Executed verification / synthetic and theoretical inputs
Drawing release register
The actual browser client handlers were executed with a modeled DOM, native WebCrypto and a real HTTP/SQLite service. Their uploaded file and exported Blob bytes were checked through release and restore. Separate process-kill drills cover pending uploads and committed releases.
28 of 28 specified outcomes matched. Rejected overload and unsafe deployment cases are expected outcomes, not passing operating conditions.
Method
Each row identifies the method. Real HTTP, database, file and process checks are separate from modeled browser and deployment behavior. Inputs are synthetic. No customer deployment, physical device trial or production availability is claimed.
| Scenario | Expected | Observed | Method | Verification |
|---|---|---|---|---|
| Load actual author client session | Author workspace shown | author ยท author | Actual static/app.js event handlers in Node vm with minimal DOM adapter, native WebCrypto, real HTTP and SQLite | Matched |
| Hash and upload PDF through actual client submit handler | Verified revision 2 with source file SHA-256 | {"status":"verified","sha256":"39b9e35fbe3954d7963b7ae0f0a13052da058808f31427d92e6b7b0771f4e939"} | Actual static/app.js event handlers in Node vm with minimal DOM adapter, native WebCrypto, real HTTP and SQLite | Matched |
| Finish upload without leaving form disabled | Submit enabled and change field cleared | {"disabled":false,"note":""} | Actual static/app.js event handlers in Node vm with minimal DOM adapter, native WebCrypto, real HTTP and SQLite | Matched |
| Lose network after pending revision creation | Revision 3 stays pending and retry control appears | {"status":"pending","retry":true} | Actual static/app.js event handlers in Node vm with minimal DOM adapter, native WebCrypto, real HTTP and SQLite | Matched |
| Retry pending upload with wrong bytes | Rejected without verification | pending | Actual static/app.js event handlers in Node vm with minimal DOM adapter, native WebCrypto, real HTTP and SQLite | Matched |
| Retry pending upload using original file | Revision 3 verified once | verified | Actual static/app.js event handlers in Node vm with minimal DOM adapter, native WebCrypto, real HTTP and SQLite | Matched |
| Review and release latest uploaded file through client controls | Revision 3 released, prior release superseded | [{"number":3,"status":"released"},{"number":2,"status":"verified"},{"number":1,"status":"superseded"}] | Actual static/app.js event handlers in Node vm with minimal DOM adapter, native WebCrypto, real HTTP and SQLite | Matched |
| Prepare export through actual client click handler | Attached download anchor, JSON MIME and valid bundle | {"filename":"drawing-register-export.json","mime":"application/json","bytes":1081182,"attached":true} | Actual static/app.js event handlers in Node vm with minimal DOM adapter, native WebCrypto, real HTTP and SQLite | Matched |
| Restore exact JSON bytes produced by client export | History and released file hash preserved | {"drawings":2,"revisions":4,"objects":4,"release":"2009e2a0-48c9-4b4a-a187-86929567fea3"} | Actual static/app.js event handlers in Node vm with minimal DOM adapter, native WebCrypto, real HTTP and SQLite | Matched |
| Load reader session after release | Upload/release operations hidden and latest release readable | {"upload_hidden":true,"operator_hidden":true} | Actual static/app.js event handlers in Node vm with minimal DOM adapter, native WebCrypto, real HTTP and SQLite | Matched |
| Kill process and reuse prior session | 401; restart invalidates session cookies | 401 | Real child process, HTTP, native SQLite and local files with synthetic documents | Matched |
| Abrupt process loss after file upload before finalization | One pending stored file, no missing verified files | {"pending":1,"missing":0} | Real child process, HTTP, native SQLite and local files with synthetic documents | Matched |
| Finalize durable pending file after restart | 200 verified | verified | Real child process, HTTP, native SQLite and local files with synthetic documents | Matched |
| Kill after release transaction and restart | Revision pointer, review and prior history survive | {"release_version":2,"current":"8d7a214c-beed-4059-91d5-b9b4db3b2409","revisions":2} | Real child process, HTTP, native SQLite and local files with synthetic documents | Matched |
| Read released file after abrupt process loss | Original SHA-256 retained | 39b9e35fbe3954d7963b7ae0f0a13052da058808f31427d92e6b7b0771f4e939 | Real child process, HTTP, native SQLite and local files with synthetic documents | Matched |
| Export after restart and restore into a new directory | 3 objects and matching release, database integrity ok | {"drawings":2,"revisions":3,"objects":3,"integrity":"ok","elapsed_ms":17.559} | Real child process, HTTP, native SQLite and local files with synthetic documents | Matched |
| Change exported metadata without changing manifest | Restore refuses corrupt bundle | true | Real child process, HTTP, native SQLite and local files with synthetic documents | Matched |
| Restore cannot replace existing directory | Existing file preserved | preserve | Real child process, HTTP, native SQLite and local files with synthetic documents | Matched |
| Evaluate selected backup and restore schedule | RPO <=15 min and RTO <=15 min under declared timings | {"rpo_minutes":15,"rto_minutes":8} | Deterministic theoretical deployment calculation with declared inputs; no remote infrastructure is provisioned | Matched |
| Evaluate an old daily snapshot against 15 min target | Daily snapshot rejected | {"rpo_minutes":1440,"accepted":false} | Deterministic theoretical deployment calculation with declared inputs; no remote infrastructure is provisioned | Matched |
| Evaluate slow operator recovery | RTO breach visible | {"rto_minutes":33,"accepted":false} | Deterministic theoretical deployment calculation with declared inputs; no remote infrastructure is provisioned | Matched |
| Combine independent illustrative network, proxy and host availabilities | Product below 99.9%; no high-availability claim | {"component_availability":[0.999,0.999,0.995],"series_availability":0.993010995,"expected_minutes_per_30_days":301.9250159999997} | Deterministic theoretical deployment calculation with declared inputs; no remote infrastructure is provisioned | Matched |
| loopback reference with demo identities | Policy decision true | {"allowed":true,"scope":"Theoretical deployment policy, separate from the localhost application"} | Deterministic theoretical deployment calculation with declared inputs; no remote infrastructure is provisioned | Matched |
| public listener with demo identities | Policy decision false | {"allowed":false,"scope":"Theoretical deployment policy, separate from the localhost application"} | Deterministic theoretical deployment calculation with declared inputs; no remote infrastructure is provisioned | Matched |
| public listener without TLS | Policy decision false | {"allowed":false,"scope":"Theoretical deployment policy, separate from the localhost application"} | Deterministic theoretical deployment calculation with declared inputs; no remote infrastructure is provisioned | Matched |
| modeled private authenticated gateway | Policy decision true | {"allowed":true,"scope":"Theoretical deployment policy, separate from the localhost application"} | Deterministic theoretical deployment calculation with declared inputs; no remote infrastructure is provisioned | Matched |
| Evaluate 12 two-MiB PDF revisions | Fits 48 MiB export content limit | {"raw_bytes":25165824,"base64_json_bound":34603008,"estimated_working_bytes":94371840} | Deterministic theoretical deployment calculation with declared inputs; no remote infrastructure is provisioned | Matched |
| Seven maximum-size PDF revisions | Reference export limit rejects the aggregate | {"raw_bytes":73400320,"accepted":false} | Deterministic theoretical deployment calculation with declared inputs; no remote infrastructure is provisioned | Matched |
Reproduce
node complete.mjs
Operations and deployment decisions / Machine-readable checks and source hashes / Execution log
Evidence boundaries
- The client rehearsal models DOM events and download delivery; it does not claim an observed Chrome file-picker upload or operating-system download.
- The earlier Chrome run covers login, seeded release browsing and reconciliation.
- Remote identity, TLS and hosting are modeled as a deployment boundary. Public exposure of the demo server is rejected by the selected configuration.
- SIGKILL tests process failure, not sudden storage hardware loss. File and manifest digests detect corruption; they do not authenticate an untrusted export author.
Source notes
W3C Service Workers describes the lifecycle and cache contract used by the shell simulation. Node SQLite documentation describes the native database and backup API. The deployment capacity and recovery calculations use the declared inputs in deployment-inputs.json; they are assumption studies.