[loopx-agent]

Ordinary quota admission and native Turn exposed different projections of the same decision. This C1 implementation for #7416 composes one complete decision before capture and carries it to actual host input. Exact acceptance, authoring, Explore guidance, current-Task title and vision-audit sharing now converge on the existing TypeScript composition owner; the corresponding Python matching algorithms are removed.

This is still unfinished author work: remaining consumers, historical adapter retirement and packaged/outcome qualification keep the PR Draft. It is not ready for adoption or merge.

One route owner for planning and controller continuation

At ddf96b79c54272184bb67394e4355dd8a120b10b, Python's action classifications and route branches are removed. The existing TypeScript Turn owner now owns the exhaustive registered decision/frontier table and ordered routing gates. Planning consumes its route together with the existing coarse lineage/action-signature projection; the loop controller retains a thin transport to the same owner. Receipt/budget continuation policy, scheduler ownership and effect authority are unchanged. Historical unknown actions retain Host routing; no string-suffix heuristic or new action vocabulary is introduced.

Historical Python scalar-text encoding remains a compatibility codec, including numeric/exponent and container spelling. Complete input ignores those historical hints and retains source/version/integrity validation. The persisted action-hash codec and historical selected-work reader remain; this slice does not claim all adapters or C1 are retired. Both RFC languages and generated controller ownership declarations are updated.

Validation on the frozen production source:

• 658 passed in 536.30s across real File/SQLite CLI capture, original-input recovery/completion, Turn driver, Codex CLI and DSH host regression. These checks use the actual owning backends and synthetic model transport; they preserve original capture/Turn identity, stops/refusal, numeric action hashes, retry and once-only settlement. They do not qualify an installed App, real model outcomes or PostgreSQL authority changes.
• 333 passed across route, loop controller, controller-contract and generated-binding qualification. 46 TypeScript tests pass; typecheck, Ruff, docs governance, generated-binding freshness, staged/head bilingual diff, public-boundary and whitespace checks pass.
• 1,152 old-Python/new-TypeScript action/gate combinations agree. A fixed real SQLite CLI fixture produces identical complete and historical ordinary plans, each retaining two bridge operations. These planner comparisons use the same current TypeScript endpoint; they are parity/call-count evidence, not an exact old/head latency experiment.
• The first focused route run had 24 passed/1 failed because the new capability test tried to compose an absent required intent. The corrected fixture reaches the intended routing gate and passes in the 333-case run. An earlier invocation used a nonexistent test filename and collected no tests. Neither is described as successful qualification.

Cost is mixed: on the same 44,891-byte real request, 61 alternating warm standalone-route samples increase median/p95 from 0.004792/0.010125 ms to 13.252792/15.855042 ms. This controller-only caller adds one bridge operation where classification was previously in-process Python. Ordinary planning batches route retrieval with its existing operation, but no complete-Turn efficiency improvement is established. This measured cost gap is retained for controller boundary consolidation; no cache or duplicate classifier hides it. Model execution, cold start, installed App/SDK/MemT and original-quota accepted outcomes/full costs remain unqualified.

Scope-fit: replace the actual route owner and preserve compatibility through transport, rather than add a second policy engine or framework. The finite TypeScript record reuses the registered vocabularies and the existing two historical replan aliases; semantic advisory reports no supported new carrier, which is not proof of coverage. Current main was fetched and verified at d52f2e153a0a5abb2f9c469ad78f0beccfe3aae8. No merge, install, manual CI dispatch, live model or benchmark launch occurred. This remains genuinely unfinished author work for the remaining consumer/adapter and full-cost qualification.

Complete-source launch planning and adapter consistency

At c5445961cf8625e126aad9ffabae9195dd6ba308, the live Host launch recheck now composes its receipt-bound observation with the same complete-contract owner as initial planning and passes that contract to the shared planner. This removes the raw-quota-to-historical-plan shortcut. Stop/changed-action refusal precedence stays ahead of composition; the live observation does not overwrite the original capture, substitute selected work or mint a receipt.

The shared complete reader also checks that the adapter's signed action document equals the existing producer projection of the admitted source. Separate integrity hashes alone previously allowed a rehashed adapter to carry different execution/writeback facts while retaining Goal/Agent/Todo. The fix reuses the producer's existing signature dimensions, without another field list, RPC, schema or decision view. Historical-only readers retain their behavior. Complete profile/adapter disagreement now explicitly rejects; this replaces the prior complete reader's silent use of the source profile and is an intentional refusal change.

Validation on unchanged production source:

• Six-file Python regression: 656 passed, 2 failed in 441.83s. Both failures were the new test's incorrect assumption that refusal allocates no lane-lock directory. The assertion now checks no Turn journal/settlement receipt and no host/writeback/spend callbacks. Corrected cases plus the eight instrumented real File/SQLite launch/capture/recovery cases: 10 passed in 46.54s (eight overlap the broad run; 658 distinct cases covered). The earlier failed run is retained, not described as green.
• The live-entry observation delegates to the real planner and real File/SQLite backend, confirms complete input and original Turn identity, and retains original capture/retry/one-spend assertions. Model transport is synthetic.
• New File/SQLite planning refusal assertions fail at b9e2c5120; six rehashed variants cover eligibility, effective action, delivery, user intervention, execution policy and spend permission. Candidate planning/execution entry rejects all before effect callbacks. Existing lane-lock allocation remains allowed.
• 44 TypeScript envelope tests, control-plane typecheck, Ruff, docs governance, semantic advisory, staged/head bilingual checks against the actual main target, public-boundary scan and diff checks pass.

Local cost on the same 44,891-byte real SQLite CLI fixture: 101 alternating warm in-process TypeScript samples preserve legitimate lineage output, with median 4.864→5.163ms and p95 5.570→6.010ms. This is added validation cost and excludes RPC, the new live-composition call, cold startup, model execution and full Turn cost. No overall efficiency improvement is claimed. At that checkpoint Python routing was unretired; the increment above now replaces its classifier. Remaining effect/material readers, packaged App/SDK/MemT and original-quota outcome/cost qualification remain open. This remains unfinished author work; no merge, install or model/benchmark launch occurred.

Complete-source planning and failed-session reconciliation

At b9e2c51204c0abb5a663c01bdb7824e9134f1e11, the production Turn CLI passes the complete contract into planning, before route/session/transaction decisions. Planning and failed-session reconciliation reuse one TypeScript driver_lineage operation backed by the existing complete source/version/integrity/identity validator. It replaces the existing signature-only call and returns identity facts plus the action-signature preimage together; no per-field RPC, validation cache, schema/view, or parallel decision owner is added. Explicit null/altered/unsupported complete input rejects, including requests whose session already says resume. Omitted historical requests retain their decoder. The existing receipt owner retains Todo-less replan identity.

The Python JSON/hash codec is intentionally retained. Characterization found that directly hashing in JavaScript changes numeric/exponent spelling and hence persisted Turn keys. The final implementation preserves the original preimage encoding, adaptive work selection, Unicode, original receipt identity, wrong-Turn refusal and idempotent session resume. This is source/identity convergence; _typed_route, launch-time live eligibility and remaining effect/material adapters are not declared retired. The outer executor already validates complete requests; this change does not claim a previously demonstrated end-to-end dispatch bypass in failed-session recovery.

Validation: 609 main regression cases passed on frozen production source (real File/SQLite CLI capture/recovery/completion, Turn driver, Codex and DSH), plus 2 separately run Todo-less replan cases; the earlier focused 2-case planning check overlaps the main suite; 44 TypeScript envelope tests, control-plane typecheck, Ruff, docs governance, staged/head bilingual and diff checks pass. Six changed files pass the public-boundary scan; global loopx check still reports an unrelated existing Goal's missing canonical authority. Early development runs are not final qualification: a first fixture assertion used the wrong transaction shape, the direct-JavaScript hash trial failed numeric parity, and a replan fixture initially retained an invalid selected-Task title reference. All were corrected; the initial broad run overlapped source changes and is excluded. Public tests reuse the existing File/SQLite CLI fixture; the larger capture file retains distinct source/recovery coverage without another fixture/harness. No authority-store persistence is changed; real PostgreSQL, installed App/native SDK, model and benchmark qualifications remain unclaimed.

Same-request comparison against 088867421 preserves complete/historical plan and failed-session output equality. Two null/altered recovery inputs accepted by the old helper now reject. In 31 alternating warm samples on a 45,380-byte real SQLite CLI request, planning median/p95 changes 39.632/47.964 → 42.608/53.270 ms; recovery changes 12.330/20.858 → 18.136/23.242 ms. These are added local validation costs, not an efficiency win or the full-Turn/original-quota outcome comparison. Prior profile/settlement costs and prompt savings remain independent evidence below and in the paired RFC.

Scope-fit improvement applied: consolidate complete planning/recovery identity and signature transport in the existing typed owner while retaining the persisted-key codec. The next bounded change must converge route consumption with the source projection and qualify real launch/refusal/recovery/full-path costs, without multiplying field-level bridge calls. Latest target main inspected at 31d61bff1; no merge, installation or live model/benchmark launch occurred. C1 remains unfinished.

Codex prompt validation consolidation

At 088867421bd548513beefcedc9ac4379acea4ee5, valid complete requests use the existing complete validator's envelope-version check instead of first calling the same boundary separately. Historical requests retain their standalone version gate. Rejected complete requests still run that gate so doubly malformed input preserves its original diagnostic precedence. This removes redundant validation transport from the actual Codex CLI prompt path without a cache, new protocol field, new owner, or changed prompt instructions.

Pinned e1dcd95dd/candidate comparison uses the same real SQLite CLI request. Complete and historical prompts match byte for byte; six invalid-input cases match refusal diagnostics, including null, altered source, unsupported versions and doubly malformed input. On a 45,429-byte request producing a 34,043-byte prompt, 61 alternating warm samples reduce median construction 24.229 → 14.819 ms and p95 30.189 → 17.854 ms. Bridge observation shows consumer_version plus validate_complete becoming only validate_complete for valid complete requests. This is about 39% lower local construction latency, excluding cold startup, model execution, full Turn and accepted-outcome costs. It does not cancel the earlier independently measured profile/settlement overhead. The earlier pre-diagnostic-refinement sample (21.279/12.994 ms median, 29.729/17.321 ms p95) is retained as earlier evidence.

Validation on the final frozen source: 607 tests passed across real File/SQLite CLI capture/recovery, completion, Turn driver, Codex CLI and shared DSH-host selections. The initial focused prompt cases passed 2 tests (overlapping); a broader run was interrupted after 45 passes when diagnostic-precedence refinement changed the source, and is not counted as final qualification. Ruff, docs governance, bilingual staged/head checks and diff checks passed; semantic advisory found no supported new vocabulary carriers. Four changed files passed the public-boundary scan; global loopx check retains the unrelated existing Goal canonical-authority failure. Latest target main checked at d60b1f9ef; PostgreSQL, installed App and native SDK qualification are not claimed.

The test additions reuse the real File/SQLite CLI capture fixture and retain original-state/no-spend teardown; no additional harness or production abstraction was added. The capture test file now slightly exceeds the smoke-size review prompt; its shared integration coverage is retained rather than split into duplicate fixtures. Scope-fit improvement applied: remove a redundant owner call while preserving historical/negative behavior. That head left complete-contract-first planning and failed-session reconciliation open; the current slice advances their shared identity boundary. That checkpoint still used the internal adapter for routing and the live launch recheck. The new slice above replaces the live raw-quota planning shortcut; the subsequent route increment above retires Python classification; remaining effect/material adapters are still open.

No model/benchmark launch, installation or merge occurred. C1 remains open and this PR stays Draft for unfinished planning/consumer replacement and packaged/outcome qualification.

Settlement and recovery identity convergence

At e1dcd95ddf1b3aadd60d8aa9b47687a8b14bbc85, execution validates the complete decision before dispatch or existing-journal recovery. Settlement-plan fallback and recovery Agent identity reuse that checked lineage within one invocation. Existing settlement plans/receipts are not rebuilt; historical requests with an omitted complete contract retain their decoder. There is no cross-attempt or cross-source cache, new schema, or second decision owner.

This closes a concrete bypass: an existing settlement plan previously skipped source validation, allowing a null/altered complete request to return an existing journal outcome. Ten targeted cases fail the new refusal assertions on ce996ea0f; the candidate passes 32 capture/recovery tests and the broader 605-test regression (overlapping). The real File/SQLite CLI journal cases verify unchanged journal bytes and spend counts with no host/writeback/spend/scheduler callbacks on refusal. Legitimate captured-source recovery remains covered.

Ruff, docs governance, bilingual staged/head checks and diff checks pass. The semantic advisory found no supported new vocabulary carriers. The public-boundary scan passed four changed files; the global check still fails on the previously recorded unrelated Goal's missing canonical authority. Latest target main was checked at d60b1f9ef; this slice does not claim PostgreSQL, packaged App or native SDK qualification.

Measured added cost: on the same 45,405-byte real SQLite CLI request, 31 alternating warm samples of the existing settlement-plan read plus recovery identity preserve legitimate outputs but increase median 0.016 → 12.382 ms, p95 0.024 → 14.883 ms. This measures one added validation boundary call, not full-Turn/model cost or an efficiency win. Previous profile-read cost evidence remains separate. The same-domain refactor reuses call-local checked identity; broader validation-call consolidation is deferred until its source/lifetime invariants and complete costs can be qualified.

Remaining routing/settlement consumers, historical adapter retirement and original-quota accepted-outcome/full-cost comparison remain open. No model/benchmark launch, installation or merge occurred; C1 and this Draft remain unfinished.

Result evidence applicability convergence

At ce996ea0f7f67567378248803a15ec746b96e594, Codex result-schema construction and the shared candidate adapter read evidence applicability through one validated complete-decision helper. New requests no longer derive the execution-profile requirement from the internal capsule. Model input and this read reuse the existing TypeScript integrity/source/lineage validator; no new wire field, packet view or per-evidence-field operation is added. Historical requests with an omitted complete contract keep their decoder; explicit null/altered contracts reject. Empty/non-object profiles, stop results and evidence-field presence retain existing semantics; supplied evidence remains unchanged for the executor's content validation.

Validation: 603 tests passed across real File/SQLite CLI capture/recovery, completion, Turn driver, Codex CLI and shared DSH-host selections. The expanded profile matrix was then rerun separately (2 passed, overlapping the broader selection), covering omitted/null/empty/non-object/nonempty profiles, one or both evidence fields missing, optional completion, altered internal projections, historical parity and malformed complete bindings. Ruff, docs governance, bilingual staged/head checks and diff checks passed. The semantic advisory found no supported new vocabulary carriers. Public-boundary scanning passed all five changed files; the global check still failed for the previously recorded unrelated Goal's missing canonical authority. An attempted unsupported bilingual-check option was corrected to the supported staged/head commands; it was not counted as a passing check.

Measured added cost: using the same real SQLite CLI host request (45,405 JSON bytes, synthetic provider), 31 alternating warm measurements of schema construction plus material-candidate conversion increased from median 0.013 ms at 68223e337 to 19.6 ms (p95 0.019 / 22.8 ms). Legitimate outputs matched. This is negative local cost evidence from two checked boundary calls, not a full-Turn benchmark; cold startup, model execution, complete costs and accepted outcomes remain unqualified. No live model/benchmark job, installation or merge occurred.

This retires two new-request capsule profile reads and their duplicate applicability test. Evidence-content validation stays with its current owner; routing, other settlement consumers, historical adapter retirement and packaged/outcome qualification remain unfinished. The PR remains Draft for that author work.

Completion source convergence

At 68223e337b9ab6a0e11cae3d44c233cb030f078c, run-once resolves its admitted task body from the validated complete decision. The existing TypeScript interaction owner now owns source/reference resolution and exact UTF-8 hashing for both complete requests and historical journals; Python keeps only transport. Missing/ambiguous sources, null complete inputs, altered bindings and wrong selected identities reject. Historical accepted completion recovery still reads original receipts without resubmitting completion or spending twice.

Validation: the real File/SQLite CLI capture, completion and Turn driver selection passed 207 tests; the unchanged capture/completion selection passed 48 at baseline 599cf1f72. TypeScript envelope tests passed 44, with typecheck, focused Ruff, docs governance, bilingual staged/head checks and diff checks passing. The first candidate run had 199 passed / 8 failed because the new synthetic source fixtures retained a title reference to the replaced source; correcting that fixture produced the final all-green run. The seven publication candidates passed the public-boundary scan. The broader global loopx check exited nonzero for a separate existing Goal lacking canonical authority; it is not reported as passing.

This removes one Python semantic algorithm and one adapter-derived source read. The boundary adds a TypeScript call where the previous resolver was local Python; full-path cost and accepted-outcome benefit remain unmeasured. Result profile/evidence interpretation and other settlement consumers remain unfinished, along with the previously recorded host/adoption gaps. No live model/benchmark job, installation or merge was performed. The PR remains Draft for unfinished author work.

Planning and recovery identity convergence

At 599cf1f7257d4473765ad71f805b0354d4947ae2, initial Codex/DSH planning, failed-attempt session lookup and journal inspection pass the original complete decision to the existing shared identity owner. Live and cached vision-result normalization also reuse that owner. Omitted historical contracts keep their decoder; explicit null contracts reject. Session storage, scope/lifetime fences and the native app-server callback retain their existing contracts. This removes identity-only adapter reads; result evidence/profile interpretation, routing and settlement still require migration.

Validation and retained failures:

• Broader Python selection: 494 passed / 4 failed. All four failures were completion-recovery tests demanding a second completion-writer call, despite successful recovery through the original receipt. The same failures reproduced at prior head 0166e4315 (24 passed / 4 failed in that suite). The repaired oracle verifies original-Turn completion/spend readback, one host attempt, no completion resubmission, and preservation of later task text; the complete suite then passed 28. These are overlapping selections, not a claim of one fresh all-green 498-test run.
• An earlier selection was 464 passed / 3 failed because an adaptive fixture mutated an already signed envelope. It now constructs source facts before composition and retains both historical unverified selection and rejection of conflicting verified sources before host/writeback/spend. All 6 cases pass on the candidate and prior baseline. No production gate was weakened.
• Complete-capture selection passed all 20 within the broader run. Baseline sensitivity retained 8 real CLI/capture/recovery passes and failed 4 new vision-identity assertions: live results previously accepted the foreign adapter Agent, while cached results rejected at the older packet-identity check rather than the shared original-source gate. These are distinguished findings, not four previously accepted corruptions.
• The first vision fixture incorrectly paired material replan with a continue outcome (16 passed / 4 failed); corrected before the broader run. The first receipt-oracle edit assumed an explicit Turn-id field absent from this fixture (24 passed / 4 failed); the corrected check uses its original Turn key. Ruff, docs governance, bilingual staged/head checks, diff checks and staged public-boundary scan pass. The diff-scoped vocabulary advisory found no supported new vocabulary carriers; this is not a semantic proof.

No model/benchmark job, installation or merge ran. File/SQLite real CLI, subprocess and receipt recovery are qualified for this slice; native operation-SDK, packaged App and original quota single-session accepted-outcome/full-cost comparison remain open. MemT lifetime admission remains a path-specific dependency. C1 stays open and the PR remains Draft for the named unfinished implementation/integration work, not for CI or review alone.

Shared complete-input session validation

At 0166e4315e08ae796ca880a87746c312a836b7af, Codex and DSH dispatch read session lineage from the complete decision through the existing TypeScript owner. Model input and session identity share source/version/signature checks; complete requests no longer repeat Python version/signature validation. A self-consistent internal adapter with a different Goal, Agent or Todo now rejects against its original complete input. Historical requests, session paths, schemas and scopes retain their decoder.

Validation: 280 Python tests passed, 8 native-environment tests skipped, 44 TypeScript tests passed, control-plane typecheck and Ruff passed. The same real File/SQLite CLI fixture at baseline 9c400ee24ed6a7bfc6432782d7dc39df742fc02b passed 14 legal/recovery cases and failed the two added identity-conflict cases; candidate capture selection passed all 16 within the broader run. Existing capture cases exercise failure retry and once-only settlement replay. Ordinary/adaptive sessions restore the same persisted Codex/DSH identity in Todo/Agent scopes without rewriting the saved file. An initial added fixture used an unsupported scope spelling (12 passed / 4 failed); corrected to the existing agent scope before final validation.

This is dispatch identity migration, not full result/settlement retirement. Result/profile/evidence interpretation and settlement still consume the internal adapter; the native operation SDK, packaged App adoption and original quota accepted-outcome/full-cost comparison remain unqualified. MemT lifetime admission blocks only its dependent path. No net efficiency claim, installation, model/benchmark job or merge is included. New internal operation complete_host_lineage reuses the existing quota owner and adaptive work selector; no public capability, persisted schema or decision vocabulary is added. The bounded refactor removes duplicate complete-path validation while preserving the historical decoder.

Delivery split

This Draft is the integration/cutover candidate, not a requirement to merge all C1 work together. Independently usable shared-owner prerequisites are being extracted against target main; they retain the current writer/host entrypoints and include their own validation. Contract writer/capture switching, consumer migration/recovery, historical-reader retirement and packaged outcome/full-cost qualification keep separate review and acceptance boundaries. First extracted prerequisite: #7457 (56559929aa), based directly on main, consolidates exact Task-title/Explore-guidance sharing and reader recovery while retaining current schemas and entrypoints. It is ready for independent review; this integration branch now absorbs its commits as a prerequisite without retaining duplicate semantic owners. The prerequisite remains independently reviewable against main; this PR keeps main as its target, so the prerequisite delta will drop out after that separate merge. Further cutover and retirement slices retain C1's original quota-baseline comparison.

Result and ownership

• Both quota spellings and native Turn compose the same flat loopx_turn_envelope_v1, retaining original facts, instructions, scheduler binding and capture integrity. Codex stdin and the structured-host renderer consume that complete contract. The old envelope is temporarily internal to effect interpretation and recorded-history decoding, not a permanent alternative model input.
• Original-Turn successor binding and settle-before-ending instructions are composed before hashing/capture by the same owner as historical staged reads. An observed obligation cannot replace an existing Todo settlement identity; creating a successor does not authorize running it.
• Complete composition and recovery reuse the existing interaction decoder and registered execution-action vocabularies. Unknown/mistyped execution semantics reject despite valid hashes; unknown optional evidence remains intact. Explore's existing applicability owner prevents an unbound replan from advertising a Todo-bound result attachment without dropping independent evidence or before-work obligations.
• Complete composition and legacy display delegates share exact acceptance contracts, durable-writeback authoring and optional Explore instructions. Different revisions, types, provenance, negative evidence or clauses remain distinct. Historical readers resolve before relocating context. Missing owners, conflicting inline/reference values and chains reject. No second decision owner or new persisted vocabulary is introduced.
• Current-Task fix: the complete contract now absorbs the original quota path's exact title sharing. A lane title can reference only the unique, complete, verified current selected Task with the same identity and exact text/title. Original requirements and provenance remain inline. Missing, failed, ambiguous, incomplete, done, archived or differing sources retain their title. Unicode character-threshold behavior is preserved. The legacy label-prefix display omission is not applied to the complete contract.
• Reference validation is shared at composition/recovery: malformed or dangling current-Task references, conflicting inline values, chains and invalid source/selection identities reject before host input, even after hashes are recomputed. Historical envelopes retain the complete Task source without relocating a dangling lane reference.
• Vision-audit sharing: the complete root audit and judge retain all original clauses, unknown facts and negative evidence. Exact nested copies use the same TypeScript owner in complete composition and the legacy display delegate. Different facts stay inline; malformed, dangling, conflicting or chained references reject at composition and recovery even after hashes are recomputed. JSON type differences now stay distinct (correcting Python equality of true and 1); short audits stay inline when a reference would be larger. Historical readers retain the full root judge.
• Rejected admission: decisions with an actual interaction contract now pass through the same complete composer before capture, even when ok=false. Failing exit status, pause/health facts and original reentry receipts survive; host handoff, native context-baseline advancement, delivery and spend remain refused. Errors before a work contract exists keep their full typed diagnostic/recovery payload under either flag spelling, without inventing an interaction contract or falling back to the historical renderer. The renderer-only turn_envelope_skipped annotation is no longer added to predecision diagnostics. Malformed complete decisions still reject before capture.
• New-emission retirement: should-run projection now accepts only the already-composed complete contract or original predecision diagnostic. Both flag spellings refuse uncomposed sources before durable capture or host handoff instead of falling back to an unversioned packet or v0 envelope. Historical captures retain their explicit recovery readers; quota status/plan/monitor projections are unchanged. A prior-projection sensitivity probe accepted both old outputs, while the candidate rejects them and preserves complete output unchanged.
• Cold surface migration forces one full delivery; warm delta and lost-baseline recovery reuse the existing context owner. Main's cumulative acceptance-evidence reuse is integrated rather than reimplemented. Neither shared code nor fewer serialized bytes proves model compliance or outcome benefit.

The Task-title/Explore legacy delegate now uses one shared transport operation from #7457; its old per-field bridge operations are removed. The complete path invokes the same functions inside its existing composition call. Other historical display delegates still add transport calls. Their exit condition is retirement of the unversioned display consumers, while supported historical captures retain explicit decoding/recovery. Host-specific launch and observation stay in thin adapters. The same-domain refactor is applied at the existing owner; remaining consumer work remains within C1, with no new generic framework.

External worker admission boundary

The external scheduler worker now validates versioned complete decisions through the existing TypeScript complete reader before interpreting scheduler facts or launching a wake process. Unknown versions, missing bindings, changed integrity, unsupported required semantics and invalid references reject before execution. The Python bridge receives only a validation acknowledgement; it neither copies decision rules nor recomposes the input. Ordinary unversioned quota compatibility remains until its explicit C1 consumer retirement.

Real isolated File/SQLite CLI inputs drive the worker and a local marker subprocess: valid input wakes; eight malformed/tampered variants per backend refuse without a marker, state mutation or spend. Prior code launched the marker for unknown versions on both backends. This validates the external admission boundary, not executor-model adoption, result return or full-cost benefit.

Quota observation recovery prerequisite

Independent normal PR #7468 (0caa350456f7d85891c0038d059ca350d83d1208) is now absorbed, based on target main 59c8bbf791bca9d3d1dd996629a1610c0679b23e. quota status/plan retains the same authority rejection fields as execution commands, including migration/backup recovery. It fixes diagnostic loss without restoring retired ordinary unmigrated reads. File/SQLite scope checks remain; the two old legacy-success assertions now protect the accepted refusal and no-side-effect boundary. New negative assertions failed on the prior code; the standalone scope/diagnostic/authority suite passed 156 tests. This is independently reviewable and reversible, not a C1 outcome/cost qualification.

Earlier validation (historical evidence)

Latest combined quota qualification: 174 passed in test_quota_observation_scope.py and test_quota_settlement_cli.py on code head 57cd797b051ae1a2bd8ec95345738bb62fd6f1e9. Final head db27a6b165337592cfda2e556641fedabf65e470 adds only the paired RFC checkpoint; production and test sources are identical. This closes the previously recorded cache/legacy-scope failures in this selection. Fifteen base/head failure projections also preserve all non-target responses exactly. Docs governance, paired RFC and diff checks passed. One initial integration command named a nonexistent cache test file and collected no tests; the corrected full selection above is the qualification. No whole-tree or installed/model-outcome pass is claimed.

Latest external-boundary head: 8eca73b28ac67c2e9d1395217a15aefba5180618, synchronized with target main beede96e0ade200353ee0e4646a0b52d81576c37: 292 passed across complete contracts, external scheduling/replan/continuity and native Turn CLI. TypeScript envelope/context 70 passed, control-plane typecheck, Ruff, paired RFC checks and diff hygiene passed. The initial two new cases failed on the prior worker as expected. One intermediate expanded run had 290 passes and two unsupported-operation failures because source was edited during execution; it is retained as invalid mixed-source evidence. The 292-pass run uses unchanged committed final source. Earlier counts below are historical and overlap.

Tested integration head: e9388a1ac0247d5abacd59ea6f8dc4f522291fc3; verified target main: 71057d44f0d50a3636fcd8796f7c98717ce41742.

• Shared-owner integration before the final emission cleanup: 256 passed across complete/context/title/Explore/refusal/CLI/staged/Turn tests and 172 passed across external worker tests, including real isolated File/SQLite CLI. External worker dispatch uses a controlled Host; this does not prove actual executor-model adoption.

• Final emission/capture/history/refusal selection: 158 passed before the final pre-capture ordering fix; the final focused refusal/capture rerun is 64 passed, followed by 12 passed after tightening the missing-contract/schema guard (overlapping selection). TypeScript Turn/context 70 passed and typecheck passed; Ruff, docs governance, bilingual staged/exact-head and public-boundary checks passed.

• The integration includes target-main changes to canonical lifecycle helpers unchanged; no new authority-store behavior is authored here.

• Previous-head refusal/capture/provider-route selection: 93 passed after target-main synchronization. Real isolated File/SQLite CLI checks cover missing work, unavailable capabilities, same-original-Turn selection reentry, complete capture equality, original diagnostic recovery, health-false pauses, no spend/baseline mutation and exact transport-failure receipt retention. Malformed complete decisions reject before capture.

• Capture migration: 36 passed; capability memory-mode matrix: 20 passed, overlapping the post-sync selection. Complete boundary clauses reach actual structured-host input. Historical long-route readers retain shell quoting, immutable original observation, missing-capture refusal and once-only receipt effects.

• Broader characterization: 661 passed / 8 failed. The eight failures expected a non-v1 source only for rejected capability admission; those obsolete producer-layout assertions were migrated without weakening capability/authority checks and pass in the current selection. The broader run spanned the final test migration and main synchronization; it is not an exact-head whole-matrix pass.

• TypeScript envelope/context selection: 70 passed; control-plane typecheck, focused Ruff, docs governance, paired RFC staged/head checks and diff hygiene pass. Public added-line/new-test scans are clean. Production semantic advisory reports no supported new vocabulary carriers, not exhaustive semantic coverage. An initial advisory invocation incorrectly included a test outside its supported source root and failed; the corrected production-scoped invocation passed.

• No authority-store implementation changes. File/SQLite are real isolated backends; native/DSH subprocess providers in these tests are deterministic recorders, not live models. No all-provider, installed-App or accepted-model-outcome qualification is claimed.

Refusal characterization initially produced 3 passed / 15 failed, combining missing complete refusal transport with fixture issues (App-only flags on generic CLI and an already-bound Todo instead of a selection-required reentry). After correcting the isolated fixtures, 18 passed; the expanded focused selection then exposed an old missing-roster fixture failing before identity validation. That failure reproduced with the prior emission implementation. Initializing its isolated canonical authority preserved the original identity assertions and yielded 93 passed. Capture characterization was 27/9, then 34/2 while migrating old renderer layout assumptions; the two remaining prompt-label assertions were corrected before the 36-pass result. Historical failures remain recorded, not waived.

The preceding vision increment's synchronized 464-pass result and focused 83-pass result remain historical, overlapping evidence. They were not both rerun as distinct current-head qualifications.

Vision characterization started at 12 passed / 15 failed: missing complete sharing, Python boolean/number equality and missing negative-reference rejection exposed product gaps; four cases also needed correct source/context fixtures. The initial isolated real-CLI fixture had no active prior vision and correctly emitted no audit. Seeding the isolated prior vision fixed those two tests without changing production admission. An earlier in-progress broad run retained that fixture failure (457 passed / 2 failed); the final synchronized run above uses the corrected fixture and the final absent-interaction parity cases. Intermediate focused scopes overlap and are not additive.

Prior title qualification remains historical: an initial 2 passed / 17 failed found a missing local delegate import; then 69, 72, and synchronized 430 passed in overlapping selections. The unused Python JSON import was removed. No earlier failure is reclassified as a pass.

Original quota comparison

The target fuses quota's necessary decision information with Turn delivery efficiency and replaces both. The complete source is a migration oracle, not the final fusion design. Compare the same single-session caller-visible original quota path first; double-session effects need a separate comparison.

The original CLI projection module is frozen at 895f38fc5. Same synthetic inputs pass through production projection/read functions; values below are compact UTF-8 JSON bytes:

Fixture	Original non-staged CLI	Fused complete input	Difference	Original captured entry + review + writeback	Fused captured input
No current Task / stride off	20,543	21,738	+5.82%	21,882	21,821
Repeated acceptance	22,237	23,432	+5.37%	24,509	23,515
Repeated authoring	22,062	23,266	+5.46%	24,311	23,349
Repeated Explore guidance	22,848	24,320	+6.44%	26,081	24,403
Current Task title	28,585	29,780	+4.18%	29,906	29,863
Repeated vision audit	22,337	23,333	+4.46%	23,658	23,416
Unhealthy paused decision	6,325	6,639	+4.96%	Not measured	Not measured

The earlier 21,461-byte baseline was an internal quota source, not caller-visible CLI; its +1.29% comparison was corrected to +5.82%. An evidence-conditioned fixture has captured totals 28,558 original versus 33,368 fused. Receipt-only variants are identical data, not independent workloads.

Extra acceptance/Explore/material reads, request framing, cached/uncached tokens, latency, retries, verification, human attention and accepted outcomes are unmeasured here. These results restore quota's existing sharing and remove duplicated algorithms; positive full-cost benefit over quota remains unproven. Byte reductions cannot close C1 or justify dropping unique instructions.

Prior evidence and unresolved qualification

Earlier qualification is retained as historical evidence, not a claim that the whole matrix was rerun at this head:

• Native Codex 0.163.0-alpha.11.1 deterministic-loopback checks previously passed 10 cases spanning exec, app-server, code-mode, compaction/process resume and history replacement/fallback. Four later pragma/compaction cases also passed; their first unconfigured invocation skipped four cases, which are not qualification. Context facade checks passed 73, lifecycle/resume 190, quota-settlement CLI 158, DSH context 8, host-memory 105, and external-worker 70 in separate overlapping selections. An opaque external shell wake does not establish executor-model delivery.
• Selected-work migration was 4 passed / 6 failed, then 10 passed through actual bootstrap/quota and native planning after obsolete layout assertions were migrated. Staged sensitivity was 6 passed / 4 failed with the prior composer, then the candidate staged 23 and host matrix 4 passed. Unknown-action characterization had five failures; complete/reader regression then passed 95. Four invalid interaction contracts were previously accepted; shared decoder admission produced 352 passed across its complete/DSH/stdio selection. The earlier inline-successor 68 and host-input 4 overlap this evidence.
• Acceptance sharing had 12/2, then 9/5 while fixing copied-parent mutation, and a final 425 passed. Authoring was 501/8, then 505/4; after main sync 498/13 included nine missing-envelope negative-test fixtures, followed by 63 passed in the corrected focused selection. Four projection gaps remained at that checkpoint. Guidance repaired two and migrated 31 old consumer/canonical-fixture assumptions: 371/33, intermediate 39/2, then 402/2. The current title increment resolves the remaining two; those historical failures are not relabeled or waived.
• Broader historical consumer characterization was 101 passed / 46 failed / 19 skipped, versus 121/26/19 on its preceding candidate. A preferences selection was 24/6, with all six reproduced at its prior head. SDK skips are unqualified. Earlier quota/replan 168/3 had two repaired alias expectations; its cache case passed alone without changes. Subsequent characterization at e9388a1ac was 170 passed / 3 failed: the cache failure compared independent live observation timestamps exactly, and two legacy-scope fixture failures reproduced on target main. The original main detail-mode cache comparison also fails across seconds; default main omitted those details and hid the bad oracle. Independent test-only test(quota): validate live observation clocks in cache parity #7464 is absorbed at 1ad16f8ad: each timestamp is validated against its own real invocation and every other fact remains compared exactly. At this head, 8 cache tests passed, and both default/detail modes passed with deliberately delayed real CLI calls. Negative probes reject stale timestamps and wrong readiness. The complete output retains its useful observation facts; no product semantics were removed to pass the test. The two diagnosed legacy failures are resolved by fix(quota): preserve authority recovery in status and plan #7468: obsolete success expectations are replaced with the required refusal, and the previously hidden authority recovery is preserved. Broader consumer qualification remains open. Earlier capture 5/5 and release cold-import 95/2 stopped on assumptions later repaired. Unrestricted mypy failed across dependencies, and a renderer assignment error reproduced at prior source; whole-tree typing is not claimed.

Before cutover: finish remaining quota/staged/external/optional consumers and exact recovery, complete broader suite qualification, retire historical effect adapters on their supported boundary, and qualify packaged App journeys and comparable accepted outcomes/full costs. DSH still requires Todo-scoped sessions and refuses obligation-only replans before dispatch.

The paired controller RFC and historical hot-path protocol now document the actual shared owner, strict recovery, compatibility exit and measurement limits. C1 remains open. No model/benchmark job, installation, merge, independent approval or net efficiency claim is included.

Optional Ark complete-input qualification

The existing optional Ark adapter uses the shared host-input owner without a second converter. Real File/SQLite turn plan --host generic-cli --iteration-context fresh requests now exercise the real Ark SDK with synthetic HTTP responses. Actual user-message input retains the entire original contract. Running-receipt recovery does not resubmit input; completed receipt replay makes no provider calls. Source/version/binding corruption and an explicitly null complete input reject before provider calls or receipt creation. Historical request coverage remains.

Validation at c3065006f93f1701b39fe9dbfa24521ac4b07006: all 42 optional Ark tests pass, with Ruff, docs governance, bilingual staged/head and diff checks passing. The first invocation omitted the source root from PYTHONPATH (27 passed / 10 setup import errors); corrected source-checkout execution passed 37 tests, and the final expanded running-recovery selection passes 42. Command: PYTHONPATH=.:packages/loopx-ark-turn/src uv run --extra test --with 'arkruntime[mcp]>=0.8.0,<0.9' --with 'mcp==1.30.0' python -m pytest -q packages/loopx-ark-turn/tests.

This is SDK wire/recovery qualification, not a cloud session, model outcome, installed adoption, or Core settlement. MemT, native operation-SDK and packaged App coverage remain open. The internal effect envelope still has settlement/result/session callers; replacing final model input alone does not justify deleting it. C1 stays open, including the original quota single-session outcomes and complete-cost comparison. No runtime code or package dependency declarations changed.

MemT integration gap and shared optional-host fixture

Ark and MemT now reuse one real File/SQLite CLI request fixture. The MemT investigation exposes a producer/consumer gap: the executable legacy registry supplies no exact Goal lifetime, so MemT rejects the otherwise complete request before provider IO. The exact-lifetime source-session profile is lifecycle-only and generic Turn planning rejects it. Injecting a reference after planning would conceal this gap. Tests retain both refusals and reject complete-contract source/version/binding/null corruption before provider or receipts. The package launch guide and both controller RFC translations now disclose the missing prerequisite.

At 9c400ee24ed6a7bfc6432782d7dc39df742fc02b, MemT's full package suite passes 59, Ark 42, and Core capture 10. Ruff, docs governance, bilingual staged/head and diff checks pass. These totals qualify existing SDK fixtures, safe refusals and fixture reuse; complete-input MemT native delivery and recovery remain unqualified. The historical SDK fixture uses a tiny vocabulary and cannot establish complete prompt delivery. The attempted lossless-token positive probe failed before reaching the SDK (56 passed / 4 failed: exact lifetime missing); an exact-profile planning probe then failed at the lifecycle-only guard. Those failures are retained, not converted into positive adoption evidence. An earlier baseline invocation with relative PYTHONPATH failed after CLI subprocess cwd changes (40 passed / 8 failed); absolute source roots yielded the unchanged baseline's 48 passes.

On the MemT path, the owning repair must admit and preserve exact Goal lifetime through an executable registry, shared Turn input and recovery, including recreation/stale-instance rejection. It must not weaken MemT isolation or enable a lifecycle-only registry as a workaround. No runtime or dependency declarations changed, and no model/server/benchmark job ran. Native operation-SDK, packaged App, historical reader retirement and original quota single-session accepted-outcome/full-cost comparisons remain open. This evidence increment belongs to the integration candidate; independent reusable production fixes remain separately reviewable. C1 is still open and this PR still has unfinished author work.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork