Record real Hermes cancellation and native stream failure evidence

docs/3.0/PROGRESS.md

@@ -1,5 +1,17 @@
 # PROGRESS · Clawket 3.0 进度日志
 
+- 2026-10-16 Native 真实 Hermes Stop 定位与复验（独立探索；RN 保持默认）。
+  - #274 exactca7f9393/base76bc45b9在current-main/CLEAN、全13 CI绿后合8afa5784并finish；App314/314零失败/跳过（57.765秒test/80.504秒wall）、package459、19语两表9082精确编译值。primary既有node_modules保留，自有开发副本/证据保存在SSD，不发行。工作入口/菜单实际验收边界见下条，不以CI替代真实后端。
+  - 新任务从fresh main独立工作树开始，仅用既有owner QA route与baseline physical/首条自有输入比对。原生registry只在QA独立Keychain，未扫Vault或按剩余Hermes行猜observer身份；未启动原observer或覆写旧结果。独立loopback probe前后各定向history，先确认无活动，单次send，等真实非空delta，再核samephysical/inFlightRun精确归属后唯一次Stop。20秒绝对RPC预算、总145秒、事件只保留本QA的128KiB/256条紧凑类别/布尔，未知不重试，凭据只内存、不输出URL/正文。
+  - 实际独立probe发送1/停止1，7毫秒收到ACK，随后真实aborted且samephysical/hasActiveRun=false，取消通过该桥接窗口。不是Native UI、原Direct、Relay或稳定性证明；先前真实App Stop失败的原因仍未证，没有据此修改超时/认证/服务。后续实际App复验继续，保留原QA草稿与合成Studio资源/held项。
+  - source35（与main8afa的Swift/PBX完全相同）实际App复验：原saved-connection精确ID、导航偏好精确QA route、samephysical和原16字草稿均核对；系统Paste固定非秘密prompt原UTF8/落盘匹配后只点Send一次。被动独立reader在预检noactive后绑定本次唯一新owned input的实际receipt runID，确收该run非空delta，后续Work检查阶段未通过（unknown，控件visible=false）；尚未点Stop，不能称本轮Stop失败。该份XML无Alert节点，稍后截图实际出现Runtime类通用错误提示，不能倒推其准确出现时点；同窗只读head已samephysical/noactive，本地新reply仍1字符/streaming=true。
+  - 两个只读审查确认Hermes生产Bridge转发的是incremental delta，Native却固定.snapshot覆盖；这是1/2字符的确定缺陷，独立#275修复/真mapper→consumer回归继续，不用它解释尚未采到类别的Alert。首次LLDB仅断点位置存在，stdin continue异步后5表达式均process_running，无真实breakpoint hit/typed值，已detach；不是capacity/调用阶段证据，下轮先同步continue并验证真实stop reason。
+  - 未重发/追加Stop。实际系统OK后恢复原16字draft与0refs、held0/queued0/sending0，Studio原空draft/三refs/held1亦不变；私有失败原文档保留。自有QA app/WDA停、runner75、ownSIM Shutdown、两lease释放给#275窄测/开发编译；真实App Stop、提前Alert/stream恢复仍未通过，RN默认/服务/凭据/发布均未变。
+  - #275 production653开发包双arch/codesign通过后接续真实验收；冷启前轮全文与原草稿恢复。新专用prompt系统Paste/落盘原UTF8核对，Send1、向enabled Stop控件发出WebDriver点击1次（未证明handler/abort RPC已进入）；被动reader绑定本次真实receipt并见非空live，最后terminal=final而非aborted，取消仍未通过。Native连续保留数段正文（本地355字节/streaming=true），不再只剩尾token，但实际Runtime通用失败提示仍出现；本轮observer固定快照落盘，不丢失失败时终态证据。
+  - 同步LLDB这次真实命中showFailure，caller=event_stream；ACK并恢复原draft后只重选精确saved connection、Send0/Stop0，另次命中caller=activate。均已detach。Swift expression因本机SwiftUICore PCM/modulemap过期失败，未采到code/delivery/retryable，不能伪称capacity实测。源码唯一throwing eventContinuation.finish位于有界队列溢出，count/bytes未采样；独立runtime-buffer窄修复继续。未重启/改共享服务、未放大容量或猜重试。
+  - #275 finalcfa6a69a（Swift/PBX与production653完全等价）在current-main/CLEAN全13 CI绿后合3efd84b3并finish。App315/315零失败/跳过（80.696秒test/134.357秒wall）、package465=59+406、19语两表9082精确编译值；开发App/modules/dSYM/source copy独立保留，非发行或完整真实后端验收。
+  - source653普通字号/浅色/普通对比度Studio实际预览→Done原code按钮y偏移0；Copy即时“已复制”及simulator pasteboard精确45字节含尾换行、显式Latest、Work→Done→菜单→连接设置→Done通过。后台WDA pasteboard空值不作复制失败，已独立读实际simulator剪贴板核对。未Send或重发held；真QA原16字draft/0refs及Studio空draft/原三refs/held1、两者queued0/sending0保留。初验可聚焦聊天/编辑/附件与导航，真实Stop/恢复与完整N5仍未通过。
+
 - 2026-10-16 Native Hermes 实时增量语义修复（独立切片；RN 保持默认）。
   - 当前Bridge的`message.delta`经`stream-mapping.ts`只把单fragment放入`chat.delta.message.content`，native却统一按snapshot替换；这能解释实时正文只剩末token，不能据此解释Stop前的generic Alert或宣称Stop已修。仅将Hermes该事件映射为.delta且不带snapshotMetadata；OpenClaw累计snapshot、全量final、SDK textMode、原segment/终态/身份与共享协议均保持。
   - 新6个纯SPM方法（8个参数化case）用该producer结构的合成帧核Direct/Relay同语义、原空白/NFD/emoji片段、工具段边界、final-only/完整final及实际ID不升级fragment身份；既有App文件新增1方法，将真实SessionEvents.map输出送入NativeLiveMessages，核单segment逐token原UTF8、同render UUID、整run fullfinal替换不重复prefix、终态及草稿不变，不用测试自制append reducer冒充消费者。只有Hermes rawdelta绕过累计silentPrefix规则，`NO`→`RMAL`和分片`NO_REPLY`均保原字节，完整final/OC/SDK/subagent规则不改。

docs/native-ios/BACKEND-ACCEPTANCE.md

@@ -26,6 +26,22 @@ The three new cases use the production root and helpers in a real UIKit host, in
 
 These checks do not establish Relay, phone-network, owner replacement, full backend parity, VoiceOver, same-bundle migration or store acceptance. React Native remains the default; there was no shared service restart, production configuration change, distribution build or release.
 
+## Later owned cancellation probe
+
+A separate authenticated loopback client used the existing isolated QA route. Before sending, it verified the same physical session, the first known owned input and `hasActiveRun=false`. It sent once, received an actual run ID and nonempty live text, then rechecked the exact `inFlightRun` and physical session before its sole targeted Stop. The complete Stop RPC budget was 20 seconds inside a 145-second total limit; uncertain writes were never replayed. Only bounded own-session event categories and booleans were retained; credentials and original frames stayed out of diagnostics.
+
+That run acknowledged Stop in 7 ms, emitted an authoritative `aborted` event and ended with the same physical session and no active run. This confirms cancellation for that independent Bridge/upstream window. It does not establish the original native attempt's failure mechanism, complete native UI acceptance or justify changing the five-second upstream timeout. No shared service was restarted or reconfigured. Native UI revalidation remains separate.
+
+The subsequent actual native attempt used the exact saved Direct connection and QA route. It sent once, received a run receipt and independently observed nonempty text for that run, but did not reach the Stop tap. Work remained unknown; the captured accessibility snapshot had invisible controls and no Alert node, while a later screenshot showed the fixed Runtime operation-failure notice. An independent same-physical history read already reported no active run; the native cache still held a one-character streaming reply. This is an incomplete native Send/recovery check, not another attempted Stop. The original 16-character draft and empty attachment list were restored through the actual editor without replay.
+
+Source review separately confirmed that Hermes Bridge forwards incremental `message.delta` text while the native mapper labeled every chat delta as a full snapshot. That defect explains replacing earlier live text; it does not establish the notice's cause or missing terminal transition. The focused mapping fix and actual mapper-to-consumer regression are tracked separately. A preliminary debugger attempt never stopped at its breakpoint and produced no typed failure evidence; the debugger detached. Runtime failure-stage sampling remains pending.
+
+The later `653895db` development app contains that focused delta fix. Its actual cold launch recovered the previous full reply and exact original draft. A fresh owned input was pasted and verified byte-for-byte, then sent once; a separate passive reader bound its actual receipt run ID and observed nonempty text. Native now retained several continuous paragraphs rather than the last token. WebDriver issued one click to the enabled Stop control, but this window did not establish entry into its handler or an abort RPC receipt. The independent terminal was `final`, not `aborted`; cancellation remains **not passed**. The native cache still contained a 355-byte streaming reply and the Runtime operation-failure notice. No uncertain input or Stop was replayed.
+
+The synchronous debugger now actually stopped in `showFailure`, with its caller classified as the event-stream catch. After acknowledging the notice, restoring the exact original draft and reselecting the exact saved connection without sending, a separate breakpoint identified the activation catch. Both debuggers detached. Swift expressions failed because a local SwiftUICore PCM referenced a modified module map; neither sample yielded the failure enum, delivery or retryability. These are real call-site observations, not sampled `capacity` values. Source inspection finds only one throwing finish of the coordinator's public event stream: its bounded-queue overflow path, which permanently closes that stream. Count versus byte overflow remains unsampled. The independent runtime-buffer repair and its slow-consumer tests are a separate task; this record does not claim that repair or native Stop acceptance.
+
+The same app's later standard-text-size Studio review passed actual photo preview/open/Done with a zero-point change in the visible code button's reading position, Copy feedback plus the exact 45 code bytes including the trailing newline, explicit Latest, and Work/Done/Menu/Connection settings/Done. The background WebDriver pasteboard API returned empty; the owned simulator's pasteboard read independently matched the known fixture, so the empty automation read is not recorded as a Copy defect. The real QA draft and zero resources, Studio's original draft and three ordered resources, and its one held item were all preserved, with no queued or sending items. Studio is a synthetic UI environment; these checks do not establish real inference, backend Stop, VoiceOver or recovery stability.
+
 ## Later authentication diagnostics
 
 On the `0f648ece` development app, a private loopback application-frame observer forwarded original frames without adding credentials or issuing RPCs. It classified OpenClaw's response as `INVALID_REQUEST` / `AUTH_TOKEN_MISMATCH`, and an in-memory comparison found that the submitted `connect.auth.token` differed from the current local operator configuration. A fresh form with explicit secure-field focus, slower WebDriver input and transition waits produced the same classification. The secure field does not expose the literal value through accessibility, so its masked value does not establish which input reached the binding. Form entry, automation and credential selection still require diagnosis; no token or service configuration was changed.