refactor(quota): resolve fallback advice from one typed snapshot

[cocolord]

Summary

Preserve @cocolord's fix for optional fallback advice disappearing behind compact Todo lanes, and refine the existing contributor branch against current main. This remains PR #4061; original contributor commits are retained.

The live quota path now reads one complete Todo source snapshot, selects at most eight declared targets/successors plus eight direct resume dependencies, and delegates disposition to TypeScript. It no longer repeats the complete source query for each Todo. Archived prerequisites survive; no declarations means no extra source read.

Architecture and RFC contribution

• fallback_source.py owns the Python snapshot IO and transport codec, and reuses the existing canonical provider reader after promotion and the existing legacy parser before promotion. Unavailable authority never falls back to Markdown.
• fallback_disposition.ts composes the existing resume evaluator, resume planner, and resumeConditionHasKnownPendingTarget. Python retains input codecs and public presentation, not its own Monitor-wait and declaration-aggregation rules.
• Target classification and condition evaluation consume the same selected source rows. Bounded selection does not recursively follow dependency chains.
• Both RFCs record this as one T3 consumer closure, not T1/T2 completion, storage qualification, a provider-default change, or promotion approval. Permanent Markdown projection and D1–D3 holds remain.

Placement: existing goal-frontier read policy and Todo resume owner; no new capability, extension, provider, CLI option, persisted declaration, or permission surface.

Intentional semantic corrections

1. Resolve each declaration symmetrically: one runnable, validly waiting, or bounded create/reopen alternative discharges its own advisory, irrespective of the other candidate's order, absence, or uncertainty.
2. Uncertainty from a resolved declaration cannot leak into the aggregate. Resolving one declaration never clears another.
3. Reuse positive pending-target evidence, including generation and PR repository binding. An unbound PR wait, archived fallback itself, contradictory done flag, invalid Monitor completion wait, other-agent claim, or exclusion cannot suppress advice. Archived completed prerequisites remain usable; an increased Monitor generation remains satisfied even if the Monitor subsequently completes.
4. Missing display is not missing state. Only a complete source can prove absence; unavailable/ambiguous source remains uncertain.

These are disclosed corrections, not a claim of universal zero behavior change. fallback_gaps stays advisory, separate from acceptance-gap obligations; it does not grant execution, settlement, ownership, capability activation, or user-decision authority. Canonical work discovery does not require extra fallback declarations.

Scope and validation

Current head: db367de7b, integrated with main@b27c4c729. Original contributor and refinement commits are retained. The refresh adds explicit nested TypeScript package data, uses main's lazy runtime dispatcher, preserves current quota/replay arguments and resume timestamps, and extends installed-package qualification.

• 62 focused fallback Python tests and 37 adjacent frontier/resume tests passed.
• 14 TypeScript fallback contract tests passed.
• Wheel build and all six isolated installed-package qualification stages passed, including resource presence, real fallback dispatch and authority transactions outside the checkout.
• Ruff, diff whitespace and added-line public/private scans passed.

The duplicate-identity CLI regression now expects main's earlier canonical succession rejection, before a frontier exists. Source selection still independently tests ambiguity and fail-closed uncertainty. The prior full-kernel/canary evidence belongs to an older revision; it is not claimed for this refresh. Hosted checks and maintainer re-review remain required for the new head.

This guarantees coherence for fallback alternatives and their direct dependencies, not an atomic snapshot across the entire quota/status packet. The future-facing pass retains the existing typed owner, shared resume codecs and lazy dispatcher without introducing a new abstraction. No live Goal, model API, benchmark or external delivery was changed by validation; all runtime fixtures were disposable.

Review

Ready for a fresh exact-head review after the updated checks; the old-head approval is not inherited. No merge or installation is requested by this update.

Current-main reconciliation

The current source-bound resume evaluator, PR observation planner and guard timestamp are retained. Repository binding alone does not establish a pending PR; matching observed merge evidence or the existing causal Todo/Monitor conditions are required by the current owner.

The Python adapter is consolidated in existing fallback_source.py; the internal Python decision-named module is retired and public package exports retained. TypeScript remains the disposition decision owner. The 43-twin budget is unchanged and the new registry read is registered/classified in the 292-site IO census.

Validation: 70 affected Python tests and 28 fallback/resume TypeScript tests pass; types, focused Ruff checks, registry IO and complete semantic drift pass. Initial stale wait expectation, twin-budget failure and relocation/import-fixture errors were kept while repairing the owning code and active call sites. No active Goal state, PostgreSQL authority, installed package, real Host, paid model or benchmark job was changed or qualified by this reconciliation. Prior installed installer-prose qualification and exact-head CI/review/merge gates remain separate.

[cocolord]

@huangruiteng Please review this follow-up to the closed #4049. It resolves fallback declarations from exact canonical Todo rows instead of bounded display slices, while preserving the existing eligibility and TypeScript resume-condition authorities.

Validation is complete: all GitHub checks passed; focused local suites passed (221 tests), Ruff and mypy passed, the control-plane TypeScript typecheck passed, and loopx canary premerge --from-git-diff --goal-id loopx-product passed 17/17 selected checks with no manual holds.

[huangruiteng]

Reviewed exact head: 8e0476d5b3146eaec179b2c7aea934e11e8e8d66.

动机

这个 PR 修复的缺陷真实存在：fallback_declarations 已经声明了关联 Todo，但旧 advisory 从有展示上限的 Todo summary 读取“是否存在/是否等待”；无关 deferred Todo 增多后，合法 fallback 会被截掉并误报 vision_fallback_unresolved。缺失项、权限读取失败和真实不存在必须区分，不能继续把 bounded presentation 当完整数据库。

从不合并的角度重新审视后，exact-id canonical read 是正确方向，但当前实现还有两个阻塞点：它把“最多四条声明”扩展成了无上限的同步依赖遍历；同时没有与已批准的 #4059 causal-wait owner 整合，仍在同一边界维护另一套 parser/source seam。绿色测试证明了原回归被修，不足以证明 quota 热路径现在有界、也不足以证明两个并行 PR 合并后的唯一 owner。

改动思路

live quota 先从最新 Vision 提取每条声明的 target/successor exact id，再通过 todo list 的 canonical authority 逐个读取 Todo；对 todo_done / monitor_changed 又读取依赖项。frontier adapter 复用现有 ownership、exclusion、task-class、lifecycle 和 TypeScript resume-condition evaluator，将结果分成 runnable、valid waiting、uncertain 或 absent。读取失败投影 vision_fallback_lookup_uncertain，不再伪造 absence；这个方向与 source-completeness 原则一致。

但 direct resume evaluator 只需要声明 Todo 和它的一层 target 状态/代数。当前 while pending_ids 会检查每个依赖 Todo 自己的 resume_when，继续加入依赖的依赖，形成与声明数无关的传递闭包。另一个集成问题是 #4059 已把 todo_delta parsing 和完整 Vision/Todo causal wait read model 收敛到共享 owner；本 PR 与它基于同一个 base 开发，尚未 rebase，三方合并在 frontier、fallback、quota prepare 和测试发生冲突。

具体改动

exact-head diff 为 8 个文件、+665/-16。六个生产文件新增 canonical fallback Todo read、source authority 参数、resume 求值和 uncertainty gap；两个测试文件覆盖真实 CLI 在 0/8/20 个无关 deferred Todo 下的稳定性，以及 absence、authority failure、todo_done、monitor_changed、ownership、exclusion 和 monitor task-class。

关键代码讲解

1. live_decision.py:40-55 只从 typed declarations 提取 target/successor Todo id，不再把 declaration_id 冒充 Todo id，这一修正是合理的。
2. live_decision.py:83-118 用 list_goal_todos(todo_id=...) 读取 canonical state，但循环同时追踪每个新读取 Todo 的 resume_when，因此一条声明可以触发任意长度的调用链。
3. fallback_disposition.py:221-287 复用既有 typed eligibility 与 TypeScript resume evaluator；authority unavailable 进入 uncertainty，exact not-found 才进入 unresolved，避免 bounded slice 的假阴性。
4. fallback_disposition.py:24-103 仍自己定义 VISION_FRONTIER_TODO_DELTA_ACTIONS 和 parser；#4059 已在共享 goal_vision_read_model.py 中抽取同一知识，继续保留会在相邻 read models 中产生第二 owner。

对主干的风险

[P1] canonical lookup 在 quota 热路径上不是有界读取。 我固定同一个 fallback declaration，只让其 Todo 的 resume_when=todo_done:... 形成不同长度的合法合成链。链深 0/4/64/512 时，_live_fallback_authority_items() 分别调用 list_goal_todos 1/5/65/513 次。TypeScript evaluator只读取声明 Todo 的直接 todo_done status 或 monitor_changed generation，后续依赖不会参与本次 disposition；递归遍历既无语义需要，也违背 PR 所称的 bounded exact lookup。长链或损坏状态会让每次 quota should-run 产生线性同步 authority I/O。请只读取最多 8 个声明 target/successor id 及其直接 resume target，并为读取数量加显式上限/回归；超过、歧义或读取失败都投影 uncertainty，不要继续递归。

[P1] 先与 #4059 的共享 causal-wait owner 整合，再判断 compatibility advisory 还需要多少独立代码。 #4059 已批准 exact head 3a6c5ca9555f057c27259baf4432ccd970aa9ec2，把 todo_delta parser、canonical Vision read model 和 wait coverage 放入同一 goal frontier 边界；本 PR 当前重新定义 parser/constants，并新增 fallback_todo_source_items 并行来源。两条分支三方合并已在 fallback_disposition.py、goal_frontier/__init__.py、should_run_prepare.py 和测试产生冲突。请 rebase 到 #4059/其落地主干，复用共享 read model，只保留无法由 causal state 推导的 fallback compatibility lookup；不要通过手工选择一边而丢掉 #4059 的完整性与 lineage 规则。rebase 后整个 exact head 必须重新跑 capacity/order、incomplete-source、completed/superseded/archived reference 和真实 CLI counterfactual，不能继承本次结论。

独立验证：30 个 focused Python tests 通过；changed-path Ruff 和 git diff --check 通过；远端 DCO、dependency、Python/Windows、Pages/release build、Sonar 均成功或预期 skip。本地 detached checkout 未安装 Node/pg 依赖，因此没有把共享环境里无法解析 pg 的 typecheck 当成新的产品失败；远端该检查为绿色。主干已前进且当前 PR 为 BEHIND，这本身不是独立 blocker，但与 #4059 整合后需要新 exact-head evidence。

我的整体评价

REQUEST_CHANGES。 原容量回归的方向和大部分 typed-state 处理是对的，测试也有长期价值；当前不能批准的原因是 quota 热路径存在已复现的无界 authority read，以及它尚未与同边界的已批准 causal-wait refactor 收敛。最小修复是“声明 exact ids + 一层 direct dependencies + 完整性/不确定性”，然后 rebase 复用 #4059 的 parser/read model，而不是继续扩展传递遍历或并行 source contract。

future-facing pass：应在本 PR 内完成上述 bounded read 与 owner 收敛；不需要新 capability、provider 或通用依赖图框架。

English verdict: REQUEST_CHANGES on exact head 8e0476d5b3146eaec179b2c7aea934e11e8e8d66. The capacity fix is directionally sound, but one declaration can trigger an unbounded transitive chain of synchronous canonical Todo reads (1/5/65/513 reads at depths 0/4/64/512), although disposition needs only direct resume targets. Rebase onto approved PR #4059's shared causal-wait/read-model owner, remove duplicate parsing/source seams, bound exact reads to declared ids plus direct dependencies, and rerun the full real-CLI/state-lifecycle evidence on the new head.

[cocolord]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewed head: acd302cedafe2b9c12d624ae0b92371f78cb92ff. Includes #4059 at 0c619324870f2f4ce9e9a550b6bc0228722d5095 and current main 54681bccd5e5780dc03390488c5afcf217daf692.

动机

这条可以继续，但范围仅是已有 fallback 提示的准确性。#4059 修复核心等待决策后，真实 CLI 在增加 8 个无关等待项时仍错误出现 fallback_gaps；它不应被描述成另一套必需的规划机制。

改动思路

已处理上轮两项要求：去掉递归依赖遍历；直接复用 #4059 的 Vision read model 与 todo_delta parser。声明目标和 successor 最多 8 个，仅再查它们的一层直接 resume 依赖，总计最多 16 次读取。更深的链由现有 Todo 状态表达，不在 quota 入口重新遍历。

具体改动

_live_fallback_authority_items 使用两轮、去重、稳定排序的精确读取；错 ID 或读取失败返回未知。_authoritative_fallback_disposition_ids 复用 TS resume evaluator、ownership/exclusion/task-class/lifecycle 谓词。declared_fallback_gap_from_agent_vision 区分缺失与 lookup uncertain；quota 参数传递和 semantic writeback 明确传入完整来源，并删掉了多余的 authority 布尔标志。协议文档与两组聚焦测试解释和验证这一边界。

正向路径：被裁剪的已声明合法等待仍无 gap；0/4/64/512 层链均只读该目标和直接前置任务。负向路径：真正缺失保留 unresolved，读失败或返回错 ID 保留 uncertain，其他 Agent、excluded、非法 monitor 等仍使用原有规则。没有声明时新增精确读取为 0。#4059 的完整 causal coverage、projection、TS handler、文档及生命周期测试已一并复核。

对主干的风险

176 项 Python 回归和 18 项标准 premerge 全部通过，含真实 CLI、文件 authority、真实 TS evaluator 与公共边界检查。共享 TS reducer 与已通过 6 项 TS 测试及 typecheck 的 #4059 相同。fallback 仍是 advisory，不进入 acceptance replan 义务；完整来源不可获得时允许显示“不确定”。未运行真实 Goal、benchmark 或 PostgreSQL 集成，存储后端实现未修改。

我的整体评价

保留这条修复有价值，但优先级低于 #4059。相对 #4059 是 10 文件 +752/-16；当前 PR 页面包含依赖，因此应先合 #4059，再刷新 main 和本 PR 的最终差异。相关精简已经落地：单一 parser、单一 resume 规则、一次性有界来源、无额外 authority 标志，不再扩建依赖图框架。已推回原分支，仍待维护者重新评审；本次没有执行合并。

English verdict: APPROVE conclusion for acd302cedafe2b9c12d624ae0b92371f78cb92ff. Both requested changes are addressed: direct-dependency reads are bounded, and #4059 owns shared Vision parsing. 176 Python tests and 18 premerge checks pass. This fixes optional advisory accuracy and depends on #4059; merge that PR first and refresh the final diff. Author-owned review, pending maintainer re-review.

[cocolord]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewed exact head: 5f00200f554871eb5dae8a6d26e470efa5039c36; base 5008a30f2adf04e5fcf0d459d6deabfaf06a7ccd.

动机

这个 PR 修复的是可选 fallback advisory 的准确性：Vision 已结构化声明 target/successor Todo，但 compact status lane 会裁剪展示项，旧逻辑可能把“未展示”误判成“canonical Todo 不存在”，从而错误投影 vision_fallback_unresolved。这不改变 #4059 已收敛的 causal wait / acceptance 主决策，也不新建 replan 义务；目标只是让兼容性提示从完整权威来源判断存在性、等待状态和失败不确定性。相较于扩张 status 展示容量或重建依赖图，exact-id 读取是更小且与问题成因匹配的修复。

改动思路

live quota 从最新 agent Vision 的 typed fallback_declarations 提取最多 8 个 target/successor id，第一轮逐 id 读取 canonical Todo；仅当声明 Todo 的 resume_when 是 todo_done 或 monitor_changed 时，再读取一层直接依赖，因此上限为 16 次。读到的有限权威集合交给 goal-frontier fallback disposition，继续复用既有 ownership、exclusion、advancement task class、lifecycle 与 TypeScript resume evaluator。正向路径中，compact lane 即使裁掉合法 fallback，canonical target 和直接前置仍能证明它 runnable 或 validly waiting，不再产生 gap；负向路径中，真正缺失仍是 unresolved，读取异常或返回 Todo id 不匹配则 fail closed 为 vision_fallback_lookup_uncertain，不会把未知伪装成不存在。

具体改动

exact-head 相对当前 main 是 10 个文件、+752/-16。live_decision.py 负责有界 authority 读取；fallback_disposition.py 负责 advisory 分类；goal_frontier/__init__.py、should_run.py、should_run_prepare.py 与公共 quota.py 仅透传独立 fallback source 和 capability；semantic_replan_writeback.py 在已有完整 Todo source 的路径复用同一输入；协议文档明确 16 次上限与 advisory 权限边界。两组测试覆盖真实 CLI 容量、深链、读取失败、错 ID、ownership/exclusion、monitor wait、terminal disposition 和无声明零读取。

关键代码讲解

1. _fallback_authority_todo_ids 只从共享 goal_vision_read_model 解析后的 typed declarations 收集 target/successor，不把 prose 或 declaration id 当 Todo id。
2. _live_fallback_authority_items 使用固定两轮读取：第一轮声明 Todo，第二轮直接 resume dependency；深度 0/4/64/512 的 fixture 都只读取 fallback 与其直接 prerequisite，消除了旧 head 的传递闭包。读取异常、非法对象或 identity mismatch 统一返回不可用来源。
3. _authoritative_fallback_disposition_ids 用现有 Todo predicates 和 evaluate_todo_resume_conditions 区分 runnable、valid waiting、uncertain；peer claim、当前 agent exclusion、非 advancement monitor、非法状态继续按既有 typed owner 判定。
4. declared_fallback_gap_from_agent_vision 将 authoritative absence 投影为 vision_fallback_unresolved，将 source 不可用或 provider evidence 缺失投影为 vision_fallback_lookup_uncertain；fallback_gaps 保持独立 advisory，不进入 acceptance replan stream。
5. quota / frontier 的参数透传把实时 exact source 与普通 planning source 分开，避免 compact presentation lane 获得它没有的 completeness authority；writeback 已有完整 source 时直接复用，不增加 I/O。

对主干的风险

主要风险在 quota 热路径额外同步读取和 incomplete-source 语义。读取量现在由 typed declaration 上限与一层依赖共同封顶为 16，且没有声明时为 0；它不会随无关 deferred Todo 数量或依赖链深度增长。发生 authority failure、identity mismatch 或 capability evidence 缺失时结果保守为 uncertain，不会错误解除或制造执行权限。该 advisory 不授予 quota、ownership、gate、replan 或 lifecycle authority；核心 obligation 仍由既有 typed control-plane owner 决定。

独立验证覆盖 exact head：59 个相关 Python tests 通过；control-plane TypeScript typecheck、changed-path Ruff、git diff --check、公共/私有边界扫描通过；loopx canary premerge --from-git-diff --goal-id loopx-product 为 18/18 通过、0 manual hold。远端 DCO、dependency review、Frontstage/release build、Python shards、stage2c installed/e2e/mutants、Windows、pytest、Sonar 与 merge-gate 均成功或预期 skip。聚焦 mypy 会触发仓库既有全量基线（917 errors / 126 files），因此未把它误报为本 PR 新失败；未运行真实 Goal、benchmark 或生产存储集成，且本 PR 未修改这些边界。

我的整体评价

APPROVE conclusion（author-owned COMMENTED fallback）。旧 review 的两个阻塞项均已在 exact head 解决：canonical read 不再递归遍历，Vision parsing/read model 由已合并的 #4059 单一 owner 提供；分支也已刷新到当前 main，独立 diff 仍严格为 10 个文件。实现范围与问题影响相称，正负路径、默认无声明路径和权限边界都有回归。future-facing pass 已在当前 PR 内完成 owner 收敛与 typed boundary 复用，无需再引入 capability、provider、依赖图框架或额外兼容层。剩余动作只是由非作者维护者在新 head 上重新评审；本结论不执行合并。

English verdict: APPROVE conclusion for exact head 5f00200f554871eb5dae8a6d26e470efa5039c36 (published as COMMENTED because this is author-owned). Both prior blockers are resolved: canonical reads are bounded to declared IDs plus direct dependencies, and merged PR #4059 owns shared Vision parsing/read-model semantics. The branch is refreshed to current main; 59 focused Python tests, control-plane typecheck, 18/18 premerge canaries, boundary checks, and remote CI pass. No merge was performed; maintainer re-review is requested.

[cocolord]

@huangruiteng PR #4059 is now merged, and #4061 has been refreshed to current main at exact head 5f00200f554871eb5dae8a6d26e470efa5039c36.

Both blockers from the earlier review are addressed: canonical fallback lookup is bounded to declared IDs plus one layer of direct dependencies (max 16 reads), and the shared Vision parser/read model is owned by the merged #4059 implementation. The independent diff remains 10 files, +752/-16; focused validation, 18/18 premerge canaries, and remote CI are green.

I could not add a formal review request because the author account lacks RequestReviewsByLogin permission, so this comment is the explicit re-review request for the new exact head. The full bilingual exact-head review is here: #4061 (review)

[cocolord]

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

Reviewed exact head: 5f00200f554871eb5dae8a6d26e470efa5039c36; integration baseline: 5008a30f2adf04e5fcf0d459d6deabfaf06a7ccd.

动机

原问题真实存在：compact Todo lane 裁剪了仍存在且合法等待的 fallback，旧提示把“没有展示”误判为“没有可用路径”。独立真实 CLI 对照确认，加入 20 个无关 deferred Todo 后，baseline 错报 vision_fallback_unresolved，本 head 消除了该误报。扩大展示容量不能解决完整性问题；从既有 Todo authority 读取声明 id 是合理的修复边界。

但重新审查整个 PR 后，当前仍不能批准：新的分类把“resume 条件尚未满足”直接当作“合法等待”，漏掉了现有规则对 todo_done:<continuous_monitor> 的排除，反而隐藏了这类无效 fallback。

改动思路

quota should-run 从最新 agent Vision 读取既有 typed declarations，经 list_goal_todos 获取最多 8 个 target/successor 及一层直接依赖，再交给 goal-frontier advisory 分类。Todo 存储、ownership/exclusion 谓词和 TS resume evaluator 仍由既有模块负责；只新增读取和派生提示，没有新增持久状态、CLI opt-in 或执行权限。

相对上轮 reviewed head 8e0476d5b3146eaec179b2c7aea934e11e8e8d66，两个原 P1 已处理：依赖遍历改为固定两轮；Vision parser/constants 复用已合并 #4059 的 goal_vision_read_model。本轮重跑深度 0/4/64/512 的真实 CLI 测试，均只读取声明目标与直接 prerequisite；无声明测试为零次新增读取。这些修复不应被撤回。

具体改动

完整独立 diff 是 10 个文件、+752/-16：7 个生产文件 +282/-14，2 个测试文件 +462/-2，1 个协议文档 +8。新测试保护容量、深链、缺失、读取失败、错 id、ownership/exclusion、monitor generation 与 terminal disposition；文档声明读取上限以及 advisory 不产生 replan 义务。

关键代码讲解

1. live_decision.py::_live_fallback_authority_items（约 60–122 行）在真实 quota 入口读取 exact ids；固定两轮及 parser 的四条声明上限共同限制调用数量。读取异常和 identity mismatch 返回 unavailable，交由提示层投影 uncertain。尚有一个 P2：list_goal_todos 对重复 id 返回 ambiguous=true, matched=true, todo_count=2, todo=null，105–107 行却把它与 not-found 一样跳过，最后产生 unresolved。独立 CLI 合成的 user/agent 重复 id 已复现；应先检查 ambiguity，再区分 not_found，不要把 authority 歧义称作确定缺失。
2. fallback_disposition.py::_authoritative_fallback_disposition_ids（约 187–269 行）复用 task class、claim/exclusion 和 TS resume evaluation，但第 260–263 行只根据 satisfied 分类。TS todo_done evaluation 只表达目标是否 done，不证明目标可作为合法等待对象；这是下述阻塞的根因。
3. declared_fallback_gap_from_agent_vision（约 272–425 行）在 blocked primary、有声明且非 terminal 时计算 gap；无完整来源时保留 uncertain，已创建/重开的 successor 与显式 terminal disposition 沿用既有规则。错误进入 waiting_ids 的 fallback 会在这里被消除，用户无法看到未解决提示。
4. goal_frontier/__init__.py 传入独立 fallback source、run evidence 与 capabilities，保持 fallback_gaps 独立于 acceptance/replan。公共 quota.py、内部 should_run.py 和 should_run_prepare.py 仅透传输入；semantic_replan_writeback.py 复用已有完整 source，无新增 authority I/O。未发现这些透传改变 quota、ownership 或写回权限。

对主干的风险

[P1] 保留对 todo_done:<continuous_monitor> 的等待资格排除。 位置：fallback_disposition.py:260–263。

触发场景：主线任务合法等待普通 prerequisite；另一个声明的 fallback 是 deferred advancement Todo，resume_when=todo_done:todo_monitor；todo_monitor 是持续运行的 continuous_monitor。没有 create/reopen successor，也没有 terminal disposition。

同一合成 fixture、同一真实 quota should-run --verbose 入口，baseline 保留 vision_fallback_unresolved，本 head 删除了整个 fallback_gaps。两边 should_run 都是 false。新代码把 evaluator 的 satisfied=false 当成合法 waiting；旧 todo_summary_blocked_successor_items 明确排除 monitor target，TS planTodoExternalWait 也明确拒绝以 todo_done 等待 continuous monitor，要求使用 generation-fenced monitor_changed。这不是无关的严格化建议，而是现有等待资格的回归：一个通常不会完成的 monitor 可以让不可用 fallback 长期静默。

最小修复：在现有等待资格 owner 中保留这条规则并供 fallback 分类复用，不再以 satisfied=false 单独证明 valid waiting；合法 monitor_changed 仍按 generation/baseline 判断。补真实 CLI 反例：上述输入必须保留 unresolved，而普通 Todo prerequisite 和合法 monitor_changed 等待仍不产生假 gap。不要扩展依赖图或增加第二套 prose/state authority。

独立验证：59 个相关 Python tests、13 个 Todo resume/Vision coverage TS tests、control-plane typecheck、仓库支持版本的 isolated changed-path Ruff、git diff --check 均通过。额外 baseline/head CLI 对照验证了容量修复、无声明默认路径、旧 monitor 规则回归与 ambiguous-id 分类；普通小容量及无声明场景的已比较 decision/obligation/frontier 输出一致。缺失 todo_done dependency 的等待行为在 baseline 已存在，未算作本 PR 新缺陷。最初未固定版本/配置的 Ruff 读到了额外规则；使用仓库支持版本与独立默认配置复核后通过。

这些都是合成隔离 fixture，未操作真实 Goal 或 benchmark；未独立运行 PostgreSQL 集成或全套 premerge canary，本 PR 未修改存储实现。远端 CI 已回读，无失败或待运行项。当前已复现的语义回归足以阻止批准，不以绿色测试覆盖掉它。

我的整体评价

REQUEST_CHANGES。 原两个阻塞已修复，整体边界与规模可以成立，但最新 head 仍有一个已复现的等待资格回归，另有一个 authority ambiguity 的 P2。影响限于 fallback advisory，未证明存在执行权限绕过；仍需修复，因为提示准确性就是这个 PR 的交付目标。

future-facing pass：共享 parser 的收敛已完成；当前最有价值的小范围改进是复用等待资格规则，避免 pending 与合法 waiting 在两个消费者中分叉。修复后重跑真实 CLI 正反路径、容量/深链、无声明默认路径，并基于新 exact head 重新评审。本次不合并。

English verdict: REQUEST_CHANGES on exact head 5f00200f554871eb5dae8a6d26e470efa5039c36. The previous unbounded-read and duplicate-parser blockers are resolved, but a real CLI baseline/head counterexample shows that the new classifier accepts todo_done:<continuous_monitor> as a valid wait and suppresses the unresolved fallback advisory. Preserve the existing wait-eligibility rule and add the counterexample; also distinguish ambiguous canonical ids from not-found (P2). 59 Python tests, 13 TS tests, control-plane typecheck, supported-version isolated Ruff, and diff checks pass. This is an advisory regression, not an observed execution-authority bypass.

[cocolord]

The findings in the latest review are addressed in b27a7a000b8b98d164a81c708172a4a3634a6d10:

• Wait eligibility: fallback classification now reuses the existing non-monitor wait predicate. Pending todo_done:<continuous_monitor> retains vision_fallback_unresolved; valid monitor_changed generation waits still work. The shared predicate extraction preserves the existing ordinary successor selection behavior.
• Canonical ambiguity: ambiguous IDs, identity mismatches and failed reads remain uncertain. Failed authority reads are now distinguished from legacy callers that omitted a source, preventing compact display evidence from masking a known failure. Only explicit canonical not-found proves absence.

Validation on this head: 115 Python tests, 13 TS tests, control-plane typecheck, isolated supported-version Ruff, and 18/18 standard premerge checks pass, with no manual holds or boundary findings. Four new monitor/ambiguity counterexamples failed before the fix; all eight paired monitor/ambiguity cases pass afterward. Coverage also includes small/compacted lanes, depth 0/4/64/512, no-declaration zero reads, failure/identity mismatch, legacy positive evidence, and the existing monitor repair route. Real CLI baseline comparisons confirm ordinary/no-declaration behavior and restoration of the rejected monitor-wait advisory.

The branch is refreshed to main 04ff4204d1abb133d97dc7353d31242bb032eb97; the PR remains based on main. Remote CI for this exact head has completed: 16 successful checks and 3 expected skips, including a successful merge-gate. PostgreSQL integration was not run because the storage implementation is unchanged; validation used isolated synthetic state and the real CLI/TS runtime. No live Goal or benchmark was operated.

The two reported defects are fixed in this head. This is an implementation and validation update; maintainer re-review is still required. No merge was performed.

[cocolord]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Exact head reviewed: b27a7a000b8b98d164a81c708172a4a3634a6d10

动机

这个 PR 解决的是 Vision 声明 fallback 后，quota / goal-frontier 只能从有界展示摘要判断 Todo 是否存在、可运行或正在合法等待的问题。旧路径把“没有出现在展示 lane”近似成“canonical Todo 不存在”，既可能制造假的 vision_fallback_unresolved，也可能把普通 todo_done:<continuous_monitor> 错认成合法等待；同时，ambiguous id、authority 读取失败和明确 not-found 没有形成不同的 typed 结果。受影响的是 heartbeat 的 quota should-run、semantic replan writeback 和 goal-frontier projection：错误分类可能隐藏真正未解决的 fallback，或把 authority 不确定性投影成需要用户处理的 gate。

本 head 的目标边界是合理的：只为 Vision 已声明的 target/successor 做 exact canonical read，并只追一层 resume dependency；没有扩大成全量 Todo 扫描，也没有引入新的 scheduler、Todo lifecycle 或用户权限模型。

改动思路

入口仍是 live quota decision。_fallback_authority_todo_ids() 从当前 agent Vision 提取声明过的 Todo id，_live_fallback_authority_items() 通过现有 list_goal_todos() authority 边界逐项读取这些 id，并为 todo_done / monitor_changed 只补一层直接依赖。四条 declaration 最多包含八个 target/successor，再加八个直接依赖，因此 exact read 上限为 16；无声明时为零读取。

读取结果经 FallbackTodoSource 贯穿 build_live_quota_should_run_decision()、build_quota_should_run()、prepare 与 semantic replan writeback，最终由 declared_fallback_gap_from_agent_vision() 分类。明确 not-found 可以作为缺失证据；ambiguous id、identity mismatch、remote/local authority 异常或非标准响应统一映射为 FallbackTodoReadState.UNAVAILABLE，投影为 lookup uncertainty，而不是伪装成不存在。

正向路径：Vision 声明 fallback → exact read canonical Todo 与一层依赖 → 复用现有 ownership、task class、open/deferred、resume evaluator 规则 → runnable 或合法 waiting 时不产生 unresolved gap。负向路径：authority 无法给出唯一且身份匹配的 Todo → fail closed 为 uncertain gap，并建议重读完整 canonical source，不制造 user gate。普通 todo_done:<continuous_monitor> 不再被当作 waiting；合法的 monitor_changed:<id> generation-fenced wait 仍保留。

具体改动

• fallback_disposition.py 引入 FallbackTodoReadState.UNAVAILABLE 与 FallbackTodoSource，区分 legacy caller 的“未提供 source”和 live authority 的“读取失败”；新增 authoritative disposition 分类，复用现有 Todo ownership/actionability/task-class predicates 与 TS resume evaluator，并分别输出 unresolved 与 lookup-uncertain reason/action。
• live_decision.py 新增声明 id 提取和有界 exact-read 实现。只读取 declaration 的 target/successor 与一层直接 resume dependency；明确 not_found 才按缺失继续，ambiguous、异常、类型或 Todo identity 不匹配都返回 UNAVAILABLE。
• deferred_resume.py 抽取 todo_resume_condition_is_non_monitor_wait()，让普通 blocked successor 与 fallback 分类共享同一个规则：standing continuous monitor 不能作为 todo_done prerequisite，monitor generation wait 由 typed resume evaluator 单独验证。
• should_run.py、should_run_prepare.py、quota.py、semantic_replan_writeback.py 和 goal-frontier export 只负责 typed source 的参数贯穿，没有复制第二套状态机。
• 协议文档补充 exact read 的 16 次上限、ambiguous/unavailable uncertainty 以及 monitor wait 边界。
• 两组 Python 回归覆盖真实 CLI 的容量上限、深链不递归、无声明零读取、明确 not-found、authority failure、错误 identity、duplicate/ambiguous id、open/deferred fallback、monitor completion 与 generation wait。

关键代码讲解

1. _live_fallback_authority_items() 是 I/O 边界：第一轮读声明 Todo，第二轮只读第一轮暴露的直接依赖；循环次数固定，避免递归链与全库扫描。
2. FallbackTodoReadState.UNAVAILABLE 是关键 typed state：它保留“authority 没有可靠回答”的事实，防止 compact summary 或空列表覆盖不确定性。
3. _authoritative_fallback_disposition_ids() 是语义分类边界：runnable、validly waiting、uncertain 三类分开，并继续由现有 predicate / evaluator 决定 ownership、lifecycle 和 resume 合法性。
4. todo_resume_condition_is_non_monitor_wait() 消除了 fallback 与 ordinary successor 对 monitor completion 的规则漂移；monitor_changed 仍走 generation-fenced typed 路径。
5. declared_fallback_gap_from_agent_vision() 只在 authoritative source 确认后输出 unresolved；source omitted/failed 或 provider evidence 缺失时输出 uncertainty。

对主干的风险

主要风险在 quota 热路径新增最多 16 次 exact Todo read，以及 Python projection 对 TS resume semantics 的调用。该机制与问题规模相称：读取集合由最多四条 Vision declaration 严格派生，没有全量 list、二层依赖或隐藏重试；无 declaration 时保持零读取。异常路径 fail closed，不会把 authority 故障降级成“Todo 不存在”，也不会新增生产动作、权限或用户 gate。

我独立验证了 exact head：108 个相关 Python tests 通过；23 个 Todo resume / Vision TypeScript tests 通过；control-plane TypeScript typecheck 通过；changed-path Ruff 通过；premerge canary 18/18 通过（含 quota、scheduler、interaction、maintainability 与 public boundary）；git diff --check、DCO 和新增行私有信息扫描通过。远端 CI 为 16 个成功检查和 3 个预期 skip，无 pending/failed。

剩余风险不是本 head 的逻辑 blocker：复核期间 main 已前进 2 个提交，PR 当前为 BEHIND。合并前应更新到最新 main，并以更新后的新 head 重跑检查；本结论只绑定上述 exact head，不自动延伸到未来 merge/rebase head。

我的整体评价

APPROVE（以 COMMENTED review 记录，因为这是 author-owned PR，GitHub 不允许正式 self-approval）。

此前两个 blocker 已在该 exact head 被完整修复：todo_done:<continuous_monitor> 不再隐藏 unresolved fallback；ambiguous canonical id 不再被当成 not-found。实现把 authority uncertainty、合法 waiting 与真实缺失做成显式 typed 分支，复用了既有 Todo/TS owner，没有靠 substring 或产品特定文案建立新规则。改动虽然包含较多回归覆盖，但生产机制保持有界、可解释且可回滚；未发现新的 P0/P1/P2 finding。

---

English verdict — APPROVE (recorded as COMMENTED because this is an author-owned PR). Reviewed exact head b27a7a000b8b98d164a81c708172a4a3634a6d10. The previous monitor-wait and ambiguous-id blockers are fixed: ordinary todo_done waits cannot use a standing monitor, valid monitor_changed waits remain generation-fenced, and ambiguous/unavailable authority reads project typed uncertainty rather than false absence. Validation passed: 108 focused Python tests, 23 focused TypeScript tests, control-plane typecheck, Ruff, 18/18 premerge canaries, diff/DCO/public-boundary checks, and all non-skipped remote CI. No remaining blocker found on this exact head. The PR is now two commits behind main; update the base and rerun checks before merge.

[huangruiteng]

Reviewed exact head: b27a7a000b8b98d164a81c708172a4a3634a6d10.

动机

这个 PR 的原问题真实且值得修：Agent Vision 已 typed 声明 fallback，但旧 goal-frontier 只从有容量上限的 Todo 展示摘要判断目标是否存在、可运行或合法等待；无关 deferred Todo 增多后，canonical state 中真实存在的 fallback 会被裁掉并误报 vision_fallback_unresolved。展示容量不能成为完整性 authority，最小正确边界是只 exact-read 声明的 target/successor 与 resume evaluator 所需的一层直接依赖。

相对早期 review，当前 head 已处理无界传递读取、重复 Vision parser、todo_done:<continuous_monitor> 等待资格和 ambiguous-id 被误当 not-found 等问题；但整个 exact head 重新审查后仍有一个真实 lifecycle 反例：monitor_changed 的 target 已 done 且 generation 未越过 baseline 时，fallback 仍被当成“合法等待”，从 projection 中静默消失。

改动思路

live quota 从最新 Agent Vision 的 shared read model 取得最多四条 declaration，_live_fallback_authority_items() 对最多八个 target/successor 做 canonical lookup，再只读最多八个直接 todo_done/monitor_changed dependency。明确 not-found 可以证明缺失；异常、ambiguous、identity mismatch 或非标准 projection 返回 typed UNAVAILABLE。结果经 quota/prepare/semantic writeback 参数传入 goal frontier；fallback reducer 复用既有 task class、ownership/exclusion、lifecycle predicates 与 TypeScript resume evaluator，输出 runnable、waiting、uncertain 或 unresolved。这个 source/owner 划分与 16-read bound 是合理的，且没有新增执行、quota、gate 或 replan 权限。

正向 real-CLI 对照也成立：同一 canonical fallback 加 20 个无关 deferred Todos，base 错报 unresolved，本 head 不再受 display compaction 影响；open continuous monitor、baseline=3、generation=3 的合法 monitor_changed wait 也从 base 的 unresolved 修正为 no gap。

具体改动

完整 diff 为 11 个文件、+892/-27：8 个生产文件 +333/-25，2 个测试文件 +548/-2，协议文档 +11。

关键代码讲解

1. live_decision.py::_live_fallback_authority_items 用固定两轮 stable exact read：第一轮 declaration ids，第二轮仅第一轮 Todo 的直接 resume target。更深 dependency chain 不参与本次 disposition；无 declaration 时为零读取。
2. fallback_disposition.py::FallbackTodoReadState.UNAVAILABLE 保留“authority 没有可靠回答”的事实；legacy caller 的 omitted source 仍可使用 compact positive evidence，但不能把遗漏升级为 absence。
3. fallback_disposition.py::_authoritative_fallback_disposition_ids 是当前 finding 所在的语义边界。它正确复用 TS evaluation 和 ownership/lifecycle predicates，但 275-279 行对 condition.kind == "monitor_changed" 只要求 satisfied=false 且没有 invalid_state，没有检查 target_status 是否仍为 open。
4. resume_condition.ts::conditionFor 会把 done continuous monitor 投影为 target_status=done, satisfied=false；external-wait authoring 的同一 owner 则明确要求 monitor_changed target 必须是 open continuous monitor。Python shortcut 因此扩大了“可继续等待”的语义。
5. quota、goal-frontier 和 semantic writeback 的其余参数贯穿没有复制第二套 parser/state machine；协议文档也正确声明 fallback_gaps 只是 advisory。

对主干的风险

[P1] 已结束且 generation 未变化的 monitor 不能继续证明 fallback 合法等待。 触发状态是：fallback 为 open/deferred advancement Todo，resume_when=monitor_changed:todo_monitor，resume_monitor_generation=3；dependency 为 task_class=continuous_monitor,status=done,material_change_generation=3。真实 file-backed CLI + canonical Todo lookup + real TS runtime/evaluator 对照显示：base 保留 vision_fallback_unresolved，本 head 的 fallback_gaps 为空；两边 should_run=false。这不是执行权限绕过，但会让一个已经不可能产生下一 generation 的 fallback 无限静默，直接违背本 PR “只有合法等待才能消除 gap”的交付目标。

现有 47 个 changed Python tests 全绿仍没覆盖它：名为 monitor-completion-is-invalid 的 case 实际测试的是 todo_done 指向一个 open monitor，而不是 monitor_changed 指向一个 completed monitor。最小修复是：对 satisfied=false 的 monitor_changed 同时要求 target status=open、task class=continuous_monitor、baseline 有效；最好由 shared TS resume owner 投影 waitable/invalid lifecycle，Python 只消费 typed result。若 generation 已经大于 baseline 后 monitor 才完成，应保留 satisfied/runnable 语义并补对应回归。

独立验证：两组 changed Python tests 47/47、typed resume TS tests 7/7、control-plane typecheck、changed-path Ruff、git diff --check 通过；远端 16 success、3 expected skip，无 pending/failed。baseline/head harness 同时证明 capacity/open-monitor 修复和上述 done-monitor 回归。未运行 PostgreSQL 集成，因为本 PR 没改 storage implementation/transaction/migration；fixture 使用隔离文件 authority，没有操作真实 Goal。

我的整体评价

REQUEST_CHANGES。 之前的 unbounded read、owner duplication、monitor-completion authoring 和 ambiguity blockers 已实质解决，整体机制也与原问题相称；但最新 head 在相邻的 monitor lifecycle 分支仍有可复现的语义漂移，不能用绿测或 earlier approval 继承覆盖。future-facing pass 应只把“pending monitor waitability”收敛到 shared typed resume owner，不要再新增 Python prose rule、dependency graph、source flag 或 capability。修复并更新 main 后，请用同一 real-CLI 正反 paired cases 对新 exact head 复审。

English verdict: REQUEST_CHANGES on exact head b27a7a000b8b98d164a81c708172a4a3634a6d10. The bounded canonical lookup, shared Vision owner, ordinary monitor-completion rule, and ambiguity handling are fixed. However, a real CLI/base-head counterexample shows that an unsatisfied monitor_changed fallback is still accepted as waiting after its continuous monitor is already done at the unchanged generation, suppressing vision_fallback_unresolved indefinitely. Require an open monitor for the pending state (while preserving an already-satisfied generation fence) and add the completed-monitor pair through the real CLI/TS boundary. 47 focused Python tests, 7 TS tests, typecheck, Ruff, diff checks, and remote CI pass, but the existing tests do not cover this lifecycle state.

[cocolord]

Exact-head repair and re-review

Reviewed and repaired head: 661c4e67a8ef2c39b906c984f4a0215e2bdfe6f6.

The PR remains useful: it preserves typed fallback waiting and authoritative-lookup uncertainty instead of treating every non-runnable fallback as absent. The prior review found one real P1 in that otherwise-valid direction: an unchanged monitor_changed condition was accepted as a durable pending wait even after its target continuous-monitor Todo was already done, so vision_fallback_unresolved could be suppressed forever.

The repair keeps resume evaluation in the existing TypeScript-owned boundary and narrows only the Python fallback disposition:

• satisfied=true remains runnable, including when a generation increase and monitor completion are observed together;
• satisfied=false monitor_changed is now a valid pending fallback only when the typed target is still an open continuous_monitor;
• an unchanged generation against a completed monitor now projects vision_fallback_unresolved instead of pretending that future progress is still possible.

Paired regression cases cover both the fail-closed completed-monitor path and the already-satisfied generation path, in addition to the existing valid-open-monitor and missing-baseline cases.

Validation on this exact head:

• 57 focused Python tests passed across fallback disposition, fallback wait admission, and external wait lifecycle;
• 7 TypeScript todo_resume_condition tests passed;
• Ruff and git diff --check passed;
• loopx canary premerge --from-git-diff --goal-id loopx-product passed all 18 selected checks, with zero failures, warnings, or manual holds;
• public/private boundary check passed.

Future-facing scope review: no new state machine or duplicate authority was added. The small related improvement was to make fallback admission consume the typed evaluator's existing target_status and target_task_class fields, which keeps the change local and reversible.

Conclusion: the PR still has a valid, distinct purpose and should remain open. The identified P1 is fixed at this exact head; please re-review the updated commit.

[cocolord]

Latest-main rebase/merge readback

Updated exact head: 345644dc662c5a6d900ddac0b8a8aa997fe8343c. The branch now contains current origin/main (dbacd1e55ae61884a7fb9910df3f2ecc5e5e541a); GitHub's previous merge conflict is resolved.

The conflict resolution follows the newer control-plane ownership boundary: current main deleted the legacy deferred_resume.py policy owner and moved resume planning to resume_planning.ts. This branch does not restore that deleted module. Fallback disposition now feeds evaluated resume facts through project_todo_resume_planning, while the completed-monitor rule remains narrowly enforced for monitor_changed.

Post-merge validation:

• 72 focused Python tests passed, covering fallback disposition, fallback wait admission, TypeScript-backed resume planning projection, and external-wait lifecycle;
• 15 TypeScript tests passed across todo_resume_condition and resume_planning;
• Ruff and git diff --check passed;
• public/private boundary check passed;
• the premerge runner selected 18 checks. Sixteen passed consistently. bounded-context-namespace-smoke.py and catalog-run-e2e-smoke.py each failed inside repeated aggregate runs but passed immediately when executed directly with the same Python 3.13 environment; an earlier aggregate run instead had only hot-path-interface-budget-smoke.py fail under system Python 3.9, and that smoke passed with Python 3.13. These are disclosed as environment/runner instability rather than claimed as a clean aggregate gate. No manual holds were reported.

The semantic blocker remains fixed and the branch is now based on latest main. Please use this exact head for the next review/check run.

[cocolord]

Latest-main necessity check

Exact head: fbfd499c61a4138d05f17eca1d803018838b9433. Baseline: current origin/main 87958a0f1ff2b4eccef750f11ff12df3187689b4.

I rechecked whether current main had made this PR obsolete. It has not: main still lacks canonical fallback lookup, typed lookup-uncertainty projection, and the completed-monitor fallback regression. git cherry reports all four behavior commits as independent of main. The only new main commit since the previous sync is #4223's settings UI work, which does not overlap this control-plane change.

The branch now contains that latest main commit without conflicts. The PR diff remains the same 10 control-plane/docs/test files (+927/-19); no settings UI file appears in the PR diff.

Post-sync validation:

• 72 focused Python tests passed;
• 15 TypeScript resume-condition/resume-planning tests passed;
• Ruff and git diff --check passed;
• branch worktree is clean.

Conclusion: continue this PR. Its bounded canonical read and fail-closed completed-monitor semantics are still absent from main, and the latest-main update did not require expanding scope. Please review this exact head.

[cocolord]

Recheck after main advanced through #4238

Exact head: 4d2d5a77aece5042c6e720166abe659d120f2c8b. Baseline: current origin/main 49cee5b30fef9f5bacddb548dc37809d7aa71be3.

Main advanced again while this PR was being checked, this time through #4238 in overlapping Vision/fallback files. I compared semantics rather than assuming overlap meant duplication. #4238 expands the bounded evidence-rich Vision packet and its checkpoint tests; it does not add canonical fallback Todo reads, vision_fallback_lookup_uncertain, or completed-monitor fallback admission. git cherry still reports all four PR behavior commits as independent of main, and the PR diff remains 10 files (+927/-19).

The new main commit merged cleanly. Post-merge validation expanded to include the new Vision budget/checkpoint coverage:

• 74 focused Python tests passed;
• 32 TypeScript tests passed across resume-condition, resume-planning, and Vision checkpoint;
• Ruff and git diff --check passed;
• worktree is clean.

Conclusion remains: continue #4061. The overlap with #4238 is at the same integration surface but implements a different invariant; closing #4061 would still leave bounded canonical fallback lookup and the completed-monitor fail-closed path absent. Please review this latest exact head.

[huangruiteng]

Reviewed exact head: 4d2d5a77aece5042c6e720166abe659d120f2c8b.

动机

这个 PR 修复的问题真实存在：Agent Vision 已用 typed declaration 指定 fallback Todo，但旧 quota / goal-frontier 从有容量上限的展示摘要判断目标是否存在、可运行或合法等待。无关 deferred Todo 增多后，canonical state 中真实存在的 fallback 会被裁掉并误报 vision_fallback_unresolved。早期修复又一度沿 resume chain 递归读取，在 heartbeat 热路径把 declaration 数量扩展成任意依赖深度。

当前 head 已把核心语义修到正确边界：只 exact-read 声明的 target/successor 与一层直接 resume dependency；明确 not-found、ambiguous/authority unavailable、runnable、合法 waiting 与 terminal 分开。上一轮发现的 completed-monitor 漂移也已修复：generation 未越过 baseline 且 monitor 已 done 时不能继续隐藏 unresolved；generation 已越过后即使 monitor 同时完成仍保持 runnable。

改动思路

live quota should-run 从 shared Agent Vision read model 提取最多四条 declaration、最多八个 target/successor id。_live_fallback_authority_items() 固定两轮：第一轮读声明 Todo，第二轮只读第一轮直接引用的 todo_done / monitor_changed target，最坏 16 次 exact read；无 declaration 时零新增读取，更深依赖绝不展开。

canonical 结果通过 typed FallbackTodoSource 进入 goal frontier。UNAVAILABLE 与 legacy caller 的 omitted source、explicit not-found 分开；authority failure、ambiguous projection 或 identity mismatch fail closed 为 vision_fallback_lookup_uncertain。实际 resume condition 继续由 TypeScript evaluator/planning owner产生，Python 只结合既有 ownership、exclusion、advancement task class 与 lifecycle predicates做 fallback-specific advisory 聚合。

具体改动

完整 diff 为 10 个文件、+927/-19：生产与协议文件新增 exact-read source、quota/semantic-replan 参数贯穿、typed uncertainty 与 disposition；两组 focused tests 共 563 行，覆盖 compact capacity 0/8/20、深链 0/4/64/512、无 declaration 零读取、not-found、authority exception、duplicate/ambiguous id、identity mismatch、ownership/exclusion、ordinary wait、open/done monitor 与 generation fence。

关键代码讲解

• live_decision.py::_live_fallback_authority_items 是唯一 live I/O owner：两轮固定循环，第二轮不会检查 dependency 自己的 resume_when，所以 read count 与深链无关。
• FallbackTodoReadState.UNAVAILABLE 保留“authority 没有可靠回答”的事实；compact positive evidence仍可给 legacy caller 使用，但 compact omission 不能升级成 canonical absence。
• _authoritative_fallback_disposition_ids 让 TS evaluator生成 condition，再复用现有 Todo predicates。unsatisfied monitor_changed 只有在 target 仍是 open continuous monitor 时才算 durable wait；satisfied generation 在 monitor close 后仍可 runnable。
• declared_fallback_gap_from_agent_vision 继续把 fallback_gaps 与 acceptance/replan obligation 隔离；recommended action 不创造 user gate 或 mutation authority。

独立验证：changed 两组 tests 49/49 通过；连同 adjacent resume-planning 与 external-wait owners 共 72 passed。Ruff 与 git diff --check 通过；远端 Python shards、stage2c、aggregate pytest、merge-gate、DCO、dependency 与 release build 均成功。未运行 PostgreSQL integration，因为本 PR 不改 store、transaction、migration 或 provider implementation；真实 file-backed CLI cases 已通过现有 canonical Todo reader 与真实 TypeScript runtime。

对主干的风险

代码语义没有剩余 P0/P1/P2 finding。最强反例——done monitor at unchanged generation——已被新的 paired regression 捕获；此前的无界 read、duplicate parser、ordinary todo_done:<continuous_monitor> wait 与 ambiguous-id-as-absence 也都已关闭。future-facing pass 认为不应在本 PR 新建 batch authority 或 fallback state machine；如果将来 canonical provider 提供一致性 batch read，可在不改变 advisory contract 的前提下降低混合时点风险。

但当前 exact head 仍有一个 P1 integration blocker：Frontstage Pages run 34589377400 在 required “Verify packaged Personal Workspace is current” step 重建后发现 loopx/web/chat/index.html 与 generated assets 变化。这个失败同样存在于 exact base 49cee5b30，而本 PR 没改 Dashboard source/package，所以它不是 fallback 逻辑缺陷；不过 policy-v3 不能在 exact-head required gate 为红时批准。#4239 的当前 head 已包含并验证 packaged Dashboard repair；请先让该修复进入 main，再把本分支更新到新 main 并重跑完整矩阵。

我的整体评价

REQUEST_CHANGES（仅剩 integration freshness/gate，代码 blocker 已关闭）。 当前实现的 source completeness、typed uncertainty、16-read bound、monitor lifecycle 与 advisory authority 都成立，927 行规模主要由多个历史漏测分支的回归覆盖支撑，整体 proportionate。不能因为失败继承自 main 就把 exact-head 门禁标成绿色，也不能要求本 PR夹带无关 generated UI 修复；正确动作是更新到已修复的 main 后重新跑 gate。

下一次无需重做这次已经绑定的代码结论，只要 head 变化后检查 merge diff、确认 fallback files 未漂移，并回读新的完整 hosted matrix。当前不合并。

English verdict: REQUEST_CHANGES on exact head 4d2d5a77aece5042c6e720166abe659d120f2c8b, solely for integration freshness. The previous unbounded lookup, duplicate owner, monitor lifecycle and ambiguity blockers are fixed; 72 focused tests, Ruff, diff checks and the full hosted Python/merge-gate matrix pass. Frontstage Pages still fails the required packaged Personal Workspace parity step because the exact base carries stale generated assets; this PR does not touch that surface, but policy-v3 cannot approve a red exact head. Land the packaged-dashboard repair, update this branch to the repaired main, and rerun the full matrix.

[cocolord]

已按最新 review 刷新并请求复审。

• 合入最新 origin/main：84334f794（包含 Dashboard 修复及 fix: harden decision-scope boundaries and CI isolation #4259 的 CI/browser smoke 隔离）
• 唯一冲突位于 loopx/control_plane/quota/live_decision.py imports；解析时同时保留本 PR 的 canonical fallback authority 读取，以及 main 的 typed project_agent_context 投影
• origin/main...HEAD 仍仅有本 PR 原来的 10 个同主题文件；merge base 已更新为 84334f794

本地验证：

• pytest 聚焦 fallback/quota/decision-scope：117 passed
• npm run typecheck:control-plane：passed
• npm run test:control-plane：1123 passed, 1 skipped
• Dashboard npm run build:chat 且 packaged assets clean：passed
• 新版分片 smoke:personal-workspace-packaged：passed（navigation-sorting, chat-recovery, typed-actions）
• public/private boundary、diff check、Python compile 及其余 16 个 selected canary/risk smokes：passed
• DCO：branch commits 均有 sign-off

loopx canary premerge --from-git-diff --goal-id loopx-product 唯一未通过项是 main 自身可复现的既有 heartbeat_prompt_json 热路径预算超限（3825 > 3600）。相关 producer、budget smoke 与协议文档均与 origin/main 无 diff；本 PR 没有抬高预算或扩大范围去掩盖该基线问题。

请基于 head 4877152c7 复审；远端完整 hosted matrix 将重新验证集成结果。

[cocolord]

最新 head 4877152c7 的 hosted matrix 已全部通过，包括：

• Frontstage Pages / packaged Dashboard build
• Dashboard acceptance
• kernel static checks
• 4 个 Python test shards
• Stage 2C e2e、mutants、installed
• Windows PowerShell
• minimum / forward Node compatibility
• aggregate pytest coverage gate
• final merge-gate

当前剩余状态仅为既有 CHANGES_REQUESTED review，等待 maintainer 基于新 head 复审；本分支不执行合并。

[huangruiteng]

Refinement update — 8c520fe

感谢 @cocolord 识别“展示裁剪不是 Todo 不存在”的问题。这次直接在原 fork 分支保留贡献历史，并将其收拢为面向两个 RFC 的 T3 consumer 改进。

动机

原方案仍有两个成本：每个目标/依赖都重新查询完整来源，可能混入不同 revision；Python 又维护一套 Monitor 等待与 fallback 聚合规则。反例还发现，同一声明的合法候选会被另一个缺失或不确定候选误伤。

改动思路

一次完整来源快照 → 最多 16 个目标/直接依赖记录 → TS 统一 disposition。复用 canonical reader、legacy parser、resume evaluator/planner 及正向 pending-target 证明，不新增 provider 或 Todo inventory。已加载的 replan 来源也复用同一有界 codec。

具体改动

• 删除逐 Todo 查询循环与 Python Monitor 特判；新 TS owner 组合既有 resume 规则。
• 按整条声明聚合：一个有效去向解决本声明，不会替其他声明清账；候选顺序不再改变结果。
• 保留 source-unavailable 与 source-absent 的区别、归档完成依赖和 generation 语义；读取失败不能回退 Markdown。
• 两份双语 RFC 保留执行卡、永久 projection 和 promotion hold。Refinement 相对 main 集成后的作者分支净减少 111 行产品代码，不把测试增长算作产品删除收益。

对主干的风险

有意收紧非法等待作为正向证据的使用：未绑定仓库的 PR 等待、归档 fallback 本身、矛盾 done 状态不能隐藏提示。Claim/exclusion、其他 agent 的 ownership 和 Monitor 非执行性不变。无声明不增加来源读取；提示仍是 advisory，不新增 quota/replan/user-gate/settlement 权限。整个 quota/status packet 的原子快照不在本次承诺内。

我的整体评价

保留原 PR 的增量价值，同时减少跨语言重复知识与多次查询。验证包含真实 CLI、File/SQLite、全 TS 内核及隔离 PostgreSQL、反例和风险 canary；精确结果与限制见更新后的 PR 描述。本次仅更新作者分支，等待新 head 的 CI 与独立评审，不沿用旧 head 的批准，不合并。

English verdict: implementation updated, fresh review pending for 8c520fe. One source snapshot and the existing typed resume owner replace repeated reads and Python policy duplication; alternative-resolution defects are covered by failing-before regressions. Original contributor history is preserved. No merge performed.

[huangruiteng]

动机

这次 PR 解决的是一个真实的配额公平性问题：当主路径被阻塞时，fallback 声明不应因为 compact Todo 展示只带出少量行，就被误判成不存在。当前 head 将 fallback 的事实读取收敛到一次有界的 canonical Todo snapshot，再让 TypeScript effect-runtime 负责 runnable / waiting / unresolved / uncertain 的分类；Python 只做来源读取和投影，这个方向与现有控制面边界一致。

我按 exact head 8c520fec18d35f8c6220a8b7c417c8eecae430f9 重读了 19 个文件（运行时 11、文档 5、测试 3），并复核了新增的 direct-dependency、duplicate、authority-unavailable 和 monitor-generation 覆盖。焦点 Python 测试 62 个通过，TypeScript fallback codec 测试 14 个通过；但这还不能证明安装发行物可用。

改动思路

live quota 路径先由 live_fallback_authority_items 读取被提升的 canonical authority（没有提升时才读状态文件），按最多四个 declaration 的 candidate IDs 加一层直接 todo_done / monitor_changed 依赖做选择，并把重复 ID 或坏行变成 UNAVAILABLE。declared_fallback_gap_from_agent_vision 将这些行标准化后调用 goal.fallback_disposition.project，TypeScript 再统一检查角色、claim、排除、archive、done、removed-continuation 和 resume condition。只有 runnable 或有正向 pending target 的 waiting alternative 才能消除 gap；缺少完整来源则是 uncertain，不能从 compact presentation 推断 absence。

这个 ownership 划分是合理的：Python 不再复制决策规则，TypeScript 复用现有 resume codecs，projection 仍然是只读的 advisory field，不会创建 Todo、授予 lease 或制造 user gate。真正的问题出在发布边界：新增 handler 位于 goals/goal_frontier/，但当前 wheel package-data 只声明 loopx.control_plane.goals 下直接匹配的 *.ts，没有声明这个子包。

具体改动

关键代码讲解

1. loopx/control_plane/goals/goal_frontier/fallback_disposition.py:165 的 declared_fallback_gap_from_agent_vision 删除了原先 summary-only 的 Python eligibility 判断，构造有界 source facts 和 resume request，再把最终 kind 转换成 fallback_gaps。source_state=unavailable 与 omitted 被明确区分，避免异常读取被当成 canonical absence。
2. loopx/control_plane/goals/goal_frontier/fallback_disposition.ts:80 的 projectFallbackDisposition 是新的 typed decision owner。Disposition union 和严格 decoder 让重复、越权 claim、monitor Todo、invalid condition 只能 unresolved/uncertain，且 alternatives 对 declaration 对称处理；这是正确的状态边界。
3. loopx/control_plane/effect_runtime_handlers.ts:80 静态导入该 nested handler，420 行将其注册为 effect method。静态导入发生在 server readiness 之前，因此发行物漏掉该资源时不是单个 fallback 失败，而是整个 effect runtime 无法启动。
4. loopx/control_plane/goals/goal_frontier/fallback_source.py:35 只在 vision 有 declaration 时读取 authority，并在 promoted canonical source 失败时拒绝回退到 Markdown；这个 completeness boundary 与新增 uncertainty 语义相符。

对主干的风险

有两个必须先解决的 P1：

1. wheel 缺少新 nested TypeScript 模块（P1）。effect_runtime_handlers.ts:80 引入 ./goals/goal_frontier/fallback_disposition.ts，但 pyproject.toml:55 的 package-data 仅是 "loopx.control_plane.goals" = ["*.ts"]，该 glob 不覆盖 goal_frontier 子目录。GitHub 的 stage2c (installed 0) 下载报告显示，wheel 安装成功后在 console_shadow_bootstrap 阶段以 EffectRuntimeStartupError 退出；build 也在 wheel/managed-runtime 校验处退出 1。也就是说 source checkout 的 62+14 测试全绿时，干净安装用户仍无法启动 effect runtime。

   最小修复：为 loopx.control_plane.goals.goal_frontier 增加显式 *.ts package-data（并确认其递归 import 的资源），或把 handler 放到已有打包边界；新增 wheel-content assertion 和 PYTHONPATH 为空的 installed startup/dispatch smoke。只有 build、stage2c (installed 0) 与 stage2c-correctness-e2e 重新通过后，才算验证了真正的交付边界。

2. exact head 不能合并（P1）。PR 当前 mergeable=CONFLICTING、mergeStateStatus=DIRTY，并有四个失败检查：build、stage2c (installed 0)、stage2c-correctness-e2e、merge-gate。分支基于旧 main；rebase 解决冲突很可能触碰本次 19 文件的决策/调用边界，所以不能把旧 head 的 focused pass 当成新 head 的通过证据。修复后请先 rebase current main，再读取新 head SHA、重跑所有 required checks，并请求一次完整 exact-head review。

我的整体评价

one-snapshot + typed effect owner 是解决 compact-lane false absence 的合适、可维护方案，测试也覆盖了不少过去容易遗漏的语义细节；我没有因代码量本身否定设计。但当前 head 在安装发行物层面会在启动前失败，同时与主干冲突、required checks 为红，属于可复现的交付阻断，而不是可以通过重跑或忽略来接受的环境噪声。因此本次为 REQUEST_CHANGES。请先修 package-data/installed runtime、rebase 并让四个红检查恢复，再以新的 exact head 复审。

English verdict: REQUEST_CHANGES — the typed fallback design is sound, but the new nested TypeScript handler is not included by the wheel package-data rule, causing the installed effect runtime to exit before readiness; the exact head is also conflicting and has four failing required checks. Repackage, rebase onto current main, rerun installed/build/stage2c/merge-gate validation, then request a fresh exact-head review.

[cocolord]

Updated PR #4061 to db367de7b on current main b27c4c729, preserving the original contributor and refinement history.

• Added explicit package data for the nested fallback TypeScript owner.
• Integrated the handler through main's lazy dispatcher and preserved current quota workspace/replay arguments and resume evaluation timestamps.
• Updated the duplicate-identity regression for main's earlier canonical succession rejection; malformed authority remains fail-closed before any frontier projection.
• Extended the existing installed-package qualification with resource presence and real fallback dispatch from an isolated venv outside the checkout.

Validation: 62 focused fallback tests, 37 adjacent frontier/resume tests, 14 TypeScript contract tests, Ruff and diff checks passed. The wheel built successfully; the isolated installed qualification passed all six required stages, including real dispatch and authority transactions. Candidate added-line public/private scan was clean.

Future-facing pass: retained the existing typed owner, shared resume codec and lazy runtime boundary; no new framework. Hosted checks must qualify this new head, and the prior request-changes review needs re-review. No merge was performed.

[cocolord]

CI follow-up for db367de7bf90aefe59bcc0e06d6b0b0eb6583149: two completed checks are red and merge readiness remains held.

• Frontstage Pages fails blog-bilingual-index-smoke.mjs because edgebench-feedback-and-memory lacks its paired-edition link. The identical failure reproduces on the unmodified b27c4c729 main baseline.
• Dependency Review reports GHSA-6qxp-vccf-f47h for @modelcontextprotocol/client@2.0.0 in packages/dsh-loopx-plugin/pnpm-lock.yaml. That lockfile is unchanged from the same main baseline and contains the flagged version there too.

These findings are outside this fallback-admission diff; no exception or weakened check was added. Other required checks are still running/queued. The focused Python, TypeScript and installed-wheel qualification reported above remain the validation for the changed behavior, not a claim that CI is fully green.

[loopx-agent]

Reviewer: actor_kind=model_agent; model=gpt-6.1-sol; provider=OpenAI; declaration_source=runtime_reported; reasoning_effort=xhigh

Reviewed exact head: db367de7bf90aefe59bcc0e06d6b0b0eb6583149.

动机

主路径受阻并已声明备用任务的 Agent会遇到这一问题。同一备用任务和前置条件不变，只增加 8／20 个无关等待任务，旧版就因展示裁剪误报备用任务不存在。新版从完整来源读取后再判断，不再让展示容量改变提示。

真实 CLI 的 base/head 对照和干净 wheel 都消除了上述误报；没有声明时维持原有等待与执行义务，不新增读取。

只修复可选备用路径提示；不授予执行、审批、结算权限，不替代 canonical 工作发现，也不宣称全 quota 快照一致性或 provider 迁移完成。

剩余边界：新 fallback_source.py 的 registry codec_read 未登记到 I/O 清单，标准 semantic drift 门禁失败；需修正登记并重跑。

改动思路

来源 I/O 留在现有 Goal frontier，TypeScript 复用 resume evaluator、planning 和正向 pending-target 证明；Python 删除等待／声明聚合决策，只保留 codec 与 projection。

当前交付边界：本 PR 只交付 optional fallback advisory 的完整来源与 typed 分类；现阶段必须补登记新增 registry I/O，整体 quota snapshot 与 provider cutover 留在已有 owner。

最强的不合并理由：advisory is lower priority than core execution; a second manual planning protocol would be too costly。单纯扩大显示容量、保存新的 ready cache 或再建一套状态规则，均不能解决已复现的来源／执行边界问题；本方案在现有 owner 内闭合。

具体改动

GitHub 元数据仍显示旧 base 与4028文件；本地 ancestry 确认当前主干与 head 的实际 merge base 为 b27c4c7290b9fea5deac1afa54694f3d5c263b93，独立差异 21 文件 +1243/-154。以前指出的无界依赖读取、重复 parser 和 wheel 缺 TS 模块，本轮已按完整21文件重新核验；最新 head 的 package-data、lazy dispatch、真实 installed dispatch 已通过，不继承旧批准。

• read_fallback_source_snapshot（loopx/control_plane/goals/goal_frontier/fallback_source.py:23）：promoted source 失败不能回退 Markdown；未提升时解析一次 legacy source，含归档。
• select_fallback_source_items（loopx/control_plane/goals/goal_frontier/fallback_disposition.py:138）：只选择最多 8 个候选及一层直接依赖；不递归，重复引用身份 fail closed。
• projectFallbackDisposition（loopx/control_plane/goals/goal_frontier/fallback_disposition.ts:80）：每条 declaration 独立地被一个有效 alternative 消除；复用 typed wait proof，保持 uncertainty。
• build_todo_resume_evaluation_request（loopx/control_plane/todos/resume_condition.py:342）：抽出共享输入 codec，直接 resume evaluation 与组合投影共享相同 bounded facts。

spec_ref: docs/reference/protocols/goal-vision-replan-contract-v0.md；spec_revision: b27c4c7290b9fea5deac1afa54694f3d5c263b93。判断依据是本 PR 改动之前的 accepted contract。criterion_id：Ownership Boundary；Exact blocked-successor wait；Acceptance。这些 criteria 的实现位置和实际验证见以上符号及下列实测；当前 PR 编辑过的文档不是独立验收来源。

对主干的风险

[P2] 新 registry I/O 未登记，标准门禁被本 PR 引入的读取点打断。 fallback_source.py:31 新增 load_registry(registry_path)，但未更新既有 project registry I/O manifest。同一 native semantic smoke 在 immutable base 通过，head 报 read_fallback_source_snapshot::codec_read:load_registry#1 unregistered。最小修复是按已有 owner 生成并审阅该清单中的 codec-read 分类（或复用已有来源解析消除新读取点），再跑 uv run --extra test python examples/semantic-vocabulary-drift-smoke.py 及标准 canary；不要放宽 census 或只改测试。

独立验证：62 Python tests（含真实 File/SQLite CLI、归档依赖和陈旧／缺失展示）；20 TS tests；typecheck；packaged Chat build；干净 wheel 6 个安装阶段及 6 个声明开关／容量反例通过；canary 5 direct + 19 selected 中 2 个失败，已分清新增与旧问题。

另外 install-local-smoke.py:458 的 exact prose assertion（never infer verified from metadata or CI）在 base/head 同样失败；文件/skill未改，归为现有安装门禁问题，单独保留，不要求本 PR 夹带修复。没有查看或等待 GitHub CI。

两次最初 wheel build 因干净 checkout 尚未生成 Chat bundle 拒绝构建；按仓库流程生成 packaged Chat 后两者 build/isolated installation 均通过，未放宽校验。补充 paired probe 最初有 fixture import 与临时 compile-cache 清理错误，保留失败记录；修正私有 probe 的 setup/证据目录后，原本的执行/提示 assertions 不变，base/head/wheel 对照通过。没有把 fixture 清理结果解释为产品恢复证明。

advisory only; no execution obligation created。没有新增跨 Agent、审批、quota、结算 authority；既有 owner、exclusion、lease 和其他义务仍各自生效。没有做无限期 soak、真实桌面或 Lark 账户操作，未声称这些验收完成。界面相关依赖沿已有入口；没有新增配置按钮或手工同步要求。

我的整体评价

REQUEST_CHANGES，仅绑定上述 exact head。本 PR 只交付 optional fallback advisory 的完整来源与 typed 分类；现阶段必须补登记新增 registry I/O，整体 quota snapshot 与 provider cutover 留在已有 owner。

长程效果预期正向：减少错误提示、无意义修复及重复来源查询；不把 advisory 变成义务。 体验方面，同一备用任务和前置条件不变，只增加 8／20 个无关等待任务，旧版就因展示裁剪误报备用任务不存在。新版从完整来源读取后再判断，不再让展示容量改变提示。 这些是已实测的有界前后差异，不能据此宣称无限活性或总体算力吞吐提升。效率价值来自减少重复误判/无效纠正和共用状态规则；单次延迟采样不作为性能增益结论。

future-facing pass：来源 I/O 留在现有 Goal frontier，TypeScript 复用 resume evaluator、planning 和正向 pending-target 证明；Python 删除等待／声明聚合决策，只保留 codec 与 projection。 已满足本次相关 owner 收敛；更大范围 snapshot/provider cutover 不并入这一修复。新 fallback_source.py 的 registry codec_read 未登记到 I/O 清单，标准 semantic drift 门禁失败；需修正登记并重跑。

English verdict: REQUEST_CHANGES on exact head db367de7bf90aefe59bcc0e06d6b0b0eb6583149. The advisory completeness and typed-owner design have positive demonstrated value, and installed dispatch now works. However, the new fallback_source registry read is missing from the existing I/O census: the same semantic smoke passes on the immutable base and fails on this head. Register/classify that read and rerun the native gate. The identical pre-existing installer prose-assertion failure is a separate hold.

[loopx-agent]

[P2] Register the new registry codec-read in the existing I/O census. This new load_registry call is not represented in project_registry_io_manifest. The same native semantic-vocabulary-drift-smoke passes on immutable merge base b27c4c7 and fails on this exact head with read_fallback_source_snapshot::codec_read:load_registry#1 unregistered. Regenerate/review the existing manifest classification (or eliminate the new read by reusing an existing source resolver), then rerun the semantic smoke and risk-selected canary. Do not loosen the scan or budget.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @cocolord.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh

详细中文评审 — #4061，exact head cd4ce126cdeb204d5aef5a8bc4acba22e31f5403

动机

使用已有候补方向声明的自动工作操作者：当前任务在等依赖完成，后台实际已有合法后继任务。

仅因其他等待事项增加，展示列表会漏掉已存在的后继任务，系统于是错误提示候补方向没有落实，诱发重复重规划；修复后从完整来源判断，继续原来的等待，真正缺失或被其他角色领取的方向仍报告未落实。

同输入的7组完整实际 CLI 输出中，8项和20项容量场景消除了错误提示，其余执行、等待和指令保持一致；当前 File/SQLite 路径与干净 wheel 的六阶段验证通过。

本次是已有可选建议的来源与类型化判断修复；不授予领取、执行或扣费权限，不关闭整个 provider/RFC，不证明自然宿主持续采用或模型净收益。

规格依据：docs/reference/protocols/goal-vision-replan-contract-v0.md，pre-change f606a3ff763982a7f7c78a1456e6ee24d9f73f12；映射项 existing-caller-invariant（本次评审标签，不是新增协议）。相关 issue/maintainer frame 与当前 caller 一并核对，PR 自述不是独立 oracle。

改动思路

完整 canonical Todo 读取和展示裁剪属于不同职责。Python 保留已有 provider 读取与 codec，TypeScript 复用 resume evaluator/planner 做 disposition 判断；删除旧 Python 决策模块，既有 quota 与 replan caller 共用一个 owner。无声明时零新读取，有声明时一次完整来源读取、两次 typed transport，裁剪只发生在来源完整性确认之后。

本次交付已有 fallback 建议的真实 caller 修复与 T3 consumer closure，包含安装资源及读取失败反例；T1/T2、D1–D3、完整 provider 切换和自然宿主采用仍保持各自验收边界。

具体改动

全量22文件 +1377/-279，范围是一个已在使用的建议消费者：

• fallback_source.py 读取完整来源并保留 archive，再选择目标及直接依赖；promoted source 失败不会退回旧 Markdown。零声明不读来源，0/4/64/512历史深度均一次来源读取、两次 typed transport，传输最多16条。
• fallback_disposition.ts::projectFallbackDisposition 复用 resume evaluator/planner 和 resumeConditionHasKnownPendingTarget；旧269行 Python 决策文件删除，__init__ 只保留既有出口适配。resume_condition.py 抽取同一请求 codec。
• live quota、prepare、should-run、semantic replan 调用同一来源；effect runtime 注册真实 handler，wheel 明确打包嵌套 TS。IO manifest 登记新增 registry read；协议及两份 RFC 的英中文说明限定 T3 边界。
• 测试覆盖正等待、dependency done、peer/exclusion、重复引用、缺失/损坏来源、显示截断、归档引用、monitor done 与实际 generation 证据的区别，PR wait 保留真实 merge 绑定。

独立同输入7组实际 CLI 完整输出只出现两处预期建议消失，另14处是完整保留并逐一列出的新 observation event_id/time；没有把控制、指令或权限差异归一化掉。无声明、真正缺失、依赖完成和 peer claim 路径保留。当前五套 Python 99项、三套 typed 34项、typecheck/Ruff/diff、完整 semantic 和292-site I/O 检查通过。初次测试命令误写了不存在的文件，exit4且未执行测试；纠正后才得到99项结果，未把它归为PR故障。

构建当前 chat 与 wheel 后，用 checkout 外的隔离空 venv 实跑 installed.py：10项资源、fallback dispatch、真实基线bootstrap、三次变更各一receipt、资格与exact candidate读取、rollback/new lineage 共六阶段通过。安装 dispatch 使用空声明；非空语义由当前源码和实际 File/SQLite 入口验证，未宣称自然 App 升级。还按真实注册领域元数据，对5 Goal/12绑定执行36个自有、peer和不可用来源合成场景；没有改动这些活跃 Goal，不能算自然 Agent 采用。

对主干的风险

之前 review 5470059332 所指未登记 registry I/O，当前292-site及全量 semantic 已通过；review 5186422721 的嵌套 TS wheel 资源问题，当前隔离 wheel 六阶段直接覆盖。旧评论、旧批准或CI不作为证据；当前策略不获取或等待CI。既有 owner 的有效 CHANGES_REQUESTED 仍需单独完成 reconciliation，当前技术批准不授予 dismiss 或合并权限。

有声明时比旧 main 增加完整来源读取，代价随历史长度增长；一次快照/有界传输比此前逐声明读取更稳健，但不能因此声称比 main 更快。源码证明失败不会被当成空来源或虚构人类门禁。内部现有 Agent CLI 建议没有新增可编辑操作、UI或Lark旅程，未把未交付的前端能力标成完整产品。未触及 PostgreSQL store/transaction/migration，未宣称真实PG provider推广资格。

我的整体评价

通过该 exact-head 的有界消费者修复。长期判断效果有正向证据：等待集合变大不再诱发错误的“候补未落实”重规划，依赖真正完成后仍走原恢复规则。体验更清晰且不增加必填信息或确认步骤；全模型/整机净效率和自然采用尚未测量。前瞻重构已经落实为一个 typed decision owner、共享 resume codec、删除旧 Python policy；进一步在既有 read scope 复用来源快照可作为安全的后续优化，须先保留 archive、scope、排序与失败语义，不需要新增框架或重复状态。

English verdict: APPROVE — #4061 at cd4ce12. Resolve declared alternatives against complete current source before bounded projection; source unavailable becomes uncertain, not absence; positive pending-target proof retained. Independently checked real source callers, negative/base-head controls and native validation; current isolated wheel verified. No merge, release, authority or natural model-utility claim.