test(storage): certify durability and isolation with seeded model histories #756

Problem

Component failpoints, examples, and benchmark dashboards cannot establish the integrated durability/isolation claim. The final tree needs a reproducible state-machine oracle spanning acknowledgement, restart, filesystem admission, recovery-on-open, transactions, typed delta replay, compaction, leases, checkpoints, and garbage collection, plus exact-head diagnostic performance evidence for the new hot paths.

Objective

Certify the complete M6 contract with bounded exhaustive cases, seeded randomized histories, native platform runs, and durable reviewable evidence; attach exact-head CodSpeed simulation/walltime/memory results without confusing performance evidence with correctness proof.

Requirements

• Freeze one exact integrated commit and all contract/schema/benchmark-fixture versions.
• Model clients, pinned readers, three write modes, transaction identities, mutations, checkpoints, typed delta runs, compaction, GC, cancellation, process death, and allowed persistent-media faults.
• Compare every observable state to a small independent reference model.
• Check acknowledged-write durability, pre-ack atomicity, snapshot consistency, documented conflicts/anomalies, idempotency, and reachability safety.
• Include an explicit write-skew witness proving the optimistic mode is not mislabeled serializable.
• Run bounded exhaustive cases in required CI and higher history/seed counts in a scheduled lane.
• Retain seeds, minimized traces, exact commands, platform/tool versions, and artifact digests.
• Run actual Linux/macOS/Windows NTFS subprocess/handle tests in addition to the simulator.
• Use the test(storage): model torn writes lost flushes and crash recovery deterministically #749 trust boundary: allowed pre-ack/failed-operation persistence faults are modeled, while dishonest hardware acknowledgement remains outside the software guarantee.
• Require perf(storage): add CodSpeed durability and transaction regression baselines #782 exact-head CodSpeed evidence: simulation for pure M6 kernels, walltime for durable I/O on a suitable stable runner, and memory mode or an explicit scheduled fallback for replay/compaction.
• Compare against the frozen pre-M6 baseline and repair or explicitly disposition every material regression with measured tradeoff evidence.
• Fail on first invariant violation; never convert a failed seed or benchmark signal with retries, removed samples, weakened fixtures, or inflated thresholds.

Acceptance Criteria

• Every M6 BDD scenario maps to automated evidence or an explicit bounded platform rationale.
• Required CI passes the bounded state space at the exact head.
• Scheduled evidence records the declared history/seed count with zero untriaged invariant failures.
• All acknowledged commits survive every allowed modeled restart on admitted filesystems.
• No reader sees a mixed generation or changes after pinning.
• Recovery, compaction, and GC never remove CURRENT, checkpoints, live leases, or required delta inputs.
• Public Rust, Python, Node, and CLI observations agree.
• perf(storage): add CodSpeed durability and transaction regression baselines #782 is closed and exact-head CodSpeed simulation, walltime, and memory/fallback evidence is linked against the frozen pre-M6 baseline.
• Every material performance regression is repaired or explicitly dispositioned; no result is presented as correctness proof.
• Evidence and docs make no SSI, universal-filesystem, dishonest-hardware, distributed-durability, leaderboard, or universal-performance claim.

BDD Completion Scenarios

• Given a seeded history with crashes around acknowledgement, when it is replayed, then every reopened state matches the reference model exactly.
• Given concurrent pinned readers and writers plus compaction/GC, when histories interleave, then each reader remains on one complete snapshot and all reachable generations survive.
• Given a failing randomized history, when the harness reports it, then a deterministic minimized trace reproduces the same invariant violation.
• Given optimistic write skew, when results are classified, then the documented SI limitation is observed and no serializability claim is emitted.
• Given the exact integrated M6 commit, when CodSpeed and scheduled performance evidence run, then every declared kernel and durable I/O path has versioned results with no unexplained material regression.

Implementation Notes

Extend the deterministic filesystem oracle into a complete independent reference state machine; reuse contract matrices and binding fixtures rather than parallel test vocabularies. Consume #782 performance artifacts by exact commit and fixture version rather than reimplementing benchmark logic here.

Observability

Evidence includes exact commit, seed/count, operation classes, invariant, minimized trace, safe phase/outcome, admitted platform, elapsed time, resource envelope, benchmark identity/mode, base/head commits, result URLs, and artifact digests—never graph contents or sensitive paths.

Security And Privacy

Use synthetic data and private temporary roots. Fuzzed or benchmark paths must remain contained and must not inspect unrelated filesystem state. Preserve OIDC authentication and do not add long-lived benchmark credentials.

Testing

This issue is the final correctness and evidence gate. Required and scheduled correctness lanes use the same versioned model and fail-closed artifact validation. Performance evidence comes from #782 with instrument choice appropriate to the measured surface and remains diagnostic rather than correctness authority.

Documentation

Publish the exact-head certification ledger, supported platform/storage assumptions, model bounds, known isolation anomalies, CodSpeed baseline/head comparison, accepted regression rationales, and explicit limitations.

Non-Goals

Jepsen over a network service, distributed consensus, proof beyond the declared model/platform set, a performance leaderboard, a universal hardware claim, or making CodSpeed a correctness/merge gate.

Related Issues

Canonical tracker #747. Final M6 close gate; blocked by every earlier M6 close gate, including filesystem admission #776, typed deltas #752, compaction #753, and CodSpeed evidence #782.