Require receiver commits for Jepsen repair coverage

[jeregrine]

Problem

Jepsen used outgoing transport attempts to certify completed repair. A logical gate could drop every delta and snapshot frame before invoking the delegate while the checker still accepted multi-record delta repair and multi-chunk snapshot assembly as covered.

Fix

Require receiver commit evidence instead. The Jepsen VM wraps the existing delta-run and terminal snapshot-install functions before starting Group, observing the same stream's cursor before and after the original body in one serialized shard turn. The delta peak counts only newly applied contiguous records, excluding duplicate prefixes. Multi-chunk snapshot coverage requires successful terminal installation and cursor advancement.

The instrumentation is test-only and fails closed when its expected function signatures change. Production code and APIs are unchanged; shards only send local evidence messages, and a separate owner handles persistence. Sender attempt peaks remain available as diagnostics but cannot satisfy the checker.

Supporting information

The receiver evidence applies equally to distribution, TCP, and chaos. Persisted maxima survive VM restarts and are cleared between histories. A crash before evidence is persisted can conservatively lose coverage, never manufacture it.

Executable receiver regressions cover logical drops, rejected generations and mutations, gaps, duplicate-only traffic, provisional or incomplete snapshots, successful contiguous runs, completed multi-chunk installation, and fresh-BEAM reload. The pure checker consumes the same EDN fixture compared against live emitted receiver evidence, keeping its coverage schema tied to the node implementation.