[songoow]

Moved to the upstream repository

This proposal has been resubmitted as loopx-project/loopx#7778, targeting upstream main, with the same head commit 90d7d460b010777b583bec0ab8327a843cfa0202.

Closing this fork-local PR to keep further review in the upstream submission. No implementation commit was changed by this move. The upstream description records the old loopx-project#7764 dependency, the newer loopx-project#7764 recovery policy, and the integration decision still needed before merge. The original discussion and validation record remain below.

---

Contribution target

Contribution for loopx-project/loopx#7764. The base branch is an unchanged snapshot of its c053027fb2f26c54cc3f5950ebee7021e87a5450 head; this PR contains only the four-file follow-up, ready to cherry-pick as one commit. The GitHub integration cannot open a PR in the original author's fork (HTTP 403), so this reviewable contribution is hosted here and linked from the upstream discussion.

Problem

This is a focused follow-up to loopx-project#7764, based on its c053027fb2f26c54cc3f5950ebee7021e87a5450 head. It is intended for that contribution branch, so the review contains only the recovery fix below.

Source-history reconciliation selects the latest event for each missing, already registered result. The stricter attribution checks correctly reject new measurements that contradict their declared execution. However, reconciliation preview currently counts contradictory historical events as recoverable, then execution rejects the entire batch, including valid results.

A synthetic real-CLI case with one valid finding and two historical attribution contradictions previews three recoveries on the base revision, then fails before writing any of them.

Change and behavior

• Reuse the existing TypeScript-owned attribution check through the result-log adapter in reconciliation planning. Single and batch writers, current views, and recovery use the same rule; ordinary batch validation keeps its existing structural-validation precedence.
• Recover the eligible latest registered subset. Keep blocked historical records in the unchanged candidate log and report their count, an event-id digest, and the validation reasons. Existing Markdown warnings make those reasons visible outside JSON output.
• Report blocked when no selected record is writable. Partial recovery reports would_reconcile_with_blocked_history or reconciled_with_blocked_history.
• Classify blocked history separately from unrelated remote orphans. A correctable attribution contradiction alone does not report that registered remote rows require deletion. No remote deletion is performed.
• Keep ordinary writes strict and leave ordered-prefix archival replay unchanged. This selected subset is not an authoritative ordered prefix, so it receives no replay bypass.
• Document the recovery path in English and Chinese: append a valid correction for the same result id in candidate history, then preview again. Recovery selects the latest correction without rewriting its prior evidence.

Validation

Tested tree: 712bc48c58c3091611f9fb11a194d42b7e5161e2.

The following four focused modules passed: 57 tests.

python -m pytest -q \
  tests/test_explore_source_history_reconcile.py \
  tests/control_plane/test_explore_source_history_measurements.py \
  tests/control_plane/test_explore_measurement_history.py \
  tests/control_plane/test_explore_measurements.py

Coverage includes mixed and all-blocked recovery, unrelated remote orphans, corrected latest events, idempotence, forged/unknown/private source rejection before any write, runtime failure propagation, the existing strict-write and archival-history contracts, and actual CLI JSON/Markdown preview, execution, and readback. The CLI test first verifies the uninstalled-extension rejection, then installs the bundled Lark provider through its real local lifecycle; it does not bypass the gate or call a remote service.

The same isolated real-CLI harness and synthetic fixture were run against the base and tested candidate:

Observation	Base	Candidate
Preview	Selects 3, no blocked explanation	Selects 1, reports 2 blocked reasons
Execute	Attribution error, writes 0	Writes 1, readback verified
Repeat	Same attribution error	blocked, writes 0
Original candidate	Unchanged	Unchanged
Existing destination prefix	Preserved	Preserved

The acceptance oracle fails on the base and passes on the candidate. Both isolated runtimes were stopped after authenticated ownership checks.

Also passed: focused Ruff, changed-source semantic advisory, public-boundary scan of all four changed files, staged bilingual RFC check, and git diff --check. The semantic advisory does not infer dynamically constructed status strings; the additive recovery statuses are explicitly described above. Full repository CI and merge readiness remain separate qualification.

Scope and generality

The bounded refactor exposes the existing attribution validator to its real recovery caller; it adds no parallel measurement owner or generic recovery framework. The tests use synthetic opaque references and exercise the result-reference and input-revision contracts, not task names, benchmark values, model identities, or a provider-specific rule. This change makes no claim about benchmark scores, token savings, performance, or downstream research outcomes.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-01T03:00:55.788856Z	90d7d46	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.