fix(scheduler): keep automatic dated successor waits alive

[loopx-agent]

Goal And Delivered Outcome

An owned, automatically resumable resume_at successor could remain pending while the scheduler classified it as a reassignment wait. A generic CLI host then exited after three unchanged polls, potentially before the scheduled instant. The real CLI and external worker reproduce this on synthetic state.

Verified automatic dated waits now keep quiet scheduling alive, with backoff bounded by the remaining wait and existing host cadence floors. Ordinary reassignment/dependency waits retain their finite supervision. A fresh guard still owns due-time admission; explicit stop, pause, user gates, Turn settlement and budget enforcement retain precedence.

• Intended base: main.
• Observable result: the actual worker survives four pending checks without a model wake or quota debit, then exits on an explicit Goal stop. The due-time CLI restores the original successor through its existing resume contract.

Author Declaration

• Written by: model_agent — OpenAI Codex, GPT-6 family.
• Implemented against: existing automatic Vision-wait and interaction/scheduler contracts at 2ca6c2b2e5155e9c6414e52a112fbcbdff1def50; docs/quota-allocation.md and loopx/control_plane/goals/goal_vision_wait.py.

Criterion	Disposition	Owner / evidence
Preserve pending automatic dated successors without granting work	implemented	Shared TypeScript clock proof; real CLI + external worker, File/SQLite
Reopen only through the due-time guard; retain explicit stop	implemented	test_dated_vision_wait_cli.py
Invalid/foreign/bound waits and higher-priority gates retain supervision	implemented	Typed arbitration negative cases and existing scheduler regression matrix
Retain ordinary default behavior and wire boundaries	implemented	Transport boundary tests, generic worker tests and scheduler characterization

The existing typed interaction owner shares its exact clock proof with scheduler arbitration. An optional internal duration is transported by Python and projected through existing scheduler actions; there is no new public state vocabulary, capability, provider, host-side business classifier or extra arbitration RPC. The related refactor removes duplicate clock-proof policy within the touched owner.

Scope And Continuation

Complete within the automatic dated-wait scheduling fix. No new caller operation, authority-store refactor, provider promotion, experiment launch or scoring change. Installed long-running campaign adoption and research outcomes remain separate work; these bounded checks do not claim a multi-hour soak or live treatment effect.

Validation

• Tested revision: 71d748f6c99f26f73372fd503f3d33a08955cde5.
• Run state: finished; remote CI and independent exact-head review remain pending.
• Input classes: synthetic, public_fixture.

Check kind	Result	Evidence / limitation
regression_parity	passed	New positive typed assertion fails before the fix; synthetic real CLI + worker reproduces the previous three-poll exit. Ordinary disposition/negative cases retain their prior results.
real_entrypoint / real_backend	passed	Real source CLI, File/SQLite stores and actual generic worker loop: four pending checks, no model wake/debit, explicit stop; separate real due-time admission test. Host sleeps are injected, so this is not an elapsed-time soak.
real_entrypoint	passed	Normal frontend build and wheel; isolated installed CLI through the unmodified external worker --once entrypoint, persisted progression beyond three checks and explicit stop on File/SQLite. Installed changed runtime sources match the checkout byte for byte.
unit / integration	passed	55 focused checks and 288 worker/scheduler regressions on the pre-rebase candidate; 27 current-base CLI/transport checks and 71 typed checks pass.
static	passed	TypeScript typecheck, semantic advisory and full semantic smoke, diff hygiene and bilingual RFC check. No paired RFC changed.
regression_parity	passed	Standard uv run --extra test loopx canary premerge --from-git-diff --tier standard: direct checks, 10 catalog checks and 8 risk-profile checks.

Coverage includes the production quota producer and actual scheduler consumer, legal waiting/due/stop transitions, malformed/foreign/bound proof rejection, transport thresholds and ordinary default parity. PostgreSQL promotion/conformance and frontend interaction changes are out of scope; no provider/store implementation or visual layout changes. The initially absent generated Chat bundle was built normally before package validation; no packaging guard was bypassed.

Frontend / Visual Evidence

UI impact: none. Existing scheduler projections consume the corrected policy; no new frontend/Lark/CLI operation or presentation change. Screenshot and first-viewport review: not applicable.

Technical Direction And Boundary Checklist

Existing roadmap S7 scheduling and S3 continuation; this closes the reproduced dated-wait gap, not the entire sustained-host acceptance.

• Bug fix, public documentation and focused regression coverage; core control plane / host integration.
• Private state, raw trajectories, verifier output, credentials, internal links and local machine paths excluded.
• Independently reviewable scope; no duplicate benchmark implementation or authority-store migration.
• No paired RFC changes; bilingual check passes.
• UI impact none; no first-screen change.
• Every commit includes DCO sign-off.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

已安排自动恢复时间的 Agent 工作，需要让通用调度进程等到该时刻，并在停止或暂停时及时退出。

原调度把这类等待当成普通移交等待，连续三次状态不变就退出，可能永远到不了恢复时刻；现在只有带真实未到期时钟证明的单个本方 successor 保留安静重查，到期仍重新走原准入。

真实 CLI、原 worker 和 File/SQLite 验证表明，四轮等待不会唤起模型或扣额，随后显式停止会退出；到期用例仍恢复原 Todo 的既有生命周期动作。

不新增工作权限、额度、时间预算或 worker 业务分类，不证明多小时实际运行、生产安装或研究效果。

改动思路

复用既有 TypeScript 正向时钟证明，并把剩余秒数随已有 arbitration RPC 交给原调度提示归属；worker 只消费原契约，不再自行理解日期或另设一套等待策略。

当前切片是原自动定时 successor 的调度存活与停止优先级；完整主机长程运行和外部效果不在这次离线资格中。

保活不是工作准入。必须是本 Agent 或未认领的单个 pending successor，具有现有 runtime-clock 正向证明，且本 Turn 没有结算/选择绑定、用户门禁、工作义务或扣费权限。剩余秒数从原日期事实推导，不新增人工填写或持久化字段；其他等待继续原有限监督，fresh guard 仍决定到期、暂停、停止及新工作。

具体改动

完整十路径 +250/-15：四个生产路径、原 quota 文档及五个测试/fixture 路径，未改 worker、provider/store 或评分规则。独立依据是基线的quota allocation 契约和原 Vision-wait/resume-condition owner：dated-quiet-wait、due-resume-and-stop、bounded-other-waits 均有当前真实入口及反例，不用新增文档自行证明实现。

关键代码讲解

• pendingDatedSuccessor 提取原有正向时钟证明，供观察义务与 arbitration 共用；有绑定 Turn 时继续监督，非法/缺失证据不会自动放宽。
• projectSchedulerArbitration 先执行原结构/authority/disposition 规则，再判断准确 owner、单个 future wait 和无工作/门禁/扣费状态。只有该分支计算内部重查秒数，不制造新恢复时间或准入。
• SchedulerArbitration codec 在已有 fused RPC 中传输事实并严格解码正整数，bool、字符串、小数、零和负数均拒绝。自己的 File/SQLite 实际 CLI 探针确认该私有字段不出现在公共 JSON 中。
• 原 hint 分支 复用已有 action/builder，把 cadence progression 限于剩余等待并尊重主机 floor；只取消这一证明对应的 finite poll stop。前面的 Goal stop/quota pause 和后续 fresh due guard 保持原归属。

对主干的风险

主要风险是把宽泛的 scope wait 变成无限等待，或者保活覆盖停止/额度/结算。独立 55 项重点测试、48 项 TypeScript 和 288 项 worker/调度回归通过。相同新断言在不可变基线的真实 CLI+原 worker、File/SQLite 两侧都失败，明确观察到第三次 unchanged 后退出；当前则四轮安静等待、无模型唤醒/扣费，再按显式 stop 退出。到期仍是原 Todo 的 lifecycle action；自己的公共 wire、quota paused、Goal stopped 探针在两个后端均通过，原任务正文不变。

此次测试注入主机 sleep，证明实际消费者采用与状态顺序，不证明真实小时级运行。没有新增 frontend/Lark/CLI 操作或视觉流程，现有 hint 是实际消费者，源码 CLI 资格也不冒充我独立跑过安装后 campaign。配套配置/权限不增加用户准备或确认轮次。

语义与 CI 对齐

当前详细 standard premerge 六项直接和 19 项选中检查全部通过，root 类型检查通过；所有阈值与断言未改。完整有界运行集中还保留第一次 compact premerge 的单项 hot-path 失败，原 compact 输出未给内层原因，不能宣称它已被修复或已证明是历史问题。为判断当前风险，另在普通执行和真实 canary 隔离环境各跑了同负载 base/head：前者 quota/status 为 18636/22690 字符，后者 18804/22858，两侧全部指标一致且在原限额内；再结合真实改动路径的 wire/authority 反例与完整详细重跑，而非仅选最后一次 green。若初始问题复现，应保留详细内层证据继续归因；当前未观察到本改动造成的 payload 增长。未查询远端 CI。

我的整体评价

APPROVE，精确 head 71d748f6c99f26f73372fd503f3d33a08955cde5。此独立切片修复已复现的调度连续性问题，长期可续作与使用体验改善，普通等待与 authority 语义保留。抽取原正向证明、复用已有 transport/hint/worker 是相称的同域整理；没有新框架或版本分支。初次 canary 失败原因、安装后长期运行和真实效果仍保留为未验证边界，批准不授予合并、安装、额外执行或扣费权限。

English verdict: APPROVE — 71d748f. Real CLI/worker/File/SQLite comparisons prove the dated wait survives the old three-poll exit while due/stop/pause and no-work/no-spend boundaries remain intact. Independent 55 focused, 48 TS and 288 regressions pass; current detailed premerge and matched base/head budgets pass. The initial unexplained compact canary failure is retained, with no elapsed-soak, installed-campaign or merge-authority claim.