[cocolord]

Summary

Remove the unused Python lease source-snapshot capture tree left after ordinary inspection moved to canonical registry facts in 155dee190.

• Delete task_lease_acquire_authority_facts, its four exclusive helpers and exclusive imports: 150 product lines removed.
• Replace the obsolete-function sentinel with a real, exact-display-path Path.open guard in the existing File/SQLite renewal regression matrix.
• Keep all 11 surviving adapter function ASTs identical to the base. No new module, effect handler, protocol field or compatibility wrapper.

Scope and compatibility

This removes an undocumented internal Python helper/import surface, not the public lease facades or native lifecycle transport. Repository caller/export/package searches found no remaining production consumers; the sole outside reference was the test sentinel. Arbitrary undocumented external imports are not claimed as compatible.

Canonical acquire/renew/transfer/release/inspect, registry source-stability receipts, provider choice/defaults, TTL, owner/key/version/epoch CAS and permission boundaries are unchanged. Exact historical release, held fence-close and 1.x prepared/committed receipt replay remain supported. No persisted lease, receipt or source data is deleted or migrated.

Validation

Base: 0cfbf11dcea4ba7bc8fb13f06f1c915b63ce8fad (main). Final head: c45e9b35a788825e829d2ae895746afa2e9e63d6. The two DCO-signed commits were rebased onto the latest fetched main; final validation is rerun on this unchanged head.

• Focused Python public consumers and retained cleanup: 75 passed, no skips. Includes real File/SQLite CLI acquire, renewal, handover, release and inspection with stale/missing/malformed display and historical replay.
• TS canonical lifecycle and 1.x retained receipts: 93 passed, no skips. Includes stale owner/version, ambiguous response, real before/after-commit process interruption, exact release and lost fence-close response.
• Characterization before product deletion: existing renewal matrix 6 passed.
• Regression sensitivity: an isolated, in-memory reconnection to the old source-read path made all 6 cases fail at the intended display IO guard. No probe or mutant is included in this PR.
• ruff check on both changed files, npm run typecheck:control-plane, git diff --check, surviving-function AST parity and removed-symbol searches: passed.
• loopx canary premerge --from-git-diff --git-diff-base origin/main (standard): 6 direct checks + 14 executed smokes passed, 0 failures/skips/advisories/manual holds. Includes lease runtime, state-write contracts, maintainability/vocabulary checks and canary planner/runner contracts.
• Public/private boundary scan of both candidate files: clean; fixtures remain synthetic. Local reports, probes and raw validation output are excluded.

Full required CI (including Stage 2C and Windows) and independent exact-head review remain pending. Local validation does not grant merge authority; no self-merge is proposed.

Bounded refactor pass / rollback

Applied: retire the actual removed-caller source-capture remnant rather than adding another routing layer. Adapter shrinks from 619 to 469 lines; complete diff is +8/-154, net 146 lines removed. Live call/round-trip ownership is unchanged; no latency improvement is claimed.

Deferred: a broad TS canonical/recovery module split. The existing typed discrimination already isolates authority for this slice, and mechanical file splitting would not establish further route retirement. Rollback is code-only, with no persisted-state rewrite.

中文说明

这条 PR 清理的是普通 inspect 调用方迁移后遗留的 Python 来源快照树，不是退役 canonical 租约，也不删除历史租约或回执。保留真实 release、fence-close、1.x 回执恢复和全部现有 native transport。

测试从“拦截旧函数名”改为“拦截实际 Goal display 文件 IO”；原有 File/SQLite × 缺失／无效模式／损坏 YAML 六场景保留，并用隔离反例确认能拦住旧读取被重新接入。生产代码删 150 行，存活函数 AST 不变；最终 focused Python 75 项、TS 93 项通过，无跳过。完整 CI、独立 exact-head review 与合并授权仍是单独门禁。

[cocolord]

Author validation — exact head c45e9b35a788825e829d2ae895746afa2e9e63d6

This is author-side validation, not independent approval or merge authority.

• Changed surfaces: unused Python lease source-capture code and the canonical renewal regression's display-IO guard. Native TS dispatch/provider transactions, registry receipts and historical release/fence/replay are unchanged.
• Real paths: focused Python CLI/direct consumers 75 passed; TS canonical + retained 1.x recovery 93 passed, no skips. File/SQLite cover acquisition, renewal, handover, release, inspection, stale proof, original replay, lost response and real commit interruption.
• Negative sensitivity (before product deletion): reconnecting the old source-read path in an isolated in-memory probe caused all 6 existing renewal cases to fail at the intended Goal display guard. The guard is unchanged on the final head; no probe/mutant is shipped.
• Risk-based checks: standard loopx canary premerge --from-git-diff --git-diff-base origin/main passed 6 direct checks + 14 executed smokes on this committed head; typecheck, focused ruff, diff hygiene, removed-symbol search and all 11 surviving-function ASTs matched the rebased main owner.
• Public/private boundary: both candidate files scanned clean; fixtures are synthetic. No local paths, private planning, credentials, raw logs or generated review/probe artifacts are included.
• Failures/skips/manual holds: none in the local validation set. Coverage percentage was not requested or asserted. Full required CI, Stage 2C/Windows aggregation and independent exact-head review remain separate pending gates; no self-merge is proposed. PostgreSQL service integration and packaged frontend journeys were not run: no provider/service transaction or frontend/install behavior changes in this deletion-only slice.
• Why sufficient for this slice: every live adapter function is structurally unchanged; actual public local-provider paths and fixed historical recovery bytes are exercised, and a deliberate old-read mutation proves the changed regression guard is sensitive. This does not claim arbitrary undocumented external helper imports remain compatible.
• Future-facing pass: applied the actual dead-source-tree deletion; deferred broad TS canonical/recovery file splitting because it would not prove further route retirement. Rollback is code-only, with no persisted-state rewrite.

中文摘要： 最终 head 的 Python 75 项、TS 93 项及 premerge 6+14 检查通过，无本地失败／跳过／manual hold。保留 release、fence-close、历史回执恢复和现有权限边界；仅清理已迁走调用方的旧来源树并加强真实 IO guard。反例只用于本地敏感性验证，不进入仓库。这是作者验证，不替代独立 review、完整 CI 或合并授权。

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max.

动机 / Motivation

维护租约调用链的开发者和续租任务的操作者，需要明确规范存储是唯一事实来源。原先已经不用的Markdown捕获链仍留在租约适配器中，测试只禁止调用旧函数名；新版本删去死链，并直接禁止续租读取Goal展示文件。留着没有调用者的旧读取路径会让后续改动误以为展示仍可提供权威事实，按函数名拦截也捕捉不到改名后的回归。删除后十一项保留函数的AST完全相同，真实File与SQLite续租、历史重放和错误拒绝继续成立；重新接入展示读取会使六个回归用例准确失败。本提案完成有界清理和有效回归保护，不改变租约协议、存储格式、权限或产品交互，也不证明长期性能收益。

改动思路 / Approach

保留实际公开CLI→租约facade→native adapter→TypeScript规范生命周期owner的整条路径。规范租约、Todo与handoff mode仍来自同一provider revision；Python只运输注册信息和返回结果。删去只服务于旧捕获入口的五个函数及两个未用导入；源码、测试、示例、packages和文档中均未发现产品调用方，旧测试仅引用其名称作哨兵。

架构判断：这次减法消除不再被调用的展示读取边界，保留现有typed owner及全部真实租约分支；更改不应新建wrapper、兼容入口或另一个判断owner。当前PR边界：删除不可达捕获链，并把回归检查绑定实际展示IO。保留的注册文件前后指纹检查、三次source-CAS重试、规范provider失败拒绝和legacy清理通道都没有改写。

具体改动 / Changes

准确审查 c45e9b35a788825e829d2ae895746afa2e9e63d6 相对 0cfbf11dcea4ba7bc8fb13f06f1c915b63ce8fad 的全部两个路径：生产删除150行，测试+8/-4。十一项保留函数逐一AST对照相同，排除注释与行号后没有暗改分支。没有新增协议、CLI、配置或持久字段。

关键代码讲解

• _canonical_lease_authority_facts:81 只抓取注册来源并检查前后身份，不以Markdown的handoff值决定规范状态；保留原失败与重试路径。
• execute_native_task_lease_lifecycle:266 继续按canonical或legacy既有请求分派，lease key/version、TTL、owner约束和持久回执仍交原owner；本次没有把清理权限扩成执行权限。
• test_public_renew_preserves_canonical_authority_and_historical_receipt:33 在真实File/SQLite两后端与缺失、错误模式、畸形YAML三种展示下，经两次CLI续租后用实际 Path.open 哨兵检查第三次续租；另查版本4、独立inspect、原版本重放、变更TTL拒绝及展示未写。

规范依据 docs/reference/protocols/active-state-structured-projection-v0.md，固定版本 0cfbf11dcea4ba7bc8fb13f06f1c915b63ce8fad：原接受文本。使用原文标识 Lease inspection / 租约检查 映射同revision权威读取、缺失/失败不回退；原文 active 映射有效租约及原key/version、幂等与CAS边界。两项均保持，223项当前实路测试、六组旧adapter对照和故障注入提供证据。

对主干的风险 / Risks

PASS：九个完整canonical lease/CLI模块223项，File与SQLite真实provider和子进程路径均覆盖；Ruff、标准premerge的6个直接检查及14个选中检查通过，严格CQR有效。测试包含真实CLI acquire/renew/transfer/release/inspect、不可用或缺失规范状态、claim/exclusion、原key/version拒绝、历史receipt和无重复写入；没有通过删除断言取得绿测。

另将不可变base adapter加载进未改的公开facade，六个展示异常用例仍通过；CLI子进程使用当前树，其保留适配函数AST与base逐一相同。这是精确adapter对照，未冒称重建整个旧安装。独立故意在实际lifecycle入口重新读取注册Goal的展示文件，六项全部在新的 Path.open 哨兵处失败；该预期失败证明回归保护会捕捉实际IO，不是当前提案失败。动态时间/临时目录由同一测试夹具管理，回执与provider head在每例内独立读回。

最强回归风险是误删动态或独立消费者；完整仓库搜索未见导出清单、文档或调用方，活跃十一项函数与持久格式未改，因而无需保留假想外部兼容。未运行真实PostgreSQL集成：此差分不改变其store/service或任何保留的adapter行为，File/SQLite正常入口和原生验证符合这个删除边界；也未验证性能或正式安装采用。

我的整体评价 / Verdict

未发现阻断问题，APPROVE。长程工作语义 preserved：续租和历史重放仍保留owner/fence、完整Todo及一次持久效果；用户体验 preserved：既有CLI输入、错误、inspect结果与恢复步骤不变，新增的是开发者回归保护，不要求本人准备或确认。视觉观察不适用：已检查租约CLI/facade、适配器和测试，差分没有渲染或交互变更。未验证范围：真实PostgreSQL、正式安装和长期性能；没有据删行数宣称效率收益。此清理复用已有typed词汇和权威owner，范围相称且可回滚，没有未完成的产品旅程需要人为拆出后继。

English verdict: APPROVE — dead capture code is removed, live authority behavior is preserved, and the IO regression guard is sensitive.