Merge remote-tracking branch 'origin/main' into codex/canonical-todo-readmodel-0924

Author: huangruiteng

docs/architecture/rfcs/loopx-overall-roadmap-v0.md

@@ -378,6 +378,14 @@ These priorities do not change live Goal quota or authorize experiments/cloud re
 - **Exit:** independent readback proves retained commitments; distinguish all-gap/partial/stale/rejected/committed; recovery neither duplicates nor expands work, and the initiating surface displays the exact outcome. Add independent semantic counterexamples, not only row-existence assertions.
 - **Rollback:** stop new plan production, keep old previews/receipts readable and unfinished reconciliation available; do not delete materialized work.
 
+**Recovery checkpoint (2026-09-24):** Enabled acceptance now routes missing as
+well as stale associations through bounded agent-scoped replan. Exact hold
+checkpoints survive crowded vision projections; a replan decision does not
+simultaneously select a candidate monitor. Owner binding and fresh completion
+validation remain required. This repairs R1/S2/S3 continuity, not R4's general
+intent-preserving amendment or provider promotion. Real File/SQLite CLI
+regressions cover recovery admission and continued refusal of unbound completion.
+
 ### R2: Continuous Small-team Execution
 
 **Product responsibility.** The steward owns the owner's cross-project context,

docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md

@@ -336,6 +336,12 @@ R2 的一条依赖必须通过真实 LoopX Agent 间的请求/产物交接完成
 - **退出：** 独立回读证明承诺保留；all-gap/partial/stale/rejected/committed 区分；中断后恢复不复制、不扩大工作，原接收界面显示精确结果。新增独立语义反例，不能只断言一行存在。
 - **回滚：** 停新计划 producer，保留可读旧预览/receipt 及未完成对账；不删除已经形成的工作。
 
+**恢复检查点（2026-09-24）：** 已启用验收的缺失关联与过期关联统一进入 Agent 范围的
+有界重规划；精确阻塞检查点不会被拥挤的 vision 展示挤掉，重规划不再同时选择候选观察任务。
+所有者绑定与完成时的新鲜验证仍然必需。这修复 R1/S2/S3 的持续运行路径，不代表 R4 通用
+意图保持 amendment 或 provider 晋升。真实 File/SQLite CLI 回归覆盖恢复准入与继续拒绝
+未绑定任务完成。
+
 ### R2：小团队持续执行
 
 **产品职责。** 管家负责所有者跨项目的上下文、取舍和注意力；项目 coordinator 是

docs/reference/goal-acceptance-observations.md

@@ -156,17 +156,28 @@ acceptance criteria remain separately configured and checked. Text, whether
 completion validation is required, repository/write-scope declarations, and
 unknown future work fields still invalidate the association. Replacing an
 existing `resume_when` is not reconstructible from the latest Todo and remains
-`stale`. When the agent's applicable Todo is genuinely stale, the existing
-Goal frontier projects its exact Todo ID as an agent-scoped replan trigger if
-no advancement Todo is selectable. The agent inspects the binding and work
-delta, restores an unintended edit or records an evidence-linked path change.
-The original Turn/Todo identity remains intact; a successor has its own identity.
-The agent cannot rebind
-owner-confirmed criteria, complete held work, or settle a different Todo under
-the old Turn; a true change to owner-owned criteria or scope still needs owner
-review. Only an evidence-linked runnable successor or concrete blocker receipt
-for this stale-binding trigger, recorded after the Todo update, quiets repeated
-wakeups until another material change. Existing enabled contracts configured
+`stale`. When no advancement Todo is selectable, both missing (`unbound`)
+and stale associations enter the existing agent-scoped recovery lane. Recovery
+preserves the original Turn/Todo identity and does not authorize execution of
+held work. Inspect a missing association and prepare it for owner confirmation;
+for a stale association, inspect the work delta and restore an unintended edit
+or propose the changed association. An already eligible successor remains a
+separate execution identity. Do not create another unbound repair Todo and
+mistake its existence for a runnable successor.
+
+Acceptance holds precede general vision gaps in the bounded trigger packet, so
+the Agent can read the exact checkpoints that recovery requires. Only an
+accepted, evidence-linked runnable successor or concrete blocker receipt covering
+the exact hold generation can quiet it. Unrelated progress, a vision rewrite,
+or an acknowledgement for another association cannot discharge the hold.
+Reconfirming the contract or changing the work rearms recovery. Disabled/absent
+acceptance retains its existing behavior. When quota selects replan, candidate
+monitors remain inventory; `selected_todo` and `agent_lane_next_action` do not
+advertise them as this decision's execution target. Original receipt identities
+remain in their settlement contracts. A genuinely Todo-bound replan still
+projects its selected Todo; this only removes the unrelated inventory fallback.
+
+Existing enabled contracts configured
 with a persisted `no_followup` field under the earlier digest rule require owner inspection and
 reconfiguration; no historical receipt is rewritten or automatically accepted.
 Disabled/absent acceptance retains its existing behavior.
@@ -316,12 +327,18 @@ claim、lease/fence、权限和后续工作要求。既有验证回执或已确
 重复确认，也不改写已保存的绑定摘要。修订后的命令仍须在完成时重新验证，Goal 验收条件
 也仍独立执行。任务文本、是否要求完成验证、仓库与写入范围等实质工作声明变化仍使关联
 过期；未知的新工作字段默认按实质变化处理。已有 `resume_when` 被替换时，当前 Todo
-无法证明旧值，仍保持 `stale`。适用的 Agent Todo 确实过期、且无可选推进任务时，现有
-Goal frontier 以原 Todo ID 产生 Agent 范围的重规划触发。Agent 核查关联与工作变化，
-恢复误改或记录有依据的路径变化。原 Turn/Todo 身份保持不变，后继有独立身份；Agent 不能自行重绑所有者确认
-的条件、完成受阻任务，或用原 Turn 结算另一条 Todo。真正改变所有者验收条件或范围的
-情况仍交所有者审阅。只有绑定该过期触发项、发生于 Todo 更新之后，并证明有依据的可运行
-后继或具体阻塞的回执，才会消解重复唤醒，直到再次出现实质变化。
+无法证明旧值，仍保持 `stale`。无可选推进任务时，缺失关联（`unbound`）与过期关联
+（`stale`）统一进入现有 Agent 范围的恢复路径。缺失关联需要准备关联方案供所有者确认；
+过期关联需要核查工作变化、恢复误改或提交变更后的关联。恢复保留原 Turn/Todo 身份，
+不授权执行或完成受阻任务，也不自动重绑。不要再新建一个同样 unbound 的修复 Todo，
+然后将其当作可运行后继。
+
+有界触发项优先保留验收阻塞及其精确检查点，再展示通用 vision 缺口。只有覆盖该阻塞
+代次、被接纳的有据可运行后继或具体阻塞回执，才会消解重复唤醒。无关进展、改写 vision、
+其他关联的确认均不能代替；重新确认合同或改变工作会重新触发恢复。未启用时保持原行为。
+配额选择重规划时，候选观察任务仍可见于清单，但不再同时成为 `selected_todo` 或
+`agent_lane_next_action`；原回执身份仍由结算合同保留。真正绑定 Todo 的重规划仍展示原 Todo，
+本次仅移除从无关观察清单补出的选择。
 
 `loopx goal-acceptance verify --goal-id example-goal` 仅预览；加 `--execute` 执行全部配置条件，
 再运行 inspect 读回。进入 **概览 → 交付与依据**，刷新并展开交付链下方的 **Goal 验收合同**。

loopx/control_plane/goals/goal_frontier/__init__.py

@@ -1,7 +1,5 @@
 from __future__ import annotations
 
-import hashlib
-import json
 from typing import Any
 
 from ...agents.agent_scope import (
@@ -57,6 +55,10 @@
 )
 from ..goal_vision_wait import build_goal_vision_wait_state
 from . import outcome_continuity
+from .acceptance import (
+    GOAL_ACCEPTANCE_HOLD_TRIGGERS,
+    acceptance_gaps_from_held_goal_binding,
+)
 from .ack_policy import (
     autonomous_replan_ack_satisfies_obligation,
     replan_successor_transition_ack,
@@ -106,7 +108,6 @@
 FRONTIER_EXHAUSTED_MONITOR_TRIGGER = "frontier_exhausted_monitor_lane"
 MONITOR_NO_CHANGE_STREAK_TRIGGER = "monitor_no_change_streak"
 VISION_PROFILE_MISSING_TRIGGER = "required_agent_vision_missing"
-GOAL_ACCEPTANCE_STALE_TRIGGER = "goal_acceptance_stale"
 TODO_SUCCESSION_GAP_TRIGGER = TODO_SUCCESSION_WARNING_REASON_CODE
 
 
@@ -368,69 +369,6 @@ def acceptance_gaps_from_agent_profile_requirement(
     ]
 
 
-def acceptance_gaps_from_stale_goal_binding(
-    agent_todo_summary: dict[str, Any] | None,
-    source_items: list[dict[str, Any]] | None,
-    *,
-    agent_id: str | None,
-) -> list[dict[str, Any]]:
-    """Route this agent's held semantic drift through the existing replan lane.
-
-    This is a read-only trigger, not an acceptance rebind. Other runnable work
-    remains selectable; the frontier rule schedules a replan only when no
-    advancement Todo can be selected for this agent.
-    """
-
-    if not agent_id or not isinstance(agent_todo_summary, dict):
-        return []
-    contract = agent_todo_summary.get("goal_acceptance_contract")
-    if not isinstance(contract, dict) or contract.get("enabled") is not True:
-        return []
-    stale_ids = {
-        task.get("todo_id")
-        for task in contract.get("tasks", [])
-        if isinstance(task, dict)
-        and task.get("state") == "stale"
-        and task.get("applicable") is True
-    }
-    gaps: list[dict[str, Any]] = []
-    for item in source_items or []:
-        if (
-            not isinstance(item, dict)
-            or item.get("todo_id") not in stale_ids
-            or item.get("role") != "agent"
-            or item.get("status") not in {"open", "blocked"}
-            or not agent_scope_item_claimed_by_agent_or_unclaimed(item, agent_id=agent_id)
-        ):
-            continue
-        todo_id = str(item["todo_id"])
-        frontier_revision = hashlib.sha256(json.dumps(
-            [todo_id, item.get("updated_at"), contract.get("digest")],
-            ensure_ascii=True, separators=(",", ":"), default=str,
-        ).encode("utf-8")).hexdigest()
-        gap = {
-            "kind": GOAL_ACCEPTANCE_STALE_TRIGGER,
-            "source": "goal_acceptance_contract",
-            "agent_id": agent_id,
-            "reason_code": GOAL_ACCEPTANCE_STALE_TRIGGER,
-            "vision_todo_ids": [todo_id],
-            "frontier_revision": frontier_revision,
-            "replan_trigger_summary": f"The acceptance association for {todo_id} is stale after a work change.",
-            "acceptance_summary": "Preserve the owner-confirmed criteria and the original Turn identity.",
-            "resolution_hint": (
-                f"Inspect {todo_id} and its acceptance binding; restore an unintended edit, "
-                "or record an evidence-linked path delta and continue via an eligible "
-                "successor. Escalate only a real change to owner-owned criteria or scope; "
-                "never rebind or settle a different Todo under the original Turn."
-            ),
-        }
-        if isinstance(item.get("updated_at"), str):
-            gap["generated_at"] = item["updated_at"]
-        gaps.append(gap)
-        if len(gaps) == 3:
-            break
-    return gaps
-
 
 def build_vision_continuation_audit(
     *,
@@ -991,11 +929,11 @@ def _vision_gap_acknowledged(
     # The vision-patch shortcut below covers gaps authored by that same Turn.
     # A persisted Goal Acceptance drift is an independent Todo event: an older
     # vision patch cannot acknowledge a later semantic edit.
-    stale_bindings = [
+    held_bindings = [
         gap for gap in acceptance_gaps
-        if gap.get("kind") == GOAL_ACCEPTANCE_STALE_TRIGGER
+        if gap.get("kind") in GOAL_ACCEPTANCE_HOLD_TRIGGERS
     ]
-    if stale_bindings:
+    if held_bindings:
         semantic_delta = latest_replan_ack.get("semantic_delta")
         satisfying_outcomes = (
             semantic_delta.get("satisfying_outcomes")
@@ -1009,24 +947,25 @@ def _vision_gap_acknowledged(
             and isinstance(semantic_delta.get("trigger_checkpoints"), list)
             else []
         )
-        exact_stale_checkpoints = all(
+        exact_hold_checkpoints = all(
             any(
                 isinstance(checkpoint, dict)
-                and checkpoint.get("kind") == GOAL_ACCEPTANCE_STALE_TRIGGER
+                and checkpoint.get("kind") == gap.get("kind")
                 and checkpoint.get("frontier_revision") == gap.get("frontier_revision")
                 for checkpoint in recorded_checkpoints
             )
-            for gap in stale_bindings
+            for gap in held_bindings
         )
         if (
             not _replan_evidence_acknowledged(
-                stale_bindings, latest_replan_ack, time_key="generated_at",
+                held_bindings, latest_replan_ack, time_key="generated_at",
             )
             or not isinstance(semantic_delta, dict)
             or latest_replan_ack.get("recorded") is not True
             or semantic_delta.get("accepted") is not True
-            or GOAL_ACCEPTANCE_STALE_TRIGGER not in (semantic_delta.get("trigger_kinds") or [])
-            or not exact_stale_checkpoints
+            or not all(gap.get("kind") in (semantic_delta.get("trigger_kinds") or [])
+                       for gap in held_bindings)
+            or not exact_hold_checkpoints
             or not any(
                 outcome in {"new_runnable_successor", "new_concrete_blocker"}
                 for outcome in satisfying_outcomes if isinstance(outcome, str)
@@ -1105,9 +1044,12 @@ def derive_goal_frontier_replan_obligation_from_summaries(
         if selectable_frontier_advancement == 0
         else None
     )
-    compact_acceptance_gaps = [
-        item for item in (acceptance_gaps or []) if isinstance(item, dict)
-    ]
+    compact_acceptance_gaps = sorted(
+        (item for item in (acceptance_gaps or []) if isinstance(item, dict)),
+        # An enforced hold must survive the bounded trigger projection. Its
+        # exact checkpoint is required to settle; generic vision gaps follow.
+        key=lambda gap: gap.get("kind") not in GOAL_ACCEPTANCE_HOLD_TRIGGERS,
+    )
     if any(gap.get("vision_todo_ids") for gap in compact_acceptance_gaps):
         # Diagnostic claim counts retain executor-excluded work. A causal
         # acceptance obligation needs an actually selectable Todo identity.
@@ -1268,6 +1210,9 @@ def derive_goal_frontier_replan_obligation_from_summaries(
             },
         )
     if replan_rule.rule is GoalFrontierReplanRule.VISION_ACCEPTANCE_GAP:
+        acceptance_held = any(
+            gap.get("kind") in GOAL_ACCEPTANCE_HOLD_TRIGGERS for gap in compact_acceptance_gaps
+        )
         rearmed_after_obligation_id = _acknowledged_replan_obligation_id(
             latest_replan_ack
         )
@@ -1305,13 +1250,14 @@ def derive_goal_frontier_replan_obligation_from_summaries(
                 }
                 for gap in compact_acceptance_gaps[:3]
             ],
-            guidance_actions=[
-                "create_successor",
-                "update_agent_vision",
-                "record_evidence_gap",
-                "record_no_followup",
-            ],
-            todo_actions=[
+            guidance_actions=(
+                ["inspect_acceptance_binding", "select_eligible_successor", "record_evidence_gap"]
+                if acceptance_held else
+                ["create_successor", "update_agent_vision", "record_evidence_gap", "record_no_followup"]
+            ),
+            # Another unbound advancement Todo cannot repair this admission
+            # hold. Keep authoring suggestions aligned with the typed exits.
+            todo_actions=[] if acceptance_held else [
                 {
                     "action": "add",
                     "role": "agent",
@@ -1339,11 +1285,6 @@ def derive_goal_frontier_replan_obligation_from_summaries(
                 "record no-follow-up"
             ),
             rearmed_after_obligation_id=rearmed_after_obligation_id,
-            extra_fields=(
-                {"satisfying_semantic_outcomes": ["new_runnable_successor", "new_concrete_blocker"]}
-                if any(gap.get("kind") == GOAL_ACCEPTANCE_STALE_TRIGGER for gap in compact_acceptance_gaps)
-                else None
-            ),
         )
     if replan_rule.rule is GoalFrontierReplanRule.LONG_TODO_CHAIN:
         assert long_chain_observation is not None
@@ -1641,7 +1582,7 @@ def build_goal_frontier_projection_context_from_status(
                 (project_asset or {}).get("execution_profile")
             ),
         )
-        + acceptance_gaps_from_stale_goal_binding(
+        + acceptance_gaps_from_held_goal_binding(
             agent_todo_summary, agent_todo_source_items, agent_id=agent_id,
         )
     )
@@ -1681,7 +1622,7 @@ def build_goal_frontier_projection_context_from_status(
         ),
     )
     acceptance_gaps = (
-        [gap for gap in source_acceptance_gaps if gap.get("kind") == GOAL_ACCEPTANCE_STALE_TRIGGER]
+        [gap for gap in source_acceptance_gaps if gap.get("kind") in GOAL_ACCEPTANCE_HOLD_TRIGGERS]
         if vision_wait_state else source_acceptance_gaps
     )
     declared_fallback_gaps = [