EriX Documentation

This repository contains the current product specifications, technical manual, security policy, operational guidance, and project-planning archive for EriX.

EriX is a clean-room, capability-based microkernel operating system written in Rust.

Alpha 1 is the operating-system threshold at which EriX can rebuild EriX inside an authority-bounded EriX build realm. It is not the project's endpoint: the longer-range direction includes a general-purpose personal-computing platform, broader hardware and architecture support, security and reliability services, distribution, desktop and compatibility environments, virtualization, and fleet operations. A related EriX toolchain subproject separately replaces the imported Alpha 1 compiler payloads with EriX-owned runtime libraries, binary utilities, and Rust/C/C++ compiler workflows.

Purpose of This Repository

The repository is the cross-component documentation boundary. It owns:

• boot image and kernel handoff specifications
• syscall, IPC, and capability contracts
• the technical manual under manual/
• clean-room, dependency, security, and release policies
• operational evidence for image construction and runtime validation
• a separate planning archive that does not define product APIs or runtime architecture

Component repositories remain the source of truth for implementation details. When a shared contract changes, its owning component, direct callers, integration scenarios, and this repository must be updated together.

Current Product Model

Mapping preflight and performance acceptance

Activation/restoration walk private read-only mapping chunks directly. Pending updates cross storage-chunk boundaries, while reserved empty chunks do no work. Live mapping reads, permission barriers, immediate failures and the final batch retain their order. The view carries neither authority nor cached mapping state; smaller iterator bookkeeping does not establish a guest timing improvement.

Prepared mapping leaves encode the GLOBAL-invalidation flag only in bit 0 of their already aligned target address, retaining the complete entry and exact hardware PTE key. Checked non-null hardware keys let the compiler use smaller temporary results without tagging a pointer or extending its lifetime. Whole-batch validation, live preparation, immediate GLOBAL invalidation and all existing group/error flushes remain. The manual records this private representation separately from matching-image startup-performance acceptance; smaller emitted code and stack use do not establish a guest speedup.

Mapping tables retain one last-full-search index for repeated user-buffer validation and copying. It belongs to the table, not to a process-global cache, and stores no pointer, rights, backing or successful authorization. Each use checks the live bound and exact page under the existing VSpace lock, then performs the original authorization checks. Mutable exposure, removal and clearing invalidate it; appending preserves an already established first match. Operation-local neighbor hits do not replace this full-search origin. The original linear first-match search remains the fallback. Matching-image performance acceptance is separate from this source optimization.

Mapping-batch staging initializes only the exact bounded prefix that a successful independent group will consume. Partial preparation failure never reads that prefix or writes the group's leaves; the existing flush still runs. Copy-only leaf/key records need no destructor cleanup, and the unused tail is never read. Eight trace-equivalence regressions cover every prefix length and failure position, dependencies, GLOBAL invalidation and empty/invalid groups. The strict kernel matrix passes 555 default and 579 all-feature tests, with two explicit host benchmarks ignored by ordinary tests. Reduced emitted work is not evidence that either strict startup-performance gate has passed.

Kernel bb9c46fb retains the first exact index from successful whole-range mapping-byte preflight for the subsequent copy pass. Every copy still reacquires the VSpace lock and checks live page identity, rights, kind and backing. Only a duplicate initial search is removed; errors, complete preflight and activation flush boundaries are unchanged. Ten new regressions and the warning-denied kernel matrix pass. This is not a measured image speedup. The strict startup limits remain open: both exact green Integration 411bc181 baseline observations and both private c306711a candidate observations fail, despite CI 1545 passing all 486 scenarios and post-image gates. The private candidate measures 2.755 and 2.735 seconds for the four-command interval, against the unchanged two-second limit; no observer overhead is subtracted.

Storage verification progress

Integration storage scenarios report a phase only after its complete proof succeeds. Rootd's existing Integration-only logging adapter emits the library-selected record; production bootstrap gains no test policy or authority. A pending or failed proof cannot refresh progress, and reporting failure stops the pipeline. Final compatibility markers retain their original order. This replaces a silent fifteen-step baseline interval without changing the 120-second total or 45-second silence budget. The migration-closure VM requires fourteen unique, ordered phase records between mount and I/O readiness, preserving its existing assertions. Run 1543's storage failures remain open until matching published-head CI confirms the repair. The final 7f7e6cfd graph's eight private terminal/time/interrupt probes pass; that focused evidence does not establish full-catalog acceptance.

Provider read-response stack correctness

VFSD c3e7b987 removes a redundant owned provider-read response by validating the existing fixed wire through its borrowed view, then constructing only the final owned backend result in a non-inlined helper. Ordinary and timestamped reads retain every payload byte, including the initialized tail beyond the reported data length, and preserve length/field/correlation checks, error precedence, requests and capability-receipt cleanup. No wire, authority or deployment-stack allowance changes.

The exact prior smoke entry/serve/read/transport chain required 267072 bytes against its 262144-byte stack; preceding mapped library padding could hide the 4928-byte underflow. Runtime and smoke compiler-output checks now conservatively sum 169008 bytes, leaving 93136 bytes in that same allocation. The selected-frame gate caps its sum at 245760 bytes, reserving at least 16 KiB for descendants. It overcounts transport and decode as concurrent, but is not a whole-program, indirect-call or recursion proof. The component's strict default/all matrices both pass 136 tests, including seven new reply regressions. Checker-only 6b945dc2 passes thirteen models covering unsupported stack-pointer updates, prefixed instructions and direct backedges into the allocating prologue; the runtime source and measured artifacts are unchanged. This independently proven stack defect is not an attribution of run 1543's thirteen storage stalls; matching fixed-graph guest and full-CI acceptance remain separate, with unchanged 120/45 deadlines and no speedup claim.

Interrupted callers and shared terminal lifetime

An inherited child's stream CALL is not ownership of its parent's terminal. Exact debugger evidence shows a killed reader losing its reply, after which ttyd incorrectly terminated the shared parent session. The next launch then received a denied terminal policy. The scoped repair treats only the ordinary input/output REPLY's NOT_FOUND as cancellation of that kernel-retired call: it preserves the session, routes, policy, prompt ownership and committed stream offsets. It neither retries the reply against another caller nor replays consumed input or accepted output. Explicit lifecycle failure and other transport errors retain their existing teardown or fail-closed behavior; no wire or authority change is required. Matching fixed-image acceptance remains pending. Signed ttyd ece7fa95 passes its strict 248/252 matrix and eight focused stream-dispatch tests, including six new regressions.

Separately, launchd dd7b78d0 preserves terminal status when a signal reply succeeds: an independently delegated control holder must not consume the original status waiter's result or charge its parent's waited-child totals. Exsh's companion explicitly reads its already-held status route after a terminating signal response, requiring the same terminal state and status before dropping either handle. Deferred cleanup retains both routes and that expected result through at most 64 yielded re-observations; mismatch or uncertainty fails closed. Successful status delivery accounts once, and grant/provider cleanup still gates retirement. Launchd's strict 325/325 matrix and replacement CI 123 pass; its two-row model proves nine child generations reuse a row only after explicit status observation and normal cleanup. The earlier 58cccff6 consuming-signal behavior is superseded. Eight passing 2636f792 private probes are retained diagnostics, not corrected-graph acceptance. Matching exsh-companion and complete remote evidence remain open. The frozen exsh companion passes twelve new focused host regressions; those checks do not establish full-matrix or matching-guest acceptance. The new physical nine-cycle interrupt probe instead checks sustained guest use: fresh reader echo and output, one Ctrl-C, exact CONTROL130, a new prompt, then a separately launched AFTERINT and another prompt per cycle. It retains 120/15/10-second bounds and is not a universal configurable-capacity proof. Matching VM and full replacement CI results are not inferred from host tests.

CI fixture isolation and product-console evidence

The independent-console observer uses 800-ms ordinary command-result captures, while keeping edit, consent and foreign-seat Enter observations unchanged. Every accepted result still needs a fresh screenshot, with the original 160-frame and 120/15/10-second limits. The matching unchanged e7f4fa71 image passes twenty commands and exact consent/readback evidence in 132 captures. The times fixture also performs bounded successor work before requiring visible growth: separately truncated centisecond fields can remain equal despite increasing raw CPU counters. Neither repair adds authority or changes runtime accounting, and full replacement CI remains required. Run 1541 retains 485 PASS / 1 FAIL across all 486 scenarios, with only the strict times display-increase assertion failing; later product stages were skipped. The corrected fixture passes its matching private 1bd2c311 guest and the same remote scenario in replacement 82c7ffd5 run 1542, whose complete catalog and post-image stages are still required.

Host runner fixtures select private firmware sources, writable variable copies, disks and all log paths, including disabled-input logs that the real runner retires. The runner creates the exact selected firmware target's parent before copying; it does not create an unrelated default output tree. Clean-checkout negative profile tests provide a private nonbootable disk so the intended profile validation is reached without depending on an existing appliance. Fake-QEMU tests check unchanged source bytes, ambient output sentinels and failure before launch. These are host checks, not guest or CI acceptance.

Canonical development packaging selects the existing interactive-escalation policy without authored physical-input fixtures. Rootd uses one predicate for console dispatch, fixture-baseline capture, completion evidence and terminal reporting: only an interactive command with physical-input testing disabled uses the product console plan. Authored input scenarios retain their original authority, exit and trusted-terminal evidence rather than inheriting product success handling. No new shell authority or wire ABI is introduced.

The canonical product boot probe is separate from those authored scenarios. It requires an independently expected version, the exact banner/readiness policy, a full primary prompt and visible caret, then two separately entered physical command lines with distinct exact output, zero status and a fresh prompt each. Framebuffer color evidence and acknowledged host QMP retirement do not establish guest shell exit; the product shell remains usable when the host stops its private VM. It retains private disk/firmware copies and the 120/15/10-second bounds; scanout colors are not an exact bitmap proof of text or caret position. Both immutable ad6da25e development/release compatibility probes pass under normal auto/KVM with the independently expected image version. A separately retained, accidentally forced TCG development attempt stalled before input. These results validate observer compatibility, not the newly repaired rootd dispatch or startup performance. Later matching aa690657 development/release canonical probes both pass, with byte-identical development reproducibility. Full replacement remote CI remains open, as do separately exposed interrupt and redirected-stdin failures. Earlier utility, console and strict-startup results below retain their original scope.

The retained complete Integration run 1537 reports 280 PASS / 206 FAIL across 486 scenarios. The follow-on verifier accepts only deviced's exact seeded RTC tuple: matching device/policy identity, discovered state, nonzero generation and zero PCI fields. Only that seed is excluded from PCI-report counts; other device identities and typed reply checks remain mandatory. The unchanged ACPI positive and post-mount malformed-HTree negative both pass on the exact RTC-fixed graph. This focused evidence does not close the entire failure set.

Launchd b84d5f0e fixes a debugger-proven manifest-read stack overwrite by borrowing the existing VFS reply view instead of returning its owned 32 KiB body. Its generated reader frame falls from 98,264 to 168 bytes, preserving the 64 KiB service stack, correlation, receipt cleanup and scratch erasure. Kernel aedef436 confines an SMP topology helper to its actual callers; five coherent strict target profiles and three original guest scenarios pass. Probed ba8553ad aligns an import with its callers and adds strict default Clippy to CI. These changes do not introduce warning allowances, broader authority or a measured speedup. Their replacement component CI runs are green; complete Integration acceptance remains a separate gate.

The original aa690657 scripted/physical batch passes eight of ten scenarios, including the formerly stack-corrupting script. The session-control failure then passes on the same preserved guest after the host uses its existing 100 ms input-group settle before each Delete/Left/K chord. QMP acceptance does not prove consumption from a bounded PS/2 queue. All 22 focused helper tests pass; the private guest retains exact three-control, shell-exit and authority-cleanup assertions, original 120/45-second bounds and unchanged source hashes. This separate correction does not close the interrupt failures.

Marker failures retain the last 80 lines within 16 KiB of serial output while preserving the original assertion result, match semantics and deadlines. Successful assertions stay quiet. An expected guest exit alone cannot replace missing or reordered final-output evidence.

The orderly-terminal repair retains the original lifecycle CALL until accepted output and an exact framebuffer FLUSH have completed, then revalidates its kernel-attested caller before replying. If no live delivered caller remains on the exact held receiver, ttyd affirmatively retires it and records its absence before slot reuse, without inferring successful delivery. Forced cancellation of a pending orderly session preserves only pre-admitted drain tickets/FLUSH and correlated prompt cancellation; completing them never sends an OK. Generic query or uncertain retirement errors still fail closed; serial completion retains its synchronous driver acknowledgement. This changes orderly completion semantics, not the wire opcode or authority inventory. Ttyd 59b0193e passes 242/246 strict host tests, including 21 new regressions, target builds and Rustdoc; replacement component CI 61 is green. Matching Integration b04d1576 passes all seven unchanged focused scenarios: five native-time cases (clockless, malformed, auxiliary, clock-positive with media checks, and unavailable), plus physical powerbox approval and denial. The original 120/45-second bounds, exact assertions and source revisions remain unchanged. Earlier output-order failures remain retained; these focused passes do not close separate interrupt/stdin failures, full Integration CI or the strict performance gate.

Named file utilities and separate copy authority

cat validates its operands before effects, acquires one exact READ lease per named file, and preserves operand order with inherited stdin at -. Empty files emit no bytes and succeed; -u and -- are supported without additional rights. cp acquires source READ and destination WRITE independently. Only authenticated destination absence selects a separate one-shot CREATE review, followed by a new WRITE review after creation and lease retirement. CREATE denial leaves no file; WRITE denial after creation leaves an empty file. Successful copying truncates through the held destination WRITE endpoint only after EOF, including an empty source; it does not promise metadata preservation or atomic rollback.

Integration's new b57d2eed utility oracle has 36 passing focused host checks and retains separate exact source/create/write consent. Matching 7f57bb8b development serial nvXIBw and release physical pFP0iI now both pass all 16 commands and 20 reviews under unchanged 120/15/10 limits, with source hashes unchanged. Their elapsed times are 102.568724 and 98.375396 seconds respectively; these establish functional utility acceptance, not an isolated speedup.

The first corrected c9a78901 images retain 0 PASS / 2 FAIL: development serial l9wqxM passes named cat and the three copy reviews but times out before copy completion; release physical iPnBdH hits the 15-second stall limit before the OS banner. Later release aRp5BF completes eight commands, including empty-copy readback, nonempty cat and CREATE denial, but command nine emits its WRITE-denial diagnostic without completing before the same deadline. That checkpoint stays 0 PASS / 2 FAIL, with all three failed attempts retained. The separate user VM's roughly 386% CPU load is observed contention, not proof of the sole cause. It also remained active during the accepted pair. Earlier console feature passes remain scoped to their tested images; the separate strict startup-performance gates remain open.

Interactive editors, console selection and reproducible images

Exsh keeps command history and insertion state in EXS21 caller-owned storage. Up/Down recalls completed logical commands or restores the saved draft; Left/Right moves the visible caret, Backspace removes the preceding byte and Delete removes the following byte. Fragmented CSI input and bounded wrapped redraw share the same physical/serial editor. History is neither persisted nor filled with canceled, incomplete or trusted-consent input. Oversize history entries are skipped without rejecting an otherwise valid command. Each accepted original byte is offered once before runtime planning can split the retained list or reorder asynchronous here-documents, so a reparsed suffix cannot replace the whole entered line.

Descriptor cleanup keeps its full fallback transport buffer in a separate, non-inlined call. Explicitly completed transactions still restore local metadata and check retained-provider uncertainty, but allocate no redundant transport scratch. Early-return cleanup retains exact provider retirement and scratch erasure. This prevents nested cleanup frames from overwriting the adjacent history arena; neither the fixed stack nor authority is enlarged.

Editing changes only the shell's own active, focused lifecycle-controlled PTY. Stdin's descriptive session identity is a compatibility filter, never control authority. Saved flags and geometry come from the own lifecycle, and exact mode restoration precedes foreground execution, traps, EOF and cleanup. Foreign inherited stdin keeps canonical fallback; uncertain restoration fails closed. Only ttyd's exact ordinary framebuffer route interprets bounded relative CSI, row erase and a reversible caret; root/log output remains literal and trusted chrome blocks ordinary rendering. Release bootloader initialization clears visible GOP pixels once before the initial handoff, after geometry/aperture preflight, so firmware graphics cannot overlap the first EriX banner. Padding and aperture tails remain untouched; genuine development trace continuity and later trusted/log history are preserved. This adds no shell clearing operation or runtime authority.

Explicit [features] Booleans tty_fbcon, tty_serial and tty_mirror select zero, one, or two initial shells independently of logging/provider inclusion. Two enabled paths mirror one PTY when requested; otherwise root creates separate generational console anchors, realms, shells and seat-local focus. Only authenticated root bootstrap establishes those bindings. Child realm data arrives through procd's private launch route and cannot create or select a peer binding. Disabled terminal routes are proved absent before startup and never polled. Dual startup retains exact cancellation controls only until both launches succeed, then retires all launch/control aliases before fair waiting. Successful product or exactly selected non-fixture interactive console completion omits only the terminal test-host success report. Bootstrap and host-report authority are still retired, and rootd exits normally; no-console services need no rootd spin.

features.rtc_cmos replaces the rejected private_provider table. Calibrated monotonic time measures bootstrap-CPU TSC elapsed nanoseconds, not query count; RTC-backed UTC remains a separate source. Canonical images mount ext4 / read-write, FAT /boot read-only, and ramfs /tmp read-write. Packaging selects explicit SOURCE_DATE_EPOCH or the selected Integration commit's committer timestamp and retains that choice in source-date-epoch.json; disk construction rejects missing metadata or a conflicting override instead of using a newer HEAD.

At Integration a02f5797, development serial and release physical runs pass the new 14-command directory probe and the ten-command editor probe. The editor now verifies complete wrapped text and the exact caret from retained pixels at both long-line phases and the final prompt. Release frames are visually clean after bootloader efebead8 clears firmware graphics once before handoff. The earlier ca6f1346 image-policy and editor text/CSI passes remain historical; their partial editor captures did not establish pixel acceptance. The no-console case passes separately at Integration 9dc9cf6b with rootd f075e4ae: after canonical READY and disabled physical/serial input attempts, the live VM stays without a shell for the full five-second quiet window. These functional observations do not close the separate tighter startup-performance gate. The separate serial-only console run then exposed per-semicolon-unit history recall; an af080f09 framebuffer-only follow-up showed that parser-only staging missed runtime-plan resegmentation. Exsh 2ad98e0c fixes that boundary and passes both 928-test matrices. Matching Integration 392b6c18 now passes the exact-pixel editor pair (DUc8Uh, nykmFL), both 12-command image-policy runs (ttyu5N, L44Re1), and seven-command framebuffer-only (AsBk8u) and serial-only (l7XJ9s) runs including whole-line history. No-console lsfF86 also passes. The independent-seat run W6NLEC remains a failure: its 160-capture budget ended after 15 commands at 83.2 seconds, before the first trusted review. Later Integration dd7ed015 passes both extended eleven-command single-seat runs: framebuffer piiK7I and serial FB38PU verify own approval/denial, choice-alone pending state and exact approved-object readback with denied-object absence. No-console r7gwRn also passes. Independent HWVuHp still fails overall at 160 captures: both decisions and wrong-seat checks complete, and approved-only readback succeeds at 82.358 seconds, but the final completion outputs are not observed. At that checkpoint the independent-seat gate remained open; partial success is not a pass.

Request-local storage optimizations keep authority and validation unchanged. Lib-block df03ec77 borrows only the exact header plus checked read-fragment bytes, so a 512-byte metadata read uses 592 bytes of IPC call capacity. E2fsd 3e564fc3 reuses the same invocation's checksum-validated raw inode for inline attribute validation, retaining fresh external-block and value-inode checks. Both e2fsd 249-test matrices pass; no snapshot survives a request and no matching-image speedup is claimed. Loaderd 67616387 additionally sizes graph and object storage from verified read lengths, eliminating only preliminary size-only queries. Live metadata, graph/object digests, the pinned executable root, disjoint arena tails and complete terminal erasure remain required. Both 73-test matrices pass. Loaderd b26f906d includes 75e32c0b's 32-byte limit for fixed dynlink status and commit reply bodies, preserving short supplied reply capacities, complete request chunks and variable-size plan replies. Its portable peer framing clears only the validated active request/reply envelope, never transmits unused backing tails, and retires all fitting unexpected receipts before typed rejection. Oversized replies are not truncated or installed; uncertain cleanup still fail-stops. It also reuses the digest of the same immutable executable-root snapshot for handoff. A private byte/digest pair is constructed only after the original full live SHA-256 comparison succeeds; every selected object is freshly read and checked before the per-invocation snapshot is published. There is no manifest-only shortcut, removed first verification, or cross-launch cache. Both 90-test matrices and strict checks pass. Integration ad6da25e pins both loader changes with kernel b54082bd unchanged. Separately named images are built and verified. Development serial YYG3LA passes all 16 utility commands and 20 trusted reviews in 53.095723 seconds; release physical 2ftR8b does so in 59.918327 seconds. Both wrappers exit zero with unchanged 120/15/10 bounds, fresh trusted-review identities, exact outputs/status/carets and source hashes. CREATE-denied absence, post-create WRITE-denied emptiness, nonempty copy, empty-source truncation and final shell reuse all remain proven. This closes the matching utility gate at 2 PASS / 0 FAIL, not the failing strict gate below. No other VM, compiler or manual build overlapped these sequential runs. Historical contended utility durations are not isolated comparison baselines. The exact Integration source is ad6da25e2ffb1aad8539cee2330867f4d10c982a, epoch 1788893085. Its separately named images under Integration out/appliance/ are:

• erix-startup-bounds-dev.img, SHA-256: 354c6db83572b66874fb2699e736cfe6b334f8bb215f85af9a7529f4232f8703.
• erix-startup-bounds-release.img, SHA-256: 08d8394079edadaa7f8e6bd6c0ce397fc81407cdd6ff8d31bf23b4408469736e.

These are the tested runtime identities; later documentation commits do not relabel or rebuild those images. All prior failures and protected images remain retained unchanged. Kernel 6d642d95 selects the lowest free page of a canonical managed extent of at most 64 pages with a request-local bitmap over live mappings. Exact frame identity, aliases, holes and errors are unchanged; other geometry retains the original search. Its 518/542-test matrices pass with one existing benchmark ignored in each. A dedicated allocator-domain hardware gate requires exact private mapping/frame/capability cleanup before its occupancy marker; that hardware scenario now passes with the cleanup marker preceding domain PASS and later service startup. The raw managed-frame.serial.log and wrapper managed-frame-vm.log are retained under Integration out/console-editor. Two isolated dd7ed015 observations show modest command gains against the adjacent preserved 392b6c18 control, without consistent startup improvement. The strict startup-performance gate remains open. The later uncontended continuation retains three complete, actual exit-one strict-gate failures across the immutable 776e3407 control and 7f57bb8b utility image. In root-to-READY / largest READY gap / READY-to-full-caret / four-command seconds, check.Ijhmow records 3.331945 / 0.860476 / 1.236359 / 2.455439; check.dq8Jql records 3.186823 / 0.847521 / 1.266006 / 3.118697; and check.oypESc records 3.227462 / 0.845896 / 1.213853 / 3.239898. Every run meets the first two limits and misses the latter two: 0 PASS / 3 FAIL measurements, not four failed thresholds per run. Complete observer evidence is not gate acceptance; the same conservative timestamp bounds and unrounded Enter-before-ACK command timing apply to both images. No overall speedup is established. The next isolated adjacent comparison retains 7f57bb8b control check.UKNhOl at 3.105823 / 0.817050 / 1.164035 / 3.239686 seconds, then ad6da25e runs check.2RwvLL at 3.074977 / 0.793675 / 1.138679 / 3.038390 and check.r7CgVn at 3.130488 / 0.820912 / 1.173104 / 3.079151. All three again meet the first two limits and miss the latter two, giving 0 PASS / 3 FAIL for this comparison and 0 PASS / 6 FAIL across both continuation batches. The two new command intervals are about 6.2% and 5.0% below the adjacent control, but boot and prompt times straddle it. This limited paired sample neither isolates the two loader changes from each other nor establishes overall startup improvement; the unchanged strict gate remains open. A separate local-PDE bitmap experiment was rejected before publication: fair opaque-call host measurements regressed common restore-heavy cases by roughly 36–40%, despite a roughly 6% shuffled-alias improvement. Its temporary scenario was withdrawn; the signed b54082bd kernel and existing oracles are unchanged. Exsh 700e41d6 separately bounds event/status polling to 128/112 borrowed bytes, including canonical replies and two-receipt audit space. Every fitting unexpected receipt is still retired; unused caller storage is untouched and untransmitted. Cadence, cursors, signal order and terminal cleanup are unchanged. Both 936-test matrices and strict component checks pass. Matching Integration 547f67b6 passes seven feature cases: development/release exact-pixel editors (ac1phW, 5gnhIj), twelve-command mount/time policy (YYfdGL, fcTWmN), eleven-command framebuffer/serial consent and history (qDehGv, XSIdlp), and no-console quiet (ykFHKv). Independent z2nO1F still fails overall at 160 captures and 77.623 seconds: nineteen commands complete, including both decisions, foreign-seat proofs and approved-only readback, but the injected final serial command is not observed completing. Two new-image isolated timing runs and the adjacent old-image control pass their functional observers, but do not establish a clear incremental command gain from polling-buffer reduction alone. Independent-console and strict startup acceptance remained open at that checkpoint.

Kernel 48cc425c subsequently combines the first exact-virtual-address lookup with canonical managed-frame occupancy in one live-record scan. Existing mapping and alias/rights rules still win first; any free-page selection error remains deferred until the original overlap and storage-reservation checks. Noncanonical and device paths retain their original selection order, with no persistent index, new authority or ABI. The 527/551-test matrices pass with one existing ignored benchmark each. Integration 776e3407 pins this checkpoint. Its real managed-frame cleanup scenario and seven feature cases pass: editors THyQKT/IwKZhM, mount/time policy 9xHiXd/1HyYuM, single-seat consent/history ZKIW4m/WHmRmZ, and no-console CcFtdf. Independent tEYC0g remains overall FAIL at 160 captures after nineteen complete commands; the twentieth is injected but not observed completing. The last frame is at 78.075 seconds. The final isolated timing pair and old-image control pass their functional observers without a uniform command gain. The corrected strict-startup probe nuGiUS fails all four thresholds: root-to-READY 6.195 seconds, READY-to-prompt 1.805 seconds, largest service gap 2.981 seconds and four commands 4.166 seconds, against limits of 5/1/1/2 seconds.

The final independent-seat run QgXj4d passes on the unchanged 776e3407 image with signed observer cf59e661: all twenty commands complete in 74.490576166 seconds using 144 of 160 captures. Both exact decisions, processed foreign-seat Enter proofs, approved-only readback at 68.312364 seconds and final completion echoes pass, with source hashes unchanged. The observer carries its existing 400-millisecond capture cadence from the verified edit across Enter into result observation; every predicate still requires a fresh frame, with unchanged 120/15/10-second limits and consent checks. This closes all eight feature probes, alongside the hardware proof and two new-image functional timing passes. It is an observer-efficiency correction, not evidence of faster guest execution. Earlier failures remain failures; both stricter performance gates stay open.

Directory commands and pinned working directories

cd is a regular shell builtin with -L, -P, --, HOME, OLDPWD, and CDPATH planning. Runtime changes retain the original navigation anchor and an independent current-directory handle; path strings are descriptive. Private provider component opens and raw pinned-symlink reads prevent namespace replacement from redirecting a walk. The shell commits its selected sender and PWD/OLDPWD together; failed resolution or environment preflight leaves the old context intact, and nested subshells restore it exactly. An output failure after a committed change does not undo that change. Later effects use the current handle, not a fixed initial directory or a reopened pathname. External command launch does not classify executable names or operands. The original selector reaches launchd's scoped executable and manifest checks; command identification uses a receipt-audited executable probe rather than an applet whitelist. Only authenticated manifest flags select optional fixed ABI routes. No launcher infers filesystem writes, clock needs or argument validity. Inherited launch implies neither cwd nor redirection-resolver authority; each requires its own immutable declaration. Executable probes use the exact fixed launch sender with SEND/GRANT, never the shell's own bound receiver. The latter only identifies a slot that descriptor allocation must exclude.

ls [-al] [--] [directory] parses options inside the running utility. Long rows request an additional explicit invocation metadata grant and use no-follow metadata beneath the held directory. The explicitly selected bootstrap ceiling admits this read-only request for interactive review; admission is not a grant and does not make metadata routine or imply generic metadata-write authority. Numeric owners and an explicit unknown for unavailable timestamps avoid extra lookup authority or invented values. -a includes hidden provider entries and ./.. exactly once, including empty directories. Long parent rows use a separate exact scoped metadata lease after retiring the current-directory lease; enumeration authority never permits parent traversal. Denied parent metadata fails without partial output. Metadata is not fabricated, and complete POSIX ls conformance is not claimed. A private native artifact check measured the final dispatcher frame at 1,048 bytes, down from the former 65,912-byte frame that overlapped retained listing data on a 64-KiB stack. This establishes the stack correction independently of runtime acceptance or startup-speed measurements.

Object-capable utilities receive a SEND-only job broker, not preinstalled operand grants or a broad filesystem resolver. Runtime requests intersect retained manifest, invocation, tty and script policy against the exact held cwd. Powerbox approval derives a revocable SEND alias and transfers it in the blocked caller's IPC reply. Release waits for revocation and provider cleanup; process death cancels pending review before any job route or scope can be reused. The staged foreign-CSpace installer remains Created-only. Runtime delivery therefore installs new authority into a live caller without retaining that broader installation capability. Read-only-root errors belong to mkdir and touch themselves (status 1), not exsh's executable-launch error (126). Matching development and release images at Integration d8e83d3d, exsh 061e452b and launchd 99095e7 pass all ten focused cases: two development runtime-error transports, native time and serial powerbox on both profiles, and all four physical/serial directory combinations. Exact utility errors, command identification, inherited stdio/EOF, consent, directory state and fresh prompts pass with unchanged 120/15/10-second bounds and source-image hashes. The original 090e7156 checkpoint remains recorded as two passes and two failures; correcting its ABI and probe-route bugs does not erase that evidence. This functional acceptance does not close the tighter startup-performance gate.

Earlier development and release images at Integration a1b985ea with exsh beb065f4 passed six focused checks: serial powerbox approval/denial on both profiles, plus native directory commands through physical and serial input on each. The first-attempt runs verify actual listings and metadata, separate grants and denial, successive cd/pwd/./ls commands, no input replay, exact banners and READY policy, and unchanged source-image hashes. Their unchanged 120/15/10-second total/stall/command bounds establish functional acceptance, not the separate tighter startup-performance targets, which remain pending.

Bootstrap and authority

The bootloader validates the signed image and hands the kernel a bounded, versioned structure. The kernel validates every range before starting rootd. rootd interprets BootConfig as policy data, retains its validated count-derived tables, launches the canonical encoded service order, transfers attenuated capability bundles, and revokes bootstrap-only authority.

The complete-service barrier precedes the version banner and initial shell in both image profiles. Development displays final READY and a blank line; release suppresses that development stamp. The light-gray banner contains the Integration tag or commit and another blank line before exsh starts.

The first semantic-bootstrap implementation slice makes that revocation a one-way Rust transition. Only validated handoff state can create the non-copy StartFoundation token; the phase starts exactly procd, memd, vspaced, and pagerd, then attempts every inherited RAM allocator and root TCB/CSpace/VSpace drop plus the consumed memd, vspaced, and pagerd primary-control source drops and the production process-control source drop before residual bootstrap. Unit tests prove all eight independent drop attempts, and a focused warning-free VM orders pagerd readiness before residual service, probe, and final readiness. The build-gated legacy DynlinkPreProcd fixture is the sole exception. Its authority-free plan returns the exact retained process-control source number beside the seven immediate drops; rootd accepts only the canonical slot and carries it through non-copy Core, Hardware, and MountRoot phase state. Rootd drops and proves it absent immediately after its final direct storage launch, before named resolution or runtime staging, and every earlier failure path attempts the same cleanup independently. Temporary-kernel child paging now follows a separate move-only lifecycle. Rootd receives one map-only child-VSpace alias in a role-derived scratch slot; procd and rootd use disjoint pagerd destination partitions, and the process ID never selects authority. Lazy paging is confined to the final 256-KiB stack tail. Temporary-kernel memd, vspaced, and pagerd instances receive fully backed stacks; every instance remains unregistered, so providers cannot fault recursively through their own service chain. All failure paths unregister pagerd before child teardown and retire rootd's local aliases with exact absence proof. Service-install final-use selection is now a shared descriptive capability ABI. lib-capabi owns a closed 31-entry map from root-held startup sources to their exact final consumer roles, including six deviced-final sources, one loaderd-final RTC route, and seven later deviced-consumer sources, and returns no inferred role for unknown slots. The map grants no transfer authority: rootd separately validates and performs each install, then applies its existing exact DROP and absence proof only to the matching source. The same catalog selects exhaustive source cleanup when an optional deviced consumer, including blockd, is absent. All 31 wholly Integration-only rootd adapter files enter through one guarded integration_adapters.rs include. This single crate-level boundary replaces 20 scattered crate-level cfg sites plus eight nested conditional include sites and excludes scenario policy and those adapters from release compiler inputs. The authority-free library retains policy, while every explicit endpoint and capability effect remains local to rootd. The thirtieth file is the Integration policy-import adapter. Production retains only a false compile-time initial-shell source-retention result in the semantic baseline. Canonical release images instead select a separately audited bounded product-shell hook: it retains launchd's source only across one authority-free interactive transaction, then proves that source absent. No Integration verifier, evidence effect, or scenario marker enters the product compiler inputs. The thirty-first file consolidates the legacy retained process-control exception's Foundation, Core, Hardware, failed-phase, and MountRoot effects. It is absent from production compiler inputs; production retains no exception state or authority. Every successful root-started child is retained in an exact-capacity, non-copy phase ledger until that phase commits. A later child, readiness action, or source-retirement failure cleans the current disposition, then earlier children in reverse order, before attempting every phase-source retirement. Each source in the fixed Foundation, Core, and Hardware phase-boundary catalogs is dropped and then queried through its exact local slot. A lost drop reply is accepted only when that query proves the source absent; an uncertain proof still cannot skip any later independent source. Terminal cleanup repeats the same drop-then-query contract rather than assuming that a previous phase attempt consumed the source. RetireAuthority extends the exact disposition to named-resolution sources, authenticated service sources, ordinary root clients, and private RTC routes. Its attenuated query alias remains live until every other queryable client is resolved, then retires directly through the synchronous local-capability syscall. MountRoot uses that shared exact disposition for the root VFS namespace, loaderd namespace, and procd loader-materialization sources. A lost DROP reply does not decide success: only a query proving the same local slot absent may advance the transition, while an uncertain proof still leaves every later independent source eligible for cleanup. The ext4-only one-shot RTC provider is a deviced-owned explicit driver. Rootd transfers only the exact CMOS, timed-provider, and RTC-loader route sources and proves each source absent. Deviced authenticates loaderd's fixed receipt pair, installs the narrow RTC child bundle, starts through its procd driver endpoint, waits for acknowledged sampling and clean exit, then retires every temporary alias before returning zero persistent process and endpoint identities. StartRuntime's complete failure funnel is now exposed to one deterministic exact-order regression over descriptive dispositions. Pending leases abort in reverse order, then started services, authenticated sources, and private RTC sources are cleaned without short-circuiting; the first cleanup failure remains authoritative. No endpoint, process identity, source, or cleanup observation crosses into Integration policy. RetireAuthority applies an equivalent whole-sequence regression to named-resolution, authenticated-service, private RTC, core, and hardware source retirement, the terminal status emission boundary, and final root-client retirement. Every later family still runs after failure and the first cleanup error remains authoritative. Exit separately proves that final-report failure cannot skip host-report endpoint retirement. This boundary remains wholly inside rootd and transfers no authority or cleanup observation to Integration. Every kernel-control receipt is now accepted only when syscall status, message-header result, typed response result, and operation agree. The final host-report response must also carry zero value fields. Malformed terminal evidence selects internal-error exit while endpoint retirement still runs; no receipt or report authority crosses into Integration. The next test-only boundary begins with an actually malformed handoff and proves the complete terminal retirement and Exit sequence. It also feeds a rejected delegated-driver receipt directly into reverse prior-child cleanup and phase-source retirement, retaining first-error precedence without adding production code or authority. Kernel-started procd uses only the explicit kernel lifecycle route; other children use rootd's authenticated procd route, and process identifiers remain descriptive. Cleanup failure takes precedence and uncertain lifecycle evidence fail-stops for complete kernel CSpace teardown. After a lost stop reply, rootd must validate the exact terminal process, role, and generation before consuming the matching event; malformed process evidence cannot consume an unrelated event. Endpoint cleanup always proves the local slot absent after the drop attempt, including when the drop reply is lost. These checks use only rootd's existing authenticated lifecycle and CSpace routes and delegate no observation or authority to Integration. A partially transferred launch is cleaned with the same rule: after aborting the exact staged generation, rootd independently drops and proves absence of every selected install grant, endpoint source, service endpoint, and optional published source. A source already retired at its final transfer is accepted only after the exact absence proof, and an uncertain proof cannot skip cleanup of the remaining slots. Delegated deviced rows have an exact zero process/endpoint shape and enter no root cleanup ledger. The four deviced child-only public endpoint sources use that same exhaustive final-use disposition immediately after their exact installs: every DROP is followed by an exact absence query, a lost reply is never accepted by itself, and one failed proof cannot skip any later independent source. The seven retained probed, hotplugd, seriald, inputd, and blockd consumer sources receive the same exact proof immediately after their last transfer. When an optional consumer is absent, registry sealing is followed by exhaustive disposition of every unused source rather than first-error short-circuiting. After deviced startup, rootd's sole optional device-management capability, SLOT_IRQ_CONTROL, is also dropped and exactly proven absent. A lost DROP reply alone cannot authorize continued bootstrap. Pager fault-delivery source retirement uses the same shared disposition after its final transfer. Lost DROP transport cannot skip exact absence proof; the injected product-validation seam is explicitly inventoried rather than exposed as Integration policy. Kernel and procd dynamic staging now share one ordered absence-proof boundary for the install grant, endpoint source, and service endpoint. The three slots are dispositioned before creation and again on staged-failure cleanup; later slots are never skipped after an earlier failure. The Integration-only legacy procd-spawn negative runner independently applies that closed three-slot rule before creation and after an exact staged-process abort. Rootd accepts a lost DROP response only after querying the exact slot, continues through later slots after a proof failure, and preserves abort-first cleanup precedence. The policy library receives only named effects and never a slot or capability observation. Signed Integration revision 69d08a5 now exposes each dynamic, install-grant, cleanup, and negative-spawn disposition only as exact retirement. Signed rootd revision 33f299d, pinned by Integration revision 789a740, validates the closed slot and couples DROP to same-slot absence proof inside that effect. Signed rootd revision 16d4dcb, pinned by signed Integration revision e90b985, closes the semantic-phase failure ledger. Its schema-2 contract binds all eight phases to twelve real Rust unit tests and exactly the six failure classes for malformed handoff, rejected delegation, lost reply, partial transfer, child-start failure, and cleanup failure. The audit rejects missing coverage, invented classes, path escape, and stale test anchors while preserving strict contraction and an authority-empty Exit result. Signed rootd revision 62f8f55, pinned by signed Integration revision a6d4d6f, closes service-effect ownership. Operation-ownership schema 3 binds all seven families to their exact release groups or an operation-free capability-transfer boundary. Time and terminal policy admit no rootd service operation; image work admits only loaderd preparation plus graph-declared dynlinkd route transfer. The audit and exact 14/0/14/0 Integration ledger prove that rootd retains generic sequencing and fail-closed transport, not functional verifiers or provider-policy fallbacks. Signed rootd revision ac02455, pinned by signed Integration revision c793d16, makes the production-boundary artifact exact under target reuse. The checker emits one unique object for its current compiler invocation, scans only that object, and retires it on exit; a behavioral regression proves that a pre-existing rootd object can neither contaminate nor satisfy the audit. Signed Integration revision 4852e88 defines one exact four-scenario phase5-semantic-bootstrap VM group for the then-deferred runtime evidence. Its CI contract locks inserted-foundation rejection, foundation and core authority retirement, and procd-managed cleanup; the inserted-foundation negative now also forbids kernel panic and fatal-exception fallback. Signed Integration revision 1838b7b passes all four within complete-catalog run 1468. Post-start kernel-service cleanup now follows kill, terminal wait, and process destruction by dropping and exactly querying the root-local service endpoint. A lost DROP response is accepted only after the query proves absence, and an earlier lifecycle failure cannot skip the endpoint disposition. Filesystem request-source replacement now validates the old canonical endpoint, drops it, and proves the exact slot absent before copying its attenuated SEND|GRANT successor. Residual or uncertain old authority blocks the copy; a lost DROP response proceeds only after exact absence proof. Root-direct BootConfig staging now retires its temporary process-endpoint source and install grant as one ordered exact set after final transfer. Every DROP receives an absence query, and a failed proof for the first receipt cannot skip disposition of the second; uncertain results enter exact unstarted-child cleanup with both receipts still selected. Loaderd filesystem staging applies the same rule to its root-local install-grant and staged-process endpoint receipts. Both receipts are proven absent after successful installation and during loader preparation cleanup; neither receipt or its disposition enters Integration policy. Cleanup may use rootd's broad procd abort route only when loaderd's success reply matches the IPC header result and the exact request, transaction, role, child endpoint, receipt sources, and runtime-graph digest. A correlated service failure carries no process identity. Malformed or substituted correlation retires both fixed root-local receipts and fail-stops without using the reply's process fields, so descriptive data cannot redirect process-control authority. Transport failure and an invalid preparation envelope are committed-unknown: loaderd may already have staged a child, but rootd has no authenticated abort identity. Rootd attempts exhaustive disposition of both fixed receipts and then fail-stops regardless of cleanup outcome. Only a correlated explicit loader failure is a recoverable no-child result. Direct procd dynamic creation uses the same committed-completion discipline. Rootd binds the IPC header result to the response body and exact request, operation, child endpoint, process identifier, and staged generation before it may use that identity. Transport, decode, or correlation uncertainty triggers all three fixed local-slot dispositions followed by fail-stop. An exact non-success returns only after exact absence proof. If an exact success carries invalid receipts or installed aliases, rootd aborts that authenticated staged generation, retires the same three slots, and fail-stops on cleanup uncertainty. Every procd staged-abort path now shares one bounded idempotent completion rule. Exact correlated OK proves retirement and exact correlated NOT_FOUND proves prior absence. Any other result or transport/decode uncertainty retries the identical abort once; a second uncertain completion fail-stops rather than returning while delegated staged-process authority may remain. Every staged dynamic-object MAP, APPLY_RELOCATION, and SEAL reply is likewise accepted only when its IPC-header and typed results agree and its request, operation, process, staged generation, and object selector match the outstanding mutation exactly. A mismatch enters the same authenticated- generation abort cleanup; it never supplies a replacement cleanup identity. Named registry SEED, SEAL, and publication ACTIVATE replies also require equal IPC-header and typed results in addition to exact request and operation correlation. Because activation transfers explicit publication authority, conflicting evidence fails inside the retained phase service/source cleanup boundary instead of advancing named state. Terminal serial readiness accepts a completed byte count only when both the IPC-header and typed response report OK. Transient status in either layer may still select the existing retry path; a denied header paired with a forged successful body cannot advance the terminal visibility barrier. Serial and direct framebuffer completion additionally require that byte count to equal the exact requested length; partial and over-reported writes cannot advance readiness. The authority-free Integration verifier applies the same predicate, so host evidence cannot certify a completion rejected by rootd. Logd applies the exact nonempty predicate to seriald and fbcond mirroring and preserves its canonical replay obligation on contradictory completion evidence. After framebuffer handoff, one ordinary pending fbcond record is eligible in the bounded maintenance turn following a completed producer reply; replay does not wait for shell exit. Terminal readiness now precedes every initial-shell launch. The producer reply and cooperative yield still precede the sink call. The authority-free encrypted/casefold and ext-rename VFS proofs bind fixed reads to exact length and next-offset evidence. They close opened file or directory handles after completed and failed reads, with cleanup failure taking precedence over the earlier evidence or transport disposition. Final Integration verifier timing is one total mapping from the authenticated scenario profile. Module-backed proofs execute before boot-module retirement, the storage-services proof executes after runtime startup, and the earlier hardware/console proof is not repeated. Rootd retains every module, endpoint, process, and cleanup disposition; the authority-free library returns only the descriptive timing. The readiness path retains no dormant alternate topology. Pre-logd stage facts remain uniquely queued, while direct framebuffer fallback performs one exact terminal READY write. The constant-false framebuffer-deferral and runtime-serial-only branches, their unused stage buffer, and duplicate tests are deleted from rootd. Both sides of MountRoot now use that same readiness dispatcher. A descriptive phase bit preserves the earlier trace and failure-fixture distinctions without carrying authority; the duplicate post-mount routing implementation is gone. The permanently disabled eager framebuffer-cursor transport is also deleted. Deferred Integration verification continues from cursor zero, while rootd retains only the live framebuffer effect adapter. The measured rootd surface is 15,724 lines and the checked Integration ledger is 254/241/13/0. Signed Integration revision 1ce8251 next owns the authority-free readiness disposition: whether evidence is emitted, its kernel/logd route, serial echo ordering, and failure fatality. Signed rootd revision 6ff326c, pinned by Integration revision 81cc0b6, consumes that value mechanically while keeping the closed seriald/fbcond product policy and every queue, request identity, retry, endpoint, buffer, and capability effect local. The measured production surface falls to 15,578 lines and the exact ledger to 253/240/13/0; the 4,616-byte image, eight unsafe blocks, and authority inventory are unchanged. Signed rootd revision 3f9cfcf, pinned by signed Integration revision ebea6b0, then deletes the obsolete rootd-only driver-readiness test catalog. Integration scenario manifests remain the authoritative positive and negative marker contracts. The change removes 296 rootd Rust source lines, including one otherwise empty production include, and lowers the reviewed production surface to 15,577 lines. The ledger, image, unsafe count, runtime behavior, and authority remain unchanged. Signed Integration revision 43758ed next makes the exact observable ERIX_ROOTD:TRACE:VFS:* strings library-owned. Signed rootd revision 554b471, pinned by signed Integration revision fcce68f, deletes the unconsumed pre-mount READY_APPEND_CURRENT_* trace branches and the local DBG-to-TRACE rewrite. Rootd retains only explicit kernel-log and hexadecimal effects. The reviewed production surface falls to 15,500 lines; the checked ledger is 255/242/13/0, while the 4,616-byte image, eight unsafe blocks, runtime behavior, and authority inventory remain unchanged. Signed Integration policy revision 958a0c5, signed rootd revision 3adb9b3, and signed Integration pin revision 73ef1e7 then move exact TRACE, READYTRACE, and DBG namespace classification behind the authority-free library boundary. Rootd keeps only enable state and logging effects. Production falls to 15,479 lines and the checked ledger is 256/243/13/0; image, unsafe, runtime, and authority measures remain unchanged. Signed lib-capabi revision d2cacd8 next couples fixed-width publication names to the same closed pagerd/timed/irqd target set that owns named authority. Signed Integration revision 35b992f deletes its wider scenario catalog; signed rootd revision bd57279, pinned by signed Integration revision 2beeadd, consumes the canonical mapping while retaining seed, seal, response, and endpoint effects. Production falls to 15,441 lines and the checked ledger to 253/240/13/0; image, unsafe, runtime, and authority remain unchanged. Signed rootd revision 7aed97d, pinned by signed Integration revision 2beeadd, next removes validation-profile overrides from named publication and deviced registry seeding. Signed BootConfig flags, canonical target scopes, and driver-policy rows are the only selectors. Production falls to 15,435 lines and the checked ledger to 250/237/13/0; all other measures remain unchanged. Signed Integration policy revision a4530aa, signed rootd revision d930064, and signed pin revision 054ceef apply the same boundary to PCI discovery. Every runtime profile with a signed delegated-driver row performs exactly one product-owned discovery before endpoint readiness. Integration receives only the correlated descriptive receipt and cannot suppress or repeat that call. The production and surface-ledger measures remain unchanged. Signed Integration policy revision 6708d1b, signed rootd revision 3c5c0eb, and signed pin revision 79376b2 move the complete ordered timer-only or timer-plus-serial IRQ fixture plan out of rootd. Rootd retains every IRQD endpoint and exact seed/unmask effect. Its reviewed surface falls to 15,413 lines and the checked ledger to 249/236/13/0; the 4,616-byte image, eight unsafe blocks, authority, and syscall inventories remain unchanged. Signed Integration revisions 04f4219 and c972697, signed rootd revision a7d0eb7, and signed pin revision 72fb7d5 complete that plan with fixture admission and bounded per-row request correlations. Rootd removes its remaining three fixture request constants while retaining every call and reply check. The reviewed surface is 15,412 lines and the exact ledger is 246/233/13/0; binary, unsafe, authority, and syscall measures remain unchanged. Signed Integration policy revision 2f9c639, signed rootd revision aec42c2, and signed pin revision c652e24 move the exact descriptive full and legacy StartFoundation retirement slices out of rootd. Rootd receives only slot numbers and retains every capability DROP, absence proof, and failure disposition. The reviewed surface is 15,411 lines and the reconciled ledger is 247/234/13/0; the 4,616-byte image, eight unsafe blocks, authority, and syscall inventories remain unchanged. Signed Integration revision 64b8ecf, signed rootd revision b00d3e3, and signed pin revision 373aa84 next move the exact typed loader discovery and launch requests, including the deliberately malformed discovery body, into the authority-free orchestration library. Loader endpoints remain separate inputs; rootd alone encodes and sends the planned values, authenticates replies, and performs procd and logging effects. The rootd adapter surface falls by 110 source lines to 249 lines and passes 313 default and 312 all-feature tests; the library passes 250 and 251. The 247/234/13/0 ledger and every production measure remain unchanged. Signed rootd revision 211247b and signed Integration pin revision 2c88559 then delete the unconsumed target-only hardware debug, numeric, and lifecycle-marker mirrors. Rootd's probe, hotplug, ACPI, and driver adapters no longer receive a kernel-log endpoint; all authenticated service effects and evidence checks remain intact. The cleanup removes 102 Rust lines and reconciles the ledger to 245/232/13/0 without changing any production measure. Signed Integration revision a5508d9, signed rootd revision 8ada277, and signed pin revision 40cd05c next move the complete final-execution match into an authority-free fixed-capacity action plan. Rootd iterates complete helper/extension contracts and bounded correlation ranges while retaining all authenticated effects; after module retirement it admits only the planned storage action. Rootd removes 41 Rust lines and the ledger becomes 246/233/13/0, with the 15,411-line, 4,616-byte, eight-unsafe production baseline unchanged. Signed Integration revision 558aba1, signed rootd revision de54855, and signed pin revision d4ac71e then move the complete per-profile host launch order into a bounded authority-free role/stage plan. No endpoint, capability, module view, or process handle crosses that boundary: rootd still validates each stage against signed BootConfig and performs every launch. Deleting the 779-line rootd catalog removes 811 net rootd Rust lines. Rootd passes 313 default and 312 all-feature tests, the library passes 256 and 257, the ledger remains 246/233/13/0, and all production measures remain unchanged. Signed Integration revision e850a65, signed rootd revision e9e1d1a, and signed pin revision 84e773f then make the legacy retained process-control source explicit and retire it at its exact final use. The library returns only an optional descriptive slot number. Rootd validates the canonical slot, transports it in move-only phase tokens, and owns every DROP, exact absence proof, retry state, failure disposition, and success gate. A lost DROP reply advances only after exact absence proof, while failed proof prevents entry to named resolution or runtime. Rootd passes 318 default and 317 all-feature tests at 15,402 production lines, 4,616 bytes, and eight unsafe blocks; the library passes 256 and 257. The audited surface is 268/255/13/0. Signed lib-capabi revision d41f0c9, signed rootd revision e95326b, and signed Integration pin revision ce08526 complete the closed 30-entry shared map for the prior final-use masks plus all eleven deviced-created sources. Rootd retains route validation, exact installation, DROP, and exact absence-proof effects and uses the same catalog for absent optional consumers, including blockd. It passes 317/316 tests at a reduced 15,280-line production baseline; the 4,616-byte image, eight unsafe blocks, and syscall, decoder, stage, authority, and 268/255/13/0 surface inventories remain unchanged. Signed rootd revision c93b402 and signed Integration pin revision 4709f9f then consolidate the 21 wholly Integration-only effect-adapter files behind one guarded include. The exact surface contracts to 248/235/13/0 and scenario_policy.rs leaves the release compiler inputs. Rootd retains 317/316 tests; its reviewed baseline falls one non-effectful line to 15,279 while the image and every authority-relevant inventory remain unchanged. Signed rootd follow-up f6785f3 and signed Integration pin revision 0861990 fold eight nested hardware, console, dynamic-launch, monitoring, negative-spawn, and VFS-marker adapters into the same boundary. All 29 wholly Integration-only adapter files now share one admission point, the ledger contracts to 240/227/13/0, and the reviewed release baseline falls to 15,269 lines without changing the image or any authority measure. Signed rootd follow-up 2d26e5c and signed Integration pin revision 2e4fbd1 move integration_policy.rs behind the same gate as the thirtieth file. Four superseded file-local cfg rows become two explicit compile-time mode-adapter rows, contracting the ledger to 238/225/13/0. Production fixes the descriptive retention result to false, the reviewed baseline falls to 15,268 lines, and no image or authority measure changes. Signed rootd follow-up b19b348 and signed Integration pin revision d9c52e0 then consolidate the legacy retained process-control exception behind the same gate as the thirty-first wholly Integration-only adapter file. Eight superseded cfg rows leave the exhaustive ledger at 230/217/13/0. The adapter is absent from production compiler inputs, production retains no exception state or authority, and the 15,268-line baseline and every measured authority value remain unchanged. Signed lib-bootstrap revision b1dbeaf next centralizes the exact 29-role signed boot-store executable-name mapping. Signed rootd revision a6e531c, pinned by signed Integration revision 95a15b2, consumes it after the Integration-only extension overlay and rejects post-mount and unassigned extension roles. Selector bytes remain descriptive and grant no module, mapping, process, or capability authority. The ledger stays 230/217/13/0 and rootd's reviewed release baseline falls to 15,237 lines; its 4,616-byte image and all authority measures remain unchanged. Signed lib-bootstrap revision 5da8002 next centralizes six disjoint ordered Phase 5 service catalogs covering exactly 33 bootstrap roles. Signed rootd revision d92d41b, pinned by signed Integration revision 1ef54ce, aliases its Foundation, Core, Hardware, MountRoot storage, and StartRuntime ext4 arrays to that shared contract while retaining every effect. The ledger remains 230/217/13/0 and rootd's reviewed baseline falls to 15,203 lines; its image and authority measures remain unchanged. Signed rootd revision f6fb701, pinned by signed Integration revision f1882be, next centralizes every rootd-owned asynchronous DROP-plus-local- absence disposition. Exhaustive tests bind all 30 final-use rows to their exact consumer, require proof after a lost reply, reject uncertain proof, and exclude non-final consumers. The redundant private-RTC query is removed while the 15,203-line, 4,616-byte, 230/217/13/0, and authority baselines remain fixed. Signed lib-bootstrap revision c5256a2 then centralizes the exact 22-entry Foundation, Core, and Hardware role/readiness/launch-owner contract. Signed rootd revision c158bb7, pinned by signed Integration revision e152e0e, consumes those descriptive rows without moving an authenticated effect. The surface contracts mechanically to 228/215/13/0 and rootd's reviewed baseline falls to 15,170 lines; its 4,616-byte image, eight unsafe blocks, and authority inventories remain unchanged. Signed lib-bootstrap revision 81917f9 completes that launch contract with the five MountRoot and six StartRuntime rows plus exact row matching. Signed rootd revision 59558ea, pinned by signed Integration revision a4493aa, now validates all 33 role/readiness/launch-owner rows before effects and removes its late local suffix-stage and storage-owner policy. The surface remains 228/215/13/0; rootd passes 321/320 tests at a reviewed 15,176 lines while its 4,616-byte image, eight unsafe blocks, and authority inventories stay fixed. Signed lib-bootstrap revisions 2b4824a and a1011d6 centralize exact product seriald/fbcond marker selection, borrowed-text membership, and readiness disposition. Signed Integration revision c030316 extends the same authority-free type and exhaustively preserves every product combination; signed rootd revisions bf722de and 43ada27, pinned through Integration revision 632771a, remove its duplicate representation, four cfg sites, and release-filter literals while retaining every readiness effect. The surface falls to 222/211/11/0 and rootd's reviewed baseline to 15,147 lines with every other measure fixed. Signed rootd revision 3c22778, pinned by signed Integration revision 16e89a1, then centralizes the descriptive Integration-smoke build fact in one mode helper. Product builds receive a compile-time false result and Integration builds consult authenticated scenario policy. Entry, logging, and readiness policy lose three duplicated positive/complement cfg pairs; the surface contracts to 218/207/11/0 and rootd's reviewed baseline to 15,141 lines, with its 4,616-byte image, eight unsafe blocks, and authority measures unchanged. Signed rootd revision b51c0d4, pinned by signed Integration revision 8e6a0c4, next moves hardware-console runtime-mode and framebuffer-cursor state, readiness observation, and verifier invocation into one typed context inside the existing Integration-only adapter boundary. Release-active bootstrap and hardware-phase code retain one opaque guarded crossing; product compilation admits no context type or Integration effect. The exact surface contracts to 215/204/11/0 while the 15,141-line, 4,616-byte, eight-unsafe-block, and authority baselines remain fixed. Signed rootd revision a9fbd8f, pinned by signed Integration revision d4f6c87, then consolidates build-specific bootstrap policy behind two complementary compile boundaries. The Integration adapter owns mode facts, module/profile projection, endpoint requirements, and terminal override; one product adapter owns Foundation, Core, and Hardware retirement implementations. Semantic phases call uniform methods without scattered positive/complement branches. The exact surface contracts to 197/186/11/0 and the reviewed production baseline to 15,139 lines, while the 4,616-byte image, eight unsafe blocks, and authority measures remain fixed. Signed rootd revision 8aa37ab, pinned by signed Integration revision ebd3b30, then moves Integration-only module-name recognition out of common handoff discovery and into the same build-gated adapter. The adapter owns ten exact fixture names, two aliases, type/required-flag validation, duplicate rejection, and descriptor-free presence projection; product rootd recognizes none of those names and stores no fixture state. Seven distinctive literals are forbidden in the release object, the exact surface contracts to 196/185/11/0, and the reviewed baseline falls to 15,097 lines without changing the image or authority measures. Signed rootd revision 00c8d04, pinned by signed Integration revision 2bab9fe, then moves the remaining product mode, constant, module, endpoint, and host launch counterparts into the product adapter and keeps the complementary aliases and ordering in the Integration adapter. Common handoff, required-module, and type modules contain no Integration feature branch, mode.rs is deleted, and product descriptive presence is zero-sized. A source gate rejects restoration. Thirteen classified cfg sites disappear, contracting the exact surface to 183/172/11/0 and the reviewed baseline to 15,095 lines; runtime effects and authority remain fixed. Signed rootd revision c903739, pinned by signed Integration revision d453bff, next moves validation-profile decoding, host profile encoding, target terminal override selection, and the last Integration-only pre-module failure code behind the same adapters. Product accepts only the signed runtime profile and returns its cleanup token unchanged; Integration owns its closed descriptive mappings. The source gate covers all seven cleaned common modules. Six stale cfg rows disappear, contracting the exact surface to 177/166/11/0 and the reviewed baseline to 15,082 lines without changing runtime effects or authority. Signed rootd revision 9e628bf, pinned by signed Integration revision ce303c8, then moves release-message admission, boot-log suppression, stage-marker lookup, ready-stamp disposition, and final-route choice behind the same complementary adapters. Common logging and ready-stamp code retains every explicit endpoint-bearing transport but chooses no product-versus-scenario policy. The source gate preserves that separation. Eight stale cfg rows disappear, contracting the exact surface to 169/158/11/0 and the reviewed baseline to 15,061 lines without changing runtime effects or authority. Signed rootd revision a80ac51, pinned by signed Integration revision 4bdb1fb, next moves the remaining Integration live-marker, routed-evidence, marker-flag, and debug/trace logging effects into a dedicated 103-line adapter. Every endpoint and request identifier remains explicit, while the shared request-ID hash used by product terminal status carries no build branch. Common logging is Integration feature-free and source-gated. Eight stale cfg rows disappear, contracting the exact surface to 161/150/11/0 and the compiler-qualified product baseline to 15,006 lines without changing runtime effects or authority. Signed rootd revision db4fef8, pinned by signed Integration revision 9263617, then moves console reads, discovery-history reads, ACPI/hotplug discovery, and driver lifecycle effects into the existing explicit Integration adapters. Product writes, canonical probe discovery, and device reads remain with their semantic owners. Four common files are Integration feature-free and source-gated, and every moved effect retains explicit endpoint and request identity. Ten stale cfg rows disappear, contracting the exact surface to 151/140/11/0, the compiler-qualified product baseline to 14,736 lines, and accepted external typed messages from 39 to 29 without changing runtime effects or authority. Signed rootd revision f54da1a, pinned by signed Integration revision 16d6cb9, next removes redundant nested Integration feature gates from the initial-shell, physical-input, and loader-verification adapters already admitted only by integration_adapters.rs. Target/host selection, explicit endpoint inputs, and fail-closed host behavior remain unchanged. Eight stale cfg rows disappear, contracting the exact surface to 143/132/11/0 while the 14,736-line product baseline, 29 accepted typed messages, image size, runtime effects, and authority remain fixed. Signed rootd revision fab1395, pinned by signed Integration revision 50acc10, then moves IRQ fixture seed, seal, and mask effects into a dedicated 203-line Integration adapter behind the same boundary. The 183-line common hardware-seed module retains product named/deviced registry behavior and is feature-free and source-gated. Nine stale cfg rows disappear, yielding 134/123/11/0, a 14,577-line product baseline, and 26 rather than 29 accepted typed messages; image, runtime-effect, and authority measures remain fixed. Signed rootd revision ead5b85, pinned by signed Integration revision 9fe381a, next isolates Integration-specific process-completion retry, terminal-state, and host-fixture policy in a 70-line adapter. The 156-line feature-free common procd host module retains the shared WAIT transport required by product cleanup and explicit dynamic effects. Two stale cfg rows disappear, yielding 132/121/11/0 and a 14,517-line product baseline while accepted messages, runtime effects, and authority remain fixed. Signed rootd revision b26e576, pinned by signed Integration revision 5fab113, then moves the target-only hexadecimal formatter and kernel boot-log effect for VFS evidence into the 148-line Integration logging adapter. Product capability operations remain in the 737-line feature-free common kernel-control IPC module. One stale cfg row disappears, yielding 131/120/11/0 and a 14,478-line product baseline while accepted messages, runtime effects, and authority remain fixed. Signed rootd revision cb78a72, pinned by signed Integration revision b655551, next moves forced service-start failure selection into the Integration adapter's authority-free postcheck. Common procd transport retains the explicit endpoint, authenticated request, correlated reply, role/status validation, and host fixture behavior, and is feature-free and source-gated. One stale cfg row disappears, yielding 130/119/11/0; the explicit product seam raises the reviewed baseline to 14,481 lines while the 4,616-byte image, 26 accepted messages, eight unsafe blocks, runtime effects, and authority remain fixed. Signed rootd revision 2d27e87, pinned by signed Integration revision c065450, then moves post-start cleanup evidence into the 155-line Integration logging adapter. The 986-line feature-free, source-gated common cleanup module retains process kill, terminal wait, destruction, endpoint retirement, and fail-stop cleanup. Product builds compile a capability-free no-op disposition; Integration builds preserve the explicit kernel-log endpoint, marker, and best-effort behavior. One stale cfg row disappears, yielding 129/118/11/0 and a 14,480-line product baseline while image, accepted messages, unsafe blocks, runtime effects, and authority remain fixed. Signed rootd revision 398987b, pinned by signed Integration revision 1f8d37c, next replaces the common foundation, core, and hardware tokens' three conditional retained-process fields with a build-selected phase state. Product state is zero-sized; only rootd's Integration adapter owns and exactly disposes the retained pre-procd process source, and no endpoint or capability enters the authority-free orchestration library. Foundation and core token definitions are feature-free and source-gated; hardware retains unrelated scenario-validation branches. Three stale cfg rows disappear, yielding 126/115/11/0 and a 14,481-line product source baseline while the 4,616-byte image, 26 accepted messages, eight unsafe blocks, ten dependencies, five syscalls, runtime effects, and authority inventory remain fixed. If a procd START reply is lost, boot-module and ext4 launch paths use the same exact process query. Only authenticated STAGED state selects abort and only authenticated RUNNING state continues startup; a substituted operation, role, process, generation, event, restart policy, or terminal state fail-stops. Started ext4 cleanup also drops and proves its optional published source absent after a lost drop reply. Integration receives neither lifecycle observation nor cleanup authority from these product-owned checks. The build-gated legacy pre-procd fixture plus later logging and device clients still need to move behind their semantic owners before the complete phase boundary can close.

The next consuming transition accepts only the canonical signed named -> logd -> crashd -> timed -> irqd -> deviced -> probed -> hotplugd prefix. Production requires all eight roles; a non-production validation profile may select only a leading prefix, never an interleaved hardware role or later reuse of a core role or readiness stage. After that prefix, rootd retains one separate send-only query client and exhaustively retires the inherited time, IRQ, hotplug, platform-discovery, and transferable query sources. The kernel-log source remains live only for runtime cleanup's synchronous final terminal report, after which common retirement proves it absent. This exact use prevents teardown from stranding a queued terminal marker without adding an operation or authority family. Logging verification likewise keeps rootd's fixed authenticated submit route disjoint from the generic query route, so read authority cannot be reused to append a record.

StartHardware is the third consuming transition. It accepts only the canonical hardware-role segment, sequences each retained driver and service through its authenticated owner route, and consumes its private transition authority before producing post-hardware state. MountRoot and StartRuntime consume the signed storage and ext4 launch lineages. RetireAuthority is constructed only after exhaustive root-client cleanup; Exit attempts one final typed report, retires that report endpoint, and calls process_exit. The kernel then retires rootd's receiver and clears the complete root CSpace. All eight semantic phases are implemented. The legacy pre-procd fixture and later logging/device clients remain explicit routing-deletion work rather than exceptions to that target.

The same phase-local ownership applies to StartCore and StartHardware. Core failure after logd startup retires the phase's children and marks the logd route unavailable to terminal reporting. Hardware failure cleans only root-started mediation processes; delegated driver-policy rows remain owned by deviced and cannot be reinterpreted as root process dispositions.

Failure before a staged service receives its startup envelope aborts that exact generation and independently retires its install grant, endpoint source, and service endpoint. A failed abort cannot skip another capability drop. A focused negative VM separately starts logd, forces its startup rejection, and requires correlated procd cleanup before rootd reports terminal service failure.

Names, IDs, slot numbers, BootConfig declarations, catalog rows, and filesystem records do not grant authority. Runtime code must validate the actual local capability type, identity, rights, and grant rights before use.

Independent cleanup operations all run after partial failure. If revocation cannot be confirmed, cleanup failure takes precedence and the affected bootstrap or service path fails closed.

Service replies are authority-free unless their operation explicitly transfers authority. Successful staged process creation returns exactly the request-selected child endpoint and install grant, and deviced READ_DRIVER returns at most its predetermined send-only driver endpoint. Callers verify kernel-normalized receipts and the installed aliases; malformed metadata or uncertain cleanup terminates the caller for complete kernel CSpace teardown.

Endpoint receive state also follows live authority. Process exit, kill, or removal of a recorded receiver's final live RECV binding wakes generation-matched queued callers with NOT_FOUND, erases queued/reply state, and leaves surviving send aliases non-callable until an explicitly bound live replacement owns receive authority.

Dynamic executables

The bootloader is the only static executable exception. Other packaged executables may be signed ELF64 x86_64 ET_DYN objects in the dynamic-link store. Catalog and filesystem mirror data prove identity and locate bytes; they do not grant lookup, loader, storage, or service authority.

lib-dynlink uses caller-provided graph and plan storage. Callers derive capacity from validated input structure instead of enforcing independent global limits. loaderd selects a root from an authenticated runtime graph and streams the complete reachable closure to dynlinkd; the service returns authoritative relocation writes without filesystem or process authority. Packaging derives both private workspaces from the authorized closures. Obsolete one-object messages, caller-reported telemetry, fixed whole-table arrays, and compatibility padding are not retained.

Native loading uses the shared 32-KiB inline transport for verified source fragments and relocation batches. Each launch retains an immutable authenticated object cache only for its current graph; cached bytes confer no filesystem or process authority and are erased when the transaction ends. Procd allocates fresh frame extents of at most 64 pages within the current exact segment, falls back to smaller extents under fragmentation, and preserves page-level W^X sealing and final-use capability retirement. Adjacent relocation writes coalesce into at most one 4-KiB population range without changing plan order. Final RW pages reuse their identical initial checked map: the unstarted child and open frame remain transaction-private until commit. RO/RX transitions, permission validation, counters, frame retirement, and failure cleanup remain unchanged; this is not a broader permission or lifetime exception.

Kernel activation separately updates ordinary physical mappings, anonymous aliases, and original-entry restores in batches of at most 64 pages. Independent groups prepare all leaves before writing them under existing VSpace and page-table ownership, with local interrupts masked until invalidation and unlock complete. Each group's local CR3 reload covers non-global entries, while old or new global leaves each receive explicit invalidation. This retains exact recorded mapping authority without extending backing lifetime or adding remote shootdown. Duplicate targets or alias backing rewritten by an earlier target split a group; completed writes are flushed before dependent backing translation, preserving sequential mapping semantics. Range validation and copying use operation-local last-index hints, revalidating the current page, mapping kind, and rights on every lookup under the existing VSpace lock. Source and destination hints are separate, retain no authority, and preserve full-range preflight before destination writes. Permission-only transitions resolve page-table spans for two whole-range passes under one lock, preserving structural preflight and sparse-leaf policy. Mapping batches may borrow one prepared target-table hint only until their independent group flushes; no leaf, backing translation, or rights decision is cached across dependency groups. An independent group may also retain one non-huge backing-table structure hint, but reads the leaf's live PRESENT bit and physical address on every use. Large-leaf translations are fresh and never cached. The immutable batch is validated once before locked preparation; every group still prepares all leaves and clears both structure hints on success or error. For strictly ascending targets, contiguous prefixes use interval membership; after a gap, exact binary search checks the actual earlier targets rather than treating a missing page as a dependency. Duplicate/decreasing targets keep the whole-prefix exact hash fallback. An earlier dependency ends its group before any later descent. Activation/restoration select separate live-record loops once; no mapping plan or authority is cached. Group boundaries, permission barriers and success/error flushing remain identical. These kernel 7fdefd83 source refinements do not by themselves establish guest latency acceptance. Inlining hardware preparation removes an aggregate return copy, not any live target, backing, permission, or GLOBAL check.

Idle i8042 and PS/2 translator polling skips at most seven service-loop turns after an authenticated empty observation. Own receiver polling still runs each turn; consumed bytes restore next-turn backend polling, including incomplete prefixes or packets. Malformed replies and I/O errors remain fatal, not idle. The counters introduce no timer, IRQ, endpoint, or retained authority.

Initial-shell READ_JOB polling uses a 112-byte request/reply slice: the canonical status occupies 72 bytes, with 40 bytes reserved to audit and retire up to two unexpected capability receipts. Encoding, transport, and receipt validation share that slice. Larger launch records keep their existing capacity; one yield per live status and terminal session cleanup are unchanged. Oversized replies are rejected before capability installation, but this does not introduce a peer-failure timeout or guarantee accepted-call completion.

Kernel scheduling permits at most eight successful preferential task handoffs before an ordinary turn from a persistent runnable cursor. CALL receivers, exact replies, pending wakes, and every preferred selector share the counter; a CALL/reply pair consumes two turns. Only actual ordinary selection resets it. Pending reply/wake identity survives budget exhaustion. This is cooperative turn fairness, not a wall-clock or preemptive latency guarantee. YIELD honors every recorded preferred, deferred, and pending-wake target, including non-reply work, within the same budget. Queued-call fallback uses the endpoint's live-validated retained receiver, including auxiliary routes, not only a TCB's primary service slot.

The reviewed zero-timeout receive refinement observes exact dequeue RETRY and transfer-waiter liveness under the same original endpoint lock. This removes only the second advisory lookup for BUSY versus RETRY; it still validates and clears stale waiter generations. Blocking registration retains its second live lookup, and success or non-RETRY errors never inspect waiters. No endpoint hint, cache, ABI or authority is added. Signed kernel b54082bd passes strict 537/561-test matrices, with one existing benchmark ignored in each. The change is absent from the c9a78901 utility images. The accepted 7f57bb8b pair functionally exercises it through the utility workflow, but establishes no isolated guest speedup or strict startup-performance acceptance.

Before publishing send authority, launchd and ttyd prime each newly created endpoint they will receive from using its exact retained receive alias and one zero-capacity, nonblocking RECV. Only empty RETRY is accepted; no message buffer or pending receive is retained. Failure uses existing publication rollback. Ttyd retains RECV only; launchd permits exactly RECV|GRANT only for its owned script-reply receiver and otherwise retains RECV. Receivers destined for another process, including vfsd resolver routes, are excluded. Endpoint creation itself still supplies no receiver hint or authority.

Integration's hidden freestanding memcpy, memset, and memmove implementations use scalar eight-byte integer operations with exact byte tails. Overlap selects memmove direction before copying; short and unaligned ranges stay within the requested bytes. No SIMD, direction-flag change, out-of-range access, or new dynamic PLT dependency is introduced. These remain internal artifact support, not a new runtime API or an accepted performance result.

Canonical IPC copies take one immutable 40-byte header snapshot and then only the declared body; raw and malformed-message fallback behavior remains unchanged. Before any endpoint access, the syscall gate validates the complete advertised current-VSpace range: read/write for CALL, write for RECV, and read for REPLY/NOTIFY. Root has no exemption. Delivery rechecks live target write rights for the exact payload, so entry-time validation cannot leave residual write authority. Tracked backing is preferred; raw root delivery additionally requires fresh coverage by explicitly registered writable user ranges, never an arbitrary tracked-copy failure. These checks add no capabilities or cached permissions and retain the existing serialized BSP dispatch model.

Before dynlinkd is available, rootd groups its existing staged relocation plan into root-only procd 0x431 requests of at most 64 records for one exact unstarted process generation and object. Complete validation precedes ordered per-record kernel writes. Failure reports the successful prefix and requires rootd's exact-stage abort, not a batch retry; no new kernel operation or retained authority is introduced.

The separate host startup observer measures complete READY records and the first shell prompt from a fresh serial log without guest timing authority. Schema 2 records an earliest_ns to observed_ns window for each event and rejects uncertainty over 100 ms. Serial-derived acceptance intervals use the conservative upper bound: right-event observation minus left-event earliest time, not point timestamps. Native command time comes from the QMP injector's separate post-typing monotonic interval. Bounded multi-chunk drains preserve backlog uncertainty; firmware stderr stays in a private separate log so it cannot contaminate serial timing evidence. Intervals include loading, start, initialization, scheduling, and output delivery; they are not pure loader time. The focused acceptance targets are five seconds root-launch to final READY, one second per canonical service READY gap, one second final READY to shell, and two seconds for the four-command native transcript after typing. These tighter targets remain pending fresh VM proof. The intermediate first wave reduced observed boot time from about 14 seconds to 4.651 seconds and early service gaps from about 125 ms to 4–6 ms, but its 1.84-second shell gap and 4.992-second native transcript were not accepted. Rootd's earlier corrected source inventory was 15,158 lines: the reduction excludes previously miscounted disabled host/test bodies, not newly removed runtime code. Its reviewed console-selection baseline, including the ten-line completion correction, is now 15,248 lines; the 4,672-byte minimal artifact, eight unsafe sites and authority inventory remain unchanged.

lib-elf likewise separates target geometry from resource capacity. Its allocating static planner accepts every validated load segment, while its no-allocation planner uses only the caller's slice length and reports exact required and available counts without partially mutating insufficient storage.

Process metrics and extop

Read-only metrics flow through explicit receiver-owned routes: the kernel supplies processor topology/counters and allocator totals to procd, memd projects its delegated allocator domain, procd serves only launchd's private combined snapshot request, and launchd projects system and process rows through the requesting session's inspection route. A snapshot body, cursor, PID, job, generation, or session number is descriptive data and cannot select another session or authorize control.

Launchd assigns each published job a nonzero POSIX-visible PID from a namespace separate from procd's reusable kernel TCB identity. It retains that PID with the stable job through terminal-status observation, places it in each process's authenticated startup image, and preserves it when an exec successor is adopted. The PID is the value exposed as $$ or returned to a parent for $!; only the job's exact status, control, accounting, and launch routes authorize operations.

extop is the ext4-only native process monitor. Its exact CSpace contains TTY lifecycle and streams plus session inspection; optional process control is possible only through separately delegated exact job handles that identify themselves and match the selected session/job generation. The monitor receives no cwd, resolver, public launch, loader, dynamic-linker, procd, memd, kernel-control, global VFS, or discovery authority. --samples=N provides authority-free bounded capture. The positive and deny-all VM scenarios are authored but intentionally unexecuted until the post-implementation debug pass.

Services and storage

Service identity is structural: dedicated endpoint families authorize callers, and request bodies do not assert caller roles. Driver, process, memory, storage, filesystem, logging, and discovery services receive only their documented startup peers.

VFS directory enumeration keeps its synthetic mount-overlay cursor tagged even after the last entry. The next read terminates instead of restarting backend enumeration at zero, so ls can complete at the mounted root.

Startup capability-transfer consumers validate the authenticated encoded table in place. Producers stream directly into caller-owned transport envelopes, so neither libraries nor rootd/deviced impose a parallel descriptor-count ceiling.

Automatic terminal focus follows a newly provisioned stdin sender, not the existence of a process-lifecycle session. Ordinary external commands transfer the shell's exact fixed stream capabilities; their otherwise-unused lifecycle PTY must not take keyboard or COM1 focus. Such provisioning leaves ordinary and trusted focus unchanged while the child runs and when it exits. New-stdin provisioning and explicit trusted focus selection retain their existing rules. Focused interactive checks send separate command lines and require a fresh output record and subsequent prompt for each; semicolon batches do not prove that the shell can read its next command.

The trusted virtual-terminal foundation gives ttyd distinct ordinary-input, secure-attention, ordinary framebuffer, trusted framebuffer, ordinary serial, and private serial-review routes. Ordinary framebuffer bytes form one continuation-only light-gray terminal stream, so ttyd queue-record completion cannot create per-key newlines. COM1 receive bytes take the same ordinary canonical-input path: drv-serial separates RX from TX history, seriald admits input reads only from its authenticated ttyd peer, and ttyd supplies the current focus. A bounded UART poll on provider READ also collects idle input when no IRQ was delivered. Only private seriald RX can supply serial consent; public serial writers and ordinary PTY data cannot approve prompts or synthesize generic secure attention. Ttyd advances one retained serial-input call step per loop with a buffer separate from renderer calls. Pending provider input therefore leaves ordinary rendering and trusted terminal work runnable. Accepted requests retain their exact bytes through completion; ordinary bytes survive backpressure without duplication, but focus/prompt transitions erase old batches rather than reroute them into another session or prompt. An empty poll or pre-acceptance BUSY skips exactly seven focused loop turns before retrying; output cannot extend that delay, and accepted calls or buffered bytes continue every turn. Its 96-byte version-2 TTY1 startup tail authenticates console flags and exact caller-owned state capacities, including a deployment-sized active-grant view and physically separate PTY input, canonical-line, and PTY output byte pools. Generational session and PTY identities, realm identifiers, and numeric cleanup slots remain data; only a live validated endpoint supplies authority. Each session also carries explicit operation/lifetime and deny-or-prompt defaults. Private peer-specific policy decisions and one fully correlated prompt per session render through private framebuffer and serial review routes. Admission requires the already-focused live session and rejects a different focus. An older accepted physical-input queue entry instead returns nonmutating pre-admission RETRY, and powerboxd preserves the identical request. The prompt captures authenticated physical or serial input, but consent requires that transport's complete exact review acknowledgement. Serial additionally drains older accepted replies and queued input until a fresh post-visibility empty read. A fresh y or n plus Enter from the same input transport answers once; choices cannot combine across transports. Retired answers, batch tails, CRLF and previsible input cannot replay into the shell. This is acceptance-order proof, not a hardware generation timestamp. Automatic attention grants no manual trusted-control policy generation. Private serial review bypasses public log history, and seriald excludes ordinary writers until exact empty release. The physical and serial console operators are trusted input sources; the serial path does not authenticate an arbitrary remote human cryptographically.

The escaped human-readable review names the VFS-authenticated canonical program entry, never caller-controlled argv[0], its exact launch job/generation, the requested operation and lifetime, and the selector within its delegated scope. The selector is not necessarily a relative path and claims no ambient cwd. Object class, exact object/selector digests, and child destination stay bound to the same request. Descriptive labels grant no authority; contextual private messages have exact additional framing, while authored legacy fixed bodies remain accepted without fabricated labels or malformed-context fallback.

The focused prompt fixture uses writable tmp/promptallow and tmp/promptdeny selectors, confirming approval and denial independently. Its later /bin/ls tmp requires a third explicit enumeration review and physical approval; an existing grant for . cannot authorize tmp. Exact framebuffer evidence uses only trusted amber PF2 glyphs. Firmware graphics in cells with no amber are background, not text; a damaged or mixed-color cell containing amber remains invalid and cannot satisfy a required field.

Inputd delivery is push-shaped on distinct ordinary and trusted routes: it supplies no ttyd session or prompt correlation. Its signed generation-3 policy maps Ctrl+Alt+Delete to manual secure attention and, while both modifiers are held, maps Left/Right to directional session switching, G to active-grant inspection, and K to emergency kill. Y/N are no longer trusted chords. Each control make becomes one sessionless trusted intent; its repeats and matching release never enter ordinary retained input. Ttyd resolves every target from its own focus and requires the exact manual-attention generation. A trusted switch retains ttyd's exact prior live generational focus; killing the switched-to session restores that focus only if the same generation remains live, without accepting a caller-supplied target. Powerboxd mirrors receipt-free ACTIVE/REMOVE evidence over its existing private ttyd route; the caller-sized view stores only descriptive grant rows and trusted inspection renders only the focused session's canonical snapshot. Inputd's public status counts a trusted delivery only after the exact correlated ttyd success reply; the aggregate counter cannot identify or replay an event or select a session, prompt, grant, or object. The manual also records the two exact rootd bootstrap lifecycle destinations. The second is used by independent dual-console startup and focused multi-session validation, receives no PTY stream in the bootstrap reply, and cannot be replaced by a caller-selected neighboring slot. The focused multi-PTY, ordinary-output spoof, and emergency-kill fixtures require exact trusted-delivery deltas of three, one, and three respectively. It also records ttyd's bounded ordinary pump: normalized set-1 translation, transactional canonical/raw input and ordinary-only echo, non-consuming PTY output preview, destination reservation before source progress, unsplit CRLF mapping, orderly EOF, erased scratch, and an interface with no trusted-path operation. Immutable exact-slot fbcond/seriald calls bind per-renderer partial progress to opaque output records, and a serialized visible trusted display retains its canonical fbcond release through backpressure. The authenticated ttyd orderly-exit path denies every new lifecycle and stream call while draining already accepted PTY bytes through framebuffer and serial; only then does exact receiver-capability cleanup start. Killed and failed peers continue to cancel undelivered output immediately. The authenticated ttyd runtime now creates three endpoint objects per session, retains only receive authority, and returns the mandatory lifecycle sender plus only the committed standard-stream aliases to procd. Procd validates the exact selected receipt set beside launchd's authenticated complementary explicit streams and provider-pinned cwd, validates the complete object identities, installs cwd, lifecycle, and all three child streams atomically, and retains only cwd/lifecycle cleanup senders. Exsh now authenticates one deployment-sized NOBITS command/parser/environment/parameter workspace, initializes borrowed argv/environment plus invocation-selected parameters/options, zero status, and authenticated descriptive $$. Implicit/-s stdin is promptless, explicit -i stdin prompts only on stderr, shared stdin is fetched byte-exactly without cross-command read-ahead, and borrowed -c input never reads stdin. Syntax and expansion failures terminate non-interactive sources; every exit path clears retained command/parser state. The POSIX exit special built-in commits prefix assignments, accepts the portable 0--255 status range, defaults to the current $?, and transfers control only after command-local descriptor and here-document state has been restored. POSIX shift defaults to one position, accepts an unsigned count through $#, commits prefix assignments before a semantic operand error, and mutates only caller-owned parameter storage. Removed values are erased, and an invalid non-interactive use terminates with status 2 after descriptor restoration. Implicit POSIX set [argument...] and explicit set -- [argument...] preflight and then replace or clear the positive parameters, reusing and zeroizing the live caller arena while preserving $0 and special state. A non-option first operand begins the implicit list, after which -/+-prefixed fields are data; -- admits such a value first. Leading grouped or successive -Cfu and +Cfu fields now update $-, the existing noclobber intent, pathname suppression, and nounset policy. Separate or attached -o / +o names noclobber, noglob, and nounset map to the same C, f, and u flags without installing o. Under -u, a reached unset scalar parameter or arithmetic variable is an exact expansion error; $@ and $*, unvisited lazy arithmetic branches, and plain arithmetic assignment targets retain their POSIX exceptions. +u restores the empty-string and arithmetic-zero defaults. Option-only forms preserve positionals; options followed by -- or a non-option operand commit atomically with the replacement after complete option parsing and positional preflight. Deferred standard names/letters and invalid names/bytes diagnose distinctly at the exact aggregate field and byte offset without changing flags or positionals, although special-built-in prefix assignments persist. Exact bare set -o emits deterministic tab-separated on/off state for the three behavior-backed names, while set +o emits complete enabling or disabling commands in the same order so reinput recreates every setting. Both commit prefixes without changing option or positional state, stream borrowed fragments only through the authenticated command-local stdout cursor, return status 1 on terminal output failure before leading !, and restore descriptor aliases. Capacity failure changes neither prefix variables nor parameters. Bare set emits every set variable in deterministic portable-name byte order, always single-quotes its re-input-safe value, omits declared-but-unset names, and returns status 1 after any terminal stdout failure. Current-locale collation and the remaining names/letters remain explicit incompleteness. Listing uses only the already authenticated stdout cursor and retains no callback, stream, or other authority. Command-file bytes remain non-authoritative until an authenticated content envelope exists. POSIX exec with no utility commits exported prefix state and the fully preflighted parser-order descriptor view. Its utility form bypasses functions and built-ins and performs external-only direct or child-PATH search through a route-authenticated successor handoff. Launchd keeps the caller-facing job session and existing public routes stable, keeps the job's POSIX-visible PID unchanged, uses a separate lifecycle session for the candidate, and adopts the new process only after procd consumes the predecessor and starts the successor. Before the old job resolver is retired, launchd uses its private vfsd route to atomically reparent remaining predecessor-owned streams to the exact same-realm candidate resolver, then reparents matching launchd cleanup obligations and releases only predecessor-local state; the receipt-free request transfers no authority. A safe pre-boundary refusal drops only duplicated candidate aliases, leaving the running predecessor's provider object intact. Exact ELF format rejection or exact native-manifest absence for an executable-mode script therefore permits reading only the already selected file; malformed manifests do not. The interpreter is the fixed ext4 lib/erix/dynlink/executables/exsh.elf selector, never an ambient or child- PATH fallback. The replacement preserves the candidate environment, descriptors, $0 and remaining arguments, stable $$, and no additional public authority. The exsh ELF, runtime graph, and authenticated sidecar are installed only in the ext4 dynamic object store, never in the boot image. Ttyd itself is now an ext4-only runtime-graph executable: rootd authenticates loaderd's staged endpoint and install grant, installs its ten exact transfers plus separate endpoint factory, retires all staging authority, starts the exact generation through procd, and requires typed readiness after root mount and VFS I/O. It has no boot-store copy. Launchd now follows the same ext4-only lifecycle: rootd installs its dedicated child request receiver, six peer routes, and complete 68-byte version-2 LCH1 policy, retires all staging authority, starts the exact generation, and requires typed readiness after ttyd and powerboxd. It has no boot-store copy.

After the complete service graph is ready, rootd emits terminal ERIX_ROOTD:READY, prints EriX <version> using the Integration repository's exact tag at HEAD or otherwise its commit identifier, and only then enters the optional first-shell path. That path creates one deny-all ttyd parent session and submits the canonical exsh -c : transaction over launchd's public route. Its ordinary launchd control alias remains exactly SEND. Rootd authenticates the distinct canonical source as the same endpoint object with exactly SEND | GRANT, derives one transaction-local alias with those rights, and retires the source before the first launch call. This is the only sender that may carry the two explicit root-VFS transfers for executable-directory and cwd records; it is retired immediately after commit. Rootd retains only the ttyd lifecycle and launchd status senders until terminal observation, then hangs up and retires both. Uncertain source, receipt, abort, or cleanup disposition fails stopped so process teardown removes every possible alias.

Production bootstrap is rootd's primary architecture. The Integration repository's lib/rootd-integration-orchestration crate owns the richer post-mount scenario transcripts, bounded launch-record policy, feature selection, outcome classification, stable evidence strings, and the time, console, probe, hotplug, ACPI, driver-lifecycle, normalized-input, input-authority, physical-input, interrupt, crash-reporting, logging, and loader verifier state machines. Trusted-terminal fixture selection is one immutable library plan covering secondary creation, status-route independence, session-control retirement, exact trusted-delivery count, and the completion marker. It is a no_std, capability-free policy library linked only by the explicit build-gated rootd Integration-policy boundary and is absent from production images. Initial-shell and physical-input selection is expressed only as dependency features of that crate; physical input implies the initial shell. Rootd has no matching scenario Cargo gate. Rootd retains the authority-bearing ttyd, launchd, VFS, input, cleanup, marker-emission, and fail-stop effects plus narrow hardware and input IPC adapters; the library performs no syscall or authenticated transport. Every hardware or input effect names its endpoint, request identifier, event bound, and selector explicitly. The library also owns all eleven Integration-only dynamic executable names, the closed helper/core/interrupt role family, and pre-procd launch selection. Rootd retains its production service-name catalog, signed manifest and ELF validation, and every mapping, process, logging, and cleanup effect. The explicit timed-service IPC adapter is isolated in one rootd source file behind the crate-level Integration gate. Timed verification policy remains in the library, while production neither compiles the adapter nor admits its two response decoder types. The explicit VFS file-operation adapter is isolated the same way. Production retains only path encoding and signed-mount transport; twelve per-item gates are replaced by one include gate, and seven verifier-only VFS response decoders are absent from the reviewed production surface. The interrupt boundary names only the explicit procd and logd endpoints. The Integration library owns the line-bound request, expected terminal status, and profile marker without retaining child authority. The crash-reporting boundary likewise names only explicit procd, crashd, and optional logd endpoints. The library owns the fault-client launch contract, terminal reason, report correlation, cooperative retry, and dynamic marker; rootd retires the launched child endpoint before returning its descriptive observation. Logging verification uses the same boundary. Integration owns deterministic append content, required-role selection, response validity, cursor/timestamp monotonicity, the 1,024-record stress sequence, and its dynamic marker. Rootd performs only submit/query effects naming logd explicitly and a marker effect naming both kernel-log and logd routes. Loader verification also follows that boundary. Integration owns the ABI round-trip, canonical paths and request identifiers, discovery and ELF/load-plan expectations, materialized-child isolation, five cleanup-fault boundaries, evidence markers, and final disposition. Rootd's two 356-line adapters retain only explicit loaderd, procd, kernel-log, and logd effects; the former dedicated cleanup verifier module is gone. Core VFS verification uses the same boundary. Integration owns five immutable memory, ESP, data, indexed-directory, and volatile-/tmp plans, including the canonical paths, payload, disjoint request ranges, fourteen-operation create/write/read/stat/readdir/cleanup transcript, response expectations, and trace strings. Rootd retains only endpoint-explicit VFS/kernel-log effects and local IPC and handle lifetimes. Integration also owns the shared 22-operation FAT/ext truncate proof, including exact paths, request ranges, fill bytes, shrink/growth thresholds, zero-fill evidence, and trace policy. Rootd's two filesystem entry points select immutable plans over one explicit transport adapter. The ext sparse verifier owns both paths, tail offset and payload, zero-hole and tail reads, sparse truncation, sequencing, and trace through the same boundary. FAT, exFAT, and ext metadata verification also owns host and created-file expectations, timestamp normalization, mode and ownership changes, filesystem flags, immutable denial, sequencing, and traces. Rootd retains one endpoint-explicit metadata status adapter and immutable plan selectors. FAT namespace policy likewise owns lowercase short-name enumeration, persistent payloads, rename replacement, and nonempty-directory, type-mismatch, and descendant-cycle denials through explicitly addressed raw stat, directory-read, path-status, and two-path effects. The fourteen-operation extended VFS cross-API transcript, paths, values, cleanup, and traces are also Integration-owned; rootd retains one 42-line typed effects adapter. The checked migration ledger, after the ext-link extraction below, contains 970 classified surfaces. Ext rename overwrite, cross-directory, symlink, device, tree, HTree, denial, prefix-evidence, and request policy is Integration-owned as well; rootd retains one 31-line endpoint-explicit adapter. Encrypted ext casefold lookup, payload, case-preserving enumeration, and exact request policy is library-owned too; rootd retains one 21-line endpoint-explicit adapter. Ext symlink, hard-link, special-file, denial, persistent-file, cleanup, request, and diagnostic policy is Integration-owned as well. Rootd retains a 124-line adapter including raw stat/open transport shared by other VFS adapters; the checked migration ledger is now 970 items. Persistent host/read-only/ext-only evidence, created markers, indexed paths, large-file samples and sizes, payloads, request sequencing, and diagnostics are library-owned too. The typed dispatcher invokes those plans through the shared explicit file effects, with no dedicated rootd adapter. The build-gated signed-BootConfig storage smoke selector is library-owned too: it consumes the validated descriptive mount table and selects the root or memory-backed /tmp plan. Production mount validation and explicit IPC remain in rootd's 271-line BootConfig mount module; the checked ledger is now 951 items. Signed mount authority is bounded by media authority: default and other read-only full-system profiles mark every block-backed mount read-only, while writable fixtures must explicitly select writable QEMU media. Integration host validation rejects a mismatch before launch, and providers retain their own independent denial. Focused-versus-baseline VFS completion markers, their exact order, and optional encrypted-casefold evidence are library-owned as well. Rootd retains only a 16-line adapter that iterates the supplied transcript through its explicit logd route. Complete memory, read-only, verity, baseline FAT/ext, and focused VFS pipeline order is now library-owned as immutable typed steps. Rootd retains a 253-line mechanical dispatcher and a 520-line general transport module. Ten high-level verifier/plan wrapper families and the persistent adapter are also gone; together with the nine selector files and four duplicated entries, the VFS split removes 387 rootd source lines. Dynamic-link fixture constants are library-owned too: the dynamically materialized rootd-intake marker, six named negative-selftest diagnostics, and the zero optional-spawn-flags policy. Rootd retains only their explicitly addressed kernel-log and procd effects. Subsequent initial-shell transport, hardware/console, negative-spawn, pre-procd, cleanup-fault, dynlinkd evidence, map-success, and cumulative service-group START/READY extractions bring the completed slices to 4,364 rootd Rust lines. The final group-plan extraction removes 213 release-active lines without changing product authority or effects. Signed BootConfig driver-discovery validation remains in production rootd: each configured device selector must resolve through its explicit deviced route before endpoint readiness. It is a bootstrap invariant, not scenario policy. Block-storage discovery and layout checks are production invariants too. The audited 509-line rootd module now uses validate_* names and checks namespace, partition, filesystem-signature, optional-journal, and sentinel evidence before mount. Integration contributes only an explicit multiple-provider requirement. Six obsolete verifier entries left the migration ledger, while product storage diagnostics remain production validation. After the subsequent extraction and compatibility audits the ledger contains 832 items (776 move, 55 production validation, and one delete).

The physical-input variant instead submits a six-record interactive transcript: program, one exsh argument, cwd, and ttyd-provisioned stdin/stdout/stderr. It omits both -c and the script-authority envelope. Rootd publishes no separate session-ready marker. A private, short-lived QMP socket waits for the real exsh prompt and then injects emulated PS/2 pointer activity, Ctrl+Alt+Delete, and exit; scenario data cannot select that socket or a trusted target. Integration policy accepts evidence only if keyboard, pointer, and exact trusted-acknowledgement counters all advance through rootd's existing read-only inputd adapter. Complete-catalog run 1468 passes this physical-input path with its exact trusted acknowledgement, cleanup, and final-readiness evidence.

The additional trusted-terminal group keeps that ext4 interactive path. One member creates an independently receipted empty session and switches focus in both directions, one prints secure-attention-like bytes through ordinary PTY output before the sole real trusted chord, and one focuses and kills the secondary with target-free Ctrl+Alt+K before primary exsh can receive exit. The spoof-negative member passes in the restored catalog and the focused session-control rerun passes after exact prior-generation focus restoration. The multi-PTY rerun exposed a harness race: its first output match was the terminal's echoed command, so trusted chords could reach the short-lived echo child instead of the resumed shell. The QMP driver now requires the second occurrence produced by the utility before entering secure attention; a focused rerun and complete-catalog run 1468 verify that correction.

The focused launch-handle scenario exercises the same interactive ext4 exsh without adding a boot-image executable. Rootd keeps only the initial shell's mandatory read-only status route. The shell observes /bin/false as status 1, then blocks in /bin/cat; a physical Ctrl+C reaches only cat through its independently returned control route, and the following command observes status 130. Neither QMP nor scenario data supplies a process, job, session, or route selector. Bounded retries stop on the unique CONTROL130 result. The focused warning-free VM passes 1/1, including ordered exsh cleanup, authority-boundary, physical-input, and final-readiness evidence.

Sixteen focused VM scenarios cover the positive, missing-program, PATH-search, command-not-found, redirection, here-document, nested-status-propagation, POSIX for, parenthesized-subshell state-isolation, POSIX function, eval, dot, exec, synchronous-pipeline, times, and persistent trap script paths. The pipeline fixture first rejects a mixed AND-OR list containing a singleton compound pipeline with status 126 before stream allocation; neither compound can mutate the parent. It then commits a finite ext4 exsh child before a missing second command returns status 127, requiring exact child, status/control-route, and provisional-stream reconciliation. The following valid work proves immediate reuse. State-sensitive child-last pipelines prove nondefault IFS, readonly set, and readonly declared-unset behavior while the parent remains unchanged. The fixture next reparses a function definition and a brace-group export in separate isolated ext4 exsh children, then feeds the declaration stream to a third ext4 reader. Its middle child receives both a reader and writer at stable launchd transaction-ledger ordinals; delivery of the first cannot renumber the second. A final external pair proves parser-order redirection precedence. Every pipeline commits all children before observation, uses launchd-provisioned logical streams, observes exact status zero, and reaches final root readiness. The three-stage concurrency also covers a transfer caller that reaches its retained script route before launchd's poll: a retryable return from the armed blocking receive resumes bounded polling and retains the caller, while terminal receive errors remain fail-stop. BEGIN selects only inventory-proven empty receipt slots, including after cleanup authority changes from transaction to job ownership. The fixture therefore proves both progress and absence of implicit slot reuse without adding authority to exsh or rootd. Its initial 72 MiB runtime profile exhausted the kernel heap while staging the second concurrent 83 MiB exsh image; the warning-free 80 MiB replay passes and forbids the exact allocation-failure marker. Integration run 746 passes the complete 439/439 catalog through the coordinated POSIX exec checkpoint; the focused times member expands the selected catalog to 440. A focused replay with lib-ipc 96cffcf, launchd 2949549, exsh 6dd0a0a, and rootd e4a1270 passes the exact-state pipeline under a conservative 1,800-second single-vCPU host budget; exsh remains an ext4 runtime executable rather than a boot-image member. The function image also crosses 32,768 live managed frames and switches a large user range, proving that kernel frame-registry growth and range-permission activation remain bounded while the large ext4 executable is materialized.

The times fixture uses that same ext4-only shell and unchanged launch transcript. Four canonical two-line snapshots surround one failed lookup, one terminal-observed ext4 child, and an in-place ext4 successor. Host validation proves failed-launch exclusion, one-time child charging, predecessor-inclusive self time, and monotonic shell totals, while target checks cover operands, prefix/redirection commit, closed stdout, and exact status. The complete historical CI catalog passed 439/439 in Integration run 746; adding this focused member expands the selected catalog to 440 without suppressing an older VM. A warning-free production-capacity replay passes at Integration 2eff22e with exsh 616ee0b and ttyd 4d97a7b, including all eight canonical output rows, the exact success/exit/readiness markers, fresh successor terminal streams, and the orderly dual-renderer drain. Coherent run 756 passes all 440/440 scenarios and both workflow jobs without build, image, workflow-permissions, panic, or unexpected warning text. Its superseded initial-pin predecessor passed all 439 historical scenarios and failed only this new member, ruling out a historical VM regression.

The persistent trap checkpoint retains default, ignore, or NUL-free action source for EXIT and lib-ipc's 27 canonical v1 signal identities in authenticated caller storage. Exsh maps every non-EXIT condition bijectively to the shared name, default-action class, pristine disposition, and immutable policy; identities remain descriptive and select no delivery target. Prefix assignments and trap replacement commit atomically only after redirections and complete destination preflight; canonical reinput listings use the selected stdout. Invalid conditions return status one and continue, while invalid options or a missing condition return status two with the direct-special-builtin source disposition. On shell termination, one installed EXIT action is copied into the authenticated retained evaluator, reset before execution, and run after source-parser teardown but before descriptor and provider teardown. Normal completion restores the pre-action status, an explicit exit n replaces it, and operand-less exit selects that pre-action status even after an intervening command. Syntax failure selects status two, and all retained parser bytes are erased on every path. The checkpoint deliberately imports no event or process authority. Functions, eval, and dot scripts share the live table; parenthesized entry preserves ignores and resets catches, while exact LIFO leave restores the parent and erases every snapshot. While idle, exsh reads exact-cursor events from its authenticated session-lifecycle sender. Foreground waiting first reads that same route with the persistent idle cursor, because ordinary children inherit the shell's PTY. It validates the held child status/control senders before consuming an event and returns immediately after selecting one deliverable signal. If the own-session event is absent, ignored, or mode-only, it then uses the control-enabled child's returned read-only status route; launchd and procd derive the bound process generation and use the already retained child lifecycle sender without exposing a selector or another endpoint. Exsh consumes inherited ignores without job mutation, coalesces other canonical conditions, and forwards them only over returned exact control routes. Caught actions run in canonical order at post-command and pre-input safe points, preserve incoming status after normal completion, and resume exact function, eval, dot, and pipeline-list continuations without replay. The warning-free focused ext4-only VM passes with exsh c7056cf, ttyd 07521c0, rootd 1275013, and Integration c346ee9; coherent Integration run 764 passes all 442 scenarios and both workflow jobs.

The same shared contract fixes receipt-free ordinary PTY event shapes. Success advances the exact cursor once: resize carries WINCH plus a nonzero state generation, mode change carries zero plus a nonzero generation, hangup carries HUP plus one exact reason, and interrupt carries INT plus zero. Retry preserves the cursor and zeros the event fields. Lib-tty validates its adapter through this contract and carries no host-native interrupt code, process/job selector, delivery route, or capability receipt.

Ttyd now reuses the authenticated TTY1 ordinary-event capacity for opaque ordinary-input or per-session descriptive-event slots. Global input cursors and generational session event cursors remain independent. An exact cursor read is served only on that session's already retained lifecycle receiver; empty reads return typed retry without movement, and response storage is preflighted before consumption. Signal-enabled Control-C is converted in place to canonical INT without entering PTY input, while resize and hangup preflight canonical WINCH or HUP retention before state mutation. Only pending interrupt or resize conditions coalesce, with resize retaining the latest generation. Lifecycle cleanup erases queued event state and retires its cursors before receiver authority bookkeeping leaves the session record. This adds no endpoint, capability, startup transfer, process/job selector, or boot.img executable. Launchd and procd now consume the narrow delivery vocabulary without adding a route. Exsh projects only validated ignored-condition bits into ordinary, pipeline-child, utility-bearing exec, and ENOEXEC replacement BEGIN records; caught action text resets to default and never crosses the process boundary. Launchd derives the exact process and generation from the existing job-control receiver, and procd alone applies explicit ignore or the catalog default on its private launchd route. Terminate-class defaults carry one tagged kernel reason back to exact POSIX shell status; managed cancellation remains disjoint, and stop/continue fail without mutation until real kernel transitions exist. Exsh now consumes those events during foreground waits, broadcasts a selected identity to every live pipeline member before another status round, and dispatches caught actions after foreground completion or before blocking input. If child exit races an event read, both launchd and procd return a receipt-free retry with the cursor unchanged so the following exact status read remains the sole terminal observation. The focused launch-handle VM passes 1/1: it observes status one, retries selector-free physical Ctrl+C until status 130, then proves exsh cleanup, the authority boundary, and final readiness. EXS21 also retains each asynchronous child's exact returned routes in a caller-sized ledger. Launchd returns the stable job's nonzero POSIX-visible PID for $! rather than exposing a reusable kernel TCB identity, and exsh accepts that number as descriptive job data only. Operand or all-job wait, signal forwarding, cancellation, and teardown continue to use the exact returned routes. A caught condition interrupts wait with signal-derived status before its action runs; later observation retires the route. The globally checked visible-PID sequence never wraps or reuses an identity. The first focused rerun proved the interrupt/action/status sequence but exposed two independent fixture defects: marker commands depended on an unavailable echo, and the background ledger treated a recycled kernel TCB number as job identity. Marker evidence now uses the authority-free trap special built-in and the stable visible-PID lifecycle removes that collision; the corrected focused VM passes every required, forbidden, unique, and ordered marker plus final readiness under the common 120-second absolute and 45-second serial-progress watchdogs.

Coreutils owns the no-std catalog and target for 20 exact /bin/<applet> entries. Each applet has its smallest semantic ceiling: pure applets are empty, read-only applets contain no mutation, and namespace mutations are one-shot. One shared ext4 object retains distinct command-entry digests and .lmf sidecars; there is no generic /bin/coreutils, basename, argv[0], alias, or union fallback. Image construction patches its retained workspace, every command starts through loaderd/dynlinkd/procd after mount, and no coreutils executable or sidecar enters boot.img.

The three additional entries are read-only date, entry-scoped touch, and status-only inherited time. Their version-2 manifest flags declare generic ABI ceilings; launchd does not parse their syntax. Date, touch and time query clock data through their job-bound broker and never receive timed's endpoint. Touch acquires exact target/reference leases lazily and requests current time only after a target operation is authorized and its syntax needs that value. Time receives an invocation-bound launch sender and only the child's status route. Inherited dynamic streams use explicit SEND-only loans with child-local EOF/close state; the child cannot close time's backend before its timing report. No cleanup sender, guessed object identity, wildcard lookup, job-control route or fresh replacement PTY is introduced. Lender exit ends outstanding loans by cancelling borrowers before backend retirement.

Integration now carries three focused disk scenarios with a validated fixed QEMU RTC base. The positive script has nine canonical exact-path rows for only its ext4/FAT I/O and touch operations and checks success, failure, not-found, and signal statuses. One negative runtime omits the authenticated private RTC provider; another builds that private provider to submit one invalid nanosecond value in an otherwise canonical serialized request and permits clean fixture exit only after timed's exact typed, correlated rejection. Exact private operation and body size are required for that response; unrelated malformed framing remains header-only. Both must leave trusted date/current-touch unavailable while explicit touch and monotonic time remain independent. A post-VM host verifier reopens the positive disk and checks persisted payloads and timestamps. Host and orchestration gates pass. Integration's closed build-only selector now constructs all three exact images, each containing a signed boot image, and stops before QEMU. Each disk image is 156,237,824 bytes; the positive, unavailable, and malformed SHA-256 values are c26f9fa62708db210628529373fcf584328f77f04e181d6f3b17b3e0a741127f, 520e9ddd052c7828158be176724c332eebf0335b0cbf26af99d78722ae889e77, and e03268dacd0ee445d75d68d4d178b441f6b2af5a063f404876cdc7f39b6c7280. Checksum, identity, GPT, FAT, and ext checks pass. Complete-catalog run 1468 also passes VM execution and post-mutation timestamp inspection.

Native utility output is an opaque byte contract. sort and ls use unsigned- byte lexical order without locale or Unicode normalization; selection applets retain input order and numeric text uses fixed ASCII decimal syntax. ls omits metadata and timestamps, cp promises content rather than metadata preservation, successful mutations are silent, and diagnostics and statuses are fixed. Focused ext4 workflow, cross-applet-denial, and native-time scenarios are committed and pass in complete-catalog run 1468.

The native launch foundation keeps command intent separate from process authority. launchd validates a fragment-independent typed transcript, binds each program, cwd, and explicit-stream final-fragment receipt to its exact LCH1 role slot and transaction lifetime, then binds the provider-pinned executable object identity, loader-measured executable content, runtime graph, command entry, and authority table, rejects absent, malformed, stale, contradictory, and semantically overbroad manifests before handoff, intersects session/manifest/script/invocation ceilings, and orders non-runnable procd staging before exact child installation and cleanup. Version-2 LCH1 supplies exact caller-owned state dimensions and partitions six deterministic endpoint slots per job for mandatory status, optional control, and optional script-launch source/receiver pairs, then two slots per authenticated here-document or pipeline endpoint pair, all disjoint from the nonempty launch-intake receipt tail. Launchd now carves the exact empty caller-sized stream-pair table from its version-3 compiler-described arena. Canonical intent may interleave provider-backed and authority-free provisioned descriptions in one contiguous description-ID and strictly increasing child-slot namespace before sparse aliases. A provisioned record binds its role, access, and child destination; its numeric stream identity is correlated only inside the authenticated ingress/session/realm scope, and only a here-document reader contains selected immutable bytes. Commit reparses that ordering, uniqueness, descriptor references, endpoint count, and retained-body demand against supplied storage before any endpoint-factory effect. Ordinary and retained-authority launch paths now reserve complete logical state, create every pair, and install each exact send-only operation endpoint through procd immediately after its canonical child-description row. Launchd retires the full source after the attempt and serves only the retained receive route. A script host receives only its fresh send route; launchd retains the matching receiver and binds every script transaction to that receiver and its generation-safe, session/realm/job/process envelope. Canonical manifest, ttyd-session, parent, and requested ceilings can only narrow authority. Owner-first retirement blocks new transactions, aborts retained work, drains leases, and deletes the receiver before slot reuse. Authority-bearing COMMIT preflights every canonical record before the first remote request, retains only scalar state and immutable transcript boundaries, and waits under per-ingress backpressure. Powerboxd's dedicated authority-free notification is only a wake; launchd re-reads the exact correlated decision before one-at-a-time resume, publication, or complete rollback. The public commit contract returns only a mandatory read-only status endpoint and an explicitly requested control endpoint, both attenuated to SEND; job, process, session, and generation identities remain launchd-internal. At the last pre-start boundary, launchd resolves the cwd selector inside its committed scope into one provider-pinned READ_METADATA, job-lifetime directory endpoint and retires the broader scope. Explicit redirections remain exact stream endpoints and are never reinterpreted as path authority. The public dispatcher and narrow endpoint-factory delegation are active together. Clients receive no loaderd or procd authority.

The child startup-data boundary is now explicit below the service layer. lib-ipc defines one canonical, allocation-free LCS1 v1.8 image containing the nonzero actual lifecycle identity, a distinct stable POSIX-visible PID, optional script-envelope identity, inherited ignored-condition set, and authenticated command-entry digest, followed by ordered argument, portable environment, child-description, and sparse-descriptor records without a product-size policy ceiling. Environment records retain exact set or declared-unset, export, and readonly attributes; an unset declaration carries no value. Sparse aliases address one child-local description namespace: zero through two select the implicit fixed standard streams and identifiers from three select dynamic rows. Process-control operation 46 binds one exact readable child-owned image range to one created process generation; an identical retry succeeds, while changed, stale, unmapped, and post-start requests fail. The kernel supplies the address and length in initial rdi/rsi and keeps the separately bound receive endpoint in rdx. Procd now implements the receipt-free, generation-bound receiver that materializes the actual PID only from its authenticated process/generation stream identity, accepts the stable PID only through launchd's private transaction-bound stream, hashes this image in fresh non-executable child pages, and gates start on the kernel configuration. Launchd hashes both identities while producing the canonical stream before TTY provisioning or start on both ordinary and retained launch paths. Exsh parses that complete borrowed image, proves every slot in its fixed capability inventory before any I/O, and retains the stable PID only as non-authoritative $$ data in its connected interactive runtime. Its authority-free language library emits a balanced caller-owned event stream for simple commands, redirections, pipelines, AND-OR groups, and list separators. Ordered here-document specifications stop command parsing at the first body byte. A second borrowed scanner performs top-level delimiter quote removal, recognizes empty and multi-line delimiters in lexical order, applies unquoted continuation and <<- tab rules, and either emits unexpanded body bytes or atomically prepares processed bytes plus exact raw-source offsets in caller-owned storage without a private size ceiling. Opaque caller-retained checkpoints now resume exact pipeline, structural-!, AND-OR, and terminal positions after ordered body scanning without replaying events or imposing a body-handoff ceiling. A caller-sized opaque frame slice now also drives iterative function- definition, brace-group, subshell, complete if-branch, case-item, and for/while/until do-group parsing. Function definitions validate Rule 8 names, reject special built-ins, require one compound body, and attach its trailing redirections before closing the wrapper. Function names, checked for names/words, and case selectors/patterns stream as borrowed data; none creates variable, matching, function-namespace, or launch authority. Regressions stream 100,000 words or patterns, 10,000 case items, 10,000 nested functions through 20,000 exact frames, and 10,000 retained-frame handoffs without a parser-owned list, nesting, or continuation ceiling. The canonical caller-storage parser now also locates $() boundaries by iteratively parsing each commands string with the same grammar. Caller-owned work frames, an exact boundary cache, inner compound frames, and nested here-document slots replace parenthesis guessing; case patterns, comments, quotes, groups, parameter/arithmetic contexts, and body bytes retain their grammatical roles. Ordered nested bodies recognize the synthetic commands-string newline at the exact closing ), and all descriptive scratch clears after each token or error. Regressions cover 10,000 nested and sibling substitutions plus 10,000 nested body handoffs without a product ceiling. The POSIX backquoted form now shares the lexer's first-unescaped delimiter and normalizes its commands string into caller-owned byte and source- offset arenas. Unquoted and double-quoted backslash rules are distinct; both arenas are checked before either changes, and a 300,000-byte regression has no private command limit. The normalized string can feed the same grammar. A borrowed execution validator now checks the complete retained wrapper and every source-backed component before yielding simple-command, brace, conditional, case, for, and while/until actions without copying an AST. Caller-sized nested braces, complete if/elif/else commands, nested case commands, and loops execute in the current shell environment without recursion. Conditions run in order, the first successful one selects its consequent, and case expands its selector once and patterns lazily in source order until the first portable match. Loops reevaluate their condition before every iteration and return the last body status, or zero when no body ran. Active loops reuse only the authenticated caller parser-frame arena for descriptive replay positions and status, and erase each slot during completion or teardown. Expanded POSIX break [n] and continue [n] special built-ins commit prefix assignments and request only a descriptive transfer after command-local descriptor restoration. The controller clamps an oversized positive depth to the outermost active loop, unwinds inner compounds in source order, retires skipped here-documents, and either resumes after or replays the selected loop. Out-of-loop use is the documented successful choice for POSIX-unspecified behavior. Unselected regions perform no expansion or mutation while still retiring every retained here-document record; ;& enters later bodies without expanding their patterns. A POSIX for command expands an explicit word list once in source order or snapshots the then-current positional parameters when in is omitted. Its stable items survive body mutations in authenticated caller-owned arenas, and each iteration assigns through exact live-environment rebuild before the body runs. Empty input returns zero; otherwise completion returns the last body status. Loop completion, transfer, failure, and source teardown erase every owned item and byte. An active pathname pattern remains the documented unavailable general-enumeration boundary, without importing namespace authority into the shell language layer. Parenthesized lists checkpoint exact variables, positionals, option flags, status, descriptive parameters, compound control, loop depth, and the complete function namespace in authenticated caller-owned arenas. Inherited functions remain callable; inner definition, replacement, and removal effects disappear at matching leave. Leave restores the parent, exposes only the inner or leading- !-inverted completion status, scopes inner exit and loop transfer, and erases every snapshot. It reuses the same proof-built descriptor table and acquires or clones no authority. Synchronous pipelines prevalidate every command and commit each child before waiting. External utilities retain their direct launch path; source-backed built-ins, compound commands, and function definitions execute in fresh ext4 exsh children with exact parent state and pipeline streams. Noncontiguous here-documents and compound commands that could observe an untransferred parent function namespace reject the complete mixed list before stream allocation. A simple command matching a parent function fails explicitly instead of falling through to external lookup. Every entry in the mixed fallback must currently be a real multi-command pipeline; a singleton entry fails before stream allocation instead of being isolated with different state semantics. Asynchronous lists and negated non-subshell compounds remain unavailable. POSIX function definitions are inert caller-owned namespace mutations. Invocation snapshots the selected body, replaces only positive parameters, preserves $0, and evaluates nested calls iteratively; special built-ins retain precedence, while functions precede regular built-ins and utilities. Each call checkpoints the live control depth, so break and continue cannot consume caller loops, return exits only the innermost call, and exit restores every active call scope. unset -f removes a binding without changing an active snapshot. Invocation- and definition-site function redirections and selected local producers restore in exact LIFO order. Exsh now also initializes an open-addressed shell-variable table in caller-owned metadata slots from borrowed LCS1 values. Duplicate startup names retain the last record, absent IFS receives the invocation default, and exact startup set/unset, export, and readonly attributes precede assignment, lookup, iteration, unset cleanup, and live-state rebuild in caller byte storage. A 20,000-variable regression has no library-owned count ceiling; replacement arenas remove obsolete mutation history without retaining variable bytes or authority. A separate caller-owned positional table borrows parameter zero and initial values from ordered startup arguments, supports exact replacement/live rebuild, and creates independently stored function scopes so the outer list remains restorable. Exit status, option letters, and stable POSIX-visible shell and asynchronous PIDs are descriptive state only. The first scalar expansion copies longest unbraced names, one digit/special symbol, or simple braced name/decimal/ special forms into exact caller output. A separate field-forming interface now retains the ordered initial $@/$* fields in exact caller metadata, byte, and per-byte origin arenas. It preserves empty-field quote/split state, first/last fragment attachment, zero-width quoted-null edges, and explicit first-IFS joining choices. A second allocation-free interface applies the POSIX 2.6.5 candidate algorithm to those fields in caller replacement arenas. Only exact unquoted-parameter spans can delimit; quoted and literal bytes remain opaque, while white-space/non-white-space runs, required empty candidates, null IFS, and quoted-null edges retain their distinct behavior. A caller-owned composer now joins independently interpreted literal, scalar-parameter, and positional- parameter parts across a complete word before applying the same splitting engine. Repeated $@ sequences retain exact cross-occurrence edge attachment, and an interior quoted-null part preserves an otherwise removed empty field. A stateless two-pass traverser now interprets one exact raw word range through continuations, ordinary quoting, the portable dollar-single-quote escape set, the supported simple scalar or positional parameters, and POSIX regular or assignment-value tilde prefixes into those composed fields. Bare prefixes use current HOME; named prefixes use only a validated, strictly sorted caller table of portable login-name and NUL-free initial-directory bytes. Replacement bytes retain protected provenance, including null HOME; assignment values recognize unquoted-colon boundaries and suppress splitting. The traverser retains absolute diagnostics and strong all-arena rollback without ambient user-database, namespace, I/O, or capability authority. Braced parameter expansion now covers character length, the complete lazy colon/no-colon value matrix, ordered staged name assignments, descriptive error results, and all four quote-aware prefix/suffix removal forms. Its opt-in transaction uses only caller-owned nesting, mutation, capture, replacement- environment, field, byte, and origin arenas. It commits only after complete preflight; malformed input, readonly targets, storage exhaustion, or unavailable command/arithmetic evaluators leave the current environment and output unchanged. Assignment-value traversal reuses that transaction with suppressed splitting, empty-value retention, and isolated top-level tilde rules. The locale-free pattern policy is deterministic and carries no locale, namespace, I/O, process, launch, or capability authority. Prepared here-document bodies now use a separate explicit transaction. Quoted delimiters preserve the complete body literally. Unquoted delimiters expand parameters, immutable command results, and arithmetic in source order but skip tilde expansion, field splitting, pathname expansion, and top-level quote removal. Top-level quote bytes remain literal, backslash has the exact four special followers, nested parameter words retain ordinary grammar, positionals join through first IFS, and assignments commit only to the returned replacement environment after complete preflight. The one unsplit body and all offset/capture/work records are descriptive; no evaluator, stream, process, namespace, locale, launch, or capability authority enters the language library. A separate redirection transaction resolves each validated target descriptor and produces one typed pathname-open, descriptor-duplicate/close, or prepared-body operation plus a replacement environment. Ordinary operands perform tilde, parameter, completed-command, arithmetic, and quote removal with splitting and pathname expansion suppressed; here-documents retain their prepared literal or expanded policy. Decimal descriptor overflow, the unsupported optional {location} form, invalid duplication operands, set -C, dirty/short storage, and rollback are explicit. The operation remains caller-owned data: the transaction receives no endpoint, handle, route, callback, namespace, stream, process, launch, or capability authority and cannot inspect, open, apply, or restore a redirection. The simple-command transaction now expands regular words first, resolves every redirection left to right through one alternating candidate environment, and expands prefix assignments last. Exact immutable command-result and prepared or retained raw here-document associations are consumed once in source order. The ready parser retains only exact body/delimiter ranges and source policy; the transaction revalidates and prepares those bytes in caller scratch only for a selected list entry. Skipped entries advance association order without body preparation. Caller-owned aggregate slots and bytes expose borrowed typed redirection iterators; dirty input, every failure, discard, and successful commit clear the complete candidate. Capacity descriptor version 18 additionally authenticates caller-sized open-description, sparse-descriptor, reverse-journal, matching per-description reader/writer cursor, local-producer, local-alias, and local- body, launch-record, command-search, stable for item/byte storage, and complete caller-sized parenthesized-environment variable/parameter/function snapshots plus persistent function definitions, active-call snapshots, iterative execution frames, parameter checkpoints, validation frames, a retained-scope local descriptor journal, a second complete evaluation workspace for definition-site redirections, one typed pipeline-job slot per admitted command record, and disjoint caller-sized LIFO eval source, event, retained- document, substitution-boundary, execution-frame, and parser arenas, plus disjoint persistent and replacement-candidate trap slots and action bytes, before typed runtime storage exists. A separate descriptor- startup path validates canonical bound-receiver-skipping description slots, complete description references, fixed-descriptor exclusion, and exact send-only endpoint authority before returning a non-copyable proof. That proof builds a caller-owned sparse table with fixed standard streams, arbitrary u64 aliases, exact access, and shared checked cursors. A reverse journal makes duplicate, idempotent close, and already-resolved bind metadata transactional. It now also preflights and appends one caller-authenticated fresh description before binding it; reverse rollback removes each new description after its last alias. Failure, drop, and built-in completion restore the old table, while an explicit future-exec commit preserves metadata. These public APIs perform no capability resolution, transfer, cleanup, or I/O. The connected target consumes the full non-copyable proof into that authenticated state before effects and resolves standard-stream I/O through the proof-built table and its shared per-description cursors. For a selected simple command, it applies existing-description duplicate, idempotent close, and local here-document operations in parser order. Every local input alias shares one bounded producer cursor, while output access fails closed. The candidate table remains live while the built-in emits output or a diagnostic; completion or a later failure restores endpoint aliases, erases every local body byte and producer/alias/cursor record, and discards any failed expansion candidate.

The freestanding target uses only exsh's fixed send-only cwd and job-bound resolver endpoints through a stateless syscall adapter. Before each effect it preflights descriptor storage and walks the canonical destination interval to two empty slots; every occupied slot must be the exact send-only authority represented by the current table or provider ledger. One process-local monotonic nonzero request sequence correlates each cwd transfer. The target accepts only exact ordered independent operation and cleanup senders, validates response correlation, rights, provenance, and endpoint-object independence, and routes implemented intrinsic I/O through the live candidate table. It retains the exact stream identity with both senders, shares its cursor across aliases, performs receipt-free digest-bound semantic release, accepts an exact tombstone NOT_FOUND retry, and deletes operation authority before cleanup authority. Ambiguous release retains only the cleanup sender and identity for retry; unexplained, missing, over-righted, query-uncertain, or hidden-receipt authority permanently poisons execution without a fixed-stream fallback. External commands use the already authenticated launchd route. Each complete launch record supplies distinct fixed child cwd and redirection-resolver destinations. Launchd creates a fresh cwd-bound resolver, vfsd registers its receiver, and procd installs only its attenuated send side; exsh never transfers or aliases its own resolver. Command-local PATH bytes order bounded selectors without conveying namespace authority. Exact not-found candidates advance the search, exhaustion returns status 127, and failed or terminal cleanup retires every temporary job and resolver alias or fails stopped on uncertainty. For a fully validated simple-command synchronous pipeline, exsh reserves every low-half logical stream identity and every typed job slot before effects. External utilities receive launchd reader/writer descriptions before expanded command redirections. A representable non-external command instead runs from its exact source in a fresh ext4 exsh.elf -c child, where parser-order redirections and built-in mutations remain isolated. Both paths commit all children before waiting left-to-right. The invocation-time pipefail setting and leading ! reduce only authenticated terminal statuses. Each pending slot owns exactly its returned status/control routes; observation consumes them, while partial submission or a later wait failure cancels every remaining job before the caller arena is cleared. Exsh never receives a pipe endpoint, and uncertain cleanup fails stopped rather than leaving residual job authority. The isolated child receives only explicit cwd, lifecycle, stream, and resolver authority plus exact set/unset, export, readonly, positional, and supported fiu option state. Nondefault or absent IFS and readonly set or declared-unset variables cross this boundary as descriptive LCS1 v1.8 records. Noncontiguous here-documents and unsupported option state fail before BEGIN; no fallback discards descriptive state or retains unwanted authority. The current exsh regular-built-in checkpoint adds getopts, umask, and command, while true and false accept and ignore operands. A fresh shell replaces inherited OPTIND with non-exported OPTIND=1; a descriptive mutation revision distinguishes an explicit restart from continued parsing of one clustered argument. Function return restores function-local positionals but preserves the shell-wide option cursor and creation mask, while an exact parenthesized checkpoint restores both. umask fully validates octal or symbolic input before changing its nine-bit value and attenuates only the mode of an already-authorized pathname-create request. command bypasses function lookup only for its unwrapped operand, uses command-local PATH or the fixed -p path /bin:/usr/bin, and identifies only descriptive function, built-in, or packaged ext4 utility names. These facilities add no resolver, launch, process, stream, endpoint, or capability authority. Their focused unit tests pass under warning denial, and the generated reference records the exact validated exsh revision. The focused ext4 VM reaches every regular-built-in check through command identification but currently fails its final default-path execution assertion; that failure is reserved for the separate debug pass rather than treated as completed runtime evidence. POSIX eval now joins expanded operands into preflighted caller storage, validates the complete deferred program before prefix or redirection effects, and executes it iteratively in the current environment. Nested eval, compound commands, functions, retained here-documents, exact status and leading negation, loop transfer, and function return use authenticated LIFO frames. A return erases only eval scopes owned by its invoking function, preserving an enclosing eval so it resumes at the exact next action. Every completion and error restores descriptor state and erases retained eval bytes and records. These arenas are descriptive only; exsh gains no endpoint, stream, namespace, process, launch, or capability authority, and rootd receives no eval state. POSIX dot (.) is likewise a special built-in rather than an external lookup. It accepts exactly one file operand, with -- available for an option-like name. Slash-free names search only the command-local PATH; names containing a slash bypass search, and an unset PATH supplies no ambient default. Exsh opens the selected non-executable file through its admitted cwd-scoped resolver, reads it through one temporary descriptor, and releases every provider capability before whole-program parsing. The validated script executes in the current environment through the same authenticated LIFO arenas, with prefix effects, redirections, here-documents, status, and return scoped to the nearest function or dot script. Completion and failure erase the pathname, source, parser, frame, descriptor, and capability scratch; rootd receives no script state or added authority. Fixed stdin/stdout/stderr descriptions are borrowed from the authenticated TTY session. An exiting child therefore leaves those shared endpoints open for its parent and siblings; only an explicitly delegated process-owned dynamic description carries an orderly-close obligation. Session hangup remains owned by the session lifecycle route rather than inferred from a process exit. The authority-free exsh library now also preflights one complete direct-launch transcript over borrowed program/cwd selectors, argv, environment, standard streams, mixed provider-backed or launchd-provisioned descriptions, and sparse descriptor aliases. It derives canonical zero-based dynamic description IDs, combined fixed/dynamic alias IDs, exact record/count/byte totals, send-only transfer instructions, and the SHA-256 transcript digest in reusable caller scratch before exposing any record or BEGIN/COMMIT request. The scratch is cleared on success and every failure. These records and transfer descriptors remain data in the library; the freestanding target connects them to launchd, authenticates reply authority, observes one terminal status, and performs exact abort and cleanup. Pathname expansion now consumes completed split command fields through exact borrowed requests and immutable pending/completed captures. An explicitly authorized evaluator retains namespace enumeration and current-locale collation-key generation; the library validates component, leading-period, ordering, uniqueness, completion, option/assignment bypass, literal fallback, and exact output rules before returning final byte-only fields. Discarding the origin map performs logical quote removal without transferring an evaluator callback, route, handle, operation, or capability into the language core. Case selector/pattern finalization now consumes one splitting-suppressed transaction field. The selector discards origins, each pattern retains them only through an exact source-order comparison request, and immutable pending/ completed captures contain one Boolean rather than a locale service. The first match suppresses all later pattern expansion; ;& executes subsequent bodies directly, and completion retains either no-match status zero or the last body status. No callback, process, stream, namespace, locale, or launch authority enters the language library. The documented choices preserve unknown dollar-quote escapes, consume at most two hexadecimal digits, reject an octal value above one byte, and discard a decoded NUL plus the rest of only that quoted segment. Regressions cover 20,000 positionals or initial/split/composed/traversed fields, dollar-quoted segments, tilde prefixes, or here-document expansions, 10,000 selected-word frames, and 300,000-byte positional/name/value/field/home/removal/body paths. Named-user table population, subshell descriptor inheritance, inherited function invocation in pipeline children, compound pipeline children when the parent function namespace is nonempty, noncontiguous pipeline here-documents, interleaved singleton current-environment entries, asynchronous execution and output capture, evaluator-backed nonportable locale pattern interpretation and collation-key generation, exported command-environment emission, and general non-function compound redirections now have authored host coverage. Complete POSIX conformance remains gated on the recorded focused-VM failures and current complete-catalog evidence rather than an unimplemented language surface.

Exceptional authority remains separately owned by powerboxd. A selector is committed as data, resolved only inside a transferred scope, correlated with ttyd session policy and trusted UI, installed through procd at one exact child slot, and tracked by a generational revocation handle. Denial and cancellation publish no authority. Vfsd mints a narrow exact-object endpoint per approved operation and retires it on one-shot use or an authenticated release transfer; powerboxd preserves its local alias until vfsd proves retirement. PBX1 sizes every retained request and grant record. Powerboxd is now a real ext4-only runtime-graph executable: rootd authenticates loaderd's staged endpoint and install grant, installs its five peer routes, retires all staging authority, starts the exact generation through procd, and requires typed readiness. It has no boot-store copy. Launchd's ext4 packaging and focused readiness VM workflow are complete; complete-catalog run 1468 also passes authenticated client launch through the initial tty session without a root-owned shortcut.

Exact entry mutation is provider-identity-bound before delegation. Vfsd alone sends the canonical mount-relative path during provider-private binding; the returned opaque handle retains parent and target identity or absence. Later mutation carries only that handle and VFS-derived basename data, so it cannot re-resolve a replaced selector. The focused replay and selector-race scenarios both pass in complete-catalog run 1468.

named is a capability router, not a shared string-addressed directory. Root alone seeds, seals, and activates publications. Each discoverable target has a separate resolution endpoint, and callers receive only the target scopes named by their startup policy. Foundation memory services start without logging or discovery authority.

Process orchestration, loader materialization, and driver lifecycle use three separate procd endpoints. Each endpoint admits only its operation family; loaderd cannot invoke root orchestration, and deviced cannot invoke loader materialization. Successful loader materialization preserves the exact staged generation beside the process ID. Every later lifecycle query supplies that complete descriptive pair, preventing PID reuse from selecting a different managed incarnation; authority still comes only from the caller's admitted procd endpoint.

Managed RAM allocation clears the complete kernel-selected physical range before the new frame capability is installed. One explicitly delegated, manage-only allocator-domain capability covers every authenticated usable-RAM extent; neither rootd nor memd can select a parent extent or physical address. Reclaimed RAM therefore carries neither stale bytes nor residual prior-owner authority. Concurrent rootd verification also accepts process identifiers reused according to procd's lifecycle contract and consumes each launch record exactly once. Driver restart verification confirms the replacement through deviced's running binding instead of requiring a different numeric identifier.

Loader materialization prepares every anonymous child page touched by a transport fragment before one kernel population operation. The kernel preflights the caller's complete readable range and the child's complete anonymous destination range, then streams the copy without a page-sized logical ceiling or partial-prefix write. Fresh anonymous frames already provide deterministic zero fill, so procd does not retain or transmit a redundant zero page. Loaderd assigns one checked load bias per runtime-graph object from actual mapped extents, so zero-based shared objects do not collide. Adjacent raw segments may share one aligned boundary page only when procd's combined final permissions remain non-W+X; raw overlap still fails before start.

Pager registration and kernel fault delivery also use distinct endpoints. Procd's transfer-bearing registration call delegates the child VSpace directly to pagerd; the kernel-owned fault channel has no userspace sender and only pagerd retains its receive binding. Faulting children receive neither endpoint. Only non-present user accesses with one semantic access are delegable; protection and security faults remain kernel-owned. The focused registered process write-protection scenario requires a kernel-policy kill and forbids every pager-notification marker.

Runtime capability-transfer tables are sender intent before a syscall and kernel-normalized receipts after delivery. The kernel preserves each installed destination and its actual rights in the delivered message. Receivers validate the complete receipt and revoke every alias they do not retain; pagerd and procd fail-stop if cleanup cannot be confirmed.

Memory-service requests carry explicit operation identifiers. Their services parse only complete, exactly sized typed bodies; ignored memd/vspaced flags, prefix-based dispatch, and compatibility padding are absent. Managed RAM mappings retain their backing through an explicit VSpace-owned reference, so pagerd and vspaced can drop transient frame aliases without invalidating a live process page. The allocator reuses the exact range only after both aliases and mappings are gone.

VFS open/create requests alone carry validated access flags. Mkdir, stat, readlink, unlink, and rmdir use compact flag-free path bodies across both the public and provider IPC boundaries.

The time service exposes monotonic snapshots, preserves its legacy synthetic wall-clock v1 operation, and owns the source-qualified UTC wall-clock v2 API. Only timed receives the private RTC-sample endpoint; it receives no CMOS I/O authority. The ext4-only private provider receives only sampling-only CMOS authority: fixed selector writes, data-port reads, and a send-only alias to the private route. It cannot write CMOS data, read the index port, mask NMI, select unrelated registers, be published through named, or be reached by general clients. It makes one bounded attempt, waits for timed to accept an exact stable sample before reporting positive readiness, and exits cleanly; ordinary absent, changing, or invalid hardware evidence leaves timed UNAVAILABLE. Deviced consumes the exact clean procd exit and retires its temporary child endpoint aliases. Rootd retains no RTC process or service endpoint; it only retires its exact raw-I/O, provider-route, and RTC-loader sources after their final transfers. The executable is never placed in boot.img.

Rootd transfers the public timed source only to named, vfsd, and launchd, then retires it after launchd's final installation. vfsd alone receives the filesystem query route. Its checked helper converts only HARDWARE_RTC or DEGRADED v2 evidence into a filesystem value representable as u64 Unix nanoseconds. After session, path, handle, and operation authorization, vfsd passes that value in one additive provider-v2 request. E2fsd, fatd, and ramfsd receive only descriptive timestamp fields over their existing provider routes, never a timed or RTC capability. Unavailable wall time keeps the unchanged v1 operation; malformed, synthetic, failed, or overflowing evidence reaches no provider mutation. Each provider applies its format-specific precision and representability rules, and uncertain post-publication failure is fail-stopped rather than returned as retryable success. Vfsd retains each mount's validated read-only bit. Namespace, exact-object, and redirection-stream read, enumeration, and symlink-read paths omit access-time evidence on those mounts and select the unchanged non-mutating provider operation; writable mounts retain normal atime propagation. Providers still enforce read-only state independently. The focused POSIX dot and five-stage exec VMs pass after this rule was extended to sourced-script streams. Rootd's Integration-only RTC reconciliation marker is emitted only after deviced reports the completed one-shot lifecycle and zero persistent identity. Readiness retry paths yield cooperatively and do not hold time authority solely for backoff; blocking deadlines await a scheduler-backed asynchronous contract.

IPC reply scheduling is application-protocol opaque. Every reply makes its blocked caller runnable as the deferred switch target while the replying server continues until its next block or yield; operation IDs, result bodies, roles, and endpoint slot conventions receive no special kernel treatment. At an explicit yield, the kernel first gives the next ordinary runnable TCB its round-robin turn and retains any preferred IPC handoff for the next blocking boundary. Sustained wake traffic therefore cannot starve a runnable polling driver.

Storage drivers receive explicit device frames and narrow service peers. Filesystem services receive explicit block and key endpoints. vfsd receives a root-only mount-control endpoint plus distinct namespace-session receivers: rootd retains read-write access, while loaderd receives only stat, open-for-read, read, and close. Handles are session-owned, and runtime images do not infer authority or validation behavior from the set of packaged modules. Packaging sizes vfsd mount and handle storage from explicit deployment configuration and embedded target layouts. The service reserves local records before providers create state, retains no allocator, and imposes no crate-wide record-count ceiling. Packaging likewise derives ramfsd mount records from only configured ramfs rows and requires explicit nodes per mount, file bytes per node, and private handle records. Each node owns one configured data extent, and create reserves both node and handle capacity before mutation. One deployment managed-process count sizes procd lifecycle/event state, pagerd bindings, rootd's five procd scratch ranges, and pager/vspace import windows. Rootd and procd consume one versioned lib-capabi multiplier for that window; empty addressable slots confer no authority. Vspaced uses a no mapping-record arena: exact operation-scoped receipts select the mapping authority and the kernel owns authoritative mapping and overlap state. Procd and pagerd borrow exact typed slices and retain no allocator over page padding. The private key service authenticates e2fsd through endpoint delegation; request bodies and startup material rows contain no caller-role claim, duplicated namespace selector, or compatibility padding.

Technical Manual

The manual is built from manual/main.tex:

./scripts/build-manual.sh

The generated PDF and build intermediates belong under out/ and are not source specifications.

The API-reference generator and its unit tests require pandoc; the manual CI image installs it alongside Python and the TeX toolchain before validation.

Part VIII inventories 33 public library crates and includes generated item-level references for all 33, including extop. The generator consumes warning-denied Rustdoc JSON, records the exact source revision and JSON digest, and fails its check mode when committed reference text is stale. Enum declarations that would exceed one rendered code page use one source line per variant so TeX can page-break them without omitting or abbreviating any public signature.

The manual documents current product contracts. Historical project sequencing belongs only in the planning archive and must not appear in API names, runtime markers, source layouts, or normative architecture descriptions.

Validation

markdownlint-cli2
python3 -m unittest discover -s tests -p 'test_*.py'
api_reference_json_dir=<rustdoc-json-dir>
python3 scripts/generate-library-api-reference.py \
    --json-dir "$api_reference_json_dir" --check
./scripts/build-manual.sh

Documentation changes must also pass:

• link and identifier review against current component source
• TeX review for overfull boxes, undefined references, and page-boundary overflow
• focused integration checks for any changed runtime contract
• a repository scan ensuring planning labels have not re-entered product documentation

The operational manual fixes every complete-catalog VM at one 120-second absolute ceiling and a separate 45-second no-serial-progress ceiling. The hard ceiling is about 1.76 times the healthy 68.2 occupied worker-second mean and cannot be widened by a scenario or environment override. It also documents rootd's single proof-gated resubmission after a pre-acceptance procd receiver absence. Exact worker archives prune generated and cache directories before fallback source-identity traversal, while retaining every source path and byte in the digest. Neither host watchdogs, provenance hashing, nor the retry introduce authority.

The shell chapter also records same-line asynchronous here-document job capture: descriptive body bytes rotate in caller-owned storage so the isolated child receives one contiguous unit and the parent reparses its untouched successor. No source arena or authority is added.

Generative AI Contribution Policy

Generative AI assistance is permitted for code, tests, documentation, review, and analysis under the EriX Generative AI Contribution Policy. The contributor remains responsible for understanding, reviewing, licensing, validating, defending, and maintaining the complete contribution. Tool output and tool-predicted test results are not evidence.

Attribution is optional. Neither Assisted-by nor Signed-off-by is required, and their absence is not grounds for rejection. Optional attribution may appear in a commit body when it helps review, but it does not replace the canonical title, body, and rationale format.

Clean-Room Policy

• Do not copy external source or documentation.
• Do not add external Rust crates.
• Do not use generators that embed third-party code.
• Cite externally defined standards only where policy permits and keep EriX implementation text independently authored.

Extended compatibility images may package explicitly approved third-party programs as data. Such packages do not become part of the EriX trusted computing base.

License

This repository is licensed under the ISC License.

Development Model

Documentation changes follow the same coordinated, reviewable development model as implementation changes. Shared contract updates must include their owning component, direct consumers, focused validation, and the corresponding manual or specification text.

Governance Principles

• Product documentation describes current behavior, not implementation history.
• Planning records do not define product terminology or compatibility policy.
• Pre-alpha ABI cleanup may be incompatible when it removes obsolete, misleading, or authority-bearing fields; direct consumers migrate together.
• Security and authority claims require implementation and validation evidence.
• Non-obvious design choices require documented rationale and review.

Contact

Development occurs in the EriX organization. Maintainers can be reached at admin@erikinkinen.fi.