refactor(shadow): retain observations after source-producer exit

[loopx-agent]

Enabled coordination-shadow inspect, qualify, and read-candidate currently depend on the legacy management adapter. Move the complete observation family into the existing retained readback owner, with exact historical import aliases, so these migration observations continue after source-producer removal.

A related failure surfaced in real validation: an unreadable provider journal becomes bootstrap_required, and inspection can report success with status=missing. The existing TypeScript qualifier now preserves the provider's failure code before lineage validation. Corrupt and unavailable reads refuse observation/qualification; valid and missing-store behavior and default-off admission stay unchanged. No new schema, configuration, RPC, writer cutoff, or promotion authority.

Validation: 48 source/normal-wheel integration cases, 137 retained Python controls, 20 command/adapter unit cases, and 4448 TypeScript tests passed; 37 optional PostgreSQL integration cases were skipped and remain unqualified. TS compilation, configured mypy, Ruff, semantic inventory/checks and the 12-file public boundary scan passed. Five direct and 19 selected premerge checks executed successfully; exact-scope CQR is recorded separately. Real disposable File shadow observations cover all three commands, source drift, insufficient coverage, missing Todo/store, corrupt/unavailable store and restoration with all four producer modules physically absent. Canonical File/SQLite lifecycle, original-operation recovery, leases, settlement and Monitor regression checks retain the live source/capture/history contracts. Immutable-base negative oracles fail for both demonstrated defects; 14 complete CLI comparisons preserve 11 whole responses and disclose 3 provider-diagnostic corrections, with original bytes unchanged. Three moved Python function bodies/arguments are identical; the same source-transfer invoker and native methods are reused. Small paired command samples are no sustained-cost or capacity qualification.

Retain live bootstrap, rollback, promotion, old writers, original receipts/backups and permanent Markdown projection. This is the retained-reader exit under R5/T4, with a bounded typed failure repair. It does not close whole C1, core installed trial, PostgreSQL, frozen D2, or release-default acceptance. Reverting this code requires no state conversion. Existing App/Lark entrypoints and UI are unchanged; no live installation/Host adoption is claimed. No runtime self-merge.

中文：整组旧 shadow 只读检查退出管理模块依赖，复用已有 readback owner，保留公开历史 import 的同一函数 alias。顺带在既有 TS qualifier 修复“provider 读取失败误判为尚未 bootstrap”：损坏／不可读 journal 明确拒绝，不改正常、缺失状态或默认关闭权限。验证使用真实合成 File shadow、canonical File/SQLite 和正常构建 wheel；原写入／回执／备份、永久 Markdown 投影和受支持管理命令保留。全 C1、核心开发者安装试用、PostgreSQL、冻结 D2 和正式默认资格仍按原 owner 验收。

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=xhigh.
Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Exact head: 4421bf6ef05a32bde67c2a10e362855174a7d085

动机

受影响的是检查旧 Goal 数据、准备导入迁移的维护者。旧 shadow 是迁移前的候选副本；原只读检查依赖它的管理模块，移除旧模块后检查直接失败。损坏候选 journal 还会被误报为尚未 bootstrap，检查结果看起来成功。这次整组只读入口改为依赖保留的读回 owner；损坏或不可读候选明确返回 provider 失败，并能在恢复原数据后继续检查。实际旧写入、bootstrap、rollback、promotion 和历史 import 支持仍保留。完整旧 writer 退役、核心开发者真实安装试用、Host/peer、PostgreSQL 与冻结 D2／正式默认资格仍需原验收。

改动思路

复用现有 readback 和 TS qualifier，整组只读调用退出旧管理依赖；相关 provider 失败修复留在同一 typed owner，代码回退不改数据。

规范基线 b760c1eb35613ac84a03cb17246eaba9030db062：docs/architecture/rfcs/loopx-overall-roadmap-v0.md#r5-ts-convergence-and-local-persistence；对应 R5.Selection、R5.Delivery、R5.Exit 和 T4。

既有 R5 的完整调用族、原始证据与无回退要求，和 T4 保留历史 reader／仍受支持 writer 的边界共同约束本批。直接移动三组已有 IO transport，历史 export 保留同一函数 alias；所有权限、source witness、outbox／lineage 资格继续归 TS。没有新 schema、RPC、配置、Python 决策或切默认动作。

具体改动

• handle_coordination_shadow_command（loopx/cli_commands/coordination_shadow.py:356）：inspect／qualify／candidate 直接到 retained readback；关闭态仍在 source capture 前拒绝，管理动作继续使用支持中的 adapter。
• inspect_coordination_runtime_shadow（local_authority_shadow_readback.py:200）：完整 source snapshot 与原 source-transfer invoker 保留，缺席 producer 不再阻断检查。三个移动函数的 body／argument AST 相同。
• qualify_coordination_runtime_shadow（同文件 :251）：minimum operations 和 required event kinds 仍交原生 owner，检查不是执行权限。
• qualifyCoordinationShadowLineageUnderLocks（runtime_shadow.ts:363）：先区分既有 AuthorityStoreReadFailure，将 provider 的失败代码保留给所有读入口，避免误进 bootstrap_required；loaded／missing 分支和后续身份／source／outbox 校验不变。

对主干的风险

最终正常 wheel 已重建前端并逐字节核对四个改动的 production 文件。48 项 source／normal-wheel 真实集成、137 项 retained Python controls、20 项 command／adapter tests 通过；4448 TS 通过、0 失败、37 可选 PostgreSQL skip 保留。TS compiler、mypy19、Ruff、完整 semantic 与 12-path public scan 通过。CQR cqr_86269e801abd3d031141 与 premerge 5 direct＋19 selected 全通过，无 manual hold；这不授予合并权限。

Immutable b760 的旧模块缺席反例和 corrupt-journal 原生反例均失败，修复后通过。相同真实 CLI 的 14 组完整 decoded payload 对照：11 组保持，3 组损坏诊断按明确的新规则拒绝；原 state／registry／journal／outbox bytes 不变。缺失、损坏、EISDIR 不可读、源漂移、资格不足、missing Todo、默认关闭和恢复均覆盖。小样本与相同 RPC 调用不证明持续容量；冻结 D2 失败／缺失仍保留。

初次 canary 的全局解释器缺 pytest，改用该 checkout 的 test-extra 环境重跑；一次 wheel build 因前端 fingerprint 过期而拒绝，旧 artifact 的失败不计资格，重建并核对后的最终 run 全通过。所有通过结果来自最终 code scope。PG／真实安装 cohort／attached Host／浏览器与 live Lark 未在此切片中验收；这里是 File shadow 的既有 CLI 观察路径，canonical File/SQLite 是回归覆盖。App/Lark UI 和操作入口没有改变。历史 import 和真正活跃的 capture／writer／backup／receipt 保留；以后删 writer 仍须自己的 cutoff。

我的整体评价

本 PR 交付旧 shadow 的整组观察入口解耦及读取失败诊断修复；后续写入退出和安装采用沿既有 R5/T4 路径继续。

整组调用出口可独立回退，保留兼容和原数据义务；相邻失败分类修复已经落在原 TS owner，future-facing pass 已应用。当前没有阻塞发现，建议维护者审阅后合入；不自行合并 Core，也不称为全 C1 或发布默认完成。

English verdict: APPROVE — The retained observation family works without all four source producers; provider read failures now refuse explicitly. Final source/wheel and typed validation passed, with 37 optional PG skips retained. Live writer support, historical imports and parent adoption/release gates remain open. No CI was fetched under the current review policy, and this review grants no merge authority.