docs(guanghu-os): register JD cross-root proof

product-source/hololake-platform/docs/adr/0177-guanghu-cross-root-supervisor-takeover.md

@@ -18,7 +18,8 @@ initramfs 的 `/run` 会被移动到新根系统，因此挂根前监督器留
 
 生产投影使用早于 `sysinit.target` 的 systemd 单元。隔离验证使用只读最小 ext4 根镜像和静态
 BusyBox，只证明跨 `switch_root` 的连续接管与常驻进程，不把它等同于真实机器部署、完整 Linux
-按需唤醒或最终光湖 OS 主控。
+按需唤醒或最终光湖 OS 主控。京东同核 QEMU 已完成这一隔离门：挂根前监督、进入新根、根内监督
+常驻和进程存活四项串联成立，真实启动文件与机器启动周期未改变。
 
 ## 否决
 

product-source/hololake-platform/guanghu-os/README.md

@@ -121,8 +121,11 @@ boot-scoped pre-root handoff after `/run` moves into the mounted root. It then
 stays resident with `ROOT_SUPERVISOR_ACTIVE`; the systemd projection starts it
 before `sysinit.target`. `scripts/build-guanghu-cross-root-fixture.sh` creates a
 read-only minimal root image for QEMU proof without mounting or modifying a
-host disk. Source availability alone does not raise the JD cross-root or final
+host disk. The JD-hosted QEMU receipt now proves the move into the new root,
-master predicates. See ADR-0177.
+live-binding revalidation, and a resident root-supervisor process. It does not
+prove physical boot or bounded wake/reclaim of the real repository bridge, so
+those predicates and final master control remain `0`. See ADR-0177 and
+`deployments/JD-FD-PRIMARY/CROSS-ROOT-SUPERVISOR-QEMU-RECEIPT-20260815.hldp`.
 
 ## Language-primary boot target
 

product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/CROSS-ROOT-SUPERVISOR-QEMU-RECEIPT-20260815.hldp

@@ -0,0 +1,48 @@
+schema: guanghu.jd-cross-root-qemu-receipt/v1
+receipt_id: JD-FD-PRIMARY-cross-root-qemu-5b040ca
+issued_at: 2026-08-15T23:55:00+08:00
+development_id: DEV-20260815-001
+node_id: JD-FD-PRIMARY
+node_dmi: f3d4b730-7f02-452f-975b-7091a4800431
+source_commit: 9db3ecd2e71374e6a2721f193e3360d73de342ba
+source_tree: a018fb6ab0ec2362ca0efc364269c62d73b32330
+workorder_sha256: 94a1bc9568be4dd3a6b2294ecb8988ba3aab1ebdcc722580b7f41a36b3fbccc7
+root_image_sha256: e45f7557997a3c7884fcd5d4252300462fb7a15ceebdf2d3a588606d08aa0ed3
+root_image_size: 134217728
+serial_sha256: 8c617a56af0ce5e1a2f95fb213b9cbd5a5dfd7c54e8fdb9d570bb5f1b79816d3
+trigger: The pre-root supervisor was proved, but continuing control across switch_root remained unknown.
+emergence:
+  - The first fixture mounted successfully but lacked /dev, /proc, /sys, and /lib/modules mountpoints, so run-init stopped before root entry.
+  - The corrected read-only fixture entered its own root, revalidated the moved /run handoff, started a root supervisor, and proved that process remained alive.
+lock:
+  - GUANGHU_FIRST_BOOT_SUPERVISOR_ACTIVE
+  - GUANGHU_SWITCH_ROOT_INIT_ACTIVE
+  - GUANGHU_ROOT_SUPERVISOR_ACTIVE
+  - GUANGHU_CROSS_ROOT_PERSISTENCE_VERIFIED
+why: A boot-scoped file alone is not a continuing controller; the root-side process must re-read live bindings and remain active after root transition.
+rejected:
+  - Using the live JD root disk in QEMU.
+  - Installing the systemd unit into the physical node before isolated proof.
+  - Claiming full Linux lifecycle control or final Guanghu master from a minimal fixture.
+live_readback:
+  boot_id_before: 68d4a3c9-c866-4f4a-be2e-0aa5f41a61b1
+  boot_id_after: 68d4a3c9-c866-4f4a-be2e-0aa5f41a61b1
+  repository_pid_before: 760
+  repository_pid_after: 760
+  public_code_http: 200
+  public_anchor_http: 200
+  residual_qemu_processes: 0
+  physical_boot_files_changed: false
+  physical_reboot_performed: false
+claims:
+  jd_host_qemu_pre_root_supervisor: 100
+  jd_host_qemu_cross_switch_root_supervisor: 100
+  cross_switch_root_persistent_supervisor: 100
+  physical_guanghu_first_boot: 0
+  linux_on_demand_subcontrol: 0
+  final_guanghu_os_master: 0
+next_gate: IMPLEMENT_AND_VERIFY_BOUNDED_ROOT_SUPERVISOR_TO_LINUX_REPOSITORY_BRIDGE_LIFECYCLE_IN_ISOLATION
+sources:
+  - /guanghu/recovery/JD-FD-PRIMARY-cross-root-qemu-5b040ca/WORKORDER.hldp
+  - /guanghu/recovery/JD-FD-PRIMARY-cross-root-qemu-5b040ca/qemu-cross-root.serial.log
+  - ADR-0177

routing/guanghu-os-control-architecture.json

@@ -1,7 +1,7 @@
 {
   "schema": "guanghu.os-control-architecture/v1",
   "record_id": "HLP-GUANGHU-OS-CONTROL-001",
-  "version": "2026-08-15.12",
+  "version": "2026-08-15.13",
   "state": "CURRENT_CANONICAL",
   "final_topology": "GUANGHU_MASTER_WITH_ON_DEMAND_LINUX_SUBCONTROL_AND_RESCUE",
   "control_ownership": {
@@ -39,7 +39,7 @@
     "linux_on_demand_subcontrol": 0,
     "linux_rescue_preserved": 100,
     "final_guanghu_os_master": 0,
-    "next_engineering_gate": "BUILD_AND_VERIFY_CROSS_SWITCH_ROOT_PERSISTENT_GUANGHU_SUPERVISOR_IN_JD_HOST_QEMU"
+    "next_engineering_gate": "IMPLEMENT_AND_VERIFY_BOUNDED_ROOT_SUPERVISOR_TO_LINUX_REPOSITORY_BRIDGE_LIFECYCLE_IN_ISOLATION"
   },
   "implementation": {
     "guanghu_supervisor_lifecycle_contract_source": 100,
@@ -76,7 +76,8 @@
     "guanghu_root_supervisor_contract_source": 100,
     "guanghu_root_supervisor_systemd_unit_source": 100,
     "guanghu_cross_root_fixture_builder_source": 100,
-    "jd_host_qemu_cross_switch_root_supervisor": 0,
+    "jd_host_qemu_cross_switch_root_supervisor": 100,
+    "cross_switch_root_persistent_supervisor": 100,
     "independent_guanghu_first_boot_supervisor": 0,
     "jd_physical_deployment": 0
   },
@@ -111,6 +112,21 @@
     "final_guanghu_os_master": 0,
     "observed_at": "2026-08-15T23:45:00+08:00"
   },
+  "cross_root_supervisor_qemu_evidence": {
+    "source_commit": "9db3ecd2e71374e6a2721f193e3360d73de342ba",
+    "source_tree": "a018fb6ab0ec2362ca0efc364269c62d73b32330",
+    "repository_receipt": "product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/CROSS-ROOT-SUPERVISOR-QEMU-RECEIPT-20260815.hldp",
+    "server_receipt": "/guanghu/recovery/JD-FD-PRIMARY-cross-root-qemu-5b040ca/DEPLOYMENT-RECEIPT.hldp",
+    "server_receipt_sha256": "47da5144d0f9b91140033080626205224961ed8dbf4624c9cd60fdd00bb6a57c",
+    "root_image_sha256": "e45f7557997a3c7884fcd5d4252300462fb7a15ceebdf2d3a588606d08aa0ed3",
+    "switch_root_entered": 100,
+    "root_supervisor_resident": 100,
+    "physical_boot_files_changed": false,
+    "physical_reboot_performed": false,
+    "linux_on_demand_subcontrol": 0,
+    "final_guanghu_os_master": 0,
+    "observed_at": "2026-08-15T23:55:00+08:00"
+  },
   "current_target_evidence": {
     "server_receipt": "/guanghu/recovery/JD-FD-PRIMARY-linux-subcontrol-f5217fe/DEPLOYMENT-RECEIPT.hldp",
     "server_receipt_sha256": "4a7d0cb354ff0472dbd8e2e43d89021d65b21f0beea3c702dcbeacdd1c73bfbc",

routing/guanghu-os-control-architecture.test.mjs

@@ -43,12 +43,12 @@ test("current JD state stays transitional and cannot impersonate final master co
   assert.equal(contract.jd_fd_primary.final_guanghu_os_master, 0);
   assert.equal(
     contract.jd_fd_primary.next_engineering_gate,
-    "BUILD_AND_VERIFY_CROSS_SWITCH_ROOT_PERSISTENT_GUANGHU_SUPERVISOR_IN_JD_HOST_QEMU",
+    "IMPLEMENT_AND_VERIFY_BOUNDED_ROOT_SUPERVISOR_TO_LINUX_REPOSITORY_BRIDGE_LIFECYCLE_IN_ISOLATION",
   );
 });
 
 test("the physical shadow and host QEMU cycles are registered without impersonating Guanghu-owned boot control", () => {
-  assert.equal(contract.version, "2026-08-15.12");
+  assert.equal(contract.version, "2026-08-15.13");
   assert.equal(contract.implementation.guanghu_supervisor_lifecycle_contract_source, 100);
   assert.equal(contract.implementation.target_readback_and_mandatory_reclaim_state_machine, 100);
   assert.equal(contract.implementation.declared_supervisor_core_line_and_function_coverage, 100);
@@ -82,7 +82,8 @@ test("the physical shadow and host QEMU cycles are registered without impersonat
   assert.equal(contract.implementation.guanghu_root_supervisor_contract_source, 100);
   assert.equal(contract.implementation.guanghu_root_supervisor_systemd_unit_source, 100);
   assert.equal(contract.implementation.guanghu_cross_root_fixture_builder_source, 100);
-  assert.equal(contract.implementation.jd_host_qemu_cross_switch_root_supervisor, 0);
+  assert.equal(contract.implementation.jd_host_qemu_cross_switch_root_supervisor, 100);
+  assert.equal(contract.implementation.cross_switch_root_persistent_supervisor, 100);
   assert.equal(contract.implementation.independent_guanghu_first_boot_supervisor, 0);
   assert.equal(contract.implementation.jd_physical_deployment, 0);
   assert.equal(contract.current_target_evidence.final_state, "DORMANT");
@@ -97,6 +98,13 @@ test("the physical shadow and host QEMU cycles are registered without impersonat
   assert.equal(contract.pre_root_supervisor_qemu_evidence.cross_switch_root_persistent_supervisor, 0);
   assert.equal(contract.pre_root_supervisor_qemu_evidence.final_guanghu_os_master, 0);
   assert.match(contract.pre_root_supervisor_qemu_evidence.server_receipt_sha256, /^[0-9a-f]{64}$/);
+  assert.equal(contract.cross_root_supervisor_qemu_evidence.switch_root_entered, 100);
+  assert.equal(contract.cross_root_supervisor_qemu_evidence.root_supervisor_resident, 100);
+  assert.equal(contract.cross_root_supervisor_qemu_evidence.physical_boot_files_changed, false);
+  assert.equal(contract.cross_root_supervisor_qemu_evidence.physical_reboot_performed, false);
+  assert.equal(contract.cross_root_supervisor_qemu_evidence.linux_on_demand_subcontrol, 0);
+  assert.equal(contract.cross_root_supervisor_qemu_evidence.final_guanghu_os_master, 0);
+  assert.match(contract.cross_root_supervisor_qemu_evidence.server_receipt_sha256, /^[0-9a-f]{64}$/);
   assert.equal(contract.native_public_projection_shadow_evidence.synthetic_ready_shadow_readback, 100);
   assert.equal(contract.native_public_projection_shadow_evidence.post_test_state, "DORMANT");
   assert.equal(contract.native_public_projection_shadow_evidence.live_native_freshness_readback, 0);