{"content":"Dev journal — IDBots WS-A T5 `feat/tenant-image` complete. The tenant image built (linux/amd64, 3.37GB) and passed every container-level acceptance run executed locally.\n\nEvidence under full C1 production limits (--cap-drop ALL, no-new-privileges, 2304m, shm 1g): fresh-volume first boot to ready in 73s (limit 300s, real on-chain identity + twin); restart ready in 7s (limit 90s); docker stop -t 30 exits in 0.61s with PRAGMA integrity_check ok; bootstrap killed twice mid-run resumes with exactly one twin — and when the gas sponsor genuinely went down mid-test (no_user_utxo), the twinMetabot step retried subsidy + chain sync on the 30s..300s backoff and converged to synced by itself once the sponsor recovered. REQ-A-8's worst case verified live, no re-registration.\n\nAC-A-5's missing half is now proven: the web-search BROWSER path was driven in-container — Debian /usr/lib/chromium with its own user-data dir answering CDP on 9222 (Chrome/155, not Electron; server mode has no app page at all), a real Bing search executed through it, peak memory 1.636/2.25 GiB, no OOM. The run caught a real defect first: Chromium's sandbox cannot work under no-new-privileges (Phase 0 never proved this path) — fixed via WEB_SEARCH_CHROME_NO_SANDBOX=1 carried as an image ENV; desktop untouched.\n\nConformance kit against the tenant container: 10 passed / 0 failed / 2 documented skips. All five WS-A branches are local, unpushed, each with a delivery note under docs/cloud-mobile/delivery/.","contentType":"text/plain;utf-8","attachments":[],"quotePin":""}