refactor(protocol): retire legacy action packet from new quota output

docs/architecture.md

@@ -333,8 +333,9 @@ The server path should land in layers:
    CLI fallbacks for every write.
 4. **Heartbeat scheduler**: move recurring heartbeat bookkeeping behind the
    coordinator only after quota/spend idempotency is proven. Scheduler output
-   should be the same `quota should-run` / `interaction_contract` /
-   `protocol_action_packet` shape that current automation prompts already use.
+   should consume the structured `quota should-run` / `interaction_contract`
+   output, with `scheduler_hint` owning cadence; historical
+   `protocol_action_packet` summaries are compatibility observations only.
 5. **Planning and dreaming queues**: let background planning produce ranked
    todo proposals, evidence probes, and refactor warnings as advisory records.
    These queues must not execute protected work, read private material, or

docs/architecture/rfcs/ledger/semantic-vocabulary-convergence-v0/2026-09-20-pr05-packet-write-retirement-candidate.md

@@ -0,0 +1,47 @@
+# PR-05: retirement of protocol action packet writes
+
+Refs [#4794](https://github.com/loopx-project/loopx/pull/4794),
+[#4447](https://github.com/loopx-project/loopx/issues/4447). The
+[protocol decision](../../../../reference/protocols/protocol-action-packet-decision-v0.md)
+owns the migration contract. The cutover is the first official release containing #4794, with source builds
+following their code revision; published v1.1.0 artifacts stay unchanged.
+Historical v0 reads remain supported for the v0 reader lifetime. The protocol
+contract names the bundled consumers and v1.1.0 rollback scope. Normal maintainer
+review/release controls remain; this entry does not close the tracker.
+
+- **Delivered delta.** Six live writes across four quota modules are removed,
+  together with the unused packet builder and its imports. Ordinary, paused,
+  required-read, capability-intent and host-recovery construction use existing
+  typed contracts. The default full decision now omits the legacy field, not
+  merely the compact view. No new flag, schema vocabulary or authority owner.
+- **Retained responsibility.** Historical Python Markdown and TypeScript
+  Effect/Envelope readers, ordered `protocol_action_packet_fields`, summary
+  reconstruction, opaque fallback, residue and signature rejection remain.
+  Historical records are never rewritten. The measured Python field surface
+  falls from 5 to 1; TypeScript remains 2. The same-diff anchors retain those
+  compatibility readers instead of pretending the field disappeared globally.
+- **Behavior evidence.** Eight complete baseline/candidate quota payloads match
+  after removing only the packet; canonical signature documents match after
+  removing only its capsule witness. The digest may consequently change.
+  Real CLI/reentry/Envelope/live tests pass (149). The renamed
+  `quota-without-legacy-packet-smoke.py` rejects the previous default. The obsolete
+  decision-note wording smoke is removed; runtime and compatibility regressions
+  own behavior evidence, while docs governance checks document structure.
+- **Versioned readback.** Actual v1.1.0 source (`607c11d75`) reads eight new and
+  eight packet-bearing baseline samples with unchanged signed actions and valid
+  host admission. Installed candidate wheel checks ordinary/paused output,
+  bundled TS/JSON resources, real bridge and host admission. This is bounded
+  synthetic evidence, not full historical archive or all-host qualification.
+- **Durable historical evidence.** Four frozen decision/Envelope objects were
+  generated by actual v1.1.0 code, with their original hashes retained. Current
+  readers validate those stored signatures; 24 tampered copies fail admission.
+  `scripts/verify_protocol_packet_migration.py` requires that exact unmodified
+  release checkout and checks eight fresh outputs plus the four stored records.
+  Real CLI replay and combined required-read/capability-intent tests preserve
+  identity, commands and read order without the packet.
+- **Bounded completion.** No default writer remains. Consumer/read-format scope
+  and rollback steps are concrete in the protocol contract, with no private
+  client or full-archive promise. External clients requiring the old field must
+  migrate or retain v1.1.0. Future v0 reader removal needs a separate breaking
+  migration. Adjacent quota PRs must retain these invariants when rebasing;
+  their unmerged changes are not silently part of this main-based PR.

docs/architecture/rfcs/ledger/semantic-vocabulary-convergence-v0/2026-09-20-pr05-packet-write-retirement-candidate.zh-CN.md

@@ -0,0 +1,36 @@
+# PR-05：protocol action packet 写入退休
+
+对应 [#4794](https://github.com/loopx-project/loopx/pull/4794)、
+[#4447](https://github.com/loopx-project/loopx/issues/4447)。
+[协议决定](../../../../reference/protocols/protocol-action-packet-decision-v0.md)
+拥有迁移契约。首次包含 #4794 的正式发行版切换新写入，源码版本按相应代码行为
+运行；已经发布的 v1.1.0 产物不变。历史 v0 格式在 v0 reader 生命周期内继续支持。
+协议明确 bundled 消费者与 v1.1.0 回退范围；正常维护者评审/发布控制仍保留，本条
+不关闭 tracker。
+
+- **交付变化。** 删除四个 quota 模块内六个现行写入点，以及失去调用者的 packet
+  builder/import。普通、暂停、required-read、capability-intent、host-recovery
+  路径使用现有类型化契约。默认完整 decision 也不再输出旧字段，不只是 compact
+  view 省略。未新增 flag、schema 词表或决策 owner。
+- **保留责任。** Python Markdown 和 TS Effect/Envelope 的历史 reader、
+  `protocol_action_packet_fields` 有序语义投影、summary 重建、opaque fallback、
+  residue 和签名拒绝仍保留，不重写旧记录。实测 Python 字段迁移面由 5 降为 1，
+  TypeScript 仍为 2；同 diff 锚点保留这些兼容 reader，不虚报字段全仓消失。
+- **行为证据。** 八组完整新旧 quota payload 只去除 packet 后相等；规范签名文档
+  只去除 capsule 中对应见证后相等，摘要值可能因此变化。真实 CLI/重入/Envelope/
+  live 测试 149 项通过。更名后的 `quota-without-legacy-packet-smoke.py` 会拒绝旧
+  默认输出；原 decision-note 文案 smoke 退役，行为由实际运行和兼容回归保护，
+  文档结构继续由 docs governance 校验。
+- **版本化读回。** 实际 v1.1.0 源码 `607c11d75` 读取八组新输出和八组带 packet 的
+  基线样本，签名含义与 host admission 均通过。安装后的候选 wheel 验证普通/暂停
+  输出、打包 TS/JSON 资源、真实 bridge 与 host admission。这是有界合成证据，
+  不代表完整历史存档或全部 host 资格已验证。
+- **持久历史证据。** 实际 v1.1.0 源码生成四组固定 decision/Envelope，保留原始
+  哈希。当前 reader 验证原签名，24 个篡改变体被拒绝。
+  `scripts/verify_protocol_packet_migration.py` 要求准确且未修改的发行源码，复核
+  八组新输出与四组历史对象。真实 CLI 重放及 required-read/capability-intent
+  组合测试验证身份、命令和读取顺序在缺少旧字段时保持正确。
+- **有界完成。** 默认 writer 已全部停止写入。协议已给出具体消费者/格式范围和
+  回滚步骤，不承诺私有客户端或完整历史存档兼容。依赖旧字段的外部客户端需先迁移
+  或保留 v1.1.0。未来移除 v0 reader 必须另行做破坏性迁移。相邻 quota PR 在 rebase
+  时须保留这些不变量；其未合并改动不被悄悄计入本 PR 的 main 基线。

docs/archive/incidents/agent-scoped-user-gate-overreach-incident-20260624.md

@@ -90,7 +90,8 @@ The durable repair landed in PR #629:
   - unscoped user gates remain global gates.
 - `examples/control_plane/work-lane-contract-smoke.py`
 - `examples/control_plane/quota-action-scope-guard-smoke.py`
-- `examples/protocol/protocol-action-packet-smoke.py`
+- `examples/protocol/quota-without-legacy-packet-smoke.py` (current successor to
+  the original `protocol-action-packet-smoke.py`)
 - `examples/control_plane/quota-plan-smoke.py`
 - a real active-state quota check confirmed the non-target agent returned
   `decision=run`, `requires_user_action=false`, and `delivery_allowed=true`

docs/concepts/interaction-pattern-catalog.md

@@ -612,7 +612,7 @@ IP-003 scope metadata being ignored by the user-todo blocking summary.
 **Validation**
 
 - `regression/scoped-user-gate-fallback-contract.py`
-- `examples/protocol/protocol-action-packet-smoke.py`
+- `examples/protocol/quota-without-legacy-packet-smoke.py`
 - `examples/control_plane/work-lane-contract-smoke.py`
 - `examples/control_plane/quota-agent-scoped-user-gate-smoke.py` for `blocks_agent` scoped
   user gates that block only the target agent while preserving other-agent

docs/development/control-plane-course/06-quota-decision-kernel.md

@@ -103,8 +103,7 @@ capability_gate
 work_lane_contract
 vision_continuation_audit
 user_todo_summary / agent_todo_summary
-protocol_action_packet
-compatibility fields
+compatibility fields (historical protocol_action_packet is read-only)
 ```
 
 其中最稳定的执行入口是：

docs/product/core-control-plane/rule-seam-map.md

@@ -94,7 +94,7 @@ The next module-boundary PR should therefore:
 | Agent vision and goal routing contract | Future goal-route policy/CLI adapter plus `goal_vision_replan_contract_v0` | CLI-enforced bounded vision fields, per-agent vision checkpoints, and the vision/replan state machine. | Over-budget vision fails or compacts before status/quota; material closeouts emit `vision_checkpoint_v0`; quota consumes projection only and does not own per-agent vision storage. |
 | Quota plan and should-run assembly | `build_quota_plan`, `build_quota_should_run` | Thin orchestration layer that merges status, quota accounting, gates, and policy outputs. | `quota should-run` JSON field names and interaction contract stay compatible. |
 | Effect packet lens | `loopx.control_plane.effect_program.interpret_quota_should_run_packet` | Read-only canonical effect slots over the existing quota packet. | Runtime decisions unchanged; focused tests and docs consume the lens. |
-| User/agent/CLI split | `_protocol_action_packet`, `_interaction_contract` | Protocol packet builder with no scheduler or writeback side effects. | Operator gate vs bounded delivery payloads keep the same action_required and must_attempt meanings. |
+| User/agent/CLI split | `build_interaction_contract` | Structured user/agent/CLI projection with no scheduler or writeback side effects. | Operator gate vs bounded delivery payloads keep the same action_required and must_attempt meanings. |
 | Scheduler policy | `_scheduler_hint` wrapper plus `loopx.control_plane.scheduler.scheduler_hint` | Pure scheduler-hint builder fed by final decision state. | RRULE, reset token, and no-spend cadence fields stay stable for Codex App and local loops. |
 | Monitor writeback | `_quota_decision_due_monitor_item`, `build_quota_monitor_poll_event`, `record_quota_monitor_poll` | Monitor event/writeback module with idempotent todo lookup and next-due projection. | Due-monitor and external-evidence monitor-poll paths remain no-spend and reject non-monitor todos. |
 | Spend accounting | `build_quota_slot_spend_event`, `spend_quota_slot` | Quota accounting module with explicit accountable-run lookup. | Spend only after validated writeback; source enum and slot accounting remain unchanged. |

docs/reference/effect-interpreter-packet.md

@@ -146,7 +146,17 @@ The decision is returned as:
 | `effective_action` | Machine-visible effective action |
 | `recommended_action` | Next concrete action text |
 | `action_portfolio` | Primary plus bounded typed fallbacks, when present |
-| `protocol_action_packet.summary` | Compact actor-facing summary |
+| `protocol_action_packet.summary` | Optional historical actor-facing summary; no action authority |
+
+For a source without `protocol_action_packet`, the quota lens exposes
+`protocol_summary=null`; typed interaction, lane, and scheduler contracts still
+supply obligations and next effects. Historical v0 and opaque summaries remain
+readable observations and cannot override those contracts. The
+[PR-05 migration](protocols/protocol-action-packet-decision-v0.md)
+defines packet-free new quota/live/paused/recovery output from the first release
+containing #4794. It names the supported bundled consumers, retained v0 format
+lifetime and tested v1.1.0 rollback baseline; unknown external clients are not
+automatically covered.
 
 `EffectTurn.observation.action_portfolio` is the canonical TypeScript-owned
 observation of this field. Python supplies only scope/capability-admitted todo

docs/reference/protocols/protocol-action-packet-codex-cli-wrapper-v0.md

@@ -4,8 +4,10 @@ This wrapper is the cold-path bridge between `protocol_action_packet_v0` and a
 future Codex CLI summarizer. It is intentionally outside `quota should-run` so
 the hot path keeps its interface budget.
 
-The wrapper consumes a synthetic `protocol_router_comparison_v0` report and
-builds a Codex CLI command envelope for an isolated project:
+The wrapper consumes a synthetic `protocol_router_comparison_v0` report, not a
+legacy field from fresh quota output. The [PR-05 migration](protocol-action-packet-decision-v0.md)
+keeps it outside the live execution contract. It builds a Codex CLI command
+envelope for an isolated project:
 
 ```text
 codex exec --skip-git-repo-check --ephemeral --ignore-user-config