fix(routing): harden authoritative route state

[andrei-hasna]

Follow-up for merged PR #37 / todos task 958cba66-7a42-47ab-b4c9-e00ede97bb3e.

What changed:

• Do not classify workflow_state-only metadata as deduped_active; require current_run_id or current_workflow_invocation_id for active/terminal workflow pointer gates.
• Verify project roots by default on drain-facing ready/source-discovery route_state surfaces.
• Add regression tests for workflow_state-only pointers and missing project roots in source discovery.

Validation:

• TMPDIR=/tmp BUN_INSTALL_CACHE_DIR=/tmp/bun-install-cache bun test src/lib/task-routing.test.ts src/lib/task-route-sources.test.ts
• TMPDIR=/tmp BUN_INSTALL_CACHE_DIR=/tmp/bun-install-cache bun test src/cli/cli.test.ts --test-name-pattern "route state|source discovery JSON"
• TMPDIR=/tmp BUN_INSTALL_CACHE_DIR=/tmp/bun-install-cache bun run typecheck
• git diff --check
• staged secrets scan: no hits

Known unrelated blocker:

• src/lib/event-hooks.test.ts still fails 3 cleanup cases in this restricted environment with EROFS removing /home/hasna/.cache/todos--hooks-home-; follow-up todos task 5d1fe7b8 was created for that CI harness issue.

No Co-Authored-By trailer.

---

Note

Medium Risk
Changes eligibility and dedupe classification for routed tasks and defaults admission checks to machine-local paths; behavior shifts for tasks with stale workflow_state-only metadata or bad working dirs.

Overview
Tightens task route state so drains and CLI “ready” surfaces agree on admission and dedupe.

Workflow pointers: deduped_active / terminal_requeue_needed now require current_run_id or current_workflow_invocation_id—metadata with only workflow_state (e.g. "working") no longer counts as an active/terminal pointer, so those tasks stay eligible instead of being deduped incorrectly.

Project root checks: Drain-facing paths default to filesystem verification of the resolved project root: discoverTaskRouteSources gains verifyProjectRoot (on by default, opt out with false), and todos ready --json attaches route_state from getTaskRouteState(..., { verifyProjectRoot: true }). Missing directories surface missing_project_root / missing_metadata and ineligibility when verified.

Regression tests cover workflow-state-only pointers and missing roots in source discovery.

^{Reviewed by Cursor Bugbot for commit aca2156. Bugbot is set up for automated code reviews on this repo. Configure here.}

[andrei-hasna]

CI classification after worker watch:

• dashboard: pass
• Cursor Bugbot: pass
• test: fail, same known unrelated blocker from PR fix(routing): make route_state authoritative + aligned with OpenLoops drain eligibility #37: three src/lib/event-hooks.test.ts explicit in-memory cleanup tests.
• Full test log reached 2314 pass / 3 fail; failed tests were:
  • local event hooks > suppresses quiet lifecycle hooks for explicit in-memory databases using a non-isolated todos home
  • local event hooks > suppresses quiet run hooks for explicit in-memory databases using a non-isolated todos home
  • local event hooks > suppresses quiet approval and review hooks for explicit in-memory databases using a non-isolated todos home

This matches local reproduction and follow-up todos task 5d1fe7b8. The routing/source-discovery tests and targeted CLI route-state/source-discovery tests passed locally before push.

[andrei-hasna]

Worker review update for task bbc01fc3-a9a2-48d3-ba1e-a24e3efcada9:

• Scoped PR fix(routing): harden authoritative route state #39 code review passed: the route-state change correctly stops treating workflow_state alone as an active dedupe pointer, source discovery now verifies project roots by default for the drain-facing surface, and legacy ready --json opts into root verification.
• Local validation on head aca2156 passed:
  • bun test src/lib/task-routing.test.ts src/lib/task-route-sources.test.ts: 23 pass / 0 fail
  • bun test src/cli/cli.test.ts --test-name-pattern "route state|source discovery JSON": 2 pass / 0 fail
  • bun run typecheck: pass
  • git diff --check and git diff --check origin/main...HEAD: pass
  • staged diff redaction scan and PR diff redaction scan: ok, no findings
• Independent adversarial verification found no scoped code issue.

Merge is blocked by policy right now. Live GitHub state is still mergeable=MERGEABLE but mergeStateStatus=UNSTABLE because CI test is FAILURE while dashboard and Cursor Bugbot are SUCCESS. The failure matches the known event-hooks read-only HOME cache blocker, and todos task 5d1fe7b8 is still pending. Per the task acceptance criteria, this PR should not be force-merged until that blocker is resolved or an explicit quarantine policy is recorded.