[loopx-agent]

Goal And Delivered Outcome

A bound quota spend-slot currently reads the completed Turn once for the CLI receipts and again for Reward Memory. Use the same fresh post-event readback for both consumers. Late reflection already reads after recording the refresh event, so it can pass that observation to the existing memory hook.

On the matched synthetic original quota CLI journey, the default SQLite spend command went from 87 to 86 Effect RPCs and 517,481 to 484,009 wire bytes. File went from 87 to 86 and 517,025 to 483,621 bytes. The matching C1 preview after incorporating the current main went from 116 to 115 and 698,633 to 665,161 bytes in the combined writeback. File and SQLite retained the same verified artifact, receipt sequence, one durable writeback and one debit. Source, effect, validation, workspace and run-index CAS are still checked by the existing owners. The CLI uses its resolved registry for the shared readback.

Related work is tracked in #7430. This proposal targets main and can be reviewed and reverted independently.

Author Declaration

• Written by: model_agent, Codex, OpenAI GPT-6 family

Implemented against

• Specification and revision: Receipt-backed settlement progress
• Criteria:

Criterion	Disposition	Symbol / path	Validation
Verify the original Turn's durable writeback and debit before returning settlement	implemented	attach_spend_settlement_result	Matched File and SQLite CLI and installed wheel journeys
Keep invalid effects and workspace mismatches fail-closed, and preserve once-only replay	implemented	Existing quota accounting and readback owners	Invalid Vision/workspace, exact replay, source lifetime and commit CAS suites
Finalize staged memory only from validated writeback and spend receipts, including late reflection	implemented	attach_reward_memory_ingest_after_spend	Native Reward Memory stage, malformed and changed reflection, before/after spend and late-reflection tests

• Self-check before submission: reviewed the four changed paths, verified signed commit and actual main base, and ran the source, package and runtime checks below.

Scope And Continuation

• Completed scope and remaining work: one post-event observation feeds the existing two consumers. It reuses the existing RPC schema, admission policy and persistence format. The same component serves the ordinary CLI and the C1 child spend. The wider C1 cutover and model-level performance remain open.
• Slice boundary / successor: source-local changes in the CLI adapters and their existing settlement helper. The scope review deferred pre-commit read consolidation because those reads bracket decision preparation and need separate freshness and concurrency evidence.

Validation

• Tested revision: 668bed2f03a274f273d39c187121a1a4ede67165, actual main 97cc1e0c40e766c73193b8077526a7f565dc561b. Instrumented working-tree comparisons used the same committed product files.
• Run state: finished
• Input classes: synthetic, public_fixture

Check kind	Result	Public-safe evidence and limit
static	passed	Changed Python files passed Ruff and the committed diff passed git diff --check.
static	failed	The repository-required Ruff command reported the same single F841 in the unchanged Goal creation test on base and candidate.
integration	passed	Six focused staged-memory cases and 164 TypeScript quota readback/commit tests.
integration	failed	Broad source suite had 315 passes and one Windows skip. Two telemetry-start cases, one oversized-snapshot fixture and one source-registry loader census failed with the same diagnostics on the actual unchanged base.
real_entrypoint	passed	Real quota should-run, progressive reader, fresh evidence writeback, spend and exact retry in isolated File and SQLite. Invalid Vision and wrong workspace produced no writeback/debit.
real_backend	passed	File and SQLite in disposable stores. Unchanged source lifetime and run-index CAS checks stayed on the real owner.
regression_parity	passed	Same outcome and debit on the C1 integration preview, with the identical four-file change. The external CLI byte totals stayed equal in each fixture.
real_entrypoint	passed	Candidate wheel built and verified in isolation, including the complete File and SQLite journey. Its focused test sweep had 15 passes and the same inherited snapshot fixture failure.
integration	passed	Standard local premerge passed six direct and 18 selected checks. Required repository lint remains reported separately.

• Coverage and gaps: the measurements count actual Python-to-Effect wire bytes. Node CPU, system I/O, user model behavior and real long-horizon cost remain unmeasured. The CLI output contract continues to be exercised through the original route.

Frontend / Visual Evidence

• UI impact: none. The changed work is an internal readback used by existing CLI and Reward Memory paths.

Type of Change

• Refactoring (no functional changes)

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)

Technical Direction

Core control-plane hardening. S7 budget, scheduling and fleet scale.

Shared-authority RFC fixture impact

Existing quota settlement and source-lifetime fixtures only.

[loopx-agent]

Reviewer: model_agent, gpt-6.1-sol, OpenAI, runtime_reported, reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

当前 head 未发现阻塞项。核对了原 Turn 首次写回与扣额、丢失 CLI 输出后的重放，以及可选内存的正常、延迟和失败路径。

动机 / Motivation

Codex App 或 CLI 的调用方完成一次原 Turn 的工作后，要读回结算回执并继续接续。 原来的扣额命令先为 CLI 回读结算，再为可选的 Reward Memory 重读同一份原 Turn。候选把记账后的同一个回读交给两个消费者。 File 和 SQLite 的关闭内存样例各少一次 settlement read，原回执、一次写回和一次扣额一致。 本提交只调整两个消费者怎样取得回读。扣额资格和可选内存写入仍由各自原有规则判断。 C1 全路径切换、真实安装采用和完整工作成本仍待独立验证。

改动思路 / Approach

一次 post-event 读取可供两个消费者复用，TypeScript 结算 owner 和可选 provider 的重试边界各自保留。 这一提交收口 CLI 在写入结算事件后重复读取同一身份的开销。 用 CLI 已解析的 registry 和原 Turn 绑定查询现有 owner，再把同一 QuotaSettlementReadback 交给内存 hook。若仅在关闭内存时跳过重读，启用及延迟反射仍会重复查询。把首次校验前的快照拿来复用则会丢失刚提交的扣额事实。候选把复用放在事件写入之后，保留前置读路各自的时效。

具体改动 / Changes

按基线 97cc1e0 的 quota 合同核对 original-turn-receipts、typed-blocked-no-spend 和 same-turn-replay。对应原身份的验证、写回及扣额回执，阻塞不扣额，以及原 Turn 重放保留同一绑定。基线规范

关键代码讲解

• _record_non_guard_quota_event 先记录扣额事件，随后把解析后的 registry 和原绑定传给 attach_spend_settlement_result。后者仍经 TypeScript owner 读取、投影缺失回执或 settled，然后返回该对象供同一调用使用。CLI 消费方 · 投影 owner
• attach_reward_memory_ingest_after_spend 从该对象取得原身份、写回事件及候选引用，仍要求执行成功与两份真实回执。延迟反射从 refresh 的现有 post-event 回读取值，provider 错误由原内存 owner 返回。内存 hook · 延迟反射

对主干的风险 / Risks

用相同输入在真实 File、SQLite 结算入口对照。关闭内存且首次 CLI 输出丢失时，每边都回读出一份写回和一次扣额，重放没有再扣。首次命令的 settlement read 由 4 到 3，全部 Effect RPC 由 88 到 87。SQLite 预先验证的反射用替身 provider 完成一次写入和一次读回，File 的延迟反射也激活一次且少一次结算查询。SQLite 替身 provider 失败仍返回 provider_unavailable，原 Turn 已结算。把候选换成扣额前的快照会要求回执修复且内存调用为零。恢复真实快照后，重放返回同一笔扣额。

• PASS · 两边各 32 条定向测试，覆盖同一 Todo 的 File／SQLite 重入、blocked/no-spend 和内存侧验证。候选 quick premerge 通过 6 项直接与 3 项选中检查。
• FAIL · 仓库要求的 Ruff 命令在两边都只报 tests/control_plane/test_goal_create_completion.py:184 的 F841，保留独立质量门。作者报告的其他套件失败保持原状态，本评审对照了受影响的结算入口。

我的整体评价 / Verdict

这次删去了一个已可复用的查询，保持原身份、回执和错误的含义。关闭内存的 CLI 与启用反射时的权限边界均沿用既有词汇。改动在 CLI 回读与后台内存 hook，界面层没有改动，视觉检查不适用。 隔离样例验证了 RPC 次数和回执语义。真实 provider 并发、运行时延迟与长期净收益仍待验证。 前置读涉及不同的准备和提交时点，当前边界适合独立评审。

English verdict: APPROVE at 668bed2. Original-Turn File and SQLite settlement and replay preserve one debit, and the fresh readback removes one redundant request on the measured paths.