[deku2026]

Manual PurgeTaskRecord could return success while old sealed ciphertext remained in the main database/WAL; retention purge stopped retrying a blocked checkpoint once its rows were tombstoned. Checkpoint/truncate after the successful logical command commits, on first call and identical-command replay. If busy/failed, return the existing INTERNAL/internal error with known effect HAPPENED; keep the stored logical result and retry the checkpoint on replay. Every periodic PurgeDue pass now checkpoints, including zero newly due rows, retaining retry across a restart without a new marker/schema.

Design#34 merged as3df9db7 (complete Windows3/15 s, Linux3/34 s). Direct review found the common replay summaries also needed alignment: Design#35 merged as2d9995e (complete Windows3/26 s, Linux3/45 s) before this implementation. Existing secure_delete/tombstones/retention/key remain; no generic post-commit throw, dedup rewrite, new error/RPC/proto/package/schema migration or restricted credential operation. Older snapshots/pages can retain bytes until checkpoint completion; no device/filesystem/external-copy erase guarantee. MR-13 backup policy and MR-16 block remain. The small API edit completes the authorized AF-NODE-02 purge repair after commit.

Real before at test-only dcb10d0 with unchanged production: each native host had 2 retention failures/0 skips and4 own-platform RPC failures/4 opposite-platform skips; both builds zero warnings/errors, test exits2, wrappers0/drained. Initial1cb7c38 had four test-setup/analyzer compile errors, corrected before the baseline; neither tests nor AOT ran there. No false baseline pass.

Final reviewed head 0d261bbe1d48f3c1e9848c15f32a26132cf030da, tree852d5472ff079f9df9debe57a1a3329f8bc0faf9, base448e28dc247fb4234607cc4e811f3723f53e9b31. Author on both native hosts: format/build zero warnings/errors, new retention2/2 and own-platform RPC4/4 (4 other-platform skips each), full Store Windows95 passed/2 skips and Linux94 passed/3 skips of97, affected Windows TaskService9/9, Host+Bench AOT zero warnings/errors, diff clean, wrappers0. Tests use real SQLite/GCM, old read snapshots, actual native attempts, file fragments/free-list/integrity checks and isolated external keys; new RPC node is in-process, not a new standalone native-node purge-runtime claim. No injected I/O failure or real OS-store pass claimed. Author evidence, direct review, documentation follow-up.

Merged as 5fa2ad5fe77bef791b96db11129b3851fe55c940 after complete native full Windows13 steps/1148 s and Linux16 steps/1364 s passed at that exact head. Every one of29 results, both runner exits0 and required success statuses were read with fresh main/head/tree. Final source gate. No relaxed assertions, competing same-host build/test or old-head status reuse. The Design-only common-summary follow-up changed no source profile input.

Maintenance list, detailed validation, exactly one CLI AF-NODE-02 completion note and stop handoff merged in Plan#67, merge65e26947f283e6307cff4acafc8486ff0b05737d, after its own full Windows4/3 s and Linux4/26 s passed against fresh Design2d9995e, re-fetched on both hosts immediately before merge. Current handoff. Stop after MR-14 under the latest owner instruction; MR-15 unstarted, MR-16 blocked. Direct OpenAI Codex work/review alone; no independent reviewer or other agent/model claimed.

Generated by OpenAI Codex.

[deku2026]

Author evidence completed for final head 0d261bb, tree 852d5472ff079f9df9debe57a1a3329f8bc0faf9. Linux author working tree was byte-identical; Windows fetched this pushed head clean. Format and Release builds passed with zero warnings/errors (Linux 3.89 s, Windows 13.22 s). New retention regressions 2/2 each (Linux 10.783 s, Windows 13.877 s); real-RPC own-platform regressions 4/4 each, with 4 opposite-platform skips (Linux 7.215 s, Windows 10.192 s). Full affected Store: Linux 94 passed/3 platform skips out of 97 in 10.712 s; Windows 95 passed/2 platform skips in 13.611 s. Existing affected Windows TaskService class 9/9, no skips, 5.512 s. Host and Bench Native AOT publish passed with zero warnings/errors on both hosts; diff clean and both author wrappers exit 0. New API tests run the node in-process with real native attempts; AOT publication and full native profile evidence are separate, no new standalone native-node purge runtime claim. Logs: native Windows C:\MyFile\Projects\dev\logs\mr14-author.{ps1,out,err,exit}; Linux /home/sammiller/arcforges/logs/mr14-author.{sh,out,err,exit}. Baseline dcb10d0 had unchanged production and six real failures per host; initial 1cb7c38 compiled neither regression suite (four test-setup/analyzer errors), retained separately. Linux complete final-head full profile has passed all 16 results/1364 s, wrapper 0 (20261026-091249-0d261bbe1d48-linux); Windows complete profile now running, so merge remains gated.

[deku2026]

Exact-head direct self-review by OpenAI Codex alone under explicit user instruction; no independent reviewer or other agent/model claimed. Full four-file diff reviewed at 0d261bb, tree 852d5472ff079f9df9debe57a1a3329f8bc0faf9, base 448e28d. No findings. Checked against merged Design#34 (3df9db7), node-store section 1, execution section 2 and AD-0006: SQLite TRUNCATE runs after the transaction/dedup bytes are committed, outside CommandProcessor rollback handling; ApiCommands parses stored bytes to a fresh response before the transient known-HAPPENED error, so replay retains the committed logical outcome and retries the checkpoint. Only successful logical outcomes checkpoint; refusal and permission paths stay guarded. Existing secure_delete/tombstones/retention/schema/key remain. Unconditional housekeeping checkpoint avoids losing a retry when no new row is due or the process restarts. Reviewed both tests' real prior snapshot, post-release zero-row/replay path, three 16-byte ciphertext fragments in DB/WAL, overflow free-list evidence, integrity/schema and isolated key cleanup. All original assertions/bounds retained; before failures prove assertions reach the defect. A busy reader explicitly prevents success, with device/filesystem/external-copy erasure outside the claim. SQLite exception branch is narrowly caught post-commit; real busy behavior is exercised, no injected I/O failure claimed. Full Linux gate read; Windows final-head full gate still required.

[deku2026]

Additional documentation review follow-up: contracts/README.md section 6 still says an identical command always returns the stored outcome without naming the MR-14 post-commit checkpoint exception. The merged node-store/error/AD-0006 text specifies it, and the implementation preserves stored logical bytes correctly, but the general summary should explicitly distinguish the logical outcome from the transient known-HAPPENED checkpoint error on replay. I am correcting that canonical summary in a small MR-14 Design follow-up before this implementation merges. Source head/tree and formal-profile inputs remain unchanged; no code, test assertion or gate changes. The earlier direct review remains valid for the implementation; this additional documentation inconsistency is being resolved, not left as an unrecorded finding.

[deku2026]

Final implementation gate read: exact head 0d261bb, tree 852d5472ff079f9df9debe57a1a3329f8bc0faf9, fresh base/main 448e28d. Native Windows full 13 steps/1148 s (20261026-015108-0d261bbe1d48-win) and Linux full 16 steps/1364 s (20261026-091249-0d261bbe1d48-linux) passed. Every one of the 29 summary results read, both wrapper exit records 0, both required engine-reported statuses success at this head, owner-hosted checks including real OS-store tier skipped as expected. No competing build/test on either host. Direct review/author evidence: #56 (comment) and #56 (comment). The additional general-idempotency documentation finding is resolved by Design#35, merged first as 2d9995e78c4aa0f6327371ab0b5639857718da5c after full Windows3/26 s and Linux3/45 s; Design#34 policy already merged as 3df9db7. This changed no source head/tree or source verification inputs (both source summary contexts empty); no source assertions/steps/statuses reused from another head. No unresolved findings. Merge now; only after actual source merge append the owning AF-NODE-02 ledger note through the Plan CLI and update maintenance/stop handoff. Finish that record PR's own fresh native gates, then STOP under the user's latest instruction; MR-15 unstarted, MR-16 blocked.