fix(status): fail closed on truncated legacy Todo sections

[JasonBuildAI]

Goal And Delivered Outcome

• Outcome basis / optional anchor: Closes #6870.

• Goal/source and gap: A readable legacy ACTIVE_GOAL_STATE.md that ends before ## Agent Todo is currently classified as a healthy goal with zero Todos. This turns an unknown projection into "no open work" and lets quota should-run authorize a turn.

• Observable before → after, with the validation row that proves it: On the same synthetic fixture, status changes from exit 0 / ok:true / connected_without_run / generic first-tick advice to exit 1 / state_incomplete / explicit restore guidance; todo list changes from exit 0 / ok:true / todo_count:0 to exit 1 / error_code:state_incomplete. Restoring the section returns the fixture to exit 0 with one Todo.

• Issue/task and intended base: Closes #6870; base is loopx-project/loopx:main.

Author Declaration

• Written by: OpenAI Codex model agent, working at the requester's direction and under their review.

AI disclosure: this change was drafted with AI assistance at my request, under my direction and review.

Implemented against

• Specification and revision: GitHub issue status: a truncated ACTIVE_GOAL_STATE.md reports healthy with zero Todos #6870, reproduced on upstream main 242821068; the status/Todo contract in docs/status-data-contract.md at the final base.
• Criteria:

Criterion (spec clause)	Disposition	Symbol / path	Test or command
A truncated legacy state must not report healthy with zero Todos	implemented	loopx/contract.py, loopx/control_plane/todos/todo_summary.py	tests/control_plane/test_truncated_active_state_todos.py; synthetic status comparison
todo list must not present the missing projection as a valid empty list	implemented	loopx/control_plane/todos/list_readback.py	same regression; synthetic todo list comparison
The quota gate must not treat the state as having no open work	implemented	existing contract-health and attention consumers	real quota should-run on the wounded fixture returns should_run:false, state:blocked_health
Present-but-empty Agent Todo sections and accepted aliases remain valid	implemented	loopx/control_plane/todos/active_state_todo_parser.py	parameterized alias cases in the new regression
Canonical provider authority remains unaffected by the legacy Markdown check	implemented	loopx/control_plane/todos/active_state_todos.py	tests/control_plane/test_canonical_status_todos.py

• Self-check before submission: I read the status contract and attention mapping, checked the canonical display-only cases, and kept the change limited to the legacy Markdown fallback. I deliberately did not add last-known-good revision comparison or User Todo requirements; the issue only requires detecting the missing Agent Todo source section. No dependencies or unrelated cleanup were added.

Scope And Continuation

• Completed scope and remaining work: The reported section-boundary truncation now fails closed across status, Todo readback and quota admission. A present-but-empty Agent Todo heading remains a valid empty projection.
• Slice boundary / successor: Complete within this scope. Last-known-good section or revision comparison is a broader corruption-integrity design, not required to resolve this reproducible truncation. N/A.

Validation

• Tested revision: fa29f297e, rebased onto upstream e4190c30d. The focused regression and direct CLI reproduction were rerun on the final head; the canonical status/Todo suite reports 156 passed and four unchanged Windows GBK subprocess-decoding failures, which pass when rerun with PYTHONUTF8=1.
• Run state: finished
• Input classes: synthetic

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	Same synthetic fixture on upstream 242821068 and the change: status exit 0/ok:true vs 1/state_incomplete; Todo list exit 0/ok:true vs 1/error_code:state_incomplete; restored section returns exit 0 with one Todo.
unit	passed	tests/control_plane/test_truncated_active_state_todos.py: 6 passed at final head fa29f297e, including direct status, todo list, and quota should-run CLI regressions. Covers truncation, three accepted aliases, project-asset propagation, contract diagnostics, status attention, and malformed-region handling.
integration	passed	tests/control_plane/test_canonical_status_todos.py: 156 passed and four environment-only Windows GBK subprocess-decoding failures; the four failures pass with PYTHONUTF8=1. Includes truncated display cases proving canonical/provider authority is unaffected.
real_entrypoint	passed	Automated CLI regression and direct rerun cover loopx status --format json, loopx todo list --format json, and loopx quota should-run --goal-id ... on wounded and restored fixtures. Wounded: exit 1 and state_incomplete; restored: exit 0 with one Todo. Quota reports should_run:false, state:blocked_health, and the restore action.
static	passed	Ruff over all changed Python/test paths; changed-file py_compile; git diff --check; semantic inventory reports 7 changed sources and zero supported new vocabulary carriers.
manual	failed	loopx canary premerge --from-git-diff --git-diff-base upstream/main: 17/19 selected checks passed, including risk-profile smokes and public-boundary. The two failures reproduce on the same upstream baseline: hot-path extension doctor entrypoint_missing, and CLI output budget differential Windows temp-directory cleanup PermissionError / WinError 32.
static	not_run	Mypy is not a clean repo-wide gate here; a targeted no-follow-import run reports pre-existing no-any-return diagnostics in the touched modules. No mypy pass is claimed.
real_backend	not_applicable	No external backend, database, network service, or new dependency is involved.

• Coverage and gaps: The regression exercises the real legacy reader, contract check, attention/status projection, project asset, and the status, todo list, and quota should-run CLI paths. The canary limitations are the two baseline-reproduced Windows/extension-environment failures above. A section cut after the ## Agent Todo heading but before its items remains indistinguishable from an intentionally empty section; that is the explicit boundary of the heading-presence strategy.

Frontend / Visual Evidence

• UI impact: none
• Before: N/A
• After: N/A
• First viewport and preview: N/A; this is CLI/status data, not a visual UI change.
• States and viewports shown: N/A
• Source data: none
• Attention review: N/A; the change is to the existing CLI/status projection, not a visual first screen.
• Craft review: N/A

Independent Review

• A separate reviewer agent received the issue, user constraints, diff, reproduction, and check commands without the author's design rationale. Verdict: no P0/P1; the value is fail-closed protection of the real backlog and quota admission.
• Notes addressed in fa29f297e: the contract now distinguishes an empty agent_todos field from a required legacy heading, and the primary acceptance path has an automated CLI regression for status, todo list, and quota should-run.
• Residual boundary: truncation after the ## Agent Todo heading but before its items still reads as an intentionally empty section. This patch deliberately checks heading presence, not last-known-good section inventory.

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference, when applicable: Core control-plane hardening; issue status: a truncated ACTIVE_GOAL_STATE.md reports healthy with zero Todos #6870.

Shared-authority RFC fixture impact

• Production-scale fixture schema: N/A
• Semantic dimensions changed, or reviewed no-impact rationale: Adds the documented state_incomplete status/error classification only to the legacy Markdown fallback; canonical authority is unchanged.
• Provider conformance arms run: N/A; no promotion or provider-routing change.
• Read-only legacy/file/PostgreSQL three-arm rehearsal (required for promotion, runtime-routing, or compatibility-projection changes): N/A

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths (including .loopx/, .codex/goals/, and live ACTIVE_GOAL_STATE.md).
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• Existing English/Chinese RFC pairs (including ledger entries) both have a diff, and the local premerge check python3 scripts/check_rfc_bilingual.py --base origin/main --head HEAD passes, or no paired RFC changed.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

[songoow]

Reviewer: model_agent; OpenAI GPT-6 Astra; provider OpenAI; self_reported.

Reviewed head: fa29f297e50e3066376ef0d77516947a33240723

动机

这是对 #6870 所述 legacy ACTIVE_GOAL_STATE 截断问题的定向修复。原有读回把“文件可读、但在 Agent Todo 标题前已经截断”解释为 agent todo 数量为零，contract/status 也可能给出健康结果和首次只读 tick 的行动建议。受影响的是仍以 Markdown 为 Todo authority 的 Goal 及依赖 status、todo list、quota 决定是否推进的调用者；错误健康结果会把未知工作状态传递给后续执行判断。

预期前后变化是：缺少必要 Agent Todo 来源区段时，返回可见的 state_incomplete 和修复动作；确实存在、但没有条目的 Agent Todo 区段继续代表合法空集合。已经 promoted 到 canonical provider 的 Goal 仍只按 provider 判定完整性，展示副本的缺损不改变权威状态。此 PR 的非目标是恢复被截掉的条目、证明标题之后的正文没有丢失，或维护一份新的 last-good Todo 权威副本。

改动思路

实现沿已有 Todo parser 建立一个缺失区段诊断，再复用 contract、read model、attention queue 和 quota 已有的健康判断路径。这个实现比增加持久化健康开关或第二套 Todo inventory 更符合当前责任划分：缺失与否从本次实际读取的来源派生；修复原文件后，下次读取自然恢复，不需要同步另一份状态。

最关键的边界是 authority 优先级。代码在 canonical 路径确定之后才进入 legacy Markdown 完整性判断，避免把一个过时展示副本升级成否定 canonical 状态的依据。现有 parser 的标题别名与可见 Markdown 处理被继续使用，新增检查不通过裸字符串匹配另造语法规则。该局部诊断足以覆盖报告的问题；不能据此宣称能检测所有可能的截断位置。

具体改动

关键代码讲解

• active_state_incomplete_warning（loopx/control_plane/todos/active_state_todo_parser.py:27）复用 visible_markdown_lines 与 find_todo_source_regions，把缺少 agent 来源区域转为结构化诊断。Agent Todo、Codex Todo 和 Project Agent Todo 仍沿已有别名解析；front matter、注释和代码块中的伪标题不会仅凭字面匹配构成来源。存在但为空的区段不触发诊断。
• _todo_contract_diagnostics（loopx/contract.py:463）在 canonical authority 分支之后读取 legacy 来源并消费同一诊断，产生 error 级 state_incomplete。读取或 Todo 区域解析失败仍交给现有错误路径，不把异常变成空集合。
• list_goal_todos（loopx/control_plane/todos/list_readback.py:56）在 legacy 路径返回 ok=false、error_code=state_incomplete 和缺失原因。即使兼容 payload 仍有 todo_count=0，状态明确告诉调用者该数字不能当成已证实的无工作结论。
• active_state_todo_fields 与 active_state_todo_attention_item（loopx/control_plane/todos/active_state_todos.py、todo_summary.py）把缺失诊断传给高优先级 attention；其修复建议先于首次 tick 等常规建议。project_asset 同步携带相同诊断，避免页面内两个读回对同一损坏来源给出互相冲突的解释。

正向路径是完整且空的合法标题经 parser/list/contract 保持健康；负向路径是文件恰在 Agent Todo 前截断，经同一来源检查让 list 和 status 明确失败，再让已有 quota 健康门返回 blocked_health。修复来源的 owner 是用户或 controller，而不是 parser 自动重建丢失 Todo。

本次已阅读所有 11 个改动文件、调用处及现有 review 讨论；新增测试覆盖 legacy 截断的 API/CLI/status/attention/quota、三个空标题别名、解析失败，并把 canonical 展示副本的 truncated 情况加入现有 provider/readback 测试矩阵。git diff --check 在当前 head 通过。测试文件的覆盖范围是源码检查结论，不能等同于我重新跑过全部测试。

对主干的风险

没有发现需要阻塞的代码问题。最大的兼容变化是：历史上没有任何 Agent Todo 区段、但曾被当作健康空集合的 legacy 文件，现在需要恢复合法标题。这个行为是本次修复的主要效果，已在 status contract 和 attention queue 文档写清，不是一个隐藏的可选模式。state_incomplete 属于来源诊断和健康状态，不新增工作分类、授权主体或调度责任。

较强的回归反例是 canonical Goal 的展示 Markdown 损坏后误触发阻塞。我检查了 canonical 分支先返回的顺序、相关 provider 读取和新增 truncated 展示矩阵，未发现从展示副本回退或反向覆盖 canonical authority 的新路径。另一个剩余边界是 Agent Todo 标题存在、但标题之后内容被截断：当前检查不能证明该内容完整；这是明确保留的范围限制，不应把此 PR 的成功描述扩大成通用文件完整性保证。

此前尝试执行涉及真实 Effect runtime 的本地测试时，环境的 host permission/运行资源限制使整批结果不能形成有效的通过凭证。本次按要求优先发表源码 review，不依据 CI，也不把本地环境限制列为 PR 缺陷。尚缺我在当前 head 上独立完成的全链路 CLI 重放，尤其是 canonical file/SQLite 展示损坏与修复前后的行为对照。

我的整体评价

本次源码 review 未发现 blocking finding。改动使用已有 parser 和健康 owner，把“未知来源”与“合法空集合”分开，并保留 canonical authority 的优先级，范围与报告的问题相称。建议采用这份代码结论；本评论不声称已完成全套运行验证或合并资格认证。剩余验证边界如上，不构成凭空提出的代码缺陷。

English verdict: COMMENT — no blocking code finding at fa29f297e50e3066376ef0d77516947a33240723. The legacy completeness diagnostic is derived at the existing parser/readback boundary, remains separate from a valid empty section, and is bypassed by canonical authority. This is a source-review conclusion; CI was not used as a prerequisite, and a complete independent live CLI/base-head validation is not claimed.