fix(quota): stop settled in-flight Turn replay without completing Todo

[huangruiteng]

Goal And Delivered Outcome

• Outcome basis / optional anchor: Self-contained reproduced quota/Turn replay defect; related to the existing TS control-plane direction.
• Goal/source and gap: Ordinary accepted in_flight_continuation + outcome_progress can settle while its validation-required Todo remains open. The settlement readback reported settled, but the replay phase still required Todo completion and constructed another executable action.
• Observable before → after: Against immutable main fce1a4bac83ac9bdc9b8a6fc16a7849e06569ec9, the same synthetic CLI fixture had settled + should_run=true. This head returns heartbeat_settled_skip + should_run=false, preserves the open Todo/required completion validator, and retains exactly one debit.
• Issue/task and intended base: Reproduced defect above; base main. No fabricated issue closure. This ordinary in-flight path is separate from the replan-successor proof repair in fix(replan): retain original Turn successor proof through settlement #5182.
• 中文：根因是把开放 Todo 的最终验收与单个 Turn 的进展结算混为一谈。本修复只关闭已凭精确回执结算的 Turn；Todo 不提前完成、验证器不放宽、扣额不重复。

Scope And Continuation

• Completed scope: One additional accepted-checkpoint case in the existing TS replay decision owner; exact Goal/Agent/Todo/Turn, outcome, accepted checkpoint and trigger, plus the existing matching durable receipts, are mandatory. No Python decision copy, new authority/provider/configuration, receipt rewriting or Todo lifecycle mutation.
• Slice boundary / successor: Independently testable quota replay fix. Missing spend remains settlement_pending; missing writeback, wrong identities, unaccepted or semantic_closeout checkpoints remain open. A fresh Turn recomputes ordinary admission and can continue the Todo or its independent successor. Maintainer merge and installed consumer adoption remain follow-up; no self-merge or promotion claimed.
• 中文：在途结算与最终交付分离；等待与后继变化不能重开旧 Turn，新 Turn 仍需重新准入。本 PR 不代表整个研究 Goal 已完成。

Validation

• Tested revision: 057eeab1aeac294e149282eba8adb120811903d5. The 14-check premerge execution ran at c36ac664b1d2df55b3fc0e654f99d3769764fbe0, before test-only typing annotations; production code is identical.
• Run state: finished
• Input classes: synthetic, public_fixture

Check kind	Result	Public-safe evidence / limitation
static	passed	npm run typecheck:control-plane; focused Ruff; focused mypy with silent import checking; git diff --check.
unit	passed	Five TS settlement suites: 130 tests, no skips. Exact receipt/checkpoint negatives, partial settlement, auxiliary monitor, replan and workspace causality remain covered.
regression_parity	passed	Identical public-fixture digest cc7d889c1ec10b20c065f9e0a296b6d847deea75a980d9c05770c94e62d99774: immutable main fails the independent post-spend replay oracle; exact head passes. Both retain an open validation-required Todo and one spend; only executable replay changes. New assertions were also observed failing before the fix.
real_entrypoint	passed	Real subprocess CLI across legacy, File and SQLite, waiting/non-waiting, explicit/implicit replay, managed TurnEnvelope, idempotent spend and fresh successor admission: final exact-head full rerun: 6 passed, no skips. Earlier 6-case run also passed; an intervening run failed during local temporary-storage exhaustion, and its affected scenario passed after removing only this task's disposable baseline checkout. No assertion or gate relaxed.
real_backend	passed	Real isolated File and local SQLite canonical stores used by the above CLI fixtures; soft-claim fixture mode, not hard-lease or PostgreSQL qualification.
unit	passed	Existing settled replay construction/live quota decision suites: 40 tests. Existing CLI accepted/negative in-flight tests passed together with the provider cases before the annotation-only change.
integration	passed	loopx canary premerge --from-git-diff --no-progress --timeout-seconds 120: 14 selected/executed checks, 0 failures, 0 warnings; repository policy still requires maintainer merge.
manual	passed	Full six-file diff, TS semantic owner/caller and public-boundary scan reviewed; bilingual protocol update.
integration	not_run	Full repository test suite, required remote CI, live-model delivery and installed/native desktop end-to-end adoption are not claimed.

• Coverage and gaps: This covers accepted progress → exact writeback → one spend → same-Turn skip, while proving fresh admission and completion requirements remain intact. Synthetic faults target receipts/identity/checkpoints, not an active user Goal. No provider cutover or PostgreSQL promotion acceptance is claimed.
• 中文：真实 CLI 和真实本地存储验证不能替代尚未进行的安装态/原生桌面/真实模型验收。机器临时存储不足造成的一次失败单独披露，不靠重复扣额或放宽断言“修复”。

Frontend / Visual Evidence

• UI impact: none
• Before / After: N/A; no UI, layout, setting, schema or configuration change.
• States and viewports shown: N/A.
• Source data: none
• Attention review: Existing CLI/managed consumers already render the authoritative execution_obligation, interaction_contract and TurnEnvelope writeback flags. The real CLI tests assert those existing fields are non-executable/non-spendable; no new control or frontend source of truth is needed. No browser, Lark transport or packaged desktop acceptance claimed.
• 中文：本次修的是现有执行投影的错误值，而非新增前端配置；复用同一投影，不新建界面权威。

Type of Change

• Bug fix
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)

Technical Direction

• Existing TS single-authority quota settlement/replay owner. Terminal Todo acceptance remains separate.

Shared-authority RFC fixture impact

• Production-scale fixture schema: unchanged.
• Semantic dimensions changed / no-impact rationale: Existing accepted checkpoint data now discharges only the exact Turn's progress obligation. Goal/Todo cardinality, lifecycle/acceptance authority, leases, paging and provider routing do not change; checkpoint/receipt mismatches and waiting/successor changes are characterized above.
• Provider conformance arms run: Real legacy, File and SQLite CLI fixtures; not a new provider-conformance suite or cutover.
• Read-only legacy/file/PostgreSQL three-arm rehearsal: N/A for this bounded replay correction; no promotion, runtime-provider routing or new compatibility owner/projection schema. PostgreSQL and production-scale cutover have not been qualified by this PR.

Boundary Checklist

• Diff, body and evidence are public-safe; no private Goal/account/chat, credentials, raw traces, internal URLs or local machine paths.
• No duplicated maintainer-owned benchmark work.
• Scoped to the reproduced ordinary in-flight replay defect.
• UI impact marked none with existing-entrypoint rationale.
• DCO Signed-off-by included; author and committer verified.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

精确 head：057eeab1aeac294e149282eba8adb120811903d5。自评审结论 APPROVE：没有发现阻塞问题；这不是合并许可，也不是安装态已生效的声明。

动机

开放任务已经提交合法在途进展，写回和扣额回执齐全，旧实现却仍要求任务完成才停止同一轮执行。主干对照确实得到“已结算但仍要求执行”，会让长程工作反复回到旧轮次。修复仅履行该轮的进展义务，最终任务验收和整个目标是否达成仍由原权威判断。这是完整的配额回放修复，不是整个研究目标已完成。

改动思路

复用既有 TypeScript 结算读取与阶段归约，不添加 Python 回放规则、配置或存储标记。普通刷新先由现有 TypeScript checkpoint 生产者验证在途边界，再提交精确写回，最后扣额；回读只有在原轮次身份和已接受 checkpoint 全部吻合时，才让这一轮进入结算分支。直接把任务标成完成会绕过最终验收，单改 Python 展示字段又会产生第二个决策源，都不是更小的正确修复。

具体改动

关键代码讲解

• isAcceptedInFlightWriteback 只认可绑定任务的精确目标、执行者、任务和轮次，合法进展 outcome、checkpoint schema、严格的 accepted 布尔值、在途边界和当前任务 trigger。字符串形式的真值、其他执行者、语义收尾或错误 trigger 都不能充当进展结算凭证。这是现有已提交事实的派生判断，不是新持久状态。
• readQuotaSettlementFromRequest 先复用写回事件与运行记录的精确验证，再把合格在途写回送入原阶段归约。缺少扣额仍是待结算，缺少写回仍不能闭合；最终 closeout 独立失败，不能由这个新分支伪造。
• 新 CLI 回归复用现有公开 fixture 与 canonical 初始化器，在旧存储、真实 File 和本地 SQLite 上走 guard、写回、扣额和重入。修改等待条件或后继后，显式和隐式重入保留原任务身份；新轮次可以继续原任务或选择独立后继。另行读回确认任务仍开放、完成验证器哈希未改、扣额只有一次；managed TurnEnvelope 的执行与扣额字段同时为否。

对主干的风险

最强反例不是扣额失败，而是扣额成功后，下一次 guard 又产生可执行动作；原先只检查写回或 spend 的测试会漏掉它。反向风险是用普通进展声明提前停工，或者让一轮结算阻断任务后续工作。精确回执和 checkpoint 负例、新轮次准入、等待后继及最终验证器保留覆盖了这些边界。

当前 head 的 130 项 TS、6 个真实 CLI/provider 场景、40 项既有决策回归和 2 项既有 CLI 正反例均通过；类型、Ruff、差异检查通过。实际 14 项 premerge 执行在注解清理前的相同生产代码上通过，来源版本已披露。一次中途运行受本机临时存储耗尽影响，独立 pytest 启动也无法创建临时文件；仅移除本任务可重建的基线 checkout 后，失败场景及全部六项复跑通过，没有修改断言或放宽门禁。

语义与 CI 对齐

复用现有在途进展与轮次结算词汇，在协议中中英说明旧轮不重开、任务不提前完成和新轮重新准入，不引入 schema 或 provider 切换。按本次能力配置，评审使用仓库原生本地验证，不查询或等待远端 CI。硬租约、PostgreSQL 晋级、原生桌面、安装态真实模型闭环和全仓测试未声称完成。现有前端没有新配置需要暴露：此次修正的是已有 managed caller 消费的同一执行投影，不能把 CLI 验证包装成浏览器或飞书端到端验收。

我的整体评价

这是合理、可回滚的最小增量。持续执行方面，关闭旧轮同时保留新轮和独立后继；用户体验方面，结算状态与执行义务一致，不要求用户错误完成任务。生产部分扩展现有 owner，测试和双语说明有明确消费者与缺陷；保留历史回执契约比删掉旧格式或增加版本分支更合适。它不扩大完成或交易权限。合入与安装态自然消费者验收仍需后续完成；#5182 的 replan 后继证明是独立问题，本修复不依赖它。

English verdict: APPROVE - No blocking finding at the exact head. The fix aligns ordinary accepted in-flight Turn replay with durable settlement without completing the Todo, weakening its validator or widening authority. Identical baseline/head CLI input reproduces the contradiction and proves the intentional change; real legacy/File/SQLite continuation, receipt negatives and existing consumers pass. An infrastructure interruption was independently attributed to temporary-storage exhaustion and recovered without weakening checks. Local validation is not installed desktop, live-model, hard-lease or PostgreSQL promotion acceptance. Maintainer merge and installed consumer adoption remain separate.