P1: Make Python single-module moves import-aware or refuse

[tomdps]

Parent

Tracking parent #249; epic #243. This is one vertical delivery slice. Do not close or bypass the parent tracker from this child.

Goal

Preview and apply one-file Python module moves only when willRenameFiles and canonical import evidence prove every affected rewrite; physical-only moves stay impossible.

Dependency contract

• fix(python): share import resolution between validation and graph #209
• P1 — Add truthful Python LSP semantic inspection and navigation #248 accepted bounded semantic manager and capability negotiation; this child introduces workspace/willRenameFiles and must not assume a pre-existing file-operation capability
• P1: Apply Python semantic rename atomically with rollback #266 (P1: Apply Python semantic rename atomically with rollback)

Required behavior

1. Accept one regular .py/.pyi move only inside one supported P0 — Resolve Python projects, interpreters, environments, and tools canonically #246 project/source-root; resolve old/new contexts from the exact snapshot and refuse cross-project/config/root movement initially.
2. Call the existing bounded semantic manager workspace/willRenameFiles; normalize/simulate returned WorkspaceEdit before appending the physical move, then derive final after-state and reuse B validation/transaction. One-shot move --apply remains refused.
3. A null/empty semantic response counts only with explicit complete service acknowledgment and fix(python): share import resolution between validation and graph #209 evidence of zero affected importers; otherwise refuse semantic_import_rewrite_incomplete.
4. Compare fix(python): share import resolution between validation and graph #209 canonical before/after import edges and importer set to service edits. Missing importer edits or unresolved after-state imports refuse; graph may cross-check completeness but never synthesize import text.
5. Apply all A/B URI/range/version/hash/path/encoding/metadata/resource/collision/validation/rollback invariants and return deterministic preview/commit order.

Acceptance criteria

• Absolute/relative multi-level imports, aliases, from-package module, star imports, init re-export, .pyi peer, importer inside moved module, flat/src/namespace, same-name other project, and old-URI edit ordering are covered.
• Explicit no-import completeness, null/empty ambiguity, missing one importer, malformed/unsupported/timeout/crash, cross-root/project, collision/case/symlink/read-only/generated/encoding/path refuse exactly.
• Import/type validation and injected failure between importer edit/file move restore both; repeated hashes/order match.
• Packed relative+absolute module preview/apply records service capability, before/after import edges, gates, hashes/listing; unavailable/incomplete service refuses before physical move.

Observable outcomes

• Clean success carries positive execution/provenance evidence; zero diagnostics alone is never proof.
• Findings and every unavailable/invalid/timeout/crash/resource/stale/unsupported state are machine-readable and fail or degrade exactly as the capability contract says.
• No implicit fallback, partial result, or skipped execution is reported as a pass.
• Target source, configuration, lockfiles, environments, and caches remain unchanged except where this issue explicitly owns a validation-gated atomic edit; every temporary resource/process is cleaned.

Non-goals

• package directories
• cross-project/config/root moves
• config/lock/build edits
• dynamic/string import guesses
• alternate import parser
• physical fallback

Verification

Run focused behavior first, then the configured repository proof only after the acceptance matrix works:

• npm run build
• node --test tests/edit-preview-apply.test.mjs tests/semantic-provider-integration.test.mjs tests/contracts.test.mjs tests/opcore-facade.test.mjs
• npm run lint
• Attach exact real-tool/artifact versions, argv/config/cwd/source, normalized result examples, before/after cleanliness evidence, and packed-install proof where the slice changes public package behavior.

Execution rule

Implement only after a just-in-time review against current dev. Keep exactly one implementation run active. PR base is dev; require green checks, clean scoped diff, merged PR, closed child, parent checklist update, focused reproductions, and opcore-ci proof before starting the next child. Do not claim Python readiness/parity, ASP authority, old-tool replacement, security/SAST, all-stack support, automatic fixes, or a blended score.