test(migration): characterize source stop and lease drain

[loopx-agent]

Preparing a planned Agent transfer must distinguish stopping automatic advancement from excluding old execution and settling its leases. A stopped Goal still permits an already admitted Agent to write back; withdrawn membership makes a retained lease ineffective without releasing it, so restoring membership can make it effective again.

Add a real CLI regression on canonical File and SQLite that composes ordinary bootstrap, peer configuration, an independent Git worktree, Goal stop, warm/cold mutation rejection, exact cleanup after withdrawal, and membership recovery without reviving a released proof. The bilingual reference explains those existing boundaries and their relationship to the planned-transfer proposal.

This is preparatory characterization for the transfer composition. Production behavior is unchanged; portable packaging, destination admission, continuation of the unfinished task, and the initiating frontend journey remain unimplemented. It does not ask users to assemble a migration from these commands.

Validation:

• 151 related source tests passed; the final added cases were rerun after adding the membership-restoration control.
• The final cases passed outside the checkout against a normally installed wheel. Five affected owner files match the current baseline byte for byte. Removing native registration rejection in that disposable installation made both provider cases fail; restoring the exact file made both pass again. This is affected-owner installed evidence, not full newest-main package qualification.
• Ruff, configured mypy, semantic-vocabulary drift, public-boundary scan, and diff hygiene passed. Exact-scope premerge passed 4 direct and 12 selected checks with no warnings or manual holds; CQR is valid.
• Frontend/Lark, PostgreSQL and a complete source-to-destination migration were not exercised or changed. Existing migration and long-running qualification gates remain open.

The related refactor pass retained the existing typed owners and one local test trace; no new production wrapper, schema or parallel decision source is needed for this batch.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval). Exact head 6ee8f37353f7865534c2e477891e30f24b59e38e.

动机

负责把正在工作的 Agent 迁往另一环境的实现者，需要判断源端何时才能安全交接。以前缺少真实入口的组合回归，容易把 Goal 已停止或租约 active=false 当作源端已排空；现在 File/SQLite 回归直接证明这些状态不同，并拦住放宽成员资格检查的反例。维护者获得可重复执行的源端交接边界验证，避免迁移编排依赖错误假设；现有运行时行为保持不变。本 PR 不提供迁移命令、可携包、目标执行准入或目标 Agent 继续任务。完整计划内迁移及发起入口的继续任务、独立验收和失败恢复仍未实现。

改动思路

同一条真实 CLI 旅程复用既有 Goal activation、peer 配置、canonical Todo 和类型化租约 owner。测试先证明合法源端回写仍可完成，再验证撤回后的热/冷拒绝和精确释放后的恢复；不把诊断字段变成新的执行权威。以下表格是该 head 的已验证边界摘要，不替代执行证据。

操作	原租约记录	执行边界
停止自动推进	保留	已获准回写仍有效
撤回成员资格	仍可为 active	当前成员资格不允许执行；恢复资格可能重新有效
精确释放租约	released	重新注册也不复活原证明

具体改动

关键内容讲解

test_stop_withdrawal_and_exact_release_have_distinct_authority 用普通 bootstrap、独立 Git worktree 和真实 File/SQLite。它同时覆盖 stop 零写预览、原租约保留、合法 note 回写、撤回后热/冷拒绝、拒绝不改 provider revision、未释放时恢复资格、撤回后精确 cleanup，以及释放后旧证明拒绝。configuration-backup.md 新增匹配的中英文解释，并明确进程停止、外部 effect 结果和目标准入尚需各自 owner 完成。

规格依据为 docs/architecture/rfcs/complete-state-recovery-v0.md，不可变基线 f184f13b29011fd33753cb1f49c96d1af9730c09。quiescent、M2、M3 均为 deferred：本批只刻画源端边界，没有证明完整跨 owner 静止/捕获、目标采用或继续任务。该文档中计划内迁移仍是提案，未被提升为已实现接口。现有 request、原 receipt、格式和默认策略没有改动。

对主干的风险

没有 production diff；主要风险是把通过的回归误称为迁移交付。151 项关联源码验证通过，最终新增案例补充成员恢复对照后再跑通过。正常安装包在源码目录外运行同一最终案例；五个受影响 owner 与当前基线逐字节一致，不能据此推断最新 main 整包资格。在仅有测试数据的安装副本移除原生成员检查，两 provider 均在撤回边界失败；精确恢复文件后均再次通过。

配置 mypy、Ruff、semantic drift 和公开边界扫描通过。准确范围 premerge 为4项 direct与12项所选检查，零告警/manual hold，CQR有效。先前 CQR输入超长、测试目录不受 advisory支持和临时report不存在属于验证编排错误，已修正并保留原始结果，没有放松产品阈值。按包内 wait_for_ci=false 未查询或等待远端CI。未验证 frontend/Lark/Host、PostgreSQL、外部 effect 或完整跨环境迁移；这些仍是父旅程缺口，不由本批测试核销。

我的整体评价

本 head 无阻塞发现，结论 APPROVE，交付判断为 justified_increment。long_horizon 与 user_experience 都是 preserved：现行运行时和用户步骤没有变化，得到的是可重复执行且能抓住真实权威退化的组合回归。扫描已有 activation/lease/default 和 TS eligibility/inspection 覆盖及同作者近期批次后，未发现等价组合用例或重复测试系列；本批有独立的源码 consumer 和反例价值。

166行增量局限于一个参数化测试和双语深层参考；相关重构检查保留现成 typed owner，不加包装器或推测框架。下一工作仍是同一完整计划内迁移，从源准备贯通目标准入、继续原未完成任务及发起入口独立验收，不应继续拆成 owner 字段或小测试系列。本条 COMMENTED 自评不等于独立 GitHub approval，不授予 merge 权限。

English verdict: APPROVE — exact head 6ee8f37353f7865534c2e477891e30f24b59e38e. Real CLI/File/SQLite characterization distinguishes stop, withdrawn membership and exact lease release; the disposable installed native-owner mutant fails both cases and exact restoration passes. Whole Agent transfer remains unimplemented; no merge authority is claimed.