[songoow]

Goal And Delivered Outcome

• Outcome basis: a reproduced native context delivery cost regression and the accepted request to fix it in an independent PR.
• Gap: the shared codec chooses a valid delta before native file-reference and reader framing are known. A small current capture can therefore cost more to deliver as a delta. On the locked current-main synthetic CLI fixture, reference plus complete reader stdout is 9,790 B for delta versus 6,581 B for full.
• Delivered outcome: compare the final compact reference and all explicit-file reader pages, then use the cheaper readable candidate. Preserve useful deltas, the exact current target, immutable recovery and the existing read limits.
• Intended base: main, implemented and validated against 37cedac966dda06ad6605fc389abab8bc2686777, including fix(context): keep bounded native references readable #7735, refactor(context): compose native delivery in one TypeScript transaction #7768 and perf(context): include bounded field discovery in native references #7761. No separate issue is required for this self-contained repair.

Author Declaration

• Written by: model_agent — OpenAI ChatGPT (GPT-6 Astra Pro).

Implemented against

• Specification: the native saved-file delivery, recovery and progressive-reading contract in required-work-context.md at the validated base, plus the delivery-cost request described above.

Criterion	Disposition	Owning path / behavior	Decisive evidence
Shared TypeScript owner retains delta legality, target identity and numeric continuity	implemented	Existing codec and native projection are unchanged; Python compares only its actual IO representation	Exact restore, numeric/unknown-field, compaction and feature-off cases
Full fallback reuses the current immutable capture without re-admission	implemented	quota_capture.py publishes/registers only the selected view; full uses ancestry 0	Pending/candidate identity, single-registration and actual File/SQLite successor tests
Compare final serialized output under existing limits	implemented	Reference JSON + newline + all actual page framing, guidance, escaping and continuation commands	Three failing-before cases, public-reader cost oracle, parent-alias and whole-capture limit cases
Preserve #7761's optional current-field index without another planning RPC	implemented	Plan the existing index once; each candidate independently retains or omits it under its budget	Real context_select call-count assertion and existing index/selection tests

Self-check: independently reviewed the frozen patch and its #7768/#7761 interactions. Two integration issues found during author review were fixed: canonical parent paths in continuation commands, and the reader's existing whole-file size cap. No output or file limit was raised.

Scope And Continuation

The shared codec still owns semantic preparation. The native IO layer can only replace an accepted delta with its already-published current full capture. A tie prefers full. Unreadable candidates cannot win; known whole-file transport failures remain typed failures. Full cost uses a raw-byte lower bound and stops paging once it cannot beat the delta.

The change is complete within this scope. It includes focused regression tests and English/Chinese reference documentation. It does not add an RPC relative to the current formatter: the existing optional field-index request runs once for both candidates. The separate recommendation-history IO opportunity is outside this PR.

This optimizes serialized bytes for the reference plus one complete selected-file read. It does not require a model to read everything, predict selective reads or baseline discovery, or establish provider-token, cache, fee, latency or long-horizon task improvements.

Validation

• Tested revision: frozen source content published as 84a3082a148c57472ce5694c2a851d3578beb949; the remote Git tree is verified identical to the local validated tree 1270f601cd3358f9ef85169612aa2ebac02067c8.
• Run state: finished.
• Input classes: synthetic, public_fixture.

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	On unmodified 37cedac, the small-cost, low-budget full-fallback and failed-publication cases all fail; the new suite passes on the candidate.
unit / integration	passed	45 passed: test_native_context_delivery_cost.py, test_context_capture_selection.py, and the native-reference continuity/recovery lifecycle case. Includes 11 new cases and a real-owner single-index-call assertion.
real_entrypoint / real_backend	passed	6 passed: test_checkpoint_preflight_selection_inherits_native_transport, File and SQLite × off/on/on-after-compaction. Actual subsequent selection should-run; original receipt/Turn, zero spend and source/guard invariants retained. Existing assertions unchanged.
real_entrypoint / regression_parity	passed	Paired public context-project, context-read, context-hook runs on three fixed synthetic cases, with exact reconstruction, partial/index/selection non-acknowledgment and compaction recovery. See table below.
static	passed	Ruff for both changed Python files, compile, diff hygiene, bilingual RFC check and public-boundary scan.
static / integration	passed	Quick premerge on the three exact changed paths: six direct checks, three catalog smokes and public-boundary check; no failures or holds. Catalog includes maintainability, semantic vocabulary and scheduler ACK.
static	failed, inherited	An additional ad hoc strict mypy check reports the pre-existing optional Path argument in handle_native_context_command; no new diagnostic was introduced. This module is outside the configured strict-file set.
regression_parity	not_run	Paid/native-model comparison, retained model input, provider-token/cache attribution and task outcome evaluation are outside this transport fix.
CI	pending	GitHub checks and maintainer review remain separate from the local evidence.

Actual CLI output comparison

Each value includes actual reference stdout, field_index, all selected-file reader stdout and newlines. Setup, historical-baseline reads and auxiliary verification are separate.

Synthetic case	Base → candidate	Base bytes	Candidate bytes	Result
Small capture, 1,361 source bytes	delta → full	9,790	6,581	−3,209 B (−32.78%)
Multi-page capture, 131,833 source bytes, 16 KB page ceiling	delta → delta	9,832	9,832	Useful delta retained; full would require 9 pages
Chinese text, quotes, backslashes and newlines, 4,265 source bytes	delta → full	9,838	9,829	−9 B

All three chosen-file reads remain one call. The tiny last-row byte reduction is not evidence of lower model-token cost.

Coverage and gaps: an earlier broader 221-case run passed before the final field-index integration; it is not claimed as final-head suite coverage. Initial validation setup failures from a missing local console entrypoint were resolved with the actual source entrypoint and focused reruns. The final selected checks above passed without changing existing test assertions or budgets. No model calls were made.

Frontend / Visual Evidence

• UI impact: none. This changes CLI transport selection and its contract documentation; no frontend view changed.
• Before/after screenshots, viewport and craft review: N/A.
• Source data: synthetic.

Type of Change

• Bug fix
• Documentation update
• Test update

LoopX Area

• Control plane (native context transport)
• Host or runtime integration

Technical Direction

• Improve native context transport efficiency while preserving the current recovery, exact-value and authority boundaries.

Shared-authority RFC fixture impact

N/A: no authority promotion, provider routing or TypeScript semantic migration is claimed.

Boundary Checklist

• No private state, credentials, raw traces/verifier output, internal links or local machine paths in the diff or this description.
• No duplication of maintainer-owned benchmark work.
• Scoped to the accepted delivery-cost repair.
• No paired RFC changed; bilingual check passes and the reference update includes both languages.
• UI impact is marked none.
• The commit has a DCO Signed-off-by trailer.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-01T02:48:43.980562Z	84a3082	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max

未发现阻塞性问题。评审完整 head 84a3082a148c57472ce5694c2a851d3578beb949 的三个文件，独立复现实际 CLI 的成本选择与恢复，结论限于源码版本的 native transport。

动机 / Motivation

Agent 通过已有保存文件恢复当前工作上下文时，会收到一个读取引用和随后分页的内容。 以前只比较压缩内容的小幅缩短，可能把小包选成总输出更大的 delta；现在把引用、分页外壳、转义和继续读取命令一起计算，小包回到完整输出，大包仍可使用 delta。 三个同输入的实际 CLI 对照中，小包和转义包减少输出，大包保留原 delta 成本；原始约束和恢复路径没有变化。 本次只修复已决定上下文的传输选择，不证明模型记住了内容、长期任务收益、真实 token 成本或安装后的 Host 行为。 这里的 delta 是两份保存文件间可精确恢复的差异，并不是模型已经记住前文的证明。调用者的实际任务仍是拿到必要事实继续原工作，无需为了这次优化新增配置、确认或重填已知信息。

改动思路 / Approach

传输成本选择属于拥有实际 JSON/分页输出的 IO 适配层；语义有效性继续由 TS codec 决定，不能让可选成本判断创造执行义务。只选择同一已提交 current capture 的可读传输，不改变语义状态、调度、计费、模型保留或配置授权。先持久化当前 recovery，再构造两个引用候选；引用、索引与页面使用同一套既有 owner。选择 full 时复用已存在的当前完整文件，ancestry 回到 0；选择 delta 则保留既有链路。最后只发布选中的 wire 并登记一次 pending。

这是比固定长度阈值更贴近真实调用者的修复：UTF-8、JSON 转义、首次阅读说明和 next_command 都影响输出。反过来，直接在 TS 复制 Python 的页面规则会形成第二个 owner；本头复用纯 _capture_page，没有引入新的持久成本标志、独立策略配置或 capability。下面使用实际对照表解释结果，未声称做 Mermaid 渲染验证。

具体改动 / Changes

差异为 +492/-52：quota_capture.py +128/-52，341 行聚焦成本/失败边界测试，23 行双语参考说明。已检查 base 中 #7735 的 bounded references、#7768 的共享 TS transaction、#7761 的 field index 及两条不在 diff 中的调用路径；本头沿用这些现有语义，没有以改名或新模块替换权威 owner。

关键代码讲解

1. _native_context_reference抽出原有引用构造，保留 target、current recovery、可执行 reader 和字段索引。两个候选共享一次可选索引规划；元数据超限时保持已有的降级/报错边界，完整当前事实仍可恢复。
2. _native_context_read_bytes把引用与所有实际页面 JSON（含 LF）相加，直接调用真正的 UTF-8 page renderer。它是纯成本规划，不发阅读回执、不建立 retention；保留 8MiB reader 上限，full 已不可能获胜时可停止计数。
3. native_context_capture_view只在已有合法 typed delta 时比较两个可读候选；同价选 full，不能读取的可选 full 不破坏合法 delta。current recovery 已先提交，未使用的 delta 不发布，选中者才进入一次 register_native_context_view。既有 quota should-run 与 saved context-project都调用这一入口。

独立规范：docs/reference/required-work-context.md，spec_revision=37cedac966dda06ad6605fc389abab8bc2686777，在 diff 前读取，新增文档不作为自己的验收依据。文档未给这些要求编号，本次 criterion_id 对应原章节/现有约束：Opt-in native reuse → implemented，保留单一 TS codec 和完整重构；Machine default → implemented，saved-file basis 与完整模型保留区分，known loss 后新 epoch 使用 full；Selected capture details / 按需读取捕获详情 → implemented，选中字段/索引的 EOF 不变成完整 retention；Bounded native output → implemented，引用和真实分页在现有上限内，错误保留原始 digest-bound recovery。浮点 1.0、-0.0 和大整数 2**60+1 的原始值在独立 full fallback 对照中均逐字保留。

对主干的风险 / Risks

独立实验使用 base 37cedac966dda06ad6605fc389abab8bc2686777 与本头自己的环境，同一物理输入文件、等长 executable alias 和隔离路径布局。真正执行 quota context-project，随后逐个执行它返回的 context-read/next_command，统计引用 stdout 与完整 reader stdout，保留换行，验证连续 offsets、EOF、SHA、恢复内容、目标和 pending ancestry。短 wrapper 仅固定各源码版本及显式私有空 registry/runtime，未替换产品逻辑。不同安装路径会改变绝对字节数，所以以下是匹配布局的实验结果，不能外推成 token 或延迟承诺。

同输入/同页预算	base：引用 + reader	本头：引用 + reader	结果
小包，64,000	12,734 bytes，delta	8,385 bytes，full	PASS，保留同一当前原文
大包，64,000	12,740 bytes，delta	12,740 bytes，delta	PASS，精确重构
UTF-8/转义，8,192	12,756 bytes，delta	10,831 bytes，full	PASS，原字节可恢复

反方向也已核验：仅选一个字段不能建立完整 candidate，完整 pages 才触发已有 native-hook assumption；PreCompact 保留当前 recovery 并使下一次呈现变为新 epoch 的 full；显式 off 在 base/head 都保留原始输入与引用，journal 前后相等，无额外 human round、admission 或 spend。数字/未知值反例在两边都安全保留 full，未强迫生成不能精确验证的 delta。初始探查遇到默认 runtime 路由歧义，在执行 projection 前失败；使用显式隔离路由后继续，未把 fixture 错误当成本 PR 回归。

PASS：44 个成本/selection 测试、163 个 native lifecycle 测试；PASS：Ruff、仓库配置 mypy 的 17 个源文件、control-plane TypeScript typecheck；PASS：固定 merge-base 的 premerge 6 个直接和 19 个选定检查，无失败、跳过或手动 hold，包含 public/private scan、diff hygiene 和双语 RFC 检查。exact-scope change-quality receipt cqr_84821f1b2ea9f20f31b1 已记录，未应用 safe-fix。按当前 wait_for_ci=false 策略，没有查询、轮询或等待 GitHub CI。

语义与 CI 对齐

复用现有 context_delivery_v1、context_capture_page_v1 和 lifecycle owner，无新词汇、无 prose 分类、无默认开启。新增可观察行为是合法 native delta 在总输出更贵时切为当前 full；原始 receipt、current SHA、Goal/Agent/Turn、约束与恢复指令继续绑定同一事实。不可读候选、元数据过小、转义分页和超过 reader 上限的 full 替代均有聚焦负例。关闭路径走原有文件读取，未被成本策略接管。页面/Host 呈现无改动，因此不要求新增 UI editor 或设置入口。

我的整体评价 / Verdict

problem_context=goal_achieved 指本次完整 native output 成本修复；long_horizon=preserved、user_experience=improved，不是对长期有效性或模型采用的认证。observable_semantics=intentional_change_validated、default-off 隔离，owner 与机制规模适合这个问题。保存文件和返回命令有真实跨调用消费者，应保留 current recovery 兼容；共享 reference builder 和提前停止计数已是有意义的简化，没有依据增加新 provider 或重做 codec。改动仅涉及 quota_capture.py 的 CLI transport 和参考文档，没有渲染页面、布局或屏幕变更。未测试安装后的真实 Host/模型采用、阅读理解、端到端 token 或延迟收益。这是剩余验证边界，不影响本次已通过的源码 CLI 结论；合并与安装另需各自权限和 readiness。

English verdict: APPROVE — complete native output cost is reduced without losing current recovery or lifecycle semantics.