[loopx-agent]

The context feature was presented as a Codex-specific capability, and its machine opt-in could reject unrelated declared hosts. This change presents Differential context → Codex: one application row over the existing machine configuration transaction. It also supplies private path defaults and delivers the first verified page with a saved projection, avoiding one extra read request per wake.

The existing context_delivery v0 mode remains the Codex preference; there is no additional global switch or new host configuration schema. Off remains the default. Inherited on leaves other explicitly resolved hosts on full delivery. Explicit --context-delivery on still accepts only declared Codex App heartbeat or the Codex benchmark heartbeat worker; unsupported, unknown or contradictory declarations fail before admission. Frozen trial/explicit CLI off retains precedence.

The UI now names the capability, places Codex beneath it, honors a read-only editor, saves through revision-locked preview/apply/readback, and distinguishes the saved preference from unverified host readiness and actual use. Supported calls create private storage and isolate native sessions; unsafe existing directories are rejected. Bootstraps reread inheritance each wake. Workers propagate their resolved trial mode, including default off, to preflight and solver subprocesses.

Enabled saved projections include up to 3 KiB of verified page-zero content through the existing page protocol, then continue using the ordinary 4 KiB reader and returned UTF-8 cursor. The original from-zero command and same-capture full recovery remain usable, including after an optional first-page read failure. Full required reads and exact baseline reconstruction still precede work. No new admission, spend, retention proof or execution authority is created.

Boundary: saving this preference does not initialize an unattended native Codex App, install/trust hooks, configure process-start diagnostics, or establish actual delta use. Missing retention proof keeps full delivery. No installed host, live/frozen experiment, scoring or paid campaign is changed.

中文：入口改为“差分上下文”，在能力下选择对 Codex 开启。复用原配置 owner，默认关闭；机器偏好不再影响其他已声明宿主，显式 on 对不支持或无法确认的跑法仍报错。首屏分页沿用现有协议和完整恢复。保存偏好、宿主就绪、本轮实际 full/delta 分别表达；原生 App 自动初始化与真实 solver 收益仍待验证。

Validation at cb5950fdb4be57f8253131ac2be75d7104d77a1e:

• 269 distinct Python passes, comprising 260 focused cases and nine explicitly enabled native cases; 44 optional cases remain skipped. This is not a whole-suite pass.
• Six new real-CLI counterfactuals fail before the host-scope correction and pass afterward: inherited Codex on leaves Trae, Claude, Kunlun, Kiro, Ark and a complete Claude scheduler declaration byte-identical to their original off response. They create no native state or spend. Explicit unsupported on still errors; missing/conflicting Codex and ambiguous generic CLI declarations still error.
• The previous exact-head review found a real runtime-routing blocker: native commands could ignore the registry-selected runtime and read a different machine preference. The extra native-only routing branch is removed in favor of the existing effective_runtime_root owner. Four direct-CLI regressions fail before and pass after: A on/B absent and A off/B on, each with absolute and relative registry roots, without an explicit root. Generated hooks pin A, B stays untouched, and digest-bound recovery still reads the original capture after registry corruption. Independent re-review of this fix is pending.
• Actual Codex 0.163.0-alpha.11.1 with deterministic local inference verifies complete cold/warm reads for App, machine App, code-mode App and benchmark. Five File/SQLite off-worker cases retain caller inputs, original Turn, one admission, zero extra spend and no context hooks/journals. Six immutable-baseline off-projector comparisons cover ASCII/UTF-8 and host declarations.
• A 4 KiB first-page attempt failed the existing 2,000-token code-mode output limit. The final 3 KiB page passes the same workload and limit; no budget or completeness oracle was weakened. This fixture does not guarantee that every possible content fits that token limit. UTF-8 cursors, truncated-page rejection, original-capture immutability, restart and reader-failure recovery are covered.
• Packaged Chat and frontend contracts pass. Real isolated backend verification covers keyboard on/off saves, reload/readback, and offline save failure retaining the prior value. Synthetic read-only catalog and HTTP403 fixtures verify disabled/no-write UI and failure retention; they do not qualify backend authorization. English/Chinese hierarchy, desktop and 390px primary controls were inspected. Desktop help supports focus/Escape; expanded narrow tooltip layout was not separately qualified. Lower help/raw JSON still uses inner scrolling.
• Configured mypy passes 17 files and four focused adapter modules; Ruff, control-plane TypeScript, bilingual diff and semantic advisory pass. Registered HostSurface values are reused locally, without a new vocabulary. The advisory detects no supported new carriers in the PR scope; this is not proof of semantic completeness. Historical exploratory typecheck failures remain recorded.
• Full premerge against target snapshot f094b2cfb2acde7a4a0d4d875bba52f64ac31ba9 executes six direct and 19 selected checks without command failures. Exact-scope receipt cqr_72114a93252f63f697bd is valid. Overall result remains manual_review_required: nine image holds plus one benchmark-sensitive maintainer-review hold. No merge readiness or authority is claimed. Latest fetched main has no commits overlapping the 31 PR paths; that read is not current-main integration qualification.

Matched complete-request experiment:

Eight source-bound native cells compare immutable prefetch baseline 37e5bb895c1b8c9dde2a17db4951052368cd14f9 with this head: File/SQLite × off/on, two wakes each, identical short CLI wrapper, and a synthetic Task of 240 stable requirement lines (about 55.5 KB per packet). Every page is read and verified; all eight cells pass without truncation. Original captures, admission identity and the explicit inter-wake debit are preserved.

Authority	On: baseline → head, two wakes	Head cold vs off	Head warm vs off	Head two wakes vs off
SQLite	759,553 → 696,607 (−8.29%)	+4.56%	−55.64%	−35.25%
File	764,827 → 699,085 (−8.60%)	+4.91%	−55.43%	−34.97%

On requests fall from 24 to 22 by eliminating one redundant first-page read per wake. Values are o200k_base token proxies of complete serialized native requests, including repeated history, tools, instructions, protocol fields and all supplementary reads. They are not billed tokens, cache pricing, solver decisions or outcome scores. Deterministic loopback usage counters are excluded. This single workload is separate from the historical 31-packet corpus and live campaigns. Prefetch adds a bounded local verification/read; no CPU, IO or latency saving is claimed. Cold delivery still costs about 5% more than off.

Earlier source 0750ff61084e5a71a28368526437eeba9d64ad52 used a longer CLI path in its approximately 28% total / 49% warm / 12% cold table. That experiment remains historical evidence; cross-workload percentages are not a matched comparison. The table above uses the same short path in both base/head arms. Earlier 3 KiB candidate repeats were about 7.6%–8.6% lower than baseline; the final repeat above retains the observed variation.

Current-head GitHub CI and independent re-review remain open. At the preceding cff37c260 source, artifact CI failed the empty-running-tile browser assertion and CI maintenance timed out waiting for obsolete-run cancellation; that older run was subsequently confirmed cancelled. These observations are not CI waivers. Earlier source CI failed browser/artifact checks; those failures remain failed without causal or baseline waivers. Previous Python run, previous artifact run.

Bounded refactoring reuses the machine transaction, scheduler declaration owner, public page reader, native verifier and TypeScript codec. Native argument adaptation stays in its existing adapter; runtime selection now uses the same owner as machine configuration. No parallel control-plane decision owner is added. Installed native initialization and real solver outcome/complete-cost qualification remain open.

Visual evidence: actual packaged Chat with an isolated backend and synthetic state, updated at cb5950fdb4be57f8253131ac2be75d7104d77a1e. Four changed captures were inspected; they contain no text/EXIF metadata or private context. The 390px primary Codex switch and its uncertainty are visible; lower details require inner scrolling. These are packaged browser observations, not installed Desktop/native qualification.

Before — the Codex-specific capability at the previous source:

After — Differential context with a Codex application row:

Default off, failed save and 390px viewport

[loopx-agent]

Validation readback for 0750ff61084e5a71a28368526437eeba9d64ad52:

• Focused machine-configuration and shared-worker suites: 88 passed, 48 explicitly skipped.
• With the real native Codex executable and loopback-only inference, the machine-configuration suite passes all 26 cases. Five are native worker cases: File/SQLite, machine off/on with the trial setting omitted, and an explicit trial off under machine on. These execute the actual preflight and model-invoked guard, preserve the original caller environment, create no context hooks/cache, and retain one admission with no spend.
• Accounting for the 21 overlapping cases, this run qualifies 93 distinct cases; 43 other opt-in cases remain skipped. No paid model calls or benchmark experiments were launched. Earlier UI and positive native evidence remain separately versioned, not claimed as rerun here.

The default-off propagation fix passes this production-path regression check. Full next-start Codex App activation remains unfinished: the launch owner must prepare startup diagnostics and exact native hook trust while preserving existing configuration. Per-Goal/Agent recovery instructions must not be installed as global instructions for unrelated sessions. The saved preference is not proof of host activation, and restarting alone is not a substitute for launch integration. Default remains off; this is not a merge-readiness declaration.

中文：最新 head 的默认关闭隔离已通过真实原生 worker 路径验证，包含机器已开启但 trial 未配置/显式关闭的情形。统计去重后本轮 93 项通过，另有 43 项显式跳过；没有付费模型调用。App“下次启动生效”仍需真正接入启动 owner、精确 hook 信任与按 Goal/Agent 隔离的恢复，不能把保存偏好或重启当成实际生效，也不宣称具备合并资格。

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · max

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

REQUEST_CHANGES — 0750ff61084e5a71a28368526437eeba9d64ad52，完整差异基线 61b83ac745a49f9eafadd7b87b085d567a9dca11。 找到一项实际阻塞：原生上下文入口没有沿用同一 registry 所选择的运行目录，可能把已保存的开启读成关闭，也可能越过该目录的关闭设置。以下结论覆盖本次完整30文件；最新3个路径已逐段复核。27个路径的blob与此前检查完全相同，旧UI/构建证据保留d457bcfa来源，当前CLI反例、off对照、worker原生用例与premerge均重新执行。

[P1] Keep native context defaults on the registry-selected runtime — context_machine.py:57–60。machine-config 使用 registry 的 common_runtime_root，这里却只让 heartbeat/should-run 使用该 route，原生 config/hook/project/read 走 resolve_runtime_root({}, ...)。同一份 registry 在没有显式--runtime-root时因此读到另一份机器配置。真实 CLI 已复现 A开启/B无配置→setup关闭，以及 A关闭/B开启→setup开启并创建B的私有目录；显式指定A后两边均正确。应复用原有 runtime resolver，保留摘要绑定恢复的独立读路径，并补齐不传 root 参数的双目录回归。不是靠新增一个设置或要求用户重复参数解决。

动机

维护本机 Codex 心跳的用户希望保存一次上下文传输偏好，并让后续支持的心跳采用它。 此前每条命令都要重复开启参数与私有目录；本次改为设置页一次开关保存，并为支持的入口选择私有目录。 逐条维护参数会增加后续唤醒的准备成本，并可能让持久入口继续固化旧设置。同一运行目录中，一次开关完成原生预览、带修订应用与独立读回；这只保存偏好，不证明宿主已实际使用差分。 当前普通同目录路径已经验证，但两份合法运行目录并存时会发生上述错误，不能把局部保存成功等同端到端继承成立。

不安装或信任用户宿主钩子、不重启 App、不改冻结实验、不启动付费模型；仅在隔离目录以现有 Codex 和回环合成推理验证 worker，不证明自主采用或完整成本收益。 目录选择必须先统一；原生宿主自动初始化、安装态采用和实际差分收益仍未验证。新增五个 worker off 隔离用例通过不解除来源绑定缺陷。 本次也没有把配置可见、目录存在或生成了钩子声明当成授权与保留证明。

改动思路

保存偏好复用已有机器配置事务：一次用户选择在内部完成预览、精确修订应用和独立读回；没有再建Goal级开关或另一套配置文件。显式命令行选择优先，未指定时读取本机偏好，仍由已有声明校验器判断是否属于支持的Codex运行方式。原生保留诊断、TypeScript上下文编码和原始Turn捕获继续各归原owner。

The registered preference and existing transaction/UI are a coherent bounded extension. The extra implicit runtime-selection rule is unnecessary and observably disagrees with that owner; simplify it in this PR. Deliver a correct saved preference and consistent native path selection; leave automatic native trust/setup and installed/model benefit with their existing qualification owners. 机器偏好是不可推导的操作者意图，不能从安装、可用性或已有目录猜测；正确性边界则必须是强制的一致路由，而非另一项可选策略。

条件	应有行为	当前独立观察
无机器配置或显式off	普通完整上下文与原有工作/结算边界	九条公共CLI路径与基线的语义观察一致
支持的声明、显式同一runtime、on	保存/读取同一偏好，安全创建私有叶目录	原生测试与实际设置HTTP流程通过
registry选择A，原生入口省略root	与设置入口继续读取A	错读默认B，双向反例均失败
缺少原生保留证明	保留原始完整捕获，不重复准入/扣额	File/SQLite源验证通过；安装态采用仍未知

这是当前源码和执行结果的对照表，不是模型理解、正式安装或科学收益证明。

具体改动

完整差异 30文件，+636/-49：14个生产文件、5个测试/示例文件、2份文字文档和9张合成图片；评审没有改作者源码。

关键代码讲解

1. apply_context_machine_options 集中处理省略/显式on/off、既有worker的环境off、宿主声明及私有路径。None保留“继承”意图，off直接跳过继承；错误宿主在准入前拒绝。其57–60行的两套路由是本次阻塞，后续目录与配置读者都继承了错误选择。

2. context_delivery_machine_configuration_namespace 在原注册表新增严格的schema/version与off/on值；默认关闭、机器独占，仍由原预览/CAS/应用/删除/回滚处理。没有新Goal事实或推断出的readiness布尔值。

3. setContextDelivery 把一个开关连接到真实预览、应用和fetch读回。实际一次on和键盘off均各产生一次预览/应用；服务中断时保留原值并显示失败，重启后读到持久偏好。原配置说明、原始JSON读取和设备范围仍可访问。

4. codex_context_configuration 为继承式钩子携带所选runtime并避免强制on，让后续关闭可被重新读取；显式on仍然显式。提取的参数声明adapter复用已有宿主规则，bootstrap在解析机器默认之前复制调用者参数，避免固化自动路径；CLI帮助、中文/英文文案和文档同时披露变化。测试还为既有scheduler route夹具初始化canonical来源，没有放宽生产校验。

5. run_once 在复制出的子进程环境中写入已解析的trial off/on，保证preflight和solver都不会把省略的off再次解释成机器on。没有改调用者字典、冻结实验设置、评分或任务语义；新增五例覆盖File/SQLite、机器缺失/on、worker省略/显式off，并用现有Codex加合成回环推理实际通过。

主要依据为改动前的 docs/reference/required-work-context.md，修订 61b83ac，并核对同版的设计/任务交付约定及已有runtime resolver。逐项结论：Opt-in native reuse 的默认关闭与边界隔离在跨runtime情况下 not_met；Saved context cache 的私有物理目录、拒绝不安全目录且不chmod，已由原生测试覆盖；Required work context 的完整原始捕获、恢复不重新准入/扣额，在File/SQLite与本轮公共CLI对照中成立。PR新增的机器默认文档是被审内容，未拿它替代旧规范作为独立证明。

对主干的风险

最强反例不是一个非法mode，而是两份各自合法的配置：A的明确off不能约束读取B的入口。原测试封装的每次调用都会带--runtime-root，所以即使全部通过也观察不到这个分叉。真实事务和CLI复现如下；只把平台默认目录置于临时目录，未替换路由函数、事务或上下文判断：

# Run with the checkout's Python. All configuration and platform defaults are temporary.
import contextlib, io, json, os, tempfile
from pathlib import Path
import loopx.paths as paths
from loopx.cli import main
r = Path(tempfile.mkdtemp())
paths.DEFAULT_RUNTIME_ROOT, paths.LEGACY_RUNTIME_ROOT = r/'default', r/'legacy'
os.environ.pop('LOOPX_CONTEXT_DELIVERY', None)
os.environ.pop('LOOPX_EXECUTION_MODE', None)
a, reg = r/'declared', r/'registry.json'
reg.write_text(json.dumps({'schema_version':'0.1', 'common_runtime_root':str(a), 'goals':[]}))
def cli(*args):
    out = io.StringIO()
    with contextlib.redirect_stdout(out):
        main(['--registry', str(reg), '--format', 'json', *args])
    return json.loads(out.getvalue())
def set_mode(mode, root=None):
    f = r/'setting.json'
    f.write_text(json.dumps({'schema_version':'context_delivery_machine_defaults_v0', 'mode':mode}))
    prefix = ['--runtime-root', str(root)] if root else []
    opts = ['--namespace','context_delivery','--config-json',str(f)]
    plan = cli(*prefix, 'machine-config','preview', *opts)
    return cli(*prefix,'machine-config','apply',*opts,'--expected-plan-revision',plan['plan_revision'],'--execute')
def setup():
    return cli('quota','context-config','--codex-app','--goal-id','fixture','--agent-id','worker')['context_delivery']['enabled']
set_mode('on')
assert setup() is False  # BUG: the declared runtime is on.
set_mode('on', paths.DEFAULT_RUNTIME_ROOT)
set_mode('off')
assert setup() is True   # BUG: the declared runtime is off.

最低修复是让这些原生消费者与现有配置/heartbeat使用同一runtime来源，测试A开/B缺失、A关/B开、生成钩子与恢复位置，保留原摘要恢复不依赖当前Goal配置。临时显式指定runtime只是恢复对照，不是修复验收。没有在用户的活动Goal或机器设置上做这项实验。

本轮验证保留版本与失败区别：此前d457bcfa四个配置/CLI/保存捕获/机器API模块 87 passed、4 optional skipped，另生命周期/原生边界/bootstrap组 105 passed、20 optional skipped；相关旧覆盖依据精确blob一致复用。当前0750ff61宽调用为 88 passed、43 failed、5 skipped，43项均在未改动的harbor.agents导入处失败；相同解释器运行基线同一导入亦复现，Harbor adapter、测试和依赖声明的blob一致。另一个基线独立环境全文件结果为62通过、43跳过、5个既有测试辅助导入错误；保留原始失败，不把不同环境计数混作回归对照，也不要求本PR修复这些环境问题。新增五个worker用例单独选择本机现有Codex0.163.0-alpha.11.1，5 passed；只使用隔离状态和合成本地HTTP推理，未接真实模型或启动实验。

相同脚本在不可变基线与当前head分别执行九条公共CLI路径：配置off、完整提示/bootstrap、真实File guard、摘要恢复、saved projection等完整归一化语义一致。原Turn一份回执、零扣额且未创建transport目录。原始字符预算计数随临时目录长度变化（3853→3856、561→567，均小于4200）；完整命令、原始值与工作文本均保留，没有把所有动态metadata宣称逐字一致。完整dashboard/Chat类型检查及两次Vite构建在d457bcfa通过；相关UI、HTTP owner、资源与依赖未变化，未把旧构建改写成新构建。

当前标准premerge 6项直接检查、19项选中检查通过，0自动失败；整个命令仍是manual_review_required/exit1，保留 10项：9张图片和1项benchmark敏感路径维护者复核。我逐张看过旧五图与当前四图的像素及PNG/ICC元数据，未见私人材料，当前head图片blob一致；这些人工检查不改变原命令退出码或授予自合并。当前diff语义advisory成功，11路径/11快照、无支持的新carrier，不能证明所有语义形式都已覆盖。双目录独立负例在当前head仍失败，是本PR来源绑定回归。

实际Ego页面使用d457bcfa源码打包Chat（相关blob在当前head完全一致）与隔离真实机器配置后端，覆盖开关、独立读回、重启、断线恢复、键盘与中英文390px。未配置的首页会话建立曾产生一次被夹具405拒绝的/api/chat/sessions尝试；未调用模型或准入工作。一次命名为narrow的早期捕获实际是1200×888，已保留并由同次明确390×844的截图替代，没有用于窄屏结论。测试浏览器和两个后端进程均已正常关闭。没有查询、轮询或等待CI。

语义与 CI 对齐

本次新增的是既有机器配置注册表中的schema，复用已有off/on与宿主声明词汇，不是新的Agent/权限生命周期。原工作、lease、quota与once-only结算不变。显式on的自动私有目录和bootstrap显式off保留是已披露的行为变化；实际runtime绑定与默认关闭隔离仍被当前反例违反。当前规范、触发输入、观察、最小修复及可复现命令如上；绿色自动检查不能解除这项语义阻塞。

我的整体评价

设置保存本身是有价值、可回退的 justified_increment，完整原生初始化未被伪装成交付；但当前源码不能批准。long_horizon regression 与 user_experience regression 都落在同一个已复现的来源错误：已保存偏好与后续原生消费者不一致，持续使用会迫使操作者重复修补参数。父级改动规模可以是proportionate，仍须在当前PR simplify_now：The registered preference and existing transaction/UI are a coherent bounded extension. The extra implicit runtime-selection rule is unnecessary and observably disagrees with that owner; simplify it in this PR. Deliver a correct saved preference and consistent native path selection; leave automatic native trust/setup and installed/model benefit with their existing qualification owners.

实际打包页面把单一开关放在设备能力详情内，来源与尚未验证的原生状态可见；完整启用条件在帮助中读取。桌面、390px中英文及展开帮助已目视检查，开关可达，长说明可经详情区域滚动读取。 英文390px共享设置头的分类选择仍拥挤，内层反馈需要滚动；未验证安装态App、真实模型采用或所有显示缩放。仅配置API采用真实后端，其他不可用服务仍显式拒绝。 完整帮助、错误与实际保存值均可读取；这不证明所有设置页已改善。提供的历史经验仅用于提醒先核原任务与普通用户路径，已按当前head作上述判断，不继承旧案例结论或声称记忆效用。

请在同一PR修复runtime绑定并补足上述负例，再按更新后的完整head复审。保留24个原生可选变体、正式安装/宿主信任/实际模型采用及完整成本的未知；本次没有安装、合并、改变冻结实验或授予额外权限。GitHub作者账号与本评审账号相同，因此COMMENTED承载完整阻塞结论，不冒充平台的正式REQUEST_CHANGES状态。

English verdict: REQUEST_CHANGES — 0750ff61084e5a71a28368526437eeba9d64ad52. Native context setup still ignores the registry-selected runtime: A=on/B=absent disables setup; A=off/B=on enables B and creates its private root. Explicit same-runtime controls succeed. Reuse the existing route and add no-root two-runtime regressions. Current five actual native worker off-isolation cases pass with synthetic loopback inference; nine paired CLI semantic observations agree. Premerge automated6+19 pass but retains10 manual holds; the wider suite keeps43 unchanged missing-Harbor import failures, independently reproduced on base. Unchanged UI/build evidence remains pinned to d457. Installed adoption, real model benefit and complete costs stay unqualified. No CI observation, merge or user-host installation.

[loopx-agent]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · max

APPROVE — 7311@cb5950fdb4be57f8253131ac2be75d7104d77a1e，实际基线 9b8adda2f04c285d1c13ecc90b3abba93202ebee。 此前的 P1 配置来源阻塞已经用同一个独立真实 CLI 反例验证修复；没有当前阻塞 finding。

动机

用户在设置中开启 Codex 差分上下文后，希望下一次受支持心跳复用旧上下文，而不必逐条补路径参数。

此前每次调用都需手工提供启用和私有目录；现在保存一次 Codex 偏好即可让受支持入口沿同一 registry runtime 读取，关闭后也不会被另一目录的开启覆盖。

真实页面的开启、关闭与读回通过；当前双目录真实 CLI 两向正确，原生冷暖轮次、完整分页和恢复通过。

不自动安装或信任宿主 hook，不重启当前 App，不改变冻结实验，不据此宣称真实模型的费用或长期成果改善。

安装态宿主初始化、实际持续采用和真实模型的完整成本及成果收益仍未验证；本次不以本地回环传输验证代替这些结果。

目录、配置或 hook 文件存在都不能证明宿主保留了完整输入；这个设置只减少重复参数准备，实际 full/delta 仍由既有宿主声明、原生保留证据与同一原始捕获决定。

改动思路

既有机器配置事务、统一 runtime resolver 和原生传输 codec 足以承载设置与分页；删除额外目录分支后，保存、宿主配置与消费复用同一来源，不需要第二套配置或新的启用状态。

本 PR 交付可保存、可关闭且在同一配置来源生效的 Codex 偏好与原有完整恢复；安装态宿主采用和模型完整成本收益继续由既有验收验证。

开关写入不可从环境推导的用户意图，沿用预览、带精确修订的应用和独立读回。私有目录 IO 与分页只是投影，不能增加 work、lease、quota 或宿主信任权限。持久 bootstrap 保留显式参数而不固化当次默认值；worker 把已经解析的 off/on 写入环境副本，防止冻结实验的关闭选择被机器开启覆盖。

当前增量删除 native-only 的平台目录分支，直接复用 effective_runtime_root；摘要绑定的恢复页仍在读取 registry 前返回，所以损坏 registry 不会破坏原始捕获的恢复。这比新增路径开关或要求用户每次补参数更小。on 路径可内联最多3 KiB首页，再按原4 KiB分页读至EOF；旧 command 仍从零重启，不能把单页内容当成完整基线。

具体改动

完整31文件范围为 +849/-57。本轮先完整检查 cff37c2，再读取 cb 的两个路径增量；29个路径 blob 完全一致，旧页面、图片与类型检查证据保留原修订来源，没有重标为新构建。新增的四个真实CLI用例覆盖绝对/相对registry目录与双向开关。

关键代码讲解

1. apply_context_machine_options 先处理显式off、worker off和摘要绑定恢复，再由既有 effective_runtime_root 解析 registry/override。保存、native setup/hook/project和隐式恢复现在选择相同runtime；生成的继承hook固定到该runtime，另一目录不再干预。
2. project_saved_context_capture 复用原捕获读取器返回首页；UTF-8 offset、完整摘要、后续分页和从零重读沿用原协议。可选首屏读取失败仍有原命令，原捕获和Turn不变，也不重跑guard或扣费。
3. run_once 把已解析的试验off/on传给预检与solver，保留调用方输入；它不创建第二种trial设置。

规范依据是事先读取的 docs/reference/required-work-context.md@9b8adda2f04c，配置来源还绑定到既有 machine-config owner。capture-integrity、default-off-and-host-scope、configuration-source 均在当前头有实现和实际证据。新增机器默认说明不是其自身的验收oracle。安装态采用和真实完整成本未在这个本地增量中宣称完成。

对主干的风险

未发现当前阻塞项。最强反例一直是“保存开关和消费开关来自不同目录”：同一registry选择A、平台默认B，不显式传root。此前 cff37c2 仍在此处失败；当前 cb 用同一未改的独立probe、同一fixture fingerprint重新执行，结果如下，显式固定A的控制组同样正确。

状态	旧 cff 实际	当前 cb 实际
A=on，B未配置	关闭	启用A
A=off，B=on	启用B并建目录	保持关闭，不建B目录

四个新增回归还覆盖绝对和相对registry位置、hook固定A，以及registry损坏后的摘要恢复。该修复足以映射此前唯一P1 finding；历史失败输出保留，未把旧失败重写为通过。当前四模块100项通过、10项可选跳过；另外显式启用现有Codex的合成回环选测17项通过，包含前述10项可选和重叠用例，不将两组相加冒称独立数量。没有付费模型、live benchmark或用户hook安装。

实际基线9b8与当前cb的9组完整关闭态观察完全一致，包括完整工作/结算文字、诊断、恢复和回执：原文件未改、一份原准入、零额外扣费、不创建原生目录。其他已声明宿主继承机器on仍保留full，显式不支持on仍拒绝；worker File/SQLite关闭态与ASCII/UTF-8分页、截断和可选读取失败均有原生或真实CLI证据。

语义与 CI 对齐

复用既有off/on、HostSurface、scheduler和page词汇，新增可选机器namespace不授予执行或宿主信任。内联首页改变on路径的读页顺序；原基线、完整恢复、interaction contract与settlement义务不变。diff advisory支持范围内未发现新词汇载体；其盲区仍由源码语义审查承担，当前完整semantic canary通过。按配置未查询或等待远端CI。

我的整体评价

APPROVE，交付判断 justified_increment；long_horizon 为 preserved，user_experience 为 improved。反例修复后的有用增量是一次保存即可供现有受支持入口可靠读取，而不是新增配置壳。局部删除分支已经完成必要的同域简化，没有扩大为新架构。完整成本与真实成果收益仍未知，不把作者的请求token代理测量当作本评审的模型费用或效果结论。

宽屏的差分上下文卡片保留单个 Codex 开关；390px 开关和保存状态可读，支持范围按需展开，明确区分已保存偏好与未验证的实际使用。旧的五张编辑器图片只作为历史对照，四张当前图片已重新检查。

未验证安装态 Desktop、所有宿主以及真实模型的自主采用与完整费用；实际页面使用隔离配置后端，未启动付费模型。

设置页开启/关闭/读回及390px展开是本轮独立运行的 cff 打包证据；所有相关UI、布局、HTTP配置owner与九张图片在cb的blob未变，故显式复用。当前cb标准premerge的6项直接检查、19项自动项通过，父命令仍exit1/manual_review_required，保留九张图片和一项benchmark-sensitive人工hold；图片像素、来源与元数据已经单独检查，未改写原gate。正式旧review/线程协调、exact-head merge-readiness、维护者merge授权和真实安装采用仍分别处理。

English verdict: APPROVE for cb5950fdb4be57f8253131ac2be75d7104d77a1e. The original two-runtime counterexample now passes both directions using the unchanged independent probe. Current focused/native checks, complete disabled parity and automatic premerge constituents pass. Installed adoption, real model outcomes/costs, manual holds and merge authority remain separate.