fix(context): retain required facts without replaying supporting material

docs/architecture/rfcs/controller-executor-unified-contract-v0.md

@@ -449,6 +449,28 @@ counter folding in [#7587](https://github.com/loopx-project/loopx/pull/7587) is
 separate compatible slice, not this replacement. Each slice can have its own PR
 and rollback; no generic retrieval framework or two-session rollout is required.
 
+The native quota caller now implements a bounded acceptance-material slice:
+known cumulative objectives, complete requirement descriptions and current review
+states remain in its required view; source history and review notes/evidence are
+addressable in the original immutable capture. Its read obligation, full/delta
+baseline and recovery move together. Selected detail reads never fulfill hidden
+required content or establish a full baseline. Unknown semantics and signed
+envelopes remain whole; the disabled path is unchanged. The original capture's
+values survive the typed path plan without a JavaScript numeric round trip.
+If the required view plus its detail index is not smaller in serialized UTF-8
+bytes, retain full delivery and its original obligations. Default detail examples
+select source, note or evidence fields rather than replaying the whole outcome.
+
+Native exec and code-mode fixtures also qualify two compactions within one work
+Turn: a sufficient working brief continues with the original work/settlement
+identity without replaying its packet or re-entering admission. The baseline is
+still invalidated; unfinished initial reads and missing necessary facts require
+same-capture recovery, while a new work Turn obtains its fresh guard. This is
+native protocol qualification with deterministic inference, not evidence of
+model compliance or live outcome/cost benefit. C1/C2 remains incomplete:
+candidate, preference and Explore staging, signed-envelope migration and matched
+accepted outcomes with complete costs still need their own qualification.
+
 ## 6. Alternatives and design choices
 
 | Alternative | Disposition |

docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md

@@ -343,6 +343,21 @@ work-context/读取履行、capture/detail 与 delta owner，不新增候选存
 [#7587](https://github.com/loopx-project/loopx/pull/7587) 的诊断计数折叠是独立兼容
 切片，不代表本次替换。每个切片可有独立 PR 与回退，不要求通用检索框架或启用双会话。
 
+原生 quota caller 现已实现有界的验收材料切片：已知的累计目标、完整验收要求描述和
+当前评审状态保留在必读视图；来源历史与评审说明/证据可以从原始不可变 capture 按需
+读取。读取义务、全量/差分基线与恢复共同切换。选读详情不能履行隐藏的必读内容，
+也不能建立完整基线。未知语义和签名 envelope 保持完整，关闭路径不变。Typed 路径
+计划不让原始 capture 数值经过 JavaScript 往返转换。
+若必读视图加详情索引的 UTF-8 序列化字节数并未减少，则保留全量交付和原始义务。
+默认详情示例选择来源、说明或证据字段，避免重放整个 outcome。
+
+原生 exec 与 code-mode fixture 还验证了同一工作 Turn 内连续两次压缩：充分的工作
+摘要可以保留原始工作/结算身份继续推进，无须重放 packet 或重新准入。基线仍失效；
+尚未完成的初次读取和缺失的必要事实仍需从同一 capture 恢复，新工作 Turn 则取得
+新的 guard。这是确定性 inference 下的原生协议资格，不是模型遵循性或真实成果/
+成本收益的证据。C1/C2 仍未完成：候选、偏好、Explore 分阶段交付、签名 envelope
+迁移，以及可比验收成果和完整成本仍须分别验证。
+
 ## 6. 备选方案与取舍
 
 | 备选方案 | 结论 |

docs/development/testing-and-quality.md

@@ -1535,6 +1535,26 @@ failure; the installed-profile smoke and semantic assertions qualify the repair.
    or promotion thresholds stay fixed for that result; revised thresholds belong
    to a new qualification, never a relabeled historical pass.
 
+Native progressive-context qualification found an existing default-output
+budget failure: immutable base `fb331f45c` and candidate `edbd56b14` both emit
+25,836 JSON characters for `quota_should_run/multi_agent` with the unchanged
+18-Todo, 3-Agent, 12-run fixture. Recursive comparison differs only in observation
+timestamps and the rollout event id. This is neither an incremental native-off
+regression nor evidence of a saving. Preserve the previous 25,500-ceiling failure;
+calibrate this one regression allowance to 26,500 (664 characters of headroom)
+without dropping fields. Markdown, line, semantic, bootstrap duplication,
+per-Todo/fixed growth and all other surface ceilings remain unchanged. This
+changes no host hard limit, authorized execution quota or frozen experiment
+criterion. Native-on material and recovery savings need separate qualification.
+
+原生渐进上下文资格检查发现已有默认输出超限：不可变 base `fb331f45c` 与 candidate
+`edbd56b14` 在相同 18 个 Todo、3 个 Agent、12 条运行记录夹具上，
+`quota_should_run/multi_agent` 都为 25,836 JSON 字符；递归对比只有观察时间和
+rollout event id 不同。这不是 native-off 新增回归，也不是节省证据。保留旧 25,500
+阈值失败，只将这一回归预算校准为 26,500，留 664 字符余量，不删除字段。Markdown、
+行数、语义、bootstrap 重复、每 Todo/固定增长及其他 surface 阈值不变；宿主硬限制、
+授权执行配额和冻结实验标准均不变。Native-on 材料和恢复收益须单独验证。
+
 The initial-delivery guidance change measured the same 96-row fixture at
 `f6cf9583794eb8c4cca41fa832a1c2f150059583` and
 `da01f996c820aad3bae85268963e64c6bbb19d7c`. The complete instruction adds

docs/reference/required-work-context.md

@@ -77,9 +77,56 @@ Marked sources retain their generated-region lineage and canonical Todo authorit
 Native delta delivery and source fulfillment share the same integrity predicate.
 Only exact verified Goal text can be inherited from the retained baseline;
 current source witnesses and unknown fields remain literal. Cold delivery and
-context-loss recovery retain the complete original text, including arbitrary
-sections, comments and final stops. This does not establish model retention,
-execution authority, token savings or accepted outcome gains.
+full-capture recovery retain the complete original text, including arbitrary
+sections, comments and final stops.
+
+Enabled native quota delivery separates known acceptance requirements from their
+supporting material before full/delta presentation. The TypeScript acceptance
+projection keeps every scoped outcome objective, requirement description,
+review conclusion, current-basis flag, independent-verification flag, work link
+and source revision inline. Outcome source history and Agent review notes/evidence
+references remain in the immutable original capture. Each projected outcome has
+a `supporting_material_pointer`; `context_details` supplies the original path,
+SHA-256 and `quota context-read --select` command. Read needed evidence before a
+decision, verification or review that depends on it; repeated selectors batch
+related source, note and evidence fields without replaying the outcome's inline
+requirements. An unmet or stale review stays visible before its explanation
+is opened. Agent review still does not establish independent acceptance.
+
+The archive remains `projection.json`; the required model view is
+`required-context.json`. Required reads, full/delta preparation and recovery use
+that same model view. A selected detail page cannot acknowledge the required
+view, establish a full baseline or prove that other hidden details were read.
+The adapter edits paths selected by the typed owner without round-tripping the
+original JSON values through JavaScript. Unknown outcome fields, unknown source
+read obligations, unsupported schemas, signed envelopes and unavailable planning
+retain their original full content. Context delivery off remains unchanged.
+If the required view and its index are not smaller in serialized UTF-8 bytes,
+delivery retains the original full view and read obligations; small material
+does not need a more expensive detail round trip. This is a transport-size
+comparison, not a relevance heuristic or a model-token estimate.
+Historical captures retain their original obligations. This acceptance-material
+slice does not yet stage candidate selection, preferences or Explore history,
+and a smaller body alone does not establish lower total model cost.
+
+A context epoch is not a work Turn. Compaction or a failed native hook invalidates
+delta reuse; it does not require another admission or unconditional replay of the
+old quota packet. Within the existing Turn, continue from the working brief with
+the Goal, applicable requirements/stops, task and original capture/settlement
+identity. Before an action that depends on missing or uncertain facts, recover
+those facts from the same immutable capture. An unfinished initial required read
+still requires its missing content; summarizing it does not fulfill that read.
+Do not repeat completed work or settle the original Turn twice. If the original
+reference is lost, repair it before dependent work; independently authorized work
+can continue. A later work Turn obtains its own current guard and required
+context, without prefetching an older packet to manufacture a delta baseline.
+
+The native lifecycle still invalidates the previous baseline. A working brief
+is sufficient only for the work whose necessary facts it preserves; it is not
+input-byte coverage, a new baseline, renewed authority or proof of freshness or
+model retention. These separate boundaries prevent transport loss from becoming
+either a repeated full-input loop or permission to act on missing requirements.
+No token savings or accepted outcome gains follow from instruction delivery alone.
 
 Checkpoint Host preflight uses the hidden `--defer-context-presentation` option
 with an explicitly enabled native JSON `should-run` capture. It collects the

loopx/cli_commands/quota_capture.py

@@ -244,7 +244,8 @@ def project_saved_context_capture(args: argparse.Namespace) -> dict[str, Any]:
 
     Publication is delayed until this native tool runs, so the lifecycle owner
     can select its current continuity basis. Optional codec failure returns the
-    original full read reference. An unsafe recovery selector fails explicitly
+    committed required-view reference when available, otherwise the original
+    full read reference. An unsafe recovery selector fails explicitly
     with that same reference, never a replacement guard.
     Invalid run-mode opt-ins fail before that optional transport path.
     """
@@ -278,6 +279,23 @@ def project_saved_context_capture(args: argparse.Namespace) -> dict[str, Any]:
 
         if not activation["enabled"]:
             raise ValueError("context delivery is off")
+        page_bytes, output_bytes = native_context_page_budget()
+        output_limit = getattr(args, "max_page_output_bytes", None)
+        if output_limit is not None:
+            if output_limit <= 0:
+                raise QuotaDecisionTransportError("Native context output limit must be positive.")
+            output_bytes = min(output_bytes, output_limit)
+            page_bytes = min(page_bytes, output_bytes)
+
+        def recovery_reference(value: dict[str, Any]) -> dict[str, str]:
+            # Preserve the caller's read budget on success and failure without
+            # duplicating instructions already carried by the outer view.
+            return {"path": value["path"], "sha256": value["sha256"],
+                "command": context_capture_read_command(Path(value["path"]), value["sha256"],
+                    page_bytes=page_bytes, max_page_output_bytes=output_bytes)}
+
+        full_reference = recovery_reference(full_reference)
+        reference = dict(full_reference)
         directory = codex_context_directory(directory=args.codex_context_dir,
             root=args.codex_context_root, create=True)
         if not directory:
@@ -303,6 +321,12 @@ def project_saved_context_capture(args: argparse.Namespace) -> dict[str, Any]:
             capture_id=hashlib.sha256(raw).hexdigest(),
             continuity_generation=getattr(args, "_context_delivery_generation", None))
         native_prepared = True
+        if projected.get("schema_version") == "context_delivery_v1":
+            # Native publication owns the complete required view. Keep its
+            # committed recovery even if optional wire/inline delivery fails;
+            # the input capture digest below remains the original identity.
+            full_reference = recovery_reference(projected["recovery"])
+            reference = dict(full_reference)
         native_view = native_context_capture_view(projected, cache, context_directory=directory,
             metadata={"recovery": full_reference, "capture_sha256": args.capture_sha256,
                 "context_delivery": activation},
@@ -324,7 +348,7 @@ def project_saved_context_capture(args: argparse.Namespace) -> dict[str, Any]:
                     "original captured decision and preserve its Turn receipt; do not rerun admission. "
                     "Authority and freshness are unchanged. " + CONTEXT_CAPTURE_READ_GUIDANCE}
         # Off is inert; after native preparation an optional wire write can fall
-        # back to the original reference without leaving an older selector live.
+        # back to the committed required view without leaving an older selector live.
     result: dict[str, Any] = {"ok": True, "mode": mode, **reference, **({"target": target} if target else {}),
         "recovery": full_reference,
         "capture_sha256": args.capture_sha256,

loopx/control_plane/quota/context_delivery.ts

@@ -520,10 +520,13 @@ export function prepareContextDelivery(request: JsonObject, legacyQuotaFields: r
       + (assumed ? "After reading this delta completely, use it with the retained model context. "
         + "Do not also fetch the full projection just to materialize JSON or replace missing Code Mode variables; "
         + "tool-process memory is separate from retained model context. If required baseline content is unavailable "
-        + "or continuity is uncertain, recover this capture in full before dependent work. " : "")
+        + "or continuity is uncertain, do not reconstruct from that baseline. Recover the necessary current facts "
+        + "from this capture before dependent work; completing an unfinished required read still needs its missing content. " : "")
       + "A value replaces its subtree; from copies the exact string, array or object at that path in the base capture, never in current changes. "
       + (hasOverlay(changes) ? "An optional edit then applies to that copied value, with all nested from paths still rooted in the immutable base. " : "")
-      + "Values assigns complete fields (exact indices with items); changed/items recurse, removed deletes object keys, length sets array length. Lost context triggers automatic full recovery from this capture, never an owner question."};
+      + "Values assigns complete fields (exact indices with items); changed/items recurse, removed deletes object keys, length sets array length. "
+      + "Within the same work Turn, compaction alone requires neither another guard nor replay of already-read context. "
+      + "Continue from the working brief and original work/settlement identity; missing facts use same-capture recovery."};
   if (bytes(delta) >= bytes(full("delta_not_smaller"))) return full("delta_not_smaller");
   if (!equal(applyTree(prior, changes), context)) return full("reconstruction_failed");
   // Native consumers page the wire before they can use its baseline. Deliver