fix(quota): preserve monitor-poll fence rejection

[Duang777]

Summary

• preserve the typed legacy-writer fence code, remediation, and nested write check through quota monitor-poll --execute
• add a public CLI regression proving the fenced write remains side-effect free

Issue Or Task

• Follow-up to the quota adapter gap disclosed during fix(coordination): make Stage 2C capture and rollback recoverable #3985 review.
• Contributor task ID: core control-plane hardening

Validation

• python3 -m pytest -q tests/control_plane/test_split_root_todo_writeback_fence.py tests/control_plane/test_quota_error_codes.py tests/test_cli_argument_diagnostics.py (114 passed)
• python3 -m pytest -q tests/presentation/test_quota_markdown_renderers.py tests/control_plane/test_monitor_poll_cli_projection.py tests/control_plane/test_quota_monitor_poll_runtime.py (11 passed)
• ruff check loopx/cli_commands/quota.py tests/control_plane/test_split_root_todo_writeback_fence.py
• loopx canary premerge --from-git-diff (17 selected checks passed, no manual holds)
• git diff --check

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Core control-plane hardening

• Long-horizon benchmark evidence

• Operator surface and IM integration

• Shared Goal Authority and cross-host coordination

• Architecture and research incubator

• Target base branch: main

• Direction tracker or promotion unit: status/quota/monitor hardening

Boundary Checklist

• I did not commit .loopx/, .codex/goals/, live ACTIVE_GOAL_STATE.md, credentials, private benchmark traces, verifier output, raw agent sessions, internal document links, or local machine paths.
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

Future-facing pass: no adjacent refactor was needed; the owning quota CLI adapter already has the correct typed-exception extension point.

[huangruiteng]

动机

本 PR 修复的是一个窄但真实的公共边界缺口：quota monitor-poll --execute 在 promoted coordination authority 已经 fence 旧 writer 时，底层会正确拒绝写入且不产生副作用，但 CLI 的总异常边界把它压成了 quota_unexpected_collection_error / quota collection failed。调用方因此看不到已有的 legacy_coordination_writer_fenced、canonical-authority remediation 和 write_check，容易把预期的 authority 拒绝误诊为基础设施故障。最小修复就是在现有 quota failure renderer 中白名单这个既有 typed exception；不需要改变 fence 决策，也不应泛化为任意异常 payload 的透传。

改动思路

真实链路保持原样：handle_quota_command → record_quota_monitor_poll_for_cli → record_quota_monitor_poll_for_decision → require_legacy_coordination_write_allowed。TypeScript-owned fence 仍决定旧 writer 是否允许继续写；Python quota 层只负责把已有的 LegacyCoordinationWriterFenced.code/payload 渲染成公共 CLI envelope。未命中该精确类型的异常仍走原有 sanitized generic failure，避免泄露任意异常字段。

我用同一份 synthetic Goal/monitor fixture 分别跑了不可变 baseline 54681bccd5e5780dc03390488c5afcf217daf692 与当前 head。baseline 和 head 都 exit 1、state bytes 不变；差异仅在于 baseline 丢失 typed diagnostic，而 head 返回 legacy_coordination_writer_fenced、完整 remediation 与 nested write_check。这证明改动恢复的是可观测语义，不是放宽 authority 或改变副作用。

具体改动

• loopx/cli_commands/quota.py 增加对既有 LegacyCoordinationWriterFenced 的精确识别，保留 error.code、str(error) 和已定义的 error.payload。
• tests/control_plane/test_split_root_todo_writeback_fence.py 从真实 loopx.cli.main 入口执行 quota monitor-poll --execute，同时断言 exit code、typed fields、remediation、nested write check 和原状态字节不变。

关键代码讲解

1. loopx/cli_commands/quota.py:167 的 _quota_failure_payload 是公共失败 envelope 的唯一现有出口。本次只在 QuotaIdentityPreconditionError 旁增加一个 exact-type 分支；关键不变量是“可信 typed exception 才能展开 payload”，其他异常继续返回通用、脱敏的错误。
2. loopx/control_plane/quota/monitor_poll.py:596 的 record_quota_monitor_poll_for_decision 仍在 execute + concrete target 时先检查 writer fence，再进入 decision/provider writeback。fence 抛错发生在写入之前，所以外层新增渲染不会创建 Todo 变更或 poll receipt；恢复动作仍由 promoted canonical authority 的调用方负责。

对主干的风险

主要风险是为了一个诊断而扩大异常透传面。当前实现通过精确 isinstance 白名单约束住了这个风险，没有 duck-type 任意 .code/.payload，也没有改动 write admission、monitor scheduling、receipt 或 persisted schema。另一个证据边界是新增 CLI 回归用 deterministic typed fence-result seam 聚焦 envelope；同文件已有真实 TypeScript fence engagement/provider rejection 覆盖，因此没有把 mocked decision 当成 fence 正确性的唯一证明。

验证结果：split-root fence 文件 7 项全部通过；不可变 base/head public-entrypoint 对照复现了 generic → typed diagnostic 的唯一预期变化；Ruff 与 git diff --check 通过；GitHub 当前 17 项检查成功，release/publish job 为预期 skip。没有发现 blocking finding。

我的整体评价

这是比例合适的 adapter-boundary 修复：11 行生产改动复用既有 exception 和 failure renderer，55 行测试覆盖了过去下层测试没有保护到的公共可观测结果。它保持 TypeScript 的 fence decision authority，不新增状态、协议或第二套规则；future-facing pass 也不需要为单个可信异常引入通用错误框架。批准 exact head 1897e143e5d78faa0acd75696245c240263f6871。

English verdict: APPROVE exact head 1897e143e5d78faa0acd75696245c240263f6871; the public monitor-poll CLI now preserves the existing typed fence rejection and remediation while retaining exit-1/no-write behavior, with base/head and focused regression evidence.