fix(lease): isolate default-off acquire from shadow producers

[loopx-agent]

Goal And Delivered Outcome

An unpromoted Goal without runtime shadow could durably acquire a lease and then report ModuleNotFoundError when the old shadow producers were absent. Acquire imported capture settlement unconditionally, while the typed owner correctly omitted a capture request.

Acquire now follows the existing lifecycle adapter: load settlement only when the typed result carries coordination_runtime_shadow_capture. Enabled capture and an active durable binding after configuration removal still deliver normally. The existing CLI completes acquire/replay, stale-renewal rejection, renewal, transfer and release without those producer modules.

Author Declaration

• Written by: model_agent — Codex, GPT-6 family, OpenAI.
• Intended base: main; immutable comparison baseline a4c072f603aba19bc566d40fc06a5cba8e463cd1.
• Specification: TypeScript migration RFC, T4 and Validation and stop rules.

Criterion	Disposition	Implementation and evidence
T4: retain necessary Host IO, import/export, projections and durable recovery; remove dependencies only at proven caller exits	implemented within this slice	Existing acquire adapter gates loading on the typed capture request; supported writers and active bindings remain.
Validation and stop rules: affected real entrypoint/backend, base/head comparison and native checks	implemented	Disposable real CLI/source and normal-wheel lifecycle oracles; immutable baseline counterexample and capture regression.

Scope And Continuation

TypeScript remains the single binding/state/outbox owner. Python adapts settlement IO; no new schema, configuration, provider, CLI option or decision owner. The unused private finalizer parameter is removed; the registry IO manifest changes only two source locations.

This completes the default-off acquire dependency exit. The existing T4 program still owns supported source writers, pending capture/outbox/history and their support-window exits. Those modules are retained in production; no Goal is promoted and no provider default changes. The boundary is independently reversible and does not claim full Markdown retirement or SQLite release qualification.

Validation

• Tested revision: 953327af360c95cb9ce98d053dae5ad2789f6bd9 (same tested runtime/test bytes).
• Run state: finished. Input classes: synthetic, public_fixture.

Check kind	Result	Public-safe evidence / limitation
real_entrypoint / real_backend	passed	100 affected source tests: native legacy and canonical File/SQLite leases, capture, cold import and recovery. No active Goal used as a fixture.
real_entrypoint / regression_parity	passed	Six normal-wheel CLI arms: absent, disabled and retired configuration × producers present/physically absent. Original registry/source bytes remain unchanged; no shadow state; exact replay and stale-renewal refusal verified. Package origin and reviewed adapter/manifest bytes asserted.
regression_parity	passed	Same final oracle against immutable baseline: producer-present arms pass, all three producer-absent arms fail on the unconditional import after lease persistence. Head passes all six.
integration	passed	Enabled capture and existing binding after setting removal deliver acquire, renew, transfer and release; 143 typed lease/capture/outbox tests pass.
static / integration	passed	npm run typecheck:control-plane and complete npm run test:control-plane: 4400 passed, zero failed; 37 PostgreSQL environment skips remain unverified.
static	passed	Changed Ruff, configured mypy (19 files), semantic advisory and complete semantic smoke; seven changed paths scanned clean.
static	failed	Extra mypy --follow-imports=skip on the adapter reports one no-any-return. Independent immutable baseline and head have the same complete diagnostic, with line mapping 564→566; the unchanged projection-return expression is outside the acquire gate. This optional failure remains failed; native exact-scope attribution records it.
static / integration	passed	Native exact-scope change quality and premerge: five direct/compile/boundary checks plus 19 selected checks pass; zero failures or manual holds.

The normal wheel initially refused a stale existing Chat bundle. Rebuilding through the repository's normal bundle workflow allowed a normal wheel build/install; no editable package or bundle-check bypass was used. PostgreSQL, active-user migration, Host/model/cohort trials and release qualification are outside this unchanged provider boundary.

Frontend / Visual Evidence

UI impact: none. Existing CLI behavior is repaired; no new capability, configuration editor, Lark operation, first viewport or navigation. English/Chinese reference and paired RFC checkpoint record the same limited exit.

Type of Change

• Bug fix
• Documentation update
• Test update
• Control plane

Boundary Checklist

• Public-safe diff and description; no private state, raw evidence, credentials, internal links or machine paths.
• No benchmark execution or scoring change.
• Scoped to the demonstrated acquire dependency defect; original broader retirement acceptance remains open.
• Every commit has a DCO sign-off.

Runtime change: exact-head review and maintainer merge required; this PR is not self-merged.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

未发现本切片阻塞项。Exact head: 953327a。

动机

需要在尚未迁移的旧 Goal 中领取任务租约的用户，以及准备退役旧 shadow 模块的开发者。 捕获是向既有持久 shadow 链路记录事务的可选工作。旧 Goal 没有开启捕获时领取租约：修复前租约已落盘，却因加载缺席模块报错；修复后原命令成功，且可以继续续约、转交、释放和原样重试。 源码和正常安装包的完整流程均通过，陈旧续约拒绝且不改已存租约；已有捕获绑定在移除配置后仍正常送达。 本批不迁移活动 Goal，不删除仍有调用方的旧 writer、capture 历史或待处理 outbox，也不改变 provider 默认值。 完整旧源退役、开发者试用、真实 Host/cohort 和发布资格仍由现有 T4 与各自持久性验收继续推进。

改动思路

捕获义务由既有 TypeScript owner 决定，Python 只按它返回的请求加载 IO 适配器；复制配置或 binding 判断会产生第二份决策。 本 PR 完成默认关闭时 acquire 的依赖隔离，并保留启用捕获及持久绑定的原送达路径；不能把模块缺席测试通过当成整个旧源退役完成。

直接删除全部 capture 会破坏活跃 binding，按 registry 开关判断也会在关闭配置后丢义务。既有 lifecycle adapter 已采用返回结果带请求才加载的方式，acquire 复用同一契约即可。TypeScript 负责资格、绑定、事务及 outbox，Python 继续适配 registry/source 和真实 settlement IO。正常流程没有新开关、确认、额外 round trip 或第二份状态机；这条可逆边界先消除错误依赖，再让真正的最后调用方决定模块删除。

具体改动

独立规范依据为 docs/architecture/rfcs/typescript-control-plane-migration-v0.md，修订 a4c072f603aba19bc566d40fc06a5cba8e463cd1。T4 的真实调用方检查及保留必要渲染、审核导入／导出、effect adapter，在本调用族范围 implemented；完整退役尚未完成。Validation and stop rules for every card 通过真实源码／正常 wheel、独立基线、完整控制面 typecheck/tests 和风险 canary 满足。新增 checkpoint 仅同步证据边界，不能反过来成为验收 oracle。

关键代码讲解

• _finalize_native_acquire_result（task_lease_acquire_adapter.py:329）保留 ok/acquired 的条件，并检查既有 coordination_runtime_shadow_capture。没有请求就直接返回原 lease；有请求则照旧调用 settlement。它不推断绑定、不捕获异常、不将可选能力安装当成启用。
• execute_native_task_lease_acquire（同文件:360）只删除未用的私有 Todo 参数；source CAS、资格和 canonical provider 证据检查均保持。已晋升路径仍在 finalizer 前返回。相邻 lifecycle 使用同一惰性 import 边界，原 typed captureRequired 会在存在活跃 binding 时继续返回 capture 请求。

既有冷源 oracle 增加无配置／关闭配置／退役旧配置 × producer 存在／四个整模块缺席六臂，每臂沿正常 CLI 做领取、原样重放、陈旧续约拒绝、合法续约、换接收者和执行 key、释放及释放重放。比较原源／registry 字节、存储 lease、version/epoch/scopes，不要求合法创建的空锁目录消失。capture oracle 增加移除配置但 binding 留存，四笔操作都要求 delivered。manifest 只同步两处代码行位置；中英文 reference/RFC 同步说明退役边界。

对主干的风险

最强反例是关闭配置后已有持久 binding 仍要求捕获，而新的条件错误地跳过它。真实原生捕获测试证明该场景仍送达并最终记录接收方 released lease。另一个风险是 producer 存在的单测遮蔽删除后错误：不可变基线的同六臂有3通过、3预期导入失败；独立保留的失败 fixture 还读回 active lease，证实错误发生在提交后。最终源码100项、正常 wheel6臂、相关 TS143项及完整 TS4400项通过，typecheck、配置内 mypy19、Ruff、全树 semantic、七路径 public scan 和原生 premerge5direct+19selected 全通过，没有 manual hold。

完整控制面测试另有 37 项环境跳过，保留为未验证，不作为 PostgreSQL 资格。正常 wheel 最初因旧 Chat bundle 过期拒绝打包，按仓库标准流程重建后再正常 build/install，子进程 package 来源及 adapter/manifest 与被评 head 同字节均已断言。没有绕过 bundle 校验。额外 adapter strict mypy 仍失败1项：独立基线和 head 完整诊断相同，仅行位564→566，未改动的 canonical projection 返回导致原有 no-any-return；此失败保持失败，并由 native 精确范围归因记录。早期 oracle 的目录／转交 generation 假设已按既有契约纠正，最终完整流程重新执行，未删除生产不变量。

语义与 CI 对齐

复用现有 typed capture/lease vocabulary，无新 schema、substring 分类或 Python 决策源。默认关闭的 prompt、help、输入、scheduler、quota 不变，持久 lease 语义与 source/registry 保留；producer 缺席报错修复已明确披露。已有绑定是机器义务，不能因移除开关降为建议。当前主干新增 research lease、dashboard emit、maintainer 合并授权与本 owning 路径没有语义交叠；按当前 native policy 未查询或等待 GitHub CI。此次不改 PostgreSQL 事务，不宣称其资格或活动 Goal 的全面迁移。

我的整体评价

APPROVE，属于 justified_increment。long_horizon 为 improved：已提交租约可继续跨续约、转交、释放和重试推进，不增加重复写入或丢掉原操作。user_experience 为 improved：用户直接使用原 CLI，不需要恢复无用途模块或猜测失败后是否重新领取。运行实现仅+5/-3行，相关未来重构已删除未用私有参数；没有投机框架。本 PR 完成默认关闭时 acquire 的依赖隔离，并保留启用捕获及持久绑定的原送达路径；不能把模块缺席测试通过当成整个旧源退役完成。 完整旧源退役、开发者试用、真实 Host/cohort 和发布资格仍由现有 T4 与各自持久性验收继续推进。 额外 typing 原失败及完整退役／实际试用证据缺口仍保留。运行行为 PR 留给 maintainer 合并，本评审不授予 bypass 权限。

English verdict: APPROVE — 953327a. Default-off native lease acquisition returns without unused shadow producer imports. Normal-wheel lifecycle/replay and stale-version rejection pass; enabled capture and active binding after setting removal remain delivered. Source100, wheel6, typed143, full typed4400/typecheck and native premerge pass; 37 environment skips remain unverified. One independently attributed optional baseline typing failure remains failed; full retirement, active-user adoption and release qualification remain separate.