feat(collaboration): reconcile request corrections with Goal effects

[songoow]

Goal And Delivered Outcome

A requester can revise or cancel an existing local request in its original conversation and recover an uncertain response with the same operation. Request revisions, reserved Goal effects and immutable terminal receipts remain distinct: an old receiver result cannot complete a newer request, and cancellation does not pretend to roll back committed Goal work.

This revision repairs a demonstrated recovery gap. Before dispatch, the browser now reads back the complete saved route, operation, basis and content. Silent storage loss, altered retained content or an unreadable write keeps the draft editable and sends no mutation. Normal successful-response loss still supports reload and replay of the identical request.

中文：本次修正“恢复信息没有真正保存却仍发送”的问题，并补齐主干新增配置 reader 的真实调用链。请求修订、原效果对账、结果送达、后续采用及验收保持各自边界，与 长时运行整合 PR #6374 的过程定义一致。

• Updated head: 4746c41141b165c34a6de40ce1fc75a838ce2f24; integrated main and exact merge base: 3300dfdd29fe6e53e1aa4a0282ca3952db6e9e8f.
• Intended base: main. Original PR history is retained; already-merged prerequisites are not claimed as new implementation.
• Goal/source: Shared Goal Alignment §5.1/§9.4 and Manager §§5.10/5.12; original conversation → corrected request → reserved effect → authentic terminal receipt → original-route readback.

Author Declaration

Written by: model_agent — GPT-6, OpenAI.

Implemented against

Existing RFCs at integrated main plus this request-control profile's preserved amendment contract. The current-head review's retention counterexample is the repair oracle.

Criterion	Disposition	Implementation / evidence
Preserve original request and source revision	implemented	Existing typed request owner, version-bound assessments/returns, stale-source refusal and CLI/MCP/HTTP readback
Recover uncertain effects without inventing a new operation	implemented	Verify browser retention before dispatch; durable reservation, real Goal receipt and independent terminal linkage; packaged loss/reload/retry negative cases
Use current owning configuration for new work	implemented	Main's injected replan_configuration_reader now reaches direct and request-derived commit/recovery through CLI, HTTP and MCP. Unavailable current configuration refuses a new preview; retained terminal history remains recoverable
Do not confuse delivery with acceptance	implemented within this profile	Existing source/Goal/request owners and bilingual RFC §9.4 retain the distinction; live-model/Lark and general M2/G1 remain deferred

Scope And Continuation

The original request/result store remains authoritative. TypeScript owns request/Goal transitions; Python adapts authenticated source and existing IO. Commit and conditional abort compete for one durable terminal receipt, then the request links that receipt. No new request database, scheduler, policy fallback or current-basis writer is introduced.

The only textual main conflict was the generated registry I/O census; it was regenerated from merged source, then regenerated after the callback changes: 307 sites, zero unclassified. Real-entry verification also exposed an automatic-merge API mismatch: main required a configuration reader that the PR wrapper omitted. That integration defect is repaired through the existing injection seam.

Complete for this scoped local correction/recovery slice, subject to current-head review and required checks. Arbitrary Host effects, restored writer activation, live-model/Lark delivery and full M2/G1 remain with their existing owners. This PR is not dependent on backup activation or on treating direction read receipts as model understanding. The architecture guard entries were grouped with their existing collaboration owners so sibling Direction additions merge cleanly; AST comparison and seven current guard tests preserve the same members and assertions. Related-boundary pass reused local steering retention and the existing configuration composition seam; it adds no generic persistence framework.

Validation

• Tested revision: 4746c41141b165c34a6de40ce1fc75a838ce2f24; run state: finished; input classes: public_fixture, synthetic.
• Sources and isolated runtimes were bound to the intended checkout; Node 22.22.3 and real disposable PostgreSQL 14.20 were used. Only test-owned services were stopped.

Check kind	Result	Evidence / limitation
real_entrypoint / real_backend	passed	Actual packaged frontend, Chat HTTP, canonical SQLite and independent receiver CLI: silent-drop/altered-body/read-failure storage cases issue zero mutations and retain the draft; normal lost successful response/reload reuses the whole original request; stale editing, interim return and cancellation/terminal readback remain covered
integration	passed	59 Python tests across request recovery, Chat control and Goal amendment. Two strengthened File/SQLite reader cases were separately rerun; these overlap the 59 and are not added to them
integration / real_backend	passed	69 typed request/Goal tests, zero skips, File/SQLite and isolated PostgreSQL
unit / static	passed	Four existing steering retention tests; seven source/session architecture checks; dashboard/root types, Ruff, semantic advisory followed by full drift, 307-site census and public/private scan
static / manual	passed	Exact-head bundle build/source verification. Browser-tested and final manifests differ only in source revision; delivered asset bytes match. Changed-path review, whitespace and DCO checks pass
regression evidence	passed	Old RequestControl failed the silent-drop browser oracle; repaired code passes. Initial real browser initialization failed on the missing configuration callback; actual caller integration now passes

The build retains its existing bundle-size warning; no ceiling changed. The enhanced browser faults alter only storage/response delivery, not backend admission or Goal results. No live model, installed-App replacement, Lark, remote Host, Windows or general end-to-end Goal completion is claimed. Hosted CI and renewed exact-head public review remain separate; older approvals/results are not transferred to this head.

Frontend / Visual Evidence

UI impact: changed failure behavior inside the existing request details; no opening navigation, hero or first-viewport composition change. The packaged journey covers editable failure, unknown delivery/retry, cancellation, Chinese/English and 390px. Evidence uses synthetic fixtures; private validation logs/screenshots are not attached. Existing controls and localized storage-error text are reused.

Boundary Checklist

• Scoped runtime/UI repair and original RFC clarification; no private state, raw logs, credentials or local machine paths in the diff/body.
• Current request and Goal owners reused; no benchmark jobs or policy promotion.
• Tests preserve failure and untested distinctions.
• Every PR-owned commit carries a DCO sign-off.
• No merge, deployment or user-installation change.

Combined Integration Readback

A disposable local composition of the four coordinated PR heads passed 18 actual HTTP/source-denial tests, control-plane typecheck and docs governance. The generated registry I/O census was rebuilt from that combined source: 310 sites, zero unclassified, with --check passing. Request, Direction and Recovery routes preserve unique keys and their owning handlers. Source/test insertion conflicts were removed; when #6357 and #6338 are combined, their branch-specific generated census must be regenerated from the combined source, not resolved by accepting one side or concatenating JSON.

This is local integration evidence, not a merged branch, installed product, live-model adoption or resolution of unrelated main-branch checks. Exact heads: #6374 c34e4f1576a69ab0fc98f9253933c1a3ea7929c2; #6357 4746c41141b165c34a6de40ce1fc75a838ce2f24; #6338 082ed83c22e23d1d771da879773b33c66f31d953; #6279 f4bfab4a391e8754cb961471237bc57f4c651eed.

[songoow]

Reviewer: model_agent; GPT-6; OpenAI; self_reported.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

原会话的请求发起者，以及按该请求协作的接收 Agent。 发起者修正或取消一项委托时，旧结果不能冒充新请求完成；已经预留、但回复丢失的 Goal 变更也不能靠换编号再执行。 候选实现让发起者在原会话修改、取消并核对结果；接收方按实际读取的版本判断和回传，未知变更通过原操作回执恢复后才能继续。 本批不开放任意 Host 效果、外部来源控制、通用重分配、恢复写者启用或真实模型团队运行。 完整 M2/G1、通用 source-profile 运行时、真实 Lark/模型采用与恢复后的授权重绑定仍需各自原验收。

本次检查完整主干至 1675f570d32f06cc3b564e1511e6bbe3126bfa60 的差异，不继承前置 PR 的批准结论。评审中发现并修复了新版本中途进展与旧 decision 记录冲突、旧结论压掉新进展的路径；另将版本操作指引限定到实际供给版本化请求的 CLI 页面。当前未发现该本地切片的阻断问题。

改动思路

请求和 Goal 分别保有自己的事务；复用既有 Inbox、Goal work planner、operation receipt 和返回链路，比另建请求库或用一次远端存活检查代替取消顺序更符合现有边界。 本 PR 交付受支持本地来源从修订/预留到提交或中止、独立回执关联和原会话回读的完整切片；主干至本 head 包含仍开放的前置 #6323，不能将它重复算作新成果。

请求先在原记录预留一个不可变操作；提交与条件中止在 Goal owner 竞争同一终局回执；随后独立读回并关联原回执。请求修正不删除旧预留，超时不释放 fence，提交胜出就保留 Goal 工作。TypeScript 负责决定，Python 解析真实来源和执行 IO；前端不增加独立配置或决策源。

最强反面是完整 diff 较大、有限容量与多次同步观察有维护/调用成本，且普通 source-profile runtime 仍未整体可用。这个限制已体现在资格边界：现有原对话可以完成修正/取消/恢复，不能由此宣传通用团队运行。只改 brief、增加超时或另加一个状态页都无法解决两个 owner 间的提交顺序。

具体改动

完整 diff 为 73 个文件、+5516/-213。其中包含仍 OPEN 的 #6323（8ddedecb288788961a479a28395698d68dfea8ca）的 root/policy、固定模板、实际 claim/replan 和设置页前置；#6343 已在主干。请求控制自身的新工作在既有依赖组合之后。源路由 helper 复用 #6338 的同一路径，无第二套路由或全 Direction 依赖。

依据变更前 b0b2acffb8fea7d85b20dd4f0139c1ce0616e5a7 的 docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md；同时对照 docs/architecture/rfcs/capable-manager-semantic-handoff-v0.md，新增 §9.4 只记录本地资格与限制，没有改写原验收。

• §5.1(1)、§5.1(2)： request_control.ts:265 planRequestControl 在既有 Inbox 内管理修订、读取/判断和唯一预留；request_amendment.py:168 control_request 在修正/取消后尝试条件中止。保留原始 brief/source、为合法取消及关联预留容量，未提高128000字节限制。
• §5.1(3)、§5.1(4)： goal_amendment_authority.ts:351 executeGoalAmendment 复用 work planner 与原 CAS/receipt；execute_request_amendment 独立读取原 Goal 终局再关联。绑定包含真实 store/source 身份；新编号、缺 source、迟到原 worker 都不能获得新效果。
• manager §5.10、manager §5.12： result_publication.ts:112 planCollaborationResult 与原返回链路保留各版本结果；省略版本仍指原始1。中途进展按修订保存，仅同修订结论能收起未发进展。Inbox、peer、Chat、Lark tracking 共用回读；新请求仍可在另一请求效果未知时独立推进。
• §9.2(1)、§9.2(2)、§9.2(3)： 前置的原承诺、冻结policy、实际新增工作/回执、精确实例/基线与现有租约保护已按当前调用关系复核；无 permission/objective/acceptance 扩张。
• §9.2(4)、§9.2(5)、§9.2(6)： 原操作恢复、独立peer adoption/claim和原义务消费继续复用前置owner；当前新增 RequestControl 在原交办详情提供完整编辑、取消和恢复。保存是一次操作手势，已知 Goal/接收方不用重填；未知响应跨刷新重试同一请求，读失败清除旧控件，过期编辑加载当前版本。未改首页/hero/主导航。
• M2/G1 promotion： 通用执行、真实团队两轮、独立实际验收和外部发送仍由原里程碑承担，未由此关闭。

边界内的未来整理已应用：工作图共享planner，原来源事实组装移到Core并删除旧函数，旧未发布Python适配器名被移除，类型化wire由前端复用。迁移成本也明确：原受控请求是新增语义，并非把旧writer换名；原始记录/返回和独立Goal路径继续存活。实际File/SQLite调用计数为首次request commit20次bridge、原操作replay15次、条件abort恢复14次，包含既有生命周期/replan观察，不是模型调用；未声称速度或token改善，也未为每字段新建RPC。

对主干的风险

• 中途返回修复后的原生路径225项通过、3项Win32专用跳过；新增同Goal未来请求不被旧fence捕获2项通过；typed request/result18项通过。最终仅CLI指引与测试变化，补跑开/关路径2项及当前主干完整输出对比通过。此前集成版本的313项通过和typing修正50项仍可复用到未变化边界，未把这些不同集合相加当覆盖率。
• 共享owner在41b22a51a的隔离真实PostgreSQL14.20上372项通过、0跳过，至最终head仅CLI指引及测试变化，相关owner字节未变；包含commit/abort/correction与原authority conformance，服务已停止。这不新增PG终端用户profile。
• 来源源码和独立安装正常wheel的真实浏览器均通过：生产注册、SQLite、原Chat入口、实际HTTP、独立receiver CLI、中途返回、丢成功响应后reload/同操作重试、过期编辑、读失败恢复、取消终局、中文/英文/390px。41个产品文件HEAD/source/wheel/install逐字节相同，退休适配器不存在。已检查整屏层级和状态；sidebar的generic Goal状态不可用没有被mock隐藏。
• 主干/候选使用同一份原请求保存状态，经CLI正向/冲突/重放与原会话回读，全输出和指引保持一致；新注册root commitments为单独校验的provenance增量，旧回执不回填。源码guard移除的隔离反例和中途返回旧实现都曾实际失败，修复后通过。未用实现输出充当预期不变量。
• 风险预合并检查19项及5项direct检查通过；TypeScript、Ruff、focused mypy、语义advisory/full drift、IO census和公共边界检查完成，无budget上调。较早一轮检查与manifest生成重叠触发tracked-side-effect；稳定树重跑保留guard后通过。浏览器曾因旧bundle拒绝、之后因可见文本与live-region双匹配失败；重建和精确定位后通过，没有删除行为断言。

远端CI在本次读取时仍排队；本地证据不替代hosted CI或merge readiness。合成replan历史、故障注入与真实本地后端不等同于真实模型或Lark发送，Windows专用路径本轮未资格。回退在新数据产生前可revert；新记录产生后应停止新准入并保留兼容reader/receipt/fence，不可删掉一侧记录制造可执行状态。

我的整体评价

APPROVE，限上述精确head的本地来源切片；交付判断是 justified_increment。已验证的价值是请求改动后仍能正确续行、历史结果不污染当前判断、取消与不确定效果不重复执行，并在原会话看到实际结果。维持长程原目标、未完成要求和权限边界；不以一次receipt、测试数量或此PR代表整个Goal完成。

请求和 Goal 分别保有自己的事务；复用既有 Inbox、Goal work planner、operation receipt 和返回链路，比另建请求库或用一次远端存活检查代替取消顺序更符合现有边界。 本 PR 交付受支持本地来源从修订/预留到提交或中止、独立回执关联和原会话回读的完整切片；主干至本 head 包含仍开放的前置 #6323，不能将它重复算作新成果。

前置#6323、hosted CI、维护者合并和更广profile推广分别保留。未执行merge、部署或运行用户的活跃Goal。

English verdict: APPROVE - 1675f57: the bounded local request revision/cancellation journey preserves one reserved Goal operation, authentic terminal linkage and revision-specific original-route results. Native positive/negative recovery, main/head full-output parity, isolated real PostgreSQL (372 passed), source/independent-wheel browser and risk-based validation passed. Prerequisite #6323 remains open; hosted CI, wider runtime/live-model qualification and merge authority are separate.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[songoow]

Conflict reconciliation at 6637b26e17af5cdb4900c0a163f68a84ef962ecc against main 91b675dfca178db68d3527140272ffb263a3b319.

Native request correction and Goal amendment HTTP regression: 37 passed. TypeScript owner/proposal: 57 passed, 4 PostgreSQL cases skipped. Semantic vocabulary and registry I/O: 133 passed.

Control-plane typecheck, semantic advisory, regenerated I/O census (zero unclassified sites), and diff whitespace checks passed. No unmerged paths remain. No limits, history retention, activation authority or product defaults were changed by the resolution. Related refactor pass: unnecessary for this merge-only reconciliation; existing typed owners are retained.

This records conflict repair, not approval or merge readiness. Hosted CI and exact-head review remain separate; PostgreSQL was not requalified in this batch. No merge performed.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh.

动机

在原会话修正或取消一项已交办请求的用户，以及读取并回传该请求的接收 Agent。 过去用户改了委托，接收方旧结论和已预留的 Goal 变更难以按新要求核对；新实现能在原会话修正、取消并看到各版本结果，但恢复信息静默未保存时仍发出变更，刷新后无法重试原操作。 原生 File/SQLite/PostgreSQL 终局与版本回读通过，打包页面的正常丢响应重放、过期编辑和取消也通过；静默丢弃恢复写入的反例仍违反可靠重试承诺。 此处不开放任意 Host 效果、扩张原权限或替换请求/Goal 存储，也不把冷控制旅程称为真实模型团队、Lark 发送或完整 M2/G1 验收。

可靠修正需要同时保留来源版本、原效果与实际回传。只是修改 brief 或增加超时不能解决两个 owner 的提交次序。本次评审从原会话走完整冷控制旅程，独立挑战了“未知响应跨刷新仍能重试原操作”的承诺；作者旧 self-review、测试数及 Goal 注册本身都不是结论。

改动思路

请求与 Goal 分别保有自己的事务和 TypeScript owner，复用原 Inbox、work planner、terminal receipt 与返回链路；剩余修复仅需在现有浏览器恢复边界读回保存的身份。 受支持本地来源的修订、原预留操作、终局回执关联与原会话回读应一起可靠；通用 source-profile runtime、真实模型/Lark 与 M2/G1 仍由原阶段负责。

请求先持久预留；Goal 的提交与条件中止竞争同一个终局回执；随后独立读回并关联原请求。状态决策在 TypeScript，Python 只适配真实来源、锁与 IO。UI 复用原交办入口、已绑定的 Goal/接收方，编辑是可选动作，不要求复制命令或重选同一目标。

最强反面是范围与长期成本：当前完整净差异42文件，多个 IO/bridge 和容量约束值得保留明确限制。真实 scoped 控制旅程证明这不是空 serializer；保留原两事务也优于另建存储。但是浏览器恢复身份不能只凭 setItem 未抛异常判断，下面的 P2 需在当前片段修好。

具体改动

当前完整 6357@60cdcc0ef2301338a98c14be2b2d31d43e4044ab，immutable merge-base b77f63495f2619237380755178c0780ae10a0f26：42文件、+3215/-186。此前73文件旧 head 的作者意见不是当前完整评审。原始规格 docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md @ b77f63495f2619237380755178c0780ae10a0f26，结合 Manager §5.10/§5.12。

关键代码讲解

• request_control.ts:265 planRequestControl：source 才能修正/取消，receiver 按实际版本读取/判断；原 brief 不变、当前版本不继承旧 assessment、仅一个活动 reservation。容量保留取消和终局关联空间。§5.1 对应机制由真实 File/SQLite 和 PG owner 核验。
• goal_amendment_authority.ts:351 executeGoalAmendment：复用 work planner/CAS，绑定实际 store/source/Goal/proposal；commit 与 abort 共用原终局身份。缺回执不等于无效果，新编号或丢掉 source 不释放旧预留。
• request_amendment.py:94 execute_request_amendment：先预留再调用原 Goal owner，独立读取 authentic terminal 后链接。接收方与原会话消费者保留版本；Manager §5.10/§5.12 已核验，旧 revision1 返回不能完成后来 revision。
• RequestControl:43 remember：这是 Original-operation recovery 的未满足项。它只 setItem 然后设置内存 pending，缺少同仓 steering-recovery.persistRequests 已有的保存后读回检查。M2/G1 的通用运行时与真实模型团队保持 deferred，不是本次阻断的新增条件。

对主干的风险

[P2] 发送前确认恢复身份确已保存。 在实际打包 Ego 页面，正常保存恢复信息、真实成功回复丢失后，刷新与重试的完整逻辑请求对象相同，修订仍为2。只把该 storage 写入改为静默不保留、继续让真实 SQLite/HTTP owner 执行同类修正：实际 execute=true 一次、保存记录零个，页面仍称“原操作已保留”。刷新后服务器第3版仍可读，但原操作重试入口为零。这是新 UI 的恢复保障缺口；服务器历史及 Goal fence 保持 intact，没有据此宣称重复 Goal 写入。

最小修复是在 remember 后读回并验证相同身份；失败保留编辑内容、停止 execute=true。复用现有 steering retention 的模式，给现有 request-control browser smoke 增加 silent-drop＋lost-response＋reload 的反例。回归应证明失败时零派发，正常丢响应仍只重放原编号。范围在 apps/presentation/dashboard/src/features/personal-workspace/request-control.tsx:44。

独立验证：38 项 native Python通过、零跳过；真实隔离 PostgreSQL16.2 配合现有 File/SQLite typed owners 428 项通过、零跳过，服务已停止；126 项全量语义规则测试通过；类型、打包构建、306-site IO census通过。浏览器真实走了原入口修正、丢成功回复/刷新/相同请求重试、过期编辑、独立接收方第4版读取与中途回传、预留效果取消后的 aborted/noGoalChange 回读、中文/英文及390px无横向溢出。只有 storage/回复投递被注入故障，没有 mock 请求或 Goal 结果。

初次误用未安装的 tsx loader、四个 PG 环境跳过及过长 Unix socket 路径均保留；正确原生 Node/隔离 PG 重跑覆盖了相应已执行组。作者旧14.20/372、313/225与独立安装字节组不是本轮结果。冷 source-profile 的通用 Goal sidebar 和 Lark discovery 仍不可用，未隐藏为成功；没有运行真实模型/Lark发送、安装替换或 Windows/ACL。本轮没有查询 CI。

语义与 CI 对齐

三个新 closed set 是 collaboration-owned request wire，前端与 TS owner共用，保持26项原正式 vocabulary 范围；advisory 后 full drift 通过。原版不带控制字段和省略版本的读/判断/返回仍属 revision1，当前受控读明确要求所读版本和摘要。core actor/terminal 约束是机器义务，context/read/已记录变更不冒称实际采用或完整验收。新字段和未资格边界已披露。

我的整体评价

REQUEST_CHANGES，当前 delivery judgment 为 not_yet_proven：架构与有界本地结果有正向价值，但可靠跨刷新恢复还差这项小修复。长程与体验的实际风险是未知成功后丢失原重试身份、增加人工核对；正常修正/取消路径和原始历史保持的收益已分别验证。多次 bridge/状态成本是正确性支出，未证明时间或 token 净收益。

请求与 Goal 分别保有自己的事务和 TypeScript owner，复用原 Inbox、work planner、terminal receipt 与返回链路；剩余修复仅需在现有浏览器恢复边界读回保存的身份。 受支持本地来源的修订、原预留操作、终局回执关联与原会话回读应一起可靠；通用 source-profile runtime、真实模型/Lark 与 M2/G1 仍由原阶段负责。 相关整理已复用 planner/source/helper；下一项只需补现有本地 retention 的验证，不需要第二套存储、通用缓存框架或新学习队列。修复后对新完整 head 重做该反例及正常恢复资格，再判断全 PR；没有合并或升级。

English verdict: REQUEST_CHANGES — 60cdcc0. The scoped request/Goal terminal and revision-specific return paths have substantial passing real-backend and packaged-UI evidence. P2: pending recovery storage is not read back before dispatch; a silent persistence failure plus a lost successful response leaves no original-operation retry after reload. Verify retention before execute, reuse the existing steering pattern and add the negative browser regression. Server history/fences remain intact; wider runtime, live-model/Lark and installed/native-Windows qualification remain separate.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh.

Reviewed exact head: 4746c41; whole PR baseline: 3300dfd.

动机

在原会话修正或取消已交办请求的用户，以及读取并回传该请求的接收 Agent。 过去用户改变委托后，旧结论和已预留的 Goal 变更难以按新要求核对。现在在原会话修正或取消，接收方按实际版本判断与回传；未知结果保留原操作，待终局回读后再继续。 真实 File/SQLite 与 PostgreSQL 终局检查通过；打包页面保存丢失、内容变更或读回失败时均零派发并保留草稿，正常丢响应重载后逐字相同重试，取消读回 aborted 且不改变 Goal 工作。 这里不开放任意 Host 效果、不扩张原权限，不把请求读取或已记录变更称为真实模型理解、任务执行、Lark 发送或完整 M2/G1 验收。 真实 Host、模型团队、Lark 发送、Windows 与完整 M2/G1 仍由原 manager/shared-Goal 阶段资格化。

改动思路

请求与 Goal 分别保有自己的事务和 TypeScript owner，复用原 Inbox、work planner、terminal receipt 与返回链路；恢复信息保存后读回完整原请求，失败则零派发。 受支持本地来源的修订、原预留操作、终局关联与原会话回读一起交付；通用 source-profile runtime、真实模型/Lark 和 M2/G1 仍由原阶段负责。

只编辑 brief 或增加超时不能决定两个独立事务的提交次序；预留身份、单一 terminal 和原回传必须组合，浏览器持久读回是这条旅程的可靠入口。

以下表格对应当前 exact head 4746c41141b165c34a6de40ce1fc75a838ce2f24 的 remember 与 terminal owner，用于解释触发、分支与结果；它是源码流程示意，不替代执行证据，表格渲染未单独验收。

触发	原路径/旧缺陷	当前结果
保存恢复信息未实际留存	setItem 返回后继续发送	读回完整请求不匹配 → 零派发，保留草稿
真实写入成功但响应丢失	原重试身份依赖存储	重载 → 同一原 payload 重试 → 不再增加 revision
source 取消预留效果	不能仅凭超时声称已取消	原 commit/abort 争一个终局 → 独立 receipt 关联 → 明确保留已提交工作或 aborted

具体改动

完整当前范围为 42 个文件，+3312/-186；包括原 request/Goal owner、来源适配器、CLI/MCP、原会话和跟踪 projection、双语规格及聚焦测试。旧 self-review 的 73-file 范围和旧 head verdict 均没有作为当前批准依据；本次另核对旧阻塞到当前 head 的保存读回修复，以及 main 集成后的实际 replan configuration reader。

关键代码讲解

• request_control.ts:265 planRequestControl：在原请求记录保存 source revision、独立 read/assessment、最多一个未终结 reservation 和稳定 operation receipt。只有原 source 可以修正/取消；receiver 必须采用实际 revision/digest，预留容量给合法取消和终局关联，重试不消耗新容量。
• goal_amendment_authority.ts settleReservedAmendment：复用 planWorkCommit、canonical CAS 和原 CoordinationCommandReceipt。commit 与条件 abort 使用一个不可变 reservation identity；后到的旧 commit 不能绕过已记录的 abort。当前来源与历史 Goal outcome 分开，不用超时或 missing receipt 释放效果。
• request_amendment.py:99 execute_request_amendment：从实际 source snapshot 预留后调用原 Goal owner，再独立读真实 terminal 并关联；最新的 configuration reader 显式传到 proposal/basis/commit/recovery，配置读取失败不授权新变更，已有原 receipt 仍可恢复。
• request-control.tsx:43 remember：保存完整序列化原请求后必须 getItem(...) === serialized，否则保持可编辑草稿并拒绝 execute。submit 的未知响应保留原 payload，重载后重试该 operation；typed stale basis 读当前版本，不覆盖另一 source 修订。

规格依据为 docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md，不可变基线 3300dfd；并核对同基线 manager §§5.10/5.12。逐项映射：§5.1 implemented；Manager §5.10/§5.12 implemented；Original-operation recovery implemented；M2/G1 deferred。当前 §9.4 将本地 profile、限制和原 operation 恢复讲清楚，没有把 request 状态扩成通用 Agent/Goal lifecycle。

对主干的风险

没有当前 head 的阻塞 finding。原 P2 保存问题已独立验证修复。 实际 packaged Ego 页面使用真实 production SQLite/HTTP 后端，分别注入静默丢弃、替换已存内容和读回异常：三种情况均 execute=true 请求为 0，原草稿仍可编辑。正常存储后令真实成功响应丢失，刷新原会话再重试，两个完整 JSON payload 逐字相同，原 operation/basis/content 不变，request revision 保持 4，pending 才被清除。第一轮 reload 的探针丢失 fetch interception，未作为通过证据；修正逐文档探针后才得到上述明确请求对比，产品源码未修改。

完整正负路径还覆盖：过期 editor 遇另一 owner 的修订后拒绝覆盖并读新内容；独立 receiver CLI 读取/采用版本 4，并回传该版本 interim；未知 reservation 随 source 取消后，独立读回一个 aborted terminal、active reservation=null、goal_changed=false。中文、英文及 390px 窄屏无横向溢出；read/已记录变更不被表述成执行或验收。

43 项原生 Python 全通过；428 项 TS 全通过、零 skip，包含隔离真实 PostgreSQL 16.2 的 shared authority integration；126 项全树语义检查、typecheck 和 packaged build 通过。当前未限定平台的冷控制不等于已 installed App、真实 Host/model/Lark 资格；synthetic progress 只提供 replan 输入。一个 peer interim 返回假设经真实公开 CLI 的 conclusion-only guard 排除，没有伪造成缺陷。

默认路径、语义与本地检查归因

六份原有测试源码在 base、此 head 与另一复审 head 逐字相同，各跑 158 passed / 3 skipped：skip 均为本机 POSIX 不适用的三个 Win32 extended/binary/workspace path 场景，Windows 资格保持未验证。旧 backup plan/create、配置快照、原 peer/inbox/result/Chat tracking 及直接 governed Goal 路径都走实际 production owner；按实际 PR 基线 3300dfd 运行同一 CLI differential，96 baseline / 96 candidate，candidate_only=0、review_required=0。无新 required legacy field、自动调度、quota 或活跃 writer。

risk-based canary premerge --from-git-diff --git-diff-base 3300dfdd29fe6e53e1aa4a0282ca3952db6e9e8f 保留红灯：5 个 direct check 通过，19 个 selected check 中 18 个通过，只有 python examples/control_plane/cli-output-budget-regression-smoke.py 失败。用同一默认命令在不可变 pre-change source 和两个 exact head 重跑，并保留完整 differential 结果，49 个 row id、增长值和 allowance 完全一致；失败规范化摘要 1e363375b912c7440b8c5b442f503c145b2f72a1c9c2fe7db94690606ff489dd。该检查默认比较 origin/main，独立按实际 PR base 的 96 项比较通过；没有修改限制、断言或只挑绿色重跑。它归为 pre_existing_unrelated，而不是此 PR 的行为回归，仍不称整个 merge gate 绿色。

advisory 先于 full-tree semantic 检查执行，判定涉及 registered readability / local request wire，而不以相似字符串合并不同领域状态。输入、source、receipt、unknown、停止和恢复义务仍由 typed owner 约束；UI own-next-action 是建议，权限和终局 guard 是机器义务。未查询、轮询或等待 GitHub CI。

我的整体评价

结论为 APPROVE，没有当前阻塞 finding。交付判断是 justified_increment：long_horizon improved（原 request 和 Goal terminal 不混淆，未知结果仍可恢复）；user_experience improved（原会话修正/取消、可靠保留与读回，不要求用户重新拼接 identity）。这不完成真实团队 M2/G1 或把新的 work record 当 Goal 验收。

42-file 范围在原请求、Goal 和原回传三条必须一起成立的边界内相称。邻近未来演进检查已采用原 planWorkCommit、来源事实/route 共用 owner 和完整浏览器存储读回；不要求新数据库、workflow engine 或第二个 Python 决策源。旧请求与 revision1 receipt 是实际 persisted compatibility；保留一种 typed owner 的显式变体合理，不能为了减少版本擦除历史。三个 wire closed sets 是 collaboration local contract，owner/frontend 共用，formal 26-vocabulary scope 未扩张。

English verdict: APPROVE. The prior retention defect is fixed: silent drop, changed stored content and unreadable storage all prevent dispatch while preserving the draft; ordinary response loss survives reload and replays the identical original request. Independent native File/SQLite, real PostgreSQL and packaged original-conversation recovery passed. The unchanged baseline CLI-budget failure is separately attributed and remains a merge-validation hold; this approval grants no merge or runtime activation authority.

[songoow]

Conflict repair and review-fix readback at 2ee697f7742c5d626ed24ef391c3d1c52062c05d (merged main 6ebba628083792f3c428453566a9d8c2d9e3b036).

Conflict resolved. The only conflict was loopx/semantics/project_registry_io_manifest_v1.json: main (#6375) retired the committed manifest and computes the registry I/O census on demand. The resolution takes main's deletion; the computed census for this head validates with zero errors (every site this PR adds is a codec_api read or transaction, so no new direct-I/O classification is needed). No other paths conflicted.

Review P2 (verify recovery storage before dispatch) — fixed and re-verified on this head. 75002e186 reads the pending identity back after setItem and refuses to dispatch (keeping the editable draft) when the readback does not match. The packaged request-control browser smoke now injects silent-drop, changed-content and unreadable retention faults: each refuses execution with zero dispatched mutations, revision stays 1, the draft text stays editable and no retry entry appears; normal storage then still replays only the original request after a lost reply and reload. This run passed on the merged head.

Validation on this exact head (local, Node 22.22.3, File/SQLite; PostgreSQL cases skipped and not requalified):

• control-plane typecheck: pass
• TypeScript owner tests (request_control, goal_amendment_authority): 23 tests, 19 passed, 0 failed, 4 PostgreSQL cases skipped
• Python native request-correction / Goal-amendment HTTP, source-registry denial, registry I/O census and inventory suites: 61 passed, 0 skipped
• semantic vocabulary drift test: 126 passed; semantic advisory over the diff vs main reports only the three collaboration-owned request closed sets already disclosed in this PR, nothing new from the merge
• request-control browser smoke (real source registration, Chat entrance, retention negatives, correction, lost reply/reload/exact retry, stale edit, receiver CLI, cancellation readback): PASS
• git diff --check: clean

Harness note: the first local attempt reported setup errors in every SQLite-parameterized case because a previously spawned managed Effect runtime was running on Node 25.2.1, whose embedded SQLite main now refuses as unqualified; rerunning on Node 22.22.3 passed. This is an environment condition, not a change in this PR.

No limits, retention, activation authority or product defaults changed in the resolution. Hosted CI and exact-head review remain separate; this is a conflict-and-fix record, not approval or merge readiness. No merge performed.

[songoow]

Review-fix and main reconciliation at d88a36cd6 (merged main 373f2fa12).

Failing dashboard-browser shards fixed. Main's new CSS custom-property check rejected three bare var() references in collaboration-card.css: --color-border on lines 11 and 17, and --color-text-secondary on line 19. No stylesheet defines either token, so those declarations were silently dropped: the request-control divider and the input separator had no border, and the help text was not muted. They now use --pw-line and --pw-muted, the tokens the surrounding personal-workspace rules already use. The check fails on exactly those three lines before the change and passes after it.

Merge. No textual conflicts. Main now contains #6338, which shares Goal source routing, the configuration API and the effect handler table with this branch, so the overlapping suites were rerun on the merged tree.

Validation on this exact head (local, Node 22.23.3, File/SQLite):

Check	Result
control-plane typecheck	pass
TS request_control, goal_amendment_authority, direction_authority, effect_runtime_handlers, effect_runtime_handler_loading	38 passed, 0 failed, 5 skipped (PostgreSQL cases; no server)
Python request-control, request-amendment recovery, source-registry denial, registry I/O census, Goal direction runtime and chat	88 passed, 0 skipped
CSS custom-property check, dashboard build and chat bundle	pass
packaged request-control-browser-smoke (real source registry, SQLite, Chat entrance, Agent CLI)	PASS, including silent-drop / changed-content / unreadable retention refusing execution, unknown reply + reload + exact retry, stale edit and cancellation readback

Known main-wide failure, not from this PR. content_digest_single_owner ("the owner's consumers are the pinned set") fails on main itself because #6338 did not pin direction_authority.ts. #6431 carries that one-line pin. typescript-core will stay red on every PR until it lands; this branch already pins its own request_control consumer.

Not run: PostgreSQL, Windows, live model or Lark. This records the repair; exact-head review is still required and no merge was performed.

[songoow]

CI note: the red typescript-core (2/3) shard on this head is the content-digest single-owner guard failing on current main itself (direction_authority.ts from #6338 is not in the pinned consumer list). The one-line repair is #6435; this PR adds no digest consumer of its own. 中文：该分片失败来自主干，修复见 #6435，本 PR 未新增 digest 消费者。

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[songoow]

Merged current main (f713e0f) at 9c61426 to clear the conflict.

• Only conflict: tsconfig.control-plane.json. build(types): discover production sources instead of maintaining per-file lists #6411 replaced the per-file production list with loopx/control_plane/**/*.ts; resolution keeps main's globs and re-adds this branch's tests/control_plane_ts/request_control.test.ts entry. All other files auto-merged.
• Validation on 9c61426: control-plane tsc --noEmit and dashboard tsc --noEmit pass; the PR's three Python modules 43 passed; request_control + goal_amendment_authority + content_digest_single_owner TS 35 pass / 1 fail / 4 skip; examples/semantic-vocabulary-drift-smoke.py ok.
• The one TS failure is the pre-existing direction_authority.ts pin missing on main itself. Correction to my earlier note: the repair is test(digest): pin the direction authority consumer to restore main #6431; test(digest): pin direction_authority as a canonical digest consumer #6435 was closed as its duplicate.

中文：已合入最新 main（f713e0f07），唯一冲突是 #6411 把 tsconfig 改为目录 glob，保留 main 写法并补回本分支的 request_control.test.ts。上述检查通过；唯一 TS 失败来自主干缺少 direction_authority 登记，修复入口更正为 #6431（#6435 已作为重复关闭）。

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork