P2: Prove concurrent closing-expiry convergence across repositories

[YueZh127]

Objective

Add deterministic cross-repository regression proof for the existing closing-expiry compare-and-set contract. This is a verification gap discovered while reviewing #27, not evidence that Talos needs another production teardown mechanism.

Review origin and fixed baseline

• Review date: 2026-09-11.
• Source baseline: qa-tools@2dd6dd27a2928f3d70fd5aad0b862117016a0aa4.
• Delivery lineage: P0: Bind terminal action retries to immutable dispatch credentials #29 was implemented by PR github-devloop implementation for #42 #43 and integrated into qa-tools by PR Roll up qa-tools-fkst-staging into qa-tools #44.
• P1: Make interactive lease teardown idempotent across concurrent expiry sweepers #27 was declined by FKST as premise-refuted: current code already fences teardown with immutable claim identity, generation, Task version, and status.
• Existing release operations are additionally reservation/generation keyed in both repositories.

Verification gap

The current suite does not directly force two independent expiry sweepers to observe the same expired closing Task version and then prove that only the winning terminal CAS performs externally observable teardown effects. The production premise is already refuted, but this concurrency contract should be locked down against future regression.

Acceptance criteria

• Use deterministic barriers around two separate TaskService instances so both observe the same expired closing Task version before either guarded replacement resolves.
• Run the same service-level contract against MemoryRepository and a real standalone MongoRepository.
• Start the target machine with activeLeases=2; finish at exactly 1.
• Preserve an unrelated reservation and profile lease.
• Release the target reservation and generation-bound profile lease exactly once.
• Persist exactly one completed task.state_changed event and one task.completed event for the expired Task.
• Cover worker-result-wins and teardown-result-wins orderings at service level for both repositories.
• In each winner ordering, assert the persisted SessionActionResult is exactly the immutable winning result; loser and duplicate retries cannot overwrite it.
• After terminalization, assert pendingActionId is absent and the target Task contains no action left in pending or dispatched state.
• Preserve P0: Bind terminal action retries to immutable dispatch credentials #29 immutable dispatch binding: a legitimate worker retry remains bound to the original dispatch claim/generation/binding, while stale or mismatched credentials cannot observe or replace the winner.
• Prove the losing sweeper performs no lease/profile release, event, or action-result effect.
• Keep non-interactive lease expiry/requeue and existing complete, cancel, queued-close, and closing-expiry contracts passing unchanged.
• Use no sleeps, timing assumptions, process-local locks, timeout increases, client retries, or test-only production behavior.
• If a reproducible bypass of the existing guarded CAS is found, stop and amend this issue with the concrete production defect before changing teardown implementation.

Scope and dispatch gate

• Default scope is tests and narrowly required test seams only.
• Do not change Talos Testing Tool/QARun/provider/deployment contracts.
• Do not mix in terminal-event crash recovery (P1: Make non-testing Task terminal events restart-convergent #46), input/handoff durability (P1: Make non-testing Task input and handoff intents restart-convergent #38), or Mongo action-result indexing (P2: Keep Mongo completed-action result lookup indexed #24).
• Keep this issue unlabelled while P1: Make non-testing Task input and handoff intents restart-convergent #38 is in flight.
• Before later routing, record fresh source/target SHAs and FKST package/manifest authority.
• Deliver through qa-tools-fkst-staging, followed by a separate human-reviewed integration PR into qa-tools; no direct merge, auto-merge, squash, rebase, force-push, or branch deletion.