[Bug]: required CI tests compare time-varying todo projections after #6874 - the windows-powershell SQLite exit case plus two test-shard cases #7152

Problem (impact first)

The required windows-powershell job of Python Tests — one of the jobs merge-gate aggregates (.github/workflows/python-tests.yml:1027) — is deterministically red on main at 872b70368. Two cases of tests/control_plane/test_sqlite_authority_cli.py::test_new_default_goal_settles_once_and_returns_current_writes_to_file fail on every run, so merge-gate cannot go green for any PR whose path selection runs the Python Tests workflow:

• current victim: PR fix(chat): isolate unreadable native monitor conversations #7149 (base 872b70368, Python-only change) — job 120426820679 reports 2 failed, 7 passed at the Run SQLite CLI integration step;
• that step is the only place the whole test_sqlite_authority_cli.py file runs, so the lane stays red until the two cases are repaired.

Root cause: #6874 (5705f683e, merged 2026-10-23T03:24:50Z) moved the canonical Todo read into one TypeScript transaction and added projection_envelope to every todo list payload. Its observed_at / served_at / sources[].last_read_at are wall-clock values (readTodo(..., observedAt = new Date().toISOString()) in loopx/control_plane/todos/read_projection.ts:308). The SQLite exit-refusal case proves that a refused authority-archive plan-migration writes no plan and leaves Todos untouched by comparing two consecutive todo list payloads for equality at line 241; the payloads now always differ by those envelope timestamps, so the assertion fails regardless of whether the refusal mutated anything.

The same root cause breaks two more tests that the required test-shard job collects (python -m pytest ... -m "not stage2c_e2e" --splits 6, .github/workflows/python-tests.yml:639-651):

• tests/control_plane/test_canonical_todo_writer_isolation.py::test_handoff_mode_without_source_todo_writers — whole-payload equality against a previous read at lines 188, 196, 200 and 214; reproduced locally as 2 failed in 33.23s at 911e6d5fc with only projection_envelope.observed_at/served_at differing;
• tests/control_plane/test_research_context_adoption.py::test_retained_context_is_adopted_only_with_fresh_current_ownership — whole-payload equality at lines 230, 241 and 261; not runnable on this Windows host (os.symlink raises WinError 1314 before those assertions), so its repair is verified by the producer contract and Linux CI.

Scope boundary: test-shard also carries 10 unrelated failures from the in-progress canonical-authority fixture migration (tests/control_plane/test_truncated_active_state_todos.py 6, tests/control_plane/test_contract_health.py 4 at this head, all CanonicalAuthorityRequired/legacy-Markdown fixtures). This report does not cover that migration; it covers only the envelope-timestamp class, which is independent of it and would otherwise outlive it. Acceptance for this issue: the three whole-payload comparison sites no longer compare the observation clocks and their tests pass; restoring merge-gate additionally requires the separately owned canonical-authority fixture migration.

Why it stayed red: #6874 merged with an already-failing windows-powershell job at an earlier step (Qualify the native Windows CLI output differential, job 120201480586), so its own run never reached Run SQLite CLI integration (steps 21-22 are skipped). Subsequent main push runs were cancelled by workflow concurrency, so nothing exercised the SQLite step on main until PR #7149.

Minimal reproduction

Native Windows, commit 872b70368:

uv sync --extra test
uv run --extra test python -m pytest -q "tests/control_plane/test_sqlite_authority_cli.py::test_new_default_goal_settles_once_and_returns_current_writes_to_file"
uv run --extra test python -m pytest -q "tests/control_plane/test_canonical_todo_writer_isolation.py::test_handoff_mode_without_source_todo_writers"

SQLite cases: 2 failed in 81.26s, both at tests/control_plane/test_sqlite_authority_cli.py:241:

E  AssertionError: assert (not False and {'ok': True, ...: 'list', ...} == {'ok': True, ...: 'list', ...})
E    Differing items:
E    {'projection_envelope': {... 'observed_at': '2026-10-23T13:31:14.855Z', 'served_at': '2026-10-23T13:31:14.855Z', ...}}
E      !=
E    {'projection_envelope': {... 'observed_at': '2026-10-23T13:31:13.579Z', 'served_at': '2026-10-23T13:31:13.579Z', ...}}

Writer-isolation cases: 2 failed in 33.23s with the same only-envelope difference. In both cases not refused_plan.exists() and the row bodies are satisfied; only the envelope clocks differ. At the parent of #6874, d6634f7f3, the same SQLite command reports 2 passed in 97.82s, and that revision contains no projection_envelope producer under loopx/control_plane/todos.

Expected behavior

These tests pass on main and keep proving their invariants: a refused migration writes no plan file and leaves the Todo read unchanged; a handoff-mode dry run/replay leaves the Todo read unchanged. The time-varying observation timestamp is not part of "unchanged rows".

Actual behavior

Whole-payload equality fails on the projection_envelope timestamps, so the required Windows lane fails before its remaining steps and the three tests fail on every run.

Diagnostics

2 failed, 7 passed in 135.47s   # windows-powershell, job 120426820679
FAILED tests/control_plane/test_sqlite_authority_cli.py::test_new_default_goal_settles_once_and_returns_current_writes_to_file[True]
FAILED tests/control_plane/test_sqlite_authority_cli.py::test_new_default_goal_settles_once_and_returns_current_writes_to_file[False]

Additional context

The repository already has the comparison helper for this contract: tests/control_plane/canonical_authority_fixture.py:16-28 (assert_todo_read_unchanged) strips only observed_at, served_at and each sources[].last_read_at after validating them, then compares every other envelope and body fact — strictly stronger than dropping the envelope. The repair replaces the three whole-payload comparisons with that helper; the producer's observation time is the intended contract and should not be frozen.

Preflight: existing issues and PRs were searched for test_new_default_goal_settles_once, sqlite_authority_cli, assert_todo_read_unchanged and projection_envelope; no open issue or PR covers this failure. This is not a security report, and no credentials or private material are included.