docs: record MR-14 erasure repair and stop-point handoff

ledger/ledger.jsonl

@@ -145,3 +145,4 @@
 {"at": "2026-10-25T23:52:51Z", "task": "AF-EXEC-02", "kind": "note", "text": "MR-105 fixed: Design#32 merged as 772435e591339a0c94ec34832bbebe5b94094a57 before ArcForges#54 merged as 54e0809d7386f1ec24c39cd4ec1a4fc90f35177a; reviewed final head 3c16d263d22cd2777dbba6f72f852a1fa0811f4d, tree 140798f0d9d717c15964e213a051674a41819d29, base 4990f63. Design native full Windows3/24s and Linux3/46s; source native full Windows13/1109s and Linux16/1356s, all results and exact-head statuses read with fresh main/head/tree. Kind-guarded synthetic ADOPTED initial RUNNING, cancellation STOPPING then FINISHED CANCELLED/HAPPENED, natural/recovery loss LOST/UNKNOWN; no invented exit status or managed FINALIZING. Actual production cancel now journals its first STOPPING change exactly once. Real Linux pre-fix1-fail/0-skips, final adoption4/4 and model18/18 in JIT/native-helper modes; final Windows model18/18 both modes and task control15/15, adoption0-executed/4-skips each mode. Native Host AOT zero warnings/errors both. Candidate864 Linux3-pass/1-cursor-test-fail and obsolete Windows interrupted/error retained separately; corrected test asserts API reset and reads actual cross-generation journal, no bound/guard weakening. Exact-head direct self-review by OpenAI Codex alone, no other model/agent. AR-19 remains deferred/Open with cancellation procedure, MR-16 blocked; no real credential/orphan-file operations, schema/RPC/package/migration, user manager stop or later feature. See maintenance/2026-10-25-mr105-validation.md."}
 {"at": "2026-10-25T23:52:51Z", "task": "AF-SEC-01", "kind": "note", "text": "MR-105: AR-19 successful Windows adoption remains Open/deferred. On the current native workstation all three lifecycle adoption candidates created through WMI were already in a job and refused; the fourth test is Linux-only. Final author mode counts are 0 executed/4 skips for JIT and native-helper, never a successful adoption claim. Extend the existing user-provided outside-every-job venue procedure with CancellingAnAdoptionJournalsStoppingBeforeItsFinalResult: actual initial RUNNING/no previous states, one STOPPING despite repeated cancels, FINISHED CANCELLED/HAPPENED/no exit code, no adopted FINALIZING and the same real journal's managed-attempt guards. Linux current-venue adoption4/4 JIT/native-helper passed separately; it does not close Windows acceptance. No new provisioning request or feature activation; MR-16 remains blocked."}
 {"at": "2026-10-26T00:47:34Z", "task": "AF-NODE-02", "kind": "note", "text": "MR-13 fixed (original ledger26 item3): Design#33 merged as 6358f94ebf32f4e2968d591413d86f5e2939decc before ArcForges#55 merged as 448e28dc247fb4234607cc4e811f3723f53e9b31; reviewed final head fcd99c085bb8b5bba44e4be4cb43d97fc147979e, tree 5517871c08c62ec72e659a37ddf014cadc51caa3, base 54e0809. Design complete native Windows3/25s, Linux3/46s; source complete native Windows13/1135s and Linux16/1355s, all results and exact-head statuses read with fresh main/head/tree. Retained backups never carry sealed task input: sanitize new copies before publish and older copies before open, reuse tombstones, compact/check integrity, fail closed on corrupt/locked/unreadable copies; records/names/schema/live retention/key remain. Restored sealed inputs require new submission. Real SQLite/GCM before 5 failures/0 skips each native host (test exit2), final fixed regressions5/5 both; full affected store project Windows93-pass/2-platform-skips of95 and Linux92-pass/3-platform-skips of95; Host and Bench AOT zero warnings/errors both. Initial CS0111 duplicate-constructor compile-only failure removed, existing constructor reused; no weakened assertion. External key backend is isolated under policy, never real OS-store stress/credential/orphan-file operation; no new or deployed database schema migration, enum/RPC/package change, node-key deletion/rotation or later feature. Exact-head direct self-review by OpenAI Codex alone, no other model/agent. MR-16 blocked and MR-14 remains next separate page/WAL audit. See maintenance/2026-10-26-mr13-validation.md."}
+{"at": "2026-10-26T02:12:43Z", "task": "AF-NODE-02", "kind": "note", "text": "MR-14 fixed: Design#34 merge 3df9db7946e9af6fd1e43f97216adfc44fd55507 before ArcForges#56 merge 5fa2ad5fe77bef791b96db11129b3851fe55c940, reviewed head 0d261bbe1d48f3c1e9848c15f32a26132cf030da. Existing secure_delete plus manual post-commit/replay WAL TRUNCATE and periodic zero-new-row retry; busy/failed manual checkpoint returns existing INTERNAL/internal, effect HAPPENED, no rollback/dedup rewrite. Real before 6 failures per native host, after all 6 own-platform regressions pass; full Store Windows95/97 (2 platform skips), Linux94/97 (3), affected AOT zero warnings/errors. Final complete Windows13/1148s and Linux16/1364s passed at exact head; Design Windows3/15s Linux3/34s. Evidence maintenance/2026-10-26-mr14-validation.md. Direct work/review by OpenAI Codex alone. No new schema migration, restricted credential operation or task activation. MR-16 remains blocked; MR-07 and MR-11 deferred/unresolved. Owner's 2026-10-26 instruction: finish MR-14 then stop for context adjustment to 872000; MR-15 remains next and unstarted. Current handoff maintenance/2026-10-26-handoff.md; 35 disposed,67 open,2 deferred,1 blocked of105. Design#35 merge 2d9995e78c4aa0f6327371ab0b5639857718da5c resolved the common idempotency-summary review finding before source merge; native full Windows3/26s Linux3/45s passed, no source/profile input change."}

maintenance/2026-10-24-repair-list.md

@@ -51,7 +51,7 @@ managed tasks, no option that disables protection to enable elevation. The stop
 | ID | Issue | Ledger | Repos | Evidence | Proposed disposition | Status |
 |---|---|---|---|---|---|---|
 | MR-13 | Pre-migration backups (`records/backups`, last 3) keep `task_secret` values after the task's secrets are purged (R-EXE-017 / 04 §2 vs 13 §6). | 26 (3) | Design, ArcForges | 02 §2 step 3, 13 §6, node-store.md; no backup handling in the purge *(confirm)* | fix: Design states that a purge also removes the values from every retained backup (or that backups never carry them), and the node does so; regression test | fixed: Design#33 (merge 6358f94; native full Windows3/25 s, Linux3/46 s) before ArcForges#55 (merge 448e28d, reviewed head fcd99c0; native full Windows13/1135 s, Linux16/1355 s); all retained copies exclude sealed input, new copies before publish and older copies before open, fail closed on inability; real before 5 failures/0 skips each host, after 5/5 each and full store Windows93-pass/2-skip, Linux92-pass/3-skip; real restore with original isolated key backend, names/nonsecret records/schema/live retention preserved; no new/deployed schema migration or restricted credential operation; MR-14 separate; [validation](2026-10-26-mr13-validation.md); ledger AF-NODE-02 note |
-| MR-14 | Deleted sealed values may stay readable in free pages of the store file after a purge. | 26 (3) (same retention concern) | ArcForges | *(confirm `secure_delete` or equivalent)* | fix if confirmed (same Design statement as MR-13); else resolved with evidence | open |
+| MR-14 | Deleted sealed values may stay readable in free pages of the store file after a purge. | 26 (3) (same retention concern) | ArcForges | *(confirm `secure_delete` or equivalent)* | fix if confirmed (same Design statement as MR-13); else resolved with evidence | fixed: Design#34 (merge 3df9db7; native full Windows3/15 s, Linux3/34 s) before ArcForges#56 (merge 5fa2ad5, reviewed head 0d261bb; native full Windows13/1148 s, Linux16/1364 s); existing secure_delete retained, manual post-commit/replay TRUNCATE checkpoint with known-HAPPENED error when busy/failed, and periodic zero-new-row retry; real before 6 failures per host, after 6 own-platform regressions pass per host, full Store Windows95-pass/2-skip and Linux94-pass/3-skip of97; [validation](2026-10-26-mr14-validation.md); ledger AF-NODE-02 note; owner requested stop after this item, MR-15 unstarted; common replay summaries aligned by Design#35 (merge 2d9995e, Windows3/26s Linux3/45s) before source merge |
 | MR-15 | `CrashConsistencyTests.AStoreKilledDuringWritesReopensConsistent(420)` once saw every sealed value unavailable after a kill and reopen. | ArcForges#12 follow-up | ArcForges | Not reproduced; the test prints `UnavailableReason` *(confirm against host logs)* | fix if a cause is found; otherwise reported with evidence (no claim of resolution) | open |
 | MR-16 | Historical records from 2026-10-17 report 746 stress-generated Windows credentials and about 5,990 orphan credential files; current counts have not been inspected. Cleanup stopped by the owner's decision of 2026-10-18. | 39 (7), 40 | none (workstation) | Records only; no store access in this pass | blocked: the owner's decision on the recovery proposal in the final report | blocked: owner's stop of 2026-10-18 reaffirmed on 2026-10-25; recovery proposal retained; no real Credential Manager cleanup, orphan credential-file operations or real-store stress |
 

maintenance/2026-10-25-handoff.md

@@ -1,3 +1,5 @@
+> Superseded operational state and continuation instruction: see [2026-10-26 handoff](2026-10-26-handoff.md). The latest owner instruction is to finish MR-14 and STOP; MR-15 is unstarted. Refresh all refs and host state before resuming.
+
 # Maintenance pass: session handoff, 2026-10-25
 
 This file records where the maintenance pass stopped on 2026-10-25 and how the next session can take over without losing context.

maintenance/2026-10-26-handoff.md

@@ -0,0 +1,52 @@
+# Maintenance handoff, 2026-10-26
+
+## Latest owner instruction
+
+Finish the current item, MR-14, including verification, merge and records, then STOP so the owner can adjust context to
+872000. MR-14 is complete. Do not start MR-15 or continue automatically. A later explicit owner resume can continue
+the authorized maintenance list from MR-15. Do not start AF-REC-01 or later features.
+
+This supersedes the resumption instruction and stale operational state in the [2026-10-25 handoff](2026-10-25-handoff.md).
+Scope/order and current dispositions are in the [repair list](2026-10-24-repair-list.md); read the append-only ledger too.
+
+## Completed current item
+
+- MR-14: [Design#34](https://github.com/ArcForges/ArcForges-Design/pull/34), merge 3df9db7946e9af6fd1e43f97216adfc44fd55507,
+  precedes [ArcForges#56](https://github.com/ArcForges/ArcForges/pull/56), merge 5fa2ad5fe77bef791b96db11129b3851fe55c940.
+- Reviewed implementation head 0d261bbe1d48f3c1e9848c15f32a26132cf030da, tree 852d5472ff079f9df9debe57a1a3329f8bc0faf9.
+  Complete native Windows 13 steps/1148 s and Linux 16 steps/1364 s passed at that head; Design 3/15 s and 3/34 s.
+- Real before: 6 failures on each host. After: all 6 own-platform regressions pass per host, plus existing affected checks.
+  Full evidence, initial compile-only failure, exact logs and limits: [MR-14 validation](2026-10-26-mr14-validation.md).
+- Source repair is post-commit WAL checkpoint/replay and zero-new-row periodic retry. Existing secure_delete, schema,
+  tombstones, live key and retention remain. Busy readers can defer physical erasure, and manual success is withheld then.
+- MR-13 is already complete: [source#55](https://github.com/ArcForges/ArcForges/pull/55) and [Plan#66](https://github.com/ArcForges/Plan/pull/66).
+  MR-101, MR-04 and MR-102 are also merged; never resume their historical diagnostics as unfinished work.
+- This Plan record updates the list, appends the AF-NODE-02 note only through the Plan CLI, and links the new handoff from
+  the old one. It needs its own fresh native full profiles and unchanged freshly fetched Design context before merge.
+
+- Additional [Design#35](https://github.com/ArcForges/ArcForges-Design/pull/35), merge 2d9995e78c4aa0f6327371ab0b5639857718da5c, aligned AD-0004 and the common replay summary before source merge; both native full legs passed (Windows 3/26 s, Linux 3/45 s). It is the Design context used by this Plan record.
+
+## Remaining and boundaries
+
+105 list items: 35 disposed, 67 open, 2 deferred, 1 blocked. MR-15 is next, not started: investigate the historical
+CrashConsistencyTests(420) all-secrets-unavailable observation from retained logs/UnavailableReason; nonrecurrence does
+not establish its cause or a repair. Do not repeat a timed-out launch without checking logs/processes/products first.
+
+MR-16 stays blocked: no real Windows Credential Manager cleanup/stress or orphan credential-file operations; preserve
+the recovery proposal. MR-07/AR-20 and MR-11/AR-21 stay unresolved/deferred. Other acceptance-register limitations,
+including successful real Windows adoption AR-19, remain. No LAN/cloud MCP implementation or new/deployed DB migration.
+
+## Resume safely
+
+Use only the native Windows and Linux MCP servers for host actions, discover tools afresh, and test connections.
+Windows root C:/MyFile/Projects/ArcForges; Linux root /home/sammiller/arcforges. No direct executor, SSH or WSL fallback.
+Refresh GitHub PRs/statuses, git refs, all applicable AGENTS/governance and Design, and actual processes/logs.
+Recorded SHAs and PIDs are historical evidence, never live state. Preserve all worktrees, user changes and ignored caches.
+Primary checkouts intentionally remain stale; use fresh origin/main and task worktrees.
+
+Windows source worktree: ArcForges/.worktree/mr-14 (clean detached final head).
+Linux source worktree: ArcForges/.worktree/mr-14 (task/mr-14, clean final head).
+Plan reusable Windows worktree: Plan/.worktree/maintenance-resume-2026-10-25, branch plan/maintenance-mr14-purge-erasure.
+Formal logs remain under each repository's .git/arcforges-verify/logs; mr14-* wrapper logs are in the hosts' dev/logs or logs.
+Never terminate the Linux user systemd manager, use pkill -f or daemon-reload. Keep formal hosts free of competing tests.
+Work alone under the owner's instruction; use truthful OpenAI Codex attribution and direct review.