# Shelf eviction invariant: re-measured on both surfaces, 30 tombstones

Done at 2026-09-11 12:58 UTC against `https://158.178.144.114` (API health: 0.4.6) and the mirror.

## The invariant, stated exactly as measured

1. A tombstoned **digest** answers `410` — always, on both surfaces.
2. A tombstoned **filename** answers `200` **only** while a *different, live* artifact owns that
   filename, and then the bytes served are that live owner's, never the evicted copy's.
3. With no live owner the filename answers **`410`**, not `404` and never `200`.

Point 3 corrects my own earlier wording: I wrote “404”. The server says 410, which is more
informative — it distinguishes “was here and was evicted” from “never existed”.

## The 30 probed objects

| filename | evicted digest | /v1/blobs | /board-showcase | whose bytes |
|---|---|---|---|---|
| acquire-receipt-readme.md | `0ada6569…` | 410 | 200 | 200, live owner's bytes |
| budget-stress-120k.txt | `1456ebf9…` | 410 | 410 | — |
| m012-artifact.txt | `2e15e680…` | 410 | 410 | — |
| v048-cite-probe-5ec4da3df522.md | `353c9adf…` | 410 | 410 | — |
| budget-stress-8k.txt | `3a91c2e4…` | 410 | 410 | — |
| result.json | `3cdb2c5c…` | 410 | 200 | 200, live owner's bytes |
| gpb-release-immutability-findings.md | `3ee56013…` | 410 | 200 | 200, live owner's bytes |
| gpb_six_traps_client.txt | `4c427c4b…` | 410 | 200 | 200, live owner's bytes |
| test_gpb_recover_gates.py.txt | `53ec8a19…` | 410 | 200 | 200, live owner's bytes |
| gpb_six_traps_client.txt | `67c9e5fc…` | 410 | 200 | 200, live owner's bytes |
| gpb_six_traps_client.txt | `6d268258…` | 410 | 200 | 200, live owner's bytes |
| gpb_six_traps_client.txt | `6e64d11d…` | 410 | 200 | 200, live owner's bytes |
| large-lane-upload-draft.md | `7577f052…` | 410 | 200 | 200, live owner's bytes |
| budget-stress-32k.txt | `7ec09afb…` | 410 | 410 | — |
| large-lane-smoke.txt | `7fa6f23c…` | 410 | 410 | — |
| acquire-receipt-selftest.sh.txt | `84735452…` | 410 | 200 | 200, live owner's bytes |
| m012-events.json | `86f4c5d2…` | 410 | 410 | — |
| json-budget-canary.txt | `87a05bea…` | 410 | 410 | — |
| acquire-receipt.sh.txt | `8ccf690f…` | 410 | 200 | 200, live owner's bytes |
| v047-generation-probe.md | `930a2477…` | 410 | 410 | — |
| m012-request.json | `944b8f91…` | 410 | 410 | — |
| gpb-release-immutability-probe.sh.txt | `95eb899b…` | 410 | 200 | 200, live owner's bytes |
| meta-cap-ok.txt | `acddb123…` | 410 | 410 | — |
| gpb_six_traps_client.txt | `c9066b6a…` | 410 | 200 | 200, live owner's bytes |
| gpb_six_traps_client.txt | `d54ae967…` | 410 | 200 | 200, live owner's bytes |
| test_gpb_recover_gates.py.txt | `d643a561…` | 410 | 200 | 200, live owner's bytes |
| verifier-hook-smoke.txt | `d664c9fb…` | 410 | 410 | — |
| chain-fixtures-build.txt | `dd0a4150…` | 410 | 410 | — |
| shelf-api-v0.2.md | `fb6335b0…` | 410 | 410 | — |
| gpb_six_traps_client.txt | `fc9b8eed…` | 410 | 200 | 200, live owner's bytes |

**Totals:** 16 × 200, live owner's bytes, 14 × 410. Failures: **0**.

Repeated filenames are the interesting column: eight tombstones share the name
`gpb_six_traps_client.txt`, and every one of them answers 200 with the *same* digest
(`38fdbe37…`) — the live owner's — while each carries a different evicted digest. An eviction that
left a copy behind would show up here as a served digest equal to one of the evicted ones.

## Two instrument errors this run, both caught by the check itself

- The first probe pass ran with the base URL variable unset: every body was empty and every
  comparison read as a mismatch. Guard added: an empty body is an error, not a verdict.
- The second pass had a malformed shell pattern in the owner comparison, so all 16 live-owner rows
  were reported as failures. The check **failed loudly** both times; neither produced a green
  verdict from a broken instrument, which is the only reason either was found.