Reliability defects to close before product expansion
Observed 7 September 2026; not yet corrected by this plan. The reviewed working tree identified itself as version 0.3.0 at base commit 56fc9bbd5ca8a47cf54b77885463b8dae3d7320f, with substantial local changes. On macOS arm64/AppleClang, development and ASan/UBSan suites each passed 341 tests; 17 Python assurance tests, generated-evidence checks and relocated-install checks also passed. The cases below demonstrate gaps beyond those existing tests. These observations do not establish the same outputs on every compiler/platform.
| ID | Defect and evidence | Required M0 closure |
|---|---|---|
| R01 | Sensitivity bounds derive guarantees from sampled lower estimates of norms; reports print false lower bounds on margins | Separate sampled estimates from justified conservative bounds in APIs and all reports; regress out-of-band/narrow peaks and bound directions |
| R02 | Sign-only eigenvalue checks in classical margins, disk margin and sensitivity can misclassify severely ill-conditioned stability | Detect insufficient numerical evidence and return unresolved; establish stability with a reviewed error/conditioning argument |
| R03 | Pipeline linearization discards Euler-chart conditioning and detailed evidence when creating a LinearSystem | Preserve structured diagnostics; reject or explicitly gate unsupported charts before dependent acceptance decisions |
| R04 | Linearization accepts mutable stale trim data and copies the caller's old residual | Recompute applicable equilibrium residual, validate state/controls and bind trim to model/operating-point identity |
| R05 | Public model/numerical/evaluator boundaries inconsistently reject nonfinite values, invalid solver options and channel indices | Shared boundary contracts, negative tests and fail-closed propagation through every public entry point |
| R06 | Release publication does not depend on full CI for one resolved commit | Exact immutable SHA across every job/package; all required evidence must pass before publication |
| R07 | Run provenance hashes executable but does not bind loaded libraries, dirty source contents or effective toolchain configuration | Verified runtime inventory and exact source/build identity; preserve existing input snapshots |
| R08 | Presets use schema 6 while declaring CMake 3.24; some policy/ADR prose is stale | Align minimum version and test it; reconcile certification-use wording and determinism documentation |
Durable counterexamples for regression design. These fixtures are adversarial engineering tests, not aircraft reference data. Preserve the independent reasoning when moving them into tests; do not freeze a faulty output as an expected numerical answer.
- R01: use
A=[[0,k,0],[0,0,k],[-10k,-10k,-10k]],B=[0,0,k]',C=[25,0,0],D=0, withk=0.001/2.8. Default sensitivity options produced phase-margin guarantees of 37.214 degrees and 122.419 degrees. The actual phase margin is 29.110369130415734 degrees. Independently, for the unscaled transfer25/(s^3+10s^2+10s+10), solvez^3+80z^2-100z-525=0for positivez=omega^2, then evaluate phase atj*omega. Positive time scaling preserves the phase margin. The closed-loop cubic has positive coefficients and10*10 > 35, confirming its stable nominal baseline. - R02: use
A=[[t-1,t-2],[-t-2,-t-1]],t=10^13, and zero B/C/D. Exact integer trace is -2 and determinant -3, so poles are +1 and -3. Closing feedback leaves A unchanged. The observed report said strictly stable and returned disk size 2. This severe nonnormal example should be refused as numerically unresolved unless a robust method establishes the correct classification. - R03: start from the NT-33A YAML, make a clearly labeled synthetic model with reference lift coefficient 0.05, reference alpha 0 and reference Mach 0.588; trim at 200 m/s and flight-path angle 90 degrees, then linearize all states. The library reported chart conditioning approximately 0.00944285, below the documented 0.1 advisory threshold. The CLI completed without exposing it. A tiny truncation estimate does not substitute for a usable coordinate chart.
- R04: compute the ordinary NT-33A trim, increase stored thrust by 1,000 N, and linearize without retrimming. Observed copied residual was zero, while actual longitudinal acceleration was approximately 0.186832 m/s².
- R05: public API probes accepted positive-infinite mass, a NaN elevator-moment derivative, infinite raw integration step, and infinite Newton residual tolerance. A NaN-returning LoopEvaluator yielded infinite classical/disk margins. YAML rejects many of these inputs already; the closure must cover direct C++ use as well. Disk-margin channel-index access is an additional source-inspected case requiring a regression.
Limitations requiring product features rather than bug labels. Aircraft evidence is concentrated on one local NT-33A condition. Alpha/Mach guards do not establish a validated aircraft envelope; a beta of one radian can evade those two guards. Independent aircraft time histories and controller-gain comparisons are missing. Onboard timing, sensors/estimators, broad flight-envelope dynamics and enterprise sustainment are outside the existing release. The feature and assurance plans address these separately so an honest scope limit is not confused with a corrected implementation.
Follow-up changes and verification are tracked in the M0 implementation record. This baseline remains the historical pre-fix observation; it is not a current test result.