C1: deliver complete-source Turn input and recovery

docs/architecture/rfcs/STATUS.md

@@ -31,7 +31,7 @@ appendix may keep dated history, but no dated log heading may precede it.
 | [RFC: Capable Agent Manager and Semantic Work Handoff (v0)](capable-manager-semantic-handoff-v0.md) | Accepted | [Personal Follow-through independent proposal](personal-follow-through-v0.md) | [2 entries](ledger/capable-manager-semantic-handoff-v0/) |
 | [RFC: Complete State Recovery and Controlled Reactivation (v0)](complete-state-recovery-v0.md) | Accepted | none | — |
 | [RFC: Composable State Machines and Recovery Verification (v0)](composable-state-machines-recovery-verification-v0.md) | Accepted | none | — |
-| [RFC: Controller / Executor Sessions and One Governed Work Contract (v0)](controller-executor-unified-contract-v0.md) | Accepted | none | [5 entries](ledger/controller-executor-unified-contract-v0/) |
+| [RFC: Controller / Executor Sessions and One Governed Work Contract (v0)](controller-executor-unified-contract-v0.md) | Accepted | none | [12 entries](ledger/controller-executor-unified-contract-v0/) |
 | [Explicit Todo continuation: Stage A](cross-session-memory-substrate-v0.md) | Accepted | none | — |
 | [RFC: LoopX Desktop Execution Frontends v0](desktop-execution-frontends-v0.md) | Accepted | none | — |
 | [RFC: External Evidence Research Capability v0](external-evidence-research-capability-v0.md) | Accepted | none | [3 entries](ledger/external-evidence-research-capability-v0/) |

docs/architecture/rfcs/STATUS.zh-CN.md

@@ -28,7 +28,7 @@
 | [RFC：强能力 Agent 管家与语义工作交接（v0）](capable-manager-semantic-handoff-v0.zh-CN.md) | 已接受 | [个人事项持续跟进独立提案](personal-follow-through-v0.zh-CN.md) | [2 条](ledger/capable-manager-semantic-handoff-v0/) |
 | [RFC：完整状态恢复与受控重新激活（v0）](complete-state-recovery-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：可组合状态机与恢复验证（v0）](composable-state-machines-recovery-verification-v0.zh-CN.md) | 已接受 | 无 | — |
-| [RFC：Controller / Executor 会话与统一受治理工作契约（v0）](controller-executor-unified-contract-v0.zh-CN.md) | 已接受 | 无 | [5 条](ledger/controller-executor-unified-contract-v0/) |
+| [RFC：Controller / Executor 会话与统一受治理工作契约（v0）](controller-executor-unified-contract-v0.zh-CN.md) | 已接受 | 无 | [12 条](ledger/controller-executor-unified-contract-v0/) |
 | [显式 Todo 接续：阶段 A](cross-session-memory-substrate-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：LoopX 桌面执行前端 v0](desktop-execution-frontends-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：外部证据研究能力 v0](external-evidence-research-capability-v0.zh-CN.md) | 已接受 | 无 | [3 条](ledger/external-evidence-research-capability-v0/) |

docs/architecture/rfcs/ledger/controller-executor-unified-contract-v0/2026-10-29-complete-numeric-integrity.md

@@ -0,0 +1,102 @@
+# Numeric integrity for complete contracts and Host transport
+
+中文镜像：[同名检查点](2026-10-29-complete-numeric-integrity.zh-CN.md)。
+
+This is proposed C1 integration in [#7430](https://github.com/loopx-project/loopx/pull/7430),
+not a mainline or installed cutover. The comparison starts at
+`4173cc2ee7ef94de00ca777ff8600455c080c29f`, after integrating main
+`33d9ecd9fd29bce4986da6c9e9a6b758a24f91b3` and the preceding source-comparison ledger. Numeric binding is
+implemented at `974cd09ef7cb12832911ee58880aaf25e86fb2b2`; the final runtime
+`e18d46db51c58ee17c770d7bba915f0133cf9f78` also retires the unused source echo.
+
+## One source identity through actual consumers
+
+The preceding [packaged comparison](2026-10-29-packaged-source-comparison.md)
+showed that a complete contract accepted `1.0 → 1` while its original capture-byte
+check refused the changed file. The new experimental binding explicitly declares
+`hash_codec=context_source_numbers_v1`. Its source and content commitments use the
+existing TypeScript source identity, including sparse producer numeric encodings.
+These distinguish integer/float values, negative zero and large integers that a
+JavaScript parse can otherwise merge. Exact byte layout and alternative spellings
+of the same producer value remain the separate capture-byte boundary.
+
+| Consumer / owner | Convergence |
+| --- | --- |
+| `diagnostic_projection.ts::contextSourceIdentity` | Track retained or relocated values; removed carriers leave no numeric tokens in the projected identity. Existing callers without metadata retain their canonical identity. |
+| `turn_envelope.ts` composition and complete validation | One numeric-aware binding, reused by replan reads, capture binding, Host checks and driver lineage. The complete path no longer recomputes a normalized whole-decision hash at each seam. |
+| Python Turn transport | Derive sparse numeric encodings from original values and apply the existing source edits. No second digest, selection or recovery rule. |
+| `host_candidate.py::complete_host_input` | Consume the existing compact `host_context` check. Delete the unused `validate_complete` source-echo operation; retain original model-source values. |
+
+Missing/unsupported codecs or missing numeric transport reject before dependent
+work. Older experimental complete bindings need their pinned reader; raw captures
+are not rewritten. Historical v0 hashes, Turn keys and receipt decoding retain
+their existing behavior. The binding adds integrity, not execution authority or a
+new model-facing view.
+
+## Qualification and remaining failures
+
+Five numeric mutation cases fail on the unchanged baseline and pass after repair
+across seven complete consumers. Additional tests cover unsupported codecs,
+missing numeric transport, actual File/SQLite replan-file refusal/restoration,
+malformed references, original-capture recovery and once-only settlement.
+Capture rejection retains the original-observation diagnostic and error code.
+The unified failure writer preserves the collection error without attempting a
+legacy runtime renderer or manufacturing a complete contract.
+
+The affected Python ladder passes 457 cases at `974cd09ef`. On the final runtime,
+the retirement ladder passes 220 cases; one new assertion initially reversed the
+existing unsupported-operation message wording, and its corrected case passes
+separately. The final TypeScript ladder passes 149 cases. Touched-file typing
+passes; a broader eight-file check still has 27 inherited errors versus 32 on the
+baseline, with no new errors. This is not full typing qualification. The initial
+442-pass/13-failure integration run is retained: it exposed capture diagnostics,
+old fixture hash arguments and an obsolete failure-format assumption. The
+corrections retain the original semantic refusal assertions.
+
+After integrating main `3b4641c4fc0ec314d347f74b05880bb516012049`, product
+sources remain identical to the final runtime above. Native file-manifest,
+selection and compaction/recovery tests pass 198 cases; 46 native-binary opt-in
+cases remain skipped. The external scheduler/worker ladder passes 183 cases.
+Ark Host passes 39 local protocol fixtures with `arkruntime` 0.8.0 and mock
+transport in a private dependency target. Resolving the full optional SDK profile
+was stopped after its service-dependency expansion; this selected fixture run
+does not qualify that installation profile or a live provider. MemT Host fixtures
+cannot collect because tokenizer/runtime dependencies are unavailable. Neither
+optional live provider nor model behavior is qualified.
+
+Both isolated Python 3.14 wheels contain 1,860 product files matching their pinned
+source, with generated frontend assets checked separately. The same synthetic
+six-outcome/24-requirement workload runs through real File and SQLite CLI, native
+hooks, compaction, corruption recovery, early-spend refusal and single settlement.
+All 21 existing source/recovery predicates pass in every arm. The baseline still
+accepts the numeric-only semantic mutation; the final runtime refuses it. Actual
+emitted warm files reconstruct exactly; missing baselines and damaged deltas
+recover the same full source. No live Goal, installed host or model is a fixture.
+
+## Costs and next boundary
+
+| Packaged observation | File: baseline → repair | SQLite: baseline → repair |
+| --- | --- | --- |
+| Cold saved presentation | 68,407 → 68,602 bytes | 68,515 → 68,706 bytes |
+| Actual warm delta file | 3,755 → 3,775 bytes | 3,763 → 3,783 bytes |
+| Complete observer CLI stdout | 494,448 → 495,559 bytes | 495,234 → 496,329 bytes |
+
+Every arm makes 38 observer CLI calls plus one actual-delta read. Nine in-process
+codec operations and one standalone integrity control are additional qualification
+work, not a mandatory model reading policy. Package/fixture path-length differences
+are included in these byte totals; the growth is not attributable solely to the
+codec field. This C1-before/C1-after cohort does not replace the original-quota
+comparison or the earlier frozen **25,862 > 13,000** failure.
+
+For the standalone Host consumer, the same 68,227-byte synthetic source yields
+one RPC in both versions. Request-parameter JSON grows 108,061 → 108,150 bytes;
+result JSON shrinks 68,504 → 207 bytes. Original task, facts and constraints remain
+exact; the new contract binding itself adds 41 bytes. Both installed wheels
+reproduce this result. These are argument/result JSON sizes, excluding protocol
+framing, composition/setup, model input processing, timing, memory and full Turn
+cost. Deleting an unused echo does not establish a positive whole-path result.
+
+Continue within the original C1 owner on remaining consumer/writer cutover,
+historical-reader exit and comparable accepted outcomes with complete costs.
+Keep existing independent source-fidelity PRs and their owners; this checkpoint
+does not promote defaults, launch an experiment or close C1.

docs/architecture/rfcs/ledger/controller-executor-unified-contract-v0/2026-10-29-complete-numeric-integrity.zh-CN.md

@@ -0,0 +1,79 @@
+# 完整契约的数值完整性与 Host 运输
+
+English mirror: [the same checkpoint](2026-10-29-complete-numeric-integrity.md).
+
+这是 [#7430](https://github.com/loopx-project/loopx/pull/7430) 中提议的 C1 集成，
+尚未切换 mainline 或安装入口。对照基线为
+`4173cc2ee7ef94de00ca777ff8600455c080c29f`，已集成 main `33d9ecd9fd29bce4986da6c9e9a6b758a24f91b3` 和前一份
+来源对照 ledger。数值 binding 实现在 `974cd09ef7cb12832911ee58880aaf25e86fb2b2`；
+最终 runtime `e18d46db51c58ee17c770d7bba915f0133cf9f78` 同时退役无用的来源 echo。
+
+## 同一来源身份贯穿实际消费者
+
+前一份[打包对照](2026-10-29-packaged-source-comparison.zh-CN.md) 发现：完整契约接受
+`1.0 → 1`，原始 capture 字节校验却拒绝变更文件。新实验 binding 显式声明
+`hash_codec=context_source_numbers_v1`，来源与内容承诺复用既有 TypeScript 来源身份，
+包含稀疏 producer 数值编码，区分 JavaScript parse 可能合并的整数／浮点、负零及大
+整数。精确字节布局及同一 producer 值的其他写法仍由独立 capture 字节边界负责。
+
+| 消费者／owner | 收敛方式 |
+| --- | --- |
+| `diagnostic_projection.ts::contextSourceIdentity` | 跟随保留／搬移的值；删除的 carrier 不在投影身份中留下数值 token。没有 metadata 的既有 caller 保留原 canonical identity。 |
+| `turn_envelope.ts` 组合与完整验证 | 同一数值 binding 供 replan、capture、Host 检查及 driver lineage 复用；完整路径不再在每个接缝重新计算归一化整份 decision hash。 |
+| Python Turn 运输 | 从原始值派生稀疏数值编码，并应用既有来源 edits；不新增第二套 digest、选择或恢复规则。 |
+| `host_candidate.py::complete_host_input` | 复用紧凑的 `host_context` 检查，删除无调用方的 `validate_complete` 来源 echo operation，保留原模型来源值。 |
+
+缺失／不支持的 codec 或缺少原数值运输信息在依赖工作前拒绝。旧实验完整 binding 须
+使用版本固定的 reader，原 capture 不改写。历史 v0 hash、Turn key 与回执 decoder
+保留既有行为。该 binding 增加完整性检查，不授予执行权限或新增模型侧视图。
+
+## 验证与剩余失败
+
+五种数值 mutation 在未修改基线上失败，修复后通过七类完整消费者。补充验证覆盖不
+支持的 codec、丢失数值运输、真实 File/SQLite replan 文件拒绝／恢复、畸形引用、
+原 capture 恢复及一次结算。Capture 拒绝保留原始观察诊断与 error code。统一失败
+writer 保留 collection error，不调用旧 runtime renderer 或制造完整契约。
+
+`974cd09ef` 的受影响 Python ladder 457 过。最终 runtime 的退役 ladder 220 过；
+一条新增断言最初把既有“不支持 operation”消息的词序写反，纠正后该用例单独通过。
+最终 TypeScript ladder 149 过。修改文件的类型检查通过；扩大至八文件仍有 27 个继承
+错误，基线为 32 个，没有新增错误，不据此宣称完整类型资格。保留初始 442 过／13 败
+集成运行：它暴露 capture 诊断、旧 fixture hash 参数及过期失败格式假设；纠正后仍
+保留原语义拒绝断言。
+
+合入 main `3b4641c4fc0ec314d347f74b05880bb516012049` 后，产品源码仍与上述最终
+runtime 相同。原生 file-manifest、选择及压缩／恢复测试 198 过，46 条 native binary
+opt-in 用例仍跳过；external scheduler／worker ladder 183 过。Ark Host 在私有依赖
+目录使用 `arkruntime` 0.8.0 和 mock transport，39 条本地协议 fixture 通过。完整可选
+SDK profile 的 service 依赖展开已被限时停止；这组精选 fixture 不证明该安装 profile
+或 live provider。MemT Host 缺少 tokenizer／runtime 依赖，无法收集 fixture。两条可选
+live provider 及模型行为均未取得资格。
+
+两份隔离 Python 3.14 wheel 各有 1,860 个产品文件与固定源码一致，生成的 frontend
+assets 分别校验。同一合成六成果／24 要求负载经真实 File/SQLite CLI、native hook、
+压缩、损坏恢复、提前 spend 拒绝及一次结算运行。每组既有 21 条来源／恢复判据均过；
+基线仍接受纯数值语义 mutation，最终 runtime 拒绝。实际 warm 文件精确重建，缺失
+baseline 或损坏 delta 恢复同一全文；未用 live Goal、已安装 Host 或模型作 fixture。
+
+## 成本与下一边界
+
+| 打包观察 | File：基线 → 修复 | SQLite：基线 → 修复 |
+| --- | --- | --- |
+| 冷态保存视图 | 68,407 → 68,602 字节 | 68,515 → 68,706 字节 |
+| 实际 warm delta 文件 | 3,755 → 3,775 字节 | 3,763 → 3,783 字节 |
+| 完整观察器 CLI stdout | 494,448 → 495,559 字节 | 495,234 → 496,329 字节 |
+
+每组观察器 38 次 CLI，另加一次实际 delta 读取。九次进程内 codec operation 和一次
+独立完整性 control 属于验证工作，不是模型强制读取策略。总字节包含 package／fixture
+路径长度差异，增长不能全部归因于 codec 字段。这是 C1 修复前后对照，不能替代原
+quota 对照，也不改变先前冻结的 **25,862 > 13,000** 失败。
+
+独立 Host 消费者使用同一份 68,227 字节合成来源，两版均一次 RPC。Request 参数 JSON
+从 108,061 增至 108,150 字节，result JSON 从 68,504 降至 207 字节。原任务、事实及
+约束精确保留，新 contract binding 本身增加 41 字节；两份安装至隔离环境的 wheel
+均复现。这里计参数／结果 JSON，不含协议 framing、组合／准备、模型输入处理、时延、
+内存及完整 Turn 成本；删除无用 echo 不等于完整路径结果正向。
+
+继续沿原 C1 owner 推进剩余 consumer／writer 切换、历史 reader 退出及可比验收成果／
+完整成本。保留既有独立来源保真 PR 与负责人；本检查点不提升默认、不启动实验，
+也不结清 C1。

docs/architecture/rfcs/ledger/controller-executor-unified-contract-v0/2026-10-29-context-source-fidelity.md

@@ -0,0 +1,53 @@
+# C1 context source-fidelity checkpoint
+
+中文镜像：[同名检查点](2026-10-29-context-source-fidelity.zh-CN.md)。
+
+C1 integrates main `b201da8bab305d053866aa0d4516b97ba4a4499e` and reuses normal
+[PR #7661](https://github.com/loopx-project/loopx/pull/7661), source
+`4bb530c0f7b22950ba17300dacdc5a23debedf12`. This is proposed source adoption,
+not a merged, installed or model-qualified rollout. The separate journal repair
+[#7657](https://github.com/loopx-project/loopx/pull/7657) remains a prerequisite
+through its existing owner.
+
+The generic context codec also normalized original numbers in cold delivery and
+full recovery. Warm equality could omit a change between `1` and `1.0`, negative
+zero, or distinct large integers. Seven of nine independent exact-number cases
+fail on the unchanged baseline. Ordinary dictionary equality concealed part of
+that failure.
+
+The existing TypeScript codec now compares sparse original-number identity and
+returns the existing source-edit format. Python applies those edits to original
+values; it does not select sources, diff contexts or decide recovery. The same
+source-identity helper serves C1 acceptance sharing and the codec. Full bodies,
+primitive/grouped literals and reordered sources retain origin. Recovery rejects
+normalized-equivalent damaged deltas against the supplied current capture.
+Direct JavaScript callers retain detached results. No native hook, source
+selection, authority, admission, settlement or historical digest is changed.
+
+The independent slice passes 76 Python checks, including actual File/SQLite CLI
+cold/warm/missing-baseline paths, and 90 TypeScript checks. Another 194 capture,
+selection, reader and lifecycle regressions pass; 46 native-binary opt-in cases
+remain skipped. Typecheck, Ruff, public scan, semantic advisory and standard local
+premerge pass. C1 integration results are pinned on its PR; earlier cohorts stay
+at their original revisions. This is reconstruction from the supplied source,
+not proof that the old semantic hash distinguishes every numeric source.
+
+Matched synthetic component costs cover five codec RPCs, not a complete model or
+Host Turn:
+
+| Body | Request parameter JSON, base → repair | Response result JSON, base → repair |
+| --- | --- | --- |
+| 8 KiB | 70,855 → 72,040 bytes | 41,277 → 5,183 bytes |
+| 64 KiB | 524,616 → 525,801 bytes | 300,569 → 5,183 bytes |
+
+Both larger samples retain a warm delta; model-visible growth is the restored
+numeric distinctions. With no body, response metadata grows from 2,400 to 3,560
+bytes. Sequential local latency samples move in both directions; memory and full
+Host/model/human-attention costs remain unqualified. Request limits, original
+quota comparison and the frozen 25,862 > 13,000 failure are unchanged.
+
+Continue with numeric hash identity across all actual consumers and remaining
+bridges before writer/caller cutover and historical-reader exit. Reuse this codec
+and the journal owner rather than adding caller-specific number patchers. Keep
+original-quota single-session accepted outcomes/full cost open; optional two-session
+work remains separate.