hhyykk · Oct 21, 2026
@@ -1772,6 +1772,15 @@ input/output independence unchanged.
 This is a bounded shared-codec cost repair, not a provider-format migration or
 qualification of sustained operation, CI capacity or release admission.
 
+Canonical Todo collection reads also share one `GoalAcceptanceRead` within the
+loaded provider head. Contract, oracle basis and work guards reuse the validated
+authority, Todo index and task decisions. Guard projection stays lazy so source
+identity and continuation checks retain their original precedence. Public
+standalone helpers start fresh, and returned containers remain independent.
+Every new provider head or continuation read creates a new scope. This adds no
+Python bridge, RPC, persisted cache or write authority; native-read measurements
+do not qualify full CLI latency, installed adoption or PostgreSQL operation.
+
 `as unknown as T` is permitted only as a named migration seam: its exact call
 site, upstream validator, negative boundary coverage, and removal owner must be
 visible in the cutover PR. A migrated domain cannot pass its promotion gate

@@ -1254,6 +1254,13 @@ TypeScript 类型在运行时会被擦除。因此 network/RPC payload、解析
 检查与 schema validation、semantic invariant 分层负责。未经检查的
 `JSON.parse(...) as T` 不能建立控制面 authority。
 
+Canonical Todo 集合读取在同一个已加载 provider head 内共享 `GoalAcceptanceRead`。
+合同、oracle basis 和工作 guard 复用已验证的 authority、Todo 索引和任务判断。
+guard 保持惰性投影，保留来源 identity 与连续页检查的原拒绝顺序。公开独立 helper
+每次重新读取，返回的容器相互隔离。每个新 provider head 或连续页读取都建立新
+scope。不新增 Python bridge、RPC、持久化缓存或写权限；原生读取测量不证明
+完整 CLI 延迟、安装采用或 PostgreSQL 运行资格。
+
 `as unknown as T` 只允许作为具名迁移缝：cutover PR 必须明确其调用点、上游
 validator、负向边界覆盖和移除 owner。只要 public、持久化、RPC 或 extension
 输入仍通过未经验证的断言进入已迁 domain 的 semantic core，该 domain 就不能

@@ -4,7 +4,6 @@ import {configuredGoalChecks} from "../goals/acceptance_contract.ts";
 import type {JsonObject} from "../effect_program.ts";
 import {requireJsonObject} from "../runtime_decode.ts";
 import {MAX_LOCAL_SNAPSHOT_BYTES} from "../effect_runtime_snapshot.ts";
-import {projectGoalAcceptanceWorkGuards} from "../goals/acceptance_contract.ts";
 import {decodeProjectionReadback, confirmProjectionReadback} from "../todos/projection_delivery.ts";
 import {authorityStoreSourceAuthority, type AuthorityStore} from "./authority_store.ts";
 import {canonicalAuthoritySha256, hasExactAuthorityKeys, requireAuthorityStoreId} from "./authority_store_codec.ts";
@@ -95,7 +94,7 @@ export async function readCanonicalSnapshotFromStore(value: unknown, store: Auth
     after.snapshot.provider_revision === head.provider_revision && after.snapshot.cursor === head.cursor &&
     after.snapshot.query_sha256 === query,
   "canonical_snapshot_changed", "canonical snapshot changed; restart the complete read, never append a newer page");
-  const {projection, todoReadModel: readModel, leaseIndex: leases, acceptance, oracleObservationBasis} =
+  const {projection, todoReadModel: readModel, leaseIndex: leases, acceptance, oracleObservationBasis, projectWorkGuards} =
     canonicalTodoCollection(head.head, goal, input.include_leases);
   const snapshot: Snapshot = {goal_id: goal, store_identity: identity.store_identity,
     provider_revision: head.provider_revision, cursor: head.cursor, query_sha256: query,
@@ -128,7 +127,7 @@ export async function readCanonicalSnapshotFromStore(value: unknown, store: Auth
   let completeGuards: JsonObject | null = null;
   if (after === null && completeBytes > 0) {
     completeGuards = configuredGoalChecks(acceptance)
-      ? projectGoalAcceptanceWorkGuards(head.head, goal, projection.todo_ids) : {};
+      ? projectWorkGuards(projection.todo_ids) : {};
     const complete = result(projection.todo_ids, leases?.lease_todo_ids ?? [], completeGuards);
     if (bytes(complete) <= Math.min(completeBytes, CANONICAL_SNAPSHOT_LOCAL_BYTES)) return complete;
   }
@@ -137,7 +136,7 @@ export async function readCanonicalSnapshotFromStore(value: unknown, store: Auth
   const todoIds = projection.todo_ids.slice(todoStart, todoStart + CANONICAL_SNAPSHOT_PAGE_ITEMS);
   const leaseIds = leases?.lease_todo_ids.slice(leaseStart, leaseStart + CANONICAL_SNAPSHOT_PAGE_ITEMS - todoIds.length) ?? [];
   const guards = completeGuards ?? (configuredGoalChecks(acceptance)
-    ? projectGoalAcceptanceWorkGuards(head.head, goal, todoIds) : {});
+    ? projectWorkGuards(todoIds) : {});
   const page = (size: number) => result(todoIds.slice(0, size),
     leaseIds.slice(0, Math.max(0, size - todoIds.length)), guards);
   const available = todoIds.length + leaseIds.length;

@@ -2,8 +2,7 @@ import {configuredGoalChecks} from "../goals/acceptance_contract.ts";
 /** Canonical Todo reads and projection confirmation share one provider snapshot. */
 import type {JsonObject} from "../effect_program.ts";
 import {requireJsonObject} from "../runtime_decode.ts";
-import {acceptanceWorkGuard, projectGoalAcceptance,
-  projectGoalAcceptanceWorkGuards, goalAcceptanceOracleObservationBasis} from "../goals/acceptance_contract.ts";
+import {acceptanceWorkGuard, GoalAcceptanceRead} from "../goals/acceptance_contract.ts";
 import {authorityStoreSourceAuthority as sourceAuthorityFor} from "./authority_store.ts";
 import {canonicalAuthoritySha256, hasExactAuthorityKeys, parseAuthorityCursor,
   requireAuthorityStoreId} from "./authority_store_codec.ts";
@@ -21,14 +20,16 @@ import {completionTurnOperationId,
  * this same owner. */
 export function canonicalTodoCollection(head: JsonObject, goalId: string, includeLeases: boolean) {
   const read = new CoordinationProjectionRead(head, goalId);
-  const acceptance = projectGoalAcceptance(head, goalId);
+  const acceptanceRead = new GoalAcceptanceRead(head, goalId, read);
+  const acceptance = acceptanceRead.contract();
   return {
     projection: read.todoIndex,
-    todoReadModel: read.validateTodoReadModel(),
+    todoReadModel: acceptanceRead.validateTodoReadModel(),
     leaseIndex: includeLeases ? read.coordinationIndex : null,
     acceptance,
     oracleObservationBasis: acceptance.outcome_requirements
-      ? goalAcceptanceOracleObservationBasis(head, goalId) : null,
+      ? acceptanceRead.oracleBasis() : null,
+    projectWorkGuards: (todoIds: readonly string[]) => acceptanceRead.workGuards(todoIds),
   };
 }
 
@@ -149,7 +150,7 @@ export async function readLocalCoordinationTodoSource(
     if (after.status !== "available" || after.store_identity !== identity.store_identity) {
       return failure("todo_source_lineage_mismatch");
     }
-    const {projection, todoReadModel, acceptance} = canonicalTodoCollection(
+    const {projection, todoReadModel, acceptance, projectWorkGuards} = canonicalTodoCollection(
       transaction.projection, goalId, false,
     );
     let completion: JsonObject | null = null;
@@ -187,8 +188,7 @@ export async function readLocalCoordinationTodoSource(
       todo_ids: projection.todo_ids, todo_read_model: todoReadModel,
       ...(!configuredGoalChecks(acceptance) && !acceptance.outcome_requirements ? {} : {
         goal_acceptance_contract: acceptance,
-        goal_acceptance_work_guards: projectGoalAcceptanceWorkGuards(
-          transaction.projection, goalId, projection.todo_ids),
+        goal_acceptance_work_guards: projectWorkGuards(projection.todo_ids),
       }),
       source_authority: sourceAuthority, decision_read_from_provider: true,
       legacy_fallback_used: false,
@@ -314,7 +314,7 @@ export async function listLocalCoordinationTodos(
         legacy_fallback_used: false,
       };
     }
-    const {projection, todoReadModel, leaseIndex, acceptance, oracleObservationBasis} = canonicalTodoCollection(
+    const {projection, todoReadModel, leaseIndex, acceptance, oracleObservationBasis, projectWorkGuards} = canonicalTodoCollection(
       head.head, goalId, input.include_leases === true,
     );
     return {
@@ -325,7 +325,7 @@ export async function listLocalCoordinationTodos(
       todo_ids: projection.todo_ids,
       todo_read_model: todoReadModel,
       ...(!configuredGoalChecks(acceptance) && !acceptance.outcome_requirements ? {} : {goal_acceptance_contract: acceptance,
-        goal_acceptance_work_guards: projectGoalAcceptanceWorkGuards(head.head, goalId, projection.todo_ids)}),
+        goal_acceptance_work_guards: projectWorkGuards(projection.todo_ids)}),
       ...(oracleObservationBasis === null ? {} : {goal_acceptance_oracle_observation_basis: oracleObservationBasis}),
       ...(leaseIndex === null ? {} : {
         leases: leaseIndex.lease_todo_ids.map((id) => leaseIndex.leases.get(id)!),