SideThread Hub PR2 Docker evidence
Date: 2026-08-26 Asia/Shanghai
Tested source commit: 0744c312f9188278f243d4266ddd8acab8493c7b
Stack base: c0981ecc26b8b570ff29a30da2d926fdc8ec4a09 (PR #1194 rev4)

Layer 1 — contract
  image: anet-test1195-contract-actions
  result: PASS
  tests: 8 pass, 0 fail, 35 assertions
  witnessed-red: native exact-fork mode gate mutation rejected
  includes schema/golden projection drift check and caller requestKey coverage
  for every mutating POST action

Layer 2 — auth/SSE security
  image: anet-test1195-security-actions
  result: PASS
  tests: 5 pass, 0 fail, 19 assertions
  witnessed-red: query-string token acceptance mutation rejected
  covers owner hydration, opaque cross-owner reads, node binding, metadata-only SSE,
  and no-FIFO unsupported behavior

Layer 3 — races/faults
  image: anet-test1195-race-actions
  result: PASS
  tests: 9 pass, 0 fail, 60 assertions
  witnessed-red: weakened four-tuple runtime event ownership mutation rejected
  covers terminal-before-ACK, cross-coordinator claims, retry lineage, bring-back
  uniqueness, response-loss ambiguity/reconciliation, and no-repeat
  cancel/archive/purge RPCs

Total final Docker evidence: 22 pass, 0 fail, 114 assertions, 3 witnessed-red.

Complete server unit domain:
  image: anet-test798-pr1196-actions
  result: PASS
  discovered/executed files: 74/74, failed files: 0
  witnessed-red: weakened registration password floor rejected
  confirms the schema/golden fixture is present in the CI image

Aggregate isolation CI image:
  image: anet-test638-pr1196-exact
  tested fix commit: c207d3538d4f28d774f165c9eebac46ae732772c
  result: PASS
  aggregate: 74 files, 984 pass, 0 fail, 3235 assertions
  covers normal/reverse concurrent aggregate order, syscall DB isolation,
  nonzero/timeout/signal/missing-summary/spawn/slug witnessed-red, and the
  per-file DB isolation mutation
  root cause fixed: test638 now explicitly copies contracts/side-thread/v1

Preflight:
  check-test-suite-registration.py PASS (no new unregistered suite)
  check-l1-paths-sync.py PASS
  lint-no-bare-rm-rf.sh PASS
  git diff --check PASS
  server.ts minimal diff: 83 additions, 0 deletions ignoring EOL whitespace

An earlier race image attempt failed before test collection because its
Dockerfile omitted the vendored golden fixture. Commit 72fe67b9 added that
explicit COPY; all three layers above were then rebuilt and rerun against the
same exact source commit. No failed pre-fix run is counted as evidence.

Rebase + purge regression follow-up (2026-08-26 Asia/Shanghai):
  code/test commit: 6c3c50a01276a70beb26a673a7ac8a2944c9c137
  rebase base: 57bd606d52129d2a78360dda2dd68e8c968541bd (merged PR #1194)
  provenance: old PR2 9a074ccb..new PR2 96c131ff is 9/9 patch-equivalent;
              the two final trees are byte-identical
  contract Docker: 8 pass, 0 fail, 35 assertions
  security Docker: 5 pass, 0 fail, 19 assertions
  race Docker: 9 pass, 0 fail, 62 assertions
  witnessed-red: 4 total, including removal of per-attempt attachment purge
  aggregate Docker: 74 files, 984 pass, 0 fail, 3237 assertions
  purge boundary: readable question/result/error and root/per-attempt file
                  references are erased; durable identity/audit receipts remain
