refactor(chat): the capabilities route is decided by its server

[karenchuu]

Goal And Delivered Outcome

• Outcome basis / optional anchor: Refs [Task]: Semantic vocabulary convergence follow-ups after RFC PR #4433 / 语义词表收敛后续任务 #4447 Track A and the inventory_ratchets note in loopx/semantics/vocabulary_v0.json, which makes a repeated module-level constant duplicate knowledge regardless of whether the copies currently agree.
• Goal/source and gap: /api/chat/capabilities is a wire identity with three owners. loopx/chat_server.py:100 binds it and dispatches on it at line 1309; loopx/dashboard_launcher.py:19 bound its own copy and probes with it at line 60 to decide whether an already-running server may be reused; and the shipped browser build fetches the same string in apps/presentation/dashboard/src/data/chat.ts:618. The two Python copies were also a counted fork in the generated inventory, so the drift smoke already treated them as one decision spelled twice.
• Observable before -> after, with the validation row that proves it: the server is the only Python module that binds the name and the only one that spells the value; the launcher asks the server for the route at the moment it probes; the new guard fails on a private copy, on a new Python literal, and on an undeclared or removed browser-build literal. The regression_parity row shows the inventory now reports same_runtime_forks=10/10, same_runtime_fork_definitions=23/23 and same_runtime_forks_semantic=8/8.
• Issue/task and intended base: Refs [Task]: Semantic vocabulary convergence follow-ups after RFC PR #4433 / 语义词表收敛后续任务 #4447 Track A. Base is main at f49b4a008.

Scope And Continuation

• Completed scope and remaining work: dashboard_launcher.py lost its module-level copy and reads chat_server.CHAT_CAPABILITIES_PATH inside _probe_existing_chat, and three budgets were re-anchored to the values measured on this revision. The import sits in the probe, not at module level, for a measured reason: with a module-level import, importing loopx.dashboard_launcher cost 118-121ms across three samples against 10-13ms on base, because the launcher is imported by loopx/cli_commands/support_control.py and frequently runs against a port that holds no LoopX process at all; with the deferred import the same three samples are 12-13ms. The probe path itself is unchanged, and the guard pins it behaviourally.
• Slice boundary / successor:
  • apps/presentation/dashboard/src/data/chat.ts:618 keeps its own literal. A browser module cannot import a Python constant, and that file is being changed by in-flight PR fix(chat): recover uncertain instructions after page reloads #5373. The copy is therefore declared by file and count in DECLARED_WEB_CLIENT_RESTATEMENTS, so a second hardcoded fetch, or removing the declared one without updating the census, fails the guard. A generated binding is the real fix and is out of scope here.
  • The capabilities schema version is deliberately not folded into this owner. chat_server.py:1315 advertises loopx_chat_capabilities_v1 as an inline literal while dashboard_launcher.py:21 and the browser build declare the accepted set (chat.ts:143 accepts both ..._v0 and ..._v1). Advertised-versus-accepted is a per-surface policy decision, so merging them would erase a compatibility window rather than a duplicate. The one visible defect - the advertised version having no name in its owner module - is left as a follow-up with its file:line.
  • Tests and examples keep their own expected route on purpose: if they read it from the owner, a wrong owner would have nothing to fail against.

Validation

• Tested revision: afb94f9b8
• Run state: finished
• Input classes: synthetic fixtures, a real localhost HTTP probe, and the repository's own chat suites

Check kind	Result	Public-safe evidence / limitation
unit	passed	New tests/architecture/test_chat_capabilities_route_single_owner.py: 9 passed, covering the module-level binding scan, the Python literal census, the declared browser-build census, the owner's value, the launcher probe through a recording HTTPConnection, the absence of a private copy in the launcher, and the generated inventory.
integration	passed	tests/architecture plus tests/canary: 1098 passed, 0 failed. Chat/dashboard selection (test_dashboard_command, both test_support_control_*, test_chat_server_cors, test_chat_startup_isolation, test_manager_channel_binding and the new guard): 145 passed, 5 failed.
static	passed	python -m ruff check clean on all changed files; configured python -m mypy succeeded for 19 source files; git diff --check clean. python -m ruff format --diff flags the same pre-existing files on base and head, so no format finding is introduced.
real_entrypoint	passed	tests/test_chat_startup_isolation.py starts the real chat server and reads /healthz and /api/chat/capabilities over HTTP, so the owner's route is exercised as a live endpoint rather than a constant.
regression_parity	passed	The same selection on an untouched worktree at the base commit fails the identical 5 tests (tests/test_dashboard_command.py) and otherwise passes 136; the head adds 9 passing tests and no new failure. Those 5 fail for an environment reason this change cannot affect: the compiled Chat bundle is gitignored build output and is absent from the worktree, and examples/loopx-chat-server-smoke.py stops on the same missing bundle on base and head. The drift smoke was run on both trees; every line is byte-identical except the ratchet line, which moves same_runtime_forks=11/11 -> 10/10, same_runtime_fork_definitions=25/25 -> 23/23 and same_runtime_forks_semantic=9/9 -> 8/8, with schema_version_same_runtime_forks unchanged at 2/2.
premerge	passed	loopx canary premerge over the exact four changed files completed 5 checks with 0 failures and no manual hold; loopx check --scan-path reported the public boundary clean for the changed paths.

• Mutation battery: nine mutants applied one at a time in a separate worktree and reverted between runs. Killed: launcher keeps a private module-level copy (4 red); the probe spells the route inline (1 red); a third module binds the name (3 red); a second hardcoded fetch is added to the browser build (1 red); the declared browser copy is removed while its declaration stays (1 red); the registry anchor raised without the smoke anchor (smoke fails: "the registry and the anchor move together in one diff"); both anchors lowered below measured (smoke fails: "grew to 23; budget is 22"); the owner's route value changed (5 red across the guard and the CORS suite, so the route is behaviourally load-bearing). Survived, and why: a consumer that rebuilds the route by concatenation, "/api/chat/" + "capabilities", passes the census, because the literal scan looks for the whole quoted value. That is a real gap in the guard, disclosed rather than papered over; the binding scan and the inventory assertion would still catch it if the consumer also bound a name.
• Coverage and gaps: the full repository suite was not run. No persisted state, backend or wire payload changes; the probe sends the same request bytes as before.
• Environment disclosure: validation reused an already-installed local interpreter (uv pip install -e ".[test]") instead of uv sync --extra test, with Node 22.23.2 on PATH and the repository's npm dev dependencies installed, both required by the drift smoke.

Frontend / Visual Evidence

• UI impact: none
• Before: N/A
• After: N/A
• States and viewports shown: N/A
• Source data: none
• Attention review: N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Shared-authority RFC fixture impact

N/A. This PR does not claim progress against the shared Goal Authority or TypeScript migration RFCs.

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths.
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked task.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

Technical Direction

• Direction / acceptance reference, when applicable: Ref [Task]: Semantic vocabulary convergence follow-ups after RFC PR #4433 / 语义词表收敛后续任务 #4447 Track A: retire counted duplicate spellings instead of raising their budgets.

Notes For The Reviewer

• A sibling PR in this account lowers the same two ratchet keys from the same base commit. If that one lands first, the anchors here need same_runtime_forks 10 -> 9 and same_runtime_fork_definitions 23 -> 21 re-measured on the integrated base; same_runtime_forks_semantic stays at the 8 measured here. The quoted values are measured against f49b4a008.

[karenchuu]

CI triage for exact head afb94f9b8bf2c332a9574a32a33ddd2622dbc692:

The failed checks do not point to any of this PRs four changed files:

• test-shard (2) failed two source-fingerprint churn tests in tests/control_plane/test_turn_journal_runtime_readiness.py.
• test-shard (3) failed another source-churn diagnostic plus test_source_first_usage_disclosure_keeps_json_pure_and_does_not_send.
• typescript-core (1/3) failed the existing single-owner digest census on loopx/control_plane/work_items/task_lease_workspace.ts:26.

The PR changes only loopx/dashboard_launcher.py, its new route-owner architecture test, and the semantic budget files. None of the failing implementation/test paths are changed by this PR.

Current main is two commits ahead of this head. It already includes 647756d21 / #5367, which updates the runtime source-fingerprint implementation and the failing readiness tests. Please update this branch from current main and rerun CI. Any remaining digest or usage-disclosure failure should be repaired at its owning mainline boundary rather than folded into this route-owner refactor.

This explains the current red checks only; it is not an approval. The PR still needs exact-head review after the branch update.