test(collaboration): qualify the Windows peer read lane in CI

[JasonBuildAI]

Goal And Delivered Outcome

• Outcome basis / optional anchor: issue Windows: peers.py inbox read crashes on os.O_NONBLOCK (bare use; defensive getattr form already used elsewhere) — and the read receipt is persisted before the crash #5511 (Windows peer inbox read path); the maintainer reply there keeps the remaining Windows peer-brief qualification as a platform gap.

• Goal/source and gap: tests/test_peer_collaboration.py carries three Win32-marked regressions for the peer inbox read lane — long private store paths, binary CRLF/Ctrl-Z digests (the input_readiness open that used to raise AttributeError on Windows), and long workspace inputs behind a junction. The windows-powershell job runs explicit pytest lists that never included this file, and the ubuntu shards skip those rows by platform marker, so those three rows have executed on no runner since they landed (fix(collaboration): qualify existing peer handoffs on Windows #5456, 05e596d).

• Observable before → after, with the validation row that proves it: before, no CI runner executed test_peer_exchange_survives_long_private_store_paths, test_peer_binary_artifact_preserves_crlf_and_ctrl_z_digest or test_peer_read_qualifies_long_workspace_input; after, the Windows job executes exactly those three rows on native Windows. Proven by the real_entrypoint row below.

• Issue/task and intended base: Related to Windows: peers.py inbox read crashes on os.O_NONBLOCK (bare use; defensive getattr form already used elsewhere) — and the read receipt is persisted before the crash #5511 — its shipped code fix is not reopened, and only the platform-coverage gap it named is closed. Base: upstream main at ed79bfd.

Author Declaration

• Written by: model_agent — an OpenAI Codex agent, working under the direction and constraints of the repository contributor @JasonBuildAI, who reviewed the result.

AI disclosure: this change was drafted with AI assistance at my request, under my direction and review.

Implemented against

• Specification and revision: issue Windows: peers.py inbox read crashes on os.O_NONBLOCK (bare use; defensive getattr form already used elsewhere) — and the read receipt is persisted before the crash #5511 body (repro and "The fix already exists in this repo — twice" sections) as accepted on 2026-10-05, plus the repository contract for the windows-powershell job in .github/workflows/python-tests.yml at ed79bfd.
• Criteria:

Criterion (spec clause)	Disposition	Symbol / path	Test or command
The Windows peer read lane is exercised on a Windows host (#5511 "Repro")	implemented	.github/workflows/python-tests.yml → windows-powershell	python -m pytest -q tests/test_peer_collaboration.py::test_peer_read_qualifies_long_workspace_input
Input readiness keeps the guarded flag form that #5456 landed	implemented	loopx/control_plane/collaboration/peers.py::_input_readiness_for_goal (unchanged)	the three Win32 rows above
The reads/<request_id>.json receipt is evidence of a completed read only (#5511 "Impact notes")	implemented	loopx/control_plane/collaboration/peers.py::read_inbox (ordering set by 025be07)	tests/test_peer_collaboration.py::test_a_failed_input_readiness_leaves_no_read_receipt

• Receipt-ordering history: the "receipt persisted before the crash" half of the report was real for 1.2.4 — read_inbox committed the read before response enrichment, and 025be07 ("fix(collaboration): commit inbox reads after response validation", merged 2026-10-04, before this base) moved it after. This PR changes no runtime code; it holds that ordering with a test so it cannot drift back.
• Self-check before submission: ran the added workflow command and the full affected test file on native Windows, read read_inbox and _input_readiness_for_goal to locate the ordering, and mutation-tested the new contract test. Deliberately not added: the rest of tests/test_peer_collaboration.py to the Windows job. Those rows already run on the ubuntu shards; only the three Win32 rows execute nowhere, and a recent windows-powershell run on main took 12m05s of its timeout-minutes: 30, so the step is limited to the ~1 minute of coverage nothing else provides.

Scope And Continuation

• Completed scope and remaining work: complete within this scope — the Windows-only rows of the peer read lane now execute on Windows, and the receipt ordering has coverage.
• Slice boundary / successor: N/A. The broader Windows peer/desktop platform qualification tracked from Windows: peers.py inbox read crashes on os.O_NONBLOCK (bare use; defensive getattr form already used elsewhere) — and the read receipt is persisted before the crash #5511 remains with its existing owner; this does not claim it.

Validation

• Tested revision: 5ba7b26a9
• Run state: finished
• Input classes: synthetic

Check kind	Result	Public-safe evidence / limitation
static	passed	python -m ruff check tests/test_peer_collaboration.py (All checks passed); git diff --check clean
unit	passed	python -m pytest -q tests/test_peer_collaboration.py on native Windows at d903712: 34 passed, 2 skipped. The two skips are pre-existing (POSIX FIFO fixture; a symlink fixture that requires privileges). After the docstring edit that produced 5ba7b26a9, the touched test was re-run alone: 1 passed.
real_entrypoint	passed	The exact command of the new windows-powershell step, run on native Windows: 3 passed in 60.70s — the three rows that previously executed on no runner
regression_parity	passed	Mutation check on the new test: moving record_read ahead of input readiness makes it fail at assert not receipt.exists(); the probe was reverted and the test passes again
unit	failed	python -m pytest -q tests/test_python_ci_workflow.py: 4 failed, 543 passed on this host, with the same 4 failures reproduced with this diff reverted (they need bash and a UTF-8 console). Environment limitation, not a diff effect.
manual	failed	loopx canary premerge --from-git-diff --git-diff-base upstream/main: diff hygiene, py_compile and the public/private boundary scan passed for this diff; the catalog canary cli-output-budget-regression-smoke.py was killed by its own 120s budget on this Windows host and also fails on a pristine upstream/main worktree (temp-dir cleanup WinError 32). Reported as a host limitation, not a diff effect.
manual	not_run	Independent review by a separate agent reviewer at d903712: re-ran the focused checks (ruff clean; full file 34 passed, 2 skipped; the three step node ids 3 passed in 66.68s) and confirmed in source that read_inbox calls the patched _input_readiness_for_goal before record_read. It did not run the mutation probe or the Windows job itself.

• Coverage and gaps: the changed workflow step is validated by parsing the workflow and running its exact folded command; tests/test_python_ci_workflow.py passes for the Windows job. Residual risks: (1) these three rows are written by their authors and this is their first execution on a CI Windows host — they passed on a developer Windows host and CI will confirm; (2) the added step is not covered by the existing node-id/file-existence guard in tests/test_python_ci_workflow.py, which only parses the "Run native Windows lifecycle tests" step. That guard was left untouched to keep this change reviewable, and the failure mode of a stale node id is a loud pytest collection error rather than silent loss of coverage; the pre-existing "Validate local-state routing" step has the same shape.

Frontend / Visual Evidence

• UI impact: none
• Before: N/A
• After: N/A
• States and viewports shown: N/A
• Source data: none
• Attention review: N/A — no user-visible surface changed.

Type of Change

• Test update
• Bug fix

LoopX Area

• Build, packaging, installer, or CI

Technical Direction

• Direction / acceptance reference, when applicable: N/A for this bounded slice; the linked Windows: peers.py inbox read crashes on os.O_NONBLOCK (bare use; defensive getattr form already used elsewhere) — and the read receipt is persisted before the crash #5511 platform gap remains with its existing owner.

Shared-authority RFC fixture impact

• Production-scale fixture schema: N/A
• Semantic dimensions changed, or reviewed no-impact rationale: N/A — no control-plane vocabulary changed; scripts/generate_semantic_inventory.py --changed-from HEAD reported no supported new vocabulary carriers.
• Provider conformance arms run: N/A
• Read-only legacy/file/PostgreSQL three-arm rehearsal (required for promotion, runtime-routing, or compatibility-projection changes): N/A

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths.
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

See validation disclosure guidance.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh.

Exact head: 5ba7b26; immutable base: c0f77b2.

动机

维护 Windows 协作入口的贡献者，需要让现有平台专属回归测试实际进入 Windows 测试任务，并防止失败读取留下成功回执。

以前三个 Windows 专属 peer 测试在 Ubuntu 上被跳过，Windows 任务也没有选择它们；新工作流显式执行这三个现有测试，并新增读取准备失败时不写读回执的回归保护。

Windows 工作流位置、折叠命令和三个选择项已解析并收集验证；真实本机读取测试与提前写回执的反向变异验证通过。

本 PR 不修改生产协作代码，也不证明全部 Windows 平台、端到端桌面或本机 Windows 实际执行成功。

本机是 macOS，三个 Windows 专属测试未独立执行；完整 Windows 桌面与平台资格继续现有 #5208 验收。

改动思路

复用既有 Windows job、三项平台夹具和生产读取所有者；新增一项失败回执保护足够，不需要生产修复或新测试框架。

当前 PR 是可独立审查和回退的 Windows 测试选择与读取回执保护；不关闭完整平台验收。

具体改动

关键代码讲解

完整两文件 +38/-0 已读。规格来源 https://github.com/loopx-project/loopx/issues/5511，spec_revision issue-5511-maintainer-comment-5995568203：maintainer 已说明生产修复随1.2.4交付，完整 Windows 资格仍是独立平台缺口。映射 5511-read-receipt、5511-windows-selection 已实现；5511-full-platform 延后到原#5208，并不把测试选择当全部平台合格。

Windows job 已有 checkout、Python3.11、Node24 和 test 依赖，新增 folded python -m pytest -q 选择已有长私有路径、CRLF/Ctrl-Z binary digest、长 workspace input/junction 三项。没有扩大生产权限或重写协作读取。新增 test_a_failed_input_readiness_leaves_no_read_receipt（test_peer_collaboration.py:783）要求输入准备失败时没有读回执，解除故障后经真实 read_inbox（peers.py:603）完成读取再有回执。

独立执行相关 peer 与 workflow 套件：580通过，3项Win32专属在macOS跳过。YAML解析确认 existing windows-latest job；三个选择项都被收集，folded命令不是多条PowerShell命令。将实际 record_read 故意移到 readiness 前，新测试在回执不存在断言上失败；finally还原生产源码字节后真实读回通过。Ruff和diff-check通过。三个原Win32夹具完整检查覆盖>260路径、二进制hash、changed/missing/junction越界拒绝及清理边界；作者Windows执行报告只作声明，没有算作本Agent独立证据。

无阻塞发现。最强未验证项是本机不能执行Win32原语，完整平台与桌面资格继续#5208。当前可交付结果是将现有专属回归放入正确lane并用变异证明读取顺序保护有用，不能宣称Windows产品全验收。本PR不引入新状态或词表；既有loopx/control_plane/collaboration生命周期、持久回执和输入IO原样保留。未来相关refactor pass 未发现需要当前扩大生产范围的理由；复用现有job/fixtures最合适。没有查询、轮询或等待CI。

最终 head 5ba7b26 的完整两文件 diff 重读；相对旧 d903712 只更正历史说明，测试断言及 workflow 未变。最终 head 重新执行580通过/3平台跳过，反向变异、真实恢复、YAML三项收集、Ruff/diff通过。最新 main c0f77b2 的 Todo API 重构在另一未提交合并树同样580通过/3跳过；不把旧 head 验证继承为新 head 执行。

对主干的风险

本机是 macOS，三个 Windows 专属测试未独立执行；完整 Windows 桌面与平台资格继续现有 #5208 验收。 本 PR 不修改生产协作代码，也不证明全部 Windows 平台、端到端桌面或本机 Windows 实际执行成功。 默认行为、作用范围和失败恢复以上述独立对照为依据，观察或测试计数不能证明全部父目标完成。未执行合并、dismiss 或本机升级。

我的整体评价

APPROVE，限当前精确 head 的有界交付；无未解决阻塞项。当前 PR 是可独立审查和回退的 Windows 测试选择与读取回执保护；不关闭完整平台验收。 复用既有 Windows job、三项平台夹具和生产读取所有者；新增一项失败回执保护足够，不需要生产修复或新测试框架。 长期运行方面保留父验收，并加强重复读取/失效恢复或平台回归保护；用户体验方面，启用观察后的关系与证据读回已实测，而测试工作流只改善维护者资格验证，普通产品界面不变。观察质量、原平台持续运行及作用范围仍按前述未验证项验收。

English review

This is a bounded qualification improvement for maintainers of the Windows peer lane. The three existing Win32-only tests were skipped on Ubuntu and absent from the Windows list. The new folded pytest step selects them in the existing windows-latest job after its existing Python/Node/test setup. One cross-platform regression asserts that failed input readiness leaves no read receipt and a subsequent real successful read does. Production peer logic is unchanged.

Both files were reviewed against issue5511 and its maintainer statement that the runtime repair shipped in1.2.4 while broader Windows qualification remains separate. Independent local validation gives580 passed and3 platform skips. YAML parsing and pytest collection confirm all3 selections. A deliberate mutation moves the actual record_read before readiness; the new assertion detects the premature receipt, and restoring exact production bytes makes the real read pass. Ruff and diff hygiene pass. The existing fixtures cover extended paths,binary CRLF/Ctrl-Z digests, changed/missing inputs and junction escape refusal. Author-reported Windows results are not reviewer execution evidence.

No blocking finding. Actual Win32 execution is unavailable on this macOS host and is explicitly unverified; full platform/desktop qualification remains with#5208. This approval covers useful workflow selection and durable receipt regression protection, not complete Windows product qualification. Reusing the existing job,fixtures and unchanged lifecycle owner is proportionate; no new runtime mechanism,state contract or refactor is needed. No CI was fetched or awaited. Final head5ba7b26a954f30b060338bbe5ca51ce0b221265a only corrects historical ordering prose relative to d903712; nevertheless its whole two-file diff and580 related tests,mutation/recovery,selection and hygiene were reevaluated. A separate no-commit integration with latest main c0f77b2 also gives580passed/3platform skips.

English verdict: APPROVE — exact head 5ba7b26; bounded delivery qualified, broader acceptance and explicitly unverified dimensions remain separate.

[JasonBuildAI]

Check disposition for head 5ba7b26a9, as of this comment.

New step passed on CI. In windows-powershell, Qualify native Windows peer reads and long-path inputs completed success on windows-latest — the first time test_peer_exchange_survives_long_private_store_paths, test_peer_binary_artifact_preserves_crlf_and_ctrl_z_digest and test_peer_read_qualifies_long_workspace_input have executed on any runner. The three test rows cannot execute everywhere else: the ubuntu shards skip them by platform marker.

One unrelated step failed in the same job. Run native scheduler and SQLite authority tests (TS scheduler/SQLite rows) failed. It is not attributable to this diff, which touches no runtime code and adds one pytest step before it: the same step fails on another open PR, codex/app-producer-independent-import-20261010 (run 38026590501), and codex/fix-lark-private-return-source-fixture (run 38028615442) fails the earlier Run native Windows lifecycle tests step, while runs 38026035693 and 38024328167 pass the whole job. This is current-base Windows-runner behaviour, not this branch's.

Local evidence at this head. python -m pytest -q tests/test_peer_collaboration.py on a native Windows host: 34 passed, 2 skipped (pre-existing skips: POSIX FIFO fixture, symlink-privilege fixture). The exact step command locally: 3 passed in 60.70s. Mutation check on the new test: moving record_read ahead of input readiness makes it fail, then passes when reverted. ruff check and git diff --check clean. tests/test_python_ci_workflow.py: 4 failures that reproduce with this diff reverted on the same host (they need bash and a UTF-8 console).

Known limits. I could not yet read the failed step's log because the workflow run has not finished; the failing set is reported above by comparison with concurrent runs. The failed step does not execute or cover anything this PR changes.

[BigDataDZ]

Independent verification on a real native Windows 10 host (zh-CN, cp936, Python 3.12) — the platform this PR's whole point is about, and the one its own CI job could not currently evidence (the head's windows-powershell job is red with a generic exit-1 annotation).

Verified by execution at head 5ba7b26a: all four test cases this PR qualifies pass locally:

• test_a_failed_input_readiness_leaves_no_read_receipt (new ordering pin: a raising readiness probe leaves reads/ untouched; the next completed read records exactly one receipt)
• test_peer_exchange_survives_long_private_store_paths (Win32)
• test_peer_binary_artifact_preserves_crlf_and_ctrl_z_digest (Win32)
• test_peer_read_qualifies_long_workspace_input (Win32, junction) — the junction fixture also works unprivileged on this host

Focused run: 4 passed in 78s. The workflow change itself (adding the explicit pytest node list to the windows-powershell job) is syntactically sound and targets the correct job.

One pre-existing flaky pattern surfaced while running the full file (32 passed, 2 skipped, 1-2 flaky failures across runs, deterministically unrelated to this PR): directory walks over runtime state can race with the ephemeral cross-runtime lock holder sidecar on Windows. test_canonical_stopped_goal_rejects_peer_request_before_any_write failed with FileNotFoundError when a walker listed ...\.local\manager-context\entries\...\....lock.lock.holder.json and the file was deleted before read_bytes(). The same ephemeral-sidecar mechanism also surfaced in #5966 (a glob("*.json") assertion matching a persisted .lock.holder.json). Suggest a follow-up: walkers over runtime dirs should tolerate/skip *.lock.holder.json, or the sidecar should not share the .json suffix - either removes a class of Windows-only flakes across several suites. Non-blocking here; the new test passes deterministically.

Approving on the evidence above: the three long-orphaned Win32 regressions now have a CI execution lane, and every case they assert passes on a real native Windows host.