diff --git a/docs/architecture/rfcs/controller-executor-unified-contract-v0.md b/docs/architecture/rfcs/controller-executor-unified-contract-v0.md
index e34474c9d0..167ad296cd 100644
--- a/docs/architecture/rfcs/controller-executor-unified-contract-v0.md
+++ b/docs/architecture/rfcs/controller-executor-unified-contract-v0.md
@@ -7,8 +7,8 @@
- **Delivery maturity:** Proposal; no new runtime, schema or default is shipped by this document.
- **Authors / owners:** LoopX maintainers; control-plane and runtime owners
- **Created:** 2026-10-27
-- **Last normative revision:** 2026-11-06
-- **Latest source audit:** `f91e26d91d3e4e1b28b69f5881a059ea78891082`; historical experiments retain their own baselines.
+- **Last normative revision:** 2026-11-09
+- **Latest source audit:** `3edaf9c25a56c9d714b097f2d6fee6ffabbd629d`; historical experiments retain their own baselines.
- **Related contracts:** [Effect interpreter](agent-loop-effect-interpreter-v0.md), [Session execution modes](agent-session-execution-modes-v0.md), [Semantic handoff](capable-manager-semantic-handoff-v0.md), [Overall roadmap](loopx-overall-roadmap-v0.md)
- **Language mirror:** [中文版](controller-executor-unified-contract-v0.zh-CN.md)
@@ -170,7 +170,7 @@ intentionally have no LoopX Core and must remain uncontaminated controls.
### Current delivery audit
-The 2026-11-06 audit is pinned to main `f91e26d91d3e4e1b28b69f5881a059ea78891082`.
+The 2026-11-09 audit is pinned to main `3edaf9c25a56c9d714b097f2d6fee6ffabbd629d`.
A mechanism present in source establishes an implementation boundary, not a
qualified dual-session journey or benefit.
@@ -182,7 +182,7 @@ qualified dual-session journey or benefit.
| Original-audience return | [`return_delivery.ts`](../../../loopx/control_plane/collaboration/return_delivery.ts) distinguishes a provider write without a locator from no write | Router synthesis must not rerun tasks to repair delivery; delivery is not requester adoption |
| Shared managed operations | Codex/DSH both call [`managed_operation_host.py`](../../../loopx/control_plane/turn_driver/managed_operation_host.py) and `select_managed_operation_session` | C3.1's generic-handler extraction already exists; reuse it and audit remaining callers instead of repeating the project |
| Two-role binding | [`codex_sessions.py`](../../../loopx/control_plane/turn_driver/codex_sessions.py) stores sessions by Goal/Agent/Todo or Agent scope, without this proposed controller/worker pair | C3 needs roles/generations, independent queues and continuity within one Agent; two thread IDs alone are insufficient |
-| Unified work contract | Active quota/Turn format branches remain; [#7430](https://github.com/loopx-project/loopx/pull/7430) is an open C1 proposal, inspected at `3a4f6f64f288ab6c663c829ed5f5670c42d72595` | Coordinate with its owners and retain the original single-session outcome/cost gate; do not add router multi-unit delivery to its merge conditions |
+| Unified work contract | [#7430](https://github.com/loopx-project/loopx/pull/7430) merged and was reverted by [#8265](https://github.com/loopx-project/loopx/pull/8265). [#8266](https://github.com/loopx-project/loopx/pull/8266) carries the C1 replacement. [#8238](https://github.com/loopx-project/loopx/pull/8238) and [#8323](https://github.com/loopx-project/loopx/pull/8323) landed individual settlement-read and narrative-read improvements. [#8304](https://github.com/loopx-project/loopx/pull/8304) is an independent staged-replan candidate. | Keep moving useful fixes into main. Qualify the replacement against original single-session quota before profile cutover. Earlier transport or writeback measurements remain scoped to their measured path. |
| Common Host transport | [#7568](https://github.com/loopx-project/loopx/pull/7568) remains Draft, inspected at `e3a3c06524fae99519a72d751a16a5e8dd6f9a5d` | A candidate adapter; bounded calls do not establish bidirectional long-lived sessions/asynchronous control. OAR or an all-Host rewrite is not a prerequisite |
The annex below retains older field audits and experiments at their original
@@ -981,42 +981,88 @@ No model busy-polling loop or new recurring automation follows from this RFC.
```mermaid
flowchart TB
- C1[C1/C2: unified single-session contract and context] --> U[C3-C6: one real dual-session unit]
- F[Existing request / managed-operation / Session owners] --> U
+ C1[C1/C2: qualify unified single-session against original quota] --> E[C7: matched product outcomes and complete cost]
+ F[Existing request / managed-operation / Session owners] --> U[C3-C6: isolated one-Host dual-session preview]
U --> I[C6/C8: autonomous work loop with conversation, correction and Stop]
I --> R[C6/C8: router connects two independent units]
- I --> E[C7: unit outcomes and complete-cost comparison]
- R --> E
+ I --> E
+ R --> M[Separate multi-unit evidence]
E --> Q[C8/C9: scoped adoption and old-path retirement]
F -.Independent correctness repairs and caller simplification may land first.-> C1
```
-These are actual dependencies, not a fixed queue every Agent must start at the
-first box. C1 retains its acceptance scope; shared-owner prerequisites, existing
-request/recovery repairs and removal of already-replaced code can land independently.
-A new profile's actual cutover depends on its unified contract being qualified,
-not every Host, language migration or benchmark being complete. Select work from
-the overall roadmap, current user outcome, bottleneck and in-flight owners; row
-numbers are not PR counts.
+Run C1/C2 qualification and the isolated one-Host preview in parallel. The
+preview may consume an exact pinned version of the C1 contract in a disposable
+scope. Production profile cutover still requires C1 qualification. The unit
+comparison can start after single-session qualification and the first
+dual-session work loop. Router and multi-unit comparisons have their own
+evidence. Use the existing C tasks to assign work and keep independently useful
+repairs reviewable. The rows describe delivery dependencies and exit evidence.
| Slice within existing C tasks | Complete reviewable delivery / existing owner to adopt | Exit evidence and concrete simplification |
| --- | --- | --- |
-| **C1/C2 — Finish existing contract cutover** | Converge #7430's source, consumer and recovery work; no router packet | Original single-session quota comparison, field/clause fidelity, real caller, off and recovery; remove each replaced format writer, retaining named historical decoders |
+| **C1/C2 — Finish existing contract cutover** | Converge the source, consumer and recovery work now in #8266; reuse the existing contract | Original single-session quota comparison, field/clause fidelity, real caller, off and recovery; remove each replaced format writer, retaining named historical decoders |
| **C3/C4 — One binding unit** | Two roles in one Agent through current session/managed-operation owners; qualify one Host with isolation, observation and interruption | Two real sessions and independent context baselines; concurrent/restarted callers cannot overwrite bindings or let old generations write; remove replaced single-slot assumptions without another dual-session runtime |
| **C5/C6.1/C8 — Work loop with interaction during execution** | Real long worker operation returns a handle; controller consumes user/worker input through request revisions, queue reservations, Stop and readback | Ordinary result → assessment/feedback → further execution without a user wake; original settlement and fresh continuation; substantive response before worker completion, correction changes subsequent artifacts, attention/safe-preemption/fairness cases pass, cancellation need not await a model; replace that caller's whole-task blocking wait and duplicate classification, delivering the same App journey |
| **C6.2/C8 — Router connects two units** | Steward adopts existing multi-recipient requests, original-audience returns and selected bindings; direct controller input uses the same revision entry | B progresses while A is busy; partial refusal does not rerun A; restart returns results to original audiences without expanding permissions/budgets; remove duplicate synthesis/routing branches |
| **C7/C8 — Compare and adopt narrowly** | Match workload/Host across original single-session, unified single-session and dual-session arms; separate additional multi-unit coordination arm | Comparable-budget outcomes and complete costs, response/correction/stop latency and human intervention; retain small-task counterexamples and model/Host boundaries. Qualify packaged App/CLI and supported Lark failure/recovery separately |
| **C9 — Named retirement and default decision** | Retire each replacement with caller, historical-reader window and rollback evidence; decide adoption for qualified workloads/profiles | No second decision/task/budget ledger; original attempts reconcile after new admission closes; retain qualified single-session use, without treating fewer lines or more sessions as benefit |
-The recommended next implementation decision is to align in-flight C1 with current
-session ownership, select a Host that actually supports nonblocking worker
-observation, tool isolation and Stop, and deliver a reviewable “one autonomous unit loop +
-interaction during execution” slice. The steward's existing multi-recipient chain
-then adopts it. Binding/recovery simplifications that improve current callers may
-land first without waiting for all of C1. A global scheduler, generic message
-middleware, unlimited Agent hierarchy or third state store is unnecessary. Add
-missing bidirectional Host behavior to the real adapter; a unified interface alone
-is not delivery.
+
+
+### Controller delivery cadence
+
+1. **First native slice — run alongside C1.** The runtime and Turn owners
+ should qualify Codex App Server first. The existing managed-operation adapter
+ observes authenticated `turn/start` and the Chat host already routes
+ `turn/interrupt`. Verify that a durable worker attempt remains observable
+ after dispatch returns, including reconnect and an actual interruption.
+ Extend the existing adapter at the missing boundary if required. The first
+ runnable slice uses one Agent, two native sessions with independent context
+ baselines, and one scoped task. The Controller is the sole model-side Core
+ client. It consumes Progressive and Delta state and retains admission,
+ validation and settlement. The Worker receives the task, scoped ordinary
+ tools and artifact references. It returns findings and artifacts through the
+ existing request chain. Verify through both session traces that an attempted
+ Worker Core call is denied and ordinary scoped tools still work. The slice exits when a worker result causes an
+ evidence-based decision and another useful work segment under fresh
+ admission, the original attempt settles once, and an unavailable Controller
+ still permits Host/Core Stop. Verify restart, duplicate and late outcomes on
+ the same recorded attempt before admitting a replacement.
+2. **Make that unit usable while it works.** The request and App owners should
+ deliver one real journey through existing Chat and artifact projections. Ask
+ about a running task, get a substantive response from durable evidence before
+ the Worker finishes, inspect a versioned artifact and request a correction.
+ Apply it at a safe boundary and verify that the next artifact adopts the
+ effective revision. The Worker keeps its original attempt while in-flight
+ effects finish or reconcile. Offer unsolicited updates on material evidence
+ or required decisions, deduplicated by revision and audience. Reuse the
+ existing scheduler wait, Stop path and product readback. Once that journey
+ works, have the steward adopt the same request/return path for a second
+ independent unit. Verify that B advances while A is busy and that a refusal
+ or restart preserves both the original audiences and scope.
+3. **Measure whether separating the sessions pays.** Benchmark and acceptance
+ owners first qualify the unified single-session path against original quota.
+ Then compare the native two-session unit against both with frozen task
+ acceptance, comparable budgets and matched Host/model settings. Record
+ Controller and Worker input/output, calls, tools, retries, reporting,
+ wall-clock cost and human interventions, including the cost of the Controller
+ or Reviewer asking for another round. Measure response, correction adoption
+ and actual Stop latency separately from completed-task latency. Freeze the
+ acceptance oracles and cost/latency thresholds before running. Retain simple
+ tasks where coordination overhead may dominate. Use existing Stride and
+ Yardstick decisions to test whether a longer worker segment, a measurement
+ change or stopping improves subsequent accepted work. Attribute a local
+ yardstick's usefulness to later independent acceptance, including wrong
+ rankings and plateau cases. A learned meta-controller is a later research
+ hypothesis. Default adoption and old-path retirement follow the scoped §9
+ and C9 evidence, including rollback to qualified single-session admission
+ with reconciliation of original attempts.
+
+Implement these slices through the current request, session, Turn and product
+owners. Each PR records its replaced caller, the new observable outcome, the
+evidence and the rollback. The preview introduces no second authority store or
+separate user ingress.
@@ -1060,9 +1106,9 @@ are stable design references, not claims that a canonical Todo is complete.
| --- | --- | --- |
| **C1 — Unified contract; new-profile cutover dependency** | Interaction/work-context + quota/Turn owners: inventory fields/instruction clauses, capture/view/read-evidence mappings and versioned two-layer configuration; capture one schema and migrate ordinary quota/Turn producers and thin renderer | Single-session real-entry parity with necessary information, action binding and once-only settlement, plus §9's quota-baseline effectiveness/full-cost comparison; preserve explicit off and version-pinned readers until cutover qualifies |
| **C2 — One context-delivery pipeline; C1** | Context owner + host observers: compose cross-host Progressive, independent qualified Delta, same-capture detail/recovery and conservative unread discovery; replace staged candidate delivery and duplicate packet branches | Unchanged unread constraints reach actual next-Turn work; qualify no-hook readers, exact evidence/continuity and all four layer combinations at complete cost; full fallback without a new admission; rollback encoding/configuration through the existing owner |
-| **C3 — Session binding and native lifecycle; C1** | Session/runtime owner: extend existing binding for role/generation; reuse native create/resume/observe/interrupt and ordered queues | Two roles cannot overwrite the Agent native ID, cross-read baselines or race execution; recovery observes existing attempts before retry; disable new role admission to roll back |
-| **C4 — Shared governed lifecycle; C1** | Effect/Turn owner + outer worker adapters: converge duplicated prepare/dispatch/observe/validate/writeback/settle orchestration around existing typed operations and receipts | App/Turn/external worker agree on admission, original result and single debit under partial failure; scheduler effects retain their true host owner; switch callers back only after receipt reconciliation |
-| **C5 — Replan and result authoring boundary; C1** | Goal/Vision and interaction owners: expose current facts and typed controller operations; remove ordinary executor obligations to manufacture Core writeback fields in the two-session profile | Fact-first decision preserves default/stride policy differences, all evidence and required validation; invalid proposed writes reject; single-session authoring remains qualified during rollout |
+| **C3 — Session binding and native lifecycle; C1 for cutover** | Session/runtime owner: extend existing binding for role/generation; reuse native create/resume/observe/interrupt and ordered queues | Two roles cannot overwrite the Agent native ID, cross-read baselines or race execution; recovery observes existing attempts before retry; disable new role admission to roll back |
+| **C4 — Shared governed lifecycle; C1 for cutover** | Effect/Turn owner + outer worker adapters: converge duplicated prepare/dispatch/observe/validate/writeback/settle orchestration around existing typed operations and receipts | App/Turn/external worker agree on admission, original result and single debit under partial failure; scheduler effects retain their true host owner; switch callers back only after receipt reconciliation |
+| **C5 — Replan and result authoring boundary; C1 for cutover** | Goal/Vision and interaction owners: expose current facts and typed controller operations; remove ordinary executor obligations to manufacture Core writeback fields in the two-session profile | Fact-first decision preserves default/stride policy differences, all evidence and required validation; invalid proposed writes reject; single-session authoring remains qualified during rollout |
| **C6 — Controller/executor exchange; C2–C5** | Manager/request + host owners: reuse versioned semantic requests and result return; replace schema-constrained executor work with natural-language work/material exchange; keep user interaction available during execution | Complete sources, local autonomy, Core isolation, ordinary result → assessment → feedback → further work without human prompting, actual feedback adoption through ordered revisions, original settlement/fresh continuation and independently accepted outcome; busy, conflict, stop and late-result cases in §9; return new work to qualified single-session profile on rollback |
| **C7 — Benchmark reuse and full-cost attribution; C4/C6** | Benchmark toolkit/execution owner: thin adapters select the same product profiles; consolidate duplicated launch/session settings and track both sessions without changing frozen trials | Native/plain controls unchanged; matched-arm configuration/replay and complete cost coverage; no jobs launched merely by merging helpers |
| **C8 — Product configuration and operational readback; C3/C6** | Existing App/settings/Chat projections: one effective configuration owner, role-aware activity, failure/recovery, proactive evidence-based reports, task-appropriate rich views, feedback/readback, Stop and artifact return | Packaged managed and supported attached heartbeat journeys from §9, including unavailable host, late results, quiet/deduplicated reports, accessible fallback, audience denial and recovery; installed qualification separate; no new packet-format toggle |
@@ -1125,9 +1171,10 @@ model adoption. All-host defaults, other omitted material, trusted Host coverage
writer/reader cutover and §9's outcome/full-cost comparison remain open. Index
overhead participates in the existing full-versus-folded byte guard.
-C1's inventory is part of its usable replacement, not a standalone architecture
-framework. C3/C4/C5 can proceed independently once C1's contract is stable;
-C7 can prepare measurements before C6 but cannot claim two-session outcomes.
+C1's inventory is part of its usable replacement. C3/C4/C5 may build the
+isolated preview against a pinned C1 contract. Changes to that contract require
+renewed preview validation before cutover. C7 can prepare the comparison while
+both lanes are in flight.
Implementation PRs must name the replaced caller, remaining gap, actual tests
and rollback. No full language migration or unrelated manager rewrite is a
prerequisite. No task is complete merely because a new abstraction compiles.
@@ -1197,7 +1244,7 @@ open PRs and canonical work before claiming one.
| Existing task / package | Simplification result | Start condition |
| --- | --- | --- |
| **C3.1 Managed-operation protocol** | Generic handler and session selection are already shared; extend that boundary for roles and audit before removing remaining duplicated callers | Reuse `managed_operation_host.py`; do not reopen the completed extraction, and retain both real Hosts’ native differences |
-| **C3.2 Session-binding callers** | Reuse shared persistence; eliminate caller-side binding reconstruction and private cross-host imports where a cohesive existing operation can replace them | Pair with C3.1 if a separate change would leave only a rename/facade; role/generation expansion waits for stable C1 |
+| **C3.2 Session-binding callers** | Reuse shared persistence; eliminate caller-side binding reconstruction and private cross-host imports where a cohesive existing operation can replace them | Pair with C3.1 if a separate change would leave only a rename/facade; preview may pin C1; role/generation cutover waits for qualified C1 |
| **C4.1 Receipt-to-continuation** | Adopt a qualified typed Turn observation/continuation boundary; retire replaced Python receipt reconstruction and decisions | Keep journal recovery distinct from next-work decisions; integrate C1 and existing recovery fixes |
| **C4.2 Outer-worker adoption** | Consume qualified semantic results instead of reconstructing common retry/continuation policy | C4.1; preserve wake ownership, original receipts and opaque-command uncertainty |
| **C4.3 Settlement-adapter convergence** | Reuse settlement primitives; retire a second step/condition interpreter only where obligations coincide | Candidate: compare Host Todo completion and Turn settlement; coordinate active settlement PRs |
diff --git a/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md b/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md
index 9f638f5242..d5096b832d 100644
--- a/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md
+++ b/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md
@@ -7,8 +7,8 @@
- **交付成熟度：** Proposal；本文不交付新运行时、schema 或默认行为。
- **作者 / 负责人：** LoopX 维护者、控制面与运行时 owner
- **创建日期：** 2026-10-27
-- **最近规范性修订：** 2026-11-06
-- **最新源码核对：** `f91e26d91d3e4e1b28b69f5881a059ea78891082`；旧实验保留各自基线。
+- **最近规范性修订：** 2026-11-09
+- **最新源码核对：** `3edaf9c25a56c9d714b097f2d6fee6ffabbd629d`；旧实验保留各自基线。
- **相关契约：** [Effect interpreter](agent-loop-effect-interpreter-v0.zh-CN.md)、[会话执行模式](agent-session-execution-modes-v0.zh-CN.md)、[语义交接](capable-manager-semantic-handoff-v0.zh-CN.md)、[整体路线图](loopx-overall-roadmap-v0.zh-CN.md)
- **语言镜像：** [English](controller-executor-unified-contract-v0.md)
@@ -139,7 +139,7 @@ flowchart TB
### 当前交付的源码核对
-以下 2026-11-06 核对绑定 main `f91e26d91d3e4e1b28b69f5881a059ea78891082`。
+以下 2026-11-09 核对绑定 main `3edaf9c25a56c9d714b097f2d6fee6ffabbd629d`。
代码中存在机制只证明已有实现边界，不代表双会话用户旅程或收益已经验收。
| 能力 | 源码事实 / 在途工作 | 对本设计的决定 |
@@ -150,7 +150,7 @@ flowchart TB
| 原受众返回 | [`return_delivery.ts`](../../../loopx/control_plane/collaboration/return_delivery.ts) 区分 provider 已写入但无定位符与未写入 | Router 汇总不得重新执行任务来补投递；投递不等于 requester 采用 |
| 受管操作复用 | Codex/DSH 均调用 [`managed_operation_host.py`](../../../loopx/control_plane/turn_driver/managed_operation_host.py) 与 `select_managed_operation_session` | C3.1 的通用 handler 抽取已存在；复用并检查剩余调用方，不重复开重构项目 |
| 双角色绑定 | [`codex_sessions.py`](../../../loopx/control_plane/turn_driver/codex_sessions.py) 按 Goal/Agent/Todo 或 Agent scope 保存 session；尚无本提案的 controller/worker 成对绑定 | C3 需要同一 Agent 的 role/generation 与独立队列、连续性；仅有两个 thread ID 不够 |
-| 统一工作契约 | quota / Turn 活跃格式分支仍在；[#7430](https://github.com/loopx-project/loopx/pull/7430) 是开放的 C1 提案，本次核对头 `3a4f6f64f288ab6c663c829ed5f5670c42d72595` | 与其既有 owner 协同，保留原单会话成果/成本验收；不把 router 多单元交付追加为它的合入条件 |
+| 统一工作契约 | [#7430](https://github.com/loopx-project/loopx/pull/7430) 已合入，随后由 [#8265](https://github.com/loopx-project/loopx/pull/8265) 回退；C1 替换由 [#8266](https://github.com/loopx-project/loopx/pull/8266) 继续。[#8238](https://github.com/loopx-project/loopx/pull/8238) 和 [#8323](https://github.com/loopx-project/loopx/pull/8323) 已分别改善结算读取和叙事读取。[#8304](https://github.com/loopx-project/loopx/pull/8304) 是分阶段重规划的独立候选。 | 继续将可独立验收的修复合入主干。切换 profile 前，按原 quota 单会话验收替换路径。此前传输或写回测量只适用于各自测过的路径。 |
| 通用 Host transport | [#7568](https://github.com/loopx-project/loopx/pull/7568) 仍为 Draft，本次核对头 `e3a3c06524fae99519a72d751a16a5e8dd6f9a5d` | 可作为适配器候选；bounded 调用不证明双向长期 session/异步控制，不把 OAR 或全 Host 重写设为先决条件 |
旧的逐字段审计与实验保留原版本，位于下面的技术附录；其中历史 Draft/测试记录不能
@@ -799,35 +799,63 @@ backoff 继续归当前 scheduler owner。本文不引入模型空轮询或新
```mermaid
flowchart TB
- C1[C1/C2：单会话契约与上下文收敛] --> U[C3-C6：一个真实双会话单元]
- F[已有请求 / 受管操作 / Session owners] --> U
+ C1[C1/C2：以原 quota 验收统一单会话] --> E[C7：同条件成果与完整成本对照]
+ F[已有请求 / 受管操作 / Session owners] --> U[C3-C6：一个隔离 Host 上的双会话预览]
U --> I[C6/C8：自主工作循环，同时对话、纠偏、Stop]
I --> R[C6/C8：Router 对接两个独立单元]
- I --> E[C7：单元成果与完整成本对照]
- R --> E
+ I --> E
+ R --> M[独立验证多单元协同]
E --> Q[C8/C9：范围化采用与旧路径退役]
F -.独立正确性修复与调用方精简可先交付.-> C1
```
-这是实际依赖，不是要求每个 Agent 从第一格开始的固定队列。C1 保持原验收范围；
-其共享 owner 前置、现有请求/恢复修复和删除已被替代代码可独立交付。新 profile 的
-实际切换依赖它消费的统一契约已合格，但不等所有宿主、全部语言迁移或所有 benchmark
-完成。认领依据整体 roadmap、当前用户成果、瓶颈和在途 owner；表中编号不是 PR 数。
+C1/C2 验收与单 Host 隔离预览并行推进。预览可在可丢弃的范围内使用固定版本的 C1
+契约。生产 profile 切换仍以 C1 验收为前提。单元对照等统一单会话通过验收、首个双会话
+工作闭环跑通即可启动。Router 和多单元对照各自提供证据。沿用现有 C 任务分工，可独立
+验收的修复单独评审。下表给出交付依赖和退出证据。
| 既有 C 任务下的切片 | 完整可审查交付 / 必须采用的旧 owner | 退出证据与具体精简 |
| --- | --- | --- |
-| **C1/C2 — 完成现有契约切换** | 沿 #7430 的来源、consumer 与恢复工作收敛，不另写 router packet | 原单会话 quota 对照、字段/条款保真、真实 caller、off 与恢复；逐 caller 删除旧格式 writer，保留具名历史 decoder |
+| **C1/C2 — 完成现有契约切换** | 收敛 #8266 的来源、consumer 与恢复工作，复用既有契约 | 原单会话 quota 对照、字段/条款保真、真实 caller、off 与恢复；逐 caller 删除旧格式 writer，保留具名历史 decoder |
| **C3/C4 — 一个绑定单元** | 在现有 session/managed-operation owner 中实现同一 Agent 两角色；先资格化一个支持隔离、观察和中断的 Host | 两个真实会话、独立上下文基线；并发/重启不覆盖绑定，旧 generation 不可写；删除被实际替换的单槽位假设，不另建双会话 runtime |
| **C5/C6.1/C8 — 主循环与执行中交互** | 真实 worker 长操作返回 handle；controller 消费用户与 worker 输入；复用 request revision、queue reservation、Stop 与 readback | 无用户唤醒也能普通结果→评估/反馈→后续执行；原结算与新鲜接续正确；worker 未完成时已有实质答复；纠偏改变后续产物；注意力/安全插队与防饿死场景通过；取消无需等模型；替换该 caller 的整项阻塞等待与重复状态分类，交付同一个 App 旅程 |
| **C6.2/C8 — Router 接两个单元** | 管家使用既有多接收方、原受众返回与选择绑定；直达 controller 复用同一修订入口 | A 忙时 B 可独立推进；部分拒绝不重跑 A；router 重启后结果回原受众，跨单元权限和预算不扩大；删除重复汇总/路由分支 |
| **C7/C8 — 比较与小范围采用** | 相同 workload/Host 下比较原单会话、统一单会话、双会话；额外单列多单元协调组 | 同预算成果与完整成本、响应/纠偏/停止时延、人工介入；小任务负例与模型/Host 边界公开。打包 App/CLI 与受支持 Lark 失败恢复分别验证 |
| **C9 — 点名退役与默认决策** | 每条替换随 caller、历史读取窗口和回退证据删旧代码，采用决定按合格 workload/profile 范围作出 | 无第二套决策/任务/预算账本；新准入关闭后原 attempt 可对账；保留合格单会话，不以少代码或多会话数量证明收益 |
-建议最近的实施决策是：先对齐 C1 在途交付与当前 session owner，选择一个真正支持
-worker 非阻塞观察、工具隔离和 Stop 的 Host，形成“一个自主单元循环 + 执行中交互”的可审查
-切片；管家已有多接收方链在其后采用。相关绑定/恢复精简若能直接改善现有 caller，可
-先合入，不要求等 C1 整体完成。无需先做全局 scheduler、通用消息中间件、无限层级 Agent
-或第三套状态存储。尚未完成的双向 Host 能力应补在实际 adapter，不把接口统一当作完成。
+
+
+### Controller 推进节奏
+
+1. **先做真实 Host 上的闭环，与 C1 并行。** 运行时和 Turn owner 优先资格化 Codex
+ App Server。已有受管操作适配器能观察经认证的 `turn/start`，Chat host 已能发送
+ `turn/interrupt`。验证派工返回后仍可观察同一份持久化 worker attempt，覆盖断线
+ 重连和实际中断。缺口补在既有适配器。首个可运行切片限定一个 Agent、两个原生会话
+ 和一个有界任务，各会话独立维护上下文基线。Controller 是唯一面向 Core 的模型侧
+ 客户端，读取 Progressive 与 Delta 状态，负责准入、验收、结算。Worker 收到任务、
+ 范围内的普通工具与产物引用，经既有请求链返回发现和产物。用两份轨迹验证 Worker 的
+ Core 调用被拒绝，同时范围内的普通工具可用。退出条件是 Worker 结果触发基于证据的判断和下一段有用工作，后者使用新鲜准入，
+ 原 attempt 仅结算一次，Controller 不可用时仍可经 Host/Core Stop。重启、重复或迟到
+ 的结果先按原 attempt 对账，再决定是否重派。
+2. **让用户在执行中真正用起来。** 请求与 App owner 通过现有 Chat 和产物投影交付
+ 一条真实旅程。用户询问运行中的任务，在 Worker 完成前收到基于持久事实的实质答复，
+ 查看有版本的产物，再提出纠偏。到安全边界应用 revision，检查下一份产物实际采用
+ 纠偏。正在进行的效果仍在原 attempt 内完成或对账。主动汇报由有意义的新证据或需要
+ 用户决定的事项触发，按 revision 和受众去重。沿用现有调度等待、Stop 和产品回读。
+ 这条旅程跑通后，由管家沿同一请求和返回链接入第二个独立单元。验收 A 忙时 B 仍能
+ 推进，且单元拒绝或重启后，两个单元各自的范围和原受众都能恢复。
+3. **实测拆会话的净收益。** Benchmark 与验收 owner 先把统一单会话同原 quota 对照
+ 做完。再在固定任务验收、可比预算及匹配的 Host/模型设置下，对照两个单会话组与原生
+ 双会话组。分别记录 Controller 和 Worker 输入输出、调用、工具、重试、汇报、总耗时
+ 与人工介入，计入 Controller 或 Reviewer 要求返工一轮的成本。分开测答复、纠偏采用、
+ 实际停止和任务完成时延。开跑前冻结验收 oracle 与成本/时延阈值。保留可能被协调开销
+ 主导的简单任务。沿用 Stride 和 Yardstick，检验延长执行段、改标尺或停止是否改善后续
+ 独立验收的成果。用后续验收核对本地标尺是否有用，保留错排与长期停滞的例子。可学习的
+ Meta Model 属于后续研究假设。默认采用和旧路径退役继续遵循第 9 节与 C9 的分范围证据，
+ 并验证回退到合格单会话后仍能对账原 attempt。
+
+沿用已有的 request、session、Turn 和产品 owner。每个 PR 记录被替换的调用方、新的可观察
+结果、验证证据和回退办法。预览沿用同一份权威状态和用户入口。
@@ -865,9 +893,9 @@ worker 非阻塞观察、工具隔离和 Stop 的 Host，形成“一个自主
| --- | --- | --- |
| **C1 — 统一契约；新 profile 切换依赖** | Interaction/work-context + quota/Turn owner：盘点字段/指令、capture/视图/读取证据映射及分版本双层配置；捕获同一 schema，迁移普通 quota/Turn producer 与 thin renderer | 单会话真实入口保留必要信息、动作绑定和一次结算，并完成第 9 节 quota 基线效果/完整成本对照；保留显式 off，cutover 合格前保留绑定版本的 reader |
| **C2 — 一个上下文交付管线；C1** | Context owner + host observer：组合跨 Host Progressive、独立资格化 Delta、同 capture 详情/恢复和保守未读发现，替换分阶段候选交付及重复 packet 分支 | 未变未读约束抵达下一 Turn 实际工作；按完整成本验收无 Hook reader、精确证据/连续性和四种分层组合；full 回退不重新准入；经既有 owner 回退编码/配置 |
-| **C3 — 会话绑定与原生生命周期；C1** | Session/runtime owner：扩展 role/generation，复用 native create/resume/observe/interrupt 和有序队列 | 两角色不覆盖 Agent native ID、不借用基线、不竞态执行；重试前观察既有 attempt；关闭新角色准入即可开始回退 |
-| **C4 — 共享受治理生命周期；C1** | Effect/Turn owner + 外层 worker adapter：围绕既有 typed 操作与回执合并重复 prepare/dispatch/observe/validate/writeback/settle 编排 | App/Turn/external worker 在部分失败下对准入、原结果与一次扣额一致；scheduler effect 保留真实 host owner；核对回执后才切回旧调用方 |
-| **C5 — Replan 与结果编写边界；C1** | Goal/Vision 与 interaction owner：提供当前事实和 typed controller 操作，移除双会话 profile 中普通 executor 编造 Core 写回字段的义务 | 先看事实保留 default/stride policy 区别、全部证据与必要验证；非法写回拒绝；rollout 期间单会话编写仍合格 |
+| **C3 — 会话绑定与原生生命周期；切换依赖 C1** | Session/runtime owner：扩展 role/generation，复用 native create/resume/observe/interrupt 和有序队列 | 两角色不覆盖 Agent native ID、不借用基线、不竞态执行；重试前观察既有 attempt；关闭新角色准入即可开始回退 |
+| **C4 — 共享受治理生命周期；切换依赖 C1** | Effect/Turn owner + 外层 worker adapter：围绕既有 typed 操作与回执合并重复 prepare/dispatch/observe/validate/writeback/settle 编排 | App/Turn/external worker 在部分失败下对准入、原结果与一次扣额一致；scheduler effect 保留真实 host owner；核对回执后才切回旧调用方 |
+| **C5 — Replan 与结果编写边界；切换依赖 C1** | Goal/Vision 与 interaction owner：提供当前事实和 typed controller 操作，移除双会话 profile 中普通 executor 编造 Core 写回字段的义务 | 先看事实保留 default/stride policy 区别、全部证据与必要验证；非法写回拒绝；rollout 期间单会话编写仍合格 |
| **C6 — Controller/executor 交流；C2–C5** | Manager/request + host owner：复用版本化语义请求与结果返回，用自然语言工作/材料交流替换 executor 的 schema 约束任务；执行时用户仍可交互 | 完整来源、局部自主、Core 隔离、无需人工催促的普通结果→评估→反馈→后续执行、有序 revision 下的反馈实际采用、原结算/新鲜接续与独立验收结果；第 9 节忙碌、冲突、Stop 和迟到结果场景；回退后新工作使用合格单会话 profile |
| **C7 — Benchmark 复用与完整成本归因；C4/C6** | Benchmark toolkit/execution owner：薄 adapter 选择相同产品 profile；合并重复 launch/session 配置，跟踪两个会话，不改冻结 trial | Native/plain 对照不变，可比组配置/replay 与完整成本覆盖；合并 helper 不启动 job |
| **C8 — 产品配置与运行 readback；C3/C6** | 既有 App/settings/Chat 投影：同一 effective configuration owner，按角色展示 activity、失败/恢复、主动循证汇报、适合任务的丰富展现、反馈/readback、Stop 和产物返回 | 第 9 节打包 managed 及受支持 attached heartbeat 旅程，包括 host 不可用、迟到结果、安静/去重汇报、可访问降级、受众拒绝和恢复；安装资格另验；不新增 packet 格式开关 |
@@ -913,8 +941,8 @@ retention。选读不会清除覆盖未知状态或新增第二账本。当前
其他省略材料、可信 Host 覆盖、writer/reader 切换及第9节成果/完整成本对照仍开放。
索引开销计入原完整/折叠字节守卫。
-C1 盘点是可用替换的一部分，不单独建设架构框架。C1 契约稳定后，C3/C4/C5 可以独立
-推进；C7 可以提前准备测量，但不能提前宣称双会话成果。实现 PR 列明替换的调用方、剩余
+C1 盘点是可用替换的一部分。C3/C4/C5 可按固定版本的 C1 契约实现隔离预览。
+契约有变更时，切换前需要重验预览。C7 可以在两条线推进期间准备对照。实现 PR 列明替换的调用方、剩余
缺口、实际测试与回退。完整语言迁移或无关 manager 重写不是前置条件；新抽象能编译
不能算任务完成。
@@ -968,7 +996,7 @@ C1/C2 组合/capture/最终输入工作与这些精简同属一个候选前沿
| 既有任务 / 工作包 | 精简结果 | 启动条件 |
| --- | --- | --- |
| **C3.1 受管操作协议** | 通用 handler 与 session 选择已共享；新角色沿该边界扩展，核对后才删除剩余重复调用方 | 复用 `managed_operation_host.py`；不能再次把已完成抽取列为待办，保留两个真实 Host 的原生差异 |
-| **C3.2 会话绑定调用方** | 复用共享持久化；以既有完整操作替换调用方重建 binding 和跨 Host 私有导入 | 若独立拆开只剩改名/facade，则与 C3.1 一起交付；role/generation 扩展等待 C1 稳定 |
+| **C3.2 会话绑定调用方** | 复用共享持久化；以既有完整操作替换调用方重建 binding 和跨 Host 私有导入 | 若独立拆开只剩改名/facade，则与 C3.1 一起交付；预览可固定 C1 版本；role/generation 切换等 C1 验收 |
| **C4.1 回执到继续决策** | 采用已合格 typed Turn 观察/继续边界；退役被替代的 Python 回执重建与决策 | 保留 journal 恢复与下一工作决策的区别；整合 C1 及已有恢复修复 |
| **C4.2 外层 worker 采用** | 消费已合格语义结果，移除自行重建的公共重试/继续策略 | C4.1；保留唤醒归属、原回执和不透明命令的不确定性 |
| **C4.3 结算 adapter 收敛** | 复用 settlement 原语；仅在义务一致时删除第二套步骤/条件解释器 | 候选：比较 Host Todo completion 与 Turn settlement，并对齐在途结算 PR |