New WSL distribution recipe: Ubuntu 26.04.1 on WSL 3.0.1, rehearsed from P1 to F5 (paired isolation proof, shared-console mask)

adoption/templates/wsl/cloud-init.user-data.template

@@ -1,5 +1,5 @@
 #cloud-config
-# User-data for a new Ubuntu 24.04.5 WSL instance: adoption/platforms/linux-wsl2-new-distro.md, step W3, renders this
+# User-data for Ubuntu 26.04.1 default or 24.04.5 rollback WSL image: adoption/platforms/linux-wsl2-new-distro.md, step W3, renders this
 # file to %USERPROFILE%\.cloud-init\<Name>.user-data, where <Name> is the --name of the install, before the instance
 # first boots. The cloud-init WSL datasource reads that file at the first boot; the image's /usr/lib/wsl/wsl-setup then
 # waits for cloud-init, reuses this user (the first one with uid 1000 or more), keeps the [user] default written below
@@ -8,6 +8,7 @@
 # Keys follow Canonical's "Automatic setup of Ubuntu on WSL with cloud-init" example and the cloud-init WSL datasource
 # "Default user" example. The groups are the ones the image's wsl-setup gives a user it creates interactively. uid 1000
 # matches defaultUid in the image's /etc/wsl-distribution.conf. The password stays locked; sudo needs none.
+# P2 checks the workstation schema; W5 must validate the selected image's own schema. Full new-host acceptance is owed.
 users:
 - name: ${WSL_USER}
   uid: 1000
@@ -22,3 +23,8 @@ write_files:
   content: |
     [user]
     default=${WSL_USER}
+
+# /dev/tty1 is shared across distributions in the WSL VM. Mask its getty in cloud-init's network stage,
+# before systemd starts the unit. The source review, ordering and proof are in the page's W5.
+bootcmd:
+- [systemctl, mask, --now, getty@tty1.service]

evidence/artifacts/new-wsl-dual-image-20261001/receipt.json

@@ -0,0 +1,44 @@
+{
+  "schema_version": 1,
+  "kind": "new-wsl-dual-image-recipe-integration",
+  "accepted_main": "85543efe5abcddb7b7cddb14e8774e83b6758616",
+  "source_recipe_base": "798ac445307e2cd8eba6e74d7722ac0e16da02c7",
+  "evidence_class": "local_integration",
+  "source_patch_sha256": "019af42cc09aed576b26702c75537a1eed1ee0421ab0516f7aadd2211c480019",
+  "release_status": {"26.04.1": "provisional", "24.04.5": "provisional", "acceptance_precedence": null},
+  "image_sha256": {
+    "26.04.1": "48d56724b5c8e60f24893e83e73bbb58c60b3ca22fba3da977075420acd54104",
+    "24.04.5": "bb415d824822c4b878125729af451a5d18fb13d1cf5cbed9a7393ad64ac6039e"
+  },
+  "validation": [
+    {"command": "python3 -m unittest tests.test_wsl_new_distro_recipe", "tests": 50, "native_exit_code": 0, "independent": true, "duration_seconds": 0.428},
+    {"command": "python3 scripts/validate_convergence.py blueprints/convergence-practice/wsl-new-distro-image-20261001/experiment.json --root . --json", "native_exit_code": 0, "independent": true, "observations": 0, "returned_output": {"records": [{"errors": [], "observations": 0, "path": "blueprints/convergence-practice/wsl-new-distro-image-20261001/experiment.json", "valid": true}], "valid": true}},
+    {"scope": "swapped selected release recipe and receipt digest rejection", "native_exit_code": 0, "independent": true},
+    {"scope": "frozen seven-file patch application check on accepted main", "native_exit_code": 0},
+    {"scope": "frozen seven-file patch application on accepted main", "native_exit_code": 0}
+  ],
+  "source_verification": {
+    "evidence_class": "reported signature verification exit codes and signer fingerprint; reported 26.04.1 stream hash match; no retained verification output",
+    "signed_checksum_verification_exit_codes": {"26.04.1": 0, "24.04.5": 0},
+    "signer_fingerprint": "843938DF228D22F7B3742BC0D94AA3F0EFE21092",
+    "catalog_commit": "8bc98bc33b246fe66710eec9eaa1b24c323da987",
+    "wsl_setup_commit": "73418e32bb48d514c2c2853fa7e5cacdcaf3dfe8",
+    "image_26_stream_hash_match": true,
+    "image_26_download_bytes": null
+  },
+  "retained_failed_conditions": [
+    {"scope": "original native Claude Opus actor", "native_exit_code": 1, "cause": "returned weekly limit", "changes_made": false},
+    {"scope": "dual-image recipe regression before repair", "native_exit_code": 1, "tests": 2},
+    {"scope": "integration commit secret scanner", "native_exit_code": 1, "cause": "public GPG signer fingerprint labeled as a key matched generic-api-key", "correction": "rename the receipt field to signer_fingerprint; preserve the public fingerprint and scanner"},
+    {"scope": "dependent publication sequencing", "correction": "the first push after the rejected commit published only accepted main; wait for successful commit before publishing the repaired branch"}
+  ],
+  "not_run": ["new distro import or installation", "first boot", "systemd user lifecycle", "second isolated instance", "GPU runtime acceptance", "provider acceptance"],
+  "boundaries_preserved": ["export before unregister", "historical 24.04 receipts", "no global WSL shutdown or kernel change", "native operating-system consent", "Ubuntu insights consent guard"],
+  "sources": [
+    "https://github.com/microsoft/WSL/blob/8bc98bc33b246fe66710eec9eaa1b24c323da987/distributions/DistributionInfo.json",
+    "https://releases.ubuntu.com/26.04.1/",
+    "https://releases.ubuntu.com/24.04.5/",
+    "https://github.com/ubuntu/wsl-setup/tree/73418e32bb48d514c2c2853fa7e5cacdcaf3dfe8",
+    "adoption/platforms/linux-wsl2-new-distro.md"
+  ]
+}

evidence/artifacts/new-wsl-rehearsal-20261002/coordinator-review.md

@@ -0,0 +1,64 @@
+# Coordinator's review of the 26.04.1 rehearsal (2026-10-02)
+
+The receipt beside this file is the worker's record and is unchanged. This note adds what the coordinator did and
+checked afterwards.
+
+## What the rehearsal showed
+
+Stage 1 works for the 26.04.1 image on this host: signed sums, schema check, install, first launch through cloud-init
+(path A) and the file-ownership probe all held. The first boot then stopped at F1: `systemctl is-system-running --wait`
+printed `degraded`, and `user@1000.service` had failed with `Failed to spawn executor: Device or resource busy`.
+
+## Cause: distributions share one cgroup tree on WSL 2.7.13
+
+Checked from the workstation's distribution at 2026-10-02T02:40Z, with a third distribution also running:
+
+- `/sys/fs/cgroup/system.slice/cron.service/cgroup.procs` printed `0 <pid> 0`: one local process and two processes
+  from other process namespaces, in one cgroup. Same-named system units of every distribution share a cgroup.
+- The other running distribution reports its `user@1000.service` as active with
+  `ControlGroup=/user.slice/user-1000.slice/user@1000.service`, the workstation's own path.
+- The rehearsal's failed unit showed the workstation's accounting (about 1,840 tasks, 16 GiB), as the receipt records.
+
+So a second systemd distribution whose user has the same uid cannot start its user manager while the first one runs,
+and a stop or restart of a system unit in one distribution acts on a cgroup that holds another distribution's
+processes.
+
+## Upstream state (microsoft/WSL release notes, read 2026-10-02)
+
+- 2.9.8 (pre-release, 2026-08-24): "Protect critical WSL processes under heavy load with cgroup & isolate distro
+  cgroups" (pull request 40519).
+- 2.9.13 (pre-release, 2026-09-25): "Create new namespaces for distro cgroups" (pull request 41512).
+- 3.0.1 (stable, 2026-09-29) is the first stable release after those. The host runs 2.7.13; the 2.7 line (2.7.14,
+  2026-09-11) has neither change.
+- Issue 41492 (rootless Docker and Podman cannot start a container after the hierarchy moved) is still open, last
+  updated 2026-09-28. Whether 2.9.13's namespaces close it on 3.0.1 is not verified here.
+
+## What the coordinator did
+
+- Removed the failed rehearsal by the recipe's failure path at 2026-10-02T02:40:47Z: terminate, export, unregister.
+  Export: `StackRehearsal2604-rehearsal.tar`, sha256
+  `3dadd24ab1af5e9639d26f5ecd3fff36a9df5e3b1dfa204e5f8a70cbaa42e9ff`, 1,276,456,960 bytes. The default distribution
+  is unchanged.
+- Did not touch the other distributions.
+
+## Consequences for the recipe
+
+1. The recipe's uid-1000 user cannot have a working user manager beside the workstation on WSL 2.7.x. Either the
+   host first moves to a WSL release with isolated distro cgroups, or the new distribution's user gets another uid
+   (which removes the user-manager collision only; system units still share cgroups).
+2. W5's proof should name the launch warning `wsl: Failed to start the systemd user session`.
+3. P3/W5: six new storage-error lines appeared about 15 seconds before cloud-init started, when the new disk was
+   attached; the rule "equal to the baseline" does not hold on a host that attaches a disk.
+4. The rootless-container check (issue 41492) belongs right after F3 on whichever WSL release the host ends on.
+
+## Runs on WSL 3.0.1 (2026-10-02)
+
+`runs-on-wsl-3.0.1.json` holds the compact, sanitized record of three units on the updated host, each on its own
+throwaway name: run 2 (08:32Z to 08:39Z, the recipe before its repair, stopped at W5's paired rule on the shared VM
+console), probe E1 (08:42Z, outside the recipe, the template plus the `bootcmd` mask) and run 3 (10:54Z to 11:01Z, the
+repaired recipe, P1 to F5 with a rootless container). Each step names its raw output by sha256 and keeps a bounded
+excerpt; the raw files stay in the coordinator's private state folder. The record is built by a script that replaces
+the user name, the Windows computer name, device ids and profile paths and refuses to write if one survives.
+
+These are rehearsals. They qualify neither image arm of the preregistered comparison; stage 2 with its uv and Node
+probes, the 24.04.5 rollback arm and path B are still owed.