fix(presentation): show decision bodies and evidence in App and Lark

[huangruiteng]

Problem and result

A decision could be reduced to a scheduler label in Lark, while App details reused the 112-character card summary. The concrete object could disappear before the user chose an action.

App details now retain the request body alongside reason and evidence. Lark uses a small typed presentation projection of request bodies, IDs and evidence. Summary-only input explicitly reports missing request details; the obsolete action-label/free-form fallback is removed. Existing admission, duplicate suppression and authority transitions are unchanged. The App conversation RFC and GQ10 evaluation cover this journey.

Validation

Validated head bf2c38ff3c4d804bc2346567c34455c099cba5a9 against integrated main 440a19aab2b69dc23748bb734fa58f2a53e2872f. The inherited SQLite typecheck and architecture blockers are resolved. CI then exposed a stale benchmark environment expectation, reproduced locally before integrating the existing main repair from #5231; private temporary-directory isolation remains enforced.

• Current head: 73 Python tests passed (65 Lark goal-channel and 8 runner configuration), 2 typed projection tests, full control-plane typecheck and App render smoke. The reproduced old runner expectation was 1 failed/7 passed.
• Prior validated head 9f791b767: 820 architecture tests, configured Ruff/mypy, packaged build/browser and production-boundary probe passed. The integration changes only the upstream benchmark test and release documentation; App/runtime sources and the 12-file PR diff are byte-for-byte unchanged.
• Packaged browser scenarios passed: Chinese desktop, narrow English, read-only, unavailable source, supersession and no unintended writes.
• An isolated production-path probe passed 11 cases through the real TS/Python projection and notification state owner. Only external Lark transport was faked; five inactive cases matched the same base fixtures. No live group notification was sent.
• Risk-based premerge passed: 5 direct checks, 7 catalog canaries, 8 risk-profile smokes and 1 public-boundary check; no failures, skips, timeouts or manual holds. Exact-scope change-quality receipt is valid (0b7ee5749e3682ce490799017cc71fb08a0fbd4a1b945273fa50673b2ce38d26).

Placement: request-content selection belongs to existing typed presentation; Lark remains a formatting/transport adapter. The future-facing pass removes legacy content fallback without adding migration scaffolding. No new action authority or persisted state is introduced. The installed application has not been updated. Updated-head review and maintainer merge remain separate from these validation results.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @huangruiteng.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[huangruiteng]

Exact-head self-review: NOT READY TO MERGE (inherited validation blocker).

The App renderer now carries requestText separately from its short card label. Packaged desktop/narrow/read-only tests exercise the real parser, mapper and drawer, including stale/missing/superseded selection. Lark request projection uses the existing TS presentation owner and existing redaction/idempotency/readback. Missing bodies are unavailable; old action labels and free-form prompts no longer synthesize decision content. Typed gate state and authorization are unchanged.

Validation: 65 Lark tests, 2 TS tests, App render smoke, packaged build/browser, Ruff, configured mypy and focused TS check passed. Global control-plane typecheck fails identically on base/head in SQLite replay; #5215 repairs that callsite and passes 322 real SQLite tests plus full TS check. This draft needs a repaired main and refreshed exact-scope qualification before promotion. Premerge selected 16 checks (15 passed, one advisory maintainability failure); strict quality remained blocked as expected. No live notification or installed update.

Future-facing pass removes obsolete compatibility fallback and preserves request identity rather than deduplicating by prose. RFC and public-safe GQ10 acceptance updated.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewed exact head: 863694b70850a544d3557e0e68dba5af360caf6d; immutable merge base: 71525ab908e24dc9f3e4ace922d1d2ef3437ce4d.

动机

这是一个有用且完整的“决策可读性”增量，而不是整个对话或 GQ10 验收已经完成。旧 Lark 路径优先展示调度标签；App 抽屉也只拿到卡片摘要，正文后面的版本和发布渠道会消失。我用相同合成请求在 base/head 复现：旧版缺正文，新版保留正文与证据；后续批准、执行和结果返回仍由现有 owner 验收。

改动思路

从既有 Todo 投影取正文、ID、原因和证据，不从 action 标签或自由 gate prompt 推断用户要决定什么。Lark 在格式化前复用既有 public-safe 压缩过滤，再调用 TS presentation owner 选取内容；Python 仍只负责消息排版和传输。App 沿现有 status parser→workspace mapper→detail drawer 传递独立的 requestText。新 RPC 是只读投影，不新增 gate、决策状态、权威来源或发送许可。保持原样会继续丢失对象；仅修 Lark 或仅修 App 不能覆盖这两个已存在的入口。

具体改动

关键代码讲解

• projectDecisionNotice（loopx/control_plane/presentation/decision_notice.ts:6）：只接受真实 request body，最多投影三项；相同正文的不同 ID 不合并。只有标签或空正文时返回 unavailable，不再拼出兼容决策。
• gate_message（loopx/extensions/lark/goal_channel_contracts.py:704）：正文、原因、证据分别在既有隐私过滤之后进入投影，保留 request ID，并明确这是 bounded preview。缺正文时不提示用户回复决定。原通知 admission、generation、receipt/readback 与冷却路径没有改动。
• attentionDetails（apps/presentation/dashboard/src/features/personal-workspace/attention-details.ts:18）与 AttentionDetailCard（同目录 attention-detail-card.tsx:4）：保留完整正文，与短标题分开显示；不改变 user_gate 分类、不可用来源或 superseded 判断，也不因此开放操作。

12 个文件全部检查：生产改动是上述 App 两处、Lark formatter、21 行 TS 投影及其 handler 注册；测试是两项 TS、Lark 回归、React 静态渲染及现有浏览器 smoke；package 脚本增加 JSX 编译；RFC/GQ10 明确对象、证据、截断和权限边界。没有生成物或私有证据进入 diff。未来演进检查已体现在删除旧 action/free-form 内容 fallback；当前无需再造共享状态层或扩大重构。

对主干的风险

最值得反证的是“正文显示对了，但重复发送、内容修订或无权限路径退化”。独立探针在真实 Effect owner 上验证长正文、两个同文不同 ID、summary-only、隐私字段和超长预览；通知调用使用假 Lark transport，没有发真实消息。首次发送、相同请求重放、正常 updated_at 修订的结果分别为 sent_verified、already_sent、sent_verified；关闭 binding/通知、外部发送权限关闭、cooldown 和非 gate 五条路径与 base 完整返回值一致，均不发送且不改 binding。

打包浏览器验证通过中文桌面、英文窄屏、只读来源、离线、替代与移除事项；只读路径没有写请求。桌面/窄屏截图确认正文在详情区可读，不改公开入口首屏。独立打包 App 对照也复现 base 缺正文、head 保留正文；两边相同的 Chat 初始化请求不是决策写入。没有测量性能、真实 Lark 交付、已安装 App 升级或完整对话 settlement。

语义与 CI 对齐

这是现有 request/Todo 词汇的 presentation 扩展，不是新的授权协议。缺正文不再用标签生成内容的默认变化已在重命名测试、RFC 和 GQ10 披露；“预览”不是批准义务或执行授权。既有 Lark opt-in 关闭路径已做 base/head 对照，未被新 handler 的存在激活。label 清理正则用于排版，不用于判定 gate 或权限。

本地结果：65 项 Lark、2 项 TS、App render smoke、完整 App 构建与 packaged browser、Ruff、配置的 mypy 通过；架构套件 818 通过、2 失败。两失败的完整六条 I/O census 明细与不可变 base 相同，且相关源文件不在此 diff。全局 TS 检查也在 base/head 同样报 SQLite replay 三条类型错误，修复由已合并 #5215 拥有，不是本 PR 引入。maintainability 的 loopx.status 119/117 也是相同 base 失败。风险 premerge 的 5 项 direct、16 项选中检查全部执行，required failure 为 0，包含一项继承的 ratchet advisory；上述硬检查没有被豁免。当前策略 wait_for_ci=false，本轮未查询或等待远程 CI；仓库 CI 分类仍是 full，不能称 UI-only 豁免。

我的整体评价

APPROVE：长期连续性 preserved，用户体验 improved；已验证的小切片确实让决定对象可读，并保留重放、权限与恢复边界。代码规模与问题相称，没有增加持久化状态；现有内容 fallback 的删除有活跃调用及缺正文测试支撑。整个 App/Lark 对话闭环仍是原 RFC/GQ10 owner 的后续验收，不由这次 review 代替。主干集成和继承检查修复影响 merge readiness，但不应把已归因的 base 失败变成本 PR 的 REQUEST_CHANGES。此结论不授权自合并控制面或 runtime 改动。

English verdict: APPROVE - 863694b70850a544d3557e0e68dba5af360caf6d; decision bodies and evidence survive real presentation paths, with retry/redaction/off-path checks. Local baseline failures are independently attributed; full live delivery and merge readiness remain separate.

[huangruiteng]

Frame-aligned conclusion at 863694b: APPROVE. Checked the App conversation / async inbox RFC, R1–R3 and steward GQ10. The request-object/evidence preview row is delivered at the real App and Lark presentation paths. Action acceptance, execution/result return, live transport and installed-product qualification remain with their existing owners; this is not full GQ10 settlement or new permission. The existing base-integration/conflict notice is a merge-readiness concern, not a body-readability regression.

本轮亲自验证，没有交给其他 session。65 项 Lark、2 项 TS、App render/build/packaged browser 通过；独立 base/head 反证确认旧路径丢正文、新路径保留正文，重放/修订、隐私和关闭路径保持边界。SQLite 全局类型错误、两项 I/O census 失败和 status 119/117 超限的完整明细均在不可变 base 复现，因果路径未被此 diff 修改；它们应由原 owner 处理，不应据此对这个 PR REQUEST_CHANGES。当前策略不查询远程 CI。没有合并或修改 PR 分支。

Full exact-head review.

[huangruiteng]

Integration and validation update for 9f791b7:

Integrated main d0bc16a and retained both golden-query additions during the documentation merge. The old SQLite typecheck and architecture holds no longer reproduce. Full control-plane typecheck, 820 architecture tests, 65 Lark tests, 2 TS tests, App rendering/build and packaged browser coverage passed. Premerge passed all 5 direct checks and 16 selected checks, with no failures, skips or manual holds; the exact-scope quality receipt is valid.

The 11-case isolated production-boundary probe also passed, including unchanged disabled/unauthorized paths, duplicate suppression, revised requests, missing bodies and redaction. Lark transport was simulated; no live notification or installed-App update occurred.

This is an author validation update, not approval of the new head. The earlier review applies to the previous head; updated-head review and maintainer merge remain pending. No checks were bypassed.

[huangruiteng]

CI follow-up at bf2c38f:

The failing shard in run 36353664964 was test_app_server_environment_adds_only_nonsecret_gateway_sentinel: its expected environment omitted the private TMPDIR/TMP/TEMP entries. I reproduced the same failure locally (1 failed, 7 passed), then integrated main's existing #5231 repair. The configuration suite now passes all 8 cases; no runtime isolation was removed and no check was bypassed.

Current-head validation: 73 focused Python tests, 2 typed projection tests, full control-plane typecheck, App render smoke and premerge (5 direct + 16 selected checks) passed. The exact quality receipt is valid. App/runtime sources and the full PR diff are unchanged from the previous tested head; prior packaged browser, production-boundary and architecture evidence remains explicitly attributed there in the body.

The new remote CI run and updated-head review remain pending. This is author validation evidence, not approval or deployed acceptance. No merge or installation performed.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Fresh whole-PR review of exact head bf2c38ff3c4d804bc2346567c34455c099cba5a9 against 440a19aab2b69dc23748bb734fa58f2a53e2872f. Prior approval of another head is not inherited. No validated blocking finding; no merge performed.

Integration freshness: the previous-to-current head merges two unrelated main-only test/release-doc changes; the entire base-to-head PR patch has the same SHA256 de9b4785be6e02eea4b60c987d028ef40f709a8f2b4e981b3761b19fe2816f4c. I nevertheless reran the 885-test suite, TypeScript checks, actual App base/head builds and independent entrypoint probes, and the 16-check native canary on this exact head. Prior packaged readonly/layout evidence is reused only because its entire production/build/dependency source is unchanged.

动机

按 App conversation/async inbox RFC 与 steward GQ10 的真实决策对象可读性要求，用户必须看得到自己被要求决定什么。旧 Lark 通知可用调度标题代替正文，App 卡片缩略后详情也没有保留完整请求；绿色测试或短标题并不能证明决策可读。这次完整交付 App 详情和既有 Lark 通知的正文、原因及证据显示，是父级交互旅程中可独立验收的增量，不冒充请求接受、执行及结果返回全部完成。

改动思路

权威输入仍是 canonical request/Todo，既有通知绑定、发送授权、冷却和重放逻辑继续拥有副作用。新增 TypeScript owner 只是只读内容投影，Python 负责先做 public-safe 截断与脱敏，再格式化既有传输消息；App 在既有 details mapper 和卡片补回正文。只修一端会留下另一端的同一缺口，新造 permission、gate 或持久化字段则没有必要。通知可用、RPC handler 可用或有摘要，都不能激活授权或证明正文存在。

具体改动

全量 12 文件、+175/-40：生产 6 文件 +60/-34，测试 4 文件 +97/-6，文档 2 文件 +18/-0。没有新的状态写入或跨用户授权。具体修复并非把标题加长，而是保留正文来源、身份和未取得正文时的诚实反馈。

关键代码讲解

1. projectDecisionNotice 从结构化 request items 投影非空正文，保留 id、reason 和 evidence；最多三个项目只是呈现上限，不是 admission 或执行义务。相同正文但不同 id 不再被文本去重吞掉；缺正文返回 unavailable，不猜造用户决定。
2. gate_message 先调用已有 public-safe formatter，再进入只读投影。正文 900 字符边界明确标识为 preview，原因与证据保持既有保护；缺正文不再显示可执行的回复提示。发送指纹、绑定状态和 retry owner 没有转移到新 helper。
3. attentionDetails 在原详情模型保留 canonical request text，身份、因果原因、证据与 successor 导航仍来自已有模型，避免把调度 label 当成第二份请求。
4. AttentionDetailCard 在缩略文本与正文不相同时显示完整段落；实际打包页面验证了移动端换行、只读和来源不全状态，没有新增接受/执行按钮或决策写入。

对主干的风险

最强反例是正文超出旧 label 上限后仍消失，或缺正文时把摘要当成可决定内容。独立同 fixture 对比实际 Lark 入口：base 有六项正文/身份/缺源反馈违例，head 为零；关闭绑定、关闭通知、关闭 authority、冷却和非人工 gate 五条路径的完整输出及无副作用行为与 base 一致。真实本地状态的重放序列保持 sent_verified、already_sent、sent_verified，正文修订后才产生新的通知。外部 Lark 传输是合成替身，不据此宣称真实远端发送已验收。

实际构建的 App 也用同一 fixture 做 base/head 对照：旧页面缺具体请求、独立断言失败；新页面正文可见、断言通过。仓库 packaged browser smoke 在桌面、移动端及只读三种组合通过，覆盖 offline、superseded、replacement 和已移除的选中项；没有决策写入，原有 chat 初始化行为在两边相同。新增正文不改变第一屏 hero 或主导航。

语义与 CI 对齐

本次没有查询或等待 GitHub CI。新 head 的 Lark 与 architecture pytest 885 passed，TypeScript 内容 owner 2 passed，control-plane typecheck、定向 Ruff、App build、component smoke、packaged browser 均通过。风险 canary 16/16 passed，五项直接检查无失败，无手工 hold。复用已有 request 身份、public-safe evidence 与只读 presentation 语义，没有提高预算，也没有把文字指引改成机器义务。呈现上限不裁决请求是否有效或用户是否已授权；正文缺失的 unavailable 行为已在 RFC/GQ10 披露。

我的整体评价

long_horizon 保持既有重放、修订和恢复 owner，没有增加同步事实或丢失长期请求；user_experience 在两个实际入口都改善了具体对象可读性，并保留不可行动和来源不足的状态。关闭功能的完整基线对照支持隔离，而不是只凭“没出现 feature 字段”。未来整理已采用最近的 TypeScript 只读 presentation owner，Python 不再新造决定规则；没有需要扩大到另一个框架的相关重构。完整父级 GQ10 行动 round-trip 仍归既有交互 owner，这个增量已可独立测试及回滚。当前 head 可以 APPROVE；仓库 runtime/App 合并仍由 maintainer 负责。

English verdict: APPROVE - bf2c38f. Fresh real-entrypoint and packaged-UI evidence validates the bounded, read-only decision-content improvement; it does not grant execution authority or certify the entire parent interaction journey.

[huangruiteng]

Frame alignment for exact head bf2c38ff3c4d804bc2346567c34455c099cba5a9: App conversation/async inbox RFC and steward GQ10 require a readable decision object and evidence. App/Lark previews now preserve canonical request content and disclose unavailable content. This is an independently verified presentation increment; preview content, identity and read-only transport do not accept a request, grant permission, settle a gate, or close the full parent action/result-return acceptance.