DF-3095 runtime log (guest, stock INVARIANTS kernel #0 Jul 2, X86_64_GENERIC)
============================================================================
[run 1 - panic variant]
# cp base.img tid.img && ./tid_craft /root/tid.img panic && vnconfig -c vn0 tid.img
vol0_next_tid @ header offset 248 (sizeof header 1928)
vol0_next_tid BEFORE = 0000000100000000  (btree_root 8000000021000000)
vol0_next_tid AFTER  = ffffffffff000000 (panic variant)
# mount_hammer /dev/vn0 /mnt        <- SUCCEEDS
(serial) HAMMER(ua3095) mounted clean, no recovery needed
# echo hello > /mnt/x
(serial) panic: hammer_alloc_tid: Ran out of TIDs!
        hammer_alloc_tid() at hammer_alloc_tid+0xa7
        hammer_alloc_objid() at hammer_alloc_objid+0x246
        hammer_create_inode() at hammer_create_inode+0x365
        hammer_vop_ncreate() at hammer_vop_ncreate+0xa8
        vop_ncreate() at vop_ncreate+0x5b
        Debugger("panic") ... db>
(full console section in panic.txt)

[run 2 - wrap variant, fresh 4G stock base image]
# ./tid_craft /root/tid.img wrap
vol0_next_tid BEFORE = 0000000100000000  (btree_root 8000000021000000)
vol0_next_tid AFTER  = ffffffffffffffff (wrap variant)
# mount_hammer /dev/vn0 /mnt && echo hello > /mnt/x && sync
MOUNT_OK
WRITE_OK                       <- NO panic, NO error anywhere
# hammer history /mnt/x
/mnt/x	0000000000000066 clean {
    0000000000008010 06-Sep-2026 07:19:01      <- create_tid 0x8010 << TID base 0x100000000
}
# umount /mnt
UMOUNT_OK

[run 3 - wrap variant + snapshot isolation proof]
# fresh stock image; mount RW; echo AAA > /mnt/a; sync
# hammer synctid /mnt
0x0000000100008080                      <- T1 (only file 'a' exists)
# umount; ./tid_craft snap.img wrap; mount RW; echo BBB > /mnt/b; sync
# hammer history /mnt/b
/mnt/b	000000000000038d clean {
    0000000000008010 06-Sep-2026 07:20:04      <- post-wrap TID
}
# umount; mount_hammer -T 0x0000000100008080 /dev/vn0 /mnt   <- as-of T1 view
# ls -l /mnt
total 0
-rw-r--r--  1 root root  wheel  4 Sep  6 07:20 a
-rw-r--r--  1 root root  wheel  4 Sep  6 07:20 b       <- LEAKED: created AFTER T1
# cat /mnt/b
BBB
=> the T1 snapshot (taken when only 'a' existed) contains 'b':
   snapshot isolation broken by the wrapped create_tid.

[stress] both variants deterministic across runs (panic 1/1, wrap 1/1);
scaffolding iterations for TID parsing and the -T mount option were
tooling fixes, not reproduction variance.