[loopx-agent]

Goal And Delivered Outcome

The first read in quota spend-slot carries full settlement records even though this caller uses identity, replay receipts and the presence of an existing debit. A receipt can arrive after that read while the run index stays identical. This change projects the first response through the existing TypeScript owner and lets the preview read the authoritative receipt again.

The isolated File and SQLite entrypoints reach the same synthetic result, validation, writeback and single debit. The first response is roughly 26 KB before and 2.5 KB after. See the complete command transfers below.

Author Declaration

• Written by model_agent, Codex, GPT-6 family, OpenAI.
• Target main at ebb39f4db088cc77927c4514d614476ad0a5c84e.

Implemented against

Quota allocation and receipt-bound settlement

Criterion	Disposition	Implementation and evidence
Original identity and replay receipts	implemented	quota spend-slot receives its identity and complete receipt controls from the same TypeScript owner. Exact replay and wrong-Todo rejection exercised through the CLI.
Repair the original receipt after a durable debit	implemented	The compact response preserves the owner's spend-record presence bit. The CLI repairs a deleted synthetic receipt with the original run index and one debit.
Validate fresh delivery before spend	implemented	The full preview read stays on its existing path. A second process repaired a missing writeback receipt between the two reads without touching the run index. The current command then settled once.

Scope And Continuation

The early adapter and the full reader share transport and source admission. The internal projection is selected only by the early replay check. The default readback, the settled-result presentation flag and all persisted formats use their existing shapes. The tests retain the prior File/SQLite decision and receipt oracles.

This is an independently reversible change to the Python–Effect response. The post-debit readback sharing proposal composes cleanly in a local merge preview. The C1 combined caller was exercised in a separate source integration preview. #8243 #7430

Validation

• Tested revision 6a5a2779697c23057976b563d87f0aa5ae84269e against ebb39f4db088cc77927c4514d614476ad0a5c84e.
• Run state finished. Inputs synthetic.

Check kind	Result	Evidence
real_entrypoint / real_backend	passed	Real File and SQLite source CLI. The advertised guard, validation and settlement sequence, exact replay, wrong binding, recovery of a missing spend receipt and concurrent writeback receipt repair all passed.
real_entrypoint / packaging	passed	Isolated wheel on both providers. Verified 1,815 packaged Python and TypeScript members against the source checkout and installed copy.
regression_parity	passed	The base and head finish with the same artifact and receipt chain. An intentional false spend-record bit fails the missing-spend-receipt and settled assertions in the TypeScript test.
unit / static	passed	145 settlement readback and execution-preparation checks, control-plane typecheck, affected-path Ruff, 6 direct and 18 selected standard premerge checks.
integration	failed on base and head	Matched Python suite with 317 passed and 1 skipped on each. Two Gitless settle variants and the spend snapshot-limit fixture fail with the same test identities and messages on both.
static	failed on base and head	The workflow's Ruff scope reports the same F841 in tests/control_plane/test_goal_create_completion.py:184 on both revisions.

Effect request and response bytes under matched inputs and equal fixture path lengths. C1 pairs also used the same source checkout. Counts cover the complete command and its child where applicable.

Caller	Provider	Base bytes	Head bytes	RPCs
Main spend	file	518,679	495,040	87
Main exact replay	file	71,098	40,942	12
Main spend receipt repair	file	133,910	108,828	15
C1 combined settlement preview	file	699,675	676,188	116
C1 combined replay preview	file	90,953	90,953	10
Main spend	sqlite	519,135	495,442	87
Main exact replay	sqlite	71,204	40,982	12
Main spend receipt repair	sqlite	134,144	109,004	15
C1 combined settlement preview	sqlite	700,319	676,778	116
C1 combined replay preview	sqlite	91,153	91,153	10

The paired command outputs preserve the effect identity, outcome, retry result and once-only accounting. The measurement covers internal transport on the synthetic workloads. End-to-end latency, model tokens, real workload incidence and adopted C1 results remain outside this validation.

Frontend / Visual Evidence

UI impact none. This changes the internal settlement response behind the existing CLI.

Type of Change

• Refactoring
• Test update

LoopX Area

• Control plane

Technical Direction

S2 typed kernel and S10 recovery. This slice removes duplicated record transport for one active caller. There is no state migration, provider routing change or persistent schema update.

Shared-authority RFC fixture impact

N/A. The tests exercise the existing provider and recovery contracts without changing authority storage.

Boundary Checklist

• Public-safe synthetic evidence and scoped paths.
• No paired RFC changes. The bilingual diff check passed.

[loopx-agent]

Reviewer: model_agent, gpt-6.1-sol, OpenAI, runtime_reported, reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

本次代码评审未发现阻塞项。两种真实存储的原绑定、回执与一次扣额均通过对照。规定范围的 Ruff 仍有独立失败，需在合并前处理。

动机 / Motivation

每轮结束时，执行任务的 Agent 用原 Turn 身份扣额，或在中断后恢复回执。 原命令第一次只需确认身份、已结算或需补回执，却跨运行时传输了完整记录。每天重复运行和重放时，这些记录会反复序列化和传输。 首次读回只传这些事实，后续预览仍重新读完整权威状态。使用原命令可以完成单次扣额、原身份重放和缺失回执修复。 本切片只优化内部传输。安装采用、端到端耗时及长期收益需要各自的运行证据。 后续可在相同业务负载下量完整延迟和实际采用。本轮对照量的是请求参数与结果的紧凑 JSON 字节。

改动思路 / Approach

TypeScript 结算 owner 继续从同一权威记录派生身份、回执和 spend run 是否存在。Python 首次只消费这些事实，随后预览的独立读取必须保留，才能接纳迟到回执。 这个 PR 只收窄扣额预检的回包，并沿同一个读取 owner 保留后续校验。 现有 include_record_bodies=false 只在已经结算时减少记录，待修复的回执仍需用实际 run 判断。保持第一次传完整记录有兼容性优势，但会保留本次可移除的成本。把两次读取改成复用一份快照会让迟到回执看不见。这里共用传输与原权威读取，新增一个仅内部消费的投影。

具体改动 / Changes

核对 head 6a5a2779697c23057976b563d87f0aa5ae84269e 和比较基线 ebb39f4db088cc77927c4514d614476ad0a5c84e。本轮读取的目标 main 为 8e86f173f08bd55eb833d8cdf42360f93bf989fe，向前的变更和本 PR 四个文件无交叠。当前精确提交通过校验，后续整合后的行为需独立复验。

关键代码讲解

• _read_heartbeat_settlement_payload 保留 schema、原 Goal 路由和 source admission，由原完整读取和 read_quota_spend_precheck 共用。后者解析身份、回执状态和持久扣额存在位。Python 适配器
• readQuotaSettlement 在同一 TS owner 完整计算后，按 precheck 请求只返回早期消费的控制字段。原预览和其他调用方仍取得完整结果。没有迁移原 run 或回执。投影分支
• spend_quota_slot 在明确指定 Turn 和兼容推导两条路上使用预检。已结算则重放原回执，有扣额记录而缺回执则进入原修复。待首次扣额继续用 fresh preview。扣额入口

依据 docs/quota-allocation.md 的 ebb39f4db088cc77927c4514d614476ad0a5c84e 版本核对三项。结算回执约定

• exact-turn-binding 已覆盖。显式与推导重放保留同一身份，错 Todo 被拒。
• receipt-before-debit 已覆盖。预览只在真正补齐写回回执后推进扣额。
• receipt-only-repair 已覆盖。恢复原扣额回执时原 debit 数保持为 1。

对主干的风险 / Risks

真实第二个 CLI 在预检读到 writeback_receipt_required 后补回执，run index 字节未变，后续完整预览读到 spend_required 并结算一次。 同一 Goal 的错误 Todo 被拒且零扣额。删除扣额回执后，两端均只修复原回执。 仅在真实预检响应把 spend_run_present 改成 false，两个 backend 都不能补回执，仍为 spend_receipt_required，扣额仍为 1。 四条生产/测试路径全 diff 核对。两端各 145 项 TS 通过，head 类型检查通过。quick premerge 的 6 个直接和 3 个选定检查通过。两端各 220 项 Python 通过，现代和旧 runtime 两个遥测用例均在 guard 后、首次 spend 前等待 cycle start 失败。该分支和用例文件均未改。作者更新了宽套件结果。我另行重跑其中的 snapshot-limit 用例，直接调用原 commit 的 2,100,000 B 注入上限在两端均未抛 ValueError。该路径不经过本 PR 的预检，配对的旧 snapshot 拒绝用例两端均通过。规定 Ruff 范围同样在两端报 F841，位置 tests/control_plane/test_goal_create_completion.py:184。这些失败分别保留为独立验证记录。未查询远端 CI。

合成输入与命令	File JSON 字节	SQLite JSON 字节
正常扣额全命令	346,158 → 329,619	346,600 → 330,007
原身份重放	48,961 → 26,542	49,067 → 26,582

口径是经真实 Effect 调用返回的参数和结果重新编码后的紧凑 JSON，排除外层 RPC envelope。正常扣额两端均 88 个调用，SQLite 首个结算 result 从 18,900 B 降到 2,285 B。

我的整体评价 / Verdict

连续 Turn 的重复传输变小，原任务的拒绝、恢复、执行和回执语义保留。用户仍走相同命令，迟到回执由后续预览读取。改动局限在内部读回，界面层不涉及视觉验收。这个结果支持批准精确提交。仓库必需 Ruff、实际安装、完整延迟及与 #8243 和 #7430 的整合证据单独核验。

English verdict: APPROVE for 6a5a2779697c23057976b563d87f0aa5ae84269e. Matched File and SQLite CLI runs preserve binding, late receipt recovery, and one debit while reducing the first settlement response. Inherited lint and usage-cycle failures are recorded separately.