refactor(work-lane): decide the contract wire version in one owner

[karenchuu]

Goal And Delivered Outcome

• Outcome basis / optional anchor: Refs [Task]: Semantic vocabulary convergence follow-ups after RFC PR #4433 / 语义词表收敛后续任务 #4447 Track A and the inventory_ratchets note in loopx/semantics/vocabulary_v0.json: "Both the number of affected names and the number of definitions are budgets, so a third spelling of an already-conflicting name is still a regression."
• Goal/source and gap: the work-lane contract's wire version had five spellings. Two were module-level constants (control_plane/work_items/work_lane.py:35 and control_plane/work_items/capability_monitor_fallback.py:12) and three were inline payload literals (control_plane/quota/task_orchestration.py:362, control_plane/quota/live_decision.py:318, control_plane/quota/unsettled_host_turn.py:348). task_orchestration.py already imported the owner constant on line 12 and then restated the same value inline about 350 lines later, which is also why the name-keyed inventory reports one fork group where the tree really holds five.
• Observable before -> after, with the validation row that proves it: work_lane.py is the only module that binds the name and the only module under loopx/ that spells the value; capability_monitor_fallback.py and task_orchestration.py project the owner's constant; the new guard fails on a private copy, on a new inline literal, and on a deferred entry that goes stale. The regression_parity row shows the generated inventory now reports same_runtime_forks=10/10, same_runtime_fork_definitions=23/23 and schema_version_same_runtime_forks=1/1.
• Issue/task and intended base: Refs [Task]: Semantic vocabulary convergence follow-ups after RFC PR #4433 / 语义词表收敛后续任务 #4447 Track A. Base is main at f49b4a008.

Scope And Continuation

• Completed scope and remaining work: the duplicate binding in capability_monitor_fallback.py became an import of the owner, the inline literal in task_orchestration.py reads the constant that file already imported, and both counted budgets plus the schema-version budget were re-anchored to the values measured on this revision. The product change is two lines added and two removed, with the six anchor lines moving in the same diff; the semantic inventory moves same_runtime_forks 11 -> 10, same_runtime_fork_definitions 25 -> 23 and schema_version_same_runtime_forks 2 -> 1, with same_runtime_forks_semantic unchanged at 9 because [A-Z][A-Z0-9_]*_SCHEMA_VERSION is a module-local convention name.
• Slice boundary / successor: quota/live_decision.py:318 and quota/unsettled_host_turn.py:348 still restate the value inline. Both files are being changed by in-flight PRs Refactor/event driven control plane #3200, fix(scheduler): inject capability registry instead of importing catalog from control_plane #4023, refactor(quota): resolve fallback advice from one typed snapshot #4061 and fix(quota): fence settlement by exact GoalRef #5340, so converting them here would merge-conflict for no evidence gain; they are declared by file and count in the guard's DEFERRED_INLINE_RESTATEMENTS, so a new site, a fixed site that keeps its declaration, or a silently widened set all fail. The remaining counted *_SCHEMA_VERSION twin is SNAPSHOT_SCHEMA_VERSION (capabilities/issue_fix/repository_snapshot.py:14 and capabilities/issue_fix/metrics_projection.py:16), which cross-validate each other's payloads with that same literal and is deliberately left for its own PR. Tests, examples and docs keep their own copy of the expected value on purpose: if they read it from the owner, a wrong owner would have nothing to fail against.

Validation

• Tested revision: 5e9c5ad08
• Run state: finished
• Input classes: synthetic fixtures plus the repository's own control-plane suites

Check kind	Result	Public-safe evidence / limitation
unit	passed	New tests/architecture/test_work_lane_contract_schema_version_single_owner.py: 8 passed, covering the binding scan, the payload-literal census, the deferred declaration set, consumer wiring through all three fallback branches plus the orchestration projector, and the generated inventory.
integration	passed	47-file selection of every suite that names the contract, the fallback builder or the orchestration projector: 1415 passed, 0 failed. tests/architecture plus tests/canary: 1097 passed, 0 failed.
static	passed	python -m ruff check clean on all changed files; python -m ruff format --diff reports the same two pre-existing files on base and head, so no format finding is introduced; configured python -m mypy succeeded for 19 source files; git diff --check clean.
real_entrypoint	passed	examples/control_plane/work-lane-contract-smoke.py and examples/control_plane/quota-plan-smoke.py both passed on the tested revision.
regression_parity	passed	The same 47-file selection on an untouched worktree at the base commit: 1407 passed, 0 failed, so the head failure set is empty and strictly the eight new tests. The drift smoke was run on both trees: every output line is byte-identical except the ratchet line, which moves same_runtime_forks=11/11 -> 10/10, same_runtime_fork_definitions=25/25 -> 23/23 and schema_version_same_runtime_forks=2/2 -> 1/1.
premerge	passed	loopx canary premerge over the exact five changed files completed 19 checks with 0 failures, 0 warnings and no manual hold; the public-boundary scan reported clean for all five paths.

• Mutation battery: ten mutants were applied one at a time in a separate worktree and reverted between runs. Killed: private binding restored in the fallback module (3 tests red, including the inventory assertion); inline literal restored in the orchestration projector (1 red); a new inline literal in an unrelated module (1 red); a new module-level binding in an unrelated module (3 red); a deferred entry deleted while its file still restates the value (1 red); a deferred file changing its value while keeping its entry (2 red); the registry budget raised without the smoke anchor (smoke fails with "the registry and the anchor move together in one diff"); both anchors lowered below measured (smoke fails with "grew to 23; budget is 22"); the owner's value changed to work_lane_contract_v2 (guard red). Survived, and why it is equivalent: adding a second payload literal inside the owner module passes every test, because the owner would still be the single module deciding the value - the census excludes the owner path by design, and the same-module restatement is a readability issue rather than a second owner.
• Coverage and gaps: the full repository suite was not run. Two limitations are recorded rather than hidden. First, changing the owner's value to work_lane_contract_v2 left the eight focused contract tests green, because that suite compares against its own restated literal - same-value restatements are invisible behaviourally, which is the reason the census is structural. Second, tests/control_plane/test_work_lane_contract_core.py and the two smokes above ran against a worktree without a compiled Chat bundle, which this change does not touch. No backend, persisted state or wire payload changes: every projected payload keeps the byte-identical value.
• Environment disclosure: validation reused an already-installed local interpreter (uv pip install -e ".[test]") instead of uv sync --extra test, with Node 22.23.2 on PATH and the repository's npm dev dependencies installed, both required by the drift smoke.

Frontend / Visual Evidence

• UI impact: none
• Before: N/A
• After: N/A
• States and viewports shown: N/A
• Source data: none
• Attention review: N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Shared-authority RFC fixture impact

N/A. This PR does not claim progress against the shared Goal Authority or TypeScript migration RFCs.

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths.
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked task.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

Technical Direction

• Direction / acceptance reference, when applicable: Core control-plane hardening under the accepted Semantic Vocabulary Convergence RFC, Track A, following the same shape as the merged single-source carrier cleanups.

Notes For The Reviewer

• The two anchors (vocabulary_v0.json and BUDGET_ANCHOR in the drift smoke) move in this single diff, as the smoke's own error message requires.
• A sibling PR in this account lowers the same two ratchet keys from the same base commit. If that one lands first, the anchors here need same_runtime_forks 10 -> 9 and same_runtime_fork_definitions 23 -> 21 re-measured on the integrated base; the values quoted above are measured against f49b4a008.

[karenchuu]

CI triage for exact head 5e9c5ad0833547f439ecea3f1d7ad82d59d6cd21:

The failed checks are the same mainline failures seen on neighboring PRs and do not point to this PRs five changed files:

• test-shard (2) failed two source-fingerprint churn tests in tests/control_plane/test_turn_journal_runtime_readiness.py.
• test-shard (3) failed another source-churn diagnostic plus test_source_first_usage_disclosure_keeps_json_pure_and_does_not_send.
• typescript-core (1/3) failed the existing single-owner digest census on loopx/control_plane/work_items/task_lease_workspace.ts:26.

This PR changes the two work-lane contract consumers, its new architecture guard, and semantic budget metadata; none of the failing implementation or test paths are part of its diff.

The branch is currently two commits behind main. Current main includes 647756d21 / #5367, which updates the runtime source-fingerprint implementation and the failing readiness tests. Please update this branch from current main and rerun CI. Any remaining digest or usage-disclosure failure belongs at its owning mainline boundary and should not be folded into this single-owner refactor.

This comment explains the red checks only; it is not an approval. The PR still needs exact-head review after the branch update.

[huangruiteng]

动机

评审精确 head：5e9c5ad0833547f439ecea3f1d7ad82d59d6cd21；比较基线：f49b4a00870604d39fa4318da24d6dd35e72bb6e。这是 #4447 Track A、Semantic Vocabulary Convergence RFC 的有界债务收敛：同一个 work-lane wire version 由多个 Python producer 独立拼写，未来版本调整可能让正常 lane 与 capability fallback 输出不同契约。目标是减少真实重复知识，不是改变调度或用扫描计数宣布整个 RFC 完成。

改动思路

复用 work_items/work_lane.py 的既有 owner：fallback 显式重新导出该常量，orchestration 使用自己已经导入的常量。保持 work_lane_contract_v1、字段、义务和拒绝顺序不变；不新增 Python 决策源，也不为一次 Python wire-carrier 收敛引入 TS 桥。架构测试同时检查定义、已知 inline 副本和 producer 输出，并下调原有 inventory 预算。live_decision.py、unsettled_host_turn.py 的两个 inline 副本仍被精确记录，不应将这一阶段表述成全部 producer 已归一。

具体改动

五文件 +226/-8，其中生产代码只有两处替换；其余主要是 218 行架构护栏及 smoke/registry 的一致预算调整。

关键代码讲解

• capability_monitor_fallback.py:9 的显式重导出保留原模块符号可用性，值来自 work_lane.py，没有重新声明 literal。build_capability_skip_monitor_fallback_contract 的 due、schedule-gap、quiet 和无 monitor 分支仍分别产生原 obligation、原 must-attempt 标志或 (None, None)。
• task_orchestration.py:355 的 _task_orchestration_work_lane_contract 只替换 schema_version 来源；上游 apply_task_orchestration_contract 仍依据已有 capability、actor 与 lane 事实准入。没有观察到“导入常量即激活编排”的路径。
• test_work_lane_contract_schema_version_single_owner.py:34 的 deferred census 锁住两处剩余副本及次数；owner 以独立 wire literal 为 oracle。它是限定语法的 source guard，不是执行状态机、持久化兼容或全程序语义证明。

独立验证：157 个相关 pytest 通过；work-lane public smoke、完整 semantic-vocabulary smoke、changed-diff advisory、改动文件 Ruff 和 whitespace 检查通过。同一独立 harness 在 base/head 执行四种 fallback、编排 capability 开/关及三个公开 quota 场景，共九份完整结果；仅规范化生成的临时 runtime 路径后全部相同，未删除 obligation、诊断、命令或字段。故意让 producer 发出错误 wire version，独立 oracle 按预期失败。无 opt-in/default-off 宣称；既有无 capability 的编排控制也保持一致。

对主干的风险

未发现阻塞问题。主要风险是未来 fork 或 inline 漂移，而非当前 wire 变化；现有 literal oracle、producer 验证和全树预算形成互补。没有修改 persisted receipt、租约、authority store、CLI 参数、权限或 UI，故不需要新的 PostgreSQL/前端迁移资格；也未读取活跃 Goal 来构造测试。没有查询远端 CI，本次批准不代替 merge readiness。

两个同作者的收敛 PR 都修改预算锚点，合并时应按最新主干重跑完整 semantic smoke，并保留各自 census 声明；不能从单个 PR 的历史计数推断合并后的实际库存。未来面对更复杂语法时，可先复用 inventory 的 AST facts、压缩重复 census 辅助代码；这次不扩展扫描框架或强制无关语言迁移。已考虑这个相邻重构边界，当前有界改动独立可回滚。

我的整体评价

APPROVE。这不是功能扩张，而是把两个真实 producer 接回既有 owner，完整外部结果保持一致，删除的重复知识有可执行 readback。两个 deferred inline 副本与 RFC 的更广泛收敛仍未完成；本评审没有关闭它们，也没有把通过测试数量当作产品接受。批准后继续核对有效旧阻塞评审，仅在逐项证明过期且具备权限时撤销；不合并 PR。

English verdict: APPROVE — existing wire ownership is reused without observable quota drift; remaining inline copies are explicit, and independent parity plus wrong-version sensitivity passed. No merge or whole-RFC completion is implied.