test(scheduler): bind recovery ACK fixture to current Codex host

[loopx-agent]

After #6276 required fresh bound Codex App readback, the quota-error recovery fixture still omitted the current Host and forced a nonexistent Python interpreter for the Codex launcher. Its four File/SQLite × module/launcher cases could no longer reach the ACK and settlement assertions.

Reuse the existing bound heartbeat fixture and the selected interpreter. Keep every original assertion for the rejected quota audit, original receipt identity, ACK replay without spend, once-only ordinary settlement, and stale receipt refusal. Production behavior is unchanged; the Python-free Trae path retains its separate coverage.

Validation on commit bd5c650 (parent 36a2f71):

• Full affected Python suites: 102 passed, zero failures/skips, including actual Unix and PowerShell launchers and real File/SQLite stores. Original setup previously produced four failures and 98 passes.
• Typed followup suites: 25 passed; Ruff, semantic advisory then full semantic smoke, public boundary scan, and native change-quality receipt passed.
• Risk-selected premerge: four selected smokes plus four direct checks passed, with no holds.

PowerShell ran on macOS; this does not certify Windows OS behavior. This repair restores the source qualification matrix. Installed App/runtime adoption remains a separate acceptance step and is not claimed by this PR. The related refactor pass reused the existing fixture instead of adding helpers or another Host decision owner.

[loopx-agent]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=xhigh
Exact head: bd5c650942187cb83dabcd36f126d3f11dee8b21

动机

维护 scheduler 的开发者在验证一次错误 quota 查询后的自动恢复时会遇到这个问题。现有四个恢复用例没有设置当前绑定的 Codex App 配置，且启动器被指定为不存在的 Python；Host 重新观测后拒绝 ACK，后续恢复断言无法执行。本次使用已有绑定配置 fixture 和当前解释器，让真实 File/SQLite 的模块与启动器调用执行原回执重放、一次结算和过期回执拒绝。本 PR 只修正测试前置条件，不更改生产调度、权限、安装或存储规则。真实安装的 App/runtime 采用及 Windows OS 资格仍需分别验收；这些不由本次合成 Host 配置证明。

改动思路

保留原语义断言，纠正已经不满足当前 Host 安全合同的正例前置条件。复用已有 write_codex_heartbeat_fixture，指定 sys.executable，不新增 helper 或例外分支。最小替代方案也是这两处设置；删断言、恢复缺席 Host 的接受逻辑或伪造 ACK 都不合理。

规范依据：docs/heartbeat-automation-prompt.md#minimal-user-facing-form，固定版本 36a2f71064b74cb14db9701bf33fb834c9878f04，核对 Minimal User-Facing Form：成功/唯一匹配的 Host 调度才能走绑定 ACK，调度确认不花 quota。#6259/#6276 的生产修复已合并；#5766 的错误查询后原回执恢复测试需要相应合法输入。本批完整恢复原有错误查询后的结算回归矩阵；生产修复由已合并 #6259/#6276 提供，实际安装采用保持独立验收。

具体改动

test_failed_quota_invocation_keeps_receipt_ack_and_exact_settlement 使用临时绑定 App 配置和相同解释器调用真实启动器。module/launcher 只是本地 pytest 参数名。全部原断言保留：错误查询 audit、原 Turn/receipt 身份、ACK 重放时字节不变且 quota 为零、普通结算恰好一次，以及新 Turn 后原 ACK 以 stale 错误拒绝。未添加生产状态、协议、默认或权限规则。

独立扫描现有 Host binding/native launcher/fixture 以及相关作者近期 scheduler PR：本批修复既有用例，不新增重复 smoke。真实 launcher 的缺席、错误、歧义 Host 和 outer-controller 拒绝用例继续运行，Trae 无 Python 路径保持独立覆盖。

对主干的风险

修复前同一恢复矩阵有 4 个前置条件失败；最终稳定源码树上 102 项 Python 全部通过、无跳过，其中包括实际 Unix 与 PowerShell 启动器及真实 File/SQLite。原回执、一次结算与 stale 拒绝断言没有放宽。25 项 typed followup 通过；Ruff、advisory 后完整 semantic smoke、公开边界扫描、原生质量回执及 4 个所选 premerge smoke + 4 项直接检查通过，无 hold。验证树为 parent 36a2f71064b74cb14db9701bf33fb834c9878f04 加最终完全相同的测试改动；提交不含其他变化。早期错误文件名的零测试运行、checkout 更新重叠的中间运行不作为通过证据。按当前 policy 未咨询 CI。

合成配置只能证明 CLI 重新读取匹配 metadata，不能证明实际 App API 更新、已安装版本采用或 Windows OS；PowerShell 实跑平台为 macOS。本 PR 没有可影响 frontend/Lark/CLI 用户流程的生产改动，因此无需新增界面或开关。

我的整体评价

无阻塞发现，APPROVE。这是一个有明确失败证据、完整保留恢复断言的测试维护切片；复用现有 fixture 是已落实的相邻简化。本批完整恢复原有错误查询后的结算回归矩阵；生产修复由已合并 #6259/#6276 提供，实际安装采用保持独立验收。安装采用仍沿原验收继续；不从测试通过推断默认 SQLite、持续调度或整个 Goal 完成。

English verdict: APPROVE. The existing recovery fixture now supplies the current bound Codex Host facts and selected Python required by the merged launcher contract. Original receipt, replay, zero-spend ACK, once-only settlement and stale-refusal assertions remain intact. Actual source launchers and real File/SQLite pass; live App adoption and Windows OS remain separate qualification.