ARCADIA-Studio/harness/release-linux-host-ytr83r-20260911.md

# Linux route on host Codex-ytr83r — 2026-09-11

Owner: Codex-ytr83r `/root/linux_runtime`. This is a new host inventory and bounded preparation report, not a reuse of another host's Linux acceptance. Root owns source integration and heavyweight build scheduling. No production files or Cargo jobs are owned by this worker.

## Current outcome — 2026-09-11 13:25:20 UTC

The official Ubuntu image is fully verified and reusable. The normal Q35/UEFI/TCG pilot ended at its time limit without guest-ready evidence. Serial, stdout and stderr were empty; QMP accepted ACPI powerdown, then the helper requested a forced stop at 300.564 seconds and recorded process exit at 310.155 seconds. This is an inconclusive boot observation, not Linux runtime acceptance or evidence of the other host's IO-APIC failure. No second boot, Linux Cargo, GUI or system/security/network change followed. See the final delivery/pilot evidence below; the intervening transfer checkpoints are preserved history.

## Final delivery and pilot evidence

The suffix controller reused the original prefix, 39 complete retained chunks and correct HTTP 206 partial prefixes after five available byte-overlap comparisons. It requested only missing suffixes of at most 256 KiB, two concurrently, with exact status/range/length checks, 60-second requests and bounded transient retries. All new requests completed without retry. Sequential assembly required complete gap-free coverage and rechecked retained hashes; no holes were accepted. Before the publisher check, coverage comprised 250,232,832 complete-response bytes plus 14,139,392 provisional-only bytes across 847 segments. The full publisher check then validated the entire assembled image, including those provisional bytes.

- Exact image size: 264,372,224 bytes. SHA-256: `46b0dbaffa6950a7da5ff2dc5ed34c46084610b3b6d1fae8f1ec2d7e953984a3`, matching fresh [publisher SHA256SUMS](https://cloud-images.ubuntu.com/minimal/releases/noble/release-20260905/SHA256SUMS), an independent local rehash and preparation rehash. QEMU installer publisher SHA-512 also passed again.
- Suffix run: 1,952.520 seconds, 209,338,368 image bytes transferred, zero retries. Original 60-minute attempt elapsed 3,122.192 seconds, below its unchanged 13:26:26.250 UTC deadline. Historical prefix/chunk files and failed attempts remain preserved separately.
- `qemu-img info` reports QCOW2, 3,758,096,384 virtual bytes, not corrupt, dirty flag false. Preparation created a separate 12 GiB virtual overlay, private UEFI variables and disposable SSH/NoCloud seed. The publisher image remains the verified backing file.
- Independent prelaunch read at 13:18:48 UTC: 4,063,617,024 bytes free RAM and 32,082,993,152 bytes free disk; the helper also enforced its own 2.75 GiB RAM/15 GiB disk gate. No runtime floor was breached.
- Pilot command and process evidence: `.local/linux-host-ytr83r/pilot-20260911/command.json`, `events.jsonl`, `result.json`. Normal Q35, TCG single thread, CPU max, one CPU, 1536 MiB, publisher UEFI code/private variables, virtio disk/network, loopback-only seed/SSH/QMP. Spawn at 13:20:10.433 UTC, PID 5072. ACPI request at 270 seconds received QMP capabilities and POWERDOWN acknowledgment. Force-stop requested at 300.564 seconds; SIGTERM exit recorded at 310.155 seconds, 13:25:20.557 UTC. Thus the stop request met the timer boundary, but host process termination had a measured 9.6-second delay; no clean guest shutdown is claimed. QEMU PID 5072/helper PID 5388 were absent afterward.
- All three serial/stdout/stderr logs were zero bytes. No Linux shell, SSH, filesystem, application, package or Cargo validation was established. No kernel panic was observed. [Issue comment 252](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/1#issuecomment-252) records the verified-image milestone before pilot completion.

Raw suffix evidence lives in `.local/linux-host-ytr83r/ranges-suffix-20260911/`. SHA-256 anchors: controller `1BF912221220B8A549CB91895D190D69A6D66B69AFAA87AF649D8BC0FC1EC6F6`; suffix result `11A4D4D9675E5A9E5AE5F1EB3EBF3CB0DACD0883E308081FF006B012C446C0FE`; pilot events `32A87ED335274504CF204545B63BFF124BD8C26C2B02FD1EA732D9F9DEF8D767`; pilot result `BFC0F6972987CDB636D314F389F3DE071915E1732D29FD29418A606000B17BD5`.

## Bounded read-only observability diagnosis

The package's `share/firmware/60-edk2-x86_64.json` explicitly pairs `edk2-x86_64-code.fd` with `edk2-i386-vars.fd` for x86_64/Q35. The i386 variable-template filename therefore does not establish a mismatched firmware pair. The captured command contains neither CPU pause `-S` nor direct kernel/timer workaround arguments.

The pilot used both `-display none` and `-vga none`, with only `-serial file:...`. QEMU documents that these respectively suppress displayed video and remove the emulated VGA card; serial redirection captures the guest serial port, not all firmware output. [QEMU command reference](https://www.qemu.org/docs/master/system/qemu-manpage.html). OVMF documents a separate default debug I/O port 0x402, serial debug as a build-time choice, and disabled debug messages in RELEASE builds. This pilot had no debug-port capture; the precise firmware build's enabled logging was not proved. [OVMF README](https://github.com/tianocore/edk2/blob/master/OvmfPkg/README).

Inference: the empty serial log is insufficient to distinguish early firmware inactivity, output on an unobserved console, boot-manager/media discovery delay, or later guest startup. QMP response proves emulator control availability, not guest boot. The low observed QEMU CPU/working set during early startup is evidence of slow initialization, not a root-cause diagnosis. A later root-authorized normal observation could retain VGA and capture its framebuffer, collect QMP status/block/CPU observations plus serial and ordinary SSH readiness, and, if explicitly approved, capture the documented debug port without firmware/kernel behavioral overrides. Those observations would distinguish firmware screen/media selection from kernel output and successful SSH startup. No second boot or configuration mutation was performed. Root must coordinate the next bounded observation and resources before any Linux build.

## Historical checkpoint — 2026-09-11 13:14:02 UTC

The authorized suffix assembler is active. Contiguous delivery is 229,736,448 of 264,372,224 bytes: 215,597,056 bytes from complete range responses and 14,139,392 provisional-only retained prefix bytes. Five available overlap comparisons passed; the current suffix run has needed zero retries. Missing requests are at most 256 KiB, with at most two concurrent requests and exact HTTP 206/range/length checks. The original delivery deadline remains 13:26:26.250 UTC, including elapsed earlier continuation time; five-minute checks continue to require contiguous progress. Full-image publisher SHA-256 verification and the normal five-minute UEFI/Q35 pilot are pending. Partial delivery is not accepted boot media. Root permits the conditional pilot while Windows compilation continues only if resource checks pass; the helper requires at least 2.75 GiB free RAM and 15 GiB free disk before its unchanged 1536 MiB guest launch. No Linux Cargo or host/system changes have run. Raw state is in `.local/linux-host-ytr83r/ranges-suffix-20260911/`; preceding sections below preserve earlier route and transfer history.

## Direct host evidence

Read issue #1 through the current coordination, the Release-readiness Wiki and historical Linux cross-build/runtime reports. No open pull requests were returned. Work ownership was posted as issue comment #149.

| Probe | Observed on this host |
| --- | --- |
| `Get-CimInstance Win32_OperatingSystem` | Windows 11 Pro, 10.0.26200, build 26200; last boot 2026-09-11 03:12:27.5 -07:00 |
| `Get-CimInstance Win32_ComputerSystem` | VMware, Inc. / VMware20,1; HypervisorPresent true; 8,588,644,352 bytes RAM |
| `Get-CimInstance Win32_Processor` | Two reported logical CPUs; Intel Core i7-10870H; VirtualizationFirmwareEnabled and VMMonitorModeExtensions false |
| `wsl --version` | WSL 2.7.13.0; kernel 6.18.33.2-2; WSLg 1.0.73.2; Windows 10.0.26200.8457 |
| `wsl --status` | Default version 2; WSL1 optional component unavailable; WSL2 cannot start because virtualization is not enabled |
| `wsl --list --verbose` | No installed distributions |
| `Get-CimInstance Win32_OptionalFeature` | VirtualMachinePlatform InstallState 1 (enabled); WSL1 and Hyper-V feature family InstallState 2 (disabled) |
| `Get-Service WslService,vmcompute,hns,LxssManager` | WslService running; other requested names absent |
| CBS `RebootPending` registry-key existence | True; inspected only |
| Initial resources | 4,468,444 KiB free physical memory; C: free 37,781,413,888 bytes (35.19 GiB) |
| Normal executable lookup | WSL found; Docker, Podman, QEMU, SSH, rustup and Cargo absent from PATH |
| Bounded conventional-path inventory | No Program Files QEMU/Docker/Podman; 7-Zip and Git-bundled SSH/ssh-keygen present; no user `.cargo/bin` or `.rustup/toolchains` result |
| Existing task caches | No historical `.local/linux-qa`, `.local/linux-wsl` or cross-Linux cache; root is separately creating `.local/toolchain` |

These observations establish an unavailable WSL guest now. They do not prove which outer VMware configuration or pending Windows component state is responsible. No distro import, Windows feature/registry modification, host restart, service override or existing credential inspection was attempted. The pending reboot is reported without assuming a reboot alone would fix nested virtualization. Microsoft's [WSL troubleshooting](https://learn.microsoft.com/en-us/windows/wsl/troubleshooting) and [WSL VM FAQ](https://learn.microsoft.com/en-us/windows/wsl/faq) describe the relevant platform/nested-virtualization prerequisites.

## Route decision and preparation

The local route selected for measurement is portable QEMU TCG with an official Ubuntu Minimal cloud image. QEMU documents [TCG support on Windows](https://www.qemu.org/docs/master/system/introduction.html), and its [Windows downloads](https://www.qemu.org/download/#windows) link to Stefan Weil's builds. This permits a real Linux kernel without changing this Windows host's virtualization settings. It remains software emulation, with unmeasured application/GUI performance.

Root explicitly authorized a fresh normal-boot pilot on this distinct host: one CPU, approximately 1.5 GiB guest RAM, five-minute first boot, preserve 15 GiB host free disk for Windows work, no simultaneous Rust compilation. The previously rejected direct-kernel / `no_timer_check` workaround is outside this pilot and is not used.

Task-local root: `.local/linux-host-ytr83r/`. Pinned downloads:

- [QEMU 20260811 Windows payload](https://qemu.weilnetz.de/w64/qemu-w64-setup-20260811.exe), expected 206,615,928 bytes; publisher [SHA-512](https://qemu.weilnetz.de/w64/qemu-w64-setup-20260811.sha512).
- [Ubuntu Minimal 24.04 amd64 QCow2, release-20260905](https://cloud-images.ubuntu.com/minimal/releases/noble/release-20260905/ubuntu-24.04-minimal-cloudimg-amd64.img), expected 264,372,224 bytes; release [SHA256SUMS](https://cloud-images.ubuntu.com/minimal/releases/noble/release-20260905/SHA256SUMS).

The planned extracted footprint is about 1.6 GiB based on the historical identical payload, plus an initially small sparse guest overlay. This is a planning estimate until measured locally. The installer is only an archive for 7-Zip extraction; it will not be executed. Checksums must match the downloaded publisher files before binaries or images are used. Independent OpenPGP verification is not claimed.

Prepared `pilot.cjs` uses normal Q35/UEFI boot, a private writable UEFI variables file and a new QCow2 overlay; `tcg,thread=single`, CPU `max`, one vCPU and 1536 MiB RAM. The unchanged official image remains the read-only backing file. No direct kernel, kernel command-line override or timer workaround is present. NoCloud serves only public guest setup at loopback port 18080; SSH forwards only 127.0.0.1:2222; QMP binds only 127.0.0.1:4445 for ACPI shutdown. All three ports must be free before startup. A new task-owned SSH key is used; private key bytes are not recorded here or committed.

The hidden helper samples host RAM/disk every ten seconds, requests ACPI powerdown after 270 monotonic seconds and stops only its task child at 300 seconds if needed. Free host disk below 15 GiB or RAM below 768 MiB requests earlier shutdown; prelaunch requires 2.75 GiB free RAM. This first pilot has no package transactions, source upload, Cargo or GUI session.

## Current result and next action

QEMU download completed at 11:47:39 UTC: **206,615,928 bytes**, SHA-512 **`5bcf9eed634e8575a37b74f445af41a2fe4106da512d0c30c368301d4c105037fdfab40a5287367a28a957624cddebbc8c07e16c88ab6634f554cdf3d16bf543`**, exactly matching the fetched publisher checksum. The transfer needed bounded resumptions after long stalls. Independent connections to both download hosts timed out; DNS resolved correctly and a later explicit IPv4 Ubuntu HTTPS HEAD returned 200 with byte-range support. Subsequent IPv4 QEMU completion is recorded without claiming IPv6 caused the earlier timeouts.

Existing 7-Zip extraction completed successfully: **3,389 files / 1,256,205,208 uncompressed bytes**. The installer was not executed. The console emulator reports **11.1.0 (v11.1.0-12130-ge470268ff4)**. `-accel help` lists TCG and WHPX; listing WHPX in the binary does not prove available host acceleration. `-display help` lists GTK, SDL and other backends. Read-only UEFI code exists at `qemu/share/edk2-x86_64-code.fd` (3,653,632 bytes); the writable-vars template `qemu/share/edk2-i386-vars.fd` is 540,672 bytes. These are emulator/prerequisite checks, not a guest boot.

The fetched official Ubuntu image package manifest contains cloud-init `26.1-0ubuntu1~24.04.1`, openssh-server `1:9.6p1-3ubuntu13.19` and kernel `6.8.0-139-generic`.

**Final first setup outcome: image download timeout; boot not attempted.** The last IPv4 image command ended with curl error 28 after **900.015 seconds**, receiving **11,714,560 of 264,372,224 bytes**. The partial file is retained at the original `.img` path and is not a validated image. The transfer used DNS address `185.125.190.37`; a separate 64 KiB range request to that address succeeded (HTTP 206) in 13.382590 seconds. The other published A record, `185.125.190.40`, failed a bounded connection in 10.560009 seconds with no HTTP response. DNS and a small HTTPS response work, but a practical complete image transfer was not established in this window. This is a measured network preparation constraint, not a guest kernel failure.

No guest boot, SSH identity/seed generation, overlay, Linux shell, package installation, Rust compilation, native GUI or release acceptance was reached. No VM or helper listener was started, and the bounded download exited rather than continuing in the background. Once a later image download and checksum succeed, run the prepared normal-boot pilot once and retain serial output, QEMU stderr, process identity, monotonic events and final resource/exit status under `pilot-20260911/`. No rejected timer/kernel workaround was attempted.

Final readback confirms partial image length **11,714,560 bytes**, no QEMU/curl/7-Zip process, **34,071,371,776 bytes (31.73 GiB) free disk** and **4,111,672 KiB free physical memory**. Report whitespace check passed. No commit was made; the single tracked-scope report is untracked for root integration. Gitea handoff: issue #1 comment **177** and Wiki **LinuxHostYtr83r20260911** (updated with this preparation result).

If normal boot produces a usable guest, preserve it and coordinate the next source snapshot and resource lease with root before any Linux Cargo work. If normal boot fails, report its actual local failure without generalizing the other host's IO-APIC problem or trying the rejected workaround. Cross-compilation can establish matching ELF artifacts but cannot close native Linux filesystem, HTTP/restart or GUI workflows. A supplied accelerated Linux runner remains the straightforward alternative if this pilot cannot establish usable runtime.

Prepared-helper checks: `node --check prepare.cjs`, `node --check pilot.cjs`, `pilot.cjs --describe` and report whitespace check passed. Exact SHA-256 at this checkpoint:

| Local file | SHA-256 |
| --- | --- |
| `.local/linux-host-ytr83r/pilot.cjs` | `7A62D8F016F238F0D66F9BE38E8F7355BDA3DC6A9D4A3A9DB0992145E63A2594` |
| `.local/linux-host-ytr83r/prepare.cjs` | `6EDB916EF8107A1725C36364F6FD98E4A9CFAC13035B9503C293A50F35F28EF7` |
| `.local/linux-host-ytr83r/prepared-command.json` | `B3A826CE589C0668897D27EA911144C32833B3C0B20EC7972E92549D8688A380` |
| `.local/linux-host-ytr83r/extraction.log` | `CFE46753EDC2F7CC1A5D7F4FA8E113E69F9503A9A740A93DFE49F883FB525161` |

The next executable download command, from the repository root after ensuring the prior download is stopped, resumes the same partial file:

```powershell
& curl.exe -4 -fL --silent --show-error --continue-at - `
  --connect-timeout 20 --max-time 900 --speed-time 60 --speed-limit 1024 `
  -o .local/linux-host-ytr83r/ubuntu-24.04-minimal-cloudimg-amd64.img `
  'https://cloud-images.ubuntu.com/minimal/releases/noble/release-20260905/ubuntu-24.04-minimal-cloudimg-amd64.img'
if ($LASTEXITCODE -ne 0) { throw 'Image download remains incomplete' }
& curl.exe -4 -fL --silent --show-error --connect-timeout 20 --max-time 60 `
  -o .local/linux-host-ytr83r/ubuntu.SHA256SUMS `
  'https://cloud-images.ubuntu.com/minimal/releases/noble/release-20260905/SHA256SUMS'
if ($LASTEXITCODE -ne 0) { throw 'Publisher checksum download failed' }
$qaNode = 'C:/Users/User/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/bin/node.exe'
& $qaNode .local/linux-host-ytr83r/prepare.cjs
if ($LASTEXITCODE -ne 0) { throw 'Preparation verification failed' }
& $qaNode .local/linux-host-ytr83r/pilot.cjs --describe
```

`prepare.cjs` rechecks both publisher checksums, inspects the official QCow2 and creates a new **12 GiB virtual** overlay, private UEFI vars, disposable SSH key and public seed. It refuses an existing overlay. Neither the diagnostic 64 KiB byte-range downloads nor the partial image are accepted as a complete image. Only after the image/overlay checks pass and root's resource schedule is clear should the already bounded pilot start:

```powershell
Start-Process -FilePath $qaNode -WindowStyle Hidden `
  -ArgumentList ('"' + (Join-Path $PWD '.local/linux-host-ytr83r/pilot.cjs') + '"') `
  -WorkingDirectory $PWD -PassThru
```

The helper refuses a prior `pilot-20260911/result.json`; do not overwrite old pilot evidence to retry. Its command is headless and has `-vga none`, with no graphical acceptance claim. A completed later guest would need a separately measured graphical session and supported user-input route before desktop acceptance.

## Bounded protocol/endpoint diagnosis — 12:09–12:11 UTC

Root authorized one additional approximately three-minute / three-MiB investigation while Windows compiled. No VM/Cargo, host networking/security/proxy change or access-denial bypass. Downloaded exactly **3,145,728 image bytes** in three separately bounded range requests; each used a ten-second connection and thirty-second total cap, a 1 MiB maximum file size, no redirects and no retry. Every request returned HTTP **206** from the normal hostname at published DNS address **185.125.190.40**; no access denial occurred.

| Request | Inclusive byte range | Received | Elapsed | Rate |
| --- | --- | ---: | ---: | ---: |
| HTTPS | 0–1,048,575 | 1,048,576 | 1.835597 s | 557.86 KiB/s |
| HTTP | 0–1,048,575 | 1,048,576 | 7.608139 s | 134.59 KiB/s |
| HTTPS, second overlap | 10,485,760–11,534,335 | 1,048,576 | 2.200903 s | 465.26 KiB/s |

HTTPS combined measured rate is **507.37 KiB/s**. This is a short current sample, not a sustained-download guarantee or proof of why the earlier transfer stalled. HTTP provides no performance benefit here.

Both first-MiB responses equal the retained image prefix byte-for-byte, SHA-256 `b184298207946ba9b1c8b359531a49ea4173eaafd88dc9b3c5950c6e91beabb8`. The later HTTPS range equals its retained overlap byte-for-byte, SHA-256 `e5bc21406eeb296b4f6a8caf95fb04c76175dca00d91dce440b151c907efc2f7`. Local diagnostics are `probe-{http,https}-1m.bin`, `probe-https-overlap-1m.bin`, `protocol-probe-byte-comparison.json` and `protocol-probe-overlap.json`. These overlap comparisons check consistent content, not the final full-image publisher checksum.

Official alternate-endpoint investigation: Canonical's current [artifact reference](https://ubuntu.com/docs/public-images/public-images-reference/artifacts/) names cloud-images.ubuntu.com and Simplestreams for locating/mirroring images. Its [cloud-image Wiki](https://wiki.ubuntu.com/UsingCloudGuestImages) describes local mirrors but does not provide a separately operated public CDN carrying this exact pinned Minimal image. No documented alternate CDN/mirror for these exact bytes was established in the bounded search. A custom mirror or a different cloud-provider image is not silently substituted.

**Proposal only; not executed:** the recovered HTTPS rate supports a new bounded resume using the same pinned URL and the currently successful published address, followed by the publisher checksum gate. This is not another identical 900-second attempt: use a **600-second maximum** and fail if throughput remains below **128 KiB/s for thirty seconds**, preserving the partial on interruption. At the measured average the remaining approximately 241 MiB would take about eight minutes; actual sustained time is uncertain. Request-scoped DNS selection does not modify system networking.

```powershell
& curl.exe -4 -f --silent --show-error --continue-at - `
  --resolve cloud-images.ubuntu.com:443:185.125.190.40 `
  --connect-timeout 10 --max-time 600 --speed-time 30 --speed-limit 131072 `
  -o .local/linux-host-ytr83r/ubuntu-24.04-minimal-cloudimg-amd64.img `
  'https://cloud-images.ubuntu.com/minimal/releases/noble/release-20260905/ubuntu-24.04-minimal-cloudimg-amd64.img'
```

Only a zero exit, exact 264,372,224-byte image and full SHA-256 match against the fetched HTTPS publisher `SHA256SUMS` can admit preparation/boot. Prior report sections remain unchanged historical evidence; no complete download, guest or release acceptance resulted from this small diagnosis.

## Authorized recovered-HTTPS resume — 12:14–12:15 UTC

Root subsequently authorized the exact proposed bounded resume, with full publisher verification and the existing normal five-minute pilot conditional on download success. Executed task-local `resume-verified.ps1`; no network/security/system setting changed, no alternate flags or retry loop.

**Low-speed guard stopped the transfer; no full image or boot.** The command began at **12:14:47.6300053 UTC** and ended at **12:15:22.0749941 UTC**, **34.1516695 monotonic seconds**, exit **28**. Curl's exact reason was `Operation too slow. Less than 131072 bytes/sec transferred the last 30 seconds`. File length grew from **11,714,560** to **12,943,360 bytes**, adding **1,228,800 bytes**. The earlier successful 1 MiB samples did not predict sustained throughput for the larger resume.

Evidence: `.local/linux-host-ytr83r/resume-600-20260911/{status.json,curl.json,curl.stderr.log}`; the exact driver is `.local/linux-host-ytr83r/resume-verified.ps1`. The incomplete image remains at its original path, never admitted to `prepare.cjs` or QEMU. The driver stopped before publisher-checksum fetch/verification, seed/overlay creation or boot; no full-image checksum pass is claimed. No VM, Cargo or apt was started. No second attempt was issued after the configured guard fired. The prepared normal-boot route remains pending a practical complete-image delivery path.

Curl metadata independently records HTTP **206**, remote **185.125.190.40**, **31.686317 seconds** transfer time and **38,780 bytes/second** average. Wrapper timing includes process overhead and is intentionally recorded separately. Final process query found no curl/QEMU; free disk was **33,588,867,072 bytes**. Gitea comment **186** and the existing host Wiki preserve this outcome.

## Consecutive short-range hypothesis — 12:19–12:20 UTC

Root authorized an at-most-eight-MiB sample of consecutive one-MiB HTTPS ranges beginning exactly at the retained partial end, at most two concurrent requests and approximately sixty seconds total. Conditional continuation required aggregate throughput above 128 KiB/s; only then could the remaining image be assembled within ten minutes, with full publisher SHA-256 mandatory before normal boot.

**The sample failed that condition; this image-delivery route is blocked under the tested bounds. No further transfers followed.** The Node controller requested stop at **60.0747567 monotonic seconds** and finished owned-child cleanup at **61.1701748 seconds**. Six requests completed with HTTP **206**, exact `Content-Range: bytes start-end/264372224`, exact 1,048,576-byte bodies and retained hashes. Two outstanding requests were terminated by the sample deadline and remain explicitly unvalidated `.part` files of **393,216** and **16,384 bytes**.

Actual image traffic was **6,701,056 bytes** (below the eight-MiB cap), including incomplete bodies. Validated bytes were **6,291,456**, yielding **100.44 KiB/s** over the completed sample window; all received traffic was **106.98 KiB/s**. Both are below 128 KiB/s. Initial chunk completion times did not establish sustained performance. Each curl request had a thirty-second transfer timeout; process creation/scheduling overhead is included separately in recorded request/controller elapsed times.

Independent readback with `verify-range-sample.cjs` rehashed all six chunks, verified exact consecutive coverage **[12,943,360, 19,234,816)** with no gaps or overlaps, and reconciled every `.chunk`/`.part` body size with actual traffic. Original **12,943,360-byte** prefix remains unchanged, SHA-256 `2b7efcd276869937897c2ed9e73b37160c1b9ce2b825a8cfe98a26bd2f81cae1`. Chunks remain separate; nothing was appended, padded, zero-filled or accepted as a complete image. Neither the conditional ten-minute assembler nor publisher full-image verification/normal pilot was reached. No VM, Cargo, GUI or network/security/system change occurred; no curl/QEMU remained at final process query.

| Inclusive verified range | SHA-256 |
| --- | --- |
| 12943360–13991935 | `c145dfb684bd26a277c95e9a642c5b74ab4ee8e5a0159af6b008d978a18770f7` |
| 13991936–15040511 | `6a912d5db9f66db684a3b65e672b5de010cc103b8ebaf741681da3f03ac1333f` |
| 15040512–16089087 | `2c1fc4e16e0a082dec4ba01b98802569c75b204b01b8b91199f2e9ab6ccd5474` |
| 16089088–17137663 | `2fe89495036dffce7c8a887b2120954e1231c9b92efe10a1e414911f5d756297` |
| 17137664–18186239 | `7e67082618f6e529709ff812037ddfd05c25a2563cc5792f8d9b8fb3abe07dec` |
| 18186240–19234815 | `d2bc1db744d4c164afa24a750fc701cef177f281cef4a91a8391293af9cf0663` |

Evidence is retained under `.local/linux-host-ytr83r/ranges-20260911/`: `input.json`, `events.jsonl`, `result.json`, `independent-readback.json`, and each range's headers, curl metadata, stderr and separate body. The syntax-checked controller is `.local/linux-host-ytr83r/range-assembler.cjs`; it refuses reuse of its existing evidence directory. Preserve these inputs for an externally changed delivery route; do not repeat the failed sample or bypass its threshold.

## Root-replanned slower range continuation — from 12:26 UTC

Root explicitly replaced the earlier 128 KiB/s admission threshold after reviewing the six contiguous validated chunks: the measured approximately 100 KiB/s rate was judged usable alongside the long Windows dependency compile. This is a new authorized budget/criterion, not an undisclosed retry under the failed sample's rules. The earlier sample/result remains unchanged historical evidence.

Prepared and syntax-checked `.local/linux-host-ytr83r/range-continuation.cjs`. It first revalidated the exact original 12,943,360-byte prefix and all six earlier chunk hashes/lengths/continuity, then resumed **new ranges at byte 19,234,816**. It does not re-download validated prefix/chunks or run a full-stream resume. New evidence directory: `.local/linux-host-ytr83r/ranges-continuation-20260911/`.

Revised limits: at most two requests concurrently, 1 MiB per chunk (short exact final chunk), sixty seconds per request, at most one retry for a timeout/HTTP 5xx, stop on access denial/rate limiting or an inconsistent accepted response, sixty-minute total controller cap and a five-minute check requiring increased contiguous validated coverage. Every failed attempt retains its separate body, header, curl metadata and stderr. No sparse preallocation or missing-chunk substitution is used. Only exact complete coverage, unchanged retained bytes and a full HTTPS publisher SHA-256 match can admit the normal five-minute pilot. No Cargo, GUI or host/network/security setting changes.

Early progress at 12:27:14 UTC: six new chunks validated, contiguous coverage reached **25,526,272 bytes**. Five-minute check passed with 19,922,944 new contiguous bytes at 300.0806 seconds.

Final result: stopped after **514.3564 seconds**, because range **52,789,248–53,837,823** timed out on both allowed attempts. Both returned **HTTP 206** with `Content-Range: bytes 52789248-53837823/264372224` and `Content-Length: 1048576`; curl exit **28**, receiving **884,736 bytes / 60.006416 seconds** then **901,120 bytes / 60.009288 seconds**. This was a transfer timeout, not HTTP 5xx, denial, rate limiting or inconsistent content. Two earlier timed-out ranges succeeded on their single retry. The other active request was stopped and retained separately when this range exhausted its retry.

Independent readback passed: original prefix unchanged; **39 validated chunks** (six reused, 33 new), **34,603,008 newly validated bytes**, **52,789,248 bytes contiguous coverage**, plus valid range **53,837,824–54,886,399** beyond the first gap. New actual image traffic **38,567,936 bytes**, 38 attempts, three retries. No assembly, full-image checksum, VM/Cargo/GUI or further request occurred. `ranges-continuation-20260911/independent-readback.json` lists every retained chunk/hash and failed body; its SHA-256 is `EF49D629032F83AA0A035E87EADFA32CACCE2C0872A06BD47A96F025095F0A8C`. Root requested exact failure diagnosis before considering a revised retry policy; the controller remains stopped.