fix(quota): keep unbound scheduled vision waits quiet

[huangruiteng]

When a Codex App wake finds a retained Vision whose single successor is deferred until a future resume_at, quota commits an unbound heartbeat receipt but previously required a monitor-poll. That command rejects the same Turn with heartbeat_receipt_identity_conflict because it has no Todo settlement binding.

The shared TypeScript interaction owner now permits quiet waiting only with a complete, pending canonical runtime-clock proof and no existing settlement or pending selection binding. Python preserves and transports the clock proof. The due-time lifecycle, independent runnable work, dependency/mixed waits, and existing Turn settlement fences keep their original behavior. This is a narrow interaction projection repair; it does not waive monitor identity validation or schedule work early.

Validation:

• Reproduced the required-attempt projection through the real source CLI before the repair.
• Related Python regression suites: 70 passed. Additional real CLI/settlement controls: 10 passed, including legacy Markdown, canonical File and SQLite, repeated/replayed pre-due wakes, due resume, independent work, valid monitor settlement, and stale/foreign identity refusals.
• TypeScript interaction/coverage/monitor commit suites: 43 passed; control-plane typecheck passed.
• Premerge: all 19 selected checks and 5 direct checks passed. Ruff, whitespace checks, semantic inventory advisory and the seven-file public-boundary scan passed.
• Focused mypy comparison against the same upstream base: 74 existing diagnostics on each side, no new diagnostics. The import-following invocation still fails on repository-wide existing diagnostics; this is not a clean full mypy qualification.

All fixtures are synthetic. CLI coverage isolates data and managed Effect processes. The change is source-qualified; installed-host adoption and game outcome benefits require later observation.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh

动机

使用定时恢复任务的自动 Agent 与维护者。 唯一后继任务还没到恢复时间时，旧心跳要求执行 monitor-poll，却因没有 Todo 绑定而拒绝该命令；当前完整时钟证明允许安静等待，到期仍须显式恢复任务。

真实 CLI 的旧 Markdown、canonical File 和 SQLite 路径均验证提前等待与同 Turn 重放；到期恢复、独立任务和监控身份拒绝路径通过。 不提前调度、不放宽已绑定 Turn 的结算或监控校验，也不声明实际 App 安装、模型采用与长期净收益。 没有发现当前有界修复的阻塞问题。

改动思路

安静等待必须来自完整、同 Agent、唯一后继的原生时钟证明。已有 settlement 或 pending-selection 绑定不走豁免；依赖与混合等待继续观察。复用现有 TypeScript interaction owner 和 resumeConditionHasKnownPendingTarget，Python 只保留并传递事实。当前边界是共享交互投影修复，既有恢复、结算与权限 owner 保持；删除所有 poll 身份门或添加第二定时器都不是合理替代。

先读接受前版本 docs/quota-allocation.md，固定 3dd3c550afecfa0c525a34e8744a3cf06774ac94。逐项判断：resume_at 的一次运行时时钟、到期显式恢复与不重复 receipt 已 implemented；vision_wait_state 的精确支持条件、无独立可执行任务及严格 lineage 已 implemented；“Receipt-backed settlement progress”的原 Turn 身份与结算义务已 implemented。新增中英段落是在解释已复现的矛盾修复，不作为自己的独立验收来源。

具体改动

完整 head：44363a4e9a493adbee04b9a578d9e0b87e28df1e；真实 base：3dd3c550afecfa0c525a34e8744a3cf06774ac94。全七文件 +309/-5。

• projectBlockedSuccessorWaitObservation 检查精确等待形状、receipt 绑定、同 Agent、单个 open/deferred 后继，再调用既有 typed resume owner 验证 clock/source/date/material-generation/receipt。
• _compact_resume_condition 保留完整时钟事实和明确 resume_receipt=null；不制造时间或执行恢复。
• _blocked_successor_wait_observation_required 调用注册的 Effect handler，结果供既有模式、machine flags、主动作与 CLI 动作消费者使用。
• 两个测试文件覆盖真实 CLI 三种 provider、重复提前 wake/重放、到期、独立工作、合法 monitor 和 stale/foreign 拒绝；文档明确这次默认行为仅修正合法的 unbound 定时等待。

对主干的风险

主要风险是把已有绑定、未知时钟或依赖等待误当成可静默的未来日期。110 项完整相关 Python 测试通过，包含六个新增真实 CLI 用例；57 项 TypeScript interaction/resume/coverage/monitor-commit 测试通过，均零跳过。相同新用例在不可变 base 的 legacy/File/SQLite 三路都在 must_attempt=True 处失败；head 安静等待并保持原 Todo、恢复日期和源文件，重放及后续两个 wake 不生成 poll/spend。base 的到期与独立工作两项对照通过；head 仍要求到期显式恢复、执行独立工作。无绑定的强行 monitor-poll 继续报身份冲突，已有合法绑定可以提交，stale/foreign 请求拒绝且状态不变。

typed 反例覆盖 existing/pending bindings、foreign Agent、两个等待、已完成后继、未知 receipt、坏或缺时钟证明、author clock、错误日期以及依赖条件，不能放宽观察义务。完整 coverage 家族继续验证显示上限外的因果工作、无关联/已归档引用、缺 checkpoint 和 closed-stage 缺口。

原生 canary 5 direct/19 selected 全通过，无人工 hold；control-plane typecheck、Ruff、diff、七路径公私扫描和 advisory 后完整语义检查通过。纯内部投影无新 capability、开关、timer 或 durable state，也不改变外部权限。改动进入既有 quota/heartbeat/status 交互路径；源码 CLI 与合成 File/SQLite 实际后端已测，packaged App/Lark、自然模型使用和长期成本未资格化。未读取、轮询或等待 CI。

我的整体评价

APPROVE。修复让合法等待不必反复执行必然被拒绝的命令，同时保留到期恢复、独立工作与原 Turn 结算。当前四处 production owner/transport、文档和测试构成一个可独立回退的完整源修复。未来重构检查已应用：共享 TypeScript proof owner，Python 无第二判断源；没有当前需要的新抽象。机器执行义务与解释文字保持区分；本结论不证明整个 Goal、安装或模型收益完成，也不授予合并权限。

English verdict: APPROVE - 44363a4; quiet only positively clock-qualified unbound scheduled waits. 110 Python/57 TypeScript tests pass; all three baseline providers reproduce the defect, due/independent work and bound-monitor fences stay enforced. Installed/model/long-horizon adoption remains unverified.