[loopx-agent]

Goal And Delivered Outcome

A long-lived heartbeat can finish its durable writeback, then fail quota spend-slot when the complete decision preview exceeds the shared runtime's 2 MiB inline request budget. Both decision snapshots are part of the durable request fingerprint; dropping them would change replay compatibility.

Register quota.spend.commit with the existing private snapshot transport on both sides and opt its adapter into that transport. Requests and preview responses can cross the inline boundary while retaining the complete logical payload, original digest, source admission, index CAS and exactly-once accounting. The socket limit and existing 64 MiB private-file limit stay unchanged. Base: main at 35031332795ee7417f56f6a7582e09cc3a75458a.

Author Declaration

Written by: model_agent — OpenAI Codex, GPT-6 family.

Implemented against the existing quota/spend_commit.ts transaction and effect_runtime_snapshot.ts transport at the base revision above. This is a reproduced reliability defect; no new capability, authority or execution mode is introduced.

Criterion	Disposition	Path	Validation
Preserve the full preview and durable request digest	implemented	quota/spend_commit.py	Small and 2.2 MB preview/commit/replay regression
Bound and authenticate private snapshot delivery	implemented	effect_runtime.py, effect_runtime_server.ts	Existing snapshot permissions, digest, symlink, byte-limit and socket-boundary checks
Spend once, retaining validation and CAS	implemented	existing typed quota owner	Transaction concurrency/recovery suite and File/SQLite CLI settlement journeys

Scope And Continuation

Complete within this transport repair. The quota transaction, persistence format, source-lifetime checks and CLI contract are unchanged. This does not claim a reduction in model-input tokens or solver costs; packet compaction remains separate work. No installed runtime or live Goal is modified by qualification.

Scope-fit: reuse the existing internal transport and typed transaction, with no wrapper, parallel decision owner or new configuration. Semantic advisory: extend the existing method allowlist with an already-registered RPC method on both ends; this is not a new protocol vocabulary.

Validation

• Tested revision: 2ab41925407d81242f6c30cccd083d069fae1911 (the passing focused runs exercised the identical final file bytes before commit).
• Run state: finished.
• Input classes: synthetic, public_fixture, authorized_private_read_only. Private observations are not included in the diff or attachments.

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	The same new 2.2 MB facade case rejects on immutable base with the inline-limit error and passes on the candidate. Preview is complete; a repeated commit leaves one index row and unchanged persisted record bytes.
integration	passed	114 Python tests across test_quota_spend_commit_runtime.py, test_canonical_snapshot_integration.py and test_effect_runtime_integration.py.
integration	passed	29 TypeScript quota transaction and snapshot cases, including prepared recovery, index CAS, concurrent exact retries and integrity rejection.
real_entrypoint / real_backend	passed	47 production CLI settlement tests on isolated real File/SQLite providers in test_quota_authority_settlement_journey.py; same synthetic fixture also completes guard → writeback → preview → spend → replay on base and head, once per provider. These CLI fixtures are below the inline bound; the above-bound regression separately exercises the production adapter and real runtime.
regression_parity	passed	Alternating inline/private transport for the same small request returns exactly equal complete results, without filtering fields. One warm local cohort of 45 samples each measured medians of 6.77/7.11 ms; the added temporary response sink costs about 0.34 ms. This is a local transport measurement, not an end-to-end performance SLO.
static	passed	Repository Ruff, configured strict mypy (17 files), control-plane TypeScript typecheck, bilingual staged-diff check, semantic advisory, and explicit four-file public-boundary scan.
real_entrypoint	passed	Existing cli-output-budget-regression-smoke.py; no decision prose was compacted.
integration	passed	Full TypeScript control-plane suite: 5,478 passed, 75 conditional skips, zero failures. External-service skips are not PostgreSQL qualification.
static / integration	passed	Exact-scope quality receipt verified; managed premerge passed all 6 direct checks and 13 selected commands. No merge authority is inferred.

Coverage boundary: no PostgreSQL authority implementation, storage routing or provider protocol is changed; no PostgreSQL promotion or performance claim is made. The shared private-file checks and unchanged typed accounting owner are covered directly. No scored or paid benchmark was launched. Broad CI remains the remote merge gate.

Frontend / Visual Evidence

UI impact: none. This repairs the existing CLI/runtime accounting path; it adds no caller-facing operation or screen.

Type Of Change

• Bug fix
• Test update

LoopX Area

• Control plane (quota and runtime)

Shared-authority RFC fixture impact

N/A: no provider, cutover, compatibility projection or authority-store semantics change is claimed.

Boundary Checklist

• Public-safe source and synthetic fixtures only; no private state, logs, credentials or local operating context published.
• No benchmark jobs, submissions, scoring changes or duplicated campaign work.
• Scope is limited to the reproduced accounting transport defect.
• No paired RFC changed; the staged bilingual check passed.
• No visual surface changed.
• Commit carries DCO sign-off.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; reasoning_effort=max; declaration_source=runtime_reported; observation_id=0956f835f35a14ed9628f47a3145e8c5710554ab78cf98631d175df2a5953bca

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

长期运行的 heartbeat 使用者，在工作已写回后仍需要把同一次配额扣记可靠地结算。 决策上下文较大时，扣记请求会超过2 MiB通道限制，原先在扣记前失败；删除上下文又会改变原请求摘要。现在完整请求按需走现有私有快照，大包预览、实际扣记与重放都能保留原逻辑内容。 实际基线的大包在产生效果前拒绝，当前完整预览、一次扣记和不重复的重放通过；小包两种通道的完整请求和结果相同。 本次范围是既有扣记的传输修复，不提高传输上限、不压缩决策原文、不增加权限或第二个记账所有者，也不宣称模型成本下降。

改动思路

把完整请求交给既有私有快照通道，实际扣记仍由原TypeScript事务执行；Python只负责传输与原错误适配。 当前四路径仅扩展两端方法许可、开启原适配器选项并增加回归用例；默认socket边界、快照校验和原结算规则保持各自所有者。 Opt the existing method and facade into the existing snapshot transport on both ends; no raised budget, truncation, new service or duplicate transaction. 原身份、输入完整性和独立未完成义务都保留；拒绝与恢复由原所有者处理，不能以继续运行代替证明。

具体改动

准确头 2ab41925407d81242f6c30cccd083d069fae1911，实际merge-base 35031332795ee7417f56f6a7582e09cc3a75458a，本次目标main快照 920f18809d906b840325c4f40013e9224e4a3a2e。接受规格 docs/architecture/rfcs/typescript-control-plane-migration-v0.md 取修改前不可变版本 35031332795ee7417f56f6a7582e09cc3a75458a。以下编号为评审映射，未用本PR修改内容自证。

• QS-COMPLETE implemented：Complete logical facts must survive the wire; display/RPC budgets cannot authorize truncation. 路径：_quota_spend_commit_result；验证：161 Python tests and immutable base/head2.2MB probe。

• QS-PRIVATE implemented：Existing2 MiB inline and64 MiB private snapshot limits, same-UID ownership, digest and private-file validation remain enforced. 路径：effect_runtime.py / effect_runtime_server.ts / effect_runtime_snapshot.ts；验证：29 TS snapshot/transaction tests and actual runtime integration。

• QS-REPLAY implemented：The existing typed owner retains exact request digest, admission, index CAS and once-only accounting. 路径：quota/spend_commit.ts unchanged owner；验证：real File/SQLite CLI and transaction/concurrency/recovery tests。

• QS-AMBIGUOUS implemented：Unverifiable post-dispatch results require exact receipt recovery rather than automatic mutation retry. 路径：effect_runtime_request / original receipt replay；验证：actual commit plus synthetic unverified return: one automatic call, explicit replay adds no row。

关键代码讲解

• _quota_spend_commit_result：传输完整扣记请求。原inline改为原snapshot适配选项；关键约束：complete logical request, no compaction。调用 effect_runtime_result quota.spend.commit 后交给 existing typed transaction and CLI payload；失败由 same conflict/rejection adapters; ambiguous response remains typed 负责。

• _request_with_info：共享有界IPC与快照IO。仅此已有方法新增许可；大请求变文件，小响应仍inline；关键约束：2MiB frame/64MiB file; token, private files and digests。调用 private request/reference and verified response 后交给 existing effect_runtime_request；失败由 no automatic retry after send ambiguity; ExitStack cleans files 负责。

• writeResponse：保留大小分支及不确定结果。response fits inline unchanged; wide response uses prepared sink；关键约束：never downgrade a possibly committed large result into safe retry。调用 writePrivateResponse or socket response 后交给 Python runtime decoder；失败由 post-dispatch unverifiable result requires receipt recovery 负责。

完整审查四路径 +77/-1，生产变化只涉及两端已有方法许可与原适配器选项，新增回归没有引入新的写回所有者。请求中的完整preview仍参与旧摘要；小包请求保持inline，大请求才使用params_ref。预备响应文件只在响应本身超过inline限制时使用，小commit结果仍按旧分支inline返回。临时文件在现有调用范围内清理，文件权限、所属用户、字节数、摘要、认证token及64 MiB边界由原通道核验。

本次独立执行161项Python、29项TS、完整TS typecheck、mypy17配置源文件及仓库声明完整Ruff，全部通过。标准premerge的6项直接检查、5项catalog和8项风险检查通过，四文件另作隔离公开边界扫描通过。真实CLI路径使用File/SQLite隔离权威源；没有以单个适配器成功替代整个结算旅程。

对主干的风险

最强反例是把超过预算的字段截断后仍扣记，或在原效果已提交后自动再扣一次。准确基线与当前源分别执行同一新fixture：小包均通过，2.2MB原始上下文在基线明确因inline预算拒绝且没有Goal事务；当前完整预览、一次扣记及重放均通过，原索引和记录字节不变。小包在同一实际runtime中切换inline/私有通道，完整请求与完整结果逐项相等，没有过滤或归一化字段。 为了直接观察小fixture经过文件codec，独立脚本只把客户端路由阈值降为4096字节，实际捕获到params变为params_ref；生产2 MiB/64 MiB限制不改，正常真实阈值另由2.2MB用例覆盖。

另一次真实native扣记后，在客户端接收结果前注入typed不可验证返回，只有一次自动调用；显式按原效果恢复返回appended=false，索引仍一条且字节不变。初次故障脚本误将小commit响应当成文件响应，注入点没有生效而测试失败；读明原大小分支后改在真实返回边界注入，保留原失败并通过完整断言。共享decoder的原始坏JSON/文件反例由上述native套件另行覆盖，不把这个合成注入宣称为真实provider故障。

请求允许范围扩展只覆盖已有quota.spend.commit，其他方法默认IPC限制不变。64 MiB并非无限容量；超过它或不合法私有文件仍在效果前拒绝，效果后无法验证仍须原凭证恢复。作者较大测试/本地时延样本没有被冒充本次独立运行结果；没有据此认定安装采用、端到端SLO或模型预算收益。

我的整体评价

APPROVE，仅对应当前完整提交 2ab41925407d81242f6c30cccd083d069fae1911，本次明确的修复切片达成；没有当前引入且未解决的阻塞发现。把完整请求交给既有私有快照通道，实际扣记仍由原TypeScript事务执行；Python只负责传输与原错误适配。 当前四路径仅扩展两端方法许可、开启原适配器选项并增加回归用例；默认socket边界、快照校验和原结算规则保持各自所有者。 现有所有者与这个局部改变足够，不需要第二个规则服务、配置页或形式化后续任务。

long_horizon 为improved，依据是本次有界实路中的原效果保护、重放和后续可用工作，不扩大为真实模型或长期净收益。user_experience 为improved：使用者继续原CLI操作，不增加配置、复制上下文、确认或手工换身份的步骤；响应不可验证时仍须按原凭证恢复。 仅运行时传输、既有扣记适配器及测试变化，没有页面、组件或样式改动。 无新增渲染表面；已安装宿主、真实模型与长期收益未验证。

严格质量回执 cqr_a0453d823e9a0328fa31 为PASS，当前执行的必需检查没有失败。 未查询或等待CI，未执行合并、共享安装、真实模型或实验。APPROVE不是GitHub正式自我批准，不授予合并权限，也不替代准确头的准备检查；新提交或相关所有者/条件变化需重新核验。

English verdict: APPROVE — 2ab41925407d81242f6c30cccd083d069fae1911. Complete logical spend previews now cross the existing bounded private transport without changing the typed transaction.161 Python and29 TS tests, immutable-base sensitivity, full small-mode equality and explicit postcommit recovery pass; static/premerge/CQR pass. Installed/live/model/performance qualification is separate; no merge performed.