I read this as an adversarial verification of Todo 3 r8 only - I will reproduce the required seams, validate evidence and code, then write only the independent verification receipt.


routing: I read this as adversarial verification - recorded the r8 verdict and exact repros.

focused_tests: 92 passed

canonical_regressions: 49 passed

static: ruff, ty, basedpyright, compileall, no-excuse, and direct LSP passed

normal_initializer_races: exactly one winner, typed loser, sealed inventory, zero normal residue

repair_standard_cases: healthy/absent/corrupt/missing-lock/multiple-tail rejections and valid one-tail repair passed

severity: blocker

repro: Rename/recreate the parent after _open_parent/flock and before stage mkdir. Initialization returns a binding in the detached parent; fresh open at bootstrap_path fails.

needed_fix: Use a caller-held, identity-bound parent authority; do not claim pathname atomicity under uncooperative parent rename.

repro: Replace the exchanged cleanup stage name after final identity verification and before rmdir. The initializer deletes the unowned replacement and returns success.

needed_fix: Remove check-then-rmdir ownership claims; require an immutable/cooperatively locked parent namespace or preserve a typed cleanup incident.

repro: Replace the selected data pathname after repair validation and before ftruncate. Repair detects drift afterward but truncates the detached original inode.

needed_fix: Do not in-place truncate under arbitrary child-name substitution; establish a namespace authority or redesign the repair contract.

severity: high

repro: Change lock-file bytes after repair issuance without changing its inode metadata. Repair succeeds and mutates data.

needed_fix: Bind and revalidate canonical lock size/digest under flock.