docs: design router-coordinated controller and worker units

docs/architecture/rfcs/README.md

@@ -192,12 +192,13 @@ Paired diffs do not certify translation accuracy.
     settlement, and typed Effect Program foundations are shipped. Replan
     planning/ACK stays domain-local until a second real lifecycle justifies
     extraction.
-- [Controller / Executor Sessions and One Governed Work Contract v0](controller-executor-unified-contract-v0.md)
+- [Router–Controller–Worker Architecture and One Governed Work Contract v0](controller-executor-unified-contract-v0.md)
   ([中文版](controller-executor-unified-contract-v0.zh-CN.md))
   - **Delivery on `main`:** Design only; no unified schema or dual-session profile is implemented.
   - **Current boundary:** Replaces permanent quota/Turn packet views with one
-    contract including differential context; controller-only model access to
-    Core, natural-language executor work and runtime-owned identity/recovery.
+    contract including differential context; a steward router coordinates Agent
+    units, each binding a controller and worker with asynchronous interaction.
+    Existing Core/request/session owners retain authority, identity and recovery.
     C1–C9 connect concrete refactors, real host adoption and complete-cost
     qualification without changing defaults or launching experiments.
 - [TypeScript Control-Plane Migration v0](typescript-control-plane-migration-v0.md)

docs/architecture/rfcs/loopx-overall-roadmap-v0.md

@@ -187,8 +187,8 @@ format choices. Its [two-layer delivery design](controller-executor-unified-cont
 targets cross-host Progressive by default, independent Delta auto only on
 qualified hosts, and unread-material discovery from the current complete capture;
 explicit off and versioned migration remain protected. The optional
-controller model alone talks to Core; the executor receives natural-language
-work and materials, while existing host/Core owners retain identity, permissions,
+controller model owns its unit’s model-facing Core work control and settlement;
+the executor receives natural-language work and materials, while existing host/Core owners retain identity, permissions,
 recovery and settlement. Session roles, execution modes, wake sources and
 benchmark arms remain separate axes. This is design direction, not shipped
 behavior or evidence of lower cost.
@@ -253,6 +253,27 @@ records already-shared code and distinct lifecycles that must not be merged by
 appearance. Packages are claimable slices, not a fixed PR count or new controller
 prerequisites; runtime delivery and qualification remain open.
 
+The [Router–Controller–Worker extension](controller-executor-unified-contract-v0.md#router-controller-worker)
+makes the steward a cross-Agent router while each controller + worker retains one
+Agent binding unit. A long worker operation must not block controller input from
+the user/router; existing Core, request, session, queue and return owners retain
+authority. Authorized router request operations cannot settle unit work or copy
+budgets. [Attention and safe preemption](controller-executor-unified-contract-v0.md#controller-attention-and-preemption)
+prioritize current user interaction, then ready [controller–worker main-loop work](controller-executor-unified-contract-v0.md#controller-worker-main-loop),
+including ordinary result assessment and feedback, not only blocked-worker help.
+Without another user message, useful admitted work continues through original
+settlement and fresh admission; input handling returns to that loop rather than
+automatically resuming a report. Background reports yield while original-effect
+recovery and one control writer remain intact. The [current source audit](controller-executor-unified-contract-v0.md#current-delivery-audit)
+separates shared managed operations, multi-recipient requests and revisions from
+the missing role pair and asynchronous journey. The [delivery slices](controller-executor-unified-contract-v0.md#delivery-path-from-current-state)
+reuse C1–C9: one autonomous unit loop → busy-time interaction/correction/Stop → router adoption
+of two units → outcome/cost qualification and retirement. These are selected-profile
+dependencies, not fixed global priority or additional router merge gates on C1.
+Existing correctness repairs and simplification with real callers can land
+independently; no new scheduler, message bus or task store. Full schema cutover and
+dual sessions remain undelivered, with unchanged defaults.
+
 ### Current priorities after research and acceptance integration
 
 This checkpoint is pinned to main `5550e91bab` (2026-10-23). It reconciles
@@ -524,7 +545,6 @@ authority and privacy checks; optimize repeated reads only with equivalent
 positive, negative, retry, and stale-generation outcomes. A fast sink no-op
 is not evidence that long-history status and quota admission meet G4 SLOs.
 
-
 ## 4. Every RFC: Ownership and Next Step
 
 This maps the primary RFC inventory through the date in the header, counting
@@ -1007,7 +1027,6 @@ configuration tests qualify this slice. Existing installed settings and immutabl
 old failures are retained; installed activation and effect-aware recovery of an
 original timed-out request remain separate acceptance, not inferred replay.
 
-
 **Bound-conversation status presentation.** The shared display renderer leads
 with canonical execution/recovery state, project and queue/permission facts;
 the Lark adapter reserves full commands and diagnostics for help, retaining a
@@ -1361,7 +1380,7 @@ bytes under shared locks; Python retains filesystem transport. Regular retained
 lease history remains witnessed without granting a live lease. This closes a
 bounded source-inventory gap; complete cold-source import, original-operation
 recovery, packaged App adoption and the reversible developer trial remain on
-the [existing migration/release path](../../reference/local-authority-provider-selection.md#proposed-compatibility-cutoff-and-release-sequence).
+the [existing migration/release path](../../reference/local-authority-provider-selection.md#20-compatibility-cutoff-and-release-sequence).
 
 审核源准入拒绝不支持的租约 JSON 文件名、非普通文件和链接子目录，不再静默漏读
 或跟随链接。既有 TS coordination owner 在共享锁内核对原始字节；Python 保留

docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md

@@ -143,8 +143,8 @@ assessment 中有证据绑定的研究综合分析接入指标 → 汇报 → 
 S2/S4/S6/S7/S11：用一份受治理工作 schema 替代 quota/Turn packet 格式选择。
 [双层交付设计](controller-executor-unified-contract-v0.zh-CN.md#差分上下文)以跨 Host 默认
 Progressive、仅已资格化 Host 独立 Delta auto，以及当前完整 capture 的未读发现为目标；
-保留显式 off 与分版本迁移。可选 controller 模型独自对接 Core，executor 接收自然语言工作
-和材料；身份、权限、恢复、结算仍归既有 host/Core owner。Session role、执行模式、
+保留显式 off 与分版本迁移。可选 controller 模型负责该单元的 Core 工作控制与结算；
+executor 接收自然语言工作和材料；身份、权限、恢复、结算仍归既有 host/Core owner。Session role、执行模式、
 唤醒来源和 benchmark 评估组保持正交。这是设计方向，不是已交付行为或成本收益证据。
 
 Controller 会话的[智能中介作用](controller-executor-unified-contract-v0.zh-CN.md#controller-的智能与语义压缩)
@@ -192,6 +192,23 @@ worker/settlement adapter 和有条件的旧路径退役。从全局成果与实
 因外形相似就合并的不同生命周期。工作包是可认领切片，不是固定 PR 数量或 controller
 新前置条件；runtime 交付与资格仍未完成。
 
+[Router—Controller—Worker 扩展](controller-executor-unified-contract-v0.zh-CN.md#router-controller-worker)
+将管家定位为跨 Agent router，每个 controller + worker 沿用一个 Agent 绑定单元。
+Worker 长操作不能阻塞 controller 处理用户/router 输入；既有 Core、请求、会话、
+队列与返回 owner 保留 authority。Router 可用授权请求操作，不能替单元结算或复制预算。
+[注意力与安全插队](controller-executor-unified-contract-v0.zh-CN.md#controller-attention-and-preemption)
+优先当前用户交互，再处理已就绪的 [controller—worker 主循环工作](controller-executor-unified-contract-v0.zh-CN.md#controller-worker-main-loop)，
+包括普通结果评估与反馈，不只阻塞求助。没有用户新消息时，有用的已准入工作仍经原结算与
+新准入持续推进；处理完输入返回这个循环，不默认恢复汇报。后台汇报可让出，原 effect
+对账与单一控制写入方仍保留。
+[当前源码核对](controller-executor-unified-contract-v0.zh-CN.md#current-delivery-audit)区分
+已共享 managed-operation、多接收方与 revision 机制，以及仍缺的双角色绑定/异步旅程。
+[依赖与交付切片](controller-executor-unified-contract-v0.zh-CN.md#delivery-path-from-current-state)
+复用 C1–C9：一个自主单元循环 → 忙时交互/纠偏/Stop → 两单元 router 采用 → 成果/成本与退役。
+这是所选 profile 的依赖，不是全局固定优先级，也不向在途 C1 追加 router 合入门。
+现有正确性修复与有真实 caller 的精简可独立推进；不新建 scheduler、消息总线或任务库。
+完整 schema cutover 与双会话尚未交付，默认仍不变。
+
 ### 研究与验收集成后的当前优先级
 
 本检查点固定在 main `5550e91bab`（2026-10-23），核对公共源码交付，不公布私有实验
@@ -393,7 +410,6 @@ Muse 设计页在浏览器超时，其文章通过网页检索读取。本次调
 
 不预先发明未经测量的性能数字。每个实验/试点开始前，由对应 owner 固定目标阈值、基线、预算、停止条件与证据范围；结果出炉后改变阈值应作为新实验。G4 correctness 要求无重复受保护效果和过期/越权提交，性能/成本阈值另行测量资格化。
 
-
 ## 4. 全部 RFC 的落位与下一步
 
 下表覆盖 header 日期所示的主 RFC inventory，中英镜像合并计数。架构状态仍使用
@@ -748,7 +764,6 @@ Goal 成果页可打开正文；原管家对话仅在已确认团队计划的回
 保留安装态既有设置及不可变旧失败；实际启用与核对效果后的原超时请求恢复
 仍是独立验收，不据此推断已重放。
 
-
 **S1/S5 注意力 checkpoint。** 本地管家/Goal Turn 无须 Lark 连接，即收到 canonical
 阻塞与具体用户请求。共用 TS 读模型合成同一 Todo 的阻塞/决策；正文 adapter 和
 阻塞收集服务本地与外部投递。这闭合 Turn preparation 的证据缺口；已有外发使用
@@ -758,7 +773,6 @@ Goal 成果页可打开正文；原管家对话仅在已确认团队计划的回
 独立授权的 sink 投递。宣称自动智能通知前，在原打包对话验收无 Channel 的阻塞、
 安全回退、用户决定与恢复旅程。
 
-
 - **Owner：** 管家 RFC M2/M3；从已有 `manager_context` request/tracking/return 迁移到单一 typed collaboration 事务，纳入 #4094 adapter。
 - **交付：** 交接保存目的、决策、约束、证据引用和期望回报；receiver 读取后自行 adopt/defer/reject/replan。用独立事实表示 accepted work、result committed、answer delivered；从已有 outbox 自动回传。
 - **退出：** manager→worker 和 worker→worker 两个真实 caller，补充消息、来源会话消失、超长答案、重复回调、发送成功但 ACK 丢失及传输重启；同一结果在 CLI、packaged frontend、Lark 回读一致且受众隔离。普通已授权工作不增加第二次人工确认。