fix(quota): retain mandatory resume replans across turn replay

[loopx-agent]

A due deferred task initially receives mandatory successor-replan admission. Re-reading the same Turn currently collapses that admission into a quiet skip because the task is still deferred; reopening it can also import a different semantic obligation into an originally empty guard. This loses an authorized recovery step and can leave feasible work waiting indefinitely.

Preserve the original committed receipt's pending replan, recheck the same canonical claim-scoped candidate, and permit only its bounded resume path. Explicit future waits, changed ownership, settled Turns and work deferred after ordinary admission keep their no-delivery/no-spend behavior. Reopening the original task qualifies work without replacing its settlement identity. Existing TypeScript receipt/replan owners make the decision; Python transports it.

The quality skill distinguishes a qualification hold from an external execution wait: feasible authorized repairs continue, required checks stay required, and completed author proposals may enter normal PR review with their holds disclosed.

Validation at 1eace238b2b271e9fda1b524892857f877c1f859:

• Reproduced the wrong quiet-skip on both File and SQLite before repair.
• 181 real CLI/selection/blocked-successor/replan tests passed with isolated registries.
• Final eligibility/claim guard: five replay and after-admission deferral cases passed, including future-wait refusal, same-task reopen and unchanged settlement/no-spend.
• Control-plane TypeScript typecheck, configured Python mypy (17 modules), changed Python ruff, semantic diff/public scan and staged bilingual RFC gate passed.
• Exact-scope quality receipt passes. Final risk-based premerge passed with no failures/manual holds. The producer registration and preparation-complexity failures from the first run were repaired in code; limits remain unchanged. Final preparation is 90 statements/56 decisions (base: 90/59). Eight final replay/continuity/semantic-guard cases passed after the bounded refactor.

Entrypoints: existing quota/heartbeat decision and replay consumers. No new caller-facing capability, CLI flag, persisted authority, alternate scheduler or presentation layout. No active Goal fault injection. This does not permit selecting unrelated work inside an interrupted Turn, waive real dependencies or prove installed/model adoption.

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

已获准自主推进目标的 Agent，在同一轮中恢复一个到期的延期任务。原先第一次准入要求重新规划，但重读同一轮后变成静默跳过；现在保留原任务的恢复义务，明确重开后继续同一结算身份。File 和 SQLite 的真实 CLI 已验证重复准入不会丢失恢复义务，未来依赖仍然等待，重开后可以推进且不额外记账。本 PR 不取消真实依赖、账号额度、任务归属或结算约束，也不允许旧轮次改选无关任务。后续还须经维护者授权合并、安装，并观察普通自主运行；测试不证明所有模型都会采纳新指引。

这是一次可复现的恢复路径缺失，增加唤醒频率或追加“积极工作”提示不能修复回执重读。质量检查失败也只应阻止未经资格确认的交付，不能把自己仍能修的代码自动归类为外部依赖。

改动思路

复用既有 TypeScript 回执与语义重规划 owner，Python 只把当前规范任务的可执行性带回同一个选择路径。本次只修复同轮 resume 重读和质量阻塞的继续规则，不另建调度器或自动放宽准入。

最初准入已绑定哪个任务、要求什么恢复，是不可被后来列表排序替换的事实。新投影只说明原回执的 resume 是否尚待处理；它不独立授予权限。重新判断时还必须在规范任务源中找到同一 agent 的同一已到期任务，且 Goal 健康、准入状态可用。显式重开才进入正常工作，结算身份沿用，观察本身不扣额度。没有新建持久化开关、调度器或另一个重规划 owner。

具体改动

关键代码讲解

• readQuotaSettlementFromRequest 只从原始回执的 open 阶段、required-replan 状态及 should_run/delivery_allowed 组合派生待恢复标志。后来的文本或新候选不能伪造这项事实。
• _pending_receipt_resume_is_ready 将原待恢复事实与当前规范任务、claim、健康和 eligible 状态结合。新未来依赖依然拒绝；原来正常准入后才延期的任务也不套用恢复例外。
• _selected_deferred_replan_frontier 复用既有有限重规划路径，并限制在原任务上；注册表的 producer 指向已同步更新，不新增 action 词汇。
• preserveReceiptBoundObligation 区分明确 scoped-null 与旧调用未带作用域。前者保持空语义义务，不能在重开时悄悄引入后来发现的新义务。

规格依据为 docs/quota-allocation.md，版本 860e42d4b63b45c4798ee7f08622a27c146a2610，按修改前的 immutable-turn-identity、bounded-successor-replan、once-only-accounting 三项义务评判。三项均 implemented，分别由原回执/重绑定负例、File/SQLite 到期重读和未来等待、以及每一步 identity 相等且 spend 为零的真实 CLI 断言验证。新增说明段不作为自己的独立验收依据。

对主干的风险

最大的反向风险是把旧的“该恢复”当成跳过新依赖或改选任务的许可。最终实现同时检查原始回执与当前规范源，未来时间、其他 claim、已结算轮次和非原任务均无法扩大权限。新用例先让同一任务到期、重读，再设为未来依赖并确认拒绝，最后明确重开并读回正常准入；两种存储后端都保持原结算身份且未扣额度。既有未绑定轮次创建新任务的合法路径仍保留，不能为了这次修复把合法选择一起封死。

语义与 CI 对齐

181 个真实 CLI/选择/阻塞后继/语义重规划回归通过。最后的局部抽取又跑了 8 个重复准入、大 Goal 连续性和空语义 guard 用例。第一次 premerge 暴露的 producer 过期和大函数门槛问题均由代码修复：准备函数从基线 90 statements/59 decisions 变成 90/56，阈值保持 90/60，无新增例外。最终 premerge、语义词汇检查、TS typecheck、配置 mypy 和 ruff 均通过，精确范围质量记录有效；按 wait_for_ci=false 未查询远程 CI。

质量 skill 的旧“交付前停止”改为“保持 merge/promotion/资格声明的 hold，同时继续可行且已授权的修复”。safe-fix 次数、strict receipt、真实失败和维护者权限均保留。这是指引语义的有意澄清，不是机器强制模型采纳，也没有修改通用 heartbeat 提示来掩盖确定性缺陷。验证只使用隔离 File/SQLite 状态，没有修改活跃 Goal 来制造故障。

我的整体评价

源码交付判断 justified_increment。long_horizon=preserved：同轮重读到明确重开保留原任务、义务和一次结算约束，不把新候选塞入旧轮次；user_experience=improved：已有授权的修复不再因为泛化质量 hold 要求人工重新唤醒。这里不宣称整体效率提升或所有模型后续都会主动工作，安装与普通运行观察仍须分别核验。

这份修复与原问题相称：复用已有 readback、规范候选和有限 frontier，加上直接抓住正反路径的回归，没有附带新状态体系或宽泛准入豁免。没有剩余阻塞发现，给予精确 head APPROVE；该作者自身评审以 COMMENTED 发布，后续合并仍需独立就绪检查和维护者授权。

English verdict: APPROVE 1eace23. Original pending resume duties survive replay while canonical future waits, claims, immutable task identity and no-spend guards remain enforced. Final local validation passes without budget relaxation; installed rollout and future agent adoption are separate evidence.