resilience-auditlisted

# Resilience Audit <!-- SHARED:LANGUAGE_HEADER --> For every operation: **"what happens when this FAILS?"** Report; do NOT fix unless asked. ## Failure categories 1. **External I/O** — network down/slow, API 4xx/5xx/timeout, rate-limit. Retry w/ backoff? Timeout set? Clear error vs hang? 2. **Storage** — disk full, permission denied, partial write. Atomic write (temp+rename)? Cleanup on failure? Existing good copy untouched? 3. **Partial completion** — half-done op (50/100 files). Reported as FAILURE, never success. 4. **Crash / OOM** — killed mid-op. Idempotent restart? No orphaned half-state? 5. **Concurrency** — two instances, race, deadlock. Locking / idempotency / safe re-entry? 6. **Input / data** — malformed, null, truncated, huge. Validate at boundary? Fail-fast? 7. **Dependency down** — fallback/cache/graceful degrade? Clear error vs silent hang? 8. **Resource exhaustion** — bounded? Backpressure? Cleanup on error path? Per-stack timeout/atomicity/idempotency patterns to grep: read `references/checks.md` before scanning. ## For each failure point, check 4 things - **Detected?** code notices it (doesn't swallow)? - **Handled?** retry/fallback/fail-clean — not ignored, not silent-success? - **Recoverable?** rollback/idempotent; no data loss or corruption? - **Communicated?** clear error to user+log; not a hang, not a false "done"? ## Discipline - Trace actual failure path (cite file:line). Don't assume handling exists; prove it. - "partial = failure" — any path r