refactor(todos): retire unused decision-scope Python facades

[loopx-agent]

Four internal Python decision-scope facades have no remaining production callers. Remove them and their unused blocking-state constant, retaining the existing TypeScript rule owner, active batch/single-relation adapters, fail-closed decoders and supported wire operations. Move the outer-envelope negative test to the active relation adapter and document the internal retirement boundary.

Validation: Python regression baseline 76/head 73 (three retired-helper cases removed); eight existing typed-rule tests before/after; two independently built wheels, six real File/SQLite scenarios and 48 CLI calls per arm with package/module provenance. Explicit outcomes, missing actor/outcome and invalid scopes, and display-loss readback are covered. A disposable-wheel decoder mutation fails the retained negative tests. Ruff, configured 19-file mypy, control-plane typecheck, semantic advisory/smoke and packaged bundle/wheel builds passed.

Draft hold: an additional single-file mypy invocation follows a wider import graph and finds four unchanged errors in work_lane.py and succession_warning.py, also reproduced in the baseline wheel. The native change-quality receipt records this failure and holds qualification; this PR does not bypass that gate. Risk-based premerge executed five direct checks and 19 selected checks; all executions passed, but the overall gate remains quality_invalid_receipt for the recorded wider-import failure. The native review packet classifies this draft as readback-only; no approval or merge-readiness claim is made.

No provider, persisted format, permission, default, CLI/frontend/Lark interaction or supported recovery path changes. Existing GUI journeys and PostgreSQL storage were not separately exercised; their implementation is unchanged. This is a bounded internal retirement, not completion of writer removal or SQLite/default migration. Revert the single commit to restore the facades; no data migration is needed.

[loopx-agent]

Draft validation and qualification hold at 53f1b60b28a855585ff3290342075a7219832c09.

Reviewer: model_agent; GPT-6 family; OpenAI; self_reported (exact runtime build unavailable). This is a draft validation note, not an approval verdict.

动机

按 TypeScript migration RFC 的 T4 last-caller 边界删除失去生产调用方的内部 Python facade，降低维护面；这不证明 SQLite 默认迁移或全部旧 writer 的验收。依据为 docs/architecture/rfcs/typescript-control-plane-migration-v0.md，基线 revision f1efc22e1b97971751bb5e8a32b13d6b6ed434d6。

改动思路

保留现有 TS decision-scope owner、活动 relation/batch/consistency/gate-scope adapters 和 wire 操作，直接删除四个闲置包装与重复 blocking-state 常量，不增加桥接层。保留带实际调用方的解码、持久化、备份和恢复路径。仓库搜索只剩新的退役说明、课程伪代码与未改动的 reason token，没有生产 import/调用或动态注册。

具体改动

decision_scope.py 删除四个 helper 和 TODO_GATE_BLOCKING_STATES。runtime-boundary 测试删除三项专属旧入口 case，把外层 envelope 的四个负例转到活动 todo_gate_relation，保留 nullable、schema 与 batch cardinality 校验。协议文档只增加内部退役边界，不改变 CLI、默认值、权限或前端操作。

对主干的风险

源码 Python 基线 76/head 73 pass，既有 TS 八项语义测试前后通过。两套独立 wheel 各执行六个真实 File/SQLite 场景、48 次 CLI；approve/reject/cancel、缺 actor/outcome、非法 scope 不写入与 display 删除后的 provider 读回均按独立约束验证。96 个 CLI 子进程来源、每臂四个模块 hash 已核对。可丢弃 wheel 中放宽外层 envelope 的 mutation 使四项负例失败，模块原字节已恢复。

Ruff、仓库配置的 19-file mypy、focused module check、完整 control-plane typecheck、semantic advisory/smoke、Chat bundle 和两套 wheel build 通过。canary premerge --from-git-diff 的五项 direct 和 19 项选中执行均通过，公开边界扫描干净，没有新增 vocabulary、domain prose rule、feature switch 或权限变化。GUI、其他 OS 和 PostgreSQL 存储未单独测试；实现未改变。

额外的 python -m mypy loopx/control_plane/todos/decision_scope.py 会检查更宽的 import graph，基线 wheel 与 head 均报 work_lane.py:262,267,268 的 nullable .get 和 succession_warning.py:207 的 dict attribute 错误。配置检查通过不等于这些错误已修复。已把失败原样写入 change-quality 结果；当前 strict gate 是 quality_invalid_receipt，不是测试执行全绿后的合并许可。

我的整体评价

删除边界有真实调用方检查与实际 backend/package 证据，可单独回滚；没有用语言或 LOC 代替价值判断。资格仍被 recorded failure 持有，保持 Draft。应通过现有质量/任务机制归因并修复或正式协调该验证边界，再重验同 scope；不修改 gate、擦掉失败、要求本 PR 顺带修所有无关代码或 admin bypass。原生 PR review 对当前 Draft 返回 review_action_kind=null，本次不强制创建审批结论。此处记录结果和剩余阻塞，供后续资格恢复使用。

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · xhigh

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

精确 head：5ed411ca40882662ae77520bea7c83fb99e2e26f；整合前 head：53f1b60b28a855585ff3290342075a7219832c09；当前 base：main（cdfe14643 已并入）。

动机

内部 Python decision-scope facade 已无生产调用方，继续保留会让同一规则出现第二份可被误用的入口。本 PR 退役这些没有调用方的 facade 与不再使用的阻塞状态常量，同时保留 TypeScript 规则 owner、active 的 relation/batch/consistency/gate-scope adapter、fail-closed 解码与全部受支持的 wire 操作；分支需要先整合已经前进了 55 个提交的主干再判断。

改动思路

先把当前主干并入并重新测量：主干已经由 f574ec73f 自行退役了 decision_scope_covers、decision_scope_gate_relation、exact_todo_gate_relation，因此本 PR 的有效增量收敛为 TODO_GATE_BLOCKING_STATES 与 todo_gate_relation_blocks_agent 两项，以及协议文档里的内部退役边界说明。冲突只有一处：主干在同位置新增了仍然存活的 todo_gate_relation 外层 envelope 负例，本 PR 只退役已死的 helper，因此保留主干那条新用例，其余移除照旧。

具体改动

整合后相对 main 为 2 文件、+14/−7：loopx/control_plane/todos/decision_scope.py 删除阻塞状态常量与其谓词（todo_gate_relation、todo_gate_relations、select_scoped_gate_fallback、todo_gate_scope_projections、consistency/authority adapter 全部保留）；docs/reference/protocols/long-horizon-agent-state-protocol-v0.md 记录内部退役边界并声明不改 CLI、持久决策、审批权限、provider 选择或恢复格式。测试文件在整合后与主干一致（主干已移除对应旧用例），并保留主干新增的 envelope 负例。验证：test_todo_decision_scope_runtime_boundary.py 21 项通过；连同 test_auxiliary_scoped_gate.py、test_scoped_gate_fallback_selection.py 合计 70 项通过；rg 复查仓库内已无 todo_gate_relation_blocks_agent/TODO_GATE_BLOCKING_STATES 的调用方（只剩文档描述）；ruff 干净；仓库配置的 19 文件 mypy 通过；语义 vocabulary smoke 通过；公共边界扫描 3 文件干净。

对主干的风险

这是内部退役：没有 CLI、前端、Lark、providers、持久格式、权限或默认值变化；被保留的 wire 操作及其 schema 校验仍受支持，回滚只需恢复这一条。PR 正文提到的「更宽 import 图的单文件 mypy」失败只涉及未改动的 work_lane.py/succession_warning.py，属继承问题而非本 PR 引入；本 head 不把它当作通过，也不声称 GUI 旅程或 PostgreSQL 存储被重新验证。控制面合并资格仍由维护者决定。

我的整体评价

APPROVE：退役范围已按整合后的主干重新收窄，残留 facade 确无调用方，存活 adapter 与 wire 契约未动，回归与类型检查通过；剩余的主干继承债务与更宽资格由各自 owner 继续处理。

English verdict: APPROVE - 5ed411c. After integrating current main the retirement is scoped to the two helpers that lost their callers; the surviving relation, batch, consistency and gate-scope adapters and their wire schemas are untouched, no caller remains in the tree, and 21 boundary plus 70 related tests, ruff, the configured 19-file mypy set, the semantic smoke and the boundary scan pass. The wider-import mypy failure the PR body discloses reproduces on unchanged unrelated files.