fix(task-lease): scope canonical writes by frozen repository

[huangruiteng]

Outcome / 交付结果

Canonical hard leases now freeze the owning Todo's normalized repository identity. Within one Goal, two known, different repositories can acquire the same relative write scope without a false conflict. Same-repository aliases and unknown historical grants remain conservative conflicts.

Canonical hard lease 现在冻结权威 Todo 的规范化仓库身份。同一 Goal 内，两个已知且不同的仓库可以领取同名相对写路径；同仓库别名和未知历史租约仍保守互斥。

Increment and authority boundary / 增量与权威边界

• Reuse task_repository, the existing TS repository normalizer, canonical acquisition/lifecycle decisions and the shared execution fence. Store optional immutable lease.write_repository; no caller override, working-directory inference, new configuration or parallel decision owner.
• Preserve complete-head conflict scans, atomic claim, CAS, owner eligibility, TTL, generations and receipt identities. Legacy absent/null namespaces are never backfilled from a later Todo.
• Reject known repository drift during acquisition replay, current execution proof, renewal/transfer and inspection; exact-key/version release remains available for cleanup. Lifecycle transitions preserve the frozen identity and acquisition history.
• Reuse the shared File, SQLite and PostgreSQL conformance harness and add real File/SQLite CLI acquisition/readback coverage. The Python change is presentation-only; decisions remain in TypeScript.

复用现有 TS 决策与单一权威存储，仅为执行租约增加冻结的逻辑仓库身份；不修改授权、acceptance、扣额或委派职责。旧记录未知时保持原保守语义，仓库漂移拒绝执行但允许精确释放清理。

Validation / 验证

Check	Result
npm run typecheck:control-plane	Passed
npm run test:postgresql-authority-store with isolated PostgreSQL	301 passed; no skips
Lease acquisition/repository production conformance across File, SQLite and isolated PostgreSQL	95 passed; no skips
Lease decision, lifecycle, inspection and repository tests with isolated PostgreSQL	111 passed; no skips
pytest for task lease, native CLI and canonical inspection	62 passed, including real File/SQLite CLI repository readback
Same real CLI counterfactual on immutable baseline 6669c178b	Both File/SQLite cases reject the second distinct repository with write_scope_conflict; candidate cases pass
Ruff / mypy	Passed; 20 mypy source files
loopx canary premerge --from-git-diff	Passed: 10 catalog checks, 8 risk smokes, public-boundary check; zero failures
Diff/public-boundary checks	Clean; no private runtime inputs added

Full repository CI remains separate from these locally executed checks. The optional Goal change-quality receipt policy is disabled; native validation was still executed.

User entry points / 用户入口

CLI JSON inspection and Markdown readback expose the same write_repository (or explicit conservative unknown). Real acquisition followed by both readbacks was verified against File and SQLite; inspection does not advance authority or rewrite obsolete display files.

This patch adds no configuration control and does not change the existing Todo repository editor. It is a bounded CLI/native lease prerequisite, not completion of the broader frontend/Lark collaboration journey or automated managed-worker dispatch; that companion work remains separate.

CLI JSON 与 Markdown 已真实读回验证；无新配置项。完整前端/Lark 协作旅程、自动委派及金融最小闭环不在本 PR 完成范围内。

Scope and documentation / 范围与文档

This is a Goal-local logical repository mutex, not a physical filesystem/symlink alias detector or a cross-Goal lock. The bilingual contract is documented in docs/reference/canonical-lease-renew.md. Review and maintainer merge are required for this runtime/control-plane change.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

精确评审提交：036e2e17fb7cf06c0583e3743a8b9ccd6f588f92。未发现阻塞本切片的代码问题；这是可独立验证的租约修复，不是整个 managed collaboration 的完成声明。

动机

旧规则把同一 Goal 内的相对写路径当作同一资源。真实 File/SQLite CLI 的相同输入在不可变基线 6669c17 上均于第二个不同仓库领取时返回 write_scope_conflict；候选版本可以领取并独立读回。这消除的是无关仓库之间的等待，不把新增字段或测试数量当作父目标已完成。

改动思路

沿现有 canonical Todo、TS 决策、CAS 和回执边界扩展，而不是添加另一套协调表。task_repository 是已有工作声明；write_repository 在合法新领取时冻结为执行身份，随后不能从可变 Todo 回填。只有双方已知且不同才隔离，相同仓库、大小写别名和未知历史记录仍互斥。直接取消 scope 检查过弱，直接读取当前 Todo 会改写旧执行的含义，因此保留冻结快照是必要的最小增量。

具体改动

关键代码讲解

• task_lease_repository.ts 的 leaseWriteRepository 复用原有仓库 normalizer，但冻结字段必须已经规范化；它与 overlap、drift 两个函数共同维护未知保守、别名互斥和漂移拒绝三条规则。
• task_lease_acquire_decision.ts 的 decideTaskLeaseAcquire 保留 owner、version、TTL、同请求重放和完整扫描，仅在 relative scope overlap 前比较冻结仓库；materialize 使用决策产物，而非调用者覆盖字段。canonical facts 和 atomic claim 复用同一路径。
• lease_acquisition_proof.ts 的 currentLeaseAcquisitionProof 同时检查当前 grant 与原回执身份、当前 Todo 与冻结值。共享 terminal fence、renew/transfer 和 inspect 消费相同规则，既有 owner 拒绝优先级保留；release 仅用于精确清理。

类型与 lifecycle fact codec 传递字段，不新增 Python 决策。Python 的两行改动仅用于 Markdown 展示，JSON 仍来自同一投影。四个测试文件覆盖三种真实存储、旧记录、非法字段、完整扫描、领取/重放/续租/转交/释放，以及真实 File/SQLite CLI 的 JSON/Markdown 读回。双语文档说明逻辑仓库、历史兼容及非目标。最终补充了漂移拒绝→精确释放→新 key 领取→有效 proof 的完整恢复断言。

对主干的风险

最危险的情况是利用命名空间绕过同仓库互斥，或把历史回执重标为新执行。本次测试验证了大小写别名、未知 holder、调用者 override、损坏字段和 Todo 漂移均不能获得这类权限；拒绝不写新 head，原回执不改。恢复测试曾错误假设 release 会递增 version，已按现有保存版本的契约修正测试，未调整生产逻辑。

语义与 CI 对齐

采用既有 Todo/lease 语义和 TS 单一 owner，新增 optional snapshot 而非协议版本分叉。最终 head 的 typecheck、隔离 PostgreSQL 301 项无跳过和完整 premerge 均通过。另有 95 项 acquisition、111 项 TS lease、62 项 Python/真实 CLI 验证；末次提交只增加 TS 恢复断言，生产和 Python 文件未变，旧证据的假设已重新核对。精确 packet 要求不观察远端 CI，本评审未轮询 CI，也不将这些局部检查声称为全仓库全部测试。

JSON/Markdown 已真实交互验证；无新配置控件。完整前端/Lark managed dispatch 仍是独立 companion 交付。本修复只是 Goal 内逻辑仓库 mutex，不保证物理路径、软链接或跨 Goal 的排他性；未知历史 grant 仍需合法退役后才可获得已知身份。

我的整体评价

APPROVE：long_horizon 的独立工作与合法恢复能力改善，user_experience 的领取和真实读回改善。338 增、6 删中大部分是测试与双语契约；生产机制是小型共享 codec 和既有 facts/fence 传播，无平行状态库或授权入口。收益有相同真实 CLI 在旧版本失败、候选通过的反事实证据，不依赖元数据或 green CI。采用已有语义、保留实际历史存储兼容，边界与剩余风险明确。仍需独立维护者评审及合并、安装后再做 managed caller 验收；本评审不执行自合并，也不宣称金融最小闭环已达成。

English verdict: APPROVE - 036e2e1. The frozen repository namespace removes demonstrated cross-repository false conflicts while retaining unknown/same-repository fences and immutable execution lineage. Real CLI baseline/head comparison, three-provider recovery, 301 PostgreSQL tests and premerge validate this bounded increment; full managed/frontend/Lark delivery and maintainer merge remain separate.