[xyx2002OvO]

Summary

• preserve the typed missing_turn_lineage contract error when a normal host route has neither a selected Todo nor a signed scoped request identity
• keep replan and invalid request-session combinations as operational holds
• leave the signed ordinary-request settlement path unchanged

Context

Commit 3ebad9d021 added scoped settlement identity resolution for ordinary requests. It also changed a READY_FOR_HOST envelope with no selected Todo and no scoped identity into BLOCKED before _session_plan could return its existing missing-lineage contract error.

The regression reproduced on main@544aa0fee5dad33e3b70496dadfb3ffd36400e13 and failed the existing test_turn_plan_missing_todo_does_not_bypass_contract_errors assertion in both the Ark adapter job and MemT adapter job observed from #7603. This branch is now rebased on main@652f503842609e948e8ff832ae3977f23f79f28d.

This PR is intentionally separate from #7603's private-I/O runtime change. The unrelated browser-smoke baseline failures have focused owners in #7599 (delegation-search, merged) and #7620 (team-evidence, open with its hosted target and Release build passing).

Validation

• hosted Ark adapter contract: Python 3.11 passed, Python 3.13 passed
• hosted MemT adapter contract: Python 3.11 passed, Python 3.13 passed
• pytest missing-Todo contract regression: 2 passed
• signed-governance/replan hold cases: 9 passed
• ordinary request settlement on real File and SQLite backends: 2 passed
• complete tests/test_loopx_turn_driver.py: 147 passed; 1 local Windows fixture-setup failure before this route logic (_fake_codex returned a packaged executable that the test attempted to read as UTF-8)
• ruff check loopx/control_plane/turn_driver/driver.py: passed
• mypy --platform linux: 17 files passed
• exact-head diff-scoped standard premerge canary: 10 selected checks passed, 0 failures
• hosted DCO, dependency review, real PostgreSQL authority, Windows PowerShell, kernel contracts and available TypeScript/stage2c checks: passed
• public/private boundary scan: clean

This PR's hosted Release Artifacts build failed at team-evidence-return-smoke.mjs:133, the same baseline fixture-state leak observed on #7603. #7620 fixes that independent failure; its hosted chat-bundle-browser (2) and Release build both pass. #7618 still requires ordinary review and a fresh post-dependency run before merge consideration. No merge is requested by this submission.

[xiaoan17]

这个 PR 在当前 main 上已经过时，而且会与 #7523 刚定下的契约冲突

复核方式：在当前 main（0a9a3a388，含 #7523）之上把本 PR 的补丁套上去再跑测试。

1. 本 PR 针对的那条红项在当前 main 上已经不存在了。

#7523 把 tests/test_loopx_turn_driver.py 里的
test_turn_plan_missing_todo_does_not_bypass_contract_errors 改名并重写为
test_turn_plan_without_todo_requires_signature_and_scoped_binding，所以 adapter-contract lane
在当前 main 上不再因为这一条失败。

2. 更重要的是：这个 PR 会把 #7523 明确修正过的契约改回去。

#7523 的说明里写得很清楚：

旧测试仍要求合法但无绑定工作报 contract_error，同命令在不可变 main 同样失败。
当前规则返回 blocked；本 PR 修正测试并加强无 Host、无 session、无 transaction/effects，
原固定组合的整个 driver 148 项及完整 903 项通过，不改变生产准入。

重写后的断言是：

assert payload["ok"] is (not invalid_signature)
assert payload["route"]["kind"] == ("contract_error" if invalid_signature else "blocked")

也就是签名合法但没有 Todo → blocked hold，而不是 contract_error。

本 PR 的改动把 route = LoopXTurnRoute.BLOCKED 换成"保持 READY_FOR_HOST，让 _session_plan
返回 typed missing-lineage error"，正好把这一格从 blocked 翻回 contract_error。

3. 实测证据。

在 0a9a3a388 上：

• 不套本 PR 补丁：test_turn_plan_without_todo_requires_signature_and_scoped_binding → 2 passed
• 套上本 PR 补丁：→ 1 failed, 1 passed

失败的那一条正是签名合法、无 Todo 的情形：

assert payload["ok"] is (not invalid_signature)
E   assert False is not False

tests/test_loopx_turn_driver.py:1343

结论：这条红项的正解是"改测试"，不是"改产品"。#7523 已经把它改完了，方向上属于
#7622 那一类（改过期期望），而不是本 PR 的"恢复 typed contract error"。

建议本 PR 关闭，不要合并；否则会把主干刚定下的 blocked hold 语义翻回 contract_error，
并破坏 #7523 加强过的断言（无 Host、无 session、无 transaction/effects）。

English verdict: this PR is obsolete on current main and contradicts the contract #7523 just
settled. With the patch applied, test_turn_plan_without_todo_requires_signature_and_scoped_binding
fails (2 passed → 1 failed, 1 passed): a valid signature with no Todo must remain a blocked
hold, not a contract_error. The fix for that stale expectation belongs in the test, which
#7523 already did.