{
  "schema_version": 1,
  "evidence_type": "executed synthetic operations",
  "command": "python operations.py",
  "passed": true,
  "checks": [
    {
      "id": "kill-files",
      "description": "Recover after hard process termination at files",
      "expected": "partial directory found; source unchanged; supervised cleanup; retry passes",
      "observed": {
        "exit_signal": 9,
        "partial_directory_observed": true,
        "source_unchanged": true,
        "retry_passed": true,
        "unrelated_preserved": true
      },
      "passed": true,
      "method": "real subprocess / SIGKILL"
    },
    {
      "id": "kill-restore",
      "description": "Recover after hard process termination at restore",
      "expected": "partial directory found; source unchanged; supervised cleanup; retry passes",
      "observed": {
        "exit_signal": 9,
        "partial_directory_observed": true,
        "source_unchanged": true,
        "retry_passed": true,
        "unrelated_preserved": true
      },
      "passed": true,
      "method": "real subprocess / SIGKILL"
    },
    {
      "id": "kill-probes",
      "description": "Recover after hard process termination at probes",
      "expected": "partial directory found; source unchanged; supervised cleanup; retry passes",
      "observed": {
        "exit_signal": 9,
        "partial_directory_observed": true,
        "source_unchanged": true,
        "retry_passed": true,
        "unrelated_preserved": true
      },
      "passed": true,
      "method": "real subprocess / SIGKILL"
    },
    {
      "id": "full-volume",
      "description": "Fail closed and clean owned resources on archive-write failure",
      "expected": "rejected; cleanup succeeds",
      "observed": {
        "passed_restore": false,
        "cleanup": true,
        "error": "OSError: [Errno 28] synthetic full volume"
      },
      "passed": true,
      "method": "injected ENOSPC"
    },
    {
      "id": "parallel-isolation",
      "description": "Parallel verification does not share a restore target",
      "expected": "two successful restores; distinct owned directories; source unchanged",
      "observed": {
        "successes": 2,
        "distinct_directories": 2,
        "source_unchanged": true
      },
      "passed": true,
      "method": "two operating-system workers"
    },
    {
      "id": "count-1000",
      "description": "Enforce documented file-count boundary",
      "expected": "restore_passed=True",
      "observed": {
        "restore_passed": true,
        "seconds": 0.159169,
        "input_bytes": 1349468,
        "error": null
      },
      "passed": true,
      "method": "generated SQLite and archive fixture"
    },
    {
      "id": "count-1001",
      "description": "Enforce documented file-count boundary",
      "expected": "restore_passed=False",
      "observed": {
        "restore_passed": false,
        "seconds": 0.000587,
        "input_bytes": 1349616,
        "error": "CheckError: Invalid file list"
      },
      "passed": true,
      "method": "generated SQLite and archive fixture"
    },
    {
      "id": "member-corruption",
      "description": "Reject changed attachment despite updated outer archive checksum",
      "expected": "member digest rejection",
      "observed": "CheckError: File digest mismatch: visits/001.txt",
      "passed": true,
      "method": "single-byte damage"
    },
    {
      "id": "online-wal-snapshot",
      "description": "Recover a snapshot produced while writes commit",
      "expected": "valid snapshot; 300 commits complete; application probes pass",
      "observed": {
        "writer_errors": [],
        "writer_commits": 300,
        "restore_passed": true,
        "writer_committed_during_copy": true
      },
      "passed": true,
      "method": "SQLite backup API plus independent writer"
    },
    {
      "id": "postgres-recovery-model",
      "description": "Never accept a backup after an incomplete required stage",
      "expected": "healthy path accepted; all six injected faults rejected; no production target",
      "observed": {
        "scenarios": 7,
        "accepted": 1,
        "failures_rejected": 6
      },
      "passed": true,
      "method": "theoretical pipeline state model"
    },
    {
      "id": "recovery-budget",
      "description": "Calculate recovery window from declared rates",
      "expected": "RTO increases with size and decreases with transfer rate",
      "observed": {
        "cases": 6,
        "range_seconds": [
          120.72,
          6234.0
        ]
      },
      "passed": true,
      "method": "theoretical serial-stage budget"
    }
  ],
  "source_sha256": {
    "operations.py": "3b9398ccae809d69b3d333b8a9f9f6affe8ed3b857de249b54c0f0bf68982de3",
    "restore_check.py": "01b3ea753330d793ef992931673b9d18cb7ac4b8e3eecde61d228223e9f975eb",
    "make_fixtures.py": "7e87e19ca8919feb74d7b9ddc78e42c198e48738d1e9b9a1ac17c2f1b134300c"
  },
  "report": "operations-report.html",
  "limitations": [
    "Process termination is real SIGKILL on Linux; it does not remove power or emulate a faulty storage device.",
    "ENOSPC is an injected write error. No host volume was filled.",
    "SQLite restores and consistency probes are executed. The PostgreSQL pipeline and remote transfer timing are explicit theoretical models, not pg_restore or network measurements.",
    "Synthetic records and local timings describe this run only. Backup authenticity needs a trusted signature or protected manifest; hashes alone do not authenticate a backup.",
    "A killed process cannot run its finally block. The supervisor demonstrates cleanup of only the exact child-owned path after confirming process death."
  ],
  "runtime": {
    "python": "3.12.14",
    "sqlite": "3.53.1",
    "platform": "Linux"
  },
  "observations": {
    "live_snapshot_assumption": "Attachment bytes and document references remain immutable during capture; only visit status changes. A real application must supply an equivalent coordinated snapshot contract.",
    "postgresql_pipeline_model": [
      {
        "fault": "none",
        "completed": [
          "download",
          "checksum",
          "create_disposable_database",
          "restore",
          "application_probes",
          "report"
        ],
        "accepted": true,
        "cleanup_owned_database": true,
        "production_target_used": false
      },
      {
        "fault": "download",
        "completed": [],
        "accepted": false,
        "cleanup_owned_database": false,
        "production_target_used": false
      },
      {
        "fault": "checksum",
        "completed": [
          "download"
        ],
        "accepted": false,
        "cleanup_owned_database": false,
        "production_target_used": false
      },
      {
        "fault": "create_disposable_database",
        "completed": [
          "download",
          "checksum"
        ],
        "accepted": false,
        "cleanup_owned_database": false,
        "production_target_used": false
      },
      {
        "fault": "restore",
        "completed": [
          "download",
          "checksum",
          "create_disposable_database"
        ],
        "accepted": false,
        "cleanup_owned_database": true,
        "production_target_used": false
      },
      {
        "fault": "application_probes",
        "completed": [
          "download",
          "checksum",
          "create_disposable_database",
          "restore"
        ],
        "accepted": false,
        "cleanup_owned_database": true,
        "production_target_used": false
      },
      {
        "fault": "report",
        "completed": [
          "download",
          "checksum",
          "create_disposable_database",
          "restore",
          "application_probes"
        ],
        "accepted": false,
        "cleanup_owned_database": true,
        "production_target_used": false
      }
    ],
    "capacity_model": [
      {
        "database_GiB": 1,
        "network_MiB_s": 25,
        "restore_MiB_s_assumed": 50,
        "download_s": 40.96,
        "restore_s": 20.48,
        "fixed_startup_and_probe_s": 90,
        "modeled_RTO_s": 151.44,
        "backup_interval_s": 3600,
        "worst_case_RPO_s": 3600
      },
      {
        "database_GiB": 1,
        "network_MiB_s": 100,
        "restore_MiB_s_assumed": 50,
        "download_s": 10.24,
        "restore_s": 20.48,
        "fixed_startup_and_probe_s": 90,
        "modeled_RTO_s": 120.72,
        "backup_interval_s": 3600,
        "worst_case_RPO_s": 3600
      },
      {
        "database_GiB": 10,
        "network_MiB_s": 25,
        "restore_MiB_s_assumed": 50,
        "download_s": 409.6,
        "restore_s": 204.8,
        "fixed_startup_and_probe_s": 90,
        "modeled_RTO_s": 704.4000000000001,
        "backup_interval_s": 3600,
        "worst_case_RPO_s": 3600
      },
      {
        "database_GiB": 10,
        "network_MiB_s": 100,
        "restore_MiB_s_assumed": 50,
        "download_s": 102.4,
        "restore_s": 204.8,
        "fixed_startup_and_probe_s": 90,
        "modeled_RTO_s": 397.20000000000005,
        "backup_interval_s": 3600,
        "worst_case_RPO_s": 3600
      },
      {
        "database_GiB": 100,
        "network_MiB_s": 25,
        "restore_MiB_s_assumed": 50,
        "download_s": 4096.0,
        "restore_s": 2048.0,
        "fixed_startup_and_probe_s": 90,
        "modeled_RTO_s": 6234.0,
        "backup_interval_s": 3600,
        "worst_case_RPO_s": 3600
      },
      {
        "database_GiB": 100,
        "network_MiB_s": 100,
        "restore_MiB_s_assumed": 50,
        "download_s": 1024.0,
        "restore_s": 2048.0,
        "fixed_startup_and_probe_s": 90,
        "modeled_RTO_s": 3162.0,
        "backup_interval_s": 3600,
        "worst_case_RPO_s": 3600
      }
    ],
    "capacity_equation": "RTO = database MiB / download MiB/s + database MiB / restore MiB/s + 30 s startup + 60 s probes. RPO bound assumes successful hourly backups; failed or stale backups invalidate that bound. Compression, parallelism, secrets, retries and operator time are excluded."
  },
  "seconds": 0.571975
}