@feltdb/core 0.15.0 → 0.16.0

package/dist/create/server-source/crates/feltdb/tests/production_certification.rs

@@ -1,1153 +0,0 @@
-//! The FeltDB production certification matrix.
-//!
-//! This file is the **authoritative** statement of what FeltDB can and cannot
-//! claim. Every count in `docs/architecture/production-certification.md` is
-//! derived from the table below; none is maintained by hand.
-//!
-//! # The certification principle
-//!
-//! > For every claim: **what exact evidence proves this today, and what does
-//! > that evidence not prove?**
-//!
-//! A claim is not `Proven` because an implementation exists, because another
-//! claim implies it, because an earlier change said so, because a related test
-//! passes, or because the wording sounds reasonable. Every `Proven` claim names
-//! a test that exists and runs now.
-//!
-//! # What this audit changed
-//!
-//! Recalculating rather than inheriting **downgraded two claims** that earlier
-//! work recorded as `Proven` (see `DOWNGRADES`), corrected two dangling
-//! evidence citations, and added the managed-incident remediation, which
-//! had shipped with tests but no matrix entry at all. Discovering that an
-//! earlier conclusion no longer holds is the point of the exercise, not a
-//! failure of it.
-
-use std::collections::BTreeMap;
-
-mod common;
-
-/// The status labels that withhold rather than grant. A table row carrying one
-/// of these is recording a gap, and is read as such by the prose tripwire.
-const WITHHELD_LABELS: &[&str] = &["Partially Proven", "Unproven", "Blocked", "Not Applicable"];
-
-/// The only statuses this certification recognises.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
-enum Status {
-    Proven,
-    PartiallyProven,
-    Unproven,
-    Blocked,
-    NotApplicable,
-}
-
-impl Status {
-    /// Every status this certification recognises. Counts are derived over this
-    /// list, so a bucket that happens to be empty is still published as zero.
-    const ALL: [Status; 5] = [
-        Status::Proven,
-        Status::PartiallyProven,
-        Status::Unproven,
-        Status::Blocked,
-        Status::NotApplicable,
-    ];
-
-    /// The enum variant's own name, which is how earlier ledgers spell it.
-    fn variant(self) -> &'static str {
-        match self {
-            Status::Proven => "Proven",
-            Status::PartiallyProven => "PartiallyProven",
-            Status::Unproven => "Unproven",
-            Status::Blocked => "Blocked",
-            Status::NotApplicable => "NotApplicable",
-        }
-    }
-
-    /// How much a status claims. Only used to assert that a divergence from an
-    /// earlier ledger is a *weakening*; a strengthening needs new evidence and
-    /// must not slip through as a declared downgrade.
-    fn strength(self) -> u8 {
-        match self {
-            Status::Proven => 3,
-            Status::PartiallyProven => 2,
-            Status::Blocked => 1,
-            Status::Unproven | Status::NotApplicable => 0,
-        }
-    }
-
-    fn label(self) -> &'static str {
-        match self {
-            Status::Proven => "Proven",
-            Status::PartiallyProven => "Partially Proven",
-            Status::Unproven => "Unproven",
-            Status::Blocked => "Blocked",
-            Status::NotApplicable => "Not Applicable",
-        }
-    }
-}
-
-/// How a claim is established. The distinction matters: implementation
-/// inspection alone may not carry a *behavioural* guarantee.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-enum Evidence {
-    /// A test that exercises the behaviour and asserts the outcome.
-    ExecutableContract,
-    /// A test that damages, truncates or kills something and asserts recovery.
-    FailureInjection,
-    /// A test that runs a fixed experiment and asserts a relationship.
-    DeterministicExperiment,
-    /// A measurement under a frozen workload.
-    Benchmark,
-    /// Reading the code. Sufficient only for structural claims.
-    ImplementationInspection,
-    /// No evidence exists.
-    None,
-}
-
-impl Evidence {
-    /// How the published document names this evidence type.
-    fn label(self) -> &'static str {
-        match self {
-            Evidence::ExecutableContract => "Executable contract",
-            Evidence::FailureInjection => "Failure injection",
-            Evidence::DeterministicExperiment => "Deterministic experiment",
-            Evidence::Benchmark => "Benchmark",
-            Evidence::ImplementationInspection => "Implementation inspection",
-            Evidence::None => "None",
-        }
-    }
-}
-
-struct Claim {
-    id: &'static str,
-    domain: &'static str,
-    claim: &'static str,
-    status: Status,
-    /// The test function that establishes this claim, or "" when there is none.
-    evidence: &'static str,
-    kind: Evidence,
-    /// What the evidence does **not** establish. Required for every claim that
-    /// is not fully `Proven`, and used freely on `Proven` ones.
-    limitation: &'static str,
-    source: &'static str,
-}
-
-/// Where this audit disagrees with the ledger of the pull request that first
-/// recorded a claim.
-///
-/// The earlier ledgers stay as they are: they are the record of what #307, #313
-/// and #314 concluded on the evidence they had, and rewriting them would erase
-/// the fact that the conclusion changed. But a disagreement must never be
-/// silent, so every one of them is declared here and checked in both
-/// directions — the earlier ledger must still say what this table claims it
-/// says, and the certification must still say the weaker thing.
-///
-/// `(claim, what the earlier ledger records, what this audit records, why)`
-const DOWNGRADES: &[(&str, &str, &str, &str)] = &[
-    (
-        "E6",
-        "Proven",
-        "PartiallyProven",
-        "the frozen workload is asserted by a test; the environment is only in prose",
-    ),
-    (
-        "O2",
-        "Proven",
-        "PartiallyProven",
-        "the library value and the status derivation are tested; the HTTP handler is not",
-    ),
-];
-
-/// The certification matrix.
-///
-/// Laid out as a table on purpose: a claim is meant to be read across its row,
-/// and the fields line up so a missing limitation or an empty evidence cell is
-/// visible at a glance. `rustfmt` would expand each entry to nine lines and
-/// lose that.
-#[rustfmt::skip]
-const CERTIFICATION: &[Claim] = &[
-    // ---------------------------------------------------------------- D
-    Claim { id: "D1", domain: "Durability", claim: "committed mutations survive a clean restart",
-        status: Status::Proven, evidence: "a_clean_restart_preserves_state_history_and_retention",
-        kind: Evidence::ExecutableContract,
-        limitation: "A clean, cooperative shutdown. Says nothing about an abrupt one.",
-        source: "#307" },
-    Claim { id: "D2", domain: "Durability", claim: "revision history survives a clean restart",
-        status: Status::Proven, evidence: "a_clean_restart_preserves_state_history_and_retention",
-        kind: Evidence::ExecutableContract, limitation: "As D1.", source: "#307" },
-    Claim { id: "D3", domain: "Durability", claim: "retention policy and horizon survive a restart",
-        status: Status::Proven, evidence: "a_clean_restart_preserves_state_history_and_retention",
-        kind: Evidence::ExecutableContract, limitation: "As D1.", source: "#306" },
-    Claim { id: "D4", domain: "Durability", claim: "a reopened database continues history rather than restarting it",
-        status: Status::Proven, evidence: "a_clean_restart_preserves_state_history_and_retention",
-        kind: Evidence::ExecutableContract, limitation: "As D1.", source: "#306" },
-    Claim { id: "D5", domain: "Durability", claim: "a single write survives operating-system or power loss",
-        status: Status::Unproven, evidence: "", kind: Evidence::None,
-        limitation: "NOT PROVEN AND NOT PROVABLE HERE. The default mode flushes to the \
-                     operating system without fsync. `Synced` mode issues a barrier per write, \
-                     but whether the device honoured it is a property of the storage stack that \
-                     no test in this repository can observe. Settling this needs an experiment \
-                     that cuts power to real hardware.",
-        source: "#312, #314" },
-    Claim { id: "D6", domain: "Durability", claim: "every crash point leaves a clean prefix of the mutation sequence",
-        status: Status::Proven, evidence: "every_crash_point_leaves_a_clean_prefix",
-        kind: Evidence::FailureInjection,
-        limitation: "Truncation models the durable bytes at every byte boundary of a \
-                     three-write log. It does not model a filesystem reordering writes or a \
-                     device returning stale data.",
-        source: "#312" },
-    Claim { id: "D7", domain: "Durability", claim: "a crash never produces a revision for a record that was not written",
-        status: Status::Proven, evidence: "no_crash_point_produces_a_phantom_revision",
-        kind: Evidence::FailureInjection,
-        limitation: "Follows from record-before-revision ordering; verified over one workload.",
-        source: "#312" },
-    Claim { id: "D8", domain: "Durability", claim: "a committed write survives the process dying",
-        status: Status::Proven, evidence: "a_committed_write_survives_process_death",
-        kind: Evidence::FailureInjection,
-        limitation: "A real SIGABRT. The process, not the machine.", source: "#312" },
-    Claim { id: "D9", domain: "Durability", claim: "a transaction is all-or-nothing across a crash",
-        status: Status::Proven, evidence: "a_transaction_is_all_or_nothing_at_every_crash_point",
-        kind: Evidence::FailureInjection,
-        limitation: "Every byte offset of one three-row transaction.", source: "#312" },
-    Claim { id: "D10", domain: "Durability", claim: "a crash-recovered database replicates identically",
-        status: Status::Proven, evidence: "a_crash_recovered_database_replicates_identically",
-        kind: Evidence::FailureInjection,
-        limitation: "Crash points sampled every 37 bytes, not exhaustively.", source: "#312" },
-    // ---------------------------------------------------------------- A
-    Claim { id: "A1", domain: "Atomicity", claim: "a stale fenced write is rejected and mints nothing",
-        status: Status::Proven, evidence: "a_stale_fenced_write_is_rejected_and_mints_nothing",
-        kind: Evidence::ExecutableContract, limitation: "Version conflict only.", source: "#307" },
-    Claim { id: "A2", domain: "Atomicity", claim: "concurrent writes to distinct resources keep distinct chains",
-        status: Status::Proven, evidence: "concurrent_writes_produce_correct_chains",
-        kind: Evidence::ExecutableContract,
-        limitation: "Four threads, twenty-five writes each, on one machine.", source: "#307" },
-    Claim { id: "A3", domain: "Atomicity", claim: "concurrent writes to one resource form one correct chain",
-        status: Status::Proven, evidence: "concurrent_writes_produce_correct_chains",
-        kind: Evidence::ExecutableContract,
-        limitation: "One hundred writes producing one hundred unique sequences. Not a \
-                     stress test.", source: "#307" },
-    Claim { id: "A4", domain: "Atomicity", claim: "a duplicate remote operation is idempotent",
-        status: Status::Proven, evidence: "replayed_and_gapped_remote_operations_are_handled_explicitly",
-        kind: Evidence::ExecutableContract, limitation: "Whole-stream replay.", source: "#307" },
-    Claim { id: "A5", domain: "Atomicity", claim: "a remote operation with a sequence gap is rejected",
-        status: Status::Proven, evidence: "replayed_and_gapped_remote_operations_are_handled_explicitly",
-        kind: Evidence::ExecutableContract, limitation: "One gap shape.", source: "#307" },
-    Claim { id: "A6", domain: "Atomicity", claim: "a crash part-way through a mutation leaves consistent state",
-        status: Status::Proven, evidence: "every_crash_point_leaves_a_clean_prefix",
-        kind: Evidence::FailureInjection, limitation: "As D6.", source: "#312" },
-    // ---------------------------------------------------------------- R
-    Claim { id: "R1", domain: "Recovery", claim: "an incomplete final append is recovered and reported, not silently dropped",
-        status: Status::Proven, evidence: "an_unterminated_final_record_is_recovered_and_reported",
-        kind: Evidence::FailureInjection,
-        limitation: "A KNOWN INCOMPLETE APPEND ONLY. This is not general recovery from \
-                     storage failure.", source: "#309" },
-    Claim { id: "R2", domain: "Recovery", claim: "a complete but invalid record refuses the open, wherever it sits",
-        status: Status::Proven, evidence: "a_complete_but_invalid_final_record_refuses_the_open",
-        kind: Evidence::FailureInjection,
-        limitation: "Detection and refusal. Damaged records are never repaired.", source: "#309" },
-    Claim { id: "R3", domain: "Recovery", claim: "damaged ancestry is distinguishable from expired ancestry",
-        status: Status::Proven, evidence: "damaged_ancestry_is_distinguishable_from_expired_ancestry",
-        kind: Evidence::ExecutableContract,
-        limitation: "On inspection of a named revision. See R4.", source: "#306, #307" },
-    Claim { id: "R4", domain: "Recovery", claim: "ancestry damage is surfaced without being asked for",
-        status: Status::Unproven, evidence: "", kind: Evidence::None,
-        limitation: "`parent_of` distinguishes Expired from Missing when a caller asks about \
-                     a specific revision. NOTHING SCANS PROACTIVELY. Detection on inspection is \
-                     not monitoring.", source: "#307" },
-    // ---------------------------------------------------------------- H
-    Claim { id: "H1", domain: "History", claim: "history is bounded under a configured policy",
-        status: Status::Proven, evidence: "repeated_mutation_has_bounded_history",
-        kind: Evidence::ExecutableContract, limitation: "Count-based policy only.", source: "#306" },
-    Claim { id: "H2", domain: "History", claim: "history is unbounded without one, by design",
-        status: Status::Proven, evidence: "the_retention_envelope_behaves_in_both_directions",
-        kind: Evidence::ExecutableContract,
-        limitation: "A stated contract, not an omission.", source: "#306" },
-    Claim { id: "H3", domain: "History", claim: "a policy change takes effect in both directions",
-        status: Status::Proven, evidence: "the_retention_envelope_behaves_in_both_directions",
-        kind: Evidence::ExecutableContract,
-        limitation: "Loosening does not restore what was expired.", source: "#306" },
-    Claim { id: "H4", domain: "History", claim: "maintenance never rewrites history",
-        status: Status::Proven, evidence: "maintenance_never_rewrites_history_and_forks_survive",
-        kind: Evidence::ExecutableContract,
-        limitation: "Compaction, an unrelated write and a retention pass.", source: "#306" },
-    Claim { id: "H5", domain: "History", claim: "forked history is preserved",
-        status: Status::Proven, evidence: "maintenance_never_rewrites_history_and_forks_survive",
-        kind: Evidence::ExecutableContract, limitation: "Two heads from one base.", source: "#306" },
-    // ---------------------------------------------------------------- B
-    Claim { id: "B1", domain: "Backup", claim: "a durable backup artifact is self-contained and independently verifiable",
-        status: Status::Proven, evidence: "a_backup_is_self_contained_and_outlives_its_source",
-        kind: Evidence::ExecutableContract,
-        limitation: "Verified with the source database deleted.", source: "#310" },
-    Claim { id: "B2", domain: "Backup", claim: "a restore proves the result means the same thing, not merely that it parsed",
-        status: Status::Proven, evidence: "a_restore_preserves_state_history_forks_retention_and_provenance",
-        kind: Evidence::ExecutableContract,
-        limitation: "The meaning digest is recomputed from the restored live database.",
-        source: "#310" },
-    Claim { id: "B3", domain: "Backup", claim: "an altered or truncated backup is refused rather than restored",
-        status: Status::Proven, evidence: "a_single_altered_byte_is_refused",
-        kind: Evidence::FailureInjection,
-        limitation: "One altered byte inside a value: still valid JSON, still a valid record.",
-        source: "#310" },
-    Claim { id: "B4", domain: "Backup", claim: "a restore will not overwrite an existing database",
-        status: Status::Proven, evidence: "a_restore_will_not_overwrite_an_existing_database",
-        kind: Evidence::ExecutableContract,
-        limitation: "The occupied target is byte-identical afterwards.", source: "#310" },
-    Claim { id: "B5", domain: "Backup", claim: "backup and restore are exposed as an operator command-line workflow",
-        status: Status::Unproven, evidence: "", kind: Evidence::None,
-        limitation: "THE PRIMITIVE WORKING IS NOT A WORKFLOW. `write_backup`, `verify_backup` \
-                     and `restore_backup` are library calls. There is no command, schedule, or \
-                     documented operator procedure. An operator without a Rust toolchain has no \
-                     backup.", source: "#310" },
-    // ---------------------------------------------------------------- S
-    Claim { id: "S1", domain: "Replication", claim: "current state replicates to a peer",
-        status: Status::Proven, evidence: "replication_preserves_revision_history_and_ancestry",
-        kind: Evidence::ExecutableContract,
-        limitation: "STATE CONVERGENCE IS NOT HISTORY CONVERGENCE. See S4.", source: "#311" },
-    Claim { id: "S2", domain: "Replication", claim: "revision history replicates to a peer with identical identities",
-        status: Status::Proven, evidence: "replication_preserves_revision_history_and_ancestry",
-        kind: Evidence::ExecutableContract,
-        limitation: "Reconstructed from operation provenance, not re-minted. Requires the peer \
-                     to send provenance; see S5.", source: "#311" },
-    Claim { id: "S3", domain: "Replication", claim: "replicated history preserves parents, sequences, forks and provenance",
-        status: Status::Proven, evidence: "concurrent_authorities_produce_a_fork_that_survives_replication",
-        kind: Evidence::ExecutableContract,
-        limitation: "Two authorities, one fork.", source: "#311" },
-    Claim { id: "S4", domain: "Replication", claim: "state equivalence and historical equivalence are checked separately",
-        status: Status::Proven, evidence: "same_state_with_different_history_is_detected",
-        kind: Evidence::ExecutableContract,
-        limitation: "THE NEGATIVE CONTROL. Two databases with an identical state digest and a \
-                     different history digest. Without this, every other S claim could be \
-                     satisfied by values alone.", source: "#311" },
-    Claim { id: "S5", domain: "Replication", claim: "a peer that sends no revision provenance contributes no history",
-        status: Status::Proven, evidence: "an_operation_without_provenance_replicates_state_only",
-        kind: Evidence::ExecutableContract,
-        limitation: "A bounded, stated consequence of the field being additive.", source: "#311" },
-    // ---------------------------------------------------------------- E
-    Claim { id: "E1", domain: "Envelope", claim: "retention cost per write grows with the retention window",
-        status: Status::Proven, evidence: "the_retention_envelope_has_the_measured_shape",
-        kind: Evidence::DeterministicExperiment, limitation: "An ordering, not a number.", source: "#314" },
-    Claim { id: "E2", domain: "Envelope", claim: "retention increases log size before compaction",
-        status: Status::Proven, evidence: "the_retention_envelope_has_the_measured_shape",
-        kind: Evidence::DeterministicExperiment, limitation: "Expiry tombstones. Before compaction only.",
-        source: "#314" },
-    Claim { id: "E3", domain: "Envelope", claim: "durability is a selectable contract, and each mode states its guarantee",
-        status: Status::Proven, evidence: "every_durability_mode_states_its_own_guarantee",
-        kind: Evidence::ExecutableContract,
-        limitation: "The wording is asserted not to overstate. It does not make the guarantee true.",
-        source: "#314" },
-    Claim { id: "E4", domain: "Envelope", claim: "a stable-storage barrier per write has a measured cost",
-        status: Status::Proven, evidence: "a_barrier_per_write_costs_more_than_none",
-        kind: Evidence::DeterministicExperiment,
-        limitation: "3-4x on the recorded environment. THE COST OF ASKING, NOT PROOF OF LANDING.",
-        source: "#314" },
-    Claim { id: "E5", domain: "Envelope", claim: "the durability mode changes the contract and not the stored database",
-        status: Status::Proven, evidence: "the_durability_mode_does_not_change_what_is_stored",
-        kind: Evidence::ExecutableContract,
-        limitation: "Compared on one path, because authority identity is path-derived.",
-        source: "#314" },
-    Claim { id: "E6", domain: "Envelope", claim: "the workload envelope is recorded against a frozen workload and a named environment",
-        status: Status::PartiallyProven, evidence: "a_measurement_carries_the_workload_that_produced_it",
-        kind: Evidence::Benchmark,
-        limitation: "DOWNGRADED BY THIS AUDIT. The test asserts the frozen workload half only. \
-                     The environment is recorded in prose in the envelope document and no test \
-                     asserts that a measurement carries it.", source: "#314" },
-    Claim { id: "E7", domain: "Envelope", claim: "grouped durability is measurably cheaper than a barrier per write",
-        status: Status::Unproven, evidence: "", kind: Evidence::None,
-        limitation: "Grouped ran SLOWER than per-write fsync on one of four workloads and faster \
-                     on three. The proven property is that grouping reduces barrier frequency to \
-                     the configured interval, which is a contract, not a speed.", source: "#314" },
-    // ---------------------------------------------------------------- U
-    Claim { id: "U1", domain: "Format", claim: "an incompatible durable format is detected before any record is interpreted",
-        status: Status::Proven, evidence: "pre_306_database_does_not_open_as_empty_history",
-        kind: Evidence::FailureInjection,
-        limitation: "A read-only probe runs before the open.", source: "#308" },
-    Claim { id: "U2", domain: "Format", claim: "a pre-model database's revision history is losslessly migratable",
-        status: Status::NotApplicable, evidence: "migration_is_refused_because_the_resource_was_never_recorded",
-        kind: Evidence::ExecutableContract,
-        limitation: "IMPOSSIBLE, NOT UNIMPLEMENTED. A legacy revision never recorded its \
-                     resource, so which history it belongs to is not in the data. Migration \
-                     would have to invent it.", source: "#308" },
-    Claim { id: "U3", domain: "Format", claim: "a persisted durable format version exists and is checked on open",
-        status: Status::Proven, evidence: "a_new_database_declares_its_format",
-        kind: Evidence::ExecutableContract,
-        limitation: "New logs and compaction headers. An unversioned database with no legacy \
-                     revisions opens by design.", source: "#308" },
-    Claim { id: "U4", domain: "Format", claim: "a refused open leaves the database byte-identical",
-        status: Status::Proven, evidence: "pre_306_database_does_not_open_as_empty_history",
-        kind: Evidence::FailureInjection,
-        limitation: "Bytes compared before and after. Made unconditional by making the log \
-                     reader read-only until replay succeeds.", source: "#308, #309" },
-    Claim { id: "U5", domain: "Format", claim: "a durable format from a newer build is refused",
-        status: Status::Proven, evidence: "a_newer_durable_format_is_refused",
-        kind: Evidence::FailureInjection,
-        limitation: "The rollback direction, exercised by a synthesised future version.",
-        source: "#308" },
-    Claim { id: "U6", domain: "Format", claim: "a snapshot from another format is refused",
-        status: Status::Proven, evidence: "a_snapshot_from_another_format_is_refused",
-        kind: Evidence::ExecutableContract,
-        limitation: "Snapshots are a second durable ingress and carry their own version.",
-        source: "#308" },
-    // ---------------------------------------------------------------- O
-    Claim { id: "O1", domain: "Observability", claim: "an operator can inspect history and retention state",
-        status: Status::PartiallyProven, evidence: "revision_retention_bounds_a_resources_history",
-        kind: Evidence::ExecutableContract,
-        limitation: "Per resource only. Nothing aggregates, so \"is any ancestry anywhere \
-                     damaged?\" means walking every revision.", source: "#313" },
-    Claim { id: "O2", domain: "Observability", claim: "reported health reflects actual storage state",
-        status: Status::PartiallyProven, evidence: "a_clean_open_reports_clean_storage",
-        kind: Evidence::ExecutableContract,
-        limitation: "DOWNGRADED BY THIS AUDIT. The library value and the server's status \
-                     derivation are each tested, but no test exercises the HTTP endpoint. That \
-                     the handler composes them is established by inspection.", source: "#313" },
-    Claim { id: "O3", domain: "Observability", claim: "a recovered open is distinguishable from a clean one in health",
-        status: Status::Proven, evidence: "a_recovered_open_does_not_report_the_same_health_as_a_clean_one",
-        kind: Evidence::ExecutableContract,
-        limitation: "At the library boundary.", source: "#313" },
-    Claim { id: "O4", domain: "Observability", claim: "health reports only conditions that were observed",
-        status: Status::Proven, evidence: "health_reports_only_conditions_that_were_observed",
-        kind: Evidence::ExecutableContract,
-        limitation: "Asserts no storage label says `durable` or `healthy`.", source: "#313" },
-    Claim { id: "O5", domain: "Observability", claim: "the remaining health fields are compile-time constants",
-        status: Status::PartiallyProven, evidence: "crates/feltdb-server/src/main.rs:HealthResponse",
-        kind: Evidence::ImplementationInspection,
-        limitation: "`runtime`, `fabric`, `workflows` and `agents` are still constants. \
-                     Recorded, not fixed: each needs an operational contract first.",
-        source: "#313" },
-    // ---------------------------------------------------------------- M
-    Claim { id: "M1", domain: "Managed incident", claim: "a timer-driven compaction defers the log rewrite",
-        status: Status::Proven, evidence: "the_default_policy_does_not_rewrite_on_a_handful_of_operations",
-        kind: Evidence::ExecutableContract,
-        limitation: "Ten timer ticks over a small database cause zero rewrites. THIS DOES NOT \
-                     MAKE COMPACTION NON-BLOCKING; see M6.", source: "6b550ea" },
-    Claim { id: "M2", domain: "Managed incident", claim: "an explicit compaction still rewrites immediately",
-        status: Status::Proven, evidence: "an_explicit_compaction_still_rewrites_now",
-        kind: Evidence::ExecutableContract,
-        limitation: "The policy governs the timer, not a caller. Every prior call site keeps \
-                     its behaviour.", source: "6b550ea" },
-    Claim { id: "M3", domain: "Managed incident", claim: "deferring the rewrite preserves state and history",
-        status: Status::Proven, evidence: "deferring_the_rewrite_preserves_state_and_history",
-        kind: Evidence::ExecutableContract,
-        limitation: "State and history digests across a reopen. The log stays longer than \
-                     needed, which is the accepted cost.", source: "6b550ea" },
-    Claim { id: "M4", domain: "Managed incident", claim: "an overload is refused with a status, a code and a retry hint",
-        status: Status::Proven, evidence: "an_overload_is_an_explicit_refusal_with_a_retry_hint",
-        kind: Evidence::ExecutableContract,
-        limitation: "The refusal's shape is asserted. THAT THE BOUND AND DEADLINE FIRE UNDER \
-                     REAL LOAD IS NOT TESTED; there is no load harness.", source: "6b550ea" },
-    Claim { id: "M5", domain: "Managed incident", claim: "a bounded search visits only as many rows as its limit",
-        status: Status::Proven, evidence: "a_bounded_search_stops_at_the_limit_instead_of_scanning",
-        kind: Evidence::ExecutableContract,
-        limitation: "500 rows, limit 10, exactly 10 predicate visits. THIS BOUNDS THE SEARCH \
-                     AND PROVENANCE PATHS ONLY, not every read in the database.",
-        source: "6b550ea" },
-    Claim { id: "M6", domain: "Managed incident", claim: "compaction no longer blocks the database",
-        status: Status::Unproven, evidence: "", kind: Evidence::None,
-        limitation: "EXPLICITLY NOT CLAIMED. A rewrite still holds the global lock for its \
-                     duration; it merely happens rarely and off the runtime. A large enough \
-                     database will still stall while one runs. `the_rewrite_cost_grows_with_the_\
-                     database` measures that it grows.", source: "6b550ea" },
-    Claim { id: "M7", domain: "Managed incident", claim: "readiness performs a real scoped storage probe",
-        status: Status::PartiallyProven, evidence: "a_recovered_open_does_not_report_the_same_health_as_a_clean_one",
-        kind: Evidence::ImplementationInspection,
-        limitation: "The storage conditions it reports are tested at the library boundary. \
-                     THE `/health/ready` HANDLER ITSELF IS NOT EXERCISED BY A TEST, including \
-                     the STORAGE_STALLED path; there is no HTTP-level harness.",
-        source: "6b550ea" },
-    Claim { id: "M8", domain: "Managed incident", claim: "scoped reads stay correct and bounded while a compaction runs",
-        status: Status::Proven, evidence: "scoped_reads_stay_correct_and_bounded_while_compaction_runs",
-        kind: Evidence::ExecutableContract,
-        limitation: "The composed shape, not the isolated fixes. NO LATENCY IS MEASURED, so \
-                     this is not evidence that the incident cannot recur; see M6.",
-        source: "#315" },
-    Claim { id: "M9", domain: "Managed incident", claim: "a compaction concurrent with traffic leaves the database intact",
-        status: Status::Proven, evidence: "a_concurrent_compaction_leaves_the_database_intact",
-        kind: Evidence::ExecutableContract,
-        limitation: "Correctness under concurrency, including a forced rewrite and a reopen. \
-                     Says nothing about how long anything waited.",
-        source: "#315" },
-];
-
-fn matrix() -> BTreeMap<&'static str, &'static Claim> {
-    CERTIFICATION.iter().map(|c| (c.id, c)).collect()
-}
-
-/// Every test named as evidence, gathered from the test sources on disk.
-/// Resolve a claim's `evidence` field to something that actually exists.
-///
-/// Two citation forms are permitted, and the permitted form depends on the
-/// evidence *kind*:
-///
-/// - a **test function name**, which must be a `fn` in this repository's test
-///   suites (or in the server crate, which holds its tests inline);
-/// - a **source location** of the form `path/to/file.rs:Symbol`, permitted only
-///   for `ImplementationInspection`, where there is by definition no test. The
-///   file must exist and must contain the named symbol.
-///
-/// The restriction is the point: a claim may not dodge the test requirement by
-/// citing a source file. Only a claim that has already been marked as resting
-/// on inspection — and which `inspection_alone_never_proves_a_behavioural_claim`
-/// therefore forbids from being `Proven` — may cite one.
-fn evidence_resolves(claim: &Claim, known: &[String]) -> bool {
-    match claim.evidence.split_once(".rs:") {
-        Some((file, symbol)) if claim.kind == Evidence::ImplementationInspection => {
-            let path = std::path::Path::new(concat!(env!("CARGO_MANIFEST_DIR"), "/../.."))
-                .join(format!("{file}.rs"));
-            match std::fs::read_to_string(path) {
-                Ok(source) => source.contains(symbol),
-                Err(_) => false,
-            }
-        }
-        Some(_) => false,
-        None => known.iter().any(|f| f == claim.evidence),
-    }
-}
-
-/// A tripwire that cannot fire is decoration, so the mention/assertion rule has
-/// its own negative control.
-#[test]
-fn the_forbidden_phrase_rule_separates_assertion_from_mention() {
-    // Asserted: flagged.
-    assert!(common::asserts_phrase(
-        "feltdb is power-loss safe.",
-        "power-loss safe"
-    ));
-    assert!(common::asserts_phrase(
-        "a mention of \"power-loss safe\" here, but the next line is not.\n\
-         and feltdb is power-loss safe.",
-        "power-loss safe"
-    ));
-
-    // Merely named: not flagged.
-    assert!(!common::asserts_phrase(
-        "a test asserts no mode's wording contains \"power-loss safe\".",
-        "power-loss safe"
-    ));
-    assert!(!common::asserts_phrase(
-        "the phrase `power-loss safe` appears nowhere in the api.",
-        "power-loss safe"
-    ));
-
-    // An unbalanced delimiter must not silence the line it opens.
-    assert!(common::asserts_phrase(
-        "the \"mode is power-loss safe",
-        "power-loss safe"
-    ));
-
-    // Absent: not flagged.
-    assert!(!common::asserts_phrase(
-        "flushed is not synced.",
-        "power-loss safe"
-    ));
-}
-
-/// The published document, read from disk.
-fn published_document() -> String {
-    let path = concat!(
-        env!("CARGO_MANIFEST_DIR"),
-        "/../../docs/architecture/production-certification.md"
-    );
-    std::fs::read_to_string(path).expect("the certification document exists and is readable")
-}
-
-/// The status counts the document publishes, read out of its summary table.
-fn published_counts() -> BTreeMap<String, usize> {
-    let mut counts = BTreeMap::new();
-    for line in published_document().lines() {
-        let Some(cells) = common::table_cells(line) else {
-            continue;
-        };
-        if cells.len() != 2 {
-            continue;
-        }
-        let label = cells[0].clone();
-        if !Status::ALL.iter().any(|status| status.label() == label) {
-            continue;
-        }
-        let Ok(count) = cells[1].parse::<usize>() else {
-            continue;
-        };
-        assert!(
-            counts.insert(label.clone(), count).is_none(),
-            "the document publishes the count for `{label}` more than once"
-        );
-    }
-    counts
-}
-
-/// One claim row as the document renders it.
-struct PublishedRow {
-    status: String,
-    evidence: String,
-    kind: String,
-    source: String,
-}
-
-/// Every claim row in the document, keyed by claim id.
-fn published_rows() -> BTreeMap<String, PublishedRow> {
-    let mut rows = BTreeMap::new();
-    for line in published_document().lines() {
-        let Some(cells) = common::table_cells(line) else {
-            continue;
-        };
-        // id | domain | claim | status | evidence | kind | limitation | source
-        if cells.len() != 8 {
-            continue;
-        }
-        let id = cells[0].clone();
-        let looks_like_a_claim_id = id.len() >= 2
-            && id.starts_with(|c: char| c.is_ascii_uppercase())
-            && id[1..].chars().all(|c| c.is_ascii_digit());
-        if !looks_like_a_claim_id {
-            continue;
-        }
-        assert!(
-            rows.insert(
-                id.clone(),
-                PublishedRow {
-                    status: cells[3].clone(),
-                    // An em dash is the document's rendering of "no evidence".
-                    evidence: if cells[4] == "—" {
-                        String::new()
-                    } else {
-                        cells[4].clone()
-                    },
-                    kind: cells[5].clone(),
-                    source: cells[7].clone(),
-                },
-            )
-            .is_none(),
-            "the document publishes claim `{id}` more than once"
-        );
-    }
-    rows
-}
-
-fn known_test_functions() -> Vec<String> {
-    let mut found = Vec::new();
-    let root = concat!(env!("CARGO_MANIFEST_DIR"), "/tests");
-    for entry in std::fs::read_dir(root).expect("the tests directory is readable") {
-        let path = entry.expect("a readable entry").path();
-        if path.extension().and_then(|e| e.to_str()) != Some("rs") {
-            continue;
-        }
-        let source = std::fs::read_to_string(&path).expect("a readable test file");
-        for line in source.lines() {
-            if let Some(rest) = line.trim().strip_prefix("fn ") {
-                if let Some(name) = rest.split('(').next() {
-                    found.push(name.to_string());
-                }
-            }
-        }
-    }
-    // The server crate holds the admission and health-status tests.
-    let server = concat!(env!("CARGO_MANIFEST_DIR"), "/../feltdb-server/src/main.rs");
-    if let Ok(source) = std::fs::read_to_string(server) {
-        for line in source.lines() {
-            if let Some(rest) = line.trim().strip_prefix("fn ") {
-                if let Some(name) = rest.split('(').next() {
-                    found.push(name.to_string());
-                }
-            }
-        }
-    }
-    found
-}
-
-// ===========================================================================
-// Matrix integrity
-// ===========================================================================
-
-/// The statuses an earlier ledger records for the same claims.
-///
-/// Parsed rather than duplicated, so this cannot drift from the file it reads.
-fn readiness_ledger() -> BTreeMap<String, String> {
-    let readiness = include_str!("production_readiness_contract.rs");
-    let start = readiness
-        .find("const CLAIMS")
-        .expect("the readiness contract declares CLAIMS");
-    let end = start
-        + readiness[start..]
-            .find("];")
-            .expect("the CLAIMS table terminates");
-    let table = &readiness[start..end];
-
-    let mut ledger = BTreeMap::new();
-    let mut pending: Option<String> = None;
-    for line in table.lines() {
-        let trimmed = line.trim().trim_start_matches('(').trim();
-        if let Some(rest) = trimmed.strip_prefix('"') {
-            if let Some(id) = rest.split(' ').next() {
-                if id.len() >= 2 {
-                    pending = Some(id.to_string());
-                }
-            }
-        }
-        if let Some(index) = line.find("Status::") {
-            let status: String = line[index + "Status::".len()..]
-                .chars()
-                .take_while(|character| character.is_alphanumeric())
-                .collect();
-            if let Some(id) = pending.take() {
-                ledger.insert(id, status);
-            }
-        }
-    }
-    ledger
-}
-
-/// **Every disagreement with an earlier ledger is declared.**
-///
-/// This is the tripwire that makes recalculation safe. Re-deriving a claim from
-/// current evidence is only honest if a changed answer is visible; otherwise two
-/// files quietly assert different things and the reader believes whichever they
-/// opened first.
-///
-/// It fails three ways. A claim whose status differs and is not in `DOWNGRADES`
-/// fails. A declared downgrade whose earlier ledger no longer records the prior
-/// status fails — so closing the gap for real forces this table to be updated
-/// rather than left as a stale accusation. And a declared change that makes a
-/// claim *stronger* fails, because new evidence is not a downgrade and must not
-/// be recorded as one.
-#[test]
-fn every_disagreement_with_an_earlier_ledger_is_declared() {
-    let ledger = readiness_ledger();
-    let certified = matrix();
-    assert!(
-        ledger.len() > 40,
-        "the readiness ledger did not parse; it yielded {} entries",
-        ledger.len()
-    );
-
-    let mut problems = Vec::new();
-
-    for (id, earlier) in &ledger {
-        let Some(claim) = certified.get(id.as_str()) else {
-            continue;
-        };
-        let now = claim.status.variant();
-        if now == earlier {
-            continue;
-        }
-        match DOWNGRADES.iter().find(|(claim_id, ..)| claim_id == id) {
-            None => problems.push(format!(
-                "{id}: the readiness ledger records `{earlier}`, this audit records `{now}`, \
-                 and the disagreement is not declared"
-            )),
-            Some((_, from, to, _)) => {
-                if from != earlier {
-                    problems.push(format!(
-                        "{id}: declared as a downgrade from `{from}`, but the readiness ledger \
-                         now records `{earlier}`"
-                    ));
-                }
-                if to != &now {
-                    problems.push(format!(
-                        "{id}: declared as a downgrade to `{to}`, but this audit records `{now}`"
-                    ));
-                }
-            }
-        }
-    }
-
-    for (id, from, to, why) in DOWNGRADES {
-        let claim = certified
-            .get(id)
-            .unwrap_or_else(|| panic!("{id} is declared as a downgrade and is not in the matrix"));
-        assert_eq!(
-            claim.status.variant(),
-            *to,
-            "{id} is declared as a downgrade to `{to}`"
-        );
-        assert_eq!(
-            ledger.get(*id).map(String::as_str),
-            Some(*from),
-            "{id} is declared as a downgrade from `{from}`; the earlier ledger disagrees"
-        );
-        assert!(
-            !why.trim().is_empty(),
-            "{id} is declared as a downgrade with no reason"
-        );
-
-        let stronger = Status::ALL
-            .iter()
-            .find(|status| status.variant() == *from)
-            .expect("a declared prior status is a real status");
-        assert!(
-            claim.status.strength() < stronger.strength(),
-            "{id} is declared as a downgrade but `{to}` is not weaker than `{from}`"
-        );
-    }
-
-    assert!(problems.is_empty(), "{}", problems.join("\n"));
-}
-
-/// Claim identifiers are unique.
-#[test]
-fn every_claim_has_a_unique_identifier() {
-    assert_eq!(
-        matrix().len(),
-        CERTIFICATION.len(),
-        "a claim identifier is used twice"
-    );
-}
-
-/// **Every `Proven` claim names a test that exists.**
-///
-/// The central tripwire. A claim cannot be `Proven` on the strength of an
-/// implementation existing, of another claim, or of a test that was renamed or
-/// deleted.
-#[test]
-fn every_proven_claim_names_a_test_that_exists() {
-    let known = known_test_functions();
-    let mut problems = Vec::new();
-
-    for claim in CERTIFICATION {
-        let proven = claim.status == Status::Proven;
-        if proven && claim.evidence.is_empty() {
-            problems.push(format!("{}: Proven with no named evidence", claim.id));
-            continue;
-        }
-        if !claim.evidence.is_empty() && !evidence_resolves(claim, &known) {
-            problems.push(format!(
-                "{}: names `{}`, which resolves to nothing in this repository",
-                claim.id, claim.evidence
-            ));
-        }
-        if proven && claim.kind == Evidence::None {
-            problems.push(format!("{}: Proven with evidence kind None", claim.id));
-        }
-    }
-
-    assert!(problems.is_empty(), "{}", problems.join("\n"));
-}
-
-/// **Implementation inspection alone never carries a `Proven` behavioural
-/// claim.**
-///
-/// Reading the code establishes what the code says, not what it does under a
-/// condition nobody has run.
-#[test]
-fn inspection_alone_never_proves_a_behavioural_claim() {
-    for claim in CERTIFICATION {
-        if claim.kind == Evidence::ImplementationInspection {
-            assert_ne!(
-                claim.status,
-                Status::Proven,
-                "{} is Proven on implementation inspection alone: {}",
-                claim.id,
-                claim.claim
-            );
-        }
-    }
-}
-
-/// Every claim that is not fully `Proven` says what is missing, and every
-/// claim with no evidence has no evidence kind.
-#[test]
-fn every_claim_states_its_limitation() {
-    for claim in CERTIFICATION {
-        assert!(
-            !claim.limitation.trim().is_empty(),
-            "{} has no stated limitation",
-            claim.id
-        );
-        if claim.evidence.is_empty() {
-            assert_eq!(
-                claim.kind,
-                Evidence::None,
-                "{} names no evidence but claims a kind",
-                claim.id
-            );
-        }
-    }
-}
-
-/// The certification covers every claim the readiness contract declares.
-///
-/// The two files are kept in step mechanically rather than by memory: a claim
-/// added to one and forgotten in the other fails here.
-#[test]
-fn the_certification_covers_the_readiness_contract() {
-    let readiness = include_str!("production_readiness_contract.rs");
-    let start = readiness
-        .find("const CLAIMS")
-        .expect("the readiness contract declares CLAIMS");
-    let end = readiness[start..]
-        .find("];")
-        .map(|offset| start + offset)
-        .expect("the CLAIMS table terminates");
-    let table = &readiness[start..end];
-
-    let certified = matrix();
-    let mut missing = Vec::new();
-    for line in table.lines() {
-        let trimmed = line.trim();
-        let Some(rest) = trimmed.strip_prefix('"') else {
-            continue;
-        };
-        let Some(id) = rest.split(' ').next() else {
-            continue;
-        };
-        if id.len() >= 2 && !certified.contains_key(id) {
-            missing.push(id.to_string());
-        }
-    }
-    missing.sort();
-    missing.dedup();
-    assert!(
-        missing.is_empty(),
-        "declared in the readiness contract and absent from the certification: {missing:?}"
-    );
-}
-
-// ===========================================================================
-// Claim-inflation tripwires
-// ===========================================================================
-
-/// **The substitutions this certification refuses to make.**
-///
-/// Each pair is a real temptation, and each has been available at some point in
-/// this work. Encoding them means a future change cannot make the stronger
-/// claim by editing a status.
-#[test]
-fn no_claim_is_inflated_into_a_stronger_one() {
-    let certified = matrix();
-    let must_not_be_proven = [
-        (
-            "D5",
-            "a barrier being issued is not the hardware preserving data",
-        ),
-        (
-            "E7",
-            "a configured grouping interval is not a measured speed advantage",
-        ),
-        (
-            "B5",
-            "a working library primitive is not an operator workflow",
-        ),
-        ("R4", "detection on inspection is not proactive monitoring"),
-        ("M6", "a deferred rewrite is not a non-blocking compaction"),
-    ];
-
-    for (id, why) in must_not_be_proven {
-        let claim = certified
-            .get(id)
-            .unwrap_or_else(|| panic!("{id} is missing"));
-        assert_ne!(
-            claim.status,
-            Status::Proven,
-            "{id} must not be Proven: {why}"
-        );
-    }
-
-    // State convergence must never stand in for history convergence: the claim
-    // that separates them has to remain Proven and independently evidenced.
-    let separation = certified.get("S4").expect("S4 exists");
-    assert_eq!(separation.status, Status::Proven);
-    assert_eq!(
-        separation.evidence, "same_state_with_different_history_is_detected",
-        "the negative control is what keeps every other replication claim honest"
-    );
-    assert_ne!(
-        certified.get("S1").unwrap().evidence,
-        separation.evidence,
-        "state convergence and history convergence must not rest on one test"
-    );
-}
-
-/// **No document claims a guarantee the matrix does not permit.**
-///
-/// Documentation drifts faster than tests. These phrases would each assert
-/// something the evidence does not support, so their absence is checked rather
-/// than trusted.
-#[test]
-fn no_document_asserts_a_guarantee_the_matrix_withholds() {
-    let docs = concat!(env!("CARGO_MANIFEST_DIR"), "/../../docs/architecture");
-    let forbidden = [
-        "power-loss safe",
-        "power loss safe",
-        "guaranteed durable",
-        "compaction is non-blocking",
-        "compaction no longer blocks",
-        "all reads are bounded",
-        "supported capacity",
-    ];
-
-    let mut violations = Vec::new();
-    for entry in std::fs::read_dir(docs).expect("the architecture docs are readable") {
-        let path = entry.expect("a readable entry").path();
-        if path.extension().and_then(|e| e.to_str()) != Some("md") {
-            continue;
-        }
-        let document = std::fs::read_to_string(&path).expect("a readable document");
-        let prose = common::prose_excluding_withheld_rows(&document, WITHHELD_LABELS);
-        for phrase in forbidden {
-            if common::asserts_phrase(&prose, phrase) {
-                violations.push(format!(
-                    "{}: asserts \"{phrase}\"",
-                    path.file_name().unwrap().to_string_lossy()
-                ));
-            }
-        }
-    }
-    assert!(violations.is_empty(), "{}", violations.join("\n"));
-}
-
-// ===========================================================================
-// Derived counts
-// ===========================================================================
-
-/// Counts are computed from the matrix, never maintained by hand.
-///
-/// The numbers below are the certification's published totals. They are
-/// asserted so the document and the table cannot disagree.
-#[test]
-fn the_published_counts_are_derived_from_the_matrix() {
-    let mut derived: BTreeMap<&str, usize> = BTreeMap::new();
-    for status in Status::ALL {
-        derived.insert(status.label(), 0);
-    }
-    for claim in CERTIFICATION {
-        *derived.entry(claim.status.label()).or_default() += 1;
-    }
-
-    let total: usize = derived.values().sum();
-    assert_eq!(
-        total,
-        CERTIFICATION.len(),
-        "every claim has exactly one status"
-    );
-
-    // The document may not carry a total of its own. Each count it publishes is
-    // checked against the count computed here, and every status must appear —
-    // so a bucket cannot be quietly dropped from the published summary because
-    // it is inconvenient.
-    let published = published_counts();
-    for (label, count) in &derived {
-        let shown = published.get(*label).copied().unwrap_or_else(|| {
-            panic!("the certification document publishes no count for `{label}`")
-        });
-        assert_eq!(
-            shown, *count,
-            "the document publishes {shown} `{label}` claims; the matrix holds {count}"
-        );
-    }
-    assert_eq!(
-        published.len(),
-        derived.len(),
-        "the document publishes a status the matrix does not define"
-    );
-}
-
-/// The published matrix is a rendering of the executable one, not a second
-/// record of the same facts.
-///
-/// Every claim must appear in the document with the same status, the same
-/// evidence and the same source. A downgrade that lands in the test file and
-/// not in the document — or the reverse — fails here.
-#[test]
-fn the_published_matrix_matches_the_executable_matrix() {
-    let rows = published_rows();
-    let mut problems = Vec::new();
-
-    for claim in CERTIFICATION {
-        match rows.get(claim.id) {
-            None => problems.push(format!("{}: absent from the document", claim.id)),
-            Some(row) => {
-                if row.status != claim.status.label() {
-                    problems.push(format!(
-                        "{}: the document says `{}`, the matrix says `{}`",
-                        claim.id,
-                        row.status,
-                        claim.status.label()
-                    ));
-                }
-                if row.evidence != claim.evidence {
-                    problems.push(format!(
-                        "{}: the document cites `{}`, the matrix cites `{}`",
-                        claim.id, row.evidence, claim.evidence
-                    ));
-                }
-                if row.kind != claim.kind.label() {
-                    problems.push(format!(
-                        "{}: the document types the evidence `{}`, the matrix types it `{}`",
-                        claim.id,
-                        row.kind,
-                        claim.kind.label()
-                    ));
-                }
-                if row.source != claim.source {
-                    problems.push(format!(
-                        "{}: the document sources `{}`, the matrix sources `{}`",
-                        claim.id, row.source, claim.source
-                    ));
-                }
-            }
-        }
-    }
-
-    for id in rows.keys() {
-        if !CERTIFICATION.iter().any(|claim| &claim.id == id) {
-            problems.push(format!("{id}: in the document, absent from the matrix"));
-        }
-    }
-
-    assert!(problems.is_empty(), "{}", problems.join("\n"));
-}
-
-/// Every domain the certification covers is represented, and the managed
-/// incident is among them.
-#[test]
-fn every_domain_is_represented_including_the_managed_incident() {
-    let mut domains: BTreeMap<&str, usize> = BTreeMap::new();
-    for claim in CERTIFICATION {
-        *domains.entry(claim.domain).or_default() += 1;
-    }
-    for domain in [
-        "Durability",
-        "Atomicity",
-        "Recovery",
-        "History",
-        "Backup",
-        "Replication",
-        "Envelope",
-        "Format",
-        "Observability",
-        "Managed incident",
-    ] {
-        assert!(
-            domains.contains_key(domain),
-            "the certification has no {domain} claims"
-        );
-    }
-    assert_eq!(
-        domains.get("Managed incident").copied().unwrap_or(0),
-        9,
-        "the incident remediation shipped with tests and no matrix entry; it has one now, \
-         plus the two composed-shape claims this audit added"
-    );
-}
-
-/// The intentional gaps are still gaps.
-///
-/// A certification whose Unproven claims quietly disappear is worse than one
-/// that keeps them. Each of these must remain present and unproven until real
-/// evidence exists.
-#[test]
-fn the_known_gaps_have_not_disappeared() {
-    let certified = matrix();
-    for id in ["D5", "E7", "B5", "R4", "M6"] {
-        let claim = certified
-            .get(id)
-            .unwrap_or_else(|| panic!("{id} was removed from the certification"));
-        assert_eq!(
-            claim.status,
-            Status::Unproven,
-            "{id} changed status without new evidence"
-        );
-        assert!(
-            claim.evidence.is_empty(),
-            "{id} names evidence but is still Unproven"
-        );
-    }
-}