[huangruiteng]

Older Goals that require canonical storage currently appear as generic status failures, so retrying gives the owner no recovery route. Preserve the storage owner's typed refusal and open the existing storage inspector from the error state. Canonical-only settings wait for status, preventing a misleading ownership error during reload.

The existing Goal storage owner still controls preview, writer-stop confirmation and File/SQLite import. This changes App/web error recovery; CLI and Lark migration authority are unchanged. The added authority value is a local frontend display classification mapped from the existing canonical_authority_required code, not a new shared protocol. This is a bounded S5/S10 upgrade-recovery repair; it does not migrate installed Goals or qualify sustained storage operation.

Validation:

• After integrating current main, 100 focused HTTP, acceptance-reference and original-source tests passed, including a real disposable legacy Goal whose original Todo and source bytes survive the status failure and inspection.
• Loader smoke passed: this refusal does not enter service retry loops.
• Packaged frontend passed the real HTTP/File/SQLite recovery journey on desktop and mobile, including keyboard entry, reload, lost import response, unsettled lease/outbox refusal and English/Chinese UI. Build Chat and desktop passed.
• Full test-tree Ruff, diff check and full-tree semantic vocabulary smoke passed. Public boundary scan passed. A general local loopx check also inspected unrelated registered Goals and reported pre-existing canonical-storage refusals; it is not recorded as a passing global check.
• Initial CI exposed pre-existing semicolon/colon lint errors in two test files and a navigation smoke waiting for a removed source-note element. Fix those fixtures without changing their product semantics; the packaged read-only navigation scenario now opens the existing Map explanation and passes. The integrated packaged storage journey also passed again at a9da49db48. Further packaged regressions are corrected at 50e5c23883: Tasks no longer exposes the Chat composer/runtime selector, and acceptance freshness follows its independent owning read. Both typed-actions and goal-showcase pass, including actual acceptance-read failure and retry.
• CLI base/head differential passed all 96 matched cases with no candidate-only rows or review signals. Windows CI still reports crowded quota JSON at 40,415 characters against a 40,000 ceiling; no ceiling or guidance has been changed. Native Windows attribution/qualification remains open, and CI must rerun on this head.
• Related refactor considered: reuse the existing storage inspector and local status classification; no duplicate migration controller was added.

Visual evidence at 1a7b84cd3f (packaged candidate, synthetic public Goal, real disposable backend): the failure gives one recovery action; the mobile view fits without horizontal overflow. This is an error/settings state, not a public homepage change.

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | reasoning_effort=max

动机

使用旧版 Goal 的本机操作者，在打开现有工作时需要恢复状态读取。

同一个旧 Goal，基线返回通用 500；当前头返回有类型的 503，错误页能直接打开既有存储检查器，显式导入后读回原任务。

已验证错误页键盘入口、重载保留原预览、明确确认后的 File/SQLite 读回，以及未结算租约拒绝。

不自动迁移、不停止外部 Host，不授予执行权；CLI/Lark 的迁移事务和现有 provider 选择规则不变。

安装态旧 Goal 的整体升级、持续存储资格及 Windows 原生资格仍未证明；手机展开来源详情的既有溢出仍存在。

改动思路

保留现有 TypeScript 存储事务与策略权威，Python 只转译已知异常，前端只分类错误并跳转原检查器。

本 PR 的交付边界是把旧 Goal 的状态失败接回已有存储恢复旅程；迁移、备份、停写判断和回执不另造 owner。

真实打包界面配生产 HTTP 和隔离原源，错误CTA/Enter进入；SQLite与File分别显式导入，两条原始记录及原文保留；准备/完成后重载保持相同operation/digest，未再次提交。

默认只改变旧存储拒绝的HTTP诊断与App恢复入口；无feature开关，其他错误、只读和事务权限沿原owner。

具体改动

关键代码讲解

1. def _status(：只在现有 canonical_authority_required 异常上保留错误代码和安全提示；其他异常仍沿原错误处理，不泄露本机路径。

2. async function statusFailure(：既有错误 union 增加本地 authority 分类；该拒绝只读一次，不进入 service 的三次重试。

3. startup.storageSettings：错误页为可交互本机来源提供现有 ownership 设置入口；只读来源继续保留原边界。

4. const canonicalSettingsReady：状态加载或旧权威拒绝期间只保留可用的存储检查器，暂缓依赖 canonical 数据的设置；导入后这些设置恢复。

其余改动已逐项检查：四条中英文提示、两张公开安全图片和存储说明，加载器/真实HTTP回归，以及已有导航、typed-actions、showcase验收独立读取的fixture修正；两处Python测试只是等价格式清理，没有改变断言。

原规范：docs/reference/local-authority-provider-selection.md，不可变修订 265ec9b78bc6ba76ab4dc940973fb98e364d116c。以下按变更前规范映射，新增说明不能自行证明实现：

• Unpromoted Markdown authority：implemented。Retain inspection and explicit upgrade/recovery; reject normal mutation before any write or new execution grant, with an actionable supported migration route. 验证沿上述真实路径，保持当前切片与父目标的边界。
• The packaged Goal storage settings use the same transaction for cold import：implemented。Preview and explicit confirmation remain owned by the existing cold import; reload observes the original operation and never completes it. 验证沿上述真实路径，保持当前切片与父目标的边界。
• Existing canonical Goal storage in the App：implemented。Current storage and original receipt are read independently; preserve later state and supported File/SQLite boundaries. 验证沿上述真实路径，保持当前切片与父目标的边界。

对主干的风险

相同冻结HTTP用例在不可变基线返回500而失败，在当前头通过；不是把所有错误重新命名成可恢复。

100项Python HTTP/验收引用/原来源测试、状态加载器、真实前端build与focused Ruff通过。原生premerge六direct及十九selected检查通过，整体仍为manual_review_required，两项图片人工检查另行完成，未称merge readiness通过。

展开来源详情在390px出现旧布局缺陷：同一完整File状态，基线及head均section clientWidth360/scrollWidth535，原文和hash相同；原组件和CSS共27个blob未变。此为独立证明的既有非因果问题，不是本PR修复。 我额外启动不可变基线的打包App，使用相同File权威和相同390px展开状态；两端实测一致，因此不把旧问题归成本PR新增回归，也不把它描述为已修复。

没有证明安装态、自动停止Host、完整历史恢复或Windows平台资格；不把作者报告的Windows预算红灯当作独立已归因或passing检查。 本轮没有查询、轮询或等待CI。两张已提交PNG逐像素和metadata检查为合成安全样例；原生人工hold不是自动passing或合并权限。

我的整体评价

批准这个有用的恢复入口切片。独立验证把旧Goal从“无法读状态”带到原导入器、原任务读回；不需要操作者重新输入已知Goal或另找路径。目标存储、策略与停写确认是既有操作的必要决定，没有增加新的确认轮次。长期效果判断为preserved，UX为preserved，不能从一次导入推出整体升级或长期收益。

保留现有 TypeScript 存储事务与策略权威，Python 只转译已知异常，前端只分类错误并跳转原检查器。 本 PR 的交付边界是把旧 Goal 的状态失败接回已有存储恢复旅程；迁移、备份、停写判断和回执不另造 owner。

视觉判断：错误页有一个清楚的恢复动作，存储主读数与按需来源详情分开；已实际查看长名称、多Goal混合状态、重载、拒绝及展开整页。展开手机详情仍会溢出，基线与当前同状态实测相同，不能称整个手机存储页可读性已经通过。

尚未资格：安装态和完整手机存储页质量未资格；已知的展开长摘要溢出保留，由原存储展示边界处理。

保留原权威和原操作身份；不执行合并、安装或额外消息。本结论只绑定 50e5c2388334f84723cf49014cf7ab28e29012de，新head必须重新评审。

English verdict: APPROVE — 50e5c2388334f84723cf49014cf7ab28e29012de. Validated typed legacy-storage refusal, real packaged recovery and File/SQLite readback; original lease gates remain. Identical pre-existing expanded mobile overflow is disclosed; no merge or installed qualification.