[loopx-agent]

Compaction currently invalidates the delta baseline and tells the Agent to replay the complete captured packet. For an ongoing work Turn with a sufficient working brief, that adds another full input without a new decision. Native quota input also repeats supporting acceptance history and review evidence alongside the requirements on every cold read.

Native quota delivery now keeps complete cumulative objectives, requirement descriptions, current review/check states and work identity in a required view. Supporting source history and review notes/evidence stay in the immutable original capture, reachable through the digest-bound selector from #7597. The same required view drives native full/delta delivery, hooks and saved context-project recovery, including wire/inline failure paths. Recovery commands retain the caller's explicit output budget. Selected detail pages cannot establish a full baseline. Unknown semantics, signed envelopes and context delivery off retain their original behavior. When the required view plus its index would be no smaller than the original UTF-8 serialization, small material stays in the original full view with its original obligations. Detail examples select exact source, note or evidence fields rather than repeating outcome requirements.

Same-Turn guidance permits continuation from a sufficient working brief and the original work/settlement identity. Missing necessary facts and unfinished initial reads still require same-capture recovery; compaction still invalidates delta reuse, and new work Turns still need their current guard. Canonical authority, spend and settlement rules are unchanged. The TypeScript owner chooses paths; Python publishes original JSON values and capture references.

Validation:

• Final progressive/saved-project/context-delivery CLI suite: 113 passed, 5 optional native scenarios skipped. Coverage includes real quota CLI and File/SQLite acceptance readback, unchanged canonical state, unknown-shape fallback, large integers, selected-detail isolation, small-material cost fallback and saved-view native coverage. Six saved-project recovery cases cover default/4,000-byte limits across success, wire failure and inline-read failure; each complete recovery is assembled from pages that respect the requested output ceiling.
• Earlier lifecycle/resume/selection suites: 220 passed; adjacent integration: 99 passed, 24 optional native cases skipped in that ordinary run. Separate deterministic native qualification passed 2 sufficient-working-brief cases through two compactions without repeated admission/settlement, plus all 20 missing-facts/hook-failure cases across exec, App Server, code-mode and benchmark hosts.
• 35 TypeScript tests, control-plane typecheck, Ruff, bilingual RFC check and public-boundary scan passed.
• Final risk-selected premerge on 4e78ab11b passes all 6 direct and 19 selected checks, with zero failures or manual holds. Packaged Linux native CLI readback also passes with the explicit 4,000-byte output budget: outer recovery matches the committed native required view, complete reads establish coverage, and exact source-detail reads preserve the original capture. These checks use isolated synthetic state without model invocation. Earlier 68845f3cb passed 6 direct + 19 selected checks and packaged default-budget recovery. Independent review exposed two additional saved-project counterexamples during refinement: recovery pointed to the original archive instead of the committed required view, then recovery metadata lost a caller's 4,000-byte ceiling. Both are covered by the final regressions above; earlier heads must not be used for deployment.

The initial premerge run passed 6 direct and 18/19 selected checks. The remaining default-output budget failure was independently reproduced on immutable base fb331f45c and the runtime candidate: both emitted 25,836 characters for the same 18-Todo, 3-Agent, 12-run fixture. The historical 25,500-ceiling failure is preserved in the development evidence. Main now independently carries the matched 26,500 calibration, so this PR retains its evidence note and no longer changes that budget code. The synthetic hook-output allowance also moves from 2,000 to 2,300 characters for the explicit Turn/baseline distinction (observed body 2,178). No fields, semantic/line/growth checks, host limits or experiment criteria change; these calibrations are not optimization benefits.

Scope: this is the acceptance-material and recovery slice of C1/C2, with the paired RFC checkpoint updated. Candidate selection, preferences, Explore history, signed-envelope migration and live matched outcome/complete-cost benefit remain unqualified. It does not claim installation or measured model-token savings. The branch is rebased onto main 89a8efb44, including #7595/#7597/#7579. The redundant reader cherry-pick and overlapping budget-code change were removed. All four product patches are unchanged by range-diff from independently approved 4e78ab11b; only the evidence-only calibration commit loses its now-duplicate code hunk. Final rebased head 6a916a7a4 also passes the standard gate (6 direct + 19 selected, zero failures/manual holds) and 52 progressive/saved-project tests (5 optional native skips). The rebuilt current-main frontend bundle is verified. The rebased snapshot also passes all three formal Linux package readbacks with the explicit 4,000-byte recovery budget; original capture identity and complete required coverage are preserved.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[loopx-agent]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

APPROVE — 精确 head 4e78ab11bd242a63dffba5f8ba24b743437292aa 未发现当前阻塞缺陷。两个先前独立反例都已在原条件下通过：saved recovery 的目标与 hook 一致，调用方显式4,000字节预算也完整保留。旧头的失败和普通预算通过证据分别保留，未把换预算后的成功冒充同条件修复。

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; reasoning_effort=max; declaration_source=runtime_reported.

动机

需要跨压缩继续当前工作、并从同一 capture 补读依据的原生 Codex Agent，以及发布和恢复其上下文的 Host adapter。

旧路径把完整要求与长来源历史一起交付，压缩后容易重放整包；本 head 将完整目标、要求和当前状态保留为必读视图，长来源及 review 依据按同一原始 capture 精确补读。

最终 head 联合交付完整必读要求、同一原始 capture 的精确详情与 required-view 恢复；普通及显式4,000字节输出预算均保留，原工作身份和 canonical acceptance 不变。

本 PR 不完成单一 C1 工作契约、按 Agent 选择全部上下文或 controller/executor 分离，不改变 canonical acceptance，也不授予准入、结算、安装或额外模型执行权限。

候选/偏好/Explore、完整 C1/C2、安装采用及匹配模型成果与完整成本收益仍未资格。

这里的目标是让同一项工作安全接续，减少重复发送不需要的依据，同时保留完整累计承诺。Agent已有来源、身份和授权时，应沿当前命令完成恢复；不需用户重新选择目录、重复准备信息或再确认。同源详情可按需读取，也不能把尚未读到的反证、未知或约束当作不存在。

改动思路

复用已有 TypeScript 上下文 owner 做路径计划，Python 保留原 JSON 值和文件发布；normal、required、detail 和 recovery 共同接入，而不建立另一份验收或授权状态。

交付原生 acceptance 材料与同 Turn 恢复的有界切片；保留所有 Agent 的完整要求，未知语义和签名契约回到 full；完整 C1/C2 与模型收益另行验收。

情况	当前交付与恢复	必须保留的边界
known大acceptance材料	完整目标/要求/current state必读；长来源、review note/evidence精确补读	原capture与其digest保留，其他Agent共享约束也保留
unknown、signed、没有净大小收益的小材料	原full视图	不猜未知语义，不把索引成本藏掉
cold/warm/compaction或可选wire/inline失败	同一committed required capture恢复	预算、原Turn、来源及完整coverage不变
足够working brief接续	可继续原工作	缺事实/未完成初读仍须恢复，不能获得新authority或重复spend

表格仅说明 4e78ab11bd242a63dffba5f8ba24b743437292aa 的源码行为，执行证据另列。最小合理实现是共享typed地址计划与原值IO；另一份验收状态、通用relevance engine或重写reader都没有必要。新局部adapter归并恢复引用形状，去掉重复instruction，复用已有命令构建与分页预算；不以删必要指引换取小输出。

验收依据为 docs/architecture/rfcs/controller-executor-unified-contract-v0.md，spec_ref：https://github.com/loopx-project/loopx/blob/898363635d4737f84b6a673a9a11265a121b6f57/docs/architecture/rfcs/controller-executor-unified-contract-v0.md，spec_revision：`898363635d4737f84b6a673a9a11265a121b6f57`。按原文 Lossless context delivery 检查full/delta/recovery与缺页、compaction、完整读回成本及零重复准入/扣额；C2 的更广候选、Agent范围和完整切换仍deferred。第11节允许有实际caller的独立可回退切片，因此不把整项迁移作为本PR泛化前置。另按 docs/reference/required-work-context.md 同revision核显式预算必须贯穿初始帧、continuation与full-recovery命令。文档新增checkpoint本身不证明这些行为成立。

具体改动

完整18文件 +665/-38：9产品文件 +216/-25，4文档 +107/-3，5测试 +342/-10。已读全部净diff，并逐次核81cf→688→4e78修复；最终delta只有2文件，修改现有saved caller的局部恢复引用与对应测试。未扩大成新服务、状态库或授权owner。

关键代码讲解：

• progressiveContextPlan:15：typed owner仅选择已知结构的路径；完整目标、要求和当前状态保留，未知字段/签名对象不被隐藏。
• _capture_required_context:465：Python从原值生成required view，避免大整数经JS number舍入；视图连索引不更小时保留full。
• project_codex_context:521：required/full/delta/recovery共享既有native lifecycle与coverage；selected详情EOF不能建立完整baseline。
• project_saved_context_capture:242：本次两个反例的实际caller。局部recovery_reference仅保留path/hash/command，并在native准备前保留调用方预算；提交required capture后成功和可选失败使用同一引用，original capture_sha256仍是原source身份。
• _context_continuation_instructions:209：working brief足够时接续原工作；缺失事实或unfinished initial read仍回同capture，compaction只使delta基线失效。

最终独立执行：原先固定 4,000B 的9项探针 9通过；另一个专门预算断言 1通过。覆盖unknown/signed/small全量回退、2**100+17/1.0/-0.0/false/null类型、其他Agent尾部共享stop、精确详情、缺页/压缩/共享要求变化，以及原effect、零新admission/spend。完整advertised recovery现在既与hook同SHA，又能确立candidate。

同head完整progressive、saved-project与context-delivery CLI套件 113通过、5可选native跳过。其中default/4000 × success/wire/inline的6个实际CLI用例完整拼回required内容，每页含metadata与换行的JSON字节都不超过请求上限。最终标准premerge 6 direct+19 selected通过，0失败、0manual holds，含双语、风险与公开边界检查。

明确复用边界：81cf的 62 TS、200 Python、typecheck及 2个真实Codex exec/code-mode双压缩案例，相关typed、guidance、lifecycle消费者在后两次修复中源码未变；saved caller则已在最终head重跑。真实native案例使用隔离HOME与确定性loopback inference，44项deselected不能算通过或skip。它们不证明真实付费模型的理解/保留，也不替代安装资格。作者报告的容器安装验证不计入本次独立通过数。

对主干的风险

第一项历史缺陷在81cf：初始required视图3702B，外层recovery却指原18596B；完整读回原文仍不能填入hook的required coverage。688改正目标，但复制整份recovery instruction增加metadata，在相同显式4000B输入下失败，fallback命令又放大到64000B。两个不变量分别验证，不因修好前一个就跳过整个PR。

最终4e78在相同冻结输入下恢复成功：requested_limit=4000、recovery_limit=4000、hook SHA一致。原9项固定预算探针全部通过；688的9失败、普通64000B的9通过及独立budget失败均原样保留，不称旧失败从未发生。wire/inline分支同样保留精确required source与原budget，未重新准入、修改验收或产生新业务effect。代码改动与失败归因相符，不靠提高4000B测试预算解决问题。

整轮效率仍不能由首包推断。本次required3702B加实际所需detail17001B，共20703B，高于原18596B，尚未计framing、IO、RPC、模型与人工。因此小材料full回退有价值，按需材料可减少不展开时的输入，但“普遍节省”未证。官方96项普通raw/off同输入结构/语义/规模对照无变化；本次校准保留旧quota25836>25500失败，仅将该回归allowance改为26500、留664余量。hook body2178需2300替代2000，也不改变Host硬限制或科学阈值，更不能替代调用方4000B契约。未查询、轮询或等待CI。

我的整体评价

当前批准的是联合可用的required/detail/recovery与同工作Turn接续切片：保留完整要求、原始证据和唯一authority，原反例及失败恢复已有决定性源码证据。没有当前需发布的阻塞finding；对更广C1/C2、模型采用、完整成本和正式安装不作资格外推。当前无需新抽象或人为新增后继，既有owner继续较广验收即可。COMMENTED是同账号平台限制下的评审结论，不是GitHub正式自批准或合并授权。

视觉适用性：未改变渲染页面、布局或控件；已检查 quota/native/saved-project CLI、上下文 hook 及现有机器设置路径。

未验证范围：正式安装和真实模型理解/保留、完整 C1/C2 成果/净成本未验证；这次没有视觉变更。

English verdict: APPROVE. Both original saved-recovery counterexamples pass at 4e78ab11bd242a63dffba5f8ba24b743437292aa; complete C1/C2, installed/model adoption and net outcome/cost benefit remain unqualified.

[loopx-agent]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

APPROVE — 在新 base 上重新核验完整提案后，精确 head 6a916a7a4a30c16e69a898cf7820405b84ef7c38 未发现当前阻塞缺陷。两个先前独立反例都已在原条件下通过：saved recovery 的目标与 hook 一致，调用方显式4,000字节预算也完整保留。旧头的失败和普通预算通过证据分别保留，未把换预算后的成功冒充同条件修复。

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; reasoning_effort=max; declaration_source=runtime_reported.

动机

需要跨压缩继续当前工作、并从同一 capture 补读依据的原生 Codex Agent，以及发布和恢复其上下文的 Host adapter。

旧路径把完整要求与长来源历史一起交付，压缩后容易重放整包；本 head 将完整目标、要求和当前状态保留为必读视图，长来源及 review 依据按同一原始 capture 精确补读。

重基后的当前 head 联合交付完整必读要求、同一原始 capture 的精确详情与 required-view 恢复；普通及显式4,000字节预算保留，新增主干 request settlement 分支未改变原工作身份或 canonical acceptance。

本 PR 不完成单一 C1 工作契约、按 Agent 选择全部上下文或 controller/executor 分离，不改变 canonical acceptance，也不授予准入、结算、安装或额外模型执行权限。

候选/偏好/Explore、完整 C1/C2、安装采用及匹配模型成果与完整成本收益仍未资格。

这里的目标是让同一项工作安全接续，减少重复发送不需要的依据，同时保留完整累计承诺。Agent已有来源、身份和授权时，应沿当前命令完成恢复；不需用户重新选择目录、重复准备信息或再确认。同源详情可按需读取，也不能把尚未读到的反证、未知或约束当作不存在。

改动思路

复用已有 TypeScript 上下文 owner 做路径计划，Python 保留原 JSON 值和文件发布；normal、required、detail 和 recovery 共同接入，而不建立另一份验收或授权状态。

交付原生 acceptance 材料与同 Turn 恢复的有界切片；保留所有 Agent 的完整要求，未知语义和签名契约回到 full；完整 C1/C2 与模型收益另行验收。

情况	当前交付与恢复	必须保留的边界
known大acceptance材料	完整目标/要求/current state必读；长来源、review note/evidence精确补读	原capture与其digest保留，其他Agent共享约束也保留
unknown、signed、没有净大小收益的小材料	原full视图	不猜未知语义，不把索引成本藏掉
cold/warm/compaction或可选wire/inline失败	同一committed required capture恢复	预算、原Turn、来源及完整coverage不变
足够working brief接续	可继续原工作	缺事实/未完成初读仍须恢复，不能获得新authority或重复spend

表格仅说明 6a916a7a4a30c16e69a898cf7820405b84ef7c38 的源码行为，执行证据另列。最小合理实现是共享typed地址计划与原值IO；另一份验收状态、通用relevance engine或重写reader都没有必要。新局部adapter归并恢复引用形状，去掉重复instruction，复用已有命令构建与分页预算；不以删必要指引换取小输出。

验收依据为 docs/architecture/rfcs/controller-executor-unified-contract-v0.md，spec_ref：https://github.com/loopx-project/loopx/blob/89a8efb44fa768e144de7d588be7befb7cc4340d/docs/architecture/rfcs/controller-executor-unified-contract-v0.md，spec_revision：`89a8efb44fa768e144de7d588be7befb7cc4340d`。按原文 Lossless context delivery 检查full/delta/recovery与缺页、compaction、完整读回成本及零重复准入/扣额；C2 的更广候选、Agent范围和完整切换仍deferred。第11节允许有实际caller的独立可回退切片，因此不把整项迁移作为本PR泛化前置。另按 docs/reference/required-work-context.md 同revision核显式预算必须贯穿初始帧、continuation与full-recovery命令。文档新增checkpoint本身不证明这些行为成立。

具体改动

当前完整17文件 +660/-36：8产品文件 +211/-23，4文档 +107/-3，5测试 +342/-10。已从原问题重新判断整个净diff；独立range-diff确认4项产品patch严格相等，仅预算校准commit删除新main已有的重复代码hunk。逐文件blob比对只有turn_envelope.py/.ts因新main而改变，其完整上游delta已读。未扩大成新服务、状态库或授权owner。

关键代码讲解：

• progressiveContextPlan:15：typed owner仅选择已知结构的路径；完整目标、要求和当前状态保留，未知字段/签名对象不被隐藏。
• _capture_required_context:465：Python从原值生成required view，避免大整数经JS number舍入；视图连索引不更小时保留full。
• project_codex_context:521：required/full/delta/recovery共享既有native lifecycle与coverage；selected详情EOF不能建立完整baseline。
• project_saved_context_capture:242：本次两个反例的实际caller。局部recovery_reference仅保留path/hash/command，并在native准备前保留调用方预算；提交required capture后成功和可选失败使用同一引用，original capture_sha256仍是原source身份。
• _context_continuation_instructions:209：working brief足够时接续原工作；缺失事实或unfinished initial read仍回同capture，compaction只使delta基线失效。

最终独立执行：原先固定 4,000B 的9项探针 9通过；另一个专门预算断言 1通过。覆盖unknown/signed/small全量回退、2**100+17/1.0/-0.0/false/null类型、其他Agent尾部共享stop、精确详情、缺页/压缩/共享要求变化，以及原effect、零新admission/spend。完整advertised recovery现在既与hook同SHA，又能确立candidate。

同head完整progressive、saved-project与context-delivery CLI套件 113通过、5可选native跳过。其中default/4000 × success/wire/inline的6个实际CLI用例完整拼回required内容，每页含metadata与换行的JSON字节都不超过请求上限。最终标准premerge 6 direct+19 selected通过，0失败、0manual holds，含双语、风险与公开边界检查。

明确复用边界：81cf的 62 TS、200 Python、typecheck及 2个真实Codex exec/code-mode双压缩案例，相关typed、guidance、lifecycle消费者在后两次修复中源码未变；saved caller则已在最终head重跑。真实native案例使用隔离HOME与确定性loopback inference，44项deselected不能算通过或skip。它们不证明真实付费模型的理解/保留，也不替代安装资格。作者报告的容器安装验证不计入本次独立通过数。

本次重基没有继承旧批准：base为 89a8efb44fa768e144de7d588be7befb7cc4340d，包含已合入7579。原4e评审保留为历史；当前源代码、问题价值、owner、fallback、scope与成本重新核对。原accepted RFC和required-context指南在两base的blob完全一致，先读新base依据，再读完整range及实际改变的两个共享文件。新main新增scoped request settlement identity，仍要求签名、正确Goal/Agent/Turn与原effect，不能冒充Todo；本PR的typed projection不另建settlement规则。

当前组合独立重跑 313 Python通过、5可选native跳过（包含上述三模块113子集，不能再相加）、64 TS通过、typecheck通过、96/96新base/head对照无漂移、原4000B九项全部通过，以及新base标准 6 direct+19 selected通过、0 holds。同一九项oracle在新base为7通过/2预期失败，失败只针对尚未存在的required拆分与新continuation指引；完整原始恢复/unknown/signed/small控制仍过。它与旧688的真实预算回归是不同失败，均保留准确归因。

对主干的风险

第一项历史缺陷在81cf：初始required视图3702B，外层recovery却指原18596B；完整读回原文仍不能填入hook的required coverage。688改正目标，但复制整份recovery instruction增加metadata，在相同显式4000B输入下失败，fallback命令又放大到64000B。两个不变量分别验证，不因修好前一个就跳过整个PR。

当前6a916a7在相同冻结输入下恢复成功：requested_limit=4000、recovery_limit=4000、hook SHA一致。原9项固定预算探针全部通过；688的9失败、普通64000B的9通过及独立budget失败均原样保留，不称旧失败从未发生。wire/inline分支同样保留精确required source与原budget，未重新准入、修改验收或产生新业务effect。代码改动与失败归因相符，不靠提高4000B测试预算解决问题。

整轮效率仍不能由首包推断。本次required3702B加实际所需detail17001B，共20703B，高于原18596B，尚未计framing、IO、RPC、模型与人工。因此小材料full回退有价值，按需材料可减少不展开时的输入，但“普遍节省”未证。新base89a与当前6a的官方96项普通raw/off同输入对照全部一致；26500预算已归新main，本PR删除重复调整。历史quota25836>25500失败仍保留，664余量不称优化收益。hook body2178需2300替代2000，也不改变Host硬限制或科学阈值，更不能替代调用方4000B契约。未查询、轮询或等待CI。

我的整体评价

当前批准的是联合可用的required/detail/recovery与同工作Turn接续切片：保留完整要求、原始证据和唯一authority，原反例及失败恢复已有决定性源码证据。没有当前需发布的阻塞finding；对更广C1/C2、模型采用、完整成本和正式安装不作资格外推。当前无需新抽象或人为新增后继，既有owner继续较广验收即可。COMMENTED是同账号平台限制下的评审结论，不是GitHub正式自批准或合并授权。

视觉适用性：未改变渲染页面、布局或控件；已检查 quota/native/saved-project CLI、上下文 hook 及现有机器设置路径。

未验证范围：正式安装和真实模型理解/保留、完整 C1/C2 成果/净成本未验证；这次没有视觉变更。

English verdict: APPROVE. Rebased head independently requalified; both original saved-recovery counterexamples pass at 6a916a7a4a30c16e69a898cf7820405b84ef7c38; complete C1/C2, installed/model adoption and net outcome/cost benefit remain unqualified.