C1: converge complete Turn decisions and inspection callers

docs/architecture/rfcs/STATUS.md

@@ -31,7 +31,7 @@ appendix may keep dated history, but no dated log heading may precede it.
 | [RFC: Capable Agent Manager and Semantic Work Handoff (v0)](capable-manager-semantic-handoff-v0.md) | Accepted | [Personal Follow-through independent proposal](personal-follow-through-v0.md) | [2 entries](ledger/capable-manager-semantic-handoff-v0/) |
 | [RFC: Complete State Recovery and Controlled Reactivation (v0)](complete-state-recovery-v0.md) | Accepted | none | — |
 | [RFC: Composable State Machines and Recovery Verification (v0)](composable-state-machines-recovery-verification-v0.md) | Accepted | none | — |
-| [RFC: Controller / Executor Sessions and One Governed Work Contract (v0)](controller-executor-unified-contract-v0.md) | Accepted | none | [5 entries](ledger/controller-executor-unified-contract-v0/) |
+| [RFC: Controller / Executor Sessions and One Governed Work Contract (v0)](controller-executor-unified-contract-v0.md) | Accepted | none | [12 entries](ledger/controller-executor-unified-contract-v0/) |
 | [Explicit Todo continuation: Stage A](cross-session-memory-substrate-v0.md) | Accepted | none | — |
 | [RFC: LoopX Desktop Execution Frontends v0](desktop-execution-frontends-v0.md) | Accepted | none | — |
 | [RFC: External Evidence Research Capability v0](external-evidence-research-capability-v0.md) | Accepted | none | [3 entries](ledger/external-evidence-research-capability-v0/) |

docs/architecture/rfcs/STATUS.zh-CN.md

@@ -28,7 +28,7 @@
 | [RFC：强能力 Agent 管家与语义工作交接（v0）](capable-manager-semantic-handoff-v0.zh-CN.md) | 已接受 | [个人事项持续跟进独立提案](personal-follow-through-v0.zh-CN.md) | [2 条](ledger/capable-manager-semantic-handoff-v0/) |
 | [RFC：完整状态恢复与受控重新激活（v0）](complete-state-recovery-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：可组合状态机与恢复验证（v0）](composable-state-machines-recovery-verification-v0.zh-CN.md) | 已接受 | 无 | — |
-| [RFC：Controller / Executor 会话与统一受治理工作契约（v0）](controller-executor-unified-contract-v0.zh-CN.md) | 已接受 | 无 | [5 条](ledger/controller-executor-unified-contract-v0/) |
+| [RFC：Controller / Executor 会话与统一受治理工作契约（v0）](controller-executor-unified-contract-v0.zh-CN.md) | 已接受 | 无 | [12 条](ledger/controller-executor-unified-contract-v0/) |
 | [显式 Todo 接续：阶段 A](cross-session-memory-substrate-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：LoopX 桌面执行前端 v0](desktop-execution-frontends-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：外部证据研究能力 v0](external-evidence-research-capability-v0.zh-CN.md) | 已接受 | 无 | [3 条](ledger/external-evidence-research-capability-v0/) |

docs/architecture/rfcs/controller-executor-unified-contract-v0.md

@@ -753,6 +753,21 @@ reject an unsupported inner version before Codex prompt execution or DSH runner
 loading, without spend. The complete-contract/context/DSH/stdio selection passes
 352 cases; TypeScript checking and focused lint pass. This qualifies these
 interaction semantics, not every required field or packaged-host adoption.
+Heartbeat templates now own the ordered settlement instruction; exact-Turn
+binding adds only its canonical source locator, instead of repeating the
+execution and no-static-reconstruction clauses. Thin prompts combine complete
+capture and required-context reads before action, while sharing the unchanged
+progress/outcome clauses. On the unchanged full-route fixture (320-character
+scope, explicit CLI and five capabilities), the unbound prompt falls from 4,981
+to 4,895 budget characters under the original 4,900 ceiling. The exact-Turn
+variant falls from 5,198 to 4,987 and still fails that ceiling. The padded-route
+negative remains rejected; no route, capability, fixture population or limit
+was shortened. The prompt/platform selection passes 115 checks with one skip.
+These are presentation and clause-retention results, not model adoption or cost
+benefit. Four other original CLI-budget failures remain open. Integration with
+opaque reader references also exposed two obsolete digest-field assertions;
+their File/SQLite consumers now read the pinned machine descriptor, preserve
+the original receipt and reject byte-changed captures without admission or spend.
 Remaining cache consistency investigation, other old reader expectations, staged instruction parity and
 actual optional/external consumers, version admission and packaged host
 continuity remain unfinished. Operation-SDK checks without an explicit native
@@ -796,6 +811,22 @@ are reconciled. Rollback likewise separates outstanding work from new admission.
 A version transition does not rewrite saved prompts, journals or source hashes
 as if they had always used the new contract.
 
+Code convergence is part of each migration slice, not only the final C9 cleanup.
+Both entrypoints must call the same semantic implementation for composition,
+reference validation, context reconstruction and settlement. Keep genuinely
+host-specific launch/observation mechanics in thin adapters; do not force their
+different lifecycles into a new general-purpose runner. The existing typed owners
+remain responsible for their respective decisions.
+
+For each slice, record the before/after callsites, shared owner, removed duplicate
+algorithm and remaining compatibility caller with its removal condition. Qualify
+both routes with the same independently authored semantic cases and their real
+transport/recovery tests. A wrapper that only delegates can be transitional;
+copying a rule into a newly named common module while leaving two implementations
+is not convergence. The next change to a shared rule should be made and tested in
+one owner and reach both routes. Do not make declining line counts an acceptance
+metric or remove unique host coverage to meet one.
+
 The first C1 PR must include the two production composition callsites above and
 at least one complete producer-to-final-input journey, with an explicit list of
 remaining readers. Qualifying that bounded slice does not enable the new writer
@@ -1188,3 +1219,11 @@ The directory is the index. A planning/source-inspection entry does not establis
 runtime delivery; live priorities and claims remain in the roadmap and canonical
 work. Keep historical entries append-only and refine the current normative plan
 here rather than treating a dated audit as a permanent execution queue.
+
+The [source-convergence checkpoint](ledger/controller-executor-unified-contract-v0/2026-10-30-c1-source-convergence.md)
+keeps the candidate's detailed chronology outside this normative plan. Integration
+preserves main's presentation/journal owners and shares numeric source identity
+and edit transport across acceptance, summaries, authoring and Vision. This does
+not qualify writer/consumer cutover, installed adoption or the original-quota
+accepted-outcome/full-cost comparison. Remaining reader retirement and negative
+cost observations keep C1 open.

docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md

@@ -563,6 +563,16 @@ reader 覆盖仍保留。八项聚焦用例通过，使用注入的记录 runner
 File/SQLite 原生输入检查确认不支持的内层版本在 Codex prompt 执行或 DSH runner
 加载前拒绝，且不扣额。完整契约/context/DSH/stdio 集合 352 项通过，TypeScript
 检查及聚焦 lint 通过。这只证明上述交互语义，不代表所有必需字段或打包宿主已验收。
+Heartbeat 模板现统一提供按顺序结算的执行要求；精确 Turn 绑定只补充 canonical
+来源定位，不再重复执行和禁止静态重建的条款。Thin 将完整 capture 与所需上下文的
+行动前读取合并，复用未变的进展／outcome 条款。原完整路由 fixture（320 字符
+scope、显式 CLI、五项能力）中，未绑定提示从 4,981 降至 4,895 个预算字符，通过
+原 4,900 上限；精确 Turn 变体从 5,198 降至 4,987，仍超过该上限。超长路由反例
+仍拒绝；没有缩短路由、能力、fixture 规模或修改上限。提示／平台集合 115 项通过、
+1 项跳过。这只证明展示和条款保留，不代表模型采用或费用收益。其余原 CLI 预算
+仍有四项失败。与 opaque reader reference 整合还暴露两项过时的 digest 字段断言；
+File/SQLite 消费者现读取已钉住的 machine descriptor，保留原 receipt，并确认
+capture 字节改变后拒绝读取，不产生新 admission 或 spend。
 剩余 cache 一致性调查、其他旧 reader 断言、分阶段指令等价和实际 optional/external
 消费者、版本准入及打包宿主连续性仍未完成。缺少显式原生 runtime 的 operation SDK
 检查属于未测，不能算资格。默认 writer 变更尚未交付；PR 因作者实现未完而保持
@@ -595,6 +605,16 @@ Draft，不是仅等待评审。尚无模型或成本收益证据。历史 effec
 受支持恢复窗口核清前保留历史 decoder。回退同样区分未结工作与新准入。版本迁移不能
 把保存的 prompt、journal 或源 hash 改写成仿佛一直使用新契约。
 
+代码收敛属于每个迁移切片，不只留给最终 C9 清理。两个入口须共用 composition、引用
+校验、上下文重建与结算的语义实现。真实的宿主 launch/observation 差异留在薄 adapter；
+不为强行统一不同生命周期而另造通用 runner。各项决策仍由既有 typed owner 负责。
+
+每个切片记录迁移前后调用点、共享 owner、已删除的重复算法，以及剩余兼容 caller 和
+退出条件。两条路径共用独立编写的语义用例，并分别验证真实传输与恢复。仅委托调用的
+wrapper 可以过渡保留；给公共模块起新名字却继续保留两套规则实现，不算收敛。下一次
+修改共同规则，应只改、只测一个 owner 并传递到两条路径。代码行数下降不是验收指标，
+也不能为此删除宿主独有的验证覆盖。
+
 C1 首个 PR 必须覆盖上述两个生产组合调用点，并交付至少一条从生产端到最终输入的
 完整旅程，同时明确剩余 reader。这个有界切片通过资格，不代表可向未验收 host 开启
 新 writer，也不关闭 C1。最终切换须在全部受支持 reader 验收后删除活跃格式选择。
@@ -898,3 +918,9 @@ C1/C2 组合/capture/最终输入工作与这些精简同属一个候选前沿
 目录即索引。规划/源码检查记录不证明 runtime 交付；当前优先级与认领仍在 roadmap 和
 canonical 工作中维护。历史记录保持 append-only，当前规范性计划在本文修订，不能把
 某日审计当作永久执行队列。
+
+[来源收敛检查点](ledger/controller-executor-unified-contract-v0/2026-10-30-c1-source-convergence.zh-CN.md)
+将候选的详细沿革保留在本规范计划之外。集成保留 main 的展示／journal owner，让验收、
+summary、authoring 与 Vision 共用数值来源身份和编辑运输。这不证明 writer／consumer
+切换、installed 采用或原 quota 的验收成果／完整成本对照。剩余 reader 退出与负成本
+观察继续使 C1 保持未完成。