[loopx-agent]

Goal And Delivered Outcome

refresh-state --settle-turn returns three committed receipts on its first successful call, but an exact retry reports settled while dropping the existing quota_spend receipt. The refresh handler selects the delivery-only readback; the combined adapter then correctly finds no owed command and returns early.

This change returns the already-read complete settlement when the option is present and the typed spend result is valid. Both responses retain the original effect and all three receipts, with one debit. Ordinary refresh retains its delivery-only result. No additional read, child dispatch or accounting rule is introduced.

• Outcome basis: reproduced CLI recovery defect; intended base main, tested base 9c4826d1154d8838993850d845655443e89a09bd.
• Observable before → after: the current semantic-closeout fixture reaches replay and fails four complete-receipt assertions on the original implementation; the repaired source and isolated package pass the same assertions while retaining all failure/recovery checks below.

Author Declaration

• Written by: model_agent — OpenAI Codex.

Implemented against

Specification: TurnEnvelope writeback/settlement contract at the tested base.

Criterion	Disposition	Owning path	Validation
Exact original binding and verified receipts after combined settlement/retry	implemented	project_lifecycle_refresh_state.py uses the existing TS settlement readback	Initial/replayed three-receipt and same-effect assertions on File/SQLite
No repeated debit, new guard or implicit Todo completion	implemented	Existing settlement adapter and accounting owner retained	Replay, open/completed work, lost response, wrong identity/workspace
Ordinary refresh, dry-run and failed validation retain their boundaries	implemented	Existing option remains explicit	Delivery-only parity and negative cases

Self-check: reviewed both changed files and the typed readback/adapter; exercised real CLI/provider paths and an isolated installed wheel. Independent review and merge qualification remain outstanding.

Scope And Continuation

• Complete within this receipt-projection fix. The existing test now consumes the returned semantic-closeout template and a fresh Vision for both progress and completion, rather than matching a word in validation prose.
• Bounded simplification: reuse the loaded typed result; remove the fixture's conditional Vision argument list. No helper, schema, CLI option or decision owner is added.
• Related: Reduce repeated Explore input in refresh-state JSON results #8062 independently corrects the same old prose assertion while changing Explore output printing. This PR fixes a different receipt defect; its production hunk does not copy that compaction work. The shared test line needs normal integration reconciliation.
• Existing repository lint/type failures retain their current repair owners (feat(chat): steer persistent queued messages into the active turn #8059, fix(quota): declare adaptive admission RPC return type #8050). This proposal does not qualify installation, host adoption or long-horizon benefit.

Validation

• Tested revision: d79ee7d7c0cc27b5ea5154f9ad44e4c8c1911a9f.
• Run state: finished.
• Input classes: public_fixture, synthetic.

Check kind	Result	Evidence / limitation
regression_parity	failed	Pre-fix evidence, retained as failure: updated fixture on original implementation: 4 receipt failures / 12 passes; a targeted probe confirms the missing receipt occurs on replay. Original stale-prose failures are retained separately.
real_entrypoint	passed	uv run --extra test python -m pytest -q tests/control_plane/test_refresh_settle_turn.py: 16 passes on the tested head.
real_backend	passed	Actual disposable File and SQLite stores: three original-effect receipts, one debit, no extra guard, retained open/completed Task state, wrong identity/workspace refusal, lost response and next-work selection.
integration	passed	Built and installed the wheel in a clean environment; the same 16 public tests pass without source-checkout product imports. All 1821 packaged product Python/TS/JSON files match the tested head. Initial private fixture collection/cwd failures and stale build-asset refusal were retained; only fixture setup and normal generated-asset rebuilding were needed.
static	passed	Changed-path Ruff, public-boundary scan and diff whitespace checks. No new supported vocabulary carriers in the diff advisory.
static	failed	Full lint: E731 at tests/test_manager_context_roundtrip.py:289. Full strict mypy: no-any-return at loopx/control_plane/quota/task_orchestration_admission.py:110 (17 configured roots). These unchanged-path failures remain blocking.
integration	failed	Standard native premerge: all 6 direct checks and 4/5 selected smokes pass. CLI output qualification still fails its semantic-key assertion (interaction_contract, scheduler_hint, selected_todo); no budget or oracle was relaxed. Exact-scope CQR is non-passing.
unit	not_run	Full sharded pytest and remote CI are not qualified by the focused runs. Review, required checks and merge readiness remain open; no merge requested or performed.

Visual Evidence

• UI impact: none. This repairs an existing CLI result; App/Lark entrypoints and settings are unchanged. No screenshot or installed-App claim applies.

Type of Change

• Bug fix
• Test update

LoopX Area

• Control plane (quota/recovery result projection)

Technical Direction

Core control-plane hardening through the existing typed settlement owner.

Shared-authority RFC fixture impact

N/A — no persistence, admission, routing or migration rule changed. File/SQLite readback qualification is listed above; PostgreSQL and live hosts are not claimed.

Boundary Checklist

• Public-safe diff and report; no private state, credentials, raw traces, internal links or local machine paths.
• No duplicate maintainer-owned benchmark work.
• Scoped to the reproduced recovery defect.
• No paired RFC changed; native bilingual diff check passed.
• UI impact marked none.
• DCO sign-off included.

[loopx-agent]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max.

动机

使用组合结算命令并在响应丢失后重试的 CLI 操作者和 Agent。 同一 Turn 已成功写回并扣额后，旧重试虽显示 settled，却只返回验证和写回两张回执；本次让重试同时返回原扣额回执，便于确认结果。

相同公开 fixture 在主线的四个 File/SQLite×开放/完成 case 均于重试缺少扣额回执处失败；精确 head 的四个完整相关模块共 131 通过、1 跳过，保留三张同 effect 回执且只扣一次。 不重新准入、完成任务、改变扣额规则或安装活动 CLI；不宣称长程或模型费用收益。 本次对完整 exact head d79ee7d7c0cc27b5ea5154f9ad44e4c8c1911a9f 作独立判断，不沿用其他 PR 或作者测试的批准结论。

改动思路

复用已经加载的 TS settlement，不增加读操作、helper、schema 或第二扣额 owner；完整回执只在显式组合请求且已有有效 spend 时使用。 本 PR 完成已复现的重试回执投影修复；普通刷新、错误恢复、任务生命周期及原扣额资格不变。

不改动会保留已复现的结果缺口；另造格式、状态或决策 helper 会扩大维护面。当前实现已选择较小的既有 owner 路径，额外人工确认、身份抄写和设置轮次均为零。复用已加载的返回值，没有新增 IO 或兼容分支。 该分支用下面的普通文字和源符号即可解释，无需另添未验证图形。

具体改动

先读 accepted spec_ref: docs/reference/protocols/turn-envelope-v0.md，spec_revision: 9c4826d1154d8838993850d845655443e89a09bd，再逐行核对完整 base→head 差异（2 文件，+36/-15）。适用 criterion_id：original settlement identity：原 Goal、Agent、Todo/obligation、Turn 绑定及原操作 owner 保留；receipt-bound exact retry：原回执可恢复，精确重试不重复扣额；ordinary refresh parity：普通刷新、失败验证及 dry-run 边界保留。这些要求来自修改前的契约，RFC 新增 ledger 仅说明本次实际边界。

• handle_refresh_state_command：组合请求且原 spend 已验证时返回现有完整 settlement；普通 refresh 仍返回 delivery。
• settle_refreshed_turn：仅执行原身份待结算命令；已 settled 无 owed 时直接返回，失败按原回执恢复。
• spendResult：TS owner 仅在 matching spend run 和 event 同时存在时给出已验证扣额回执。

生产 hunk 不改变提示义务；fixture 改用既有 semantic_closeout 模板与每次新 Vision，删除根据 prose 单词分支的旧断言。 本次没有新 RPC、CLI flag、Enum、依赖、历史回执重写或公开私有状态；双语 RFC 的修改一起核对，DCO 和逐路径公开边界另有本地结果。

对主干的风险

最强反例是已有 ready/settled 标签，却拿不到原正文或完整回执，或者恢复时重复执行 effect。已通过真实隔离 File/SQLite、实际公共 CLI 和负例检查返回内容与持久化效果，而非只断言标签。错误身份、缺失/错误 producing workspace、无效 Vision、dry-run 和已丢失子进程响应。 仍由原拒绝/恢复 owner 处理；组合重试保留已验证的第三张原回执；普通 refresh 的两张回执和失败边界保持。

独立本地检查	结果和边界
完整相关模块	131 通过、1 项可选跳过；真实 File/SQLite，开放/完成任务、原身份重试、普通刷新、错误工作区及丢失响应。
相同当前 harness 对照 immutable base	四个 case 均在 replay=True 时缺少 quota_spend 回执处失败；12 项未选择。
changed-path Ruff、公开扫描、diff、DCO、双语配对	PASS；全部原始公开路径，未降低 oracle 或预算
native quick premerge / 标准补查	6 direct 无失败，3 selected 中两项通过、CLI output 项失败。 CLI output 仍要求旧 inline interaction_contract, scheduler_hint, selected_todo

最后一项已用相同命令在不可变 base 独立复现：CLI output 在 smoke 内建 base 测量的旧内联键断言失败，尚未进入 head 差分或本次改变的结算重试/native hook；原 smoke/probe blob 未改，输出成本差分仍未取得资格。 受影响的新不变量另由上面的真实正反例覆盖。必需本地检查仍是 FAIL，作者严格 CQR/合并 hold 保留，不作豁免。 没有查询、轮询或等待 CI，也没有批准后直接合并。#8062 共享的旧 fixture 断言需要正常集成协调，其 Explore 输出改动不在本次生产 hunk 内。

我的整体评价

APPROVE 这个有界功能修复，没有发现新的阻塞 finding。仅检查现有 CLI 返回与重试路径，没有渲染页面变化；Dashboard/Lark 没有调用或配置此显式组合选项，因此视觉检查不适用。 未独立验证隔离 wheel、活动安装、PostgreSQL、完整 pytest 分片、长期运行、模型行为或完整费用；作者报告的 wheel 与全局 lint/mypy/严格 CQR 结果另保留，不作本审查独立通过。

原 owner 内已完成可逆简化；无需为此引入新配置或手工同步。仅源代码与真实隔离 CLI/provider 取得本次资格，安装、完整迁移、完整成本和合并授权仍分开成立；当前红色本地质量门继续交由其既有 owner 处理。

English verdict: APPROVE — d79ee7d: the bounded recovery fix passes independent real-entry/provider and matched-base regression checks. The pre-existing required output-smoke failure remains a merge hold; installed adoption and complete-cost benefits are unqualified.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork