refactor(quota): keep blocked retry validation in settlement owner

[huangruiteng]

Goal And Delivered Outcome

• Goal/source and gap: A required semantic vocabulary smoke on current main fails because a newly added quota/blocked_retry.py and quota/blocked_retry.ts create a 44th maintained same-basename pair against the reviewed ceiling of 43. The TypeScript file contains only a validator used by settlement readback and vision closeout; the Python file owns the separate retry projection.
• Observable before → after: TypeScript blocked-retry validation remains byte-for-byte equivalent but now lives with the existing settlement-phase owner; both callers use that one module. The same smoke now reports 43/43 maintained pairs, with the ceiling unchanged. File-backed settlement and vision tests verify no behavior change.
• Issue/task and intended base: Base-branch premerge regression discovered while validating Goal status and steward presentation fixes; main.

Scope And Continuation

• Completed scope and remaining work: Removed only the redundant TypeScript file and redirected its two imports. The Python projection, retry receipt schema and 43-pair ratchet remain unchanged. Complete within this baseline repair scope.
• Slice boundary / successor: This small control-plane refactor needs exact-head maintainer review and merge before dependent product PRs can report a green semantic vocabulary check. It does not grant self-merge authority to those PRs.

Validation

• Tested revision: 67d45df004e37601e30763ad654ed77284675da2 against 166c68b0387ffc1a8fc4de938d8f7e48d6cdaad7.
• Run state: finished.
• Input classes: synthetic.

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	semantic-vocabulary-drift-smoke.py: current main has 44 maintained pairs versus 43 allowed; this head has 43/43 without changing the limit or scan root.
integration	passed	67 TypeScript settlement-readback and vision-checkpoint tests, including a real temporary file-backed receipt chain and blocked no-spend closeout.
static	passed	npm run typecheck:control-plane and git diff --check origin/main...HEAD.
static	passed	Changed-path public/private boundary scan: zero errors; two unrelated active-state warnings.
static	passed	loopx canary premerge --from-git-diff --goal-id loopx-meta: 13 selected checks passed, including the semantic vocabulary smoke; exact-scope quality receipt and boundary scan are valid.

• Coverage and gaps: The real file-backed readback and vision entrypoints are covered. No PostgreSQL authority behavior, persisted state format, or Python projection logic changed. The later product PRs still require their own exact-head validation after this repair merges.

Frontend / Visual Evidence

• UI impact: none. The change moves an internal TypeScript validator without modifying UI data or presentation.

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference: Core control-plane hardening; preserve the replacement-first same-basename twin ratchet in the semantic vocabulary convergence RFC.

Shared-authority RFC fixture impact

• N/A: No shared Goal Authority state or production-scale fixture semantics changed; this is an internal behavior-preserving module move.

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths.
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• I marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

本 PR 处理的是当前主干真实失败的架构回归：新增 quota/blocked_retry.py 和同名 TypeScript 小模块后，独立维护的跨语言同名文件对从 43 变成 44，超过已审定的 43 上限。若直接调高预算，会掩盖这次所有下游 PR 都会碰到的失败。此次交付把 TypeScript 校验归回已有结算阶段 owner，不改运行结果，也让 Goal 状态与管家展示等后续变更可继续接受原门禁检查。

改动思路

我先比较了不处理、提高预算、重命名文件和复用现有模块。blocked_retry.ts 只提供一个被结算回读和 vision closeout 调用的 15 行校验函数；Python 同名文件承担 Todo 等待投影，两者并非需要并列维护的同一模块。把原函数原样放入 settlement_phase.ts，让两个现有调用点从结算 owner 导入，是最小的行为保持修复。结算与 vision 仍读取同一个 Turn 的 blocked_retry，使用相同 ID、来源、时间界限和 resume_when 判断；拒绝条件和责任边界均未改变。

具体改动

删除 loopx/control_plane/quota/blocked_retry.ts，把它的 isBoundedBlockedRetry 原样放进 loopx/control_plane/quota/settlement_phase.ts；settlement_readback.ts 和 goals/vision_checkpoint.ts 仅改导入路径。Python 投影模块、持久化字段、注册词表与预算数字均未修改。基线与提交使用相同的两份测试文件；67 个测试都通过，去掉 TAP 耗时后的测试名与结果摘要相同。原语义检查在基线报 44/43、在此提交报 43/43，证明修的是已见失败而非改变门槛。

关键代码讲解

• settlement_phase.ts:5 的 isBoundedBlockedRetry 是本次移动的唯一校验逻辑。它保留来源、Todo 绑定、resume_at 与 1–30 分钟界限的原有判断；函数体与基线同字节。
• settlement_readback.ts:902 的 readQuotaSettlementFromRequest 仍在完成同 Turn 写回且没有 spend 时才调用这个校验，并与 isTurnScopedSettlementOutcome 一起决定 no-spend closeout；读取的是原有文件回执。
• vision_checkpoint.ts:759 的 buildVisionCheckpoint 仍通过同一校验区分有界等待与需要 vision 变更的材料进展；这里只换了导入位置。

对主干的风险

最大风险是移动后某个调用点漏改，或者看似相同的校验在结算与 vision 路径出现差异。全仓搜索只找到这两个生产导入；TypeScript 类型检查、67 个文件后端结算与 vision 测试均通过，包含无等待、错 Todo 和有效有界等待。精确提交的 premerge 13/13 通过，公开边界扫描无错误。基线/提交的原函数文本比对一致；由于没有改变 persisted receipt 或 feature gate，历史回执、默认行为和授权范围不需要迁移。剩余风险是维护者仍需在当前主干头上确认合并基线；若主干期间又修改结算 owner，应重新跑这两组测试与语义检查。

我的整体评价

这是一个有用且完整的基线修复：它不牺牲 43 对双实现的约束，不引入新状态，也没有把复杂度转嫁给用户。持续运行与用户体验都保持原样，现有两个调用链可继续处理合法等待并拒绝非法回执；失败的仓库门禁恢复为可用。无需以增加预算或新抽象换取通过。基于精确 head 67d45df004e37601e30763ad654ed77284675da2、上述基线/提交对照和测试，我给出批准结论；控制面变更仍由维护者决定合并。

English verdict: APPROVE - 67d45df restores the unchanged 43-twin guard by moving an identical validator to its existing settlement owner; baseline/head file-backed tests and the exact-head premerge pass.