feat(todos): close canonical ownership update boundary

[huangruiteng]

Summary

• Close the next T1 boundary: promoted Todo ownership and executor-exclusion edits now use the existing typed public update transaction instead of falling back to a separate Markdown business path.
• Keep one TS planning/admission owner for claim transfer, claim clearing and exclusion changes. The operation is still an intent; it does not grant a lease or bypass lifecycle authority.
• Preserve the old legacy path for unpromoted Goals, while adding real CLI parity and replay/atomicity coverage for legacy, File and SQLite.

Semantic corrections

• A current claim owner may explicitly transfer a claim or clear it; another owner cannot edit the Todo.
• Ownership and exclusion intent is normalized before request identity is bound, so aliases and retries are deterministic. An old replay cannot restore a claim cleared by a later operation.
• A Todo cannot be transferred to an agent that is also excluded. Clearing a claim and excluding the former owner in one operation is allowed.
• Invalid ownership input fails before any copy or projection write. Leased ownership/exclusion changes remain rejected by the metadata transaction and must use the lease lifecycle operation.
• User-gate decision scope, terminal completion, Monitor observation, capability enablement and generic permission grants remain outside this change.

RFC value and refactor

The TypeScript migration RFC gains a concrete T1 ownership-edit closure. The shared-authority RFC gains one canonical intent/replay boundary while retaining its provider and promotion holds. The old Python route remains only as a compatibility adapter for unpromoted state; no second TS/Python ownership policy is introduced.

Before this PR, promoted updates allowed only copy/planning fields while legacy updates handled claimed_by, clear_claim and excluded_agents through a separate writer transaction. The same authoring scope, lifecycle authority, field planner, and metadata serialization assumptions were therefore interpreted in parallel. This PR routes promoted ownership intent through the existing public planner and removes that split, without deleting the still-live legacy writer.

Validation

• Tested revision: latest origin/main at branch base 18fda32fd; final commit carries DCO.
• Run state: finished
• Input classes: synthetic, public_fixture, authorized_private_read_only

Check kind	Result	Evidence / limitation
static	passed	Control-plane TypeScript typecheck, kernel mypy, changed Python Ruff and diff hygiene.
unit / integration	passed	Full serial TS suite: 1,206 tests, 1,205 passed, 0 failed, 1 environment-gated skip; focused update suite 32/32 passed.
real_backend	passed	Isolated PostgreSQL 16.15 authority conformance: 46/46 passed in a disposable database.
real_entrypoint / regression_parity	passed	Python ownership/planning CLI tests: 116/116 passed across legacy/File/SQLite, including dry-run, transfer, clear, exclusions, replay, malformed input and no-partial-write cases. Legacy and promoted projections preserve the same public result contract.
production-scale fixture	passed	Existing 400+ row coordination fixture is exercised by the shared planning conformance; no private records or live Goal state are committed.

• Coverage and gaps: the affected public CLI, typed planner, File/SQLite/NoKV conformance and isolated PostgreSQL provider are covered. One full-suite test is skipped when the optional PG environment is absent; it was separately run in the isolated PG arm above. This PR does not claim whole-Goal promotion, Monitor ownership edits, User-gate authority, service PostgreSQL routing, soak qualification or removal of the legacy writer.

Type of Change

• Bug fix
• Refactoring (bounded typed-authority consolidation)
• Test update
• Documentation update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)

Technical Direction

• Core control-plane hardening
• Shared Goal Authority and cross-host coordination
• Target base branch: main
• Direction tracker: T1 ownership/decision metadata closure; no D1–D3 qualification claim.

Shared-authority RFC fixture impact

• Production-scale fixture schema: existing loopx_coordination_production_scale_fixture_v0.
• Semantic dimensions: claim ownership, exclusions, normalization, replay identity, atomic invalid-input rejection and leased-operation fences.
• Provider conformance arms: File, SQLite, NoKV helper and isolated real PostgreSQL.
• Read-only legacy/File/PostgreSQL rehearsal: legacy CLI parity plus canonical File/SQLite and PostgreSQL authority transactions; no live registry or Goal mutation.

Boundary Checklist

• No private state, credentials, raw traces, internal links or local paths in the diff or this body.
• No benchmark launch, scoring or submission behavior changed.
• Scope is limited to Todo ownership/exclusion intent and the existing transaction boundary.
• Commit includes a DCO sign-off.

[huangruiteng]

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

动机

该 PR 关闭 promoted Todo ownership/exclusion 更新的一处分叉：此前 promoted 路径与 legacy writer 对 claim、clear_claim、excluded_agents 的规则可能并行解释，容易在归一化、重放和 leased-operation fence 上产生漂移。本次目标是让现有 typed public update transaction 成为 promoted ownership intent 的唯一入口，同时保留未 promoted Goal 的兼容 writer。

改动思路

authoring_scope.ts 先归一化 claim/clear/exclusion intent，todo_lifecycle_decision.ts 统一 actor、binding、exclusion 与 claim-owner admission，todo_update.ts 在有 lease 或 hard-lease 时阻断 metadata ownership rewrite，最终由现有 authority transaction 原子提交。该设计保持 ownership intent 与 execution lease、user-gate authority 的边界，不授予新 lease 或权限。

具体改动

关键代码讲解

• registeredTodoMutationRejection 集中注册 actor、排除和绑定关系的拒绝规则。
• normalizeTodoOwnershipIntent 在 replay identity 绑定前归一化 claim、clear_claim 和 excluded_agents，并拒绝互斥组合。
• targetRejection/todo_update.ts 将 ownership/exclusion edits 与 lease lifecycle 分开，防止 metadata 路径改写执行授予。
• update_goal_todo 将 Python CLI 参数适配为 typed intent，同时不删除 legacy 未 promoted writer。

对主干的风险

聚焦 Python ownership tests 与 TypeScript todo_update.test.ts 均通过，覆盖 transfer、clear、exclusion、replay、malformed input 和 no-partial-write。风险在于该 exact head 的 required windows-powershell、stage2c (e2e 2)、stage2c (mutants 0) 和 merge-gate 均失败；失败原因尚未在 PR 证据中闭合，因此 Windows 与完整端到端语义不能以其它平台通过替代。最小修复是定位失败、在同一 head 重跑并补充失败路径证据。

我的整体评价

REQUEST_CHANGES。设计边界和 focused coverage 合理，但 required checks 的红灯是明确交付阻断，当前不具备合并条件。审阅 head：da40ade7f3652eb182bf85b56d6865e84cdb5d74。

English verdict: REQUEST_CHANGES — head da40ade. Focused ownership tests pass, but windows-powershell, stage2c e2e 2, stage2c mutants, and merge-gate are failing; diagnose and rerun before merge.

[huangruiteng]

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

评审对象：#4273，exact head da40ade7f3652eb182bf85b56d6865e84cdb5d74。
本轮按 policy revision 3 重新核对完整 diff、Python facade、native/public update、TS plan、replay/negative paths 和远端检查；head 未变化。

动机

PR 要关闭 canonical Todo ownership update boundary：调用方传递 claim/transfer/clear intent，由 TypeScript 统一推导和提交，避免 Python、native path、public path 各自重建 ownership、binding、exclusion 规则。

改动思路

authoring_scope.ts 归一化 ownership intent，todo_lifecycle_decision.ts 持有 typed rejection，native_update_plan.ts/public_update.ts 组成一次 canonical mutation；Python facade 只适配外部参数和公共响应。receipt/replay 继续复用现有 authority transaction，不新造 recovery framework。

具体改动

• claim、transfer、clear 和 exclusion fields 进入同一 ownership intent/plan。
• canonical update 对 terminal/decision/observation 注入做 fail closed，重试不能恢复旧 owner。
• Python todos.py 不再提前推导完整 ownership 结果；公共/native callers 改走 canonical update。
• RFC、ownership tests、replay tests 和 typed plan tests 同步更新。

正向路径（首次 claim、合法 transfer/clear、replay）在 TS focused suite 中通过并保持原子性。反向路径（foreign owner、excluded actor、冲突字段）暴露了下面的真实契约回归。

对主干的风险

1. P1：公共 owner-mismatch 诊断发生未披露的语义漂移。 stage2c (e2e 2) 的 3 个真实公共入口用例仍期待 update_owner_mismatch 的稳定文本 Todo update cannot edit another claim owner's work，exact head 返回了泛化的 Todo update requires a registered, non-excluded actor within the existing owner/binding scope。error code 相同不等于完整公共响应兼容；调用方/操作者可能依赖这段可处理诊断。最小修复是保留 owner-mismatch 分支的旧文本，或明确发布兼容性变更并迁移全部消费者。
2. P1：mutation oracle 已失去 locator。 stage2c (mutants 0) 以 ValueError: mutation locator drift; review source and oracle 中止；这是重构后测试/验证边界没有跟随 owner 移动的真实失败，不是环境噪声。必须把 locator/oracle 指向新的 TS decision owner，并重新跑完整 mutation lane。
3. stage2c-correctness-e2e 因上述失败聚合失败；windows-powershell 也失败在同一 installer/quota skip 路径；merge-gate 因 required failures 失败，且 PR 当前 CONFLICTING。
4. 精确 head 的 focused TS ownership suite 17 passed，Python 相关集合 55 tests 中 3 个公共诊断用例失败；helper 绿不能掩盖公共入口和 mutation boundary 红。

我的整体评价

架构方向正确，且把业务 owner 收回 TS 是值得保留的重构；但 exact head 仍 REQUEST_CHANGES。先恢复稳定的 public error contract、修 mutation locator/oracle，再 rebase 解决冲突并重跑 stage2c、Windows 和 merge gate。不要用更新测试期望的方式掩盖未声明的产品响应变化。

English verdict: REQUEST_CHANGES — #4273 exact head da40ade7f3652eb182bf85b56d6865e84cdb5d74; three public e2e cases regress the owner-mismatch diagnostic, the stage2c mutation runner aborts on locator drift, Windows required checks fail, and the PR is CONFLICTING. Preserve or deliberately version the public message, repair the mutation oracle, rebase, and rerun the required lanes.

[huangruiteng]

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

动机

该 PR 关闭 promoted Todo ownership/exclusion 更新的一处分叉：此前 promoted 路径与 legacy writer 对 claim、clear_claim、excluded_agents 的规则可能并行解释，容易在归一化、重放和 leased-operation fence 上产生漂移。本次目标是让现有 typed public update transaction 成为 promoted ownership intent 的唯一入口，同时保留未 promoted Goal 的兼容 writer。

改动思路

authoring_scope.ts 先归一化 claim/clear/exclusion intent，todo_lifecycle_decision.ts 统一 actor、binding、exclusion 与 claim-owner admission，todo_update.ts 在有 lease 或 hard-lease 时阻断 metadata ownership rewrite，最终由现有 authority transaction 原子提交。该设计保持 ownership intent 与 execution lease、user-gate authority 的边界，不授予新 lease 或权限。

具体改动

关键代码讲解

• registeredTodoMutationRejection 集中注册 actor、排除和绑定关系的拒绝规则。
• normalizeTodoOwnershipIntent 在 replay identity 绑定前归一化 claim/clear/exclusion，并拒绝互斥组合。
• targetRejection/todo_update.ts 将 ownership/exclusion edits 与 lease lifecycle 分开，防止 metadata 路径改写执行授予。
• update_goal_todo 将 Python CLI 参数适配为 typed intent，同时不删除 legacy 未 promoted writer。

对主干的风险

聚焦 Python ownership tests（55 passed）、TypeScript todo_update.test.ts（18 passed）及 Ruff 均通过，覆盖 transfer、clear、exclusion、replay、malformed input 和 no-partial-write。但 tests/control_plane/test_shadow_observable_native_e2e.py 的三个真实 public-adapter 断言在 exact head 失败：update_owner_mismatch 的 decision code 保持不变，error/reason 却从既有兼容文本 Todo update cannot edit another claim owner's work 改成了泛化文本 Todo update requires a registered, non-excluded actor within the existing owner/binding scope。这是可观察 API 文本回归，不能只因 code 相同而忽略；应在共享 predicate 与 adapter message mapping 间保留旧的 owner-mismatch 文本，并补回该 e2e 回归。另有 required stage2c (mutants 0) 的 mutation-locator drift、其 correctness wrapper、windows-powershell 与 merge-gate 失败；必须逐项诊断并重跑。

我的整体评价

REQUEST_CHANGES。共享 typed predicate 的方向合理，但 exact head 已有确定的 public error contract 回归，且 required checks 仍红灯，当前不具备合并条件。审阅 head：da40ade7f3652eb182bf85b56d6865e84cdb5d74。

English verdict: REQUEST_CHANGES — head da40ade. Preserve the existing update_owner_mismatch error/reason text at the adapter boundary, then diagnose and rerun stage2c e2e/mutants, windows-powershell, correctness, and merge-gate checks.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

评审对象：#4273，最终 exact head a34028b7cae6606f58c111d2d7b0e249eab18ef5。

动机

将 promoted Todo 的 ownership/exclusion 更新收口到既有 typed canonical update transaction，避免 Python facade、native path 与 public adapter 各自推导 claim、binding 和 exclusion 规则，同时保留未 promotion Goal 的兼容 writer。

改动思路

TypeScript 负责 ownership intent 归一化、注册 actor/绑定/排除/claim-owner admission 与 lease fence；Python 只适配 CLI 参数和公共响应。现有 authority receipt/replay 和原子提交路径保持复用，不引入新的 recovery framework 或 provider。

具体改动

• authoring_scope.ts 与 native_update_plan.ts 归一化 claimed_by、clear_claim、excluded_agents，拒绝未注册、互斥或部分写入的 intent。
• todo_lifecycle_decision.ts 提供共享 typed admission predicate；todo_update.ts 在 lease/hard-lease 下拒绝 ownership metadata 重写。
• 在公共 adapter 边界保留既有 update_owner_mismatch 文本 Todo update cannot edit another claim owner's work，并补回真实 native/public e2e 覆盖。
• Stage 2C mutation oracle 跟随 predicate 从 todo_update.ts 移到 todo_lifecycle_decision.ts，不改变测试语义。
• RFC 中保留主干最新内容并补充 ownership update closure 的执行卡。

对主干的风险

已修复本轮发现的两个阻塞：公共 owner-mismatch 诊断回归与 Stage 2C mutation locator drift。最终远端 required checks 全部通过：Python tests（含 stage2c e2e 1/2、mutants、installed、Windows、correctness、pytest、merge-gate）、TypeScript/node compatibility、dashboard acceptance、release/build、DCO、dependency review 与 Sonar 均为成功。

本地 loopx canary premerge --from-git-diff --goal-id loopx-meta 仅有已有基线失败 hot-path-interface-budget-smoke（origin/main 同样为 dashboard_status_json 18,930 > 18,500 上限），其余 17 个选中检查和 public/private boundary scan 均通过；该失败不由本 PR 引入，已保留为主干 follow-up，不扩大本 PR 范围。

我的整体评价

架构方向正确：ownership decision 只保留一个 typed owner，公共契约兼容，lease 边界 fail closed，receipt/replay 和真实 public entrypoint 均有覆盖。最终 head 已 rebase 到当前 main，required CI 绿色，建议合并。

English verdict: APPROVE — exact head a34028b7cae6606f58c111d2d7b0e249eab18ef5; public owner-mismatch compatibility and the Stage 2C mutation oracle are fixed, required CI is green, and the remaining local canary failure reproduces on origin/main as an unrelated dashboard payload baseline.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

评审对象：#4273，最终 exact head 538c9c82826e85fcc59cf0835623c1ce4daf6530，base 5bb312ccab5dbddb9c29f54e135bec9f56f8cac9。

动机

将 promoted Todo 的 ownership/exclusion 更新收口到既有 typed canonical update transaction，避免 Python facade、native path 与 public adapter 各自推导 claim、binding 和 exclusion 规则，同时保留未 promotion Goal 的兼容 writer。

改动思路

TypeScript 负责 ownership intent 归一化、注册 actor/绑定/排除/claim-owner admission 与 lease fence；Python 只适配 CLI 参数和公共响应。现有 authority receipt/replay 和原子提交路径保持复用，不引入新的 recovery framework 或 provider。

具体改动

• authoring_scope.ts 与 native_update_plan.ts 归一化 claimed_by、clear_claim、excluded_agents，拒绝未注册、互斥或部分写入的 intent。
• todo_lifecycle_decision.ts 提供共享 typed admission predicate；todo_update.ts 在 lease/hard-lease 下拒绝 ownership metadata 重写。
• 在公共 adapter 边界保留既有 update_owner_mismatch 文本 Todo update cannot edit another claim owner's work，并补回真实 native/public e2e 覆盖。
• Stage 2C mutation oracle 跟随 predicate 从 todo_update.ts 移到 todo_lifecycle_decision.ts，不改变测试语义。
• RFC 中保留主干最新内容并补充 ownership update closure 的执行卡。

对主干的风险

已修复本轮发现的两个阻塞：公共 owner-mismatch 诊断回归与 Stage 2C mutation locator drift。最终远端 required checks 全部通过：Python tests（含 stage2c e2e 1/2、mutants、installed、Windows、correctness、pytest、merge-gate）、TypeScript/node compatibility、dashboard acceptance、release/build、DCO 与 dependency review 均为成功；Sonar 是明确的 non-blocking 检查，目前不影响合并门禁。

本地 loopx canary premerge --from-git-diff --goal-id loopx-meta 仅有已有基线失败 hot-path-interface-budget-smoke（origin/main 同样为 dashboard_status_json 18,930 > 18,500 上限），其余 17 个选中检查和 public/private boundary scan 均通过；该失败不由本 PR 引入，已保留为主干 follow-up，不扩大本 PR 范围。

我的整体评价

架构方向正确：ownership decision 只保留一个 typed owner，公共契约兼容，lease 边界 fail closed，receipt/replay 和真实 public entrypoint 均有覆盖。最终 head 已 rebase 到当前 main，required CI 绿色，建议合并。

English verdict: APPROVE — exact head 538c9c82826e85fcc59cf0835623c1ce4daf6530; public owner-mismatch compatibility and the Stage 2C mutation oracle are fixed, required CI is green, and the remaining local canary failure reproduces on origin/main as an unrelated dashboard payload baseline.