# US07-04 — Prove Concurrency and Crash Recovery

Epic: [E07](../E07-hardening-release.md)

As an operator, I want randomized race and fault tests so concurrency cannot produce
deadlocks, stale commits, duplicate terminal states, or data loss.

## Acceptance criteria

- Test control points exist at persisted transitions without exposing production
  mutation APIs.
- Tests cover database pressure, worker claim races, file changes, thumbnail races,
  safety/analysis races, EXIF/upload races, rename/archive conflicts, and cancellation.
- Faults cover process death, disk full, read-only paths, DB busy/corruption, network
  failures, malformed providers, GPU exhaustion, subprocess hangs, and missing tools.
- Recovery is deterministic or enters an explicit manual-recovery state.

## Automated tests

- Randomized suites repeat with recorded seeds and assert invariants after restart.
- CI retains journals, logs, DB, seed, and filesystem manifest for any failure.

## Dependencies

- US07-02, US07-03