fix(todos): derive external-wait successors from source facts

[loopx-agent]

When an open successor has a satisfied todo_done or monitor_changed condition, the Todo read model marks it ready, but external-wait authoring previously rejected its raw record because that record does not persist resume_ready. Conversely, a forged readiness flag could admit an unresolved successor.

Derive readiness from the existing TypeScript resume-condition owner and the locked Todo graph. Remove the redundant display-flag input; preserve wait declarations, monitor baselines, completion and replay boundaries. This changes the default validation of locally provable successors on the shared CLI/native/Chat/Lark Todo-update path. Source evidence requiring a PR provider or clock remains fail-closed at this synchronous authoring seam. The bilingual protocol and roadmap record the boundary.

Validation:

• Immutable-base counterfactual: 6 ready CLI cases fail while 6 pending cases pass; the three new TS semantic tests fail on the base.
• Source: 91 focused Python cases pass; final unchanged 12-case real CLI oracle repeated after rebase; 74 TS cases and typecheck pass.
• Normal isolated wheel: runtime bytes match the final source, and the unchanged 12-case oracle passes across legacy/File/SQLite, including absent Markdown, preview, atomic rejection and replay.
• Native premerge: all 19 selected checks and 4 direct checks pass; semantic inventory, maintainability and public-boundary scans pass; exact-scope change-quality receipt passes.

Future-facing refactor: display readiness no longer acts as a second decision source; no new vocabulary, provider or Python rule is introduced. This is a source/package-qualified repair. Live host adoption, waiting cadence/readback and the wider legacy-retirement program remain open; no PostgreSQL integration or release qualification is claimed. Maintainer merge is required for this control-plane change.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[loopx-agent]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

无阻塞发现；当前精确 head 2f919407ca8378ccce84588b6687ea209dbca55f 的 source/package 切片可以交由维护者合并。此结论是作者侧评审，不是独立 GitHub APPROVED 或合并授权。

Reviewer: model_agent; runtime_reported; model=gpt-6.1-sol; provider=OpenAI; reasoning_effort=xhigh

动机

为开放任务登记外部等待的 CLI 或现有 Chat/Lark Todo-update 调用者。 后继任务 B 的依赖已完成，查询显示 B 可执行；为 A 登记等待时却因原始 B 没有展示字段而被拒绝。现在从同一锁定源图重算，合法等待可提交，未满足依赖仍拒绝。 已在真实 legacy/File/SQLite CLI 及独立安装 wheel 验证登记、读回、预览和重放，不改 B 的原等待。 本批不删除原依赖、不强制完成 Todo、不变更权限；不宣称本机采用或整个等待/退役目标已完成。 真实 Host 的等待退避/读回/ACK、本机安装采用及需要外部 PR/能力/时钟证据的后继仍待各自 owner 验收。

改动思路

直接复用现有 TS resume owner、移除展示字段的判断权威，比复制投影或清除依赖更小且可回滚。 本 PR 只交付从锁定 Todo 源事实证明后继可运行的规则及生产 CLI/包验证；保留 Host 与外部证据采用边界。

规范依据：docs/reference/protocols/quota-blocked-causal-closeout-v0.md，spec_revision=e0a452b8715f0656b992f52e31ad47f175d3f39c，按本次修改前的合同判断。causal-runnable-successor：由当前源事实验证独立后继；original-wait-and-validation：保留原等待、未完成状态及原验收边界；live-and-backend-qualification：真实采用与 PostgreSQL 资格仍留在其原 owner。这次规范编辑是默认行为披露，不用改后的文字给实现自证。

具体改动

externalWaitSuccessors（resume_condition.ts:803）保留缺失、自引用、非开放 advancement 的拒绝，再调用既有 conditionFor（:471）和 diagnoseTodoResumeCondition（:571）。移除原始 resume_ready 解码，CLI/native/Chat/Lark 的公共 planner 共用同一规则；Python 只适配锁定源与提交，不增判断源。

基线同一 CLI oracle 为6失败/6通过，失败都在合法已满足后继；精确 head12通过。新增3个 TS 语义测试在旧分支失败，head7个相关 Todo suite共74通过。反例覆盖 false/absent/forged true、严格 monitor generation、缺失/自引用/未完成来源及历史归档完成引用。另以相同公共 CLI oracle改变顺序、前置160条无关源记录，基线12失败/12通过，head24通过；没有靠展示上限选择输入。

真实路径验证：91个相关 Python 用例；最终源码重跑12个关键用例。正常构建 wheel并独立安装，执行与源码字节相同的12-case oracle，legacy/File/SQLite全通过，canonical无 Markdown仍可预览、登记、读回、拒绝无副作用及精确操作重放；安装包规则字节与当前源一致。原始失败证据保留，未放松阈值或移除语义断言。

Native premerge的19项选中检查与4项直接检查通过，无当前失败、跳过或 manual hold；含 maintainability、完整 semantic vocabulary/producer inventory 和public boundary。TS typecheck与精确 diff CQR通过。按当前 review capability配置未读取或等待远端 CI。先前包构建因缺失/陈旧前端 bundle失败，使用正常依赖安装及前端构建解决后，最终包路径验收通过，没有采用构建豁免。

对主干的风险

默认行为有意修正：本地源可证明的满足条件不再因缺展示字段而拒绝；展示 flag也不能放行未满足条件。普通 copy/rearm、延期、PR/capacity调度、原 monitor baseline、错误顺序及 provider replay保持原归属。本同步 authoring边界没有外部 PR、能力或时钟证据，仍 fail-closed；不声称已验证这些后继或已在真实 App/Lark安装采用。没有新 schema、CLI选项、权限、写入分支或数据迁移，回滚是有界源 diff。

我的整体评价

直接复用现有 TS resume owner、移除展示字段的判断权威，比复制投影或清除依赖更小且可回滚。 本 PR 只交付从锁定 Todo 源事实证明后继可运行的规则及生产 CLI/包验证；保留 Host 与外部证据采用边界。 相邻面向未来的整理已应用：删除展示 readiness的平行判断，继续复用 typed语义 owner，没有引入框架。对本切片最强反例（展示字段伪造、真实源已满足但无字段、展示裁剪/重排序）已有正反向证据；最重要剩余验收是 真实 Host 的等待退避/读回/ACK、本机安装采用及需要外部 PR/能力/时钟证据的后继仍待各自 owner 验收。 控制面变更留给维护者合并。

English verdict: APPROVE - exact head 2f91940; source-derived successor validation is a justified bounded repair, with real legacy/File/SQLite CLI, package, replay and negative evidence. Live adoption and external-evidence qualification remain open; maintainer merge authority is separate.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · xhigh

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

精确 head：03db086cf06d082bb14f00fd8e0f0b83ade9a28c；上一被批准 head：2f919407ca8378ccce84588b6687ea209dbca55f；当前 base：main（125db4201 已并入）。

动机

开放后继若有已满足的 todo_done 或 monitor_changed 条件，Todo 读模型会把它标成 ready，但外部等待授权此前会因为原始记录没有持久化 resume_ready 而拒绝；反过来，被伪造的 ready 展示位又能让未满足的后继通过。本 head 让 readiness 从既有 TypeScript resume owner 与锁定的 Todo 图推导，删掉冗余的展示位输入，同时保留等待声明、monitor baseline、完成与重放边界。分支落后主干且冲突，需要整合后重新核验。

改动思路

先并入当前主干。唯一冲突又是 roadmap 的 S7 行：主干新增了「File/SQLite CLI 拒绝把原 Turn 的步骤写进新选中的 Todo，并保留该 Todo 的步骤/CAS 与依赖、只结算原写回一次」，本分支新增的是「外部等待授权从锁定 Todo 快照经既有 resume owner 推导后继 readiness，覆盖已完成依赖与 monitor generation fence，且不信任展示位」。两条事实合并进同一行，尾部「各自验收」的措辞也一并合并；没有取舍。生产改动本身是纯增量：resume_condition.ts 复用既有 conditionFor 与 diagnoseTodoResumeCondition，只移除原始 resume_ready 解码。

具体改动

6 文件、+155/−5：resume_condition.ts（加上 externalWaitSuccessors 的源事实推导）与两份测试，加上 roadmap 中英两行与一份协议文档说明。验证（合并后 head）：test_native_todo_planning_update.py 76 passed；连同 test_blocked_retry_wait_context.py、test_quota_blocked_retry_projection.py、test_post_writeback_wait_cli.py 合计 96 passed；TS public_todo_update、todo_resume_condition、causal_blocked_wait、todo_update、todo_update_soft_claim 合计 98 passed、0 fail；npm run typecheck:control-plane、仓库配置的 19 文件 mypy、改动文件 ruff、语义 vocabulary smoke、git diff --check 与公共边界扫描（3 文件）通过。

对主干的风险

最强反例是展示字段伪造与「真实源已满足但缺展示字段」两个方向。修正后本地源可证明满足的条件不再因缺展示字段被拒；展示 flag 也不能放行未满足条件；严格 monitor generation、缺失/自引用/未完成来源与历史归档完成的引用仍被拒绝，需要 PR provider 或时钟证据的后继在这一同步授权缝上保持 fail-closed。普通 copy/rearm、延期、PR/capacity 调度、原 monitor baseline 与 provider replay 归属不变。未测边界与上一轮一致：真实 Host 的等待退避/读回/ACK、本机安装采用，以及仍需外部证据的后继各自验收。控制面合并资格仍由维护者决定。

我的整体评价

APPROVE：展示位不再是第二个决策来源，后继 readiness 由锁定源事实与既有 typed owner 推导，正反向反例都有覆盖；与主干的 S7 表述合并后两侧事实都在，回归、类型与边界检查全部通过。

English verdict: APPROVE - 03db086. Current main is integrated with its newly selected Todo step/CAS fact kept and this branch's source-derived successor readiness folded into the S7 row; 96 focused Python tests and 98 related TypeScript cases pass with zero failures, together with control-plane typecheck, the configured mypy set, ruff, the semantic smoke, the diff check and the boundary scan. Live Host waiting cadence/readback, installed adoption and external-evidence successors remain separate acceptance.