refactor(state): retire legacy Todo events and isolate supervisor history

[huangruiteng]

Retire the superseded experimental Todo event replay, overlay, dual-writer and automatic backfill paths now that native shared Goal providers own current state. Promoted File/SQLite/PostgreSQL providers remain authoritative. A nonempty unpromoted legacy event source is refused unchanged with preservation/export guidance, scoped to the affected Goal; unrelated Goals remain usable and stale historical Todos cannot become fallback work.

Keep explicitly configured supervisor proposals and host receipts in a separate local-private log. TypeScript owns semantic identity/sequence admission and Python owns lock-held durable publication. This log grants no Todo or external execution authority. Canonical bilingual retirement/usage docs, callers, IO census and canary catalogs are reconciled; the current website navigation check follows the actual showcase link without changing its anchor/history invariant or budget.

Validation: final head has29 focused retirement/supervisor/census tests, Ruff, mypy, TypeScript typecheck, three strict documentation builds, actual base/head CLI/HTTP recovery, all19 selected native premerge checks and exact-scope quality passing. DCO, realPostgreSQL integration, macOS/Windows desktop and full Frontstage Pages publication CI pass. Prior source-labelled535 Python,620 typed,301 provider+10 service realPostgreSQL tests and three installed-wheel UI journeys remain bounded regression evidence after byte-equality/integration review; they are not final-release qualification. The final1.2.1 package separately passes actual install/upgrade/sdist/Chat HTTP,18 packaged browser scenarios, Python3.11 checks and21 model scenarios twice with6contrasts/42actor calls; complete release qualification continues independently.

Earlier Unicode framing failures and a nested60second canary timeout are preserved; LF regression and unchanged-budget full premerge rerun pass. No scan root, fixture population or hard budget was relaxed. Future-facing pass: share source alias ownership, remove duplicate state authority and reuse the existing Overview error presenter and typed/durable boundaries. No further framework extraction is needed.

[huangruiteng]

Replacement implementation validated at a91cc0962411630acd6a4cd15aee36ed446682c6.

The Todo event source, replay/overlay/backfill and completion branch are removed. The experimental supervisor has a separate single-record log; old experimental formats fail without rewriting. Nonempty legacy Todo sources refuse reads/writes/validation and shadow qualification, while promoted provider reads remain independent of stale legacy files.

Final premerge: 19/19 selected checks passed, zero failures. Exact-scope change-quality receipt is valid. Focused source/governance, completion, mutation, outbox/status and supervisor checks passed; real PostgreSQL integration passed 293 tests with zero skips; SQLite capacity rehearsal and two promoted File readbacks passed. Both writer-lock mutants were killed by assertions after passing controls. The broader Python run had 416 passes, four environment skips and one obsolete ladder assertion; that assertion was corrected and its exact pytest case passed on rerun. The TS sweep exposed retired event characterization plus a capacity rehearsal failure; final targeted rechecks passed all 23 cases. These results do not claim full D2/soak qualification or completed remote CI.

Future-facing simplification: remove the duplicate Todo authority rather than extending its capture; reuse existing durable file IO and typed append admission for the experimental supervisor. No frontend companion change is required: CLI/source contracts change here, and current status/manager consumers use the existing canonical-first Todo read and error path. External host effect-to-receipt fencing remains separate.

Independent review requested from the designated peer on this exact head. No self-merge performed.

[huangruiteng]

Review fixes are pushed at e657c09c8:

• Correct the broken cross-site retirement links and use loopx-project/loopx throughout the six documentation files touched by this fix. Root documentation and both language editions of the Developer Book pass MkDocs strict builds.
• Reproduce installed-runtime startup failure: Node could not resolve control_plane/runtime/receipt_log_snapshot.ts, introduced on the baseline but omitted from Python package data. Add the existing runtime directory to the TypeScript package-data declarations; no runtime semantics change.
• Rebuilt wheel and sdist each pass all five required installed-authority E2E stages. The rebuilt wheel also passes Python 3.11 workflow-skill inspect, install/readback and uninstall outside the checkout.
• Clarify the architecture boundary in the PR description: the provider transaction ledger remains; retiring legacy Todo event replay does not delete atomic event/projection/receipt commits or ordered history. Checkpoint/delta state recovery is not a claim of complete domain-event-only replay.

Exact committed-scope change-quality verification is valid. Independent review and remote CI must qualify this updated head; this is not a merge approval.

[huangruiteng]

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

Reviewed exact head: e657c09c81ec1eb17fe68d9e0735a1447ae885f2; baseline: 27f0fc93b806925cb151df4ffac26e3aebdbff2c.

Blocking finding: [P1] 将旧事件源的拒绝限制在所属 Goal，不能让它击穿全局状态收集。

动机

按 Todo event retirement 决策 和 #4574 当前边界，这个 PR 是退役实验性 Todo events，而不是删除已提升的 canonical authority store。删除重复 replay/overlay/writeback 能减少长期双重状态规则；同时保留非空旧数据、拒绝偷偷用 Markdown 替代，是正确的安全目标。supervisor 的最后一个日志依赖也需要解除，才能把退役作为一个完整可用的切片交付。但目前一个旧 Goal 会让其他正常 Goal 的全局状态不可见，因此这个切片尚不能批准。

改动思路

Todo 路径先选已提升的 canonical provider；只有未提升的 legacy 路径检查默认 events.jsonl 和三个旧 alias。没有旧事件则继续 Markdown，有非空文件则拒绝读取、写回、完成或资格检查，不自动迁移或删除原文件。supervisor 另用私有、实验性的 proposal/receipt log：Python 负责锁和耐久文件发布，TypeScript 负责 identity、顺序和 replay/conflict 判断，不再把日志回放成 Todo 状态。

这比保留两个 Todo writer 更合适。canonical provider 的事务/receipt authority 未迁移，旧 proposal 的 basis 字段仅作为已持久化兼容字段保留。正常 proposal/receipt、重复请求和冲突路径我在真实 CLI 上对照了基线与候选；这仍不是外部 host effect 的 exactly-once 保证，副作用与 receipt 间的 crash gap 没有被消除。

具体改动

完整 diff 是 103 个文件、+940/-9064，不能只把它看作两个新 helper。生产代码 +378/-3272，测试/fixture/example +288/-5427，文档 +250/-349，IO manifest +24/-16。删除包括 event-sourced API、replay、Markdown overlay/backfill、event-only completion、已无调用的 migration bridge 及专属 smokes。保留的 completion/handoff/lease/shadow/status/manager 入口改用当前 authority；integrated canary、E2E retirement row、书和双语 RFC/协议一起更新。pyproject 的 runtime TypeScript package-data 修复了安装包真实入口缺资源的问题，wheel 和 sdist 都独立验证过。

关键代码讲解

1. require_no_legacy_todo_events，legacy_event_source.py:34：检查 alias 和默认路径，任何非空旧源都明确拒绝，原字节保留。它是旧源 admission，不是新 Todo authority；空/缺失旧文件走原 Markdown 路径。
2. active_state_todo_fields，active_state_todos.py:48：先读 canonical，再在 legacy 分支调用 guard。第 77 行的异常直接离开这个 per-Goal reader；未改变的 attention queue 在循环里没有隔离此异常，导致本文的 P1。
3. record_supervisor_receipt，supervisor_events.py:274：在同一 log lock 内读取 proposal 和已有 executed receipt、规范化受支持的 outcome/capability/rollback，再决定写入；不同的第二个 executed receipt 不会悄悄覆盖既有结果。
4. SupervisorEventStore.record_locked，supervisor_event_log.py:96：把语义 fingerprint/既有 sequence 交给 typed append plan，忽略时间戳差异做幂等 replay；preview 不写也不 sync，execute 使用既有 durable primitives，不确定发布要求检查原 receipt 后再重试。

对主干的风险

P1：单个旧源击穿无关 Goal 的状态入口

我用同一份合成数据在不可变基线和精确 head 启动真实 CLI 与真实 loopback status server：两个有效的 active Goal，healthy 有普通 Markdown Todo；仅给 retired 放非空 events.jsonl。没有使用活跃 Goal/registry 或 mock 后端。

实际入口	基线	候选 head
两个 Goal，无旧日志，全局 status	exit 0，两个 Goal	exit 0，两个 Goal
retired 有旧日志，全局 status	exit 0，healthy 保留	exit 1，只剩 loopx-status 错误项，healthy 与 Todo index 消失
同样输入，status --goal-id healthy	exit 0，可继续	exit 0，可继续
HTTP /status，有旧日志	200，healthy 保留	500，整个状态响应不可用
在合成 fixture 中由 owner 移除旧源后	200，两个 Goal	200，两个 Goal 恢复

因果链是新 guard 在 active_state_todos.py:77 抛错，attention_queue 循环不隔离，CLI 外层替换整份 payload，HTTP 层返回 500。正确拒绝 retired 并不意味着它可以阻断 healthy。全局错误也没有附带所属 Goal，操作者只能靠逐个 scoped 查询寻找故障源。

最小修复：在 per-Goal collection 边界投影带 Goal id 的 typed source-unavailable/refusal，让该 Goal 仍不能执行或被误当成空 Todo；继续保留其他正常/canonical Goal 的 attention 和 index。不要删除原日志，也不要通过移除 guard、catch 后返回空字典或回退陈旧 Markdown 来“修好”状态。加入真实 CLI+HTTP 的两 Goal regression，覆盖首次出现旧源、后加入正常 Goal、不能改 Todo 注解逃过拒绝及显式 owner 恢复。可扩展现有 tests/control_plane/test_retired_todo_event_source.py，并重跑 uv run --extra test python examples/control_plane/status-collection-readmodel-smoke.py。

非阻塞文档建议：E2E README 第 48 行仍写 event_log_writer_not_bound、Markdown 写入仍提交和必须 rollback/rebootstrap；实际 retirement row 已改为拒绝旧源写入并通过 owner cleanup 恢复。把这张当前运行表同步到新语义，避免操作者照旧提示重试。历史 ledger 可以保留，但不能把当前操作表当历史记录。

语义与 CI 对齐

当前要求是保留源数据并对所属 Goal fail closed，不是清空整个 portfolio。局部旧源拒绝、canonical 优先与 supervisor admission 复用了现有 typed owner；全局隔离是新增的未披露行为漂移，必须修复。没有新增 domain-specific 核心义务，也没有把 machine-enforced refusal 称为可忽略的 guidance。supervisor 仍需原有 opt-in；普通无旧事件的 legacy lane 和 canonical lane 不因安装新日志组件而激活 supervisor。

本地验证：360 项 focused Python 测试、21 项 TS 测试、control-plane typecheck、Ruff/Mypy、integrated canary 通过；隔离真实 PostgreSQL 的 293 项全部通过、零跳过；3 条 authority E2E row 通过；wheel/sdist 各自的 5 阶段 installed E2E 通过。现有 supervisor CLI smoke 在基线和候选均通过。另一个相同 SQLite alignment 调用在两端都报 invalid canonical Todo basis，已区分为保留的基线限制，不是本 PR 阻塞项。最初构建缺少 Chat bundle 是干净 checkout 的前置步骤，按仓库流程构建后发行验证通过，没有降低 gate。按当前 review policy 不读取或等待远端 CI。

我的整体评价

REQUEST_CHANGES，理由是上述可重复的跨 Goal 回归，不是红 CI 或测试数量不足。长期推进维度存在回归：一个待迁移的旧 Goal 会遮蔽独立工作；用户体验维度也回归：Dashboard 状态变 500，且缺少定位所属 Goal 的信息。退役规模与目标总体匹配，面向后续的整理已删除第二套 Todo authority、将 append 判定放入 TS；不需要恢复旧 replay 框架。请在现有 collector 所有者处补齐 typed、goal-scoped 故障隔离，保留正确的数据安全边界，再以新精确 head 重跑完整路径审查。更大的 provider cutover、soak 和外部 effect fence 仍属于原路线的后续边界，不能由本次测试代替。

English verdict: REQUEST_CHANGES - e657c09; one nonempty retired Todo event source removes unrelated healthy Goals from global CLI status and turns HTTP status into500. Preserve the per-Goal refusal but isolate its projection. Local suites, real PostgreSQL and installed distribution E2Es passed.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @huangruiteng.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewed exact head: 5054@39ccc74365426c66d1e2d122a5aa0ac426bce160; baseline: af3e7f1f00e2815e45f99258c0d8ec58774ec9bb.

动机

共享 Goal 已有 File／SQLite／PostgreSQL 原生 authority，旧 Todo event replay、overlay、双写和自动回填继续存在会形成第二个状态 owner。此次按已接受的 retirement checkpoint 完整删除该旧路径，并让实验性 supervisor 的 proposal／host receipt 使用独立私有日志。退休旧源时必须保留数据所有权、其他 Goal 的可用性和可执行的恢复路径。

改动思路

先读 promoted provider；未提升的 Goal 检查默认 events.jsonl 和三种既有别名，遇到非空旧源明确拒绝且不改字节。异常只在单 Goal 的 attention 边界捕获，现有 Overview → Pending gates 呈现完整 preserve/export 指引。Todo index 同时排除该 Goal 的当前及历史 fallback，并明确 incomplete。supervisor identity／sequence 留在 TypeScript，Python 只负责持锁与原子持久写入；没有 Todo replay、默认 host adapter 或新增行动权限。

具体改动

完整差异为110个路径、1123行增加／9072行删除，大部分删除旧实现及失效测试；文档、caller、IO census、canary catalog 同步退休，没有保留闲置兼容框架。

关键代码讲解

• require_no_legacy_todo_events（loopx/control_plane/goals/legacy_event_source.py）共享 alias 元组并以实际非空文件判定，不能用可变注释绕过；promoted provider 先行。
• build_attention_queue（loopx/control_plane/work_items/attention_queue.py）只捕获 typed retirement error，保留完整操作指引并继续其他 Goal。
• build_todo_index（loopx/control_plane/todos/todo_index.py）让 refused source 的当前／历史条目都不能成为可执行 fallback；complete=false 表达未知而非无工作。
• SupervisorEventStore.record_locked 与 planSupervisorEventAppend 分别持有文件 durability 和 typed replay identity／sequence；commit-unknown 要先读回，日志不证明外部动作恰好一次。

Current 39ccc74:29 retirement/supervisor/census tests, Ruff, mypy19, TS typecheck, three strict docs builds, actual CLI/HTTP base/head fixture, native premerge19 and exact-scope quality pass. Exact-head Frontstage Pages CI passes its full publication/browser steps. Prior 9fb464b:535Python,620typed,301realPostgreSQL provider+10service tests (zero PG skips) and three installed-wheel UI journeys pass; byte-equality/dispatcher-integration review bounds their reuse. These prior results do not qualify the final release source.

真实打包 UI 已验证旧源指引、独立 Goal 和显式恢复三个流程；现有 presenter 足以展示此状态，不需要另一套设置或首页 UI。Lark 没有新增 supervisor/default activation 或专属配置入口。未来改动便利性检查已应用：共享一个 alias owner、删除双 authority、复用 typed planner／durable primitives；更大的框架拆分不需要。

语义与 CI 对齐

这是显式旧源兼容变化：非空旧 Todo event 文件不再被自动回放或转换，须用兼容旧版本导出。原生 provider、Markdown、lease／completion 仍使用原 owner。supervisor_log_event_v0 只扩展已存在的 proposal／host receipt 载体，不宣称 actor lifecycle、scheduler、merge 或外部 exactly-once authority。当前 canonical IO census 和 canary catalog 已同步；官网测试改为点击现有 showcase href，原锚点／历史导航不变量及4秒预算保持。最终候选的完整 Frontstage Pages CI 已通过。

对主干的风险

主要风险是漏掉旧源 mutation 或 alias、把局部拒绝扩大为全局故障、把历史列表当成可执行事实，以及私有日志失败后的重复副作用。当前15项 retirement 测试覆盖全部来源、独立／新增 Goal、注释绕过、历史 fallback 和显式恢复；8项日志测试覆盖 replay／conflict／Unicode／commit uncertainty。此前实际 unrepaired 分支复现全局 HTTP500；修复后最终 base/head 实际 fixture 的 global／scoped HTTP 正常，源字节保持。最初三条 Unicode 负例在旧 splitlines 上失败，改用 LF framing 后通过。一次真实 PostgreSQL service 验证因缺少它独立的 URL 跳过1例，纠正后10例全部在真实服务执行；不能把原 skip 算通过。

首次19项native premerge有一项nested namespace检查在原60秒预算超时；原失败保留，单项及完整19项均在原预算下复验通过，没有放宽门槛。同源码本地完整网页 fixture 的首次执行出现 mechanism fragment 超时；原静态页有该 section、测试预算未修改，原失败保留。最终 head 的 GitHub 完整发布网站／浏览器检查已通过；本地按相同预算重验也完整通过168个链接，原失败保留，不据此猜测性能根因。较早的535／620／PG／打包 UI 证据均注明9fb来源；最终 runtime／tests 除 dispatcher 注册和 census 外逐字节相同，当前29／typecheck／CLIHTTP 验证其集成。这些历史结果只用于本 PR 的 bounded review，不充当最终版本的全量发布资格。

持续工作得到改善：一个旧源不能阻塞其他 Goal，未知源不能复活陈旧工作；用户体验得到改善：完整指引可见、实际恢复后能继续。旧实验数据需要显式处理，这是已接受的 retirement 代价；没有改变原生 provider 或降低原预算。最终1.2.1全量测试、真实模型与远程产物读回仍由当前发布操作完成。

我的整体评价

该完整 head 符合已接受的 retirement／private-supervisor boundary，复用当前 owner，修复了验证暴露的 scope、projection、LF 和当前导航问题。无未解决的本 PR 行为 blocker。用户已明确授权5054自修复自合并；可在精确 head 的 native readiness 通过后按该授权合入。

English verdict: APPROVE

[huangruiteng]

Post-merge exact-head review: the maintainer merged this PR while its integration review was being completed. The agent readiness gate refused a second merge; this record reviews the actual merged head.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewed exact head: 5054@55edb1e5e9c0dcf04d86edb9c1c7d6750bd58cd4; integration baseline: 03b7e66f189518bb28253392ef8cf9ff9ae02c66.

动机

按共享 Goal authority 的 accepted retirement checkpoint 删除旧实验 Todo event replay／overlay／双写／自动回填，并把 supervisor proposal／host receipt 留在独立私有日志。非空旧源必须保留所有权与显式恢复，不能变成 Markdown fallback 或阻断其他 Goal。

改动思路

Promoted provider 先行，未提升源用共享 alias/default path 与实际文件 bytes 判定。Typed refusal 在单 Goal attention 边界隔离，现有 Overview Pending gates 展示完整保存／导出指引；Todo index 同时拒绝当前与历史 fallback，明确 incomplete。Supervisor 的 identity／sequence 属于 TS，Python 持锁完成原子耐久发布，Host 仍拥有外部执行。

具体改动

本次只把最新已合入 main 集成到 PR，以消除 merge-state BEHIND。对全部110个 owned patch逐一比较，仅归一化 source coordinate与Git index object ID，增删语义完全一致。共享的 status schema／dispatcher／status projection／census 保留 main 增量，没有改变本 PR 边界。新head29项 retirement／supervisor／census、Ruff、mypy、typed typecheck、实际 frontend build以及同一 real CLI／HTTP base/head recovery通过；canonical census为248sites。

关键代码讲解

• require_no_legacy_todo_events 检查默认源和全部三种别名，先保留 promoted provider；注释不能绕过实际旧源。
• build_attention_queue 只捕获 typed source refusal，保留完整恢复指引并继续其他 Goal。
• build_todo_index 同时排除 refused Goal 的当前／历史条目，complete=false 不能被解释为“没有工作”。
• SupervisorEventStore.record_locked／planSupervisorEventAppend 分别拥有 durability与typed semantic replay，commit-unknown先检查再重试，不证明外部 exactly-once。

New integration head 55edb1e:29retirement/supervisor/census tests, Ruff, mypy, typed typecheck, actual frontend build and real base/head CLI/HTTP recovery pass. Native census248sites is current. All110owned semantic patches equal reviewed39ccc7436; only source-coordinate/index-ID normalization. Earlier39ccc7436 whole scope19native premerge, full website CI, actual model/package tests retain their original source identity. Earlier9fb535Python/620typed/311realPG and installed Overview journeys remain bounded evidence; no result is relabelled as a new-source release qualification.

语义与 CI 对齐

原 review：#5328934556。全部110patch语义一致，加上新head真实集成验证，构成覆盖完整 PR 的 equivalent risk-based validation；原19项native premerge保留39ccc源码标签，并未伪称在55ed上重跑。新head CI仍按真实状态记录，不把 pending 算通过。版本资格继续针对固定39ccc源码运行，与此 integration head分开记录。

兼容变化明确：旧非空实验 Todo event 源原样拒绝，需用兼容旧版保存／导出；不自动转换或提升provider。Supervisor schema只表达私有proposal／host receipt，不授予Todo、scheduler、session creation、merge或外部动作权限。原预算、fixture population、扫描根与typed owner没有降低或更换。

对主干的风险

Alias、跨Goal过度拒绝、历史fallback、冲突replay和不确定durability均在当前29测试与实际CLIHTTP恢复中验证。原535Python／620typed／301provider+10service真实PG回归标明9fb来源；原39ccc完整19项native gate、官网CI、打包UI和模型证据也保留各自来源。旧Unicode负例、一次namespace60秒timeout与网页fragmenttimeout保存；相同预算复验通过，不能据此猜测性能根因。

正在执行的最终版本全量pytest发现一个未改动extension输出上限用例失败，原预算单项复验通过；此问题不在5054 caller／文件／执行路径，但完整release资格仍hold，单项通过不替代它。合入本PR不构成发布完成。

持续工作与用户体验仍得到改善：局部旧源不会阻断其他Goal，状态如实显示缺口，明确恢复后能继续。已安装Overview的三流程证据和新CLIHTTP读回支持这个边界。没有本PR新增的frontend/Lark配置入口；当前真实frontend build验证其optional schema组合。未来改动便利性检查保留共享alias owner、typed planner与durable primitive，删除第二authority，未加闲置框架。

我的整体评价

完整110patch与已评审实现一致，最新main组合已作明确的对照与实际入口验证。无本PR未解决行为blocker；用户已明确授权5054自修复自合并，可在此精确head的native readiness通过后合入。最终release资格与远程产物读回仍待完成。

English verdict: APPROVE