test(ci): reconcile checkpoint and receipt-bound contract checks

[BigDataDZ]

Main's kernel lint and TypeScript shard 1 fail on three test integration gaps. All three failures were reproduced locally on main 13e680a75b90ba9d3c5c0a372436f3191eee152a before repair.

Register the existing checkpoint-retention reader in the strict canonical digest-consumer inventory and remove its Python test's unused import. Exercise the real typed retention owner for valid bare lowercase SHA-256 identities and reject empty, short, long, uppercase, nonhex and prefixed identities in both points and pins.

The receipt-reentry test still expected an explicit empty Turn guard to acquire a newly discovered frontier obligation. Align it with the accepted rule in 6d55e43df and the quota settlement contract: a scoped empty guard stays empty; a legacy unguarded read still returns the current obligation. Both assertions remain, alongside the existing original-proof and identity-conflict negatives.

Validation:

• Five real TypeScript suites, including checkpoint artifacts/retention, digest single ownership, replan semantics and quota settlement readback: 198 passed, 0 skipped.
• Full control-plane TypeScript check and the exact CI Ruff scope passed.
• Python checkpoint-retention tests: 12 skipped on Windows because their filesystem transport is explicitly POSIX-only. These are not transport-pass evidence; Linux CI remains required.
• Independent read-only review found no blockers; public/private scan and whitespace checks passed.

This is a test-only repair. Existing canonical owners already provide the intended behavior, so no production refactor or parallel rule is needed. Hosted qualification is pending; this does not claim the entire CI suite or storage/recovery acceptance is complete.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @BigDataDZ.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | reasoning_effort=max

动机

维护者运行 checkpoint 保留策略与 Turn 回执测试时，需要测试准确反映既有 typed owner 的规则。 旧测试漏登记已存在的 digest 消费者，并要求空的已准入 Turn 接管后来出现的义务；新测试补登记，并分别断言 scoped 空绑定与 unguarded 实时读取。

独立运行同五个 TypeScript 模块，基线 195 通过、2 失败，当前 head 198 全过；POSIX 文件系统 12 项通过，完整类型检查与 CI Ruff 范围通过。

这是一项测试契约修复，不修改生产选择、存储、权限或 UI；不证明完整 hosted CI、Windows 文件系统运输或长期研究收益。

改动思路

既有 TypeScript owner 已提供正确语义，只需在原测试中恢复严格登记与两条不同读取路径的断言，无需新增生产实现。 本 PR 只交付四个测试文件的登记、断言、非法 digest 覆盖和 unused import 清理。

checkpointRetentionPlan / projectReplanSemantics / digest consumer AST inventory；原 checkpoint CLI 与本地文件运输。 既有数据/权威与材料传递职责分开：本头没有另建通用状态机，也没有扩大原操作授权。正向、拒绝及回读都沿原拥有者；在需要新意图、控制权或原生提示处理时仍保留原边界。

具体改动

精确 head e67bf0581320ea25d7b7d5072160cac4a01eb0db，实际 merge base 13e680a75b90ba9d3c5c0a372436f3191eee152a，整头 4 files +18/-2。先读取原问题和不可变规范，再检查全部 diff；主要规范为 docs/quota-allocation.md，revision 13e680a75b90ba9d3c5c0a372436f3191eee152a，候选修改文档不自行认证验收。

• empty_guard_binding — implemented：replan_semantics.test.ts 的 scoped-null 分支；13e 的既有 preserveReceiptBoundObligation。
• legacy_frontier_read — implemented：同一请求显式 guard_scoped:false，保留原 current 对象断言。
• single_digest_owner — implemented：content_digest_single_owner.test.ts 清单与原 AST 导入/实际引用检查。
• pin_identity_integrity — implemented：新增正例与六类非法 points/pins；既有 missing/changed pin 负例未删。

关键内容讲解

1. retention 测试 调用真实 checkpointRetentionPlan，先接受有效身份，再分别在 point 和 pin 中拒绝空、63/65 长度、大写、非十六进制及 prefixed digest。没有复制第二套 matcher。
2. consumer inventory 只把已存在且实际使用共同导出的 reader 加入严格集合；原 AST 扫描、私有 matcher mutation 和例外限制不变。
3. receipt 测试 把错误的“空 guard 接管 current”改回 null，同时新增 unguarded-current 断言；原 proof、错 id 和 source 反例继续存在。
4. Python 文件只删除未使用 import，真实本地运输代码没有变。当前 main 已有该删除和 consumer 登记，receipt 两分支也已语义对齐；本头新增的非法 digest 覆盖仍有独立价值，不能把重复部分当第二次生产修复。

对主干的风险

独立基线失败与当前通过的差异支持测试规则修复，不代表生产状态机发生了修复。GitHub 当前仍报告冲突，需作者在最新 main 对齐，保留两类 guard 和新增负例后重新提交精确 head；本次没有修改分支。质量凭据缺失也是独立合并限制。没有查询、派发或等待 hosted CI，也不把作者的 Windows skip 当本机运输通过。

验证：Ruff 精确 CI 范围、完整 control-plane tsc、DCO、5 direct/3 selected 标准 premerge 执行均通过。该执行未绑定 Goal；另一次绑定 Goal 的不执行计划仅核对质量凭据，返回 receipt_missing，不把它当测试重跑或完整门已通过。 同文件集合在固定基线复现 inventory 与旧 receipt 断言两项失败；新断言仍同时检查 scoped-null 和 unguarded-current。六类坏 digest 在 point 与 pin 均拒绝；原 identity-conflict、错误原 proof、缺失/改绑 pin 反例保留。

我的整体评价

长期行为保持原状；维护者获得与既有 owner 一致且更有负例压力的本地检查。尚无 hosted 整体费用或长期研究净益证据。边界内目标已达成，代码评审结论 APPROVE；冲突处理和质量凭据重新资格化仍须完成。 既有 TypeScript owner 已提供正确语义，只需在原测试中恢复严格登记与两条不同读取路径的断言，无需新增生产实现。 本 PR 只交付四个测试文件的登记、断言、非法 digest 覆盖和 unused import 清理。 没有以测试数、哈希或评审记录数证明采用与效用。小范围重构检查已完成：复用既有 owner，保留必要负例，未发现需要在本切片新增的抽象。

English verdict: APPROVE — The exact-head test repair matches the existing typed owners; baseline failures are independently reproduced. Resolve current-main conflicts and refresh change-quality qualification before merge.

[mergify]

Hi @BigDataDZ, the DCO Sign-off check did not pass. Please inspect
its details first: checkout, fetch, timeout or infrastructure errors
need their own recovery, not a rewrite of otherwise signed commits.

If the log confirms a missing Signed-off-by trailer, amend the
affected commit with git commit --amend -s; for multiple commits,
use an interactive rebase against the current base from the correct
base-repository remote and sign off each affected commit. Push the
rewritten PR branch with git push --force-with-lease origin HEAD.

[loopx-agent]

Reviewer: model_agent; provider=OpenAI; runtime_reported

动机

受影响的是维护 checkpoint 保留策略与 Turn 回执测试的维护者：这些测试需要准确锁定既有 typed owner 的行为，而不是要求空 guard 接管后来出现的前沿义务、或漏登记已经存在的 digest 消费者。本 PR 只补测试登记、断言与负例。上一轮已在 e67bf0581 给出代码批准，但要求先解决与 main 的冲突；本头完成合并后在新的精确头重新取证。

改动思路

合入当前 main 时只有 tests/control_plane_ts/replan_semantics.test.ts 冲突，且两侧是同一组断言、只是注释措辞不同——main 已经包含 scoped-null 与 unguarded-current 两条断言。因此该文件采用 main 的版本，不保留重复或改写语义。合并后相对 main 的净差异只剩本 PR 仍有独立价值的部分：checkpoint_retention.test.ts 新增的合法/非法摘要身份覆盖。

具体改动

相对 main 为 1 个文件、+12：在 tests/control_plane_ts/checkpoint_retention.test.ts 新增 retention points and pins use bare lowercase SHA-256 identities，先断言合法的小写 64 位 bare SHA-256 在 point 与 pin 两处都被接受，再对空串、63/65 长度、大写、非十六进制与 sha256: 前缀六种形式分别在 points 与 pins 上断言 invalid retention point identity。没有复制第二套 matcher，也没有改动生产实现。

对主干的风险

纯测试改动，不触及生产选择、存储、权限或 UI。本头实测：checkpoint_retention、checkpoint_artifacts、checkpoint_provider_head、checkpoint_read_context、content_digest_single_owner、replan_semantics 六个 TypeScript 模块共 76 项通过；tests/control_plane/test_checkpoint_retention.py 12 项通过。未查询或等待托管 CI；完整 hosted 矩阵、Windows 文件系统运输与已安装产品仍不在本轮资格内。

我的整体评价

结论 APPROVE。冲突解决采用 main 已有的等价断言，净差异收敛到真正新增的负例覆盖；新增用例同时覆盖 point 与 pin 两条路径的六类非法输入，是对既有校验的有效加固，不需要任何生产改动。

English verdict: APPROVE - a5e3167. The only conflict was an equivalent assertion with different comments, so main's version is kept; the net diff is the new illegal-digest coverage, and 76 TypeScript plus 12 Python checkpoint tests pass on this head.