# Gate 3 increment 4 checkpoint reliability report

Date: 2026-08-16
Exact base: `c1b34503ddd3cb797e5d70671c47afcabfe73832`
Exact core implementation/mutation head:
`9da022e6f3bc73d17fd31d4da70b42e3ca052ba2`
Windows durability repair commit:
`2771dd42cacec3e137804f0ba0e1b12c5d611c0d`
Delivery head: `6be6b01ad7a9b4c4fc52280b49f3488e2f8ba98d`
Canonical merge: `d7d2ad566af778b1d315616bbea8b8a3c4dd2191` (PR #104)
Status: PASS; exact-head audit, rebase merge, and canonical post-merge evidence
complete

## Results

| Gate | Result |
|---|---|
| Focused checkpoint/policy contracts | 176 passed in 6.08s at the exact core head; the repaired delivery tree passed 180 tests in 6.47s |
| Mandatory CPU matrix | Exact core head — Python 3.10: 1,878 passed in 88.21s; Python 3.11: 1,878 passed in 80.63s. Repaired delivery tree — Python 3.12: 1,881 passed, 2 expected xfails in 54.51s. Canonical post-merge Python 3.12: 1,883 passed in 84.84s with no failures, errors, or skips. Nine conditional tests remained deselected by policy |
| Repository coverage | Canonical exact-base 76.59% statements / 63.17% branches; canonical merge 76.76% / 63.49% |
| Mature CPU scope | 93.12% statements / 82.60% branches before; 93.20% / 82.86% after |
| Changed executable lines | 143/143 (100%) against the exact base on Python 3.12 |
| Touched production modules | 2/2 pass exact-base line and branch no-regression |
| Persistence seam | `persistence_contracts.py`: 100% statements and 100% branches (171 statements, 60 branches) |
| Abliteration runtime | 50.82% statements / 38.03% branches before; 50.91% / 38.03% after |
| Selective mutation | Canonical post-merge: 1,618/1,831 killed (88.37%); 208 survived; 5 timed out; 0 no-test, suspicious, skipped, interrupted, or segfault results |
| Changed persistence mutation | Exact core head: 229/229 killed. Repaired delivery tree: 233/233 killed; 0 survived or timed out |
| Mutation runtime | Canonical post-merge: 2,043.17s; 624,932 KiB maximum parent RSS; required-target guard passed |
| Repeatability | Canonical post-merge: 497 tests passed in each of three file orders/hash seeds; 47.315s total; no flake candidates or consistent failures |
| Package | sdist and wheel built; metadata, contents, isolated import, version, module entry point, and console entry point passed on Python 3.12 |
| Supply chain | Pinned `uv 0.12.4` lock, all-extras import, Gitleaks, Python 3.10–3.12 vulnerability audits, wheel-bound CycloneDX SBOM, and license policy passed |
| Windows portability | The first hosted lane correctly blocked delivery after exposing `os.O_RDONLY` as an invalid Windows `_commit`/`fsync` handle (23 failed, 62 passed). The repaired selector uses `O_RDWR | O_BINARY` on Windows and `O_RDONLY` elsewhere; the final exact-head and canonical post-merge Windows lanes each passed all 89 contracts |

The mandatory Python lanes remain below the 240-second policy budget. The final
Python 3.12 test time measured 1.06s faster than the exact-base 55.57s while
adding 51 passing tests. The slowest Python 3.12 test remains the existing
offline model save/reload slice at 5.364s; no new checkpoint test exceeds an
owned duration budget.

## Contracts added

1. A staged checkpoint must contain the exact prepared metadata, non-empty JSON
   model and tokenizer configurations, and either regular direct weights or a
   complete safe sharded-weight map. Missing, empty, corrupt, truncated,
   link-backed, or traversal-bearing artifacts fail before promotion.
2. Every regular staged artifact is flushed, nested directory entries are
   flushed bottom-up where the platform supports directory fsync, and the
   destination parent is flushed after backup, promotion, rollback, and durable
   cleanup transitions.
3. A persistent sibling lock serializes cooperative threads and processes that
   commit to the same destination. Concurrent complete writers may replace one
   another, but readers never observe a partially promoted checkpoint.
4. Writer failure and `BaseException` cancellation are injected before commit
   and at tree sync, backup replacement, backup-parent sync, promotion,
   promotion-parent sync, and rollback. Existing destinations are restored;
   newly created destinations are removed; ambiguous double failures fail
   closed with an explicit recovery path.
5. Cleanup errors never mask the primary write failure. Only transaction-owned
   staging and backup paths are removed, and a successfully promoted checkpoint
   remains valid when obsolete-backup cleanup reports a durable warning.
6. Pipeline offload cleanup no longer clears ownership after a failed removal.
   The owned path is retained for a deterministic retry, while successful
   cleanup clears both the path and ownership flag.
7. The production rebirth path validates the complete staged checkpoint before
   atomic promotion. Persistence is now a required mutation target and the
   checkpoint atomicity/pipeline suites are part of mutation selection and the
   three-order repeat gate.
8. The platform-specific lock and directory-sync branches are no longer backed
   by an unverified CI comment: a focused `windows-latest` lane executes the
   checkpoint contracts with the locked Python 3.12 environment and retained
   JUnit evidence.
9. Regular-file durability uses a platform-specific descriptor contract. POSIX
   retains a read-only descriptor, while Windows requests the writable binary
   descriptor required by its C-runtime `_commit` implementation. Pure flag
   selection, descriptor use, and close-on-failure behavior are regression- and
   mutation-tested independently of the host platform.

## Defects and mutants detected

The development mutation campaign initially left 29 persistence survivors.
They identified weak JSON type/path assertions, incomplete cleanup and
diagnostic call contracts, missing cancellation boundaries, and insufficient
parent-sync/rollback observability. The repaired exact-target campaign killed
all generated persistence mutants. The final complete campaign preserved that
229/229 result while exceeding the immutable aggregate 85% floor.

The first repair attempt exposed three Linux-equivalent mutation survivors
because `os.O_BINARY` is absent on POSIX. Refactoring the flag selector to take
the platform binary flag explicitly made the Windows behavior independently
observable; the repaired campaign killed all 233 persistence mutants.

The full fault-injection suite also detects partial directory trees, unsafe or
missing shards, symlinked artifacts, file-fsync failure, concurrent commit
interleavings, incomplete rollback, cleanup-warning suppression, stale staging
ownership, and offload-directory ownership loss.

## Verification and evidence

- Exact delivery-head Python 3.12 coverage/JUnit/trend evidence:
  `/tmp/obliteratus-gate3-item4-final-JlA1k3/`
- Repaired delivery-tree Python 3.12 coverage/JUnit evidence:
  `/tmp/obliteratus-gate3-item4-windows-fix-final-tZIqbG/`
- Exact-base Python 3.12 coverage/JUnit evidence:
  `/tmp/obliteratus-gate3-item4-base-2uZEXr/`
- Python 3.10 and 3.11 coverage/JUnit evidence:
  `/tmp/obliteratus-gate3-item4-py310-exact-ldLxx6/` and
  `/tmp/obliteratus-gate3-item4-py311-exact-H4wFBU/`
- Repeat evidence:
  `/tmp/obliteratus-gate3-item4-repeat-H23MdN/`
- Exact core-head mutation evidence:
  `/tmp/obliteratus-gate3-item4-mutation-PVKKOL/`
- Repaired delivery-tree persistence mutation: 233/233 killed from prepared
  local `mutants/` evidence
- Canonical post-merge Python 3.12 evidence:
  `/tmp/obliteratus-postmerge-item4-py312-CH4T03/`
- Canonical post-merge repeat and mutation evidence:
  `/tmp/obliteratus-postmerge-item4-quality-5yrGKB/`
- Canonical hosted run:
  https://github.com/elder-plinius/OBLITERATUS/actions/runs/31926709748
- Exact-head audit:
  https://github.com/elder-plinius/OBLITERATUS/pull/104#issuecomment-5305717315
- Python 3.10/3.11 and quality-depth normalized trends:
  `/tmp/obliteratus-gate3-item4-trends-lrrEjF/`
- Package evidence:
  `/tmp/obliteratus-gate3-item4-package-CTZeC6/`
- Pinned-tool supply-chain evidence:
  `/tmp/obliteratus-gate3-item4-supply-7aqGSc/`

The canonical Ruff F gate, checksum-verified `actionlint`, `uv lock --check`,
conditional-policy validation, risk-map validation, changed-line gate,
touched-module gate, immutable coverage policy, normalized duration policy,
repeat gate, mutation score, installed-distribution checks, and supply-chain
decisions all pass. The ordinary worktree remained clean; all work and evidence
were isolated in the dedicated item-4 worktree and temporary evidence paths.

## Scope and release decision

This increment implements Gate 3 bounded delivery item 4. It does not reopen
ordinary feature work: items 5–7, conditional-evidence reconciliation, and the
final canonical Gate 3 publication remain open. The new hosted Windows lane is
a checkpoint portability contract, not a claim that accelerator, MPS, MLX,
network, download, remote, or operator-UI execution is supported by this
increment.

Delivery completed at canonical commit
`d7d2ad566af778b1d315616bbea8b8a3c4dd2191`. The exact final head passed all
eight hosted jobs, had no unresolved review thread, received a clean exact-SHA
audit, and was rebase merged. The canonical post-merge run then passed the same
eight jobs on attempt 1 before item 5 began.
