feat(collaboration): reconcile request corrections with Goal effects

[songoow]

Goal And Delivered Outcome

A requester can revise or cancel an existing local request in its original conversation and recover an uncertain response with the same operation. Request revisions, reserved Goal effects and immutable terminal receipts remain distinct: an old receiver result cannot complete a newer request, and cancellation does not pretend to roll back committed Goal work.

This revision repairs a demonstrated recovery gap. Before dispatch, the browser now reads back the complete saved route, operation, basis and content. Silent storage loss, altered retained content or an unreadable write keeps the draft editable and sends no mutation. Normal successful-response loss still supports reload and replay of the identical request.

中文：本次修正“恢复信息没有真正保存却仍发送”的问题，并补齐主干新增配置 reader 的真实调用链。请求修订、原效果对账、结果送达、后续采用及验收保持各自边界，与 长时运行整合 PR #6374 的过程定义一致。

• Updated head: 4746c41141b165c34a6de40ce1fc75a838ce2f24; integrated main and exact merge base: 3300dfdd29fe6e53e1aa4a0282ca3952db6e9e8f.
• Intended base: main. Original PR history is retained; already-merged prerequisites are not claimed as new implementation.
• Goal/source: Shared Goal Alignment §5.1/§9.4 and Manager §§5.10/5.12; original conversation → corrected request → reserved effect → authentic terminal receipt → original-route readback.

Author Declaration

Written by: model_agent — GPT-6, OpenAI.

Implemented against

Existing RFCs at integrated main plus this request-control profile's preserved amendment contract. The current-head review's retention counterexample is the repair oracle.

Criterion	Disposition	Implementation / evidence
Preserve original request and source revision	implemented	Existing typed request owner, version-bound assessments/returns, stale-source refusal and CLI/MCP/HTTP readback
Recover uncertain effects without inventing a new operation	implemented	Verify browser retention before dispatch; durable reservation, real Goal receipt and independent terminal linkage; packaged loss/reload/retry negative cases
Use current owning configuration for new work	implemented	Main's injected replan_configuration_reader now reaches direct and request-derived commit/recovery through CLI, HTTP and MCP. Unavailable current configuration refuses a new preview; retained terminal history remains recoverable
Do not confuse delivery with acceptance	implemented within this profile	Existing source/Goal/request owners and bilingual RFC §9.4 retain the distinction; live-model/Lark and general M2/G1 remain deferred

Scope And Continuation

The original request/result store remains authoritative. TypeScript owns request/Goal transitions; Python adapts authenticated source and existing IO. Commit and conditional abort compete for one durable terminal receipt, then the request links that receipt. No new request database, scheduler, policy fallback or current-basis writer is introduced.

The only textual main conflict was the generated registry I/O census; it was regenerated from merged source, then regenerated after the callback changes: 307 sites, zero unclassified. Real-entry verification also exposed an automatic-merge API mismatch: main required a configuration reader that the PR wrapper omitted. That integration defect is repaired through the existing injection seam.

Complete for this scoped local correction/recovery slice, subject to current-head review and required checks. Arbitrary Host effects, restored writer activation, live-model/Lark delivery and full M2/G1 remain with their existing owners. This PR is not dependent on backup activation or on treating direction read receipts as model understanding. The architecture guard entries were grouped with their existing collaboration owners so sibling Direction additions merge cleanly; AST comparison and seven current guard tests preserve the same members and assertions. Related-boundary pass reused local steering retention and the existing configuration composition seam; it adds no generic persistence framework.

Validation

• Tested revision: 4746c41141b165c34a6de40ce1fc75a838ce2f24; run state: finished; input classes: public_fixture, synthetic.
• Sources and isolated runtimes were bound to the intended checkout; Node 22.22.3 and real disposable PostgreSQL 14.20 were used. Only test-owned services were stopped.

Check kind	Result	Evidence / limitation
real_entrypoint / real_backend	passed	Actual packaged frontend, Chat HTTP, canonical SQLite and independent receiver CLI: silent-drop/altered-body/read-failure storage cases issue zero mutations and retain the draft; normal lost successful response/reload reuses the whole original request; stale editing, interim return and cancellation/terminal readback remain covered
integration	passed	59 Python tests across request recovery, Chat control and Goal amendment. Two strengthened File/SQLite reader cases were separately rerun; these overlap the 59 and are not added to them
integration / real_backend	passed	69 typed request/Goal tests, zero skips, File/SQLite and isolated PostgreSQL
unit / static	passed	Four existing steering retention tests; seven source/session architecture checks; dashboard/root types, Ruff, semantic advisory followed by full drift, 307-site census and public/private scan
static / manual	passed	Exact-head bundle build/source verification. Browser-tested and final manifests differ only in source revision; delivered asset bytes match. Changed-path review, whitespace and DCO checks pass
regression evidence	passed	Old RequestControl failed the silent-drop browser oracle; repaired code passes. Initial real browser initialization failed on the missing configuration callback; actual caller integration now passes

The build retains its existing bundle-size warning; no ceiling changed. The enhanced browser faults alter only storage/response delivery, not backend admission or Goal results. No live model, installed-App replacement, Lark, remote Host, Windows or general end-to-end Goal completion is claimed. Hosted CI and renewed exact-head public review remain separate; older approvals/results are not transferred to this head.

Frontend / Visual Evidence

UI impact: changed failure behavior inside the existing request details; no opening navigation, hero or first-viewport composition change. The packaged journey covers editable failure, unknown delivery/retry, cancellation, Chinese/English and 390px. Evidence uses synthetic fixtures; private validation logs/screenshots are not attached. Existing controls and localized storage-error text are reused.

Boundary Checklist

• Scoped runtime/UI repair and original RFC clarification; no private state, raw logs, credentials or local machine paths in the diff/body.
• Current request and Goal owners reused; no benchmark jobs or policy promotion.
• Tests preserve failure and untested distinctions.
• Every PR-owned commit carries a DCO sign-off.
• No merge, deployment or user-installation change.

Combined Integration Readback

A disposable local composition of the four coordinated PR heads passed 18 actual HTTP/source-denial tests, control-plane typecheck and docs governance. The generated registry I/O census was rebuilt from that combined source: 310 sites, zero unclassified, with --check passing. Request, Direction and Recovery routes preserve unique keys and their owning handlers. Source/test insertion conflicts were removed; when #6357 and #6338 are combined, their branch-specific generated census must be regenerated from the combined source, not resolved by accepting one side or concatenating JSON.

This is local integration evidence, not a merged branch, installed product, live-model adoption or resolution of unrelated main-branch checks. Exact heads: #6374 c34e4f1576a69ab0fc98f9253933c1a3ea7929c2; #6357 4746c41141b165c34a6de40ce1fc75a838ce2f24; #6338 082ed83c22e23d1d771da879773b33c66f31d953; #6279 f4bfab4a391e8754cb961471237bc57f4c651eed.

[songoow]

Reviewer: model_agent; GPT-6; OpenAI; self_reported.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

原会话的请求发起者，以及按该请求协作的接收 Agent。 发起者修正或取消一项委托时，旧结果不能冒充新请求完成；已经预留、但回复丢失的 Goal 变更也不能靠换编号再执行。 候选实现让发起者在原会话修改、取消并核对结果；接收方按实际读取的版本判断和回传，未知变更通过原操作回执恢复后才能继续。 本批不开放任意 Host 效果、外部来源控制、通用重分配、恢复写者启用或真实模型团队运行。 完整 M2/G1、通用 source-profile 运行时、真实 Lark/模型采用与恢复后的授权重绑定仍需各自原验收。

本次检查完整主干至 1675f570d32f06cc3b564e1511e6bbe3126bfa60 的差异，不继承前置 PR 的批准结论。评审中发现并修复了新版本中途进展与旧 decision 记录冲突、旧结论压掉新进展的路径；另将版本操作指引限定到实际供给版本化请求的 CLI 页面。当前未发现该本地切片的阻断问题。

改动思路

请求和 Goal 分别保有自己的事务；复用既有 Inbox、Goal work planner、operation receipt 和返回链路，比另建请求库或用一次远端存活检查代替取消顺序更符合现有边界。 本 PR 交付受支持本地来源从修订/预留到提交或中止、独立回执关联和原会话回读的完整切片；主干至本 head 包含仍开放的前置 #6323，不能将它重复算作新成果。

请求先在原记录预留一个不可变操作；提交与条件中止在 Goal owner 竞争同一终局回执；随后独立读回并关联原回执。请求修正不删除旧预留，超时不释放 fence，提交胜出就保留 Goal 工作。TypeScript 负责决定，Python 解析真实来源和执行 IO；前端不增加独立配置或决策源。

最强反面是完整 diff 较大、有限容量与多次同步观察有维护/调用成本，且普通 source-profile runtime 仍未整体可用。这个限制已体现在资格边界：现有原对话可以完成修正/取消/恢复，不能由此宣传通用团队运行。只改 brief、增加超时或另加一个状态页都无法解决两个 owner 间的提交顺序。

具体改动

完整 diff 为 73 个文件、+5516/-213。其中包含仍 OPEN 的 #6323（8ddedecb288788961a479a28395698d68dfea8ca）的 root/policy、固定模板、实际 claim/replan 和设置页前置；#6343 已在主干。请求控制自身的新工作在既有依赖组合之后。源路由 helper 复用 #6338 的同一路径，无第二套路由或全 Direction 依赖。

依据变更前 b0b2acffb8fea7d85b20dd4f0139c1ce0616e5a7 的 docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md；同时对照 docs/architecture/rfcs/capable-manager-semantic-handoff-v0.md，新增 §9.4 只记录本地资格与限制，没有改写原验收。

• §5.1(1)、§5.1(2)： request_control.ts:265 planRequestControl 在既有 Inbox 内管理修订、读取/判断和唯一预留；request_amendment.py:168 control_request 在修正/取消后尝试条件中止。保留原始 brief/source、为合法取消及关联预留容量，未提高128000字节限制。
• §5.1(3)、§5.1(4)： goal_amendment_authority.ts:351 executeGoalAmendment 复用 work planner 与原 CAS/receipt；execute_request_amendment 独立读取原 Goal 终局再关联。绑定包含真实 store/source 身份；新编号、缺 source、迟到原 worker 都不能获得新效果。
• manager §5.10、manager §5.12： result_publication.ts:112 planCollaborationResult 与原返回链路保留各版本结果；省略版本仍指原始1。中途进展按修订保存，仅同修订结论能收起未发进展。Inbox、peer、Chat、Lark tracking 共用回读；新请求仍可在另一请求效果未知时独立推进。
• §9.2(1)、§9.2(2)、§9.2(3)： 前置的原承诺、冻结policy、实际新增工作/回执、精确实例/基线与现有租约保护已按当前调用关系复核；无 permission/objective/acceptance 扩张。
• §9.2(4)、§9.2(5)、§9.2(6)： 原操作恢复、独立peer adoption/claim和原义务消费继续复用前置owner；当前新增 RequestControl 在原交办详情提供完整编辑、取消和恢复。保存是一次操作手势，已知 Goal/接收方不用重填；未知响应跨刷新重试同一请求，读失败清除旧控件，过期编辑加载当前版本。未改首页/hero/主导航。
• M2/G1 promotion： 通用执行、真实团队两轮、独立实际验收和外部发送仍由原里程碑承担，未由此关闭。

边界内的未来整理已应用：工作图共享planner，原来源事实组装移到Core并删除旧函数，旧未发布Python适配器名被移除，类型化wire由前端复用。迁移成本也明确：原受控请求是新增语义，并非把旧writer换名；原始记录/返回和独立Goal路径继续存活。实际File/SQLite调用计数为首次request commit20次bridge、原操作replay15次、条件abort恢复14次，包含既有生命周期/replan观察，不是模型调用；未声称速度或token改善，也未为每字段新建RPC。

对主干的风险

• 中途返回修复后的原生路径225项通过、3项Win32专用跳过；新增同Goal未来请求不被旧fence捕获2项通过；typed request/result18项通过。最终仅CLI指引与测试变化，补跑开/关路径2项及当前主干完整输出对比通过。此前集成版本的313项通过和typing修正50项仍可复用到未变化边界，未把这些不同集合相加当覆盖率。
• 共享owner在41b22a51a的隔离真实PostgreSQL14.20上372项通过、0跳过，至最终head仅CLI指引及测试变化，相关owner字节未变；包含commit/abort/correction与原authority conformance，服务已停止。这不新增PG终端用户profile。
• 来源源码和独立安装正常wheel的真实浏览器均通过：生产注册、SQLite、原Chat入口、实际HTTP、独立receiver CLI、中途返回、丢成功响应后reload/同操作重试、过期编辑、读失败恢复、取消终局、中文/英文/390px。41个产品文件HEAD/source/wheel/install逐字节相同，退休适配器不存在。已检查整屏层级和状态；sidebar的generic Goal状态不可用没有被mock隐藏。
• 主干/候选使用同一份原请求保存状态，经CLI正向/冲突/重放与原会话回读，全输出和指引保持一致；新注册root commitments为单独校验的provenance增量，旧回执不回填。源码guard移除的隔离反例和中途返回旧实现都曾实际失败，修复后通过。未用实现输出充当预期不变量。
• 风险预合并检查19项及5项direct检查通过；TypeScript、Ruff、focused mypy、语义advisory/full drift、IO census和公共边界检查完成，无budget上调。较早一轮检查与manifest生成重叠触发tracked-side-effect；稳定树重跑保留guard后通过。浏览器曾因旧bundle拒绝、之后因可见文本与live-region双匹配失败；重建和精确定位后通过，没有删除行为断言。

远端CI在本次读取时仍排队；本地证据不替代hosted CI或merge readiness。合成replan历史、故障注入与真实本地后端不等同于真实模型或Lark发送，Windows专用路径本轮未资格。回退在新数据产生前可revert；新记录产生后应停止新准入并保留兼容reader/receipt/fence，不可删掉一侧记录制造可执行状态。

我的整体评价

APPROVE，限上述精确head的本地来源切片；交付判断是 justified_increment。已验证的价值是请求改动后仍能正确续行、历史结果不污染当前判断、取消与不确定效果不重复执行，并在原会话看到实际结果。维持长程原目标、未完成要求和权限边界；不以一次receipt、测试数量或此PR代表整个Goal完成。

请求和 Goal 分别保有自己的事务；复用既有 Inbox、Goal work planner、operation receipt 和返回链路，比另建请求库或用一次远端存活检查代替取消顺序更符合现有边界。 本 PR 交付受支持本地来源从修订/预留到提交或中止、独立回执关联和原会话回读的完整切片；主干至本 head 包含仍开放的前置 #6323，不能将它重复算作新成果。

前置#6323、hosted CI、维护者合并和更广profile推广分别保留。未执行merge、部署或运行用户的活跃Goal。

English verdict: APPROVE - 1675f57: the bounded local request revision/cancellation journey preserves one reserved Goal operation, authentic terminal linkage and revision-specific original-route results. Native positive/negative recovery, main/head full-output parity, isolated real PostgreSQL (372 passed), source/independent-wheel browser and risk-based validation passed. Prerequisite #6323 remains open; hosted CI, wider runtime/live-model qualification and merge authority are separate.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[songoow]

Conflict reconciliation at 6637b26e17af5cdb4900c0a163f68a84ef962ecc against main 91b675dfca178db68d3527140272ffb263a3b319.

Native request correction and Goal amendment HTTP regression: 37 passed. TypeScript owner/proposal: 57 passed, 4 PostgreSQL cases skipped. Semantic vocabulary and registry I/O: 133 passed.

Control-plane typecheck, semantic advisory, regenerated I/O census (zero unclassified sites), and diff whitespace checks passed. No unmerged paths remain. No limits, history retention, activation authority or product defaults were changed by the resolution. Related refactor pass: unnecessary for this merge-only reconciliation; existing typed owners are retained.

This records conflict repair, not approval or merge readiness. Hosted CI and exact-head review remain separate; PostgreSQL was not requalified in this batch. No merge performed.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh.

Reviewed exact head: 4746c41; whole PR baseline: 3300dfd.

动机

在原会话修正或取消已交办请求的用户，以及读取并回传该请求的接收 Agent。 过去用户改变委托后，旧结论和已预留的 Goal 变更难以按新要求核对。现在在原会话修正或取消，接收方按实际版本判断与回传；未知结果保留原操作，待终局回读后再继续。 真实 File/SQLite 与 PostgreSQL 终局检查通过；打包页面保存丢失、内容变更或读回失败时均零派发并保留草稿，正常丢响应重载后逐字相同重试，取消读回 aborted 且不改变 Goal 工作。 这里不开放任意 Host 效果、不扩张原权限，不把请求读取或已记录变更称为真实模型理解、任务执行、Lark 发送或完整 M2/G1 验收。 真实 Host、模型团队、Lark 发送、Windows 与完整 M2/G1 仍由原 manager/shared-Goal 阶段资格化。

改动思路

请求与 Goal 分别保有自己的事务和 TypeScript owner，复用原 Inbox、work planner、terminal receipt 与返回链路；恢复信息保存后读回完整原请求，失败则零派发。 受支持本地来源的修订、原预留操作、终局关联与原会话回读一起交付；通用 source-profile runtime、真实模型/Lark 和 M2/G1 仍由原阶段负责。

只编辑 brief 或增加超时不能决定两个独立事务的提交次序；预留身份、单一 terminal 和原回传必须组合，浏览器持久读回是这条旅程的可靠入口。

以下表格对应当前 exact head 4746c41141b165c34a6de40ce1fc75a838ce2f24 的 remember 与 terminal owner，用于解释触发、分支与结果；它是源码流程示意，不替代执行证据，表格渲染未单独验收。

触发	原路径/旧缺陷	当前结果
保存恢复信息未实际留存	setItem 返回后继续发送	读回完整请求不匹配 → 零派发，保留草稿
真实写入成功但响应丢失	原重试身份依赖存储	重载 → 同一原 payload 重试 → 不再增加 revision
source 取消预留效果	不能仅凭超时声称已取消	原 commit/abort 争一个终局 → 独立 receipt 关联 → 明确保留已提交工作或 aborted

具体改动

完整当前范围为 42 个文件，+3312/-186；包括原 request/Goal owner、来源适配器、CLI/MCP、原会话和跟踪 projection、双语规格及聚焦测试。旧 self-review 的 73-file 范围和旧 head verdict 均没有作为当前批准依据；本次另核对旧阻塞到当前 head 的保存读回修复，以及 main 集成后的实际 replan configuration reader。

关键代码讲解

• request_control.ts:265 planRequestControl：在原请求记录保存 source revision、独立 read/assessment、最多一个未终结 reservation 和稳定 operation receipt。只有原 source 可以修正/取消；receiver 必须采用实际 revision/digest，预留容量给合法取消和终局关联，重试不消耗新容量。
• goal_amendment_authority.ts settleReservedAmendment：复用 planWorkCommit、canonical CAS 和原 CoordinationCommandReceipt。commit 与条件 abort 使用一个不可变 reservation identity；后到的旧 commit 不能绕过已记录的 abort。当前来源与历史 Goal outcome 分开，不用超时或 missing receipt 释放效果。
• request_amendment.py:99 execute_request_amendment：从实际 source snapshot 预留后调用原 Goal owner，再独立读真实 terminal 并关联；最新的 configuration reader 显式传到 proposal/basis/commit/recovery，配置读取失败不授权新变更，已有原 receipt 仍可恢复。
• request-control.tsx:43 remember：保存完整序列化原请求后必须 getItem(...) === serialized，否则保持可编辑草稿并拒绝 execute。submit 的未知响应保留原 payload，重载后重试该 operation；typed stale basis 读当前版本，不覆盖另一 source 修订。

规格依据为 docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md，不可变基线 3300dfd；并核对同基线 manager §§5.10/5.12。逐项映射：§5.1 implemented；Manager §5.10/§5.12 implemented；Original-operation recovery implemented；M2/G1 deferred。当前 §9.4 将本地 profile、限制和原 operation 恢复讲清楚，没有把 request 状态扩成通用 Agent/Goal lifecycle。

对主干的风险

没有当前 head 的阻塞 finding。原 P2 保存问题已独立验证修复。 实际 packaged Ego 页面使用真实 production SQLite/HTTP 后端，分别注入静默丢弃、替换已存内容和读回异常：三种情况均 execute=true 请求为 0，原草稿仍可编辑。正常存储后令真实成功响应丢失，刷新原会话再重试，两个完整 JSON payload 逐字相同，原 operation/basis/content 不变，request revision 保持 4，pending 才被清除。第一轮 reload 的探针丢失 fetch interception，未作为通过证据；修正逐文档探针后才得到上述明确请求对比，产品源码未修改。

完整正负路径还覆盖：过期 editor 遇另一 owner 的修订后拒绝覆盖并读新内容；独立 receiver CLI 读取/采用版本 4，并回传该版本 interim；未知 reservation 随 source 取消后，独立读回一个 aborted terminal、active reservation=null、goal_changed=false。中文、英文及 390px 窄屏无横向溢出；read/已记录变更不被表述成执行或验收。

43 项原生 Python 全通过；428 项 TS 全通过、零 skip，包含隔离真实 PostgreSQL 16.2 的 shared authority integration；126 项全树语义检查、typecheck 和 packaged build 通过。当前未限定平台的冷控制不等于已 installed App、真实 Host/model/Lark 资格；synthetic progress 只提供 replan 输入。一个 peer interim 返回假设经真实公开 CLI 的 conclusion-only guard 排除，没有伪造成缺陷。

默认路径、语义与本地检查归因

六份原有测试源码在 base、此 head 与另一复审 head 逐字相同，各跑 158 passed / 3 skipped：skip 均为本机 POSIX 不适用的三个 Win32 extended/binary/workspace path 场景，Windows 资格保持未验证。旧 backup plan/create、配置快照、原 peer/inbox/result/Chat tracking 及直接 governed Goal 路径都走实际 production owner；按实际 PR 基线 3300dfd 运行同一 CLI differential，96 baseline / 96 candidate，candidate_only=0、review_required=0。无新 required legacy field、自动调度、quota 或活跃 writer。

risk-based canary premerge --from-git-diff --git-diff-base 3300dfdd29fe6e53e1aa4a0282ca3952db6e9e8f 保留红灯：5 个 direct check 通过，19 个 selected check 中 18 个通过，只有 python examples/control_plane/cli-output-budget-regression-smoke.py 失败。用同一默认命令在不可变 pre-change source 和两个 exact head 重跑，并保留完整 differential 结果，49 个 row id、增长值和 allowance 完全一致；失败规范化摘要 1e363375b912c7440b8c5b442f503c145b2f72a1c9c2fe7db94690606ff489dd。该检查默认比较 origin/main，独立按实际 PR base 的 96 项比较通过；没有修改限制、断言或只挑绿色重跑。它归为 pre_existing_unrelated，而不是此 PR 的行为回归，仍不称整个 merge gate 绿色。

advisory 先于 full-tree semantic 检查执行，判定涉及 registered readability / local request wire，而不以相似字符串合并不同领域状态。输入、source、receipt、unknown、停止和恢复义务仍由 typed owner 约束；UI own-next-action 是建议，权限和终局 guard 是机器义务。未查询、轮询或等待 GitHub CI。

我的整体评价

结论为 APPROVE，没有当前阻塞 finding。交付判断是 justified_increment：long_horizon improved（原 request 和 Goal terminal 不混淆，未知结果仍可恢复）；user_experience improved（原会话修正/取消、可靠保留与读回，不要求用户重新拼接 identity）。这不完成真实团队 M2/G1 或把新的 work record 当 Goal 验收。

42-file 范围在原请求、Goal 和原回传三条必须一起成立的边界内相称。邻近未来演进检查已采用原 planWorkCommit、来源事实/route 共用 owner 和完整浏览器存储读回；不要求新数据库、workflow engine 或第二个 Python 决策源。旧请求与 revision1 receipt 是实际 persisted compatibility；保留一种 typed owner 的显式变体合理，不能为了减少版本擦除历史。三个 wire closed sets 是 collaboration local contract，owner/frontend 共用，formal 26-vocabulary scope 未扩张。

English verdict: APPROVE. The prior retention defect is fixed: silent drop, changed stored content and unreadable storage all prevent dispatch while preserving the draft; ordinary response loss survives reload and replays the identical original request. Independent native File/SQLite, real PostgreSQL and packaged original-conversation recovery passed. The unchanged baseline CLI-budget failure is separately attributed and remains a merge-validation hold; this approval grants no merge or runtime activation authority.

[songoow]

Conflict repair and review-fix readback at 2ee697f7742c5d626ed24ef391c3d1c52062c05d (merged main 6ebba628083792f3c428453566a9d8c2d9e3b036).

Conflict resolved. The only conflict was loopx/semantics/project_registry_io_manifest_v1.json: main (#6375) retired the committed manifest and computes the registry I/O census on demand. The resolution takes main's deletion; the computed census for this head validates with zero errors (every site this PR adds is a codec_api read or transaction, so no new direct-I/O classification is needed). No other paths conflicted.

Review P2 (verify recovery storage before dispatch) — fixed and re-verified on this head. 75002e186 reads the pending identity back after setItem and refuses to dispatch (keeping the editable draft) when the readback does not match. The packaged request-control browser smoke now injects silent-drop, changed-content and unreadable retention faults: each refuses execution with zero dispatched mutations, revision stays 1, the draft text stays editable and no retry entry appears; normal storage then still replays only the original request after a lost reply and reload. This run passed on the merged head.

Validation on this exact head (local, Node 22.22.3, File/SQLite; PostgreSQL cases skipped and not requalified):

• control-plane typecheck: pass
• TypeScript owner tests (request_control, goal_amendment_authority): 23 tests, 19 passed, 0 failed, 4 PostgreSQL cases skipped
• Python native request-correction / Goal-amendment HTTP, source-registry denial, registry I/O census and inventory suites: 61 passed, 0 skipped
• semantic vocabulary drift test: 126 passed; semantic advisory over the diff vs main reports only the three collaboration-owned request closed sets already disclosed in this PR, nothing new from the merge
• request-control browser smoke (real source registration, Chat entrance, retention negatives, correction, lost reply/reload/exact retry, stale edit, receiver CLI, cancellation readback): PASS
• git diff --check: clean

Harness note: the first local attempt reported setup errors in every SQLite-parameterized case because a previously spawned managed Effect runtime was running on Node 25.2.1, whose embedded SQLite main now refuses as unqualified; rerunning on Node 22.22.3 passed. This is an environment condition, not a change in this PR.

No limits, retention, activation authority or product defaults changed in the resolution. Hosted CI and exact-head review remain separate; this is a conflict-and-fix record, not approval or merge readiness. No merge performed.

[songoow]

Review-fix and main reconciliation at d88a36cd6 (merged main 373f2fa12).

Failing dashboard-browser shards fixed. Main's new CSS custom-property check rejected three bare var() references in collaboration-card.css: --color-border on lines 11 and 17, and --color-text-secondary on line 19. No stylesheet defines either token, so those declarations were silently dropped: the request-control divider and the input separator had no border, and the help text was not muted. They now use --pw-line and --pw-muted, the tokens the surrounding personal-workspace rules already use. The check fails on exactly those three lines before the change and passes after it.

Merge. No textual conflicts. Main now contains #6338, which shares Goal source routing, the configuration API and the effect handler table with this branch, so the overlapping suites were rerun on the merged tree.

Validation on this exact head (local, Node 22.23.3, File/SQLite):

Check	Result
control-plane typecheck	pass
TS request_control, goal_amendment_authority, direction_authority, effect_runtime_handlers, effect_runtime_handler_loading	38 passed, 0 failed, 5 skipped (PostgreSQL cases; no server)
Python request-control, request-amendment recovery, source-registry denial, registry I/O census, Goal direction runtime and chat	88 passed, 0 skipped
CSS custom-property check, dashboard build and chat bundle	pass
packaged request-control-browser-smoke (real source registry, SQLite, Chat entrance, Agent CLI)	PASS, including silent-drop / changed-content / unreadable retention refusing execution, unknown reply + reload + exact retry, stale edit and cancellation readback

Known main-wide failure, not from this PR. content_digest_single_owner ("the owner's consumers are the pinned set") fails on main itself because #6338 did not pin direction_authority.ts. #6431 carries that one-line pin. typescript-core will stay red on every PR until it lands; this branch already pins its own request_control consumer.

Not run: PostgreSQL, Windows, live model or Lark. This records the repair; exact-head review is still required and no merge was performed.

[songoow]

CI note: the red typescript-core (2/3) shard on this head is the content-digest single-owner guard failing on current main itself (direction_authority.ts from #6338 is not in the pinned consumer list). The one-line repair is #6435; this PR adds no digest consumer of its own. 中文：该分片失败来自主干，修复见 #6435，本 PR 未新增 digest 消费者。

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[songoow]

Merged current main (f713e0f) at 9c61426 to clear the conflict.

• Only conflict: tsconfig.control-plane.json. build(types): discover production sources instead of maintaining per-file lists #6411 replaced the per-file production list with loopx/control_plane/**/*.ts; resolution keeps main's globs and re-adds this branch's tests/control_plane_ts/request_control.test.ts entry. All other files auto-merged.
• Validation on 9c61426: control-plane tsc --noEmit and dashboard tsc --noEmit pass; the PR's three Python modules 43 passed; request_control + goal_amendment_authority + content_digest_single_owner TS 35 pass / 1 fail / 4 skip; examples/semantic-vocabulary-drift-smoke.py ok.
• The one TS failure is the pre-existing direction_authority.ts pin missing on main itself. Correction to my earlier note: the repair is test(digest): pin the direction authority consumer to restore main #6431; test(digest): pin direction_authority as a canonical digest consumer #6435 was closed as its duplicate.

中文：已合入最新 main（f713e0f07），唯一冲突是 #6411 把 tsconfig 改为目录 glob，保留 main 写法并补回本分支的 request_control.test.ts。上述检查通过；唯一 TS 失败来自主干缺少 direction_authority 登记，修复入口更正为 #6431（#6435 已作为重复关闭）。

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh.

Reviewed exact head: 9c61426. Whole-PR merge base: f713e0f.

动机

在原会话修正或取消已交办请求的用户，以及读取并回传该请求的接收 Agent。过去用户改变委托后，旧结论和已预留的 Goal 变更难以按新要求核对。现在在原会话修正或取消，接收方按实际版本判断与回传；未知结果保留原操作，待终局回读后再继续。

当前43项原生 Python 和428项真实 File/SQLite/PostgreSQL 检查通过；打包页面三种存储故障均零派发并保留草稿，成功回复丢失后重载逐字重放原请求，取消读回唯一 aborted 且未改 Goal 工作。这里不开放任意 Host 效果、不扩张原权限，不把请求读取或已记录变更称为真实模型理解、任务执行、Lark 发送或完整 M2/G1 验收。真实 Host、模型团队、Lark 发送、Windows 与完整 M2/G1 仍由原 manager/shared-Goal 阶段资格化。

本次重新判断整个当前提案；之前4746的批准已失效，没有沿用其 verdict。当前 PR 正文中的 tested/updated head 仍停在4746，最新作者评论已说明9c6142600的合入；以下证据均区分当前结果与历史记录。

改动思路

请求与 Goal 分别保有自己的事务和 TypeScript owner，复用原 Inbox、work planner、terminal receipt 与返回链路；恢复信息保存后读回完整原请求，失败则零派发。受支持本地来源的修订、原预留操作、终局关联与原会话回读一起交付；通用 source-profile runtime、真实模型/Lark 和 M2/G1 仍由原阶段负责。

最强反面是新增有界历史、多次 bridge/IO 和维护成本；它们没有证明模型质量或时间、token 净收益。仅修改 brief 无法决定已预留效果究竟提交还是中止；另建数据库或跨 owner 事务反而扩大问题。当前方案在原请求预留身份，在既有 Goal 写者内让 commit/abort 竞争同一终局，随后独立读回并关联原回执。Python 负责可信来源和 IO，前端只执行原路由操作并显示结果，没有另一套政策、调度或权限判定。

存储失败是发送前的硬拒绝，读回失败撤下可写控件，未知回复保留原请求重试。状态说明明确“已记录”不代表执行或验收，原接收方的 assessment 也没有被当作真实模型理解。

具体改动

当前净差异 40个路径、+3259/-164，23个分支提交均有 DCO。覆盖请求与 Goal owner、CLI/MCP、Inbox/peer/原会话及 Lark tracking 投影、前端控制、双语规格与聚焦测试。旧到新范围的43路径并集里，31个路径的 base/head 两侧 blob 均相同；其余12项重新核对，包含已进入主干而退出净差异的来源路由、API与旧 census。整个当前范围仍按真实入口重新验收，没有把旧428结果改标成新运行。

关键代码讲解

• planRequestControl:265：保留原声明，只有可信 source 能修正或取消；receiver 读取、判断和预留都绑定实际 revision/digest。每请求最多一个未终结 reservation，容量仍为原128000字节，并为取消及终局关联留空间。
• settleReservedAmendment:312：复用 canonical writer、CAS和原 command receipt。commit/abort 共享不可变 operation；已提交的工作不因取消回滚，已中止的旧 worker 不能迟到提交。
• execute_request_amendment:99：实际来源认证→持久预留→原 Goal owner→独立终局读回→原请求关联。当前配置 reader 继续通过已有注入边界传递，恢复不接受调用者自填的“成功”事实。
• RequestControl.remember:43：完整序列化请求保存后必须逐字读回，随后才发送。submit 将未知成功保留为原操作，stale basis 则重新加载当前内容。

独立规格为 docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md，revision f713e0f，固定原文，并核对同基线 manager。逐项：§5.1 implemented（预留、控制排序、唯一终局、独立关联）；Manager §5.10/§5.12 implemented（版本化读/判断/返回及 typed owner）；Original-operation recovery implemented（真正保留后才发送，原 payload 重试）；M2/G1 deferred（一般运行时和真实团队验收未完成）。本 head 的§9.4只是本地 profile 和限制说明，不替代父阶段验收。

main 集成后的实际新差异也核对：三处 CSS 从未定义 token 改为既有 --pw-line/--pw-muted，实际计算样式为1px灰色分隔线和灰色帮助文字；digest guard登记本 PR真实 request_control consumer；tsconfig保留主干目录glob并纳入本测试；原registry census按主干改为即时计算。最新main在相关路径仅新增独立 sidebar-order API mixin，没有合入本请求控制功能。

对主干的风险

当前没有请求控制的阻断 finding。旧静默存储 P2 已修复，且本轮在实际打包页面、生产 HTTP/SQLite owner 再次挑战：silent drop、改写保存内容、读取异常均为 execute=0，草稿仍可编辑。正常存储下实际服务器成功但回复被丢弃，刷新后完整逻辑 JSON 请求逐字相同，revision保持2。另一授权视图创建revision3，旧编辑拒绝覆盖并读回新内容；独立 receiver CLI 读取/采纳3并回传 interim3。未知预留随后从原页面取消，真实 GET读回一个 aborted、goal_changed=false、无新 Todo 的终局。请求 GET失败时取消控件撤下，恢复读取后才可继续。

本轮43项Python通过；428项typed通过、零跳过，包含隔离真实 PostgreSQL16.2 与 File/SQLite。原六份未控制请求/备份/配置/peer/tracking/直接Goal测试源码在实际base/head逐字相同，两侧各 166 passed /3 skipped，三项均为本机POSIX不适用的Win32路径场景。根目录和Dashboard类型、正常打包/source verify、Ruff、advisory后全树语义、40路径公开边界检查通过。风险canary 5 direct +19 selected（10 catalog +8 risk +1 boundary）全部通过，无manual hold。

另行保留 required digest guard 的失败：同一命令 node --no-warnings --experimental-sqlite --experimental-strip-types --test tests/control_plane_ts/content_digest_single_owner.test.ts，不可变base与当前head都 16 passed /1 failed，完整断言差异都只缺 control_plane/goals/direction_authority.ts。该消费者和 digest owner 两侧字节相同；本 PR新增的 request_control import与pin相匹配。归因 pre_existing_unrelated，既有修复入口为#6431；没有删除断言、放宽限制或将失败转optional。canary通过不抹去这个单独的合并验证问题，也不承袭旧head的CLI预算红灯：当前预算检查已通过。

语义与 CI 对齐

三个closed set留在 collaboration request wire，前端与TS owner共用，正式26项语义注册范围未扩大；不把同名字符串当同一领域状态。revision1兼容与原回执是实际持久化合同；source、actor、unknown及终局规则是机器义务，提示和已提供上下文不授执行权。未获取、轮询、等待或触发远程CI。

浏览器重载后一次私有采集变量丢失发生在取消已成功之后；没有重复取消，而是按原路由独立GET核对终局。通用source-profile侧栏和Lark discovery现有失败仍可见，没有掩盖成完整产品通过。中文1280px和英文390px截图已目视检查，窄屏scrollWidth=390；控制留在原对话，不要求重填Goal/接收方。此为真实冷控制和合成数据，尚非安装App、真实模型/Host/Lark或Windows资格。

我的整体评价

APPROVE 当前 exact head 的有界代码提案，交付判断 justified_increment。long_horizon improved：新旧请求依据、未知效果和原终局不会混淆；user_experience improved：原会话可以修正、恢复和取消，失败时保留草稿并读回真实结果。没有以测试数替代任务执行、真实采用、完整M2/G1或长期净效成本验收。

未来便利性检查已应用在同一原因边界：复用原planner/receipt/source helper，完整恢复信息读回，没有加入第二套存储或通用生命周期框架。40路径的组合服务于同一原会话旅程；保留真实历史兼容是必要成本。主干digest登记缺口、当前分支冲突、exact-head merge readiness及真实平台/部署验收仍分别处理。这份批准不授予合并、升级或恢复写者激活权限。

English verdict: APPROVE — 9c61426. The scoped original-conversation correction/cancellation and exact-operation recovery pass current real File/SQLite/PostgreSQL and packaged UI checks, including three retention failures, response-loss replay, stale editing and authentic abort readback. The independently reproduced unchanged direction-authority pin failure, merge conflicts and wider live/runtime qualification remain separate holds; no CI was queried or merge performed.

[songoow]

Merged current main (3593cf1) at 40c8bc4 to clear the new conflict.

• Only conflict: loopx/presentation/configuration_api.py. Main's workspace-preferences work and this branch's request-control work each added a mixin base plus one GET and one POST route at the same three spots; resolution keeps both (request-control first, then preferences). Imports for both modules were already present.
• On 40c8bc4: control-plane tsc --noEmit passes; test_chat_request_control, test_request_amendment_recovery and test_source_session_registry_denial 43 passed.
• The previous approval was on 9c61426; this head differs only by the merge commit above.

中文：再次合入最新 main，唯一冲突是 configuration_api.py 同一位置双方各加了一个 mixin 与两条路由，保留双方；类型检查与 43 项相关测试通过。

[loopx-agent]

Review exact head: 6357@40c8bc47be5666ea6613762b74cf45b3ebfb5353
Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; declaration_source=runtime_reported; reasoning_effort=xhigh

Reviewed exact head: 40c8bc4. Whole-PR merge base: 3593cf1.

动机

在原会话修正或取消已交办请求的用户，以及读取并回传该请求的接收 Agent。过去用户改变委托后，旧结论和已预留的 Goal 变更难以按新要求核对。现在在原会话修正或取消，接收方按实际版本判断与回传；未知结果保留原操作，待终局回读后再继续。

当前43项原生 Python 和428项真实 File/SQLite/PostgreSQL 检查通过；打包页面三种存储故障均零派发并保留草稿，成功回复丢失后重载逐字重放原请求，取消读回唯一 aborted 且未改 Goal 工作。这里不开放任意 Host 效果、不扩张原权限，不把请求读取或已记录变更称为真实模型理解、任务执行、Lark 发送或完整 M2/G1 验收。真实 Host、模型团队、Lark 发送、Windows 与完整 M2/G1 仍由原 manager/shared-Goal 阶段资格化。

本次重新判断整个当前提案，没有继承旧 9c61426 的 verdict。作者最新评论说明合入3593后的40c8bc47b；PR正文 tested/updated head 仍停在4746，下面明确区分当前验证与这些历史记录。

改动思路

请求与 Goal 分别保有自己的事务和 TypeScript owner，复用原 Inbox、work planner、terminal receipt 与返回链路；恢复信息保存后读回完整原请求，失败则零派发。受支持本地来源的修订、原预留操作、终局关联与原会话回读一起交付；通用 source-profile runtime、真实模型/Lark 和 M2/G1 仍由原阶段负责。

最强反面是新增有界历史、多次 bridge/IO 和维护成本；它们没有证明模型质量或时间、token 净收益。仅修改 brief 无法决定已预留效果究竟提交还是中止；另建数据库或跨 owner 事务反而扩大问题。当前方案在原请求预留身份，在既有 Goal 写者内让 commit/abort 竞争同一终局，随后独立读回并关联原回执。Python 负责可信来源和 IO，前端只执行原路由操作并显示结果，没有另一套政策、调度或权限判定。

存储失败是发送前的硬拒绝，读回失败撤下可写控件，未知回复保留原请求重试。状态说明明确“已记录”不代表执行或验收，原接收方的 assessment 也没有被当作真实模型理解。

具体改动

当前净差异 40个路径、+3259/-164，24个分支提交均有 DCO。覆盖请求与 Goal owner、CLI/MCP、Inbox/peer/原会话及 Lark tracking 投影、前端控制、双语规格和聚焦测试。与前次9c相比，40个路径中39个head blob相同，40个净差异的base侧也仅配置入口改变；新merge保留主干侧栏偏好和请求控制两组mixin/GET/POST路由。复用仍有效的全diff源码证据，重新挑战集成入口、两侧默认路径及当前真实后端，不继承旧测试运行或旧批准。

关键代码讲解

• planRequestControl:265：保留原声明，只有可信 source 能修正或取消；receiver 读取、判断和预留都绑定实际 revision/digest。每请求最多一个未终结 reservation，容量仍为原128000字节，并为取消及终局关联留空间。
• settleReservedAmendment:312：复用 canonical writer、CAS和原 command receipt。commit/abort 共享不可变 operation；已提交的工作不因取消回滚，已中止的旧 worker 不能迟到提交。
• execute_request_amendment:99：实际来源认证→持久预留→原 Goal owner→独立终局读回→原请求关联。当前配置 reader 继续通过已有注入边界传递，恢复不接受调用者自填的“成功”事实。
• RequestControl.remember:43：完整序列化请求保存后必须逐字读回，随后才发送。submit 将未知成功保留为原操作，stale basis 则重新加载当前内容。

独立规格为 docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md，revision 3593cf1，固定原文，并核对同基线 manager。逐项：§5.1 implemented（预留、控制排序、唯一终局、独立关联）；Manager §5.10/§5.12 implemented（版本化读/判断/返回及 typed owner）；Original-operation recovery implemented（真正保留后才发送，原 payload 重试）；M2/G1 deferred（一般运行时和真实团队验收未完成）。本 head 的§9.4只是本地 profile 和限制说明，不替代父阶段验收。

本次唯一改动的配置组合入口另行实测：在同一个真实 Chat 服务，侧栏顺序 GET 为null、合法POST保存、GET读回相同顺序、重复Goal拒绝400；请求控制同时完成下述原会话旅程。相应路径键不同，原有设置和新操作都未被覆盖。此前已核对的CSS token、request_control摘要pin、tsconfig和来源规则仍在当前whole-PR范围，相关源码未变；当前类型、语义及消费者检查重新执行。

对主干的风险

当前没有请求控制的阻断 finding。旧静默存储 P2 已修复，且本轮在实际打包页面、生产 HTTP/SQLite owner 再次挑战：silent drop、改写保存内容、读取异常均为 execute=0，草稿仍可编辑。正常存储下实际服务器成功但回复被丢弃，刷新后完整逻辑 JSON 请求逐字相同，revision保持2。另一授权视图创建revision3，旧编辑拒绝覆盖并读回新内容；独立 receiver CLI 读取/采纳3并回传 interim3。未知预留随后从原页面取消，真实 GET读回一个 aborted、goal_changed=false、无新 Todo 的终局。请求 GET失败时取消控件撤下，恢复读取后才可继续。

本轮43项Python通过；428项typed通过、零跳过，包含隔离真实 PostgreSQL16.2 与 File/SQLite。原六份未控制请求/备份/配置/peer/tracking/直接Goal测试源码在实际base/head逐字相同，两侧各 166 passed /3 skipped，三项均为本机POSIX不适用的Win32路径场景。根目录和Dashboard类型、正常打包/source verify、Ruff、advisory后全树语义、40路径公开边界检查通过。风险canary 5 direct +19 selected（10 catalog +8 risk +1 boundary）全部通过，无manual hold。

另行保留 required digest guard 的失败：同一命令 node --no-warnings --experimental-sqlite --experimental-strip-types --test tests/control_plane_ts/content_digest_single_owner.test.ts，当前head重跑 16 passed /1 failed。不可变base3593的既有原样回执（相同17项命令）复用，为同一16过1失败；完整差异仍只缺 control_plane/goals/direction_authority.ts。该消费者与摘要owner两侧blob相同，本PR新增request_control import与pin正确匹配。归因 pre_existing_unrelated；既有#6431独立修复仍保留，未删除断言、放宽限制或把失败改optional。canary绿灯不抹去这项单独失败；当前CLI预算通过也不改写旧头预算失败。

语义与 CI 对齐

三个closed set留在 collaboration request wire，前端与TS owner共用，保持原词汇验收的归属；不把同名字符串当同一领域状态。revision1兼容与原回执是实际持久化合同；source、actor、unknown及终局规则是机器义务，提示和已提供上下文不授执行权。未获取、轮询、等待或触发远程CI。

本次中文桌面与英文390px截图均目视检查，窄屏scrollWidth=390；重试和取消分别经键盘Enter触发，控制留在原对话，不重填Goal/接收方。普通source-profile侧栏状态和模型发现仍显示不可用，不包装为完整产品健康。fixture仅合成进展及浏览器存储/回复故障，实际HTTP、SQLite、Goal写者和接收方CLI未替换；不是安装App、真实模型/Host/Lark、Windows或完整M2/G1资格。

我的整体评价

APPROVE 当前 exact head 的有界代码提案，交付判断 justified_increment。long_horizon improved：新旧请求依据、未知效果和原终局不会混淆；user_experience improved：原会话可以修正、恢复和取消，失败时保留草稿并读回真实结果。没有以测试数替代任务执行、真实采用、完整M2/G1或长期净效成本验收。

未来便利性检查已应用在同一原因边界：复用原planner/receipt/source helper，完整恢复信息读回，没有加入第二套存储或通用生命周期框架。40路径的组合服务于同一原会话旅程；保留真实历史兼容是必要成本。主干digest登记缺口、exact-head merge readiness、旧评审状态和真实平台/部署验收仍分别处理。这份批准不授予合并、升级或恢复写者激活权限。

English verdict: APPROVE — 40c8bc4. The scoped original-conversation correction/cancellation and exact-operation recovery pass current real File/SQLite/PostgreSQL and packaged UI checks, including three retention failures, response-loss replay, stale editing and authentic abort readback. The independently reproduced unchanged direction-authority pin failure, existing review state and wider live/runtime qualification remain separate holds; no CI was queried or merge performed.