fix(quota): keep capture IO out of the settlement plan's cold import - #8054

Goal And Delivered Outcome

• Outcome basis / optional anchor: Reproduced defect on current main at d29ec8bf2; no issue is filed for it and none is invented here. The failing check is the repository's own guard, not a new convention.

• Goal/source and gap: tests/architecture/test_control_plane_import_boundaries.py::test_settlement_plan_import_does_not_load_native_capture_io requires that importing the settlement-plan builder does not load loopx.control_plane.turn_driver.decision_capture, because "a command template needs the native output profile, not capture binding or the complete quota/Goal routing graph". Commit a5b742f19 fix(quota): unify private capture platform qualification added a module-scope from ..turn_driver.decision_capture import private_capture_supported, which loads the whole capture-IO owner — and with it bind_turn_decision_capture, the quota error-code surface and the content-digest pattern — every time the plan builder is imported. The guard therefore fails on main.

• Observable before → after: before, python -c "import sys; import loopx.control_plane.quota.effect_program; assert 'loopx.control_plane.turn_driver.decision_capture' not in sys.modules" exits 1; after, it exits 0, while the generated plan payload is byte-identical (983 bytes, same identity, same four command templates, --max-page-output-bytes 64000 still emitted on a POSIX host). Proved by the unit, regression_parity and failing-before rows below.

• Issue/task and intended base: Related to no issue. Base main at ce4cfc1ce.

Author Declaration

• Written by: model_agent (Claude-family model behind an AI coding agent).

Implemented against

• Specification and revision: the existing guard tests/architecture/test_control_plane_import_boundaries.py::test_settlement_plan_import_does_not_load_native_capture_io and its stated clause ("keep the typed kernel usable independently of those orchestration owners") on main at ce4cfc1ce.

• Criteria:

• Self-check before submission: this branch was rebased from d29ec8bf2 onto ce4cfc1ce with git patch-id --stable equal before and after (55ef4334…), so the rebase changed no content; the suites above were re-run on the rebased revision. I read every reference to private_capture_supported across loopx/, tests/ and examples/ before choosing the shape. My first attempt moved the import into the function only; that version left patch.object(quota_effect_program, "private_capture_supported", ...) in test_settlement_command_uses_private_capture_support with no module attribute to patch, and the suite went red — so the same commit also retargets those two patches to the owner module, which is where the name is now looked up. I did not move the predicate into native_context_profile.py even though that leaf module is declared "independent of capture and quota IO", because decision_capture.py is concurrently held by in-flight PRs C1: unify work sources and validate recovery #7430, fix(qualification): restore Any ceilings and current workspace contracts #8013 and fix(context): make progressive reads independent of native delta #8044; relocating a definition there is the better end state but belongs to whichever of those lands first. I did not run anything on a native Windows or non-POSIX host.

Scope And Continuation

• Overlap disclosure: in-flight PR fix(qualification): restore Any ceilings and current workspace contracts #8013 also edits tests/control_plane/test_quota_settlement.py, but at a different precondition-string assertion, and its decision_capture.py edits are typing-only, so the two hunks do not meet. Nothing in the open-PR set edits this guard or this import edge.
• Completed scope and remaining work: the cold-import guard passes and the predicate keeps a single owner. The remaining gap is structural rather than behavioural: private_capture_supported() is a two-line platform qualification that sits in the capture-IO module, so every consumer of the answer must either import that module or resolve it lazily. Moving it to the declared leaf module would retire the lazy import, and needs coordination with the three in-flight PRs listed above.
• Slice boundary / successor: this PR is independently testable and reversible on its own. The follow-up (predicate relocation) should be raised once fix(qualification): restore Any ceilings and current workspace contracts #8013 settles, since it also edits decision_capture.py for typing only.

Validation

• Tested revision: bca2dbb5d
• Run state: finished
• Input classes: synthetic

• Coverage and gaps: the guard covers the exact edge this change removes, the two retargeted patch cases cover the flag appearing and disappearing through the owner, and the base-versus-head payload comparison covers the four generated commands, so no rendering path is left unexercised. Untested: import weight on a Windows host (the predicate result differs there, but the edge being removed is host-independent), and the canary ratchet failure above, which needs its own recorded decision.

Frontend / Visual Evidence

• UI impact: none
• Before: N/A
• After: N/A
• First viewport and preview: N/A
• States and viewports shown: N/A
• Source data: none
• Attention review: N/A — no presentation surface changed.
• Craft review: N/A — no presentation surface changed.

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference, when applicable: Core control-plane hardening (keep the typed settlement kernel independently loadable).

Shared-authority RFC fixture impact

• Production-scale fixture schema: N/A
• Semantic dimensions changed, or reviewed no-impact rationale: N/A — no fixture dimension or schema changed; only the import site moved.
• Provider conformance arms run: N/A
• Read-only legacy/file/PostgreSQL three-arm rehearsal (required for promotion, runtime-routing, or compatibility-projection changes): N/A — no routing, promotion or compatibility projection changed.

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths (including .loopx/, .codex/goals/, and live ACTIVE_GOAL_STATE.md).
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• Existing English/Chinese RFC pairs (including ledger entries) both have a diff, and the local premerge check python3 scripts/check_rfc_bilingual.py --base origin/main --head HEAD passes, or no paired RFC changed.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).