[hhyykk]

Goal And Delivered Outcome

A public quota read composes several existing typed decisions. When the caller has no outer executable-revision scope, each decision rescans the TS code tree. Global summaries and Todo views pay this cost repeatedly, although the runtime already supports a bounded request scope.

Put that existing scope at build_quota_should_run, the shared public decision interface. The compatibility facade and global-view adapters inherit it. Status remains a caller-supplied snapshot; provider/callback reads retain their existing behavior. No decision result or source fact is cached by this change.

Basis: TypeScript control-plane migration RFC Stage 3 caller adoption at 1a9933cce84d9ad94d3eb83490b4404741c7834a; target main. Observable before → after: repeated code-identity scans become one per quota read while native calls, decisions, pause/refusal signals and view coverage remain unchanged.

Author Declaration

• Written by: model_agent, OpenAI GPT-6 Codex, for the requesting operator.

Implemented against

Specification: docs/architecture/rfcs/typescript-control-plane-migration-v0.md, revision 1a9933cce84d9ad94d3eb83490b4404741c7834a.

Criterion	Disposition	Symbol / evidence
Reuse existing typed transport from actual callers	implemented	public quota/should_run.py interface; facade/global views
Verify complete costs rather than infer gain from RPC counts	implemented	matched complete SQLite global-summary CLI plus File/SQLite behavior parity; RPC sequences unchanged
Preserve authority and source facts	implemented	current pause wins in nested and independent reads; normal decisions and view outputs retain parity
Replacement-first economics	implemented within this scope	+3 product lines including whitespace, two executable statements; existing scope owner reused, no new bridge/cache/semantic implementation; semantic deletion 0
Complete T0–T4, R1–R3 or provider/default promotion	out_of_scope	no such qualification or routing change claimed

Self-check: production/test/docs guard review, related tests, real disposable providers, historical regression sensitivity and normal installed artifacts. No live task or external provider execution was launched.

Scope And Continuation

• One existing module owns the bounded decision's code identity; no per-view copies, new helper, dependency, config option, wire operation, schema, public argument or permission.
• Existing outer scopes join as before. Normal quota should-run, Chat workers and the proposed perf(portfolio): share executable revision across one evidence read #6990 portfolio outer scope already provide this lifetime; their gains are not counted here. The benchmark uses previously unscoped global views on main without perf(cli): reuse selected dispatch for manager Inbox commands #6989/perf(portfolio): share executable revision across one evidence read #6990.
• The next independent quota read resolves current code again. Changed status inputs and callbacks remain subject to existing admission; a paused result cannot become a runnable cached result.
• Reviewed the 48-PR discovery inventory and refreshed the 47 still open before publication. tracking: land research continuity as small PRs into main #6838 shares should_run.py but changes acceptance guard logic; it adds no executable request scope. Its related acceptance hunks are already represented on this base. perf(portfolio): share executable revision across one evidence read #6990 changes the portfolio parent lifetime, perf(cli): reuse selected dispatch for manager Inbox commands #6989 changes Inbox CLI dispatch, Add projection envelopes to global todos and risks #5598 changes global projection envelopes, and refactor(todos): compose full readback in one TypeScript transaction #6874/perf(control-plane): reuse acceptance reads within one Todo snapshot #6984 change Todo reads. This changes distinct production/test hunks and does not repeat those implementations. Shared RFC edits are separate paragraphs.
• Complete within this public-reader scope. Coarse TS transaction consolidation and remaining migration/qualification stay separate; no speculative bridge or follow-up project is added.

Validation

• Tested revision: cdc0c89e13c13a7f53427b60ad881c18583d6049 on a590609a357f7cde17289b5ceba9f85a9fcb46cc. Performance dataset predates this Lark-only rebase; measured quota/native/global/CLI files have unchanged hashes. The 189 related tests and installed artifacts were rerun on this final head.
• Run state: finished. Input classes: synthetic, public_fixture.

Check kind	Result	Public-safe evidence / limitation
integration	passed	189 related Python tests: quota parity, request scope, paused precedence, global summary/Todo/risk views, CLI entrypoint and Todo source precedence
regression_parity	passed	new public-facade/bounded-reader test uses actual native IPC and fingerprint filesystem IO; independent reads resolve fresh code and observe pause; nested reads reuse caller code identity
regression_parity	passed	same final test source fails on the pinned baseline's repeated scans and passes on HEAD; actual source roots verified
real_entrypoint	passed	150 fresh source-verified timed CLI processes and 120 direct global-summary samples, plus supporting global-Todo readback
real_backend	passed	real File and SQLite canonical stores; 1/8 Goals, registered worker, one open Todo per Goal created through the public mutation owner; indexed JSON/Markdown observation artifacts exist
integration	passed	normal wheel/sdist builds, independently installed environments and actual console from empty-project cwd without source PYTHONPATH; both providers, summary/Todo readback, unknown Goal denial, unchanged registry/state bytes
static	passed	scoped Ruff, control-plane typecheck, bilingual staged/head checks and whitespace check; diff-scoped semantic advisory found no supported new vocabulary carrier

Early fixture/test construction failures were corrected before qualification. Incomplete artificial frontier rows, missing run-artifact profiles and small exploratory timings are excluded; the final fixture uses native public Todo creation and real observation files. No failing scenario was removed to obtain a passing result.

Complete-command performance

Pinned main 1a9933cce84d9ad94d3eb83490b4404741c7834a versus this HEAD; Linux, Python 3.11, Node 24.21.0 / SQLite 3.53.4. Same disposable fixture and sequential arms, 15 samples per arm; nearest-index p95. Each sample starts a new Python CLI process and includes startup/imports, parser, real status/quota reads, public source scanning, view projection and output. The managed native runtime is warm.

Both complete packages are precompiled with the same interpreter and get one untimed CLI warmup; bytecode writing is disabled during timed CLI children. Compiled module sets are checked equal. This measures a prepared installation/cache state, not first-ever compilation or cold native startup. Each CLI proves its actual Python and TS roots.

Initial CLI timings had four extra setup-module bytecode files in the candidate and are excluded from gain claims. The primary row is the controlled rerun. Earlier post-import view timings remain supporting experiments; all their behavior and method observations remain in parity checks.

Provider	Goals	Complete CLI p95 ms, base → head	Whole-view code scans
sqlite	8	6960.3 → 1851.9 (-73.4%)	346 → 10

Global views still perform their status read and final envelope sealing separately; this does not claim one scan for the whole view. Native method sequences/counts are unchanged. The speedup removes repeated executable-tree IO, not RPCs, state reads or scheduling checks.

Every public output matches across arms and samples after normalizing only the top-level observation timestamp and projection-envelope read/serve clocks and elapsed-age fields. Null clock/age values remain null. Persisted progress timestamps, source-updated times, freshness/coverage/alert flags, Goals/Todos, reasons, omissions and boundary fields remain in the comparison. The unconfigured local global-directory source is disclosed identically by both views; no all-healthy or complete global-inventory claim is made. Raw local samples remain private.

This measures local evidence-read overhead, not long-horizon task quality, model/token savings, cold native startup, PostgreSQL or all of LoopX. Already-scoped consumers should not be credited with another equivalent speedup.

Portable reproduction

Save the three scripts outside both checkouts. Install their Python test dependencies and run npm ci in both checkouts. Select the same Python and qualified Node version, use empty output directories, and run sequentially on an idle host:

python3 setup_goals.py HEAD_CHECKOUT FIXTURE_DIRECTORY
python3 -m compileall -q BASE_CHECKOUT/loopx HEAD_CHECKOUT/loopx
python3 qualify_global.py BASE_CHECKOUT FIXTURE_DIRECTORY BASE_OUTPUT --samples 15
python3 qualify_global.py HEAD_CHECKOUT FIXTURE_DIRECTORY HEAD_OUTPUT --samples 15
python3 qualify_cli.py BASE_CHECKOUT FIXTURE_DIRECTORY/sqlite-8 BASE_CLI_OUTPUT --samples 15
python3 qualify_cli.py HEAD_CHECKOUT FIXTURE_DIRECTORY/sqlite-8 HEAD_CLI_OUTPUT --samples 15

The fixture directory is shared deliberately so persisted source bytes and identities remain comparable. Setup creates synthetic canonical stores and public Todos only; it performs no work attempt. The qualifier disables usage pings, records every sample/native method/source proof and stops its managed runtime. A small explicit public scan directory keeps unrelated repository scans out of both arms.

setup_goals.py SHA256: 338c2b0e33b541107bbb41b43dd6b5fc375fc10c61a91c147745d640f0b71165.

import argparse,json,os,sys,tempfile
from pathlib import Path
from datetime import datetime,timezone,timedelta
p=argparse.ArgumentParser();p.add_argument('repo');p.add_argument('root');a=p.parse_args();repo=Path(a.repo).resolve();root=Path(a.root).resolve();root.mkdir(parents=True,exist_ok=True);tmp=root/'tmp';tmp.mkdir(exist_ok=True);os.environ.update(TMPDIR=str(tmp),TEMP=str(tmp),TMP=str(tmp),LOOPX_USAGE_PING='0');tempfile.tempdir=str(tmp);sys.path[:0]=[str(repo),str(repo/'tests/control_plane')]
from canonical_authority_fixture import initialize_canonical_authority
from loopx.control_plane.coordination.runtime_shadow import build_todo_runtime_shadow_projection
from loopx.status import collect_status
from loopx.control_plane.todos.mutation_api import add_goal_todo
from loopx.control_plane.coordination.coordination_state_contract import TODO_DOMAIN_READ_RECORD_SCHEMA_VERSION,TODO_DOMAIN_RECORD_FIELDS
from loopx.control_plane.quota.should_run import build_quota_should_run
from loopx.control_plane.effect_runtime import effect_runtime_request_scope,restart_effect_runtime
for provider in ('file','sqlite'):
 for count in (1,8):
  folder=root/f'{provider}-{count}';runtime=folder/'runtime';goals=[]
  for i in range(count):
   goal=f'goal-{i}';project=folder/goal;project.mkdir(parents=True);state=project/'state.md';state.write_text('---\nstatus: active\n---\n# Goal\n## Agent Todo\n')
   projection=build_todo_runtime_shadow_projection(goal_id=goal,todos=[],handoff_mode='soft_claim');projection['todo_read_model'].update(schema_version=TODO_DOMAIN_READ_RECORD_SCHEMA_VERSION,contract_fields=list(TODO_DOMAIN_RECORD_FIELDS));initialize_canonical_authority(runtime,goal,projection,state_path=state,provider=provider)
   goals.append({'id':goal,'domain':'quota-read','status':'active','repo':str(project),'state_file':str(state),'adapter':{'kind':'generic_project_goal_v0','status':'connected'},'coordination':{'registered_agents':['worker'],'agent_model':'peer_v1'},'authority_sources':[],'quota':{'compute':1.0,'window_hours':24,'slot_minutes':1,'allowed_slots':100}})
   index=runtime/'goals'/goal/'runs/index.jsonl';index.parent.mkdir(parents=True,exist_ok=True);jp=index.parent/'fixture.json';mp=index.parent/'fixture.md';row={'run_id':f'fixture-{i}','goal_id':goal,'agent_id':'worker','generated_at':(datetime.now(timezone.utc)-timedelta(minutes=1)).isoformat(),'classification':'read_only_refresh','recommended_action':'Inspect the bounded fixture.','json_path':str(jp),'markdown_path':str(mp)};jp.write_text(json.dumps(row));mp.write_text('# Synthetic read observation\nNo task completion is claimed.\n');index.write_text(json.dumps(row)+'\n')
  registry=folder/'registry.json';registry.write_text(json.dumps({'schema_version':1,'common_runtime_root':str(runtime),'goals':goals}))
  with effect_runtime_request_scope():
   for g in goals:
    created=add_goal_todo(registry_path=registry,goal_id=g['id'],role='agent',text='Inspect the bounded fixture.',priority='P1',task_class='advancement_task',action_kind='implement',claimed_by='worker',agent_id='worker',operation_id='fixture-create:'+g['id']);assert created['ok'],created
   status=collect_status(registry_path=registry,runtime_root_override=None,scan_roots=[],limit=40,include_public_boundary_scan=False);assert status['ok'],status.get('contract')
   q=build_quota_should_run(status,goal_id='goal-0',agent_id='worker');print(provider,count,q.get('state'),q.get('decision'),q.get('reason'),flush=True)
restart_effect_runtime()

qualify_global.py SHA256: e9e8343c7c7cf5e243adbfdd756b0cd1101bcd796ef2f9b54f66a2fb79cf07af.

import argparse,hashlib,json,os,statistics,subprocess,sys,tempfile,time
from pathlib import Path
p=argparse.ArgumentParser();p.add_argument('repo');p.add_argument('fixtures');p.add_argument('out');p.add_argument('--samples',type=int,default=15);p.add_argument('--providers',default='file,sqlite');p.add_argument('--counts',default='1,8');a=p.parse_args()
repo=Path(a.repo).resolve();fixtures=Path(a.fixtures).resolve();out=Path(a.out).resolve();out.mkdir(parents=True,exist_ok=True);tmp=out/'tmp';tmp.mkdir(exist_ok=True);os.environ.update(TMPDIR=str(tmp),TEMP=str(tmp),TMP=str(tmp),LOOPX_USAGE_PING='0',PYTHONDONTWRITEBYTECODE='1');tempfile.tempdir=str(tmp);sys.path.insert(0,str(repo))
import loopx
from loopx.summary_all import build_summary_all
from loopx.global_todos import build_global_todos
from loopx.control_plane import effect_runtime as er
assert Path(loopx.__file__).resolve()==repo/'loopx/__init__.py';assert er._control_plane_root().resolve()==repo/'loopx/control_plane'
original=er._runtime_fingerprint;request=er._request_with_info;scans=[];methods=[]
def scan():
 r=original();scans.append(r);return r
def rpc(*args,**kw):methods.append(kw['method']);return request(*args,**kw)
er._runtime_fingerprint=scan;er._request_with_info=rpc

def normalize(value,path=()):
 if isinstance(value,dict):
  result={}
  for k,v in value.items():
   if path==() and k=='generated_at':result[k]='<observation-time>'
   elif 'projection_envelope' in path and k in {'observed_at','served_at','last_read_at'}:result[k]=None if v is None else '<observation-time>'
   elif 'projection_envelope' in path and k in {'age_seconds','staleness_seconds'}:result[k]=None if v is None else '<elapsed>'
   else:result[k]=normalize(v,(*path,k))
  return result
 if isinstance(value,list):return [normalize(v,(*path,str(i))) for i,v in enumerate(value)]
 return value

def percentile(v):return sorted(v)[int((len(v)-1)*.95+.5)]
rows=[]
try:
 for provider in a.providers.split(','):
  for count in map(int,a.counts.split(',')):
   folder=fixtures/f'{provider}-{count}';reg=folder/'registry.json';public=folder/'public';public.mkdir(exist_ok=True);(public/'README.txt').write_text('Synthetic public fixture. No private content.\n')
   kwargs=dict(registry_path=reg,runtime_root_override=None,scan_roots=[public],agent_id='worker',limit=128)
   first=build_summary_all(**kwargs,time_range='24h');assert first['ok'] and first['summary']['runnable_todo_count']==count,first
   supporting=build_global_todos(**kwargs);assert supporting['ok'] and supporting['summary']['matched_todo_count']==count,supporting
   warm=[];full=[];scan_counts=[];calls=[];observations=[];proofs=[];outputs=[]
   for _ in range(a.samples):
    scans.clear();methods.clear();t=time.perf_counter();value=build_summary_all(**kwargs,time_range='24h');warm.append((time.perf_counter()-t)*1000);assert value['ok'] and value['summary']['runnable_todo_count']==count;scan_counts.append(len(scans));calls.append(list(methods));observations.append(value)
   script='''import pathlib,sys,json,loopx
from loopx.control_plane import effect_runtime as er
from loopx.entrypoint import main
expected=pathlib.Path(sys.argv[1]);sys.argv=sys.argv[:1]+sys.argv[2:]
assert pathlib.Path(loopx.__file__).resolve()==expected/'loopx/__init__.py'
assert er._control_plane_root().resolve()==expected/'loopx/control_plane'
scans=[];fingerprint=er._runtime_fingerprint
def scan():
 r=fingerprint();scans.append(r);return r
er._runtime_fingerprint=scan
code=main()
sys.stderr.write('PROOF='+json.dumps({'module':str(pathlib.Path(loopx.__file__).resolve()),'code_scans':len(scans)})+'\\n')
raise SystemExit(code)
'''
   argv=['--registry',str(reg),'--format','json','global-summary','--agent-id','worker','--limit','128','--scan-path',str(public)]
   for _ in range(a.samples):
    t=time.perf_counter();pr=subprocess.run([sys.executable,'-c',script,str(repo),*argv],cwd=repo,env={**os.environ,'PYTHONPATH':str(repo)},capture_output=True,text=True,timeout=90);full.append((time.perf_counter()-t)*1000);assert pr.returncode==0,(pr.stdout,pr.stderr);value=json.loads(pr.stdout);assert value['ok'] and value['summary']['runnable_todo_count']==count;outputs.append(value);proof=json.loads(next(x.removeprefix('PROOF=') for x in pr.stderr.splitlines() if x.startswith('PROOF=')));assert proof['module']==str(repo/'loopx/__init__.py');proofs.append(proof)
   row={'provider':provider,'goals':count,'warm_samples_ms':warm,'cli_samples_ms':full,'warm_p50_ms':statistics.median(warm),'warm_p95_ms':percentile(warm),'cli_p50_ms':statistics.median(full),'cli_p95_ms':percentile(full),'scans':scan_counts,'methods':calls,'source_proofs':proofs,'raw_warm':observations,'raw_cli':outputs,'supporting_todos':supporting,'semantic':normalize(observations[0])};rows.append(row);print(json.dumps({k:row[k] for k in ('provider','goals','warm_p95_ms','cli_p95_ms','scans')}),flush=True)
 (out/'receipt.json').write_text(json.dumps({'revision':subprocess.check_output(['git','-C',str(repo),'rev-parse','HEAD'],text=True).strip(),'product_sha256':hashlib.sha256((repo/'loopx/control_plane/quota/should_run.py').read_bytes()).hexdigest(),'harness_sha256':hashlib.sha256(Path(__file__).read_bytes()).hexdigest(),'rows':rows},indent=2)+'\n')
finally:er.restart_effect_runtime()

qualify_cli.py SHA256: a30c0ad45b31f3c9eb16c0fdcb8cee023a45448af78cf1047d048bac8cd290ef.

import argparse,hashlib,json,os,statistics,subprocess,sys,time,tempfile
from pathlib import Path
p=argparse.ArgumentParser();p.add_argument('repo');p.add_argument('fixture');p.add_argument('out');p.add_argument('--samples',type=int,default=15);a=p.parse_args();repo=Path(a.repo).resolve();fixture=Path(a.fixture).resolve();out=Path(a.out).resolve();out.mkdir(parents=True,exist_ok=True);tmp=out/'tmp';tmp.mkdir(exist_ok=True)
env={**os.environ,'TMPDIR':str(tmp),'TEMP':str(tmp),'TMP':str(tmp),'LOOPX_USAGE_PING':'0','PYTHONPATH':str(repo),'PYTHONDONTWRITEBYTECODE':'1'}
compile_env=dict(env);compile_env.pop('PYTHONDONTWRITEBYTECODE',None)
subprocess.run([sys.executable,'-m','compileall','-q',str(repo/'loopx')],cwd=repo,env=compile_env,check=True)
script='''import sys,pathlib,json,loopx
from loopx.control_plane import effect_runtime as er
from loopx.entrypoint import main
expected=pathlib.Path(sys.argv[1]);sys.argv=sys.argv[:1]+sys.argv[2:]
assert pathlib.Path(loopx.__file__).resolve()==expected/'loopx/__init__.py'
assert er._control_plane_root().resolve()==expected/'loopx/control_plane'
scans=[];original=er._runtime_fingerprint
def scan():
 r=original();scans.append(r);return r
er._runtime_fingerprint=scan
code=main()
sys.stderr.write('PROOF='+json.dumps({'module':str(pathlib.Path(loopx.__file__).resolve()),'scans':len(scans)})+'\\n')
raise SystemExit(code)
'''
argv=[sys.executable,'-c',script,str(repo),'--registry',str(fixture/'registry.json'),'--format','json','global-summary','--agent-id','worker','--limit','128','--scan-path',str(fixture/'public')]
def invoke():
 t=time.perf_counter();pr=subprocess.run(argv,cwd=repo,env=env,capture_output=True,text=True,timeout=90);elapsed=(time.perf_counter()-t)*1000;assert pr.returncode==0,(pr.stdout,pr.stderr);value=json.loads(pr.stdout);assert value['ok'] and value['summary']['runnable_todo_count']==8;proof=json.loads(next(x.removeprefix('PROOF=') for x in pr.stderr.splitlines() if x.startswith('PROOF=')));assert proof['module']==str(repo/'loopx/__init__.py');return elapsed,value,proof
samples=[];observations=[];proofs=[]
try:
 invoke()
 for _ in range(a.samples):
  elapsed,value,proof=invoke();samples.append(elapsed);observations.append(value);proofs.append(proof)
 receipt={'revision':subprocess.check_output(['git','-C',str(repo),'rev-parse','HEAD'],text=True).strip(),'product_sha256':hashlib.sha256((repo/'loopx/control_plane/quota/should_run.py').read_bytes()).hexdigest(),'method':'all package modules compiled with same interpreter; one untimed CLI warmup; each sample new Python process; warm managed native runtime','python':sys.version,'samples_ms':samples,'p50_ms':statistics.median(samples),'p95_ms':sorted(samples)[int((len(samples)-1)*.95+.5)],'raw':observations,'proofs':proofs,'bytecode_modules':len(list((repo/'loopx').rglob('*.cpython-311.pyc')))};(out/'receipt.json').write_text(json.dumps(receipt,indent=2)+'\n');print(json.dumps({k:receipt[k] for k in ('revision','p50_ms','p95_ms','bytecode_modules')}),flush=True)
finally:
 sys.path[:0]=[str(repo),str(repo/'tests')]
 from managed_effect_runtime_fixture import capture_disposable_effect_runtimes,stop_disposable_effect_runtimes
 stop_disposable_effect_runtimes(out,capture_disposable_effect_runtimes(out))

Coverage/gaps: full repository suite, Windows, PostgreSQL, browser/model roundtrips, live provider delivery and hosted CI results are separate and were not claimed by the local checks. No TS semantic implementation changed; real typed transport and affected Python callers were exercised.

Frontend / Visual Evidence

UI impact: none. Existing read interfaces and output shapes remain unchanged; no new capability or screen is introduced.

Change Area

• Control plane: public quota-reader caller adoption.

Technical Direction

TypeScript migration Stage 3, existing executable request-scope owner. Domain/authority owners and provider routing remain unchanged.

Shared-authority RFC fixture impact

• Schema: 1/8 canonical Goals, registered worker, open Todo from public creation, actual read-observation artifacts, global summary and Todo projections.
• Changed semantic dimensions: none; nested lifetime, independent-read refresh, current pause and refusal remain covered. Existing source limits, coverage and warnings remain visible.
• Provider conformance arms: real File/SQLite; installed artifacts repeat both.
• Legacy/file/PostgreSQL promotion rehearsal: not run. This does not promote or route a backend or change compatibility projection semantics; full D1–D3/R1–R3 qualification remains outside this bounded lifetime fix.

Boundary Checklist

• Public-safe diff/body; no private state, raw traces, credentials, internal URLs or local machine paths.
• Existing PRs reviewed; no duplicated maintainer benchmark project.
• Scoped to the requested measured improvement.
• English/Chinese RFC pair changed; staged/head bilingual checks pass.
• UI impact none.
• DCO sign-off included.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max.

动机

需要在命令行反复读取多个 Goal 状态的用户和 Agent。

同一次 quota 读取过去多次扫描执行代码；现在该次读取共享代码版本，下一次独立调用仍使用调用者当次提供的状态。

真实 File/SQLite 输出与拒绝语义保持一致，公共读取的重复代码扫描减少，完整摘要命令的耗时下降。

本改动不更改配额、权限、Todo 状态或 provider 路由，也不交付完整原生 CLI 或安装态 App。

完整原生 CLI、托管及安装态 App、长期任务收益和完整成本仍由迁移主线继续验收。

改动思路

沿用原有请求作用域，避免在每个视图复制缓存或判断规则。 只包住一次公共 quota 读取的代码版本生命周期。

build_quota_should_run 是已有公共决策组合入口，给它加原有 context decorator，兼容 facade 和没有外层 scope 的程序调用者即可共享一次执行代码版本。这里只固定执行代码身份；status 仍来自调用者当次参数，provider 和 callback 继续按原路径读，不缓存准入结果。已有外层 scope 时仍加入原生命周期。将相同包装散放在各个视图更难保持一致；另建数据缓存还会引入新鲜度问题。

这是调用路径及代码版本生命周期的有界改进。状态和准入规则仍由既有 typed owner 决定，观察来源缺失仍明确显示；没有额外 provider、协议操作、领域状态、权限判断或同步状态副本。

具体改动

评审完整 head cdc0c89e13c13a7f53427b60ad881c18583d6049，实际 PR merge-base 为 a590609a357f7cde17289b5ceba9f85a9fcb46cc。先固定接受的 docs/architecture/rfcs/typescript-control-plane-migration-v0.md，规范修订 a590609a357f7cde17289b5ceba9f85a9fcb46cc，再读完整提案。

规范逐项映射：§2.4 复用既有 owner，未双跑语义；§2.8 以同输入基线/当前入口核验成本；§5 分开报告生产 LOC、代码搬移和兼容边界；§6 比较完整输出、真实 File/SQLite、失败恢复和反例敏感性；§7 从正常 wheel/sdist 的实际 console 执行。以上在本切片 implemented；Stage 3 的完整 native CLI/App 收敛 deferred，剩余边界如动机所述。这里不以零语义删除、目录移动或更少 RPC 宣称完成整个迁移阶段。

关键代码讲解

• build_quota_should_run: 完整公共读取在既有代码 scope 内运行；暂停和拒绝仍从当前输入产生。
• effect_runtime_request_scope: 未改动的 owner 负责嵌套加入、异常退出与 ContextVar 清理，下一独立请求重新解析代码。

生产代码 +3/-0（含空行；导入和 decorator 两条执行语句），不增加桥接调用或兼容分支。独立公共读取的实际代码扫描从 11 次降为 1 次；第二次暂停输入仍为 skip，嵌套外层 scope 仍只扫描一次。基线和去掉 decorator 的私有变体触发同一独立断言失败，当前 head 通过。

199 项相关 Python 测试通过；标准 premerge 的 6 项直接检查和 18 项选中检查全部通过。

每个 PR 独立比较 40 组真实 File/SQLite CLI 结果，覆盖五个命令、四个 manager-view、单 Goal 范围、未知范围、坏参数、损坏来源和暂停/恢复。另补 cap 与新来源的反例。每个 PR 的正常 wheel、sdist 各 25 个 console 案例通过：独立环境、空 cwd、无源码 PYTHONPATH，包内生产字节和 native 根已核。注册、state 和历史源文件保持不变。

比较保留完整字段、错误全文、权限、覆盖率、新鲜度标签、持久化时间及文件/库存 revision，只规范化明确的观察时钟和观察耗时。portfolio 的来源 digest 由捕获的原始 status 重算，原始快照和 manager context 的派生身份也独立核验，再比较规范化后的含义；没有直接删掉 opaque ID 掩盖差异。

本机同一 SQLite 八 Goal 输入、相同 Python/Node，准备完整字节码并预热原生运行时后，每臂 15 次新 Python 进程的真实 python -m loopx.entrypoint：摘要 p50 3361.68→1067.82 ms，p95 3493.07→1120.95 ms。这里没有计入 #6993 或已存在外层 scope 的额外收益。

对主干的风险

最关键的风险是代码 scope 跨请求泄漏，或入口搬移改变拒绝顺序、隐藏来源不完整和旧状态。实际负例保留：未知 Goal 的原合同是 code 0、空结果与 missing_goal_ids/不完整覆盖，不是凭空改为拒绝码；坏 registry 和无对应 mode 的 exact Todo 保持原错误；暂停后可见任务从 8 变 7，恢复后回到 8。未配置全局目录的 gates/todos 仍报来源不可用，不能称全局来源全健康。cap 下其余行明确 omitted，新注册的坏来源不会闯入已限定的 Goal 读取；显式读坏来源保持 unknown。

原生调用的方法序列保持一致；没有发起真实工作、外部 provider 投递或修改活跃 Goal。旧缺陷/私有变体会失败，当前 head 通过；包构建使用当前源码重建忽略的 Chat 资源后正常完成，最初错误构建调用和旧资源拒绝均保留。没有弱化断言、删掉失败或修改 budget。未查询、轮询或等待远程 CI。

冷原生启动、daemon RSS、PostgreSQL、Windows、安装态 App/Lark/模型以及长程净收益和完整成本仍未验证；本次不改变它们的原验收或授予推广资格。

我的整体评价

未发现本次精确 head 的阻断问题，结论 APPROVE。交付判断为 justified_increment：真实调用者获得可测的读取成本改善，边界可独立验证和回滚；不把这一结果等同整体 Stage 3、Goal 完成或模型收益。long_horizon 判为 preserved：当前状态、暂停、范围、失败恢复与后续读取语义保留；user_experience 判为 improved：同一读任务减少本地等待，无新增准备、权限或确认轮次。

沿用原有请求作用域，避免在每个视图复制缓存或判断规则。 只包住一次公共 quota 读取的代码版本生命周期。 兼容保留有真实调用方；采用现有 typed vocabulary/owner，没有新增领域状态分类或以 prose 猜测规则。保留已说明的未测边界。APPROVE 不授予合并、安装或发布权限。

English verdict: APPROVE — cdc0c89e13c13a7f53427b60ad881c18583d6049. Reuse the existing executable request scope at the public quota reader; current-state and failure behavior remain equivalent. 199 focused tests,40 full real-provider CLI pairs,50 installed console cases and matched normal-CLI measurements support this bounded improvement.