refactor(turn): isolate failed-session recovery

[huangruiteng]

Summary

• move the typed failed-Turn host recovery protocol into its bounded-context owner
• keep executor.py focused on orchestration and restore the maintainability ratchet after fix(turn): resume preserved sessions on failed-turn retry #3262
• preserve the existing failed-session retry behavior and journal schema

Validation

• ruff check on changed and focused test surfaces
• pytest -q tests/test_loopx_turn_executor.py tests/test_loopx_turn_driver.py (80 passed)
• control-plane maintainability ratchet
• loopx canary premerge --from-git-diff (9/9 selected checks passed; no holds)

This is a behavior-preserving prerequisite for #3261; it does not raise the module budget or alter retry semantics.

[huangruiteng]

Self-review complete.

• Changed surfaces: Turn-driver host recovery ownership only; no journal schema, host retry, scoring, permission, or scheduler behavior change.
• Focused parity: 80 tests passed across test_loopx_turn_executor.py and test_loopx_turn_driver.py.
• Quality: ruff, compileall, diff hygiene, and maintainability ratchet passed; executor.py is back below the 1,500-line budget.
• Premerge: 9/9 risk-selected checks passed, with no failures, skips, or manual holds.
• Boundary: only public runtime source files are committed; local uv.lock remains untracked.

The coverage is sufficient because the pre-existing #3262 executor/driver tests exercise both the failed-session retry path and its rejection paths through the unchanged public entrypoint.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

精确评审头（Exact Head）: 3266@e4b83c9362b27dddd57f715ce6bf5c7daa1f5a5a
Base: main | 类型: turn failed-session recovery isolation（2 files, +64/-59）
作者: huangruiteng（owner）

---

详细中文评审

动机

失败 Turn 的 typed host 会话恢复逻辑（schema/kind 校验、binding resolver、retry request 合并）全部内联在 turn_driver/executor.py 里，既让 orchestration 文件继续膨胀，也让该 bounded context 的契约难以独立复用。本 PR 把恢复协议收拢到自己的模块，为 #3261 的后续工作提供行为保持的前置拆分。

改动思路

新建 loopx/control_plane/turn_driver/session_recovery.py 作为失败会话恢复的 bounded-context owner：常量（HOST_RECOVERY_SCHEMA_VERSION、HOST_RECOVERY_KINDS）、类型（SessionBindingResolver）与校验/构造/合并函数全部迁入；executor.py 只保留导入与调用点。校验顺序与失败语义逐行保持不变。

具体改动

• session_recovery.py（+64）：require_host_recovery_kind、build_host_recovery_record、reconcile_failed_turn_retry_request；schema → kind → failed_phase=host_execute → resolver 存在性 → provider 边界 fail-closed 的原有顺序完整保留。
• executor.py（-59）：删除内联常量/类型/_reconcile_failed_turn_retry_request，改从新模块导入；_host_result_stage 改用 build_host_recovery_record（写入时同样校验 kind）。无行为变化。

关键内容讲解

1. 行为保持：原实现里 recovery/receipt 都假定是 Mapping；新实现先做 isinstance 再 dict()，对非 Mapping 的 journal 字段与旧行为一致（空 dict → 直接返回原 request），比原实现更防御但语义相同。
2. budget 归还：executor.py 模块指标下降，maintainability ratchet 的既有 advisory（#3265 中提到的 executor 预算）得以缓解，且未提高模块预算。
3. 接口收窄：executor 不再暴露恢复协议内部，后续 #3261 可以只在该模块内演进恢复缝。

对主干的风险

无阻断项。纯抽取 + 严格保持行为，相关测试全绿。P2：GitHub pytest 在评审时刻仍 IN_PROGRESS（无失败）；本地已在 exact head 跑通 80 个 executor/driver 测试、ruff 与 maintainability ratchet smoke，合并前确认 CI 全绿即可。

验证矩阵（exact head 实测）

场景	结果
pytest tests/test_loopx_turn_executor.py tests/test_loopx_turn_driver.py	80 passed
ruff check（changed surfaces）	PASS
control-plane-maintainability-ratchet-smoke.py	PASS（0 unreviewed / 0 regressions）
Sign-off / build / dependency-review	SUCCESS（GitHub）
pytest（CI）	IN_PROGRESS（评审时刻）

我的整体评价

小而准的 bounded-context 抽取：恢复协议获得独立 owner，executor 回归编排职责，校验语义逐行保持，测试与 ratchet 全部通过。结论：APPROVE（author-owned PR，以 COMMENTED 记录批准结论；合并前确认 CI pytest 绿）。

---

English Verdict

Verdict: APPROVE (author-owned PR; recorded as COMMENTED because GitHub blocks formal self-approval). This is a behavior-preserving bounded-context extraction of failed-Turn host session recovery into session_recovery.py, with the same validation order and fail-closed semantics. At the exact head: 80 executor/driver tests pass, ruff is clean, and the maintainability ratchet smoke passes; CI pytest was still in progress at review time.