docs(rfc): reconcile bilingual mirrors and archive historical checkpoints

docs/architecture/rfcs/STATUS.md

@@ -65,7 +65,7 @@ appendix may keep dated history, but no dated log heading may precede it.
 | [RFC: Shared Goal Alignment and Governed Amendment Protocol (v0)](shared-goal-alignment-and-governed-amendment-v0.md) | Accepted | none | [2 entries](ledger/shared-goal-alignment-and-governed-amendment-v0/) |
 | [RFC: LoopX Shared Control-Plane Authority and Pluggable State Providers (v0)](shared-goal-authority-state-provider-v0.md) | Accepted | none | [24 entries](ledger/shared-goal-authority-state-provider-v0/) |
 | [RFC: Single-Owner Local Daemon (v0)](single-owner-local-daemon-v0.md) | Accepted | none | — |
-| [RFC: TypeScript Control-Plane Migration Direction v0](typescript-control-plane-migration-v0.md) | Accepted | none | [14 entries](ledger/typescript-control-plane-migration-v0/) |
+| [RFC: TypeScript Control-Plane Migration Direction v0](typescript-control-plane-migration-v0.md) | Accepted | none | [15 entries](ledger/typescript-control-plane-migration-v0/) |
 
 ## Superseded (1)
 

docs/architecture/rfcs/STATUS.zh-CN.md

@@ -62,7 +62,7 @@
 | [RFC：共享 Goal 对齐与受治理 Amendment 协议（v0）](shared-goal-alignment-and-governed-amendment-v0.zh-CN.md) | 已接受 | 无 | [2 条](ledger/shared-goal-alignment-and-governed-amendment-v0/) |
 | [RFC：LoopX 共享控制面权威与可插拔状态 Provider（v0）](shared-goal-authority-state-provider-v0.zh-CN.md) | 已接受 | 无 | [24 条](ledger/shared-goal-authority-state-provider-v0/) |
 | [RFC: Single-Owner Local Daemon (v0)](single-owner-local-daemon-v0.md) | 已接受 | none | — |
-| [RFC：LoopX 控制面 TypeScript 渐进迁移方向 v0](typescript-control-plane-migration-v0.zh-CN.md) | 已接受 | 无 | [14 条](ledger/typescript-control-plane-migration-v0/) |
+| [RFC：LoopX 控制面 TypeScript 渐进迁移方向 v0](typescript-control-plane-migration-v0.zh-CN.md) | 已接受 | 无 | [15 条](ledger/typescript-control-plane-migration-v0/) |
 
 ## 已被替代 (1)
 

docs/architecture/rfcs/agent-loop-effect-interpreter-v0.md

@@ -479,7 +479,7 @@ Current source-path audit for the first convergence slice:
 | Full requirements | Authoritative Agent-channel work context plus remaining reads; effective Todo, acceptance and scoped User obligations, with the full Goal on its progressive read | Registered source readers fulfill current task reads inline in both transports; the mixed Goal remains mandatory on its full read path; source failure holds dependent delivery. Live model adoption and packaged host journeys remain unqualified |
 | Capability refusal | Existing quota `capability_gate_v0`; compact boundary now retains exact `required`/`missing` arrays and historical source names | This repairs omitted facts, not readiness policy or capability activation |
 | Selection / claim / lease | Selected Todo, action portfolio and current owning transactions | Compact selected ownership is not a fresh lease; retain the captured source and revalidate at the owning mutation |
-| Replan / Goal closure | Replan action packet and the existing TS capsule preserve full audit steps/guidance, current judge and evidence/non-proof conditions | Same captured File/SQLite decisions qualify clause retention and signature mutation; full evidence stays on authorized detail paths. Host/model adoption remains open; Todo completion is not Goal completion |
+| Replan / Goal closure | Replan action packet and the existing TS capsule preserve full audit steps/guidance, current closure assessment (judge) and evidence/non-proof conditions | Same captured File/SQLite decisions qualify clause retention and signature mutation; full evidence stays on authorized detail paths. Host/model adoption remains open; Todo completion is not Goal completion |
 | Settlement / scheduler | Intact typed settlement plan and explicit host-owned scheduler projection; omitted scheduler argv references resolve the same captured full decision | Unbound detail commands are retired in this projection. Actual host readback, stale mutation refusal and exactly-once recovery still need host adoption qualification |
 | Optional memory | Verified boundary participation plus fresh host binding | Off/recall/ingest/stale/provider-failure isolation remains mandatory; transport parity is not model value |
 
@@ -494,7 +494,7 @@ open until their own acceptance is met; this inventory is not blanket permission
 to delete the remaining Python IO adapters.
 
 The continuation-audit projection also retains every ordered closeout step and
-the complete current judge. Earlier capsules dropped those fields while signing
+the complete current closure assessment (judge). Earlier capsules dropped those fields while signing
 their already reduced projection, and clipped the continuation guidance to 48
 characters. Captured File/SQLite work and replan paths now retain those clauses
 and reject signature equivalence after a step/order/judge mutation. The existing

docs/architecture/rfcs/agent-loop-effect-interpreter-v0.zh-CN.md

@@ -335,9 +335,9 @@ envelope 投影，Codex CLI 保持关闭隔离；这不代表安装态 heartbeat
 |---|---|---|
 | Goal/Agent/Todo 身份 | quota 选择及回执；envelope actor、selected Todo 和签名结算身份 | 捕获身份与写入时校验仍必要；展示身份不授予执行权 |
 | 完整要求 | Agent channel 权威 work context 与剩余必读；有效 Todo、验收及 scoped User 义务，完整 Goal 保留渐进式全文读取 | 注册 reader 在两种传输中满足当前任务读取；来源失败会阻止依赖它的交付，真实模型采用和打包宿主旅程仍待验收 |
-| 能力拒绝 | 既有 capability_gate_v0；短包保留原样 required/missing 与源中历史字段 | 修复事实遗漏，不改变就绪策略或能力开启 |
+| 能力拒绝 | 既有 quota `capability_gate_v0`；短包保留精确 `required`/`missing` 数组与源中历史字段 | 修复事实遗漏，不改变就绪策略或能力开启 |
 | 选择／claim／lease | selected Todo、action portfolio 及当前所属事务 | 短包归属不是新鲜 lease；保留捕获源并在所属写入入口复核 |
-| replan／Goal 收尾 | replan action packet、contract capsule 和 vision audit | 完整证据仍走有权限的详情；Todo 完成不证明 Goal 完成 |
+| replan／Goal 收尾 | replan action packet 与既有 TS capsule 保留完整、有序 audit 步骤/指导、当前 judge（收尾评估） 及证据与非证明条件 | 同一捕获的 File/SQLite 决策验证条款保留与签名突变；完整证据仍走有权限的详情。宿主/模型采用仍开放；Todo 完成不证明 Goal 完成 |
 | 结算／scheduler | 完整 typed 结算计划及显式宿主调度投影；省略的调度 argv 引用同一捕获的完整决策 | 此投影退役未绑定的详情命令。实际宿主读回、过期写入拒绝与一次恢复仍待宿主采用验收 |
 | 可选 memory | 核验后的 boundary 参与事实及新鲜宿主绑定 | 关闭／recall／ingest／失效／provider 失败隔离持续保留；传输等价不是模型收益 |
 
@@ -347,6 +347,12 @@ envelope 投影，Codex CLI 保持关闭隔离；这不代表安装态 heartbeat
 结算另有覆盖，仍不证明安装态 App 收敛或模型成本。以下三项继续按各自验收保持
 未完成；这份核对不授权批量删除剩余 Python IO adapter。
 
+接续 audit 投影还保留每个有序 closeout 步骤和完整当前 judge（收尾评估）。旧 capsule 在签名前就
+遗漏这些字段，并把接续指导截成 48 字符。捕获的 File/SQLite 工作和 replan 路径现在
+保留这些条款，修改步骤、顺序或 judge 后拒绝签名等价。既有 8 KiB 诊断阈值不变，
+必需文本可以超出并警告。这只关闭传输遗漏，不代表三项收敛验收通过，也不授权退役仍
+活跃的 Python/host adapter。
+
 统一工作上下文现在由既有 TS interaction owner 选择并满足必读，注册的 Python
 adapter 核验来源，在普通 heartbeat/quota 与签名 envelope 中返回完整当前任务来源，
 无需启用 TurnEnvelope。混合 Goal 文件仍必须经渐进式路径全文读取，不能按历史标题
@@ -373,6 +379,14 @@ live 模型结果、App 采用或以下三项收敛验收完成。
 | 在真实宿主 renderer 采用同一 typed 投影 | heartbeat full/thin 与 Turn host 消费同一执行事实及同 Turn 捕获/详情入口；显式保留通知和 scheduler 的宿主传输。真实 File/SQLite CLI 与打包 Codex App 覆盖重入、来源丢失、必读前拒绝、迟到结果、backoff 和一次结算；补读不触发第二次准入。最后调用方迁移后才退役旧投影。 |
 | 核验上下文形态及迁移默认 | 将相同的正常、replan、等待/恢复与可选能力负载同时对照当前完整和短包路径，测量载荷/model token、详情 IO、延迟、资源增长、遗漏、决策与结果质量。数据丢失、重复效果、身份和结算错误保持硬约束；保留受支持的已保存 prompt/回执与可逆 rollout，根据证据再改预算或默认。 |
 
+原生 Turn detail 采用现持久化真实 `run-once` producer 的完整 observation，由既有 TS
+envelope owner 将 Host 请求绑定到它。真实 File/SQLite CLI 检查实际 subprocess 输入，
+改变 canonical Todo 来源，验证原详情、重试和无效果 replay；模型 provider 是协议
+fixture。只读规划与可选 quota capture 默认值不变，原生执行 Turn 现保留私有 capture
+证据。证据缺失或不匹配拒绝再次调用 Host；legacy 缓存结果恢复与终态读回保留原 receipt。
+这只关闭 producer 到 detail 的传输缺口。真实模型、打包 App/Lark、后续 authority 检查
+及其余收敛矩阵仍独立验收，本切片不退役任何 Python 投影。
+
 此前成本切片已复现回归预算缺口，不能归因于 fixture alias，也不授权删掉
 必需上下文。`aa87cc019` 与 `fc411c878` 使用相同公共 CLI fixture、临时 alias
 和命令参数，实际 JSON stdout 测量如下：

docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md

@@ -270,6 +270,24 @@ resume. Earlier source evidence records a Codex canary editing and reading back
 synthetic note while preserving prior text and creating no Goal. This historical
 host/filesystem evidence is separate from current synthetic-protocol regression
 checks and does not qualify live Lark, material intake or a release.
+Disconnecting a binding or replacing its identity, context or grant first
+publishes typed revocation, then reuses Core's exact-Turn interruption. Cancel
+that binding's queued work before stopping its active Turns, including topic
+and resumed Sessions; unrelated authorized work continues. History remains
+readable and unchanged-configuration retries do not interrupt execution. Never
+hold the authorization-publication lock while waiting for the host to stop or
+create another queue, scheduler or provider authority. An unconfirmed stop
+retains revocation and reports failure. Retrying disconnect with the old binding
+identity and current revision continues stop confirmation, including after a
+failed replacement. Settings projects pending/running targets from Core's
+persisted state, retains exact stop recovery across refresh and reload, and
+removes recovery only after Core confirms termination. It does not restore the
+grant or change the new binding and unrelated work. A claimed attached host
+still lacks push-stop support: report that limit, cancel its unclaimed external
+requests and preserve unrelated local Turns. Synthetic Codex/provider tests
+qualify source semantics; installed/live-host stop, physical command cancellation
+and community enablement remain separate acceptance.
+
 Committed same-claim replay is separate from new admission: after a lost response
 and target revocation, the original host can recover its committed receipt; new
 claims and external result publication remain denied. Current validation uses real
@@ -1135,3 +1153,27 @@ host media and file delivery remain separate gaps. Regression covers model-wire
 image input, unchanged Session, replay, durable restart and download-time
 revocation; live provider/model acceptance is reported separately. No new
 Session authority, queue, worker or feature toggle is introduced.
+
+### Lark progress-edit budget and final-result recovery
+
+Private conversations and steward commissions reuse persisted Turn events to
+edit one progress message; the Core terminal answer still owns the full result.
+Progress allows at most 12 edit attempts, persisted before the provider write.
+Unknown receipts consume the budget and restart does not reset it. This is a
+conservative transport limit, not Lark's maximum allowance. After exhaustion,
+retain Turn events and the allowance for a final edit and necessary close notice.
+
+Older long tasks may already have exhausted the provider quota. Only an explicit
+`230072` response plus fresh readback proving the target body absent allows
+retaining the rejected-edit proof and sending the complete result separately
+through the existing source-session, audience and idempotent-send path. Never
+mark an exhausted draft successfully closed, rerun the model or recreate the
+Session. Unknown errors, lost receipts and unavailable readback retain recovery
+without a blind resend. If the result is verified but reaction cleanup remains,
+recover only its original result proof without sending again.
+
+Regression covers budget persistence across restart, final-result retention,
+explicit quota refusal, unknown failure, lost post-write receipt, unavailable
+readback, recovery of older failed journals and two-App isolation. Live provider
+delivery remains separate. Model completion, material intake and an intermediate
+card cannot substitute for final-message readback.