feat(goals): add reversible stop and resume

[huangruiteng]

Summary

• add a typed, reversible Goal activation lifecycle with preview/execute CLI and owner-confirmed Chat actions
• make stop remove the Goal from active attention and project zero effective quota, so the next scheduler packet stops recurring host automation without deleting Todo, evidence, history, or configured quota
• reuse one canonical hard-pause path for Goal stop and quota.compute=0, while preserving typed causes and different resume authority (goal resume versus positive quota update)
• split the workspace directory into active Goals and a collapsed stopped-Goals section with focused browser coverage

Refine decisions

• stopped Goals remain visible in run history and the stopped directory, but never receive automatic allocation or active-attention work
• configured quota is retained and restored on lifecycle resume; if configured compute was already zero, resume correctly remains quota-paused
• quota set > 0 cannot reactivate an owner-stopped Goal
• a stop does not force-kill an in-flight tool call; the next quota should-run packet instructs Codex App or another scheduler owner to pause/delete the recurring heartbeat
• idempotent stop/resume now repairs a drifted shared-registry projection before issuing a verified receipt; stale Chat state no longer returns an unverified early success

Validation

• git range-diff: the two original commits remain patch-equivalent after rebase onto current origin/main
• full Python suite: 3572 passed, 10 skipped
• final-head focused lifecycle/quota/scheduler suite: 28 passed
• changed-surface Ruff: passed
• repository strict mypy targets: passed
• dashboard TypeScript/Vite production builds: passed
• npm run smoke:personal-workspace: passed
• loopx canary premerge --from-git-diff --goal-id loopx-meta: 18/18 selected checks passed, 0 failures, 0 warnings, 0 manual holds
• public/private boundary scan: passed
• exact change-quality receipt: cqr_bdabb4cd5e21a19fa344

The owner-approved first-screen presentation is unchanged by the refine commit. No private state, credentials, local paths, raw benchmark evidence, or generated browser artifacts are included.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

这个 PR 解决的是 Goal 数量增长后的真实操作问题：不活跃 Goal 不能继续占据主列表和自动调度，但又不能用完成/删除来伪造生命周期。新增可逆 stop/resume，既让 owner 能整理工作区，也保留 Todo、历史、证据与后续恢复能力，和用户提出的产品需求一致。

改动思路

后端用 typed GoalActivationState(active|stopped) 与 versioned activation record 表达状态；CLI 和 Chat 都走 preview/explicit execute/readback；source registry 写入后同步 global registry，失败时显式暴露 partial write。quota 在 stopped 状态返回 paused，attention queue 排除 stopped Goal。前端按 activation state 拆成 Active Goals 与默认折叠的「已停止」区，stop/resume 只创建 typed action preview，仍需 owner 确认。

具体改动

• 完整阅读了 25 个 changed files，并核对 activation service、global sync/readback、quota/attention projection、Chat action、sidebar/home mapping、docs、browser fixture 和生成 bundle 的调用链。
• 正向路径闭合：旧 registry 默认 active；stop/resume 可逆；preview 零写入；执行同时验证 source/global；stopped Goal 不再进入自动 attention/quota 运行面，但其 run history/Todo/evidence 未删除；resume 只恢复 eligibility，不绕过 quota、Gate 或 Todo。
• 交互符合已批准首屏：主目录只显示 active 项，stopped 项在折叠区保留，行尾 pause/restore 进入确认抽屉；桌面与 mobile、reduced-motion 都有 browser smoke 覆盖。没有发现直接写控制面、默认行为静默放宽、私有路径/凭据或删除历史的 blocker。
• 本地验证：focused pytest 5 passed；changed-surface Ruff passed；npm run build passed；npm run smoke:personal-workspace passed；本地重新渲染并目视检查 lifecycle directory screenshot。远端 9 个 checks 全部 success/skip，无 pending。

对主干的风险

主要风险是双 registry 写入中途失败；实现没有假装原子跨文件事务，而是预检 target writability、锁定 source、执行规范 sync、双端 readback，并在失败时返回 partial_write 与明确修复命令，这个取舍对本地控制面是可恢复且诚实的。停止只影响后续自动 Turn，不删除状态、不冒充完成，风险边界清楚。未发现需要阻止合并的 correctness、authority、privacy 或 presentation 问题。

我的整体评价

通过。这个 batch 把状态模型、调度语义、可恢复写入和前端信息架构放在一个完整、可回滚的 PR 中，scope 合理；测试既覆盖 typed lifecycle，也覆盖真实浏览器交互。由于 PR 作者与当前 GitHub 身份相同，GitHub 不允许 formal self-approval，所以这里发布等价的 owner-head approval conclusion；仓库要求的独立非作者 approval 仍需由另一 reviewer 提交。

English verdict: Approve. The exact head provides a coherent, reversible Goal activation lifecycle across typed registry state, quota/attention behavior, verified source/global sync, and an owner-confirmed Active/Stopped UI. Focused Python checks, Ruff, production builds, browser smoke, visual inspection, and all remote checks passed; no merge-blocking correctness, authority, privacy, or first-screen issue was found. GitHub blocks formal self-approval, so an independent non-author approval is still required by repository policy.

[huangruiteng]

Exact-head refine review — 6d12d2687

I re-reviewed and refined the Goal lifecycle change across these surfaces:

• typed activation and source/global registry synchronization;
• attention and quota planning;
• quota should-run, automation liveness, and scheduler hints;
• Chat preview/apply receipts and idempotent recovery;
• Personal Workspace active/stopped directory and public operator docs.

Product/architecture conclusion

Goal stop and quota.compute=0 should share the same automatic shutdown mechanism, but they must not become the same authority state. The final contract is:

owner Goal stop → leave active attention → effective quota=0 → host automation stop

The configured quota remains durable. A typed pause_cause distinguishes goal_stopped from compute_quota_zero, so raising quota cannot accidentally revive a Goal the owner stopped. Lifecycle resume restores the stored quota policy; if that policy is still zero, the Goal remains quota-paused. The next scheduler packet stops the Codex App heartbeat; an in-flight tool call is not force-killed.

I also fixed two correctness gaps found during review: stopped Goals missing from attention are now re-derived as paused from run-history state, and an idempotent lifecycle retry repairs shared-registry drift before Chat records a verified success.

Validation

• full Python suite: 3572 passed, 10 skipped;
• final-head focused lifecycle/quota/scheduler tests: 28 passed;
• Ruff and strict mypy: passed;
• TypeScript/Vite production builds: passed;
• Personal Workspace browser smoke: passed, including preview-before-write, desktop/mobile directory behavior, and reduced motion;
• change-quality receipt: cqr_bdabb4cd5e21a19fa344, exact scope verified;
• premerge canary: 18/18 passed, 0 failures, 0 warnings, 0 manual holds;
• public/private boundary: clean.

The full suite emitted one pre-existing third-party forward-reference warning; the Vite build emitted its existing large-chunk advisory. Neither affected correctness. The declared 10 test skips remained skips, not failures. There are no validation failures or manual holds on this head.

Merge judgment: ready after the remote exact-head checks complete. The owner explicitly authorized self-merge; the exact-scope canary reports self_merge_allowed=true.