docs(storage): preserve recovery before the canonical writer cutoff

[loopx-agent]

The proposed 2.0 canonical-writer cutoff must still let an old Goal release its original lease before import. The current legacy fence also guards release and recovery, while the Python adapter bypasses its TypeScript check when the fence file is absent. A blanket denial would block migration; changing only the TS check would leave an admission bypass.

Clarify the existing R5/T4 release contract in English and Chinese: reject fresh work, preserve exact original lease/fence settlement and receipt replay, reconcile bounded outbox work, then import. Name the team-plan receipt ordering and the shared format/registry recovery callers that the implementation must cover. Define the combined cold-source → original settlement → import → new write → old-operation replay acceptance on File/SQLite and the affected packaged entrypoints.

Validation: the existing expired-active import refusal, wrong owner/key/version release rejection, and original release retry tests passed (3 tests); git diff --check and the two-file public boundary check passed. These characterize current components, not the future combined cutoff. No runtime or installed behavior changes; full runtime/packaged qualification belongs to the implementation package. Existing failed/missing capacity qualification remains unchanged.

Future-facing boundary: reuse the current typed transaction owners and remove the Python admission shortcut together with the cutoff. This PR specifies the prerequisite recovery boundary; it neither adds a new setting nor splits individual legacy fallbacks into implementation PRs.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=xhigh

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

准备把已有 Goal 迁入统一存储、随后停止旧写入入口的维护者。 直接拒绝所有旧操作会连原租约释放一起阻止，冷导入仍因过期未释放租约而失败；只修改 TypeScript 准入又会留下 Python 缺少 fence 文件即返回的旁路。 文档现在明确先拒绝新工作、保留原身份释放和回执恢复、对账再导入，并要求新写入后重放旧操作仍保留新数据；维护者能据此判断截止包是否完整。 本次仅澄清现有 2.0 交付验收，不改变运行时或安装行为，不宣布完整截止、SQLite 默认晋升、容量、PG 或自然长期试用已经合格。 组合截止旅程、正常 wheel/受影响 App/Lark、退役 writer 物理缺席与全 release/capacity 资格仍待原实现包验证。

改动思路

把新工作准入与原操作恢复放回现有 typed transaction owner，Python 只传决定；不以文件缺失开旁路，也不为了导入删除原租约。 两份既有双语合同中的有界前置说明；完整运行时与打包迁移链仍由原 R5/T4 实现包交付。 这是在现有发布合同中说明一个会影响迁移可行性的先后顺序：新工作不能继续走旧写入，但旧操作必须能先收尾。正常写入准入、原身份恢复、provider IO 和显示读取各有现存 owner，不以整层 helper 替换或删除历史记录来简化规则。

具体改动

完整 ed5eb974eae1ebd012b953c167949903b0142c14，冻结依据 60d833b13c85135587b725013b247e827663ffb9，全部两份文档 +66/-0。规范依据改动前 docs/architecture/rfcs/typescript-control-plane-migration-v0.md 的 R5/T4 及已链接 docs/reference/local-authority-provider-selection.md 的 proposed compatibility cutoff；原“fresh refusal＋original recovery＋旧 writer 缺席”的交付要求保留。本次文档澄清 implemented；整个运行时/安装/发布验收 deferred 到既有实现包，未新增 gate 或任务。

关键内容讲解

• R5/T4 checkpoint 新增五行，明确原租约释放与回执/outbox 恢复先于导入，同时移除 Python 缺失 fence 的捷径，不能只修改 TS。
• 原 release contract 将操作分为新工作、原租约/fence 关闭、原业务回执、prepared/committed shadow 和显式导入/格式/备份/display 恢复。新 grant、renewal、transfer 拒绝；原恢复保持 owner/key/version/generation/lock token，错误证明仍拒绝。
• 组合准出从冷源、过期未释放租约和中断操作开始，经原释放/对账/导入后再写新工作；重启重放旧操作保留新写入。File/SQLite、错误证明、变更 intent、坏历史、provider 不可用、正常 wheel 和受影响 App/Lark 都属于未来实现资格，组件通过不能代替。
• 中英段落保留相同顺序、边界及未交付声明。明确 preview 与 confirmation 一致，未迁移走审核导入，已选 provider 缺失先恢复 provider，不自动创建 store 或打开配置。

对主干的风险

我独立检查当前 Python shared fence 的缺失文件早退及 TS lease lifecycle 的共同 fence 调用，冷导入仍拒绝过期 active 原租约。五项真实 File/SQLite 冷源租约案例和三项目标 TS release 案例通过：错误 owner/key/version 不写，过期原释放可重放，响应失败后的原释放只留一次 tombstone。最初 name-filter runner 的额外文件汇总不冒充冷导入案例；对应冷导入由完整参数化 Python 五项另证。

native premerge 3 direct、18 selected 全通过，两文档公开边界通过；初始 format 参数位置错误作为 setup 失败保留并纠正。没有查询或等待 CI。本 PR 没有运行时更改、optional activation、状态闭集或预算调整；新的文字是明确实现义务，没有称作建议。它保留原组件权限，没有授予新的 lease holder 或回执身份使用权。

future-facing pass 留在原 typed owner：实现截止时一起消除 Python shortcut、移动 team-plan 原结果恢复顺序并保留 format/registry 等实际 callers，不再按每个 fallback 拆实现包。完整 canonical cutoff、正常 wheel/App/Lark 合成链、capacity/PG 与自然试用仍未验证；文档没有把当前组件绿灯当这些阶段完成。

我的整体评价

APPROVE，属于 justified_increment。long_horizon 和 user_experience 在设计边界 improved：维护者可用一条可复核的原操作收尾→导入→新工作→旧重放旅程判断截止包，而不会按表面 writer 删除误判成功；本轮没有认证实际运行时改善。把新工作准入与原操作恢复放回现有 typed transaction owner，Python 只传决定；不以文件缺失开旁路，也不为了导入删除原租约。 两份既有双语合同中的有界前置说明；完整运行时与打包迁移链仍由原 R5/T4 实现包交付。 保留既有验收、恢复身份、未知和未验边界，范围与成本相称，无需新增 setting、协议 owner 或仪式性 successor。

English verdict: APPROVE — ed5eb97. This bilingual R5/T4 clarification preserves original lease/receipt recovery before import while specifying fresh-work refusal and removal of the Python missing-fence bypass. Five cold-lease and three targeted release cases characterize current components; the combined 2.0 runtime, normal-wheel and packaged journey remains pending.