[loopx-agent]

Problem and result

After the canonical authority cutoff, older tests authored Markdown-only fixtures, modified exports after import, or expected lifecycle writers to run again after an accepted completion. Prepare disposable authority once after all authored inputs and preserve actual provider CAS, full-source commitments, leases, unique settlement and recovery semantics.

This batch updates existing unit/CLI integration fixtures and canonical lease/history documentation. Lark fixtures retain consistent provider message identities, explicit native group audience, full split-reply readback and distinct preflight/effect authority checks; new counterexamples deny a send after a successful preflight when App identity or the original grant changes. Lost-completion-response recovery reads the original durable proof, invokes the Host and lifecycle writer exactly once, and preserves later requirements. The quota/archive race keeps its legacy and exact-source paths; its transport interception now forwards native snapshot keyword arguments. The SLA responder list is aligned with the existing published Windows owner appointment.

No product authority or fallback is added. Original no-write, source integrity, privacy, quota/settlement and canonical provider assertions remain. Historical discovery failures are preserved; mocks are not live-provider qualification.

Validation

• Complete eight final repaired modules: 141 passed, zero skipped.
• Complete original-failing module cohort: 655 passed, one failure in the existing Chat terminal-stop race, addressed independently in PR fix(chat): keep a completed Turn's event history when a stop races it #7477; no other known failure remains in this cohort.
• Final head cc5c7d91909e82aee9736959565062adcc434a26: all changed test modules 1378 passed, zero skipped. Premerge 5 direct + 10 catalog + 8 risk + 1 boundary, required Ruff, configured mypy, isolated 77-path boundary, exact-head review, change quality and merge readiness passed. Full release qualification remains separate and will run on one frozen integrated source.

Frontend / Visual Evidence

UI impact: none. These changes exercise existing production entrypoints and independent readback; they do not add a new UI or certify external provider delivery.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max
Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

APPROVE，精确head cc5c7d91909e82aee9736959565062adcc434a26。

动机 / Motivation

维护canonical Todo、lease、Turn恢复与Lark集成回归的开发者。 部分旧测试在普通读取前没有canonical authority，或在导入后再次初始化、期待已接受completion重复写入，以及把只读预检当成最终发送权限。 现有fixture通过真实File/SQLite owner初始化一次，后续状态走原CAS；恢复从原durable proof结清且Host和completion writer均只调用一次，Lark在预检后变更App或撤权仍拒绝发送。 不新增Markdown fallback、产品权限、配额、状态owner或Lark实际发送，不声称真实模型或最终发布已经合格。

改动思路 / Approach

复用现有canonical fixture、typed projection、生命周期与transport owner，修正测试输入和独立oracle，不在生产实现添加迁就旧fixture的分支。 本PR收敛既有canonical/恢复测试、相关验证脚本与契约说明，并同步既有公开review roster到SLA统计。 先完成全部源fixture再导入，已有authority的后续变化通过CAS推进；不能靠删除fence、重复导入或把当前显示重建为authority来通过测试。已接受completion丢响应时，恢复应读原receipt而不是重新调用写入器；发送预检和最后权限复查也属于两个边界，不能用一次旧proof覆盖后者。

具体改动 / Changes

按 47576fd81b52984f24360c31c78ad627b92c7373 的 docs/development/good-smokes.md 核对 INDEPENDENT-ORACLE、REAL-BOUNDARY、PRESERVE-COVERAGE。77个文件主要补齐现有File/SQLite fixture初始化、真实CAS和显式迁移前source读取；旧普通Markdown正例变为typed refusal，no-write/no-fallback/source bytes断言保留。完整task source与action signature仍核验，replan只能调用语义Host而不能变成普通delivery，原signed scheduler投影保留。截断源的显式migration诊断独立检查，普通读取不恢复legacy fallback。

completion响应丢失后核验相同turn key、原durable completion、Host和writer各一次，以及第二次resume零effects且journal不变；后续新要求的全文仍保留。Lark provider的返回message ID和保留消息一致，native group fixture明确audience；最终split reply从composite locator逐个读取实际保留post，包含复用的草稿前缀并与完整独立文本比较。发送前预检与effect fence各用fresh proof，新增预检成功后换App/撤权的反例，断言零发送、零reaction、零intent。quota/archive保留legacy与exact-source并发路径，只修复拦截器转发关键字参数。

预算没有删字段或删Agent指导：Monitor相同完整负载在37f2ecfca9d28c18a0377052727c22891f197231与9d42c6d216f03af1b9113fc6a5964fb8279fd92c均为6806/1432/572字符，仅固定长度临时root nonce规范化后全文一致。writeback测试6000→7500，spend/settled仍2000。planning在713e13e2e618724ab23bb916f2c26e7e262e31d4与00e3e852be7ccf9817c6c83338a6ca131348c421均8503字节，完整source/envelope无规范化一致；测试使用9216回归上限，生产8192 overflow诊断及excess warning照常保留，未称为SLO通过。native Goal脚本在完整source准备后显式SQLite导入，仍声明soft_claim fixture；这不替代最终hard-lease默认路径资格。SLA只补入已在治理文档任命的BigDataDZ，不授予权限。

最终head全部改动测试模块1378通过、0跳过；近期八模块141通过、0跳过；最终premerge5direct+10catalog+8risk+1boundary通过，规定Ruff、17模块mypy与77路径隔离边界通过。 历史655/1 cohort的唯一Chat竞态由独立PR7477负责，不把它改写为本PR已通过；CI依Goal配置未查询。

对主干的风险 / Risks

主要风险是fixture修复掩盖真正的数据丢失、重复结算或权限回退。因此保留真实provider、完整源、lease/CAS和原receipt，增加成功预检后的撤权反例、writer/Host计数及完整reply读回，拒绝只改auth计数或只比新分片后缀。匹配预算证据保留全部字段与prose，不是通过缩减任务语义来降低输出。没有产品runtime代码改动；验证脚本、文档和SLA统计的边界已分别说明。1378例是完整受影响模块，仍不能替代最终统一commit上的全仓测试和外部模型资格。

我的整体评价 / Verdict

复用现有canonical fixture、typed projection、生命周期与transport owner，修正测试输入和独立oracle，不在生产实现添加迁就旧fixture的分支。 本PR收敛既有canonical/恢复测试、相关验证脚本与契约说明，并同步既有公开review roster到SLA统计。 可复用fixture与已有typed owner足够，不需要新增fallback、影子authority、重复恢复写入器或通用测试框架。该批次恢复当前真实入口的回归意义，并独立检查权限/完整性反例；沒有UI实现变化。1378项全部受影响测试通过；另一个完整历史失败模块cohort的655通过/1Chat终态失败已由独立PR7477修复，但尚未整合为最终发布source。真实模型、安装与各渠道资格仍待统一候选完成。 当前APPROVE只覆盖此验证批次，正式发布将在最终source上重新完成所需整套资格与渠道读回。

English verdict: APPROVE cc5c7d91909e82aee9736959565062adcc434a26.1378changed-module cases andrequiredlocalgates passed. Existingcanonical,uniquecompletion,Larkfreshauthority/fullreply andbudgetsemanticsarepreserved. No productauthority/defaultchange;finalintegratedrelease qualificationremains separate.