loopx-project · huangruiteng · Sep 27, 2026 · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026
@@ -131,6 +131,8 @@ export const todoIndexSchema = z.object({
   current_projected_count: z.number().optional().default(0),
   rollout_event_count: z.number().optional().default(0),
   item_limit: z.number().optional().nullable(),
+  complete: z.boolean().optional(),
+  unavailable_goal_ids: z.array(z.string()).optional(),
   items: z.array(todoIndexItemSchema).optional().default([]),
 });
 

@@ -20,7 +20,7 @@ them as though they were interchangeable PRs.
 | #4870 claim-preserving writes; #4888 reviewed cutover; #4920 drain planning | Implemented. Exercise their combined head; do not commission replacements. |
 | #4922 complete canonical snapshot pagination; #4960 qualified SQLite runtime admission; #4961 display refresh recovery; #4964 shared source summaries | Implemented. Consumer and packaged-client acceptance still needs integration evidence; a whole new pagination/recovery implementation is not pending. |
 | #4967 typed complete-source assembly; #4968 native outbox delivery/recovery | Implemented. Complete-source transport is also merged in #5013; capture assembly is not missing. |
-| #5003 atomic event-owned completion | Merged. Solves batch publication/retry, **not** the event writer's shadow-capture binding. |
+| #5003 atomic event-owned completion | Historical implementation; retired with its Todo event source in #5054. Do not rebuild capture for it. |
 | #4994 explicit leased Agent handoff; #4995 generated Monitor proof; #4991 rejected poll reservation; #4992 deferred receipt-bound Turn | Merged. Audit the integrated callers before deciding what remains; do not recreate them under a new caller-refactor PR. |
 | #4931 retained SQLite proof encoding, contributor #4224 | Open optimization plus incomplete D2 qualification. A speedup is not capacity/recovery/soak acceptance. |
 | #4915 default `.loopx` filesystem placement | Separate configuration migration; does not select File/SQLite authority. |

@@ -35,7 +35,7 @@ SQLite 已有 TS checkpoint/delta 编码，保留原始版本、回执和完整
 | #4870 保留 claim 的写入、#4888 reviewed cutover、#4920 drain 规划 | 已实现。验收组合 head，不再重新安排一套替代实现。 |
 | #4922 完整 canonical 快照分页、#4960 SQLite runtime 准入、#4961 显示刷新恢复、#4964 共享来源摘要 | 已实现。消费者和打包客户端仍需组合验收，不等于还缺一个全新的分页/恢复实现。 |
 | #4967 TS 完整来源组装、#4968 原生 outbox 交付/恢复 | 已实现。大型来源传输亦已通过 #5013 合入；不能再称为 capture 未做。 |
-| #5003 event-owned completion 原子提交 | 已合入。解决整批发布/重试，不负责 event writer 与 shadow capture 的绑定。 |
+| #5003 event-owned completion 原子提交 | 历史实现；在 #5054 中随旧 Todo 事件来源一起退役，不再补其 capture。 |
 | #4994 带 lease 的显式 Agent 交接、#4995 Monitor 命令 proof、#4991 拒绝 poll 后释放预约、#4992 延期且绑定 receipt 的 Turn | 已合入。组合现有实现盘点 caller，不能再开一个 caller 重构 PR 重做它们。 |
 | #4931 SQLite retained proof 编码、contributor #4224 | 优化 PR 开放，D2 资格未闭合。提速不等于容量、恢复和 soak 验收通过。 |
 | #4915 默认 `.loopx` 目录 | 独立的配置迁移，不会选择 File/SQLite authority。 |

@@ -1,5 +1,7 @@
 # Event-owned completion: one publication before capture integration
 
+> Superseded by [Todo event retirement](2026-09-25-todo-event-retirement.md): this historical implementation is removed in #5054.
+
 Baseline: `90f21a5299188d54f984a5313e774c9ac48d6595`. This advances overall
 roadmap R5/G2, shared-authority L2/L7 and TS T1/T2. It closes an existing event
 writer correctness gap; it does not qualify that writer for shadow capture.

@@ -1,5 +1,7 @@
 # 事件源完成事务：先建立完整提交，再接入捕获
 
+> Superseded by [Todo event retirement](2026-09-25-todo-event-retirement.md): this historical implementation is removed in #5054.
+
 基线：`90f21a5299188d54f984a5313e774c9ac48d6595`。对应总路线 R5/G2、
 shared-authority L2/L7 与 TS T1/T2。本批修复已有事件写入者的正确性，
 不授予该写入者 shadow capture 资格。

@@ -0,0 +1,50 @@
+# Retire the experimental Todo event source
+
+## Delivery brief
+
+- Goal/source: roadmap R5/S12, TypeScript T4 and shared-authority D1–D3;
+  maintainer direction on #5054 retires the old Todo event route.
+- Gap: a second Todo projection/writeback pipeline was being extended solely to
+  capture a retired source. Supervisor proposal/receipt logging was its remaining
+  independent product caller.
+- Result: delete Todo replay/overlay/backfill/completion and the unused migration
+  bridge. Keep Markdown compatibility and provider authority; detect nonempty
+  retired sources rather than silently omit their records.
+- Owners: Todo source admission; existing TS completion/authority owners;
+  experimental supervisor log under `control_plane/agents`.
+- Acceptance: source selectors refuse without writes or validation effects;
+  canonical reads ignore stale legacy files; normal completion/successors and
+  downstream status/quota/review-packet work; supervisor concurrent receipts,
+  preview, conflicting identity and uncertain-publication replay are covered.
+
+## Compatibility and scope
+
+A nonempty `events.jsonl`, `state_event_log`, `state_events_file` or `event_log`
+source refuses legacy Todo reads/writes and shadow qualification. The operator
+must preserve it and export/inspect its Todos with a compatible older release
+before deliberately removing the binding/file from the active source location.
+There is no automatic replay, deletion, Markdown fallback or new migration API.
+Portfolio status isolates this refusal to its Goal, preserves healthy Goals,
+and marks the refused Todo source unavailable. The Todo index declares the
+unavailable Goal and incomplete coverage; its historical rollout records cannot
+substitute for current Todo authority. CLI and HTTP status remain readable.
+Absent and zero-byte files have no event-owned Todos. Previously prepared
+unsupported event outbox records remain rejected; this PR does not certify them.
+
+The supervisor is experimental/default-off. Its `supervisor_log_event_v0`
+envelope accepts only local-private proposals/receipts. Old experimental log
+formats require manual archival before a fresh log; unknown formats fail without
+rewriting. Admission and publication share the log lock; execution replay checks
+full semantic identity while allowing a new observation timestamp. Preview never
+publishes or syncs the log. A durable executed receipt prevents a second executed
+receipt; this does not close the crash interval between an external host effect
+and its receipt. External-effect fencing retains its own roadmap acceptance.
+
+## Remaining boundary
+
+This supersedes older entries calling for event-writer binding/capture. It does
+not recount already delivered transaction capture, nor subtract a PR from a
+fixed total. Remaining exits are executor-effect fencing, qualified whole-Goal
+migration/rollback, default onboarding and bounded deletion of reachable Python
+writers. D2 backend/capacity/soak and #4931 remain independent evidence. PostgreSQL
+continues using the same authority contract; no new provider is added here.
@@ -0,0 +1,40 @@
+# 退役实验性 Todo 事件来源
+
+## 交付摘要
+
+- 目标／来源：roadmap R5/S12、TypeScript T4 与 shared-authority D1–D3，
+  以及维护者在 #5054 中删除旧 Todo 事件路径的明确方向。
+- 缺口：为捕获一个退役来源而继续扩展第二套 Todo 投影和写回；其中仍有独立用途的
+  caller 是 supervisor 提案／回执日志。
+- 结果：删除 Todo replay、overlay、backfill、completion 与未被产品调用的迁移桥。
+  保留 Markdown 兼容及 provider 权威；拒绝非空旧来源，避免无声丢失记录。
+- 归属：Todo 来源准入、现有 TS completion／authority owner，以及
+  `control_plane/agents` 下的实验 supervisor 日志。
+- 验收：各来源别名拒绝且不写数据／不执行验收命令；canonical 读取忽略遗留文件；
+  普通 completion／successor 与 status／quota／review-packet 链路正常；
+  supervisor 覆盖并发回执、预览、身份冲突和提交结果未知后的重放。
+
+## 兼容与边界
+
+非空 `events.jsonl`、`state_event_log`、`state_events_file` 或 `event_log` 来源
+会阻止旧 Todo 读写和 shadow 资格验证。操作者须保留原文件，先用兼容旧版本检查／
+导出其中 Todo，再有意移除活动来源位置的绑定或文件。没有自动回放、删除、
+Markdown 降级或新增迁移 API。缺失及零字节文件不承载事件 Todo。
+全局状态将拒绝隔离到所属 Goal，保留健康 Goal，并明确标记该 Todo 来源不可用。
+Todo 索引标注不可用 Goal 及不完整覆盖，不能用其历史 rollout 记录替代当前 Todo
+authority。CLI 和 HTTP 状态接口保持可读。
+以前准备但不受支持的事件 outbox 记录仍会被拒绝，本 PR 不为其提供资格认证。
+
+Supervisor 保持实验性、默认关闭；新 `supervisor_log_event_v0` 只接收本地私有的
+提案和回执。旧实验格式须人工归档后启用新日志；未知格式会明确拒绝，不自动改写。
+准入与发布共用日志锁；重试比较完整语义身份，允许观察时间变化。
+预览不发布或同步日志。持久化 executed 回执阻止第二份 executed 回执，但不解决
+“宿主外部动作执行后、回执落盘前崩溃”的区间；外部动作保护继续遵循独立验收。
+
+## 剩余边界
+
+本决策替代旧交付记录中“补事件 writer 绑定／捕获”的计划，不重复计数已交付的
+事务捕获，也不机械地从固定 PR 数量中减一。剩余退出条件仍是执行器外部动作保护、
+整 Goal 迁移／回退资格、默认启用和可达 Python writer 的有界删除。
+D2 后端／容量／持续运行证据与 #4931 单列。PostgreSQL 继续复用原 authority 合同；
+本 PR 不添加 provider。
@@ -45,6 +45,20 @@ SQLite reuse logical archives for cross-provider isolated recovery.
 This adds no provider/default promotion and retires no Python business owner.
 [Automatic backup/migration, cold costs and qualification limits](../../reference/file-authority-state-log.md).
 
+## Todo event retirement (2026-09-25)
+
+PR #5054 replaces its original event-writer capture proposal with removal of
+that experimental Todo source. `events.jsonl` is no longer projected, overlaid,
+backfilled or used for completion. Nonempty default/aliased sources are refused
+without changing their bytes; empty/absent sources permit the Markdown path.
+Promoted Goals continue reading their selected provider even if stale legacy
+files remain. The supervisor uses its own local-private experimental log.
+
+This closes the *retired source* branch by deletion, not by claiming event-writer
+capture was qualified. Whole-Goal migration/rollback and default onboarding
+still require their existing acceptance; this change does not make all Python
+writers or PostgreSQL deployment ready. Do not add a replacement event capture
+PR to the remaining work. [Decision and exits](ledger/shared-goal-authority-state-provider-v0/2026-09-25-todo-event-retirement.md).
 
 ## Persistence route for steward scale (2026-09-16)
 
@@ -84,8 +98,7 @@ integration defects; it neither recounts shipped capture nor flips global defaul
 [Operation and boundaries](../../reference/reviewed-coordination-promotion.md).
 
 Handoff-mode changes now share one TS ownership-fact classifier before and
-after promotion. Legacy event-only claims reject rather than disappear at a
-Markdown boundary; event append locks protect the observation through writeback.
+after promotion. Legacy nonempty event sources are refused before any Markdown substitution.
 Canonical changes reuse durable command receipt recovery. This is an L2/L3
 compatibility correction with Python decision deletion, not cohort migration,
 SQLite D2 completion or a default flip. Remaining work depends on executor/consumer closure, qualification,
@@ -1201,7 +1214,7 @@ Qualify an **embedded transactional store, with SQLite as the first candidate**,
 behind the existing TypeScript `AuthorityStore` owner. A local goal must not
 require a PostgreSQL service. The file-v0 provider remains a conformance/import
 baseline; no general-purpose ten-day promotion may rely on its full-history
-rewrite. [PR #4121](https://github.com/huangruiteng/loopx/pull/4121) supplies an
+rewrite. [PR #4121](https://github.com/loopx-project/loopx/pull/4121) supplies an
 opt-in SQLite conformance candidate behind that owner; it does not by itself
 qualify long-goal durability or change the default. Dependency/package,
 Windows/macOS/Linux and supported Node-profile evidence remain explicit gates.

@@ -30,6 +30,19 @@ PR：本次恢复切片、外部执行区间保护、整 Goal 激活/回退集
 缺失证据另列，不能保证最终缺陷修复数量。
 [当前清单、依据及退出条件](ledger/shared-goal-authority-state-provider-v0/2026-09-27-recovery-audit.zh-CN.md)。
 
+## Todo 事件路径退役（2026-09-25）
+
+PR #5054 将原先的事件 writer 捕获方案改为删除这条实验性 Todo 来源。
+`events.jsonl` 不再参与投影、叠加、回填或 completion；默认路径及显式别名指向的
+非空文件会被明确拒绝使用，原字节保留。空文件或缺失文件允许 Markdown 路径继续。
+已晋升 Goal 仍以选定 provider 为准，不受遗留文件影响。Supervisor 改用自己拥有的
+本地私有实验日志。
+
+这是通过删除关闭旧来源分支，不是宣称事件 writer 已通过捕获资格验证。
+整 Goal 迁移／回退、默认启用仍须满足现有验收；不能据此宣称所有 Python writer
+已经退役或 PostgreSQL 已可部署。剩余工作不再新增“补事件捕获”PR。
+[决策与退出条件](ledger/shared-goal-authority-state-provider-v0/2026-09-25-todo-event-retirement.zh-CN.md)。
+
 File 历史存储在 #5063 的读取缓存和 RPC 预算之上，复用现有 TS checkpoint/delta
 编码；物理格式升级保留原版本、回执和每条完整历史投影。正常读写只接受 v1，
 安装入口调用显式升级流程，先自动备份、验证再迁移；旧解析器仅用于迁移。File／
@@ -937,7 +950,7 @@ projection 后的累计重写。这是 payload 解析估算，不是 SSD 物理
 
 在既有 TypeScript `AuthorityStore` owner 后资格化**嵌入式事务存储，首选候选为
 SQLite**。本地 goal 不应依赖 PostgreSQL 服务。file-v0 保留作 conformance/import
-基线，通用十天 goal 晋升不能依靠其全历史重写。[PR #4121](https://github.com/huangruiteng/loopx/pull/4121)
+基线，通用十天 goal 晋升不能依靠其全历史重写。[PR #4121](https://github.com/loopx-project/loopx/pull/4121)
 在该 owner 后提供显式 opt-in 的 SQLite conformance 候选；它本身不证明长程耐久性，
 也不切换默认值。依赖／打包、Windows/macOS/Linux 与受支持 Node profile 的证据仍是
 显式门禁。分段文件日志作为比较候选；PostgreSQL 继续走独立的共享服务路线。