docs: record MR-13 retained-backup input repair and native verification

ledger/ledger.jsonl

@@ -144,3 +144,4 @@
 {"at": "2026-10-25T23:04:59Z", "task": "AF-EXEC-02", "kind": "note", "text": "MR-103 fixed: ArcForges#53 merged as 4990f63f33bcf36855e184e4e8c4d3b8d7bde003; reviewed final head 0b11e1c97081dc6c1cb4baf8065015bb3038f79f, tree 153aee3c889f4942fe3d89938d8e8657c2f2b617, base 47ec7aa. Native Windows full 13 steps/1140s and Linux full 16 steps/1357s passed; all results and exact-head statuses read with fresh main/head/tree. Direct self-review 6404412350 by OpenAI Codex alone under user authorization. Guard all three end-step paths (Windows holder, Linux ExecStop, observe-only children): nonpositive timeout receives remaining shared budget, positive timeout capped, root outcome and launch-step semantics unchanged. Existing Design 04 section 3 at 376c6e9 suffices. Real regressions before Windows 3 failures/1 control and Linux 6 failures/2 controls; after Windows holder 9/9 JIT/native and launch faults 18/18 native, Linux full platform 92/92 JIT and 92/92 native-helper, no Linux skips. Total budget/sentinel/root-result checks retained, no fake process/clock or bound weakening; own attempts/slice drained, actual user manager untouched. No schema/package/RPC/migration, real credential-store/orphan-file operation, LAN/cloud MCP or later feature. MR-16 remains blocked; MR-105 remains next open follow-up. See maintenance/2026-10-25-mr103-validation.md."}
 {"at": "2026-10-25T23:52:51Z", "task": "AF-EXEC-02", "kind": "note", "text": "MR-105 fixed: Design#32 merged as 772435e591339a0c94ec34832bbebe5b94094a57 before ArcForges#54 merged as 54e0809d7386f1ec24c39cd4ec1a4fc90f35177a; reviewed final head 3c16d263d22cd2777dbba6f72f852a1fa0811f4d, tree 140798f0d9d717c15964e213a051674a41819d29, base 4990f63. Design native full Windows3/24s and Linux3/46s; source native full Windows13/1109s and Linux16/1356s, all results and exact-head statuses read with fresh main/head/tree. Kind-guarded synthetic ADOPTED initial RUNNING, cancellation STOPPING then FINISHED CANCELLED/HAPPENED, natural/recovery loss LOST/UNKNOWN; no invented exit status or managed FINALIZING. Actual production cancel now journals its first STOPPING change exactly once. Real Linux pre-fix1-fail/0-skips, final adoption4/4 and model18/18 in JIT/native-helper modes; final Windows model18/18 both modes and task control15/15, adoption0-executed/4-skips each mode. Native Host AOT zero warnings/errors both. Candidate864 Linux3-pass/1-cursor-test-fail and obsolete Windows interrupted/error retained separately; corrected test asserts API reset and reads actual cross-generation journal, no bound/guard weakening. Exact-head direct self-review by OpenAI Codex alone, no other model/agent. AR-19 remains deferred/Open with cancellation procedure, MR-16 blocked; no real credential/orphan-file operations, schema/RPC/package/migration, user manager stop or later feature. See maintenance/2026-10-25-mr105-validation.md."}
 {"at": "2026-10-25T23:52:51Z", "task": "AF-SEC-01", "kind": "note", "text": "MR-105: AR-19 successful Windows adoption remains Open/deferred. On the current native workstation all three lifecycle adoption candidates created through WMI were already in a job and refused; the fourth test is Linux-only. Final author mode counts are 0 executed/4 skips for JIT and native-helper, never a successful adoption claim. Extend the existing user-provided outside-every-job venue procedure with CancellingAnAdoptionJournalsStoppingBeforeItsFinalResult: actual initial RUNNING/no previous states, one STOPPING despite repeated cancels, FINISHED CANCELLED/HAPPENED/no exit code, no adopted FINALIZING and the same real journal's managed-attempt guards. Linux current-venue adoption4/4 JIT/native-helper passed separately; it does not close Windows acceptance. No new provisioning request or feature activation; MR-16 remains blocked."}
+{"at": "2026-10-26T00:47:34Z", "task": "AF-NODE-02", "kind": "note", "text": "MR-13 fixed (original ledger26 item3): Design#33 merged as 6358f94ebf32f4e2968d591413d86f5e2939decc before ArcForges#55 merged as 448e28dc247fb4234607cc4e811f3723f53e9b31; reviewed final head fcd99c085bb8b5bba44e4be4cb43d97fc147979e, tree 5517871c08c62ec72e659a37ddf014cadc51caa3, base 54e0809. Design complete native Windows3/25s, Linux3/46s; source complete native Windows13/1135s and Linux16/1355s, all results and exact-head statuses read with fresh main/head/tree. Retained backups never carry sealed task input: sanitize new copies before publish and older copies before open, reuse tombstones, compact/check integrity, fail closed on corrupt/locked/unreadable copies; records/names/schema/live retention/key remain. Restored sealed inputs require new submission. Real SQLite/GCM before 5 failures/0 skips each native host (test exit2), final fixed regressions5/5 both; full affected store project Windows93-pass/2-platform-skips of95 and Linux92-pass/3-platform-skips of95; Host and Bench AOT zero warnings/errors both. Initial CS0111 duplicate-constructor compile-only failure removed, existing constructor reused; no weakened assertion. External key backend is isolated under policy, never real OS-store stress/credential/orphan-file operation; no new or deployed database schema migration, enum/RPC/package change, node-key deletion/rotation or later feature. Exact-head direct self-review by OpenAI Codex alone, no other model/agent. MR-16 blocked and MR-14 remains next separate page/WAL audit. See maintenance/2026-10-26-mr13-validation.md."}

maintenance/2026-10-24-repair-list.md

@@ -50,7 +50,7 @@ managed tasks, no option that disables protection to enable elevation. The stop
 
 | ID | Issue | Ledger | Repos | Evidence | Proposed disposition | Status |
 |---|---|---|---|---|---|---|
-| MR-13 | Pre-migration backups (`records/backups`, last 3) keep `task_secret` values after the task's secrets are purged (R-EXE-017 / 04 §2 vs 13 §6). | 26 (3) | Design, ArcForges | 02 §2 step 3, 13 §6, node-store.md; no backup handling in the purge *(confirm)* | fix: Design states that a purge also removes the values from every retained backup (or that backups never carry them), and the node does so; regression test | open |
+| MR-13 | Pre-migration backups (`records/backups`, last 3) keep `task_secret` values after the task's secrets are purged (R-EXE-017 / 04 §2 vs 13 §6). | 26 (3) | Design, ArcForges | 02 §2 step 3, 13 §6, node-store.md; no backup handling in the purge *(confirm)* | fix: Design states that a purge also removes the values from every retained backup (or that backups never carry them), and the node does so; regression test | fixed: Design#33 (merge 6358f94; native full Windows3/25 s, Linux3/46 s) before ArcForges#55 (merge 448e28d, reviewed head fcd99c0; native full Windows13/1135 s, Linux16/1355 s); all retained copies exclude sealed input, new copies before publish and older copies before open, fail closed on inability; real before 5 failures/0 skips each host, after 5/5 each and full store Windows93-pass/2-skip, Linux92-pass/3-skip; real restore with original isolated key backend, names/nonsecret records/schema/live retention preserved; no new/deployed schema migration or restricted credential operation; MR-14 separate; [validation](2026-10-26-mr13-validation.md); ledger AF-NODE-02 note |
 | MR-14 | Deleted sealed values may stay readable in free pages of the store file after a purge. | 26 (3) (same retention concern) | ArcForges | *(confirm `secure_delete` or equivalent)* | fix if confirmed (same Design statement as MR-13); else resolved with evidence | open |
 | MR-15 | `CrashConsistencyTests.AStoreKilledDuringWritesReopensConsistent(420)` once saw every sealed value unavailable after a kill and reopen. | ArcForges#12 follow-up | ArcForges | Not reproduced; the test prints `UnavailableReason` *(confirm against host logs)* | fix if a cause is found; otherwise reported with evidence (no claim of resolution) | open |
 | MR-16 | Historical records from 2026-10-17 report 746 stress-generated Windows credentials and about 5,990 orphan credential files; current counts have not been inspected. Cleanup stopped by the owner's decision of 2026-10-18. | 39 (7), 40 | none (workstation) | Records only; no store access in this pass | blocked: the owner's decision on the recovery proposal in the final report | blocked: owner's stop of 2026-10-18 reaffirmed on 2026-10-25; recovery proposal retained; no real Credential Manager cleanup, orphan credential-file operations or real-store stress |

maintenance/2026-10-26-mr13-validation.md

@@ -0,0 +1,106 @@
+# MR-13: retained backups exclude sealed task input
+
+## Scope and authority
+
+MR-13 confirmed that pre-migration backups kept decryptable task_secret values after both live-store purge paths. The maintenance
+list permits either removing values from all retained backups or excluding them from backups. This repair selects exclusion:
+new copies are sanitized before publish; older retained copies are sanitized on store open before migration/startup. Failure
+to sanitize any retained copy refuses the open. Task records, nonsecret data, presence-only names and store_meta schema version
+are retained. A backup restore requires new submission for sealed inputs, including values still available in the live store.
+The live store's retention and the node data key are unchanged.
+
+[Design#33](https://github.com/ArcForges/ArcForges-Design/pull/33) merged first as
+6358f94ebf32f4e2968d591413d86f5e2939decc. Reviewed head 029fc26067a26a0d4e9a92cb99ca857363cd6682, tree
+d2a106cfee32753d702104db2e4e5fc0bb90a407, base 772435e591339a0c94ec34832bbebe5b94094a57.
+AD-0006, execution, startup, distribution and node-store documentation agree on this retention policy and its restore consequence.
+
+Design author checks: zero errors, protoc 25 files, both SQL schemas, 47 tool tests with 20 Windows platform skips, diff clean.
+Final native Windows full 3 steps/25 s (20261026-000524-029fc26067a2-win); Linux 3 steps/46 s
+(20261026-080520-029fc26067a2-linux). All six results, both wrapper exit records 0 and both exact-head required success statuses
+were read, owner-hosted check skipped. Fresh main/head/tree checked before merge.
+[Direct self-review](https://github.com/ArcForges/ArcForges-Design/pull/33#issuecomment-6405254475);
+[final gate](https://github.com/ArcForges/ArcForges-Design/pull/33#issuecomment-6405277250).
+
+## Real before-fix proof
+
+Source test-only head ebc2b951cff881ab85173ca7ccef85d16c7b61c0, tree 4ebdbb06f88f0dc009b1bf7f2090496f19b1c376,
+kept production unchanged at main 54e0809d7386f1ec24c39cd4ec1a4fc90f35177a. Both native hosts fetched through Git.
+
+- Windows locked restore/Release build passed, zero warnings/errors, build 19.89 s. Five actual regressions failed, zero skips,
+  test exit 2, 3.317 s.
+- Linux locked restore/Release build passed, zero warnings/errors, build 15.57 s. Five actual regressions failed, zero skips,
+  test exit 2, 0.878 s.
+- Four cases restored a real SQLite backup with the original isolated key backend still available, and found the input Available
+  instead of Unavailable: new copies with small and overflow-sized payloads, and three legacy retained copies after immediate
+  and retention-based live purges. The live purge itself passed its unavailable assertion before the legacy restore failed.
+- The fifth case found that a corrupt retained backup did not refuse the open. The unexpected successful open was disposed.
+- Both wrappers captured the expected test failures and exited 0; these are before-fix evidence, never a successful regression
+  or complete profile. No formal profile ran on either intermediate test-only head.
+
+The AES-GCM, SQLite files, backup copy and restored store are real. Only the external key backend is isolated, as required by
+the secret-store test policy. Tests use synthetic input and their own temporary roots, verify key cleanup through the isolated
+backend, and never call a real OS secret store or inspect/delete credential or orphan-credential files.
+They also require nonsecret records/names/schema preservation, unchanged live input availability, no migration, backup integrity,
+absence of sampled old ciphertext bytes, and refusal without damaging live input. An unrelated file is retained untouched.
+
+Before logs: Windows C:\MyFile\Projects\dev\logs\mr13-before.{ps1,out,err,test-exit,exit};
+Linux /home/sammiller/arcforges/logs/mr13-before.{sh,out,err,test-exit,exit}.
+
+## Diagnosed author iteration
+
+The first fixed working-tree Windows author attempt passed formatting but failed compilation with CS0111: an added
+StoreBackupException(string, Exception) duplicated the existing constructor. The duplicate addition was removed; the existing
+constructor is reused. No regression or AOT checks ran in that failed attempt. This was a compile-only failure, not a passed
+profile or weakened test. Logs: C:\MyFile\Projects\dev\logs\mr13-author.{ps1,out,err,exit} (exit 2).
+
+## Author and final evidence
+
+[ArcForges#55](https://github.com/ArcForges/ArcForges/pull/55) merged as 448e28dc247fb4234607cc4e811f3723f53e9b31.
+Final reviewed head: fcd99c085bb8b5bba44e4be4cb43d97fc147979e.
+Tree: 5517871c08c62ec72e659a37ddf014cadc51caa3.
+Base: 54e0809d7386f1ec24c39cd4ec1a4fc90f35177a.
+Four files: backup sanitization, its store-open hook, reuse of the existing tombstone and real backup/restore regressions.
+
+New copies are sanitized before rename/publish. Store open processes every retained backup before startup or any existing
+migration path. The copy uses secure_delete, DELETE journal mode and VACUUM, then integrity_check. Existing schemas are not
+migrated or expanded. The original task secret rows in the live store remain usable until their own purge; key operations and
+retention policy are unchanged. Older copies with no task_secret table are not given a new table. Copy failures retain the
+underlying error and refuse the open. Named backup retention remains three.
+
+Windows author working tree was byte-identical to this final head: changed-file format/diff and Release build passed with
+zero warnings/errors (10.77 s); new regressions 5/5, no skips, 3.780 s. Full affected store project: 95 total, 93 passed,
+2 platform skips, 8.052 s. Skips: Linux Secret Service selection and Unix directory modes. Host and Bench win-x64 Native AOT
+both published with zero warnings/errors; mr13-author2 exited 0.
+
+Linux fetched the exact final head: Release build zero warnings/errors, new regressions 5/5, no skips, 0.880 s. Full affected
+store project: 95 total, 92 passed, 3 platform skips, 3.013 s (two Windows mapped-file behaviors and the Windows-only
+Credential Manager denial guard). Host and Bench linux-x64 Native AOT both published with zero warnings/errors; changed-file
+format/diff passed and worktree clean; mr13-after exited 0. Both author jobs drained before either complete final profile.
+These author tests exercise the managed store on each native host; AOT publish validates the affected components. A broader
+native executable backup-runtime claim is not inferred.
+
+[Author evidence](https://github.com/ArcForges/ArcForges/pull/55#issuecomment-6405463572).
+[Exact-head direct self-review](https://github.com/ArcForges/ArcForges/pull/55#issuecomment-6405463805): all four files against
+the merged Design, no findings. No identical full suite was repeated for review.
+Author logs: Windows C:\MyFile\Projects\dev\logs\mr13-author2.{ps1,out,err,exit};
+Linux /home/sammiller/arcforges/logs/mr13-after.{sh,out,err,exit}.
+
+Both complete post-push native profiles passed at the final reviewed head:
+
+- Windows full: 13 steps/1135 s, 20261026-002302-fcd99c085bb8-win.
+- Linux full: 16 steps/1355 s, 20261026-082255-fcd99c085bb8-linux.
+- Every selected summary result read and passed, including JIT/native exclusive suites and startup gates.
+- Both required exact-head arcforges/windows and arcforges/linux statuses success; owner-hosted checks skipped as configured.
+- Fresh PR head/tree and source main/base checked immediately before merge.
+- [Final merge gate](https://github.com/ArcForges/ArcForges/pull/55#issuecomment-6405736718).
+
+Formal logs: Windows C:\MyFile\Projects\dev\logs\mr13-final.{out,err,exit};
+Linux /home/sammiller/arcforges/logs/mr13-final.{out,err,exit}. Both native runners exited 0 and drained, with no competing
+build/test. No earlier head, expected failure, partial run, skip or relaxed assertion substituted for these gates.
+Only after the actual source merge, the maintenance list was updated and the owning AF-NODE-02 ledger note was appended
+through the Plan CLI. Task states and later feature activation remain unchanged.
+
+The implementation uses existing tables and tombstones. No new or deployed database schema migration, enum/RPC/package change,
+real credential-store operation, node-key deletion/rotation or orphan credential-file operation is included. MR-16 remains blocked.
+MR-14's live-store page/WAL erasure is the next separate item. No user manager shutdown, daemon-reload, pkill -f, LAN/cloud MCP
+or AF-REC-01/later feature activation. All work/review by OpenAI Codex alone; no other model/agent or independent review claimed.