feat(setup): report optional-scope impacts instead of scope names alone

[itswl]

What

Setup's scope reconciliation already lists which optional scopes were not granted (#211), but not what each gap costs. On a real machine that meant discovering the gaps only from the daemon log: a missing im:chat* surfaced as 成员表拉取失败, drive:drive as a failed document-comment subscription, admin:app.visibility as a failed visibility update. Filed as #225.

Change

• src/setup/tenant-scope-grant.ts: missingOptionalScopeImpacts() groups missing optional scopes by the capability they degrade — chat info/members, chat management, document comments, visibility, employee-id signature, message search, base messaging — and falls back to a 其他权限 line for anything unbucketed, so no requested scope is silently dropped.
• src/setup/bot-register.ts: the non-blocking optional-scope notice now prints those impact lines. The required-scope fail-closed gate and the console recovery link are unchanged.
• Tests: test/unit/setup/tenant-scope-impact.test.mjs (grouping, declaration order, empty input, unbucketed fallback) and test/integration/setup/setup-optional-scope-report.test.mjs (required granted + every optional missing → setup completes, and the output carries the impact lines and the console link; the fixture stubs globalThis.fetch so the test stays offline).

Resulting output sketch:

Tenant scopes 对账：必需未授予=无；可选未授予=im:message, …, im:chat.members:read, …
! 可选权限未授予，setup 可继续；未授予项对应的能力不可用或降级：
  - 群与成员信息（成员姓名/群名解析）：im:chat:readonly, im:chat.group_info:readonly, im:chat.members:read
  - 云文档评论事件与回复：drive:drive, docs:document.comment:read, docs:document.comment:create
  - 应用可用范围自动设为全员可见：admin:app.visibility
  …

Validation

• bun test test/unit/setup/tenant-scope-impact.test.mjs test/integration/setup/setup-optional-scope-report.test.mjs → 3 pass / 0 fail
• bun test test/unit/setup/ test/unit/app/setup-cli.test.mjs test/integration/setup/ → 78 pass / 1 skip / 1 fail. The failure is the known environmental setup-single-root clean-build test (it builds inside bun's 5 s test timeout; a clean build measures ~11.4 s on this machine) and is unrelated to this change.
• bun run build ✅ · bun run typecheck ✅ · bun run licenses:check ✅ · bun run publication:check:tree ✅
• bun run test:unit → 894 pass / 1 skip / 4 fail on a machine with three other agents' daemons running:
  • three-Agent live acceptance … — known pre-existing environmental failure (fails on unmodified main here too);
  • Agent CLI process consumes native-shaped Codex, Claude, and Pi directory fixtures and a live reclaim guard is never stolen while its owner protects stale-lock recovery — both reproduce identically on unmodified main in the same session (7.0 s / 11.4 s against their 10 s budget), i.e. load-sensitive process/timing tests;
  • local control keeps upsert ID idempotency … — passes in isolation.
    None of the four touch this change.

Lands ahead of maintainer alignment on #225 — happy to adjust the groupings, the wording, or split out the runtime-side (status/agents) visibility as a follow-up.

Fixes #225

🤖 Generated with Claude Code

[eddiearc]

MERGE-WITH-NITS（Fable 5.1 审合）— 文案对齐后合

可选权限从「只有名字」变成「能力影响」，必需 scope 门禁不变，方向对。「其他权限」fallback 避免漏报。

请补：1) grant-scopes.ts 旧提示行也走同一套 impact 映射；2) Owner 确认各 capability 文案（尤其 employee_id 标签）；3) im:chat 不在 TENANT_SCOPES，属死条目。缺 version bump。与 #222 同改 bot-register，先 rebase/错开。

[eddiearc]

Maintainer follow-up — 缓合（独立 UX 批次）

方向可以，先别跟 runtime 修复绑在一起合。

请小改后再叫我们看：

1. 文案弱化：不要写成「能力不可用/降级」定论；改成「可能受限，实际以平台校验为准」。
2. grant-scopes.ts 旧提示行也走同一套 impact 映射（或明确只在 bot-register 路径展示）。
3. OPTIONAL_SCOPE_CAPABILITIES 里的 im:chat 若不在 TENANT_SCOPES，删掉或对齐，避免死条目。
4. 表保持 display-only，不要演变成第二套能力权威。

相关：#225。

[itswl]

四条已改完（head 更新为 0d1090a，已 rebase 到最新 main）：

1. 文案弱化：! 可选权限未授予，setup 可继续；以下能力可能受限（实际以平台校验为准）：——不再写"不可用/降级"定论。
2. grant-scopes.ts 旧提示行已走同一套 impact 映射（原"相关能力仍不可用或未验证"替换为同一份分组列表）。
3. 桶条目已与 TENANT_SCOPES 对账：无死条目——im:chat、im:chat:create/update、im:chat.members:read/write_only、im:chat:operate_as_owner、im:chat.group_info:readonly 等都在申请清单里；唯一未被桶覆盖的是 application:application:self_manage，归入"其他权限"一行。
4. 保持 display-only：没有任何门禁或行为读取这张表，只用于输出。

验证：tenant-scope-impact + setup-optional-scope-report 两个测试文件 3 pass / 0 fail；build 通过。等你们安排独立 UX 批次时再看。

[eddiearc]

核对过 head 0d1090a 相对缓合四条：

1. ✅ 文案已弱化为「可能受限（实际以平台校验为准）」
2. ✅ grant-scopes.ts 已共用 missingOptionalScopeImpacts
3. ✅ 桶条目与申请清单对账说明可接受（application:application:self_manage 走「其他权限」）
4. ✅ 仍是 display-only，门禁未变

等 CI 全绿后，maintainer 侧倾向 APPROVE；合入仍等 idan 明确 yes。

[itswl]

package.json 已按 Owner 政策补 bump（0.5.9 → 0.5.10，head 652b639），CI 已触发。

[itswl]

Windows gate 失败排查：CI 基础设施 403，非代码问题

Windows 11 x64 core and standalone gate 在 "Download exact Windows standalone build" 步骤就失败了：

##[error]Unable to download artifact(s): Failed to ListArtifacts: Received non-retryable error:
Failed request: (403) Forbidden: Error from intermediary with HTTP status code 403 "Forbidden"

是下载构建 artifact 被拒（GitHub Actions 基础设施抖动），测试根本没开跑；同一 run 的 source-checks 与 standalone artifact 均通过。烦请重跑该 job 一次。