[reiase]

Outcome

Completed the requested six-hour iteration window: 2026-11-12 14:21–20:21 UTC (22:21–04:21 Beijing time). The final read-only audit was recorded at 20:21:00.053187Z. This includes scenario design, bounded builds, resource pauses, investigation, repair and delayed observation; it is not six continuous hours of load.

Fixed one confirmed product defect: --result-file could overwrite the current Session's Bundle or completion receipt after guest execution, breaking offline status/review. Both ordinary spawn and prepared --spec now reject resolved export destinations inside the current opaque Session storage before workload startup. Component-aware containment preserves external same-name files and adjacent stage2. Admission is not a TOCTOU reservation.

The fix was published separately in a5e3e093; helper coverage and the intentional help snapshot update followed in 79835afa. Other production algorithms and public interfaces are unchanged. Additional changes are bounded regression tests, owning README/help documentation, and the campaign report.

Validation performed by subagents

Package	Final local package result
pvisor-journal	33 passed, zero skipped
pvisor-core	91 passed, zero skipped
pvisor-overlay-core	246 passed, five existing ignored diagnostics skipped
pvisor-replay	155 passed, one existing ignored long test skipped
pvisor-cli	338 passed, zero failed, 40 existing skips

Rust execution used mise run test -- PACKAGE -- --offline --no-capture for the full package regressions, with exact per-phase commands/filters in the report. CLI all-targets Clippy with warnings denied, targeted Clippy for the other new tests, formatting and whitespace checks passed with source-version qualifications recorded. Independent final read-only review found no blocker.

• Four self-overwrite regression cases failed before repair. Seven new destination tests and two private implicit-storage/symlink-ancestor tests passed after repair; existing external-obstruction recovery remained intact.
• Journal, Core, Overlay Core and Replay ran bounded changing-seed campaigns. Subcases and repeated seed executions are not reported as distinct nextest tests.
• NativeHost: 1,280 pre-fix changing seeds and 512 post-fix changing seeds, plus default/regression reruns.
• A 360.433-second live safe Session received an external export obstruction 120.020 seconds after readiness. Guest completion/once-only effects, readable immutable records, explicit export failure, selective apply/drop and a healthy successor passed.
• Total recorded nextest execution wall time: 6,934.221 seconds. Across repeated invocations: 1,634 passes and six historical failures (four repair regressions, intentional help mismatch, and the disclosed long-socket-path fixture failure). This is not a distinct-test count.

CI and historical failures

All 33 CI checks passed for code revision 79835afa, verified at 19:58 UTC. The final campaign-closing commit changes only the report; its own CI is separate from that green code checkpoint.

Historical failures remain recorded:

• Early NativeHost compilation exceeded the initial owned 1 GiB cgroup budget; no runtime pass was claimed. Once host RAM recovered, a separately admitted 4 GiB phase enabled the real NativeHost runs.
• APFS rejected invalid-UTF-8 fixture names. macOS now uses Unicode names while Linux retains raw-name coverage; subsequent CI passed that test.
• One existing macOS Replay continuation test hit a supplier/startup deadline. Later CI passed, but its root cause is not claimed fixed.
• Full CLI validation initially hit the intentional help hash change and a 109-byte Unix-socket fixture path. The help contract was aligned with an explicit assertion; the same socket assertions passed using a shorter owned worktree-local TMPDIR. No timeout or production socket assertion was relaxed.

Resource control and cleanup

One serial executor, nice priority, finite watchdogs, measured CPU/memory/PID limits, no added swap and resource admission/stop thresholds. Most small-component work used CPU 50% and a 1 GiB hard limit; the later NativeHost phase used a 4 GiB maximum only with at least 14 GiB startup headroom. Initial threshold stops and the owned-cgroup compilation OOM are environmental evidence, not product failures.

Final delayed audits confirmed all 47 captured owned cgroups absent, no owned service/unresolved gate or successful Native fixture, and no worktree mount in the observer's current namespace. Twelve damaged-record reproduction fixtures and two failed-run HOME roots are intentionally retained with stable manifests. Persistent target-key apply-lock files may remain by design; no shared directory was swept.

Limits and evidence

• No all-namespace cleanup certification, hostile alias/TOCTOU guarantee, real power-loss/host-exhaustion experiment, local other-platform NativeHost/VM acceptance, local full-workspace/Python/rustdoc run or exactly-once execution claim.
• Replay pipe output has exact input/tail and log-size checks, not full-body fidelity; redirected output has full-body comparisons.
• Overlay host edits are scheduled between preview and apply, not during publication. Committed-recovery checks are not crash-recovery experiments.
• Canonical report: CHAOS_TEST_6H_20261112.md, with a closed-window summary, exact commands, source versions, timings, resource samples, skips and preserved historical failures. Raw evidence remains ignored in the test worktrees.
• No merge into main, force-push, package publication or semspec approval.