Historical repository record migrated on 2026-10-10. Original repository path: docs/experiments/benchmarks/coupled-operations-completion-readiness.md Original SHA-256: e5e9c2762fee8f867b8e624ef4f0717168ab51f6e852fe8317fa5b39eb2a5b08 Stated outcomes, measured revisions, failures and limits remain historical. Local raw evidence is private and is not uploaded. Relative links and the data-drive prefix were normalized.

Operations completion readiness

Read-only review, 2026-10-07. Elevated OS permissions remove execution/access obstacles; they do not change contracts, failed gates or trust-boundary scope. Coupled results record O6 exit101, O7 diagnostic exit0 with soundness inconclusive. Their original counterexamples and byte-verified archives remain evidence. No workload or source change was performed here.

O6: preserve known metadata; resolve availability explicitly

Recommended disposition: revise the fixture/model boundary, then test the independent raw-availability implementation gap. Product promises distinguish retained window/freshness, collection gaps and scan completeness; freshness covers any retained record. Erasing independently surviving metadata solely because one projection disappeared would collapse those dimensions and contradict that intent.

Observed O6 reproduction (local evidence omitted from stage): zero expected/answered rows agree; window/freshness/gaps disagree. Fixture deletes only logs, retaining raw Batch bytes, Manifest and gaps. The existing oracle's --unavailable excludes whole records, so this invocation cannot describe the fixture. Query obtains window/freshness from Manifest and gaps from their own table. This is evidence of a model mismatch, not proof every corruption case is correctly implemented.

Concrete next steps:

1. Register a separate availability decision: retained verified custody/metadata survives a missing projection; matching projected rows become unavailable and complete:false. Storage unavailability does not invent a collection gap. Clarify unknown metadata when its own evidence fails. The accepted contract's meaning supports this direction, but the table-specific mapping is currently underspecified; clarification and checker/fixture routing are trust changes.
2. Keep the whole-record oracle unchanged. Prepare an independent companion availability checker driven by pre-IO producer bytes and explicit per-table availability, plus a new fixture. Route this historical partial-table fixture to the appropriate checker only in a separate explained fixture/checker commit; preserve its historical failure. Do not simply remove envelope assertions or change their expected outcome to obtain a green result.
3. Fresh states for Scan/Walk, logs/metrics/spans, first/full pagination: intact; requested projection missing; optional index absent/corrupt; raw table missing; gaps missing; Manifest missing; retention-expired continuation. Independent controls reject falsely complete, invented freshness, erased known metadata, dropped/duplicated rows and an expired page accepted through a cached handle.
4. Ordinary queries currently do not open batches.parquet. Reproduce raw-table deletion with surviving projections. Product says missing/corrupt raw Segments are incomplete; a complete answer would be a separate implementation defect. Add raw-source availability validation consistent with existing table checks, then regression controls for missing/size/schema/decode corruption. Decide and measure checksum/decode cost before claiming all corruption is detected; cheap existence checks alone cannot establish that promise.

No oracle modification is needed to diagnose these cases. A companion checker and clarified mapping require explicit semantic registration; OS permission is not that approval. Full fast remains failed until a scoped correction and fresh verification. Reusing whole-record exclusion while retaining partial-source facts cannot resolve O6 correctly.

O7: exact rows and conservative bounds, separately from physical identity

Recommended disposition: retain C2 failure; propose a new prospective criterion only after independent native soundness evidence. Saved bigrows pair (local evidence omitted from stage) has identical raw/log/metric ordered hashes:4070logs/6400metrics. Reference has one4070-row log group; bounded has eight508-row groups plus6rows. Overlapping 10s windows match7140rows but admit hypothetical20350/9156footer rows. O7 established report consistency, not actual IO or complete query soundness.

The registered C2 comparison explicitly requires equal window dictionaries, including read_rows. It intentionally fails physical differences. Therefore a fixture correction cannot turn this into acceptance without changing the gate. The byte-cap exception for Parquet byte identity does not waive pruning equality.

Next: register one additive native diagnostic exporting actual per-group identities, min/max and row counts against pre-IO producer bytes; independently compare every matching row, total order and full pagination with the unchanged query oracle. Include equal times crossing a chunk boundary, late timestamps, a cap-forcing large row and an empty window whose bounds admit extra reads. Reject omitted matching groups and falsely narrowed bounds; record actual admitted/read groups separately. The existing producer forces zero estimated reads when matches are zero, so it cannot provide this discriminator. Keep its reports unchanged.

If soundness holds, a separate acceptance revision can require conservative bounds and exact answers while measuring physical amplification instead of equality. That fits the product query contract but changes the registered verification obligation. Historical C2 remains failed; fresh evidence belongs to the new criterion. Alternatively preserve equality and redesign grouping, accepting its memory/performance consequences. No source-only argument chooses a new gate.

O8: one next Batch; one network attempt

Smallest viable preparation: logs/metrics only, opt-in delivery worker, with the main runtime remaining the sole owner of Spool, cursors, metric history, sequence allocation, remote configuration and metering. Current collect prepares tentative cursors/history, appends durably, then updates in-memory state. deliver synchronously sends owned bytes and observes the answer before persisting ACK. Trace commits share the same Spool; defer their concurrent admission from this first prototype.

Move only an owned immutable N request and sender/config snapshot into one bounded worker; return outcome and request ownership through a single-slot channel. While N awaits ACK, main may durably collect at most N+1. No second send until N's outcome is processed; retries reuse exact N bytes. Main emits Attempt before record_ack, preserving observation order. Stop preparing when that one slot is occupied or Spool cannot admit it. Cap staged bytes by existing Batch limits; no shared mutable Spool or cursor locks around network IO.

Test ACK loss/retry, malformed ACK/conflict, full Spool, append failure, log rename/truncation, pending configuration/pause, worker failure and graceful stop. Cancel an uncommitted preparation without advancing cursors/history; durable N+1 survives stop/reopen. Network cancellation cannot mean acknowledged custody; join/stop owned worker and preserve durable unacknowledged requests. No detached threads, delivery-window expansion or unbounded queue.

Choose one prospective metric before running: fixed-offer collection-to-ACK latency with CPU/memory/backlog guards, or independently controlled capacity. Dev/small fixed offers alone cannot prove capacity gain. O8 ownership tests can be prepared without contract changes; prototype execution needs its own registered commands, resource admission and relevant O6/O7 dependency decision. C4/Q4 finite diagnostics remain independently admissible; C5/O8 coupled acceptance is not cleared by access.