fix(todo): anchor runtime root to registry

[Duang777]

Goal And Delivered Outcome

• Goal/source and gap: list_goal_todos() resolved a relative common_runtime_root against the caller's working directory because it did not pass registry_path to resolve_runtime_root(). A CLI call from another worktree could miss the promotion fence and return stale Markdown Todos instead of canonical authority state.
• Observable before -> after, with the validation row that proves it: the new CLI regression returns todo_stale on the parent revision and todo_canonical on this revision, with decision_read_from_provider=true and legacy_fallback_used=false.
• Issue/task and intended base: self-contained reproduced bug; base main.

Scope And Continuation

• Completed scope and remaining work: anchor Todo list runtime resolution to the registry project and cover the public CLI path from an independent working directory. No schema or provider contract changes.
• Slice boundary / successor: complete within this scope; no successor is required.

Validation

• Tested revision: a368f7cf2ec8786abb7393d4843b9cbf995c98ec
• Run state: finished
• Input classes: synthetic, public_fixture

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	python -m pytest -q tests/control_plane/test_registry_relative_runtime_resolution.py -k todo_list_anchors_promoted_authority_to_registry_project; the parent revision returns the stale Markdown Todo, while this revision returns canonical authority state.
unit	passed	The registry-relative runtime, Todo list, and local coordination authority suites passed: 55 tests.
real_entrypoint	passed	The regression invokes python -m loopx.cli ... todo list from an independent working directory against the real FileAuthorityStore fixture.
static	passed	Ruff, Python compilation, git diff --check, and loopx check passed for the changed files.
integration	passed	loopx canary premerge --from-git-diff passed all 18 selected catalog and risk-profile smokes.
static	failed	Mypy follows the existing import graph and reports baseline errors, including 17 existing diagnostics in loopx/todos.py; no diagnostic points to the changed call.

• Coverage and gaps: the regression covers the faulty path-resolution branch, the promotion fence, the canonical read, and the stale Markdown counterexample. No provider implementation or persisted schema changed. Exact-head CI remains pending.

See validation disclosure guidance.

Frontend / Visual Evidence

• UI impact: none
• Before: N/A
• After: N/A
• States and viewports shown: N/A
• Source data: synthetic
• Attention review: N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference, when applicable: Core control-plane hardening; preserve fail-closed canonical Todo reads when the registry stores a project-relative runtime root.

Shared-authority RFC fixture impact

N/A. This bug fix changes registry-relative path anchoring in one Python caller. It does not change the production-scale fixture, provider semantics, promotion behavior, or compatibility projection.

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths (including .loopx/, .codex/goals/, and live ACTIVE_GOAL_STATE.md).
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

[Duang777]

CI triage for head a368f7cf2:

• test-shard (3) fails in test_legacy_coordination_writer_fence.py and the File case in test_todo_projection_concurrency.py.
• test-shard (4) fails in the SQLite case in test_todo_projection_concurrency.py.
• node-minimum-compatibility reports nine failures in authority_archive.test.ts.

This PR changes only loopx/todos.py and test_registry_relative_runtime_resolution.py. PR #4906 changes the three failing test areas and the Node timeout configuration, and its exact head d38410f00 passed the same Node minimum and Python shard jobs. I am keeping #4913 scoped to the Todo runtime-root fix. After #4906 reaches main, I will sync #4913 and rerun exact-head CI.

[huangruiteng]

结论

代码评审通过（exact head a368f7cf2）。这修复的是 todo list 从独立工作目录读取相对 common_runtime_root 时漏掉 registry 锚点的问题；我没有合并此 PR。当前远端 CI/merge gate 仍是红色，合并需等相关基线修复、同步后重新验证，不把代码评审通过当成 merge-ready。

问题与边界

基线 list_goal_todos 调用 resolve_runtime_root 时不传 registry_path，导致相对运行目录随调用者 cwd 漂移；promoted Goal 可能找不到 provider fence，并把旧 Markdown Todo 当真。新 head 复用现有路径解析器，没有新增 Todo 权限、状态协议或写入。绝对运行目录保持原语义。

关键代码讲解

• loopx/todos.py:208：把 registry_path 交给现有 resolver，让相对目录锚定 registry 所属项目。
• tests/control_plane/test_registry_relative_runtime_resolution.py:124：真实 CLI 子进程从独立 cwd 读取合成 promoted provider；故意让旧 Markdown 与 canonical Todo 分叉，并检查 provider=true、legacy=false 和调用目录没有新建 runtime。

验证与风险

精确 head 的目标测试 3 passed（13.02s）；git diff --check 通过。负例覆盖旧 Markdown 不可盖过 provider；未触碰真实 Goal。当前 test-shard (3)/(4)、Node minimum 等远端检查失败，PR 作者已指出对应 #4906 的交叉基线问题；我未将这些失败归因于本次两文件改动，也未宣称完整 CI 通过。合并前仍需在更新后的 head 上取得绿色必需检查。

后续

无此 head 的代码阻塞意见。邻近调用点若也遗漏 registry_path，应按各自实际入口和回归证据修复；不扩大这次窄改。未来向重构检查：现有 resolver 正是合适边界，无需新抽象。

English verdict: APPROVE the code at exact head a368f7cf2; merge remains on hold until required CI is green on the final head.