# 0.5.0-dev.8 isolated qualification

Limited isolated VM pilot: **COMPLETED PASS within documented scope**. Production readiness: **NOT VERIFIED**. Bare-metal qualification: **BLOCKED**. This is a public development candidate, not a production release. Appliance build source is commit `2b1f18c6c0c706c37a94cc57181f4df101f6b882`; the ISO is 166,983,680 bytes, SHA-256 `fa3e65bf037e385c74d220b8ed5eb006f48b70b7c459cfdf92b5f5b494be62a9`. The build-input manifest is `evidence/0.5.0-dev.8/build-inputs.json`. A clean-checkout, bit-identical rebuild is NOT RUN. The prior dev.6 and rejected dev.7 images are immutable and their evidence is not transferred.

| Gate | Result | Exact evidence and scope |
| --- | --- | --- |
| Real lost-Stop reproduction on dev.6 | PASS | `evidence/0.5.0-dev.7/accounting/dev6-reproduction/RESULT.json`; a real PPPoE disconnect during a RADIUS outage lacked a server-side Stop. This identifies the old defect, not dev.8 acceptance. |
| Fresh ISO install, BIOS and UEFI | PASS | `evidence/0.5.0-dev.8/fresh-install/`; new disposable 2 GiB QCOW2 disks, unchanged ISO, verified accounting binary and engine module in media. |
| Real RADIUS outage and replay | PASS | `evidence/0.5.0-dev.8/accounting/live/OUTAGE-RESULTS.json` and raw FreeRADIUS detail. Start/Stop survive worker restart; pending interims/Stop survive appliance reboot; dropped Accounting-Response yields duplicate Start delivery until a valid ACK; ten simultaneous graceful disconnects receive Stops. At-least-once, not exactly-once. |
| Low free space and admission | PASS | `evidence/0.5.0-dev.8/accounting/boundaries/RESULTS.json`; 58,437,632 free bytes closed new admission, existing session Stop was retained and delivered. The first BusyBox `dd` harness attempt failed and is preserved. |
| Forged/mismatched Accounting-Response | PASS on separate live fixture | `evidence/0.5.0-dev.8/accounting/negative-live/RESULT.json`: a cloned FreeRADIUS fixture on a separate bridge was stopped and replaced temporarily by a UDP responder that logged four actual Accounting-Requests and sent invalid authenticators with matching and mismatched identifiers. The real dev.8 queue retained the Stop; after the genuine server returned, its ledger cleared and the server recorded the same session's Start and Stop. The initial uninstrumented attempt remains in `accounting/live/forged-response-initial.json`. |
| 500 authenticated sessions | PASS after paced retest, with failed first attempt retained | `evidence/0.5.0-dev.8/vm-qualification/STAGES.json`, `SESSION-RETRY-RESULT.json`, `SESSION-RETRY-ROUTE-CORRECTION.json`. The first batch held 411. The paced retest held 500 for 60 seconds; first routing probe lacked generator routes for clients 251–500. After adding those namespace routes, all 500 isolated routed probes passed. This is not 500 traffic-bearing sessions. 1,000 dev.8 sessions are NOT RUN. |
| Sustained active traffic | PASS for measured workload | `evidence/0.5.0-dev.8/active-traffic/TRAFFIC-SUMMARY.json` and raw client/server JSON. With shaping disabled, 250 clients each offered 1 Mbit/s UDP per direction for 120 seconds, achieved 249.987/249.992 Mbit/s forward/reverse and 44,641 packets/s aggregate, zero client-reported UDP packet loss. Sampled ICMP p99 was 0.716 ms with zero sampled loss. Earlier listener-readiness generator failures are retained. No router capacity claim follows from this one workload. |
| Subscriber shaping | PASS for one measured profile | `evidence/0.5.0-dev.8/shaping/RESULT.json`; separate fresh dev.8 BIOS install and real local-auth PPPoE client. A 1,024 kbit/s profile delivered 1,053 kbit/s upstream UDP with 2 Mbit/s offered and 944 kbit/s downstream TCP, each for 20 seconds. The ingress policer counted 1,691 excess drops; the egress TBF counted 1,073 overlimits. The high UDP loss is the expected result of offering twice the configured ingress rate, not an unshaped baseline. |
| WinControl session page | PASS at 411 real sessions | `evidence/0.5.0-dev.8/accounting/wincontrol-http-i18n-retest.json`; actual isolated nginx/PHP-FPM HTTPS app, pinned SSH host key, 25-row pagination, filter/sort, no RADIUS secret in response. A synthetic 1,000-row PHP feature test passed separately; live 1,000-row UI is NOT RUN. |
| Safe Mode | PASS for tested configuration paths | `evidence/0.5.0-dev.8/safe-mode/SAFE-MODE-SUMMARY.json`; independent UEFI guest proved confirm/reboot, unconfirmed rollback, management-break rollback, invalid rejection and concurrent busy handling. A forced initiating SSH kill at 0.15 seconds left an accepted operation; its independent watchdog rolled back and restored hashes. Initial harness failures are retained. |
| Licensing | PASS for isolated signed-admission behavior | `evidence/0.5.0-dev.8/licensing/UEFI-LICENSE-SMOKE.json` and `ACTIVE-SESSION-CONTINUITY.json`; a lab-signed cap of one preserved two established real PPPoE sessions and their forwarding, rejected a new login after one disconnected, and allowed it after the license was removed. A tampered signature was rejected and emergency SSH management remained available on a separate UEFI guest. No commercial activation claim. |
| Reinstall/restore | PASS for tested backup | `evidence/0.5.0-dev.8/reinstall-restore/RESULT.json`; new BIOS and UEFI installs, backup from separate UEFI guest, restored identity, SSH host key, network hash, route, and services on a new UEFI virtual disk. The backup contained no pending accounting events; pending-event reboot replay is proven in the separate RADIUS test. |
| Forward-version upgrade | PASS for one supported disposable path | `evidence/0.5.0-dev.8/forward-upgrade/RESULTS.json`; a signed dev.6 → dev.8 UEFI ext4 sysupgrade wrote the partition image and rebooted. Device identity, UCI hashes, pinned SSH enrollment and a lab-signed license survived. A truncated image was rejected before writing. This does not prove automatic firmware rollback or every upgrade path. |
| Candidate-specific eight-hour soak | PASS | 28,851.838 valid healthy seconds, 482 samples, identity-bound media/source/boot checks and independent closeout PASS. The scheduled RADIUS outage occurred and queued accounting replayed after recovery. |
| Authorized limited VM pilot | PASS within scope | Ten synthetic subscribers, 600 seconds, approximately 10 Mbit/s offered and achieved per direction, zero measured loss, 21/21 monitor samples PASS, zero accounting backlog, WinControl ten-session checks PASS, and clean delivery of ten Stop records at closeout. This is not a capacity or production-readiness claim. |
| Automatic firmware rollback/A-B | UNSUPPORTED | No implementation or live failure rollback proof. Configuration Safe Mode is separate. |
| Bare-metal and production capacity | BLOCKED | No identified physical target, selected disk, console/recovery route, NIC inventory, or target workload; no physical installation authorized. |

The durable queue stores subscriber identity and RADIUS signing material; see the storage and backpressure policy in the source documentation. A permanent storage fault followed by engine loss can still lose an unpersisted Stop. The queue coalesces undelivered interims; Start and Stop remain distinct. The operator explicitly accepted this residual risk for the isolated pilot. Publication does not authorize production networking, physical installation or subscriber migration.