test(storage): qualify combined App retirement isolation

[loopx-agent]

The App retirement probe previously removed the legacy Todo writer/source modules but retained bootstrap, while the independent cold-import fixture removed bootstrap in a different distribution. Combining their successful results did not prove that the App worked with both groups absent at once.

Reuse those existing fixtures in one receiver: removal tolerates modules already deleted by the upstream fixture, and the receiver asserts all nine targeted modules are absent before every server start/restart and auxiliary CLI. The existing HTTP import, later-write, original-operation replay and failure oracles are unchanged. The RFC records this precise C1/R5/T4 qualification boundary.

Validation:

• Complete selected source/normal-wheel HTTP suites:76 passed,0failed,0skipped. Real File/SQLite, backup, cold import, later edits/completion, restart/replay, provider/lease/source/backup failures and registry/runtime aliases; existing local Lark/Explore checks retain their synthetic/external boundary.
• Independent cross-fixture oracle:all four unchanged baseline cases fail because bootstrap remains; the final candidate's four cases pass with no source-module escape. This exposes a validation gap, not a demonstrated product storage failure.
• Normally built wheel 39c7cc758c720eb3c75b3576f29f3406711fd1c7f147ea265941211b0a701f6d has1599installed product files identical to base 509c38c502d3d0b4eafb01550efcdc4b5b5a1d17; this PR changes tests/docs only. Child processes use the selected interpreter with -S and the isolated receiver first.
• Ruff, semantic advisory/full semantic smoke, whitespace and public/private scans pass. Exact-head CQR is valid; risk-based premerge ran4direct+18selected checks with no required failure/manual hold. Its inherited maintainability advisory remains failed:unchanged goal_frontier/__init__.py has2,007lines versus2,000. Independent immutable base/head complete reports and fixture/environment digests match; CQR retains that failed observation as a baseline risk.

This is a disposable receiver qualification; the normal canonical CLI creation entrypoint stays with its owner. Production1.x compatibility, the supported package layout and installed runtime are unchanged. Actual native App/model/core-developer adoption, full Goal backup/restore, frozen capacity evidence and the cohesive2.0 normal-writer cutoff remain separate acceptance. Future-facing pass:join existing fixture owners with idempotent deletion and one complete absence assertion rather than a second harness or runtime abstraction.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

验证旧代码退役的开发者，需要确认同一份包缺少全部目标模块时仍能导入和恢复。原来两组测试分别缺少不同模块，却可能被合并解读为完整缺席；现在同一接收包在每次启动、重启及辅助 CLI 前检查全部目标模块。源码和正常 wheel 的 File/SQLite 导入、后写入、原操作重放与失败路径已通过同包检查。本批不删除受支持生产代码、不切换活动 Goal，也不改变 1.x 默认或支持布局。自然开发者试用、真实 App/Host 采用、完整 Goal 恢复和 2.0 整族截止仍各自开放。

改动思路

已有consumer fixture负责源码/正常wheel加载和writer/source模块卸除；已有cold HTTP fixture负责真实App导入、备份、后续操作与重启。将这两个owner在同一receiver内组合，再在实际进程启动前检查文件缺席。Python只承担pytest/provider运输；实际准入、存储与恢复仍由既有typed owner处理，无新增状态、provider、配置或决策分支。源码与wheel都使用指定解释器、-S和receiver-first加载，临时卸除不改变受支持发行包。普通canonical创建入口继续保留。

具体改动

精确head：2c3b3c741a17c9716b7fd5127bc417ddb6fb58a6。独立验收依据：docs/architecture/rfcs/typescript-control-plane-migration-v0.md，接受前revision：509c38c502d3d0b4eafb01550efcdc4b5b5a1d17；没有用本PR改后的规范给自身定义正确性。

关键内容讲解

• tests/control_plane/test_todo_consumer_host_retirement.py:25的cold_api将原capture_present=True改为False，在已有writer/source卸除的receiver中额外卸除bootstrap。require_retired_receiver在每次server启动/重启和辅助CLI前检查九个真实路径，包括facade、legacy mutation/line writer、legacy Monitor、四个source/shadow模块和bootstrap；没有增加运行时控制器。
• tests/control_plane/test_chat_cold_source_import.py:23的原fixture以unlink(missing_ok=True)处理上游已经删除的文件。它只允许重复删除临时文件；不是缺provider、权限或来源时的静默fallback。完整物理集合的断言仍严格执行。
• RFC只澄清组合资格：canonical CLI创建保留原owner，临时删除正常创建模块仅用于冷接收端资格，不将fixture变成支持的发行格式，也不宣称真实自然采用或整族代码退役。

规范映射：Disposable source/normal-wheel probes implemented，同receiver+独立缺席oracle；missing-provider/lease and changed-source/backup refusals implemented，原完整失败断言保留；additive 1.x implemented，生产1599文件字节一致、常规fixture矩阵通过；bounded reversible core-developer SQLite trial deferred，已有实际使用与自然人/Host资格独立续验；cohesive 2.0 normal-writer cutoff deferred，继续既有整族准入/原outbox/last-caller包，不能一fallback一PR。

对主干的风险

未发现阻塞项。最强反例是旧HTTP测试通过，却仍保留bootstrap，或者editable finder补回已删模块。独立同一oracle在不可变base四个原场景都于实际server准备阶段发现bootstrap存在；当前head四个场景通过，源码模块逃逸为零。完整两套源码/正常wheel测试76通过、0失败/0跳过：真实File/SQLite/HTTP/backup、后写入及完成、原操作重放、重启和provider/lease/source/backup/alias拒绝；原business/readback/no-duplicate断言均未改。正常wheel39c7已有正常构建资格，本PR不改产品，其1599安装product文件与base完全一致。接收端的物理缺席在所有启动和辅助调用前核验，不能把检查器形状当作行为证明。

Ruff、semantic advisory/full smoke、diff/public扫描和4direct+18selected风险canary通过必需门，manualhold0。继承的维护性检查仍失败：未改的goal_frontier为2,007行，超过2,000；独立base/head完整失败身份、细节、fixture/env digest一致，CQR将它保留为failed baseline risk，旧同范围receipt已原样归档。没有提高门槛、删旧失败记录或查/等待CI。既有全量/容量失败不由此结算；原失败与未验证条件保持各自身份。

我的整体评价

justified_increment，long_horizon=improved、user_experience=preserved：未来退役前的原操作重启/后写入证明更准确，普通使用无需新增步骤或权限。29/2行的改动修复实际验证遗漏，沿现有owner复用完整旅程，没有增加新的测试框架、运行时词汇或兼容分支。已扫描现有覆盖与同作者相关批次；这是加强原fixture，不是新建重复smoke。bounded future-facing pass已将原删除步骤做成可组合的精确缺席检查。

剩余边界仍是自然core开发者/原Host/原生App窗口采用、完整Goal恢复和明确2.0整族writer截止及随后outbox/producer退役。合成输入、正常wheel和实际HTTP是本批证据；Lark仅本地预览、不含外部送达。精确head自评成立，PR交maintainer；不将本结论视为合并或发布授权。

English verdict: APPROVE - 2c3b3c741a17c9716b7fd5127bc417ddb6fb58a6. Existing fixtures now prove App cold import/later-write/restart recovery with both old module groups absent in one receiver.76source/normal-wheel tests and independent baseline-failing/head-passing absence probes pass; inherited maintainability failure and broader adoption/major-cutoff gaps remain explicit. Production behavior and1.x compatibility are unchanged.