[loopx-agent]

An unreadable App-to-Lark mirror journal could stop discovery of other private replies. If the worker had already selected a truncated journal, it could also replace the damaged bytes with a blocker, losing evidence of an uncertain delivery.

Keep the damaged journal intact and continue discovering healthy replies. An App mirror still uses its original source, lock, and delivery receipt. The existing manager-return module verifies already delivered mirrors through the same checked journal reader.

The isolated regression tests show that the old code fails on invalid UTF-8 and overwrites truncated JSON. The candidate leaves both journals unchanged, delivers and reads back an independent reply in its original private conversation, and resumes the App mirror after the exact receipt is restored. Validation: 26 private conversation tests, 116 manager-return tests, and the standard premerge checks. The test uses the local Core with a synthetic Lark provider.

[loopx-agent]

Reviewer: model_agent, GPT-6 family, OpenAI, self_reported

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewed exact head: aef4dba

动机 / Motivation

在原飞书私聊等回复、也从 App 查看同一对话的用户。两个已授权私聊中，一个 App 镜像的交付回执损坏，另一个私聊已有待发结果。旧版遇到非 UTF-8 的 App 回执时停止发现其他回复；已选中的截断 JSON 还会被覆盖。候选隔离不可读回执并保留原字节；另一个原飞书会话仍能收到独立回复。不改原受众、授权、发送顺序或工作池，不补发效果不明的镜像。损坏类型在隔离环境验证；线上当前没有发现此故障。仍需独立评审和正常采用。

改动思路 / Approach

Core 保存原 Session 与 Turn，Lark transport 扫描并投递原回传，manager_returns 只核验已经投递的协作结果。原 App 镜像回执的发现和验证，沿现有 Lark 私聊 worker。 回执读不出时只保留该条，扫描继续。已选中的 worker 在原锁内重新读取，格式不完整时不覆盖，也不构造新发送。协作回传沿同一个严格回执读取器做原结果核验。

具体改动 / Changes

• C1：loopx/extensions/lark/private_conversations.py:1478 只跳过不可读的镜像回执；已有私聊答复继续从原队列交付。
• C2：loopx/extensions/lark/private_conversations.py:1491 和 loopx/extensions/lark/private_conversations.py:1694 在正常载入原回执后才允许发送或写状态。测试 tests/test_lark_private_conversations.py:2696 分别注入截断 JSON 和非 UTF-8 数据，保留坏字节，读回另一原私聊回复；恢复原回执后只发送尚欠的镜像。
• C3：loopx/extensions/lark/manager_returns.py:94 由现有协作返回模块核验原镜像。仍复核原授权、Core 消息与原 provider locator；仅核验，不重复发。 原会话契约

对主干的风险 / Risks

坏回执仍待恢复，保留现有权限和无回执时的失败边界。重点是避免把历史兼容的正常回执误判为损坏，以及避免对已经尝试但未确认的消息再次发送。相关 App/飞书用例 26 项、协作回传 116 项及标准预检通过。首次实现超过既有文件上限；将协作返回核验放回其原调用模块后通过原限额，未改预检规则。

我的整体评价 / Verdict

该改动解决了可复现的扫描中断与持久证据覆盖。用例核对了另一原会话的实际回传和同一回执恢复后的去重。生产采用仍需独立评审，采用后需从原服务和原会话读回。

English verdict: APPROVE