[LIHUA919]

Goal And Delivered Outcome

Restore regression coverage that stopped at native context navigation instead of reaching the original recovery and model-tool assertions. On main 71970fb03eb2ab90b353f0895bb1463ca7eaf236, the matched 54-case suite has five failures: four missing should_run fields and a scripted portfolio parser failure. The same cases pass with this repair.

• Basis: the shipped native captured-input contract and existing recovery tests; related to Control-plane tests fail on main when scenario Goals lack canonical authority #7433 and Quota-bound wait recovery test fails on main #7435, without claiming their complete historical closure.
• Intended base: loopx-project/loopx:main; rebased and requalified on be17d4ff30eb00ef739710961d223ce81fb1b5e9.

Author Declaration

• Written by: model_agent — OpenAI Codex, GPT-6 family; no human review before submission.
• Specification: docs/reference/contracts/interface-budget-contract.md and current CLI behavior at 71970fb03eb2ab90b353f0895bb1463ca7eaf236.

Criterion	Disposition	Implementation / evidence
Models follow the original current reader instead of treating navigation as policy	implemented	Scripted portfolio transport performs actual context-read tool calls within unchanged actor budgets.
Complete retained input preserves bytes, digest and current-source identity	implemented	UTF-8 paging plus missing-middle, altered-byte and unread-new-capture negative cases.
Recovery remains bound to the original Todo and Turn	implemented	Existing CLI policy oracle; exact refusal and receipt checks plus unchanged work identity/dependencies.
Required vision follows the current owned workflow	implemented	Reuse the existing vision transport instead of reading obsolete compact-frontier fields.

Scope And Continuation

Complete within this test-consumer repair. Product code, native schemas and runtime defaults are unchanged. Full Agent collaboration qualification in #5248 remains separate. The newer upstream deferred-replan fix is retained; this patch does not make a deferred fixture executable to obtain a pass.

Validation

• Tested revision: c76503629007d48208d72afd94a559fb4db31edc.
• Run state: finished. Input classes: synthetic.

Check kind	Result	Evidence / limitation
regression_parity	passed	Matched baseline: 49 passed / 5 failed. All 54 original cases pass at head; 109 total cases pass with the current context, scoped-gate and required-vision suites.
real_entrypoint / real_backend	passed	Production CLI parser, native reader commands, actual model-tool protocol and isolated File/SQLite recovery. Model replies are scripted; no paid model qualification.
static	passed	Ruff, Python compilation, committed/staged diff checks, bilingual RFC check and scoped four-file public-boundary scan. No RFC pair changed.
integration	passed	Quick premerge: five direct checks and three selected quota/lane/scheduler canaries passed.

The semantic advisory has no changed production paths. The intended new test helper is outside its supported production scan scope; it reuses existing capture schema labels and local test-case names. Full repository CI, installed Hosts and live-model behavior are not claimed.

Frontend / Visual Evidence

UI impact: none. This change repairs test consumers and synthetic qualification only; no rendered surface changes.

Type / Area / Direction

• Test update; Core control-plane acceptance coverage.
• Shared-authority fixture schema, promotion and runtime routing: unchanged; no migration qualification claim.
• Same-domain cleanup: remove the obsolete frontier reader and reuse the existing CLI oracle and vision helper.

Boundary Checklist

• No private state, raw traces, credentials, internal links or local machine paths in the diff or this description.
• Scope is the reproduced acceptance failure; no benchmark or product-rule changes.
• No paired RFC changes or generated evidence assets.
• Every commit has a DCO sign-off.
• Review, full CI and maintainer merge authority remain separate.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; reasoning_effort=max; declaration_source=runtime_reported

动机 / Motivation

维护者运行恢复与工具协议回归时，需要测试真正执行原身份恢复和拒绝断言。过去，恢复测试读到导航文档便因缺少 should_run 退出，portfolio 也没走到真实工具断言；现在测试读取原捕获后继续核验原 Turn 的恢复、拒绝与结算。当前主干中5个失败的原用例均已恢复，全部64个匹配原用例在候选通过；扩展至109项全部通过。本次只修复测试消费者，不改变产品协议、默认输出、执行权限或工具预算，也不证明真实模型与安装态 Host 的采用。

改动思路 / Approach

两类读取明确分开：普通 CLI 回归复用已有私有 policy oracle，读取当前捕获供测试断言；脚本化模型则通过真实 context-read 工具调用接收原始分页，原导航输出没有被偷偷替换成完整 policy。新增 helper 从实际模型请求的 tool messages 重建 UTF-8 字节，核对连续覆盖、重叠一致和完整 digest；单见 EOF 不足以通过。

required Vision 场景复用现有 _vision_transport，替换已经过时的 frontier 文件读取；actor 的生产实现和工具预算没有变化。与已有 Codex input[] 字节 oracle 比较过，新 helper 服务 chat messages[] 传输，普通 CLI 和 Vision 已有能力直接复用，不另建产品解码器或恢复 owner。

具体改动 / Changes

审查精确版本 c765036 的完整4文件 diff：164+/31-，全部位于测试；loopx/、apps/、packages/ 对 base 逐字相同。

关键代码讲解

• quota_context_fixture.py：context_reading_transport 跟随本次 recovery/next reader，latest_quota_payload 在新导航出现时清空旧输入，_retained_packet 校验完整原字节。103行 helper 有四个真实 portfolio actor 和新负例作为消费者。
• test_model_tool_context.py：真实 reader 生成 Unicode 多页，再分别删除中间页、修改字节、追加尚未读取的新捕获，三者都必须拒绝。不是刷新 golden 或把导航当 policy。
• test_quota_bound_wait_recovery.py：保留原错误码、原 Todo 和 replayed receipt 检查；以 should_run=false、相同事件和完整相关工作身份/依赖不变，替换对推荐文字中某个单词的依赖。

规格依据：docs/reference/protocols/turn-envelope-v0.md，spec_revision=be17d4ff30eb00ef739710961d223ce81fb1b5e9，审查前读取了 原捕获/恢复条款。原文未编号，以下只为条款定位：CAPTURE-RECOVERY implemented（恢复读原捕获，不重跑 guard）；BYTE-PRESERVATION implemented（完整 UTF-8 字节和来源核对，坏源拒绝）；ORIGINAL-IDENTITY implemented（保存的观察不授予新权限，保留原绑定和检查）。接口预算的 native qualification 条款和 good-smokes 的独立 oracle 要求也已对照；没有改变预算或以本 PR 新文本自行定义通过条件。

对主干的风险 / Risks

最强反例是测试因私有读取替模型提供答案、放宽拒绝条件或改变 fixture 可执行性而变绿。逐路径核对后，模型仍看到原导航并实际执行 reader；CLI 私有读取不被当作模型消费证明。四个 bound-wait 组合覆盖 File/SQLite 与 monitor_changed/todo_done，继续检查原 Turn 拒绝、回执和工作身份不变。原 scoped-gate、required-Vision、预算耗尽与结算负例保留，未将 deferred fixture 改成可执行。

独立验证	结果
当前不可变 base 的三份原 suite	FAIL：59通过、5失败；四个 should_run KeyError，另一个 portfolio transport abort，原输出保留
候选同名64个原用例	PASS：64全部通过
候选加当前上下文、scoped-gate、required-Vision suite	PASS：109通过，无失败或跳过
四个变更文件 Ruff、diff/DCO、标准 premerge	PASS；quota/lane/scheduler 所选 canary 通过

同作者当前批次也核过：#8094 修 native admission I/O，#5248 是较广的协作工作，与本次测试消费者修复的 oracle 和交付边界不同；未发现重复冻结某次运行或私有轨迹的测试。已有大 portfolio 没有因此扩大成新的基础设施，局部删除旧 frontier helper 是合适的清理。按当前契约未查询或等待远端 CI。

我的整体评价 / Verdict

就本次具名的测试消费者修复，goal_achieved：恢复的是可用的语义回归信号，没有发现阻塞问题。long_horizon=preserved、user_experience=preserved，生产行为保持，测试反馈恢复；109或PR数量都不是模型工作效果收益。机制规模与真实缺口相称，保留独立 byte oracle 与已有 helper 复用，不要求无关拆分或新后继任务。

visual_review=not_applicable：四条测试路径和未变产品树均已检查，无渲染改动或待验渲染范围。脚本模型、隔离后端与真实 CLI 的资格，不能代替真实模型、安装态 Host、物理 Windows 或完整成本验收。

English verdict: APPROVE — c765036; restored current-capture regression coverage without changing runtime policy, with synthetic and installed-host limits retained.