K3 validation

Continuing WIP 68a51d7 against offline-kit spec 6049830 (discussion #5). The inherited implementations were explicitly no-op stubs, not working code.

2026-09-24: ran the inherited tests against those stubs before implementation. swift test failed on missing enqueues, sends, replacement ordering, status mapping and store writes. One inherited outbox test indexed an empty result and terminated the process. A separate filtered run of SyncStringsTests, SyncStatusTests, FaultingBlobStoreTests, and SealedStoreTests executed 24 tests with 78 failures (including missing sealed files). Local transcripts: /tmp/k3-kit-red.log, /tmp/k3-kit-red-rest.log.

After implementation, the storage/status/fault suite passed 32 tests and the drainer/catalog suite passed 18. make ci passed, including macOS and iOS companion builds, Go race tests, and Python bundle tests; transcript: /tmp/k3-kit-ci-1.log. This is intermediate evidence, not final K3 approval.

The continuation evidence below supersedes the intermediate status. Nothing has been merged or deployed.

Disk stop, 2026-09-24

Work stopped when df reported 1.2 GiB free (user's stop threshold: 1.5 GiB). Only session-created Docs build outputs and companion DerivedData were removed. The inherited .build directory in this worktree was preserved.

Additional focused evidence before the stop:

• Seal-count rotation and interrupted-rotation tests: both failed with the rotation call stubbed (/tmp/k3-rotation-red.log); all 14 sealed-store tests passed after restoring/fixing rotation (/tmp/k3-rotation-green-2.log).
• Independent-lane retry regression: failed with the first retry starving the next lane (/tmp/k3-lane-retry-red.log); all 15 drainer tests then passed (/tmp/k3-lane-retry-green.log).
• Fixed an inherited undeclared AppleTests → RastrilloTestSupport dependency: incremental builds could compile tests against a stale support module.
• Fixed an inherited test's unchecked empty-array indexing so stub failures produce an assertion instead of terminating the test process.

At that disk stop, the latest changes had not had another full make ci. The resumed local gate and later focused checks are recorded below.

Docs adoption is saved on oficina/docs feat/k3-outbox-lane, discussion #69. Its evidence file lists unresolved title/lifecycle issues and remaining gates.

Resume: status priority and concurrent close-save

Spec §3.4 gives session-ended priority 2 and empty priority 3. Pending entries already produced needsSignIn(n); the empty-session exception is now removed too. A concurrent drain now awaits the reserved batch's result, so close-save cannot mistake an in-flight batch for idle. New checks failed on the previous behavior (2 assertions, /tmp/k3-status-drain-red.log); all 20 status/drainer tests then passed (/tmp/k3-status-drain-green.log).

Reservation API rationale: load surfaces unavailable storage rather than an empty queue; entries includes held entries for offline replay; beginSend makes selection and reservation one actor operation so compaction cannot delete a batch in flight; endSend releases a retry/cancelled reservation without ack. No update or retarget API was added.

Final continuation evidence

• Full local make ci passed at 3e93ef916f2bb5469fd09375e0f6253938da8650, including Swift, macOS/iOS companion builds, Go race and Python bundle checks (/tmp/k3-kit-final-ci.log).
• A locked store must preserve its last known status. The new regression failed against the previous behavior (/tmp/k3-unavailable-status-red.log); all 21 drainer/status tests passed after the fix (/tmp/k3-unavailable-status-green.log). Explicit app enqueue failures still show cannotSaveOnDevice; unknown storage never masquerades as a known empty queue.
• The final-head make ci rerun is logged at /tmp/k3-kit-release-ci.log and its result/head is recorded on discussion #9.
• Hub CI at 3e93ef9 failed before compilation: Sparkle archive extraction could not find unzip. There is no macOS runner; the local macOS gate is authoritative for this task, as directed by the user.
• Docs now has real SIGKILL red/green proof and the parked-update port. Its replica/metadata/Home adoption and crash tests are on oficina/docs #69.

The only deliberate ordering difference is app-side discard removing the replica before its lane; exhaustive crash tests prove this prevents stranded unsent text. The prior empty-session status exception is removed. No merge or deployment.

Fable review follow-up (2026-09-24)

• testSealBlocksCacheStateAndSkipUnusedQuotaAfterCrash: failed against the inherited per-seal implementation (38 high-water assertions and two cache assertions); passes with 1024-slot reservations. Two process lifetimes consume 19 seals each, observe durable marks 1024/2048, and produce 38 distinct 96-bit nonces. A restart abandons 1005 unused slots; key rotation still counts reseals and keeps its previous key until completion. Complete file protection remains in every atomic write.
• testThrowingLaneDoesNotStarveOtherLanesAndEventuallyHolds: failed against the inherited drainer (only lane a called, three lanes remained, no hold, fourth throw); passes with b/c draining on the first attempt and a held after its third consecutive untyped throw. Returning a disposition or a typed transport error resets the throw streak.
• Full Swift suite: 119 tests passed. Red/green logs: /tmp/k3-native-review-{red,green}.log (ephemeral); observed assertions above are the durable record.
• Reservation API addition: entries(lane:excludingInFlight:) adds a filter to the existing snapshot, needed to deduplicate held metadata markers without suppressing a successor to a marker already being sent. No new mutation or reservation operation.
• Snapshot invariant is now documented: entries/summary can retain stale display/deduplication hints on unavailable storage; summary flags this, sendable fails closed, and load/beginSend/all mutations enforce availability before replay or changes.
• Corrected unavailable-send and Retry-After comments. The latter remains a deadline that neither connectivity nor Try again bypasses.