[hhyykk]

Goal And Delivered Outcome

Quota source and planning reads projected both canonical and project-asset Todo summaries before choosing one. An invalid display index in an unused handoff row could therefore block a valid canonical source. Select the available preferred summary first, then use the existing typed projection owners. Authoritative empty summaries remain empty; a selected-source failure still propagates.

• Basis: the requested architecture/payoff study against the TypeScript migration RFC.
• Intended base: main; refreshed to 3e35f83d6f009ad490320d2b525ebecea1605ea4 after feat(planning): keep Goal context current with independent Agent adoption #6987 merged.
• Overlap: all 49 open PR file inventories checked, including new fix(codex): recover long-turn activity with bounded reads #6994. No other PR modifies either changed Python file. refactor(todos): compose full readback in one TypeScript transaction #6874 owns canonical Todo readback composition; this change removes discarded downstream source projections. perf(quota): reuse one executable revision per public read #6992/perf(cli): dispatch global reads through their lightweight owner #6993 remain separate and their gains are excluded from the marginal comparison.

Author Declaration

• Written by: model_agent, OpenAI Codex (GPT-6 family).

Implemented against

• Specification: TypeScript control-plane migration RFC, especially sections 2.3, 5 and 6.

Criterion	Disposition	Evidence
One typed domain owner	implemented	Existing succession/context owners unchanged; Python only selects the compatibility input.
Replacement/payoff economics	implemented	Duplicate planning adapter and discarded projections removed; receipt below.
Caller-observable parity and failure behavior	implemented	Real-runtime source precedence matrix, authoritative empty sources, selected failure, terminal causality and malformed discarded handoff regression.
Complete entrypoint and installed qualification	implemented	Source, wheel and sdist File/SQLite reads; matched complete-command measurements with limits disclosed below.
Whole-task/model improvement and broader migration cutoff	out_of_scope	No model-backed outcome, ten-day continuity, provider promotion or complete Python retirement claim.

Scope And Continuation

Complete within this bounded source-selection family. select_quota_todo_source_items and select_planning_inventory_source_items keep their signatures. Quota preparation, task-orchestration fallback, replan writeback and receipt-source recovery keep their existing callers. No CLI flag, output field, provider selection, canonical write, cache or new RPC.

The larger quota-plan migration was rejected because live policy helpers would remain and its complete-command payoff was unproven. Broader Todo preparation fusion overlaps active #6874. Neither is a prerequisite for this independently reversible fix.

Migration economics	Receipt
Canonical owner before/after	Existing TS succession/context owners; existing Python compatibility precedence.
Domain rules deleted	0; this is caller/adapter retirement, not a new semantic migration.
Adapter/product code	+14 / -30 product LOC, net -16; _planning_inventory_source_items removed. Tests +80; paired RFC prose separate.
Bridge code added	0.
Crossings removed	Discarded source projections only. Happy-path and unchanged selected-failure behavior checked with real runtime IO.
Scaffolding	No production benchmark or migration scaffold added. Tests preserve durable source-selection behavior.
Facade exit	Compatibility selection remains until quota/planning callers consume the typed owners in-process.

Validation

• Tested normal source and artifacts: d71d95aa99b796404907d09329e3505735339a75.
• State: finished. Inputs: synthetic and public test fixtures. Linux; Python 3.13 tests, Python 3.11 installed/measurement callers; qualified Node 24.

Check kind	Result	Evidence / limits
static	passed	Ruff, control-plane typecheck, diff check and paired RFC gate. Clean-code, test and docs guard passes completed.
integration	passed	All 28 source-precedence tests pass with the managed TS runtime, terminal-inclusive planning, and selected transport failure injected at the runtime IO boundary.
regression_parity	passed	Exact same test source on current base and candidate: discarded source IPC and malformed unused handoff regressions fail before the fix and pass after.
integration	failed	Wider 14-file selection: 362 passed, 3 failed. All three failures also reproduce on unchanged current main; listed below. This is not an all-green suite.
real_entrypoint / real_backend	passed	Five global read commands x File/SQLite plus five malformed-registry refusals: 15 cases per arm for source, wheel and sdist. Selected outputs match baseline after declared observation metadata normalization; registry and state bytes remain unchanged.
manual	passed	Wheel/sdist carry the exact changed source; no bytecode, dependency-tree or symlink leakage.
real_entrypoint / performance	finished	Complete CLI observations below; no universal latency or model-quality claim.

Pre-existing failures, reproduced on current main:

• test_public_quota_distinguishes_monitor_repair_from_generation_wait[todo_done-True]
• test_public_quota_distinguishes_monitor_repair_from_generation_wait[monitor_changed-True]
• test_public_quota_capacity_wait_uses_provider_after_cutover_without_display_write[True]

These promoted resume-planning cases return status-health failure on both trees. They remain in the suite; this PR does not repair unrelated acceptance behavior.

Matched complete-command observations

Complete SQLite CLI	Native requests	Median ms	p95 ms
global-summary-1	65 → 59	497.7 → 508.2	545.6 → 548.0
global-summary-8	485 → 437	1003.5 → 979.7	1087.4 → 1058.5
quota-should-run	85 → 79	1254.0 → 1251.9	1306.9 → 1305.3
global-summary-32	1925 → 1733	2668.1 → 2589.4	2786.0 → 2805.7

Latency is mixed: the single-Goal median is higher, and the 32-Goal p95 is 19.7 ms (+0.7%) higher. The delivered gains are the reproduced failure repair, less discarded computation and net product deletion. The table does not establish a general speedup.

The marginal baseline composes current main with the public #6992 and #6993 changes; the candidate adds only this PR's production patch. Thus prior request-scope and CLI-import savings are not counted again. Both arms use complete prepared bytecode, warm native runtimes, the same immutable Todo/registry inputs and 15 fresh Python processes per arm in alternating order. Actual Python/TS source origins, code-resolution scans and native methods are captured. The measured production file is byte-identical to the normal PR head.

Observation clocks and the quota CLI's newly generated rollout-observation id/time are normalized; Todo identities, persisted times, gates, coverage, actions and source facts are retained. Portfolio snapshot hashes are independently recomputed before removing clock-derived snapshot/revision metadata. Missing global-source warnings remain visible.

Earlier pinned-base observations and a scale attempt without its intended public scan directory are retained as earlier/invalid qualification evidence, not substituted for this current-main matrix. Normal registry/state data is synthetic; no live Goal was promoted or changed. Wall-clock samples do not establish model-backed effectiveness or a general speedup.

Reproduction entrypoints:

uv sync --extra test
uv run --extra test pytest -q tests/control_plane/test_quota_summary_source_precedence.py
uv run --extra test pytest -q tests/control_plane/test_quota_should_run_parity.py tests/control_plane/test_quota_plan_policy.py tests/test_goal_portfolio.py tests/test_summary_all.py tests/test_global_todos.py tests/test_global_risks.py
npm run typecheck:control-plane
python3 scripts/check_rfc_bilingual.py --base origin/main --head HEAD

The full related selection also includes Todo summary, resume planning, task-orchestration admission, Goal frontier and handoff-context tests. Raw local receipts remain private. No Windows/macOS, live Chat HTTP/MCP journey, provider delivery/send or model-backed end-to-end run was performed. No merge-readiness or activation claim.

Frontend / Visual Evidence

UI impact: none. This changes internal source selection; no screen or workflow is added. Before/after screenshots, preview, viewport and craft review: N/A. Source data: synthetic/public fixtures.

Type Of Change / Area

Bug fix; bounded refactoring; tests and bilingual RFC update. Area: control plane. Direction: replacement-first caller/adapter payoff.

Shared-authority RFC fixture impact

• Shared fixture: tests/fixtures/control_plane/coordination_production_scale_v0.json, schema loopx_coordination_production_scale_fixture_v0, unchanged. No coordination field, canonical operation, capacity/retention assumption or persisted compatibility projection changes.
• The affected source-selection cases use real File and SQLite through normal installed callers.
• PostgreSQL conformance and the read-only legacy/File/PostgreSQL rehearsal were not run: no AuthorityStore/provider, runtime routing, promotion or persisted compatibility-projection change is introduced. This does not qualify those promotion gates.

Boundary Checklist

• Public-safe source, prose and aggregate evidence; no private state, raw traces, credentials, local machine paths or private links.
• Open PR overlap checked; no maintainer-owned benchmark work duplicated.
• Scope kept to the selected source-projection defect/payoff.
• Both RFC languages updated and bilingual diff gate passed.
• UI impact marked none.
• Every commit has a DCO sign-off.