[JasonBuildAI]

Goal And Delivered Outcome

• Outcome basis / optional anchor: [Bug]: required CI tests compare time-varying todo projections after #6874 - the windows-powershell SQLite exit case plus two test-shard cases #7152
• Goal/source and gap: main cannot pass the required windows-powershell job of Python Tests for any Python-changing PR, and two more required test-shard cases fail for the same reason. refactor(todos): compose full readback in one TypeScript transaction #6874 (5705f683e) added projection_envelope to the canonical Todo read with wall-clock observed_at / served_at / sources[].last_read_at, while three tests still compare consecutive whole payloads for equality. The repository merged 39 PRs in the last 24 hours and has 29 open PRs; every Python-changing one runs these lanes, and PR fix(chat): isolate unreadable native monitor conversations #7149 is blocked by the Windows lane now.
• Observable before → after, with the validation row that proves it: tests/control_plane/test_sqlite_authority_cli.py — 2 failed, 7 passed at 872b70368 → the file passes; tests/control_plane/test_canonical_todo_writer_isolation.py::test_handoff_mode_without_source_todo_writers — 2 failed → 2 passed; tests/control_plane/test_research_context_adoption.py — whole-payload equality replaced with the same helper (Linux-only on this host, see gaps).
• Issue/task and intended base: Closes [Bug]: required CI tests compare time-varying todo projections after #6874 - the windows-powershell SQLite exit case plus two test-shard cases #7152; base main (e4674e814).

Author Declaration

• Written by: model_agent — DeepSeek Harness with deepseek-v4.1-flash, directed by @JasonBuildAI.

AI disclosure: this change was drafted with AI assistance at my request, under my direction and review.

Implemented against

• Specification and revision: issue [Bug]: required CI tests compare time-varying todo projections after #6874 - the windows-powershell SQLite exit case plus two test-shard cases #7152 ([Bug]: required CI tests compare time-varying todo projections after #6874 - the windows-powershell SQLite exit case plus two test-shard cases #7152) plus the existing read-comparison helper at tests/control_plane/canonical_authority_fixture.py:16-28.
• Criteria:

Criterion (spec clause)	Disposition	Symbol / path	Test or command
A refused migration writes no plan and leaves the whole read unchanged (#7152 expected behavior)	implemented	tests/control_plane/test_sqlite_authority_cli.py:241-245	full file passed
Handoff-mode dry run/replay leaves the whole read unchanged	implemented	tests/control_plane/test_canonical_todo_writer_isolation.py:188,196,200,214	focused case passed
Adopted/resumed research context leaves the whole read unchanged	implemented	tests/control_plane/test_research_context_adoption.py:230,241,261	Linux CI only; see gaps
The volatile observation clocks are not part of "unchanged", while every other envelope and body fact still is	implemented	assert_todo_read_unchanged (canonical_authority_fixture.py:16-28)	same rows

• Self-check before submission: the producer was read rather than assumed — read_projection.ts:308 defaults observedAt to new Date().toISOString() and read_transaction.ts:132-139 copies it into the envelope, so the clocks are observation facts, not row state. The helper validates and ignores only those three clock fields and compares coverage, sources[].item_count and the rest of the body, which is stronger than dropping the envelope. Deliberately left out: freezing or caching observed_at in the producer, which would change the read contract instead of the assertions.

Scope And Continuation

• Completed scope and remaining work: restores the Windows lane's SQLite step and repairs every whole-payload Todo comparison of this class in the required test-shard collection. Boundary: test-shard separately carries 10 unrelated failures from the in-progress canonical-authority fixture migration (tests/control_plane/test_truncated_active_state_todos.py 6, tests/control_plane/test_contract_health.py 4 at this base, all legacy-Markdown/CanonicalAuthorityRequired). This PR does not touch that migration and does not claim to restore merge-gate by itself.
• Slice boundary / successor: complete within this scope; the canonical-authority fixture migration is a separately owned, in-progress program.

Validation

• Tested revision: 808483ad2ffaea47175fdb534b97ccdf48e85ea4
• Run state: finished
• Input classes: synthetic

Check kind	Result	Public-safe evidence / limitation
unit	passed	uv run --extra test python -m pytest -q tests/control_plane/test_sqlite_authority_cli.py tests/control_plane/test_canonical_todo_writer_isolation.py → 19 passed in 475.83s on native Windows at this revision
regression_parity	passed	SQLite cases: 2 failed in 81.26s at 872b70368 locally and 2 failed, 7 passed in 135.47s in hosted job 120426820679 → passes; writer-isolation cases: 2 failed in 33.23s at 911e6d5fc → 2 passed in 86.93s; the pre-#6874 parent d6634f7f3 has 2 passed in 97.82s and no projection_envelope producer
static	passed	python -m ruff check on the three changed files → All checks passed!; loopx canary premerge --from-git-diff --git-diff-base upstream/main → passed, 3 changed files, 0 failures, 0 manual holds
integration	passed	The required windows-powershell job completed success at this head, including Run SQLite CLI integration and every step after it: https://github.com/loopx-project/loopx/actions/runs/39968592465/job/120471874898

• Coverage and gaps: test_research_context_adoption.py cannot run on this Windows host — fixture setup raises WinError 1314 on os.symlink before the changed assertions, so it is not locally exercised; its repair relies on the unconditional envelope producer and on Linux test-shard CI. The writer-isolation file and SQLite file ran in full. The canonical-migration failures noted above are outside this diff and are expected to keep test-shard red until that program lands.

Frontend / Visual Evidence

• UI impact: none

Type of Change

• Test update

LoopX Area

• Build, packaging, installer, or CI

Technical Direction

• Direction / acceptance reference, when applicable: N/A

Shared-authority RFC fixture impact

• Production-scale fixture schema: N/A
• Semantic dimensions changed, or reviewed no-impact rationale: N/A
• Provider conformance arms run: N/A
• Read-only legacy/file/PostgreSQL three-arm rehearsal: N/A

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths.
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · reasoning_effort=max

动机

维护 Todo 读回、交接模式和上下文接续测试的贡献者。原测试把两次读取的完整 JSON 直接比较；即使 Todo 没变，只要读取时间不同也会报错，遮住拒绝操作与重放是否真的保持状态这一问题。改用既有辅助函数，仅忽略通过格式验证的观测时间，继续逐项比较所有其他读回事实；同一命令在真实基线为 13 失败、22 通过，当前提交为 35 通过。本 PR 仅修正三个测试模块的比较方式，不修改生产读取、权限、迁移、结算或默认行为，也不宣告整个权威迁移计划完成。

改动思路

生产读取仍按每次请求生成新观测时间，权威状态仍由既有 File/SQLite owner 管理。测试复用原有比较辅助函数，先验证时钟，再去掉允许变化的观测字段，最后比较完整剩余对象；比删除整个 envelope 或另造比较器更小，也保留更强的故障敏感度。

具体改动

关键代码讲解

• assert_todo_read_unchanged 本次未修改：只归一化 observed_at、served_at、来源 last_read_at，以及原先已有的类型化 resume evaluated_at；这些值须可解析且含时区。递归复制保证不会修改比较双方。
• 交接模式测试 四处改用既有 helper，继续覆盖 dry-run、旧操作重放、身份冲突和后端离线恢复；当前 handoff mode、原显示文件和拒绝写入检查保留。
• 上下文采用测试 三处读回改用 helper，仍验证来源不变、原负面历史保留、目标 lease 不变、重放不追加事件，以及过期所有权和旧上下文拒绝。
• SQLite 迁移拒绝测试 将“拒绝计划未落盘”和“其他读回事实不变”分开断言，后续释放 lease、迁回 File、重启和一次性结算检查仍执行。

规范依据：docs/reference/contracts/projection-envelope-contract.md，不可变基线 e4674e814d5c73b8ce72348c1675b6f07766d3e5，并结合 #7152 的复现边界。observation-is-not-mutation 与 retain-other-read-facts 均 implemented。实际 merge base 为上述提交；队列中的目标分支 tip 是另一提交，没有拿其两点差异冒充本 PR 全部改动。辅助函数、两处生产读取 owner 和规范正文在两端完全相同。

对主干的风险

最强反例是比较器把真实状态变化也擦掉。已直接导入实际 helper 做 15 项独立检查：合法观测时间变化通过，Todo note、认领、provider revision/provider、coverage、不可读来源、source count、resume 满足状态及无类型时间字段变化均拒绝；缺失、非法、无时区时间和 envelope schema 错误也拒绝，输入对象均未被修改。

相同完整测试命令在 e4674e814d5c73b8ce72348c1675b6f07766d3e5 为 13 失败、22 通过，13 项均因 projection_envelope 观测时间差异停在被修改的断言；808483ad2ffaea47175fdb534b97ccdf48e85ea4 为 35 通过。实际检查覆盖合成隔离 File/SQLite、正常 CLI、复制源码包来源、重启、迁移拒绝和重放；并非只执行新 helper 单测。标准 premerge 5 项直接检查、3 项选中检查，以及三个文件的 Ruff 均通过。没有读取、等待或借用远端 CI。

我的整体评价

APPROVE，限 808483ad2ffaea47175fdb534b97ccdf48e85ea4。这是有实际价值的测试维护切片：恢复回归检测可用性，保持长程执行、权限和数据边界；贡献者更容易区分观测噪声与真正状态变化，但未测量整体效率收益。仅三个测试文件 +16/-11，没有新增兼容分支、词汇、重复 owner 或一次性 smoke，原位复用已是合适的简化。

未执行 Windows、安装 wheel、真实模型或个人 Host；上下文测试既有 native history 替身的边界保留。也没有把 #7152 提到的其他历史 fixture 红项宣告修复，或把这 35 项扩张成整个权威迁移完成。测试比较不改变 UI 或文档首屏，因此视觉检查不适用。

English verdict: APPROVE this exact head. The same three real-source modules move from 13 observation-only failures and 22 passes on the true merge base to 35 passes. Independent mutation checks confirm canonical facts and malformed clocks still fail. Production authority and continuation behavior are unchanged; broader migration, Windows and installed-Host qualification are not claimed.