loopx-project · huangruiteng · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026
@@ -20,7 +20,7 @@ them as though they were interchangeable PRs.
 | #4870 claim-preserving writes; #4888 reviewed cutover; #4920 drain planning | Implemented. Exercise their combined head; do not commission replacements. |
 | #4922 complete canonical snapshot pagination; #4960 qualified SQLite runtime admission; #4961 display refresh recovery; #4964 shared source summaries | Implemented. Consumer and packaged-client acceptance still needs integration evidence; a whole new pagination/recovery implementation is not pending. |
 | #4967 typed complete-source assembly; #4968 native outbox delivery/recovery | Implemented. Complete-source transport is also merged in #5013; capture assembly is not missing. |
-| #5003 atomic event-owned completion | Merged. Solves batch publication/retry, **not** the event writer's shadow-capture binding. |
+| #5003 atomic event-owned completion | Historical implementation; retired with its Todo event source in #5054. Do not rebuild capture for it. |
 | #4994 explicit leased Agent handoff; #4995 generated Monitor proof; #4991 rejected poll reservation; #4992 deferred receipt-bound Turn | Merged. Audit the integrated callers before deciding what remains; do not recreate them under a new caller-refactor PR. |
 | #4931 retained SQLite proof encoding, contributor #4224 | Open optimization plus incomplete D2 qualification. A speedup is not capacity/recovery/soak acceptance. |
 | #4915 default `.loopx` filesystem placement | Separate configuration migration; does not select File/SQLite authority. |
@@ -41,7 +41,7 @@ not implement another store or close the whole migration package or D2 gate.
 | Proposed PR | Observable result and owner | Exit |
 | --- | --- | --- |
 | 1. External-effect execution fencing | Lease/effect owners protect the actual execution interval, takeover, timeout, exit and uncertain completion. Reuse merged #4994/#4995. | Stale executors cannot continue or settle; real executor and receipt recovery matrix passes. A point-in-time proof check is insufficient. |
-| 2. Event-writer binding and whole-Goal migration/rollback | Bind event writer locks/atomic publication to existing outbox; integrate Markdown/event/lease capture, drain, saved cutover, consumers and fenced export/rollback; delete Python decisions replaced by TS. | Reuse #5003. Retain `event_log_writer_not_bound` until binding passes; close D1, command inventory and D3 cohort. One Goal without an event overlay does not prove this package. |
+| 2. Whole-Goal migration/rollback | Qualify existing Markdown/lease capture, drain, saved cutover, provider consumers and fenced export/rollback. Retire reachable Python decisions after TS adoption. | Close D1, command inventory and D3 cohort. #5054 removes the experimental event source; no new event-writer binding is planned. |
 | 3. Default entrypoints and bounded Python retirement | New Goals, settings, installation and packaged frontend/Lark/CLI select a qualified profile consistently; existing Goals have explicit migration/disable flows. | 1/2 and applicable D1–D3 pass; user entrypoints work; delete business writers only after their last callers migrate. Retain rendering, host IO and lawful import/export. |
 
 **Plan three named future implementation PRs, plus existing #4931 and outstanding

@@ -17,7 +17,7 @@
 | #4870 保留 claim 的写入、#4888 reviewed cutover、#4920 drain 规划 | 已实现。验收组合 head，不再重新安排一套替代实现。 |
 | #4922 完整 canonical 快照分页、#4960 SQLite runtime 准入、#4961 显示刷新恢复、#4964 共享来源摘要 | 已实现。消费者和打包客户端仍需组合验收，不等于还缺一个全新的分页/恢复实现。 |
 | #4967 TS 完整来源组装、#4968 原生 outbox 交付/恢复 | 已实现。大型来源传输亦已通过 #5013 合入；不能再称为 capture 未做。 |
-| #5003 event-owned completion 原子提交 | 已合入。解决整批发布/重试，不负责 event writer 与 shadow capture 的绑定。 |
+| #5003 event-owned completion 原子提交 | 历史实现；在 #5054 中随旧 Todo 事件来源一起退役，不再补其 capture。 |
 | #4994 带 lease 的显式 Agent 交接、#4995 Monitor 命令 proof、#4991 拒绝 poll 后释放预约、#4992 延期且绑定 receipt 的 Turn | 已合入。组合现有实现盘点 caller，不能再开一个 caller 重构 PR 重做它们。 |
 | #4931 SQLite retained proof 编码、contributor #4224 | 优化 PR 开放，D2 资格未闭合。提速不等于容量、恢复和 soak 验收通过。 |
 | #4915 默认 `.loopx` 目录 | 独立的配置迁移，不会选择 File/SQLite authority。 |
@@ -37,7 +37,7 @@ scan 100 p95 801.81 ms / 250 ms），#4931 尚未提供精确 head 的正式复
 | 拟议 PR | 可观察结果与 owner | 退出条件 |
 | --- | --- | --- |
 | 1. 外部动作执行区间保护 | lease/effect owner 将执行身份验证覆盖到实际外部动作、接管、超时、退出及不确定完成。复用已合入 #4994/#4995。 | 过期 executor 不能继续执行/结算；真实执行器及 receipt 恢复矩阵通过。执行前查一次 proof 不够。 |
-| 2. 事件 writer 绑定与整 Goal 迁移/回退闭环 | 将 event writer 锁和原子发布接入现有 outbox；组合 Markdown/event/lease writer、drain、saved cutover、消费者和 fenced export/rollback，删除被 TS 替代的 Python 决策。 | 复用 #5003，绑定通过前保留 `event_log_writer_not_bound`；闭合 D1、命令清单与 D3 cohort。单个无 event overlay 的 Goal 晋升不证明本项。 |
+| 2. 整 Goal 迁移／回退闭环 | 验证现有 Markdown／lease capture、drain、saved cutover、provider 消费者及 fenced export／rollback；TS 接管后删除仍可达的 Python 决策。 | 闭合 D1、命令清单和 D3 cohort。#5054 删除实验事件来源，不再规划新的 event writer 绑定。 |
 | 3. 默认入口与有界 Python 退役 | 新 Goal、settings、安装及 packaged frontend/Lark/CLI 一致选择合格 profile；存量有显式迁移与停用流程。 | 1/2 及适用 D1–D3 通过，验证用户入口，删除最后 caller 已转走的业务 writer；保留 renderer、host IO、合法导入导出。 |
 
 **计划是三个可命名的后续实现 PR，加已有 #4931 和未闭合证据；不是保证总计四个

@@ -1,5 +1,7 @@
 # Event-owned completion: one publication before capture integration
 
+> Superseded by [Todo event retirement](2026-09-25-todo-event-retirement.md): this historical implementation is removed in #5054.
+
 Baseline: `90f21a5299188d54f984a5313e774c9ac48d6595`. This advances overall
 roadmap R5/G2, shared-authority L2/L7 and TS T1/T2. It closes an existing event
 writer correctness gap; it does not qualify that writer for shadow capture.

@@ -1,5 +1,7 @@
 # 事件源完成事务：先建立完整提交，再接入捕获
 
+> Superseded by [Todo event retirement](2026-09-25-todo-event-retirement.md): this historical implementation is removed in #5054.
+
 基线：`90f21a5299188d54f984a5313e774c9ac48d6595`。对应总路线 R5/G2、
 shared-authority L2/L7 与 TS T1/T2。本批修复已有事件写入者的正确性，
 不授予该写入者 shadow capture 资格。

@@ -0,0 +1,46 @@
+# Retire the experimental Todo event source
+
+## Delivery brief
+
+- Goal/source: roadmap R5/S12, TypeScript T4 and shared-authority D1–D3;
+  maintainer direction on #5054 retires the old Todo event route.
+- Gap: a second Todo projection/writeback pipeline was being extended solely to
+  capture a retired source. Supervisor proposal/receipt logging was its remaining
+  independent product caller.
+- Result: delete Todo replay/overlay/backfill/completion and the unused migration
+  bridge. Keep Markdown compatibility and provider authority; detect nonempty
+  retired sources rather than silently omit their records.
+- Owners: Todo source admission; existing TS completion/authority owners;
+  experimental supervisor log under `control_plane/agents`.
+- Acceptance: source selectors refuse without writes or validation effects;
+  canonical reads ignore stale legacy files; normal completion/successors and
+  downstream status/quota/review-packet work; supervisor concurrent receipts,
+  preview, conflicting identity and uncertain-publication replay are covered.
+
+## Compatibility and scope
+
+A nonempty `events.jsonl`, `state_event_log`, `state_events_file` or `event_log`
+source refuses legacy Todo reads/writes and shadow qualification. The operator
+must preserve it and export/inspect its Todos with a compatible older release
+before deliberately removing the binding/file from the active source location.
+There is no automatic replay, deletion, Markdown fallback or new migration API.
+Absent and zero-byte files have no event-owned Todos. Previously prepared
+unsupported event outbox records remain rejected; this PR does not certify them.
+
+The supervisor is experimental/default-off. Its `supervisor_log_event_v0`
+envelope accepts only local-private proposals/receipts. Old experimental log
+formats require manual archival before a fresh log; unknown formats fail without
+rewriting. Admission and publication share the log lock; execution replay checks
+full semantic identity while allowing a new observation timestamp. Preview never
+publishes or syncs the log. A durable executed receipt prevents a second executed
+receipt; this does not close the crash interval between an external host effect
+and its receipt. External-effect fencing retains its own roadmap acceptance.
+
+## Remaining boundary
+
+This supersedes older entries calling for event-writer binding/capture. It does
+not recount already delivered transaction capture, nor subtract a PR from a
+fixed total. Remaining exits are executor-effect fencing, qualified whole-Goal
+migration/rollback, default onboarding and bounded deletion of reachable Python
+writers. D2 backend/capacity/soak and #4931 remain independent evidence. PostgreSQL
+continues using the same authority contract; no new provider is added here.
@@ -0,0 +1,37 @@
+# 退役实验性 Todo 事件来源
+
+## 交付摘要
+
+- 目标／来源：roadmap R5/S12、TypeScript T4 与 shared-authority D1–D3，
+  以及维护者在 #5054 中删除旧 Todo 事件路径的明确方向。
+- 缺口：为捕获一个退役来源而继续扩展第二套 Todo 投影和写回；其中仍有独立用途的
+  caller 是 supervisor 提案／回执日志。
+- 结果：删除 Todo replay、overlay、backfill、completion 与未被产品调用的迁移桥。
+  保留 Markdown 兼容及 provider 权威；拒绝非空旧来源，避免无声丢失记录。
+- 归属：Todo 来源准入、现有 TS completion／authority owner，以及
+  `control_plane/agents` 下的实验 supervisor 日志。
+- 验收：各来源别名拒绝且不写数据／不执行验收命令；canonical 读取忽略遗留文件；
+  普通 completion／successor 与 status／quota／review-packet 链路正常；
+  supervisor 覆盖并发回执、预览、身份冲突和提交结果未知后的重放。
+
+## 兼容与边界
+
+非空 `events.jsonl`、`state_event_log`、`state_events_file` 或 `event_log` 来源
+会阻止旧 Todo 读写和 shadow 资格验证。操作者须保留原文件，先用兼容旧版本检查／
+导出其中 Todo，再有意移除活动来源位置的绑定或文件。没有自动回放、删除、
+Markdown 降级或新增迁移 API。缺失及零字节文件不承载事件 Todo。
+以前准备但不受支持的事件 outbox 记录仍会被拒绝，本 PR 不为其提供资格认证。
+
+Supervisor 保持实验性、默认关闭；新 `supervisor_log_event_v0` 只接收本地私有的
+提案和回执。旧实验格式须人工归档后启用新日志；未知格式会明确拒绝，不自动改写。
+准入与发布共用日志锁；重试比较完整语义身份，允许观察时间变化。
+预览不发布或同步日志。持久化 executed 回执阻止第二份 executed 回执，但不解决
+“宿主外部动作执行后、回执落盘前崩溃”的区间；外部动作保护继续遵循独立验收。
+
+## 剩余边界
+
+本决策替代旧交付记录中“补事件 writer 绑定／捕获”的计划，不重复计数已交付的
+事务捕获，也不机械地从固定 PR 数量中减一。剩余退出条件仍是执行器外部动作保护、
+整 Goal 迁移／回退资格、默认启用和可达 Python writer 的有界删除。
+D2 后端／容量／持续运行证据与 #4931 单列。PostgreSQL 继续复用原 authority 合同；
+本 PR 不添加 provider。
@@ -23,16 +23,20 @@
   [Chinese version](./shared-goal-authority-state-provider-v0.zh-CN.md) and this
   English version are semantic mirrors. A difference between them is a defect.
 
-## Current delivery frontier (2026-09-25)
+## Todo event retirement (2026-09-25)
 
-Audit `37bbaec79` and current PR states: complete-source transport, transaction
-capture, source assembly and the five previously open caller/event fixes are
-merged, not future implementation. After the current promotion-admission repair,
-three named code boundaries remain planned: external-effect execution fencing;
-event-writer binding plus whole-Goal migration/rollback; default onboarding plus
-bounded Python retirement. #4931 and outstanding D2 evidence are tracked
-separately. Three is a delivery plan, not a guaranteed total PR count.
-[Current inventory and exits](ledger/shared-goal-authority-state-provider-v0/2026-09-24-default-cutover-reconciliation.md).
+PR #5054 replaces its original event-writer capture proposal with removal of
+that experimental Todo source. `events.jsonl` is no longer projected, overlaid,
+backfilled or used for completion. Nonempty default/aliased sources are refused
+without changing their bytes; empty/absent sources permit the Markdown path.
+Promoted Goals continue reading their selected provider even if stale legacy
+files remain. The supervisor uses its own local-private experimental log.
+
+This closes the *retired source* branch by deletion, not by claiming event-writer
+capture was qualified. Whole-Goal migration/rollback and default onboarding
+still require their existing acceptance; this change does not make all Python
+writers or PostgreSQL deployment ready. Do not add a replacement event capture
+PR to the remaining work. [Decision and exits](ledger/shared-goal-authority-state-provider-v0/2026-09-25-todo-event-retirement.md).
 
 ## Persistence route for steward scale (2026-09-16)
 
@@ -64,8 +68,7 @@ integration defects; it neither recounts shipped capture nor flips global defaul
 [Operation and boundaries](../../reference/reviewed-coordination-promotion.md).
 
 Handoff-mode changes now share one TS ownership-fact classifier before and
-after promotion. Legacy event-only claims reject rather than disappear at a
-Markdown boundary; event append locks protect the observation through writeback.
+after promotion. Legacy nonempty event sources are refused before any Markdown substitution.
 Canonical changes reuse durable command receipt recovery. This is an L2/L3
 compatibility correction with Python decision deletion, not cohort migration,
 SQLite D2 completion or a default flip. Remaining work depends on executor/consumer closure, qualification,
@@ -1194,7 +1197,7 @@ Qualify an **embedded transactional store, with SQLite as the first candidate**,
 behind the existing TypeScript `AuthorityStore` owner. A local goal must not
 require a PostgreSQL service. The file-v0 provider remains a conformance/import
 baseline; no general-purpose ten-day promotion may rely on its full-history
-rewrite. [PR #4121](https://github.com/huangruiteng/loopx/pull/4121) supplies an
+rewrite. [PR #4121](https://github.com/loopx-project/loopx/pull/4121) supplies an
 opt-in SQLite conformance candidate behind that owner; it does not by itself
 qualify long-goal durability or change the default. Dependency/package,
 Windows/macOS/Linux and supported Node-profile evidence remain explicit gates.

@@ -20,13 +20,18 @@
 - 语言说明：[英文版](./shared-goal-authority-state-provider-v0.md)与本中文版互为
   语义镜像；两者不一致属于缺陷
 
-## 当前交付边界（2026-09-25）
+## Todo 事件路径退役（2026-09-25）
 
-按 `37bbaec79` 与当前 PR 状态核对：完整来源传输、事务捕获、来源组装及此前五个
-在途 caller/event 修复都已合入，不再计入待开发。当前晋升准入修复之后，规划三个
-明确代码边界：外部动作执行区间保护、事件 writer 绑定与整 Goal 迁移/回退闭环、
-默认启用与最后一批有界 Python 退役。#4931 与 D2 的剩余资格证据单列；三个是
-可命名的开发批次，不是保证总 PR 数。[唯一当前清单与退出条件](ledger/shared-goal-authority-state-provider-v0/2026-09-24-default-cutover-reconciliation.zh-CN.md)。
+PR #5054 将原先的事件 writer 捕获方案改为删除这条实验性 Todo 来源。
+`events.jsonl` 不再参与投影、叠加、回填或 completion；默认路径及显式别名指向的
+非空文件会被明确拒绝使用，原字节保留。空文件或缺失文件允许 Markdown 路径继续。
+已晋升 Goal 仍以选定 provider 为准，不受遗留文件影响。Supervisor 改用自己拥有的
+本地私有实验日志。
+
+这是通过删除关闭旧来源分支，不是宣称事件 writer 已通过捕获资格验证。
+整 Goal 迁移／回退、默认启用仍须满足现有验收；不能据此宣称所有 Python writer
+已经退役或 PostgreSQL 已可部署。剩余工作不再新增“补事件捕获”PR。
+[决策与退出条件](ledger/shared-goal-authority-state-provider-v0/2026-09-25-todo-event-retirement.zh-CN.md)。
 
 ## 旧观测退役检查点（2026-09-24）
 
@@ -933,7 +938,7 @@ projection 后的累计重写。这是 payload 解析估算，不是 SSD 物理
 
 在既有 TypeScript `AuthorityStore` owner 后资格化**嵌入式事务存储，首选候选为
 SQLite**。本地 goal 不应依赖 PostgreSQL 服务。file-v0 保留作 conformance/import
-基线，通用十天 goal 晋升不能依靠其全历史重写。[PR #4121](https://github.com/huangruiteng/loopx/pull/4121)
+基线，通用十天 goal 晋升不能依靠其全历史重写。[PR #4121](https://github.com/loopx-project/loopx/pull/4121)
 在该 owner 后提供显式 opt-in 的 SQLite conformance 候选；它本身不证明长程耐久性，
 也不切换默认值。依赖／打包、Windows/macOS/Linux 与受支持 Node profile 的证据仍是
 显式门禁。分段文件日志作为比较候选；PostgreSQL 继续走独立的共享服务路线。