fix(lease): align cutoff recovery across CLI formats

[loopx-agent]

Unmigrated task-lease transfer --transfer-claim returned an obsolete lease error instead of the shared backup-and-migrate response. Canonical lease refusals also crashed default/Markdown output because its renderer assumed the argument-repair schema. Reuse require_canonical_authority and render its existing recovery descriptor by the canonical error code, so the Python API, JSON CLI and default/Markdown CLI expose a usable refusal.

Migrate the remaining legacy-positive lease recovery test to hard_lease, and replace its two obsolete cases with real File/SQLite negatives: a retained, unexpired legacy lease is readable and precisely releasable, while fresh acquire and use of its old proof cannot execute work. Release replay preserves the original receipt, task graph, registry and display. The reference now states the 2.0 cutoff and labels the retained capture-isolation prose as historical. TypeScript keeps lease admission and persistence ownership; the runtime changes are Python adaptation/presentation.

Validation on macOS / Python 3.14 / Node 24:

• Current-head API/CLI formats, normal File/SQLite handovers, projection recovery and argument/native-CLI recovery: 57 passed. The expanded Markdown/default negatives reproduce six failures before the renderer fix.
• Complete changed lease-recovery module: 14 passed, including both new real-backend legacy negatives. The wider immutable-parent run was 1,147 passed / 2 failed; those failures were the obsolete legacy-positive cases repaired here. The entire wider suite was not rerun after the targeted repair.
• Exact five-path PR canary: 5 direct checks and 19 selected checks passed, with no manual hold. Configured kernel mypy: 17 files passed; Ruff, changed-source advisory followed by full semantic smoke, whitespace and public-boundary checks pass.
• Global documentation governance still fails on the same two dated TypeScript RFC headings as the immutable parent. Existing #6605 owns that correction. The initial adapter-only transitive mypy probe reproduced baseline errors; it is separate from the passing configured kernel gate.

Hosted CI was not queried, waited for or triggered. Full Goal/Host recovery, installed-App adoption and D2/D3/default qualification retain their existing acceptance. The separate shared storage-fixture repair is consolidated in the earlier community #6607; duplicate #6608 is closed with its independent review retained.

[loopx-agent]

Completion update: the companion work is now in exact head 6a4315342245e127e20eab18e588107ef5f57541. API/JSON/default/Markdown recovery, retained source-policy fixtures, legacy read/release without execution and the current reference are complete. The current-head focused CLI suite passes 57 tests, the changed legacy/hard-lease recovery module passes 14, and the exact five-path canary passes 5 direct plus 19 selected checks. Configured kernel mypy passes 17 files. The PR body separately records the wider-run failures, their targeted repair and the unchanged global documentation-governance failures owned by #6605.

The earlier implementation hold below is resolved for this new head. Independent exact-head review remains requested; this author update grants no merge authority.

Original diagnosis retained for traceability:

Author follow-up: the public default and explicit Markdown outputs also need a companion fix. The canonical migration-recovery descriptor has action / backup_required; the lease Markdown renderer assumes argument-repair fields and raises KeyError: cli_args. JSON refusal remains safe, and this renderer issue also affects existing canonical lease cutoffs.

I am adding the formatter correction, JSON/Markdown/default-output regression coverage and a bounded reference correction in this PR. The currently running immutable-source integration suite is retained; the head will change for this completion. Please hold review/merge conclusions until that updated head and its validation are posted.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

评审对应 6611@6a4315342245e127e20eab18e588107ef5f57541，完整五路径及五个 DCO 提交均已核验。

动机

需要把已认领工作交给另一 Agent、或清理历史租约的 CLI 操作者。

未迁移 Goal 的联合交接原先返回孤立错误码；遇到迁移恢复描述时默认/Markdown 又可能崩溃。新头统一拒绝新执行并显示备份后迁移提示，原参数修复仍可用。

真实三格式均返回可操作拒绝且原记录不变；已迁移 File/SQLite 的接收方仍能继续编辑、完成并恢复原回执。

不自动迁移 Goal、不创建另一租约规则、不授予接收方新权限；不声称完整 Host、已安装 App 或 D2/D3 资格。

这次验收关注操作者能否从真实命令得到正确的下一步，并保住现有工作和回执。只替换 API 异常会留下已复现的文本输出崩溃；只改显示又会让联合交接继续使用孤立的错误契约，因此生产端和显示端应作为同一修复交付。

改动思路

复用既有 canonical 拒绝 owner，并在 CLI 投影按既有错误码区分两种恢复描述，避免新增决策源。

当前 PR 只完成联合交接拒绝、三格式诊断、原参数恢复兼容及对应历史租约验证和双语参考说明。

未迁移的联合转交仍在构造执行请求前停止；已迁移路径继续由原 TypeScript owner 裁决租约、版本、epoch、CAS 和回执。Markdown 只决定怎样展示现有诊断：迁移恢复具有 action/backup_required，参数修复具有 cli_args/缺失项/冲突项。两者的真实含义不同，不应共用同一个字段假设，也不需要再建一种状态或恢复框架。

具体改动

完整差异为 5 文件、+119/-12。两个生产文件只改变共同拒绝适配和文本消费；两个测试模块覆盖真实输出与 File/SQLite 历史状态；英文和中文参考都明确当前 cutoff，并将旧 capture 隔离段落标为历史。没有新 provider、CLI 参数、持久化字段或 Python 决策 owner。

关键代码讲解

• execute_native_task_lease_lifecycle 在 transfer_claim 且非 canonical 的分支调用已有 require_canonical_authority，返回共同 operation/write_admitted/recovery。canonical 分支和原 TS 事务保持原样，没有模拟分两次写 claim 与 lease。
• render_task_lease_markdown 按已有 canonical_authority_required 精确区分迁移描述，再在原参数分支使用 shlex/cli_args；默认和显式 Markdown 均走真实消费者。没有用报错文案做 substring 分类，也没有自动重试或迁移。
• legacy 历史验证 保留未来到期旧租约，实际证明它可读、可精确释放及恢复原 receipt，却不能 acquire 新执行或凭旧 proof 编辑。原两项与已退役规则矛盾的正向假设改为 hard_lease 正向和更强的历史负例，未削弱有效断言。

独立规范采用改动前的 docs/reference/canonical-lease-renew.md，固定 revision 1d60e7e。该文无正式编号，这里使用段落定位标签：claimed-work-handover 对应 canonical hard_lease 联合事务及拒绝旧 writer 的要求；argument-repair 对应保留原路由、身份、key/CAS 且不自动执行；exact-cleanup-and-replay 对应精确 cleanup 与历史 receipt 不授当前执行权。三者在当前头均有真实命令/存储读回。此次编辑的 cutoff 文案是被核验的修正文案，并非用新写的规范给自身背书。

对主干的风险

独立本地四模块 69 passed。另外以相同 frontmatter、registry 和未来有效历史 lease 在固定 base/head 执行 55 个真实子进程：三模式、两种联合选项状态、三输出格式，加九组参数修复完整输出对照和后来新建 Goal。基线六个默认/Markdown 崩溃被实际捕捉；新头十八种拒绝均有明确迁移描述、无 traceback，JSON 省略联合选项时的业务结果及九组参数修复输出与基线逐字一致。源、注册表、原 lease 均未改变。

合法方向也经过实际 File/SQLite：获取、旧 lease-only 与 claim 冲突拒绝、联合交接、展示失败后恢复原回执、旧执行者拒绝、接收方编辑/完成、历史重放后独立检查仍为当前 released 状态。fixture 使用隔离真实 provider；这不等于验证了人的迁移准备流程、所有 Host 或长期部署。

预合并五项直接检查和十九项可执行选择检查通过，五个公开路径扫描 clean；另保留既有 DSH maintainability advisory 和本工作区 quality_stale_receipt 策略 hold，不能称全部合并门绿。全局 docs governance 在同一不可变 base/head 都因相同两个 dated TypeScript RFC 标题失败；检查器、生成器和两个 RFC 的 blob 相同，既有 #6605 负责。没有放宽阈值、移除断言或借用作者的质量回执。作者历史宽集1147/2与其定点修复声明保持原范围，本轮未冒称全宽集重跑或跨平台验证。

语义与 CI 对齐

本头复用已有 canonical_authority_required 词汇，未新增共享闭集；开发期语义 advisory 先于全树 semantic smoke 执行，Ruff/compile/diff/DCO 通过。advisory 空结果不作为动态语义证明；实际 producer/consumer 和反例承担该证明。两种恢复都是既有机器边界的说明，提示不是新的授权。未查询、轮询或等待远端 CI。

我的整体评价

结论 APPROVE，本次拒绝/格式恢复修复的交付判断为 goal_achieved；原连续 Goal 并未因此完成。long_horizon=preserved：精确重放、合法接收方继续工作及 later-current readback 保留；user_experience=improved：三种格式提供同一可操作拒绝，避免用 traceback 替代下一步。原权限、备份和 reviewed migration 仍由原 owner 执行，不增加无依据的确认轮次。

有界整理已经应用：删除孤立拒绝，复用现有 owner；在真实需要的两种描述之间保留清楚的本地展示分支。进一步抽象没有当前收益。此批准不清除上述独立质量/文档门，不授权合并、dismiss、安装、完整 Host 或 D2/D3/default 资格。

English verdict: APPROVE - 6a43153; common canonical refusal now survives JSON/default/Markdown, while argument repair, real File/SQLite recipient progress and retained cleanup/replay remain valid. Independent69 tests and55 CLI subprocesses pass; five direct/nineteen executable canary checks pass. Preserve the separate local quality hold, unchanged governance failure and untested deployment boundaries.