Service-compatible log opening — run 01

Date: 2026-10-12. Repair source 084d0aa0c2c67601f3996eb4f12cf24ff0e18d2a on milestone/service-log-opening; base frozen candidate ca84d9823b5e3f8f39f40647cedffef0acff3aac. This is native regression evidence for an unmerged repair, with rebuilt-package acceptance pending.

Rejected candidate and origin

Debian lifecycle rel-deb-life-01 exited 2: the required RestrictSUIDSGID=yes filter denied mandatory openat2 with ENOSYS in the dedicated Spindle preflight, and the server exited. The installation failure record retains the guest controls and exact failure.

Artifact	SHA-256
Rejected Debian candidate	241679e2d63d75f0ec628376baaff80a1070dc44991c7ca8c430dd9c66542219
Rejected RPM candidate	43ee9a896713e60ae9fd26d92757c16661c61dfcfd60e1bee48465058ce32bad

The owner authorized preparing and verifying a product fix. The old packages remain private failure evidence and are excluded from release acceptance.

Mechanism and registered checks

The registered amendment replaces mandatory openat2 with a root-anchored, descriptor-relative openat walk. Each intermediate component uses O_PATH | O_NOFOLLOW | O_CLOEXEC and descriptor metadata; the leaf uses read-only, no-follow, nonblocking access and must be regular. Every error propagates. Parent descriptors remain pinned across rename and Rust ownership bounds descriptors to two. No path is canonicalized or reopened, and the unit hardening stays byte-identical. This does not authenticate hardlinks/content or confine mount changes.

The isolated child test actually returns ENOSYS for the retained old syscall before checking production reads. On 73f7d90553dc32a64d4b45e2958b8f6a870769a8, the regression exited 101 at the ordinary backlog read with errno 38. After the replacement it exited 0, retaining exact nine-byte backlog/cursor checks, leaf/parent refusal, numeric-PID proc magic-link refusal and the deterministic parent-replacement control.

Commands and observed exits

Every command used python3 -B tools/resource_group.py -- COMMAND, with mounted data-drive storage and pinned Rust 1.99.0. The table shows COMMAND; local administrative run labels bind the complete command and outer receipt.

Run	Command	Exit / observation	Outer receipt SHA-256
focused-security-final	rustup run 1.99.0 python3 -B tools/ci/security_checks.py	0; 11 Linux + 11 node + 10 server security tests; formatting passed	2e892980a026232a401e4586caae33b6cc4487825c3390ff9c540e30b862f0a6
fast-checks-admitted	rustup run 1.99.0 cargo xtask checks --profile fast	0; all 20 fast receipts passed on a clean source tree	245ed04bc4785db8f7c5402938d4651f0128e1a5936e8a639e381ca3841ae8e3
documentation-final	/run/media/kmosoti/data/FabricO11y/tools/bun-1.4.0/bun tools/docs/check.mjs	0; documentation checker	4625274e7d3652bec1b2c76b4e7a07a1b9151df61351c64dc99f47670665735a
documentation-probes-final	env PATH=/run/media/kmosoti/data/FabricO11y/tools/bun-1.4.0:/home/kmosoti/.cargo/bin:/usr/local/bin:/usr/bin:/bin bun tools/docs/check.test.mjs	0; 55/55 positive and negative probes	768de719fcca6d6e30da84eb574f273d52f0888515427039fbef8ce6d17897e3
documentation-hooks-final	env PATH=/run/media/kmosoti/data/FabricO11y/tools/bun-1.4.0:/home/kmosoti/.cargo/bin:/usr/local/bin:/usr/bin:/bin python3 -B tools/docs/test_hooks.py	0; hook tests	fe2853a9d7e824917950c3e8dbfb02ed008b5149503fa53564f7c489abd96428

Retained failures and cleanup

The initial full fast run on 5a933e6 exited 1: its outside-scratch control derived a path from the checkout, but that checkout was itself beneath scratch. The runner correctly admitted the inside path; mocked process state then failed JSON serialization. The separately committed fixture repair chooses a sibling of the actual scratch root and asserts the outside precondition, retaining every original refusal/no-launch/no-creation assertion. All 21 runner tests then exited 0, and the final fast profile also passed that gate.

The first full build grew the strict regular-path census above the 95 GB admission limit. A final run was mistakenly started after admission failed, then explicitly stopped; its launcher exit 2 and partial receipts remain interrupted. A subsequent guarded attempt was denied before launch. No failed or stopped run is counted as a pass. The administrative launcher now checks admission before execution and samples storage every 30 seconds.

Cleanup removed 3,603,504,590 bytes of repair-created incremental compiler scratch, using birth times and source/target identity; preexisting cache directories and completed binaries/fingerprints remain. Ownership assumes no other project build was admitted during these commands. Raw failures, bad-layout fixture, receipts and frozen packages were retained before cleanup. The old cached Bun copy failed the pinned-version check (1.4.2 versus 1.4.0), and an initial doc probe lacked Bun in child PATH; both failures are retained. The official pinned Bun 1.4.0 asset was checksum-verified, installed only under the data drive, and the corrected complete documentation checks passed.

Final cached verification began at 93,813,453,212 strict regular-path bytes with a 1 GB reserve. Its sampled maximum was 93906049474 bytes. Default 16/20 GiB memory high/max, zero swap and 1800-second deadline were enforced; every final command stopped and cleaned its private temporary directory. Final fast cgroup observations:

{
  "memory.peak": "1722368000",
  "memory.events": "low 0\nhigh 0\nmax 0\noom 0\noom_kill 0\noom_group_kill 0\nsock_throttled 0",
  "cpu.stat": "usage_usec 602105648\nuser_usec 563532372\nsystem_usec 38573276\nnice_usec 0\ncore_sched.force_idle_usec 0\nnr_periods 0\nnr_throttled 0\nthrottled_usec 0\nnr_bursts 0\nburst_usec 0"
}

Remaining acceptance and decision impact

The architecture pages, current state, capability ledger, verification matrix and counterexample registry distinguish the native repair from package acceptance. The implementation and trust-boundary changes are separate commits. Owner merge uses a merge commit, then a replacement frozen commit needs fresh Debian/RPM builds, hashes/provenance and the affected installation/security/extended gates. Historical extended evidence cannot cover this changed code. #41 criteria remain unchecked; later #42–#47 exact-candidate gates are pending.

Private raw evidence: /run/media/kmosoti/data/FabricO11y/results/service-log-opening/ (controlled local archive, not publicly downloadable). completion-evidence.json SHA-256: 7ce896ba235314d796da86d3e24b1171e3d4579294dc964f0fb300f8697deefb. No package, credential, raw telemetry or compiled binary is uploaded with this report.