R3 simulator output precondition counterexamples

Both replacement-candidate S1 attempts below failed before native exposure. Neither supplies S1 headroom, full-soak or package acceptance. Canonical TLS replacement product e078ba23b543126011a2136dd1f7e98ca65370eb, package source28bcdf7, and the separately source-certified witness helper ELF5d0555dfc38cd001d0ecca0f488d309eb0be02cdf0cf295b3e07cbb3c79eee24 were unchanged.

DATA is /run/media/kmosoti/data/FabricO11y.

Actual attempt	Command result	Independent native refusal	Retained evidence
S1-01, source2a8e11e	measurement2, outer stop confirmed04:37:23Z	begin witness must use the owned output directory	results/r3-s1-replacement-tls-01 and preparation-01; raw/fixture scratch retained
S1-02, source2255fb5	measurement2, outer stop confirmed05:53:44Z	witness parent must be canonical, owned and private	results/r3-s1-replacement-tls-02 and preparation-02; raw/fixture scratch retained

First, the caller placed begin.json outside its exact --out directory. Separate protocolb1bd36a and implementation2255fb5 joined the live caller, native observer finish, checkpoint and stopped validator to raw/sim/begin.json. Its63 focused source tests exited0; actual S1-02 then reached the next independent helper guard.

Second, caller output creation was left to the helper's create_dir_all under the actual default umask, yielding mode0755, UID/GID1000. S1-02 setup lasted61,482,678,348ns; no native begin was published. Original helper stderr, trace and failure remain unchanged. Failure JSON SHAfb97bd630d47bd3afca6c192f353f6cf6eb96fbbbdf9655a1bf0e1a010c18262; trace SHA62a3057496325caca185067b5d1f3cf6a8368778af7d901ae162565208ea49d9; outer resource SHA bebedbb831b3e06282384b279bf62cad0f83537517d231e94783f5b2e0e86199. Inner cleanup was not confirmed; whole outer process stop was confirmed. No exposure or successful inner cleanup is inferred.

Implementation5220e27f81e3f1e3285dd736057dd70a25c261c5 exclusively creates raw/sim mode0700 before expensive fixture setup. It checks the canonical parent and private ownership, refuses existing or symlinked outputs, and does not chmod-repair an existing directory. The helper's own canonical/owner/private/nonmount/publication guards remain unchanged. The minimized observed failure is tools/qualification/fixtures/soak-witness-output-permissions.json.

Actual verification command:

python3 -B DATA/results/soak-output-custody-01/source-driver.py soak-private-output-source-01 1073741824 env PYTHONPATH=tools/qualification:tools python3 -B -m unittest discover -s tools/qualification -p 'test_soak*.py'

DATA is expanded literally in the source binding. The driver invoked the required default resource launcher. All66 tests exited0, launcher0, outer stop confirmed06:01:31Z, source clean before/after. Receipt results/soak-output-custody-01/soak-private-output-source-01.json SHA f26cf13c96cad537660922d6c3f4300e0e4ebaed866a1c441b78bba970398add; resource SHA24c83b76a7d78d78b31929ce5ea59c82ad278741c843ad0c0b51d6effa8e6df8. Strict whole-DATA census68,411,486,845bytes plus1GiB reservation was admitted below95GB; no swap, successful owned launcher scratch cleanup. Native failure scratch was preserved.

The three new filesystem controls cover ordinary/private umasks, existing/symlink refusal with target unchanged, and restrictive-umask failure without chmod repair. These tests are mechanism checks; the original native guard is the independent counterexample oracle. Frozen Bun dependencies and all3 documentation checks subsequently exited0 with confirmed stops before PR75 publication. Required hosted fast/extended and actual main admission remain pending at this record's preparation.

Prospective S1-03 has fresh namespace/runtime and exact pins in results/r3-s1-replacement-tls-preparation-03, posted/read back at https://github.com/kmosoti/FabricO11y/issues/59#issuecomment-6209204709. Original70-second full-rate case/window and all resources/ceilings/oracles remain unchanged. Execution waits required main authority and sole scheduler CLEAR. Actual exposure, stop, raw joins and six independent phase maxima are still not run. Full7200-second acceptance remains pending.

Exact failed native invocations

S1-01: python3 -B /run/media/kmosoti/data/FabricO11y/results/r3-s1-replacement-tls-preparation-01/run-measure.py r3-s1-measure-01 5368709120 --delegate python3 -B tools/qualification/soak_r3.py --admission /run/media/kmosoti/data/FabricO11y/results/r3-s1-replacement-tls-preparation-01/admission.json --admission-sha256 7ca2d4dbdcbea835941f6a689c1aa9a8fdaf334f69f3f69beab67badafc384aa

Outer wrapper SHA256 69ee97d59305617d915720b0f5ddb344b28e223b2f0fe09810991d2d8998577c; actual command exit 2, finished 2026-10-16T04:37:23.892980+00:00. Required launcher and all actual resource references are retained in that exact wrapper.

S1-02: python3 -B /run/media/kmosoti/data/FabricO11y/results/r3-s1-replacement-tls-preparation-02/run-measure.py r3-s1-measure-02 5368709120 --delegate python3 -B tools/qualification/soak_r3.py --admission /run/media/kmosoti/data/FabricO11y/results/r3-s1-replacement-tls-preparation-02/admission.json --admission-sha256 465dcfbf19e603517423cfc92413974ac2fe499daad9da133a581207c1ba6461

Outer wrapper SHA256 9f9f39aa17c75ce97fa1469730fb02cfcb8f14e6e6011289c97a4d43e9391812; actual command exit 2, finished 2026-10-16T05:53:44.039592+00:00. Required launcher and all actual resource references are retained in that exact wrapper.