fix(todos): settle durable Next Action on completion

[huangruiteng]

Summary

• make typed Todo state the authority for generated durable Next Action projections
• move binding, completion-fence, migration, and re-projection semantics into one TypeScript Todo reducer
• reconcile completion and supersede only after successor creation and identity writeback have finished inside the existing single-file transaction
• preserve unrelated owner-authored routes and fail closed on unknown, malformed, or ambiguous bindings

Problem and correctness model

A completed Todo could remain projected as the durable Next Action. That left lifecycle truth and routing truth contradictory, so consumers could continue steering toward already-completed work.

The fix treats Todo state as the source of truth and Next Action as an owned projection. System-generated projections carry a stable todo_id; legacy state may migrate only when its single visible Next Action is exactly equal to the completed Todo text. Unbound owner-authored text is never rewritten. A successor completion does not reproject until every declared successor identity is materialized.

The latest main-line TypeScript runtime refactor also exposed a Windows lifecycle bug. That bug is now fixed upstream by #3423; this branch is rebased on that fix and does not carry a duplicate implementation.

Architecture

• loopx/control_plane/todos/next_action.ts is the single semantic owner for binding, typed decoding, completion fencing, route matching, and next-open-advancement selection.
• The existing managed TypeScript runtime exposes one coarse todo.next_action.transition handler. No new daemon or generic command executor is introduced.
• Python retains a narrow DTO/compatibility facade and the existing file lock/write boundary. It invokes the reducer once at the end of complete_goal_todo or supersede_goal_todo, after all Todo mutations are present, so Todo and Next Action still commit through one file write.
• Replaced Python rule code and its implementation-specific tests were removed; native TypeScript tests own reducer invariants, while Python tests retain end-to-end CLI/state contracts.

Validation

• rebased onto origin/main at ad77a0487185aaf3fa26e04a6772a427053e0770, including the upstream Windows runtime repair in fix(runtime): probe Windows Effect process without signals #3423
• npm run typecheck:control-plane
• npm run test:control-plane — 25 passed
• combined Todo, managed-runtime, quality-gate, command, locking, self-update, and Windows-install pytest set — 194 passed, 6 skipped
• focused final Next Action integration pytest set — 7 passed
• ruff checks on changed Python surfaces
• full python -m mypy
• wheel and sdist build; both contain the new TypeScript module
• fresh wheel install and real managed-runtime Todo transition probe
• premerge canary — gate passed and self-merge allowed; all 17 risk-selected checks passed with zero failures, advisory failures, warnings, or manual holds
• git diff --check origin/main...HEAD
• added-line public/private boundary scan — clean

Boundary

This changes the built-in Todo completion and Next Action projection path. It does not launch benchmark jobs or change scoring, task semantics outside this projection, permissions, submissions, credentials, or third-party writes. No private evidence, local paths, raw logs, or generated artifacts are included.

[huangruiteng]

No actionable findings.

Open questions: none.

Product/architecture judgment:

• Motivation: a completed Todo could remain the durable Next Action, leaving the control plane with contradictory lifecycle and routing truth.
• Solved: the final diff makes Todo state authoritative, gives generated projections stable typed ownership, waits for the final successor-materialized snapshot, and preserves owner-authored routes by failing closed on absent, unknown, malformed, or ambiguous bindings.
• User/operator impact: completed work no longer remains the recommended route, while manually curated goal routing cannot be overwritten by a Todo completion.
• Main risk: this is the first Todo projection slice on the managed TypeScript runtime, so RPC decoding, package inclusion, and the Python transaction boundary are the compatibility risks.
• Design judgment: the reducer is domain-owned under control_plane/todos, the runtime registration is one coarse typed transaction, and Python is only the DTO and existing atomic-write adapter. This follows the latest TypeScript migration contract and avoids a second semantic implementation or a second state writer.
• Bounded future-facing pass: applied only where it has a current caller and regression contract. No speculative capability, provider, daemon, or generic executor was added.

Latest-main reconciliation:

• Rebased onto origin/main at ad77a0487185aaf3fa26e04a6772a427053e0770.
• The Windows failure reproduced unchanged on refactor(control-plane): move Effect Program authority to TypeScript #3416 and the subsequent main run. Upstream fix(runtime): probe Windows Effect process without signals #3423 fixed both the non-signaling process probe and inherited descriptor handling, and passed its Windows and Linux pytest jobs.
• The rebase adopts fix(runtime): probe Windows Effect process without signals #3423 intact. This PR carries only the Todo TypeScript module's runtime-fingerprint registration, not a competing Windows implementation.

Validation performed:

• TypeScript typecheck and native control-plane tests: 25 passed.
• Combined Todo, managed-runtime, quality-gate, command, locking, self-update, and Windows-install pytest set: 194 passed, 6 skipped; focused final Next Action integration rerun: 7 passed.
• Ruff, full mypy, and diff hygiene passed.
• Wheel and sdist include the Todo TypeScript owner; a fresh wheel install executed the real managed-runtime transition successfully.
• The bounded Python refactor moved supersede-lineage mutation into the existing control_plane/todos/line_update.py owner and reduced loopx/todos.py to 2284 lines, below its 2285-line ceiling; no exception was added.
• Premerge canary selected 17 checks; all 17 passed, and the gate allowed self-merge with zero failures, advisory failures, warnings, or manual holds.
• Added-line public/private scan was clean. No benchmark, permission, scoring, submission, credential, or external-write surface changed.

Merge decision: approved for owner-authorized self-merge after the refreshed GitHub checks, including the native Windows lifecycle job, pass.