[loopx-agent]

Reports can remain stuck after a quota-exhausted model request even when the current authentication has usable allowance. This reuses the native metadata reader and shared typed admission owner to permit one new, correlated report Turn only after proving the original request contains solely its user input and the current allowance is usable. The failed Chat/kernel records, Task, frozen window, actor and original return route remain intact.

The admitted continuation refreshes its own native adapter to reload authentication in the same thread. File/SQLite and ordinary managed Session/steward paths retain busy-user priority, revocation, cancellation, authored-result and unknown-effect holds. A failed continuation cannot spawn another attempt. Generation, native settlement and verified original-message delivery remain separate.

Validation:

• 256 report, monitor, native-host and authentication regressions; production code is unchanged by the subsequent test-only commit.
• Eight extended File/SQLite integration scenarios: original failure/journal bytes remain unchanged, unavailable quota holds, one continuation refreshes its native client, another failure cannot chain, and a successful report permits the next independent calendar window.
• Eight typed-owner tests, including wrong identity/window, missing or stale proof, revoked/disabled/busy state and recorded-effect counterexamples; TypeScript typecheck passes.
• Thirteen existing quota-recovery regressions; two immutable-base disabled-path checks pass. The original quota-recovery scenario fails on the base by leaving the report stranded.
• Source premerge, public-boundary and diff checks pass.

Model responses, native provider metadata and delivery in integration tests are synthetic. Installed adoption, live report quality and a natural original-audience report require separate readback; this PR adds no calendar subscription or authentication selector.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

使用已启用定期报告的原管家或普通 managed Session 的用户。 Before：一次额度耗尽会把原报告窗口永久留在失败；After：原生读回确认仅有用户输入且当前额度可用时，原服务自动接纳一次独立续办。 可观察的增量是同一任务、窗口和原会话完成独立验证及原路回传，原失败与其 kernel journal 字节不变。 本 PR 不选择认证账号、不恢复任意失败业务、不扩大授权，也不改报告内容或前端布局。 尚余完整自然语言周期任务、报告编辑密度及安装后真实定时报表资格，继续由既有周期任务负责人验收。

改动思路

Native proof → typed admission → one new Turn → original publication。保留旧失败，给续办一个独立的 kernel/lease 身份，避免把“额度已恢复”误当成“原执行无副作用”。保留现有 provider IO、typed admission、Turn、lease 与 publication 分工；一个可推导的续办身份承担去重，不增加调度器、任务库或权限。 当前 PR 边界是额度拒绝后的单次报告续办与同线程客户端刷新，覆盖原路回传和下一独立周期；生产采用由正常更新与独立读回完成。

以下是 source-derived control flow，绑定本次 reviewed head 7ad36d0590d90ad680ea7acdb69f743dbab7fe6a；表格解释条件，不代替执行证据。

Native state	Current allowance	Result
user-only quota refusal	available	one correlated Turn
tools/output/unknown items	any	hold
busy/queued/revoked/cancelled	any	defer/refuse
failed continuation	available	retain; no retry chain

具体改动

Spec：docs/product/periodic-reports.md，accepted revision a07941697d614c65d48c1d646d1151681b22d81e（immutable contract）。lifecycle-owners 复用现有 Task/Turn 与 publication；one-persistent-steward-actor 保持原身份和受众；native-scheduling-and-execution 保持用户工作优先、权限及未知效果门禁；original-private-report-settings-and-execution 以完整正文和原路读回验送达。

关键代码讲解

• admitReportQuotaRecovery 同时核原失败 receipt、actor/Task/window、native user-only inventory 与当前 allowance；缺证据和 scope 变化在执行前拒绝。
• StewardTurnHost.report_quota_request 复用现有 provider reader，构建一次独立身份，未改写原失败或其 journal。
• ChatRuntimeController._ensure_adapter_locked 只刷新该已接纳且 queued 的 native report adapter，重新载入认证并 resume 同一 thread；不会替换正在执行的其他用户 Turn。
• report_turn 统一结果选择，供 Core/Lark return、health、cancel 和 cached settlement 使用，避免 kernel 已提交但读者仍盯着旧失败而不投递。

Validation：256 个 report/monitor/host/auth 回归通过；后续 test-only commit 没有 production diff，扩展后的 8 个 File/SQLite 场景另行通过，包含 old-process exit、same thread、旧记录字节不变、第二次失败停住及下一独立窗口继续。另有 8 个 typed-owner 测试、13 个既有 quota recovery 回归、base/head 未到期不激活对照，typecheck 与最终 standard premerge 均通过。

对主干的风险

主要风险是误把可用 quota 当成可重跑证明，或复用仍缓存旧认证的客户端。前者由 native 完整 item 读回及 typed effects/identity fences 拒绝；后者由原 queued adapter 的实际关闭、同 thread 恢复验证。Core、File/SQLite、validator、Task/lease/quota 和 publication journal 都走真实实现；测试中的 model、native provider metadata 和 Lark transport 是 synthetic，不能证明真实账号或自然送达已成功。缺失 API、quota 不可用、已有 authored response/generation、撤权及失败 child 保持 hold。回滚保留新旧记录，可能需要恢复兼容 host 才能继续 pending child，不能删历史或盲重放。

语义与 CI 对齐

这是 existing typed request 的 optional witness 扩展，复用既有 actor、native receipt 和 publication 语义；没有新的 scheduler/store/CLI 或 grant。共享读者合并为单一 report_turn，不为旧数据增加并行 authority。当前 Goal 的 wait_for_ci=false，未查询、轮询或等待 CI；所列证据来自本地精确版本。Module budgets、公开边界与最终 premerge 通过，没有调高门限或隐藏失败。

我的整体评价

APPROVE — justified increment. Long-horizon 与 user experience 在已测机械链路上 improved：已授权报告无需新增用户交互即可恢复，失败有界且后续独立周期能继续。保留现有 provider IO、typed admission、Turn、lease 与 publication 分工；一个可推导的续办身份承担去重，不增加调度器、任务库或权限。 当前 PR 边界是额度拒绝后的单次报告续办与同线程客户端刷新，覆盖原路回传和下一独立周期；生产采用由正常更新与独立读回完成。 没有渲染界面变更；检查范围为原有消息、报告格式与后台执行链，布局和样式保持原实现。 视觉范围无新增未测项；真实安装、自然送达与 live report quality 另行验收。 这是可合并的通用原生报告修复；完整自然语言任务、编辑密度及生产闭环继续保留在既有负责人任务中，不能以本 PR 或 synthetic delivery 宣告完成。

English verdict: APPROVE at 7ad36d0590d90ad680ea7acdb69f743dbab7fe6a. The shared native report path admits one independently qualified quota continuation, reloads only its own queued client, preserves both failed histories, verifies original-route publication, and permits the next independent period. Unknown effects and missing authority remain holds. Local real-storage/kernel tests pass; installed live delivery and editorial quality remain separate acceptance.