test(control-plane): preserve checkpoint fences and frontier recovery

[loopx-agent]

Goal And Delivered Outcome

Two existing recovery test families fail against the shipped contracts. The frontier tests require successful execution after deleting the Goal document, although canonical counts remain complete and the missing-intent gate correctly refuses work. The exact-source checkpoint fixture substitutes two registry readers but omits the late-bound Goal-facts reader, so it fails before reaching the native Goal-instance fence.

This PR updates only those existing tests. File/SQLite CLI cases now verify intact admission, missing-document refusal with unchanged complete counts, byte-preserving document recovery, and provider loss/restoration without display fallback. The lower-level checkpoint fixture includes the existing late-bound reader in its explicit source-only seam while independently proving that the real generic reader still refuses the lifecycle-only profile; exact replay remains idempotent, recreation is rejected, and neither path debits quota.

• Outcome basis: independently reproduced mainline qualification failure and the accepted status/Goal-instance contracts.
• Before → after: both complete changed modules at base ef77d9064607dfc69edd3f21926dc4c22126c44b produce 3 failed / 57 passed. All 60 cases pass within the final 221-test four-module run.
• Intended base: loopx-project/loopx:main. The existing missing-document distinction clarified in test(control-plane): separate canonical readback from execution admission #6945 is retained. This does not duplicate fix(status): fail closed on truncated legacy Todo sections #6921's legacy-section truncation or fix(quota): retain settlement after ordinary Todo completion #6947's ordinary-Todo settlement work.

Author Declaration

• Written by: OpenAI Codex model agent under the requester's direction.

Implemented against

• Specification and revision: docs/status-data-contract.md (canonical observation versus missing Goal intent), loopx/control_plane/projects/registry_codec.py (generic refusal of the lifecycle-only profile), and the existing native checkpoint/Goal-instance fence, at base ef77d9064607dfc69edd3f21926dc4c22126c44b.

Criterion	Disposition	Path	Evidence
Missing Goal intent refuses automatic work while canonical full-source counts remain complete	implemented	test_goal_frontier_full_source_counts.py	Real File/SQLite CLI: intact → missing → restored; 12 open and 12 ready successors remain identical
Provider loss refuses fallback; restoring the provider recovers original canonical work without reconstructing the document	implemented	same existing test	Failed native read and successful restored read, retained thin display and complete counts
A test-only source-reader adaptation does not enable generic runtime reads	implemented	test_checkpoint_provider_fence.py	The unmodified generic reader still raises its protocol refusal
Original exact-Goal checkpoint commits/replays once; recreation rejects without another write or debit	implemented	same existing test	Original GoalRef/settlement identity, byte-identical replay, stale-instance refusal and zero-spend assertions

Self-check: characterize the existing production contract before changing assertions. The frontier failure does not establish lost state. The checkpoint fixture is a lower-level commit-fence qualification with explicit reader substitution; it does not qualify runtime execution for a lifecycle-only profile. No production admission, decoder, provider or settlement implementation changes.

Validation

• Tested revision: 44ee9ca6101c56d30809378b3f0e34e1cbc1ec31.
• Finished local checks use disposable synthetic registries/runtimes and the real owning CLI/native writer; no live model or active Goal mutation.

Check	Result	Scope and limitations
Immutable-base characterization	failed, retained	Two complete changed modules: 3 failed, 57 passed
Changed and adjacent recovery families	passed	221 tests across the complete checkpoint fence, frontier counts, checkpoint read-context and canonical-status modules
Source-profile and reader owners	passed	57 tests across registry denial, replan-context evidence and project registry codec
Native standard premerge	passed	5 direct and 6 catalog-selected checks; zero failures, warnings or manual holds
Static / public boundary	passed	Ruff, compile, diff hygiene, RFC-pair checks and explicit two-file public scan
Whole Python suite / release / installed App	not_run	Not qualified by this tests-only repair; prior failed/incomplete runs remain so

Scope And Design

Two existing test modules, 53 additions and 7 deletions. Existing typed owners, defaults, public interfaces, runtime behavior and permissions are unchanged. The bounded refactoring pass shares the repeated quota argv across the three actual test phases; semantic assertions remain explicit. No fixture framework, module, capability, vocabulary, provider or smoke wrapper is added. PostgreSQL-store integration and new visual evidence are inapplicable to this zero-production/UI diff.

Boundary Checklist

• Existing synthetic regression families; no raw logs, private context, credentials, internal URLs or host paths.
• Generic source-profile refusal, Goal-instance fence and missing-intent gate preserved.
• Recovery, failure and exact replay tested through their existing owners.
• No RFC pair changes; bilingual gate passed.
• DCO sign-off included.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

未发现阻塞问题。维护者在验证缺失 Goal 文档和旧轮补记时，现有回归套件会在到达真正的安全边界之前报错。 原测试要求缺失文档后继续运行，另一个夹具漏适配新增读取入口；现在分别核验只读计数、拒绝执行、恢复和原实例补记。 本次交付修复两个现有测试族的验证假设，保留原生产安全边界。 本 PR 不改变生产实现、默认值、运行时准入或发布资格。 两个完整模块在不可变主干基线有3失败、57通过，负例证明确切计数没有丢失。继续保留旧假设会阻断验证；为满足旧断言而修改生产守卫则会扩大风险。

改动思路

入口仍是现有 pytest 用例、真实 File/SQLite CLI 和 TypeScript 原生补记写入者。Goal 文档提供意图，canonical store 提供任务事实，两者不能互相补造。测试依次比较文档完整、缺失、恢复，再核 provider 不可用与恢复。补记夹具仅补齐已有 source-only 读取适配，真实 generic reader 的拒绝独立执行；运行时没有获得新权限。

本次边界只修正两个现有测试族，不增加模块、并行状态或兼容分支。现有 owner 已足够；重构生产读取器或扩大 source-session 激活范围没有已证明的需求。小范围整理将三个阶段复用的 quota argv 保存在同一局部元组，保留独立语义断言。

具体改动

规范依据：docs/status-data-contract.md，版本 ef77d9064607dfc69edd3f21926dc4c22126c44b。同时核对 accepted RFC docs/architecture/rfcs/goal-instance-identity-and-orphan-recovery-v0.md 的 Invariant4 和“component fixtures may precede activation”边界，以及现有 registry codec；本次不宣称完整 RFC 激活验收。

关键代码讲解

1. test_real_cli_frontier_preserves_canonical_counts_after_display_loss：state_file_missing 已实现。缺文档时明确要求拒绝运行，同时维持12个 open、12个 ready successor 的完整计数，薄显示仍只有1条。恢复原文档字节后重新检查通过；provider 丢失拒绝 fallback，原 provider 恢复后又读回原任务，没有重建文档。
2. test_exact_source_checkpoint_commits_only_for_the_current_goal_instance：source_session_v1 仍被真实 generic reader 拒绝；只有底层夹具的晚绑定读取显式适配。idempotent_replay 保持已提交 index 字节不变、零扣额；stale_goal_instance 在同别名新实例出现后拒绝旧补记，旧 index 不变，原 GoalRef 和 settlement identity 断言保留。

整个 diff 是两个既有测试文件 +53/-7；生产文件没有改变。已逐项核对当前 PR body、完整 diff、DCO 提交和远端 head，未引用私有原始日志。

对主干的风险

最强反例是“测试变绿但守卫被绕过”：本次直接调用未修改的 generic reader 验证协议拒绝，并用 typed should_run=false 与 normal_delivery_allowed=false 验证缺失意图的停止分支。原实例 replay、重建实例拒绝和恢复后成功避免把任意错误当正确负例。读取适配明确只属于组件测试，不证明整个生命周期 profile 可以执行。

完整 checkpoint fence、frontier counts、checkpoint read-context、canonical status 四族221项通过；另有 registry denial、replan-context evidence、registry codec 三族57项通过。原生 standard premerge 的5项直接检查与6项选中 canary 全过，Ruff、编译、双语/差异和显式公开边界扫描通过。按当前 wait_for_ci=false 未查询或等待 CI。完整 Python、已安装 App、真实模型及发布资格没有重跑；历史失败和未完成记录保留。

我的整体评价

APPROVE，精确 head 44ee9ca6101c56d30809378b3f0e34e1cbc1ec31，未发现阻塞项。long_horizon=preserved：原 Goal 实例/Turn 重放边界保留，不允许旧写入者落入新实例；user_experience=preserved：没有界面、配置或提示变化，也没有新人工确认步骤。此修正恢复了可用的回归验证，并保留必要拒绝和恢复，不等于整个父目标或发布验收。

代码量与问题相称；复用原测试 owner、真实 CLI 和 typed writer，没有新增 vocabulary、状态合同、provider 或生产兼容机制。生产兼容迁移不适用，PostgreSQL store 集成不由这份零生产改动触发。剩余最强验证缺口是整套仓库及发布/已安装路径；它们按各自现行验收继续。此结论需与独立的原生 merge-readiness 和既有合并授权一起使用。

English verdict: APPROVE — 44ee9ca6101c56d30809378b3f0e34e1cbc1ec31. The two existing test families now preserve missing-intent/profile refusal, complete canonical counts, provider recovery and exact-instance idempotent checkpoint fencing.278 focused tests and native premerge pass; no production change, full-suite, installed-App or release qualification is claimed.