From 0da763e488dfe6078cce38638bcd550a9d53462b Mon Sep 17 00:00:00 2001
From: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Date: Fri, 16 Oct 2026 23:20:59 +0800
Subject: [PATCH] docs(rfc): reconcile bilingual mirrors and relocate
 historical checkpoints

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
---
 docs/architecture/rfcs/STATUS.md              |   2 +-
 docs/architecture/rfcs/STATUS.zh-CN.md        |   2 +-
 .../agent-loop-effect-interpreter-v0.zh-CN.md |  18 +-
 .../app-conversation-and-async-inbox-v0.md    |  42 +++
 ...p-conversation-and-async-inbox-v0.zh-CN.md |  57 ++++
 .../automatic-execution-admission-v0.zh-CN.md |  12 +
 ...pable-manager-semantic-handoff-v0.zh-CN.md |   5 +
 .../desktop-execution-frontends-v0.zh-CN.md   | 106 ++++++--
 .../rfcs/harness-selection-dsh-pi-v0.zh-CN.md |  31 ++-
 ...2026-09-24-observation-retirement.zh-CN.md |   3 +-
 .../2026-09-27-recovery-audit.md              |   6 +-
 .../2026-09-27-recovery-audit.zh-CN.md        |   1 +
 .../2026-09-28-retirement-cadence.zh-CN.md    |  15 ++
 .../2026-09-22-replan-history-policy.zh-CN.md |  18 ++
 .../2026-10-12-1x-prerequisites.md            | 251 ++++++++++++++++++
 .../2026-10-12-1x-prerequisites.zh-CN.md      | 152 +++++++++++
 .../rfcs/loopx-overall-roadmap-v0.zh-CN.md    |   5 +
 ...ome-memory-utility-attribution-v0.zh-CN.md |   7 +
 ...-goal-authority-state-provider-v0.zh-CN.md |  60 +++++
 .../typescript-control-plane-migration-v0.md  | 248 +----------------
 ...script-control-plane-migration-v0.zh-CN.md | 177 ++----------
 21 files changed, 786 insertions(+), 432 deletions(-)
 create mode 100644 docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.md
 create mode 100644 docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.zh-CN.md

diff --git a/docs/architecture/rfcs/STATUS.md b/docs/architecture/rfcs/STATUS.md
index ab35913d88..1d17fb99c5 100644
--- a/docs/architecture/rfcs/STATUS.md
+++ b/docs/architecture/rfcs/STATUS.md
@@ -65,7 +65,7 @@ appendix may keep dated history, but no dated log heading may precede it.
 | [RFC: Shared Goal Alignment and Governed Amendment Protocol (v0)](shared-goal-alignment-and-governed-amendment-v0.md) | Accepted | none | [2 entries](ledger/shared-goal-alignment-and-governed-amendment-v0/) |
 | [RFC: LoopX Shared Control-Plane Authority and Pluggable State Providers (v0)](shared-goal-authority-state-provider-v0.md) | Accepted | none | [24 entries](ledger/shared-goal-authority-state-provider-v0/) |
 | [RFC: Single-Owner Local Daemon (v0)](single-owner-local-daemon-v0.md) | Accepted | none | — |
-| [RFC: TypeScript Control-Plane Migration Direction v0](typescript-control-plane-migration-v0.md) | Accepted | none | [14 entries](ledger/typescript-control-plane-migration-v0/) |
+| [RFC: TypeScript Control-Plane Migration Direction v0](typescript-control-plane-migration-v0.md) | Accepted | none | [15 entries](ledger/typescript-control-plane-migration-v0/) |
 
 ## Superseded (1)
 
diff --git a/docs/architecture/rfcs/STATUS.zh-CN.md b/docs/architecture/rfcs/STATUS.zh-CN.md
index 223877626c..73458f5fa7 100644
--- a/docs/architecture/rfcs/STATUS.zh-CN.md
+++ b/docs/architecture/rfcs/STATUS.zh-CN.md
@@ -62,7 +62,7 @@
 | [RFC：共享 Goal 对齐与受治理 Amendment 协议（v0）](shared-goal-alignment-and-governed-amendment-v0.zh-CN.md) | 已接受 | 无 | [2 条](ledger/shared-goal-alignment-and-governed-amendment-v0/) |
 | [RFC：LoopX 共享控制面权威与可插拔状态 Provider（v0）](shared-goal-authority-state-provider-v0.zh-CN.md) | 已接受 | 无 | [24 条](ledger/shared-goal-authority-state-provider-v0/) |
 | [RFC: Single-Owner Local Daemon (v0)](single-owner-local-daemon-v0.md) | 已接受 | none | — |
-| [RFC：LoopX 控制面 TypeScript 渐进迁移方向 v0](typescript-control-plane-migration-v0.zh-CN.md) | 已接受 | 无 | [14 条](ledger/typescript-control-plane-migration-v0/) |
+| [RFC：LoopX 控制面 TypeScript 渐进迁移方向 v0](typescript-control-plane-migration-v0.zh-CN.md) | 已接受 | 无 | [15 条](ledger/typescript-control-plane-migration-v0/) |
 
 ## 已被替代 (1)
 
diff --git a/docs/architecture/rfcs/agent-loop-effect-interpreter-v0.zh-CN.md b/docs/architecture/rfcs/agent-loop-effect-interpreter-v0.zh-CN.md
index f2adf31376..5c22b8b466 100644
--- a/docs/architecture/rfcs/agent-loop-effect-interpreter-v0.zh-CN.md
+++ b/docs/architecture/rfcs/agent-loop-effect-interpreter-v0.zh-CN.md
@@ -335,9 +335,9 @@ envelope 投影，Codex CLI 保持关闭隔离；这不代表安装态 heartbeat
 |---|---|---|
 | Goal/Agent/Todo 身份 | quota 选择及回执；envelope actor、selected Todo 和签名结算身份 | 捕获身份与写入时校验仍必要；展示身份不授予执行权 |
 | 完整要求 | Agent channel 权威 work context 与剩余必读；有效 Todo、验收及 scoped User 义务，完整 Goal 保留渐进式全文读取 | 注册 reader 在两种传输中满足当前任务读取；来源失败会阻止依赖它的交付，真实模型采用和打包宿主旅程仍待验收 |
-| 能力拒绝 | 既有 capability_gate_v0；短包保留原样 required/missing 与源中历史字段 | 修复事实遗漏，不改变就绪策略或能力开启 |
+| 能力拒绝 | 既有 quota `capability_gate_v0`；短包保留精确 `required`/`missing` 数组与源中历史字段 | 修复事实遗漏，不改变就绪策略或能力开启 |
 | 选择／claim／lease | selected Todo、action portfolio 及当前所属事务 | 短包归属不是新鲜 lease；保留捕获源并在所属写入入口复核 |
-| replan／Goal 收尾 | replan action packet、contract capsule 和 vision audit | 完整证据仍走有权限的详情；Todo 完成不证明 Goal 完成 |
+| replan／Goal 收尾 | replan action packet 与既有 TS capsule 保留完整、有序 audit 步骤/指导、当前 judge 及证据与非证明条件 | 同一捕获的 File/SQLite 决策验证条款保留与签名突变；完整证据仍走有权限的详情。宿主/模型采用仍开放；Todo 完成不证明 Goal 完成 |
 | 结算／scheduler | 完整 typed 结算计划及显式宿主调度投影；省略的调度 argv 引用同一捕获的完整决策 | 此投影退役未绑定的详情命令。实际宿主读回、过期写入拒绝与一次恢复仍待宿主采用验收 |
 | 可选 memory | 核验后的 boundary 参与事实及新鲜宿主绑定 | 关闭／recall／ingest／失效／provider 失败隔离持续保留；传输等价不是模型收益 |
 
@@ -347,6 +347,12 @@ envelope 投影，Codex CLI 保持关闭隔离；这不代表安装态 heartbeat
 结算另有覆盖，仍不证明安装态 App 收敛或模型成本。以下三项继续按各自验收保持
 未完成；这份核对不授权批量删除剩余 Python IO adapter。
 
+接续 audit 投影还保留每个有序 closeout 步骤和完整当前 judge。旧 capsule 在签名前就
+遗漏这些字段，并把接续指导截成 48 字符。捕获的 File/SQLite 工作和 replan 路径现在
+保留这些条款，修改步骤、顺序或 judge 后拒绝签名等价。既有 8 KiB 诊断阈值不变，
+必需文本可以超出并警告。这只关闭传输遗漏，不代表三项收敛验收通过，也不授权退役仍
+活跃的 Python/host adapter。
+
 统一工作上下文现在由既有 TS interaction owner 选择并满足必读，注册的 Python
 adapter 核验来源，在普通 heartbeat/quota 与签名 envelope 中返回完整当前任务来源，
 无需启用 TurnEnvelope。混合 Goal 文件仍必须经渐进式路径全文读取，不能按历史标题
@@ -373,6 +379,14 @@ live 模型结果、App 采用或以下三项收敛验收完成。
 | 在真实宿主 renderer 采用同一 typed 投影 | heartbeat full/thin 与 Turn host 消费同一执行事实及同 Turn 捕获/详情入口；显式保留通知和 scheduler 的宿主传输。真实 File/SQLite CLI 与打包 Codex App 覆盖重入、来源丢失、必读前拒绝、迟到结果、backoff 和一次结算；补读不触发第二次准入。最后调用方迁移后才退役旧投影。 |
 | 核验上下文形态及迁移默认 | 将相同的正常、replan、等待/恢复与可选能力负载同时对照当前完整和短包路径，测量载荷/model token、详情 IO、延迟、资源增长、遗漏、决策与结果质量。数据丢失、重复效果、身份和结算错误保持硬约束；保留受支持的已保存 prompt/回执与可逆 rollout，根据证据再改预算或默认。 |
 
+原生 Turn detail 采用现持久化真实 `run-once` producer 的完整 observation，由既有 TS
+envelope owner 将 Host 请求绑定到它。真实 File/SQLite CLI 检查实际 subprocess 输入，
+改变 canonical Todo 来源，验证原详情、重试和无效果 replay；模型 provider 是协议
+fixture。只读规划与可选 quota capture 默认值不变，原生执行 Turn 现保留私有 capture
+证据。证据缺失或不匹配拒绝再次调用 Host；legacy 缓存结果恢复与终态读回保留原 receipt。
+这只关闭 producer 到 detail 的传输缺口。真实模型、打包 App/Lark、后续 authority 检查
+及其余收敛矩阵仍独立验收，本切片不退役任何 Python 投影。
+
 此前成本切片已复现回归预算缺口，不能归因于 fixture alias，也不授权删掉
 必需上下文。`aa87cc019` 与 `fc411c878` 使用相同公共 CLI fixture、临时 alias
 和命令参数，实际 JSON stdout 测量如下：
diff --git a/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md b/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md
index 3c80b67888..49dc23ed0a 100644
--- a/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md
+++ b/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md
@@ -270,6 +270,24 @@ resume. Earlier source evidence records a Codex canary editing and reading back
 synthetic note while preserving prior text and creating no Goal. This historical
 host/filesystem evidence is separate from current synthetic-protocol regression
 checks and does not qualify live Lark, material intake or a release.
+Disconnecting a binding or replacing its identity, context or grant first
+publishes typed revocation, then reuses Core's exact-Turn interruption. Cancel
+that binding's queued work before stopping its active Turns, including topic
+and resumed Sessions; unrelated authorized work continues. History remains
+readable and unchanged-configuration retries do not interrupt execution. Never
+hold the authorization-publication lock while waiting for the host to stop or
+create another queue, scheduler or provider authority. An unconfirmed stop
+retains revocation and reports failure. Retrying disconnect with the old binding
+identity and current revision continues stop confirmation, including after a
+failed replacement. Settings projects pending/running targets from Core's
+persisted state, retains exact stop recovery across refresh and reload, and
+removes recovery only after Core confirms termination. It does not restore the
+grant or change the new binding and unrelated work. A claimed attached host
+still lacks push-stop support: report that limit, cancel its unclaimed external
+requests and preserve unrelated local Turns. Synthetic Codex/provider tests
+qualify source semantics; installed/live-host stop, physical command cancellation
+and community enablement remain separate acceptance.
+
 Committed same-claim replay is separate from new admission: after a lost response
 and target revocation, the original host can recover its committed receipt; new
 claims and external result publication remain denied. Current validation uses real
@@ -1135,3 +1153,27 @@ host media and file delivery remain separate gaps. Regression covers model-wire
 image input, unchanged Session, replay, durable restart and download-time
 revocation; live provider/model acceptance is reported separately. No new
 Session authority, queue, worker or feature toggle is introduced.
+
+### Lark progress-edit budget and final-result recovery
+
+Private conversations and steward commissions reuse persisted Turn events to
+edit one progress message; the Core terminal answer still owns the full result.
+Progress allows at most 12 edit attempts, persisted before the provider write.
+Unknown receipts consume the budget and restart does not reset it. This is a
+conservative transport limit, not Lark's maximum allowance. After exhaustion,
+retain Turn events and the allowance for a final edit and necessary close notice.
+
+Older long tasks may already have exhausted the provider quota. Only an explicit
+`230072` response plus fresh readback proving the target body absent allows
+retaining the rejected-edit proof and sending the complete result separately
+through the existing source-session, audience and idempotent-send path. Never
+mark an exhausted draft successfully closed, rerun the model or recreate the
+Session. Unknown errors, lost receipts and unavailable readback retain recovery
+without a blind resend. If the result is verified but reaction cleanup remains,
+recover only its original result proof without sending again.
+
+Regression covers budget persistence across restart, final-result retention,
+explicit quota refusal, unknown failure, lost post-write receipt, unavailable
+readback, recovery of older failed journals and two-App isolation. Live provider
+delivery remains separate. Model completion, material intake and an intermediate
+card cannot substitute for final-message readback.
diff --git a/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.zh-CN.md b/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.zh-CN.md
index 952115093c..759907f52d 100644
--- a/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.zh-CN.md
+++ b/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.zh-CN.md
@@ -122,6 +122,49 @@ Material Lifecycle，也不证明项目 adapter 的 intake/ranking 已接通。
 降为只读后，入站受理及恢复重新核验授权。本机 Scope 只复用相同 typed 项目上下文；
 宿主授权变化时创建新会话，保留旧历史，拒绝在旧会话上执行新工作。
 
+`loopx chat --project-filesystem-scope workspace_only` 进一步将普通 Codex 项目 Session
+限制为工作区文件工具：拒绝根目录访问，只保留最小系统可执行文件读取，既有读写 grant
+只作用于选中工作区。关闭临时目录、shell 环境继承、login shell、web search 和工具
+网络访问。typed context 持久化该选择，变化后旧上下文不能复用；默认仍是可写的
+`host_default` scope。
+
+shell 只保留 `PATH`，禁用 shell profile snapshot，POSIX 使用固定最小系统搜索路径，
+同时过滤账户配置覆盖及继承变量。macOS 可信宿主可通过固定系统 `xcode-select` 选择
+标准 Command Line Tools/Xcode toolchain，将其 Git 目录前置并授予只读。由二进制到
+`/` 的每个路径都必须 canonical、root-owned、类型正确，且 group/other 和调用方均
+不可写，包括 ACL。容器不安全（含可写 `/Applications`）、toolchain 缺失或选择不支持
+时保留原 profile/搜索路径，不放开 toolchain 写入、根目录读取、账户环境或工具网络。
+真实探针不证明 Windows 执行合格。
+
+收窄 profile 关闭自动 skill catalog 注入和项目指令发现，Agent 可经有界文件工具读取
+工作区自己的 `AGENTS.md` 与 skills；普通项目 Session 保留原生发现。workspace-only
+原生 Session 使用私有 `HOME`/`CODEX_HOME`、最小进程环境及文件式原生凭据存储；
+新建与恢复均禁用有效 MCP server（包括 managed/项目配置）及原生 Apps connector。
+operator 的 `LOOPX_CHAT_PUBLIC_SOURCE_READ=on` 只准入匿名 `read_public_url`/
+`read_public_image`，并须原生工具显式批准；其他 MCP 不可用，关闭开关移除 reader，
+Apps 仍关闭。Core 按获授权工作区和 App/owner binding 派生 store identity；不同
+话题保留独立线程，不要求每条消息重新登录。`host_default` 保留账户原配置和认证。
+
+不把认证或对话历史复制到新 store，已有项目原生登录保留所选账户。否则，可信宿主有
+文件式原生 ChatGPT 登录时，adapter 仅经私有 app-server stdio 的
+[`chatgptAuthTokens`](https://learn.chatgpt.com/docs/app-server#3c-log-in-with-externally-managed-chatgpt-tokens-chatgptauthtokens)
+传递 access token 与账户标识。该实验模式只在进程内存持有 token，不写项目 store、
+模型 prompt、工具环境或命令行。未授权 token callback 要求宿主账户 store 刷新，并发
+callback 复用已轮换 token；账户不可用、store 无效或账户变化失败关闭并脱敏报错，恢复
+账户后可重试而无需重绑。此 adapter 不桥接 keyring-only 或 API-key 认证；可将
+`CODEX_HOME` 指向 Session 已记录 home，走原生独立登录。旧共享 home 的 workspace-only
+Session 不静默恢复/迁移，须显式选择隔离 home 的新 Session；普通 legacy Session 保留
+原 home 和精确原线程恢复。
+
+adapter 在新建和精确线程恢复时只发送 Core 所属 named permissions profile，不同时
+发送 legacy sandbox override。核验返回 profile 与唯一工作区根，后续 Turn 固定该
+profile；宿主不支持时拒绝，不 fallback 到更宽权限。此 scope 拒绝其他 executor，
+native helper 使用 canonical Codex executable，home symlink 无需另加读取 grant。
+这是文件系统工具边界，不是完整社区 Bot 隔离；不授权群受众、不清空历史、不隔离任意
+host dynamic tools，也不让含私有文件的 checkout 自动具备公开安全性。公开启用前仍须
+群准入、干净公开工作区、合格模型认证及真实隐私/交互验收；原生上下文隔离和文件探针
+通过只是前置证据。
+
 typed Core、HTTP 与原生宿主回归覆盖默认读写、明确只读、工作区身份、App 独立授权、
 旧会话拒绝和原线程恢复。既有源码证据记录了 Codex canary 编辑并读回合成笔记、
 保留原文且不创建 Goal；这项历史宿主/文件系统证据与本次合成协议回归分开，
@@ -424,6 +467,14 @@ App 找到合格的已有负责人，保留请求，展示对方真实判断，
 - 一个获准驱动实际干活；纠偏和定向停止分别有接收方或运行时读回，传输 ACK 不够。
 - 原对话可打开草稿，刷新或更换会话后仍在；源码、打包前端、真实原生执行分别记录通过、失败、阻塞或未运行。
 
+既有对话 reader 还有一个有界 GQ02 companion：`view=agent_route` 通过共享 TS
+selector 与只读宿主 adapter 观察精确发现的 Goal/Agent，可跨归档历史定位唯一可读
+binding，无需用户复制 session 链接。未知或多个可读 binding 保持未解析，远端来源
+不可观测时明确不可用，不偷读本机宿主。管家与普通 Goal reader 共用该路径，不增加
+管家专属生命周期或执行驱动。验收使用真实隔离 host store，保持其不变；这只修复
+read-tool 缺口，不关闭原生派发、纠偏采用、定向停止或原路结果验收。安装态行为仍须
+维护者合并与 promotion 后验证。
+
 随后验收已有 G1：**“组个小队，核对现金流，把分歧查清楚。”**
 2–3 个真实 worker 消费版本化材料，独立指出期间或单位错误，采用修订后回传综合结论；
 第二轮修改输入，必须改变实际消费依据。对应 GQ05/GQ11–13，不新增里程碑或任务队列。
@@ -500,6 +551,12 @@ Chat/Lark 发送须等待前一结果核验送达；Peer 消费只确认已读
 在打包对话中验证重启、重复重试、前次发送不确定及精确 Goal 实例隔离。
 这是 R3/T1–T2 的结果连续性，不新增工作请求、权限、任务完成声明或管家专用队列。
 
+provider 暂时核验失败须与终态拒绝分开：共享 owner 先复核持久化发送事实与当前路由，
+保留原不确定结果并按退避恢复，不再次发送。显式撤权、路由丢失或 provider 必需 ACK
+缺失仍是终态 blocker。`source_session_v1` Goal 被重建后也一样：崩溃前持久化的
+attempt 沿原 GoalRef 与对话恢复，暂时核验失败退避且不重发，typed 终态阻塞保持停止。
+这只验证持久恢复边界，不证明真实 provider 可用性或完整 GQ09 旅程。
+
 已提交委派的恢复复用现有 typed collaboration lifecycle。原请求 Turn 失败、超时或
 被打断，不会取消已经进入接收方 Inbox 的工作。该 Turn 结束后，即使调用方没能保存
 handoff 回答，接收方已保存的结果仍可沿同一可信路由返回。重新核验当前来源授权、
diff --git a/docs/architecture/rfcs/automatic-execution-admission-v0.zh-CN.md b/docs/architecture/rfcs/automatic-execution-admission-v0.zh-CN.md
index 75a145aa03..08bd93cafa 100644
--- a/docs/architecture/rfcs/automatic-execution-admission-v0.zh-CN.md
+++ b/docs/architecture/rfcs/automatic-execution-admission-v0.zh-CN.md
@@ -49,6 +49,8 @@ long-task cadence 是建议，不是用户约束。
 
 ## 5. 架构与状态
 
+### 一个决策 owner，职责分别归属
+
 | 边界 | 职责 | 不代表 |
 | --- | --- | --- |
 | Quota 配置 | 用户下限、修订版本、作用域继承 | 实际消费或权限 |
@@ -89,6 +91,16 @@ App 间隔编辑器中，选定目标并明确保存已展示的前后值，就
 | 附着式交互 / 手动会话 | 显式手动意图；其余门禁保留 | 记录原因；自动续跑不能冒充手动 |
 
 App 必须显示目标和实际 schedule、应用失败。不支持该间隔时，应挂起受影响自动化，不能缩短间隔。
+Codex App 的 ACK 命令必须在宿主更新后重新读取匹配的 heartbeat；请求的 RRULE 和 hint
+中的旧观察不能认证本次更新。类型化 scheduler commit 在迁移、身份重置或持久化前，拒绝
+缺失或不匹配的当前观察。console 原生 follow-up 与 Python 兼容适配器遵守同一边界。
+Unix 和 PowerShell launcher 的 Codex host-match ACK 也经该入口取得新鲜读回；其他生成的
+follow-up 保留 Node 快路径。外层控制的写入在原生派发前仍受入口既有权限 guard 约束。
+原生 decoder 把 host-match 标记与捕获的 ACK 事实绑定，不能通过删掉标记绕过当前读回。
+其他 App adapter 提供自己的中立 current-RRULE 参数：显式不可用的观察清除旧事实，
+省略观察则保留其已绑定的观察，不从 Codex 元数据补齐缺失值。失败命令保留原 target/observed
+组合。真实 App API 更新和临时 File/SQLite Goal 上的读回，只验证该调度边界；经过的 timer
+唤醒、已安装 runtime 采用及模型启动前准入仍须独立验收。
 激活路径必须独立验收后才能宣传一键安全激活。模型内 guard 只能停止后续工作，不能撤销已消费的
 唤醒 token；仅修改 prompt 不等于强制执行。原生 `UserPromptSubmit` 是候选方案；自动化覆盖未验收前，
 调度建议模式不能宣称阻止所有过早模型启动。
diff --git a/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.zh-CN.md b/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.zh-CN.md
index ec17a764d0..57ff699b15 100644
--- a/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.zh-CN.md
+++ b/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.zh-CN.md
@@ -680,6 +680,11 @@ bundled provider 的[就绪指南](../../../loopx/extensions/lark/docs/realtime-
 记录有界跨会话处理和仍待完成的替代验收；私聊开通、普通非 Goal 对话、流式回显与媒体输入，
 须等固定版本的已安装旅程通过后才能宣称就绪。
 
+群回复的来源验证先并发读取新鲜消息 envelope 和 App 身份，再检查 canonical topic root。
+这消除了两次读取的串行 IO 依赖，但不缓存任何观察，也不提前读取事件提供的祖先关系。
+每次向外操作仍受 root mention、当前 grant 与原回复 receipt 约束。仅来源检查的耗时
+不能证明入口反馈、完整回答延迟或已安装实时旅程已通过。
+
 **模型容量失败（S5/S10）：** Codex adapter 把 typed `serverOverloaded` 终结错误保留为
 `server_overloaded`，上游任意 prose 不能建立该分类。启用后的 Codex app-server Chat Turn
 现在默认对这个精确 typed 过载做有界同请求续接：同一 worker 内，Session、Turn、请求、
diff --git a/docs/architecture/rfcs/desktop-execution-frontends-v0.zh-CN.md b/docs/architecture/rfcs/desktop-execution-frontends-v0.zh-CN.md
index ee5a6a415c..f38fb3e17e 100644
--- a/docs/architecture/rfcs/desktop-execution-frontends-v0.zh-CN.md
+++ b/docs/architecture/rfcs/desktop-execution-frontends-v0.zh-CN.md
@@ -66,6 +66,48 @@ manager Agent，也不把连接器硬编码到 Codex。
 配置。可选 Lark 投影同一选择及自己的受众约束。用例通过前，这是分配设计而非
 运行保证。见[近期发布路线](loopx-overall-roadmap-v0.zh-CN.md#近期本地-agent-产品与发布路线)。
 
+## 设置归属与作用域
+
+导航按用户任务组织，作用域按配置归属决定。管家保留一级 **Steward** 入口，配置其执行器、
+模型/推理偏好与宿主 runtime grant。这不是 Goal 成员的模型设置，也不能仅因配置归设备
+所有就埋进能力中心。不同入口复用相同配置组件与事务 owner。
+
+能力中心只有一个目标选择器：**设备默认值**或**某个 Goal**。当前“全局”只指本设备的
+配置权威，不是账户级或跨宿主同步设置；远端宿主保留自己的凭证与默认值。按以下行为
+决定作用域，不能按现有编辑器或存储路径猜测。
+
+| 配置 owner | 作用域决定 | 原因 |
+| --- | --- | --- |
+| `manager_runtime` | 仅设备；Steward 页 | 宿主向管家授予工具，Goal 不能扩大 grant。 |
+| `steward_executor` | 仅设备；Steward 页 | 一个管家 channel 拥有执行器/模型/effort 偏好；Goal worker 分配仍属于其自身 binding。 |
+| `periodic_report` | 设备默认值 + Goal 覆盖 | 复用报告样式、时区、schedule，允许项目节奏；默认 route alias 不授权向其他 Goal 的受众投递。 |
+| `change_quality_qualification` | 设备默认值 + Goal 覆盖 | 复用验证偏好并容纳显式项目合同；配置不能豁免仓库或合并要求。 |
+| `pull_request_review` | 设备默认值 + Goal 覆盖 | 复用 CI 等待和队列优先级偏好；两个作用域都不授予批准或合并权限。 |
+| `todo_replan_cadence` | 设备默认值 + Goal 覆盖 | 复用复盘频率并允许 Goal 工作节奏；这是已完成工作复盘频率，不是 automation timer。 |
+| `multi_subagent` | 仅 Goal | 子模型、容量、职责域和委托 binding 属于一个 Goal 的团队与资源边界。 |
+| `peer_task_coordination` | 仅 Goal | coordinator 必须是本 Goal 成员，不能继承无关 Agent 身份。 |
+| `explore_harness`、`explore_graph` | 仅 Goal | 探索策略与 opt-in 只影响本 Goal 的规划和证据图。 |
+| `progress_review` | 仅 Goal | drift 模式与阈值绑定本 Goal 固定的验收合同版本。 |
+| `reward_memory` | 仅 Goal | 私有 provider binding 和启用 Agent 是 Goal 局部配置，设备偏好不能扩散数据 binding。 |
+| `lark_kanban_heartbeat_sync` | 仅 Goal | 目标看板与同步遵循本 Goal 的 binding 和受众。 |
+| `lark_event_inbox` | 仅 Goal；在 Lark 设置/CLI 编辑 binding | 捕获消息、session binding 和 cursor 属于本 Goal；能力卡只读，传输凭证仍归宿主。 |
+| `coordination_runtime_shadow` | 仅 Goal | 实验观察显式限定在本 Goal 执行中。 |
+| `local_authority_shadow` | 仅 Goal；已退役/只读 | 历史检查不构成新的激活或设备默认值。 |
+
+这些决定保留已交付的作用域合同。仅 Goal 不排斥未来可复用 preset；应用 preset 须有意创建
+Goal 局部配置，不能实时继承身份、权限、binding 或实验激活。未来若拆分可复用偏好与局部
+binding，须先同时修改所属 schema 与真实消费者，再宣传新的作用域。
+
+双作用域能力保留 **Goal 显式值 → 当前设备默认值 → 能力默认值** 的优先级。Goal 覆盖是
+完整值，不按字段合并。恢复继承经既有 preview/apply/readback 路径删除覆盖。只读状态与
+作用域独立：即使当前不能编辑，Goal 绑定能力仍须显示仅 Goal。catalog、runtime 解析和
+UI 必须一致；不支持的作用域写入由既有 owner 拒绝。
+
+模型 provider 凭证、usage telemetry 与外观保留在各自设备级设置入口，Agent 分配属于
+Goal。自动执行间隔沿用其 Goal/Agent/automation 层级与 scheduler 读回，能力中心不另建
+timer。验收须覆盖上述矩阵、非法写入拒绝、打包 UI 的三类作用域及只读 Goal binding，
+保留独立 Steward 页，并验证切换目标、preview/apply/readback 和恢复继承不发生跨目标写入。
+
 ## 问题
 
 LoopX 已经拥有两个不同产品的零件：
@@ -708,6 +750,17 @@ executor 精确版本、完成情况、延迟、动作数、人工介入、禁
 挂接描述符或托管会话引用不能授予新的 Goal 权威。陈旧或不匹配的 Goal、Agent、
 工作区、运行时、provider 或信任绑定失败关闭。
 
+Desktop 壳自身的 CLI/HTTP 产物选择，与 Agent 工作会话或 provider binding 分开。
+启动比较已资格化的 package 版本和官方源码祖先；启动时的开发覆盖保持显式。记住的 App
+自有 release 路径只是发现缓存。同基线 snapshot 无法排序时，当前 App 可用 bundled
+产物维护自己的安装，但须保留可证明较新的 runtime 或独立管理的 CLI。修复在重连前
+保留已资格化 promotion，两项 HTTP 服务都须读回所选身份。启动被阻断时，已可用的签名
+App 更新仍能操作；在用户应用更新或有意选择其他恢复前，未变的服务重试不能覆盖它。
+手动更新或恢复失败同样保留错误、诊断和重试控件，直到下一次显式动作。自动更新源不可用
+仍须允许已安装 App 启动。已完成且验证的恢复清除安装未完成标记并显示 Restart；在重启前
+仍不得启动服务。验收同时覆盖普通打包重启、同窗口恢复和失败 fallback；安装成功或临时
+覆盖不能关闭该 bootstrap 验收、Agent 执行验收或签名发布资格。
+
 ## 安全与隐私
 
 - 把不透明会话句柄、凭据、环境值、进程元数据、原始转录、provider 负载、
@@ -775,25 +828,28 @@ executor 精确版本、完成情况、延迟、动作数、人工介入、禁
 
 这是围绕已在运行的工作采用 Desktop 的短路径。
 
-第一阶段的可执行 broker 契约沉淀在 Chat session/store 与通用
-`worker-bridge attached-session-*` 命令中，而不是 Lark provider 内部：
-
-- `agent_id` 始终表示 Goal 内已登记的 LoopX Agent；
-- `executor_endpoint_id` 单独表示 `codex`、`claude-code` 或其他执行端；
-- attach 只有在 `(host_surface, host_session_id)` 已精确绑定该 Agent 时才成立；
-- attached session 的 Web 与 Lark 消息进入同一有界 FIFO，并保留
-  `origin=web|lark`；
-- 已有宿主可以保持一个最长 30 分钟的 claim 等待，并在队列出现消息时立即
-  获得旧项优先、幂等 claim；超时只返回空结果，不启动或恢复任何运行时；
-- 原宿主通过稳定 claim/completion id 领取消息并回写，重复调用不会重复生成
-  Agent 回复；以及
-- 任何 attached session 路径都不得调用 managed runtime 的启动/恢复函数。
-
-该阶段已经能支撑 `session_queue` 与回复 readback。`live_steering` 仍要求宿主提供
-对正在运行 Turn 的 push transport；在此之前 capability 明确为 false，入口失败
-关闭，不能用新启动的 app-server 或静默改投另一个模式冒充完成。Desktop 下一步
-需要把 bind/list/claim 状态投影成首屏 attach 管理交互，并由 Codex App 等宿主
-自动完成 claim/complete，而不是要求人手工运行 CLI。
+有界 provider checkpoint：本机 Goal Chat 可检查已登记 Codex App Agent 原先保存的
+对话，并经既有 Desktop owner 提供仅空闲时可用的纯文本回复。它读取有界来源窗口，
+每秒观察已保存记录，不恢复另一个 app-server。provider 展示可见消息、function/custom-tool
+输入与结果及显式 Turn 生命周期。长文本可原处续读，前后分页与 append cursor 保留 burst
+中的历史。有界空窗口追赶避免反复点击元数据；折叠工具行解码原生文本块，保留来源字段并
+展示可读 shell 输出。读旧记录时暂停插入，并提供回到最新的路径。
+
+排除隐藏 reasoning/configuration，隐去凭证形态字段。不支持、畸形、非文本和超限记录
+保留为可见覆盖缺口。目标是每个 Goal/Agent 都有稳定工作对话：Goal 目录现打开稳定 Agent
+路由，保留刷新与前进/后退，明确未绑定或不支持的宿主；该视图不显示普通 Goal composer/
+executor。首个 provider 不证明其他 provider 覆盖或完整原生活动/stream 对等。详见
+[provider 边界与操作](../../integrations/session-runtime-control-plane-adapter.md#experimental-owner-local-codex-app-conversations)。
+
+这是实验 provider 提案，不代表完整切片 B 验收：token delta、忙碌 Turn steering/queueing、
+审批 callback、原生 live-send、Windows 传输与已安装采用仍分别待验。其有界用户任务是在
+查看 Goal 工作时跟进特定 Agent。已确认输入后 composer 立即可用，无冗余 ACK；被中断的
+回复从已有 receipt 恢复，不重复提交，真实不确定输入仍须先恢复再发送。
+
+Overview owner 入口一次导航打开精确 Agent，无需再次选择；binding 缺失就保持不可用。
+稳定页面复用既有原生 provider 和权限。这缩短了本机 Overview 路径；其余工作会话整合
+仍须与在 Codex App 选择原对话比较，覆盖目标发现、纠正和结果读回。传输成功不证明
+任务路径更短、独立验收或 G1 完成。
 
 ### 切片 C：托管参考垂直
 
@@ -820,6 +876,18 @@ executor 精确版本、完成情况、延迟、动作数、人工介入、禁
 
 ## 验证标准
 
+### 原生服务所有权
+
+打包原生窗口使用自己的 loopback status/Chat 端点，只拥有自己启动的子进程。同源码
+版本且已就绪的服务不能证明使用相同 registry 或归 App 所有。窗口导航与原生维护权限
+必须跟随精确 Chat origin。runtime repair 保留同窗口端点，两项替换子进程由同一个已
+资格化选择启动，不能独立重新发现全局 CLI。CLI 服务与 Vite 开发保留既有共享端口；
+打包 App 启动不再借用、重启这些服务或其 LaunchAgent。
+
+验收时让独立共享服务同时运行：两项 HTTP runtime 身份与渲染工作区都属于所选 runtime，
+退出、修复、重开只影响自己的子进程。私有端点被占用时拒绝，不接管或终止 listener。
+源码 checkout 或 helper 测试通过不能认证该原生进程边界。
+
 ### 公共
 
 - 一个绑定至多有一个活跃执行器，用户入口串行化；
diff --git a/docs/architecture/rfcs/harness-selection-dsh-pi-v0.zh-CN.md b/docs/architecture/rfcs/harness-selection-dsh-pi-v0.zh-CN.md
index e9b3a1d9e0..acf27d32bc 100644
--- a/docs/architecture/rfcs/harness-selection-dsh-pi-v0.zh-CN.md
+++ b/docs/architecture/rfcs/harness-selection-dsh-pi-v0.zh-CN.md
@@ -444,20 +444,25 @@ journal 与配额语义；B 作为上游接口出现时的低成本替代；只
 `steward_executor`（`loopx/capabilities/steward_executor/machine_defaults.py`），
 本机的管家选择因此成为一等公民。
 
-该命名空间只有三个字段，且不保存任何凭据：
+当前命名空间保存主要端点、模型/effort 和封闭的选择策略，不保存凭据：
 
 ```json
 {
-  "schema_version": "steward_executor_machine_defaults_v0",
+  "schema_version": "steward_executor_machine_defaults_v1",
+  "selection_policy": "preferred",
   "executor_endpoint": "codex",
+  "eligible_endpoints": [],
   "executor_model": null,
   "executor_reasoning_effort": null
 }
 ```
 
 `executor_endpoint` 必填，且仅限 LoopX 作为通道执行器出货的端点；模型或推理档位留空
-表示本机对该字段不做决定，通道继续从更低层解析。未知字段、未知 schema 版本、未列出
-的端点、不支持的档位都会在任何生效前 fail closed。需要命名空间未列出适配器的运维方
+表示本机对该字段不做决定，通道继续从更低层解析。`preferred` 以该端点为默认，但尊重
+用户显式选择；`pinned` 拒绝不同的显式选择；`flexible` 要求非空 `eligible_endpoints`
+包含主要端点，只能在该池内按可用性 fallback。未知字段、未知 schema 版本、未列出
+端点、非法 pool 或不支持的档位都在任何效果前失败关闭。已存 v0 文档保留原 `preferred`
+行为。需要命名空间未列出适配器的运维方
 仍然可以使用 `LOOPX_MANAGER_ENDPOINT`。
 
 优先级只在通道所有者（`loopx/chat_manager.py`）声明一次：machine configuration、
@@ -466,6 +471,22 @@ journal 与配额语义；B 作为上游接口出现时的低成本替代；只
 文档；通道回读新增 `executor_endpoint_source: machine_configuration` 以及该文档的
 `status` 与 `configuration_revision`，无需读取存储即可区分"机器决定"与"服务环境值"。
 
+解析后的 endpoint、model、effort、policy、分配原因、eligible pool 与来源 revision
+也持久化在 manager Session。运行中的 Turn 保留原分配。同 endpoint 的 model/effort
+修改在下一空闲或已接受的 queued Turn 边界采用：用新模型打开上游 adapter，按时间顺序
+保留完整可见历史和相同权限，启动成功后才持久化、投影新分配。模型或 context/tool
+迁移创建新线程，不能任意截取最近消息而丢掉早期用户约束；空原生线程尚无 rollout 时
+同样适用。每次分配捕获已接受的机器 model/effort 输入，单改 policy 不触碰 provider，
+改一个字段保留另一个字段的持久值。显式值清空后只从既有低层解析该字段，即使它原先
+等于有效值。旧分配没有捕获机器输入时，未知 unset 字段继续未知，只有有证据的显式编辑
+才能原地更新。环境变化或其他 endpoint 默认值不在重启后重解释既有 binding。
+
+App model/effort badge 打开既有 Steward 设置，在设置事务或对话 Turn 后刷新权威
+channel 读回，不把已保存默认值当作当前 Turn 已换模型的证明。
+`loopx chat-endpoint inspect-steward` 通过同一公开投影读取有效配置与当前 Session
+binding。本阶段交付分配边界及可用性 fallback，不从对话 prose 推断语义任务适配。
+后续 Agent 可明确选择 executor，但仍由相同 pinned/flexible 边界准入或拒绝。
+
 本次不做改变的边界：出货默认值在每台机器上仍是 `codex`；凭据仍然只做认证、不做选择；
 托管宿主仍然需要自己的凭据与 runtime；该选择不授予任何权限——它只命名一个由运维方
 计费的 runtime，`manager_runtime` 仍是另一项机器决定。管家值损坏或存储不可读时，回落
@@ -475,7 +496,7 @@ journal 与配额语义；B 作为上游接口出现时的低成本替代；只
 验证：`tests/capabilities/test_steward_executor_machine_defaults.py`、
 `tests/test_manager_channel_binding.py`、`tests/test_chat_machine_configuration_api.py`、
 `tests/capabilities/test_capability_configuration_ui.py`，以及
-`examples/loopx-steward-channel-binding-smoke.py`。
+`apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-contract.test.mjs`。
 
 ### 管家回答身份与 Runtime 选择（2026-09-16）
 
diff --git a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-24-observation-retirement.zh-CN.md b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-24-observation-retirement.zh-CN.md
index 470ed28a9a..f2aaf4f87e 100644
--- a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-24-observation-retirement.zh-CN.md
+++ b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-24-observation-retirement.zh-CN.md
@@ -37,7 +37,8 @@ SQLite 合格默认和所有旧 Goal 迁移不是同一验收范围。PostgreSQL
 [操作说明](../../../../reference/authority-observation-retirement.md)覆盖拒绝、清理、
 bootstrap 与回退。主 Todo/租约规则、来源校验、事件 hold 和活跃绑定不变。中英文
 设置中旧入口只读，旧客户端写入前拒绝；旧 RPC 保留 typed 拒绝入口。历史 codec/read
-保留，删除 Python 后采样/重试与 TS observation 提交。目录迁移结果明确不再 seed。
+保留，删除 Python 后采样/重试与 TS observation 提交。状态迁移保留响应字段并返回
+`retired/attempted=false`，明确不再 seed。
 
 验证真实 CLI bootstrap、旧配置/无配置的租约写入、非法配置清理、历史读回，以及
 主文件替换后 committed marker 前进程死亡的单次恢复。保留现有事务、fence 与配置
diff --git a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-27-recovery-audit.md b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-27-recovery-audit.md
index 906f6b9f13..0ce1ed044f 100644
--- a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-27-recovery-audit.md
+++ b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-27-recovery-audit.md
@@ -1,6 +1,10 @@
 # Local default cutover: recovery audit and remaining delivery scopes
 
-- Historical recovery baseline: `157ab7b11`; current inventory: `70b3cca01`, 2026-09-27.
+- Latest rechecked baseline: `76ff7c73c`; historical recovery baseline:
+  `157ab7b11`, inventory `70b3cca01` on 2026-09-27. Historical sections retain
+  their original baseline.
+- Current counts follow the final local-provider-cutover table; historical
+  planning is not a countdown of remaining PRs.
 - Owner: overall roadmap #4574 R5/G2; shared authority D2/D3; TS T3/T4.
 - Supersedes the **current count**, not historical evidence, in the
   [September 24 reconciliation](2026-09-24-default-cutover-reconciliation.md).
diff --git a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-27-recovery-audit.zh-CN.md b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-27-recovery-audit.zh-CN.md
index ab5f674764..fc29b151aa 100644
--- a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-27-recovery-audit.zh-CN.md
+++ b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-27-recovery-audit.zh-CN.md
@@ -1,6 +1,7 @@
 # 本地默认切换：恢复审计与剩余交付范围
 
 - 最新核对基线：`76ff7c73c`；下方历史段落保留其当时基线。
+- 历史恢复基线：`157ab7b11`；2026-09-27 清单基线：`70b3cca01`。
 - 当前数量以末尾“本地 provider 切换”表为准，历史规划不是剩余 PR 倒计时。
 - 归属：总目标 #4574 R5/G2；shared authority D2/D3；TS T3/T4。
 - 取代[九月二十四日清单](2026-09-24-default-cutover-reconciliation.zh-CN.md)的
diff --git a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.zh-CN.md b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.zh-CN.md
index 6a5ec13c22..f396feddb8 100644
--- a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.zh-CN.md
+++ b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.zh-CN.md
@@ -644,6 +644,21 @@ OS 缓存，未控制其他进程负载，不代表 p95、provider 对比或完
 全部保留。
 
 
+### Runtime 退役须排空已准入效果
+
+共享 TS Effect server 现独立于 TCP 连接统计 pending handler；空闲窗口在最后一个
+handler 及私有 response sink 完成后才开始。显式 shutdown 停止接受连接，等待已准入
+效果（含断连调用方），最后只删除自己的 locator。认证、请求预算、原 receipt 与调用方
+恢复不变，不增加 provider 或 Python 决策 owner。
+
+旧 close handler 可能在断连调用方写入仍等待真实 mutation lock 时退出。真实 server
+回归在空闲退役与显式 shutdown 下重现，用仍连接调用方作对照，同时验证并发 ping、
+认证拒绝、listener 关闭、持久写入读回和最终退役。替换 locator、重启及 File/SQLite
+archive crash/recovery 测试仍须保留。
+
+这只修复 R5/D2 recovery 的一个 S4/runtime-lifetime 依赖，不证明持续运行，不选择
+release 默认值，不增加冻结容量预算，也不授权删除 legacy writer。
+
 ### 委派完成阶段的原租约衔接
 
 #5436 的 TS Host 监督覆盖模型执行和 Turn 验证，最终 Todo 独立验收位于其后。
diff --git a/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-09-22-replan-history-policy.zh-CN.md b/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-09-22-replan-history-policy.zh-CN.md
index 3fd3092ba3..41dffd209e 100644
--- a/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-09-22-replan-history-policy.zh-CN.md
+++ b/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-09-22-replan-history-policy.zh-CN.md
@@ -20,6 +20,24 @@ Python 保留历史解码、指纹及 obligation 呈现；删除被替代的触
 组装、frontier 结算及完整捕获资格仍有各自归属。没有加入模型观察器、provider
 切换、前端配置项或可选 capability。
 
+## 基于回执的证据展示修复
+
+Replan 证据消费者原先可能为工作及其 quota 扣记各重复一次相同接续。既有 TypeScript
+work-item owner 现使用限定作用域的 settlement 与 spend receipt 事实去重。Python
+传递身份及完整文本摘要，不分类资格。新增事实不进入公开行 hash，已投递的 history
+reference 因此仍解析到原不可变记录。
+
+归约要求完整 Goal/Agent/Todo/Turn/effect 身份、实际类型化 progress observation 及
+完整接续都匹配。每个合并 occurrence 都须有自己的匹配，且对应工作须在展示窗口内保留。
+不同 health 仍可见；不同 outcome、缺失或不支持的 receipt、身份不匹配和不同接续尾部
+保留原展示。raw count、负向覆盖与 obligation identity 不变，不新增共享词汇、能力、
+store 或权限。
+
+验收使用临时真实 File/SQLite quota CLI fixture、不可变 history-reference CLI
+读回、inline/snapshot 对等和类型化负例。本修复减少消费侧重复；完整历史仍有
+O(history) 传输与处理成本，并增加身份字节。不证明已安装采用、模型 token/时间效果、
+整项任务有效性或剩余 T3/provider 资格。
+
 ## 长历史传输修复
 
 此前 600 行演练不足以证明长期运行的 Goal。即使去掉正文，所有紧凑事实仍随历史
diff --git a/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.md b/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.md
new file mode 100644
index 0000000000..f7a86fc2af
--- /dev/null
+++ b/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.md
@@ -0,0 +1,251 @@
+# Historical 1.x prerequisite checkpoints (through 2026-10-12)
+
+Moved from the [TypeScript migration RFC](../../typescript-control-plane-migration-v0.md), former section “Historical 1.x prerequisite checkpoints (through 2026-10-12)”, on 2026-10-16 at RFC baseline `b2aca67d76af45e554c620818a982a81f8d2d52b`. Preserve the original evidence and unqualified boundaries. The English source recorded `38cb407ed`; the Chinese source recorded `06b6caa07`. Neither is a new qualification of the current candidate.
+
+[中文版](2026-10-12-1x-prerequisites.zh-CN.md).
+
+The following records explain the prerequisites and validation at their named
+sources. Their references to reachable writers and a “next” cutoff describe
+that 1.x baseline, not remaining implementation work in the candidate above.
+
+Rechecked at main `38cb407ed`: #5413/#5466/#5283 and the affected creation,
+Host-stop and UI-history owners #5500/#5805/#5308/#5398 are merged. Reuse
+their delivered boundaries rather than reopening the October 2 merge queue.
+The [current validation, migration and deletion plan](../shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.md#current-closeout-validation-migration-and-deletion-2026-10-02)
+now prioritizes installed reversible qualification, affected consumer adoption,
+policy migration and last-caller deletion; it records the merged sources and
+the remaining evidence separately.
+
+Canonical new-Goal creation is already implemented by #5500/#5805. The existing
+machine setting and `coordination/local_authority_defaults.ts` choose canonical
+SQLite with `hard_lease` for unconfigured new Goals; CLI bootstrap and App
+creation share the typed initialization and original-operation recovery owner.
+Explicit v0 settings and v1 `canonical_creation=false` preserve post-promotion
+target behavior. Existing Goals keep their recorded selection. See the
+[configuration and disable contract](../../../../reference/local-authority-provider-selection.md#new-goal-authority-machine-setting).
+This is the source candidate, not certification of installed adoption, a released
+default, full shared Goal intent or D2/D3. Do not rebuild a creation/default owner.
+
+Canonical Todo entrypoint separation (T4): all five mutation facades now share
+`todos/mutation_api.py`; historic imports are lazy and the unpromoted writer is
+isolated in `todos/legacy_mutation.py`. The installed File/SQLite oracle can
+remove the whole writer module while exercising lifecycle and settlement
+recovery. The cold-import oracle now composes reviewed import, fresh leased
+updates/new writes and original-operation recovery with that writer absent;
+source-display loss and provider outage cannot replace the current authority
+or erase later writes. The original import cursor remains historical while the
+current provider revision is preserved. This prepares last-caller deletion
+without claiming code retirement:
+bootstrap, handoff, team-plan and Monitor still have supported source callers;
+keep capture/outbox and historical recovery until their own exits. [Caller and
+rollback inventory](../../../../reference/canonical-todo-completion-update.md#canonical-mutation-entrypoint-isolation).
+Production Todo consumers use the concrete owners instead of the historic `loopx.todos` re-export:
+CLI registration/actions, quota and planning, capability writeback, source lease
+reads and the Lark source projection import the same concrete mutation, full-read,
+path or Markdown display owners. No new wrapper, decision or RPC is introduced.
+The historic public imports and their supported unpromoted IO remain available.
+Disposable source/normal-wheel probes remove the facade, the whole legacy Todo
+writer and four shadow producers together; real File/SQLite CLI lifecycle,
+once-only settlement, Monitor replay and App cold-import/action/restart journeys
+must still work, with missing-provider/lease and changed-source/backup refusals.
+The App HTTP receiver now also removes `bootstrap.py` from that same copied
+distribution and checks the complete removed set before each server start,
+restart and auxiliary CLI. Separate fixture results cannot prove this combined
+absence. The ordinary canonical CLI creation entrypoint remains with its owner;
+removing it from the cold-import receiver is a disposable qualification probe,
+not a supported package format or permission to break the additive 1.x line.
+中文：App 冷导入、后续写入和重启使用同一份缺少旧入口、writer 与 source producer 的
+隔离副本；不能拼接两组各自缺少一部分模块的结果。正常 canonical 创建仍保留其
+现有入口，这个临时卸除验收不等于已完成整族退役、自然试用或正式安装采用。
+Lark dry-run and Explore replay qualify local consumers only, not live external
+adoption. The fresh research execution path added by [#5280](https://github.com/loopx-project/loopx/pull/5280)
+reintroduced a function-local historic import after the earlier caller inventory.
+It now imports `todos/list_readback.py` directly, preserving the same typed
+current-Todo validation and the historical replay branch before that read.
+The qualification includes fresh research execution, actor/runnable/input
+refusals, exact lineage readback and replay after current input/Todo changes
+in the same facade-present/absent source and normal-wheel File/SQLite matrix.
+A whole-production Python import guard resolves relative imports and aliases;
+dynamic loading still requires the isolated real journeys. Keep this guard as
+new capabilities arrive, rather than treating a past inventory as a permanent
+exit. Last supported source writers, historical recovery, installed cohort
+and release exits remain independently open.
+
+The next T4 package is the [import-first normal-writer cutoff](../../../../reference/local-authority-provider-selection.md#proposed-compatibility-cutoff-and-release-sequence),
+not another re-export or producer-loading extraction. At `38cb407ed`, live
+unpromoted callers remain in ordinary mutation, bootstrap/creation opt-out,
+team-plan, Monitor, ownership/source lease and active capture/binding. Reuse
+their typed admission/transaction owners; treat retained source capture,
+historical receipts and permanent document IO as recovery obligations.
+The existing delivery Todos should carry these concrete exits:
+
+- Qualify the installed import/backup/recovery journey for the declared source
+  matrix; importer implementation is already present and is not a missing-code
+  dependency. Do not reinterpret complete coordination backup as complete Goal
+  backup.
+- Run the bounded reversible core-developer SQLite trial before the breaking
+  cutoff, recording real Host adoption/use separately from conversion drills.
+- Deliver the cohesive 2.0 normal-writer cutoff: fresh unmigrated writes and
+  execution grants refuse before effects; canonical work and original-operation
+  recovery pass with the old writer physically absent. Keep the additive 1.x
+  import/deprecation line compatible.
+  Admission must preserve original lease release and receipt/outbox recovery
+  before import; denying the existing shared legacy fence indiscriminately
+  would also block these prerequisites. Remove the Python missing-fence bypass
+  with the typed cutoff and validate the combined recovery-to-import journey
+  specified in the linked release contract.
+- After the last source caller exits, reconcile pending outboxes and delete
+  unused capture producers/private decisions together. Keep supported historical
+  readers and current-head rollback; do not wait for every external user to
+  migrate or claim full T4/D2/default qualification from internal deletion.
+
+This updates the existing R5/T4 frontier and release proposal; it creates no
+parallel migration owner, runtime gate or release activation.
+
+Team-plan recovery prerequisite: an unpromoted plan that published its original
+receipt can now recover through the Chat confirmation owner while shadow
+bootstrap is interrupted. Registry/Todo/source locks still protect the read,
+and the existing typed identity validator rejects changed intent, actor or
+reviewed basis. Recovery verifies source durability without loading the capture
+producer or admitting new writes; fresh plans still obey all source, management
+and promotion guards. This repairs the existing 1.x recovery path and does not
+activate the 2.0 cutoff or settle the remaining lease/outbox/Host obligations.
+
+
+The retained import-compatible field writer now composes resume normalization
+and contradictory-clear rejection in its existing typed field plan. Keep blank
+Python input omission and locked IO; retire the duplicate normalization crossing,
+not the still-supported writer or migration reader.
+
+The remaining legacy writer and bootstrap capture adapter now avoids loading
+rollout history and constructing a Todo projector when runtime shadow is off
+and there is no active durable binding. It still resolves the source identity;
+an active binding continues to require durable preparation even after config
+is disabled. This removes optional capture work from ordinary legacy writes,
+without changing their output, history retention or outbox recovery. Python
+retains this Host IO adapter until its last supported source writer is replaced;
+this is neither whole-writer retirement nor default-provider qualification.
+Unpromoted lease acquire now loads the capture adapter only when the typed
+result carries a capture request. The real CLI and normal-wheel oracle cover
+acquire/replay, rejected stale renewal, renewal, transfer and release with the
+four legacy shadow producer modules physically absent and with no enabled
+capture or active binding. An active binding still delivers capture after the
+setting is removed. This retires a default-off dependency, not the supported
+source writer or pending capture/history recovery.
+
+Handoff/continuation display decisions now belong to the existing TypeScript Todo
+context owner. Summary reuses its normalized identity/claim/exclusion/class
+facts in one batch; the index keeps source compaction before labelling and audit
+merging in one native batch. Planning and quota collectors project whole chosen
+sets. Oversized display context uses byte-bounded read-lens batches while
+counts, dependency decisions and closure retain their full-source owner. A
+single oversized historical record reuses the existing private snapshot transport:
+credential checks see its full text before display truncation. The
+Python facade keeps shared metadata codecs and historical tuple/SHA-1 identity
+encoding, with no Python decision fallback. Retain nested-empty precedence,
+Unicode whitespace/codepoint limits and credential rejection before truncation;
+these are compatibility obligations. File/SQLite CLI and normal-wheel recovery
+must preserve exact source and provider revision when Markdown display is absent
+or the selected provider is unavailable. This read-model retirement does not
+retire the supported mutation/Host callers or certify a released SQLite default.
+
+Public add now composes scope, supported wait and bounded Monitor metadata in
+one typed creation-scope request. The legacy add writer consumes that same
+fresh draft rather than re-planning it; standalone line codecs and successor
+creation retain their own admission. Priority and validation-declaration
+checks keep their prior diagnostic order, and canonical provider transactions
+still recheck registry/claim/lease/CAS authority. This retires duplicate add
+composition, not the supported Markdown writer or bootstrap/Host/history IO.
+
+The canonical team-plan caller now loads capture and Markdown editing only in
+its supported unpromoted arm. Real File/SQLite Chat and normal-wheel source
+removal cover confirmed batch commit, later-write replay, provider restoration,
+projection recovery and imported historical receipts. The existing TS
+transaction, source guards and projection owner remain unchanged; the legacy
+batch IO instrumentation seam stays lazy for its current consumers. This is a
+caller-isolation exit, not deletion of the live legacy writer or completion of
+receiver adoption, Host execution, PostgreSQL or D2 qualification.
+[Contract and retained duties](../../../../reference/canonical-todo-completion-update.md#team-plan-source-writer-isolation).
+
+Public CLI isolation now keeps shadow configuration in `coordination/configuration.py`
+and complete source capture in `coordination/authority_source_capture.py`. Cold import,
+source inspection and historical promotion recovery reuse those retained owners;
+only explicit enabled shadow actions load the old producers. Ordinary new-Goal
+SQLite creation, leased work, once-only settlement and reversible exit, plus cold
+File/SQLite import and original-operation replay, run through the real CLI with
+all four shadow producers physically absent in disposable source/normal-wheel
+copies. The old module still re-exports the retained APIs for current consumers;
+enabled capture, outbox and legacy commands remain supported. Preserve exact
+source identity, archive dependencies, safe lease reads and later-write recovery.
+This removes an eager-import blocker; deleting live producers still requires
+their last-caller exit. App/Lark contracts, provider transactions, cohort adoption
+and frozen D2 evidence remain separate.
+
+The Monitor router likewise isolates its live source writer. Historical receipt
+codec/replay has a small shared scheduler IO owner, while the existing TS batch
+still owns operation identity and decisions. File/SQLite CLI and normal-wheel
+source removal must preserve later canonical writes and original successors;
+promoted replay leaves old outbox bytes inert. Unpromoted markerless batch
+recovery retains its existing bounded drain. Business-receipt replay does not
+guarantee shadow catch-up: lock deferral or an expired proof budget preserves
+pending evidence for an independent `authority-shadow drain`. Recovery keeps
+the original source bytes, successor IDs and once-only quota effect; it does
+not replay the writer to finish catch-up or increase the inline limits.
+This removes a canonical import dependency,
+not the supported legacy writer. The absent arm also removes all four shadow
+producer modules using the qualified CLI startup isolation above.
+[Retained duties and rollback](../../../../reference/canonical-todo-completion-update.md#monitor-source-writer-isolation).
+
+Shadow diagnostics now have an independent read-only boundary: retained outbox
+disk codecs live in `local_authority_shadow_history.py`, and status/candidate
+read transport in `local_authority_shadow_readback.py`. The public status and enabled
+`coordination-shadow inspect`/`qualify`/`read-candidate` commands call that owner
+without loading source producers. Full source and normal-wheel observations
+retain matched/refused, default-off, source-drift and missing/corrupt-store
+recovery behavior with all four producer modules absent. Historical imports
+remain exact aliases; bootstrap, rollback and promotion retain their live adapter.
+The existing TS qualifier now propagates provider read refusals before lineage
+validation can mislabel corruption as `bootstrap_required`; valid/missing stores
+retain their behavior. This is an explicit failure-diagnostic correction, with
+no new RPC or migration authority; drain still uses its existing orchestration.
+Original entry identity, malformed evidence, cursor residue and missing-store
+behavior remain unchanged. Python retains historical filesystem decoding and
+presentation IO; TS retains history proof, delivery and cleanup authority.
+Existing producer imports are aliases for supported callers, not duplicate
+implementations. Source and normal-wheel File/SQLite recipient checks compare
+complete status results and unchanged original bytes with producers present or
+absent. This is a historical-reader exit prerequisite, not writer deletion,
+outbox disposition, installed cohort adoption or release-default qualification.
+See [operator readback and rollback](../../../../reference/authority-observation-retirement.md#retained-readback-without-source-producers).
+
+Existing Goal migration, two-policy ownership retirement and storage-format
+upgrade retain separate receipts and exits. Original-receipt recovery does not
+justify retaining `legacy` as a live policy. Required migration readers remain.
+
+Imported canonical bootstrap reconnect now reuses the existing typed authority
+reader, keeping current Todos, leases and original import receipts without
+entering the Markdown writer. File/SQLite real CLI coverage includes an old v0
+preference naming the other provider, missing display, missing selected authority,
+force/route rejection and later-write replay with legacy producers absent.
+Python retains bootstrap registry/Host IO; it adds no decision owner or creation
+receipt. This closes a reconnect dependency, not the remaining unpromoted writer,
+active outbox, Host or release-default acceptance.
+
+A bounded cohort can start after its installed recovery and relevant execution
+controls pass; it does not certify a released default or formal ten-day D2.
+Frozen failures/missing evidence remain visible. T4 deletes proven redundant
+owners alongside implementation, without waiting for R6 or all Python to vanish.
+This replaces stale current-count estimates, not historical execution evidence.
+
+Public-scan privacy checkpoint: the retained Python filesystem/regex owner
+classifies canonical inputs before reader submission, independently of display
+paths. Overlapping roots cannot remove a private classification; reports use the
+widest requested root consistently. Narrow explicit files/directories retain
+private ancestry. Git-verified worktrees remain their own namespace beneath
+private parent directories, while a directory merely named `.git` grants no
+exception. Outside a worktree, explicit inputs beneath private state remain
+excluded. Tracked-file policy, fresh symlink resolution and existing error rules
+remain in this owner; no second control-plane decision source or new setting is
+introduced. This safety repair does not qualify scanner latency, SQLite release
+defaults or whole T4 retirement. CLI checks and quota preparation use the rule;
+App status continues to report repository scanning as deferred.
diff --git a/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.zh-CN.md b/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.zh-CN.md
new file mode 100644
index 0000000000..bf6e52eb15
--- /dev/null
+++ b/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.zh-CN.md
@@ -0,0 +1,152 @@
+# 历史 1.x 前置 checkpoint（截至 2026-10-12）
+
+从 [TypeScript 迁移 RFC](../../typescript-control-plane-migration-v0.zh-CN.md) 的“历史 1.x 前置 checkpoint（截至 2026-10-12）”小节迁出；迁移日期 2026-10-16，RFC 基线 `b2aca67d76af45e554c620818a982a81f8d2d52b`。保留当时证据与未验收边界；英文源记录 `38cb407ed`，中文源记录 `06b6caa07`，均不是当前候选的再次验收。
+
+[English](2026-10-12-1x-prerequisites.md)。
+
+以下记录解释具名源码上的前置条件与验证。“writer 仍可达”及“下一次截止”
+描述当时的 1.x 基线，不是上方候选仍未实现的工作。
+
+按 main `06b6caa07` 复核，#5413/#5466/#5283，以及创建、Host 停止、UI 历史
+相关 owner #5500/#5805/#5308/#5398 均已合并。复用各自已交付的边界，不重开
+10 月 2 日的合并队列。
+[当前验证、迁移与删除计划](../shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.zh-CN.md#当前收尾验证迁移与删除2026-10-02)
+现在优先安装态可回退验证、相关消费者采用、策略迁移及最后调用方删除，并分别
+记录已合并源码和仍缺的证据。
+
+#5500/#5805 已实现 canonical 新 Goal 创建。既有机器设置与
+`coordination/local_authority_defaults.ts` 为未配置的新 Goal 选择 canonical
+SQLite／`hard_lease`；CLI bootstrap 和 App 创建共享 typed 初始化及原操作恢复
+owner。显式 v0 设置和 v1 `canonical_creation=false` 保留晋升后目标行为；存量
+Goal 保持已记录的选择。见[配置及关闭契约](../../../../reference/local-authority-provider-selection.md#new-goal-authority-machine-setting)。
+这是源码候选，不认证安装采用、发布默认、完整共享 Goal 意图或 D2/D3；不重建
+创建／默认值 owner。
+
+canonical Todo 入口隔离（T4）：五种 mutation facade 统一进入既有
+`todos/mutation_api.py`；历史导入改为惰性，未迁移 writer 隔离在
+`todos/legacy_mutation.py`。安装态 File/SQLite 检查可物理移除整个 writer，验证
+生命周期及结算恢复。冷导入检查进一步组合审核导入、新租约下的更新／新增写入、
+原操作恢复，并保持整个 writer 不存在；显示源丢失或 provider 中断不能替换
+当前 authority 或抹去后续写入。原导入 cursor 仍是历史回执，当前 provider
+revision 保持。这为最后调用方删除建立边界，不宣称代码已退役：bootstrap、
+handoff、team-plan 和 Monitor 仍有受支持的旧源调用；capture/outbox 及历史恢复
+各等自己的出口。见[调用方及回滚清单](../../../../reference/canonical-todo-completion-update.md#canonical-mutation-entrypoint-isolation)。
+生产 Todo 消费者直接使用具体 owner：CLI 注册／操作、quota 与规划、
+能力写回、旧源租约读取及 Lark 源投影直接导入相同的 mutation、完整读取、路径或
+Markdown 显示 owner，不新增 wrapper、决策或 RPC。历史公开导入及其受支持的旧源
+IO 继续保留。隔离源码／正常 wheel 同时移除 facade、整个旧 Todo writer 和四个
+shadow producer，验证真实 File/SQLite CLI 生命周期、恰好一次结算、Monitor 重放
+及 App 冷导入／操作／重启；缺 provider／租约及源／备份变化须拒绝。Lark dry-run
+与 Explore 重放只验证本地消费者，不计 live 外部采用。
+此前调用方盘点后，[#5280](https://github.com/loopx-project/loopx/pull/5280) 新增的
+fresh research execution 又在函数内导入历史 facade；现直接导入既有
+`todos/list_readback.py`，保持相同 typed 当前 Todo 校验以及先于读取的历史重放。
+同一 facade 存在／缺席、源码／正常 wheel、File／SQLite 矩阵补 fresh 执行、
+actor／可运行状态／输入拒绝、精确 lineage 读回，以及当前输入／Todo 改变后的
+原观察重放。完整生产包 import 守卫解析相对导入与 alias，动态加载仍依赖真实
+隔离路径验证。新能力进入时持续守卫，不把历史库存当永久出口。最后受支持的
+旧源 writer、历史恢复、安装 cohort 与发布验收各自保持开放。
+
+保留的 import-compatible field writer 在既有 typed field plan 中统一等待条件
+归一化及矛盾 clear 拒绝；保持 Python 空白输入省略和锁内 IO，只退役重复的
+normalization crossing，不删除仍受支持的 writer 或迁移 reader。
+
+剩余 legacy writer 和 bootstrap 的 capture 适配器，在 runtime shadow 关闭且没有
+活跃持久 binding 时，跳过 rollout 历史读取和 Todo projector 构建。原源身份仍须
+解析；已有活跃 binding 即使配置关闭，也继续要求持久 prepare。普通旧源写入因此
+省去可选捕获工作，输出、历史保留及 outbox 恢复保持原契约。Python 保留这层
+Host IO 适配，直到最后受支持的源 writer 被替换；本批不代表整个 writer 退役或
+默认 provider 资格通过。
+未迁移 lease acquire 现在仅在 typed 结果带有 capture 请求时加载 capture 适配器。
+真实 CLI 与正常 wheel 检查覆盖领取／重放、陈旧续约拒绝、续约、转交及释放：没有
+启用 capture 或活跃 binding 时，可物理移除四个旧 shadow producer 模块。已有活跃
+binding 在移除配置后仍完成 capture。这只退役默认关闭时的依赖，不删除仍受支持的
+源 writer，也不结束待处理 capture／历史恢复窗口。
+
+handoff／continuation 显示决策已归入既有 TypeScript Todo context owner。summary
+在同一个 batch 复用已归一化的身份、claim、exclusion 和任务类型事实；index 在单个
+原生 batch 保留先压缩源、再标注、最后合并审计事件的顺序。planning 与 quota
+收集器整组投影已选记录。过大的显示上下文按字节预算分批读取，计数、依赖决策与
+闭合仍由完整源 owner 处理。超大单条历史记录复用既有私有快照传输，完整文本
+先进入凭证检查，再截断显示；不另加单条 frame 上限。Python facade 保留共享 metadata codec 和历史
+元组／SHA-1 身份编码，没有 Python 决策回退。nested-empty 优先级、Unicode 空白／
+codepoint 上限和截断前凭证拒绝都是需要保留的兼容义务。File／SQLite CLI 与正常
+wheel 的恢复验收要求：Markdown 显示缺失或选定 provider 不可用时，完整源与
+provider revision 仍被保留。这项读模型退役不等于受支持的 mutation／Host 调用方
+已删除，也不认证已发布的 SQLite 默认值。
+
+公开 Todo 创建现在以一次 typed creation-scope 调用组合 scope、受支持的等待条件和
+有界 Monitor metadata。旧 add writer 复用同次准备结果，独立 Markdown codec 与后继
+创建仍自行校验；priority 和 validation declaration 保留原错误顺序，canonical 事务
+仍复核 registry、claim、lease 和 CAS。本批只退出重复创建编排，不删除仍有调用方的
+Markdown writer、bootstrap、Host IO 或历史恢复路径；发布默认与整项退役验收保持独立。
+
+canonical team-plan 只在受支持的未迁移分支加载 capture 和 Markdown 编辑依赖。
+真实 File/SQLite Chat 及正常 wheel 的物理删源检查覆盖确认整批提交、后续写入后
+重放、provider 恢复、投影恢复和导入前历史回执。既有 TS 事务、源锁和投影 owner
+保持；旧批量 IO 的故障注入入口为当前消费方保留惰性加载。这是调用隔离出口，
+不等于删除活跃旧 writer，或完成 receiver adoption、Host 执行、PostgreSQL／D2
+资格。见[合同及保留义务](../../../../reference/canonical-todo-completion-update.md#team-plan-source-writer-isolation)。
+
+公开 CLI 的 shadow 配置归入 `coordination/configuration.py`，完整源捕获归入
+`coordination/authority_source_capture.py`；冷导入、源检查和历史 promotion 恢复
+复用保留 owner，只有显式开启的 shadow 动作加载旧 producer。隔离源码及正常
+wheel 的副本中物理删除四个 shadow producer 后，真实 CLI 仍覆盖新 Goal 默认
+SQLite、租约工作、一次结算及可回退出口，以及冷 File／SQLite 导入和原操作重放。
+旧模块为现有消费者保留 API 重导出；启用的 capture、outbox 和旧命令仍受支持。
+精确源身份、归档依赖、安全 lease 读取和后续写入恢复均须保留。本批移除提前导入
+阻塞；删除活跃 producer 仍须其最后调用方退出。App／Lark 合同、provider 事务、
+cohort 采用及冻结 D2 证据保持独立。
+
+Monitor router 同样隔离活跃旧源 writer；历史回执 codec／replay 共用 scheduler
+只读 IO owner，原操作身份和决策继续归既有 TS batch。File/SQLite CLI 与正常
+wheel 删源检查须保留后来写入及原 successor；晋升后重放保持旧 outbox 静止，
+未晋升的 markerless batch 恢复保留原有界 drain。业务回执重放不保证 shadow
+立即追平：锁延期或 proof 预算耗尽时保留待处理证据，由独立的
+`authority-shadow drain` 恢复。恢复须保持原 source bytes、successor ID 和 quota
+effect 恰好一次；不能为追平而重放 writer 或扩大 inline 上限。
+本批只移除 canonical 导入依赖，
+不删除受支持的旧 writer；缺席臂复用上述 CLI 启动隔离，同时移除四个 shadow
+producer module。
+见[保留义务及回滚](../../../../reference/canonical-todo-completion-update.md#monitor-source-writer-isolation)。
+
+shadow 诊断现在有独立只读边界：历史 outbox 磁盘 codec 位于
+`local_authority_shadow_history.py`，status／candidate read transport 位于
+`local_authority_shadow_readback.py`。公开 status 和启用的
+`coordination-shadow inspect`／`qualify`／`read-candidate` 直接调用保留 owner，
+不加载源 producer。源码和正常 wheel 物理删除四个 producer 后，完整读回保持
+匹配／拒绝、默认关闭、源漂移、store 缺失／损坏及恢复结果；历史 import 保留
+同一函数 alias，bootstrap／rollback／promotion 的活跃 adapter 继续受支持。
+既有 TS qualifier 保留 provider 读取失败，避免把损坏 journal 误称尚未
+bootstrap；正常／缺失状态保留原结果。这是明确的失败诊断修复，无新 RPC 或
+迁移权限；drain
+仍走现有 orchestration。原 entry 身份、损坏证据、cursor 残留和缺失 store 行为
+保持。Python 保留历史文件解码及展示 IO；TS 保留历史证明、投递与清理权限。
+旧 producer 的已有导入为支持调用方保留 alias，不复制实现。源码及正常 wheel
+的 File/SQLite 接收端检查，在 producer 存在／缺席两臂比较完整 status 响应和
+原文件字节。这是历史 reader 的退役前置，不代表 writer 删除、outbox 处置、
+安装 cohort 采用或发布默认资格。
+见[操作读回与回滚](../../../../reference/authority-observation-retirement.md#retained-readback-without-source-producers)。
+
+存量 Goal 迁移、两策略退役和格式升级仍各有独立回执及出口；原回执恢复不能成为
+保留 legacy 活跃策略的理由，必要迁移 reader 保留。
+
+导入后 canonical bootstrap 重连复用既有 typed authority reader，保留当前
+Todo、租约及原导入回执，避开 Markdown writer。File／SQLite 真实 CLI 覆盖旧
+v0 偏好指向另一 provider、显示缺失、选定权威丢失、force／改向拒绝，以及旧
+producer 不存在时的后续写入重放。Python 保留 bootstrap registry／Host IO，
+不新增决策 owner 或创建回执。本批关闭重连依赖，未关闭未晋升 writer、活跃
+outbox、Host 或发布默认验收。
+
+有界 cohort 在安装恢复和相关执行控制通过后可开始，不代表发布默认值或正式十天
+D2 已通过；冻结的失败／缺项保持可见。T4 随实现删除已证明重复的 owner，不等 R6
+或所有 Python 消失。本节替代陈旧的当前数量估算，不覆盖历史执行证据。
+
+公共扫描隐私检查点：保留的 Python 文件系统／正则 owner 在提交 reader 前分类
+canonical 输入，分类独立于显示路径。重叠扫描根不能移除私有分类；报告统一使用
+最宽的请求根。窄范围显式文件／目录保留私有祖先信息。经 Git 核验的 worktree
+即使位于私有父目录下，也保留自己的命名空间；仅名为 `.git` 的目录不构成例外。
+worktree 外、私有状态目录下的显式输入仍须排除。tracked 文件策略、每次重新
+解析的符号链接及既有错误规则均留在这个 owner，不新增第二份控制面决策源或
+配置项。这次安全修复不认证扫描耗时、SQLite 发布默认值或整个 T4 退役。CLI
+检查和 quota 准备复用此规则；App status 继续明确报告仓库扫描为 deferred。
diff --git a/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md b/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md
index 0d29ff4d0f..760d3fe807 100644
--- a/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md
+++ b/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md
@@ -11,6 +11,11 @@
 
 **S2/S12 启动诊断检查点（2026-10-04）** 已移至[执行账本](ledger/loopx-overall-roadmap-v0/2026-10-04-s2-s12-startup-diagnostic.zh-CN.md)。
 
+[PR #4376](https://github.com/loopx-project/loopx/pull/4376) 的对话式准备已在 R1/GQ01
+下整合到既有 Chat draft 与已审阅 Goal 创建路径，见
+[吸收映射](app-conversation-and-async-inbox-v0.zh-CN.md#对话式目标准备吸收团队工作台提案)。
+没有采用其独立 workspace/executor；入口改进不代表 GQ01 执行/回传或 R2 小队验收完成。
+
 ## 1. 总目标与产品路线
 
 LoopX 的目标是让人用本地前端或 Lark 提出、修订和验收复杂目标，由持久管家协调多个拥有独立工作承诺的长程 LoopX Agent，在本地 managed 与云端 runtime 上持续完成可验证的工作。单 Agent 的长程可靠性是基础，多个 Agent 的协作、handoff、恢复和共享目标收敛是核心能力，百 Agent 规模是需要独立证明的系统资格。
diff --git a/docs/architecture/rfcs/post-outcome-memory-utility-attribution-v0.zh-CN.md b/docs/architecture/rfcs/post-outcome-memory-utility-attribution-v0.zh-CN.md
index 8d1d03216c..c01822153f 100644
--- a/docs/architecture/rfcs/post-outcome-memory-utility-attribution-v0.zh-CN.md
+++ b/docs/architecture/rfcs/post-outcome-memory-utility-attribution-v0.zh-CN.md
@@ -316,6 +316,13 @@ baseline/experience 两组，包含合理内部前置阶段与误阻断对照。
 
 ## 10. 验证标准
 
+Agent binding 前置能力复用现有 Reward Memory 配置 owner：可选的精确 Agent 覆盖保留
+legacy/shared 路由与全部 sibling，禁用或非法覆盖失败关闭。配置、runtime 准入、同 Turn
+receipt 复用及 pending outcome 对账共享 binding 身份；有界重试先选择当前路由再应用
+上限，保留其他路由的不确定 journal。provider 可写性与精确读回仍是必需条件。
+Goal 设置旅程复用相同 preview/apply owner，并区分已提交配置和失败读回。这只验证
+配置与生命周期，不代表 Stage 3/4 效用或排序资格。
+
 Focused fixture 必须证明：
 
 - 记忆即使被 `applied`，在 artifact evidence 反驳时仍可判为 `harmful`；
diff --git a/docs/architecture/rfcs/shared-goal-authority-state-provider-v0.zh-CN.md b/docs/architecture/rfcs/shared-goal-authority-state-provider-v0.zh-CN.md
index 0c9b58aa03..cf0de13d97 100644
--- a/docs/architecture/rfcs/shared-goal-authority-state-provider-v0.zh-CN.md
+++ b/docs/architecture/rfcs/shared-goal-authority-state-provider-v0.zh-CN.md
@@ -858,6 +858,39 @@ transition、claim/lease fencing、Turn admission、quota 语义、settlement 
 receipt 的含义。特别是，adapter 不得把 provider transaction result 重新解释为领域
 判断。
 
+Stage 1 TS 合同显式区分读取失败：已证明 head `missing` 不同于存储 `unavailable`；
+字节损坏或 lineage 无效是 `failed`。只有已证明不存在才允许 bootstrap。提交保留封闭
+结果 `applied | conflict | ambiguous | failed`；`ambiguous` 表示已尝试发布却无法从响应
+证明耐久性，须通过 `read_receipt` 和新鲜 head 读回对账。provider 异常或可读错误串
+从不构成提交证明。
+
+三种 adapter 用不同原生机制实现同一逻辑操作，不把它们当成可互换的数据库：
+
+| 事项 | File Stage 1 | NoKV Stage 2A | PostgreSQL Stage 2B |
+| --- | --- | --- | --- |
+| 条件 revision | 跨进程文档锁内比较 revision chain | compare-and-publish 携带路径 `generation` | 每 tenant/Goal head-row revision，在行锁或条件更新下检查 |
+| 原子 event/projection/receipt 提交 | 完整 journal 文档，文件 fsync、原子 rename、目录 fsync | 单个 generation-CAS envelope；在多记录协议合格前内嵌 receipt/scan 数据 | 一个 SQL 事务更新 head 并插入有序 event/receipt 行 |
+| operation 唯一性 | 保留 journal 拒绝重复 `operation_id` | CAS envelope 中的 authority receipt index | 唯一 `(tenant_id, goal_id, operation_id)` 约束，只作存储 fencing，不作领域判断 |
+| cursor | 文档局部单调递增 opaque string | 内嵌 journal cursor，仍待容量验收 | 在同一事务分配每 Goal 序号，不声称全局顺序 |
+| lineage | 持久目录 `store-identity` | workbench 与永不复用的 `workspace_incarnation_id` | 绑定 provider 部署的服务管理数据库 incarnation |
+| 信任边界 | 受信任嵌入式 LoopX 进程 | LoopX authority 持有的 NoKV 凭证 | 经认证的 tenant 作用域服务角色，Agent 不接收数据库表凭证 |
+
+PostgreSQL 的 `commit_authority` 是一个事务：锁定或条件更新 scoped head、核验预期
+provider revision、分配下一 scoped cursor、写入 transaction/event/receipt、更新
+projection head 后提交。任何写入前的连接失败是可证明的 `failed`；可能开始提交后的
+断连是 `ambiguous`，经唯一 operation 行与 receipt 读回对账。`READ COMMITTED` 配合
+显式 head 行锁/条件更新可以实现此合同；选择 `SERIALIZABLE` 是 adapter 决策，不能
+替代 LoopX CAS、operation identity 或 lease fencing。认证、tenant routing、audit、
+连接池耗尽、取消、超时与 failover 在服务边界均须失败关闭。
+
+NoKV 现有 `load` / `compare_and_put` 参考实现映射缺失、generation 冲突、不确定发布
+及 workbench incarnation lineage，尚未证明扩展的 event/receipt/cursor 服务合同。
+容量、保留、重启/恢复、可用性与 HA 合格前，`read_receipt` 与 `scan_committed` 只能
+读取单个 CAS envelope 内保留的 journal，不能静默映射为最终一致 listing API。
+File provider 因此是一致性证据，不是生产级事件存储。完整 journal 便于检查原子性和
+历史 receipt replay，代价是整文档增长；Stage 1 可接受的取舍不能直接成为 PostgreSQL
+物理 schema 或 NoKV 容量证明。
+
 ### 6.3 三个版本号不是一回事
 
 | 版本域 | Owner | 含义 | Consumer |
@@ -2100,6 +2133,24 @@ provider 合同与 file backend 已落地，第一个 Stage 2C 提交后 runtime
 shadow 读取决策，上述 migration、rollback、parity、read flip 与 legacy-writer fencing
 门禁仍然开放。
 
+### Deferred hard-lease 生命周期澄清（2026-09-23）
+
+上述终态租约门禁适用于处于 `open` 的执行型 Todo。`deferred` Todo 在等待期间本就
+无法取得 hard lease，若仍要求先持有租约才能离开等待态，负责人既不能恢复也不能
+终止该等待。对于已晋级的 `hard_lease` Goal，已注册且具备该 Todo 所有权的 Agent
+可以显式执行 `status=open` 加 `clear_resume_when`，或将该 deferred 等待标记为
+superseded；前提是没有仍在有效期内的租约，也未提交旧执行租约凭证。Provider CAS
+会把遗留的过期租约代际与 Todo 状态一并更新。重新打开不授予执行权限，下一次
+执行必须重新获取租约。`complete`、挤占有效租约、跨负责人修改及混入执行内容的
+更新仍受原有门禁约束。
+
+反向转换同样由当前 claim/lease 持有者凭有效证明，原子延期开放 Todo、写明等待及原因
+并释放当前执行代际，不混入工作内容或所有权修改。legacy 模式保留的租约 lineage
+也遵守此规则，重新打开要求无有效持有者。同一 TS owner 和 provider CAS 保留 receipt
+及重试。延期后的已注册 Todo/monitor 等待仍可按原 Turn 身份完成无扣额阻塞结算，见
+[因果收尾](../../reference/protocols/quota-blocked-causal-closeout-v0.md)。这只关闭 S3
+owner 等待生命周期缺口，不代表通用 shared amendment 或 SQLite 默认准入合格。
+
 ### 与分阶段交付的关系
 
 对应 #2787 评审结论中的五阶段计划：先在 characterization 阶段把今天的真实行为
@@ -2432,6 +2483,15 @@ D1–D3 与永久投影规划不变。
 
 **D1 — 资格化永久投影交付，可与 T1/T2 重叠推进。**
 
+周期报告 staging、live editorial fallback 与批准重试现共用一份 canonical-first Todo
+来源，frontier/progress 从同一完整求值 snapshot 选择，缺失/过期展示不能制造或隐藏工作。
+`capabilities/periodic_report_progress.ts` 拥有报告选择和拒绝重试排序，删除 Python
+选择/排序循环。带 offset 的时刻保留微秒，canonical 归档拒绝记录仍有效，显式 runtime-root
+同时作用于 intent 与 Todo IO；冻结 editorial 请求保留原 basis。见
+[操作与边界](../../../loopx/capabilities/periodic_report/README.md#todo-authority-and-report-retries)。
+这只关闭 T3/L5 的该消费者族，不代表 D1 永久展示新鲜度、D2 持久性、D3 整 Goal 资格或
+默认 provider 选择。当前核对清单继续区分代码缺口与资格验证工作。
+
 Todo 摘要现由一个 TS 批次决定范围、lanes、计数、claim 展示分配和收尾证明，删除
 Python 的重复汇总分支及分离的 lane／closure 内部调用。最近完成按真实完成时刻排序，
 不把编辑时间或 ISO 字符串顺序当作完成顺序；partial 来源不能在再次筛选后重新取得
diff --git a/docs/architecture/rfcs/typescript-control-plane-migration-v0.md b/docs/architecture/rfcs/typescript-control-plane-migration-v0.md
index d7cf4aa525..013a166445 100644
--- a/docs/architecture/rfcs/typescript-control-plane-migration-v0.md
+++ b/docs/architecture/rfcs/typescript-control-plane-migration-v0.md
@@ -78,253 +78,7 @@ and [combined-tree evidence](https://github.com/loopx-project/loopx/pull/6396#is
 retain their source revisions; they do not certify an untested later head/base,
 a completed installed cohort or all RFC acceptance.
 
-### Historical 1.x prerequisite checkpoints (through 2026-10-12)
-
-The following records explain the prerequisites and validation at their named
-sources. Their references to reachable writers and a “next” cutoff describe
-that 1.x baseline, not remaining implementation work in the candidate above.
-
-Rechecked at main `38cb407ed`: #5413/#5466/#5283 and the affected creation,
-Host-stop and UI-history owners #5500/#5805/#5308/#5398 are merged. Reuse
-their delivered boundaries rather than reopening the October 2 merge queue.
-The [current validation, migration and deletion plan](ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.md#current-closeout-validation-migration-and-deletion-2026-10-02)
-now prioritizes installed reversible qualification, affected consumer adoption,
-policy migration and last-caller deletion; it records the merged sources and
-the remaining evidence separately.
-
-Canonical new-Goal creation is already implemented by #5500/#5805. The existing
-machine setting and `coordination/local_authority_defaults.ts` choose canonical
-SQLite with `hard_lease` for unconfigured new Goals; CLI bootstrap and App
-creation share the typed initialization and original-operation recovery owner.
-Explicit v0 settings and v1 `canonical_creation=false` preserve post-promotion
-target behavior. Existing Goals keep their recorded selection. See the
-[configuration and disable contract](../../reference/local-authority-provider-selection.md#new-goal-authority-machine-setting).
-This is the source candidate, not certification of installed adoption, a released
-default, full shared Goal intent or D2/D3. Do not rebuild a creation/default owner.
-
-Canonical Todo entrypoint separation (T4): all five mutation facades now share
-`todos/mutation_api.py`; historic imports are lazy and the unpromoted writer is
-isolated in `todos/legacy_mutation.py`. The installed File/SQLite oracle can
-remove the whole writer module while exercising lifecycle and settlement
-recovery. The cold-import oracle now composes reviewed import, fresh leased
-updates/new writes and original-operation recovery with that writer absent;
-source-display loss and provider outage cannot replace the current authority
-or erase later writes. The original import cursor remains historical while the
-current provider revision is preserved. This prepares last-caller deletion
-without claiming code retirement:
-bootstrap, handoff, team-plan and Monitor still have supported source callers;
-keep capture/outbox and historical recovery until their own exits. [Caller and
-rollback inventory](../../reference/canonical-todo-completion-update.md#canonical-mutation-entrypoint-isolation).
-Production Todo consumers use the concrete owners instead of the historic `loopx.todos` re-export:
-CLI registration/actions, quota and planning, capability writeback, source lease
-reads and the Lark source projection import the same concrete mutation, full-read,
-path or Markdown display owners. No new wrapper, decision or RPC is introduced.
-The historic public imports and their supported unpromoted IO remain available.
-Disposable source/normal-wheel probes remove the facade, the whole legacy Todo
-writer and four shadow producers together; real File/SQLite CLI lifecycle,
-once-only settlement, Monitor replay and App cold-import/action/restart journeys
-must still work, with missing-provider/lease and changed-source/backup refusals.
-The App HTTP receiver now also removes `bootstrap.py` from that same copied
-distribution and checks the complete removed set before each server start,
-restart and auxiliary CLI. Separate fixture results cannot prove this combined
-absence. The ordinary canonical CLI creation entrypoint remains with its owner;
-removing it from the cold-import receiver is a disposable qualification probe,
-not a supported package format or permission to break the additive 1.x line.
-中文：App 冷导入、后续写入和重启使用同一份缺少旧入口、writer 与 source producer 的
-隔离副本；不能拼接两组各自缺少一部分模块的结果。正常 canonical 创建仍保留其
-现有入口，这个临时卸除验收不等于已完成整族退役、自然试用或正式安装采用。
-Lark dry-run and Explore replay qualify local consumers only, not live external
-adoption. The fresh research execution path added by [#5280](https://github.com/loopx-project/loopx/pull/5280)
-reintroduced a function-local historic import after the earlier caller inventory.
-It now imports `todos/list_readback.py` directly, preserving the same typed
-current-Todo validation and the historical replay branch before that read.
-The qualification includes fresh research execution, actor/runnable/input
-refusals, exact lineage readback and replay after current input/Todo changes
-in the same facade-present/absent source and normal-wheel File/SQLite matrix.
-A whole-production Python import guard resolves relative imports and aliases;
-dynamic loading still requires the isolated real journeys. Keep this guard as
-new capabilities arrive, rather than treating a past inventory as a permanent
-exit. Last supported source writers, historical recovery, installed cohort
-and release exits remain independently open.
-
-The next T4 package is the [import-first normal-writer cutoff](../../reference/local-authority-provider-selection.md#proposed-compatibility-cutoff-and-release-sequence),
-not another re-export or producer-loading extraction. At `38cb407ed`, live
-unpromoted callers remain in ordinary mutation, bootstrap/creation opt-out,
-team-plan, Monitor, ownership/source lease and active capture/binding. Reuse
-their typed admission/transaction owners; treat retained source capture,
-historical receipts and permanent document IO as recovery obligations.
-The existing delivery Todos should carry these concrete exits:
-
-- Qualify the installed import/backup/recovery journey for the declared source
-  matrix; importer implementation is already present and is not a missing-code
-  dependency. Do not reinterpret complete coordination backup as complete Goal
-  backup.
-- Run the bounded reversible core-developer SQLite trial before the breaking
-  cutoff, recording real Host adoption/use separately from conversion drills.
-- Deliver the cohesive 2.0 normal-writer cutoff: fresh unmigrated writes and
-  execution grants refuse before effects; canonical work and original-operation
-  recovery pass with the old writer physically absent. Keep the additive 1.x
-  import/deprecation line compatible.
-  Admission must preserve original lease release and receipt/outbox recovery
-  before import; denying the existing shared legacy fence indiscriminately
-  would also block these prerequisites. Remove the Python missing-fence bypass
-  with the typed cutoff and validate the combined recovery-to-import journey
-  specified in the linked release contract.
-- After the last source caller exits, reconcile pending outboxes and delete
-  unused capture producers/private decisions together. Keep supported historical
-  readers and current-head rollback; do not wait for every external user to
-  migrate or claim full T4/D2/default qualification from internal deletion.
-
-This updates the existing R5/T4 frontier and release proposal; it creates no
-parallel migration owner, runtime gate or release activation.
-
-Team-plan recovery prerequisite: an unpromoted plan that published its original
-receipt can now recover through the Chat confirmation owner while shadow
-bootstrap is interrupted. Registry/Todo/source locks still protect the read,
-and the existing typed identity validator rejects changed intent, actor or
-reviewed basis. Recovery verifies source durability without loading the capture
-producer or admitting new writes; fresh plans still obey all source, management
-and promotion guards. This repairs the existing 1.x recovery path and does not
-activate the 2.0 cutoff or settle the remaining lease/outbox/Host obligations.
-
-
-The retained import-compatible field writer now composes resume normalization
-and contradictory-clear rejection in its existing typed field plan. Keep blank
-Python input omission and locked IO; retire the duplicate normalization crossing,
-not the still-supported writer or migration reader.
-
-The remaining legacy writer and bootstrap capture adapter now avoids loading
-rollout history and constructing a Todo projector when runtime shadow is off
-and there is no active durable binding. It still resolves the source identity;
-an active binding continues to require durable preparation even after config
-is disabled. This removes optional capture work from ordinary legacy writes,
-without changing their output, history retention or outbox recovery. Python
-retains this Host IO adapter until its last supported source writer is replaced;
-this is neither whole-writer retirement nor default-provider qualification.
-Unpromoted lease acquire now loads the capture adapter only when the typed
-result carries a capture request. The real CLI and normal-wheel oracle cover
-acquire/replay, rejected stale renewal, renewal, transfer and release with the
-four legacy shadow producer modules physically absent and with no enabled
-capture or active binding. An active binding still delivers capture after the
-setting is removed. This retires a default-off dependency, not the supported
-source writer or pending capture/history recovery.
-
-Handoff/continuation display decisions now belong to the existing TypeScript Todo
-context owner. Summary reuses its normalized identity/claim/exclusion/class
-facts in one batch; the index keeps source compaction before labelling and audit
-merging in one native batch. Planning and quota collectors project whole chosen
-sets. Oversized display context uses byte-bounded read-lens batches while
-counts, dependency decisions and closure retain their full-source owner. A
-single oversized historical record reuses the existing private snapshot transport:
-credential checks see its full text before display truncation. The
-Python facade keeps shared metadata codecs and historical tuple/SHA-1 identity
-encoding, with no Python decision fallback. Retain nested-empty precedence,
-Unicode whitespace/codepoint limits and credential rejection before truncation;
-these are compatibility obligations. File/SQLite CLI and normal-wheel recovery
-must preserve exact source and provider revision when Markdown display is absent
-or the selected provider is unavailable. This read-model retirement does not
-retire the supported mutation/Host callers or certify a released SQLite default.
-
-Public add now composes scope, supported wait and bounded Monitor metadata in
-one typed creation-scope request. The legacy add writer consumes that same
-fresh draft rather than re-planning it; standalone line codecs and successor
-creation retain their own admission. Priority and validation-declaration
-checks keep their prior diagnostic order, and canonical provider transactions
-still recheck registry/claim/lease/CAS authority. This retires duplicate add
-composition, not the supported Markdown writer or bootstrap/Host/history IO.
-
-The canonical team-plan caller now loads capture and Markdown editing only in
-its supported unpromoted arm. Real File/SQLite Chat and normal-wheel source
-removal cover confirmed batch commit, later-write replay, provider restoration,
-projection recovery and imported historical receipts. The existing TS
-transaction, source guards and projection owner remain unchanged; the legacy
-batch IO instrumentation seam stays lazy for its current consumers. This is a
-caller-isolation exit, not deletion of the live legacy writer or completion of
-receiver adoption, Host execution, PostgreSQL or D2 qualification.
-[Contract and retained duties](../../reference/canonical-todo-completion-update.md#team-plan-source-writer-isolation).
-
-Public CLI isolation now keeps shadow configuration in `coordination/configuration.py`
-and complete source capture in `coordination/authority_source_capture.py`. Cold import,
-source inspection and historical promotion recovery reuse those retained owners;
-only explicit enabled shadow actions load the old producers. Ordinary new-Goal
-SQLite creation, leased work, once-only settlement and reversible exit, plus cold
-File/SQLite import and original-operation replay, run through the real CLI with
-all four shadow producers physically absent in disposable source/normal-wheel
-copies. The old module still re-exports the retained APIs for current consumers;
-enabled capture, outbox and legacy commands remain supported. Preserve exact
-source identity, archive dependencies, safe lease reads and later-write recovery.
-This removes an eager-import blocker; deleting live producers still requires
-their last-caller exit. App/Lark contracts, provider transactions, cohort adoption
-and frozen D2 evidence remain separate.
-
-The Monitor router likewise isolates its live source writer. Historical receipt
-codec/replay has a small shared scheduler IO owner, while the existing TS batch
-still owns operation identity and decisions. File/SQLite CLI and normal-wheel
-source removal must preserve later canonical writes and original successors;
-promoted replay leaves old outbox bytes inert. Unpromoted markerless batch
-recovery retains its existing bounded drain. Business-receipt replay does not
-guarantee shadow catch-up: lock deferral or an expired proof budget preserves
-pending evidence for an independent `authority-shadow drain`. Recovery keeps
-the original source bytes, successor IDs and once-only quota effect; it does
-not replay the writer to finish catch-up or increase the inline limits.
-This removes a canonical import dependency,
-not the supported legacy writer. The absent arm also removes all four shadow
-producer modules using the qualified CLI startup isolation above.
-[Retained duties and rollback](../../reference/canonical-todo-completion-update.md#monitor-source-writer-isolation).
-
-Shadow diagnostics now have an independent read-only boundary: retained outbox
-disk codecs live in `local_authority_shadow_history.py`, and status/candidate
-read transport in `local_authority_shadow_readback.py`. The public status and enabled
-`coordination-shadow inspect`/`qualify`/`read-candidate` commands call that owner
-without loading source producers. Full source and normal-wheel observations
-retain matched/refused, default-off, source-drift and missing/corrupt-store
-recovery behavior with all four producer modules absent. Historical imports
-remain exact aliases; bootstrap, rollback and promotion retain their live adapter.
-The existing TS qualifier now propagates provider read refusals before lineage
-validation can mislabel corruption as `bootstrap_required`; valid/missing stores
-retain their behavior. This is an explicit failure-diagnostic correction, with
-no new RPC or migration authority; drain still uses its existing orchestration.
-Original entry identity, malformed evidence, cursor residue and missing-store
-behavior remain unchanged. Python retains historical filesystem decoding and
-presentation IO; TS retains history proof, delivery and cleanup authority.
-Existing producer imports are aliases for supported callers, not duplicate
-implementations. Source and normal-wheel File/SQLite recipient checks compare
-complete status results and unchanged original bytes with producers present or
-absent. This is a historical-reader exit prerequisite, not writer deletion,
-outbox disposition, installed cohort adoption or release-default qualification.
-See [operator readback and rollback](../../reference/authority-observation-retirement.md#retained-readback-without-source-producers).
-
-Existing Goal migration, two-policy ownership retirement and storage-format
-upgrade retain separate receipts and exits. Original-receipt recovery does not
-justify retaining `legacy` as a live policy. Required migration readers remain.
-
-Imported canonical bootstrap reconnect now reuses the existing typed authority
-reader, keeping current Todos, leases and original import receipts without
-entering the Markdown writer. File/SQLite real CLI coverage includes an old v0
-preference naming the other provider, missing display, missing selected authority,
-force/route rejection and later-write replay with legacy producers absent.
-Python retains bootstrap registry/Host IO; it adds no decision owner or creation
-receipt. This closes a reconnect dependency, not the remaining unpromoted writer,
-active outbox, Host or release-default acceptance.
-
-A bounded cohort can start after its installed recovery and relevant execution
-controls pass; it does not certify a released default or formal ten-day D2.
-Frozen failures/missing evidence remain visible. T4 deletes proven redundant
-owners alongside implementation, without waiting for R6 or all Python to vanish.
-This replaces stale current-count estimates, not historical execution evidence.
-
-Public-scan privacy checkpoint: the retained Python filesystem/regex owner
-classifies canonical inputs before reader submission, independently of display
-paths. Overlapping roots cannot remove a private classification; reports use the
-widest requested root consistently. Narrow explicit files/directories retain
-private ancestry. Git-verified worktrees remain their own namespace beneath
-private parent directories, while a directory merely named `.git` grants no
-exception. Outside a worktree, explicit inputs beneath private state remain
-excluded. Tracked-file policy, fresh symlink resolution and existing error rules
-remain in this owner; no second control-plane decision source or new setting is
-introduced. This safety repair does not qualify scanner latency, SQLite release
-defaults or whole T4 retirement. CLI checks and quota preparation use the rule;
-App status continues to report repository scanning as deferred.
+Checkpoint moved to the execution ledger: [1.x prerequisites through 2026-10-12](ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.md).
 
 ## Native authority qualification and prototype retirement (2026-09-26)
 
diff --git a/docs/architecture/rfcs/typescript-control-plane-migration-v0.zh-CN.md b/docs/architecture/rfcs/typescript-control-plane-migration-v0.zh-CN.md
index 4a7cc6dfe2..f2c71e6b0c 100644
--- a/docs/architecture/rfcs/typescript-control-plane-migration-v0.zh-CN.md
+++ b/docs/architecture/rfcs/typescript-control-plane-migration-v0.zh-CN.md
@@ -67,154 +67,16 @@ acquire／维护及当前 proof 授权，包括 delegation 启动／恢复；历
 和[组合 tree 证据](https://github.com/loopx-project/loopx/pull/6396#issuecomment-6195855339)
 各自保留源码 revision，不认证未验证的后续 head／base、安装 cohort 或全部 RFC 验收。
 
-### 历史 1.x 前置 checkpoint（截至 2026-10-12）
-
-以下记录解释具名源码上的前置条件与验证。“writer 仍可达”及“下一次截止”
-描述当时的 1.x 基线，不是上方候选仍未实现的工作。
-
-按 main `06b6caa07` 复核，#5413/#5466/#5283，以及创建、Host 停止、UI 历史
-相关 owner #5500/#5805/#5308/#5398 均已合并。复用各自已交付的边界，不重开
-10 月 2 日的合并队列。
-[当前验证、迁移与删除计划](ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.zh-CN.md#当前收尾验证迁移与删除2026-10-02)
-现在优先安装态可回退验证、相关消费者采用、策略迁移及最后调用方删除，并分别
-记录已合并源码和仍缺的证据。
-
-#5500/#5805 已实现 canonical 新 Goal 创建。既有机器设置与
-`coordination/local_authority_defaults.ts` 为未配置的新 Goal 选择 canonical
-SQLite／`hard_lease`；CLI bootstrap 和 App 创建共享 typed 初始化及原操作恢复
-owner。显式 v0 设置和 v1 `canonical_creation=false` 保留晋升后目标行为；存量
-Goal 保持已记录的选择。见[配置及关闭契约](../../reference/local-authority-provider-selection.md#new-goal-authority-machine-setting)。
-这是源码候选，不认证安装采用、发布默认、完整共享 Goal 意图或 D2/D3；不重建
-创建／默认值 owner。
-
-canonical Todo 入口隔离（T4）：五种 mutation facade 统一进入既有
-`todos/mutation_api.py`；历史导入改为惰性，未迁移 writer 隔离在
-`todos/legacy_mutation.py`。安装态 File/SQLite 检查可物理移除整个 writer，验证
-生命周期及结算恢复。冷导入检查进一步组合审核导入、新租约下的更新／新增写入、
-原操作恢复，并保持整个 writer 不存在；显示源丢失或 provider 中断不能替换
-当前 authority 或抹去后续写入。原导入 cursor 仍是历史回执，当前 provider
-revision 保持。这为最后调用方删除建立边界，不宣称代码已退役：bootstrap、
-handoff、team-plan 和 Monitor 仍有受支持的旧源调用；capture/outbox 及历史恢复
-各等自己的出口。见[调用方及回滚清单](../../reference/canonical-todo-completion-update.md#canonical-mutation-entrypoint-isolation)。
-生产 Todo 消费者直接使用具体 owner：CLI 注册／操作、quota 与规划、
-能力写回、旧源租约读取及 Lark 源投影直接导入相同的 mutation、完整读取、路径或
-Markdown 显示 owner，不新增 wrapper、决策或 RPC。历史公开导入及其受支持的旧源
-IO 继续保留。隔离源码／正常 wheel 同时移除 facade、整个旧 Todo writer 和四个
-shadow producer，验证真实 File/SQLite CLI 生命周期、恰好一次结算、Monitor 重放
-及 App 冷导入／操作／重启；缺 provider／租约及源／备份变化须拒绝。Lark dry-run
-与 Explore 重放只验证本地消费者，不计 live 外部采用。
-此前调用方盘点后，[#5280](https://github.com/loopx-project/loopx/pull/5280) 新增的
-fresh research execution 又在函数内导入历史 facade；现直接导入既有
-`todos/list_readback.py`，保持相同 typed 当前 Todo 校验以及先于读取的历史重放。
-同一 facade 存在／缺席、源码／正常 wheel、File／SQLite 矩阵补 fresh 执行、
-actor／可运行状态／输入拒绝、精确 lineage 读回，以及当前输入／Todo 改变后的
-原观察重放。完整生产包 import 守卫解析相对导入与 alias，动态加载仍依赖真实
-隔离路径验证。新能力进入时持续守卫，不把历史库存当永久出口。最后受支持的
-旧源 writer、历史恢复、安装 cohort 与发布验收各自保持开放。
-
-保留的 import-compatible field writer 在既有 typed field plan 中统一等待条件
-归一化及矛盾 clear 拒绝；保持 Python 空白输入省略和锁内 IO，只退役重复的
-normalization crossing，不删除仍受支持的 writer 或迁移 reader。
-
-剩余 legacy writer 和 bootstrap 的 capture 适配器，在 runtime shadow 关闭且没有
-活跃持久 binding 时，跳过 rollout 历史读取和 Todo projector 构建。原源身份仍须
-解析；已有活跃 binding 即使配置关闭，也继续要求持久 prepare。普通旧源写入因此
-省去可选捕获工作，输出、历史保留及 outbox 恢复保持原契约。Python 保留这层
-Host IO 适配，直到最后受支持的源 writer 被替换；本批不代表整个 writer 退役或
-默认 provider 资格通过。
-未迁移 lease acquire 现在仅在 typed 结果带有 capture 请求时加载 capture 适配器。
-真实 CLI 与正常 wheel 检查覆盖领取／重放、陈旧续约拒绝、续约、转交及释放：没有
-启用 capture 或活跃 binding 时，可物理移除四个旧 shadow producer 模块。已有活跃
-binding 在移除配置后仍完成 capture。这只退役默认关闭时的依赖，不删除仍受支持的
-源 writer，也不结束待处理 capture／历史恢复窗口。
-
-handoff／continuation 显示决策已归入既有 TypeScript Todo context owner。summary
-在同一个 batch 复用已归一化的身份、claim、exclusion 和任务类型事实；index 在单个
-原生 batch 保留先压缩源、再标注、最后合并审计事件的顺序。planning 与 quota
-收集器整组投影已选记录。过大的显示上下文按字节预算分批读取，计数、依赖决策与
-闭合仍由完整源 owner 处理。超大单条历史记录复用既有私有快照传输，完整文本
-先进入凭证检查，再截断显示；不另加单条 frame 上限。Python facade 保留共享 metadata codec 和历史
-元组／SHA-1 身份编码，没有 Python 决策回退。nested-empty 优先级、Unicode 空白／
-codepoint 上限和截断前凭证拒绝都是需要保留的兼容义务。File／SQLite CLI 与正常
-wheel 的恢复验收要求：Markdown 显示缺失或选定 provider 不可用时，完整源与
-provider revision 仍被保留。这项读模型退役不等于受支持的 mutation／Host 调用方
-已删除，也不认证已发布的 SQLite 默认值。
-
-公开 Todo 创建现在以一次 typed creation-scope 调用组合 scope、受支持的等待条件和
-有界 Monitor metadata。旧 add writer 复用同次准备结果，独立 Markdown codec 与后继
-创建仍自行校验；priority 和 validation declaration 保留原错误顺序，canonical 事务
-仍复核 registry、claim、lease 和 CAS。本批只退出重复创建编排，不删除仍有调用方的
-Markdown writer、bootstrap、Host IO 或历史恢复路径；发布默认与整项退役验收保持独立。
-
-canonical team-plan 只在受支持的未迁移分支加载 capture 和 Markdown 编辑依赖。
-真实 File/SQLite Chat 及正常 wheel 的物理删源检查覆盖确认整批提交、后续写入后
-重放、provider 恢复、投影恢复和导入前历史回执。既有 TS 事务、源锁和投影 owner
-保持；旧批量 IO 的故障注入入口为当前消费方保留惰性加载。这是调用隔离出口，
-不等于删除活跃旧 writer，或完成 receiver adoption、Host 执行、PostgreSQL／D2
-资格。见[合同及保留义务](../../reference/canonical-todo-completion-update.md#team-plan-source-writer-isolation)。
-
-公开 CLI 的 shadow 配置归入 `coordination/configuration.py`，完整源捕获归入
-`coordination/authority_source_capture.py`；冷导入、源检查和历史 promotion 恢复
-复用保留 owner，只有显式开启的 shadow 动作加载旧 producer。隔离源码及正常
-wheel 的副本中物理删除四个 shadow producer 后，真实 CLI 仍覆盖新 Goal 默认
-SQLite、租约工作、一次结算及可回退出口，以及冷 File／SQLite 导入和原操作重放。
-旧模块为现有消费者保留 API 重导出；启用的 capture、outbox 和旧命令仍受支持。
-精确源身份、归档依赖、安全 lease 读取和后续写入恢复均须保留。本批移除提前导入
-阻塞；删除活跃 producer 仍须其最后调用方退出。App／Lark 合同、provider 事务、
-cohort 采用及冻结 D2 证据保持独立。
-
-Monitor router 同样隔离活跃旧源 writer；历史回执 codec／replay 共用 scheduler
-只读 IO owner，原操作身份和决策继续归既有 TS batch。File/SQLite CLI 与正常
-wheel 删源检查须保留后来写入及原 successor；晋升后重放保持旧 outbox 静止，
-未晋升的 markerless batch 恢复保留原有界 drain。业务回执重放不保证 shadow
-立即追平：锁延期或 proof 预算耗尽时保留待处理证据，由独立的
-`authority-shadow drain` 恢复。恢复须保持原 source bytes、successor ID 和 quota
-effect 恰好一次；不能为追平而重放 writer 或扩大 inline 上限。
-本批只移除 canonical 导入依赖，
-不删除受支持的旧 writer；缺席臂复用上述 CLI 启动隔离，同时移除四个 shadow
-producer module。
-见[保留义务及回滚](../../reference/canonical-todo-completion-update.md#monitor-source-writer-isolation)。
-
-shadow 诊断现在有独立只读边界：历史 outbox 磁盘 codec 位于
-`local_authority_shadow_history.py`，status／candidate read transport 位于
-`local_authority_shadow_readback.py`。公开 status 和启用的
-`coordination-shadow inspect`／`qualify`／`read-candidate` 直接调用保留 owner，
-不加载源 producer。源码和正常 wheel 物理删除四个 producer 后，完整读回保持
-匹配／拒绝、默认关闭、源漂移、store 缺失／损坏及恢复结果；历史 import 保留
-同一函数 alias，bootstrap／rollback／promotion 的活跃 adapter 继续受支持。
-既有 TS qualifier 保留 provider 读取失败，避免把损坏 journal 误称尚未
-bootstrap；正常／缺失状态保留原结果。这是明确的失败诊断修复，无新 RPC 或
-迁移权限；drain
-仍走现有 orchestration。原 entry 身份、损坏证据、cursor 残留和缺失 store 行为
-保持。Python 保留历史文件解码及展示 IO；TS 保留历史证明、投递与清理权限。
-旧 producer 的已有导入为支持调用方保留 alias，不复制实现。源码及正常 wheel
-的 File/SQLite 接收端检查，在 producer 存在／缺席两臂比较完整 status 响应和
-原文件字节。这是历史 reader 的退役前置，不代表 writer 删除、outbox 处置、
-安装 cohort 采用或发布默认资格。
-见[操作读回与回滚](../../reference/authority-observation-retirement.md#retained-readback-without-source-producers)。
-
-存量 Goal 迁移、两策略退役和格式升级仍各有独立回执及出口；原回执恢复不能成为
-保留 legacy 活跃策略的理由，必要迁移 reader 保留。
-
-导入后 canonical bootstrap 重连复用既有 typed authority reader，保留当前
-Todo、租约及原导入回执，避开 Markdown writer。File／SQLite 真实 CLI 覆盖旧
-v0 偏好指向另一 provider、显示缺失、选定权威丢失、force／改向拒绝，以及旧
-producer 不存在时的后续写入重放。Python 保留 bootstrap registry／Host IO，
-不新增决策 owner 或创建回执。本批关闭重连依赖，未关闭未晋升 writer、活跃
-outbox、Host 或发布默认验收。
-
-有界 cohort 在安装恢复和相关执行控制通过后可开始，不代表发布默认值或正式十天
-D2 已通过；冻结的失败／缺项保持可见。T4 随实现删除已证明重复的 owner，不等 R6
-或所有 Python 消失。本节替代陈旧的当前数量估算，不覆盖历史执行证据。
-
-公共扫描隐私检查点：保留的 Python 文件系统／正则 owner 在提交 reader 前分类
-canonical 输入，分类独立于显示路径。重叠扫描根不能移除私有分类；报告统一使用
-最宽的请求根。窄范围显式文件／目录保留私有祖先信息。经 Git 核验的 worktree
-即使位于私有父目录下，也保留自己的命名空间；仅名为 `.git` 的目录不构成例外。
-worktree 外、私有状态目录下的显式输入仍须排除。tracked 文件策略、每次重新
-解析的符号链接及既有错误规则均留在这个 owner，不新增第二份控制面决策源或
-配置项。这次安全修复不认证扫描耗时、SQLite 发布默认值或整个 T4 退役。CLI
-检查和 quota 准备复用此规则；App status 继续明确报告仓库扫描为 deferred。
+历史检查点已移至执行账本：[1.x 前置条件（截至 2026-10-12）](ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.zh-CN.md)。
+
+## 原生 authority 验收与原型退役（2026-09-26）
+
+仅用于覆盖验证的 Python coordination executor、head codec、File provider 与
+bootstrap bridge 已随最后 example/test 调用方退役。Stage 0 现运行完整原生
+File/SQLite conformance，不再使用旧 Python provider；复用既有 TS domain owner
+与共享 fixture。`authority_core.py` 仍是活跃 adapter，未删除。这是早期有界 T4
+删除切片，不代表默认 cutover 或全部 Python 退役。见
+[覆盖、行为差异与格式边界](../../../examples/shared-goal-authority-e2e/README.md#native-qualification-and-prototype-retirement)。
 
 ## Todo 事件路径退役（2026-09-25）
 
@@ -1087,8 +949,13 @@ TS 生产者验证器通过共享 guard fixture 执行真实 TS 分类器，并
 codec；较大的完整事实快照通过私有临时文件和摘要绑定的引用传递。同一 reducer
 校验全部记录、agent 作用域内的 ACK 及重试身份；RPC 预算和展示窗口都不允许截断
 历史。快照缺失、改变或无效时在决策前拒绝，适配器在返回或失败后清理临时文件。
-这修复 T3/S2 的结算阻塞并补充 S7/R7 的传输增长证据，不代表全历史解析已经恒定
-内存，也不证明分布式执行。游标/checkpoint 归约保留为以测量驱动、完整源语义一致
+Replan 语义投影也通过既有同 UID、摘要绑定的请求/响应 snapshot 通道传递完整生命周期
+和 receipt 恢复事实。调用方共用一个 transport adapter；生命周期、stride 与 receipt
+决策仍归同一个 TS owner。普通 RPC 保留 2 MiB 上限，本地 snapshot 保留 64 MiB 上限。
+File/SQLite CLI 恢复覆盖超过 wire 预算的完整事实、后续独立工作与用户 gate、持久 refresh
+及 replay，以及精确一次 quota 扣记。这修复 T3/S2 的结算阻塞并补充 S7/R7 的传输增长
+证据，不代表全历史解析已经恒定内存，也不证明已安装宿主采用或分布式执行。
+游标/checkpoint 归约保留为以测量驱动、完整源语义一致
 为前提的后续工作，不再造 Python 规则。见[历史决策证据](ledger/typescript-control-plane-migration-v0/2026-09-22-replan-history-policy.zh-CN.md)。
 
 **Checkpoint 恢复编写契约。** 现有 TS vision owner 只能投影校验器接受的恢复
@@ -1321,10 +1188,10 @@ Python 拥有的投影只传入紧凑的读取 facts。每个投影一次请求
 status projection 迁入 kernel（§4 已将其列为 facade 退出条件），由 TS 直接收集
 facts，adapter 随之删除。
 
-推广顺序。`status`（含 `--goal-id` 与 projection cache 命中）、`global-summary`
-与 `global-gates` 现已携带 envelope。其他 `collect_status` 调用方会在 payload 里
-收到 status envelope，但尚未输出自己的 envelope。下一步依次为：`global-todos` 与
-`global-risks`（同样的组合，各一次调用）、`quota should-run`、`review-packet`，
+推广顺序。`status`（含 `--goal-id` 与 projection cache 命中）、`global-summary`、
+`global-gates`、`global-todos` 与 `global-risks` 现已携带 envelope。其他 `collect_status`
+调用方会在 payload 里收到 status envelope，但尚未输出自己的 envelope。下一步依次为：
+`quota should-run`、`review-packet`，
 以及 Decision Context packet。新加入或迁入 TypeScript 的读模型在同一个 PR 里输出
 envelope；§6 把这一条定为 promotion 门禁。
 
@@ -1384,7 +1251,7 @@ replay、receipt 与 settlement。这个架构选择已经落地，不再是假
 | Quota monitor-poll commit transaction | TypeScript 拥有 monitor admission 复核、target/event/result 构造、effect replay/index CAS、provider intent，以及可修复的 JSON/Markdown/index persistence | Python 投影 compact `should-run` facts，在最多两次 reduction 之间调用真实 Todo provider，刷新 legacy status，并持有 cross-writer index lock |
 | Runtime decoder（[#3443](https://github.com/loopx-project/loopx/pull/3443)） | 稳定 primitive decoding 进入一个很小的共享模块；domain decoder 仍留在本地 | 没有理由建设更大的 schema framework |
 | Transaction 兑现（[#3464](https://github.com/loopx-project/loopx/pull/3464)、[#3481](https://github.com/loopx-project/loopx/pull/3481) 与 Todo completion） | Turn settlement、quota delivery routing 与 Todo completion 均只跨一个粗粒度 TS boundary；Todo transaction 拥有 identity、replay fence、validation planning/result reduction、continuation/recovery 与 completion metadata | Python 仍执行显式 external provider，并物化 legacy Markdown result；其他 domain 仍需各自的 bounded cutover |
-| Projection envelope | TypeScript 拥有 `loopx_projection_envelope_v0` 的解码，以及全部 freshness、告警、完整性与重放判定 | 在 `status`、`global-summary`、`global-gates` 迁移前，Python 仍为它们收集读取 facts |
+| Projection envelope | TypeScript 拥有 `loopx_projection_envelope_v0` 的解码，以及全部 freshness、告警、完整性与重放判定 | 在 `status`、`global-summary`、`global-gates`、`global-todos`、`global-risks` 迁移前，Python 仍为它们收集读取 facts |
 
 Scheduler facade exit 已交付第一段有边界的 Stage 3 路径。带版本的
 `heartbeat_followup_cli.ts` 从生成的 ACK/failure hint 接收有大小上限的 compact host