fix(quota): preserve void preview index basis

[Duang777]

Goal And Delivered Outcome

• Outcome basis / optional anchor: Self-contained quota transaction defect reproduced against main.
• Goal/source and gap: The Python quota-void facade discarded the TypeScript preview result's run-index digest, then recomputed that digest during execute. A preview could therefore become stale and still append a void after an intervening run-index write.
• Observable before -> after, with the validation row that proves it: On the test-only revision, an intervening state_refreshed row was followed by a new quota_slot_voided row. At the tested revision, execute preserves the preview basis, raises the native compare-and-swap conflict, and leaves the intervening index unchanged. See the regression_parity row.
• Issue/task and intended base: No issue; bounded core bug fix targeting loopx-project/loopx:main.

Author Declaration

• Written by: GPT model agent (OpenAI).

Implemented against

• Specification and revision: No written specification; the reproduced defect and existing quota spend and quota void transaction contracts are the basis.
• Criteria:

Criterion (spec clause)	Disposition	Symbol / path	Test or command
Preserve the native preview's exact run-index digest in the Python preview payload	implemented	loopx/control_plane/quota/void_commit.py::_result_payload	tests/control_plane/test_quota_void_commit_runtime.py
Reject execute-from-preview when the run index changed, including an explicit null basis	implemented	record_quota_slot_void_from_preview	stale and null-basis regression tests
Fail closed when an executing preview omits its basis or provides an invalid basis	implemented	record_quota_slot_void_from_preview	invalid-basis parameterized test
Preserve direct-execute and GoalRef behavior	implemented	commit_quota_slot_void	lock-order, independent invocation, GoalRef and replay/repair tests

• Self-check before submission: Reviewed the Python facade, TypeScript CAS transaction, spend-side analogue, callers and GoalRef admission path. Reproduced the failure on the test-only revision; ran focused quota tests, static checks, semantic inventory and standard premerge canaries. No unrelated refactor, dependency or generated artifact is included.

Scope And Continuation

• Completed scope and remaining work: Complete within this scope. The fix carries the existing native CAS basis across the Python preview-to-execute boundary and validates the result envelope.
• Slice boundary / successor: N/A; no protocol, schema or TypeScript transaction change is required.

Validation

• Tested revision: e7ae7a7ebe7db7079c762bcab4bed206974c3532
• Run state: finished
• Input classes: synthetic

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	test_stale_preview_rejects_an_intervening_index_write fails on test-only revision 86140a116d95547074316b3e403eeccb0a818831 because no conflict is raised; it passes at the tested revision.
unit	passed	pytest -q tests/control_plane/test_quota_void_commit_runtime.py tests/control_plane/test_quota_spend_commit_runtime.py tests/control_plane/test_quota_slot_accounting.py -> 87 passed.
static	passed	Ruff passed for both changed files; git diff --check upstream/main passed.
static	passed	uv run python scripts/generate_semantic_inventory.py --changed-from HEAD found no supported new vocabulary carriers before commit.
integration	passed	loopx canary premerge --from-git-diff --git-diff-base upstream/main passed all 13 selected checks with no manual holds.
manual	passed	Standard diff review, security review and comment review found no blocking issue; one redundant test assertion was removed.

• Coverage and gaps: Real Python-to-TypeScript preview and commit paths cover stale and fresh bases, missing and malformed bases, explicit null, direct execute, GoalRef admission, independent voids, receipt replay, and receipt repair. No skipped or failed changed-path checks remain.

See validation disclosure guidance.

Frontend / Visual Evidence

• UI impact: none
• Before: N/A
• After: N/A
• First viewport and preview: N/A; no UI surface changed.
• States and viewports shown: N/A
• Source data: none
• Attention review: N/A
• Craft review: N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference, when applicable: Core control-plane hardening; preserve the existing TypeScript-owned quota transaction's CAS contract.

Shared-authority RFC fixture impact

• Production-scale fixture schema: N/A
• Semantic dimensions changed, or reviewed no-impact rationale: No shared vocabulary, owner, schema or fixture dimension changed.
• Provider conformance arms run: N/A
• Read-only legacy/file/PostgreSQL three-arm rehearsal (required for promotion, runtime-routing, or compatibility-projection changes): N/A; no promotion, routing or compatibility projection changed.

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths (including .loopx/, .codex/goals/, and live ACTIVE_GOAL_STATE.md).
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• Existing English/Chinese RFC pairs (including ledger entries) both have a diff, and the local premerge check python3 scripts/check_rfc_bilingual.py --base origin/main --head HEAD passes, or no paired RFC changed.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=max

完整评审 6717@e7ae7a7ebe7db7079c762bcab4bed206974c3532，实际 merge-base f0c7302。APPROVE：当前完整提案在下述已验证范围内未发现剩余代码阻断。

动机

先预览再提交配额撤销的调用方，需要确保提交仍基于刚才看到的账本。

以前预览后账本多一条记录，旧预览仍能提交；现在旧预览被拒绝，重新预览后可正常完成同一次撤销任务。

相同公开入口和真实TypeScript后端的八组对照在head全部符合独立预期，过期提交不写账本，重新预览可恢复进展，既有重放与修复保持有效。

不新增配额授权、撤销入口或存储provider，不认证生产部署、数据库迁移、付费模型运行或整个Goal完成。

改动思路

保留历史摘要属于现有Python适配层，CAS与effect重放仍由同一个TypeScript owner裁决；局部sentinel区分直接执行和显式null，不增加第二套状态机。

当前PR在已有公开preview→execute路径交付有效并发前提，不增加新用户操作、权限开关或存储provider。

问题是预览所见状态被适配层丢掉，补丁不需要重写事务：TypeScript本来就计算index_digest并比较历史摘要，Python之前只投影payload，提交时又读了最新摘要。当前把历史摘要带到现有提交点，继续由同一个TS owner决定能否写入。直接执行并无“旧预览”要保持，仍在原锁内取当前摘要。

触发	旧路径	当前路径
预览后无并发写入	可以提交，但预览丢失摘要	返回摘要并正常提交
预览后另有run入账	重算摘要，静默接受旧预览	保留旧摘要，CAS拒绝且账本不变
冲突后重新预览	已无法区分旧意图	新预览可提交，正常恢复工作
同一effect重放或修复	由既有receipt处理	仍由相同TS receipt处理

表格解释来源于实际base/head路径，不代替下面的执行证据。最强反对理由是为小修复增加新状态及兼容分支；当前摘要是既有TS值的自动投影，不是手工同步账本。局部sentinel只表达“调用方没给历史basis”的直接执行意图；显式null必须保持“预览时无index”的含义。重算摘要或把null当默认值都更短，却会丢掉真正的并发前提。

具体改动

两路径 +268/-14全部已读；其中生产适配层+43/-5，测试+225/-9，两个提交均DCO。先读实际base的quota RFC/decision-kernel和完整PR框架，未找到void-preview的书面独立验收行，因此 spec_basis=no_spec；这里的预期来自已存在的TS CAS规则、spend预览类比和原公开caller，未把新增测试当规范。

1. _result_payload（111行）在非执行结果中检查TS顶层index_digest存在且为str/null，自动投影到expected_index_digest。null保留，缺字段或坏类型不会伪装成当前摘要。
2. commit_quota_slot_void（145行）沿用legacy index锁和source-session admission，只有未传历史basis的直接调用才在锁内取当前摘要；从预览来的值原样交给原quota.void.commit。它没有在Python重新裁决CAS、目标归属或effect重放。
3. record_quota_slot_void_from_preview（258行）仍先检查预览ok、Goal和before；execute才要求basis字段及str/null类型，非执行的旧预览仍可刷新。缺失、不合法及过期预览的诊断不同且都不能写入。
4. 同一个runtime测试文件增加stale/null/malformed和锁内调用顺序覆盖，调整独立调用每次生成新预览，并让已有GoalRef用例经过真实producer。公开quota/slot_accounting别名、CLI直接执行、JSON/Markdown/index/receipt格式和TS owner保持不变。

实际 merge-base是 f0c7302；GitHub/native包的target main tip为 555a83d，两者没有混称。逐个比较八个相关owner，target与实际base均相同，head仅本PR适配层改变；对当前target的只读合成merge-tree无冲突。验证的完整提案是实际merge-base→head两路径，没有把旁支main历史算入PR。

对主干的风险

当前void/spend/slot-accounting邻域 87 passed，包含真实Python→Node TS、source GoalRef、foreign/legacy目标拒绝、独立调用、receipt重放/修复、以及legacy/source锁路径。另用不可变base fixture与同一独立公开入口探针运行两版，head八组全部符合预期；base有五组违反basis安全，实际接受了stale/missing/null/type-invalid意图，不只是mock参数不同。

决定性路径是先真实预览，再向完整index追加无关run：base继续追加void，head返回完整quota run index compare-and-swap precondition failed，独立读回确认账本逐字节不变。随后在同一head runtime重新预览，再执行成功，账本为原spend、无关run、单次void三行。这验证恢复能回到工作，没有通过自动重试改写用户原意。另有foreign Goal的相同完整错误及无写入、missing target的显式失败、直接执行→同effect replay→删JSON后repair仍仅两行等对照。

Ruff、先运行的semantic advisory和标准canary均通过；canary 6 direct+13 selected全部通过，包括完整semantic及quota/scheduler边界。初次测试命令误写了不存在的文件，未执行任何用例；按实际清单纠正后才得到87项结果，保留该诊断而不冒称首次通过。没有查询、触发或等待CI。所有写入验证都在可丢弃的合成runtime，未以活动Goal/registry/lease做实验。

兼容变化需要明确：手工或旧缓存的executing preview缺basis现在会拒绝，应重新调用现有preview producer；没有提供“自动补当前basis”的绕过。新旧普通caller不需新配置，直接CLI语义保留，旧的非执行预览仍可刷新。摘要是并发前提，不是密码或新的操作许可，目标source admission独立执行。没有数据库provider或TS存储owner重构，因此文件事务真实路径是本次相关后端；本结论不声称生产安装或新增PG资格。

我的整体评价

long_horizon=improved、user_experience=improved：同一已有任务意图零新增普通交互轮次，只有真实并发冲突才需更新预览；拒绝后可以得到新basis并继续。重放/修复不会复制已提交effect，独立新调用仍由既有契约产生新effect。异常状态与诊断由同一typed owner负责，不把强制CAS叫作建议。

future-facing pass比较了spend预览适配、两条admission和共享transaction owner：当前复用现有typed owner的局部修正足够，未发现必须捆入的新通用抽象、请求版本或第二套状态机。没有额外frontend配置/编辑器操作需要新增，现有操作授权与展示入口不变；当前交付是实际preview→execute路径的完整安全修复，可独立审阅和回退。正式批准不授予合并、dismiss或其他外部行动权限。

English verdict: APPROVE - e7ae7a7: the existing TS preview digest now survives Python projection and reaches the unchanged CAS owner. Eight real public-path comparisons pass at this head; the immutable base demonstrates stale acceptance, while current refusal leaves exact index bytes unchanged and fresh re-preview resumes work. All87 focused cases, Ruff and6direct/13selected canaries pass. Direct execution, source admission and receipt replay/repair retain their separate existing contracts.