973 B
Raw output - verify pre-runtime netns entry
After committing realized bindspace references and their deferred codec plan, the human requested the next Layer C increment.
git diff HEAD~1..HEAD -- tractor/spawn/_netns.py tests/test_netns_spawn.py ai/tpt-backends/03_wg_tunnel_bindspace.md
Added a private synchronous enter_netns() bootstrap primitive. It validates the inherited FD and expected inode, constrains setns() to CLONE_NEWNET, verifies /proc/self/ns/net afterward, and leaves FD closure to the future spawn-bootstrap caller.
Tests use real stand-in FDs while replacing only the privileged syscall and post-entry procfs observation. They prove stale FDs fail before entry, the syscall receives the exact namespace type, and bootstrap rejects an unexpected post-entry namespace. Ruff and all three focused tests passed.