test(authority): rehearse source outbox and lease recovery before cold import

[loopx-agent]

Goal And Delivered Outcome

Existing tests separately prove backup bytes, outbox settlement and cold import. This R5/T4 validation joins them: restore an owned stopped source runtime at its original binding, settle its original outbox position once, then perform reviewed import and recover the original import after new canonical writes.

The same parameterized journey covers Todo operations at four persistence windows under both ownership policies, and the lease partition at committed-pending and lost-response windows under hard_lease. All cases import into real File and SQLite providers. Restored lease acquisition replays its original identity without renewal; an active source lease still refuses import until native release. A fresh canonical grant advances version/epoch, and import replay preserves that grant and later data. No product behavior changes.

Author Declaration

• Written by: model_agent — GPT-6, OpenAI.
• Implemented against: TypeScript migration RFC, R5/T4 import-first frontier, immutable revision ffbd579502e6559ecf4d551b8837da1d6dd40a90.

Criterion	Disposition	Evidence
Installed import/backup/recovery for the declared source matrix	implemented for this bounded Todo/lease-outbox slice	test_restored_source_outbox_resumes_once_before_cold_import; actual CLI/storage validation below
Source capture and original receipts remain recovery obligations	implemented	Original byte inventory, binding, entry/history identity, repeated drain and original acquisition replay
Coordination recovery does not certify whole-Goal activation	implemented	Original source paths remain; complete_goal_backup_verified=false; import grants no execution authority
Core trial, whole writer-family cutoff and last-caller cleanup	deferred	Existing R5/T4 program; no rollout or deletion here

Scope And Continuation

Only tests/control_plane/test_backup_registered_source_retention.py changes, 330 additions / 7 deletions against main. The original inert-history case and restored-runtime case share one small member-verification helper. Todo and lease partitions use the same restore/import journey, avoiding a second standalone fixture. No product framework, new state vocabulary or configuration owner is introduced.

Generic pending effects, relocation/new bindings, complete Goal reactivation, packaged App/Lark use and natural core trial remain with their existing owners. The lease drill proves restored records and native release/fresh acquisition, not actual Host execution or automatic lease settlement.

Validation

• Tested head: b73e162ab928644d8bbf96236dbcea82464e071d.
• Finished; synthetic public fixtures on macOS.

Check kind	Result	Evidence / limitation
real_entrypoint / real_backend	passed	Complete source-backup and cold-source inspection suites: 60 passed, zero skip, using the previously built normal wheel from unchanged immutable main ffbd5795. Its 1,579 product Python/TS files match source; all 212 loaded product modules come from that wheel. No source borrowing.
real_entrypoint / real_backend	passed	Current default installed source 43abc6db: final changed matrix plus existing shared-witness caller, 22 passed, zero skip. All 198 product modules belong to that release; wrapper/manifest unchanged. Owned crashed subprocesses stop before runtime restoration.
negative / fault	passed	Independently remove an original lease file from the real extracted backup: the original-member oracle rejects it before restoration. One intentionally failing mutant, 19 deselected; its unmodified case passes. Active lease import also refuses before writer-fence creation and keeps lease bytes unchanged.
static	passed	Ruff, diff hygiene, semantic advisory, full semantic drift smoke, public/private scan.
integration	passed	Exact-scope CQR cqr_616e4b87d154bd5f58a6; native premerge: 4 direct checks passed, 0 selected catalog/risk checks, no manual holds. Focused real-path cases supply recovery coverage.
manual	not_run	Windows, PostgreSQL, live App/Lark, natural Host/cohort and complete Goal reactivation; those product boundaries do not change.

A temporary validation-driver syntax error stopped before product execution; it was corrected before collecting the complete results above. Earlier prototype/build/result-shape failures remain documented in validation history; no test result, frozen budget or gate is waived. CI was not queried under the current review contract.

Frontend / Visual Evidence

UI impact: none. Existing CLI/import contracts and typed owners are exercised without new user settings, defaults or navigation.

Shared-authority RFC Fixture Impact

Public synthetic source with both soft_claim and hard_lease Todo operations, plus the supported hard-lease partition, and real File/SQLite import targets. Full original non-lock bytes, retained grants and later canonical writes remain explicit oracles. This is a scoped qualification increment, not promotion or complete R5/T4 acceptance.

Boundary Checklist

• Public-safe fixtures; no private state, raw traces, local paths or credentials.
• No benchmark, runtime or authority-policy change.
• Existing recovery owner and acceptance frontier reused.
• DCO sign-off; merge remains with the maintainer.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; declaration=runtime_reported; effort=xhigh

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

维护需要恢复旧 Goal 后再迁移的维护者，以及后续删除旧写入代码的开发者。
已有测试分别验证备份字节、独立队列结算与冷导入，但未把中断后的源运行时恢复和原操作继续写入串起来。
以前只分别证明资料能解包、队列能结算；现在从备份恢复原路径上的临时运行时，再确认原操作只结算一次、迁移后的新数据继续保留。
中断产生的原记录保留，恢复仅结算一次，导入重放也保留之后的新数据。
本批只新增公开恢复验证并合并相同的成员校验逻辑；完整 Goal 激活、自然试用、写入代码退役及默认变更不属于本批。
租约队列、通用待执行副作用、完整 Goal 复活、打包 App/Lark 路径和核心开发者自然试用仍须按现有 R5/T4 验收。

改动思路

复用现有备份 CLI、可中断的临时源 fixture，以及 TypeScript 捕获、队列结算和冷导入 owner。先在真实持久化窗口终止自己的进程，独立核验备份的成员与原文件字节，再只恢复原绑定路径上的临时 runtime。原 Goal 源文件留在原处；后续由已有 owner 结算，测试没有实现第二套恢复决策或新的执行授权。

具体改动

精确 head：d4499f6c8839b0037be4a8255d0e3aa8429d9a85；全 PR 仅 tests/control_plane/test_backup_registered_source_retention.py，220 行新增、7 行删除。extract_verified_backup 合并两处相同的完整成员 size/hash 断言；test_restored_source_outbox_resumes_once_before_cold_import 覆盖四个中断窗口、两种原 ownership policy 和两种 canonical provider。原 entry_id、一次 terminal position、二次 drain 无新增 history、迁移后新写入及原 import 重放均通过真实 owner 读回。

规范：docs/architecture/rfcs/typescript-control-plane-migration-v0.md，不可变版本 ffbd579502e6559ecf4d551b8837da1d6dd40a90。逐条对应：

• T4: Qualify the installed import/backup/recovery journey：本批源 Todo/runtime 范围 implemented；安装 wheel56 与 actual default18 证明相关路径。
• T4: complete coordination backup versus complete Goal backup：implemented；保持原源路径，明确断言 complete_goal_backup_verified=false，导入不授予执行权。
• T4: retained source capture and historical receipts：implemented；核验全部原非锁字节、原绑定与 entry/history，不仅比较当前 Todo。
• T4: reversible core-developer SQLite trial：deferred；现有 R5/T4 自然试用仍须真实 Host 使用验收。
• T4: cohesive 2.0 normal-writer cutoff：deferred；本批没有改变 1.x 行为或删除仍有调用的 writer。
• T4: last source caller and pending outbox exit：deferred；只证明源 Todo 分区，不宣称所有租约/effect/producer 已退出。

已扫描现有 backup、cold-source、outbox、cursor/Host recovery 覆盖和作者完整 open 批次；没有重复同一恢复旅程的 PR。未来整理已应用在当前 test-local 成员校验边界，没有引入产品层框架。

对主干的风险

无阻塞发现。完整正常 wheel 的两个 suite 56 passed，当前实际默认安装源 43abc6db 的最终矩阵与既有 helper 调用者 18 passed；两臂均核验实际产品模块来源，默认 wrapper/manifest 前后不变。额外把真实解包后的一个 prepared 原记录删除，独立原字节断言按预期拒绝，证明“有效成员子集”不能冒充完整保留；没有用 mock 伪造恢复成功。

Ruff、diff、语义 advisory/inventory、公开边界扫描、当前 CQR cqr_7bfad6a856e5c606cb3d 与 native premerge 四项 direct 检查通过。选择器未选 catalog/risk 项，恢复覆盖来自上述真实执行。初始探针错误携带 backup 不支持的 Goal 参数、旧 frontend bundle、过长 CQR 字段均保留并修正后验证；不是放宽测试或数据预算。按当前合同不查询 CI。

仅测试文件和临时根目录有改动；Windows、PG、真实 App/Lark、自然核心试用与全 Goal 复活没有被本批证明。已有 source/receipt 格式和所有默认行为保持；测试窗口使用已有本地 fault vocabulary，不新建共享状态。

我的整体评价

APPROVE：这是 R5/T4 的 justified_increment，关闭一个此前分散测试无法证明的原操作恢复关联。long_horizon 与 user_experience 均 preserved：原操作重放不重复结算、不替换迁移后新数据，现有用户操作没有新增导航、确认或配置。后续仍由现有 owner 补全租约/effect 与实际安装使用范围，然后执行统一的版本截止和最后调用方清理。该结论是 test-only 范围评审，不等于默认发布、全 C1 或合并授权。

English verdict: APPROVE - d4499f6; a bounded real-backend recovery witness joins verified backup, original-binding outbox settlement and cold-import replay while preserving later writes. Wheel56, installed18 and the omitted-original-member counterexample cover the changed tests; full Goal activation and natural trial remain open.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; declaration=runtime_reported; effort=xhigh

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

维护者需要在旧源中断后保留原任务、租约和操作，再迁移并继续写入。此前备份、队列结算、租约生命周期与导入分别有测试，无法共同证明从备份恢复后原操作仍只结算一次。现在同一真实旅程覆盖源 Todo 与租约分区，进一步核验恢复不会续租或将活跃租约当作已结算，也不会覆盖迁移后的新 grant 和数据。

恢复后原任务与租约保留，原操作只结算一次；迁移重试保留此后的新数据与新执行租约。

本次仅增加公开恢复验证，不改变运行行为、界面或默认设置，也不声称完成整份 Goal 的重新激活。

这是既有 R5/T4 安装恢复资格的有界增量。通用待执行 effect、异路径绑定、完整 Goal 复活、实际 App/Lark/Host 与核心自然试用，以及整族 writer/producer 退役仍开放；本批仅资格化原路径源 Todo/lease 队列。

改动思路

复用真实备份 CLI、既有进程中断 fixture，以及 TypeScript 捕获、drain、lease、import/provider owner。先终止自有临时进程，校验原文件和真实 archive members，再只恢复原绑定路径下的 runtime；原 Goal/source/registry 仍在原处。恢复和新执行权分别核验，没有测试内第二套产品决策。

具体改动

当前精确 head b73e162ab928644d8bbf96236dbcea82464e071d：全 PR 仅 tests/control_plane/test_backup_registered_source_retention.py，330 行新增、7 行删除。上一评审 d4499f6 到当前 head 增加124/删除14行，将同一恢复函数参数化到 lease 分区，避免另一份相似 restore/import fixture；本次重新核验整个 PR，不沿用旧批准。

extract_verified_backup 复用 size/hash witness；test_restored_source_outbox_resumes_once_before_cold_import 覆盖 Todo 四窗口×两 ownership policy，加 hard-lease 的 committed-pending/lost-response 两窗口，各有 File/SQLite 目标。原 entry/history 只一次，二次 drain 不增 history；原 acquisition 恢复保持完整 lease/version/epoch/expiry。仍 active 的 lease 拒绝导入且不创建 writer fence，native release 后才允许确认。新 canonical grant 增 version/epoch，原 import 重放保留该 grant 与后写入 Todo。

已先读接受的 TypeScript migration RFC，不可变版本 ffbd579502e6559ecf4d551b8837da1d6dd40a90，逐条映射：

• T4: Qualify the installed import/backup/recovery journey：本批源 Todo/lease 队列限定 implemented，wheel60 和当前 installed22 证明。
• T4: complete coordination backup versus complete Goal backup：implemented，原源路径保持；明确断言 complete_goal_backup_verified=false 和 import 无执行授权。
• T4: retained source capture and historical receipts：implemented，全原非锁字节、binding、entry/history 与 lease identity 读回。
• T4: reversible core-developer SQLite trial：deferred，真实 Host/自然使用继续由原 owner 验收。
• T4: cohesive 2.0 normal-writer cutoff：deferred，1.x 兼容和正常 writer 均未改。
• T4: last source caller and pending outbox exit：deferred，本批不删除活跃调用或证明通用 effect/完整 Goal 激活。

现有 backup、cold-source、source lease、cursor、Host suites 与完整同作者 open 批次已检查。相关 lease 验收合并进本 PR；没有重复另开同形 PR。未来整理应用在既有参数化旅程和 member witness 边界，不引入产品恢复框架。

对主干的风险

无阻塞发现。当前全文件 backup+inspection 在产品源码未变的正常 ffbd wheel 上60 passed/零 skip，212产品 module 全来自 wheel；wheel 的1,579产品文件与原源码一致。当前实际默认安装 43abc6db 上最终矩阵和原 helper caller22 passed/零 skip，198 module 来自该 release，wrapper/manifest 保持。均使用真实 CLI、File/SQLite 和 TS owner，没有借用 checkout 产品模块。

最强反例：真实解包后刻意删去原 lease 文件，member 检查成功的子集也被独立原字节 oracle 拒绝，发生在 restore 前；该一例 mutant 预期失败，19例未选，未修改对应 case 正常通过。完整路径另证明 active-lease import fail closed 且源 lease 字节不变。测试只恢复已停自有临时 runtime，不测试活动真实 Goal/Host。

Ruff、diff、advisory、全树 semantic drift、公开边界扫描、当前 CQR cqr_616e4b87d154bd5f58a6 与 native premerge4项direct通过；没有选中 catalog/risk 项，恢复覆盖由上述真实矩阵提供。临时验证驱动 syntax error 在产品执行前停止，修正后完整重新收集；原探针/构建/shape失败保留，没有预算放宽。按当前合同不查询 CI。没有 UI、配置、默认、runtime/schema 或 authority 改动；Windows、PG、实际 App/Lark/Host 与完整 Goal 恢复仍未宣称。

我的整体评价

APPROVE：有明确回归价值的 justified_increment；long_horizon/user_experience preserved。恢复保持旧承诺与原授权事实，原 import replay 保留新工作和新 grant；用户操作没有增加配置或导航。现有核心可逆试用与实际 packaged 采用可消费本限定证据，冻结 D2 资格和完整恢复各保留独立边界。本评审不授予合并或默认发布权限，交 maintainer。

English verdict: APPROVE - b73e162; the joined real-backend recovery witness retains original Todo/lease identity, requires native lease settlement before import, and preserves fresh canonical grants and later writes. Current wheel60, installed22 and a copied-lease omission counterexample cover the whole test-only PR; natural trial and whole-Goal activation remain open.