docs: qualify archive-summary reader compatibility

docs/architecture/rfcs/monorepo-distribution-split-v0.md

@@ -2598,4 +2598,57 @@ cross-package breaking change for three consecutive releases.
 
 ## Appendix E: Incident and review lessons
 
-None yet.
+### Generated Todo pointer read compatibility (non-normative)
+
+The generated archive-summary and per-Todo active-field omission pointers belong
+to the existing Todo projection owner. The observed strict `machine_region.py`
+reader matching `8d314af49` rejects the archive-summary comment, which has no
+recognized Todo metadata. It already accepts the emitted per-Todo omission row
+through valid `todo_id` metadata. Their shared `loopx:todo-archive-pointer` prefix
+does not establish reader drift; attribute an omission-row fault only after the
+exact installed reader rejects that exact generated line. The archive-summary
+reader repair is already on `main` through
+[#7834](https://github.com/loopx-project/loopx/pull/7834). An affected installed
+reader needs composition qualification, rather than another source fix or removal
+of live projection metadata.
+
+Author qualification at `97cc1e0c4` used the same synthetic source and real
+File/SQLite stores under Python 3.13 and 3.14 with Node 26. The prior reader's
+grammar matches `8d314af49`. Across the prior snapshot, current source and its
+built wheel, 36 cases covered plain, archive-summary and foreign-narrative rows;
+they did not test per-Todo omission. They produced 20 expected successes and
+16 expected refusals: four prior-reader archive-summary failures and twelve
+foreign-narrative failures. All four prior-reader failures recovered and replayed
+through the current source
+under the original Turn identity. Canonical work remained unchanged and quota
+debits stayed zero. Eight additional source/wheel console cases read the native
+capture back with synthetic Session identities; fixture preparation failures
+remain failures, and a committed capture was recovered without rerunning
+admission. The existing region, projection and SQLite archive regressions passed
+(83 cases).
+
+Review qualification on runtime baseline `ebb39f4db` filled the missing per-Todo
+comparison through the real installed-snapshot, source and isolated-wheel console
+entrypoints on File/SQLite, Python 3.13.5 and Node 26. Eighteen cases produced ten
+successes and eight expected refusals: the old reader rejected two archive
+summaries, all three distributions rejected six foreign-narrative cases, and all
+six per-Todo omission cases succeeded. Ten successful cases executed the emitted
+native read command and replayed the original Turn; both old archive-summary
+failures recovered/replayed through source with that same identity. Source and
+canonical work stayed unchanged, with zero quota debits. The 83 existing
+regressions passed again. The packaged runtime resources matched source bytes.
+Fixture preparation failures remain recorded; an initial process-exit wait was
+unconfirmed, so evidence directories were retained and serving retirement was
+checked separately. This does not claim process-exit qualification.
+
+The 36-case matrix took 135.6 seconds; this is observation cost, not a speed or
+long-horizon benefit qualification. Total model, service CPU and human costs are
+unmeasured. Actual installed-host upgrade and readback remain unqualified.
+Preserve I3 for at least one minor release. This evidence does not close full
+R0/V10, M1/#8011, R1, context/model or split installation, or promote D2/D5/D6/D3.
+Use the existing self-repair lookup for `marked_todo_archive_pointer_reader_drift`
+with the combined query `quota_unexpected_collection_error non-generated content
+inside marked Todo region`. Thin Codex App output may expose only the error code;
+read-only `loopx --format json quota status --goal-id <goal-id> --verbose` supplies
+the detailed symptom. Distinguish a shipped repair from installed-reader drift
+without weakening foreign-content rejection or rewriting active state.

docs/architecture/rfcs/monorepo-distribution-split-v0.zh-CN.md

@@ -2019,4 +2019,42 @@ context／model／split-install、PostgreSQL host／wheel、full-cost／adoption
 
 ## 附录 E：事故与评审经验
 
-暂无。
+### 生成式 Todo 指针的读取兼容性（非规范性）
+
+归档摘要和单条 Todo 活跃字段省略指针由既有 Todo 投影 owner 生成。实际观察到的
+严格 `machine_region.py` reader 与 `8d314af49` 一致：它拒绝没有可识别 Todo
+元数据的归档摘要注释，但已能通过有效的 `todo_id` 元数据接受生成的单条省略行。
+两者共享 `loopx:todo-archive-pointer` 前缀不能证明 reader 漂移；只有精确安装
+reader 确实拒绝该条生成行时，才能将单条省略故障归因于它。归档摘要 reader 修复
+已通过 [#7834](https://github.com/loopx-project/loopx/pull/7834) 进入 `main`。
+受影响的安装 reader 需要装配资格验证，不能据此重复源码修复或删除活跃投影元数据。
+
+作者在 `97cc1e0c4` 上，以相同合成 source 和真实 File/SQLite store，在 Python
+3.13、3.14 与 Node 26 下验证。旧 reader 的语法与 `8d314af49` 一致。旧快照、当前
+源码及其构建 wheel 的 36 场景只覆盖普通、归档摘要和外来叙述行，未测试单条字段
+省略。它们得到 20 个预期成功、16 个预期拒绝：4 个旧 reader 归档摘要失败和
+12 个外来叙述失败。4 个旧 reader 失败均通过当前源码按原 Turn 身份恢复
+并重放；canonical work 保持不变，quota 扣费为零。另外 8 个 source/wheel console
+场景以合成 Session 身份完成 native capture 回读；fixture 准备失败仍保留为失败，
+已提交 capture 的恢复未重跑准入。既有 region、projection 和 SQLite archive 回归
+通过（83 个场景）。
+
+评审资格验证在 runtime 基线 `ebb39f4db` 上，通过真实安装快照、源码和隔离 wheel
+的 console 入口，在 File/SQLite、Python 3.13.5 与 Node 26 下补齐单条省略对照。
+18 个场景得到 10 个成功和 8 个预期拒绝：旧 reader 拒绝 2 个归档摘要，三个发行
+形态均拒绝共 6 个外来叙述场景，6 个单条省略场景全部成功。10 个成功场景执行了
+实际发出的 native read 命令并重放原 Turn；2 个旧 reader 归档摘要失败均按同一
+身份通过源码恢复／重放。source 和 canonical work 均未改变，quota 扣费为零。
+83 个既有回归再次通过；打包 runtime 资源与源码字节一致。fixture 准备失败仍保留；
+一次初始 process-exit 等待未确认，因此保留证据目录并另查 serving retirement，
+不声称 process-exit 资格通过。
+
+36 场景矩阵耗时 135.6 秒；这是观察成本，不是速度或长程收益资格。完整 model、
+service CPU 与人工成本未测量。真实安装宿主的升级及回读仍未验证。I3 至少保留一个
+minor release。这些证据不关闭完整 R0/V10、M1/#8011、R1、context/model 或拆分安装，
+也不晋升 D2/D5/D6/D3。使用既有 self-repair lookup 中的
+`marked_todo_archive_pointer_reader_drift`，组合查询
+`quota_unexpected_collection_error non-generated content inside marked Todo region`。
+精简 Codex App 输出可能只有错误码；只读
+`loopx --format json quota status --goal-id <goal-id> --verbose` 提供详细症状。
+据此区分已交付修复和安装 reader 漂移；保留外来内容拒绝，不重写活跃状态。

skills/loopx-self-repair/references/repair-patterns.md

@@ -5,6 +5,7 @@ teaches a reusable control-plane lesson.
 
 | Pattern | Symptoms | Evidence To Read | Likely Root | Durable Repair |
 | --- | --- | --- | --- | --- |
+| `marked_todo_archive_pointer_reader_drift` | An installed `quota should-run` reports `quota_unexpected_collection_error`; read-only `loopx --format json quota status --goal-id <goal-id> --verbose` confirms `ValueError: non-generated content inside marked Todo region`, while current source reads succeed. Thin Codex App output may expose only the error code. | Use `python3 skills/loopx-self-repair/scripts/find_pattern.py --query 'quota_unexpected_collection_error non-generated content inside marked Todo region'`, then read this exact pattern. Inspect the launcher, Python/import route, component hashes, exact emitted line and installed `machine_region.py`; compare synthetic File/SQLite source/wheel fixtures. Keep verbose diagnostics and snapshots private. | The observed reader matching `8d314af49` rejects an emitted archive-summary comment without recognized Todo metadata. It already accepts the emitted per-Todo active-field omission row through valid `todo_id` metadata. Their shared `loopx:todo-archive-pointer` prefix does not establish the cause; attribute an omission-row failure only when the exact installed reader actually rejects that exact generated line. Version or declared commit alone cannot establish dirty installed bytes. | Verify projection ownership and compare archive-summary, per-Todo omission and foreign-narrative controls under the same interpreter and real backend; preserve foreign-content rejection, original-Turn recovery/replay, unchanged canonical work and zero quota debit. If main already includes the archive-summary reader repair, as in #7834, do not duplicate it, strip active metadata or relax the grammar. Qualify the affected source/wheel composition, then follow existing upgrade authority and original-binding readback. Source recovery alone does not qualify the installed runtime or prove long-horizon benefit. |
 | `outcome_review_same_batch_link_invalidation` | A successful review-plus-result refresh immediately reports its Agent review basis stale; an unchanged standalone review is then repeated. | Exact refinement and result-delivery receipts, original CAS revision, retained conclusions and canonical Todo links before/after; distinguish the authored effect from other new evidence. | Refinement hashes pre-link work, then post-writeback delivery adds a work-basis input. | Validate the complete intent and same-Goal ownership before determining relevance in the typed owner. Bind only the newly authored complete review whose outcome includes that work to the exact normalized same-batch additive link using the shared append rule and original CAS snapshot. Keep it stale until actual commit; a valid separate-work result leaves the reviewed outcome unchanged. Preserve independent verification, all retained requirements, separate/legacy reviews, initial CAS refusal, failed delivery, exact receipt replay and concurrent work/evidence invalidation through real File/SQLite CLI. Never exclude all evidence links, refresh old review digests against an arbitrary later head, reorder effects before primary admission or claim model/score benefit from this repair. |
 | `answer_question_replaced_by_delivery_status` | A user asks why a result occurred or whether it is expected, but receives measurements, tests or PR progress even though the reply was delivered completely. | The actual question and relevant corrections, current receiver brief, shared answer guidance, and the complete message on its original return route. | The author answered implementation progress instead of the causal question; successful transport or correct counters were mistaken for a useful answer. | Retain the correction in the existing Task and outcome, then repair the existing shared generation guidance: explain meaning, supported mechanism, expectations and the specific unknown before supporting data. Keep hypotheses separate from confirmed causes and preserve the qualified investigation owner. Verify guidance at native callers and read back the actual explanatory answer. Do not add keyword-based answer scoring, a second model rewrite, another display or a duplicate investigation; a prompt test or delivery receipt does not prove model compliance or user adoption. |
 | `queue_action_type_coercion` | A queued input action such as `["edit"]` is accepted but applies cancellation, or a stored operation accepts a non-string action. | Original JSON types, the typed planner and receipt decoder, real HTTP responses, canonical Turn/transcript/events/Session snapshots and native IO before/after refusal. | Membership checks stringify the action while effect selection and replay compare its original literal value. | Validate the original literal action at the existing owner before branching and when decoding pending or committed receipts. Cover arrays, nested arrays, objects, nulls, numbers, booleans and unknown strings; require rejection without state or native effects, then verify legal edit/cancel, original-operation replay and queue races. Preserve malformed historical evidence rather than coercing or rewriting receipts. |