I read this as an independent adversarial verification of Todo 3 r10 only - I will inspect the mandated evidence and implementation, run the specified probes and quality gates, then write only the verification receipt.


focused_tests: 116 passed

canonical_regressions: 49 passed

static: ruff, ty, basedpyright, compileall, no-excuse, and direct LSP passed

signal_controls: SIGTERM/SIGINT before, inside, after, validation-pending, cleanup, and repair-temp substitution probes interrupted safely

manual_qa: parent capability, absent-only init, replacement repair, lock digest, privacy, topology, global history, and canonical-reader coexistence passed

severity: blocker

repro: Twice: after real stage mkdir, defer SIGTERM, rename the created stage aside, create a distinct empty 0700 directory at the stage name, then resume production code. Both runs raised _InitializationTerminated, preserved the moved original, and deleted the substituted inode.

impact: The initializer registers and cleans up a replacement inode rather than the inode created by mkdir, violating ownership registration and no-unowned-deletion guarantees.

needed_fix: Add deterministic SIGTERM/SIGINT RED coverage for stage-name substitution before the first post-mkdir open.

needed_fix: Do not infer ownership from a post-mkdir pathname. On this ambiguous same-UID rename gap, raise WeeklyOperationsAuthorityCompromise and preserve the suspect name, or explicitly narrow the threat model to cooperative namespace mutation.

needed_fix: Rerun r10 signal probes twice, 116 focused tests, 49 regressions, and quality gates.