docs: record MR-18 verification and stop after this item

ledger/ledger.jsonl

@@ -148,3 +148,5 @@
 {"at": "2026-10-26T02:12:43Z", "task": "AF-NODE-02", "kind": "note", "text": "MR-14 fixed: Design#34 merge 3df9db7946e9af6fd1e43f97216adfc44fd55507 before ArcForges#56 merge 5fa2ad5fe77bef791b96db11129b3851fe55c940, reviewed head 0d261bbe1d48f3c1e9848c15f32a26132cf030da. Existing secure_delete plus manual post-commit/replay WAL TRUNCATE and periodic zero-new-row retry; busy/failed manual checkpoint returns existing INTERNAL/internal, effect HAPPENED, no rollback/dedup rewrite. Real before 6 failures per native host, after all 6 own-platform regressions pass; full Store Windows95/97 (2 platform skips), Linux94/97 (3), affected AOT zero warnings/errors. Final complete Windows13/1148s and Linux16/1364s passed at exact head; Design Windows3/15s Linux3/34s. Evidence maintenance/2026-10-26-mr14-validation.md. Direct work/review by OpenAI Codex alone. No new schema migration, restricted credential operation or task activation. MR-16 remains blocked; MR-07 and MR-11 deferred/unresolved. Owner's 2026-10-26 instruction: finish MR-14 then stop for context adjustment to 872000; MR-15 remains next and unstarted. Current handoff maintenance/2026-10-26-handoff.md; 35 disposed,67 open,2 deferred,1 blocked of105. Design#35 merge 2d9995e78c4aa0f6327371ab0b5639857718da5c resolved the common idempotency-summary review finding before source merge; native full Windows3/26s Linux3/45s passed, no source/profile input change."}
 {"at": "2026-10-26T02:27:22Z", "task": "AF-NODE-02", "kind": "note", "text": "MR-15 audited, unresolved/deferred AR-22, not fixed or validated: ArcForges#12 original Windows/WSL-concurrent CrashConsistencyTests(420) all20 unavailable has no retained unsealing reason; historical Windows selected real Credential Manager, whereas 6978b0c moved writer/reopen to file-backed isolated keys. Read-only Windows audit1940 text logs/11920238bytes across88 run directories/86 summaries (70win,16legacy host-unspecified;75success,11other) found only6 explicit isolated case passes, no original failure/cause; no read errors or size skips. Audit ba16cbe71de88665228e807460632a52c1915591f5d42fe36d28e6cd96f8c0c4. Existing native source profiles and isolated Store passes do not prove the old real-store path. Evidence maintenance/2026-10-26-mr15-observation.md, owning AF-NODE-02 AR-22 closure requires actual nonsecret causal evidence, no new OS-store operation/stress/cleanup authorized. MR-16 remains blocked; no runtime/Design patch, assertion relaxation, real-store test, migration or task-state activation. Owner resumed on2026-10-26 and requests remaining counts after each item:35 disposed,66open,3deferred,1blocked of105;70 unresolved total. Next MR-17, skip blocked MR-16. Direct OpenAI Codex work/review only."}
 {"at": "2026-10-26T03:23:31Z", "task": "AF-EXEC-01", "kind": "note", "text": "MR-17 fixed: Design#36 merge9da4127003a90842ddafeb03a6f07e7c5877f34c before ArcForges#57 merge852d23d8b4daca78cef509cb7a6925b18795b6b1, reviewed head92235c31a30d7434a3abe78c09083c3bd507bf9e/tree8013bd2effc7df38b2c14000b073f2a5f643ccd0. Holder retains job_memory from own durable peak above actual enabled notification threshold after released-memory/query sequence; nonzero-exit condition and original hard fallback remain, not proof of allocation refusal. Initial4/4 and5/5 diagnostic batches retained; discriminating before9ec4939 two recovery reason failures plus3 controls, no skips,13.413s. Final author Windows new5/5 JIT+5/5 AOT holder, TaskControl15/15,Job8/8,Repo72/72,HostAOT0warnings/errors; LinuxRepo72/72,pureformat14/14,HostAOT0warnings/errors. Full final pushed-head Windows13/1163s and Linux16/1364s passed, all results/statuses read; Design Windows3/12s Linux3/45s. Evidence maintenance/2026-10-26-mr17-validation.md. Direct OpenAI Codex work/review alone; no new schema migration, real credential operation, altered assertions/steps, old-head pass or later task activation. MR-16 blocked;MR-07/11/15 deferred. Counts36 disposed,65open,3deferred,1blocked of105;69 unresolved total. Report counts and continue MR-18 under owner's resumed authorization."}
+{"at": "2026-10-26T05:05:10Z", "task": "AF-EXEC-01", "kind": "note", "text": "MR-18 fixed: Design#37 merge973934c658f62967be4b6cc40d0526d877ee4383 before ArcForges#58 mergea4c1b2bf1b8afd0112fb490aa590c3ac8199ac96, final reviewed head15d6717144468ce0be615e8538f858d29b0fed7d/treefed15ef1b4251c08d8bd48afcfe32b2530570e06. Own-job notification/peak or hard-limit peak evidence gates memory packets; qualifier leaves allocation refusal unproven; MR-17 comparisons preserved/shared. Before detail3 failures/2controls plus actual kernel hard packet10 on real shared port wrongly own hit=True (own peak117784576<268435456), not the three default-forwarding prerequisite timeouts. fa6f836 authors memory5+1 JIT and5+1 AOT holder passed; final delta only fairness isolation/comment, no src/tools/eng runtime change. fa6f836 Windows full CI failed timed share65.3948% despite6:6 starts; standalone50.5%, new-head50.9%; existing exclusive policy applied without changing assertions/timeouts/loads/algorithm. Final complete Windows13/1140s and Linux16/1382s passed at final head; all results/statuses read; Design Windows3/12s Linux3/44s. Partial Linux launcher/controller run and old-head results retained, never final status substitutes. Evidence maintenance/2026-10-26-mr18-validation.md. Direct OpenAI Codex work/review alone. No new schema/RPC/key/credential operation or task activation. MR-16 blocked;MR-07/11/15 deferred. Owner says finish MR-18 then STOP, MR-19 unstarted. Counts37 disposed,64open,3deferred,1blocked of105;68 unresolved total."}
+{"at": "2026-10-26T05:05:10Z", "task": "AF-SCHED-01", "kind": "note", "text": "MR-18 required-gate fixture follow-up (not a scheduler algorithm change): TwoSessionsShareAdmissionsEquallyOnWindows failed fa6f836 parallel CI at65.3948% running slot-time share while starts6:6. Source records include launch/finalization timing for300ms holds, so the prior independence comment was false and both OS wrappers violated existing timing-sensitive exclusive policy. One unchanged fa6f836 standalone check passed50.5%; final15d6717 standalone passed50.9%,6:6. Add isolation=exclusive and DisableParallelization to both wrappers; retain40-60%,5-7 starts,12tasks/session,300ms holds,180s timeout and all assertions; CI+exclusive retains coverage. Final source#58 mergea4c1b2bf1b8afd0112fb490aa590c3ac8199ac96, full Windows13/1140s/Linux16/1382s passed at15d6717144468ce0be615e8538f858d29b0fed7d. No new AF-SCHED-01 feature/scope/state, no weakened gate or old-head status reuse. Owner stop after MR-18 remains controlling. Evidence maintenance/2026-10-26-mr18-validation.md."}

maintenance/2026-10-24-repair-list.md

@@ -60,7 +60,7 @@ managed tasks, no option that disables protection to enable elevation. The stop
 | ID | Issue | Ledger | Repos | Evidence | Proposed disposition | Status |
 |---|---|---|---|---|---|---|
 | MR-17 | Windows: an attempt that crossed `mem_ceiling` while the node was down is classified EXITED, not MEMORY_LIMIT (the exit record's violation query reads the job state at exit, empty once memory is released). | 39 (2); ArcForges#12 | Design, ArcForges | ArcForges#12 open question (3 workstation runs) | fix: the holder records the job's peak against the notification limit; Design 04 §7 states the node-gap rule | fixed: Design#36 (merge9da4127; native full Windows3/12s,Linux3/45s) before ArcForges#57 (merge852d23d, reviewed head92235c3; native full Windows13/1163s,Linux16/1364s); durable peak compared with actual enabled notification threshold preserves job_memory after post-release queries; nonzero-exit guard/hard fallback retained, no allocation-refusal guarantee; real before2 failures/3 controls, after JIT5/5 and AOT holder5/5; [validation](2026-10-26-mr17-validation.md); ledger AF-EXEC-01 note |
-| MR-18 | MEMORY_LIMIT is recorded for a non-zero exit after the commit notification at `mem_ceiling` with no allocation refused, and when a workload's own nested job reports a limit. | 55 (1) | Design, ArcForges | *(confirm in the classification code)* | fix: classification follows the specified evidence; Design states it | open |
+| MR-18 | MEMORY_LIMIT is recorded for a non-zero exit after the commit notification at `mem_ceiling` with no allocation refused, and when a workload's own nested job reports a limit. | 55 (1) | Design, ArcForges | `JobObject.HasOwnMemoryLimitEvidence`, `WindowsAttemptHandle.OnJobMessage`, `ExecutionSupervisor.Outcome`; real shared-port packet regression and own-job detail cases | fix: classification follows the specified evidence; Design states it | fixed: Design#37 (merge973934c; native full Windows3/12s,Linux3/44s) before ArcForges#58 (mergea4c1b2b, reviewed final head15d6717; native full Windows13/1140s,Linux16/1382s); own-job evidence required for packet attribution, detail explicitly leaves allocation refusal unproven; before Core3 failures/2 controls plus actual shared-port hard-packet failure, after6 JIT+6 AOT-holder checks pass; default-forwarding prerequisite timeouts not counted as defect/pass; failed fa6f836 Windows timing-share gate diagnosed and existing exclusive policy applied with all bounds unchanged; [validation](2026-10-26-mr18-validation.md); ledger AF-EXEC-01 and AF-SCHED-01 notes; owner requests stop here,MR-19 unstarted |
 | MR-19 | `windows_status` labels every code at or above 0xC0000000 as NTSTATUS, including customer-bit codes (0xE0434352, 0xE0000008). | 55 (2), 63 | ArcForges, Design | `ExecutionSupervisor.cs` 1994 | fix: customer-bit codes are application codes (not NTSTATUS); Design and node agree | open |
 | MR-20 | OOM_KILLED says "killed at its memory limit" for four causes (its own MemoryMax, the slice's, a machine OOM, systemd-oomd). | 56 (1) | Design, ArcForges | *(confirm)* | fix: classify from `memory.events.local` of the attempt and the slice and systemd-oomd's attribute; detail names the cause | open |
 | MR-21 | The Critical pressure level reacts to any OOM kill, including an attempt's kill at its own ceiling (the machine-wide count). | 58 (1), 57 (5) | Design, ArcForges | `PressureEvaluator` uses the machine-wide `OomKills` | fix: kills inside an attempt at its own limit do not raise Critical; Design 03 §5.4 states it | open |

maintenance/2026-10-25-handoff.md

@@ -1,4 +1,4 @@
-> Superseded operational state and continuation instruction: see [2026-10-26 handoff](2026-10-26-handoff.md). The owner resumed maintenance on 2026-10-26 and requests remaining counts after every item. Refresh refs and host state; MR-16 remains blocked.
+> Superseded operational state and continuation instruction: see [2026-10-26 handoff](2026-10-26-handoff.md). The latest owner instruction is to finish MR-18 and STOP; MR-19 is unstarted. Refresh all refs/host state on any later explicit resume. MR-16 remains blocked.
 
 # Maintenance pass: session handoff, 2026-10-25
 

maintenance/2026-10-26-handoff.md

@@ -2,15 +2,15 @@
 
 ## Latest owner instruction
 
-On 2026-10-26 the owner resumed the authorized maintenance list after adjusting context and asked for the remaining
-counts after every item. Continue serially in maintenance priority order, completing each item's review, required native checks, merge,
-maintenance list and CLI ledger record before reporting the new counts and automatically continuing.
-This supersedes the temporary finish-MR-14-and-stop instruction. Work alone; do not start AF-REC-01 or later features.
+On 2026-10-26 the owner asked to finish the current item MR-18, including validation, merge and records, then STOP.
+MR-18 is complete. Do not start MR-19 or continue automatically. A later explicit owner resume may continue the authorized
+maintenance list from MR-19. Report the remaining counts at this stopping point. Do not start AF-REC-01 or later features.
+This supersedes the earlier resumed continuous-execution instruction and keeps all existing safety/scope boundaries.
 
 This supersedes the resumption instruction and stale operational state in the [2026-10-25 handoff](2026-10-25-handoff.md).
 Scope/order and current dispositions are in the [repair list](2026-10-24-repair-list.md); read the append-only ledger too.
 
-## Completed MR-14 and MR-17; current maintenance position
+## Completed repairs and current stopping point
 
 - MR-14: [Design#34](https://github.com/ArcForges/ArcForges-Design/pull/34), merge 3df9db7946e9af6fd1e43f97216adfc44fd55507,
   precedes [ArcForges#56](https://github.com/ArcForges/ArcForges/pull/56), merge 5fa2ad5fe77bef791b96db11129b3851fe55c940.
@@ -27,7 +27,7 @@ Scope/order and current dispositions are in the [repair list](2026-10-24-repair-
 
 - Additional [Design#35](https://github.com/ArcForges/ArcForges-Design/pull/35), merge 2d9995e78c4aa0f6327371ab0b5639857718da5c, aligned AD-0004 and the common replay summary before source merge; both native full legs passed (Windows 3/26 s, Linux 3/45 s). That was the Design context used by the MR-14 record; current verification fetches Design main afresh.
 
-## Latest completed repair: MR-17
+## Prior completed repair: MR-17
 
 [Design#36](https://github.com/ArcForges/ArcForges-Design/pull/36) merge9da4127003a90842ddafeb03a6f07e7c5877f34c
 precedes [source#57](https://github.com/ArcForges/ArcForges/pull/57) merge852d23d8b4daca78cef509cb7a6925b18795b6b1.
@@ -37,14 +37,27 @@ native full Windows13/1163s and Linux16/1364s passed at that head.
 before2-fail/3-control and after JIT/AOT-holder5/5 cases. Current job notification threshold, strict peak crossing and
 nonzero-exit condition; no hard-allocation-refusal proof, new schema/key operation or later feature.
 The owning AF-EXEC-01 completion note is appended only through Plan CLI after source merge.
-MR-18 correlated/nested-limit classification/detail remains next; MR-16 and AR-20/21/22 remain unchanged.
+MR-18 is completed below. MR-16 and AR-20/21/22 remain unchanged.
+
+## Latest completed repair: MR-18
+
+[Design#37](https://github.com/ArcForges/ArcForges-Design/pull/37) merge973934c658f62967be4b6cc40d0526d877ee4383
+precedes [source#58](https://github.com/ArcForges/ArcForges/pull/58) mergea4c1b2bf1b8afd0112fb490aa590c3ac8199ac96.
+Final reviewed head15d6717144468ce0be615e8538f858d29b0fed7d/treefed15ef1b4251c08d8bd48afcfe32b2530570e06;
+complete native Windows13/1140s,Linux16/1382s passed at that head.
+[Evidence](2026-10-26-mr18-validation.md) separates actual shared-port packet attribution from three default-forwarding
+delivery-prerequisite timeouts, and records the failed fa6f836 Windows fairness gate plus corrected test isolation.
+All fairness bounds remain. Memory-code author fa6f836 results are distinct from final15d6717 gate results.
+The initial malformed Linux launch/partial run and corrected old-head run are retained, not final gating evidence.
+Own-job scope and uncertainty are explicit; no new RPC/schema/key operation or feature. CLI notes on AF-EXEC-01 and
+AF-SCHED-01 follow actual source merge. MR-19 is next and unstarted; STOP under the owner's latest instruction.
 
 ## Remaining and boundaries
 
-105 list items: 36 disposed, 65 open, 3 deferred, 1 blocked: 69 unresolved total.
+105 list items: 37 disposed, 64 open, 3 deferred, 1 blocked: 68 unresolved total.
 MR-15 has been audited and recorded as unresolved/deferred AR-22, never repaired or passed; see
 [the observation](2026-10-26-mr15-observation.md). Current isolated-key passes cannot validate its historical real-store cause.
-MR-18 is next eligible; MR-16 keeps its existing block. Check actual logs/processes/results before retrying a timed-out launch.
+MR-19 is next eligible but unstarted; stop until the owner resumes. MR-16 keeps its existing block. Check actual logs/processes/results before retrying a timed-out launch.
 
 MR-16 stays blocked: no real Windows Credential Manager cleanup/stress or orphan credential-file operations; preserve
 the recovery proposal. MR-07/AR-20, MR-11/AR-21 and MR-15/AR-22 stay unresolved/deferred. Other acceptance-register limitations,
@@ -58,9 +71,9 @@ Refresh GitHub PRs/statuses, git refs, all applicable AGENTS/governance and Desi
 Recorded SHAs and PIDs are historical evidence, never live state. Preserve all worktrees, user changes and ignored caches.
 Primary checkouts intentionally remain stale; use fresh origin/main and task worktrees.
 
-Windows source worktree: ArcForges/.worktree/mr-17 (clean detached final head).
-Linux source worktree: ArcForges/.worktree/mr-17 (task/mr-17, clean final head).
-Plan reusable Windows worktree: Plan/.worktree/maintenance-resume-2026-10-25, branch plan/maintenance-mr17-memory-gap.
-Formal logs remain under each repository's .git/arcforges-verify/logs; mr14-*/mr17-* wrapper logs are in the hosts' dev/logs or logs.
+Windows source worktree: ArcForges/.worktree/mr-18 (clean detached final head).
+Linux source worktree: ArcForges/.worktree/mr-18 (task/mr-18, clean final head).
+Plan reusable Windows worktree: Plan/.worktree/maintenance-resume-2026-10-25, branch plan/maintenance-mr18-memory-scope.
+Formal logs remain under each repository's .git/arcforges-verify/logs; mr14-*/mr17-*/mr18-* wrapper logs are in the hosts' dev/logs or logs.
 Never terminate the Linux user systemd manager, use pkill -f or daemon-reload. Keep formal hosts free of competing tests.
 Work alone under the owner's instruction; use truthful OpenAI Codex attribution and direct review.