Reject streamed diagnostic error documents and record VM qualification

1 files changed, 4 insertions, 2 deletions

diff --git a/README.md b/README.md
index ecd2380..829bfb1 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 Roentgen is a Linux CLI/TUI for importing 3x-ui subscription link lists and controlling the local machine's proxy intent through a root-owned controller. The implementation follows [.scratch/linux-first-release/spec.md](.scratch/linux-first-release/spec.md).
 
-This is an implementation candidate. Full native-TUN, boot, SSH authentication and recovery acceptance on the required current ALT Xray package is incomplete. The available ALT test VM and its refreshed Sisyphus repository currently supply Xray 26.3.27. Activation rejects that release before changing enabled intent. This build currently gates activation on the researched Xray 26.10.29 configuration contract. That gate is not a claim that the full release acceptance matrix has passed.
+This is an implementation candidate. Full native-TUN forwarding and managed-probe lifecycle acceptance on the required current ALT Xray package is incomplete. The supplied VM passed diagnostics transport, terminal authentication, enabled/blocked reboot protection, and recovery checks. The available ALT test VM and its refreshed Sisyphus repository currently supply Xray 26.3.27. Activation rejects that release before changing enabled intent. This build currently gates activation on the researched Xray 26.10.29 configuration contract. That gate is not a claim that the full release acceptance matrix has passed.
 
 ## Build
 
@@ -50,6 +50,8 @@ Explicit recovery persists disabled intent before releasing owned capture and pr
 
 Run tests only on the supplied disposable ALT VM. Compile acceptance executables with `cargo test --features linux-runtime --no-run`; copy the executable and test artifacts to the VM or run Cargo there. CLI tests support `ROENTGEN_TEST_BINARY` when the executable is installed at another path.
 
-`tests/controller_acceptance.rs` exercises the public controller with real TOML/SQLite persistence and HTTP/runtime boundary fixtures. `tests/cli_acceptance.rs` exercises the executable interface. `tests/vm_guard_acceptance.py` checks real kernel traffic through the guard CLI. `tests/vm_controller_acceptance.py` checks the CLI/system-bus/polkit boundary, using temporary integration fixtures when the packaged Xray is too old for product installation. The Python checks refuse to run outside the authorized `altctlrs` VM and require its explicit VM-only marker.
+`tests/controller_acceptance.rs` exercises the public controller with real TOML/SQLite persistence and HTTP/runtime boundary fixtures. `tests/cli_acceptance.rs` exercises the executable interface. `tests/diagnostics_acceptance.rs` uses the public controller and CLI with verified TLS, the production probe configuration, and a real non-TUN Xray Trojan path. Its VM wrapper is `tests/vm_diagnostics_acceptance.py`. `tests/vm_guard_acceptance.py` checks real kernel traffic through the guard CLI. `tests/vm_boot_acceptance.py` checks enabled/blocked reboot ordering, controller crashes, and recovery from a stopped controller. `tests/vm_controller_acceptance.py` checks the CLI/system-bus/polkit boundary, using temporary integration fixtures when the packaged Xray is too old for product installation. The Python checks refuse to run outside the authorized `altctlrs` VM and require its explicit VM-only marker.
 
 The VM guard checks use a temporary network namespace and veth pair, never the workstation's network. Preserve a powered-off checkpoint before running them, and restore it after validation. Credentials and VM reset settings belong outside this repository.
+
+The latest VM run passed 20 Rust acceptance tests and 29 VM workflow checks. See the [review and qualification limits](docs/implementation-review.md) and [captured output](docs/validation/linux-vm-continued.txt). The VM checkpoint was restored after validation.