[loopx-agent]

Quota and native Turn conveyed admitted work through different layouts and repeated interpretation. This C1 integration composes one complete contract before capture and moves actual consumers onto shared typed owners, preserving requirements, evidence, differential recovery and original settlement identity.

Author integration remains unfinished; this PR stays Draft. The packaged comparison now reaches cold/warm/lost-context recovery and once-only settlement, but does not show a positive complete-cost diff. Warm reconstruction/metadata cost, remaining caller replacement and actual decisions/accepted-outcome qualification remain concrete author work. No default promotion is proposed.

Behavior and ownership

Boundary	Shared owner and resulting behavior
Complete input	Existing quota/turn_envelope.ts composition serves quota and Turn before capture. Acceptance, authoring, Explore guidance, task title and Vision retain their existing semantic owners and complete obligations.
Legacy projection transport	Acceptance, Task-title and Explore references share one existing reference_context request. The separate acceptance operation and duplicate controller-input dispatch are removed; complete composition reuses the same functions. Replan authoring remains a distinct lifecycle.
Diagnostic projection	One quota/diagnostic_projection.ts algorithm serves existing reference callers and scoped native composition. Replaced Python Todo-list, candidate and portfolio compaction algorithms are removed. Unknown fields/lists and complex items retain their complete source; retained items, selected work, candidates and portfolio prose are not shortened. The identical module is independently proposed in normal PR #7557.
CLI execution and completion	The execution-context/task-commitment reader belongs to turn_driver/driver.py; its CLI copy is removed. Preparation and post-validation completion classification share the checked TypeScript source. Malformed/conflicting complete input rejects before writeback/spend.
Planning and native launch	driver_lineage and launch checks use shared selected work. Python retains persisted JSON/number and historical scalar/whitespace codecs; it does not independently select fresh work or rewrite the action-hash preimage.
Host preparation and recovery	Codex CLI and operation-equipped app-server share a source check for prompt/schema within a launch. Standalone/post-execution consumers check independently. An unfinished journal rechecks source and recovers the original validated result without another Host invocation or debit.
Context delivery	Scope and full/delta encoding share one typed request. Original recovery is published first; required artifacts commit before delivery. Full views page the existing immutable capture; deltas retain encoded wire.

The existing native-context opt-in applies current-Agent/relevant-outcome expansion and peer indexes with current status plus exact original-capture readers. Global intent, permissions, stops and pending reads remain; unknown relevance/fields/guidance, unresolved reads and broad replans retain full context. The scope wrapper is presentation, not a second authority. C2 default adoption, semantic independence and model retention are unqualified.

Current qualification

Final source 9e9d3fb0a, genuinely rebased onto verified main 19c213324fbb5990288bd374c1b79096f22bb152. This includes merged route owner #7520 and reference owner #7457. All 76 touched product/test paths are byte-identical to pre-rebase measurement source d33c1a19d91738c66073d9e71586f14466f36d89; the new target adds an unrelated Lark-return change. Frozen measurements remain attached to their actual source, not relabeled as a run of the final head.

• 144 final selected Python cases and 117 typed cases pass for diagnostic projection, complete context, acceptance references and portfolio preservation; control-plane typecheck and affected Ruff pass. An earlier broader run had 533 passes and five optional native/SDK skips, before unknown-item fallback was strengthened; it is not an exact-final full-suite claim.
• Independent normal Preserve complete context in shared quota diagnostics #7557, head 5b5d9dd3b0a816aae9d5160b849cff4a3c38da13, has 264 Python / 70 typed passes, including real File/SQLite status/plan/detail and exact canonical Todo/provider-revision readback. All 14 selected premerge checks pass. This independently usable legacy-reader slice does not depend on WIP: converge governed work inputs and packaged heartbeat consumers #7430. Status/plan now pays one coarse typed request; full Todo detail bypasses diagnostic transport. The native composition already has its existing request.
• 32 documentation/bilingual regression tests, full docs-governance smoke and generated-index check pass. Final committed standard premerge passes 6 reported direct checks and 19 selected checks, zero failures/manual holds. Diff/bilingual/public-boundary and semantic checks do not grant merge authority.
• Matched source/wheel parity is 1,884 base / 1,885 candidate product members. The candidate wheel is from pre-rebase d33c1a19d; final docs do not change its measured runtime. No global installation or active Goal used as a test fixture.

The prior 469-pass/5-skip and 116-typed checkpoint remains versioned in the ledger. Initial author runs retain their failures: two former lossy-output assertions, the foundation's former zero-request assumption (User context still needed compaction), a fixture using the raw authoring reader, and one nonexistent selected test path. The final targeted tests correct the expected semantics and use actual canonical CLI readers; unchanged settlement cases were not needlessly repeated. Earlier rebase call-count, helper-import, build fingerprint/dependency, harness-carrier and concurrent-index failures remain recorded authoring costs. No failed run is relabeled as passed.

A crowded diagnostic unit fixture grows to 43,862 characters because complete candidate records are retained. No public interface budget was increased. The unchanged public v4 multi-Agent budget probe passes on original quota but fails at 27,934 > 13,000 characters on both the preceding and current integration wheels. This existing integration gap remains open and is not covered by a green standard canary selection.

Earlier completion sensitivity remains versioned evidence: eight same-body source-replacement cases commit on the immutable baseline and reject on the candidate before writeback/spend, then recover the original result with one Host invocation/debit. Historical Unicode/BOM identity failures and correction remain in the paired RFC. Older full-tree/SDK/model/remote-CI conclusions do not transfer to this source.

Packaged heartbeat versus original quota

The bilingual measurement checkpoint preserves the earlier negative comparison and adds one matched cohort using the same frozen harness, path lengths and real isolated File/SQLite authorities. Base remains original quota 843be494266774b63b3de61d0adf5dd7f4f877a2; candidate runtime is d33c1a19d91738c66073d9e71586f14466f36d89.

Actual wheel CLI calls cover thin bootstrap, guarded native context, all required pages/Goal reads, synthetic native hooks, warm delta, PostCompact/SessionStart and full recovery of the same original capture. Tampering/early debit reject; refresh/spend replays preserve one effect/debit and the open task. All 24 original clauses/owners/work/unverified states survive peer expansion. This is packaged engineering with simulated host continuity, not model retention or a controller/executor experiment.

Backend / phase	Context bytes, original → candidate	Stdout bytes	Logical requests	Total CLI ms
File / cold	75,648 → 70,388	95,004 → 89,875	103 → 102	4,959.03 → 6,475.69
File / warm	41,252 → 44,029	58,401 → 61,183	99 → 98	3,465.08 → 4,538.62
File / recovery	74,880 → 69,618	90,113 → 84,903	6 → 6	5,108.18 → 5,762.51
SQLite / cold	75,740 → 70,492	95,114 → 89,997	103 → 102	5,771.16 → 5,856.03
SQLite / warm	41,346 → 44,133	58,509 → 61,301	99 → 98	3,772.95 → 3,794.99
SQLite / recovery	74,974 → 69,722	90,217 → 85,017	6 → 6	4,226.47 → 5,113.92

Both arms use 13/9/13 CLI calls; invalidation is two extra hooks. Candidate expansion of all five peers adds 13,940 content bytes, 10 CLI/logical calls, 17,620 stdout bytes and 4.11–4.88 s per phase; original quota already carries those bodies inline. The seven negative/settlement/readback calls use 226 logical requests in each arm with equal per-backend stdout. Setup, builds, failed probes and optional reads remain separate recorded costs.

Cold/recovery content falls about 5.3 KB, but warm content grows about 2.8 KB and all-peer consumption remains more expensive. All observed candidate phases are slower in this cohort. One observation per arm/backend/phase and uncontrolled background load support no causal speedup, p95 or default SQLite performance qualification. The intermediate repeated-capture-command variant was larger still (File/SQLite warm 45,187/45,303 bytes); the shared-reference correction preserves that negative history.

Four cold/warm File/SQLite presentations independently compare original source captures for complete selected work, boundary, horizon, capability candidates and portfolio. An intentionally mutated QA wheel deleting capability_gate fails through the real packaged guard/reader path. This establishes sensitivity to lost decision context, not model adherence or outcome benefit.

Next C1 work diagnoses warm reconstruction/metadata cost without losing obligations, then qualifies remaining consumers, actual decisions/outcomes and writer cutover. No positive complete-cost diff or default promotion is claimed.

Historical cost evidence retained

Against immutable 2a170247ba3, three balanced sequential cohorts use clean sibling copies, identical source inventories and bytecode disabled. Warm helper rows have 93 samples per arm/case; identical native workload rows have three per arm/case. No other owned validation runs alongside the cohorts; background host load is uncontrolled.

Complete completion-intent/recovery classification now adds one coarse source-check request after execution, while the launch guard adds none. Frozen helper medians rise from about 0.002 ms to 19.005–20.770 ms; p95 is 22.458–26.454 ms. Each request carries 43,200/43,253 B for File/SQLite plus a 1,693 B result. Historical classification remains zero requests with equivalent outcomes. Logical JSON counts exclude framing and physical transport retries.

Actual CLI completion	Baseline median [range], ms	Candidate median [range], ms	Logical requests
File / ordinary	2303.0 [2001.9–3646.5]	2173.5 [2051.4–2196.6]	282 → 283
File / final	2306.0 [2283.4–2389.4]	2818.4 [2338.2–2973.9]	294 → 295
SQLite / ordinary	1888.5 [1758.5–2061.7]	2513.5 [2086.5–2955.7]	278 → 279
SQLite / final	2549.1 [2240.7–2681.2]	2282.7 [2276.8–4064.8]	294 → 295

The timed CLI includes actual admission/capture/Host/validation/settlement. Native Todo readback and committed replay are measured separately; complete outcome observations agree, including original effect identity and one debit. Committed replay remains 5 logical requests, zero new effects in both arms. Three samples do not support a p95 or causal speedup. The source check is a demonstrated added cost; whole-CLI results are mixed and default SQLite performance is not qualified.

Earlier negative observations remain: the corrected 6e84e811909 planner/recovery comparison kept 2/1 RPCs and equal ordinary bytes, but SQLite complete-plan median/p95 changed 39.600/46.547→40.036/77.714 ms. Initial ef479d2b5 and its clean control stayed mixed/slower. The earlier Codex 2→1 preparation result does not cancel negative structured-Host rows, original-quota cold JSON +4.18–6.44%, short-source +1,655 B, unchanged warm-artifact bytes or mixed detail/recovery costs. Full tables and original scopes remain in the paired RFC.

No matched real-model decisions/outcomes, cache tokens, billing, evaluation, implementation/human costs or long-horizon net benefit are qualified. Owned V8 profiles from the earlier scope do not explain this CLI timing.

Dependencies, remaining work and rollback

• Merged and adopted: #7520 route owner (a78f9772c), #7457 exact references (97d38f9a8). Main's recovery guards (fix(turn): block ambiguous dispatch and revoked recovery #7456) and managed-operation owner (refactor(turn): unify managed operation IO and fence session initialization #7515) remain intact. test(quota): validate live observation clocks in cache parity #7464's duplicate patch is absent.
• Independent diagnostic proposal: #7557, with an identical shared module and standalone adoption/rollback.
• Separate proposals (not adopted as merged): #7517 intelligent-controller design and #7468 rejection/migration diagnostics. Deterministic composition/codecs are distinct from controller reasoning.
• Unfinished author work: warm reconstruction/metadata cost and remaining v0 Host/controller/material consumers; historical-reader exit qualification; packaged App/SDK/benchmark paths and MemT's exact-lifetime producer. The MemT gap holds its dependent path. Compare original-quota single-session actual input, decisions, accepted outcomes and all costs before cutover; intelligent two-session mediation is assessed separately.

Independently usable owner slices retain separate PRs. Roll back each owner/caller pair together and reconcile outstanding original receipts before changing admission; historical journal decoding is retained until its real callers/recovery qualify retirement. C1 stays open; local evidence gaps do not stop independent authorized work.

The paired RFC, roadmap, generated RFC index and protocol guidance record the actual boundary and mixed/negative cost results. No self-merge, installation, release, new paid-model call, managed benchmark or manual CI dispatch was performed. Tokens/cache, billing, verification outcomes, full implementation/human cost and long-horizon net benefit remain unqualified.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork