M9 §14.13 release-gate evidence ledger (fuzz + soak)

[guyo13]

M9 §14.13 release-gate evidence ledger (fuzz + soak)

Umbrella tracking issue for the two passive M9 release gates. The M9 software is
complete (F1–F4 + differential, Miri, !Sync/dir-lock, soak harness, DoD audit §14.12.1);
what remains are the two gates that need dedicated runner time, not code. Each gate is
discharged by an evidence artifact commented onto this issue, not a checkbox — the JSON
is the sign-off. (Same discipline as the M8 gate issues.)

Both gates run from workflow_dispatch on the self-hosted fuzz-rig box. H1 power-pull is
tracked separately in #18 and is not part of this issue.

---

Gate 1 — Fuzz: ≥ 24 CPU-hours per target (§14.5 / §14.13, D11/D4/D5)

• PASS filed

Pass criteria (all must hold):

• ≥ 24 measured CPU-hours per target, for all four of recovery / decode /
  structure / model. "Measured" = real User+System CPU seconds from /usr/bin/time -v
  on a taskset-pinned dedicated core — not wall-clock × cores. (Shared/hosted runners
  cannot satisfy this; the gate workflow refuses them.)
• Zero crash artifacts. A crash reproducer in fuzz/artifacts/<target>/ is a real
  D4/D5/D11 bug, not a gate slip → see "Crash convention" below.
• Baseline: hours accumulated on the current on-disk format — HEAD at/after 2b198e7
  (the all-zero-header sentinel fix, the last format change). A format change resets the
  clock and requires a corpus regrow + cargo fuzz cmin first (see fuzz/README.md).
• Bounded-scan counter never exceeded (structural drift guard; the substantive D11 proof
  is the crash-free surface above).

How to run: Actions → "Fuzz gate (self-hosted, §14.13)" → Run workflow
(hours_per_target: 24). Attach the produced evidence/fuzz_gate.json as a comment
here; verdict must read PASS.

Evidence log:

• (comment fuzz_gate.json here; note the head SHA + per-target measured CPU-seconds)

---

Gate 2 — Soak: one multi-hour endurance run (§14.10 / §14.13)

• PASS filed

Pass criteria (all must hold), over one ≥ multi-hour run:

• Zero resource regression: fd count, segment-dir disk usage (incl. the per-checkpoint
  disk-floor assertion — a single unreclaimed segment fails on the first cycle), RSS, and
  commit-latency tails all within bound.
• Zero oracle violation: the §14.3 committed-set oracle holds on every recover
  (D1/D2/D3/D6/D7/D8).
• Crash model is process-crash (page-cache-survives), not power loss — this gate is
  endurance/leak detection, not a durability proof (power-loss durability is H1, M8/H1: power-pull durability — ≥50 cycles, zero acked loss (D1) #18).

How to run: Actions → "Soak (M9)" → Run workflow with runner: fuzz-rig and
seconds: a multi-hour value (e.g. 21600 = 6 h). Attach the produced
soak-evidence.json as a comment here.

Evidence log:

• (comment soak-evidence.json here; note the duration, seed, and that no regression/oracle
  breach occurred)

---

Crash convention (fuzz)

If the fuzz gate produces a crash artifact, it is a real bug, and this umbrella issue is
not the place to resolve it:

1. Save the reproducer as a corpus seed.
2. Open a dedicated investigation issue for that specific crash (mirrors how the M8
   §14.4d investigation threaded separately) — root-cause, fix, regression test.
3. After the fix lands, the fuzz clock restarts for that target (a parser/format change
   per the "since last format change" rule) → regrow + cmin + re-run the gate.
4. Only a clean ≥ 24-CPU-h/target run with zero crashes discharges Gate 1 here.

Definition of done for this issue

Both boxes ticked, both evidence JSONs filed with verdict: PASS / no-regression, head SHA
recorded. At that point the §14.12.1 / §14.13 fuzz + soak rows flip from contingent
(dedicated runner) to met at <SHA>, and M9 is release-gate complete (H1 tracked
separately in #18).

[guyo13]

{
  "gate": "soak",
  "seconds": 21600,
  "summary": {
    "seconds": 21600,
    "seed": 5995210576198893569,
    "ops": 93258735,
    "commits": 20522537,
    "checkpoints": 6529576,
    "recoveries": 6531212,
    "fd_baseline": 8,
    "fd_peak": 8,
    "disk_peak": 20480,
    "disk_bound": 65536,
    "rss_start": 3465216,
    "rss_end": 4091904,
    "rss_peak": 4091904,
    "commit_us_p50": 863,
    "commit_us_p99": 4959,
    "commit_us_p999": 7975
  },
  "verdict": "PASS",
  "timestamp": "2026-07-03T00:56:08Z"
}

https://github.com/guyo13/open-wal/actions/runs/28614334515/job/84854273328

[guyo13]

{
  "gate": "fuzz-cpuh-per-target",
  "baseline": "2b198e7",
  "head": "21d57779f5828da89c6af666f8f7eafcd013a72a",
  "hours_required_per_target": 24,
  "accounting": "real User+System CPU seconds, taskset-pinned, dedicated vCPU",
  "scratch": "tmpfs (WAL segment scratch in RAM; recovery logic identical to disk-backed — disk durability is H1, not this gate)",
  "runner": "self-hosted fuzz-rig",
  "targets": [
    {
      "target": "recovery",
      "cpu_seconds": 85822,
      "crashes": 0,
      "cpu_ok": true,
      "crash_ok": true
    },
    {
      "target": "decode",
      "cpu_seconds": 86227,
      "crashes": 0,
      "cpu_ok": true,
      "crash_ok": true
    },
    {
      "target": "structure",
      "cpu_seconds": 86082,
      "crashes": 0,
      "cpu_ok": true,
      "crash_ok": true
    },
    {
      "target": "model",
      "cpu_seconds": 86113,
      "crashes": 0,
      "cpu_ok": true,
      "crash_ok": true
    }
  ],
  "verdict": "PASS",
  "timestamp": "2026-07-04T07:57:13Z"
}

https://github.com/guyo13/open-wal/actions/runs/28646828202/job/84955328062