refactor(control-plane): unify effective lease inspection in TypeScript

[huangruiteng]

Goal And Delivered Outcome

Related to #4574 R5 and the shared-authority / TypeScript migration RFCs; base: main.

task-lease inspect interpreted lease time and assembled owner diagnostics in Python after reading canonical state. An archived-open Todo with a retained active lease could appear executable, while malformed active expiry silently appeared inactive. This PR puts the complete existing inspection entrypoint under the TS lease owner and reuses mutation admission's Todo/lease facts and rejection precedence.

• Archived records cannot make execution effective; malformed active expiry returns corrupt_lease on both storage routes.
• Registration receipts and the promotion fence are revalidated; source changes retry at most three host attempts, without legacy fallback after promotion.
• Legacy inactive reads avoid full Todo projection. TS requests those facts only for a time-active lease and re-reads the lease afterward. Canonical inspection transports one lease result instead of the complete head through Python.
• Public CLI options and ordinary result fields remain unchanged. These are observations, not grants or mutation-time proofs.

Scope And Continuation

Complete for the existing inspection API, its CLI, shared diagnostic adapter and File/SQLite/service-injected PostgreSQL reader. This intentionally fixes diagnostic semantics; it does not change default providers, persist new state or promote an active Goal.

#4799 and #4816 are now integrated. Remaining caller/external-effect fences, consumer recovery (#4823/#4827), contributor-owned SQLite D2 (#4224/#4778), integrated migration acceptance and default onboarding retain their RFC gates. Inspection can be reviewed/reverted independently of those packages. Python remains the source/transport adapter; legacy writers and unrelated Python runtime owners are not declared retired.

Validation

• Reviewed head: 4fb3501009b4b5723c9fee1421a554b93077d5cc.
• Run state: finished.
• Input classes: synthetic, public_fixture, authorized_private_read_only.

Check kind	Result	Evidence / limitation
integration / real_backend	passed	432 focused TS tests, including the complete real PostgreSQL store suite on an isolated PostgreSQL 16 server; no skips. Final inspection checks: 12 tests across legacy/File/SQLite/PostgreSQL and native/imported heads.
real_entrypoint	passed	191 Python lease/CLI/acquire/renew/lifecycle/authority/visibility tests; final inspection transport checks: 25 cases. CLI JSON readback matches the API.
regression_parity	passed	Four archived-open/malformed-expiry cases fail at immutable baseline and pass with this change. Registration churn, route changes, release between deferred phases and missing provider reject stale or invalid observations.
real_backend / regression_parity	passed	Authorized frozen snapshot: 1010 Todos, 9 leases. Thirty legacy/File/SQLite observations match baseline through Python and actual CLI; ten PostgreSQL observations match. Source snapshot and canonical heads remain unchanged. Private input stays local; public complex fixtures reproduce semantic boundaries.
integration	passed	Premerge Canary: 19 selected checks passed, zero failures or manual holds; exact-scope quality receipt verified.
static	passed	Control-plane typecheck, configured mypy (22 sources), focused Ruff, compile and public/private diff scan.
integration	not_run	Optional PostgreSQL HTTP-service deployment is unchanged and not supplied. Real store and service-factory injection are tested; HTTP/auth/deployment are not claimed.

The broader pre-refinement TS run had 2410 passes and the one optional HTTP-service skip. Final focused checks above cover the subsequent lazy-inspection and transport refinements. Test counts from separate runs overlap. The final head also integrates an unrelated installer fix; its contents do not alter this inspection boundary.

Same-input local medians were approximately 7→35 ms for inactive legacy inspection, 298→283 ms for File and 274→259 ms for SQLite; these are observations, not a fleet latency claim. The initial eager legacy implementation took approximately 984 ms and was replaced by the demand-driven path. Active legacy inspection can require two native calls.

Frontend / Visual Evidence

UI impact: none. Caller inventory resolves the changed public inspection API to the existing task-lease CLI; its JSON/text contract and error readback are exercised. No frontend, Lark capability editor, provider setting or activation surface is added. Goal Channel ownership observation retains its separate display contract.

Shared-authority RFC fixture impact

Reuse loopx_coordination_production_scale_fixture_v0 and the existing generator. Extend the inspection test's mixed head with retained archived-open, missing, expired, released, closed, excluded, claim-conflicting and unregistered-owner cases, preserving unrelated work history. Independent expected diagnostics run on all three real stores with native/imported Todo shapes; legacy files additionally cover orphan history. The read-only rehearsal does not qualify D2 soak, default cutover or PostgreSQL service deployment.

All commits are DCO-signed. Private snapshots, runtime state, raw logs and local paths are excluded. Maintainer merge required.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewed exact head: 4fb3501009b4b5723c9fee1421a554b93077d5cc。本次是完整 inspection 边界的交付，不代表 #4574、默认 provider 或整个 Python retirement 完成。

动机

旧 task-lease inspect 在 Python 解释租约时间、组合诊断。虽然 owner 拒绝顺序已有 TS owner，事实准备仍与 canonical mutation 不一致：归档但保留 open 状态的 Todo 可以令旧租约看似有效；active 到期时间损坏被当成正常失效。四个 File/SQLite 基线反例可稳定复现。

改动思路

沿用现有 task-lease owner，把完整读取交给 task_lease_inspection.ts。复用 canonicalLeaseTodoFact、canonicalTaskLease、leaseIsActive、provider identity 和 source receipts；leaseOwnerConstraint 由同一个拒绝规则派生字段。Python 保留来源投递、响应校验和有界重试。没有增加 provider、持久化 phase、授权或默认切换。

具体改动

• inspectTaskLease 在一个 provider head 中读取 Todo、lease、mode，前后校验注册来源与晋升 fence，provider 不可用时明确失败。
• Legacy 先由 TS 判断是否 time-active。仅在需要资格判断时请求完整 Todo projection；最终阶段重新读 lease，防止中途 release 后仍报告有效。已失效检查不解析完整工作历史。
• inspect_native_task_lease 校验阶段响应与最终 provenance，最多三次来源重试；旧 Python inspection body 和按 reason 拼字段的逻辑被删除。仍有调用方的文件适配器和 legacy writer 保留。
• leaseOwnerConstraint 用分支返回关联的 reason/字段，复用 mutation 的拒绝顺序。运行时 dispatch 和现有 CLI 接通完整链路。
• 两个测试文件覆盖真实 CLI、缺失/损坏展示、空 canonical lease、归档历史、腐坏时间、注册/路由竞态、两阶段之间 release、无写入和复杂混合 head。操作文档及两份 RFC 的中英文检查点同步更新；无需新增 UI，因为现有 inspection caller 是 CLI，Goal Channel 的观察语义保持独立。

对主干的风险

行为变化已明确披露：归档历史不再提供有效资格，损坏 active expiry 返回 corrupt_lease，持续来源变化报错。普通结果和 CLI 参数保持兼容。读取不是后续执行的授权，仍可能在返回后过期；mutation 必须验证当前凭据。

代价是失效 legacy 读取增加一次 TS 调用，活跃 legacy 可能两次。相同输入的局部测量约从7ms到35ms；最初接近984ms的 eager Todo 解析已移除，不作整体性能提升承诺。没有新持久化格式，回滚无需数据迁移。

验证：432项相关 TS 测试（含独立真实 PostgreSQL16 全套 store 集成）、191项 Python 回归通过；最后两处 refinement 后在最终 head 重跑12项原生 inspection与25项 Python inspection，全部通过。1010 Todo/9 lease 的授权只读快照在 legacy/File/SQLite 的 API+真实CLI上有30次普通语义对比一致，真实 PostgreSQL另10次一致；私有输入不公开，合成 fixture 可复现边界。四个旧主干反例失败而新实现通过。静态检查、精确质量回执和19项 premerge检查通过，零失败/人工 hold。

较早完整 TS 套件2410通过、1项可选HTTP服务集成跳过；最终必需的数据库/reader验证无跳过。PostgreSQL HTTP/auth/deployment、真实 Goal 晋升和长程 soak 未在本 PR 交付。按当前 review policy wait_for_ci=false 未查询远端CI。

我的整体评价

APPROVE：未发现阻塞问题。实际收益是让现有检查入口和 mutation 复用完整的时间/事实/资格边界，消除误导诊断及 Python 重复知识。保留必要的 legacy 存储适配，避免为删除 Python 而扩大迁移范围。#4799/#4816 已集成；剩余 executor effect fence、消费者恢复、D2和最终默认切换按原 RFC 验收。此 runtime PR 留给维护者合并。

English verdict: APPROVE - head 4fb3501009b4b5723c9fee1421a554b93077d5cc. Shared TS inspection fixes archived-holder effectiveness and corrupt-expiry handling, with source revalidation and a tested lazy legacy path. Real CLI/File/SQLite/PostgreSQL, failing-before regressions, exact-scope quality and 19 premerge checks pass. No default cutover or PostgreSQL service-deployment claim; maintainer merge required.

[huangruiteng]

Merge-readiness recheck — exact head 4fb3501009b4b5723c9fee1421a554b93077d5cc

The existing detailed APPROVE conclusion is still valid for this exact head, and there are no unresolved review threads. This is a bounded readiness update, not a duplicate review.

loopx pr-review --check-merge-readiness 4829@4fb3501009b4b5723c9fee1421a554b93077d5cc currently returns ready=false because GitHub reports merge_state=BEHIND (merge_state_requires_update). Update/rebase the branch onto current main; the resulting head is a new exact head and must be reviewed and qualified again before merge.