fix(lark): isolate realtime conversations on one Bot listener

[huangruiteng]

Goal And Delivered Outcome

• Outcome basis: the native realtime conversation journey in roadmap S1/S5/S10 and the steward/conversation-entry RFCs. This is the first transport repair, with a reusable two-App deployment handoff; full Bot replacement remains open.
• Gap and before → after: one blocked model answer held the single Lark consumer, delaying every role using that Bot. Independent conversations can now reach their existing Inbox, answer, verified reply and ACK while a slow conversation remains busy. Source follow-ups keep FIFO, including across Session rebinds; shared Session references also serialize transport handlers.
• Intended base: main at 5d790b49dd723c1f366d69ac7c8ce35beafb155d. No issue is closed.

Author Declaration

• Written by: model_agent — OpenAI GPT-6 / Codex.
• Specification and revision: this PR's docs/architecture/rfcs/capable-manager-semantic-handoff-v0.md §10, app-conversation-and-async-inbox-v0.md “Realtime Bot entry and recipient purpose”, and loopx-overall-roadmap-v0.md S5/S10 at 56747e3e42fe61591af4404a6950b31d59a902d6.

Criterion	Disposition	Symbol / path	Test or command
Independent conversations on one consumer; ordered source/shared Session processing	implemented	Lark ProfileEventDispatch, native profile stream	test_lark_realtime_dispatch.py, test_lark_topic_dispatch_bounds.py
Bounded backpressure; stop/drain retain consumer ownership and never ACK unpersisted waiting input	implemented	Existing stream/service lease and Inbox owners	Native stop, reader failure, capacity and handler failure counterexamples
Existing private configuration survives concurrent publication and failed replacement	implemented	Shared write_private_json_atomic	test_lark_topic_inbox_config.py
Plain project/DM entry, explicit role selection, busy-session feedback, progress/media/permission parity and installed switch	deferred	Existing shared conversation/host owners under S5/M1/M3	Explicit successor requirements and readiness guide; no live parity claim

• Self-check: reviewed routing, consumer lease, Core Session admission and provider persistence; generalized fixtures and docs, with no imported bridge credentials or sessions.

Scope And Continuation

The public owner-controlled-bots.md guide supplies a readiness matrix, separate assistant/steward identities and grants, fresh setup and minimum-permission review, a shared-Core implementation continuation, and installed acceptance. It contains no operator-specific migration data.

Already-enabled listeners use up to four transport handlers and a dispatch capacity of 64 messages including active handlers. Inactive profiles allocate neither consumer nor dispatcher. Core still owns model admission, execution, budgets, permissions and durable receipts; the provider's transient buffer grants none of those. This helper remains Python inside the bundled Lark transport, with no parallel domain authority.

The roadmap and bilingual RFCs distinguish a realtime Bot entry from its recipients: ordinary project chat, a selected existing Agent and the explicit persistent steward share mechanics, not objectives or audience grants. The next owner is the shared conversation entry under the existing App-conversation RFC, followed by per-host progress/media/operation qualification. Same-conversation handlers still wait for the current terminal answer; the dispatcher does not yet deliver immediate busy-session steering. This boundary is independently testable and reversible without changing the durable Session/Turn schema or retiring a bridge.

Validation

• Tested revision: 56747e3e42fe61591af4404a6950b31d59a902d6 (identical tested candidate tree).
• Run state: finished.
• Input classes: synthetic, public_fixture.

Check kind	Result	Evidence / limitation
unit / integration	passed	268 checks across Lark runtime/connections/direct-group/reply/recovery and Core queue/steering/event-buffer families, including 14 new dispatcher/configuration cases. Corrected an existing stale plain-text context assertion to check the structured source id/content and retain its non-authority checks.
real_entrypoint	passed	Production native stream → exact routing → real filesystem Inbox → reply readback → ACK, with provider/model doubles; source stop and reader failure preserve active ownership and exclude waiting messages. Not live Lark or model qualification.
regression_parity	passed	Verified the unmodified fd65e71f4 runtime fails both slow-role counterexamples (single and batch provider records); candidate passes. Concurrent configuration publication/failure cases also fail before the atomic-writer repair.
static	passed	Ruff; diff whitespace; semantic advisory and full semantic-vocabulary-drift-smoke.py; quality catalog reference audit.
manual / static	passed	Explicit public boundary scan of 15 candidate files: no errors/warnings; manual locator/literal-secret review and 339 relative links verified.
real_backend	not_run	Installed live Bot/host, ordinary DM/plain project chat, mobile progress/media and host permission callbacks remain unqualified.

CI note: the preceding head 3ddabeb4c464b27cb8856c63e3d525e77d1fa428 had a Dashboard browser visibility timeout at typed-actions.mjs:1633 (job). This PR changes no Dashboard implementation. The final head includes the then-current main; its Dashboard acceptance has now passed, while the remaining full CI checks are still running. Local transport checks did not waive that acceptance or establish the cause of the preceding timeout.

Frontend / Visual Evidence

UI impact: none. No dashboard layout, documentation chrome or first-screen change; existing listener health and replies retain their projections. Source data: synthetic/public fixtures.

Type of Change / LoopX Area

Bug fix, documentation update and test update; capability/extension and host integration. Technical direction: operator surface and IM integration, roadmap S1/S5/S10.

Shared-authority RFC fixture impact: N/A; no Goal authority provider promotion, writer cutover or compatibility projection change.

Boundary Checklist

• Diff and PR metadata contain no private state, credentials, raw traces, internal links or local machine paths.
• No duplicated benchmark work.
• Scoped native transport repair with explicit existing successor.
• UI impact is none.
• Every commit has a DCO sign-off.