refactor(frontier): unify typed revision and long-chain replan policy

[huangruiteng]

Summary

• Consolidate advancement-frontier selection, completeness, material identity, long-chain thresholds and exact ACK/rearm in the existing typed Todo owner. Python retains the persisted v0 codec and response adaptation.
• Preserve 15/20 thresholds, timestamp-only maintenance and terminal-row relevance. Explicit corrections: excluded unclaimed work does not rearm that Agent; duplicate selected identities or matching lanes cannot provide complete checkpoints.
• Address review: reject non-object typed index responses at the Python adapter boundary, without casts or ignores.
• Fix the formerly misclassified completed-history HTTP 503: full source facts exceeded the shared 2 MiB Effect request limit. Use bounded lossless transport for large sources, not truncation or a higher shared limit. TS still owns hashing and decisions.
• Rebase on current main and preserve both RFC migration records when resolving the documentation conflict.

Ownership and compatibility

Existing core Todo/frontier policy is the owner; no new capability, provider, storage transaction, writer or promotion route. The companion transport codec follows the existing compressed-facts pattern without introducing a general transport framework. Encoded requests retain the shared 2 MiB limit; decompression rejects invalid input or output above 64 MiB. Small requests remain plain facts.

No frontend change is necessary: completed-history HTTP and quota consumers keep their existing contracts. No claim, lease, user authorization, settlement, provider CAS/replay or optional-capability enablement changes. This closes one T3 consumer rule group, not the entire TS migration or shared-authority RFC.

Validation

Exact head: e2a0eedbc5ca152f575c157e046e214555f58eed; base: 37ca93ff7f4ea204f5c3eeb4f0bf910c0ec5d4f3.

• 87 focused Python tests passed, including real completed-history HTTP, real file authority with missing/stale display, ACK/rearm, terminal rules and malformed responses.
• Configured mypy (22 files), scoped frontier/long-chain mypy (2 files), Ruff and TypeScript typecheck passed.
• Direct TS frontier tests: 8 passed, including plain/compressed equivalence and malformed/oversized decompression rejection.
• Full npm run test:control-plane: 1,245 passed, zero skipped, including disposable real PostgreSQL 16 and file/local conformance. Temporary server stopped afterward.
• Premerge: 17/18 catalog/profile checks passed; direct checks 4/4; no manual holds. The remaining dashboard_status_json budget failure is identical on immutable main and final head (18,930 > 18,500). It is disclosed, not relabeled as success or addressed by increasing the budget.
• Exact quality receipt: cqr_7f6a28db49e0853f9af4, verified valid for 12 changed files. Scope fingerprint: 7f6a28db49e0853f9af4b533137fbe5afd7629bddb914ccbc15c1304df8cce9b.
• Regression sensitivity: the five malformed index cases failed before the guard. The 4,087-row HTTP case passed on immutable main and failed on the pre-transport-fix candidate with request_too_large; it now passes. A complete frontier larger than 2 MiB preserves the independent exact v0 digest and detects a tail-row material edit.
• Read-only production-complex snapshot replay: 278 Agent rows, 190 User rows, 4,456 archive rows, 473 canonical records, 10 Agent lanes. Latest main and final candidate match revision, quota decision, interaction mode and full frontier projection in legacy and isolated canonical-file modes; nine checkpoints remain complete and one incomplete. Source/display fingerprints unchanged; no live promotion or state writes. Raw evidence is not public.

Shared fixture impact: existing production-scale coordination fixture plus a complete-timestamp/unclaimed-exclusion variant covers checkpoint selection and rearm. New transport regressions complement it with long text, large complete source identity and invalid encoded inputs. No provider routing or promotion changes; snapshot replay is not a three-provider cutover qualification or performance claim.

No model-token qualification or live installation is claimed. Earlier hosted failures must not be represented as passing: the mypy failure and HTTP failure are both fixed here, not waived as environment noise.

[huangruiteng]

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

复核 exact head：1fe18bb3c52f4082ff8c355962c26a3a20b33b17

动机

这个 PR 的动机成立：advancement frontier revision、long Todo-chain threshold 与 ACK/rearm 目前仍由 Python 持有较多决策规则，会在 TypeScript control-plane 迁移期形成双重 authority。目标是保留 Python 对 legacy Todo 字段的归一化和精确 v0 JSON codec，把 lane selection、完整性、hash、15/20 阈值和 exact ACK 判断集中到 TypeScript。

改动思路

实现沿用了现有 effect_runtime_result 边界。Python 将 canonical Todo row 编码成稳定 facts，TypeScript 的 projectAdvancementFrontier 负责 all/unclaimed/by-agent index，evaluateLongTodoChain 负责 threshold 与 ACK；Python 再适配回现有 tuple/dataclass 接口。这样没有引入新持久化或 CLI，也删除了旧 Python 决策体。特别值得保留的是 excluded-only Agent 的显式 lane：它避免该 Agent 错误 fallback 到包含被排除工作的 global unclaimed checkpoint。

具体改动

• 新增 frontier_revision.ts，集中 row decode、checkpoint、index、threshold 和 exact ACK 规则。
• Python frontier_revision.py 只保留 legacy field serialization、normalization 和 response adapter。
• long_todo_chain.py 将 observe + ACK classification 合并为一次 typed request，保留 freshness timestamp fence。
• handler 注册新 effect operation；中英文 RFC 记录迁移后的 authority boundary。
• 测试覆盖稳定 hash、排序/时间戳无关性、excluded lane、duplicate fail-closed、15/20 阈值、exact ACK 和 material rearm。

关键代码讲解

1. loopx/control_plane/todos/frontier_revision.ts:63 的 checkpoint 统一 eligibility 与 material identity；duplicate id 或 invalid timestamp 都返回 incomplete。
2. loopx/control_plane/todos/frontier_revision.ts:132 的 evaluateLongTodoChain 保留 15 advancement / 20 open-with-advancement 两个阈值，并只接受 exact checkpoint ACK。
3. loopx/control_plane/todos/frontier_revision.py:99 的 build_advancement_frontier_revision_index 是 Python→TS adapter，也是当前唯一阻塞点。

对主干的风险

当前有一个确定的 P1：build_advancement_frontier_revision_index 在 line 102 直接返回 _request(...)["index"]。该 subscript 的类型是 Any，因此新 adapter 没有兑现声明的 dict[str, Any] 边界，required mypy 报：Returning Any from function declared to return "dict[str, Any]" [no-any-return]。我用同一 scoped command 比较了 exact base/head：base 通过，head 稳定失败，所以这是 branch-attributable regression。

最小修复：先把 index 绑定到局部变量，验证 isinstance(index, dict)；不满足时在 adapter 边界抛出包含 typed frontier response 上下文的 TypeError，满足时返回已经 narrow 的 dict；再加一个 typed runtime 返回非 object index 的回归用例。这样既让 mypy 通过，也把 malformed response fail-closed 在正确边界，而不是延迟到 summary consumer。

验证方面，4 组 focused Python suites 为 65 passed in 19.04s，direct TypeScript tests 为 7 passed，npm run typecheck:control-plane 通过；Hosted DCO、build、Node compatibility、Windows 和全部 Stage2c 通过。test shard 3 的 completed-todos HTTP 503 位于本 PR 未改动路径，我把它记录为独立 residual，不用它阻塞本结论；deterministic mypy regression 已足够要求修改。

我的整体评价

迁移方向、rule ownership、兼容 codec 和 negative cases 都合理，且 production 净减行，future-facing pass 不需要再扩一个抽象层。当前只需把 Python adapter 真正做成 typed/fail-closed boundary，并补 malformed response 测试。修复后重跑 scoped mypy、focused Python/TS suites 和 required checks，即可按新的 exact head 复审完整 PR。

English verdict: REQUEST_CHANGES — the TypeScript authority migration is well-scoped and semantically convincing, but the new Python adapter returns Any as dict[str, Any], fails the required mypy gate on this exact head, and needs explicit response decoding plus malformed-response coverage.

[huangruiteng]

Review follow-up — both regressions fixed

Final head: e2a0eedbc5ca152f575c157e046e214555f58eed (rebased on 37ca93ff7).

1. Reported P1 fixed: the Python index adapter explicitly narrows the response to a dictionary and rejects malformed/missing values with contextual TypeError. No cast or ignore. Five malformed-response cases failed before the fix and pass now; configured and scoped mypy pass.
2. Correction to the earlier review: the completed-history HTTP 503 was not an unrelated residual. The 4,087-row case passes on clean main but fails before this repair: transporting the full serialized frontier exceeds the 2 MiB Effect request bound. Large facts now use lossless bounded deflate/base64 transport; the global bound is unchanged, TS still owns the exact v0 hash, and no row is truncated. Existing real HTTP tests now pass. Added >2 MiB complete-frontier digest/tail-edit coverage and malformed/inflation-bound rejection.
3. Conflict resolved: retain both the upstream capability-gate closure and this frontier closure in the Chinese RFC.

Product and architecture judgment

The PR removes duplicate Python lane/revision/ACK decisions while preserving the v0 codec. Excluded work and ambiguous identities have explicit documented fail-closed corrections; thresholds, timestamp-only maintenance and terminal relevance remain covered. The transport companion change fixes an actual installed-user read path, not speculative infrastructure. No new provider, promotion, write authority, optional capability or UI behavior is introduced; existing CLI/status/history consumers benefit through the same owner. No additional broad refactor is warranted.

Final validation and merge decision

• 87 Python tests passed, including real HTTP, real file-store/missing-display replay, long-chain/terminal rules and negative transport cases.
• 1,245 TS tests passed, zero skipped, including isolated real PostgreSQL 16 and local/file conformance. Temporary server stopped.
• mypy (configured 22 files + 2 scoped adapters), Ruff, TS typecheck and public boundary scan passed.
• Same authorized production-complex snapshot, immutable main versus final head: 10 Agent lanes match in both legacy and isolated canonical-file modes for full frontier, revision, decision and interaction mode. Nine complete checkpoints and one incomplete remain unchanged. No active state writes; raw evidence stays private. This is not a promotion/three-provider-cutover claim.
• Premerge 17/18, direct checks 4/4, no manual holds. Remaining Dashboard budget failure is reproduced identically on clean main: 18,930 characters versus 18,500. No limit increase and no claim of all-green CI. Final hosted CI is newly queued/running.
• Exact quality receipt cqr_7f6a28db49e0853f9af4 verified valid, fingerprint 7f6a28db49e0853f9af4b533137fbe5afd7629bddb914ccbc15c1304df8cce9b, 12 files; one bounded repair pass, no unresolved scoped findings.

Decision: owner-authorized self-merge/admin bypass after the above risk-based validation; the identical baseline budget failure and pending hosted CI are explicitly disclosed, not waived as passing tests. No installation requested.