Retire duplicate authority observation and keep one transaction-bound shadow

[huangruiteng]

Retire the post-commit authority observer after transaction-bound runtime-shadow capture has shipped. Goals carrying coordination.authority_shadow now report an inactive, retired setting instead of resampling every Todo/lease write into a second history. Existing historical records remain readable; enabling the retired path rejects before writes. Clearing it does not enable, bootstrap or retire runtime shadow.

This closes shared-authority RFC §12 question 14 and removes duplicate Python/TypeScript capture logic under #4574 R5/G2. It does not flip provider defaults, bind event writers, or claim whole-Goal migration qualification.

Changes

• Delete the Python resampler, TS observation commit/retry path, writer hooks and migration seeder. Retain the old RPC as an actionable typed rejection and preserve historical codecs/reads.
• Make CLI/configuration/settings agree on retirement, including malformed-setting cleanup, a read-only bilingual settings entry and explicit replacement bootstrap.
• Replace obsolete observer acceptance rows with the real CLI upgrade journey; Stage 1 now reads transaction-bound writes through TypeScript load, paged scan and original receipt lookup. Existing mixed-writer, process-death, parity and rollback rows remain.
• Reconcile both RFCs: three further proposed implementation batches after this cleanup—Host lease liveness, event capture plus whole-Goal migration, and qualified default onboarding/Python writer retirement. Already-open implementations and D1–D3 evidence gates are tracked separately from that plan.

Validation

• Python: 92 capture/configuration/migration/recovery tests, 47 settings/contract tests, 76 team-plan/handoff/bootstrap tests passed; final writer-signature regression passed (7 tests, overlapping coverage).
• Shared-authority ladder: 23 passed / 4 declared skips (two unavailable NoKV profiles, PostgreSQL in the unconfigured projection, and the CLI-twin row). PostgreSQL and the twin upgrade row were run separately: 293 real PostgreSQL integration tests passed with zero skips; both selected real-CLI upgrade/readback rows passed.
• TypeScript: 36 focused tests and control-plane typecheck passed.
• Packaged dashboard build and typed-actions browser scenario passed, including desktop/mobile retired settings; configure-goal and documentation-governance smokes passed.
• A witness-checked disposable copy of a real local Goal (about 6.1 MB state, 191 source files including 188 lease files) passed primary Todo mutation and retired-setting cleanup/readback. Historical bytes remained unchanged and no replacement was implicitly created. This is upgrade-path evidence, not whole-Goal promotion evidence; no private source data is included.

Compatibility changes are intentional: the old enable flag/RPC cannot write, and migrate-state reports retired/attempted=false instead of seeding a new observer. Operator transition and rollback guidance are in docs/reference/authority-observation-retirement.md. Default-off behavior, active capture bindings, event-writer holds and source-fencing rules remain unchanged.

Premerge: passed (19 selected checks plus five direct checks; zero blocking failures/manual holds). One inherited advisory remains: goal_topic_runtime.py exceeds the existing module budget on the base; neither that module nor the budget is changed here. Exact-scope change-quality receipt cqr_5dc68e729454f792b13e is valid for head b59268c8ddb6433f3a8ae42f533573bd54728d56 (39 files; scope fingerprint 5dc68e729454f792b13ec58ded98e95b8a440f04a45b5f40387d09f77c5e480f). The bounded simplification pass removed obsolete helpers/arguments; no unresolved change-quality risks. Maintainer review/merge remains required.

[huangruiteng]

Request changes conclusion (author-owned PR; GitHub blocks formal self-review). Reviewed exact head b59268c8ddb6433f3a8ae42f533573bd54728d56.

动机

旧的 post-commit authority observer 在 Todo/lease 主写入完成后重新采样，与已经落地的 transaction-bound runtime shadow 形成第二套可写历史；采样又不能证明触发它的那笔事务。移除这条过时路径、保留历史只读记录，契合共享 authority RFC §12 问题 14，也让后续政策只需在一个捕获边界维护。此 PR 是有用且可独立回滚的清理增量，不代表整体 Goal authority 迁移完成。

改动思路

保留 coordination.authority_shadow 配置的识别和清理能力，但将其状态投影为 inactive/retired；旧启用参数和旧 TS RPC 在任何新写入前拒绝。主写入仍由既有 Markdown/lease 路径负责，可选的 transaction-bound outbox 仍按显式配置与 bootstrap 独立工作。候选读取增加 legacy_observation/ runtime_shadow 区分，历史记录不被当作晋升证据。相比继续修补双写采样，删除第二个事实来源更符合源事务和回执所有权。

具体改动

关键代码讲解

• runtime_shadow.py:53-129 接管旧设置摘要、拒绝再次启用、清除保留设置，同时维持 runtime-shadow 配置的独立性。
• local_authority_shadow.ts 删除 post-commit 记录/重试路径，旧 recordLocalAuthorityShadow 变成明确的退役拒绝；既有 transaction-bound 读/提交接口保留。
• runtime_shadow_writer_adapter.py 不再在 Todo 主写入后调用旧 observer；local_authority_shadow_adapter.py:781-847 对留存历史只读候选和当前 runtime 候选做明确标记；state_migration.py:236-241 只报告 retired，不再在迁移目标补种第二条历史。CLI、Dashboard 设置、双语操作文档及旧测试也同步改为新语义。

对主干的风险

本次没有在独立 head 上复现新的功能性错误；我跑了配置/运行时 Python 11 个、CLI/迁移 Python 4 个、TS 历史读取/旧 RPC 3 个、control-plane 类型检查和打包 Dashboard build，均通过。历史读取与默认关闭路径有正面证据，作者列出的 PostgreSQL 293 项属于 PR 描述证据，此轮没有独立重跑，不能把它表述为我的验证。

[P1 集成阻断] 当前 exact head 对最新 origin/main 的无工作区合并演算返回冲突：除四份 RFC 文档外，loopx/control_plane/coordination/runtime_shadow.py 也发生内容冲突。该文件恰是旧设置拒绝、清理与新捕获配置的共同所有者；因此孤立 head 的绿测不能证明冲突解决后的默认关闭、历史读取、清理和 runtime capture 仍同时成立。请更新分支解决冲突，在新的 exact head 对这些公共入口及真实后端复跑回归，并重新请求 review。不要通过放松启用/晋升门槛来解冲突；远端 CI 当前状态不是此轮审查依据。

我的整体评价

删除第二个可写观察者是合理的未来维护方向，代码量减少有真实收益；它不增加新授权，也把旧配置的操作与回滚边界写清楚。长线进展和用户迁移路径在独立 head 上看来改善，但主干集成结果尚未证明，尤其是共享配置 owner 的冲突可能改写行为。故当前请求修改仅针对可合并性与集成后证据，并非声称这里已经发现独立 head 的实现缺陷；新 head 需按完整 PR 重新审视。

English verdict: REQUEST_CHANGES - Exact head b59268c passes the selected local Python, TypeScript and dashboard checks, but it conflicts with current main in the runtime-shadow configuration owner and four RFC documents. Resolve the conflict and revalidate the integrated exact head before approval; no isolated-head functional defect was reproduced.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval). Reviewed exact head 1db8993464af6b8e54ffd4f110b62e601ce518e5, rebased onto origin/main 166c68b0387ffc1a8fc4de938d8f7e48d6cdaad7, which contains #5003, #5014 and the chat control PR.

动机

已复核基线行为：transaction-bound 的 runtime shadow outbox 已经落地，但仓库里仍同时存在一条提交后观测路径（Python 重新采样 + TS observation 提交/重试），于是同一个 Todo/lease 写入会产生第二份历史，配置面上还留着可开启的实验开关。本 PR 删除这条已被替代的写入链，并把旧的开关与 RPC 保留成可操作的拒绝，让仍然配置过的 Goal 得到明确指引而不是静默复活第二份历史。

对长期推进而言，共享权威的迁移方向是「一个可写 lineage」：修复前两套捕获并存，任何一次 shadow 比较都要先判断哪份历史可信；修复后事务 outbox 是唯一捕获 owner，旧的 coordination.authority_shadow 只会被识别为 retired/invalid 并可显式清理，不再产生新的观测。对用户旅程而言，受影响入口是「配置与设置视图」和 configure-goal/migrate-state：操作者能看到只读的双语设置条目、可清理旧配置、并按文档显式 bootstrap 替代的 runtime shadow；历史回执仍可读，不会被删除或改写。

改动思路

删除 Python 的提交后重采样器、TS observation 提交/重试链、writer hook 与迁移 seeder，同时把旧的 RPC 保留为「识别 + 拒绝」：local_authority_shadow_summary 只识别保留的配置并标记 retired/invalid，validate_local_authority_shadow_change 对 --local-authority-shadow-file 直接给出 local_authority_shadow_retired 指引，apply_local_authority_shadow_change 只允许清理而不写入。配置目录把该 feature 的 availability 标为 retired，effect/does_not 改写成「不写新观测、保留数据只读」，命令集只保留清理路径；migrate-state 报告 retired/attempted=false 而不是播种新 observer。

语义与集成

产品语义上是「删除已被替代的路径」，而不是「其余 Python 业务 writer 或 reference executor 已退役」——这一边界在双语 ledger 与 docs/reference/authority-observation-retirement.md 中写明，并保留 D1–D3 与 executor-held fence 的开放状态。e2e ladder 把原来的七条 observation-writer 验收行退役，改为真实 CLI 的显式升级行程（清理旧设置 → 显式 bootstrap → 通过 TS load、分页扫描与原回执查询读取事务写入）。

具体改动

• 删除 loopx/control_plane/coordination/local_authority_shadow_observation.py，并把 runtime_shadow.py 改为一组识别/校验/清理函数（local_authority_shadow_summary、validate_local_authority_shadow_change、apply_local_authority_shadow_change），保留历史 schema 常量供读取。
• loopx/configuration_catalog.py、loopx/capabilities/configuration_ui.py 与打包 dashboard 的设置/本地化改动：availability 变为 retired，命令只保留清理与替代 bootstrap。
• loopx/bootstrap.py、loopx/state_migration.py、loopx/todos.py、loopx/cli_commands/registry_admin_configure.py：移除播种/钩子，保持显式替换路径与拒绝语义。
• 测试与验收：tests/control_plane/test_local_authority_shadow_runtime.py 等 5 个文件大幅精简（合计删除约 2,900 行），ladder row 改为真实 CLI 升级行程；新增双语 ledger 2026-09-24-observation-retirement.md 与 docs/reference/authority-observation-retirement.md。
• RFC 对账：两本 RFC 的 checkpoint 同时保留 main 的当前交付边界与本 PR 的退役检查点，明确「退役这条路径 ≠ 完成迁移」。

对主干的风险

最大风险是兼容性表象：旧开关与 RPC 仍在，读到旧配置的 Goal 会看到 retired/invalid 状态而不是被清除。这正是有意的设计——它给出可操作指引并保持历史可读，代价是这个表面会一直存在到兼容窗口关闭；PR 已在 docs/reference/authority-observation-retirement.md 写明操作与回滚。第二个风险是对账文档：两本 RFC 的 checkpoint 段落被多个 PR 连续修改，我这次把它们合并成「保留双方语义」而不是覆盖，避免任一方的结论被静默删除。第三个风险是门禁现状：canary premerge --goal-id loopx-meta 选中 19 项检查，18 项通过，唯一失败的 semantic-vocabulary-drift-smoke 是模块对预算 44 > 43，我在干净的 origin/main 上复现同一失败，属于继承的基线红灯；本目标不等待远端 CI。PostgreSQL 与打包前端的浏览器行程不在此次本地复跑范围内（PR 正文有作者记录的对应证据）。

我的整体评价

没有发现阻断项。这个增量删除了约 2,900 行已被替代的捕获与验收代码，把配置面收敛到「退役 + 显式替换」，并保留了可读的历史与可操作的拒绝语义；没有把「删除一条旧路径」夸大成「迁移完成」。验证覆盖正例、负例与真实路径：36 + 57 个 focused Python 用例、3080 个 control-plane TS 用例（0 失败）、真实 CLI 的 ladder s2c1 行、configure-goal smoke、严格 mypy、ruff 与类型检查全部通过；变更质量回执 cqr_b17c9b3738478fb3d0cc 对精确指纹有效。建议按维护者流程合并。

English verdict: APPROVE - exact head 1db8993464af6b8e54ffd4f110b62e601ce518e5; the duplicate post-commit observation writer is deleted, the transaction-bound outbox stays the only capture owner, and the retained flag/RPC become recognizable, readable and explicitly clearable rather than silently reviving a second history. Focused Python suites, the full control-plane TypeScript suite, the real-CLI ladder row s2c1, strict typing and lint are green; the only failing check is the inherited module-pair vocabulary budget, reproduced on a clean origin/main.

[huangruiteng]

Merge note — #5011 merged on the reviewed exact head

Merged via admin bypass as 1e21976d61e3a8f6c04b95a845b8e21f92935541; the merge tree 58d2debdd6d8f6c0fe56a44c0183df211346578b equals the reviewed head tree, so every changed path is byte-identical to head 1db8993464af6b8e54ffd4f110b62e601ce518e5 (rebased onto origin/main 166c68b03).

Changed surfaces: the coordination runtime-shadow module (retained recognition/rejection/cleanup, deleted observation module), the configuration catalog and configuration-UI capability, the registry admin command, bootstrap/state_migration/todos writer hooks and seeder, the packaged settings projection, the authority e2e ladder rows, and the bilingual RFC ledger/reference.

Rebase repair: one conflict in runtime_shadow.py (the deleted observation import versus upstream's source-transfer invoker) resolved by keeping source_effect_runtime_result and dropping only the retired module import; four RFC checkpoint conflicts resolved by keeping both main's current delivery boundary and this PR's retirement checkpoint rather than overwriting either.

Checks on the reviewed head

• pytest: 36 tests across shadow runtime/config/migration/contract/CLI suites, plus 57 in the drain/writer-capture/writer-boundary/coordination-configuration/team-plan selection — all passed;
• npm run test:control-plane — 3080 tests, 3051 passed, 0 failed, 29 skipped;
• npx tsc --project tsconfig.control-plane.json --noEmit clean; strict mypy clean; ruff check clean; git diff --check clean;
• real path: examples/shared-goal-authority-e2e/ladder.py --stage 2c1 (real python -m loopx.cli and the production TypeScript store) — 1 executed, 1 pass, 0 fail, 0 unverified, 0 privacy violations; examples/project/configure-goal-smoke.py ok;
• change-quality receipt cqr_b17c9b3738478fb3d0cc for scope fingerprint b17c9b3738478fb3d0cc3300aacded6aabc89ed7ba3876fd78cfcf7095ded445;
• loopx pr-review --check-merge-readiness 5011@1db899346 --goal-id loopx-meta returned ready=true immediately before merge.

Failures, skips and holds: the goal-scoped premerge gate selected 19 checks and 18 passed; examples/semantic-vocabulary-drift-smoke.py fails on the module-pair budget (44 > 43) for a pair merged earlier and reproduces identically on a clean origin/main, so it is inherited. Remote CI was not awaited (wait_for_ci=false); the packaged-dashboard browser journey, the PostgreSQL lanes and the >10-day soak were not re-run in this local pass. Manual holds: none.

Residual risk: the reject-only compatibility surface stays until configured Goals are cleared, and retained observation records remain readable but must never be treated as promotion evidence.