Record MR-100 stop recovery, native validation and future compatibility

delivery-graph.json

@@ -3417,7 +3417,8 @@
         "Real update and rollback with running executions on both platforms",
         "Crash injection at each switch phase recovers",
         "Local HTTP manifest tests for every refusal case",
-        "Before a transparent Windows upgrade from an older holder without started.json, preserve known command-start/limit evidence or settle the STARTING attempt; validate node-gap and post-recovery starts with timeout and CPU-time limits across versions (MR-95, architecture 04 section 3)."
+        "Before a transparent Windows upgrade from an older holder without started.json, preserve known command-start/limit evidence or settle the STARTING attempt; validate node-gap and post-recovery starts with timeout and CPU-time limits across versions (MR-95, architecture 04 section 3).",
+        "Cross-version update/rollback with a live STOPPING attempt must preserve the pending termination_reason/detail interpretation and retry rules, or settle the attempt with the compatible node first; an unknown legacy cause must not be inferred from human text (MR-100, architecture 04 section 9)."
       ],
       "verification": {
         "author": [
@@ -3456,7 +3457,7 @@
         }
       ],
       "size": "L",
-      "notes": "MR-95 fixes current-version recovery using additive holder start evidence; it does not backfill older live holders. Cross-version update preservation/settlement remains this planned task's acceptance obligation; no updater or migration is implemented by maintenance.",
+      "notes": "MR-95 fixes current-version recovery using additive holder start evidence; it does not backfill older live holders. Cross-version update preservation/settlement remains this planned task's acceptance obligation; no updater or migration is implemented by maintenance. MR-100 uses existing reason/detail columns for pending STOPPING intent; update/rollback compatibility with older readers remains future acceptance, not implemented or verified by maintenance.",
       "blocked_by": [],
       "evidence": {
         "prs": [],

ledger/ledger.jsonl

@@ -136,3 +136,5 @@
 {"at": "2026-10-25T17:35:08Z", "task": "AF-DIST-02", "kind": "note", "text": "MR-95: Design#28 merged 64e7c994; current-version recovery is being repaired in ArcForges#50. Added future cross-version acceptance: older Windows holders lacking started.json must preserve known start/limit evidence or settle STARTING before transparent update; real both-platform gap/post-recovery timeout and CPU-limit upgrade validation remains AF-DIST-02, still planned. No updater or migration implemented."}
 {"at": "2026-10-25T17:35:08Z", "task": "AF-DP-01", "kind": "note", "text": "MR-12 publication follow-up: DesktopPlatform main e02ebe455d4fe2c06b19dabc0f3179a43ab21aa6 normal Publish NuGet run 40213555173 (148/attempt 1) completed successfully at 2026-10-25T17:18:17Z; publish job 121236288721 successful, including preauthentication source/hash checks and publish-same-verified-bytes. No post-publication artifact download or reinstall. Public cohort version/admission and consumer adoption remain MR-43; AR-21 real cross-integrity validation remains deferred."}
 {"at": "2026-10-25T18:05:40Z", "task": "AF-EXEC-02", "kind": "note", "text": "MR-95 fixed current-version STARTING recovery: Design#28 merged 64e7c994 (reviewed 1683367; full Windows 3 steps/17 s, Linux 3 steps/46 s) before ArcForges#50 merged 6caf418af3eba19a5d4d7989e8ed11476b67736b, reviewed final head 265342e91fe69a53d263dce1eb013af7871af9fd tree 07fd93e4c67b33ec9a7d9a047c52bcf5186de4b6 base 5eaee92. Native full Windows 13 steps/948 s and Linux 16 steps/1128 s passed at final pushed head, all results/statuses checked; direct self-review 6400937846. Four real recovered-start limit cases failed before and passed after; new launch-step and evidence-write-failure guards passed. Initial Linux comm observer failures, incomplete MCP launch, erroneous Windows AOT help command, and superseded-head Windows pass retained distinctly in maintenance/2026-10-25-mr95-validation.md. No assertion weakened, SQL/RPC migration or updater; older Windows holders without started.json remain future AF-DIST-02 preservation/settlement and update validation, still planned."}
+{"at": "2026-10-25T18:56:02Z", "task": "AF-DIST-02", "kind": "note", "text": "MR-100 future compatibility assignment: Design#29 merged c58c228fa160c34e91c126e1408c02a2e4efb478; current-version cause recovery is being repaired in ArcForges#51 at 6b4e8c4. Existing reason/detail fields now carry pending STOPPING intent; supported-version update/rollback must preserve that interpretation and retry rules or settle with the compatible node first. Unknown legacy causes keep cancellation fallback, never inferred from human text. Added acceptance/notes; AF-DIST-02 stays planned, no updater, migration, backfill or cross-version validation implemented."}
+{"at": "2026-10-25T20:39:05Z", "task": "AF-EXEC-02", "kind": "note", "text": "MR-100 fixed: Design#29 merge c58c228fa160c34e91c126e1408c02a2e4efb478 and Design#30 merge 049cf20a7da7994d849c13dab2c7ac8944c20529 before ArcForges#51 merge dec32cb8ab48a575d563c5e4a1b10c80fc95c486; reviewed head c146ddebb8ce912d375ef5facd505d00525dba6b, tree6e9977f679f505c8b1ac4520a12ea5986e36406a, base6caf418. Final native Windows full13/1051s and Linux full16/1168s passed with exact-head required statuses; direct self-review by OpenAI Codex alone6402619710. STOPPING cause/detail persist atomically and restore permitted retry; pending intent is not a public final result; legacy null cause stays cancellation. Linux forced cleanup preserves bounded controls while killing remaining workload identities and directly thawing even timed-out freezes. Real crash4 Windows/3 Linux and actual end-step/lingering-descendant before-fail/after-pass evidence; Windows root-rundown fixture release corrected without weakening any assertion or bound. Failed/incomplete/diagnostic/superseded runs retained distinctly; no older-head gate reused. MR-95/MR-102 follow-ups are recorded. AF-DIST-02 cross-version acceptance remains future/planned; MR-16 stays blocked, no real credential-store/orphan-file operations; no later feature, LAN/cloud MCP or database migration. See maintenance/2026-10-25-mr100-validation.md."}

maintenance/2026-10-24-repair-list.md

@@ -24,7 +24,7 @@ managed tasks, no option that disables protection to enable elevation. The stop
 | MR-84 | Live cancel race in `ExecutionSupervisor.ForceWhenStarted`: the forced phase terminates the container first and only then checks `handle.Root is not null \|\| handle.Started.IsCompleted`; a command whose start completes in between is never terminated again and runs past the cancel (TERMINATION_INCOMPLETE). Seen once in `LaunchFaultTests.TasksCancelledAsSoonAsSubmittedAllEndCancelled` (one of 24 tasks, Windows). | found in MR-82 | ArcForges | code order confirmed at main 90486a7 | fix together with MR-02 (the same terminate-again-on-start rule for live and recovered stops); deterministic test | fixed: ArcForges#39 (merge 9ab4c7b); ledger AF-EXEC-02 note |
 | MR-89 | A recovered STARTING attempt (not STOPPING) that is cancelled after the node restart keeps the late-start gap: its re-opened handle is not armed to see a launch the node no longer controls (Windows: no per-process signal; Linux: the queued start job is not queried at the forced phase), and no root is recorded when its command starts. | found in MR-02 (ArcForges#39) | ArcForges | worker and reviewer analysis | fix: arm the re-opened handle at the forced phase (Windows snapshot and per-process signal on every rootless re-open; Linux PendingStartJob at the forced phase) | fixed: ArcForges#42 (merge 8146392); ledger AF-EXEC-02 note |
 | MR-101 | A cancel during a Windows launch step could take seconds to end the task: the holder (`AttemptRunner.RunStep`) waited for the killed step's process handle, which is signalled only when the step's below-normal-priority threads finish exiting (seconds under load), although the job is empty and the exit code final within about 1 ms (6.07 s against the 5 s bound in `LaunchFaultTests` at 7a13cf7). | found in MR-04 (Windows leg at 7a13cf7) | ArcForges | instrumented runs under the leg's load (3 of 140 over 5 s); saturated-machine probe; deterministic debugger-held test | fix: end the wait early only for an empty job and a final nonzero exit code; a step that exits 0 waits on its handle as before | fixed: ArcForges#45 (merge 866b0b7), reviewed head 8c1c06c; complete author 10 standalone + 10 loaded classes passed, all lanes drained; native Windows 13 steps/932 s and Linux 16 steps/1130 s passed at exact head; [validation record](2026-10-25-mr101-validation.md); ledger AF-EXEC-02 note |
-| MR-102 | The Windows holder still waits for the running command's (root's) process handle, so a forced or limit stop of a running command under load can take seconds to be recorded; no test bounds this. | found in MR-101 (worker and review) | ArcForges | `AttemptRunner` root wait; MR-101 measurements | fix: end the root wait on a known stop or a final nonzero code with an empty job (same guard as MR-101), preferably event-driven; bounded test | fixed: ArcForges#48 (merge 3990e07), reviewed head 95f5ea2; final nonzero/empty-job root wait with 250 ms checks, zero-code/resource-order guard retained; native Windows 13 steps/963 s and Linux 16 steps/1132 s passed at exact head; forced-root before-fail/after-pass and zero-guard negative control; [validation record](2026-10-25-mr102-validation.md); ledger AF-EXEC-02 note |
+| MR-102 | The Windows holder still waits for the running command's (root's) process handle, so a forced or limit stop of a running command under load can take seconds to be recorded; no test bounds this. | found in MR-101 (worker and review) | ArcForges | `AttemptRunner` root wait; MR-101 measurements | fix: end the root wait on a known stop or a final nonzero code with an empty job (same guard as MR-101), preferably event-driven; bounded test | fixed: ArcForges#48 (merge 3990e07), reviewed head 95f5ea2; final nonzero/empty-job root wait with 250 ms checks, zero-code/resource-order guard retained; native Windows 13 steps/963 s and Linux 16 steps/1132 s passed at exact head; forced-root before-fail/after-pass and zero-guard negative control; [validation record](2026-10-25-mr102-validation.md); ledger AF-EXEC-02 note; MR-100 follow-up corrects the successful-root test's artificial job-termination release race, retaining every original bound and assertion; [follow-up](2026-10-25-mr100-validation.md) |
 
 ## 2. Startup, stop and crash-recovery races; unintended termination; permission bypasses
 
@@ -40,9 +40,9 @@ managed tasks, no option that disables protection to enable elevation. The stop
 | MR-11 | Cross-integrity case: a non-elevated node with an elevated same-user client (resolution and acceptance entry). | 20, 30 | ArcForges, Plan | ArcForges.Client owner-SID check fixed in AF-NODE-01; no acceptance-register entry *(confirm)* | fix: test if missing; acceptance-register entry for the real elevated case (deferred validation) | deferred validation (AR-21): ArcForges.Client user-SID repair and three existing ownership tests confirmed (retained Client.Tests 102/102 at 8fe744f); real non-elevated-node/elevated-client peer identification/refusal remains unproven, owner final end-to-end deferral retained; procedure and AF-NODE-01 register link added, no elevation performed; DesktopPlatform MR-12 separate; ledger AF-NODE-01 note |
 | MR-12 | DesktopPlatform `LocalRpcClientChannel` CurrentUserOnly check refuses an elevated same-user client (the defect ArcForges.Client fixed locally). | 30 | DesktopPlatform | *(confirm in DesktopPlatform main)* | fix in DesktopPlatform; adoption by ArcForges recorded separately (MR-43) | fixed in producer: DesktopPlatform#200 (merge e02ebe4), reviewed head 66ffbc7; explicit user-SID client check and parent-child pipe owner, foreign/group/missing owners denied; native Windows full 17 steps/532 s and Linux full 24 steps/406 s passed; normal NuGet publication run 40213555173 completed successfully (publish job 121236288721, 2026-10-25); consumer cohort admission/adoption MR-43 separate; AR-21 real cross-integrity validation remains deferred; [evidence](2026-10-25-mr12-validation.md); ledger AF-DP-01 note |
 | MR-92 | Lost `JobRemoved` signal: `SystemdManager`'s handler looked for the job's waiter and recorded the result only when it found none, while `WaitJob` registers its waiter and then reads the record; a wait registering in between missed the end and ran to its timeout although the job had finished (seen as a 10 s adoption refusal in `AdoptionTests`; an attempt's 90 s start wait could record 'did not start' for a running attempt). | found in MR-76 (Linux leg at bbd4ddb) | ArcForges | live-manager probe: 68 of 20,800 waits missed on main, 0 of 28,800 with the fix | fix | fixed: ArcForges#40 (merge 64e9f7c); ledger AF-EXEC-02 note |
-| MR-95 | Timeouts and CPU-time limits never fire for an attempt recovered STARTING: the supervisor's timeout and CPU-time checks require `attempt.StartedTimestamp`, which only the change to RUNNING sets, and recovery reads `row.StartedAt`, so a command that a recovered launch starts (during the node gap or after) runs without `timeout_ms` or a CPU-time limit, contrary to 04 section 6 and section 9. | found in MR-89 review (ArcForges#42) | ArcForges | `ExecutionSupervisor.cs` timeout/CPU check and recovery (lines cited in #42's review record) | fix: give a recovered STARTING attempt a start time once its command is known to run; fault test with a restart in a launch step | fixed current-version recovery: Design#28 (merge 64e7c99; Windows full 3 steps/17 s, Linux 3 steps/46 s) before ArcForges#50 (merge 6caf418, reviewed head 265342e; Windows full 13 steps/948 s, Linux 16 steps/1128 s); durable Windows command-start evidence, refreshed Linux root and original recovered clock restore timeout/CPU polling; before-fail/after-pass real-process regressions; older-holder cross-version preservation/settlement assigned to planned AF-DIST-02, not claimed verified; [validation](2026-10-25-mr95-validation.md); ledger AF-EXEC-02 and AF-DIST-02 notes |
+| MR-95 | Timeouts and CPU-time limits never fire for an attempt recovered STARTING: the supervisor's timeout and CPU-time checks require `attempt.StartedTimestamp`, which only the change to RUNNING sets, and recovery reads `row.StartedAt`, so a command that a recovered launch starts (during the node gap or after) runs without `timeout_ms` or a CPU-time limit, contrary to 04 section 6 and section 9. | found in MR-89 review (ArcForges#42) | ArcForges | `ExecutionSupervisor.cs` timeout/CPU check and recovery (lines cited in #42's review record) | fix: give a recovered STARTING attempt a start time once its command is known to run; fault test with a restart in a launch step | fixed current-version recovery: Design#28 (merge 64e7c99; Windows full 3 steps/17 s, Linux 3 steps/46 s) before ArcForges#50 (merge 6caf418, reviewed head 265342e; Windows full 13 steps/948 s, Linux 16 steps/1128 s); durable Windows command-start evidence, refreshed Linux root and original recovered clock restore timeout/CPU polling; before-fail/after-pass real-process regressions; older-holder cross-version preservation/settlement assigned to planned AF-DIST-02, not claimed verified; [validation](2026-10-25-mr95-validation.md); ledger AF-EXEC-02 and AF-DIST-02 notes; MR-100 follow-up preserves Linux exit-record accounting during a late forced stop; [follow-up](2026-10-25-mr100-validation.md) |
 | MR-99 | The persisted attempt states diverge from SM-ATTEMPT: `RecordFinished` writes FINISHED from whatever state the attempt is in, so FINALIZING is never persisted; timeout, CPU-limit, output, disk and shutdown stops persist no STOPPING (SM-ATTEMPT names timeout and CPU limit as RUNNING -> STOPPING triggers), so a crash during such a stop recovers the attempt as RUNNING; STARTING is persisted at admission, before the container exists, and CREATED is never persisted. The model test checks pairs and allows every state -> FINISHED, so it catches none of this. | found in MR-04 (worker and review) | ArcForges, Design | `ExecutionSupervisor.cs` RecordFinished, Stop, admission; `TaskLifecycleModelTests` | decide per divergence: persist the specified states (code) or amend the triggers (Design, reviewed); tighten the model test | open |
-| MR-100 | A preempted attempt that lives through a node restart ends CANCELLED instead of PREEMPTED and loses its retry: recovery sets `StopReason = Cancelled` for every recovered STOPPING attempt, while Preempt and Requeue keep the PREEMPTED reason in memory only. | found in MR-04 review | ArcForges | `ExecutionSupervisor.cs` recovery of STOPPING | fix: persist the stop reason with STOPPING and restore it; fault test (preempt, restart, expect PREEMPTED and the retry) | open |
+| MR-100 | A preempted attempt that lives through a node restart ends CANCELLED instead of PREEMPTED and loses its retry: recovery sets `StopReason = Cancelled` for every recovered STOPPING attempt, while Preempt and Requeue keep the PREEMPTED reason in memory only. | found in MR-04 review | ArcForges | `ExecutionSupervisor.cs` recovery of STOPPING | fix: persist the stop reason with STOPPING and restore it; fault test (preempt, restart, expect PREEMPTED and the retry) | fixed: Design#29 (merge c58c228) and Design#30 (merge 049cf20; native Windows full3/12 s, Linux3/38 s) before ArcForges#51 (merge dec32cb, reviewed head c146dde; native Windows full13/1051 s, Linux full16/1168 s); durable STOPPING cause/detail and permitted retry restored; pending result remains private until FINISHED; legacy null cause retains cancellation; Linux workload cleanup preserves bounded control helpers/exit accounting; real before-fail/after-pass crash and lingering-descendant tests; all original bounds retained; future cross-version acceptance stays in planned AF-DIST-02; [validation](2026-10-25-mr100-validation.md); ledger AF-EXEC-02 note |
 | MR-103 | An end step whose `TimeoutMs` is -1 gets an unbounded wait in `RunEndSteps` and bypasses the 10 s end-step budget (04 section 3), delaying `TerminateLeftovers` and `exit.json` for as long as it runs (present on main before MR-101). | found in MR-101 review | ArcForges | `AttemptRunner.RunEndSteps` timeout choice | fix: treat `TimeoutMs <= 0` as the remaining budget, or validate `TimeoutMs > 0` where steps are built | open |
 
 ## 3. Secret purge and backup retention