refactor(replan): converge captured context and original-Turn closeout

benchmark/runtime/checkpoint.py

@@ -10,6 +10,7 @@
 import json
 import math
 import subprocess
+import tempfile
 import time
 from contextlib import ExitStack, contextmanager
 from pathlib import Path, PurePosixPath
@@ -138,28 +139,43 @@ def capture_before_replan(env: dict[str, str], receipt: dict[str, Any], body: st
         raise ValueError("fresh_replan checkpoint trigger requires a heartbeat execute wake")
     started = time.monotonic()
     guard_path = Path(env["LOOPX_WAKE_LOG_DIR"]) / receipt["turn_id"] / "checkpoint-start-guard.json"
-    command = [env["LOOPX_CLI"], "--format", "json", "--registry", env["LOOPX_REGISTRY"],
+    # Use the CLI's original-decision capture, including with TurnEnvelope off.
+    # The checkpoint selector needs the full source; the model consumes the
+    # ordinary CLI projection of those same bytes, never a second guard.
+    capture_root = Path(tempfile.mkdtemp(prefix="checkpoint-start-", dir=guard_path.parent))
+    command = [env["LOOPX_CLI"], "--cli-bin", env["LOOPX_CLI"], "--format", "json", "--registry", env["LOOPX_REGISTRY"],
                "--runtime-root", env["LOOPX_RUNTIME_ROOT"], "quota", "should-run",
                "--goal-id", env["LOOPX_GOAL_ID"], "--agent-id", env["LOOPX_AGENT_ID"],
                "--runtime-profile", "generic_cli", "--turn-instance-id", receipt["turn_id"],
-               "--available-capability", "shell", "--available-capability", "filesystem_write"]
+               "--available-capability", "shell", "--available-capability", "filesystem_write",
+               "--decision-output-root", str(capture_root)]
     guard_run = subprocess.run(command, cwd=env["LOOPX_PROJECT"], env=env, capture_output=True,
                                text=True, timeout=120, check=True)
-    guard = json.loads(guard_run.stdout)
-    if not isinstance(guard, dict) or guard.get("ok") is not True:
+    projected = json.loads(guard_run.stdout)
+    captures = list(capture_root.glob("decision-*/decision.json"))
+    if len(captures) != 1:
+        raise ValueError("checkpoint requires exactly one captured original quota decision; do not replay the guard")
+    raw_guard = captures[0].read_bytes()
+    guard = json.loads(raw_guard)
+    if (not isinstance(guard, dict) or guard.get("ok") is not True or
+            not isinstance(projected, dict) or projected.get("ok") is not True):
         raise ValueError("checkpoint requires a successful original quota guard")
     # A previous preflight on this wake may already have allowed model work,
     # even if its optional attempt marker (or final receipt) could not be saved.
     # Such reentry can verify an existing point, but cannot capture a later one.
     preflight_seen = guard_path.exists()
-    guard_path.write_text(guard_run.stdout, encoding="utf-8")
+    guard_path.write_bytes(raw_guard)
     guard_path.chmod(0o600)
-    reading = f"Read the complete packet at {guard_path} before work, then follow its interaction_contract. "
+    view_path = guard_path.with_name("checkpoint-start-view.json")
+    view_path.write_text(guard_run.stdout, encoding="utf-8")
+    view_path.chmod(0o600)
+    reading = (f"Read the complete CLI view at {view_path} before work, then follow its interaction_contract "
+        "and replan review/writeback reads when present. ")
     if env.get("LOOPX_CONTEXT_DELIVERY") == "on" and env.get("LOOPX_CODEX_CONTEXT_DIR"):
         from .context_delivery import preflight_context_instruction
 
-        reading = preflight_context_instruction(env, guard_path,
-            hashlib.sha256(guard_path.read_bytes()).hexdigest(), receipt["turn_id"])
+        reading = preflight_context_instruction(env, view_path,
+            hashlib.sha256(view_path.read_bytes()).hexdigest(), receipt["turn_id"])
     preloaded_body = ("Host checkpoint preflight has already executed this wake's original quota guard once. "
         + reading +
         "Do not repeat the initial guard below; use its selection or recovery command when required.\n\n" + body)

benchmark/tests/test_checkpoint_handoff.py

@@ -473,7 +473,13 @@ def test_preflight_defers_history_only_when_capture_will_verify_it(tmp_path, mon
     request.write_text(json.dumps({"destination": str(tmp_path / "checkpoints"),
         "trigger": "fresh_replan", "native_session": native_participant,
         "components": [{"id": "code", "source_path": str(tmp_path / "code")}], "point_metadata": {}}))
-    monkeypatch.setattr(checkpoint.subprocess, "run", lambda *a, **k: SimpleNamespace(stdout=json.dumps({"ok": True})))
+    def guard(command, **kwargs):
+        from pathlib import Path
+        captured = Path(command[command.index("--decision-output-root") + 1]) / "decision-original"
+        captured.mkdir()
+        (captured / "decision.json").write_text(json.dumps({"ok": True}))
+        return SimpleNamespace(stdout=json.dumps({"ok": True}))
+    monkeypatch.setattr(checkpoint.subprocess, "run", guard)
     monkeypatch.setattr(checkpoint, "effect_runtime_result", lambda *a, **k: {"capture": False, "reason": "no_fresh_replan"})
     observed = []
     def gate(*args, full_history):

docs/architecture/rfcs/hierarchical-agent-stride-control-v0.md

@@ -762,17 +762,42 @@ these facts do not change the admitted context/basis identity. Changed source
 requires rereading within the original Turn. Page coordinates persist with the
 decision into subsequent review; node-filtered/planner detail routes remain
 outside this bounded citation path. No separate receipt store is introduced.
-The enabled review also carries the prior decision's existing `todo_delta`
+The replan context also carries the prior decision's existing `todo_delta`
 targets in `decision_followthrough.planned_work`: current canonical status and
 claim, plus references to causally later observations of that exact work item.
 Legacy descriptive Todo deltas remain readable with unresolved linkage; an
 overlong reference is never truncated into a different Todo identity.
 Missing Todo sources and omitted work remain explicit; a missing observation
 does not prove non-execution, and Todo completion does not prove objective gain.
 Related observations survive unrelated recent activity in the bounded window.
-The same bounded followthrough is included in `stride_control` so compact Host
-envelopes expose it without requiring another full-context read. Historical
-decision identities and off-mode output remain unchanged.
+Generic followthrough is available with stride off as well: `result_counts`
+separates advanced, unchanged, blocked and terminal observations, while visible
+rows retain their result class and delivery outcome. The compatibility
+`recorded_progress_count` is an observation count, never successful work.
+Historical decision identities and stride admission/settlement gates remain
+unchanged; off-mode context now includes this feedback without enabling stride.
+
+The [captured replan reader](../../reference/protocols/turn-envelope-v0.md#captured-replan-reads--捕获后的重规划读取)
+separates state review from authoring on one immutable decision snapshot.
+Cumulative acceptance uses lossless content-bound detail reads, and Explore
+receives a separate context increment. Existing uncaptured callers retain their
+full delivery. File/SQLite source tests and populated packet budgets qualify
+transport and writer continuity; installed adoption, real model decisions and
+matched outcome/cost benefit remain unqualified. This introduces no new planning
+receipt, model checkpoint or requirement to change direction.
+The reader replaces repeated method guidance with compact semantic boundaries
+and the existing stride format. Benchmark preflight captures the original
+decision through the CLI and delivers its staged view even with TurnEnvelope
+off; retaining a full checkpoint packet alone does not qualify model exposure.
+Captured CLI and Turn entries now share delayed settlement-format delivery;
+new native journals deliver the same reader through actual Codex/structured
+Host inputs. The executor retains its signed identity and full source. Core Goal
+and the current horizon stay explicit each Turn, with only cumulative acceptance
+detail indexed. Legacy journals and uncaptured Host requests keep their original
+fallback until they possess the same immutable source/reader binding. No new
+cache, acknowledgement or planning owner is introduced. Qualification must count
+entry, applicable acceptance/evidence, writeback and recovery together; successful
+reader routing is not model adoption, scientific benefit or a total-cost pass.
 
 The next-review input also exposes causally later ordinary writebacks for the
 declared work in `ordinary_work`, with per-Todo `ordinary_evidence_refs`. Its

docs/architecture/rfcs/hierarchical-agent-stride-control-v0.zh-CN.md

@@ -632,14 +632,31 @@ revision、考虑的 finding 与适用/暂缓等理由，不建新图或第二
 拒绝缺少复盘、错误引用以及过期或不可用依据的错误声明，校验提案结构和来源，
 不能证明研究已执行或有收益。
 
-启用策略后，`decision_followthrough.planned_work` 将上次决定中既有 `todo_delta`
+replan context 中的 `decision_followthrough.planned_work` 将上次决定中既有 `todo_delta`
 指向的 Todo 与当前规范状态、认领人和该工作项在决定之后的观测引用一起返回。
 Todo 来源缺失和省略数量明确保留；缺少观测不等于没有执行，Todo 完成也不等于
 目标收益。历史描述性 Todo delta 保持可读并注明关联未解析；过长引用不会截断成
 另一个 Todo 的身份。相关观测不会被大量较新的无关活动挤出有限窗口。
-同一份有界反馈进入
-`stride_control`，紧凑 Host envelope 可直接消费，避免为这些信息再读完整上下文。
-历史决定的引用身份及 off 模式输出不变。
+通用执行回顾在 stride 关闭时也可读取：`result_counts` 区分推进、未变、阻塞和
+终态观测，明细保留结果分类及交付结果。兼容字段 `recorded_progress_count` 表示
+观测数量，不表示成功工作。历史决定引用及 stride 准入/结算门禁不变；off 模式
+新增反馈上下文，但不启用 stride。
+
+[捕获后的重规划读取](../../reference/protocols/turn-envelope-v0.md#captured-replan-reads--捕获后的重规划读取)
+把状态审视和写回格式分开，复用同一不可变决策快照。累计验收通过内容绑定的明细
+读取完整保留，Explore 使用独立的上下文增量预算；未捕获快照的调用仍完整投递。
+File/SQLite 源码测试和真实规模 packet 预算验证传输与写回连续性；已安装采用、真实
+模型决策及可比成果/成本收益仍待资格化。不新增规划回执、模型 checkpoint 或强制
+改变方向的要求。
+读取入口用精简的语义边界和既有 stride 格式替换重复方法指导。benchmark 前置检查
+通过 CLI 捕获原决定，在 TurnEnvelope 关闭时也交付分段视图；仅保留完整 checkpoint
+源包不能证明模型实际收到了实验处理。
+捕获后的 CLI 与 Turn 入口现共享延后交付结算格式的投影，新原生 journal 经实际
+Codex/结构化 Host 输入交付同一读取器；执行器保留签名身份与完整原包。每轮明确
+交付 Core Goal 与当前规划窗口，仅累计验收明细使用索引。旧 journal 和未捕获
+原包的 Host 请求在具备同样的不可变源/读取绑定前保留原回退方式。不新增缓存、
+确认回执或规划 owner。资格化须合计入口、适用验收/证据、写回及恢复成本；路由
+成功不等于模型采用、科学收益或完整成本通过。
 
 下一轮输入还通过 `ordinary_work` 与各 Todo 的 `ordinary_evidence_refs` 返回已
 声明工作在决定之后的普通回写。详情最多六项，保留总数、省略数和稳定 history

docs/reference/canonical-terminal-review.md

@@ -130,8 +130,12 @@ only when the current contract permits final scope closeout. Ordinary completion
 retains `active_goal` continuation without creating
 an artificial successor. Its command has the condition
 `todo_deliverable_complete`; required validation is never conditional or waived.
-Qualified `in_flight_continuation` leaves unfinished work open and omits ordinary
-completion rather than pretending the deliverable passed.
+Qualified `in_flight_continuation` leaves unfinished work open with its original
+declaration. Its plan retains the conditional completion command: execute it only
+when the original deliverable independently passes acceptance. Completed work or
+a changed route uses `semantic_closeout` with an evidence-linked vision decision
+on the same Turn; no fresh guard or binding is needed. Projecting a command does
+not execute it or establish acceptance.
 
 The shared Todo summary keeps missing-successor diagnostics and counts, but its
 warning is review guidance, not an obligation to create a successor or terminate
@@ -141,6 +145,16 @@ alone does not certify final scope closeout. Graph validation, empty-frontier
 replan and terminal proof remain governed by their existing typed rules. This
 guidance change is shared by CLI, status and quota readback.
 
+When a captured replan creates a successor, use the writeback reader's
+`successor_binding_args` on `todo add --replan-obligation-id ...`. The original
+Turn and Goal incarnation are checked before creation. The creation receipt
+returns that Turn's settlement plan instead of an immediate stop action; finish
+its validation/writeback/accounting before ending. The successor remains open
+and needs a later admission for execution. No guard reentry is required.
+An unbound legacy add retains its existing end-of-heartbeat receipt; it does not
+invent an original Turn. This binding is an authoring affordance, not a new
+requirement to create successor work.
+
 If final closeout is attempted before writeback/accounting, CLI JSON and Markdown
 return that same recovery plan. Supplied registry/runtime, project/state routes
 and original lease proof are retained where the corresponding command accepts