refactor(cli): extract turn run-once execution owner

[Duang777]

Goal And Delivered Outcome

• Outcome basis / optional anchor: restore the command-module ownership budget on current main without changing Turn behavior.
• Goal/source and gap: loopx/cli_commands/turn.py had grown to 1,128 lines and exceeded its historical 1,114-line exception.
• Observable before → after, with the validation row that proves it: the command owner is now 298 lines and the extracted run-once owner is 890 lines; both pass the default 1,000-line budget.
• Issue/task and intended base: maintenance fix against main at f49b4a00870604d39fa4318da24d6dd35e72bb6e.

Scope And Continuation

• Completed scope and remaining work: moved the complete run-once execution and settlement adapter into turn_run_once.py, retained lazy loading for non-executing commands, and updated test injection targets. Complete within this scope.
• Slice boundary / successor: N/A; no behavioral or public API change is intended.

Validation

• Tested revision: fcea927f6c9664f79f3623b7a62e587eca4b67f2
• Run state: finished
• Input classes: synthetic, public_fixture

Check kind	Result	Public-safe evidence / limitation
unit	passed	Six affected suites: 185 passed, 2 skipped.
static	passed	Ruff passed on changed Python paths; mypy reported no issues in 19 source files.
real_entrypoint	passed	python examples/loopx-turn-dsh-e2e-smoke.py completed a committed Turn, spent one quota slot, and replayed with all effect flags false.
regression_parity	passed	The 42-statement execution block and extracted helper are AST-equivalent after the intentional local-name and return normalization.
static	passed	Module-size ownership, docs-governance, repository-hygiene, semantic-vocabulary, cold help/import, and selected premerge checks passed.
manual	passed	Two grouped reviews plus a cross-group contract review found no P0-P2 defects.

• Coverage and gaps: the tests cover planning-only lazy import, built-in Codex and DSH hosts, validation, durable completion, quota settlement, replay recovery, capability hooks, and journal inspection. No untested changed path was identified.

See validation disclosure guidance.

Frontend / Visual Evidence

• UI impact: none
• Before: N/A
• After: N/A
• States and viewports shown: N/A
• Source data: none
• Attention review: N/A; CLI module ownership only.

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference, when applicable: Core control-plane hardening.

Shared-authority RFC fixture impact

N/A. This refactor does not claim progress against the TypeScript control-plane migration or shared Goal Authority RFC.

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths (including .loopx/, .codex/goals/, and live ACTIVE_GOAL_STATE.md).
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

[Duang777]

Exact-head CI attribution for fcea927f6c9664f79f3623b7a62e587eca4b67f2:

• typescript-core (1/3) failed only the duplicate whole-value digest matcher at control_plane/work_items/task_lease_workspace.ts:26; fix(control-plane): reuse canonical lease digest matcher #5377 removes that duplicate owner. The other two TypeScript shards passed.
• test-shard (2) failed only test_runtime_source_churn_has_a_stable_readiness_diagnostic (ready instead of package_invalid); fix(runtime): reject stale batched source fingerprints #5367 covers this runtime fingerprint race.
• test-shard (3) failed the same runtime race plus the stale usage-notice assertion (5 observed vs 4 expected); test(usage): align source disclosure notice version #5379 updates that fixture.
• test-shard (1) and (4) passed. checks, pytest, and merge-gate are downstream aggregate failures.

None of the three failing owners is modified by this PR, and no failure points into the extracted turn_run_once.py boundary or its adjusted tests. The branch remains unchanged. @cocolord @huangruiteng please review this exact head when available. No merge action was taken.

[Duang777]

Exact-head update for 8812eb2952c91756bb7355507f851a9f8a798674:

• Synced with main@638d0e39cff09948df1816a4a5c5ccce70262c57 through a conflict-free merge commit with Signed-off-by.
• The prior failing owners are now repaired on main by fix(runtime): reject stale batched source fingerprints #5367, fix(control-plane): reuse canonical lease digest matcher #5377, test(usage): align source disclosure notice version #5379, and fix(control-plane): remove duplicate lease digest import #5391.
• Focused validation passed: 185 Python tests passed and 2 were skipped across the six affected Turn/CLI test files.
• Ruff and git diff --check passed.
• The local untracked uv.lock remained byte-for-byte unchanged and was not staged.

Fresh CI is running on this exact head. @cocolord @huangruiteng please review when available. No merge action was taken.

[Duang777]

Exact-head update for c2fb27349d8ef592de2b5787b0adca069c23886e on main@3ad3269af4d2cfae2085693823dcfcda522f9a2b:

• Resolved the fix(operations): allow admitted prepare with a registered source audience #5378 merge conflict by keeping the extracted turn_run_once.py owner, retaining the CLI source-route guard in turn.py, forwarding source_route from the extracted host adapter, and moving the test monkeypatch to the new owner. No old run-once implementation was restored.
• The resolved integration passed 195 Python tests with 2 skips and Ruff.
• After test(host): publish process markers atomically #5365 entered main, the affected Host/Codex CLI suite passed again: 65 passed, 2 skipped.
• git diff --check passed; the local untracked uv.lock remained byte-for-byte unchanged and was not staged.

Both merge commits carry Signed-off-by; no history was rewritten remotely. Fresh CI is running. @cocolord @huangruiteng please review when available. No merge action was taken.

[Duang777]

Exact-head update for 8a51dec2121328782ac01b12a5fee1634a54bf0b on main@31480ca039d36fcb07d6e6d8447082bf803d4a96:

• Synced through a conflict-free, signed-off merge commit. The extracted turn_run_once.py owner and current CLI boundary guards remain intact.
• The expanded Python suite passed: 237 passed, 2 skipped. This includes the new reward-memory tests from main.
• Ruff, the CLI module-ownership smoke, and git diff --check passed.
• The untracked uv.lock was not modified or staged.

Fresh exact-head CI is starting. No merge action was taken.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @Duang777.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork