fix(context): preserve distinct JSON observations in shared quota views

docs/architecture/rfcs/controller-executor-unified-contract-v0.md

@@ -913,6 +913,15 @@ from local sharing to one call. These are projection-parameter measurements,
 not framed traffic, latency, model billing or the integrated C1 comparison.
 Retain this negative result rather than declaring a net efficiency win.
 
+The compatibility owner also uses one local JSON serialization identity for
+acceptance, Vision-audit and replan-authoring sharing. Python's ordinary value
+equality must not turn distinct booleans/numbers, integer/float representations
+or signed zero into an alias to another observation. Exact copies still share
+one in-response owner, including after key reordering; different facts remain
+complete. This repairs source fidelity without another projection RPC. It does
+not qualify the unified writer, final consumers or original-quota outcome/cost
+benefit.
+
 Repair relocated acceptance aliases at the current compatibility owner without
 that extra transport. Existing aliases must follow only inline owners actually
 moved by the projection, including aliases visited before their owner. Preserve

docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md

@@ -691,6 +691,12 @@ compactor：精确共享、省略和延后读取的信息与失败后果各不
 一次请求。这些是投影参数测量，不是带协议包装的流量、延迟、模型计费或完整 C1 对照。
 保留此负结果，不能宣称净效率收益。
 
+兼容 owner 也为验收、Vision audit 和 replan authoring 共享复用一份本地 JSON 序列化
+身份。不能用 Python 普通值相等，把不同布尔／数值、整数／浮点表示或带符号零替换成
+另一条观测的别名。完全相同的副本仍共享同一响应内的 owner，包括键顺序不同的情况；
+不同事实保留全文。这修复来源保真，不增加投影 RPC；不代表统一 writer、最终消费者
+或相对原 quota 的成果／完整成本收益已经合格。
+
 先在当前兼容 owner 修复被迁移的验收引用，不引入上述额外传输。已有别名只跟随本次
 投影实际迁移的内联 owner，包括先访问别名、后迁移 owner 的情况。保留完整值、原始
 数值类型、carrier 顺序和现有大小判断；不推断任意引用链，不重写已存 capture。

docs/reference/required-work-context.md

@@ -39,6 +39,11 @@ references follow their complete inline owner when that projection relocates it,
 including an owner visited later. Different revisions, types, failures and
 sources stay distinct. This adds no source read or authority, admission or
 settlement change; saved captures retain their original contents.
+Vision-audit and replan-authoring mirrors reuse that local serialization
+identity. Boolean/number values, integer/integral-float representations and
+signed zero remain distinct when their original JSON encodings differ. Key
+order alone does not prevent sharing. This adds no model read or runtime round
+trip; distinct source facts retain their complete instructions.
 Registered Goal state uses the existing writer's strict generated-region
 ownership. When every recognized Todo region is explicitly marked, the source
 adapter delivers **all other text verbatim** in `work_context.sources`: Goal
@@ -590,6 +595,9 @@ all-Goal adoption, actual solver costs or outcome benefit.
 普通 CLI 在同一响应内共享完全相同的验收副本。已有引用跟随本次投影迁移的完整
 内联 owner，包括后访问的 owner；不同修订、类型、失败和来源分别保留。不增加来源
 读取，不改变权限、准入或结算；已存 capture 保留原始内容。
+Vision audit 和 replan authoring 副本复用该本地序列化身份。原始 JSON 编码不同的
+布尔／数值、整数／整值浮点表示及带符号零分别保留；仅键顺序不同仍可共享。不增加
+模型补读或 runtime 往返；不同来源事实保留完整指引。
 Goal Markdown 复用原 writer 对生成区域的严格归属规则：所有已识别 Todo 区域均有
 显式标记时，`work_context.sources` 原样携带区域外的全部文字，保留目标、frontmatter、
 任意章节、注释、历史和末尾停止条件。`excluded_todo_regions` 保留每段的角色、行区间

loopx/control_plane/quota/cli_projection.py

@@ -94,6 +94,16 @@
 )
 
 
+def _json_content_key(value: Any) -> str:
+    """Compare original JSON values for sharing, including types and signed zero.
+
+    This is local serialization IO, not another quota or context-selection rule.
+    Python equality merges booleans with integers and integral floats; those
+    distinct source facts must not borrow each other's in-response owner.
+    """
+    return json.dumps(value, sort_keys=True, ensure_ascii=False, allow_nan=False)
+
+
 def _compact_monitor_poll_interaction_contract(
     contract: Any,
 ) -> dict[str, Any] | None:
@@ -254,10 +264,11 @@ def _reference_inline_replan_authoring(
     steps = plan.get("ordered_steps") if isinstance(plan, dict) else None
     if not isinstance(steps, list):
         return packet
+    authoring_key = _json_content_key(writeback["vision_authoring"])
     index = next(
         (index for index, step in enumerate(steps)
          if isinstance(step, dict) and step.get("kind") == "durable_writeback"
-         and step.get("vision_authoring") == writeback["vision_authoring"]),
+         and _json_content_key(step.get("vision_authoring")) == authoring_key),
         None,
     )
     if index is None:
@@ -304,10 +315,11 @@ def _replace_nested_vision_continuation_audits(
     source_audit: dict[str, Any],
     audit_ref: dict[str, Any],
 ) -> None:
+    source_key = _json_content_key(source_audit)
     frontier = payload.get("goal_frontier_projection")
     if (
         isinstance(frontier, dict)
-        and frontier.get("vision_continuation_audit") == source_audit
+        and _json_content_key(frontier.get("vision_continuation_audit")) == source_key
     ):
         compact_frontier = dict(frontier)
         compact_frontier["vision_continuation_audit"] = dict(audit_ref)
@@ -321,7 +333,7 @@ def _replace_nested_vision_continuation_audits(
         channel = compact_interaction.get(channel_name)
         if (
             not isinstance(channel, dict)
-            or channel.get("vision_continuation_audit") != source_audit
+            or _json_content_key(channel.get("vision_continuation_audit")) != source_key
         ):
             continue
         compact_channel = dict(channel)
@@ -536,9 +548,8 @@ def writable_parent(path: tuple[str | int, ...]) -> dict[str, Any]:
         value = parent.get(field) if isinstance(parent, dict) else None
         if not isinstance(value, dict) or not value or field + "_ref" in parent:
             continue
-        # Python equality conflates True/1 and False/0. Compare JSON types and
-        # the complete content, including revision, scope, failures and sources.
-        encoded = json.dumps(value, sort_keys=True, ensure_ascii=False, allow_nan=False)
+        # Keep complete revision, scope, failures and sources in the identity.
+        encoded = _json_content_key(value)
         reference = carriers.get(encoded)
         own_ref = "$" + "".join(
             f"[{part}]" if isinstance(part, int) else f".{part}" for part in path)

skills/loopx-self-repair/references/repair-patterns.md

@@ -5,6 +5,7 @@ teaches a reusable control-plane lesson.
 
 | Pattern | Symptoms | Evidence To Read | Likely Root | Durable Repair |
 | --- | --- | --- | --- | --- |
+| `same_packet_json_type_alias` | Quota sharing replaces a distinct Vision or authoring observation with a reference because Boolean/number or signed-zero values compare equal in the host language. | Original captured values, projected body/ref, exact scalar types and zero signs, equal-content/key-order controls, actual CLI recovery and unchanged receipt/spend counts. | Language-level value equality was used as lossless JSON identity, while another sharing path already retained original serialized types. | Reuse one local serialization identity at the existing compatibility owner; share only complete equal JSON bodies and retain unique values/instructions. Preserve exact references, source input and existing reader/settlement ownership. Cover ordinary/native File/SQLite reads and digest refusal, and count transport rather than adding a late full-payload RPC. Keep installed/model adoption and whole-C1 benefit separate. |
 | `original_conversation_cli_goal_instance_drift` | `manager-inbox original-conversation` accepts an explicit `--goal-instance-id` but returns success for a stale instance, or follows the currently registered generation instead. | The physical CLI argv, selected registry profile, explicit versus omitted instance, current Goal reference, and real HTTP/source/queue/return readback in disposable File/SQLite state. | The CLI branch dropped the selector before the existing collaboration owner; current-instance inference concealed the missing caller reference. An unsupported source profile is a separate boundary, not proof that forwarding alone enables it. | Validate and forward the explicit Goal reference through the existing owner. Preserve omitted-selector compatibility and keep stale-instance, source/grant and audience checks authoritative. Cover real CLI discovery, request and control, unchanged inferred discovery, stale-instance rejection without queued work, and original recipient/result return; do not promote profiles or infer grants to make a live request pass. |
 | `conversation_inventory_refusal_reason_loss` | A delegation inventory stays partial because an original request is rejected as `initial_delivery_unproved`, but the App shows only a generic unreadable count. | The current authorized source, committed request/route, trusted originating Turn receipt and typed lifecycle refusal; distinguish incomplete scans and unloaded pages. | The IO adapter collapses a typed receipt conflict into a generic exception and omits the row without retaining a diagnosable identity. | Preserve the existing TS refusal and expose bounded diagnostic identities only after source/route agreement is proved and current audience/Goal checks pass. Keep the count partial, brief/work withheld and controls/return rejected; disclose the cause through existing accessible help. Other failures remain unknown. Cover File/SQLite real HTTP, source/scope changes, bounded diagnostics and fresh read after source recovery. Never rewrite live receipts, infer cancellation from another target, remove proof checks or claim the historical conflict is repaired. |
 | `codex_usage_session_rebinding` | Cumulative Codex token usage moves to a different session after another `session_meta`, or replaying the same snapshot loses its recorded duration after repeated metadata. | The explicitly bound synthetic rollout's ordered session ids, first clock, usage snapshot identity, and before/after run-index bytes and aggregate counters. | The usage reader overwrites identity and start time while scanning, allowing later metadata to reinterpret earlier counters. | Require identified metadata before usage, reject conflicting session ids, and retain the first clock for repeated same-id headers. Preserve streaming and the existing booking lock. Cover File/SQLite refusal without an append and repaired same-snapshot zero-delta recovery; never discover another session or rewrite historical usage. |