fix(runtime): reuse healthy organ receipts on restart

2026-09-13 10:30:57 +08:00 · 2026-09-13 10:30:57 +08:00 · 22d0f3e25e
commit 22d0f3e25e
parent 05b74073c1
6 changed files with 336 additions and 1 deletions
--- a/runtime/fifth-domain-language-system/language/protocols/TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913.gir.json
+++ b/runtime/fifth-domain-language-system/language/protocols/TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913.gir.json
@ -0,0 +1,83 @@
+{
+  "compiled_from": {
+    "compiler_id": "TCS-COMPILER-STAGE1-0001",
+    "compiler_state": "TCS_COMPILER_GIR_EXECUTED",
+    "source_sha256": "8275192c10981cf196822d7cc133ad470dcfc3c518d09479f08bf21660d611fb"
+  },
+  "declaration": {
+    "emergence": {
+      "value": "启动先验证既有器官签名和源哈希；健康则复用，疼痛、缺失或漂移才重跑自检。"
+    },
+    "event_time": {
+      "precision": "HOST_LOCAL_DATE",
+      "value": "2026-09-13"
+    },
+    "evidence": {
+      "prebootstrap": "PASS_10_PERSONAS",
+      "rescue_boots": "2",
+      "test": "HEALTHY_ORGAN_RECEIPT_REUSED_ON_RESTART"
+    },
+    "header": {
+      "canonical_uri": "runtime/fifth-domain-language-system/language/protocols/TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913.tcs",
+      "compatibility": [
+        "JD-FD-PRIMARY",
+        "ICE-BB-0006",
+        "ICE-BB-0007",
+        "ICE-BB-0008"
+      ],
+      "language": "TCS/0.1",
+      "lifecycle": "CANDIDATE",
+      "name_en": "Multi Persona Organ Startup Idempotence Correction",
+      "name_zh": "多人格器官启动幂等纠正",
+      "profile": "HLDP-HUMAN-ENGINEERING/0.1",
+      "protocols": [
+        "GLS-0200",
+        "GLS-0400"
+      ],
+      "schema": "tcs.event/v1",
+      "version": "1.0.0"
+    },
+    "lock": {
+      "value": "healthy_signed_organ_receipt=reuse; pain_or_source_drift=rerun_self_test; supervisor_timeout_unchanged=5_seconds; prebootstrap_required_for_new_long_time_chains=true"
+    },
+    "observation": {
+      "value": "源哈希未漂移且签名CURRENT健康时，重复运动自检不会增加启动置信，反而破坏主控可用性。"
+    },
+    "rejected": {
+      "values": [
+        "放宽光湖主控故障门",
+        "每次启动重写所有器官回执",
+        "删除救援证据",
+        "未验证就再次重启"
+      ]
+    },
+    "source": {
+      "source_id": "BINGSHUO-DIRECT-CONTINUE-BOTTLE-0006-0008-20260913",
+      "source_role": "DIRECT_HUMAN",
+      "source_sha256": "33994b1a1f210c738f31138c124fc403d17d56844725fbc40ae6c9575d82f392",
+      "source_uri": "source://codex-current-dialogue/2026-09-13/continue-bottle-0006-0008"
+    },
+    "subject": {
+      "channel_id": "ICE-CH-ZC001",
+      "subject_id": "ICE-P-ZY001",
+      "subject_kind": "PERSONA",
+      "verification": "十人格状态预生成成功，但每次启动重复写十份器官自检回执，超过光湖主控5秒服务恢复窗口并两次触发Linux救援。"
+    },
+    "trigger": {
+      "value": "器官自检实现缺少已签名健康状态复用。"
+    },
+    "why": {
+      "value": "保持严格故障门，同时让健康器官具备幂等启动，才不会把自检本身变成系统故障源。"
+    }
+  },
+  "executable": false,
+  "identity": {
+    "declaration_id": "TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913",
+    "declaration_kind": "EVENT",
+    "language_version": "0.1"
+  },
+  "native_self_hosted": true,
+  "natural_language_is_typed_data": true,
+  "schema": "guanghu.declaration-gir/v1",
+  "unresolved_natural_language": false
+}
--- a/runtime/fifth-domain-language-system/language/protocols/TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913.human.en-US.md
+++ b/runtime/fifth-domain-language-system/language/protocols/TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913.human.en-US.md
@ -0,0 +1,117 @@
+# Multi Persona Organ Startup Idempotence Correction · Human Engineering Language (English)
+
+> This is an English reading projection of validated native TCS/HLDP source. It is not a new canonical source and grants no execution authority.
+
+## What this is
+
+This is a **event** declaration with identifier `TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913` and version `1.0.0`. The projector validates it with the Stage-1 compiler before changing its reading order.
+
+## Who is here
+
+- **subject**  `subject`
+  - **channel_id**：ICE-CH-ZC001  `subject.channel_id`
+  - **subject_id**：ICE-P-ZY001  `subject.subject_id`
+  - **subject_kind**：PERSONA  `subject.subject_kind`
+  - **verification**：十人格状态预生成成功，但每次启动重复写十份器官自检回执，超过光湖主控5秒服务恢复窗口并两次触发Linux救援。  `subject.verification`
+
+## Why this started
+
+- **trigger**  `trigger`
+  - **value**：器官自检实现缺少已签名健康状态复用。  `trigger.value`
+- **why**  `why`
+  - **value**：保持严格故障门，同时让健康器官具备幂等启动，才不会把自检本身变成系统故障源。  `why.value`
+- **source**  `source`
+  - **source identifier**：BINGSHUO-DIRECT-CONTINUE-BOTTLE-0006-0008-20260913  `source.source_id`
+  - **source role**：DIRECT_HUMAN  `source.source_role`
+  - **source checksum**：33994b1a1f210c738f31138c124fc403d17d56844725fbc40ae6c9575d82f392  `source.source_sha256`
+  - **source address**：source://codex-current-dialogue/2026-09-13/continue-bottle-0006-0008  `source.source_uri`
+
+## What changed
+
+- **emergence**  `emergence`
+  - **value**：启动先验证既有器官签名和源哈希；健康则复用，疼痛、缺失或漂移才重跑自检。  `emergence.value`
+- **lock**  `lock`
+  - **value**：healthy_signed_organ_receipt=reuse; pain_or_source_drift=rerun_self_test; supervisor_timeout_unchanged=5_seconds; prebootstrap_required_for_new_long_time_chains=true  `lock.value`
+
+## How it will execute
+
+This is a non-executable declaration and has no action graph.
+
+## Boundaries and exception handling
+
+The native source does not provide this field; the projector does not guess.
+
+## How completion is proven
+
+The native source does not provide this field; the projector does not guess.
+
+## Where to continue next time
+
+The native source does not provide this field; the projector does not guess.
+
+## Source and verification
+
+- **Native declaration identifier**: `TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913`
+- **Native declaration kind**: `EVENT`
+- **TCS source SHA-256**: `8275192c10981cf196822d7cc133ad470dcfc3c518d09479f08bf21660d611fb`
+- **Validation compiler**: `TCS-COMPILER-STAGE1-0001`
+- **Projection protocol**: `GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001`
+
+## Complete native structure cross-reference
+
+All top-level structures and field paths are retained below so a reader can audit whether the projection omitted information.
+
+- **emergence**  `emergence`
+  - **value**：启动先验证既有器官签名和源哈希；健康则复用，疼痛、缺失或漂移才重跑自检。  `emergence.value`
+- **event_time**  `event_time`
+  - **precision**：HOST_LOCAL_DATE  `event_time.precision`
+  - **value**：2026-09-13  `event_time.value`
+- **evidence**  `evidence`
+  - **prebootstrap**：PASS_10_PERSONAS  `evidence.prebootstrap`
+  - **rescue_boots**：2  `evidence.rescue_boots`
+  - **test**：HEALTHY_ORGAN_RECEIPT_REUSED_ON_RESTART  `evidence.test`
+- **header**  `header`
+  - **canonical source path**：runtime/fifth-domain-language-system/language/protocols/TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913.tcs  `header.canonical_uri`
+  - **compatibility**  `header.compatibility`
+    - JD-FD-PRIMARY
+    - ICE-BB-0006
+    - ICE-BB-0007
+    - ICE-BB-0008
+  - **language**：TCS/0.1  `header.language`
+  - **lifecycle**：CANDIDATE  `header.lifecycle`
+  - **English name**：Multi Persona Organ Startup Idempotence Correction  `header.name_en`
+  - **Chinese name**：多人格器官启动幂等纠正  `header.name_zh`
+  - **profile**：HLDP-HUMAN-ENGINEERING/0.1  `header.profile`
+  - **protocols**  `header.protocols`
+    - GLS-0200
+    - GLS-0400
+  - **schema**：tcs.event/v1  `header.schema`
+  - **version**：1.0.0  `header.version`
+- **lock**  `lock`
+  - **value**：healthy_signed_organ_receipt=reuse; pain_or_source_drift=rerun_self_test; supervisor_timeout_unchanged=5_seconds; prebootstrap_required_for_new_long_time_chains=true  `lock.value`
+- **observation**  `observation`
+  - **value**：源哈希未漂移且签名CURRENT健康时，重复运动自检不会增加启动置信，反而破坏主控可用性。  `observation.value`
+- **rejected**  `rejected`
+  - **values**  `rejected.values`
+    - 放宽光湖主控故障门
+    - 每次启动重写所有器官回执
+    - 删除救援证据
+    - 未验证就再次重启
+- **source**  `source`
+  - **source identifier**：BINGSHUO-DIRECT-CONTINUE-BOTTLE-0006-0008-20260913  `source.source_id`
+  - **source role**：DIRECT_HUMAN  `source.source_role`
+  - **source checksum**：33994b1a1f210c738f31138c124fc403d17d56844725fbc40ae6c9575d82f392  `source.source_sha256`
+  - **source address**：source://codex-current-dialogue/2026-09-13/continue-bottle-0006-0008  `source.source_uri`
+- **subject**  `subject`
+  - **channel_id**：ICE-CH-ZC001  `subject.channel_id`
+  - **subject_id**：ICE-P-ZY001  `subject.subject_id`
+  - **subject_kind**：PERSONA  `subject.subject_kind`
+  - **verification**：十人格状态预生成成功，但每次启动重复写十份器官自检回执，超过光湖主控5秒服务恢复窗口并两次触发Linux救援。  `subject.verification`
+- **trigger**  `trigger`
+  - **value**：器官自检实现缺少已签名健康状态复用。  `trigger.value`
+- **why**  `why`
+  - **value**：保持严格故障门，同时让健康器官具备幂等启动，才不会把自检本身变成系统故障源。  `why.value`
+
+---
+
+This page changes only the reading order; it does not change TCS/HLDP semantics.
--- a/runtime/fifth-domain-language-system/language/protocols/TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913.human.zh-CN.md
+++ b/runtime/fifth-domain-language-system/language/protocols/TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913.human.zh-CN.md
@ -0,0 +1,117 @@
+# 多人格器官启动幂等纠正 · 简体中文人类工程语言版
+
+> 这是 TCS/HLDP 原生源码的简体中文阅读投影，不是新的正本，也不授予执行权限。若本页与 `.tcs` 源码不一致，以经过校验的 `.tcs` 源码为准。
+
+## 这是什么
+
+这是一份 **事件** 声明，编号为 `TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913`，版本为 `1.0.0`。转换器已先用 Stage-1 编译器校验原生源码，再把机器枚举翻译成汉语；原始编号保留在括号和字段路径中。
+
+## 谁在这里
+
+- **执行主体**  `subject`
+  - **channel_id**：ICE-CH-ZC001  `subject.channel_id`
+  - **subject_id**：ICE-P-ZY001  `subject.subject_id`
+  - **subject_kind**：人格体（`PERSONA`）  `subject.subject_kind`
+  - **verification**：十人格状态预生成成功，但每次启动重复写十份器官自检回执，超过光湖主控5秒服务恢复窗口并两次触发Linux救援。  `subject.verification`
+
+## 为什么开始
+
+- **触发**  `trigger`
+  - **value**：器官自检实现缺少已签名健康状态复用。  `trigger.value`
+- **为什么**  `why`
+  - **value**：保持严格故障门，同时让健康器官具备幂等启动，才不会把自检本身变成系统故障源。  `why.value`
+- **来源**  `source`
+  - **来源编号**：BINGSHUO-DIRECT-CONTINUE-BOTTLE-0006-0008-20260913  `source.source_id`
+  - **来源角色**：人类直接语言来源（`DIRECT_HUMAN`）  `source.source_role`
+  - **来源校验值**：33994b1a1f210c738f31138c124fc403d17d56844725fbc40ae6c9575d82f392  `source.source_sha256`
+  - **来源地址**：source://codex-current-dialogue/2026-09-13/continue-bottle-0006-0008  `source.source_uri`
+
+## 发生了什么变化
+
+- **认知或状态变化**  `emergence`
+  - **value**：启动先验证既有器官签名和源哈希；健康则复用，疼痛、缺失或漂移才重跑自检。  `emergence.value`
+- **锁定结论**  `lock`
+  - **value**：healthy_signed_organ_receipt=reuse; pain_or_source_drift=rerun_self_test; supervisor_timeout_unchanged=5_seconds; prebootstrap_required_for_new_long_time_chains=true  `lock.value`
+
+## 准备怎样执行
+
+这是非执行声明，没有动作图。
+
+## 边界与异常处理
+
+源程序没有提供这一项，转换器不猜。
+
+## 怎样算完成
+
+源程序没有提供这一项，转换器不猜。
+
+## 下一次从哪里继续
+
+源程序没有提供这一项，转换器不猜。
+
+## 来源与校验
+
+- **原生声明编号**：`TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913`
+- **原生声明类型**：`EVENT`
+- **TCS 源码 SHA-256**：`8275192c10981cf196822d7cc133ad470dcfc3c518d09479f08bf21660d611fb`
+- **校验编译器**：`TCS-COMPILER-STAGE1-0001`
+- **投影协议**：`GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001`
+
+## 原生结构逐项对照
+
+下面保留源码的全部顶层结构和字段路径，供人类审计投影有没有漏掉信息。
+
+- **认知或状态变化**  `emergence`
+  - **value**：启动先验证既有器官签名和源哈希；健康则复用，疼痛、缺失或漂移才重跑自检。  `emergence.value`
+- **event_time**  `event_time`
+  - **precision**：HOST_LOCAL_DATE  `event_time.precision`
+  - **value**：2026-09-13  `event_time.value`
+- **evidence**  `evidence`
+  - **prebootstrap**：PASS_10_PERSONAS  `evidence.prebootstrap`
+  - **rescue_boots**：2  `evidence.rescue_boots`
+  - **test**：HEALTHY_ORGAN_RECEIPT_REUSED_ON_RESTART  `evidence.test`
+- **语言头**  `header`
+  - **正本路径**：runtime/fifth-domain-language-system/language/protocols/TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913.tcs  `header.canonical_uri`
+  - **compatibility**  `header.compatibility`
+    - JD-FD-PRIMARY
+    - ICE-BB-0006
+    - ICE-BB-0007
+    - ICE-BB-0008
+  - **语言**：TCS/0.1  `header.language`
+  - **生命周期**：候选版本，尚未成为正式正本（`CANDIDATE`）  `header.lifecycle`
+  - **英文名**：Multi Persona Organ Startup Idempotence Correction  `header.name_en`
+  - **中文名**：多人格器官启动幂等纠正  `header.name_zh`
+  - **协议配置**：HLDP-HUMAN-ENGINEERING/0.1  `header.profile`
+  - **protocols**  `header.protocols`
+    - GLS-0200
+    - GLS-0400
+  - **schema**：tcs.event/v1  `header.schema`
+  - **版本**：1.0.0  `header.version`
+- **锁定结论**  `lock`
+  - **value**：healthy_signed_organ_receipt=reuse; pain_or_source_drift=rerun_self_test; supervisor_timeout_unchanged=5_seconds; prebootstrap_required_for_new_long_time_chains=true  `lock.value`
+- **observation**  `observation`
+  - **value**：源哈希未漂移且签名CURRENT健康时，重复运动自检不会增加启动置信，反而破坏主控可用性。  `observation.value`
+- **已排除路径**  `rejected`
+  - **values**  `rejected.values`
+    - 放宽光湖主控故障门
+    - 每次启动重写所有器官回执
+    - 删除救援证据
+    - 未验证就再次重启
+- **来源**  `source`
+  - **来源编号**：BINGSHUO-DIRECT-CONTINUE-BOTTLE-0006-0008-20260913  `source.source_id`
+  - **来源角色**：人类直接语言来源（`DIRECT_HUMAN`）  `source.source_role`
+  - **来源校验值**：33994b1a1f210c738f31138c124fc403d17d56844725fbc40ae6c9575d82f392  `source.source_sha256`
+  - **来源地址**：source://codex-current-dialogue/2026-09-13/continue-bottle-0006-0008  `source.source_uri`
+- **执行主体**  `subject`
+  - **channel_id**：ICE-CH-ZC001  `subject.channel_id`
+  - **subject_id**：ICE-P-ZY001  `subject.subject_id`
+  - **subject_kind**：人格体（`PERSONA`）  `subject.subject_kind`
+  - **verification**：十人格状态预生成成功，但每次启动重复写十份器官自检回执，超过光湖主控5秒服务恢复窗口并两次触发Linux救援。  `subject.verification`
+- **触发**  `trigger`
+  - **value**：器官自检实现缺少已签名健康状态复用。  `trigger.value`
+- **为什么**  `why`
+  - **value**：保持严格故障门，同时让健康器官具备幂等启动，才不会把自检本身变成系统故障源。  `why.value`
+
+---
+
+本页只改变阅读顺序，不改变 TCS/HLDP 语义。
--- a/runtime/fifth-domain-language-system/language/protocols/TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913.tcs
+++ b/runtime/fifth-domain-language-system/language/protocols/TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913.tcs
@ -0,0 +1,14 @@
+TCS 0.1;
+EVENT TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913 {
+  header { schema = "tcs.event/v1"; name_zh = "多人格器官启动幂等纠正"; name_en = "Multi Persona Organ Startup Idempotence Correction"; version = "1.0.0"; language = "TCS/0.1"; profile = "HLDP-HUMAN-ENGINEERING/0.1"; protocols = ["GLS-0200", "GLS-0400"]; lifecycle = "CANDIDATE"; canonical_uri = "runtime/fifth-domain-language-system/language/protocols/TCS-EVENT-PERSONA-ORGAN-STARTUP-IDEMPOTENCE-CORRECTION-20260913.tcs"; compatibility = ["JD-FD-PRIMARY", "ICE-BB-0006", "ICE-BB-0007", "ICE-BB-0008"]; }
+  source { source_id = "BINGSHUO-DIRECT-CONTINUE-BOTTLE-0006-0008-20260913"; source_uri = "source://codex-current-dialogue/2026-09-13/continue-bottle-0006-0008"; source_sha256 = "33994b1a1f210c738f31138c124fc403d17d56844725fbc40ae6c9575d82f392"; source_role = "DIRECT_HUMAN"; }
+  subject { subject_id = "ICE-P-ZY001"; subject_kind = "PERSONA"; channel_id = "ICE-CH-ZC001"; verification = "十人格状态预生成成功，但每次启动重复写十份器官自检回执，超过光湖主控5秒服务恢复窗口并两次触发Linux救援。"; }
+  event_time { value = "2026-09-13"; precision = "HOST_LOCAL_DATE"; }
+  trigger { value = "器官自检实现缺少已签名健康状态复用。"; }
+  observation { value = "源哈希未漂移且签名CURRENT健康时，重复运动自检不会增加启动置信，反而破坏主控可用性。"; }
+  emergence { value = "启动先验证既有器官签名和源哈希；健康则复用，疼痛、缺失或漂移才重跑自检。"; }
+  lock { value = "healthy_signed_organ_receipt=reuse; pain_or_source_drift=rerun_self_test; supervisor_timeout_unchanged=5_seconds; prebootstrap_required_for_new_long_time_chains=true"; }
+  why { value = "保持严格故障门，同时让健康器官具备幂等启动，才不会把自检本身变成系统故障源。"; }
+  rejected { values = ["放宽光湖主控故障门", "每次启动重写所有器官回执", "删除救援证据", "未验证就再次重启"] ; }
+  evidence { rescue_boots = "2"; prebootstrap = "PASS_10_PERSONAS"; test = "HEALTHY_ORGAN_RECEIPT_REUSED_ON_RESTART"; }
+}
--- a/server-tools/tcs-mother-body/persona-runtime-hub.mjs
+++ b/server-tools/tcs-mother-body/persona-runtime-hub.mjs
@ -85,7 +85,9 @@ export class PersonaRuntimeHub {
    const loop = new PersonaSelfLoop({root: this.root, shelf: this.shelf, router: this.router, personaId: entry.persona_id, now: this.now,
      requireLifeLine: this.requireLifeLine, lifeTimeBootstrapPath: this.resolve(entry.life_time_bootstrap), profile});
    const organ=new PersonaOrganReflex({root:this.root,personaId:entry.persona_id,shelf:this.shelf,sourcePaths:[this.resolve(entry.self_kernel),memoryPath,...(isBaby?[this.bottleEnvironmentPath]:[])],now:this.now});
-    organ.selfTest();loop.profile.organHealthProvider=()=>organ.status();
+    const priorOrgan=organ.status();
+    if(priorOrgan.state!=='NATIVE_ORGAN_REFLEX_HEALTHY_AWAITING_PARENT_BRAIN_WAKE_CYCLE')organ.selfTest();
+    loop.profile.organHealthProvider=()=>organ.status();
    this.loops.set(entry.persona_id, {entry, loop, organ});
  }

--- a/server-tools/tcs-mother-body/persona-runtime-hub.test.mjs
+++ b/server-tools/tcs-mother-body/persona-runtime-hub.test.mjs
@ -80,3 +80,5 @@ test('one baby evolves only its own signed self while the shared environment rem
    assert.equal(call.input.contract.environment_may_overwrite_self,false);
  } finally { fs.rmSync(ctx.temporary,{recursive:true,force:true}); }
 });
+
+test('healthy signed organ receipts are reused on restart instead of rewriting every persona during boot',()=>{const first=setup();try{const sequence=first.hub.organ('ICE-BB-0006').status().sequence;const second=new PersonaRuntimeHub({root:path.join(first.temporary,'state'),shelf:first.hub.shelf,router:first.hub.router,repoRoot,registryPath:path.join(repoRoot,'server-tools/tcs-mother-body/persona-runtime-registry.json'),now:()=>new Date('2026-09-13T08:01:00.000Z')});assert.equal(second.organ('ICE-BB-0006').status().sequence,sequence);}finally{fs.rmSync(first.temporary,{recursive:true,force:true});}});