fix(peer): stop the hard-cut guard flagging ordinary runtime prose

[huangruiteng]

Problem

main's pre-merge gate is red for any diff that selects the peer-agent canary: examples/control_plane/peer-agent-runtime-v1-smoke.py runs examples/control_plane/peer-agent-hard-cut-boundary-smoke.py, which reports three legacy-hierarchy violations:

loopx/chat_manager.py:190: The runtime controller owns the runtime root and therefore the
loopx/chat_manager.py:217: controller owns, so the same owner that resolves the machine's steward
loopx/chat_runtime.py:398: # machine configuration this controller owns.

The guard's denylist contains the phrase controller owns, because that phrase described the retired controller-over-sub-agent model. These three lines use the same words for an unrelated subject: the runtime controller holding the runtime root and its machine-configuration store. The result is a false positive that fails the gate on clean main, blocking self-merge for anyone whose diff selects that canary.

What changed

The prose says the same thing without the flagged phrase:

• the controller holds the runtime root, so there is no ambiguity about who owns the root;
• the credential scope is the runtime root this controller resolves;
• the steward channel reads this controller's machine configuration.

No code path, behavior, contract or default changes, and the guard keeps its full strictness — it is not narrowed, exempted or allowlisted, so a real resurgence of the legacy phrase still fails.

Validation

• examples/control_plane/peer-agent-hard-cut-boundary-smoke.py: ok (was the failing check).
• examples/control_plane/peer-agent-runtime-v1-smoke.py: ok, which also runs the continuation-state-machine, task-orchestration and quota-spend-workspace smokes.
• tests/test_chat_manager_context.py, tests/capabilities/test_steward_executor_machine_defaults.py: 25 passed.
• loopx canary premerge --from-git-diff: merge_gate_passed=true, self_merge_allowed=true, failures 0.

Boundaries

Comment and docstring text only. The value is that the baseline red stops blocking other lanes' self-merge, and the fix is in the prose rather than in the check.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

一、变更内容

• loopx/chat_manager.py：两处散文措辞改为不触发 peer hard-cut 守卫的表述——控制器"holds"runtime root；凭据范围是"this controller resolves"的 runtime root。
• loopx/chat_runtime.py：注释改为"this controller's machine configuration"。
• 仅此三处文本，共 5 行改动；无代码、无行为、无契约、无默认值变化。

二、依据与一致性

• 守卫 examples/control_plane/peer-agent-hard-cut-boundary-smoke.py 的 denylist 里有 controller owns，它原本用于描述已被淘汰的"controller 拥有 sub-agent"层级。这三行讲的是 runtime controller 持有 runtime root 与 machine-configuration store，属于同词不同义，因此是误报。
• 修的是散文而不是检查：没有放宽正则、没有加白名单、没有跳过差异，守卫的严格性原样保留（真出现该措辞仍会失败）。这符合仓库"不要靠放宽门禁解决 self-repair"的要求。
• 影响面明确：这是 main 上的既有红，会阻断任何选中该 canary 的 diff 的自合并；修它不改变任何产品语义。

三、验证

• examples/control_plane/peer-agent-hard-cut-boundary-smoke.py：ok（原失败项）。
• examples/control_plane/peer-agent-runtime-v1-smoke.py：ok（并连带运行 continuation-state-machine、task-orchestration、quota-spend-workspace 三条 smoke）。
• tests/test_chat_manager_context.py、tests/capabilities/test_steward_executor_machine_defaults.py：25 passed。
• loopx canary premerge --from-git-diff：merge_gate_passed=true、self_merge_allowed=true、failures 0（此前该 canary 是硬失败）。

四、风险与残余缺口

• 风险极低：纯文本，且已验证两条 smoke 与两条测试。
• 仍未做：peer_agent_directory_v0 的实现侧接线（目录产出、provider 注册、前端呈现）——本次只清掉阻塞门禁的红。

五、结论

批准以 admin squash 合并（self_merge_allowed=true）。它移除的是 main 上的既有门禁红，使其它 lane 的 diff 不再被无关失败阻断；修在散文而非检查，因此没有降低守卫强度。

English verdict: Approved for an admin squash merge. The peer hard-cut guard was failing on clean main because the denylist phrase controller owns matched three lines of ordinary prose about the runtime controller holding the runtime root and its machine-configuration store. The prose is reworded, the guard keeps its full strictness, the previously failing canary and the peer-agent-runtime smoke both pass, 25 focused tests pass, and the canary premerge gate is now green.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

问题是真的：examples/control_plane/peer-agent-runtime-v1-smoke.py 会跑 peer-agent-hard-cut-boundary-smoke.py，只要某个 diff 选中 peer-agent canary，pre-merge gate 就会红。我在父提交上复现了三条违规，和 PR 正文列的一模一样：

loopx/chat_manager.py:190: The runtime controller owns the runtime root and therefore the
loopx/chat_manager.py:217: controller owns, so the same owner that resolves the machine's steward
loopx/chat_runtime.py:398: # machine configuration this controller owns.

这三条都是文档句子，讲的是 controller 持有 runtime 目录，不是层级声明。一个恒红的 canary gate 的代价不只是挡住一个 diff：它会让人开始习惯性绕过 gate，这比改词更糟。

改动思路

选的是最小且不动守卫的做法：只改这两处被扫到的散文，不碰 smoke 的模式、扫描集合与 allowlist。对一个边界守卫来说，这比"为了让 gate 变绿而放宽模式"更可接受——守卫的严格度没有任何损失。

措辞改法也算克制：owns → holds / resolves / 所有格，句子描述的事实（controller 解析出的 runtime root 决定哪份 machine-config 是权威、没有该 owner 的调用方回退到未读取环境）没有改变。我验证了这一点是可证而非"看起来"：把两个模块在 optimize=2（剥掉 docstring）下编译，序列化后的 bytecode 与父提交完全相同，所以这次改动连一条可执行语句都没动。

具体改动

loopx/chat_manager.py（两处 docstring）与 loopx/chat_runtime.py（一处注释）共 5 行改写。验证：父提交 smoke 失败（三条违规），本 head peer-agent-hard-cut-boundary-smoke ok，整条 peer-agent-runtime-v1-smoke 链（migration / quota-spend workspace causality / continuation state machine / task orchestration / runtime v1）全绿；git diff --check 干净。

一个 P3（非阻塞，已记入 findings）：这次的根因是"散文级子串黑名单"。守卫按行扫描 .py/.md/.json/.html/.ts/.tsx/.mjs，其中一个 token 是裸的 controller owns——它不知道被"拥有"的是什么，所以命中了讲目录的句子；修法是改文档而不是改规则，于是这个假阳性类别会留下：下一个人在被扫描文件里写"controller owns a workspace / a lock / a directory"，还会再红一次、再付一次改词成本。仓库自身对状态分类规则的要求正是"优先类型化规则而非子串黑名单"，守卫也已有 ALLOWED_LEGACY_PATHS 这种可承载"带理由的类型化例外"的机制。一个很小的后续（要求 owns 的宾语是 agent/sub-agent，或把该假阳性记成有理由的例外）就能消掉这一类。不阻塞：本 PR 正确、可回滚，守卫严格度不变。

对主干的风险

极低：两文件 5 行注释/docstring，剥掉 docstring 后 bytecode 相同，说明不存在分支、默认值或调用变化；守卫模式、扫描集合、allowlist 全部未动，也没有为了让 gate 变绿而加例外或跳过检查。风险面只有"以后还会遇到同类假阳性"这一项，已作为 P3 记录。

我的整体评价

这是一次正确的止血：真实 red gate、最小改动、不动守卫、可证明无行为变化（bytecode 等价 + 两个方向的 gate 结果）。我也认可它选择"改词"而不是"放宽模式"，因为放宽一个边界守卫本该单独评审。

唯一值得跟进的是根因：让 controller owns 这类散文级 token 不再误伤普通文档，建议作为后续小改动处理（P3），不构成合并阻塞。

English verdict: APPROVE (exact head bc1b863)