REQ-RECOVERY-CLEANUP-001: a known initiating failure or any process/reader/close/file-readiness/handle error prevents root deletion. The same actual child, original exit observation and original readers settle through their existing owners; a completed process alone is not reader settlement. Unknown reader work prevents raw Process disposal. All original bounds, caller cancellation and clocks remain unchanged.
REQ-RECOVERY-CLEANUP-002: preserve the original failure objects and every independent cleanup failure. The seeded operation passes its actual failure context and reconciles only reference-equal helper rethrows; it never blindly flattens an original aggregate. fatal-first ordering remains authoritative. Blob cleanup retains the full original drain Task fault vectors, cancels its SAME linked reader token only after an initiating failure and joins the SAME original tasks under its existing cleanup deadline. No new reader/process/provider or replacement wait is a join proof.
REQ-RECOVERY-CLEANUP-003 / AC-RECOVERY-CLEANUP-001 maps to RecoveryFaultRootRetentionTests.ActualFailedAppendRetainsDamagedRootThenExactUndoHealthyReplayAndCold and its whole-operation owner. Seed the actual existing checksum-profile corpus and capture the complete original WAL/files. Corrupt only the saved frame byte. The existing typed CorruptionRefusal operation succeeds before and after one failed ordinary FirstAppend attempt.
That failed attempt must have clean startup, a live original caller deadline, exactly the actual EOF-before-required-completion exception object, independently observed natural nonzero process exit before kill-only cleanup, both original readers and exit settled, and the actual Process closed. Independent errors, output overflow, cancellation or unexpected startup failure fail the case. Missing completion/nonzero exit is not a typed Corruption reply or exclusive root-cause proof. Retain this failed attempt in an actual closed-field JSON sidecar linked to the original evidence containing SIX successful phase receipts. The same failed child remains owned by the RunAsync attempt until original bounded cleanup has run; any unsettled child is retained by its actual failure.
Call both shared cleanup boundaries with that SAME actual failure. The entire bounded damaged file inventory must remain unchanged afterward. Undo only the injected fault using the exact captured WAL bytes; this is test-owned rollback, not product corruption repair. Execute the original healthy FirstAppend, SecondAppend and Cold phases with full corpus, triad, receipt/replay and authority oracles. Preserve all six original successful phase receipts and the separate failed attempt. Only a fully successful final cleanup may delete the root. Directory deletion itself is not an atomic recovery operation.
flowchart TD
A[Actual seed and complete saved image] --> B[One saved WAL byte damaged]
B --> C[Typed corruption refusal]
C --> D[Ordinary FirstAppend misses completion and exits nonzero]
D --> E[Same exit and original readers settle; Process closes]
E --> F[Both cleanup APIs preserve complete damaged image]
F --> G[Second typed corruption refusal]
G --> H[Exact injected-byte undo]
H --> I[Healthy FirstAppend and SecondAppend]
I --> J[Cold reopen with original receipts and full state]
J --> K[Successful owned cleanup deletes root]
The existing SeededWalCorruptionWholeProcessTests, document/index/time-series/ANN, messaging, event-projection, text-projection and blob process operations remain required. This bounded helper correction does not qualify cluster, power loss, endurance, every failed Dispose or a full product task. ADR-117 retains TUnit ownership; StorageRecovery retains current-format authority.