docs(upstream): complete affected bug handoffs

Record the tested apple/container#1757 launchd identity fix and the narrowed apple/containerization#792 implementation for apple/containerization#790 and apple/container#1895.

Include exact source and shared-test-support commits so either change can be reviewed for Apple without pushing it there.

Author: stephenlclarke

docs/upstream/APPLE-UPSTREAM-REVIEW.md

@@ -37,17 +37,15 @@ six approved open pull requests.
 | [apple/container#1888](https://github.com/apple/container/issues/1888) | `container system start` status text used stdout. The focused change from [apple/container#1889](https://github.com/apple/container/pull/1889) is ported as `0fe7833`. |
 | [apple/container#1672](https://github.com/apple/container/issues/1672) | `container system stop --prefix` accepted path-like values. [apple/container#1717](https://github.com/apple/container/pull/1717) is ported as `7329f12`. |
 | [apple/container#1767](https://github.com/apple/container/issues/1767) | Image snapshots omitted ordered EXT4 journaling. Approved [apple/container#1818](https://github.com/apple/container/pull/1818) is ported as `6e525cc`. |
+| [apple/container#1757](https://github.com/apple/container/issues/1757) | `system start` discarded launchd failures and could adopt a daemon using another app root. Fixed in `stephenlclarke/container` `6ac1253`. |
+| [apple/containerization#790](https://github.com/apple/containerization/issues/790) and [apple/container#1895](https://github.com/apple/container/issues/1895) | Retrying an interrupted ECR blob PUT reused a stale upload session. The useful fresh-session design from [apple/containerization#792](https://github.com/apple/containerization/pull/792) is implemented with narrower retry semantics and local registry tests in `d388a15` and `c8043bb`. |
 
 ## Open Follow-up
 
-- [apple/container#1895](https://github.com/apple/container/issues/1895) and
-  [apple/containerization#790](https://github.com/apple/containerization/issues/790)
-  affect registry push when ECR briefly returns `404` after upload completion.
-  Open `apple/containerization#792` retries a broader set of failures and has no
-  regression coverage, so it should be narrowed and tested before use.
-- [apple/container#1757](https://github.com/apple/container/issues/1757) affects
-  service registration because a nonzero `launchctl bootstrap` result is not
-  propagated. The local fork still needs a focused error-handling fix.
+No confirmed local impact from this review remains without either a fix or an
+existing stronger local implementation. Re-run the review before release or
+Apple submission because newly opened and newly approved work can change that
+result.
 
 ## Submission Boundary
 

docs/upstream/apple-container/ISSUE-system-start-app-root.md

@@ -0,0 +1,28 @@
+# System Start Can Adopt The Wrong App Root
+
+## Upstream Reference
+
+- Existing report: [apple/container#1757](https://github.com/apple/container/issues/1757)
+
+Do not open a duplicate issue.
+
+## Problem
+
+`ServiceManager.register` discards the `launchctl bootstrap` termination
+status. A repeated `container system start --app-root B` can therefore appear
+successful while launchd continues running the singleton API service created
+for app root A. The health response already exposes the live daemon's app root,
+but `SystemStart` discards it.
+
+## Expected Behavior
+
+- A nonzero launchd bootstrap result is an error.
+- An already registered API service is not bootstrapped again.
+- The live health response must identify the requested canonical app root.
+- A mismatch explains that the existing system must be stopped before changing
+  `--app-root`.
+
+## Ownership
+
+This is native `container` service lifecycle and identity handling. Compose
+must be able to trust a successful system start without probing private paths.

docs/upstream/apple-container/PR-system-start-app-root.md

@@ -0,0 +1,28 @@
+# Pull Request: Verify Launchd Startup Identity
+
+## Summary
+
+- Surface nonzero `launchctl bootstrap` status.
+- Skip bootstrap when the API service label is already registered.
+- Compare the health response's canonical app root with the requested path.
+- Cover status validation and matching/mismatched app roots without invoking
+  launchd in unit tests.
+
+## Upstream Reference
+
+- Fixes [apple/container#1757](https://github.com/apple/container/issues/1757).
+- No overlapping open pull request was found.
+
+## Commit Tracking
+
+- Fork commit: `6ac1253` in `stephenlclarke/container`.
+- The commit is intentionally separate from imported upstream changes.
+
+## Validation
+
+```sh
+swift test --disable-automatic-resolution \
+  --filter 'ServiceManagerTests|SystemStartTests'
+make check
+make test
+```

docs/upstream/apple-containerization/ISSUE-ecr-blob-upload-retry.md

@@ -0,0 +1,31 @@
+# Interrupted ECR Blob Uploads Reuse A Stale Session
+
+## Upstream Reference
+
+- Runtime issue: [apple/containerization#790](https://github.com/apple/containerization/issues/790)
+- CLI report: [apple/container#1895](https://github.com/apple/container/issues/1895)
+- Overlapping open pull request:
+  [apple/containerization#792](https://github.com/apple/containerization/pull/792)
+
+Do not open a competing issue or pull request. Use these notes to review or
+improve the existing proposal.
+
+## Problem
+
+The generic request retry recreates a blob body stream at byte zero while
+reusing the same registry upload URL. If ECR committed part of the first PUT,
+it rejects the restarted body with HTTP 416 and `BLOB_UPLOAD_INVALID` because
+the session expects the next byte offset.
+
+The overlapping PR has the correct high-level idea but retries manifests and
+non-retryable semantic failures, and it invents three retries for clients whose
+retry policy is nil.
+
+## Expected Behavior
+
+- Every retried blob attempt starts with a new `POST /blobs/uploads/` session.
+- The PUT itself never retries against the same upload UUID.
+- Manifests retain the existing request behavior.
+- Nil or zero retry policy performs no fresh-session retry.
+- Only transport failures, server errors, and ECR's specific
+  `416/BLOB_UPLOAD_INVALID` response restart the blob upload.

docs/upstream/apple-containerization/PR-ecr-blob-upload-retry.md

@@ -0,0 +1,39 @@
+# Pull Request: Restart Interrupted Blob Uploads In Fresh Sessions
+
+## Summary
+
+- Incorporate the fresh-session design from
+  [apple/containerization#792](https://github.com/apple/containerization/pull/792).
+- Add an internal request policy that can truly disable generic retries.
+- Apply the outer retry loop only to blobs.
+- Retry only transport errors, 5xx responses, and ECR
+  `416/BLOB_UPLOAD_INVALID` responses.
+- Share the local HTTP stub between registry and Cloud Hypervisor tests.
+- Prove that retry uses a second upload UUID and nil policy performs one POST
+  and one PUT.
+
+## Upstream Reference
+
+- Fixes [apple/containerization#790](https://github.com/apple/containerization/issues/790).
+- Resolves the lower-layer cause of
+  [apple/container#1895](https://github.com/apple/container/issues/1895).
+- Update the existing open
+  [apple/containerization#792](https://github.com/apple/containerization/pull/792)
+  rather than opening a competing pull request.
+
+## Commit Tracking
+
+- Shared test support: `d388a15` in `stephenlclarke/containerization`.
+- Source fix and registry regressions: `c8043bb` in
+  `stephenlclarke/containerization`.
+- Keep the source fix as its own upstream-overlap commit.
+
+## Validation
+
+```sh
+swift test --disable-automatic-resolution --filter blobPush
+swift test --disable-automatic-resolution \
+  --filter CloudHypervisorTests.ClientTests
+make check
+make test
+```