fix(validation): align prompt budgets and Goal source recovery

docs/development/testing-and-quality.md

@@ -1305,6 +1305,46 @@ spending or provider permissions and does not rewrite original failures as passe
 仅修正已超过的展示回归预算。时钟与生成回执元数据不作逐字节一致声明；每 Todo
 和固定增长、重复度、生产性能诊断及执行配额边界不变，原失败仍按失败记录保留。
 
+The cumulative-outcome guidance added 523 authored characters on the same
+`contract-fixture` / `worker-a` prompt workload, comparing
+`74dd179c44ba06dfa3c621d978c41dcd9a2f46f3` with
+`b9e60c59f3c367a63755d97f4595d9c2eef91947`. It preserves original requirements,
+inline acceptance reuse, direct-user refinement, milestone evidence review,
+batch writeback, unmet-outcome replanning and root stop/budget authority. These
+are distinct consumer decisions, not redundant copies. All four visible-Goal
+hosts and all four heartbeat modes retain the same line counts. For example,
+the Codex Goal body grew from 3,152 to 3,675 characters; the full heartbeat's
+normalized body grew from 12,285 to 12,808, exceeding its old 12,640 allowance.
+That original failure remains a failure.
+
+The matched current workload also covers zero and 320-character authored profile
+scopes with Reward Memory both disabled and enabled. The following values are
+normalized body characters, not JSON size, UTF-8 bytes, model tokens or transport
+limits. Only the exceeded mode budgets change; generated instructions and command
+routes remain byte-identical across this budget repair.
+
+| Mode / memory | No scope / 320-character scope | Previous / qualified ceiling |
+| --- | --- | --- |
+| Full / disabled | 12,388 / 12,688 | 12,000 / 12,800 |
+| Full / enabled | 12,808 / 13,108 | 12,640 / 13,440 |
+| Compact / disabled | 7,231 / 7,531 | 7,200 / 7,600 |
+| Compact / enabled | 7,486 / 7,786 | 7,840 / 8,240 |
+| Brief / disabled | 4,985 / 5,285 | 4,800 / 5,400 |
+| Brief / enabled | 5,240 / 5,540 | 5,440 / 6,040 |
+
+The disabled base budgets leave 112 / 69 / 115 characters above the measured
+full / compact / brief maximum. The fixed, feature-scoped 640-character Reward
+Memory allowance remains unchanged. Thin budgets, envelope limits, normalization,
+and the visible Goal host's existing 4,000-character limit remain unchanged; its
+obsolete 3,300-character test expectation now follows that existing host limit.
+Exact-limit and one-character-over cases still distinguish valid and overflowing
+bodies. No prompt clause, execution permission, quota, experiment threshold or
+model-compliance requirement changes.
+
+累计成果指引在相同输入上增加 523 字符；本次保留完整指令，仅按默认及 320 字符
+profile、memory 关闭和开启的实测结果调整受影响的展示回归预算。原超限失败保留，
+正文与命令逐字节不变；thin、信封、Goal 宿主硬边界及执行/费用权限不变。
+
 Classify the limit by its owning contract before deciding how to repair a
 failure. This applies to output size/structure and latency regression budgets;
 it does not grant execution quota, spending, or provider authority.

examples/control_plane/monitor-scheduler-contract-smoke.py

@@ -196,7 +196,8 @@ def guard_for(
 def assert_scheduler_timestamp_parser_is_shared_and_utc_normalized() -> None:
     assert scheduler_time.parse_timestamp is runtime_time.parse_timestamp
     assert monitor_todo_module.parse_monitor_timestamp is scheduler_time.parse_scheduler_timestamp
-    assert scheduler_hint_module._parse_monitor_timestamp("2026-01-01T08:00:00+08:00").isoformat() == (
+    assert scheduler_hint_module.parse_timestamp is runtime_time.parse_timestamp
+    assert scheduler_hint_module.parse_timestamp("2026-01-01T08:00:00+08:00").isoformat() == (
         "2026-01-01T00:00:00+00:00"
     )
     assert monitor_todo_module.parse_monitor_timestamp(" 2026-01-01T00:00:00Z ").isoformat() == (

loopx/control_plane/heartbeat/budget.py

@@ -10,11 +10,12 @@
 # Keep useful admission and authority instructions readable; do not abbreviate
 # them solely to fit a historical character ceiling.
 INTERFACE_BUDGET_CHARS = {
-    "full": 12_000,
-    # Matched scoped prompt: 7,286 -> 7,809 including Reward Memory.
-    # Default outcome intake/review preserves earlier continuation clauses.
-    "compact": 7_200,
-    "brief": 4_800,
+    # Complete outcome intake/review adds 523 authored characters. Matched
+    # no-memory bodies with the supported 320-character profile scope measure
+    # 12,688 / 7,531 / 5,285; preserve the instructions and bound their growth.
+    "full": 12_800,
+    "compact": 7_600,
+    "brief": 5_400,
     # Matched public CLI fixture: 3,306 -> 3,829 normalized body chars.
     # The same supported 320-char scope reaches 4,118, leaving 82 chars
     # above the complete outcome, authority, continuation and settlement rules.

tests/control_plane/test_fallback_wait_admission.py

@@ -457,6 +457,7 @@ def test_real_provider_cli_uses_one_snapshot_including_archived_dependency(
     before = read_canonical_todos_if_promoted(
         runtime_root=runtime_root, goal_id=GOAL_ID,
     )
+    goal_source = state_file.read_bytes()
     if display == "missing":
         state_file.unlink()
     else:
@@ -471,12 +472,33 @@ def read_once(**kwargs: object) -> list[dict]:
         return snapshot
 
     monkeypatch.setattr(fallback_source, "read_fallback_source_snapshot", read_once)
-    assert cli_main(args) == 0
+    code = cli_main(args)
     result = json.loads(capsys.readouterr().out)
+    # Canonical Todos survive display loss; they do not replace the Goal's
+    # intent and stop conditions. A missing Goal source must still deny work.
+    assert code == (1 if display == "missing" else 0), result
+    if display == "missing":
+        assert result["state"] == "blocked_health"
+        assert result["should_run"] is False
+        assert result["normal_delivery_allowed"] is False
+        assert result["interaction_contract"]["agent_channel"]["delivery_allowed"] is False
     assert "fallback_gaps" not in result["goal_frontier_projection"]
     assert snapshots == [len(rows)]
     after = read_canonical_todos_if_promoted(
         runtime_root=runtime_root, goal_id=GOAL_ID,
     )
     assert before == after
     assert (state_file.read_bytes() if state_file.exists() else None) == saved_display
+
+    if display == "missing":
+        state_file.write_bytes(goal_source)
+        snapshots.clear()
+        assert cli_main(args) == 0
+        recovered = json.loads(capsys.readouterr().out)
+        assert recovered["status_health_ok"] is True
+        assert "fallback_gaps" not in recovered["goal_frontier_projection"]
+        assert snapshots == [len(rows)]
+        assert read_canonical_todos_if_promoted(
+            runtime_root=runtime_root, goal_id=GOAL_ID,
+        ) == before
+        assert state_file.read_bytes() == goal_source

tests/control_plane/test_goal_prompt_dispatch.py

@@ -37,7 +37,10 @@ def test_goal_prompt_has_one_live_execution_entry(host: str) -> None:
     assert "notification" in body
     assert "no work/spend" in body
     assert "No permission asks in a trusted session" not in body
-    assert len(body) < 3300
+    # The native host already owns a 4,000-character limit. Keep the complete
+    # outcome/continuation clauses within it, rather than a stale second cap.
+    assert len(body) < 4000
+    assert packet["interface_budget"]["within_budget"]
 
 
 def test_codex_wait_rule_is_not_exported_to_other_goal_hosts() -> None:

tests/control_plane/test_heartbeat_prompt_support.py

@@ -69,13 +69,17 @@ def test_interface_budget_uses_visible_goal_mode() -> None:
     assert budget["within_budget"] is True
 
 
-@pytest.mark.parametrize("mode,limit", [("thin", 4200), ("visible_goal", 4000)])
+@pytest.mark.parametrize("mode,limit", [
+    ("full", 12800), ("compact", 7600), ("brief", 5400),
+    ("thin", 4200), ("visible_goal", 4000),
+])
 def test_prompt_body_limit_remains_independent_of_json_envelope(mode: str, limit: int) -> None:
     for size in (limit, limit + 1):
         budget = build_interface_budget(
             task_body="x" * size,
             goal_id="fixture-goal",
             active_state="fixture-state",
+            **({mode: True} if mode != "visible_goal" else {}),
             native_goal_host=mode == "visible_goal",
         )
         assert budget["max_chars"] == limit
@@ -302,19 +306,27 @@ def test_brief_diagnostics_keep_only_the_selected_prompt_command() -> None:
 
 @pytest.mark.parametrize(
     ("mode", "base_budget"),
-    [("full", 12000), ("compact", 7200), ("brief", 4800), ("thin", 4200)],
+    [("full", 12800), ("compact", 7600), ("brief", 5400), ("thin", 4200)],
 )
+@pytest.mark.parametrize("scope_chars", [0, 320])
 def test_reward_memory_prompt_headroom_is_fixed_and_feature_scoped(
-    mode: str, base_budget: int
+    mode: str, base_budget: int, scope_chars: int
 ) -> None:
+    profile = {"scope_summary": "x" * scope_chars} if scope_chars else None
     enabled = build_heartbeat_prompt(
         goal_id="reward-memory-budget-fixture",
+        agent_id="worker-a",
+        registered_agents=["worker-a"],
+        agent_profile=profile,
         runtime_profile="codex_app_heartbeat",
         **{mode: True},
         reward_memory_enabled=True,
     )
     disabled = build_heartbeat_prompt(
         goal_id="reward-memory-budget-fixture",
+        agent_id="worker-a",
+        registered_agents=["worker-a"],
+        agent_profile=profile,
         runtime_profile="codex_app_heartbeat",
         **{mode: True},
         reward_memory_enabled=False,
@@ -329,6 +341,8 @@ def test_reward_memory_prompt_headroom_is_fixed_and_feature_scoped(
     assert "--reward-memory-reflection-json" not in disabled["task_body"]
     assert disabled["interface_budget"]["reward_memory_headroom_chars"] == 0
     assert disabled["interface_budget"]["max_chars"] == base_budget
+    assert enabled["interface_budget"]["within_budget"]
+    assert disabled["interface_budget"]["within_budget"]
 
 
 @pytest.mark.parametrize("mode", ["full", "compact", "brief", "thin"])