Reject streamed diagnostic error documents and record VM qualification

1 files changed, 15 insertions, 3 deletions

diff --git a/docs/implementation-review.md b/docs/implementation-review.md
index 0bf25c0..99ecf29 100644
--- a/docs/implementation-review.md
+++ b/docs/implementation-review.md
@@ -22,12 +22,24 @@ The specification review found five correctness issues:
 - Manual diagnostic requests ignored provider cooldowns. Retry-After now prevents further diagnostic requests to that provider, including manual Ping and Speed.
 - Competing HTTP and measurement timeouts could turn a completed duration-limited Speed observation into a generic error. Diagnostics now use one measurement deadline and report consumed bytes when the duration cap ends a nonempty measurement.
 
-Spec findings: five correctness issues, corrected. The stale-selection forwarding path was the most serious finding. VM CLI regressions cover failed preflight retries and startup with stale capture and unset selection. The probe TLS changes and duration/rate-limit behavior still require end-to-end validation with the required current Xray runtime.
+Spec findings: five correctness issues, corrected. The stale-selection forwarding path was the most serious finding. VM CLI regressions cover failed preflight retries and startup with stale capture and unset selection. The continued validation below covers probe TLS transport and duration/rate-limit behavior using non-TUN fixtures. Qualification of the full managed lifecycle on the required current Xray runtime remains pending.
 
 ## Validation boundary
 
 After the user's VM-only instruction, all test execution used the supplied ALT VM. Compilation and formatting used the local checkout. The VM checkpoint precedes package/test preparation and is restored after validation.
 
-The current package available from that VM's refreshed Sisyphus repository is Xray 26.3.27. The implementation rejects activation with it. The tests therefore distinguish actual guard/controller/polkit/editor/recovery behavior from unverified native-TUN and diagnostic operation with the researched newer Xray contract. The product installer is not counted as a successful installation in this environment; system-bus tests stage their integration fixtures explicitly.
+The current package available from that VM's refreshed Sisyphus repository is Xray 26.3.27. The implementation rejects activation with it. The tests distinguish actual guard/controller/polkit/editor/recovery behavior and fixture-backed diagnostics from unverified native-TUN forwarding and managed-probe lifecycle operation with the researched newer Xray contract. The product installer is not counted as a successful installation in this environment; system-bus tests stage their integration fixtures explicitly.
 
-The final available suite passed on 2026-10-30: 10 Rust CLI/controller acceptance tests and 21 VM workflow checks. The [captured output](validation/linux-vm.txt) records the tested executable digest and each result. Checks include TCP and UDP DNS destination policy, IPv4/IPv6 blocking, retained incoming connections, denial/allow authorization, ordinary-user TUI restoration, editor privacy, failed-preflight retries, stale capture with unset selection, malformed TOML recovery, missing durable state, and uninstall retention/purge.
+The initial available suite passed on 2026-10-30: 10 Rust CLI/controller acceptance tests and 21 VM workflow checks. The [captured output](validation/linux-vm.txt) records the tested executable digest and each result. Checks include TCP and UDP DNS destination policy, IPv4/IPv6 blocking, retained incoming connections, denial/allow authorization, ordinary-user TUI restoration, editor privacy, failed-preflight retries, stale capture with unset selection, malformed TOML recovery, missing durable state, and uninstall retention/purge.
+
+## Continued implementation and review
+
+Independent standards and specification reviews compared candidate `7999fab` against `fc3c1d51b1be9db6ba6ad286584fbc34bb305f38`. Standards found no actionable issues. Spec found one P2 issue: a JSON error document larger than the diagnostic prefix could count as a successful Speed download. A bounded-memory scanner now checks top-level error markers throughout consumed response chunks. Controller acceptance checks cover long error values, late and escaped error keys, legitimate nested payload fields, and HTML after long leading whitespace. All pass.
+
+The continued work also corrected diagnostic CLI exit status after provider rejection and stale successful observations after probe startup failure. Probe sessions now use the runtime boundary, and both production and acceptance fixtures share the authenticated HTTPS proxy configuration. Networking units use a shared dependency drop-in so the guard starts first.
+
+The final available suite passed on 2026-10-30: 20 Rust acceptance tests and 29 VM workflow checks. The [continued captured output](validation/linux-vm-continued.txt) records the tested executable digest and results. All tests ran only on the supplied ALT VM. The diagnostic fixtures used its distribution-owned Xray 26.3.27 in non-TUN mode, a temporary trusted CA, an authenticated HTTPS proxy, a real Trojan TLS connection, and a local HTTPS provider. Checks covered TLS failures without direct fallback, redirects and error documents, byte/time limits, both Retry-After header forms, cancellation, scheduling, and CLI failures. Temporary certificates and trust anchors were removed afterward.
+
+System checks used actual terminal polkit/PAM authentication with wrong and correct temporary fixture passwords, cancellation, and noninteractive denial. A real VM reboot retained enabled/blocked intent, and the guard became active before NetworkManager. SIGKILL and SIGSTOP checks retained protection; explicit recovery persisted disabled intent before releasing it. The reboot fixture deliberately had no selected configuration, so it does not qualify successful native-TUN forwarding after reboot.
+
+The required Xray 26.10.29 distribution package was unavailable in the refreshed VM repository. Production compatibility requirements remain unchanged. Full native-TUN forwarding, successful managed-probe startup, and the product installation lifecycle on that package remain unqualified. The VM checkpoint was restored after this run.