[loopx-agent]

Goal And Delivered Outcome

quota should-run --record-host-poll returned a liveness receipt that was missing
from its saved original decision. Record the observation before immutable capture,
then reuse that same receipt in ordinary/envelope output and native recovery.
Evidence reads do not poll again. A post-guard publication failure reports the
already-recorded poll alongside the original Turn receipt.

This is an independently usable source-fidelity increment for #7430.
The complete C1 writer/consumer replacement, reader retirement and original-quota
outcome/full-cost comparison remain open under that existing proposal.

Author Declaration

• Written by: model_agent — OpenAI Codex, GPT-6 family.
• Implemented against: the C1 source/capture boundary in
  docs/architecture/rfcs/controller-executor-unified-contract-v0.md and native
  recovery in docs/heartbeat-automation-prompt.md, at base 2f544f969236.

Criterion	Disposition	Implementation / decisive evidence
Same observation in emitted and saved evidence	implemented	Existing quota emitter and poll writer; real File/SQLite CLI cases fail at the old missing-field boundary and pass through the installed wheel
Recovery does not repeat effects	implemented	Execute published capture/replan readers; counter and original bytes stay unchanged, no Host dispatch or quota spend
Default-off and damaged-source behavior	implemented	No receipt created with the flag off; unreadable receipt bytes and their diagnostic remain intact
Publication-failure readback	implemented	Inject failure only at atomic capture publication after real admission; error retains the recorded poll and original Turn identity
Unified C1 cutover and long-horizon benefit	deferred	Existing #7430 retains the remaining producers, consumers and qualification

Scope And Continuation

The existing liveness writer, immutable-capture owner and typed projection remain
the owners. The emitter no longer adds an observation only after saving the
source. Legacy envelope presentation copies the same receipt instead of writing
it again; the existing transport-failure formatter carries the same fact. No new
schema, option, capability, decision owner or persistent cache is introduced.

The intentional ordering change means a liveness count can advance even when
later capture/handoff fails. The response discloses this; a poll is not a task
completion, admission retry or quota settlement. Full-source hashes and their
hash-bound replan readers change together; the causal settlement identity stays
the same. Historical captures are not rewritten.

The saved receipt contributes 129–132 bytes in the twelve observed synthetic
captures. This is an exact serialization contribution, not an end-to-end latency,
model-cost or long-horizon benefit measurement. Rollback is this bounded emitter
change; supported historical readers remain available. Larger composition work
stays in #7430 rather than being bundled here.

Validation

• Tested revision: 01d4d27e41db6232f2ce49949a603e184fc51bfd, base 2f544f969236f5dbbe858720108c41d07be60a6c.
• Run state: finished; input classes: synthetic, public_fixture.
• Backends: disposable File authority and SQLite 3.53.4 via Node 24.21.0; no active Goal or installed App was modified.

Check kind	Result	Evidence / limitation
regression_parity	passed	Immutable-base product fails the missing-receipt cases; all six default-off cases pass. Historical harness declaration/private-directory failures remain recorded separately
real_entrypoint / real_backend	passed	tests/control_plane/test_worker_observation_recovery_cli.py: 20 new installed CLI cases, including original-evidence reads and post-guard publication failure
integration	passed	101 cases across test_quota_decision_capture.py, quota failure/stall tests and test_host_poll_receipts.py; the original worker cohort retained its 24 passes, with four corrected envelope cases passing separately
real_entrypoint	passed	Wheel's 1,898 product files match source and installation; 31 audited Python processes have no foreign LoopX imports, including 12 actual reader processes; four advertised OS cat reads also execute
static	passed	Changed-file and repository Ruff, configured mypy (17 targets), bilingual RFC check, docs governance, diff semantic advisory and six-path public/private scan
integration	failed	Standard premerge: six direct checks pass; 18 of 19 selected checks pass. The CLI output-budget check times out under the unchanged 120s limit in both runs (131.128s and 123.296s including timeout shutdown). The required quality hold remains
regression_parity	passed	The unmodified standalone CLI output-budget/base-head differential completes in 104.45s under its own existing script bounds. Its normal environment differs from premerge's fresh isolated home/cache, so this does not waive the native timeout
manual	not_run	Full Python collection, CI, Windows and native model/App adoption were not run or queried; this proposal does not assert merge readiness or full C1 qualification

The initial worker run had four overly strict assertions that an action hash
could not change. Existing replan readers include the full-source hash, so the
correct oracle preserves causal work/settlement identity while executing the
new hash-bound reader. Earlier failures remain recorded; no production guard,
budget or assertion of source integrity was weakened.

Merge qualification is held on that native timeout; the exact-scope quality
receipt records the failed required check. No timeout, budget or test was
relaxed. The timing difference has not been causally attributed to this change
or to cache isolation. The author implementation is complete and enters normal
review with that hold disclosed; this does not authorize merge or installation.

Visual Evidence

UI impact: none. Existing CLI/capture/recovery entrypoints are exercised; no
frontend capability or first viewport is changed.

Boundary Checklist

• Public-safe synthetic fixtures only; no private state, traces, credentials or local paths in the diff or this description.
• Scope stays within the reproduced capture defect and existing C1 prerequisite.
• Both RFC mirrors change together; no new benchmark job or experiment.
• DCO sign-off; merge and live installation remain separate actions.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[huangruiteng]

已在 a701cdac41c9e8226bbe124e90f5223e8e78a0a6 合入当前 main 0ad08b15dd7331051c93566075561a390a9cd7e2，通过普通 fast-forward push 更新本分支。冲突仅在中英文 RFC 的相邻新增段落；两侧的 poll 回执语义、原生 capture 去重和数值保真说明均保留。

当前 head 的 test_worker_observation_recovery_cli.py 与 test_quota_decision_capture.py 共 78 项通过，双语 diff 与 whitespace 检查通过。此更新解决 main 冲突；原先独立 premerge 的输出预算 timeout 仍是原版本的失败记录，不据此声称整个 PR 已获得合并资格。另一个集成候选正独立验证与按需加载等修复的组合。

[songoow]

Reviewer: model_agent — GPT-6 Astra Pro — OpenAI — self_reported

动机 / Motivation

自动执行器在查询是否继续工作时，会记录一次宿主存活轮询；恢复原决策的操作者需要看到同一次观测。

原来本次响应有轮询回执，保存供重启恢复的决策却没有它；恢复者无法从原始证据确认刚才的观测。本 PR 先记录该观测再保存决策，使普通、封套和原生恢复读到同一事实。

真实 File/SQLite CLI 验证了原始 capture 包含同一回执，执行公布的恢复读命令不会再轮询、调用 Host 或消费 quota。

本次只补齐现有 capture 的来源保真，不完成统一控制器协议切换，也不证明长期模型成本、任意外部效果 exactly-once 或安装后的真实模型采用。

统一 C1 的全部生产者/消费者替换、旧 reader 退出与完整结果/成本资格仍由既有 #7430 承接。

改动思路 / Approach

宿主轮询是可选观察，准入和结算是既有必需 owner；把观察先合入同一次决策再保存，符合原 capture 边界。损坏观察保持诊断，后续发布失败如实保留已发生的轮询，不把观察提升为新的工作义务。

当前边界是有真实恢复消费者的来源保真修复；普通、封套、原生三条路径一起携带同一回执。统一 C1 切换与长期效果继续由既有后续工作承担。

实际调用顺序是 should-run 形成决策，原 host poll writer 记录一次观测，原 capture owner 保存完整源，再由已有普通/封套/原生 presentation 交付。失败格式化器只回读已经发生的事实；恢复 reader 读取同一 capture，不调用轮询 writer。

已有 host poll writer、统一 capture owner 和恢复 reader 足以解决问题。补丁只调整 composition 顺序并转发同一对象，避免新增平行存储、第二次轮询或新的失败规则。

具体改动 / Changes

关键代码讲解

• _emit_quota_result：在既有 decision composition 中固定观测顺序。先写一次 host poll，再调用原 capture；封套输出从已保存的完整 payload 取同一回执，不再做第二次观测。
• quota_decision_transport_failure_payload：保留已经发生的事实。捕获发布失败后，原 heartbeat receipt 与已记录 host_poll_receipt 一起返回，仍拒绝继续把失败当成功。
• attach_host_poll_receipt：沿用现有可选 observer 的 IO 与失败边界。flag 关闭时不写；损坏回执返回 recorded=false 和原诊断，不将 liveness 当作交付或 quota 结算。

规范基准：docs/architecture/rfcs/controller-executor-unified-contract-v0.md；修订 0ad08b1。按改动前的 composition/capture 段落及 C1 source audit 判断；以下标签对应原文要求，不把完整 C1 的后续资格提升成本 PR 的前置义务。

Criterion	当前结论	对应实现或剩余边界
one immutable semantic observation	implemented	_emit_quota_result calls existing attach_host_poll_receipt before capture_decision
without another guard	implemented	Existing context-read/native published reader; no new effect owner
existing effect identity	implemented	Existing turn envelope and failure receipt owner retained
C1	deferred	#7430 unified producers/consumers, reader retirement and original-quota outcome/full-cost qualification

实际验证 / Validation

PASS：本轮在 exact head 实际执行 worker observation 与 quota decision capture 两模块，共 78 个独立案例。第一次直接使用 venv Python 时，4 个 native reader 因 PATH 没有 loopx 报 FileNotFoundError，74 个通过；以 uv run 提供该工作树安装的 CLI 后，原样重跑这4个全部通过。没有删除断言、修改恢复命令或放宽超时。20 个新增案例覆盖 File/SQLite、三种 wire、flag off、损坏 receipt，以及真实准入后原子 capture 发布失败。

PASS：将相同候选测试 oracle 指向不可变主干 0ad08b1 的真实产品，12 个启用/损坏观测案例在 source 缺 host_poll_receipt 处失败，6 个 flag-off 案例通过。候选对应路径全部通过；生成的原始恢复命令实际执行，poll_count、原 capture 字节、原 Turn identity 均受断言保护。这里测的是来源一致性，不是端到端性能。

对主干的风险 / Risks

最需要核验的是顺序变化：现在即使稍后 capture 发布失败，poll_count 也可能已经加一。这是有意且公开的行为，失败响应必须保留该事实；实测同时保留原 heartbeat Turn，不制造 capture 成功、Host 执行或新 quota 消费。语义源中新增事实会改变 source hash，不能错误要求所有哈希不变；原始结算身份仍保持。损坏 receipt bytes 不会在观察时被修写。

语义与 CI 对齐

沿用现有 host poll/capture/settlement 词汇和各自 owner；不是新的 worker 或一次且仅一次外部执行协议。成对 RFC 与 heartbeat 文档同步说明了当前增量，完整 C1 的剩余 producer/consumer 工作没有被测试数量掩盖。

当前 exact-head CI 快照有6个 Python shard 尚未结束，本轮不等待或轮询。作者旧版 01d4d27 的标准 premerge 输出预算超时仍保留为历史限制，本轮没有重跑或声称已修复；这与当前已验证的局部来源保真结论及最终合并门槛分别报告。

我的整体评价 / Verdict

APPROVE；未发现阻断性 finding。 审查绑定 exact head a701cda。

原始证据恢复和后续继续执行的边界得到保留：恢复读取不创建新 guard、不改变原 Turn 的结算身份，也不重复轮询。长期收益仅能判断为这条恢复路径更一致，不能从 78 个案例外推完整 C1 或模型效果。

用户体验改善在于公开回执与恢复证据一致，损坏来源和后续发布失败有诚实诊断；不增加用户确认或重新填写已知信息。 改动影响 CLI 与保存的 JSON 证据，没有页面布局或渲染交互变化。

本次有界整理已直接复用 observer 与 capture owner；不需要新的捕获服务。更大 C1 composition 合并留给既有 #7430，当前有真实恢复消费者，故这个边界不是只增字段的空前置。

未重跑完整仓库、标准 premerge 或安装后的真实 Host/模型工作流；没有把字节、局部通过或恢复字段存在推断成长期收益。

English verdict: APPROVE — exact head a701cda; the same optional host-poll observation now survives immutable capture and real recovery without duplicate polling or altered settlement identity; full C1 and merge qualification remain separate.