docs(003): close T069 final reconciliation

specs/003-workspace-execution-spine/t069-final-reconciliation.md

@@ -0,0 +1,161 @@
+# T069 Final Reconciliation
+
+Status: **CLOSEOUT CANDIDATE — TASK TRUTH MARKED COMPLETE; NOT CANONICAL UNTIL FINAL EXACT-HEAD GATES AND MERGE**
+
+This artifact performs Spec 003 T069 evidence reconciliation only. It does not change runtime behavior, dependencies, migrations, workflow semantics, verification authority, or platform behavior. It does not start Spec 006 or authorize any daemon/session-owner, IPC, MCP/ACP/A2A, provider/plugin runtime, remote execution, Agent Fleet, Herdr, Pi, SQL, or LLM implementation.
+
+## 1. Canonical start state
+
+T069 started from exact canonical `main`:
+
+- commit: `c19ad598cd353bc53b852a693495addbd05e74a3`
+- tree: `61f008f58900f3a74a8b3f4fdb5b5dbcb25e50b3`
+- commit: `Merge pull request #63 from TheHalfMoon/fix/003-t068-independent-review-findings`
+- PR #63: merged/canonical
+
+The merge commit is GitHub-verified and has ordered parents:
+
+1. `29c394084631afd6d1890362372b8a162dac083a`
+2. `391121f5128d9006a75948ce2c328c95165e40fd`
+
+The second parent is the final PR #63 head and has the same tree as canonical main:
+
+- PR #63 final head: `391121f5128d9006a75948ce2c328c95165e40fd`
+- PR #63 final tree: `61f008f58900f3a74a8b3f4fdb5b5dbcb25e50b3`
+- canonical main tree: `61f008f58900f3a74a8b3f4fdb5b5dbcb25e50b3`
+
+Therefore the merge introduced no tree drift beyond the accepted final PR head.
+
+## 2. T068 accepted implementation and review evidence
+
+T068 is CLOSED_CANONICAL. Its accepted final implementation/review candidate was:
+
+- implementation head: `badfa984d7aa5552478aaba5b7da5819290253df`
+- implementation tree: `d5e6ffcdd97af9cf0281c2606f799fb88b9e6b0e`
+- unchanged canonical review base: `29c394084631afd6d1890362372b8a162dac083a`
+
+Exact-head deterministic evidence on that implementation head:
+
+- `quality #613` / run `32407334800` = SUCCESS
+- `windows-terminal #338` / run `32407334815` = SUCCESS
+- `release-candidate #405` / run `32407334775` = SUCCESS
+- real Windows Server 2025 + Ubuntu WSL2 T062 production proof/evidence = PASS
+- T063 100-cycle terminal lifecycle soak on Ubuntu/macOS/Windows = PASS
+- T064 pre-existing verification regression gates = PASS
+- SC-001 soak, native-Windows authority refusal, quality, and release builds = PASS
+
+The final material CodeRabbit WSL post-exit-drain finding was repaired and resolved on the bound implementation head. A fresh independent Qodo full-implementation review was explicitly bound to that exact implementation head/tree/base and returned `NO MATERIAL FINDING REMAINING` after focused re-evaluation of bounded WSL draining, object-bound history pruning, clone staging cleanup, and the complete current implementation surface.
+
+This is historical T068 acceptance evidence. T069 does not reinterpret itself as another runtime implementation review and does not mutate the accepted runtime candidate.
+
+## 3. PR #63 closeout-head evidence and canonical adoption
+
+After the accepted implementation head, PR #63 carried documentation/closeout reconciliation and restored the normal workflow definitions. Its final head was `391121f5128d9006a75948ce2c328c95165e40fd`.
+
+Exact-head PR-closeout workflows on that final head were:
+
+- `quality #623` / run `32411409486` = SUCCESS
+- `windows-terminal #348` / run `32411409624` = SUCCESS
+- `release-candidate #415` / run `32411409491` = SUCCESS
+
+PR #63 was then merged as canonical main `c19ad598cd353bc53b852a693495addbd05e74a3`, whose tree exactly equals the final PR #63 tree.
+
+Any text inside T068 evidence files stating that PR #63 "remains unmerged" or that T069 is "NOT STARTED" is preserved as historical checkpoint truth from the moment that evidence was authored. It is not current canonical repository-state truth after merge `c19ad598...`. T069 records that chronology rather than rewriting accepted historical evidence artifacts.
+
+## 4. T065-T069 acceptance-stack reconciliation
+
+The Spec 003 acceptance stack represented by this closeout candidate is:
+
+- T065 documentation update: CLOSED_CANONICAL
+- T066 correctness/safety review: CLOSED_CANONICAL
+- T067 Ponytail v4.9.0 simplicity review: CLOSED_CANONICAL
+- T068 fresh independent exact-head review and reconciliation: CLOSED_CANONICAL
+- T069 final evidence reconciliation: TASK TRUTH MARKED COMPLETE ON PR #65 CLOSEOUT CANDIDATE
+
+T069 is not yet canonical merely because `tasks.md` is checked on the branch. Canonical completion requires the final PR #65 closeout head itself to pass exact-head repository CI and a fresh independent review, followed by guarded merge. Until that merge, canonical `main` still contains T069 unchecked.
+
+The acceptance stack preserves these authority boundaries:
+
+- workspace execution/history is not verification evidence merely because Winds recorded it;
+- native-Windows workspace/ConPTY and WSL support do not imply native-Windows authoritative required-check execution;
+- `WORKTREE != SANDBOX`;
+- agent/model/shell claims are not promoted to Winds-observed or human-decided truth;
+- no automatic winner/merge/rebase/cherry-pick/push behavior is introduced;
+- no daemon/public runtime protocol/plugin/provider/remote-session runtime is implied by completion of Spec 003.
+
+## 5. Late post-closeout review artifacts on merged PR #63
+
+GitHub retains two Qodo review threads on merged PR #63 that are unresolved and not outdated. T069 records them truthfully and does not claim that all historical PR #63 threads are resolved. Their stable inline discussion/review-comment identifiers are `3825305219` and `3825305225`; both were observed as created at `2026-08-20T20:59:19Z`.
+
+### L1. `release-candidate.yml` recursive target cleanup
+
+Qodo review-comment `3825305219` reports that the release-candidate workflow uses recursive cleanup of `$CARGO_TARGET_DIR` without a separate canonical ownership/descendant check immediately before deletion.
+
+T069 disposition: **LATE_POST_CLOSEOUT_REVIEW_ARTIFACT / NOT MUTATED BY T069**.
+
+The relevant canonical workflow constructs the cleanup target under a run-scoped temporary parent created by the workflow. Nevertheless, the Qodo thread remains unresolved on GitHub. Under the current T069 authorization, workflow-semantic mutation is prohibited. T069 therefore neither resolves nor dismisses the thread and does not represent it as fixed. It remains a separately actionable workflow-hardening item if such work is later authorized.
+
+No workflow change is made in T069.
+
+### L2. Unix direct-child `fstatat` -> `unlinkat` replacement race
+
+Qodo review-comment `3825305225` reports that a same-principal concurrent rename-and-replace of an individual direct history child between name-based validation and `unlinkat` can cause the replacement name to be deleted.
+
+T069 disposition: **RECONCILED_AGAINST_ACCEPTED_T068_BOUNDARY / NO NEW CLAIM EXPANSION**.
+
+The accepted T068 A14 disposition already narrowed the Unix security claim explicitly: POSIX `unlinkat` remains name-based, and Winds does not claim protection when an external same-principal process concurrently replaces an individual direct child name inside the private session directory between validation and unlink. The retained accepted claim is limited to the already-bound session-directory object, the supported Winds writer path, flat/non-recursive deletion, and prevention of redirection into another directory tree.
+
+CodeRabbit independently re-evaluated this exact limitation during T068, confirmed that the narrowed wording matched the offered alternative disposition, withdrew its corresponding finding, and resolved that thread. The later unresolved Qodo thread identifies the same excluded same-principal direct-child race; T069 does not silently expand the security claim or introduce new runtime containment.
+
+The GitHub fact remains explicit: the Qodo thread itself is still unresolved on merged PR #63. T069 records its disposition but does not mutate source or falsely state that GitHub marked the thread resolved.
+
+## 6. T069 reconciliation-candidate evidence
+
+PR #65 initial reconciliation head:
+
+- head: `5159ee1eebc1a65caac80dc62771a4ecf2bfced4`
+- tree: `7affc1d80113f15ef5840c212c7304c1f4f05af7`
+- changed path at that stage: `specs/003-workspace-execution-spine/t069-final-reconciliation.md` only
+- `quality #625` / run `32420641899` = SUCCESS
+- author-side documentation/evidence-integrity verdict: `AUTHOR_RECONCILIATION_REVIEW_PASS`
+- author-side simplicity verdict: `PONYTAIL_PASS_NO_REQUIRED_REMOVALS`
+- fresh independent Qodo review explicitly identified commit `5159ee1eebc1a65caac80dc62771a4ecf2bfced4` and reported Bugs (0), Rule violations (0), Requirement gaps (0), and no material issues
+
+Those results justified creating the T069 task-truth closeout candidate. They do not satisfy exact-head gates for a later commit that changes `tasks.md` or this artifact. Every later closeout head invalidates earlier-head CI/review as final merge evidence.
+
+## 7. Final closeout-head gate
+
+The final T069 closeout head MUST satisfy all of the following before merge:
+
+1. Canonical base remains `c19ad598cd353bc53b852a693495addbd05e74a3` or any later main movement is explicitly reconciled.
+2. Changed paths remain exactly T069 documentation/task-truth surfaces; no runtime, dependency, migration, or workflow-semantic change is present.
+3. Repository deterministic CI applicable to the exact closeout head is green.
+4. At least one fresh independent reviewer inspects that exact closeout head after the task-truth/artifact changes.
+5. All material findings against that exact closeout head are reconciled.
+6. Merge uses an exact expected-head guard; if the head moves, prior merge authorization/evidence is stale.
+7. Only after merge may Spec 003 be described as `CLOSED_CANONICAL`.
+
+The final closeout SHA is intentionally not written into this file, which would create a self-referential follow-up commit. The PR metadata, exact-head CI, and independent review bind the final immutable candidate externally.
+
+## 8. Future-research / Spec 006 boundary
+
+PR #64, `docs: finalize future agentic development master plan`, is merged as `29c394084631afd6d1890362372b8a162dac083a` and is future-research documentation only. It does not amend Spec 003 runtime scope and does not authorize Spec 006 implementation.
+
+Canonical completion of T069 closes Spec 003 only. Spec 006 remains separately gated by explicit future authorization and the normal Constitution -> Spec -> Plan -> Tasks sequence.
+
+## 9. Current verdict
+
+```text
+T068=CLOSED_CANONICAL
+T069_TASK_TRUTH_MARKED=YES
+T069_CANONICAL=NO
+T069_MODE=DOCS_ONLY
+SPEC_003_CANONICAL_COMPLETE=NO
+SPEC_006_STARTED=NO
+RUNTIME_MUTATION=NO
+DEPENDENCY_MUTATION=NO
+MIGRATION_MUTATION=NO
+WORKFLOW_SEMANTIC_MUTATION=NO
+```
+
+This is the final closeout-candidate posture. The repository may claim `T069=CLOSED_CANONICAL` and `SPEC_003=CLOSED_CANONICAL` only after this final docs-only head passes its exact-head gates and is merged into canonical main.

specs/003-workspace-execution-spine/tasks.md

@@ -52,7 +52,7 @@ This checklist records implementation/evidence truth for Spec 003. A checked ite
 - [x] **T066** Complete correctness/safety review on the exact final implementation head, explicitly covering PTY/process ownership, stale PID reuse, Windows/Unix close semantics, WSL path/domain truth, SQLite partial transitions, shell-telemetry source attribution, secret/history persistence, and separation from verification authority. **Canonical evidence:** PR #58 final accepted head `8601b7dbb44582a284813bbd50a44aeb1afd24f1` passed quality #495, windows-terminal #233, and release-candidate #302, including Ubuntu/macOS format+Clippy+full tests, native-Windows full touched-surface tests, real Windows+Ubuntu WSL2 integration, T063 soak on Ubuntu/macOS/Windows, T064 verification regression on Ubuntu/macOS, SC-001, native-Windows authority refusal, and Linux/macOS packaging. The T066 review exposed and repaired the missing user-facing restart reconciliation, startup-vs-bulk ownership races, lease unlink pathname/inode split-brain, same-kind deferral, display proof/read races, an intermediate ownership-directory TOCTOU, cross-owner durable-exit finalization, recoverable clock-regression handling, and multiple acceptance-fixture reliability gaps. The final design uses exact-ID retained SQLite ownership leases with domain-separated SHA-256 filenames directly under canonical `WINDS_HOME`, targeted reconciliation with unknown end/duration on ownership loss, no PID reconnect/blind signaling, post-proof display refresh, and durable observed-exit finalization only under exact ownership recovery. `src/command.rs` regression coverage proves starting command B cannot finalize unrelated command A; the binary T066 fixture proves future-dated stale rows still reconcile fail-closed without fabricating timing. Fresh exact-head Qodo merge-gate review found no remaining blocking correctness/safety/scope issue; all review threads were resolved, including the late Cubic findings, with the broad proposal to silently skip corrupt/persistence reconciliation failures rejected because FR-019/FR-029 require conservative truth. PR #58 merged with expected-head guard as canonical main `af89ee6a65bc796ddb74aee01becca3a7af7af8a`. This closes **T066 only**; it does not start or satisfy T067 Ponytail review, T068 independent review, or T069 final Spec 003 reconciliation, and adds no daemon/public runtime protocol/plugin/provider/MCP/ACP/A2A/Agent Fleet/Herdr behavior or native-Windows verification-authority claim.
 - [x] **T067** Complete Ponytail v4.9.0 simplicity review on the exact final implementation head. Challenge every dependency/module/protocol; remove custom multiplexer/renderer/plugin/provider/environment-manager machinery not required by Spec 003. **Canonical evidence:** PR #60 review head `b216f36bcd3773860cdb427b4b54bdd278d9f4e9` added only `t067-ponytail-review.md`, bound the review to exact final implementation head `8601b7dbb44582a284813bbd50a44aeb1afd24f1` / tree `1d056bead423f02c62ace10b798ceb5c1a1c191c`, and recorded verdict `T067_REVIEW_PASS_NO_REQUIRED_REMOVALS`. The review challenged all six direct dependencies, concrete module seams, forbidden daemon/public-protocol/plugin/provider/renderer/multiplexer surfaces, custom trait-framework risk, module-wide `dead_code` allowances, large-file refactor pressure, speculative SQL/LLM/Agent Fleet/Herdr/Pi abstractions, and the T066 ownership-lease machinery. It found no dependency, module, protocol, service boundary, interface, or runtime subsystem that can be removed without deleting an accepted requirement or replacing concrete code with more machinery; no runtime/dependency/migration/workflow change was required. Exact-head quality #499 passed on the review PR; Qodo reviewed `b216f36...` with Bugs (0), Rule violations (0), Requirement gaps (0), and zero review threads remained. PR #60 merged with expected-head guard as canonical main `9128133573e80dbbe4d467b95873a6740e64d672`. This closes **T067 only**; PR #60 artifact reviews do not start or satisfy T068 independent review, T068/T069 remain not started, and Spec 003 is not yet complete.
 - [x] **T068** Obtain and reconcile at least one independent reviewer pass on the exact final implementation head. External summaries or reviews bound only to older heads do not satisfy this task. **Closeout evidence:** PR #63 final reviewed implementation head `badfa984d7aa5552478aaba5b7da5819290253df` / tree `d5e6ffcdd97af9cf0281c2606f799fb88b9e6b0e`, against unchanged canonical base `29c394084631afd6d1890362372b8a162dac083a` with `behind_by=0`, passed quality #613, windows-terminal #338, and release-candidate #405 on that same exact head. The Windows gate includes real Windows Server 2025 + Ubuntu WSL2 T062 production proof/evidence; release-candidate includes T063 100-cycle soak on Ubuntu/macOS/Windows, T064 regression, SC-001, native-Windows authority refusal, quality, and release builds. All material reconciliation threads are resolved, including the final CodeRabbit post-exit WSL drain finding; zero material review threads remain unresolved. Fresh independent Qodo full-implementation review was explicitly bound to the exact head/tree/base above and returned **NO MATERIAL FINDING REMAINING**, including focused re-evaluation of bounded WSL post-exit draining, object-bound history pruning, clone staging cleanup, and the complete current implementation surface. This checks T068 only; PR #63 remains draft/unmerged pending the documentation-only closeout head landing gate, T069 remains NOT STARTED, and Spec 003 remains incomplete.
-- [ ] **T069** Reconcile deterministic CI, platform/WSL evidence, soak results, correctness/safety, Ponytail, and independent-review findings into final canonical task truth before making the Spec 003 completion claim.
+- [x] **T069** Reconcile deterministic CI, platform/WSL evidence, soak results, correctness/safety, Ponytail, and independent-review findings into final canonical task truth before making the Spec 003 completion claim. **Closeout evidence:** PR #65 initial reconciliation head `5159ee1eebc1a65caac80dc62771a4ecf2bfced4` / tree `7affc1d80113f15ef5840c212c7304c1f4f05af7` added only `t069-final-reconciliation.md`; exact-head quality #625 / run `32420641899` passed; author-side documentation/evidence-integrity review returned `AUTHOR_RECONCILIATION_REVIEW_PASS` and Ponytail returned `PONYTAIL_PASS_NO_REQUIRED_REMOVALS`; fresh independent Qodo review explicitly identified commit `5159ee1eebc1a65caac80dc62771a4ecf2bfced4` and reported Bugs (0), Rule violations (0), Requirement gaps (0), and no material issues. The artifact reconciles PR #63 canonical adoption, accepted T068 implementation/closeout evidence, the historical status wording inside T068 artifacts, and the two late unresolved Qodo threads on merged PR #63 without falsely claiming those threads are resolved; it preserves the accepted narrowed Unix same-principal direct-child replacement boundary and makes no workflow-semantic/runtime/dependency/migration/platform change. This task-truth update creates the final T069 closeout candidate; it does not by itself authorize merge, and the exact closeout head must still pass repository CI plus a fresh independent exact-head review before canonical adoption. Spec 006 remains NOT STARTED and separately gated.
 
 ## Explicit Follow-On Specifications