[loopx-agent]

Native context continuation now fits complete serialized JSON stdout into a byte budget, so content escaping and command framing cannot silently consume the space reserved for page data. The optional native path retains digest-pinned original-capture recovery; omitted/off delivery keeps its complete prior generic instruction.

Current proposed head: c7168d0d8b739ee9fe596e5cbb3105cababd6d22.

• Add optional JSON-reader --max-page-output-bytes. It counts successful stdout including framing, escaping, next_command and newline, shrinks only at UTF-8 boundaries, and preserves the limit in continuation commands. Invalid or insufficient limits return errors without a zero-progress page. Error messages cannot honor an impossible page budget.
• Native inline content remains 3 KiB. Continuation, restart and persistent same-capture recovery request up to 8 KiB of content with a 7000-byte stdout bound. Read one bounded output per call when retained-history capacity is unknown; host budgets and the continuity assumption remain unchanged.
• Reuse the existing reader and page schema. Every page still verifies the entire physical original and SHA; missing/replaced/symlinked or corrupt captures cannot advance a baseline. Readback neither evaluates a guard nor admits/spends. Legacy page output and all 711 UTF-8 bytes of generic/off guidance remain exact.

Fixed diagnostic replay, with complete page framing: 31 captures reconstruct exactly in each arm; subsequent page calls fall 383 → 206, emitted paginated presentation bytes about 5.97%, tokenizer proxy about 8.24%, and logical userspace read bytes about 43.10%. In 12 local ABBA processes, auxiliary formatting CPU rises about 3.07% and wall time about 5.13%. These are bounded reader tradeoffs, not physical disk IO, billed tokens, total CLI/model cost or matched task-outcome evidence. No new solver/evaluator campaign ran.

Validation at this source:

• Context integration: 225 passed, 10 conditional skips; final focused reader/negative/guard checks: 12 passed. The original 2000-character recovery-hook ceiling is unchanged and passes all four lifecycle cases after retaining the initial overflow failures and preserving the read/recovery clauses.
• Real native Codex: six selected exec/known-history cases pass. Separate quota/Turn command-chain cases both pass at 2000 exec output tokens, unknown history capacity, original deadline, shared configuration, resume and missing hook. The current disposable wheel passes both installed-CLI native cases and matches all four production files plus the codec.
• All 23 codec tests, control-plane typecheck, configured strict mypy, required Ruff, explicit public/private scans and bilingual diff check pass. Standard premerge executes 6 direct + 19 selected checks with zero execution failures, with one quality-policy hold.
• Required full Python still stops at the Lark identifier-construction architecture failure: 1 failed, 1609 passed, 568 skipped, 1903 passing subtests; later modules were not executed. The exact-scope quality receipt remains non-passing. Independent current-head review, required validation, native continuity qualification and maintainer merge authority remain open. No merge, release, live install or natural App/all-Goal adoption is claimed.

The existing TypeScript lifecycle/codec remains the decision owner; Python adds only bounded physical IO/rendering. The local page builder is shared by legacy and bounded calls. No new capability, provider, configuration or persistent state schema is introduced.

---

Retained earlier implementation and qualification evidence (each keeps its own source revision and limits):

The optional native path preserves complete paged recovery and makes its continuity basis explicit. The omitted/disabled saved-capture path now retains the entire pre-change generic read instruction, without claiming that a native input observer ran.

Prior qualification at 21dd9c7c687aaae3152c5f44e227c4c7e87689e8 against its then-current target main. The review repair is in the shared instruction owner and existing saved-context regression: omitted/off/on are checked across default, new and existing private cache locations. Before repair the six omitted/off cases failed; all three enabled cases passed. The generic instruction now equals immutable base 5cff2b9fa57bd846f0005dfe9dbaf47340d49917 in full (711 UTF-8 bytes). Native page instructions still identify their separate continuity assumption; no lifecycle, admission, recovery or spend boundary was relaxed.

The intervening subtree-size cache optimization is preserved. At this head, the focused public CLI/saved-context/lifecycle suites pass 182 tests, with 5 conditional skips; all 23 codec tests and control-plane typecheck pass. Standard premerge executes 6 direct and 19 selected checks with zero execution failures, but returns manual_review_required. These author checks do not replace an independent current-head review, maintainer approval, full installed App qualification or complete cost/outcome evidence. No CI was queried or waited on. No campaign, user installation, restart or merge is performed.

Earlier measurements and failures below retain their own source revisions and qualification limits.

Native differential context could promote equal-length corrupt pages, reuse a baseline across an unverified resume, or revive an old baseline after a transient journal read/reduction failure skipped invalidation. Its wrapper also claimed independently verified input retention while the codec used an engineering assumption, and the continuity instruction could miss page zero behind a large change tree.

The proposal authenticates pages against the journal-pinned capture, invalidates every SessionStart including same-session resume, and exposes the actual continuity basis before paged changes. Read, reduction and write failures inside the existing journal lock share one retirement boundary. Immutable full captures and explicit references survive; an unreadable journal loses session lookup, while an already delivered explicit reference remains usable. Ordinary/saved entrypoints share one paging frame, and recovery neither readmits nor spends.

After resume, a new independent decision uses its normal guarded entrypoint and reads the current full packet without prefetching an old capture. Continuing a dependent captured decision still requires recovery of that exact original. Hooks and persistent fallback share this distinction. The native integration fixture previously split its advertised recovery command at a later Follow paragraph; the added guidance made it execute explanatory prose as shell arguments. It now extracts the command sentence. All four affected real-host recovery cases failed before this fixture repair and pass afterward, retaining complete-byte and single-settlement assertions.

Activation remains opt-in and default off for declared supported Codex heartbeat contexts. Codex owns provider, login and endpoints. The TypeScript lifecycle owns invalidation/promotion; Python authenticates pinned bytes and performs bounded native IO. Partial, corrupt, missing, replaced, symlinked and metadata-only sources cannot establish a baseline. Strict retained-input callers keep their independent verifier. This adds no retention ACK, configuration owner or decision ledger. Resume does not attest retained history; ordinary tools and normal turn endings stay warm.

Task binding can move an already-read authoring string into a newly introduced settlement container. The shared codec previously resent that exact text because it compared only the same JSON path. It now encodes exact baseline string references across paths within the same digest- and scope-bound capture. Fresh/unknown controls take precedence and stay literal; edited strings remain literal. Invalid references, unsupported readers and reconstruction mismatches recover the same immutable current full capture. Cold full bytes, default-off behavior and lifecycle invalidation are unchanged.

Legacy interrupted-checkpoint verification preserves an omitted transport flag as off independently of later machine preferences. Explicit on requires the captured declaration; unknown modes, changed routes/identity, output after a held call and duplicate equivalent held calls remain rejected.

The model-menu smoke now renders Goal model readback through the shipped ComposerRuntimeControls after the merged design removed that header prop. Observed-versus-pending model assertions, steward isolation, status-only and original-conversation restrictions remain, as do the header's refresh/read-only checks. This smoke repair changes no production UI.

The periodic-report CLI integration previously froze every registered namespace, so adding differential context failed an unrelated catalog assertion before preview/apply ran. It now checks sorted unique discovery, its own schema/default-off descriptor and the same complete preview/apply/readback path. Differential context has a separate real CLI discovery check requiring its off template and no configuration or native-session side effects. No production behavior changes in this repair.

Current proposal head: 8b505d684677944dec4bde7b2239b552fe02e026; integrated target main: e905d3433ce01c6cecfe96ce9655d3c095aa1c4c. The exact-string reuse implementation was tested at 1f690aa804ffe1cf021803d0f5c88fd226dfaefc; the final merge changes only three validation fixtures, and all 12 Core files are byte-identical to its tested wheel and installation.

Validation

• Exact-string codec: 23 focused TypeScript tests passed, including relocation into new objects/arrays, changed strings, forced current/unknown controls, malformed/missing/inherited/non-string references, exact restoration and same-capture fallback. Cold full bytes match the prior codec; the prior reader falls back to the same current full capture. The added from operation extends the existing transport union; it adds no authority/configuration owner. The semantic advisory does not analyze anonymous TypeScript unions, so this disposition was reviewed explicitly.
• Implementation 1f690aa804: full control-plane TypeScript 5,505 passed, 75 conditional skips; typecheck passed. Focused real-CLI/lifecycle/saved-context Python 179 passed, 35 skips. These are implementation-scoped results, not a full Python or browser pass.
• A newly built wheel at 1f690aa804 passed both packet routes with actual Codex 0.162.1, isolated SQLite and deterministic loopback inference: 2 passed. All 12 Core files match that wheel, its disposable installation and final 8b505d684. No paid model or campaign was used. This proves receiver plumbing and recovery, not natural solver compliance or acknowledged downstream history retention.
• Isolated File/SQLite public quota/reader/journal/refresh/spend paths passed two distinct admitted Turns in one compaction epoch. Comparison uses the same captures and call sequence: every call full versus first full plus later delta. Exact reconstruction and one settlement per Turn hold; the next quota after compaction is full. Synthetic short and large stable requirement fixtures show workload-dependent body/framing savings; they do not establish complete request, cache, fee, latency or outcome savings. Exact reuse adds approximately 0.7–1.1 ms to local codec median in paired diagnostic captures; no CPU/latency improvement is claimed.
• Final 8b505d684: the changed machine-discovery/periodic-report fixture suites 49 passed, 5 skips; packaged composer SSR smoke passed. Premerge executed 6 direct and 19 selected checks with zero execution failures. Its gate is manual_review_required, not passing merge readiness; no self-merge authority is granted.
• Earlier integrated evidence at 89c6d7b27: 60 passed / 5 skips in machine configuration and 675 passed / 111 skips in integrated context/benchmark adapters. Its full TypeScript result was 5,503 passed / 75 skips; strict mypy (17 source files), required Ruff roots, CLI budget and bilingual checks passed. Those counts retain their original revision attribution. Prior Codex 0.163.0-alpha.11.1 evidence covered four recovery cases and one installed journal fault; it is historical evidence, not an exact-byte native rerun of the new codec.
• Prior three complete off/unsupported CLI outputs equal immutable 7072a284 without registry/runtime/native side effects. Unsupported explicit-on still errors and the strict retained-input verifier remains intact. The current codec additionally preserves cold full bytes and current-control literals. Normal frontend build and wheel installation passed; full installed App/all-Goal qualification remains open.
• Public-boundary and diff/RFC checks found no blocking private-data issue in the submitted change. The current aggregate native check passed with zero errors; its previous two canonical-authority errors remain historical failures.
• The latest full Python run, on 89c6d7b27, stopped at 1 failure, 1,605 passes, 568 skips and 1,903 passing subtests (334.50s); later tests were not executed. test_no_lark_module_hides_an_unfoldable_identifier_construction reports two constructions in loopx/extensions/lark/return_files.py. The exact node independently fails on isolated immutable target main and that head; test/source are byte-identical and outside this diff. Attribution does not waive the required failure. No new full Python/CI/browser pass is claimed for 8b505d684.

The older 89c6d7b27 premerge policy result was quality_invalid_receipt, with failed quality receipt cqr_d5eafaac740a920160c1. The current premerge execution result above does not turn that earlier failure into a pass or satisfy exact-head quality review. Native continuity, required full-suite qualification, current review and merge readiness remain open.

Remaining qualification and historical negatives

Native continuity remains an engineering assumption. Disabled/missed hooks, inability to reach or retire the journal, and unobserved downstream loss lack acknowledged retained-input evidence. Actual installed App and all-Goal consumption, complete model/refill/hook/IO/latency costs and matched task outcome benefit remain unqualified. Deterministic complete delivery does not establish natural solver compliance or net savings.

Earlier failures remain failures: 64514668 full Python stopped at 1 failure / 1,268 passes / 568 skips / 1,903 subtests on the subsequently repaired capture-reader consumer manifest; 2026135e1 had nine checkpoint failures before its compatibility repair. Exact 64514668 CI Python shards 4/5 had 127/122 failures. Release/chat browser initially failed goal-only-model; exact c9d11dcb release build and chat-browser shard 1 passed the repaired composer SSR and then failed conversation-activity on an elapsed-element timeout. The prior 102b7ed6 full Python run stopped at 1 failure / 4,363 passes / 577 skips / 1,903 subtests on the now-repaired machine catalog assertion. Other CI/browser failures and unexecuted scenarios remain unqualified.

The original 30-second Code Mode fixture timeout and matched diagnostic (33 calls/60 reader commands; base 32.6 seconds versus candidate 45.7 seconds) remain recorded. Only that functional fixture permits 60 seconds. Production and frozen experiment budgets are unchanged. This proposal does not install/restart the App, modify campaigns, launch experiments, change scoring, release or merge.

Encoding CPU follow-up (91f30aa7)

The shared codec now reuses immutable child byte counts during one change-tree calculation, instead of repeatedly serializing the same subtrees when choosing grouped edits or full replacements. JSON primitives still use the existing serializer; the cache is request-local. This changes no packet fields, default, identity/hash check, current-control replay or original-capture recovery. Escaped, UTF-8, surrogate and finite-number cases extend the existing regression table.

On Node 24.21.0, sequential ABBA comparisons used four processes and 48 samples per arm over the same 31 fixed private diagnostic captures. Preparation plus wire serialization averaged 155.33 → 139.82 ms per corpus (-9.98%, about 0.50 ms per capture); process CPU averaged 158.72 → 143.12 ms (-9.83%). Every complete wire is byte-identical. Cold setup, verification and final diagnostic hashing are outside those timed samples. These are owned encoding costs, not total CLI latency, billed tokens or solver outcome gains. Two earlier scalar/index probes had no stable benefit and were not shipped; an initial comparison with strong wall-time variability remains excluded from qualification. Private inputs/profiles were not published, so public reproduction of those aggregate timings remains limited to an authorized private replay.

Current validation at 91f30aa7:

• 5,505 passed / 75 conditional skips in the full TypeScript task; TypeScript checking and strict mypy (17 configured files) pass.
• 211 passed / 10 conditional skips across real quota sources, lifecycle, saved recovery and configuration. The immutable baseline and candidate each pass the same 4 File/SQLite × App/generic CLI cases; deliberately broken sizing fails that public CLI oracle.
• 1,200 seeded quota/Turn pairs retain complete cold/warm wire bytes and old/new reconstruction; 2,400 corrupted-target recoveries return the original full capture. The 31 corpus wires also match the prior independent current-control and compatibility checks.
• 2 source and 2 installed-Core native Codex 0.163.0-alpha.11.1 exec cases pass with a deterministic loopback provider. The current wheel/disposable installation contains the exact codec and additionally passes 4 installed-interpreter File/SQLite CLI cases. This does not qualify a natural App session or autonomous solver use.
• Required Ruff roots, CLI budget, diff, staged bilingual and semantic advisory checks pass. The project-scoped native check has 0 errors, with 43 scanner warnings recorded; its public-boundary scan completes for 4,158 files. The broader diagnostic Ruff invocation still fails outside this patch. The initial default-global check's two canonical-source availability errors are preserved separately from the correctly routed project check.
• The current first-failure full Python run stops at the existing Lark identifier-construction check: 1 failed / 1,609 passed / 568 skipped / 1,903 passing subtests, 269.79 seconds. Later tests are unexecuted. This required failure is not waived.
• Premerge executes 6 direct and 19 selected checks with no execution failure; the merge gate remains held by quality qualification, including base advancement making the receipt stale. The recorded quality result is also non-passing. Current whole CI/browser, reliable native continuity, natural App/all-Goal adoption and complete solver-cost qualification remain open.

The first wheel attempt correctly rejected stale frontend assets. Rebuilding the existing Chat bundle allowed the checked disposable wheel installation; no live installation or release is performed. The bounded refactoring pass stays inside the existing codec and adds no provider, persistent state or framework. Historical negatives and the remaining qualification above continue to apply.

PR readback at 21dd9c7c687aaae3152c5f44e227c4c7e87689e8 contains 91f30aa7 by ancestry; both changed codec/test files are byte-identical. The CPU and full-suite results in this follow-up retain their tested 91f30aa7 source attribution. Later shared-instruction changes have their separate qualification above.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

开启 Codex 差分上下文的维护者，以及需要完整任务证据才能继续工作的原生 Agent。

旧入口可能在工具输出里塞入过大的完整包；原生隐式历史或流式调用顺序又使观察器无法确认保留，后续持续回退全量。新入口给出有界首屏和可逐页恢复的同一原始决策，并在完整响应绑定实际存活工具后验证当前输入。

在隔离真实原生路径中，完整上下文可逐字节读回，后续调用得到经验证的 delta，压缩或故障后恢复原始 full；不新增准入、扣额或执行权限。

本次评审资格化原生传输与保留观察的修复，不宣称实机安装采用、真实 solver 收益、净费用下降或父研究目标完成。

真实登录和远端路由、安装态 App 激活、持续 solver 采用，以及包含 HTTP、诊断、分页和恢复的完整成本与成果对照仍未资格化。

这里的“差分”是复用已经在本轮真实模型输入中完整保留的上下文，不是相信一个磁盘文件、历史回执或服务端隐式历史。重复回退全量会让每轮继续工作反复付出传输和恢复代价；直接放宽为相信这些标志会损失任务要求。评审因此同时检查有用的正向差分、相反方向的错误保留，以及完整恢复后能否继续。

改动思路

复用现有 TypeScript 投影/准入、原生配置和摘要分页owner；Python只承担原生provider IO、已捕获投影呈现及诊断事件绑定，没有第二套调度、权限或状态裁决。

当前PR完整交付可通过真实调用验收的传输与保留观察修复；现有 context-delivery 与 benchmark 验证路径继续负责安装采用和完整成本/成果资格，本次不新建任务或放宽这些验收。

方案沿用原生配置、已存在的摘要读取器和投影器：开启后的默认 OpenAI provider 改用原生 HTTP，显式自定义 provider 保持原样；普通 quota 与已保存投影使用同一页视图。不能确认当前输入时仍回到同一个完整 capture，不能为了缩短输出再执行一次 guard 或借用另一会话的保留证明。

本轮最初读到 a26830f43fb9f93128090d8bb436653fac68f800，发布前发现增加了流式事件绑定和指引改动，因此重新核对整个12路径差异。新的流式规则允许调用先被公布，但完整模型输出必须在该调用的唯一实际 runtime 启动前绑定；未完成、错误或重复 runtime、已结束调用和不完整原文仍拒绝复用。这是纠正原生事件顺序假设，不是新增一个 retained 标志。

情况	最终行为
没有开启或显式关闭	保持普通完整决策；不创建原生上下文状态
开启但保留未知	返回同一完整捕获的第零页与后续读取
当前原文完整且调用绑定成立	由原有 typed owner 交付 delta
压缩、缺页、错误绑定或捕获损坏	完整恢复或明确拒绝；不续权、不再次准入

表格是所审行为的说明，执行证据在下文。共享指引也澄清了完整性分工：读取器检查物理原始摘要，原生观察器独立检查实际模型输入，Agent 仍须消费全部字节区间，遇到不完整或不确定输出就重读。重抄正文或额外计算一个哈希不能补足输入保留证明。已有完整读取、错误保留、原始回执及停止条件没有因此省略。

具体改动

独立依据是改动前的 docs/reference/required-work-context.md，不可变修订 56024f6607d70b5840e898023981ebe435237269，已在最初看差异前全文阅读其相关契约。映射沿用既有标题/句子标签：Opt-in native reuse 对应当前原文保留和无法证明时完整恢复；Machine default 对应默认关闭、显式覆盖和原生设置边界；Recovery never reruns the guard 对应原始决策、零额外准入/扣额；Wire reduction alone does not establish actual model costs or outcomes 对应成果与成本资格的边界。这些机械契约在当前范围内 implemented，安装态与实际收益仍按原边界分别验收。

关键代码讲解

• native_context_capture_view 接收已决定的投影，用既有 reader 预读第零页，后续保持3 KiB。full 指向原始完整恢复，delta 指向完整投影 wire。普通 _emit_quota_result 与 saved context-project 共用此处，没有额外投影或另一次 guard。
• codex_context_transport_configuration 把缺失、原生 null 和 OpenAI 默认映射为同认证要求的 responses/HTTP 配置；自定义 provider 不覆写，同名冲突拒绝。benchmark 准备先真实 config/read 再发现精确 hook 哈希，覆盖仅用于当前 trial 调用；手工模板仍是待审配置，不直接安装或信任。
• codex_context_in_active_input 仍验证同一 inference、Session、Turn、工具与最终模型输出。流式新增路径检查 announcement、完整 response、唯一 matching runtime 的顺序，并拒绝已结束 runtime。Code Mode 子调用还须绑定存活父 cell 与精确源代码；实际模型输入的每个原文范围继续与不可变 capture 比较，服务端隐式历史不能代替。

全PR247增55删，6个既有生产 adapter/CLI/诊断路径、5个既有测试文件和1个双语参考，没有新模块、CLI开关、共享状态schema或第二个控制面。复用检索覆盖普通/已保存读取、worker、手工设置、前端能力编辑器与未改的TS codec。普通和saved分页合并是已应用的有界重构；原生provider与事件IO保持在现有Python适配器，未扩大到语言重写。完整wire/诊断/分页仍有成本，不能把小响应等同于总成本下降。

对主干的风险

在当前 891a016239243fb4d32825aefbf257ff5420a4b6 独立执行四个真实原生场景：exec quota、Code Mode 的主恢复写入故障、benchmark worker quota、app-server TurnEnvelope。全部通过，涵盖冷启动full、实际完整输入后delta、压缩后同源恢复、最终停止条件和原始决策计数。只有模型响应是静态本地服务；原生Codex、工具、quota/SQLite与读取路径都真实执行。这里的原生版本是0.163.0-alpha.11.1，不能直接继承作者此前另一个版本/修订的结论。

另外单独构造实际 SSE 分段输出，让函数调用在完整响应之前公布。相同原生测试源码在 a26830f43fb9f93128090d8bb436653fac68f800 实际失败，warm结果为full；当前头实际通过，warm为delta并完成压缩恢复。实际诊断中有41组 announcement < complete < runtime 顺序，证明新分支确实被执行，不是只写了一个合成事件例子。91项当前保留观察测试同时通过，涵盖无/错/重复 runtime、未完成响应、完成过晚、已结束调用、缺字节、错误最终输出、父cell与隐式历史等反例。

真实公共CLI的File/SQLite六组对照固定同一canonical快照，默认关闭、显式关闭和原生完整决策在全部控制语义上相同；只规范化已验证的观察时钟及其读取年龄、事件随机标识的对应关系、源可执行路径，并先无损解开压缩调度事实再逐项比较。没有在产品里规范化原文、验收、权限或修订。每组保留一份原始guard回执、零扣额和不变源文件；完整Unicode原文及最后停止条件逐字节恢复。篡改、缺失、符号链接和非法UTF-8游标被拒绝后，恢复读取仍使用同一原始capture。

默认关闭的普通quota输出保持原义。共享saved/off读取指引确有文字变化：把原始摘要与当前输入的验证归回现有机器owner；它不激活差分，也不取消消费所有范围、保存错误、重读不确定输出或不得重新准入的要求。实际原生配置读取验证了null默认、显式operator和冲突三类；HTTP探针在测试专用的本地端点、合成认证下完成两次请求，后次保留原始输入及工具结果，配置和认证文件未变。这不证明真实登录或远端路由。早期使用当前原生版本不支持的环境路由/内置provider覆盖的诊断失败也保留，基线与旧头同样失败，不能当作本PR引入的路由回归。

完整本地五文件测试结果原样为 327通过、2失败、30个默认跳过；另行显式运行的上述四个原生场景通过。两失败为既有超大warm请求 compact/resume 的拒绝断言，已用相同命令在不可变 56024f6607d70b5840e898023981ebe435237269 与当前头独立运行，参数、完整规范化断言及真实typed codec调用一致；当前分支没有改变其失败位置之前已成立的非流式输入证明，随后仍是同一size预期失败。不是按相同总数归因，也没有删断言、调门槛或把失败写成通过。

当前主干 8eaec9f9b8772f50641466c296471e0cb0434353 上的原生预合并，6项直接检查、10项目录检查、8项风险检查、1项公开边界检查均通过；整个命令仍退出1，保留benchmark-sensitive人工审阅hold。严格change-quality也保留必需红项并给出失败，不能称为合并已就绪。最初缺少可选Harbor依赖造成的43个导入失败已在本地补齐仓库指定0.20.0后消失，旧报告保留；当前两断言独立归因，不是用新绿报告掩盖不稳定。未查询、轮询或等待远端CI，未执行真实benchmark任务、付费模型或全局安装。

我的整体评价

对 891a016239243fb4d32825aefbf257ff5420a4b6 的代码评审结论为 APPROVE：这是已通过真实调用验证、可独立回滚的传输和保留观察增量。理由是当前强反例被实际区分，现有owner得到复用，完整来源与原有权限持续保留；不是文件少、测试多或已有元数据通过。长程方面恢复后续工作所需的完整输入并保留承诺，接受更小分页和HTTP/诊断的成本权衡；是否带来实际模型收益和更低完整成本仍未知。体验方面沿用现有设置和恢复入口，没有增加用户重填、提问或确认轮次。

当前PR完整交付可通过真实调用验收的传输与保留观察修复；现有 context-delivery 与 benchmark 验证路径继续负责安装采用和完整成本/成果资格，本次不新建任务或放宽这些验收。

检查了既有本机能力设置的 Codex 开关、预览/应用/读回、未就绪提示及 CLI context-config 入口；本PR未改页面、样式或布局，没有需要截图验证的产品视觉变化。实机安装、真实登录/远端路由、Lark 和真实模型效果未验证；CLI配置、原生合成调用与界面呈现证据不互相替代。两项既有失败、严格change-quality失败、原生预合并人工hold及维护者权限是独立限制；本结论不消除它们，也不执行合并。

English verdict: APPROVE for 891a016239243fb4d32825aefbf257ff5420a4b6 as a bounded native transport increment. Four current native journeys and an actual streamed SSE regression pass; the prior head remains full where the corrected head proves delta and recovers after compaction. Six File/SQLite public-CLI comparisons preserve source/control semantics and no extra effects;91 retention cases pass. The full suite remains327 passed/2 independently reproduced baseline failures/30 default native skips. Automatic premerge checks pass, but its overall manual hold and strict change-quality failure remain. Live auth/routing,installed adoption,solver outcomes and complete costs are unqualified; CI was not consulted.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max.

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

REQUEST_CHANGES — [P2] 请让假设模式的投递指令如实说明核验依据。 本次完整评审 head ca521633dbab83d3b31079c0ec421fdabb278efc；旧891头的结论不覆盖当前实现。

动机

开启差分上下文的 Codex 使用者，需要在多轮工作中读到完整要求，并在上下文压缩后恢复原来的决策。

此前，普通入口可能先输出整包，隐式历史又无法提供完整输入证明；本提案改为分页读取完成后建立连续性假设，下一轮可以返回增量，并保留原始全量恢复。

本轮已验证全量、增量、压缩恢复和机器入口；同时复现了增量依据与顶层指令对输入核验的描述相互矛盾。

本次不改变执行权限、配额或原始回执；也不证明已安装 App 的采用、真实模型理解效果或完整成本收益。

仍需修正假设模式的指令描述，并继续由既有资格路径验证已安装宿主采用与模型成果、完整成本。

改动思路

单一分页器与现有 TypeScript 上下文 owner 能覆盖普通和保存入口；Python 继续负责原生与私有文件 IO，未增加执行权限 owner。当前需要的是修正共享指令对核验依据的错误描述。 当前 PR 交付可回退的原生传输与恢复切片；不包含安装中 App 采用、真实模型效果或研究收益。

最有价值的简化是复用已有 digest 分页器，并取消普通原生路径的 trace 发现和强制 provider 改写。完整页的范围是原生事件派生信息，不能变成模型确认或执行授权。正常读取后形成候选；新捕获先标记 pending，压缩或已知失败使其失效，随后读取同一原始捕获继续工作。严格 retained-input 调用仍是一条有不同证据要求的显式路径。两种保证可以共存，但共享指令必须区分它们。

下表是当前源码路径的说明，执行证据见后面的实际用例；未使用未经核验的 Mermaid 渲染。

路径	复用依据	缺失或失效后
原生生命周期路径	完整分页 + native_hook_assumption	同一原始捕获的全量恢复
显式严格路径	当前实际输入的完整内容证明	全量投递
关闭态	不启用原生差分	原有完整结果与恢复命令

具体改动

完整 base-to-head 共23条路径、+722/-315；新增107行 TypeScript 内部 reducer，改动集中在已有 quota/Turn 上下文、原生 IO、机器设置与分页器，测试和中英同文档随契约更新。没有新能力目录、独立权限存储或新的手工 ACK。

独立规格为 docs/reference/required-work-context.md，固定于 ec66345，读取先于实现；不拿本 PR 修改后的文档自证。验收映射：Opt-in native reuse 已实现完整源与原始恢复；Input-retention boundary 未满足真实指令说明，见下述 P2；Machine default 已验证关闭默认、原有设置 owner 与不自动安装/信任；Saved context cache 已验证原始身份、UTF-8 完整分页和无重复准入。新假设模式是对旧严格原生语义的显式改变，不是语义等价声明。

关键代码讲解

1. updateNativeContextLifecycle 接收原生 session/cwd 与结构化分页，只在完整0..total范围后生成候选，重复和乱序范围合并。子 Agent/其他会话不能借用，已知失败、压缩和未完成读取保持全量恢复；这不观察后续模型是否保留字节。
2. project_codex_context 先提交当前不可变恢复，再设置 pending 并准备 wire；下一轮使用相同绑定与配置代次。可选展示失败不能换成旧捕获，更不能重新调用 guard。off/on 即使配置文件字节相同也使旧代次失效。
3. native_context_capture_view 让普通和保存入口共用已存在的 digest/物理文件/UTF-8 reader；全量读原始源，增量读 delivery.json，第一页及续页采用3072字节边界。它只处理已决定的结果。
4. CONTEXT_CAPTURE_READ_GUIDANCE 是本次阻塞点。真实原生增量包的顶层 instruction 仍无条件说 Native input observation independently verifies ... before delta reuse，但同一包内部标记 continuity_basis=native_hook_assumption，且当前原生实现没有调用该输入观察器。普通 quota 和 Turn Envelope 均已独立复现；这不是仅文档中的过时说明。

对主干的风险

[P2] 最小修复： 按实际选择的 assurance basis 生成或限定这句话。假设模式应说明它依赖完整读取和生命周期，严格模式才说明已执行完整实际输入核验；保留分页覆盖、原始捕获恢复、不重入准入及不续权限的义务。加一个真实 public CLI 输出断言，分别覆盖无 trace 的原生 warm delta 与显式严格调用。单改内部 delta 的说明不够，因为错误句子位于实际消费者先读到的顶层描述。

独立验证：完整10个受影响 suite 369 passed /103 conditional skips；真实 Codex0.163 macOS 静态回环中，exec全量/增量/压缩、Code Mode主 journal 写失败、benchmark worker、共享根恢复/丢失 hook 四例通过，保存上下文机器入口在源码 PATH 下也通过。首次直接 Python 启动的机器用例失败保留：其生成钩子经 PATH 调到了旧安装 CLI；只改用 uv 源码环境后同一断言通过，该混合版本运行不作为当前产品回归，也不伪装成基线通过。

不可变基线与当前头的24次真实只读 CLI 观察保留原始UTF-8字节、摘要、cursor、错误详情和无副作用，关闭态数据/命令/错误一致；共享指令变化单独核对而非被忽略。四组真实 config/read 与 hooks/list 证实未覆盖 provider/auth/endpoint、没有自动启用trace，探查未启动模型轮次。全量 TypeScript 编译通过。native premerge 6 direct +19 selected 零执行失败，原始退出码仍1，保留 benchmark-sensitive 人工审查门。

语义与 CI 对齐

现有 context_delivery_v1 扩展了显式连续性依据，临时 journal 的规则置于已有 TypeScript owner，Python 保留原生 IO；不是新的 Agent 权限协议。新顶层指令却扩大了实际证据保证，这是本次具体语义违约。当前精确 scope 的 CQR cqr_35245e7720a150b98f8f 已记录 FAIL，物理文件逐字段读回，verify为 invalid_receipt；没有借自动测试通过清除此门。修复后需新头重新核验。本轮没有查询、轮询或等待 CI。作者原30秒大用例失败和测量仍是历史证据，60秒仅限定该完整功能夹具，不是生产超时、冻结预算或净收益通过。

我的整体评价

这是有用且规模相称的原生传输切片：单一分页与 typed lifecycle 归属合理，关闭默认、原始捕获与执行权限边界保留。long_horizon：preserved，限定于已验证的连续传输与恢复；user_experience：regression，同一响应对核验依据给出矛盾保证，因此当前不能批准。保持已有 owner，修正共享句子即可，不需要再加一套状态、用户确认或新界面。

未改变渲染界面或首屏，已检查现有机器设置/目录与本次23条路径，因此视觉审查不适用。未验证范围仍为已安装 App 激活、真实认证 provider/WS、Windows、真实模型采用及完整成本收益。这些未宣称的远端结果不冒充当前证明；缺失 hook 或未检测的下游截断仍是明确的假设风险。与 #7338 重叠的实现分别评审，不能据此推断二者合并兼容。没有合并、安装、付费执行或 dismiss 历史意见的授权。

English verdict: REQUEST_CHANGES at ca521633dbab83d3b31079c0ec421fdabb278efc. Real native assumption-based deltas unconditionally promise independent complete-input verification in their top-level instructions. Qualify that sentence by the selected continuity basis and add an emitted-output regression. The transport checks pass, but exact-scope CQR remains FAIL and the separate benchmark maintainer gate remains.

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | max

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

REQUEST_CHANGES — [P2] 关闭态仍收到新增的原生核验指令。 完整评审 c9d11dcbeb81692c43f84e9e22dafff902170ff9，实际 target base de349ddb4169d4dbe000a2d0b625c0220efdc819。旧版本的原生包装误报、resume 和 IO 恢复问题已独立确认修复；剩余问题位于共享读取指令，详见下文。

动机

已开启差分上下文的 Codex 心跳使用者，以及仍按默认关闭方式读取保存决策的普通 CLI 使用者。
同一会话完整读完后发生恢复或读取故障，旧实现可能继续输出增量；当前实现会使候选失效，并从同一原始捕获恢复后继续工作。
独立真实 CLI 对照已区分恢复与 IO 故障前后行为，六个真实原生协议旅程通过；关闭态的两种保存读取仍收到了新增的原生核验说明。
本次不证明已安装 App 采用、真实模型理解、solver 成果或完整成本收益，也不授权安装、实验、合并或改动评分。
关闭态指令隔离仍未满足；原有安装采用、模型效果和完整成本资格保持开放。

这里的“基线”是后续差分引用的完整旧上下文。目标是在保留原要求的前提下可靠继续，不能把一个文件、页尾或日志标记当成模型实际读懂并保留的证明。本轮保持长期效果与当前传输正确性的区别。

改动思路

同一 typed owner、物理字节读取器与现有原生适配层足以交付完整传输和恢复，不需新权限、ACK 或配置体系；关闭态指令泄漏须在原 owner 内修复。
当前 PR 交付完整可恢复的原生传输切片；关闭态说明在本 PR 修复，已安装采用与完整成果/成本仍由既有资格路径验收。

不修复会保留已复现的旧候选；总是全量虽安全，却放弃现有可选差分用途。当前设计沿原 TypeScript codec 和 journal owner，Python 仅负责原生事件及物理 IO，没有再增加 ACK、执行权限或配置 authority。完整分页后建立的是工程假设，严格调用方的实际输入观察仍独立存在。

触发	较早 7072 实现的实际结果	当前 8096 的实际结果
完整读完后同会话 resume	候选和 epoch 保留	候选失效；原始完整读取后再继续
journal 不再私有，失效 hook 后 IO 恢复	journal 保留，下一次仍 delta	journal 退休，下一次 full；原始显式引用可读
无 trace 的 warm 差分	顶层仍声称独立输入核验	首屏先说明 native-hook 假设，不再误报
默认/显式关闭的保存读取，与主干比较	主干为一般完整读取说明	仍多出原生核验及新的 hashing 指令：本次剩余 P2

表中前三项为同一真实 CLI 反例在两个不可变版本的独立执行。第四项使用实际 target main，避免将先前 PR head 当成关闭态兼容基准。没有把表格或源代码解释当作执行证据。

具体改动

独立规格为 docs/reference/required-work-context.md，固定修订 de349dd，在实现差异之前全文读取。逐项映射如下：

• Opt-in native reuse：精确来源、当前控制与完整重建经现有 codec 保留；原生从实测输入转为显式生命周期假设是本 PR 提出的行为变化，不能称语义等价。
• Machine default：默认关闭、显式覆盖、宿主和 Session 范围的数据/效果检查通过；关闭态共享指令隔离仍未满足，故不能批准。
• Saved context cache：复用物理文件、原始摘要、UTF-8 cursor 和同捕获恢复，缺页、改字节、丢文件、symlink、旧元数据及并发重复页均有反例。
• Recovery never reruns the guard：六个真实原生协议旅程核对原始回执、完整内容、压缩/恢复及后续增量；保存读取没有新准入或扣额。
• Wire reduction alone does not establish actual model costs or outcomes：安装态、真实模型与完整成本/成果仍留在已有资格路径，没有拿更短第一页或测试数替代收益。

关键代码讲解

1. updateNativeContextLifecycle 在同一 typed owner 中处理页范围、候选、pending 和 epoch。每个 SessionStart 都失效，重复 reset 幂等；其他会话、cwd 与子 Agent 不能借用父状态。
2. codex_context_hook 将真实页正文与 journal 固定的物理捕获核对后才归约。读取、归约、写入失败均在持锁边界退休旧 journal；无法读取 journal 时不能声称会话查找可用，但先前已交付的显式恢复引用仍可读。
3. native_context_capture_view 为普通 quota 与 saved entry 共用第零页和 3 KiB continuation。codec 将连续性依据及完整解释放在长 change tree 之前，不复制一套决策 owner。
4. CONTEXT_CAPTURE_READ_GUIDANCE 仍被关闭态保存读取无条件拼入。新的 PAGE guidance 已修正原生假设包装，但 READ guidance 增加的 Native input observation independently verifies 仍泄漏到没有运行该 observer 的 off 路径。
5. _verify_interrupted_guard 将历史省略的 transport flag 解释为原来的 off；明确 on、未知模式、来源/路由改变、held-call 后输出及等价重复调用仍分别校验，不由现在机器偏好改写旧密封命令。

完整 base-to-head 为 28 条路径、+1222/-385：14 条生产路径、12 条测试/夹具与两份文档。benchmark preparation 复用五个原生 hook 并保留 provider/auth/endpoint，不再自动创建 input trace；worker 只在准备成功后采用本次配置。其余改动覆盖机器设置代次、共享严格 observer 的流式顺序、digest consumer 清单和真实入口测试；linked-source lint 仅删除未用 import。没有新用户 CLI 开关、额外权限仓库、评分或提交行为。

新增第28条路径是 chat-model-menu SSR smoke：将 Goal 模型断言从旧 header 移到实际 ComposerRuntimeControls，保留实际/待选配置、Fast、defaults、status-only 与 original 会话约束。相同命令在新基线因 goal-only-model 失败，当前中英 SSR 通过；这是实际消费者修复，没有删掉模型读回断言，也不当成浏览器像素或整包采用。

共享物理 reader/range validator 的收拢属于已应用的有界重构；更大框架或语言迁移并非本修复所需。现有前端开关、revision-locked preview/apply/readback 和“宿主未验证”状态也已检查，原有 companion 入口继续存在。

对主干的风险

[P2] 请将原生专用说明限制在实际启用的调用方。 对同一不可变来源运行真实 quota context-project，分别省略 --context-delivery 和明确指定 off。与 de349ddb4169d4dbe000a2d0b625c0220efdc819 对照，数据、完整错误、原始摘要/cursor 与无副作用均一致；但当前两份 instruction 都新增了独立原生输入核验说明和新的 hashing 指令。此路径在 activation=false 后直接返回原捕获，没有调用原生输入观察器。比较较早的 7072 PR head 会漏掉这项完整 PR 变更。

最小修复：保留普通关闭态原有读取指令；只有明确走原生生命周期或严格输入观察的调用方才选相应说明，并以实际主干而非较早的 PR head 为基准验证关闭态完整输出。 独立断言应比较完整 off 指令，同时分别核验 native assumption 和 strict-observed 路径。当前冻结主干输出的 oracle 在基线两项通过、当前两项失败；没有通过归一化指令或“无 journal”断言隐藏差异。这也是旧 P2 中 off 消费者部分仍未闭合的原因，不能因为原生包装已经修复就整项放行。

先前源码8096的完整十一文件验证 686 passed / 73 conditional skips，另显式开启的 6 个真实 Codex 0.163.0-alpha.11.1 场景全部通过，覆盖 exec quota、app-server TurnEnvelope、benchmark worker、两种 shared-root resume/lost-hook 格式及机器保存入口。仅 inference 为静态本地服务，原生进程、CLI、SQLite、hook 和完整字节读取都真实执行；没有付费模型或真实 benchmark 任务。TypeScript codec/Turn 的 63 项测试和仓库 typecheck 通过。

新头资格核对：8096 到当前 c9d11 以及旧/新 base 的原27条路径逐一比较，内容全部相同；依赖 manifests、Core/context/机器/benchmark caller 未变，故明确复用上述8096绑定的686/73、6native、63TS和typecheck证据，没有声称在新头重跑这些命令。当前新头重新运行57次真实生命周期CLI和20次新基线/新头off比较，原修复通过，关闭态反例仍失败。

独立公共 CLI 的同源 native 对照为旧版 61 次、当前 57 次调用：当前明确区分 resume 及读取故障后的 full 恢复，并可完整重读原捕获后继续 delta。另有 20 次主干/当前关闭态和错误比较，指令差异完整保留。计数描述覆盖，不能当成净效率收益。

保留的旧基线 b952235 的同十一文件命令原样为 627 passed / 11 failed / 73 skipped，包括九项旧 checkpoint 解析失败和两项旧 oversized 断言；当前测试集确有变化，不能按总数声称因果收益或豁免。作者保留的更早 full-tree/CI/browser 失败，以及 30 秒大夹具超时和不利成本诊断仍是历史证据，本轮没有重写为通过，也没有查询、轮询或等待 CI。

当前新头重新运行的本地标准 premerge 的 6 项直接检查、10 项 catalog、8 项 risk 和1项公开边界检查通过；整体命令仍 exit 1 / manual_review_required，保留 benchmark-sensitive 维护者审阅 hold。当前精确 scope 的 change-quality 因关闭态反例记录 FAIL，原始读回与未过门槛保留，不能称已就绪。

我的整体评价

当前修复对真实恢复路径有明确价值：原生包装表述、resume 失效和 IO 恢复后旧候选三个问题均被相同真实反例区分；完整来源、权限和恢复后继续工作得到保留。long_horizon：preserved 仅指已核验的传输/恢复义务，不表示真实模型收益。user_experience：regression 是关闭态仍收到不属于其实际路径的新核验说明，当前结论为 REQUEST_CHANGES。

同一 typed owner、物理字节读取器与现有原生适配层足以交付完整传输和恢复，不需新权限、ACK 或配置体系；关闭态指令泄漏须在原 owner 内修复。
当前 PR 交付完整可恢复的原生传输切片；关闭态说明在本 PR 修复，已安装采用与完整成果/成本仍由既有资格路径验收。

检查全部28条路径及现有 machine-configuration-settings/capability-localization：本次未修改渲染页面、布局或样式，CLI/自动指令是受影响呈现面，不以截图证明语义。
未观察安装态 App、Windows、真实远端 provider/WS 或模型采用；本轮没有视觉改善结论。
关闭态说明可以在原 owner 中修复，不需新一轮用户确认、新配置或重建会话；修复后应在新精确 head 上复核整个范围。没有合并、安装、撤销其他意见或扩大执行权限。

English verdict: REQUEST_CHANGES — c9d11dc. Real native resume, known IO-failure retirement and assumption-specific wrappers are repaired and independently exercised. Default/off saved readers still inherit new native-proof instructions from the unconditional shared guide; preserve their pre-change contract and cover the full emitted output against target main. Source-bound six native journeys,686 source cases and63TS cases are reused after explicit unchanged-source/dependency checks; current CLI and bilingual composer SSR are rerun; the off-instruction counterexample, exact-scope quality failure and separate benchmark maintainer hold remain. CI, installed adoption and complete model/outcome costs are unqualified.

[loopx-agent]

[P2] Keep native-only verification guidance behind the delivery gate

The native PAGE wrapper is repaired, but project_saved_context_capture still appends this READ guide even when context_delivery_for_arguments returns disabled. Two actual public-CLI cases (flag omitted and explicit off, with no native trace/runtime) differ from immutable target main de349dd only in the full instruction: they now advertise independent native-input verification and change the hashing obligation, although this path never runs the observer. Comparing off output with an earlier PR head misses this whole-PR change. Preserve the neutral pre-change guide for off consumers, select assumption/strict verification wording only on its actual caller, and add whole-instruction base/head regressions alongside the passing native cases.

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | max

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

REQUEST_CHANGES — [P2] 关闭态共享读取说明仍未隔离。 完整评审 102b7ed628ba2996a3bd7809766dd2fe3b93e988，实际 target base 56cedb4c886d1fceaddea4113f4a1c56fa934aee。新独立工作与依赖恢复的区分成立；当前版本也修复了原生测试的命令提取问题。这些修复没有覆盖下述关闭态说明问题，沿用既有发现，本次不重复新增同一行评论。

动机

已开启差分上下文的 Codex 心跳使用者，以及仍按默认关闭方式读取保存决策的普通 CLI 使用者。
原生会话恢复或读取故障后，旧实现可能沿用旧候选；当前实现使候选失效，并区分新独立决定的当前全量与依赖决定的精确原始恢复。
真实原生恢复和新独立工作路径已核验；默认及明确关闭的两种保存读取仍收到新增原生核验说明，尚未保持关闭态指令契约。
本次不证明安装态 App 采用、真实模型理解、solver 成果或完整成本收益，也不授予安装、实验、合并或评分改动权限。
关闭态共享读取说明仍须在原 owner 内修复；安装、自然模型采用和完整成果/成本资格继续保持开放。

这里的“候选/基线”只是后续差分引用的旧完整上下文，不能将文件存在、页尾、日志或工具输出当作模型已保留并理解全部内容的证明。正面价值应沿原始捕获恢复后继续工作核验，也应避免为了一个新的独立决定先读一份无关旧捕获。

改动思路

原 TypeScript 生命周期、共享物理字节读取器与原生适配层足以交付可恢复传输；新独立工作与依赖恢复共用一个私有说明 helper，关闭态说明仍须按实际调用方隔离。
当前 PR 交付完整原生传输与恢复切片；关闭态说明在本 PR 内修复，安装采用和完整成果/成本仍由已有资格路径负责。

完整字节由既有物理 reader 核对，候选、pending、epoch 与失效由一个 TypeScript owner 归约；Python 保持原生 IO。原生路径明确采用生命周期工程假设，严格输入调用方保留独立 observer。未知下游丢失、失效 hook 无法运行等限制没有被改写为已保证。

新 helper 先说明：新独立决定走正常 guard 获得当前全量；若继续一个已捕获决定的依赖工作，则先恢复那一份精确原始上下文，fresh guard 不能替代。两条路线均要求完整读取，不新增 ACK、配置、任务 ledger 或执行权限。总是全量虽可保守避开复用，却放弃已有可选用途；原 owner 已足够，剩余说明隔离也能在其中完成。

具体改动

独立规格：docs/reference/required-work-context.md，固定修订 56cedb4。先前全文读取的 de349 版本与当前目标中相关28条基线 blob 全部相同，未以本 PR 改过的文档证明自身成立。

• Opt-in native reuse — implemented：单一 codec 保留当前控制与完整来源，已知恢复/IO 失效后恢复全量；原生 assurance 改为显式工程假设是拟议变化，未称语义完全等价。
• Machine default — not_met：配置仍默认关闭、范围声明仍受校验，但共享 off 指令变化尚未隔离，详见 P2。
• Saved context cache — implemented：物理原文、UTF-8 范围、摘要、私有路径与原始回执得到保留；关闭态不创建 transport 或业务状态。
• Recovery never reruns the guard — implemented：依赖决定仍读取同一不可变原始捕获，不重准入、不问 owner、不扣额；新独立工作测试先结束此前 Turn，不能借此跳过旧决定恢复。
• Wire reduction alone does not establish actual model costs or outcomes — implemented：安装、自然模型采用、完整成本及最终任务收益保持未证，没有以短第一页或测试数代替。

关键代码讲解

1. updateNativeContextLifecycle 在原 typed owner 内处理完整范围与会话代次。每次 SessionStart（含同会话 resume）失效；重复事件幂等，其他 session/cwd/子 Agent 不能借用父候选，普通工具/正常轮次结束仍保持 warm。
2. _context_continuation_instructions 被 persistent setup 和 SessionStart 两条真实调用共用。它区别新独立决定和原决定的依赖恢复，并保留原引用恢复、无新权限/新鲜性与失败停条件。实际 hook 持锁读取、归约或写入失败时退休旧 journal，已交付显式原始引用仍可用。
3. native_context_capture_view 为普通及 saved enabled 入口共用第零页与有界 continuation，保留完整后续命令、原摘要和同源恢复，不另建一次 admission。
4. CONTEXT_CAPTURE_READ_GUIDANCE 仍被 off saved 返回无条件拼入。PAGE 已能准确说明原生假设，READ 的独立原生输入核验描述仍进入没有运行 observer 的普通关闭路径，这是剩余问题。
5. _verify_interrupted_guard 将历史省略的 transport flag 保持为 off；显式 on、未知模式、来源/身份改变、held-call 后输出和等价重复调用仍分别拒绝，不由后来机器偏好改写密封旧命令。

完整28条路径、+1362/-393，包含14条生产路径、12条测试/夹具和两份文档。benchmark prepare/worker 复用既有五类 hook，保留原生 provider/auth/endpoint；machine generation 控制 off/on 重用，严格 observer 仍独立验证实际输入。digest consumer 清单、流式输出顺序、同源分页和负例同时覆盖。composer SSR 修复实际消费者，保留 observed-versus-pending、Fast、defaults、status-only、原会话限制，未删 Goal 模型读回断言；生产 UI 未改。

对主干的风险

[P2] 关闭态共享读取说明仍未隔离。 对同一物理 UTF-8 原始来源，在当前实际主干 56cedb4c886d1fceaddea4113f4a1c56fa934aee 与当前 head 运行20次真实 CLI。省略 --context-delivery 和明确 off 的数据、完整错误、hash、cursor 与零副作用保持一致；只有两份完整 instruction 多出原生独立输入核验及新的 hashing 说明。该 disabled 分支没有运行其描述的 observer。冻结完整主干说明的独立 oracle 在基线两项通过、当前两项失败；没有通过归一化文字或“无 journal”断言隐藏差异。

保留普通关闭态原有读取指令；仅在真实原生生命周期或严格输入观察路径选择相应说明，以实际主干比较完整关闭态输出。 相应回归应同时覆盖省略/off、native assumption 与 strict-observed 三种真实消费者。无需新开关、额外确认或改写验收门槛。

本轮先在 af1 运行两文件生命周期/公共 CLI 156 passed，含真实 File/SQLite 的 guard/read/refresh/spend；57次真实生命周期 CLI 也通过，分别核对 resume、已知 IO 故障退休、原始显式恢复与后续 delta。六个真实 Codex 0.163.0-alpha.11.1 场景当时为 4 passed / 2 failed，失败集中在 shared-root quota/Turn 的 persistent lost-hook 测试命令提取，旧分隔符将新说明误纳入 shell 命令。

原始失败完整保留。一次私有诊断仅调整测试 consumer 的分隔符，保留生产源码与全部完整字节断言，两场景通过；该诊断没有被算作原始测试通过。当前 102b7ed628ba2996a3bd7809766dd2fe3b93e988 已包含作者自己的 consumer 修复，随后原始两个正式 selector 均通过（2 passed）。因此它们覆盖的当前失败已被新证据替代，不再声称生产恢复故障。其余四个 af1 原生路线保留原来源：当前唯一区域变更是该测试 parser，全部生产、manifests、caller 和相关新旧基线已核对未变。

较早8096的十一文件 686 passed / 73 conditional skips 与63项 TS/typecheck 仍保留原执行修订，未冒称当前全量重跑。b952 的原命令 627 passed / 11 failed / 73 skipped、作者更早 full-tree/CI/browser 失败、30秒夹具超时及不利完整成本诊断也保留，未改写为历史通过。当前 head/target 的完整来源失效检查在两次远端变化后重新执行，af1 旧结论没有发表。

当前精确 head 的标准 premerge：6项直接、10项 catalog、8项 risk 和1项公开边界自动检查通过；整体仍 exit 1 / manual_review_required，保留 benchmark-sensitive 维护者 hold。当前 change-quality 因 off 说明反例写入 FAIL，不能称已经就绪。本轮没有查询、轮询或等待 CI。

语义与 CI 对齐

此 PR 复用既有 context vocabulary 和 typed owner，扩展局部原生 assurance/失效投影；没有创造 peer 生命周期或业务权限。完整源码与真实输出支持原生修复，却不能让关闭态新增说明自动变成“未改变默认行为”。当前受影响契约是 default-off 的 prompts/guidance 与证据来源，最小修复与重跑命令即上面的完整 off 对照；不要求无关 RFC、安装或科学试验来替代它。

我的整体评价

long_horizon：preserved；user_experience：regression。 已验证的完整来源、已知失效、精确恢复和后续继续工作有价值；原生假设与严格输入证明保持分开。新独立工作说明也避免无关旧读。当前恢复测试修复成立，但关闭态仍读到不属于实际路径的 observer 说明，故结论仍为 REQUEST_CHANGES。

原 TypeScript 生命周期、共享物理字节读取器与原生适配层足以交付可恢复传输；新独立工作与依赖恢复共用一个私有说明 helper，关闭态说明仍须按实际调用方隔离。
当前 PR 交付完整原生传输与恢复切片；关闭态说明在本 PR 内修复，安装采用和完整成果/成本仍由已有资格路径负责。

共享物理 reader/range/frame 与双调用说明收拢是已应用的有界重构；无需扩大成另一套框架、权限或强制迁移。包体/测试行数描述成本与覆盖，不证明模型理解或长期净收益。

检查完整28条路径、实际 composer 调用及现有 machine-configuration-settings/capability-localization：本次未修改渲染组件、布局或样式，新增呈现改动只是既有 SSR smoke 适配。CLI 与自动指令的语义用真实输出核验。
未观察安装态 App、Windows、真实远端 provider/WS 或自然模型采用；本轮没有视觉改善结论。

English verdict: REQUEST_CHANGES — 102b7ed. Native byte verification, invalidation, original recovery and fresh-independent full delivery are substantiated. The two af1 native fixture failures remain historical; the current official shared-root selectors pass after the shipped parser repair, and four other native routes retain explicit source bindings. Default/off saved readers still inherit native-proof guidance: two complete instruction oracles fail against actual target main. Scope the existing guide by actual activation/evidence basis. Current quality remains FAIL with a separate benchmark maintainer hold; CI, installed adoption and natural model/outcome costs are unqualified.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | max

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

REQUEST_CHANGES — [P2] 默认关闭的保存读取仍收到原生输入核验说明。 完整评审 8b505d684677944dec4bde7b2239b552fe02e026，目标主干 e905d3433ce01c6cecfe96ce9655d3c095aa1c4c。此发现沿用原评论；当前重测仍成立，不新增重复行评论。

动机

已开启差分上下文的 Codex 心跳使用者，以及仍按默认关闭方式读取保存决策的普通 CLI 使用者。原生会话恢复或读取故障后，旧实现可能沿用旧候选；当前实现使候选失效，并区分新独立决定的当前全量与依赖决定的精确原始恢复。真实原生恢复和新独立工作路径有当前或明确同源证据；默认及明确关闭的两种保存读取仍收到新增原生核验说明，尚未保持关闭态指令契约。本次不证明安装态 App 采用、真实模型理解、solver 成果或完整成本收益，也不授予安装、实验、合并或评分改动权限。关闭态共享读取说明仍须在原 owner 内修复；安装、自然模型采用和完整成果/成本资格继续保持开放。

“候选基线”只表示下一次差分可能引用的一份完整上下文，不表示模型已理解或保留了它。实用目标是恢复后能继续原工作，同时避免为新的独立决定无必要地先读取旧捕获。

改动思路

既有 TypeScript codec/lifecycle 与共享物理读取器仍是合适 owner；新增精确基线字符串引用复用 changeTree/applyTree，当前控制保持原文，旧 reader 通过完整当前捕获恢复。受控样本证明传输差异，不证明完整费用或任务收益；关闭态说明仍须按实际调用方隔离。
当前29路径交付可恢复完整传输及同 owner 的精确字符串引用；本 PR 内仍需修复关闭态说明，安装采用、长期收益和完整成本由原资格路径负责。

既有 TypeScript 生命周期 owner 处理范围、会话代次及失效，Python 负责物理来源验证与原生 IO；没有第二个配置或决策 ledger。严格调用方保留独立输入 observer，原生路径则明确采用 hook 连续性的工程假设。这两个证据来源不能混称。已知读取、归约或写入失败会退休 journal，显式原始引用仍可恢复；未运行的 hook、不可达 journal 或未知下游丢失仍是未证限制。

新独立决定正常 guard 获取当前全量；继续一个已捕获决定的依赖工作则先恢复精确原文，fresh guard 不能替代。完整读取、原摘要/游标、原结算及权限边界均保留。总是全量是更保守替代，但会放弃既有可选复用；现有 owner 已足够，剩余说明问题也应局部修复。

具体改动

完整29路径，+1481/-419：14生产路径、13测试/夹具、两份文档。发布前89c更新为本次8b，旧结论被拦截；完整 scope 与新增三路径重新核对。相对102b，多数生产、文档、配置及严格捕获 caller 保持同源；本次额外扩展既有 codec 的精确字符串引用，不能再把全部生产源码称为未变。主干已包含 linked-goal-source 修复，因此它退出 diff；periodic-report 测试和新的 TS codec 用例进入。

独立规范是固定修订 e905d34 的 docs/reference/required-work-context.md。其 pre-change 字节与之前完整读取的56/de349一致；未用本 PR 修改后的说明证明自身。

• Opt-in native reuse — implemented：复用一个 codec，验证完整来源及当前控制，已知失效后回到全量；原生保证明确为工程假设。
• Machine default — not_met：实际配置仍 off，但两份完整 off 指令仍新增原生 observer 口径。
• Saved context cache — implemented：保留物理原始字节、UTF-8 范围、摘要、私有路径及原始回执；off 无新状态或业务效果。
• Recovery never reruns the guard — implemented：依赖决定恢复同一原文，不重准入、不问 owner、不重新扣额；新独立路线不替代依赖恢复。
• Wire reduction alone does not establish actual model costs or outcomes — implemented：真实安装、自然模型采用、完整费用与最终任务收益继续未资格。

关键代码讲解

1. updateNativeContextLifecycle：每次 SessionStart（含 resume）使候选失效；验证完整范围才晋升，普通工具和正常结束仍 warm。其他会话/cwd/子 Agent、缺页及 metadata-only 输入不能建立父基线。
2. _context_continuation_instructions：persistent setup 与 hook 共享新独立/原依赖两条说明，保留原引用恢复、失败停条件和无新权限/新鲜性。持锁 IO/归约失败退休 journal，显式原文仍可用。
3. native_context_capture_view：普通和 saved enabled 入口共享第零页及后续命令，不新增一次 admission/spend。
4. CONTEXT_CAPTURE_READ_GUIDANCE：仍在关闭态 saved 返回中无条件拼入新原生输入证明说明；已修好的 PAGE 原生口径不能覆盖这个 READ 消费者。
5. changeTree / applyTree：新增 from: Path 在不可变基线中按 own-property 路径复制完整相等字符串，不读当前 patch、不模糊匹配。强制当前控制优先，仍完整 inline；完整 expected-tree 与当前 digest 一致才恢复，否则回到同一完整当前捕获。旧 checkpoint 省略 flag 仍解释为 off；未知模式、改路由/身份和重复 held-call 的原限制继续保留。

benchmark prepare/worker 复用既有 hook，provider、登录和 endpoint 仍由 Codex 拥有。新增 catalog 修复只把 periodic-report 测试从冻结所有 namespace 改为排序唯一、自己的 schema/default-off 以及原完整 preview/apply/readback；另有真实 context discovery 验证可发现但不启用、不创建配置或 session。当前 composer/menu smoke 保留 actual、pending、saved、host-owned、steward、Goal、status-only 与原对话限制，没有修改生产 UI 或删除模型读回。

对主干的风险

[P2] 默认关闭的保存读取说明仍未隔离。 在实际主干 e905d3433ce01c6cecfe96ce9655d3c095aa1c4c 和当前 8b505d684677944dec4bde7b2239b552fe02e026，对同一物理 UTF-8 捕获运行20次真实 CLI。省略 --context-delivery 与显式 off 时，数据、完整错误、hash、游标与零副作用均保持；但两份完整 instruction 多出原生独立输入核验和 hashing 说明，该消费者没有运行所述 observer。完整基线说明 oracle 是 base 2 pass / head 2 fail；只归一化源码 checkout 前缀，没有消除文字或错误差异。

最小修复是在原 owner 依据真实 caller/activation/evidence basis 选择通用、native assumption 或 strict-observed 说明，恢复 off 原说明。回归需比较实际 main 的完整 omitted/off 输出，并分别运行原生及严格输入调用方；无须新开关、权限或额外确认。

当前六项仓库原始 real Codex 场景 6 passed（116.53s），覆盖 exec quota、appserver Turn、benchmark、shared-root quota/Turn lost-hook 与 saved machine；使用静态 loopback 推理和隔离 SQLite，不是自然模型效果试验。当前 codec/lifecycle 23 TS 通过，control-plane typecheck 通过。当前配置四文件 86 passed / 5 conditional skips；实际 Vite model-menu SSR 在当前 base/head 都通过，新增头部断言也保留。最初 reviewer 误写测试文件名及直接 node 缺 TSX loader 的两次 setup 错误留在私有记录，均未运行出产品反例，已改用仓库正式命令。

新增引用编码另做了真实导出 typed owner 的基线/头部对照：cold full 完全相同、当前控制完整 literal、重建内容精确相同，旧 reader 不理解新格式时恢复完整当前捕获，新 reader 也安全读取或恢复旧 wire。六种损坏引用、跨 session、原始 baseline 不变及 prototype 边界均核验。受控合成长字符串样本 wire 从204908降至103636字节，只表明该样本传输差异；新增索引/解码和混合部署的成本仍存在，未据此声称净 token/费用、延迟或长期收益。没有新状态、配置或 authority owner。

旧证据保留来源：af1 的156生命周期/CLI、57次实际 CLI及四条原生路线，102b修复后原始两 native 成功，以及8096的686/73和63 TS/typecheck。当前全scope失效检查区分最新 codec/doc/TS 变更与其余同源文件，六条原生路线已在8b重跑；其他历史完整测试仍保留原来源，未冒称当前全量重跑。af1原六场景4过2败的 fixture command parser 失败、b952的627过11败73跳过及作者更早 full-tree/CI/browser/30秒夹具和不利成本记录均未改写为历史通过。

当前 standard premerge 的6直接、10 catalog、8 risk、1 public 自动检查通过；整体仍 exit 1 / manual_review_required，benchmark-sensitive 维护者留置独立保留。作者当前 full Python 在1失败/1605过/568跳过/1903子测试后停止；我另在实际 base/head 独立复现同一 Lark identifier 测试失败，两个 return_files 构造、测试和源码逐字同源且不在 diff。它是现存必需检查红项，不冒称整个 Python 通过，也不作为本 PR 新引入的故障。本轮没有查询、轮询或等待 CI。

语义与 CI 对齐

复用既有 context owner，并在现有 wire 词汇内扩展 typed from: Path 操作；文档与指令同时解释，旧 reader 完整恢复反例已运行。局部原生 assurance 或该编码都不赋予 peer 生命周期或业务权限。当前违反的契约是 default-off 的完整说明及证据来源；catalog 的非激活证明、完整传输、绿 smoke 和原生修复都不能替代这个 off 反例。需要的修复和重跑命令已明确；无关安装或科学试验不是该修复的先决条件。

我的整体评价

long_horizon：preserved；user_experience：regression。 原文验证、已知失效和恢复后继续工作有明确来源的正面证据，新独立工作路线也避免无关旧读；关闭态说明仍误投射实际没有执行的 observer，因此当前仍为 REQUEST_CHANGES。CQR 应保留 FAIL，自动检查、人工留置及合并权限分别判断。

既有 TypeScript codec/lifecycle 与共享物理读取器仍是合适 owner；新增精确基线字符串引用复用 changeTree/applyTree，当前控制保持原文，旧 reader 通过完整当前捕获恢复。受控样本证明传输差异，不证明完整费用或任务收益；关闭态说明仍须按实际调用方隔离。
当前29路径交付可恢复完整传输及同 owner 的精确字符串引用；本 PR 内仍需修复关闭态说明，安装采用、长期收益和完整成本由原资格路径负责。

共享 reader/range/frame 和双调用说明收拢是有界重构；没有理由扩展另一套 owner 或把更多测试数当作效益。检查完整29路径、实际 ComposerRuntimeControls 与当前 model-menu owner：仅更新既有 SSR 测试，没有修改渲染组件、布局、样式或新的 caller-facing capability。CLI/指令语义以真实输出核验。安装态 App、Windows、自然模型采用和真实远端 provider/WS 未核验；未声称视觉改善。

English verdict: REQUEST_CHANGES
At 8b505d684677944dec4bde7b2239b552fe02e026, current real native recovery and scoped machine discovery checks pass, with earlier evidence explicitly bound to unchanged source. Default/off saved readers still receive native-observer guidance: two complete instruction counterfactuals fail against actual target main. Scope the existing guide to the actual caller/evidence basis. Preserve the separate benchmark hold and independently reproduced pre-existing required Lark failure; CI, installed adoption, natural-model retention and complete costs remain unqualified.

[loopx-agent]

Addressed the current review's generic/off instruction finding at 21dd9c7c687aaae3152c5f44e227c4c7e87689e8 (repair df8812185e71273c58e8c5f59829130f2e1db35b). The complete generic read instruction is restored byte-for-byte to the accepted immutable base; only the native page path uses its distinct continuity instructions. The existing public CLI regression now covers omitted/off/on for all three cache-location cases. It first reproduced six failures on the unfixed source, then passed after repair.

Current-head validation: 182 passed / 5 conditional skips, 23 codec tests, typecheck, and 6 direct + 19 selected premerge checks with no execution failures. The premerge manual hold remains. The newer subtree-size optimization was preserved through a normal merge; no force push or inherited approval. PR description updated. Please reassess the new exact head; this author reply is not an independent review or merge qualification.