refactor(coordination): retire unused source lease reader

[loopx-agent]

Goal And Delivered Outcome

The source lease-reader helper has no production callers; its only consumer is a regression test reached through a test-only CLI export. Remove that internal crossing while moving its valuable complete-terminal-record assertions to actual TS-verified source capture/bootstrap and persistent authority reads.

Before: the regression exercised the idle reader. After: the helper/export are absent and the regression proves complete lease preservation, exact source-byte inventory, drift rejection, public File/SQLite cutover and original-receipt recovery.

Basis: the existing retirement cadence, immutable base 715c8774074871fa4b96c7efb6306436fc4b30be; PR base main.

Author Declaration

Written by: model_agent, OpenAI GPT-6 / OpenAI.

Implemented against

The retirement cadence at the base above requires last-caller proof, retained recovery obligations, real entrypoints, independent semantics and reversible deletion.

Criterion	Disposition	Implementation / evidence
Remove unused internal crossings with their last callers	implemented	load_task_lease_runtime_shadow_records and test-only CLI export removed; full tracked caller census and installed import readback
Preserve public behavior and complete recovery records	implemented	test_shadow_registry_source.py: unknown fields, absent/null/false, identity and byte inventory, rejection before publication, real File/SQLite cutover and original-receipt recovery
Preserve supported source writers, migration readers and historical receipts	implemented	Live snapshot assembly, compact lease capture, outbox readers/codecs, import/export and original receipts unchanged
Whole writer/default adoption	out_of_scope	Existing owning acceptance remains; this internal deletion grants no broader adoption qualification

Scope And Continuation

Complete within this cleanup scope. No new capability, production vocabulary, configuration switch or authority owner. Existing TypeScript verification/transactions remain the decision owners; Python continues necessary host/source IO. Related future-facing pass: move the old helper-only test onto its actual consumer and reuse the existing public CLI fixture, without a new abstraction.

Retired symbol / path	Production caller / replacement	Persisted obligation / rollback
runtime_shadow.py::load_task_lease_runtime_shadow_records	None; real snapshot assembler already reads and verifies source leases	Complete terminal records and byte inventory retained; revert code without data conversion
coordination_shadow.py test-only lease-reader export	Old regression only; replaced by real capture/bootstrap/public CLI coverage	No CLI schema or serialized handler removed

Whole source-writer/capture retirement still needs last supported caller and outbox/recovery qualification. Provider defaults, policy migration, product UI and installed adoption do not change.

Validation

• Tested revision: 009de62 (identical to validated working-tree source).
• Run state: finished.
• Input classes: synthetic, public_fixture.

Check kind	Result	Evidence / limitation
integration / real_entrypoint	passed	69 adjacent tests across adapter, registry-source, bounded runtime, archive, reviewed promotion and SQLite authority; 2 additional current public File/SQLite cutover/recovery cases
regression_parity / real_backend	passed	Same 8 terminal-lease cases on immutable baseline and independent installed wheel, disposable real File/SQLite stores. Full unknown/absent/null/false fields and exact bytes retained; cross-Goal and changed-byte inputs rejected before publication; newer canonical Todo survives original-receipt recovery. A deliberately lossy source-capture mutation is rejected through the public CLI and makes the independent case fail
packaging / real_entrypoint	passed	Current wheel built and installed separately; exact production bytes verified and both retired Python attributes absent. Final qualification uses 24 package-attributed CLI children per arm
static	passed	Ruff, configured mypy (19 sources), semantic advisory then full-tree vocabulary drift, registry I/O manifest (284 sites), public boundary scan and diff hygiene
canary	passed	17 risk-selected checks and 5 direct checks pass on the exact committed head; native current-scope quality receipt is valid
earlier attempts	failed, corrected	Initial synthetic Todo metadata syntax was rejected; fixture corrected without changing product rules. Stale frontend bundle was rejected by packaging; normal dependency install and chat build repaired it. Current qualification passed
platform / broader rollout	not_run	Windows, PostgreSQL and sustained adoption soak not rerun: no live provider/store, public routing or platform behavior changed. This slice does not certify their broader acceptance

Coverage follows the removed crossing and its real consumers. No public frontend/Lark/CLI operation changes; real CLI and packaged consumers are used for verification. No speed claim or provider-default change.

Frontend / Visual Evidence

UI impact: none. No first-viewport, interaction or presentation source changes. Generated build assets remain ignored.

Type of Change / Area

Refactoring, documentation and regression-test replacement; coordination control-plane internals.

Shared-authority RFC fixture impact

No new fixture schema or semantic dimension. Reuse current complete lease/source inventory and public CLI fixtures; File/SQLite parity qualifies this deletion only. The broader legacy/File/PostgreSQL promotion rehearsal is out of scope because production promotion/routing/projection paths are unchanged.

Boundary Checklist

• Public-safe product code, reference and focused tests only; private state, local paths, raw logs, credentials and internal links excluded.
• No duplicate benchmark work or data rewrite.
• Dedicated branch from the immutable main baseline; DCO sign-off included.
• Runtime/control-plane PR is left for maintainer merge after exact-head review.

[loopx-agent]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)
Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; xhigh

精确 head：009de6224bc9e0a4400d95bd154a4e7767f50360。未发现阻塞项；这是内部退役及验证迁移，完整 writer/default 采用仍需原有验收。

动机

维护协调源码与恢复逻辑的开发者。
以前完整历史 lease 的测试只经过闲置 reader；现在删除该入口，验证改走真实捕获、bootstrap、持久化读取和原回执恢复。
已验证闲置入口和测试专用导出消失，同时完整 lease 字段、原字节与恢复后的新增 Todo 得到保留。
本 PR 的边界是内部 reader 退役；完整 writer、默认采用、ownership 迁移和安装态全面升级仍沿用既有验收。

改动思路

保留现有 TypeScript 校验和事务 owner，以及 Python 中仍有调用方的源 IO。去掉没有生产调用方的 reader，并把原测试的完整终态记录语义迁到真实消费者。仅删旧测试会丢掉恢复保障；再造一个 helper 也没有必要。

规格：docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.md，修订 715c8774074871fa4b96c7efb6306436fc4b30be，按变更前的验收判断：

• Duplicate decisions / obsolete internal crossings：完整 tracked-tree caller census 仅有旧测试与测试专用导出；现 head 和独立 wheel 中两处旧属性均消失。
• Historical formats and receipts：完整 lease、未知字段、absent/null/false、原字节 inventory、原回执及新增 canonical Todo 的恢复均保留。
• Legacy Todo mutation：不属于这次内部 reader 的删除范围，当前可写源入口及其迁移/升级验收保留。

具体改动

覆盖全部六个文件：runtime_shadow.py 删除闲置 load_task_lease_runtime_shadow_records；CLI 模块删除测试专用 re-export；旧 adapter 测试迁入 test_shadow_registry_source.py；registry I/O manifest 只更新两处行号；既有 reference 记录删除与保留边界。

真实调用链保持 build_runtime_shadow_source_snapshot → _build_runtime_shadow_source_snapshot/compact_lease → 原生 source verification/bootstrap。新增验证继续走 drain、reviewed promotion、后续 Todo 写入、删除隔离的旧 Markdown、原回执恢复及独立 lease/Todo readback。没有新增 schema、开关、状态来源或 caller-facing 操作；frontend/Lark 的操作流程未改变。

对主干的风险

主要风险是把有价值的历史字段或恢复路径随 Python 一起删掉。因此本轮保留 live source IO、outbox reader/codec、backup import/export 和原回执，不以内部函数删除推导整个 writer 可退役。所有测试使用隔离合成数据，无 active Goal 数据改写。

不可变基线与独立 wheel 各通过同一组 8 项语义测试，最终每个 arm 的 24 次真实 CLI 调用有 package provenance，完整 lease 与恢复后新增 Todo 的观察一致；跨 Goal 与 changed-byte 输入在发布前拒绝。另在隔离 package 中故意让 live capture 丢掉未知字段：真实 CLI bootstrap 因 source_changed_retry 拒绝，独立测试如预期失败。现 head 的正常路径通过，没有以 mock 提供被验证的结果。

69 项相邻源码检查及 2 项新增真实 File/SQLite journey 通过；Ruff、mypy 19 个源文件、semantic advisory/full drift、284-site registry manifest、公开边界扫描、wheel build 通过。精确 head 的原生 premerge 17 项选择检查与 5 项直接检查通过，当前 CQR 有效。最初 fixture metadata 语法错误和 stale chat bundle 构建拒绝已按原规则纠正，失败证据保留；没有放宽 oracle。当前契约不等待 CI，未查询/轮询 CI。Windows、PostgreSQL 和持续采用 soak 此轮未运行；对应 live provider/platform 路径未变，这些更大资格仍未宣称。代码 revert 即可回滚，无数据转换。

我的整体评价

APPROVE。原任务的内部删除及真实消费者保真验证已完成；相邻重构已在同 PR 落地为旧测试迁移与现有 fixture 复用，没有增加新的生产框架。维护收益来自清除第二个闲置入口与修复验证归属，不宣称运行时加速或完整迁移已完成。属于 control-plane/runtime 变更，保留给维护者合并。

English verdict: APPROVE - 009de62; remove the production-unused reader/export, retain complete terminal history and original recovery, with immutable base/wheel parity, public lossy-mutation refusal, real File/SQLite journeys and exact-head native premerge validation. No provider-default or whole-writer qualification claimed.