[loopx-agent]

Problem and outcome

A delegated result must return to its original conversation once, even when a temporary Chat write fails and the retry is resumed by another process using a different valid timezone or fractional representation. String comparisons could admit retries early or delay them. Recovering a lost answer could also surface an ambiguous duplicate route, and an ambient operator provider selection prevented the broader return tests from reaching their assertions.

This proposal composes the existing return fixes on current main, preserving original source, audience, attempt and Turn identity. The actual packaged Chat now shows one returned conclusion after an isolated failure and a fresh-process retry. No new capability, setting, sender, worker dispatch or permission is introduced.

Author implementation is complete; qualification remains held by the two Codex profile capture-reader failures below. This is a normal review proposal, without merge readiness or merge authorization.

Exact scope and dependencies

• Tested head: 3f881ad3c16e6248e750f3a9b75b19fe3917d4c0.
• Target/base: main at 8a9e116283df2796926ea153241f48c9c8fc3dbb.
• Eight changed files: three production owners and five validation files; nine DCO-signed commits including the ordered integration merges.
• Written by: model_agent, OpenAI Codex. No separate written specification; the existing return contract and demonstrated failures are the basis.

The original author heads remain ancestors, composed in this order:

Source	Exact head	Included outcome
#7842	b216e4a7e76365d4d31deaa03d2cd5b05869c632	Isolate duplicate-route ambiguity to its request; retain independently readable recipients
#7854	ba5d3c25f286d52807b974b216ca2145f164ac46	Clear ambient Chat provider selection inside the existing test fixture; explicit test choices remain effective
#7865	4509737dc18b5756b467209cbe13ab0bf916399a	Reuse the canonical digest matcher without relaxing native-result provenance
Original #7851	e18805883e4c6048fb83d8a75abda39f7e62fef3	Compare deadline instants at microsecond precision; recheck eligibility under the existing mutation lock

These source PRs retain their own lifecycle. This PR remains based on main; it was updated by a normal fast-forward and does not include the separate shared-transport declaration work in #7862. Earlier reviews cover their stated source heads, not this combined head. The local integration owner verified every exact source/base ancestor and the final tree; that receipt is composition evidence, not a quality or approval certificate.

Behavior and ownership

• The typed return owner uses the existing timestamp parser for retry_at and admission expiry. Valid equivalent representations compare as instants; damaged deadlines are unavailable without rewriting evidence. A due scan is rechecked under the original lock before sending.
• The existing Chat projection groups recovered routes by request, withholding only an ambiguous request. It does not infer authority from text or select a replacement source.
• Native result recovery consumes the existing BARE_SHA256_PATTERN; invalid digest types, shape and provenance still refuse recovery.
• The test-only provider isolation uses the existing autouse fixture and teardown. It changes no shipped provider default or configuration.

Bounded refactoring: applied through the existing timestamp/digest owners and request-local ambiguity map. No parallel executor, vocabulary or speculative framework was added. This is progress toward the overall roadmap and existing controller/executor return acceptance; it does not qualify installed-host adoption or sustained long-horizon benefit.

Validation

All current-head results below are for the exact head above, on macOS with Python 3.14.8 and Node 24.21.0, using isolated synthetic state and the same dependency lock.

Check	Result	Evidence and limits
Five-module return comparison	Passed	Same interpreter, lock and synthetic ambient provider: base 179 passed / 1 failed / 56 setup errors; head 242 passed. All 236 shared case identities now pass, six added cases pass, none removed. The formerly passing 179 cases remain passing.
Provider and native recovery	Passed	558 passed across four existing Chat/provider modules and 24 original-worker/queue recovery cases; explicit selections and refusal assertions retained.
Complete TypeScript suite	Passed	5853 passed / 0 failed / 77 conditionally skipped. Existing platform/environment skips remain skips.
Packaged real entrypoint	Passed	Rebuilt the existing Chat bundle, built and extracted a wheel without installing it, and verified the changed Python/Node product bytes match the candidate. Before retry deadline: 0; new Python process at the deadline: 1; reopened store: 0. Source bytes and original Turn remain unchanged.
Packaged browser readback	Passed	Ego Lite opens the original synthetic conversation: before delivery, no returned result; after recovery and reload, one conclusion and delivered-to-original-audience status. The read-only fixture refused three startup POST attempts and accepted none. No worker, live model or external provider executed.
Static and scope checks	Passed	TypeScript typecheck, changed-Python Ruff, configured 17-module mypy, diff-scoped semantic advisory, full semantic oracle, whitespace, exact-head bilingual RFC check, public/private scan and DCO. The advisory detected no supported new carrier; it is not exhaustive semantic proof.
Codex profile adapter cases	Failed	Both existing variants of test_quota_cli_codex_app_profile_is_explicit_and_applicable still index scheduler_hint on a saved-capture navigation response and fail with KeyError. Reproduced on this candidate; the reader repair remains separate controller work. No required-validation waiver.
Exact change-quality qualification	Failed / held	Eight-file fingerprint fdd4eb9716fdd529bbfe6621f5b98033c4fab7e17d77bbf3b3a645c23ac6d1e9; receipt cqr_fdd4eb9716fdd529bbfe. Safe-fix permitted / 0 applied; one unresolved validation risk plus the failed required validator, no warning/advisory findings. Exact verification is invalid_receipt.
Standard premerge	Held	Four direct checks, Python compilation and all 10 selected catalog/risk smokes passed. Aggregate gate remains quality_invalid_receipt; merge_gate_passed=false.

An initial wheel attempt correctly refused stale generated Chat assets; rebuilding the existing bundle made the subsequent build and extracted-wheel journey pass. It is not an installation or runtime upgrade.

Historical failures are retained: the original e188 author run had 182 passed / 1 failed / 56 setup errors, and its separate review had 88 passed / 1 failed / 104 setup errors. Those observations remain failed at their own revisions and environments. The new passing comparison qualifies only the combined candidate. Earlier source CI failures are not retroactively declared passing; this new head still needs current CI and independent review.

Product boundary and remaining acceptance

The affected existing entrypoints are Chat conversation readback, native return draining and the existing external-return adapters. No visual layout, navigation, control, user copy or persistent configuration changes. Default and detailed UI composition are unchanged; the packaged browser inspection observes the returned result in the existing conversation. No first-screen design change is proposed, and raw captures remain private.

The source/delegation and retry chain is tested, including ambiguity, damaged clocks, lost results, exact/legacy routes, provider isolation and fresh-process recovery. Installed App behavior, real external-provider delivery, model adoption, Windows/minimum-Node execution and sustained outcome/cost improvement remain unverified here. PostgreSQL authority-store behavior is unchanged; these tests do not qualify it.

Next qualification is the existing controller reader repair, followed by the affected profile tests and exact combined-head quality/CI/review checks. No new follow-up work item or alternate return owner is created. No merge, host installation or release was performed.

[loopx-agent]

Reviewer: model_agent — gpt-6.1-sol / OpenAI; runtime_reported; reasoning_effort=max.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机 / Motivation

用户在原始对话等待已交办工作的结果，后台需要在暂时写入失败或重启后继续回传。同一实际时刻用不同时区或微秒写法表示时，旧实现可能提前重试或到期仍等待；修复后截止前保持原记录，到期继续原尝试并只返回一份结果。本次验证了实际回传、独立进程恢复和 HTTP 原对话读回；没有新增用户准备、选择或确认轮次。本修复不关闭完整 R3、C6/C8 的真实接收方采用、安装版、多 host 或持续成本验收，也不修复独立的歧义路由和 private-Lark 前置夹具。

改动思路 / Approach

ReturnService._return_step 仍调用 roundtrip.drain，经既有 Effect 桥进入原生回传事务。now 与保存的截止字符串通过现有 parseTodoTimestampMicros 转为时间点；scan 和锁内 prepare 共用 pendingDelivery。未到期就跳过，到期才继续现有 source/grant、原尝试验证和 token/CAS 流程；损坏的有效截止记录进入原有 unavailable 边界并保留原字节。

在既有 typed 回传事务中复用微秒时钟 codec，比较资格与 provider IO、原来源授权和展示继续分层；无需迁移记录或新增 Python 决策 owner。当前 PR 只修复已提交回传的截止时间判断和损坏记录拒绝；路由歧义、private-Lark 夹具、真实 provider 与完整 C6/C8 仍按原边界资格化。与不做修改相比，保留字典序会留下已复现的提前/延迟判断；单纯用 Date 会丢微秒，迁移所有旧字符串或增加 Python 决策 owner 则扩大状态与维护成本。这里使用简短文字解释分支，无需新增图形服务或把示意当执行证据。

具体改动 / Changes

准确 head：e18805883e4c6048fb83d8a75abda39f7e62fef3；不可变基线与规范版本：8ac384cdcfcf3d6c683ffab43db1a5c14dba0343。完整 diff 为三文件 +165/-7，其中生产 +17/-7，其他为 native 与真实 Chat 回归；没有审阅者代码修改。

关键代码讲解

1. returnClockMicros 对既有长度和日历合法性做有界检查，复用微秒 codec；nowMicros 仅为本次命令的派生 bigint，不写入 receipt，也不是新协议字段。
2. pendingDelivery 保留 terminal、legacy/exact、admitted 与 retry 的原分支，只将 retry_at / expires_at 的资格判断改为实际时间点。原 admission 已有 attempt 时仍走 verify，不重新发送。
3. transactManagerReturnDelivery 在原锁内重读并检查资格。prepare 的检查移入既有 read/decode catch，因此不可读有效截止值返回 skip；attempt/settle 的冲突处理没有被吞掉。

规范为 docs/architecture/rfcs/loopx-overall-roadmap-v0.md，版本 8ac384cdcfcf3d6c683ffab43db1a5c14dba0343；同时核对该版本的 controller/executor §9。R3：本切片实现原结果回传、旧请求可继续处理、重启和重复调用不新增答复的截止时间边界。C6/C8：完整受支持 host、真实反馈采用与持续成本验收属于 out_of_scope，不能由这些隔离测试推断通过。作者列出的 broader private-Lark qualification 仍按下述失败事实保留，不将作者声明当验收证据。

独立复用评估采用当前 repository experience 对真实调用、原来源及有用结果的要求；未从过往案例继承结论。现有 typed owner、时间 codec、formatter、source fence 与 provider verifier 已足够；有界简化已通过共享 predicate 实现，无需另建状态或兼容框架。

对主干的风险 / Risks

最强反例是“不同本地时钟写法导致尚未到期却获得发送资格”，以及 scan 后另一 writer 推迟 deadline。独立 Python aware-datetime oracle 在同一 150 个实际 native scan 观察中，基线 60 个误判，head 为 0；150 份记录均无字节变化。完整 54 个 native 测试还覆盖微秒前一刻、同刻、offset seconds、保留原 attempt、8 种损坏截止字段、源损坏与锁内重查。没有 feature-off 开关；无 pending/terminal 等原路径及已正确的 90 个时间观察保持原行为，修复默认时间语义的变化已明确披露。

本次本地验证：PASS — TypeScript typecheck、changed Python Ruff、5 项 direct +10 项选定 premerge smoke、三份文件 public scan、差分语义 advisory；PASS — 四个真实 drain/新 Python 子进程/HTTP 用例证明截止前 0、到期 1、重新打开后 0，原 route 与用户 Turn 不变。初次 public scan 因未显式指定 runtime 被入口拒绝，已改用一次隔离的显式 registry 扫描，未修写现用 runtime。

FAIL（保留、非本次时钟回归）— 五个完整扩展/回传模块：base {'passed': 84, 'failure': 1, 'error': 104}，head {'passed': 88, 'failure': 1, 'error': 104}。同一解释器与安装依赖、相同测试选择和共同夹具，全部共同 case 状态及完整归一化错误一致，完整失败签名 sha256:5b157f47b7069cd54fcce0e31b8560a283801fee3ed85d1cbb4894a97d2e8a8c；head 仅新增四个通过的真实 Chat 时钟 case。歧义 route 的 projection 断言不调用 deadline 事务；其余失败停在 private-Lark 前置准备，回传断言未执行。既有 #7842 / #7854 保留修复/资格责任，不能把这些红项说成通过或用相同计数代替因果验证。初轮两 venv 的 Pillow 版本不同，未用于受控归因；后续 head 使用与 base 相同解释器/依赖并核实导入当前源码。本轮 exact-scope CQR cqr_801c5769a8cc15dde0b5 已记录并 verify 为 valid/pass，test_validation 仍为 risk；这是必要断言独立通过、旧失败完整归因后的当前资格，作者旧 CQR/premerge hold 历史仍保留。未查询或等待远端 CI。

未独立验证真实 private-Lark provider、安装版或其他 host；其断言被旧夹具挡住的范围仍未获资格。没有 authority-store、路由或持久协议变更，因此未运行无关 PostgreSQL/完整 TS 存储矩阵。已验证必要的时钟、来源、单次回传和本地仓库检查；更广红项是有独立证据的诊断风险，不改变为绿，也不构成合并授权。

我的整体评价 / Verdict

该准确 head 完成已复现的截止时刻缺陷这一完整、有用且可回滚的切片，未发现新增阻塞问题。long_horizon 为 improved：等待、到期恢复与终态去重连成实际后续行为；user_experience 为 improved：原始已授权请求即可得到一次结果，无新增准备或确认轮次。改动复用现有词汇，bigint 留在本地命令，不新增共享状态、领域义务或更宽权限。

检查 return_delivery.ts、roundtrip.drain、Chat HTTP snapshot 及既有卡片消费路径；本次没有页面、布局、文案或 bundle 改动，无需新增视觉证据。未独立重跑作者浏览器证据；安装版、真实 provider 和完整 private-Lark 回传仍未获本次资格。APPROVE 只评价当前修复；既有 broader-suite 红项、作者原 qualification hold、最终 head 的单独资格及 maintainer merge authority 继续分别记录，不宣称完整 R3/C6/C8 或已合入。

English verdict: APPROVE — head e18805883e4c6048fb83d8a75abda39f7e62fef3 fixes instant-based return deadlines; native54, independent150 and real Chat retry/reopen4 pass. Matched unrelated broader-suite failures remain failed; no merge or installed-provider qualification.