# OPS-001A durable operation verification

Updated: 2026-08-02

Status: `IMPLEMENTED — NOT VERIFIED`. State, ownership, concurrency and SQLite migration checks pass. Executable MariaDB and production checks remain unavailable.

## Evidence

| Check | Result |
|---|---|
| `dotnet test ... --filter "FullyQualifiedName~UserOperationStoreTests"` | PASS — 7/7 real SQLite |
| Full backend suite | PASS — 539/539 |
| `dotnet ef migrations has-pending-model-changes ... --no-build` | PASS — no pending model changes |
| SQLite/MariaDB migration scripts from canonical-identity migration to `AddUserOperations` | PASS — create + unique/claim indexes; MariaDB uses eight `datetime(6)` fields and no `TEXT`/`longtext` |
| SQLite/MariaDB down scripts | PASS — both drop only `UserOperations` |
| Disposable existing SQLite upgrade, down, and re-upgrade | PASS |
| Fresh disposable application startup on 5307, followed by EF no-op update | PASS — health 200; database already current; exact PID stopped and port closed |

Tests cover owner-scoped idempotency, same key across owners, concurrent duplicate creation, concurrent claim exclusion, bounded lease recovery/final failure, running cancellation recovery, cross-owner mutation denial, retry delay, successful completion, terminal cancellation refusal, deadlines, input bounds and neutral/owner scope guards.

Generated evidence is under `docs/audits/evidence/ops-001a/`: `sqlite-up.sql`, `sqlite-down.sql`, `mariadb-up.sql`, `mariadb-down.sql`, disposable `upgrade.db`, and `fresh-runtime/`. All data is synthetic and local.

## Limitations and rollback

- MariaDB SQL was generated and inspected but not executed against a server.
- No handler, queue worker, notification, owner API, browser UI or production canary is active yet.
- No raw private payload field exists; later producers still require task-specific subject/policy validation.
- Stop producers/workers and drain/cancel rows before `Down`. The migration is additive on upgrade and drops only this new table on rollback.