[loopx-agent]

A review-only outcome update can exhaust its UTF-8 storage budget even with one source. The previous rejection did not quantify that budget, and the native conversation hid the qualified validation reason behind a generic configuration error, making recovery ambiguous.

Merged head 2b45029257f093910a4f9ead7cb307f3a451f677 integrates #7056's independent declaration and review budgets. The existing TypeScript owner reports the failing budget's candidate, retained and limit bytes. Review overflow directs callers to preserve conclusions and provenance while compacting proposed notes/references; declaration overflow explicitly says shortening reviews cannot help. The per-outcome 64-source limit remains independent.

The native conversation forwards the existing safe owner-qualified diagnostic. Its immutable request envelope remains enforced: corrected intent requires a new operation ID after a confirmed rejection; an uncertain write recovers the original unchanged request. Generic provider/IO errors remain sanitized. Reference documentation and the self-repair lookup carry these distinctions.

This is a bounded reliability repair in the existing owner and consumer. It introduces no new schema, capability, automatic compaction, budget increase or source pruning. Storage-byte observations do not measure model tokens or establish long-horizon benefit. No visual layout or installed release is changed.

Validation of the integrated code:

• Capacity suite: 9 tests pass, including both exact 131072-byte limits, a four-byte overflow, cross-outcome aggregation, independent source capacity, File/SQLite/PostgreSQL atomic rejection, replay and stale revision handling. Real PostgreSQL was isolated and disposable.
• Complete real PostgreSQL authority-store integration: 369 tests pass, no skips.
• Python diagnostics/native retry: 27 pass; outcome capacity/refinement/prepared-action owner suites: 103 pass.
• TypeScript owner suites: 87 pass and 23 PostgreSQL-dependent cases skip in that invocation; the separate real PostgreSQL suite above supplies provider coverage. Skips are not counted as passes.
• A same-input real CLI comparison on File and SQLite preserves all 16 ordinary success, rejection, persistence and replay responses after normalization of opaque fixture identities only. Six diagnostic/native regressions fail on the immutable pre-change baseline and pass on the integrated head.
• Control-plane typecheck, focused Ruff, semantic advisory, bilingual and public/private boundary checks pass.

Premerge history and remaining fixture repair:

• At merged head 2b45029257f093910a4f9ead7cb307f3a451f677, 6 direct checks and 16 of 17 selected checks pass. examples/autonomous-replan-obligation-smoke.py fails with canonical_authority_required, reproduced with the same full normalized failure on baseline 795c30a2903638cf4f990adccb4cdceae355c70b. The required gate and its change-quality receipt remained failed; baseline attribution was not treated as a waiver.
• After this PR was merged by a parallel workflow, the two-line fixture initialization repair was submitted separately as test: restore canonical authority in autonomous replan smoke #7070. It preserves every original assertion and reuses the existing canonical fixture importer. With that repair, the full integration premerge passes all 6 direct and 17 selected checks; test: restore canonical authority in autonomous replan smoke #7070's standalone managed premerge also passes. These results do not retroactively change this PR's original failed receipt or imply that test: restore canonical authority in autonomous replan smoke #7070 was included in this merge.
• Earlier combined-budget experiments, conflict observations and older CI failures describe superseded source revisions. This integrated head uses fix: reserve bounded capacity for outcome evidence reviews #7056's independent budgets; current hosted CI was not polled for this update.

Scope review: one local byte-count helper shares candidate/retained measurement, while existing typed error transport, provider CAS/replay and conversation dispatch retain their ownership. The fixture follow-up is a separate proposal. Validation, independent review, merge authority and installed qualification remain distinct.

[loopx-agent]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

审查 7057@ad053b17f88930843f6fd4ae5f80956024854a87，不可变基线 9aedbbd3d2987498e0b17083fd02c195b4fe4bbe。结论：APPROVE，本次完整差异未发现阻断问题。此结论只覆盖当前精确提交，不授予合并或安装权限。

Reviewer: actor_kind=model_agent; model=gpt-6.1-sol; provider=OpenAI; declaration_source=runtime_reported; reasoning_effort=max

动机

通过已有 CLI 或原生会话维护成果要求的使用者，需要在容量拒绝后知道被哪个边界阻止，并保留原要求完成恢复。

同一份超限状态，旧 CLI 只有固定拒绝规则，原生会话还会退化成通用错误；当前提供候选、已保留和上限的 UTF-8 字节数，并在原生工具返回受限的 typed detail 与正确重试指引。

冻结的相同真实 File、SQLite 调用在基线有 6 项按预期失败，当前全部通过；拒绝不写入，修正后由原权威完成提交与精确重放。

本次只交付容量诊断与现有调用路径的恢复，不增加容量、不自动压缩或删除来源，也不宣称独立验收、根 Goal 完成、模型采用或长程成本收益。

先依据既有累计成果与恢复契约，再评估新增实现和说明。无改动会保留可复现的调用阻塞；自动清理旧来源会丢失多轮意图；另建存储或要求使用者反复手工搬移数据会扩大恢复成本。现有会话与 CLI 已表达了工作意图，这次不需要新增设置、确认轮次或独立页面。测试数量和写入回执本身不能证明父级成果已完成。

改动思路

容量规则继续归现有 TypeScript 成果所有者，Python 仅转交已限定的校验错误；复用原错误类型和会话重试所有者即可，无需第二套状态或新界面。

当前 PR 完整交付既有 CLI、refresh-state 与原生会话的容量诊断及拒绝后恢复；运行容量和独立验收保持原边界，长期采用仍由原成果验收负责。

这里继续保留整份标准化成果状态合计 131072 字节的边界，也继续保留每项最多 64 个来源的独立规则。新诊断在原 TypeScript 校验处计算候选状态、已保留状态与上限，使用紧凑 JSON 的 UTF-8 字节数；初次声明的已保留计数可以为零。字节数不是字符数、模型 token 或调用成本。

原生适配器只转交既有安全拒绝类，不从错误文字猜分类，也不回显候选正文、来源值或 provider/IO 上下文。CLI 中确认未写入的修正可沿用仍有效的操作与 revision；原生会话预先保存完整请求，改正文档意味着新意图，需要新 operation id 与当前读回。写入结果不确定时仍恢复原始回执，不能用新 id 重发可能已发生的效果。这些差异对应原来的不同重试所有者。

具体改动

完整读取 7 个文件，+253/-6。生产逻辑局限于既有成果所有者与原生 typed catch；其余为既有说明和有明确回归价值的测试，没有新模块、CLI 参数、配置或持久化字段。

关键代码讲解

1. refineGoalOutcome 在原标准化、累计要求与 owner 检查中校验整个候选。成功生成新状态，拒绝发生在提交之前，原输入和已保留状态不会被就地改写。容量计量包含其他成果，不能通过把内容拆到不同 outcome 绕过总量。
2. refineGoalAcceptanceOutcome 是原有实际调用与事务所有者：Python CLI 和会话经此调用同一 TypeScript 规则，再由现有 File、SQLite、PostgreSQL 做 CAS、journal、读回与精确重放。它没有在 Python 或各 provider 另写一份容量决策。
3. ChatLoopXMode.tool 在通用 ValueError/IO 拒绝前捕获 GoalAcceptanceRejected。该类只保存已有稳定错误码和经过 typed bridge 允许的 error_detail，不会把任意异常 payload 当作成功结果。原 admission、会话身份、精确 Goal lifetime 与已保存请求保持权威。

正向流程是原生或 CLI 拒绝超限候选 → 读到准确边界与无写入结果 → 保留旧声明并修正文档 → 由原调用方合法提交和重放。负向覆盖旧 id 搭配变更意图、未知/外部错误、超出 64 来源、其他成果占用空间、UTF-8 精确上限和超出四字节字符；错误不能泄漏被拒值，修复不能产生重复效果。

规范依据：docs/reference/goal-acceptance-observations.md#default-supporting-outcomes，版本 9aedbbd3d2987498e0b17083fd02c195b4fe4bbe。本次逐项映射：Default supporting outcomes；Validation rejection writes nothing。这些要求取自改动前文本；新增说明只解释已验证的边界。既有会话中的产物要求、读回和修正构成现有用户路径，本次不改变布局，未以截图或构建成功冒充部署采用。

对主干的风险

本地在当前精确提交执行：Python 80 项、TypeScript 33 项通过，完整 PostgreSQL 权威存储集成 369 项通过、零跳过，typecheck 通过。PostgreSQL 为隔离的真实 16.15；验证后已移除该临时服务，未对活动状态做测试写入。冻结调用与独立完整对象对照另行执行，三组完整状态/投影和四组完整负向错误均与不可变基线一致；不是只比较计数或两个新 provider。

标准 premerge 整体仍是失败：6 项直接检查通过，catalog 7/8 通过，8 项风险检查与 1 项公私边界通过，0 个 manual hold。唯一红项 examples/autonomous-replan-obligation-smoke.py 在基线和当前头运行原命令都退出 1，停在 assert_typed_repeat_requires_two_equivalent_observations，实际子状态为 canonical_authority_required，要求迁移该测试的 canonical fixture。

归因比较了完整 traceback 和实际完整 status JSON：只归一化 checkout/临时路径、两个绑定随机 fixture 路径的 history digest，以及 registry 读时钟与其 staleness；其余字段相同。8 个相关 fixture/authority/read/history 所有者在基线、当前头和已捕获目标主干 blob 相同，失败发生在本次容量诊断之前。改变的不变量另由真实调用与精确边界测试通过。因此归类 pre_existing_unrelated，原红项保留，其 fixture 恢复与 merge readiness 是独立事项，没有删断言或降低检查。

语义与 CI 对齐

共享成果本来默认启用，没有把本次改动伪装成 opt-in。普通无成果状态与既有完整状态读回、actor/目标/重试边界保持一致；原生模式的绑定与 admission 不因容量或诊断改变。没有子串分类器、领域专属通用规则或新的执行义务。容量拒绝是实际校验，自查引用与恢复说明是原责任范围内的指导，不能扩大执行或验收权限。

按当前 wait_for_ci=false 契约，未获取、轮询或等待远端 CI；以上是本地实测证据。初次测试准备中的容器就绪/标签或观察脚本问题保留为准备记录，修正后实际后端和原命令结果才作为资格；没有把准备退出计作产品通过。未安装共享运行时或调用付费模型。

相关未合并 #7056 与 #7057 修改同一容量代码段和测试文件。这里分别评估各自的当前完整提交，不宣称组合已验证。合入时需由作者协调容量规则与对应诊断，重跑边界、原生恢复和回滚测试；新组合提交需新的精确头审查。

我的整体评价

批准本次有界、完整的调用修复。 原所有者直接解决已复现的用户阻塞，累计意图、来源、事务与重试有真实调用证据；没有用新的设置、前置框架或人工确认代替有效恢复。局部复用已完成，没有必要为本次完成的切片新增形式化后续任务。

容量规则继续归现有 TypeScript 成果所有者，Python 仅转交已限定的校验错误；复用原错误类型和会话重试所有者即可，无需第二套状态或新界面。

当前 PR 完整交付既有 CLI、refresh-state 与原生会话的容量诊断及拒绝后恢复；运行容量和独立验收保持原边界，长期采用仍由原成果验收负责。

结论不等于正式 GitHub 自批准、合并就绪或合并授权；使用作者账号按 COMMENTED 发布。父级成果、真实模型是否因此改变后续工作、比较后的完整成本与注意力收益仍未验证。保留本次披露的资源/兼容性限制和既有失败，后续头不能继承这份批准。

English verdict: APPROVE at ad053b17f88930843f6fd4ae5f80956024854a87. The unchanged combined byte limit now has accurate safe diagnostics through the existing CLI/native owner and correct recovery. Six matched real File/SQLite cases fail at the intended invariant on the immutable base and pass here; 80 Python, 33 TS and369 real PostgreSQL cases pass. One premerge canonical-authority fixture remains red with the same full normalized baseline failure and unchanged causal owners. It is retained as unrelated, not relabeled green. No merge authority or model/long-horizon benefit is claimed.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork