I read this as an independent adversarial verification of Todo 3 r7 only - I will inspect the plan, prior evidence, implementation, tests, and repository state; execute the required repros and gates; then write only the requested verification evidence and cleanup receipt.


verdict: needs-fix

scope: Todo 3 r7 atomic initializer and global history validation

severity: blocker

class: atomic-publication-race

exact_repro: Two event-synchronized initializers against one exact-empty destination both return; one returned binding fails fresh open and one .weekly-operations-init-* residue remains. A stage-name substitution before rename also returns a binding for an empty destination with a mismatched inode.

needed_fix: Serialize initialization, bind publication/cleanup to verified inode identity, reconcile destination identity before returning, and add concurrent/source-substitution/cleanup-race regressions.

class: repair-capability-overreach

exact_repro: A repair authority accepts a healthy history with RepairResult(1, 0); an absent selected history returns RepairResult(0, 0) and creates a 0600 lock file.

needed_fix: Issue repair authority only for one existing selected incomplete final fragment, bind its file identity/offset, reject zero-byte repairs, and never create files on repair.

focused_tests: 77 passed

canonical_regressions: 49 passed

global_history: All normal authority use validates every customer through the same full history validator before mutation.

static: ruff, ty, basedpyright, compileall, no-excuse, and LSP all confirmed clean.

canonical_hashes: models.py and store.py match prior audited hashes.

cleanup: No target stage/cache residue remains.