\section{Preliminary Evaluation}
\label{sec:evaluation}

Evaluation must follow the paper's dependency order. The primary claim concerns
whether an observer declaration makes a perspective reproducible, auditable,
and actionable. Evidence for a fact substrate or recovery mechanism is
necessary but cannot substitute for that observer-level result. The present
implementation evaluates two prerequisites: a verifiable Episode authority and
a single-host continuity substrate that does not infer readiness from process
liveness. The complete multi-machine observer view remains unevaluated. We keep
evidence from different source revisions separate rather than combining it into
one imaginary run.

\subsection{Questions and method}

The evaluation program asks:

\begin{itemize}[leftmargin=*]
  \item \textbf{RQ1:} Can two human- or agent-facing surfaces reproduce the
        same declared view from its observer, accepted cut, policy, causality,
        consequence position, and degradation metadata? This remains future
        work.
  \item \textbf{RQ2:} Does declaration expose hidden ordering assumptions,
        missing evidence, and differences in safe next action that an
        undeclared global-looking timeline hides? This remains future work.
  \item \textbf{RQ3:} Does the Episode path preserve the causal identity,
        evidence, recovery, and safe-capability semantics needed by an accepted
        fact cut?
  \item \textbf{RQ4:} Can runtime readiness be bound to exact authority and
        projection cuts rather than inferred from process existence?
  \item \textbf{RQ5:} Can a replacement coordinator reject stale authority,
        rebootstrap surviving Peers at an accepted cut, and expose recovery
        instead of false continuity?
\end{itemize}

Kungfu's Episode qualification harness drives the public Python storage service
backed by the C++ implementation. A structurally independent Python oracle
models abstract lifecycle and evidence transitions without importing Kungfu or
reading journal bytes. The current semantic profile compares production
observations with the oracle and requires every named evidence dimension,
including capability soundness, to execute and pass
\cite{kungfu2026episode}.

Runtime activation uses a separate retained report. It binds clean source and
tree revisions, platform, exact commands, suite results, raw-log hashes, and
explicit non-claims \cite{kungfu2026runtimequalification}. Peer continuity and
runtime upgrade use their own contracts and campaigns. Passing one layer does
not upgrade a claim owned by another.

\subsection{Observer-level evaluation program}

The direct test of KFD-4 should begin with one shared causal scenario and vary
the observer declaration. At minimum, a local operator, remote worker, release
reviewer, and recovery agent should receive controlled overlaps and gaps in
their accepted fact cuts. The experiment should compare an undeclared
wall-clock timeline with declared projections that preserve the same known
causality.

The primary measures are deterministic reproduction from exported metadata,
causal-order preservation under clock skew, hidden assumptions found during
audit, evidence gaps surfaced rather than silently repaired, and the ability of
humans and agents to identify a justified next action or refusal. This last
measure is necessary: a view may be factually reproducible yet fail to expose
the value and constraints needed for cooperation.

No current result in this paper completes that program. The remaining
subsections report prerequisite evidence and preserve that qualification.

\subsection{Episode semantic evolution}

The historical numerical baseline used the v1 Trust Report at clean revision
\texttt{b6961891731b}. It predated the complete safe-capability contract, so its
unexercised capability dimension is not reinterpreted after the fact. The later
C++ fold/fsck path emits \texttt{kungfu.episode.qualification/v1}; current
Semantic v1 fixtures compare the exact safe-capability set across healthy,
open, ended, aborted, degraded, and failed states. Both over-advertising and
unnecessary contraction fail the required \texttt{capability\_soundness}
dimension.

The distinction illustrates the paper's evidence rule. A stronger current
contract can close a previously identified gap, but it does not mutate an older
report. Trust starts from the source-bound facts available for each claim.

The current Episode query path is manifest-direct. Earlier prototype text
described an absent/stale/rebuilt SQLite Episode projection; current public
qualification explicitly states that rebuilding a source-registry SQLite index
is not an Episode projection rebuild. Projection derivation therefore remains a
required semantic property and an implementation gap for a future dedicated
Episode projection.

\subsection{Historical scale and contention evidence}

The metadata accumulation result from revision \texttt{b6961891731b} is shown
in Table~\ref{tab:episode-scale}. The run used \texttt{darwin/arm64}, Node
22.22.3, 20 logical CPUs, 128 GiB RAM, and one reported seed for the largest
tables.

\begin{table}[ht]
\centering
\small
\begin{tabular}{rrrrrr}
\toprule
Episodes & Ingest/s & List & Fsck & Inspect p95 & RSS \\
\midrule
1,000 & 1,670 & 40 ms & 9 ms & 1.1 ms & 54 MB \\
10,000 & 937 & 444 ms & 82 ms & 11.0 ms & 115 MB \\
100,000 & 316 & 4.20 s & 804 ms & 87.5 ms & 698 MB \\
\bottomrule
\end{tabular}
\caption{Historical metadata-only Episode accumulation baseline.}
\label{tab:episode-scale}
\end{table}

At 100,000 retained Episodes, all 100,000 objects and 200,000 semantic Episode
records matched after fresh-process readback. Clean recovery found no
interrupted Episode. The physical manifest contained 200,002 frames; the two
additional page-control frames were accounted for separately rather than
misclassified as semantic records.

The contention profile kept total work fixed at 10,000 Episodes while using
one, two, five, and ten physical writers. Aggregate ingest ranged from 1,143 to
1,230 Episodes/s. At ten writers, 8,252 explicit writer-busy results were
retried; none exhausted the retry bound, and the run reported no count,
readback, fsck, recovery, unexpected-error, or progress-timeout violation.

These observations support a bounded correctness claim, not a capacity promise.
Throughput did not scale with writer count, whole-manifest costs increased with
retained population, the workload was metadata-only, and only one of three
declared baseline seeds supplied the largest tables.

\subsection{Exact-cut activation evidence}

The current retained runtime report is bound to clean Kungfu revision
\texttt{b325b97392e6} on Darwin arm64. It passed all eight required suites:
activation Core, product distribution, Profile action admission, runtime
surface parity, bounded performance observation, frozen-product runtime smoke,
full product verification, and product catalog verification
\cite{kungfu2026runtimequalification}.

The activation Core suite exercises daemonless storage, direct no-fork
coordination, exact-cut readiness, first-call serialization, generation
replacement, crash windows, lease expiry, and idle drain. Native readiness
coordinates are published only after durability and projection authorities
establish the requested cut. Consumers revalidate those authorities; descriptor
bytes and process liveness are not promoted to readiness proof.

This supports a named-platform single-host claim: the implementation can bind a
runtime incarnation to semantic readiness and a projection cut. It does not
establish distributed election, cross-machine leases, high availability,
physical-host power-loss recovery, Linux or Windows product qualification, or a
universal latency SLO.

\subsection{Peer continuity and upgrade evidence}

The Peer-continuity implementation includes native contract tests, Python
runtime tests, Agent Session transport tests, and a process campaign covering
coordinator kill/restart, stale and future authority rejection, projection
rebootstrap, and product-visible failure handling
\cite{kungfu2026peercontinuity}. Stages 1--3 of the implementation are complete.
The macOS process campaign passes locally, while retained Linux and Windows
execution remain promotion boundaries. We therefore treat it as strong
implementation evidence for the continuity-witness model, not as a
cross-platform or cross-host qualification result.

The versioned upgrade control plane similarly has a registered contract,
negative fixtures, and Python tests for immutable runtime installation,
generation-fenced planning, activation, rollback, and reference-aware garbage
collection \cite{kungfu2026upgrade}. The implementation is staged. Signed
platform distribution, public product messaging, and native fault campaigns
remain outside the present evidence. The paper consequently claims that the
system can represent policy/runtime transitions explicitly, not that every
desktop upgrade path is qualified.

\subsection{Remaining end-to-end evaluation}

The observer-declared timeline claim still requires the following case studies:

\begin{itemize}[leftmargin=*]
  \item \textbf{Remote agent work.} An agent performs a task on a server while
        the user later reviews the work from a local GUI.
  \item \textbf{Multi-machine sync.} Facts from local and remote runtimes are
        imported with different freshness boundaries and causal completeness.
  \item \textbf{Observer replacement.} A successor exports a continuity
        witness, reproduces the predecessor view at a selected cut, and then
        advances without accepting stale authority.
  \item \textbf{Policy upgrade.} The same accepted fact set is projected under
        two declared policy versions, with semantic difference made visible.
  \item \textbf{Replay and debugging.} A user or agent reconstructs why a task
        reached a given state after partial failure.
\end{itemize}

The corresponding measures include recovery time, hidden-ordering assumptions
found during audit, deterministic reproduction from exported metadata, causal
order preservation under clock skew, surfaced degradation rather than silent
repair, and human/agent ability to select the next safe action.

Required artifacts include fixture ledgers, selected Episode sets, accepted
source ranges, projected timeline exports, observer-incarnation and continuity
declarations, KFD-2 trust assessments, and machine-readable qualification
reports. The campaign must include clock skew, late remote evidence, missing
ranges, missing causal links, policy-version mismatch, observer restart, and
deterministic reproduction by both human-facing and agent-facing surfaces.

The paper should not rely on private operational logs for evidence unless they
are sanitized, permissioned, and explicitly marked.
