[rgarcia]

Summary

• Keep memory-preserving VZ live forks available and document Apple's shared-platform-identifier warning.
• Replace intentionally failing identity diagnostics with a passing compatibility test and normal macOS guest-state regression coverage.
• Check process and boot continuity, tmpfs state, counter progress, independent RAM/disk writes, fresh UUID divergence, and two additional standby/restore cycles.
• Retain host-to-fork HTTP reachability as an explicitly opt-in diagnostic, with its current limitation documented.
• Report the exact macOS host version in CI so OS-specific boot failures are distinguishable.

Testing

Host: Apple M4, 16 GB RAM, macOS 27.0.1.

• Guest-state correctness: passed three consecutive runs, each with a live fork and two additional standby/restore cycles. The post-fork HTTP subtest is skipped unless HYPEMAN_VZ_FORK_HTTP=1.
• VZ hypervisor unit suite: passed.
• Existing standby/restore, running-source snapshot round trip, and running-network-fork tests: passed.
• Opt-in host-to-fork HTTP diagnostic: fails; the fork responds over loopback and vsock but not at its allocated IP from the host. No attribution to shared platform identity is claimed.

Important environment limitation

The currently released Cloud Hypervisor-derived kernel crashes the VZ service before guest boot on macOS 27, matching apple/container#2360. Initial integration results used a local four-byte binary patch. The guest-state test has since passed three additional consecutive runs with a kernel built directly from the source fix in kernel/linux#5, with no binary patching. Existing standby/restore, running-source snapshot round trip, and running-network-fork tests also passed with that source-built kernel.

The source fix is not yet released, and no kernel or runtime workaround ships in this PR. These results do not establish released-kernel macOS 27 support or general concurrent-fork safety. The macOS CI run passed on macOS 15.6.1 (build 24G90), Apple M1 Max; it does not cover macOS 27.

Full repository suite was not run locally; validation was targeted to VZ.