[engine-audit][P2-cluster] Persistence robustness

[100yenadmin]

Cluster theme

Persistence-robustness defects: check_* tools and world_tick save unconditionally (live-pointer flips — the #640 class; a 4th site found); tolerant-load drops unknown keys then the next save destroys them permanently (write-once fixed-name backup needed); enumerators use the strict parse only so tolerant-loadable campaigns turn invisible; and one torn session-log line bricks recap/resume until hand-repair.

This is a P2 cluster from the WorldOS full-engine adversarial audit (2026-06-11). Every finding below was skeptic-verified at engine HEAD a245a2c and has a full implementation-ready spec (root cause with file:line, evidence, fix spec, test strategy) in the per-unit deep sections (Part C) of the audit report — work the cluster as a wave or split per-finding as it gets scheduled.

Findings

F8-2: check_* tools save unconditionally; any cross-campaign evaluation flips the live pointer — CORRECTED (P1 → P2)

severity: P2 (downgraded from P1) | confidence: high (mechanism, re-proven) / med (production frequency) | effort: S-M Skeptic verification on HEAD: unconditional save_campaign(c) confirmed at server.py:7313 (check_consequences), 7501 (check_companion_arc), 8227 (check_faction_arcs) — all reached with zero results; scene_context delegates to check_companion_arc at server.py:9128 every beat. Probe: one zero-mutation load+save of camp_A flipped active_campaign_id from camp_B to camp_A. Also found: world_tick saves unconditionally too (server.py:7344) — any fix at the tool level must include it; the chokepoint …

F8-3: tolerant-load drops unknown keys; next save destroys them permanently — CONFIRMED, spec CORRECTED

severity: P2 | confidence: high | effort: S Skeptic verification on HEAD: store.py:142-170 drops + warns (log-only, invisible at the table); save_campaign:128 rewrites current-schema-only. Probe: inject future_field_from_newer_engine → load OK → save → key gone from disk. tests/test_store.py pins load success only, never load→save. Fix spec CORRECTION: the filed spec self-contradicts — "copy to snapshot.pre-tolerant.<ts>.json if absent" is never absent when the name embeds a fresh timestamp (→ unbounded backups, one per tolerant load). Corrected shape: fixed filename …

F8-4: enumerators use the STRICT parse only — tolerant-loadable campaign invisible to resolver/listings — CONFIRMED

severity: P2 | confidence: high | effort: S Skeptic verification on HEAD: bare Campaign.model_validate_json + except Exception: continue confirmed at store.py:253 (list_campaigns), 272 (campaigns_for_world), 313-315 (active_campaign_id); player_server.py:58-62 sits atop list_campaigns. Probe: unknown-key snapshot → load_campaign True; list_campaigns excludes it; active_campaign_id resolves the OTHER campaign; campaigns_for_world empty. Two divergent definitions of "loadable" with the #640-authoritative resolver on the narrower one — exactly as filed. Fix spec: AS FILED (shared _load_summary using the SAME …

F8-5: one torn session-log line poisons read_log/read_log_all until hand-repair — CONFIRMED

severity: P2 | confidence: high | effort: S Skeptic verification on HEAD: read_log (store.py:335-344) per-line model_validate_json with no tolerance; append_log (328-332) blind append. Probe: torn final line → read_log raises ValidationError, read_log_all raises, recap_from_store raises (recap.py:77 → read_log); start_session's recap read (server.py:7057-7059) and _scene_recent_narration → read_log_all (server.py:~9044) sit on those exact paths. Amplifier re-proven: next good append concatenates onto the unterminated line (one line containing both) — poison grows. Torn lines are plausible on this fleet …

Issue refs appearing in the findings' dup/related lines: #741, #640, #165

---

Findings: F08-2, F08-3, F08-4, F08-5 | effort/confidence: per-finding tags above
Source: docs/audits/ENGINE-AUDIT-2026-06-11.md (PR #768), unit(s) 08 — Part C per-finding deep sections hold the full specs.