From 4d71def8764d1b4782e7c3dc948ba953ee949243 Mon Sep 17 00:00:00 2001
From: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Date: Mon, 2 Nov 2026 08:13:32 +0530
Subject: [PATCH] docs(context): separate progressive delivery, delta and
 unread coverage

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
---
 ...controller-executor-unified-contract-v0.md | 186 +++++++++++++++---
 ...ller-executor-unified-contract-v0.zh-CN.md | 146 ++++++++++++--
 .../rfcs/loopx-overall-roadmap-v0.md          |   5 +-
 .../rfcs/loopx-overall-roadmap-v0.zh-CN.md    |   6 +-
 docs/reference/required-work-context.md       |  16 ++
 5 files changed, 317 insertions(+), 42 deletions(-)

diff --git a/docs/architecture/rfcs/controller-executor-unified-contract-v0.md b/docs/architecture/rfcs/controller-executor-unified-contract-v0.md
index 668aa91b4d..9f7deee01c 100644
--- a/docs/architecture/rfcs/controller-executor-unified-contract-v0.md
+++ b/docs/architecture/rfcs/controller-executor-unified-contract-v0.md
@@ -5,7 +5,7 @@
 - **Delivery maturity:** Proposal; no new runtime, schema or default is shipped by this document.
 - **Authors / owners:** LoopX maintainers; control-plane and runtime owners
 - **Created:** 2026-10-27
-- **Last normative revision:** 2026-10-29
+- **Last normative revision:** 2026-11-02
 - **Implementation baseline:** `fe2b8dcbcb998647edb4bafb51932988bd7fdaa6`
 - **Related contracts:** [Effect interpreter](agent-loop-effect-interpreter-v0.md), [Session execution modes](agent-session-execution-modes-v0.md), [Semantic handoff](capable-manager-semantic-handoff-v0.md), [Overall roadmap](loopx-overall-roadmap-v0.md)
 - **Language mirror:** [中文版](controller-executor-unified-contract-v0.zh-CN.md)
@@ -40,9 +40,11 @@ evidence belongs in a dated ledger when an implementation first produces it.
    and questions. It neither consumes a second Core packet view nor authors
    quota, Vision, lease or settlement fields. A small machine carrier records
    routing and causality outside the task prose.
-4. Full-first delivery, exact differential context and automatic full recovery
-   are capabilities of the single contract. Controller and executor sessions
-   have independent continuity evidence; one cannot borrow the other's baseline.
+4. Save complete context, then compose two independent delivery layers:
+   **Progressive by default across hosts**, and **Delta automatically only on
+   qualified hosts**. Keep unread material discoverable from the current capture.
+   Controller and executor have separate continuity evidence and cannot borrow
+   each other's baseline. Full recovery remains available.
 5. Unification first qualifies the existing single-session path. Two-session
    execution remains opt-in until matched outcome and complete-cost evidence
    justifies adoption. This RFC launches no benchmark or privileged operation.
@@ -454,20 +456,140 @@ its existing independent claim/lease/handoff contract.
 ### Differential context
 
 Reuse the existing context-delivery owner and immutable capture mechanism.
-Deliver complete context first. Send exact registered-subtree deltas only with
-proven complete delivery and retained context in the exact consumer session,
-role, epoch, schema and source capture. Preserve deletion, array order, null,
-empty values and complete strings. Unknown fields remain fully delivered until
-their reuse semantics are registered; send full if delta plus metadata is larger.
+The target has two orthogonal layers; neither creates another semantic producer:
+
+- **Layer 1 — Progressive:** default model-facing delivery across LoopX hosts,
+  including ordinary CLI, MCP/HTTP and external workers without Session Hooks.
+  Keep the current Goal, applicable cumulative acceptance, failures/unknowns,
+  authority, stop conditions and outstanding read/settlement obligations inline.
+  Fold heavy history, source bodies and review evidence only through the existing
+  typed composition owner, with exact current-capture read routes and explicit
+  before-dependent-work obligations. Unknown relevance/schema keeps the complete
+  necessary material. This is a delivery default, not permission to collect or
+  persist additional data. A caller without an authorized, usable reader receives
+  complete inline context; a local file path is not a working remote read route.
+  If hard Host limits prevent both routes, expose unavailable context and hold
+  dependent work.
+- **Layer 2 — Delta:** an exact encoding of the composed instance, automatically
+  selected only with qualified consumer/session, role, epoch, schema and source
+  binding. Progressive can use full encoding; a complete inline instance can use
+  Delta. Qualify both combinations as well as Progressive plus Delta and neither.
+  A host without qualified continuity uses current full encoding of Layer 1,
+  without losing Progressive or requiring a native session to be invented.
+
+Distinguish two existing reuse claims. **`captured_file`** compares verified,
+compatible immutable saved artifacts; exact reconstruction does not require the
+model to have read the old file, reached EOF or retained its contents. **Retained
+model-input reuse** may omit previously delivered text only with trusted complete
+delivery and retention evidence for that exact consumer binding. A saved file,
+tool-output receipt or model self-acknowledgement cannot establish that evidence.
+Session Hooks observe their supported boundary; they grant no new authority.
+Preserve deletion, array order, null, empty values, original numeric values and
+complete strings. Unknown fields stay complete until reuse semantics are
+registered. Publish the current complete recovery source before an optional view
+or delta, verify reconstruction, and choose full when Delta plus its metadata is
+not smaller. Layer 1 likewise compares its final serialized UTF-8 view, read
+guidance and index with the same capture's complete alternative; use the smaller
+valid delivery, never trim mandatory meaning to meet a size budget.
 
 Current authority, admission, cancellation, unresolved-read, settlement and
 scheduler facts stay fresh and inline even if unchanged. A warm transport never
-relaxes the underlying instructions. Missing/out-of-order deltas, truncation,
-compaction, corrupt or unknown baselines select full recovery from the same
-capture automatically, without another admission/debit. Execution still checks
-current source validity and authority; recovering an old capture cannot revive
-cancelled work. The executor's task conversation is a separate consumer of
-semantic material, not a relabeled delta of the controller's Core packet.
+relaxes the underlying instructions. Missing/out-of-order deltas, corrupt or
+unknown baselines select current full encoding/recovery. Truncated or missing
+reads recover the necessary range from the same capture. Compaction invalidates
+retention for the next work Turn's new baseline epoch; it neither invalidates the
+existing Turn nor forces an old-packet prefetch or immediate full reread. Preserve
+the original admission, recovery reference and once-only settlement/debit.
+Execution still checks current source validity and authority; recovering an old
+capture cannot revive cancelled work. The executor's task conversation consumes
+semantic material separately, not a relabeled controller Core-packet delta.
+
+#### Unread material across Turns
+
+Current immutable captures already support exact selected reads. The missing
+design is explicit discovery of unread material across deliveries, not a second
+reader or a requirement to consume an entire baseline. Extend the existing
+context/readback owner and native `session.json` projection; use its equivalent
+consumer binding on other hosts. Distinguish publication, model-visible delivery
+coverage, retention and semantic adoption/accepted outcomes.
+
+`confirmed_read_sections` is a proposed coverage projection;
+`consumed_pointers`, if retained as a name, must derive from that same owner,
+not become a second ledger or imply comprehension. Bind evidence to the exact
+source/capture digest, revision, consumer/session role, epoch, schema and selected
+pointer/range. Confirm coverage only from trusted Host observation of the actual
+model-visible result. Calling `--select`, file existence, reader EOF, a successful
+tool log or a self-ACK alone is insufficient. Partial/truncated/missing output
+stays unconfirmed; selecting a parent/index cannot confirm hidden descendants.
+Without such an observer, coverage is unknown and discovery stays conservative.
+This coverage never becomes a new full-read gate for `captured_file` Delta.
+
+Every warm delivery carries an **`unread_context_index`** (proposed name) for
+eligible non-inline material whose current content is unconfirmed or changed,
+including unchanged text omitted by Delta. Include exact current pointers,
+source revisions/digests and required-read status, rather than inferred relevance
+from a summary. A confirmed range applies only to its observed version; changed
+content, reordered arrays or ambiguous mappings require current rebinding and
+conservative discovery. Confirmed delivery never proves retained input or adoption.
+
+Each item resolves independently through existing `quota context-read --select`
+against the **current complete immutable `projection.json`**, with its exact
+capture SHA, without the previous packet, baseline file, model memory or patch
+chain. A derived `required-context.json` or wire view retains the existing owner's
+explicit mapping to the canonical source; roots and digests are not interchangeable.
+Historical exact-version lookup remains a separate, version-pinned artifact/read
+contract, not an invented path alias or a reason to silently use stale facts.
+If still-required earlier material is absent from the new projection, its owner
+must carry it forward or expose its current authorized source/read obligation.
+Legitimate expiry, revocation or removal must remain explicit, with unavailable
+required material holding dependent work; never silently mark it read or retain
+forbidden raw data. External materials keep their own source-consumption contract.
+
+#### Configuration and migration
+
+The following is proposed behavior, not a change to today's Codex-scoped
+`context_delivery` on/off interface. Evolve the existing typed configuration owner
+to express the two layer decisions; C1 maps exact names and versions before
+implementation. Do not add a parallel settings store or packet-format toggle.
+
+| Configuration / caller | Migration and effective behavior |
+| --- | --- |
+| No saved preference, model-facing caller | Target Layer 1 default applies after that caller's reader/fallback and cost qualification; Layer 2 is auto only for a qualified continuity host, otherwise full encoding. Today's ordinary CLI/other-host full behavior remains until that rollout qualifies. |
+| Explicit invocation/environment off | Preserve current precedence and full/raw delivery for that invocation, with no optional codec/coverage-ledger dependency; do not rewrite the saved preference. |
+| Existing persisted off | Preserve the complete off path and its original read/recovery obligations; never convert it to Progressive or Delta through an absent-preference migration. |
+| Existing on, supported host | Preserve the qualified native file/recovery semantics while mapping to Layer 1 plus qualified Layer 2 auto; no full-model-read prerequisite is introduced. |
+| Existing explicit on, unsupported host | Preserve the current validation error during compatibility. A versioned caller rollout may expose supported Layer 1 after qualification; do not silently reinterpret an unsupported request. |
+| New independently configured layers | Honor each layer independently, including Progressive off with qualified Delta auto. Explicit Delta off preserves Progressive; unsupported auto falls back to current full encoding. |
+| Internal raw machine consumers | Preserve their explicit `--context-delivery off` contracts; do not replace machine JSON with a model-facing file reference or mutate preferences. |
+
+Freeze recorded versions, experimental configurations and historical receipts.
+Qualify default expansion as a behavior change on real callers, including explicit
+off isolation and failure/recovery; a merged design alone changes no defaults.
+
+#### Delivery acceptance
+
+Reuse C1/C2's real-entry and §9 comparisons, including these decisive cases:
+
+| Case | Required observation |
+| --- | --- |
+| Ordinary no-hook CLI and supported MCP/HTTP/worker routes | Layer 1 works through the actual authorized reader or complete inline fallback; no dangling local-only references or invented native epoch. |
+| Unchanged unread tail becomes decisive next Turn | Warm Delta may omit its bytes, but the current index exposes its full source and actual subsequent selection/work obeys the recovered constraint. Index visibility alone is not success. |
+| Changed/unread bodies, reordered arrays, unknown fields or scope | Rebind to the current source; preserve applicable cross-Agent obligations and unknown-scope complete fallback. |
+| Partial pages, lost/truncated tool output, EOF without a Host witness | Do not confirm unseen bytes or hidden descendants; recover missing ranges, conservatively index unknown coverage, and keep file Delta usable. |
+| Compaction, role/session/schema/epoch change | Invalidate incompatible retention/reuse; recover current facts without replaying the original admission, effects or debit, and without old-packet prefetch. |
+| Revoked source, missing reader or legitimately removed material | Respect the current permission/source owner; expose the loss and hold dependent work or use authorized complete fallback, without stale-data disclosure. |
+| Full is cheaper; off and legacy configuration | Choose valid full delivery, preserve explicit off and frozen versions, and observe both source identity and raw machine-consumer parity. |
+
+The primary stored-body reduction is **`1 - V/F`**: `F` is the complete capture's
+actual UTF-8 file bytes and `V` the selected view body file's actual bytes from
+that same capture; saved bytes are `F - V`. Bind both artifacts and their digests,
+and report wire/index overhead separately rather than changing that denominator.
+The delivery size guards above still include their actual presentation overhead.
+A net-benefit claim also counts all later reads/recovery, host/controller/executor calls and latency,
+actual tokenizer/cached/output usage, human attention and accepted outcomes.
+Preserve unfavorable cases and frozen budgets. A smaller packet alone proves
+neither lower token cost nor better outcomes; §9's original quota single-session
+comparison stays primary, and two-session costs remain a separate comparison.
 
 ### Candidate context by decision stage
 
@@ -502,9 +624,10 @@ and cursor. Distinct revisions of one Todo stay distinct. Missing, truncated,
 unsupported or changed detail holds dependent work and uses that capture's full
 recovery; a fresh guard is not a detail reader. One read can deliver several bodies;
 verified bodies need not be repeated within a supported retained session. Reading
-an index never acknowledges hidden bodies. Delta baselines contain only material
-actually delivered to that consumer: newly required detail must supply its text
-even if the machine already holds it. Context loss recovers the required model
+an index never acknowledges hidden bodies. Retained-model reuse covers only text
+actually delivered and retained for that consumer; saved-file Delta has its
+separate artifact proof above. Newly required detail must supply its text even
+if the machine already holds it. Context loss recovers the required model
 artifact, widening to the full source when its scope is unknown. Historical captures
 keep their original obligations. Read receipts prove coverage, not comprehension,
 retention, fresh authority or acceptance.
@@ -621,6 +744,9 @@ an immutable product constraint.
 | Work context, required reads and settlement | Keep their existing `interaction_contract` paths and owners. Existing root-relative references retain their meaning; any intentional relocation requires explicit reference and reader migration. Never rewrite prose or command strings by pattern. |
 | Host-operation binding | Compose from the actual caller execution context. Validate consistency with source authority; reject conflicting bindings rather than choosing whichever representation is convenient. |
 | Content and transport integrity | Commit the entire semantic instance independently of the former compact action digest. Preserve exact capture-byte verification and original settlement identity as separate checks; changing a transport encoding does not create a new effect. |
+| Complete capture and Progressive view | Keep canonical `projection.json` distinct from its derived `required-context.json`/wire view; inventory exact root, revision, digest and pointer mappings. Save complete recovery before presentation; reference only through an authorized usable reader. |
+| Saved-file reuse, delivery coverage and retention | Inventory each existing typed owner and its evidence boundary separately. Proposed `confirmed_read_sections`/derived `consumed_pointers` describe observed coverage only; neither is artifact-reconstruction proof, comprehension or a full-read gate for file Delta. |
+| Unread discovery | Map the proposed `unread_context_index` to current complete-capture pointers, revisions and source/read obligations, including unchanged unconfirmed material. Rebind changed/unknown mappings; retain explicit unavailable states and permission checks. |
 | Historical receipts and readers | Decode the recorded version for outstanding work. A temporary internal adapter may serve an existing effect interpreter, but must not become a second emitted contract or a compact replacement for the model's required input. |
 
 A synthetic layout probe used real isolated File/SQLite quota captures and the
@@ -635,8 +761,9 @@ remains possible if its mapping and consumers justify the migration cost.
 
 Therefore C1/C2 must explicitly version the context surface and its fresh/reuse
 paths with the wire transition. Do not relabel an old surface or inherit its
-baseline by Turn identity. The first delivery after transition is full; reuse
-requires a verified compatible retained baseline. Qualification includes fields
+baseline by Turn identity. The transition first saves a complete compatible
+source; the model-facing view may already be Progressive. Reuse requires the
+appropriate saved-artifact or retained-model proof above. Qualification includes fields
 outside the old action projection, missing baselines, session/epoch changes and
 same-capture recovery. This resolves a concrete layout risk; shared writer and
 final-consumer replacement remain the next implementation, not another layout
@@ -1021,8 +1148,8 @@ are stable design references, not claims that a canonical Todo is complete.
 
 | Task / dependency | Owner and concrete replacement | Decisive exit / rollback |
 | --- | --- | --- |
-| **C1 — Unified contract; first** | Interaction/work-context + quota/Turn owners: inventory fields and instruction clauses, capture one schema, migrate actual ordinary quota/Turn producers and thin renderer | Single-session real-entry parity with necessary information, action binding and once-only settlement, plus the quota-baseline effectiveness/full-cost comparison in §9; retain version-pinned readers until cutover qualifies |
-| **C2 — One context-delivery pipeline; C1** | Context owner + host observers: absorb full/delta/detail/recovery into the canonical contract; replace candidate delivery by decision stage; remove packet-format branches and duplicate context copies | Required detail precedes actual selection/work; normal/replan/resume preserve cross-Agent constraints and exact role/session continuity at measured complete cost; full fallback without a new admission; rollback encoding to full |
+| **C1 — Unified contract; first** | Interaction/work-context + quota/Turn owners: inventory fields/instruction clauses, capture/view/read-evidence mappings and versioned two-layer configuration; capture one schema and migrate ordinary quota/Turn producers and thin renderer | Single-session real-entry parity with necessary information, action binding and once-only settlement, plus §9's quota-baseline effectiveness/full-cost comparison; preserve explicit off and version-pinned readers until cutover qualifies |
+| **C2 — One context-delivery pipeline; C1** | Context owner + host observers: compose cross-host Progressive, independent qualified Delta, same-capture detail/recovery and conservative unread discovery; replace staged candidate delivery and duplicate packet branches | Unchanged unread constraints reach actual next-Turn work; qualify no-hook readers, exact evidence/continuity and all four layer combinations at complete cost; full fallback without a new admission; rollback encoding/configuration through the existing owner |
 | **C3 — Session binding and native lifecycle; C1** | Session/runtime owner: extend existing binding for role/generation; reuse native create/resume/observe/interrupt and ordered queues | Two roles cannot overwrite the Agent native ID, cross-read baselines or race execution; recovery observes existing attempts before retry; disable new role admission to roll back |
 | **C4 — Shared governed lifecycle; C1** | Effect/Turn owner + outer worker adapters: converge duplicated prepare/dispatch/observe/validate/writeback/settle orchestration around existing typed operations and receipts | App/Turn/external worker agree on admission, original result and single debit under partial failure; scheduler effects retain their true host owner; switch callers back only after receipt reconciliation |
 | **C5 — Replan and result authoring boundary; C1** | Goal/Vision and interaction owners: expose current facts and typed controller operations; remove ordinary executor obligations to manufacture Core writeback fields in the two-session profile | Fact-first decision preserves default/stride policy differences, all evidence and required validation; invalid proposed writes reject; single-session authoring remains qualified during rollout |
@@ -1031,6 +1158,21 @@ are stable design references, not claims that a canonical Todo is complete.
 | **C8 — Product configuration and operational readback; C3/C6** | Existing App/settings/Chat projections: one effective configuration owner, role-aware activity, failure/recovery, proactive evidence-based reports, task-appropriate rich views, feedback/readback, Stop and artifact return | Packaged managed and supported attached heartbeat journeys from §9, including unavailable host, late results, quiet/deduplicated reports, accessible fallback, audience denial and recovery; installed qualification separate; no new packet-format toggle |
 | **C9 — Retire old paths and qualify adoption; C1–C8** | Contract/runtime maintainers: remove superseded producers, format switches, duplicated prompts and tests; update protocols, guides and RFC delivery facts | Caller/field/decoder retirement inventory, historical replay and rollback evidence; App + benchmark acceptance and matched benefit before any default promotion |
 
+Evolve this delivery boundary through those existing tasks, not another roadmap:
+
+1. **C1:** map canonical capture, derived view, reader references, coverage and
+   retention to existing owners; version both layer decisions and the legacy
+   migration matrix above. Keep unresolved mappings explicit before caller cutover.
+2. **C2:** replace actual no-hook and native callers with the common Progressive
+   composition/reader and conservative unread index. Add trusted Host coverage
+   observations where available; unknown coverage must still work. Then qualify
+   independent Delta auto/full recovery on supported hosts, with §5's negative
+   cases and the original quota single-session/full-cost comparison.
+3. **C9:** retire conflated switches, duplicate delivery assumptions and superseded
+   readers only after their consumers, off path, historical replay and local
+   rollback qualify. Reconcile existing C1/C2 tasks/PRs and preserve unpassed size
+   or adoption gates; do not put this design into a frozen experimental treatment.
+
 The existing native context entry now supports a bounded C2 precursor: complete
 captures remain on disk, the normal response exposes file navigation, and exact
 file deltas do not require model retention. After compaction the next work Turn
diff --git a/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md b/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md
index 89e87e0578..0248a02fcd 100644
--- a/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md
+++ b/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md
@@ -5,7 +5,7 @@
 - **交付成熟度：** Proposal；本文不交付新运行时、schema 或默认行为。
 - **作者 / 负责人：** LoopX 维护者、控制面与运行时 owner
 - **创建日期：** 2026-10-27
-- **最近规范性修订：** 2026-10-29
+- **最近规范性修订：** 2026-11-02
 - **实现基线：** `fe2b8dcbcb998647edb4bafb51932988bd7fdaa6`
 - **相关契约：** [Effect interpreter](agent-loop-effect-interpreter-v0.zh-CN.md)、[会话执行模式](agent-session-execution-modes-v0.zh-CN.md)、[语义交接](capable-manager-semantic-handoff-v0.zh-CN.md)、[整体路线图](loopx-overall-roadmap-v0.zh-CN.md)
 - **语言镜像：** [English](controller-executor-unified-contract-v0.md)
@@ -32,8 +32,9 @@
 3. Executor 接收自然语言任务对话、原始材料和普通宿主工具，返回发现、产物、证据与问题。
    它不消费第二份 Core packet 视图，不编写 quota、Vision、lease 或 settlement 字段。
    任务正文之外的小型机器载体负责记录路由与因果关系。
-4. 完整首包、精确差分上下文与自动全量恢复属于统一契约的能力。Controller 与 executor
-   分别证明各自上下文连续性，不能借用对方的基线。
+4. 先保存完整上下文，再组合两个独立交付层：**跨 Host 默认 Progressive**，以及
+   **仅在已资格化 Host 自动使用 Delta**。未读材料仍可从当前 capture 发现。
+   Controller 与 executor 分别证明连续性，不能借用对方的基线；完整恢复始终可用。
 5. 先在现有单会话路径验收契约统一；双会话保持 opt-in，直至可比成果与完整成本证据支持
    采用。本文不启动 benchmark 或特权操作。
 6. Executor 工作期间，controller 仍应面向用户保持可交互：回答问题、主动解释有意义
@@ -349,16 +350,111 @@ role 不是第二个并发业务 executor。Peer 或并行执行仍需既有独
 
 ### 差分上下文
 
-复用现有 context-delivery owner 与不可变 capture 机制。先完整交付，只有在精确消费
-session、role、epoch、schema、source capture 下证明已完整送达并保留上下文，才能
-发送注册子树的精确 delta。保留删除、数组顺序、null、空值和完整字符串。未知字段在
-注册复用语义前每次完整发送；delta 加元数据更大时发送 full。
+复用现有 context-delivery owner 与不可变 capture 机制。目标包含两个正交层，
+二者都不创建第二个语义 producer：
+
+- **Layer 1 — Progressive：** 面向模型的交付默认跨 LoopX Host 生效，包括没有
+  Session Hooks 的普通 CLI、MCP/HTTP 和外部 worker。当前 Goal、适用的累计验收、
+  失败/未知、权限、停止条件和未履行读取/结算义务保持内联。历史、来源正文和评审证据
+  等重材料，只能经既有 typed composition owner 折叠，提供精确的当前 capture 读取
+  路线，并明确依赖工作前的读取义务。相关性/schema 未知时保留完整必要材料。这是
+  交付默认值，不授予额外采集或持久化权限。调用方没有可用且获授权的 reader 时交付
+  完整内联上下文；本地文件路径不是可用的远端读取路线。Host 硬限制使两种路线都不可用
+  时，明确上下文不可用并阻止依赖工作。
+- **Layer 2 — Delta：** 对组合后实例进行精确编码，仅在 consumer/session、role、
+  epoch、schema 与来源绑定已资格化的 Host 自动选择。Progressive 可以用 full 编码，
+  完整内联实例也可以用 Delta；连同 Progressive + Delta、二者都关闭，共同验收四种
+  组合。Host 没有合格连续性时，对 Layer 1 使用当前 full 编码，不丢失 Progressive，
+  也不虚构 native session。
+
+区分两种已有复用主张。**`captured_file`** 比较已验证且兼容的不可变落盘产物；
+精确重建不要求模型先读旧文件、到达 EOF 或保留其内容。**已保留模型输入的复用**
+只有在精确 consumer binding 下存在可信完整送达和 retention 证据时，才能省略此前
+交付的正文。文件落盘、工具输出回执和模型自我确认不能建立这种证据。Session Hooks
+只观察受支持边界，不授予新权限。保留删除、数组顺序、null、空值、原始数值和完整
+字符串；未知字段在注册复用语义前保持完整。先发布当前完整恢复源，再交付可选视图或
+差分；验证重建，Delta 加元数据不更小时选 full。Layer 1 也将最终序列化 UTF-8 视图、
+读取说明和索引，与同次 capture 的完整替代交付对比；选择更小的有效交付，不能为满足
+体积预算而裁掉必需含义。
 
 当前权限、准入、取消、未完成必读、结算与 scheduler 事实即使未变也新鲜内联交付，温态
-传输不能减弱正文义务。缺失/乱序 delta、截断、压缩、损坏或未知基线自动从同次 capture
-全量恢复，不重新准入/扣额。执行仍检查来源有效性与当前权限；恢复旧 capture 不能复活
-已取消工作。Executor 任务对话独立消费语义材料，不是 controller Core packet 换名后的
-delta。
+传输不能减弱正文义务。Delta 缺失/乱序、基线损坏或未知时，选择当前 full 编码/恢复；
+读取截断或丢失时，从同次 capture 恢复必要范围。上下文压缩使下个工作 Turn 在新基线
+epoch 中的 retention 失效；它不使现有 Turn 失效，也不要求预读旧包或立即全量重读。
+保留原准入、恢复引用和一次结算/扣额。执行仍检查来源有效性与当前权限；恢复旧 capture
+不能复活已取消工作。Executor 任务对话独立消费语义材料，不是 controller Core packet
+换名后的 delta。
+
+#### 跨 Turn 未读材料
+
+当前不可变 capture 已支持精确选读。待补设计是跨交付显式发现未读材料，不是第二个
+reader，也不是先读完整基线。扩展既有 context/readback owner 与原生 `session.json`
+投影；其他 Host 使用相应 consumer binding。区分产物发布、模型可见交付覆盖、
+retention，以及语义采用/验收成果。
+
+`confirmed_read_sections` 是提议的覆盖投影；若保留 `consumed_pointers` 这个名字，
+它必须从同一 owner 派生，不能成为第二本台账或暗示理解。证据绑定精确 source/capture
+digest、revision、consumer/session role、epoch、schema 和选读 pointer/range。
+仅凭可信 Host 对实际模型可见结果的观察确认覆盖。调用 `--select`、文件存在、reader
+EOF、成功工具日志或模型自我 ACK 均不足。部分/截断/丢失输出保持未确认；选择父节点/
+索引不能确认隐藏子节点。没有此类 observer 时覆盖为未知，发现保持保守。这种覆盖
+绝不能成为 `captured_file` Delta 的新增全量读取门。
+
+每次 warm 交付携带 **`unread_context_index`**（提议名称）：列出符合交付范围、未内联且
+当前内容未确认或已变更的材料，包括被 Delta 省略的未变正文。给出精确当前指针、来源
+版本/digest 和必读状态，不能凭摘要推断相关性。已确认范围只适用于观察到的版本；
+内容变化、数组重排或映射不明须重新绑定当前来源并保守发现。确认送达不证明输入已保留
+或语义已采用。
+
+每项通过既有 `quota context-read --select`，绑定精确 capture SHA，从**当前完整不可变
+`projection.json`** 独立读取，不依赖上一包、基线文件、模型记忆或 patch 链。派生的
+`required-context.json` 或 wire 视图保留既有 owner 对规范来源的显式映射，不能混用
+根路径和 digest。历史精确版本回查仍属于单独绑定版本的产物/读取契约，不能虚构路径
+别名或借此静默使用旧事实。前轮材料仍属必需却不在新 projection 中时，由原 owner
+带入当前 capture，或暴露当前获授权的来源/读取义务。合法过期、撤权或移除须显式保留；
+必需材料不可用则阻止依赖工作，不能静默记作已读或永久保留禁止保存的原始数据。
+外部材料仍遵循自己的来源消费契约。
+
+#### 配置与迁移
+
+下表是提议行为，不改变当前限定 Codex 的 `context_delivery` on/off 接口。演进既有
+typed 配置 owner，表达两个层的决定；由 C1 在实现前映射精确名称和版本，不新增平行
+配置存储或 packet 格式开关。
+
+| 配置 / 调用方 | 迁移与生效行为 |
+| --- | --- |
+| 面向模型、没有持久偏好的调用方 | 该调用方 reader/回退及成本验收后使用目标 Layer 1 默认值；Layer 2 仅在连续性已资格化的 Host auto，否则 full 编码。在 rollout 合格前，普通 CLI/其他 Host 仍保持当前 full 行为。 |
+| 显式调用参数/环境 off | 保留当前优先级，本次调用 full/raw 交付，不依赖可选 codec/覆盖台账，不改写持久偏好。 |
+| 已持久化 off | 保留完整 off 路径及原读取/恢复义务，不能借“无偏好”迁移把它变为 Progressive 或 Delta。 |
+| 已有 on、受支持 Host | 映射为 Layer 1 + 已资格化 Layer 2 auto 时，保留合格的原生文件/恢复语义，不增加模型全量读取前置。 |
+| 已有显式 on、不受支持 Host | 兼容期间保留当前校验错误；按版本发布且调用方验收后才可提供受支持的 Layer 1，不能静默重释不受支持请求。 |
+| 新的独立分层配置 | 独立遵守各层，包括 Progressive off + 合格 Delta auto；显式 Delta off 仍保留 Progressive；不受支持的 auto 回退当前 full 编码。 |
+| 内部 raw machine 消费者 | 保留显式 `--context-delivery off` 契约，不把机器 JSON 换为模型文件引用，不修改偏好。 |
+
+冻结已记录版本、实验配置与历史回执。扩大默认值属于行为变更，须验证真实调用方、
+显式 off 隔离与失败/恢复；设计合并本身不改变默认值。
+
+#### 交付验收
+
+复用 C1/C2 真实入口和第 9 节对照，覆盖以下决定性案例：
+
+| 案例 | 必须观察到的结果 |
+| --- | --- |
+| 无 Hook 普通 CLI 及受支持 MCP/HTTP/worker 路线 | Layer 1 经真实获授权 reader 或完整内联回退可用，不留下仅本地可用的悬空引用，不虚构 native epoch。 |
+| 未变的未读末尾在下一 Turn 成为决定性约束 | Warm Delta 可省略其字节，但当前索引须暴露完整来源，后续实际选择/工作遵守恢复的约束；仅索引可见不能算成功。 |
+| 变化/未读正文、数组重排、未知字段或 scope | 绑定当前来源，保留适用跨 Agent 义务及未知范围的完整回退。 |
+| 部分页、工具输出丢失/截断、EOF 但无 Host 见证 | 不确认不可见字节或隐藏子节点；恢复缺失范围，未知覆盖保守进入索引，文件 Delta 仍可用。 |
+| 压缩、role/session/schema/epoch 变化 | 使不兼容 retention/复用失效；恢复当前事实，不重放原准入、effect 或扣额，不预读旧包。 |
+| 来源撤权、reader 不可用、材料合法移除 | 遵守当前权限/来源 owner，暴露丢失并阻止依赖工作，或使用获授权完整回退，不泄露旧数据。 |
+| Full 更便宜、off 与旧配置 | 选择有效 full 交付，保留显式 off 和冻结版本，并观察来源身份及 raw machine 消费者行为一致。 |
+
+正文文件缩减率主指标为 **`1 - V/F`**：`F` 是完整 capture 的实际 UTF-8 文件字节，
+`V` 是同次 capture 所选视图正文文件的实际字节，节省字节为 `F - V`。绑定两个产物及
+digest，wire/索引开销单独报告，不能改换分母；上文交付体积保护仍计入实际呈现开销。
+净收益主张还须计入后续全部读取/恢复、Host/controller/executor 调用与延迟、实际
+tokenizer/cached/output 用量、人工注意力和验收成果。保留不利案例和冻结预算。
+包更小本身不能证明 token 成本更低或成果更好；第 9 节原 quota 单会话对照仍为主，
+双会话成本单独比较。
 
 ### 按决策阶段交付候选上下文
 
@@ -385,8 +481,9 @@ Agent 的 outcomes、让其他成果可发现是有用的；共享要求、依
 来源、完整性、覆盖与游标。同 Todo 不同版本仍分开。详情缺失、截断、不受支持或变化时
 阻止依赖工作，使用该 capture 的完整恢复；fresh guard 不能充当详情 reader。一次
 读取可交付多个正文，受支持的保留会话内无需重复交付已验证正文。读索引不等于确认隐藏
-正文已读。Delta 基线只包含实际交付给该消费者的材料；新成为必需的详情必须提供正文，
-不能因为机器已经存有它而省略。上下文丢失恢复必需模型产物，范围未知时扩大到完整来源。
+正文已读。已保留模型输入的复用仅覆盖实际送达且保留于该消费者的正文；文件 Delta
+遵循上文独立产物证明。新成为必需的详情必须提供正文，不能因为机器已经存有它而省略。
+上下文丢失恢复必需模型产物，范围未知时扩大到完整来源。
 历史 capture 保留原义务。读取回执证明覆盖，不证明理解、保留、新鲜权限或验收。
 
 单会话 Agent 消费同一管线。Controller/executor profile 中，由 controller 比较备选项
@@ -472,6 +569,9 @@ binding、减少重复指令、有界交付与可靠详情/恢复。Full/delta/d
 | Work context、必读与结算 | 保留既有 `interaction_contract` 路径与 owner。现有根相对引用保持含义；有意搬迁须显式迁移引用与 reader，不能按模式改写正文或命令字符串。 |
 | Host-operation binding | 从真实调用方 execution context 组合，验证与源权限一致；binding 冲突时拒绝，不能选择方便的表示。 |
 | 内容与传输完整性 | 对整个语义实例作完整性承诺，独立于原紧凑 action digest。精确 capture 字节校验和原结算身份仍分别检查；更换传输编码不创建新 effect。 |
+| 完整 capture 与 Progressive 视图 | 区分规范 `projection.json` 与派生 `required-context.json`/wire 视图，盘点精确根路径、版本、digest 和指针映射；先保存完整恢复源，再交付呈现，仅通过可用且获授权 reader 引用。 |
+| 文件复用、交付覆盖与 retention | 分别盘点既有 typed owner 及证据边界。提议的 `confirmed_read_sections`/派生 `consumed_pointers` 只表示观察到的覆盖，不是产物重建证明、理解或文件 Delta 全读前置。 |
+| 未读发现 | 将提议 `unread_context_index` 映射到当前完整 capture 的指针、版本和来源/读取义务，包括未变的未确认材料；变化/未知映射重新绑定，保留显式不可用状态和权限检查。 |
 | 历史回执与 reader | 未结工作按记录版本解码。临时内部 adapter 可以服务既有效果解释器，但不能成为第二份输出契约，也不能用紧凑副本替代模型必需输入。 |
 
 一个合成布局探针使用真实隔离 File/SQLite quota capture 和既有 TypeScript context
@@ -482,8 +582,9 @@ epoch 变化均要求 full。Retention 为合成声明；这衡量 codec 行为
 一般性的嵌套布局。若映射与消费者收益足以抵偿迁移成本，仍可设计嵌套布局。
 
 因此 C1/C2 须随 wire 迁移显式版本化 context surface 及其 fresh/reuse 路径，不能
-改名冒用旧 surface 或凭 Turn 身份继承基线。迁移后的首次交付使用 full；只有验证了
-兼容的 retained baseline 才可复用。资格覆盖旧 action 投影之外的字段、基线缺失、
+改名冒用旧 surface 或凭 Turn 身份继承基线。迁移时先保存兼容的完整来源，面向模型
+视图可以已使用 Progressive；复用须具备上文相应的文件产物或 retained-model 证明。
+资格覆盖旧 action 投影之外的字段、基线缺失、
 session/epoch 变化和同 capture 恢复。这里消除了具体布局风险；下一步仍是共享 writer
 与最终消费者替换，不能再建设一个布局框架，也不能据此宣布 C1 交付。
 
@@ -768,8 +869,8 @@ backoff 继续归当前 scheduler owner。本文不引入模型空轮询或新
 
 | 任务 / 依赖 | Owner 与实际替换内容 | 决定性退出 / 回退 |
 | --- | --- | --- |
-| **C1 — 统一契约；首先** | Interaction/work-context + quota/Turn owner：盘点字段与指令条款，捕获同一 schema，迁移真实普通 quota/Turn producer 与 thin renderer | 单会话真实入口保留必要信息、动作绑定和一次结算，并完成第 9 节相对 quota 基线的效果/完整成本对照；cutover 合格前保留绑定版本的 reader |
-| **C2 — 一个上下文交付管线；C1** | Context owner + host observer：将 full/delta/detail/recovery 纳入 canonical 契约，按决策阶段替换候选交付，删除 packet 格式分支和重复上下文副本 | 必需详情先于实际选择/工作；正常/replan/resume 保留跨 Agent 约束与精确 role/session 连续性，并测量完整成本；full 回退不重新准入；编码可回退 full |
+| **C1 — 统一契约；首先** | Interaction/work-context + quota/Turn owner：盘点字段/指令、capture/视图/读取证据映射及分版本双层配置；捕获同一 schema，迁移普通 quota/Turn producer 与 thin renderer | 单会话真实入口保留必要信息、动作绑定和一次结算，并完成第 9 节 quota 基线效果/完整成本对照；保留显式 off，cutover 合格前保留绑定版本的 reader |
+| **C2 — 一个上下文交付管线；C1** | Context owner + host observer：组合跨 Host Progressive、独立资格化 Delta、同 capture 详情/恢复和保守未读发现，替换分阶段候选交付及重复 packet 分支 | 未变未读约束抵达下一 Turn 实际工作；按完整成本验收无 Hook reader、精确证据/连续性和四种分层组合；full 回退不重新准入；经既有 owner 回退编码/配置 |
 | **C3 — 会话绑定与原生生命周期；C1** | Session/runtime owner：扩展 role/generation，复用 native create/resume/observe/interrupt 和有序队列 | 两角色不覆盖 Agent native ID、不借用基线、不竞态执行；重试前观察既有 attempt；关闭新角色准入即可开始回退 |
 | **C4 — 共享受治理生命周期；C1** | Effect/Turn owner + 外层 worker adapter：围绕既有 typed 操作与回执合并重复 prepare/dispatch/observe/validate/writeback/settle 编排 | App/Turn/external worker 在部分失败下对准入、原结果与一次扣额一致；scheduler effect 保留真实 host owner；核对回执后才切回旧调用方 |
 | **C5 — Replan 与结果编写边界；C1** | Goal/Vision 与 interaction owner：提供当前事实和 typed controller 操作，移除双会话 profile 中普通 executor 编造 Core 写回字段的义务 | 先看事实保留 default/stride policy 区别、全部证据与必要验证；非法写回拒绝；rollout 期间单会话编写仍合格 |
@@ -778,6 +879,17 @@ backoff 继续归当前 scheduler owner。本文不引入模型空轮询或新
 | **C8 — 产品配置与运行 readback；C3/C6** | 既有 App/settings/Chat 投影：同一 effective configuration owner，按角色展示 activity、失败/恢复、主动循证汇报、适合任务的丰富展现、反馈/readback、Stop 和产物返回 | 第 9 节打包 managed 及受支持 attached heartbeat 旅程，包括 host 不可用、迟到结果、安静/去重汇报、可访问降级、受众拒绝和恢复；安装资格另验；不新增 packet 格式开关 |
 | **C9 — 旧路径退役与采用资格；C1–C8** | Contract/runtime 维护者：删除被替代 producer、格式开关、重复提示/测试，更新 protocol、guide 和 RFC 交付事实 | 调用方/字段/decoder 退役清单、历史 replay 与回退证据；App + benchmark 验收及可比收益成立后再决定默认提升 |
 
+沿既有任务演进这条交付边界，不另立 roadmap：
+
+1. **C1：** 把规范 capture、派生视图、reader 引用、覆盖与 retention 映射到既有
+   owner，版本化两个层的决定及上表旧配置迁移；调用方切换前明确未决映射。
+2. **C2：** 用共享 Progressive composition/reader 和保守未读索引替换真实无 Hook
+   及原生调用方；可用时增加可信 Host 覆盖观察，没有覆盖证明也须可用。随后验收受支持
+   Host 独立的 Delta auto/full 恢复，覆盖第 5 节负例和原 quota 单会话/完整成本对照。
+3. **C9：** 消费者、off 路径、历史 replay 和局部回退合格后，才退役混合开关、重复交付
+   假设与旧 reader。对齐既有 C1/C2 task/PR，保留未通过的体积或采用 gate；不能把这项
+   设计塞入冻结实验 treatment。
+
 现有原生上下文入口增加一个有界 C2 前置改进：完整捕获保存在磁盘，常规响应提供
 文件导航，精确文件差分不依赖模型保留；压缩后下一个新 Turn 建立新的完整文件基线，不要求立即
 全量重读。必要事实仍须在
diff --git a/docs/architecture/rfcs/loopx-overall-roadmap-v0.md b/docs/architecture/rfcs/loopx-overall-roadmap-v0.md
index 1c56fc7d01..b6102d075f 100644
--- a/docs/architecture/rfcs/loopx-overall-roadmap-v0.md
+++ b/docs/architecture/rfcs/loopx-overall-roadmap-v0.md
@@ -183,7 +183,10 @@ acceptance remain open. Proposed experiments are advice, not execution authority
 
 The [controller/executor RFC](controller-executor-unified-contract-v0.md)
 refines S2/S4/S6/S7/S11: one governed work schema replaces quota/Turn packet
-format choices and incorporates full-first differential context. The optional
+format choices. Its [two-layer delivery design](controller-executor-unified-contract-v0.md#differential-context)
+targets cross-host Progressive by default, independent Delta auto only on
+qualified hosts, and unread-material discovery from the current complete capture;
+explicit off and versioned migration remain protected. The optional
 controller model alone talks to Core; the executor receives natural-language
 work and materials, while existing host/Core owners retain identity, permissions,
 recovery and settlement. Session roles, execution modes, wake sources and
diff --git a/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md b/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md
index b6ef303a57..7f62099f7b 100644
--- a/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md
+++ b/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md
@@ -140,8 +140,10 @@ assessment 中有证据绑定的研究综合分析接入指标 → 汇报 → 
 ### 统一契约与 controller/executor 交付
 
 [Controller/executor RFC](controller-executor-unified-contract-v0.zh-CN.md) 细化
-S2/S4/S6/S7/S11：用一份受治理工作 schema 替代 quota/Turn packet 格式选择，并纳入
-完整首包与差分上下文。可选 controller 模型独自对接 Core，executor 接收自然语言工作
+S2/S4/S6/S7/S11：用一份受治理工作 schema 替代 quota/Turn packet 格式选择。
+[双层交付设计](controller-executor-unified-contract-v0.zh-CN.md#差分上下文)以跨 Host 默认
+Progressive、仅已资格化 Host 独立 Delta auto，以及当前完整 capture 的未读发现为目标；
+保留显式 off 与分版本迁移。可选 controller 模型独自对接 Core，executor 接收自然语言工作
 和材料；身份、权限、恢复、结算仍归既有 host/Core owner。Session role、执行模式、
 唤醒来源和 benchmark 评估组保持正交。这是设计方向，不是已交付行为或成本收益证据。
 
diff --git a/docs/reference/required-work-context.md b/docs/reference/required-work-context.md
index aea9943c75..2074a82ee1 100644
--- a/docs/reference/required-work-context.md
+++ b/docs/reference/required-work-context.md
@@ -11,6 +11,22 @@ read obligations before capture. Recovering delivery from that immutable capture
 does not refresh authority; a legitimate new selection/authority check remains
 distinct from retrying transport.
 
+The RFC's [two-layer delivery design](../architecture/rfcs/controller-executor-unified-contract-v0.md#differential-context)
+proposes host-independent Progressive defaults, independent qualified Delta and
+current-capture discovery of unread material, with an explicit legacy/off
+migration matrix. Those changes are **not shipped by this page**: current defaults
+and `context_delivery` on/off behavior below remain in force. Current selected
+reads already reach the complete capture; calling a reader or reaching EOF alone
+does not prove model-visible delivery, retention or adoption. Native saved-file
+Delta keeps its existing artifact proof without a full-model-read prerequisite.
+
+中文：RFC 的[双层交付设计](../architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md#差分上下文)
+提议跨 Host 默认 Progressive、独立资格化 Delta，以及从当前 capture 发现未读材料，
+并明确旧配置/off 迁移矩阵。这些变更**尚未由本页交付**，下文当前默认值和
+`context_delivery` on/off 行为继续有效。当前选读已能到达完整 capture；调用 reader
+或到达 EOF 本身不证明模型可见交付、retention 或采用。原生文件 Delta 仍按既有产物
+证明复用，不增加模型全量读取前置。
+
 The RFC's [candidate context by decision stage](../architecture/rfcs/controller-executor-unified-contract-v0.md#candidate-context-by-decision-stage)
 proposes complete captured alternatives with discoverable decision facts and
 same-capture batch detail reads. It does not change current read obligations.