fix(quota): preserve retry waits through cached deadlines and notices

[loopx-agent]

A valid full-source monitor cache could hide an earlier receipt-owned retry and let an ordinary reminder suggest owner intervention. Keep that cache while comparing only qualified earlier retries, include existing full-source successor waits before display limits, and retain the retry obligation on the quiet route. No new configuration, stored clock, execution authority or host timer change.

This increment repairs the later-cache case. An earlier/equal independent monitor still has the pre-existing reminder explanation defect; paired base/head observations match and recheck intervals remain bounded. The existing quota recovery boundary retains that gap. Installation and sustained host/cost benefits are separate acceptance.

较晚的 monitor 缓存会遮住较早的 receipt 重试到期时间，并把普通提醒误解释为等待本人解锁。修复保留缓存、在原 typed owner 中比较合格重试并使用完整来源 waits，quiet route 保留原重试义务；显示限制、scope、实际 gate、独立工作与费用规则保留。

更早／同刻独立监控的旧提醒解释仍未修复，base/head 相同且重检周期有界；本 PR 不宣称全局 quota、安装或长期效果已验收。

Validation / 验证：

• Identical final regression oracles: pinned production base 5 failed/4 passed → exact head 9 passed. Four focused Python files:46 passed. Disposable real File/SQLite CLI refresh, same-Turn guard replay and cold canonical readback preserve OPEN/no canonical resume, monitor due/hash/generation and zero work spend; actual gates, independent work, mismatches, due/newer-run and hidden/ninth clocks are covered.
• TypeScript full suite:4444 passed/37 optional skipped; typecheck, mypy19 files, Ruff, semantic drift, output budget and public/private scan passed. Full Python: 20981 passed, 343 skipped, 9 warnings, 517 subtests passed in 5041.53s (1:24:01). It started at b824; the two production and three regression files remain byte/hash identical at d027, whose documentation-only qualification is separately checked on the final head. No old verdict is reused.
• Two earlier full runs were interrupted; the second's23 Gitless fixture failures reproduce on unchanged base. The three affected files pass37 outside Git. Proper paired output size is14929/15500 without relaxed limits/assertions. Failures/incomplete runs remain recorded. Current-head native risk-based premerge and exact-scope quality receipts are recorded separately. GitHub CI was not queried or waited for.
• Bounded refactor pass applied: reuse the existing typed full-source owner; remove the proposed parallel Python cache-discard rule. No new provider IO, module, protocol or activation surface. Natural consumer/packaged host adoption, sustained multi-Goal fairness, model comprehension and net latency/cost remain unmeasured.

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | reasoning_effort=xhigh

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

English verdict: APPROVE

Exact reviewed head: d0274a3d306cb800d7b9132ec300288e845fe9ab. Verdict: APPROVE for the bounded source increment. No blocking finding in this changed scope. The existing earlier/equal-monitor notice explanation gap is explicitly retained below; this is not global quota/host or long-term cost acceptance. Runtime attribution does not prove model-weight identity or active-turn liveness.

动机

使用现有 quota／heartbeat 入口、同时有待重试工作、未来监控和普通提醒的 Agent。

这里的重试是原执行记录指定的下一次检查时间。同一输入中，工作五分钟后可重新检查，独立监控二十五分钟后才到期，另有普通提醒；旧实现提示等待本人，新实现保留工作重试时间并明确提醒不阻塞。 误提示本人解锁，会增加不必要的介入；如果宿主照较长的等待执行，还可能推迟合法重检，实际累计延迟尚未测量。

实际 File／SQLite CLI 重放保持不扣业务额度、原 Todo OPEN、监控时钟／hash／generation 不变；组合输入显示 blocked_wait 和原到期时间。 本 PR 交付源码中的等待解释与时钟组合修复，不执行新业务、不授予权限、不自动安装或改宿主 timer。

更早或同刻独立监控拥有下一时钟时，普通提醒仍可能被解释成人工门禁；该旧缺口由现有 quota 恢复工作继续处理。本机安装、自然消费者下一窗口及长期净延迟／成本收益仍待采用后的证据。

改动思路

从现有 quota should-run 出发，canonical Todo 与已提交的 Run 提供事实，receipt overlay 只派生原 Agent／Todo 的暂时等待，TypeScript planner 负责比较到期时钟；既有 obligation adapter 再将工作等待、普通通知和实际 gate 分开，最终 interaction／scheduler 输出给宿主。实际 File／SQLite CLI 通过重放与独立冷读验证结果，原存储、claim、lease 和费用规则未迁移。

已有类型化 deadline owner 已承担完整来源时钟比较，既有 obligation adapter 已承担提醒与执行的分离；复用它们比丢缓存、增加并行决策源或额外配置更小且可验证。 本 PR 在既有 quota 入口修复更早 receipt retry 被较晚缓存遮住的等待旅程；更早／同刻监控的旧提醒解释缺口、安装和长期运行仍分别验收。

不修会保留已复现的较晚缓存遮挡；直接丢缓存会丢掉隐藏的更早时钟；只看显示八行会漏第九个更早 retry。先让独立第九时钟 oracle 击穿第一版，再复用已有完整来源 successor waits。缓存与 full-source union 都是已有数据的投影，无新配置／IO／权限。scope 和实际 gate 是不变量；调度下限是已有 policy；宿主更新是独立 effect，本 PR 不执行。

具体改动

七个现有文件，+153/-28：两个 production owner、三个 regression test、两个既有文档／checkpoint；无新增模块、CLI、protocol field 或 capability。独立规范为 docs/quota-allocation.md，固定 pre-change revision df826263926651ab9c50acee182ef96e2a60ff4b；本次新增解释不充当自己的验收依据。

• bounded-retry：implemented，同 Goal／Agent／Todo／claim 的 retry 有界，独立工作保持可执行；due／newer run 重新走当前 guard。
• monitor-integrity：implemented，未来 unchanged monitor quiet，guard／重放不改变 due、hash、generation。
• notice-not-gate：deferred（局部已实现）。receipt retry 拥有下一时钟时通知不阻塞；独立 monitor 更早或同刻时仍有旧解释缺口。现有 quota recovery 工作继续处理多时钟的等待投影，不能以本 PR 宣称全局完成。
• no-spend-blocked：implemented，真实 File／SQLite blocked/replay 路径无业务 debit；这不表示所有后续工作免费。

关键代码讲解

1. projectTodoFrontierDeadline：原先有效缓存直接返回，现在把它保留为候选，仅让匹配 OPEN advancement、原 receipt、due／resume、Agent／Todo／claim 的更早 retry 竞争。非法或较晚 retry 保留原缓存及 extension；同 identity／time 去重，更新同 identity 不夸大 candidate count。返回的是重检时钟，不是执行权。
2. projectTodoQuotaPlanning：在内部 deadline 计算前合并已有 blocked_successor_items 与显示 wait lane。第九个更早时钟可参与，而 wire/display 保持八行边界；没有新存储时钟。生产 caller 是现有 todo.quota_planning.project handler 与 Python quota bridge。
3. build_execution_obligation：已有 repair／独立工作优先分支之后，quiet monitor route 也可保留 pending retry；输出 must_attempt_work=false、delivery_allowed=false，并要求到原 due 后重新检查全部当前 gate。完整 notice-only user lane 决定普通提醒不阻塞，实际 user gate 仍保留。

对主干的风险

重点反例是隐藏更早缓存、第九 retry、伪造／不匹配 scope、真实 gate、独立工作和到期后陈旧等待。最终四个相关 Python 文件46通过；相同两个测试 oracle 在固定 baseline 5失败／4通过，candidate 9通过。真实 File／SQLite CLI blocked refresh→guard→同 Turn 重放→cold readback 保持原 Todo OPEN、无 canonical resume、monitor due／hash／generation 不变、0spend。TypeScript 全集4444通过／37 optional skipped，typecheck、mypy19文件、Ruff、output budget、public/private scan 通过。

完整 Python 正确环境结果：20981 passed, 343 skipped, 9 warnings, 517 subtests passed in 5041.53s (1:24:01)。该运行始于 b824，期间只有 d027 的文档资格说明变化；两个 production 与三个测试文件 byte/hash 均相同，最终文档再走当前 head 的原生 premerge／scan，并未继承旧 verdict。两个较早全集均被中断，不能算通过；其中23个 Gitless fixture 失败在 unchanged baseline 逐个复现，三个对应文件在 repo 外临时根37通过。首次 size／Gitless smoke 的失败也保留：相同正确短临时根 base/head 均14929/15500，未放宽预算或删 assertion。19个 risk-selected premerge smokes 与直接检查通过，最终 exact-scope quality receipt／merge readiness 另有原生记录。

额外六个同输入公共 quota composition 反例覆盖无缓存注解、显示顺序、25个额外较晚监控、完成／superseded reference；原五分钟时钟与权限边界保持。再对更早3m／同刻5m monitor 做 paired probe，base/head normalized observation 完全相同：仍误解释 human_gate，但重检 interval 已分别有界为1／3m。这是明确剩余缺口；本修复不扩大它，也没有宣称解决。此前 consumer 能在实际 due 后恢复，故不能把潜在九分钟减少写成已观测线上收益。

语义与 CI 对齐

沿用既有 vocabulary、typed retry helper 和 EffectiveAction，无 prose／substring 分类、新 shared protocol 或 feature-off 宣称。旧“等待本人”改成“原执行记录的有界重检，普通通知不阻塞”，是 accepted contract 支持并在真实 caller 验证的语义修正；到期、scope、gate、独立工作、no-spend 和停止执行条件保留。默认行为改变已在双语 quota docs 及命名 regression cases 披露。development advisory 未见支持范围内的新 carrier，并非动态语义证明；semantic smoke 通过。按配置不查询／等待 GitHub CI。

我的整体评价

justified_increment；long_horizon=improved、user_experience=improved 限于较晚缓存／retry 拥有下一时钟的源码旅程：合法重检更准确，普通提醒减少错误介入，同 Turn 重放、due／newer run 和独立工作均保留。无需额外参数或确认步骤。真实宿主采纳、packaged installation、多个 Goal 的长期公平性、memory causal utility 与净延迟／费用仍未验收，不能由测试数推出。

维护成本是对已经投影的完整来源 waits 多一次 union/scan；没有新增 provider IO／持久字段或迁移。已做 bounded future-facing pass：撤掉丢缓存的平行 Python 判断，复用 typed owner；现有 transient request variants 与 persisted receipt 路径保留，不为这次修复另起大迁移。已有类型化 deadline owner 已承担完整来源时钟比较，既有 obligation adapter 已承担提醒与执行的分离；复用它们比丢缓存、增加并行决策源或额外配置更小且可验证。 本 PR 在既有 quota 入口修复更早 receipt retry 被较晚缓存遮住的等待旅程；更早／同刻监控的旧提醒解释缺口、安装和长期运行仍分别验收。 更早／同刻 notice gap 的下一 owner 是既有 quota recovery；需要区分“下一 clock”与“所有 pending waits”，保持单一 typed authority。源码审批不授予合并、自动安装或宿主 timer 修改权。

Motivation

An agent using the existing quota/heartbeat entrypoint may have receipt-owned retrying work, a future monitor and an ordinary reminder at the same time. In the concrete case, work can be rechecked after five minutes while the independent monitor is due after twenty-five. Previously the later cache hid the earlier retry, and the reminder produced a false owner-unlock explanation with a fifteen-minute suggestion. The repaired composition retains the work retry and makes the reminder non-gating when that retry owns the next deadline. Unnecessary intervention and delayed rechecking are plausible costs; accumulated live delay was not measured.

Real File/SQLite CLI replay preserves zero work debit, the original OPEN Todo and unchanged monitor due/hash/generation. This PR delivers a source wait/clock correction; it performs no new business operation, grants no permission, installs nothing and changes no host timer. Earlier/equal independent-monitor notice explanation remains defective at both revisions and belongs to existing quota recovery work. Installation, a natural subsequent consumer window and sustained net latency/cost still require separate evidence.

Approach

Canonical Todo and committed Run facts enter the existing receipt overlay. The TypeScript quota planner owns deadline comparison; the existing obligation adapter distinguishes work waiting, ordinary notices and actual gates before the interaction/scheduler packet. File and SQLite CLI replay plus independent cold reads test the real consumer boundary.

The established typed owner and obligation adapter fit this responsibility more closely than dropping caches, adding a second decision owner or introducing configuration. Doing nothing keeps the reproduced defect; cache invalidation loses hidden earlier clocks; scanning eight display rows misses a ninth earlier retry. A failing independent ninth-clock oracle prompted reuse of the existing full-source successor waits. This reversible increment repairs the later-cache source journey. The unchanged earlier/equal-monitor explanation requires a distinct multi-clock projection judgment, while installation/host effects have their own authority and readback boundaries. Scope and gates remain invariants, cadence floors remain existing policy and no provider IO/effect is added.

Changes

Seven existing files, +153/-28: two production owners, three regression files and two existing contract/checkpoint documents. No new module, CLI, capability, protocol field or persisted state. The independent accepted specification is docs/quota-allocation.md at pre-change df826263926651ab9c50acee182ef96e2a60ff4b.

• bounded-retry: implemented; exact receipt scope only, independent work remains eligible and due/newer work uses the current guard.
• monitor-integrity: implemented; quiet unchanged monitors retain their due/hash/generation through guard/replay.
• notice-not-gate: deferred globally, implemented where receipt retry owns the next deadline. Earlier/equal monitor explanation stays with existing quota recovery and must not be called complete.
• no-spend-blocked: implemented in actual File/SQLite blocked/replay paths; later work is not declared free.

Key code walkthrough

projectTodoFrontierDeadline at line328 retains the full-source cache as a candidate and compares only earlier legitimate OPEN advancement receipt retries with matching due/resume/Agent/Todo/claim. Invalid or later inputs preserve the cached clock/extensions; duplicates and same-identity replacement do not inflate candidate population. Its result is a recheck deadline, not execution authority.

projectTodoQuotaPlanning at line376 unions the existing full-source blocked_successor_items before internal deadline selection. This includes the ninth earlier retry without widening the display or wire schema. Existing typed handler and Python quota bridge are active production callers.

build_execution_obligation at line11 preserves pending retry on the quiet monitor route after repair and independent-work precedence. It forbids delivery, requires a current recheck at original due and all current gates, and treats the complete ordinary notice lane as non-gating. Actual user gates remain in force.

Mainline risk

The decisive negatives are hidden earlier caches, the ninth retry, forged/mismatched scope, actual gates, independent work and obsolete waits after due/newer runs. Four focused Python files pass46 cases; the identical two regression oracles give base5 failures/4 passes and candidate9 passes. Disposable File/SQLite CLI refresh→guard→same-Turn replay→cold readback preserves OPEN/no canonical resume, monitor facts and zero spend. Full TypeScript passes4444 with37 optional skips; typecheck, mypy19 files, Ruff, output budget and public/private scans pass. Full Python under the proper environment: 20981 passed, 343 skipped, 9 warnings, 517 subtests passed in 5041.53s (1:24:01). The run started at b824; only the d027 documentation qualification changed while it ran. The two production and three test files remain byte/hash identical, with final documentation checked again through current-head native premerge and scan. No prior verdict is inherited.

Two previous full runs were interrupted and remain incomplete. The same23 inside-Git Gitless-fixture failures reproduce individually on unchanged base; the three affected files pass37 cases outside the repository. The earlier size/Gitless smoke failures were recovered without changing assertions, workload or budgets: identical proper temporary roots produce14929/15500 characters on base/head. All19 selected premerge smokes and direct checks pass; final native quality/readiness receipts are separate records. No CI rollup, polling or waiting was used.

Six paired public quota-composition counterfactuals also cover absent redundant cache, reversed display,25 extra later monitors, completed and superseded references. Earlier/equal3m/5m independent-monitor probes produce exactly the same normalized base/head observations: the old human-gate explanation persists but intervals remain bounded at1/3m. That limitation is disclosed rather than relabeled fixed. A consumer's eventual due-time recovery does not prove measured live latency savings.

Semantic and validation alignment

Existing typed vocabulary/helpers and EffectiveAction are reused. No substring classifier, new shared protocol, feature-off assertion or wider authority model is introduced. The decision text intentionally changes a false owner unlock into a scoped receipt recheck with a non-gating notice. Accepted-contract validation preserves actor/scope, ordering, due/gate, independent work, no-spend and stop conditions; model comprehension remains unmeasured. Bilingual docs and named regressions disclose the default correction. The advisory found no supported new vocabulary carriers, which is not dynamic semantic proof; the semantic smoke passes.

Overall assessment

APPROVE, justified_increment, with long_horizon=improved and user_experience=improved only for the later-cache/receipt-owning-next-deadline source journey. Legitimate rechecking becomes truthful, mistaken owner intervention is reduced and replay/lifecycle/independent work are retained without new setup or confirmation. Installed host adoption, packaged readback, sustained multi-Goal fairness, memory causal utility and net latency/cost are not established by these test counts.

Cost is one union/scan of already-projected full-source waits, with no new provider IO, persisted contract or migration. The bounded simplification pass removed the proposed parallel Python cache-invalidating rule and reused the current typed owner; existing evidenced request/receipt compatibility remains. The existing quota recovery owner must separately distinguish the next deadline from all scoped pending waits for the earlier/equal notice gap. No blocking finding remains in this bounded changed scope; that gap and unmeasured installed/host/long-term behavior are the strongest remaining evidence limits. This approval grants no merge, installation or timer authority.