test(control-plane): stabilize renewal cancellation timing

[mikamikasuki]

Goal And Delivered Outcome

• Outcome basis: flaky test observed in TypeScript core shard 3/3 for PR #5962.
• Goal/source and gap: The test uses a 4-second lease and a fixed 3.5-second wait, leaving little time for the renewal subprocess to persist a new completion wait and return. On the CI failure, the deadline timer won and the test expected the wrong causal boundary.
• Observable before → after: The test now gives renewal a 12-second lease window, waits for the Host heartbeat to start, and awaits the actual supervised result before checking that cancellation stopped the heartbeat. Under a controlled 3-second delay in the renewal subprocess, the old test failed while the updated test passed.
• Issue/task and intended base: No issue is needed for this self-contained test maintenance change under CONTRIBUTING.md; rebased on main at 3ed5d6b.

Author Declaration

• Written by: model_agent — OpenAI GPT-6 Luna.

Implemented against

• Specification and revision: No separate written specification; this PR's test scenario is the acceptance basis, on main at 3ed5d6b.
• Criteria:

Criterion	Disposition	Symbol / path	Test or command
A completion wait added during renewal cancels the delegated Host before it continues executing	implemented	tests/control_plane_ts/host_process.test.ts	node --no-warnings --experimental-sqlite --experimental-strip-types --test tests/control_plane_ts/host_process.test.ts

• Self-check before submission: Reproduced the timing failure with a controlled local delay, reviewed the exact CI failure and repository contribution requirements, and confirmed the change remains limited to this test.

Scope And Continuation

• Completed scope and remaining work: Stabilize the renewal-cancellation regression test while retaining its assertion that a rejected renewal stops the Host.
• Slice boundary / successor: Complete within this scope.

Validation

• Tested revision: b2e23eb (base 3ed5d6b)
• Run state: finished locally; hosted checks are rerunning on this revision.
• Input classes: synthetic

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	On Node 22.22.3, a controlled 3-second delay after the wait mutation made the original 4-second fixture fail its heartbeat-stop assertion; the updated fixture passed with the same delay. This red-green delay qualification was run on the prior head 148ccf2; the rebased diff only changes the test fixture.
unit	passed	On Node v24.21.0, all 15 tests in tests/control_plane_ts/host_process.test.ts passed on the rebased head.
static	passed	npm run typecheck:control-plane -- --pretty false and git diff --check passed on the rebased head.

• Coverage and gaps: The local timing comparison exercises the deadline-versus-renewal boundary. No product implementation changed. Hosted checks on the rebased revision remain in progress.

Frontend / Visual Evidence

• UI impact: none
• Before: N/A
• After: N/A
• States and viewports shown: N/A
• Source data: none
• Attention review: N/A

Type of Change

• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)

Technical Direction

• Direction / acceptance reference: N/A; test-only maintenance.

Shared-authority RFC fixture impact

• Production-scale fixture schema: N/A
• Semantic dimensions changed, or reviewed no-impact rationale: N/A; no fixture schema or product semantics changed.
• Provider conformance arms run: N/A
• Read-only legacy/file/PostgreSQL three-arm rehearsal: N/A

Boundary Checklist

• No private state, credentials, raw traces, internal links, or local paths are included.
• No maintainer-owned benchmark work is involved.
• The change is limited to the regression test described above.
• UI impact is marked none.
• The commit includes a DCO Signed-off-by trailer.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=xhigh.

Reviewed exact head b2e23eb430a7fd7e66ebb3b985688bfe39abfeb8 against base 3ed5d6bc88ffaaa05f2b1bc6a98ed5d921379fd1. APPROVE；有一项不阻塞本次修复的既有覆盖改进建议。

动机

维护者运行 delegated Host 回归时，需要可靠地区分续租拒绝与期限到达。
续租子进程在保存等待条件后延迟 3 秒，旧测试误报心跳仍运行；新测试等待真实取消结果，并检查拒绝原因、停止后的心跳及已保存条件。
本轮独立 base/head 均 15 项通过；同一 3 秒延迟探针 base 失败、head 通过，当前 TS typecheck 与 diff 检查通过。
本 PR 不改变生产 supervisor、租约权限、默认配置或 UI/Lark，也不验收 live App、所有平台或整体恢复能力。

这是维护现有回归信号的完整小修复。作者关于旧固定等待的描述已用同一基础版本和当前 head 独立复现；没有以作者测试或远端 CI 代替本轮执行。召回的恢复方案产品交付建议不适用于这项内部测试维护，但“明确当前有用结果、区分证明层次”仍用于判断；未继承历史 verdict 或声称记忆改善了模型效果。

改动思路

继续使用既有 delegatedCompletionWaitFixture 和真实 TS supervisor，而不是另造租约判断或新测试框架。旧测试在调用尚未返回时，以固定 3.5 秒取样决定心跳是否停止；改为先确认 Host 已实际启动，再等待受监督结果，检查真实取消原因和停止后的心跳。

仅延长旧固定 sleep 仍可能与子进程调度竞争；当前方案复用正确的返回边界。租约 4→12 秒，外层 watchdog 8→16 秒，为续租响应留下空间；生产 expiry、重试、取消和 canonical lease owner 均未改。等待更长是局部测试成本，不是延长生产授权。

具体改动

完整 diff 只有 tests/control_plane_ts/host_process.test.ts，+5/-7，全部属于测试夹具：

• delegatedCompletionWaitFixture(t, 12) 扩大测试租约窗口；真实 FileAuthorityStore、atomic claim 和 renewal 写入等待条件保留。
• Heartbeat readiness 通过现有 marker 轮询，2 秒上限内确认进程启动；移除 premature 固定时间取样。
• await running 后保留 spawned === 1、outcome === cancelled、renewal_rejected / renewal、返回后 heartbeat 稳定，以及 canonical resume_when 已保存的断言。

规格依据：docs/reference/local-delegation.md，完整 revision 3ed5d6bc88ffaaa05f2b1bc6a98ed5d921379fd1，Disconnect and recovery：首个 typed failure 与 renewal/deadline 区分保持 implemented；取消结果不被当成 lease release 或 stop settlement。并对照现有 Host 执行区间规范；未改其准入、权限或恢复合同。

现有 lease_acquisition_conformance 覆盖权威拒绝，而此文件覆盖实际进程生命周期；本 PR 在原测试上修改，没有增加重复 smoke。同作者相邻 #5991/#5993/#5994/#5986 的摘要分别指向内容 revision、hook fixture、successor 和 periodic report，未发现与本项重复的同形拆分。

对主干的风险

独立验证使用 Node v24.21.0：基础版本和当前 head 的完整文件各 15 passed；head 的 npm run typecheck:control-plane -- --pretty false、完整 B..H git diff --check 通过，DCO trailer 存在。相同私有隔离源码探针在实际 renewal 保存等待条件后延迟 3 秒：base 的旧 heartbeat-stop 断言失败，head 的同一测试通过。这是受控时序比较，不是长期或全部平台稳定性证明；未查询、轮询或等待远端 CI。

P2 建议：补足“续租拒绝时取消”与“到期最终停止”的区分。 在隔离 B/H 源码里，仅去掉 lose() 对 renewal failure 的 abort，保留原因记录及独立 expiry abort，两版本的目标测试均通过。当前 head 的故障探针先记录 renewal rejection，约 5.261 秒后才由 deadline 取消；测试仍接受正确的首个原因与返回后停止。这证明的是两版本共有的测试盲点，不是本 PR 新增的生产 bug。

建议在现有 fixture 中暴露实际 rejection 观察点，检查 expiry 尚未介入时 Host 已不再产生作用，并使同一 missing-abort 故障探针失败；同时保留延迟响应容忍。无需添加第二个 runtime owner。这个既有缺口不否定本次已复现的 flaky-test 修复，单次 suite 通过也不证明整个执行权限区间已验收。

未运行 live App、Windows、PostgreSQL 或全仓测试；生产代码、UI/Lark 交互和持久化格式均未改变，没有把这些层次写成通过。最初一次搜索因 shell 未匹配的 glob 及一次误指 module path 未执行目标读取，随后按结构化 argv 和实际 owner 路径完成搜索，未把设置失败当成测试结果。

我的整体评价

APPROVE，无本次引入的阻塞发现。当前 slice 完成已证明的固定采样/renewal 竞态修复，保留原生取消原因、实际停止和保存状态检查。未来重构检查：当前 local fixture/真实返回 seam 已足够，建议的 rejection 观察改进应落在同一测试边界；已有 missing-abort 覆盖缺口作为 P2 保留，不扩成通用框架或额外权威。

这是评审结论；合并资格和维护者授权需独立读回。

English verdict: APPROVE — exact head b2e23eb; both base/head pass 15 focused tests, identical delayed-renewal qualification fails base and passes head, typecheck and diff checks pass. A shared missing-abort coverage gap remains as a non-blocking suggestion; no production authority change or full live-host qualification is claimed.

[mikamikasuki]

Follow-up coverage update for the reviewer’s P2 note:

• The fixture now records when renewal is rejected and captures the actual Host PID.
• It verifies that the Host process exits before the last proved lease expiry; it no longer infers cancellation timing from the supervisor wrapper returning, which includes the process-group cleanup grace period.
• Mutation check: omitting the renewal-failure abort while retaining the expiry abort makes the before-expiry assertion fail. The production source was restored exactly; this update changes tests only.
• Validation on 1224503: tests/control_plane_ts/host_process.test.ts — 15 passed; npm run typecheck:control-plane -- --pretty false and git diff --check passed.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=xhigh.

Reviewed exact head 1224503a29d0872938fb3c6692132241c60e9290 against base 3ed5d6bc88ffaaa05f2b1bc6a98ed5d921379fd1. APPROVE，无阻塞发现；本次独立全量判断不继承旧批准。

动机

维护者运行 delegated Host 回归时，需要可靠地区分续租拒绝和租约到期。
旧测试固定时刻采样，并可能把到期停止当成续租拒绝后的停止；当前测试读取拒绝观察点并检查真实 Host PID 在到期前退出。
当前 exact head 完整 15 项测试通过；保留 expiry abort、仅去掉 renewal abort 的独立反例触发新增断言失败。
本 PR 只维护既有测试，不改变生产租约、停止结算、默认行为或 UI/Lark，也不验收 live App 或所有平台。

这是一项有独立反例证明价值的既有回归维护。召回的恢复 RFC/产品旅程建议不适用于单文件内部测试改动；区分过程、实际停止和结算证明仍适用，没有把上下文交付当成模型效果验证。

改动思路

复用既有 canonical claim、renewal、真实 TS supervisor 和同一个 fixture。增加拒绝观察点和实际 PID 退出检查，比延长固定 sleep 更直接地验证取消因果。12 秒仅为测试租约窗口，16 秒为测试 watchdog，生产规则未改；t.after 保留 owned-process abort 清理。

未来重构检查：当前 fixture 就是最小 owning boundary，已在同一文件加强观察，无需抽通用框架、并行租约 owner 或额外 smoke。

具体改动

全量 B..H 只有 tests/control_plane_ts/host_process.test.ts，+30/-11。delegatedCompletionWaitFixture 将 renewal 拒绝写入局部观察文件并返回路径；测试从 4 秒 lease / 固定 3.5 秒 heartbeat 采样，改为 12 秒 lease、确认 Host 启动、等待真实拒绝，再要求 PID 在最后证明的 expiry 前退出。仍检查 spawned=1、cancelled、renewal_rejected/renewal、停止后 heartbeat 不变和 canonical resume_when 已保存。

关键代码讲解

• delegatedCompletionWaitFixture 调用真实 executeCanonicalTaskLeaseLifecycle；新增文件只观察结果，不替代权威状态。
• runLeasedHostProcess 的实际 spawn callback 提供 PID；process.kill(pid, 0) / ESRCH 判定进程退出，避免把包含 process-group 清理宽限的 wrapper 返回时间误当停止时刻。
• 测试的 rejection/stop deadline 均限制在原 lease expiry 前，保留 first typed cause 和最终状态检查。

规格依据：docs/reference/local-delegation.md，完整 revision 3ed5d6bc88ffaaa05f2b1bc6a98ed5d921379fd1，Disconnect and recovery implemented：区分 renewal rejection 与 proved deadline，不把 cancelled 当成 lease release 或 stop settlement。完整读过旧 review 和 inline P2：旧评审 head b2e23eb430a7fd7e66ebb3b985688bfe39abfeb8 到当前 head 的新增部分是拒绝观察/PID/到期前退出断言；原时序修复在全量 diff 中也重新判断。

同作者相邻 #5991/#5993/#5994/#5986 的当前完整队列摘要分别涉及内容 revision、hook、successor、periodic-report；现有 lease conformance 验权与本文件验真实进程生命周期不同，没有增加同形 smoke 或重复框架。

对主干的风险

新独立执行的当前完整文件 15 passed，Node v24.21.0 / Darwin；当前精确 worktree 的 TS typecheck、完整 B..H diff check 和两个 commit 的 DCO 均通过。仅测试 fixture/断言改变，生产实现与 base 相同。

复用先前独立反例时做了源码失效检查：当时最小隔离 source subset 的 1045 个文件与当前 immutable head 内容逐字一致，相关 caller、依赖源和测试均无变化；这不是宣称当时留存了全仓快照。先前同一目标测试 clean 通过；只移除 renewal-failure abort、保留首个 reason 和独立 expiry abort 的版本，在新增“到期前已停止”断言失败。当前全量 suite 新跑通过，因此旧 P2 覆盖盲点已有直接消辨证据，不靠作者的 mutation 声明。

前一评审的同一 3 秒延迟 base/head red-green 保留其原始版本，未冒充本轮新跑，也没有以最后一次绿测试抹除早期观察。这个有界运行集支持测试维护，不证明长期/所有平台稳定性。一次 archive 环境缺少 tsc 的准备失败已保留；随后在当前精确 worktree 使用现有依赖重跑 typecheck 通过。未查询、轮询或等待 CI；未运行 live App、Windows、PG 或整仓 suite。

我的整体评价

APPROVE。原固定采样竞态修复及新拒绝/PID观察形成同一完整的小改动，取消原因、实际停止、到期前边界和原有效断言均保留。旧建议已用相关源码匹配和独立 missing-abort 反例验证，未发现新的阻塞问题。合并资格、有效旧 review 和维护者授权独立读回，批准不是合并授权。

English verdict: APPROVE — exact head 1224503; fresh full 15-test suite, exact-head TypeScript typecheck, diff and DCO checks pass. The independently qualified same-head missing-renewal-abort mutation fails the new before-expiry PID assertion; no production authority or all-platform acceptance is claimed.