fix(chat): continue one verified effect-free transport failure

[loopx-agent]

Goal And Delivered Outcome

A native Chat transport failure can exhaust the host's own retries and leave an otherwise valid request failed. This candidate continues that request once when fresh, complete host inventories prove a typed connection failure and no possible tool or delivery effects. It retains the original Core Turn, Session, request, configuration and authorization, then waits two seconds before the additional native attempt. Native error notifications can precede the persisted failed Turn; readback now waits within its existing five-second deadline for that terminal state before considering recovery.

• Outcome basis: the self-contained repair request above; intended base main.
• Before → after: the same positive Core endpoint/stdio fixture fails on base 94dd826a453bb3bfb34332ba8552fabcd5c696ac and completes on the candidate. Unknown errors, effects, unreadable inventories, steering, stop, revoked grants and changed configuration remain stops.

Author Declaration

• Written by: OpenAI Codex (model_agent).
• Specification: no written specification; the request in this PR is the basis. Existing Core claim/fence and native adapter contracts are from base 94dd826a453bb3bfb34332ba8552fabcd5c696ac.

Criterion	Disposition	Symbol / path	Evidence
Recover only the current, valid Core request	implemented	ChatRuntimeController._prepare_transport_retry	Core endpoint tests, original admission and duplicate request
Typed terminal failure and complete effect readback	implemented	CodexChatAgentSession.transport_retry_readback	Paginated turns/items; tools, delivery, unknown data, changed error and late effects reject recovery
Persist one attempt before dispatch; bounded backoff	implemented	transport.retry_planned event in the existing ledger	Two-second backoff, exhausted allowance, queued requests
Preserve request, Session, configuration and current authorization	implemented	_transport_retry_binding, existing Core claim/fence	Native parameters match; stop, grant revocation, model, authorization and claim changes prevent dispatch
Do not replay uncertain requests after a crash	implemented	Existing managed Session resume path	Crash after reservation retains the event; restart marks uncertainty failed and duplicate admission does not redispatch
Return through the original audience	implemented	Existing Lark private conversation pipeline	Synthetic Lark delivery/readback reconciliation without a new model execution
Qualify the real host and packaged web experience	implemented	Existing native host and compiled Chat bundle	Real app-server, controlled 503 → recovery → completion; real model ordinary conversation; same-viewport failure/retry/completion captures

Self-check: read the complete diff, existing lifecycle owners and native inventory protocol; ran the checks below. Native Goal commands and LoopX execution use their existing paths and are excluded from this recovery.

Scope And Continuation

This is a bounded transport adapter/runtime increment. Python placement follows the existing native transport and same-worker Core claim owner; it adds no parallel Goal decision owner, global recovery driver, Core status vocabulary, permissions or Lark-owned model replay.

The parent Chat/Bot qualification remains open. Next work is exact-head independent review, integration with the terminal presentation repair in #6239, then authorized adoption and original-request verification. No live runtime has been replaced. Restart recovery remains fail-closed; this does not claim autonomous crash resume.

Validation

• Tested revision: 2f0d9e0b87e0eae3adf49d86ea91baefd6628333. The 377-test and premerge runs used the exact final product/test bytes before the DCO commit; the frozen real model run used this commit.
• Run state: finished.
• Input classes: synthetic, public_fixture.

Check kind	Result	Evidence / limitation
static	passed	Ruff on the five changed Python files; diff hygiene
integration	passed	uv run --extra test pytest -q tests/test_chat_agent.py tests/test_chat_turn_steering.py tests/test_lark_private_conversations.py tests/test_chat_ordinary_project.py: 377 passed; native stdio and Lark providers are synthetic
real_entrypoint	passed	uv run --extra test python examples/loopx-chat-runtime-smoke.py: actual Core/CLI entrypoint with a synthetic native host
regression_parity	passed	Unchanged positive test fails on the exact base because the Core Turn remains failed; candidate completes it
static	passed	Maintainability ratchet and semantic vocabulary scan after dependency preparation and the scoped budget adjustment
static	passed	Source-checkout Goal-aware premerge: five direct checks and thirteen selected checks passed; no failures, advisory failures or skips
real_backend	passed	Actual Codex app-server with a disposable loopback transport: first native Turn receives 503, fresh paginated readback qualifies one second native Turn, Core completes one original request and duplicate admission creates no request. A separate real-model, workspace-only read session returns the exact answer.
manual	passed	Compiled, integrity-verified Chat assets served by the actual Core API and operated through Ego Lite. Baseline Core fails after one 503; candidate shows the retry phase and completes after two seconds. The model transport in this failure journey is synthetic; no production Bot was replaced.

Budget decision: the complete runtime module measures 2,024 lines / 35 Any references on the base and 2,128 / 36 on the candidate. The old ceiling fails on this growth. The added checks preserve fresh grants/configuration, steering/stop fences, durable reservation, backoff and late effect readback. Deleting or packing them to fit would harm safety or reviewability; moving Core lifecycle checks into the native IO adapter would mix owners. Update only this module's ceiling to the measured 2,128 / 36, with no spare allowance. The original failure remains a failure under the old budget. Dependency preparation also resolved an initially missing TypeScript package in the semantic scan; that environment failure is not a product pass.

Coverage gaps: the whole repository suite and production Bot adoption/original-request outcome were not run for this increment. The controlled transport proves recovery through the real host, not an actual upstream outage. Independent review and adoption remain required. The crash test covers reservation-before-dispatch, not every post-dispatch crash point.

Frontend / Visual Evidence

• UI impact: changed: the existing phase surface receives a retry progress label; no frontend files or layout changed.
• Before / after: captured and inspected at 1200 × 878. Baseline Core shows the terminal transport error after one native request. Candidate shows “连接暂时中断，已核验本轮未执行工具；正在原会话继续。” and then one completed answer, without a /status round trip.
• Source data: disposable public fixtures; real Codex app-server and Core API; synthetic loopback model transport. The baseline comparison loads the exact base Core controller with the same native adapter and compiled frontend, isolating the recovery behavior. Captures remain in the private qualification artifact for local review; they are not a live Bot acceptance claim.
• Attention / craft review: retry status appears in the existing answer card; steering and stop remain visible during recovery, disappear after the completed readback, and the composer becomes usable again. No new panels, duplicated answers or model protocol metadata appear.

Type of Change

• Bug fix
• Test update

LoopX Area

• Control plane (runtime)
• Host or runtime integration

Technical Direction

Existing native Chat request lifecycle and IM feedback.

Shared-authority RFC fixture impact

N/A: no authority provider, promotion, runtime routing or compatibility projection changes.

Boundary Checklist

• Diff and PR contain no private state, credentials, raw traces, internal links or local machine paths.
• No maintainer-owned benchmark work duplicated.
• Change scoped to the stated repair.
• UI impact and outstanding visual evidence documented.
• Commit includes a DCO sign-off.

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | xhigh

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

已接受的普通聊天请求遇到 host 连接失败，原生重试用尽后只留下失败。候选先核验当前原生 Turn 的持久化失败与完整无工具清单，在同一 Core 请求内保留配置和授权，再等待两秒继续一次；用户不必重复提问。
受影响的是普通 Chat、project 和 IM 调用者。原生协议和实际 Codex app-server 均完成两次 native 尝试、一次 Core 请求、一个用户消息和一个答案；重复 ingress 不新建请求。晚到工具、未知错误、授权撤回、配置变化、停止、重启不重放。 此评审覆盖有界连接恢复；不证明真实上游故障频率、付费模型质量、生产 Bot 安装接替、任意崩溃恢复或 #6239 组合安装验收。
评审精确 head 2f0d9e0b87e0eae3adf49d86ea91baefd6628333，不可变基线 94dd826a453bb3bfb34332ba8552fabcd5c696ac。具体恢复请求无独立书面 spec；先核对基线的原请求、Session/claim、停止和 native home 契约。交付判断为有用且独立可回滚的增量；生产 Bot 的完整验收仍开放。

改动思路

连接清单留在 native IO adapter，继续与停止仍由现有 Core/TS claim owner 决定；永久 reservation 只占现有事件账本的一行，避免新增恢复调度器。
本 PR 交付一次仍有效、未发生工具或交付效果的原请求继续；终态重开、外部交付重试、生产接替及 #6239 组合验收保留原 owner。
我比较了保持失败、一般重试和当前有界继续：一般重试无法证明副作用没有发生，当前清单核验和持久化 reservation 是必要成本。未来演进检查复用现有 _control_items 与 typed Core fence；当前没有值得另加框架的相邻重构。

具体改动

• chat_agent.py 的 transport_retry_readback 读取最新失败 Turn 和全部 item 分页，拒绝工具、交付、新输入、未知 item、游标循环及不完整数据；在既有五秒期限内等待 notification 之后才落盘的终态。错误信息只保留 typed discriminator。
• chat_runtime.py 的 _transport_retry_binding、_prepare_transport_retry 和原 worker 循环保留原请求、thread、配置和授权；先落一次 reservation，等待两秒后再次核验效果及停止/steering/claim。/goal 与 LoopX execution 不进入该恢复。
• 三个测试文件覆盖 Core HTTP/stdio、分页和错误负例、FIFO、新请求 allowance、配置/授权/停止变化、reservation 后重启与 Lark 原路 delivery-only 恢复。module_metric_baseline.json 仅把同模块实测上限从 2024/35 更新为 2128/36，无额外余量；保留检查比压缩掉这些条件更合理。

对主干的风险

默认行为由一次终态失败变为严格条件下多一次 native 尝试；无证据、政策/权限/额度错误、有工具或交付、终态或已用 allowance 仍停止。独立运行 377 项 Chat/Core/Lark 测试、Ruff、真实 runtime smoke、semantic smoke、bundle build/verify 全通过。相同冻结 HTTP oracle 在基线产生两项预期历史失败且七项负例通过，候选九项全通过。额外真实 HTTP 负例在退避后出现 command item，确认只有一次 turn/start。

独立真实 Codex app-server + 合成 loopback 503 服务：两次 native 尝试、一条 Core 请求、一个答案，重复 admission 不重放。实际打包页面通过 Ego Lite 走完发送→重试提示→完成，输入框恢复，停止/调整在进行中可见、结束后隐藏；截图核对了整屏层级。该故障服务和 Lark provider 是合成边界，未调用付费模型或替换生产 Bot；未把 #6239 组合安装验收算作已通过。私有负例 harness 的构造错误及一次旧 semantic 命令用法错误已修正后重新验证，未归因为产品回归。

我的整体评价

APPROVE，当前精确 head 未发现阻断项。一次原请求的有界继续有实质用户价值，重启不确定性保持失败，外部交付沿用原 owner。本 PR 交付一次仍有效、未发生工具或交付效果的原请求继续；终态重开、外部交付重试、生产接替及 #6239 组合验收保留原 owner。 安装接替和原始 Bot 请求回读由现有后续工作完成。本评审未查询或等待 CI；批准结论不构成 merge 或生产升级授权。

English verdict: APPROVE - 2f0d9e0; complete effect-free readback, one durable continuation and authority fences verified through Core/native, immutable baseline and packaged UI; installed Bot adoption remains separate.