fix(lark): isolate recovery drafts and restore verified failure notices

docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md

@@ -1324,6 +1324,17 @@ original-source result. A restart resumes the deterministic reservation rather
 than dispatching it twice. Existing provider replies accompany recovery as data
 so completed work can be retained without repeating its effects.
 
+Continuation admission, progress, cursor and final delivery use a version-scoped
+presentation journal. They never reopen the acknowledged original Inbox source
+or edit its failure notice as a new draft. The final replaces only the new draft.
+For already-returned legacy continuations that reused the old notice, the same
+worker may restore that notice and retire subsequent stale drafts using their
+exact confirmed edit proofs. This is edit-only presentation repair: current
+source/grant, canonical Turn and unchanged prior-or-desired provider body must
+verify. Changed bodies, uncertain effects and edit-limit rejections stay pending;
+repair neither enqueues work nor appends another result. Acceptance independently
+checks actual provider bodies, including rollover and lost acknowledgements.
+
 Qualification covers the actual background scanner, source/grant counterexamples,
 native inventory reads and crashes before admission, after enqueue and before
 transport synchronization. Synthetic model/provider journeys and read-only native

docs/architecture/rfcs/app-conversation-and-async-inbox-v0.zh-CN.md

@@ -840,6 +840,14 @@ Turn，确认完整条目清单仅包含原用户输入后，Core 才能为本
 确定性预留，不重复派发。已有 provider 回复作为数据随恢复提供，供保留已完成工作、
 避免重复效果。
 
+续办的接收提示、进展、游标与最终回传按版本独立记账，不重新打开原 Inbox 已确认的
+消息，也不把原失败通知改成新草稿；最终结果只替换本次新草稿。对于已经回传、但旧版
+误用原失败通知的续办，原 worker 可凭确切已确认的编辑凭证恢复旧通知，并结束随后
+残留的旧草稿。这仅是消息编辑修复：必须核验当前来源与 grant、原生规范 Turn，以及
+provider 当前正文等于已知前文或目标正文。正文改变、效果不明与编辑次数耗尽继续
+保留待办；不重新排队执行，也不另发结果。验收独立检查 provider 实际正文，覆盖草稿
+续段与回执丢失。
+
 资格验证覆盖真实后台扫描器、来源与授权反例、原生条目读取，以及受理前、排队后、
 传输同步前的中断。合成模型/provider 通路及只读原生观察不证明真实模型完成，
 也不代表更广泛的会话 SLA 已通过。

loopx/extensions/lark/inbox_reply.py

@@ -991,6 +991,7 @@ def update_lark_inbox_reply(
     before_send: Callable[[str], Any],
     delivery_attempt_recorder: Callable[[Any], None],
     finalize_reactions: bool = False,
+    require_previous_text_match: bool = False,
 ) -> dict[str, Any]:
     """Replace one known Bot reply, verifying source and exact provider readback.
 
@@ -1052,6 +1053,8 @@ def update_lark_inbox_reply(
                        "intent_digest": _intent_digest(profile, chat_id, receipt)}
     edit_limit_reached = False
     if not lark_markdown_readback_matches(text=text, message=message):
+        if require_previous_text_match and not lark_markdown_readback_matches(text=previous_text, message=message):
+            return {"ok": False, "reply_verified": False, "blocker": "provider_delivery_mismatch"}
         edit_args = [*base, "im", "+messages-edit", "--message-id", ref,
                      "--msg-type", "post", "--content", content, "--as", "bot", "--format", "json"]
         preview = _call(runner, [*edit_args, "--dry-run"])