docs: record MR-103 end-step budget repair and native verification

ledger/ledger.jsonl

@@ -141,3 +141,4 @@
 {"at": "2026-10-25T21:21:55Z", "task": "AF-DIST-02", "kind": "note", "text": "MR-99 future acceptance only: extend live-attempt update/rollback compatibility to the separately persisted FINALIZING phase and nullable pending stop cause/detail, including normal completion without a cause. AF-DIST-02 stays planned; no updater, database migration or cross-version validation is implemented or claimed."}
 {"at": "2026-10-25T21:21:55Z", "task": "AF-EXEC-02", "kind": "note", "text": "MR-99 direct review observation: add open maintenance follow-up MR-105 for the existing synthetic ADOPTED initial RUNNING and direct CANCELLED/HAPPENED finish paths not named by the generic canonical machines. The managed executing-attempt repair does not claim those adoption paths repaired. Reconcile Design/model kinds and verify actual Linux adoption separately; successful Windows adoption remains deferred where every process is already in a job. No task activated and no new host adoption operation performed by this audit."}
 {"at": "2026-10-25T22:00:50Z", "task": "AF-EXEC-02", "kind": "note", "text": "MR-99 fixed managed executing attempts: Design#31 merge376c6e9b3b895e75ef3e486623e0b16ad931161f (full Windows3/13s, Linux3/45s) before ArcForges#52 merge47ec7aa38b3c8a7431862ad98b6c0b3c6ddcf8e5; final reviewed headd86b89ce1a0670cfdc6b9dd3fa43260c967f9f6e tree9fd0e767d5f06e56647c0226b8bbf772cf84d8af base dec32cb8. Final native Windows full13/1023s and Linux full16/1183s passed with all results and required exact-head statuses read, fresh main/head checked; direct self-review6403660689 by OpenAI Codex alone under user authorization, no independent-review claim. STOPPING cause precedes platform action, FINALIZING is separately durable with no public final result, normal nullable causes differ from legacy cancellation, and initial STARTING has no fictional CREATED predecessor. Real crash3 plus causal cancel-reply regression passed on each native AOT host, MR100 legacy/retry controls retained; original bounds unchanged. Initial71b367d Linux CI failure136s and old Windows pass1055s are historical only, no stale gate reuse. Synthetic ADOPTED canonical mapping remains separate open MR-105; AF-DIST-02 cross-version acceptance stays planned. No AF-REC-01/later feature, real credential-store/orphan-file operation, LAN/cloud MCP or database migration. See maintenance/2026-10-25-mr99-validation.md."}
+{"at": "2026-10-25T23:04:59Z", "task": "AF-EXEC-02", "kind": "note", "text": "MR-103 fixed: ArcForges#53 merged as 4990f63f33bcf36855e184e4e8c4d3b8d7bde003; reviewed final head 0b11e1c97081dc6c1cb4baf8065015bb3038f79f, tree 153aee3c889f4942fe3d89938d8e8657c2f2b617, base 47ec7aa. Native Windows full 13 steps/1140s and Linux full 16 steps/1357s passed; all results and exact-head statuses read with fresh main/head/tree. Direct self-review 6404412350 by OpenAI Codex alone under user authorization. Guard all three end-step paths (Windows holder, Linux ExecStop, observe-only children): nonpositive timeout receives remaining shared budget, positive timeout capped, root outcome and launch-step semantics unchanged. Existing Design 04 section 3 at 376c6e9 suffices. Real regressions before Windows 3 failures/1 control and Linux 6 failures/2 controls; after Windows holder 9/9 JIT/native and launch faults 18/18 native, Linux full platform 92/92 JIT and 92/92 native-helper, no Linux skips. Total budget/sentinel/root-result checks retained, no fake process/clock or bound weakening; own attempts/slice drained, actual user manager untouched. No schema/package/RPC/migration, real credential-store/orphan-file operation, LAN/cloud MCP or later feature. MR-16 remains blocked; MR-105 remains next open follow-up. See maintenance/2026-10-25-mr103-validation.md."}

maintenance/2026-10-24-repair-list.md

@@ -43,7 +43,7 @@ managed tasks, no option that disables protection to enable elevation. The stop
 | MR-95 | Timeouts and CPU-time limits never fire for an attempt recovered STARTING: the supervisor's timeout and CPU-time checks require `attempt.StartedTimestamp`, which only the change to RUNNING sets, and recovery reads `row.StartedAt`, so a command that a recovered launch starts (during the node gap or after) runs without `timeout_ms` or a CPU-time limit, contrary to 04 section 6 and section 9. | found in MR-89 review (ArcForges#42) | ArcForges | `ExecutionSupervisor.cs` timeout/CPU check and recovery (lines cited in #42's review record) | fix: give a recovered STARTING attempt a start time once its command is known to run; fault test with a restart in a launch step | fixed current-version recovery: Design#28 (merge 64e7c99; Windows full 3 steps/17 s, Linux 3 steps/46 s) before ArcForges#50 (merge 6caf418, reviewed head 265342e; Windows full 13 steps/948 s, Linux 16 steps/1128 s); durable Windows command-start evidence, refreshed Linux root and original recovered clock restore timeout/CPU polling; before-fail/after-pass real-process regressions; older-holder cross-version preservation/settlement assigned to planned AF-DIST-02, not claimed verified; [validation](2026-10-25-mr95-validation.md); ledger AF-EXEC-02 and AF-DIST-02 notes; MR-100 follow-up preserves Linux exit-record accounting during a late forced stop; [follow-up](2026-10-25-mr100-validation.md) |
 | MR-99 | The persisted attempt states diverge from SM-ATTEMPT: `RecordFinished` writes FINISHED from whatever state the attempt is in, so FINALIZING is never persisted; timeout, CPU-limit, output, disk and shutdown stops persist no STOPPING (SM-ATTEMPT names timeout and CPU limit as RUNNING -> STOPPING triggers), so a crash during such a stop recovers the attempt as RUNNING; STARTING is persisted at admission, before the container exists, and CREATED is never persisted. The model test checks pairs and allows every state -> FINISHED, so it catches none of this. | found in MR-04 (worker and review) | ArcForges, Design | `ExecutionSupervisor.cs` RecordFinished, Stop, admission; `TaskLifecycleModelTests` | decide per divergence: persist the specified states (code) or amend the triggers (Design, reviewed); tighten the model test | fixed managed executions: Design#31 (merge 376c6e9; native full Windows3/13 s, Linux3/45 s) before ArcForges#52 (merge 47ec7aa, final head d86b89c; native full Windows13/1023 s, Linux16/1183 s); durable STOPPING/FINALIZING, real initial event, trigger/effect model and awaited cancel initiation; real before-fail/after-pass and causal missing-await control, all original bounds retained; earlier 71b367d Linux CI failure and Windows pass retained separately; synthetic ADOPTED mapping is open MR-105 and cross-version acceptance stays planned AF-DIST-02; [validation](2026-10-25-mr99-validation.md); ledger AF-EXEC-02 note |
 | MR-100 | A preempted attempt that lives through a node restart ends CANCELLED instead of PREEMPTED and loses its retry: recovery sets `StopReason = Cancelled` for every recovered STOPPING attempt, while Preempt and Requeue keep the PREEMPTED reason in memory only. | found in MR-04 review | ArcForges | `ExecutionSupervisor.cs` recovery of STOPPING | fix: persist the stop reason with STOPPING and restore it; fault test (preempt, restart, expect PREEMPTED and the retry) | fixed: Design#29 (merge c58c228) and Design#30 (merge 049cf20; native Windows full3/12 s, Linux3/38 s) before ArcForges#51 (merge dec32cb, reviewed head c146dde; native Windows full13/1051 s, Linux full16/1168 s); durable STOPPING cause/detail and permitted retry restored; pending result remains private until FINISHED; legacy null cause retains cancellation; Linux workload cleanup preserves bounded control helpers/exit accounting; real before-fail/after-pass crash and lingering-descendant tests; all original bounds retained; future cross-version acceptance stays in planned AF-DIST-02; [validation](2026-10-25-mr100-validation.md); ledger AF-EXEC-02 note |
-| MR-103 | An end step whose `TimeoutMs` is -1 gets an unbounded wait in `RunEndSteps` and bypasses the 10 s end-step budget (04 section 3), delaying `TerminateLeftovers` and `exit.json` for as long as it runs (present on main before MR-101). | found in MR-101 review | ArcForges | `AttemptRunner.RunEndSteps` timeout choice | fix: treat `TimeoutMs <= 0` as the remaining budget, or validate `TimeoutMs > 0` where steps are built | open |
+| MR-103 | An end step whose `TimeoutMs` is -1 gets an unbounded wait in `RunEndSteps` and bypasses the 10 s end-step budget (04 section 3), delaying `TerminateLeftovers` and `exit.json` for as long as it runs (present on main before MR-101). | found in MR-101 review | ArcForges | `AttemptRunner.RunEndSteps` timeout choice | fix: treat `TimeoutMs <= 0` as the remaining budget, or validate `TimeoutMs > 0` where steps are built | fixed all three paths: ArcForges#53 (merge 4990f63, final head 0b11e1c; native full Windows13/1140 s, Linux16/1357 s); Windows holder, Linux ExecStop and observe-only end steps cap nonpositive values to the shared remaining budget, positive caps and root result retained; real before Windows3-fail/1-control and Linux6-fail/2-controls, after JIT/native regressions passed without assertion changes; no Design change needed, existing 04 section 3; [validation](2026-10-25-mr103-validation.md); ledger AF-EXEC-02 note |
 | MR-105 | A code-wide MR-99 audit found a separate canonical mapping gap for synthetic ADOPTED records: adoption inserts task and attempt directly RUNNING; cancellation finishes the attempt directly with CANCELLED/HAPPENED, and natural disappearance with LOST/UNKNOWN. SM-TASK/SM-ATTEMPT do not name the ADOPTED-specific initial state or cancellation shortcut, although 04 section 10 specifies the synthetic adoption behavior. | found during MR-99 direct review | ArcForges, Design | Adoptions.cs insertion/FinishAsync and 04 section 10; read-only code audit, existing suite regressions are separate evidence | fix: reconcile the canonical machines with the existing adoption semantics and guard the model by attempt kind; verify real Linux adoption and retain the deferred successful Windows adoption case | open; separate from MR-99 managed executing-attempt repair |
 
 ## 3. Secret purge and backup retention

maintenance/2026-10-25-mr103-validation.md

@@ -0,0 +1,83 @@
+# MR-103: one bounded end-step budget on both native platforms
+
+## Repair scope
+
+[ArcForges#53](https://github.com/ArcForges/ArcForges/pull/53) repairs end-step timeout selection in the Windows holder, Linux ExecStop
+and Linux observe-only child path. All three previously passed a negative timeout through to their process wait. In particular -1
+selected an infinite wait; zero and other negative values could instead kill a step before it ran. The maintenance-list observation
+named Windows; the code audit found the same defect in both Linux paths, repaired in this item.
+
+The existing authority is architecture 04 section 3 at Design main 376c6e9b3b895e75ef3e486623e0b16ad931161f: end steps share a
+ten-second budget, their failure does not change the root result, then leftover cleanup and exit recording follow. No Design change
+is needed. A nonpositive per-step timeout now uses the remaining total budget; a positive value is still capped by that remainder.
+The budget is not restarted for each step. Launch-step timeout behavior and all other termination/accounting guards remain intact.
+No public schema/RPC/package change, database migration, later feature, LAN/cloud MCP, real credential-store or orphan-file operation.
+
+## Real before/after regressions
+
+The Windows holder and Linux unit/direct cases each run a real first end step that consumes four seconds. A second real step has
+TimeoutMs -1, 0, -2 or 30000 and runs long enough to exceed the shared budget if it is not capped. A third sentinel must never start
+after the budget is consumed. The regression requires the second step to start, exit recording within twelve seconds of observing
+the first step (the real ten-second budget plus two seconds for scheduling/recording), at least eight seconds elapsed, unchanged
+successful root exit, no launch failure and no sentinel. Unit stop records must show timed_out, timed_out, skipped.
+
+The four seconds spent first make a wrongly restarted ten-second budget fail the twelve-second total bound. These are timing-sensitive
+exclusive tests with actual processes/jobs or user units; no fake clock, process, sampler or platform substitutes for the behavior.
+The Linux direct case uses the existing unreachable-manager-address fault to select real observe-only children, without stopping or
+altering the user's actual manager. Its before-fix fifteen-second children finish and are reaped in fixture cleanup; completion is
+awaited before disposal. On Windows thread rundown is separately drained after the bounded exit record (MR-101). Fixture cleanup is
+limited to its own attempts/slice; no user-manager shutdown, daemon-reload or pkill -f.
+
+Before repair:
+- Windows production source was unchanged at main 47ec7aa38b3c8a7431862ad98b6c0b3c6ddcf8e5. Locked restore/Release build passed.
+  The new four cases reported 3 failures/1 pass, test exit 2, 33.684 s. The -1 case had no exit record within its total bound; 0/-2
+  produced no second-step marker. The long positive control passed at 10.210 s. Wrapper captured that expected failure and exited 0.
+- Linux fetched the test-only head 8ab02278f66fd38c4974fa6b12be3baa56c40c2d, with unchanged production source. Locked restore/Release
+  build passed. Eight cases reported 6 failures/2 positive-control passes, no skips, test exit 2, 73.420 s. Each path reproduced all
+  three nonpositive defects. Direct -1 finished cleanup naturally after about 19 s; the unit's separate stop timeout bounded its
+  before-fix failure at about 15.6 s. That external unit timeout was not the required shared ten-second budget.
+- Both before wrappers drained. Logs: Windows C:\MyFile\Projects\dev\logs\mr103-before.{ps1,out,err,test-exit,exit};
+  Linux /home/sammiller/arcforges/logs/mr103-before.{sh,out,err,test-exit,exit}. Test-only intermediate heads ran no formal profile.
+
+After repair:
+- Initial Windows working-tree Release build, format and HolderTests passed 9/9 in 49.389 s. All four new cases completed at
+  10.191-10.220 s, preserving the root result and blocking the sentinel. This is author evidence, not a post-push full profile.
+- At the pushed head below, Windows Host win-x64 Native AOT published with zero warnings/errors; HolderTests 9/9 and native-helper
+  LaunchFaultTests 18/18 passed. Changed-file format/diff passed, and mr103-native-author exited 0.
+- Linux full affected platform project passed 92/92 JIT in 144.510 s, with no skips. Host linux-x64 Native AOT published with
+  warnings-as-errors, then the same project passed 92/92 against native helpers in 137.412 s, no skips. All eight new unit/direct
+  cases passed in each run. Format/diff passed, worktree clean, mr103-after exited 0.
+- The direct budget loop executes in the real parent test process; its command launch uses the selected real helper. The unit
+  ExecStop and Windows holder run their real helper roles. A native-node direct-budget claim is not inferred from this coverage.
+- Linux synchronization uses Git fetch/checkout only; no source file or verification artifact is copied between hosts through agent
+  context. Author commands/results: Windows C:\MyFile\Projects\dev\logs\mr103-native-author.{ps1,out,err,exit};
+  Linux /home/sammiller/arcforges/logs/mr103-after.{sh,out,err,exit}.
+
+## Commit, author checks and final gate
+
+Final reviewed head: 0b11e1c97081dc6c1cb4baf8065015bb3038f79f.
+Tree: 153aee3c889f4942fe3d89938d8e8657c2f2b617.
+Base: 47ec7aa38b3c8a7431862ad98b6c0b3c6ddcf8e5.
+Five files: three timeout-selection repairs and two real regression test files.
+
+[Author evidence](https://github.com/ArcForges/ArcForges/pull/53#issuecomment-6404412089) records both hosts and before-fix failures.
+[Direct self-review](https://github.com/ArcForges/ArcForges/pull/53#issuecomment-6404412350) covers all five files, the three repaired
+paths and real regression/cleanup behavior against existing Design; no findings. No independent review claimed.
+
+Both full native profiles completed on the final pushed head, after the relevant host's author jobs drained:
+
+- Windows full: 13 steps/1140 s, 20261025-223721-0b11e1c97081-win.
+- Linux full: 16 steps/1357 s, 20261026-064114-0b11e1c97081-linux.
+- Every selected result was read and passed, including JIT/native exclusive suites and startup gates.
+- Both required exact-head arcforges/windows and arcforges/linux statuses were success; owner-hosted checks were skipped as configured.
+- Fresh PR head/tree and source main/base were checked immediately before merge; actual source merge 4990f63f33bcf36855e184e4e8c4d3b8d7bde003.
+- [Final gate](https://github.com/ArcForges/ArcForges/pull/53#issuecomment-6404647803); exact-head direct self-review above.
+
+Windows full logs: C:\MyFile\Projects\dev\logs\mr103-final.{out,err,exit}.
+Linux full logs: /home/sammiller/arcforges/logs/mr103-final.{out,err,exit}.
+Both native runners exited 0 and drained; no competing build/test, older-head status, expected failure, partial run or skip was used
+as the final gate. Maintenance-list status and the completion note were updated only after the source merge; the ledger note was
+appended through the Plan CLI, with no task-state activation.
+
+MR-16 remains blocked. AF-REC-01 and later feature tasks remain unstarted. MR-105 is the next maintenance follow-up after this item,
+before continuing the list. No other model or agent was used; any review is direct self-review under the user's explicit instruction.