feat(coordination): unify reviewed Todo and Monitor edits

[huangruiteng]

Goal And Delivered Outcome

Promoted Todo/Monitor edits from Chat carried an authority reason into a legacy route that was fenced from writing. Preview freshness used Markdown, and a committed edit with a lost response or pending display could lose its recovery card.

This change closes the reviewed nonterminal edit journey: preview the real canonical update, bind its provider/registration basis, commit through shared TS admission and CAS, then recover the same operation and current display after interruption. Registered lifecycle grants remain distinct from reasons and lease execution proof.

Related to #4574 and the TS T1 / shared-authority L2/L5 contracts. Base: current main, including #4683 acceptance and #4686 joint leased handover. Their shared-boundary integration is validated here.

Scope And Continuation

• Canonical v2 update transports grants, source witness and optional reviewed revision; v0/v1 cannot silently accept the new obligations. Existing receipt identities remain valid.
• Extract shared update admission, reuse lifecycle/lease/field-planning owners, and share registry facts with terminal lifecycle. Reassign-only grants cannot authorize bundled copy edits.
• Chat owns review basis and stable operation IDs. Historical receipt recovery precedes current admission; display recovery reads the current head. Monitor cadence remains intent, with due time derived only for a new operation.
• Dashboard reload preserves failed edit cards and offers Retry original operation. CLI/API, Chat service and packaged frontend are covered. No new Lark command/card contract is introduced; existing group operation-confirmation gates retain their separate owner.

Monitor previews now actually execute dry-run validation on both promoted and legacy paths; previously they could claim validation without running it.

Complete within this reviewed-edit scope. Existing TS/shared-authority owners retain leased ownership/requirements/status transitions, completion/run-now, PostgreSQL production routing, D1–D3, long-running soak and default-provider rollout. No Goal/provider promotion or default switch. The registry witness is an optimistic source check, not a distributed transaction with provider storage. Keeping this boundary separate makes the user journey independently testable and reversible.

Validation

• Tested head: 5ef984f2ce529b2b01f9c33c9389777ccff36ccf; integrated main: 28b1c9f60d05755de05d44ee1a80110df118d002.
• Run state: finished. Input classes: synthetic, public_fixture, authorized_private_read_only.
• Integration: preserve candidate-head acceptance before preview and commit, keep terminal validation effects, rebuild the combined packaged frontend, and extend the existing acceptance test to both modes.

Check kind	Result	Evidence / limitation
static	passed	Control-plane TS typecheck, dashboard build/typecheck and changed Python Ruff.
unit	passed	Python reviewed-edit/native/acceptance/handover/rendering: 134 passed. Native selected 769: 753 passed initially; the 16 failures were isolated PostgreSQL port mismatch, fully covered by a corrected 53-pass/0-failure/0-skip acceptance rerun.
real_backend	passed	Selected native File/SQLite/NoKV and isolated PostgreSQL 16.15 store suites pass. The initial connection failures and corrected rerun are retained in evidence. PostgreSQL uses the native service/store factory, not Python production routing.
real_entrypoint	passed	Public Todo CLI/Chat, installed wheel and sdist (21 cases each), packaged typed-actions recovery and goal-acceptance-contract browser including off parity, keyboard, locales, mobile and refresh/read-only behavior.
regression_parity	passed	Frozen read-only graph: 357 Todos/9 leases; baseline/File/SQLite/PostgreSQL compatible complete heads and provider heads match; source and non-target state unchanged. After correcting the test port, four-arm rerun passes. An isolated premature dry-run mutation is killed by the real File acceptance assertion.
integration	passed	Current-head risk-based canary 19/19 passed, plus direct checks; exact-scope quality receipt valid.
manual	passed	Whole PR and last-review-to-head integration delta, authority/acceptance boundaries, source/public-boundary scan and generated package inspected.

Historical baseline failure and registry-witness mutation retain their original source revisions; they are not relabeled as new-head validation. The changed-base runtime, packages, browser, frozen snapshot and guard-order mutation checks were rerun. No unresolved required failure, skip or manual hold. Counts overlap and are not summed. Long-running soak and PostgreSQL Python route qualification remain outside scope. Remote CI is not consulted under the resolved review policy.

Frontend / Visual Evidence

• UI impact: changed.
• Before: canonical preview could fail before a card existed; failed edit cards were filtered out after reload. This recovery drawer state is new (no corresponding baseline recovery view).
• After: retained pending-display card explains the committed edit and retries the original operation; readback confirms replayed and delivered.
• States/viewports: pending display and recovery, desktop 1200×870 and mobile 390×844; packaged frontend. No opening navigation or public hero changes.
• Source data: synthetic.

Mobile recovery

Type of Change

• Bug fix
• New feature
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Public docs or presentation surface (README, protocols, dashboard)
• Host or runtime integration

Technical Direction

Shared Goal Authority and TS convergence: R5 / T1 / L2 / L5. Refactor uses existing owners and introduces no capability/provider. It removes duplicate admission/projection knowledge while preserving explicit legacy storage compatibility.

Shared-authority RFC fixture impact

• Production-scale fixture: existing productionScaleCoordinationFixture; retain complete dependency graph and unrelated leases, remove only the synthetic edit target's lease to exercise unleased delegation.
• Dimensions: grants vs reasons, update vs reassign, reviewed CAS, registry change before commit, immutable historical replay, current display, non-target preservation.
• Arms: File, SQLite, NoKV transaction conformance and real PostgreSQL; frozen baseline/File/SQLite/PostgreSQL rehearsal described above.

Boundary Checklist

• No private state, credentials, raw traces, internal links or local machine paths in public artifacts.
• No duplication of maintainer-owned benchmark work.
• Scoped to the requested reviewed-edit outcome and linked roadmap.
• Visual evidence is synthetic and included above.
• Every commit includes DCO sign-off.

Owner explicitly authorized self-merge after current-head local qualification, published review and exact-head merge-readiness.

Quality receipt: cqr_ad45aac5fd2942aafcc3; exact scope ad45aac5fd2942aafcc32d810e90d4d294c4475007439bd2dd1d071a17a94fe1 (39 changed files). One allowed safe-fix pass applied; no blocker, warning or advisory recorded.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

精确评审版本：ea0f4798ac9427696b59fd2e157473793554944e，base ac604a2e5b1a83f60e86648ca118080237e81972。没有发现阻塞项，结论 APPROVE。 这是作者自评审记录；控制面代码仍留维护者合并。

动机

依据 #4574 的 R5、TS T1 与 shared-authority L2/L5，本 PR 交付一个完整的 reviewed nonterminal edit 链路。原先 Chat 总携带的 authority_reason 会排除 canonical 路由；preview 依赖 Markdown；Monitor 未执行真实 dry-run 就宣称验证；提交后展示失败的卡片又会在重载时消失。基线真实 Chat 用例在 canonical 已存在、Markdown 缺失时失败，说明这是现实入口的断点。

本批属于 justified increment：CLI/API、Chat、事务、展示恢复和 packaged Dashboard 都闭合。它不代表 provider 默认切换、全部 T1 或 D1–D3 完成；#4683 的 terminal acceptance、#4686 的 joint leased handover 与既有 durability/default program 继续持有各自边界。

改动思路

复用既有 todo_lifecycle_decision、task_lease_proof、native_update_plan/public_update、CoordinationCommandReceipt 与 projection outbox。Python 只投影 registry facts、映射参数和交付展示；TS 决定准入与事务。没有第二个 writer、权限引擎或恢复数据库。

canonical_update_basis 是服务端保存的历史审阅依据：当前 head 不能反推用户当时看过的 revision，故该快照有独立价值。新写入受 revision/source 与 CAS 约束；相同操作先查不可变回执，恢复时再投影当前 head。Checkpoint 与 retryOriginal 均由已有事实派生，不授予权限。

只删除 reason 路由条件不足以修复 grant、审阅新鲜度、响应丢失和 UI 恢复，因此本次跨 Python、TS 与前端的范围合理。Monitor preview/apply 共用一份映射，registry facts 与 terminal lifecycle 共用已有模块，是本次一并落实的相关去重。

具体改动

38 个文件，+960/-294；包括 6 个验证路径、双语合同/RFC、两张合成恢复截图与生成的前端包。生成资源与业务实现已分别检查。

关键代码讲解

1. executeCoordinationTodoUpdate：receipt.read 先于当前来源和准入；无历史结果时才检查 reviewed revision、准入、准备状态、再次校验 registry，最后提交 provider CAS。旧回执不能被重新解释成新执行。
2. todoUpdateAdmissionRejection：组合已有 grant/lease 规则。纯重分配可用 reassign grant，夹带 copy/planning 必须有 update authority；exclusion、binding、lease lineage 仍独立阻断。理由不是权限。
3. _apply_reviewed_todo_edit：稳定 ID 来源于 proposal；历史 original_receipt.changed 与本次 replay 区分。展示 pending 保持 failed/recoverable，只有真实交付后才存 applied/verified。旧操作恢复不会覆盖后续接受的文本。
4. compileActionReviewPlan：failed/applying canonical 非终态编辑得到“重试原操作”；stale/gated/terminal/普通 operation 卡片不会获得该路径。Dashboard 重载和 timeline 不再过滤这些恢复卡片，服务端继续拥有执行权限。

v2 transport 防止旧 runtime 忽略新增约束后部分提交；旧 v0/v1 receipt identity 保持。CLI 新增显式 reviewed revision，非 update/claim 路径不能吞掉该依据。Canonical Monitor 的 cadence 是意图，due time 只在新操作中由既有 TS planner 派生，重试不重新调度。

对主干的风险

最强反例是：编辑已提交、展示/响应丢失，随后 Todo 和 registry 均推进，再重试原卡片。真实 File/SQLite 用例证明恢复旧回执、展示最新状态且无新业务写；改变时钟后 Monitor 重试仍保持原 due time。临时副本故意绕过 registry basis 检查时，独立 Chat 断言以 applied != stale 失败，证明反例覆盖会抓住错误实现。

验证结果：Python 主/伴随组 156/46；TS focused 29；File/SQLite/NoKV 410；真实隔离 PostgreSQL 16.15 为 137，零 skip；wheel/sdist 各 21。最终 head 的 reviewed-edit + 新合入 producer-scan 回归 93，通过。各组存在重叠，不相加作为质量指标。

只读冻结图含 357 Todos、9 graph leases，baseline/File/SQLite/PostgreSQL 四臂的兼容 head 一致，新 grant/stale/replay 和非目标保持通过，源字节未变。真实 Chat HTTP、packaged browser 与桌面/移动 SQLite 恢复交互均通过，API 读回 replayed / delivered。测试故障注入只制造展示或 ACK 失败，不伪造成功 postcondition。

语义与 CI 对齐

本次扩展已有 update/review 词汇，复用权限、租约、字段与回执 owner。错误分类使用 schema、枚举和精确 code，未增加文案子串判权。新行为已在 CLI、Todo/Monitor 文档及双语 RFC 披露；尤其 legacy Monitor preview 也改为执行真实 dry-run，不能把整个修复描述为默认关闭。Provider 默认与 promotion 本身未变化。

Registry witness 是乐观来源检查，不是 registry 与 provider 的跨资源原子事务；PG 验证覆盖既有 native service/store factory，不宣称 Python 生产路由已经切换。Live soak、默认切换及跨宿主资格化不在本次结论内。按解析后的 wait_for_ci=false，未查询、轮询或等待远端 CI；本地必需验证均通过。

我的整体评价

支持合入这一完整编辑切片：它修复现实路径、缩小重复知识，并使新写入、历史结果与当前展示分别有明确 owner。旧兼容路径、无新字段的旧协议和不带 reviewed revision 的调用保持已有合同；故意改变的路由、preview 与恢复行为有反例及实际 backend/readback 支撑。

风险型 canary 19/19，加直接检查，通过且无 manual hold；最终 exact-scope quality receipt cqr_7c4f0588b63f5ea2411e 验证有效，scope 7c4f0588b63f5ea2411ed6c91857c6199609cdbf38a47356b6eecd7e4db8e76e。一轮允许的 bounded safe-fix 已落实，无 blocker/warning/advisory。评审结构检查通过不代替证据判断；发布前再次核对远端 head。没有自合并。

English verdict: APPROVE - ea0f479. Reviewed canonical Todo/Monitor edits now share native admission, bind review freshness, and recover immutable results plus current display through the original card. Real File/SQLite/PostgreSQL, installed packages, browser recovery, frozen baseline comparison and mutation sensitivity passed; exact quality receipt and 19/19 canary passed. Registry witnessing is optimistic; provider defaults, soak and PostgreSQL Python routing remain outside scope. Maintainer merge required.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

精确评审 head：5ef984f2ce529b2b01f9c33c9389777ccff36ccf；base：28b1c9f60d05755de05d44ee1a80110df118d002。结论：APPROVE，无未解决的阻塞项。这是集成 main 后的完整重新评审；此前 ea0f4798 的结论不代替本次判断。仓库所有者已明确授权本 PR 自合并，仍须在发布后通过同一 head 的 merge-readiness。

动机

本 PR 对应 #4574、TS T1 和 shared-authority L2/L5 的 reviewed nonterminal edit 链路。此前 Chat 总带的 authority_reason 排除了 canonical 路由；preview 以 Markdown 为依据；Monitor preview 没有执行实际更新却声称验证；提交后展示或响应丢失，又可能使恢复卡片在重载后消失。历史基线真实 Chat 用例已复现“canonical 已有 Todo，但缺少 Markdown 使 preview 失败”。

交付判断为 justified increment：从 CLI/API、Chat 的真实预览，到 TS 准入/CAS、投影交付、packaged Dashboard 原卡恢复，形成可独立验证和回滚的完整编辑切片。当前 main 已合入 #4683 acceptance、#4686 joint leased handover；本次保留并验证与它们的组合。默认 provider 切换、全量 T1、D1–D3/soak 和 PostgreSQL Python 生产路由仍由原计划持有，不宣称在此完成。

改动思路

复用 todo_lifecycle_decision、task_lease_proof、native_update_plan/public_update、CoordinationCommandReceipt 和 projection outbox。Python 投影 registry facts、适配参数并交付展示；TS 持有准入、字段语义和事务。抽取共享准入、共用 Monitor preview/apply 参数映射及 registry facts，没有新增 writer、权限引擎或恢复数据库。

canonical_update_basis 记录服务端生成的历史审阅依据：当前状态无法反推用户审阅过的 revision。新写入必须通过它；已成功的同一操作则先恢复不可变回执，再展示当前 head。Reason 是授权所需的证据，不是权限；恢复卡片和 checkpoint 是投影，也不授予权限。

仅删除 reason 路由条件，不能同时解决 grants、陈旧审阅、时间派生和响应丢失，所以当前范围合理。本次 main 集成特别保留 candidate-head acceptanceWorkGuard：它必须位于唯一的 dry-run 返回之前，避免“预览通过、提交才拒绝”的语义分裂。

具体改动

39 个文件，+972/-302：Python/TS 产品代码、7 个 durable validation 路径、双语合同与 RFC、两张合成截图、生成前端资源。生成包已与合并源码一起重建，包含 main 的验收 UI 和本 PR 的恢复 UI，并保留正确的上一代资源。

1. executeCoordinationTodoUpdate：先读取历史回执；无匹配结果时，依次检查 registry、当前 revision、共享准入，构造候选 head，通过 main acceptance guard，再检查 registry。预览只在这些检查后返回；提交则写 receipt 并执行 provider CAS。
2. todoUpdateAdmissionRejection：组合已有 lifecycle 和 lease owner。纯重分配可用 reassign grant，夹带文本/planning 修改必须具备 update 权限；exclusion、binding 和租约 lineage 仍独立约束。
3. _apply_reviewed_todo_edit：沿用原 proposal 的稳定操作 ID，保留 original_receipt.changed 的历史含义。投影 pending 仍为可恢复失败，实际交付后才标记 applied/verified；恢复不能覆盖后续已接受的编辑。
4. compileActionReviewPlan：仅对适用的 failed/applying canonical 非终态编辑给出“重试原操作”；stale/gated/terminal/普通 operation 不进入该路径。Dashboard 重载及 timeline 保留对应卡片，执行权限仍在服务端。

v2 transport 防止旧 runtime 忽略新增义务而部分写入；旧 v0/v1 receipt identity 保持。Canonical Monitor cadence 保留为意图，due time 只在新操作内由既有 TS planner 派生；重试不重新调度。CLI reviewed revision 不能被 claim 等不适用路径吞掉。

相对上次评审，本轮变化是必要的 main 集成、candidate acceptance 与 registry 检查顺序、组合前端重建，以及已有 acceptance 测试对 dry-run/apply 的覆盖；没有借集成增加新能力或第二轮可选质量修复。

对主干的风险

最强历史反例：提交已成功、展示或 ACK 丢失，随后 Todo 和 registry 均推进，再重试原卡片。真实 File/SQLite 用例验证恢复历史回执、投影最新状态且不重新写旧意图；Monitor 时钟移动也不改变原操作的 due time。另一个集成反例是提前 dry-run 返回：隔离副本故意把返回放在 acceptance guard 前，真实 File 的独立断言以 undefined 对 goal_acceptance_stale 失败，证明测试能捕获此回归。未修改实现的预览和提交都拒绝陈旧验收，head 与 receipt 不变。

本轮验证：

• Python 编辑/native/acceptance/handover/渲染回归 134 passed；TS typecheck、Dashboard build/typecheck、相关 Python Ruff 通过。
• 原生 769 项首轮 753 passed、16 failed、0 skipped；16 项全部是隔离 PostgreSQL 启动端口与配置不符导致的连接拒绝。修正测试环境后，包含所有失败用例的 acceptance 两组 53 passed、0 failed、0 skipped。其余原生 File/SQLite/NoKV/真实 PostgreSQL store 用例均通过，无未解决失败；没有把首轮失败抹掉或归为跳过。
• 新构建的 wheel/sdist 各 21 passed，安装源、TS 和前端包来源已验证。
• Packaged typed-actions 恢复与 goal-acceptance-contract browser 通过，覆盖 feature-off、键盘、双语、移动端、revision refresh 和只读导出。
• 只读冻结快照含 357 Todos、9 graph leases；baseline/File/SQLite/PostgreSQL 四臂的兼容 complete heads 一致，provider heads 一致，delegation/stale/replay 及非目标保持通过，源字节未变。该验证使用隔离运行时，不更改活动 Goal；同一端口错误修正后重跑通过。
• 当前 head 的 risk-based canary：19/19 passed, plus direct checks；exact-scope quality receipt 有效。各验证组有重叠，不合计成质量分数。

历史基线失败和 registry-witness mutation 仅作为其已记录 revision 的证据保留；改变 base 后，运行时、安装包、浏览器、冻结快照和集成 mutation 均重跑，旧 head 的 APPROVE/canary 不继承。

语义与 CI 对齐：分类使用 schema、枚举和精确 code，未加入文案子串判权或领域专属义务。路由、preview、历史恢复及展示行为已披露；尤其 legacy Monitor preview 也会执行真实 dry-run，这是显式修复，不能谎称整个 PR 默认关闭。Provider 默认和 promotion 未变；新合入 acceptance 的关闭/开启路径均有覆盖。Registry witness 是乐观来源检查，不是跨资源事务；PG 证据来自实际 native service/store factory，不等于 Python 生产路由切换。按解析后的 wait_for_ci=false，未查询、轮询或等待远端 CI。

我的整体评价

支持合入：该切片修复真实用户路径，减少重复知识，并把历史结果、当前资格和当前展示分开。既有权限/租约/字段 owner 得到复用；main 的 acceptance 和 handover 语义得到保留，CLI、Chat 与 packaged Dashboard 的交付闭合。

Future-facing pass 已落实为共享准入、registry facts、Monitor 映射和既有 receipt/outbox 恢复。保留旧协议和 legacy writer 是明确兼容需要；没有新 capability/provider 或推测性框架。范围为 39 文件，quality receipt cqr_ad45aac5fd2942aafcc3，fingerprint ad45aac5fd2942aafcc32d810e90d4d294c4475007439bd2dd1d071a17a94fe1；允许的单次 bounded safe-fix 已应用，零 blocker/warning/advisory。

合并决定：所有者已明确授权自合并及该流程所需的 bypass；本地必需验证通过，测试环境失败已修正并重跑，无未解决 skip 或 manual hold。覆盖包含真实 provider、安装包、用户交互、历史恢复、完整图和集成反例，足以支持这一边界。结构检查不代替证据；发布前核对远端 head，合并前必须再次通过同一版本的 merge-readiness。

English verdict: APPROVE - 5ef984f. The complete reviewed canonical Todo/Monitor edit journey preserves immutable recovery, current projection, shared admission and main's candidate acceptance guard before preview and commit. Python 134, installed packages 21 each, native/provider coverage (16 initial PG port failures fully covered by a corrected 53-pass rerun), packaged browsers, frozen four-arm comparison and mutation sensitivity passed; current canary 19/19 passed, plus direct checks, exact quality valid. Registry witnessing remains optimistic; provider defaults, soak and PostgreSQL Python routing are outside scope. Owner authorized self-merge after exact-head readiness.