[hhyykk]

Goal And Delivered Outcome

• Outcome basis / optional anchor: TypeScript control-plane migration RFC §2.4 and §8 (no retained Python code without a real caller). Follow-up to refactor(control-plane): retire dead local snapshot and standing-decision wrapper #7870.
• Goal/source and gap: An import and reference audit found Python helpers left behind by earlier transaction cutovers. Nothing calls them: no production code, test, example, script or package, and no string-based or lazy dispatch either. Two RFC/ledger passages still described two of them as retained.
• Observable before → after: 402 lines of unreachable Python product code → removed. The RFC and ledger text is corrected in both languages. No runtime behavior changes and no cross-runtime calls change, because no execution path reached this code.
• Issue/task and intended base: Self-contained maintenance outcome; base loopx-project/loopx:main. No issue closure claimed.

Author Declaration

• Written by: model_agent: Factory Droid (lead, review and commits) with OpenAI Codex CLI (implementation).

Implemented against

Criterion	Disposition	Symbol / path	Check
Delete only code that nothing calls (whole-repo rg -w, __all__, lazy export maps in loopx/todos.py and loopx/quota.py, string dispatch)	implemented	todos/update_source.py (whole file); mutation_response.serialize_todo_update_result; completion_validation.prepare_user_todo_update_completion, locked_todo_completion_source; active_state_editing.set_todo_text; local_state_write_correctness.shadow_validate_local_state_write_correctness_packet and its private lease helper; worker_bridge trace loader and counter reducer; primary_action.protocol_monitor_action	repository-wide search; tests below
Keep live neighbours intact	implemented	serialize_added_todo_payload, dry-run packet builders, trace append, resolution trace, codecs; all retained functions are AST-identical to base	ruff; tests below
Correct stale retention text (EN and zh-CN)	implemented	migration RFC public-update checkpoint; ledger/typescript-control-plane-migration-v0/2026-10-27-primary-action-instruction-selection{,.zh-CN}.md. Historical text is kept, with a dated correction added	check_rfc_bilingual.py

• Self-check before submission: Read the full diff and re-searched each removed name across the repository (code, tests, examples, scripts, packages, apps, docs).

Migration economics receipt

Field	Result
Canonical owner	Unchanged; the removed helpers were superseded by existing typed owners (todos/public_update.ts, interaction contract, typed Todo mutation transport)
Legacy code deleted	402 product lines (helper bodies plus imports they alone used)
Bridge code added	0
Cross-runtime calls	Unchanged; no execution path reached the removed code
Product net change	−402 lines; tests unchanged
Facade exit	Removed helpers exit now

Scope And Continuation

• Completed scope and remaining work: Complete within this scope. This is cleanup after earlier cutovers, not a new transaction migration.
• Deliberately not included: audit hits that have no in-repo production caller but are documented as public or extension contracts (for example the Lark document-comment provider, governed capability execution, the peer-supervisor inject seam and the Explore replay runtimes). Those need explicit compatibility-exit decisions, not silent deletion.

Validation

• Tested revision: fc81212
• Run state: finished
• Input classes: synthetic

Check kind	Result	Public-safe evidence / limitation
static	passed	ruff check on all changed Python files.
unit	passed	Todo mutation authority, worker bridge, completion validation, public Todo update plan, update lease recovery, state-refresh projections, scheduler interaction arbitration: 136 passed, 0 failed.
unit	passed	TS public_todo_update, interaction_contract, todo_update: 91 passed, 0 failed.
unit	failed (pre-existing)	A broader 751-test Python run also had 4 failures, all test_todo_consumer_retirement.py::test_once_only_settlement_uses_retained_owners (File/SQLite × facade present/absent). They fail identically on untouched origin/main (KeyError: 'decision' in test_canonical_todo_writer_isolation.py). The removed code is not involved.
static	passed	check_rfc_bilingual.py --base origin/main --head HEAD; diff checks; changed-file compile; maintainability ratchet; public-boundary scan; semantic vocabulary drift.
canary	failed (pre-existing)	loopx canary premerge: 16 of 18 selected checks passed. The 2 failures reproduce on untouched origin/main: the catalog-selected examples/worker-bridge-install-contract-smoke.py does not exist on main (stale catalog entry), and examples/codex-cli-tui-bootstrap-smoke-bundle-smoke.py fails in scripts/install-from-github.sh on main as well. Manual hold: benchmark_sensitive (path classification only; no benchmark code changed).

• Coverage and gaps: PostgreSQL-dependent TS cases were skipped (no isolated server); none exercise the removed code. Installed-artifact checks were not run.

Frontend / Visual Evidence

• UI impact: none.
• Before / After / First viewport / States / Source data / Attention / Craft: N/A; no UI surface change.

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference: TypeScript control-plane migration RFC deletion rule (code exits with its last caller).

Shared-authority RFC fixture impact

• Production-scale fixture schema / semantic dimensions / conformance arms / three-arm rehearsal: N/A; only unreachable helpers are removed.

Boundary Checklist

• Reviewed diff and body for private state, credentials, raw traces, internal links and local machine paths; none included.
• No maintainer-owned benchmark work duplicated.
• Change remains scoped to the request described above.
• Paired RFC and ledger files changed together (EN and zh-CN).
• UI impact marked none.
• Every branch commit includes a DCO Signed-off-by trailer (git commit -s).

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T08:01:20.836909Z	fc81212	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[loopx-agent]

1) 问题定义（为什么改、要解决什么）

• 推进控制面减法重构（TypeScript Control Plane Migration v0），清理已完成迁移后在 Python 控制面与 worker_bridge 中残留的无调用死代码，并同步修正双语迁移台账中的过时描述。

2) 改动摘要（按模块分组）

• 死代码清理 (loopx/control_plane/**, loopx/worker_bridge.py)：移除 shadow_validate_local_state_write_correctness_packet、set_todo_text、prepare_user_todo_update_completion、locked_todo_completion_source、serialize_todo_update_result、todo_update_snapshot（删除 update_source.py）、protocol_monitor_action 以及 load_worker_bridge_counter_trace_file / build_worker_bridge_interaction_counters_from_trace 共 402 行无调用遗留辅助函数。
• 双语 RFC 与台账同步 (docs/architecture/rfcs/**)：在中英文 typescript-control-plane-migration-v0 主文档及 2026-10-27-primary-action-instruction-selection 台账中补充 2026-11-02 更正说明。

3) 逐点审阅结论（架构、语义、正确性、测试、风险）

• 全仓引用核验：通过 git grep 全仓检索上述 9 个被删符号，确认在 loopx/、tests/ 与 examples/ 中均已无任何剩余调用方；双语 RFC 对齐且语义一致。

4) 建议修改项（分 P0/P1/P2，带文件路径和行号）

• 无阻塞项。

5) 最终结论（Verdict）

Approved — ready to merge once CI completes (exact head fc8121294505c542427eefb7543c7c4e54e2526f verified; zero remaining symbol references across repo).

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max

动机 / Motivation

维护控制面和审查其变更的开发者会在旧入口已退役后仍看到这些代码与过时保留说明。 过去维护者会遇到没有调用方的旧更新与 trace 代码，并从两处旧文档误判其仍在承担职责；现在删除不可达代码并同步修正中英文 checkpoint。 独立搜索没有找到十个被删函数的任何剩余调用；54 个保留函数 AST 相同，同一真实 Todo 生命周期 smoke 在 base/head 通过。 本次只完成这组已无消费者代码的退役，不宣称整个 Python facade 或长程收益已资格化。

改动思路 / Approach

生产已经采用现有 typed owner，退役死包装符合迁移 RFC 的“最后一个真实消费者退出后删除”约束。保留另一份不再执行的实现只增加下一次修改的搜索和误读成本。 当前 PR 删除不可达 helper 与无用 import，保留全部可达 Todo transaction、completion gate、worker trace writer 与 primary-action resolution。 不修改会保留已无消费者的语义和过时 checkpoint；加兼容 shim 会重新创造死入口。当前已有真实 owner，只应移除最后消费者之后的局部边界，未要求重写仍活跃的 Python I/O。 正向路径从 update_goal_todo / complete_goal_todo → existing native transactions 进入既有 owner，同一源/fixture 经过真实 owner 和 CLI，得到原有正确断言结果；异常路径保留 既有 Todo mutation authority、completion validation 与 lease recovery owner，原有负向 suite 和真实 smoke 保持拒绝及恢复断言，删除死代码没有绕过拒绝。本次完整审查当前 head，没有继承先前模板审查的通过结论。

具体改动 / Changes

11 paths +12/-406；产品代码为删除和 import 清理，四个文档更新修正已退役 helper 的表述；没有新增运行时分支。 既有 update/completion native transaction、writer fence、primary-action resolution 与 worker trace writer 全部保留；删除的是无消费者旧 helper。 没有新状态、分类或 persisted schema。决定资格/chronology 或 Todo lease/proof 规则均沿用原 typed owner。

关键代码讲解

• execute_completion_validation_effects：保留当前完成验证的执行与恢复路径。 只删除前面两个无调用的准备/锁内来源 helper；该函数 AST 未变。 输入为typed completion result 与 scoped source，关键条件是既有 actor/lease/proof 条件未放宽。原拒绝/恢复 owner 保留

• build_primary_action_projection：投影既有 primary-action 结果。 移除不可达 protocol_monitor_action；活跃 projection/trace AST 未变。 输入为current payload/mode/primary action，关键条件是不引入新的 monitoring obligation。原错误及终止语义保持

• build_worker_bridge_install_contract：保留 worker bridge 安装合同。 删除前方旧 trace loader/reducer；writer 和安装 builder 保留。 输入为existing worker spec，关键条件是trace writer 继续存在，不清除历史格式。原 bridge refusal/recovery

规格为 docs/architecture/rfcs/typescript-control-plane-migration-v0.md，spec_revision 867615e2c3aa2a32516a71d46f11a20d6fcb3289；§2.4/§8 要求以生产 caller 为依据退役，不通过改名、移入档案或永久保留 Python/TS twins 宣称完成。

• §2.4 reuse_and_retirement：implemented。已有 typed owner 继续负责决策；死包装不再构成平行 owner。 对应 update_goal_todo / complete_goal_todo → existing native transactions；全仓 caller/字符串搜索与 AST audit。
• §8 source_and_behavior：implemented。只删除最后消费者已退出的代码，保留真实状态/回执/恢复消费者。 对应 update_goal_todo / complete_goal_todo → existing native transactions；96 Python tests; 91 TypeScript tests; same real lifecycle CLI smoke at base/head。

对主干的风险 / Risks

最强风险是遗漏字符串/懒加载消费者，或误删真正承担授权/恢复职责的 helper；仅以净减行数无法排除它。 为区分修复与无效测试，我对不可变 base/head 执行相同输入：base 相同生产 smoke exit 0，原语义断言通过；head 同一 smoke exit 0；当前受影响 suites 全部通过。全仓检查同时搜索函数名、旧模块路径和动态 dispatch；不是只搜索 Python import。十个删除函数无剩余命中；54 个保留函数 AST 相同。 当前 Todo suites 覆盖 actor/lease/completion、worker bridge、公共 update、successor 与 lease 恢复；相同真实生命周期 CLI smoke 在 base/head 均通过。该 PR 不改变 standing-decision 规则，也不据此宣称对该规则完成新增验证。

• PASSED：same source smoke on base/head — both exit0；full semantic assertions preserved。
• PASSED：96 Python tests; 91 TypeScript tests; same real lifecycle CLI smoke at base/head — all selected current Python/TS suites passed。
• PASSED：whole-repo symbol search; AST compare; check_rfc_bilingual.py --base 867615e2c3aa2a32516a71d46f11a20d6fcb3289 --head HEAD; git diff --check — caller/AST evidence verified；双语与 diff 见独立日志。

语义与 CI 对齐

复用既有 typed source/decision vocabulary；退役 transient private RPC 不删除持久化回执格式。RFC 英中同步修正，旧历史边界仍可追溯。 没有新增或重定义 default-off 路径；所有可达生产状态/权限保持，相关 enabled/disabled 和非法主体 suite 已执行。 独立证据覆盖当前 changed invariant；远端 CI 的其他状态与合并 readiness 另行保留，没有把检查颜色当作正确性证明。 真实 source CLI/TS 和合成隔离状态已执行；未宣称 installed 或整体长程效率资格。未触及 PostgreSQL authority store，无新增该后端义务。

我的整体评价 / Verdict

APPROVE：当前完整 diff 在所声明边界内达到 goal_achieved；long_horizon 为 preserved，原决定、租约、完成、恢复和历史读取路径保持；减少无消费者维护表面，不把减少行数当作实测长程收益。 user_experience 为 preserved，现有 CLI/Chat 调用、拒绝和恢复保留；维护者可从准确 checkpoint 找到当前 owner。 检查现有 Todo read/update、worker bridge 与 primary-action 内部调用；没有渲染展示变化，visual_review not_applicable。 生产已经采用现有 typed owner，退役死包装符合迁移 RFC 的“最后一个真实消费者退出后删除”约束。保留另一份不再执行的实现只增加下一次修改的搜索和误读成本。 当前 PR 删除不可达 helper 与无用 import，保留全部可达 Todo transaction、completion gate、worker trace writer 与 primary-action resolution。 已做同域收口；仍有活跃调用的 decoder/trace/writer 不应为减少代码继续删除。 不把本次 review 当作合并授权。

English verdict: APPROVE — fc8121294505c542427eefb7543c7c4e54e2526f; unreachable legacy boundaries are retired while the existing production owner and semantic checks are retained. 96 Python tests; 91 TypeScript tests; same real lifecycle CLI smoke at base/head pass.