execution.json

{
  "schemaVersion": 1,
  "settings": {
    "backend": "rust",
    "threads": 1,
    "seed": "0xd1a1ca",
    "verbosity": 1
  },
  "check": {
    "maxSamples": 2000,
    "maxSteps": 40,
    "outputDirectory": ".formal-traces/verification"
  },
  "test": {
    "maxSamples": 1
  },
  "models": [
    {
      "path": "formal/dialcache-core.qnt",
      "invariants": [
        "failedLocalReadSkipsReuseAndPublication",
        "failedLocalWritePreservesAcceptedResult",
        "closedScopeHasNoRequestValue",
        "requestValueBelongsToCurrentScope",
        "passThroughSkipsCacheMachinery",
        "firstHitStopsLowerTraversal",
        "remoteFailureNeverRefills",
        "trackedRemoteFallbackSuppressesLocalPublication",
        "onePolicySnapshotPerEnabledInvocation",
        "sourceFailureNeverPublishes",
        "noLayerPolicySkipsAllStorage",
        "invalidInvocationPolicyNeverTouchesStorage"
      ]
    },
    {
      "path": "formal/dialcache-runtime-policy.qnt",
      "invariants": [
        "runtimeOverlayIsLeafWise",
        "configuredTtlImpliesDefaultFullRamp",
        "featureLibraryDefaults",
        "existingLocalEntryKeepsInsertionTtl",
        "existingRemoteEntryKeepsPhysicalTtl"
      ]
    },
    {
      "path": "formal/dialcache-tracked-invalidation.qnt",
      "invariants": [
        "servedSnapshotClearedObservedFence",
        "staleValueAfterInvalidationIsFenced",
        "acquiredAfterInvalidationDoesNotServeStale"
      ]
    },
    {
      "path": "formal/dialcache-stale-recovery.qnt",
      "invariants": [
        "recoveryUsesSingleRedisRead",
        "retainedCandidateWasEligible",
        "servedStaleIsStrictlyWithinMaxAge",
        "staleRequiresAuthorizedSourceFailure",
        "sourceSuccessDoesNotDecodeCandidate",
        "recoveredStaleHasNoSharedPublication",
        "readFailureNeverRetains",
        "readFailureNeverAttemptsRecovery",
        "futureFrameIsNeverFreshOrRetained"
      ]
    },
    {
      "path": "formal/dialcache-redis-protocol.qnt",
      "invariants": [
        "nilValueIsValueAbsent",
        "fenceCanPrecedeEncodingError",
        "malformedWatermarkPrecedesEncodingError",
        "trackedZeroTimestampIsNotHit",
        "observedWatermarkOnlyOnTrackedReads",
        "encodingErrorRequiresSupportedFrame",
        "replyTypesAreValidatedFirst",
        "validMissWatermarksArePreserved",
        "untrackedDecodingIgnoresWatermarks",
        "unsupportedFramePrecedesEncodingError"
      ]
    },
    {
      "path": "formal/dialcache-conformance.qnt",
      "invariants": [
        "loaderCountsNonNegative",
        "redisCountsNonNegative",
        "readableRemoteHasValue",
        "servedLayerValueMatchesCache"
      ],
      "profile": "core",
      "generate": {
        "maxSamples": 256,
        "maxSteps": 30,
        "traces": 32,
        "outputDirectory": ".formal-traces/conformance"
      }
    },
    {
      "path": "formal/dialcache-effects-conformance.qnt",
      "invariants": [
        "oneRequestPerRead",
        "measurementsAreNonnegative",
        "futureOffsetsArePositiveAtObservingLayer",
        "oneSourceDurationPerSettlement",
        "oneRegisteredSource",
        "registeredFlightHasPendingCalls",
        "registeredReadOwnsFlight",
        "effectCountsMatchRecords",
        "writeRequiresAcceptedSource",
        "acceptedSourcesSettledBeforeTheirDeadline",
        "staleFrameRepliesReportExpired"
      ],
      "profile": "effects",
      "differential": {
        "maxBytesPerStateRatio": 1.45
      },
      "generate": {
        "maxSamples": 4096,
        "maxSteps": 60,
        "traces": 512,
        "outputDirectory": ".formal-traces/effects"
      }
    },
    {
      "path": "formal/dialcache-recovery-conformance.qnt",
      "invariants": [
        "singleReadPerFlight",
        "writesHaveRetention",
        "agesRequireRecovery",
        "closedScopesHaveNoMemo",
        "pendingDecodeHasCall",
        "sourcesMatchEffects",
        "onlyRegisteredSourceOwnsDeadline",
        "oneExecution",
        "completedCallsHaveNoActiveWork",
        "pendingCallersOwnActiveFlights"
      ],
      "profile": "recovery",
      "differential": {
        "maxBytesPerStateRatio": 1.85
      },
      "generate": {
        "maxSamples": 4096,
        "maxSteps": 60,
        "traces": 512,
        "outputDirectory": ".formal-traces/features/recovery"
      }
    },
    {
      "path": "formal/dialcache-policy-conformance.qnt",
      "invariants": [
        "writesHaveRetention",
        "hitsSkipSource",
        "callsKeepSourceOutcome",
        "sourceCountsMatchEffects",
        "registeredSourcesArePending",
        "sharedSourcesKeepRegistration",
        "policyResolutionErrorsHaveStableClassification",
        "localHitsRespectInsertionExpiry",
        "remoteHitsRespectAcquiredFreshness",
        "remoteHitsWarmLocalForTheReplysLocalTtl",
        "joinsOnlyJoinableFlights",
        "atomicPathSeedsDecodableFrames"
      ],
      "profile": "policy",
      "generate": {
        "maxSamples": 2048,
        "maxSteps": 60,
        "traces": 512,
        "outputDirectory": ".formal-traces/features/policy"
      }
    },
    {
      "path": "formal/dialcache-shadow-conformance.qnt",
      "invariants": [
        "oneSourcePerCaller",
        "writesHaveRetention",
        "missingHookHasNoShadowEffects",
        "agesRequireVerdicts",
        "warningsRequireMismatch",
        "expiredSourceWorkSkipsRedis",
        "invalidLoggingCannotBeCaptured",
        "fillsRequireMissAndAcceptedSource",
        "c0AcquisitionsRespectFreshness",
        "budgetsBelongToPendingWork",
        "heldEffectsAreTheDrivers",
        "oneExecution",
        "fillsClearTheirFence",
        "budgetsAreOneKnob"
      ],
      "profile": "shadow",
      "generate": {
        "maxSamples": 4096,
        "maxSteps": 60,
        "traces": 1024,
        "outputDirectory": ".formal-traces/features/shadow"
      },
      "differential": {
        "maxBytesPerStateRatio": 1.8
      }
    },
    {
      "path": "formal/dialcache-scope-conformance.qnt",
      "invariants": [
        "closedScopesHaveNoMemo",
        "registeredSourcesArePending",
        "callsKeepSourceOutcome",
        "sourceCountsMatchEffects",
        "memoFollowsLatestSuccessfulSettlement",
        "registrationFollowsCoalescing"
      ],
      "profile": "scope",
      "generate": {
        "maxSamples": 1024,
        "maxSteps": 60,
        "traces": 256,
        "outputDirectory": ".formal-traces/features/scope"
      }
    },
    {
      "path": "formal/dialcache-admission-conformance.qnt",
      "invariants": [
        "capacityIsPerInstance",
        "oneJobPerIdentity",
        "registeredFlightsArePending",
        "callsKeepAcquiredValue",
        "jobsAreDiagnostic",
        "effectsMatchRecords",
        "selectionsAwaitTheirHit",
        "jobBudgetsBelongToLiveJobs",
        "elapsedStaysBelowReadDeadlines",
        "pendingDeadlinesAreFuture"
      ],
      "profile": "admission",
      "differential": {
        "maxBytesPerStateRatio": 1.65
      },
      "generate": {
        "maxSamples": 1024,
        "maxSteps": 60,
        "traces": 128,
        "outputDirectory": ".formal-traces/features/admission"
      }
    },
    {
      "path": "formal/dialcache-layers-conformance.qnt",
      "invariants": [
        "sourceEffectsMatch",
        "capacityIsPerInstance",
        "closedScopesHaveNoMemo",
        "registeredSourcesArePending",
        "zeroCapacityHasNoLocalValues",
        "callsKeepSourceOutcome",
        "localMembershipMatchesLru",
        "absentRemoteHasNoAdapterEffects",
        "sourceOwnershipNeverCrossesKeyOrInstance",
        "atomicPathSeedsDecodableFrames"
      ],
      "profile": "layers",
      "generate": {
        "maxSamples": 2048,
        "maxSteps": 80,
        "traces": 512,
        "outputDirectory": ".formal-traces/features/layers"
      }
    },
    {
      "path": "formal/dialcache-independent-conformance.qnt",
      "invariants": [
        "oneReadPerCall",
        "effectsMatchOwners",
        "completedCallsHaveNoActiveWork",
        "retainedSnapshotsWereEligible",
        "abortsAreUnique",
        "writesKeepCapturedRetention",
        "eachSourceKeepsItsFullBudget"
      ],
      "profile": "independent",
      "generate": {
        "maxSamples": 2048,
        "maxSteps": 60,
        "traces": 512,
        "outputDirectory": ".formal-traces/features/independent"
      }
    },
    {
      "path": "formal/dialcache-recovery-read-conformance.qnt",
      "profile": "recovery-read",
      "invariants": [
        "closedContextsStayEmpty",
        "selectedShadowNeverAdmitsRecoveredResults",
        "observationsHaveOwners",
        "trackedWritesRespectPhysicalCap",
        "effectsMatchOwners",
        "completedCallsHaveNoActiveWork",
        "oneExecution",
        "expiredMarkersFenceNothing"
      ],
      "generate": {
        "maxSamples": 1024,
        "maxSteps": 60,
        "traces": 256,
        "outputDirectory": ".formal-traces/features/recovery-read"
      }
    },
    {
      "path": "formal/dialcache-local-failure-conformance.qnt",
      "profile": "local-failure",
      "invariants": [
        "faultedReadNeverUsesLocal",
        "faultedSettlementPublishesNothingLocally",
        "callsKeepSourceOutcome",
        "storageHoldsAcceptedValuesOnly",
        "atomicPathSeedsDecodableFrames",
        "oneSourceAtATime"
      ],
      "differential": {
        "maxBytesPerStateRatio": 1.45
      },
      "generate": {
        "maxSamples": 512,
        "maxSteps": 40,
        "traces": 128,
        "outputDirectory": ".formal-traces/features/local-failure"
      }
    },
    {
      "path": "formal/dialcache-runtime-boundaries-conformance.qnt",
      "profile": "runtime-boundaries",
      "invariants": [
        "equalAndLowerCohortsNeverTraverse",
        "inheritedDisabledSharingNeverJoins",
        "invalidBooleanLeavesBypassAllCaching",
        "callersKeepTheirSourceValue",
        "retainedValueFollowsSettlementOrder",
        "sourceEffectsMatch",
        "atomicPathSeedsDecodableFrames"
      ],
      "generate": {
        "maxSamples": 1024,
        "maxSteps": 60,
        "traces": 256,
        "outputDirectory": ".formal-traces/features/runtime-boundaries"
      }
    },
    {
      "path": "formal/dialcache-shadow-layers-conformance.qnt",
      "profile": "shadow-layers",
      "invariants": [
        "boundedSharedJobRegistry",
        "oneJobPerInstanceKey",
        "sourcesRemainIndependentOfJobs",
        "callerSourceOwnsItsResult",
        "darkJobsNeverRecover",
        "fillKeepsCapturedRetention",
        "servedJobsNeverWrite",
        "timedOutDarkSourceWaitReleases",
        "unboundedCallerKeepsPendingSource",
        "detachedSourcesCarryNoAuthority",
        "jobBudgetsBelongToLiveJobs",
        "heldWorkHasAcceptedResults",
        "atomicPathSeedsDecodableFrames"
      ],
      "generate": {
        "maxSamples": 1024,
        "maxSteps": 60,
        "traces": 256,
        "outputDirectory": ".formal-traces/features/shadow-layers"
      }
    },
    {
      "path": "formal/dialcache-local-clock-conformance.qnt",
      "invariants": [
        "clockIsOnTheGrid",
        "callsServeLiveEntriesOrRunTheSource",
        "publicCallsMatchSources",
        "noProviderMakesNoPolicyCall"
      ],
      "profile": "local-clock",
      "generate": {
        "maxSamples": 512,
        "maxSteps": 40,
        "traces": 128,
        "outputDirectory": ".formal-traces/features/local-clock"
      }
    },
    {
      "path": "formal/dialcache-source-budgets-conformance.qnt",
      "profile": "source-budgets",
      "invariants": [
        "outsideSourcesHaveNoDeadline",
        "acceptedSourceRespectsItsOwnStart",
        "registeredWorkIsNotAbandoned",
        "localPublicationRequiresAcceptedSource",
        "followersKeepTheirOwnersOutcome",
        "onlyEnabledValidCallsResolvePolicy"
      ],
      "generate": {
        "maxSamples": 1024,
        "maxSteps": 60,
        "traces": 256,
        "outputDirectory": ".formal-traces/features/source-budgets"
      }
    },
    {
      "path": "formal/dialcache-frame-vectors.qnt",
      "invariants": [
        "encodedFrameKeepsHeaderAndPayload",
        "decodedTextContainsOnlyScalars",
        "trackedHitsStrictlyClearValidFence",
        "absentValueKeepsItsOwnClassification",
        "acceptedDurationWithinCeiling",
        "writerRejectsInvalidNumericDomain"
      ],
      "vectorExport": {
        "generator": "formal/generate-frame-vectors.mjs",
        "artifact": "formal/quint-frame-vectors.json",
        "kind": "protocol",
        "cases": 589,
        "sources": [
          "formal/dialcache-frame-vectors.qnt",
          "formal/wire-text.qnt",
          "formal/generate-frame-vectors.mjs",
          "formal/cache-rules.qnt"
        ]
      }
    },
    {
      "path": "formal/dialcache-invalidation-transition.qnt",
      "invariants": [
        "rejectedInputPreservesEntireRedisState",
        "argumentValidationIsExact",
        "successfulCutoffIsExactMaximum",
        "successfulRetentionMeetsBothFloors",
        "stringsKeepExistingRetention",
        "unrelatedTypesReceiveFiniteRepair",
        "outputIsCanonicalDecimalString",
        "finiteRetentionIsExact"
      ],
      "vectorExport": {
        "generator": "formal/generate-invalidation-vectors.mjs",
        "artifact": "formal/quint-invalidation-vectors.json",
        "kind": "invalidation",
        "cases": 288,
        "sources": [
          "formal/dialcache-invalidation-transition.qnt",
          "formal/generate-invalidation-vectors.mjs"
        ]
      }
    },
    {
      "path": "formal/dialcache-key-protocol.qnt",
      "invariants": [
        "keyAcceptanceRespectsTextAndHashTagDomain",
        "rejectedKeysExposeNoPartialIdentity",
        "successfulKeysHaveOneOperationDelimiter",
        "normalizedNamesAreOrderedAndValuesAssociated",
        "normalizedIntegersRetainExactMagnitude",
        "cohortNumeratorsAreUnsignedAndBoundariesStrict"
      ],
      "vectorExport": {
        "generator": "formal/generate-key-vectors.mjs",
        "artifact": "formal/quint-key-vectors.json",
        "kind": "protocol",
        "cases": 457,
        "sources": [
          "formal/dialcache-key-protocol.qnt",
          "formal/generate-key-vectors.mjs",
          "formal/wire-text.qnt",
          "formal/cohort-boundaries.qnt"
        ]
      }
    },
    {
      "path": "formal/dialcache-envelope-vectors.qnt",
      "invariants": [
        "rawEscapeIsLossless",
        "readFailuresPreserveOriginalBinary",
        "readDoesNotConsultNewWritePolicy",
        "escapeConsumesExactlyOnePrefix",
        "successfulReadRespectsMarkerAndLimit",
        "compressionUsesByteThresholdAndStrictShrink",
        "unknownZeroPrefixPassesThroughUnchanged"
      ],
      "vectorExport": {
        "generator": "formal/generate-envelope-vectors.mjs",
        "artifact": "formal/quint-envelope-vectors.json",
        "kind": "protocol",
        "cases": 297,
        "sources": [
          "formal/dialcache-envelope-vectors.qnt",
          "formal/wire-text.qnt",
          "formal/generate-envelope-vectors.mjs"
        ]
      }
    },
    {
      "path": "formal/dialcache-rule-checks.qnt",
      "invariants": [
        "freshBoundaryIsExclusive",
        "recoveryBoundaryIsExclusive",
        "retentionStartsAtFreshBoundary",
        "localBoundaryIsExclusive",
        "localGridUsesWholeMilliseconds",
        "sourceBoundaryIsExclusive",
        "fenceBoundaryIsExclusive"
      ],
      "symbolic": {
        "maxSteps": 1,
        "timeoutMs": 120000
      }
    },
    {
      "path": "formal/dialcache-recovery-read-connection.qnt",
      "invariants": [
        "retainedSnapshotMatchesAcquisition",
        "recoveryReturnMatchesAcquiredContract",
        "freshnessUsesReadSettlement",
        "recoveredResultsNeverPublishShared",
        "sourcesCarryCappedAdmittedRetention"
      ]
    },
    {
      "path": "formal/dialcache-source-connection.qnt",
      "invariants": [
        "sourceOriginsMatchContract",
        "sourceOwnersMatchContract",
        "acceptedSourcesMatchContract",
        "followerKeepsAcquiredOwner"
      ]
    },
    {
      "path": "formal/dialcache-recovery-connection.qnt",
      "invariants": [
        "recoveredValueWasWithinAcceptedAge",
        "recoveredFlightCompletesEveryOwner",
        "retainedSnapshotMatchesAcquisition",
        "recoveredResultsNeverPublishShared",
        "retainedCandidateWindow"
      ]
    },
    {
      "path": "formal/dialcache-independent-connection.qnt",
      "invariants": [
        "independentSnapshotsMatchAcquisition",
        "independentRecoveryMatchesContract",
        "independentSourceOriginsMatchContract"
      ]
    },
    {
      "path": "formal/dialcache-shadow-layers-connection.qnt",
      "invariants": [
        "servedCallersKeepTheirOutcome",
        "jobsAdmittedOnlyWhenSelected",
        "jobsCaptureAdmissionRetention",
        "retainedC0WasFreshWhenAcquired",
        "localPublicationBelongsToCaller"
      ]
    },
    {
      "path": "formal/dialcache-dark-layers-conformance.qnt",
      "profile": "dark-layers",
      "invariants": [
        "boundedJobRegistry",
        "oneJobPerIdentity",
        "darkJobsRunOverOwnedSources",
        "sourcesAreCallersOwn",
        "heldFillsBelongToJobs",
        "fillsCarryCapturedAuthority",
        "fillsClearTheirFence",
        "sourceOwnersShareTheSourcesIdentity",
        "deadlinesBelongToPendingWork",
        "failedFlightsAreAttributedOnce",
        "coalescedLabelsCountFollowers",
        "localEntriesHoldAcceptedOwnedValues",
        "memoHoldsAcceptedValues",
        "callersOwnTheirResults",
        "futureOffsetsFollowRollbacks",
        "channelRestrictionsHold",
        "agesRequireVerdicts",
        "budgetsAreOneKnob",
        "pendingDeadlinesAreFuture",
        "heldEffectsKeepTheirJob",
        "inspectionReceiptsCoverAdmissions",
        "inspectionsDescribeLiveLeaders",
        "inspectionsCountOnlyProcessFollowers",
        "inspectionAgeUsesTheOldestLiveMonotonicStart"
      ],
      "generate": {
        "maxSamples": 1024,
        "maxSteps": 60,
        "traces": 256,
        "outputDirectory": ".formal-traces/features/dark-layers"
      }
    },
    {
      "path": "formal/dialcache-shadow-read-deadlines-conformance.qnt",
      "profile": "shadow-read-deadlines",
      "invariants": [
        "capacityIsBounded",
        "rawReadsKeepTheirRegistration",
        "abortedReadsHaveEndedTheirResult",
        "endedReadsHaveNoJobTimer",
        "liveReadDeadlinesAreOwned",
        "callerResultsBelongToTheirSources"
      ],
      "generate": {
        "maxSamples": 1024,
        "maxSteps": 40,
        "traces": 128,
        "outputDirectory": ".formal-traces/features/shadow-read-deadlines"
      }
    }
  ],
  "symbolic": {
    "backend": "apalache",
    "version": "0.56.1",
    "archive": {
      "url": "https://github.com/apalache-mc/apalache/releases/download/v0.56.1/apalache-0.56.1.tgz",
      "sha256": "a61c07569d7195ddc589f01037fa10fafef4fb0796af2f1c9cb45226375dfbfc"
    }
  },
  "challenges": [
    {
      "id": "recovery-inclusive-maximum",
      "contract": "C45",
      "source": "formal/cache-rules.qnt",
      "model": "formal/dialcache-rule-checks.qnt",
      "invariant": "recoveryBoundaryIsExclusive",
      "before": "created <= observed and observed - created < ceiling",
      "after": "created <= observed and observed - created <= ceiling",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M01",
        "text": "M01 is the observable native site of cache-rules.qnt ageBeforeCeiling becoming inclusive, as measured by dialcache-rule-checks.qnt recoveryBoundaryIsExclusive: the post-decode serving check in both ports accepts a retained candidate at exactly the maximum age. Earlier ceiling sites are masked by the post-decode recheck because ages only grow, so this is the one single-site inclusive edit; recovery/maximumAgeAfterDecodePreservesSourceTest already detects it in both ports."
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "maximumAgeAfterDecodeFromStrictlyStaleFrameTest",
        "model": "formal/dialcache-recovery-conformance.qnt",
        "failure": "s.o.calls == List(SOURCE_ERROR) and s.o.loads == 1 and s.o.recovery == List(\"miss\") and s.d.ages == List() and s.o.writes == 0",
        "family": "inclusive-maximum-boundary",
        "profiles": [
          "formal/dialcache-rule-checks.qnt",
          "recovery",
          "policy",
          "independent",
          "recovery-read",
          "shadow-layers",
          "shadow",
          "dark-layers",
          "effects"
        ],
        "exclusions": {
          "scope": "The request-only projection has no frames and no clock, so no age judgment is evaluated.",
          "source-budgets": "The local projection has no remote frames; local expiry is localEntryLiveAt, not ageBeforeCeiling.",
          "layers": "Frames are seeded at age 0 under a 60 s freshness and the clock moves 1 ms per tick, so no history reaches an age boundary.",
          "admission": "Composes the remote freshness judgment, but every frame is stamped at a wall clock that only advances and is read within 600 ms under a 60 s freshness, so no read meets an age boundary or observes a future stamp.",
          "local-failure": "Composes the remote freshness judgment (ageBeforeCeiling), but its wall clock never moves and every frame is stamped at the current instant, so a frame's age is always 0 and never meets a ceiling (re-measured 2026-09-20 over the composed text: every scheduled invariant and regression passes under the mutant).",
          "local-clock": "Composes the local projection with no remote layer; its closure reaches cache-rules through wholeMs and localEntryLiveAt only, so ageBeforeCeiling is never evaluated (re-measured 2026-09-20 over the composed text).",
          "runtime-boundaries": "No scheduled history reaches an exact age boundary: every regression passes under the mutant.",
          "shadow-read-deadlines": "All six exported read-deadline histories and all six scheduled invariants at 2000 x 40 pass under this fault; this profile does not exercise the affected recovery or settled-flight reuse behavior."
        }
      }
    },
    {
      "id": "recovery-future-candidate",
      "contract": "C45",
      "source": "formal/cache-rules.qnt",
      "model": "formal/dialcache-rule-checks.qnt",
      "invariant": "recoveryBoundaryIsExclusive",
      "before": "created <= observed and observed - created < ceiling",
      "after": "observed - created < ceiling",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M40",
        "text": "M40 is the native twin of cache-rules.qnt ageBeforeCeiling losing its created-before-observed clause, as measured by dialcache-rule-checks.qnt recoveryBoundaryIsExclusive: both ports classify a frame dated after the reader clock as a valid frame of age zero instead of rejecting it as future. The future clause is implemented once and shared by serving, recovery and shadow reads, so a recovery-only edit is not expressible and the shared edit is the faithful twin.",
        "crossContract": "M40 sits on C40.future-rejected because the shared frameAge future clause is the cache-rules ageBeforeCeiling rule; C45's replay rollbackDuringRetainedDecodeRejectsFutureSnapshotTest and witness rollback-rejects-retained-future detect the same edit on the recovery path."
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "wallRollbackRejectsFutureRemoteFrameTest",
        "model": "formal/dialcache-policy-conformance.qnt",
        "failure": "s.o.calls == List(VALUE_ONE, CALL_PENDING) and s.o.loaders == 2",
        "family": "future-timestamp-accepted",
        "profiles": [
          "formal/dialcache-rule-checks.qnt",
          "recovery",
          "policy",
          "shadow",
          "recovery-read",
          "effects",
          "dark-layers"
        ],
        "exclusions": {
          "scope": "Evaluates no age judgment from cache-rules, so ageBeforeCeiling is unreachable.",
          "admission": "Composes the remote freshness judgment, but every frame is stamped at a wall clock that only advances and is read within 600 ms under a 60 s freshness, so no read meets an age boundary or observes a future stamp.",
          "layers": "Frames are stamped from a wall clock that only moves with the monotonic clock (no rollback input), so no history observes a future stamp.",
          "independent": "Seeds stamp frames at the wall minus a non-negative age and the clock only advances, so no history observes a future stamp.",
          "local-failure": "Composes the remote freshness judgment (ageBeforeCeiling through freshAgeAllowed), but its wall clock never moves and every frame is stamped at the current instant, so no history observes a future stamp.",
          "runtime-boundaries": "Frames are stamped from a wall clock that only moves with the monotonic clock (no rollback input), so no history observes a future stamp.",
          "shadow-layers": "Frames are stamped with the wall clock at write release (remote_writes.dispatch) or seeded at a non-negative age; the skew is 0 and never shifts, so no history observes a future stamp.",
          "local-clock": "Composes the local projection with no remote layer; its closure reaches cache-rules through wholeMs and localEntryLiveAt only, so ageBeforeCeiling is never evaluated.",
          "source-budgets": "Uses only localEntryLiveAt and sourceAcceptsAt from cache-rules; no age judgment is evaluated.",
          "shadow-read-deadlines": "All six exported read-deadline histories and all six scheduled invariants at 2000 x 40 pass under this fault; this profile does not exercise the affected recovery or settled-flight reuse behavior."
        }
      }
    },
    {
      "id": "recovery-connection-inclusive-maximum",
      "contract": "C45",
      "source": "formal/cache-rules.qnt",
      "model": "formal/dialcache-recovery-connection.qnt",
      "invariant": "recoveredValueWasWithinAcceptedAge",
      "before": "created <= observed and observed - created < ceiling",
      "after": "created <= observed and observed - created <= ceiling",
      "measures": "Repeats the recovery-inclusive-maximum fault against the recovery connection model: the same shared-rule mutation must also be caught by that monitor's own clause.",
      "reproducer": {
        "kind": "exported-regression",
        "run": "maximumAgeAfterDecodeFromStrictlyStaleFrameTest",
        "model": "formal/dialcache-recovery-conformance.qnt",
        "failure": "s.o.calls == List(SOURCE_ERROR) and s.o.loads == 1 and s.o.recovery == List(\"miss\") and s.d.ages == List() and s.o.writes == 0",
        "family": "inclusive-maximum-boundary",
        "profiles": [
          "formal/dialcache-recovery-connection.qnt",
          "recovery",
          "policy",
          "independent",
          "recovery-read",
          "shadow-layers",
          "shadow",
          "dark-layers",
          "effects"
        ],
        "exclusions": {
          "scope": "The request-only projection has no frames and no clock, so no age judgment is evaluated.",
          "source-budgets": "The local projection has no remote frames; local expiry is localEntryLiveAt, not ageBeforeCeiling.",
          "layers": "Frames are seeded at age 0 under a 60 s freshness and the clock moves 1 ms per tick, so no history reaches an age boundary.",
          "admission": "Composes the remote freshness judgment, but every frame is stamped at a wall clock that only advances and is read within 600 ms under a 60 s freshness, so no read meets an age boundary or observes a future stamp.",
          "local-failure": "Composes the remote freshness judgment (ageBeforeCeiling), but its wall clock never moves and every frame is stamped at the current instant, so a frame's age is always 0 and never meets a ceiling (re-measured 2026-09-20 over the composed text: every scheduled invariant and regression passes under the mutant).",
          "local-clock": "Composes the local projection with no remote layer; its closure reaches cache-rules through wholeMs and localEntryLiveAt only, so ageBeforeCeiling is never evaluated (re-measured 2026-09-20 over the composed text).",
          "runtime-boundaries": "No scheduled history reaches an exact age boundary: every regression passes under the mutant.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M01",
        "text": "Same native fault as recovery-inclusive-maximum: M01 makes the post-decode serving maximum inclusive in both ports, which is cache-rules.qnt ageBeforeCeiling becoming inclusive as measured here by dialcache-recovery-connection.qnt recoveredValueWasWithinAcceptedAge over the snapshot a served recovery decode settles from."
      }
    },
    {
      "id": "policy-inclusive-local-expiry",
      "contract": "C09",
      "source": "formal/kernel/local-storage.qnt",
      "model": "formal/dialcache-policy-conformance.qnt",
      "invariant": "localHitsRespectInsertionExpiry",
      "before": "if (localEntryLiveAt(state.now, state.localExpires.nth(slot))) state.localValues.nth(slot) else NO_VALUE",
      "after": "if (state.now <= state.localExpires.nth(slot)) state.localValues.nth(slot) else NO_VALUE",
      "reproducer": {
        "kind": "exported-regression",
        "run": "localHitDoesNotRenewInsertionTtlTest",
        "failure": "s.o.calls == List(VALUE_ONE, VALUE_ONE, CALL_PENDING) and s.o.loaders == 2",
        "family": "inclusive-expiry-boundary",
        "profiles": [
          "policy",
          "source-budgets",
          "recovery-read",
          "shadow-layers"
        ],
        "exclusions": {
          "effects": "The local layer is off (capacity 0 and no local TTL), so the mutated local lookup never serves an entry.",
          "recovery": "The local layer is off: capacity 0 and no local TTL, so local expiry is never judged.",
          "shadow": "Composes local storage, but every reply leaves the local layer off and the capacity is 0, so no local entry is ever written or read.",
          "admission": "The local layer is off in every reply and local storage is declared empty, so the mutated local storage rule is never executed.",
          "independent": "Composes local storage, but every reply leaves the local layer off and the capacity is 0, so the mutated lookup is never executed and no local entry is ever written.",
          "local-failure": "Composes local storage, but its clock never advances (now stays 0 against a 60 s local TTL), so no read meets an entry at its expiry instant.",
          "scope": "Composes the request-only projection, which never reads local storage.",
          "layers": "Composes local storage, but its 60 s entries never reach their insertion expiry within the bound of 1 ms ticks.",
          "runtime-boundaries": "Composes local storage, but no input advances the clock, so no entry reaches its expiry.",
          "dark-layers": "The named dark-job histories and invariants do not distinguish inclusive local expiry. The sampled local-expiry witness drives native replay, but this profile supplies no model-side assertion for that exact local boundary.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed.",
          "local-clock": "The fractional profile supplies its lookup through local_grid using raw insertion ticks and localEntryLiveOnGrid; it does not execute the mutated local_storage.localValue lookup. All named histories and scheduled invariants pass under this fault. Its own precise-grid and hit-renewal faults remain separately checked."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M18",
        "text": "M18 is the native twin of kernel/local-storage.qnt localValue replacing localEntryLiveAt with an inclusive comparison against the entry's expiry: both ports serve a local entry at the exact millisecond its insertion TTL elapses."
      }
    },
    {
      "id": "local-precise-grid",
      "contract": "C09",
      "source": "formal/cache-rules.qnt",
      "model": "formal/dialcache-rule-checks.qnt",
      "invariant": "localGridUsesWholeMilliseconds",
      "before": "localEntryLiveAt(wholeMs(observedTicks, ticksPerMs), wholeMs(insertedTicks, ticksPerMs) + ttlMs)",
      "after": "observedTicks - insertedTicks < ttlMs * ticksPerMs",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M19",
        "text": "M19 replaces whole-millisecond local insertion/expiry with precise time in both ports. The unchanged raw-tick-difference fault now reaches the local-clock lifecycle, which retains raw insertion ticks and judges lookup through localEntryLiveOnGrid. The original localGridUsesWholeMilliseconds property remains independent."
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "fractionalInsertionExpiresAtWholeMillisecondTest",
        "model": "formal/dialcache-local-clock-conformance.qnt",
        "failure": "s.o.calls == List(VALUE_ONE, VALUE_ONE, VALUE_TWO) and s.o.loaders == 2",
        "family": "raw-versus-gridded-local-age",
        "profiles": [
          "formal/dialcache-rule-checks.qnt",
          "local-clock"
        ],
        "exclusions": {
          "effects": "This profile never calls localEntryLiveOnGrid. Its local expiry, if present, is already expressed in whole milliseconds; raw insertion/observation projection belongs to local-clock.",
          "recovery": "This profile never calls localEntryLiveOnGrid. Its local expiry, if present, is already expressed in whole milliseconds; raw insertion/observation projection belongs to local-clock.",
          "policy": "This profile never calls localEntryLiveOnGrid. Its local expiry, if present, is already expressed in whole milliseconds; raw insertion/observation projection belongs to local-clock.",
          "shadow": "This profile never calls localEntryLiveOnGrid. Its local expiry, if present, is already expressed in whole milliseconds; raw insertion/observation projection belongs to local-clock.",
          "scope": "This profile never calls localEntryLiveOnGrid. Its local expiry, if present, is already expressed in whole milliseconds; raw insertion/observation projection belongs to local-clock.",
          "admission": "This profile never calls localEntryLiveOnGrid. Its local expiry, if present, is already expressed in whole milliseconds; raw insertion/observation projection belongs to local-clock.",
          "layers": "This profile never calls localEntryLiveOnGrid. Its local expiry, if present, is already expressed in whole milliseconds; raw insertion/observation projection belongs to local-clock.",
          "independent": "This profile never calls localEntryLiveOnGrid. Its local expiry, if present, is already expressed in whole milliseconds; raw insertion/observation projection belongs to local-clock.",
          "recovery-read": "This profile never calls localEntryLiveOnGrid. Its local expiry, if present, is already expressed in whole milliseconds; raw insertion/observation projection belongs to local-clock.",
          "local-failure": "This profile never calls localEntryLiveOnGrid. Its local expiry, if present, is already expressed in whole milliseconds; raw insertion/observation projection belongs to local-clock.",
          "runtime-boundaries": "This profile never calls localEntryLiveOnGrid. Its local expiry, if present, is already expressed in whole milliseconds; raw insertion/observation projection belongs to local-clock.",
          "shadow-layers": "This profile never calls localEntryLiveOnGrid. Its local expiry, if present, is already expressed in whole milliseconds; raw insertion/observation projection belongs to local-clock.",
          "source-budgets": "This profile never calls localEntryLiveOnGrid. Its local expiry, if present, is already expressed in whole milliseconds; raw insertion/observation projection belongs to local-clock.",
          "dark-layers": "This profile never calls localEntryLiveOnGrid. Its local expiry, if present, is already expressed in whole milliseconds; raw insertion/observation projection belongs to local-clock.",
          "shadow-read-deadlines": "All six scheduled histories and six invariants pass under this shared fault at 2000 samples by 40 steps. No scheduled assertion distinguishes fractional local insertion and lookup expiry in this bounded read-deadline profile; the imported rule alone does not establish detection."
        }
      }
    },
    {
      "id": "source-inclusive-deadline",
      "contract": "C25",
      "source": "formal/cache-rules.qnt",
      "model": "formal/dialcache-rule-checks.qnt",
      "invariant": "sourceBoundaryIsExclusive",
      "before": "pure def deadlinePendingAt(observed: int, deadline: int): bool = observed < deadline",
      "after": "pure def deadlinePendingAt(observed: int, deadline: int): bool = observed <= deadline",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M35",
        "text": "M35 is the native twin of cache-rules.qnt deadlinePendingAt becoming inclusive, as measured by dialcache-rule-checks.qnt sourceBoundaryIsExclusive: both ports accept a settlement observed at exactly the elapsed deadline. Timer-delivered regressions do not distinguish it from the unchanged timer path, so the effects jumpClock histories (effects/lateReadCannotBecomeHitTest, lateReadRejectionUsesDeadlineCategoryTest and the late-resolve and late-reject witnesses) are the expected evidence."
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "lateSourceResultIsADeadlineErrorTest",
        "failure": "s.o.calls == List(DEADLINE_ERROR) and s.o.dumps == 0 and errorReasons == List(\"fallback\") and amounts(\"fallback\") == List(10)",
        "family": "inclusive-deadline-boundary",
        "profiles": [
          "formal/dialcache-rule-checks.qnt",
          "source-budgets",
          "independent",
          "shadow-layers",
          "recovery",
          "admission",
          "shadow",
          "effects",
          "dark-layers",
          "policy",
          "recovery-read",
          "shadow-read-deadlines"
        ],
        "exclusions": {
          "scope": "This profile has no source/read/shadow deadline. It imports the common rules through storage, but its scheduled histories and independent properties do not distinguish equality in deadlinePendingAt for physical retention or marker expiry.",
          "layers": "This profile has no source/read/shadow deadline. It imports the common rules through storage, but its scheduled histories and independent properties do not distinguish equality in deadlinePendingAt for physical retention or marker expiry.",
          "local-failure": "This profile has no source/read/shadow deadline. It imports the common rules through storage, but its scheduled histories and independent properties do not distinguish equality in deadlinePendingAt for physical retention or marker expiry.",
          "runtime-boundaries": "This profile has no source/read/shadow deadline. It imports the common rules through storage, but its scheduled histories and independent properties do not distinguish equality in deadlinePendingAt for physical retention or marker expiry.",
          "local-clock": "This profile has no source/read/shadow deadline. It imports the common rules through storage, but its scheduled histories and independent properties do not distinguish equality in deadlinePendingAt for physical retention or marker expiry."
        },
        "model": "formal/dialcache-effects-conformance.qnt"
      }
    },
    {
      "id": "fence-inclusive-timestamp",
      "contract": "C33",
      "source": "formal/cache-rules.qnt",
      "model": "formal/dialcache-rule-checks.qnt",
      "invariant": "fenceBoundaryIsExclusive",
      "before": "pure def fenceAllows(created: int, watermark: int): bool = created > watermark",
      "after": "pure def fenceAllows(created: int, watermark: int): bool = created >= watermark",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M06",
        "text": "M06 makes the tracked native decoder accept a frame stamped exactly at its watermark. The shared model fenceAllows edit also changes fill-side checks; frameAtTheWatermarkIsFencedFromTheDarkReadTest isolates the read boundary through dumps and loads and completes in both mutated ports."
      },
      "reproducer": {
        "kind": "exported-regression",
        "model": "formal/dialcache-dark-layers-conformance.qnt",
        "run": "frameAtTheWatermarkIsFencedFromTheDarkReadTest",
        "failure": "s.o.calls == List(VALUE_TWO) and s.o.dumps == 1 and s.o.loads == 0",
        "family": "strict-read-fence",
        "profiles": [
          "formal/dialcache-rule-checks.qnt",
          "layers",
          "independent",
          "recovery-read",
          "dark-layers"
        ],
        "exclusions": {
          "effects": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "recovery": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "policy": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "shadow": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "scope": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "admission": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "local-failure": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "runtime-boundaries": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "shadow-layers": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "local-clock": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "source-budgets": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      }
    },
    {
      "id": "profile-source-wrong-clock",
      "contract": "C23",
      "source": "formal/kernel/deadlines.qnt",
      "model": "formal/dialcache-source-connection.qnt",
      "invariant": "sourceOriginsMatchContract",
      "before": "at: state.now + budget }), ...state }",
      "after": "at: budget }), ...state }",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M33",
        "text": "M33 judges source settlement against the clock origin instead of its start; kernel/deadlines.qnt due makes the same origin mistake when registering the deadline. The model expires during advance while the native faults reject at settlement. After policy waits 100 ms, a source taking 9 ms of its 10 ms budget and the subsequent local hit must both return VALUE_ONE. The final caller outcomes distinguish the shared consequence.",
        "evidence": {
          "history": "source-budgets/heldPolicyDoesNotSpendSourceBudgetTest",
          "step": 7,
          "fields": [
            "o.calls"
          ]
        }
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "heldPolicyDoesNotSpendSourceBudgetTest",
        "model": "formal/dialcache-source-budgets-conformance.qnt",
        "failure": "s.o.calls == List(VALUE_ONE, VALUE_ONE) and s.o.loaders == 1",
        "family": "source-budget-starts-with-source",
        "profiles": [
          "formal/dialcache-source-connection.qnt",
          "effects",
          "recovery",
          "shadow",
          "independent",
          "shadow-layers",
          "source-budgets",
          "dark-layers",
          "admission",
          "shadow-read-deadlines"
        ],
        "exclusions": {
          "scope": "Request-only sources have no deadline or elapsed clock; diagnostics imports the deadline module without invoking its registration transition. All 14 named runs and all six scheduled invariants pass with the wrong-origin fault at 2000 samples by 40 steps."
        }
      }
    },
    {
      "id": "profile-source-wrong-owner",
      "contract": "C24",
      "source": "formal/kernel/flights.qnt",
      "model": "formal/dialcache-source-connection.qnt",
      "invariant": "sourceOwnersMatchContract",
      "before": "owners: state.owners.replaceAt(caller, index),",
      "after": "owners: state.owners.replaceAt(caller, 0),",
      "nativeMutants": {
        "kind": "model-only",
        "text": "The fault rewrites kernel/flights.qnt registerSource to record every source-starting caller as the owner of source 0, so finish (finishOwnedCalls and ownedBy) never completes a caller from the source it started; the connection monitor sourceOwnersMatchContract checks this bookkeeping against a reference captured at start. Neither port has an owners table: the starter awaits the promise its own run returned (TypeScript typescript/src/dialcache.ts singleFlightProcess and singleFlightRequestLocal) or its own goroutine result (Go go/engine.go singleFlight), and followers await the flight they looked up by key, so a caller cannot be bound to any source other than the one it started or joined. A wrong-key lookup is the C11 identity fault (M20), not this one."
      },
      "reproducer": {
        "kind": "model-run",
        "run": "outsideSourcesKeepDistinctOwnersTest",
        "failure": "sourceOwnersMatchContract and observedSources.length() == 2",
        "family": "source-owner-receipt",
        "profiles": [
          "formal/dialcache-source-connection.qnt",
          "effects",
          "recovery",
          "policy",
          "shadow",
          "scope",
          "admission",
          "layers",
          "independent",
          "recovery-read",
          "local-failure",
          "runtime-boundaries",
          "shadow-layers",
          "local-clock",
          "source-budgets",
          "dark-layers",
          "shadow-read-deadlines"
        ],
        "exclusions": {},
        "scope": "Two outside callers start distinct sources. The connection monitor captures each caller from the external admission count and rejects an owners-table rewrite at the second source. This checks model bookkeeping only: native callers await their own source promise or goroutine result, with no owners table to mutate."
      }
    },
    {
      "id": "profile-recovery-wrong-snapshot",
      "contract": "C44",
      "source": "formal/kernel/recovery.qnt",
      "model": "formal/dialcache-recovery-read-connection.qnt",
      "invariant": "retainedSnapshotMatchesAcquisition",
      "before": "created: Contract::retainedFrameStamp(created, Clock::wallOf(state)),",
      "after": "created: Contract::retainedFrameStamp(created, Clock::wallOf(state)) + 1,",
      "reproducer": {
        "kind": "exported-regression",
        "run": "compressedRecoveryRechecksMaximumAfterDecodeTest",
        "model": "formal/dialcache-recovery-read-conformance.qnt",
        "failure": "s.o.calls == List(SOURCE_ERROR) and s.io.sourceErrors == List(1) and s.o.recovery == List(\"miss\") and s.o.dumps == 0 and s.o.writes == 0",
        "family": "wrong-snapshot-stamp",
        "profiles": [
          "formal/dialcache-recovery-read-connection.qnt",
          "recovery-read",
          "independent",
          "recovery"
        ],
        "exclusions": {
          "effects": "Classifier NONE: no snapshot is retained, so the mutated candidate retention is never executed.",
          "shadow": "Composes remote_io with Recovery::NONE and no caller read: no snapshot is ever retained and no recovery decode is held.",
          "admission": "Passes Recovery::NONE at every read settlement, so no snapshot is retained and no recovery decode is held; the mutated text is never executed.",
          "shadow-layers": "Composes recovery on the atomic path, but its guard excludes every stale candidate, so no snapshot holds a candidate and neither its stamp nor its maximum is ever consulted.",
          "scope": "Composes the request-only projection, which has no remote layer and dispatches no held read.",
          "source-budgets": "Composes the local projection, which has no remote layer and dispatches no held read.",
          "dark-layers": "Remote serving is always off and no caller retains a recovery candidate; dark C0 bytes belong to the shadow job, not a recovery snapshot.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M43",
        "text": "M43 is the native twin of kernel/recovery.qnt retain stamping the retained candidate one millisecond after the acquired frame, checked by dialcache-recovery-read-connection.qnt retainedSnapshotMatchesAcquisition: both ports retain the stale candidate with a timestamp one millisecond later than the frame they acquired."
      }
    },
    {
      "id": "recovery-read-wrong-admission-policy",
      "contract": "C45",
      "source": "formal/kernel/remote-io.qnt",
      "model": "formal/dialcache-recovery-read-connection.qnt",
      "invariant": "retainedSnapshotMatchesAcquisition",
      "before": "holdRead(registered, state.sources.length(), effectiveTtls(judged.effective, ttls), budget)",
      "after": "holdRead(registered, state.sources.length(), { retentionMs: ttls.retentionMs + 1, ...effectiveTtls(judged.effective, ttls) }, budget)",
      "reproducer": {
        "kind": "exported-regression",
        "run": "compressedRecoveryRechecksMaximumAfterDecodeTest",
        "model": "formal/dialcache-recovery-read-conformance.qnt",
        "failure": "s.o.calls == List(SOURCE_ERROR) and s.io.sourceErrors == List(1) and s.o.recovery == List(\"miss\") and s.o.dumps == 0 and s.o.writes == 0",
        "family": "wrong-admission-policy",
        "profiles": [
          "formal/dialcache-recovery-read-connection.qnt",
          "recovery-read",
          "independent",
          "recovery",
          "effects"
        ],
        "exclusions": {
          "shadow": "Composes remote_io, but every reply leaves the remote layer off, so the caller never dispatches a read; the job's read is the shadow module's.",
          "admission": "Composes the held read dispatch, but every read serves a hit (the three keys always hold a frame fresh for the 60 s TTL inside the 600 ms bound) and Recovery::NONE retains no snapshot, so the retention the held read carries reaches only a served job's fill authority, which a served job never writes.",
          "shadow-layers": "Composes the atomic release (remote_writes), never remote_io's held read dispatch or decode, so the mutated text is never executed.",
          "scope": "Composes the request-only projection, which has no remote layer and dispatches no held read.",
          "source-budgets": "Composes the local projection, which has no remote layer and dispatches no held read.",
          "dark-layers": "Caller remote reads never start because remote serving is off; the mutated caller read-admission policy is not used by the separate held dark C0 read.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M45",
        "text": "M45 is the native twin of kernel/remote-io.qnt dispatchRead recording a recovery maximum one unit above the reply's on the held read, checked by dialcache-recovery-read-connection.qnt retainedSnapshotMatchesAcquisition: both ports admit the call with a recovery maximum one second above the configured value, one second being the smallest configurable unit."
      }
    },
    {
      "id": "independent-wrong-admission-policy",
      "contract": "C45",
      "source": "formal/kernel/remote-io.qnt",
      "model": "formal/dialcache-independent-connection.qnt",
      "invariant": "independentSnapshotsMatchAcquisition",
      "before": "holdRead(registered, state.sources.length(), effectiveTtls(judged.effective, ttls), budget)",
      "after": "holdRead(registered, state.sources.length(), { retentionMs: 2000, ...effectiveTtls(judged.effective, ttls) }, budget)",
      "reproducer": {
        "kind": "exported-regression",
        "run": "recoveryPolicyIsCapturedPerCallerTest",
        "model": "formal/dialcache-independent-conformance.qnt",
        "failure": "s.o.calls == List(VALUE_ONE, SOURCE_ERROR) and s.io.sourceErrors == List(0, 2) and s.o.recovery == List(\"served\", \"miss\")",
        "family": "wrong-admission-policy",
        "profiles": [
          "formal/dialcache-independent-connection.qnt",
          "independent",
          "recovery-read",
          "recovery",
          "effects"
        ],
        "exclusions": {
          "shadow": "Composes remote_io, but every reply leaves the remote layer off, so the caller never dispatches a read; the job's read is the shadow module's.",
          "admission": "Composes the held read dispatch, but every read serves a hit (the three keys always hold a frame fresh for the 60 s TTL inside the 600 ms bound) and Recovery::NONE retains no snapshot, so the retention the held read carries reaches only a served job's fill authority, which a served job never writes.",
          "shadow-layers": "Composes the atomic release (remote_writes), never remote_io's held read dispatch or decode, so the mutated text is never executed.",
          "scope": "Composes the request-only projection, which has no remote layer and dispatches no held read.",
          "source-budgets": "Composes the local projection, which has no remote layer and dispatches no held read.",
          "dark-layers": "Caller remote reads never start because remote serving is off; the mutated caller read-admission policy is not used by the separate held dark C0 read.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M46",
        "text": "M46 is the native twin of kernel/remote-io.qnt dispatchRead recording a fixed retention on the held read instead of the reply's effective TTLs (the maximum its snapshot is retained under): the ports have no constant to substitute for a generic policy, so admitting with the static default while ignoring the runtime overlay is the faithful analog."
      }
    },
    {
      "id": "independent-wrong-recovered-value",
      "contract": "C43",
      "source": "formal/kernel/remote-io.qnt",
      "model": "formal/dialcache-independent-connection.qnt",
      "invariant": "independentRecoveryMatchesContract",
      "before": "if (outcome.served) Payloads::valueOf(snapshot.candidate) else settled.sources.nth(held.flight).result)",
      "after": "if (outcome.served) VALUE_TWO else settled.sources.nth(held.flight).result)",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M41",
        "text": "M41 is the native twin of kernel/remote-io.qnt settleLoad returning a wrong constant instead of each retained candidate. TypeScript serves undefined and Go the zero value; the model serves VALUE_TWO to both callers. After the two independent recoveries settle, caller results must preserve the distinct acquired values even though the stored frame was replaced and invalidated.",
        "evidence": {
          "history": "independent/independentRecoveriesServeDistinctAcquiredSnapshotsTest",
          "step": 10,
          "fields": [
            "o.calls"
          ]
        }
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "independentRecoveriesServeDistinctAcquiredSnapshotsTest",
        "model": "formal/dialcache-independent-conformance.qnt",
        "failure": "s.o.calls == List(VALUE_ONE, VALUE_TWO) and s.o.recovery == List(\"served\", \"served\") and s.o.reads == 2 and s.o.loaders == 2 and s.o.loads == 2 and s.o.dumps == 0 and s.o.writes == 0",
        "family": "recovery-keeps-acquired-value",
        "profiles": [
          "formal/dialcache-independent-connection.qnt",
          "recovery",
          "independent",
          "recovery-read"
        ],
        "exclusions": {
          "effects": "Every held read settles with Recovery::NONE, so no caller retains a recovery candidate and the changed recovery-decode completion arm is unreachable.",
          "shadow": "Every reply disables caller remote serving; held C0 decodes belong to shadow jobs, and no caller retains a recovery candidate.",
          "scope": "Uses the request-only serving lifecycle, with no caller remote read or held recovery decode; it never executes RemoteIO::settleLoad.",
          "admission": "Every caller read settles with Recovery::NONE, so held caller decodes can serve fresh hits but never execute the changed recovery-completion arm.",
          "shadow-layers": "Uses the atomic caller traversal and RemoteWrites settlement, never RemoteIO::settleLoad; its guard also excludes ordinary stale caller recovery.",
          "source-budgets": "Uses the budgeted local projection, with no remote layer or held caller decode; it never executes RemoteIO::settleLoad.",
          "dark-layers": "Every reply disables caller remote serving; held C0 decodes belong to shadow jobs, and no caller retains a recovery candidate.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      }
    },
    {
      "id": "effects-wrong-acceptance-receipt",
      "contract": "C25",
      "source": "formal/kernel/metrics.qnt",
      "model": "formal/dialcache-effects-conformance.qnt",
      "invariant": "measurementsAreNonnegative",
      "before": "{ dumpStarted: loaders.dumpStarted.append(after.now), ...loaders }",
      "after": "{ dumpStarted: loaders.dumpStarted.append(after.now + 1), ...loaders }",
      "reproducer": {
        "kind": "exported-regression",
        "run": "sourceDurationExcludesPublicationTest",
        "failure": "amounts(\"fallback\") == List(0) and amounts(\"serialization\") == List(10)",
        "family": "measurement-receipt",
        "profiles": [
          "effects"
        ],
        "exclusions": {}
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M36",
        "text": "M36 is the native twin of kernel/metrics.qnt stamping the dump's hold one millisecond late: the serialization-start stamp both ports take one millisecond late is the only native acceptance receipt, and the dump duration comes out one millisecond short.",
        "evidence": {
          "history": "effects/sourceDurationExcludesPublicationTest",
          "step": 7,
          "fields": [
            "events"
          ]
        }
      }
    },
    {
      "id": "recovery-strands-followers",
      "contract": "C24",
      "source": "formal/kernel/serving.qnt",
      "model": "formal/dialcache-recovery-conformance.qnt",
      "invariant": "pendingCallersOwnActiveFlights",
      "before": "o: { calls: finishOwnedCalls(state.o.calls, state.owners, index, value), ...state.o },",
      "after": "o: { calls: state.o.calls.indices().fold(state.o.calls, (out, c) => if (state.owners.nth(c) == index and c == Flights::ownedBy(state, index).fold(state.owners.length(), (m, x) => if (x < m) x else m)) out.replaceAt(c, value) else out), ...state.o },",
      "reproducer": {
        "kind": "exported-regression",
        "run": "crossRequestRecoveryMemoizesBothScopesTest",
        "failure": "s.memo == List(VALUE_ONE, VALUE_ONE) and s.o.calls == List(VALUE_ONE, VALUE_ONE, VALUE_ONE) and s.d.coalesced == List(\"process\", \"request_local\") and s.o.loads == 1",
        "family": "stranded-followers",
        "profiles": [
          "recovery",
          "layers",
          "policy",
          "scope",
          "runtime-boundaries",
          "source-budgets",
          "admission",
          "effects",
          "dark-layers"
        ],
        "exclusions": {
          "independent": "Coalescing is off in every reply: every flight has one owner, so completing the first owner completes them all.",
          "recovery-read": "One execution at a time: no follower ever joins a flight, so every flight has one owner.",
          "shadow-layers": "Coalescing is off in every reply: every flight has one owner.",
          "shadow": "Coalescing is off and one caller runs at a time: every flight has one owner.",
          "local-failure": "Composes serving.complete through local_faults.settle, but admits one source at a time (no call begins while a source is pending), so every flight has one owner and the mutant's minimum-owner fold finishes the same call.",
          "local-clock": "Composes serving.complete through serving.callLocal, whose inline source settles in the step that starts it, so no flight ever gains a second owner and the mutant's minimum-owner fold finishes the same call.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M34",
        "text": "M34 is the native twin of kernel/serving.qnt complete finishing only the flight's first owner instead of every caller it owns: both ports stop followers of a joined flight from receiving the accepted value while errors still propagate. Followers get an undefined or zero value rather than staying pending because a blocked follower would deadlock synctest."
      }
    },
    {
      "id": "independent-source-wrong-clock",
      "contract": "C23",
      "source": "formal/kernel/deadlines.qnt",
      "model": "formal/dialcache-independent-connection.qnt",
      "invariant": "independentSourceOriginsMatchContract",
      "before": "at: state.now + budget }), ...state }",
      "after": "at: budget }), ...state }",
      "measures": "Repeats the profile-source-wrong-clock fault against the independent connection: the same deadline mutation, reached through the held read and loader deadlines instead of the local source list, must also be caught by that monitor's origins clause.",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M33",
        "text": "M33 judges a source settlement against the clock origin instead of the source start. kernel/deadlines.qnt due makes the same origin mistake when registering a deadline; independentSourceOriginsMatchContract independently checks held-read/loader origins. The shared held-policy history exposes the consequence: a source starting after 100 ms keeps its full 10 ms budget and both callers return its accepted value.",
        "evidence": {
          "history": "source-budgets/heldPolicyDoesNotSpendSourceBudgetTest",
          "step": 7,
          "fields": [
            "o.calls"
          ]
        }
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "heldPolicyDoesNotSpendSourceBudgetTest",
        "model": "formal/dialcache-source-budgets-conformance.qnt",
        "failure": "s.o.calls == List(VALUE_ONE, VALUE_ONE) and s.o.loaders == 1",
        "family": "source-budget-starts-with-source",
        "profiles": [
          "formal/dialcache-independent-connection.qnt",
          "effects",
          "recovery",
          "shadow",
          "independent",
          "shadow-layers",
          "source-budgets",
          "dark-layers",
          "admission",
          "shadow-read-deadlines"
        ],
        "exclusions": {
          "scope": "Request-only sources have no deadline or elapsed clock; diagnostics imports the deadline module without invoking its registration transition. All 14 named runs and all six scheduled invariants pass with the wrong-origin fault at 2000 samples by 40 steps."
        }
      }
    },
    {
      "id": "independent-source-wrong-owner",
      "contract": "C24",
      "source": "formal/kernel/flights.qnt",
      "model": "formal/dialcache-independent-connection.qnt",
      "invariant": "independentSourceOriginsMatchContract",
      "before": "owners: state.owners.replaceAt(caller, index),",
      "after": "owners: state.owners.replaceAt(caller, 0),",
      "measures": "Repeats the profile-source-wrong-owner fault against the independent connection: the same registry mutation, reached through remote_io's read dispatch instead of the local release, must also be caught by that monitor's origins clause.",
      "nativeMutants": {
        "kind": "model-only",
        "text": "The fault rewrites kernel/flights.qnt registerSource to record every caller as the owner of flight 0, so the flight a caller's own read dispatched never completes it and flight 0 completes every caller; the connection monitor independentSourceOriginsMatchContract finds no owner for any other flight's loader. With coalesce false each port caller awaits the promise or goroutine of the source it started itself (TypeScript typescript/src/dialcache.ts finishRedisChain through callFallback and withFallbackTimeout; Go go/engine.go execution.source returning into GetOrLoad), so no registry exists that could route a settlement to another caller."
      },
      "reproducer": {
        "kind": "model-run",
        "run": "independentReadSourcesKeepDistinctOwnersTest",
        "failure": "independentSourceOriginsMatchContract and profile::s.o.loaders == 2",
        "family": "source-owner-receipt",
        "profiles": [
          "formal/dialcache-independent-connection.qnt",
          "effects",
          "recovery",
          "policy",
          "shadow",
          "scope",
          "admission",
          "layers",
          "independent",
          "recovery-read",
          "local-failure",
          "runtime-boundaries",
          "shadow-layers",
          "local-clock",
          "source-budgets",
          "dark-layers",
          "shadow-read-deadlines"
        ],
        "exclusions": {},
        "scope": "Two independent held reads start distinct loaders. The unchanged connection property rejects the second loader having no caller in the mutated ownership registry. Both ports return each independent source into its own caller without such a registry; this reproducer checks the model monitor, not a native wrong-key fault."
      }
    },
    {
      "id": "tracked-read-inclusive-fence",
      "contract": "C33",
      "source": "formal/cache-rules.qnt",
      "model": "formal/dialcache-tracked-invalidation.qnt",
      "invariant": "servedSnapshotClearedObservedFence",
      "before": "pure def fenceAllows(created: int, watermark: int): bool = created > watermark",
      "after": "pure def fenceAllows(created: int, watermark: int): bool = created >= watermark",
      "measures": "Repeats the fence-inclusive-timestamp fault against tracked-invalidation: the same shared-rule mutation must also be caught by that model's own invariant.",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M06",
        "text": "M06 makes the tracked native decoder accept a frame stamped exactly at its watermark. The shared model fenceAllows edit also changes fill-side checks; frameAtTheWatermarkIsFencedFromTheDarkReadTest isolates the read boundary through dumps and loads and completes in both mutated ports."
      },
      "reproducer": {
        "kind": "exported-regression",
        "model": "formal/dialcache-dark-layers-conformance.qnt",
        "run": "frameAtTheWatermarkIsFencedFromTheDarkReadTest",
        "failure": "s.o.calls == List(VALUE_TWO) and s.o.dumps == 1 and s.o.loads == 0",
        "family": "strict-read-fence",
        "profiles": [
          "formal/dialcache-tracked-invalidation.qnt",
          "layers",
          "independent",
          "recovery-read",
          "dark-layers"
        ],
        "exclusions": {
          "effects": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "recovery": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "policy": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "shadow": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "scope": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "admission": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "local-failure": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "runtime-boundaries": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "shadow-layers": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "local-clock": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "source-budgets": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after changing the shared strict read/write fence to an inclusive comparison. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      }
    },
    {
      "id": "policy-inclusive-remote-freshness",
      "contract": "C22",
      "source": "formal/kernel/remote-frames.qnt",
      "model": "formal/dialcache-policy-conformance.qnt",
      "invariant": "remoteHitsRespectAcquiredFreshness",
      "before": "freshAgeAllowed(state.created.nth(key), Clock::wallOf(state), freshMs)",
      "after": "state.created.nth(key) <= Clock::wallOf(state) and Clock::wallOf(state) - state.created.nth(key) <= freshMs",
      "reproducer": {
        "kind": "exported-regression",
        "run": "exactRemoteFreshBoundaryStartsSourceTest",
        "failure": "s.o.calls == List(VALUE_ONE, CALL_PENDING) and s.o.loaders == 2 and s.o.loads == 0 and s.expires.nth(0) == DEFAULT_RETENTION_MS",
        "family": "inclusive-freshness-boundary",
        "profiles": [
          "policy",
          "independent",
          "recovery-read",
          "shadow-layers",
          "recovery",
          "shadow",
          "dark-layers"
        ],
        "exclusions": {
          "effects": "Frames are stamped at the wall clock and read within 600 ms under a 60 s freshness, so no read meets the freshness boundary.",
          "admission": "Composes the remote freshness judgment, but every frame is stamped at a wall clock that only advances and is read within 600 ms under a 60 s freshness, so no read meets an age boundary or observes a future stamp.",
          "local-failure": "Composes the remote freshness judgment, but its wall clock never moves and every frame is stamped at the current instant, so a frame's age is always 0 and never meets the fresh boundary.",
          "local-clock": "Composes the local projection with no remote layer, so the freshness judgment is never executed.",
          "scope": "Composes the request-only projection, which never reads a remote frame.",
          "source-budgets": "Composes the local projection, which never reads a remote frame.",
          "layers": "Composes remote frames, but its 60 s freshness is never reached within the bound of 1 ms ticks.",
          "runtime-boundaries": "Composes remote frames, but no input advances the clock, so no frame ages to its freshness boundary.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M30",
        "text": "M30 is the native twin of kernel/remote-frames.qnt fresh replacing freshAgeAllowed with an inclusive age comparison: both ports serve a remote frame whose age equals the fresh TTL as a hit. Without stale-on-error retention the maximum-age check runs first and masks the flip, as the model's retained masks it when retention equals freshness."
      }
    },
    {
      "id": "shadow-inclusive-c0-freshness",
      "contract": "C22",
      "source": "formal/kernel/shadow.qnt",
      "model": "formal/dialcache-shadow-conformance.qnt",
      "invariant": "c0AcquisitionsRespectFreshness",
      "before": "pure def acquired(observed: Remote::Observed): int = if (observed.value > NO_VALUE) observed.payload else NO_VALUE",
      "after": "pure def acquired(observed: Remote::Observed): int = observed.payload",
      "reproducer": {
        "kind": "exported-regression",
        "run": "expiredC0BeginsFillBeforePublicationTest",
        "failure": "s.o.calls == List(VALUE_TWO, VALUE_TWO) and s.o.loads == 1 and s.o.dumps == 1",
        "family": "inclusive-freshness-boundary",
        "profiles": [
          "shadow",
          "shadow-layers",
          "dark-layers"
        ],
        "exclusions": {
          "admission": "Every reply enables the remote layer, so no dark C0 read is made and the mutated acquisition is never applied.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M31",
        "text": "M31 is the native twin of kernel/shadow.qnt acquired keeping a dark C0 from a visible frame remote_frames.observe declined for the reply's freshness: both ports acquire a dark C0 frame whose age equals the fresh TTL instead of treating it as expired."
      }
    },
    {
      "id": "core-unhealthy-local-read-hits",
      "contract": "C27",
      "source": "formal/dialcache-core.qnt",
      "model": "formal/dialcache-core.qnt",
      "invariant": "failedLocalReadSkipsReuseAndPublication",
      "before": "val localHit = localReadEligible and s.localHasValue",
      "after": "val localHit = s.callLocal and s.localHasValue",
      "nativeMutants": {
        "kind": "model-only",
        "text": "The core model keeps localHasValue apart from the environment flag localReadHealthy, so the fault in dialcache-core.qnt localHit serves a value through a read the environment declared failed. In both ports the failed read is the harness seam and yields no value: TypeScript spies LocalCache.prototype.getWithResolvedConfig in typescript/test/formal/behavior-driver.ts and throws before delegation, so DialCache.readLocalWithResolvedConfig in typescript/src/dialcache.ts returns a disabled result with reason config_error; Go panics in behaviorLocalFaultClock.ElapsedMS (go/behavior_driver_test.go) inside Cache.localGet (go/cache.go) and callSafely returns the zero localResult. No decision point could return the stored value from a failed read; a Go-only bypass of the seam has no TypeScript twin and would test the harness. Moving either seam must re-trigger this review."
      },
      "reproducer": {
        "kind": "model-run",
        "run": "failedLocalReadCannotServePreviouslyStoredValueTest",
        "failure": "s.localHasValue and s.phase == RemoteLookup and s.origin == NoResult and s.localReads == 1 and failedLocalReadSkipsReuseAndPublication",
        "family": "unhealthy-read-served",
        "profiles": [
          "formal/dialcache-core.qnt"
        ],
        "exclusions": {},
        "scope": "The run first populates local storage, then fails the next read and stops at its lookup decision. The independent property rejects serving that retained model value through a failed read. Native fault seams throw or panic before returning an entry, so there is no native value-selection decision to mutate at this boundary."
      }
    },
    {
      "id": "core-tracked-fallback-warms-local",
      "contract": "C31",
      "source": "formal/cache-rules.qnt",
      "model": "formal/dialcache-core.qnt",
      "invariant": "trackedRemoteFallbackSuppressesLocalPublication",
      "before": "pure def sourceMayWarmLocal(tracked: bool, readRemote: bool): bool =\n    not(tracked and readRemote)",
      "after": "pure def sourceMayWarmLocal(tracked: bool, readRemote: bool): bool =\n    true",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M10",
        "text": "M10 allows a tracked source refill to warm local storage before a validating remote read. sourceMayWarmLocal is the original core publication condition shared with kernel authority; the original trackedRemoteFallbackSuppressesLocalPublication property stays independent. The second public read distinguishes reuse through local versus validated Redis.",
        "evidence": {
          "history": "layers/trackedRefillIsReadAgainBeforeLocalReuseTest",
          "step": 3,
          "fields": [
            "o.reads"
          ]
        }
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "trackedRefillIsReadAgainBeforeLocalReuseTest",
        "model": "formal/dialcache-layers-conformance.qnt",
        "failure": "s.o.calls == List(VALUE_ONE, VALUE_ONE) and s.o.reads == 2 and s.o.loaders == 1",
        "family": "tracked-source-publication-authority",
        "profiles": [
          "formal/dialcache-core.qnt",
          "layers",
          "recovery-read"
        ],
        "exclusions": {
          "effects": "The local layer is disabled and has zero capacity, so no source can warm local storage.",
          "recovery": "The local layer is disabled and has zero capacity, so no source can warm local storage.",
          "policy": "All calls are untracked, for which the correct and faulty source publication judgments both permit local writes.",
          "shadow": "The local layer is disabled and has zero capacity, so no source can warm local storage.",
          "scope": "The request-only projection has no remote read or local storage.",
          "admission": "The local layer is disabled and has zero capacity, so no source can warm local storage.",
          "independent": "The local layer is disabled and has zero capacity, so no source can warm local storage.",
          "local-failure": "All calls are untracked, for which the correct and faulty source publication judgments both permit local writes.",
          "runtime-boundaries": "All calls are untracked, for which the correct and faulty source publication judgments both permit local writes.",
          "local-clock": "The local projection has no remote read, so no tracked remote miss can withhold local publication.",
          "source-budgets": "The local projection has no remote read, so no tracked remote miss can withhold local publication.",
          "dark-layers": "Foreground remote serving is always off, so source local publication is permitted by both judgments.",
          "shadow-layers": "Dark sources may publish locally because remote serving is off. Its scheduled histories and properties do not detect the changed foreground tracked publication authority; layers and recovery-read supply that boundary.",
          "shadow-read-deadlines": "All six scheduled histories and six invariants pass under this shared fault at 2000 samples by 40 steps. No scheduled assertion distinguishes direct local publication after a tracked source refill in this bounded read-deadline profile; the imported rule alone does not establish detection."
        }
      }
    },
    {
      "id": "runtime-policy-coalesce-defaults-off",
      "contract": "C17",
      "source": "formal/cache-rules.qnt",
      "model": "formal/dialcache-runtime-policy.qnt",
      "invariant": "featureLibraryDefaults",
      "before": "pure val libraryCoalescingDefault = true",
      "after": "pure val libraryCoalescingDefault = false",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M28",
        "text": "M28 treats an omitted static coalesce leaf as false. The verifier resolver and runtime fixture default normalization both consume libraryCoalescingDefault; featureLibraryDefaults still independently requires the true default. The public history observes both callers joined to the same source.",
        "evidence": {
          "history": "runtime-boundaries/omittedRampAndSharingUseLibraryDefaultsTest",
          "step": 7,
          "fields": [
            "o.calls"
          ]
        }
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "omittedRampAndSharingUseLibraryDefaultsTest",
        "model": "formal/dialcache-runtime-boundaries-conformance.qnt",
        "failure": "s.o.calls == List(VALUE_ONE, VALUE_ONE, VALUE_ONE) and s.o.loaders == 1\n      and s.o.reads == 2 and s.o.loads == 1 and s.o.writeTtls == List(TTL_MS)\n      and s.o.shadow == List() and s.o.recovery == List()",
        "family": "omitted-sharing-default",
        "profiles": [
          "formal/dialcache-runtime-policy.qnt",
          "runtime-boundaries"
        ],
        "exclusions": {
          "effects": "The profile supplies an explicit sharing policy and never resolves an omitted coalesce leaf through libraryCoalescingDefault. The omitted-default connection belongs to runtime-boundaries.",
          "recovery": "The profile supplies an explicit sharing policy and never resolves an omitted coalesce leaf through libraryCoalescingDefault. The omitted-default connection belongs to runtime-boundaries.",
          "policy": "The profile supplies an explicit sharing policy and never resolves an omitted coalesce leaf through libraryCoalescingDefault. The omitted-default connection belongs to runtime-boundaries.",
          "shadow": "The profile supplies an explicit sharing policy and never resolves an omitted coalesce leaf through libraryCoalescingDefault. The omitted-default connection belongs to runtime-boundaries.",
          "scope": "The profile supplies an explicit sharing policy and never resolves an omitted coalesce leaf through libraryCoalescingDefault. The omitted-default connection belongs to runtime-boundaries.",
          "admission": "The profile supplies an explicit sharing policy and never resolves an omitted coalesce leaf through libraryCoalescingDefault. The omitted-default connection belongs to runtime-boundaries.",
          "layers": "The profile supplies an explicit sharing policy and never resolves an omitted coalesce leaf through libraryCoalescingDefault. The omitted-default connection belongs to runtime-boundaries.",
          "independent": "The profile supplies an explicit sharing policy and never resolves an omitted coalesce leaf through libraryCoalescingDefault. The omitted-default connection belongs to runtime-boundaries.",
          "recovery-read": "The profile supplies an explicit sharing policy and never resolves an omitted coalesce leaf through libraryCoalescingDefault. The omitted-default connection belongs to runtime-boundaries.",
          "local-failure": "The profile supplies an explicit sharing policy and never resolves an omitted coalesce leaf through libraryCoalescingDefault. The omitted-default connection belongs to runtime-boundaries.",
          "shadow-layers": "The profile supplies an explicit sharing policy and never resolves an omitted coalesce leaf through libraryCoalescingDefault. The omitted-default connection belongs to runtime-boundaries.",
          "local-clock": "The profile supplies an explicit sharing policy and never resolves an omitted coalesce leaf through libraryCoalescingDefault. The omitted-default connection belongs to runtime-boundaries.",
          "source-budgets": "The profile supplies an explicit sharing policy and never resolves an omitted coalesce leaf through libraryCoalescingDefault. The omitted-default connection belongs to runtime-boundaries.",
          "dark-layers": "The profile supplies an explicit sharing policy and never resolves an omitted coalesce leaf through libraryCoalescingDefault. The omitted-default connection belongs to runtime-boundaries.",
          "shadow-read-deadlines": "All six scheduled histories and six invariants pass under this shared fault at 2000 samples by 40 steps. No scheduled assertion distinguishes the inherited library coalescing default in this bounded read-deadline profile; the imported rule alone does not establish detection."
        }
      }
    },
    {
      "id": "runtime-policy-physical-ttl-ignores-recovery",
      "contract": "C22",
      "source": "formal/cache-rules.qnt",
      "model": "formal/dialcache-runtime-policy.qnt",
      "invariant": "existingRemoteEntryKeepsPhysicalTtl",
      "before": "pure def remoteRetentionFor(fresh: int, recovery: int): int =\n    if (recovery > fresh) recovery else fresh",
      "after": "pure def remoteRetentionFor(fresh: int, recovery: int): int =\n    fresh",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M32",
        "text": "M32 retains remote frames only for freshness, discarding a larger recovery maximum. remoteRetentionFor is shared by verifier insertion and the portable policy resolver; existingRemoteEntryKeepsPhysicalTtl still independently compares the captured policy. The public history observes the actual per-source write TTLs.",
        "evidence": {
          "history": "policy/eachSourceKeepsPublicationPolicyTest",
          "step": 7,
          "fields": [
            "o.writeTtls"
          ]
        }
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "eachSourceKeepsPublicationPolicyTest",
        "model": "formal/dialcache-policy-conformance.qnt",
        "failure": "s.o.writeTtls == List(FOUR_SECONDS_MS, DEFAULT_RETENTION_MS) and s.remoteValues == List(1, 0)",
        "family": "captured-physical-retention",
        "profiles": [
          "formal/dialcache-runtime-policy.qnt",
          "policy"
        ],
        "exclusions": {
          "effects": "The profile supplies retention directly and does not derive it through policy-overlay resolved retention. The captured maximum-of-freshness-and-recovery judgment is exercised by policy.",
          "recovery": "The profile supplies retention directly and does not derive it through policy-overlay resolved retention. The captured maximum-of-freshness-and-recovery judgment is exercised by policy.",
          "shadow": "The profile supplies retention directly and does not derive it through policy-overlay resolved retention. The captured maximum-of-freshness-and-recovery judgment is exercised by policy.",
          "scope": "The profile supplies retention directly and does not derive it through policy-overlay resolved retention. The captured maximum-of-freshness-and-recovery judgment is exercised by policy.",
          "admission": "The profile supplies retention directly and does not derive it through policy-overlay resolved retention. The captured maximum-of-freshness-and-recovery judgment is exercised by policy.",
          "layers": "The profile supplies retention directly and does not derive it through policy-overlay resolved retention. The captured maximum-of-freshness-and-recovery judgment is exercised by policy.",
          "independent": "The profile supplies retention directly and does not derive it through policy-overlay resolved retention. The captured maximum-of-freshness-and-recovery judgment is exercised by policy.",
          "recovery-read": "The profile supplies retention directly and does not derive it through policy-overlay resolved retention. The captured maximum-of-freshness-and-recovery judgment is exercised by policy.",
          "local-failure": "The profile supplies retention directly and does not derive it through policy-overlay resolved retention. The captured maximum-of-freshness-and-recovery judgment is exercised by policy.",
          "runtime-boundaries": "The profile supplies retention directly and does not derive it through policy-overlay resolved retention. The captured maximum-of-freshness-and-recovery judgment is exercised by policy.",
          "shadow-layers": "The profile supplies retention directly and does not derive it through policy-overlay resolved retention. The captured maximum-of-freshness-and-recovery judgment is exercised by policy.",
          "local-clock": "The profile supplies retention directly and does not derive it through policy-overlay resolved retention. The captured maximum-of-freshness-and-recovery judgment is exercised by policy.",
          "source-budgets": "The profile supplies retention directly and does not derive it through policy-overlay resolved retention. The captured maximum-of-freshness-and-recovery judgment is exercised by policy.",
          "dark-layers": "The profile supplies retention directly and does not derive it through policy-overlay resolved retention. The captured maximum-of-freshness-and-recovery judgment is exercised by policy.",
          "shadow-read-deadlines": "All six scheduled histories and six invariants pass under this shared fault at 2000 samples by 40 steps. No scheduled assertion distinguishes physical retention beyond the fresh lifetime for recovery in this bounded read-deadline profile; the imported rule alone does not establish detection."
        }
      }
    },
    {
      "id": "stale-recovery-inclusive-served-maximum",
      "contract": "C45",
      "source": "formal/cache-rules.qnt",
      "model": "formal/dialcache-stale-recovery.qnt",
      "invariant": "servedStaleIsStrictlyWithinMaxAge",
      "before": "pure def retainedCandidateAgeAllowed(created: int, observed: int, maximum: int): bool =\n    recoveryAgeAllowed(created, observed, maximum)",
      "after": "pure def retainedCandidateAgeAllowed(created: int, observed: int, maximum: int): bool =\n    recoveryAgeAllowed(created, observed, maximum + 1)",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M01",
        "text": "M01 serves a retained candidate at its exclusive maximum. The original verifier call-site judgment now lives in retainedCandidateAgeAllowed, also used at kernel recovery failure/decode settlement. servedStaleIsStrictlyWithinMaxAge remains independent; both ports must reject the same decoded candidate at equality."
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "maximumAgeAfterDecodeFromStrictlyStaleFrameTest",
        "model": "formal/dialcache-recovery-conformance.qnt",
        "failure": "s.o.calls == List(SOURCE_ERROR) and s.o.loads == 1 and s.o.recovery == List(\"miss\") and s.d.ages == List() and s.o.writes == 0",
        "family": "retained-recovery-maximum",
        "profiles": [
          "formal/dialcache-stale-recovery.qnt",
          "recovery",
          "recovery-read",
          "independent"
        ],
        "exclusions": {
          "effects": "Classifier NONE: no snapshot is retained, so the mutated retained-candidate judgment is never executed.",
          "policy": "Composes the atomic layered release (serving.release), which observes the remote frame at release and never dispatches a held read through remote_io.",
          "shadow": "Composes remote_io with Recovery::NONE and no caller read: no snapshot is ever retained and no recovery decode is held.",
          "scope": "Composes the request-only projection, which has no remote layer and dispatches no held read.",
          "admission": "Passes Recovery::NONE at every read settlement, so no snapshot is retained and no recovery decode is held; the mutated text is never executed.",
          "layers": "Composes the atomic layered release (serving.release), which observes the remote frame at release and never dispatches a held read through remote_io.",
          "local-failure": "Composes the layered traversal without the recovery module (no stale-on-error snapshot is retained), so the mutated retained-candidate judgment is never executed.",
          "runtime-boundaries": "Composes the atomic layered release (serving.release), which observes the remote frame at release and never dispatches a held read through remote_io.",
          "shadow-layers": "Composes recovery on the atomic path, but its guard excludes every stale candidate, so no snapshot holds a candidate and neither its stamp nor its maximum is ever consulted.",
          "local-clock": "Composes the local projection without the recovery module, so the mutated retained-candidate judgment is never executed.",
          "source-budgets": "Composes the local projection, which has no remote layer and dispatches no held read.",
          "dark-layers": "Remote serving is always off and no caller retains a recovery candidate; dark C0 bytes belong to the shadow job, not a recovery snapshot.",
          "shadow-read-deadlines": "All six scheduled histories and six invariants pass under this shared fault at 2000 samples by 40 steps. No scheduled assertion distinguishes serving a retained recovery candidate at maximum-age equality in this bounded read-deadline profile; the imported rule alone does not establish detection."
        }
      }
    },
    {
      "id": "stale-recovery-candidate-stamped-at-read",
      "contract": "C44",
      "source": "formal/cache-contract.qnt",
      "model": "formal/dialcache-stale-recovery.qnt",
      "invariant": "retainedCandidateWasEligible",
      "before": "pure def retainedFrameStamp(frameCreated: int, readAt: int): int = frameCreated",
      "after": "pure def retainedFrameStamp(frameCreated: int, readAt: int): int = readAt",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M44",
        "text": "M44 replaces the retained frame creation stamp with its acquisition clock. retainedFrameStamp is shared by the original verifier transition and kernel retention. The original retainedCandidateWasEligible property keeps the independent read receipt; the public decode history distinguishes an expired candidate from a restamped one.",
        "evidence": {
          "history": "recovery-read/compressedRecoveryRechecksMaximumAfterDecodeTest",
          "step": 6,
          "fields": [
            "o.calls"
          ]
        }
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "compressedRecoveryRechecksMaximumAfterDecodeTest",
        "model": "formal/dialcache-recovery-read-conformance.qnt",
        "failure": "s.o.calls == List(SOURCE_ERROR) and s.io.sourceErrors == List(1)\n      and s.o.recovery == List(\"miss\") and s.o.dumps == 0 and s.o.writes == 0",
        "family": "retained-frame-stamp",
        "profiles": [
          "formal/dialcache-stale-recovery.qnt",
          "recovery-read",
          "recovery",
          "independent"
        ],
        "exclusions": {
          "effects": "Classifier NONE: no snapshot is retained, so the mutated retained-candidate judgment is never executed.",
          "shadow": "Composes remote_io with Recovery::NONE and no caller read: no snapshot is ever retained and no recovery decode is held.",
          "scope": "Composes the request-only projection, which has no remote layer and dispatches no held read.",
          "admission": "Passes Recovery::NONE at every read settlement, so no snapshot is retained and no recovery decode is held; the mutated text is never executed.",
          "shadow-layers": "Composes recovery on the atomic path, but its guard excludes every stale candidate, so no snapshot holds a candidate and neither its stamp nor its maximum is ever consulted.",
          "source-budgets": "Composes the local projection, which has no remote layer and dispatches no held read.",
          "dark-layers": "Remote serving is always off and no caller retains a recovery candidate; dark C0 bytes belong to the shadow job, not a recovery snapshot.",
          "shadow-read-deadlines": "All six scheduled histories and six invariants pass under this shared fault at 2000 samples by 40 steps. No scheduled assertion distinguishes preserving the original frame timestamp in a retained recovery candidate in this bounded read-deadline profile; the imported rule alone does not establish detection."
        }
      }
    },
    {
      "id": "shadow-fenced-fill-writes",
      "contract": "C53",
      "source": "formal/kernel/remote-writes.qnt",
      "model": "formal/dialcache-shadow-conformance.qnt",
      "invariant": "fillsClearTheirFence",
      "before": "if (not(Remote::writeAllowed(state, held.fence))) dropped",
      "after": "if (false) dropped",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M04",
        "text": "M04 is the native twin of kernel/remote-writes.qnt dispatch skipping the fence recheck at dump release: both ports skip the post-serialization fence recheck in the write routine the shadow fill also uses, so a fenced dark fill writes and reports filled instead of fill_fenced.",
        "crossContract": "M04 skips the post-serialization fence in the caller write routine (C34.second-fence); the shadow fill reaches the same line through putForShadow (TS) and putRemote (Go), so under it a fenced dark fill writes and reports filled instead of fill_fenced (witness shadow:outcome:fill_fenced)."
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "fenceRejudgedAtDumpReleaseAfterRollbackTest",
        "failure": "s.o.shadow == List(\"fill_fenced\") and s.o.writes == 0",
        "family": "fence-recheck-at-dispatch",
        "profiles": [
          "shadow",
          "effects",
          "dark-layers"
        ],
        "exclusions": {
          "admission": "Composes the held shadow lifecycle for served jobs, which always carry a C0 and never fill, so no dump is ever held and the mutated dispatch is never executed.",
          "shadow-layers": "Composes remote_writes::dispatch but never raises a watermark (no invalidate input), so every fence is NO_FENCE and the recheck never refuses a write.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      }
    },
    {
      "id": "shadow-fill-before-source",
      "contract": "C49",
      "source": "formal/kernel/shadow.qnt",
      "model": "formal/dialcache-shadow-conformance.qnt",
      "invariant": "fillsRequireMissAndAcceptedSource",
      "before": "if (sourceOf(waiting, job).result != CALL_PENDING) settleJobHeld(waiting, layout, source) else waiting",
      "after": "if (sourceOf(waiting, job).result != CALL_PENDING) settleJobHeld(waiting, layout, source) else fill(waiting, layout, jobOf(waiting, source))",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M47",
        "text": "M47 is the native twin of kernel/shadow.qnt settleJobRead filling at once when the job's source is still pending instead of waiting for it: both ports continue dark shadow work without waiting for the caller's source, comparing and filling with an undefined or zero value."
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "darkReadBeforeSourceWaitsForItTest",
        "failure": "s.o.calls == List(CALL_PENDING) and s.o.shadow == List() and s.o.dumps == 0 and s.o.loads == 0",
        "family": "fill-before-source",
        "profiles": [
          "shadow",
          "dark-layers",
          "shadow-read-deadlines"
        ],
        "exclusions": {
          "admission": "Composes the held shadow lifecycle for served jobs only, whose C0 is the payload the hit served: no job ever holds a C0 read, so the acquisition arm the fault mutates is never executed.",
          "shadow-layers": "Composes the atomic lifecycle: the dark C0 read is made at the release and the job waits in the registry until remote_writes::settle, so the held read settlement the fault mutates is never executed."
        }
      }
    },
    {
      "id": "redis-protocol-inclusive-fence",
      "contract": "C33",
      "source": "formal/cache-rules.qnt",
      "model": "formal/dialcache-redis-protocol.qnt",
      "invariant": "fenceCanPrecedeEncodingError",
      "before": "pure def readFenceAllows(tracked: bool, created: int, watermark: int): bool =\n    not(tracked) or fenceAllows(created, watermark)",
      "after": "pure def readFenceAllows(tracked: bool, created: int, watermark: int): bool =\n    not(tracked) or created >= watermark",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M06",
        "text": "M06 admits a frame at the tracked watermark in both codecs. The verifier classifier, generated frame decoder and behavioral remote reads consume the same readFenceAllows judgment; fenceCanPrecedeEncodingError remains independently stated in the original verifier. The exact native row matches the cited frame model run.",
        "evidence": {
          "vector": {
            "artifact": "formal/quint-frame-vectors.json",
            "group": "trackedDecodeVectors",
            "rows": {
              "typescript": "Quint frame 546 decode",
              "go": "Quint frame 546 decode"
            },
            "fields": [
              "kind",
              "reason"
            ],
            "relation": "The named run executes requestFor(546), the exact generated tracked frame row: createdAtMs and watermark are both one. Its miss classification must precede serving the frame."
          }
        }
      },
      "reproducer": {
        "kind": "model-run",
        "run": "frameAtWatermarkIsDeclinedTest",
        "failure": "result.kind == \"miss\" and result.reason == \"watermark_fenced\" and result.fence == 1",
        "family": "shared-tracked-read-fence",
        "profiles": [
          "formal/dialcache-redis-protocol.qnt",
          "formal/dialcache-frame-vectors.qnt",
          "layers",
          "independent",
          "dark-layers",
          "recovery-read"
        ],
        "exclusions": {
          "effects": "This profile does not execute the shared tracked-read fence at timestamp equality with an observable value; scheduled histories and independent properties are measured under the fault.",
          "recovery": "This profile does not execute the shared tracked-read fence at timestamp equality with an observable value; scheduled histories and independent properties are measured under the fault.",
          "policy": "This profile does not execute the shared tracked-read fence at timestamp equality with an observable value; scheduled histories and independent properties are measured under the fault.",
          "shadow": "This profile does not execute the shared tracked-read fence at timestamp equality with an observable value; scheduled histories and independent properties are measured under the fault.",
          "scope": "This profile does not execute the shared tracked-read fence at timestamp equality with an observable value; scheduled histories and independent properties are measured under the fault.",
          "admission": "This profile does not execute the shared tracked-read fence at timestamp equality with an observable value; scheduled histories and independent properties are measured under the fault.",
          "local-failure": "This profile does not execute the shared tracked-read fence at timestamp equality with an observable value; scheduled histories and independent properties are measured under the fault.",
          "runtime-boundaries": "This profile does not execute the shared tracked-read fence at timestamp equality with an observable value; scheduled histories and independent properties are measured under the fault.",
          "shadow-layers": "This profile does not execute the shared tracked-read fence at timestamp equality with an observable value; scheduled histories and independent properties are measured under the fault.",
          "local-clock": "This profile does not execute the shared tracked-read fence at timestamp equality with an observable value; scheduled histories and independent properties are measured under the fault.",
          "source-budgets": "This profile does not execute the shared tracked-read fence at timestamp equality with an observable value; scheduled histories and independent properties are measured under the fault.",
          "shadow-read-deadlines": "All six scheduled histories and six invariants pass under this shared fault at 2000 samples by 40 steps. No scheduled assertion distinguishes tracked read acceptance at watermark equality in this bounded read-deadline profile; the imported rule alone does not establish detection."
        },
        "scope": "A deterministic protocol transform exports language-neutral vector inputs rather than an asynchronous driver history. Exact generated rows have their own native input/output recording and clean baseline in both ports. The named run executes requestFor(546), the exact generated tracked frame row: createdAtMs and watermark are both one. Its miss classification must precede serving the frame.",
        "model": "formal/dialcache-frame-vectors.qnt"
      }
    },
    {
      "id": "redis-protocol-untracked-fence",
      "contract": "W04",
      "source": "formal/cache-rules.qnt",
      "model": "formal/dialcache-redis-protocol.qnt",
      "invariant": "untrackedDecodingIgnoresWatermarks",
      "before": "pure def readFenceAllows(tracked: bool, created: int, watermark: int): bool =\n    not(tracked) or fenceAllows(created, watermark)",
      "after": "pure def readFenceAllows(tracked: bool, created: int, watermark: int): bool =\n    fenceAllows(created, watermark)",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M52",
        "text": "M52 applies entity watermarks to untracked reads at read-request construction in both ports. The original verifier classifier and behavioral remote read share readFenceAllows; untrackedDecodingIgnoresWatermarks remains independent. The public history returns both untracked values after grouped invalidation.",
        "evidence": {
          "history": "layers/untrackedReadsIgnoreGroupedInvalidationTest",
          "step": 6,
          "fields": [
            "o.calls"
          ]
        }
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "untrackedReadsIgnoreGroupedInvalidationTest",
        "model": "formal/dialcache-layers-conformance.qnt",
        "failure": "s.o.calls == List(VALUE_ONE, VALUE_TWO) and s.o.loaders == 0\n      and s.o.reads == 2 and s.o.loads == 2 and s.o.invalidations == 1",
        "family": "untracked-read-ignores-fence",
        "profiles": [
          "formal/dialcache-redis-protocol.qnt",
          "layers",
          "local-failure"
        ],
        "exclusions": {
          "effects": "This profile does not execute the affected shared judgment with a distinguishing input; its scheduled histories and independent properties are measured under the same mutation.",
          "recovery": "This profile does not execute the affected shared judgment with a distinguishing input; its scheduled histories and independent properties are measured under the same mutation.",
          "policy": "This profile does not execute the affected shared judgment with a distinguishing input; its scheduled histories and independent properties are measured under the same mutation.",
          "shadow": "This profile does not execute the affected shared judgment with a distinguishing input; its scheduled histories and independent properties are measured under the same mutation.",
          "scope": "This profile does not execute the affected shared judgment with a distinguishing input; its scheduled histories and independent properties are measured under the same mutation.",
          "admission": "This profile does not execute the affected shared judgment with a distinguishing input; its scheduled histories and independent properties are measured under the same mutation.",
          "independent": "This profile does not execute the affected shared judgment with a distinguishing input; its scheduled histories and independent properties are measured under the same mutation.",
          "recovery-read": "This profile does not execute the affected shared judgment with a distinguishing input; its scheduled histories and independent properties are measured under the same mutation.",
          "runtime-boundaries": "This profile does not execute the affected shared judgment with a distinguishing input; its scheduled histories and independent properties are measured under the same mutation.",
          "shadow-layers": "This profile does not execute the affected shared judgment with a distinguishing input; its scheduled histories and independent properties are measured under the same mutation.",
          "local-clock": "This profile does not execute the affected shared judgment with a distinguishing input; its scheduled histories and independent properties are measured under the same mutation.",
          "source-budgets": "This profile does not execute the affected shared judgment with a distinguishing input; its scheduled histories and independent properties are measured under the same mutation.",
          "dark-layers": "This profile does not execute the affected shared judgment with a distinguishing input; its scheduled histories and independent properties are measured under the same mutation.",
          "shadow-read-deadlines": "All six scheduled histories and six invariants pass under this shared fault at 2000 samples by 40 steps. No scheduled assertion distinguishes ignoring a grouped watermark on an untracked read in this bounded read-deadline profile; the imported rule alone does not establish detection."
        }
      }
    },
    {
      "id": "frame-vectors-inclusive-fence",
      "contract": "C33",
      "source": "formal/dialcache-frame-vectors.qnt",
      "model": "formal/dialcache-frame-vectors.qnt",
      "invariant": "trackedHitsStrictlyClearValidFence",
      "before": "else if (request.tracked and fence >= 0 and not(readFenceAllows(request.tracked, timestamp, fence)))",
      "after": "else if (request.tracked and fence >= 0 and timestamp < fence)",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M06",
        "text": "M06 makes the tracked decode fence inclusive in both ports, the fault dialcache-frame-vectors.qnt decode inlines as a strict timestamp-below-fence test. The exported quint-frame-vectors trackedDecodeVectors are the very rows that detect M06 in both ports.",
        "evidence": {
          "vector": {
            "artifact": "formal/quint-frame-vectors.json",
            "group": "trackedDecodeVectors",
            "rows": {
              "typescript": "Quint frame 546 decode",
              "go": "Quint frame 546 decode"
            },
            "fields": [
              "kind",
              "reason"
            ],
            "relation": "The named run executes requestFor(546), the exact generated tracked frame row: createdAtMs and watermark are both one. Its miss classification must precede serving the frame."
          }
        }
      },
      "reproducer": {
        "kind": "model-run",
        "run": "frameAtWatermarkIsDeclinedTest",
        "failure": "result.kind == \"miss\" and result.reason == \"watermark_fenced\" and result.fence == 1",
        "family": "frame-fence-equality",
        "profiles": [
          "formal/dialcache-frame-vectors.qnt"
        ],
        "exclusions": {},
        "scope": "A deterministic protocol transform exports language-neutral vector inputs rather than an asynchronous driver history. Exact generated rows have their own native input/output recording and clean baseline in both ports. The named run executes requestFor(546), the exact generated tracked frame row: createdAtMs and watermark are both one. Its miss classification must precede serving the frame."
      }
    },
    {
      "id": "invalidation-transition-cutoff-moves-backwards",
      "contract": "C38",
      "source": "formal/dialcache-invalidation-transition.qnt",
      "model": "formal/dialcache-invalidation-transition.qnt",
      "invariant": "successfulCutoffIsExactMaximum",
      "before": "val cutoff = if (priorCutoff > proposed) priorCutoff else proposed",
      "after": "val cutoff = proposed",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M63",
        "text": "M63 changes the production Lua in typescript/src/internal/redis-scripts.ts and go/redis_adapter.go at the same invalidation boundary as this model fault. The generated Redis cohort executes the actual scripts, and the exact selected row records their public response and stored state.",
        "evidence": {
          "vector": {
            "artifact": "formal/quint-invalidation-vectors.json",
            "group": "vectors",
            "rows": {
              "typescript": "Quint 002: zero buffer / future finite",
              "go": "Quint 002: zero buffer / future finite"
            },
            "fields": [
              "content"
            ],
            "relation": "The named run applies case 2, exactly the generated row with an existing 10000000 cutoff and an older 1000 proposal. The returned stored cutoff must remain 10000000."
          }
        }
      },
      "reproducer": {
        "kind": "model-run",
        "run": "futureCutoffDoesNotMoveBackwardsTest",
        "failure": "s.after.value == decimalText(10000000) and s.after.ttlMs == 13659000",
        "family": "invalidation-maximum-cutoff",
        "profiles": [
          "formal/dialcache-invalidation-transition.qnt"
        ],
        "exclusions": {},
        "scope": "Atomic Redis invalidation is a deterministic protocol transition, exported as generated decimal inputs and stored-state vectors. Native workers execute production Lua against a real Redis server; expected results stay in the coordinator. The named run applies case 2, exactly the generated row with an existing 10000000 cutoff and an older 1000 proposal. The returned stored cutoff must remain 10000000."
      }
    },
    {
      "id": "invalidation-transition-inclusive-buffer-limit",
      "contract": "C39",
      "source": "formal/dialcache-invalidation-transition.qnt",
      "model": "formal/dialcache-invalidation-transition.qnt",
      "invariant": "argumentValidationIsExact",
      "before": "if (not(buffer.valid) or buffer.value > MAX_BUFFER_MS or",
      "after": "if (not(buffer.valid) or buffer.value >= MAX_BUFFER_MS or",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M64",
        "text": "M64 changes the production Lua in typescript/src/internal/redis-scripts.ts and go/redis_adapter.go at the same invalidation boundary as this model fault. The generated Redis cohort executes the actual scripts, and the exact selected row records their public response and stored state.",
        "evidence": {
          "vector": {
            "artifact": "formal/quint-invalidation-vectors.json",
            "group": "vectors",
            "rows": {
              "typescript": "Quint 036: maximum buffer / absent",
              "go": "Quint 036: maximum buffer / absent"
            },
            "fields": [
              "outcome"
            ],
            "relation": "The named run first applies case 36, exactly the generated row with the maximum 31536000000 buffer and no existing marker. The script must accept equality and install its buffered cutoff."
          }
        }
      },
      "reproducer": {
        "kind": "model-run",
        "run": "maximumBufferAndTimestampSumAreAcceptedTest",
        "failure": "s.outcome == SUCCESS and s.after.ttlMs == 31539660000",
        "family": "invalidation-maximum-buffer",
        "profiles": [
          "formal/dialcache-invalidation-transition.qnt"
        ],
        "exclusions": {},
        "scope": "Atomic Redis invalidation is a deterministic protocol transition, exported as generated decimal inputs and stored-state vectors. Native workers execute production Lua against a real Redis server; expected results stay in the coordinator. The named run first applies case 36, exactly the generated row with the maximum 31536000000 buffer and no existing marker. The script must accept equality and install its buffered cutoff."
      }
    },
    {
      "id": "key-protocol-untracked-brace-rejection",
      "contract": "W01",
      "source": "formal/dialcache-key-protocol.qnt",
      "model": "formal/dialcache-key-protocol.qnt",
      "invariant": "keyAcceptanceRespectsTextAndHashTagDomain",
      "before": "not(key.tracked) or (not(containsBrace(key.keyType)) and not(containsBrace(key.id)))",
      "after": "not(containsBrace(key.keyType)) and not(containsBrace(key.id))",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M50",
        "text": "M50 is the native twin of dialcache-key-protocol.qnt validKey dropping its untracked disjunct: both ports reject braces in keyType and id for untracked keys as well as tracked ones. quint-key-vectors 050, 052, 062, 064, 411 and 413 (untracked keys with braces expected valid) are the expected evidence in both ports.",
        "evidence": {
          "vector": {
            "artifact": "formal/quint-key-vectors.json",
            "group": "keyVectors",
            "rows": {
              "typescript": "Quint key 050: opening brace",
              "go": "Quint key 050: opening brace"
            },
            "fields": [
              "kind"
            ],
            "relation": "The named run executes inputFor(50), the exact generated untracked identity with an opening brace as keyType. Both bindings must construct that identity successfully."
          }
        }
      },
      "reproducer": {
        "kind": "model-run",
        "run": "untrackedTypeBraceRemainsValidTest",
        "failure": "s.key.valid",
        "family": "untracked-brace-acceptance",
        "profiles": [
          "formal/dialcache-key-protocol.qnt"
        ],
        "exclusions": {},
        "scope": "A deterministic protocol transform exports language-neutral vector inputs rather than an asynchronous driver history. Exact generated rows have their own native input/output recording and clean baseline in both ports. The named run executes inputFor(50), the exact generated untracked identity with an opening brace as keyType. Both bindings must construct that identity successfully."
      }
    },
    {
      "id": "cohort-inclusive-threshold",
      "contract": "W03",
      "source": "formal/cohort-boundaries.qnt",
      "model": "formal/dialcache-key-protocol.qnt",
      "invariant": "cohortNumeratorsAreUnsignedAndBoundariesStrict",
      "before": "pure def cohortAdmits(sample: int, threshold: int): bool =\n    sample < threshold",
      "after": "pure def cohortAdmits(sample: int, threshold: int): bool =\n    sample <= threshold",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M51",
        "text": "M51 is the native twin of cohort-boundaries.qnt cohortAdmits becoming inclusive: both ports admit a key whose cohort sample equals the configured ramp. The rampVectors pin hash samples, not admission, so detection is behavioral through runtime-boundaries/localCohortEqualityBypassesBeforeAboveSampleCachesTest and remoteCohortEqualityBypassesBeforeAboveSampleCachesTest, whose fixture ramps equal the driver key's FNV numerators.",
        "evidence": {
          "history": "runtime-boundaries/localCohortEqualityLeavesNoValueForLaterAdmissionTest",
          "step": 7,
          "fields": [
            "o.calls"
          ]
        }
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "localCohortEqualityLeavesNoValueForLaterAdmissionTest",
        "model": "formal/dialcache-runtime-boundaries-conformance.qnt",
        "failure": "s.o.calls == List(VALUE_ONE, CALL_PENDING) and s.o.loaders == 2",
        "family": "strict-cohort-equality",
        "profiles": [
          "formal/dialcache-key-protocol.qnt",
          "runtime-boundaries",
          "shadow-layers"
        ],
        "exclusions": {}
      }
    },
    {
      "id": "envelope-vectors-tie-compresses",
      "contract": "W07",
      "source": "formal/dialcache-envelope-vectors.qnt",
      "model": "formal/dialcache-envelope-vectors.qnt",
      "invariant": "compressionUsesByteThresholdAndStrictShrink",
      "before": "else if (codecBytes + 1 >= escaped.length()) { outcome: \"not_smaller\", ...uncompressed }",
      "after": "else if (codecBytes + 1 > escaped.length()) { outcome: \"not_smaller\", ...uncompressed }",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M55",
        "text": "M55 is the native twin of dialcache-envelope-vectors.qnt selectWrite treating a size tie as smaller: both ports store a compressed payload whose marked size ties the escaped raw size. The compressionWriteVectors tie rows, which record per-binding codec sizes, are the expected evidence in both ports.",
        "evidence": {
          "vector": {
            "artifact": "formal/quint-envelope-vectors.json",
            "group": "compressionWriteVectors",
            "rows": {
              "typescript": "Quint envelope 192 write text-size-boundary",
              "go": "Quint envelope 219 write escaped-size-boundary"
            },
            "fields": [
              "outcome",
              "marker"
            ],
            "relation": "The primary run executes requestFor(192), the TypeScript native codec tie; the independently scheduled goCompressionTieKeepsRawRepresentationTest executes requestFor(219), the Go native codec tie. Both require strict shrink against escaped raw size; codec sizes differ legitimately."
          }
        }
      },
      "reproducer": {
        "kind": "model-run",
        "run": "compressionTieKeepsRawRepresentationTest",
        "failure": "result.typescript.outcome == \"not_smaller\" and result.typescript.storedBytes == 18",
        "family": "compression-strict-shrink",
        "profiles": [
          "formal/dialcache-envelope-vectors.qnt"
        ],
        "exclusions": {},
        "scope": "A deterministic protocol transform exports language-neutral vector inputs rather than an asynchronous driver history. Exact generated rows have their own native input/output recording and clean baseline in both ports. The primary run executes requestFor(192), the TypeScript native codec tie; the independently scheduled goCompressionTieKeepsRawRepresentationTest executes requestFor(219), the Go native codec tie. Both require strict shrink against escaped raw size; codec sizes differ legitimately."
      }
    },
    {
      "id": "envelope-vectors-escape-misses-binary-marker",
      "contract": "W06",
      "source": "formal/dialcache-envelope-vectors.qnt",
      "model": "formal/dialcache-envelope-vectors.qnt",
      "invariant": "escapeConsumesExactlyOnePrefix",
      "before": "if (raw.length() > 1 and raw.nth(1) <= 2)",
      "after": "if (raw.length() > 1 and raw.nth(1) <= 1)",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M53",
        "text": "M53 is the native twin of dialcache-envelope-vectors.qnt readEnvelope lowering the escapable marker range to exclude the binary-zstd marker: both ports leave the escape prefix in place before an escaped binary-zstd marker. Envelope vectors 008, 003 and 013 are the expected evidence in both ports.",
        "evidence": {
          "vector": {
            "artifact": "formal/quint-envelope-vectors.json",
            "group": "envelopeVectors",
            "rows": {
              "typescript": "Quint envelope 008 envelope",
              "go": "Quint envelope 008 envelope"
            },
            "fields": [
              "decodedHex"
            ],
            "relation": "The named run executes requestFor(8), the exact generated byte sequence 0002. Decoding strips precisely one escape prefix and returns the literal binary marker byte02."
          }
        }
      },
      "reproducer": {
        "kind": "model-run",
        "run": "escapedBinaryMarkerRemainsLiteralTest",
        "failure": "result.read.bytes == List(2)",
        "family": "escaped-binary-marker",
        "profiles": [
          "formal/dialcache-envelope-vectors.qnt"
        ],
        "exclusions": {},
        "scope": "A deterministic protocol transform exports language-neutral vector inputs rather than an asynchronous driver history. Exact generated rows have their own native input/output recording and clean baseline in both ports. The named run executes requestFor(8), the exact generated byte sequence 0002. Decoding strips precisely one escape prefix and returns the literal binary marker byte02."
      }
    },
    {
      "id": "conformance-local-hit-returns-source",
      "contract": "C05",
      "source": "formal/dialcache-conformance.qnt",
      "model": "formal/dialcache-conformance.qnt",
      "invariant": "servedLayerValueMatchesCache",
      "before": "      lastResult: s.localValue,",
      "after": "      lastResult: s.sourceVersion,",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M17",
        "text": "M17 is the native reading of dialcache-conformance.qnt localCall recording the environment's sourceVersion as the result of a local hit: no port can read that version without invoking the loader, so the twin is a hit that returns something other than the stored value while loader counts stay unchanged. core/localValueSurvivesSourceChangeTest detects both ports in the generated cohort.",
        "evidence": {
          "history": "core/localValueSurvivesSourceChangeTest",
          "step": 3,
          "fields": [
            "lastResult"
          ]
        }
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "localValueSurvivesSourceChangeTest",
        "failure": "s.lastResult == 1 and s.localLoaderCalls == 1",
        "family": "local-hit-stored-value",
        "profiles": [
          "core"
        ],
        "exclusions": {}
      }
    },
    {
      "id": "conformance-remote-miss-skips-publication",
      "contract": "C28",
      "source": "formal/dialcache-conformance.qnt",
      "model": "formal/dialcache-conformance.qnt",
      "invariant": "servedLayerValueMatchesCache",
      "before": "      remoteLoaderCalls: s.remoteLoaderCalls + 1,\n      remoteReadable: true,\n      remoteValue: s.sourceVersion,",
      "after": "      remoteLoaderCalls: s.remoteLoaderCalls + 1,\n      remoteValue: s.sourceVersion,",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M38",
        "text": "M38 is the native twin of dialcache-conformance.qnt remoteCall dropping remoteReadable from its miss branch: both ports skip the Redis publication after a semantic miss, including a decode failure, so only retained-candidate misses refill. core/invalidationRefillsFromCurrentSourceTest (redisWrites 3 and a later hit) and effects/nullReplyRefillsAndIsReadableTest are the expected evidence in both ports.",
        "evidence": {
          "history": "core/invalidationRefillsFromCurrentSourceTest",
          "step": 3,
          "fields": [
            "lastResult"
          ]
        }
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "invalidationRefillsFromCurrentSourceTest",
        "failure": "s.lastResult == 1 and s.remoteLoaderCalls == 1",
        "family": "remote-miss-publication",
        "profiles": [
          "core"
        ],
        "exclusions": {}
      }
    },
    {
      "id": "effects-fenced-source-publishes",
      "contract": "C34",
      "source": "formal/kernel/serving.qnt",
      "model": "formal/dialcache-effects-conformance.qnt",
      "invariant": "writeRequiresAcceptedSource",
      "before": "accepted(value) and refillAllowed(state, source.retentionMs, source.fence)",
      "after": "accepted(value) and source.retentionMs > 0",
      "reproducer": {
        "kind": "exported-regression",
        "run": "fencedSourceSkipsSerializationTest",
        "failure": "s.o.calls == List(VALUE_ONE) and s.o.dumps == 0 and s.o.writes == 0",
        "family": "first-fence-check",
        "profiles": [
          "effects",
          "recovery",
          "recovery-read"
        ],
        "exclusions": {
          "policy": "Composes refills, but no scheduled regression and no sampled history at 2000 x 40 settles an accepted source while its fence is at or ahead of the wall clock.",
          "shadow": "Every reply leaves the remote layer off, so no caller source refills; the dark fill judges its fence through refillAllowed, which the mutant leaves intact.",
          "scope": "The request-only projection never refills the remote layer, so refills is never judged.",
          "admission": "Every read serves a hit and a served job's detached source never fills, so refills is never judged for a refill.",
          "layers": "Composes refills, but no scheduled regression and no sampled history at 2000 x 40 settles an accepted source while its fence is at or ahead of the wall clock.",
          "independent": "Composes refills, but no scheduled regression and no sampled history at 2000 x 40 settles an accepted source while its fence is at or ahead of the wall clock.",
          "local-failure": "Composes refills, but no scheduled regression and no sampled history at 2000 x 40 settles an accepted source while its fence is at or ahead of the wall clock.",
          "runtime-boundaries": "Composes refills, but no scheduled regression and no sampled history at 2000 x 40 settles an accepted source while its fence is at or ahead of the wall clock.",
          "shadow-layers": "Composes refills, but no scheduled regression and no sampled history at 2000 x 40 settles an accepted source while its fence is at or ahead of the wall clock.",
          "local-clock": "The local projection has no remote layer, so refills is never judged.",
          "source-budgets": "The local projection never refills the remote layer, so refills is never judged.",
          "dark-layers": "Caller remote serving is off, so callers capture no remote-refill authority. Dark fills apply the shadow job fence independently of this caller-publication guard.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M39",
        "text": "M39 is the native twin of kernel/serving.qnt refills dropping the fence half of refillAllowed: both ports drop the pre-serialization fence check, so a source accepted behind an observed fence is serialized while the post-serialization recheck still blocks the write."
      }
    },
    {
      "id": "effects-late-source-accepted",
      "contract": "C25",
      "source": "formal/kernel/deadlines.qnt",
      "model": "formal/dialcache-effects-conformance.qnt",
      "invariant": "acceptedSourcesSettledBeforeTheirDeadline",
      "before": "else if (reached(state, SOURCE, ordinal)) DEADLINE_ERROR else value",
      "after": "else if (false) DEADLINE_ERROR else value",
      "reproducer": {
        "kind": "exported-regression",
        "run": "lateSourceResultIsADeadlineErrorTest",
        "failure": "s.o.calls == List(DEADLINE_ERROR) and s.o.dumps == 0 and errorReasons == List(\"fallback\") and amounts(\"fallback\") == List(10)",
        "family": "late-acceptance",
        "profiles": [
          "effects",
          "shadow"
        ],
        "exclusions": {
          "recovery": "Composes the budgeted lifecycle, but no scheduled regression and no sampled history at 2000 x 40 resolves a loader after its deadline was reached undelivered: its late results are timer-delivered or drained.",
          "scope": "Composes the request-only projection, which registers no deadline (deadlines reaches its closure through diagnostics alone), so arrival never runs.",
          "admission": "Composes the budgeted lifecycle, but no scheduled regression and no sampled history at 2000 x 40 resolves a loader after its deadline was reached undelivered: its late results are timer-delivered or drained.",
          "independent": "Composes the budgeted lifecycle, but no scheduled regression and no sampled history at 2000 x 40 resolves a loader after its deadline was reached undelivered: its late results are timer-delivered or drained.",
          "shadow-layers": "Composes the budgeted lifecycle, but no scheduled regression and no sampled history at 2000 x 40 resolves a loader after its deadline was reached undelivered: its late results are timer-delivered or drained.",
          "source-budgets": "Its late settlements are delivered deadlines: arrival never finds a reached deadline undelivered.",
          "dark-layers": "Elapsed-time advances deliver source deadlines before later settlements; this profile has no clock jump without timer delivery to expose the arrival-time check independently.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M03",
        "text": "M03 is the native twin of kernel/deadlines.qnt arrival accepting a result whose deadline was reached undelivered: both ports accept an externally settled result after its elapsed deadline when the timer has not run."
      }
    },
    {
      "id": "scope-late-source-repopulates-closed-memo",
      "contract": "C03",
      "source": "formal/kernel/request-memo.qnt",
      "model": "formal/dialcache-scope-conformance.qnt",
      "invariant": "closedScopesHaveNoMemo",
      "before": "if (slot < 0 or state.closed.nth(slot / keysPerScope)) state else {",
      "after": "if (slot < 0) state else {",
      "nativeMutants": {
        "kind": "unobservable",
        "text": "The closure guard on the memo write (TypeScript RequestLocalCache.set in typescript/src/context.ts; Go the owner-live check before the memo write in the run closure of go/engine.go GetOrLoad) is the native line of kernel/request-memo.qnt memoize memoizing into a closed scope, but removing it changes no public history: both ports re-check closure on the memo read (TypeScript RequestLocalCache.read in typescript/src/context.ts; the same Go run closure serves the memo only while the owner is live) and bypass closed scopes at admission, mirroring the kernel's admission bypass. Measured once while this table was authored, the edit survived every scope and layers history in both ports; the model detects the fault only through the state invariant closedScopesHaveNoMemo, so the challenge is unobservable rather than mapped."
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "lateSourceCannotPopulateReplacementTest",
        "failure": "s.o.calls == List(VALUE_ONE, CALL_PENDING) and s.o.loaders == 2 and s.memo == List(NO_VALUE, NO_VALUE)",
        "family": "closed-scope-memo-publication",
        "profiles": [
          "recovery",
          "scope",
          "layers",
          "recovery-read"
        ],
        "exclusions": {
          "effects": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "policy": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "shadow": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "admission": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "independent": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "local-failure": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "runtime-boundaries": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "shadow-layers": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "local-clock": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "source-budgets": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "dark-layers": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "shadow-read-deadlines": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection."
        }
      }
    },
    {
      "id": "scope-source-error-memoized",
      "contract": "C15",
      "source": "formal/kernel/serving.qnt",
      "model": "formal/dialcache-scope-conformance.qnt",
      "invariant": "memoFollowsLatestSuccessfulSettlement",
      "before": "if (not(accepted(value))) settled else Flights::ownedBy(state, index).fold(settled, (out, call) =>",
      "after": "Flights::ownedBy(state, index).fold(settled, (out, call) =>",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M25",
        "text": "M25 preserves a rejected request-local flight in both ports, making the next same-scope caller receive that error instead of retrying. The kernel fault memoizes a non-accepted value by dropping the accepted guard. The exported held dark-layers history checks a rejected source followed by a new loader and read."
      },
      "reproducer": {
        "kind": "exported-regression",
        "model": "formal/dialcache-dark-layers-conformance.qnt",
        "run": "rejectedDarkSourceSeedsNoLayerTest",
        "failure": "s.o.calls == List(SOURCE_ERROR, CALL_PENDING) and s.o.loaders == 2 and s.o.reads == 2 and s.d.coalesced == List()",
        "family": "failed-source-retry",
        "profiles": [
          "scope",
          "local-failure",
          "dark-layers"
        ],
        "exclusions": {
          "effects": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after memoizing a rejected source result. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "recovery": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after memoizing a rejected source result. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "policy": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after memoizing a rejected source result. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "shadow": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after memoizing a rejected source result. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "admission": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after memoizing a rejected source result. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "layers": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after memoizing a rejected source result. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "independent": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after memoizing a rejected source result. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "recovery-read": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after memoizing a rejected source result. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "runtime-boundaries": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after memoizing a rejected source result. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "shadow-layers": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after memoizing a rejected source result. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "local-clock": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after memoizing a rejected source result. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "source-budgets": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after memoizing a rejected source result. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      }
    },
    {
      "id": "scope-nested-close-evicts-outer-memo",
      "contract": "C02",
      "source": "formal/kernel/request-memo.qnt",
      "model": "formal/dialcache-scope-conformance.qnt",
      "invariant": "memoFollowsLatestSuccessfulSettlement",
      "before": "if (slot / keysPerScope == context) out.replaceAt(slot, NO_VALUE) else out),",
      "after": "out.replaceAt(slot, NO_VALUE)),",
      "reproducer": {
        "kind": "exported-regression",
        "run": "nestedCloseAndDisabledBypassKeepOuterMemoTest",
        "failure": "s.o.calls == List(VALUE_ONE, VALUE_TWO, VALUE_ONE) and s.o.loaders == 2 and s.o.sourceScopes == List(true, false)",
        "family": "nested-close-evicts-outer-memo",
        "profiles": [
          "scope",
          "recovery-read"
        ],
        "exclusions": {
          "effects": "No request scope (persistentContexts 0), so request_memo.closeScope never runs.",
          "recovery": "Closes a scope only through closeScope while the other scope's memo is empty in every scheduled history, so clearing every row clears exactly the closing scope's.",
          "policy": "Has no request scopes (persistentContexts 0 and no closeScope input), so the memo fold the fault mutates is never executed.",
          "shadow": "No request scope (persistentContexts 0) and no closeScope input.",
          "admission": "No scope is persistent (persistentContexts 0) and no input closes one, so request_memo.closeScope is never executed.",
          "independent": "Composes the layered traversal with persistentContexts 0 and no closeScope input, so request_memo.closeScope is never executed.",
          "local-failure": "Composes the request memo but has no closeScope input.",
          "runtime-boundaries": "One persistent scope owns the only memo row, so a close that clears every row clears exactly its own.",
          "shadow-layers": "Composes the request memo but has no closeScope input.",
          "local-clock": "Composes the local projection with no request scope (persistentContexts 0) and no closeScope input.",
          "source-budgets": "Composes the local projection with no request scope: no input opens or closes a scope and every reply disables the request layer, so request_memo.closeScope is never executed.",
          "dark-layers": "The fault can clear peer request memos, but named histories never probe a previously populated peer memo after closing another scope. memoHoldsAcceptedValues permits empty rows; named runs and bounded invariant checks pass.",
          "layers": "Closing a scope can clear another open scope under this fault, but no scheduled layers regression closes a scope or probes another memo afterward. Scheduled invariants constrain closed rows and accepted ownership, not preservation of open memo rows; named runs and the bounded invariant check pass.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M15",
        "text": "M15 is the native reading of kernel/request-memo.qnt closeScope clearing every memo row instead of only the closing context's: a completed nested enable evicts the enclosing request's memo while the outer scope stays open. A nested handle can only reach its own enclosing row, so the port fault evicts one outer row rather than all rows."
      }
    },
    {
      "id": "admission-duplicate-key-admitted",
      "contract": "C54",
      "source": "formal/kernel/shadow.qnt",
      "model": "formal/dialcache-admission-conformance.qnt",
      "invariant": "oneJobPerIdentity",
      "before": "duplicate(state, instance, key) or full(state, instance, capacity)",
      "after": "full(state, instance, capacity)",
      "reproducer": {
        "kind": "exported-regression",
        "run": "duplicateDropsBeforeCapacityIsFullTest",
        "failure": "s.o.calls == List(VALUE_ONE, VALUE_ONE) and s.o.loaders == 1 and s.o.shadow == List(\"dropped\")",
        "family": "duplicate-key-admitted",
        "profiles": [
          "admission",
          "shadow-layers"
        ],
        "exclusions": {
          "shadow": "Composes the shadow module, but admits one job at a time (a call begins only after the previous job drained), so busy is judged against an empty registry and the mutated judgment never changes an admission.",
          "dark-layers": "One job fills the instance capacity of one, so the unchanged full-capacity check still drops a duplicate even when the duplicate test is removed.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M48",
        "text": "M48 is the native twin of kernel/shadow.qnt busy judged without its duplicate disjunct (admitServed and the dark arm of admitJobs both consult it): both ports admit a shadow job for an identity that already has a live job, subject only to capacity."
      }
    },
    {
      "id": "admission-capacity-off-by-one",
      "contract": "C54",
      "source": "formal/kernel/shadow.qnt",
      "model": "formal/dialcache-admission-conformance.qnt",
      "invariant": "capacityIsPerInstance",
      "before": "state.jobs.select(job => sourceOf(state, job).instance == instance).length() >= capacity",
      "after": "state.jobs.select(job => sourceOf(state, job).instance == instance).length() > capacity",
      "reproducer": {
        "kind": "exported-regression",
        "run": "fullInstanceDoesNotBlockOtherInstanceTest",
        "failure": "s.o.loaders == 2 and s.o.shadow == List(\"dropped\")",
        "family": "capacity-off-by-one",
        "profiles": [
          "admission",
          "shadow-layers",
          "dark-layers",
          "shadow-read-deadlines"
        ],
        "exclusions": {
          "shadow": "Composes the shadow module, but admits one job at a time (a call begins only after the previous job drained), so full is judged against an empty registry and the mutated comparison never changes an admission."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M49",
        "text": "M49 is the native twin of kernel/shadow.qnt full comparing the instance's live jobs strictly against its capacity: both ports admit one shadow job beyond the per-instance capacity."
      }
    },
    {
      "id": "layers-process-flight-crosses-instance",
      "contract": "C11",
      "source": "formal/kernel/serving.qnt",
      "model": "formal/dialcache-layers-conformance.qnt",
      "invariant": "sourceOwnershipNeverCrossesKeyOrInstance",
      "before": "pure def identity(layout: Layout, call: Call): int = call.instance * layout.keysPerInstance + call.key",
      "after": "pure def identity(layout: Layout, call: Call): int = call.key",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M20",
        "text": "M20 is the native twin of kernel/serving.qnt identity dropping the instance term from the flight identity: both ports register process flights in one process-wide registry, so a pending flight on one instance is joined from another. The held dark-layers history replays the same public boundary in both ports."
      },
      "reproducer": {
        "kind": "exported-regression",
        "model": "formal/dialcache-dark-layers-conformance.qnt",
        "run": "sameKeyCallersOnTwoInstancesKeepSeparateFlightsTest",
        "failure": "s.o.calls == List(CALL_PENDING, CALL_PENDING) and s.o.loaders == 2 and s.o.reads == 2 and s.o.shadow == List() and s.d.coalesced == List()",
        "family": "instance-flight-identity",
        "profiles": [
          "layers",
          "admission",
          "dark-layers"
        ],
        "exclusions": {
          "effects": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "recovery": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "policy": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "shadow": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "scope": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "independent": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "recovery-read": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "local-failure": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "runtime-boundaries": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "shadow-layers": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "local-clock": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "source-budgets": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      }
    },
    {
      "id": "layers-late-memo-into-closed-scope",
      "contract": "C03",
      "source": "formal/kernel/request-memo.qnt",
      "model": "formal/dialcache-layers-conformance.qnt",
      "invariant": "closedScopesHaveNoMemo",
      "before": "if (slot < 0 or state.closed.nth(slot / keysPerScope)) state else {",
      "after": "if (slot < 0) state else {",
      "measures": "The layers model measures this fault across keys and instances; scope-late-source-repopulates-closed-memo measures it where nested handles memoize into their outer lifetime's row and a replacement request opens beside a closed root.",
      "nativeMutants": {
        "kind": "unobservable",
        "text": "The closure guard on the memo write (TypeScript RequestLocalCache.set in typescript/src/context.ts; Go the owner-live check before the memo write in the run closure of go/engine.go GetOrLoad) is the native line of kernel/request-memo.qnt memoize memoizing into a closed scope, but removing it changes no public history: both ports re-check closure on the memo read (TypeScript RequestLocalCache.read in typescript/src/context.ts; the same Go run closure serves the memo only while the owner is live) and bypass closed scopes at admission, mirroring the kernel's admission bypass. Measured once while this table was authored, the edit survived every scope and layers history in both ports; the model detects the fault only through the state invariant closedScopesHaveNoMemo, so the challenge is unobservable rather than mapped."
      },
      "reproducer": {
        "kind": "exported-regression",
        "model": "formal/dialcache-scope-conformance.qnt",
        "run": "lateSourceCannotPopulateReplacementTest",
        "failure": "s.o.calls == List(VALUE_ONE, CALL_PENDING) and s.o.loaders == 2 and s.memo == List(NO_VALUE, NO_VALUE)",
        "family": "closed-scope-memo-publication",
        "profiles": [
          "recovery",
          "scope",
          "layers",
          "recovery-read"
        ],
        "exclusions": {
          "effects": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "policy": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "shadow": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "admission": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "independent": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "local-failure": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "runtime-boundaries": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "shadow-layers": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "local-clock": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "source-budgets": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "dark-layers": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection.",
          "shadow-read-deadlines": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. This profile does not observe a memo populated after its request scope closes; the shared module being imported alone does not establish detection."
        }
      }
    },
    {
      "id": "independent-fresh-frame-retained",
      "contract": "C40",
      "source": "formal/kernel/recovery.qnt",
      "model": "formal/dialcache-independent-conformance.qnt",
      "invariant": "retainedSnapshotsWereEligible",
      "before": "val stale = visible and retainedAgeAllowed(created, Clock::wallOf(state), ttls.freshMs, ttls.retentionMs)",
      "after": "val stale = visible",
      "nativeMutants": {
        "kind": "model-only",
        "text": "The fault drops the age window from kernel/recovery.qnt retain, so a visible frame the read declined is retained whatever its age. A fresh frame never reaches retain, so the candidate retained under the fault is one past the maximum, consulted only through validCandidate's maximum recheck at loader failure and at decode settlement: no observation changes and only retainedSnapshotsWereEligible sees it; the former literal mutant (retainedAgeAllowed to recoveryAgeAllowed) is equivalent here for the same reason. Retention and serving are mutually exclusive in both ports (typescript/src/internal/redis-cache.ts getWithResolvedConfig returns hit or retained by comparing the age with the fresh age; Go go/engine.go readServing returns kind hit before recover) and the maximum is rechecked before and after decode, so no single edit retains an out-of-window frame a later check does not reject."
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "initiallyExpiredFrameIsNotRetainedTest",
        "failure": "retainedSnapshotsWereEligible and s.retained.nth(0).candidate == NO_VALUE",
        "family": "initial-recovery-retention-window",
        "profiles": [
          "independent"
        ],
        "exclusions": {
          "effects": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. The profile does not independently reject retaining an initially out-of-window candidate; subsequent maximum-age checks still prevent serving it.",
          "recovery": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. The profile does not independently reject retaining an initially out-of-window candidate; subsequent maximum-age checks still prevent serving it.",
          "shadow": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. The profile does not independently reject retaining an initially out-of-window candidate; subsequent maximum-age checks still prevent serving it.",
          "scope": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. The profile does not independently reject retaining an initially out-of-window candidate; subsequent maximum-age checks still prevent serving it.",
          "admission": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. The profile does not independently reject retaining an initially out-of-window candidate; subsequent maximum-age checks still prevent serving it.",
          "recovery-read": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. The profile does not independently reject retaining an initially out-of-window candidate; subsequent maximum-age checks still prevent serving it.",
          "shadow-layers": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. The profile does not independently reject retaining an initially out-of-window candidate; subsequent maximum-age checks still prevent serving it.",
          "source-budgets": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. The profile does not independently reject retaining an initially out-of-window candidate; subsequent maximum-age checks still prevent serving it.",
          "dark-layers": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. The profile does not independently reject retaining an initially out-of-window candidate; subsequent maximum-age checks still prevent serving it.",
          "shadow-read-deadlines": "All scheduled named histories and invariants pass under this fault at 2000 samples by 40 steps. The profile does not independently reject retaining an initially out-of-window candidate; subsequent maximum-age checks still prevent serving it."
        }
      }
    },
    {
      "id": "independent-deadline-settles-at-start",
      "contract": "C24",
      "source": "formal/kernel/deadlines.qnt",
      "model": "formal/dialcache-independent-connection.qnt",
      "invariant": "independentSourceOriginsMatchContract",
      "before": "val moved = Clock::advance(current, earliestDue(current, target) - current.now)",
      "after": "val moved = Clock::advance(current, target - current.now)",
      "reproducer": {
        "kind": "exported-regression",
        "run": "readExpiryStartsItsLoaderAtTheReadsDueInstantTest",
        "model": "formal/dialcache-independent-conformance.qnt",
        "failure": "s.o.calls == List(DEADLINE_ERROR) and s.io.aborted == List(0) and s.o.loaders == 1 and s.o.loads == 0 and s.now == 1000",
        "family": "deadline-delivery-instant",
        "profiles": [
          "formal/dialcache-independent-connection.qnt",
          "independent"
        ],
        "exclusions": {
          "effects": "Every deadline is a multiple of the 10 ms step from the origin, so the earliest due instant and the advance's target coincide.",
          "recovery": "Its one source deadline is 10 ms and every scheduled history that reaches it advances by exactly 10 ms or by 1000 ms with the candidate still inside its maximum, so delivering at the target yields the same channels.",
          "shadow": "Composes deadlines' delivery for a source deadline and a job budget registered at one instant, whose expiries read no clock, so delivering at the target instead of each due instant yields the same channels.",
          "scope": "Does not compose the deadlines module: its sources have no budget.",
          "admission": "Composes deadlines' delivery for job budgets only: a job's expiry reads no clock and every budget is the same 10 ms, so registration order is due order and delivering at the target instead of each due instant yields the same labels in the same order.",
          "shadow-layers": "Composes deadlines' delivery for job budgets whose expiry reads no clock and whose registration order is job order, so delivering at the target instead of each due instant yields the same labels in the same order.",
          "source-budgets": "Composes the budgeted local lifecycle, whose deliveries inside one advance complete the same sources with the same deadline error whichever instants the fold visits, and no delivery there starts further bounded work; only its private settledAt history sees the instant.",
          "dark-layers": "No recovery decode or source-duration observation samples the delivery instant inside an advance. Named runs and scheduled invariants still see the same final errors and retired jobs.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "model-only",
        "text": "The fault makes kernel/deadlines.qnt deliver move the clocks straight to the advance's target instead of visiting each due instant, so a deadline is delivered at the end of the advance rather than at its own instant: a loader a read expiry starts is stamped at the wrong instant and its deadline registered from there, which the monitor's origins clause (the read's own due instant plus the budget) rejects. The former text measured this rule through the settledAt it stamped at expiry, which the held shape does not carry. Neither port records when a deadline error settled (TypeScript typescript/src/internal/deadline.ts withMonotonicDeadline rejects on the timer or on a late result; Go go/deadline.go awaitDeadline returns its timeout error), and the nearest observable, the fallback duration metric, is emitted for every outcome, so an edit there would be a different, broader fault."
      }
    },
    {
      "id": "recovery-read-inclusive-maximum",
      "contract": "C45",
      "source": "formal/kernel/recovery.qnt",
      "model": "formal/dialcache-recovery-read-connection.qnt",
      "invariant": "recoveryReturnMatchesAcquiredContract",
      "before": "snapshot.maximum",
      "after": "snapshot.maximum + 1",
      "reproducer": {
        "kind": "exported-regression",
        "run": "compressedRecoveryRechecksMaximumAfterDecodeTest",
        "model": "formal/dialcache-recovery-read-conformance.qnt",
        "failure": "s.o.calls == List(SOURCE_ERROR) and s.io.sourceErrors == List(1) and s.o.recovery == List(\"miss\") and s.o.dumps == 0 and s.o.writes == 0",
        "family": "inclusive-maximum-boundary",
        "profiles": [
          "formal/dialcache-recovery-read-connection.qnt",
          "recovery-read",
          "independent",
          "recovery"
        ],
        "exclusions": {
          "effects": "Classifier NONE: no snapshot is retained and no recovery decode is held, so the mutated recovery age check is never executed.",
          "shadow": "Composes remote_io with Recovery::NONE and no caller read: no snapshot is ever retained and no recovery decode is held.",
          "admission": "Passes Recovery::NONE at every read settlement, so no snapshot is retained and no recovery decode is held; the mutated text is never executed.",
          "shadow-layers": "Composes recovery on the atomic path, but its guard excludes every stale candidate, so no snapshot holds a candidate and neither its stamp nor its maximum is ever consulted.",
          "scope": "Composes the request-only projection, which has no remote layer and dispatches no held read.",
          "source-budgets": "Composes the local projection, which has no remote layer and dispatches no held read.",
          "dark-layers": "No caller recovery candidate is retained while remote serving is off; the recovery maximum is never judged.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M01",
        "text": "M01 makes the post-decode serving maximum inclusive in both ports, the observable site of kernel/recovery.qnt validCandidate calling recoveryAgeAllowed with the snapshot's maximum plus one, checked by dialcache-recovery-read-connection.qnt recoveryReturnMatchesAcquiredContract; a pre-decode flip alone is masked in the ports by the post-decode recheck."
      }
    },
    {
      "id": "recovery-read-recovery-warms-local",
      "contract": "C43",
      "source": "formal/kernel/remote-io.qnt",
      "model": "formal/dialcache-recovery-read-connection.qnt",
      "invariant": "recoveredResultsNeverPublishShared",
      "before": "complete(Recovery::recordOutcome(settled, outcome.label), layout, held.flight,",
      "after": "complete(Recovery::recordOutcome(if (outcome.served) Serving::warm(settled, layout, settled.sources.nth(held.flight), Payloads::valueOf(snapshot.candidate), 1000) else settled, outcome.label), layout, held.flight,",
      "reproducer": {
        "kind": "exported-regression",
        "run": "untrackedCompressedRecoveryDoesNotWarmLocalTest",
        "model": "formal/dialcache-recovery-read-conformance.qnt",
        "failure": "s.o.calls == List(VALUE_ONE, CALL_PENDING) and s.o.reads == 2 and s.localValues == List(NO_VALUE) and s.o.dumps == 0 and s.o.writes == 0",
        "family": "recovery-warms-local",
        "profiles": [
          "formal/dialcache-recovery-read-connection.qnt",
          "recovery-read"
        ],
        "exclusions": {
          "effects": "Classifier NONE: no snapshot is retained and no recovery decode is held, so the mutated recovery-decode settlement is never executed.",
          "recovery": "Local capacity is 0: Local::putLocal stores nothing, so the mutated warm changes no channel.",
          "shadow": "Composes remote_io with Recovery::NONE and no caller read: no snapshot is ever retained and no recovery decode is held.",
          "admission": "Passes Recovery::NONE at every read settlement, so no snapshot is retained and no recovery decode is held; the mutated text is never executed.",
          "independent": "Composes the held remote lifecycle with a local capacity of 0 and replies that leave the local layer off, so the mutated warm stores nothing.",
          "shadow-layers": "Composes the atomic release (remote_writes), never remote_io's held read dispatch or decode, so the mutated text is never executed.",
          "scope": "Composes the request-only projection, which has no remote layer and dispatches no held read.",
          "source-budgets": "Composes the local projection, which has no remote layer and dispatches no held read.",
          "dark-layers": "No caller enters recovery or releases a recovery decode; dark jobs decode their own C0 and never use the challenged recovery publication arm.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M42",
        "text": "M42 is the native twin of kernel/remote-io.qnt settleLoad warming local storage with a served recovery candidate, checked by dialcache-recovery-read-connection.qnt recoveredResultsNeverPublishShared: both ports publish a recovered stale value into process-local storage. The recovery profile has no local TTL, so detection rests on the recovery-read profile."
      }
    },
    {
      "id": "recovery-read-tracked-retention-uncapped",
      "contract": "C37",
      "source": "formal/kernel/serving.qnt",
      "model": "formal/dialcache-recovery-read-conformance.qnt",
      "invariant": "trackedWritesRespectPhysicalCap",
      "before": "retentionMs: if (refills) Remote::physicalRetention(state, ttls.retentionMs) else 0",
      "after": "retentionMs: if (refills) ttls.retentionMs else 0",
      "reproducer": {
        "kind": "exported-regression",
        "run": "trackedPhysicalRetentionExpiresAtCapTest",
        "failure": "s.o.writeTtls == List(3600000)",
        "family": "tracked-retention-cap",
        "profiles": [
          "recovery-read"
        ],
        "exclusions": {
          "effects": "The 60 s retention is below the tracked cap, so the mutated cap never binds.",
          "recovery": "Every retention (2000, 5000) is under the tracked cap, so capped and raw retention coincide.",
          "shadow": "Every retention (60 s) is under the tracked cap, so capped and raw retention coincide.",
          "admission": "Every retention (60000 ms) is under the one-hour physical cap, so the capped and raw retention coincide.",
          "independent": "Composes serving.authority, but its retentions (2000 and 5000 ms) are under the one-hour cap, so capped and raw retention coincide.",
          "local-failure": "Composes serving.authority with tracking off, so the physical retention is the raw retention and the capped and uncapped texts coincide.",
          "shadow-layers": "Every retention (120000, 180000) is under the tracked cap, so capped and raw retention coincide for callers and jobs alike.",
          "local-clock": "Composes the local projection, whose sources capture a local TTL only (serving.startLocalSource), so the refill authority is never executed.",
          "policy": "Composes serving.authority, but every retention it resolves (2000, 4000 or 5000 ms) is under the one-hour cap, so capped and raw retention coincide.",
          "layers": "Composes serving.authority, but its 60000 ms retention is under the one-hour cap, so capped and raw retention coincide.",
          "runtime-boundaries": "Composes serving.authority, but its 120000 ms retention is written for an untracked entity, which the cap never applies to.",
          "scope": "Composes the request-only projection, which never reaches serving.authority.",
          "source-budgets": "Composes the local projection, which never reaches serving.authority.",
          "dark-layers": "Caller remote serving is off, so callers capture no refill retention. Held dark fills cap their own captured retention through remote_frames.physicalRetention.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M56",
        "text": "M56 is the native twin of kernel/serving.qnt authority capturing a tracked refill's retention uncapped instead of through remote_frames.physicalRetention: both ports write a tracked value for its full configured retention above one hour instead of clamping it to the hour."
      }
    },
    {
      "id": "local-failure-write-fault-publishes",
      "contract": "C27",
      "source": "formal/kernel/local-faults.qnt",
      "model": "formal/dialcache-local-failure-conformance.qnt",
      "invariant": "faultedSettlementPublishesNothingLocally",
      "before": "    val publishing = if (state.localFailed) { sources: state.sources.replaceAt(index, { localMs: 0, ...source }), ...state } else state",
      "after": "    val publishing = state",
      "nativeMutants": {
        "kind": "model-only",
        "text": "The fault in kernel/local-faults.qnt settle commits a local write the environment flagged failed: the settlement keeps the source's captured local TTL under an armed fault, so serving.publish warms the slot. In both ports the write and its failure are one operation: the TypeScript driver spy on LocalCache.prototype.put (typescript/test/formal/behavior-driver.ts) throws before delegation, so putLocalFailOpen in typescript/src/dialcache.ts only logs and records cache_write; Go's Cache.localPut in go/cache.go evaluates the panicking Clock.ElapsedMS while building the entry before simplelru.Add, and execution.putLocal in go/engine.go recovers through callSafely. Nothing can commit the entry after the storage operation threw. local-failure/localWriteFailureKeepsSourceAndRequestMemoTest pins the model site (calls 1,1,0 with two loaders, not a hit on the dropped value)."
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "localWriteFailureKeepsSourceAndRequestMemoTest",
        "failure": "s.o.calls == List(VALUE_ONE, VALUE_ONE, CALL_PENDING) and s.o.loaders == 2 and s.o.writes == 1",
        "family": "local-write-fault-publishes",
        "profiles": [
          "local-failure"
        ],
        "exclusions": {}
      }
    },
    {
      "id": "local-failure-source-error-published",
      "contract": "C27",
      "source": "formal/kernel/serving.qnt",
      "model": "formal/dialcache-local-failure-conformance.qnt",
      "invariant": "storageHoldsAcceptedValuesOnly",
      "before": "    if (accepted(value)) warm(state, layout, source, value, source.localMs) else state",
      "after": "    warm(state, layout, source, value, source.localMs)",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M37",
        "text": "M37 is the native twin of kernel/serving.qnt publishLocal warming local storage without the accepted-value judgment: both ports publish a rejected source's result into process-local storage before rethrowing."
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "rejectedSourceDoesNotSeedLocalTest",
        "failure": "s.o.calls == List(SOURCE_ERROR, CALL_PENDING) and s.o.loaders == 2 and s.o.reads == 2",
        "family": "source-error-published",
        "profiles": [
          "local-failure",
          "policy",
          "source-budgets"
        ],
        "exclusions": {
          "effects": "No local TTL: warm with localMs 0 stores nothing whatever the value, so the mutated local publication is never observable.",
          "recovery": "Composes serving.publish only through remote_io.settleLoader, which publishes a settled value only when it is already accepted and classifies a rejected one without publishing, so the removed acceptance gate never decides.",
          "shadow": "Composes local storage, but every reply leaves the local layer off and the capacity is 0, so no local entry is ever written or read.",
          "scope": "Composes the request-only projection, whose sources settle through serving.settleRequest, never serving.publish.",
          "admission": "Composes serving.publish only for a job's detached source, whose local TTL is 0, so the mutated warm stores nothing.",
          "layers": "Composes the layered shape and reaches the mutated warm when a source is rejected while local storage participates, but none of its scheduled invariants or exported regressions reads the local slot between that rejection and the next publication (measured under the mutant at 2000 x 40 and over its exported regressions).",
          "independent": "Composes serving.publish, but every reply leaves the local layer off and the capacity is 0, so the mutated warm stores nothing.",
          "recovery-read": "Composes the layered shape and reaches the mutated warm when a source is rejected while local storage participates, but none of its scheduled invariants or exported regressions reads the local slot between that rejection and the next publication (measured under the mutant at 2000 x 40 and over its exported regressions).",
          "runtime-boundaries": "Composes the layered shape and reaches the mutated warm when a source is rejected while local storage participates, but none of its scheduled invariants or exported regressions reads the local slot between that rejection and the next publication (measured under the mutant at 2000 x 40 and over its exported regressions).",
          "shadow-layers": "Composes the layered shape and reaches the mutated warm when a source is rejected while local storage participates, but none of its scheduled invariants or exported regressions reads the local slot between that rejection and the next publication (measured under the mutant at 2000 x 40 and over its exported regressions).",
          "local-clock": "Its inline sources only return accepted values, so the acceptance judgment in publishLocal never rejects one.",
          "dark-layers": "The held source lifecycle rejects errors before the accepted-only serving publication call. Native M37 also edits a serving/recovery failure-publication site outside finishRampedDownRemote; both ports replay this dark corpus unchanged under the absent-value mutation.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      }
    },
    {
      "id": "runtime-boundaries-inclusive-cohort",
      "contract": "W03",
      "source": "formal/kernel/runtime-policy.qnt",
      "model": "formal/dialcache-runtime-boundaries-conformance.qnt",
      "invariant": "equalAndLowerCohortsNeverTraverse",
      "before": "or cohortAdmits(sample, thresholdForRelation(sample, cohortRelation(policy)))",
      "after": "or sample <= thresholdForRelation(sample, cohortRelation(policy))",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M51",
        "text": "Same native fault as cohort-inclusive-threshold: M51 makes the serving-layer cohort comparison inclusive in both ports, which is kernel/runtime-policy.qnt admits inlining an inclusive comparison in place of cohortAdmits. runtime-boundaries/localCohortEqualityBypassesBeforeAboveSampleCachesTest and remoteCohortEqualityBypassesBeforeAboveSampleCachesTest are the expected evidence in both ports.",
        "evidence": {
          "history": "runtime-boundaries/localCohortEqualityLeavesNoValueForLaterAdmissionTest",
          "step": 7,
          "fields": [
            "o.calls"
          ]
        }
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "localCohortEqualityLeavesNoValueForLaterAdmissionTest",
        "failure": "s.o.calls == List(VALUE_ONE, CALL_PENDING) and s.o.loaders == 2",
        "family": "strict-cohort-equality",
        "profiles": [
          "runtime-boundaries"
        ],
        "exclusions": {}
      }
    },
    {
      "id": "runtime-boundaries-inherited-sharing-ignores-default",
      "contract": "C16",
      "source": "formal/kernel/runtime-policy.qnt",
      "model": "formal/dialcache-runtime-boundaries-conformance.qnt",
      "invariant": "inheritedDisabledSharingNeverJoins",
      "before": "or (sharingMode(policy) == INHERIT_SHARING and baseline.coalesce)",
      "after": "or sharingMode(policy) == INHERIT_SHARING",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M27",
        "text": "M27 is the native twin of kernel/runtime-policy.qnt resolve dropping the baseline coalesce condition from its inherit-sharing disjunct: both ports capture the operation's coalesce default as true, so an omitted runtime leaf or a null provider inherits sharing over a configured false. runtime-boundaries/inheritedFalseKeepsIndependentMemoizingSourcesTest and the independent profile replays whose fixture sets coalesce false are the expected evidence.",
        "evidence": {
          "history": "runtime-boundaries/inheritedFalseStartsBothSourcesBeforeSettlementTest",
          "step": 4,
          "fields": [
            "o.loaders"
          ]
        }
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "inheritedFalseStartsBothSourcesBeforeSettlementTest",
        "failure": "s.o.calls == List(CALL_PENDING, CALL_PENDING) and s.o.loaders == 2",
        "family": "inherited-sharing-policy",
        "profiles": [
          "runtime-boundaries"
        ],
        "exclusions": {}
      }
    },
    {
      "id": "shadow-layers-inclusive-c0-freshness",
      "contract": "C22",
      "source": "formal/kernel/shadow.qnt",
      "model": "formal/dialcache-shadow-layers-connection.qnt",
      "invariant": "retainedC0WasFreshWhenAcquired",
      "before": "pure def acquired(observed: Remote::Observed): int = if (observed.value > NO_VALUE) observed.payload else NO_VALUE",
      "after": "pure def acquired(observed: Remote::Observed): int = observed.payload",
      "reproducer": {
        "kind": "exported-regression",
        "run": "expiredC0StartsFillWithoutDecodingTest",
        "model": "formal/dialcache-shadow-layers-conformance.qnt",
        "failure": "s.o.calls == List(VALUE_TWO) and s.o.reads == 1 and s.o.loads == 0 and s.o.dumps == 1 and s.o.shadow == List()",
        "family": "c0-freshness-boundary",
        "profiles": [
          "formal/dialcache-shadow-layers-connection.qnt",
          "shadow-layers",
          "shadow",
          "dark-layers"
        ],
        "exclusions": {
          "admission": "Every reply enables the remote layer, so no dark C0 read is made and the mutated acquisition is never applied.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M31",
        "text": "Same native fault as shadow-inclusive-c0-freshness: M31 makes the dark C0 acquisition inclusive in both ports, which is kernel/shadow.qnt acquired keeping a dark C0 from a visible frame remote_frames.observe declined for the reply's freshness (the boundary itself is remote_frames' own partition), checked by dialcache-shadow-layers-connection.qnt retainedC0WasFreshWhenAcquired."
      },
      "measures": "Repeats the shadow-inclusive-c0-freshness fault against the shadow-layers connection model: the same acquisition mutation must also be caught by that monitor's own clause."
    },
    {
      "id": "shadow-layers-fill-uses-current-retention",
      "contract": "C18",
      "source": "formal/kernel/shadow.qnt",
      "model": "formal/dialcache-shadow-layers-conformance.qnt",
      "invariant": "fillKeepsCapturedRetention",
      "before": "else update(Writes::holdDump(state, job.source, authority.retentionMs, authority.fence), { phase: SERIALIZING, ...job })",
      "after": "else update(Writes::holdDump(state, job.source, sourceOf(state, job).retentionMs, authority.fence), { phase: SERIALIZING, ...job })",
      "reproducer": {
        "kind": "exported-regression",
        "run": "darkFillRetainsPolicyThroughSerializationTest",
        "failure": "s.o.writeTtls == List(120000) and s.o.shadow == List(\"filled\")",
        "family": "captured-fill-retention",
        "profiles": [
          "shadow-layers",
          "shadow",
          "dark-layers"
        ],
        "exclusions": {
          "admission": "Served jobs always carry a C0 and never fill, so the mutated fill is never reached.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M29",
        "text": "M29 is the native twin of kernel/shadow.qnt fill holding the dark fill's dump with the source's retention (0 for a dark source) instead of the retention the job captured at admission: both ports re-resolve the runtime policy at fill time and write the dark fill with the retention then in force."
      }
    },
    {
      "id": "local-clock-precise-ttl",
      "contract": "C09",
      "source": "formal/cache-rules.qnt",
      "model": "formal/dialcache-local-clock-conformance.qnt",
      "invariant": "clockIsOnTheGrid",
      "before": "pure def wholeMs(ticks: int, ticksPerMs: int): int = ticks / ticksPerMs",
      "after": "pure def wholeMs(ticks: int, ticksPerMs: int): int = (ticks + ticksPerMs / 2) / ticksPerMs",
      "reproducer": {
        "kind": "exported-regression",
        "run": "fractionalInsertionExpiresAtWholeMillisecondTest",
        "failure": "s.o.calls == List(VALUE_ONE, VALUE_ONE, VALUE_TWO) and s.o.loaders == 2",
        "family": "sub-millisecond-expiry-grid",
        "profiles": [
          "local-clock"
        ],
        "exclusions": {
          "effects": "Does not compose the fractional clock, so the mutated definition is never executed.",
          "recovery": "Never composes the fractional clock (clock.advanceTicks): its clock moves through diagnostics.advance and clock.shiftWall on the whole-millisecond grid, so the mutated projection is never executed.",
          "policy": "Advances its clock in whole milliseconds through clock.advance and never composes the fractional clock, so the mutated projection is never executed.",
          "shadow": "Does not compose the fractional clock.",
          "scope": "Advances its clock in whole milliseconds through clock.advance and never composes the fractional clock, so the mutated projection is never executed.",
          "admission": "Advances its clock in whole milliseconds through clock.advance and never composes the fractional clock.",
          "layers": "Advances its clock in whole milliseconds through clock.advance and never composes the fractional clock, so the mutated projection is never executed.",
          "independent": "Advances its clock in whole milliseconds through clock.advance and never composes the fractional clock, so the mutated projection is never executed.",
          "recovery-read": "Advances its clock in whole milliseconds through clock.advance and never composes the fractional clock, so the mutated projection is never executed.",
          "local-failure": "Has no elapsed-time input and never composes the fractional clock (clock.advanceTicks), so the mutated projection is never executed.",
          "runtime-boundaries": "Advances its clock in whole milliseconds through clock.advance and never composes the fractional clock, so the mutated projection is never executed.",
          "shadow-layers": "Advances its clock in whole milliseconds through clock.advance and never composes the fractional clock, so the mutated projection is never executed.",
          "source-budgets": "Advances its clock in whole milliseconds through clock.advance and never composes the fractional clock, so the mutated projection is never executed.",
          "dark-layers": "The environment advances in whole milliseconds and never calls clock.advanceTicks; wall rollback changes no monotonic insertion grid.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M19",
        "text": "M19 replaces the whole-millisecond local clock with precise time. This challenge retains its shifted-grid approximation: wholeMs rounds after adding half a millisecond, so a fill at 0.7 ms expires at 1001 ms. Clock.advanceTicks and raw-insertion lookup now share that projection; clockIsOnTheGrid remains independent and the original public history still detects the changed expiration."
      }
    },
    {
      "id": "local-clock-hit-renews-insertion",
      "contract": "C09",
      "source": "formal/kernel/local-storage.qnt",
      "model": "formal/dialcache-policy-conformance.qnt",
      "invariant": "localHitsRespectInsertionExpiry",
      "before": "    { lru: state.lru.replaceAt(instance, touch(state.lru.nth(instance), key)), ...state }",
      "after": "    { lru: state.lru.replaceAt(instance, touch(state.lru.nth(instance), key)), localExpires: state.localExpires.replaceAt(instance, state.now + 1000), ...state }",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M11",
        "text": "M11 is the native twin of kernel/local-storage.qnt promote re-stamping the insertion expiry on a hit instead of renewing recency alone: both ports refresh the insertion time on every hit while keeping the value. promote has no TTL parameter, so the mutant stamps a literal second, the local-clock TTL."
      },
      "reproducer": {
        "kind": "exported-regression",
        "model": "formal/dialcache-local-clock-conformance.qnt",
        "run": "fractionalInsertionExpiresAtWholeMillisecondTest",
        "failure": "s.o.calls == List(VALUE_ONE, VALUE_ONE, VALUE_TWO) and s.o.loaders == 2",
        "family": "local-hit-renews-insertion",
        "profiles": [
          "policy",
          "local-clock",
          "source-budgets",
          "recovery-read"
        ],
        "exclusions": {
          "effects": "The local layer is off (capacity 0 and no local TTL), so the mutated promotion never runs.",
          "recovery": "The local layer is off: capacity 0 and no local TTL, so no local entry is ever written or hit and the mutated renewal is never executed.",
          "shadow": "Composes local storage, but every reply leaves the local layer off and the capacity is 0, so no local entry is ever written or read.",
          "scope": "Composes the request-only projection, which never reads local storage.",
          "admission": "The local layer is off in every reply and local storage is declared empty, so the mutated local storage rule is never executed.",
          "layers": "Composes local storage, but its 60 s entries never reach their insertion expiry within the bound of 1 ms ticks, so a renewed insertion is invisible.",
          "independent": "Composes local storage, but every reply leaves the local layer off and the capacity is 0, so no local hit is ever served.",
          "local-failure": "Composes local storage, but no input advances the clock, so a renewed insertion is invisible.",
          "runtime-boundaries": "Composes local storage, but no input advances the clock, so a renewed insertion is invisible.",
          "shadow-layers": "Composes local storage; its one expiry regression reads the entry again only after the advances that expire it, with no hit in between, so a renewed insertion is invisible (measured under the mutant at 2000 x 40 and over its exported regressions).",
          "dark-layers": "The named dark-job histories and invariants do not constrain renewing local insertion expiry on a hit. Local-clock supplies the detecting model boundary; this profile does not claim that property.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      }
    },
    {
      "id": "source-budgets-outside-call-has-deadline",
      "contract": "C01",
      "source": "formal/kernel/deadlines.qnt",
      "model": "formal/dialcache-source-budgets-conformance.qnt",
      "invariant": "outsideSourcesHaveNoDeadline",
      "before": "pure def admissionBudget(state: Budgeted[r], call: Call): int = if (call.keyFailed) state.sourceBudget else UNBOUNDED",
      "after": "pure def admissionBudget(state: Budgeted[r], call: Call): int = state.sourceBudget",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M14",
        "text": "M14 is the native twin of kernel/deadlines.qnt admissionBudget applying the configured source budget to outside calls instead of UNBOUNDED. At advance(100), both outside callers must remain pending; the fault completes them with deadline errors. Boundary evidence selects caller outcomes so unrelated policy or loader counters cannot satisfy the mapping.",
        "evidence": {
          "history": "source-budgets/outsideAndInvalidOutsideCallsIgnoreDeadlineAndSharingTest",
          "step": 3,
          "fields": [
            "o.calls"
          ]
        }
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "outsideAndInvalidOutsideCallsIgnoreDeadlineAndSharingTest",
        "failure": "s.o.calls == List(CALL_PENDING, CALL_PENDING) and s.o.policyCalls == 0 and s.o.loaders == 2",
        "family": "outside-call-unbounded-source",
        "profiles": [
          "source-budgets",
          "dark-layers"
        ],
        "exclusions": {
          "effects": "All calls are enabled with valid keys and no closable request scope; sources start at release or read/decode settlement, never from bypass admission.",
          "recovery": "Call and join guards admit only enabled callers in open scopes. Closing a scope after admission cannot start a bypass source, so the changed admission budget never registers a deadline.",
          "shadow": "All calls are enabled with valid keys and no closable request scope; the caller source starts at participating release, not bypass admission.",
          "scope": "Uses Diagnostics::admitRequest and the request-only serving lifecycle, with no budgeted source lifecycle; it never calls the changed admission-budget rule.",
          "admission": "Uses Shadow::beginHeld through RemoteIO::begin without a source budget; only shadow jobs register deadlines, so caller admission never uses the changed rule.",
          "independent": "All calls are enabled with valid keys and no closable request scope; source loaders start after read/decode settlement, not from bypass admission.",
          "shadow-layers": "Uses Shadow::begin with the atomic serving lifecycle and no source budget; only shadow jobs are timed, so caller admission never uses the changed rule.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      }
    },
    {
      "id": "source-budgets-settled-flight-stays-registered",
      "contract": "C15",
      "source": "formal/kernel/flights.qnt",
      "model": "formal/dialcache-source-budgets-conformance.qnt",
      "invariant": "registeredWorkIsNotAbandoned",
      "before": "processFlights: state.processFlights.foldl(List(), (out, owner) => out.append(if (owner == index) NO_OWNER else owner)),",
      "after": "processFlights: state.processFlights,",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M26",
        "text": "M26 is the native twin of kernel/flights.qnt forgetSource leaving processFlights unchanged instead of clearing the settled index: neither port removes a settled process flight from the registry, so later same-key callers join finished work. Joiners get the settled flight's stale outcome rather than stranding, since a blocked follower would deadlock synctest; source-budgets/defaultSourceBudgetExpiresAtSixtySecondsTest and policy/independentCompletionKeepsRegisteredLeaderTest are the evidence.",
        "evidence": {
          "history": "source-budgets/defaultSourceBudgetExpiresAtSixtySecondsTest",
          "step": 7,
          "fields": [
            "o.calls"
          ]
        }
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "defaultSourceBudgetExpiresAtSixtySecondsTest",
        "failure": "s.o.calls == List(DEADLINE_ERROR, CALL_PENDING) and s.o.loaders == 2",
        "family": "settled-process-flight-cleanup",
        "profiles": [
          "effects",
          "recovery",
          "policy",
          "admission",
          "layers",
          "recovery-read",
          "local-failure",
          "runtime-boundaries",
          "local-clock",
          "source-budgets",
          "dark-layers"
        ],
        "exclusions": {
          "scope": "Only request flights are registered; processFlights stays empty, so removing process-flight cleanup changes no state.",
          "shadow": "This single-execution projection cannot admit a second source after its one source/job lifetime; its scheduled properties do not observe the settled process registry.",
          "independent": "Every caller has coalesce false and registers no process flight, so processFlights remains empty.",
          "shadow-layers": "Coalescing is disabled for its independent-source fixture, so no process flight is registered.",
          "shadow-read-deadlines": "All six exported read-deadline histories and all six scheduled invariants at 2000 x 40 pass under this fault; this profile does not exercise the affected recovery or settled-flight reuse behavior."
        }
      }
    },
    {
      "id": "stale-recovery-future-candidate",
      "contract": "C40",
      "source": "formal/cache-rules.qnt",
      "model": "formal/dialcache-stale-recovery.qnt",
      "invariant": "futureFrameIsNeverFreshOrRetained",
      "before": "created <= observed and observed - created < ceiling",
      "after": "observed - created < ceiling",
      "measures": "Repeats the recovery-future-candidate fault against stale-recovery: the model keeps no future check of its own on the initial-read path, so a shared age rule that stops rejecting future stamps must be caught by this model's read receipt.",
      "reproducer": {
        "kind": "exported-regression",
        "run": "wallRollbackRejectsFutureRemoteFrameTest",
        "model": "formal/dialcache-policy-conformance.qnt",
        "failure": "s.o.calls == List(VALUE_ONE, CALL_PENDING) and s.o.loaders == 2",
        "family": "future-timestamp-accepted",
        "profiles": [
          "formal/dialcache-stale-recovery.qnt",
          "recovery",
          "policy",
          "shadow",
          "recovery-read",
          "effects",
          "dark-layers"
        ],
        "exclusions": {
          "scope": "Evaluates no age judgment from cache-rules, so ageBeforeCeiling is unreachable.",
          "admission": "Composes the remote freshness judgment, but every frame is stamped at a wall clock that only advances and is read within 600 ms under a 60 s freshness, so no read meets an age boundary or observes a future stamp.",
          "layers": "Frames are stamped from a wall clock that only moves with the monotonic clock (no rollback input), so no history observes a future stamp.",
          "independent": "Seeds stamp frames at the wall minus a non-negative age and the clock only advances, so no history observes a future stamp.",
          "local-failure": "Composes the remote freshness judgment (ageBeforeCeiling through freshAgeAllowed), but its wall clock never moves and every frame is stamped at the current instant, so no history observes a future stamp.",
          "runtime-boundaries": "Frames are stamped from a wall clock that only moves with the monotonic clock (no rollback input), so no history observes a future stamp.",
          "shadow-layers": "Frames are stamped with the wall clock at write release (remote_writes.dispatch) or seeded at a non-negative age; the skew is 0 and never shifts, so no history observes a future stamp.",
          "local-clock": "Composes the local projection with no remote layer; its closure reaches cache-rules through wholeMs and localEntryLiveAt only, so ageBeforeCeiling is never evaluated.",
          "source-budgets": "Uses only localEntryLiveAt and sourceAcceptsAt from cache-rules; no age judgment is evaluated.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M40",
        "text": "Same native fault as recovery-future-candidate: M40 classifies a frame dated after the reader clock as a valid frame of age zero in both ports, which is cache-rules.qnt ageBeforeCeiling losing its created-before-observed clause as measured on the read receipt by dialcache-stale-recovery.qnt futureFrameIsNeverFreshOrRetained."
      }
    },
    {
      "id": "envelope-strips-unknown-zero-prefix",
      "contract": "W06",
      "source": "formal/dialcache-envelope-vectors.qnt",
      "model": "formal/dialcache-envelope-vectors.qnt",
      "invariant": "unknownZeroPrefixPassesThroughUnchanged",
      "before": "if (raw.length() > 1 and raw.nth(1) <= 2)",
      "after": "if (raw.length() > 1)",
      "reproducer": {
        "kind": "model-run",
        "run": "unknownLegacyZeroPrefixRemainsUntouchedTest",
        "failure": "result.read.bytes == List(0,3)",
        "family": "escape-prefix-over-consumed",
        "profiles": [
          "formal/dialcache-envelope-vectors.qnt"
        ],
        "exclusions": {},
        "scope": "A deterministic protocol transform exports language-neutral vector inputs rather than an asynchronous driver history. Exact generated rows have their own native input/output recording and clean baseline in both ports. The named run executes requestFor(9), the exact generated byte sequence0003. Because03 is not an envelope marker, both native readers preserve both bytes."
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M54",
        "text": "M54 is the native twin of dialcache-envelope-vectors.qnt readEnvelope dropping its marker guard: both ports strip a leading zero byte even when the next byte is not an envelope marker. M53 shares the anchor with a different edit and stays a distinct entry; envelope vectors 009 (0003 stays 0003) and 010 are the expected evidence in both ports.",
        "evidence": {
          "vector": {
            "artifact": "formal/quint-envelope-vectors.json",
            "group": "envelopeVectors",
            "rows": {
              "typescript": "Quint envelope 009 envelope",
              "go": "Quint envelope 009 envelope"
            },
            "fields": [
              "decodedHex"
            ],
            "relation": "The named run executes requestFor(9), the exact generated byte sequence0003. Because03 is not an envelope marker, both native readers preserve both bytes."
          }
        }
      }
    },
    {
      "id": "source-budgets-accepts-at-deadline-equality",
      "contract": "C25",
      "source": "formal/kernel/deadlines.qnt",
      "model": "formal/dialcache-source-budgets-conformance.qnt",
      "invariant": "acceptedSourceRespectsItsOwnStart",
      "before": "pure def dueAt(now: int, d: Due): bool = not(deadlinePendingAt(now, d.at))",
      "after": "pure def dueAt(now: int, d: Due): bool = now > d.at",
      "reproducer": {
        "kind": "exported-regression",
        "run": "lateSourceResultIsADeadlineErrorTest",
        "failure": "s.o.calls == List(DEADLINE_ERROR) and s.o.dumps == 0 and errorReasons == List(\"fallback\") and amounts(\"fallback\") == List(10)",
        "family": "inclusive-deadline-boundary",
        "profiles": [
          "source-budgets",
          "independent",
          "shadow-layers",
          "recovery",
          "admission",
          "shadow",
          "effects",
          "dark-layers",
          "shadow-read-deadlines"
        ],
        "exclusions": {
          "scope": "does not compose the deadlines module: its sources have no budget"
        },
        "model": "formal/dialcache-effects-conformance.qnt"
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M35",
        "text": "M35 changes native settlement-time deadline equality. The shared dueAt mutation also affects timer delivery, which the dark-layers source/job deadline history detects model-side. Its native advance still delivers the unchanged timer, so that profile supplies no native M35 boundary; effects clock-jump histories isolate settlement."
      }
    },
    {
      "id": "policy-hit-before-join",
      "contract": "C13",
      "source": "formal/kernel/serving.qnt",
      "model": "formal/dialcache-policy-conformance.qnt",
      "invariant": "remoteHitsRespectAcquiredFreshness",
      "before": "else if (processOwner >= 0) JoinsProcess(processOwner)\n        else if (memoValue > NO_VALUE) ServesMemo(memoValue)\n        else if (localValue > NO_VALUE) ServesLocal(localValue)\n        else if (remoteValue > NO_VALUE) ServesRemote(remoteValue)",
      "after": "else if (memoValue > NO_VALUE) ServesMemo(memoValue)\n        else if (localValue > NO_VALUE) ServesLocal(localValue)\n        else if (remoteValue > NO_VALUE) ServesRemote(remoteValue)\n        else if (processOwner >= 0) JoinsProcess(processOwner)",
      "reproducer": {
        "kind": "exported-regression",
        "run": "independentCompletionKeepsRegisteredLeaderTest",
        "failure": "s.o.calls == List(CALL_PENDING, VALUE_TWO, CALL_PENDING) and s.o.loaders == 2 and s.o.reads == 2",
        "family": "hit-before-join",
        "profiles": [
          "policy",
          "runtime-boundaries",
          "layers",
          "dark-layers"
        ],
        "exclusions": {
          "effects": "No request memo: the memo value is always absent, so the two traversal orders coincide.",
          "recovery": "No scheduled history admits a caller into a scope holding a memo while another scope's flight is pending, so the reordered arms decide alike.",
          "shadow": "Every reply leaves every layer off and coalescing off: decide's join and serve arms are never taken.",
          "admission": "Composes decide with the remote layer unobserved and no memo or local layer, so no layer value can precede a join and the reordered arms decide alike.",
          "independent": "Composes decide with coalesce false, so no process owner is ever looked up, and with no request memo and no local layer no layer value can precede a join.",
          "recovery-read": "One execution at a time: no caller is released while a flight is pending, so decide's join arms are never taken.",
          "local-failure": "Composes serving.decide, but admits one source at a time (no call begins while a source is pending), so no flight is ever joinable and the join arms are never taken.",
          "shadow-layers": "Coalescing is off in every reply: decide's join arms are never taken and the request registry is never written.",
          "local-clock": "Composes serving.decide over the local projection, but an inline source settles in the step that starts it, so no flight is pending at any admission and the join arms are never taken.",
          "scope": "Composes the request-only projection, which passes no layer values to the decision, so no layer hit can precede a join.",
          "source-budgets": "Its replies always coalesce and its bypass sources warm nothing, so a live entry and a pending registered flight never coexist.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M21",
        "text": "M21 is the native twin of kernel/serving.qnt decide moving JoinsProcess below the memo, local and remote branches: both ports serve a live local entry before joining the pending process flight registered for the key."
      }
    },
    {
      "id": "policy-join-ignores-coalesce",
      "contract": "C13",
      "source": "formal/kernel/serving.qnt",
      "model": "formal/dialcache-policy-conformance.qnt",
      "invariant": "joinsOnlyJoinableFlights",
      "before": "if (resolved.coalesce and sharedLayers(layers) and memoValue == NO_VALUE)",
      "after": "if (sharedLayers(layers) and memoValue == NO_VALUE)",
      "reproducer": {
        "kind": "exported-regression",
        "run": "nonCoalescingCallStartsSeparateSourceTest",
        "failure": "s.o.calls == List(CALL_PENDING, CALL_PENDING) and s.o.loaders == 2 and s.o.reads == 2",
        "family": "join-ignores-coalesce",
        "profiles": [
          "policy",
          "runtime-boundaries",
          "admission",
          "dark-layers"
        ],
        "exclusions": {
          "effects": "Every reply coalesces, so the dropped conjunct is always true.",
          "recovery": "Coalescing is on in every reply, so the conjunct the fault removes is always true and no history observes it.",
          "shadow": "Every reply leaves every layer off and coalescing off: decide's join and serve arms are never taken.",
          "independent": "Composes decide with coalesce false and registers its flights unshared, so the process registry never names an owner and the dropped conjunct changes no decision.",
          "recovery-read": "One execution at a time: no caller is released while a flight is pending, so decide's join arms are never taken.",
          "local-failure": "Composes serving.decide, but admits one source at a time (no call begins while a source is pending), so no flight is ever joinable and the join arms are never taken.",
          "shadow-layers": "Coalescing is off in every reply: decide's join arms are never taken and the request registry is never written.",
          "local-clock": "Composes serving.decide over the local projection, but an inline source settles in the step that starts it, so no flight is pending at any admission and the join arms are never taken.",
          "layers": "Its replies always coalesce, so the conjunct the fault removes is always true and no history observes it.",
          "scope": "Composes the request-only projection, whose process join requires a shared layer this shape never has.",
          "source-budgets": "Its replies always coalesce, so the conjunct the fault removes is always true and no history observes it.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M22",
        "text": "M22 is the native twin of kernel/serving.qnt decide dropping the coalesce condition from its process-owner conjunction: both ports let a non-coalescing caller join a pending process flight while registration still respects coalesce."
      }
    },
    {
      "id": "source-budgets-settlement-never-replaces-local-entry",
      "contract": "C13",
      "source": "formal/kernel/local-storage.qnt",
      "model": "formal/dialcache-source-budgets-conformance.qnt",
      "invariant": "localPublicationRequiresAcceptedSource",
      "before": "if (state.capacity == 0) state else {",
      "after": "if (state.capacity == 0 or state.localValues.nth(slot) != NO_VALUE) state else {",
      "reproducer": {
        "kind": "exported-regression",
        "run": "independentLocalPublicationUsesLastCompletionTest",
        "failure": "s.o.calls == List(VALUE_ONE, VALUE_TWO, VALUE_ONE) and s.o.loaders == 2",
        "family": "local-publication-never-replaces",
        "profiles": [
          "source-budgets",
          "local-clock",
          "policy",
          "runtime-boundaries"
        ],
        "exclusions": {
          "effects": "The fixture gives every source a zero local TTL, so the mutated local put has no observable effect.",
          "recovery": "The fixture has zero local capacity, so putLocal stores nothing before or after this fault.",
          "shadow": "Every reply leaves the local layer off and local capacity is zero, so no local entry is published.",
          "scope": "The request-only traversal never publishes a local entry.",
          "admission": "Serving reads are remote hits and detached shadow sources have no local publication authority; no occupied local slot is replaced.",
          "layers": "Local publication is reachable, but no scheduled regression or sampled invariant at the check bounds distinguishes skipping an occupied slot; its properties check ownership and storage membership, not a last-completion probe.",
          "independent": "Every reply leaves the local layer off and local capacity is zero, so no local entry is published.",
          "recovery-read": "Local publication is reachable, but no scheduled regression or sampled invariant at the check bounds distinguishes skipping an occupied slot; the partition checker remeasures that exclusion.",
          "local-failure": "Only one source can be pending, time never expires a local entry, and a failed local read withdraws local publication authority. The profile never requires replacing an occupied slot.",
          "shadow-layers": "Local publication is reachable, but no scheduled regression or sampled invariant at the check bounds distinguishes skipping an occupied slot; the partition checker remeasures that exclusion.",
          "dark-layers": "Local publication is reachable, but no scheduled regression or sampled invariant at the check bounds distinguishes skipping an occupied slot; the partition checker remeasures that exclusion.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        },
        "model": "formal/dialcache-policy-conformance.qnt"
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M23",
        "text": "M23 is the native twin of kernel/local-storage.qnt putLocal refusing an occupied slot: both ports skip a local publication when an entry already occupies the key, even if it has expired. The shared storage rule is reached by both the local-only and layered traversals."
      }
    },
    {
      "id": "source-budgets-failed-settlement-clears-local-entry",
      "contract": "C13",
      "source": "formal/kernel/serving.qnt",
      "model": "formal/dialcache-source-budgets-conformance.qnt",
      "invariant": "localPublicationRequiresAcceptedSource",
      "before": "if (accepted(value)) warm(state, layout, source, value, source.localMs) else state",
      "after": "if (accepted(value)) warm(state, layout, source, value, source.localMs) else { localValues: state.localValues.replaceAt(source.instance * layout.keysPerInstance + source.key, NO_VALUE), localExpires: state.localExpires.replaceAt(source.instance * layout.keysPerInstance + source.key, 0), lru: state.lru.replaceAt(source.instance, state.lru.nth(source.instance).select(key => key != source.key)), ...state }",
      "reproducer": {
        "kind": "exported-regression",
        "run": "independentFailureKeepsLocalValueWhenRemoteFailsTest",
        "failure": "s.o.calls == List(VALUE_ONE, SOURCE_ERROR, VALUE_ONE) and s.o.loaders == 2 and s.o.reads == 2",
        "family": "failed-settlement-clears-local-entry",
        "profiles": [
          "source-budgets",
          "policy",
          "local-failure"
        ],
        "exclusions": {
          "effects": "No local TTL is configured, and rejected held sources complete without calling publishLocal.",
          "recovery": "The held lifecycle handles rejection without calling publishLocal, and local capacity is zero.",
          "shadow": "Every reply leaves the local layer off and local capacity is zero, so no accepted local entry can be lost.",
          "scope": "The request-only traversal settles through serving.settleRequest and never publishes local storage.",
          "admission": "Serving local storage is disabled; detached shadow sources have no local publication authority and no accepted local entry can be lost.",
          "layers": "The consistent removal preserves storage membership and source ownership. No scheduled history or sampled property at the check bounds probes a previously published local value after the rejection.",
          "independent": "The held lifecycle handles rejection without calling publishLocal, and local capacity is zero.",
          "recovery-read": "Rejected held sources go through remote_io.settleLoader, which handles their error or recovery without calling publishLocal with the rejected value.",
          "runtime-boundaries": "No scheduled history or sampled property at the check bounds probes a previously published local value after another source rejects; the partition checker remeasures that exclusion.",
          "shadow-layers": "Rejected sources go through remote_writes.failed, which completes or recovers them without calling publishLocal with the rejected value.",
          "local-clock": "Its inline sources only return accepted values, so the failure-preserves-local branch is never taken.",
          "dark-layers": "Rejected held sources complete without calling publishLocal with the rejected value, so they cannot take the mutated failure branch.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        },
        "model": "formal/dialcache-policy-conformance.qnt"
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M24",
        "text": "M24 is the native twin of kernel/serving.qnt publishLocal removing the key's existing local entry on rejection. The shared rule applies to local-only and layered settlements; the native edits affect active fallback paths with an available key, while outside bypass calls never enter those paths."
      }
    },
    {
      "id": "dark-layers-process-flight-crosses-instance",
      "contract": "C11",
      "source": "formal/kernel/serving.qnt",
      "model": "formal/dialcache-dark-layers-conformance.qnt",
      "invariant": "sourceOwnersShareTheSourcesIdentity",
      "before": "pure def identity(layout: Layout, call: Call): int = call.instance * layout.keysPerInstance + call.key",
      "after": "pure def identity(layout: Layout, call: Call): int = call.key",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M20",
        "text": "M20 is the native twin of kernel/serving.qnt identity dropping the instance term from the flight identity: both ports register process flights in one process-wide registry, so a pending flight on one instance is joined from another. The held dark-layers history replays the same public boundary in both ports."
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "sameKeyCallersOnTwoInstancesKeepSeparateFlightsTest",
        "failure": "s.o.calls == List(CALL_PENDING, CALL_PENDING) and s.o.loaders == 2 and s.o.reads == 2 and s.o.shadow == List() and s.d.coalesced == List()",
        "family": "instance-flight-identity",
        "profiles": [
          "dark-layers",
          "admission",
          "layers"
        ],
        "exclusions": {
          "effects": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "recovery": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "policy": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "shadow": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "scope": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "independent": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "recovery-read": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "local-failure": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "runtime-boundaries": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "shadow-layers": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "local-clock": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "source-budgets": "Every named run and the scheduled invariant check at 2000 samples by 40 steps passes after removing the instance from pending process-flight identity. This bounded profile supplies no detecting assertion for that shared fault; the listed profiles carry its model evidence.",
          "shadow-read-deadlines": "All six exported read-deadline regressions and the scheduled 2000 x 40 invariant check pass under this mutation. This profile claims separate dark read deadlines and raw ownership, not this property; detecting profiles are listed."
        }
      },
      "measures": "Repeats the layers identity fault against the held dark path: every caller must own a source for its own key and instance."
    },
    {
      "source": "formal/kernel/deadlines.qnt",
      "before": "at: state.now + budget }), ...state }",
      "after": "at: budget }), ...state }",
      "id": "dark-layers-budget-starts-at-clock-origin",
      "contract": "C23",
      "model": "formal/dialcache-dark-layers-conformance.qnt",
      "invariant": "pendingDeadlinesAreFuture",
      "measures": "Repeats the shared wrong-origin deadline fault against a later dark caller and its owned diagnostic job.",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M33",
        "text": "M33 applies the generic elapsed deadline to clock uptime instead of the work start. The shared model fault registers the same wrong absolute deadline. A dark caller starts at elapsed 10 ms and resolves immediately, within its own 10 ms budget. The source must succeed and publish locally for another request scope while the independent dark read remains held. Both faulty variants reject this source and fail the caller-result checkpoint.",
        "evidence": {
          "history": "dark-layers/laterDarkSourceKeepsItsWholeBudgetTest",
          "step": 5,
          "fields": [
            "o.calls"
          ]
        }
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "laterDarkSourceKeepsItsWholeBudgetTest",
        "failure": "s.o.calls == List(VALUE_ONE, VALUE_ONE) and s.o.loaders == 1 and s.o.reads == 1 and s.o.dumps == 0 and s.o.shadow == List() and s.d.fallbackErrors == List()",
        "family": "source-budget-starts-with-source",
        "profiles": [
          "effects",
          "recovery",
          "shadow",
          "independent",
          "shadow-layers",
          "source-budgets",
          "dark-layers",
          "admission",
          "shadow-read-deadlines"
        ],
        "exclusions": {
          "scope": "Request-only sources have no deadline or elapsed clock; diagnostics imports the deadline module without invoking its registration transition. All 14 named runs and all six scheduled invariants pass with the wrong-origin fault at 2000 samples by 40 steps."
        }
      }
    },
    {
      "source": "formal/kernel/deadlines.qnt",
      "before": "at: state.now + budget }), ...state }",
      "after": "at: budget }), ...state }",
      "id": "admission-budget-starts-at-clock-origin",
      "contract": "C54",
      "model": "formal/dialcache-admission-conformance.qnt",
      "invariant": "pendingDeadlinesAreFuture",
      "measures": "Repeats the shared wrong-origin deadline fault against a later detached job admitted after a served cache hit.",
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M33",
        "text": "M33 applies the generic elapsed deadline to clock uptime instead of the job start. This served-hit job starts at 10 ms and its source rejects at 11 ms, inside its own 10 ms budget. Both the wrong model registration and native settlement report timeout instead of source_error; the served caller keeps its acquired value.",
        "evidence": {
          "history": "admission/laterServedShadowKeepsItsWholeBudgetTest",
          "step": 6,
          "fields": [
            "o.shadow"
          ]
        },
        "crossContract": "The C23 mutant changes the generic deadline wrapper used by both caller sources and C54 detached shadow jobs. This mapping requires the shadow outcome from the latter, not a caller-source failure."
      },
      "reproducer": {
        "kind": "exported-regression",
        "run": "laterServedShadowKeepsItsWholeBudgetTest",
        "failure": "s.o.calls == List(VALUE_ONE) and s.o.loaders == 1 and s.o.loads == 1 and s.o.shadow == List(\"source_error\")",
        "family": "source-budget-starts-with-source",
        "profiles": [
          "effects",
          "recovery",
          "shadow",
          "independent",
          "shadow-layers",
          "source-budgets",
          "dark-layers",
          "admission",
          "shadow-read-deadlines"
        ],
        "exclusions": {
          "scope": "Request-only sources have no deadline or elapsed clock; diagnostics imports the deadline module without invoking its registration transition. All 14 named runs and all six scheduled invariants pass with the wrong-origin fault at 2000 samples by 40 steps."
        }
      }
    },
    {
      "id": "dark-layers-timeout-releases-held-capacity",
      "contract": "C54",
      "source": "formal/kernel/shadow.qnt",
      "model": "formal/dialcache-dark-layers-conformance.qnt",
      "invariant": "heldEffectsKeepTheirJob",
      "before": "if (job.dark and job.phase == WAITING_SOURCE) { jobs: expired.jobs.select(other => other.source != job.source), ...expired }",
      "after": "if (true) { jobs: expired.jobs.select(other => other.source != job.source), ...expired }",
      "reproducer": {
        "kind": "exported-regression",
        "run": "timedOutDarkDumpKeepsCapacityUntilRawReleaseTest",
        "failure": "s.o.calls == List(VALUE_ONE, CALL_PENDING) and s.o.reads == 1 and s.o.shadow == List(\"timeout\", \"dropped\")",
        "family": "shadow-timeout-releases-held-capacity",
        "profiles": [
          "shadow",
          "admission",
          "shadow-layers",
          "dark-layers",
          "shadow-read-deadlines"
        ],
        "exclusions": {}
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M58",
        "text": "M58 removes the shadow registration when the whole-job timeout is reported in both ports, while raw read/decode/dump/write work can still be pending. The kernel expireJob edit frees the same held-work capacity at timeout. The exported held-dump history detects the premature admission at its competing-key public checkpoint; companion histories cover C0 read, decode, C1 read and write."
      }
    },
    {
      "id": "effects-stale-frame-reply-unclassified",
      "contract": "C58",
      "source": "formal/kernel/metrics.qnt",
      "model": "formal/dialcache-effects-conformance.qnt",
      "invariant": "staleFrameRepliesReportExpired",
      "before": "if (Replies::isFrame(state.reply)) declinedFrameReason(state.replyAt, Clock::wallOf(state))",
      "after": "if (Replies::isFrame(state.reply)) \"unclassified\"",
      "reproducer": {
        "kind": "exported-regression",
        "run": "staleFrameReplyExpiresRefillsAndIsReadableTest",
        "failure": "missReasons == List(\"expired\") and s.o.loads == 0 and s.o.loaders == 1",
        "family": "expired-frame-reply-category",
        "profiles": [
          "effects"
        ],
        "exclusions": {}
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M57",
        "text": "M57 is the native twin of a stale queued frame reply losing its expired miss category: both ports report unclassified at the maximum-age guard while the ordinary source and refill still proceed.",
        "evidence": {
          "history": "effects/staleFrameReplyExpiresRefillsAndIsReadableTest",
          "step": 4,
          "fields": [
            "events"
          ]
        }
      }
    },
    {
      "id": "inspection-counts-leaders-as-followers",
      "contract": "C11",
      "source": "formal/kernel/flights.qnt",
      "model": "formal/dialcache-dark-layers-conformance.qnt",
      "invariant": "inspectionsCountOnlyProcessFollowers",
      "before": "activeFollowers: joined.size()",
      "after": "activeFollowers: joined.size() + registered.size()",
      "reproducer": {
        "kind": "exported-regression",
        "run": "inspectionTracksKeysFollowersAndOldestLeaderTest",
        "failure": "s.d.inspections == List({ instance: 0, activeLeaders: 2, activeFollowers: 1, oldestLeaderAgeMs: 1 })",
        "family": "process-follower-accounting",
        "profiles": [
          "dark-layers"
        ],
        "exclusions": {
          "effects": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "scope": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "recovery": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "policy": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "shadow": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "admission": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "layers": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "independent": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "recovery-read": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "local-failure": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "runtime-boundaries": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "shadow-layers": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "local-clock": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "source-budgets": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "shadow-read-deadlines": "Measured with all six exported read-deadline histories and all six scheduled invariants at 2000 x 40: all pass. The profile imports flights but never calls recordInspectionAdmission or inspectProcess, so this inspection-only fault has no executed path."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M59",
        "text": "M59 is the native twin of counting each registered leader as an extra follower in the public process-coalescing snapshot.",
        "evidence": {
          "history": "dark-layers/inspectionTracksKeysFollowersAndOldestLeaderTest",
          "step": 8,
          "fields": [
            "d.inspections"
          ]
        }
      }
    },
    {
      "id": "inspection-age-uses-wall-clock",
      "contract": "C11",
      "source": "formal/kernel/flights.qnt",
      "model": "formal/dialcache-dark-layers-conformance.qnt",
      "invariant": "inspectionAgeUsesTheOldestLiveMonotonicStart",
      "before": "oldestLeaderAgeMs: if (registered.size() == 0) NO_LEADER_AGE else state.now - oldest",
      "after": "oldestLeaderAgeMs: if (registered.size() == 0) NO_LEADER_AGE else state.now + state.skew - oldest",
      "reproducer": {
        "kind": "exported-regression",
        "run": "inspectionIsPerInstanceAndUsesMonotonicTimeTest",
        "failure": "s.d.inspections == List({ instance: 0, activeLeaders: 1, activeFollowers: 0, oldestLeaderAgeMs: 1 })",
        "family": "process-inspection-clock",
        "profiles": [
          "dark-layers"
        ],
        "exclusions": {
          "effects": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "scope": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "recovery": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "policy": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "shadow": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "admission": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "layers": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "independent": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "recovery-read": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "local-failure": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "runtime-boundaries": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "shadow-layers": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "local-clock": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "source-budgets": "This profile does not call inspectProcess or compare public coalescing snapshots; the modified inspection helper has no effect on its histories.",
          "shadow-read-deadlines": "Measured with all six exported read-deadline histories and all six scheduled invariants at 2000 x 40: all pass. The profile imports flights but never calls recordInspectionAdmission or inspectProcess, so this inspection-only fault has no executed path."
        }
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M60",
        "text": "M60 is the native twin of subtracting the monotonic registration instant from the application wall clock in the public oldest-leader age.",
        "evidence": {
          "history": "dark-layers/inspectionIsPerInstanceAndUsesMonotonicTimeTest",
          "step": 6,
          "fields": [
            "d.inspections"
          ]
        }
      }
    },
    {
      "id": "shadow-read-deadline-ignores-bounded-result",
      "contract": "C54",
      "source": "formal/kernel/shadow-reads.qnt",
      "model": "formal/dialcache-shadow-read-deadlines-conformance.qnt",
      "invariant": "abortedReadsHaveEndedTheirResult",
      "before": "    finishReadResult(aborted, read, job)",
      "after": "    aborted",
      "reproducer": {
        "kind": "exported-regression",
        "run": "c0ReadDeadlineKeepsRawCapacityTest",
        "failure": "s.o.calls == List(VALUE_ONE) and s.o.shadow == List(\"redis_error\") and s.io.aborted == List(0)",
        "family": "shadow-read-deadline-ignores-bounded-result",
        "profiles": [
          "shadow-read-deadlines"
        ],
        "exclusions": {}
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M61",
        "text": "M61 is the native twin of this model fault. Both ports keep the read timer and cancellation but wait for the raw reply instead of consuming the bounded read error. The shadow-reads kernel fault records cancellation without ending that read result, and the generated C0 history detects the missing redis_error at exactly 5 ms."
      }
    },
    {
      "id": "shadow-read-deadline-releases-raw-capacity",
      "contract": "C54",
      "source": "formal/kernel/shadow-reads.qnt",
      "model": "formal/dialcache-shadow-read-deadlines-conformance.qnt",
      "invariant": "rawReadsKeepTheirRegistration",
      "before": "      expiredReads: state.expiredReads.append(read),",
      "after": "      jobs: state.jobs.select(other => other.source != job.source),\n      expiredReads: state.expiredReads.append(read),",
      "reproducer": {
        "kind": "exported-regression",
        "run": "c0ReadDeadlineKeepsRawCapacityTest",
        "failure": "s.o.reads == 1 and s.o.shadow == List(\"redis_error\", \"dropped\")",
        "family": "shadow-read-deadline-releases-raw-capacity",
        "profiles": [
          "shadow-read-deadlines"
        ],
        "exclusions": {}
      },
      "nativeMutants": {
        "kind": "mapped",
        "mutant": "M62",
        "text": "M62 is the native twin of this model fault. Both ports complete the bounded read error but release its shadow registration before the raw adapter operation settles. The kernel removes the same job while retaining the raw read, and the generated competing-key admission checkpoint detects the premature capacity release."
      }
    }
  ],
  "reproducerBacklog": [],
  "nativeMutantBacklog": []
}