test(coordination): restore Stage2C priority and recovery oracles

[loopx-agent]

Goal And Delivered Outcome

After #6539 adopted default P1 priority, the Stage2C CLI/cold-import jobs still expect undecorated fresh Todo text. The mutation lane consequently stops because its unchanged runtime-root oracle is already red. These are substantive job failures even though that workflow later reports cancellation.

Align the four existing Stage2C modules with the shipped contract: new creations, ordinary edits and imported fresh records retain P1, and the assertions check both text and priority. Reuse the existing fixture identity normalizer for lease-effect paths, replacing one incidental generated ID with the already-declared todo_b placeholder. Complete effect dictionaries still distinguish the requested target from other IDs or extra writes.

A release-head qualification also exposed an intermittent outbox_pending result in the unchanged sequence-recovery scenario, after both lease receipts were present. The scenario now performs the documented explicit authority-shadow drain and requires zero pending/prepared residue before qualification. The production inline drain remains bounded; no timeout, budget or qualification rule changes.

Author Declaration

• Written by: model_agent — OpenAI GPT-6 (Codex).
• Specification: Todo priority intent at the base revision, adopted in fix(todos): default new work to P1 and preserve successor priority intent #6539; existing parity fixture target-identity contract; documented explicit outbox recovery.
• Criteria: default P1 and retained priority across edits/imports; exact lease target and effect; existing fence, receipt, replay, crash-window and byte-preservation invariants. Implemented in the existing scenarios and validated below.
• Intended base: main.

Scope And Continuation

Complete as a repair of the current Stage2C oracles. All existing cases, deadlines, failure/authority guards and production code remain. The related simplification reuses the current readback and existing identity normalizer; no helper or protocol is added. #6396 independently retires these legacy paths; this patch keeps the currently shipped qualification usable while that proposal remains separate.

Validation

• Tested revision: 08215766bc7635b869f7776931a6be3118d209c0; base 81ff72b64d2c8b7872a25908dedf199edb31eac3.
• Diff requalified against latest main ee5777bcd57015781e5295ab9ea1a46720605f3b: fix(lark): collect card callbacks without a duplicate IM stream #6550 changes four unrelated Lark paths. The author head and five-file diff remain unchanged; the tested fork is 81ff. This does not qualify the combined latest main.
• Run state: finished. Input classes: synthetic, public_fixture.

Check	Result / evidence
Same four complete Python modules	Original P1 baseline: 28 failed / 65 passed. The intermediate release head had one outbox_pending failure / 92 passes; a full unchanged repeat passed but does not erase that failure. Final explicit-recovery candidate: 93 passed, no skips/errors; the original case set is identical.. Real CLI/File/SQLite, interrupted writes, copied cold receiver with original producer modules absent; disposable state only.
Existing rollout_cwd_root mutant	Unchanged control passes; wrong-runtime-root mutant is killed by assertion, with no import/setup/timeout failure.
Shared fixture / priority TS consumers	todo_priority.test.ts and legacy_writer_fence_caller_parity.test.ts: 30 passed, no skips/cancellations.
Explicit recovery negative	Zero-budget public drain leaves a committed pending entry and qualification refuses; explicit default drain clears residue, preserves exact unique lease sequences 1/2 and qualifies.
Manual identity probe	B matches; A/C/unknown IDs and an extra-file effect remain unequal. Test-helper evidence only.
Static / boundary	Ruff on four changed Python modules, diff checks and five-file public scan passed.
Exact qualification	CQR cqr_8cf78df65838558ec444 passed and verified valid (five files, one bounded safe-fix pass, no remaining risks).. Goal-bound premerge passed: three whitespace checks and Python compilation; zero catalog canaries selected and no failures or manual holds.. The real-path suites and mutation probe above cover the changed oracles.
Broader hosted CI	Remains unqualified. The separate Windows retirement failure, complete six-shard outcomes, sustained operation and maintainer adoption remain open.

The version-only 1.4.2 release preparation was integrated before final qualification; this is not a claim that 1.4.2 is released. The pending-residue cause was not recovered from the expired temporary directory, so no runtime root cause or sustained drain performance is claimed.

No performance improvement is claimed from the before/after durations: passing scenarios execute later assertions that the failing baseline did not reach. No active Goal, hosted rerun/dispatch, runner allocation or billing setting is changed.

Frontend / Visual Evidence

UI impact: none; test oracles and one synthetic fixture only.

Type / Area

• Test update
• Build, packaging, installer, or CI

Boundary Checklist

• Public-safe diff/body; no private state, logs, local paths, credentials or benchmark execution.
• Existing cases, failure guards and deadlines retained.
• Production defaults, permissions and authority owners unchanged.
• Every commit includes DCO sign-off.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval). Exact head 08215766bc7635b869f7776931a6be3118d209c0.

动机

维护当前真实 CLI、冷导入和恢复测试的贡献者，以及依赖这些检查判断升级安全性的维护者。新 Todo 已默认 P1，但旧测试仍期待没有前缀的文本，导致测试在真正验证后续恢复前就失败；另一条租约效果断言写死了偶然生成的 Todo id。同一批现有场景能按当前优先级合同继续验证后续写入、恢复与权限边界，效果比较仍严格区分目标和额外写入。本 PR 只修复既有资格测试的期待值和显式恢复前置，不改变生产规则，也不宣称完整主线或持续运行已经合格。

改动思路

先按合入前已存在的 Priority intent 和 Drain before promotion 判断预期，再看实现。不能为了通过测试删掉优先级含义，也不能用任意 id 掩盖写错对象。沿用原有四个完整场景和同一条 typed owner，不新增兼容分支、测试框架或生产重试。这个变化用下表即可说明，无需另造流程或状态。

边界	旧断言的问题	当前约束
新 Todo 与普通编辑	仍期待无优先级文本	文本和 P1 同时断言
租约文件效果	写死一次生成的 id	只替换声明过的准确目标，比较完整 effect
恢复后的资格	隐含要求一次 inline drain 已全部清理	显式原 owner drain，要求 pending/prepared 都为零后再 qualify

具体改动

default-p1-and-retained-priority：冷导入、普通更新、后继任务和 retirement 请求继续验证完整文本，同时明确 P1；历史记录与后续写入/重放断言保留。exact-target-effect：Workspace.observe 将原有 normalize 用到完整 effect 字典，fixture 只把偶然的文件名换成原已声明的 todo_b 占位符，列表、数量、目标和额外文件仍逐项比较。explicit-recovery-precondition：丢失 cursor 的 native lease 场景显式调用既有 authority-shadow drain，检查 pending/prepared-only 零残留，再验证原租约 seq 1/2、唯一 entry 和 qualification。

完整五文件 diff 没有生产、超时、评分、权限或默认开关改动。原有功能关闭/开启及 File/SQLite 路径均保留。复用已有 normalizer 是本次有界重构，继续抽象不会减少新的规则 owner，故无需新模块。

对主干的风险

最强风险是测试把错误的写入“归一化掉”或借 recovery 吞掉待办证据。独立负例核对 B 正确匹配，A/C/未知 id 和额外 effect 均不相等；真实零预算 drain 留下待处理项时 qualification 以 outbox_pending 拒绝，显式 drain 后清理残留并保留精确唯一序号。既有 rollout_cwd_root mutation 的不变 control 通过，错误 runtime root 被原断言杀死，没有把导入、语法或超时错误算作杀伤。

精确 head 上四个完整 Python 模块 93 通过、零跳过/错误；共享 fixture 与优先级 TS 消费者 30 通过、零跳过/取消。Ruff、diff、公开边界、严格 scope 质量回执和 premerge 通过；没有查询 PR CI。此前真实出现过 inline drain 留 outbox_pending，原失败和后续不变通过均保留，未推断其运行时根因；当前修复验证的是文档已有的显式恢复前置，不宣称持续 drain 性能已修复。其余主线和完整 release 继续独立验证。

我的整体评价

APPROVE。这是修复已发布默认变更后的既有回归证据，未增加人机操作或影响生产长程路径；完整恢复、后续写入与错误目标约束仍能执行。范围适中、可独立回退，与另行讨论的 legacy retirement 不冲突。批准仅覆盖本补丁；合并仍须维护者既有授权、公开评审读回与即时精确 head readiness，测试数或 green CI 不替代这些条件。

English verdict: APPROVE - head 08215766bc7635b869f7776931a6be3118d209c0. Existing Stage2C oracles now assert shipped P1 semantics, normalize only known opaque identities, and explicitly drain before qualification. Independently verified93 real CLI/File/SQLite cases,30TS consumers, runtime-root mutation sensitivity, exact-target negatives and pending-state refusal/recovery; no production, deadline or authority change. Full release and sustained inline-drain qualification remain separate.