fix(context): honor explicit output limits on initial native frames

docs/product/releases/v2.2.0.md

@@ -36,6 +36,8 @@ loopx dashboard
 
 Canonical state, complete Todo reads and shared decision ownership stay with their typed owners. Read-only status follows the canonical source runtime; runtime aliases do not create a different authority. Goal creation can resume its original operation without erasing later writes. [#6874](https://github.com/loopx-project/loopx/pull/6874), [#7325](https://github.com/loopx-project/loopx/pull/7325), [#7462](https://github.com/loopx-project/loopx/pull/7462), [#7411](https://github.com/loopx-project/loopx/pull/7411), [#7298](https://github.com/loopx-project/loopx/pull/7298), [#7381](https://github.com/loopx-project/loopx/pull/7381), [#7496](https://github.com/loopx-project/loopx/pull/7496).
 
+An ordinary CLI self-claim now prepares execution atomically when the explicit actor matches the assignee and no explicit lease proof is supplied. Follow the returned progress/completion commands: progress can renew that still-active original execution, while expiry, replacement, foreign ownership and unavailable proof refuse without acquiring a new grant. Explicit lease calls, other assignments, soft-claim policy, read-only guards and App manual completion retain their existing authority. [#7510](https://github.com/loopx-project/loopx/pull/7510).
+
 Replan, outcome review, terminal refusal and original settlement retain their own identities. Required Host work does not grant ordinary delivery; no-write failures preserve their original source and journal. [#7484](https://github.com/loopx-project/loopx/pull/7484), [#7486](https://github.com/loopx-project/loopx/pull/7486), [#7452](https://github.com/loopx-project/loopx/pull/7452), [#7470](https://github.com/loopx-project/loopx/pull/7470).
 
 ## Capabilities & Workflows
@@ -74,7 +76,8 @@ Native differential context requires qualified host lifecycle delivery, not mere
 - [@JasonBuildAI](https://github.com/JasonBuildAI) — completed-Turn stop races, interrupted canonical creation, signed Windows updates, DSH launch guidance and Unicode/privacy repairs. [#7477](https://github.com/loopx-project/loopx/pull/7477), [#7381](https://github.com/loopx-project/loopx/pull/7381), [#6854](https://github.com/loopx-project/loopx/pull/6854), [#7473](https://github.com/loopx-project/loopx/pull/7473), [#7247](https://github.com/loopx-project/loopx/pull/7247), [#7251](https://github.com/loopx-project/loopx/pull/7251), [#7439](https://github.com/loopx-project/loopx/pull/7439).
 - [@Jiaqiiii523](https://github.com/Jiaqiiii523) — attached-conversation regressions and Lark upload acknowledgement. [#7293](https://github.com/loopx-project/loopx/pull/7293), [#7395](https://github.com/loopx-project/loopx/pull/7395).
 - [@Jim-jimu](https://github.com/Jim-jimu) — Pi input-driven pause and Explore input/zero-evidence semantics. [#7401](https://github.com/loopx-project/loopx/pull/7401), [#7303](https://github.com/loopx-project/loopx/pull/7303), [#7143](https://github.com/loopx-project/loopx/pull/7143), [#7239](https://github.com/loopx-project/loopx/pull/7239).
-- [@hhyykk](https://github.com/hhyykk) — shared TypeScript decision ownership, complete canonical reads, recovery, queued-session ownership and explicit source-content pins. [#7462](https://github.com/loopx-project/loopx/pull/7462), [#7325](https://github.com/loopx-project/loopx/pull/7325), [#7298](https://github.com/loopx-project/loopx/pull/7298), [#6874](https://github.com/loopx-project/loopx/pull/6874), [#6855](https://github.com/loopx-project/loopx/pull/6855), [#7321](https://github.com/loopx-project/loopx/pull/7321), [#7386](https://github.com/loopx-project/loopx/pull/7386), [#7136](https://github.com/loopx-project/loopx/pull/7136), [#7137](https://github.com/loopx-project/loopx/pull/7137), [#7131](https://github.com/loopx-project/loopx/pull/7131).
+- [@LIHUA919](https://github.com/LIHUA919) — packaged-browser fixture startup, rendering/focus and research-reading regressions. [#7508](https://github.com/loopx-project/loopx/pull/7508).
+- [@hhyykk](https://github.com/hhyykk) — shared TypeScript decision ownership, complete canonical reads, recovery, queued-session ownership and explicit source-content pins. [#7462](https://github.com/loopx-project/loopx/pull/7462), [#7325](https://github.com/loopx-project/loopx/pull/7325), [#7411](https://github.com/loopx-project/loopx/pull/7411), [#7298](https://github.com/loopx-project/loopx/pull/7298), [#6874](https://github.com/loopx-project/loopx/pull/6874), [#6855](https://github.com/loopx-project/loopx/pull/6855), [#7321](https://github.com/loopx-project/loopx/pull/7321), [#7386](https://github.com/loopx-project/loopx/pull/7386), [#7136](https://github.com/loopx-project/loopx/pull/7136), [#7137](https://github.com/loopx-project/loopx/pull/7137), [#7131](https://github.com/loopx-project/loopx/pull/7131).
 - [@mikamikasuki](https://github.com/mikamikasuki) — Lark timestamp precision and encoded local-path redaction. [#6084](https://github.com/loopx-project/loopx/pull/6084), [#5978](https://github.com/loopx-project/loopx/pull/5978).
 - [@songoow](https://github.com/songoow) — mobile task modality, managed observer ownership, report routing and offline analysis cancellation. [#7410](https://github.com/loopx-project/loopx/pull/7410), [#7354](https://github.com/loopx-project/loopx/pull/7354), [#7353](https://github.com/loopx-project/loopx/pull/7353), [#7352](https://github.com/loopx-project/loopx/pull/7352), [#7415](https://github.com/loopx-project/loopx/pull/7415).
 - [@steven-kid](https://github.com/steven-kid) — original evidence search and revision comparison, retained-work search and report downloads. [#7370](https://github.com/loopx-project/loopx/pull/7370), [#7129](https://github.com/loopx-project/loopx/pull/7129), [#7228](https://github.com/loopx-project/loopx/pull/7228), [#7041](https://github.com/loopx-project/loopx/pull/7041), [#7048](https://github.com/loopx-project/loopx/pull/7048), [#7297](https://github.com/loopx-project/loopx/pull/7297).
@@ -105,7 +108,7 @@ loopx benchmark trajectory-assessment-cancel --directory "$ANALYSIS_DIR" --forma
 ```
 ### Codex differential context
 
-**Activation:** Default off. In Settings → This machine → Capabilities → Differential context → Codex, switch on through the existing exact-revision transaction. Supported native Codex App heartbeat, SSH Goal and explicit benchmark heartbeat consumers also require their exact native hook/configuration setup for the next supported session. A saved preference alone does not initialize a loaded thread.
+**Activation:** Default off. In Settings → This machine → Capabilities → Differential context → Codex, switch on through the existing exact-revision transaction. Supported native Codex App heartbeat, SSH Goal and explicit benchmark heartbeat consumers also require their exact native hook/configuration setup for the next supported session. A saved preference alone does not initialize a loaded thread. For a smaller tool-output budget, add --max-page-output-bytes 7900 to the generated guard or context-project command; follow its bounded continuation and recovery commands, and keep aggregate batch output within the host limit.
 
 **Validation:** Read back the machine setting, render context-config for the actual Goal/Agent, then verify native lifecycle delivery and complete digest-bound pages. Setup and hooks/list discovery alone do not prove actual delta use or model retention.
 
@@ -319,6 +322,8 @@ For an existing installation, finish active work, run update check and plan, the
 
 完整 Todo 读取与共享决策复用 typed owner，status 沿 canonical source runtime 路由，原 Goal 创建可在中断后接续，不抹掉后续写入。replan、outcome review 与原结算保留身份；必须执行 Host 不等于普通交付授权。[#6874](https://github.com/loopx-project/loopx/pull/6874), [#7325](https://github.com/loopx-project/loopx/pull/7325), [#7462](https://github.com/loopx-project/loopx/pull/7462), [#7411](https://github.com/loopx-project/loopx/pull/7411), [#7298](https://github.com/loopx-project/loopx/pull/7298), [#7381](https://github.com/loopx-project/loopx/pull/7381), [#7496](https://github.com/loopx-project/loopx/pull/7496), [#7484](https://github.com/loopx-project/loopx/pull/7484), [#7486](https://github.com/loopx-project/loopx/pull/7486), [#7452](https://github.com/loopx-project/loopx/pull/7452), [#7470](https://github.com/loopx-project/loopx/pull/7470)。
 
+普通 CLI 在 actor 明确等于 assignee、且未提供显式 lease proof 的自 claim 中，原子准备 execution，并返回可直接使用的 progress／completion 命令。progress 只续原来仍有效的 execution；过期、被替代、其他 holder 或 proof 不可用时显式拒绝，不自动另取授权。显式 lease、其他指派、soft-claim、只读 guard 与 App 手工完成权保持原语义。[#7510](https://github.com/loopx-project/loopx/pull/7510)。
+
 ### 能力与工作流
 
 研究页先展示结果、报告与问题，再深入历史、数量与原引用；搜索和比较复用保存译文，导出原记录。新准备持久化忠实本地化指导，旧冻结方法、失败与用量保留。交付分析 producer 和打包 reader，科学校准另验。[#7051](https://github.com/loopx-project/loopx/pull/7051), [#7129](https://github.com/loopx-project/loopx/pull/7129), [#7370](https://github.com/loopx-project/loopx/pull/7370), [#7412](https://github.com/loopx-project/loopx/pull/7412), [#7423](https://github.com/loopx-project/loopx/pull/7423), [#7428](https://github.com/loopx-project/loopx/pull/7428), [#7444](https://github.com/loopx-project/loopx/pull/7444), [#7451](https://github.com/loopx-project/loopx/pull/7451)。
@@ -347,7 +352,8 @@ Python 3.11+、Node 22.22.3+（推荐 24 LTS）。沿原安装 owner 更新；
 - [@JasonBuildAI](https://github.com/JasonBuildAI) — 已完成 Turn 的停止竞态、canonical 创建恢复、Windows 签名更新、DSH 启动说明及 Unicode／隐私修复. [#7477](https://github.com/loopx-project/loopx/pull/7477), [#7381](https://github.com/loopx-project/loopx/pull/7381), [#6854](https://github.com/loopx-project/loopx/pull/6854), [#7473](https://github.com/loopx-project/loopx/pull/7473), [#7247](https://github.com/loopx-project/loopx/pull/7247), [#7251](https://github.com/loopx-project/loopx/pull/7251), [#7439](https://github.com/loopx-project/loopx/pull/7439).
 - [@Jiaqiiii523](https://github.com/Jiaqiiii523) — 原生绑定会话回归与飞书上传确认. [#7293](https://github.com/loopx-project/loopx/pull/7293), [#7395](https://github.com/loopx-project/loopx/pull/7395).
 - [@Jim-jimu](https://github.com/Jim-jimu) — Pi 输入暂停，以及 Explore 输入与零证据语义. [#7401](https://github.com/loopx-project/loopx/pull/7401), [#7303](https://github.com/loopx-project/loopx/pull/7303), [#7143](https://github.com/loopx-project/loopx/pull/7143), [#7239](https://github.com/loopx-project/loopx/pull/7239).
-- [@hhyykk](https://github.com/hhyykk) — 共享 TypeScript 决策归属、完整 canonical 读取、恢复、排队会话归属与显式来源内容固定. [#7462](https://github.com/loopx-project/loopx/pull/7462), [#7325](https://github.com/loopx-project/loopx/pull/7325), [#7298](https://github.com/loopx-project/loopx/pull/7298), [#6874](https://github.com/loopx-project/loopx/pull/6874), [#6855](https://github.com/loopx-project/loopx/pull/6855), [#7321](https://github.com/loopx-project/loopx/pull/7321), [#7386](https://github.com/loopx-project/loopx/pull/7386), [#7136](https://github.com/loopx-project/loopx/pull/7136), [#7137](https://github.com/loopx-project/loopx/pull/7137), [#7131](https://github.com/loopx-project/loopx/pull/7131).
+- [@LIHUA919](https://github.com/LIHUA919) — 打包浏览器 fixture 启动、渲染／焦点与研究阅读回归. [#7508](https://github.com/loopx-project/loopx/pull/7508).
+- [@hhyykk](https://github.com/hhyykk) — 共享 TypeScript 决策归属、完整 canonical 读取、恢复、排队会话归属与显式来源内容固定. [#7462](https://github.com/loopx-project/loopx/pull/7462), [#7325](https://github.com/loopx-project/loopx/pull/7325), [#7411](https://github.com/loopx-project/loopx/pull/7411), [#7298](https://github.com/loopx-project/loopx/pull/7298), [#6874](https://github.com/loopx-project/loopx/pull/6874), [#6855](https://github.com/loopx-project/loopx/pull/6855), [#7321](https://github.com/loopx-project/loopx/pull/7321), [#7386](https://github.com/loopx-project/loopx/pull/7386), [#7136](https://github.com/loopx-project/loopx/pull/7136), [#7137](https://github.com/loopx-project/loopx/pull/7137), [#7131](https://github.com/loopx-project/loopx/pull/7131).
 - [@mikamikasuki](https://github.com/mikamikasuki) — 飞书时间戳精度与编码本地路径脱敏. [#6084](https://github.com/loopx-project/loopx/pull/6084), [#5978](https://github.com/loopx-project/loopx/pull/5978).
 - [@songoow](https://github.com/songoow) — 移动任务交互、受管观察者归属、报告路由与离线分析取消. [#7410](https://github.com/loopx-project/loopx/pull/7410), [#7354](https://github.com/loopx-project/loopx/pull/7354), [#7353](https://github.com/loopx-project/loopx/pull/7353), [#7352](https://github.com/loopx-project/loopx/pull/7352), [#7415](https://github.com/loopx-project/loopx/pull/7415).
 - [@steven-kid](https://github.com/steven-kid) — 原始证据搜索与版本比较、历史工作搜索及报告下载. [#7370](https://github.com/loopx-project/loopx/pull/7370), [#7129](https://github.com/loopx-project/loopx/pull/7129), [#7228](https://github.com/loopx-project/loopx/pull/7228), [#7041](https://github.com/loopx-project/loopx/pull/7041), [#7048](https://github.com/loopx-project/loopx/pull/7048), [#7297](https://github.com/loopx-project/loopx/pull/7297).
@@ -376,7 +382,7 @@ loopx benchmark trajectory-assessment-cancel --directory "$ANALYSIS_DIR" --forma
 ```
 #### Codex differential context
 
-**启用：** 默认关闭。在「设置 → 本机 → 能力 → 差分上下文 → Codex」开启，沿原精确 revision 事务保存。受支持的 Codex App heartbeat、SSH Goal 与显式 benchmark heartbeat，还须为下一次受支持会话完成准确 hooks／配置。保存偏好不初始化已载入线程。
+**启用：** 默认关闭。在「设置 → 本机 → 能力 → 差分上下文 → Codex」开启，沿原精确 revision 事务保存。受支持的 Codex App heartbeat、SSH Goal 与显式 benchmark heartbeat，还须为下一次受支持会话完成准确 hooks／配置。保存偏好不初始化已载入线程。宿主输出预算较小时，可在已有 guard 或 context-project 命令追加 --max-page-output-bytes 7900；沿有界续页与原恢复命令读取，批量输出仍须满足宿主总预算。
 
 **验证：** 读回机器设置，针对实际 Goal／Agent 生成 context-config，并验证原生生命周期和完整 digest 绑定分页。设置成功或 hooks/list 可发现不等于实际差分使用、模型保留。
 

docs/reference/required-work-context.md

@@ -287,8 +287,12 @@ recovery without another admission. Inline and continuation pages use the same
 64000-byte output budget, including recovery, instructions, escaping, commands
 and newline. Content shrinks at UTF-8 boundaries to fit that complete stdout;
 captures that fit finish inline. This default does not depend on a shell output
-declaration. Explicit smaller reader budgets remain available to recover a
-truncated range of the same capture. Consume the inline
+declaration. An explicit `--max-page-output-bytes` also bounds the initial enabled
+`should-run` or `context-project` frame, its continuations and full-recovery
+command. For example, append `--max-page-output-bytes 7900` to the existing guard
+command for a smaller tool-output budget. This does not change host history
+limits; a batch must fit their aggregate budget too. Explicit smaller reader
+budgets remain available to recover a truncated range of the same capture. Consume the inline
 page before following next_command; when the retained-history limit is unknown,
 read one bounded output at a time. This is not a guarantee of model retention.
 Forward exec stdout directly in code mode. Repeating the packet in
@@ -626,7 +630,8 @@ arguments also defaults to 64000 content bytes under a 64000-byte output cap.
 Markdown retains its 4096-byte content default. Explicit page/output arguments
 retain their prior semantics; a page above 8192 bytes still requires a sufficient
 output cap, within the existing capture limit. The JSON-only
-`--max-page-output-bytes` shrinks content at UTF-8 boundaries and persists in
+`--max-page-output-bytes` also bounds the initial enabled native guard/projection
+frame; it shrinks content at UTF-8 boundaries and persists in
 `next_command`, including for explicitly smaller same-capture recovery. An
 insufficient cap returns an error without a zero-progress page; increase it for
 the same capture. Error messages are not subject to an impossible page limit.
@@ -659,7 +664,10 @@ input retention.
 请求 64000 字节正文；Markdown 保留 4096 字节正文默认值。显式分页/输出参数保留
 原有语义：超过 8192 字节的页仍须足够的输出上限，且不超过既有 capture 限制。
 JSON 专用参数 `--max-page-output-bytes` 按 UTF-8 边界缩减正文，并在 `next_command`
-中保留，显式更小的同捕获恢复也一样。上限不足时返回错误，不返回无进展分页；
+中保留，也约束开启原生投递的 `should-run`／`context-project` 首次输出及完整恢复命令。
+例如在已有 guard 命令后追加 `--max-page-output-bytes 7900`；省略时仍为 64000 字节。
+该上限不修改宿主历史容量，批量输出还须满足总预算。显式更小的同捕获恢复也一样。
+上限不足时返回错误，不返回无进展分页；
 增大上限后重读同一捕获。错误消息不受无法满足的分页上限限制。
 读取器不修改宿主或保留历史设置。历史 Codex 0.162.1 定向验证采用 10,000 token 历史
 设置和 12,000 token code-mode 输出预算，每次直接转发一份 stdout；该观察不证明

loopx/cli_commands/quota.py

@@ -451,7 +451,8 @@ def _emit_quota_result(
                     "command": context_capture_read_command(original, capture_id),
                 }
             payload = native_context_capture_view(payload, capture_directory, context_directory=directory,
-                metadata={"capture_sha256": capture_id, "recovery": recovery})
+                metadata={"capture_sha256": capture_id, "recovery": recovery},
+                max_page_output_bytes=getattr(args, "max_page_output_bytes", None))
         except (QuotaDecisionTransportError, OSError, ValueError) as exc:
             if not isinstance(exc, QuotaDecisionTransportError):
                 exc = QuotaDecisionTransportError(