test(shadow): separate Monitor replay from bounded catch-up

[loopx-agent]

Goal and delivered outcome

A successful legacy Monitor business replay can leave a prepared shadow entry when the existing bounded drain defers. The recovery test instead required immediate catch-up, so a legal maintenance-lock deferral failed its assertion. Separate the two obligations: preserve the business receipt, then recover the same entry through an independent drain with the original limits.

Basis: the Monitor source-writer checkpoint in docs/architecture/rfcs/typescript-control-plane-migration-v0.md at 2e3ab4c4a5665378b9e422f9483a820066fca40b, and the existing typed shadow drain contract. Intended base: main.

Author declaration

Written by: model agent, Codex / GPT-6 / OpenAI.

Existing criterion	Disposition	Decisive evidence
Historical business replay preserves source bytes, original successors and one quota effect	implemented	Real public CLI nominal/held-lock/late-replay assertions
Bounded proof work may leave recoverable evidence; later drain must retain original identity	implemented	Real File ledger after-proof 2100ms delay at unchanged 2s/16-entry/0.25s limits, then same-limit recovery
A lost response cannot automatically replay a possibly committed drain	implemented	Response loss after a real File commit; one transport attempt, retry_safe=false, original 17s timeout, unchanged history on later drain
Supported source writers and migration/producer retirement boundaries remain intact	implemented within this scope	Runtime bytes unchanged; English/Chinese checkpoint clarifies existing behavior

Scope and continuation

Changes only five tests/docs paths. The parameterized CLI test shares its setup and keeps business replay separate from candidate catch-up. Native deadline and lost-response tests cover distinct effect boundaries; no new runtime mechanism, cache, capability, API or budget is introduced.

This closes the overstrong recovery assertion and adds durable regression coverage. It does not attribute the timing of the earlier natural full-suite failure, certify a full-suite rerun, retire live writers/producers, change provider defaults, or qualify installed/cohort operation. Those remain in the existing C1/T4 program; no extra follow-up issue is created. Frontend/Lark behavior and configuration are unchanged.

Validation

Tested source: 032f8fbb83882bad827515e39a55246689f41fcb, forked from immutable 2e3ab4c4a5665378b9e422f9483a820066fca40b. Run state: finished. Inputs: synthetic and public fixtures; disposable local storage/processes.

Check kind	Result	Evidence / limitation
regression_parity	passed	Original assertion fails specifically under a real legal drain-lock deferral, while the source business bytes and successors survive; uncontended original case passes
real_entrypoint	passed	uv run --extra test python -m pytest tests/control_plane/test_monitor_poll_transaction_recovery.py tests/control_plane/test_local_authority_shadow_drain.py -q: 37 passed, zero skips; legacy/File/SQLite CLI and actual File outbox recovery
real_backend	passed	node --experimental-sqlite --experimental-strip-types --test tests/control_plane_ts/shadow_drain.test.ts: 12 passed, zero skips; real File ledger, exact evidence and no duplicate commit
static	passed	Complete npm run typecheck:control-plane, changed-Python Ruff, diff semantic advisory before full-tree census, DCO and public/private diff scan
static	passed	Goal-bound exact-diff premerge: 4 direct checks and 19 selections, required checks passed; exact-scope quality receipt verified
manual	failed (inherited advisory)	Unchanged frontier-module maintainability debt, no magnitude regression or raised ceiling; native canary classifies it as advisory
manual	not_run	Prior full-suite failure and unproved natural timing attribution remain recorded; this source test repair does not claim global qualification or deployment

Python 3.14.8, Node 24.21.0. No runtime, receipt, transport deadline or writer budget was changed. The initial clean-worktree semantic census failed for missing npm development dependencies; npm ci --ignore-scripts repaired setup and the unchanged-diff full premerge rerun passed.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Exact head: 032f8fbb83882bad827515e39a55246689f41fcb; pre-change specification revision: 2e3ab4c4a5665378b9e422f9483a820066fca40b.

动机

维护 Monitor 恢复路径的开发者会遇到这个问题：业务回执重放成功，但维护锁占用时，待同步的 shadow 候选库仍可合法滞后。 之前测试把业务重放成功等同于候选库立即追平；现在分别验证原业务结果保持，以及释放锁后用相同上限独立恢复。 旧断言可能把合法恢复判成失败，并诱导重复源写入或扩大预算。真实 CLI、File 存储和原有 TS drain 已验证：延期时保留证据，后续恢复原 entry，业务源字节、后继 ID 和 quota 副作用不重复。

本 PR 不改运行时、writer、默认存储或预算，不宣称旧 writer 退役、安装采用、自然全量故障根因或整个 C1 验收完成。 原自然全量失败的时序根因仍未知；正常安装包、core 自然试用和原 C1 writer／producer 退役验收保持开放。

改动思路

业务回执代表已经完成的原操作；shadow 是其待同步候选库。前者重放返回原后继，后者由既有 TS drain 在锁和预算允许时，根据原持久证据恢复。Python 保留 IO／传输职责，未增加决策源。先保留业务源字节和身份，再独立调用同限 drain，最后重放并比较 quota 回执、事件和候选历史，验证整条继续路径。

只删旧断言会失去恢复证明，改运行时或增加预算也没有必要。这里复用现有 fixture、真实维护锁和 private after-proof seam；普通／延期 CLI 路径共用参数化 setup。三个例子分别守住源业务重放、proof 后 deadline 和真实 commit 后响应丢失，不能互相代替。本 PR 完整交付这个有界测试及契约修正；整体退役继续归既有 C1/T4 验收。

具体改动

五个路径共 134 additions／8 deletions：三个测试文件、英中 RFC 两份；生产代码、schema、命令、默认值和权限均未变。

关键内容讲解

• test_enabled_shadow_business_replay_then_bounded_drain_recovers_batch 保留普通路径，增加真实 held-lock 延期。CLI exit1／drain_lock_busy 时 prepared 字节、源状态和候选交易不变；释放锁后以 16 entries／2s／0.25s 原上限恢复，原 successor ID、一次 quota effect 和之后的 replay 均有读回断言。
• Native inline deadline retains a markerless source commit for an independent drain 在真实 File 存储和原 source commit 下，利用现有私有 seam 在 proof 后延迟 2100ms。原 2s deadline 保留全部证据且 delivered=0；同限独立 drain 恢复原 entry，后续历史不增加。现有 0.05s 已提交残留案例仍保留，覆盖不同阶段。
• test_lost_drain_response_never_replays_the_effect 先执行真正的 native commit，再丢弃响应。验证只发一次、retry_safe=false、原 17s transport timeout；下一次显式 drain 为 nothing_pending，交易及源字节均不变。
• 英中 RFC 对齐说明 bounded deferral 和独立恢复，保留旧 writer、原身份和一次副作用。原 reference 中的保留 drain 路径继续存在；这里明确它的边界，未新增恢复权或强制迁移。

依据：docs/architecture/rfcs/typescript-control-plane-migration-v0.md，spec_revision 2e3ab4c4a5665378b9e422f9483a820066fca40b，按修改前条款判断：

criterion_id	disposition	证据／边界
markerless-recovery	implemented	原有 drain 的 source CLI、真实 File proof、延期及后续同限恢复
source-and-successor-preservation	implemented within source scope	源字节、原后继、当前历史和 once-only 回执读回；未改 source removal／wheel 路径，安装包独立验收仍开放
supported-writer-retention	implemented	整个 diff 无生产 writer 变化，原支持及历史义务保留
C1	deferred	最后 writer 调用退出、安装恢复／core 试用和 producer/outbox 退役保留原验收，不能用本批测试关闭

对主干的风险

无阻塞发现。最强反例是“删掉立即追平断言后丢失后继或重复提交”。新例把原 source、entry、successor、quota 和候选交易分别作为 oracle，并跨独立恢复／late replay 比较。真实锁、存储和 commit 没有 mock；故障 seam 只控制时序或丢响应，不提供待证明的成功结果。

验证于该 exact head／固定 base：37 Python、12 native TS 全通过且零 skip；完整 control-plane typecheck、Ruff、DCO、公共边界扫描、语义 advisory 后 full semantic smoke、exact-scope CQR 和 premerge 4 direct／19 selected required 全通过。首次 clean-worktree census 因 npm dev 依赖缺失失败，补齐后同一 diff 完整 rerun 通过。未变 frontier 维持债仍为 inherited advisory，未抬上限。

历史自然全量 20804 pass／1 fail／343 skip／517 subtests 保留，未证明其时序根因，也未归因其他 reader PR。当前锁控制独立证明旧断言过强，预算／lost-response 控制独立覆盖恢复义务；它们不等于全量、wheel、自然 Host 或冻结 D2 资格。按本次 capability 的 wait_for_ci=false 未查询远端 CI。检查相邻 #6303 停机源恢复／导入和 #6325 unavailable late-poll admission，边界不同，未重复接管。

我的整体评价

APPROVE：这是 justified_increment。long_horizon improved：回归现在覆盖延期、后续恢复和一次性重放，避免靠重复业务写入追平；user_experience not_applicable：没有新增 UI／Lark／CLI 步骤或配置。代码量必要，共用 nominal/deferred setup 的局部简化已应用；无生产增长或兼容分支变化。状态名称全部复用既有 typed shadow／scheduler vocabulary，没有新协议或 Python 决策源。

批准范围是上述完整测试／文档修正；自然全量时序、安装采用及 C1/T4 剩余接受条件仍开放。原 owner 继续 import-first 和明确版本截止路线。本评审不授予合并权，PR 留给 maintainer。

English verdict: APPROVE - 032f8fb; the existing bounded recovery contract is covered by real CLI/File tests without increasing limits or replaying unknown effects. 37 Python / 12 native TS and required premerge pass; historical natural/full and installed C1 qualification remain open.