[loopx-agent]

Goal And Delivered Outcome

A periodic report can remain pending after stale_goal_authority rejects the original native turn/start publication. Its outer Chat request is retained, so the normal pump previously observed that request forever instead of completing the due report. This adds one qualified continuation of the same native transaction. It does not replay an unknown model attempt.

Outcome basis: reproduced runtime defect and the existing native recovery contract in periodic reports at the base revision. Intended base: loopx-project/loopx:main. Related to #7200.

Author Declaration

Written by: model_agent, OpenAI GPT-6.1 Sol.

Implemented against

Criterion	Disposition	Owning symbols	Decisive validation
Keep the original pending window, native transaction and settlement identity	implemented	StewardTurnHost._report_launch_recovery, execute	Original pump and native journal on File and SQLite
A missing answer or event alone cannot authorize replay	implemented	admitStewardManagedTurn	Typed rejection, identity, attempt, generation and effect counterexamples
Fresh grant, idle queue and native lease remain required	implemented	_admit, existing admission and lease owners	Existing native host regression and typed negative cases
Recovery is bounded and full-body publication remains separately verified	implemented	submit, existing settlement recovery and private delivery	One model publication after a refusal; failed continuation does not loop; original delivery readback

Scope And Continuation

Complete within this scope: one retained, specifically proven pre-publication refusal can resume through existing run-once --resume-turn-key. The typed conversation owner validates the original transport rejection and canonical journal before accepting the correlated Chat continuation. Its lease operation has its own correlation while the native Turn identity remains unchanged. Historical outer responses remain intact.

Unknown transport outcomes, interrupted or started work, generation already present, changed identity, revocation, conflicting history and a failed continuation do not qualify. No scheduler, task store, model worker, provider grant or subscription is added. This is a recovery slice; broader generic managed-session task authoring remains separate work.

Validation

Tested revision: fdd6567368a1ed05c7b550aab8f103d9c93f4851. Run state: finished. Input classes: synthetic.

Check kind	Result	Evidence / limitation
real_entrypoint / real_backend	passed	New original-pump recovery and failed-recovery cases: File and SQLite, four passes; synthetic app-server and Lark transport
unit	passed	Twelve typed conversation/report tests, including unknown effects, start evidence, foreign identity, revocation and repeat-attempt rejection
static	passed	Control-plane TypeScript typecheck; semantic vocabulary and maintainability checks; five changed public files scan clean
integration	passed	Native host, report and delivery: 70 passed; native monitor: 32 passed
regression_parity	passed	Same native input: base 4 failed/7 passed, head 11 passed. Same typed input: base 1 failed/2 passed, head 3 passed
static / premerge	passed	Six direct and three selected checks passed with no manual holds

Coverage and gaps: tests exercise the real original producer, Chat worker, native calendar/Todo/lease/journal/settlement and private delivery owners. Model and provider I/O are synthetic; no natural production report or content-quality claim is made here. A broad registry diagnostic retains two unrelated pre-existing unavailable-Goal errors; its changed-file public-boundary scan is clean. No PostgreSQL storage or authority implementation changes.

Frontend / Visual Evidence

UI impact: none. Existing conversation, subscription settings and report body surfaces are unchanged. No screenshots are needed for this transport recovery change.

Type of Change

• Bug fix
• Documentation update
• Test update

LoopX Area

• Capability or extension
• Host or runtime integration
• Control plane

Shared-authority RFC fixture impact

N/A: no shared-authority implementation, migration, provider routing or compatibility projection is changed.

Boundary Checklist

• Public-safe source, docs, fixtures and PR text; no private state, credentials, raw traces or machine paths.
• No benchmark jobs or duplicated maintainer experiments.
• One reproduced recovery defect and its native consumers.
• No paired RFC changed; exact-head bilingual check is included in premerge.
• UI impact is none.
• Commit includes DCO sign-off.

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

启用周期报告的原会话用户，以及负责续跑的同一服务。 报告在模型启动发布前遭到准入拒绝，旧版永久观察原请求；修复版证明拒绝边界后，只恢复一次原生事务并走原渠道送达。 恢复原待报窗口，无需再次描述任务或人工补发；恢复再次失败时保留记录且不循环调用模型。 不新增调度器、任务库、模型执行器、订阅或权限，不恢复效果未知的业务，不在此 PR 完成通用任务自然语言入口。 通用 managed Session 任务编排与自然语言配置仍由已有交付主线继续；本 PR 尚未声称真实生产内容质量或自然到期验收。

改动思路

由现有 typed conversation owner 判断恢复资格，Python 仅读取原请求与 journal 并调用既有恢复入口；不引入第二套重试或结算状态。 本 PR 只闭合已证实未发布模型请求的原报告续跑、结算与原路投递。 旧路径把“原请求已存在”一律当作无需再启动，因此真实的启动前拒绝也会卡住。新路径读取原生拒绝与唯一 journal，再由原有 typed 准入判断；符合资格时调用已有恢复入口，并保持同一个窗口、Todo、原生 Turn 与结算身份。额外 Chat 请求只负责承载续跑，不能另创一个业务事务。若恢复再次被拒绝，原生产者继续保留失败，既不循环重试，也不自动取消原窗口。

相同输入	基线 09e47b0	当前 fdd6567
原生产者遇到真实启动前拒绝，File/SQLite	四个恢复用例失败，七个正常/关闭路径通过	十一个用例通过；模型至多启动一次，原渠道独立读回
typed 原请求、身份和效果反例	新恢复请求被旧 schema 拒绝，两个原用例通过	三个用例通过，错误身份/已启动/未知效果仍拒绝

具体改动

规范依据：docs/product/periodic-reports.md，spec_revision 09e47b0e2ed990681b007c031efae385b73df1a3。按原规范的章节核对：Daily portfolio report 的固定窗口及生成/送达分离已保留；Original private report settings and execution 的原来源授权与未知效果不重放已实现；Acceptance boundaries 的单执行者、停止及原生结算条件由现有真实入口与反例验证。文档新增的是对此次有证据恢复的说明，没有改写规范来允许未知重放。

关键代码讲解

1. StewardTurnHost._report_launch_recovery 读取原 outer response，并按原结算身份查询唯一原生 journal。丢失历史、冲突身份或缺少原生记录会拒绝；没有模型事件本身不构成安全证明。
2. admitStewardManagedTurn 核对原请求、准确的启动前拒绝、一次尝试、无生成及无结算效果。错误 key、actor、Todo、真实启动、已生成、额外尝试、撤权和用户队列均不能获得这条恢复路径。已接受的执行仍受原活动 Turn fence 约束。
3. StewardTurnHost.submit 复用确定性 .admission-retry 关联，只允许一个续跑请求。既有续跑无论成功、失败或被中断都不会产生第三次请求，原失败记录继续可读。
4. StewardTurnHost.execute 调用现有 --resume-turn-key，复用旧计划与结算身份；新的 lease 操作关联避免把旧 acquire 的不同 CAS 输入当作幂等重试。原生 kernel 仍检查恢复与启动准入，已有无模型结算恢复和私聊全文读回保持原职责。

对主干的风险

最危险的反例是把“没有答复”误判为“没有执行”，进而重复业务。本次只有原生 launch owner 在发布前产生的精确拒绝可以参与恢复，且需要原请求与当前 canonical journal 一致；超时、未知状态、已启动和真实撤权均不能通过。检查了实际 start_turn 的单次 guarded write，而非只相信测试构造的结果对象。File/SQLite 故障注入也确实发生在原生写入边界。恢复失败保留原 journal 与外层响应，不重开 Todo、不伪造 publication。

原关闭/未来首日/暂停/取消与普通 native wait/progress 在两版七个相同用例中保持一致；相关当前回归共 102 项通过，typed 回归 12 项通过。预合并六项直接与三项选中检查通过，TypeScript 类型检查通过。早期测试的错误类名、回读字段名及暴露的 lease 幂等冲突已保留在本地证据，最终完整回归和不可变基线对比覆盖原故障，未删除安全断言。可选全机 registry 诊断还保留两个无关旧 Goal 不可用问题；准确差异的 public-boundary 检查独立通过。模型与 Lark I/O 为合成边界，不能据此宣称生产内容质量。

语义与 CI 对齐

复用现有 native request、journal inspection、resume key 和结算词汇，没有新增公共协议或 generic quota/scheduler 决策。恢复 key 是原历史派生的执行绑定，不是用户手填的状态注解。默认未启用的报告、普通会话、attached 和其他 Goal 沿原入口运行。已按当前 Goal 的 wait_for_ci=false 完成本地必要验证，没有查询或等待 GitHub CI；该策略不放宽实际测试或 merge-readiness。

我的整体评价

由现有 typed conversation owner 判断恢复资格，Python 仅读取原请求与 journal 并调用既有恢复入口；不引入第二套重试或结算状态。 本 PR 只闭合已证实未发布模型请求的原报告续跑、结算与原路投递。 长程效果为 improved：卡住的原承诺现在能走到独立核验的送达，且失败重试有明确上限；用户体验为 improved：既有意图和授权无需补确认、复制或人工代发。visual_review 为 not_applicable：The diff changes only native transport recovery and existing documentation; no rendered page, component or report format changes. unverified_scope：Live production report content and deployment remain separate from this source review.

范围与机制成本相称：新增的是原生产者需要的 proof 读取与 typed 分支，复用原生恢复、lease 和 sender，不保留第二套执行引擎。基线真实入口四个失败用例在当前全部通过；正常及关闭路径也进行了相同输入对比。评审结论为 APPROVE，准确 head fdd6567368a1ed05c7b550aab8f103d9c93f4851；这只批准该恢复切口，通用任务入口与实际安装/自然生产报告仍需各自验收。

English verdict: APPROVE — fdd6567368a1ed05c7b550aab8f103d9c93f4851 safely resumes one original native report after a proven pre-publication launch refusal. Matched File/SQLite recovery, negative cases, 102 native regressions, 12 typed tests, typecheck and exact-diff premerge passed; live production content and broader managed-task authoring remain outside this review.