C1: deliver complete-source Turn input and recovery

docs/architecture/rfcs/STATUS.md

@@ -31,7 +31,7 @@ appendix may keep dated history, but no dated log heading may precede it.
 | [RFC: Capable Agent Manager and Semantic Work Handoff (v0)](capable-manager-semantic-handoff-v0.md) | Accepted | [Personal Follow-through independent proposal](personal-follow-through-v0.md) | [2 entries](ledger/capable-manager-semantic-handoff-v0/) |
 | [RFC: Complete State Recovery and Controlled Reactivation (v0)](complete-state-recovery-v0.md) | Accepted | none | — |
 | [RFC: Composable State Machines and Recovery Verification (v0)](composable-state-machines-recovery-verification-v0.md) | Accepted | none | — |
-| [RFC: Controller / Executor Sessions and One Governed Work Contract (v0)](controller-executor-unified-contract-v0.md) | Accepted | none | [5 entries](ledger/controller-executor-unified-contract-v0/) |
+| [RFC: Controller / Executor Sessions and One Governed Work Contract (v0)](controller-executor-unified-contract-v0.md) | Accepted | none | [12 entries](ledger/controller-executor-unified-contract-v0/) |
 | [Explicit Todo continuation: Stage A](cross-session-memory-substrate-v0.md) | Accepted | none | — |
 | [RFC: LoopX Desktop Execution Frontends v0](desktop-execution-frontends-v0.md) | Accepted | none | — |
 | [RFC: External Evidence Research Capability v0](external-evidence-research-capability-v0.md) | Accepted | none | [3 entries](ledger/external-evidence-research-capability-v0/) |

docs/architecture/rfcs/STATUS.zh-CN.md

@@ -28,7 +28,7 @@
 | [RFC：强能力 Agent 管家与语义工作交接（v0）](capable-manager-semantic-handoff-v0.zh-CN.md) | 已接受 | [个人事项持续跟进独立提案](personal-follow-through-v0.zh-CN.md) | [2 条](ledger/capable-manager-semantic-handoff-v0/) |
 | [RFC：完整状态恢复与受控重新激活（v0）](complete-state-recovery-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：可组合状态机与恢复验证（v0）](composable-state-machines-recovery-verification-v0.zh-CN.md) | 已接受 | 无 | — |
-| [RFC：Controller / Executor 会话与统一受治理工作契约（v0）](controller-executor-unified-contract-v0.zh-CN.md) | 已接受 | 无 | [5 条](ledger/controller-executor-unified-contract-v0/) |
+| [RFC：Controller / Executor 会话与统一受治理工作契约（v0）](controller-executor-unified-contract-v0.zh-CN.md) | 已接受 | 无 | [12 条](ledger/controller-executor-unified-contract-v0/) |
 | [显式 Todo 接续：阶段 A](cross-session-memory-substrate-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：LoopX 桌面执行前端 v0](desktop-execution-frontends-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：外部证据研究能力 v0](external-evidence-research-capability-v0.zh-CN.md) | 已接受 | 无 | [3 条](ledger/external-evidence-research-capability-v0/) |

docs/architecture/rfcs/controller-executor-unified-contract-v0.md

@@ -179,6 +179,17 @@ writer/consumer cutover and original-quota outcome/full-cost qualification remai
 open. The added bridge calls must be counted; code convergence alone is no
 evidence of lower cost.
 
+The current-main integration also checks the provenance of its qualification
+fixtures. `read_fixture_todos` previously seeded canonical authority from an
+attention summary, erasing an authored tail after 500 characters before capture.
+It now uses the existing full source parser and Todo normalizer. A real
+File/SQLite CLI case carries that tail through complete capture, a subprocess
+Host's artifact, independent validation, settlement and replay. Both original
+truncation failures remain evidence; this repairs the test input, not a runtime
+policy. Current size and compatibility failures remain open. Deterministic
+artifact agreement and measured CLI/RPC bytes do not qualify model comprehension,
+native accepted outcomes, total cost or the full C1 cutover.
+
 | Current source / obligation | Present envelope treatment | Required C1 disposition |
 | --- | --- | --- |
 | `interaction_contract.agent_channel.work_context` and pending required reads | `work_context` plus `required_reads`; identical inline material can be referenced | One complete requirement/evidence source with resolvable references; preserve pending reads and their completion conditions |
@@ -890,6 +901,21 @@ reject an unsupported inner version before Codex prompt execution or DSH runner
 loading, without spend. The complete-contract/context/DSH/stdio selection passes
 352 cases; TypeScript checking and focused lint pass. This qualifies these
 interaction semantics, not every required field or packaged-host adoption.
+Heartbeat templates now own the ordered settlement instruction; exact-Turn
+binding adds only its canonical source locator, instead of repeating the
+execution and no-static-reconstruction clauses. Thin prompts combine complete
+capture and required-context reads before action, while sharing the unchanged
+progress/outcome clauses. On the unchanged full-route fixture (320-character
+scope, explicit CLI and five capabilities), the unbound prompt falls from 4,981
+to 4,895 budget characters under the original 4,900 ceiling. The exact-Turn
+variant falls from 5,198 to 4,987 and still fails that ceiling. The padded-route
+negative remains rejected; no route, capability, fixture population or limit
+was shortened. The prompt/platform selection passes 115 checks with one skip.
+These are presentation and clause-retention results, not model adoption or cost
+benefit. Four other original CLI-budget failures remain open. Integration with
+opaque reader references also exposed two obsolete digest-field assertions;
+their File/SQLite consumers now read the pinned machine descriptor, preserve
+the original receipt and reject byte-changed captures without admission or spend.
 Remaining cache consistency investigation, other old reader expectations, staged instruction parity and
 actual optional/external consumers, version admission and packaged host
 continuity remain unfinished. Operation-SDK checks without an explicit native
@@ -914,6 +940,13 @@ design, not a claim that these paths have changed.
 | `turn_driver/decision_capture.py` and `cli_commands/quota_capture.py` | Reuse immutable capture, validated readers and full/delta delivery. Fresh delivery and saved-capture recovery must reconstruct the same contract; do not reuse a continuity baseline for a different projection merely because its Turn identity matches. |
 | `benchmark/runtime/worker.py`, `benchmark/runtime/sessions.py` and `scripts/external_scheduler_worker.py` | Migrate the product entry they actually invoke. Keep evaluation setup and outer wake ownership; do not add benchmark-only conversion or count a managed-host test as attached-host acceptance. |
 
+The current proposal's [private-plan checkpoint](ledger/controller-executor-unified-contract-v0/2026-10-30-c1-source-convergence.md#current-private-plan-boundary)
+migrates the complete-source Turn writer and its capture, Host, CLI resume,
+native conversation, capability, child-result and journal consumers together.
+It writes one source in `loopx_turn_plan_v1`, retains explicit original-version
+readers, and does not close the remaining quota-preview/presentation, installed
+adoption or original-quota outcome/full-cost requirements.
+
 Before replacing any seam, its implementation PR records source path, field or
 instruction clause, current readers, target owner, representation, recovery and
 retirement condition. Relocation must include reference resolution; an omitted
@@ -933,6 +966,22 @@ are reconciled. Rollback likewise separates outstanding work from new admission.
 A version transition does not rewrite saved prompts, journals or source hashes
 as if they had always used the new contract.
 
+Code convergence is part of each migration slice, not only the final C9 cleanup.
+Both entrypoints must call the same semantic implementation for composition,
+reference validation, context reconstruction and settlement. Keep genuinely
+host-specific launch/observation mechanics in thin adapters; do not force their
+different lifecycles into a new general-purpose runner. The existing typed owners
+remain responsible for their respective decisions.
+
+For each slice, record the before/after callsites, shared owner, removed duplicate
+algorithm and remaining compatibility caller with its removal condition. Qualify
+both routes with the same independently authored semantic cases and their real
+transport/recovery tests. A wrapper that only delegates can be transitional;
+copying a rule into a newly named common module while leaving two implementations
+is not convergence. The next change to a shared rule should be made and tested in
+one owner and reach both routes. Do not make declining line counts an acceptance
+metric or remove unique host coverage to meet one.
+
 The first C1 PR must include the two production composition callsites above and
 at least one complete producer-to-final-input journey, with an explicit list of
 remaining readers. Qualifying that bounded slice does not enable the new writer
@@ -1252,6 +1301,84 @@ model adoption. All-host defaults, other omitted material, trusted Host coverage
 writer/reader cutover and §9's outcome/full-cost comparison remain open. Index
 overhead participates in the existing full-versus-folded byte guard.
 
+The C1 candidate's journal inspection, publication, settlement lookup and managed
+retry now consume a present complete contract through the same checked-source
+owner as Host dispatch. A changed source, unsupported version or self-consistent
+but divergent executor adapter blocks recovery/publication; it cannot select the
+historical decoder. Native file reads and Python transport retain the original
+sparse numeric spellings. The old adapter-only decoder remains for historical
+journals without a complete contract. This is a source-integrity repair with
+additional validation cost, not installed adoption, full reader retirement or
+the original-quota outcome/net-cost qualification.
+
+The candidate's external generic CLI stdin now uses the same complete-source
+Host request v1 as native model input. It removes the second executable
+envelope from that wire and preserves the original contract, capture readers,
+Turn key and result transport. The shared checked-source owner validates v1
+directly; native adapters share version decoding, and the DSH stdio consumer
+accepts v1 as well as historical v0. Missing/invalid source, mixed carriers and
+capture drift refuse without selecting the historical decoder. Ark and MemT
+distribution adapters also use the Core decoder through the
+existing supported Host seam; provider permissions, receipt recovery and exact
+memory-lifetime gates remain. Their matching-Core requirement is explicit.
+The private executor adapter and versioned historical journal readers remain until their
+own replacement is qualified. This source-level wire cutover requires external
+v0 adapters to migrate; it establishes neither installed adoption, original
+quota outcome/full-cost qualification nor model-retention benefit.
+
+The candidate's built-in Codex/DSH session-index lookup now reads identity from
+one checked complete source. Normal CLI planning, failed-session resolution and
+journal inspection no longer transport a second executor adapter for that read.
+The existing TypeScript identity owner and native session store retain the same
+Goal/Agent/Todo scope, namespace and lifetime checks. An explicitly supplied
+historical adapter still selects its existing decoder and consistency checks;
+malformed supplied sources never fall back. Host dispatch, injected callbacks
+and the private executor/journal adapter keep their separately qualified
+boundaries. This read-only caller replacement does not authorize a launch or
+qualify whole-C1 retirement, model adoption or original-quota full-cost benefit.
+
+The candidate's strict Codex result normalizer also reads material-result
+evidence applicability through the existing checked-source owner, for both the
+CLI and operation Host. A complete source cannot lose that obligation when
+its executor adapter is absent; malformed supplied sources do not fall back.
+The strict output schema keeps required nullable fields, stop results normalize
+null evidence to absence, and non-null evidence content remains the executor
+validator's responsibility. Historical requests without a complete source
+retain their original rule.
+This replaces one active metadata reader and adds a fresh source check after
+the provider; it does not qualify whole-C1 cutover or net-cost/model benefit.
+
+Operation Hosts also reuse that dispatch owner for preparation and normalized
+session lineage. Codex checks complete work and Goal delivery before native
+initialization, retaining a fresh prompt/schema check after startup. DSH reuses
+the lineage already checked in its preparation invocation instead of issuing
+another identity read. The optional projection metadata stays outside model
+input and persisted authority; callers that do not request it retain their
+existing projection. Historical codecs, session scope/lifetime, confirmation
+and consumption gates, and post-provider validation keep their owners. These
+caller changes require separate startup/refusal, native protocol and matched
+component-cost evidence; they do not close the remaining private-adapter cutover
+or establish original-quota outcome/full-cost benefit.
+
+The shared Turn Host-request producer now selects that same complete v1 input
+for built-in Hosts and injected callbacks as well as generic CLI stdin. It
+checks the private plan's source/adapter consistency before removing the second
+carrier. Original-capture publication preserves v1 and its immutable reader
+header; only an original historical observation can restore the old request
+codec. A quota capture without a journal key retains its original source-Turn
+reference; provided journal keys still match exactly, without a fabricated binding.
+Failed-session recovery checks the complete source/header and retains the
+existing native scope, action-hash number codec and scoped request/replan identity.
+Its complete-input `driver_lineage` reader now consumes the checked action facts
+directly, without regenerating a v0 adapter, cold reader commands or compaction
+diagnostics. Both readers share the same route and scoped-identity rules;
+historical envelopes retain their own version/signature proof and scalar codec.
+Private plans/journals still retain their adapter: retiring this recovery caller
+does not retire that writer or all Core adapters. Qualify actual dispatch,
+recovery/replay and source-check/derivation costs separately. Unchanged bridge
+traffic is not a measured latency gain; already-complete model input is not
+another compression gain or original-quota outcome qualification.
+
 C1's inventory is part of its usable replacement, not a standalone architecture
 framework. C3/C4/C5 can proceed independently once C1's contract is stable;
 C7 can prepare measurements before C6 but cannot claim two-session outcomes.
@@ -1390,3 +1517,11 @@ The directory is the index. A planning/source-inspection entry does not establis
 runtime delivery; live priorities and claims remain in the roadmap and canonical
 work. Keep historical entries append-only and refine the current normative plan
 here rather than treating a dated audit as a permanent execution queue.
+
+The [source-convergence checkpoint](ledger/controller-executor-unified-contract-v0/2026-10-30-c1-source-convergence.md)
+keeps the candidate's detailed chronology outside this normative plan. Integration
+preserves main's presentation/journal owners and shares numeric source identity
+and edit transport across acceptance, summaries, authoring and Vision. This does
+not qualify writer/consumer cutover, installed adoption or the original-quota
+accepted-outcome/full-cost comparison. Remaining reader retirement and negative
+cost observations keep C1 open.