Execute selected-path handler and config failure/recovery acceptance #100

Acceptance Criteria

• Execute the retained valid/invalid/privacy/debug/header/body-cap/timeout/cancellation/config-replacement cases with observable real dispatch.
• Inject authorized bounded malformed config and digest mismatch only into isolated bindings, prove fail-closed no-dispatch, then restore through typed push and observe recovery, including abrupt-termination cleanup.

Consolidated Operator-Configuration Acceptance

Remaining acceptance from superseded #131 belongs here for a selected standalone Axum path, not in a new configuration-wiring task. EdgeZero already constructs the stores and the shared typed reader already consumes the one runtime policy.

• On the selected final release artifact, use the same executable bytes with isolated operator A/B policies and prove distinct effective settings, bidder/alias bindings, privacy decisions and secret references without cross-operator cached state. Vary those policy dimensions independently; do not treat the existing status/node-cap regression as proof of all dimensions.
• Exercise missing/invalid config and installed-cap refusal through the real serving entrypoint, bounded liveness, update-versus-restart semantics, overload, restoration and restart recovery. Reuse existing handler tests and the Rust qualification harness rather than introducing another loader, startup model, config cache or test target.
• Bind observations to the actual executable, runtime/SDK, configuration and deployment facts. Final resource/meter qualification remains Qualify the selected actual deployment under Q2-D #99 and native fit/ownership remains Certify native configured-ceiling fit and resource ownership #72; operator declarations do not establish OS quotas. These are conditional native rows, not extra prerequisites for every hosted or embedded path.

Existing native evidence was rerun against the tree merged by PR #140 as f307289269f7c510d86647a9f6b673058b74e746. The real Axum executable test uses isolated config-store directories and checks identical executable digests, different effective policy/node limits, snapshot behavior until restart, and installed-cap enforcement. Cargo invocation (with the existing local prerequisite environment prepared):

cargo test --locked --offline -p auctioneer-adapter-axum --test resource_profile native_store_keeps_startup_snapshot_until_restart -- --exact tests::native_store_keeps_startup_snapshot_until_restart

running 1 test
test tests::native_store_keeps_startup_snapshot_until_restart ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 13 filtered out; finished in 16.10s

Exit 0. This is a targeted development-build regression, not final-release qualification, independent alias/privacy/secret coverage, a full-suite rerun, or hosted execution. Test owner.

No acceptance box above is checked by this issue consolidation; reuse already matching evidence and execute only genuinely missing cases.

Blocking And Review Gates

• Blocked by: #52, #91.
• External blockers: Selected deployment access and isolated config-corruption/restoration authorization.
• Conditional blockers: The same selected-target qualification/serving gates as #99, not every provider.

Use native blocked-by/blocking links for unconditional issue relationships. Conditional target gates are not universal blockers; link only the selected applicable path after its contract is frozen.

Shared Acceptance Requirements

Every implementation issue ships its own unit/conformance, failure, resource and privacy tests. A later integration issue does not postpone those checks. New untrusted decoders include generated hostile-input controls; changed hot paths include repeatable measurements. Use the existing engine, host services, validated config/push path and EdgeZero handler registration. Preserve privacy, authorization, cookie integrity, HTTPS/SSRF protections, deadlines, exact sent coverage, authoritative bidder/alias attribution and bounded work/storage. Standalone and embedded behavior share policy rather than fork implementations.

No issue may claim a missing capability from metadata import, compilation, observed allocations, a signed cookie, or a different artifact's old evidence. New public/configuration behavior requires its reviewed design before execution. No workload reduction, raised ceiling or replacement budget equation is implied. Bodies and evidence must not publish credentials, identifiers, raw consent, private provider addresses or customer configuration.

Technical Ownership

Sources: roadmap sections 6 and 8 and the existing M6 contracts/runbooks.

Source Contracts

• Approved roadmap
• Product vision
• Issue ledger and qualification limitations
• Schema qualification record