fix(replan): retire expired monitors from current streak triggers

[loopx-agent]

Goal And Delivered Outcome

An expired Monitor with a retained unchanged-poll streak can request autonomous replanning even when it has no due work. Exclude expires_at <= observed_at from the current-streak detector through the existing typed Monitor lifetime rule. Active Monitors, including future-due ones, retain their review behavior.

• Outcome basis: reproduced CLI defect; existing quota/Monitor contract and roadmap S7/S10.
• Before → after: the same controlled File/SQLite CLI workload fails four past/equal-expiry cases on base 105c4bc15091afac832495167cb98a1389951a04 and passes all six cases with this fix; two active controls pass on both.
• Intended base: main. No issue is closed by this proposal.

Author Declaration

• Written by: OpenAI GPT-6 via Codex (model_agent).
• Implemented against: current-streak policy in docs/quota-allocation.md and Monitor scheduling in loopx/control_plane/todos/summary_lanes.ts, base 105c4bc15091afac832495167cb98a1389951a04; this PR's reproduced expiry defect supplies the missing validity case.

Criterion	Disposition	Owner / evidence
Current streak excludes expired and exactly-expiring Monitors	implemented	Shared monitorIsActive; real File/SQLite CLI expiry regression
Active future-due review, scope, claimant, watch-only and trigger shape remain	implemented	Characterization, typed parity and CLI integration
Recorded counters/source fields, pending work and independent history triggers remain	implemented	Canonical before/after readback and replan/settlement integration
Required repository module budget	not_met	146 modules against pinned 145; separate #6768 remains open

Self-check: reviewed the complete final diff, repository instructions and existing callers. Classified and scanned all eleven paths before explicit staging. No new capability, provider, configuration or authority is introduced.

Scope And Continuation

The Python Goal-frontier caller contained a second streak selector. Remove its duplicate count/winner/trigger construction and send its characterized eligibility facts to the existing TypeScript replan owner. The status caller reuses the same expiry predicate; legacy clockless internal requests preserve replay behavior. This bounded companion refactor removes a second decision source without changing unrelated routing.

This is an independently testable source repair. Required validation and exact-head review still gate integration; installed adoption and sustained operation remain separate. Requalify after the existing packaging budget repair (#6768), rather than increasing the limit here.

Validation

• Tested revision: d90437361fb651a07700e3610f604f1164d1a2cd (validated source bytes unchanged by the signed commits).
• Run state: finished. Input classes: synthetic, public_fixture.

Check kind	Result	Evidence / limitation
regression_parity	passed	Pinned production base/head, clock frozen inside the real CLI child: past/equal expiry fails before and passes after for File and SQLite; active controls remain.
real_entrypoint / real_backend	passed	Disposable File/SQLite canonical stores; actual quota should-run --codex-app parser and TS runtime. Todo fields, hashes, generations, source state and deferred successor remain unchanged; quiet liveness does not poll or debit.
integration	passed	Eight complete Python modules: 211 passed, no skips. Replan/agent scope, Goal frontier, blocked successor, authority settlement and effective-Turn continuation.
unit / integration	passed	Four complete TS modules: 189 passed, no skips. Replan history, quota selection, Todo summary lanes and settlement readback.
static	passed	npm run typecheck:control-plane; configured mypy (17 files); full CI-configured Ruff scope.
integration / static	passed	Standard premerge executed six direct and nineteen selected checks, including semantic vocabulary, maintainability, scheduler/interaction/replan/Monitor/settlement smokes and public-boundary scan. Final committed RFC bilingual and whitespace checks pass.
static	failed	Required kernel checks: 6 passed, 1 failed. Top-level module budget is 146/145 on both base and head. No waiver or ceiling change.
static	failed	Optional full-tree python -m ruff check . --output-format json: immutable base 105c4bc and head d904373 select the same 3,750 files with 17 identical configuration controls. Both report the same 646 complete diagnostics, including locations, details and multiplicity; none targets a changed path. Same interpreter, environment and command; accepted as pre-existing unrelated failure through optional baseline attribution. Retained as a failed risk; no all-tree lint pass or required-check waiver.
manual	blocked	Exact-scope quality record retains the optional Ruff failure and its accepted baseline attribution. The required kernel/module-budget failure still blocks qualification; receipt verification and the current premerge gate remain held.

Coverage follows the affected policy, adapters, real CLI and retained settlement semantics. No PostgreSQL store, transport, migration, scoring or frontend interaction is changed; no PostgreSQL promotion or installed/hosted qualification is claimed. Full hosted CI and independent exact-head review remain unqualified by this author evidence.

Frontend / Visual Evidence

UI impact: none. Existing quota/heartbeat CLI and shared projections consume the repaired rule; no new caller operation or settings editor is added. First viewport, screenshots, preview, attention/craft review and viewports: N/A. Source data: none for visuals.

Type of Change

• Bug fix
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Public docs or presentation surface (contract docs only)

Technical Direction

S7 budget/scheduling and S10 reliability. Update the existing S7 checkpoint in both RFC mirrors; this does not close fleet, latency or full Goal/CI acceptance.

Shared-authority RFC fixture impact

No provider promotion or authority-store migration. Semantic delta: expiry validity of the current Monitor streak. Synthetic File/SQLite conformance arms run; PostgreSQL/three-arm promotion rehearsal is not applicable to this policy composition repair.

Boundary Checklist

• Public-safe diff/body; private state, raw logs, credentials and local paths excluded.
• No duplicate maintainer benchmark work or unrelated task expansion.
• Both existing RFC mirrors changed and committed bilingual gate passes.
• UI impact none.
• Both commits have DCO sign-off.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

仅剩有限来源监控、等待真实后续输入的 Goal/Agent，可能因为一个已经过期的 Monitor 留有八次未变化计数，被反复要求重规划。当前修复让过去或恰好在观测时刻到期的监控退出本次 streak 判定；记录、待续工作和独立历史触发仍保留。可观察的结果是无可执行来源时安静等待，而有效监控仍能按既有规则要求复核。

本次交付是当前源码中可独立验证的过期判定修复；正式安装、持续运行、完整费用或父 Goal 验收、CI 与合并不在这个结论内。无改动会继续制造无任务可执行的复核；仅在 TS status selector 加过滤则漏掉实际 Python frontier caller。把两条真实入口接到已有规则，比保留两个过期判定更合适。

改动思路

过期判定复用原 Monitor lifetime owner；Python 保留既有资格筛选，计数与 winner 交给已有 TS replan owner，删除重复业务规则。observed_at 是 codec 在一个请求中取得一次的运行时事实，不是要求 Agent 或用户维护的新状态。下次 poll 的 due time 与生命周期 expiry 继续分开：有效但尚未到下一次 poll 的 monitor，已有未变 streak 仍可以触发复核。

当前 PR 交付可独立验证的源码修复；安装采用、持续运行与整个 Goal 的验收仍由现有工作承担。这里没有新开关、权限、模型观察器、表单或额外确认；现有 status/quota 消费原触发结构。对于保留的两个 public trigger 形状，复用同一决策后分别投影，比删除真实 consumer 兼容性或另建服务更小。

具体改动

完整差异为 11 个文件、增加 264 行、删除 42 行。四个生产文件包括既有 TS Monitor lifetime、replan history、Python frontier 及 codec；其余是三个测试文件、quota 文档和现有路线图的中英两份 checkpoint。双语增量均保留 source、installed、Goal/CI 的验收边界，没有把这次修复写成 fleet 或长期效果完成。

规范依据：改动前 docs/reference/protocols/goal-vision-replan-contract-v0.md，spec_revision 105c4bc15091afac832495167cb98a1389951a04；History-trigger ownership and retry semantics 对应 implemented：复用 typed owner、维持原阈值与 claim/ACK/历史行为，当前监控只在生命周期有效时参与。quota 原 Allocation Contract 和原 summary_lanes.ts 的严格大于 expiry 规则也已先读；新增文档不作为自行通过的依据。

关键代码讲解

• monitorIsActive 导出现有 expiresAt === null || expiresAt > now，不另造边界；同刻到期按过期处理。
• monitorStreak 在选 count/winner 前过滤过期项。frontier 仍用原目标字典序打破同计数平局，复用现有 Unicode code-point comparator；status 路径保留原稳定顺序。
• project_replan_history 仅为两种 current-streak 请求填一次 clock。历史 raw clockless 输入仍可重放，普通 progress/periodic trigger 不受这次 current-source 过滤影响。
• _monitor_no_change_streak_trigger 保留 done/status、monitor class、watch-only 和 claimant 资格筛选，再交给同一 TS owner；删除 Python 自己的 count、排序和触发文本构造。

对主干的风险

未发现阻塞的改动缺陷。最有力反例是“只修 status 而真实 quota 仍误触发”，以及过期最高计数项隐藏后面的有效监控。独立在不可变基线运行同一套真实 CLI fixture，过去和同刻 expiry 的 File/SQLite 四例均在目标断言失败，有效监控两例通过；当前完整八模块 202 项 Python 回归通过，其中同一六项 CLI 测试全部通过，并核对原 Todo、计数、hash/generation、deferred successor、原文状态和无额外 source poll/debit。

额外调用真实 frontier owner 的 17 组 base/head JSON：16 组完全相同，包括 peer/unclaimed/watch-only/done/blocked、无 expiry、fractional count、反向同计数、BMP/补充 Unicode 字符顺序、130 个无关项之后的有效来源以及不影响事实的旧诊断。唯一变化是过期来源不再产生当前 streak。57 项 TS、control-plane typecheck、改动 Python Ruff，以及标准 premerge 的 19 项选择检查和 6 项直接检查通过。没有查询、轮询或等待 CI，也没有把 quiet liveness receipt 当真实监控执行。

语义与 CI 对齐

内部 replan_history_request_v0 operation 集合扩展 frontier_monitor_streak，复用已有 expiry 和 trigger 词汇；无持久化 schema、Task 授权或阈值迁移。current clock 是显式瞬时事实，旧 clockless 兼容只保留历史 replay，Python 当前 caller 不会走它逃过 expiry。文档把这条规则写成实际执行条件，而非建议。

另有独立必需 kernel 检查失败，不能用通过的 premerge 隐去：相同命令 uv run --extra test python -m pytest tests/architecture/test_top_level_module_budget.py -q 在基线和当前头均为同一 test_top_level_module_count_stays_at_the_pinned_budget:63、同一 offender workflow_skill_install.py，146/145，1 failed/5 passed；只耗时不同。该 PR 没增加顶层模块，offender、预算和 checker 均未改。按当前评审能力的 pre_existing_unrelated 规则，这不是本修复的代码阻塞；既有 #6768 的预算修复与总体合并资格仍须单独落实，没有提高限额或豁免 required check。作者额外全树 Ruff 646 errors 声明未作为我的通过证据；当前改动的配置相关检查单独列明。

我的整体评价

APPROVE，限定准确头 d90437361fb651a07700e3610f604f1164d1a2cd。它修复真实 current-source 错触发，保留既有历史、scope、排序和持久记录，能减少没有可执行输入时的不必要复核，同时不改变用户现有任务入口。最有价值的邻近整理已经包含：删除 Python 的重复选择规则。继续抽象或扩大语言迁移对本次验收没有必要。真实 CLI 和反例支持这条有界源码交付，不证明安装生效、长期成本收益或整个 Goal 结束；批准结论也不把既有 kernel/CQR hold 变成合并授权。

English verdict: APPROVE — d904373. The current Monitor streak now shares the existing expiry owner across both real callers. Independent File/SQLite CLI red/green, 202 Python tests, 57 TS tests, 17 frontier comparisons and standard premerge support the bounded repair. The identical pre-existing workflow_skill_install.py module-budget failure remains a separate required-validation/merge hold; no CI consultation, installation or merge is implied.