G0 E2E verification report

Verified commit: 3c53e186085eb48dd081c045de8a7a5fe5a4d27f.

Result: passed on macOS arm64, using Node.js 22.22.2, Zulu JDK 21.0.11 and Maven 3.8.4. The packaged CLI ran against isolated H2 with a deterministic local model and a test trusted-principal adapter. The Spring coordinator, SQL persistence, Hosted Harness, production Broker and separate worker were real components; Sessions were admitted through public HTTP, without direct store creation or a replacement Broker.

Final verification after restoration:

• Targeted server suite: 66 tests, 0 failures, 0 errors, 0 skipped; the production-path test took 3.757 seconds in the final run.
• SDK suite: 18 tests, 0 failures, 0 errors, 0 skipped.
• npm run build, npm run typecheck, npm run bundle, Checkstyle, Prettier checks and git diff --check: passed. Checkstyle reported zero violations.
• Five complete undirected/reverse audit rounds ended with two consecutive clean passes. An additional fresh-context minimal review read all 21 changed files and found no reportable issue. After round five, only Critical fixes were eligible; no further source change was needed.

Baseline: the globally installed CLI could not start the Hosted profile, so the baseline used the existing isolated admission suite (17 passing tests). That establishes the original creation gate, not a passing tool-execution baseline.

Limits: local MySQL, real provider behavior, production authentication, concurrent/restart replay and SSE client reconnect were not tested. The terminal evidence is a persisted public-event count plus public event content. The existing Hosted MySQL CI profile includes the new integration test. G1–G3 recovery and later Workspace operations remain outside this change.

Real-stack verification — G0 public Workspace file turns @ 3c53e186

Verdict: no blocker. The G0 claims hold on a real MySQL stack, on both creation surfaces and with a real model. I suggest landing it together with the two-commit candidate patch (+154/−0; it applies to the head and to head ⊕ main): F1 is a 10-line coordinator fix and F2 is one test. F3 needs a scope sentence in Risk, not a code change in this PR.

Setup. The stack was the production Spring jar with its embedded Runtime Broker, a separate managed-runtime-worker, the packaged Hosted Harness (dist/cli.js serve --profile hosted-harness) and MySQL 8.4.7. Only two parts were stand-ins: a deterministic OpenAI-compatible model and a trusted-principal filter of the same shape as the IT's. Every Session was created through public HTTP, and a wire tap recorded Spring → Harness traffic. I ran four arms:

• the PR head, 3c53e186;
• the base, bc8879ee;
• PR ⊕ main 9f6138ae (a clean merge whose jar classes are CRC-identical to the PR's);
• the candidate.

The author's E2E ran on H2; this run adds local MySQL.

What holds

Findings

F1 — An authorization refusal at dispatch is retried and reported as "Harness unavailable" (minor; candidate fix).

• Cause: QwenHostedHarnessConnector.createOrLoad rechecks the binding through WorkspaceExecutionStore.authorize, which throws RuntimeBrokerException(409, workspace_unavailable, retryable=false). HarnessCoordinator.coordinate catches that as a generic RuntimeException, so transientFailure keeps retrying it until the pre-admission retry budget (5) is spent. The Turn then fails with hosted_harness_unavailable and the message "Hosted Harness remained unavailable before Turn admission."
• Reproduction: drain the Workspace, or revoke the creator's create grant, between admission and the first successful dispatch. The Turn fails after 32.9 s with the wrong code.
• Candidate fix: fail with workspace_unavailable when this refusal happens before submission. Refusals after submission, and all other Broker errors, keep the retry path.
• A/B on the real stack: the candidate fails in 1.8 s with the correct code, and the control Session still completes. The new unit test fails without the change.

F2 — No test pins the default-off gate for an otherwise admissible Workspace (test gap; candidate test).

• Removing both opt-in checks (!workspaceFilesEnabled in the store and !harness.isWorkspaceFilesAvailable() in the service) survives all 180 server unit tests and the IT.
• The masking comes from the fixture. ManagedWorkspaceAdmissionTest registers config-ws-a and configures no mounts, so the new profile/mount check refuses first and the opt-in gate is never reached.
• The candidate ManagedWorkspaceFilesOptInTest uses the fixed profile, a matching mount and the opt-in off:
  • it passes on the PR;
  • it passes with either gate removed on its own;
  • it fails with both gates removed (202 instead of 409).
• One more survivor, not covered by the patch: mount matching that ignores tenantId also survives, because the IT uses a single tenant.

F3 — One active G0 Turn per Workspace, and a crashed Turn keeps the Workspace (scope note; not introduced here).

• Concurrent creations: two creations in the same Workspace at once make the second Turn fail in 2 s. The Broker returns 409 workspace_busy, but the public event says only hosted_turn_failed. The Session cannot retry, because later submit is gated.
• Harness crash: SIGKILL of the Harness mid-Turn (after write_file ran) fails the Turn, and public cancel returns 409.
• Lease stays held: the crashed Turn's qwen_runtime_binding stays READY. Every new G0 Session in that Workspace then fails with hosted_turn_failed (workspace_busy). This still held about 10 minutes and two Spring restarts later.
• Scope: other Workspaces are unaffected.

This is the same class as #12904 (a held Workspace lease has no supported recovery) and falls under the PR's stated G1–G3 exclusion, but G0 makes it reachable from public creation. I suggest two things:

1. Surface workspace_busy in the terminal event data instead of the generic hosted_turn_failed.
2. Add one sentence to the README/design Risk section naming both limits.

Observations (no merge action needed)

• Tool calls are not visible to readers. Public items/events and the WebShell transcript carry only the prompt and the final text; the file tool calls are not projected.
• The Web Shell banner is stale. The UI (image 01) renders the G0 Session but still shows "Workspace is bound. Message execution is not available in this service yet." on it. Its creator still sends input: [], so G0 is reachable by API callers of the WebShell adapter, not from the UI. That matches "No UI changes are required".
• Pre-existing, reproduced on base: after a Harness restart, every new Turn fails with hosted_harness_generation_mismatch until Spring restarts. This includes unbound Turns on bc8879ee.
• Pre-existing worker accumulation: within one server lifetime, every Turn leaves its runtime worker running (9 Turns → 9 workers, about 1.3 GB RSS). Unbound Turns do this too; with G0, each public creation adds one worker.
• Merge sequencing (the triage question): feat(managed-agent): enable G0 public Workspace file turns #12955 and feat(managed-agent): Implement private Hosted MCP runtime (H1) #12946 (H1) both set the contract to 1.21.0, with different v1.21 sentences, and they conflict textually in managed-agent-public-api.openapi.json. Whichever lands second needs 1.22.0 and regenerated types. Test merges against test(hosted): gate Shell output capture failures (FG6f) #12954, test(managed-agent): record Hosted latency baseline #12945, feat(managed-agent): Record Managed sessions as Managed Session logs (M4) #12935 and feat(serve): implement generic Broker provider controls #12868 are clean and share no files.
• Ingress trust is still unverified: like the IT, this rig supplies the principal through a filter, so production ingress authentication remains untested. Triage's point stands.

Mutation testing

I ran 20 single mutants plus 1 combination on the Java diff:

• 14 are killed by the unit tests.
• M6–M8 (the mount, config/policy and agent admission checks) are killed only by the IT.
• M9 and M10 are equivalent when applied alone.
• M9+M10 and M16 survive (see F2).

With the candidate applied, the server suite passes 182/182 with Checkstyle.

Not covered: Windows and Linux hosts, SSE reconnect, concurrent replay of one key, and production ingress authentication.

Evidence: rig, probes, results and candidate patch. harness/candidate-f1-f2.patch can be applied with git am. Before the reported runs I ruled out three rig artifacts:

• The tap's Host header caused 403s.
• The tap did not propagate an upstream abort, which made the crash look like an endlessly RUNNING Turn.
• The first S3 variant restarted the Harness and was confounded by the generation issue above. The report uses S3b, the clean variant.

@qwen-code /triage

Review follow-up pushed in 7528ba6.

All three Critical findings are fixed:

• R1-1 / real-stack F1: permanent Workspace authorization refusal before submission now fails immediately with its original code/message. Retryable failures and Turns that were already or may have been submitted keep recovery retries.
• R1-2: README execution guidance now describes the opt-in initial file Turn and the remaining later-operation/Shell gates; stale Hosted-startup rejection claims were removed while the copied scripts' missing worker-artifact limitation remains explicit.
• R1-9: Store scope documentation now distinguishes persisted Workspace identity for bound Sessions from the configured global identity for unbound Sessions, retaining the global-ID startup requirements.

Validation: 71 targeted server tests passed, no failures/errors/skips, including the real Hosted Harness REST/WebShell file-tool integration test. Build, typecheck, bundle, Checkstyle and formatting checks passed. Before the repair, two coordinator cases failed for the reported retry/misclassification; removing the submission guard also causes two failures. After restoration, an independent probe passed 12 scenarios, including persisted and in-call submission markers beyond the pre-admission retry limit. Two complete undirected/reverse audit passes over this follow-up diff were clean, followed by an independent minimal review with no findings.

The independent dispatch probe uses mocked persistence/connector/warmer around the real coordinator; it is not a claim of a new real-DB revocation or crash test. The existing reviewer-supplied real-stack evidence remains separate.

Per the requested Critical-only policy after audit round five, these Suggestions are deferred and their threads remain open:

Additional review notes are recorded, without widening G0: real-stack F2 (otherwise-admissible default-off regression fixture) is deferred; F3 (same-Workspace contention and held lease after a crash) remains in #12904 / G1–G3, with no timeout takeover introduced. The current README already describes retained holders. H1 #12946 is still open; the second landing must reconcile the API contract version and generated output. UI projection/banner, production ingress and existing worker/restart behavior remain outside this change.

Merged current main (d5a157c45e) into this branch in a2a78369c5; GitHub now reports MERGEABLE (no conflicts).

The conflict was the shared API version/changelog. Main's v1.21 task-route 403 contract is preserved, and G0 is now v1.22 (1.22.0). Regenerated client types preserve both changes. No new feature or deferred Suggestion was added.

Merged-tree verification: 85 server tests + 1 real-process G0 integration test + 2 generated-type tests passed, with no failures or skips. The G0 test uses the rebuilt CLI and completes file-tool Turns through REST and WebShell. Build, typecheck, bundle, Checkstyle, formatting and commit-hook lint passed. Two resolution audit passes checked the full manual resolution, all five overlapping files and preservation of the 16 unchanged G0 files. The committed tree exactly matches the tested and audited tree.

已解决与主分支的冲突并推送：保留 v1.21 的任务接口 403 契约，G0 顺延至 v1.22。上述 88 项测试及构建、类型与格式检查通过；两轮解决冲突审计无新增问题。GitHub 已确认无冲突，合并仍以 CI 和所需审批为准。

Fixed the CI failure and the current Critical capability-description mismatch in 312d96b.

The Ubuntu/Node 22 job failed seven positive skill-listing cases because the merged test fixture supplied a SkillManager but reported no registered Skill tool. The fix registers Skill only in that matrix's existing mock; all original assertions remain. The original file went from 7 failed / 74 passed to 81 passed. Production resume and tool-policy gates are unchanged.

Validation:

• 174 focused core tests and 2 generated-contract tests pass.
• Reverse verification: bypassing the per-agent policy makes all four denied/unreachable cases fail; the original production code was restored.
• Root build, typecheck and bundle pass, as do changed-file lint/format checks.
• Independent test-engineer verification passes the original 81-case file and the packaged CLI skill-discovery smoke. That smoke starts a fresh session; it is not a real paused-background-agent recovery test.
• Audit rounds 10 and 11 are consecutive clean full-diff passes; an additional independent minimal review found no actionable defect.

The three renewed Critical reports against the old 3c53e18 implementation were checked against the current code; their 7528ba6 fixes remain present, and those duplicate conversations are resolved. R1-4's current contract text and generated client are corrected, and both conversations for it are resolved. The six remaining Suggestions (R1-3, R1-5, R1-7, R1-8, R1-12 and R1-14) remain deferred and open under the requested Critical-only policy after round five. The new GitHub CI run is pending; local results do not claim a green Ubuntu run.

已修复 CI 的七个失败用例及 R1-4 的能力契约说明。176 项定向测试、build/typecheck/bundle、两轮完整自查和独立验证通过；已修复问题的评论线程均已 Resolve。其余六条 Suggestion 按第五轮后的规则继续延期，新提交的 GitHub CI 正在等待结果。

Follow-up to the previous CI report: the remote rerun exposed an integration-tree difference that the previous local checks missed. The workflow checked out a synthetic merge containing the newer takeover reconciliation change from main. Acquisition now scans the original worker journal and settles the execution before returning, so the old UNKNOWN / RESOLVED expectations were no longer valid. The earlier held-response fix addressed a separate reproducible fixture race, but was insufficient for this merged contract.

Commit 97081c21f3 synchronizes main and keeps the deterministic crash window. The test requires no committed result before the first Broker is killed, requires SETTLED immediately after the replacement Broker acquires the original session, and requires same-execution replay followed by ALREADY_SETTLED. Original worker identity, binding generation, endpoint, marker contents, one initial execute and zero replayed executes remain checked. No new production behavior is introduced by the CI repair.

Verification on the integrated tree: root build, typecheck and bundle passed; 174 core regression tests, 149 Broker/takeover/repository tests, all 39 process fault gates, 39 focused Managed Agent/G0 tests, and the real-CLI HostedPublicWorkspaceIT passed without skips. Checkstyle passed. An independent test engineer verified both placements with an additional 3.5-second delay, and confirmed that deliberately delivering the result before crash or preventing worker execution makes the corresponding assertions fail. These local process checks use macOS/H2; GitHub provides the Linux/MySQL confirmation.

Two further complete self-audit passes, including reverse checks of the test evidence, and an independent scoped static review found no actionable issue. The committed tree exactly matches the tested and audited tree; commit-hook formatting and lint passed. The six previously recorded Suggestions remain deferred under the requested Critical-only policy; the eight fixed conversations are resolved.

Remote confirmation: the Java SDK workflow for 97081c2 is now fully successful. The previously failing Hosted process fault-gate job checked out synthetic merge 8290747, whose complete tree matches the locally tested commit. Its logs confirm 190 Managed Agent unit tests, all 10 Hosted integration cases (including G0), and all 39 Runtime Broker fault gates passed with zero failures, errors or skips; the durable-worker class passed all 10 cases. The platform matrix, MariaDB integration and real daemon E2E jobs also passed. This report supersedes the earlier local-only diagnosis.

At this update, unrelated Node tests, visual capture and automatic review checks are still running; this is confirmation of the repaired Java workflow, not a claim that every PR check has finished.

Merged current main (fa4a4c92ce) in defcd631ad and resolved the single conflict with its parallel durable-worker fault-gate repair.

The resolution preserves this branch's deterministic held-response crash window and strict takeover-settlement assertions, which already passed the prior GitHub run. It retains original worker identity, successful result, and no-replay checks. All 23 existing authored paths are unchanged; the other 12 incoming paths match main exactly. No G0 production behavior or deferred Suggestion was added.

Merged-tree verification: build, typecheck and bundle passed; 65 trajectory UI tests and all 10 durable-worker fault-gate cases passed with no failures or skips. Checkstyle passed. Two clean resolution-audit passes, including a reverse check of the test evidence and exact path preservation, are complete.

The committed tree exactly matches the verified tree; commit-hook lint and formatting passed. GitHub now reports MERGEABLE (no conflicts). The new Java CI run is queued; this does not claim the new commit has completed CI.

Merged main a903de1112 (W0e-3 trusted local reboot recovery and exact-integer validation) in fcb77a33f1. The only manual conflict was the deployment-boundary paragraph: it now preserves the new trusted-host reboot recovery scope and the existing G0 opt-in initial file Turn, while keeping later public operations and public Shell gated.

The two configuration overlaps preserve both independent, default-off options and their existing validations. No production source was manually changed for the conflict. All 20 unaffected authored paths match the previous PR head; all 46 non-overlapping incoming paths match main.

Merged-tree verification passed: root build, typecheck and bundle; 276 Broker tests, 65 focused Managed Agent tests, two real-worker/CLI integration tests and all 41 fault gates (384 tests total, no failures or skips). Checkstyle and two consecutive resolution audits, including reverse verification of the assertions and path preservation, passed. The integration tests use H2 and synthetic boot identity; they are not a new physical Linux reboot certification.

The committed tree exactly matches the tested/audited tree, and the working tree is clean. GitHub confirms MERGEABLE (no conflicts). The new Java CI run is queued; its result is still pending.

@qwen-code /triage

PR 12955 — local real-environment verification (follow-up round)

Verdict: findings — 15 passed · 1 failed · 16 total scripted assertions. The single failure is pre-existing on this host and proven not PR-caused (A/A control on base fails identically; see Finding 1). The PR's own claims all held: the central G0 claim passed its A/B on both H2 and a real local MySQL 8.0.45, and the only PR-authored production change since the last verified head is pinned by its new tests.

Verified head: fcb77a33f1dff4351584600c25587adb1c9270e0 (gh pr view headRefOid, fetched and checked out). Base: a903de1112a69259b30b914dbba84eb554802ed1 (baseRefOid). Host: Linux aarch64 (Orange Pi 5, Armbian/Ubuntu 22.04), Node v24.13.0, Oracle JDK 21+35, Maven 3.9.0, MySQL 8.0.45 — a platform cell no earlier round covered (author: macOS arm64; CI: Linux x86_64).

Previous-finding status (carried forward, re-measured at fcb77a33f1)

Central claim and A/B (re-measured)

Central claim. With the opt-in enabled on a validated deployment shape, an authorized public Workspace Session creation (REST and WebShell adapter) runs one initial Read/Write/Edit Turn through the production Hosted Harness → Broker → worker under the selected Workspace cwd; at base, the same creation is refused.

Same IT blob on both arms (HostedPublicWorkspaceIT.java, sha256 559c960a…, cp-verified; byte-identical to round 1's), same bundled CLI on both arms (dist/cli.js built from head — a valid constant: base's daemon already carries toolProfile support, 11 references in hosted-harness-session.ts at a903de1112, verified by git grep). Base Java artifacts (qwencode, runtime-broker, managed-agent-server) were built from the base worktree into an isolated Maven repository (-Dmaven.repo.local=/root/.m2-pr12955-base) so no head artifact could leak into the control.

Both base reds fail the intended assertion with named expected/actual values and are scored as passes. Witness: 07-ab-it-cells-h2-mysql.png.

Delta since the last verified head (3c53e18608 → fcb77a33f1)

The PR-authored delta is four commits; everything else is inbound main via three merges (verified under Previous-finding status / C1/C3/C5).

• 7528ba60a2 — the only production change (+5 lines in HarnessCoordinator.coordinate: a dedicated catch (RuntimeBrokerException) that fails fast with the original code/message when the refusal is non-retryable and submission was not attempted; recovery retries otherwise). Load-bearing proof: reverting the hunk in a scratch checkout turns exactly classifiesWorkspaceRefusalBeforeSubmission[1] and [2] red at the intended failTurn(..., "workspace_unavailable", ...) verification (17 run / 2 failures); restored, the class is 17/17 green. The workspaceRefusal=true variant of doesNotExhaustAfterSubmissionMayHaveBeenAdmitted correctly survives the revert — it pins the unchanged post-submission recovery path. Witness: 08-mutation-coordinator-pins-fix.png.
• 312d96b8e1 — capability contract text + resume-listing fixture. Verified: regenerated client types byte-identical (C4); packages/core background-agent-resume.test.ts 81/81 (D4).
• 147740556b / 97081c21f3 — durable-worker crash-window pin + fault-gate alignment (test-only). The fault-gate suite ran here with one pre-existing failure — see Finding 1. The pinned method itself (brokerCrashAdoptsOriginalWorkerWithoutReplaying, the method the PR modifies) passed in every run (class-level 9–10/10 each time, only adoptedWorkerCanCancelItsOriginalActiveCall failed).

Targeted gates (head)

Findings

1 — Pre-existing, not PR-caused: adoptedWorkerCanCancelItsOriginalActiveCall deterministically fails on this Linux aarch64 host. (Does not block this PR; likely wants a tracking issue.)

• Symptom. runtime-broker -Pfault-gates: 40/41 green; the failing case asserts proxy.count("cancel") == 1 ("cancellation must reach the original active worker") and gets 0 — the second Broker answers cancel with OK but never forwards it to the adopted original worker. The test's downstream assertions (which this run never reached) imply the worker then runs to completion — a quiet wrong-answer shape, not a loud crash.
• Attribution (A/A control, measured). The base tree fails the same assertion the same way (1/1 class run); on head the method failed 4/4 single-method runs (both placements) and 2/2 full-class runs; which placement loses varies between runs, marking a timing race widened on this slow board. The failing method is not modified by the PR (the PR touches only brokerCrashAdoptsOriginalWorkerWithoutReplaying in the same file); the PR diff contains zero runtime-broker production files (base already carries feat(runtime-broker): reconcile executions on session takeover #12964 takeover reconciliation); GitHub CI's fault-gate job is green at this head (run 36559630341, MySQL 8.4 / x86_64). Conclusion: host/platform-specific pre-existing race in main's takeover cancel path, not a regression this PR introduces.
• Suggested handling. Not a merge condition for feat(managed-agent): enable G0 public Workspace file turns #12955. Worth a repo tracking issue for Linux aarch64 (or slow-host) fault-gate coverage: on this platform a cancel acknowledged-but-never-forwarded is deterministic, and CI currently has no lane that would see it. Witness: 09-faultgate-preexisting-aa.png.

No other findings. Round-1's carried Suggestion (store admission block pinned only by the IT) still stands and is recorded in the status table above; it remains completeness reporting, not a merge condition.

Not covered

• Windows and local x86_64 Linux (CI covers x86_64; this run adds aarch64).
• Real model providers and production ingress authentication — the IT supplies a deterministic local model and a trusted-principal filter, same as round 1 and the author's rig; triage's ingress point stands.
• Concurrent/restart replay and SSE reconnect — author-declared out of scope; not re-attempted.
• The rest of the Hosted*IT family — invocation narrowed to -Dit.test=HostedPublicWorkspaceIT (the CI report gate would reject this narrowing; locally it is deliberate scoping, not a claim about the family).
• F3 re-measurement (same-Workspace contention / held lease) — deferred to Hosted Shell: recover a Workspace lease after incomplete pipe capture #12904 / G1–G3 by declaration; no new evidence here.
• Root-cause of Finding 1 in main's broker code — attribution is settled by the A/A control; the mechanism (takeover re-attach losing the race to cancel on slow hosts) is a hypothesis from the failure shape, not a proven root cause.
• Web Shell UI — the IT exercises the WebShell adapter over HTTP, not the browser UI; the round-1 observation about the stale UI banner was not re-checked.
• Repo-wide JS gates (lint, typecheck, full vitest suites) — not re-run; the PR's JS footprint is one generated-file doc comment + one test fixture, both directly exercised above.
• The 9 skipped SDK tests — pre-existing conditional skips, uninvestigated.

Methodology

Local maintainer-driven round on an Orange Pi 5 (aarch64, 8 cores), worktrees at tmp/pr12955-head (fcb77a33f1) and tmp/pr12955-base (a903de1112). Head JS side installed with corepack pnpm install --frozen-lockfile (the repo retired package-lock.json in #11859; npm ci fails on these trees — harness fault #1, corrected) then npm run build && npm run bundle; dist/cli.js smoke-checked (--version → 0.24.6). Java side built with Oracle JDK 21 + Maven 3.9.0 with -Dgpg.skip=true (the qwencode pom signs by default and this host has no secret key — harness fault #2, corrected); head artifacts in ~/.m2, base artifacts in an isolated /root/.m2-pr12955-base seeded by a full copy. The A/B drove the same IT blob + same dist/cli.js against head and base production code; the MySQL arms used a dedicated hosted_harness_test schema + hosted user on the host's existing MySQL 8.0.45 (created for this round; no pre-existing schemas touched). The mutation probe used git apply -R of the exact 7528ba60a2 hunk with a trap-guaranteed restore; tree verified clean afterwards (git status --porcelain empty). Every assertion above maps to a scripted check whose raw log is in this directory: logs-it-{head,base}-{h2,mysql}.txt, logs-D1-server-tests.txt, logs-D2-sdk-tests.txt, logs-D3-fault-gates.txt, logs-D3b-durable-head-rerun.txt, logs-D3c-durable-base.txt, logs-D4-resume-test.txt, logs-mut-B2.txt, logs-C4-generate.txt, build logs. Assertion ledger: record.mjs → assertions.json / assertions-detail.json. Captures made with scripts/verify-capture.mjs.

Evidence images

— Local maintainer verification round (verify-pr skill, local publish path)

All 13 unresolved Suggestions from this PR now have separate follow-up issues: the six originally deferred items and seven from the later review. Each issue links its source discussion and records the requested work and acceptance criteria.

The original conversations have issue links and remain open until their fixes are implemented. The post-submission refusal item tracks a recovery-policy decision; it does not approve failing an uncertain submission based only on a missing local watermark. The two related coordinator-test items link to that policy issue.

已把全部 13 条未解决 Suggestion 分别转为 Issue（此前 6 条及后续 7 条），并回填原讨论；创建 Issue 不代表已经修复。