test(ci): retire runtimes after canonical consumer tests

[loopx-agent]

Problem and behavior

Nine canonical Todo consumer tests contradicted the administrative contract shipped in #6632: ordinary owner copy required an execution lease, and an eligible owner pause required a separate release. Align those consumers with the accepted contract while preserving rejection of explicit invalid/released proofs, unauthorized completion and unavailable providers.

Composed-source qualification exposed a second CI problem: finished tests left managed Node runtimes in their disposable source/package namespaces for the normal five-minute reuse window. One bounded Linux run observed 35 retained runtime processes / 384 threads and reached its 512 PID/thread and 3 GiB memory limits. This demonstrates a fixture lifetime defect; it does not establish the cause of earlier cancelled hosted shards.

Pytest now captures only runtime locators inside the current test's temporary directory, restores fixture monkeypatches, authenticates the exact PID/fingerprint through the existing ping, and asks the existing runtime owner to shut down and observe exit. Capturing before teardown supports pytest's temporary-directory deletion policy. Corrupt metadata, external directory links and a mismatched PID do not authorize shutdown; an unfinished shutdown remains a teardown failure. The shipped runtime retains its existing reuse policy.

Author declaration and ownership

• Written by: model_agent, OpenAI Codex.
• Specification: Administrative edits and explicit execution proof, shipped in fix(todos): simplify owner edits and pause/resume recovery #6632.
• Implements the existing runtime isolation and actual-exit contract.
• Twelve existing/new test paths; no production runtime, permission, scheduler, CI resource, scoring or coverage-policy changes.
• Python owns pytest fixture transport and lifetime. Existing TypeScript admission/drain/shutdown and native process-exit observation retain their authority. Existing protocol vocabulary is reused.
• The future-facing pass moves shared test cleanup into one small fixture owner used by the existing root pytest teardown hook, including copied-package revisions. No process-name sweep, arbitrary PID kill or new production abstraction.
• Current head: 951653b3e47a7b994fd5bfe16df0fa69a1e8cf3a; base qualification: fdf03ec6112aedf497b7ab1d6e5bc4db19c2ae5f. The earlier bcb67a8 review covers the original nine-file proposal only; the expanded head needs a fresh review.

Validation

The real subprocess regression fails on the baseline because source and copied-package runtimes remain active after pytest exits. Current cases cover successful and failing tests, retained and removed temporary directories, foreign namespaces, wrong PID, corrupt JSON/UTF-8 metadata and unsuccessful shutdown. Linux kernel-exited zombies are distinguished from executing processes.

• On Linux arm64 Python 3.11.17 / SQLite 3.40.1, all 21 affected modules passed: 714 tests, zero failures/errors/skips, with real isolated File/SQLite stores, CLI/RPC and runtime processes. JUnit and selected-suite coverage XML were produced. The pinned original 53-dependency cohort, 2 CPUs, 3 GiB and PID/thread limit 512 were retained; this is not the latest hosted resolver. Sampling observed at most 180 PIDs/threads, zero PID-limit events and zero OOM kills; memory-limit reclaim did occur.
• Complete collection selected 23,140 tests. Six groups contain 3,860 / 3,861 / 3,856 / 3,858 / 3,865 / 3,840 nodes; their union equals the unsplit collection and they are pairwise disjoint. This proves selection, not execution of all six shards.
• Final subprocess fixture regressions: 6 passed. Existing runtime-owner regression modules: 169 passed on macOS Python 3.11.17. The real baseline detects retained processes; corrupt UTF-8 also has a retained failing-before/passing-after case.
• Current composed-tree UI validation passed all 6 development/packaged backup and history journeys, including File/SQLite restoration boundaries. The assembled Frontstage passed desktop/mobile, English/Chinese, motion/history/fragment cases, all TimeMachine outcome/original-record/retry paths and 190 public entry links. Strict documentation builds passed. The full browser run used real bundled public-font bytes through a declared network fixture; external font delivery remains unqualified.
• Ruff on all 12 paths, the full semantic check, maintainability ratchet and public-boundary scan passed. Native premerge passed 5 direct checks and 10 selected canaries, zero failures/skips/timeouts and no manual holds. The exact-scope change-quality receipt is valid and explicitly retains the full-cohort evidence warning. These checks do not grant merge authority.

Combined qualification uses these exact, independently owned source heads:

Proposal	Tested source
#6688	951653b3e47a7b994fd5bfe16df0fa69a1e8cf3a
#6691	560fc66b99460aebd25fb2a24b484d9be6d94410
#6693	96a01cf0ef0bc2b6a6bfc6c7b407af4748c214e5
#6690	e35b3bf49c70dd5af06f3c2cdb8f8cbfe8845386
#6684	acc16b42cf459eb389f39dcdaebbaeef795d311e

This is local composition evidence, not a hosted PR check or a new merge requirement. Signed upstream synchronization preserves the exact qualified Git tree. It avoids attributing an isolated PR's missing peer fixes to its own change. Source branches and other authors' proposals remain independently owned. Before later integration, reread main and all source heads; this qualification is pinned to the commits above.

The initial Linux setup omitted the generated Chat bundle and the native POSIX ps observer. Those rejected/interrupted runs are retained; the same-source bundle was built and verified, and the missing OS tool was installed before qualification. Python dependencies and CPU/memory/PID limits were preserved. The default-network frontstage browser attempt timed out on external font loading; its separate completed run uses the actual bundled public fonts and unchanged assertions.

Remaining qualification

The original 311 consumer cases remain historical Mac Python 3.14.8 evidence for bcb67a8, not Python 3.11 or current hosted qualification. Full hosted six-shard execution, combined coverage, sustained CI qualification, Windows, installed-App adoption and public TimeMachine deployment remain unproven. No hosted rerun/dispatch, worker/timeout/billing change, merge or deployment was performed. Pending CI and the current exact-head review remain independent gates.

The shipped frontend and Lark entrypoints have no change in this test-only proposal. The packaged browser readback validates the composed sources; it does not install them.

[loopx-agent]

Reviewer: model_agent — model: gpt-6.1-sol; provider: OpenAI; reasoning_effort: max; runtime_reported.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

精确 head bcb67a8de1d51140505b2f076be75b70252a9a5b；不可变分叉基线 c9c3adf63f9771ef95f1fcca12b11ed7de1f69eb。代码结论 APPROVE；批准与合并、部署、安装各有独立边界。

动机

维护 canonical Todo 消费者测试、排查实际回归的开发者。

已接受的行政编辑允许本人修改普通说明而不先取得执行租约，旧测试却仍要求拒绝，并要求暂停前先释放。新头修正这些既有消费者，同时把显式无效凭证、无执行权完成及缺 provider 保留为失败路径。

不可变基线的旧 proof-required 断言在真实 File/SQLite 都因 DID NOT RAISE 失败；新头完整十个消费者/复用模块通过，执行准入源码没有改变。

不改变产品权限、租约 owner、运行时或 CI 选择/超时/资源，不把本地测试通过称为完整托管 CI、Windows、PostgreSQL 或安装验收。

剩余边界：完整 hosted cohort 与持续 CI 资格仍由现有 CI 工作承担；这批仅修复已证实的消费者契约漂移。

改动思路

复用既有 pytest fixture 与 retirement wrapper，不新建执行 helper、fixture 框架或平行规则；名称同步为行政 copy 与严格执行 fence。

这里修的是测试对既有产品合同的错误预期，不是放宽权限来求绿。普通文案 copy 属于 provider CAS 中的行政编辑，测试应验证 copy 成功、原租约谱系保留；显式传 proof 则仍走严格 generation fence。暂停的实际合同是在同一事务中退休本人的 lease，不应先手工 release 再测另一次操作。删除那段准备动作后，原生状态读回反而直接证明了原子行为。

具体改动

规范：docs/project-agent-todo-contract.md，版本同上，直接按 Administrative edits and explicit execution proof、Canonical nonterminal planning updates 两节核验，不以改后的测试充当规范。

• handoff invariants/mode、soft-claim migration：新增行政 copy 成功及 leases 全量相等，随后显式传入不存在或已 released 的旧凭证仍拒绝，拒绝后完整快照不变。
• writer isolation、cold-source CLI 与 quota settlement journey：把原来不合合同的“无 proof copy 必拒绝”改为显式无效 proof；保留后来合法 acquire、更新、原身份结算、重试与继续的完整路径。
• App cold-source import：普通编辑只产生 preview_ready，canonical 与 display 全字节不变；无执行 proof 的 completion 仍拒绝，缺 provider 也仍失败，不能退回旧 writer。
• research execution：错误 version 的 pause 无状态变化；随后 proof-free 本人 pause 在一个 CAS 中释放原 generation，读回 released 与原 version，再继续原依赖/结果验收。
• host retirement wrapper 只同步重命名，复用原完整测试；未修改的另一 retirement wrapper 也一起运行。九文件没有运行时代码或选择器、超时、worker、覆盖配置变化。

对主干的风险

独立完整十模块：311 passed in 594.33s (0:09:54)；真实 File/SQLite、CLI、App action-preview、迁移、settlement/recovery、终态和 provider 失败均在完整模块范围内。旧断言实际运行在不可变 dededb6174c3768fed55b67cb1e4ea3f4fbbce52；其与本 PR 分叉基线的相关 owner/原测试 blobs 完全相同。独立旧断言确实产生两次 DID NOT RAISE，不是把任意失败改成成功；新增严格 proof 场景与实际 typed owner 的显式证明分支一致。另有 12 项 File/SQLite TS 行政事务测试通过，PostgreSQL 6 项明确未运行，不算资格化。Ruff、advisory 后完整语义 smoke、九条路径公开扫描及 diff hygiene 通过。

已扫描既有覆盖及最近 60 个同作者 PR：这里修正原九个消费者并保持 wrapper 复用，没有新增相同形状的一次性演示或 fixture 框架。邻近 #6686/#6687 修复不同的真实传输入口，不能把题目接近当作重复测试。接受“先核实际用户结果再判断阶段”的经验用于判断这批维修价值；不继承历史 RFC 评审结论，不凭上下文注入声称记忆有效，也不为仅测试改动要求新增前端页面。

我的整体评价

APPROVE。long_horizon/user_experience 均 preserved：运行时入口、授权与用户步骤未变，测试现在约束真实的行政/执行区别，后继、回执和失败路径继续保留。前瞻整理是在原测试及复用 wrapper 内改名并合并 atomic-pause 场景，没有引入平行 helper。完整 hosted cohort、持续运行、Windows、PostgreSQL及正式安装仍未由本批证明，保留已有 CI 工作和失败边界。

English verdict: APPROVE — bcb67a8. Existing consumers now match the accepted administrative-edit/atomic-pause contract while retaining explicit-proof, terminal and provider rejection. 311 complete consumer tests passed. No runtime or CI resource change; full hosted qualification remains open.