[Task]: Semantic vocabulary convergence follow-ups after RFC PR #4433 / 语义词表收敛后续任务 #4447

Task ID or area

area: semantics / control-plane vocabulary

Technical direction

Core control-plane hardening; Architecture and research incubator

Intent

Tracking issue for bounded semantic-convergence slices and their RFC decisions.

Current delivery status — 2026-10-12

The issue remains OPEN. Current source readback is pinned to canonical main
323c3053128e41e16df27e6b6498f83c37e81f5e; older censuses and work proposals below
retain their dates and do not override the accepted staged scope.

The current source inventory is reviewable in English
and Chinese.
It distinguishes runtime creation, caller-supplied input, compatibility, unknown
source purpose and actual test scope. No registry enrollment or budget is raised.

The later #6251 typed-failure and #6268 canonical-selection fixes remain separate
open PRs at this readback; #6260 shared consistency is merged. These do not add
new closure prerequisites to #4447 or qualify installed/frontend/Lark/live-model
behavior. Follow-up source PRs continue to use Refs #4447, not Closes #4447.

A previously qualified local candidate combination of main 609005984669f3d7b2f196f2a98b3ab8dddbd15f plus #6251 (c773edef8), #6268 (5d79ce8e7), #6270 (0b0c0fd6c) and #6285 (277dab815) also includes the separate #6290 (f30dbf7e8) work-basis repair and documentation-only #6289 (0273617e7). After main changed retry identity, monitor wakeup and execution obligations, the combined source/selection/executor/retry-context suite passed 272 Python tests, and 23 native settlement/retry scenarios passed (20 File/SQLite retry-monitor cases plus the three original settlement CLI cases). Another 101 Goal-amendment tests and 147 combined TS tests passed; the amendment evidence does not expand #4447 closure. TypeScript typecheck and full-tree semantic drift pass with the original 26-entry/F1-F2 six-producer scope unchanged. These are bounded candidate-combination results, not release, live-model, whole-tree or final integrated-main qualification; the two unresolved source meanings remain open.

The newer #6313 source-treatment candidate was checked on 323c3053128e41e16df27e6b6498f83c37e81f5e: 144 Python and 35 TypeScript tests passed through actual decoder/IPC and Todo CLI/lifecycle paths, with kind-isolation mutation rejection and 19 passing premerge checks. The same immutable-base/candidate real-path probe produced equal observations and runtime source hashes. Only maintenance/authoring metadata and witnesses change; all 26 entries, values, owners, producer enrollment, formal domains and budgets are unchanged. This evidence does not replace the earlier combined-runtime validation or qualify the final integrated main. The two dispositions remain proposed until owner acceptance/integration.

The merged program — what this tracker shipped

The thirteen PRs this section used to list as open are all merged. They are
kept as one record because they were reviewed as one program, and because the
merge order below was measured rather than guessed.

Track A — repay measured debt. #4606
single-sourced six status constants, #4608
imported the Todo task-class vocabulary from its owner, and
#4617 single-sourced five
multi-value vocabularies. Together with #4513
and #4517 these removed
7 forked names and 17 duplicate definitions: same_runtime_forks 25 names /
58 definitions to 18 / 41, multi_value_twins 19 to 13.

Track B — make the measurement faithful. #4614
reported the name-keyed divergence a rename hides and measured the limit it does
not close; #4630 filtered the 18
registered owner pairs out of the merge candidates; #4629
locked two ratchets to measured values; #4631
bounded each formal invariant to the domain it verifies; #4628
halved ast.parse calls per run.

Corrections found by reviewing the merged tree. #4680
fixed two measurements that contradicted themselves — reordering a set was
counted as a new fork while the adjacent divergence report correctly said the
value set had not changed, and a registered-but-unimplemented projection still
reported F5:2/2. #4682 and
#4687 closed three producer-scan
answers that were confidently wrong, each a missing value delivered inside a
complete-looking set.

Merge order, for the record. Trial-merging all 78 pairs found nine conflicts in
four clusters, every one textual adjacency rather than semantic disagreement: the
ratchet anchors (#4606/#4608/#4617/#4629), the drift test file's append cluster
(#4626/#4629/#4631), the RFC Appendix B rows (#4614/#4627/#4631), and the inventory
generator (#4614/#4630). The append-cluster conflicts recurred often enough that
#4691 removed the cause: each
ledger entry is now its own file under docs/architecture/rfcs/ledger/<rfc-slug>/.

Governed scope — kernel boundary, not a count-growth goal

This tracker governs the registered 26-entry set. The current F1/F2 domain is six
entries (five kernel plus settlement_binding_kind); twenty cross-runtime entries
remain outside that producer check. task_lease_lifecycle_operation replaced the
retired private lease_action, without a fake empty producer. Source treatment
and decoder evidence do not inflate the formal producer domain.

The earlier 092a28c4e census (664 carriers, 26 registered, six producer entries)
was historical, not a current coverage ratio. Whole-tree coverage, zero twins,
all unknown sites resolved and generic F6 proof are not added closing targets.
Development-time coinage remains the separately delivered #4743/#5317 advisory.

Staged delivery coordination — current accepted scope

The #4789 scope revision is merged. It replaces mandatory deletion with verified
maintenance reduction and explicit source treatment; it relaxes no runtime
budget or compatibility gate. PR counts, labels and test counts alone are not
completion evidence.

1. Stage 1: review the integrated guard and live/replay/selection/inbox paths,
   preserving workspace repair, independent capability work, exact binding and
   reentry. The existing slices are merged; their future integration evidence
   must name a revision rather than rely on old branch checks.
2. Stage 2: keep the existing 2a/2b/2c order. 2a has four settlement/receipt
   entries; 2b has seven workspace/Todo entries; 2c includes the eight remaining
   original owners plus the replacement native lease-operation entry. Together
   with six already-verified entries this is the same current set of 26, not a
   scope expansion. Every row names owner/slot, source, exact witness,
   compatibility and remaining limits. Mixed sources keep all obligations.
3. Stage 3: accept one final integrated revision with reviewed source
   disposition and explicit passed/failed/untested boundaries. Retained historical
   reading/signature duties stay; no automatic field or vocabulary deletion.

• Scope revision docs(semantics): stage tracker acceptance around verified outcomes #4789 and factual corrections docs(semantics): reconcile RFC milestones with shipped contracts #4777 are merged.
• Current source inventory and missing witnesses in test(semantics): qualify registered source evidence and reconcile checkpoints #6270 are reviewed and integrated.
• Effect/settlement owner accepts or adjusts docs(semantics): define reserved cancellation and custom decision scopes #6313's explicit reserved-input/compatibility decision and exit condition for cancelled; no internal cancellation producer is claimed.
• Todo decision-scope owner accepts or adjusts docs(semantics): define reserved cancellation and custom decision scopes #6313's explicit custom-authority authoring rule for other. Unknown input continues to reject rather than become other, and named kinds remain isolated.
• Integrated real CLI/TS and applicable isolated-backend checks pass, including resolution or explicit accepted disposition of the known current-host ACK fixture gap.
• Final record names revision, commands/results, retained compatibility and accepted exceptions before closure.

No exceptions above have been accepted by this status update. Evidence on the
current source batch: Python groups 66/564/82/706 and native TS group 421 pass;
these group counts are not unique production-path counts or completion ratios.
Generators, drift, typecheck, docs governance and risk-based premerge pass. F1/F2
is still 6/26, F3 is 0/26 and general F6 remains unproved. The passing groups do
not include the three known ACK fixture failures. See #6270 for the exact scope.

中文当前读回： Stage 1 与范围修订已合入，packet 已停写新输出，兼容 reader 仍在。
#6270 提交 26 项来源清单和补充见证，但 cancelled/other 的含义尚未获 owner 处置，
三个 ACK fixture 的修复现由 #6285 提议；此前主线 609005984 与候选 PR 的组合已通过
272 项核心检查和 23 个原生结算/重试场景，但仍须正式主线集成验收。其他 Goal 变更
测试不扩大本 issue 的关闭范围。当前 323c30531 上，#6313 已将 cancelled 的保留输入处置与 other 的编写准则做成可评审提案，真实路径与权限隔离见证通过；仍需 owner 接受及最终主线集成。issue 保持开放；
不能把 decoder 接纳、测试计数、PR 合并或来源标签当作全部完成。

Source of truth. The merged English RFC and Chinese mirror own the design contract. #4453 merged into that pair, so the proof-stage model and the four enforcement lanes are already part of the contract on main. This issue owns delivery status, dependencies and follow-up links. Refinements below that differ from the RFC remain proposals until incorporated into both language versions; they are not maintainer approvals.

Execution strength and proof boundary

The registry's enforcement-policy lane labels remain metadata, not activation
switches. Read the implementation/domain beside them: F1/F2 checks already run
for six declared producer entries, and F4 checks four declared contexts. The
labels do not mean those bounded checks are still unimplemented.

Roles. Owner defines the vocabulary; Producer introduces a value at a particular output/slot; Consumer reads or accepts it. Interpreter and Pass-through are Consumer subroles, not an exhaustive or mutually exclusive partition of whole modules. A transformer can consume one vocabulary and produce another. Persistence is an additional property: even a pass-through may need serializer, reader and version checks. Merely referring to an enum member is not evidence of production at a protocol boundary.

Mathematical limits to preserve in implementation:

• Distinguish admitted values S_v from actual/runtime and observed values. Define production over an ambient value domain, then check Produced(v) ⊆ S_v; defining production as already restricted to S_v would make this obligation tautological.
• A fixed syntax scan is evidence about recognized forms. No recognized producer means unresolved, not automatically dead. A dead-value or compatibility-only decision also needs dynamic, external-input and historical-reader evidence.
• A partial consumer handles a subset of S_v; this is not an exemption permitting unregistered outputs. External inputs must be validated/translated or have an explicitly open contract.
• Count equality with editable anchors is a current-snapshot constraint, not proof of historical monotonicity. Scope alone does not make name-based counts invariant under renaming.
• Tagged slots can share strings: (slot, value) identifies the case. Distinct field paths may already provide that context; pairwise-disjoint raw strings are not required.
• Identifier occurrence counts improve substring metrics but do not prove zero semantic readers. Candidate value-set equality does not prove same_concept behavior.
• Inventory generation can become stale across merges; the original 8/20 sample is historical evidence, not a universal probability of failure. Recompute and validate the integrated tree.

Historical census — retained, not current acceptance targets

The original issue labeled the following census with baseline 1dc6ad8d8. Keep it as historical context; refresh counts and source SHA with the current generator before selecting repairs. Parser changes and reclassification are not debt repayment.

Historical pre-revision scope and dependencies — superseded by staged acceptance above

Two tracks can proceed locally in isolated worktrees. Runtime, authority and compatibility changes still follow normal repository review rules; a cleanup label does not waive them.

M0 merged + #4453 design/schema follow-up
  |-- Track A: classify -> bounded repairs + parity evidence
  `-- Track B: B0 model precision -> B1 scope -> B2 kernel producer pilot
                             `---- B3 reader metrics (can run in parallel)
        Q9 ---------------------- B4 merge-order policy
B1/B2 + Q3/Q6 -> M1 typed slots
M1 + Q2/Q7/Q10 -> M2 published decision contract
B3 + per-field compatibility evidence -> M3 retirement
TypeScript migration cutovers -> M4 twin reduction

M3 need not wait for unrelated M2 work if its own readers/migration evidence is sufficient. Track A need not reach zero before M1. Local prototypes and fixtures can proceed while a decision is pending; policy activation and incompatible product changes wait for the specific decision.

Track B — bounded measurement improvements

• B0 — align formulas, roles and enforcement claims. Reconcile RFC I2/I11–I14 with the limits above; distinguish schema validation, implementation stage, evidence status and actual blocking behavior. Add focused malformed/duplicate/missing-entry regressions for the formal signature and hierarchy. Exit: bilingual contract is internally consistent; metadata cannot be presented as an executed proof. 已交付 —— #4661：签名/层级的畸形与重复负例回归，并把 schema 校验、实施阶段、证据状态、实际阻塞行为四种声明在 RFC 中分开陈述。
• B1 — scope and stable attribution. Specify global/bounded_context, context IDs, owner symbols and relevant slots; use SOURCE_SURFACES and its four CLI owners as the first case. Preserve raw counts; report classified semantic conflicts separately. If claiming rename invariance, add stable semantic identity or an explicit rename mapping. Exit: legal context reuse is distinguished, undeclared new collisions remain visible, and an identifier rename alone receives no debt-repayment credit. Implement the data shape before adding rows to the closed registry schema. Status 2026-09-17: the scope half is delivered - scope_declarations with SOURCE_SURFACES and its four CLI owners merged in #4494; raw multi_value_forks stays 4 while multi_value_forks_semantic is 3. Rename invariance is not closed: #4614 measured every case instead of assuming one. Only a declared name fails closed, because the declaration names every defining module. An undeclared one-sided rename, and renaming every side at once, both lower the budget with nothing reporting it; that residue is recorded in RFC Appendix B rather than left implied. The new divergent_value_sets advisory is a fork-visibility companion, not a rename detector.
• B2 — producer pilot for four Turn kernel vocabularies. Start with turn_result_kind, turn_route, loop_disposition, effective_action. Bind a recognized write/return to its vocabulary and slot using bounded AST analysis; report dynamic/alias/external paths as unresolved. Definite unregistered writes fail; missing producer evidence is investigated before removing values or granting a reasoned compatibility exception. Recheck skip, replay values and both quota_action_selection_* codes. Exit: positive/negative fixtures cover both runtimes and slot attribution; unknown paths are visible; ordinary consumer edits need no new registry entries. Pilot before enabling additional blockers. Status 2026-09-17: partially delivered - action-domain separation and production evidence (#4494), one bound re-export hop in the Python producer scanner (#4573), and a recorded reason per unresolved site (#4581). The recheck is finished: skip, observe_replay, block_replay and both quota_action_selection_* codes are verified absent from all 26 registered vocabularies. Remaining: the 19 real effective_action candidate sites - 34 total minus the 15 unprovable by design (10 same-name keyword arguments, 5 pure type annotations). 已交付 —— #4573 / #4581 / #4682：有界 producer 绑定与 blocker 分类；当前 40 个未解析站点各带具体理由，其中 15 个在设计上无法成为证据。该残留已于 2026-09-18 由 #4687 修复，连同另外两处同类漏报：** 展开重放了被下标改写前的陈旧初始值，以及 TypeScript 扫描器没有作用域模型、把被遮蔽的 String/undefined 当作内建。三处都是漏报——一个看起来完整的值集里少了一个值，而 F1 证明的是 Produced_scan(v) ⊆ S(v)，漏报会让未注册值通过门禁，多报只会误警。反例套件在 main 上先跑出 16/20，四条失败中的三条是真漏报。
• B3 — retirement metric. Replace substring matching with an explicit syntactic-use metric, including string-key access (obj["field"], get("field")), attributes and unresolved computed keys. Distinguish reads/writes/mentions. Compare old/new counts and reconcile all six anchors in one reviewed diff without claiming remeasurement as cleanup. Delivered 2026-09-18 — #4651, merge 02cc53bd5. Five orthogonal roles (reader/writer/binding/unresolved/mention) per module, asserted to partition the token count per field and per runtime, so the smaller number is provably a reclassification of one population rather than a smaller sample. Both budgets are pinned in the same diff; retiring the token budget is Q11's call. dynamic_mapping_key_sites=1739 and typescript_dynamic_member_sites=410 are printed, so "zero lexical count alone cannot authorize deletion" is a number rather than a caveat in prose.
  One correction to this item's own exit condition. It named goal_boundary_repair not being a reader of goal_boundary as the test. Measured, the old token metric already passed that: _token_pattern matches standalone tokens, so a module containing only goal_boundary_repair scored zero under both metrics. The defect the old metric really had is the one B3 fixes — it cannot tell a bare mention from a read at all. That is where the gap lives: goal_boundary has 30 token-matching modules but a surface of 16, because 14 of them are prompt prose and module-path imports. The exit condition was aimed at a problem the metric did not have.
• B4 — inventory freshness / Q9. Prepare an isolated two-branch integration fixture and document a reproducible regenerate/check sequence. Closed by the decision itself, not by the fixture. The exit condition was "chosen policy is recorded in RFC §10"; Q9 selected on-demand inventory and §10 now records it: the committed census is removed, checks evaluate G(f(T), R) over the full tracked tree on every run, and the extra condition I_committed = f(T) is gone. The two-branch fixture was scoped against the committed-snapshot policy — it tested a staleness that can no longer occur — so it is withdrawn rather than carried. The obligation that survives is already in §10 prose and unchanged: validate the combined tree normally; never replace the full-tree scan with a diff-only scan.
• B5 — optional consumer report. Extend the existing report only after concrete producer/slot identities are available; distinguish read/interpret/pass-through/unknown with location, source SHA, domain and limitations. Exit: evidence report works on representative paths with no blanket consumer-registration or global merge gate. This is not an M1 blocker. 已交付 —— #4663：仅覆盖声明了 literal_scan.field 的词表（当前 1/26），其余 25 个报告为 missing_slot_identity 而非猜测；建议性输出，不设门禁。覆盖率只能由后续迁移声明槽位身份来提升，改代码无法提升。

Track A — classify and repair existing debt

Each item requires current-source confirmation. Resolve scope mistakes through B1; prioritize verified duplicate authority or incompatible meanings over reducing totals.

• AGENT_TODO_HEADER_MARKERS, USER_TODO_HEADER_MARKERS — unified in #4643, merged 2026-09-17. Both parsed the same active-state document into the same role vocabulary, so they were one contract with two implementations, and the copies disagreed on 15 of 23 realistic headings: archives counted as live, the writer-created Codex Todo heading was invisible to the counter, and bare owner matched prose Ownership sections. The fix deletes both copies and delegates to the writer's classifier (todo_role_for_heading), un-silencing state_projection_gap_warning. - [ ] RAW_MATERIAL_KEY_HINTS remains open, measured by #4614 as genuinely different value sets (body/chat/credential/dm vs credential/local_path/log/raw), so it stays classification work, not a direct single-sourcing.
• Resolve DECISION_CONTEXT_CAPABILITY_ID hyphen/underscore and MCP_REQUIREMENT pin/range differences after checking actual callers and packaging boundaries. Done: #4513 merged - the two spellings were classified as two slots rather than one conflict (the hyphen is the extension/directory namespace, the underscore is the packet contract, and no consumer joins them), the kunluncode MCP pin was single-sourced, and a regression test pins the classification.
• Classify the 19 historical multi-value twins and 18 semantic string forks; retain justified independent contracts. Example to inspect: SOURCE_REGISTRY_SHADOW_FINDINGS in the status/projection modules. Status 2026-09-17: open. The named example was single-sourced in #4517 - it now has one definition in loopx/control_plane/status/registry_health_projection.py that loopx/status.py imports. Ratchets after the four 2026-09-17 merges (refactor(status): single-source six duplicated status vocabulary constants #4606, refactor(todos): import the Todo task-class vocabulary from its owner #4608, feat(semantics): report the name-keyed value-set divergence a rename hides #4614, refactor(semantics): single-source five duplicated multi-value vocabularies #4617): same_runtime_forks_semantic 11, conflicting_values_semantic 0, multi_value_twins 13, multi_value_forks_semantic 1; fix(state): count Todo headings the way the region writer classifies them #4643 merged and took multi_value_forks_semantic to 1 by retiring the two Todo marker forks; measured 2026-09-18 on 092a28c4e it is still 1.
• Per-value meaning for registered vocabularies. 2026-09-18 实测 149/149（2026-09-17 尚为 13/149）：kernel 68 个值由 #4625 / #4626 补齐，cross_runtime 81 个值由 #4662 补齐；其中 2 条无法从代码确立产生条件的，如实标为 unresolved 并写明缺什么证据。覆盖不等于验证：这是文档覆盖，与 F1/F2 的生产验证（6/26）是两件事。
• Classify the 32 historical same-value candidates as same_semantics, same_values_different_semantics, same_semantics_different_scope, or unrelated_collision. Record review evidence; agree a supported representation before adding classification fields to the registry. Only confirmed same_semantics groups become merge work. CONFIDENCE_LEVELS and EDGE_CASE_COMPLEXITIES illustrate why equal sets are insufficient. Status 2026-09-17: open; remeasured at 38 groups, not the historical 32.

M1 — typed effective_action (Q3 + Q6; after the relevant B1/B2 evidence)

• Choose a canonical definition and update producers/consumers to use it.
• Separate decision, frontier and replay contracts by typed field path or discriminated union, preserving needed compatibility. Exit: consumers can unambiguously determine the slot; raw string sets need not be disjoint.
• Resolve skip, move observe_replay / block_replay out of decision semantics, and keep quota_action_selection_* errors out of the verdict slot where source/reader evidence supports that change. Exit: status/should-run parity and migration checks pass; no arbitrary “28 values” gate. Done: #4494 separated the action domains against production evidence; all five values are verified absent from the registry, and the drift smoke is green on main. The typed owner and the slot split (the other two boxes here) still wait on Q3 and Q6.

M2 — published Turn decision contract (Q2 + Q7 + Q10)

• Publish route→disposition and the owning decide_loop_disposition rules through a shared contract and generated bindings. Define relevant input partitions, priority and rejection paths first. Additional hops must include required context; do not invent a context-free result→route function if behavior is not one. Done: #4499 merged turn_contract_generated.py / .ts carrying TURN_CONTROLLER_CONTRACT with route_projection over all 8 routes and the 29 decide_loop_disposition rules; #4580 pinned the rule id order and proved it load-bearing, so a reordering cannot silently change first-match semantics.
• Make settlement.ts and transaction.py consume the shared result-kind definition. Exit: generation freshness, boundary cases and behavior/parity evidence pass; copying a table through a generator alone is not proof of the full function. Done: #4571 - transaction.py imports LoopXTurnResultKind from turn_contract_generated, and settlement.ts imports TURN_RESULT_KINDS / TurnResultKind from turn_contract_generated.ts. Neither file keeps its own copy of the set.
• Decide whether to reuse the existing maintainability exception lifecycle; avoid another speculative framework.

M3 — retire legacy fields one at a time

Gate: B3 evidence plus writer, reader, external-consumer and persisted-format compatibility review. B3 landed 2026-09-18, so the counts below are measured surfaces, not module mentions. Each row keeps its historical count and its token count beside the surface, because the three answer different questions and the gap between them is the point. Remeasure on the current tree before ordering work; these were taken on 092a28c4e.

• protocol_action_packet (historical 7 Python / 2 TypeScript; token count 5 / 2; measured 2026-09-18 on 092a28c4e by B3: surface 5 py / 2 ts — reader 1, writer 4, binding 0, unresolved 0, mention 0. The cheapest first removal and the only field with no unknown use.)
• external_evidence_observation (historical 11 / 1; token count 8 / 1; measured 2026-09-18 on 092a28c4e by B3: surface 7 py / 1 ts — reader 4, writer 1, binding 1, unresolved 1, mention 1.)
• heartbeat_recommendation (historical 18 / 1; token count 17 / 1; measured 2026-09-18 on 092a28c4e by B3: surface 13 py / 1 ts — reader 8, writer 4, binding 1, unresolved 0, mention 4.)
• execution_obligation (historical 21 / 1; token count 20 / 1; measured 2026-09-18 on 092a28c4e by B3: surface 15 py / 1 ts — reader 8, writer 7, binding 0, unresolved 0, mention 5.)
• work_lane_contract (historical 32 / 3; token count 29 / 3; measured 2026-09-18 on 092a28c4e by B3: surface 29 py / 3 ts — reader 11, writer 8, binding 9, unresolved 1, mention 0. The most expensive field; its token count and surface coincide because it carries almost no bare mentions.)
• goal_boundary (historical 35 / 2; token count 30 / 2; measured 2026-09-18 on 092a28c4e by B3: surface 16 py / 1 ts — reader 8, writer 4, binding 3, unresolved 1, mention 14. The token count nearly doubles the real surface: 14 of its 30 modules are prompt prose and module-path imports.)

Exit per field: producer/reader migration evidence, focused negative/parity tests, rollback path and required schema-reduction decision. Keep retirement evidence after removal rather than requiring an empty ledger.

M4 — runtime migration

• Reduce Python/TypeScript twins with the existing TypeScript migration RFC. A same-basename pair is a candidate, not proof of duplicate authority. Each cutover needs real-path parity and its own migration evidence.

Historical decision proposals — not new assigned commitments

Record approved outcomes in RFC Appendix B; link the implementing PR here. “Before” identifies the dependent milestone, not a new calendar deadline. Owner roles below do not assign GitHub users.

Historical target state — current closure uses staged acceptance above

The original RFC's numerical targets are retained as historical direction, not universal gates. Propose synchronizing these refined acceptance criteria into the RFC before milestone closure.

The Measured column is dated and non-normative: it records what the tree
measured on 2026-09-17 so work can be ordered against current numbers rather
than the historical baseline, as the sentence below already requires. A later
measurement replaces it; it does not amend the acceptance target. The RFC's
Section 11 target table carries the same column.

Keep this issue open until selected milestones have linked merged PRs and evidence, and unresolved/deferred items have explicit dispositions and linked follow-ups. Scope changes require a recorded decision; merging #4453 alone is insufficient.

Intended base branch

main in huangruiteng/loopx; use the latest actual upstream base for each new PR, not a stale fork ref.

Relevant files and commands

• RFC English/Chinese pair: Sections 2, 5, 9–12 and Appendix B.
• loopx/semantics/vocabulary_v0.json, inventory_v0.json, inventory.py.
• examples/semantic-vocabulary-drift-smoke.py, tests/architecture/test_semantic_inventory.py, tests/architecture/test_semantic_vocabulary_drift.py.
• python3.11 scripts/generate_semantic_inventory.py --report: symbol-mention ranking only. Merge candidates are available via merge_candidate_groups; a dedicated CLI report is follow-up work.

Validation and contribution contract

Use the project's supported Python (>=3.11), with python3 on PATH resolving to that environment for canary commands. Explicitly stage any new public source paths before regenerating because the scanner uses Git-index paths and working-tree content. Private notes/raw evidence stay excluded.

python3.11 examples/semantic-vocabulary-drift-smoke.py
python3.11 scripts/generate_semantic_inventory.py --check
python3.11 examples/docs-governance-smoke.py
python3.11 -m pytest -q tests/architecture
loopx canary premerge --from-git-diff --git-diff-base upstream/main

• Track A: show the specific authority/conflict repaired and caller parity; update a budget only when its measured debt actually changes.
• Track B: show a meaningful counterexample, corrected classification, unknown handling and protected negative tests. No requirement to lower a count or remove an inventory row.
• M1–M4: validate affected production entrypoints and compatibility, not just generated-set equality. Persisted data changes need reader/migration evidence.
• Report exact base/head, commands, failures/skips, boundaries and rollback. Historical mutation totals are not a whole-program guarantee. Synchronize normative English/Chinese changes.
• Follow AGENTS.md for decisions; do not turn routine budget reductions into an extra approval gate. Every PR-range commit, including inherited/cherry-picked commits, needs Signed-off-by. Use git commit -s; repair each affected commit with git commit --amend --no-edit -s, then check the entire PR range. Published-history rewrites need explicit authorization and a guarded lease.

Outside this tracker: the separate maintainability RFC_MODULE_BUDGETS anchor question should be triaged under its own RFC; this issue does not alter it. M0/M0.5 do not change runtime/wire behavior. M1–M4 may make scoped changes after their decisions and compatibility work; no bulk unification, global consumer-registration mandate or claimed whole-program proof.

Public/private boundary

• This issue contains no private benchmark traces, verifier output, credentials, internal links, raw agent sessions or local runtime state.
• Maintainer-owned benchmark cases are not run or duplicated without a separately scoped public task.

中文说明

当前完成度与关联

以 c464cf308 主线及 #6270 的来源证据候选为当前读回。范围修订 #4789、事实修正
#4772/#4777、Stage 1 的四条生产路径和 #4764 均已合入；#4794 已停写新 packet，
保留历史格式/签名和其余五个字段。#4743 的开发期 advisory 由 #5317 交付。

登记仍为26项，正式 producer 检查范围仍为6/26。#6270 补齐真实无绑定回执、权限拒绝
及输入见证，并逐项记录来源/兼容边界。cancelled 的用途与 other 的作者选择准则仍未解决，
不是已批准例外。当前主线3个 ACK fixture 的缺失宿主观察已复现；#6285 候选通过真实 reader
读取隔离合成 manifest，补齐缺失/错误观察拒绝、原 ACK 与字节级重放，全套相关 Python112项
通过。该修复尚未合入。主线加 #6251/#6268/#6270/#6285 的本地组合另通过266项针对性 Python、
原3条结算 CLI、35项 TS、类型检查和全树 drift；这不是正式主线或发布资格，完整验收仍开放。后文带日期的测量和旧里程碑记录不覆盖上方当前范围；不得把全部字段退休、
全程序证明或后续优化追加为关闭前提。

门禁强度与角色

registry 的 enforcement-policy 分组仍是元数据，不是启用开关。实际 m0_5 已对
6/26 个登记 producer 执行 F1/F2 检查，对4/4个声明 context 执行 F4；不能因分组仍叫
blocking_next 就说这些有界检查从未实现。F5 的可执行投影为1/1，既有 owner/parity/
source/budget 守卫继续生效。F3 的通用消费者证明仍为0/26；已有 consumer-evidence
报告只提供有界语法/槽位/角色线索及明确未知，不是全程序数据流。通用 F6 仍为0/0、
未建模；具体历史 reader 的测试不等于通用 F6。

Owner 定义词表，Producer 在具体输出/槽位引入值，Consumer 读取或接受值。Interpreter 与 Pass-through 是消费者子角色，不是互斥、穷尽的模块分类。 转换器可以既消费又生产；持久化另需版本、写入、读取与迁移证据。枚举成员出现在源码里，不等于它被写入协议。

保留以下数理边界：

• 区分注册集、运行时值集与扫描观测集；先在完整值域上定义生产，再检查是否属于注册集，避免把结论预先写进定义。
• 未扫描到生产者是“来源未解析”，不能直接判死值；需核查动态来源、外部输入及兼容读者。具体历史 reader 的删除仍需独立迁移证据。
• 部分消费者接受注册集的子集，不意味着允许随意产生未注册值。
• 作用域字段不能单独保证改名不变性；锚点相等不能证明跨提交历史单调性。
• 带标签的 (slot, value) 可以重复使用字符串；不要求各槽位原始字符串两两不交。
• 标识符计数不等于真实读者计数；同值集合不等于同一概念。8/20 只是历史样本，不能当成固定的未来故障概率。

历史两轨任务分解（以上方当前验收为准）

轨道 A：分类、确认、修复已有债务。 保留原清单：三个 marker/hint 多值分叉、DECISION_CONTEXT_CAPABILITY_ID 与 MCP_REQUIREMENT 差异、19 个多值孪生、18 个语义分叉、32 组同值候选。先核对当前调用者与作用域，再修真正的重复权威或冲突；合法独立契约可以保留。四类候选标签见英文任务表；不能自动合并或仅改名消数字。2026-09-17 实测进展：DECISION_CONTEXT_CAPABILITY_ID 与 MCP_REQUIREMENT 已结案（#4513，判为两个槽位而非一个冲突）；SOURCE_REGISTRY_SHADOW_FINDINGS 已单源化（#4517）；marker/hint 分叉中 AGENT_TODO_HEADER_MARKERS 与 USER_TODO_HEADER_MARKERS 已由 #4643 单源化（已合并）——两者解析同一份 active-state 文档、分到同一套角色取值，属一份契约两处实现；RAW_MATERIAL_KEY_HINTS 仍待分类（#4614 实测值集确实不同）。同值候选组重测为 38 组（原记 32；#4630 已合并，指出其中 18 组是已注册词表的 py/ts owner 符号对，属扫描器伪影而非债务）。

轨道 B：先让度量可靠。 英文 B0–B5 是主任务清单：

本地 fixture 和设计可以在决策待定时推进；阻断启用、协议不兼容修改和平台配置等待对应决策。轨道 A 不必先归零才能做 M1；B3 可以与生产者试点并行。

范围修订前的里程碑记录（非当前关闭条件）

• M1（B1/B2 相关证据 + Q3/Q6）：明确 owner，按类型化字段路径或标签区分 decision/frontier/replay；处理 skip、replay 值和 quota 错误码，验证真实调用与旧格式兼容，不强求恰好 28 值。
• M2（Q2/Q7/Q10）：发布 route→disposition 和承重决策规则；先定义输入分区、优先级和拒绝路径，再生成 Python/TypeScript 绑定。额外投影需要上下文时必须保留；不虚构无上下文的 result→route 函数。生成器自身不能证明行为。
• M3（B3 + 每字段兼容证据）：逐个处理 protocol_action_packet、external_evidence_observation、heartbeat_recommendation、execution_obligation、work_lane_contract、goal_boundary。核实写方、读方、外部消费者、持久化与迁移，再删除；保留退休证据，不要求账本清空。无需等待无关 M2 工作。
• M4：跟随既有 TypeScript 迁移 RFC，按真实路径 parity 与迁移证据减少孪生；同文件名不是重复权威的证明。

历史关闭条件（2026-09-18；已由上方分阶段验收取代）

本 issue 目前 26 个复选框、11 个 Q 决策，没有"做完"的定义，只有"全部勾上"——而
边际收益已经明显递减。提出一个可验收的关闭条件，供维护者确认：

满足以下三条即可关闭：

1. 每个跨运行时边界的词表都有 producers 声明。 2026-09-18 实测 F1/F2 覆盖
   6/26，20 个 cross_runtime 词表没有任何生产验证——它们完全靠人不犯错。这是
   当前最大的防护缺口，而且扩大它不需要写新代码，机器已经造好，缺的是注册表
   里的声明。
2. 同运行时分叉降到个位数。 实测 18 个（41 处定义）。棘轮历史显示这类修复
   每个约 20 行（refactor(semantics): single-source five duplicated multi-value vocabularies #4617 是 13 增 16 删、refactor(todos): import the Todo task-class vocabulary from its owner #4608 是 20 增 12 删），位置与修法都已知。
3. 六个旧字段退休完成。 消掉约 85 个模块的迁移面，是唯一让代码库真正变简单
   的工作；其余都是让它更可测。

以下明确标为"已测量、已接受"，不再作为关闭前提：

• F3 消费者定义域（0/26，advisory）——B5 已交付并证明：在注册表为更多词表
  声明槽位身份之前，覆盖率无法靠改代码提升。
• F6 持久化读者兼容（0/0，unproved）——证据缺口如实保留，不宣称通过。
• 合并候选全部分类（20 组真实待分类）——分类本身不消除重复权威，应由真实
  迁移需求拉动，而不是先分类完再等着。

理由：截至 2026-09-18，最后一次真实降债是 #4608（09-17，分叉 20→18）。此后合并的
每一个 #4447 PR 都是度量修正——它们修的都是真问题（F5 拿声明当证据、扫描器
给自信的错答案、等价写法能伪造退休进度），但四个健全性反例现在全部安全、
149/149 个值有产生条件说明，度量阶段已经结束。继续打磨尺子没有空间了，应该
开始用它。

决策与完成标准

11 个 Q 保留独立决策表：Q9 对应 B4；Q11 对应 B3 度量；M3 依当前条件迁移，不再以首次删除为强制门槛；Q3/Q6 对应 M1；Q2/Q7/Q10 对应 M2；Q1/Q4/Q5/Q8 分别涉及位置、术语表、评审规则和扩展覆盖。责任角色不等于指派某个贡献者，建议的里程碑期限不等于维护者承诺。

已合并的计划 —— 本追踪交付了什么

此前列为「13 个在开 PR」的那一批已全部合并。它们作为一个计划被评审，因此保留为一条记录；
下面的合并顺序是实测的，不是估计的。

轨道 A —— 偿还已计量的债务。 #4606 单源化六个 status 常量，
#4608 让 Todo task-class 词表从 owner 导入，
#4617 单源化五个多值词表。连同 #4513
与 #4517，这批真实删除了 7 个分叉名字、17 处重复定义：
same_runtime_forks 25 名 / 58 定义 → 18 / 41，multi_value_twins 19 → 13。

轨道 B —— 让测量忠实。 #4614 报告改名会隐藏的按名分歧，
并实测了它未闭合的边界；#4630 把 18 组已注册 owner 对从合并候选中滤出；
#4629 把两个棘轮锁到实测值；
#4631 把每条形式不变量限定到它真正验证的域；
#4628 把每次运行的 ast.parse 调用减半。

评审合并后的树才发现的更正。 #4680 修了两处自相矛盾的度量——
仅重排 set 被算成新分叉，而旁边的分歧报告正确地说值集没变；以及注册但未实现的投影仍报 F5:2/2。
#4682 与 #4687
修掉三处 producer 扫描的漏报——一个看起来完整的值集里少了一个值。方向很重要：F1 证明的是
Produced_scan(v) ⊆ S(v)，漏报会让未注册值通过门禁，多报只会误警。

合并顺序，存档。 试合全部 78 对，发现 9 处冲突、4 个簇，全部是文本相邻而非语义分歧：棘轮锚点
（#4606/#4608/#4617/#4629）、drift 测试文件的追加簇（#4626/#4629/#4631）、RFC Appendix B 行
（#4614/#4627/#4631）、inventory 生成器（#4614/#4630）。追加簇的冲突复发频繁到
#4691 直接消除了成因：每条账本条目现在是
docs/architecture/rfcs/ledger/<rfc-slug>/ 下的独立文件。

治理范围 —— 当前登记集

本追踪治理当前26项，正式 F1/F2 为6/26，不按此计算完成率。退休的私有 lease_action
已替换为实际 native task_lease_lifecycle_operation；其余20项不因来源文档或输入见证
自动获得 producer 证明。旧 092a28c4e 的664载体/3.9%数字只属历史截面。

开发期造词提示仍归独立 #4743，并已由 #5317 实现；它是显式调用的 advisory，
不是自动 watcher，不以空报告证明没有语义变化。当前任务保持范围，不要求扩大登记
数量、消灭所有 twins/unknown 或通用 F6 证明。

进度实测（2026-09-18）

树的规模：跟踪源码 1215 个文件（1066 py / 149 ts、约 17 MiB），多值载体 611 个
（107 枚举 + 496 闭集 + 8 个 Literal 别名）与 2130 个具名字符串常量。漂移守卫
单次耗时约 39 秒（3 次中位数）。

该残留已修复。 #4687 关掉了 global
重绑定这一处，连同另外两处同类漏报：** 展开重放被下标改写前的陈旧初始值，以及
TypeScript 扫描器没有作用域模型、把被遮蔽的 String/undefined 当作内建。
遮蔽判定按文件粒度——比按作用域粗，且是刻意的：文件粒度只可能扣下一个内建读法，
不可能凭空造出一个。

实测 列带日期且非规范：它记录当天树上的实测值，使工作可以按当前数字而非
历史基线排序。后续测量替换它，它不改动验收目标。RFC 第 11 节的目标态表带有同一列。

基线数字是原 issue 的历史记录，启动具体任务前按明确 SHA 重算。目标是没有未经评审且已确认的语义冲突/重复，各槽位清楚，历史兼容有证据；不把所有同名、孪生和合法独立词表都强制归零。待办未做完时保持 issue 开放；保留或延后必须有理由和跟进链接。

验证与贡献方式

复用上方命令，固定受支持的 Python，并记录准确 base/head。新源码路径须显式暂存后再生成清单；命令 --report 仅提供符号提及排行，候选组目前由 merge_candidate_groups 函数提供。

• 轨道 A 证明修了哪个重复权威/冲突，并验证调用者行为。
• 轨道 B 证明原先的反例被正确处理、未知可见，无需强制降低预算或删除清单行。
• 协议和持久化改动另跑生产入口与读者/迁移验证；不能以源码符号零出现代替兼容性证明。
• 规范变更同步 RFC 中英双版；routine 预算收紧按 AGENTS.md，不增加额外审批。
• PR 范围内全部 commit（包括继承和 cherry-pick）均须 DCO：git commit -s；缺签时逐个 git commit --amend --no-edit -s，再检查完整范围。已发布历史重写需显式授权与 lease 保护。

本 issue 不另行修改 RFC_MODULE_BUDGETS 的可维护性规则，不包含私有日志、会话、凭据、本地运行状态或未经授权的 benchmark 任务。