[loopx-agent]

Goal And Delivered Outcome

Three existing regression families treated readable canonical state as execution permission, or selected a health finding as the Goal's data projection. A fourth expected an admitted Turn to become unrecoverable after its primary Task was blocked. On f72b67113, these assumptions produce 11 failures across four complete test modules.

This change corrects those test oracles against the already shipped owners: canonical observation survives a missing Goal document, automatic delivery remains refused, and a blocked primary permits only its original idempotent no-spend closeout. The previously emitted auxiliary-monitor command remains rejected. No production implementation or execution gate changes.

• Outcome basis: reproducible mainline qualification failure; existing status/health contract and the merged fix(quota): close blocked advancement attempts without a retry clock #6936 settlement contract.
• Before → after: the four complete modules change from 11 failed / 37 passed to 48 passed, with additional refusal, recovery, identity, retained-blocked-state and replay assertions.
• Intended base: loopx-project/loopx:main. Related fix(quota): close blocked advancement attempts without a retry clock #6936; fix(status): fail closed on truncated legacy Todo sections #6921 owns the separate legacy-section truncation case and is not copied here.

Author Declaration

• Written by: OpenAI Codex model agent under the requester's direction.

Implemented against

• Specification and revision: docs/status-data-contract.md, docs/quota-allocation.md#receipt-backed-settlement-progress, and the missing-Goal health rule at base f72b67113ff42ccf385519222a530a11ce22659c.

Criterion	Disposition	Path	Evidence
Canonical lease readback survives a missing document without reconstructing it; provider failure refuses stale fallback	implemented	test_canonical_goal_channel_coordination.py	Real File/SQLite CLI, exact current lease and provider failure/recovery
Capabilities do not replace missing Goal intent or silently grant a repair output	implemented	test_capability_gate_cli.py	Markdown/File/SQLite with network present/absent: normal admission → missing-document refusal → byte-preserving recovery
Canonical acceptance stays visible and held without exposing verifier commands	implemented	test_goal_acceptance_runtime.py	Explicit data-row selection, retained hold, refused execution
A blocked primary retains its original settlement identity without admitting an auxiliary observation	implemented	test_auxiliary_scoped_gate.py	File/SQLite and source/global routes; denied old monitor command; exact closeout replay; zero debit; primary stays blocked
Attention can contain a health row and a data row for the same Goal	implemented	docs/status-data-contract.md	Bilingual clarification; no API shape or ordering change

Self-check: read the existing production rules before changing assertions. The seven source-loss failures do not establish lost canonical data: the health row preceded the full read model, and missing-document admission was deliberately refused. The four primary-blocked failures reflect the accepted #6936 recovery change; the monitor command's rejection is preserved. Historical failed/incomplete runs remain failed/incomplete.

Scope And Continuation

Complete within the regression/contract scope. Production code, typed authority, provider routing, defaults, release candidates and installed runtimes are unchanged. This does not qualify an entire release or finish unrelated outcome validation.

Bounded refactoring: clarified the existing multi-row read-model boundary and extended the current test families instead of adding a new fixture framework or parallel owner. No new semantic vocabulary. Real PostgreSQL-store integration is not applicable because no store/provider or production behavior changed.

Validation

• Tested revision: 714c7d1fef4ac388169594baf10b06555c3a7e92.
• Run state: finished. Inputs: synthetic disposable registries/runtimes; no live Goal state or model execution.

Check	Result	Scope and limitations
Baseline reproduction	failed, retained	Same four complete modules at base: 11 failed, 37 passed
Changed regression families	passed	48 tests across all four complete modules; native CLI File/SQLite and legacy Markdown boundaries
Adjacent owners	passed	202 tests: canonical status/Todos, contract health, scoped quota, shared registry-finding vocabulary and lease recovery
Native premerge	passed	5 direct checks and 18 selected checks, including public-boundary scan; zero failures/warnings
Static/hygiene	passed	Ruff, compile, RFC-pair check, diff hygiene; semantic advisory found no supported new carriers
Whole Python suite	not_run	Not rerun for this tests/docs-only change; no full-suite or release qualification is claimed

Frontend / Visual Evidence

• UI impact: none; no first-screen, component, CSS, configuration or product interaction changes.
• Native browser readback: existing packaged Chat is checked with a disposable SQLite fixture; this is readback qualification of the unchanged interface, not installed-App adoption or creative/product acceptance.
• Public visual evidence: N/A for this tests/docs-only diff. Private captures are not uploaded as proof.

Boundary Checklist

• Focused existing regression/contract repair; no production implementation changes.
• Public-safe synthetic fixtures and aggregate validation only; no credentials, private state, raw logs, internal URLs or host paths.
• Existing semantic owners and all permission/settlement checks retained.
• No RFC pair changed; the native bilingual check passed.
• DCO Signed-off-by trailer included.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

维护者在验证 Goal 文档丢失或任务受阻后的恢复路径时，会遇到回归套件对既有安全规则的错误期待。原测试把同一 Goal 的首条健康告警当成数据视图，并在删除目标文档后要求准入；现在分别验证可回读、拒绝执行和恢复后重新准入。此次交付修正现有回归验证，保护原有只读状态、阻塞和结算边界。本 PR 不修改生产实现、默认行为、模型载荷、发布候选或已安装运行时。

改动思路

先区分“能查看已有状态”和“允许执行工作”。目标文档缺失时，健康告警与权威数据投影可同时存在，读取者不能仅按 Goal 取第一行。另一路是已准入任务转为阻塞：guard 可以要求原尝试收尾，但这不允许继续执行或轮询旁路任务。因此保留现有生产 owner，仅改测试取数与完整断言，比放宽生产门更小也更安全。

情况	保留的观察	保留的限制
Goal 文档缺失	当前 canonical Todo、lease、验收	不授予自动执行，不重建文档
primary 转 blocked	原 Turn 身份及 no-spend 收尾	旧 monitor 命令仍拒绝，Task 仍 blocked

具体改动

关键内容讲解

接受依据为 docs/status-data-contract.md 与 docs/quota-allocation.md#receipt-backed-settlement-progress，固定修订 f72b67113ff42ccf385519222a530a11ce22659c；评审 head 为 714c7d1fef4ac388169594baf10b06555c3a7e92。

state_file_missing：test_canonical_goal_channel_coordination.py::channel 与 test_goal_acceptance_runtime.py 显式选择带相应投影的唯一数据行，同时断言缺失告警、验收 hold 和执行拒绝。test_capability_gate_cli.py 先验证原有 capability 语义，再删除文档验证拒绝及 canonical 可读，恢复原字节后重核同一候选。provider 不可用时不读旧显示数据的负例仍在。

typed_blocked_writeback_no_spend：test_auxiliary_scoped_gate.py 保留旧 monitor 命令的 identity-conflict 拒绝，新增同一原尝试的收尾与 replay，核对零扣额且 primary 仍 blocked。双语文档只说明已有多行读模型；没有新增协议、字段或默认规则。四个现有测试族复用原 fixture，未增加独立框架。

对主干的风险

没有 P0/P1 或其它阻塞发现。最危险的替代方案是为满足旧断言而放宽准入，本 PR 没有改生产代码。四个完整模块 48 项通过，邻近 canonical/health/scope/lease 202 项通过；原生 premerge 的 5 项直接检查和 18 项选中检查全部通过。真实 File/SQLite CLI 覆盖源缺失、恢复、受阻后的旧命令拒绝和收尾重放；打包 Chat 的 SQLite 合成只读验收覆盖 provider 失败后清除旧状态及重试恢复。未运行整仓全量套件，不把历史失败、中止记录或浏览器回读当成整版发布通过。按当前配置未查询远程 CI。

我的整体评价

APPROVE。命名的回归修复范围已完成，交付判断为 goal_achieved；long_horizon=preserved、user_experience=preserved：原承诺、阻塞和恢复规则保持，用户没有新增准备或确认步骤。该结论仅覆盖此测试/说明 PR；无安装、模型调用或发布资格推断。相同作者最近 12 个 PR 与既有覆盖检查未发现重复铺设，本次扩展现有回归有直接维护价值。现有状态词汇全部复用；更宽的完整资格由原有工作继续，不为本 PR 新增仪式性后继。

English verdict: APPROVE — 714c7d1fef4ac388169594baf10b06555c3a7e92. Corrects obsolete regression assumptions while preserving missing-intent refusal, canonical readback, monitor rejection and original no-spend replay. 250 focused tests and native premerge passed; production behavior is unchanged. Full-suite and release qualification are not claimed.