From 130c44d98cdc3b28ed133087b56db2dd9475f196 Mon Sep 17 00:00:00 2001 From: sammiller Date: Mon, 26 Oct 2026 02:29:08 +0000 Subject: [PATCH] docs: retain MR-15 unresolved evidence and resume maintenance Co-Authored-By: OpenAI Codex --- acceptance-register.md | 21 +++++++ delivery-graph.json | 6 +- ledger/ledger.jsonl | 1 + maintenance/2026-10-24-repair-list.md | 2 +- maintenance/2026-10-25-handoff.md | 2 +- maintenance/2026-10-26-handoff.md | 20 +++--- maintenance/2026-10-26-mr15-observation.md | 71 ++++++++++++++++++++++ 7 files changed, 110 insertions(+), 13 deletions(-) create mode 100644 maintenance/2026-10-26-mr15-observation.md diff --git a/acceptance-register.md b/acceptance-register.md index 615953b..1a5e06a 100644 --- a/acceptance-register.md +++ b/acceptance-register.md @@ -37,6 +37,7 @@ Real-world validation that cannot run at development stage, and the human prereq | AR-19 | Successful Windows process adoption (ArcForges-Design 04 §10; `ResourceService.AdoptProcess`): a same-user process outside every job is adopted into the root job and a nested adoption job (the root job's limits apply, V-W01), appears as an `ADOPTED` task with label `ADOPTED`, its existing children follow, it can be terminated through `process.terminate`, and it ends `LOST` ("no exit status: the node is not the adopted process's parent") when it exits; after a node restart an adoption job the node cannot reopen (L-14) ends the task `LOST` through `container_missing`. Procedure: on a Windows 11 machine where a process created through WMI `Win32_Process.Create` is outside every job (check with `IsProcessInJob`), run `Node.Platform.Windows.Tests -method *AdoptionTests.AProcessOutsideAnyJobIsAdoptedWithItsChildrenAndTerminated` and `Node.Core.Tests -method *AdoptionLifecycleTests.AnAdoptedProcessThatEndsByItselfEndsItsTaskLostWithoutAnExitStatus` and `-method *AdoptionLifecycleTests.AnAdoptionContainerTheNodeCannotReopenAfterARestartIsLost`, plus `-method *AdoptionLifecycleTests.CancellingAnAdoptionJournalsStoppingBeforeItsFinalResult` (MR-105: real journal has initial RUNNING without previous states, exactly one STOPPING even after repeated cancellation, FINISHED CANCELLED/HAPPENED with no exit code, no adopted FINALIZING, and the shared kind-guarded model also checks an ordinary task); none may skip with the "already in a job" reason | On the workstation every user process, a WMI-created one included, is already in a job (ArcForges-Design register L-30), so 04 §10 refuses every candidate and the capability `adopt` reports `LIMITED`; the refusal path is proven there (AF-SEC-01) | A Windows 11 machine or VM where a WMI-created process is outside every job (user-provided) | AF-SEC-01 | Open | | AR-20 | MR-07: establish the cause of the Windows supervisor test's unexplained node stop exit 75 and verify a discriminating repair if required | The historical failure has not recurred with the retained diagnostics; non-recurrence cannot establish its cause or prove a fix | A captured native Windows recurrence with verbose transport/descriptor/node/supervisor evidence, or a proven causal reproduction; the Windows MCP venue is already available, no new human provisioning | AF-NODE-01 | Open; unresolved observation, not a passed check or task block | | AR-21 | MR-11: a non-elevated Windows node and an elevated client of the same user: user-SID pipe ownership succeeds, but an unidentifiable elevated peer is refused before API execution | Existing automated ownership tests do not create two processes at different integrity levels; owner deferred full end-to-end testing on 2026-10-15 (ledger 30) | User-performed Windows 11 cross-integrity run at final end-to-end acceptance; no automatic elevation or re-request now | AF-DP-01, AF-NODE-01 | Open; deferred validation, no task block | +| AR-22 | MR-15: establish the cause of the historical Windows crash-test all-sealed-values-unavailable observation and a discriminating repair if required | Original failure lacks the unsealing reason; current crash tests use isolated file-backed keys and cannot validate the historical Credential Manager path | Existing or naturally recurring nonsecret diagnostic, or separately owner-authorized causal evidence; MR-16 real-store cleanup/stress prohibition stays in force, no new real-store operation authorized | AF-NODE-02 | Open; unresolved observation, deferred validation, no task block | ## 2. Human prerequisites @@ -139,3 +140,23 @@ ArcForges' adoption of the producer version is MR-43. See [MR-12 evidence](maint Residual risk: no retained run proves the actual ordinary-node/elevated-client peer-resolution/refusal combination. Close only with that two-process evidence and review of the observed result. AR-02 second-account isolation and the deferred positive auto-start leg remain separate and open; this entry neither proves nor changes them. + +### AR-22: MR-15 historical sealed-input loss + +The historical Windows CrashConsistencyTests(420) observation remains unresolved, not repaired or validated. +[MR-15 evidence](maintenance/2026-10-26-mr15-observation.md) records the original PR, backend change, audit scope and limits. +The current file-backed isolated crash tests and their passing profiles do not validate the former real Credential Manager path. +No current task or maintenance dependency is blocked by this entry. + +Procedure if existing evidence is supplied or a natural recurrence is observed during otherwise authorized work: +1. Preserve the original output and UTC times before retry/reset. Record the source/binary revision, test scenario, acknowledgement + count, backend and isolation mode from existing diagnostics. Keep UnavailableReason and case outcome, never key/environment values. +2. Classify the actual diagnostic: unrecorded/missing/unreadable/wrong-length key, changed backend, purge, or authentication mismatch. + An unavailable result alone proves none of these causes. Preserve the original relation between writer, kill and reopening reader. +3. Do not run the old concurrent Windows/WSL scenario, change assertions/retries, select a real OS store, set its opt-in, run its tier, + list/read back/delete credentials or credential files, or start a real-store stress batch. MR-16 and the retained recovery proposal + remain controlling. This procedure grants no additional host, credential or test authorization. +4. A real-store experiment would need separate explicit owner authorization and a reviewed isolated venue/procedure; do not request + or start one automatically. Existing nonsecret evidence may instead establish the cause without such an experiment. +5. Close only with a proven cause, a discriminating regression and reviewed repair when required, and the owning repository's final + pushed-head native checks. Additional silent or isolated passing runs alone never close this entry. diff --git a/delivery-graph.json b/delivery-graph.json index 4e81f4f..406f821 100644 --- a/delivery-graph.json +++ b/delivery-graph.json @@ -774,7 +774,9 @@ "none" ], "future_validation": [], - "acceptance_register": [], + "acceptance_register": [ + "AR-22" + ], "human_prerequisites": [], "risks": [ { @@ -794,7 +796,7 @@ } ], "size": "M", - "notes": "", + "notes": "MR-15 remains an unresolved historical real-store observation; AR-22 owns the nonsecret evidence/causal closure procedure. Routine isolated-backend passes do not establish its cause. MR-16 real-store cleanup/stress prohibition remains; no new real-store experiment or task activation is authorized.", "blocked_by": [], "evidence": { "prs": [ diff --git a/ledger/ledger.jsonl b/ledger/ledger.jsonl index 620318b..d93ae28 100644 --- a/ledger/ledger.jsonl +++ b/ledger/ledger.jsonl @@ -146,3 +146,4 @@ {"at": "2026-10-25T23:52:51Z", "task": "AF-SEC-01", "kind": "note", "text": "MR-105: AR-19 successful Windows adoption remains Open/deferred. On the current native workstation all three lifecycle adoption candidates created through WMI were already in a job and refused; the fourth test is Linux-only. Final author mode counts are 0 executed/4 skips for JIT and native-helper, never a successful adoption claim. Extend the existing user-provided outside-every-job venue procedure with CancellingAnAdoptionJournalsStoppingBeforeItsFinalResult: actual initial RUNNING/no previous states, one STOPPING despite repeated cancels, FINISHED CANCELLED/HAPPENED/no exit code, no adopted FINALIZING and the same real journal's managed-attempt guards. Linux current-venue adoption4/4 JIT/native-helper passed separately; it does not close Windows acceptance. No new provisioning request or feature activation; MR-16 remains blocked."} {"at": "2026-10-26T00:47:34Z", "task": "AF-NODE-02", "kind": "note", "text": "MR-13 fixed (original ledger26 item3): Design#33 merged as 6358f94ebf32f4e2968d591413d86f5e2939decc before ArcForges#55 merged as 448e28dc247fb4234607cc4e811f3723f53e9b31; reviewed final head fcd99c085bb8b5bba44e4be4cb43d97fc147979e, tree 5517871c08c62ec72e659a37ddf014cadc51caa3, base 54e0809. Design complete native Windows3/25s, Linux3/46s; source complete native Windows13/1135s and Linux16/1355s, all results and exact-head statuses read with fresh main/head/tree. Retained backups never carry sealed task input: sanitize new copies before publish and older copies before open, reuse tombstones, compact/check integrity, fail closed on corrupt/locked/unreadable copies; records/names/schema/live retention/key remain. Restored sealed inputs require new submission. Real SQLite/GCM before 5 failures/0 skips each native host (test exit2), final fixed regressions5/5 both; full affected store project Windows93-pass/2-platform-skips of95 and Linux92-pass/3-platform-skips of95; Host and Bench AOT zero warnings/errors both. Initial CS0111 duplicate-constructor compile-only failure removed, existing constructor reused; no weakened assertion. External key backend is isolated under policy, never real OS-store stress/credential/orphan-file operation; no new or deployed database schema migration, enum/RPC/package change, node-key deletion/rotation or later feature. Exact-head direct self-review by OpenAI Codex alone, no other model/agent. MR-16 blocked and MR-14 remains next separate page/WAL audit. See maintenance/2026-10-26-mr13-validation.md."} {"at": "2026-10-26T02:12:43Z", "task": "AF-NODE-02", "kind": "note", "text": "MR-14 fixed: Design#34 merge 3df9db7946e9af6fd1e43f97216adfc44fd55507 before ArcForges#56 merge 5fa2ad5fe77bef791b96db11129b3851fe55c940, reviewed head 0d261bbe1d48f3c1e9848c15f32a26132cf030da. Existing secure_delete plus manual post-commit/replay WAL TRUNCATE and periodic zero-new-row retry; busy/failed manual checkpoint returns existing INTERNAL/internal, effect HAPPENED, no rollback/dedup rewrite. Real before 6 failures per native host, after all 6 own-platform regressions pass; full Store Windows95/97 (2 platform skips), Linux94/97 (3), affected AOT zero warnings/errors. Final complete Windows13/1148s and Linux16/1364s passed at exact head; Design Windows3/15s Linux3/34s. Evidence maintenance/2026-10-26-mr14-validation.md. Direct work/review by OpenAI Codex alone. No new schema migration, restricted credential operation or task activation. MR-16 remains blocked; MR-07 and MR-11 deferred/unresolved. Owner's 2026-10-26 instruction: finish MR-14 then stop for context adjustment to 872000; MR-15 remains next and unstarted. Current handoff maintenance/2026-10-26-handoff.md; 35 disposed,67 open,2 deferred,1 blocked of105. Design#35 merge 2d9995e78c4aa0f6327371ab0b5639857718da5c resolved the common idempotency-summary review finding before source merge; native full Windows3/26s Linux3/45s passed, no source/profile input change."} +{"at": "2026-10-26T02:27:22Z", "task": "AF-NODE-02", "kind": "note", "text": "MR-15 audited, unresolved/deferred AR-22, not fixed or validated: ArcForges#12 original Windows/WSL-concurrent CrashConsistencyTests(420) all20 unavailable has no retained unsealing reason; historical Windows selected real Credential Manager, whereas 6978b0c moved writer/reopen to file-backed isolated keys. Read-only Windows audit1940 text logs/11920238bytes across88 run directories/86 summaries (70win,16legacy host-unspecified;75success,11other) found only6 explicit isolated case passes, no original failure/cause; no read errors or size skips. Audit ba16cbe71de88665228e807460632a52c1915591f5d42fe36d28e6cd96f8c0c4. Existing native source profiles and isolated Store passes do not prove the old real-store path. Evidence maintenance/2026-10-26-mr15-observation.md, owning AF-NODE-02 AR-22 closure requires actual nonsecret causal evidence, no new OS-store operation/stress/cleanup authorized. MR-16 remains blocked; no runtime/Design patch, assertion relaxation, real-store test, migration or task-state activation. Owner resumed on2026-10-26 and requests remaining counts after each item:35 disposed,66open,3deferred,1blocked of105;70 unresolved total. Next MR-17, skip blocked MR-16. Direct OpenAI Codex work/review only."} diff --git a/maintenance/2026-10-24-repair-list.md b/maintenance/2026-10-24-repair-list.md index 5bc5260..fe10708 100644 --- a/maintenance/2026-10-24-repair-list.md +++ b/maintenance/2026-10-24-repair-list.md @@ -52,7 +52,7 @@ managed tasks, no option that disables protection to enable elevation. The stop |---|---|---|---|---|---|---| | MR-13 | Pre-migration backups (`records/backups`, last 3) keep `task_secret` values after the task's secrets are purged (R-EXE-017 / 04 §2 vs 13 §6). | 26 (3) | Design, ArcForges | 02 §2 step 3, 13 §6, node-store.md; no backup handling in the purge *(confirm)* | fix: Design states that a purge also removes the values from every retained backup (or that backups never carry them), and the node does so; regression test | fixed: Design#33 (merge 6358f94; native full Windows3/25 s, Linux3/46 s) before ArcForges#55 (merge 448e28d, reviewed head fcd99c0; native full Windows13/1135 s, Linux16/1355 s); all retained copies exclude sealed input, new copies before publish and older copies before open, fail closed on inability; real before 5 failures/0 skips each host, after 5/5 each and full store Windows93-pass/2-skip, Linux92-pass/3-skip; real restore with original isolated key backend, names/nonsecret records/schema/live retention preserved; no new/deployed schema migration or restricted credential operation; MR-14 separate; [validation](2026-10-26-mr13-validation.md); ledger AF-NODE-02 note | | MR-14 | Deleted sealed values may stay readable in free pages of the store file after a purge. | 26 (3) (same retention concern) | ArcForges | *(confirm `secure_delete` or equivalent)* | fix if confirmed (same Design statement as MR-13); else resolved with evidence | fixed: Design#34 (merge 3df9db7; native full Windows3/15 s, Linux3/34 s) before ArcForges#56 (merge 5fa2ad5, reviewed head 0d261bb; native full Windows13/1148 s, Linux16/1364 s); existing secure_delete retained, manual post-commit/replay TRUNCATE checkpoint with known-HAPPENED error when busy/failed, and periodic zero-new-row retry; real before 6 failures per host, after 6 own-platform regressions pass per host, full Store Windows95-pass/2-skip and Linux94-pass/3-skip of97; [validation](2026-10-26-mr14-validation.md); ledger AF-NODE-02 note; owner requested stop after this item, MR-15 unstarted; common replay summaries aligned by Design#35 (merge 2d9995e, Windows3/26s Linux3/45s) before source merge | -| MR-15 | `CrashConsistencyTests.AStoreKilledDuringWritesReopensConsistent(420)` once saw every sealed value unavailable after a kill and reopen. | ArcForges#12 follow-up | ArcForges | Not reproduced; the test prints `UnavailableReason` *(confirm against host logs)* | fix if a cause is found; otherwise reported with evidence (no claim of resolution) | open | +| MR-15 | `CrashConsistencyTests.AStoreKilledDuringWritesReopensConsistent(420)` once saw every sealed value unavailable after a kill and reopen. | ArcForges#12 follow-up | ArcForges | Not reproduced; the test prints `UnavailableReason` *(confirm against host logs)* | fix if a cause is found; otherwise reported with evidence (no claim of resolution) | deferred validation (AR-22), unresolved: original Windows real-store failure has no retained cause; current crash test/benchmark use file-backed isolated keys since 6978b0c, so later passes cannot validate the historical Credential Manager path; read-only audit 1940 logs/88 run directories found six explicit isolated case passes and no original failure diagnostic; no new runtime/stress run or repair claimed; [observation](2026-10-26-mr15-observation.md); ledger AF-NODE-02 note | | MR-16 | Historical records from 2026-10-17 report 746 stress-generated Windows credentials and about 5,990 orphan credential files; current counts have not been inspected. Cleanup stopped by the owner's decision of 2026-10-18. | 39 (7), 40 | none (workstation) | Records only; no store access in this pass | blocked: the owner's decision on the recovery proposal in the final report | blocked: owner's stop of 2026-10-18 reaffirmed on 2026-10-25; recovery proposal retained; no real Credential Manager cleanup, orphan credential-file operations or real-store stress | ## 4. Resource-limit enforcement and failure classification diff --git a/maintenance/2026-10-25-handoff.md b/maintenance/2026-10-25-handoff.md index a67631f..6c6e287 100644 --- a/maintenance/2026-10-25-handoff.md +++ b/maintenance/2026-10-25-handoff.md @@ -1,4 +1,4 @@ -> Superseded operational state and continuation instruction: see [2026-10-26 handoff](2026-10-26-handoff.md). The latest owner instruction is to finish MR-14 and STOP; MR-15 is unstarted. Refresh all refs and host state before resuming. +> Superseded operational state and continuation instruction: see [2026-10-26 handoff](2026-10-26-handoff.md). The owner resumed maintenance on 2026-10-26 and requests remaining counts after every item. Refresh refs and host state; MR-16 remains blocked. # Maintenance pass: session handoff, 2026-10-25 diff --git a/maintenance/2026-10-26-handoff.md b/maintenance/2026-10-26-handoff.md index 54c756b..cf5e9f7 100644 --- a/maintenance/2026-10-26-handoff.md +++ b/maintenance/2026-10-26-handoff.md @@ -2,14 +2,15 @@ ## Latest owner instruction -Finish the current item, MR-14, including verification, merge and records, then STOP so the owner can adjust context to -872000. MR-14 is complete. Do not start MR-15 or continue automatically. A later explicit owner resume can continue -the authorized maintenance list from MR-15. Do not start AF-REC-01 or later features. +On 2026-10-26 the owner resumed the authorized maintenance list after adjusting context and asked for the remaining +counts after every item. Continue serially from MR-15, completing each item's review, required native checks, merge, +maintenance list and CLI ledger record before reporting the new counts and automatically continuing. +This supersedes the temporary finish-MR-14-and-stop instruction. Work alone; do not start AF-REC-01 or later features. This supersedes the resumption instruction and stale operational state in the [2026-10-25 handoff](2026-10-25-handoff.md). Scope/order and current dispositions are in the [repair list](2026-10-24-repair-list.md); read the append-only ledger too. -## Completed current item +## Completed MR-14 and current maintenance position - MR-14: [Design#34](https://github.com/ArcForges/ArcForges-Design/pull/34), merge 3df9db7946e9af6fd1e43f97216adfc44fd55507, precedes [ArcForges#56](https://github.com/ArcForges/ArcForges/pull/56), merge 5fa2ad5fe77bef791b96db11129b3851fe55c940. @@ -28,12 +29,13 @@ Scope/order and current dispositions are in the [repair list](2026-10-24-repair- ## Remaining and boundaries -105 list items: 35 disposed, 67 open, 2 deferred, 1 blocked. MR-15 is next, not started: investigate the historical -CrashConsistencyTests(420) all-secrets-unavailable observation from retained logs/UnavailableReason; nonrecurrence does -not establish its cause or a repair. Do not repeat a timed-out launch without checking logs/processes/products first. +105 list items: 35 disposed, 66 open, 3 deferred, 1 blocked: 70 unresolved total. +MR-15 has been audited and recorded as unresolved/deferred AR-22, never repaired or passed; see +[the observation](2026-10-26-mr15-observation.md). Current isolated-key passes cannot validate its historical real-store cause. +MR-17 is next eligible; MR-16 keeps its existing block. Check actual logs/processes/results before retrying a timed-out launch. MR-16 stays blocked: no real Windows Credential Manager cleanup/stress or orphan credential-file operations; preserve -the recovery proposal. MR-07/AR-20 and MR-11/AR-21 stay unresolved/deferred. Other acceptance-register limitations, +the recovery proposal. MR-07/AR-20, MR-11/AR-21 and MR-15/AR-22 stay unresolved/deferred. Other acceptance-register limitations, including successful real Windows adoption AR-19, remain. No LAN/cloud MCP implementation or new/deployed DB migration. ## Resume safely @@ -46,7 +48,7 @@ Primary checkouts intentionally remain stale; use fresh origin/main and task wor Windows source worktree: ArcForges/.worktree/mr-14 (clean detached final head). Linux source worktree: ArcForges/.worktree/mr-14 (task/mr-14, clean final head). -Plan reusable Windows worktree: Plan/.worktree/maintenance-resume-2026-10-25, branch plan/maintenance-mr14-purge-erasure. +Plan reusable Windows worktree: Plan/.worktree/maintenance-resume-2026-10-25, branch plan/maintenance-mr15-observation. Formal logs remain under each repository's .git/arcforges-verify/logs; mr14-* wrapper logs are in the hosts' dev/logs or logs. Never terminate the Linux user systemd manager, use pkill -f or daemon-reload. Keep formal hosts free of competing tests. Work alone under the owner's instruction; use truthful OpenAI Codex attribution and direct review. diff --git a/maintenance/2026-10-26-mr15-observation.md b/maintenance/2026-10-26-mr15-observation.md new file mode 100644 index 0000000..94e017b --- /dev/null +++ b/maintenance/2026-10-26-mr15-observation.md @@ -0,0 +1,71 @@ +# MR-15: historical sealed-input loss remains unresolved + +Date: 2026-10-26. Disposition: deferred validation / unresolved observation, AR-22. No runtime repair or real-store +validation pass is claimed. The owner resumed the authorized maintenance list after MR-14 and requested remaining +counts after every completed item; this record supersedes the temporary stop instruction in the earlier handoff. + +## Historical evidence and changed test venue + +[ArcForges#12](https://github.com/ArcForges/ArcForges/pull/12), historical head f5c622d94b145d3d62aad1884f8db4ae983f8467, +records one Windows ci failure while Windows and WSL ci ran concurrently, iteration 4 of 10: +CrashConsistencyTests.AStoreKilledDuringWritesReopensConsistent(420) found all 20 sampled sealed values UNAVAILABLE. +It does not record which key-load or authentication failure occurred. Commit c358e2d added UnavailableReason to the +assertion afterwards. The PR review comment does not add a cause or original raw diagnostic. + +At that historical head, TestSecretStores.Select on Windows selected the real Credential Manager; the benchmark also +used that selection. Commit 6978b0c5cf4723ca562907dda7d300fb1c53caf8 (2026-10-18) moved both the writer and the +reopening crash test to NodeSecretStores.ForTestDataRoot, a private file-backed isolated key store. Production still uses +its selected backend. This change isolates routine tests; it does not establish or repair the historical real-store cause. +The old concurrent Windows/WSL run was not resumed. Current verification uses only native MCP hosts, never WSL. + +## Read-only retained-log audit + +Windows MCP audit at 2026-10-26T02:25:06.595092+00:00: +- 88 formal run directories, 86 readable summaries: 70 explicitly win and 16 legacy summaries without a host field. + 75 summaries say success and 11 say otherwise; failed/incomplete or host-unspecified records are not fresh native passes. +- 1,940 retained text log files, 11,920,238 bytes; no read errors or size-limit skips. Limits: 32 MiB per file, 512 MiB total. +- Scope: ArcForges .git/arcforges-verify/logs step logs, registered source worktrees' artifacts/test-logs, and + C:/MyFile/Projects/dev/logs plus its immediate child log directories. No credential-store/data-root/key-file content. +- Summary timestamps span 2026-10-22T09:12:32Z through 2026-10-26T02:10:17Z. These runs postdate the original observation. +- Exactly six explicit case mentions/outcomes: acknowledgements 25,160,420 in mr13-author2.out and mr14-author.out; + all six passed. Neither failed-case markers nor nearby unavailable diagnostic candidates were found in those mentions. +- The original raw failure was not found in this bounded scope. This does not assert that it exists nowhere. + Many retained formal logs summarize projects without individual passed-case names; file/run counts are not test counts + or proof that each run reached the original scenario. +- The first audit matched the current test-output format; a second audit also inspected every CrashConsistencyTests + mention for alternate failure markers/nearby unavailable context. Both are read-only, not fresh crash/stress batches. + +Scripts/output: C:/MyFile/Projects/dev/logs/mr15-audit.py/.ps1/.out/.err/.exit, mr15-audit2-edit.py, +mr15-audit2.py/.out/.err, mr15-audit2-inspect.exit and the two JSON manifests. +Final audit JSON SHA-256: ba16cbe71de88665228e807460632a52c1915591f5d42fe36d28e6cd96f8c0c4. +Initial audit JSON SHA-256: 3be003d79b601c7f8928495bfdf40488a486e114e9a30d71705daf7891f53cb4. + +## Current evidence and diagnostic boundary + +Fetched source main 5fa2ad5fe77bef791b96db11129b3851fe55c940 has the same tree +852d5472ff079f9df9debe57a1a3329f8bc0faf9 as reviewed head 0d261bbe1d48f3c1e9848c15f32a26132cf030da. +The MR-14 complete native profiles already passed at that exact code tree: Windows13/1148 s, Linux16/1364 s. +MR-14 author full Store tests passed Windows95/97 (2 platform skips) and Linux94/97 (3), with crash cases25/160/420 +explicitly passed on each host. Linux retained mr14-author.out contains those three results too. +This is existing isolated-backend evidence, not a new MR-15 reproduction or real Credential Manager validation. + +CrashConsistencyTests still demands every sampled sealed value be available after kill/reopen and prints +UnavailableReason on failure. TaskSecrets/NodeDataKeyRing distinguish a missing/unrecorded/unreadable/wrong-length key, +a changed backend, purge and AES-GCM authentication mismatch. No assertion, timeout, retry policy, key generation, +read-back policy or guard was weakened or changed. No source/Design/runtime patch was justified by this audit. +All 20 being unavailable alone cannot choose between the failure categories or prove a lost key write. + +## Remaining obligation and authorization + +AR-22 records a closure rule requiring a proven cause and discriminating regression/repair where applicable; more +isolated passing runs cannot close it. Capture an existing or naturally recurring failure's nonsecret diagnostic before +any retry/reset, identify the exact binary/commit/backend/isolation mode and preserve the original output. Do not print +key or environment values. No new OS-store call, listing, read-back, opt-in, tier run, cleanup or stress is authorized. +MR-16 remains blocked with its recovery proposal; no original real-store stress is repeated. Any future real-store +experiment needs separate explicit owner authorization and an approved isolated venue; none is proposed for execution now. +This entry blocks no other maintenance task and changes no delivery state. AF-NODE-02 owns its record. + +Maintenance counts after this disposition: 105 total, 35 disposed, 66 open, 3 deferred-validation items +(MR-07/AR-20, MR-11/AR-21, MR-15/AR-22), 1 blocked (MR-16): 70 still unresolved in total. +Next eligible maintenance item is MR-17; skip MR-16 under its existing block. AF-REC-01/later features remain unstarted. +All analysis and direct record review are by OpenAI Codex alone under the owner's no-other-model/agent instruction.