diff --git a/docs/architecture/rfcs/STATUS.md b/docs/architecture/rfcs/STATUS.md
index 5cb719de11..1614dff04b 100644
--- a/docs/architecture/rfcs/STATUS.md
+++ b/docs/architecture/rfcs/STATUS.md
@@ -31,7 +31,7 @@ appendix may keep dated history, but no dated log heading may precede it.
 | [RFC: Capable Agent Manager and Semantic Work Handoff (v0)](capable-manager-semantic-handoff-v0.md) | Accepted | [Personal Follow-through independent proposal](personal-follow-through-v0.md) | [2 entries](ledger/capable-manager-semantic-handoff-v0/) |
 | [RFC: Complete State Recovery and Controlled Reactivation (v0)](complete-state-recovery-v0.md) | Accepted | none | — |
 | [RFC: Composable State Machines and Recovery Verification (v0)](composable-state-machines-recovery-verification-v0.md) | Accepted | none | — |
-| [RFC: Controller / Executor Sessions and One Governed Work Contract (v0)](controller-executor-unified-contract-v0.md) | Accepted | none | — |
+| [RFC: Controller / Executor Sessions and One Governed Work Contract (v0)](controller-executor-unified-contract-v0.md) | Accepted | none | [1 entry](ledger/controller-executor-unified-contract-v0/) |
 | [Explicit Todo continuation: Stage A](cross-session-memory-substrate-v0.md) | Accepted | none | — |
 | [RFC: LoopX Desktop Execution Frontends v0](desktop-execution-frontends-v0.md) | Accepted | none | — |
 | [RFC: External Evidence Research Capability v0](external-evidence-research-capability-v0.md) | Accepted | none | [3 entries](ledger/external-evidence-research-capability-v0/) |
diff --git a/docs/architecture/rfcs/STATUS.zh-CN.md b/docs/architecture/rfcs/STATUS.zh-CN.md
index 7e7433e6df..3c479b6daa 100644
--- a/docs/architecture/rfcs/STATUS.zh-CN.md
+++ b/docs/architecture/rfcs/STATUS.zh-CN.md
@@ -28,7 +28,7 @@
 | [RFC：强能力 Agent 管家与语义工作交接（v0）](capable-manager-semantic-handoff-v0.zh-CN.md) | 已接受 | [个人事项持续跟进独立提案](personal-follow-through-v0.zh-CN.md) | [2 条](ledger/capable-manager-semantic-handoff-v0/) |
 | [RFC：完整状态恢复与受控重新激活（v0）](complete-state-recovery-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：可组合状态机与恢复验证（v0）](composable-state-machines-recovery-verification-v0.zh-CN.md) | 已接受 | 无 | — |
-| [RFC：Controller / Executor 会话与统一受治理工作契约（v0）](controller-executor-unified-contract-v0.zh-CN.md) | 已接受 | 无 | — |
+| [RFC：Controller / Executor 会话与统一受治理工作契约（v0）](controller-executor-unified-contract-v0.zh-CN.md) | 已接受 | 无 | [1 条](ledger/controller-executor-unified-contract-v0/) |
 | [显式 Todo 接续：阶段 A](cross-session-memory-substrate-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：LoopX 桌面执行前端 v0](desktop-execution-frontends-v0.zh-CN.md) | 已接受 | 无 | — |
 | [RFC：外部证据研究能力 v0](external-evidence-research-capability-v0.zh-CN.md) | 已接受 | 无 | [3 条](ledger/external-evidence-research-capability-v0/) |
diff --git a/docs/architecture/rfcs/controller-executor-unified-contract-v0.md b/docs/architecture/rfcs/controller-executor-unified-contract-v0.md
index 4c9b6074ab..871e2e7230 100644
--- a/docs/architecture/rfcs/controller-executor-unified-contract-v0.md
+++ b/docs/architecture/rfcs/controller-executor-unified-contract-v0.md
@@ -752,6 +752,78 @@ owner; adopt its qualified changes and add only the integration coverage missing
 at the new composition boundary. Keep C1 open until the replacement works and
 the remaining supported readers have explicit cutover/retirement conditions.
 
+### Responsibility convergence and contributor handoff
+
+The [source-backed refactor handoff](ledger/controller-executor-unified-contract-v0/2026-10-27-refactor-handoff.md)
+decomposes C3/C4/C7/C8/C9 into concrete simplification candidates. It belongs to
+this plan, not another roadmap or evidence of shipped implementation. The pinned
+audit separates duplicated decisions, misplaced shared code, existing shared
+owners and hypotheses requiring semantic comparison.
+
+Keep three responsibilities clear:
+
+1. **Core semantic owners:** decide legal work/session/effect transitions and
+   validate original authority and receipts in the existing typed domains.
+2. **Shared managed execution:** drive those decisions through session binding,
+   native invocation, observations and recovery. Reuse existing Turn/effect
+   owners; this is not another permission engine or scheduler.
+3. **Host adapters:** implement native SDK/CLI transport, event translation,
+   supported resume and resource cleanup. Preserve real host differences rather
+   than hiding unsupported behavior behind a nominal common interface.
+
+Select work from the overall roadmap, current user outcome, demonstrated
+bottlenecks, open delivery and canonical work. Package IDs and table order are
+references, not global priority, an Agent's fixed agenda or reserved ownership.
+C1/C2 composition/capture/final-input work and these simplifications are options
+within that same frontier, not competing permanent Agent mandates. Owners name
+code boundaries, not assignments or execution grants; recheck target main,
+open PRs and canonical work before claiming one.
+
+| Existing task / package | Simplification result | Start condition |
+| --- | --- | --- |
+| **C3.1 Managed-operation protocol** | Codex and DSH adopt one operation-session flow; remove duplicated binding/profile checks and handoff/start orchestration, and DSH's dependency on a Codex-owned generic handler | When this duplication is the selected bottleneck: existing single-session behavior and two real callers; retain native differences |
+| **C3.2 Session-binding callers** | Reuse shared persistence; eliminate caller-side binding reconstruction and private cross-host imports where a cohesive existing operation can replace them | Pair with C3.1 if a separate change would leave only a rename/facade; role/generation expansion waits for stable C1 |
+| **C4.1 Receipt-to-continuation** | Adopt a qualified typed Turn observation/continuation boundary; retire replaced Python receipt reconstruction and decisions | Keep journal recovery distinct from next-work decisions; integrate C1 and existing recovery fixes |
+| **C4.2 Outer-worker adoption** | Consume qualified semantic results instead of reconstructing common retry/continuation policy | C4.1; preserve wake ownership, original receipts and opaque-command uncertainty |
+| **C4.3 Settlement-adapter convergence** | Reuse settlement primitives; retire a second step/condition interpreter only where obligations coincide | Candidate: compare Host Todo completion and Turn settlement; coordinate active settlement PRs |
+| **C7.1 Worker/process adapter cleanup** | Reuse applicable launch/drain/cleanup helpers and remove proven duplicated mechanics | Candidate: match ownership, signal/deadline and control-arm semantics first |
+| **C8.1 Operational readback** | App/Chat/CLI consume the same typed work/session facts; retire superseded caller classifications | Candidate: role facts available and duplicate classification demonstrated; retain unknown/coverage and audience boundaries |
+| **C9.1 Lease/source-path retirement** | Remove obsolete normal-writer routing/wrappers after caller migration; retain required release, fence-close and original-receipt recovery | Cross-RFC candidate: shared-authority/TS acceptance, not a controller-launch prerequisite |
+| **C9.2 Contract-test consolidation** | Shared invariant cases and thin native-adapter tests replace duplicated complete-flow fixtures | Companion to the owning replacement; preserve unique integration and negative cases |
+
+These are nine investigation/delivery packages, **not nine promised PRs**, a
+fixed remaining count or mandatory work before C1 lands. Do not select C3.1
+merely because it appears first, or prefer visible code deletion over a more
+valuable current correctness, contract-delivery or authority-retirement outcome.
+If selected, C3.2 may share C3.1's reversible PR. Only actual semantic dependencies
+constrain order. Existing-behavior repairs and proven local simplifications can
+land before C1; contract-dependent cutovers retain that dependency. Similar-looking
+files do not qualify a conditional candidate.
+
+Record why the chosen slice advances the current global outcome, which higher-
+value alternatives or in-flight deliveries were considered, and its actual
+dependency. Reassess after delivery or new evidence; this inventory neither
+exhausts useful work nor obliges an Agent to finish one lane before changing
+focus. Priority advice creates no new admission or approval gate.
+
+Each claimed package carries its source owners/callers, target boundary,
+specific deleted rules/branches, real-path oracle, dependencies and rollback
+in the existing Todo and PR. An audit assigns no peer work and creates no parallel
+task store. Complete caller replacement and deletion in the usable slice; keep a
+wrapper only for an identified external or recovery contract. Measure total
+production changes across languages, semantic owners, complete-transaction
+runtime crossings and the next representative rule's change sites. Python LOC
+reduction or a new shared class alone does not establish simplification; no
+arbitrary net-negative LOC quota replaces correctness or required validation.
+
+Reuse [TypeScript change-locality payoff](typescript-control-plane-migration-v0.md#28-change-locality-as-migration-payoff)
+and [smoke consolidation policy](../../development/good-smokes.md). Internal
+behavior-preserving replacements need real caller/backend evidence, not new
+settings screens. Changed caller-facing operations/readback retain C8's packaged
+frontend failure/recovery journey and first-screen evidence. C1/default-adoption
+complete-cost and benefit qualification remain unchanged; a bounded refactor is
+not full RFC acceptance.
+
 ## 12. Open decisions
 
 1. **Exact wire name and field mapping — contract owner, before C1 cutover.**
@@ -767,3 +839,12 @@ the remaining supported readers have explicit cutover/retirement conditions.
    Test same-model controller/executor first to isolate architecture effects;
    cheaper controller models and different budgets are separate experiments.
    Keep the profile opt-in until full outcome/cost evidence supports a decision.
+
+## Appendix A: Execution ledger
+
+Source audits and subsequent delivery evidence live in
+[`ledger/controller-executor-unified-contract-v0/`](ledger/controller-executor-unified-contract-v0/).
+The directory is the index. A planning/source-inspection entry does not establish
+runtime delivery; live priorities and claims remain in the roadmap and canonical
+work. Keep historical entries append-only and refine the current normative plan
+here rather than treating a dated audit as a permanent execution queue.
diff --git a/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md b/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md
index 1a201c51f5..ab60844ec9 100644
--- a/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md
+++ b/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md
@@ -570,6 +570,62 @@ C1 首个实现片必须把完整字段/条款迁移与真实单会话 producer
 Native-resume/context 工作保留原 owner；采用其已验收改动，只补新组合边界缺少的集成
 覆盖。替换真正可用且其余受支持 reader 有明确切换/退役条件之前，C1 保持未完成。
 
+### 职责收敛与贡献者交接
+
+[有源码依据的重构交接清单](ledger/controller-executor-unified-contract-v0/2026-10-27-refactor-handoff.zh-CN.md)
+把 C3/C4/C7/C8/C9 拆成具体精简候选。它属于本计划，不是另一份 roadmap，也不证明
+实现已交付。固定版本核对区分重复决策、归属不当的共享代码、已有共享 owner，以及
+需要语义比较才能成立的假设。
+
+保持三个清晰的职责：
+
+1. **Core 语义 owner：** 在既有 typed 领域内裁决合法工作、会话、effect 转移，验证
+   原权限与回执。
+2. **公共受管执行：** 按这些裁决驱动会话绑定、原生调用、观察与恢复。复用既有
+   Turn/effect owner；不是另一套权限引擎或调度器。
+3. **Host adapter：** 实现原生 SDK/CLI transport、事件转换、实际支持的 resume 和资源
+   清理。保留真实宿主差异，不能用名义统一接口隐藏不支持的行为。
+
+从整体 roadmap、当前用户成果、实际瓶颈、在途交付与 canonical 工作中选择任务。
+工作包编号和表格顺序只是引用，不是全局优先级、某个 Agent 的固定议程或预留归属。
+C1/C2 组合/capture/最终输入工作与这些精简同属一个候选前沿，不是永久分给不同 Agent
+的竞争议程。Owner 指代码边界，不代表任务分配或执行授权；认领前重新核对目标 main、
+开放 PR 与 canonical 工作。
+
+| 既有任务 / 工作包 | 精简结果 | 启动条件 |
+| --- | --- | --- |
+| **C3.1 受管操作协议** | Codex、DSH 采用同一操作会话流程；删除重复 binding/profile 校验、handoff/start 编排，以及 DSH 对 Codex 模块内通用 handler 的依赖 | 此重复被选为当前瓶颈时：现有单会话行为、两个真实调用方，保留原生差异 |
+| **C3.2 会话绑定调用方** | 复用共享持久化；以既有完整操作替换调用方重建 binding 和跨 Host 私有导入 | 若独立拆开只剩改名/facade，则与 C3.1 一起交付；role/generation 扩展等待 C1 稳定 |
+| **C4.1 回执到继续决策** | 采用已合格 typed Turn 观察/继续边界；退役被替代的 Python 回执重建与决策 | 保留 journal 恢复与下一工作决策的区别；整合 C1 及已有恢复修复 |
+| **C4.2 外层 worker 采用** | 消费已合格语义结果，移除自行重建的公共重试/继续策略 | C4.1；保留唤醒归属、原回执和不透明命令的不确定性 |
+| **C4.3 结算 adapter 收敛** | 复用 settlement 原语；仅在义务一致时删除第二套步骤/条件解释器 | 候选：比较 Host Todo completion 与 Turn settlement，并对齐在途结算 PR |
+| **C7.1 Worker/进程 adapter 精简** | 复用适用 launch/drain/cleanup helper，删除已证实重复的机制 | 候选：先核对归属、信号/截止时间及对照组语义 |
+| **C8.1 运行 readback** | App/Chat/CLI 消费同一 typed 工作/会话事实，退役被替代的调用方分类 | 候选：role 事实可用且证实分类重复；保留 unknown/coverage 与受众边界 |
+| **C9.1 租约/来源旧路径退役** | 调用方迁移后删除过时正常 writer 路由/wrapper；保留必要 release、fence-close 和原回执恢复 | 跨 RFC 候选：遵循 shared-authority/TS 验收，不作为 controller 启动前置 |
+| **C9.2 契约测试合并** | 共用不变量案例，加薄原生 adapter 测试，替换重复完整流程 fixture | 随所属替换交付；保留独有集成与负例 |
+
+这是九个调查/交付工作包，**不是承诺九个 PR**、固定剩余数量，也不是 C1 合入前必须
+完成的工作。不能因 C3.1 排在前面就选择它，也不能为了可见删代码而放弃当前更有价值的
+正确性、契约交付或 authority 退役成果。若选定 C3.1，C3.2 可以属于同一个可逆 PR。
+只有真实语义依赖约束顺序。现有行为修复和已证实局部精简可以先于 C1 交付；依赖契约
+的切换仍保留该依赖。不能仅凭文件相似就认定候选具备实施条件。
+
+记录所选切片为何推进当前全局成果、考虑过哪些更高价值替代项或在途交付，以及实际
+依赖。交付或新证据出现后重新评估；此盘点不穷尽有价值工作，也不要求 Agent 做完
+一条工作线才能换方向。优先级建议不新增准入或批准 gate。
+
+每个已认领工作包在既有 Todo/PR 内携带来源 owner/调用方、目标边界、具体删除的规则/
+分支、真实路径 oracle、依赖与回退。审计不替其他 Agent 分配任务，也不建立平行任务库。
+可用切片应完成调用方替换和删除；仅对具名外部接口或恢复契约保留 wrapper。记录跨语言
+生产代码总变化、语义 owner、完整事务 runtime crossing，以及下一项代表性规则的
+修改位置。Python LOC 减少或新增共享类不能单独证明精简；不以任意净减行数配额
+替代正确性或必需验证。
+
+复用 [TS 修改局部性收益](typescript-control-plane-migration-v0.zh-CN.md#28-以修改局部性衡量迁移收益)
+及 [smoke 合并规则](../../development/good-smokes.md)。内部行为保持替换需要真实调用方/
+后端证据，无需新设置页面。改变调用方操作/readback 时，仍需 C8 的打包前端失败/恢复
+旅程及首屏证据。C1/默认采用的完整成本与收益资格不变；有界重构不代表完整 RFC 验收。
+
 ## 12. 待决事项
 
 1. **精确 wire 名称与字段映射——contract owner，在 C1 cutover 前。** 优先演进一个
@@ -582,3 +638,11 @@ Native-resume/context 工作保留原 owner；采用其已验收改动，只补
 3. **资源分配与默认——product/evaluation owner，在 C7–C8 后。** 先用相同模型的
    controller/executor 隔离架构影响；更便宜的 controller 模型与不同预算另行实验。
    完整成果/成本证据支持决定前，profile 保持 opt-in。
+
+## Appendix A: Execution ledger / 执行记录
+
+源码核对及后续交付证据位于
+[`ledger/controller-executor-unified-contract-v0/`](ledger/controller-executor-unified-contract-v0/)。
+目录即索引。规划/源码检查记录不证明 runtime 交付；当前优先级与认领仍在 roadmap 和
+canonical 工作中维护。历史记录保持 append-only，当前规范性计划在本文修订，不能把
+某日审计当作永久执行队列。
diff --git a/docs/architecture/rfcs/ledger/controller-executor-unified-contract-v0/2026-10-27-refactor-handoff.md b/docs/architecture/rfcs/ledger/controller-executor-unified-contract-v0/2026-10-27-refactor-handoff.md
new file mode 100644
index 0000000000..dd98ecbc8d
--- /dev/null
+++ b/docs/architecture/rfcs/ledger/controller-executor-unified-contract-v0/2026-10-27-refactor-handoff.md
@@ -0,0 +1,263 @@
+# Controller-related simplification and retirement handoff
+
+- Parent: [controller/executor RFC, contributor handoff](../../controller-executor-unified-contract-v0.md#responsibility-convergence-and-contributor-handoff).
+- Source audit: `27991e27ba998439d7faf2fc113efcfe82882144`, 2026-10-27.
+- Status: source-backed work decomposition; no implementation, runtime qualification, installation or default change.
+- [Chinese mirror](2026-10-27-refactor-handoff.zh-CN.md).
+
+## Read this before claiming work
+
+The requested payoff is fewer independent decisions, fewer places to change a
+rule and removal of superseded production paths. Moving Python into TypeScript,
+renaming files or introducing another shared class does not by itself deliver it.
+This audit is bounded to the controller's existing execution/session/settlement
+callers and adjacent retirement seams; it is not an exhaustive repository audit.
+
+This is an option inventory, not a ranked queue. Select the next outcome against
+the overall roadmap, current user direction, demonstrated bottlenecks, active
+PRs and canonical work. Do not infer global priority from IDs, row order or a
+contributor handoff; no Agent is confined to one permanent lane. A current
+correctness or contract/authority-delivery gap can outrank any simplification
+here. Explain the selected outcome's value and alternatives in its existing task,
+then reassess after delivery or new evidence rather than finishing the list.
+
+If C3.1 is selected, C3.2 can share its PR when splitting creates only a facade.
+C4.2 needs the applicable qualified C4.1 boundary, not every other package.
+C4.3, C7.1, C8.1 and C9.1 need their stated comparison or retirement proof; reject
+or narrow candidates with distinct responsibilities. C9.2 accompanies the owning
+implementation, not a new framework or prerequisite project. Packages are not
+a PR count. Priority advice creates no extra admission or approval gate.
+
+Before claiming, refresh target main, related PRs and canonical Todos. Record
+actual ownership there; this document grants no peer assignment, merge or model-
+execution authority. The open-PR scope read at audit time identifies these seams:
+
+| Existing work | Coordination consequence |
+| --- | --- |
+| [#7430](https://github.com/loopx-project/loopx/pull/7430), [#7457](https://github.com/loopx-project/loopx/pull/7457), [#7461](https://github.com/loopx-project/loopx/pull/7461) | Coordinate with active C1/C2 contract composition/cutover, context references and Host-input work. Do not create another composer or rewrite qualified capture/context delivery; this is scope coordination, not a permanent Agent assignment. |
+| [#7456](https://github.com/loopx-project/loopx/pull/7456) | Adopt its independently qualified recovery guards; do not expand the bounded fix into all lifecycle consolidation or treat it as automatic reconciliation. |
+| [#7462](https://github.com/loopx-project/loopx/pull/7462), [#7411](https://github.com/loopx-project/loopx/pull/7411), [#7298](https://github.com/loopx-project/loopx/pull/7298) | Existing primary-action, Todo-summary and Vision-wait retirement proposals need reconciliation, not parallel Python/TS migrations. |
+| [#3412](https://github.com/loopx-project/loopx/pull/3412), [#5677](https://github.com/loopx-project/loopx/pull/5677) | Settlement readback and Host first-delivery semantics overlap C4.3's boundary. Review current diffs before replacing it. |
+| [#6838](https://github.com/loopx-project/loopx/pull/6838), [#6900](https://github.com/loopx-project/loopx/pull/6900), [#7252](https://github.com/loopx-project/loopx/pull/7252) | Research-worker launch/admission and lease-scope fixes retain their existing owners. Coordinate only the actual touched mechanics. |
+
+PR scopes are discovery evidence, not approval or a live status registry. Recheck
+them before implementation; do not infer authors' adoption or qualification.
+
+## C3.1 — Shared managed-operation protocol
+
+**Confirmed overlap / misplaced shared code.** `loopx/control_plane/turn_driver/`
+`codex_operation_host.py::run_codex_operation_host` and
+`dsh_operation_host.py::_run_dsh_operation_host` both check planned session versus
+binding/profile, recheck confirmed-operation scope, obtain pending handoffs and
+report native execution start. DSH already imports the generic
+`operation_tool_handler` from the Codex module: the handler is shared, not two
+implementations to rewrite.
+
+- **Target and deletion:** give that existing protocol a host-neutral owning
+  boundary and migrate both callers. Remove duplicated common orchestration and
+  the internal Codex-specific handler entry/import. Reuse current collaboration
+  and Goal-admission decisions; adapters supply native facts rather than minting
+  actor identity or approval. Do not create a `BaseHost` hierarchy.
+- **Preserve:** Codex native acceptance metadata, DSH connection pin/restore
+  limits, initialization races, tool isolation and native resource ownership.
+  Equal-looking callback code does not prove equal authority.
+- **Decisive acceptance:** both actual operation entries preserve original
+  authorized session/operation, pending-item filtering and once-only start;
+  changed profile/Todo/Goal or missing acceptance rejects before effect dispatch.
+  Extend `tests/test_codex_operation_host.py` and
+  `tests/control_plane/test_dsh_operation_entry.py`; retain SDK/connection cases.
+- **Dependency / rollback:** existing single-session behavior can refactor before
+  C1 without changing its schema. Revert caller adoption and common extraction
+  together; no state-format migration or new runtime toggle is needed.
+
+## C3.2 — Cohesive session-binding callers
+
+**Already shared storage, scattered caller composition.** `codex_sessions.py`
+already supports Codex and DSH schemas through a host parameter. Operation
+adapters still use private read/write helpers and assemble binding/profile
+checks around them. `driver.py::reconcile_failed_turn_session_request` and
+`session_recovery.py` consume the same managed-session identity.
+
+- **Target and deletion:** reuse this persistence owner and expose only the
+  cohesive select/verify/store operations needed by real callers. Retire replaced
+  caller-side reconstruction and private cross-host imports. A module rename
+  alone is not this package; combine it with C3.1 if no independent payoff exists.
+- **Decisive acceptance:** new/resume/fresh, changed profile, concurrent binding
+  replacement, checkpoint provenance and existing failure recovery preserve the
+  exact session and Goal instance. Validate both native adapters and original
+  persisted documents; do not introduce a second session database.
+- **Dependency / rollback:** keep existing on-disk paths/wire versions for the
+  behavior-preserving slice. C3's later role/generation extension requires stable
+  C1 and explicit migration/replay/rollback; never overwrite old native IDs or
+  borrow continuity between hosts/roles. Read accepted receipts before reverting.
+
+## C4.1 — Typed receipt-to-continuation boundary
+
+**Remaining cross-language decision ownership.** `loop_controller.py` owns
+`ValidatedTurnReceipt`, `BoundedTurnBudget` and deterministic disposition rules;
+`managed_step.py` reconstructs an execution-shaped receipt from the journal and
+also asks `turn_journal.ts` for consistency. `recovery.py` already wraps that TS
+journal decision. Journal recovery and deciding the next admitted action are
+different questions; their proximity is not proof they should be one state.
+
+- **Target and deletion:** evolve the existing typed Turn/effect domain to
+  compose receipt qualification and deterministic continuation over one coherent
+  fact request. Keep separate domain decisions where required, but remove the
+  replaced Python reconstruction, admission partitions and policy evaluation.
+  Preserve the registered controller contract rather than adding a workflow DSL
+  or another runtime operation for each field.
+- **Decisive acceptance:** the independent semantics in
+  `tests/test_loop_turn_loop_controller.py`,
+  `tests/test_loopx_turn_managed_step.py` and journal tests preserve causal
+  predecessor, selected work, budget, retry ceiling and early-return ordering.
+  Later facts must not become mandatory for a branch that legitimately returns
+  earlier. Real run-once/managed-step readback on File/SQLite must retain original
+  receipts, no redispatch on saved results and one settlement.
+- **Dependency / rollback:** absorb C1's stable contract and qualified recovery
+  fixes. Characterization and proven local deletion need not wait for full C1
+  benefit experiments. Replace real consumers in the delivery slice; preserve
+  historical decoding and original effect readback across code rollback.
+
+## C4.2 — Thin outer-worker semantic adoption
+
+**Candidate for bounded policy convergence.**
+`scripts/external_scheduler_worker.py::_host_attempt`, `_host_result` and
+`_run_worker_locked` combine local IO with Host retry, pending-replan and
+continuation interpretation. They already reuse Host failure helpers. Do not
+count that reuse as missing, or equate the outer wake with a governed Turn.
+
+- **Target and deletion:** after C4.1, migrate a supported observable Host path
+  to qualified semantic observations/decisions; remove only replaced common
+  policy branches. Keep polling/backoff execution, command transport, wake
+  identity and original-host settlement with their actual scheduler owners.
+- **Decisive acceptance:** `tests/test_external_scheduler_worker.py` plus real
+  product entry checks cover saved failure, original replan, lost response,
+  repeated wake, stop and retry exhaustion. A shell success/ACK cannot become a
+  semantic result; unknown/opaque effects remain unknown. Do not delete the
+  pending-intent witness until its crash window is covered by the replacement.
+- **Dependency / rollback:** C4.1 and a Host that can observe its original
+  attempt. Keep opaque commands on an explicit supported/degraded boundary,
+  never a blind automatic retry. Reconcile pending original work before reverting.
+
+## C4.3 — Settlement adapters over existing primitives
+
+**Comparison required, not a proven duplicate transaction.**
+`host_adapter_settlement.py` decodes and executes an ordered CLI plan and its
+conditions; `host_todo_completion.ts` owns its prepare/finalize semantics.
+`turn_driver/settlement.py` instead executes the existing TS settlement reducer
+and provider readbacks. Both reuse `SettlementIdentity`, but have distinct
+entry obligations. `extensions/governed_capability_execution.py` already calls
+`execute_turn_driver_settlement`.
+
+- **Target and deletion:** compare identity, validation, guard/vision,
+  completion, durable writeback, spend, closeout and recovery obligations first.
+  Reuse matching effect/receipt primitives in the existing owner. Delete a
+  second condition/step interpreter only after callers adopt an equivalent
+  typed boundary; preserve genuinely Host-specific front-door obligations.
+- **Decisive acceptance:** original effect IDs and per-phase durable readbacks
+  survive failure before/after commit, response loss, repeated completion and
+  Todo-less replan. Use existing MCP, Turn-settlement and external-capability
+  integration cases. Distinct transaction boundaries remain explicit.
+- **Dependency / rollback:** coordinate #3412/#5677 and stable contract inputs.
+  Compare complete-path runtime crossings/costs; moving a tiny condition into a
+  new RPC per step is not automatically an improvement. Revert after original
+  prepared effects are read back, not by discarding journals.
+
+## C7.1 — Worker/process cleanup at the existing runtime boundary
+
+**Mechanics overlap; semantics need qualification.**
+`benchmark/runtime/worker.py` has `child_process`, `_reap_child_process` and
+`interrupt_checkpoint_process`; product `host_process_transport.py` owns
+supervisor records, drain observations and guarded process execution. Shared
+POSIX calls alone do not make their stop/ownership contracts interchangeable.
+
+- **Target and deletion:** reuse suitable existing process primitives and make
+  benchmark-specific entry adapters thin. Remove a duplicate launch/cleanup
+  implementation only after matching its policy; keep task environment,
+  checkpoint behavior, native event decoding and outer wake ownership explicit.
+- **Decisive acceptance:** real disposable process groups cover normal exit,
+  spawn failure, timeout, descendants, interruption and unknown drain; ACK is not
+  exit. Preserve signal ordering, deadlines, descriptor/environment handling and
+  supported-platform reporting. Native/plain control arms gain no LoopX admission
+  dependency, changed scoring, budget or instrumentation merely through reuse.
+- **Dependency / rollback:** coordinate existing worker/admission work; no model
+  or benchmark jobs are authorized here. Keep distinct owners if policy matching
+  fails. Code rollback preserves already-admitted process and receipt ownership.
+
+## C8.1 — One operational fact source, existing readback surfaces
+
+**Projection candidate, not a replacement authority.**
+`control_plane/runtime/session_runtime.py`, `status/lifecycle_projection.py` and
+dashboard `features/personal-workspace/goal-activity.ts` adapt activity and work
+facts. Some already delegate shared owners. A display grouping, a session's
+transport state and work admission are not interchangeable status machines.
+
+- **Target and deletion:** when role-aware session facts exist, trace them to
+  App/Chat/CLI. Remove only demonstrated duplicate semantic classifications;
+  retain presentation grouping/localization. Do not create another controller
+  console, provider setting or state store, or merge legacy material-summary
+  classification with native session persistence by name.
+- **Decisive acceptance:** the existing packaged journey shows actual work,
+  unavailable Host, recovering/unknown state, stop scope and late results from
+  the same typed facts. Include populated desktop/narrow first screens; unknown
+  is not idle or zero, and audience/redaction boundaries remain intact.
+- **Dependency / rollback:** C3/C6 and a proven classification overlap. Retain
+  old consumers only for their explicit wire/support window; revert projection
+  consumers without granting execution authority or changing runtime settings.
+
+## C9.1 — Retire old lease/source execution paths with proof
+
+**Concrete retained path, not dead code by naming.**
+`work_items/task_lease_lifecycle.ts::executeTaskLeaseLifecycle` routes canonical
+operations through `canonical_task_lease_lifecycle.ts` and retains source-backed
+release, fence-close and historical-receipt recovery. Fresh source-backed writes
+and separate verification operations are already refused. The canonical
+coordination executor and old adapter already share lifecycle decisions.
+
+- **Target and deletion:** use the shared-authority and TS retirement inventory
+  to move remaining normal callers to canonical transactions, then delete obsolete
+  writer routing, unreachable mutation code and wrappers. Isolate old-format
+  parsing in its required migration/recovery boundary; migrate with backup when
+  formats change. This is not permission to remove an active fence or receipt
+  reader because its name contains `legacy`.
+- **Decisive acceptance:** enumerate imports, dispatch registrations, wire callers
+  and retained journals/receipts. Rehearse migration and restore in disposable
+  runtimes, including release, fence-close, stale owner, response-loss replay and
+  new post-migration writes. Qualify supported File/SQLite and real PostgreSQL
+  transaction changes under the existing gates. Markdown remains a readable
+  projection, not a second truth or a file to delete for this package.
+- **Dependency / rollback:** named retirement/support conditions and the owning
+  shared-authority checkpoint. Active recovery remains until replaced or its
+  explicit support window closes; absence of local samples proves no global
+  absence. This cross-RFC work is not a prerequisite for controller launch.
+
+## C9.2 — Contract tests as a companion simplification
+
+- **Sources:** Codex operation tests, DSH entry/SDK/connection tests, managed-step,
+  journal and settlement suites named above.
+- **Target and deletion:** share useful existing setup and invariant cases;
+  keep thin real-adapter and unique integration/negative tests. Remove duplicated
+  fixture builders and repeated complete-flow tests only after mapping their
+  assertions. No new general test framework or whole-output snapshot quota.
+- **Acceptance / rollback:** derive oracles from independent semantics, preserve
+  native acceptance, lost-response and authority-race coverage, and keep a
+  representative assertion capable of detecting a broken guard. Fewer test
+  functions alone is not success. Change tests alongside their owning production
+  replacement; retain per-host failures rather than averaging them away.
+
+## Already shared or intentionally different: do not create duplicate work
+
+| Observed source | Disposition |
+| --- | --- |
+| `decision_capture.py`, context-delivery owners and #7430/#7457 consumers | Reuse existing capture/full/delta; only qualified C1/C2 caller replacement remains. |
+| `benchmark/runtime/sessions.py::BenchmarkSessionWake` | Already a thin `CodexAgentSession` adapter; no second benchmark session owner to extract. |
+| `recovery.py`, TS journal inspection and `execute_turn_driver_settlement` | Existing shared owners, not missing frameworks. C4 targets remaining caller/decision duplication. |
+| `coordination/task_lease_lifecycle.ts` and `work_items/task_lease_lifecycle_decision.ts` | Transaction execution versus shared pure decision; similar names do not justify collapsing them. |
+| Root `execution_profile.py`, Turn `execution_profile.py`, manager `machine_profile.py` | Work-granularity policy, provider/model selection and permissions are different axes. Chat already reuses the managed profile; do not merge by filename or create duplicate defaults. |
+| App conversation claim, native session binding, Turn journal and outer wake state | Different authority, lifetime and atomicity. Connect through exact identities/receipts, not one generic status or a new database. |
+
+Each implementation reports applied/deferred/rejected candidates, actual retired
+callers/rules, remaining supported recovery and the next representative change's
+locality. Preserve the RFC's original full-cost/outcome and default-adoption
+acceptance. This source audit did not run the listed runtime suites and does not
+establish net deletion, equivalence or performance benefit.
diff --git a/docs/architecture/rfcs/ledger/controller-executor-unified-contract-v0/2026-10-27-refactor-handoff.zh-CN.md b/docs/architecture/rfcs/ledger/controller-executor-unified-contract-v0/2026-10-27-refactor-handoff.zh-CN.md
new file mode 100644
index 0000000000..5eca2597b9
--- /dev/null
+++ b/docs/architecture/rfcs/ledger/controller-executor-unified-contract-v0/2026-10-27-refactor-handoff.zh-CN.md
@@ -0,0 +1,210 @@
+# Controller 相关精简与退役交接
+
+- 上位文档：[controller/executor RFC 贡献者交接](../../controller-executor-unified-contract-v0.zh-CN.md#职责收敛与贡献者交接)。
+- 源码核对：`27991e27ba998439d7faf2fc113efcfe82882144`，2026-10-27。
+- 状态：有源码依据的工作拆解；未交付实现、runtime 资格、安装或默认值变更。
+- [English mirror](2026-10-27-refactor-handoff.md)。
+
+## 认领前阅读
+
+目标是减少独立决策、减少同一规则的修改位置，并删除被替代的生产路径。把 Python
+搬到 TypeScript、改文件名或新增共享类，本身不能交付这些收益。本次核对限定于
+controller 既有执行/会话/结算调用方及相邻退役边界，不是全仓穷尽审计。
+
+这是候选盘点，不是排好优先级的队列。下一成果应对照整体 roadmap、当前用户方向、
+实际瓶颈、活跃 PR 和 canonical 工作选择。不能从编号、行序或贡献者交接推断全局
+优先级，也不把 Agent 固定在一条永久工作线上。当前正确性或契约/authority 交付缺口
+可以优先于任何精简项。在既有任务中解释所选成果的价值与替代项，交付或新证据出现后
+重新评估，而不是以做完清单为目标。
+
+若选定 C3.1，且独立拆分只会留下 facade，C3.2 可以同 PR。C4.2 需要适用且已合格的
+C4.1 边界，不需要其他所有工作包。C4.3、C7.1、C8.1、C9.1 需要各自的比较或退役证明；
+若职责不同就拒绝或缩小候选。C9.2 随所属实现交付，不是新框架或前置项目。工作包不等于
+PR 数量；优先级建议不新增准入或批准 gate。
+
+认领前刷新目标 main、相关 PR 与 canonical Todo，实际归属记录在那里。本文不授予
+代其他人分配任务、合并或模型执行权限。核对时的开放 PR 范围指出以下接缝：
+
+| 既有工作 | 协调要求 |
+| --- | --- |
+| [#7430](https://github.com/loopx-project/loopx/pull/7430)、[#7457](https://github.com/loopx-project/loopx/pull/7457)、[#7461](https://github.com/loopx-project/loopx/pull/7461) | 对齐活跃 C1/C2 契约组合/切换、上下文引用和 Host 输入工作。不另建 composer，不重写已合格 capture/context 交付；这是范围协调，不是 Agent 永久分工。 |
+| [#7456](https://github.com/loopx-project/loopx/pull/7456) | 采用其中独立取得资格的恢复保护；不把有界修复扩成全部生命周期收敛，也不当作自动核对能力。 |
+| [#7462](https://github.com/loopx-project/loopx/pull/7462)、[#7411](https://github.com/loopx-project/loopx/pull/7411)、[#7298](https://github.com/loopx-project/loopx/pull/7298) | 对齐已有 primary-action、Todo 摘要、Vision 等待退役提案，不平行做 Python/TS 迁移。 |
+| [#3412](https://github.com/loopx-project/loopx/pull/3412)、[#5677](https://github.com/loopx-project/loopx/pull/5677) | 结算 readback、Host 首次交付语义与 C4.3 边界相邻；替换前检查当前 diff。 |
+| [#6838](https://github.com/loopx-project/loopx/pull/6838)、[#6900](https://github.com/loopx-project/loopx/pull/6900)、[#7252](https://github.com/loopx-project/loopx/pull/7252) | 研究 worker launch/admission 与租约范围修复保留原 owner；只协调实际触及的机制。 |
+
+PR 范围只是发现依据，不是批准或实时状态库。实现前再次核对，不能推断作者已采用
+或取得资格。
+
+## C3.1 — 公共受管操作协议
+
+**已确认重叠 / 共享代码归属不当。** `loopx/control_plane/turn_driver/` 下的
+`codex_operation_host.py::run_codex_operation_host` 与
+`dsh_operation_host.py::_run_dsh_operation_host` 都核对计划会话与 binding/profile、
+复查已确认 operation 范围、获取 pending handoff，并回报原生执行开始。DSH 已从
+Codex 模块导入通用 `operation_tool_handler`：handler 已共享，不应重写两份。
+
+- **目标与删除：** 为既有协议整理 Host 中立的归属并迁移两个调用方；删除重复公共
+  编排，以及内部 Codex 专属 handler 入口/导入。复用 collaboration、Goal admission
+  的当前裁决；adapter 提供原生事实，不能生成 actor 身份或批准。不建 `BaseHost` 层级。
+- **保留：** Codex 原生接受元数据、DSH 连接 pin/restore 限制、初始化竞态、工具隔离
+  与原生资源归属。相似 callback 不证明权限等价。
+- **决定性验收：** 两个真实 operation 入口保留原授权 session/operation、pending 项
+  过滤与一次 start；profile/Todo/Goal 变化或缺失原生接受，在 effect dispatch 前拒绝。
+  扩展 `tests/test_codex_operation_host.py`、
+  `tests/control_plane/test_dsh_operation_entry.py`，保留 SDK/connection 案例。
+- **依赖 / 回退：** 现有单会话行为可先于 C1 重构，不改其 schema；调用方采用与公共
+  抽取一并回退，无需状态格式迁移或新 runtime 开关。
+
+## C3.2 — 完整的会话绑定调用边界
+
+**持久化已共享，调用方组合分散。** `codex_sessions.py` 已通过 host 参数支持 Codex、
+DSH schema。Operation adapter 仍使用私有读写 helper，并在周边组装 binding/profile
+校验。`driver.py::reconcile_failed_turn_session_request`、`session_recovery.py`
+消费同一 managed-session 身份。
+
+- **目标与删除：** 复用这个持久化 owner，仅提供真实调用方需要的完整 select/verify/
+  store 操作；删除被替代的调用方重建与跨 Host 私有导入。单纯改模块名不算此工作包；
+  无独立收益时与 C3.1 合并。
+- **决定性验收：** new/resume/fresh、profile 变化、并发 binding 替换、checkpoint
+  来源与既有失败恢复均保留精确 session、Goal instance。验证两个原生 adapter 及原
+  持久化文档，不引入第二个 session 数据库。
+- **依赖 / 回退：** 行为保持切片保留当前磁盘路径/wire 版本。后续 C3 role/generation
+  扩展需要 C1 稳定及显式迁移/replay/rollback；不能覆盖旧 native ID，不能跨 Host/role
+  借用连续性。回退前读回已接受回执。
+
+## C4.1 — Typed 回执到继续决策边界
+
+**仍存跨语言决策归属。** `loop_controller.py` 拥有 `ValidatedTurnReceipt`、
+`BoundedTurnBudget` 与确定性 disposition 规则；`managed_step.py` 从 journal 重建
+execution 形状的回执，同时调用 `turn_journal.ts` 检查一致性。`recovery.py` 已包装
+该 TS journal 裁决。Journal 恢复和决定下一项已准入动作是两个问题，位置相邻不证明
+应该合成一个状态。
+
+- **目标与删除：** 演进既有 typed Turn/effect 领域，以一个完整事实请求组合回执
+  资格和确定性继续决策。必要时保留不同领域裁决，但删除被替代的 Python 重建、准入
+  分区和策略求值。保留已注册 controller contract，不加 workflow DSL，也不为每个
+  字段新增 runtime operation。
+- **决定性验收：** `tests/test_loop_turn_loop_controller.py`、
+  `tests/test_loopx_turn_managed_step.py` 与 journal 测试中的独立语义保留因果前驱、
+  选定工作、预算、重试上限和提前返回顺序。某分支本可提前返回，后续事实不能因此变成
+  必填。File/SQLite 真实 run-once/managed-step readback 保留原回执、缓存结果不重新
+  派发、结算一次。
+- **依赖 / 回退：** 整合 C1 稳定契约与已合格恢复修复。特征化及已证实局部删除不必
+  等待完整 C1 收益实验。在交付切片中替换真实消费者；代码回退时保留历史解码与原
+  effect readback。
+
+## C4.2 — 外层 worker 的薄语义采用
+
+**有界策略收敛候选。** `scripts/external_scheduler_worker.py` 的 `_host_attempt`、
+`_host_result`、`_run_worker_locked` 混合本地 IO、Host retry、pending-replan 和
+continuation 解释；它们已经复用 Host failure helper。不能把已有复用算作缺口，也
+不能把外层唤醒等同于受治理 Turn。
+
+- **目标与删除：** C4.1 后，将一条支持观察的 Host 路径迁到已合格语义观察/裁决；
+  只删除被替代的公共策略分支。Polling/backoff 的实际执行、命令 transport、wake
+  身份和原 Host 结算仍归真实 scheduler owner。
+- **决定性验收：** `tests/test_external_scheduler_worker.py` 加真实产品入口覆盖
+  已存失败、原 replan、丢响应、重复 wake、stop、重试耗尽。Shell 成功/ACK 不能变成
+  语义结果，unknown/不透明 effect 仍是 unknown。替代路径覆盖同一崩溃窗口前，不能
+  删除 pending-intent witness。
+- **依赖 / 回退：** C4.1 和能观察原 attempt 的 Host。不透明命令保留明确的支持/降级
+  边界，不能盲目自动重试。回退前核对原未结工作。
+
+## C4.3 — 基于既有原语的结算 adapter
+
+**需要比较，不是已证明重复的事务。** `host_adapter_settlement.py` 解码并执行有序
+CLI plan 及条件；`host_todo_completion.ts` 拥有其 prepare/finalize 语义。
+`turn_driver/settlement.py` 则执行既有 TS settlement reducer 与 provider readback。
+两者复用 `SettlementIdentity`，但入口义务不同。
+`extensions/governed_capability_execution.py` 已调用 `execute_turn_driver_settlement`。
+
+- **目标与删除：** 先比较 identity、validation、guard/vision、completion、持久写回、
+  spend、closeout、recovery 的义务；在既有 owner 复用相同 effect/receipt 原语。
+  调用方采用等价 typed 边界后才能删除第二套 condition/step 解释器；保留真实的 Host
+  入口特定义务。
+- **决定性验收：** commit 前后失败、丢响应、重复完成、无 Todo replan 中，原 effect
+  ID 与分阶段持久 readback 不变。使用既有 MCP、Turn settlement、external-capability
+  集成案例；不同事务边界保持显式。
+- **依赖 / 回退：** 对齐 #3412/#5677 及稳定契约输入。比较完整路径 runtime crossing/
+  成本；把微小条件搬成每步新 RPC 不自动带来改进。回退前读回原 prepared effect，
+  不能丢弃 journal。
+
+## C7.1 — 既有 runtime 边界内的 worker/进程清理
+
+**机制重叠，语义待资格。** `benchmark/runtime/worker.py` 包含 `child_process`、
+`_reap_child_process`、`interrupt_checkpoint_process`；产品
+`host_process_transport.py` 拥有 supervisor record、drain 观察和受保护进程执行。
+都使用 POSIX 调用，不代表 stop/归属契约可互换。
+
+- **目标与删除：** 复用适用的既有进程原语，使 benchmark 入口 adapter 变薄。匹配
+  策略后才删除重复 launch/cleanup；保留 task environment、checkpoint 行为、原生
+  事件解码和外层 wake 归属。
+- **决定性验收：** 真实临时进程组覆盖正常退出、spawn 失败、timeout、后代进程、
+  interruption、unknown drain；ACK 不等于退出。保留信号顺序、截止时间、descriptor/
+  environment 处理和平台支持报告。Native/plain 对照组不能仅因复用而新增 LoopX
+  admission 依赖、改变 scoring、budget 或 instrumentation。
+- **依赖 / 回退：** 对齐既有 worker/admission 工作；本文不授权模型或 benchmark job。
+  策略匹配失败则保留独立 owner。代码回退保留已准入进程和回执归属。
+
+## C8.1 — 一个运行事实来源，沿用 readback 页面
+
+**投影候选，不替代 authority。** `control_plane/runtime/session_runtime.py`、
+`status/lifecycle_projection.py`、dashboard
+`features/personal-workspace/goal-activity.ts` 适配 activity/work 事实；部分已委托共享
+owner。显示分组、session transport 状态与工作准入不是可互换的状态机。
+
+- **目标与删除：** role-aware session 事实可用后追踪到 App/Chat/CLI。只删除证实重复
+  的语义分类，保留呈现分组/本地化。不建另一个 controller console、provider 设置或
+  状态库，也不因名称相似而合并旧材料摘要分类与原生 session 持久化。
+- **决定性验收：** 既有打包旅程从同一 typed 事实展示真实工作、Host 不可用、恢复/
+  unknown、stop 范围和迟到结果。包括有内容的桌面/窄屏首屏；unknown 不等于 idle 或
+  零，受众/脱敏边界保持有效。
+- **依赖 / 回退：** C3/C6 及已证实分类重叠。旧消费者仅因明确 wire/support 窗口
+  保留；回退投影消费者不授予执行权限，也不改变 runtime 设置。
+
+## C9.1 — 有证据地退役旧租约/来源执行路径
+
+**有具体保留路径，不能按名称判断死代码。**
+`work_items/task_lease_lifecycle.ts::executeTaskLeaseLifecycle` 经
+`canonical_task_lease_lifecycle.ts` 路由 canonical 操作，同时保留 source-backed
+release、fence-close、历史回执恢复。Fresh source-backed 写入及独立验证操作已拒绝。
+Canonical coordination executor 与旧 adapter 已共享生命周期裁决。
+
+- **目标与删除：** 用 shared-authority、TS 退役盘点将剩余正常调用方迁到 canonical
+  事务，再删过时 writer 路由、不可达 mutation 与 wrapper。旧格式解析隔离在所需
+  迁移/恢复边界；格式变化先备份迁移。不能仅因名字含 `legacy` 就删活跃 fence 或
+  receipt reader。
+- **决定性验收：** 枚举 import、dispatch registration、wire caller、保留 journal/
+  receipt。在临时 runtime 演练迁移/恢复，包括 release、fence-close、stale owner、
+  丢响应 replay、迁移后新写入。按既有 gate 验证受影响受支持的 File/SQLite、真实
+  PostgreSQL 事务变化。Markdown 保留为可读投影，不是第二真相，也不是本任务待删文件。
+- **依赖 / 回退：** 具名退役/支持条件和所属 shared-authority 检查点。活跃恢复保留
+  到替代或显式支持窗口关闭；本机无样本不证明全局不存在。此跨 RFC 工作不是 controller
+  启动前置。
+
+## C9.2 — 随实现精简契约测试
+
+- **来源：** 上述 Codex operation、DSH entry/SDK/connection、managed-step、journal、
+  settlement 测试集合。
+- **目标与删除：** 共享有用的既有 setup 和不变量案例，保留薄真实 adapter 及独有
+  集成/负例。映射断言后才删除重复 fixture builder、完整流程测试。不新建通用测试
+  框架或整份输出 snapshot 配额。
+- **验收 / 回退：** oracle 来自独立语义，保留 native acceptance、丢响应、权限竞态
+  覆盖，以及能发现保护被破坏的代表性断言。测试函数变少本身不是成功。测试与所属
+  生产替换一同修改；保留每个 Host 的失败，不能通过平均掩盖。
+
+## 已共享或刻意不同：不要制造重复工作
+
+| 源码事实 | 处理 |
+| --- | --- |
+| `decision_capture.py`、context-delivery owner、#7430/#7457 消费者 | 复用既有 capture/full/delta；只剩已合格 C1/C2 调用方替换。 |
+| `benchmark/runtime/sessions.py::BenchmarkSessionWake` | 已是薄 `CodexAgentSession` adapter，没有第二套 benchmark session owner 要抽取。 |
+| `recovery.py`、TS journal inspection、`execute_turn_driver_settlement` | 已有共享 owner，不是缺框架。C4 只处理剩余调用方/决策重复。 |
+| `coordination/task_lease_lifecycle.ts`、`work_items/task_lease_lifecycle_decision.ts` | 事务执行与共享纯裁决分工；相似名称不足以要求合并。 |
+| 根 `execution_profile.py`、Turn `execution_profile.py`、manager `machine_profile.py` | 工作粒度、provider/model 选择、权限是不同维度。Chat 已复用 managed profile，不能按文件名合并或新增重复默认值。 |
+| App conversation claim、native session binding、Turn journal、外层 wake state | Authority、生命周期、原子性不同。通过精确身份/回执关联，不合成通用 status 或新数据库。 |
+
+每个实现报告采用/延后/拒绝的候选、实际退役的调用方/规则、剩余受支持恢复，以及下一项
+代表性修改的局部性。保留 RFC 原有完整成本/成果及默认采用验收。本源码核对没有运行
+上述 runtime suites，不证明净删代码、等价性或性能收益。
diff --git a/docs/architecture/rfcs/loopx-overall-roadmap-v0.md b/docs/architecture/rfcs/loopx-overall-roadmap-v0.md
index ad2456f24c..585e9ce933 100644
--- a/docs/architecture/rfcs/loopx-overall-roadmap-v0.md
+++ b/docs/architecture/rfcs/loopx-overall-roadmap-v0.md
@@ -204,6 +204,17 @@ benchmark consumer; managed Codex can carry an implementation but proves neither
 by itself. Reuse active context/recovery work. No new Goal, scheduler, parallel
 roadmap, benchmark launch or default promotion follows from these task entries.
 
+The RFC's [responsibility-convergence handoff](controller-executor-unified-contract-v0.md#responsibility-convergence-and-contributor-handoff)
+adds source-backed C3/C4/C7/C8/C9 packages for shared managed-operation flows,
+binding callers, continuation, worker/settlement adapters and conditional old-path
+retirement. Choose among contract delivery, simplification and other current work
+from the global outcome and evidenced bottlenecks, not package order or a fixed
+Agent lane; coordinate in-flight ownership without duplicating it. Reuse existing
+owners and delete replaced rules in real callers. The audit also
+records already-shared code and distinct lifecycles that must not be merged by
+appearance. Packages are claimable slices, not a fixed PR count or new controller
+prerequisites; runtime delivery and qualification remain open.
+
 ### Current priorities after research and acceptance integration
 
 This checkpoint is pinned to main `5550e91bab` (2026-10-23). It reconciles
diff --git a/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md b/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md
index 00f0b9c1f7..d6660acb88 100644
--- a/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md
+++ b/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md
@@ -156,6 +156,14 @@ C1 的[消费链切换表](controller-executor-unified-contract-v0.zh-CN.md#c1-
 实现载体，但不能单独证明二者。复用活跃的上下文/恢复工作。这些任务项不创建新 Goal、
 scheduler 或并行路线图，不启动 benchmark，不提升默认。
 
+RFC 的[职责收敛交接](controller-executor-unified-contract-v0.zh-CN.md#职责收敛与贡献者交接)
+补充有源码依据的 C3/C4/C7/C8/C9 工作包，覆盖公共受管操作、binding 调用方、继续决策、
+worker/settlement adapter 和有条件的旧路径退役。从全局成果与实际瓶颈选择契约交付、
+精简或其他当前工作，不按工作包行序或固定 Agent 工作线选择；协调在途归属而不重复
+实现。复用已有 owner，在真实调用方删除被替代的规则。核对也列出已经共享的代码，以及不能
+因外形相似就合并的不同生命周期。工作包是可认领切片，不是固定 PR 数量或 controller
+新前置条件；runtime 交付与资格仍未完成。
+
 ### 研究与验收集成后的当前优先级
 
 本检查点固定在 main `5550e91bab`（2026-10-23），核对公共源码交付，不公布私有实验