fix(quota): require selection before binding unclaimed candidates

[huangruiteng]

Goal And Delivered Outcome

Fix a reproduced quota selection defect: a sole unclaimed candidate was bound as required work before the agent chose it. The next host Turn then demanded settlement of work the agent had not accepted.

The existing TypeScript action-portfolio owner now requires explicit selection for that candidate. Reading the recommendation leaves the receipt unbound; the returned selection command revalidates eligibility and binds the same Turn. Already-claimed singleton work keeps its direct path.

Intended base: main, baseline b77f63495f2619237380755178c0780ae10a0f26. This is a bounded S7 quota/continuity repair, not a new scheduler, claim protocol or authority store.

Author Declaration

Written by: model_agent — GPT-5-based Codex, OpenAI.

Implemented against the reproduced defect and the existing explicit-selection contract in docs/quota-allocation.md at the baseline above. This PR deliberately corrects its old unrestricted singleton shortcut; the updated document discloses that default change.

Criterion	Disposition	Owner / evidence
Recommendation does not accept unclaimed work	implemented	action_portfolio.ts; failing-before TypeScript and real SSH CLI regression
No false prior-Turn recovery before selection	implemented	App/SSH CLI journey with an owned deferred task and one unclaimed candidate
Explicit selection binds the same Turn; replay preserves identity	implemented	Real returned command plus receipt readback
Already-claimed singleton stays direct	implemented	Renamed App/SSH guided-start regression
Historical bindings remain immutable	implemented	Existing recovery rules unchanged; focused recovery suite

Scope And Continuation

• The only product change reuses claim_required_before_work in the existing typed portfolio rule. No Python decision owner, new vocabulary, setting or claim effect is added.
• Selection is not a claim or a new permission grant. Execution still requires the existing claim/lease and scope checks.
• The settlement test fixture now explicitly owns its ordinary delivery Todo; tests for unclaimed work opt out. This preserves the intended direct-delivery test precondition instead of retaining the faulty shortcut.
• Frontend/Lark UI impact: none. This repairs worker quota/Turn-envelope planning through existing selection commands; it does not introduce an owner-facing picker. No browser or Lark journey is claimed.
• Complete within the prospective selection scope. Previously committed false bindings are not rewritten or cleared. Legal historical recovery and installed adoption remain separate; no shared installation is upgraded and no merge is requested by this author action.
• Future-facing pass: reused the existing selection owner and consolidated its early-return condition; no adjacent abstraction or migration was needed.

Validation

Input classes: synthetic and public fixtures only. The new regression failed before the product change; one initial test invocation also used an invalid host-profile name, corrected to the shipped heartbeat profile before qualification.

Current head: 55cc565cb7d3fe5840df5c94f6fbc6c8535fe285. All 605 tests in the 51 direct fixture-consumer modules and all 19 selected canaries pass at this exact head. The runtime change and initial validation below are from 28c0976357d9267836559864f444cb304c0f6ca3; subsequent commits make shared-fixture ownership assumptions explicit and exercise the monitor's returned selection command. Full remote CI is still running. No exact-head review, installed adoption or full product acceptance is implied.

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	New singleton test failed before the rule change; App/SSH now preserve two unchosen Turns, then bind/replay the returned explicit choice
unit	passed	54 TypeScript action-portfolio, planning-horizon and prior-Turn recovery tests; 32 Python live quota-decision tests
static	passed	TypeScript typecheck, targeted Ruff, semantic coinage advisory, diff hygiene
real_entrypoint	passed	125/125 settlement CLI, action portfolio and replan reentry tests at the runtime-change head; App/SSH selection, legacy/File/SQLite receipt paths and final scope reentry
regression_parity	passed	CLI output-budget matrix and base/head differential; work-lane smoke
integration	passed	Runtime-change head standard canary: all 14 selected checks passed, including full semantic validation, quota policy and monitor/scheduler contracts
static	passed	Four candidate public paths scan clean; unrelated local registry warnings are not public-boundary failures
manual	not_run	Maintainer review and installed-host adoption remain separate gates
regression_parity	passed	Follow-up: 4 deferred-resume and 20 unavailable-monitor tests preserve their original self-authored claims and unchanged assertions; writer-isolation suite also passed 23 tests
regression_parity	passed	Cross-agent capability and stride-replan focused rerun: 4/4; checkpoint-validator fixture correction: 1/1
integration	passed	Final exact-head canary: 19/19 selected checks over all ten changed paths; no failures or manual holds
integration	passed	Final exact-head run of all 51 test modules directly referencing the shared settlement fixture: 605 passed, 0 failed, 0 skipped; 4 workers, 795.97 seconds

The wider run initially found fixture-precondition regressions: making the ordinary delivery fixture claimed changed the late-added-task test's original unclaimed frontier and prevented deferred-resume and monitor fixtures from authoring their own claims. Cross-agent capability fixtures likewise need an unclaimed candidate visible to both agents. These scenarios explicitly opt out of the default claim. The stride-replan test explicitly chooses the successor as an alternative to the owned default, preserving the documented retained-selection mismatch and autonomous-replan assertions. The monitor material-transition smoke now executes the returned selection command before expecting delivery authority and verifies that selection does not claim the Todo. Focused reruns and the complete final consumer run passed.

One subsequent 8-worker run stopped at a checkpoint child-process startup barrier timeout (157 passed, 1 failed). The unchanged File/SQLite test passed separately (2/2). A 4-worker run passed 525 tests and found one more old fixture marker in checkpoint-only recovery; that marker now preserves the existing claim, and its focused test passes. The final 4-worker full run completed with unchanged deadlines: 605/605 passed. Neither earlier incomplete run is recorded as a clean full-suite pass. Provider promotion is not in scope: the product change reads the existing typed inventory and does not alter persistence or provider routing.

Existing CI failures at the pinned baseline

Both failures below occur identically in the pinned baseline run, the previous-head run (635a1e25e), and the final-head run (55cc565cb), as confirmed from each completed job's logs. The failing tests, locators and affected product files are unchanged by this PR. They remain required-check failures, not passes or exemptions:

• TypeScript core 1/3: content_digest_single_owner.test.ts:607 finds the same three duplicate SHA-256 matchers in goal_amendment_authority.ts, turn_envelope.ts and stride_policy.ts.
• Stage 2C mutants: mutants.py:231 raises guard locator drift; review lock protocol before the intended mutation can be qualified.

Remote PostgreSQL integration passed at the earlier runtime-change head; that is not installed-host adoption evidence. No unrelated authority or mutation-harness repair is bundled here.

Boundary Checklist

• No private state, credentials, raw traces, internal links or local machine paths in the diff or PR body.
• Scope is the reproduced quota-selection defect; unrelated work is not accepted or changed.
• UI impact is none, as explained above.
• Commits use DCO sign-off.
• Control-plane merge remains a maintainer decision after review and required checks.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=xhigh

Exact head: 55cc565cb7d3fe5840df5c94f6fbc6c8535fe285

动机

查看可用任务但尚未接受未领取工作的 App/SSH Agent。 原单个未领取候选仅被推荐就绑定为本轮必做任务，下一轮可能被迫恢复并结算尚未接受的工作。 当前先返回既有选择命令和无绑定回执；两轮只读观察不制造结算责任，明确选择后绑定同一 Turn，仍须原 claim/lease 校验。 本 PR 不添加 scheduler、claim 协议、权限开关或 owner-facing picker，不升级共享安装，不授予合并、外部消息或模型执行权限。 真实安装宿主采用与历史错误绑定的处置仍由原恢复边界独立验收，本 PR 不认证整个 S7 或长期模型效用。

当 Agent 只想查看一个可用任务时，推荐本身不应替它承诺工作。这个修复去掉未来轮次中错误制造的恢复责任；已领取工作仍直接进入原交付路径，原历史回执的责任也不会被擦掉。

改动思路

Reuse the existing explicit selection boundary when the normalized primary requires claim-before-work. Keeping the unrestricted singleton shortcut accepts unchosen work; adding a second claim/receipt state or a new picker would duplicate existing ownership.

只调整已有 TypeScript work-items owner 的单候选 early return。planning_inventory 先给出独立的 claim 状态，action_portfolio 在返回空 portfolio 前把 claim_required_before_work 纳入原显式绑定条件。Python、CLI/Host envelope、receipt 和 claim/lease 继续消费原决策，没有第二套持久状态或权限开关。已有选择步骤提供的是接受这项工作所需的信息，不新增 owner-facing 表单或多余确认。

具体改动

完整 10 文件 +134/-14，其中产品代码仅 +5/-2。依据变更前 docs/quota-allocation.md，固定 b77f63495f2619237380755178c0780ae10a0f26，先读 default-not-binding、当前准入、claim-before-work 和历史回执条款，再检查实现；原文无条件 single-candidate shortcut 是本次明确披露的修正对象。以下是评审索引，非新增 roadmap 或协议标识：selection-not-acceptance、same-turn-current-selection、claim-before-work、historical-binding 均 implemented。

• projectQuotaActionPortfolioV1（action_portfolio.ts:246）先合并原 planning choice、未领取事实和 alternatives，再决定是否省略 portfolio。单个已领取任务仍省略；单个未领取任务返回现有选择投影。
• 原 CLI guard 两次未选择观察均无 settlement identity、无强制 closeout、无 settlement plan，交付／扣费保持关闭。返回命令复查当前资格后绑定同一 Turn；重放身份不变，但 Todo 仍未领取。
• _write_fixture 的普通交付条件明确为已有 claim。共享的 capability、deferred、unavailable Monitor、late-added-task、stride successor 与 checkpoint 夹具显式维护各自原前提；原断言没有被删除或跳过。Monitor material successor smoke 现在执行实际选择命令，并检查 selection 不等于 claim。
• 文档双语披露未来单候选默认改变，direct-start 测试改名为 single-claimed；原历史绑定与恢复条款保留。没有前端/Lark 配置变更，这属于现有内部 worker 准入旅程，不是另一个用户能力。

对主干的风险

主要风险是共享夹具的新默认掩盖原未领取／跨 Agent／后加任务场景。独立当前运行覆盖所有 52 个直接共享消费者模块：708 passed，997.95 秒，2 workers；另外核心四模块 164 passed。这些分别是完整消费者和聚焦运行，数量有交集，不相加。当前独立 TypeScript 为 62 个唯一用例（portfolio/horizon27、admission/recovery35），涵盖非法资格、foreign、硬优先级抢占、未选择重入和既有历史绑定。

通过实际 CLI 做同样原断言：App/SSH × legacy/File/SQLite 的六个场景在固定 base 6 failed/6.83秒，当前 6 passed/16.68秒。对照保留两次未选择观察、选择命令真实执行、原 Turn replay、原 source bytes 和零 spend；没有模拟绑定成功或修改期望。baseline 夹具本来未领取，只适配其旧签名，没有改变 oracle。三条已领取／future-unavailable／alternative 的真实 typed-owner 完整输出在 base/head 精确相等，零归一化。

当前风险 canary 4 direct/19 selected 全过，零 hard/advisory failure；development advisory 先于 full semantic，公共边界与 diff 检查通过。初次本地验证命令有路径／参数错误，保留后按实际入口修正，不计通过；实际上述运行均完成。未查询、轮询或等待 CI，也未把作者先前未完成的 run 记成绿色。

语义与持续工作

本修复复用现有 typed claim/selection 布尔事实，不新增 vocabulary 或按文案分类。推荐是建议；选择前禁止交付／结算属于机器义务；选择之后仍须 claim/lease，不能把接受等同授权。原已绑定回执不可追溯重写，既有恢复与当前 hard lane 保持原 owner。没有 optional feature-off 宣称；这是有界且披露的默认修正，已验证不受影响的路径和完整后续消费者。

我的整体评价

APPROVE。本批完成未来未领取单候选的选择修复及共享测试夹具采用，保持既有回执恢复，不重写历史错误绑定。 真实安装宿主采用与历史错误绑定的处置仍由原恢复边界独立验收，本 PR 不认证整个 S7 或长期模型效用。 当前未领取观察到明确选择、同 Turn 重放的有用连续工作成立；已领取路径没有新增决策负担。Reuse the existing explicit selection boundary when the normalized primary requires claim-before-work. Keeping the unrestricted singleton shortcut accepts unchosen work; adding a second claim/receipt state or a new picker would duplicate existing ownership.

有界近邻重构已经应用：将同一显式绑定判定放在 early return 前，并把共享夹具的拥有关系写清；新增抽象、picker 或 Python 决策源都没有必要。维护者合并、安装采用与整个 S7 验收保持各自边界。

English verdict: APPROVE — 55cc565. Sole unclaimed recommendations stay unbound until explicit same-Turn selection, without granting a claim or rewriting historical identities. Own708 shared-consumer tests,62TS and six real App/SSH×legacy/File/SQLite base-fail/head-pass cases qualify the change; three unaffected full projections match exactly. Native4direct/19selected checks pass. Installed-host adoption and merge authority remain separate.