[hhyykk]

Goal And Delivered Outcome

Quota source and planning reads projected both canonical and project-asset Todo summaries before choosing one. An invalid display index in an unused handoff row could therefore block a valid canonical source. Select the available preferred summary first, then use the existing typed projection owners. Authoritative empty summaries remain empty; a selected-source failure still propagates.

• Basis: the requested architecture/payoff study against the TypeScript migration RFC.
• Intended base: main; refreshed to 3e35f83d6f009ad490320d2b525ebecea1605ea4 after feat(planning): keep Goal context current with independent Agent adoption #6987 merged.
• Overlap: all 49 open PR file inventories checked, including new fix(codex): recover long-turn activity with bounded reads #6994. No other PR modifies either changed Python file. refactor(todos): compose full readback in one TypeScript transaction #6874 owns canonical Todo readback composition; this change removes discarded downstream source projections. perf(quota): reuse one executable revision per public read #6992/perf(cli): dispatch global reads through their lightweight owner #6993 remain separate and their gains are excluded from the marginal comparison.

Author Declaration

• Written by: model_agent, OpenAI Codex (GPT-6 family).

Implemented against

• Specification: TypeScript control-plane migration RFC, especially sections 2.3, 5 and 6.

Criterion	Disposition	Evidence
One typed domain owner	implemented	Existing succession/context owners unchanged; Python only selects the compatibility input.
Replacement/payoff economics	implemented	Duplicate planning adapter and discarded projections removed; receipt below.
Caller-observable parity and failure behavior	implemented	Real-runtime source precedence matrix, authoritative empty sources, selected failure, terminal causality and malformed discarded handoff regression.
Complete entrypoint and installed qualification	implemented	Source, wheel and sdist File/SQLite reads; matched complete-command measurements with limits disclosed below.
Whole-task/model improvement and broader migration cutoff	out_of_scope	No model-backed outcome, ten-day continuity, provider promotion or complete Python retirement claim.

Scope And Continuation

Complete within this bounded source-selection family. select_quota_todo_source_items and select_planning_inventory_source_items keep their signatures. Quota preparation, task-orchestration fallback, replan writeback and receipt-source recovery keep their existing callers. No CLI flag, output field, provider selection, canonical write, cache or new RPC.

The larger quota-plan migration was rejected because live policy helpers would remain and its complete-command payoff was unproven. Broader Todo preparation fusion overlaps active #6874. Neither is a prerequisite for this independently reversible fix.

Migration economics	Receipt
Canonical owner before/after	Existing TS succession/context owners; existing Python compatibility precedence.
Domain rules deleted	0; this is caller/adapter retirement, not a new semantic migration.
Adapter/product code	+14 / -30 product LOC, net -16; _planning_inventory_source_items removed. Tests +80; paired RFC prose separate.
Bridge code added	0.
Crossings removed	Discarded source projections only. Happy-path and unchanged selected-failure behavior checked with real runtime IO.
Scaffolding	No production benchmark or migration scaffold added. Tests preserve durable source-selection behavior.
Facade exit	Compatibility selection remains until quota/planning callers consume the typed owners in-process.

Validation

• Tested normal source and artifacts: d71d95aa99b796404907d09329e3505735339a75.
• State: finished. Inputs: synthetic and public test fixtures. Linux; Python 3.13 tests, Python 3.11 installed/measurement callers; qualified Node 24.

Check kind	Result	Evidence / limits
static	passed	Ruff, control-plane typecheck, diff check and paired RFC gate. Clean-code, test and docs guard passes completed.
integration	passed	All 28 source-precedence tests pass with the managed TS runtime, terminal-inclusive planning, and selected transport failure injected at the runtime IO boundary.
regression_parity	passed	Exact same test source on current base and candidate: discarded source IPC and malformed unused handoff regressions fail before the fix and pass after.
integration	failed	Wider 14-file selection: 362 passed, 3 failed. All three failures also reproduce on unchanged current main; listed below. This is not an all-green suite.
real_entrypoint / real_backend	passed	Five global read commands x File/SQLite plus five malformed-registry refusals: 15 cases per arm for source, wheel and sdist. Selected outputs match baseline after declared observation metadata normalization; registry and state bytes remain unchanged.
manual	passed	Wheel/sdist carry the exact changed source; no bytecode, dependency-tree or symlink leakage.
real_entrypoint / performance	finished	Complete CLI observations below; no universal latency or model-quality claim.

Pre-existing failures, reproduced on current main:

• test_public_quota_distinguishes_monitor_repair_from_generation_wait[todo_done-True]
• test_public_quota_distinguishes_monitor_repair_from_generation_wait[monitor_changed-True]
• test_public_quota_capacity_wait_uses_provider_after_cutover_without_display_write[True]

These promoted resume-planning cases return status-health failure on both trees. They remain in the suite; this PR does not repair unrelated acceptance behavior.

Matched complete-command observations

Complete SQLite CLI	Native requests	Median ms	p95 ms
global-summary-1	65 → 59	497.7 → 508.2	545.6 → 548.0
global-summary-8	485 → 437	1003.5 → 979.7	1087.4 → 1058.5
quota-should-run	85 → 79	1254.0 → 1251.9	1306.9 → 1305.3
global-summary-32	1925 → 1733	2668.1 → 2589.4	2786.0 → 2805.7

Latency is mixed: the single-Goal median is higher, and the 32-Goal p95 is 19.7 ms (+0.7%) higher. The delivered gains are the reproduced failure repair, less discarded computation and net product deletion. The table does not establish a general speedup.

The marginal baseline composes current main with the public #6992 and #6993 changes; the candidate adds only this PR's production patch. Thus prior request-scope and CLI-import savings are not counted again. Both arms use complete prepared bytecode, warm native runtimes, the same immutable Todo/registry inputs and 15 fresh Python processes per arm in alternating order. Actual Python/TS source origins, code-resolution scans and native methods are captured. The measured production file is byte-identical to the normal PR head.

Observation clocks and the quota CLI's newly generated rollout-observation id/time are normalized; Todo identities, persisted times, gates, coverage, actions and source facts are retained. Portfolio snapshot hashes are independently recomputed before removing clock-derived snapshot/revision metadata. Missing global-source warnings remain visible.

Earlier pinned-base observations and a scale attempt without its intended public scan directory are retained as earlier/invalid qualification evidence, not substituted for this current-main matrix. Normal registry/state data is synthetic; no live Goal was promoted or changed. Wall-clock samples do not establish model-backed effectiveness or a general speedup.

Reproduction entrypoints:

uv sync --extra test
uv run --extra test pytest -q tests/control_plane/test_quota_summary_source_precedence.py
uv run --extra test pytest -q tests/control_plane/test_quota_should_run_parity.py tests/control_plane/test_quota_plan_policy.py tests/test_goal_portfolio.py tests/test_summary_all.py tests/test_global_todos.py tests/test_global_risks.py
npm run typecheck:control-plane
python3 scripts/check_rfc_bilingual.py --base origin/main --head HEAD

The full related selection also includes Todo summary, resume planning, task-orchestration admission, Goal frontier and handoff-context tests. Raw local receipts remain private. No Windows/macOS, live Chat HTTP/MCP journey, provider delivery/send or model-backed end-to-end run was performed. No merge-readiness or activation claim.

Frontend / Visual Evidence

UI impact: none. This changes internal source selection; no screen or workflow is added. Before/after screenshots, preview, viewport and craft review: N/A. Source data: synthetic/public fixtures.

Type Of Change / Area

Bug fix; bounded refactoring; tests and bilingual RFC update. Area: control plane. Direction: replacement-first caller/adapter payoff.

Shared-authority RFC fixture impact

• Shared fixture: tests/fixtures/control_plane/coordination_production_scale_v0.json, schema loopx_coordination_production_scale_fixture_v0, unchanged. No coordination field, canonical operation, capacity/retention assumption or persisted compatibility projection changes.
• The affected source-selection cases use real File and SQLite through normal installed callers.
• PostgreSQL conformance and the read-only legacy/File/PostgreSQL rehearsal were not run: no AuthorityStore/provider, runtime routing, promotion or persisted compatibility-projection change is introduced. This does not qualify those promotion gates.

Boundary Checklist

• Public-safe source, prose and aggregate evidence; no private state, raw traces, credentials, local machine paths or private links.
• Open PR overlap checked; no maintainer-owned benchmark work duplicated.
• Scope kept to the selected source-projection defect/payoff.
• Both RFC languages updated and bilingual diff gate passed.
• UI impact marked none.
• Every commit has a DCO sign-off.

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | effort=max

动机

需要根据当前任务判断能否继续工作的命令行用户和 Agent。 已有有效权威任务时，未采用的展示副本损坏过去仍可能使配额读取失败；现在先选择来源，只投影选中的任务。 未选中副本的错误不再遮蔽有效任务，选中来源损坏仍报错，权威空任务不借用另一来源。 不改变权限、配额规则、持久状态或 provider 路由，不交付完整迁移、安装态 App 或模型收益。 这解决的是读取任务时的错误耦合；保留旧实现会继续让无关展示副本阻断当前工作，单纯吞掉异常又会掩盖真正损坏的权威来源。

改动思路

来源顺序沿用既有兼容层，领域投影仍归原有 TypeScript owner；删除被丢弃的计算和重复 planning adapter，避免新缓存或第二规则实现。 本 PR 只修复两个现有来源选择器的投影顺序，不改已选来源的字段、失败规则或持久化。 不新增权限、数据库、RPC 或数据缓存。两个选择器共享一个很小的输入选择函数，仍用原来的 typed succession/context 投影；选中来源的失败是必需校验失败，未选中的副本不参与本次决策。task-orchestration fallback、语义 replan 与原 receipt 恢复继续使用原调用者；没有因本修复引入人工配置或确认轮次。

输入	原行为	当前 head
有效 canonical + 损坏未选副本	quota 失败，global runnable 为 0	保留有效任务，可继续
损坏选中来源 + 有效副本	拒绝	仍拒绝，不借另一任务兜底
权威空来源 + 有任务副本	不选副本任务	仍不选副本任务

此表说明源码分支；执行证据另见下面的真实 CLI 对照。

具体改动

评审固定 d71d95aa99b796404907d09329e3505735339a75，实际不可变 PR 基线为 3e35f83d6f009ad490320d2b525ebecea1605ea4。先读规范 TypeScript migration RFC：docs/architecture/rfcs/typescript-control-plane-migration-v0.md，spec_revision 3e35f83d6f009ad490320d2b525ebecea1605ea4。§2.3 implemented：原 typed owner 与效果边界不变；§2.4 implemented：删除重复 planning adapter，不加第二规则；§5 implemented：产品 +14/-30、净 -16，无新增 bridge，按完整调用计实际成本；§6 implemented：真实消费者、反例、打包与完整命令测量。Stage 3 out_of_scope：完整原生 CLI/App 及迁移退场继续归原主线，不能由这一修复宣布完成。英中 RFC 新段落含义一致，描述上述窄边界，并明确少调用不等于性能收益。

关键代码讲解

• _select_todo_source：Same canonical/legacy order; choose a dict including an authoritative empty dict before any projection.
• select_quota_todo_source_items：Only selected source enters existing succession/context owners; selected errors propagate.
• select_planning_inventory_source_items：Removed duplicate adapter; include_terminal and selected-row evidence preserved.
• _prepare_quota_should_run_item：Uses source selectors for current user/agent/terminal planning inputs without new admission authority.

测试新增 80 行，保护已有来源优先级、空/缺失输入、原生 transport 异常、terminal 证据和无关 handoff 展示错误；没有把损坏权威数据改判为有效。旧私有 planning adapter 没有独立调用者，移除后不留兼容分支或新生产 scaffold。

对主干的风险

155 项聚焦测试通过。使用真实 File/SQLite、实际 CLI 与 TS runtime，对照 40 个完整调用：五个全局读命令、四种 manager 视图、范围/坏输入、暂停与恢复；保留全部非观察时钟字段，重新验证派生摘要，不靠删掉 opaque id 得出一致。另在真实 collector 输出处注入受控来源故障，32 个 CLI 观察复现上表；这是真实消费者/原生投影证据，故障注入层不冒称磁盘生产者或模型行为。正常 wheel/sdist 各 25 个 console 用例和合计 8 个安装包反例通过，空 cwd、无 source PYTHONPATH，产品字节与原生模块来源均核验。

在同一 SQLite 八 Goal、同一 Python/Node、完整字节码、原生热态下，每臂 15 个普通 Python CLI 新进程交替测量：p50 3637.03→3352.37ms，p95 4375.49→4309.07ms；完整输出一致。独立调用追踪为 477→429，少 16 次 succession 与 32 次 context 请求。只比较本 PR 的实际 base/head，不把 #6992/#6993 尚独立的优化混入收益。系统负载未完全受控，不推出普遍速度、冷启动或长期成本改善。

标准 premerge 的 6 direct 和 19 selected 全过。最初把 TMPDIR 放在仓库内，导致“非 Git 目录应跳过”的 catalog fixture 识别到父仓库而失败；同环境在基线也失败，换为仓库外临时目录后基线及当前头都通过，未改产品或断言。最初旧 Chat 资源拒绝构建，按现有 dashboard build:chat 重建后正常 wheel/sdist 构建通过。

另一个恢复测试文件在 base/head 都是 18 过、3 败：todo_done-True、monitor_changed-True 和 promoted capacity-wait。逐条核对 node id、127/271 行、实际 code1、health=false 与 repair state_file 原因，并捕获完整 packet；fixture 删除了仍被要求存在的状态文件，相关 fixture/status/prepare/公共 builder 字节不变。这些既有失败保持红灯和单独集成 hold，不称整体测试全绿。缺少全局目录的用例也保留 envelope incomplete/alert，外层 code0 不等于全局健康。未查询或等待 CI。

我的整体评价

此精确 head 的有界来源修复达到 goal_achieved，结论 APPROVE。long_horizon 为 preserved：选中失败、任务身份、空来源、terminal 因果、暂停及后续读取继续归原 owner，没有新重试或计费循环；user_experience 为 improved：有效任务不再被未采用的坏展示数据挡住，无新增准备或确认轮次。采用现有 typed vocabulary，没有新增共享状态或命名更广的权限协议。保留上述三项既有失败，以及 PostgreSQL、Windows、安装态 App/Lark/模型、冷启动/RSS 和完整长期成本的未测边界；批准不表示整体迁移、安装、发布或合并授权。

English verdict: APPROVE — d71d95aa99b796404907d09329e3505735339a75. Select the authoritative source before projection, retaining selected-source errors and authoritative emptiness. Full real File/SQLite and installed consumers, historical fault sensitivity and normal CLI cost support this bounded repair. Three independently matched pre-existing recovery failures remain a separate integration hold.