fix(coordination): converge terminal validation and reviewed recovery

[huangruiteng]

Agent completion and Monitor stop could report verified success after canonical commit even when display delivery failed. Their retry path also lacked the receipt-first recovery used by reviewed edits. Separately, ordinary completion could accept validation after the provider head changed during execution.

This closes that terminal caller family across the TS transaction, Python facade, Chat, and packaged frontend. It advances the L2/L5 work under #4574, #3225 and #3245; it does not change provider defaults or settle whole-Goal migration.

Behavior and ownership

• Terminal request v2 binds reviewed intent to provider revision/registry witness and binds validation continuation to its issued source revision. TS rechecks source and lease time before completion; v0/v1 reject the new fields instead of silently ignoring obligations.
• Historical business receipts recover before current-source checks or private argv resolution. Fresh work still requires the matching declaration and existing authorization. Reviewed identity also binds note/evidence/reason; legacy fingerprints remain compatible.
• Agent completion and Monitor stop reuse canonical Chat recovery and current-display acknowledgement. The frontend decoder, shared action plan, bilingual feedback and shipped bundle preserve the original proposal on retry and report pending display separately from verified completion.
• Extend the shared mixed native/imported fixture and existing browser scenario. No new provider, writer, capability, RPC method or settings surface. Python retains private effect execution, projection IO and unretired legacy writers.

Validation and cost

• Integrated on f19ecaa1d (including validator-revision PR feat: revise open Todo completion validators #4833): full TS suite 2,514 passed, zero failures/skips, with real PostgreSQL store and service on separate disposable databases.
• Python terminal/User completion/authority/edit coverage: 99 passed initially; the sole failure was the old two-request cost assertion. The same successor/archive case passes on immutable base and final head after explicitly asserting the new phases. New terminal/packaged HTTP coverage includes File and SQLite, response loss, display failure, stale validation and unavailable private declarations.
• Packaged typed-actions browser scenario passes for edits, User completion, Agent completion and Monitor stop; original identity and verified readback are checked. Direct browser interaction with the real SQLite-backed action endpoint also recovers both terminal operations.
• Read-only local-source rehearsal: 1,012 Todos and 10 leases, isolated synthetic overlays. The immutable latest-main baseline reproduces stale validation acceptance; File/SQLite/real PostgreSQL reject it and agree on fresh completion/replay. Non-target records and original source remain unchanged.
• Control-plane/dashboard typechecks, Ruff, configured mypy, packaged build and maintainability ratchet pass. Public-boundary scan is clean. The existing bundle-size warning remains.

A validated fresh completion now uses three terminal requests instead of two: admit/recover and resolve the private declaration, plan validation, commit. The extra crossing makes historical recovery independent of private argv; unvalidated completion/replay retains one request. This cost is documented and checked with the same base/head workload rather than hidden by a relaxed ceiling. The bounded refactor reuses the existing recovery/source owners; no larger framework was needed.

The dual-language RFC checkpoints retain the conditional 5–8 further delivery packages for remaining callers/executor fencing, D1 consumers, contributor-owned SQLite D2, capture/whole-Goal qualification, and default onboarding/retirement. PostgreSQL deployment/authenticated transport, capacity/soak and provider promotion remain separate. A missing original private declaration can still block lossless display recovery. Maintainer merge is required for this control-plane change.

Exact-scope quality receipt: cqr_24957dfff2c958225bcd, status valid, fingerprint 24957dfff2c958225bcd0b64f40e1a83a26f6dfb98022cc5a640fe861e336b0c; one bounded safe-fix pass, zero unresolved blockers/warnings/advisories. Risk-based canary premerge --from-git-diff --goal-id ... passed: 19 selected/executed checks, zero failures; exact-scope receipt valid. Coverage includes module/risk/maintenance contracts, CLI output budgets, Todo lifecycle, canary infrastructure and public boundary. No local validation holds; maintainer review/merge and remote CI remain separate.

[Job28703]

Independent review of exact head db51008b26c172e308d037e4358953aca53aaf0f (adversarial review chain, reviewer PASS):

Verdict: APPROVE.

Strong convergence slice. The three defects (false verified-success after display failure, missing receipt-first retry, stale validation acceptance) are fixed by one shared skeleton rather than three patches. Verified directly in the head source: receipt recovery now precedes freshness checks and private-argv resolution (todo_terminal_lifecycle.ts:791); the v0/v1 fail-closed rejection of new fields (local_authority_runtime.ts:1188); the witness closure re-hashing the registry file across awaits (authority_source.ts:31-40); Python's reviewed-completion fallback to legacy authority converted from silent to raise (provider_terminal_lifecycle.py:180). The 2×2×2 test matrix (provider × operation × failure boundary) plus the race/stale/HTTP-packaged scenarios pin each boundary claim in the new reference doc.

CI at this head: test-shard (2)'s single failure is the inherited refresh_state fixture regression (present on current main shard 3, fixed per #4859); node-min's two sqlite cases are the runtime-qualification gate addressed by #4857; shards 1/3/4, kernel-static-checks, real PostgreSQL, and all stage2c lanes pass at this head.

The 3-request cost for validated fresh completion is documented and measured rather than hidden — good practice.