fix(goals): make checkpoint recovery hints match validation

[loopx-agent]

Checkpoint recovery could offer an unchanged reason when no persisted vision existed, although submission rejected that option. Vision authoring also omitted the existing todo_delta limits, making otherwise valid recovery packets fail on item length.

The existing TypeScript vision owner now offers only a patch without a baseline and advertises the validator's limits: retain the first eight Todo deltas, each up to 80 characters. The validator and authoring projection share local constants. Acceptance, replay fences, retention behavior and the 1,800-character vision budget remain unchanged. The bilingual TS migration RFC records this bounded recovery contract.

Validation on the rebased head:

• 43 focused TypeScript tests and control-plane typecheck passed.
• 59 Python tests passed, including isolated real CLI recovery, persisted-baseline unchanged recovery, concurrent/replayed supplements, identity rejection and one-spend settlement.
• Semantic inventory advisory and full vocabulary smoke passed; RFC language mirrors/ledger checks and diff whitespace checks passed.
• Full docs governance remains blocked by two pre-existing dated headings in the external-evidence RFC and its Chinese mirror; those headings exist on the base.

The recovery fixture now binds the original Todo/Turn through the guard and installs completion validation before the checkpoint supplement. It no longer attempts Todo delivery through a guard preempted by autonomous replan.

This changes existing CLI JSON/Markdown repair hints and the shared replan authoring read model. No new capability, provider, configuration or operation is introduced. The related refactor reuses local limit constants in the same owner; there is no second Python decision rule. These are recovery correctness fixes, with no EdgeBench performance or token/latency improvement claim. Maintainer merge is required.

中文：修复无 vision 基线时错误提供 unchanged 选项，以及 todo_delta 缺少长度/保留项数提示。保留同一 Turn 的恢复与幂等结算；已验证真实 CLI 路径。后续效率优化需独立以轨迹和测量资格化。

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; declaration_source=runtime_reported; reasoning_effort=xhigh.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

精确评审版本：#5573d8d49d7；基础版本 1af7dbd。当前账号也是作者，发布状态为 COMMENTED；下述批准结论不能等同于 GitHub 的正式 APPROVED。未查询、轮询或等待 CI。

动机

通过 CLI 回写工作结果、需要补齐 vision 检查点的 agent；vision 是对当前角色目标和验收方向的持久记录。
例如角色没有 vision 基线，首次回写后需要补齐检查点：旧提示仍建议提交 unchanged 理由，但校验器必然拒绝；新提示只给可执行的 patch 路径，并明确告诉重规划调用者 todo_delta 最多保留 8 项、每项 80 字符。
隔离真实 CLI 对照显示，无基线时精确 head 只返回 write_vision_patch 并标记 missing_baseline；补丁可在同一 Turn 恢复，保留原结算身份。81 与 139 字符条目均拒绝且账本字节不变；合法 9 项输入仍只保留前 8 项，校验行为与基础版本一致。
本次只对齐已有检查点提示和校验器，不放宽预算、不增加权限或设置，不迁移存储，也不证明模型实际采纳、benchmark 效果、安装升级或父级 RFC 完成。

改动思路

TS goals/vision_checkpoint.ts owns prepare, budgets and checkpoint resolution; existing refresh commit owns identity, CAS and replay. Python codecs/renderers only transport or display the result.

原规范：docs/architecture/rfcs/typescript-control-plane-migration-v0.md，不可变修订 1af7dbd43a1629b0356ecd5ee28a426ad45d1d7a（先读原规范，文档新增段落不作为自己的验收依据）。以下引用标签定位原文未编号的接受规则，不增加义务：

• Delivery semantics: correctness before migration：Executable authoring for vision triggers uses real bound CLI closeout/readback and negative scope qualification; checkpoint recovery remains in its existing owner. → buildVisionCheckpoint；通过独立真实 CLI、负例和相关回归验证。
• 2.1 One TypeScript kernel：Shared control-plane rules have one TypeScript owner, with Python as host/source transport rather than a second semantic owner. → visionAuthoringContract；通过独立真实 CLI、负例和相关回归验证。
• 6. Correctness and performance gates：Caller-visible behavior, diagnostics, failure/recovery and receipt identity are qualified against the pinned pre-change baseline through the production entrypoint. → prepareVisionRefresh；通过独立真实 CLI、负例和相关回归验证。

具体改动

5 个文件 +98/−28：1 个现有 TS owner 增加真实基线判断并共享两项本地常量；2 个测试文件补齐缺失/存在基线、边界预算与真实已获准的 Todo 恢复；RFC 英文和中文镜像各更新一段当前行为。恢复 fixture 从合法正常交付开始，避免拿已被重规划接管的 Turn 冒充普通交付。

关键代码讲解

visionAuthoringContract（loopx/control_plane/goals/vision_checkpoint.ts:68）：Projects the existing validator limits into discoverable authoring guidance. Adds todo_delta limits from local constants shared with prepare. 关键分支：Hints do not authorize a patch, widen scope or relax validation. 调用方/返回：Required-replan builders and real CLI authoring cold-path probe. quota should-run --include-detail vision replan contract.

prepareVisionRefresh（loopx/control_plane/goals/vision_checkpoint.ts:541）：Normalizes and validates the caller patch under the established typed owner. Replaces repeated numeric limits with same local constants, preserving first-eight retention and 80-character validation. 关键分支：Over-budget retained items fail before commit; no validator relaxation. 调用方/返回：Python vision codec bridge → TS runtime; 75 Python and 21 TS tests plus real patch/readback. Checkpoint and persisted agent vision.

buildVisionCheckpoint（loopx/control_plane/goals/vision_checkpoint.ts:808）：Constructs truthful missing-checkpoint resolution choices. Absent baseline now yields patch only plus missing_baseline; a real persisted baseline still permits unchanged. 关键分支：Null existing vision cannot substantiate unchanged; material checkpoint requirement stays strict. 调用方/返回：Refresh runtime/Markdown renderer and real admitted-Todo CLI recovery probe. refresh-state JSON and Markdown renderer.

正向路径：refresh-state/checkpoint-context and replan authoring → TS vision prepare/checkpoint/finalize → existing durable refresh transaction → JSON/Markdown and separate readback。隔离真实 CLI 对照显示，无基线时精确 head 只返回 write_vision_patch 并标记 missing_baseline；补丁可在同一 Turn 恢复，保留原结算身份。81 与 139 字符条目均拒绝且账本字节不变；合法 9 项输入仍只保留前 8 项，校验行为与基础版本一致。

对主干的风险

最强风险是提示已修复而 checkpoint 回写仍重复副作用。真实 CLI 的补齐流程验证：先读 context，非法 unchanged/超长条目拒绝且原文件/index 字节不变；合法 patch 保留原 identity；并发补齐只追加一项，重复 spend 只有一次扣额。有持久基线时 unchanged 仍可执行；非 material 和 in-flight 规则保留。

独立验证（均在各自精确 head）：

uv run --extra test python -m pytest -q tests/control_plane/test_refresh_checkpoint_recovery.py tests/control_plane/test_vision_checkpoint_runtime.py tests/control_plane/test_required_vision_closeout_behavior.py tests/control_plane/test_refresh_checkpoint_isolation.py
node --import tsx --test tests/control_plane_ts/vision_checkpoint.test.ts
npm run typecheck:control-plane

75 Python tests, 21 vision-checkpoint TS tests, control-plane typecheck, real isolated CLI base/head refresh/recovery/authoring, advisory then full semantic smoke, Ruff, diff hygiene and public-boundary scan passed. Docs governance has two identical unrelated failures at base/head.

真实 CLI 对照使用相同 synthetic fixture、实际 TS runtime、独立临时 Markdown/file registry/Turn journal，未替换 guard 或 commit 后置结果。fixture SHA-256 1592d05fc9ac598ecd9d058cafeb86d0b046e47c7c1227509f7a689bd6a42d48；base/head 观察 SHA-256 分别 4a01a453d490a6138841b456a8b89b2b8052440ed37bbbe2f66f6e0cb331b030 / 943407fdf808b8bc57c34054c792911c16e215d3385fccdaad0532546a995c6f。合法路径、完整诊断、账本不变与 identity 分别读回。

文档治理检查未通过：在基础版本和精确 head 上，external-evidence-research-capability-v0.md 与中文镜像都因旧的 2026-10-02 dated checkpoint 标题失败。检查器和这两个文件不在本 PR，归一化失败身份/详情 SHA-256 均为 e8963067c5b2458ea726ea56a98fe078fa9c40f8528e029b8f0676d48ec6e196。已执行的语言镜像和 ledger 检查位于失败前；后续治理阶段未执行。此项是未修复的基础问题，独立当前改动验证通过，不称文档全绿。

语义与 CI 对齐

全 diff 的共享规则复用现有 typed owner，没有 substring 分类或平行 Python 权威。先执行 changed-from advisory，再执行 examples/semantic-vocabulary-drift-smoke.py；二者通过。advisory 对动态构造不完备，已另行读调用和实际执行。没有 opt-in/default-off 功能宣称；这是已披露的既有恢复默认行为修正，提示不授予权限。公共 diff 扫描与 git diff --check 通过，原有 untracked lockfile 不属于 PR。未跑全仓库套件、Windows、已安装 App、长期 soak 或模型/benchmark 效果验证；未改 authority store，未声称真实 PostgreSQL迁移验收。

已完成对应复用/简化质量核验；采用上述覆盖 changed invariant、关键负例、真实恢复/重放和边界的风险验证组合。未来改动便利性检查：Future-facing pass applied: two repeated budget numbers become shared local constants used by authoring and prepare, so the next budget change has one owner.

我的整体评价

**APPROVE：未发现本 PR 的阻塞问题。**这项既有流程修复可独立验证、回滚，完成上述有界结果，不关闭父级迁移/产品验收。模型采纳、安装版本更新及未测平台仍需各自实际证据。合并仍单独核对原生 readiness 和用户授权；本评审不自行授予 merge 或旧 review 撤回权限。

English verdict: APPROVE - 5573@d8d49d7e43e11bb61497c1028d6c1956085002c2 - Existing recovery now returns truthful executable guidance while preserving hard gates, original identity and validator limits. 75 Python tests, 21 vision-checkpoint TS tests, control-plane typecheck, real isolated CLI base/head refresh/recovery/authoring, advisory then full semantic smoke, Ruff, diff hygiene and public-boundary scan passed. Docs governance has two identical unrelated failures at base/head.