docs: publish verified Gentoo preview build and acceptance records

docs/install.md

@@ -42,13 +42,17 @@ a nonsecret snapshot is also saved at `/var/log/hydra-install.log` on that disk.
 
 ## Disposable VM acceptance
 
-Run the repository harness with QEMU/KVM, `qemu-img`, Python 3, and an OVMF
-CODE/VARS pair. Use trusted image and firmware files. For example:
+Run the repository harness with QEMU/KVM, `qemu-img`, Python 3, and a generic
+x86_64 QEMU OVMF CODE/VARS pair. A Xen-specific OVMF build is unsuitable: the
+first validation attempt with that variant produced no guest boot output.
+Use trusted image and matching firmware files. For example:
 
 ```sh
+install -d -m 700 "$HOME/.cache/hydra-tests"
 python3 dev/iso-smoke.py --iso /absolute/path/to/hydra-os.iso \
   --ovmf-code /absolute/path/to/OVMF_CODE.fd \
-  --ovmf-vars /absolute/path/to/OVMF_VARS.fd
+  --ovmf-vars /absolute/path/to/OVMF_VARS.fd \
+  --scratch-parent "$HOME/.cache/hydra-tests"
 ```
 
 The harness creates a private directory under `/tmp`, a new 32 GiB sparse
@@ -57,6 +61,8 @@ argument. QEMU attaches the ISO read-only; serial and QMP use private Unix
 sockets. Tool overrides `--qemu` and `--qemu-img` support temporary development
 environments. `--scratch-parent`, `--memory`, `--boot-timeout`, and
 `--install-timeout` control retained artifacts and bounded resource use.
+Prefer a disk-backed scratch directory: an installed disk stored on a tmpfs
+such as `/tmp` consumes host RAM. The example keeps test data in the user's cache.
 
 The test boots the live image, runs the real installer through the guest's
 controlling terminal using a generated password, writes a persistence sentinel,
@@ -67,6 +73,9 @@ synthetic VM endpoint. Network namespaces and veth interfaces exist only inside
 the disposable HydraOS guest. When guest KVM is available, it launches a further
 fresh-disk QEMU as the installed account to exercise KVM, the bridge helper,
 and private QMP; this checks VM launch, not a nested operating system boot.
+It also logs the installed account out and back in, checking that the same VM,
+private sockets and user audio services survive a measured interval without an
+open login session. This establishes process/socket continuity, not audio playback.
 
 `report.json` records each observed check, ISO/firmware SHA256, failures, and
 skipped nested virtualization. Serial/QEMU logs and the qcow2 remain in the