v0.13.0 P0 — State Engine V2 T04 with complete Windows crash-durable restore

v0.13.0 Priority 0 — Complete T04 State Engine V2

Product Owner decision: v0.12.0 omits T04, ships with the existing stable snapshot state authority, and gives T04 top priority in v0.13.0. Source: Issue #82. This issue is the v0.13 top-priority release milestone.

In-scope for v0.13.0

State Engine V2 canonical append-only event ledger, index and derived snapshot, migration and idempotent recovery, crash consistency and source-bound evidence.
Full Windows legacy-backup restore/recovery support remains required, not downgraded or disabled. Resolve the original Windows crash-durability Issue T04 P1: Windows restore-journal deletion must follow durable directory rename #73 (journal durable publication, original displacement, stage promotion, clean acknowledgement, crash recovery and controlled power-loss evidence).
Preserve the v0.12 existing-stable-state compatibility adapter and all public /dk commands during migration.
Independent three-role code, architecture and security review on exact source, issue thread closure, real Windows and Ubuntu CI, deterministic risk-3 acceptance.
Outstanding T04 criteria AC-012, AC-013, AC-014, AC-015 and AC-034 (v0.12 release-scope amendment expressly records these as DEFERRED, not PASS).
T04 PR fix(v0.12 T04): crash-safe event append, process locks and restore confinement #70 remains a development candidate and must not be merged into v0.12.0.

Delivery order

Rebase T04 development on released v0.12.0 source after publication.
Confirm exact supported Windows filesystem/OS durability contract using authoritative evidence and a controlled crash/recovery test environment.
Fix outstanding source defects and run adversarial power-loss/rollback tests.
Obtain authenticated independent role reviews and deterministic T04 ACCEPTED verdict.
Ship only through the version's protected release workflow.

Priority: Blocker / P0 for v0.13.0. Do not close Issue #73 or mark T04 accepted before verified crash-durability evidence.

v0.13 T04 integration-line reconciliation — 30 October 2026

The actual v0.13 implementation candidate is draft PR #92, branch feature/v0.13-state-engine-v2, head 46c4ee630419f1b9d21213d59f759a29c590c943, based on released v0.12.1/main. Historical PR #70 is not the release integration target; draft PRs #94–#98 are source/evidence diagnostics only. PR #92's last exact-head CI #38634328196 failed on both Ubuntu/Windows because a legacy v0.7.1 regression asserted current.json for fresh V2 state.

Created draft, unmerged diagnostic PR #99 to fix the actual v0.13 branch's compatibility regressions test-first. Additional verified failures and narrow candidate fixes include historical legacy fixture seeding (Phase01, lifecycle and Autopilot), H47/H48 durable retained-journal test expectations and native Windows crash hooks, W73-11 terminal journal/root identity false-completion, W73-12 retained original directory witness, W73-13 linked restore-journal external-write vulnerability, and W73-14 cross-project orphan-stage interference. The initial source-bound negative controls are recorded in CI #41008615937, #41008954495 and #41009168048. Latest exact diagnostic head e2ccc6aaf534b75a3f289c802e576c045f534152 has Ubuntu full CI SUCCESS in #41009351540; Windows remains running at this checkpoint. Independent diagnostic code/security/architecture reviews requested on exact source. No code has yet been ported to PR #92; no acceptance, physical power-loss proof, issue closure, mainline merge or release authorization.

Next: obtain Windows green and review findings on #99; port only the verified narrowly scoped source/test corrections to PR #92, run exact-head Ubuntu/Windows full v0.13 regression and independent risk-3 review. Issue #73 physical durability evidence and deterministic ACCEPTED remain mandatory.

30 October 2026 — v0.13 T04 test-first P2 corrections on actual integration PR #92 (NOT ACCEPTED). Exact current head 73603f8a2004100b0fb8e302f89825eecc5638b5, draft/unmerged on released v0.12.1. Two independently reproduced findings and narrow fixes:

Cross-reference leakage via composite index key collisions: valid entity tuples (a::b, c) and (a, b::c) generated identical type::id keys, causing contract/task/run/lifecycle queries to include another entity. Draft diagnostic PR #114 test-only 85a97cfc55e17c3ef36c1364619330f04b73cf0c failed on both Ubuntu/Windows CI #41074686949; a second negative test reproduced unsafe reuse of a stale, hash-matching disposable index CI #41074990296. Correction uses unambiguous JSON tuple keys and validates loaded index semantics against the canonical rebuilt snapshot before serving queries. Diagnostic dbba5619b783f8c2b5451f24766410847728b4e2 passed both full Ubuntu/Windows v0.13 CI jobs #41075160424. Ported only source/test to PR feat(v0.13): State Engine V2 durability and migration #92 57744d530ee38d457dc945d01982c08cd4cacd83, 8dff8e451ab3cbebdefec7d9daeca8707112ccd2. Intermediate production-head CI #41076212580 passed both platforms.
Interrupted first-layout hard-link publication: process death between non-replacing linkSync and temporary-name unlinkSync stranded nlink=2 and blocked all future reads/writes. Draft diagnostic PR #115 test-only 9f519ddbc753922b642a31d265a904d5ddd1f9b3 failed Ubuntu CI #41075297478. Narrow recovery accepts only exact initial schema/snapshot/index bytes, one same-inode private staging link and a dead owner; live-owner or unrelated links remain fail-closed. Initial Windows CI #41075671505 exposed H03/H15 writer lock timeouts from extra normal-path probes, so the code was optimized to inspect recovery candidates only upon an observed multiply-linked canonical bootstrap file. Final diagnostic 522c8b617f99051e655167f2f5754131b60709a7 passed both full Ubuntu/Windows v0.13 jobs CI #41076958389. Ported only validated runtime/test to PR feat(v0.13): State Engine V2 durability and migration #92 879d77379de868064bfab6dae8efc5b7b873f053, 410298fda1c8027a214bb2a235f56442ea986a27. Repository memory.md updated at 73603f8a2004100b0fb8e302f89825eecc5638b5.

No acceptance: latest combined-head CI and fresh independent distinct code/architecture/security reviews are pending; PR #92's unresolved review threads must be independently dispositioned. Issue #73's NTFS physical sudden-power-loss evidence is still missing; no hardware result, independent approval or persisted deterministic ACCEPTED was fabricated. PR #92 and diagnostic PRs remain unmerged; v0.12 release boundary unchanged.

30 Oct 2026 — T04 pending-commit evidence-preservation P2 test-first fix, actual v0.13 PR #92 (NOT ACCEPTED). Latest integration head 5150fb3011d7ffbd345725db1fab4cbef4158caa remains draft and unmerged. Independent code review found that recoverPendingCommitLocked() validated a proposed pending suffix and snapshot witnesses only after truncating/rewriting/fsyncing canonical history, so a hash-invalid journal could overwrite partial crash evidence before being rejected. Isolated draft PR #117 test-only 5d02b5d03b46f9e24a637f4a1696fc9e407ab20c reproduced canonical mutation for zero and partial append cases in Ubuntu RED CI #41079260840. Corrected diagnostic e884d88fb3a11c59acc77f159dea209de4cd730e passed both full Ubuntu and Windows v0.13 validation jobs CI #41079450641. The narrowly scoped validation-before-mutation source and H52 regression were ported to PR #92 as 385f7c9edc3fd2e882edcc31589f6c20de467124 and 130bb5c7ff05a2762bbf0a20b3ba2f444742e04a; memory.md updated at 5150fb3011d7ffbd345725db1fab4cbef4158caa. The other new P2 finding (stale /v1/scale-context API projection after V2 cutover) remains to be addressed test-first. Current final-head CI, distinct external code/architecture/security reviews, unresolved PR review threads, Issue #73 physical NTFS sudden-power-loss evidence and deterministic persisted ACCEPTED are still mandatory. No acceptance, merge, release or waiver was performed.

30 October 2026 — actual v0.13 T04 integration PR #92, source-bound test-first correction (NOT ACCEPTED). W73-28 Unicode uppercase-folded signed-backup destination aliases were reproduced on both Ubuntu and Windows in diagnostic test-only CI #41079372395 (RED). Draft diagnostic PR #116 narrowed the fix to conservative uppercase preflight and physical dev/inode duplicate detection during staging; diagnostic CI #41079431166 passed both full v0.13 lanes (GREEN). Only runtime/test changes were ported to actual PR #92 (5920cd352dae245d6360a59fd62672c1259bccb9, ea32b2bbff336f6dde4f581c2315b58f4a7e86b0), and memory.md updated. Final integration head 803c0c1968fa06ffda0b250522dad2b64cbe9c0f passed full Ubuntu and Windows v0.13 CI in run #41080869689. Fresh exact-SHA code/architecture/security independent review requests were posted on PR #92 (comments 6526700836, 6526701732, 6526702927); requests and bot reviews are NOT distinct independent approvals. Still blocking: 11 unresolved PR #92 review threads, physical NTFS sudden-power-loss proof, full two-run exact-head evidence, authenticated distinct three-role review, deterministic persisted ACCEPTED and protected release approval. Issue #73 remains open; no PR merged or release published. PR #116 is diagnostic only.

30 Oct 2026 — v0.13 T04 Control Center projection P2 test-first correction (NOT ACCEPTED). Actual integration is draft PR #92 at 952ae0dec1ae7924286c37d3567ec571689efea7, based on released v0.12.1; historical PR #70 and diagnostic PRs must not merge. Independent review found /v1/scale-context still read the legacy pointer after V2 cutover, falsely reporting inactive or frozen workflow state while /v1/workflow correctly read canonical V2. Diagnostic draft PR #118 test-only f9a1972ccfcc5e7b2d580612ef9a94b63627aa46 reproduced the mismatch in Ubuntu RED CI #41080813268. Narrow fix selects active V2 canonical state, preserves v0.12 legacy behavior for non-V2 projects, rejects corrupt V2 fallback, never writes a legacy pointer and never reports V2 as independently accepted. The v0.13 T04 contract now explicitly includes the read-only API projection. Diagnostic 85b8628fcc8ecc0b47eb7fa4d1a22c19e3996932 passed both full Ubuntu/Windows v0.13 CI jobs #41081063299. Only validated API source, test and contract scope were ported to PR #92 in 4fe2fb7ab28a3c05d5b248e9dbdaf68b7b7567a2, 00d5628beee97a5d1131ba1f726517530c51d2a5, e0b381d3861a81db7d8c866e83a28e8cd184baaa; memory.md updated at 952ae0dec1ae7924286c37d3567ec571689efea7. Fresh combined-head CI, distinct external source-bound reviews, unresolved P1/P2 threads, Issue #73 controlled physical NTFS sudden-power-loss evidence and persisted deterministic risk-3 ACCEPTED remain blocking. No approval, waiver, merge or release occurred.

30 Oct 2026 — exact combined-head v0.13 T04 CI evidence (NOT ACCEPTED). Actual integration draft PR #92 remains at immutable head 952ae0dec1ae7924286c37d3567ec571689efea7, based on released v0.12.1. The full CI run #41082483358 completed SUCCESS on both Ubuntu and Windows after combining the independently RED/GREEN-tested index collision/stale-index, dead-owner bootstrap hard-link, pending-suffix validation-before-mutation, NTFS alias, and read-only Scale & Context canonical V2 projection corrections. This is one full combined-head workflow execution, not two distinct final-head runs and not a persisted risk-3 ACCEPTED verdict. PR #92 still has 13 unresolved inline review threads, no authenticated three-distinct-role source-bound approvals, and Issue #73 remains open for controlled physical NTFS sudden-power-loss evidence. No merge, release, acceptance fabrication or waiver occurred.

New exact-head review findings requiring test-first work — 30 Oct 2026, SHA 952ae0dec1ae7924286c37d3567ec571689efea7 (NOT ACCEPTED). Automated source review identified two additional P2s that remain unresolved: (1) runtime/api/runtime-api-service.mjs read-only /v1/scale-context can call getCurrentState() and mutate a corrupt legacy current.json via automatic recovery when V2 has only unrelated metadata events and the workflow is still unmigrated; read-only API must select workflow authority and never repair legacy evidence. (2) runtime/orchestration/state-engine-v2.mjs internally generated patch paths reject valid JSON object keys '', newline, carriage return and NUL on subsequent updates/deletions, breaking V2 compatibility for formerly writable legacy state. Reproduce both with isolated adversarial tests before any narrow source correction; preserve full Windows recovery and release gates. The latest combined-head CI #41082483358 is green on both platforms but does not satisfy these new review findings, the three independent role approvals, two exact-head full runs or Issue #73 physical power-loss assurance. No acceptance or merge.

30 October 2026 — v0.13 T04 two additional P2 findings corrected test-first on actual draft PR #92 (NOT ACCEPTED). Exact pre-fix PR #92 source was 952ae0dec1ae7924286c37d3567ec571689efea7. (1) Valid JSON object keys '', LF, CR and NUL were rejected by internal array patch paths on entity updates/deletions. Draft diagnostic PR #119 reproduced failure on Ubuntu and Windows CI #41088497647 (RED); minimal string-segment correction 51f80f691d485e47dd201a42a3ae64545d1771fb passed both full platform lanes CI #41088653146 (GREEN). Source/test selectively ported to PR #92 as f35455dff057cd550eccc4d0100f54292b65d711 and b6a25cbc510dd8011fc43319dc7927f71b2b42c2.

(2) Read-only GET /v1/scale-context could silently repair corrupt unmigrated legacy current.json when unrelated V2 metadata existed. Draft diagnostic PR #120 reproduced the evidence mutation on Ubuntu and Windows CI #41088803827 (RED). Corrected workflow-authority selection b9374618c054c1fd9b596b68b43ac402d954bf01 passed both full platform lanes CI #41089162418 (GREEN), preserving valid unmigrated legacy reads and fail-closed corrupt V2 witnesses. Source/test selectively ported to PR #92 as fc1d6715d95cd530ed17fc2b3f1ae801269b0854 and a28b3cce36c57323a9cabc8d291ed1cf1a26a951. Repository memory.md updated.

Combined PR #92 head: bbe7f6342be96757c9089d2ef29ffcdec0c6338e (requires fresh exact-head full Ubuntu/Windows CI and independent source-bound review). Neither diagnostic CI routing nor historical PR #70 was ported. PR #119/#120 remain draft, unmerged. Issue #73 controlled physical NTFS sudden-power-loss durability is still unproven, existing review threads require independent resolution, and three genuinely distinct authenticated code/architecture/security reviews plus two separate full-platform executions on identical final source and persisted deterministic risk-3 ACCEPTED remain mandatory. No merge, release, approval, power-loss certification or acceptance is claimed.

30 October 2026 — exact combined v0.13 T04 head validation after P2 fixes (NOT ACCEPTED). Actual integration draft PR #92 commit bbe7f6342be96757c9089d2ef29ffcdec0c6338e completed GitHub Actions run #41090598230 with both full Ubuntu and Windows v0.13 compatibility/regression jobs SUCCESS. This source combines the test-first JSON literal patch-key fix (diagnostic PR #119, RED #41088497647 → GREEN #41088653146) and non-mutating unmigrated legacy API projection fix (diagnostic PR #120, RED #41088803827 → GREEN #41089162418), plus repository memory provenance. No diagnostic CI exception was ported.

Binding remaining gates: this is one combined-head workflow execution, not two independent executions on identical reviewed SHA. PR #92's independent code, architecture and security reviews have not produced three distinct authenticated exact-source PASS receipts; unresolved inline review threads remain; Issue #73 still lacks controlled physical NTFS sudden-power-loss ordering evidence for complete Windows legacy restore. No deterministic persisted risk-3 ACCEPTED, no PR merge, no v0.13 release, and no waiver are claimed. Historical PR #70 and diagnostics #119/#120 remain unmerged.

30 Oct 2026 — v0.13 T04 acceptance-enforcement negative control (diagnostic only; NOT ACCEPTED). The actual integration target remains draft PR #92 at immutable bbe7f6342be96757c9089d2ef29ffcdec0c6338e on released v0.12.1. Its CI #41090598230 passed the complete Ubuntu and Windows v0.13 validation jobs, but .github/workflows/ci.yml currently defines only the validate matrix and no independent risk-3 t04_acceptance job. Thus platform green does not provide an authenticated persisted acceptance verdict, and the v0.13 gate must not be inferred from CI success. Created isolated draft PR #121 from the exact PR #92 source with a deliberately failing test-first regression requiring a distinct source-bound acceptance job dependent on the full platform matrix and a real deterministic review/CI-evidence gate. Diagnostic workflow #41101076526 is queued; RED is expected, not yet claimed. Do not port a speculative or permissive gate to PR #92. Next: confirm RED, implement fail-closed authenticated source/CI/review/physical-evidence validation in the isolated branch, verify both platforms, then port only validated files to PR #92. Three distinct external reviews, 12 unresolved PR #92 threads, two full identical-head executions, and Issue #73 physical NTFS sudden-power-loss evidence remain mandatory. No merge, waiver or release authorized.

30 Oct 2026 — DKF130-T04 risk-3 acceptance-enforcement test-first diagnostic (NOT ACCEPTED). Actual v0.13 integration remains draft PR #92 at bbe7f6342be96757c9089d2ef29ffcdec0c6338e on released v0.12.1. Isolated draft PR #121 reproduced the missing independent acceptance job on BOTH Ubuntu and Windows in CI #41101076526 (RED). The diagnostic branch now contains a proposed source-bound t04_acceptance job depending on both full OS validation lanes, a canonical Development Contract, authenticated GitHub API evidence, complete immutable reviewed source tree, distinct exact-SHA code/architecture/security approvals, zero unresolved PR #92 threads, two separate exact-SHA cross-platform runs, non-waived Issue #73, independently reviewed physical NTFS power-loss artifact SHA-256, original-tree and hash-chain recovery witnesses, control-domain evidence, and decideAcceptance rather than a CI-green shortcut. Latest diagnostic head 2617f36036af60966bbfc41cabe6df8b779fe7ed; CI #41111886368 is queued at this checkpoint, NOT GREEN evidence. No changes have been ported to PR #92; no physical power-loss tests or independent approvals are claimed. Diagnostic is do-not-merge. Next: verify full Ubuntu/Windows GREEN and independent review before selective port to PR #92.

30 Oct 2026 — v0.13 T04 acceptance-enforcement diagnostic follow-up (NOT ACCEPTED). Draft PR #121 was verified against actual integration PR #92 source bbe7f6342be96757c9089d2ef29ffcdec0c6338e; runtime migration, ledger and API blobs initially matched. Acceptance-gate diagnostic CI #41112110404 exposed missing script documentation; CI #41114986036 exposed an unindexed docs reference; CI #41115110432 exposed an overbroad legacy regression asserting github.head_ref nowhere in the workflow, conflicting with the deliberately PR-restricted independent acceptance job. Corrected these without relaxing source-bound v0.13 validation. CI #41115323940 passed the entire Ubuntu validation lane, but Windows failed in its second full v0.13 regression on T04-H15 four-process stale-lock reclaim after 12.8s (State Engine lock acquisition timed out); the same test had passed earlier in that same Windows job in 7.6s. The lock still refuses live-owner reclamation. A narrowly scoped bounded Windows-only lock-wait increase from 12s to 20s is now under diagnostic CI at commit 6e228fb02f29f07131f651fc4f7077ddc1f39ab6; no correction is ported to PR #92 until both OS lanes pass. Issue #73 physical NTFS power-loss evidence, 13 unresolved PR #92 review threads, independent approvals and deterministic persisted ACCEPTED remain mandatory. No merges, waivers or releases.

30 Oct 2026 — v0.13 T04 deterministic risk-3 acceptance enforcement integrated into actual draft PR #92 (NOT ACCEPTED). Source-bound diagnostic draft PR #121 first reproduced the missing independent acceptance job on Ubuntu and Windows in RED CI #41101076526. The corrected diagnostic at 6e228fb02f29f07131f651fc4f7077ddc1f39ab6 passed both complete Ubuntu and Windows v0.13 validation jobs in GREEN CI #41116732941; its acceptance job correctly SKIPPED because the branch is diagnostic. PR #92 already contained the fail-closed gate script, negative-control tests, pending review receipts and reference documentation. Production CI #41118003732 exposed an unindexed reference page (RED both platforms), fixed by indexing the page in docs/SUMMARY.md at 2490b27248d612904415240be8dbc656eee1da51. Ported only the validated append-only .github/workflows/ci.yml acceptance job and test invocation at 6ffa5a6e2dd4c7f1f7f162921ab1481611b04093: the job depends on the complete Ubuntu/Windows matrix, checks out exact PR #92 head, uses read-only GitHub permissions and authenticated external evidence, and must fail closed absent independent reviews/NTFS evidence. The historical v071 regression initially rejected the intentional branch restriction on the separate acceptance job (Ubuntu RED #41119009453); ported the previously validated narrow test correction at a40b3186f38a52c3d66cda2e6b8b26cdd508417f, keeping the validation job branch-agnostic. Exact integration-head CI #41119119763 is running; do not claim full GREEN or acceptance prematurely. Blocking gates unchanged: 13 unresolved PR #92 review threads, no three distinct authenticated exact-source code/architecture/security approvals, Issue #73 controlled physical NTFS sudden-power-loss assurance absent, no two complete same-final-SHA cross-platform executions, no authentic persisted risk-3 ACCEPTED, no merge/release. Historical PR #70 and diagnostics #99/#121 remain unmerged. No physical test, review approval or acceptance verdict is fabricated.

30 Oct 2026 — two distinct exact-head v0.13 T04 cross-platform validation executions after H56 (NOT ACCEPTED). Actual integration draft PR #92 head f3bc71988cc8a472aaeabefc2397ebe5db4c1d85 (released v0.12.1 baseline; memory.md includes test-first provenance) completed full Ubuntu and Windows v0.13 validation on two separate GitHub Actions workflow executions: run #41127165486 (Ubuntu SUCCESS; initial Windows UI Preview fixture timed out after 15s, Windows-only job rerun succeeded with all full validation steps; independent risk-3 acceptance correctly FAILED on missing review receipts) and run #41127572518 (Ubuntu SUCCESS; Windows SUCCESS; T04 acceptance correctly SKIPPED because CI-only draft PR #123 is not the integration branch). Both workflow executions reference the identical SHA f3bc71988cc8a472aaeabefc2397ebe5db4c1d85. CI-only PR #123 has no source changes and MUST NOT MERGE. This meets the two-distinct-full-platform-run evidence requirement for this source only, not the risk-3 ACCEPTED gate. Three distinct authenticated code/architecture/security APPROVED reviews are still absent, 13 PR #92 review threads are unresolved, Issue #73 lacks independently reviewed physical NTFS sudden-power-loss evidence, the review register remains pending and no canonical persisted ACCEPTED verdict exists. No PR merge or release is authorized.

30 Oct 2026 — T04-A17 source-bound CI validation correction (NOT ACCEPTED). Discovered an acceptance-provenance gap on actual v0.13 integration PR #92: Ubuntu/Windows validate matrix used default actions/checkout, so PR #92 CI #41127165486 executed synthetic merge commit 25302739265ee4e4335ead869f81ecfefae96500 (refs/pull/92/merge) rather than the reviewed head f3bc71988cc8a472aaeabefc2397ebe5db4c1d85. PR #123's second supposed exact-head run #41127572518 similarly executed synthetic merge 0cc2e65, not the immutable reviewed source. These two runs therefore cannot count as two source-exact validation executions under the risk-3 acceptance gate despite platform-green results.

Isolated draft, do-not-merge diagnostic PR #124 introduced T04-A17 negative-control asserting both matrix jobs check out the exact PR head and discard credentials. Both full Ubuntu and Windows jobs reproduced the missing source binding in RED CI #41130880458. Narrow fix: actions/checkout@v7 ref: ${{ github.event.pull_request.head.sha || github.sha }} and persist-credentials: false (main push retains github.sha fallback). Diagnostic SHA 5fd3641078258be5897d4ca186ed346755ca6a97 passed both full Ubuntu and Windows v0.13 jobs in GREEN CI #41131224727; both job logs confirm checkout of exact 5fd3641 and T04-A17 PASS. Only validated test and workflow checkout correction were ported to actual PR #92 as 333d2f82c870563a7268a83df0f03217d7668e42 and 7502e41d03497b7fd3b185018745bb6cef1f57a1, followed by memory.md evidence at 0e351370e156765634683865cc1f57b8105d9bc3. Diagnostic-only PR trigger was not ported; PR #124 MUST NOT MERGE. Production exact-final-head CI and two independent full platform runs remain required. Issue #73 physical NTFS sudden-power-loss proof, 13 unresolved PR #92 threads, three distinct authenticated source-bound role approvals, and canonical persisted ACCEPTED remain outstanding. No waiver, merge, or release.

T04-H73 test-first source correction — 1 November 2026 (NOT ACCEPTED). Authoritative v0.13 PR #92 at prior e9ba6e3bfcf8d859401f5501e3a1d77178dbcd34 silently skipped two incomplete legacy histories: Autopilot current.json with missing revision files, and orchestration revision/pointer witnesses with missing immutable manifest.json. This could publish MIGRATION_COMPLETED while the original source was incomplete. Diagnostic draft PR #164 committed adversarial regressions FIRST (5e6f57d1b3b34cb32182987a694eeff9caf1c2a1); both Ubuntu and Windows reproduced both missing-exception defects in RED CI https://github.com/eybersjp/development-kit/actions/runs/41251264165. Narrow fail-closed fix 6d3228d7c25753b1747cebe5d6ad3220c6b22731 passed full Ubuntu and Windows in GREEN CI https://github.com/eybersjp/development-kit/actions/runs/41251304713. Exact validated source blob 7f46e190a1dcb4dfab8c8c6d81c663edca33bb69 and regression-test blob 7cf5b15d9b6259096992c422bd0f2740c4442c2d were ported atomically with updated memory.md to PR #92 head bd7bebad9368b81674789cb707dae72bdc388863 using a parent-checked ref update. Verified blob hashes and existing CI/package/State Engine source. CI-only witness PR #165 points to the IDENTICAL head. Final two full Ubuntu/Windows runs on this exact integration head are pending; three distinct authenticated code/architecture/security approvals, controlled physical NTFS power-loss Issue #73 and persisted deterministic risk-3 ACCEPTED remain hard blockers. No merge, release, waived gate or acceptance claim.

T04-H73 final exact-head validation evidence — 1 Nov 2026 (NOT ACCEPTED). Authoritative PR #92 remains at immutable SHA bd7bebad9368b81674789cb707dae72bdc388863 (unchanged after H73 atomic port). Two distinct GitHub Actions workflow executions validated the same 40-character source SHA: integration https://github.com/eybersjp/development-kit/actions/runs/41251830130 and CI-only identical-source witness https://github.com/eybersjp/development-kit/actions/runs/41251840730. All four full Ubuntu/Windows validation jobs PASSED; witness acceptance was correctly SKIPPED, and production PR #92 risk-3 acceptance correctly FAILED CLOSED with Missing exact-source independent reviews in integration run. All 21 inline PR #92 threads currently resolved, but this is not independent approval. The source-bound review register still has reviewedCommit:null, reviews:[], validationRunIds:[], windowsPhysicalPowerLoss:null, status:PENDING_INDEPENDENT_REVIEWS. Required next: genuine three distinct authenticated exact-source CODE/ARCHITECTURE/SECURITY approvals; controlled NTFS physical sudden-power-loss restore ordering evidence under Issue #73; authenticated persisted deterministic risk-3 ACCEPTED; protected v0.13 release approval. PR #92, diagnostic PR #164 and witness PR #165 remain draft/unmerged. No evidence fabricated, no gate weakened, no v0.12 inclusion.

T04-H74 test-first correction on authoritative v0.13 PR #92 — 1 November 2026 (NOT ACCEPTED).

Source at prior PR #92 SHA bd7bebad9368b81674789cb707dae72bdc388863 treated a surviving orchestration current-state.json pointer as a manifest-only revision-1 history when the referenced immutable state-revisions/*.json files and final-state.json were absent. That allowed inspectLegacyState() and migration to certify incomplete acknowledged history. Diagnostic draft PR #166 committed H74 regression FIRST at 7dbf790d951d08dcbe7037a1ee9fc8b9afaa6ba4; RED CI #41258831305 reproduced the missing exception on both Ubuntu and Windows. Narrow fail-closed correction da1ccaf51b9c47da6ce8624b893ba67fe5b679c7 rejects orphaned pointer witnesses before backup/cutover; it preserves original pointer and manifest. GREEN CI #41258894217 passed both complete Ubuntu and Windows jobs including H74 and full compatibility.

Exact validated source blob f7c72a1efc867a9af25bfbf3bde70399ee2bb5b4 and test blob a2add156ace088ed9f939ff404b9d3f83d95e817 are ported byte-identically into PR #92. memory.md updated. Authoritative final head e4f254cf991a65224cf65e7516d3b446a0e9b01a; integration CI is running and draft PR #167 is a second identical-source CI-only witness. Do not count pending jobs as successful.

Hard blockers unchanged: three distinct authenticated exact-final-source CODE/ARCHITECTURE/SECURITY approvals, controlled NTFS physical sudden-power-loss restore evidence under Issue #73, two complete final-head Ubuntu/Windows runs and authenticated persisted deterministic risk-3 ACCEPTED. No merge/release or scope waiver.

H74 final exact-head validation verified — 1 November 2026 (NOT ACCEPTED). Authoritative draft PR #92 remains at immutable SHA e4f254cf991a65224cf65e7516d3b446a0e9b01a, with exact diagnostic-validated source blob f7c72a1efc867a9af25bfbf3bde70399ee2bb5b4 and test blob a2add156ace088ed9f939ff404b9d3f83d95e817. Two distinct GitHub Actions executions on this same 40-character commit completed: integration #41259573911 and CI-only witness #41259599517. All four complete Ubuntu/Windows validation jobs SUCCESS, including H74 and v0.13 compatibility. Integration risk-3 acceptance correctly FAILED CLOSED (Missing exact-source independent reviews); witness acceptance SKIPPED. All 21 inline PR #92 threads resolved; no APPROVED independent review submissions found. Persisted receipt still has reviewedCommit:null, reviews:[], validationRunIds:[], windowsPhysicalPowerLoss:null, status:PENDING_INDEPENDENT_REVIEWS. Three genuine distinct authenticated exact-source CODE/ARCHITECTURE/SECURITY approvals, controlled physical NTFS sudden-power-loss assurance under Issue #73, and persisted deterministic risk-3 ACCEPTED remain hard blockers. No merge, release or waiver authorized.

T04-H75 test-first corrective evidence (1 Nov 2026; NOT ACCEPTED). Authoritative PR #92 source e4f254cf991a65224cf65e7516d3b446a0e9b01a let GET /v1/scale-context replay a valid pending canonical V2 revision and delete crash evidence. Diagnostic test-only PR #168 commit 6f69e3c76c17256eb6ff5019a5208746e8857fc0 reproduced the negative control on Ubuntu and Windows in RED CI #41263121147; the sole failed test on both platforms was V13-API-PROJECTION-04. Diagnostic fix PR #169 commit 3ff81aa3cb1ef5b09d59ed8242e86c859a5f5f3e passed complete Ubuntu and Windows GREEN CI #41263092726. The narrow API correction uses non-mutating loadStateSnapshot(...,{rebuildIfNeeded:false}) for V2 authority and workflow projection, preserving events.jsonl, snapshot.json, index.db, and pending-commit.json byte-for-byte when recovery is pending; legacy v0.12.1 pointer projection remains supported. Exact validated source blob c3824931c8d8e1ccdb3727b2eb044ab6d47cf8dd and test blob f9a86424137ec237eb97e3b75d5e59721638f424 are ported to authoritative draft PR #92 final head b77ad0a471eec0c2f7f06a2f254c7357fcb64769; memory.md updated. CI-only draft PR #170 points to the identical SHA to obtain the second full validation run. Final-head dual CI is pending and must be verified. H75 PR #92 review thread #discussion_r4433975614 is corrected but pending final-head validation before resolution. Three genuinely distinct authenticated exact-SHA code/architecture/security approvals, Issue #73 controlled physical NTFS sudden-power-loss evidence, and persisted deterministic risk-3 ACCEPTED remain hard blockers. No waiver, merge or release authorized.

T04-H76/H77 test-first corrective cycle in progress — 1 Nov 2026; NOT ACCEPTED. New exact-source Codex P2 findings on authoritative draft PR #92 at b77ad0a471eec0c2f7f06a2f254c7357fcb64769: (H76) read-only GET /v1/scale-context can unlink a terminated bootstrap schema staging hard link during isStateEngineV2Active() preflight; (H77) a surviving index.db witness of acknowledged revision 2 is not checked when both canonical ledger and snapshot regress to revision 1, so GET projects stale workflow. Created draft diagnostic PR #173 from the exact PR #92 head. Tests first at 322a4c6ae6d8050682b8fdbeeed63efd21dce308, adding V13-API-PROJECTION-05/06: preserve bootstrap staging entry/link count and original canonical bytes on GET, and reject rolled-back ledger+snapshot against later index without any file mutation. Ubuntu RED CI #41264569817 confirmed BOTH expected failures in the new fixtures (logs identify only the expected read-only preflight and index-witness assertion errors); Windows RED was still running when recorded. Narrow source correction on diagnostic SHA 3792c91128cc8b34da356980683968e3059b67fd makes bootstrap preflight non-mutating for read-only calls, retains recovery in write paths, and verifies surviving index sequence/hash against canonical events with a non-mutating retry for concurrent publication. Ubuntu full GREEN CI #41264602042 succeeded; Windows GREEN remains in progress. Do not port to PR #92 until complete Windows GREEN is verified. No independent approval, physical NTFS sudden-power-loss result, deterministic ACCEPTED, merge or release is claimed. Review threads H75/H76/H77 remain unresolved pending final-head validation.

T04-H76/H77 validated corrective engineering integrated into authoritative PR #92 (1 Nov 2026; NOT ACCEPTED). Diagnostic draft PR #173 tests FIRST at 322a4c6ae6d8050682b8fdbeeed63efd21dce308; RED CI #41264569817 reproduced BOTH new V13-API-PROJECTION-05/06 failures on Ubuntu and Windows. Narrow correction diagnostic SHA 3792c91128cc8b34da356980683968e3059b67fd passed complete Ubuntu and Windows release validation and full v0.13 compatibility in GREEN CI #41264602042; Windows logs show both new tests PASS, not SKIP. Ported exact verified blobs to authoritative PR #92: tests e8644e8992350ae1abfac44c84432b9311ccc05b, State Engine 348c593186f3e40d66fddfde49e17bbcd363a8a6, API b5aaac4352e36c1c2649d204ab36aaec56f7926f. memory.md updated with source-bound evidence. Final integration SHA 6b5d31d47db0a07f3eb565dbb93bd5cf97ffe051 (draft PR #92). Created unmerged draft CI-only PR #174 pinned to this exact SHA for a second independent Ubuntu/Windows full validation run; both final-head workflow outcomes must be verified before claiming the two-run gate. Original H75 and new H76/H77 review threads remain unresolved pending final-head CI and engineering disposition. Three distinct authenticated exact-source code/architecture/security approvals, controlled physical NTFS sudden-power-loss evidence under Issue #73 and persisted deterministic risk-3 ACCEPTED are still absent; do not merge, release or weaken gates.

T04-H76/H77 exact-final-source two-run validation COMPLETE — 1 Nov 2026; NOT ACCEPTED. Authoritative draft PR #92 remains at immutable SHA 6b5d31d47db0a07f3eb565dbb93bd5cf97ffe051 (released v0.12.1 base). Two distinct authenticated full GitHub Actions executions on the identical 40-character source SHA completed: integration #41265246811 and source-identical CI-only draft witness #41265254272 (PR #174). All four Ubuntu/Windows full validation jobs SUCCESS, including H76/H77, Windows legacy restore fixtures and v0.13 compatibility. Production T04 independently reviewed risk-3 acceptance correctly FAILED CLOSED in integration run with Missing exact-source independent reviews; CI-only witness acceptance SKIPPED. Source/test bytes match validated GREEN diagnostic PR #173 blobs. All 24/24 PR #92 inline review threads are now resolved with engineering dispositions, including H75/H76/H77; resolution is not independent approval. The persisted receipt docs/04-architecture/dkf-v013-t04-independent-review-receipts.json still has reviewedCommit:null, reviews:[], validationRunIds:[], windowsPhysicalPowerLoss:null, PENDING_INDEPENDENT_REVIEWS. Genuine distinct authenticated code, architecture and security exact-source reviews and controlled physical NTFS sudden-power-loss evidence (Issue #73) remain blocking; no deterministic ACCEPTED, merge, or release. Preserve exact SHA for reviewers; any source change invalidates these run/review receipts.

1 Nov 2026 — T04-H78 test-first Windows restore-path security regression (diagnostic; NOT ACCEPTED). Authoritative v0.13 integration is draft PR #92 at 6b5d31d47db0a07f3eb565dbb93bd5cf97ffe051. Draft diagnostic PR #175 committed adversarial tests before a source fix (RED SHA 1e48500f091000353908dc266ff8bb8d9f8d599b). Full CI #41269537745 failed on both Ubuntu and Windows at H78: a re-fingerprinted legacy backup with NTFS alternate-stream syntax (revision-000001.json:evil) was not rejected before staging; Ubuntu observed a missing expected exception, and Windows reached an EINVAL stage rename instead of safe preflight. Microsoft explicitly reserves :, ?, device names CON, AUX, and superscript COM/LPT aliases: https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file . Narrow diagnostic source fix at ca5c4bab8fff68d4e11fb5ca6028c5f0f631fe8d rejects forbidden Win32 characters and DOS device names in every backup path component before any stage/journal/target mutation, on all platforms. Full GREEN CI #41269595080 is pending Windows completion; do not port to PR #92 until both full jobs pass. This is path portability/confinement hardening, not NTFS sudden-power-loss evidence or independent role approval. Issue #73 and deterministic risk-3 acceptance remain open; no merge/release authorized.

T04-H78 integration update — 1 Nov 2026 (NOT ACCEPTED). Diagnostic PR #175 test-only SHA 1e48500f091000353908dc266ff8bb8d9f8d599b failed H78 on both Ubuntu and Windows in RED CI #41269537745. Exact diagnostic correction ca5c4bab8fff68d4e11fb5ca6028c5f0f631fe8d passed both complete platform validations in GREEN CI #41269595080, including H78 and v0.13 compatibility. Only validated source blob a6cbe5c265101f6db5fb2f08e3e2064d72746845, test blob eb7431c23e5972796eef76ad67622776bed9d185, and memory.md evidence were atomically ported to authoritative draft PR #92 at exact final commit 26de8b35758540a93d58207c7b6bbfbabb6050d0. Opened draft PR #176 as a CI-only identical-source witness for the second complete Ubuntu/Windows run; integration and witness final-SHA runs are in progress and must be verified before claiming the two-run gate. PR #92 remains draft/unmerged. Physical NTFS sudden-power-loss evidence under Issue #73, three genuinely distinct authenticated exact-SHA code/architecture/security approvals, and persisted deterministic risk-3 ACCEPTED remain outstanding. No release or waiver authorized.

T04-H80 test-first correction integrated into authoritative v0.13 draft PR #92 (1 Nov 2026; NOT ACCEPTED). Exact original PR #92 source 26de8b35758540a93d58207c7b6bbfbabb6050d0 could acknowledge an interrupted promotion despite missing candidate descendants. Draft diagnostic PR #178 committed H80 missing/altered-descendant tests first; RED 69c7f045950405f726e33e5c77b3dcd8d26ccd57 failed both Ubuntu and Windows in CI #41271235511 with Missing expected exception. Narrow correction c75ad53fcce1d3e47b1b941c922e419fb632ac2c passed complete Ubuntu and Windows validation and v0.13 compatibility in GREEN CI #41271297676. The fix binds a PREPARED hash-chained candidate content witness to all descendants (including symlink text) and refuses nonterminal recovery acknowledgement on missing/mismatched content while retaining candidate, original and journal. Exact validated source/test blob SHAs 7eafe30354efda77091e56fbfcca69c8b66b652e / f8372ed21ecc894de4590ec653c8778fa55ac731 ported atomically with updated memory.md to PR #92 final integration SHA d8b1e7e02e451f1c6aa1f6bce0c1bd616c67a344. Draft PR #179 is an exact-SHA second CI witness, not a merge candidate. Final-head dual full Ubuntu/Windows CI, independent distinct code/architecture/security approvals, unresolved H79/H80 review disposition, controlled physical NTFS sudden-power-loss evidence under Issue #73 and persisted risk-3 ACCEPTED remain outstanding. The H80 journal-prefix injection is NOT a physical power-loss test. No merge, release, waiver or approval claimed.

T04-H81 POSIX ancestor-alias journal bypass — test-first correction integrated into authoritative v0.13 draft PR #92 (1 Nov 2026; NOT ACCEPTED). Exact original PR #92 SHA d8b1e7e02e451f1c6aa1f6bce0c1bd616c67a344 permitted an interrupted PREPARED restore to be bypassed through a POSIX ancestor symlink, creating a second lexical journal digest for the same physical target. Draft diagnostic PR #181 added a real child-process PREPARED-crash regression FIRST; test-only RED 754a9a6f1392ac4a6004c7cc2422141de50e5118 failed the new H81 fixture on Ubuntu in CI #41273280146 with Missing expected exception. Narrow source fix 2b3d8528e0565c2229a10a7cc9064699428880a6 rejects POSIX ancestor symlinks before journal discovery in both restore and recovery; it preserves original files, hash-chained journal bytes and sibling stage entries. Both full Ubuntu and Windows validations PASSED on diagnostic GREEN CI #41273340136, including v0.13 compatibility. Exact validated source blob 95a5cd386f75e8936a7d9742fb7d58b9f2630642 and test blob 9162f97a6cee1fb3ffc5ea99b266d43ce5859b4b were ported unchanged to authoritative PR #92; memory.md updated. Current PR #92 head 215f1c4b1387432eadc34636a717740a87ce6a34, with draft CI-only PR #182 created from the identical commit for the second full validation run. Final-head two-run Ubuntu/Windows outcomes are pending verification; do not claim them until both finish. H79 Windows read-only file restore finding and H81 review-thread disposition, genuine three-role exact-source approvals, controlled physical NTFS sudden-power-loss evidence (Issue #73), and persisted deterministic risk-3 ACCEPTED remain outstanding. The POSIX preflight is not protection against arbitrary hostile same-UID races. No merge, release or waiver authorized.

1 Nov 2026 — T04-H79 test-first Windows read-only restore correction integrated (NOT ACCEPTED). Authoritative draft PR #92 originally at 215f1c4b1387432eadc34636a717740a87ce6a34 failed to restore a valid legacy backup into an existing Windows target containing an unrelated read-only file: syncRestoreTree() opened the preserved 0o444 staged copy with r+, producing EPERM. Isolated draft diagnostic PR #183 committed adversarial H79 test FIRST at 630e2130ecef9819ce54a268ed977a987f3b4edc. Full RED CI #41275223714 passed Ubuntu but reproduced Windows EPERM in H79. Narrow correction at ddd0cac386facb63d6ebc213ed17320d3286b670 validates staged file identity, temporarily enables the staged copy's write bit for the required Windows flush, and restores the exact mode in finally without touching original tree. No silent fallback on chmod/open/fsync failures. Full Ubuntu and Windows validations, H79 and v0.13 compatibility all passed in GREEN CI #41275567936. Exact validated source/test blobs 3e3d4093acc6058888d45eab8a75f94f5baee47c / f293621babce49810e67e0ab5855a112fa9d7a77 were atomically ported with memory.md to PR #92 at bf0cbcb9599a4f7f79feb88f840f89aeb2780d5b. Draft PR #184 is an identical-source second CI witness; exact-head dual platform runs pending. This corrects a Windows read-only attribute defect, not physical NTFS power-loss assurance. Issue #73 controlled physical evidence, three distinct authenticated code/architecture/security approvals, persisted deterministic risk-3 ACCEPTED and protected v0.13 release authorization remain outstanding. No merge, waiver or fabricated approval.

T04-H82 test-first correction integrated into authoritative v0.13 PR #92 — 1 November 2026 (NOT ACCEPTED). Starting source bf0cbcb9599a4f7f79feb88f840f89aeb2780d5b allowed read-only loadStateIndex(...,{rebuildIfNeeded:false}) to reclaim an interrupted initializer's index.db staging hard link during its second statePaths() preflight. Draft diagnostic PR #185 committed the adversarial real terminated-child race test FIRST at 6ceb4a518b8e61dc3d805512454fc4f944c0e4a7; RED CI #41276937317 reproduced the Missing expected exception failure on both Ubuntu and Windows. Narrow source correction ties bootstrap recovery to rebuildIfNeeded, leaving canonical bytes and staging hard links untouched for read-only lookup while retaining explicit recovery. Final diagnostic ed0efa0e2c22a69b2ed9012345a3730ab26d2cfc passed both full Ubuntu and Windows validations plus v0.13 compatibility in GREEN CI #41277058088, H82 PASS (not SKIP). Only exact validated source/test blobs e3935a0e54a26a5881db2ba9466f2f0b9310d368 / 227c8ffc868276ff565e1cacdf4334d38243d9bd were ported to authoritative draft PR #92 with updated memory.md; final integration SHA 1442d44e24b1517676698f0b7a192a923fd74686. Created draft PR #186 pinned to the identical source SHA for a second full CI run. Final-head dual Ubuntu/Windows CI must be verified before claiming two-run completion. H79 engineering review thread was resolved after its verified dual-platform CI; H82 source review thread remains open pending final-head CI. Three distinct authenticated exact-source code/architecture/security approvals, controlled physical NTFS sudden-power-loss evidence under Issue #73, and persisted deterministic risk-3 ACCEPTED remain hard blockers. PR #92/#185/#186 remain unmerged; no waiver, release or acceptance claimed.

T04-H82 exact-final-source two-run validation VERIFIED — 1 November 2026 (NOT ACCEPTED). Authoritative draft PR #92 is at immutable SHA 1442d44e24b1517676698f0b7a192a923fd74686. Test-first diagnostic PR #185 RED #41276937317 reproduced read-only index bootstrap evidence deletion on both Ubuntu and Windows; narrow source/test correction passed complete diagnostic GREEN #41277058088. Exact validated source/test blobs e3935a0e54a26a5881db2ba9466f2f0b9310d368 / 227c8ffc868276ff565e1cacdf4334d38243d9bd were ported to PR #92, with memory.md updated. Two distinct GitHub Actions runs on this identical 40-character final SHA passed all four complete Ubuntu/Windows validation jobs, including H82, v0.13 compatibility and Windows legacy restore: integration #41277705451 and source-identical CI-only witness #41277713331 (draft PR #186). Production T04 independently reviewed risk-3 acceptance correctly FAILED CLOSED with Missing exact-source independent reviews; witness acceptance SKIPPED. H79 and H82 review threads were answered and resolved with exact-source evidence; all 28/28 inline PR #92 threads are now resolved, but resolution is not independent approval. Persisted receipts still require three genuinely distinct authenticated exact-source CODE/ARCHITECTURE/SECURITY approvals, independently reviewed controlled physical NTFS sudden-power-loss evidence under open Issue #73, and an authentic persisted deterministic risk-3 ACCEPTED verdict. PR #92/#185/#186 remain unmerged; no release, waiver or acceptance claimed. Any subsequent source change requires new exact-SHA CI and independent reviews.

Navigation Menu

Repository navigation

v0.13.0 P0 — State Engine V2 T04 with complete Windows crash-durable restore #84

v0.13.0 Priority 0 — Complete T04 State Engine V2

In-scope for v0.13.0

Delivery order

v0.13 T04 integration-line reconciliation — 30 October 2026

54 remaining items

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

v0.13.0 P0 — State Engine V2 T04 with complete Windows crash-durable restore #84

Description

v0.13.0 Priority 0 — Complete T04 State Engine V2

In-scope for v0.13.0

Delivery order

Activity

eybersjp commented on Oct 30, 2026

v0.13 T04 integration-line reconciliation — 30 October 2026

eybersjp commented on Oct 30, 2026

eybersjp commented on Oct 30, 2026

eybersjp commented on Oct 30, 2026

eybersjp commented on Oct 30, 2026

eybersjp commented on Oct 30, 2026

eybersjp commented on Oct 30, 2026

eybersjp commented on Oct 30, 2026

eybersjp commented on Oct 30, 2026

eybersjp commented on Oct 30, 2026

eybersjp commented on Oct 30, 2026

eybersjp commented on Oct 30, 2026

eybersjp commented on Oct 30, 2026

eybersjp commented on Oct 30, 2026

eybersjp commented on Oct 30, 2026

54 remaining items

eybersjp commented on Oct 31, 2026

eybersjp commented on Oct 31, 2026

eybersjp commented on Nov 1, 2026

eybersjp commented on Nov 1, 2026

eybersjp commented on Nov 1, 2026

eybersjp commented on Nov 1, 2026

eybersjp commented on Nov 1, 2026

eybersjp commented on Nov 1, 2026

eybersjp commented on Nov 1, 2026

eybersjp commented on Nov 1, 2026

eybersjp commented on Nov 1, 2026

eybersjp commented on Nov 1, 2026

eybersjp commented on Nov 1, 2026

eybersjp commented on Nov 1, 2026

eybersjp commented on Nov 1, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions