feat: checkpoint compact ordinary source and lossless default preservation

harness/experiments/default-production-20260913/README.md

@@ -0,0 +1,16 @@
+# Incomplete production verification checkpoint
+
+Read [the report](../../text-default-omission-production-20260913.md) before using
+this contribution. `evidence.zip` retains two source ZIPs and manifests, the
+focused success, the disk-limited broad build, independent execution of completed
+test binaries, teaching regeneration/rerun, reviews and strict documentation
+receipts. It does not establish complete core, desktop, service or release
+acceptance. Original failures are retained.
+
+Run `python -B verify.py` here for read-only integrity/outcome checks. The outer
+`files.json` pins this archive; `capture-files.json` inside the ZIP pins its
+members. `candidate/inputs.json` identifies the final checkpoint's Git-visible
+source inputs; that candidate differs from executed captures as the report
+explains. Obtain those candidate files from the same Git commit as this archive.
+Producer scripts retain machine-local paths and need adaptation for new runs.
+No binaries are distributed; their hashes are execution receipts.

harness/experiments/default-production-20260913/files.json

@@ -0,0 +1,18 @@
+{
+  "candidate/inputs.json": {
+    "bytes": 102567,
+    "sha256": "8e5019d9e207735211518c7bc54f93483266cb2d3837aa7e22f2bf551972118d"
+  },
+  "evidence.zip": {
+    "bytes": 4964802,
+    "sha256": "cec613e8669797c74ce1e2b37526cb0050590e1fe10eb4ef1dbef94b0a958d90"
+  },
+  "README.md": {
+    "bytes": 1025,
+    "sha256": "612c6d37ce1c7ba871e1a0a13c459c28abba180e237415d3ceb4e89e0424ca44"
+  },
+  "verify.py": {
+    "bytes": 4295,
+    "sha256": "66c227c2e6f9d16364f30597aa2ca7496bed7e5fe68c9d914d30d9a5e651f718"
+  }
+}

harness/experiments/default-production-20260913/verify.py

@@ -0,0 +1,57 @@
+from pathlib import Path
+import hashlib
+import io
+import json
+import re
+import zipfile
+
+root = Path(__file__).resolve().parent
+def digest(data): return {'bytes':len(data), 'sha256':hashlib.sha256(data).hexdigest()}
+def require(ok, message):
+    if not ok: raise SystemExit(message)
+manifest = json.loads((root / 'files.json').read_text())
+actual = {p.relative_to(root).as_posix() for p in root.rglob('*') if p.is_file() and p.name != 'files.json' and '__pycache__' not in p.parts}
+require(actual == set(manifest), 'Outer membership mismatch')
+for name, expected in manifest.items(): require(digest((root/name).read_bytes()) == expected, f'Outer hash: {name}')
+with zipfile.ZipFile(root / 'evidence.zip') as evidence:
+    def read(name): return json.loads(evidence.read(name))
+    payloads = read('capture-files.json')
+    require(set(evidence.namelist()) == set(payloads) | {'capture-files.json'}, 'Capture membership mismatch')
+    for name, expected in payloads.items(): require(digest(evidence.read(name)) == expected, f'Capture hash: {name}')
+    for gate, status in [('production-focused-1',0),('production-core-1',101)]:
+        result = read(gate+'/result.json')
+        require(result['exitCode'] == status and result['inputsUnchanged'], f'{gate}: outcome')
+        require(all(result[k] == v for k,v in read(gate+'/started.json').items()), f'{gate}: start')
+        for key, file in [('inputs','inputs.json'),('archive','inputs.zip'),('stdout','stdout.log'),('stderr','stderr.log')]:
+            require(digest(evidence.read(gate+'/'+file)) == result[key], f'{gate}: {key}')
+        require(digest(evidence.read('gate-policy.py')) == result['helper'], f'{gate}: runner')
+        inputs = read(gate+'/inputs.json')
+        require(len(inputs) == result['inputCount'], f'{gate}: input count')
+        with zipfile.ZipFile(io.BytesIO(evidence.read(gate+'/inputs.zip'))) as sources:
+            require(set(sources.namelist()) == set(inputs), f'{gate}: source membership')
+            for path, expected in inputs.items(): require(digest(sources.read(path)) == expected, f'{gate}: source {path}')
+    def totals(prefix, filenames):
+        rows = [tuple(map(int,m)) for f in filenames for m in re.findall(r'test result: (?:ok|FAILED)\. (\d+) passed; (\d+) failed; (\d+) ignored;', evidence.read(prefix+f).decode())]
+        return tuple(sum(row[i] for row in rows) for i in range(3))
+    require(totals('production-focused-1/', ['stdout.log']) == (75,0,0), 'Focused totals')
+    require(b'No space left on device' in evidence.read('production-core-1/stdout.log'), 'Missing disk failure evidence')
+    built = read('production-built-tests-1/results.json')
+    compiler = {r['cargo']['target']['name']:r for r in read('production-core-1/result.json')['artifacts']}
+    require(len(built) == 36, 'Built test inventory')
+    for run in built:
+        name = run['name']
+        require(run['binary'] == compiler[name]['readback'], f'{name}: binary receipt')
+        for stream in ['stdout','stderr']:
+            require(digest(evidence.read(f'production-built-tests-1/{name}.{stream}.log')) == run[stream], f'{name}: stream')
+    require(totals('production-built-tests-1/', [r['name']+'.stdout.log' for r in built]) == (354,2,1), 'Built test totals')
+    receipt = read('production-built-tests-1/receipt.json')
+    require(receipt['inputsUnchanged'] and receipt['testsRun'] == 36, 'Execution receipt')
+    teaching = read('production-teaching-1/result.json')
+    require(teaching['nonSourceFilesUnchanged'] and len(teaching['changed']) == 29, 'Teaching delta')
+    require(all(p.endswith('.arcadia') for p in teaching['changed']), 'Non-source teaching change')
+    for run in teaching['runs']:
+        require(run['exitCode'] == 0 and run['binary'] == compiler[run['name']]['readback'], 'Teaching runner receipt')
+    require(totals('production-teaching-1/', ['release1_teaching.stdout.log']) == (4,0,0), 'Teaching rerun')
+    require(read('language-doc-3/result.json')['warnings']['bytes'] == 0, 'Documentation warnings')
+print('Verified captures: focused 75 pass; disk-limited build; separately executed 354 pass/2 fail/1 ignored; teaching rerun 4 pass.')
+print('Final candidate still needs corrected anchor test, full core, strict Clippy, native/public-consumer and release verification.')