WIP: converge governed work inputs and packaged heartbeat consumers

docs/architecture/rfcs/STATUS.md

@@ -31,7 +31,7 @@ appendix may keep dated history, but no dated log heading may precede it.
 | [RFC: Capable Agent Manager and Semantic Work Handoff (v0)](capable-manager-semantic-handoff-v0.md) | Accepted | [Personal Follow-through independent proposal](personal-follow-through-v0.md) | [2 entries](ledger/capable-manager-semantic-handoff-v0/) |
 | [RFC: Complete State Recovery and Controlled Reactivation (v0)](complete-state-recovery-v0.md) | Accepted | none | — |
 | [RFC: Composable State Machines and Recovery Verification (v0)](composable-state-machines-recovery-verification-v0.md) | Accepted | none | — |
-| [RFC: Controller / Executor Sessions and One Governed Work Contract (v0)](controller-executor-unified-contract-v0.md) | Accepted | none | [1 entry](ledger/controller-executor-unified-contract-v0/) |
+| [RFC: Controller / Executor Sessions and One Governed Work Contract (v0)](controller-executor-unified-contract-v0.md) | Accepted | none | [2 entries](ledger/controller-executor-unified-contract-v0/) |
 | [Explicit Todo continuation: Stage A](cross-session-memory-substrate-v0.md) | Accepted | none | — |
 | [RFC: LoopX Desktop Execution Frontends v0](desktop-execution-frontends-v0.md) | Accepted | none | — |
 | [RFC: External Evidence Research Capability v0](external-evidence-research-capability-v0.md) | Accepted | none | [3 entries](ledger/external-evidence-research-capability-v0/) |

docs/architecture/rfcs/STATUS.zh-CN.md

@@ -28,7 +28,7 @@
 | [RFC：强能力 Agent 管家与语义工作交接（v0）](capable-manager-semantic-handoff-v0.zh-CN.md) | 已接受 | [个人事项持续跟进独立提案](personal-follow-through-v0.zh-CN.md) | [2 条](ledger/capable-manager-semantic-handoff-v0/) |
 | [RFC：完整状态恢复与受控重新激活（v0）](complete-state-recovery-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：可组合状态机与恢复验证（v0）](composable-state-machines-recovery-verification-v0.zh-CN.md) | 已接受 | 无 | — |
-| [RFC：Controller / Executor 会话与统一受治理工作契约（v0）](controller-executor-unified-contract-v0.zh-CN.md) | 已接受 | 无 | [1 条](ledger/controller-executor-unified-contract-v0/) |
+| [RFC：Controller / Executor 会话与统一受治理工作契约（v0）](controller-executor-unified-contract-v0.zh-CN.md) | 已接受 | 无 | [2 条](ledger/controller-executor-unified-contract-v0/) |
 | [显式 Todo 接续：阶段 A](cross-session-memory-substrate-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：LoopX 桌面执行前端 v0](desktop-execution-frontends-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：外部证据研究能力 v0](external-evidence-research-capability-v0.zh-CN.md) | 已接受 | 无 | [3 条](ledger/external-evidence-research-capability-v0/) |

docs/architecture/rfcs/loopx-overall-roadmap-v0.md

@@ -202,6 +202,29 @@ host prompts. A common capture does not unify those consumers. Qualification
 checks source obligations through composition, reconstruction and actual final
 input; new-admission cutover stays separate from historical receipt replay.
 
+The [packaged C1 heartbeat checkpoint](ledger/controller-executor-unified-contract-v0/2026-10-28-packaged-heartbeat.md)
+preserves required source and same-capture settlement semantics on isolated
+File/SQLite. Its diagnostic follow-through reuses one typed owner and removes the
+Python duplicates; [#7557](https://github.com/loopx-project/loopx/pull/7557) is merged,
+and #7430 reuses its repaired module. Later complete-Goal and scoped-prose reuse
+improves cold, warm and recovery stdout against the original quota baseline when
+both arms include all mandatory reads. Earlier negative warm cohorts and the
+integration's existing v4 budget failure remain recorded; optional all-peer reads
+still add cost. [#7575](https://github.com/loopx-project/loopx/pull/7575) is merged
+as an independently usable native complete-Goal/reuse slice: warm input improves,
+while cold and recovery incur extra overhead. C1 adopts that shared implementation
+and now references identical Todo-summary lanes within the same complete capture;
+the original v4 budget still fails. Continue C1 on remaining real consumers,
+writer cutover and reader retirement with complete unknown-field/obligation
+preservation. These engineering observations do not promote defaults or qualify
+model-token, complete-cost or actual decision/outcome benefit.
+
+The same integration codec now adopts merged [#7528](https://github.com/loopx-project/loopx/pull/7528)
+for exact relocated evidence with literal current overrides, including scoped
+context. The ledger records smaller relocation-only deltas alongside the still
+negative ordinary-warm byte comparison; this is shared-owner adoption, not a
+second encoder or default promotion.
+
 Use that RFC’s C1–C9 task/deletion map within the existing work streams: first
 qualify unified single-session inputs, then role binding and shared lifecycle,
 replan/result authoring, executor exchange, benchmark reuse, packaged App

docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md

@@ -155,6 +155,22 @@ C1 的[消费链切换表](controller-executor-unified-contract-v0.zh-CN.md#c1-
 共享 capture 不表示这些消费者已统一。资格检查须追踪来源义务经过组合、重建到实际
 最终输入；新准入切换与历史回执重放分别处理。
 
+[C1 打包 heartbeat 检查点](ledger/controller-executor-unified-contract-v0/2026-10-28-packaged-heartbeat.zh-CN.md)
+在隔离 File/SQLite 保留必读来源及同 capture 结算语义。后续诊断投影复用同一 typed
+owner 并删除 Python 重复算法；[#7557](https://github.com/loopx-project/loopx/pull/7557)
+已合并，#7430 复用修复后的模块。后续完整 Goal 与作用域指令复用，在两组均计入全部
+必读内容后，相比原 quota 基线减少冷态、温态和恢复 stdout。历史温态负向 cohort 与
+集成原有 v4 预算失败仍保留，可选全部 peer 补读仍另增成本。
+[#7575](https://github.com/loopx-project/loopx/pull/7575) 已合并，提供可独立使用的原生完整
+Goal／复用切片：温态输入改善，冷态与恢复则增加开销。C1 采用该共享实现，并在同一
+完整 capture 中引用相同的 Todo 摘要列表；原 v4 预算仍失败。原 C1 继续剩余真实消费者、writer
+切换与 reader 退役，保留未知字段和完整义务。这些工程观察不提升默认，也不认证模型
+token、完整成本或实际决策／成果收益。
+
+同一集成 codec 现采用已合入的 [#7528](https://github.com/loopx-project/loopx/pull/7528)，在精确
+搬移证据上叠加字面当前控制，覆盖 scoped context。Ledger 同时记录局部搬移差分变小
+和普通温态字节对照仍负向；这是采用共享 owner，没有新增第二编码器或提升默认。
+
 把该 RFC 的 C1–C9 任务/删除表放在既有工作流内：先验收统一单会话输入，再做角色绑定
 与共享生命周期、replan/结果编写、executor 交流、benchmark 复用、打包 App readback
 及退役。App heartbeat 流程和实际 benchmark 消费者分别验收；managed Codex 可以作为

docs/heartbeat-automation-prompt.md

@@ -453,6 +453,10 @@ In a supported run mode, a missing or invalid continuity basis still
 delivers the same original full capture. The current recovery reference is saved
 before optional delta computation, so an oversized warm request or failed
 candidate update cannot select an older capture after compaction or resume.
+The unified-contract C1 candidate combines outcome scope and encoding in that
+same typed call, commits the exact required artifact before publication, and
+pages existing full captures without writing an unused duplicate wire file.
+This candidate optimization does not qualify installed adoption or outcome gains.
 If the current recovery cannot be saved, the old session lookup is invalidated;
 use the explicit original capture reference. If preparation fails before that
 can be established, or invalidation also fails, the CLI reports

docs/reference/protocols/loopx-turn-v0.md

@@ -1006,6 +1006,48 @@ writeback ordering.
 
 ## Cross-Iteration Context Policy
 
+Captured supporting outcomes have one ordinary/replan read owner. With an
+original decision file and its exact byte digest, use
+`loopx --format json quota context-read --capture-file CAPTURE --capture-sha256 SHA256 --outcome-ref`
+to page the current outcome index. Add the exact returned outcome reference
+after `--outcome-ref` to page its full original detail. Follow the returned byte
+cursor/command through EOF; every page revalidates that original file. The page
+`sha256` binds the whole capture, while offsets and `total_bytes` address only
+the selected index/detail JSON. Follow the returned `--selection-sha256` as well:
+it binds the derived JSON layout and rejects mixed renderings after a reader
+upgrade even when the original file is unchanged. Index rows retain owner/work and requirement
+identities grouped by exact existing status, planning and Agent-review facts;
+missing facts remain unknown, and an Agent review is not an independent check.
+Same-id revisions have distinct references. A failed/unsupported detail read
+requires the original full-capture recovery, never another guard.
+
+The canonical selected-work read can attach `outcome_context_read_plan_v0`
+from the same complete authority snapshot. The index's `required_in_scope`
+labels reflect that plan's typed work, shared acceptance/source/evidence and
+current failure closure only when its identity, provider revision and whole
+acceptance-source digest match. Missing, changed or unsupported coverage keeps all
+outcomes required in the candidate plan; broad replan reads also keep all.
+`scope_applied=false`: the plan is advisory until delivery, required reads and
+Host recovery migrate together. It does not prove arbitrary semantic independence.
+These optional reads do not replace existing full-read obligations.
+Native retention observation rejects scoped pages
+even when their digest matches the capture. Reading a new authority revision
+later cannot replace the original observation; no Goal/provider read, admission,
+Host invocation, writeback or quota spend occurs in this reader.
+
+给定原 decision 文件及其精确字节 digest，`context-read --outcome-ref` 分页读取成果
+索引，附返回的精确引用则读取成果全文。普通与 replan 复用同一 typed owner；按
+返回游标读到 EOF，每页重验原文件。`sha256` 绑定整个 capture，offset/total_bytes
+只定位所选索引/正文。接续命令的 `--selection-sha256` 还绑定派生 JSON 字节，
+防止 reader 升级后在原文件 hash 未变时混合渲染。索引按精确当前状态分组要求标识，保留 owner、工作关联和
+未知，Agent review 不充当独立检查；同 id 的不同版本分别引用。选定工作读取可从
+同一完整 authority 快照附 `outcome_context_read_plan_v0`。身份、provider revision
+及完整验收来源 digest 一致时，`required_in_scope` 反映 typed 工作、共同验收/来源/
+证据与当前失败闭包。覆盖缺失、变化或不支持以及广域 replan 均保留全部成果。
+显式 `scope_applied=false`：交付、必读和 Host 恢复共同迁移前，计划仅供参考，不能
+证明任意语义独立性。可选详情不替代现有完整必读义务，不能建立 Host 完整保留证明。
+读取失败恢复原 capture，不重新准入；不读取新 Goal 状态或执行/写回/扣额。
+
 Each `turn plan` or `turn run-once` invocation declares an iteration context
 policy independently from the Todo and Goal lifecycle:
 

docs/reference/protocols/quota-cli-hot-path-compaction-v0.md

@@ -85,27 +85,61 @@ neither enables native tracing nor changes the default-off transport switch.
 控制字段和原始捕获均保留。`--include-detail agent-todos` 保留内联标题。
 这是普通 CLI 序列化去重，差分开关关闭和开启时均适用，不会开启原生追踪或改变默认关闭。
 
-Exact Task-title and Explore-guidance sharing now use the existing TypeScript
-context owner; the Python quota projection delegates both operations in one
-coarse transport call, preserving each explicit detail selector. With both
-selectors enabled, or no context source carrier, it needs no sharing call. Current
-quota and Turn entrypoints retain their schemas. Explore guidance shares only
-identical inline durable-writeback instructions within the same response, and
-stays inline when the reference would be larger. Before relocating context,
-Turn and staged replan readers restore that guidance from its settlement owner.
-Dangling, chained, conflicting or incorrectly typed references reject rather
-than silently losing instructions. Settlement commands, identities and original
-source content remain unchanged. This shared-owner prerequisite does not qualify
-the proposed complete-contract cutover or claim an end-to-end efficiency gain.
-
-精确任务标题与 Explore 指引共享复用既有 TypeScript 上下文 owner，Python quota
-投影通过一次粗粒度调用委托这两项操作，分别保留显式 detail 选择；两项 detail
-均启用或不存在上下文源载体时无需共享调用。当前 quota 与 Turn 入口保持各自
-schema。Explore 仅共享本响应
-内与 durable-writeback 指引完全相同的正文；引用更大时保留内联。Turn 与分阶段
-replan reader 在移动上下文前，从原结算 owner 恢复指引。悬空、链式、冲突或类型
-错误的引用会被拒绝，不静默丢失指令。结算命令、身份与原始源内容保持不变。
-这一共享 owner 前置不代表完整契约切换已通过验收，也不声称端到端效率提升。
+During the C1 migration, exact current-Task title sharing is owned by the
+TypeScript decision composer in `turn_envelope.ts`. The legacy Python display
+helper shares one coarse transport call with Explore-guidance and Goal-acceptance
+sharing; each explicit task/Explore detail selector is preserved. Acceptance
+still shares exact duplicates when both selectors request inline detail. A call
+limited to task/Explore sharing needs no transport without a source carrier or
+with both selectors disabled. Replan-authoring projection keeps its separate
+lifecycle; it is not another acceptance/task/Explore call. Label-prefix omission
+stays display-only.
+Complete `loopx_turn_envelope_v1` decisions share before hashing/capture and
+validate the same-capture target on recovery. Conflicting inline/reference values,
+chains, malformed paths or a no-longer-verified selected Task reject even with
+valid integrity hashes. This source sharing does not require differential delivery.
+The `--include-detail` behavior above describes the historical display projection;
+it does not select an alternative complete contract. Retire its delegate with the
+legacy display callers while retaining supported historical capture recovery.
+
+C1 迁移中，当前 Task 标题的精确共享归 `turn_envelope.ts` 的 TypeScript decision
+composer 所有；旧 Python 展示 helper 与 Explore 指引、Goal acceptance 共享合用
+一次粗粒度调用，分别保留任务／Explore detail 选择；两项均要求内联详情时，验收
+仍共享精确重复。仅请求任务／Explore 共享时，无源载体或两项均停用才无需传输。
+Replan authoring 投影保留独立生命周期，不构成另一轮验收／任务／Explore 调用。
+按 label 前缀省略仍仅属于展示。
+完整 `loopx_turn_envelope_v1` 在 hash／capture 前共享，恢复时验证同一 capture 的目标。
+原文／引用冲突、引用链、非法路径或当前选中 Task 无法继续核验时，即使完整性 hash
+有效也拒绝。该来源共享不要求开启差分。上文 `--include-detail` 描述历史展示投影，
+不会选择另一套完整契约；委托随旧展示调用者退役，支持的历史 capture 恢复继续保留。
+
+The same composer also owns exact nested vision-audit sharing. The root keeps the
+full audit and judge; the existing `projection_ref` carries only matching audit
+and judge decision fields. Type-sensitive full-JSON comparison preserves different
+channel facts and short audits inline. Complete readers reject unavailable owners,
+reference chains and conflicting copies before effects. Historical envelopes keep
+the inline-root judge, and the old display adds only its existing metadata. This
+delegate retires with the same caller migration; it is not a second rule owner.
+
+同一 composer 也拥有嵌套 vision audit 的精确共享。根保留完整 audit 和 judge；已有
+`projection_ref` 仅携带匹配的 audit／judge 判定字段。完整 JSON 的类型敏感比较使
+不同 channel 事实和短 audit 保持内联。完整 reader 在产生效果前拒绝不可用 owner、
+引用链及冲突副本。历史 envelope 保留内联根 judge，旧展示只添加既有 metadata；
+委托随同一调用链迁移退役，不构成第二个规则 owner。
+
+A declined `should-run` decision with an interaction contract uses that same
+complete composer before capture. Failure still prevents host handoff and native
+context-baseline publication; validation never grants work or settlement. An
+error before an interaction contract exists remains the original typed diagnostic
+and recovery payload, with either CLI flag spelling. It is neither a fabricated
+work contract nor a historical-envelope fallback. Readers must preserve the
+original receipt and capture when transport fails after admission.
+
+已有 interaction contract 的拒绝 `should-run` 判定也在 capture 前使用同一完整
+composer。失败仍阻止 host handoff 和原生 context baseline 发布，验证不授予工作
+或结算权限。interaction contract 形成前的错误在两种 CLI flag 写法下都保留原
+typed 诊断及恢复 payload，不补造工作契约、不回退历史 envelope。准入后传输失败
+时，reader 必须保留原 receipt 和 capture。
 
 When a replan action carries a complete `vision_authoring` schema, the default
 `quota should-run` packet now retains it, alongside its executable writeback