obsidian-vault/personal/projects/archive/virfield-release-cleanup-2026-10-16/docs/VERIFICATION.md

# Архив исходника docs/VERIFICATION.md

Источник: Virfield, commit a1460d3372bdfbb5cb19d633d41dd5d3fb3164e6. Снимок перед релизной очисткой. Исторические утверждения ниже относятся к моменту исходной записи; актуальное состояние — в [[personal/projects/virfield]].

````markdown
# Verification

Current record, reconciled 2026-10-16. **Acceptance of the deployed Tart/HTPC VM,
actual owning MCP and production Broker Story paths passed within the scope below.**
Local Tart, SSH physical nodes and rootless Podman macOS lab VMs are implemented;
acceptance belongs to the exact versions and paths below. Source, installed
package, running MCP processes and published release are distinct artifacts.
The working branch is `codex/retire-lume-release-hardening`; `main` is not promoted.
The [implementation plan](VIRFIELD-3-PLAN.md) owns delivery order and all five new
operator feedback items.

## Latest installed checkpoint — 8bfff9f (2026-10-16)

Installed source `8bfff9f59cab918877d060437a1ad190905a5040`, version
`0.0.0-acceptance-runbooks`, includes the checked code correction `832e302` and
runbook reconciliation. Archive SHA-256:
`02ce205ea26cff9097b4869b81a92ea07c285c7c8e5a18b805f03ed1f586273f`.
The signed idle upgrade preserved schema 10, configuration, credentials, signing/
FDA identity, migration snapshots and all nine baseline images. Exact archive and
installed fresh stdio discovery, 20 tools and all four runbooks passed. Code
`832e302` passed complete local CI/race, Staticcheck, zero reachable vulnerabilities,
Linux cross-build and Gitleaks. The docs-only `8bfff9f` passed documentation/link,
MCP race and staged secret checks. Receipt: private upgrade
`20261016-131246-8bfff9f/installed.json`.

The following results supersede older pending/install/client statements in the
dated checkpoints below. A final documentation-only revision records these
results; it does not change the tested installed binaries or pretend their
embedded runbooks were rebuilt.

| Gate | Verified result | Private receipt under `/private/tmp` |
|---|---|---|
| Actual owning MCP | **PASS** after user Restart: actual connected 20-tool catalog and all four runbooks byte-equal to packaged8; actual MCP acquire/same-key replay/job/lease/SSH and desktop tunnels; pinned native GUI/new SSH, real reboot/new UUID, Xcode13.4.1/Swift compile-run, RFB and hashed exported artifact; actual MCP release/job/released state and both listeners revoked | `virfield-owning-mcp-acceptance-20261016/journal.json` |
| Installed remote debugging | **PASS** actual installed CLI-generated build/sync/prepare and LLDB-DAP breakpoint/stack, evaluate41, output42, exit0; exact-child loopback LISTEN wait avoids consuming the debugger connection | `virfield-remote-debug-installed-fixture-20261016/acceptance/report.json` |
| Full signed package rollback | **PASS** all CLI/daemon/MCP/Browser rollback466 then forward to exact8, exact20/four runbooks and real native/Swift/artifact/release on each side; forward installed LLDB-DAP; config/keys/schema10/nine images unchanged and original installed hashes restored | `virfield-package-rollback-live-20261016/report.json` |
| F3 node cache | **PASS** observed68,987,289,600 + requested107,374,182,400 exceeds limit176,361,471,999 by exactly1byte; real409/resource_exhausted before job/clone; original config byte-exact restored, no image pruning | `virfield-node-cache-cap-live-20261016/report.json` |
| Full off-host VM-disk DR | **PASS** stopped owned120GB-logical disk/config/NVRAM copied to HTPC, flushed and all three SHA-256 equal source/off-host/restore before boot; restored same VM identity/hardware, caller/host keys, native readiness, original expiry and workspace hash; both owned saved copies removed and temporary physical caller key revoked | `virfield-vm-disk-dr-live-20261016/journal.json`, `continuation.json`, `backup-durability.json` |
| Original F3 fixture cleanup | **PASS** original job/key/deadline/TTL wait/resume receipt retained; DR completed, owned worker officially released and only stopped own external quota fixture removed; nine baseline images unchanged | `virfield-resource-recheck-live-20261016/continuation-cleanup.json` |
| Sequoia targeted kernel-path diagnostic | **PASS diagnostic**,20 actual kernel stackshot reports containing2,002 stackshots while64 Cocoa process exits ran, then one actual guest reboot/new UUID/native/artifact/release. Historical trigger remains **unproven** | `virfield-node-stackshot-diagnostic-20261016/journal.json`, `independent-artifact-review.json` |
| Speech-log soak | **PASS** final06:38UTC metadata check: deleted huge log and backup absent, all four new logs0bytes, fixed config hash unchanged, Podman healthy and tmpfs has3.357GB free | `virfield-htpc-speech-final-soak-20261016.json` |

The full DR initially placed its held original in a dot directory inside
`TART_HOME/vms`. Tart enumerated it and correctly fenced the unsafe inventory row.
The private harness was corrected by moving that same stopped directory, with
unchanged inode/device, outside the enumerated inventory. After fresh observation,
the original known-rejected revalidation request used the same body/key and passed.
No runtime name validation was weakened and the original mutation driver was not
replayed. See [backup operations](OPERATIONS.md#quotas-and-backups).

The targeted stackshot artifact SHA-256 is
`b611b995e2dd478019b23532e98fc3f3e3f1bc1ddbd98b2fb6fc3365ec0e32a6`.
Independent header review verified actual `Data Source: Stackshots` and all2,002
samples. This adds a bounded non-reproduction on the matching Sequoia kernel;
it does not establish a causal fix for the earlier failed1,200-second reboot.
No CPU flags, NVRAM or golden were changed. Generic LLDB-DAP acceptance did not
drive VS Code editor UI or debug the DuckDuckGo application.

**Production Codex Story: PASS, independently reviewed.** Run
`run-12f093299e237f03a7bb9b70327efcc5` succeeded, cleanup is done and Prism completion
was recorded after the independent probe review. Supported `execution_retry`
retained the exact task/revision/Story and the owner's actual Telegram-approved
plan from `run-db064b95f8b530b3477a2804e3a6eb3c`; planning was not repeated and no
automatic human answer or duplicate plan approval was manufactured. Fresh human
OAuth remained valid throughout.

Actual ACP tool output from the current read-only reviewer session confirms one
executed `os.open` probe returned **EPERM / errno1**, exit0. The first heredoc was
blocked before Python; the equivalent printf-pipe program used no temporary file
and reached the real write attempt. The file was not created. Observational
instrumentation correlates the tool call with the reviewer session and read-only
process; it records only target/errno/exit metadata. Tests reject model claims,
wrong-role evidence, a blocked shell before Python and unexpected success, and
verify unchanged protocol bytes. Model report text alone was not credited.

All four real tests passed in the deterministic quality gate and independently
from the exported local commit `f7d8b95a60ecce53aff2630ad4a921204216e807`. The final
Git diff contains exactly the two new standard-library fixture files; the
checkout is clean, the probe is absent, no untracked archive was needed and no
push occurred. All exported artifact sizes/SHA-256 verified. The worker was
released, VM capacity and active jobs are0, all nine baseline images remain and
the credential identity is unrevoked with no owner.

The failed attempts remain evidence, not hidden successes:

| Attempt | Observed result / correction |
|---|---|
| `run-7493e54fe8576568720f0f40a35f58cc` | All six roles completed; ordinary Python test replay wrote two bytecode files, then correctly failed the clean-tree check. Independent replay reproduced it; `python3 -B` keeps all four tests and the tree clean |
| `run-db064b95f8b530b3477a2804e3a6eb3c` | No bytecode; reviewer probe file actually created. Next implementer preserved it and stopped. Actual-role regression showed authored reviewer ACP `allow` granted edit/execute/other expansion requests despite Codex read-only. Policy changed to `deny`, red/green and full Callee race passed |
| `run-6881d27eae00b3c0b3f428cf0c7587e6` | Program/quality succeeded but independent acceptance rejected the missing own-role syscall evidence: heredoc failed before Python, while an earlier report's claimed errno was insufficient. Added equivalent no-tempfile fallback, verifier attribution guard and actual ACP tool-output audit |

The checked Broker correction is local commit `6c70647a35056b4aeca891c416c6e4e09ea63c8f` on
`codex/readonly-story-reviewer`; its
[reviewed source patch and audit tests](acceptance/broker-reviewer-readonly.patch)
are retained in this branch. The patch applies to Broker base `4a8319a` with
`git apply --unidiff-zero`; reverse/apply validation passed. Broker source was not
pushed to its separate remote.
Full Callee race passed3.082s; audit race/protocol checks passed2.256s; staged
Gitleaks passed. The idle config change was guarded by aggregate active-run
count0 and preserved original config/archives. Only the selected workflow/version
and bootstrap changed. Runner, Callee and Codex binaries are byte-identical to the
prior checked package; the added audit proxy observes unchanged protocol bytes.
Production bootstrap SHA-256:
`463f47ce73bc76e02082faa8b34f3619a135012ee1f077bff5aa536cd7843d62`;
workflow digest:
`sha256:b09f2be2db9d96ea8b50165ff8534d1e8b28a4fc27ea4678b4f0cb2acf7d7db6`.

Private receipts: `virfield-broker-review-probe-20261016/deployment.json`,
`virfield-broker-codex-reviewed-probe-20261016/independent-review.json`,
`virfield-broker-codex-reviewed-probe-20261016/journal.json`.
The [sanitized evidence index](acceptance/2026-10-16.json) records exact installed
provenance and hashes of completed private receipts, without credentials.

## Previous installed checkpoint — 466dbb8 (2026-10-16)

Source `466dbb817450fc28f4a39cffaba9aa4812d7b5e3` is pushed and installed as
`0.0.0-desktop-drain`, archive SHA-256
`171e23cfeeb17a37f1749b4e77ae0d7229b2faabee30ab17235b32f9c44c8f30`.
The idle signed upgrade preserved schema 10, configuration, credentials,
migration snapshots and all nine baseline image manifests. Exact installed fresh
stdio version, all 20 tools and all four runbooks/resources/status passed.
Local CI/race, Staticcheck, zero reachable vulnerabilities, Linux cross-build and
Gitleaks staged/history (247 commits) passed. The short desktop-probe cap and
long-operation shutdown contexts described below are now installed.
Receipt: private upgrade `20261016-111207-466dbb8/installed.json` and
`virfield-desktop-drain-installed-mcp-20261016/report.json`.

**F3 real dispatch wait/resume: PASS.** After admission, the daemon was paused
while the original job was still queued. An owned external Tart VM consumed
12 CPUs and its full 120-GB disk potential. The fresh pre-clone check reported
CPU headroom -4 and disk headroom -46,620,811,264 bytes, emitted one resource-wait
event and dispatched no clone. Removing only that load resumed the same job,
caller key, deadline and original TTL; native GUI/SSH readiness passed on
`lease-272db900210e774cf8acb544de8026f7`. That worker and the stopped external
fixture are retained for the documented continuation. Node-cache live cap and
fresh node post-wake failure checks remain separate gates.
Receipt: `virfield-resource-recheck-live-20261016/journal.json`.

**Actual Tart remote-debug path passed; preparation race corrected in source.**
The original installed helper returned when `debugserver` existed, before its
loopback port listened; LLDB's first handshake then failed. Logs confirm successful
task authorization and later listener readiness. Connecting to that same original
process after read-only listener confirmation passed the real checkpoint/stack,
evaluation of `value == 41`, output `remote-debug-result=42` and exit 0, without
restarting or changing the process. The correction waits for the exact child's
loopback LISTEN socket using `lsof`; a TCP readiness probe would consume its first
debugger connection. A real delayed-listener regression failed before and passed
after. A new generated workspace using the corrected CLI passed actual host
build/sync/prepare and the complete LLDB-DAP workflow on the retained worker.
The corrected CLI is not yet installed; no VS Code editor UI was driven.
Receipts: `virfield-debugserver-ready-red-20261016.log`,
`virfield-debugserver-ready-green-20261016.log`,
`virfield-remote-debug-fixture-20261016/acceptance/dap-transcript.json`,
`virfield-remote-debug-ready-fixture-20261016/acceptance/report.json`.

The F5 factory/worker completed successfully on e80c194. Its extra temporary
golden was subsequently deleted through the image-delete contract; all nine
baseline images are unchanged. The failed HTPC reboot below remains **failed**:
same-container recovery returned with unchanged keys, a new boot UUID and an
exported macOS shutdownStall/stackshot report, then the owned VM was officially
released. Neither recovery nor later successful probes establish the original
trigger. No CPU flags, NVRAM or golden were changed.
Receipts: `virfield-f5-fixture-cleanup-20261016/report.json` and
`virfield-node-desktop-diagnostic-20261016/failed-reboot-cleanup.json`.

**Fresh installed HTPC matrix: PASS 4/4.** On `466dbb8`, two concurrent Sequoia
15.8.1/24H32 and two sequential Sonoma workers passed native GUI/new SSH key
storage, standard account, 1920×1080, actual guest reboot/new boot UUID, pinned
keys, workload/artifact/RFB and release/revocation. Original-overlay F1 stop/start
also passed with unchanged workspace, keys and expiry. The private driver's first
90-second SSH wait expired during boot; a separate read-only continuation
completed within the original 1,200-second deadline without repeating stop/start.
All four workers were released and nine baseline images are unchanged.
Receipt: `virfield-node-desktop-drain-acceptance-20261016/journal.json` and
`F1-native-continuation.json` in that directory.

Exact standalone kernel symbols match the earlier shutdownStall report's UUID.
The old CPU0 return address resolves to `DebuggerTrapWithState+0x67`, on the
report's stack-snapshot path. The original faulting instruction/error was not
captured before recovery; this does not establish a PCID, TSC, EFI or NVRAM cause.
No corresponding settings were changed and later passing cycles are not a
targeted fix for that historical stall.
Receipt: `virfield-node-desktop-drain-acceptance-20261016/kernel-symbols/`.

The operator explicitly approved the full disk/config/NVRAM off-host DR and
cleanup after the earlier automatic-review rejection. Its one original driver
is running: the owned Tart VM is stopped, full source hashes are saved and its
disk/config/NVRAM are being copied to the exclusively leased HTPC. Original VM
files remain intact until independent off-host verification; never replay that
driver after an unknown outcome.
Receipt: `virfield-vm-disk-dr-live-20261016/journal.json`.

Fresh human OAuth enrollment is complete: the portal reported `complete` and
the vault reports an unrevoked identity with no owner. Earlier expired portals
are historical. A new full production Story and the actual owning MCP reconnect
remain open; a completed login is not Story acceptance.

## Previous installed checkpoint — e80c194 (2026-10-16)

Source `e80c194fe5d30a33e9a0062371fd42f3fd6255b4` is pushed and installed as
`0.0.0-drain-cancel`, archive SHA-256
`245c2f941201f99e8868729219edf50a53570c7fdfc74898a4b5a22867b0c1b0`.
The idle schema-10 upgrade preserved all nine image manifests, configuration,
credentials, migration snapshots and signing/FDA identity. Exact installed fresh
stdio version, 20 tools and all four packaged runbooks/resources passed.

**F2 and installed shutdown cancellation: PASS.** On owned worker
`lease-b0047f4e185047fbccb61a264243b7c3`, a bounded failure of the actual Tart
inventory probe retained the ready lease, verified identity, keys, endpoint and
original expiry. New connections paused, an established stream survived, and
the same listener resumed after recovery. Drift/tunnel and backend failure/recovery
diagnostics remained byte-for-byte intact after release and daemon restart.

A controlled external Packer-command fixture exercised the installed daemon's
ten-minute shutdown grace without creating a golden. At 603.283 seconds the child
was interrupted, its `image_command_failed` outcome was durably recorded before
exit, and the new daemon retained that failure without replay. Cleanup used the
exact image-recovery contract. Temporary wrappers were removed from configuration;
the original configuration bytes and all nine images are preserved.
This controlled-command test is distinct from a complete real Packer build.
Receipt: `virfield-observation-drain-live-20261016/report.json`.

The earlier real Packer build interruption on 256d18f correctly fenced the unknown
outcome; launchd terminated its descendants after daemon exit. All known PIDs were
confirmed gone and Packer's log confirmed cancellation/VM cleanup before official
image deletion. No surviving orphan was observed in that launchd run. The separate
real-process regression exposed the missing context cancellation before the host
lock/database closed; the new candidate fixes that ordering.
Receipt: `virfield-build-restart-live-20261016/report.json`.

After configured Wake-on-LAN restored HTPC reachability, an independent later
check confirmed the deleted speech log and its backup remain absent, all four
new logs are zero bytes, the fixed configuration hash is unchanged, tmpfs has
3,357,130,752 free bytes and `podman info` succeeds. No speech text was read.
Receipt: `virfield-htpc-after-wake-20261016.json`.

**F5 complete factory/worker: PASS on e80c194.** Factory
`image-befe5b1452f59090482870ca853563b8`, template
`release-check-legacy-ios-drain-cancel-20261016`, reached `image_ready` after
actual construction, immutable toolchain installation and post-reboot qualification.
Fresh worker `lease-04dd18e3e776558a8aacf2c332e2b937` passed real armv7 builds
before/after actual reboot, the exact immutable marker, standard account,
native GUI/SSH, 1920×1080, workspace/key retention, cross-key rejection, artifact
export and RFB. The worker is released; the nine baseline images remain unchanged.
The extra acceptance golden is currently retained separately.
Receipt: `virfield-legacy-ios-factory-drain-cancel-20261016/journal.json`, final
stage `legacy-ios-factory-live-accepted`. Never replay the driver.

**Cold concurrent HTPC preflight remains open.** Both new Sequoia workers
`lease-a4641013b653e566a78afaa556ef8441` and
`lease-d3f476b23c2318dd3e9f7e4521cc0216` failed before credential isolation:
the fixed desktop probe stalled in `waiting_exit` and hit the generic 60-second
command cap while its original preflight allowed 120 seconds. Logs and frames
were exported before their confirmed release. A single retained worker
`lease-5b9f07e9711768694daf982784f30004` completed preparation; independent
read-only shell and JXA/CoreGraphics probes took 3.696 and 18.842 seconds and
returned the expected unlocked console without changing image credentials.
The evidence establishes the premature inner bound, but does not prove a
particular kernel/I/O cause for the slower concurrent commands. Keyboard Setup
Assistant was visible in failure frames; that alone is not its timeout cause.

The single worker also passed original-container/overlay F1 stop/start and
revalidation with its keys, workspace and expiry preserved. Its additional native
guest reboot **failed**: after one shutdown dispatch, SSH did not return within
the original 1,200-second budget. No repeated reboot was dispatched. Read-only
QEMU samples show CPU0 repeatedly at the XNU page-fault entry with CR2=0 and
the other CPUs in a debugger-wait loop; all four vCPUs execute guest code while
I/O counters remain unchanged. The instruction sequences match Apple's
[trap entry](https://raw.githubusercontent.com/apple-oss-distributions/xnu/main/osfmk/x86_64/idt64.s)
and [debugger wait](https://raw.githubusercontent.com/apple-oss-distributions/xnu/main/osfmk/i386/mp.c)
sources. This establishes a guest-kernel stall, not its original triggering cause.
The actual QEMU command already includes `+invtsc`; the host uses stable TSC.
The owned original overlay/keys are retained for a separately recorded recovery
and panic-report inspection; recovery does not count as reboot acceptance.
Receipts: `virfield-node-desktop-diagnostic-20261016/journal.json`,
`monitor-stack-readonly.json`, `qemu-readonly.json`, `host-cpu-kernel-readonly.json`.

The checked source correction gives only the fixed read-only desktop probe its
existing 120-second readiness budget. The original parent deadline and all
readiness checks remain mandatory; ordinary commands retain their 60-second cap.
A real SSH regression failed before and passed after the correction, including
the shorter original-deadline case. The shutdown audit additionally applies the
same grace/cancellation context to long SSH preparation, local copy and registry
export; an SSH preparation cancellation regression also failed before/passed
after. No mutation is retried. Whole local CI/race and pinned Staticcheck pass;
installation and fresh concurrent HTPC cycles are still required.
Receipts: `virfield-desktop-budget-red-20261016.log`,
`virfield-desktop-budget-green-20261016.log`, `virfield-ssh-drain-red-20261016.log`,
`virfield-all-operations-drain-green-20261016.log`,
`virfield-desktop-shutdown-full-check-20261016.log`.

Fresh human OAuth/full Story and the actual owning MCP reconnect remain open.

## Previous installed checkpoint — 256d18f (2026-10-16)

Source `256d18fa67f5ab9e1b21191701a98f99faafae6e` is pushed and installed as
`0.0.0-legacy-ios-native`. Archive SHA-256 is
`eb06d121db54c4a5559d7985001748976e35e423d9db682840be017f18190a01`.
The operator explicitly approved installation, schema 8→10, subsequent checked
acceptance patches, and scoped Broker/OAuth recovery. Private schema-8 and older
schema-7 snapshots pass integrity checks. All nine baseline image manifests,
configuration, VM/node credentials and signing/FDA identity are preserved.
Exact installed HTTP/fresh stdio version, 20 tools, all four packaged
runbooks/resources/status and anonymous rejection passed. The first installer
postcheck incorrectly compared historical released image rows with active HTTP
inventory; a read-only continuation verified the active subset and completed the
receipt without repeating installation or editing runtime state.
Receipts: private upgrade `20261016-093648-256d18f/installed.json` and
`virfield-native-installed-mcp-20261016.log`.

**F1 live recovery: PASS.** Worker
`lease-9b1f43fc331e50f2d83a0a67481f7a3a` underwent a real external stop/start,
confirmed drift, original-caller proof and idempotent revalidation. Its exact VM,
hardware identity, caller/host keys, workspace checksum and original expiry were
preserved. A new boot, native GUI/SSH WhenUnlocked I/O, 1920×1080, Xcode/Swift,
RFB, release and listener revocation passed; all nine images remained unchanged.
Receipt: `virfield-revalidation-live-20261016/journal.json`. Never replay it.

**F3 live arithmetic/refusal: PASS.** During the owned image build, actual
CPU/RAM/full virtual disk reservations, safety reserve and signed headroom were
checked. HTTP, CLI and MCP refused a second 140-GB request with the structured
calculation and created no VM/job. The build's observed 120-GB disk correctly
replaced its initial 120-GiB estimate. Fresh-node recheck/wait-resume and the
remaining failure matrix are separate checks.
Receipt: `virfield-admission-live-20261016/journal.json`.

The reviewed Darwin process-group fix is deployed in the production Broker's
new runner bootstrap (SHA-256
`6f7e48479f61fcbef29c289408860dfe635b2d71bdd437f8b4cb63787a3c92a4`);
the original archive is preserved. After independently confirming the old VM was
gone, the encrypted `codex-default` record was backed up, its uncertain cache
revoked and its abandoned owner reset using the supported operator command.
Original Story `run-de5f0928d21f97428502519aab3438d1` now has cleanup `done`.
Fresh human OAuth enrollment and a new full Story remain required. No uncertain
token was reused, database fence bypassed or Human answer submitted automatically.
Receipt: `virfield-broker-recovery-20261016/report.json`.

F5 actual factory qualification/worker acceptance and the graceful
restart-during-build/drain check are in progress. A real subprocess regression
exposed the missing cancellation of an unfinished image operation after shutdown
grace. The checked source fix cancels that context after ten minutes, retains the
job's original deadline, and gives Packer/VM cleanup five additional minutes before
the database/host lock close. The real-process regression failed before the fix;
it and the existing confirmed-result drain tests pass with race detection after
the fix. Full local CI, pinned Staticcheck 0.7.0 and Govulncheck 1.6.0 (zero
reachable vulnerabilities) pass. This fix is not installed by 256d18f.
Receipts: `virfield-shutdown-drain-red-20261016.log`,
`virfield-shutdown-drain-green-20261016.log`,
`virfield-shutdown-full-check-20261016.log`.
The actual owning MCP remains
a separate manual reconnect gate; fresh stdio acceptance does not attest it.
The older source-only/pending-install statements below describe their dated
checkpoints and are superseded by this section for the installed candidate.

## Previous installed checkpoint — a45655f (2026-10-16)

Source `a45655ff78d5b124ed938ef6ea244ba84a819d72` is installed and pushed,
version `0.0.0-local-golden-sparse`, daemon PID 81129. Archive SHA-256
`010c278a61ef211b252b3e0cee67ca67ea3627729b191d00b86dde6af65910d6`.
Complete local CI/race, Staticcheck 0.7.0, Govulncheck 1.6.0 (zero reachable),
Gitleaks 8.30.1 (tree/history, 239 commits), Linux cross-build and exact archive
MCP passed. Installed HTTP/fresh stdio passed in 0.853 seconds, including all four
packaged runbooks/resources/status and anonymous 401. Signing/FDA, configuration,
keys, schema 8 and the eight baseline image manifests were preserved.
Receipt: `virfield-local-golden-sparse-installed-mcp-20261016.log` and private
upgrade `20261016-005506-a45655f/installed.json`. Never replay the installer.

**F4 corrected transfer and iPad Monterey repeat: PASS.** Durable transfer
`job-bae1394eea3855fd52ab9b24dc16c58e` registered
`image-445bf1f13caf092c5afa9f594c8f3f86`, template
`release-check-ipad-monterey-sparse-20261016`. All three copied files have the
source SHA-256; the 120,000,000,000-byte logical disk uses 44,794,757,120 bytes
at destination versus 44,805,877,760 at source. Independent complete hashes
before/after both native cycles prove unchanged source and copy. Recipe/image
provenance and private identity mapping match; original eight manifests remain
unchanged. The accepted new copy is retained as a ninth image.

Two fresh sequential workers passed standard account authentication before/after
real reboot, native Aqua/new SSH WhenUnlocked key I/O, distinct boot UUID/nonces,
1920×1080, Xcode 13.4.1/13F100, Swift compile/run, workspace checksum preservation,
artifact SHA-256, RFB, cross-key rejection, release and listener revocation.
Workers `lease-c3623b2f8b4eae3cf6bd11987fa8742a` and
`lease-cd31eea297144b2e69f0756246573856` are released.
Receipt: `virfield-local-golden-sparse-live-20261016/journal.json`, final stage
`verified-transfer-native-accepted`. Never replay the completed driver.

The actual owning MCP remains a separate open gate: PID 66295 still serves the
old instructions. The user cannot restart it now; no process was killed.
Production full Codex Story `run-de5f0928d21f97428502519aab3438d1` completed real
specify/design/breakdown, then waited for the configured Telegram owner. No Human
answer/refresh was sent automatically. At its original 21:12:19 UTC deadline it
failed in approval with `process_group_unsettled` / `operation not permitted`.
Broker cleanup remains pending/`credential_state_lost`; the exact Virfield worker
`lease-faea902b1f37565ea8b084038f75b127` was independently confirmed released by
its original 21:17:19 UTC TTL, with no VM left. The issuer's read-only lease-state
confirms owned=true, revoked=false, checkpointed=false; the identity stays fenced.
Do not reuse an uncertain old token or force a database cleanup/unlock. No reviewer,
implementer or verifier ran and no artifacts were exported; full Story is not
accepted. The original driver completed with failure and must never be replayed.
Receipts: `virfield-story-cleanup-failure-events-20261016.json`,
`virfield-story-credential-fence-20261016.json` and the original Story journal.

F3 source adds shared controller/fresh-node budget evaluation, structured
admission/refusal arithmetic, separate overlay/golden filesystem observations,
cache quotas, safe overflow/unknown handling, dispatch rechecks and Console
estimates. One-byte boundaries, fallback, reservations, full/missing storage,
cache and preserved-lease waiting/resumption tests pass. CLI/MCP retain structured
refusals. Actual Console JavaScript checks also exposed/fixed Automatic submitting
the literal `Automatic`; it now submits the empty destination and refreshes
strict choices when the template changes. Full local `make check` and final
affected race tests, pinned Staticcheck 0.7.0/Govulncheck 1.6.0 (zero reachable),
Gitleaks 8.30.1 (staged and 240 commits) and Linux budget cross-build passed.
`a2aab208f74e320e8343d2a2a0d41a2cd8da8231` is pushed; candidate archive
`0.0.0-resource-admission` SHA-256 is
`7c51880aca65673d8e7cd0736f418779406be1521d87d38118fe14aa9f39a3d1`.
Exact archive source/binary hashes, fresh stdio version/19 tools/new metadata and
all four packaged help/resources passed against the existing a45655f daemon;
this does not accept new F3 daemon behavior. Logs: `virfield-resource-admission-final-check-20261016.log`,
`virfield-resource-admission-final-affected-20261016.log` and
`virfield-resource-admission-console-20261016.log`. It is not installed/live
accepted by a45655f receipts; new production installation still needs exact approval and an idle pool.

The Telegram prompt's message and published controls were independently confirmed
from a private ephemeral DB/WAL snapshot, with the production volume read-only,
network disabled and only this run's safe metadata projected. Receipt:
`virfield-story-telegram-delivery-20261016.json`. The owner has not yet answered.
Published options expired at 2026-10-15 19:44:08 UTC; the owner can renew the same
request. The original run deadline is 21:12:19 UTC. No Human response or refresh
is sent on the owner's behalf.

F2 source now has bounded typed event diagnostics and verified runtime baselines.
Targeted race tests passed for drift snapshots before endpoint clearing, every
forced listener/stream cause, backend pause/resume, original error fingerprints,
restart/cleanup persistence, exclusion of credentials/payloads and actual upstream
reset versus graceful EOF. Receipt: `virfield-diagnostics-coverage-20261016.log`.
Full local CI, final affected race/API/MCP checks, pinned Staticcheck 0.7.0 and
Govulncheck 1.6.0 (zero reachable) also passed. Gitleaks 8.30.1 passed staged and
241-commit history scans. `89344ef84ab30e728dd40ca4c877cb5feaab0903` is pushed;
archive `0.0.0-drift-diagnostics` SHA-256 is
`3e9251925c00360aedc492624eb08d0bf4d2728db203961c35f16ae23bee2c15`.
Exact archive hashes and fresh stdio 19-tool/four-runbook checks passed against
the installed a45655f daemon. Installation/live acceptance remain. Logs:
`virfield-diagnostics-full-check-20261016.log` and
`virfield-diagnostics-final-affected-20261016.log`.
Historical drift and Sonoma-stall causes remain unproven.

F1 source adds bounded durable read-only revalidation, owner-bound caller proof,
fresh immutable runtime identity, original image/SSH/account policy and OS/SIP/
desktop verification. Affected race tests pass across controller, real SSH
management/caller-enquiry servers, client proof, HTTP/MCP transport, Tart and
schema 8-to-9 backup/restart cases. Tests verify lost replies, original deadlines,
unchanged keys, same-name replacements, unknown observations, expiry/callback
races and same-endpoint tunnel revocation. Full local CI and final affected tests
passed. Staticcheck 0.7.0 and Govulncheck 1.6.0 found no actionable issues or
reachable vulnerabilities. The final client-key read additionally rejects symlinks
and unsafe file permissions through a bounded verified descriptor. Gitleaks 8.30.1
passed the staged diff and 241-commit history. Linux arm64 CLI cross-build and
final documentation checks passed. `87955e4803772374afef2e45d4dd6df920ecbd4d` is pushed; archive
`0.0.0-lease-revalidation` SHA-256 is
`0bd6665b95dc4b5d1f8cee4c0a42da6341030ccff9b1b7c1a6416a394d59258a`.
Exact binary/source hashes, fresh stdio 20 tools and all four packaged
runbooks/resources/status passed against the installed a45655f daemon.
Logs: `virfield-revalidate-full-check-20261016.log`,
`virfield-revalidate-final-affected-20261016.log` and
`virfield-revalidate-manager-20261016.log`. F1 archive exposes 20 MCP tools and schema
9; installed daemon remains a45655f/schema 8. Live recovery must independently
retain the original VM/key/expiry and workspace checksum; unit tests do not close
that gate. Production installation requires exact migration approval and an idle pool.

F5 source adds optional pinned `legacy-ios-v1` for exact Tart Monterey12.7.6 /
Xcode13.4.1. Domain/catalog/profile tests pass for incompatible combinations,
ordinary profiles executing nothing, unchanged default JSON fields, immutable
recipe checks, complete source lock/hash metadata and required native/build
evidence. All 44 actual source-gem downloads match primary RubyGems SHA-256.
The local CocoaPods dependency passed real `--deployment --no-repo-update` with
unchanged Podfile.lock on the host; this does not accept the target armv7 build.
The combined source uses schema 10 to prevent older executors silently skipping
this toolchain; no schema 9 version was installed. Full CI/security/archive, idle
installation with a private schema 8-to-10 snapshot and live factory/worker gates
remain. Full local CI/final affected tests, Staticcheck0.7.0, Govulncheck1.6.0
(zero reachable), Linux arm64 CLI and RubySec Bundler Audit0.9.2 passed. RubySec
DB commit `a6847b0651a702488f5844081e848dd1ec9dbf1d` contains 1,263 advisories,
updated 2026-10-10; no locked gem vulnerabilities were found. Gitleaks8.30.1
passed staged and 242-commit history scans. Packaging remains pending.
Logs: `virfield-f5-final-check-20261016.log`,
`virfield-f5-final-affected-20261016.log`,
`virfield-f5-ruby-audit-private-20261016.log`,
`virfield-f5-profile-tests-20261016.log` and
`virfield-f5-fixture-deployment-20261016.log`.

A final transfer/revalidation integration review reproduced a new source-only
POSIX-lock regression: opening/closing config.json for fresh hardware identity
could release this process's active transfer lock. The external Python lock
contender made the added regression fail. Identity reads now share the transfer
mutex and return unknown while it owns the descriptor; inventory never opens that
file under its own transfer lock. This supersedes the uninstalled 87955e4/dab2c33
archives for installation. Red/green logs:
`virfield-f1-transfer-lock-red-20261016.log` and
`virfield-f1-transfer-lock-green-20261016.log`. Installed a45655f is unaffected.

**F5 disposable-worker prevalidation.** On the unchanged installed a45655f,
owned Monterey worker `lease-62525e681b7f483e477cb1445b356bd8` passed native GUI/SSH
preflight and built Ruby3.3.12/OpenSSL3.5.9/LibYAML0.2.5 plus all 44 frozen gems.
Verification then failed on the actual Apple lipo CLI argument order: its
`-verify_arch` consumes following arguments, so the input file must precede it.
An independent read-only probe with corrected order confirmed native arm64 FFI,
CocoaPods1.16.2/Ethon0.18.0 and real system libcurl loading. This did not accept the
profile. The failed fixture was officially released after export, preserving all
nine image manifests. The fixed checks share one helper, tested against a real
native Mach-O, wrong architecture and non-Mach-O input. The second worker
`lease-fdcab19df25d30326aceece3fb141443` then exposed CocoaPods Unicode normalization
under noninteractive ASCII-8BIT locale. A profile-scoped UTF-8 environment fixes
that failure without changing global startup files. Actual C-locale/Ruby path
normalization now has a regression test.

Current verifier bytes were staged privately against those unchanged built tools;
they passed actual frozen CocoaPods/unsigned armv7 compile/link both before and
after a real reboot/new boot UUID. Native Aqua/new SSH WhenUnlocked I/O, 1920x1080,
admin/admin, workspace/key retention, cross-lease key rejection, RFB, exported
artifact hash and official release/listener revocation passed. Both owned workers
are released; all nine golden manifests match. Current verifier staging did not
overwrite the immutable installed toolchain/marker or qualify a factory golden.
New daemon/schema, exact candidate factory and actual connected-client gates stay
open; this is module/workload prevalidation on stable a45655f. Original TTLs and
journals remain authoritative; never replay the completed setup/cleanup drivers.
Receipts: `virfield-legacy-ios-prevalidation-live-20261016/`,
`virfield-legacy-ios-prevalidation-lipo-20261016/` and
`virfield-f5-real-lipo-regression-20261016.log`.

**Darwin/Broker cleanup research.** Apple's primary
[XNU killpg1](https://github.com/apple-oss-distributions/xnu/blob/main/bsd/kern/kern_sig.c)
excludes zombie members and can return EPERM for a group containing no executable
process. An owned same-UID zombie-only group reproduced EPERM for both signal 0
and SIGKILL; its parent then reaped it normally. An actual Broker regression
reproduced the false `process_group_unsettled` on source
`4a8319acc8d0fad7077b70f1e60417abd293f2b3`. A
[reviewable patch](fixtures/execution-broker-darwin-process-group.patch) settles
Darwin EPERM only after a successful independent no-live-members observation;
live/unknown groups still fail closed. Full Runner race tests, vet and Linux
arm64 runner cross-build passed in a separate temporary source copy. The original
Broker checkout/deployment are unchanged. Its exact historical group membership
was not recorded, so the original failure is not asserted to have been a zombie.
Recovery of the fenced identity requires the operator credential procedure; no
revoke/reset or provider login was performed here.

**Candidate installation boundary.** `188f166` passed full CI/red-green transfer
lock regression, staged secret scan, exact archive/fresh stdio 20 tools/new schemas
and all four packaged runbooks/resources. Archive `0.0.0-legacy-ios-lock` SHA-256:
`368ce8abd2f5f0bfa444ca7f2b3420fa4399b339734418b7997fc16d7ed99f8c`.
Automatic approval review rejected its production restart/schema 8-to-10 migration
as requiring specific permission; the prepared installer was not executed.
Further F5 corrections add an explicit installer umask, guest-readable root-owned
toolchain files, completion marker last, private compiler log/bounded SSH tail,
a common real-lipo check and a reusable UTF-8 environment. Full local CI, real
Mach-O/locale regressions and staged-verifier native/reboot/armv7 prevalidation
passed; staged and 244-commit history Gitleaks8.30.1 scans found no leaks. Log:
`virfield-f5-complete-source-check-20261016.log`. These corrections supersede
188f166 for installation. No new daemon/schema or factory image is accepted.

## Earlier transfer checkpoint — 3d667d2 (2026-10-16)

Source `3d667d27687d58a7f8178feee2f90f5349143323` is installed and pushed,
version `0.0.0-local-golden-transfer`, daemon PID 26451. Archive SHA-256
`e83d06b3b9fa90c95b69372b20329b5a34ce8fad6d78f4e1be0ae8f30f903efd`.
Exact installed HTTP/fresh stdio passed in 2.59 seconds, including all four
packaged runbooks/resources/status and anonymous 401. The upgrade preserved
signing/FDA, configuration, keys and the eight baseline image manifests. Schema 8
startup created a verified schema 7 snapshot; rollback to an older binary also
requires restoring that compatible snapshot.

**F4 is not live accepted.** The first local transfer exposed excessive physical
allocation: source disk 44,805,877,760 bytes, destination 106,397,872,128 bytes,
both logically 120,000,000,000 bytes. The copy implementation writes an entire
1 MiB buffer when any byte is nonzero, expanding smaller sparse regions. The
acceptance driver was stopped before worker creation; inspect the original
durable transfer job before any cleanup or retry. The source golden is retained.
Receipt: `virfield-local-golden-transfer-live-20261015/journal.json`.

The owned first copy was subsequently inspected and deleted with durable
`job-c118887cc056917a94363a9126a684d4`; all eight baseline manifests and source
metadata/private hashes were preserved. Source correction now restores actual
source holes in the destination after copying and before full hash verification.
A non-skipping APFS regression fails on the old code (524,288 to 134,217,728
allocated bytes) and passes after correction, alongside all-hole/unaligned-tail
content and source-position checks. Complete local `make check`, affected race
tests, Linux cross-build, Staticcheck 0.7.0, Govulncheck 1.6.0 (zero reachable)
and Gitleaks 8.30.1 working-tree checks passed. Darwin uses the supported
libSystem `fcntl` wrapper with a pinned request, not a deprecated direct syscall.
This is source evidence only; the corrected package/native transfer is
not yet accepted. Receipts: `virfield-sparse-copy-red-20261016.log`,
`virfield-sparse-copy-green-20261016.log`,
`virfield-sparse-copy-affected-20261016.log`,
`virfield-sparse-copy-cleanup-20261016/journal.json`.

The operator confirmed an owning MCP Restart, but the actual connected adapter
still serves four runbooks different from this installed package and exposes no
`image_transfer`. Receipt: `virfield-owning-mcp-3d667d2-20261016.json`.
Another fresh stdio process does not accept that connected client.
The exact owner was identified from its unique new TCP connection immediately
after an actual tool request: PID 66295, started at 22:18, still has the older
executable inode 643828906 loaded. The installed 23:50 binary has inode
644036119. Configuration points at the correct installed path; this is an old
running adapter, not a different configured pathname. No adapters were killed.

**HTPC speech-log cause and fix: PASS.** Speech Dispatcher
`0.12.1-6.fc44` contains the upstream `output_get_voices` debug statement that
logs each `LIST VOICES` response at level 1. In the inspected post-truncation
file, 1,687,960 voice-enumeration lines occupied 155,685,558 of 155,836,077 bytes
(99.9%), over 38 starts. The `waitpid` shutdown errors were not the volume cause.
The matching statement is in the
[0.12.1 upstream source](https://raw.githubusercontent.com/brailcom/speechd/0.12.1/src/server/output.c).
The installed binary contains the same marker. Default file logging appends
without a size limit in the user runtime tmpfs shared with rootless Podman.

On the operator's explicit instruction to fix and delete the log **and backup**,
the node account received a private user copy of its current distribution
configuration. Only active `LogLevel` (3 to 0) and `LogDir` (private persistent
`~/.local/state/speech-dispatcher/log`) changed; the system file and speech
settings/modules/autospawn were preserved. Three fresh default `spd-say -O`
autospawn/server/module/natural idle-exit cycles passed and left all new logs at
zero bytes. `LogDir stdout` was rejected by a functional probe because this
version's module stderr inheritance delayed the synchronous client spawn until
server shutdown; that configuration is not retained.

After verifying inode/owner and no open file descriptors, the 155,836,077-byte
runtime log and its 3,357,126,656-byte HDD backup were deleted (3,512,962,733 bytes
total); the backup directory and metadata were removed after retaining only the
small technical receipt. Private receipt: `virfield-htpc-speech-log-final-20261016.json`;
node receipt: `virfield/diagnostics/speech-log-fix-20261016/report.json`.
After deletion, another default client autospawn and explicit `espeak-ng` voice
listing returned 14,806 table lines successfully; the old path was not recreated
and every new log remained zero bytes.
An independent check 133 seconds later again found both old paths absent and
all four new files empty. `podman info` succeeded with 3,357,126,656 bytes free
on its `/run/user/1000/containers` runroot filesystem.
This accepts logging and module availability; no audible speech test was run.

## Installed inventory correction — a1a6bd9 (2026-10-15)

Installed source `a1a6bd96913189809fb6f81ae4f059698f327de6`, version
`0.0.0-standard-account-inventory`; archive SHA-256
`a651e881f16a758a3235100072173158ffae5153b67ab578cbd92387c24ca55e`.
Complete local CI/race, red/green ASIF regressions, pinned Staticcheck,
Govulncheck and Gitleaks (235 commits) passed. Idle install preserved signing/FDA,
configuration, keys and all eight image records (seven originals plus the new
candidate). Exact installed HTTP/fresh stdio, four runbooks/resources/status and
anonymous 401 passed in 1.01 seconds. All four actual owning-client runbooks still
differed from that package at this dated checkpoint; see the newer check above.

- **macOS 27 UI-test candidate: PASS 2/2** complete worker cycles on the retained
  new golden, with standard account authentication before/after real reboot,
  native GUI/new SSH WhenUnlocked I/O, fresh boot UUID/nonces, unlocked console,
  1920×1080, Xcode 27.0/27A266a and Swift compile/run, workspace checksum,
  artifact hash, RFB before/after, independent SSH-key rejection and confirmed
  release/revocation. Its exact original `uitest-27-v1` profile was qualified on
  `0f8bc20`; the inventory-only correction does not change that recipe/guest code.
- **ASIF live factory correction: PASS.** A new public-base factory produced an
  observed disk size zero, then 140,000,000,000 bytes after stop, without daemon
  restart. Two full standard-account/native/reboot/workload/artifact/RFB/release
  clone cycles passed; temporary factory/workers were deleted and all eight
  baseline image manifests remained unchanged. This directly accepts recovery
  of an incomplete cached size, not just a restart clearing the old cache.
- **Production Broker/Prism script-only candidate workflow: PASS.** The supported
  per-run `image_id` selected the new verified golden while leaving the global
  `macos27` template unchanged. Actual bootstrap/Callee/XCTest completed with one
  passing test, hashed artifact export, retained `.xcresult`, Story completion
  and cleanup done. No provider role or Human gate ran. This does not accept the
  default template, full Codex Story, explicit denied-write or credential reuse.

Receipts: `virfield-standard-uitest-macos27-20261015`,
`virfield-inventory-factory-a1a6bd9-20261015` and
`virfield-broker-candidate-xctest-a1a6bd9-20261015` under private `/private/tmp`.
The operator explicitly authorized the production route switch and foreign-log
cleanup on 2026-10-15. `macos27` now selects the accepted
`release-check-macos27-standard-v1` golden; the temporary duplicate template was
removed. Private config backup, original golden and all eight image manifests
were preserved across the idle daemon restart (PID 87631). A **default-template
production Broker/Prism script-only run passed**: actual XCTest 1/0, retained
`.xcresult`, verified artifact sizes/SHA-256, Story completion and cleanup done.
Receipt: `virfield-broker-default-xctest-a1a6bd9-20261015`, run
`run-fac6b0cde10fec26450dc38c4694d5ff`. No per-run image override, provider role,
Human gate or chat message was used. Full Codex Story/denied-write remains open.
`a1a6bd9` and documentation `cab85c5` are pushed to the working branch under the
operator's explicit session-wide push authorization; no main/tag/release change.

The HTPC speech log's 3,357,126,656 bytes were initially copied to a private same-node HDD
backup, reread and SHA-256 verified before truncating only the original log.
SHA-256: `90664f48489073a9f2e2b587433ebabeed337dff3f8b6af3e6af0895d0d6840d`.
The operation freed 3,357,130,752 bytes in Podman runroot. Subsequent observation
found the log growing again; that one-time cleanup did not establish a lasting
fix. The newer cause/fix/deletion receipt is above. Sequoia **2/2 and Sonoma
2/2** then passed full standard-account/native GUI/new SSH/reboot/new UUID/
1920×1080/workspace/workload/artifact/RFB/cross-key/release/revocation cycles;
all four workers were released. These successful fresh cycles do not establish
the cause of the historical Sonoma reboot stall. Receipt: `virfield-htpc-preserve-and-truncate-speech-log-20261015.log`;
new matrix root: `virfield-htpc-standard-after-runroot-a1a6bd9-20261015`.

Owning MCP acceptance and iPad transfer remain open. F4's first implementation
passed full local `make check`, final affected Go race tests,
pinned Staticcheck 0.7.0, Govulncheck 1.6.0 (zero reachable) and Gitleaks 8.30.1
working-tree scan. It was installed as `3d667d2`, but its sparse-allocation
regression above prevents live acceptance.
The complete candidate and the remaining hardening/client/provider gates remain
unaccepted.

## Standard password policy — installed, matrix acceptance partial

The operator requires the standard VM **`admin` / `admin`** account and explicitly
rejected automatic random account-password rotation. Candidate source now creates
standard account credentials and never changes an already-standard password. A
new disposable clone of an old image authenticates its inherited password before
a one-time conversion to the standard password. Existing golden credentials are
never silently rewritten; in-place securing of a legacy golden is refused before
mutation. `0f8bc20` / `0.0.0-standard-account` was packaged, installed with a
private backup and accepted on Samsung Monterey in two complete cycles. The
remaining profile/client matrix is open.
Existing secured images may retain generated credentials; do not assume they
already accept the standard password or modify them outside a journaled migration.

Local source checks on 2026-10-15 passed: complete `make check` (17 Python
tests, Go vet and full race suite), Staticcheck 0.7.0, module integrity,
Govulncheck 1.6.0 (zero reachable vulnerabilities) and Gitleaks 8.30.1
(233 commits). New stateful shell regressions cover unchanged standard accounts,
one-time legacy-clone conversion, wrong inherited credentials, random targets
and ineffective password changes; credential tests preserve legacy journals and
independent SSH keys. These are source checks, not installed/native acceptance.

Keep management/caller SSH keys, fresh host keys, host pinning, inherited/cross-lease
key rejection and key-only SSH. Preserve login-keychain items and workspaces;
resetting/deleting a keychain or replacing a protected golden is not acceptance.
New policy acceptance must cover image preparation, worker creation and actual
reboot, standard account authentication, automatic login and native GUI/new SSH
`WhenUnlocked` add/read/data comparison/delete, plus display/workload/artifact/
RFB/release. Older passing cycles below used the previous password policy.

## Standard-account checkpoint — 0f8bc20 (2026-10-15)

- Package `0.0.0-standard-account`, archive SHA-256
  `b8805029ef847f28b0eea2d87af36203d480746cf08e6f08fe754ac28ce0d9a5`;
  idle install preserved signing/FDA identity, config/keys and all seven baseline
  manifests. Exact installed HTTP/fresh stdio, all four runbooks/resources,
  status and anonymous 401 passed in 1.13 seconds. This chat's owning MCP responds
  but serves an older guide; its requested Restart is pending.
- Samsung Monterey 12.7.6 / Xcode 13.4.1: **PASS 2/2** complete cycles with actual
  `admin/admin` authentication before/after reboot, fresh boot UUID/native GUI/new
  SSH I/O, 1920×1080, workspace checksum, Swift compile/run, artifact hash, RFB,
  cross-key rejection, release and revocation. Receipt root
  `virfield-standard-account-native-20261015/monterey-xcode-13.4.1`.
- Existing macOS 27 golden: native login copy authentication still fails with
  `-25293`; exact own clone released after bounded evidence. A fresh same-pinned
  public-base `security-v1` image passed native/reboot qualification, then worker
  admission refused `resource_unknown` before allocation; own temporary image
  deleted. A separate exact `uitest-27-v1` golden also passed full qualification
  including Xcode 27.0/27A266a and native post-reboot checks; workers await the
  inventory fix below. Production template and old golden remain unchanged.
- Fresh ASIF golden admission defect **reproduced**: API caches `disk_bytes=0`
  indefinitely while fresh stopped `tart get` reports `Disk: 140`, with unchanged
  config. Candidate source now caches only positive disk sizes, with red/green
  zero/absent-disk regressions and a positive-cache reuse assertion. Complete local
  `make check`, pinned Staticcheck and Govulncheck passed for this correction.
  Subsequent package/live acceptance is recorded above; the qualified golden
  was preserved and its build was not replayed.
- HTPC: exact new Sequoia clone failed before overlay creation. Read-only pinned
  `qemu-img info` established Podman `no space left on device` in its runroot:
  `/run/user/1000` had 4,096 bytes free, while the HDD had 2,885,316,886,528 bytes
  free. The unrelated speech-dispatcher log used 3,357,126,656 bytes. The inspected
  own partial clone was resolved/released without replay. Backup/truncation of
  that foreign log awaits separate approval; no foreign files were changed.
  This is distinct from the older Sonoma reboot failure, which remains open.

Private roots: `virfield-standard-account-factory-20261015`,
`virfield-standard-uitest-macos27-20261015` and the per-profile native root above.
A new static test template was added with a private config backup during idle;
all seven original goldens/manifests and production routing were preserved.

## Previous installed checkpoint — f60efe3 (2026-10-15)

| Artifact / operation | Evidence and boundary |
|---|---|
| Installed source | `f60efe3310cd3806c18481b5d22089c421849f8b`, version `0.0.0-browser-transport-trace` |
| Archive | `virfield-v0.0.0-browser-transport-trace-darwin-arm64.tar.gz`; SHA-256 `941da8a267107103918ddc553290419f104148f5bebb7503917b130328265c00` |
| Local checks for that code | Complete `make check`: seventeen Python tests, documentation links, formatting, Go vet/full race suite; pinned Staticcheck 0.7.0, Gitleaks (229 commits), clean archive/extraction/signature/config smoke passed |
| Installed provenance | Private backup, prior signing/FDA identity, unchanged configuration/keys and all seven baseline image manifests verified; receipt `upgrades/*-f60efe3/installed.json` |
| Installer correction boundary | Binary replacement succeeded; the private installer's final predicate incorrectly required a deleted disposable template. Read-only attestation completed without repeating installation/restart |
| Service migration | Operator completed the separately approved Background → Standard migration; only plist `ProcessType` changed; fresh daemon PID 65903 and installed signed hashes verified |
| Exact installed MCP smoke | HTTP/fresh stdio version, all four runbooks/resources, discovery/status and anonymous 401 passed: 1.22 seconds before migration, 0.18 seconds after |
| Owning release-task MCP | Actual help still returns `Transport closed` after user-confirmed Restart; rechecked during this documentation reconciliation. Fresh stdio and Broker's separate working client do not close this gate |
| Latest cleanup | Both failed owned macOS 27 fixtures released with original journaled keys after bounded diagnostics; API then reported zero worker leases/jobs, capacity 0/2 and seven image records |
| Lume | Runtime/factory/wrapper/build/install paths removed; old separate service disabled/unloaded; latest retained check at 14:07 UTC confirmed port 7777 closed; rollback files preserved |

This documentation revision changes embedded help in the next build only. The
previous `f60efe3` package served its own older embedded runbooks. New code
requires fresh exact-source local checks and a clean package; no source-only
change is an installed fix. Remote CI remains deferred by the operator.

### Dated native provider results before the standard-account candidate

| Profile / tested code | Result | Scope and remaining work |
|---|---|---|
| HTPC Sequoia / `f60efe3` + Standard | **PASS 2/2** full fresh cycles | Native Aqua and new SSH `WhenUnlocked` I/O, unlocked unobstructed console, 1920×1080, actual reboot/new boot UUID/nonces, retained SSH pin, RFB before/after, workload/artifact hash, cross-key rejection, release and tunnel revocation; repeat relevant gates after account-policy change |
| HTPC Sonoma / `f60efe3` + Standard | **FAIL reboot** | Initial readiness/native GUI/new SSH/1920×1080 passed. Following one reboot dispatch, no returning SSH or new boot UUID within the full 1,200-second budget. QEMU/container stayed running, guest SSH banner was absent even from node loopback; bounded logs/frame retained, fixture released and listeners revoked. Exact stall cause unproven |
| macOS 27 / `f60efe3` | **FAIL native login authentication**, twice | Aqua agent exited 65 in login-rekey; current/previous/user candidates returned `-25293` at copy-unlock. Display passed, but native readiness and workload did not. Both owned fixtures released; no worker reboot or second successful clone claimed |
| Samsung Monterey / `614daf5` | **PASS 2/2** full cycles | Native GUI/new SSH, real reboot/new UUID, 1920×1080, Xcode 13.4.1/13F100 Swift compile/run, workload/artifact/RFB/release/revocation; historical policy, new policy untested |
| Fresh public-base Ventura factory / `614daf5` | **PASS** qualification + two full clone cycles | Native/reboot/workload/artifact/RFB/release passed; own factory/workers deleted, seven baseline manifests retained; no registry push repeated |
| iPad Monterey / `6779b6f`, `8c521fe` | **PASS** earlier native/reboot and exact Xcode/Swift receipts | Fresh repeat blocked by internal storage. Observation at 13:52 UTC: about 75.7 GB free versus about 150 GB full-growth-plus-reserve requirement; this is a dated snapshot, not current free capacity. No reserve reduction or foreign cleanup. Cross-container Tart clone is currently refused |
| Tart four-profile matrix / `4a53b67` | **PASS 8/8** earlier | iPad/Samsung Monterey, Ventura and macOS 27, two native/reboot/display/workload/artifact/RFB/release cycles each; does not override newer macOS 27 failures |

Monterey in these records is **macOS 12.7.6 with Xcode 13.4.1**, not macOS 13
(Ventura). Neither historical workload success nor an image-ready record accepts
the whole standard-password provider matrix.

Private receipt directories under `/private/tmp` retain request keys, exact owned
identities and bounded evidence:

| Result | Receipt directory |
|---|---|
| Sequoia first / second | `virfield-htpc-sequoia-diagnostic-f60efe3-20261015`, `virfield-htpc-sequoia-second-f60efe3-20261015` |
| Sonoma reboot failure | `virfield-htpc-transport-diagnostic-f60efe3-20261015` |
| macOS 27 failure / follow-up diagnosis | `virfield-macos27-native-f60efe3-20261015`, `virfield-macos27-auth-diagnostic-f60efe3-20261015` |
| Samsung Monterey / public factory | `virfield-installed-samsung-monterey-614daf5-20261015`, `virfield-installed-native-factory-614daf5-20261015` |
| Earlier iPad native / toolchain | `virfield-installed-ipad-monterey-6779b6f-20261015`, `virfield-installed-ipad-monterey-8c521fe-20261015` |

### What keychain and transport research actually established

On the retained macOS 27 diagnostic guest, five isolated native fixtures passed,
including real copy authentication/cache refresh and existing-item preservation.
The original login keychain reported unlocked (flags 7), but copies rejected all
examined known candidates with `-25293`. Guest current/previous identity values
matched controller/source-image credentials; six retained image-credential files
contained one distinct source secret. Original keychain bytes/default/search list
were preserved. These observations do **not** distinguish an unknown historical
keychain password from corruption, establish that the native APIs are generally
broken, or prove that Standard migration fixed this profile. No original
keychain reset or full keychain export to the host was performed.

A separate earlier Monterey diagnosis did establish inconsistent cached state:
the original rejected native authentication and SecItem access while a private
in-guest copy accepted the same current password. One validated native cache
refresh restored I/O and preserved items. Its `614daf5` correction has five native
fixture tests and the dated Monterey/factory acceptance above. That evidence does
not prove the same cause for macOS 27. Removing account rotation is now explicitly
required; cache research does not override that product decision.

The older inherited-desktop SSH failure hit a 60-second command timeout before
worker credentials existed; later read-only SSH succeeded. Installed `f60efe3`
adds bounded private channel-open/exec-acknowledgement/command-exit trace, covered
by real stalled-SSH regressions. Fresh Standard-era Sonoma/Sequoia desktop probes
completed in about 124/153 milliseconds. The old timeout was not reproduced in
those cycles; its exact cause and causal relation to Standard remain unproven.
The current Sonoma reboot failure is a separate full-budget failure, not the
older private verifier's prematurely aborted single reconnect attempt.

Historical Monterey `vm_drift` and tunnel closure still lack a specific proven
cause. Current source logs some expected/observed drift fields but persists a
generic event, clears the endpoint and offers cleanup-only operator resolution.
Recovery-in-place and durable tunnel-close explanations are planned F1/F2 work,
not capabilities supplied by the transient-inventory preservation fix.

### Broker macos27 reacceptance

**Current result: PASS on 2026-10-16**, including actual production Story,
reviewer os.open/EPERM, independent tests, artifact hashes, credential settlement
and worker release. See the [latest installed checkpoint](#latest-installed-checkpoint--8bfff9f-2026-10-16).
The paragraphs below preserve the earlier failed-run history and its then-open
closure criterion; they do not reopen the completed current gate.

The Broker `macos-codex` profile uses Tart template `macos27`. Three production
qualification attempts failed `guest_keychain_failed` before bootstrap/provider
execution; the last Broker-tested candidate was `614daf5`. All three owned leases
were released. Exact run/job/lease bindings, deployment provenance and timestamps
remain in the private Obsidian incident register and Broker evidence.

Before the candidate script-only acceptance above, Broker had not repeated its
production macos27 path on `f60efe3` after Standard migration. The two standalone `f60efe3` failures above establish native login-auth
failure on that deployment; they are not Broker Story runs and do not identify
the old three attempts' unrecorded substage. The generic public error alone proves
no particular password, OAuth or cache cause. Broker's own working MCP help/status
is likewise a separate client from the release task's closed transport.

Close this gate with a fresh worker on the corrected exact installed candidate:
pinned SSH, native GUI/new SSH key storage and console qualification, production
Broker bootstrap/Story, independent tests, explicit Codex read-only write denial,
artifact hashes, credential settlement and confirmed release. Preserve bounded
private diagnostics before cleanup within the existing deadline; keep public
job/lease error evidence if private detail is unavailable. Do not indefinitely
retain failed VMs or repeat unchanged attempts as proof of a fix. See
[VM keychain operations](OPERATIONS.md#vm-keychain-readiness).

## Completed receipts to preserve

| Gate | Tested result / limits | Private receipt |
|---|---|---|
| Factory/private GHCR | `2f23ae6`: fresh pinned public-base factory qualification/two clone workloads, separate fresh sanitized portable build, authorized private push/visibility/digest, pull/qualification/two clone workloads/artifacts/RFB/release, own-image cleanup; seven baseline manifests preserved; no managed golden uploaded | `virfield-release-roundtrip-20261014/journal.json`, result stage `roundtrip` has `passed: true` |
| Registry identity | Private package `mallexxx/virfield-hardening-acceptance`, tag `release-check-0644cb90dac8`; digest `sha256:a5d42b4e6e48641fba1af7171158de39252e4439d3087c1b019f392223054e73`, 21,460,835,255 descriptor bytes; registry evidence retained | Same durable roundtrip journal |
| Live controller-state restore | Restored private SQLite/images/node identity with new owner token; one manager/listener, old token 401, seven manifests intact, exact MCP and two native Monterey reboot/workload/release cycles; byte-exact original config/state returned | `virfield-live-restore-drill-20261015/report.json` |
| Signed controller-binary rollback | `2724f94 → 2f23ae6 → 2724f94`, fresh processes/versions/hashes, original config and images verified; unknown probe inspected before resuming | `virfield-controller-rollback-drill-2724f94-20261015/report.json` |
| Service migration | Only ProcessType Background → Standard; hashes/config/keys/seven images unchanged; exact HTTP/fresh stdio passed afterwards | `virfield-standard-migration-external-verification-20261015.json` |
| Native browser GUI | Fresh installed `f60efe3`, Safari URL handoff, real Apple sign-in page, controls visible with long URL; fake expired link handled; test app/tab closed | `virfield-native-browser-gui-f60efe3-20261015.json` |

Repeat a completed gate when relevant behavior changes; do not rerun a registry
upload, state restore or rollback merely because an unrelated gate remains open.
Controller-state restore excludes VM disks. Controller-binary rollback excludes
complete package/client rollback. Registry publication must always use a fresh
portable public-base build, never a private managed golden.

The browser GUI receipt used a synthetic non-authenticating link; no Apple account
credentials were entered or authenticated Xcode download resumed. Cookie handoff
and actual download completion remain a distinct untested flow requiring a real
pending download and operator sign-in. The native browser now explicitly targets
the plist's macOS 13 minimum; Mach-O metadata/build check passed, not a live macOS
13 host test. Apple login is not required to repeat the synthetic GUI smoke.

## Acceptance status and untested paths

| Path | Verified state / limit |
|---|---|
| Standard account/native matrix | Passed for both Monterey inventories, new macOS27 golden and HTPC Sonoma/Sequoia; old goldens remain preserved. The earlier kernel-stall trigger is unproven; later passes are not a causal fix |
| Actual owning MCP | Passed full actual connected20/four exact packaged8 runbooks and VM workflow through release/revocation |
| Production Codex Story | PASS run12f0932: actual reviewer os.open/errno1/exit0, independent four-test replay, artifact hashes, clean exact two-file commit, saved owner plan, credential settlement and worker release |
| Release engineering | Code/local security/archive/install checks and full signed package rollback/forward passed; source documentation records later evidence separately from installed8 binaries |
| Apple authenticated download | Actual sign-in/cookie handoff/exact-job download completion remains untested. Synthetic GUI/Safari/real login-page smoke passed; no macOS13-host live test claimed |
| Additional operations scenarios | Fresh node post-wake failure injection, broader provider crash/host loss/partition/full-disk matrix, metrics/alerts and signed promotion/revocation remain outside these completed receipts |

F1 recovery, F2 durable diagnostics, F3 admission arithmetic/Tart wait-resume/node
cache refusal, F4 sparse local transfer and F5 legacy iOS factory/worker each have
installed live receipts above. Existing HTPC golden chmod remains an optional
unapproved hardening proposal; no chmod was performed. Orchard live pool, wider
v3 grants/Access/node-agent/noVNC and additional providers remain roadmap scope.

## Not yet accepted

The accepted scope above does not cover
Orchard worker restart/drain or mixed-primary-provider scheduling, remote/container
TLS through the intended production entrypoint, full apple-browsers UI-suite
through Broker, physical-host desktop, Vetu/Linux VM coverage or the whole v3
roadmap. Earlier DDG UI smoke and Broker v1 smoke have narrower dated scope.

## Historical evidence

[Checkpoint archive through 2026-10-15](history/VERIFICATION-checkpoints-through-2026-10-15.md)
preserves the previous detailed investigations, fixed-defect table, package hash
ledger, DDG/CI findings and R1–R3 receipts. Its then-pending statuses and password
rotation descriptions are superseded here; no old passing result is erased.
[Pre-2026-10-14 records](history/VERIFICATION-before-2026-10-14.md) include the retired
Lume deployment. Dated plans/specs remain provenance, not current runbooks.

## Release procedure

Use a clean committed revision and run local CI/security/release checks for that
exact source. Build with `tools/release.py NEW_VERSION --output NEW_DIRECTORY`;
it packages fresh binaries/native browser, notices, hashes and revision manifest.
Validate extraction, signatures, current configuration, URL scheme, idle-pool
installation, actual clients, native workflows and confirmed cleanup. Preserve
private backup, signing/FDA identity, configuration, keys and existing goldens.
Never overwrite outputs/tags or replay unknown mutations blindly. The
[live acceptance runner](../tools/live-acceptance.py) retains durable private keys
and request journals and requires authorization for its disposable cleanup.

This task authorizes working-branch push with `[skip ci]`, not merge/tag/release.
The historical published `v2.0.0` is a Lume archive, not this Tart implementation.
Keep unfinished feature delivery separate from verified readiness of current code.
````