fix(control-plane): converge promoted Todo projections

[huangruiteng]

Summary

• preserve todo_claim as the runtime-shadow write class instead of misclassifying it as todo_update
• let a CAS-revised private validator declaration replace stale Markdown only when its digest is the canonical Todo digest
• allow an explicitly granted controller to repair planning state on a promoted legacy claim before its first hard lease, while retaining the ordinary holder/CAS fence after any lease lineage exists
• pin managed delegation workers, validators, CLI children and native MCP servers to the release that admitted the work, even when the worker workspace contains a stale LoopX checkout
• resolve native collaboration MCP from the managed MCP runtime and carry the admitted release root in argv, so Codex environment sanitization cannot remove it
• give the bounded canonical Todo scan a 15-second cold/large-Goal budget without relaxing the global Effect request default
• keep mismatched sidecars fail-closed and prove replay idempotency

Why

Whole-Goal promotion exposed five real acceptance gaps: claim receipts lost their semantic class; a successful validator revision could not be projected because old Markdown and the new private sidecar temporarily diverged; a preserved claimed Todo with a stale blocked status could never become eligible for its first lease; managed delegation could silently import an older LoopX package from its worker checkout; and the lightweight control-plane interpreter did not necessarily own FastMCP while Codex strips ambient PYTHONPATH from MCP children. Together these made the 149-Todo source Turn fail first at stale 5-second admission and then at native MCP initialization. Business mutations remain canonical and are not blindly retried.

Product surfaces

CLI and managed Turn Todo lifecycle now emit/read the correct canonical projection, recover an explicitly reviewed unleased planning state, and keep child execution on one release identity. The managed Codex surface reuses the existing shared MCP runtime instead of requiring a second package installation. Frontend and Lark require no separate state or UI change because they consume the shared canonical Todo projection and receipt path.

Validation

• control-plane TypeScript typecheck
• tests/control_plane_ts/todo_terminal_decision.test.ts + todo_update.test.ts: 40 passed
• tests/control_plane/test_runtime_shadow_writer_capture.py + test_todo_machine_section_projection.py: 55 passed
• tests/control_plane/test_local_coordination_authority.py: 38 passed
• tests/test_delegation_preflight.py plus worker argument guard: 27 passed
• Ruff on all changed Python/tests: passed
• provider/completion-validation/lane-scope regression: 62 passed
• real promoted Goal: validator revision 0→1 preserved history; Markdown projection delivered and replayed with changed=false
• real promoted Goal: delegated controller reopened a preserved Sol worker claim without stealing ownership or inventing a lease; canonical projection delivered with parse/render parity and narrative preservation
• real promoted Goal: source delegation preflight returns turn_eligible=true, acceptance_ready=true, authority_state=promoted, and gpt-5.6-sol@xhigh without invoking the host or writing state
• real Codex CLI + gpt-5.6-sol/xhigh: required LoopX collaboration MCP initialized from the managed MCP venv under a sanitized child environment and completed a live handshake/model turn

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

本 PR 修复的是已在 finance-research-goal 真实复现的 promoted file_v0 收敛问题：canonical Todo 的 validator CAS 已成功时，旧 Markdown/private declaration 会阻断 project-markdown；同时 managed delegation 在工作区 LoopX 版本漂移、hard lease 缺失或成功回执丢失时，可能停在不可安全恢复的状态。这个切片不引入新 authority provider，也不扩大 worker 权限。

改动思路

继续复用现有 TS admission/effect owner、file authority、hard task lease、SettlementIdentity Turn journal 和 collaboration receipts。projection 只接受与 canonical digest 完全一致的新 private declaration；delegation 只在显式 binding/acceptance/adoption 下启动，先取得 lease，再用 admitted release 执行，并且只按完整 settlement identity 恢复已经完成 host+typed-result+validation 的同一 Turn。

具体改动

• 修正 runtime shadow claim 的 write class，并允许 promoted legacy claim 在首个 lease 前由 delegated controller 做受限修复；已有 lease 后仍受 owner/CAS fence。
• pin worker、validator、CLI 与 native MCP 到 admitted release/shared MCP venv，避免 delegated workspace 的旧 checkout 劫持 import。
• 增加 exact validated settlement lookup/recovery；不按“最新 journal”猜测，不重跑 model。
• hard-lease delegation 在 host effect 前 claim，在 canonical completion 时携带同一 lease proof；DELEGATION.json 仅作为运行期兼容输入并在 validation 前清理。
• project-markdown 仅在 external declaration digest 等于 canonical record digest 时替换旧 projection，其他 divergence 继续 fail closed。

关键代码讲解

• project_todo_machine_sections：把 canonical validation digest 作为唯一可替换旧 Markdown/private declaration 的依据。
• Delegations._validated_turn_journal / find_loopx_turn_key_by_settlement_identity：完整匹配 Goal/Agent/Todo/turn_instance，且要求 exact phases/result/validation evidence；歧义或不完整均拒绝。
• Delegations._acquire_delegation_lease / _complete_delegated_todo：将 managed worker 接入 promoted hard-lease 证明链，不把 message/model return 当 adoption 或 completion。

对主干的风险

主要风险是 collaboration_mcp.py orchestration 体量增大，以及 journal lookup 当前为有界本地目录线性扫描；但没有新增服务、队列或第二状态权威。负向路径覆盖 divergent digest、foreign/stale/released lease、non-adoption、partial/ambiguous journal、duplicate recovery 和 stale workspace runtime。exact head f0b6a4a8f5fce647d815df1264a7ef2af368b407 已 rebase 到包含 #4880/#4896/#4886/#4887 的主干并验证：TS typecheck；TS 37 passed；projection/authority 160 passed；delegation/Turn 194 passed；Ruff 与 git diff --check 通过。

语义与 CI 对齐

复用当前 shared authority、hard lease、managed delegation 与 TS migration RFC 的既有语义；Python 仍是 process/filesystem adapter，TS 保持 admission/effect owner。本结论不把未来 TS 全迁移当当前合入前置条件。

我的整体评价

未发现阻塞性问题，改动对真实故障是必要且成比例的，建议独立维护者在该 exact head 上批准并合并。由于这是作者自有 PR，我仅发布 COMMENTED 结论，不绕过独立 review。剩余风险/验收是：合入后升级本机 runtime，回放真实 project-markdown，完成 stale finance Todo，并验证 managed delegation 的实际 acceptance binding。

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

本 PR 修复 finance-research-goal 在 promoted file_v0 上的真实故障：canonical validator CAS 成功后，旧 Markdown/private declaration 会阻断 project-markdown；managed delegation 还可能因工作区 LoopX 版本漂移、hard lease 缺失或成功回执丢失而无法安全恢复。它不引入新 authority provider，也不扩大 worker 权限。

改动思路

复用现有 TS admission/effect owner、file authority、hard task lease、SettlementIdentity Turn journal 和 collaboration receipts。projection 只接受与 canonical digest 完全一致的新 declaration；delegation 只在显式 binding/acceptance/adoption 下启动，先取得 lease，再用 admitted release 执行，并只按完整 settlement identity 恢复已完成 host、typed-result 和 validation 的同一 Turn。

正向链路是 canonical CAS/lease → pinned managed runtime → exact Turn journal → validation → same-turn settlement → canonical completion → projection/readback。负向链路中，divergent digest、foreign/stale lease、non-adoption 或 partial/ambiguous journal 都在 side effect/settlement 前 fail closed，不重发、不重跑 model。

具体改动

• 修正 runtime shadow claim 的 write class，并允许 promoted legacy claim 在首个 lease 前由 delegated controller 做受限修复；已有 lease 后仍受 owner/CAS fence。
• pin worker、validator、CLI 与 native MCP 到 admitted release/shared MCP venv，避免 delegated workspace 的旧 checkout 劫持 import。
• 增加 exact validated settlement lookup/recovery，不按“最新 journal”猜测。
• hard-lease delegation 在 host effect 前 claim，在 canonical completion 时携带同一 lease proof；DELEGATION.json 只在 host 运行期间存在。
• project-markdown 仅在 external declaration digest 等于 canonical record digest 时替换旧 projection，其他 divergence 继续拒绝。

关键代码讲解

• project_todo_machine_sections：canonical validation digest 是替换旧 Markdown/private declaration 的唯一依据。
• Delegations._validated_turn_journal / find_loopx_turn_key_by_settlement_identity：完整匹配 Goal/Agent/Todo/turn_instance，并校验 phases/result/validation；歧义或不完整均拒绝。
• Delegations._acquire_delegation_lease / _complete_delegated_todo：把 managed worker 接入 promoted hard-lease 证明链，不把 message/model return 当 adoption 或 completion。

对主干的风险

主要风险是 collaboration_mcp.py orchestration 增大，以及 journal lookup 当前为有界本地目录线性扫描；但没有新增服务、队列或第二状态权威。该 exact head 已 rebase 到包含 #4880/#4896/#4886/#4887 的主干。验证结果：TS typecheck；TS 37 passed；projection/authority 160 passed；delegation/Turn 194 passed；Ruff 与 git diff --check 通过。负向覆盖包含 divergent digest、foreign/stale/released lease、non-adoption、partial/ambiguous journal、duplicate recovery 和 stale workspace runtime。

语义与 CI 对齐

复用 shared authority、hard lease、managed delegation 与 TS migration RFC 的当前语义；Python 仍是 process/filesystem adapter，TS 保持 admission/effect owner。未来 TS 全迁移不是本次故障修复的合入前置条件。

我的整体评价

未发现阻塞性问题；该变更对已复现故障是必要且成比例的。建议独立维护者在 exact head f0b6a4a8f5fce647d815df1264a7ef2af368b407 上批准并合并。由于这是作者自有 PR，我只发布 COMMENTED 结论，不绕过独立 review。合入后仍需升级本机、回放真实 project-markdown、完成 stale finance Todo，并验证实际 acceptance binding。

English verdict: APPROVE at exact head f0b6a4a.