# Eve delivery fault-game preparation — Task 11.5

**Date:** 2026-09-13  
**Contract:** `eve.delivery-fault-game.v1` / preparation-frozen `1.0.0`  
**Admission:** blocked by Task 11.11; Task 11.5 remains open

## Decision

The Task 11.5 failure matrix now has one fail-closed, provider-free preparation
lane. It exercises all eleven named disruptions with real local Git operations
or real operating-system process groups. Every scenario plants an uncommitted
operator-owned note in a separate primary clone and compares both its Git status
and SHA-256 before and after the fault. A scenario passes only when the fault
was actually observed, success was withheld during the fault, and the final
state is recovered, reverted, or backed by a specific resumable checkpoint.

This is preparation, not admission. Task 11.11 is still open and the current
workbench `WorkItemRow` does not carry the required `goalRevisionId`,
`planRevisionId`, `requirementRefs`, `dependencyRefs`, and
`verificationPlanRefs` lifecycle bindings. Controlled fixtures cannot substitute
for their durable service-boundary invalidation and recovery. Consequently this
lane produces no Task 11.5 closure manifest, no direct gap-matrix evidence
mapping, no live-fleet count, and no `verified` claim.

## Faults exercised

| Fault                    | Live injection                                                                                                                                                     | Truthful recoverable end state                                                                                                    |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------- |
| conflict                 | Two clones commit different content to the same tracked line; `git merge` reports an unmerged path                                                                 | The merge is aborted with the task commit unchanged, then explicitly resolved with both edits and pushed                          |
| moving `origin/main`     | A competing clone advances the bare remote after the candidate commit                                                                                              | The first push is rejected; the remote head is fetched and merged without force, and the second push retains both changes         |
| failed hook              | An executable `pre-push` hook exits nonzero with a probe marker                                                                                                    | The candidate commit remains local and the remote does not move; after correcting the hook the same commit pushes                 |
| flaky/provider-sick test | A controlled dependency double returns an unavailable outcome, followed by two healthy runs                                                                        | No green is claimed for the unavailable attempt; two stable passes are required for recovery                                      |
| pre-existing failure     | The same deterministic failure is measured before and after a candidate-only change                                                                                | Its output digest and nonzero outcome remain attributed as pre-existing while the targeted candidate check is reported separately |
| dependency outage        | A resumable worker starts while its dependency marker is absent                                                                                                    | The empty checkpoint survives; restoration applies the candidate operation exactly once                                           |
| partial commit           | One task file is committed while another remains untracked                                                                                                         | The partial state is detected, no push is attempted, and both exact byte sets remain available                                    |
| agent crash              | A detached child writes task state and is killed with `SIGKILL`                                                                                                    | The process group is gone while the task file and checkpoint remain                                                               |
| budget/kill switch       | Two detached children are independently stopped with `SIGTERM`, once for budget exhaustion and once for an operator kill switch, before either completion sentinel | No success is reported, neither process survives, and both bounded-work checkpoints remain                                        |
| revert                   | A candidate commit is pushed and then reverted by a competing clone                                                                                                | Candidate content is absent at remote HEAD while both candidate and revert commits remain ancestors                               |
| resume                   | Attempt one exits after operation `alpha` and a durable checkpoint                                                                                                 | Attempt two applies only `beta`; neither operation duplicates and the original two-attempt budget remains in force                |

## Evidence integrity

The frozen policy binds the governing instructions, Task 11.5 ledger clause,
ADR-0076, Task 11.3 repository-execution contract, the existing fleet-drain
recovery primitives, the current work-item persistence surface, and every source
of this preparation lane by SHA-256. The retained measurement is evaluated by
scenario-specific predicates rather than summary booleans. The semantic verifier
also compares the exact scenario order and admission boundary, checks canonical
timestamps and host cleanup claims, and rejects stale source bindings.

Negative controls independently remove a scenario, mutate operator work, hide a
real conflict, discard an upstream commit, lose a hook-blocked commit, fabricate
green around flaky or pre-existing failure, discard an outage checkpoint, push a
partial commit, leave a crashed or stopped process alive, erase revert history,
duplicate resumed work, grant dependency admission, stale a source binding,
weaken the policy inventory, corrupt measurement time, or remove cleanup
evidence. Each control must make the retained verifier red before the final
green regression.

## Exact limitations

- Git operations use real local clones and a real bare remote, but not the live
  GitHub repository. No force push is used.
- Dependency and provider failures use deterministic local doubles. No external
  provider outage is induced and no coding model is run.
- Process supervision uses real detached Linux process groups, but it does not
  prove fleet authorization, tenant isolation, or durable database restart.
- The lane demonstrates recoverability of controlled task and operator state. It
  does not prove Task 11.11 revision invalidation, independent fleet review, or
  a production incident response.
- Task 11.5, Phase 11, and G12 remain open.