修复一个偶发的问题

.project-docs/30-worklog/tasks/20260914-arrangement-linkage-stability-01a0858b.md

@@ -0,0 +1,24 @@
+# Arrangement linkage stability sampling
+
+## Scope and repository gate
+- User authorizes fixing hotel create `arrangement_create_linked_fields_not_stable`; a same-team/same-resource success with different dates/quantity does not identify the failed run's cause. No live ERP inspection or writes are authorized.
+- Branch main; worktree /Users/andy/IdeaProjects/LWLT-AIBOT; base 8d55e930a2c6f6a02f4cfc30dfee60cc2f134dde; sole worktree. Existing .idea/ and release ZIP 0.5.182 are known and preserved (ZIP may be archived byte-for-byte during release). Overlap: Clear. Previous plugin-status fix is committed in the current base.
+- Feature scope: deterministic linked-field observation, failure diagnostics, synthetic tests, extension version/release synchronization. No input/Schema/Skill/DOCX, heartbeat, database or business-rule changes. Main thread only; no subagents.
+
+## Findings and plan
+- Current helper checks its six-second deadline before reading the next sample. A delayed callback can therefore reject unchanged values without a second observation. Existing fake timers always run at the requested interval and miss this case. A continuously changing field produces the same blocker; the supplied log has no sample timing or changed-field evidence, so the live cause is unproven.
+- Preserve the 1.5-second stable observation requirement, restart it after excessive sample gaps, and allow a bounded recovery window for missed scheduling. Never treat time spent unobserved as stability or silently retry a save. Fail on persistent changes, detached controls/forms or exhausted observation/wall budget.
+- Capture field names and timing only, no business values. Carry create diagnostics through lifecycle evidence and readable failure output; keep raw blocker compatibility.
+- Validate normal 6/12-room cases, delayed timers, real oscillation, late changes, boundary sampling, node loss/replacement, and no POST on failure using synthetic native forms. Run required repository/type/control-plane/legacy/build checks and verify release ZIP/source equality. Production acceptance remains pending.
+
+## Results
+- Implemented the shared arrangement wait helper using a monotonic clock when available, six seconds of observed sampling budget and a 30-second wall deadline. Gaps over 1.5 seconds reset stability and consume no observed budget; normal completion requires at least three samples over 1.5 seconds. The final deadline sample is inspected. Existing controls must stay attached/enabled and identical; visible loading/native Ajax prevents readiness. A late-ending request is classified as loading rather than falsely reporting oscillating values.
+- Indexed creates stop filling immediately on failed observation and never POST. Value-redacted timing/field names appear in `preflight.arrangement_linkage` and an additional diagnostic blocker retained by current task-event logging. The legacy blocker remains compatible. Worker failure messages distinguish delayed sampling, changing fields, loading and invalidated forms. Success logging/heartbeat behavior is unchanged.
+- Synthetic native hotel flows cover 6 and 12 rooms, ordinary and six-second-delayed callbacks, one native resource selection, one save only after successful observation, persistent changes/delays with zero saves, and unchanged old rows. Vehicle/transport/other use the same delayed-sampling tests. Existing update/clear and post-validation write guards remain covered by the complete suite.
+- Verification: 47 focused tests; 231/231 control-plane and 378/378 legacy (609 total, focused included), typecheck, build, diff whitespace checks PASS. Four escaped old-version assertions were synchronized during the version bump. Clean isolated-source repository checks 10/10 PASS; original-worktree checks remain 8/10 solely because of preserved .idea/.DS_Store and prior ignored archive logs. No cleanup of that pre-existing material.
+- Release 0.5.183 synchronized across extension manifests/runtime version declarations, platform minimum, mapping, tests, active gate, ZIP and release manifest. ZIP/source checked byte-for-byte; old 0.5.182 ZIP and manifest archived unchanged. Skills/DOCX/parser/database versions unchanged.
+- Main-thread final read-only review: PASS. Reviewed deadline semantics, delayed-sampling reset, bounded waiting, failure-message forwarding, no-value diagnostics, unchanged save guards and package equality. No subagent review claimed. User's specific 17:25 failed execution remains unobserved at runtime; the fix addresses proven code defects, not a claim of reproducing that entire production incident.
+- [Immutable validation summary](../../../archive/evidence/2026-09-14/arrangement-linkage-stability-01a0858b/README.md). Tests ran against a byte-verified isolated source copy excluding every non-example .env before reads; runtime dependencies were symlinked. No ERP access/write, task resubmission, deployment, restart, extension reload, external send, commit or push.
+
+## Promotion candidates
+- Distinguish elapsed wall time from useful stability observations and retain value-free diagnostics. Delay is not evidence of instability or stability. Canonical promotion is deferred; production acceptance requires updating the plugin and refreshing ERP, then examining the real result under separate user authorization.