@@ -3,7 +3,7 @@
 - Status: Accepted, transaction-payoff phase in progress
 - Proposed by: LoopX maintainers
 - Date: 2026-08-15
-- Last revised: 2026-08-22
+- Last revised: 2026-08-23
 - Scope: an incremental, replacement-first migration of the LoopX control-plane
   core from Python to TypeScript without maintaining two semantic
   implementations
@@ -158,6 +158,7 @@ choice is now implemented rather than hypothetical.
 | Todo, quota, and scheduler proof slices ([#3431](https://github.com/huangruiteng/loopx/pull/3431)–[#3434](https://github.com/huangruiteng/loopx/pull/3434)) | Completion fence/state, workspace causality, and scheduler transitions each have one TS rule owner | The cuts are mostly leaf-shaped; Python still composes several product transactions |
 | Scheduler durable state ([#3440](https://github.com/huangruiteng/loopx/pull/3440)) | State normalization, persistence, replay, and one coarse transition are TS-owned | The Python compatibility path still pays a cross-runtime transport tax |
 | Runtime decoders ([#3443](https://github.com/huangruiteng/loopx/pull/3443)) | Stable primitive decoding has one small shared module; domain decoders remain local | No larger schema framework is justified |
+| Transaction payoff ([#3464](https://github.com/huangruiteng/loopx/pull/3464), [#3481](https://github.com/huangruiteng/loopx/pull/3481), and Todo completion) | Turn settlement, quota delivery routing, and Todo completion each cross one coarse TS boundary; the Todo transaction owns identity, replay fencing, validation planning/result reduction, continuation/recovery, and completion metadata | Python still executes explicitly external providers and materializes legacy Markdown/event results; other domains still need their own bounded cutovers |
 
 These slices proved correctness, packaging, Windows lifecycle, crash recovery,
 real TS-owned writes, and acceptable warm primitive-call latency. They also
@@ -223,40 +224,46 @@ domains would now increase total complexity.
 ### Stage 2B — Complete transaction cutovers (active)
 
 Select by deletion leverage and runtime traffic, not by ease of translation.
-The first candidate is the complete Turn settlement/commit transaction because
-the current Python settlement surface composes several TS calls and retains
-duplicate settlement types. Subsequent candidates are complete Todo completion,
-quota spend/settlement, and scheduler heartbeat/state transactions, chosen only
-when each PR can retire an existing facade or materially shrink it.
+The shipped Turn settlement, quota delivery-routing, and Todo-completion
+cutovers establish the pattern. Subsequent candidates are quota
+spend/settlement and scheduler heartbeat/state transactions, chosen only when
+each PR can retire an existing facade or materially shrink it.
 
 For each completed transaction, replace migration-only characterization workers
 and Python implementation fixtures with native TS semantic/invariant tests plus
 one durable end-to-end adapter contract. Retain a characterization corpus only
 while an old authority remains executable or a versioned compatibility window
 requires differential proof; record its deletion trigger when introduced.
 
-Current implementation status: Stage 1 and the bounded Stage 2A proofs are
-shipped. The first Stage 2B cutover is the complete Turn settlement/commit
-transaction. TypeScript owns preflight authorization, ordered-prefix and replay
-validation, provider failure classification, receipt construction, terminal
-closeout joining, and the canonical result. Python is a mechanical adapter for
-the still-external writeback, spend, and terminal providers. New work therefore
-uses two coarse reductions and a completed replay uses one, replacing the prior
-multi-helper bridge. The remaining fine-grained settlement facade can be
-deleted after quota, host-adapter, and task-lease callers move to their own
-coarse transactions.
-
-Quota delivery routing is the next bounded payoff cutover. TypeScript now owns
-continuity-versus-fallback selection and the selected Todo's settlement boundary
-behind one request. Python still prepares the normal fallback candidate and
-projects the typed result into the legacy quota packet, but it no longer composes
-two leaf decisions. The in-flight path moves from two cross-runtime calls to one;
-no-anchor paths with a fallback candidate and preempted paths remain at one,
-while an empty no-anchor candidate set remains at zero through a projection-layer
-short circuit. The Python facade exits when the
-quota route and CLI caller move into the native TypeScript transaction. Vision
-checkpointing remains a separate refresh/writeback transaction because it does
-not share the delivery-selection lifecycle phase.
+Current implementation status: Stage 1, the bounded Stage 2A proofs, and three
+Stage 2B cutovers are shipped:
+
+- Turn settlement/commit: TypeScript owns preflight authorization,
+  ordered-prefix and replay validation, provider failure classification,
+  receipt construction, terminal closeout joining, and the canonical result.
+  A real Python provider uses two coarse reductions; completed replay uses one.
+- Quota delivery routing: TypeScript owns continuity-versus-fallback selection
+  and the selected Todo's settlement boundary. The in-flight path moved from
+  two cross-runtime calls to one; the empty candidate short circuit remains
+  zero.
+- Todo completion: TypeScript owns completion identity, terminal replay fence,
+  validation declaration/effect planning, validation-receipt reduction,
+  continuation/recovery, and completion metadata in one transaction. A Todo
+  without declared validation, including a replay, uses one reduction. A real
+  caller-approved validation command remains an explicit Python provider
+  between two reductions. A source snapshot is compared after the mutation
+  lock so a receipt for one declaration cannot authorize a changed Todo.
+  Materialized and event-projected writes consume the same typed result.
+
+The Todo cutover removes the Python state-evaluation dataclass, local identity
+projection, replay helper, and public runtime handlers for those implementation
+leaves. The remaining Python Todo facade owns transport, external command
+execution, source compare-and-swap, legacy response projection, and the actual
+Markdown/event write. It exits when those writers and the CLI move into the
+native TS transaction. The remaining fine-grained Turn facade exits after
+quota, host-adapter, and task-lease callers move to their own coarse
+transactions. Vision checkpointing remains a separate refresh/writeback
+transaction because it does not share the delivery-selection lifecycle phase.
 
 ### Stage 3 — CLI and App convergence
 
 
@@ -3,7 +3,7 @@
 - Status：Accepted，transaction-payoff 阶段进行中
 - Proposed by：LoopX maintainers
 - Date：2026-08-15
-- Last revised：2026-08-22
+- Last revised：2026-08-23
 - Scope：LoopX 控制面核心从 Python 到 TypeScript 的增量、replacement-first
   迁移；不长期维护两份语义实现
 - Tracking issue：[#3225](https://github.com/huangruiteng/loopx/issues/3225)
@@ -137,6 +137,7 @@ replay、receipt 与 settlement。这个架构选择已经落地，不再是假
 | Todo、quota 与 scheduler 证明切片（[#3431](https://github.com/huangruiteng/loopx/pull/3431)–[#3434](https://github.com/huangruiteng/loopx/pull/3434)） | Completion fence/state、workspace causality 与 scheduler transition 各有一个 TS rule owner | 切口大多仍是 leaf-shaped；Python 继续组合多个产品 transaction |
 | Scheduler durable state（[#3440](https://github.com/huangruiteng/loopx/pull/3440)） | State normalization、persistence、replay 与一笔粗粒度 transition 由 TS 拥有 | Python compatibility path 仍承担跨 runtime transport 税 |
 | Runtime decoder（[#3443](https://github.com/huangruiteng/loopx/pull/3443)） | 稳定 primitive decoding 进入一个很小的共享模块；domain decoder 仍留在本地 | 没有理由建设更大的 schema framework |
+| Transaction 兑现（[#3464](https://github.com/huangruiteng/loopx/pull/3464)、[#3481](https://github.com/huangruiteng/loopx/pull/3481) 与 Todo completion） | Turn settlement、quota delivery routing 与 Todo completion 均只跨一个粗粒度 TS boundary；Todo transaction 拥有 identity、replay fence、validation planning/result reduction、continuation/recovery 与 completion metadata | Python 仍执行显式 external provider，并物化 legacy Markdown/event result；其他 domain 仍需各自的 bounded cutover |
 
 这些切片已经证明 correctness、packaging、Windows lifecycle、crash recovery、真实
 TS-owned write 和可接受的 warm primitive-call latency。它们也暴露了迁移边界：
@@ -193,35 +194,41 @@ leaf pattern 会增加总复杂度。
 
 ### Stage 2B — 完整 transaction cutover（进行中）
 
-按删除杠杆与 runtime traffic 选切口，而不是按翻译难度选。首个候选是完整的 Turn
-settlement/commit transaction，因为当前 Python settlement surface 会组合多次 TS
-调用，并保留重复 settlement type。后续候选是完整 Todo completion、quota
-spend/settlement 与 scheduler heartbeat/state transaction；只有当每个 PR 能删除
-既有 facade，或使它物质变薄时才选择。
+按删除杠杆与 runtime traffic 选切口，而不是按翻译难度选。已经交付的 Turn
+settlement、quota delivery routing 与 Todo completion cutover 建立了这一模式。后续
+候选是 quota spend/settlement 与 scheduler heartbeat/state transaction；只有当每个
+PR 能删除既有 facade，或使它物质变薄时才选择。
 
 每完成一笔 transaction，就用 native TS semantic/invariant test 加一个持久的
 end-to-end adapter contract，替换 migration-only characterization worker 与 Python
 implementation fixture。只有旧 authority 仍可执行，或 versioned compatibility
 window 仍需 differential proof 时才保留 characterization corpus；引入时必须记录
 删除触发条件。
 
-当前实现状态：Stage 1 与 bounded Stage 2A proof 已交付。首个 Stage 2B cutover 是
-完整的 Turn settlement/commit transaction。TypeScript 拥有 preflight authorization、
-ordered-prefix 与 replay validation、provider failure classification、receipt
-construction、terminal closeout joining 和 canonical result。Python 只是仍属外部
-authority 的 writeback、spend 与 terminal provider 的机械 adapter。因此新工作使用
-两次 coarse reduction，完成态 replay 使用一次，替换此前的 multi-helper bridge。
-Quota、host-adapter 与 task-lease caller 迁到各自的 coarse transaction 后，即可删除
-剩余细粒度 settlement facade。
-
-Quota delivery routing 是下一笔 bounded payoff cutover。TypeScript 通过一次请求拥有
-continuity 与 fallback 的选择，以及 selected Todo 的 settlement boundary。Python 仍
-准备正常 fallback candidate，并把 typed result 投影成 legacy quota packet，但不再
-组合两条 leaf decision。In-flight 路径的跨 runtime 调用从两次降为一次；存在 fallback
-candidate 的无 anchor 路径与 preempted 路径保持一次，而 anchor 和 candidate 均为空时
-由 projection 层短路并保持零次调用。Quota route 与 CLI caller 进入 native TypeScript
-transaction 后，Python facade 即可退出。Vision checkpointing 属于不同的
-refresh/writeback 生命周期阶段，因此继续作为独立 transaction。
+当前实现状态：Stage 1、bounded Stage 2A proof 与三笔 Stage 2B cutover 已交付：
+
+- Turn settlement/commit：TypeScript 拥有 preflight authorization、ordered-prefix
+  与 replay validation、provider failure classification、receipt construction、
+  terminal closeout joining 和 canonical result。真实 Python provider 使用两次
+  coarse reduction；完成态 replay 使用一次。
+- Quota delivery routing：TypeScript 拥有 continuity 与 fallback 的选择，以及
+  selected Todo 的 settlement boundary。In-flight 路径从两次跨 runtime 调用降到
+  一次；空 candidate 的 short circuit 仍为零次。
+- Todo completion：TypeScript 在一笔 transaction 中拥有 completion identity、
+  terminal replay fence、validation declaration/effect planning、validation receipt
+  reduction、continuation/recovery 与 completion metadata。没有声明 validation 的
+  Todo（包括 replay）使用一次 reduction；真实 caller-approved validation command
+  作为显式 Python provider，位于两次 reduction 之间。取得 mutation lock 后会比较
+  source snapshot，确保一份 declaration 的 receipt 不能授权已经变化的 Todo。
+  Materialized 与 event-projected 写入消费同一 typed result。
+
+Todo cutover 删除了 Python state-evaluation dataclass、local identity projection、
+replay helper，以及这些 implementation leaf 的 public runtime handler。剩余 Python
+Todo facade 只拥有 transport、external command execution、source compare-and-swap、
+legacy response projection 与实际 Markdown/event write；当 writer 与 CLI 进入 native
+TS transaction 后即可退出。剩余细粒度 Turn facade 则在 quota、host-adapter 与
+task-lease caller 进入各自 coarse transaction 后退出。Vision checkpointing 属于
+不同的 refresh/writeback 生命周期阶段，因此继续作为独立 transaction。
 
 ### Stage 3 — CLI 与 App 汇合
 
 
@@ -41,6 +41,7 @@
     "scheduler/state_transition_rules.ts",
     "todos/completion_fence.ts",
     "todos/completion_state.ts",
+    "todos/completion_transaction.ts",
     "todos/completion_validation_plan.ts",
     "todos/next_action.ts",
     "turn_driver/turn_journal.ts",
 
@@ -44,16 +44,14 @@ import {
 import { commitTurnJournal } from "./turn_driver/turn_journal_effects.ts";
 import {
   evaluateTodoCompletionFence,
-  projectTodoCompletionIdentity,
 } from "./todos/completion_fence.ts";
 import {
   buildTodoCompletionMetadataUpdates,
   normalizeTodoCompletionValue,
   requireTodoCompletionMetadataValue,
   selectTodoCompletionContinuation,
-  selectTodoCompletionState,
 } from "./todos/completion_state.ts";
-import { evaluateTodoCompletionValidationPlan } from "./todos/completion_validation_plan.ts";
+import { reduceTodoCompletionTransaction } from "./todos/completion_transaction.ts";
 import { transitionTodoNextAction } from "./todos/next_action.ts";
 import { evaluateSchedulerStateTransition } from "./scheduler/state_transition_rules.ts";
 import {
@@ -260,9 +258,8 @@ export function createEffectRuntimeHandlers(
     ["todo.completion_state.normalize", normalizeTodoCompletionValue],
     ["todo.completion_state.require_metadata", requireTodoCompletionMetadataValue],
     ["todo.completion_state.continuation_for_write", selectTodoCompletionContinuation],
-    ["todo.completion_state.evaluate", selectTodoCompletionState],
     ["todo.completion_state.metadata_updates", buildTodoCompletionMetadataUpdates],
-    ["todo.completion_validation.plan", evaluateTodoCompletionValidationPlan],
+    ["todo.completion.reduce", reduceTodoCompletionTransaction],
     ["todo.next_action.transition", transitionTodoNextAction],
     ["scheduler.state_transition.evaluate", evaluateSchedulerStateTransition],
     ["scheduler.state.evaluate", evaluateSchedulerStateOperation],
@@ -392,7 +389,6 @@ export function createEffectRuntimeHandlers(
       ),
     ],
     ["turn.settlement.reduce", reduceTurnSettlementTransaction],
-    ["todo.completion_identity.project", projectTodoCompletionIdentity],
     ["work_item.replan_settlement.project", projectReplanSettlementContract],
     [
       "work_item.replan_settlement.reentry",
 
@@ -8,51 +8,6 @@
 
 TODO_COMPLETION_FENCE_REQUEST_SCHEMA = "loopx_todo_completion_fence_request_v0"
 TODO_COMPLETION_FENCE_RESULT_SCHEMA = "loopx_todo_completion_fence_result_v0"
-TODO_COMPLETION_IDENTITY_REQUEST_SCHEMA = "loopx_todo_completion_identity_request_v0"
-TODO_COMPLETION_IDENTITY_RESULT_SCHEMA = "loopx_todo_completion_identity_v0"
-
-
-def local_todo_completion_identity(*, goal_id: str, todo_id: str) -> str:
-    """Return the TS-owned stable identity for an unscoped completion."""
-
-    try:
-        result = effect_runtime_result(
-            "todo.completion_identity.project",
-            {
-                "schema_version": TODO_COMPLETION_IDENTITY_REQUEST_SCHEMA,
-                "goal_id": goal_id,
-                "todo_id": todo_id,
-            },
-        )
-    except EffectRuntimeRejected as exc:
-        raise ValueError(str(exc)) from None
-    if not (
-        isinstance(result, Mapping)
-        and result.get("schema_version") == TODO_COMPLETION_IDENTITY_RESULT_SCHEMA
-        and result.get("identity_source") == "unscoped_completion"
-        and isinstance(result.get("completion_identity_key"), str)
-        and str(result["completion_identity_key"]).startswith("local_completion_")
-    ):
-        raise RuntimeError("TypeScript Todo completion identity result shape mismatch")
-    return str(result["completion_identity_key"])
-
-
-def resolve_todo_completion_identity(
-    *,
-    todo: Mapping[str, Any],
-    goal_id: str,
-    todo_id: str,
-    completion_turn_key: str | None,
-    completion_identity_source: str | None,
-) -> tuple[str | None, str | None]:
-    """Bind an unscoped open completion to its stable local identity."""
-
-    if completion_turn_key is not None or str(todo.get("status") or "") == "done":
-        return completion_turn_key, completion_identity_source
-    return (
-        local_todo_completion_identity(goal_id=goal_id, todo_id=todo_id),
-        "unscoped_completion",
-    )
 
 
 def _json_successor_value(value: Any) -> Any:
@@ -121,64 +76,3 @@ def evaluate_todo_completion_fence(
     ):
         raise RuntimeError("TypeScript Todo completion fence result shape mismatch")
     return dict(result)
-
-
-def completed_todo_replay(
-    *,
-    todo: Mapping[str, Any],
-    goal_id: str,
-    todo_id: str,
-    completion_turn_key: str | None,
-    completion_identity_source: str | None,
-    no_followup: bool,
-    handoff_mode: str,
-    mutation_authority: dict[str, Any],
-    state_file: str,
-    project: str | None,
-    dry_run: bool,
-) -> dict[str, Any] | None:
-    """Project a typed TS replay decision into the legacy Python response.
-
-    ``handoff_mode`` is the currently resolved goal mode, not a persisted copy
-    of the original completion result. This local replay therefore is not a
-    durable operation receipt and must not be presented as Stage 2 proof.
-    Original effect markers such as a lease fence or handoff-gate override are
-    intentionally absent because this branch performs neither effect. A
-    same-turn request may return ``None`` only to append the missing terminal
-    no-follow-up state; it cannot replace a successor or cross a turn fence.
-    """
-
-    # This fast path runs before the caller selects the event writer. Treat it
-    # as a materialized projection; an event-only deferred Todo falls through
-    # and is evaluated with ``projection_source=event_log`` by that writer.
-    fence = evaluate_todo_completion_fence(
-        todo=todo,
-        projection_source="materialized",
-        completion_turn_key=completion_turn_key,
-        no_followup=no_followup,
-        goal_id=goal_id,
-        todo_id=todo_id,
-        completion_identity_source=completion_identity_source,
-    )
-
-    # Event-projected deferred rows must pass through the event writer so the
-    # existing lease-fence receipt remains visible. Done rows preserve the
-    # earlier fast replay path for both projection sources.
-    if fence.get("outcome") != "replay" or fence.get("status") != "done":
-        return None
-    return {
-        "ok": True,
-        "dry_run": dry_run,
-        "completed": True,
-        "idempotent_replay": True,
-        "changed": False,
-        "goal_id": goal_id,
-        "todo_id": todo_id,
-        "status": "done",
-        "completion_continuation": fence.get("completion_continuation"),
-        "completion_recovery": todo.get("completion_recovery"),
-        "handoff_mode": handoff_mode,
-        "mutation_authority": mutation_authority,
-        "state_file": state_file,
-        "project": project,
-    }