fix: align delegated snapshot with task lease

[Miko997]

Outcome

Problem

A valid v2 delegated task had a signed maximum ten-minute task lease, but an undocumented 300-second provider-snapshot sub-limit caused repeated broker exact-base admission seals to invalidate an otherwise live delegation before durable reservation.

User-visible behavior

None. This is a fail-closed MP2-016 broker/delegation correction.

Changes

Scope

Use one shared MAX_TASK_LEASE_SECONDS=600 bound for the v2 task lease and its exact signed provider snapshot. Document that repeated broker admission seals may validate only while the original signed task lease remains live. Refresh generated UI/public-surface/traceability currentness records and the canonical test collection count.

Out of scope: workflow triggers, rulesets, branch protection, broker ordering, merge-readiness timing, owner/emergency authority, release/publication authority, and historical evidence rewrites.

Compatibility

No Python, platform, CLI, schema, artifact, stored-history, or v1 delegation compatibility change. Existing v1 records retain their original interpretation.

Evidence and research impact

The provider snapshot remains exact-digest, provider-cursor, task, base, role, and dual-signature bound. The change removes only the undocumented five-minute sub-lease; it does not outlive the signed task lease. Existing historical evidence is not rewritten. A new regression covers the formerly rejected live portion after 300 seconds and exact expiry remains rejected.

Validation

Tests

• Focused tests run: full local suite 6255 passed, 16 skipped; focused/currentness set 234 passed, 2 skipped; Ruff, format, canonical mypy, four generated-currentness checks, and git diff --check passed; independent exact-tree review CLEAN / APPROVED for commit 8a5a49433c07afd59d8059ff04203ad3542a3ea9 and tree 8022b058fc4d9590f897e9c77941b04fa7a20bef.
• Complete hosted qualification (exact candidate, run/attempt, or pending): pending for exact head 8a5a49433c07afd59d8059ff04203ad3542a3ea9.
• Manual checks, if any: none.

Documentation

Updated task delegation, main-health broker, change-execution contract, and testing policy declarations. Generated functional/public-surface/traceability records are current.

Boundaries

Privacy and security

No credentials, recordings, private paths, archives, personal data, or identifying workcell data were added. This does not create an independent 600-second extension: validation still requires capture at or after issuance and not in the future, a task lease no longer than ten minutes, current time before delegation expiry, current merge-request lease, every provider/state seal, and the existing pre-reservation budget guard. No external contact, paid infrastructure, release, tag, upload, repository-setting change, or protection weakening occurred.

Checklist

• The pull request is focused and its diff has been reviewed.
• New or changed behavior has tests, including a relevant failure path.
• Focused checks pass locally; required complete qualification must be green for the exact candidate before merge.
• User-facing commands, support boundaries, and documentation remain truthful.
• Third-party material has compatible licensing and required attribution.
• No credentials, private recordings, personal data, or identifying workcell data were added.
• Frozen v0.2.0 evidence, checksums, measurements, tag, and DOI metadata were not rewritten.
• Current package capabilities are not attributed to the v0.2.0 SoftwareX evidence or the TIM v0.1.3 measurements.

[Miko997]

metriplane-owner-merge-request:v1
{"authorization_mode":"single-maintainer-owner-attestation","base_ref":"main","base_sha":"9ae55abf9287ed357f150e5d769cbf8e108d3ec7","changed_paths_digest":"0763122efb42f4566a1fa328ec7d863723a7425660cd13bae459a740362e9c25","collaboration_digest":"97956f2c016d6323f4e7921877599536bc72d63f26a73a3ab9e2d91abaf909d4","expires_at":"2026-09-30T05:57:16Z","head_sha":"8a5a49433c07afd59d8059ff04203ad3542a3ea9","health_generation":133,"nonce":"f367194dea614a844876df6cd3cf1501","pull_request":191,"repository":"Miko997/metriplane","requester_id":141511110,"ruleset_digests":{"20613848":"1296e1ef0e46ed8e2a0e05a73440b0be9f9ef0b9d250fb2e403f8f8538719a92","21487681":"c1689c8b834e31c319fd16007fced5f10fc939fed655fc32f47d0c03e5df6fce","21500579":"a9666448444c28603d7b16f36a866f3c3ebf008107e0e495b8433a5726fd115a","21533351":"4a6c626d1ff8d57dc3aef04b6c65769e750fb1d1ed866bf7ed60902553c8a671","21633569":"6f4993da872387e0b31ca5366be448a9cb7eae69154f36710af2d235eb80ca2b","22071973":"4ffe0846af53a2317c364cc75611de62063f81fa96828c7216aa773b20ed2f17","22170798":"f80feda5478325925ad17452287e49470fea71fe2f0a6706f61f9fa24e5627d4"},"schema_version":1,"state_commit":"dcebb4c06e9bd0917fc252aa9886f0beacd1748d"}