[loopx-agent]

Goal And Delivered Outcome

Heartbeat guidance currently starts with discovery even when the caller has already chosen its unfinished work. This can lead to an unbound guard/read followed by a second binding guard/read. The existing CLI already supports qualifying an explicit choice on the first current guard.

This change exposes that path in the shared heartbeat rule and saved-decision guidance: for a known new-Turn choice, append --todo-id <id> to the first guard; otherwise retain discovery and the returned selection command. The generator never silently chooses a Todo. Current admission, complete required reads, rejection/recovery, exact identities and settlement remain required.

• Basis: existing explicit-choice contract in docs/quota-allocation.md, revision 0d4bf99a4aa6080f2774f3c4477fb4adc1b5ac46, the initial-guard --todo-id paragraphs. Target: main.
• Observable result: the generated heartbeat command accepts a valid explicit choice in one current guard; stale/missing choices reject without delivery, admission receipt or spend.

Author Declaration

• Written by: model_agent, OpenAI GPT-6 family.
• Implemented against: the existing first-guard explicit-choice contract above and the same-Turn recovery contract in docs/heartbeat-automation-prompt.md at that revision.

Criterion	Disposition	Implementation	Evidence
Explicit choice may qualify on the first new-Turn guard	implemented	shared heartbeat rule and saved-decision renderer	generated-command tests over File and SQLite
Unknown choice still discovers candidates; generator does not bind work	implemented	conditional guidance, unchanged generated command	generated command has no automatic --todo-id
Compaction alone does not restart admission; current contract and exact settlement identity remain required	implemented	bilingual checklist, existing recovery/settlement clauses preserved	prompt support and scoped-choice regression suites

Self-check compared the unchanged clauses for current authority, complete reads, recovery, ordering, identities and ambiguous effects. The shared rule avoids duplicating a new policy in each renderer. No new state owner, protocol, CLI option or authority rule is introduced.

Scope And Continuation

Complete for this guidance defect. It does not change cold-package composition or prove that models follow the guidance, retain context, or spend fewer tokens. Progressive material delivery and complete-cost qualification continue independently; this fix does not require a new follow-up task.

Validation

• Tested revision: 1d5d2d0f63bbe8c2e135608f2a2e2785c74584a0.
• Input classes: synthetic, public_fixture.
• Run state: finished.

Check kind	Result	Evidence / limitation
integration	passed	70 scoped-choice and heartbeat-prompt tests on the rebased head; valid/missing choices, File/SQLite, existing retry/binding and prompt budgets
real_entrypoint / real_backend	passed	Wheel installed in an isolated environment: all four valid/missing × File/SQLite generated CLI journeys passed; parent and subprocess use site-packages; no live state
static	passed	Ruff, diff hygiene, public/private scan and bilingual RFC check; no paired RFC changed
regression_parity	passed	Existing prompt budgets pass without increases; generation does not silently select work, and rejected choices do not create a receipt or spend
integration	passed	Exact-head risk canary: 6 direct + 19 selected checks, zero failures or manual holds

Initial checks correctly rejected missing repository TypeScript dependencies and missing generated Chat assets; both were prepared using the existing build workflow before successful validation. No threshold or assertion was relaxed. The rebase only adds an unrelated upstream conversation-page change; the four-file patch is unchanged. No active installation or experiment upgrade is claimed here.

Frontend / Visual Evidence

UI impact: none. This corrects existing agent-facing heartbeat prose and the documented CLI journey; there is no new capability, setting or rendered page. Actual generated command success and rejection are exercised above. Screenshots are not applicable.

Type of Change / LoopX Area

• Bug fix
• Documentation update
• Test update
• Control plane
• Host or runtime integration

Shared-authority RFC fixture impact: N/A; no authority, provider routing or storage behavior changes.

Boundary Checklist

• Public-safe code, fixtures and body; no private operating context or raw traces.
• Scoped to the reproduced guidance defect; no benchmark task/scoring/runner change.
• No paired RFC changed; bilingual diff check passes.
• UI impact none.
• Commit includes DCO sign-off.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; reasoning_effort=max; declaration_source=runtime_reported.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

APPROVE — 完整评审当前 head 1d5d2d0，未发现阻塞问题。验证证明的是现有首次选择路径被正确说明，实际模型是否因此少走一轮仍未证明。

动机 / Motivation

已经选好下一项未完成工作、准备开始新 Turn 的 heartbeat Agent。旧提示只说明先发现再选择；即使已知 Todo，Agent 仍可能先取得未绑定上下文，再进行一次绑定读取。现有 CLI 本来就能在首次 guard 校验显式选择。

已知选择可在首次当前 guard 指定 Todo；未知选择继续发现并使用返回的 selection_command，生成器本身不选任务。本 PR 完成首次 guard 既有能力的指引修复；当前资格、完整读取、原 Turn 绑定、拒绝恢复和结算均由原 owner 执行。 提示是否改变实际模型选择，以及完整输入、费用和长期成果收益未验证。

改动思路 / Approach

共享 heartbeat 指引复用现有显式选择合同，saved-decision 文本引用同一片段；不新增 CLI、选择器、权限规则或同步状态。本 PR 完成首次 guard 既有能力的指引修复；当前资格、完整读取、原 Turn 绑定、拒绝恢复和结算均由原 owner 执行。

不改会保留真实可复现的提示缺口；增加新的选择器或让生成器猜 Todo 则超出了需求。当前方案把“调用者已经选好”的意图与“当前是否准入”分开：前者允许附加参数，后者仍必须由本轮 guard 读取权威状态后判断。未知工作继续使用当前返回的发现与 selection_command。优化的是已有路径的说明，没有让旧任务引用继承权限，也没有减少完整必读义务。

我还检查了 saved-decision 分支是否会误把已有 Turn 当作新 Turn。其原观测、detail 读取、transport flags、边界及结算文字都保留；新前缀明确限定 known new-Turn choice。原文档同步说明同一 Turn 的压缩不触发新准入。无需新增人工确认或重复绑定当前已准入工作。

具体改动 / Changes

全 PR 为四个文件 +61/-2、一个带 DCO 的提交：生产文字组合 +6/-2，双语指南 +13，既有 scoped-choice 测试 +42。没有新 CLI 参数、权限规则、持久状态或前端设置。

判断依据是修改前的 docs/quota-allocation.md 中初次 guard 显式 --todo-id 的合同，及同版本 heartbeat checklist。spec_revision 为 0d4bf99。以下标签映射原文中未编号的要求：

criterion_id	本 head 的处置
initial-guard-known-choice	implemented：现有 CLI 可在首次当前 guard 校验显式选择；新指引把这条路径直接说清。
fresh-qualification-and-binding	implemented：仍校验当前存在性、资格、scope 和回执绑定；生成命令不自动加入任何 Todo。
continuation-and-settlement	implemented：同一 Turn 的原身份、完整读取和当前顺序结算保留；缺失选择拒绝后按原返回路径恢复。

关键代码讲解

• HEARTBEAT_KNOWN_CHOICE_RULE 描述调用者明确选择后的参数用法，既不是 task selector，也不从旧记录猜意图。
• HOST_LOOP_QUOTA_DISPATCH_RULE 复用新前缀，并逐字保留当前 selection_command、实际工作验证、ordered settlement、精确 effect identity 和模糊 effects 读回规则。
• render_thin_heartbeat_task_body 的 saved-decision 分支消费同一片段；其余普通 renderer 通过共享 dispatch 规则收到提示。测试执行的是生成命令加上显式选择，经真实 File/SQLite 后端校验，返回工作来源不被当作“模型已经读完”的证明。

对主干的风险 / Risks

最强反例是“已知旧 Todo”被误当作本轮已获授权，或为了少读一次而重绑原 Turn。实际检查确认生成器从不自动选择，当前缺失选择拒绝且 admission receipt/spend 为零；原有拒绝恢复测试还覆盖真正 gate、独立工作、原 Turn 重放、实际产物校验和一次结算。新提示不会把这些机器规则降成建议。

独立验证	结果
四条固定 File/SQLite × 有效/缺失路径	base 已通过原 CLI 行为断言，再因提示缺失而 FAIL；head 四条全 PASS
选择、提示及真实 gate-scope 测试	70 + 6 PASS，含改绑拒绝、拒绝恢复和一次结算
14 组同条件 renderer 对照	仅声明的提示与两项字符计数变化，所有命令及其他字段一致；预算结果均保持通过
当前风险 premerge	6 direct + 19 selected PASS，零失败、零 manual hold
当前 head 新 wheel	四条有效/缺失路径 PASS；父进程和 4 次 CLI 子进程均来自 site-packages，关键生产文件与 git head 相同

常规提示增加 63 UTF-8 bytes，captured-thin 提示增加 59 bytes；未提高既有预算。初次 wheel 构建拒绝过期 Chat 资源，按现有 build:chat 工作流准备后重新构建与隔离验证通过。私有 renderer 探针对不存在目录或不支持的 Host 参数组合的拒绝也予以保留；最终对照只使用两版本都支持的固定输入，没有修改生产代码或断言。没有查询、轮询或等待 CI。

语义与 CI 对齐

这是明确披露的默认指引变化，没有声称 default-off：现有 heartbeat 入口会看到条件化提示，执行资格仍由当前 guard 决定。沿用既有 Todo/Turn/selection 词表，Python 只组合文字，没有第二个选择、权限或结算 owner。未知、过期和受限输入继续走现有拒绝与恢复规则。

我的整体评价 / Verdict

这个有界指引修复已闭合，long_horizon 和 user_experience 的局部改善是已知工作可以走既有最短合法路径，未知工作仍保持发现流程。14 组逐字比较与真实 CLI/后端证据支持其兼容边界；它不证明模型实际减少工具轮次、费用或人工注意力。共享片段足够解决本次问题，更大的上下文分阶段交付不应成为它的前置。

已检查 loopx/control_plane/heartbeat/rules.py 的生成指引与实际 CLI 路径；没有可视页面改动。
未宣称 UI 交付。提示是否改变实际模型选择，以及完整输入、费用和长期成果收益未验证。
提示是否改变实际模型选择，以及完整输入、费用和长期成果收益未验证。没有可视页面改动，截图不适用。批准仍与原生 merge-readiness 和维护者合并决定分开。

English verdict: APPROVE 1d5d2d0. First-guard explicit-choice guidance preserves current qualification, rejection and settlement; real File/SQLite and exact-wheel checks pass. Model adoption and complete-cost benefit remain unverified.

[loopx-agent]

Maintainer-authorized merge after the published exact-head review, focused source and isolated-wheel checks, risk-based premerge, bilingual validation, and an immediately preceding ready merge-readiness result. Admin bypass is limited to the configured no-CI-wait delivery policy; CI was not queried and is not represented as passed. Native-host adoption, total model cost and long-horizon benefit remain unqualified.