@feltdb/core 0.8.6 → 0.8.8

package/dist/create/server-source/crates/feltdb/tests/production_certification.rs

@@ -0,0 +1,1153 @@
+//! The FeltDB production certification matrix.
+//!
+//! This file is the **authoritative** statement of what FeltDB can and cannot
+//! claim. Every count in `docs/architecture/production-certification.md` is
+//! derived from the table below; none is maintained by hand.
+//!
+//! # The certification principle
+//!
+//! > For every claim: **what exact evidence proves this today, and what does
+//! > that evidence not prove?**
+//!
+//! A claim is not `Proven` because an implementation exists, because another
+//! claim implies it, because an earlier change said so, because a related test
+//! passes, or because the wording sounds reasonable. Every `Proven` claim names
+//! a test that exists and runs now.
+//!
+//! # What this audit changed
+//!
+//! Recalculating rather than inheriting **downgraded two claims** that earlier
+//! work recorded as `Proven` (see `DOWNGRADES`), corrected two dangling
+//! evidence citations, and added the managed-incident remediation, which
+//! had shipped with tests but no matrix entry at all. Discovering that an
+//! earlier conclusion no longer holds is the point of the exercise, not a
+//! failure of it.
+
+use std::collections::BTreeMap;
+
+mod common;
+
+/// The status labels that withhold rather than grant. A table row carrying one
+/// of these is recording a gap, and is read as such by the prose tripwire.
+const WITHHELD_LABELS: &[&str] = &["Partially Proven", "Unproven", "Blocked", "Not Applicable"];
+
+/// The only statuses this certification recognises.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+enum Status {
+    Proven,
+    PartiallyProven,
+    Unproven,
+    Blocked,
+    NotApplicable,
+}
+
+impl Status {
+    /// Every status this certification recognises. Counts are derived over this
+    /// list, so a bucket that happens to be empty is still published as zero.
+    const ALL: [Status; 5] = [
+        Status::Proven,
+        Status::PartiallyProven,
+        Status::Unproven,
+        Status::Blocked,
+        Status::NotApplicable,
+    ];
+
+    /// The enum variant's own name, which is how earlier ledgers spell it.
+    fn variant(self) -> &'static str {
+        match self {
+            Status::Proven => "Proven",
+            Status::PartiallyProven => "PartiallyProven",
+            Status::Unproven => "Unproven",
+            Status::Blocked => "Blocked",
+            Status::NotApplicable => "NotApplicable",
+        }
+    }
+
+    /// How much a status claims. Only used to assert that a divergence from an
+    /// earlier ledger is a *weakening*; a strengthening needs new evidence and
+    /// must not slip through as a declared downgrade.
+    fn strength(self) -> u8 {
+        match self {
+            Status::Proven => 3,
+            Status::PartiallyProven => 2,
+            Status::Blocked => 1,
+            Status::Unproven | Status::NotApplicable => 0,
+        }
+    }
+
+    fn label(self) -> &'static str {
+        match self {
+            Status::Proven => "Proven",
+            Status::PartiallyProven => "Partially Proven",
+            Status::Unproven => "Unproven",
+            Status::Blocked => "Blocked",
+            Status::NotApplicable => "Not Applicable",
+        }
+    }
+}
+
+/// How a claim is established. The distinction matters: implementation
+/// inspection alone may not carry a *behavioural* guarantee.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Evidence {
+    /// A test that exercises the behaviour and asserts the outcome.
+    ExecutableContract,
+    /// A test that damages, truncates or kills something and asserts recovery.
+    FailureInjection,
+    /// A test that runs a fixed experiment and asserts a relationship.
+    DeterministicExperiment,
+    /// A measurement under a frozen workload.
+    Benchmark,
+    /// Reading the code. Sufficient only for structural claims.
+    ImplementationInspection,
+    /// No evidence exists.
+    None,
+}
+
+impl Evidence {
+    /// How the published document names this evidence type.
+    fn label(self) -> &'static str {
+        match self {
+            Evidence::ExecutableContract => "Executable contract",
+            Evidence::FailureInjection => "Failure injection",
+            Evidence::DeterministicExperiment => "Deterministic experiment",
+            Evidence::Benchmark => "Benchmark",
+            Evidence::ImplementationInspection => "Implementation inspection",
+            Evidence::None => "None",
+        }
+    }
+}
+
+struct Claim {
+    id: &'static str,
+    domain: &'static str,
+    claim: &'static str,
+    status: Status,
+    /// The test function that establishes this claim, or "" when there is none.
+    evidence: &'static str,
+    kind: Evidence,
+    /// What the evidence does **not** establish. Required for every claim that
+    /// is not fully `Proven`, and used freely on `Proven` ones.
+    limitation: &'static str,
+    source: &'static str,
+}
+
+/// Where this audit disagrees with the ledger of the pull request that first
+/// recorded a claim.
+///
+/// The earlier ledgers stay as they are: they are the record of what #307, #313
+/// and #314 concluded on the evidence they had, and rewriting them would erase
+/// the fact that the conclusion changed. But a disagreement must never be
+/// silent, so every one of them is declared here and checked in both
+/// directions — the earlier ledger must still say what this table claims it
+/// says, and the certification must still say the weaker thing.
+///
+/// `(claim, what the earlier ledger records, what this audit records, why)`
+const DOWNGRADES: &[(&str, &str, &str, &str)] = &[
+    (
+        "E6",
+        "Proven",
+        "PartiallyProven",
+        "the frozen workload is asserted by a test; the environment is only in prose",
+    ),
+    (
+        "O2",
+        "Proven",
+        "PartiallyProven",
+        "the library value and the status derivation are tested; the HTTP handler is not",
+    ),
+];
+
+/// The certification matrix.
+///
+/// Laid out as a table on purpose: a claim is meant to be read across its row,
+/// and the fields line up so a missing limitation or an empty evidence cell is
+/// visible at a glance. `rustfmt` would expand each entry to nine lines and
+/// lose that.
+#[rustfmt::skip]
+const CERTIFICATION: &[Claim] = &[
+    // ---------------------------------------------------------------- D
+    Claim { id: "D1", domain: "Durability", claim: "committed mutations survive a clean restart",
+        status: Status::Proven, evidence: "a_clean_restart_preserves_state_history_and_retention",
+        kind: Evidence::ExecutableContract,
+        limitation: "A clean, cooperative shutdown. Says nothing about an abrupt one.",
+        source: "#307" },
+    Claim { id: "D2", domain: "Durability", claim: "revision history survives a clean restart",
+        status: Status::Proven, evidence: "a_clean_restart_preserves_state_history_and_retention",
+        kind: Evidence::ExecutableContract, limitation: "As D1.", source: "#307" },
+    Claim { id: "D3", domain: "Durability", claim: "retention policy and horizon survive a restart",
+        status: Status::Proven, evidence: "a_clean_restart_preserves_state_history_and_retention",
+        kind: Evidence::ExecutableContract, limitation: "As D1.", source: "#306" },
+    Claim { id: "D4", domain: "Durability", claim: "a reopened database continues history rather than restarting it",
+        status: Status::Proven, evidence: "a_clean_restart_preserves_state_history_and_retention",
+        kind: Evidence::ExecutableContract, limitation: "As D1.", source: "#306" },
+    Claim { id: "D5", domain: "Durability", claim: "a single write survives operating-system or power loss",
+        status: Status::Unproven, evidence: "", kind: Evidence::None,
+        limitation: "NOT PROVEN AND NOT PROVABLE HERE. The default mode flushes to the \
+                     operating system without fsync. `Synced` mode issues a barrier per write, \
+                     but whether the device honoured it is a property of the storage stack that \
+                     no test in this repository can observe. Settling this needs an experiment \
+                     that cuts power to real hardware.",
+        source: "#312, #314" },
+    Claim { id: "D6", domain: "Durability", claim: "every crash point leaves a clean prefix of the mutation sequence",
+        status: Status::Proven, evidence: "every_crash_point_leaves_a_clean_prefix",
+        kind: Evidence::FailureInjection,
+        limitation: "Truncation models the durable bytes at every byte boundary of a \
+                     three-write log. It does not model a filesystem reordering writes or a \
+                     device returning stale data.",
+        source: "#312" },
+    Claim { id: "D7", domain: "Durability", claim: "a crash never produces a revision for a record that was not written",
+        status: Status::Proven, evidence: "no_crash_point_produces_a_phantom_revision",
+        kind: Evidence::FailureInjection,
+        limitation: "Follows from record-before-revision ordering; verified over one workload.",
+        source: "#312" },
+    Claim { id: "D8", domain: "Durability", claim: "a committed write survives the process dying",
+        status: Status::Proven, evidence: "a_committed_write_survives_process_death",
+        kind: Evidence::FailureInjection,
+        limitation: "A real SIGABRT. The process, not the machine.", source: "#312" },
+    Claim { id: "D9", domain: "Durability", claim: "a transaction is all-or-nothing across a crash",
+        status: Status::Proven, evidence: "a_transaction_is_all_or_nothing_at_every_crash_point",
+        kind: Evidence::FailureInjection,
+        limitation: "Every byte offset of one three-row transaction.", source: "#312" },
+    Claim { id: "D10", domain: "Durability", claim: "a crash-recovered database replicates identically",
+        status: Status::Proven, evidence: "a_crash_recovered_database_replicates_identically",
+        kind: Evidence::FailureInjection,
+        limitation: "Crash points sampled every 37 bytes, not exhaustively.", source: "#312" },
+    // ---------------------------------------------------------------- A
+    Claim { id: "A1", domain: "Atomicity", claim: "a stale fenced write is rejected and mints nothing",
+        status: Status::Proven, evidence: "a_stale_fenced_write_is_rejected_and_mints_nothing",
+        kind: Evidence::ExecutableContract, limitation: "Version conflict only.", source: "#307" },
+    Claim { id: "A2", domain: "Atomicity", claim: "concurrent writes to distinct resources keep distinct chains",
+        status: Status::Proven, evidence: "concurrent_writes_produce_correct_chains",
+        kind: Evidence::ExecutableContract,
+        limitation: "Four threads, twenty-five writes each, on one machine.", source: "#307" },
+    Claim { id: "A3", domain: "Atomicity", claim: "concurrent writes to one resource form one correct chain",
+        status: Status::Proven, evidence: "concurrent_writes_produce_correct_chains",
+        kind: Evidence::ExecutableContract,
+        limitation: "One hundred writes producing one hundred unique sequences. Not a \
+                     stress test.", source: "#307" },
+    Claim { id: "A4", domain: "Atomicity", claim: "a duplicate remote operation is idempotent",
+        status: Status::Proven, evidence: "replayed_and_gapped_remote_operations_are_handled_explicitly",
+        kind: Evidence::ExecutableContract, limitation: "Whole-stream replay.", source: "#307" },
+    Claim { id: "A5", domain: "Atomicity", claim: "a remote operation with a sequence gap is rejected",
+        status: Status::Proven, evidence: "replayed_and_gapped_remote_operations_are_handled_explicitly",
+        kind: Evidence::ExecutableContract, limitation: "One gap shape.", source: "#307" },
+    Claim { id: "A6", domain: "Atomicity", claim: "a crash part-way through a mutation leaves consistent state",
+        status: Status::Proven, evidence: "every_crash_point_leaves_a_clean_prefix",
+        kind: Evidence::FailureInjection, limitation: "As D6.", source: "#312" },
+    // ---------------------------------------------------------------- R
+    Claim { id: "R1", domain: "Recovery", claim: "an incomplete final append is recovered and reported, not silently dropped",
+        status: Status::Proven, evidence: "an_unterminated_final_record_is_recovered_and_reported",
+        kind: Evidence::FailureInjection,
+        limitation: "A KNOWN INCOMPLETE APPEND ONLY. This is not general recovery from \
+                     storage failure.", source: "#309" },
+    Claim { id: "R2", domain: "Recovery", claim: "a complete but invalid record refuses the open, wherever it sits",
+        status: Status::Proven, evidence: "a_complete_but_invalid_final_record_refuses_the_open",
+        kind: Evidence::FailureInjection,
+        limitation: "Detection and refusal. Damaged records are never repaired.", source: "#309" },
+    Claim { id: "R3", domain: "Recovery", claim: "damaged ancestry is distinguishable from expired ancestry",
+        status: Status::Proven, evidence: "damaged_ancestry_is_distinguishable_from_expired_ancestry",
+        kind: Evidence::ExecutableContract,
+        limitation: "On inspection of a named revision. See R4.", source: "#306, #307" },
+    Claim { id: "R4", domain: "Recovery", claim: "ancestry damage is surfaced without being asked for",
+        status: Status::Unproven, evidence: "", kind: Evidence::None,
+        limitation: "`parent_of` distinguishes Expired from Missing when a caller asks about \
+                     a specific revision. NOTHING SCANS PROACTIVELY. Detection on inspection is \
+                     not monitoring.", source: "#307" },
+    // ---------------------------------------------------------------- H
+    Claim { id: "H1", domain: "History", claim: "history is bounded under a configured policy",
+        status: Status::Proven, evidence: "repeated_mutation_has_bounded_history",
+        kind: Evidence::ExecutableContract, limitation: "Count-based policy only.", source: "#306" },
+    Claim { id: "H2", domain: "History", claim: "history is unbounded without one, by design",
+        status: Status::Proven, evidence: "the_retention_envelope_behaves_in_both_directions",
+        kind: Evidence::ExecutableContract,
+        limitation: "A stated contract, not an omission.", source: "#306" },
+    Claim { id: "H3", domain: "History", claim: "a policy change takes effect in both directions",
+        status: Status::Proven, evidence: "the_retention_envelope_behaves_in_both_directions",
+        kind: Evidence::ExecutableContract,
+        limitation: "Loosening does not restore what was expired.", source: "#306" },
+    Claim { id: "H4", domain: "History", claim: "maintenance never rewrites history",
+        status: Status::Proven, evidence: "maintenance_never_rewrites_history_and_forks_survive",
+        kind: Evidence::ExecutableContract,
+        limitation: "Compaction, an unrelated write and a retention pass.", source: "#306" },
+    Claim { id: "H5", domain: "History", claim: "forked history is preserved",
+        status: Status::Proven, evidence: "maintenance_never_rewrites_history_and_forks_survive",
+        kind: Evidence::ExecutableContract, limitation: "Two heads from one base.", source: "#306" },
+    // ---------------------------------------------------------------- B
+    Claim { id: "B1", domain: "Backup", claim: "a durable backup artifact is self-contained and independently verifiable",
+        status: Status::Proven, evidence: "a_backup_is_self_contained_and_outlives_its_source",
+        kind: Evidence::ExecutableContract,
+        limitation: "Verified with the source database deleted.", source: "#310" },
+    Claim { id: "B2", domain: "Backup", claim: "a restore proves the result means the same thing, not merely that it parsed",
+        status: Status::Proven, evidence: "a_restore_preserves_state_history_forks_retention_and_provenance",
+        kind: Evidence::ExecutableContract,
+        limitation: "The meaning digest is recomputed from the restored live database.",
+        source: "#310" },
+    Claim { id: "B3", domain: "Backup", claim: "an altered or truncated backup is refused rather than restored",
+        status: Status::Proven, evidence: "a_single_altered_byte_is_refused",
+        kind: Evidence::FailureInjection,
+        limitation: "One altered byte inside a value: still valid JSON, still a valid record.",
+        source: "#310" },
+    Claim { id: "B4", domain: "Backup", claim: "a restore will not overwrite an existing database",
+        status: Status::Proven, evidence: "a_restore_will_not_overwrite_an_existing_database",
+        kind: Evidence::ExecutableContract,
+        limitation: "The occupied target is byte-identical afterwards.", source: "#310" },
+    Claim { id: "B5", domain: "Backup", claim: "backup and restore are exposed as an operator command-line workflow",
+        status: Status::Unproven, evidence: "", kind: Evidence::None,
+        limitation: "THE PRIMITIVE WORKING IS NOT A WORKFLOW. `write_backup`, `verify_backup` \
+                     and `restore_backup` are library calls. There is no command, schedule, or \
+                     documented operator procedure. An operator without a Rust toolchain has no \
+                     backup.", source: "#310" },
+    // ---------------------------------------------------------------- S
+    Claim { id: "S1", domain: "Replication", claim: "current state replicates to a peer",
+        status: Status::Proven, evidence: "replication_preserves_revision_history_and_ancestry",
+        kind: Evidence::ExecutableContract,
+        limitation: "STATE CONVERGENCE IS NOT HISTORY CONVERGENCE. See S4.", source: "#311" },
+    Claim { id: "S2", domain: "Replication", claim: "revision history replicates to a peer with identical identities",
+        status: Status::Proven, evidence: "replication_preserves_revision_history_and_ancestry",
+        kind: Evidence::ExecutableContract,
+        limitation: "Reconstructed from operation provenance, not re-minted. Requires the peer \
+                     to send provenance; see S5.", source: "#311" },
+    Claim { id: "S3", domain: "Replication", claim: "replicated history preserves parents, sequences, forks and provenance",
+        status: Status::Proven, evidence: "concurrent_authorities_produce_a_fork_that_survives_replication",
+        kind: Evidence::ExecutableContract,
+        limitation: "Two authorities, one fork.", source: "#311" },
+    Claim { id: "S4", domain: "Replication", claim: "state equivalence and historical equivalence are checked separately",
+        status: Status::Proven, evidence: "same_state_with_different_history_is_detected",
+        kind: Evidence::ExecutableContract,
+        limitation: "THE NEGATIVE CONTROL. Two databases with an identical state digest and a \
+                     different history digest. Without this, every other S claim could be \
+                     satisfied by values alone.", source: "#311" },
+    Claim { id: "S5", domain: "Replication", claim: "a peer that sends no revision provenance contributes no history",
+        status: Status::Proven, evidence: "an_operation_without_provenance_replicates_state_only",
+        kind: Evidence::ExecutableContract,
+        limitation: "A bounded, stated consequence of the field being additive.", source: "#311" },
+    // ---------------------------------------------------------------- E
+    Claim { id: "E1", domain: "Envelope", claim: "retention cost per write grows with the retention window",
+        status: Status::Proven, evidence: "the_retention_envelope_has_the_measured_shape",
+        kind: Evidence::DeterministicExperiment, limitation: "An ordering, not a number.", source: "#314" },
+    Claim { id: "E2", domain: "Envelope", claim: "retention increases log size before compaction",
+        status: Status::Proven, evidence: "the_retention_envelope_has_the_measured_shape",
+        kind: Evidence::DeterministicExperiment, limitation: "Expiry tombstones. Before compaction only.",
+        source: "#314" },
+    Claim { id: "E3", domain: "Envelope", claim: "durability is a selectable contract, and each mode states its guarantee",
+        status: Status::Proven, evidence: "every_durability_mode_states_its_own_guarantee",
+        kind: Evidence::ExecutableContract,
+        limitation: "The wording is asserted not to overstate. It does not make the guarantee true.",
+        source: "#314" },
+    Claim { id: "E4", domain: "Envelope", claim: "a stable-storage barrier per write has a measured cost",
+        status: Status::Proven, evidence: "a_barrier_per_write_costs_more_than_none",
+        kind: Evidence::DeterministicExperiment,
+        limitation: "3-4x on the recorded environment. THE COST OF ASKING, NOT PROOF OF LANDING.",
+        source: "#314" },
+    Claim { id: "E5", domain: "Envelope", claim: "the durability mode changes the contract and not the stored database",
+        status: Status::Proven, evidence: "the_durability_mode_does_not_change_what_is_stored",
+        kind: Evidence::ExecutableContract,
+        limitation: "Compared on one path, because authority identity is path-derived.",
+        source: "#314" },
+    Claim { id: "E6", domain: "Envelope", claim: "the workload envelope is recorded against a frozen workload and a named environment",
+        status: Status::PartiallyProven, evidence: "a_measurement_carries_the_workload_that_produced_it",
+        kind: Evidence::Benchmark,
+        limitation: "DOWNGRADED BY THIS AUDIT. The test asserts the frozen workload half only. \
+                     The environment is recorded in prose in the envelope document and no test \
+                     asserts that a measurement carries it.", source: "#314" },
+    Claim { id: "E7", domain: "Envelope", claim: "grouped durability is measurably cheaper than a barrier per write",
+        status: Status::Unproven, evidence: "", kind: Evidence::None,
+        limitation: "Grouped ran SLOWER than per-write fsync on one of four workloads and faster \
+                     on three. The proven property is that grouping reduces barrier frequency to \
+                     the configured interval, which is a contract, not a speed.", source: "#314" },
+    // ---------------------------------------------------------------- U
+    Claim { id: "U1", domain: "Format", claim: "an incompatible durable format is detected before any record is interpreted",
+        status: Status::Proven, evidence: "pre_306_database_does_not_open_as_empty_history",
+        kind: Evidence::FailureInjection,
+        limitation: "A read-only probe runs before the open.", source: "#308" },
+    Claim { id: "U2", domain: "Format", claim: "a pre-model database's revision history is losslessly migratable",
+        status: Status::NotApplicable, evidence: "migration_is_refused_because_the_resource_was_never_recorded",
+        kind: Evidence::ExecutableContract,
+        limitation: "IMPOSSIBLE, NOT UNIMPLEMENTED. A legacy revision never recorded its \
+                     resource, so which history it belongs to is not in the data. Migration \
+                     would have to invent it.", source: "#308" },
+    Claim { id: "U3", domain: "Format", claim: "a persisted durable format version exists and is checked on open",
+        status: Status::Proven, evidence: "a_new_database_declares_its_format",
+        kind: Evidence::ExecutableContract,
+        limitation: "New logs and compaction headers. An unversioned database with no legacy \
+                     revisions opens by design.", source: "#308" },
+    Claim { id: "U4", domain: "Format", claim: "a refused open leaves the database byte-identical",
+        status: Status::Proven, evidence: "pre_306_database_does_not_open_as_empty_history",
+        kind: Evidence::FailureInjection,
+        limitation: "Bytes compared before and after. Made unconditional by making the log \
+                     reader read-only until replay succeeds.", source: "#308, #309" },
+    Claim { id: "U5", domain: "Format", claim: "a durable format from a newer build is refused",
+        status: Status::Proven, evidence: "a_newer_durable_format_is_refused",
+        kind: Evidence::FailureInjection,
+        limitation: "The rollback direction, exercised by a synthesised future version.",
+        source: "#308" },
+    Claim { id: "U6", domain: "Format", claim: "a snapshot from another format is refused",
+        status: Status::Proven, evidence: "a_snapshot_from_another_format_is_refused",
+        kind: Evidence::ExecutableContract,
+        limitation: "Snapshots are a second durable ingress and carry their own version.",
+        source: "#308" },
+    // ---------------------------------------------------------------- O
+    Claim { id: "O1", domain: "Observability", claim: "an operator can inspect history and retention state",
+        status: Status::PartiallyProven, evidence: "revision_retention_bounds_a_resources_history",
+        kind: Evidence::ExecutableContract,
+        limitation: "Per resource only. Nothing aggregates, so \"is any ancestry anywhere \
+                     damaged?\" means walking every revision.", source: "#313" },
+    Claim { id: "O2", domain: "Observability", claim: "reported health reflects actual storage state",
+        status: Status::PartiallyProven, evidence: "a_clean_open_reports_clean_storage",
+        kind: Evidence::ExecutableContract,
+        limitation: "DOWNGRADED BY THIS AUDIT. The library value and the server's status \
+                     derivation are each tested, but no test exercises the HTTP endpoint. That \
+                     the handler composes them is established by inspection.", source: "#313" },
+    Claim { id: "O3", domain: "Observability", claim: "a recovered open is distinguishable from a clean one in health",
+        status: Status::Proven, evidence: "a_recovered_open_does_not_report_the_same_health_as_a_clean_one",
+        kind: Evidence::ExecutableContract,
+        limitation: "At the library boundary.", source: "#313" },
+    Claim { id: "O4", domain: "Observability", claim: "health reports only conditions that were observed",
+        status: Status::Proven, evidence: "health_reports_only_conditions_that_were_observed",
+        kind: Evidence::ExecutableContract,
+        limitation: "Asserts no storage label says `durable` or `healthy`.", source: "#313" },
+    Claim { id: "O5", domain: "Observability", claim: "the remaining health fields are compile-time constants",
+        status: Status::PartiallyProven, evidence: "crates/feltdb-server/src/main.rs:HealthResponse",
+        kind: Evidence::ImplementationInspection,
+        limitation: "`runtime`, `fabric`, `workflows` and `agents` are still constants. \
+                     Recorded, not fixed: each needs an operational contract first.",
+        source: "#313" },
+    // ---------------------------------------------------------------- M
+    Claim { id: "M1", domain: "Managed incident", claim: "a timer-driven compaction defers the log rewrite",
+        status: Status::Proven, evidence: "the_default_policy_does_not_rewrite_on_a_handful_of_operations",
+        kind: Evidence::ExecutableContract,
+        limitation: "Ten timer ticks over a small database cause zero rewrites. THIS DOES NOT \
+                     MAKE COMPACTION NON-BLOCKING; see M6.", source: "6b550ea" },
+    Claim { id: "M2", domain: "Managed incident", claim: "an explicit compaction still rewrites immediately",
+        status: Status::Proven, evidence: "an_explicit_compaction_still_rewrites_now",
+        kind: Evidence::ExecutableContract,
+        limitation: "The policy governs the timer, not a caller. Every prior call site keeps \
+                     its behaviour.", source: "6b550ea" },
+    Claim { id: "M3", domain: "Managed incident", claim: "deferring the rewrite preserves state and history",
+        status: Status::Proven, evidence: "deferring_the_rewrite_preserves_state_and_history",
+        kind: Evidence::ExecutableContract,
+        limitation: "State and history digests across a reopen. The log stays longer than \
+                     needed, which is the accepted cost.", source: "6b550ea" },
+    Claim { id: "M4", domain: "Managed incident", claim: "an overload is refused with a status, a code and a retry hint",
+        status: Status::Proven, evidence: "an_overload_is_an_explicit_refusal_with_a_retry_hint",
+        kind: Evidence::ExecutableContract,
+        limitation: "The refusal's shape is asserted. THAT THE BOUND AND DEADLINE FIRE UNDER \
+                     REAL LOAD IS NOT TESTED; there is no load harness.", source: "6b550ea" },
+    Claim { id: "M5", domain: "Managed incident", claim: "a bounded search visits only as many rows as its limit",
+        status: Status::Proven, evidence: "a_bounded_search_stops_at_the_limit_instead_of_scanning",
+        kind: Evidence::ExecutableContract,
+        limitation: "500 rows, limit 10, exactly 10 predicate visits. THIS BOUNDS THE SEARCH \
+                     AND PROVENANCE PATHS ONLY, not every read in the database.",
+        source: "6b550ea" },
+    Claim { id: "M6", domain: "Managed incident", claim: "compaction no longer blocks the database",
+        status: Status::Unproven, evidence: "", kind: Evidence::None,
+        limitation: "EXPLICITLY NOT CLAIMED. A rewrite still holds the global lock for its \
+                     duration; it merely happens rarely and off the runtime. A large enough \
+                     database will still stall while one runs. `the_rewrite_cost_grows_with_the_\
+                     database` measures that it grows.", source: "6b550ea" },
+    Claim { id: "M7", domain: "Managed incident", claim: "readiness performs a real scoped storage probe",
+        status: Status::PartiallyProven, evidence: "a_recovered_open_does_not_report_the_same_health_as_a_clean_one",
+        kind: Evidence::ImplementationInspection,
+        limitation: "The storage conditions it reports are tested at the library boundary. \
+                     THE `/health/ready` HANDLER ITSELF IS NOT EXERCISED BY A TEST, including \
+                     the STORAGE_STALLED path; there is no HTTP-level harness.",
+        source: "6b550ea" },
+    Claim { id: "M8", domain: "Managed incident", claim: "scoped reads stay correct and bounded while a compaction runs",
+        status: Status::Proven, evidence: "scoped_reads_stay_correct_and_bounded_while_compaction_runs",
+        kind: Evidence::ExecutableContract,
+        limitation: "The composed shape, not the isolated fixes. NO LATENCY IS MEASURED, so \
+                     this is not evidence that the incident cannot recur; see M6.",
+        source: "#315" },
+    Claim { id: "M9", domain: "Managed incident", claim: "a compaction concurrent with traffic leaves the database intact",
+        status: Status::Proven, evidence: "a_concurrent_compaction_leaves_the_database_intact",
+        kind: Evidence::ExecutableContract,
+        limitation: "Correctness under concurrency, including a forced rewrite and a reopen. \
+                     Says nothing about how long anything waited.",
+        source: "#315" },
+];
+
+fn matrix() -> BTreeMap<&'static str, &'static Claim> {
+    CERTIFICATION.iter().map(|c| (c.id, c)).collect()
+}
+
+/// Every test named as evidence, gathered from the test sources on disk.
+/// Resolve a claim's `evidence` field to something that actually exists.
+///
+/// Two citation forms are permitted, and the permitted form depends on the
+/// evidence *kind*:
+///
+/// - a **test function name**, which must be a `fn` in this repository's test
+///   suites (or in the server crate, which holds its tests inline);
+/// - a **source location** of the form `path/to/file.rs:Symbol`, permitted only
+///   for `ImplementationInspection`, where there is by definition no test. The
+///   file must exist and must contain the named symbol.
+///
+/// The restriction is the point: a claim may not dodge the test requirement by
+/// citing a source file. Only a claim that has already been marked as resting
+/// on inspection — and which `inspection_alone_never_proves_a_behavioural_claim`
+/// therefore forbids from being `Proven` — may cite one.
+fn evidence_resolves(claim: &Claim, known: &[String]) -> bool {
+    match claim.evidence.split_once(".rs:") {
+        Some((file, symbol)) if claim.kind == Evidence::ImplementationInspection => {
+            let path = std::path::Path::new(concat!(env!("CARGO_MANIFEST_DIR"), "/../.."))
+                .join(format!("{file}.rs"));
+            match std::fs::read_to_string(path) {
+                Ok(source) => source.contains(symbol),
+                Err(_) => false,
+            }
+        }
+        Some(_) => false,
+        None => known.iter().any(|f| f == claim.evidence),
+    }
+}
+
+/// A tripwire that cannot fire is decoration, so the mention/assertion rule has
+/// its own negative control.
+#[test]
+fn the_forbidden_phrase_rule_separates_assertion_from_mention() {
+    // Asserted: flagged.
+    assert!(common::asserts_phrase(
+        "feltdb is power-loss safe.",
+        "power-loss safe"
+    ));
+    assert!(common::asserts_phrase(
+        "a mention of \"power-loss safe\" here, but the next line is not.\n\
+         and feltdb is power-loss safe.",
+        "power-loss safe"
+    ));
+
+    // Merely named: not flagged.
+    assert!(!common::asserts_phrase(
+        "a test asserts no mode's wording contains \"power-loss safe\".",
+        "power-loss safe"
+    ));
+    assert!(!common::asserts_phrase(
+        "the phrase `power-loss safe` appears nowhere in the api.",
+        "power-loss safe"
+    ));
+
+    // An unbalanced delimiter must not silence the line it opens.
+    assert!(common::asserts_phrase(
+        "the \"mode is power-loss safe",
+        "power-loss safe"
+    ));
+
+    // Absent: not flagged.
+    assert!(!common::asserts_phrase(
+        "flushed is not synced.",
+        "power-loss safe"
+    ));
+}
+
+/// The published document, read from disk.
+fn published_document() -> String {
+    let path = concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../../docs/architecture/production-certification.md"
+    );
+    std::fs::read_to_string(path).expect("the certification document exists and is readable")
+}
+
+/// The status counts the document publishes, read out of its summary table.
+fn published_counts() -> BTreeMap<String, usize> {
+    let mut counts = BTreeMap::new();
+    for line in published_document().lines() {
+        let Some(cells) = common::table_cells(line) else {
+            continue;
+        };
+        if cells.len() != 2 {
+            continue;
+        }
+        let label = cells[0].clone();
+        if !Status::ALL.iter().any(|status| status.label() == label) {
+            continue;
+        }
+        let Ok(count) = cells[1].parse::<usize>() else {
+            continue;
+        };
+        assert!(
+            counts.insert(label.clone(), count).is_none(),
+            "the document publishes the count for `{label}` more than once"
+        );
+    }
+    counts
+}
+
+/// One claim row as the document renders it.
+struct PublishedRow {
+    status: String,
+    evidence: String,
+    kind: String,
+    source: String,
+}
+
+/// Every claim row in the document, keyed by claim id.
+fn published_rows() -> BTreeMap<String, PublishedRow> {
+    let mut rows = BTreeMap::new();
+    for line in published_document().lines() {
+        let Some(cells) = common::table_cells(line) else {
+            continue;
+        };
+        // id | domain | claim | status | evidence | kind | limitation | source
+        if cells.len() != 8 {
+            continue;
+        }
+        let id = cells[0].clone();
+        let looks_like_a_claim_id = id.len() >= 2
+            && id.starts_with(|c: char| c.is_ascii_uppercase())
+            && id[1..].chars().all(|c| c.is_ascii_digit());
+        if !looks_like_a_claim_id {
+            continue;
+        }
+        assert!(
+            rows.insert(
+                id.clone(),
+                PublishedRow {
+                    status: cells[3].clone(),
+                    // An em dash is the document's rendering of "no evidence".
+                    evidence: if cells[4] == "—" {
+                        String::new()
+                    } else {
+                        cells[4].clone()
+                    },
+                    kind: cells[5].clone(),
+                    source: cells[7].clone(),
+                },
+            )
+            .is_none(),
+            "the document publishes claim `{id}` more than once"
+        );
+    }
+    rows
+}
+
+fn known_test_functions() -> Vec<String> {
+    let mut found = Vec::new();
+    let root = concat!(env!("CARGO_MANIFEST_DIR"), "/tests");
+    for entry in std::fs::read_dir(root).expect("the tests directory is readable") {
+        let path = entry.expect("a readable entry").path();
+        if path.extension().and_then(|e| e.to_str()) != Some("rs") {
+            continue;
+        }
+        let source = std::fs::read_to_string(&path).expect("a readable test file");
+        for line in source.lines() {
+            if let Some(rest) = line.trim().strip_prefix("fn ") {
+                if let Some(name) = rest.split('(').next() {
+                    found.push(name.to_string());
+                }
+            }
+        }
+    }
+    // The server crate holds the admission and health-status tests.
+    let server = concat!(env!("CARGO_MANIFEST_DIR"), "/../feltdb-server/src/main.rs");
+    if let Ok(source) = std::fs::read_to_string(server) {
+        for line in source.lines() {
+            if let Some(rest) = line.trim().strip_prefix("fn ") {
+                if let Some(name) = rest.split('(').next() {
+                    found.push(name.to_string());
+                }
+            }
+        }
+    }
+    found
+}
+
+// ===========================================================================
+// Matrix integrity
+// ===========================================================================
+
+/// The statuses an earlier ledger records for the same claims.
+///
+/// Parsed rather than duplicated, so this cannot drift from the file it reads.
+fn readiness_ledger() -> BTreeMap<String, String> {
+    let readiness = include_str!("production_readiness_contract.rs");
+    let start = readiness
+        .find("const CLAIMS")
+        .expect("the readiness contract declares CLAIMS");
+    let end = start
+        + readiness[start..]
+            .find("];")
+            .expect("the CLAIMS table terminates");
+    let table = &readiness[start..end];
+
+    let mut ledger = BTreeMap::new();
+    let mut pending: Option<String> = None;
+    for line in table.lines() {
+        let trimmed = line.trim().trim_start_matches('(').trim();
+        if let Some(rest) = trimmed.strip_prefix('"') {
+            if let Some(id) = rest.split(' ').next() {
+                if id.len() >= 2 {
+                    pending = Some(id.to_string());
+                }
+            }
+        }
+        if let Some(index) = line.find("Status::") {
+            let status: String = line[index + "Status::".len()..]
+                .chars()
+                .take_while(|character| character.is_alphanumeric())
+                .collect();
+            if let Some(id) = pending.take() {
+                ledger.insert(id, status);
+            }
+        }
+    }
+    ledger
+}
+
+/// **Every disagreement with an earlier ledger is declared.**
+///
+/// This is the tripwire that makes recalculation safe. Re-deriving a claim from
+/// current evidence is only honest if a changed answer is visible; otherwise two
+/// files quietly assert different things and the reader believes whichever they
+/// opened first.
+///
+/// It fails three ways. A claim whose status differs and is not in `DOWNGRADES`
+/// fails. A declared downgrade whose earlier ledger no longer records the prior
+/// status fails — so closing the gap for real forces this table to be updated
+/// rather than left as a stale accusation. And a declared change that makes a
+/// claim *stronger* fails, because new evidence is not a downgrade and must not
+/// be recorded as one.
+#[test]
+fn every_disagreement_with_an_earlier_ledger_is_declared() {
+    let ledger = readiness_ledger();
+    let certified = matrix();
+    assert!(
+        ledger.len() > 40,
+        "the readiness ledger did not parse; it yielded {} entries",
+        ledger.len()
+    );
+
+    let mut problems = Vec::new();
+
+    for (id, earlier) in &ledger {
+        let Some(claim) = certified.get(id.as_str()) else {
+            continue;
+        };
+        let now = claim.status.variant();
+        if now == earlier {
+            continue;
+        }
+        match DOWNGRADES.iter().find(|(claim_id, ..)| claim_id == id) {
+            None => problems.push(format!(
+                "{id}: the readiness ledger records `{earlier}`, this audit records `{now}`, \
+                 and the disagreement is not declared"
+            )),
+            Some((_, from, to, _)) => {
+                if from != earlier {
+                    problems.push(format!(
+                        "{id}: declared as a downgrade from `{from}`, but the readiness ledger \
+                         now records `{earlier}`"
+                    ));
+                }
+                if to != &now {
+                    problems.push(format!(
+                        "{id}: declared as a downgrade to `{to}`, but this audit records `{now}`"
+                    ));
+                }
+            }
+        }
+    }
+
+    for (id, from, to, why) in DOWNGRADES {
+        let claim = certified
+            .get(id)
+            .unwrap_or_else(|| panic!("{id} is declared as a downgrade and is not in the matrix"));
+        assert_eq!(
+            claim.status.variant(),
+            *to,
+            "{id} is declared as a downgrade to `{to}`"
+        );
+        assert_eq!(
+            ledger.get(*id).map(String::as_str),
+            Some(*from),
+            "{id} is declared as a downgrade from `{from}`; the earlier ledger disagrees"
+        );
+        assert!(
+            !why.trim().is_empty(),
+            "{id} is declared as a downgrade with no reason"
+        );
+
+        let stronger = Status::ALL
+            .iter()
+            .find(|status| status.variant() == *from)
+            .expect("a declared prior status is a real status");
+        assert!(
+            claim.status.strength() < stronger.strength(),
+            "{id} is declared as a downgrade but `{to}` is not weaker than `{from}`"
+        );
+    }
+
+    assert!(problems.is_empty(), "{}", problems.join("\n"));
+}
+
+/// Claim identifiers are unique.
+#[test]
+fn every_claim_has_a_unique_identifier() {
+    assert_eq!(
+        matrix().len(),
+        CERTIFICATION.len(),
+        "a claim identifier is used twice"
+    );
+}
+
+/// **Every `Proven` claim names a test that exists.**
+///
+/// The central tripwire. A claim cannot be `Proven` on the strength of an
+/// implementation existing, of another claim, or of a test that was renamed or
+/// deleted.
+#[test]
+fn every_proven_claim_names_a_test_that_exists() {
+    let known = known_test_functions();
+    let mut problems = Vec::new();
+
+    for claim in CERTIFICATION {
+        let proven = claim.status == Status::Proven;
+        if proven && claim.evidence.is_empty() {
+            problems.push(format!("{}: Proven with no named evidence", claim.id));
+            continue;
+        }
+        if !claim.evidence.is_empty() && !evidence_resolves(claim, &known) {
+            problems.push(format!(
+                "{}: names `{}`, which resolves to nothing in this repository",
+                claim.id, claim.evidence
+            ));
+        }
+        if proven && claim.kind == Evidence::None {
+            problems.push(format!("{}: Proven with evidence kind None", claim.id));
+        }
+    }
+
+    assert!(problems.is_empty(), "{}", problems.join("\n"));
+}
+
+/// **Implementation inspection alone never carries a `Proven` behavioural
+/// claim.**
+///
+/// Reading the code establishes what the code says, not what it does under a
+/// condition nobody has run.
+#[test]
+fn inspection_alone_never_proves_a_behavioural_claim() {
+    for claim in CERTIFICATION {
+        if claim.kind == Evidence::ImplementationInspection {
+            assert_ne!(
+                claim.status,
+                Status::Proven,
+                "{} is Proven on implementation inspection alone: {}",
+                claim.id,
+                claim.claim
+            );
+        }
+    }
+}
+
+/// Every claim that is not fully `Proven` says what is missing, and every
+/// claim with no evidence has no evidence kind.
+#[test]
+fn every_claim_states_its_limitation() {
+    for claim in CERTIFICATION {
+        assert!(
+            !claim.limitation.trim().is_empty(),
+            "{} has no stated limitation",
+            claim.id
+        );
+        if claim.evidence.is_empty() {
+            assert_eq!(
+                claim.kind,
+                Evidence::None,
+                "{} names no evidence but claims a kind",
+                claim.id
+            );
+        }
+    }
+}
+
+/// The certification covers every claim the readiness contract declares.
+///
+/// The two files are kept in step mechanically rather than by memory: a claim
+/// added to one and forgotten in the other fails here.
+#[test]
+fn the_certification_covers_the_readiness_contract() {
+    let readiness = include_str!("production_readiness_contract.rs");
+    let start = readiness
+        .find("const CLAIMS")
+        .expect("the readiness contract declares CLAIMS");
+    let end = readiness[start..]
+        .find("];")
+        .map(|offset| start + offset)
+        .expect("the CLAIMS table terminates");
+    let table = &readiness[start..end];
+
+    let certified = matrix();
+    let mut missing = Vec::new();
+    for line in table.lines() {
+        let trimmed = line.trim();
+        let Some(rest) = trimmed.strip_prefix('"') else {
+            continue;
+        };
+        let Some(id) = rest.split(' ').next() else {
+            continue;
+        };
+        if id.len() >= 2 && !certified.contains_key(id) {
+            missing.push(id.to_string());
+        }
+    }
+    missing.sort();
+    missing.dedup();
+    assert!(
+        missing.is_empty(),
+        "declared in the readiness contract and absent from the certification: {missing:?}"
+    );
+}
+
+// ===========================================================================
+// Claim-inflation tripwires
+// ===========================================================================
+
+/// **The substitutions this certification refuses to make.**
+///
+/// Each pair is a real temptation, and each has been available at some point in
+/// this work. Encoding them means a future change cannot make the stronger
+/// claim by editing a status.
+#[test]
+fn no_claim_is_inflated_into_a_stronger_one() {
+    let certified = matrix();
+    let must_not_be_proven = [
+        (
+            "D5",
+            "a barrier being issued is not the hardware preserving data",
+        ),
+        (
+            "E7",
+            "a configured grouping interval is not a measured speed advantage",
+        ),
+        (
+            "B5",
+            "a working library primitive is not an operator workflow",
+        ),
+        ("R4", "detection on inspection is not proactive monitoring"),
+        ("M6", "a deferred rewrite is not a non-blocking compaction"),
+    ];
+
+    for (id, why) in must_not_be_proven {
+        let claim = certified
+            .get(id)
+            .unwrap_or_else(|| panic!("{id} is missing"));
+        assert_ne!(
+            claim.status,
+            Status::Proven,
+            "{id} must not be Proven: {why}"
+        );
+    }
+
+    // State convergence must never stand in for history convergence: the claim
+    // that separates them has to remain Proven and independently evidenced.
+    let separation = certified.get("S4").expect("S4 exists");
+    assert_eq!(separation.status, Status::Proven);
+    assert_eq!(
+        separation.evidence, "same_state_with_different_history_is_detected",
+        "the negative control is what keeps every other replication claim honest"
+    );
+    assert_ne!(
+        certified.get("S1").unwrap().evidence,
+        separation.evidence,
+        "state convergence and history convergence must not rest on one test"
+    );
+}
+
+/// **No document claims a guarantee the matrix does not permit.**
+///
+/// Documentation drifts faster than tests. These phrases would each assert
+/// something the evidence does not support, so their absence is checked rather
+/// than trusted.
+#[test]
+fn no_document_asserts_a_guarantee_the_matrix_withholds() {
+    let docs = concat!(env!("CARGO_MANIFEST_DIR"), "/../../docs/architecture");
+    let forbidden = [
+        "power-loss safe",
+        "power loss safe",
+        "guaranteed durable",
+        "compaction is non-blocking",
+        "compaction no longer blocks",
+        "all reads are bounded",
+        "supported capacity",
+    ];
+
+    let mut violations = Vec::new();
+    for entry in std::fs::read_dir(docs).expect("the architecture docs are readable") {
+        let path = entry.expect("a readable entry").path();
+        if path.extension().and_then(|e| e.to_str()) != Some("md") {
+            continue;
+        }
+        let document = std::fs::read_to_string(&path).expect("a readable document");
+        let prose = common::prose_excluding_withheld_rows(&document, WITHHELD_LABELS);
+        for phrase in forbidden {
+            if common::asserts_phrase(&prose, phrase) {
+                violations.push(format!(
+                    "{}: asserts \"{phrase}\"",
+                    path.file_name().unwrap().to_string_lossy()
+                ));
+            }
+        }
+    }
+    assert!(violations.is_empty(), "{}", violations.join("\n"));
+}
+
+// ===========================================================================
+// Derived counts
+// ===========================================================================
+
+/// Counts are computed from the matrix, never maintained by hand.
+///
+/// The numbers below are the certification's published totals. They are
+/// asserted so the document and the table cannot disagree.
+#[test]
+fn the_published_counts_are_derived_from_the_matrix() {
+    let mut derived: BTreeMap<&str, usize> = BTreeMap::new();
+    for status in Status::ALL {
+        derived.insert(status.label(), 0);
+    }
+    for claim in CERTIFICATION {
+        *derived.entry(claim.status.label()).or_default() += 1;
+    }
+
+    let total: usize = derived.values().sum();
+    assert_eq!(
+        total,
+        CERTIFICATION.len(),
+        "every claim has exactly one status"
+    );
+
+    // The document may not carry a total of its own. Each count it publishes is
+    // checked against the count computed here, and every status must appear —
+    // so a bucket cannot be quietly dropped from the published summary because
+    // it is inconvenient.
+    let published = published_counts();
+    for (label, count) in &derived {
+        let shown = published.get(*label).copied().unwrap_or_else(|| {
+            panic!("the certification document publishes no count for `{label}`")
+        });
+        assert_eq!(
+            shown, *count,
+            "the document publishes {shown} `{label}` claims; the matrix holds {count}"
+        );
+    }
+    assert_eq!(
+        published.len(),
+        derived.len(),
+        "the document publishes a status the matrix does not define"
+    );
+}
+
+/// The published matrix is a rendering of the executable one, not a second
+/// record of the same facts.
+///
+/// Every claim must appear in the document with the same status, the same
+/// evidence and the same source. A downgrade that lands in the test file and
+/// not in the document — or the reverse — fails here.
+#[test]
+fn the_published_matrix_matches_the_executable_matrix() {
+    let rows = published_rows();
+    let mut problems = Vec::new();
+
+    for claim in CERTIFICATION {
+        match rows.get(claim.id) {
+            None => problems.push(format!("{}: absent from the document", claim.id)),
+            Some(row) => {
+                if row.status != claim.status.label() {
+                    problems.push(format!(
+                        "{}: the document says `{}`, the matrix says `{}`",
+                        claim.id,
+                        row.status,
+                        claim.status.label()
+                    ));
+                }
+                if row.evidence != claim.evidence {
+                    problems.push(format!(
+                        "{}: the document cites `{}`, the matrix cites `{}`",
+                        claim.id, row.evidence, claim.evidence
+                    ));
+                }
+                if row.kind != claim.kind.label() {
+                    problems.push(format!(
+                        "{}: the document types the evidence `{}`, the matrix types it `{}`",
+                        claim.id,
+                        row.kind,
+                        claim.kind.label()
+                    ));
+                }
+                if row.source != claim.source {
+                    problems.push(format!(
+                        "{}: the document sources `{}`, the matrix sources `{}`",
+                        claim.id, row.source, claim.source
+                    ));
+                }
+            }
+        }
+    }
+
+    for id in rows.keys() {
+        if !CERTIFICATION.iter().any(|claim| &claim.id == id) {
+            problems.push(format!("{id}: in the document, absent from the matrix"));
+        }
+    }
+
+    assert!(problems.is_empty(), "{}", problems.join("\n"));
+}
+
+/// Every domain the certification covers is represented, and the managed
+/// incident is among them.
+#[test]
+fn every_domain_is_represented_including_the_managed_incident() {
+    let mut domains: BTreeMap<&str, usize> = BTreeMap::new();
+    for claim in CERTIFICATION {
+        *domains.entry(claim.domain).or_default() += 1;
+    }
+    for domain in [
+        "Durability",
+        "Atomicity",
+        "Recovery",
+        "History",
+        "Backup",
+        "Replication",
+        "Envelope",
+        "Format",
+        "Observability",
+        "Managed incident",
+    ] {
+        assert!(
+            domains.contains_key(domain),
+            "the certification has no {domain} claims"
+        );
+    }
+    assert_eq!(
+        domains.get("Managed incident").copied().unwrap_or(0),
+        9,
+        "the incident remediation shipped with tests and no matrix entry; it has one now, \
+         plus the two composed-shape claims this audit added"
+    );
+}
+
+/// The intentional gaps are still gaps.
+///
+/// A certification whose Unproven claims quietly disappear is worse than one
+/// that keeps them. Each of these must remain present and unproven until real
+/// evidence exists.
+#[test]
+fn the_known_gaps_have_not_disappeared() {
+    let certified = matrix();
+    for id in ["D5", "E7", "B5", "R4", "M6"] {
+        let claim = certified
+            .get(id)
+            .unwrap_or_else(|| panic!("{id} was removed from the certification"));
+        assert_eq!(
+            claim.status,
+            Status::Unproven,
+            "{id} changed status without new evidence"
+        );
+        assert!(
+            claim.evidence.is_empty(),
+            "{id} names evidence but is still Unproven"
+        );
+    }
+}