[loopx-agent]

quota status and quota plan rejected an unmigrated Goal but reported quota_unexpected_collection_error, hiding the canonical authority owner's backup/migration recovery. Their early observation return now preserves the same typed rejection fields already exposed by execution commands. Ordinary unmigrated reads remain refused; no fallback, migration, admission or write is added.

The two old scope cases incorrectly expected ordinary legacy reads to succeed after the accepted read cutoff (#7032). File/SQLite keep all existing selected-versus-global scope assertions; unmigrated cases now assert the required refusal, exact recovery, readable guidance and absence of state/import/spend effects. Generic exception privacy is checked for both observation modes.

Validation at target-main baseline 59c8bbf791bca9d3d1dd996629a1610c0679b23e:

• New recovery assertions fail on the original implementation: 2 failed / 13 passed. Both failures lose canonical_authority_required behind the generic collection code.
• Fixed selection: 156 passed across scope, CLI diagnostics, quota error codes, host permission failures and unmigrated read/import recovery; real isolated File/SQLite CLI paths included.
• Fifteen same-input baseline/head failure projections: only status/plan authority rejection gains the original typed recovery; execution, generic errors and host-permission responses retain exact parity.
• Ruff, diff hygiene and bilingual diff check passed. No RFC pair changed. Added-line public-boundary scan clean; no private logs or state included.

The same-domain refactor moves existing authority rejection formatting before the observation/execution split and reuses it; TypeScript remains the admission owner. No new vocabulary, provider behavior or semantic classifier is introduced. This independently useful fix is separate from the unfinished unified-contract integration (#7430). It resolves its two diagnosed legacy-scope failures without claiming C1 completion or model/full-cost benefit. Packaged installation, whole-suite qualification and merge are not claimed.

[loopx-agent]

Reviewer: model_agent; OpenAI gpt-6.1-sol; runtime_reported; reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机 / Motivation

受影响的是检查 Goal 状态或计划的 CLI 调用者。未迁移 Goal 的拒绝本来有明确的备份、迁移恢复路径，但两个观察入口提前返回通用采集错误，使调用者无法从结果知道下一步。这个 head 让拒绝携带原有恢复指引；普通读取仍被拒绝，不自动创建权威、迁移或执行任务。

改动思路 / Approach

复用既有 CanonicalAuthorityRequired 和 authority exception 的数据，把同一份错误投影移到观察、执行分支之前。权威与准入判断仍由既有 TypeScript owner 负责，Python 这里只负责展示。这样能修复实际调用入口而无需新异常体系、配置或并行恢复逻辑。与不改代码相比，调用者得到可执行的恢复说明；与复制一套观察分支相比，公共格式只维护一次。当前边界是诊断修复，不把统一契约、安装采用或模型收益纳入已完成结论。

具体改动 / Changes

完整差异为三文件、生产代码 +9/-7、测试 +25/-1。规范依据是 docs/reference/coordination-observation.md，固定版本 59c8bbf791bca9d3d1dd996629a1610c0679b23e。以下编号是本次对规范条文的映射：AUTH-READ 保留未迁移读取拒绝；AUTH-RECOVER 返回备份后迁移指引；AUTH-NOEFFECT 不自动导入、不回退旧文件、不产生业务运行；AUTH-SCOPE 保持独立 canonical Goal 可读取。四项在当前 head 均有实际 CLI 证据。

关键代码讲解

• quota_failure_payload 在第 92 行只识别原有两类 authority exception，第 124 行把原 typed payload 带入提前返回；普通未知异常仍只给通用错误，私有异常文本不会因此公开。
• CanonicalAuthorityRequired 继续拥有 write_admitted=false、无 provider 读取、无 legacy fallback 以及 migrate_goal_authority/backup_required=true 的来源；这些内容没有在 CLI 重新推断。
• handle_quota_command 的错误出口 继续调用同一 formatter。观察命令不属于业务事件集合，因此本修复没有新增业务日志或扣额路径。

独立同输入比较：不可变基线 59c8bbf791bca9d3d1dd996629a1610c0679b23e 的六个真实 CLI 场景中，两个未迁移入口丢失恢复信息，四个 File/SQLite 正向场景通过；当前 0caa350456f7d85891c0038d059ca350d83d1208 六项全部通过。另比较五命令、三异常的十五份完整 formatter 输出：十一份完全相同，四份观察入口 authority 错误按预期补回原诊断。没有只比较 error code。

对主干的风险 / Risks

主要风险是扩大异常文本暴露，或让可读指引被误当迁移授权。独立反例验证通用异常中的合成私有字符串仍不可见；真实拒绝前后状态字节不变、无新 authority、无业务 Run。两种 canonical provider 的正常读取和既有显式导入恢复也已覆盖。实现只把已有数据搬到分支之前；没有新增词汇、prose 分类、默认开关、权限判断或持久状态。

PASS：五个相关 Python 模块共 156 项；同输入真实 CLI 六项及十五输出比较；三文件 Ruff、修改模块 mypy、diff hygiene。标准 premerge 的 6 项直接检查及 18 项选中检查全部通过、无人工 hold；精确三文件质量回执 cqr_a9f8895418d013411863 有效。PostgreSQL 存储和服务未修改，本次不声称重新资格其集成矩阵；没有安装态或真实模型行为证明。

语义与 CI 对齐

复用现有 typed rejection；默认变化仅是观察失败现在保留原 authority diagnostic，既有协调观察规范已要求这一行为。未修改预算、迁移门或 machine obligation。按 Goal 的 wait_for_ci=false 未查询或等待远端 CI，本地验证与实际 GitHub 合并资格分别判断。

我的整体评价 / Verdict

没有发现阻断缺陷。problem_context=goal_achieved 指这个可独立使用的诊断切片；long_horizon=preserved，user_experience=improved：错误可恢复且没有新增交互或自动副作用。复用、兼容及改动比例均合理，局部提取已经收敛重复表达，再拆 helper 或改写语言会扩大成本。没有渲染页面变更，视觉验收不适用；未验证范围是安装采用、全仓资格和模型/完整长期成本。批准不授予 merge 权限。

English verdict: APPROVE — 0caa350 restores typed observation recovery; real CLI counterexamples, parity and 156 focused tests pass.