huangruiteng · Oct 29, 2026 · Oct 29, 2026
@@ -31,7 +31,7 @@ appendix may keep dated history, but no dated log heading may precede it.
 | [RFC: Capable Agent Manager and Semantic Work Handoff (v0)](capable-manager-semantic-handoff-v0.md) | Accepted | [Personal Follow-through independent proposal](personal-follow-through-v0.md) | [2 entries](ledger/capable-manager-semantic-handoff-v0/) |
 | [RFC: Complete State Recovery and Controlled Reactivation (v0)](complete-state-recovery-v0.md) | Accepted | none | — |
 | [RFC: Composable State Machines and Recovery Verification (v0)](composable-state-machines-recovery-verification-v0.md) | Accepted | none | — |
-| [RFC: Controller / Executor Sessions and One Governed Work Contract (v0)](controller-executor-unified-contract-v0.md) | Accepted | none | [2 entries](ledger/controller-executor-unified-contract-v0/) |
+| [RFC: Controller / Executor Sessions and One Governed Work Contract (v0)](controller-executor-unified-contract-v0.md) | Accepted | none | [3 entries](ledger/controller-executor-unified-contract-v0/) |
 | [Explicit Todo continuation: Stage A](cross-session-memory-substrate-v0.md) | Accepted | none | — |
 | [RFC: LoopX Desktop Execution Frontends v0](desktop-execution-frontends-v0.md) | Accepted | none | — |
 | [RFC: External Evidence Research Capability v0](external-evidence-research-capability-v0.md) | Accepted | none | [3 entries](ledger/external-evidence-research-capability-v0/) |

@@ -28,7 +28,7 @@
 | [RFC：强能力 Agent 管家与语义工作交接（v0）](capable-manager-semantic-handoff-v0.zh-CN.md) | 已接受 | [个人事项持续跟进独立提案](personal-follow-through-v0.zh-CN.md) | [2 条](ledger/capable-manager-semantic-handoff-v0/) |
 | [RFC：完整状态恢复与受控重新激活（v0）](complete-state-recovery-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：可组合状态机与恢复验证（v0）](composable-state-machines-recovery-verification-v0.zh-CN.md) | 已接受 | 无 | — |
-| [RFC：Controller / Executor 会话与统一受治理工作契约（v0）](controller-executor-unified-contract-v0.zh-CN.md) | 已接受 | 无 | [2 条](ledger/controller-executor-unified-contract-v0/) |
+| [RFC：Controller / Executor 会话与统一受治理工作契约（v0）](controller-executor-unified-contract-v0.zh-CN.md) | 已接受 | 无 | [3 条](ledger/controller-executor-unified-contract-v0/) |
 | [显式 Todo 接续：阶段 A](cross-session-memory-substrate-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：LoopX 桌面执行前端 v0](desktop-execution-frontends-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：外部证据研究能力 v0](external-evidence-research-capability-v0.zh-CN.md) | 已接受 | 无 | [3 条](ledger/external-evidence-research-capability-v0/) |

@@ -824,6 +824,13 @@ full encoding and its delta encoding separately so transport reuse cannot hide
 a semantic regression. Controller/executor separation is a later independent
 comparison and cannot explain away a C1 regression.
 
+The [packaged source comparison](ledger/controller-executor-unified-contract-v0/2026-10-29-packaged-source-comparison.md)
+pins mainline quota and the C1 candidate through real File/SQLite CLI delivery,
+file deltas, capture refusal/recovery and once-only settlement. Source fidelity
+improves while cold and observer-output bytes grow on that workload. Exact-byte
+capture checks and standalone numeric hash integrity remain distinct; this
+engineering evidence does not establish net cost benefit or complete C1.
+
 Qualify [human interaction during execution](#human-interaction-during-execution)
 on the same long-running work, rather than disconnected chat demonstrations:
 

@@ -618,6 +618,12 @@ C1 的主要对照是**同一单会话产品路径中的原 quota packet 与融
 传输复用掩盖语义退步。Controller/executor 分离是之后独立的对照，不能用来解释或
 抵消 C1 回归。
 
+[打包来源对照](ledger/controller-executor-unified-contract-v0/2026-10-29-packaged-source-comparison.zh-CN.md)
+固定 mainline quota 与 C1 候选版本，经真实 File/SQLite CLI 验证交付、文件差分、
+capture 拒绝/恢复及一次结算。本负载来源保真改善，冷态和观察器累计输出字节增加。
+精确字节 capture 校验与独立数值 hash 完整性仍是不同边界；这些工程证据不证明
+净成本收益，也不结清 C1。
+
 在同一长程工作上验收[执行期间的人机交互](#human-interaction-during-execution)，
 不能用脱离工作的独立聊天演示代替：
 

@@ -0,0 +1,113 @@
+# Packaged source fidelity and the remaining C1 cost gap
+
+中文镜像：[同名检查点](2026-10-29-packaged-source-comparison.zh-CN.md)。
+
+This checkpoint supports the [single-session comparison](../../controller-executor-unified-contract-v0.md#9-validation-and-acceptance).
+It qualifies source delivery and recovery on a bounded engineering workload;
+it does not establish a net efficiency gain or complete C1.
+
+## Versions and workload
+
+The comparison pins original quota to mainline
+`b201da8bab305d053866aa0d4516b97ba4a4499e` and the proposed unified contract to
+`3afc2d547f6f9ca41368fd4f3f34d8f8dae9edcf` in
+[#7430](https://github.com/loopx-project/loopx/pull/7430).
+These are the tested versions, not a qualification of later mainline changes.
+Each isolated wheel has its own verified frontend source fingerprint;
+1,857 packaged product files match that arm's source, excluding generated Chat
+assets, which pass their separate bundle check. Both use Python 3.14.
+
+Each arm uses the same synthetic active Goal, full selected task and final stop,
+one current-Agent outcome and five peer outcomes with four requirements each.
+Both real File and SQLite authorities are initialized in disposable runtimes.
+The original 24 descriptions, owners, work links and global stop conditions are
+retained. No active Goal or installed host is used as a fixture.
+
+The packaged CLI runs thin heartbeat bootstrap, one admitted App-heartbeat guard,
+saved-file reads, native lifecycle hooks, warm presentation, compaction recovery,
+refusal controls, writeback/spend and their replays. Hook events are synthetic;
+the actual packaged hook and CLI implementations execute. A deterministic
+observer reads full sources to check equivalence. That observer is not a model,
+a recommendation to read every peer body, or evidence of model retention.
+The actual emitted warm delta is separately read and reconstructed against its
+digest-verified baseline and current files.
+
+This is a new matched workload, not a rerun or replacement of the historical
+13,000-byte experiment. The earlier **25,862 > 13,000** failure is unchanged.
+
+## Source and recovery results
+
+Both arms retain the selected task, all 24 requirements and global stops. Early
+spending is refused. Restoring the original capture recovers the same source
+without another admission; repeated writeback and spending commit one effect
+and one debit, leaving the original task open.
+
+The mainline generic codec changes the admitted source's `quota.compute` from
+`1.0` to `1`; its cold, warm-recovery and missing-baseline exact-source predicates
+fail on both backends. Its native cold presentation also carries `1` rather
+than the admitted `1.0`. The C1 candidate preserves the original source through
+these paths. This exercises the source-preservation repairs also proposed
+separately in [#7661](https://github.com/loopx-project/loopx/pull/7661) and
+[#7657](https://github.com/loopx-project/loopx/pull/7657), rather than creating a
+caller-specific numeric policy. Those proposals and C1 adoption are distinct
+from a mainline or installed rollout.
+
+Both native warm files use `captured_file` continuity. Their actual deltas
+reconstruct the current file exactly; missing baselines and damaged deltas
+recover its full body. This proves saved-file reconstruction, not retained
+model input. Mainline's reconstruction is exact relative to its already
+normalized presentation; that does not repair the preceding source loss.
+
+A numeric-only capture mutation distinguishes two integrity boundaries. In C1,
+changing `quota.compute` from `1.0` to `1` still passes the standalone complete
+contract's JavaScript-normalized hash check. Reading the changed file against
+its original byte SHA-256 is refused; restoring the original bytes recovers it.
+The exact-byte capture boundary is qualified for this caller. The standalone
+contract's numeric commitment remains open; neither check substitutes for the
+other or qualifies arbitrary Host input.
+
+Three preliminary author runs remain failed observations: the first fixture
+used a non-active Goal for refinement, the second exceeded the existing
+512-character requirement limit, and the third supplied the forbidden fixed
+output-directory option to `context-project`. The corrected matched cohort
+uses an active synthetic Goal, bounded complete descriptions and the existing
+output-root option. No product limit, assertion or acceptance criterion changes.
+
+## Measured costs and decision
+
+One observation per arm/backend gives the following byte counts:
+
+| Measurement | File: quota → C1 | SQLite: quota → C1 |
+| --- | --- | --- |
+| Initial guard stdout (file manifest) | 5,413 → 5,440 | 5,429 → 5,456 |
+| Cold saved presentation | 65,756 → 68,411 | 65,866 → 68,519 |
+| Cold full-read CLI stdout | 70,568 → 73,533 | 70,680 → 73,643 |
+| Actual warm delta file | 3,761 → 3,755 | 3,769 → 3,763 |
+| Complete observer CLI stdout | 482,505 → 494,464 | 483,299 → 495,250 |
+
+The six-byte warm difference includes fixture-path and surface spelling; it
+does not demonstrate an encoding gain.
+
+The observer makes 38 CLI calls in every arm, including fixture authoring,
+full recovery, refusals and readback. Separate warm-file qualification adds one
+CLI read per arm. In-process codec checks add nine coarse operations per arm;
+C1 also performs one extra standalone-hash negative control. These are explicit
+qualification costs, not a normal Turn's mandatory read policy.
+
+The 38-call elapsed sums are 10.08 → 10.98 seconds for File and 9.41 → 9.57
+seconds for SQLite. Sequential single samples, process/broker startup and the
+chosen full-read observer do not establish a latency effect. The warm follow-up
+timer includes CLI and codec verification and is not a CLI-latency measurement.
+Memory, model tokens/cache/billing, accepted task outcomes, installed App
+behavior and human-attention costs remain unmeasured. Construction and failed
+author probes also remain costs; they are not erased by the completed cohort.
+
+The useful delta is source fidelity and a more complete contract, with modest
+additional cold/output bytes on this workload. There is no demonstrated net
+cost reduction. Continue through existing source/context/journal owners and
+independently usable repair PRs. Use actual caller failures to choose the next
+hash or bridge change; do not infer a need for another full-source carrier or
+parallel hash policy from an isolated assertion. Keep numeric integrity,
+caller/writer cutover, historical-reader retirement and the original-quota
+decision/outcome/full-cost comparison open. The optional two-session study
+remains separate.
@@ -0,0 +1,87 @@
+# 打包来源保真与 C1 尚未闭合的成本差距
+
+English mirror: [matching checkpoint](2026-10-29-packaged-source-comparison.md).
+
+本检查点支持[单会话对照](../../controller-executor-unified-contract-v0.zh-CN.md#9-验证与验收)。
+它验证有界工程负载中的来源交付与恢复，不证明效率净收益，也不结清 C1。
+
+## 版本与负载
+
+原 quota 固定为 mainline `b201da8bab305d053866aa0d4516b97ba4a4499e`，
+统一契约提案固定为 [#7430](https://github.com/loopx-project/loopx/pull/7430) 的
+`3afc2d547f6f9ca41368fd4f3f34d8f8dae9edcf`。这些是已测版本，不代表后续
+mainline 变化已合格。两份隔离 wheel 分别通过自身前端源码指纹校验；各有 1,857 个
+打包产品文件与对应源码一致，不含另经 bundle 校验的生成 Chat 资源。两组均使用
+Python 3.14。
+
+每组使用同一合成 active Goal、完整已选任务及末尾停止条件、一个当前 Agent 成果，
+以及五个 peer 成果，每个成果四条要求。真实 File 与 SQLite authority 分别在可丢弃
+runtime 初始化。原始 24 条描述、owner、工作关联与全局停止条件保留，不以活跃 Goal
+或已安装 host 为 fixture。
+
+打包 CLI 执行 thin heartbeat bootstrap、一次已准入 App heartbeat guard、保存文件
+读取、原生 lifecycle hook、暖态投影、压缩恢复、拒绝对照、写回/扣额及其重放。
+Hook 事件为合成事件，实际执行的是打包 hook 和 CLI。确定性观察器为验证等价而读全量
+来源；它不是模型，不是建议每轮读取全部 peer 正文，也不证明模型保留。实际发出的暖态
+delta 另经读取，使用摘要校验后的 baseline 与当前文件重建。
+
+这是新的同负载对照，不是历史 13,000 字节实验的重跑或替代。
+此前 **25,862 > 13,000** 的失败保持不变。
+
+## 来源与恢复结果
+
+两组均保留已选任务、24 条要求及全局停止条件，拒绝提前扣额。恢复原 capture 后，
+无需再次准入即可读回同一来源；重复写回和扣额只提交一次 effect、扣一次额度，原任务
+保持 open。
+
+Mainline 通用 codec 把已准入来源的 `quota.compute` 从 `1.0` 变为 `1`；两个后端的
+冷态、暖态恢复和丢 baseline 精确来源断言均失败，其原生冷态投影也携带 `1`，而非
+已准入的 `1.0`。C1 在这些路径保留原值。这实际复用了另行提案
+[#7661](https://github.com/loopx-project/loopx/pull/7661) 与
+[#7657](https://github.com/loopx-project/loopx/pull/7657) 的来源保真修复，
+没有建立 caller 专用数值规则。独立提案及 C1 采用，仍与 mainline 或安装采用分开。
+
+两个原生暖态文件均采用 `captured_file` 连续性。实际 delta 精确重建当前文件；
+缺失 baseline 或损坏 delta 时恢复其完整正文。这证明保存文件重建，不证明模型保留。
+Mainline 的重建相对于已经归一化的投影精确，并不修复此前的来源丢失。
+
+仅改变数值写法的 capture 负例区分了两种完整性边界。C1 中把 `quota.compute` 从
+`1.0` 改为 `1`，仍能通过独立完整契约的 JavaScript 归一化 hash 校验；但使用原始
+字节 SHA-256 读取已改文件会被拒绝，恢复原字节后可继续读取。这个 caller 的精确字节
+capture 边界通过验证；独立契约的数值承诺仍开放。两种校验互不替代，也不证明任意
+Host 输入已合格。
+
+前三次作者运行仍记为失败：第一次用非 active Goal 发起 refinement，第二次超过既有
+512 字符要求描述限制，第三次向 `context-project` 传入被禁止的固定输出目录选项。
+修正后的同负载组使用合成 active Goal、有界完整描述与既有 output-root 选项，未修改
+产品限制、断言或验收标准。
+
+## 已测成本与决策
+
+每个组/后端各一次观察，字节数如下：
+
+| 测量 | File：quota → C1 | SQLite：quota → C1 |
+| --- | --- | --- |
+| Guard 首次 stdout（文件清单） | 5,413 → 5,440 | 5,429 → 5,456 |
+| 冷态保存投影 | 65,756 → 68,411 | 65,866 → 68,519 |
+| 冷态全读 CLI stdout | 70,568 → 73,533 | 70,680 → 73,643 |
+| 实际暖态 delta 文件 | 3,761 → 3,755 | 3,769 → 3,763 |
+| 完整观察器 CLI stdout | 482,505 → 494,464 | 483,299 → 495,250 |
+
+暖态的六字节差异包含 fixture 路径及 surface 拼写，不能证明编码收益。
+
+每组观察器均执行 38 次 CLI 调用，包含 fixture 编写、全量恢复、拒绝及读回。暖态文件
+独立验证每组另加一次 CLI 读取；进程内 codec 检查每组另有九次粗粒度调用，C1 还多做
+一次独立 hash 负例检查。这些是明确计入的资格验证成本，不是正常 Turn 的必读策略。
+
+38 次调用的耗时之和，File 为 10.08 → 10.98 秒，SQLite 为 9.41 → 9.57 秒。
+顺序执行的单次样本、进程/broker 启动及所选全读观察器，不能证明时延效果。暖态补充
+计时包含 CLI 和 codec 校验，不是 CLI 时延测量。内存、模型 token/cache/billing、
+验收成果、已安装 App 行为和人工注意力成本仍未测量；构造与失败作者探测也仍是成本，
+完成后的对照组不能抹除它们。
+
+本负载的有效变化是来源保真与更完整的契约，同时增加了少量冷态和累计输出字节，
+没有证明净成本下降。继续复用既有 source/context/journal owner，优先交付独立可用
+修复 PR；根据实际 caller 失败选择下一项 hash 或 bridge 改动，不从孤立断言推导出
+需要另一份全量来源 carrier 或平行 hash 策略。数值完整性、caller/writer 切换、历史
+reader 退出和原 quota 的决策/成果/完整成本对照继续开放；可选双会话研究另行验收。
@@ -212,6 +212,12 @@ host prompts. A common capture does not unify those consumers. Qualification
 checks source obligations through composition, reconstruction and actual final
 input; new-admission cutover stays separate from historical receipt replay.
 
+The [pinned packaged comparison](ledger/controller-executor-unified-contract-v0/2026-10-29-packaged-source-comparison.md)
+qualifies C1 source/recovery behavior on real File/SQLite fixtures but records
+larger cold/output bytes and an open standalone numeric hash boundary. Preserve
+that counterevidence and the original outcome/full-cost gate; a working saved-file
+delta or once-only receipt does not establish long-horizon benefit.
+
 Use that RFC’s C1–C9 task/deletion map within the existing work streams: first
 qualify unified single-session inputs, then role binding and shared lifecycle,
 replan/result authoring, executor exchange, benchmark reuse, packaged App

@@ -162,6 +162,11 @@ C1 的[消费链切换表](controller-executor-unified-contract-v0.zh-CN.md#c1-
 共享 capture 不表示这些消费者已统一。资格检查须追踪来源义务经过组合、重建到实际
 最终输入；新准入切换与历史回执重放分别处理。
 
+[固定版本的打包对照](ledger/controller-executor-unified-contract-v0/2026-10-29-packaged-source-comparison.zh-CN.md)
+在真实 File/SQLite fixture 验证 C1 来源/恢复行为，同时记录更大的冷态/累计输出，
+以及尚开放的独立数值 hash 边界。保留这些反证和原成果/完整成本门；文件差分或一次
+结算回执可用，不证明长程收益。
+
 把该 RFC 的 C1–C9 任务/删除表放在既有工作流内：先验收统一单会话输入，再做角色绑定
 与共享生命周期、replan/结果编写、executor 交流、benchmark 复用、打包 App readback
 及退役。App heartbeat 流程和实际 benchmark 消费者分别验收；managed Codex 可以作为