[BigDataDZ]

Goal And Delivered Outcome

• Outcome basis: reproduced parser exception in the shipped doctor App/CLI pairing observer.
• Gap: plistlib.loads raises xml.parsers.expat.ExpatError for truncated or mismatched XML. This is outside the existing handled exception types, so a damaged macOS Info.plist aborts collect_doctor instead of returning its existing unknown-identity diagnosis.
• Before → after: both malformed XML cases raise on unchanged main; both now return unknown through the real observer and doctor consumer. Files remain unchanged and running_app_verified remains false.
• Intended base: main; no broader App compatibility qualification is claimed.

Author Declaration

• Written by: model_agent — OpenAI Codex, GPT-6 family.
• Specification and revision: loopx/desktop_installation.py's read-only pairing contract and tests/test_desktop_installation.py at 12803354ab13a003de8620ab496250617224ff37. Unreadable identities must retain unknown compatibility without modifying or repairing bundles.

Criterion	Disposition	Symbol / path	Evidence
Malformed XML remains unknown instead of aborting diagnosis	implemented	desktop_installation_status	Truncated and mismatched on-disk XML; existing parser executed directly
Existing doctor consumer returns a report	implemented	collect_doctor	Disposable bundle supplied at the location-discovery boundary; real parser and doctor path run
Preserve read-only and conservative pairing behavior	implemented	existing status owner	Byte-for-byte bundle checks, false running-verification flag, existing paired/mismatch/multiple-App tests

• Self-check: read full changed diff and the doctor call site, verified the exception hierarchy and checked related PRs. Tests fail before the production change. The Python module remains the existing host-specific App bundle reader; no parallel decision owner is added.

Scope And Continuation

Complete within this scope. Catch only the parser's concrete XML exception alongside existing file/value exceptions. The bounded future-facing pass found the existing read-only observer sufficient: no broad catch, second parser, state vocabulary or recovery framework is needed.

Validation

• Tested revision: current PR head, with failing-before tests run on the unchanged base.
• Run state: finished. Input classes: synthetic and public_fixture.

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	Two malformed XML cases fail before the fix with ExpatError; they pass afterward.
unit	passed	Full python -m pytest -q tests/test_desktop_installation.py: 9 passed. Valid pairing, mismatch, multiple bundles, unreadable identity and absent App controls retained.
real_entrypoint	passed	Both malformed cases also execute real collect_doctor. Only App-location discovery is redirected to disposable filesystem bundles; parser, identity decision and doctor reporting are not mocked.
static	passed	Focused Ruff, diff-scoped semantic advisory (no supported new vocabulary), staged bilingual RFC check, whitespace and public-boundary review.
integration	not_run	Native macOS installed-App discovery/startup and full repository CI were not run. These tests execute the standard-library plist parser on Windows; they do not claim running-App verification.

Frontend / Visual Evidence

Not applicable: existing diagnostic readback only, with no UI/layout or first-screen change and no new capability. No App files, active Goal or user configuration are changed by the implementation or fixture.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; reasoning_effort=max; declaration_source=runtime_reported; execution_observation_id=27fbaa154dc58cf6c39f08cbecc6542890c378cc5e3cdc446b14ac23890a9b09

未发现阻塞性代码问题。最强反例与回归敏感性已经由同一输入的基线/head 真实执行覆盖。

动机 / Motivation

运行 doctor 检查本机 App 与 CLI 来源是否一致的 macOS 用户。例如已存在的 App 的 Info.plist 是截断 XML 时，旧版解析异常会中断整份诊断；修复后该 App 保留 unknown，其他 App 的观察与 doctor 输出仍可继续。独立实测四类损坏 XML、健康 XML/binary plist、不同 App 顺序与 revision 组合，并通过真实 collect_doctor 验证 unknown、可选检查和 bundle 内容不变，共 22 例通过。本 PR 不修复或替换 App、不判断 revision 的先后关系，也不把磁盘上的 bundle 身份当成运行中 App 已验证。

改动思路 / Approach

XML 解析失败属于现有 App 身份读取 owner 的 provider IO，补充具体异常即可复用已有 unknown 投影和恢复建议；无需新状态、通用控制面策略或自动修复器。当前 PR 完成损坏 XML 下不中断诊断且保留未知身份的只读闭环；运行中 App、原生启动和真实兼容性仍须由 App 启动诊断验证。

正常流程仍由 doctor 读取磁盘 bundle 信息，与 CLI 来源 revision 比较，再展示每个 App 的观察和聚合状态。解析损坏 XML 后只把该项保留为 unknown，不推断兼容性，也不要求用户重新提供已知信息。若另一个 App 已明确 mismatch，聚合仍报告 mismatch，而不是让新增异常处理掩盖该证据。 搜索基线和 exact head 的定义及相邻 caller 后，没有发现需要保留的第二套决策规则。采用仓库经验建议中的真实任务、恢复和 readback 检查；通用 recovery RFC 与长期收益研究不被升级为本修复的新强制验收门。该边界无需额外图示，源代码与执行对照足以说明分支。

具体改动 / Changes

生产文件增加 2 行、删除 1 行，测试增加 42 行。新 import 来自标准库 xml.parsers.expat；原有 schema 和四种状态没有变化。先读基线 desktop_installation 的只读模块契约、已有 unknown/mismatch 测试以及安装指南，再读 diff。没有找到为 ExpatError 单独规定的正式书面验收条款，spec_basis=no_spec；以真实 parser 失败、既有只读契约和独立控制案例判断，不从 patch 反造规范。

关键代码讲解

1. desktop_installation_status在第 48 行把 ExpatError 加入现有精确异常元组。损坏 plist 时保持 revision=None，进入既有 unknown 分支；第 67 行聚合继续让明确 mismatch 高于未知项，返回的 running_app_verified 仍是 False。
2. collect_doctor在第 1145 行调用该 owner，第 1148 行继续把 pairing 作为可选检查。真实调用验证了 malformed XML 不再中断报告，且没有把局部读取失败变成新的必需安装门禁。

新增测试使用真实文件与 plistlib，只替换 App 位置发现，未 mock parser。独立探针额外覆盖未定义实体、无效 UTF-8 XML、健康 binary plist 和多 bundle 顺序，逐字节比较 bundle 内容，并执行真实 collect_doctor；不把 helper 的成功等同于运行中 App 验证。

对主干的风险 / Risks

未发现阻塞性代码问题。最强反例与回归敏感性已经由同一输入的基线/head 真实执行覆盖。 相关六文件测试为 89 passed / 13 skipped；Ruff、配置内 mypy（17 个源文件）及原预算串行完整 premerge 均通过。13 项条件跳过不能当作原生 Windows 验证。

首轮两项完整 premerge 并行运行时，安装 smoke 均达到默认超时，保留为 FAIL；未修改基线同预算单独运行 67.34 秒通过，此后两 head 串行完整检查通过。没有提高阈值，也不声称查明了并行超时根因或已获得并行冷构建稳定性资格。 maintainability ratchet 仍报告既有 _admitted_interaction_next_cli_actions 超限：独立基线与 head 的完整失败文本一致，相关函数和规则未改；native gate 将其标为 advisory_inherited_failure，保留该红项而不伪装通过。

本 PR 不修复或替换 App、不判断 revision 的先后关系，也不把磁盘上的 bundle 身份当成运行中 App 已验证。 异常捕获没有扩大为 Exception，也没有把损坏文件当作健康；复用现有四态投影，不增加typed vocabulary或自动修复动作。

我的整体评价 / Verdict

对 head a01d03e3109a49a6ccb25a1f5714f74963333b68，problem_context=goal_achieved 仅指该具体现有缺陷修复，change_proportionality=proportionate；代码量与验证均围绕同一真实 caller。long_horizon=preserved：不改变工作状态、调度、配额或权限，也没有量化长期收益；user_experience=improved：既有 doctor 入口可继续完成该恢复/诊断任务，没有新增必需交互轮次。

loopx/desktop_installation.py 与 tests/test_desktop_installation.py 仅改变只读诊断错误路径，没有渲染页面或布局变化，因此 visual_review 为 not_applicable。运行中 App 身份、原生 App 启动、Windows 原生执行和并行冷构建耗时未获本轮验证。 observable_semantics=intentional_change_validated，保留旧缺陷失败和合法控制输入对照。复用标准库与既有owner已是合适的有界简化，额外抽象没有当前收益。原生平台、运行中App和并行构建的未验证范围保持明确；本结论不授予 merge、安装或激活权限，合并资格须另查。

English verdict: APPROVE — a01d03e; no blocking finding; changed-invariant probes and serial repository validation passed, with prior timeouts and inherited ratchet debt retained.