[hhyykk]

A canonical Todo collection rebuilds the same acceptance authority and Todo indexes while producing its contract, oracle context and work guards. This proposal reuses that validated basis within one loaded provider head. Each later head/page and every standalone public helper still starts fresh.

The existing acceptance owner now supplies GoalAcceptanceRead; canonicalTodoCollection shares it and projects guards at the original call site. Input checks, first-error precedence, exact/retiring ownership, held work, output container independence and wire fields remain intact. No persistent cache, RPC, Python bridge, setting or write authority is added.

Based on the accepted migration RFC §§2.5, 2.8 and 6. Head 501c88099a68f9f75d018360c394c657556c3ebd, base 4e6baa51afdc2ad522012c1f691ae166c9d67e7b. All 47 other open PRs and their paginated file lists were checked: none changes these three production or two test files. Shared RFC bookkeeping is a separate paragraph. Larger interaction/quota rewrites overlap existing work; Hook batching adds compatibility bridge cost; several large adapters have no live caller or already use one native transaction.

Migration economics:

Item	Result
Semantic owner	Existing goals/acceptance_contract.ts, before and after
Repeated work retired	Same-head authority decoding, Todo indexing/model validation and repeated task verdicts; original validators remain
Python rules/bridge added or removed	0 / 0; this improves the existing native path
Product diff	+146 / -76, net +70 lines; moved code counts both ways
Cross-runtime calls	Unchanged: one ordinary complete snapshot/list request; existing continuation behavior remains
Facades/scaffolding	Existing standalone exports retained for real callers; no new migration transport or production comparison path

Observed native cost, milliseconds p50 / p95:

Same 1000-Todo workload	Base	Head
SQLite, owner-confirmed checks	180.3 / 205.6	90.4 / 127.0
File, owner-confirmed checks	154.1 / 192.1	63.0 / 81.0
SQLite, no checks	42.7 / 66.8	43.6 / 64.0

Each row uses 32 alternating A/B–B/A pairs, real provider IO, the complete public native listLocalCoordinationTodos result and JSON serialization, with identical result bytes. This is not a Python CLI or managed-IPC benchmark. An unchanged-code A/A control measured 188.4 / 250.8 versus 182.0 / 212.2: tail variance is retained, so these observations do not certify a full-CLI performance gate or a universal percentage gain. The earlier exploratory samples remain separate evidence.

Validation:

• 168 native tests passed. 23 PostgreSQL cases skipped because no service URL is available; File/SQLite cases run against real stores.
• 37 Python acceptance/CLI tests passed using real native handlers over a private stdio transport. Normal managed IPC remains unavailable.
• 29 fixed fixture heads give 116 byte-identical baseline/head observations, including error messages, missing work, selected scope, cleared/retiring/foreign-owner state, verification and oracle context. A deliberately wrong acceptance guard is detected through the unchanged real SQLite full-result oracle.
• Fresh wheel and sdist installs preserve the changed TS bytes. Each passes the 116-observation corpus and real File/SQLite native read parity from installed files. This does not claim installed managed-CLI qualification.
• Current frontend assets build and verify; paired English/Chinese RFC check, diff hygiene, maintainability ratchet and clean-code/test/docs guard review pass. Independent source review found no P1/P2 issue.

Remaining qualification: full control-plane typecheck still reports the seven unchanged conversation_binding.ts nullability errors reproduced on main (separate #6980). Quick premerge passes its four direct checks, then fails the risk-characterization smoke before dispatch at the local IPC permission boundary. Full CLI cold/warm cost, managed-runtime/daemon memory, installed managed callers, PostgreSQL and live App adoption remain unqualified. Existing budgets and failed evidence are unchanged. This is an author proposal for exact-head review, with no merge or release claim.