Record Store acceptance and propose legacy Setup owner resolution

docs/goal-delivery.md

@@ -77,16 +77,21 @@ verifies the original unacknowledged Location-settlement regression actually
 executed on Linux/macOS/Windows. This accepts its simulated lease-owner case,
 not native confinement or the complete producer matrix.
 
-Continue the first workstream on `test/cwd-wal-commit-ack`: the
-[Store commit correction](../openspec/changes/complete-plugin-hook-runtime/store-commit-uncertainty.md)
-fences generic errors after a transaction has ended, preserves known rollback,
-and verifies no CwdChanged or later shell dispatch follows the uncertain outcome.
-The real WAL-error fixture and main comparison pass locally after correction;
-current-head hosted acceptance remains required. The new replay case uses a fresh
-runtime over the same Store rather than a process restart. Keep native activation
-and Linux dependency changes behind their existing review/acceptance gates. The
-complete Setup marker/migration choices and DirectoryAdded proposal also need
-their recorded review before implementation.
+PR #90 merged at `5ed50bff` after all 16 checks passed. Its
+[source-bound receipt](../openspec/changes/complete-plugin-hook-runtime/evidence/store-commit-bb91e32d.json)
+verifies both commit-boundary cases and runtime lost-ack/replay behavior on
+Linux/macOS/Windows, with suite totals and the unverified Windows leaked-process
+warning retained. It accepts that correction, not the full producer matrix.
+The replay case uses a fresh runtime over the same Store rather than a process
+restart.
+
+Continue review on `spec/setup-legacy-admission-review`. The
+[legacy Setup owner-resolution candidate](../openspec/changes/complete-plugin-hook-runtime/setup-legacy-bootstrap-review.md)
+proposes the missing migration policy and its compatibility exception. The
+complete S1 decision is pending; publishing or merging the proposal does not
+approve it or implement markers/init. Preserve the separate Linux support and
+DirectoryAdded design-review gates. No dependent behavior or native activation
+is selected by this documentation follow-up.
 
 Native confinement foundations and regressions exist, but
 production enforcement and the remaining plugin/hook scope are incomplete. The

openspec/changes/complete-plugin-hook-runtime/evidence/store-commit-bb91e32d.json

@@ -0,0 +1,74 @@
+{
+  "head": "bb91e32d35a22fcd459b488c1f24eea6cac78091",
+  "base": "bbc233d572b44468bd906308687de33f6e7c7954",
+  "prospective_merge": "89d99aeea8acefff6c1d809af1f3dcb92e093beb",
+  "tree": "e6aedfa0600fc2ea74b11108d9d6ee3fc8812881",
+  "head_tree_equal": true,
+  "status": "Accepted Store correction: all 16 current-head checks passed; the full goal remains incomplete.",
+  "checks_passed": 16,
+  "platforms": {
+    "linux": {
+      "head": "bb91e32d35a22fcd459b488c1f24eea6cac78091",
+      "checkout": "89d99aeea8acefff6c1d809af1f3dcb92e093beb",
+      "tree": "e6aedfa0600fc2ea74b11108d9d6ee3fc8812881",
+      "platform": "linux",
+      "named_cases_passed": [
+        "committed_wal_error_stops_later_mutations",
+        "rejected_commit_rolls_back_without_stopping_the_writer",
+        "cwd_changed_lost_commit_ack_is_silent_and_replay_does_not_dispatch",
+        "full_queue_times_out_with_busy"
+      ],
+      "summaries": [
+        "2026-10-31T20:54:07.9029731Z      Summary [1244.447s] 5508 tests run: 5508 passed (2 slow), 21 skipped"
+      ],
+      "warnings": [],
+      "log_sha256": "9d971f8f9ccc76e5b997d4460f0c778c48c532c1328313f1a4706630342cd200",
+      "job_url": "https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41238584041/job/124647570206"
+    },
+    "macos": {
+      "head": "bb91e32d35a22fcd459b488c1f24eea6cac78091",
+      "checkout": "89d99aeea8acefff6c1d809af1f3dcb92e093beb",
+      "tree": "e6aedfa0600fc2ea74b11108d9d6ee3fc8812881",
+      "platform": "macos",
+      "named_cases_passed": [
+        "committed_wal_error_stops_later_mutations",
+        "rejected_commit_rolls_back_without_stopping_the_writer",
+        "cwd_changed_lost_commit_ack_is_silent_and_replay_does_not_dispatch",
+        "full_queue_times_out_with_busy"
+      ],
+      "summaries": [
+        "2026-10-31T21:13:23.6390030Z      Summary [1190.236s] 5508 tests run: 5508 passed (1 slow), 23 skipped"
+      ],
+      "warnings": [],
+      "log_sha256": "cf704f297ef38e45ba952bbc7b81986991997b2ef6b016a9b81ee43bcac06dbc",
+      "job_url": "https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41238584041/job/124647570302"
+    },
+    "windows": {
+      "head": "bb91e32d35a22fcd459b488c1f24eea6cac78091",
+      "checkout": "89d99aeea8acefff6c1d809af1f3dcb92e093beb",
+      "tree": "e6aedfa0600fc2ea74b11108d9d6ee3fc8812881",
+      "platform": "windows",
+      "named_cases_passed": [
+        "committed_wal_error_stops_later_mutations",
+        "rejected_commit_rolls_back_without_stopping_the_writer",
+        "cwd_changed_lost_commit_ack_is_silent_and_replay_does_not_dispatch",
+        "full_queue_times_out_with_busy"
+      ],
+      "summaries": [
+        "2026-10-31T21:09:04.5968084Z      Summary [1002.821s] 3785 tests run: 3785 passed (1 leaky), 647 skipped",
+        "2026-10-31T21:09:06.8480681Z      Summary [   0.028s] 4 tests run: 4 passed, 387 skipped",
+        "2026-10-31T21:09:10.8798012Z      Summary [   0.094s] 9 tests run: 9 passed, 0 skipped",
+        "2026-10-31T21:09:45.7707334Z      Summary [   1.791s] 18 tests run: 18 passed, 0 skipped"
+      ],
+      "warnings": [
+        "2026-10-31T20:57:50.4748467Z         LEAK [  22.337s] ( 520/3785) cyber-cli::messages_cli an_exec_session_refuses_messages_unless_it_accepts_them"
+      ],
+      "log_sha256": "8bbfe6f0736c573f1df589b97704d2f6e103b44fd435ff160dacdb7e37b4436b",
+      "job_url": "https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41238584041/job/124647570101"
+    }
+  },
+  "accepted_merge": "5ed50bffe185877d0a95392a9dafeb03384ebbec",
+  "accepted_tree": "e6aedfa0600fc2ea74b11108d9d6ee3fc8812881",
+  "accepted_tree_matches": true,
+  "limits": "Store correction acceptance only. Runtime replay uses the same failed Store, not a restarted process. The Windows messaging leaked-process warning has unverified cause. Native plugin enforcement, other producers and task 5.3 remain incomplete."
+}

openspec/changes/complete-plugin-hook-runtime/setup-design.md

@@ -132,6 +132,11 @@ the two epoch/key choices alone does not settle this newly identified legacy
 bootstrap requirement. The full original Setup contract remains required until
 a revised compatibility decision is reviewed.
 
+The [owner-resolution proposal](setup-legacy-bootstrap-review.md) supplies a
+concrete candidate for that review, including a deliberate legacy compatibility
+exception and its CLI/API, concurrency and retry consequences. It is not accepted
+by recording the proposal; S1 and the original full contract remain open.
+
 Required adversarial cases include root/attempt deletion before restart, a
 previously deleted root with another parent's child surviving at that Location,
 an empty settled attempt,
@@ -173,7 +178,7 @@ remain authoritative; init grants no additional permissions.
 
 ## Implementation and acceptance tasks
 
-- [ ] S1 Review both epoch/key decisions and the legacy-deletion bootstrap requirement above; record the accepted complete migration/support decision before implementation.
+- [ ] S1 Review both epoch/key decisions and the legacy-deletion bootstrap requirement above, including the [owner-resolution candidate](setup-legacy-bootstrap-review.md); record the accepted complete migration/support decision before implementation.
 - [ ] S2 Add bounded events, marker projection/migration and writer-atomic root
   Session admission across separate durable owners; cover concurrent creation,
   children, legacy/deleted history and rebuild after Session deletion with actual

openspec/changes/complete-plugin-hook-runtime/setup-legacy-bootstrap-review.md

@@ -0,0 +1,128 @@
+# Legacy Setup bootstrap: proposed owner resolution
+
+Status: **proposal requiring S1 review, not approved or implemented**. This
+supplies a concrete compatibility choice for the deletion gap in
+[setup-design.md](setup-design.md#session-deletion-and-legacy-history-review).
+It does not authorize schema, marker or init implementation. The full original
+Setup contract remains required until a complete revised decision is accepted.
+
+## Proposed decision
+
+Retain the proposed Store-lifetime installation epoch and exact stored directory
+key. Do not infer that Setup never ran from missing Session rows or receipts.
+For an unproven legacy Location, require a fresh owner decision before dispatching
+another potentially mutating automatic attempt. Permit an explicit new attempt
+or an explicit decision to consume automatic eligibility without dispatch.
+
+This is a compatibility revision for ambiguous legacy history. It is not the
+claim that universal refusal satisfies automatic Setup. New Stores retain normal
+automatic first-root behavior, and all other Setup requirements remain required.
+The changed behavior for legacy root creation needs explicit review together
+with the epoch/key choices; accepting those two choices alone is insufficient.
+
+## Classification owned by the Store
+
+| Authoritative state | Proposed result |
+| --- | --- |
+| Store proven newly initialized with its epoch, with no legacy history to migrate | Normal atomic first-root Session/automatic-attempt admission. |
+| Existing marker or admitted attempt | Retain its identity and actual status; normal creation cannot dispatch it again. |
+| Retained root-creation evidence at the exact stored directory | Consume legacy automatic eligibility without another effect; record the evidence, not fabricated successful handlers. |
+| Valid retained, non-synthetic Setup receipt facts at that key | Retain positive use and known per-handler outcomes; consume automatic eligibility without replay. An individual receipt does not prove a whole attempt completed. |
+| Existing legacy Store with no complete applicable proof, including deleted roots, child-only surviving history or an exhausted bounded search | Classify history as unproven. Missing facts cannot make the Location fresh. Apply the owner-resolution flow below. |
+
+Freshness needs Store initialization provenance captured under its ownership
+lock before a legacy migration can erase that distinction. An empty Session/event
+table, absence of receipt projections, filesystem timestamps, reinstall, process
+restart or an alias spelling is not a freshness witness. Restoring/copying an
+existing Store retains its epoch and provenance. Normal Session deletion cannot
+create a new installation. The exact initialization/migration implementation is
+an S2 prerequisite and must preserve the existing atomic schema initialization.
+
+Read positive legacy evidence in bounded pages and with a finite search budget.
+Budget exhaustion can yield only unproven history, never a proof of absence.
+Do not inspect deleted prompt contents or use provider usage as a history oracle.
+Bind retained evidence to its actual schema, source ID and directory key; do not
+silently canonicalize aliases or import synthetic test receipts as authority.
+
+## Proposed owner flow
+
+Ordinary root creation for an unproven legacy Location returns a structured
+`SetupHistoryUnprovenError` before creating the Session, admitting input, running
+a model Turn or dispatching Setup. It reports the epoch, validated directory key
+and a bounded resolution revision. It must not silently create the root while
+pretending automatic Setup completed or while hiding that Setup was suppressed.
+Child creation still cannot consume automatic eligibility or claim root authority.
+
+The owner has three explicit choices:
+
+1. **Run a new Setup attempt.** Use the proposed `cyber --init` owner operation,
+   with a new request ID. This authorizes a new attempt, not replay or settlement
+   of an old unknown invocation. Preserve all earlier uncertainty. Display that
+   prior execution cannot be ruled out; do not claim the Location was never used.
+2. **Continue without Setup.** Proposed CLI spelling:
+   `cyber --init --skip-legacy-setup --cwd <directory>`. This resolves only an
+   unproven legacy claim, creates the requested root and consumes automatic
+   eligibility with an explicit skipped outcome. It dispatches no Setup handler
+   and emits no successful Setup observation. It is not a general bypass for
+   fresh-Store automatic Setup. A later deliberate init needs a new request ID.
+3. **Cancel.** Create no Session, attempt or consumed marker. A later request
+   still needs resolution if history remains unproven.
+
+Extend the already proposed `POST /api/v1/setup` request with an optional
+`legacy_resolution` object containing the observed resolution revision and action
+`new_attempt` or `skip_automatic`. Its creation-input validation and 128-byte
+request-ID bound remain unchanged. The CLI performs the owner preflight needed
+to obtain the revision; a stale resolution is refused without effects. Explicit
+init for an otherwise ordinary Location retains its existing new-attempt meaning.
+
+An interactive client may present these choices after the structured refusal.
+An unattended ordinary creation cannot choose on the user's behalf. Explicit
+init/skip requests still obey existing non-interactive, trust, Mode, pure/managed
+policy and permission rules; they do not manufacture permission approvals.
+Use ordinary owner API authority. Prompt text, hook rewrites, plugin callbacks and
+`session/prompt` cannot supply a migration decision or assert that history is fresh.
+
+## Atomicity, ownership and retries
+
+Resolve the installation/directory claim, create the root, admit the new attempt
+or explicit skip, and bind request deduplication in the bounded multi-aggregate
+writer transaction required by S2. Recheck the epoch, exact key, resolution
+revision, existing marker and current owned context in that transaction.
+Competing legacy resolutions cannot both claim the same unresolved revision.
+A stale loser must not silently turn into another fresh attempt or retry with
+a new request ID. Normal concurrent creators resume the ordinary creation rules
+only after the legacy claim has been resolved.
+
+Dispatch after acknowledged commit and outside ownership locks. Existing live
+attempts, native owners and uncertain cleanup still need their normal settlement
+or reconciliation; a migration choice cannot bypass them. A fresh explicit
+intent never rewrites an older unknown outcome to completed. A lost commit
+acknowledgement follows the Store uncertainty fence and cannot trigger retry.
+
+Keep marker, resolution, attempt and request records independent of Session
+deletion. An exact retry returns the original result and deletion status; it
+cannot recreate a deleted Session or dispatch again. Changed-input reuse is
+refused. Reprojection uses self-contained owner facts and preserves consumed,
+skipped and unknown states without requiring a surviving Session projection.
+The request digest includes the epoch, exact key, resolution action/revision and
+validated root-creation inputs. Check exact deduplication before rejecting a
+consumed revision, so an operation's own successful resolution cannot make its
+transport retry look stale. A different action or revision under the same request
+ID is changed-input reuse, not another chance to dispatch.
+
+## Review and implementation consequences
+
+S1 must accept or replace this compatibility policy, the Store-lifetime epoch
+and the exact directory key together. No S1 checkbox is closed by this proposal.
+If accepted, revise the unconditional concurrent-root-creation description and
+the Setup delta scenarios to make the unproven-legacy exception explicit before
+S2 code. No policy is selected merely by recording or mechanically merging this
+review document. If declined, retain the original full requirement and return a
+different complete migration decision rather than silently choosing a fallback.
+
+Required acceptance cases include all classification rows; deleted roots with
+another parent's surviving child; partial and synthetic receipts; budget
+exhaustion; concurrent init/skip/root creation; stale revisions and changed inputs;
+policy refusal; empty versus unresolved catalogs; lost commit/handler outcomes;
+process restart and projection rebuild; deletion before an exact retry; and no
+model Turn, extra permission, duplicate effect or false successful observation.

openspec/changes/complete-plugin-hook-runtime/store-commit-uncertainty.md

@@ -1,6 +1,7 @@
 # Unacknowledged Store commits and CwdChanged
 
-This fixes an observed durability-boundary gap while implementing task 5.3. It
+This fixes an observed durability-boundary gap while implementing task 5.3.
+PR #90 is accepted at `5ed50bff` after all 16 current-head checks passed. This
 does not close the full producer matrix or the plugin/native workstream.
 
 ## Failure and main comparison
@@ -68,6 +69,31 @@ and all 13 Location activity tests pass after the fix. Scoped Clippy for all Sto
 targets and the actual Location test target passes with warnings denied. Formatting,
 strict OpenSpec (114/0) and spec lint (0 errors/25 warnings) pass. Those results do not claim
 the new uncertain-commit case was tested through a process restart, on Windows
-or Linux, or across the full local workspace. Local code/security review found no blocking issue. Hosted acceptance and final
-PR review remain required before merging this follow-up. Native support/design
+or Linux, or across the full local workspace. Local code/security review found no blocking issue. The platform acceptance and
+final merge review recorded below complete this Store correction only. Native support/design
 review gates, DirectoryAdded/Setup and task 5.3 remain open.
+
+
+## Accepted platform execution
+
+The [source-bound receipt](evidence/store-commit-bb91e32d.json) records actual
+Linux/macOS/Windows execution at head
+`bb91e32d35a22fcd459b488c1f24eea6cac78091`. All three checkout logs identify merge
+`89d99aeea8acefff6c1d809af1f3dcb92e093beb`, tree
+`e6aedfa0600fc2ea74b11108d9d6ee3fc8812881`, equal to the reviewed head and
+accepted main merge `5ed50bffe185877d0a95392a9dafeb03384ebbec`.
+
+Both new Store regressions, the bounded writer-queue case and the runtime
+lost-ack/replay case execute and pass on every platform. Linux/macOS each pass
+5,508 workspace tests (21/23 skipped, 2/1 slow). Windows passes 3,785 selected
+tests (647 skipped), plus four metadata, nine migration and 18 AppContainer
+checks. Its corrected profile executes the writer unit tests instead of
+silently omitting them. The receipt retains actual suite totals and log hashes.
+
+Windows reports one leaked-process warning in
+`messages_cli::an_exec_session_refuses_messages_unless_it_accepts_them`; its cause
+is unverified. No flaky or timeout result is reported in the three inspected
+jobs. This record does not turn source listing or cross-compilation into native
+execution evidence. It preserves the runtime replay/process-restart distinction
+above and leaves the complete task 5.3, native admission and other goal features
+open.