[cocolord]

Delivery brief

• Goal/source: reduce the per-Turn cost of loopx quota should-run (the heartbeat guard) without changing its decision or output.
• Current gap: every quota/Turn decision read ran the full collect_status, including two projections that nothing on the decision path reads:
  • promotion_gate: scans every Goal's rollout log for the latest promotion-readiness event (~0.14 s on a long-lived runtime).
  • per-item attention_queue.items[].goal_channel_projection: the dashboard/frontstage channel card (~0.09 s).
• Observable result: quota should-run on a long-lived real-state copy drops from a median of 2.30 s to 1.71 s (about −26%). The should-run JSON is unchanged.
• Owning boundary: the status read model (control_plane/status/collection.py, work_items/attention_queue.py) and its quota/Turn decision callers. Scheduling, settlement, Todo selection and authority are not touched.

Change

• collect_status(..., include_presentation_projections=True): when False, it skips build_promotion_gate, omits the promotion_gate key and asks the attention queue not to attach goal_channel_projection.
• build_attention_queue(..., include_goal_channel_projection=True) guards the attach call. The goal-channel notification projection (~1 ms) is kept, because decision-relevant promotion_readiness_warning and the notification rows use other owners.
• Decision callers pass False:
  • prepare_quota_command_context (all quota commands), together with the cache load/write;
  • the monitor-poll status reloader;
  • the automatic stall re-read;
  • collect_turn_status_payload (Turn decisions).
• The status projection cache adds presentation_projections=false to the key only for the reduced payload. Existing loopx status cache keys are byte-identical, and a display read can never be served the reduced view.
• docs/status-data-contract.md notes the omission on decision reads.
• Vocabulary: one local boolean parameter per function. No enum, Literal or shared state vocabulary is added.

Default behavior is unchanged for every non-quota caller: loopx status, the dashboard, chat status, summaries, Lark and the installer.

Consumers checked

• promotion_gate readers: the status markdown renderer, the dashboard usage smoke and docs. The installer calls build_promotion_gate directly.
• goal_channel_projection readers: the status CLI, the agent-lane projection (built only from status), session dash, the goal-channel HTML renderer and dashboard TS.
• No reader exists in quota, scheduling, work items, the Turn decision, capture or host-poll code.

Evidence

Real-state A/B on this head (87f981070) against base main@04c5799b8:

• Fixture: two identical disposable copies of a long-lived local runtime plus a single-Goal registry, one per side. Each side had a private temp dir. No live state was touched, and the copies were deleted afterwards.
• Method: same interpreter on both sides, 10 alternating pairs.

	median	min	max	exit codes
base	2.30 s	2.01 s	4.90 s	all 0
head	1.71 s	1.47 s	3.41 s	all 0

• Output parity: with the same turn instance id, the normalized should-run JSON is identical apart from expected per-run values:
  • receipt/event ids;
  • projection_envelope staleness (1 s vs 0 s);
  • the compressed scheduler host-facts chunk, which decodes to identical facts after timestamp/id normalization.
• Profile attribution (one run each side):
  • build_promotion_gate 0.142 s → absent;
  • attach_goal_channel_projection 0.093 s → absent;
  • collect_status 0.55 s → 0.30 s.

Tests:

• tests/control_plane/test_status_collection_material_capability_wiring.py checks three things:
  • by default, both projections are requested and promotion_gate is present;
  • with the opt-out, the gate is never called, the key is absent and the queue receives include_goal_channel_projection=False;
  • the cache key separates the opt-out and keeps the default key stable.
• tests/control_plane/test_goal_channel_hard_lease_visibility.py covers the real collector over an on-disk SQLite workspace: the decision read's attention items equal the full read's items minus goal_channel_projection.
• tests/control_plane/test_quota_observation_scope.py asserts that quota passes the opt-out to its collector.
• Focused suites: 36 passed (collection wiring, quota scope, hard-lease visibility) and 241 passed (projection envelope, split-root fence, native child receipts, monitor follow-through, stall re-projection, Turn driver, agent-lane projection, canonical goal channel).
• Smokes passed: status-projection-cache, status-collection-readmodel, attention-queue-readmodel, goal-channel-status-export, goal-channel-readmodel, status-quota-perf-budget and semantic-vocabulary-drift.
• loopx canary premerge --from-git-diff --git-diff-base origin/main: passed, 19 selected checks, 0 failures.

Limits

• Single machine with a warm filesystem. The PostgreSQL authority suite was not run because no authority-store code changed.
• main currently has unrelated failing CI checks, and this PR does not attribute them.
• Not merged or installed. Merging needs maintainer authorization, because this changes a quota/status read path.

[songoow]

Reviewer: model_agent | GPT-6 | OpenAI | self_reported

REQUEST_CHANGES — 当前 required 验证有尚未归因的失败，暂缓批准。没有新确认的阻断性代码缺陷。 精确 head：87f9810703487cb11d92f9049b6e80d08c9e548c。

动机 / Motivation

这项修改影响反复运行 quota should-run 的 Agent，以及通过 monitor-poll 和 Turn 驱动继续工作的使用者。

此前每次决策读取都构建发布展示卡和 Goal channel 展示投影，即使决策消费者不读取它们；现在这些内部调用省去展示计算，普通 status 与界面继续获得完整展示内容。

本轮确认决策调用选择精简视图、缓存按视图区分，196 项相关测试通过；用户可见性能收益和当前浏览器预算失败尚未被独立当前证据完整关闭。 本 PR 不改变准入、Todo 选择、硬租约、结算或权限，也不删掉 promotion_readiness_warning 或 Goal channel 通知。

剩余缺口：保留原1秒断言，重现同一 populated workspace 场景并报告完整有界样本；或给出该基线与当前head同命令同签名的失败及非因果说明，同时保留本PR决策不变量验证。

改动思路 / Approach

在共享 status 读模型增加明确的展示开关，比另建精简 collector 更小，也避免复制筛选、硬租约与诊断规则。 本次只跳过决策路径没有读取的两项展示投影；通知与 promotion-readiness 警告保持原 owner，缓存 identity 明确区分完整和精简视图。

从调用链看，quota CLI prepare_quota_command_context、monitor-poll reload、automatic stall reread 与 Turn decision collector。 输入来自相同 registry、canonical File/SQLite Goal/Todo/lease 状态、运行与发布证据。 既有 collect_status 读模型和 quota/Turn 决策所有者保留；仅显示投影建立可选计算边界。 精简和完整读取共用相同 canonical source、scope、eligibility、ordering、diagnostic 与 notification owner；差异仅两项 presentation。缓存假设通过加入 false 标记表达，不建立平行状态合同。 因此这是一项有实际消费者的有限优化，不需要增加用户的配置、确认或恢复步骤；量化的完整任务收益仍要依赖可比较的真实入口测量。

具体改动 / Changes

关键代码与合同

本轮按基线 04c5799b88f6c4cf12a224b7fa679f272e1e794e 的 docs/status-data-contract.md 阅读既有合同，映射 Projection Envelope、Decision Freshness Summary，再核对当前实现与消费者；新增文档不充当自己的独立验收标准。完整差异共 12 个文件，+190/−11，生产、测试与文档分别检查，没有代码搬迁掩盖的第二个决策所有者。

• collect_status：保留完整读取所有者并允许跳过展示生成。default True；False 时不构建 promotion_gate，queue 不附 Goal channel card。关键条件是notification and decision warnings remain，结果交给 quota/Turn or full status facade。

• build_attention_queue：保留共同 attention 内容、排序与义务。仅 attach_goal_channel_projection 被 guard。关键条件是no eligibility/lease/obligation branch is gated by presentation flag，结果交给 collect_status consumers。

• status_projection_cache_key：把调用视图纳入缓存身份。False 添加字段，默认 True 的旧 key 字节不变。关键条件是one view cannot hit the other key，结果交给 quota_context and status CLI。

• prepare_quota_command_context：对决策读取及其缓存统一传入 False。collector/cache load/cache write 一致，并保留 Goal scope。关键条件是all three stages use same presentation mode，结果交给 quota plan/status/should-run。

docs/status-data-contract.md 增加 decision read omission 说明；函数注释及PR body列出四类 opt-out调用。 本轮检查了完整 diff 和变更文件之外的实际消费者，未发现应单独报告的确定性代码回归。

验证记录

PASS：pytest -q tests/control_plane/test_status_collection_material_capability_wiring.py tests/control_plane/test_quota_observation_scope.py tests/control_plane/test_goal_channel_hard_lease_visibility.py，36 passed in 29.36s (isolated socket-capable run)。负例覆盖：cache separation、selected/unknown/unmigrated Goal and real hard-lease tests PASS；未把精简视图作为全展示结果服务。

关联验证的完整边界：pytest -q tests/cli_commands/test_quota_stall_context_reprojection.py tests/control_plane/test_quota_should_run_parity.py tests/test_loopx_turn_driver.py: 160 passed in 193.57s; ruff and diff check passed.

默认 sandbox 的本地 Effect socket 权限失败已作为环境观测保留；在允许本地 socket 的独立临时环境中运行相同测试，不修改代码或降低断言。当前原始 CI 快照为 failure=2, in_progress=1, pending=4, queued=1, skipped=6, success=28，跳过不等于通过，聚合 checks failure不重复计为另一独立故障，pending也不单独构成阻断。

补充真实入口与浏览器配对

status/quota status/quota plan的空registry及unknown Goal四组，exit分别0/0/0/1；只归一化投影观测时钟和0/1秒read skew后，完整JSON一致。没有把这个小fixture作为全部有状态工作流的证明。

补充实跑（Linux / Node 24.22.1 / Chromium 138，development browser）：首轮基线被共享Vite cache的504 Outdated Optimize Dep阻断，head在200项全部展开处2336.75ms超过2秒。保留该轮后，仅隔离每个checkout的Vite cache重跑一次：基线到达原lens断言并失败，五次为2267.03/5308.05/6441.33/1664.61/7009.94ms；head再次在200项全部展开处2154.33ms超过2秒。没有修改断言或预算；基线与head本轮最先失败的子断言不同，不能把它们强行标成同一已归因失败。当前数据明确保留了可见性能验证缺口，未证明由本PR造成。

对主干的风险 / Risks

当前验证缺口 — dashboard-browser (2)。 goal-workspace-m2.mjs:206: Loaded lens switches exceeded frozen 1s budget: 727.15,523.58,801.28,1164.37,631.49 ms。当前 head 的五次测量有一次1164.37 ms超过1000 ms。没有本次不可变基线的同条件失败签名，也没有覆盖原负载与并发条件的当前浏览器反证；其他PR类似失败不能替代这份归因。

最小补齐：保留原1秒断言，重现同一 populated workspace 场景并报告完整有界样本；或给出该基线与当前head同命令同签名的失败及非因果说明，同时保留本PR决策不变量验证。 已在隔离的本地浏览器环境完成下面的有界配对；没有凭修改文件不相邻、一次成功或其他PR相似失败就将它归为无关。这里要求的是覆盖这个已观察条件的证据，不要求盲目改代码、删除断言或放宽冻结阈值。

代码层最强回归路径是：decision view污染status缓存，导致界面缺完整卡片；或错把通知、release-readiness义务与display card一起删除。 当前由False-only cache key field；default True；notification/promotion_readiness owner调用保持不变。 相关局部证据为上述测试；本轮没有独立复跑作者长寿命真实状态副本的 A/B，也未测用户长期累计收益；不能把196项测试通过等同于预算失败已消失。

我的整体评价 / Verdict

设计边界和代码规模与重复调用成本相称，现有 owner 得到复用，局部正反例提供了有用支持。但当前失败的不变量尚未有充分归因或当前反证，本轮已完成下面有限的同fixture public-entrypoint 基线/当前head观察，但尚未覆盖完整调用分支与public-path mutation反事实，所以这些证据保持 UNVERIFIED；不把作者A/B或测试数量写成本轮已证明的长程收益。在共享 status 读模型增加明确的展示开关，比另建精简 collector 更小，也避免复制筛选、硬租约与诊断规则。 本次只跳过决策路径没有读取的两项展示投影；通知与 promotion-readiness 警告保持原 owner，缓存 identity 明确区分完整和精简视图。

检查了默认 status、agent-lane 与 dashboard 的展示消费者及保持 True 的调用；本 PR 没有页面布局或交互改动，视觉审查不适用。 已实跑上述浏览器断言；该变更无新页面视觉设计，本轮未独立逐张审美或全页排版审查。CI与本地浏览器环境不同，不能认证其间歇性已消失。 这项 review hold 与 pending CI、merge授权分别判断；补齐具体证据后可重评同一head，无需为了review形式制造代码改动。

English verdict: REQUEST_CHANGES 87f9810703487cb11d92f9049b6e80d08c9e548c. Focused code tests support the implementation, but the current dashboard-browser (2) failure remains unresolved. No new blocking production-code defect is established; reproduce or independently attribute the named validation failure without relaxing its assertions. Bounded public CLI pairs agree; complete public-path counterfactual coverage and current CI attribution remain unverified.