[loopx-agent]

Goal And Delivered Outcome

A same-Turn quota should-run after a successful autonomous replan writeback could expose completed validation and writeback in its ordered settlement plan. If the writeback covered the frontier, derived terminal stop could also hide the only remaining spend command.

The guard now exposes the verified original receipt's progress and remaining spend. A covered frontier can stop new work while that receipt settles. The next fresh Turn applies terminal stop, and retrying the original debit remains idempotent. The scope is the original Todo-less replan receipt; existing pause, authority and settlement checks still apply.

• Outcome basis: Receipt-backed settlement progress.
• Base: main at e251264bca5d003995ccc122b874341b4148b8f4. Related: fix(quota): require compute allowance for fresh replan admission #8576 (fresh replan compute allowance).

Author Declaration

• Written by: model_agent, OpenAI Codex.
• Implemented against the receipt contract above and docs/reference/protocols/turn-envelope-v0.md at the same base.

Criterion	Disposition	Evidence
Reuse the original verified settlement identity and its remaining action	implemented	quota/live_decision.py, work_items/interaction_contract.py; the full decision and TurnEnvelope expose the same spend step and command.
Apply terminal stop after the original pending replan has settled	implemented	quota/run_decision.ts; File/SQLite CLI regressions verify that the original debit succeeds once and the next fresh Turn stops.

Scope And Continuation

This fixes the receipt replay route and its CLI projection. Hosted checks, native Windows, independent review and the standard canary failure below remain merge holds. No installed runtime qualification is claimed.

Validation

• Tested revision: 1a1ebd5e46c1204ff925ba47211987e70fd291e0.
• Run state: finished for local checks. Inputs: public fixtures.

Check kind	Result	Evidence
regression_parity	passed	Six same-Turn cases failed on the exact base with missing settlement progress and pass on the patch. The successor and covered-frontier cases run on File and SQLite.
real_entrypoint	passed	tests/control_plane/test_replan_successor_guard_reentry.py: 36 passed. Includes premature spend refusal, identical original command and plan in the TurnEnvelope, one debit, and no successor execution in the original Turn.
integration	passed	97 related quota, pause, authority, terminal-ordering and replay checks passed; 229 focused TypeScript contract tests passed.
static	passed	TypeScript typecheck, Ruff, diff, bilingual RFC check and semantic inventory.
static	failed	Optional scoped mypy reports the same three diagnostics at unchanged call sites on the immutable base and candidate.
integration	failed	Standard premerge: six direct checks and 17 of 18 selected checks passed. The scoped operator-gate safe_bypass_allowed characterization assertion fails on both the exact base and this revision. It remains a required hold.
regression_parity	passed	The six settlement regressions also pass in a disposable composition with #8576 at 0024b2ae. Its two existing fresh-admission CLI cases fail with the same missing field with or without this patch on current main.
integration	not_run	Full hosted and native Windows results were pending at submission.

Frontend / Visual Evidence

• UI impact: none. The existing CLI contract omits completed steps; no frontend view changed.

Type of Change

• Bug fix
• Test update

LoopX Area

• Control plane (quota and settlement)

Technical Direction

• Core control-plane hardening, roadmap S7 receipt recovery.

Shared-authority RFC fixture impact

N/A. The same File/SQLite providers and receipts are exercised. No provider routing or promotion changed.

Boundary Checklist

• No private state, credentials, traces or local paths are included.
• Scoped to receipt recovery; no benchmark or unrelated product work.
• The bilingual RFC check passes; no paired RFC changed.
• UI impact is none.
• DCO sign-off is present.

[loopx-agent]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · max

本次评审对应提交 1a1ebd5e46c1204ff925ba47211987e70fd291e0。

动机 / Motivation

自治 replan 已写回覆盖证据的 frontier，但原 Turn 只完成了 writeback。宿主在回执中断后需要知道还欠哪一步。基线对同一 Turn 直接应用 terminal_no_followup，原身份仍在，但没有待执行的 spend 命令。当前提交先读回已验证的原始结算，只有原 quota_spend 可执行；不会重新准入，也不会重复 writeback。File 和 SQLite 的普通 CLI、TurnEnvelope、捕获 reader 和主干合并预演都核对原身份及同一条待执行命令。重复执行只扣一次，新 Turn 仍返回 terminal_no_followup。明确的 Goal Stop 仍保持 paused、不给执行入口；改写 replan obligation ID 的扣额请求在写入前被拒绝。已验证隔离 File／SQLite 的源码 CLI 与捕获读取。未做已安装运行时或 Windows 验收；现有 canary 失败继续保留为合并门。

改动思路 / Approach

沿用原始回执与现有结算 owner，按已验证欠账恢复下一步。原 Turn 只恢复尚欠的一次扣额。下一轮才应用派生的 terminal no-follow-up。 由 TypeScript 决定是否还有原结算；Python 只把经原回执确认的剩余命令投影到各入口。

具体改动 / Changes

关键代码讲解

六个文件，+90/−12。核对 remaining-original-step、derived-terminal-order 和 authority-and-idempotency。回执契约 路由比较。实际提交覆盖证据的 writeback 后，用同一 Turn 重新读取普通 CLI、TurnEnvelope 及摘要固定的原生捕获。验证三处返回同一 effect_id 与同一 quota_spend 命令，原计划的 validation 和 durable_writeback 都不再出现。实际执行两次，原回执只新增一次扣额。

对主干的风险 / Risks

同一身份仅恢复结算。File 和 SQLite 的明确 Stop 都不提供新执行路径；换一个 replan obligation ID 的请求被拒绝。无本次待结算回执的新 Turn 仍按派生终止，主干合并预演重复通过。

语义与 CI 对齐

104 项相关 Python、58 项路由、Ruff 和 TypeScript typecheck 通过。standard premerge 的 scoped operator gate 断言在基线与本提交都失败，触发路径没有原 replan 回执；保留独立合并门。未查托管 CI。

我的整体评价 / Verdict

未发现本次改动的阻塞问题。原结算、重复扣额与明确 Stop 的边界均经实际入口验证；现有 canary 失败仍是合并门。CLI 机器输出变化，无首屏变更。本轮读回完整 CLI、TurnEnvelope 与捕获数据。

English verdict: APPROVE. Approve the exact receipt-replay change. The existing unrelated scoped operator-gate canary failure remains a merge hold.