[shenyankm]

Summary

Model timeouts could automatically repeat paid calls, and a lost creation response followed by a page reload discarded the request ID needed to recover the original task.

• Stop model transport failures, HTTP 408 and provider 5xx responses with MODEL_RESULT_UNKNOWN. Explicit resume reuses durable work and preserves unknown usage and consumed budget. Keep service-mode grading receipts unknown without replay.
• Persist unresolved import creation IDs, verified file references and frozen options before POST. After reload, an explicit original-submission retry uses the existing idempotent creation endpoint; reselecting the source also reuses that request. Storage errors block new task creation.
• Show uncertainty and potential charges beside recovery controls. Add a recovery panel and explicit local-record removal without changing service task state.

AI assistance: Codex implemented the fixes, reviewed the complete diff and ran the checks below with model substitutes. No live model or Tencent requests were made.

Linked issue

N/A — focused fixes for reproduced import-recovery bugs. No public API, shared contract, schema or dependency change.

Affected areas

AI service import/model handling and the shared service-mode grading caller; import Web client/UI; regression tests and recovery documentation. Developed on macOS with Python 3.14.7 and Node.js 22.23.2. The offline practice app is unchanged.

Validation

Check or manual flow	Platform / environment	Result and evidence
make verify AI_PYTHON=/Users/sheny/.local/share/uv/python/cpython-3.14-macos-aarch64-none/bin/python3.14	macOS; disposable PostgreSQL/RabbitMQ; fake models	Passed — lockfile consistency, Ruff, Pyright, 30 evaluation fixtures, all 3,102 tests, 94% coverage, recovery/stop probes and source/wheel package integrity checks
Focused unknown-provider and grading-receipt regressions	macOS; fake models	Passed — 5 cases covering timeout/408/5xx and non-replayed grading receipts
make web-check web-build AI_PYTHON=...	macOS; synthetic HTTP	Passed — types, lint, coverage (225 tests in the final unit run), all 56 Chromium cases and static build
npm --prefix web test -- src/api.test.ts; TypeScript and lint after the final added security regression	macOS; synthetic HTTP	Passed — 97 client cases, including exclusion of unexpected upload-response fields from persisted metadata
PRACTIQ_WEB_BUILT=1 npm --prefix web run test:browser -- --grep 'recovers an accepted import|shows unknown model outcome'	Chromium; final production assets; synthetic HTTP	Passed — 2 recovery flows, token cleared on reload, unchanged request/options, one task start, visible uncertainty/cost warning; screenshots inspected locally
git diff --check and full diff review	macOS	Passed; no credentials, personal data or generated build output included
Live provider accuracy/charging evaluation	Real providers	Not run — no paid requests; substitutes establish recovery behavior, not provider billing or extraction quality
Native app / Docker image	Local	Native app checks not run locally (no practice-app behavior changes); App CI covers the shared evaluation helper. Image build not run locally
Hosted CI/reviews	GitHub	Pending after PR creation; not a local validation claim

Initial Service failures were retained locally: three obsolete timeout-retry expectations and the evaluation blocking classification were corrected; the final full run passed 3,102/3,102. Initial browser attempts are retained locally: one development run failed during connection; the final clean standard run passed 56/56. A full built-assets attempt passed 54/56 because two existing lazy-load fault injections target /src/ResultReview.tsx; those cases passed in their standard development mode. The new recovery flows separately passed against built assets.

Risk and rollout

• Data, contracts, and backup compatibility: No database, bank, backup or API schema changes. Task state/checkpoints remain on the service. Existing execution-signature checks still apply: retain the original compatible deployment for historical unfinished checkpoints or explicitly parse again; no checkpoint migration is introduced.
• Configuration, dependencies, and security: No configuration or dependency additions. Tokens remain memory-only. Origin-scoped browser storage contains only up to 50 unresolved creation payloads (file metadata/reference and options), never source bytes or credentials. Invalid records are retained and storage failures stop new task submission.
• Main risk and rollout or recovery steps: Ambiguous model failures now wait for explicit recovery instead of retrying automatically. Inspect provider records first; explicit resume/retry can incur another charge. Clearing browser recovery hints does not cancel service tasks and permits a later new submission; the UI explains that risk. Changing origin or clearing browser storage loses local hints, while backend history remains authoritative. Drain existing runs and retain the previous deployment for signature-compatible recovery.

Checklist

• I reviewed the full diff and kept it focused, including any required generated files and documentation.
• I recorded relevant validation results and explained remaining gaps.
• I checked code, fixtures, logs, and attachments for secrets and personal data.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-28T13:18:01.844292Z	341ab74	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-28T13:20:56.212294Z	341ab74	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.