fix(reliability): preserve diagnostic event chronology

[catwithtudou]

Goal And Delivered Outcome

Fix a reproduced reliability-diagnostics readback defect: accepted timezone-aware timestamps were sorted as text. An error at 12:00+02:00, recovery at 10:01Z, and successful turn end at 10:02Z consequently appeared errored and unrecovered, with reversed receipt bounds. They now read back as idle, recovered, and chronologically bounded, while preserving the original ledger bytes.

• Basis: self-contained reproduced defect; intended base main, investigated at 6f5505ee6b860c4994e959465736c59001d44399.
• Existing owner: the built-in reliability-diagnostics envelope/receipt/projection. No new provider or decision owner. This completes the timestamp readback fix, not the parent reliability qualification program.

accepted timestamp → exact UTC time value → event ordering and millisecond deltas
original timestamp text → unchanged ledger and receipt evidence

Author Declaration

• Written by: model_agent · GPT-6 · OpenAI (self-reported).

Implemented against

Specification: loopx/capabilities/reliability_diagnostics/README.md at baseline 6f5505ee6, “Observer envelope” and “Diagnostic projection”: timezone-aware ISO-8601 input; stage from the last event; recovery following a completed step/non-error turn end; stall relative to --as-of.

Criterion	Disposition	Implementation / evidence
Accepted offsets and fractional seconds preserve chronology	implemented	observed_at_microseconds and LedgerReading.ordered_envelopes; independent offset, fraction, and equal-instant vectors
Stage, recovery, age, and receipt bounds agree with event instants	implemented	Shared exact time values in receipt and projection; real CLI ingest → status/receipt regression
Read-only diagnostic boundary	implemented	Original timestamps, ledger bytes, schema and authority unchanged; existing provider remains default-off

Self-check: reviewed both callers of the ordering property, the accepted timestamp parser, current related PRs, and the capability contract. A first implementation using only datetime failed independent review because it truncated accepted submicrosecond precision; the final implementation retains it using standard-library rational arithmetic. Standards and specification review have no remaining findings.

Scope And Continuation

Complete within this scope. Reuse the existing Python diagnostic data adapter rather than add a parallel TypeScript owner or perform an unrelated language migration. The related simplification is one shared time interpretation for sorting and deltas; no new dependency, migration, activation, schema, or authority change.

Rollback restores readback logic; no persisted data is rewritten. No successor issue is needed for this bounded defect.

Validation

• Tested revision: c848353251c9dd7058c091f4cd40e9b2f52db423 for final focused tests and premerge; broader-run provenance is stated below.
• Run state: finished.
• Broader-run provenance: the full Python run started before the final integer fast path and exact millisecond-division amendment. All four affected diagnostics test files, the producer/retention/CLI smokes, static checks, and premerge were rerun on the final revision above; the broad run is not represented as an exact-final-head full-suite qualification.
• Base movement: validation comparisons remain pinned to 6f5505ee6; later main 30efccd6c changes unrelated Lark material and does not touch this repair.
• Input classes: synthetic, public_fixture.
• Environment: Python 3.12.10; qualified Node 22.22.3 / SQLite 3.51.3 for broader checks; disposable file-backed runtime for CLI regression.

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	The 17 new cases applied to unchanged baseline product code produce 13 failed / 4 passed; final head passes all 17. Includes independently expected UTC instants and a real CLI reproduction.
unit	passed	Four tests/capabilities/test_reliability_diagnostics*.py files: 162 passed on final head.
real_entrypoint	passed	Original dsh-shadow-observer-fixture-smoke.py and ledger-retention-smoke.py pass; CLI regression covers ingest, receipt, combined status, recovery, and unchanged ledger bytes.
static	passed	Repository Ruff, configured mypy, semantic advisory and full semantic smoke, git diff --check, and public-boundary scan.
real_entrypoint	passed	examples/control_plane/cli-output-budget-regression-smoke.py; risk-based loopx canary premerge --from-git-diff --git-diff-base 6f5505ee6: 19/19 selected checks passed.
static	failed	Additional explicit mypy of the three diagnostics modules finds existing no-any-return errors in envelope _sequence and intake _count; identical errors reproduce on unchanged base. Configured repository mypy passes.
unit	failed	Complete broader Python run with qualified Node: 16,084 passed / 115 failed / 83 skipped. Re-running the 115 failed cases on unchanged base gives 78 failed / 37 passed; those 37 also pass when rerun on final head. See provenance and disposition below.
manual	not_run	Native Windows, installed/live DSH, and performance qualification are outside this readback repair.

Full-run failure disposition: 78 failing cases also fail on unchanged 6f5505ee6, across existing control-plane contracts, collaboration, inventory, configuration backup, UTF-8 policy, and recovery. Related upstream repair work includes #5533 and the inventory fix #5548; this PR does not claim those branches repair every observed failure. The other 37 cases pass in isolation on both base and final head; their full-run failure cause is unresolved. The full suite is therefore not green, and an exact-final-head complete rerun was not performed. No unrelated tests were disabled or expectations relaxed.

Canonical public-fixture CLI JSON is byte-identical between unchanged base and final head. The intended changed cases are demonstrated by the independently expected chronology regressions above.

Coverage: default-off producer behavior and public consumers retain their existing validation; new regressions check event order, recovery, stall age/gaps, equal-time session/sequence ties, exact fractional precision, and byte-preserving readback. No claim that all upstream integration checks are green or the parent RFC is complete.

Frontend / Visual Evidence

• UI impact: none. Existing CLI data readback changes; no frontend interaction or documentation chrome changes.
• Before/after: described above and asserted by the public CLI regression.
• States/viewports, source data, attention review: not applicable to this nonvisual fix.

Type of Change

• Bug fix
• Documentation update
• Test update

LoopX Area

• Capability or extension (providers, adapters, skills)

Technical Direction

Observer-first reliability diagnostics: correct existing passive readback. No live deployment or parent-RFC completion claim.

Shared-authority RFC fixture impact

N/A: no shared-authority provider, promotion, routing, or compatibility projection changes.

Boundary Checklist

• No private state, credentials, raw traces, internal links, or local machine paths in the diff or this PR.
• No duplicated maintainer-owned benchmark work.
• Scoped to the reproduced defect.
• UI impact marked none.
• Every commit includes a DCO sign-off using the contributor's GitHub noreply address.