fix(quota): recover host turns from exact Todo lifecycle reads

[huangruiteng]

Summary

A prior must-attempt heartbeat can remain in unsettled_host_turn_recovery after its Todo has successfully transitioned to blocked. Recovery searched compact agent_todo_summary display lanes; six unrelated rows are enough to hide the accepted lifecycle evidence and prevent same-Turn continuation.

Resolve the receipt-bound Todo through the existing exact-ID list_goal_todos read path with the same registry, runtime and Goal. Keep closeout eligibility, provider failure handling, settlement identity and no-spend recovery unchanged. No new store, protocol field or RPC is introduced.

修复已写入 Todo 生命周期状态却持续进入心跳恢复的问题：按回执绑定的准确 Todo ID 读取现有权威来源，避免展示列表截断影响恢复判断，保留关闭条件、身份校验和恢复不扣额度的规则。

Issue Or Task

• Regression in the recovery lookup introduced by fix(heartbeat): recover unsettled host turns #4302.
• Related but separate: fix(quota): isolate recovery from current replan #4329 isolates replan receipt identity; fix(quota): preserve explicit Todo selection gates and retry #4332 and fix(quota): preserve action and monitor receipt identities #4335 handle unbound explicit-selection diagnostics. Those changes do not repair this lifecycle lookup.
• Task: exact Todo lifecycle evidence for prior-host-Turn recovery.

Validation

• Tested revision: eef8f6ca555a42bed962716f3aa5185e430d3ce4.
• Run state: finished.
• Input classes: synthetic, public_fixture, authorized_private_read_only.

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	On baseline ddf6efa89, the small legacy CLI inventory passes and the same lifecycle closeout with six unrelated rows remains in recovery. The repaired candidate continues with the existing current Turn. The relevant recovery source is unchanged in rebase base 18fa81bc0.
real_entrypoint	passed	Six legacy/File/SQLite CLI cases cover guard, missing closeout, real Todo update, repeated same-Turn guard and independent successor selection.
real_backend	passed	Disposable File and SQLite authority stores run the CLI recovery cases. An isolated PostgreSQL 16 server passes all 88 authority integration/conformance tests, with no skips; this is provider coverage, not a PostgreSQL host-Turn end-to-end claim.
integration	passed	68 tests: full quota settlement CLI, live managed-Turn decision and heartbeat receipt suites on the final head, including no-spend continuation.
integration	failed	Exact-head canary premerge --from-git-diff: four direct checks and 17 of 18 selected checks pass. quota-plan-smoke.py fails in the unchanged capability-memory path; the same failure reproduces on baseline. No skips or warnings.
manual	passed	Authorized read-only evaluation confirms an existing blocked Todo is recognized by the repaired recovery predicate. No live Goal, Todo, lease, writer fence, session or receipt was mutated for validation.
static	passed	Ruff, compile, diff hygiene and public/private boundary checks.

Coverage and gaps: exact source lookup and both CLI/managed callers are covered; provider selection is reused, not reimplemented. The existing quota-plan baseline failure remains a disclosed hold. No model or benchmark jobs were launched. Hosted CI will report on this exact PR head.

Frontend / Visual Evidence

UI impact: none. CLI and managed Turn consume the same live decision. No setting or frontend component changes; Lark/frontend retain their existing shared interaction projection. Tests verify state readback and successor selection. Screenshots are not applicable.

Technical Direction

• Core control-plane hardening; base: main.
• Runtime fix and focused validation are one commit; self-repair/RFC documentation is a second commit.
• Future-facing pass: reuse the exact-ID Todo reader and remove presentation-list lookup. The bilingual TypeScript RFC records the complete prior-Turn recovery transaction as a follow-up; no leaf bridge or completed Stage 2B cutover is claimed.

Shared-authority RFC fixture impact

No provider migration or authority promotion is claimed. File/SQLite recovery conformance and the isolated PostgreSQL suite validate the existing read boundary; production schema, writer routing and permissions are unchanged.

Boundary Checklist

• Public-safe diff and summary; private incident details and local evidence excluded.
• No benchmark runs, private fixtures, credentials or local paths committed.
• Explicit path staging and DCO sign-off on both commits.
• UI impact verified as none.
• Runtime change remains subject to PR review; no merge or deployment performed.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

reviewed exact head: 4342@d5f2fb6c2712a24a5b0b3f35eca521fdbcd888d0

动机

这个 PR 修复的是一个真实的 host-Turn recovery 卡死边界：上一轮 must-attempt heartbeat 已经把回执绑定的 Todo 推进到 blocked/done/deferred，但 recovery 仍从紧凑的 agent_todo_summary 展示 lane 查找它。展示 lane 可能因无关 Todo 数量、分页或终态过滤而省略该行，于是“缺少 closeout receipt”被错误地持续判定，普通独立工作也被阻断。旧路径的根因不是状态写入失败，而是把不完整的投影当成生命周期事实。当前 head 通过已有的精确 todo_id 读路径重新读取同一个 Goal 的权威 Todo 状态；合法生命周期迁移随后关闭 recovery，未绑定或不完整证据仍保守地保持 recovery。Refine commit d5f2fb6c 增加了专门的 compact-summary omission 回归测试，并在 base 上验证该场景确实失败。

改动思路

入口仍是 build_live_quota_should_run_decision，没有新增 store、RPC、协议字段或第二套生命周期模型。live_decision.py 将已经拥有的 registry_path 传给 apply_unsettled_host_turn_recovery_if_required；recovery 模块只在存在 prior closeout-required receipt 和绑定 Todo 时调用 list_goal_todos(..., todo_id=...)。因此职责边界清晰：Todo 模块负责解析 registry、canonical/file authority、精确过滤和失败关闭，quota 模块负责 receipt、结算和是否抢占普通选择。若精确读取到唯一的 done、blocked、deferred，或 open + resume_when + successor_todo_ids，则按已有 typed closeout 规则释放 recovery；成功结算、provider failure、replan identity、no-spend recovery 和 successor 选择规则没有被重写。这个设计也胜过提高展示列表上限或复制终态行，因为后两者仍无法证明 bounded view 之外不存在生命周期事实。

具体改动

关键代码讲解

• loopx/control_plane/quota/unsettled_host_turn.py:22 的 _typed_lifecycle_closeout 删除 _todo_item_by_id 展示查找，改用同一 registry_path、runtime_root、goal_id 的 list_goal_todos 精确读取；只接受显式状态/关系，缺失或不唯一时返回未关闭。
• loopx/control_plane/quota/unsettled_host_turn.py:58 的 _unsettled_host_turn_recovery 仅增加 authority 参数 threading，原有 settlement receipt 优先级、缺失 receipt 诊断、typed_host_observation_only 和 no_spend_for_recovery_transition 保持不变。
• loopx/control_plane/quota/live_decision.py:500 在现有 recovery preemption hook 传入 registry，普通选择路径仍由原 selector 处理。
• tests/control_plane/test_effect_turn_live_quota_decision.py:276 的 refine 回归构造了一个被 compact payload 隐藏的 blocked bound Todo 和一个可继续的无关 Todo；head 选择无关 Todo，base counterfactual 仍触发断言失败。
• tests/control_plane/test_quota_settlement_cli.py 的 Legacy/File/SQLite 参数化覆盖了 0/6 个隐藏行、真实 Todo update、恢复重入和 no-spend parity；双语 RFC 与 self-repair pattern 记录了展示投影不能证明生命周期缺失的边界。

对主干的风险

没有发现阻塞性问题。主要风险是精确 registry/state 读取本身不可用、缺失或出现歧义时，系统会继续保守地停在 recovery；这是安全的 fail-closed 行为，恢复/结算 owner 仍是原路径。该改动每次仅针对已有 prior receipt 的绑定 Todo 做只读 cold-path 查询，不引入写入、额度消费、lease/writer-fence 或 actor authority。状态分类使用显式 Todo status 和 successor/resume 字段，没有 substring denylist 或 prose heuristic；协议名仍是 host-Turn recovery/typed observation，没有扩张为 peer 或 durable multi-agent lifecycle。它不是 opt-in capability，普通无 prior-receipt 路径保持默认行为。当前 exact head 的 GitHub checks 全部成功（deploy/presentation 为不适用的 skipped）；本地 ruff、diff hygiene、focused managed test、CLI provider cases 和 base/head counterfactual 均通过。PR 中已披露的 quota-plan-smoke.py baseline canary failure 在主干同样复现，属于未被本改动引入的残余风险。

我的整体评价

我对完整 base-to-head diff 和 refine 后的精确 head 做了独立复核：7 个文件、+259/-21，其中生产改动集中在一个既有 quota 边界，测试覆盖真实 live decision/CLI 入口，文档补足公共契约。关键不变量是“incomplete presentation is not proof of absence”；它在旧 base 上失败，在当前 head 上通过，并保持合法 closeout、失败关闭与 no-spend 语义。代码量与问题影响、恢复代价和现有 owner 相称，没有需要另拆的 speculative abstraction。结论为 APPROVE；由于 PR 作者与当前 GitHub 身份相同，下面以公开 COMMENTED approval conclusion 记录同等 verdict，随后按 exact-head merge readiness 执行合并。

English verdict: APPROVE — reviewed exact head 4342@d5f2fb6c2712a24a5b0b3f35eca521fdbcd888d0. The patch correctly replaces compact presentation lookup with the existing exact-ID list_goal_todos authority read, so a bound Todo hidden from a compact lane can no longer strand host-Turn recovery. The refine regression fails on base and passes on head; focused managed decision tests, Legacy/File/SQLite CLI cases, ruff/diff checks, and all current hosted checks pass. No blocking finding; the disclosed quota-plan baseline canary failure remains unrelated and is retained as residual risk.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

reviewed exact head: 4342@b4f37ace900da977dd11bfc9bc95b500db2b2563

动机

这个 PR 修复的是一个真实的 host-Turn recovery 卡死边界：上一轮 must-attempt heartbeat 已经把回执绑定的 Todo 推进到 blocked/done/deferred，但 recovery 仍从紧凑的 agent_todo_summary 展示 lane 查找它。展示 lane 可能因无关 Todo 数量、分页或终态过滤而省略该行，于是“缺少 closeout receipt”被错误地持续判定，普通独立工作也被阻断。旧路径的根因不是状态写入失败，而是把不完整的投影当成生命周期事实。当前 head 通过已有的精确 todo_id 读路径重新读取同一个 Goal 的权威 Todo 状态；合法生命周期迁移随后关闭 recovery，未绑定或不完整证据仍保守地保持 recovery。Refine commit b4f37ace 增加了专门的 compact-summary omission 回归测试，并在最新主干 base 上验证该场景确实失败。

改动思路

入口仍是 build_live_quota_should_run_decision，没有新增 store、RPC、协议字段或第二套生命周期模型。live_decision.py 将已经拥有的 registry_path 传给 apply_unsettled_host_turn_recovery_if_required；recovery 模块只在存在 prior closeout-required receipt 和绑定 Todo 时调用 list_goal_todos(..., todo_id=...)。因此职责边界清晰：Todo 模块负责解析 registry、canonical/file authority、精确过滤和失败关闭，quota 模块负责 receipt、结算和是否抢占普通选择。若精确读取到唯一的 done、blocked、deferred，或 open + resume_when + successor_todo_ids，则按已有 typed closeout 规则释放 recovery；成功结算、provider failure、replan identity、no-spend recovery 和 successor 选择规则没有被重写。这个设计也胜过提高展示列表上限或复制终态行，因为后两者仍无法证明 bounded view 之外不存在生命周期事实。

具体改动

关键代码讲解

• loopx/control_plane/quota/unsettled_host_turn.py:22 的 _typed_lifecycle_closeout 删除 _todo_item_by_id 展示查找，改用同一 registry_path、runtime_root、goal_id 的 list_goal_todos 精确读取；只接受显式状态/关系，缺失或不唯一时返回未关闭。
• loopx/control_plane/quota/unsettled_host_turn.py:58 的 _unsettled_host_turn_recovery 仅增加 authority 参数 threading，原有 settlement receipt 优先级、缺失 receipt 诊断、typed_host_observation_only 和 no_spend_for_recovery_transition 保持不变。
• loopx/control_plane/quota/live_decision.py:500 在现有 recovery preemption hook 传入 registry，普通选择路径仍由原 selector 处理。
• tests/control_plane/test_effect_turn_live_quota_decision.py:276 的 refine 回归构造了一个被 compact payload 隐藏的 blocked bound Todo 和一个可继续的无关 Todo；head 选择无关 Todo，base counterfactual 仍触发断言失败。
• tests/control_plane/test_quota_settlement_cli.py 的 Legacy/File/SQLite 参数化覆盖了 0/6 个隐藏行、真实 Todo update、恢复重入和 no-spend parity；双语 RFC 与 self-repair pattern 记录了展示投影不能证明生命周期缺失的边界。

对主干的风险

没有发现阻塞性问题。主要风险是精确 registry/state 读取本身不可用、缺失或出现歧义时，系统会继续保守地停在 recovery；这是安全的 fail-closed 行为，恢复/结算 owner 仍是原路径。该改动每次仅针对已有 prior receipt 的绑定 Todo 做只读 cold-path 查询，不引入写入、额度消费、lease/writer-fence 或 actor authority。状态分类使用显式 Todo status 和 successor/resume 字段，没有 substring denylist 或 prose heuristic；协议名仍是 host-Turn recovery/typed observation，没有扩张为 peer 或 durable multi-agent lifecycle。它不是 opt-in capability，普通无 prior-receipt 路径保持默认行为。当前 exact head 的 GitHub required checks 全部成功（deploy/presentation 为不适用的 skipped；Sonar 为 non-blocking）；本地 ruff、diff hygiene、focused managed test、CLI provider cases 和最新 base/head counterfactual 均通过。PR 中已披露的 quota-plan-smoke.py baseline canary failure 在主干同样复现，属于未被本改动引入的残余风险。

我的整体评价

我对完整 base-to-head diff 和 refine 后的精确 head 做了独立复核：7 个文件、+259/-21，其中生产改动集中在一个既有 quota 边界，测试覆盖真实 live decision/CLI 入口，文档补足公共契约。最新主干 rebase 只更新基线，不改变 PR 的行为范围。关键不变量是“incomplete presentation is not proof of absence”；它在最新 base 上失败，在当前 head 上通过，并保持合法 closeout、失败关闭与 no-spend 语义。代码量与问题影响、恢复代价和现有 owner 相称，没有需要另拆的 speculative abstraction。结论为 APPROVE；由于 PR 作者与当前 GitHub 身份相同，下面以公开 COMMENTED approval conclusion 记录同等 verdict，随后按 exact-head merge readiness 执行合并。

English verdict: APPROVE — reviewed exact head 4342@b4f37ace900da977dd11bfc9bc95b500db2b2563. The patch correctly replaces compact presentation lookup with the existing exact-ID list_goal_todos authority read, so a bound Todo hidden from a compact lane can no longer strand host-Turn recovery. The refine regression fails on the rebased base and passes on head; focused managed decision tests, Legacy/File/SQLite CLI cases, ruff/diff checks, and all required new-head hosted checks pass. No blocking finding; the disclosed quota-plan baseline canary failure remains unrelated and is retained as residual risk.