[themartiano]

What changed and why

Fixes #281. Mount personal Mac shares with cache=readahead, avoiding 9p writeback caching even when a persistent VM retains an older held kernel. A factory version bump cannot update those VMs' saved disk and boot kit.

The app bundles the safe helper in its existing read-only boot payload. On launches with sharing enabled, it masks the old guest's mount service for that boot and mounts the share before settings installation and login. The on-disk helper, kernel/initramfs, package holds, and user data stay intact. Missing payloads and ARM64 command-line overflow refuse the launch; guest-side mount failures never fall back to writeback. A clean shutdown and new app launch applies the mitigation. Documentation covers old-app mitigation, verification, downgrade behavior, and the writable MAP_SHARED/bulk-write tradeoffs.

Testing

• make test: passed on Eduardo's Mac (377 Swift tests, 258 guest unit tests, guest contracts, shell suites, and 16 resize tests). Initial sandboxed sockets were blocked; final suite ran with escalation. Updated the boot-argument assertion after moving command-line assembly into a length-checked variable.
• python3 -m unittest discover -s guest/tests -p test_mac_share_mount.py -v: 5 passed. Launcher regressions cover persistent/ephemeral shares, preserved boot kits, missing helper, and oversized boot arguments. git diff --check passed.
• Disposable HVF fixture using a cloned pre-existing factory disk and its paired Linux 7.2.8-1 boot artifacts: old disk helper still contained cache=mmap, old service reported masked, actual share reported cache=0x1. 300 writes under concurrent reads passed immediate size/content checks and independent host byte-for-byte verification. Git init/commit/aggressive GC/fsck/clone, read-only mmap with a read-only descriptor, and writable private mmap passed; writable shared mmap failed with EINVAL as expected. With the fixture helper withheld, the share stayed unmounted. No live VM or personal shared files were used.
• macos/build-app.sh --guest-dir /Users/dudas/martiano/try-omarchy/dist/guest: passed with ad-hoc signature verification using copied pre-existing runtime and read-only factory artifacts. Both bundled safety payload files matched source. This validates app assembly, not a freshly rebuilt factory.
• guest/build-container.sh --refresh-package-lock "$PWD/.build/issue281/packages.refreshed.lock.json": reviewed and applied exactly five version updates (appstream, libgsf, libpng, librsvg, pcre2); package membership, metadata and kernel pins unchanged.
• Fresh make guest: passed, including the pinned reproducible Hyprland binary digest and ext4 check. Independently verified every manifest artifact hash/size and SHA256SUMS, compressed-to-raw SHA-256 equality, installed refreshed package versions, and current build spec.
• Fresh factory disposable HVF boot: Linux 7.2.8-1, native share unit loaded/unmasked, installed helper matched source and actual mount reported cache=0x1. Another 300 writes under concurrent reads passed immediate guest size/content checks and independent host byte-for-byte verification. Git and mmap checks passed with the expected writable shared mmap EINVAL. Guest /boot/Image and initramfs hashes matched the freshly exported paired artifacts.
• macos/build-app.sh --guest-dir "$PWD/dist/guest": passed using the fresh factory, including ad-hoc signature and macOS 15 compatibility verification. Bundled guest manifest and both safety payload files matched the fresh artifacts/source.
• After the lock refresh, make test passed again (377 Swift, 258 guest, all contract/shell suites, 16 resize tests); git diff --check passed. Remaining verification gap: reproduction of the reporter's race on an affected older kernel. No claim that these fixture runs reproduced that race or measured the reporter's performance results.