Executed synthetic operations
Catalog import operations rehearsal
These checks use generated records, disposable local databases and deliberate faults. A passing check means the stated expected outcome occurred, including expected rejection or rollback. It does not certify an internet-facing deployment or hardware power-loss behavior.
Results
| Case | Requirement | Expected | Observed | Result |
|---|---|---|---|---|
| crash.rollback | Abrupt process exit before commit rolls back every application write | {"exit": 86, "unchanged": true, "status": "staged"} | {"exit": 86, "unchanged": true, "status": "staged"} | PASS |
| crash.response | Retry after committed child exits returns original approval | {"exit": 87, "replayed": true, "version": 1, "applications": 1} | {"exit": 87, "replayed": true, "version": 1, "applications": 1} | PASS |
| load.concurrent | Eight suppliers preserve all rows under four concurrent writers | [250, 250, 250, 250, 250, 250, 250, 250] | [250, 250, 250, 250, 250, 250, 250, 250] | PASS |
| load.versions | Each concurrent supplier advances exactly once | {"SUP0": 1, "SUP1": 1, "SUP2": 1, "SUP3": 1, "SUP4": 1, "SUP5": 1, "SUP6": 1, "SUP7": 1} | {"SUP0": 1, "SUP1": 1, "SUP2": 1, "SUP3": 1, "SUP4": 1, "SUP5": 1, "SUP6": 1, "SUP7": 1} | PASS |
| http.local | Reviewer login and authenticated read succeed | [200, 200] | [200, 200] | PASS |
| http.boundary | Foreign Host and Origin requests are rejected | [403, 403] | [403, 403] | PASS |
| restart.session | Process-local sessions do not survive restart | 401 | 401 | PASS |
| backup.snapshot | Online snapshot excludes uncommitted data and passes integrity | {"transient_rows": 0, "integrity": "ok"} | {"transient_rows": 0, "integrity": "ok"} | PASS |
| restore.business | Restored supplier, item, batch and audit content is identical | true | true | PASS |
| restore.idempotency | Restored batch still prevents duplicate application | true | true | PASS |
| restore.corruption | Corrupt snapshot rejected before destination creation | true | true | PASS |
| restore.no-overwrite | Existing restore destination is preserved | true | true | PASS |
| integrity.final | Final source passes integrity and foreign-key checks | {"integrity": "ok", "foreign_key_errors": 0} | {"integrity": "ok", "foreign_key_errors": 0} | PASS |
| backup.schedule | Finite scheduler creates two checked snapshots and stops | {"exit": 0, "snapshots": 2, "valid": 2} | {"exit": 0, "snapshots": 2, "valid": 2} | PASS |
Measurements
{
"concurrent_imports": {
"suppliers": 8,
"rows_per_supplier": 250,
"workers": 4,
"elapsed_seconds": 0.0983,
"committed_rows_per_second": 20353.4,
"qualification": "One synthetic shared-host run; not sustained production capacity."
},
"recovery": {
"snapshot_bytes": 1036288,
"snapshot_seconds": 0.008711,
"restore_seconds": 0.007552,
"rows": {
"audit": 18,
"batches": 9,
"items": 2004,
"suppliers": 9
},
"nominal_backup_interval_seconds": 900,
"theoretical_rpo_bound_seconds": 900.008711,
"rpo_assumption": "A successful snapshot at least every 15 minutes; source and backup not lost together. No unattended schedule was run."
}
}Method
- crash.rollback: Child calls os._exit after item, version, batch and audit writes, before commit. Parent reopens SQLite.
- crash.response: Child commits then exits without returning a response. Parent replays the same batch identity.
- load.concurrent: Separate SQLite connections stage and commit eight 250-row catalogs. SQLite serializes writes.
- load.versions: Read persisted supplier versions after every worker completes.
- http.local: Real loopback HTTP requests.
- http.boundary: Otherwise authenticated requests with foreign Host or Origin.
- restart.session: Create a new application with the same database and replay the old cookie.
- backup.snapshot: Hold a WAL writer open while SQLite online backup reads a committed snapshot.
- restore.business: Verify checksum and integrity, restore to a new directory, hash all business rows.
- restore.idempotency: Execute approval again against the restored database.
- restore.corruption: Modify six snapshot bytes; SHA-256 no longer matches.
- restore.no-overwrite: Attempt restore into an occupied directory.
- integrity.final: PRAGMA integrity_check and foreign_key_check after crashes, imports and backup.
- backup.schedule: Run the supplied CLI in a subprocess with two snapshots and a 10 ms interval. This exercises scheduling without leaving a background process.
Reproduce
python operations_rehearsal.py
See OPERATIONS.md for startup, snapshot, restore and capacity assumptions. The machine-readable record is completion.json.
Boundaries
- Abrupt process termination exercises SQLite recovery, not physical power loss or loss of source and backup together.
- Synthetic CSVs and public demonstration accounts were used. The service is loopback-only; no internet deployment or external identity provider is claimed.
- Checksums detect accidental modification. Snapshots are not encrypted or digitally signed and need restricted storage permissions.
- Durations describe one local run. Detection, provisioning and restart are outside the measured restore copy time.
- The 15-minute recovery-point bound is a theoretical schedule requirement, not an enabled backup service.