Record capacity harness nonclaim

Author: lemon-mint

RELEASE_SCOPE.md

@@ -125,7 +125,7 @@ Config chain recovery note: `tests/tla_model_check.sh` now runs `tla/EPaxosConfi
 | Broader formal model coverage | Finite configured TLC models are closed above, including bounded prepare branch-priority/try-witness coverage, finite 3-, 5-, and 7-replica Accept-Deps optimized-recovery evidence coverage, finite 3-, 5-, and 7-replica abstract TryPreAccept response branch-slice coverage, finite 3-, 5-, and 7-replica TryPreAccept message-path coverage, finite 3-, 5-, and 7-replica committed-conflict evidence-query guard/fail-closed coverage, one finite three-voter committed-conflict evidence-staleness request-scoping slice (`tla/EPaxosEvidenceStaleness.cfg` generated `6/6` states), finite 3-, 5-, and 7-replica uncommitted-conflict force/defer quorum coverage, finite configuration-barrier/add/remove/chain pinning coverage, one finite normal configuration-transition retry-timer slice (`tla/EPaxosConfigTransitionRetry.cfg` generated `8/8` states), one finite normal configuration-transition response de-duplication slice (`tla/EPaxosConfigTransitionDedup.cfg` generated `16/16` states), one finite durable configuration replay slice, finite config recovery-after-removal, recovery-after-addition, lost/duplicate response de-duplication, and recovery retry-timer slices (`tla/EPaxosConfigRecovery.cfg` generated `44/30` states, `tla/EPaxosConfigAddRecovery.cfg` generated `15/15` states, `tla/EPaxosConfigRecoveryDedup.cfg` generated `11/11` states, and `tla/EPaxosConfigRecoveryRetry.cfg` generated `8/8` states), a finite rollback-allocation next-instance/skip/apply-order check, and a finite `TOQClockDiscipline.tla` bounded-skew/bounded-delay contract. Remaining open: arbitrary/general recovery under configuration changes beyond the finite recovery slices, arbitrary membership histories, arbitrary durable histories, joint consensus, arbitrary message loss and retry/rebroadcast behavior, complete optimized-recovery branch parity, unbounded proofs, external target proof, synchronized-clock implementation, one-way-delay measurement, and operational clock-discipline proof. |
 | Deployment manifest | Example systemd artifacts now exist (`deploy/systemd/kvnode@.service`, `deploy/systemd/kvnode.env.example`) plus `tests/kvnode_systemd_manifest_audit.sh`, which renders the example EnvironmentFile into the `ExecStart` contract and keeps `systemd-analyze verify` opt-in via `KVNODE_SYSTEMD_ANALYZE=yes`; these artifacts are checked by `tests/operations_readiness_audit.sh`. A reviewed and exercised target deployment under systemd/container/orchestration remains open before this can be a production manifest claim. |
 | Data lifecycle | Local destructive-storage remove/restore evidence exists, the KV example has exercised Pebble checkpoint/whole-directory restore plus offline and live-source checkpoint-backed repair tests for checksum-detected bit-level corruption, `examples/kv/cmd/kvcheckpoint` provides a maintained offline checkpoint/verify/verified-restore/repair helper, `TestRestoreRejectsCorruptCheckpointWithoutReplacingLiveData` verifies restore fails closed before replacement, `tests/kvnode_local_runner.go --mode data` stops one local loopback node and runs offline checkpoint/verify/restore/repair on a stopped local node before restart/catch-up verification, `data-lifecycle-summary.txt` records `data_lifecycle=offline-checkpoint-verify-restore-repair` plus `none-target-environment-data-lifecycle-drill-still-required`, and `docs/operations/kvnode-data-lifecycle-incident-runbook.md` documents checkpoint, verification, repair, restore, checksum-mismatch, local data-lifecycle drill, and evidence-capture procedures. A reviewed operator backup/restore/disaster-recovery drill in the target environment remains open. |
-| Capacity envelope | `tests/kvnode_capacity_envelope.sh` is an opt-in bounded harness for throughput, latency, memory RSS, disk growth, queue depth, value size, scan limit, and peer-count samples; `tests/kvnode_local_capacity_drill.sh` starts a disposable three-node loopback cluster and runs that harness against all three client/admin listeners with PIDs and data dirs; `tests/kvnode_local_runner.go` is a custom Go runner that starts the same local-only three-node loopback shape and records bounded write/read/scan latency plus admin metric samples. `bash -n tests/kvnode_capacity_envelope.sh`, `bash tests/kvnode_capacity_envelope.sh --help`, `bash tests/kvnode_local_capacity_drill.sh --help`, `go run -tags kvnode_local_runner ./tests/kvnode_local_runner.go --help`, and `tests/operations_readiness_audit.sh` pass. Local loopback samples have passed, including the earlier single-node workstation sample, a three-node local wrapper sample with 5 ops per value-size phase, 64/1024-byte values, scan limits 1/8, and peer_count=3, and a custom Go runner sample with `KVNODE_GO_RUNNER_OPS_PER_PHASE=2`, `KVNODE_GO_RUNNER_VALUE_BYTES=16`, `KVNODE_GO_RUNNER_SCAN_LIMITS=1`, and `status=local-go-runner-only`. This is workstation harness evidence only; measured target-environment capacity results remain open. |
+| Capacity envelope | `tests/kvnode_capacity_envelope.sh` is an opt-in bounded harness for throughput, latency, memory RSS, disk growth, queue depth, value size, scan limit, and peer-count samples; its `metadata.env` and `summary.md` emit `release_claim=none-target-environment-capacity-results-still-required`; `tests/kvnode_local_capacity_drill.sh` starts a disposable three-node loopback cluster and runs that harness against all three client/admin listeners with PIDs and data dirs while preserving the same release-claim non-claim; `tests/kvnode_local_runner.go` is a custom Go runner that starts the same local-only three-node loopback shape and records bounded write/read/scan latency plus admin metric samples. `bash -n tests/kvnode_capacity_envelope.sh`, `bash tests/kvnode_capacity_envelope.sh --help`, `bash tests/kvnode_local_capacity_drill.sh --help`, `go run -tags kvnode_local_runner ./tests/kvnode_local_runner.go --help`, and `tests/operations_readiness_audit.sh` pass. Local loopback samples have passed, including the earlier single-node workstation sample, a three-node local wrapper sample with 5 ops per value-size phase, 64/1024-byte values, scan limits 1/8, a non-claim metadata sample with 1 op, 16-byte values, scan limit 1, peer_count=3, and `release_claim=none-target-environment-capacity-results-still-required`, and a custom Go runner sample with `KVNODE_GO_RUNNER_OPS_PER_PHASE=2`, `KVNODE_GO_RUNNER_VALUE_BYTES=16`, `KVNODE_GO_RUNNER_SCAN_LIMITS=1`, and `status=local-go-runner-only`. This is workstation harness evidence only; measured target-environment capacity results remain open because target-environment capacity measurement remains open. |
 | Incident readiness | `docs/operations/kvnode-data-lifecycle-incident-runbook.md` now covers storage failure, network partition, peer compromise, replay/checksum suspicion, and recovery stalls, with evidence-capture steps and non-claims; `tests/kvnode_incident_tabletop_drill.sh` locally rehearses the storage-failure and network-partition test-fault branches on a disposable loopback cluster; `tests/kvnode_local_runner.go` also locally exercised `/faults/storage`, `/faults/transport`, `/readyz`, `/metrics`, and post-clear canaries with `status=local-go-runner-only`; `tests/operations_readiness_audit.sh` checks those artifacts. Operator-reviewed target-environment tabletop or live drill evidence remains open. |
 
 TryPreAccept response branch-slice note: `tla/EPaxosTryPreAcceptBranches.tla` is only a finite abstract scenario/stage model for stale restart, committed evidence ignore/fail-closed, direct/forced accept, one uncommitted deferral with duplicate suppression, and OK slow-quorum accept. Its only quorum detail is `okVotes >= SlowQuorum`, it runs for 3/5/7, and complete optimized-recovery branch parity beyond this finite slice remains open.

release/EPAXOS_READINESS_EVIDENCE.md

@@ -193,6 +193,7 @@ Non-claims remain explicit: No target-environment remote claim, no in-place Pebb
 - `go test ./examples/kv/cmd/kvcheckpoint -count=1` passed after adding the maintained offline checkpoint helper; the CLI verifies checkpoints before `restore` and `repair` replaces a data directory.
 - `KVNODE_INCIDENT_TABLETOP_RUN=yes bash tests/kvnode_incident_tabletop_drill.sh` passed on local loopback after adding the incident tabletop harness; the generated summary reported `status=local-tabletop-only`, `storage_fault=exercised-and-cleared`, `transport_fault=exercised-and-cleared`, and post-clear canaries visible on all nodes.
 - `KVNODE_LOCAL_CAPACITY_RUN=yes bash tests/kvnode_local_capacity_drill.sh` passed on local loopback after adding the three-node capacity wrapper; it ran `tests/kvnode_capacity_envelope.sh` with `peer_count=3`, 5 ops per value-size phase, 64/1024-byte values, scan limits 1/8, PID/data-dir resource sampling, and `status=local-loopback-only`.
+- `KVNODE_LOCAL_CAPACITY_RUN=yes KVNODE_LOCAL_CAPACITY_BASE_PORT=29080 KVNODE_LOCAL_CAPACITY_PEER_BASE_PORT=29180 KVNODE_LOCAL_CAPACITY_ADMIN_BASE_PORT=29280 KVNODE_CAPACITY_OPS_PER_PHASE=1 KVNODE_CAPACITY_VALUE_BYTES=16 KVNODE_CAPACITY_SCAN_LIMITS=1 bash tests/kvnode_local_capacity_drill.sh` passed on local loopback after adding the machine-readable capacity non-claim; archived sample files are `local://kvnode-local-capacity-nonclaim-20260709-wrapper-metadata.env`, `local://kvnode-local-capacity-nonclaim-20260709-wrapper-summary.txt`, `local://kvnode-local-capacity-nonclaim-20260709-capacity-metadata.env`, `local://kvnode-local-capacity-nonclaim-20260709-capacity-summary.md`, `local://kvnode-local-capacity-nonclaim-20260709-latency.csv`, and `local://kvnode-local-capacity-nonclaim-20260709-resources.csv`; generated wrapper and harness metadata both include `release_claim=none-target-environment-capacity-results-still-required`, the sample recorded 3 HTTP operations against peer_count=3, and target-environment capacity measurement remains open.
 - `go run -tags kvnode_local_runner ./tests/kvnode_local_runner.go --help` passed in this session and compiled the build-tagged custom local Go runner.
 - `KVNODE_GO_RUNNER_RUN=yes KVNODE_GO_RUNNER_OPS_PER_PHASE=2 KVNODE_GO_RUNNER_VALUE_BYTES=16 KVNODE_GO_RUNNER_SCAN_LIMITS=1 KVNODE_GO_RUNNER_BASE_PORT=28080 KVNODE_GO_RUNNER_PEER_BASE_PORT=28180 KVNODE_GO_RUNNER_ADMIN_BASE_PORT=28280 go run -tags kvnode_local_runner ./tests/kvnode_local_runner.go --mode all` passed on local loopback after adding the custom Go runner data-lifecycle mode; archived sample files are `local://kvnode-go-runner-all-20260710-verified-summary.txt`, `local://kvnode-go-runner-all-20260710-verified-incident-summary.txt`, `local://kvnode-go-runner-all-20260710-verified-capacity-summary.txt`, `local://kvnode-go-runner-all-20260710-verified-data-lifecycle-summary.txt`, `local://kvnode-go-runner-all-20260710-verified-latency.csv`, `local://kvnode-go-runner-all-20260710-verified-resources.csv`, `local://kvnode-go-runner-all-20260710-verified-checkpoint.log`, `local://kvnode-go-runner-all-20260710-verified-verify.log`, `local://kvnode-go-runner-all-20260710-verified-restore.log`, and `local://kvnode-go-runner-all-20260710-verified-repair.log`; generated summaries reported `mode=all`, `incident_ran=true`, `capacity_ran=true`, `data_lifecycle_ran=true`, storage/transport faults exercised and cleared, post-clear canaries visible on all nodes, 5 local capacity latency rows with p50 0.034385750s, p95 0.035291167s, p99 0.035291167s, `data_lifecycle=offline-checkpoint-verify-restore-repair`, `checkpoint=verified`, stopped-node restore and repair restarts, pre-checkpoint and post-restore canaries visible on all nodes after repair, and the target-environment capacity/operator-review/data-lifecycle non-claim strings.
 
@@ -227,9 +228,9 @@ Non-claims remain explicit: No target-environment remote claim, no in-place Pebb
 - `docs/operations/kvnode-upgrade-rollback.md`
   - Rolling upgrade and rollback plan.
 - `tests/kvnode_capacity_envelope.sh`
-  - Opt-in bounded capacity-envelope collection harness.
+  - Opt-in bounded capacity-envelope collection harness; `metadata.env` and `summary.md` now emit `release_claim=none-target-environment-capacity-results-still-required` so raw samples carry the same target-environment non-claim as the release docs.
 - `tests/kvnode_local_capacity_drill.sh`
-  - Local loopback capacity wrapper only: starts a disposable three-node `kvnode` cluster, runs `tests/kvnode_capacity_envelope.sh` against all three client/admin listeners with PIDs and data directories supplied, and emits `status=local-loopback-only`.
+  - Local loopback capacity wrapper only: starts a disposable three-node `kvnode` cluster, runs `tests/kvnode_capacity_envelope.sh` against all three client/admin listeners with PIDs and data directories supplied, emits `status=local-loopback-only`, and preserves `release_claim=none-target-environment-capacity-results-still-required` in wrapper metadata and summary.
 - `tests/kvnode_local_runner.go`
   - Custom local Go runner only: build-tagged with `kvnode_local_runner`, starts a disposable three-node `kvnode` loopback cluster, exercises storage-fault and transport-fault administrative branches, verifies post-clear client canaries, records bounded write/read/scan latency and admin metric samples, stops one local node for offline `kvcheckpoint` checkpoint/verify/restore/repair in data mode, verifies catch-up canaries after restore and repair, emits `status=local-go-runner-only`, and preserves target-environment capacity/operator-review/data-lifecycle non-claims.
 - `tests/kvnode_mixed_version_drill.sh`
@@ -355,7 +356,7 @@ The following blockers are still listed in `RELEASE_SCOPE.md` and prevent a go d
 - `tla/EPaxosConfigAddRecovery.tla` adds one finite staged old-instance recovery-after-addition slice and generated `15/15` states, and `TestOldConfigRecoveryUsesPinnedVotersAfterAddition` covers the matching Go prepare/accept quorum path with added-voter responses rejected for old quorum progress, but arbitrary recovery under configuration changes, joint consensus, message loss, arbitrary membership histories, and unbounded proof remain open.
 - Deployment manifest artifacts are example/operator material only; `tests/kvnode_systemd_manifest_audit.sh` renders and audits the example `ExecStart` contract, but reviewed execution under a target system manager, container, or orchestration environment remains open.
 - Data lifecycle now has a maintained local offline `kvcheckpoint` helper, runbook/audit evidence, and a local Go runner data-lifecycle drill that stops one loopback node, runs offline checkpoint/verify/restore/repair, restarts it, and verifies catch-up canaries, but a reviewed operator backup/restore/disaster-recovery drill in the target environment remains open. The mixed-version drill's binary rollback keeps current data and does not exercise checkpoint restore.
-- Target-environment capacity-envelope measurements remain open; local evidence now includes a single-node workstation sample, a three-node loopback shell wrapper sample, and a custom local Go runner sample, but none is a measured target-environment capacity result.
+- Target-environment capacity-envelope measurements remain open; local evidence now includes a single-node workstation sample, a three-node loopback shell wrapper sample, a machine-readable capacity non-claim sample, and a custom local Go runner sample, but none is a measured target-environment capacity result, so target-environment capacity measurement remains open.
 - Incident readiness has runbook/audit evidence, a local loopback tabletop shell harness, and a custom local Go runner for storage-failure and network-partition test-fault branches, but operator-reviewed target-environment tabletop or live drill evidence remains open.
 
 ## Final workflow command

tests/kvnode_capacity_envelope.sh

@@ -11,6 +11,8 @@ kvnode capacity-envelope harness (opt-in, bounded)
 Status: harness only. This script gathers small, operator-chosen samples from an
 already-running kvnode cluster. It does not start nodes, does not change release
 scope, and does not produce production capacity evidence by itself.
+It emits release_claim=none-target-environment-capacity-results-still-required
+in metadata and summary output.
 
 Required opt-in:
   KVNODE_CAPACITY_RUN=yes
@@ -179,6 +181,7 @@ printf 'sample,resource,target,value,unit\n' > "$RESOURCES_CSV"
 peer_count="${KVNODE_PEER_COUNT:-${#CLIENT_URLS[@]}}"
 cat > "$METADATA_ENV" <<EOF
 status=harness-only
+release_claim=none-target-environment-capacity-results-still-required
 run_id=$run_id
 client_urls=$client_urls_raw
 admin_urls=$admin_urls_raw
@@ -311,6 +314,7 @@ cat > "$SUMMARY_MD" <<EOF
 # kvnode capacity-envelope harness sample
 
 Status: harness output only. These numbers are samples from the requested run and are not production capacity evidence unless the environment, workload, peer count, and operator procedure have been separately approved and recorded.
+Release claim: release_claim=none-target-environment-capacity-results-still-required.
 
 ## Inputs
 

tests/kvnode_local_capacity_drill.sh

@@ -13,6 +13,7 @@ kvnode cluster, then runs tests/kvnode_capacity_envelope.sh against all three
 client/admin listeners with PIDs and data directories supplied for resource
 sampling. It does not assert production capacity, target-environment coverage,
 or operator acceptance.
+The generated metadata and summary retain release_claim=none-target-environment-capacity-results-still-required.
 
 Required opt-in:
   KVNODE_LOCAL_CAPACITY_RUN=yes
@@ -226,6 +227,7 @@ run_id=$run_id
 run_dir=$RUN_DIR
 capacity_dir=$CAPACITY_DIR
 non_claim=not_target_environment_capacity_evidence
+release_claim=none-target-environment-capacity-results-still-required
 EOF
 
 echo "kvnode-local-capacity phase=build"

tests/operations_readiness_audit.sh

@@ -255,6 +255,7 @@ require_text "$capacity" "resources.csv                   before/after RSS, disk
 require_text "$capacity" "summary.md                      Machine-generated sample summary with no readiness claim."
 require_text "$capacity" "not production capacity evidence"
 require_text "$capacity" "status=harness-only"
+require_text "$capacity" "release_claim=none-target-environment-capacity-results-still-required"
 require_text "$capacity" "latency_summary="
 require_text "$capacity" "Throughput sample:"
 require_text "$capacity" "Memory RSS samples:"
@@ -271,4 +272,5 @@ require_text "$local_capacity" "KVNODE_CAPACITY_RUN=yes"
 require_text "$local_capacity" "KVNODE_PEER_COUNT=3"
 require_text "$local_capacity" "status=local-loopback-only"
 require_text "$local_capacity" "not_target_environment_capacity_evidence"
+require_text "$local_capacity" "release_claim=none-target-environment-capacity-results-still-required"
 bash -n "$local_capacity"

tests/release_scope_audit.sh

@@ -262,6 +262,8 @@ require_text "custom Go runner sample"
 require_text "status=local-go-runner-only"
 require_text "go run -tags kvnode_local_runner ./tests/kvnode_local_runner.go --help"
 require_text "measured target-environment capacity results remain open"
+require_text "release_claim=none-target-environment-capacity-results-still-required"
+require_text "target-environment capacity measurement remains open"
 require_text "also locally exercised \`/faults/storage\`, \`/faults/transport\`, \`/readyz\`, \`/metrics\`"
 require_text "three-node local wrapper sample"
 require_text "locally rehearses the storage-failure and network-partition"