fix(quota): close qualified blocked replans without debit

[loopx-agent]

Goal And Delivered Outcome

A correctly admitted autonomous replan can report an evidence-backed blocker while its original work remains scheduled. Its accepted writeback previously returned spend_required because blocked no-spend qualification covered Todo bindings only. This change closes the exact qualified replan Turn without a debit or delivery credit. Replaying the writeback or requesting a spend afterward adds no effect.

• Basis: a self-contained native CLI defect, reproduced with synthetic canonical File and SQLite providers.
• Before → after: identical final fixtures fail against production files from 105c4bc15091afac832495167cb98a1389951a04 (spend_required), and pass against this proposal (typed_blocked_writeback_no_spend). The typed readback fixture likewise fails before and passes after.
• Intended base: main. Related independent module-placement repair: fix(packaging): restore top-level module budget #6768.

Author Declaration

• Written by: OpenAI Codex, GPT-6 family.
• Implemented against: the existing settlement and causal closeout contracts in docs/quota-allocation.md and docs/reference/protocols/quota-blocked-causal-closeout-v0.md at 105c4bc15091afac832495167cb98a1389951a04, with this bounded replan qualification amendment documented in both English and Chinese.

Criterion	Disposition	Owner / decisive evidence
Match the original Goal/Agent/replan/Turn and durable writeback	implemented	Existing TypeScript settlement owner; foreign Turn/Agent, wrong obligation/fingerprint and missing receipt fail closed.
Require a service-accepted blocker/path delta and satisfied semantic checkpoint	implemented	Existing ACK/checkpoint schemas; rejected, stale, incomplete and successor-only deltas do not close the Turn.
Zero debit, zero completion credit and exact replay	implemented	Real File/SQLite CLI replay and spend no-op; typed historical-debit and terminal-closeout cases.
Preserve original work and resume conditions; admit independent work	implemented	Canonical Todo status, text, claim, timer and monitor facts remain equal; a new independent task is selected normally.
Required repository qualification	not_met	Mandatory module budget is still 146/145; CQR is invalid and merge remains held.

Self-check: reviewed the complete six-file scope, ownership/instructions, semantic vocabulary, negative bindings, durable receipts, historical debits, public boundary and rollback. No new protocol vocabulary, persisted field, configuration, provider or Python decision owner is introduced.

Scope And Continuation

Only settlement qualification changes. The real CLI journey showed that the existing replan ACK, checkpoint and canonical wait policies already provide the correct quiet continuation after no-spend recognition. Those policies, uncovered-acceptance admission and independent-work selection remain unchanged.

The new predicate belongs beside existing phase rules; readback reuses its selected-obligation projection. This keeps the related ownership refactor bounded and preserves capability retirement's separate proof requirements.

The author implementation and source/package regression are complete within this slice. Required architecture/CQR qualification, independent review, explicit merge authority and eventual host adoption remain open. The running host has not been installed or upgraded with this candidate. No follow-up implementation task is invented for an already tested path.

Validation

• Tested revision: e88f37b0cdbaafb89d206edd4a7a77e83429a46a; pre-commit standard checks used the identical final source tree.
• Run state: finished.
• Inputs: synthetic, public fixtures.

Check kind	Result	Evidence / limitation
regression_parity / real_entrypoint / real_backend	passed	Identical final native CLI fixtures: File and SQLite both fail on immutable base production and pass on head. Replay, no-op spend, rejected foreign identities, untouched scheduled work and independent-work recovery included.
integration	passed	Eight affected Python quota/settlement/replan/vision suites: 276 passed; three complete TypeScript settlement/causal-wait/replan files: 148 passed; no failures or skips.
real_entrypoint / packaging	passed	Normal qualified frontend bundle and wheel built. The wheel was extracted into disposable isolation, product hashes and import provenance checked, and the same File/SQLite CLI journey passed twice. This is package validation, not host installation or live adoption.
static	passed	Control-plane TypeScript typecheck; configured mypy (17 files); full declared Ruff lint scope; diff advisory followed by full semantic drift smoke; public/private scan; staged and committed bilingual RFC checks.
integration	passed	Standard premerge selection: all 5 direct checks and all 14 selected checks/canaries/scans passed. Overall merge gate remains held for quality qualification.
static / required architecture	failed	Module budget suite: 1 failed, 5 passed, with 146 top-level modules against pinned 145 (workflow_skill_install.py). Dependency-lock test passed. Existing #6768 owns that separate placement repair; the limit is not waived.
static / optional format	failed	Whole-file Ruff format probe still requests formatting for the existing compact CLI test file; immutable base also fails. No baseline-attribution exemption is claimed and no unrelated whole-file formatting rewrite was added.
manual / quality	blocked	Exact-scope CQR recorded and verified invalid, retaining both failed validator observations. No merge-readiness or approval claim.

Reproduction commands:

uv run --extra test python -m pytest \
  tests/control_plane/test_dated_vision_wait_cli.py \
  tests/control_plane/test_quota_settlement.py \
  tests/control_plane/test_quota_settlement_cli.py \
  tests/control_plane/test_turn_settlement_owed_signal.py \
  tests/control_plane/test_replan_settlement_runtime.py \
  tests/control_plane/test_quota_blocked_retry_projection.py \
  tests/control_plane/test_goal_vision_blocked_successor.py \
  tests/control_plane/test_vision_wait_coverage.py -q
node --experimental-strip-types --test \
  tests/control_plane_ts/quota_settlement_readback.test.ts \
  tests/control_plane_ts/causal_blocked_wait.test.ts \
  tests/control_plane_ts/replan_settlement.test.ts
npm run typecheck:control-plane
uv run --extra test loopx canary premerge --from-git-diff --git-diff-base origin/main

Coverage/gaps: the shared settlement and real File/SQLite CLI paths are exercised, including a normal wheel consumer. This does not qualify PostgreSQL, a full hosted CI run, live host adoption or sustained operation. No storage refactor, new backend route or frontend interaction is included.

Frontend / Visual Evidence

UI impact: none. CLI and managed heartbeat consume the existing shared settlement result; frontend canonical waiting/status remains unchanged. No frontend or Lark operation/configuration is added. First viewport, screenshots and attention review: N/A; source data for visuals: none.

Type of Change / Area

Bug fix, focused validation and protocol documentation; control-plane quota/settlement. Roadmap connection: existing S2/S7/S10 acceptance, without claiming those broader checkpoints complete.

Shared-authority RFC fixture impact

No promotion, provider routing, persisted-state or compatibility-projection change. Synthetic canonical File/SQLite conformance exercised; no PostgreSQL or three-arm migration qualification claimed.

Boundary Checklist

• Public-safe diff/body; no private state, credentials, raw logs, private links or local machine paths.
• Single-purpose proposal; no duplicate benchmark work or manual workflow dispatch.
• No paired RFC changed; staged and committed bilingual checks pass.
• UI impact is none.
• Both commits carry DCO sign-off.

中文：修正“合法阻塞重规划仍被要求扣额”的结算缺口。真实 File/SQLite 及普通 wheel 消费路径已验证：原身份不变、零扣额、零完成信用、重放无副作用，独立工作仍可执行。现有等待和验收门保留；必需 146/145 模块预算及 CQR 未过，源码提案尚未合并或安装。

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

受影响的是已经获准执行重规划、确认原任务仍在等待依赖的自动化 Agent 及其维护者。过去即使已提交有证据的阻塞结论，旧 Turn 仍要求扣额，后续唤醒会卡在结算恢复；现在合格的重规划可在原身份上无扣额收尾，原任务仍按原条件等待，独立工作可以继续。

相同 File、SQLite 输入在主干停在 spend_required，在候选完成零扣额收尾；重放、冷重启后的旧 Turn 读回和独立任务恢复均已验证。此改动不完成原任务、不授予交付信用、不修改等待时钟或来源观察，也不认证 PostgreSQL、已安装 Host 或长期运行。这里的 Turn 指一次有独立准入和结算身份的执行尝试；关闭它不等于完成原任务。评审基线为 105c4bc15091afac832495167cb98a1389951a04，完整候选为 e88f37b0cdbaafb89d206edd4a7a77e83429a46a。

改动思路

状态分类继续由现有 TypeScript settlement owner 决定，直接消费既有 guard、ACK、指纹、checkpoint 和持久回执；Python 不新增判断源或人工同步字段。本 PR 只扩展合格阻塞重规划的 no-spend 读回资格；原调度、验收、普通交付扣额与 capability retirement 的独立证明门保留。

入口仍是原来的 quota should-run → refresh-state → quota.settlement.read。新谓词验证原 guard 选定的 obligation、原 Goal/Agent/Turn、typed blocker 和证据、相同 observation fingerprint、已接受的 semantic delta、满足的 semantic-closeout checkpoint；调用方先验证匹配的持久写回，并确认没有已提交的扣额。它没有把重规划伪装成 Todo，也没有另造重试时钟或第二套 Python 判定。

下面是本次源码和实际 CLI 对照的分支概括，不能替代执行证据：

原身份上的输入	主干	本候选
已准入、证据和 checkpoint 合格的 blocked replan	仍要求 spend	原 Turn 零扣额收尾
foreign Turn/Agent 或语义证据缺失	拒绝或保持未结算	同样不能据此收尾
已存在真实 debit	保留扣额结算	保留原 debit，不追溯抹除
已关闭原 Turn 后新增独立工作	不应继承旧证明	新 Task 走普通准入

只接受一句 blocker 会更短，但会丢失原身份和语义资格；强行扣额或改等待时间则修改了错误的 owner。当前提取位于已有 phase 模块内，避免继续把条件堆到 readback；这是本 PR 已应用的有界可维护性改进。capability retirement 仍保留独立证明链，不能与这条普通阻塞分支混为一谈。

具体改动

完整六文件范围为：两处既有 TS owner、两处聚焦验证、两份协议文档；没有新增 provider、顶层模块、持久字段、CLI 参数或共享协议字面量。真实 File/SQLite CLI 路径经过现有 Python transport 和同一 TS owner，新增产品逻辑没有复制到 Python。

规范依据是 docs/reference/protocols/quota-blocked-causal-closeout-v0.md，固定在 105c4bc15091afac832495167cb98a1389951a04，同时核对同版 docs/quota-allocation.md。原协议明确的 Todo 因果等待和独立验收边界保留；本次将 no-spend 资格扩展到已经合格的 replan，是已披露并验证的行为修正，不能声称与旧实现逐字节等价。按原规范条目映射：

• Exact Goal/Agent/Todo/Turn identity：implemented。对于 replan，绑定的是原选定 obligation；foreign Agent/Turn 的真实 CLI 请求无追加写回，错 obligation/fingerprint、拒绝的 ACK、缺 checkpoint/receipt 不能结算。
• Closeout returns：implemented。沿用 typed_blocked_writeback_no_spend，只读回原持久证据；同身份重复 refresh、后续 spend 均不追加 debit，也不产生 terminal-completion receipt。已有实际 debit 在完整 TS 测试中保留。
• The Todo remains unfinished：implemented。原 scheduled Task 的 status、text、claim、resume_when，以及 Monitor 的结果、generation 和下次时间都保持；之后独立 Task 可以被正常选中。
• Legacy：implemented。既有 Todo retry/causal wait/Monitor unavailable、paid progress 和 retirement 分支保留。回滚前须用兼容运行时核对旧收据，不能因旧版本的提示补扣或改写历史。

关键代码讲解

1. isAcceptedBlockedReplanWriteback：以 SettlementIdentity 和原 guard 的 selected obligation 为输入，复用 isTurnScopedSettlementOutcome 检查合法 blocked observation。仅当 accepted ACK 的 satisfying outcome 真属于当前 outcomes，且是 concrete blocker 或 fresh evidence-linked path，指纹与 checkpoint 同时一致，才允许调用方投影 no-spend。字符串 schema/kind/value 精确匹配，无 substring denylist 或 prose 分类。
2. readQuotaSettlementFromRequest：先取得原 guard、匹配写回事件与 run，再在原 Todo 条件旁加入新谓词。writeback.failure === null、spendRun === null 和 spendEvent === null 都位于两条 no-spend 分支外，因此历史已扣额不会被覆盖。后续 progress/replay 消费原 noSpendKind，Task 完成和 Goal 验收仍由各自 owner 决定。

两个测试文件补齐了原生 File/SQLite 的 guard→写回→重复→spend no-op→后续选择，以及 TS 语义证据破坏、缺回执、历史 debit 等反例；双语文档解释相同新旧差异、退出边界和回滚要求。

对主干的风险

最大风险是将一次无资格的 blocked 声明变成免费关闭任意 Turn，或让已付款 Turn 在恢复中丢失扣额。当前代码通过原 selected obligation、身份、accepted semantic delta、checkpoint 和 durable receipt 的交集限制资格。独立原生对照采用同一最终合成场景：主干 File、SQLite 均在 spend_required 上失败；候选两条路径均通过，无来源 poll 或 debit。额外关闭隔离 Effect 进程后再读原 Turn，两种 provider 都是 heartbeat_settled_skip；下一 Turn 维持 quiet，新增独立 Task 后成为 normal_run，没有用一次 blocker 回执冒充后续推进。

实际复跑八个相关 Python 文件 276 passed，三个完整 TS 文件 148 passed，额外冷进程原生检查 2 passed；control-plane TypeScript typecheck 通过。语义 advisory 后执行 full vocabulary/module-budget 检查，基线和两个候选都为 131 passed / 1 failed。完整预合并最终为 5 个 direct checks、14 个 selected checks 全过，包含调度/等待和 public-private boundary；没有查询、轮询或等待远程 CI。

保留最初的预合并失败：catalog-run-e2e-smoke.py 的“无 Git 目录”负例在仓库内临时目录继承了父级 Git，从而尝试不存在的临时脚本。同一失败在不可变主干复现，候选与主干的 smoke/runner 字节一致；只把隔离目录移到 Git 外，两版单项及候选完整预合并通过。这是受控环境对照，不是丢掉失败只选一次绿灯。

语义与 CI 对齐

146/145 顶层模块预算仍失败，CQR/合并资格限制继续保留。 同一命令在固定主干和候选得到相同失败身份 test_top_level_module_count_stays_at_the_pinned_budget、相同 offender workflow_skill_install.py、相同 146 个模块清单和预算/测试源码哈希。两处新增 TS 条件不在其因果路径；受改动结算不变量有上述独立正反和恢复证据。因此按评审协议，这是 pre-existing unrelated qualification failure，不要求本 PR 趁机修改无关模块或放宽预算，也不据此声称 merge ready。已有 #6768 是独立归位修复。

本 PR 没有新增用户操作或设置；检查了共享 CLI/heartbeat 结果与原 canonical waiting/Chat/Lark 消费关系。没有把后台成功冒充已安装 App 采用。PostgreSQL、当前 Host 安装、包发布与持续运行并未在本次独立复验，不作这些资格声明；没有存储重构或新增 provider 需要它们替代当前 File/SQLite 证明。

我的整体评价

APPROVE，代码评审结论与合并资格分开。 当前限定修复的 delivery judgment 为 goal_achieved；long_horizon=improved 的依据是原身份冷重放、等待保留和独立工作恢复，user_experience=improved 的依据是已有授权的自动化无需增加人工配置、补扣、复制或确认轮次。它并未宣称整体路线图或长期收益已经完成。

原生入口上观察到了有用结果，机制与问题匹配：复用既有 TypeScript 词汇和判定 owner，只增加必要的 receipt qualification，没有配置、provider 或迁移框架。历史 receipt 的兼容读取有实际消费者，保留它们有依据；当前有界重构已将谓词放回 phase owner，无需额外通用层。复盘中采用了“从入口到恢复及回传”的方法，但既往经验、作者声明和上下文送达都不作为 verdict 或效用证明。

本评审允许保留这份可独立回滚的修复提案；未合并、未安装、未升级运行中的 Host。预算/CQR 问题和最终 readiness/维护者授权仍须分别处理。若身份、semantic/checkpoint 证据或新旧 debit 行为改变，应针对新 head 重新验证。

English verdict: APPROVE — e88f37b0cdbaafb89d206edd4a7a77e83429a46a. The exact qualified blocked replan closes without debit or completion credit; matched File/SQLite base/head, cold replay, preserved waiting work and independent-work recovery are verified. 276 Python, 148 TS, two cold CLI cases and the corrected-isolation 5-direct/14-selected premerge set passed. The independently reproduced 146/145 baseline module-budget/CQR hold remains; this review grants no merge or installation authority.