refactor(quota): resolve fallback advice from one typed snapshot

[cocolord]

Summary

Preserve @cocolord's fix for optional fallback advice disappearing behind compact Todo lanes, and refine the existing contributor branch against current main. This remains PR #4061; original contributor commits are retained.

The live quota path now reads one complete Todo source snapshot, selects at most eight declared targets/successors plus eight direct resume dependencies, and delegates disposition to TypeScript. It no longer repeats the complete source query for each Todo. Archived prerequisites survive; no declarations means no extra source read.

Architecture and RFC contribution

• fallback_source.py reuses the existing canonical provider reader after promotion and the existing legacy parser before promotion. Unavailable authority never falls back to Markdown.
• fallback_disposition.ts composes the existing resume evaluator, resume planner, and resumeConditionHasKnownPendingTarget. Python retains input codecs and public presentation, not its own Monitor-wait and declaration-aggregation rules.
• Target classification and condition evaluation consume the same selected source rows. Bounded selection does not recursively follow dependency chains.
• Both RFCs record this as one T3 consumer closure, not T1/T2 completion, storage qualification, a provider-default change, or promotion approval. Permanent Markdown projection and D1–D3 holds remain.

Placement: existing goal-frontier read policy and Todo resume owner; no new capability, extension, provider, CLI option, persisted declaration, or permission surface.

Intentional semantic corrections

1. Resolve each declaration symmetrically: one runnable, validly waiting, or bounded create/reopen alternative discharges its own advisory, irrespective of the other candidate's order, absence, or uncertainty.
2. Uncertainty from a resolved declaration cannot leak into the aggregate. Resolving one declaration never clears another.
3. Reuse positive pending-target evidence, including generation and PR repository binding. An unbound PR wait, archived fallback itself, contradictory done flag, invalid Monitor completion wait, other-agent claim, or exclusion cannot suppress advice. Archived completed prerequisites remain usable; an increased Monitor generation remains satisfied even if the Monitor subsequently completes.
4. Missing display is not missing state. Only a complete source can prove absence; unavailable/ambiguous source remains uncertain.

These are disclosed corrections, not a claim of universal zero behavior change. fallback_gaps stays advisory, separate from acceptance-gap obligations; it does not grant execution, settlement, ownership, capability activation, or user-decision authority. Canonical work discovery does not require extra fallback declarations.

Scope and code volume

The refinement removes 111 net product lines relative to the author's branch after main integration: 315 added / 426 deleted. It retires repeated per-Todo queries, Python Monitor-specific wait logic, duplicate planning calls, and candidate-level aggregation. The same bounded codec also protects callers passing an already-loaded replan source. The whole PR against main still adds product behavior and durable tests; the net deletion claim applies only to this refinement.

This guarantees coherence for fallback alternatives and their direct dependencies, not an atomic snapshot across the entire quota/status packet.

Validation

• Tested revision: 8c520fec18d35f8c6220a8b7c417c8eecae430f9; TS kernel suite ran at 7ae1b177f with unchanged TS code, followed by final-head Python/CLI and canary validation.
• Run state: finished
• Input classes: synthetic, public_fixture

Check kind	Result	Public-safe evidence / limitation
real_entrypoint	passed	Final-head Python suite: 215 tests covering quota parity, frontier, Vision, resume, external waits and fallback admission
real_backend	passed	Full TS kernel: 1,230 passed, zero failures/skips; includes isolated real PostgreSQL 16.15
integration	passed	8 File/SQLite CLI cases: stale/missing display × pending/archived-completed dependency × provider; state and provider revision unchanged
regression_parity	passed	Dependency depths 0/4/64/512: one source read and two transported records in each case; a preloaded 4,096-unrelated-Todo source sends only its one relevant record
regression_parity	passed	Three of four candidate-order/resolution cases failed before refinement; all four pass afterward
static	passed	TypeScript typecheck, Ruff, diff whitespace and public/private scan
integration	passed	Final-head risk-based canary: 18 passed, zero failures or manual holds; earlier report-output disk exhaustion was resolved and rerun successfully

• Coverage and gaps: both legacy and promoted CLI paths, source failure, identity ambiguity, scope/lifecycle negatives, absent declarations, archived dependencies and bounded transport are covered. Full Python repository and live model-behavior suites were not run; no model prompt, storage transaction or provider implementation changed. CI on the new head is still required.

No live Goal, registry, lease, production provider, benchmark, model API, or external delivery was mutated by validation. Synthetic provider fixtures are disposable; raw logs and local paths are excluded.

Review

Ready for a fresh exact-head review after the updated checks; the old-head approval is not inherited. No merge or installation is requested by this update.

[cocolord]

@huangruiteng Please review this follow-up to the closed #4049. It resolves fallback declarations from exact canonical Todo rows instead of bounded display slices, while preserving the existing eligibility and TypeScript resume-condition authorities.

Validation is complete: all GitHub checks passed; focused local suites passed (221 tests), Ruff and mypy passed, the control-plane TypeScript typecheck passed, and loopx canary premerge --from-git-diff --goal-id loopx-product passed 17/17 selected checks with no manual holds.

[huangruiteng]

Reviewed exact head: 8e0476d5b3146eaec179b2c7aea934e11e8e8d66.

动机

这个 PR 修复的缺陷真实存在：fallback_declarations 已经声明了关联 Todo，但旧 advisory 从有展示上限的 Todo summary 读取“是否存在/是否等待”；无关 deferred Todo 增多后，合法 fallback 会被截掉并误报 vision_fallback_unresolved。缺失项、权限读取失败和真实不存在必须区分，不能继续把 bounded presentation 当完整数据库。

从不合并的角度重新审视后，exact-id canonical read 是正确方向，但当前实现还有两个阻塞点：它把“最多四条声明”扩展成了无上限的同步依赖遍历；同时没有与已批准的 #4059 causal-wait owner 整合，仍在同一边界维护另一套 parser/source seam。绿色测试证明了原回归被修，不足以证明 quota 热路径现在有界、也不足以证明两个并行 PR 合并后的唯一 owner。

改动思路

live quota 先从最新 Vision 提取每条声明的 target/successor exact id，再通过 todo list 的 canonical authority 逐个读取 Todo；对 todo_done / monitor_changed 又读取依赖项。frontier adapter 复用现有 ownership、exclusion、task-class、lifecycle 和 TypeScript resume-condition evaluator，将结果分成 runnable、valid waiting、uncertain 或 absent。读取失败投影 vision_fallback_lookup_uncertain，不再伪造 absence；这个方向与 source-completeness 原则一致。

但 direct resume evaluator 只需要声明 Todo 和它的一层 target 状态/代数。当前 while pending_ids 会检查每个依赖 Todo 自己的 resume_when，继续加入依赖的依赖，形成与声明数无关的传递闭包。另一个集成问题是 #4059 已把 todo_delta parsing 和完整 Vision/Todo causal wait read model 收敛到共享 owner；本 PR 与它基于同一个 base 开发，尚未 rebase，三方合并在 frontier、fallback、quota prepare 和测试发生冲突。

具体改动

exact-head diff 为 8 个文件、+665/-16。六个生产文件新增 canonical fallback Todo read、source authority 参数、resume 求值和 uncertainty gap；两个测试文件覆盖真实 CLI 在 0/8/20 个无关 deferred Todo 下的稳定性，以及 absence、authority failure、todo_done、monitor_changed、ownership、exclusion 和 monitor task-class。

关键代码讲解

1. live_decision.py:40-55 只从 typed declarations 提取 target/successor Todo id，不再把 declaration_id 冒充 Todo id，这一修正是合理的。
2. live_decision.py:83-118 用 list_goal_todos(todo_id=...) 读取 canonical state，但循环同时追踪每个新读取 Todo 的 resume_when，因此一条声明可以触发任意长度的调用链。
3. fallback_disposition.py:221-287 复用既有 typed eligibility 与 TypeScript resume evaluator；authority unavailable 进入 uncertainty，exact not-found 才进入 unresolved，避免 bounded slice 的假阴性。
4. fallback_disposition.py:24-103 仍自己定义 VISION_FRONTIER_TODO_DELTA_ACTIONS 和 parser；#4059 已在共享 goal_vision_read_model.py 中抽取同一知识，继续保留会在相邻 read models 中产生第二 owner。

对主干的风险

[P1] canonical lookup 在 quota 热路径上不是有界读取。 我固定同一个 fallback declaration，只让其 Todo 的 resume_when=todo_done:... 形成不同长度的合法合成链。链深 0/4/64/512 时，_live_fallback_authority_items() 分别调用 list_goal_todos 1/5/65/513 次。TypeScript evaluator只读取声明 Todo 的直接 todo_done status 或 monitor_changed generation，后续依赖不会参与本次 disposition；递归遍历既无语义需要，也违背 PR 所称的 bounded exact lookup。长链或损坏状态会让每次 quota should-run 产生线性同步 authority I/O。请只读取最多 8 个声明 target/successor id 及其直接 resume target，并为读取数量加显式上限/回归；超过、歧义或读取失败都投影 uncertainty，不要继续递归。

[P1] 先与 #4059 的共享 causal-wait owner 整合，再判断 compatibility advisory 还需要多少独立代码。 #4059 已批准 exact head 3a6c5ca9555f057c27259baf4432ccd970aa9ec2，把 todo_delta parser、canonical Vision read model 和 wait coverage 放入同一 goal frontier 边界；本 PR 当前重新定义 parser/constants，并新增 fallback_todo_source_items 并行来源。两条分支三方合并已在 fallback_disposition.py、goal_frontier/__init__.py、should_run_prepare.py 和测试产生冲突。请 rebase 到 #4059/其落地主干，复用共享 read model，只保留无法由 causal state 推导的 fallback compatibility lookup；不要通过手工选择一边而丢掉 #4059 的完整性与 lineage 规则。rebase 后整个 exact head 必须重新跑 capacity/order、incomplete-source、completed/superseded/archived reference 和真实 CLI counterfactual，不能继承本次结论。

独立验证：30 个 focused Python tests 通过；changed-path Ruff 和 git diff --check 通过；远端 DCO、dependency、Python/Windows、Pages/release build、Sonar 均成功或预期 skip。本地 detached checkout 未安装 Node/pg 依赖，因此没有把共享环境里无法解析 pg 的 typecheck 当成新的产品失败；远端该检查为绿色。主干已前进且当前 PR 为 BEHIND，这本身不是独立 blocker，但与 #4059 整合后需要新 exact-head evidence。

我的整体评价

REQUEST_CHANGES。 原容量回归的方向和大部分 typed-state 处理是对的，测试也有长期价值；当前不能批准的原因是 quota 热路径存在已复现的无界 authority read，以及它尚未与同边界的已批准 causal-wait refactor 收敛。最小修复是“声明 exact ids + 一层 direct dependencies + 完整性/不确定性”，然后 rebase 复用 #4059 的 parser/read model，而不是继续扩展传递遍历或并行 source contract。

future-facing pass：应在本 PR 内完成上述 bounded read 与 owner 收敛；不需要新 capability、provider 或通用依赖图框架。

English verdict: REQUEST_CHANGES on exact head 8e0476d5b3146eaec179b2c7aea934e11e8e8d66. The capacity fix is directionally sound, but one declaration can trigger an unbounded transitive chain of synchronous canonical Todo reads (1/5/65/513 reads at depths 0/4/64/512), although disposition needs only direct resume targets. Rebase onto approved PR #4059's shared causal-wait/read-model owner, remove duplicate parsing/source seams, bound exact reads to declared ids plus direct dependencies, and rerun the full real-CLI/state-lifecycle evidence on the new head.

[cocolord]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewed head: acd302cedafe2b9c12d624ae0b92371f78cb92ff. Includes #4059 at 0c619324870f2f4ce9e9a550b6bc0228722d5095 and current main 54681bccd5e5780dc03390488c5afcf217daf692.

动机

这条可以继续，但范围仅是已有 fallback 提示的准确性。#4059 修复核心等待决策后，真实 CLI 在增加 8 个无关等待项时仍错误出现 fallback_gaps；它不应被描述成另一套必需的规划机制。

改动思路

已处理上轮两项要求：去掉递归依赖遍历；直接复用 #4059 的 Vision read model 与 todo_delta parser。声明目标和 successor 最多 8 个，仅再查它们的一层直接 resume 依赖，总计最多 16 次读取。更深的链由现有 Todo 状态表达，不在 quota 入口重新遍历。

具体改动

_live_fallback_authority_items 使用两轮、去重、稳定排序的精确读取；错 ID 或读取失败返回未知。_authoritative_fallback_disposition_ids 复用 TS resume evaluator、ownership/exclusion/task-class/lifecycle 谓词。declared_fallback_gap_from_agent_vision 区分缺失与 lookup uncertain；quota 参数传递和 semantic writeback 明确传入完整来源，并删掉了多余的 authority 布尔标志。协议文档与两组聚焦测试解释和验证这一边界。

正向路径：被裁剪的已声明合法等待仍无 gap；0/4/64/512 层链均只读该目标和直接前置任务。负向路径：真正缺失保留 unresolved，读失败或返回错 ID 保留 uncertain，其他 Agent、excluded、非法 monitor 等仍使用原有规则。没有声明时新增精确读取为 0。#4059 的完整 causal coverage、projection、TS handler、文档及生命周期测试已一并复核。

对主干的风险

176 项 Python 回归和 18 项标准 premerge 全部通过，含真实 CLI、文件 authority、真实 TS evaluator 与公共边界检查。共享 TS reducer 与已通过 6 项 TS 测试及 typecheck 的 #4059 相同。fallback 仍是 advisory，不进入 acceptance replan 义务；完整来源不可获得时允许显示“不确定”。未运行真实 Goal、benchmark 或 PostgreSQL 集成，存储后端实现未修改。

我的整体评价

保留这条修复有价值，但优先级低于 #4059。相对 #4059 是 10 文件 +752/-16；当前 PR 页面包含依赖，因此应先合 #4059，再刷新 main 和本 PR 的最终差异。相关精简已经落地：单一 parser、单一 resume 规则、一次性有界来源、无额外 authority 标志，不再扩建依赖图框架。已推回原分支，仍待维护者重新评审；本次没有执行合并。

English verdict: APPROVE conclusion for acd302cedafe2b9c12d624ae0b92371f78cb92ff. Both requested changes are addressed: direct-dependency reads are bounded, and #4059 owns shared Vision parsing. 176 Python tests and 18 premerge checks pass. This fixes optional advisory accuracy and depends on #4059; merge that PR first and refresh the final diff. Author-owned review, pending maintainer re-review.

[cocolord]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewed exact head: 5f00200f554871eb5dae8a6d26e470efa5039c36; base 5008a30f2adf04e5fcf0d459d6deabfaf06a7ccd.

动机

这个 PR 修复的是可选 fallback advisory 的准确性：Vision 已结构化声明 target/successor Todo，但 compact status lane 会裁剪展示项，旧逻辑可能把“未展示”误判成“canonical Todo 不存在”，从而错误投影 vision_fallback_unresolved。这不改变 #4059 已收敛的 causal wait / acceptance 主决策，也不新建 replan 义务；目标只是让兼容性提示从完整权威来源判断存在性、等待状态和失败不确定性。相较于扩张 status 展示容量或重建依赖图，exact-id 读取是更小且与问题成因匹配的修复。

改动思路

live quota 从最新 agent Vision 的 typed fallback_declarations 提取最多 8 个 target/successor id，第一轮逐 id 读取 canonical Todo；仅当声明 Todo 的 resume_when 是 todo_done 或 monitor_changed 时，再读取一层直接依赖，因此上限为 16 次。读到的有限权威集合交给 goal-frontier fallback disposition，继续复用既有 ownership、exclusion、advancement task class、lifecycle 与 TypeScript resume evaluator。正向路径中，compact lane 即使裁掉合法 fallback，canonical target 和直接前置仍能证明它 runnable 或 validly waiting，不再产生 gap；负向路径中，真正缺失仍是 unresolved，读取异常或返回 Todo id 不匹配则 fail closed 为 vision_fallback_lookup_uncertain，不会把未知伪装成不存在。

具体改动

exact-head 相对当前 main 是 10 个文件、+752/-16。live_decision.py 负责有界 authority 读取；fallback_disposition.py 负责 advisory 分类；goal_frontier/__init__.py、should_run.py、should_run_prepare.py 与公共 quota.py 仅透传独立 fallback source 和 capability；semantic_replan_writeback.py 在已有完整 Todo source 的路径复用同一输入；协议文档明确 16 次上限与 advisory 权限边界。两组测试覆盖真实 CLI 容量、深链、读取失败、错 ID、ownership/exclusion、monitor wait、terminal disposition 和无声明零读取。

关键代码讲解

1. _fallback_authority_todo_ids 只从共享 goal_vision_read_model 解析后的 typed declarations 收集 target/successor，不把 prose 或 declaration id 当 Todo id。
2. _live_fallback_authority_items 使用固定两轮读取：第一轮声明 Todo，第二轮直接 resume dependency；深度 0/4/64/512 的 fixture 都只读取 fallback 与其直接 prerequisite，消除了旧 head 的传递闭包。读取异常、非法对象或 identity mismatch 统一返回不可用来源。
3. _authoritative_fallback_disposition_ids 用现有 Todo predicates 和 evaluate_todo_resume_conditions 区分 runnable、valid waiting、uncertain；peer claim、当前 agent exclusion、非 advancement monitor、非法状态继续按既有 typed owner 判定。
4. declared_fallback_gap_from_agent_vision 将 authoritative absence 投影为 vision_fallback_unresolved，将 source 不可用或 provider evidence 缺失投影为 vision_fallback_lookup_uncertain；fallback_gaps 保持独立 advisory，不进入 acceptance replan stream。
5. quota / frontier 的参数透传把实时 exact source 与普通 planning source 分开，避免 compact presentation lane 获得它没有的 completeness authority；writeback 已有完整 source 时直接复用，不增加 I/O。

对主干的风险

主要风险在 quota 热路径额外同步读取和 incomplete-source 语义。读取量现在由 typed declaration 上限与一层依赖共同封顶为 16，且没有声明时为 0；它不会随无关 deferred Todo 数量或依赖链深度增长。发生 authority failure、identity mismatch 或 capability evidence 缺失时结果保守为 uncertain，不会错误解除或制造执行权限。该 advisory 不授予 quota、ownership、gate、replan 或 lifecycle authority；核心 obligation 仍由既有 typed control-plane owner 决定。

独立验证覆盖 exact head：59 个相关 Python tests 通过；control-plane TypeScript typecheck、changed-path Ruff、git diff --check、公共/私有边界扫描通过；loopx canary premerge --from-git-diff --goal-id loopx-product 为 18/18 通过、0 manual hold。远端 DCO、dependency review、Frontstage/release build、Python shards、stage2c installed/e2e/mutants、Windows、pytest、Sonar 与 merge-gate 均成功或预期 skip。聚焦 mypy 会触发仓库既有全量基线（917 errors / 126 files），因此未把它误报为本 PR 新失败；未运行真实 Goal、benchmark 或生产存储集成，且本 PR 未修改这些边界。

我的整体评价

APPROVE conclusion（author-owned COMMENTED fallback）。旧 review 的两个阻塞项均已在 exact head 解决：canonical read 不再递归遍历，Vision parsing/read model 由已合并的 #4059 单一 owner 提供；分支也已刷新到当前 main，独立 diff 仍严格为 10 个文件。实现范围与问题影响相称，正负路径、默认无声明路径和权限边界都有回归。future-facing pass 已在当前 PR 内完成 owner 收敛与 typed boundary 复用，无需再引入 capability、provider、依赖图框架或额外兼容层。剩余动作只是由非作者维护者在新 head 上重新评审；本结论不执行合并。

English verdict: APPROVE conclusion for exact head 5f00200f554871eb5dae8a6d26e470efa5039c36 (published as COMMENTED because this is author-owned). Both prior blockers are resolved: canonical reads are bounded to declared IDs plus direct dependencies, and merged PR #4059 owns shared Vision parsing/read-model semantics. The branch is refreshed to current main; 59 focused Python tests, control-plane typecheck, 18/18 premerge canaries, boundary checks, and remote CI pass. No merge was performed; maintainer re-review is requested.

[cocolord]

@huangruiteng PR #4059 is now merged, and #4061 has been refreshed to current main at exact head 5f00200f554871eb5dae8a6d26e470efa5039c36.

Both blockers from the earlier review are addressed: canonical fallback lookup is bounded to declared IDs plus one layer of direct dependencies (max 16 reads), and the shared Vision parser/read model is owned by the merged #4059 implementation. The independent diff remains 10 files, +752/-16; focused validation, 18/18 premerge canaries, and remote CI are green.

I could not add a formal review request because the author account lacks RequestReviewsByLogin permission, so this comment is the explicit re-review request for the new exact head. The full bilingual exact-head review is here: #4061 (review)

[cocolord]

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

Reviewed exact head: 5f00200f554871eb5dae8a6d26e470efa5039c36; integration baseline: 5008a30f2adf04e5fcf0d459d6deabfaf06a7ccd.

动机

原问题真实存在：compact Todo lane 裁剪了仍存在且合法等待的 fallback，旧提示把“没有展示”误判为“没有可用路径”。独立真实 CLI 对照确认，加入 20 个无关 deferred Todo 后，baseline 错报 vision_fallback_unresolved，本 head 消除了该误报。扩大展示容量不能解决完整性问题；从既有 Todo authority 读取声明 id 是合理的修复边界。

但重新审查整个 PR 后，当前仍不能批准：新的分类把“resume 条件尚未满足”直接当作“合法等待”，漏掉了现有规则对 todo_done:<continuous_monitor> 的排除，反而隐藏了这类无效 fallback。

改动思路

quota should-run 从最新 agent Vision 读取既有 typed declarations，经 list_goal_todos 获取最多 8 个 target/successor 及一层直接依赖，再交给 goal-frontier advisory 分类。Todo 存储、ownership/exclusion 谓词和 TS resume evaluator 仍由既有模块负责；只新增读取和派生提示，没有新增持久状态、CLI opt-in 或执行权限。

相对上轮 reviewed head 8e0476d5b3146eaec179b2c7aea934e11e8e8d66，两个原 P1 已处理：依赖遍历改为固定两轮；Vision parser/constants 复用已合并 #4059 的 goal_vision_read_model。本轮重跑深度 0/4/64/512 的真实 CLI 测试，均只读取声明目标与直接 prerequisite；无声明测试为零次新增读取。这些修复不应被撤回。

具体改动

完整独立 diff 是 10 个文件、+752/-16：7 个生产文件 +282/-14，2 个测试文件 +462/-2，1 个协议文档 +8。新测试保护容量、深链、缺失、读取失败、错 id、ownership/exclusion、monitor generation 与 terminal disposition；文档声明读取上限以及 advisory 不产生 replan 义务。

关键代码讲解

1. live_decision.py::_live_fallback_authority_items（约 60–122 行）在真实 quota 入口读取 exact ids；固定两轮及 parser 的四条声明上限共同限制调用数量。读取异常和 identity mismatch 返回 unavailable，交由提示层投影 uncertain。尚有一个 P2：list_goal_todos 对重复 id 返回 ambiguous=true, matched=true, todo_count=2, todo=null，105–107 行却把它与 not-found 一样跳过，最后产生 unresolved。独立 CLI 合成的 user/agent 重复 id 已复现；应先检查 ambiguity，再区分 not_found，不要把 authority 歧义称作确定缺失。
2. fallback_disposition.py::_authoritative_fallback_disposition_ids（约 187–269 行）复用 task class、claim/exclusion 和 TS resume evaluation，但第 260–263 行只根据 satisfied 分类。TS todo_done evaluation 只表达目标是否 done，不证明目标可作为合法等待对象；这是下述阻塞的根因。
3. declared_fallback_gap_from_agent_vision（约 272–425 行）在 blocked primary、有声明且非 terminal 时计算 gap；无完整来源时保留 uncertain，已创建/重开的 successor 与显式 terminal disposition 沿用既有规则。错误进入 waiting_ids 的 fallback 会在这里被消除，用户无法看到未解决提示。
4. goal_frontier/__init__.py 传入独立 fallback source、run evidence 与 capabilities，保持 fallback_gaps 独立于 acceptance/replan。公共 quota.py、内部 should_run.py 和 should_run_prepare.py 仅透传输入；semantic_replan_writeback.py 复用已有完整 source，无新增 authority I/O。未发现这些透传改变 quota、ownership 或写回权限。

对主干的风险

[P1] 保留对 todo_done:<continuous_monitor> 的等待资格排除。 位置：fallback_disposition.py:260–263。

触发场景：主线任务合法等待普通 prerequisite；另一个声明的 fallback 是 deferred advancement Todo，resume_when=todo_done:todo_monitor；todo_monitor 是持续运行的 continuous_monitor。没有 create/reopen successor，也没有 terminal disposition。

同一合成 fixture、同一真实 quota should-run --verbose 入口，baseline 保留 vision_fallback_unresolved，本 head 删除了整个 fallback_gaps。两边 should_run 都是 false。新代码把 evaluator 的 satisfied=false 当成合法 waiting；旧 todo_summary_blocked_successor_items 明确排除 monitor target，TS planTodoExternalWait 也明确拒绝以 todo_done 等待 continuous monitor，要求使用 generation-fenced monitor_changed。这不是无关的严格化建议，而是现有等待资格的回归：一个通常不会完成的 monitor 可以让不可用 fallback 长期静默。

最小修复：在现有等待资格 owner 中保留这条规则并供 fallback 分类复用，不再以 satisfied=false 单独证明 valid waiting；合法 monitor_changed 仍按 generation/baseline 判断。补真实 CLI 反例：上述输入必须保留 unresolved，而普通 Todo prerequisite 和合法 monitor_changed 等待仍不产生假 gap。不要扩展依赖图或增加第二套 prose/state authority。

独立验证：59 个相关 Python tests、13 个 Todo resume/Vision coverage TS tests、control-plane typecheck、仓库支持版本的 isolated changed-path Ruff、git diff --check 均通过。额外 baseline/head CLI 对照验证了容量修复、无声明默认路径、旧 monitor 规则回归与 ambiguous-id 分类；普通小容量及无声明场景的已比较 decision/obligation/frontier 输出一致。缺失 todo_done dependency 的等待行为在 baseline 已存在，未算作本 PR 新缺陷。最初未固定版本/配置的 Ruff 读到了额外规则；使用仓库支持版本与独立默认配置复核后通过。

这些都是合成隔离 fixture，未操作真实 Goal 或 benchmark；未独立运行 PostgreSQL 集成或全套 premerge canary，本 PR 未修改存储实现。远端 CI 已回读，无失败或待运行项。当前已复现的语义回归足以阻止批准，不以绿色测试覆盖掉它。

我的整体评价

REQUEST_CHANGES。 原两个阻塞已修复，整体边界与规模可以成立，但最新 head 仍有一个已复现的等待资格回归，另有一个 authority ambiguity 的 P2。影响限于 fallback advisory，未证明存在执行权限绕过；仍需修复，因为提示准确性就是这个 PR 的交付目标。

future-facing pass：共享 parser 的收敛已完成；当前最有价值的小范围改进是复用等待资格规则，避免 pending 与合法 waiting 在两个消费者中分叉。修复后重跑真实 CLI 正反路径、容量/深链、无声明默认路径，并基于新 exact head 重新评审。本次不合并。

English verdict: REQUEST_CHANGES on exact head 5f00200f554871eb5dae8a6d26e470efa5039c36. The previous unbounded-read and duplicate-parser blockers are resolved, but a real CLI baseline/head counterexample shows that the new classifier accepts todo_done:<continuous_monitor> as a valid wait and suppresses the unresolved fallback advisory. Preserve the existing wait-eligibility rule and add the counterexample; also distinguish ambiguous canonical ids from not-found (P2). 59 Python tests, 13 TS tests, control-plane typecheck, supported-version isolated Ruff, and diff checks pass. This is an advisory regression, not an observed execution-authority bypass.

[cocolord]

The findings in the latest review are addressed in b27a7a000b8b98d164a81c708172a4a3634a6d10:

• Wait eligibility: fallback classification now reuses the existing non-monitor wait predicate. Pending todo_done:<continuous_monitor> retains vision_fallback_unresolved; valid monitor_changed generation waits still work. The shared predicate extraction preserves the existing ordinary successor selection behavior.
• Canonical ambiguity: ambiguous IDs, identity mismatches and failed reads remain uncertain. Failed authority reads are now distinguished from legacy callers that omitted a source, preventing compact display evidence from masking a known failure. Only explicit canonical not-found proves absence.

Validation on this head: 115 Python tests, 13 TS tests, control-plane typecheck, isolated supported-version Ruff, and 18/18 standard premerge checks pass, with no manual holds or boundary findings. Four new monitor/ambiguity counterexamples failed before the fix; all eight paired monitor/ambiguity cases pass afterward. Coverage also includes small/compacted lanes, depth 0/4/64/512, no-declaration zero reads, failure/identity mismatch, legacy positive evidence, and the existing monitor repair route. Real CLI baseline comparisons confirm ordinary/no-declaration behavior and restoration of the rejected monitor-wait advisory.

The branch is refreshed to main 04ff4204d1abb133d97dc7353d31242bb032eb97; the PR remains based on main. Remote CI for this exact head has completed: 16 successful checks and 3 expected skips, including a successful merge-gate. PostgreSQL integration was not run because the storage implementation is unchanged; validation used isolated synthetic state and the real CLI/TS runtime. No live Goal or benchmark was operated.

The two reported defects are fixed in this head. This is an implementation and validation update; maintainer re-review is still required. No merge was performed.

[cocolord]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Exact head reviewed: b27a7a000b8b98d164a81c708172a4a3634a6d10

动机

这个 PR 解决的是 Vision 声明 fallback 后，quota / goal-frontier 只能从有界展示摘要判断 Todo 是否存在、可运行或正在合法等待的问题。旧路径把“没有出现在展示 lane”近似成“canonical Todo 不存在”，既可能制造假的 vision_fallback_unresolved，也可能把普通 todo_done:<continuous_monitor> 错认成合法等待；同时，ambiguous id、authority 读取失败和明确 not-found 没有形成不同的 typed 结果。受影响的是 heartbeat 的 quota should-run、semantic replan writeback 和 goal-frontier projection：错误分类可能隐藏真正未解决的 fallback，或把 authority 不确定性投影成需要用户处理的 gate。

本 head 的目标边界是合理的：只为 Vision 已声明的 target/successor 做 exact canonical read，并只追一层 resume dependency；没有扩大成全量 Todo 扫描，也没有引入新的 scheduler、Todo lifecycle 或用户权限模型。

改动思路

入口仍是 live quota decision。_fallback_authority_todo_ids() 从当前 agent Vision 提取声明过的 Todo id，_live_fallback_authority_items() 通过现有 list_goal_todos() authority 边界逐项读取这些 id，并为 todo_done / monitor_changed 只补一层直接依赖。四条 declaration 最多包含八个 target/successor，再加八个直接依赖，因此 exact read 上限为 16；无声明时为零读取。

读取结果经 FallbackTodoSource 贯穿 build_live_quota_should_run_decision()、build_quota_should_run()、prepare 与 semantic replan writeback，最终由 declared_fallback_gap_from_agent_vision() 分类。明确 not-found 可以作为缺失证据；ambiguous id、identity mismatch、remote/local authority 异常或非标准响应统一映射为 FallbackTodoReadState.UNAVAILABLE，投影为 lookup uncertainty，而不是伪装成不存在。

正向路径：Vision 声明 fallback → exact read canonical Todo 与一层依赖 → 复用现有 ownership、task class、open/deferred、resume evaluator 规则 → runnable 或合法 waiting 时不产生 unresolved gap。负向路径：authority 无法给出唯一且身份匹配的 Todo → fail closed 为 uncertain gap，并建议重读完整 canonical source，不制造 user gate。普通 todo_done:<continuous_monitor> 不再被当作 waiting；合法的 monitor_changed:<id> generation-fenced wait 仍保留。

具体改动

• fallback_disposition.py 引入 FallbackTodoReadState.UNAVAILABLE 与 FallbackTodoSource，区分 legacy caller 的“未提供 source”和 live authority 的“读取失败”；新增 authoritative disposition 分类，复用现有 Todo ownership/actionability/task-class predicates 与 TS resume evaluator，并分别输出 unresolved 与 lookup-uncertain reason/action。
• live_decision.py 新增声明 id 提取和有界 exact-read 实现。只读取 declaration 的 target/successor 与一层直接 resume dependency；明确 not_found 才按缺失继续，ambiguous、异常、类型或 Todo identity 不匹配都返回 UNAVAILABLE。
• deferred_resume.py 抽取 todo_resume_condition_is_non_monitor_wait()，让普通 blocked successor 与 fallback 分类共享同一个规则：standing continuous monitor 不能作为 todo_done prerequisite，monitor generation wait 由 typed resume evaluator 单独验证。
• should_run.py、should_run_prepare.py、quota.py、semantic_replan_writeback.py 和 goal-frontier export 只负责 typed source 的参数贯穿，没有复制第二套状态机。
• 协议文档补充 exact read 的 16 次上限、ambiguous/unavailable uncertainty 以及 monitor wait 边界。
• 两组 Python 回归覆盖真实 CLI 的容量上限、深链不递归、无声明零读取、明确 not-found、authority failure、错误 identity、duplicate/ambiguous id、open/deferred fallback、monitor completion 与 generation wait。

关键代码讲解

1. _live_fallback_authority_items() 是 I/O 边界：第一轮读声明 Todo，第二轮只读第一轮暴露的直接依赖；循环次数固定，避免递归链与全库扫描。
2. FallbackTodoReadState.UNAVAILABLE 是关键 typed state：它保留“authority 没有可靠回答”的事实，防止 compact summary 或空列表覆盖不确定性。
3. _authoritative_fallback_disposition_ids() 是语义分类边界：runnable、validly waiting、uncertain 三类分开，并继续由现有 predicate / evaluator 决定 ownership、lifecycle 和 resume 合法性。
4. todo_resume_condition_is_non_monitor_wait() 消除了 fallback 与 ordinary successor 对 monitor completion 的规则漂移；monitor_changed 仍走 generation-fenced typed 路径。
5. declared_fallback_gap_from_agent_vision() 只在 authoritative source 确认后输出 unresolved；source omitted/failed 或 provider evidence 缺失时输出 uncertainty。

对主干的风险

主要风险在 quota 热路径新增最多 16 次 exact Todo read，以及 Python projection 对 TS resume semantics 的调用。该机制与问题规模相称：读取集合由最多四条 Vision declaration 严格派生，没有全量 list、二层依赖或隐藏重试；无 declaration 时保持零读取。异常路径 fail closed，不会把 authority 故障降级成“Todo 不存在”，也不会新增生产动作、权限或用户 gate。

我独立验证了 exact head：108 个相关 Python tests 通过；23 个 Todo resume / Vision TypeScript tests 通过；control-plane TypeScript typecheck 通过；changed-path Ruff 通过；premerge canary 18/18 通过（含 quota、scheduler、interaction、maintainability 与 public boundary）；git diff --check、DCO 和新增行私有信息扫描通过。远端 CI 为 16 个成功检查和 3 个预期 skip，无 pending/failed。

剩余风险不是本 head 的逻辑 blocker：复核期间 main 已前进 2 个提交，PR 当前为 BEHIND。合并前应更新到最新 main，并以更新后的新 head 重跑检查；本结论只绑定上述 exact head，不自动延伸到未来 merge/rebase head。

我的整体评价

APPROVE（以 COMMENTED review 记录，因为这是 author-owned PR，GitHub 不允许正式 self-approval）。

此前两个 blocker 已在该 exact head 被完整修复：todo_done:<continuous_monitor> 不再隐藏 unresolved fallback；ambiguous canonical id 不再被当成 not-found。实现把 authority uncertainty、合法 waiting 与真实缺失做成显式 typed 分支，复用了既有 Todo/TS owner，没有靠 substring 或产品特定文案建立新规则。改动虽然包含较多回归覆盖，但生产机制保持有界、可解释且可回滚；未发现新的 P0/P1/P2 finding。

---

English verdict — APPROVE (recorded as COMMENTED because this is an author-owned PR). Reviewed exact head b27a7a000b8b98d164a81c708172a4a3634a6d10. The previous monitor-wait and ambiguous-id blockers are fixed: ordinary todo_done waits cannot use a standing monitor, valid monitor_changed waits remain generation-fenced, and ambiguous/unavailable authority reads project typed uncertainty rather than false absence. Validation passed: 108 focused Python tests, 23 focused TypeScript tests, control-plane typecheck, Ruff, 18/18 premerge canaries, diff/DCO/public-boundary checks, and all non-skipped remote CI. No remaining blocker found on this exact head. The PR is now two commits behind main; update the base and rerun checks before merge.

[huangruiteng]

Reviewed exact head: b27a7a000b8b98d164a81c708172a4a3634a6d10.

动机

这个 PR 的原问题真实且值得修：Agent Vision 已 typed 声明 fallback，但旧 goal-frontier 只从有容量上限的 Todo 展示摘要判断目标是否存在、可运行或合法等待；无关 deferred Todo 增多后，canonical state 中真实存在的 fallback 会被裁掉并误报 vision_fallback_unresolved。展示容量不能成为完整性 authority，最小正确边界是只 exact-read 声明的 target/successor 与 resume evaluator 所需的一层直接依赖。

相对早期 review，当前 head 已处理无界传递读取、重复 Vision parser、todo_done:<continuous_monitor> 等待资格和 ambiguous-id 被误当 not-found 等问题；但整个 exact head 重新审查后仍有一个真实 lifecycle 反例：monitor_changed 的 target 已 done 且 generation 未越过 baseline 时，fallback 仍被当成“合法等待”，从 projection 中静默消失。

改动思路

live quota 从最新 Agent Vision 的 shared read model 取得最多四条 declaration，_live_fallback_authority_items() 对最多八个 target/successor 做 canonical lookup，再只读最多八个直接 todo_done/monitor_changed dependency。明确 not-found 可以证明缺失；异常、ambiguous、identity mismatch 或非标准 projection 返回 typed UNAVAILABLE。结果经 quota/prepare/semantic writeback 参数传入 goal frontier；fallback reducer 复用既有 task class、ownership/exclusion、lifecycle predicates 与 TypeScript resume evaluator，输出 runnable、waiting、uncertain 或 unresolved。这个 source/owner 划分与 16-read bound 是合理的，且没有新增执行、quota、gate 或 replan 权限。

正向 real-CLI 对照也成立：同一 canonical fallback 加 20 个无关 deferred Todos，base 错报 unresolved，本 head 不再受 display compaction 影响；open continuous monitor、baseline=3、generation=3 的合法 monitor_changed wait 也从 base 的 unresolved 修正为 no gap。

具体改动

完整 diff 为 11 个文件、+892/-27：8 个生产文件 +333/-25，2 个测试文件 +548/-2，协议文档 +11。

关键代码讲解

1. live_decision.py::_live_fallback_authority_items 用固定两轮 stable exact read：第一轮 declaration ids，第二轮仅第一轮 Todo 的直接 resume target。更深 dependency chain 不参与本次 disposition；无 declaration 时为零读取。
2. fallback_disposition.py::FallbackTodoReadState.UNAVAILABLE 保留“authority 没有可靠回答”的事实；legacy caller 的 omitted source 仍可使用 compact positive evidence，但不能把遗漏升级为 absence。
3. fallback_disposition.py::_authoritative_fallback_disposition_ids 是当前 finding 所在的语义边界。它正确复用 TS evaluation 和 ownership/lifecycle predicates，但 275-279 行对 condition.kind == "monitor_changed" 只要求 satisfied=false 且没有 invalid_state，没有检查 target_status 是否仍为 open。
4. resume_condition.ts::conditionFor 会把 done continuous monitor 投影为 target_status=done, satisfied=false；external-wait authoring 的同一 owner 则明确要求 monitor_changed target 必须是 open continuous monitor。Python shortcut 因此扩大了“可继续等待”的语义。
5. quota、goal-frontier 和 semantic writeback 的其余参数贯穿没有复制第二套 parser/state machine；协议文档也正确声明 fallback_gaps 只是 advisory。

对主干的风险

[P1] 已结束且 generation 未变化的 monitor 不能继续证明 fallback 合法等待。 触发状态是：fallback 为 open/deferred advancement Todo，resume_when=monitor_changed:todo_monitor，resume_monitor_generation=3；dependency 为 task_class=continuous_monitor,status=done,material_change_generation=3。真实 file-backed CLI + canonical Todo lookup + real TS runtime/evaluator 对照显示：base 保留 vision_fallback_unresolved，本 head 的 fallback_gaps 为空；两边 should_run=false。这不是执行权限绕过，但会让一个已经不可能产生下一 generation 的 fallback 无限静默，直接违背本 PR “只有合法等待才能消除 gap”的交付目标。

现有 47 个 changed Python tests 全绿仍没覆盖它：名为 monitor-completion-is-invalid 的 case 实际测试的是 todo_done 指向一个 open monitor，而不是 monitor_changed 指向一个 completed monitor。最小修复是：对 satisfied=false 的 monitor_changed 同时要求 target status=open、task class=continuous_monitor、baseline 有效；最好由 shared TS resume owner 投影 waitable/invalid lifecycle，Python 只消费 typed result。若 generation 已经大于 baseline 后 monitor 才完成，应保留 satisfied/runnable 语义并补对应回归。

独立验证：两组 changed Python tests 47/47、typed resume TS tests 7/7、control-plane typecheck、changed-path Ruff、git diff --check 通过；远端 16 success、3 expected skip，无 pending/failed。baseline/head harness 同时证明 capacity/open-monitor 修复和上述 done-monitor 回归。未运行 PostgreSQL 集成，因为本 PR 没改 storage implementation/transaction/migration；fixture 使用隔离文件 authority，没有操作真实 Goal。

我的整体评价

REQUEST_CHANGES。 之前的 unbounded read、owner duplication、monitor-completion authoring 和 ambiguity blockers 已实质解决，整体机制也与原问题相称；但最新 head 在相邻的 monitor lifecycle 分支仍有可复现的语义漂移，不能用绿测或 earlier approval 继承覆盖。future-facing pass 应只把“pending monitor waitability”收敛到 shared typed resume owner，不要再新增 Python prose rule、dependency graph、source flag 或 capability。修复并更新 main 后，请用同一 real-CLI 正反 paired cases 对新 exact head 复审。

English verdict: REQUEST_CHANGES on exact head b27a7a000b8b98d164a81c708172a4a3634a6d10. The bounded canonical lookup, shared Vision owner, ordinary monitor-completion rule, and ambiguity handling are fixed. However, a real CLI/base-head counterexample shows that an unsatisfied monitor_changed fallback is still accepted as waiting after its continuous monitor is already done at the unchanged generation, suppressing vision_fallback_unresolved indefinitely. Require an open monitor for the pending state (while preserving an already-satisfied generation fence) and add the completed-monitor pair through the real CLI/TS boundary. 47 focused Python tests, 7 TS tests, typecheck, Ruff, diff checks, and remote CI pass, but the existing tests do not cover this lifecycle state.

[cocolord]

Exact-head repair and re-review

Reviewed and repaired head: 661c4e67a8ef2c39b906c984f4a0215e2bdfe6f6.

The PR remains useful: it preserves typed fallback waiting and authoritative-lookup uncertainty instead of treating every non-runnable fallback as absent. The prior review found one real P1 in that otherwise-valid direction: an unchanged monitor_changed condition was accepted as a durable pending wait even after its target continuous-monitor Todo was already done, so vision_fallback_unresolved could be suppressed forever.

The repair keeps resume evaluation in the existing TypeScript-owned boundary and narrows only the Python fallback disposition:

• satisfied=true remains runnable, including when a generation increase and monitor completion are observed together;
• satisfied=false monitor_changed is now a valid pending fallback only when the typed target is still an open continuous_monitor;
• an unchanged generation against a completed monitor now projects vision_fallback_unresolved instead of pretending that future progress is still possible.

Paired regression cases cover both the fail-closed completed-monitor path and the already-satisfied generation path, in addition to the existing valid-open-monitor and missing-baseline cases.

Validation on this exact head:

• 57 focused Python tests passed across fallback disposition, fallback wait admission, and external wait lifecycle;
• 7 TypeScript todo_resume_condition tests passed;
• Ruff and git diff --check passed;
• loopx canary premerge --from-git-diff --goal-id loopx-product passed all 18 selected checks, with zero failures, warnings, or manual holds;
• public/private boundary check passed.

Future-facing scope review: no new state machine or duplicate authority was added. The small related improvement was to make fallback admission consume the typed evaluator's existing target_status and target_task_class fields, which keeps the change local and reversible.

Conclusion: the PR still has a valid, distinct purpose and should remain open. The identified P1 is fixed at this exact head; please re-review the updated commit.

[cocolord]

Latest-main rebase/merge readback

Updated exact head: 345644dc662c5a6d900ddac0b8a8aa997fe8343c. The branch now contains current origin/main (dbacd1e55ae61884a7fb9910df3f2ecc5e5e541a); GitHub's previous merge conflict is resolved.

The conflict resolution follows the newer control-plane ownership boundary: current main deleted the legacy deferred_resume.py policy owner and moved resume planning to resume_planning.ts. This branch does not restore that deleted module. Fallback disposition now feeds evaluated resume facts through project_todo_resume_planning, while the completed-monitor rule remains narrowly enforced for monitor_changed.

Post-merge validation:

• 72 focused Python tests passed, covering fallback disposition, fallback wait admission, TypeScript-backed resume planning projection, and external-wait lifecycle;
• 15 TypeScript tests passed across todo_resume_condition and resume_planning;
• Ruff and git diff --check passed;
• public/private boundary check passed;
• the premerge runner selected 18 checks. Sixteen passed consistently. bounded-context-namespace-smoke.py and catalog-run-e2e-smoke.py each failed inside repeated aggregate runs but passed immediately when executed directly with the same Python 3.13 environment; an earlier aggregate run instead had only hot-path-interface-budget-smoke.py fail under system Python 3.9, and that smoke passed with Python 3.13. These are disclosed as environment/runner instability rather than claimed as a clean aggregate gate. No manual holds were reported.

The semantic blocker remains fixed and the branch is now based on latest main. Please use this exact head for the next review/check run.

[cocolord]

Latest-main necessity check

Exact head: fbfd499c61a4138d05f17eca1d803018838b9433. Baseline: current origin/main 87958a0f1ff2b4eccef750f11ff12df3187689b4.

I rechecked whether current main had made this PR obsolete. It has not: main still lacks canonical fallback lookup, typed lookup-uncertainty projection, and the completed-monitor fallback regression. git cherry reports all four behavior commits as independent of main. The only new main commit since the previous sync is #4223's settings UI work, which does not overlap this control-plane change.

The branch now contains that latest main commit without conflicts. The PR diff remains the same 10 control-plane/docs/test files (+927/-19); no settings UI file appears in the PR diff.

Post-sync validation:

• 72 focused Python tests passed;
• 15 TypeScript resume-condition/resume-planning tests passed;
• Ruff and git diff --check passed;
• branch worktree is clean.

Conclusion: continue this PR. Its bounded canonical read and fail-closed completed-monitor semantics are still absent from main, and the latest-main update did not require expanding scope. Please review this exact head.

[cocolord]

Recheck after main advanced through #4238

Exact head: 4d2d5a77aece5042c6e720166abe659d120f2c8b. Baseline: current origin/main 49cee5b30fef9f5bacddb548dc37809d7aa71be3.

Main advanced again while this PR was being checked, this time through #4238 in overlapping Vision/fallback files. I compared semantics rather than assuming overlap meant duplication. #4238 expands the bounded evidence-rich Vision packet and its checkpoint tests; it does not add canonical fallback Todo reads, vision_fallback_lookup_uncertain, or completed-monitor fallback admission. git cherry still reports all four PR behavior commits as independent of main, and the PR diff remains 10 files (+927/-19).

The new main commit merged cleanly. Post-merge validation expanded to include the new Vision budget/checkpoint coverage:

• 74 focused Python tests passed;
• 32 TypeScript tests passed across resume-condition, resume-planning, and Vision checkpoint;
• Ruff and git diff --check passed;
• worktree is clean.

Conclusion remains: continue #4061. The overlap with #4238 is at the same integration surface but implements a different invariant; closing #4061 would still leave bounded canonical fallback lookup and the completed-monitor fail-closed path absent. Please review this latest exact head.

[huangruiteng]

Reviewed exact head: 4d2d5a77aece5042c6e720166abe659d120f2c8b.

动机

这个 PR 修复的问题真实存在：Agent Vision 已用 typed declaration 指定 fallback Todo，但旧 quota / goal-frontier 从有容量上限的展示摘要判断目标是否存在、可运行或合法等待。无关 deferred Todo 增多后，canonical state 中真实存在的 fallback 会被裁掉并误报 vision_fallback_unresolved。早期修复又一度沿 resume chain 递归读取，在 heartbeat 热路径把 declaration 数量扩展成任意依赖深度。

当前 head 已把核心语义修到正确边界：只 exact-read 声明的 target/successor 与一层直接 resume dependency；明确 not-found、ambiguous/authority unavailable、runnable、合法 waiting 与 terminal 分开。上一轮发现的 completed-monitor 漂移也已修复：generation 未越过 baseline 且 monitor 已 done 时不能继续隐藏 unresolved；generation 已越过后即使 monitor 同时完成仍保持 runnable。

改动思路

live quota should-run 从 shared Agent Vision read model 提取最多四条 declaration、最多八个 target/successor id。_live_fallback_authority_items() 固定两轮：第一轮读声明 Todo，第二轮只读第一轮直接引用的 todo_done / monitor_changed target，最坏 16 次 exact read；无 declaration 时零新增读取，更深依赖绝不展开。

canonical 结果通过 typed FallbackTodoSource 进入 goal frontier。UNAVAILABLE 与 legacy caller 的 omitted source、explicit not-found 分开；authority failure、ambiguous projection 或 identity mismatch fail closed 为 vision_fallback_lookup_uncertain。实际 resume condition 继续由 TypeScript evaluator/planning owner产生，Python 只结合既有 ownership、exclusion、advancement task class 与 lifecycle predicates做 fallback-specific advisory 聚合。

具体改动

完整 diff 为 10 个文件、+927/-19：生产与协议文件新增 exact-read source、quota/semantic-replan 参数贯穿、typed uncertainty 与 disposition；两组 focused tests 共 563 行，覆盖 compact capacity 0/8/20、深链 0/4/64/512、无 declaration 零读取、not-found、authority exception、duplicate/ambiguous id、identity mismatch、ownership/exclusion、ordinary wait、open/done monitor 与 generation fence。

关键代码讲解

• live_decision.py::_live_fallback_authority_items 是唯一 live I/O owner：两轮固定循环，第二轮不会检查 dependency 自己的 resume_when，所以 read count 与深链无关。
• FallbackTodoReadState.UNAVAILABLE 保留“authority 没有可靠回答”的事实；compact positive evidence仍可给 legacy caller 使用，但 compact omission 不能升级成 canonical absence。
• _authoritative_fallback_disposition_ids 让 TS evaluator生成 condition，再复用现有 Todo predicates。unsatisfied monitor_changed 只有在 target 仍是 open continuous monitor 时才算 durable wait；satisfied generation 在 monitor close 后仍可 runnable。
• declared_fallback_gap_from_agent_vision 继续把 fallback_gaps 与 acceptance/replan obligation 隔离；recommended action 不创造 user gate 或 mutation authority。

独立验证：changed 两组 tests 49/49 通过；连同 adjacent resume-planning 与 external-wait owners 共 72 passed。Ruff 与 git diff --check 通过；远端 Python shards、stage2c、aggregate pytest、merge-gate、DCO、dependency 与 release build 均成功。未运行 PostgreSQL integration，因为本 PR 不改 store、transaction、migration 或 provider implementation；真实 file-backed CLI cases 已通过现有 canonical Todo reader 与真实 TypeScript runtime。

对主干的风险

代码语义没有剩余 P0/P1/P2 finding。最强反例——done monitor at unchanged generation——已被新的 paired regression 捕获；此前的无界 read、duplicate parser、ordinary todo_done:<continuous_monitor> wait 与 ambiguous-id-as-absence 也都已关闭。future-facing pass 认为不应在本 PR 新建 batch authority 或 fallback state machine；如果将来 canonical provider 提供一致性 batch read，可在不改变 advisory contract 的前提下降低混合时点风险。

但当前 exact head 仍有一个 P1 integration blocker：Frontstage Pages run 34589377400 在 required “Verify packaged Personal Workspace is current” step 重建后发现 loopx/web/chat/index.html 与 generated assets 变化。这个失败同样存在于 exact base 49cee5b30，而本 PR 没改 Dashboard source/package，所以它不是 fallback 逻辑缺陷；不过 policy-v3 不能在 exact-head required gate 为红时批准。#4239 的当前 head 已包含并验证 packaged Dashboard repair；请先让该修复进入 main，再把本分支更新到新 main 并重跑完整矩阵。

我的整体评价

REQUEST_CHANGES（仅剩 integration freshness/gate，代码 blocker 已关闭）。 当前实现的 source completeness、typed uncertainty、16-read bound、monitor lifecycle 与 advisory authority 都成立，927 行规模主要由多个历史漏测分支的回归覆盖支撑，整体 proportionate。不能因为失败继承自 main 就把 exact-head 门禁标成绿色，也不能要求本 PR夹带无关 generated UI 修复；正确动作是更新到已修复的 main 后重新跑 gate。

下一次无需重做这次已经绑定的代码结论，只要 head 变化后检查 merge diff、确认 fallback files 未漂移，并回读新的完整 hosted matrix。当前不合并。

English verdict: REQUEST_CHANGES on exact head 4d2d5a77aece5042c6e720166abe659d120f2c8b, solely for integration freshness. The previous unbounded lookup, duplicate owner, monitor lifecycle and ambiguity blockers are fixed; 72 focused tests, Ruff, diff checks and the full hosted Python/merge-gate matrix pass. Frontstage Pages still fails the required packaged Personal Workspace parity step because the exact base carries stale generated assets; this PR does not touch that surface, but policy-v3 cannot approve a red exact head. Land the packaged-dashboard repair, update this branch to the repaired main, and rerun the full matrix.

[cocolord]

已按最新 review 刷新并请求复审。

• 合入最新 origin/main：84334f794（包含 Dashboard 修复及 fix: harden decision-scope boundaries and CI isolation #4259 的 CI/browser smoke 隔离）
• 唯一冲突位于 loopx/control_plane/quota/live_decision.py imports；解析时同时保留本 PR 的 canonical fallback authority 读取，以及 main 的 typed project_agent_context 投影
• origin/main...HEAD 仍仅有本 PR 原来的 10 个同主题文件；merge base 已更新为 84334f794

本地验证：

• pytest 聚焦 fallback/quota/decision-scope：117 passed
• npm run typecheck:control-plane：passed
• npm run test:control-plane：1123 passed, 1 skipped
• Dashboard npm run build:chat 且 packaged assets clean：passed
• 新版分片 smoke:personal-workspace-packaged：passed（navigation-sorting, chat-recovery, typed-actions）
• public/private boundary、diff check、Python compile 及其余 16 个 selected canary/risk smokes：passed
• DCO：branch commits 均有 sign-off

loopx canary premerge --from-git-diff --goal-id loopx-product 唯一未通过项是 main 自身可复现的既有 heartbeat_prompt_json 热路径预算超限（3825 > 3600）。相关 producer、budget smoke 与协议文档均与 origin/main 无 diff；本 PR 没有抬高预算或扩大范围去掩盖该基线问题。

请基于 head 4877152c7 复审；远端完整 hosted matrix 将重新验证集成结果。

[cocolord]

最新 head 4877152c7 的 hosted matrix 已全部通过，包括：

• Frontstage Pages / packaged Dashboard build
• Dashboard acceptance
• kernel static checks
• 4 个 Python test shards
• Stage 2C e2e、mutants、installed
• Windows PowerShell
• minimum / forward Node compatibility
• aggregate pytest coverage gate
• final merge-gate

当前剩余状态仅为既有 CHANGES_REQUESTED review，等待 maintainer 基于新 head 复审；本分支不执行合并。

[huangruiteng]

Approval conclusion

审阅绑定 exact head：4877152c7763f53817f1a4410b5424443a51728b。结论：APPROVE。

动机

这个 PR 修复的是一个真实且会随队列规模反复出现的 source-completeness 缺陷：Agent Vision 已用 typed declaration 指定 fallback Todo，但旧 Goal frontier 从有容量上限的 compact summary 推断目标是否存在。无关 deferred Todo 增多后，同一 canonical state 会被误报 vision_fallback_unresolved。简单扩大展示上限仍不能证明完整；早期补丁沿整个 resume chain 递归读取又会把 heartbeat 热路径放大成任意依赖深度。正确边界是只读声明真正引用的 canonical facts，并把“明确不存在”和“权威读取不可靠”分开。

改动思路

live quota should-run 从最新 typed Vision 提取最多四条 declaration、最多八个 target/successor id；固定两轮 exact read，第二轮只读这些 Todo 的直接 todo_done / monitor_changed prerequisite，因此上限为 16，且无 declaration 时零新增读取。结果进入 Goal frontier 后，resume satisfaction 继续由现有 TypeScript evaluator / planning owner 产生；Python 复用 ownership、exclusion、task class 与 lifecycle predicates，只做 fallback-specific advisory 聚合。

正向路径中，展示裁剪不再改变 runnable / valid-waiting 判断；已满足 generation 即使与 monitor 完成同时出现也保持 runnable。负向路径中，真正 not-found 产生 unresolved，authority unavailable、ambiguous 或 identity mismatch 产生 vision_fallback_lookup_uncertain；generation 未变化且 monitor 已 done 时不能继续伪装成 durable wait。fallback_gaps 始终不创建 quota、ownership、acceptance、replan 或 mutation authority。

具体改动

当前 exact-head 独立 diff 为 10 个文件、+927/-19。约 364 行生产/协议改动完成 source acquisition、typed uncertainty 与参数贯穿；563 行测试覆盖容量、深链、zero-read、absence、authority failure、ambiguity、identity mismatch、ownership/exclusion、ordinary wait、monitor task class、open/done lifecycle 和 generation fence。相对上次维护者审阅，分支只是合入最新 main；git range-diff 证明四个 behavior commits 没有改写，冲突解析同时保留本 PR canonical fallback read 与 main 的 project_agent_context 投影。

关键代码讲解

• live_decision.py:43 的 _fallback_authority_todo_ids() 只接受 typed declaration 的 target/successor，不再把 prose 或 declaration id 当 Todo。
• live_decision.py:61 的 _live_fallback_authority_items() 用两个固定 pass 调用 exact list_goal_todos；0/4/64/512 层链都只读 fallback 与直接 prerequisite，失败、歧义和返回 identity 不匹配统一保留为 UNAVAILABLE。
• fallback_disposition.py:198 的 _authoritative_fallback_disposition_ids() 让 TS owner 先计算 resume facts，再复用既有 Todo predicates。unsatisfied monitor_changed 只有 target 仍是 open continuous_monitor 才算可持续等待；satisfied generation 不会被 terminal monitor 反向抹掉。
• fallback_disposition.py:321 将 authoritative absence 与 lookup uncertainty 分别投影，同时保留 legacy caller 的 compact positive evidence，但绝不让 compact omission 升格为 canonical absence。

对主干的风险

历轮发现的四类 blocker 已闭合：递归无界 I/O、重复 Vision/parser owner、todo_done:<continuous_monitor> 被当合法等待，以及 unchanged generation 在 monitor done 后无限隐藏 gap。独立 exact-head 验证为 77 passed，覆盖 fallback admission、frontier disposition、resume planning/condition 与 external wait；control-plane TypeScript typecheck、Ruff 和 git diff --check 全部通过。远端 exact head 共有 27 个成功 checks，包括四个 Python shards、stage2c、Windows、Dashboard/Frontstage、aggregate pytest、Sonar 与 merge-gate。

最强剩余风险是 16 次 exact read 不是同一个事务快照，并发编辑时可能观察到 mixed instant；但该结果只影响 advisory，任何 authority failure/identity mismatch 都 fail closed 为 uncertainty，不会授予执行权限。未来 canonical provider 若提供一致性 batch read，可以在不改变语义的前提下降低延迟与时点风险；当前 PR 不应为此再造 provider 或依赖图框架。

我的整体评价

APPROVE。当前实现把“有界显示不是完整事实源”的问题修在正确的 live authority 边界，同时把 resume decision 留在 TypeScript owner、把 fallback 维持为 advisory。代码量主要来自对历史细微语义回归的成套反例，而不是新框架；no-declaration default-off、真实 CLI、typed lifecycle 与 latest-main 集成都有证据。future-facing pass 已完成单一 parser/decision owner、固定两轮读取与明确 uncertainty，不需要继续扩大本 PR。

English verdict: APPROVE exact head 4877152c7763f53817f1a4410b5424443a51728b. The compact-lane completeness bug is fixed at the live canonical-read boundary: typed declarations authorize at most eight exact Todo reads plus one direct prerequisite layer, no declarations add zero reads, and deeper chains cannot expand the hot path. Existing TypeScript resume planning and typed Todo predicates remain authoritative; true absence, unavailable/ambiguous identity, invalid monitor waits, terminal monitors, and satisfied generation fences retain distinct semantics. The same four behavior commits survive the latest-main integration; 77 focused tests, typecheck, Ruff, diff check, and all 27 hosted checks pass. Residual risk is mixed-instant observation across separate reads, limited to conservative advisory output and suitable for a future batch-read optimization.

[huangruiteng]

Refinement update — 8c520fe

感谢 @cocolord 识别“展示裁剪不是 Todo 不存在”的问题。这次直接在原 fork 分支保留贡献历史，并将其收拢为面向两个 RFC 的 T3 consumer 改进。

动机

原方案仍有两个成本：每个目标/依赖都重新查询完整来源，可能混入不同 revision；Python 又维护一套 Monitor 等待与 fallback 聚合规则。反例还发现，同一声明的合法候选会被另一个缺失或不确定候选误伤。

改动思路

一次完整来源快照 → 最多 16 个目标/直接依赖记录 → TS 统一 disposition。复用 canonical reader、legacy parser、resume evaluator/planner 及正向 pending-target 证明，不新增 provider 或 Todo inventory。已加载的 replan 来源也复用同一有界 codec。

具体改动

• 删除逐 Todo 查询循环与 Python Monitor 特判；新 TS owner 组合既有 resume 规则。
• 按整条声明聚合：一个有效去向解决本声明，不会替其他声明清账；候选顺序不再改变结果。
• 保留 source-unavailable 与 source-absent 的区别、归档完成依赖和 generation 语义；读取失败不能回退 Markdown。
• 两份双语 RFC 保留执行卡、永久 projection 和 promotion hold。Refinement 相对 main 集成后的作者分支净减少 111 行产品代码，不把测试增长算作产品删除收益。

对主干的风险

有意收紧非法等待作为正向证据的使用：未绑定仓库的 PR 等待、归档 fallback 本身、矛盾 done 状态不能隐藏提示。Claim/exclusion、其他 agent 的 ownership 和 Monitor 非执行性不变。无声明不增加来源读取；提示仍是 advisory，不新增 quota/replan/user-gate/settlement 权限。整个 quota/status packet 的原子快照不在本次承诺内。

我的整体评价

保留原 PR 的增量价值，同时减少跨语言重复知识与多次查询。验证包含真实 CLI、File/SQLite、全 TS 内核及隔离 PostgreSQL、反例和风险 canary；精确结果与限制见更新后的 PR 描述。本次仅更新作者分支，等待新 head 的 CI 与独立评审，不沿用旧 head 的批准，不合并。

English verdict: implementation updated, fresh review pending for 8c520fe. One source snapshot and the existing typed resume owner replace repeated reads and Python policy duplication; alternative-resolution defects are covered by failing-before regressions. Original contributor history is preserved. No merge performed.

[huangruiteng]

动机

这次 PR 解决的是一个真实的配额公平性问题：当主路径被阻塞时，fallback 声明不应因为 compact Todo 展示只带出少量行，就被误判成不存在。当前 head 将 fallback 的事实读取收敛到一次有界的 canonical Todo snapshot，再让 TypeScript effect-runtime 负责 runnable / waiting / unresolved / uncertain 的分类；Python 只做来源读取和投影，这个方向与现有控制面边界一致。

我按 exact head 8c520fec18d35f8c6220a8b7c417c8eecae430f9 重读了 19 个文件（运行时 11、文档 5、测试 3），并复核了新增的 direct-dependency、duplicate、authority-unavailable 和 monitor-generation 覆盖。焦点 Python 测试 62 个通过，TypeScript fallback codec 测试 14 个通过；但这还不能证明安装发行物可用。

改动思路

live quota 路径先由 live_fallback_authority_items 读取被提升的 canonical authority（没有提升时才读状态文件），按最多四个 declaration 的 candidate IDs 加一层直接 todo_done / monitor_changed 依赖做选择，并把重复 ID 或坏行变成 UNAVAILABLE。declared_fallback_gap_from_agent_vision 将这些行标准化后调用 goal.fallback_disposition.project，TypeScript 再统一检查角色、claim、排除、archive、done、removed-continuation 和 resume condition。只有 runnable 或有正向 pending target 的 waiting alternative 才能消除 gap；缺少完整来源则是 uncertain，不能从 compact presentation 推断 absence。

这个 ownership 划分是合理的：Python 不再复制决策规则，TypeScript 复用现有 resume codecs，projection 仍然是只读的 advisory field，不会创建 Todo、授予 lease 或制造 user gate。真正的问题出在发布边界：新增 handler 位于 goals/goal_frontier/，但当前 wheel package-data 只声明 loopx.control_plane.goals 下直接匹配的 *.ts，没有声明这个子包。

具体改动

关键代码讲解

1. loopx/control_plane/goals/goal_frontier/fallback_disposition.py:165 的 declared_fallback_gap_from_agent_vision 删除了原先 summary-only 的 Python eligibility 判断，构造有界 source facts 和 resume request，再把最终 kind 转换成 fallback_gaps。source_state=unavailable 与 omitted 被明确区分，避免异常读取被当成 canonical absence。
2. loopx/control_plane/goals/goal_frontier/fallback_disposition.ts:80 的 projectFallbackDisposition 是新的 typed decision owner。Disposition union 和严格 decoder 让重复、越权 claim、monitor Todo、invalid condition 只能 unresolved/uncertain，且 alternatives 对 declaration 对称处理；这是正确的状态边界。
3. loopx/control_plane/effect_runtime_handlers.ts:80 静态导入该 nested handler，420 行将其注册为 effect method。静态导入发生在 server readiness 之前，因此发行物漏掉该资源时不是单个 fallback 失败，而是整个 effect runtime 无法启动。
4. loopx/control_plane/goals/goal_frontier/fallback_source.py:35 只在 vision 有 declaration 时读取 authority，并在 promoted canonical source 失败时拒绝回退到 Markdown；这个 completeness boundary 与新增 uncertainty 语义相符。

对主干的风险

有两个必须先解决的 P1：

1. wheel 缺少新 nested TypeScript 模块（P1）。effect_runtime_handlers.ts:80 引入 ./goals/goal_frontier/fallback_disposition.ts，但 pyproject.toml:55 的 package-data 仅是 "loopx.control_plane.goals" = ["*.ts"]，该 glob 不覆盖 goal_frontier 子目录。GitHub 的 stage2c (installed 0) 下载报告显示，wheel 安装成功后在 console_shadow_bootstrap 阶段以 EffectRuntimeStartupError 退出；build 也在 wheel/managed-runtime 校验处退出 1。也就是说 source checkout 的 62+14 测试全绿时，干净安装用户仍无法启动 effect runtime。

   最小修复：为 loopx.control_plane.goals.goal_frontier 增加显式 *.ts package-data（并确认其递归 import 的资源），或把 handler 放到已有打包边界；新增 wheel-content assertion 和 PYTHONPATH 为空的 installed startup/dispatch smoke。只有 build、stage2c (installed 0) 与 stage2c-correctness-e2e 重新通过后，才算验证了真正的交付边界。

2. exact head 不能合并（P1）。PR 当前 mergeable=CONFLICTING、mergeStateStatus=DIRTY，并有四个失败检查：build、stage2c (installed 0)、stage2c-correctness-e2e、merge-gate。分支基于旧 main；rebase 解决冲突很可能触碰本次 19 文件的决策/调用边界，所以不能把旧 head 的 focused pass 当成新 head 的通过证据。修复后请先 rebase current main，再读取新 head SHA、重跑所有 required checks，并请求一次完整 exact-head review。

我的整体评价

one-snapshot + typed effect owner 是解决 compact-lane false absence 的合适、可维护方案，测试也覆盖了不少过去容易遗漏的语义细节；我没有因代码量本身否定设计。但当前 head 在安装发行物层面会在启动前失败，同时与主干冲突、required checks 为红，属于可复现的交付阻断，而不是可以通过重跑或忽略来接受的环境噪声。因此本次为 REQUEST_CHANGES。请先修 package-data/installed runtime、rebase 并让四个红检查恢复，再以新的 exact head 复审。

English verdict: REQUEST_CHANGES — the typed fallback design is sound, but the new nested TypeScript handler is not included by the wheel package-data rule, causing the installed effect runtime to exit before readiness; the exact head is also conflicting and has four failing required checks. Repackage, rebase onto current main, rerun installed/build/stage2c/merge-gate validation, then request a fresh exact-head review.