fix(scheduler): preserve receipt-owned blocked retry deadlines

[loopx-agent]

When a blocked Run owns a five-minute retry, its canonical Todo can remain OPEN without resume_when. The retry overlay previously lost its original Turn/source before frontier projection; an unrelated nonblocking user-action notice could then make the scheduler recommend a 30-minute human wait. Preserve receipt provenance through the existing typed Todo frontier and show the original due time in compact scheduler packets. Waiting recommendations now respect that deadline and the existing owner cadence floor; execution still requires a fresh quota/claim/lease check.

The slice reuses quota_blocked_retry_v0, the typed retry validator and the existing cadence owner. It adds no timer or canonical Todo state, keeps real human gates and scope fencing, and lets the temporary overlay disappear at/after due or when newer work supersedes it. CLI and managed heartbeat packets share this backend projection. Packaged Dashboard/live Lark rendering, deployment and receiver adoption remain separate acceptance stages; this PR does not claim those outcomes. It is independent of #6178's monitor closeout path.

Validation: 143 TypeScript tests, control-plane typecheck, focused Ruff, and the premerge gate passed (5 direct checks and 19 selected checks, including maintainability, semantic vocabulary, native heartbeat and public boundary). The expanded Python run passed 425 tests and retained one legacy terminal-closeout wall-clock assertion failure: timestamps straddled a second. An unchanged-baseline reproduction and targeted result are documented in the review. Earlier candidate null-summary and maintainability failures were fixed before final checks. Real File/SQLite CLI coverage checks canonical Todo preservation, original retry binding and no extra spend; composition covers exact/late due, newer runs, cross-scope rejection, a genuine gate, owner floor and managed Goal-runtime continuation.

[loopx-agent]

Reviewer: model_agent; runtime_reported; model=gpt-6.1-sol; provider=OpenAI; reasoning_effort=xhigh.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

当前head c5decf8 未发现阻塞本改动的缺陷。保留一个独立基线时间戳失败与部署/展示采用缺口；此结论不授予合并权限。

动机

CLI/heartbeat 调用者遇到未到期的阻塞重试，同时有独立人工提醒：此前可能显示人工门禁并建议等待30分钟，超过原5分钟重试时点。 现在包内保留原Turn、来源和到期时点，等待建议受原时点与角色下限共同约束；到期后重新准入。 不改canonical Todo、原时钟、claim/lease或执行权限。本PR交付CLI/managed heartbeat同源后端投影与调度建议；App/Lark真实展示、部署和研究者采用仍待独立验收。

改动思路

重试属于既有Run，deadline属于typed Todo frontier，cadence floor属于既有typed scheduler；投影层无需复制计时器或状态authority。 本PR交付CLI/managed heartbeat同源后端投影与调度建议；App/Lark真实展示、部署和研究者采用仍待独立验收。 保持Run中的原五分钟重试，只把有界来源穿过原有压缩链路。仅加显示字段会留下错误退避；新定时器或手写Todo等待会复制状态，因此当前方案采用原owner的投影修复。scheduler推荐属于唤醒策略，must_attempt/delivery标志仍是机器执行约束。小helper使原build不再继续膨胀，维护性ratchet未放宽。无retry时沿原路，真用户门禁仍拒绝执行。

具体改动

规范依据：docs/reference/protocols/quota-blocked-causal-closeout-v0.md，修订 96829240c17cdc05c1062d9dac1970a5138e69f5，按改动前的已接受契约评判。exact-identity：保留原Goal/Agent/Todo/Turn，跨主体与foreign claim不覆盖。no-debit：等待不提供交付或扣额许可，File/SQLite原生回执验证。unfinished-todo：原OPEN、无canonical resume_when与验收器保持。retry-compatibility：原到期/更新Run规则继续生效；到期建议仍受角色下限限制。

关键代码讲解

overlay_active_turn_retries从原Run提取Turn/source/due，只给匹配的未完成Todo添加选择投影；不写原任务。projectTodoFrontierDeadline复用已有isBoundedBlockedRetry，核agent、Todo、resume和时点后在完整lane选最早期限，显示压缩在其后。三个compact codec保留blocked_retry，避免半途丢来源。

build_execution_obligation只在较强门禁处理后，且user lane完整、全部为独立提醒时解释为blocked_wait；build_interaction_contract携带wait与non_gating_notice，scheduler arbitration才选择quiet_wait。_receipt_retry_wait_profile按剩余原时点收紧建议，再交现有typed cadence floor；App与Goal-runtime共享这条结果。薄包pending_retry明示execution_authority_granted=false，原协议增加对应中英说明。原生CLI测试覆盖消费与不修改authority，新增composition测试覆盖到期边界、更新Run、真门禁、floor和scope。

对主干的风险

共享scheduler最大的风险是把真门禁误当提醒或让deadline越过角色下限。测试表明真实final gate继续human_gate/no delivery，六分钟下限不因三分钟剩余retry被绕过，canonical依赖等待与foreign scope不覆盖；exact/late与更新Run会移除旧投影。此前候选空User摘要触发旧入口失败，已补空值边界；build增长失败已通过局部helper恢复，未删断言或调高预算。

expanded Python为425通过/1失败，143 TS通过，typecheck/Ruff及5 direct+19 selected canary通过。唯一失败是legacy终局完成时间戳相等断言：不可变基线与当前head自然运行均跨秒失败，额外1.1秒probe亦重现；该终局timestamp路径与断言未被PR改变。保留红检查及其独立恢复责任，不宣称full-suite PASS，不查远端CI，也不把它当候选已修。synthetic composition不证明实际App/Lark渲染、默认部署或研究者采用，PostgreSQL未验。

语义与 CI 对齐

复用已有quota_blocked_retry_v0、typed frontier与scheduler disposition。语义advisory两个codec字段提示已逐项审查，属于既有payload投影扩展；full-tree vocabulary canary通过，不新建canonical状态或CLI。变化是原等待来源和原到期再检查的解释；域中立文本明确当前门禁、角色下限和无执行授权，未把普通提醒升级为依赖。

我的整体评价

这是justified_increment：CLI/heartbeat的实际链路交付完整有界结果，long_horizon与user_experience均改善；没有用登记、配置或测试数量冒充整个Finance业务结案。保留原持久回执兼容而不引入新版本分支，生产增量与证明范围相称。最强剩余缺口是默认部署和真实receiver/UI/Lark采用；独立legacy红检查还可能阻挡合并准备。维护者可先评审该Core候选，再按现有阶段验收上线，不以其等待冻结其它独立业务。

English verdict: APPROVE - c5decf8; receipt-owned retry provenance and deadline-aware wait projection preserve current gates, owner floor and no-spend semantics. Native File/SQLite, TS/typecheck/Ruff and risk canary evidence cover the changed invariant; an independently reproduced baseline legacy timestamp failure remains a separate hold. Backend candidate only; deployment and UI/Lark adoption unverified.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[loopx-agent]

Reviewer: model_agent; runtime_reported; model=gpt-6.1-sol; provider=OpenAI; reasoning_effort=xhigh.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Post-merge exact-head audit; COMMENTED is not formal GitHub approval.

The owner huangruiteng merged at 2026-10-11T07:52:11Z as be15bf4 while fresh tests ran. This review is published afterward and does not attest a pre-merge approval or readiness check.

动机

CLI/heartbeat 调用者在等待一次有界重试时，还可能收到独立人工提醒。CLI/heartbeat 调用者遇到未到期的阻塞重试，同时有独立人工提醒：此前可能显示人工门禁并建议等待30分钟，超过原5分钟重试时点。 现在包内保留原Turn、来源和到期时点，等待建议受原时点与角色下限共同约束；到期后重新准入。 不改canonical Todo、原时钟、claim/lease或执行权限。 本PR交付CLI/managed heartbeat同源后端投影与调度建议；App/Lark真实展示、部署和研究者采用仍待独立验收。

这次重新审查完整新head 861fa56，基线为8d5a6fc170422ff4ff78818898b172064b1e1591；没有继承旧head的批准。最新main已有“Monitor观察不可取得”协议，本次解决文档冲突并同时保留它与原回执重试说明。不可取得的观察只结束原尝试；不能被投影为五分钟重试。相同冻结输入在当前基线仍显示30分钟人工等待，新head显示剩余3分钟重新检查，角色下限为6分钟时保持6分钟。

改动思路

原Run保存重试事实，typed Todo frontier选择原期限，已有scheduler拥有角色下限；投影无需第二套计时器或canonical状态。只补字段会继续保留错误退避，另造定时器会复制权威，因此保留当前共享owner的连贯修复。没有合格retry时沿原路径；真实门禁、原claim/lease继续约束执行。

重试属于既有Run，deadline属于typed Todo frontier，cadence floor属于既有typed scheduler；投影层无需复制计时器或状态authority。 本PR交付CLI/managed heartbeat同源后端投影与调度建议；App/Lark真实展示、部署和研究者采用仍待独立验收。 未来演化检查保留原局部helper：等待建议与可执行性分开，前者不能授予后者。新增Monitor负例复用现有真实CLI测试，没有引入新框架、开关、状态或业务规则。

具体改动

规范依据：docs/reference/protocols/quota-blocked-causal-closeout-v0.md；spec_revision 8d5a6fc。按改动前契约逐项评判：exact-identity保持原Goal/Agent/Todo/Turn及外来主体拒绝；no-debit保持等待零扣额；unfinished-todo保持原任务和验收器；retry-compatibility保持原期限与更新Run替代；monitor-no-retry保留不可观察Monitor原时钟、hash与generation且不生成重试。这些条目由真实File/SQLite与当前base/head反例验证。

关键代码讲解

overlay_active_turn_retries只为本角色匹配的OPEN advancement且无canonical wait/foreign claim提取原Run的Turn/source/due。active_turn_retry_for_run先限定advancement retry schema，Monitor unavailable与因果wait都不能借共享receipt槽进入这条路径。

projectTodoFrontierDeadline在完整lane压缩前选最早期限，核身份、resume、due和typed validator；三个compact codec保留来源。build_execution_obligation只在较强门禁已处理且完整user lane都是独立提醒时改成blocked_wait，build_interaction_contract传递wait/non_gating_notice，scheduler才选择quiet wait。

_receipt_retry_wait_profile根据原到期时点收紧建议，再交已有typed cadence floor。薄包pending_retry明确execution_authority_granted=false。全PR为10个生产文件、3个测试文件、1个文档，298新增/8删除；这轮相对旧head只合入main、保留协议两节，并加3行Monitor恢复后无pending_retry断言。

对主干的风险

主要风险是把真实门禁或不可观察Monitor误当有界retry。当前head真实File/SQLite路径覆盖观察不可取得、能力恢复、已poll拒绝、旧effect重放、独立下一任务以及无额外扣额；新的断言保证不可观察Monitor没有pending_retry。合成composition覆盖真实门禁、跨scope/claim、canonical wait、exact/late、新Run替代与6分钟下限。当前base/head使用同一冻结fixture，基线30分钟等待的缺陷仍在，新head修复且到期/更新Run合法分支保持。

新head原生子集125 passed in 255.71s。实际合并提交14个PR路径一致，完整tree另含24个main文件；合并提交原生子集 125 passed in 391.45s。先行组合24项通过，134 TS通过，typecheck/Ruff通过，5 direct + 19 selected canary通过。旧head的425通过/1个legacy时间戳失败保留为历史证据；当前main #6195已将冻结时钟patch指向实际legacy owner，本PR没有通过删除断言或调高预算消除失败。当前完整native子集独立重跑，不能用旧结果代替。按Goal配置不查询、轮询或等待远端CI。

语义与 CI 对齐

复用quota_blocked_retry_v0、typed frontier与scheduler disposition；Monitor schema仍只供原结算owner核验。共享slot不等于共享重试语义。当前diff advisory与完整vocabulary/risk canary重新运行，codec字段是已有payload投影，没有新canonical词汇。投影改变等待来源和再检查时点的解释，未改变门禁或角色下限。App/Lark打包展示、默认安装、receiver采用与PostgreSQL尚未验，不以这些后端测试宣称全产品资格或投研效用。

我的整体评价

本轮根据新head证据重新判断为justified_increment，long_horizon与user_experience改善：原有等待能按原期限接续，独立提醒不再误延迟，同时保留必要准入。重试属于既有Run，deadline属于typed Todo frontier，cadence floor属于既有typed scheduler；投影层无需复制计时器或状态authority。 本PR交付CLI/managed heartbeat同源后端投影与调度建议；App/Lark真实展示、部署和研究者采用仍待独立验收。 没有扩大原问题或复制权威，冲突修复与组合负例可独立审查、回滚。最强剩余缺口仍是默认部署和实际receiver/UI/Lark采用；当前意见只评审后端候选，本人的外部合并已实际发生；此次后审不补写成合并前批准或本角色自行合并。

English verdict: APPROVE - 861fa56; post-merge audit of the owner merge be15bf4; both unavailable-Monitor and receipt-owned advancement-retry protocols are preserved. Fresh File/SQLite, current-base/head counterfactuals, typed tests/typecheck/Ruff and risk canary cover the combined boundary. Deployment, UI/Lark and receiver adoption remain unverified; approval grants no protected merge authority.