[loopx-agent]

Goal And Delivered Outcome

• A restart between Core queue admission and saving the project request's continuation pointer can strand the admitted Turn. Its own queued input looks like a later equivalent input, so the planner falls through to a restricted result review that cannot recover the writable reservation.
• The planner now attempts to recover the already-admitted Turn with its original reservation and identity before considering a fresh result review. Source verification, native history and dispatch-time effect checks still apply.
• Intended base is main. The failing-before reproduction reaches the Feishu reconciliation entry point using a synthetic project session.

Author Declaration

• Written by: model_agent | GPT-6 | OpenAI

Implemented against

• Specification and revision: docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md at 97cc1e0c40e766c73193b8077526a7f565dc561b.

Criterion (spec clause)	Disposition	Symbol / path	Test or command
Explicit unfinished work after a completed Turn	implemented	planUnfinishedWork	Crash after admission and before the request pointer is written
Completed private project result reviews	implemented	planCompletedResultReview and its dispatch in planUnfinishedWork	Existing admitted work is recovered by the same identity. Source and input mismatches fail closed.

• Self-check before submission: read the caller, planner and dispatch guards, compared the full recovery matrix against the exact base, and ran the suites below.

Scope And Continuation

• The reservation race is addressed in this change. Production adoption and observation of natural recovery are separate steps. The recovery matrix still has eight baseline failures with identical failure details on the candidate.

Validation

• Tested revision: 9459e195e0cf4033bb98f587ed26375163c81bdb
• Run state: finished
• Input classes: synthetic, public_fixture

Check kind	Result	Public-safe evidence / limitation
unit	passed	61 cases in tests/control_plane_ts/conversation_binding.test.ts, including the existing exact Turn, source and input mismatch cases.
integration	passed	237 cases across conversation binding, Codex history and interrupted steward answers.
real_entrypoint	passed	Five targeted project recovery cases through the real reconciliation handler with a synthetic upstream. The crash case fails on the base and passes on the candidate. Queue, original source and native history are rechecked before dispatch.
regression_parity	failed	The existing 24-case project recovery matrix is 12 passing on the base and 16 on this revision. The eight remaining failures match the base case for case and detail for detail. They are excluded from the targeted pass claim.
static	passed	npm run typecheck:control-plane and the exact-revision local premerge checks, including bilingual RFC parity.

• Coverage and gaps: The integrated cases exercise recovery and dispatch through the real handler with a synthetic provider. Natural backlog recovery on an installed service is still unverified for this change.

Frontend / Visual Evidence

• UI impact: none. The diff changes internal recovery selection and its RFC and test coverage.

Type of Change

• Bug fix
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)

Technical Direction

• Operator surface and IM integration.

Shared-authority RFC fixture impact

• N/A. This fixes local conversation recovery within the existing data contract.

Boundary Checklist

• Public-safe diff and description.
• Scoped to project conversation continuation.
• Both RFC languages and the exact premerge check are included.
• UI impact is marked none.
• DCO trailer included.

[loopx-agent]

Reviewer: model_agent | GPT-6 | OpenAI | self_reported

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机 / Motivation

飞书私有项目会话有时会在完成一部分工作后留下明确的续办请求。进程若在入队与更新原请求之间重启，用户可能一直等不到续办结果。 旧版把已入队续办追加的原文识别成稍后提交的同文输入。它先选择只读复核，原请求仍指向先前的部分答复。 本次用真实对账入口复现该故障，候选版本找回原队列中的同一 Turn，原消息和既有校验都保留。 本次交付覆盖已持久化的项目续办。安装后的真实历史消息和未结事项仍由原服务逐条验收。

改动思路 / Approach

保留 Core 的续办决策和飞书原处理器的执行职责。使用原预留记录和已入队 Turn 作判断，避免从消息文本推断是否该再执行。 本 PR 的范围是原请求与已经入队的 Turn 之间的重启接续。 原生消息比对仍负责识别真正的新输入。对账先查原预留是否已经有持久化 Turn，然后沿当前授权重新核验来源。已通过校验的原 Turn 才能接回原请求，后面的派发仍核对队列和原生记录。

具体改动 / Changes

• 飞书原对账从 Core 读取已有 Turn，取回同一编号，再更新原请求指针。没有持久化 Turn 的场景仍走原有预留和入队规则。 原对账入口
• Core 在既有可写预留和已入队 Turn 同时存在时，进入原来的精确匹配分支。重新核对编号、会话、正文、来源和附件后才把该 Turn 交回调用方。 续办计划器
• 只读复核保留独立身份和预算。原状态已明确进入只读复核时，仍按原规则接回该复核。 结果复核
• 两种崩溃位置和三种队列或原生记录变化由真实对账入口测试覆盖。新增断言检查来源未验证时仍不具备执行资格。 计划器测试

基线 RFC 条款	结论	验证
Explicit unfinished work after a completed Turn	implemented	已提交的 work-1 经过重启后接回同一 Turn
Completed private project result reviews	implemented	已入队可写续办保留身份，另有独立的只读结果复核

基线 RFC 要求恢复同一已提交 Turn，也规定了只读复核独立适用的条件。 基线 RFC

对主干的风险 / Risks

最重要的风险是把后来真正的新输入误当成续办，或者在接回队列后运行已经过时的任务。计划器保留原编号、会话和正文的精确校验，派发前仍重新核对队列和原生记录。五个目标用例、61 个绑定用例、237 个会话与历史用例及本地合并前检查通过。较广的矩阵从 12 项通过增至 16 项，剩余 8 项失败与基线逐项一致，继续保留这些失败和验收缺口。

我的整体评价 / Verdict

批准这次重启接续修复。它重用已经落盘的唯一续办编号，对账可以继续沿原消息和原服务收尾。变更位于后台计划器和对账流程，检查了消息投递入口，界面和呈现格式无需视觉对照。 现场旧请求仍以原服务实际处理和飞书独立读回为验收，隔离测试只证明代码路径。

关键代码讲解

• 原对账组装已有请求、续办预留和队列事实。发现已有入队 Turn 后加载该记录，再落原指针。 对账调用方
• 续办选择先检查已有工作预留，然后复用精确身份与来源校验。持有待核验候选本身不会开启派发。 续办分支
• 只读复核沿用同一独立策略，保留自己的来源和效果约束。 只读分支

English verdict: APPROVE 9459e19. The original worker recovers the same committed project continuation across the enqueue-pointer crash while keeping source verification and dispatch fences. Eight identical baseline failures and live delivery verification remain visible.