feat: implement todo plan clearance on turn start

packages/host/apiproxy/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/host/apiproxy/README.md
-README.md: 33a4752f97c17e7879dff11a33acc93e335496b7
-README.zh.md: 45aee0225717ad8a4d9b923067f196535c7ab3f9
+README.md: c1a4bb9aa08119dc0edb783fad22a758410e18d8
+README.zh.md: 8ba835751771d38b9b5e192b48bd64b1e347b49f

packages/host/apiproxy/README.md

@@ -20,7 +20,7 @@ Workspace and Session lists are separate reconnect baselines. `workspace.create`
 
 `host.openPath` opens a filesystem path with the operating system's default application (`open` on macOS, `Invoke-Item` on Windows, `xdg-open` on Linux). The opener is injectable for tests. The browser carrier applies the same loopback, same-origin restriction as `host.pickDirectory`.
 
-`session.history` pages on message boundaries, and its tail page (no `beforeSeq`) carries two session-level extras the page window cannot supply: the in-flight partial's chunk events, and `todos` — the latest `todo/write` whole-list projection over the full log. Older pages omit `todos` because the projection is session-level, not per-page; a tail response that omits it means the whole log holds no `todo/write`, so clients read the absent field as the empty plan rather than as unchanged state.
+`session.history` pages on message boundaries, and its tail page (no `beforeSeq`) carries two session-level extras the page window cannot supply: the in-flight partial's chunk events, and `todos` — the standing plan over the full log (latest `todo/write` with no later `turn/start`). Older pages omit `todos` because the projection is session-level, not per-page; a tail response that omits it means no plan stands, so clients read the absent field as the empty plan rather than as unchanged state.
 
 The `command.*` and `skill.*` domains expose the host command registry and skill catalog to clients. Every method addresses one session's agent by `sessionId` (a served session always has an Agent; `command.*` resumes cold sessions through the same path as `session.*`, while `skill.list` resolves the project root from the session header without touching the Agent registry). `command.execute` runs a slash-command line host-side and returns a detached result; the carrier's request signal cancels the running handler. `host/commands-changed` is the catalog invalidation frame: clients refetch `command.list` instead of diffing.
 

packages/host/apiproxy/README.zh.md

@@ -20,7 +20,7 @@ Workspace 列表与 Session 列表是相互独立的重连基线。`workspace.cr
 
 `host.openPath` 会用操作系统的默认应用打开一个文件系统路径（macOS 为 `open`，Windows 为 `Invoke-Item`，Linux 为 `xdg-open`）。打开器可在测试中注入。浏览器载体对其施加与 `host.pickDirectory` 相同的回环、同源限制。
 
-`session.history` 按消息边界分页，其尾页（不带 `beforeSeq`）额外携带两项页窗口本身无法提供的会话级数据：进行中局部消息的 chunk 事件，以及 `todos`——整份日志上最后一次 `todo/write` 的整表投影。较早的页面不带 `todos`，因为该投影是会话级而非分页级的；尾页响应缺少该字段意味着整份日志中没有任何 `todo/write`，因此客户端要把缺失字段读作空计划，而不是读作「状态未变」。
+`session.history` 按消息边界分页，其尾页（不带 `beforeSeq`）额外携带两项页窗口本身无法提供的会话级数据：进行中局部消息的 chunk 事件，以及 `todos`——整份日志上的站立计划（其后没有更晚 `turn/start` 的最近一次 `todo/write`）。较早的页面不带 `todos`，因为该投影是会话级而非分页级的；尾页响应缺少该字段意味着当前没有站立计划，因此客户端要把缺失字段读作空计划，而不是读作「状态未变」。
 
 `command.*` 与 `skill.*` 领域向客户端暴露宿主命令注册表和技能目录。每个方法都通过 `sessionId` 寻址一个会话的 Agent（被服务的会话必有 Agent；`command.*` 经由与 `session.*` 相同的路径恢复冷会话，而 `skill.list` 从会话头解析项目根目录，不触碰 Agent 注册表）。`command.execute` 在宿主侧运行一条斜杠命令行并返回脱耦结果；载体的请求信号可取消正在运行的处理器。`host/commands-changed` 是目录失效帧：客户端重新拉取 `command.list` 而不是做差分。
 

packages/host/apiproxy/src/api-proxy.ts

@@ -295,11 +295,17 @@ function backscanArgs(events: readonly SessionEvent[], callId: string): { name:
   return undefined
 }
 
-/** Current todo projection: the latest `todo/write` over the full log (whole-list replace ⇒ last write wins); undefined when none. */
+/**
+ * Current plan projection over the full log: the latest `todo/write` that is not
+ * followed by a later `turn/start` (whole-list replace ⇒ last write wins; a new
+ * turn retires the previous plan). Undefined when none stands.
+ */
 function backscanTodos(events: readonly SessionEvent[]): TodoItem[] | undefined {
   for (let i = events.length - 1; i >= 0; i--) {
     const event = events[i]
-    if (event !== undefined && event.type === 'todo/write') return event.data.todos
+    if (event === undefined) continue
+    if (event.type === 'turn/start') return undefined
+    if (event.type === 'todo/write') return event.data.todos
   }
   return undefined
 }

packages/host/apiproxy/tests/api-proxy-view.spec.ts

@@ -179,6 +179,11 @@ describe('mux live view computation', () => {
     const older = await api.sessions.history({ rpcId: RpcId('t-todos-2'), payload: { sessionId: session.id, beforeSeq: boundary, maxMessages: 2 } })
     if (!older.result.ok) throw new Error('older failed')
     expect('todos' in older.result.value).toBe(false)
+    // A later turn/start retires the standing plan (omit the field = empty).
+    session.append('turn/start', { turn: 6, trigger: { kind: 'message', source: { kind: 'user' } } })
+    const cleared = await api.sessions.history({ rpcId: RpcId('t-todos-cleared'), payload: { sessionId: session.id, maxMessages: 2 } })
+    if (!cleared.result.ok) throw new Error('cleared failed')
+    expect('todos' in cleared.result.value).toBe(false)
     // A session with no todo/write anywhere omits the field.
     const bare = ctx.sessions.create()
     ctx.agents.register({ id: bare.id, session: bare, status: 'idle', ctx } as Agent)