[loopx-agent]

When a Todo-less outcome review is admitted, adding follow-up work and refining the outcome’s work links can remove the original frontier obligation. Re-entering the same Turn then fails with heartbeat_receipt_identity_conflict, even though its original receipt still owns the review and settlement.

Retain the plain goal_outcome_uncovered review kind and its exact stop condition as bounded scalar metadata in new receipts. The existing TypeScript replan owner restores that original review identity; guard re-entry and refresh both build their context from the current acceptance requirements, work inventory and Explore state. Linking work does not select it for the original Turn or discharge the review. Legacy receipts and mixed, restricted, lifecycle or capability obligations retain their existing recovery rules. Historical receipts are not rewritten.

The companion refactor groups frontier projection and receipt contextualization in the existing quota preparation module, reuses the terminal-inclusive Todo inventory, and passes the existing maintainability limits without new exceptions. This repairs the current CLI/heartbeat journey; it introduces no new settings, product editor or authority store.

Validation at d0bfe2f40651cd279d426d5c895bfec59da85485:

• PASS: 163 native quota CLI tests, including File/SQLite × Stride off/on with the current cumulative requirements, explicit-choice conflicts, wrong settlement scopes, immutable receipts and exactly-once debit.
• PASS: 244 TypeScript replan/settlement tests, control-plane typecheck, changed-Python Ruff and standard premerge (four direct checks, compile, ten catalog and eight risk smokes). Existing maintainability limits and public-boundary checks pass.
• Regression sensitivity: all four native cases fail at same-Turn re-entry on immutable pre-change product code. The final test adds exact-stop assertions after that failure point; its reproduction prefix remains identical.
• FAIL, independently attributed: the same complete five-module replan integration workload returns 84 passed and nine canonical-authority fixture initialization failures on immutable target base df9839b8001c795203039c314157bce25e294190 and the exact head. Complete failing identities and diagnostics match, with matched fixture/runtime digests. These failures remain failed; the changed paths have independent required passing coverage.

Only complete, unrestricted plain review sources qualify for the new receipt facts; incomplete trigger views and unsafe, normalized or overlong stop clauses keep the prior strict recovery. This does not backfill legacy receipts. Subsequent main changes were inspected separately; CI is not polled under the current review policy.

No PostgreSQL adapter, host installation or live Goal state is changed by this patch. Runtime merge and bypass require maintainer authorization after exact-head review and readiness.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

未发现阻塞性问题。结论针对 d0bfe2f40651cd279d426d5c895bfec59da85485；这是作者自审，不是另一账号的 GitHub approval，也不授予合并权限。

动机 / Motivation

使用 CLI 或 heartbeat 推进长期任务的 Agent 会遇到这个问题。复核已经开始后，补充后续任务并细化成果的工作关联，旧代码会拒绝原轮再次读取；候选版本保留原轮身份，并交付当前完整要求。原生回归验证了同轮重入、最新累计验收读取、真实语义回写和只扣额一次，后续任务仍按原等待条件保留。本次不扩大执行权限、不替代成果验收，也不修改已存在的历史回执。

这个缺陷的实际成本是：一次正常的工作关联修订，使已经开始的复核无法在自己的身份下继续。四个隔离的 File/SQLite、Stride 开关条件均在旧代码复现。本 PR 是可独立验证的增量，旧回执没有新增来源事实时仍走既有严格恢复；维护者合并、安装和自然长期运行效果尚未完成。

改动思路 / Approach

原准入来源属于既有回执，复核资格属于既有 TS owner，当前上下文由既有 builder 派生；无需新增计划器或可变同步表。当前 PR 交付新准入的完整普通 outcome review 的同轮恢复、语义回写与一次结算；不承担旧回执补写、能力升级或宿主调度重构。

新状态是首次准入时派生的历史事实，不是一份需要人工同步的当前计划。只保留完整普通来源的 kind 和原 stop；当前验收、Todo 与 Explore 仍按原 reader 读取。若只删身份检查，就可能把新义务或未来任务借给旧轮；若保存完整旧上下文，则会把新要求挡在复核之外。两条真实消费路径（guard 和 refresh）一起复用原 TS owner，才形成完整恢复。

同一场景	旧版本	当前候选
补 work links 后重入原轮	身份冲突	原身份、原 stop、当前完整要求
空回写或显式选择未来 Todo	拒绝	继续拒绝；未来任务不变
合法回写后重复结算	原有一次性合同	原有一次性合同

具体改动 / Changes

规范依据：docs/heartbeat-automation-prompt.md，不可变版本 df9839b8001c795203039c314157bce25e294190，读取的是当前完整要求、原结算身份、来源变化后重入与用户权限边界的既有条款。

• complete_requirement_reads：guard/refresh 都通过现有 builder 构建当前完整验收；新增要求和原来源均由原生读回断言覆盖。
• original_settlement_identity：回执、Goal/Agent/Turn/obligation 保持原绑定；错误 scope 及同轮冲突 Todo 选择被拒绝。
• changed_source_reentry：work links 去掉实时缺口后仍能恢复原 review；空回写不被当成完成。
• existing_authority：stop clause 原样保留，scope 与既有 semantic qualifier 不变；创建未来工作不授予执行权。

关键代码讲解

1. quota_rollout_details 只在匹配原义务、来源完整且 safe serializer 能原样保存 stop 时写两项 scalar。混合、受限、capability、带 progress window 或不完整触发源均维持既有路径。
2. projectSemanticReplanGuard 将来源放回已验证的 selected guard。缺主体、缺字段、过长或与 capability 混合时拒绝；Python 适配器保留事实，不重新制定资格规则。
3. preserveReceiptBoundObligation 保持既有 lifecycle/successor/已提交回写 precedence，仅在来源吻合时恢复原 duty；它不产生已接受的 semantic delta。
4. _prepare_quota_replan_context 复用当前完整 Todo inventory 与 context builder；同域提取通过原 ratchet，不新增预算例外。
5. qualify_replan_writeback 在 refresh 再次消费同一来源 owner，随后仍以有效 typed evidence 通过既有回写门；扣额仍在其后。

对主干的风险 / Risks

最高风险是把不完整或更严格的来源当作普通复核，或者把恢复误当履约。自审已限定 trigger_count 与完整 triggers 一致、类型全为普通 outcome，并保留精确 stop。原生路径还验证空回写、错误已注册主体、冲突 Todo、不可变回执、未来等待与两次 spend 只产生一次 debit。

PASS：163 项原生 quota CLI；244 项 TS replan/settlement；control-plane typecheck；全部变更 Python Ruff；标准 premerge 的 4 项直接检查、编译、10 个 catalog 与 8 个 risk smoke；公私边界扫描。不可变当前主干基线的原有 TS 用例为 241 项，通过。

FAIL：额外五个 replan 集成模块在不可变 df9839b8001c795203039c314157bce25e294190 与此 head 均为 84 passed、9 failed。逐项完整身份/诊断相同，fixture 与运行时摘要匹配；九项均在加载未初始化 canonical authority 的 fixture 时停止，未进入本次语义分支。失败没有被改成通过；本次受影响路径另有真实 CLI/typed/required checks 覆盖。未查询或等待 CI。

语义与 CI 对齐

本 PR 扩展既有 receipt metadata，复用 goal_outcome_uncovered，没有新权限、状态枚举或 public CLI。diff advisory 未发现受支持的新 carrier；动态 literal 的来源、两条 consumer 和持久边界另行人工检查，未把空报告当作完整语义证明。没有修改 hard limit、frozen criterion、CI 规则或必需验收。

我的整体评价 / Verdict

Long-horizon 在本原生恢复场景 improved：原责任能够继续并一次结算，后续工作和累计要求保留；自然长期收益仍 unknown。User experience 在既有 CLI 路径 improved：不需要用户重填要求、修回执或另造 Turn，新增必需交互轮次为 0。改动限于 quota/refresh 的既有 CLI 与内部上下文路径，没有改变任何渲染页面或聊天布局。本次无待验证的视觉变化；安装后的多宿主采用和长期收益未验证。

兼容判断为 retain：新增 facts 可缺省，旧 receipt 严格路径不删，不维护平行请求版本。复用与同域提取是已落实的简化；完整新来源的恢复、回写与结算组成有实际 caller 的边界，机制成本与复现问题相称。旧 receipt、安装、多宿主和模型采用的局限继续保留。运行时合并与 admin bypass 仍需本次维护者授权。

English verdict: APPROVE d0bfe2f. No blocking finding; native recovery and settlement are validated. Nine independently matched baseline fixture failures remain failed; merge authority is separate.