From 2c0624a2c88478571e56df90aa096f6d7c3fea7e Mon Sep 17 00:00:00 2001 From: sammiller Date: Sun, 25 Oct 2026 23:53:25 +0000 Subject: [PATCH] docs: record MR-105 adoption lifecycle repair and deferred acceptance Record the Design-first source repair and exact native two-host evidence, update maintenance follow-ups, and retain successful Windows adoption as deferred AR-19 with its cancellation journal procedure. Completion and deferral notes are appended through the Plan CLI. Co-Authored-By: OpenAI Codex --- acceptance-register.md | 2 +- ledger/ledger.jsonl | 2 + maintenance/2026-10-24-repair-list.md | 4 +- maintenance/2026-10-25-mr105-validation.md | 105 +++++++++++++++++++++ 4 files changed, 110 insertions(+), 3 deletions(-) create mode 100644 maintenance/2026-10-25-mr105-validation.md diff --git a/acceptance-register.md b/acceptance-register.md index 45c94f7..615953b 100644 --- a/acceptance-register.md +++ b/acceptance-register.md @@ -34,7 +34,7 @@ Real-world validation that cannot run at development stage, and the human prereq | AR-16 | Optional privileged features: Windows machine-wide service mode; Linux I/O control in a privileged native Linux install | Needs administrator or root installs by the user | User-performed privileged install | AF-DIST-01; AF-WSL-01 (superseded: its privileged WSL guest leg was dropped, ArcForges-Design AD-0018) | Open | | AR-17 | Doctor host-posture check on a standard Windows account, and on a machine with Administrator protection switched on (Windows 11, security-baseline or device policy) | No venue offers a standard account (as for AR-02: the product owner's decision of 2026-10-10, second-account checks are procedure only and never re-asked), and none has Administrator protection switched on: it is off by default, and switching it on is a device policy change followed by a restart (Design verification register V-W08) | A user-provided Windows 11 machine or VM with a standard account and an administrator account, Administrator protection switched on (device policy and restart; not advised on Hyper-V devices, V-W08) | AF-DIAG-01 | Open | | AR-18 | A Windows node identifies a running WSL VM's worker process (`vmmem` or `vmmemWSL`) as one `GUEST_VM` consumer in unmanaged load, never controlled, and never presents the VM's Linux processes as its own (ArcForges-Design 03 §1, §2, §9; A-L01, AD-0018 §2). Procedure: on Windows 11 with WSL2 and one distribution installed, (1) start the distribution outside ArcForges (`wsl -d -e sleep 600`); (2) run a native node; (3) `arcforges ps --label guest --json` lists the VM worker with label `PROCESS_LABEL_GUEST_VM`, no task, and a memory figure close to Task Manager's for that process, and no Linux process of the distribution appears; (4) allocate about 2 GiB inside the distribution (for example `python3 -c "b=bytearray(2<<30); import time; time.sleep(60)"`): `arcforges resources --json` shows unmanaged memory rising and the memory budget falling by about that amount within about 10 s; (5) a task running `wsl.exe -d -e sleep 30` has every process flagged `crossesVmBoundary`, and `ps --label managed` lists only Windows processes of its job; (6) run `ArcForges.ClosedLoop.Tests -method *ATaskThatRunsWsl*` there and keep the VM workers it prints | WSL is not installed on the workstation, so no VM worker runs there; the `crosses_vm_boundary` flag itself is proven with the inbox `wsl.exe` (AF-RES-01) | A Windows 11 machine with WSL2 and one distribution (user-provided; installing WSL is the user's step) | AF-RES-01 | Open | -| AR-19 | Successful Windows process adoption (ArcForges-Design 04 §10; `ResourceService.AdoptProcess`): a same-user process outside every job is adopted into the root job and a nested adoption job (the root job's limits apply, V-W01), appears as an `ADOPTED` task with label `ADOPTED`, its existing children follow, it can be terminated through `process.terminate`, and it ends `LOST` ("no exit status: the node is not the adopted process's parent") when it exits; after a node restart an adoption job the node cannot reopen (L-14) ends the task `LOST` through `container_missing`. Procedure: on a Windows 11 machine where a process created through WMI `Win32_Process.Create` is outside every job (check with `IsProcessInJob`), run `Node.Platform.Windows.Tests -method *AdoptionTests.AProcessOutsideAnyJobIsAdoptedWithItsChildrenAndTerminated` and `Node.Core.Tests -method *AdoptionLifecycleTests.AnAdoptedProcessThatEndsByItselfEndsItsTaskLostWithoutAnExitStatus` and `-method *AdoptionLifecycleTests.AnAdoptionContainerTheNodeCannotReopenAfterARestartIsLost`; none may skip with the "already in a job" reason | On the workstation every user process, a WMI-created one included, is already in a job (ArcForges-Design register L-30), so 04 §10 refuses every candidate and the capability `adopt` reports `LIMITED`; the refusal path is proven there (AF-SEC-01) | A Windows 11 machine or VM where a WMI-created process is outside every job (user-provided) | AF-SEC-01 | Open | +| AR-19 | Successful Windows process adoption (ArcForges-Design 04 §10; `ResourceService.AdoptProcess`): a same-user process outside every job is adopted into the root job and a nested adoption job (the root job's limits apply, V-W01), appears as an `ADOPTED` task with label `ADOPTED`, its existing children follow, it can be terminated through `process.terminate`, and it ends `LOST` ("no exit status: the node is not the adopted process's parent") when it exits; after a node restart an adoption job the node cannot reopen (L-14) ends the task `LOST` through `container_missing`. Procedure: on a Windows 11 machine where a process created through WMI `Win32_Process.Create` is outside every job (check with `IsProcessInJob`), run `Node.Platform.Windows.Tests -method *AdoptionTests.AProcessOutsideAnyJobIsAdoptedWithItsChildrenAndTerminated` and `Node.Core.Tests -method *AdoptionLifecycleTests.AnAdoptedProcessThatEndsByItselfEndsItsTaskLostWithoutAnExitStatus` and `-method *AdoptionLifecycleTests.AnAdoptionContainerTheNodeCannotReopenAfterARestartIsLost`, plus `-method *AdoptionLifecycleTests.CancellingAnAdoptionJournalsStoppingBeforeItsFinalResult` (MR-105: real journal has initial RUNNING without previous states, exactly one STOPPING even after repeated cancellation, FINISHED CANCELLED/HAPPENED with no exit code, no adopted FINALIZING, and the shared kind-guarded model also checks an ordinary task); none may skip with the "already in a job" reason | On the workstation every user process, a WMI-created one included, is already in a job (ArcForges-Design register L-30), so 04 §10 refuses every candidate and the capability `adopt` reports `LIMITED`; the refusal path is proven there (AF-SEC-01) | A Windows 11 machine or VM where a WMI-created process is outside every job (user-provided) | AF-SEC-01 | Open | | AR-20 | MR-07: establish the cause of the Windows supervisor test's unexplained node stop exit 75 and verify a discriminating repair if required | The historical failure has not recurred with the retained diagnostics; non-recurrence cannot establish its cause or prove a fix | A captured native Windows recurrence with verbose transport/descriptor/node/supervisor evidence, or a proven causal reproduction; the Windows MCP venue is already available, no new human provisioning | AF-NODE-01 | Open; unresolved observation, not a passed check or task block | | AR-21 | MR-11: a non-elevated Windows node and an elevated client of the same user: user-SID pipe ownership succeeds, but an unidentifiable elevated peer is refused before API execution | Existing automated ownership tests do not create two processes at different integrity levels; owner deferred full end-to-end testing on 2026-10-15 (ledger 30) | User-performed Windows 11 cross-integrity run at final end-to-end acceptance; no automatic elevation or re-request now | AF-DP-01, AF-NODE-01 | Open; deferred validation, no task block | diff --git a/ledger/ledger.jsonl b/ledger/ledger.jsonl index a0fe021..81c52a4 100644 --- a/ledger/ledger.jsonl +++ b/ledger/ledger.jsonl @@ -142,3 +142,5 @@ {"at": "2026-10-25T21:21:55Z", "task": "AF-EXEC-02", "kind": "note", "text": "MR-99 direct review observation: add open maintenance follow-up MR-105 for the existing synthetic ADOPTED initial RUNNING and direct CANCELLED/HAPPENED finish paths not named by the generic canonical machines. The managed executing-attempt repair does not claim those adoption paths repaired. Reconcile Design/model kinds and verify actual Linux adoption separately; successful Windows adoption remains deferred where every process is already in a job. No task activated and no new host adoption operation performed by this audit."} {"at": "2026-10-25T22:00:50Z", "task": "AF-EXEC-02", "kind": "note", "text": "MR-99 fixed managed executing attempts: Design#31 merge376c6e9b3b895e75ef3e486623e0b16ad931161f (full Windows3/13s, Linux3/45s) before ArcForges#52 merge47ec7aa38b3c8a7431862ad98b6c0b3c6ddcf8e5; final reviewed headd86b89ce1a0670cfdc6b9dd3fa43260c967f9f6e tree9fd0e767d5f06e56647c0226b8bbf772cf84d8af base dec32cb8. Final native Windows full13/1023s and Linux full16/1183s passed with all results and required exact-head statuses read, fresh main/head checked; direct self-review6403660689 by OpenAI Codex alone under user authorization, no independent-review claim. STOPPING cause precedes platform action, FINALIZING is separately durable with no public final result, normal nullable causes differ from legacy cancellation, and initial STARTING has no fictional CREATED predecessor. Real crash3 plus causal cancel-reply regression passed on each native AOT host, MR100 legacy/retry controls retained; original bounds unchanged. Initial71b367d Linux CI failure136s and old Windows pass1055s are historical only, no stale gate reuse. Synthetic ADOPTED canonical mapping remains separate open MR-105; AF-DIST-02 cross-version acceptance stays planned. No AF-REC-01/later feature, real credential-store/orphan-file operation, LAN/cloud MCP or database migration. See maintenance/2026-10-25-mr99-validation.md."} {"at": "2026-10-25T23:04:59Z", "task": "AF-EXEC-02", "kind": "note", "text": "MR-103 fixed: ArcForges#53 merged as 4990f63f33bcf36855e184e4e8c4d3b8d7bde003; reviewed final head 0b11e1c97081dc6c1cb4baf8065015bb3038f79f, tree 153aee3c889f4942fe3d89938d8e8657c2f2b617, base 47ec7aa. Native Windows full 13 steps/1140s and Linux full 16 steps/1357s passed; all results and exact-head statuses read with fresh main/head/tree. Direct self-review 6404412350 by OpenAI Codex alone under user authorization. Guard all three end-step paths (Windows holder, Linux ExecStop, observe-only children): nonpositive timeout receives remaining shared budget, positive timeout capped, root outcome and launch-step semantics unchanged. Existing Design 04 section 3 at 376c6e9 suffices. Real regressions before Windows 3 failures/1 control and Linux 6 failures/2 controls; after Windows holder 9/9 JIT/native and launch faults 18/18 native, Linux full platform 92/92 JIT and 92/92 native-helper, no Linux skips. Total budget/sentinel/root-result checks retained, no fake process/clock or bound weakening; own attempts/slice drained, actual user manager untouched. No schema/package/RPC/migration, real credential-store/orphan-file operation, LAN/cloud MCP or later feature. MR-16 remains blocked; MR-105 remains next open follow-up. See maintenance/2026-10-25-mr103-validation.md."} +{"at": "2026-10-25T23:52:51Z", "task": "AF-EXEC-02", "kind": "note", "text": "MR-105 fixed: Design#32 merged as 772435e591339a0c94ec34832bbebe5b94094a57 before ArcForges#54 merged as 54e0809d7386f1ec24c39cd4ec1a4fc90f35177a; reviewed final head 3c16d263d22cd2777dbba6f72f852a1fa0811f4d, tree 140798f0d9d717c15964e213a051674a41819d29, base 4990f63. Design native full Windows3/24s and Linux3/46s; source native full Windows13/1109s and Linux16/1356s, all results and exact-head statuses read with fresh main/head/tree. Kind-guarded synthetic ADOPTED initial RUNNING, cancellation STOPPING then FINISHED CANCELLED/HAPPENED, natural/recovery loss LOST/UNKNOWN; no invented exit status or managed FINALIZING. Actual production cancel now journals its first STOPPING change exactly once. Real Linux pre-fix1-fail/0-skips, final adoption4/4 and model18/18 in JIT/native-helper modes; final Windows model18/18 both modes and task control15/15, adoption0-executed/4-skips each mode. Native Host AOT zero warnings/errors both. Candidate864 Linux3-pass/1-cursor-test-fail and obsolete Windows interrupted/error retained separately; corrected test asserts API reset and reads actual cross-generation journal, no bound/guard weakening. Exact-head direct self-review by OpenAI Codex alone, no other model/agent. AR-19 remains deferred/Open with cancellation procedure, MR-16 blocked; no real credential/orphan-file operations, schema/RPC/package/migration, user manager stop or later feature. See maintenance/2026-10-25-mr105-validation.md."} +{"at": "2026-10-25T23:52:51Z", "task": "AF-SEC-01", "kind": "note", "text": "MR-105: AR-19 successful Windows adoption remains Open/deferred. On the current native workstation all three lifecycle adoption candidates created through WMI were already in a job and refused; the fourth test is Linux-only. Final author mode counts are 0 executed/4 skips for JIT and native-helper, never a successful adoption claim. Extend the existing user-provided outside-every-job venue procedure with CancellingAnAdoptionJournalsStoppingBeforeItsFinalResult: actual initial RUNNING/no previous states, one STOPPING despite repeated cancels, FINISHED CANCELLED/HAPPENED/no exit code, no adopted FINALIZING and the same real journal's managed-attempt guards. Linux current-venue adoption4/4 JIT/native-helper passed separately; it does not close Windows acceptance. No new provisioning request or feature activation; MR-16 remains blocked."} diff --git a/maintenance/2026-10-24-repair-list.md b/maintenance/2026-10-24-repair-list.md index 672ebd9..1173943 100644 --- a/maintenance/2026-10-24-repair-list.md +++ b/maintenance/2026-10-24-repair-list.md @@ -41,10 +41,10 @@ managed tasks, no option that disables protection to enable elevation. The stop | MR-12 | DesktopPlatform `LocalRpcClientChannel` CurrentUserOnly check refuses an elevated same-user client (the defect ArcForges.Client fixed locally). | 30 | DesktopPlatform | *(confirm in DesktopPlatform main)* | fix in DesktopPlatform; adoption by ArcForges recorded separately (MR-43) | fixed in producer: DesktopPlatform#200 (merge e02ebe4), reviewed head 66ffbc7; explicit user-SID client check and parent-child pipe owner, foreign/group/missing owners denied; native Windows full 17 steps/532 s and Linux full 24 steps/406 s passed; normal NuGet publication run 40213555173 completed successfully (publish job 121236288721, 2026-10-25); consumer cohort admission/adoption MR-43 separate; AR-21 real cross-integrity validation remains deferred; [evidence](2026-10-25-mr12-validation.md); ledger AF-DP-01 note | | MR-92 | Lost `JobRemoved` signal: `SystemdManager`'s handler looked for the job's waiter and recorded the result only when it found none, while `WaitJob` registers its waiter and then reads the record; a wait registering in between missed the end and ran to its timeout although the job had finished (seen as a 10 s adoption refusal in `AdoptionTests`; an attempt's 90 s start wait could record 'did not start' for a running attempt). | found in MR-76 (Linux leg at bbd4ddb) | ArcForges | live-manager probe: 68 of 20,800 waits missed on main, 0 of 28,800 with the fix | fix | fixed: ArcForges#40 (merge 64e9f7c); ledger AF-EXEC-02 note | | MR-95 | Timeouts and CPU-time limits never fire for an attempt recovered STARTING: the supervisor's timeout and CPU-time checks require `attempt.StartedTimestamp`, which only the change to RUNNING sets, and recovery reads `row.StartedAt`, so a command that a recovered launch starts (during the node gap or after) runs without `timeout_ms` or a CPU-time limit, contrary to 04 section 6 and section 9. | found in MR-89 review (ArcForges#42) | ArcForges | `ExecutionSupervisor.cs` timeout/CPU check and recovery (lines cited in #42's review record) | fix: give a recovered STARTING attempt a start time once its command is known to run; fault test with a restart in a launch step | fixed current-version recovery: Design#28 (merge 64e7c99; Windows full 3 steps/17 s, Linux 3 steps/46 s) before ArcForges#50 (merge 6caf418, reviewed head 265342e; Windows full 13 steps/948 s, Linux 16 steps/1128 s); durable Windows command-start evidence, refreshed Linux root and original recovered clock restore timeout/CPU polling; before-fail/after-pass real-process regressions; older-holder cross-version preservation/settlement assigned to planned AF-DIST-02, not claimed verified; [validation](2026-10-25-mr95-validation.md); ledger AF-EXEC-02 and AF-DIST-02 notes; MR-100 follow-up preserves Linux exit-record accounting during a late forced stop; [follow-up](2026-10-25-mr100-validation.md) | -| MR-99 | The persisted attempt states diverge from SM-ATTEMPT: `RecordFinished` writes FINISHED from whatever state the attempt is in, so FINALIZING is never persisted; timeout, CPU-limit, output, disk and shutdown stops persist no STOPPING (SM-ATTEMPT names timeout and CPU limit as RUNNING -> STOPPING triggers), so a crash during such a stop recovers the attempt as RUNNING; STARTING is persisted at admission, before the container exists, and CREATED is never persisted. The model test checks pairs and allows every state -> FINISHED, so it catches none of this. | found in MR-04 (worker and review) | ArcForges, Design | `ExecutionSupervisor.cs` RecordFinished, Stop, admission; `TaskLifecycleModelTests` | decide per divergence: persist the specified states (code) or amend the triggers (Design, reviewed); tighten the model test | fixed managed executions: Design#31 (merge 376c6e9; native full Windows3/13 s, Linux3/45 s) before ArcForges#52 (merge 47ec7aa, final head d86b89c; native full Windows13/1023 s, Linux16/1183 s); durable STOPPING/FINALIZING, real initial event, trigger/effect model and awaited cancel initiation; real before-fail/after-pass and causal missing-await control, all original bounds retained; earlier 71b367d Linux CI failure and Windows pass retained separately; synthetic ADOPTED mapping is open MR-105 and cross-version acceptance stays planned AF-DIST-02; [validation](2026-10-25-mr99-validation.md); ledger AF-EXEC-02 note | +| MR-99 | The persisted attempt states diverge from SM-ATTEMPT: `RecordFinished` writes FINISHED from whatever state the attempt is in, so FINALIZING is never persisted; timeout, CPU-limit, output, disk and shutdown stops persist no STOPPING (SM-ATTEMPT names timeout and CPU limit as RUNNING -> STOPPING triggers), so a crash during such a stop recovers the attempt as RUNNING; STARTING is persisted at admission, before the container exists, and CREATED is never persisted. The model test checks pairs and allows every state -> FINISHED, so it catches none of this. | found in MR-04 (worker and review) | ArcForges, Design | `ExecutionSupervisor.cs` RecordFinished, Stop, admission; `TaskLifecycleModelTests` | decide per divergence: persist the specified states (code) or amend the triggers (Design, reviewed); tighten the model test | fixed managed executions: Design#31 (merge 376c6e9; native full Windows3/13 s, Linux3/45 s) before ArcForges#52 (merge 47ec7aa, final head d86b89c; native full Windows13/1023 s, Linux16/1183 s); durable STOPPING/FINALIZING, real initial event, trigger/effect model and awaited cancel initiation; real before-fail/after-pass and causal missing-await control, all original bounds retained; earlier 71b367d Linux CI failure and Windows pass retained separately; synthetic ADOPTED mapping is fixed by MR-105 (successful Windows adoption remains deferred AR-19) and cross-version acceptance stays planned AF-DIST-02; [validation](2026-10-25-mr99-validation.md); ledger AF-EXEC-02 note | | MR-100 | A preempted attempt that lives through a node restart ends CANCELLED instead of PREEMPTED and loses its retry: recovery sets `StopReason = Cancelled` for every recovered STOPPING attempt, while Preempt and Requeue keep the PREEMPTED reason in memory only. | found in MR-04 review | ArcForges | `ExecutionSupervisor.cs` recovery of STOPPING | fix: persist the stop reason with STOPPING and restore it; fault test (preempt, restart, expect PREEMPTED and the retry) | fixed: Design#29 (merge c58c228) and Design#30 (merge 049cf20; native Windows full3/12 s, Linux3/38 s) before ArcForges#51 (merge dec32cb, reviewed head c146dde; native Windows full13/1051 s, Linux full16/1168 s); durable STOPPING cause/detail and permitted retry restored; pending result remains private until FINISHED; legacy null cause retains cancellation; Linux workload cleanup preserves bounded control helpers/exit accounting; real before-fail/after-pass crash and lingering-descendant tests; all original bounds retained; future cross-version acceptance stays in planned AF-DIST-02; [validation](2026-10-25-mr100-validation.md); ledger AF-EXEC-02 note | | MR-103 | An end step whose `TimeoutMs` is -1 gets an unbounded wait in `RunEndSteps` and bypasses the 10 s end-step budget (04 section 3), delaying `TerminateLeftovers` and `exit.json` for as long as it runs (present on main before MR-101). | found in MR-101 review | ArcForges | `AttemptRunner.RunEndSteps` timeout choice | fix: treat `TimeoutMs <= 0` as the remaining budget, or validate `TimeoutMs > 0` where steps are built | fixed all three paths: ArcForges#53 (merge 4990f63, final head 0b11e1c; native full Windows13/1140 s, Linux16/1357 s); Windows holder, Linux ExecStop and observe-only end steps cap nonpositive values to the shared remaining budget, positive caps and root result retained; real before Windows3-fail/1-control and Linux6-fail/2-controls, after JIT/native regressions passed without assertion changes; no Design change needed, existing 04 section 3; [validation](2026-10-25-mr103-validation.md); ledger AF-EXEC-02 note | -| MR-105 | A code-wide MR-99 audit found a separate canonical mapping gap for synthetic ADOPTED records: adoption inserts task and attempt directly RUNNING; cancellation finishes the attempt directly with CANCELLED/HAPPENED, and natural disappearance with LOST/UNKNOWN. SM-TASK/SM-ATTEMPT do not name the ADOPTED-specific initial state or cancellation shortcut, although 04 section 10 specifies the synthetic adoption behavior. | found during MR-99 direct review | ArcForges, Design | Adoptions.cs insertion/FinishAsync and 04 section 10; read-only code audit, existing suite regressions are separate evidence | fix: reconcile the canonical machines with the existing adoption semantics and guard the model by attempt kind; verify real Linux adoption and retain the deferred successful Windows adoption case | open; separate from MR-99 managed executing-attempt repair | +| MR-105 | A code-wide MR-99 audit found a separate canonical mapping gap for synthetic ADOPTED records: adoption inserts task and attempt directly RUNNING; cancellation finishes the attempt directly with CANCELLED/HAPPENED, and natural disappearance with LOST/UNKNOWN. SM-TASK/SM-ATTEMPT do not name the ADOPTED-specific initial state or cancellation shortcut, although 04 section 10 specifies the synthetic adoption behavior. | found during MR-99 direct review | ArcForges, Design | Adoptions.cs insertion/FinishAsync and 04 section 10; read-only code audit, existing suite regressions are separate evidence | fix: reconcile the canonical machines with the existing adoption semantics and guard the model by attempt kind; verify real Linux adoption and retain the deferred successful Windows adoption case | fixed: Design#32 (merge 772435e, native full Windows3/24 s, Linux3/46 s) before ArcForges#54 (merge 54e0809, reviewed head 3c16d26; native full Windows13/1109 s, Linux16/1356 s); kind-guarded synthetic initial/cancel/loss rules and exactly one journaled STOPPING event; actual Linux before-fail/after-pass, final adoption4/4 and model18/18 JIT/native-helper, all guards retained; successful Windows adoption remains deferred AR-19 (0 executed/4 skips in each author mode); earlier cursor-test failure and interrupted obsolete Windows run retained; [validation](2026-10-25-mr105-validation.md); ledger AF-EXEC-02/AF-SEC-01 notes | ## 3. Secret purge and backup retention diff --git a/maintenance/2026-10-25-mr105-validation.md b/maintenance/2026-10-25-mr105-validation.md new file mode 100644 index 0000000..95ced94 --- /dev/null +++ b/maintenance/2026-10-25-mr105-validation.md @@ -0,0 +1,105 @@ +# MR-105: kind-guarded synthetic adoption lifecycle + +## Scope and authority + +MR-99 repaired launched attempts. MR-105 reconciles the separate synthetic ADOPTED task/attempt lifecycle already described in +architecture 04 section 10 and adds the missing cancellation journal event. Adoption creates one already-running attempt; +it does not launch a command or collect a parent exit status. It cannot be queued, paused, preempted or retried. + +[Design#32](https://github.com/ArcForges/ArcForges-Design/pull/32) merged first as +772435e591339a0c94ec34832bbebe5b94094a57. Reviewed head f3b43e34f2d5c0e568a73d5c507e16eaf0a13518, tree +a5b4442f27c7ec69e17eaa3d3f0df14268d271fc, base 376c6e9b3b895e75ef3e486623e0b16ad931161f. + +The canonical machines now guard initial RUNNING by ADOPTED kind. Ordinary task/attempt initial states and managed FINALIZING +requirements remain intact. Cancellation records and journals RUNNING -> STOPPING, then FINISHED CANCELLED/HAPPENED once the +container is empty. Natural disappearance ends LOST/UNKNOWN, as does missing-container/changed-boot recovery of a live adoption. +Neither path invents an exit code or managed finalization work. The generated reference renders initial guards; checker regressions +reject incomplete, extra and empty declared guards. Architecture 04 and AD-0004 were amended. + +Design author generation/check passed with protoc (25 files), both SQL schemas, 19 state machines and zero errors; 47 tool tests +passed with 20 Windows platform skips; diff clean. Final native full Windows: 3 steps/24 s, +20261025-231335-f3b43e34f2d5-win. Linux: 3 steps/46 s, 20261026-071331-f3b43e34f2d5-linux. +All six results and both exact-head required success statuses were read, owner-hosted check skipped as configured, runners exited 0. +Fresh main/head/tree checked before merge. [Direct self-review](https://github.com/ArcForges/ArcForges-Design/pull/32#issuecomment-6404743228) +and [final gate](https://github.com/ArcForges/ArcForges-Design/pull/32#issuecomment-6404753124). + +## Before-fix evidence + +Test-only source head f010977e2d0ccd165ecdae3f326ed314ae823766, tree bd2be394db55bf77e6dbaf18edb3fed5ff8d7ba7, +keeps production code unchanged at main 4990f63f33bcf36855e184e4e8c4d3b8d7bde003. Linux fetched it through Git into its native +worktree. Locked restore and Release build passed, zero warnings/errors, build 15.21 s. One real cancellation regression ran +with no skips and failed as expected in 2.117 s (test exit 2): the FINISHED event reports previous STOPPING, while the real journal +last reported RUNNING. The cancel command had persisted STOPPING but never emitted its event. The wrapper captured that expected +failure and exited 0; it is not a successful regression or complete profile. + +The regression adopts its own same-user TestLoad process, runs a separate ordinary task in the same real journal, issues two +cancels and checks result reason/effect, one attempt, no exit code, exactly one STOPPING event, initial events without previous +states, sequence/revision continuity and no adopted FINALIZING. Existing natural-disappearance and missing-container-after-restart +tests also feed their actual events through the same kind-guarded model. Fixture cleanup stays within its own node/units/processes. +No fake process, clock or event stream substitutes for this behavior. + +Before logs: /home/sammiller/arcforges/logs/mr105-before.{sh,out,err,test-exit,exit}. No formal profile ran on the test-only head. + +## Diagnosed intermediate check + +Candidate 864531c0351f26f21565991ca96005e5d65a2c55 contained the production fix. Its Linux affected adoption class reported +3 passes/1 failure, no skips, 2.232 s: the cancel regression now passed, while the newly added restart-event check incorrectly +reused an API cursor from an older stream generation. EventJournal.Open deliberately increments generation on a node restart; +ListEvents correctly requires reset. The corrected test asserts that reset, reads the actual persisted TASKS journal spanning +both generations, and retains all state/result/sequence/revision assertions. No production behavior or bound was weakened. + +The Windows full leg had been started before the Linux affected author result. It was interrupted once the candidate became +obsolete: a host-local control helper verified the exact runner command/process tree and all members of its private console, +then delivered one Ctrl+C. The verification engine performed its own step cleanup and reported arcforges/windows error +(KeyboardInterrupt), not success; the outer wrapper's interrupted execution produced no exit record. A fresh process inventory +confirmed no old runner or build/test workload remained before new author work started. The first control-helper attempt +returned exit 1 without captured diagnostics and had no observed effect; the second used file diagnostics, exact console membership and one recorded +delivery. No arbitrary process, system manager or global process-name kill was used. + +Intermediate author logs: /home/sammiller/arcforges/logs/mr105-after.{sh,out,err,exit} (exit 2). +Obsolete Windows formal logs: C:\MyFile\Projects\dev\logs\mr105-final.{out,err}; these are interrupted, incomplete evidence. +Final profiles must run afresh on the corrected pushed head. + +## Author and final source evidence + +[ArcForges#54](https://github.com/ArcForges/ArcForges/pull/54) merged as 54e0809d7386f1ec24c39cd4ec1a4fc90f35177a. +Final reviewed head: 3c16d263d22cd2777dbba6f72f852a1fa0811f4d. +Tree: 140798f0d9d717c15964e213a051674a41819d29. +Base: 4990f63f33bcf36855e184e4e8c4d3b8d7bde003. +Three files: one missing production journal event and two actual lifecycle regression/model files. + +Final-head Windows author checks passed: Release build with zero warnings/errors, changed-file format/diff, model 18/18 JIT +and 18/18 native-helper, task control 15/15, Host win-x64 Native AOT zero warnings/errors. Each adoption run executed 0/4: +three WMI-created candidates were already in a job and one test is Linux-only. These four skips in each mode are explicitly +not successful Windows adoption evidence; AR-19 remains Open and now includes the cancellation/journal procedure. + +Final-head Linux affected adoption class passed 4/4 JIT in 2.264 s and 4/4 native-helper in 2.388 s, no skips. The lifecycle +model passed 18/18 JIT in 5.102 s and 18/18 native-helper in 4.977 s. Release build and Host linux-x64 Native AOT had zero +warnings/errors; format/diff passed and worktree clean. The corrected restart test asserts API reset and validates actual +persisted events across both generations. All real before/after, continuity, reason/effect and cleanup assertions remain. +The node in these author tests runs in the test process; native-helper mode uses the actual native launch helper for the +ordinary task sharing the journal. A full native-node adoption runtime claim is not inferred from that author coverage. + +Author logs: Windows C:\MyFile\Projects\dev\logs\mr105-author2.{ps1,out,err,exit}; +Linux /home/sammiller/arcforges/logs/mr105-after2.{sh,out,err,exit}. Both author wrappers exited 0 and drained. +[Author evidence](https://github.com/ArcForges/ArcForges/pull/54#issuecomment-6404895324). +[Final exact-head direct self-review](https://github.com/ArcForges/ArcForges/pull/54#issuecomment-6404895644): +all three files and the generation-correction delta checked against the merged Design; no findings. + +Both complete native post-push profiles passed on this final head: + +- Windows full: 13 steps/1109 s, 20261025-232921-3c16d263d22c-win. +- Linux full: 16 steps/1356 s, 20261026-072914-3c16d263d22c-linux. +- Every selected result was read and passed, including JIT/native exclusive suites and startup gates. +- Both required exact-head arcforges/windows and arcforges/linux statuses were success; owner-hosted checks skipped as configured. +- Fresh main/base, PR head and tree checked immediately before merge. +- [Final merge gate](https://github.com/ArcForges/ArcForges/pull/54#issuecomment-6405126852). + +Final formal logs: Windows C:\MyFile\Projects\dev\logs\mr105-final2.{out,err,exit}; +Linux /home/sammiller/arcforges/logs/mr105-final2.{out,err,exit}. Both runners exited 0 and drained; no competing build/test +or old candidate/partial run/skip substituted for these complete profiles. After the actual source merge, the list and CLI +ledger completion were recorded. Windows successful adoption remains deferred, no task or future feature was activated. + +No enum/RPC/package/schema change or database migration. No real credential-store or orphan-file operation; MR-16 remains blocked. +No user systemd manager termination, daemon-reload or pkill -f. AF-REC-01 and later feature tasks remain unstarted; no LAN/cloud MCP. +All work and review are by OpenAI Codex alone under the user's explicit instruction; no independent review is claimed.