Driver refusal and recovery comparison v1

Observable-state comparison · 5 September 2026

Result

Eight new fixed-corpus traces match the independent Python model at every projected step. They cover slot-rebinding refusal followed by valid service, repeated refusal and replay, quarantine refusal with progress on another slot, expiry refusal and rollover, uncertain commit followed by reopen/refusal/replay, an unstarted failed operation followed by another claim, timeout fencing until completion/recovery, and uncertain quarantine followed by valid service elsewhere.

The existing thirteen synchronous and eleven controlled-completion traces also pass against the updated Rust adapter. Five model checks pass. Regenerating the new vectors is byte-identical; expectations are produced from model/driver.py, not copied from Rust output. Historical suites and reports are preserved.

What is compared

The shared projection records verification and commit queues, claim/conflict counts, successful responses and deliveries, credits, epoch, writer occupancy, recovery status, and exclusive locking. Rust uses the real signature queue and durable ledger with preloaded signed descriptors. Invalid commit paths now consult needs_recovery() before returning the ledger to the adapter, matching the isolated owner's distinction between healthy refusal and journal uncertainty.

There is an intentional abstraction boundary. The model checks eligibility before starting a writer; the adapter can perform a real rejected call and reclaim its owner within the same projected start step. Both leave no receipt and no poison for nonmutating refusal. Negative response bytes and the transient rejected call are not observable in this projection. The network owner emits a status-0 response; the model records only successful acknowledgements.

Error-survives and error-lost outcomes remain controlled test schedules. The adapter holds notification after a real operation or skips the operation, respectively. They are not injected OS failures. Recovery sync is an oracle in Python and a real clean close/reopen in Rust. This suite uses the gated conformance adapter, not the persistent network-owner thread itself. Its results therefore do not establish full network-driver refinement, independent interoperability, or a security proof.

Reproduce

python3 model/driver_error_vectors.py
cargo build --locked --offline --features peer-recovery --example core_conformance
python3 conformance/run.py target/debug/examples/core_conformance --suite conformance/driver-errors-v1.json --output outputs/driver-errors.json
python3 -m unittest discover -s model -p test_driver.py

New vectors are conformance/driver-errors-v1.json; results and regression runs are retained under docs/results/driver-errors-v1*. The manifest records source, binary, vector and result hashes. The site publishes the comparison and shared vectors.

Next: define the persistent network driver's observable trace boundary, including negative responses, queue cleanup on fencing, and one-outstanding-request behavior, before claiming equivalence with the larger two-lane model. Capacity/churn memory, real stuck-filesystem handling and public wire review remain open. No production ingress or Fly deployment is enabled.