[vanedaltro]

SQLite can report a WAL callback error after COMMIT has already persisted the transaction. The writer previously classified a generic error as nonfatal, leaving later mutations available despite the unacknowledged outcome. Inspect transaction state before Drop cleanup: errors after the transaction ended now use the existing fatal StorageUnavailableError path. COMMIT errors that leave the transaction active retain rollback and their existing classification, so known nonfatal rejections can still be followed by valid work.

Add a Store regression that proves committed data through a second connection and requires later mutations to be fenced, plus a deferred-constraint case proving known rollback remains usable. Add a runtime regression that commits an idle exit but loses its acknowledgement, requires no successful CwdChanged or later host-shell invocation, and loads the same committed identity through a fresh runtime without dispatching its handler. The replay case uses the same Store, not a restarted process. Reuse the Location fixture for the existing and new cases.

Rusqlite hooks are enabled only in dev dependencies. The fixture uses SQLite's documented post-commit WAL boundary; it introduces no production fault API, schema, public error type, native support floor, or capability change. Clarify the existing OpenSpec durability boundary and retain the actual main failure receipt/log. Update delivery notes and source-bound #89 acceptance without closing task 5.3 or other workstreams.

Verification:

• Before fix: the exact new Store case fails on main 5d5826b72d41d6a833b523237bdbbd85ac51d31a, with only the test and test-only hook feature overlaid. Its second connection sees the committed value before the named fatal-outcome assertion fails. That production writer is byte-identical in accepted main Test CwdChanged uncertainty and record FileChanged acceptance #89.
• cargo test -p cyber-store: all 49 tests pass, including process-kill recovery and both new commit cases.
• cargo test -p cyber-server --test location_activity: all 13 tests pass, including the lost-ack case and refusal before host-shell invocation.
• Scoped Clippy on all Store targets and the actual Location test target, with --no-deps -- -D warnings: passes.
• Formatting/whitespace pass; strict OpenSpec 114 passed/0 failed; spec lint 0 errors/25 warnings. Receipt JSON parses and the retained original-log hash matches.
• Main integration preserved the exact tested Rust tree; subsequent edits are acceptance/delivery records. Local code/security review found no blocking issue.
• Tests ran locally on macOS. The full local Rust workspace and native Linux/Windows execution of this correction were not run; fresh hosted current-head acceptance is required. Test CwdChanged uncertainty and record FileChanged acceptance #89's passing platform results belong to its earlier simulated settlement case and are not substituted for this change's acceptance.

This is a durability correctness fix and task 5.3 regression coverage. Native plugin enforcement/protocols, DirectoryAdded/Setup, daily coding and binary editor remain incomplete; explicit native/support/design review gates are preserved.

Windows coverage correction: the original curated profile selected only two migration cases from the Store unit binary. The current profile also selects the portable writer::tests:: module, so both new commit-boundary regressions and the existing bounded-queue case execute on Windows. Local cargo nextest list --profile ci-windows output confirms both new Store cases and the runtime lost-ack case are non-ignored matches. This is selection validation on macOS, not Windows execution. Rust implementation/test source is unchanged; fresh current-head native CI is required. Earlier-head CI is superseded because of this genuine coverage correction.

Current-head Linux acceptance: the Linux workspace job passed all 5,508 tests (21 skipped, 2 slow). Independently inspected logs confirm actual PASS results for the committed-WAL error, known deferred rollback, bounded writer queue, and runtime lost-ack/replay cases. The actual checkout is 89d99aeea8acefff6c1d809af1f3dcb92e093beb, tree e6aedfa0600fc2ea74b11108d9d6ee3fc8812881, identical to this head and reviewed prospective merge. No flaky, timeout or leaked-process warning was reported in that job. macOS and native Windows acceptance remain pending.

Current-head native Windows acceptance: the Windows job passed all 3,785 selected tests (647 skipped), plus metadata (4), migration (9) and AppContainer (18) checks. The committed-WAL error, known deferred rollback, bounded writer queue and runtime lost-ack/replay cases each actually execute and PASS. Actual checkout binds to the same reviewed 89d99aeea8acefff6c1d809af1f3dcb92e093beb tree as Linux. The job reports one leaked-process warning in messages_cli::an_exec_session_refuses_messages_unless_it_accepts_them; its cause is unverified. macOS workspace acceptance remains pending.

Final current-head acceptance: all 16 checks passed. The macOS workspace job passed 5,508 cases (23 skipped, 1 slow), with actual PASS results for both new Store cases, the bounded writer queue and the runtime lost-ack case. Linux passed 5,508 cases (21 skipped); Windows passed 3,785 selected cases (647 skipped) and its metadata/migration/AppContainer checks. No timeout or flaky result is reported in the three inspected logs. Windows reports the one messaging leaked-process warning documented above; its cause remains unverified. Actual checkout logs all bind to 89d99aeea8acefff6c1d809af1f3dcb92e093beb, tree e6aedfa0600fc2ea74b11108d9d6ee3fc8812881, equal to the reviewed head and final prospective merge against unchanged main. Final review found no blocking issue. This accepts the Store correction; task 5.3 and the full goal remain open.