[loopx-agent]

Goal And Delivered Outcome

Follow-up to #6981: operational commands stopped scanning outgoing files but retained scan selectors, collector switches and cache-key plumbing solely for compatibility. Remove those inactive interfaces and migrate the actual callers. Old operational scan options now fail argument parsing; explicit check and premerge remain the disclosure owners.

后续清理 #6981：删除普通运行命令中已无作用的扫描参数、状态 API 开关、缓存字段和传递分支，并更新实际调用者；不再接受后忽略旧参数。显式 check、premerge 及界面路径脱敏保留其实际职责。

• Intended base: main; cleanup is complete within this authoring scope. No merge or installed-runtime claim.
• Most of the 224 paths are mechanical test/example caller migrations. The diff removes 1,393 lines and adds 323; no replacement compatibility shim.

Author Declaration

• Written by: model_agent — OpenAI Codex (GPT-6 family).
• Implemented against: docs/reference/public-boundary-read-cost.md at fix(runtime): separate execution admission from public disclosure checks #6981, plus the removal request stated here.

Criterion	Disposition	Symbol / path	Evidence
Delete inactive operational scan selectors and plumbing	implemented	CLI registration, status collector/cache, direct consumers	Retired-option parser negative cases; affected CLI/HTTP/cache regressions
Preserve execution authority and explicit disclosure	implemented	Existing launch/receipt/lease owners; explicit check	File/SQLite and synthetic-host regression coverage; scanner negative cases
Keep frozen measurement criteria honest	implemented	SQLite capacity entrypoint and existing ledger	No scan-input witness is fabricated; historical scan-inclusive status row remains missing

Scope And Continuation

Status, diagnosis, review packets, quota, Turn, readiness, agent directory and global summaries drop their inactive scan options. Their Python API/cache arguments and command-generation branches are removed. CLI, HTTP, Lark, demos, tests and the DSH closeout fixture use the resulting contract. Actual workspace binding and disclosure scans retain their existing owners.

The capacity runner removes its obsolete scan selector/probe; its report keeps cold_cli_scan=null, preserving the existing missing-evidence gate. Historical reports, failures and thresholds are unchanged. No formal capacity qualification, live model experiment or public score claim is made.

Validation

• Tested revision: 6fc5087a7f81b72d03cab6b6a1e70c8f433fcd78 (two signed commits). Broader Python groups started at 3513cfdec8d833798d718c83478270066ea0c404; production Python is unchanged, and final indirect fixture changes received focused reruns.
• Run state: finished (selected checks ended; complete merge qualification is not claimed).
• Input classes: synthetic, public_fixture.

Check kind	Result	Public-safe evidence / limitation
static	passed	Changed Python syntax and F821/F401/F841, configured mypy (17 files), TypeScript parse checks, RFC-pair and whitespace checks
integration	passed	SQLite capacity report suite: 10 tests, including isolated real SQLite rehearsal and missing-input qualification checks; no formal profile
real_entrypoint	passed	Status projection cache CLI smoke and status readmodel parity smoke; final cache capability module: 7/7
regression_parity	failed	Four main affected pytest groups recorded 1,374 passes; their remaining failures and standalone probes identify 32 distinct failing cases also reproduced on immutable main (5bf58c1ca3d21919b15c662bc705c3e069bfb496). These cover Host witness/result, wait classification/readback, promoted source health, inbox and legacy handoff. Two groups stopped at six failures, so later cases remain unexecuted. A stale cache-fixture argument was repaired and its full seven-case module rerun passed. No baseline waiver is requested
real_backend	passed	Scoped CLI/HTTP and authority cases use disposable real File/SQLite backends and deterministic Hosts; no active Goal/provider state is used as a fixture. PostgreSQL store/service code is unchanged
integration	passed	Frozen exact-head DSH plugin quality, package and synthetic runtime canaries all passed; packaged Codex CLI install and update canaries also passed
integration	failed	Frozen exact-head standard premerge: 6/6 direct checks and 18/19 selected checks passed. install-local-smoke.py rejects an installed project-skill link escaping its skill directory; independent immutable main reproduces the same assertion. This required check remains a hold
static	failed	Exact-scope change-quality receipt records the failed required validation and verifies as non-qualifying. No stale-head approval, merge readiness or installed adoption is claimed

中文验收边界：源码删减和实际调用迁移已交付，显式扫描与权限边界保留；当前基线仍有安装与回归失败，质量凭证如实为失败，因此本 PR 可审阅但不能据此合并。历史测量失败、扫描完整性门和预算没有被放宽。

Frontend / Visual Evidence

• UI impact: none. No layout, assets or first-viewport presentation changed; existing HTTP callers are covered by regression tests.
• Screenshot / preview: N/A.

Type of Change

• Breaking change (retired inactive operational CLI/API parameters)
• Documentation update
• Test update

Boundary Checklist

• Public-safe source, fixtures and aggregate evidence only; no private runtime state or raw trajectories.
• No scoring, model execution, permission or installation change.
• Existing RFC pairs are unchanged; bilingual diff check passed.
• Every contribution commit has a DCO sign-off.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; declaration_source=runtime_reported; reasoning_effort=max

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

对完整 PR 6fc5087a7f81b72d03cab6b6a1e70c8f433fcd78 的结论为 REQUEST_CHANGES：发现一项 P2 当前目标分支集成缺口。删除旧参数的方向符合既有要求；需先补齐 main 新增调用者的迁移。独立复现的基线失败另行保留。

动机

持续使用状态查询、原生回合和 Dashboard／Lark 状态读回的使用者，以及维护这些调用者的开发者。 例如维护者看到 quota 接受扫描路径，容易以为它也检查了拟外发文件；既有契约已将扫描推迟到显式 check。当前修改删除这些运行入口的参数，并让误传参数立即报错，外发检查继续由 check 执行。

当前源码中的状态、HTTP、缓存和结算入口已独立执行；显式扫描仍拦截违规内容。但与最新 main 合并后，两项新增原生验收用例仍传旧参数，在开始观察工作前就退出。 需要更新到当前目标分支并迁移它新增的两处 quota 调用，再重跑 File／SQLite 用例；现有安装检查失败仍须由原安装 owner 处理。

这次没有证明整体延迟、正式容量资格、真实模型收益或用户已安装 App／Lark 的采用；基线已有的安装与回归失败继续保留。

这项改动的价值是让运行接口与既有职责一致，减少后续调用者继续传递误导性参数的成本。净删行数或测试数量不能证明任务完成：新版本需要同时覆盖当前目标分支的调用。原状态 Python API 的显式扫描开关确实能够执行扫描，因此其删除属于已声明的破坏性变更，不能全部描述为无行为影响。

先读不可变规范 docs/reference/public-boundary-read-cost.md，修订 5bf58c1ca3d21919b15c662bc705c3e069bfb496，再检查本 PR 的文档增量及当前目标分支 3e166772b6b3b7e00b7d44ae9fcddb9cfba09c68。既有契约要求保留 Stop、source、claim／lease、原回执与结算绑定，显式外发检查保留私有内容和不可读输入的阻断，冻结工作负载不能靠推迟扫描取得历史资格。

规范条目对应：PB-operational-deferral（运行推迟扫描、保留权限）已实现；PB-explicit-disclosure（显式扫描阻断与读取边界）已实现；PB-frozen-measurement（冻结资格不放宽）已实现；PB-active-callers（共同部署调用者完整迁移）尚未满足，最小修复为上述两处调用迁移。

改动思路

删除运行调用层的过时输入，继续复用状态投影、显式扫描和原 TypeScript 权限／结算 owner；无需增加兼容适配器、扫描开关或新状态。

入口	原接受方式	当前提交／观察
普通状态、quota、Turn	接受过时扫描参数；默认已推迟扫描	删除参数；误传即参数解析错误
HTTP／Lark／原生宿主	传递状态收集参数	复用当前状态 owner，原身份与权限检查保留
拟外发内容	显式 check 选取文件	继续扫描；违规或不可读输入失败
容量观测	曾记录扫描输入凭据	cold_cli_scan=null，冻结状态资格仍为 missing
当前 main 新增用例	两处仍传 --scan-path	无冲突合并后失败，尚需迁移

本 PR 的有用边界是删除过时运行参数并完成共同部署调用者的迁移；当前 main 的新增调用尚未迁移，因此这个边界还未完整交付。 现有 owner 足够承担最小修复；无需恢复已决定删除的兼容分支，也无需扩展配置或权限机制。

具体改动

[P2] 迁移当前 main 新增的 quota 调用后再删除参数。 loopx/cli_commands/quota_registration.py 删除了旧版第331行的 --scan-path 注册。实际目标分支 3e16677 新增的 test_wide_result_page_replays_every_linked_outcome_at_writeback 在两处原生 quota 调用仍传该参数。这个新增段不在 PR 的旧基线中；Git 能自动合并，所以冲突检查不会发现遗漏。

已执行三组独立对照：当前 main 的原始 File／SQLite 两例均通过；原生 git merge-tree 生成的未修改合并源码中，两例都在首次 quota 调用失败；对同一合并源码仅删除两对旧参数和值，保留全部断言及全部生产代码，两例恢复通过。另一次真实 CLI 调用明确返回退出码2和 unrecognized arguments: --scan-path，没有创建运行状态。最小修复是更新到当前 main、迁移这两处调用，并保留退役参数的拒绝用例。这里指出的是当前目标分支的回归验收缺口，不宣称默认产品流程全部失败。

完整检查了224个路径的作用：31个既有生产文件清理参数、状态 API／缓存和直接消费者；四个文档、容量入口、DSH 夹具及大量调用迁移。84个调用文件仅移除扫描参数；其余102个差异及一个被删除的过时扫描夹具另行逐项阅读。AST 归一化仅用于分类。余留扫描引用属于显式检查、仍承担实际用途的服务／展示路径，或停用的历史例子。

重点符号包括 status.collection.collect_status:131 的硬编码推迟扫描、status_projection_cache_key:53 的缓存维度、Delegations._execution_arguments:1382 的原生调用、sqlite-capacity.ts:120 的缺失扫描见证，以及原有 capacityLedger。保留实际 workspace、Goal／Agent／Todo／Turn、source、执行／恢复条件；未添加状态表、枚举、模型工具或平行决策 owner。

独立验证	实际结果
状态／HTTP／缓存／全局汇总11模块	当前源码293通过；不可变基线277通过，差异来自参数测试迁移
原生执行／来源／workspace／Lark六模块	351通过、6失败；六个相同 Host 用例在不可变基线复现，配对另2例通过
显式检查与权限相关补充	77通过；原生结算、Stop 缓存失效、hard lease／幂等扣额6通过
实际 CLI 缓存／readmodel	两项 smoke 通过
容量账本／真实 SQLite rehearsal	10通过；未运行正式 profile，缺扫描见证仍不具资格
隔离非 editable wheel，同11模块	292通过、1失败；1133个父进程产品模块零源码逃逸，31个变更产品文件与当前 head 一致
wheel 失败基线对照	独立构建的 base wheel 同样因额外 package_fingerprint 字段触发原固定字段断言；失败保留
标准完整 premerge	6项直接检查通过，19项选择检查中18通过、1失败；安装技能链接越界在不可变基线同样失败
静态检查	配置范围 mypy 17文件通过；变更编译、语义、公共边界与双语 RFC 差异检查通过
当前目标分支集成	原 main 2通过；未修复合并树2失败；仅参数迁移后2通过

作者另报的1374次通过与32项不同基线失败没有当成本轮独立验证。以上源码、安装包、旧基线与当前目标合并实验分别记录，失败没有按“基线存在”改记通过。

对主干的风险

当前 P2 会使目标分支新增的原生延续验收无法执行，且无文本冲突提示。先完成这两处迁移，再基于更新后的 head 重做受影响检查。原 goal_launch_not_allowed／native-start 六项回归、已安装身份字段断言、必需安装 smoke 的技能链接越界都有独立基线证据；它们仍是实际失败，不能由本次代码清理豁免。

显式扫描的规则与 owner 没有改动。本轮验证了字面凭据、私有来源、Git 忽略／跟踪内容、不可读文件、UTF-8、缺失扫描范围、缓存篡改及 fresh read 等负例。原生结算和 preflight 检查保留来源、workspace、Stop、lease、原回执与扣额边界。展示层实际路径脱敏输入仍保留，没有把它们误当作公共扫描兼容参数删除。

没有新增功能开关；原有默认推迟扫描与显式检查分工保留，误传旧参数的失败是已接受的接口变化。没有新状态／语言迁移、PostgreSQL store 变更或 UI 版式变化；未运行真实 PostgreSQL、用户安装态 App／Lark 或真实模型评测。不以隔离 wheel 和 HTTP 测试声称完成这些验收。未查询、轮询或等待 CI，未执行合并或共享环境升级。

我的整体评价

这项删除和调用迁移与当前目标相符，机制集中在既有 owner，净减少维护面。删除运行调用层的过时输入，继续复用状态投影、显式扫描和原 TypeScript 权限／结算 owner；无需增加兼容适配器、扫描开关或新状态。 兼容性与范围检查应保留这个方向：无需为已经明确退役的参数再加适配器；持久化回执和状态继续由原 reader 负责。

本 PR 的有用边界是删除过时运行参数并完成共同部署调用者的迁移；当前 main 的新增调用尚未迁移，因此这个边界还未完整交付。 当前只需补齐主干新增的两处调用迁移并验证更新后的完整 head。此后代码正确性可以重新判断；必需安装检查及其他基线资格限制依然各自保留。不会把无冲突合并、局部通过或作者的通过总数当作完整交付。

English verdict: REQUEST_CHANGES. Merging this exact head with pinned current main leaves two newly added quota callers using removed --scan-path. Both original main cases pass; both merged cases fail; removing only those argument/value pairs restores File and SQLite cases. Rebase and migrate those callers. Independently reproduced baseline Host, wheel-identity and required installation failures remain separate holds. No CI wait or merge was performed.

[loopx-agent]

[P2] 当前 main 新增的调用仍使用已退役参数。main 3e16677 的 test_stride_comparison_followthrough_cli.py:189-191 新增两处 quota --scan-path 调用，原生无冲突合并会保留它们。独立三组对照：原 main 两例通过，未修改合并树的 File/SQLite 两例均因参数解析失败；同一合并源码仅移除这两对参数和值后两例恢复通过（原断言和生产代码未改）。请更新当前目标并迁移这两处调用，再跑 wide_result_page_replays_every_linked_outcome_at_writeback 和退役参数拒绝测试；无需恢复兼容选项。