[FEATURE] Enforce complete inline documentation and warning-free documentation builds #1

New issue

Open

opened 2026-09-12 07:56:22 +02:00 by erikinkinen · 0 comments

erikinkinen commented 2026-09-12 07:56:22 +02:00

Owner

Copy link

Problem and motivation

Auditable Rust APIs need documented ownership, authority, failure and unsafe invariants across every target. Existing prose and a public-item lint alone cannot demonstrate that private code, build scripts, examples and manual outputs are adequately documented.

Proposed behavior and scope

Inventory every crate target, enforce missing_docs without blanket escape hatches, document public and private contracts, and run warning-denied rustdoc with private items. Reconcile canonical component documents, headers, API references, manual pages and the technical manual.

This issue records planned work; its unchecked criteria are not implementation proof. The normative basis is Phase 6 and AC1–AC24.

Authority, security and reliability

Documentation must state real capability sources, lifetimes, denial and cleanup behavior rather than infer authority from names. Shared governance remains byte-identical to meta. Non-Rust code uses the language’s own comment format, and security-sensitive details stay in restricted reporting channels.

Apply the priority order: security, reliability, then performance. Keep suspected vulnerabilities in the repository’s restricted SECURITY.md reporting channel.

Acceptance criteria

• Inventory every crate root and target, including binary-only, build-script,
  test/example and nested crates; identify existing missing_docs enforcement and every local
  allow/expect/doc-hidden escape.
• Document crate/module purpose, trust boundary, owned/borrowed state, lifecycle,
  authority and error contracts using //!//// rustdoc comments.
• Document every public item, field, variant, constant, associated item, macro and
  FFI export with semantics, units, ranges and failure behavior.
• Document private functions, structures, fields and non-obvious algorithms as well;
  explain concurrency, mutation order, cleanup, complexity and invariants. missing_docs alone
  is not a private-code completeness audit.
• Give unsafe APIs # Safety, and fallible/panicking APIs accurate # Errors/# Panics sections where applicable. Document each unsafe block's concrete invariant and why
  safe alternatives do not cover the operation.
• Enforce #![deny(missing_docs)] or an equally non-bypassable shared lint policy in
  every EriX-authored crate/target; reject weakening attributes. Do not use blanket allowances,
  dummy comments or doc-hidden to pass the gate.
• Add private-item documentation review/check coverage and run Rustdoc with
  --document-private-items; validate broken links and examples with RUSTDOCFLAGS="-D warnings" across supported target/feature profiles.
• Ensure CI actually checks missing_docs in default and alternate feature builds, not
  only one public-library configuration; add a negative fixture proving undocumented public API
  fails the shared policy check.
• Document non-Rust authored code inline in its language's supported comment format,
  including shell/Python tools and assembly boundary contracts. Do not pretend rustdoc parses
  unrelated languages.
• Update meta standards/templates and propagate necessary policy changes
  deliberately. Repair stale canonical GenAI policy links to
  docs/policies/generative-ai-contributions.md; keep attribution optional.
• Update README/ARCHITECTURE/ROADMAP and relevant manual chapters for each
  implemented ABI, realm, POSIX service, toolchain, profiler and build step; keep historical
  measurements separate from current guarantees.
• Regenerate API references, test examples, build the whole manual, check final
  warnings/overflow/links and visually inspect changed rendered pages. Record toolchain/source
  provenance for the generated documentation.
• Update canonical templates and every repository README to remove
  current-status/progress/checkpoint sections; put concise current state in ROADMAP/ARCHITECTURE
  and detailed historical evidence in linked issue/reports.
• Refactor long README/ARCHITECTURE/ROADMAP paragraphs and exhaustive lists into
  short summaries plus focused design/API/operator documents. Preserve canonical headings,
  discoverability and normative invariants; do not hide important authority limitations or move
  status into another README section.
• Keep help text, man pages, rustdoc, C headers, IPC specifications and technical
  manual consistent through shared semantic metadata where useful; validate coverage and
  examples, not merely that generated files exist.

For each implementation slice, retain actual formatting, strict Clippy, unit/doctest and warning-denied build results for all altered Rust repositories and valid configurations. Add relevant runtime VM coverage, monitor older unit/VM regressions in exact-head CI, and update canonical component documents and affected technical-manual/API material. Every authored code file must remain below 1,000 physical lines, with meaningful inline documentation and missing_docs enforcement in Rust crates.

Alternatives and tradeoffs

Dummy comments, hidden APIs and lint allowances make checks green without helping a reviewer. Keep useful inline invariants, concise canonical navigation and detailed contracts in their owning API/manual documents.

Validation checkpoint — 14 September 2026: Signed Docs 013ec09aafd9412990fec8231ceb73e7d1a1c94f records all 156 public issues. All 45 documentation tests and 55 Markdown files pass. Manual/API/build inputs remain byte-identical to the preceding accepted source. CI 847 and 848 pass with four complete logs totaling 752,642 bytes. Both manual jobs converge through 2,325/2,339/2,339 pages and 31/1/0 reference warnings, with no final layout warnings. The reported PDF is 4,114,917 bytes; no CI artifact bytes were downloaded.

Validation checkpoint — 14 September 2026: Signed Posixd 52ef820d33399490c121aad3af1409139e4a8f44 selects the proposed realm custody owner: Procd deposits an ancestor SEND-lineage revoker into its exact native generation before export and retains a nested guard for earlier realm retirement. Exported aliases descend from the nested guard; ancestor-only bypass and setup aliases must be removed before publication. Kernel supplies the existing terminal trigger; children, provider leases, receiver aliases and pending operations retain separate owners and acknowledgments. This is a documented design; Posixd has no executable crate or implemented realm handshake. Posixd CI 5 and 6 pass with complete warning-free logs. Signed Docs d9bb106b94deb7c2af620775dc98be0cc46ae704 updates the process-services manual and records the separate owned invocation design. All 45 Docs tests and 55 Markdown files pass. The 2,341-page local manual has zero final warnings; 426,812 word boxes fit page bounds and the changed page was visually reviewed. Docs CI 849 and 850 pass; their manual jobs converge through 2,327/2,341/2,341 pages and 32/1/0 reference warnings, with no final layout warning. All six complete Posixd/Docs job logs total 760,808 bytes. Runtime producer adoption, realm byte I/O and both complete guest build generations remain open.

Allocator validation checkpoint — 14 September 2026: Signed Docs 5b171773c78938b78d0b6d9865d50ece8535682f records all 158 public issues. All 45 documentation tests, Markdown and heading checks pass. Rendered manual/API/build inputs are unchanged from the accepted realm manual. CI 851 and 852 pass with four complete logs totaling 753,560 bytes. Both manual jobs converge through 2,327/2,341/2,341 pages and 32/1/0 reference warnings, with no final layout warning. Static inventory covers 76 repositories and 2,890 code files below 1,000 lines; all 92 library/binary and 62 additional standalone test/example/bench/build-script roots directly gate missing_docs. This does not establish private-documentation quality or whole-authority closure.

Endpoint construction checkpoint — 14 September 2026: Signed Docs e923440acecfe775ed71a4f046b8e7daa3d25447 documents explicit endpoint construction and the proposed request/result custody obligations. All 45 documentation tests and canonical Markdown/structure checks pass. The local 2,341-page manual has zero final warnings; all 426,861 word boxes fit the pages and changed page 183 is visually reviewed. CI 853/854 passes with four complete logs totaling 753,568 bytes. Both manual jobs converge through 2,327/2,341/2,341 pages and 32/1/0 reference warnings, with zero final layout warnings. All 158 public issues remain indexed.

Completed CI checkpoint — 15 September 2026: Signed Integration a869a81eb406a4f027a2b5db573b6330ca114d94 passes both 1607/1608; signed endpoint-construction checkpoint 989d44d604d07c4c9bcc23264912bdf2076b99eb passes both 1609/1610. Each run reports all 486 distinct VM scenarios passing, followed by the actual native lifetime scenario, physical/serial interactive checks and all four console modes. Rust and Markdown pass. The two six-log cohorts contain 26,769,289 and 26,769,316 bytes respectively, with zero warning candidates. The previously observed intermittent quota timeout remains documented without a causal-fix claim. These results establish the selected source checkpoints, not owned invocation transport, complete authority closure or either full in-EriX build generation.

Native transfer preparation checkpoint — 15 September 2026: Signed Docs 0fe830c906bc95255d4be18413b0c054bf224e0c documents complete native transfer preparation and the pre-delivery rollback serialization boundary. All 45 documentation tests and canonical Markdown/structure checks pass. The complete 2,341-page manual has zero final warnings; all 426,948 word boxes fit the pages and changed page 144 is visually reviewed. Docs CI 855/856 passes with zero final warnings; intermediate reference passes converge through 32/1/0 warnings. All 158 public issues remain indexed. Generated API/build inputs are unchanged. This implements preparation for the current IPC path. Its private records cannot survive userspace scheduling and own no retained source authority. Persistent request/result bytes and capability custody, exact delivery state and terminal hooks remain unimplemented under Kernel issue 11. No opcode, wire record, bootstrap-frame escrow eligibility or application-cancellation semantics are assigned.

Native invocation custody checkpoint — 15 September 2026: Signed Docs 76b657ad8b8ba8df7f55f17ce739301a80d22802 indexes all 159 public issues, including the canonical fixture bug report. The native custody manual checkpoint 073da485626c3d74f68d0beb2da47ac8400c23d3 passes CI 857/858: 45 tests, 2,343 pages and zero final warnings after 32/1/0 reference convergence. Local layout review checks all 427,174 word boxes within page bounds and visually reviews changed page 144. The later index-only checkpoint passes all 45 tests and changes no manual or generated API/build input. Corrected signed-head Kernel CI 548/549 and Docs 859/860 pass. All 8 complete logs total 1,413,966 bytes, with zero final warnings. The terminal cohort is classified. The syscall wire adapter, fresh userspace buffer/fault/overlap validation, authenticated caller-origin delivery fields and actual CPL3 owned-invocation peers remain unimplemented. Reachable backend disposal-failure coverage, sustained invocation-workload profiling, realm producer adoption, whole-codebase authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire record is assigned; the existing CALL/RECV/REPLY ABI is unchanged.

Authenticated delivery-origin checkpoint — 15 September 2026: Signed Docs c728670ccc57a1c200b1bfc2ebb359920c1a2256 updates the technical manual and roadmap with the origin/liveness/authority distinction. All 45 tests pass; the complete 2,343-page manual has zero final warnings, all 427,252 word boxes within page bounds, and visual review of changed pages 144/145. CI reference passes converge through 32/1/0 warnings. The public index retains all 159 issues; no new issue is introduced by this slice. Kernel CI 550/551 and Docs 861/862 pass. All eight complete logs total 1,414,891 bytes, with zero final warnings; the cohort is classified and stopped. The separate earlier fixture correction remains closed in Kernel issue 13, preserving original CI 546/547 and corrected 548/549. Sustained invocation-workload profiling, syscall wire and fresh-buffer/fault/overlap validation, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm producer adoption, whole authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire layout is assigned. Native progress and cleanup still do not certify application cancellation.

Native invocation profiling baseline — 15 September 2026: Signed Kernel 6cb703e1ed8b9de0d29a37189cd914cd501e732e provides an actual-object host workload for queued progress, collected progress, descriptive result reads and complete request/result cycles. Signed Integration f3e4359b34cb8f7db732fbf38823f722553c86d4 adds bounded capture, raw-evidence report verification and equivalent comparisons. Every sample checks exact bytes and SEND capability bindings, authenticated origin, foreign selection, duplicate completion refusal, FIFO position reuse, one-time collection and final invocation disposal. Source and executable bytes are observed against explicit original identities; compiler/host relationships remain declarations. Workload children and source Git reads receive minimal environments; capture owns memory, time, output and process cleanup. Completion is published only after deadline teardown succeeds. The operator guide and signed Docs 644273a0edd91e4c38dcd4418d6ae1119ff1f10b describe these boundaries. Kernel strict default/all development/release checks pass 632/656 units plus three standalone controls, three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. Integration passes all 161 helper commands, including 19 profiler controls and nine source-provenance controls, plus fresh strict 320/321-unit Rust matrices, private rustdoc and warning-free target builds. Four original socket-fixture failures are retained and attributed to the selected temporary directory exceeding the host Unix-socket path domain; a shorter explicit private directory passes the same fixtures. Docs passes 45 tests and renders 2,345 pages with zero final warnings; 427,592 word boxes fit page bounds and changed pages 2284/2285 pass visual review. Kernel CI 552/553 and Docs CI 863/864 pass; eight complete logs total 1,431,762 bytes with zero final warnings after manual reference convergence. No Kernel performance algorithm has changed in this baseline. Native syscall adapters, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The 76-repository inventory has 2,923 code files below 1,000 lines and 155 direct missing_docs crate-root gates; this does not close the semantic audits.

Measured native invocation lookup refinement — 15 September 2026: Signed Kernel 8349d68636382cc7e25a3347f5f1df216554203a retains only numeric carrier-search positions. Every use rechecks the actual CSpace capability type/rights, live endpoint identity and exact binding; stale positions take the complete search path. No successful authorization, capability or reference is cached. Draining scans fix their boundary on the first poll, visit each position at most once, skip busy stack owners and return exclusive custody after unlocking. Native disposal and first-failure retention preserve their existing semantics. Signed Integration 108501cf7ec20f05dd3d62ea401ea8adad6c6e9c selects this Kernel in its isolated native catalog, and signed Docs f10a1d375a326543ec0adda4569bc7cb4faca9b6 documents the invariants. The existing syscall ABI and ordinary image catalog are unchanged. All 15 actual-object native controls pass, including real alias compaction, rights/type/object replacement, busy ownership and allocation-free settlement. The unchanged four-mode workload control also passes. Full strict default/all development/release Kernel matrices pass 634/658 units plus three standalone controls, with three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. The existing native lifetime and entry-argument VM passes unchanged oracles in 21.978041 seconds of host build-and-run time, with clean teardown and empty QEMU stderr. Its signed boot image is 2,207,744 bytes, SHA-256 4030cdfb8a13c000ff4716ecdc5203cb46273d6117a282f7375f25dccbbeedc9. Exact unchanged Integration Rust/helper bytes preserve the preceding strict 320/321-unit matrices and all 161 helper-command results; changed catalog/scenario policies pass. Docs passes all 45 tests and a complete 2,345-page render with zero final warnings, 427,679 bounded word boxes and visual review of page 145 plus continuation page 146. The original signed Kernel 6cb703e1ed8b9de0d29a37189cd914cd501e732e and the new signed Kernel use byte-identical workload sources, the same selected CPU/toolchain/context and explicit limits, distinct source targets, four modes, populations 0/32/128/512 and 256 operations per sample. Each capture retains 48 measured samples and 16 warmups; every sample passes actual semantic and native/process-cleanup checks. At population 512, median queued-progress cost changes from 117.578 to 37.673 microseconds (3.12x observed ratio), and full-cycle cost from 1167.847 to 443.055 microseconds (2.64x). Collected progress changes from 8.928 to 6.015 microseconds and descriptive reads from 9.124 to 6.212 microseconds. Timings include fixed checks, with no subtracted overhead or timing-ratio pass gate. No managed build/test workload runs concurrently during capture; external host scheduling remains unisolated. These are host operation wall times, not guest startup/build acceptance or a statistical guarantee. Kernel CI 554/555 succeeds; four complete logs total 679,280 bytes with no warnings, and its completed cohort is stopped. Docs CI 865/866 succeeds at observation three; four complete logs total 754,424 bytes, all 45 tests pass and each manual has 2,345 pages. Its normal reference passes report 32/1/0 warnings, with zero final warnings and no box diagnostics. The completed Docs cohort is stopped. Integration CI 1619/1620 is waiting at its first observation. Older Integration 1613/1614 is running; 1615/1616 and 1617/1618 are waiting. Accepted older Integration 1611/1612 passes all 486 catalog scenarios and later probes with complete warning-free logs. This does not establish the intermittent quota cause tracked in Integration issue 18. Current full-suite CI remains required; stopped cohorts are not polled again. Owned syscall wire adapters, actual owned CPL3 peers, fresh-buffer validation, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The refreshed 76-repository inventory has 2,924 code files below 1,000 lines and 155 direct missing_docs crate-root gates; those checks do not close whole-codebase semantic audits.

Owned invocation wire and native acceptance — 15 September 2026: Signed Kernel 5f497adaefa526108a0439e0e071717dddb85334, shared IPC de968da19898bef532ddb3b5974bb9562f51dee5, capability ABI a001a26f0eb3aebec3f5fd02a28d98f1bc23f8a0 and Integration 9030b217c490db6ad3ec60a799cb025eccbfcdb1 implement and exercise the immediate owned invocation boundary. The allocation-free shared codecs and shim preserve exact return metadata, including a retained draining owner on failed submission. The Kernel checks fresh complete user mappings and packet framing under one lifecycle guard before native effects. No user pointer or caller-selected identity is retained. Destination capacity and descriptive receipt capacity are independent; spare capacity acquires no authority and repeated collection cannot duplicate transfers. Existing numeric binding hints still recheck live capabilities on every use. The real three-process CPL3 scenario passes all eight operations, full-span pointer/rights/overflow/reserved-field rejection, actual returned selectors, payload/capability/origin checks, collection after server exit and repeated receipts. A second request rejects premature relinquishment, enters draining on caller release and retires only after the exact server acknowledgment. Current signed owned and unchanged older lifetime images are each 2,232,320 bytes, with SHA-256 588c6097c57ebd2ed92e0f0b76f2b1ad6b82630b4a0da272ee98e218eb8e333d and 8f9026aaefd2c5a745e35467ac01c71789c5f469f9cd42a477f87818747ee673 respectively. Both runs have clean teardown and empty QEMU stderr. Ordinary images contain neither diagnostic hook. Strict default/all development/release host, freestanding and rustdoc matrices pass: IPC 368 units, shim 20, capability ABI 191, Kernel 642/666 and Integration 320/321. Existing ignores remain one shim and three Kernel tests. All 162 maintained Integration helper commands pass; three prior correct concurrent-run lock refusals are retained and their sequential checks pass on unchanged executable inputs. Docs 46da7a4cb4d38a2bea5b5491a68f51f33e4b4305 publishes the normative register/packet contract and regenerates the three affected API references from original signed revisions. All 45 documentation tests pass. The complete 2,363-page manual has zero final warnings, 430,365 word boxes within page bounds and reviewed changed ABI/API pages. Shared IPC CI 337/338 and capability ABI CI 214/215 pass with eight complete warning-free logs. Both Kernel revisions pass CI 556/557 and 558/559 with eight complete warning-free logs. Those cohorts are stopped. Current Docs CI 867/868 passes at observation four; four complete logs total 758,328 bytes. Both 2,363-page manuals pass all 45 tests, report normal reference-pass warnings of 32/1/0, and finish with zero warnings or box diagnostics. Its cohort is stopped. Current full Integration 1621/1622 is waiting. Older full Integration 1613/1614 now passes all 486 catalog scenarios and later native/console probes, with six complete warning-free logs; its cohort is stopped. Older 1615/1616 is running, and 1617/1618 plus 1619/1620 are waiting. Current full-suite acceptance remains open, as does the intermittent quota cause in Integration issue 18. This checkpoint supersedes the earlier pending wire/CPL3/manual status. Reachable backend disposal-failure coverage, broader revocation/generation-reuse scenarios, producer adoption, realm runtime, complete authority/inline-documentation audits and both full EriX-in-EriX build generations remain open. The current inventory checks 76 repositories, 2,943 code files below 1,000 lines and 157 crate roots with direct missing_docs gates; it does not establish semantic audit closure. No complete guest build or guest performance result is claimed.

Process-bound native acceptance — 15 September 2026: Signed Kernel 60da5858d7198185efd103f0e91e5ac2e0b63e67 implements control operation 52, checking the actual moved install grant against expected process/generation with exact rights, including zero, under existing endpoint policies. Signed Procd f1105706cc19ed024a6cca79a29abc57c90c6661 uses this operation in its actual ordinary launch-description producer while retaining the narrow SEND receipt, pending state and exact failure cleanup. IPC c453b697b8cdb9cc1c36f1ad89ff868648190025, capability ABI fe8d558253ad01301b99554e20d287c4ea35bb1d and five aligned helper commits preserve original Git/type identity. Integration 58c925c564b69bebce8df6f3e75a9312824e18c4 passes the expanded lifetime CPL3 scenario with thirteen actual control calls, user-side reply checks, two staged children and full added-custody disposal. The corrected lifetime image SHA-256 is 8e6a9e8f68b90cc1ede61300958cec122b82a7c6dfd6318a51e40fefc7ba166e; the unchanged owned-invocation scenario also passes with image SHA-256 b76a380d3cd6b03b0ff61a3b626ace0667679920684ad7356a1c3a36e2224953. Both have clean teardown and empty QEMU stderr. The initial fixture setup-order failure is retained and corrected in Kernel issue #14. All strict default/all development/release matrices pass: IPC 371, shim 20, capability ABI 191, Kernel 648/672 including standalone controls, Procd 227/232 including auxiliary binaries, and Integration 320/321 tests. Existing native-only ignores are unchanged. Procd passes forty native binary builds with repository linker scripts. All 162 Integration helpers pass after updating the exact policy assertion to require the new marker; its initial mismatch remains recorded. Docs b0fcf0f43af2af741d520a0b1373cc346e08863c updates the native wire/ownership contract, operation registry, Procd boundary and three generated shared APIs. All 45 tests and the complete 2,367-page manual pass, with zero final warnings, 431,138 word boxes within page bounds and four reviewed protocol/API pages. Current IPC 339/340, capability ABI 216/217, Kernel 560/561 and 562/563, Procd 266/267, Docs 869/870 and all five helper push/review CIs pass with complete classified logs and no final warnings. Those component cohorts are stopped. Current full Integration 1623/1624 waits at observation 01. Older full Integration 1615/1616 is running at observation 11; 1617/1618, 1619/1620 and 1621/1622 wait at observations 09, 07 and 04. No pending full suite is counted as passed. Typed realm bootstrap, mediator startup/readiness/configuration/seal, complete consumer image adoption, fair terminal/provider retirement, broader native disposal failures and both full EriX-in-EriX build generations remain open. The new inventory covers 76 repositories, 2,950 code files below 1,000 lines and 158 direct missing_docs crate-root gates; complete inline documentation and whole-codebase authority closure remain open. Prior performance measurements retain their original signed source identities; this checkpoint claims no new timing or guest performance result.

Corrected native staging checkpoint — 15 September 2026: Signed source 8ef5d838392a7918398008ce5c19d5b1885af0da is recorded in the current review. Document the staged mediator contract and regenerate shared IPC and capability API references from original signed sources. All 45 tests, API generation/checks, Markdown and template checks pass. The full manual renders 2369 pages with 431570 in-bounds word boxes and zero final warnings; pages 210, 640 and 1370 were visually checked. CI 871/872 passes with complete classified logs, reference passes converging to zero final warnings. Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed.

Artifact boundary checkpoint — 15 September 2026: Signed documentation 507ae8f0840e7c40e848f4653e238e5e70d57d8d adds the corrected artifact boundary contract and distinguishes minimal bootstrap linking from the interactive product library. All 45 documentation tests, canonical formats, Markdown and whitespace checks pass. The complete manual renders 2,375 pages with 433,590 in-bounds word boxes and zero final warnings; changed page 2330 passes visual review. Original API snapshots remain unchanged. Rust, image and VM checks do not apply to this documentation-only change. Docs CI 881/882 passes with all four complete classified logs and no final warnings. Review: #4.

Shell workspace documentation checkpoint — 15 September 2026: Signed Exsh b12e172e7b266842a8659104894f6821166165fb owns ordinary and emergency transport in distinct version-22 authenticated workspace slices. Descriptor startup rejects short or dirty cleanup storage before metadata effects; transactions exclusively reborrow the complete slice and erase it after emergency cleanup. The global UnsafeCell accessor and automatic 32 KiB cleanup array are removed. Larger valid caller slices retain their complete extent. Existing provider retirement, metadata rollback and uncertain-cleanup behavior remain enforced.

All 961 Rust tests pass in each default/all-feature/production development/release configuration, with formatting, strict host/native Clippy, private rustdoc and eight native builds without warnings. Four added tests cover workspace disjointness, malformed backing, complete caller extent and consecutive cleanup reuse; existing cleanup controls now also check buffer canaries and erasure. All 73 warning-denied checker tests pass.

Both actual optimized native fallbacks measure 48 local bytes, compared with the retained prior 32,816-byte frames. Their full checker reports remain INCOMPLETE: runtime/all graphs contain 691/604 unresolved observations, and the old 32 KiB initial stack-reservation requirement still needs a workspace-specific evidence contract. Ordinary-source membership and direct-versus-nested early-drop bounds remain open. The 8/33/56 KiB upper limits and 64 KiB stack are unchanged; this measurement is not an all-path stack-safety claim.

Matching producer 38424571b76b36c1e631d99fd2c859fb32311eea exports/consumes 96 capacity words plus 72 target layout words, reserves both transport arrays first and rejects old/mixed layouts. Packaging both actual optimized shell configurations under canonical dev/release policies derives 4,300,800 workspace bytes, with unchanged executable bytes and a separate 64 KiB stack. All 162 Integration helper commands and its strict 320/321-test Rust matrix pass, including four native builds. These are private artifact and host checks, not guest execution. The product catalog still selects the earlier shell; coordinated catalog adoption and matching runtime VMs remain required.

Documentation 79cdd4c3694e800091b55c737fca04c7bdd3d071 describes the ownership and compatibility contract. Its 45 tests and canonical checks pass. The full manual renders 2,375 pages without final warnings; all 433,713 word boxes are in bounds and changed page 2280 passes visual review. API snapshots are unchanged. Exsh CI 225/226 fails only the incomplete frame gate after 961 Rust and 73 checker tests; all four logs total 311,820 bytes with zero warnings. CI runtime/all graph observations are 662/587 and both fallbacks measure 48 bytes; these artifacts remain distinct from local images. Docs CI 883/884 passes with all four complete logs (762,212 bytes); reference passes converge with 35/1/0 warnings and zero final warnings. These component cohorts are fully classified. Integration CI 1637/1638 remains queued at its first observation. No full build within EriX or whole-codebase authority closure is claimed.

Complete native companion checkpoint — 15 September 2026:

Signed Integration db80a2c1dfc669bd724762d476f5f5c0da005ff6 centralizes the complete eight assembly input roles plus the original producer script. Source selection and support-manifest validation share those roles; both outer artifact keys bind the contract module. The catalog changes only native lib-cstd to original bdcbbea43550e8b99cd9a8221e4bc5a645637990. Exact path/byte, tool, waited status, cleanup and output checks remain required.

Actual hidden/public production and missing/extra/altered receipt controls pass, as do both outer cache-key controls. All 162 helper commands are covered: 160 pass in the full run, and the two corrected test-only fixtures pass separately. The original missing-module and unclosed-fixture-stream failures are retained. The strict 320/321-test Rust matrix, Clippy, formatting, private rustdoc and four native builds pass without warnings.

A host-built diagnostic native image contains 38 executables and 27 shared objects, passes closure checks and builds without warnings. Its SHA-256 is ff5d774308cdf236c860a2423adab6e2594bf3c0991b26eb37cb3c64af96ddfe. It uses 73 original component selections with 72 coherent Cargo manifests and the five explicitly recorded helper corrections whose bytes match this signed checkpoint. It is not an unmodified product catalog. The unchanged editor/history, inherited-stream timing and runtime-error VM probes all pass with their original 120/15/10-second budgets and exact output checks; each leaves the source image unchanged.

Signed Docs 31bd9524c31c9d8d6a8f00248f702e6b7d428106 explains the complete source contract. All 45 tests and canonical checks pass. The complete manual renders 2,375 pages without final warnings; all 433,817 word boxes are in bounds and changed page 2281 passes visual review. Original API snapshots are unchanged. Docs CI 885/886 passes with all four complete logs (762,204 bytes); reference passes converge with 35/1/0 warnings and zero final warnings. Integration CI 1639/1640 remains queued at its first observation; the build compatibility issue stays open pending its complete CI. Full Exsh frame proof, coherent product adoption and both complete EriX-in-EriX build generations remain open.

Paired workspace and literal command evidence — 15 September 2026:

Signed Docs 5d77dc2b82bf5439e58234d901e30f4565aaa81a documents the independent pristine/packaged ELF workspace mapping domain, its native-loader assumption and the separate source borrowing, erasure and all-path frame obligations. It also fixes 24 existing inline long options and argument delimiters whose ASCII double hyphens previously became an en dash (issue #8). Numeric ranges, prose punctuation, verbatim command blocks and original signed API snapshots remain unchanged.

All 45 documentation tests, canonical and Markdown checks pass. The complete manual has 2,375 pages, 433,924 in-bounds word boxes and zero final warnings. Text extraction confirms literal option bytes, including embedded set -- and standalone delimiters; nine affected pages pass visual review. PDF SHA-256: fd33102422cc80697ead3f5c939b39d1e9c6bf69ce06475be4ce8767cafb2f23. The first render's punctuation failure remains recorded separately; the accepted PDF comes from the final corrected source. Docs CI 887/888 passes with all four complete classified logs (762,236 bytes). Both manual jobs pass 45 tests and converge with 35/1/0 reference warnings, leaving zero final warnings; both Markdown jobs pass. Rust and VM checks do not apply to these documentation-only edits.

Native RELRO manual — 16 September 2026: signed Docs 2560e70884ddcb1b2f262ef74ea0dd30084d4259 documents protected-page validation, exact final mapping fragments, the writable initial stack and privileged construction writes over an unstarted child. All 45 documentation tests and canonical checks pass. The complete manual has 2,375 pages and 434,088 in-bounds word boxes, with zero final warnings; both changed pages pass visual review. Exported API snapshots are unchanged. Loaderd CI 93/94 passes with all four complete classified logs (109,621 bytes) and zero warnings. Docs CI 889/890 passes with all four complete classified logs (762,216 bytes); both manual jobs pass 45 tests and converge with 35/1/0 reference warnings, leaving zero final warnings. The earlier diagnostic native command sequence passed while its permission observation failed; the subsequent repaired checkpoint below supersedes that scoped result. This checkpoint does not establish complete runtime permission, frame, authority, realm or guest-build acceptance.

Native permission checkpoint — 16 September 2026: signed Kernel 32c70109fe7663440aa56de6a49975accc1f0057 carries explicit live execution permission through single-page, batch and permission-only mappings. Data and construction aliases remain non-executable; ancestor promotion and splitting preserve neighbouring restrictions. Processor activation validates and enables execute-disable support on the bootstrap and application processors. Seven independent controls accompany the repair. Strict default/all-feature development/release suites pass 666/690 kernel unit tests plus two external controls per selection, retaining three existing ignores. Host/native Clippy, private rustdoc, formatting and ten native builds pass without warnings.

Separate one-CPU and two-CPU diagnostic VMs pass the unchanged native command sequence. A read-only hardware observer matches all 233,755 selected coreutils executable bytes, verifies CPL3 and enabled paging/execute-disable state, and confirms both observed RELRO pages are user-readable, read-only and non-executable; the current stack is user-writable and non-executable. Both processors report execute-disable enabled. This is an exact process-entry/table observation, not an injected instruction-fault test or whole-system permission proof. The diagnostic image SHA-256 is 8c3c24639e8e1ca8c4f2ad4e485323abf32ec07408241c3e4fa9713f6e07e812.

Signed Docs d221e725c2543316680e63fc5e8314ce0fe3bdf1 documents the mapping and processor contracts. All 45 documentation tests and canonical checks pass; the 2,375-page manual has 434,308 in-bounds word boxes and zero final warnings, with three changed pages visually reviewed. Exported API snapshots are unchanged. Kernel CI 574/575 passes with four complete warning-free logs (708,112 bytes), including existing optimized workload examples. Docs CI 891/892 passes all four complete logs (762,176 bytes), with 45 tests per manual job and zero final warnings. The later maintained permission regression is recorded below. Full frame proof, whole-codebase authority/documentation review, runnable realms and both complete guest build generations remain open.

Maintained permission regression — 16 September 2026: signed Integration 89d15e4536004c087dcebd63c87216c0fd58958d supplies the explicit-input runner, pure ELF/page-table checks and read-only GDB observer. The final maintained source passes 21 independent host controls and the complete strict default/all-feature development/release Rust matrix, host/native Clippy, private rustdoc, formatting and four native builds. Canonical checks pass after correcting one Markdown line wrap. Both host groups are wired into ordinary CI. All 2,995 inventoried authored code files are below 1,000 lines; this is physical size evidence, not semantic authority closure.

Actual one-CPU and two-CPU runs on the repaired diagnostic image pass the original native-time command sequence and the expanded hardware checks: all 58 selected code pages are user-readable, read-only and executable; both RELRO pages are read-only/non-executable; the current stack is writable/non-executable. Complete executable bytes match and NX interpretation is enabled on every selected processor. An earlier image is rejected by the maintained observer. Both child outcomes, exact original input bytes and temporary cleanup are retained, with empty debugger stderr in both positive runs. The final cleanup code also preserves reaping when a direct child exits between poll and termination.

The command's image CI gate awaits adoption of a coherent product catalog containing both required component fixes. Its explicit diagnostic invocations do not silently replace the older maintained image graph. Signed Docs 3fb0b12ff55d044cc4bbe142418ab7a5b07bb42d documents the maintained operator contract. All 45 tests and canonical checks pass; the 2,377-page manual has 434,563 in-bounds word boxes with zero final warnings, and the changed subsection passes visual review. Exported API snapshots are unchanged. The preceding Docs CI result is recorded below; current Integration CI, complete frame proof, whole-codebase authority/documentation closure, runnable realms and both guest-build generations remain open.

Protected relative-target checkpoint — 16 September 2026: signed Exsh a26ecffb39b70abbf15fb300c5c8c703c6900c37 admits exact six-byte RIP-relative calls and tails only after complete relative-relocation, file ownership, protected RELRO page and target-entry checks. It shares the relocation inventory with guarded tables and rejects overlapping or executable-byte writes. Independent controls cover malformed ranges, writable neighbours, different stored words, negative displacements, self-entry loops and tail restoration. All 102 checker tests and all six strict Rust feature/profile configurations pass (961 tests each), together with six native builds, host/native Clippy, formatting and private rustdoc. Runtime Rust, linker scripts and Cargo selections are unchanged.

Replaying both unique original pristine/packaged artifact pairs preserves their hashes and all original stack/resource budgets. Runtime/all-feature reports retain 641/591 new call/tail proofs and reach 266/240 functions; unresolved observations fall from 691/604 to 271/232. Workspace mapping passes. Both full reports remain incomplete: unknown indirect control flow, non-returning semantics and source/direct-versus-nested boundaries remain separate obligations. These are partial static admission results, not a complete frame or authority proof.

Signed Docs 83b2d4a2dfc473bb8a99719f86fa1c3c33effa53 explains the proof contract and its limits. All 45 documentation tests and canonical checks pass; the 2,377-page manual has 434,680 in-bounds word boxes, zero final warnings and a visually reviewed changed page. API snapshots are unchanged. The preceding Docs permission-observer checkpoint passes CI 893/894 with four complete logs (762,616 bytes) and zero final warnings. Exsh CI 231/232 is fully classified: all 961 Rust tests, 102 checker tests and all four workspace domains pass, with four complete logs totaling 314,760 bytes and zero warnings. Only the complete frame gate fails. Its separately selected CI artifacts report 273/230 unresolved observations; these do not replace the retained local artifact identities/counts. The preceding Docs CI result is recorded below. All 2,997 inventoried authored code files remain below 1,000 lines; semantic authority/documentation closure, product catalog adoption, runnable realms and both complete guest builds remain open.

Grounded return-flow checkpoint — 16 September 2026: signed Exsh 4bb35938b52c0e6b20c65ccb861af79871272cbe derives no-ordinary-return facts from complete checked loop/trap bodies and earlier proved tail targets. Only these grounded exact callees suppress ordinary fallthrough. Calls retain target, depth and relocation evidence, and each fact preserves its original body evidence and earlier dependencies. Final reachability removes stale fallthrough descendants while keeping terminal callee obligations. Unknown calls, unsupported instructions, malformed boundaries and unproved tail cycles cannot establish facts.

All 114 checker tests pass, including twelve new literal controls and a 1,200-function chain requiring at most two body visits per function. All six strict Rust feature/profile configurations pass 961 tests each, with six native builds, host/native Clippy, formatting and private rustdoc. Runtime Rust, linker scripts and Cargo selections are unchanged. The physical inventory now covers 2,999 authored code files, all below 1,000 lines.

The same retained original artifact pairs yield thirteen grounded facts each. Runtime/all-feature unresolved observations fall from 271/232 to 181/150; every function-end boundary error disappears under the stated ordinary-call model. The work queue performs 347/313 body evaluations for 266/240 discovered functions and retains 263/237 in the final reachable graph. This is an analysis-work count, not a claimed runtime speedup. Remaining observations are 140/111 unknown calls, 40/38 unknown branches and one unsupported instruction per mode. Both workspace mappings pass; whole frame and source domains remain incomplete with unchanged budgets. A separate proof audit verifies earlier dependencies and retained terminal callees.

Signed Docs 97ce65dcb8cef7232b50d53af90ff8673d623e05 documents the refinement. All 45 tests and canonical checks pass, and the 2,377-page manual has 434,800 in-bounds word boxes, zero final warnings and a visually reviewed changed page. Exported API snapshots are unchanged. Exsh CI 233/234 is fully classified: 961 Rust tests, all 114 checker tests and four workspace mappings pass, while the full frame gate remains incomplete. All four logs total 314,776 bytes with zero warnings. Those separately selected CI artifacts retain 183/145 unresolved observations, distinct from the retained local pair counts. Matching Docs CI 897/898 passes with all four complete logs across the two terminal observations (762,600 bytes), 45 tests per manual job and zero final warnings. The preceding Docs target-contract checkpoint passes CI 895/896 with four complete logs totaling 762,636 bytes and zero final warnings. Full indirect/source proof, coherent catalog adoption, whole-codebase authority/documentation closure, runnable realms and both full guest-build generations remain open.

Release-input diagnostic checkpoint — 16 September 2026: signed Integration df8147dfa437194cd091747fd7147941bd2793c4 adds fixed prefix summaries for shell lines and physical single/repeated interruption. Correlated physical VM-stall/timeout summaries retain unknown input status, failure stage and requested cleanup explicitly. They do not infer injector failure, cleanup success or the next operation's outcome. Only literal event names and bounded scalar fields can be printed; fixed private directory-relative reads, identity checks and original parsing limits remain unchanged. No guest authority, acceptance oracle, error precedence or 120/15/10-second limit changes.

All 172 host cases in eleven suites pass, including 28 diagnostic cases and eight new independent producer, malformed-prefix, private-receipt and actual-wrapper controls. The strict default/all-feature development/release matrix passes 320/321 tests per mode, host/native Clippy, four native builds, formatting and private rustdoc without warnings. A documentation line wrap is the only source change after the Rust matrix. One initial negative fixture had identical transport bytes when both exits were unknown; a distinct contradiction replaces it. An initially over-isolated console-suite invocation is corrected to its maintained CI invocation, without changing that suite or the watchdog.

Signed Docs c4bfc12245036f069d178a10183bb1ed15b4aab5 updates the operator manual. All 45 tests, canonical checks and full rendering pass: 2,377 pages, 435,037 in-bounds word boxes, zero final warnings and both changed pages visually reviewed. API snapshots are unchanged. Matching CI is pending. Release interrupt reuse #54 and release COM1 shell lines #55 remain open: missing original inner artifacts are not recovered, no shared cause is proved, and this checkpoint adds no successful guest run or full guest build.

Diagnostic manual CI — 16 September 2026: Docs c4bfc12245036f069d178a10183bb1ed15b4aab5 passes CI 899/900. All four complete logs total 762,668 bytes; both manual jobs pass 45 tests and produce 2,377 pages with zero final LaTeX warnings. All Markdown checks pass. Integration diagnostic CI 1645/1646 remains queued at its signed head; original release-input bugs 54/55 remain open.

Protected register checkpoint — 16 September 2026: signed Exsh da8b75c9063c52de2149f2a6c7ed170f720a6c62 propagates exact full-width protected-slot loads and register copies through the reached CFG. Equal-target joins retain every load origin; unknown or conflicting predecessors, alias/implicit writes, calls/syscalls and unknown effects discard facts. Weakening a join replaces stale edge proof. Complete admitted probe/dispatch effects preserve only unwritten register values. Supported REX forms permit unused bits with byte/text agreement. There is no caller-input, saved-register, spill-word or immediate-address target premise.

All 138 checker tests, formatting, canonical document checks and an independent original-byte/load/relocation and earlier no-return dependency audit pass. Retained runtime/all artifact pairs gain 16/18 register edges; the all-feature graph reaches one additional function. Remaining unresolved sites are 164/132, with thirteen grounded no-return facts per mode. Both workspace mappings pass. Full frame/source gates remain incomplete with actual exit 1 and unchanged 60/15-second and 64 MiB budgets. Every Rust/Cargo/linker/build/workflow byte is unchanged from six strict 961-test configurations and six native builds; no new Rust build or guest execution is claimed.

Profiling identified unnecessary effect parsing when all registers were unknown. Skipping those identity transfers and compiling fixed effect patterns once preserves every report decision, reducing runtime effect-parser calls from 34,901 to 1,334 and all-feature calls from 33,398 to 1,348. One before/after observation per identical pair measures 5.089 to 4.385 seconds and 4.997 to 4.358 seconds respectively, including observer overhead. These are bounded host work measurements, not a statistical timing guarantee or guest speedup.

Signed Docs 4f770bee4c6a4784b4fcce6ae606d1fc10b328da documents register provenance and limits. All 45 tests and the 2,377-page manual render pass, with 435,231 word boxes inside page bounds, no final warnings and visual review of the changed page. All 3,001 authored code files remain below 1,000 physical lines. Matching Exsh/Docs CI is pending. Complete source domains, authority closure, executable realms and both complete guest-build generations remain open.

Register checkpoint CI — 16 September 2026: Exsh da8b75c9063c52de2149f2a6c7ed170f720a6c62 is terminal in CI 239/240. Both runs pass 961 Rust tests, all 138 checker tests, strict warning-denied Rust checks and Markdown. All four paired workspace domains pass in each run. The required full-frame gate remains incomplete, with 168/131 unresolved observations on these CI artifacts, so both runs correctly fail overall. Four complete logs total 314,840 bytes and contain no compiler/lint warnings. These CI artifact observations remain distinct from the retained local pairs.

Docs 4f770bee4c6a4784b4fcce6ae606d1fc10b328da passes CI 901/902. Four complete logs total 762,604 bytes; each manual job passes 45 tests and renders 2,377 pages. Initial reference-resolution warnings clear during the normal three LaTeX passes; final renders have zero warnings. The full source/frame proof, coherent catalog adoption, authority closure and both complete confined guest-build generations remain open.

Bounded table checkpoint — 16 September 2026: signed Exsh efb542a3418badef951d01dff24eec88b8490aee tracks distinct unsigned bounds, original relative bases, signed table offsets and local targets. Exact constants, self-zeroing and zero extension establish numeric premises. Every selected immutable table byte, matching base addition and candidate instruction boundary must be proved before retaining any successor or branch evidence. Numeric/table values cannot authorize function calls. Joins preserve all alternatives and original premises; unknown predecessors and alias/implicit/call clobbers discard facts.

All 157 checker tests pass, including complete 256/65,536-entry domains, nonzero and signed read windows, extended register fields, joins, bypasses, loops, width controls and immutable/boundary refusals. Original-byte function/table/base/index/addition audits, formatting, Markdown and canonical checks pass. Final original runtime/all pairs admit two table branches each and retain 164/132 unresolved obligations: two entry branches resolve, while two newly exposed guard-interior conflicts remain. Both workspace mappings and thirteen grounded no-return facts per mode are retained. Full frame/source status remains incomplete with actual exit 1 and unchanged budgets. Initial partial-set exploration is diagnostic negative evidence, not accepted coverage.

Profiling identified repeated compilation of fixed stack patterns. Compiling sixteen unchanged patterns once and sharing the existing padding pattern preserves all report decisions and matching operations. One baseline/optimized observation per original pair reduces runtime/all regex-cache lookups from 651,254/627,530 to 135,274/131,391. Profiled times are 5.994 to 5.445 and 5.756 to 5.179 seconds, including overhead and waiting. These measurements establish reduced host work, not a timing guarantee or guest speedup. The final source has a clarified module docstring and separately reconciled complete replay decisions.

Every Rust/Cargo/linker/build/workflow byte retains the existing strict matrix; no new Rust build or guest execution is claimed. Signed Docs 242b78c8f35aeaef879f819c670574a4c1d95c3f explains complete read windows and target-set admission. All 45 tests and the 2,379-page render pass, with 435,421 word boxes inside page bounds, zero final warnings and visual review of both changed pages. All 3,003 authored code files remain below 1,000 physical lines. Matching CI is pending. Explicit flag/guard refinement, full source/frame proof, coherent catalog adoption, authority closure and both complete confined guest-build generations remain required.

Bounded table CI — 16 September 2026: signed Exsh efb542a3418badef951d01dff24eec88b8490aee is terminal in CI 241/242. Both runs pass 961 Rust tests, all 157 checker tests, strict warning-denied Rust checks and Markdown. Each run completes all four paired workspace domains. The required full-frame gate remains incomplete with 168/131 unresolved observations on the CI artifacts, so both runs fail overall. Four complete logs total 315,234 bytes, with no compiler/lint warnings. No incomplete proof is treated as acceptance.

Signed Docs 242b78c8f35aeaef879f819c670574a4c1d95c3f passes CI 903/904. All four logs are complete (763,044 bytes); each manual job passes 45 tests and renders 2,379 pages. Initial reference warnings clear in the normal LaTeX passes; final renders have zero warnings. An expanded local source/config inventory additionally checks 685 files, bringing the combined physical ceiling audit to 3,688 files, all below 1,000 lines. Flag/guard refinement, source/frame closure, coherent catalog adoption, complete authority review and both full confined guest-build generations remain required.

Ordinary comparison checkpoint — 16 September 2026: signed Exsh 4ed392bcc53cb46d0296cecbdd930c8be5cd7c28 replaces the fixed-register table macro with byte-checked CMP/Jcc facts, live comparison lifetime, unsigned/equality edge refinement and sound producer-width widening. A 32-bit comparison never zeroes upper bits. Every complete immutable target set remains mandatory, and numeric/table values cannot authorize function calls. Unknown predecessors, relevant flag/subject writes and unmodeled effects discard conditions. The obsolete dispatch report field is removed.

All 176 checker tests pass, including an independent exhaustive interval oracle, high-register dispatch, sign extension, bypasses, conflicting/unknown joins, stale proofs, complete table arms and large arithmetic loops. Independent original-byte audits check 354/321 comparison edges, eleven table branches per mode, protected function loads and thirteen earlier grounded no-return facts per mode. Original runtime/all pairs reach 271/246 functions and retain 158/126 unresolved observations, down from 164/132. Workspace domains pass; full frame/source status remains incomplete with actual exit 1 and unchanged budgets.

The audit also reproduces and fixes terminal-call discovery loss. A prior successor diagnostic no longer suppresses recomputation of a revisited call. Three independent controls retain grounded no-return, returning and unknown-target behavior. Original byte/range inspection corrects earlier descriptions of two guard-interior conflicts: these were fallthrough exactly at declared function ends. Padding remains outside those functions; callee names never supply no-return proof. Matching CI remains required before closing the defect.

Profiling identified repeated decoder-effect work. Sharing immutable effects only within one function-body analysis reduces runtime/all effect decoding from 72,668/69,784 to 34,499/32,576 and operand parsing from 75,637/72,547 to 37,468/35,339. Complete paired decisions remain identical. Final single paired profiled observations are 6.633 to 6.425 and 6.416 to 6.269 seconds, including overhead and waiting. The final baseline overlaps host test execution, and earlier pairs show timing variability; these diagnostic durations do not isolate a speedup. This establishes reduced host work, not a timing guarantee or guest speedup.

Every Rust/Cargo/linker/build/workflow byte retains the existing strict six-configuration 961-test matrix and six native builds. Formatting, Markdown and canonical checks pass. Signed Docs d8fbc3a1f3696e02954b81f23511cee513ddfa8c passes all 45 tests and complete 2,379-page rendering: 435,637 in-bounds word boxes, zero final warnings and two visually reviewed pages. The physical audit covers 3,005 authored code files below 1,000 lines. Matching CI is pending. Remaining indirect calls/branches, full source/direct-versus-nested proof, coherent catalog adoption, complete realm authority and both full confined guest-build generations remain required.

Comparison checkpoint CI — 16 September 2026: Exsh CI 243 and 244 are terminal. All four complete logs total 314,904 bytes with no compiler/lint warnings. Strict Rust checks, 961 Rust tests, 176 checker tests, Markdown and all four workspace domains per run pass. The required full-frame gate remains failed with 163/126 unresolved observations on these CI artifacts; their identities are distinct from the original static replay pairs. No full frame or guest-build acceptance is claimed.

Docs CI 905 and 906 pass with all four complete logs (763,056 bytes), 45 tests and 2,379-page manuals. Both final renders have zero warnings after ordinary reference convergence. The terminal-call discovery controls pass in both Exsh runs, resolving the scoped defect in Exsh #6 while the complete emitted-proof defect stays open. The current physical audit covers 3,690 authored source/config files below 1,000 lines; semantic authority and complete private documentation closure remain required. Original unfinished Integration jobs continue under their existing handles.

Arithmetic evidence checkpoint — 16 September 2026: signed Exsh 0cdaa8869545308c528f9cf5a2dc165cb286c6ef and Docs 07181c34b1a20150afe3380977ca5ba70c909b84 are pushed on feature/posix-compat. Immediate ADD/SUB now retains exact modular result pieces and derives unsigned/equality edges from carry/borrow and zero. Defined INC/DEC writes establish widths without preserving a stale combined flag condition. Full 64-bit comparisons may use the architectural numeric domain while keeping protected typed identities separate; narrow comparisons still require independent upper-bit proof. Known encoding/text contradictions remain explicit flow errors.

All 191 checker tests pass, including independent exhaustive concrete arithmetic and modular-interval oracles, wraparound and authority-negative controls. Original runtime/all artifact pairs admit fifteen table branches each and reach 271/246 functions, with 156/124 unresolved observations. Both workspace mappings pass; actual full-frame exits remain 1 and full source/direct domains remain incomplete. Independent original-byte audits check arithmetic/conditional/table premises, 16/18 protected register edges and thirteen grounded no-return facts per pair.

Profiling identified repeated stack-neutral grammar evaluation. A cache scoped to one function reduces those evaluations from 95,643 to 43,169 for runtime and 92,608 to 41,053 for all features, with complete paired report decisions equal. Cached values include refusals and contain no path facts. Timing observations include observer overhead and do not isolate a statistical speedup or guest performance.

Formatting, Markdown, whitespace and all 45 Docs tests pass. The 2,379-page manual has 435,808 in-bounds word boxes, zero final warnings and visual review of the changed pages. The physical inventory covers 3,691 authored source/configuration files, all below 1,000 lines. Semantic authority and complete private rustdoc closure remain open. Rust/Cargo/linker/build/workflow bytes are unchanged from the retained strict matrix and classified CI 243/244; new Exsh CI 245/246 independently reruns those checks. Docs CI 907/908 also runs. Matching CI is pending, and no full confined guest build or coherent product-catalog adoption is claimed.

Test-import correction and CI classification — 16 September 2026: original Exsh CI 245/246 failed before the frame gate because the arithmetic test could not import its checker module. They attempted 177 tests: 176 passed and one module import failed. The preceding 961 Rust tests and strict build stages passed; all four complete logs total 309,708 bytes with zero compiler/lint warnings. The earlier local 191-test pass used an explicitly supplied PYTHONPATH and did not prove equivalence to the clean workflow. This regression is retained in Exsh #7.

Signed correction 12331e26f3bb7a25c0146c8b314eef46dd451099 loads the repository's literal fixture setup before implementation imports in both affected modules. A new regression imports every checker test module in a fresh isolated interpreter; it reproduces both failures before correction and passes afterward. The exact clean workflow command now passes all 192 tests without PYTHONPATH. Formatting, Markdown and whitespace pass. Checker/runtime/Cargo/workflow bytes are unchanged, so the prior original-artifact and profiler evidence retains its exact scope. New CI 247/248 runs against the corrected source; issue #7 remains open pending matching CI.

Docs CI 907/908 now passes with four complete logs totaling 763,024 bytes, all 45 tests and 2,379-page manuals. Both final renders have zero warnings after ordinary reference convergence. Full frame/source proof, coherent catalog adoption and complete confined guest builds remain outstanding.

Corrected arithmetic checkpoint CI — 16 September 2026: Exsh CI 247 and 248 at signed 12331e26f3bb7a25c0146c8b314eef46dd451099 both pass all 192 checker tests, including the ten isolated module imports, and all 961 Rust tests. The preceding strict formatting/Clippy/documentation/build stages and Markdown pass. All four complete logs total 314,944 bytes with zero compiler/lint warning candidates. This confirms the scoped import correction in Exsh #7.

Both runs reach and fail the required full-frame gate. All four workspace mappings per run pass, while the emitted CI pairs retain unresolved counts [161, 161, 124, 124]; these artifacts are distinct from the original static pairs' 156/124 observations. Full source/direct domains remain incomplete, and Exsh #4 remains open. The original import-failed runs 245/246 stay classified and are not relabeled as passing.

Docs CI 907/908 passes all 45 tests and 2,379-page manuals with zero final warnings; four complete logs total 763,024 bytes. Signed trees are clean, canonical issue/PR metadata remains applied, and the 3,691-file physical inventory remains below 1,000 lines per authored source/configuration file. Semantic authority and private documentation closure, coherent catalog adoption, runnable realms and both full confined guest build generations remain outstanding. Original unfinished Integration runs continue under their existing handles and budgets.

Grounded call-preservation checkpoint — 16 September 2026: signed Exsh 641ac2fc7c3fba3ab351f2863df7e35117b2732a and Docs 7a7c3ff0095de8f008c9b534fd993554df37f976 are pushed on feature/posix-compat. Complete original bodies and earlier callee facts now prove never-written register families. Only existing typed values survive proved calls; live conditions clear. The separate stack-derived rbp fact follows the same rule. This corrects the reproduced stale-frame defect, which stays open pending matching CI. ABI conventions, spill restoration and current kernel behavior supply no preservation mask.

All 213 clean-environment checker tests pass, including 21 new controls, eleven isolated module imports and a 1,200-function grounded dependency chain. All six strict Rust feature/profile configurations pass 961 tests each, with host/native Clippy, private rustdoc and six native builds; no warnings. Original runtime/all artifact pairs retain 65/72 protected register edges and 70/77 load origins, reducing unresolved observations from 156/124 to 107/70. Both workspace mappings pass; full source/frame/direct gates retain actual exit 1. Independent audits bind 7,795/7,503 used-contract instructions and complete earlier-proof closure to the original captured bytes.

Profiling identified unnecessary empty-state scans and rejected-body suffix work. Removing them preserves every paired report decision and reduces total profiled Python calls from 32,160,478 to 26,673,252 and from 30,880,221 to 25,402,446. Single paired timings include observer overhead; they do not establish statistical or guest performance. Original timer, byte and stack budgets remain unchanged.

All 45 Docs tests, formatting, Markdown and canonical checks pass. The 2,379-page manual has 436,058 in-bounds word boxes, zero final warnings and visual review of both changed pages. The physical audit covers 3,693 source/configuration files, all below 1,000 lines. Semantic authority/private-documentation closure, product adoption, complete source/frame admission, runnable realms and both full in-EriX build generations remain open. Automatic CI for both exact signed heads is being followed; local passes are not reported as CI acceptance.

Matching preservation CI — 16 September 2026: Exsh 249 and 250 are fully classified at 641ac2fc7c3fba3ab351f2863df7e35117b2732a. Both pass all 213 checker tests, including eleven isolated imports and the stale-frame controls, all 961 Rust tests and preceding strict host/native Clippy, rustdoc and native build stages. Markdown and all four workspace mappings per run pass. The remaining full frame gate fails as required; original CI artifact observations are 111, 111, 74, 74], [111, 111, 74, 74. All four complete logs total 314,995 bytes without warnings. The independently retained local pairs remain 107/70, with their own original identities.

Docs 909 and 910 pass at 7a7c3ff0095de8f008c9b534fd993554df37f976. All four complete logs total 763,088 bytes; both manual jobs pass 45 tests and render 2,379 pages with zero final warnings after ordinary reference convergence. The corrected frame-pointer issue is closed on this matching evidence; the full source/frame issue remains open. No full confined build, runnable realm or coherent product-catalog adoption is established.

Native artifact intake checkpoint — 16 September 2026: signed Exsh d67dcb963f1aa265b13dd0609a5f8488784b5822 admits the retained original/stripped native pair with exact mapped bytes, allocated ownership and complete program contracts. Only absent packaged ordinary symbols are optional. The exact five-byte native entry jump preserves the shell's 8192-byte frame limit. Checked symbolic relocations contribute write footprints, never local targets or library-discovery authority. Code/dynamic metadata mutation, unknown streams, malformed names/links, resolver symbols and invalid relative prefixes refuse intake.

All 231 checker controls (18 new) and 12 isolated test modules pass in a clean environment. All six strict Rust configurations pass 961 tests each, host/native Clippy, private rustdoc and six native builds without warnings; formatting and canonical checks pass. Both retained standalone pairs have exactly unchanged proof decisions (107/70 unresolved). The original native pair inventories 1,345 functions, reaches 220, proves workspace mapping and retains 299 unresolved observations, including 102 symbolic-target refusals. The shell entry has 6,864 partially accounted bytes; its incomplete paths do not establish an upper bound. Independent original-byte audit checks all 1,086,955 executable bytes, exactly 154 changed capacity bytes and 627 relative call-load proofs. Full source/frame/direct gates remain incomplete, actual checker exit 1.

Native original SHA-256 879579542895f2f3fbda38972ebaaaf55e05857ffc456342117624a9bc8d24a9 and packaged SHA-256 183a1a2f1f4192ffd0b9c123ca50d33af6c584940ca51b156198f8822b718feb retain their original Exsh runtime selection b12e172e7b266842a8659104894f6821166165fb. The native producer already retains the original; no duplicate artifact or producer mutation was required. Profiling all three original pairs takes 16.60/16.47/17.02 seconds including observer work under unchanged 60/15-second and 64 MiB budgets. These are individual static observations, not guest performance claims.

Signed Docs 12c6d0a91e5e9c5f170d6d0aa7f050dd60e883ef documents the contract. All 45 tests and a complete 2,381-page manual pass, with 436,247 in-bounds word boxes, zero final warnings and changed-page visual review. The physical inventory covers 3,695 source/configuration files, all below 1,000 lines; semantic authority/private documentation closure remains open. New Exsh CI 251/252 and Docs CI 911/912 are running at their exact signed heads. Complete source membership, native dependency closure, coherent catalog adoption, runnable realms and both full guest builds remain required.

Matching native intake CI — 16 September 2026: Exsh 251 and 252 are fully classified at d67dcb963f1aa265b13dd0609a5f8488784b5822. Both pass 231 checker tests, twelve isolated imports, 961 Rust tests and the strict preceding Clippy/rustdoc/native build stages. All four workspace mappings per run and Markdown pass. The required full frame gate remains incomplete; the CI artifact counts are 111/111/74/74 unresolved observations in each run. Four complete logs total 315,371 bytes, with zero warnings. Retained local standalone and native artifacts keep their own separate identities and 107/70/299 counts.

Docs 911 and 912 pass at 12c6d0a91e5e9c5f170d6d0aa7f050dd60e883ef. Four complete logs total 763,452 bytes; each manual job passes 45 tests and renders 2,381 pages, with ordinary reference convergence followed by zero final warnings. No full source/frame proof, native dependency closure, runnable confined realm or full EriX-in-EriX build is established.

A separate original-source relocation calculation defect is now reproduced and tracked with the canonical bug template in lib-dynlink #2. Its two host failures do not imply a guest regression. All 107 symbol-only relocations in the seven retained native artifacts have zero addends; the supported nonzero-field case still requires correction before broader native binding admission.

Symbol-only relocation correction — 16 September 2026: signed lib-dynlink abd5153adf994ca40753f9650a675940a228e1d3 calculates GLOB_DAT and eager JUMP_SLOT as S, while retaining checked S+A and B+A, original provider selection and writable target ownership. The canonical defect report is erix/lib-dynlink#2 and review is erix/lib-dynlink#3. Four default/all-feature dev/release configurations pass 47 tests each, host/native strict Clippy, private rustdoc and four native builds without warnings. Of nine new independent controls, five fail and four pass against the original implementation; all nine pass after correction.

Original dynlinkd, loaderd and bootloader source candidates, each changing only the library's full commit selector in an isolated exact-commit worktree, pass four strict configurations: 13/105/41 tests respectively, with twelve native builds and private rustdoc, zero warnings. Published consumer commits remain unchanged pending coherent adoption.

The retained Exsh executable and six explicit libraries yield 1,608 independently expected relocation writes under caller-selected hypothetical load biases. Both original and corrected planners match those original zero-addend inputs. All 107 symbol-only writes remain identical under positive, negative and extreme unused-addend variants with the fix; the original planner fails the addend-16 control (actual Cargo exit 101). The original/packaged dynamic tables are byte-identical and all artifact/manifest hashes are retained. This host metadata replay performs no target mapping or execution and does not admit native frame paths.

Signed Docs 214b08666b8b36ad4270bcfee3b3379d8dc08a79 documents the expressions and regenerates only the library's 103-route API reference from exact signed-source rustdoc JSON. All 45 documentation tests, Markdown and canonical checks pass. The full manual has 2,383 pages, 436,424 in-bounds word boxes, zero final warnings and four visually reviewed changed pages. All 3,696 inventoried code/configuration files remain below 1,000 lines; complete semantic authority and private documentation closure remains open.

Matching library CI 30/31 passes with four complete logs (36,856 bytes), 47 tests per run, strict builds/rustdoc and zero warnings. Docs CI 913/914 passes with four complete logs (763,872 bytes), 45 tests and 2,383-page renders, zero final warnings. Coherent catalog adoption, complete native source/frame evidence, runnable realms and both full guest build generations remain open.

Closed native dependency intake — 16 September 2026: signed Exsh 9827896d1cb5ad834589045ee03390aec650df84 adds an explicit JSON input contract for one runtime manifest and the exact original/packaged executable and library pairs. Complete file hashes, manifest records, package/feature identities and both needed-name inventories must agree. Only explicit host selectors authorize reads; runtime names and source paths remain data. Inputs share one aggregate byte budget and the original deadline. Library stripping permits only independently checked administrative header selectors, never executable-byte changes. All other mapped bytes, allocated owners, program fields and paired artifact metadata remain identical. Producer source revisions remain unverified claims.

The retained native closure binds seven objects, 2,373 ordinary functions and 1,608 relocation records. Intake does not yet resolve symbolic providers or compose cross-library frames. All 259 checker controls (28 new) and 16 isolated modules pass; six strict Rust configurations pass 961 tests each, host/native Clippy, private rustdoc and six native builds with zero warnings. Formatting, Markdown and canonical checks pass. All three retained artifact replays preserve their previous frame decisions: 107/70/299 unresolved observations for standalone runtime/all/native. Full frame/source gates retain actual exit 1. Profiling records 0.181 seconds in native dependency intake and 23.17/25.51/24.59 seconds for the three complete profiled runs, within unchanged 60/15-second and 64 MiB budgets. Concurrent Rust validation changes host contention, so elapsed differences from earlier runs are not a speedup or regression claim.

Signed Docs 88537b23e1def210eeff40b7ef90fce92fe2009e documents this contract. All 45 tests and the complete 2,383-page manual pass, with 436,642 in-bounds word boxes, zero final warnings and visual review of the changed page. An initial double-hyphen ligature was corrected and the full render revalidated. The physical census covers 3,704 source/configuration files, all below 1,000 lines; complete semantic authority and private documentation closure remain open. Exact-head Exsh CI 253/254 and Docs CI 915/916 are running. Symbol providers, ordered runtime binding, cross-object frame paths, source membership, coherent catalog adoption, runnable realms and both complete guest builds remain required.

Matching closed dependency intake CI — 16 September 2026: Exsh 253 and 254, exact 9827896d1cb5ad834589045ee03390aec650df84, pass 259 checker controls, 16 isolated imports, 961 Rust tests and the strict preceding build/Clippy/rustdoc stages. All four workspace domains per run and Markdown pass. The required full frame gate remains incomplete, with 111/111/74/74 unresolved observations in each CI artifact set. Four complete logs total 315,052 bytes and contain zero warnings. Original local runtime/all/native replays retain separate input identities and 107/70/299 counts.

Docs 915 and 916, exact 88537b23e1def210eeff40b7ef90fce92fe2009e, pass 45 tests and complete 2,383-page renders. Four complete logs total 763,918 bytes. Reference convergence is 35/1/0 warnings across the three TeX passes, with zero final warnings. Both cohorts are classified without rerunning jobs or changing their budgets. The seven-object native dependency inventory is now checked; symbolic providers, ordered runtime binding, cross-object frames and source membership remain incomplete. No runnable realm, coherent product adoption or complete in-EriX build is established.

Ordered native symbol evidence — 17 September 2026: signed Exsh 469bf1f1b9d8301cf98a79d16c7c27660ecda2a1 enforces root-first depth-first discovery order and positional DT_NEEDED agreement, indexes exact strong/weak providers and preserves object-qualified relative function identities. Duplicate strong definitions fail; missing weak symbols remain zero data. S-only relocations ignore addends, while S+A must retain an exact original executable entry. Names confer no file reads and no load bias is invented.

All 276 checker tests, 17 isolated modules and six strict Rust configurations (961 tests each) pass, including host/native Clippy, rustdoc and six warning-free native builds. Independent original-byte inventory matches all 117 symbolic records: 112 exact function identities and five refused data targets. Provider indexing/reporting takes approximately 16 ms in the captured native profile. Original standalone runtime/all/native replays preserve 107/70/299 unresolved observations and actual exit 1 under unchanged budgets. This is conditional relative identity evidence only: load-base arithmetic, protected slots, cross-object calls/frames and source membership remain incomplete.

Signed Docs 24cefeb2dc6d3f163140d32f5fed5a7e1a768ebd updates the manual contract. All 45 documentation tests pass; the complete 2,383-page render has 436,737 in-bounds word boxes, zero final warnings and visual review of pages 2284–2285. The physical audit covers 3,706 source/configuration files, all below 1,000 lines. No runtime Rust, dependency, linker or workflow inputs changed. New host/CLI controls cover the analyzer behavior; no new guest feature is asserted. Exsh CI 255/256 is terminal: unit/strict/workspace stages pass, and the required full-frame gate remains incomplete. Docs CI 917/918 passes. Acceptance remains 15/459 leaves, 3.48% weighted. Both full in-EriX builds and the complete semantic authority audit remain open.

Ordered-provider automatic CI classification — 17 September 2026: Exsh 255/256 at 469bf1f1b9d8301cf98a79d16c7c27660ecda2a1 passes 961 Rust tests, the combined 276-test checker suite, strict preceding stages and all four workspace domains per run. The required full-frame gate fails with 111/111/74/74 unresolved observations per run. Four complete logs total 315,035 bytes with zero warnings. The 17 separate module executions are local evidence; CI uses combined test discovery.

Docs 917/918 at 24cefeb2dc6d3f163140d32f5fed5a7e1a768ebd passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,878 bytes. Reference-resolution passes produce 35/1/0 warnings; final output has zero warnings and no layout overflow. Original API snapshots remain unchanged. Both cohorts are fully classified, without restarting workflows or changing thresholds. Original Integration layout, quota and FAT32 failures remain open, including #58 in Integration. Acceptance remains 15/459 leaves, 3.48% weighted. Complete native source/frame proof, a runnable realm, the full semantic authority audit and both full in-EriX builds remain required.

Protected cross-object frame evidence — 17 September 2026: signed Exsh ac9646c84e432129a872737789a9be08f984b881 composes the seven explicitly selected native objects using protected relative/symbolic slots and object-qualified function identities. Local control-flow offsets cannot alias a foreign function or transfer the root fallback role. Register facts, grounded preservation/no-return dependencies and route accounting retain the selected object. Every captured decode shares the original output/time budgets; a late failure rejects the invocation. Native reports use schema 3; standalone schema 2 and input schema 1 remain unchanged.

All 299 checker tests and 20 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, rustdoc and six warning-free native builds; formatting and Markdown checks pass. Original runtime/all replays retain 107/70 unresolved observations. The composed native graph reaches 275 functions with 111 unresolved observations; all three actual checker exits remain 1. Native slots assume successful checked linking and unchanged disjoint mappings. Actual load bases, complete source/frame acceptance and coherent runtime adoption remain open.

Profiling identified redundant root-only analysis in native mode. Removing it preserved every composed decision while one profile changed from 41.52 to 25.81 seconds and 64.37M to 39.61M calls. This host profile pair includes observer overhead and gives no general or guest timing guarantee. The final source replay also preserves every decision; three register-proof records now correctly identify symbolic load provenance.

Signed Docs 44cd6c4aa95bebfa08c99804fab0f1551f537ae1 specifies the contract. All 45 documentation tests pass; the complete 2,383-page manual has 436,894 in-bounds word boxes, zero final warnings and visual review of the changed page. All 3,713 inventoried source/configuration files are below 1,000 lines. The broader documentation audit retains 108 unchanged older test definitions needing inline docstrings; current production and all new/modified definitions are documented. Runtime Rust, dependency, linker and workflow inputs are unchanged; added behavior has host and real CLI regressions, with no new guest runtime feature asserted. Original Exsh CI 257/258 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 919/920 passes. Both cohorts are fully classified. Both full builds inside EriX and complete semantic authority acceptance remain open.

Cross-object checkpoint CI classification — 17 September 2026: Exsh 257/258 at ac9646c84e432129a872737789a9be08f984b881 passes 961 Rust tests, the combined 299-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery also checks isolated module imports; the 20 separate module-suite executions are additional local evidence. The required full-frame gate fails with 111/111/74/74 unresolved observations on the four original CI artifact selections. Four complete logs total 315,180 bytes with zero warnings. Those CI selections remain distinct from the retained seven-object native replay.

Docs 919/920 at 44cd6c4aa95bebfa08c99804fab0f1551f537ae1 passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,906 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required.

Saved-value preservation evidence — 17 September 2026: signed Exsh 8b6b93a329757ae7f106e235761912b58a67deff derives incoming-register equality through exact full-width copies and owned live stack slots. Original byte decoders bind register, width and address forms. Partial or unknown aliases, conflicting paths, deallocation and reuse invalidate saved facts. Entry tokens carry equality only; they never supply a pointer or call target. A separate earlier callee contract must prove private stack writes before caller slots survive a call. Checked signed bounds and finite dependency order prevent wrapped offsets and recursive assumptions from granting evidence.

All 329 checker tests and 22 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, rustdoc and six warning-free native builds; formatting and Markdown checks pass. Independent eager scheduling controls agree with both filtered worklist orders. Original runtime/all/native replays retain 107/70/111 unresolved observations and actual checker exit 1. The native graph still reaches 275 functions. The startup iterator's unknown pointer writes remain a refusal; complete source/frame and runtime acceptance remain open.

Two initial native profiles exhausted the original 60-second budget and produced empty reports; both failures are retained. Immutable decode caches, retirement of exhausted equality state, fact-sensitive wakeups and dependency-first scheduling brought the final native replay within the unchanged budget: 57.45 seconds wall time, 53.94 profiled seconds and 72.27M calls. All 2,373 bodies are inspected once. This bounds one retained host replay and makes no general speedup or guest timing claim. Report schemas and original source, stack, byte and time gates are unchanged.

Signed Docs c3401e5f6bbc19a0ba695219ed551e29a29677ed specifies the contract. All 45 documentation tests pass; the complete 2,383-page manual has 436,968 in-bounds word boxes, zero final warnings and visual review of both changed continuation pages. All 3,717 inventoried source/configuration files are below 1,000 lines. The touched preservation tests now document 21 older methods; 87 unchanged older test definitions remain in the inline documentation audit. Current production and all new/modified definitions are documented. Runtime Rust, dependency, linker and workflow inputs are unchanged; no new guest runtime feature is asserted. Original Exsh CI 259/260 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 921/922 passes. Both cohorts are fully classified. Both full builds inside EriX and complete semantic authority acceptance remain open.

Saved-value checkpoint CI classification — 17 September 2026: Exsh 259/260 at 8b6b93a329757ae7f106e235761912b58a67deff passes 961 Rust tests, the combined 329-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery checks isolated module imports; the 22 separate module-suite executions are additional local evidence. The required full-frame gate fails with 111/111/74/74 unresolved observations on its four original CI artifact selections. Four complete logs total 315,234 bytes with zero warnings. These CI selections remain distinct from the retained seven-object native replay.

Docs 921/922 at c3401e5f6bbc19a0ba695219ed551e29a29677ed passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,958 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required.

Caller-bound stack preservation — 17 September 2026: signed Exsh e7ba974e96ee77a41c6a861150da843d4c84c7d6 binds formal GP arguments to independently proved live caller stack intervals. Exact callee write spans preserve return-address gaps and invalidate every overlapping save. Scoped masks never enter the unconditional function index; loaded words, unknown contents, released storage and recursive assumptions supply no binding. Byte-checked SETcc writes exactly one unknown byte.

All 355 checker tests and 23 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, private rustdoc and six warning-free native builds. Formatting, templates and Markdown pass. Original runtime/all/native replays retain 97/60/97 unresolved observations and actual exit 1. The native graph reaches 275 functions; the startup iterator now has caller-bound preservation for its exact live buffers. Complete source/frame and runtime acceptance remain open.

Profiling exposed repeated failed argument specializations. Mandatory opaque-prefix refusals, conservative GP demand and rejection-only control candidates avoid unnecessary interpretations without changing the original 60-second limit. Candidate records cannot become proofs, and incompatible fact kinds defer to actual interpretation: losing pointer identity can enable numeric refinement. Positive and negative controls compare filtered and eager behavior. Each CFG site has at most one pending visit and later changes still enqueue it without an iteration cap; every native proof decision agrees with the prior queue.

The final ordinary native replay takes 39.80 seconds. Complete tracing still exhausted the original deadline; failures and empty reports are retained. A separately identified selective profile measures only caller-context analysis: the complete invocation takes 56.59 seconds, with 26.92 profiled seconds in that scope. Instrumentation preserves the complete proof result. Different profiling scopes are not timing comparisons, and no guest performance claim is made. The replay selects 367 instances, evaluates 587 bodies, proves 190 and defers 51 candidate bodies for incompatible domains.

Signed Docs fc3ee44748c20a3aa6f55bd85ac1913c707e5d4e specifies these contracts. All 45 documentation tests pass. The complete 2,385-page manual has 437,275 in-bounds word boxes, zero final warnings and visual review of the changed pages. All 3,721 inventoried source/configuration files are below 1,000 lines. All new/modified definitions are documented; 87 unchanged older test definitions remain in the audit. Runtime Rust, dependencies, linker and workflow inputs are unchanged. Original Exsh CI 261/262 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 923/924 passes. Both cohorts are fully classified. Complete semantic authority acceptance, coherent runtime adoption and both full builds inside EriX remain required.

Caller-bound checkpoint CI classification — 17 September 2026: Exsh 261/262 at e7ba974e96ee77a41c6a861150da843d4c84c7d6 passes 961 Rust tests, the combined 355-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery checks isolated module imports; the 23 separate module-suite executions are additional local evidence. The required full-frame gate fails with 101/101/64/64 unresolved observations on its four original CI artifact selections. Four complete logs total 315,210 bytes with zero warnings. These CI selections remain distinct from the retained seven-object native replay.

Docs 923/924 at fc3ee44748c20a3aa6f55bd85ac1913c707e5d4e passes 45 tests and the complete 2,385-page manual. Four complete logs total 764,350 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required.

Caller-local query checkpoint — 17 September 2026: signed Docs 4ff9a60ed9ba3fbc9d3b68a14c1a40e238ed386c records one attributed query caller, explicit CSpace metadata reads, error precedence and the fifteen actual-user query canary cases. All 45 documentation tests and the complete 2,385-page manual pass; 437,473 word boxes are in bounds, affected pages 146, 147 and 1307 were visually reviewed, and final rendering has no warnings. Original Docs CI 925/926 both pass with complete terminal logs and zero final warnings. Public API snapshots are unchanged. The manual keeps finite native observations separate from generic preservation and complete self-hosting claims.

Single syscall inventory checkpoint — 17 September 2026: signed Docs 0a0f305464f7df2b33e2ef7c86079d64c844e4b8 replaces the stale detailed syscall list with a resolved reference to the complete twenty-selector IPC table. This repairs issue 9, which omitted the eight owned-invocation operations. Removed selector 0x70 remains explicitly rejected; runtime ABI and generated API snapshots are unchanged.

All 45 documentation tests, Markdown and template checks pass. The complete 2,385-page manual has 437,463 in-bounds word boxes, no final warnings, and visual review of pages 142 and 163. Rust and VM checks are inapplicable to these two prose-only changes. Original automatic CI 927 and CI 928 both pass. All four complete terminal logs total 764,750 bytes; reference passes resolve with 36/1/0 warnings and the final manual is warning-free. Issue 9 is repaired and closed. No full self-hosting acceptance is claimed.

Explicit entry-state checkpoint — 17 September 2026: signed Docs c7bfffc4a2ec46eeb496f001fd40735648843a01 corrects the syscall reference to IRETQ, a 136-byte retained prefix, a separate 176-byte kernel entry reservation, saved user RSP and the 256 KiB kernel stack. It documents the explicit live-direction contract and thirty query cases while preserving the limits of finite native evidence. This addresses issue 10; generated API snapshots are unchanged.

All 45 documentation tests and Markdown/template checks pass. The complete 2,387-page manual has 437,732 in-bounds word boxes and no final warnings; pages 146, 166, 168 and 169 were visually reviewed. Runtime tests are inapplicable to this documentation-only change. Original CI 929 and CI 930 both pass. All four complete terminal logs are classified; both full 2,387-page manual builds have zero final warnings. Issue 10 is closed for the corrected documentation drift. No complete guest build is established.

Entry-frame and complete fixture checkpoint — 17 September 2026: Signed 2a6bb7206694481362a1fe11398a6af7d23fea3d documents the aligned terminal exception call and exact five/six-word hardware frame, preserving the separate resumable page-fault contract. All 45 tests and the complete 2,387-page manual pass; 437,838 in-bounds word boxes, visually reviewed pages 147/166, zero final warnings. Original CI 931/932 passes with all four complete logs (765,262 bytes), reference warnings 36/1/0 and zero final warnings. Both complete guest builds and dependent runtime/source proof remain open.

Borrowed syscall capture reference — 17 September 2026: signed 2435bf5ed105fbe2af0349088b2ae600d4b598fd
documents the complete entry prefix and refusal before operation dispatch.
All 45 documentation tests, Markdown/template checks and the 2,387-page manual
pass, with 437,959 in-bounds word boxes, zero final warnings and visual review
of pages 167/169. Original CI 933/934 passes: all four complete logs total 765,238 bytes,
with reference-resolution warning counts 36/1/0 and zero final warnings. This documentation checkpoint
does not imply runtime or complete guest-build acceptance.

VSpace cleanup reference — 17 September 2026: signed d1f635a4755d13a7b85ad75d219a1e02ea8db686
documents one-way retirement, recorded progress and retained final ownership.
All 45 documentation tests and the complete 2,387-page manual pass, with 438,059
in-bounds word boxes, zero final warnings and visual review of page 132.
Original CI 935/936 passes with all four complete logs classified and zero
final warnings. Runtime and full
guest-build acceptance remain separate.

Process cleanup reference — 17 September 2026: signed d7f1a59620a1542e82d776e593b8da77efca2e0c
documents retained private identities, non-executable cleanup states and the
final release lock/commit contract. All 45 tests, document checks and the
2,387-page manual pass with 438,174 in-bounds word boxes, zero final warnings
and visual review of page 132. Original CI 937/938 passes with all four complete logs classified and zero
final warnings; preceding
CI 935/936 is fully classified PASS. Runtime and guest-build gates are separate.

Runtime archive checkpoint — 17 September 2026, signed cf684745b08b59e0efc98c4b904708d0c17d735d: All 45 documentation tests pass. The complete 2,387-page manual renders with zero final warnings and 438,260 in-bounds word boxes; page 2292 is visually reviewed. No Rust API, runtime code or API snapshot changes in this documentation checkpoint. Original Docs CI 939/940 passes with all four complete terminal logs classified (765,226 bytes). Reference-resolution passes contain 36/1/0 warnings; the final render has zero warnings. No earlier failed workflow is restarted.

Linker selection checkpoint — 17 September 2026, signed 050b9bcc3a5d8e0f57efc62e8775dee10a48af84: All 45 documentation tests pass. The complete 2,387-page manual has 438,385 in-bounds word boxes and zero final warnings. Page 2292 is visually reviewed. No Rust API or runtime source changes are included in this documentation checkpoint. Original Docs CI 941/942 passes with all four complete terminal logs classified (765,214 bytes). Reference-resolution passes contain 36/1/0 warnings; the final render has zero warnings. No earlier failed workflow is restarted. Complete compiler-source admission, ordinary runtime adoption and both full guest builds remain open.

Compiler metadata checkpoint — 17 September 2026, signed 64fc14411a3f1629ace2854ddc1c3b7875113343: All 45 documentation tests pass. The complete 2,387-page manual has 438,492 in-bounds word boxes and zero final warnings. The changed paragraph is visually reviewed across pages 2292 and 2293. No Rust API or runtime source changes are included in this documentation checkpoint. Original Docs CI 943/944 passes with all four complete terminal logs classified (765,158 bytes). Reference-resolution passes contain 36/1/0 warnings; the final render has zero warnings. No earlier failed workflow is restarted. Complete compiler-source admission, ordinary runtime adoption and both full guest builds remain open.

Coordinated terminal observation checkpoint — 17 September 2026: Signed revision be98a93e6f34a9c7ecaffabfa0af1c8f209feff3 is pushed. The native and process-service manual contracts and three signed-source API snapshots are updated. All 45 documentation tests pass. The complete 2,389-page PDF has zero final warnings and 439,146 in-bounds word boxes; native, service and API pages were visually reviewed, including corrected literal shift operators. Typed mediator bootstrap, ordinary service-image adoption and both complete EriX builds inside EriX remain open.

Reviewed bootstrap baseline manual — 17 September 2026: Signed revision 10ea454ebab2cb0ca465cedf52ff619c1fc7efd4 updates the testing chapter to
Rootd's reviewed 15,239-line release baseline and exact terminal-operation
ownership. Compiler-specific binary size is explicitly separate from performance
comparison. All 45 documentation tests and the complete 2,389-page manual pass;
there are no final warnings, all 439,184 word boxes are in bounds, and page 2334
was visually reviewed. Earlier original CI 945/946 passes with all four logs
complete (765,650 bytes; reference passes 36/1/0 warnings). The new signed
revision's original CI remains under observation. Complete builds inside EriX
and ordinary service-image adoption remain open.

Corrected original manual CI — 18 September 2026: Docs 10ea454ebab2cb0ca465cedf52ff619c1fc7efd4 passes original CI 947 and CI 948. All four logs are complete (765,634 bytes), all 45 tests pass, and the complete 2,389-page manual has zero final warnings after reference passes of 36/1/0 warnings. The later generation-bound cleanup manual update is still under local validation.

Generation-bound cleanup consumer acceptance — 18 September 2026: Signed revision 323da983653e6d6d25d012c2354f97afaaaa0699 is pushed. The manual documents native cleanup 56/57, retired selectors, exact framing, original deferred identity and pre-service retirement. Three API references are generated from verified signed source revisions. All 45 tests pass. The complete 2,397-page PDF has zero final warnings and 440,339 in-bounds word boxes; seven changed pages have been visually inspected. The testing chapter corrects Rootd audit-size evidence and records the actual native diagnostic scope. Original CI 949/950 remains under observation. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain open.

Original cleanup manual CI acceptance — 18 September 2026: Signed Docs 323da983653e6d6d25d012c2354f97afaaaa0699 passes CI 949 and CI 950. All four terminal logs are complete (767,338 bytes), all 45 tests pass and both complete 2,397-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements.

Returned-grant bootstrap custody design — 18 September 2026: Add distinct Procd PREPARE_REALM_BOOTSTRAP (0x432) on the existing
private Launchd route. The native pending caller must match a retained running
Launchd generation. Its exact 32-byte request carries u32 request ID, opcode,
original process/generation, source and original destination install-grant slots,
then two zero words. The actual sole receipt must be INSTALL_GRANT with exactly
GRANT|MINT. Slots are full-width descriptions; receipt, live inventory and native
matching-grant checks establish custody. Previously guarded, started, stale,
ordinary-role and malformed stages refuse before new effects.

Reserve exact rollback ownership first. Use the real returned grant and native
operation 53 to narrow the Created child's primary endpoint to RECV. Establish
an ancestor SEND branch under Kernel lifetime custody and a distinct nested
explicit revoker before any export. Retain the nested sender privately; dispose
the original master, unguarded sender and ancestor-only bypass aliases. The
returned install grant stays exclusively owned for later typed installation.
No new endpoint factory or expanded Process endpoint policy is implied.

The exact 32-byte capability-free reply echoes request/opcode/result/process/
generation, followed by a u32 custody state and two zero words. State 1 occurs
exactly with OK and confirms only guarded unstarted-stage custody; failure state
0 is not absence proof. Lost reply, rollback, abort, supervisor loss and terminal
cleanup must account for every reused scratch column, actual guard and exact
child identity. Uncertain disposal prevents reuse and ordinary continuation.

Keep ordinary mediator starts denied. Counted final receivers/configuration,
owned fair intake/provider/retirement progress, private execution, authenticated
readiness, initial receiver disposal, seal/publication, real two-realm client I/O
and both complete builds inside EriX remain required. Host models or this guarded
stage acknowledgment cannot substitute for those acceptance gates.

Returned-grant manual checkpoint — 18 September 2026: Signed Docs b6bd8ce32891a8b298228b8320d0565cef89141f documents the exact returned-grant request, custody acknowledgment, five retained scratch roles, native guard effects, source-absence requirement and cleanup boundaries. Three API snapshots come from the signed original component revisions; regeneration and provenance checks pass. All 45 tests pass. The complete 2,403-page manual has 441,471 in-bounds word boxes, seven changed pages visually reviewed and zero final warnings. Original CI 951 and CI 952 pass from all four complete logs (768,706 bytes); reference passes converge with 36/1/0 warnings and both final manuals have zero warnings. Runtime realm orchestration, actual consumer VM execution, fair progress and both complete builds inside EriX remain open requirements.

Deferred native cleanup checkpoint — 18 September 2026: Signed Docs da66c0efd61fc05be023210e1c0c58196b51b878 specifies one queued native attempt before intake, exact-generation owner rotation, first-error retention and acknowledgment-based removal. All 45 tests and the complete 2,403-page manual pass, with 441,578 in-bounds word boxes, two changed pages visually reviewed and zero final warnings. Shared API references are unchanged. Original documentation CI is under observation. Runtime consumer VM, complete realm fairness and full guest-build acceptance remain open.

Caller-local grant relocation design — 18 September 2026: Add immediate x86_64 syscall 0x54, RELOCATE_LOCAL_GRANT, taking source slot in argument 0 and destination slot in argument 1. Both fit u32, are nonzero and distinct; arguments 2–5 are zero. The return is the exact result in rax with zero auxiliary value. Admission uses the actual current Running native process and nonzero generation, checks both slots against its syscall window, and accepts only an actual held INSTALL_GRANT or REVOCATION_GRANT with its matching native record. Movement uses the existing unique-record rebinding within that same native CSpace; rights, child/generation installation scope and revocation lineage are preserved. No grant is constructed, copied, attenuated or retargeted. Malformed register shape rejects before context lookup; caller/window checks precede source lookup, then type/binding checks precede empty-destination admission. Ordinary validation refusal leaves inventory unchanged. The transition is serialized with process-terminal and reply-authority lifecycle changes. Owned CLAIM already selects receiving destinations before exposing request bytes; this operation lets a producer validate the received grant and then relocate it into an existing per-process custody slot. The operation itself does not validate a bootstrap request, install child authority or acknowledge application retirement. It adds no Process endpoint selector or general CNode route. Literal register, foreign/terminal caller, missing/fake binding, occupied destination, exact-rights/scope and actual CPL3 controls are required, followed by coordinated producer/consumer adoption and the remaining realm VM gates.

Original deferred-cleanup manual CI acceptance — 18 September 2026: Signed Docs da66c0efd61fc05be023210e1c0c58196b51b878 passes CI 953 and CI 954. All four terminal logs are complete (768,726 bytes), all 45 tests pass and both complete 2,403-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements.

Caller-local grant relocation checkpoint — 18 September 2026: Signed 623609ee627a4afba1340ee06c53678c4a562a88 documents syscall 0x54 register admission, actual Running caller and unique grant custody, exact error precedence and preserved installation/revocation scope. Three API references are regenerated from signed original shared revisions. All 45 tests, complete provenance/regeneration checks and the 2,403-page manual pass. All 442,370 word boxes are in bounds; nine changed pages are visually reviewed and final warnings are absent. The original whitespace preflight failure and subsequent terminology correction are retained. Original documentation CI is under observation. Actual owned service adoption, consumer VMs, complete realm fairness and both full builds inside EriX remain open.

Owned receiver request-budget contract — 18 September 2026: Extend register-only REGISTER (0x4C) to take the actual local RECV slot, maximum request payload bytes and maximum request capability count in arguments 0–2; arguments 3–5 remain zero and successful RDX is zero. Both budget values are explicit receiver declarations. Zero/zero admits only empty requests. The byte/slot/receipt receive layout must be addressable and capability capacity must fit native private CSpace storage. The actual Running generation and held generic RECV endpoint remain the registration authority. Exact repeated registration is idempotent only with the same budget; a different budget or owner conflicts without modifying the original registration. Replacement follows the existing actual receiver-binding removal and exact native retirement rules. SUBMIT compares actual payload length and capability count against that exact registration before request allocation, private-space reservation, native transfer or invocation serial acceptance. Oversized requests return ordinary INVALID_ARGUMENT with zero owner ID and unchanged source custody. The packet decoder passes its checked capability iterator directly to native preparation, removing its redundant temporary vector. Accepted invocation, result-budget, delivery, draining and retirement contracts remain explicit. Migrate every producer and fixture to the new signature without a deprecated unbounded fallback. These budgets describe service-owned receiving storage; they add no global CALL-size ceiling, user-pointer retention, foreign selector or capability grant. Literal malformed/zero/exact registration controls, rejected-inventory checks, actual CPL3 calls and existing VM oracles are required. Then connect the owned Procd/Launchd bootstrap path through its held private route, actual claimed caller identity, server-chosen grant receipt and local relocation, retaining each committed/draining owner through exhaustive cleanup. Actual consumer VMs, complete fair realm progress and both full guest builds remain open acceptance requirements.

Original local grant relocation manual CI acceptance — 18 September 2026: Signed Docs 623609ee627a4afba1340ee06c53678c4a562a88 passes CI 955 and CI 956. All four terminal logs are complete (768,754 bytes), all 45 tests pass and both complete 2,403-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements.

Explicit owned receiver admission acceptance — 18 September 2026: Signed 8361618f3f047479a9e52ffaba7f2607be99413c. The manual documents explicit receiver request limits, complete layout addressability, immutable registration and pre-custody refusal, with accurate allocation-observation scope. Three public API snapshots are regenerated from signed shared revisions. All 45 tests, provenance/regeneration checks and the 2,407-page manual pass. All 442,761 word boxes are in bounds; eight changed pages are visually reviewed, with zero final warnings. Original CI is under observation. Actual owned Procd/Launchd service adoption, consumer VM execution, complete realm fairness/readiness/sealing and both full builds inside EriX remain open.

Owned guarded-bootstrap service contract — 18 September 2026: Migrate PREPARE_REALM_BOOTSTRAP to native owned request/result custody on the already held private Launchd-to-Procd endpoint. Its exact 16-byte body contains request/opcode/process/generation only; remove obsolete source and destination slot descriptions. The canonical capability-free response remains 32 bytes. No legacy bootstrap transport fallback is retained.

Procd registers explicit 16-byte/one-capability request limits, supplies an actually empty local receiving slot, validates the committed receipt type and rights and matches the native claimed origin to the retained Running Launchd generation. It validates the exact staged mediator row and actual grant scope before adopting the grant into that row through caller-local relocation. Existing launch-description staging may be reused only with explicit exclusive ownership and proved completion of its former cleanup; add no broad Process authority or per-realm scratch column. Numeric identity or receipt metadata never replaces actual possession or scope validation.

The running service loop must give native retirement a turn before owned bootstrap and ordinary intake. Retain nonzero delivery/invocation owners, received authority, exact child rollback and first cleanup failure through committed/draining outcomes. Complete every independent local and child retirement action before relinquishing bookkeeping; uncertain cleanup cannot return a service to ordinary work. Authenticate actual native origin and revalidate the original supervisor before effects; do not manufacture legacy pending-caller or source-slot receipts.

Replace Launchd synchronous bootstrap exchange with retained progress driven by its actual runtime orchestration. Success requires a canonical correlated result, actual source-grant absence and complete invocation retirement. Connect this to authenticated staged realm preparation, with no public numeric shortcut into a prepared process. Preserve ordinary start refusal until realm configuration, readiness and sealing are complete.

Acceptance requires adversarial ownership/cancellation/partial-cleanup host controls, strict coordinated builds and real producer/consumer VM execution. Native primitives alone do not establish service adoption, complete fairness or a full guest build. Existing ordinary source/effect/frame and two complete EriX-in-EriX build gates remain unchanged.

Original receiver admission manual CI acceptance — 18 September 2026: Signed Docs 8361618f3f047479a9e52ffaba7f2607be99413c passes CI 957 and CI 958. All four terminal logs are complete (769,554 bytes), all 45 tests pass and both complete 2,407-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements.

Owned bootstrap receiver checkpoint — 18 September 2026: Signed Docs 5c1cf6da319787738fa03f3cc6f526e49604aa09 updates the process-services contract and three source-bound shared API snapshots for the identity-only request and retained native delivery. All 45 tests, three signed API exports, provenance/regeneration checks and the complete 2,407-page manual pass. All 442,920 word boxes are in bounds; seven rendered pages were visually reviewed and final output has no warnings. Original CI 959/960 is under observation. Actual Launchd runtime orchestration, consumer VM execution and both complete guest builds remain open.

Original owned bootstrap manual CI acceptance — 18 September 2026: Signed Docs 5c1cf6da319787738fa03f3cc6f526e49604aa09 passes CI 959 and CI 960. All four terminal logs are complete (769,578 bytes), all 45 tests pass and both complete 2,407-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements.

Original realm supervisor and producer cancellation contract — 18 September 2026: Extend BEGIN_MATERIALIZATION to an exact 64-byte body. Its existing 56-byte semantic image description is followed by two full-width u32 fields: original supervisor process ID and generation. Both are nonzero only for the realm mediator role; both must be zero for every other role. Reject the obsolete 56-byte shape. Coordinate the shared codec, Loaderd and Procd through one original pinned dependency graph.

On PREPARE_REALM, Loaderd obtains the supervisor pair from the actual native pending caller on its private Launchd receiver. Procd authenticates the actual Loaderd caller on its materialization receiver and matches the forwarded supervisor to its retained Running Launchd generation before any child effect. The pair describes delegated lifecycle responsibility; numbers alone never confer creation, installation or rollback authority. Retain that original owner before materialization and through grant handoff, native submit/claim and guarded staging. Supervisor terminality retires active preparation and every corresponding stage before unrelated provider cleanup. Guard admission must match the original supervisor, never replace it with a later claimant.

Launchd retains child rollback and native invocation ownership separately. Caller RELEASE initiates cancellation and must precede any ordinary abort request that could wait behind Procd delivery retirement. RELEASE is not an application rollback acknowledgment: preserve the exact child obligation until its separate cleanup proof. Procd exhausts independent local and child cleanup before server RELINQUISH. Both parties retain nonzero native IDs and the first cleanup failure through draining; no uncertain state returns to ordinary work.

Actual Launchd runtime preparation and scheduler adoption, deployment-sized ownership storage, adversarial host controls and real producer/consumer VM execution remain required. Guarded staging does not authorize ordinary start or establish configuration, readiness, sealing, complete fairness or either full EriX build inside EriX. Existing source, effect and frame gates remain.

Original supervisor manual checkpoint — 18 September 2026: Signed a410759e5515b18107f25efb0319ad7c85871a64 documents private caller attestation, the exact 64-byte materialization begin, original ownership before creation and handoff, and separate caller RELEASE cancellation and application rollback. Three shared API snapshots match original signed source exports. All 45 tests, provenance/regeneration checks and the complete 2,409-page manual pass. All 443,265 word boxes are in bounds; seven rendered pages were inspected and final output has zero warnings. Original CI 961 and CI 962 remain under observation. Actual Launchd owned runtime adoption, consumer VM execution and both full guest builds remain open.

Original supervisor manual CI acceptance — 18 September 2026: Signed Docs a410759e5515b18107f25efb0319ad7c85871a64 passes CI 961 and CI 962. All four terminal logs are complete (769,994 bytes), all 45 tests pass and both complete 2,409-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements.

Retained realm caller checkpoint — 18 September 2026: Signed 4dcbc10e32ebf257139bcbaf07bc1081b9589780 is pushed. The process-service manual describes the retained native caller, permanent source absence, cancellation ordering and independent child retirement. All 45 tests and the complete 2,409-page manual pass. All 443,468 word bounds are valid, both changed pages were visually inspected and final warnings are zero. No Rust implementation or generated API snapshot changes. Original CI 963/964 is under observation. Runtime admission, scheduler integration, consumer VM proof and both full guest builds remain separate requirements.

Caller-bound realm admission and retained storage contract — 18 September 2026

Use distinct Launchd operations BEGIN_REALM 0x6D0, PREPARE_REALM 0x6D1,
ABORT_REALM 0x6D2 and READ_REALM 0x6D3. The existing 0x6B0–0x6BF range belongs
to filesystem providers and is not reused. Little-endian bodies are exact, with
nonzero request correlation and no fallback to ordinary launch transactions.

BEGIN_REALM is an authority-free 8-byte request (request ID, operation). Derive
session, authority realm, original process/generation and Running job from the
actual native pending caller. Reserve an independently budgeted realm record,
a nonwrapping generation and one disjoint executable-scope receipt slot before
replying. Client numeric identities or a bearer sender cannot select ownership.

PREPARE_REALM has a 32-byte prefix: request ID and operation (u32), realm record
ID and generation (u64 each), and selector byte length (u64), followed by exactly
that nonempty UTF-8 selector without NUL. Parsing adds no pathname or packet-size
ceiling. The request carries exactly one actual SEND-only directory endpoint to
the reserved receipt slot. Verify the original caller/job/session/authority realm
again and retire every unretained received capability on refusal. Resolve only
inside this explicit directory, authenticate the exact executable and manifest,
and call Loaderd's existing private PREPARE_REALM. Never imply a Posixd pathname,
Named route, root, cwd, TTY stream, ordinary job or public PreparedProcess input.

ABORT_REALM and READ_REALM are authority-free 24-byte requests: request ID,
operation and complete realm-record ID/generation. They require the same original
Running native owner. READ observes retained state only; ABORT must complete
independent source, invocation and exact-child retirement before its successful
acknowledgment. Parent terminality initiates the same retained cleanup internally.

All four operations have an exact 40-byte capability-free response: request ID,
operation, raw result and state (u32 each), record ID and generation (u64 each),
receipt slot and zero reserved word (u32 each). States are Unconfirmed=0,
Reserved=1, Preparing=2, Guarded=3, Retiring=4 and Retired=5. Success at BEGIN
requires Reserved, a nonzero complete handle and receipt slot. PREPARE success
requires Guarded; ABORT success requires Retired. READ returns an authenticated
nonzero state. Only successful BEGIN returns a receipt slot; every other result
has zero there. Failure always has Unconfirmed state; failed BEGIN has a zero
handle while other failures echo the original complete request handle. Unknown
nonzero result codes remain full-width. Unconfirmed proves no resource absence.
Correlate the complete response with the original request before using evidence.

Replace obsolete LCH1 v2 with exact 72-byte version3 startup policy. Preserve the
first 68-byte field order and append realm_capacity (u32 at offset68). Require an
explicit deployment value: zero disables new realm reservations, and nonzero
values allocate that many retained records and disjoint receipt slots. Validate
checked job-route + stream-route + realm-receipt arithmetic before leaving any
ordinary transaction receipt storage. No default or incidental fixed array sets
realm count. Coordinate shared startup codecs, Rootd payloads, Launchd arena and
Integration policy/packaging; old version/width must reject. Extend the native
capacity descriptor with the realm record's size/alignment and a new layout
version; do not assume ordinary reply records survive long enough for realms.

Keep original child, local scope/grant obligations and native invocation owners
independent. Actual scheduler progress must exclude ordinary and indirect blocking
peer calls while any native invocation needs progress. A permanently discharged
source slot is never revisited after reuse. Native release precedes ordinary
exact-child abort; preserve first errors and exhaust independent cleanup without
returning uncertain state to normal operation. Guarded staging remains private
and unstarted, without exported SEND or a Running job. This initial admission
interface does not define configuration, readiness, sealing or publication.

Coordinated host negatives, strict source-bound build matrices and real consumer
VM execution are required. Two mediator processes, two clients per realm with
actual mediated I/O, complete fair progress, source/effect/frame admission and
both full builds inside EriX remain separate open acceptance requirements.

Original retained caller manual CI acceptance — 18 September 2026: Signed Docs 4dcbc10e32ebf257139bcbaf07bc1081b9589780 passes CI 963 and CI 964. All four terminal logs are complete (770,022 bytes), all 45 tests pass and both complete 2,409-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements.

Caller-bound realm record checkpoint — 18 September 2026: Signed 9868cf0e6f2c366b4a2c7992594a83c72789f1f0 is pushed. The manual describes exact realm admission messages, original-caller binding, explicit LCH1 version-3 capacity and independent native storage. Four API references select the signed shared graph; stale bootstrap width, version and route-stride prose is corrected. All 45 tests, API provenance/regeneration checks and the complete 2,417-page manual pass. All 445,195 word bounds are valid, seven rendered pages were reviewed and final warnings are zero. Original CI 965/966 is under observation. Actual runtime admission, coherent image consumers, mediated client I/O and both full guest builds remain open.

Original realm admission manual CI acceptance — 18 September 2026: Signed Docs 9868cf0e6f2c366b4a2c7992594a83c72789f1f0 passes CI 965 and CI 966. All four terminal logs are complete (771,742 bytes), all 45 tests pass and both complete 2,417-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements.

Exact realm executable preparation checkpoint — 18 September 2026: Signed 880bdc59818b1eff9cf9929004680f354f8265a0 is pushed. The manual documents actual exact preparation, shared authentication, scratch reuse and independent retained cleanup, while keeping dispatcher, scheduler and consumer-image requirements open. All 45 tests and the full 2,419-page manual pass; all 445,389 word bounds and both changed rendered pages are reviewed, with zero final warnings. Shared API snapshots are unchanged. Original CI 967/968 is under observation. Complete mediated execution and both full builds inside EriX remain required.

Original exact preparation manual CI acceptance — 18 September 2026: Signed Docs 880bdc59818b1eff9cf9929004680f354f8265a0 passes CI 967 and CI 968. All four terminal logs are complete (772,086 bytes), all 45 tests pass and both complete 2,419-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements.

Public realm dispatch and progress checkpoint — 18 September 2026: Signed 099f0c570414ca486bb2104c1510fbf3b84d59fb is pushed. The manual describes public realm intake, independently held replies, original-parent cleanup and fair native progress before ordinary dispatch, while preserving separate consumer VM and guest-build acceptance. All 45 tests and the complete 2,419-page manual pass. All 445,563 word boxes are within page bounds; both changed rendered pages are visually reviewed, with zero final warnings. Shared API snapshots are unchanged. Original CI is under observation; no runnable realm or guest build is claimed.

Original public realm dispatch manual CI acceptance — 18 September 2026: Signed Docs 099f0c570414ca486bb2104c1510fbf3b84d59fb passes CI 969 and CI 970. All four terminal logs are complete (772,182 bytes), all 45 tests pass and both complete 2,419-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements.

Realm startup consumer manual checkpoint — 18 September 2026: Signed 33733ceba228669e27152aee32f997d6c72264ff describes exact realm startup consumers, explicit disabled or positive deployment capacity and the reviewed Rootd production audit. All 45 tests and the complete 2,419-page manual pass, with 445,650 word boxes within page bounds, two visually reviewed changed pages and zero final warnings. Shared API snapshots are unchanged. Original CI 971/972 is under observation. Coherent catalog adoption and actual consumer VMs remain required before image acceptance; no runnable realm or full guest build is claimed.

Original coherent realm source CI acceptance — 18 September 2026: Signed 33733ceba228669e27152aee32f997d6c72264ff passes CI 972 and CI 971. All four terminal logs are complete (772,194 bytes), with zero final warnings. This closes the original CI observation recorded above. All 45 tests and both 2,419-page manuals pass; reference-pass warnings converge 36/1/0. Coherent catalog publication, actual consumer VMs and full guest-build acceptance remain separate open requirements.

Native external-toolchain rebuild requirement — 19 September 2026: Signed b54d28e755dd415079100a19683ee1474edb4ed1 makes the native rebuild an explicit Phase 6 verification and acceptance gate. The first compiler may be cross-built for EriX against its libc/sysroot, Rust OS bindings and declared C/C++ runtime closure. The extended development image must then rebuild the selected upstream Rust/LLVM toolchain inside EriX using supplied offline recipes and an explicit bootstrap compiler. Require working guest-built tools and use in at least one full EriX build, with no unrecorded porting changes, downloads, Linux executables or host build delegation. Complete source, runtime, log and measured-resource evidence is required; compiler ownership remains distinct. All 45 documentation tests and the full 2,419-page manual pass, with 445,775 in-bounds word boxes, actual visual review of the changed page and zero final warnings. Shared API snapshots are unchanged. The phase master, toolchain issue and full-build issue contain the matching requirements. Original documentation CI is under observation; the native toolchain rebuild and both OS builds remain unproven.

Tracking and rollout

The matching signed Docs PR 4, 54557713f4afad380c1166f6aa1c1622d3959744, updates the TeX chapter and both IPC API views from original signed source. All 45 tests, independent API regeneration, the complete 2,423-page manual, all 446,749 word bounds and nine visually reviewed contract pages pass, with zero final warnings. Original Docs CI 979 and 980 pass from four complete hashed logs, 773,034 bytes. Both runs pass 45 tests and the complete 2,423-page manual; successive TeX passes retain 36/1/0 warning observations, with zero final-pass warnings. No workflow rerun or cancellation supplies this result. Native upstream Rust/LLVM rebuilding and both complete EriX build generations inside EriX remain required.

Native child-custody wire checkpoint — 19 September 2026: signed lib-ipc PR 2, aaf2df39700b43507b23ff2007bc0d573c4eea30, implements ChildLifetimeBindingV1, native operation 58 and supervisor-termination kill reason 4. The request preserves the exact child/generation and actual local grant slot, with no owner selector, rights mask or withdrawal form. Existing Process authority and current Running attribution remain separate native requirements. All reserved bits are rejected; replies carry zero result values and preserve uninterpreted codes. Lost replies retain the original cleanup obligation. See the shared contract and Kernel design #19.

Seven new controls pass all eight strict library/shim configurations: 419 wire tests and 20 shim tests per configuration, eight freestanding builds, formatting, strict host/native Clippy and private rustdoc, with no warnings. The original kernel-only shim test remains ignored. Original lib-ipc CI 365 and 366 pass from four complete hashed logs, 494,246 bytes, without warnings. Kernel admission, descendant stopping, safe native reclamation progress, coherent consumer adoption and actual CPL3 failure coverage remain open. The shared codec does not enable private mediator execution or alter the current complete image's source graph.

Native caller admission checkpoint — 15 September 2026

Signed Procd c583614aa48f3e11a3ccabfeee06340f518de750 now checks the actual pending native caller on Launchd ingress against its retained running Launchd process and stage generation before operation-specific receipt validation or dispatch. Forwarded SEND aliases, request-body identities, other lifecycle roles, reused generations and unavailable identity cannot acquire this dispatch permission. Other receivers retain their policy; rejected delivered transfers still undergo local disposal, and uncertain disposal stops ordinary continuation.

Five new producer controls exercise accepted event dispatch and refusals without consuming the private event. The complete strict host/native development/release matrix passes: 239 default-feature tests, 244 all-feature tests, Clippy, rustdoc, formatting and forty native binary builds, with no warnings. The changed runtime-loop fragment is formatted by the repository formatter; its other code matches the formatted original outside the reviewed admission replacement.

Signed documentation 45d4d04c534f2ebca857ee203265232fd7c32bbe passes 45 tests and a frozen 2,375-page manual with 433,469 in-bounds word boxes and no final warnings. Page 212 was visually reviewed. The receiver inventory also corrects the existing powerbox omission and obsolete loader operation count. Shared API snapshots are unchanged.

Procd CI 274/275 and Docs CI 879/880 pass with complete classified logs and no final warnings. Both component cohorts are complete. Product runtime-image validation still requires a coherent original-commit dependency graph; this checkpoint does not claim a new Procd VM. Actual returned-grant custody, guarded bootstrap, readiness/configuration/seal, mediated client byte I/O, fair retirement and both complete guest build generations remain open.

Mediator constructor adoption manual — 15 September 2026

The manual now records Procd's mediator-only use of operation 54 without a parent VSpace receipt, independent native TCB backing, unchanged ordinary construction, refusal without fallback and closed start gates. Signed original documentation revision: 8b30523f3d7e1c300f39e3418a8748dae10ec04f. All 45 tests, Markdown/templates, source-bound rendering, all-page bounds checks and visual review of pages 186, 187 and 213 pass. The final manual has 2,375 pages, 433,374 in-bounds word boxes and zero final warnings. CI 877/878 passes with complete classified logs. The original signed shared API snapshots are unchanged; no fresh API export is claimed. An earlier render is retained for its earlier text; the final source removes stale language listing root omission as future consumer work.

This documents the accepted Procd producer change, not a new Procd CPL3 VM or runtime image. Authenticated grant return, guarded private execution, readiness, configuration/seal, client I/O, fair retirement and both full guest build generations remain open.

Construction without child root capabilities — 15 September 2026

Docs CI 875/876 passes with complete classified logs; reference passes converge to zero final warnings.

Document the construction selector, exact request, caller and child inventory, native backing lifetime, rollback and consumer gates; regenerate the shared API references. Signed original revision: 4af92b0b1ae2b8fa8e12166959057857ab6e07e8. All 45 documentation tests, Markdown, templates, source-reference checks, API regeneration/check, final rendering and actual changed-page visual review pass. The manual has 2,375 pages, 433,333 in-bounds word boxes and zero final warnings. The first render was rejected because an operation-registry correction followed its source snapshot; accepted evidence uses frozen final text.

Procd adoption, authenticated grant return, guarded bootstrap authority, private mediator execution, readiness, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase semantic authority and private-item documentation audits remain incomplete.

Staged endpoint attenuation checkpoint — 15 September 2026

Document staged primary endpoint attenuation in the kernel-control registry, normative wire/authority contract, mediator bootstrap prerequisites and regenerated shared API references. Signed original revision: b751a385ca727f7fed82c7d83a11f6971245b495. All 45 documentation tests pass. The complete manual renders 2,371 pages and 432,348 in-bounds word boxes with zero final warnings. Actual pages 185, 609 and 1034 pass visual review. Three shared API references were regenerated and independently checked from signed original revisions. Docs CI 873/874 passes with complete classified logs; reference passes converge to zero final warnings.

Authenticated grant return, independently minimal bootstrap/root authority, retained native and nested guards, private mediator execution, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase authority and private-item documentation audits remain incomplete.

Signed Docs c6b0b677f16cd31cdc7555515729b376d5ff5c52 refreshes the public issue index to all 154 issues, including Integration issue 50, and records the accepted IPC platform manual CI. The two changed Markdown files pass all 45 documentation tests, 55-file Markdown lint, canonical governance/headings and exact public-link inventory checks.

Every manual source, API reference and manual build input remains identical to accepted Docs 87942ea7, whose complete local manual and CI 843/844 pass with zero final warnings. No Rust crate or runtime interface changes in this index/status update. Push CI 845 and PR CI 846 pass at this signed source. Four full logs total 752,638 bytes. Both manual jobs pass 45 tests and converge through 2,325/2,339/2,339 pages with 31/1/0 reference warnings and no final warnings or layout diagnostics. Both 55-file Markdown jobs pass. CI reports a 4,114,917-byte PDF; the artifact was not separately downloaded.

Signed Docs 87942ea7675e2a25fe3bf19f3cac19f9c5d8b1e2 specifies native IPC platform selection and hosted transport refusal, with both IPC API references generated from signed Lib-ipc 805717680d9dfb902216550a111d910807f30d23. All 2,593 ABI and 24 shim public signatures remain unchanged, as do the other 33 reference selections. Compile-target selection, local refusal, native observations and retirement evidence remain distinct.

All 45 documentation tests and 55 Markdown files pass. The complete 2,339-page manual builds in 163.82 seconds with zero final warnings. All 426,697 word boxes fit within page bounds, and three changed pages pass visual review. PDF SHA256 is 3a8e702ecf43066f4b3dde37d22d2a527fdce810bfe7e7b43f5f4912c020a6c5. Canonical governance, document headings, links, generated references and whitespace checks pass. Docs has no Cargo crate; the selected IPC source passes its strict matrix and CI 335/336.

Push CI 843 and PR CI 844 pass at this signed source. Four complete logs total 752,618 bytes. Each manual job passes 45 tests and converges through 2,325/2,339/2,339 pages; 31 first-pass and one second-pass reference warnings resolve, leaving zero final warnings and no layout diagnostics. Both Markdown jobs pass all 55 files. CI reports a 4,114,917-byte PDF; its artifact bytes were not independently inspected. The separate local PDF geometry and visual checks pass. Earlier native lifetime and runtime namespace documentation remains accepted at Docs 17b4d52a with CI 841/842. Realm adoption, separate operation-completion contracts, the whole-codebase audit and both full EriX-in-EriX builds remain open.

Signed Docs 17b4d52a9a84e0803746e3a38eb34f070bfb28a4 documents the accepted isolated native lifetime fixture and the Bootloader runtime-symbol namespace boundary. The diagnostic uses actual CPL3 owners, ordinary exit and Process-endpoint kill, exact alias/event witnesses and an explicit typed kernel-only reporter. Rust v0 defining-path recognition preserves the existing runtime namespace and exact authenticated export checks. The public coordination index contains all 153 current issues, including the three observed diagnostic/build defects.

All 45 documentation tests and 55 Markdown files pass locally. The complete 2,339-page manual builds in 164.50 seconds with zero final warnings. All 426,453 word boxes fit within page bounds; changed pages 65 and 162 pass visual review. PDF SHA256 is 2b5df3bb6edb8cbc6e667c798148c73f46a0170fc6abec7cb04615f158cf58af. Existing generated API references and renderer code are unchanged. Docs contains no Cargo crate; Rust behavior is validated in its owning repositories.

Push CI 841 and PR CI 842 pass for this signed source. Four complete logs total 752,178 bytes. Each manual job passes 45 tests and converges through 2,325/2,339/2,339 pages: 30 first-pass and one second-pass reference warnings resolve, with zero final warnings or layout diagnostics. Both Markdown jobs pass all 55 files. CI reports a 4,113,243-byte PDF; its bytes and geometry were not independently inspected. The separate local whole-PDF and two-page visual review passes. The earlier syscall/API checkpoint 28b44183 already passes CI 839/840. Kernel 03e13a78 passes CI 528/529 and Bootloader e7fa3935 passes CI 135/136; the coordinated Integration 4b65755f native VM passes the required exit and ordered unique markers. Realm adoption, provider/pending-operation completion, the full audit and both complete builds inside EriX remain open.

Current signed Docs 28b44183368c512da9c5b804f570ff497ae3b6fc passes push CI 839 and PR CI 840, completed by 08:14:56 UTC on September 14. Four complete logs total 752,154 bytes and correlate with the original workflow and build scripts. Each manual job passes 45 tests and finishes at 2,339 pages with zero final warnings; thirty first-pass and one second-pass convergence warnings resolve. Both Markdown jobs check 55 files with zero errors. CI logs report a 4,111,798-byte PDF; its artifact bytes and geometry were not independently inspected. The separate local full-PDF and five-page visual review passes. This closes renderer issue #7 only; native VM, realm producer, full audits and guest self-hosting remain open.

Signed Docs 28b44183368c512da9c5b804f570ff497ae3b6fc documents native local lifetime revocation and corrects the opaque named-field renderer (#7). Fresh original-source IPC/shim references preserve every old signature and add only the syscall assignment and safe wrapper. All 45 Docs tests, both generation checks, 55 Markdown files, canonical governance/headings/links and the 150-issue index pass. The full 2,339-page manual builds in 165.44 seconds with zero final warnings; all 426,181 word boxes fit and five selected pages pass visual review. Push CI 839 and PR CI 840 both pass as recorded above. Native VM, realm producer, complete audits and both full build generations inside EriX remain open.

Dependencies: meta#2

Dependencies identify required contracts and closure gates; preparatory inventory/design can proceed in parallel under one owner per edited file. Link bounded implementation issues and their PRs here before claiming acceptance. Use feature/posix-compat, regular signed commits in the canonical contribution format, and WIP PRs linked to the exact coherent component graph. All cross-repository Cargo/catalog selections and CI helpers use full 40-character lowercase commit hashes, including transitive dependencies; do not substitute branch, tag or implicit HEAD selection.

Close criteria only with their own reviewed deliverables and validation evidence. Pending, skipped, cancelled, failed or predecessor-only results remain distinct. Keep main images unchanged until explicit promotion direction; technical completion does not authorize merges, release tags or publication.

Original Docs CI 973 and 974, at b54d28e755dd415079100a19683ee1474edb4ed1, pass. All 45 tests and the complete 2,419-page manual pass; intermediate reference-resolution passes converge to zero final warnings. All four terminal logs are complete and hashed, totaling 772,186 bytes. This validates the native-toolchain rebuild requirement in the phase document and manual, not an actual toolchain or EriX build inside EriX.

Signed private-route manual correction — 19 September 2026: ce8a1538ab2220f1b346e1a051265f58f83f47fc documents realm admission through both the public receiver and the shell's authenticated private script route, retaining original reply custody and caller proof. A stale startup-publication paragraph now states the permanent coherent-source and distinct runtime-evidence requirements. All 45 tests and the full 2,419-page manual pass; all 445,834 rendered words are within bounds, revised page 224 has been visually reviewed and final warnings are absent. Shared API snapshots are unchanged. Original CI 975 and 976 are running. Native external Rust/LLVM rebuilding and both full EriX build generations remain required.

Original manual CI 975/976 passes from all four complete hashed logs (772,174 bytes): 45 tests, the full 2,419-page manual and zero final-pass warnings. Signed Integration 9139c6c5fa38c139e92520f6d410626b4cf1e4aa now adopts this documentation with the matching corrected-server VM, which passes its unchanged caller-admission scenario. Complete mediator execution, native toolchain rebuilding and both full guest builds remain required.

Guarded-custody documentation reconciliation — 19 September 2026: signed Posixd PR 5, 9b031a8c2f996491a322046a4f2acd5dacdc55c2, replaces stale grant-return and proposed-custody gaps with the implemented producer boundary. Procd uses the actual returned grant to attenuate the initial endpoint to RECV before execution, removes bypass sources, and retains nested custody beneath Kernel lifetime custody. A later mediator disposal report cannot prove absence of bypass senders. Exact staged abort and the remaining counted startup, readiness, configuration, sealing, client I/O and running-realm retirement requirements are distinguished. This repository still has no Posixd executable.

Markdown, canonical headings/governance, local links, original source anchors and whitespace checks pass. Original Posixd CI 17 and 18 both pass from two complete hashed logs totaling 7,232 bytes without warnings. Rust checks do not apply to this documentation-only repository.

Signed Docs PR 4, 7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d, removes the matching stale passages from the process-services manual. All 45 tests and the full 2,419-page manual pass. All 445,847 word boxes lie within page bounds; the actual changed paragraphs and continuation on pages 222, 226 and 227 are visually reviewed, with zero final warnings. Shared API snapshots are unchanged. Original Docs CI 977 and 978 are running. These documentation corrections add no runtime behavior; the previously retained Integration 78557a6c672ecf426dfe894a01cc4aeec73b5e3c appliance retains its original source selection and passing guarded-preparation evidence. Native upstream Rust/LLVM rebuilding and both complete EriX builds remain required.

Original Docs CI 977/978 passes for signed 7b79f8d50a. All four complete hashed logs total 772,186 bytes. Both runs pass 45 tests and the full 2,419-page manual; successive TeX passes retain 36/1/0 warning observations, with zero final-pass warnings. No unchanged workflow rerun or cancellation supplies this result.

Native child lifetime checkpoint — 19 September 2026: Signed Docs 9ca5a5e811 updates the technical manual's native admission, preflight, stopping, partial cleanup and safe return/idle contracts. All 45 tests and the complete 2,425-page manual pass with zero final warnings. All 447,213 word boxes are in bounds and all three changed contract pages are visually reviewed. Shared API reference source is unchanged. Original Docs CI 981 and 982 pass from four complete hashed logs, 773,510 bytes. Both pass 45 tests and the complete 2,425-page manual. TeX pass warning counts are 36/1/0, with zero final-pass warnings; neither workflow was rerun or cancelled.

The matching original signed Kernel and both maintained native VMs pass without warnings; Kernel issue 19 retains exact runtime evidence and open executing-child, no-successor, further failure and consumer gates. Signed Integration 581226ab5435dc66c6f93157606b6d4d83475b15 selects the coherent original Kernel/lib-capabi/lib-ipc graph and updated manual. All four current strict 320/321-test configurations, four native builds, fmt, strict host/native Clippy and private rustdoc pass without warnings. Source and updated native-policy checks pass; the full 169-helper evidence remains bound to unchanged orchestration bytes. The final post-VM changes select only the newer Docs revision and update roadmap status; native source catalog, scenario, runtime and orchestration bytes are unchanged. Original Integration CI 1683 and 1684 are queued.

Executing-child and terminal-reply checkpoint — 19 September 2026: signed Kernel dd9eace5 validates actual CPL3 nested-child execution and current-child ancestor termination. Synchronous control dispatch now ends its request borrow before effects and checks original caller identity, generation and terminal state before any response write. It keeps terminal completion in Kernel-owned result registers with zero reply length; ordinary native return switches away. A surviving caller retains its normal encoded response. Two focused actual-object regressions cover terminal request preservation and the surviving-caller reply. The dispatcher is split from the tracing/policy file. A supervisor binds and starts a child; that child binds a staged grandchild and kills its supervisor through its own explicit Process SEND route. Read-only witnesses require terminal caller storage to survive dispatch, then exact child/grandchild absence before the independent observer reads child-before-supervisor events. Both terminal payloads have immediate UD2 sentinels. An unrelated Created process retains its exact record, empty capability inventory and mappings until explicitly aborted. All four additional lifetimes and twenty-two mapped pages must be disposed for ERIX_KERNEL:CHILD_EXECUTION_OK.

Four strict Kernel configurations pass 720/744 library tests and both standalone controls; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Signed Integration c14c5a61 requires the additional marker while preserving every earlier marker and the original 60-second limit. Both actual native scenarios pass, with 1,870/1,587 complete serial bytes, empty QEMU stderr and no build warnings. Packaged Kernel bytes equal retained original artifacts after normal stripping; all fifteen original source signatures verify. Lifetime serial SHA256 is 1b2f983239efca55c8bc0f6f08ee91cfdcd37d4d1f6951bbd740e4d9b45d1a2f. Four current Integration 320/321-test configurations, native builds, strict Clippy, formatting, private rustdoc and updated policy checks pass. Earlier 169-helper evidence is hash-verified against unchanged orchestration; it was not rerun for these scenario/catalog changes.

Signed Docs b4b01d87 documents the executing-child observations and remaining limits. All 45 tests, the full 2,425-page manual, 447,382 word bounds and visual review of the changed pages pass, with zero final warnings. The API reference source is unchanged.

This extends native executing-child evidence; it does not establish no-successor native idle/wake behavior, provider completion, Procd adoption or a complete service lifecycle. The original install-grant constructor still gives GRANT | MINT while binding needs only GRANT; move-only transfer preserves exact rights. Both diagnostic grants are consumed, but rights minimization remains an explicit audit follow-up. Full source/effect/frame proof, the Pagerd gate, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.

Related implementation tracking: Kernel feature, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.

Original Kernel CI 614 and 615 pass from four complete hashed logs, 753,462 bytes, without warnings. Original Docs CI 983 and 984 pass from four complete hashed logs, 773,542 bytes. Both pass all 45 tests and the complete 2,425-page final manual; reference-resolution warning counts are 36/1/0, with zero final warnings. Original Integration CI 1685/1686 remains queued at its second observation.

Older original Integration CI 1678 passes all 489 catalog scenarios and both native Kernel diagnostics, then fails the development COM1 editor probe after its physical counterpart passes. Rust and Markdown pass. All three complete logs total 13,384,697 bytes with no warnings; the outer input status does not establish cause. The canonical bug report is issue 67, with bug/ci/phase-6 metadata. Earlier editor and filesystem failures remain separate. No original workflow was cancelled or rerun.

Native cleanup without a userspace successor — 19 September 2026: signed Kernel 2cf5b34c adds a seventh actual CPL3 caller to the maintained lifetime diagnostic. After every earlier assertion, the observer binds/starts the final child and yields. The child kills that supervisor through its own explicit Process SEND route. Immediate faulting sentinels forbid either terminal payload from resuming. Ordinary native return closes CPU accounting, detaches current attribution, progresses reclamation and finds no runnable successor.

A diagnostic-only read-only witness then requires empty CPU accounting, only terminal retained records, no bound cleanup duties or event reservations, exact child identity/CSpace/mapping absence and both unconsumed child-before-supervisor events. All six final child pages retire; three original unbound terminal records remain for prior assertions. The witness neither performs cleanup nor selects a process nor installs an interrupt. ERIX_KERNEL:CHILD_IDLE_CLEANUP_OK precedes completion before HLT, so actual hardware halt/wakeup remains a separate gate.

Signed Integration 4d6f4fe8 requires the additional marker while preserving all earlier assertions and both 60-second scenario limits. Both actual native VMs pass: 1,905/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256: 4a7cba61f75f4eeac47896d165b8dbcd217e4c75e2a81c8ae0f29957facb929c. Packaged Kernel images match retained build artifacts after normal stripping; all fifteen original component signatures verify. Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Post-VM changes only select updated Docs in full catalogs and update roadmap status.

Signed Docs 69466a64 documents the pre-halt boundary and consolidates stale status paragraphs. All 45 tests, the complete 2,425-page manual, 447,534 word bounds and visual review of pages 562–564 pass with zero final warnings. API reference source remains unchanged. The static audit passes 3,140 authored code files below 1,000 lines, 74 manifests, 259 full Git selections, 171 direct missing_docs gates and 92 conventional crate roots; semantic authority and complete private-rustdoc closure remain open.

Original Kernel CI 616 and 617 pass from four complete hashed logs, 753,458 bytes, with no warnings. Original Docs CI 985 and 986 also pass: four complete hashed logs, 773,510 bytes; both pass 45 tests and the final 2,425-page manual. Reference-resolution warning counts are 36/1/0 with zero final warnings. Original Integration CI 1687/1688 remains queued at its first observation.

Older original Integration CI 1677 is now terminal failure: all 489 catalog cases, both native diagnostics, development physical/COM1 editor and release physical editor pass before release COM1 fails. Rust and Markdown pass. Three complete logs total 13,385,246 bytes without warnings; bug 37 retains this evidence. Companion 1678's earlier development COM1 failure remains separate in bug 67; a common cause is unproven. No original workflow was cancelled or rerun.

Further native failure controls, grant-rights minimization, terminal accounting, Procd adoption and complete service lifecycle acceptance remain open. Existing install-grant creation still supplies GRANT | MINT while binding needs GRANT, so minimum authority is not claimed. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.

Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.

Native terminal-event allocation refusal — 19 September 2026: signed Kernel ba03995f extends the actual executing-child sequence with one deliberately refused heap allocation. Separate diagnostic preparation captures the original supervisor, child, staged grandchild and independent process records/capability inventories, then gives an empty event queue one-event capacity. No queued event or existing reservation is discarded. The first terminal-event reservation succeeds; the second arms exactly one null return from the real Kernel allocator. Ordinary collection growth and Process dispatch return RESOURCE_EXHAUSTED before any terminal effect.

Read-only witnesses require complete reservation rollback, an empty event queue, unchanged exact records and capabilities, and preserved code/stack/message mapping ranges. Actual CPL3 instructions validate the refusal reply before the next ordinary ancestor kill succeeds with allocation available. Every earlier terminal, descendant-disposal, independent-process and no-successor idle assertion remains required. ERIX_KERNEL:TERMINAL_EVENT_RESERVATION_OK requires one consumed allocator refusal and no remaining armed fault. Fault controls are absent from ordinary images; this covers injected allocation failure, not spontaneous heap exhaustion or independent resource-release failure. No witness supplies a syscall result, cleanup effect or scheduler choice.

Signed Integration cf5b2f5f requires the new marker without changing either 60-second limit. Both maintained native VMs pass: 1,948/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is d485019082175f769ecc2d406d88c6cc84a7df323605027663f5bcc79ca03ad9. Packaged Kernel bytes match retained original artifacts after normal stripping, and all fifteen original source signatures verify. Post-VM changes only select updated Docs in full catalogs and consolidate roadmap status.

Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and updated policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed Docs 62ba2ffa passes 45 tests, the complete 2,425-page manual, all 447,688 word bounds and actual visual review of pages 562–565, with zero final warnings; API reference source remains unchanged. The static audit passes 3,142 authored code files below 1,000 lines, 74 manifests, 259 full Git pins, 171 direct missing_docs gates and 92 conventional roots. Complete semantic authority and private-rustdoc closure remain open.

Original Kernel CI 618 and 619 pass from four complete hashed logs, 753,434 bytes, with zero warnings. Original Docs CI 987 and 988 pass from four complete hashed logs, 773,506 bytes: both pass 45 tests and the final 2,425-page manual, with reference-resolution warning counts 36/1/0 and zero final warnings. Original Integration CI 1689/1690 is queued. Earlier filesystem, directory, editor and full-frame regressions remain unresolved; original workflows were not cancelled or rerun.

The terminal-accounting audit confirms that ordinary Procd terminal handling queries original TCB counters after receiving its event, while automatic bound-child reclamation removes that TCB. Its separate private-mediator branch does not take the same query path; adoption must state which lifetimes require retained metrics and preserve their original generation without fabricated zero/wall-clock values. Independent release-failure coverage, grant-rights minimization, accounting, Procd adoption and full mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.

Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.

Independent native child release recovery — 19 September 2026: signed Kernel 82d88b60 extends actual supervisor-exit coverage with two deliberate refusals at the original staged child's final VSpace-release callback, after capability disposal and unlinking. The first error is KernelHeapExhausted, the second CspaceSlotMissing. Read-only observations around two ordinary CPL3 observer yields require the original full record, generation, abort custody and first error retained, an empty original CSpace and retained mapped backing. The independent running child must already be absent from native TCB, CSpace and VSpace directories. The selected child's earlier directory position ensures its failure preceded that independent disposal.

The third callback must perform normal VSpace release before all original terminal-event, generation and resource-absence checks pass. ERIX_KERNEL:CHILD_RELEASE_ISOLATION_OK requires exactly two refusals and complete eventual disposal. Fault control uses only atomics at the locked callback boundary and exists only in the isolated native diagnostic. No witness performs cleanup, supplies a successful release/syscall result or chooses a scheduler target. This establishes injected callback-refusal coverage, not an observed hardware or allocator malfunction. All earlier nested-child, allocation-refusal and no-successor pre-halt assertions remain required.

Signed Integration 294a467a requires the added marker with both original 60-second limits unchanged. Both maintained native VMs pass: 1,988/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is 606fff037be022c876220d8e8f329c9046ffea5dcdf80831026649aedfbe0b08. Packaged Kernel bytes match retained original unstripped artifacts after normal stripping, and all fifteen original component signatures verify. Post-VM changes only select the updated manual source in full catalogs and reconcile roadmap status.

Four strict Kernel 720/744-test configurations, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test configurations, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed Docs 2a0ccc1a passes 45 tests, the complete 2,427-page manual, all 447,789 word bounds and actual visual review of pages 562–565 with zero final warnings. API reference source is unchanged. Static audit passes 3,143 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 171 direct missing_docs gates and 92 conventional roots; complete semantic authority/private-rustdoc closure remains open.

Original Kernel CI 620/621 and Docs CI 989/990 pass from four complete hashed logs each (753,438/773,910 bytes), with zero final warnings. Current Integration originals are observed after publication. Earlier filesystem, directory, editor and full-frame regressions remain unresolved, with original evidence retained; no workflow is cancelled or retried unchanged.

The grant-rights audit confirms actual Procd derivation callers and exact GRANT | MINT receipt checks in Procd and Launchd. Grant authority minimization must coordinate those consumers and distinguish the grant's own rights from its installation ceiling. Original generation-bound terminal accounting, Procd adoption, provider completion, hardware halt/wakeup and complete mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.

Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.

Manual and dependency validation — 20 September 2026:

Docs commit f4621ce2921b2b9fe3b1d25b4321d6b28289418e is signed and pushed. Native selectors 32/33/54 now document exact own rights separately from installation ceilings. The process and launch chapters require GRANT-only final receipts, explicit derivation/source disposal, and original-generation rollback. Both IPC references are regenerated from signed source. All 45 tests and API checks pass; the complete 2,429-page manual has zero final warnings, all 448,913 word bounds pass, and eleven changed pages were visually reviewed. Original Docs CI 991/992 passes with four complete hashed logs, 774,346 bytes, both 45-test runs and final 2,429-page manuals. Intermediate TeX reference warnings resolve before the final pass.

Canonical acceptance remains 15/460 leaves, 3.48% weighted. Full service lifecycle, terminal accounting, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain required. Static audit currently passes 3,150 authored code files below 1,000 lines, 74 manifests, 259 explicit Git pins, 172 direct missing_docs gates and 92 conventional Rust roots; full semantic authority and documentation review remain open.

Verified managed installer recovery — 21 September 2026:

Signed Integration 648fbd5614d3d0b82223b1c3bb7f1b5a0c81ea7d in WIP PR 12 selects signed Procd ac8a12993bc8cbf134a11e141e459cb63df71123 and Docs PR 4. Both full original catalogs pass all 72/71 manifest checks against 73/70 clean selected checkouts and all 143 verified signatures. Twenty dependency and 46 immutable-source tests, native scenario policies, Markdown and whitespace pass. The unchanged orchestration crate retains its verified four 320/321-unit configurations, four native builds and strict Clippy/rustdoc evidence. Original Integration CI 1697/1698 is running; no complete regression-suite pass is claimed.

Procd bug 4 is corrected. The added producer regression reproduces the original 1056/1040 mismatch. Procd derives exactly GRANT into disposed VSpace scratch, drops its delegating source and uniquely relocates the result into the now-empty managed grant slot before handoff. The downstream TTY checks remain strict. Four 291/296-unit configurations, four native builds, formatting, strict Clippy and private rustdoc pass without warnings; relocation refusal and occupied-destination controls retain original-stage cleanup. Original correction CI 294/295 passes from four complete logs, 344,660 bytes. The subsequent roadmap-only checkpoint keeps every runtime source byte unchanged and original CI 296/297 passes from four complete logs, 344,680 bytes, zero warnings.

The maintained initial-shell start/exit, realm-admission and normal release-appliance VM scenarios all pass on their first corrected attempts with original guest bounds and watchdogs. The release appliance executes the real product-shell command and produces standalone LOOKUPOK output, separate from its echoed input. All three builds are warning-free and QEMU stderr is empty. Serial logs retain 55,702, 55,738 and 364 bytes respectively. Actual images, full artifact sets, scenario oracles and original signatures are retained. These runs execute Procd 10d972b652297fd656e9a6ac6dbdf197f362c7ce; the selected later Procd commit changes only its roadmap. All 73 executed component signatures and clean source trees verify. The earlier 431/489 and 430/489 full CI failures remain recorded, including the independent ext4 quota timeout; those runs are not rewritten as passes.

The native-launch manual now explains the managed return destination, exact rights, unique relocation and partial-failure cleanup. All 45 tests, the complete 2,429-page manual, 448,970 word bounds and changed-page visual review pass without final warnings. Original Docs CI 993/994 passes from four complete logs, 774,342 bytes; each final TeX pass is warning-free after normal earlier reference resolution. Existing generated API references are unchanged.

Canonical acceptance remains 15/460 leaves, 3.48% weighted. This is a repaired runtime regression, not completion of a canonical lifecycle leaf. Original-generation terminal accounting, provider/lifetime completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. Exsh's retained release compiler and frame-proof failures stay open.

Committed terminal-accounting consumers — 21 September 2026:

Procd 66934642c4464fc738152a9e60790914ba27dd1c in WIP PR 2 reserves notification/crash/cleanup storage before effects, obtains exact final CPU evidence, commits local status and cleanup obligations, then acknowledges on every actual event polling path. Lost acknowledgement replies preserve the local result without duplicate counters or notifications. Mediators retain only scalar counters and the original authenticated supervisor identity after disposing all capability columns; supervisor death discharges the pending scalar observation and a replacement cannot inherit it. Four strict 299/305-test configurations, native builds, Clippy and private rustdoc pass. Original CI 298/299 passes from four complete hashed logs, 347,245 bytes, zero warnings. Bug 5 remains open for actual service acceptance.

Rootd 64c97b13c450003d9c2b6bd9ed2a627088684b46 in WIP PR 2 acknowledges bootstrap evidence only after exact native destruction and local endpoint absence; both operations remain unavailable after temporary Process custody transfers to Procd. Four strict 430/429-test configurations, native builds, Clippy and private rustdoc pass. Original 1039/1040 exposed bug 7: a stale source-call inventory and its matching semantic operation declarations. The correction explicitly inventories acknowledgement consumers and preserves the same temporary route and eventual Procd owner. All 64 Python controls, production-boundary, semantic baseline, threat model, phase contract and operation-ownership gates pass. Corrected original CI 1041/1042 passes from four complete verified logs, 222,969 bytes, zero warnings. Bug 7 is corrected; failed original runs remain retained without reruns or weaker gates.

Docs e4525848ad4462901c9a6794ef1794cf85ea9e6b updates the native contract, Procd/Rootd consumer custody and original signed IPC API references. Selector 55 is retired in both the detailed contract and summary; 58/59/60 are cross-checked against the shared registry. All 45 documentation tests and generated-reference checks pass. The complete 2,431-page manual builds without warnings; changed prose, selector and API pages pass visual review. Original documentation CI 995/996 and corrected-table 997/998 passes from eight complete logs, 1,549,628 bytes, with zero warnings in the final LaTeX passes. The 37 earlier convergence candidates per manual log are retained and resolved.

The separate Integration orchestration library checkpoint b06dfad00202765491a64552dde29eaca1c24838 passes four strict 320/321-test host/native configurations. Full service catalogs remain on their prior coherent graph while 35 remaining application/service repositories adopt the original shared revisions. Integration 1697/1698 remains running, and 1699/1700 plus 1701/1702 waits at the latest bounded observations. These are pending full regressions, not successful runtime acceptance.

No new canonical acceptance leaf is closed: 15/460 and 3.48% weighted. Ordinary Launchd metric-consumer restart/disposal semantics, coherent service CPU/profiler VMs, complete realm/provider authority and I/O, source/effect/frame proof, Pagerd, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. The static audit finds 3,162 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 173 direct missing-docs gates and 92 conventional crate roots; this does not establish semantic authority or complete private-documentation closure.

Explicit frame-tool manual — 21 September 2026: signed f8a40d45fbbd631660f3adca9152fbb398a4ee6d documents selected disassembler/helper custody, minimal child environment, bounded cleanup and preserved failure evidence. All 45 tests, the complete 2,431-page manual and 449,997 rendered word bounds pass. The changed page passes visual review, final warnings are absent and shared API reference sources remain unchanged. Original CI 999/1000 is monitored separately. Full native Rust/LLVM/runtime rebuilding and both EriX guest build generations remain required in Phase 6 completion.

Original frame-manual CI acceptance — 21 September 2026: signed f8a40d45fbbd631660f3adca9152fbb398a4ee6d passes both original 999/1000, including 45 tests and the complete 2,431-page manual. Four complete hashed logs total 774,750 bytes. Each manual log retains 37 initial warning candidates; LaTeX reference-convergence passes report 35/1/0 warnings, and the final pass has no warnings or layout overflow. These expected early convergence messages remain visible in the original logs. The native external toolchain rebuild and both full guest build requirements remain open.

Signed startup source/feature correction — 21 September 2026:

Integration fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa requires the complete runtime transition in both Rootd and its orchestration policy. The direct Kernel builder records the actual local compiler feature closure, compares original source before and after linking, and includes source identity in its cache key. Contract v2 requires the Kernel revision/tree and actual artifact/metadata binding; old receipts, synthetic wrappers and modified source cannot acquire this declaration. This remains local observed provenance, not publisher authentication or complete compiler closure.

All 171 maintained helper commands have successful, warning-free final evidence. Eight new Kernel controls cover original trees, actual cfg closure, changed inputs, hidden/redirected source, custom builds, synthetic wrappers and cache identity. Sixteen fixture readers/writers now close files explicitly; bug 71 retains the original 36 resource warnings from 15 exit-zero commands. The previously unlisted filesystem-mirror fixture now participates in CI. Earlier Markdown failures also remain retained. Formatting, source policy and final Markdown pass; identical Rust inputs retain four strict orchestration matrices.

The technical manual update 76672dff8ff83 passes 45 tests, 2,431 pages, 450,096 word bounds and both changed-page visual reviews. Original Docs 1001/1002 passes from four complete logs totaling 774,770 bytes. Each manual log retains its earlier reference-convergence warnings; final LaTeX passes have no warnings or layout overflow.

A fresh ordinary package from the signed Integration runner is under construction. Actual corrected image admission and startup capture remain pending under bug 69; no threshold or 120/15/10 capture limit changes. Original Integration 1705/1706 is monitored separately. Native external Rust/LLVM/runtime rebuilding and both complete EriX guest build generations remain mandatory.

Coherent scalar-consumer validation — 21 September 2026: signed Integration 07c883525ee5 selects Procd 59ee30a88534 in both complete catalogs. All 171 maintained helper commands pass without warnings; unchanged orchestration inputs retain four strict matrices. Five actual service VMs pass: shell CPU accounting, exec successor replacement, two-CPU read-only inspection, out-of-session denial and guarded realm preparation. Each preserves 106 hashed evidence files, clean QEMU stderr, warning-free image builds and all original markers under the unchanged 120-second guest limit. The build-plus-scenario times are 119.746880, 38.325332, 35.346729, 35.773237 and 55.339698 seconds respectively; these are not guest performance measurements. Inspection reports increasing job CPU counters with control disabled; numeric CPU utilization remains unproven.

Procd's four strict 308/314-test configurations and original CI 302/303 pass. The manual update passes 45 tests, all 2,431 pages, 450,185 word bounds and changed-page visual review. Original Docs CI 1003/1004 passes from four complete logs (774,710 bytes); retained reference-convergence warnings resolve to zero on final passes. All 3,166 authored code files remain below 1,000 lines.

Original Integration 1701/1702 remains running; 1703–1710 remains queued. Logd 240 remains failed with terminal logs unavailable through HTTP 500; no cause is inferred. No original job was restarted or cancelled. Remaining lifecycle control/event ownership, complete native fault/cleanup acceptance and the measured startup timing failures remain open. No whole acceptance leaf closes: 15/460, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain inside EriX and using it in the required full EriX guest-build generations remain mandatory and unproven.

Executed-code profiling checkpoint — 22 September 2026: signed Integration 4fa27f942bc2, tracked in Integration PR 12, adds bounded host TCG execution counters, explicit fresh-output ownership and exact packaged-ELF code candidates without adding guest authority. All 172 maintained helper commands pass without warnings. The profiler passes five Rust tests in both profiles, strict Clippy, private rustdoc, eleven Python controls and five actual selected-emulator controls. Unchanged orchestration inputs retain their preceding four strict matrices. The operator guide distinguishes complete counters from VM acceptance.

One original-image diagnostic retains 92,896 translated blocks, 1,994,216 code bytes and zero missed execution counts. Its top 100 code groups cover 85.65% of the translated instruction upper bound; 33.30% has Kernel mapping-batch candidates and 7.70% has VSpace permission-switch candidates among the selected ELF inputs. Unknown and ambiguous work remains visible. These are code matches, not process ownership or elapsed-time attribution. Both the instrumented attempt and its same-emulator uninstrumented control fail waiting for the final native-command marker under unchanged 120/15/10 collection bounds. Neither proves startup acceptance, whole-transcript instrumentation overhead or a speedup. Profiler acceptance and startup performance remain open. The next optimization must preserve complete validation, live backing checks, page permissions, invalidation ordering and cleanup on errors.

The signed manual update, tracked in Docs PR 4, passes 45 tests, all 2,431 pages, 450,367 word bounds and both changed-page visual reviews with zero final warnings or overflow. Original Docs CI 1005/1006 passes from four complete logs (774,674 bytes); initial reference-convergence warnings resolve on the final passes. Integration 1711/1712 is queued, while original 1701/1702 still runs. Existing queued jobs remain untouched. All 3,174 authored code files remain below 1,000 lines. No whole acceptance leaf closes: 15/460, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain inside EriX and completing the required full guest-build generations remain mandatory and unproven.

## Problem and motivation Auditable Rust APIs need documented ownership, authority, failure and unsafe invariants across every target. Existing prose and a public-item lint alone cannot demonstrate that private code, build scripts, examples and manual outputs are adequately documented. ## Proposed behavior and scope Inventory every crate target, enforce missing_docs without blanket escape hatches, document public and private contracts, and run warning-denied rustdoc with private items. Reconcile canonical component documents, headers, API references, manual pages and the technical manual. This issue records planned work; its unchecked criteria are not implementation proof. The normative basis is [Phase 6 and AC1–AC24](https://git.erikinkinen.fi/erix/docs/src/branch/main/phases/6.md). ## Authority, security and reliability Documentation must state real capability sources, lifetimes, denial and cleanup behavior rather than infer authority from names. Shared governance remains byte-identical to meta. Non-Rust code uses the language’s own comment format, and security-sensitive details stay in restricted reporting channels. Apply the priority order: security, reliability, then performance. Keep suspected vulnerabilities in the repository’s restricted SECURITY.md reporting channel. ## Acceptance criteria - [ ] Inventory every crate root and target, including binary-only, build-script, test/example and nested crates; identify existing missing_docs enforcement and every local allow/expect/doc-hidden escape. - [ ] Document crate/module purpose, trust boundary, owned/borrowed state, lifecycle, authority and error contracts using `//!`/`///` rustdoc comments. - [ ] Document every public item, field, variant, constant, associated item, macro and FFI export with semantics, units, ranges and failure behavior. - [ ] Document private functions, structures, fields and non-obvious algorithms as well; explain concurrency, mutation order, cleanup, complexity and invariants. `missing_docs` alone is not a private-code completeness audit. - [ ] Give unsafe APIs `# Safety`, and fallible/panicking APIs accurate `# Errors`/`# Panics` sections where applicable. Document each unsafe block's concrete invariant and why safe alternatives do not cover the operation. - [ ] Enforce `#![deny(missing_docs)]` or an equally non-bypassable shared lint policy in every EriX-authored crate/target; reject weakening attributes. Do not use blanket allowances, dummy comments or doc-hidden to pass the gate. - [ ] Add private-item documentation review/check coverage and run Rustdoc with `--document-private-items`; validate broken links and examples with `RUSTDOCFLAGS="-D warnings"` across supported target/feature profiles. - [ ] Ensure CI actually checks missing_docs in default and alternate feature builds, not only one public-library configuration; add a negative fixture proving undocumented public API fails the shared policy check. - [ ] Document non-Rust authored code inline in its language's supported comment format, including shell/Python tools and assembly boundary contracts. Do not pretend rustdoc parses unrelated languages. - [ ] Update `meta` standards/templates and propagate necessary policy changes deliberately. Repair stale canonical GenAI policy links to `docs/policies/generative-ai-contributions.md`; keep attribution optional. - [ ] Update README/ARCHITECTURE/ROADMAP and relevant manual chapters for each implemented ABI, realm, POSIX service, toolchain, profiler and build step; keep historical measurements separate from current guarantees. - [ ] Regenerate API references, test examples, build the whole manual, check final warnings/overflow/links and visually inspect changed rendered pages. Record toolchain/source provenance for the generated documentation. - [ ] Update canonical templates and every repository README to remove current-status/progress/checkpoint sections; put concise current state in ROADMAP/ARCHITECTURE and detailed historical evidence in linked issue/reports. - [ ] Refactor long README/ARCHITECTURE/ROADMAP paragraphs and exhaustive lists into short summaries plus focused design/API/operator documents. Preserve canonical headings, discoverability and normative invariants; do not hide important authority limitations or move status into another README section. - [ ] Keep help text, man pages, rustdoc, C headers, IPC specifications and technical manual consistent through shared semantic metadata where useful; validate coverage and examples, not merely that generated files exist. For each implementation slice, retain actual formatting, strict Clippy, unit/doctest and warning-denied build results for all altered Rust repositories and valid configurations. Add relevant runtime VM coverage, monitor older unit/VM regressions in exact-head CI, and update canonical component documents and affected technical-manual/API material. Every authored code file must remain below 1,000 physical lines, with meaningful inline documentation and missing_docs enforcement in Rust crates. ## Alternatives and tradeoffs Dummy comments, hidden APIs and lint allowances make checks green without helping a reviewer. Keep useful inline invariants, concise canonical navigation and detailed contracts in their owning API/manual documents. Validation checkpoint — 14 September 2026: Signed Docs `013ec09aafd9412990fec8231ceb73e7d1a1c94f` records all 156 public issues. All 45 documentation tests and 55 Markdown files pass. Manual/API/build inputs remain byte-identical to the preceding accepted source. CI [847](https://git.erikinkinen.fi/erix/docs/actions/runs/847) and [848](https://git.erikinkinen.fi/erix/docs/actions/runs/848) pass with four complete logs totaling 752,642 bytes. Both manual jobs converge through 2,325/2,339/2,339 pages and 31/1/0 reference warnings, with no final layout warnings. The reported PDF is 4,114,917 bytes; no CI artifact bytes were downloaded. Validation checkpoint — 14 September 2026: Signed Posixd `52ef820d33399490c121aad3af1409139e4a8f44` selects the proposed realm custody owner: Procd deposits an ancestor SEND-lineage revoker into its exact native generation before export and retains a nested guard for earlier realm retirement. Exported aliases descend from the nested guard; ancestor-only bypass and setup aliases must be removed before publication. Kernel supplies the existing terminal trigger; children, provider leases, receiver aliases and pending operations retain separate owners and acknowledgments. This is a documented design; Posixd has no executable crate or implemented realm handshake. Posixd CI [5](https://git.erikinkinen.fi/erix/posixd/actions/runs/5) and [6](https://git.erikinkinen.fi/erix/posixd/actions/runs/6) pass with complete warning-free logs. Signed Docs `d9bb106b94deb7c2af620775dc98be0cc46ae704` updates the process-services manual and records the separate [owned invocation design](https://git.erikinkinen.fi/erix/kernel/issues/11). All 45 Docs tests and 55 Markdown files pass. The 2,341-page local manual has zero final warnings; 426,812 word boxes fit page bounds and the changed page was visually reviewed. Docs CI [849](https://git.erikinkinen.fi/erix/docs/actions/runs/849) and [850](https://git.erikinkinen.fi/erix/docs/actions/runs/850) pass; their manual jobs converge through 2,327/2,341/2,341 pages and 32/1/0 reference warnings, with no final layout warning. All six complete Posixd/Docs job logs total 760,808 bytes. Runtime producer adoption, realm byte I/O and both complete guest build generations remain open. Allocator validation checkpoint — 14 September 2026: Signed Docs `5b171773c78938b78d0b6d9865d50ece8535682f` records all 158 public issues. All 45 documentation tests, Markdown and heading checks pass. Rendered manual/API/build inputs are unchanged from the accepted realm manual. CI [851](https://git.erikinkinen.fi/erix/docs/actions/runs/851) and [852](https://git.erikinkinen.fi/erix/docs/actions/runs/852) pass with four complete logs totaling 753,560 bytes. Both manual jobs converge through 2,327/2,341/2,341 pages and 32/1/0 reference warnings, with no final layout warning. Static inventory covers 76 repositories and 2,890 code files below 1,000 lines; all 92 library/binary and 62 additional standalone test/example/bench/build-script roots directly gate missing_docs. This does not establish private-documentation quality or whole-authority closure. Endpoint construction checkpoint — 14 September 2026: Signed Docs `e923440acecfe775ed71a4f046b8e7daa3d25447` documents explicit endpoint construction and the proposed request/result custody obligations. All 45 documentation tests and canonical Markdown/structure checks pass. The local 2,341-page manual has zero final warnings; all 426,861 word boxes fit the pages and changed page 183 is visually reviewed. CI [853](https://git.erikinkinen.fi/erix/docs/actions/runs/853)/[854](https://git.erikinkinen.fi/erix/docs/actions/runs/854) passes with four complete logs totaling 753,568 bytes. Both manual jobs converge through 2,327/2,341/2,341 pages and 32/1/0 reference warnings, with zero final layout warnings. All 158 public issues remain indexed. Completed CI checkpoint — 15 September 2026: Signed Integration `a869a81eb406a4f027a2b5db573b6330ca114d94` passes both [1607](https://git.erikinkinen.fi/erix/integration/actions/runs/1607)/[1608](https://git.erikinkinen.fi/erix/integration/actions/runs/1608); signed endpoint-construction checkpoint `989d44d604d07c4c9bcc23264912bdf2076b99eb` passes both [1609](https://git.erikinkinen.fi/erix/integration/actions/runs/1609)/[1610](https://git.erikinkinen.fi/erix/integration/actions/runs/1610). Each run reports all 486 distinct VM scenarios passing, followed by the actual native lifetime scenario, physical/serial interactive checks and all four console modes. Rust and Markdown pass. The two six-log cohorts contain 26,769,289 and 26,769,316 bytes respectively, with zero warning candidates. The previously observed intermittent quota timeout remains documented without a causal-fix claim. These results establish the selected source checkpoints, not owned invocation transport, complete authority closure or either full in-EriX build generation. Native transfer preparation checkpoint — 15 September 2026: Signed Docs `0fe830c906bc95255d4be18413b0c054bf224e0c` documents complete native transfer preparation and the pre-delivery rollback serialization boundary. All 45 documentation tests and canonical Markdown/structure checks pass. The complete 2,341-page manual has zero final warnings; all 426,948 word boxes fit the pages and changed page 144 is visually reviewed. Docs CI [855](https://git.erikinkinen.fi/erix/docs/actions/runs/855)/[856](https://git.erikinkinen.fi/erix/docs/actions/runs/856) passes with zero final warnings; intermediate reference passes converge through 32/1/0 warnings. All 158 public issues remain indexed. Generated API/build inputs are unchanged. This implements preparation for the current IPC path. Its private records cannot survive userspace scheduling and own no retained source authority. Persistent request/result bytes and capability custody, exact delivery state and terminal hooks remain unimplemented under [Kernel issue 11](https://git.erikinkinen.fi/erix/kernel/issues/11). No opcode, wire record, bootstrap-frame escrow eligibility or application-cancellation semantics are assigned. Native invocation custody checkpoint — 15 September 2026: Signed Docs `76b657ad8b8ba8df7f55f17ce739301a80d22802` indexes all 159 public issues, including the canonical fixture bug report. The native custody manual checkpoint `073da485626c3d74f68d0beb2da47ac8400c23d3` passes CI [857](https://git.erikinkinen.fi/erix/docs/actions/runs/857)/[858](https://git.erikinkinen.fi/erix/docs/actions/runs/858): 45 tests, 2,343 pages and zero final warnings after 32/1/0 reference convergence. Local layout review checks all 427,174 word boxes within page bounds and visually reviews changed page 144. The later index-only checkpoint passes all 45 tests and changes no manual or generated API/build input. Corrected signed-head Kernel CI [548](https://git.erikinkinen.fi/erix/kernel/actions/runs/548)/[549](https://git.erikinkinen.fi/erix/kernel/actions/runs/549) and Docs [859](https://git.erikinkinen.fi/erix/docs/actions/runs/859)/[860](https://git.erikinkinen.fi/erix/docs/actions/runs/860) pass. All 8 complete logs total 1,413,966 bytes, with zero final warnings. The terminal cohort is classified. The syscall wire adapter, fresh userspace buffer/fault/overlap validation, authenticated caller-origin delivery fields and actual CPL3 owned-invocation peers remain unimplemented. Reachable backend disposal-failure coverage, sustained invocation-workload profiling, realm producer adoption, whole-codebase authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire record is assigned; the existing CALL/RECV/REPLY ABI is unchanged. Authenticated delivery-origin checkpoint — 15 September 2026: Signed Docs `c728670ccc57a1c200b1bfc2ebb359920c1a2256` updates the technical manual and roadmap with the origin/liveness/authority distinction. All 45 tests pass; the complete 2,343-page manual has zero final warnings, all 427,252 word boxes within page bounds, and visual review of changed pages 144/145. CI reference passes converge through 32/1/0 warnings. The public index retains all 159 issues; no new issue is introduced by this slice. Kernel CI [550](https://git.erikinkinen.fi/erix/kernel/actions/runs/550)/[551](https://git.erikinkinen.fi/erix/kernel/actions/runs/551) and Docs [861](https://git.erikinkinen.fi/erix/docs/actions/runs/861)/[862](https://git.erikinkinen.fi/erix/docs/actions/runs/862) pass. All eight complete logs total 1,414,891 bytes, with zero final warnings; the cohort is classified and stopped. The separate earlier fixture correction remains closed in [Kernel issue 13](https://git.erikinkinen.fi/erix/kernel/issues/13), preserving original CI 546/547 and corrected 548/549. Sustained invocation-workload profiling, syscall wire and fresh-buffer/fault/overlap validation, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm producer adoption, whole authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire layout is assigned. Native progress and cleanup still do not certify application cancellation. Native invocation profiling baseline — 15 September 2026: Signed Kernel `6cb703e1ed8b9de0d29a37189cd914cd501e732e` provides an actual-object host workload for queued progress, collected progress, descriptive result reads and complete request/result cycles. Signed Integration `f3e4359b34cb8f7db732fbf38823f722553c86d4` adds bounded capture, raw-evidence report verification and equivalent comparisons. Every sample checks exact bytes and SEND capability bindings, authenticated origin, foreign selection, duplicate completion refusal, FIFO position reuse, one-time collection and final invocation disposal. Source and executable bytes are observed against explicit original identities; compiler/host relationships remain declarations. Workload children and source Git reads receive minimal environments; capture owns memory, time, output and process cleanup. Completion is published only after deadline teardown succeeds. The operator guide and signed Docs `644273a0edd91e4c38dcd4418d6ae1119ff1f10b` describe these boundaries. Kernel strict default/all development/release checks pass 632/656 units plus three standalone controls, three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. Integration passes all 161 helper commands, including 19 profiler controls and nine source-provenance controls, plus fresh strict 320/321-unit Rust matrices, private rustdoc and warning-free target builds. Four original socket-fixture failures are retained and attributed to the selected temporary directory exceeding the host Unix-socket path domain; a shorter explicit private directory passes the same fixtures. Docs passes 45 tests and renders 2,345 pages with zero final warnings; 427,592 word boxes fit page bounds and changed pages 2284/2285 pass visual review. Kernel CI 552/553 and Docs CI 863/864 pass; eight complete logs total 1,431,762 bytes with zero final warnings after manual reference convergence. No Kernel performance algorithm has changed in this baseline. Native syscall adapters, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The 76-repository inventory has 2,923 code files below 1,000 lines and 155 direct missing_docs crate-root gates; this does not close the semantic audits. Measured native invocation lookup refinement — 15 September 2026: Signed Kernel `8349d68636382cc7e25a3347f5f1df216554203a` retains only numeric carrier-search positions. Every use rechecks the actual CSpace capability type/rights, live endpoint identity and exact binding; stale positions take the complete search path. No successful authorization, capability or reference is cached. Draining scans fix their boundary on the first poll, visit each position at most once, skip busy stack owners and return exclusive custody after unlocking. Native disposal and first-failure retention preserve their existing semantics. Signed Integration `108501cf7ec20f05dd3d62ea401ea8adad6c6e9c` selects this Kernel in its isolated native catalog, and signed Docs `f10a1d375a326543ec0adda4569bc7cb4faca9b6` documents the invariants. The existing syscall ABI and ordinary image catalog are unchanged. All 15 actual-object native controls pass, including real alias compaction, rights/type/object replacement, busy ownership and allocation-free settlement. The unchanged four-mode workload control also passes. Full strict default/all development/release Kernel matrices pass 634/658 units plus three standalone controls, with three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. The existing native lifetime and entry-argument VM passes unchanged oracles in 21.978041 seconds of host build-and-run time, with clean teardown and empty QEMU stderr. Its signed boot image is 2,207,744 bytes, SHA-256 `4030cdfb8a13c000ff4716ecdc5203cb46273d6117a282f7375f25dccbbeedc9`. Exact unchanged Integration Rust/helper bytes preserve the preceding strict 320/321-unit matrices and all 161 helper-command results; changed catalog/scenario policies pass. Docs passes all 45 tests and a complete 2,345-page render with zero final warnings, 427,679 bounded word boxes and visual review of page 145 plus continuation page 146. The original signed Kernel `6cb703e1ed8b9de0d29a37189cd914cd501e732e` and the new signed Kernel use byte-identical workload sources, the same selected CPU/toolchain/context and explicit limits, distinct source targets, four modes, populations 0/32/128/512 and 256 operations per sample. Each capture retains 48 measured samples and 16 warmups; every sample passes actual semantic and native/process-cleanup checks. At population 512, median queued-progress cost changes from 117.578 to 37.673 microseconds (3.12x observed ratio), and full-cycle cost from 1167.847 to 443.055 microseconds (2.64x). Collected progress changes from 8.928 to 6.015 microseconds and descriptive reads from 9.124 to 6.212 microseconds. Timings include fixed checks, with no subtracted overhead or timing-ratio pass gate. No managed build/test workload runs concurrently during capture; external host scheduling remains unisolated. These are host operation wall times, not guest startup/build acceptance or a statistical guarantee. Kernel CI 554/555 succeeds; four complete logs total 679,280 bytes with no warnings, and its completed cohort is stopped. Docs CI 865/866 succeeds at observation three; four complete logs total 754,424 bytes, all 45 tests pass and each manual has 2,345 pages. Its normal reference passes report 32/1/0 warnings, with zero final warnings and no box diagnostics. The completed Docs cohort is stopped. Integration CI 1619/1620 is waiting at its first observation. Older Integration 1613/1614 is running; 1615/1616 and 1617/1618 are waiting. Accepted older Integration 1611/1612 passes all 486 catalog scenarios and later probes with complete warning-free logs. This does not establish the intermittent quota cause tracked in Integration issue 18. Current full-suite CI remains required; stopped cohorts are not polled again. Owned syscall wire adapters, actual owned CPL3 peers, fresh-buffer validation, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The refreshed 76-repository inventory has 2,924 code files below 1,000 lines and 155 direct missing_docs crate-root gates; those checks do not close whole-codebase semantic audits. Owned invocation wire and native acceptance — 15 September 2026: Signed Kernel `5f497adaefa526108a0439e0e071717dddb85334`, shared IPC `de968da19898bef532ddb3b5974bb9562f51dee5`, capability ABI `a001a26f0eb3aebec3f5fd02a28d98f1bc23f8a0` and Integration `9030b217c490db6ad3ec60a799cb025eccbfcdb1` implement and exercise the immediate owned invocation boundary. The allocation-free shared codecs and shim preserve exact return metadata, including a retained draining owner on failed submission. The Kernel checks fresh complete user mappings and packet framing under one lifecycle guard before native effects. No user pointer or caller-selected identity is retained. Destination capacity and descriptive receipt capacity are independent; spare capacity acquires no authority and repeated collection cannot duplicate transfers. Existing numeric binding hints still recheck live capabilities on every use. The real three-process CPL3 scenario passes all eight operations, full-span pointer/rights/overflow/reserved-field rejection, actual returned selectors, payload/capability/origin checks, collection after server exit and repeated receipts. A second request rejects premature relinquishment, enters draining on caller release and retires only after the exact server acknowledgment. Current signed owned and unchanged older lifetime images are each 2,232,320 bytes, with SHA-256 `588c6097c57ebd2ed92e0f0b76f2b1ad6b82630b4a0da272ee98e218eb8e333d` and `8f9026aaefd2c5a745e35467ac01c71789c5f469f9cd42a477f87818747ee673` respectively. Both runs have clean teardown and empty QEMU stderr. Ordinary images contain neither diagnostic hook. Strict default/all development/release host, freestanding and rustdoc matrices pass: IPC 368 units, shim 20, capability ABI 191, Kernel 642/666 and Integration 320/321. Existing ignores remain one shim and three Kernel tests. All 162 maintained Integration helper commands pass; three prior correct concurrent-run lock refusals are retained and their sequential checks pass on unchanged executable inputs. Docs `46da7a4cb4d38a2bea5b5491a68f51f33e4b4305` publishes the normative register/packet contract and regenerates the three affected API references from original signed revisions. All 45 documentation tests pass. The complete 2,363-page manual has zero final warnings, 430,365 word boxes within page bounds and reviewed changed ABI/API pages. Shared IPC CI 337/338 and capability ABI CI 214/215 pass with eight complete warning-free logs. Both Kernel revisions pass CI 556/557 and 558/559 with eight complete warning-free logs. Those cohorts are stopped. Current Docs CI 867/868 passes at observation four; four complete logs total 758,328 bytes. Both 2,363-page manuals pass all 45 tests, report normal reference-pass warnings of 32/1/0, and finish with zero warnings or box diagnostics. Its cohort is stopped. Current full Integration 1621/1622 is waiting. Older full Integration 1613/1614 now passes all 486 catalog scenarios and later native/console probes, with six complete warning-free logs; its cohort is stopped. Older 1615/1616 is running, and 1617/1618 plus 1619/1620 are waiting. Current full-suite acceptance remains open, as does the intermittent quota cause in Integration issue 18. This checkpoint supersedes the earlier pending wire/CPL3/manual status. Reachable backend disposal-failure coverage, broader revocation/generation-reuse scenarios, producer adoption, realm runtime, complete authority/inline-documentation audits and both full EriX-in-EriX build generations remain open. The current inventory checks 76 repositories, 2,943 code files below 1,000 lines and 157 crate roots with direct missing_docs gates; it does not establish semantic audit closure. No complete guest build or guest performance result is claimed. Process-bound native acceptance — 15 September 2026: Signed Kernel `60da5858d7198185efd103f0e91e5ac2e0b63e67` implements control operation 52, checking the actual moved install grant against expected process/generation with exact rights, including zero, under existing endpoint policies. Signed Procd `f1105706cc19ed024a6cca79a29abc57c90c6661` uses this operation in its actual ordinary launch-description producer while retaining the narrow SEND receipt, pending state and exact failure cleanup. IPC `c453b697b8cdb9cc1c36f1ad89ff868648190025`, capability ABI `fe8d558253ad01301b99554e20d287c4ea35bb1d` and five aligned helper commits preserve original Git/type identity. Integration `58c925c564b69bebce8df6f3e75a9312824e18c4` passes the expanded lifetime CPL3 scenario with thirteen actual control calls, user-side reply checks, two staged children and full added-custody disposal. The corrected lifetime image SHA-256 is `8e6a9e8f68b90cc1ede61300958cec122b82a7c6dfd6318a51e40fefc7ba166e`; the unchanged owned-invocation scenario also passes with image SHA-256 `b76a380d3cd6b03b0ff61a3b626ace0667679920684ad7356a1c3a36e2224953`. Both have clean teardown and empty QEMU stderr. The initial fixture setup-order failure is retained and corrected in Kernel issue #14. All strict default/all development/release matrices pass: IPC 371, shim 20, capability ABI 191, Kernel 648/672 including standalone controls, Procd 227/232 including auxiliary binaries, and Integration 320/321 tests. Existing native-only ignores are unchanged. Procd passes forty native binary builds with repository linker scripts. All 162 Integration helpers pass after updating the exact policy assertion to require the new marker; its initial mismatch remains recorded. Docs `b0fcf0f43af2af741d520a0b1373cc346e08863c` updates the native wire/ownership contract, operation registry, Procd boundary and three generated shared APIs. All 45 tests and the complete 2,367-page manual pass, with zero final warnings, 431,138 word boxes within page bounds and four reviewed protocol/API pages. Current IPC 339/340, capability ABI 216/217, Kernel 560/561 and 562/563, Procd 266/267, Docs 869/870 and all five helper push/review CIs pass with complete classified logs and no final warnings. Those component cohorts are stopped. Current full Integration 1623/1624 waits at observation 01. Older full Integration 1615/1616 is running at observation 11; 1617/1618, 1619/1620 and 1621/1622 wait at observations 09, 07 and 04. No pending full suite is counted as passed. Typed realm bootstrap, mediator startup/readiness/configuration/seal, complete consumer image adoption, fair terminal/provider retirement, broader native disposal failures and both full EriX-in-EriX build generations remain open. The new inventory covers 76 repositories, 2,950 code files below 1,000 lines and 158 direct missing_docs crate-root gates; complete inline documentation and whole-codebase authority closure remain open. Prior performance measurements retain their original signed source identities; this checkpoint claims no new timing or guest performance result. Corrected native staging checkpoint — 15 September 2026: Signed source `8ef5d838392a7918398008ce5c19d5b1885af0da` is recorded in [the current review](https://git.erikinkinen.fi/erix/docs/pulls/4). Document the staged mediator contract and regenerate shared IPC and capability API references from original signed sources. All 45 tests, API generation/checks, Markdown and template checks pass. The full manual renders 2369 pages with 431570 in-bounds word boxes and zero final warnings; pages 210, 640 and 1370 were visually checked. CI 871/872 passes with complete classified logs, reference passes converging to zero final warnings. Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed. Artifact boundary checkpoint — 15 September 2026: Signed documentation `507ae8f0840e7c40e848f4653e238e5e70d57d8d` adds the corrected artifact boundary contract and distinguishes minimal bootstrap linking from the interactive product library. All 45 documentation tests, canonical formats, Markdown and whitespace checks pass. The complete manual renders 2,375 pages with 433,590 in-bounds word boxes and zero final warnings; changed page 2330 passes visual review. Original API snapshots remain unchanged. Rust, image and VM checks do not apply to this documentation-only change. Docs CI 881/882 passes with all four complete classified logs and no final warnings. Review: https://git.erikinkinen.fi/erix/docs/pulls/4. Shell workspace documentation checkpoint — 15 September 2026: Signed Exsh `b12e172e7b266842a8659104894f6821166165fb` owns ordinary and emergency transport in distinct version-22 authenticated workspace slices. Descriptor startup rejects short or dirty cleanup storage before metadata effects; transactions exclusively reborrow the complete slice and erase it after emergency cleanup. The global UnsafeCell accessor and automatic 32 KiB cleanup array are removed. Larger valid caller slices retain their complete extent. Existing provider retirement, metadata rollback and uncertain-cleanup behavior remain enforced. All 961 Rust tests pass in each default/all-feature/production development/release configuration, with formatting, strict host/native Clippy, private rustdoc and eight native builds without warnings. Four added tests cover workspace disjointness, malformed backing, complete caller extent and consecutive cleanup reuse; existing cleanup controls now also check buffer canaries and erasure. All 73 warning-denied checker tests pass. Both actual optimized native fallbacks measure 48 local bytes, compared with the retained prior 32,816-byte frames. Their full checker reports remain INCOMPLETE: runtime/all graphs contain 691/604 unresolved observations, and the old 32 KiB initial stack-reservation requirement still needs a workspace-specific evidence contract. Ordinary-source membership and direct-versus-nested early-drop bounds remain open. The 8/33/56 KiB upper limits and 64 KiB stack are unchanged; this measurement is not an all-path stack-safety claim. Matching producer `38424571b76b36c1e631d99fd2c859fb32311eea` exports/consumes 96 capacity words plus 72 target layout words, reserves both transport arrays first and rejects old/mixed layouts. Packaging both actual optimized shell configurations under canonical dev/release policies derives 4,300,800 workspace bytes, with unchanged executable bytes and a separate 64 KiB stack. All 162 Integration helper commands and its strict 320/321-test Rust matrix pass, including four native builds. These are private artifact and host checks, not guest execution. The product catalog still selects the earlier shell; coordinated catalog adoption and matching runtime VMs remain required. Documentation `79cdd4c3694e800091b55c737fca04c7bdd3d071` describes the ownership and compatibility contract. Its 45 tests and canonical checks pass. The full manual renders 2,375 pages without final warnings; all 433,713 word boxes are in bounds and changed page 2280 passes visual review. API snapshots are unchanged. Exsh CI 225/226 fails only the incomplete frame gate after 961 Rust and 73 checker tests; all four logs total 311,820 bytes with zero warnings. CI runtime/all graph observations are 662/587 and both fallbacks measure 48 bytes; these artifacts remain distinct from local images. Docs CI 883/884 passes with all four complete logs (762,212 bytes); reference passes converge with 35/1/0 warnings and zero final warnings. These component cohorts are fully classified. Integration CI 1637/1638 remains queued at its first observation. No full build within EriX or whole-codebase authority closure is claimed. Complete native companion checkpoint — 15 September 2026: Signed Integration `db80a2c1dfc669bd724762d476f5f5c0da005ff6` centralizes the complete eight assembly input roles plus the original producer script. Source selection and support-manifest validation share those roles; both outer artifact keys bind the contract module. The catalog changes only native lib-cstd to original `bdcbbea43550e8b99cd9a8221e4bc5a645637990`. Exact path/byte, tool, waited status, cleanup and output checks remain required. Actual hidden/public production and missing/extra/altered receipt controls pass, as do both outer cache-key controls. All 162 helper commands are covered: 160 pass in the full run, and the two corrected test-only fixtures pass separately. The original missing-module and unclosed-fixture-stream failures are retained. The strict 320/321-test Rust matrix, Clippy, formatting, private rustdoc and four native builds pass without warnings. A host-built diagnostic native image contains 38 executables and 27 shared objects, passes closure checks and builds without warnings. Its SHA-256 is `ff5d774308cdf236c860a2423adab6e2594bf3c0991b26eb37cb3c64af96ddfe`. It uses 73 original component selections with 72 coherent Cargo manifests and the five explicitly recorded helper corrections whose bytes match this signed checkpoint. It is not an unmodified product catalog. The unchanged editor/history, inherited-stream timing and runtime-error VM probes all pass with their original 120/15/10-second budgets and exact output checks; each leaves the source image unchanged. Signed Docs `31bd9524c31c9d8d6a8f00248f702e6b7d428106` explains the complete source contract. All 45 tests and canonical checks pass. The complete manual renders 2,375 pages without final warnings; all 433,817 word boxes are in bounds and changed page 2281 passes visual review. Original API snapshots are unchanged. Docs CI 885/886 passes with all four complete logs (762,204 bytes); reference passes converge with 35/1/0 warnings and zero final warnings. Integration CI 1639/1640 remains queued at its first observation; the build compatibility issue stays open pending its complete CI. Full Exsh frame proof, coherent product adoption and both complete EriX-in-EriX build generations remain open. Paired workspace and literal command evidence — 15 September 2026: Signed Docs `5d77dc2b82bf5439e58234d901e30f4565aaa81a` documents the independent pristine/packaged ELF workspace mapping domain, its native-loader assumption and the separate source borrowing, erasure and all-path frame obligations. It also fixes 24 existing inline long options and argument delimiters whose ASCII double hyphens previously became an en dash (issue #8). Numeric ranges, prose punctuation, verbatim command blocks and original signed API snapshots remain unchanged. All 45 documentation tests, canonical and Markdown checks pass. The complete manual has 2,375 pages, 433,924 in-bounds word boxes and zero final warnings. Text extraction confirms literal option bytes, including embedded `set --` and standalone delimiters; nine affected pages pass visual review. PDF SHA-256: `fd33102422cc80697ead3f5c939b39d1e9c6bf69ce06475be4ce8767cafb2f23`. The first render's punctuation failure remains recorded separately; the accepted PDF comes from the final corrected source. Docs CI 887/888 passes with all four complete classified logs (762,236 bytes). Both manual jobs pass 45 tests and converge with 35/1/0 reference warnings, leaving zero final warnings; both Markdown jobs pass. Rust and VM checks do not apply to these documentation-only edits. Native RELRO manual — 16 September 2026: signed Docs `2560e70884ddcb1b2f262ef74ea0dd30084d4259` documents protected-page validation, exact final mapping fragments, the writable initial stack and privileged construction writes over an unstarted child. All 45 documentation tests and canonical checks pass. The complete manual has 2,375 pages and 434,088 in-bounds word boxes, with zero final warnings; both changed pages pass visual review. Exported API snapshots are unchanged. Loaderd CI 93/94 passes with all four complete classified logs (109,621 bytes) and zero warnings. Docs CI 889/890 passes with all four complete classified logs (762,216 bytes); both manual jobs pass 45 tests and converge with 35/1/0 reference warnings, leaving zero final warnings. The earlier diagnostic native command sequence passed while its permission observation failed; the subsequent repaired checkpoint below supersedes that scoped result. This checkpoint does not establish complete runtime permission, frame, authority, realm or guest-build acceptance. Native permission checkpoint — 16 September 2026: signed Kernel `32c70109fe7663440aa56de6a49975accc1f0057` carries explicit live execution permission through single-page, batch and permission-only mappings. Data and construction aliases remain non-executable; ancestor promotion and splitting preserve neighbouring restrictions. Processor activation validates and enables execute-disable support on the bootstrap and application processors. Seven independent controls accompany the repair. Strict default/all-feature development/release suites pass 666/690 kernel unit tests plus two external controls per selection, retaining three existing ignores. Host/native Clippy, private rustdoc, formatting and ten native builds pass without warnings. Separate one-CPU and two-CPU diagnostic VMs pass the unchanged native command sequence. A read-only hardware observer matches all 233,755 selected coreutils executable bytes, verifies CPL3 and enabled paging/execute-disable state, and confirms both observed RELRO pages are user-readable, read-only and non-executable; the current stack is user-writable and non-executable. Both processors report execute-disable enabled. This is an exact process-entry/table observation, not an injected instruction-fault test or whole-system permission proof. The diagnostic image SHA-256 is `8c3c24639e8e1ca8c4f2ad4e485323abf32ec07408241c3e4fa9713f6e07e812`. Signed Docs `d221e725c2543316680e63fc5e8314ce0fe3bdf1` documents the mapping and processor contracts. All 45 documentation tests and canonical checks pass; the 2,375-page manual has 434,308 in-bounds word boxes and zero final warnings, with three changed pages visually reviewed. Exported API snapshots are unchanged. Kernel CI 574/575 passes with four complete warning-free logs (708,112 bytes), including existing optimized workload examples. Docs CI 891/892 passes all four complete logs (762,176 bytes), with 45 tests per manual job and zero final warnings. The later maintained permission regression is recorded below. Full frame proof, whole-codebase authority/documentation review, runnable realms and both complete guest build generations remain open. Maintained permission regression — 16 September 2026: signed Integration `89d15e4536004c087dcebd63c87216c0fd58958d` supplies the explicit-input runner, pure ELF/page-table checks and read-only GDB observer. The final maintained source passes 21 independent host controls and the complete strict default/all-feature development/release Rust matrix, host/native Clippy, private rustdoc, formatting and four native builds. Canonical checks pass after correcting one Markdown line wrap. Both host groups are wired into ordinary CI. All 2,995 inventoried authored code files are below 1,000 lines; this is physical size evidence, not semantic authority closure. Actual one-CPU and two-CPU runs on the repaired diagnostic image pass the original native-time command sequence and the expanded hardware checks: all 58 selected code pages are user-readable, read-only and executable; both RELRO pages are read-only/non-executable; the current stack is writable/non-executable. Complete executable bytes match and NX interpretation is enabled on every selected processor. An earlier image is rejected by the maintained observer. Both child outcomes, exact original input bytes and temporary cleanup are retained, with empty debugger stderr in both positive runs. The final cleanup code also preserves reaping when a direct child exits between poll and termination. The command's image CI gate awaits adoption of a coherent product catalog containing both required component fixes. Its explicit diagnostic invocations do not silently replace the older maintained image graph. Signed Docs `3fb0b12ff55d044cc4bbe142418ab7a5b07bb42d` documents the maintained operator contract. All 45 tests and canonical checks pass; the 2,377-page manual has 434,563 in-bounds word boxes with zero final warnings, and the changed subsection passes visual review. Exported API snapshots are unchanged. The preceding Docs CI result is recorded below; current Integration CI, complete frame proof, whole-codebase authority/documentation closure, runnable realms and both guest-build generations remain open. Protected relative-target checkpoint — 16 September 2026: signed Exsh `a26ecffb39b70abbf15fb300c5c8c703c6900c37` admits exact six-byte RIP-relative calls and tails only after complete relative-relocation, file ownership, protected RELRO page and target-entry checks. It shares the relocation inventory with guarded tables and rejects overlapping or executable-byte writes. Independent controls cover malformed ranges, writable neighbours, different stored words, negative displacements, self-entry loops and tail restoration. All 102 checker tests and all six strict Rust feature/profile configurations pass (961 tests each), together with six native builds, host/native Clippy, formatting and private rustdoc. Runtime Rust, linker scripts and Cargo selections are unchanged. Replaying both unique original pristine/packaged artifact pairs preserves their hashes and all original stack/resource budgets. Runtime/all-feature reports retain 641/591 new call/tail proofs and reach 266/240 functions; unresolved observations fall from 691/604 to 271/232. Workspace mapping passes. Both full reports remain incomplete: unknown indirect control flow, non-returning semantics and source/direct-versus-nested boundaries remain separate obligations. These are partial static admission results, not a complete frame or authority proof. Signed Docs `83b2d4a2dfc473bb8a99719f86fa1c3c33effa53` explains the proof contract and its limits. All 45 documentation tests and canonical checks pass; the 2,377-page manual has 434,680 in-bounds word boxes, zero final warnings and a visually reviewed changed page. API snapshots are unchanged. The preceding Docs permission-observer checkpoint passes CI 893/894 with four complete logs (762,616 bytes) and zero final warnings. Exsh CI 231/232 is fully classified: all 961 Rust tests, 102 checker tests and all four workspace domains pass, with four complete logs totaling 314,760 bytes and zero warnings. Only the complete frame gate fails. Its separately selected CI artifacts report 273/230 unresolved observations; these do not replace the retained local artifact identities/counts. The preceding Docs CI result is recorded below. All 2,997 inventoried authored code files remain below 1,000 lines; semantic authority/documentation closure, product catalog adoption, runnable realms and both complete guest builds remain open. Grounded return-flow checkpoint — 16 September 2026: signed Exsh `4bb35938b52c0e6b20c65ccb861af79871272cbe` derives no-ordinary-return facts from complete checked loop/trap bodies and earlier proved tail targets. Only these grounded exact callees suppress ordinary fallthrough. Calls retain target, depth and relocation evidence, and each fact preserves its original body evidence and earlier dependencies. Final reachability removes stale fallthrough descendants while keeping terminal callee obligations. Unknown calls, unsupported instructions, malformed boundaries and unproved tail cycles cannot establish facts. All 114 checker tests pass, including twelve new literal controls and a 1,200-function chain requiring at most two body visits per function. All six strict Rust feature/profile configurations pass 961 tests each, with six native builds, host/native Clippy, formatting and private rustdoc. Runtime Rust, linker scripts and Cargo selections are unchanged. The physical inventory now covers 2,999 authored code files, all below 1,000 lines. The same retained original artifact pairs yield thirteen grounded facts each. Runtime/all-feature unresolved observations fall from 271/232 to 181/150; every function-end boundary error disappears under the stated ordinary-call model. The work queue performs 347/313 body evaluations for 266/240 discovered functions and retains 263/237 in the final reachable graph. This is an analysis-work count, not a claimed runtime speedup. Remaining observations are 140/111 unknown calls, 40/38 unknown branches and one unsupported instruction per mode. Both workspace mappings pass; whole frame and source domains remain incomplete with unchanged budgets. A separate proof audit verifies earlier dependencies and retained terminal callees. Signed Docs `97ce65dcb8cef7232b50d53af90ff8673d623e05` documents the refinement. All 45 tests and canonical checks pass, and the 2,377-page manual has 434,800 in-bounds word boxes, zero final warnings and a visually reviewed changed page. Exported API snapshots are unchanged. Exsh CI 233/234 is fully classified: 961 Rust tests, all 114 checker tests and four workspace mappings pass, while the full frame gate remains incomplete. All four logs total 314,776 bytes with zero warnings. Those separately selected CI artifacts retain 183/145 unresolved observations, distinct from the retained local pair counts. Matching Docs CI 897/898 passes with all four complete logs across the two terminal observations (762,600 bytes), 45 tests per manual job and zero final warnings. The preceding Docs target-contract checkpoint passes CI 895/896 with four complete logs totaling 762,636 bytes and zero final warnings. Full indirect/source proof, coherent catalog adoption, whole-codebase authority/documentation closure, runnable realms and both full guest-build generations remain open. Release-input diagnostic checkpoint — 16 September 2026: signed Integration `df8147dfa437194cd091747fd7147941bd2793c4` adds fixed prefix summaries for shell lines and physical single/repeated interruption. Correlated physical VM-stall/timeout summaries retain unknown input status, failure stage and requested cleanup explicitly. They do not infer injector failure, cleanup success or the next operation's outcome. Only literal event names and bounded scalar fields can be printed; fixed private directory-relative reads, identity checks and original parsing limits remain unchanged. No guest authority, acceptance oracle, error precedence or 120/15/10-second limit changes. All 172 host cases in eleven suites pass, including 28 diagnostic cases and eight new independent producer, malformed-prefix, private-receipt and actual-wrapper controls. The strict default/all-feature development/release matrix passes 320/321 tests per mode, host/native Clippy, four native builds, formatting and private rustdoc without warnings. A documentation line wrap is the only source change after the Rust matrix. One initial negative fixture had identical transport bytes when both exits were unknown; a distinct contradiction replaces it. An initially over-isolated console-suite invocation is corrected to its maintained CI invocation, without changing that suite or the watchdog. Signed Docs `c4bfc12245036f069d178a10183bb1ed15b4aab5` updates the operator manual. All 45 tests, canonical checks and full rendering pass: 2,377 pages, 435,037 in-bounds word boxes, zero final warnings and both changed pages visually reviewed. API snapshots are unchanged. Matching CI is pending. [Release interrupt reuse #54](https://git.erikinkinen.fi/erix/integration/issues/54) and [release COM1 shell lines #55](https://git.erikinkinen.fi/erix/integration/issues/55) remain open: missing original inner artifacts are not recovered, no shared cause is proved, and this checkpoint adds no successful guest run or full guest build. Diagnostic manual CI — 16 September 2026: Docs `c4bfc12245036f069d178a10183bb1ed15b4aab5` passes CI 899/900. All four complete logs total 762,668 bytes; both manual jobs pass 45 tests and produce 2,377 pages with zero final LaTeX warnings. All Markdown checks pass. Integration diagnostic CI 1645/1646 remains queued at its signed head; original release-input bugs 54/55 remain open. Protected register checkpoint — 16 September 2026: signed Exsh `da8b75c9063c52de2149f2a6c7ed170f720a6c62` propagates exact full-width protected-slot loads and register copies through the reached CFG. Equal-target joins retain every load origin; unknown or conflicting predecessors, alias/implicit writes, calls/syscalls and unknown effects discard facts. Weakening a join replaces stale edge proof. Complete admitted probe/dispatch effects preserve only unwritten register values. Supported REX forms permit unused bits with byte/text agreement. There is no caller-input, saved-register, spill-word or immediate-address target premise. All 138 checker tests, formatting, canonical document checks and an independent original-byte/load/relocation and earlier no-return dependency audit pass. Retained runtime/all artifact pairs gain 16/18 register edges; the all-feature graph reaches one additional function. Remaining unresolved sites are 164/132, with thirteen grounded no-return facts per mode. Both workspace mappings pass. Full frame/source gates remain incomplete with actual exit 1 and unchanged 60/15-second and 64 MiB budgets. Every Rust/Cargo/linker/build/workflow byte is unchanged from six strict 961-test configurations and six native builds; no new Rust build or guest execution is claimed. Profiling identified unnecessary effect parsing when all registers were unknown. Skipping those identity transfers and compiling fixed effect patterns once preserves every report decision, reducing runtime effect-parser calls from 34,901 to 1,334 and all-feature calls from 33,398 to 1,348. One before/after observation per identical pair measures 5.089 to 4.385 seconds and 4.997 to 4.358 seconds respectively, including observer overhead. These are bounded host work measurements, not a statistical timing guarantee or guest speedup. Signed Docs `4f770bee4c6a4784b4fcce6ae606d1fc10b328da` documents register provenance and limits. All 45 tests and the 2,377-page manual render pass, with 435,231 word boxes inside page bounds, no final warnings and visual review of the changed page. All 3,001 authored code files remain below 1,000 physical lines. Matching Exsh/Docs CI is pending. Complete source domains, authority closure, executable realms and both complete guest-build generations remain open. Register checkpoint CI — 16 September 2026: Exsh `da8b75c9063c52de2149f2a6c7ed170f720a6c62` is terminal in CI 239/240. Both runs pass 961 Rust tests, all 138 checker tests, strict warning-denied Rust checks and Markdown. All four paired workspace domains pass in each run. The required full-frame gate remains incomplete, with 168/131 unresolved observations on these CI artifacts, so both runs correctly fail overall. Four complete logs total 314,840 bytes and contain no compiler/lint warnings. These CI artifact observations remain distinct from the retained local pairs. Docs `4f770bee4c6a4784b4fcce6ae606d1fc10b328da` passes CI 901/902. Four complete logs total 762,604 bytes; each manual job passes 45 tests and renders 2,377 pages. Initial reference-resolution warnings clear during the normal three LaTeX passes; final renders have zero warnings. The full source/frame proof, coherent catalog adoption, authority closure and both complete confined guest-build generations remain open. Bounded table checkpoint — 16 September 2026: signed Exsh `efb542a3418badef951d01dff24eec88b8490aee` tracks distinct unsigned bounds, original relative bases, signed table offsets and local targets. Exact constants, self-zeroing and zero extension establish numeric premises. Every selected immutable table byte, matching base addition and candidate instruction boundary must be proved before retaining any successor or branch evidence. Numeric/table values cannot authorize function calls. Joins preserve all alternatives and original premises; unknown predecessors and alias/implicit/call clobbers discard facts. All 157 checker tests pass, including complete 256/65,536-entry domains, nonzero and signed read windows, extended register fields, joins, bypasses, loops, width controls and immutable/boundary refusals. Original-byte function/table/base/index/addition audits, formatting, Markdown and canonical checks pass. Final original runtime/all pairs admit two table branches each and retain 164/132 unresolved obligations: two entry branches resolve, while two newly exposed guard-interior conflicts remain. Both workspace mappings and thirteen grounded no-return facts per mode are retained. Full frame/source status remains incomplete with actual exit 1 and unchanged budgets. Initial partial-set exploration is diagnostic negative evidence, not accepted coverage. Profiling identified repeated compilation of fixed stack patterns. Compiling sixteen unchanged patterns once and sharing the existing padding pattern preserves all report decisions and matching operations. One baseline/optimized observation per original pair reduces runtime/all regex-cache lookups from 651,254/627,530 to 135,274/131,391. Profiled times are 5.994 to 5.445 and 5.756 to 5.179 seconds, including overhead and waiting. These measurements establish reduced host work, not a timing guarantee or guest speedup. The final source has a clarified module docstring and separately reconciled complete replay decisions. Every Rust/Cargo/linker/build/workflow byte retains the existing strict matrix; no new Rust build or guest execution is claimed. Signed Docs `242b78c8f35aeaef879f819c670574a4c1d95c3f` explains complete read windows and target-set admission. All 45 tests and the 2,379-page render pass, with 435,421 word boxes inside page bounds, zero final warnings and visual review of both changed pages. All 3,003 authored code files remain below 1,000 physical lines. Matching CI is pending. Explicit flag/guard refinement, full source/frame proof, coherent catalog adoption, authority closure and both complete confined guest-build generations remain required. Bounded table CI — 16 September 2026: signed Exsh `efb542a3418badef951d01dff24eec88b8490aee` is terminal in CI 241/242. Both runs pass 961 Rust tests, all 157 checker tests, strict warning-denied Rust checks and Markdown. Each run completes all four paired workspace domains. The required full-frame gate remains incomplete with 168/131 unresolved observations on the CI artifacts, so both runs fail overall. Four complete logs total 315,234 bytes, with no compiler/lint warnings. No incomplete proof is treated as acceptance. Signed Docs `242b78c8f35aeaef879f819c670574a4c1d95c3f` passes CI 903/904. All four logs are complete (763,044 bytes); each manual job passes 45 tests and renders 2,379 pages. Initial reference warnings clear in the normal LaTeX passes; final renders have zero warnings. An expanded local source/config inventory additionally checks 685 files, bringing the combined physical ceiling audit to 3,688 files, all below 1,000 lines. Flag/guard refinement, source/frame closure, coherent catalog adoption, complete authority review and both full confined guest-build generations remain required. Ordinary comparison checkpoint — 16 September 2026: signed Exsh `4ed392bcc53cb46d0296cecbdd930c8be5cd7c28` replaces the fixed-register table macro with byte-checked CMP/Jcc facts, live comparison lifetime, unsigned/equality edge refinement and sound producer-width widening. A 32-bit comparison never zeroes upper bits. Every complete immutable target set remains mandatory, and numeric/table values cannot authorize function calls. Unknown predecessors, relevant flag/subject writes and unmodeled effects discard conditions. The obsolete dispatch report field is removed. All 176 checker tests pass, including an independent exhaustive interval oracle, high-register dispatch, sign extension, bypasses, conflicting/unknown joins, stale proofs, complete table arms and large arithmetic loops. Independent original-byte audits check 354/321 comparison edges, eleven table branches per mode, protected function loads and thirteen earlier grounded no-return facts per mode. Original runtime/all pairs reach 271/246 functions and retain 158/126 unresolved observations, down from 164/132. Workspace domains pass; full frame/source status remains incomplete with actual exit 1 and unchanged budgets. The audit also reproduces and fixes [terminal-call discovery loss](https://git.erikinkinen.fi/erix/exsh/issues/6). A prior successor diagnostic no longer suppresses recomputation of a revisited call. Three independent controls retain grounded no-return, returning and unknown-target behavior. Original byte/range inspection corrects earlier descriptions of two guard-interior conflicts: these were fallthrough exactly at declared function ends. Padding remains outside those functions; callee names never supply no-return proof. Matching CI remains required before closing the defect. Profiling identified repeated decoder-effect work. Sharing immutable effects only within one function-body analysis reduces runtime/all effect decoding from 72,668/69,784 to 34,499/32,576 and operand parsing from 75,637/72,547 to 37,468/35,339. Complete paired decisions remain identical. Final single paired profiled observations are 6.633 to 6.425 and 6.416 to 6.269 seconds, including overhead and waiting. The final baseline overlaps host test execution, and earlier pairs show timing variability; these diagnostic durations do not isolate a speedup. This establishes reduced host work, not a timing guarantee or guest speedup. Every Rust/Cargo/linker/build/workflow byte retains the existing strict six-configuration 961-test matrix and six native builds. Formatting, Markdown and canonical checks pass. Signed Docs `d8fbc3a1f3696e02954b81f23511cee513ddfa8c` passes all 45 tests and complete 2,379-page rendering: 435,637 in-bounds word boxes, zero final warnings and two visually reviewed pages. The physical audit covers 3,005 authored code files below 1,000 lines. Matching CI is pending. Remaining indirect calls/branches, full source/direct-versus-nested proof, coherent catalog adoption, complete realm authority and both full confined guest-build generations remain required. Comparison checkpoint CI — 16 September 2026: [Exsh CI 243](https://git.erikinkinen.fi/erix/exsh/actions/runs/243) and [244](https://git.erikinkinen.fi/erix/exsh/actions/runs/244) are terminal. All four complete logs total 314,904 bytes with no compiler/lint warnings. Strict Rust checks, 961 Rust tests, 176 checker tests, Markdown and all four workspace domains per run pass. The required full-frame gate remains failed with 163/126 unresolved observations on these CI artifacts; their identities are distinct from the original static replay pairs. No full frame or guest-build acceptance is claimed. [Docs CI 905](https://git.erikinkinen.fi/erix/docs/actions/runs/905) and [906](https://git.erikinkinen.fi/erix/docs/actions/runs/906) pass with all four complete logs (763,056 bytes), 45 tests and 2,379-page manuals. Both final renders have zero warnings after ordinary reference convergence. The terminal-call discovery controls pass in both Exsh runs, resolving the scoped defect in [Exsh #6](https://git.erikinkinen.fi/erix/exsh/issues/6) while the complete emitted-proof defect stays open. The current physical audit covers 3,690 authored source/config files below 1,000 lines; semantic authority and complete private documentation closure remain required. Original unfinished Integration jobs continue under their existing handles. Arithmetic evidence checkpoint — 16 September 2026: signed Exsh `0cdaa8869545308c528f9cf5a2dc165cb286c6ef` and Docs `07181c34b1a20150afe3380977ca5ba70c909b84` are pushed on `feature/posix-compat`. Immediate ADD/SUB now retains exact modular result pieces and derives unsigned/equality edges from carry/borrow and zero. Defined INC/DEC writes establish widths without preserving a stale combined flag condition. Full 64-bit comparisons may use the architectural numeric domain while keeping protected typed identities separate; narrow comparisons still require independent upper-bit proof. Known encoding/text contradictions remain explicit flow errors. All 191 checker tests pass, including independent exhaustive concrete arithmetic and modular-interval oracles, wraparound and authority-negative controls. Original runtime/all artifact pairs admit fifteen table branches each and reach 271/246 functions, with 156/124 unresolved observations. Both workspace mappings pass; actual full-frame exits remain 1 and full source/direct domains remain incomplete. Independent original-byte audits check arithmetic/conditional/table premises, 16/18 protected register edges and thirteen grounded no-return facts per pair. Profiling identified repeated stack-neutral grammar evaluation. A cache scoped to one function reduces those evaluations from 95,643 to 43,169 for runtime and 92,608 to 41,053 for all features, with complete paired report decisions equal. Cached values include refusals and contain no path facts. Timing observations include observer overhead and do not isolate a statistical speedup or guest performance. Formatting, Markdown, whitespace and all 45 Docs tests pass. The 2,379-page manual has 435,808 in-bounds word boxes, zero final warnings and visual review of the changed pages. The physical inventory covers 3,691 authored source/configuration files, all below 1,000 lines. Semantic authority and complete private rustdoc closure remain open. Rust/Cargo/linker/build/workflow bytes are unchanged from the retained strict matrix and classified CI 243/244; new [Exsh CI 245](https://git.erikinkinen.fi/erix/exsh/actions/runs/245)/[246](https://git.erikinkinen.fi/erix/exsh/actions/runs/246) independently reruns those checks. [Docs CI 907](https://git.erikinkinen.fi/erix/docs/actions/runs/907)/[908](https://git.erikinkinen.fi/erix/docs/actions/runs/908) also runs. Matching CI is pending, and no full confined guest build or coherent product-catalog adoption is claimed. Test-import correction and CI classification — 16 September 2026: original Exsh CI 245/246 failed before the frame gate because the arithmetic test could not import its checker module. They attempted 177 tests: 176 passed and one module import failed. The preceding 961 Rust tests and strict build stages passed; all four complete logs total 309,708 bytes with zero compiler/lint warnings. The earlier local 191-test pass used an explicitly supplied PYTHONPATH and did not prove equivalence to the clean workflow. This regression is retained in [Exsh #7](https://git.erikinkinen.fi/erix/exsh/issues/7). Signed correction `12331e26f3bb7a25c0146c8b314eef46dd451099` loads the repository's literal fixture setup before implementation imports in both affected modules. A new regression imports every checker test module in a fresh isolated interpreter; it reproduces both failures before correction and passes afterward. The exact clean workflow command now passes all 192 tests without PYTHONPATH. Formatting, Markdown and whitespace pass. Checker/runtime/Cargo/workflow bytes are unchanged, so the prior original-artifact and profiler evidence retains its exact scope. New [CI 247](https://git.erikinkinen.fi/erix/exsh/actions/runs/247)/[248](https://git.erikinkinen.fi/erix/exsh/actions/runs/248) runs against the corrected source; issue #7 remains open pending matching CI. Docs CI 907/908 now passes with four complete logs totaling 763,024 bytes, all 45 tests and 2,379-page manuals. Both final renders have zero warnings after ordinary reference convergence. Full frame/source proof, coherent catalog adoption and complete confined guest builds remain outstanding. Corrected arithmetic checkpoint CI — 16 September 2026: [Exsh CI 247](https://git.erikinkinen.fi/erix/exsh/actions/runs/247) and [248](https://git.erikinkinen.fi/erix/exsh/actions/runs/248) at signed `12331e26f3bb7a25c0146c8b314eef46dd451099` both pass all 192 checker tests, including the ten isolated module imports, and all 961 Rust tests. The preceding strict formatting/Clippy/documentation/build stages and Markdown pass. All four complete logs total 314,944 bytes with zero compiler/lint warning candidates. This confirms the scoped import correction in [Exsh #7](https://git.erikinkinen.fi/erix/exsh/issues/7). Both runs reach and fail the required full-frame gate. All four workspace mappings per run pass, while the emitted CI pairs retain unresolved counts [161, 161, 124, 124]; these artifacts are distinct from the original static pairs' 156/124 observations. Full source/direct domains remain incomplete, and [Exsh #4](https://git.erikinkinen.fi/erix/exsh/issues/4) remains open. The original import-failed runs 245/246 stay classified and are not relabeled as passing. Docs CI 907/908 passes all 45 tests and 2,379-page manuals with zero final warnings; four complete logs total 763,024 bytes. Signed trees are clean, canonical issue/PR metadata remains applied, and the 3,691-file physical inventory remains below 1,000 lines per authored source/configuration file. Semantic authority and private documentation closure, coherent catalog adoption, runnable realms and both full confined guest build generations remain outstanding. Original unfinished Integration runs continue under their existing handles and budgets. Grounded call-preservation checkpoint — 16 September 2026: signed Exsh `641ac2fc7c3fba3ab351f2863df7e35117b2732a` and Docs `7a7c3ff0095de8f008c9b534fd993554df37f976` are pushed on `feature/posix-compat`. Complete original bodies and earlier callee facts now prove never-written register families. Only existing typed values survive proved calls; live conditions clear. The separate stack-derived rbp fact follows the same rule. This corrects [the reproduced stale-frame defect](https://git.erikinkinen.fi/erix/exsh/issues/8), which stays open pending matching CI. ABI conventions, spill restoration and current kernel behavior supply no preservation mask. All 213 clean-environment checker tests pass, including 21 new controls, eleven isolated module imports and a 1,200-function grounded dependency chain. All six strict Rust feature/profile configurations pass 961 tests each, with host/native Clippy, private rustdoc and six native builds; no warnings. Original runtime/all artifact pairs retain 65/72 protected register edges and 70/77 load origins, reducing unresolved observations from 156/124 to 107/70. Both workspace mappings pass; full source/frame/direct gates retain actual exit 1. Independent audits bind 7,795/7,503 used-contract instructions and complete earlier-proof closure to the original captured bytes. Profiling identified unnecessary empty-state scans and rejected-body suffix work. Removing them preserves every paired report decision and reduces total profiled Python calls from 32,160,478 to 26,673,252 and from 30,880,221 to 25,402,446. Single paired timings include observer overhead; they do not establish statistical or guest performance. Original timer, byte and stack budgets remain unchanged. All 45 Docs tests, formatting, Markdown and canonical checks pass. The 2,379-page manual has 436,058 in-bounds word boxes, zero final warnings and visual review of both changed pages. The physical audit covers 3,693 source/configuration files, all below 1,000 lines. Semantic authority/private-documentation closure, product adoption, complete source/frame admission, runnable realms and both full in-EriX build generations remain open. Automatic CI for both exact signed heads is being followed; local passes are not reported as CI acceptance. Matching preservation CI — 16 September 2026: [Exsh 249](https://git.erikinkinen.fi/erix/exsh/actions/runs/249) and [250](https://git.erikinkinen.fi/erix/exsh/actions/runs/250) are fully classified at `641ac2fc7c3fba3ab351f2863df7e35117b2732a`. Both pass all 213 checker tests, including eleven isolated imports and the stale-frame controls, all 961 Rust tests and preceding strict host/native Clippy, rustdoc and native build stages. Markdown and all four workspace mappings per run pass. The remaining full frame gate fails as required; original CI artifact observations are [[111, 111, 74, 74], [111, 111, 74, 74]]. All four complete logs total 314,995 bytes without warnings. The independently retained local pairs remain 107/70, with their own original identities. [Docs 909](https://git.erikinkinen.fi/erix/docs/actions/runs/909) and [910](https://git.erikinkinen.fi/erix/docs/actions/runs/910) pass at `7a7c3ff0095de8f008c9b534fd993554df37f976`. All four complete logs total 763,088 bytes; both manual jobs pass 45 tests and render 2,379 pages with zero final warnings after ordinary reference convergence. The corrected frame-pointer issue is closed on this matching evidence; the full source/frame issue remains open. No full confined build, runnable realm or coherent product-catalog adoption is established. Native artifact intake checkpoint — 16 September 2026: signed Exsh `d67dcb963f1aa265b13dd0609a5f8488784b5822` admits the retained original/stripped native pair with exact mapped bytes, allocated ownership and complete program contracts. Only absent packaged ordinary symbols are optional. The exact five-byte native entry jump preserves the shell's 8192-byte frame limit. Checked symbolic relocations contribute write footprints, never local targets or library-discovery authority. Code/dynamic metadata mutation, unknown streams, malformed names/links, resolver symbols and invalid relative prefixes refuse intake. All 231 checker controls (18 new) and 12 isolated test modules pass in a clean environment. All six strict Rust configurations pass 961 tests each, host/native Clippy, private rustdoc and six native builds without warnings; formatting and canonical checks pass. Both retained standalone pairs have exactly unchanged proof decisions (107/70 unresolved). The original native pair inventories 1,345 functions, reaches 220, proves workspace mapping and retains 299 unresolved observations, including 102 symbolic-target refusals. The shell entry has 6,864 partially accounted bytes; its incomplete paths do not establish an upper bound. Independent original-byte audit checks all 1,086,955 executable bytes, exactly 154 changed capacity bytes and 627 relative call-load proofs. Full source/frame/direct gates remain incomplete, actual checker exit 1. Native original SHA-256 `879579542895f2f3fbda38972ebaaaf55e05857ffc456342117624a9bc8d24a9` and packaged SHA-256 `183a1a2f1f4192ffd0b9c123ca50d33af6c584940ca51b156198f8822b718feb` retain their original Exsh runtime selection `b12e172e7b266842a8659104894f6821166165fb`. The native producer already retains the original; no duplicate artifact or producer mutation was required. Profiling all three original pairs takes 16.60/16.47/17.02 seconds including observer work under unchanged 60/15-second and 64 MiB budgets. These are individual static observations, not guest performance claims. Signed Docs `12c6d0a91e5e9c5f170d6d0aa7f050dd60e883ef` documents the contract. All 45 tests and a complete 2,381-page manual pass, with 436,247 in-bounds word boxes, zero final warnings and changed-page visual review. The physical inventory covers 3,695 source/configuration files, all below 1,000 lines; semantic authority/private documentation closure remains open. New Exsh CI 251/252 and Docs CI 911/912 are running at their exact signed heads. Complete source membership, native dependency closure, coherent catalog adoption, runnable realms and both full guest builds remain required. Matching native intake CI — 16 September 2026: [Exsh 251](https://git.erikinkinen.fi/erix/exsh/actions/runs/251) and [252](https://git.erikinkinen.fi/erix/exsh/actions/runs/252) are fully classified at `d67dcb963f1aa265b13dd0609a5f8488784b5822`. Both pass 231 checker tests, twelve isolated imports, 961 Rust tests and the strict preceding Clippy/rustdoc/native build stages. All four workspace mappings per run and Markdown pass. The required full frame gate remains incomplete; the CI artifact counts are 111/111/74/74 unresolved observations in each run. Four complete logs total 315,371 bytes, with zero warnings. Retained local standalone and native artifacts keep their own separate identities and 107/70/299 counts. [Docs 911](https://git.erikinkinen.fi/erix/docs/actions/runs/911) and [912](https://git.erikinkinen.fi/erix/docs/actions/runs/912) pass at `12c6d0a91e5e9c5f170d6d0aa7f050dd60e883ef`. Four complete logs total 763,452 bytes; each manual job passes 45 tests and renders 2,381 pages, with ordinary reference convergence followed by zero final warnings. No full source/frame proof, native dependency closure, runnable confined realm or full EriX-in-EriX build is established. A separate original-source relocation calculation defect is now reproduced and tracked with the canonical bug template in [lib-dynlink #2](https://git.erikinkinen.fi/erix/lib-dynlink/issues/2). Its two host failures do not imply a guest regression. All 107 symbol-only relocations in the seven retained native artifacts have zero addends; the supported nonzero-field case still requires correction before broader native binding admission. Symbol-only relocation correction — 16 September 2026: signed lib-dynlink `abd5153adf994ca40753f9650a675940a228e1d3` calculates GLOB_DAT and eager JUMP_SLOT as S, while retaining checked S+A and B+A, original provider selection and writable target ownership. The canonical defect report is https://git.erikinkinen.fi/erix/lib-dynlink/issues/2 and review is https://git.erikinkinen.fi/erix/lib-dynlink/pulls/3. Four default/all-feature dev/release configurations pass 47 tests each, host/native strict Clippy, private rustdoc and four native builds without warnings. Of nine new independent controls, five fail and four pass against the original implementation; all nine pass after correction. Original dynlinkd, loaderd and bootloader source candidates, each changing only the library's full commit selector in an isolated exact-commit worktree, pass four strict configurations: 13/105/41 tests respectively, with twelve native builds and private rustdoc, zero warnings. Published consumer commits remain unchanged pending coherent adoption. The retained Exsh executable and six explicit libraries yield 1,608 independently expected relocation writes under caller-selected hypothetical load biases. Both original and corrected planners match those original zero-addend inputs. All 107 symbol-only writes remain identical under positive, negative and extreme unused-addend variants with the fix; the original planner fails the addend-16 control (actual Cargo exit 101). The original/packaged dynamic tables are byte-identical and all artifact/manifest hashes are retained. This host metadata replay performs no target mapping or execution and does not admit native frame paths. Signed Docs `214b08666b8b36ad4270bcfee3b3379d8dc08a79` documents the expressions and regenerates only the library's 103-route API reference from exact signed-source rustdoc JSON. All 45 documentation tests, Markdown and canonical checks pass. The full manual has 2,383 pages, 436,424 in-bounds word boxes, zero final warnings and four visually reviewed changed pages. All 3,696 inventoried code/configuration files remain below 1,000 lines; complete semantic authority and private documentation closure remains open. Matching library CI [30](https://git.erikinkinen.fi/erix/lib-dynlink/actions/runs/30)/[31](https://git.erikinkinen.fi/erix/lib-dynlink/actions/runs/31) passes with four complete logs (36,856 bytes), 47 tests per run, strict builds/rustdoc and zero warnings. Docs CI [913](https://git.erikinkinen.fi/erix/docs/actions/runs/913)/[914](https://git.erikinkinen.fi/erix/docs/actions/runs/914) passes with four complete logs (763,872 bytes), 45 tests and 2,383-page renders, zero final warnings. Coherent catalog adoption, complete native source/frame evidence, runnable realms and both full guest build generations remain open. Closed native dependency intake — 16 September 2026: signed Exsh `9827896d1cb5ad834589045ee03390aec650df84` adds an explicit JSON input contract for one runtime manifest and the exact original/packaged executable and library pairs. Complete file hashes, manifest records, package/feature identities and both needed-name inventories must agree. Only explicit host selectors authorize reads; runtime names and source paths remain data. Inputs share one aggregate byte budget and the original deadline. Library stripping permits only independently checked administrative header selectors, never executable-byte changes. All other mapped bytes, allocated owners, program fields and paired artifact metadata remain identical. Producer source revisions remain unverified claims. The retained native closure binds seven objects, 2,373 ordinary functions and 1,608 relocation records. Intake does not yet resolve symbolic providers or compose cross-library frames. All 259 checker controls (28 new) and 16 isolated modules pass; six strict Rust configurations pass 961 tests each, host/native Clippy, private rustdoc and six native builds with zero warnings. Formatting, Markdown and canonical checks pass. All three retained artifact replays preserve their previous frame decisions: 107/70/299 unresolved observations for standalone runtime/all/native. Full frame/source gates retain actual exit 1. Profiling records 0.181 seconds in native dependency intake and 23.17/25.51/24.59 seconds for the three complete profiled runs, within unchanged 60/15-second and 64 MiB budgets. Concurrent Rust validation changes host contention, so elapsed differences from earlier runs are not a speedup or regression claim. Signed Docs `88537b23e1def210eeff40b7ef90fce92fe2009e` documents this contract. All 45 tests and the complete 2,383-page manual pass, with 436,642 in-bounds word boxes, zero final warnings and visual review of the changed page. An initial double-hyphen ligature was corrected and the full render revalidated. The physical census covers 3,704 source/configuration files, all below 1,000 lines; complete semantic authority and private documentation closure remain open. Exact-head Exsh CI 253/254 and Docs CI 915/916 are running. Symbol providers, ordered runtime binding, cross-object frame paths, source membership, coherent catalog adoption, runnable realms and both complete guest builds remain required. Matching closed dependency intake CI — 16 September 2026: [Exsh 253](https://git.erikinkinen.fi/erix/exsh/actions/runs/253) and [254](https://git.erikinkinen.fi/erix/exsh/actions/runs/254), exact `9827896d1cb5ad834589045ee03390aec650df84`, pass 259 checker controls, 16 isolated imports, 961 Rust tests and the strict preceding build/Clippy/rustdoc stages. All four workspace domains per run and Markdown pass. The required full frame gate remains incomplete, with 111/111/74/74 unresolved observations in each CI artifact set. Four complete logs total 315,052 bytes and contain zero warnings. Original local runtime/all/native replays retain separate input identities and 107/70/299 counts. [Docs 915](https://git.erikinkinen.fi/erix/docs/actions/runs/915) and [916](https://git.erikinkinen.fi/erix/docs/actions/runs/916), exact `88537b23e1def210eeff40b7ef90fce92fe2009e`, pass 45 tests and complete 2,383-page renders. Four complete logs total 763,918 bytes. Reference convergence is 35/1/0 warnings across the three TeX passes, with zero final warnings. Both cohorts are classified without rerunning jobs or changing their budgets. The seven-object native dependency inventory is now checked; symbolic providers, ordered runtime binding, cross-object frames and source membership remain incomplete. No runnable realm, coherent product adoption or complete in-EriX build is established. Ordered native symbol evidence — 17 September 2026: signed Exsh `469bf1f1b9d8301cf98a79d16c7c27660ecda2a1` enforces root-first depth-first discovery order and positional DT_NEEDED agreement, indexes exact strong/weak providers and preserves object-qualified relative function identities. Duplicate strong definitions fail; missing weak symbols remain zero data. S-only relocations ignore addends, while S+A must retain an exact original executable entry. Names confer no file reads and no load bias is invented. All 276 checker tests, 17 isolated modules and six strict Rust configurations (961 tests each) pass, including host/native Clippy, rustdoc and six warning-free native builds. Independent original-byte inventory matches all 117 symbolic records: 112 exact function identities and five refused data targets. Provider indexing/reporting takes approximately 16 ms in the captured native profile. Original standalone runtime/all/native replays preserve 107/70/299 unresolved observations and actual exit 1 under unchanged budgets. This is conditional relative identity evidence only: load-base arithmetic, protected slots, cross-object calls/frames and source membership remain incomplete. Signed Docs `24cefeb2dc6d3f163140d32f5fed5a7e1a768ebd` updates the manual contract. All 45 documentation tests pass; the complete 2,383-page render has 436,737 in-bounds word boxes, zero final warnings and visual review of pages 2284–2285. The physical audit covers 3,706 source/configuration files, all below 1,000 lines. No runtime Rust, dependency, linker or workflow inputs changed. New host/CLI controls cover the analyzer behavior; no new guest feature is asserted. Exsh CI 255/256 is terminal: unit/strict/workspace stages pass, and the required full-frame gate remains incomplete. Docs CI 917/918 passes. Acceptance remains 15/459 leaves, 3.48% weighted. Both full in-EriX builds and the complete semantic authority audit remain open. Ordered-provider automatic CI classification — 17 September 2026: Exsh 255/256 at `469bf1f1b9d8301cf98a79d16c7c27660ecda2a1` passes 961 Rust tests, the combined 276-test checker suite, strict preceding stages and all four workspace domains per run. The required full-frame gate fails with 111/111/74/74 unresolved observations per run. Four complete logs total 315,035 bytes with zero warnings. The 17 separate module executions are local evidence; CI uses combined test discovery. Docs 917/918 at `24cefeb2dc6d3f163140d32f5fed5a7e1a768ebd` passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,878 bytes. Reference-resolution passes produce 35/1/0 warnings; final output has zero warnings and no layout overflow. Original API snapshots remain unchanged. Both cohorts are fully classified, without restarting workflows or changing thresholds. Original Integration layout, quota and FAT32 failures remain open, including #58 in Integration. Acceptance remains 15/459 leaves, 3.48% weighted. Complete native source/frame proof, a runnable realm, the full semantic authority audit and both full in-EriX builds remain required. Protected cross-object frame evidence — 17 September 2026: signed Exsh `ac9646c84e432129a872737789a9be08f984b881` composes the seven explicitly selected native objects using protected relative/symbolic slots and object-qualified function identities. Local control-flow offsets cannot alias a foreign function or transfer the root fallback role. Register facts, grounded preservation/no-return dependencies and route accounting retain the selected object. Every captured decode shares the original output/time budgets; a late failure rejects the invocation. Native reports use schema 3; standalone schema 2 and input schema 1 remain unchanged. All 299 checker tests and 20 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, rustdoc and six warning-free native builds; formatting and Markdown checks pass. Original runtime/all replays retain 107/70 unresolved observations. The composed native graph reaches 275 functions with 111 unresolved observations; all three actual checker exits remain 1. Native slots assume successful checked linking and unchanged disjoint mappings. Actual load bases, complete source/frame acceptance and coherent runtime adoption remain open. Profiling identified redundant root-only analysis in native mode. Removing it preserved every composed decision while one profile changed from 41.52 to 25.81 seconds and 64.37M to 39.61M calls. This host profile pair includes observer overhead and gives no general or guest timing guarantee. The final source replay also preserves every decision; three register-proof records now correctly identify symbolic load provenance. Signed Docs `44cd6c4aa95bebfa08c99804fab0f1551f537ae1` specifies the contract. All 45 documentation tests pass; the complete 2,383-page manual has 436,894 in-bounds word boxes, zero final warnings and visual review of the changed page. All 3,713 inventoried source/configuration files are below 1,000 lines. The broader documentation audit retains 108 unchanged older test definitions needing inline docstrings; current production and all new/modified definitions are documented. Runtime Rust, dependency, linker and workflow inputs are unchanged; added behavior has host and real CLI regressions, with no new guest runtime feature asserted. Original Exsh CI 257/258 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 919/920 passes. Both cohorts are fully classified. Both full builds inside EriX and complete semantic authority acceptance remain open. Cross-object checkpoint CI classification — 17 September 2026: Exsh 257/258 at `ac9646c84e432129a872737789a9be08f984b881` passes 961 Rust tests, the combined 299-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery also checks isolated module imports; the 20 separate module-suite executions are additional local evidence. The required full-frame gate fails with 111/111/74/74 unresolved observations on the four original CI artifact selections. Four complete logs total 315,180 bytes with zero warnings. Those CI selections remain distinct from the retained seven-object native replay. Docs 919/920 at `44cd6c4aa95bebfa08c99804fab0f1551f537ae1` passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,906 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required. Saved-value preservation evidence — 17 September 2026: signed Exsh `8b6b93a329757ae7f106e235761912b58a67deff` derives incoming-register equality through exact full-width copies and owned live stack slots. Original byte decoders bind register, width and address forms. Partial or unknown aliases, conflicting paths, deallocation and reuse invalidate saved facts. Entry tokens carry equality only; they never supply a pointer or call target. A separate earlier callee contract must prove private stack writes before caller slots survive a call. Checked signed bounds and finite dependency order prevent wrapped offsets and recursive assumptions from granting evidence. All 329 checker tests and 22 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, rustdoc and six warning-free native builds; formatting and Markdown checks pass. Independent eager scheduling controls agree with both filtered worklist orders. Original runtime/all/native replays retain 107/70/111 unresolved observations and actual checker exit 1. The native graph still reaches 275 functions. The startup iterator's unknown pointer writes remain a refusal; complete source/frame and runtime acceptance remain open. Two initial native profiles exhausted the original 60-second budget and produced empty reports; both failures are retained. Immutable decode caches, retirement of exhausted equality state, fact-sensitive wakeups and dependency-first scheduling brought the final native replay within the unchanged budget: 57.45 seconds wall time, 53.94 profiled seconds and 72.27M calls. All 2,373 bodies are inspected once. This bounds one retained host replay and makes no general speedup or guest timing claim. Report schemas and original source, stack, byte and time gates are unchanged. Signed Docs `c3401e5f6bbc19a0ba695219ed551e29a29677ed` specifies the contract. All 45 documentation tests pass; the complete 2,383-page manual has 436,968 in-bounds word boxes, zero final warnings and visual review of both changed continuation pages. All 3,717 inventoried source/configuration files are below 1,000 lines. The touched preservation tests now document 21 older methods; 87 unchanged older test definitions remain in the inline documentation audit. Current production and all new/modified definitions are documented. Runtime Rust, dependency, linker and workflow inputs are unchanged; no new guest runtime feature is asserted. Original Exsh CI 259/260 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 921/922 passes. Both cohorts are fully classified. Both full builds inside EriX and complete semantic authority acceptance remain open. Saved-value checkpoint CI classification — 17 September 2026: Exsh 259/260 at `8b6b93a329757ae7f106e235761912b58a67deff` passes 961 Rust tests, the combined 329-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery checks isolated module imports; the 22 separate module-suite executions are additional local evidence. The required full-frame gate fails with 111/111/74/74 unresolved observations on its four original CI artifact selections. Four complete logs total 315,234 bytes with zero warnings. These CI selections remain distinct from the retained seven-object native replay. Docs 921/922 at `c3401e5f6bbc19a0ba695219ed551e29a29677ed` passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,958 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required. Caller-bound stack preservation — 17 September 2026: signed Exsh `e7ba974e96ee77a41c6a861150da843d4c84c7d6` binds formal GP arguments to independently proved live caller stack intervals. Exact callee write spans preserve return-address gaps and invalidate every overlapping save. Scoped masks never enter the unconditional function index; loaded words, unknown contents, released storage and recursive assumptions supply no binding. Byte-checked SETcc writes exactly one unknown byte. All 355 checker tests and 23 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, private rustdoc and six warning-free native builds. Formatting, templates and Markdown pass. Original runtime/all/native replays retain 97/60/97 unresolved observations and actual exit 1. The native graph reaches 275 functions; the startup iterator now has caller-bound preservation for its exact live buffers. Complete source/frame and runtime acceptance remain open. Profiling exposed repeated failed argument specializations. Mandatory opaque-prefix refusals, conservative GP demand and rejection-only control candidates avoid unnecessary interpretations without changing the original 60-second limit. Candidate records cannot become proofs, and incompatible fact kinds defer to actual interpretation: losing pointer identity can enable numeric refinement. Positive and negative controls compare filtered and eager behavior. Each CFG site has at most one pending visit and later changes still enqueue it without an iteration cap; every native proof decision agrees with the prior queue. The final ordinary native replay takes 39.80 seconds. Complete tracing still exhausted the original deadline; failures and empty reports are retained. A separately identified selective profile measures only caller-context analysis: the complete invocation takes 56.59 seconds, with 26.92 profiled seconds in that scope. Instrumentation preserves the complete proof result. Different profiling scopes are not timing comparisons, and no guest performance claim is made. The replay selects 367 instances, evaluates 587 bodies, proves 190 and defers 51 candidate bodies for incompatible domains. Signed Docs `fc3ee44748c20a3aa6f55bd85ac1913c707e5d4e` specifies these contracts. All 45 documentation tests pass. The complete 2,385-page manual has 437,275 in-bounds word boxes, zero final warnings and visual review of the changed pages. All 3,721 inventoried source/configuration files are below 1,000 lines. All new/modified definitions are documented; 87 unchanged older test definitions remain in the audit. Runtime Rust, dependencies, linker and workflow inputs are unchanged. Original Exsh CI 261/262 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 923/924 passes. Both cohorts are fully classified. Complete semantic authority acceptance, coherent runtime adoption and both full builds inside EriX remain required. Caller-bound checkpoint CI classification — 17 September 2026: Exsh 261/262 at `e7ba974e96ee77a41c6a861150da843d4c84c7d6` passes 961 Rust tests, the combined 355-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery checks isolated module imports; the 23 separate module-suite executions are additional local evidence. The required full-frame gate fails with 101/101/64/64 unresolved observations on its four original CI artifact selections. Four complete logs total 315,210 bytes with zero warnings. These CI selections remain distinct from the retained seven-object native replay. Docs 923/924 at `fc3ee44748c20a3aa6f55bd85ac1913c707e5d4e` passes 45 tests and the complete 2,385-page manual. Four complete logs total 764,350 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required. Caller-local query checkpoint — 17 September 2026: signed Docs `4ff9a60ed9ba3fbc9d3b68a14c1a40e238ed386c` records one attributed query caller, explicit CSpace metadata reads, error precedence and the fifteen actual-user query canary cases. All 45 documentation tests and the complete 2,385-page manual pass; 437,473 word boxes are in bounds, affected pages 146, 147 and 1307 were visually reviewed, and final rendering has no warnings. Original Docs CI 925/926 both pass with complete terminal logs and zero final warnings. Public API snapshots are unchanged. The manual keeps finite native observations separate from generic preservation and complete self-hosting claims. Single syscall inventory checkpoint — 17 September 2026: signed Docs `0a0f305464f7df2b33e2ef7c86079d64c844e4b8` replaces the stale detailed syscall list with a resolved reference to the complete twenty-selector IPC table. This repairs [issue 9](https://git.erikinkinen.fi/erix/docs/issues/9), which omitted the eight owned-invocation operations. Removed selector 0x70 remains explicitly rejected; runtime ABI and generated API snapshots are unchanged. All 45 documentation tests, Markdown and template checks pass. The complete 2,385-page manual has 437,463 in-bounds word boxes, no final warnings, and visual review of pages 142 and 163. Rust and VM checks are inapplicable to these two prose-only changes. Original automatic [CI 927](https://git.erikinkinen.fi/erix/docs/actions/runs/927) and [CI 928](https://git.erikinkinen.fi/erix/docs/actions/runs/928) both pass. All four complete terminal logs total 764,750 bytes; reference passes resolve with 36/1/0 warnings and the final manual is warning-free. Issue 9 is repaired and closed. No full self-hosting acceptance is claimed. Explicit entry-state checkpoint — 17 September 2026: signed Docs `c7bfffc4a2ec46eeb496f001fd40735648843a01` corrects the syscall reference to IRETQ, a 136-byte retained prefix, a separate 176-byte kernel entry reservation, saved user RSP and the 256 KiB kernel stack. It documents the explicit live-direction contract and thirty query cases while preserving the limits of finite native evidence. This addresses [issue 10](https://git.erikinkinen.fi/erix/docs/issues/10); generated API snapshots are unchanged. All 45 documentation tests and Markdown/template checks pass. The complete 2,387-page manual has 437,732 in-bounds word boxes and no final warnings; pages 146, 166, 168 and 169 were visually reviewed. Runtime tests are inapplicable to this documentation-only change. Original [CI 929](https://git.erikinkinen.fi/erix/docs/actions/runs/929) and [CI 930](https://git.erikinkinen.fi/erix/docs/actions/runs/930) both pass. All four complete terminal logs are classified; both full 2,387-page manual builds have zero final warnings. Issue 10 is closed for the corrected documentation drift. No complete guest build is established. Entry-frame and complete fixture checkpoint — 17 September 2026: Signed `2a6bb7206694481362a1fe11398a6af7d23fea3d` documents the aligned terminal exception call and exact five/six-word hardware frame, preserving the separate resumable page-fault contract. All 45 tests and the complete 2,387-page manual pass; 437,838 in-bounds word boxes, visually reviewed pages 147/166, zero final warnings. Original CI 931/932 passes with all four complete logs (765,262 bytes), reference warnings 36/1/0 and zero final warnings. Both complete guest builds and dependent runtime/source proof remain open. Borrowed syscall capture reference — 17 September 2026: signed `2435bf5ed105fbe2af0349088b2ae600d4b598fd` documents the complete entry prefix and refusal before operation dispatch. All 45 documentation tests, Markdown/template checks and the 2,387-page manual pass, with 437,959 in-bounds word boxes, zero final warnings and visual review of pages 167/169. Original CI 933/934 passes: all four complete logs total 765,238 bytes, with reference-resolution warning counts 36/1/0 and zero final warnings. This documentation checkpoint does not imply runtime or complete guest-build acceptance. VSpace cleanup reference — 17 September 2026: signed `d1f635a4755d13a7b85ad75d219a1e02ea8db686` documents one-way retirement, recorded progress and retained final ownership. All 45 documentation tests and the complete 2,387-page manual pass, with 438,059 in-bounds word boxes, zero final warnings and visual review of page 132. Original CI 935/936 passes with all four complete logs classified and zero final warnings. Runtime and full guest-build acceptance remain separate. Process cleanup reference — 17 September 2026: signed `d7f1a59620a1542e82d776e593b8da77efca2e0c` documents retained private identities, non-executable cleanup states and the final release lock/commit contract. All 45 tests, document checks and the 2,387-page manual pass with 438,174 in-bounds word boxes, zero final warnings and visual review of page 132. Original CI 937/938 passes with all four complete logs classified and zero final warnings; preceding CI 935/936 is fully classified PASS. Runtime and guest-build gates are separate. Runtime archive checkpoint — 17 September 2026, signed `cf684745b08b59e0efc98c4b904708d0c17d735d`: All 45 documentation tests pass. The complete 2,387-page manual renders with zero final warnings and 438,260 in-bounds word boxes; page 2292 is visually reviewed. No Rust API, runtime code or API snapshot changes in this documentation checkpoint. Original Docs CI 939/940 passes with all four complete terminal logs classified (765,226 bytes). Reference-resolution passes contain 36/1/0 warnings; the final render has zero warnings. No earlier failed workflow is restarted. Linker selection checkpoint — 17 September 2026, signed `050b9bcc3a5d8e0f57efc62e8775dee10a48af84`: All 45 documentation tests pass. The complete 2,387-page manual has 438,385 in-bounds word boxes and zero final warnings. Page 2292 is visually reviewed. No Rust API or runtime source changes are included in this documentation checkpoint. Original Docs CI 941/942 passes with all four complete terminal logs classified (765,214 bytes). Reference-resolution passes contain 36/1/0 warnings; the final render has zero warnings. No earlier failed workflow is restarted. Complete compiler-source admission, ordinary runtime adoption and both full guest builds remain open. Compiler metadata checkpoint — 17 September 2026, signed `64fc14411a3f1629ace2854ddc1c3b7875113343`: All 45 documentation tests pass. The complete 2,387-page manual has 438,492 in-bounds word boxes and zero final warnings. The changed paragraph is visually reviewed across pages 2292 and 2293. No Rust API or runtime source changes are included in this documentation checkpoint. Original Docs CI 943/944 passes with all four complete terminal logs classified (765,158 bytes). Reference-resolution passes contain 36/1/0 warnings; the final render has zero warnings. No earlier failed workflow is restarted. Complete compiler-source admission, ordinary runtime adoption and both full guest builds remain open. Coordinated terminal observation checkpoint — 17 September 2026: Signed revision `be98a93e6f34a9c7ecaffabfa0af1c8f209feff3` is pushed. The native and process-service manual contracts and three signed-source API snapshots are updated. All 45 documentation tests pass. The complete 2,389-page PDF has zero final warnings and 439,146 in-bounds word boxes; native, service and API pages were visually reviewed, including corrected literal shift operators. Typed mediator bootstrap, ordinary service-image adoption and both complete EriX builds inside EriX remain open. Reviewed bootstrap baseline manual — 17 September 2026: Signed revision `10ea454ebab2cb0ca465cedf52ff619c1fc7efd4` updates the testing chapter to Rootd's reviewed 15,239-line release baseline and exact terminal-operation ownership. Compiler-specific binary size is explicitly separate from performance comparison. All 45 documentation tests and the complete 2,389-page manual pass; there are no final warnings, all 439,184 word boxes are in bounds, and page 2334 was visually reviewed. Earlier original CI 945/946 passes with all four logs complete (765,650 bytes; reference passes 36/1/0 warnings). The new signed revision's original CI remains under observation. Complete builds inside EriX and ordinary service-image adoption remain open. Corrected original manual CI — 18 September 2026: Docs `10ea454ebab2cb0ca465cedf52ff619c1fc7efd4` passes original [CI 947](https://git.erikinkinen.fi/erix/docs/actions/runs/947) and [CI 948](https://git.erikinkinen.fi/erix/docs/actions/runs/948). All four logs are complete (765,634 bytes), all 45 tests pass, and the complete 2,389-page manual has zero final warnings after reference passes of 36/1/0 warnings. The later generation-bound cleanup manual update is still under local validation. Generation-bound cleanup consumer acceptance — 18 September 2026: Signed revision `323da983653e6d6d25d012c2354f97afaaaa0699` is pushed. The manual documents native cleanup 56/57, retired selectors, exact framing, original deferred identity and pre-service retirement. Three API references are generated from verified signed source revisions. All 45 tests pass. The complete 2,397-page PDF has zero final warnings and 440,339 in-bounds word boxes; seven changed pages have been visually inspected. The testing chapter corrects Rootd audit-size evidence and records the actual native diagnostic scope. Original CI 949/950 remains under observation. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain open. Original cleanup manual CI acceptance — 18 September 2026: Signed Docs `323da983653e6d6d25d012c2354f97afaaaa0699` passes [CI 949](https://git.erikinkinen.fi/erix/docs/actions/runs/949) and [CI 950](https://git.erikinkinen.fi/erix/docs/actions/runs/950). All four terminal logs are complete (767,338 bytes), all 45 tests pass and both complete 2,397-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements. Returned-grant bootstrap custody design — 18 September 2026: Add distinct Procd PREPARE_REALM_BOOTSTRAP (0x432) on the existing private Launchd route. The native pending caller must match a retained running Launchd generation. Its exact 32-byte request carries u32 request ID, opcode, original process/generation, source and original destination install-grant slots, then two zero words. The actual sole receipt must be INSTALL_GRANT with exactly GRANT|MINT. Slots are full-width descriptions; receipt, live inventory and native matching-grant checks establish custody. Previously guarded, started, stale, ordinary-role and malformed stages refuse before new effects. Reserve exact rollback ownership first. Use the real returned grant and native operation 53 to narrow the Created child's primary endpoint to RECV. Establish an ancestor SEND branch under Kernel lifetime custody and a distinct nested explicit revoker before any export. Retain the nested sender privately; dispose the original master, unguarded sender and ancestor-only bypass aliases. The returned install grant stays exclusively owned for later typed installation. No new endpoint factory or expanded Process endpoint policy is implied. The exact 32-byte capability-free reply echoes request/opcode/result/process/ generation, followed by a u32 custody state and two zero words. State 1 occurs exactly with OK and confirms only guarded unstarted-stage custody; failure state 0 is not absence proof. Lost reply, rollback, abort, supervisor loss and terminal cleanup must account for every reused scratch column, actual guard and exact child identity. Uncertain disposal prevents reuse and ordinary continuation. Keep ordinary mediator starts denied. Counted final receivers/configuration, owned fair intake/provider/retirement progress, private execution, authenticated readiness, initial receiver disposal, seal/publication, real two-realm client I/O and both complete builds inside EriX remain required. Host models or this guarded stage acknowledgment cannot substitute for those acceptance gates. Returned-grant manual checkpoint — 18 September 2026: Signed Docs `b6bd8ce32891a8b298228b8320d0565cef89141f` documents the exact returned-grant request, custody acknowledgment, five retained scratch roles, native guard effects, source-absence requirement and cleanup boundaries. Three API snapshots come from the signed original component revisions; regeneration and provenance checks pass. All 45 tests pass. The complete 2,403-page manual has 441,471 in-bounds word boxes, seven changed pages visually reviewed and zero final warnings. Original [CI 951](https://git.erikinkinen.fi/erix/docs/actions/runs/951) and [CI 952](https://git.erikinkinen.fi/erix/docs/actions/runs/952) pass from all four complete logs (768,706 bytes); reference passes converge with 36/1/0 warnings and both final manuals have zero warnings. Runtime realm orchestration, actual consumer VM execution, fair progress and both complete builds inside EriX remain open requirements. Deferred native cleanup checkpoint — 18 September 2026: Signed Docs `da66c0efd61fc05be023210e1c0c58196b51b878` specifies one queued native attempt before intake, exact-generation owner rotation, first-error retention and acknowledgment-based removal. All 45 tests and the complete 2,403-page manual pass, with 441,578 in-bounds word boxes, two changed pages visually reviewed and zero final warnings. Shared API references are unchanged. Original documentation CI is under observation. Runtime consumer VM, complete realm fairness and full guest-build acceptance remain open. Caller-local grant relocation design — 18 September 2026: Add immediate x86_64 syscall `0x54`, `RELOCATE_LOCAL_GRANT`, taking source slot in argument 0 and destination slot in argument 1. Both fit u32, are nonzero and distinct; arguments 2–5 are zero. The return is the exact result in rax with zero auxiliary value. Admission uses the actual current Running native process and nonzero generation, checks both slots against its syscall window, and accepts only an actual held INSTALL_GRANT or REVOCATION_GRANT with its matching native record. Movement uses the existing unique-record rebinding within that same native CSpace; rights, child/generation installation scope and revocation lineage are preserved. No grant is constructed, copied, attenuated or retargeted. Malformed register shape rejects before context lookup; caller/window checks precede source lookup, then type/binding checks precede empty-destination admission. Ordinary validation refusal leaves inventory unchanged. The transition is serialized with process-terminal and reply-authority lifecycle changes. Owned CLAIM already selects receiving destinations before exposing request bytes; this operation lets a producer validate the received grant and then relocate it into an existing per-process custody slot. The operation itself does not validate a bootstrap request, install child authority or acknowledge application retirement. It adds no Process endpoint selector or general CNode route. Literal register, foreign/terminal caller, missing/fake binding, occupied destination, exact-rights/scope and actual CPL3 controls are required, followed by coordinated producer/consumer adoption and the remaining realm VM gates. Original deferred-cleanup manual CI acceptance — 18 September 2026: Signed Docs `da66c0efd61fc05be023210e1c0c58196b51b878` passes [CI 953](https://git.erikinkinen.fi/erix/docs/actions/runs/953) and [CI 954](https://git.erikinkinen.fi/erix/docs/actions/runs/954). All four terminal logs are complete (768,726 bytes), all 45 tests pass and both complete 2,403-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements. Caller-local grant relocation checkpoint — 18 September 2026: Signed `623609ee627a4afba1340ee06c53678c4a562a88` documents syscall 0x54 register admission, actual Running caller and unique grant custody, exact error precedence and preserved installation/revocation scope. Three API references are regenerated from signed original shared revisions. All 45 tests, complete provenance/regeneration checks and the 2,403-page manual pass. All 442,370 word boxes are in bounds; nine changed pages are visually reviewed and final warnings are absent. The original whitespace preflight failure and subsequent terminology correction are retained. Original documentation CI is under observation. Actual owned service adoption, consumer VMs, complete realm fairness and both full builds inside EriX remain open. Owned receiver request-budget contract — 18 September 2026: Extend register-only REGISTER (0x4C) to take the actual local RECV slot, maximum request payload bytes and maximum request capability count in arguments 0–2; arguments 3–5 remain zero and successful RDX is zero. Both budget values are explicit receiver declarations. Zero/zero admits only empty requests. The byte/slot/receipt receive layout must be addressable and capability capacity must fit native private CSpace storage. The actual Running generation and held generic RECV endpoint remain the registration authority. Exact repeated registration is idempotent only with the same budget; a different budget or owner conflicts without modifying the original registration. Replacement follows the existing actual receiver-binding removal and exact native retirement rules. SUBMIT compares actual payload length and capability count against that exact registration before request allocation, private-space reservation, native transfer or invocation serial acceptance. Oversized requests return ordinary INVALID_ARGUMENT with zero owner ID and unchanged source custody. The packet decoder passes its checked capability iterator directly to native preparation, removing its redundant temporary vector. Accepted invocation, result-budget, delivery, draining and retirement contracts remain explicit. Migrate every producer and fixture to the new signature without a deprecated unbounded fallback. These budgets describe service-owned receiving storage; they add no global CALL-size ceiling, user-pointer retention, foreign selector or capability grant. Literal malformed/zero/exact registration controls, rejected-inventory checks, actual CPL3 calls and existing VM oracles are required. Then connect the owned Procd/Launchd bootstrap path through its held private route, actual claimed caller identity, server-chosen grant receipt and local relocation, retaining each committed/draining owner through exhaustive cleanup. Actual consumer VMs, complete fair realm progress and both full guest builds remain open acceptance requirements. Original local grant relocation manual CI acceptance — 18 September 2026: Signed Docs `623609ee627a4afba1340ee06c53678c4a562a88` passes [CI 955](https://git.erikinkinen.fi/erix/docs/actions/runs/955) and [CI 956](https://git.erikinkinen.fi/erix/docs/actions/runs/956). All four terminal logs are complete (768,754 bytes), all 45 tests pass and both complete 2,403-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements. Explicit owned receiver admission acceptance — 18 September 2026: Signed `8361618f3f047479a9e52ffaba7f2607be99413c`. The manual documents explicit receiver request limits, complete layout addressability, immutable registration and pre-custody refusal, with accurate allocation-observation scope. Three public API snapshots are regenerated from signed shared revisions. All 45 tests, provenance/regeneration checks and the 2,407-page manual pass. All 442,761 word boxes are in bounds; eight changed pages are visually reviewed, with zero final warnings. Original CI is under observation. Actual owned Procd/Launchd service adoption, consumer VM execution, complete realm fairness/readiness/sealing and both full builds inside EriX remain open. Owned guarded-bootstrap service contract — 18 September 2026: Migrate PREPARE_REALM_BOOTSTRAP to native owned request/result custody on the already held private Launchd-to-Procd endpoint. Its exact 16-byte body contains request/opcode/process/generation only; remove obsolete source and destination slot descriptions. The canonical capability-free response remains 32 bytes. No legacy bootstrap transport fallback is retained. Procd registers explicit 16-byte/one-capability request limits, supplies an actually empty local receiving slot, validates the committed receipt type and rights and matches the native claimed origin to the retained Running Launchd generation. It validates the exact staged mediator row and actual grant scope before adopting the grant into that row through caller-local relocation. Existing launch-description staging may be reused only with explicit exclusive ownership and proved completion of its former cleanup; add no broad Process authority or per-realm scratch column. Numeric identity or receipt metadata never replaces actual possession or scope validation. The running service loop must give native retirement a turn before owned bootstrap and ordinary intake. Retain nonzero delivery/invocation owners, received authority, exact child rollback and first cleanup failure through committed/draining outcomes. Complete every independent local and child retirement action before relinquishing bookkeeping; uncertain cleanup cannot return a service to ordinary work. Authenticate actual native origin and revalidate the original supervisor before effects; do not manufacture legacy pending-caller or source-slot receipts. Replace Launchd synchronous bootstrap exchange with retained progress driven by its actual runtime orchestration. Success requires a canonical correlated result, actual source-grant absence and complete invocation retirement. Connect this to authenticated staged realm preparation, with no public numeric shortcut into a prepared process. Preserve ordinary start refusal until realm configuration, readiness and sealing are complete. Acceptance requires adversarial ownership/cancellation/partial-cleanup host controls, strict coordinated builds and real producer/consumer VM execution. Native primitives alone do not establish service adoption, complete fairness or a full guest build. Existing ordinary source/effect/frame and two complete EriX-in-EriX build gates remain unchanged. Original receiver admission manual CI acceptance — 18 September 2026: Signed Docs `8361618f3f047479a9e52ffaba7f2607be99413c` passes [CI 957](https://git.erikinkinen.fi/erix/docs/actions/runs/957) and [CI 958](https://git.erikinkinen.fi/erix/docs/actions/runs/958). All four terminal logs are complete (769,554 bytes), all 45 tests pass and both complete 2,407-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements. Owned bootstrap receiver checkpoint — 18 September 2026: Signed Docs `5c1cf6da319787738fa03f3cc6f526e49604aa09` updates the process-services contract and three source-bound shared API snapshots for the identity-only request and retained native delivery. All 45 tests, three signed API exports, provenance/regeneration checks and the complete 2,407-page manual pass. All 442,920 word boxes are in bounds; seven rendered pages were visually reviewed and final output has no warnings. Original CI 959/960 is under observation. Actual Launchd runtime orchestration, consumer VM execution and both complete guest builds remain open. Original owned bootstrap manual CI acceptance — 18 September 2026: Signed Docs `5c1cf6da319787738fa03f3cc6f526e49604aa09` passes [CI 959](https://git.erikinkinen.fi/erix/docs/actions/runs/959) and [CI 960](https://git.erikinkinen.fi/erix/docs/actions/runs/960). All four terminal logs are complete (769,578 bytes), all 45 tests pass and both complete 2,407-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements. Original realm supervisor and producer cancellation contract — 18 September 2026: Extend BEGIN_MATERIALIZATION to an exact 64-byte body. Its existing 56-byte semantic image description is followed by two full-width u32 fields: original supervisor process ID and generation. Both are nonzero only for the realm mediator role; both must be zero for every other role. Reject the obsolete 56-byte shape. Coordinate the shared codec, Loaderd and Procd through one original pinned dependency graph. On PREPARE_REALM, Loaderd obtains the supervisor pair from the actual native pending caller on its private Launchd receiver. Procd authenticates the actual Loaderd caller on its materialization receiver and matches the forwarded supervisor to its retained Running Launchd generation before any child effect. The pair describes delegated lifecycle responsibility; numbers alone never confer creation, installation or rollback authority. Retain that original owner before materialization and through grant handoff, native submit/claim and guarded staging. Supervisor terminality retires active preparation and every corresponding stage before unrelated provider cleanup. Guard admission must match the original supervisor, never replace it with a later claimant. Launchd retains child rollback and native invocation ownership separately. Caller RELEASE initiates cancellation and must precede any ordinary abort request that could wait behind Procd delivery retirement. RELEASE is not an application rollback acknowledgment: preserve the exact child obligation until its separate cleanup proof. Procd exhausts independent local and child cleanup before server RELINQUISH. Both parties retain nonzero native IDs and the first cleanup failure through draining; no uncertain state returns to ordinary work. Actual Launchd runtime preparation and scheduler adoption, deployment-sized ownership storage, adversarial host controls and real producer/consumer VM execution remain required. Guarded staging does not authorize ordinary start or establish configuration, readiness, sealing, complete fairness or either full EriX build inside EriX. Existing source, effect and frame gates remain. Original supervisor manual checkpoint — 18 September 2026: Signed `a410759e5515b18107f25efb0319ad7c85871a64` documents private caller attestation, the exact 64-byte materialization begin, original ownership before creation and handoff, and separate caller RELEASE cancellation and application rollback. Three shared API snapshots match original signed source exports. All 45 tests, provenance/regeneration checks and the complete 2,409-page manual pass. All 443,265 word boxes are in bounds; seven rendered pages were inspected and final output has zero warnings. Original [CI 961](https://git.erikinkinen.fi/erix/docs/actions/runs/961) and [CI 962](https://git.erikinkinen.fi/erix/docs/actions/runs/962) remain under observation. Actual Launchd owned runtime adoption, consumer VM execution and both full guest builds remain open. Original supervisor manual CI acceptance — 18 September 2026: Signed Docs `a410759e5515b18107f25efb0319ad7c85871a64` passes [CI 961](https://git.erikinkinen.fi/erix/docs/actions/runs/961) and [CI 962](https://git.erikinkinen.fi/erix/docs/actions/runs/962). All four terminal logs are complete (769,994 bytes), all 45 tests pass and both complete 2,409-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements. Retained realm caller checkpoint — 18 September 2026: Signed `4dcbc10e32ebf257139bcbaf07bc1081b9589780` is pushed. The process-service manual describes the retained native caller, permanent source absence, cancellation ordering and independent child retirement. All 45 tests and the complete 2,409-page manual pass. All 443,468 word bounds are valid, both changed pages were visually inspected and final warnings are zero. No Rust implementation or generated API snapshot changes. Original CI 963/964 is under observation. Runtime admission, scheduler integration, consumer VM proof and both full guest builds remain separate requirements. Caller-bound realm admission and retained storage contract — 18 September 2026 Use distinct Launchd operations BEGIN_REALM 0x6D0, PREPARE_REALM 0x6D1, ABORT_REALM 0x6D2 and READ_REALM 0x6D3. The existing 0x6B0–0x6BF range belongs to filesystem providers and is not reused. Little-endian bodies are exact, with nonzero request correlation and no fallback to ordinary launch transactions. BEGIN_REALM is an authority-free 8-byte request (request ID, operation). Derive session, authority realm, original process/generation and Running job from the actual native pending caller. Reserve an independently budgeted realm record, a nonwrapping generation and one disjoint executable-scope receipt slot before replying. Client numeric identities or a bearer sender cannot select ownership. PREPARE_REALM has a 32-byte prefix: request ID and operation (u32), realm record ID and generation (u64 each), and selector byte length (u64), followed by exactly that nonempty UTF-8 selector without NUL. Parsing adds no pathname or packet-size ceiling. The request carries exactly one actual SEND-only directory endpoint to the reserved receipt slot. Verify the original caller/job/session/authority realm again and retire every unretained received capability on refusal. Resolve only inside this explicit directory, authenticate the exact executable and manifest, and call Loaderd's existing private PREPARE_REALM. Never imply a Posixd pathname, Named route, root, cwd, TTY stream, ordinary job or public PreparedProcess input. ABORT_REALM and READ_REALM are authority-free 24-byte requests: request ID, operation and complete realm-record ID/generation. They require the same original Running native owner. READ observes retained state only; ABORT must complete independent source, invocation and exact-child retirement before its successful acknowledgment. Parent terminality initiates the same retained cleanup internally. All four operations have an exact 40-byte capability-free response: request ID, operation, raw result and state (u32 each), record ID and generation (u64 each), receipt slot and zero reserved word (u32 each). States are Unconfirmed=0, Reserved=1, Preparing=2, Guarded=3, Retiring=4 and Retired=5. Success at BEGIN requires Reserved, a nonzero complete handle and receipt slot. PREPARE success requires Guarded; ABORT success requires Retired. READ returns an authenticated nonzero state. Only successful BEGIN returns a receipt slot; every other result has zero there. Failure always has Unconfirmed state; failed BEGIN has a zero handle while other failures echo the original complete request handle. Unknown nonzero result codes remain full-width. Unconfirmed proves no resource absence. Correlate the complete response with the original request before using evidence. Replace obsolete LCH1 v2 with exact 72-byte version3 startup policy. Preserve the first 68-byte field order and append realm_capacity (u32 at offset68). Require an explicit deployment value: zero disables new realm reservations, and nonzero values allocate that many retained records and disjoint receipt slots. Validate checked job-route + stream-route + realm-receipt arithmetic before leaving any ordinary transaction receipt storage. No default or incidental fixed array sets realm count. Coordinate shared startup codecs, Rootd payloads, Launchd arena and Integration policy/packaging; old version/width must reject. Extend the native capacity descriptor with the realm record's size/alignment and a new layout version; do not assume ordinary reply records survive long enough for realms. Keep original child, local scope/grant obligations and native invocation owners independent. Actual scheduler progress must exclude ordinary and indirect blocking peer calls while any native invocation needs progress. A permanently discharged source slot is never revisited after reuse. Native release precedes ordinary exact-child abort; preserve first errors and exhaust independent cleanup without returning uncertain state to normal operation. Guarded staging remains private and unstarted, without exported SEND or a Running job. This initial admission interface does not define configuration, readiness, sealing or publication. Coordinated host negatives, strict source-bound build matrices and real consumer VM execution are required. Two mediator processes, two clients per realm with actual mediated I/O, complete fair progress, source/effect/frame admission and both full builds inside EriX remain separate open acceptance requirements. Original retained caller manual CI acceptance — 18 September 2026: Signed Docs `4dcbc10e32ebf257139bcbaf07bc1081b9589780` passes [CI 963](https://git.erikinkinen.fi/erix/docs/actions/runs/963) and [CI 964](https://git.erikinkinen.fi/erix/docs/actions/runs/964). All four terminal logs are complete (770,022 bytes), all 45 tests pass and both complete 2,409-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements. Caller-bound realm record checkpoint — 18 September 2026: Signed `9868cf0e6f2c366b4a2c7992594a83c72789f1f0` is pushed. The manual describes exact realm admission messages, original-caller binding, explicit LCH1 version-3 capacity and independent native storage. Four API references select the signed shared graph; stale bootstrap width, version and route-stride prose is corrected. All 45 tests, API provenance/regeneration checks and the complete 2,417-page manual pass. All 445,195 word bounds are valid, seven rendered pages were reviewed and final warnings are zero. Original CI 965/966 is under observation. Actual runtime admission, coherent image consumers, mediated client I/O and both full guest builds remain open. Original realm admission manual CI acceptance — 18 September 2026: Signed Docs `9868cf0e6f2c366b4a2c7992594a83c72789f1f0` passes [CI 965](https://git.erikinkinen.fi/erix/docs/actions/runs/965) and [CI 966](https://git.erikinkinen.fi/erix/docs/actions/runs/966). All four terminal logs are complete (771,742 bytes), all 45 tests pass and both complete 2,417-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements. Exact realm executable preparation checkpoint — 18 September 2026: Signed `880bdc59818b1eff9cf9929004680f354f8265a0` is pushed. The manual documents actual exact preparation, shared authentication, scratch reuse and independent retained cleanup, while keeping dispatcher, scheduler and consumer-image requirements open. All 45 tests and the full 2,419-page manual pass; all 445,389 word bounds and both changed rendered pages are reviewed, with zero final warnings. Shared API snapshots are unchanged. Original CI 967/968 is under observation. Complete mediated execution and both full builds inside EriX remain required. Original exact preparation manual CI acceptance — 18 September 2026: Signed Docs `880bdc59818b1eff9cf9929004680f354f8265a0` passes [CI 967](https://git.erikinkinen.fi/erix/docs/actions/runs/967) and [CI 968](https://git.erikinkinen.fi/erix/docs/actions/runs/968). All four terminal logs are complete (772,086 bytes), all 45 tests pass and both complete 2,419-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements. Public realm dispatch and progress checkpoint — 18 September 2026: Signed `099f0c570414ca486bb2104c1510fbf3b84d59fb` is pushed. The manual describes public realm intake, independently held replies, original-parent cleanup and fair native progress before ordinary dispatch, while preserving separate consumer VM and guest-build acceptance. All 45 tests and the complete 2,419-page manual pass. All 445,563 word boxes are within page bounds; both changed rendered pages are visually reviewed, with zero final warnings. Shared API snapshots are unchanged. Original CI is under observation; no runnable realm or guest build is claimed. Original public realm dispatch manual CI acceptance — 18 September 2026: Signed Docs `099f0c570414ca486bb2104c1510fbf3b84d59fb` passes [CI 969](https://git.erikinkinen.fi/erix/docs/actions/runs/969) and [CI 970](https://git.erikinkinen.fi/erix/docs/actions/runs/970). All four terminal logs are complete (772,182 bytes), all 45 tests pass and both complete 2,419-page manuals have zero final warnings. Reference passes converge with 36/1/0 warnings. This closes the manual CI observation recorded above; complete Integration catalog, runnable realm and guest-build acceptance remain separate open requirements. Realm startup consumer manual checkpoint — 18 September 2026: Signed `33733ceba228669e27152aee32f997d6c72264ff` describes exact realm startup consumers, explicit disabled or positive deployment capacity and the reviewed Rootd production audit. All 45 tests and the complete 2,419-page manual pass, with 445,650 word boxes within page bounds, two visually reviewed changed pages and zero final warnings. Shared API snapshots are unchanged. Original CI 971/972 is under observation. Coherent catalog adoption and actual consumer VMs remain required before image acceptance; no runnable realm or full guest build is claimed. Original coherent realm source CI acceptance — 18 September 2026: Signed `33733ceba228669e27152aee32f997d6c72264ff` passes [CI 972](https://git.erikinkinen.fi/erix/docs/actions/runs/972) and [CI 971](https://git.erikinkinen.fi/erix/docs/actions/runs/971). All four terminal logs are complete (772,194 bytes), with zero final warnings. This closes the original CI observation recorded above. All 45 tests and both 2,419-page manuals pass; reference-pass warnings converge 36/1/0. Coherent catalog publication, actual consumer VMs and full guest-build acceptance remain separate open requirements. Native external-toolchain rebuild requirement — 19 September 2026: Signed `b54d28e755dd415079100a19683ee1474edb4ed1` makes the native rebuild an explicit Phase 6 verification and acceptance gate. The first compiler may be cross-built for EriX against its libc/sysroot, Rust OS bindings and declared C/C++ runtime closure. The extended development image must then rebuild the selected upstream Rust/LLVM toolchain inside EriX using supplied offline recipes and an explicit bootstrap compiler. Require working guest-built tools and use in at least one full EriX build, with no unrecorded porting changes, downloads, Linux executables or host build delegation. Complete source, runtime, log and measured-resource evidence is required; compiler ownership remains distinct. All 45 documentation tests and the full 2,419-page manual pass, with 445,775 in-bounds word boxes, actual visual review of the changed page and zero final warnings. Shared API snapshots are unchanged. [The phase master](https://git.erikinkinen.fi/erix/integration/issues/65), [toolchain issue](https://git.erikinkinen.fi/erix/integration/issues/7) and [full-build issue](https://git.erikinkinen.fi/erix/integration/issues/9) contain the matching requirements. Original documentation CI is under observation; the native toolchain rebuild and both OS builds remain unproven. ## Tracking and rollout The matching signed [Docs PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4), `54557713f4afad380c1166f6aa1c1622d3959744`, updates the TeX chapter and both IPC API views from original signed source. All 45 tests, independent API regeneration, the complete 2,423-page manual, all 446,749 word bounds and nine visually reviewed contract pages pass, with zero final warnings. Original [Docs CI 979](https://git.erikinkinen.fi/erix/docs/actions/runs/979) and [980](https://git.erikinkinen.fi/erix/docs/actions/runs/980) pass from four complete hashed logs, 773,034 bytes. Both runs pass 45 tests and the complete 2,423-page manual; successive TeX passes retain 36/1/0 warning observations, with zero final-pass warnings. No workflow rerun or cancellation supplies this result. Native upstream Rust/LLVM rebuilding and both complete EriX build generations inside EriX remain required. Native child-custody wire checkpoint — 19 September 2026: signed [lib-ipc PR 2](https://git.erikinkinen.fi/erix/lib-ipc/pulls/2), `aaf2df39700b43507b23ff2007bc0d573c4eea30`, implements `ChildLifetimeBindingV1`, native operation 58 and supervisor-termination kill reason 4. The request preserves the exact child/generation and actual local grant slot, with no owner selector, rights mask or withdrawal form. Existing Process authority and current Running attribution remain separate native requirements. All reserved bits are rejected; replies carry zero result values and preserve uninterpreted codes. Lost replies retain the original cleanup obligation. See the [shared contract](https://git.erikinkinen.fi/erix/lib-ipc/src/commit/aaf2df39700b43507b23ff2007bc0d573c4eea30/docs/child-lifetime-binding.md) and [Kernel design #19](https://git.erikinkinen.fi/erix/kernel/issues/19). Seven new controls pass all eight strict library/shim configurations: 419 wire tests and 20 shim tests per configuration, eight freestanding builds, formatting, strict host/native Clippy and private rustdoc, with no warnings. The original kernel-only shim test remains ignored. Original [lib-ipc CI 365](https://git.erikinkinen.fi/erix/lib-ipc/actions/runs/365) and [366](https://git.erikinkinen.fi/erix/lib-ipc/actions/runs/366) pass from four complete hashed logs, 494,246 bytes, without warnings. Kernel admission, descendant stopping, safe native reclamation progress, coherent consumer adoption and actual CPL3 failure coverage remain open. The shared codec does not enable private mediator execution or alter the current complete image's source graph. ### Native caller admission checkpoint — 15 September 2026 Signed Procd `c583614aa48f3e11a3ccabfeee06340f518de750` now checks the actual pending native caller on Launchd ingress against its retained running Launchd process and stage generation before operation-specific receipt validation or dispatch. Forwarded SEND aliases, request-body identities, other lifecycle roles, reused generations and unavailable identity cannot acquire this dispatch permission. Other receivers retain their policy; rejected delivered transfers still undergo local disposal, and uncertain disposal stops ordinary continuation. Five new producer controls exercise accepted event dispatch and refusals without consuming the private event. The complete strict host/native development/release matrix passes: 239 default-feature tests, 244 all-feature tests, Clippy, rustdoc, formatting and forty native binary builds, with no warnings. The changed runtime-loop fragment is formatted by the repository formatter; its other code matches the formatted original outside the reviewed admission replacement. Signed documentation `45d4d04c534f2ebca857ee203265232fd7c32bbe` passes 45 tests and a frozen 2,375-page manual with 433,469 in-bounds word boxes and no final warnings. Page 212 was visually reviewed. The receiver inventory also corrects the existing powerbox omission and obsolete loader operation count. Shared API snapshots are unchanged. Procd CI 274/275 and Docs CI 879/880 pass with complete classified logs and no final warnings. Both component cohorts are complete. Product runtime-image validation still requires a coherent original-commit dependency graph; this checkpoint does not claim a new Procd VM. Actual returned-grant custody, guarded bootstrap, readiness/configuration/seal, mediated client byte I/O, fair retirement and both complete guest build generations remain open. ### Mediator constructor adoption manual — 15 September 2026 The manual now records Procd's mediator-only use of operation 54 without a parent VSpace receipt, independent native TCB backing, unchanged ordinary construction, refusal without fallback and closed start gates. Signed original documentation revision: `8b30523f3d7e1c300f39e3418a8748dae10ec04f`. All 45 tests, Markdown/templates, source-bound rendering, all-page bounds checks and visual review of pages 186, 187 and 213 pass. The final manual has 2,375 pages, 433,374 in-bounds word boxes and zero final warnings. CI 877/878 passes with complete classified logs. The original signed shared API snapshots are unchanged; no fresh API export is claimed. An earlier render is retained for its earlier text; the final source removes stale language listing root omission as future consumer work. This documents the accepted Procd producer change, not a new Procd CPL3 VM or runtime image. Authenticated grant return, guarded private execution, readiness, configuration/seal, client I/O, fair retirement and both full guest build generations remain open. ### Construction without child root capabilities — 15 September 2026 Docs CI 875/876 passes with complete classified logs; reference passes converge to zero final warnings. Document the construction selector, exact request, caller and child inventory, native backing lifetime, rollback and consumer gates; regenerate the shared API references. Signed original revision: `4af92b0b1ae2b8fa8e12166959057857ab6e07e8`. All 45 documentation tests, Markdown, templates, source-reference checks, API regeneration/check, final rendering and actual changed-page visual review pass. The manual has 2,375 pages, 433,333 in-bounds word boxes and zero final warnings. The first render was rejected because an operation-registry correction followed its source snapshot; accepted evidence uses frozen final text. Procd adoption, authenticated grant return, guarded bootstrap authority, private mediator execution, readiness, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase semantic authority and private-item documentation audits remain incomplete. ### Staged endpoint attenuation checkpoint — 15 September 2026 Document staged primary endpoint attenuation in the kernel-control registry, normative wire/authority contract, mediator bootstrap prerequisites and regenerated shared API references. Signed original revision: `b751a385ca727f7fed82c7d83a11f6971245b495`. All 45 documentation tests pass. The complete manual renders 2,371 pages and 432,348 in-bounds word boxes with zero final warnings. Actual pages 185, 609 and 1034 pass visual review. Three shared API references were regenerated and independently checked from signed original revisions. Docs CI 873/874 passes with complete classified logs; reference passes converge to zero final warnings. Authenticated grant return, independently minimal bootstrap/root authority, retained native and nested guards, private mediator execution, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase authority and private-item documentation audits remain incomplete. Signed Docs `c6b0b677f16cd31cdc7555515729b376d5ff5c52` refreshes the public issue index to all 154 issues, including [Integration issue 50](https://git.erikinkinen.fi/erix/integration/issues/50), and records the accepted IPC platform manual CI. The two changed Markdown files pass all 45 documentation tests, 55-file Markdown lint, canonical governance/headings and exact public-link inventory checks. Every manual source, API reference and manual build input remains identical to accepted Docs `87942ea7`, whose complete local manual and CI 843/844 pass with zero final warnings. No Rust crate or runtime interface changes in this index/status update. [Push CI 845](https://git.erikinkinen.fi/erix/docs/actions/runs/845) and [PR CI 846](https://git.erikinkinen.fi/erix/docs/actions/runs/846) pass at this signed source. Four full logs total 752,638 bytes. Both manual jobs pass 45 tests and converge through 2,325/2,339/2,339 pages with 31/1/0 reference warnings and no final warnings or layout diagnostics. Both 55-file Markdown jobs pass. CI reports a 4,114,917-byte PDF; the artifact was not separately downloaded. Signed Docs `87942ea7675e2a25fe3bf19f3cac19f9c5d8b1e2` specifies native IPC platform selection and hosted transport refusal, with both IPC API references generated from signed Lib-ipc `805717680d9dfb902216550a111d910807f30d23`. All 2,593 ABI and 24 shim public signatures remain unchanged, as do the other 33 reference selections. Compile-target selection, local refusal, native observations and retirement evidence remain distinct. All 45 documentation tests and 55 Markdown files pass. The complete 2,339-page manual builds in 163.82 seconds with zero final warnings. All 426,697 word boxes fit within page bounds, and three changed pages pass visual review. PDF SHA256 is `3a8e702ecf43066f4b3dde37d22d2a527fdce810bfe7e7b43f5f4912c020a6c5`. Canonical governance, document headings, links, generated references and whitespace checks pass. Docs has no Cargo crate; the selected IPC source passes its strict matrix and CI 335/336. [Push CI 843](https://git.erikinkinen.fi/erix/docs/actions/runs/843) and [PR CI 844](https://git.erikinkinen.fi/erix/docs/actions/runs/844) pass at this signed source. Four complete logs total 752,618 bytes. Each manual job passes 45 tests and converges through 2,325/2,339/2,339 pages; 31 first-pass and one second-pass reference warnings resolve, leaving zero final warnings and no layout diagnostics. Both Markdown jobs pass all 55 files. CI reports a 4,114,917-byte PDF; its artifact bytes were not independently inspected. The separate local PDF geometry and visual checks pass. Earlier native lifetime and runtime namespace documentation remains accepted at Docs `17b4d52a` with CI 841/842. Realm adoption, separate operation-completion contracts, the whole-codebase audit and both full EriX-in-EriX builds remain open. Signed Docs `17b4d52a9a84e0803746e3a38eb34f070bfb28a4` documents the accepted isolated native lifetime fixture and the Bootloader runtime-symbol namespace boundary. The diagnostic uses actual CPL3 owners, ordinary exit and Process-endpoint kill, exact alias/event witnesses and an explicit typed kernel-only reporter. Rust v0 defining-path recognition preserves the existing runtime namespace and exact authenticated export checks. The public coordination index contains all 153 current issues, including the three observed diagnostic/build defects. All 45 documentation tests and 55 Markdown files pass locally. The complete 2,339-page manual builds in 164.50 seconds with zero final warnings. All 426,453 word boxes fit within page bounds; changed pages 65 and 162 pass visual review. PDF SHA256 is `2b5df3bb6edb8cbc6e667c798148c73f46a0170fc6abec7cb04615f158cf58af`. Existing generated API references and renderer code are unchanged. Docs contains no Cargo crate; Rust behavior is validated in its owning repositories. [Push CI 841](https://git.erikinkinen.fi/erix/docs/actions/runs/841) and [PR CI 842](https://git.erikinkinen.fi/erix/docs/actions/runs/842) pass for this signed source. Four complete logs total 752,178 bytes. Each manual job passes 45 tests and converges through 2,325/2,339/2,339 pages: 30 first-pass and one second-pass reference warnings resolve, with zero final warnings or layout diagnostics. Both Markdown jobs pass all 55 files. CI reports a 4,113,243-byte PDF; its bytes and geometry were not independently inspected. The separate local whole-PDF and two-page visual review passes. The earlier syscall/API checkpoint `28b44183` already passes CI 839/840. Kernel `03e13a78` passes CI 528/529 and Bootloader `e7fa3935` passes CI 135/136; the coordinated Integration `4b65755f` native VM passes the required exit and ordered unique markers. Realm adoption, provider/pending-operation completion, the full audit and both complete builds inside EriX remain open. Current signed Docs `28b44183368c512da9c5b804f570ff497ae3b6fc` passes [push CI 839](https://git.erikinkinen.fi/erix/docs/actions/runs/839) and [PR CI 840](https://git.erikinkinen.fi/erix/docs/actions/runs/840), completed by 08:14:56 UTC on September 14. Four complete logs total 752,154 bytes and correlate with the original workflow and build scripts. Each manual job passes 45 tests and finishes at 2,339 pages with zero final warnings; thirty first-pass and one second-pass convergence warnings resolve. Both Markdown jobs check 55 files with zero errors. CI logs report a 4,111,798-byte PDF; its artifact bytes and geometry were not independently inspected. The separate local full-PDF and five-page visual review passes. This closes renderer issue #7 only; native VM, realm producer, full audits and guest self-hosting remain open. Signed Docs `28b44183368c512da9c5b804f570ff497ae3b6fc` documents native local lifetime revocation and corrects the opaque named-field renderer (#7). Fresh original-source IPC/shim references preserve every old signature and add only the syscall assignment and safe wrapper. All 45 Docs tests, both generation checks, 55 Markdown files, canonical governance/headings/links and the 150-issue index pass. The full 2,339-page manual builds in 165.44 seconds with zero final warnings; all 426,181 word boxes fit and five selected pages pass visual review. [Push CI 839](https://git.erikinkinen.fi/erix/docs/actions/runs/839) and [PR CI 840](https://git.erikinkinen.fi/erix/docs/actions/runs/840) both pass as recorded above. Native VM, realm producer, complete audits and both full build generations inside EriX remain open. Dependencies: [meta#2](https://git.erikinkinen.fi/erix/meta/issues/2) Dependencies identify required contracts and closure gates; preparatory inventory/design can proceed in parallel under one owner per edited file. Link bounded implementation issues and their PRs here before claiming acceptance. Use `feature/posix-compat`, regular signed commits in the canonical contribution format, and WIP PRs linked to the exact coherent component graph. All cross-repository Cargo/catalog selections and CI helpers use full 40-character lowercase commit hashes, including transitive dependencies; do not substitute branch, tag or implicit HEAD selection. Close criteria only with their own reviewed deliverables and validation evidence. Pending, skipped, cancelled, failed or predecessor-only results remain distinct. Keep main images unchanged until explicit promotion direction; technical completion does not authorize merges, release tags or publication. Original [Docs CI 973](https://git.erikinkinen.fi/erix/docs/actions/runs/973) and [974](https://git.erikinkinen.fi/erix/docs/actions/runs/974), at `b54d28e755dd415079100a19683ee1474edb4ed1`, pass. All 45 tests and the complete 2,419-page manual pass; intermediate reference-resolution passes converge to zero final warnings. All four terminal logs are complete and hashed, totaling 772,186 bytes. This validates the native-toolchain rebuild requirement in the phase document and manual, not an actual toolchain or EriX build inside EriX. Signed private-route manual correction — 19 September 2026: `ce8a1538ab2220f1b346e1a051265f58f83f47fc` documents realm admission through both the public receiver and the shell's authenticated private script route, retaining original reply custody and caller proof. A stale startup-publication paragraph now states the permanent coherent-source and distinct runtime-evidence requirements. All 45 tests and the full 2,419-page manual pass; all 445,834 rendered words are within bounds, revised page 224 has been visually reviewed and final warnings are absent. Shared API snapshots are unchanged. Original [CI 975](https://git.erikinkinen.fi/erix/docs/actions/runs/975) and [976](https://git.erikinkinen.fi/erix/docs/actions/runs/976) are running. Native external Rust/LLVM rebuilding and both full EriX build generations remain required. Original manual CI 975/976 passes from all four complete hashed logs (772,174 bytes): 45 tests, the full 2,419-page manual and zero final-pass warnings. Signed Integration `9139c6c5fa38c139e92520f6d410626b4cf1e4aa` now adopts this documentation with the matching corrected-server VM, which passes its unchanged caller-admission scenario. Complete mediator execution, native toolchain rebuilding and both full guest builds remain required. Guarded-custody documentation reconciliation — 19 September 2026: signed [Posixd PR 5](https://git.erikinkinen.fi/erix/posixd/pulls/5), `9b031a8c2f996491a322046a4f2acd5dacdc55c2`, replaces stale grant-return and proposed-custody gaps with the implemented producer boundary. Procd uses the actual returned grant to attenuate the initial endpoint to RECV before execution, removes bypass sources, and retains nested custody beneath Kernel lifetime custody. A later mediator disposal report cannot prove absence of bypass senders. Exact staged abort and the remaining counted startup, readiness, configuration, sealing, client I/O and running-realm retirement requirements are distinguished. This repository still has no Posixd executable. Markdown, canonical headings/governance, local links, original source anchors and whitespace checks pass. Original [Posixd CI 17](https://git.erikinkinen.fi/erix/posixd/actions/runs/17) and [18](https://git.erikinkinen.fi/erix/posixd/actions/runs/18) both pass from two complete hashed logs totaling 7,232 bytes without warnings. Rust checks do not apply to this documentation-only repository. Signed [Docs PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4), `7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d`, removes the matching stale passages from the process-services manual. All 45 tests and the full 2,419-page manual pass. All 445,847 word boxes lie within page bounds; the actual changed paragraphs and continuation on pages 222, 226 and 227 are visually reviewed, with zero final warnings. Shared API snapshots are unchanged. Original [Docs CI 977](https://git.erikinkinen.fi/erix/docs/actions/runs/977) and [978](https://git.erikinkinen.fi/erix/docs/actions/runs/978) are running. These documentation corrections add no runtime behavior; the previously retained Integration `78557a6c672ecf426dfe894a01cc4aeec73b5e3c` appliance retains its original source selection and passing guarded-preparation evidence. Native upstream Rust/LLVM rebuilding and both complete EriX builds remain required. Original Docs CI 977/978 passes for signed 7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d. All four complete hashed logs total 772,186 bytes. Both runs pass 45 tests and the full 2,419-page manual; successive TeX passes retain 36/1/0 warning observations, with zero final-pass warnings. No unchanged workflow rerun or cancellation supplies this result. Native child lifetime checkpoint — 19 September 2026: Signed Docs 9ca5a5e811766a4506c0626cd58f8e228d0bacf8 updates the technical manual's native admission, preflight, stopping, partial cleanup and safe return/idle contracts. All 45 tests and the complete 2,425-page manual pass with zero final warnings. All 447,213 word boxes are in bounds and all three changed contract pages are visually reviewed. Shared API reference source is unchanged. Original [Docs CI 981](https://git.erikinkinen.fi/erix/docs/actions/runs/981) and [982](https://git.erikinkinen.fi/erix/docs/actions/runs/982) pass from four complete hashed logs, 773,510 bytes. Both pass 45 tests and the complete 2,425-page manual. TeX pass warning counts are 36/1/0, with zero final-pass warnings; neither workflow was rerun or cancelled. The matching original signed Kernel and both maintained native VMs pass without warnings; [Kernel issue 19](https://git.erikinkinen.fi/erix/kernel/issues/19) retains exact runtime evidence and open executing-child, no-successor, further failure and consumer gates. Signed Integration 581226ab5435dc66c6f93157606b6d4d83475b15 selects the coherent original Kernel/lib-capabi/lib-ipc graph and updated manual. All four current strict 320/321-test configurations, four native builds, fmt, strict host/native Clippy and private rustdoc pass without warnings. Source and updated native-policy checks pass; the full 169-helper evidence remains bound to unchanged orchestration bytes. The final post-VM changes select only the newer Docs revision and update roadmap status; native source catalog, scenario, runtime and orchestration bytes are unchanged. Original [Integration CI 1683](https://git.erikinkinen.fi/erix/integration/actions/runs/1683) and [1684](https://git.erikinkinen.fi/erix/integration/actions/runs/1684) are queued. Executing-child and terminal-reply checkpoint — 19 September 2026: signed [Kernel dd9eace5](https://git.erikinkinen.fi/erix/kernel/commit/dd9eace5b52edc02e624f142e92b85032f59bace) validates actual CPL3 nested-child execution and current-child ancestor termination. Synchronous control dispatch now ends its request borrow before effects and checks original caller identity, generation and terminal state before any response write. It keeps terminal completion in Kernel-owned result registers with zero reply length; ordinary native return switches away. A surviving caller retains its normal encoded response. Two focused actual-object regressions cover terminal request preservation and the surviving-caller reply. The dispatcher is split from the tracing/policy file. A supervisor binds and starts a child; that child binds a staged grandchild and kills its supervisor through its own explicit Process SEND route. Read-only witnesses require terminal caller storage to survive dispatch, then exact child/grandchild absence before the independent observer reads child-before-supervisor events. Both terminal payloads have immediate UD2 sentinels. An unrelated Created process retains its exact record, empty capability inventory and mappings until explicitly aborted. All four additional lifetimes and twenty-two mapped pages must be disposed for `ERIX_KERNEL:CHILD_EXECUTION_OK`. Four strict Kernel configurations pass 720/744 library tests and both standalone controls; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Signed [Integration c14c5a61](https://git.erikinkinen.fi/erix/integration/commit/c14c5a617196a9b135b479601ca47a21371a9482) requires the additional marker while preserving every earlier marker and the original 60-second limit. Both actual native scenarios pass, with 1,870/1,587 complete serial bytes, empty QEMU stderr and no build warnings. Packaged Kernel bytes equal retained original artifacts after normal stripping; all fifteen original source signatures verify. Lifetime serial SHA256 is `1b2f983239efca55c8bc0f6f08ee91cfdcd37d4d1f6951bbd740e4d9b45d1a2f`. Four current Integration 320/321-test configurations, native builds, strict Clippy, formatting, private rustdoc and updated policy checks pass. Earlier 169-helper evidence is hash-verified against unchanged orchestration; it was not rerun for these scenario/catalog changes. Signed [Docs b4b01d87](https://git.erikinkinen.fi/erix/docs/commit/b4b01d870757d9b626dd2cfa7c6424332087bf62) documents the executing-child observations and remaining limits. All 45 tests, the full 2,425-page manual, 447,382 word bounds and visual review of the changed pages pass, with zero final warnings. The API reference source is unchanged. This extends native executing-child evidence; it does not establish no-successor native idle/wake behavior, provider completion, Procd adoption or a complete service lifecycle. The original install-grant constructor still gives `GRANT | MINT` while binding needs only `GRANT`; move-only transfer preserves exact rights. Both diagnostic grants are consumed, but rights minimization remains an explicit audit follow-up. Full source/effect/frame proof, the Pagerd gate, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted. Related implementation tracking: [Kernel feature](https://git.erikinkinen.fi/erix/kernel/issues/19), [Kernel WIP PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration WIP PR](https://git.erikinkinen.fi/erix/integration/pulls/12), [manual WIP PR](https://git.erikinkinen.fi/erix/docs/pulls/4), and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Original [Kernel CI 614](https://git.erikinkinen.fi/erix/kernel/actions/runs/614) and [615](https://git.erikinkinen.fi/erix/kernel/actions/runs/615) pass from four complete hashed logs, 753,462 bytes, without warnings. Original [Docs CI 983](https://git.erikinkinen.fi/erix/docs/actions/runs/983) and [984](https://git.erikinkinen.fi/erix/docs/actions/runs/984) pass from four complete hashed logs, 773,542 bytes. Both pass all 45 tests and the complete 2,425-page final manual; reference-resolution warning counts are 36/1/0, with zero final warnings. Original Integration CI 1685/1686 remains queued at its second observation. Older original [Integration CI 1678](https://git.erikinkinen.fi/erix/integration/actions/runs/1678) passes all 489 catalog scenarios and both native Kernel diagnostics, then fails the development COM1 editor probe after its physical counterpart passes. Rust and Markdown pass. All three complete logs total 13,384,697 bytes with no warnings; the outer input status does not establish cause. The canonical bug report is [issue 67](https://git.erikinkinen.fi/erix/integration/issues/67), with bug/ci/phase-6 metadata. Earlier editor and filesystem failures remain separate. No original workflow was cancelled or rerun. Native cleanup without a userspace successor — 19 September 2026: signed [Kernel 2cf5b34c](https://git.erikinkinen.fi/erix/kernel/commit/2cf5b34c77451e4ddfa50f6bab9ae65cc5c47068) adds a seventh actual CPL3 caller to the maintained lifetime diagnostic. After every earlier assertion, the observer binds/starts the final child and yields. The child kills that supervisor through its own explicit Process SEND route. Immediate faulting sentinels forbid either terminal payload from resuming. Ordinary native return closes CPU accounting, detaches current attribution, progresses reclamation and finds no runnable successor. A diagnostic-only read-only witness then requires empty CPU accounting, only terminal retained records, no bound cleanup duties or event reservations, exact child identity/CSpace/mapping absence and both unconsumed child-before-supervisor events. All six final child pages retire; three original unbound terminal records remain for prior assertions. The witness neither performs cleanup nor selects a process nor installs an interrupt. `ERIX_KERNEL:CHILD_IDLE_CLEANUP_OK` precedes completion before HLT, so actual hardware halt/wakeup remains a separate gate. Signed [Integration 4d6f4fe8](https://git.erikinkinen.fi/erix/integration/commit/4d6f4fe8b383603b225b04a7771a11f32886e0a9) requires the additional marker while preserving all earlier assertions and both 60-second scenario limits. Both actual native VMs pass: 1,905/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256: `4a7cba61f75f4eeac47896d165b8dbcd217e4c75e2a81c8ae0f29957facb929c`. Packaged Kernel images match retained build artifacts after normal stripping; all fifteen original component signatures verify. Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Post-VM changes only select updated Docs in full catalogs and update roadmap status. Signed [Docs 69466a64](https://git.erikinkinen.fi/erix/docs/commit/69466a64c032d575569adeff14f17a445e5a9c03) documents the pre-halt boundary and consolidates stale status paragraphs. All 45 tests, the complete 2,425-page manual, 447,534 word bounds and visual review of pages 562–564 pass with zero final warnings. API reference source remains unchanged. The static audit passes 3,140 authored code files below 1,000 lines, 74 manifests, 259 full Git selections, 171 direct missing_docs gates and 92 conventional crate roots; semantic authority and complete private-rustdoc closure remain open. Original [Kernel CI 616](https://git.erikinkinen.fi/erix/kernel/actions/runs/616) and [617](https://git.erikinkinen.fi/erix/kernel/actions/runs/617) pass from four complete hashed logs, 753,458 bytes, with no warnings. Original [Docs CI 985](https://git.erikinkinen.fi/erix/docs/actions/runs/985) and [986](https://git.erikinkinen.fi/erix/docs/actions/runs/986) also pass: four complete hashed logs, 773,510 bytes; both pass 45 tests and the final 2,425-page manual. Reference-resolution warning counts are 36/1/0 with zero final warnings. Original Integration CI 1687/1688 remains queued at its first observation. Older original [Integration CI 1677](https://git.erikinkinen.fi/erix/integration/actions/runs/1677) is now terminal failure: all 489 catalog cases, both native diagnostics, development physical/COM1 editor and release physical editor pass before release COM1 fails. Rust and Markdown pass. Three complete logs total 13,385,246 bytes without warnings; [bug 37](https://git.erikinkinen.fi/erix/integration/issues/37) retains this evidence. Companion 1678's earlier development COM1 failure remains separate in [bug 67](https://git.erikinkinen.fi/erix/integration/issues/67); a common cause is unproven. No original workflow was cancelled or rerun. Further native failure controls, grant-rights minimization, terminal accounting, Procd adoption and complete service lifecycle acceptance remain open. Existing install-grant creation still supplies GRANT | MINT while binding needs GRANT, so minimum authority is not claimed. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted. Related: [Kernel design](https://git.erikinkinen.fi/erix/kernel/issues/19), [Kernel WIP PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration WIP PR](https://git.erikinkinen.fi/erix/integration/pulls/12), [manual WIP PR](https://git.erikinkinen.fi/erix/docs/pulls/4), and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Native terminal-event allocation refusal — 19 September 2026: signed [Kernel ba03995f](https://git.erikinkinen.fi/erix/kernel/commit/ba03995fe0dcfc3d4a1f72eb000e0c7698bbcbaa) extends the actual executing-child sequence with one deliberately refused heap allocation. Separate diagnostic preparation captures the original supervisor, child, staged grandchild and independent process records/capability inventories, then gives an empty event queue one-event capacity. No queued event or existing reservation is discarded. The first terminal-event reservation succeeds; the second arms exactly one null return from the real Kernel allocator. Ordinary collection growth and Process dispatch return RESOURCE_EXHAUSTED before any terminal effect. Read-only witnesses require complete reservation rollback, an empty event queue, unchanged exact records and capabilities, and preserved code/stack/message mapping ranges. Actual CPL3 instructions validate the refusal reply before the next ordinary ancestor kill succeeds with allocation available. Every earlier terminal, descendant-disposal, independent-process and no-successor idle assertion remains required. `ERIX_KERNEL:TERMINAL_EVENT_RESERVATION_OK` requires one consumed allocator refusal and no remaining armed fault. Fault controls are absent from ordinary images; this covers injected allocation failure, not spontaneous heap exhaustion or independent resource-release failure. No witness supplies a syscall result, cleanup effect or scheduler choice. Signed [Integration cf5b2f5f](https://git.erikinkinen.fi/erix/integration/commit/cf5b2f5f1d63631e69df3074d7c1c0b9b4921480) requires the new marker without changing either 60-second limit. Both maintained native VMs pass: 1,948/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is `d485019082175f769ecc2d406d88c6cc84a7df323605027663f5bcc79ca03ad9`. Packaged Kernel bytes match retained original artifacts after normal stripping, and all fifteen original source signatures verify. Post-VM changes only select updated Docs in full catalogs and consolidate roadmap status. Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and updated policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed [Docs 62ba2ffa](https://git.erikinkinen.fi/erix/docs/commit/62ba2ffa30ff9f04840c8d38d188b414e5b24b90) passes 45 tests, the complete 2,425-page manual, all 447,688 word bounds and actual visual review of pages 562–565, with zero final warnings; API reference source remains unchanged. The static audit passes 3,142 authored code files below 1,000 lines, 74 manifests, 259 full Git pins, 171 direct missing_docs gates and 92 conventional roots. Complete semantic authority and private-rustdoc closure remain open. Original [Kernel CI 618](https://git.erikinkinen.fi/erix/kernel/actions/runs/618) and [619](https://git.erikinkinen.fi/erix/kernel/actions/runs/619) pass from four complete hashed logs, 753,434 bytes, with zero warnings. Original [Docs CI 987](https://git.erikinkinen.fi/erix/docs/actions/runs/987) and [988](https://git.erikinkinen.fi/erix/docs/actions/runs/988) pass from four complete hashed logs, 773,506 bytes: both pass 45 tests and the final 2,425-page manual, with reference-resolution warning counts 36/1/0 and zero final warnings. Original Integration CI 1689/1690 is queued. Earlier filesystem, directory, editor and full-frame regressions remain unresolved; original workflows were not cancelled or rerun. The terminal-accounting audit confirms that ordinary Procd terminal handling queries original TCB counters after receiving its event, while automatic bound-child reclamation removes that TCB. Its separate private-mediator branch does not take the same query path; adoption must state which lifetimes require retained metrics and preserve their original generation without fabricated zero/wall-clock values. Independent release-failure coverage, grant-rights minimization, accounting, Procd adoption and full mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted. Related: [Kernel design](https://git.erikinkinen.fi/erix/kernel/issues/19), [Kernel WIP PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration WIP PR](https://git.erikinkinen.fi/erix/integration/pulls/12), [manual WIP PR](https://git.erikinkinen.fi/erix/docs/pulls/4), and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Independent native child release recovery — 19 September 2026: signed [Kernel 82d88b60](https://git.erikinkinen.fi/erix/kernel/commit/82d88b609bd808a840780993da315230dd14399a) extends actual supervisor-exit coverage with two deliberate refusals at the original staged child's final VSpace-release callback, after capability disposal and unlinking. The first error is KernelHeapExhausted, the second CspaceSlotMissing. Read-only observations around two ordinary CPL3 observer yields require the original full record, generation, abort custody and first error retained, an empty original CSpace and retained mapped backing. The independent running child must already be absent from native TCB, CSpace and VSpace directories. The selected child's earlier directory position ensures its failure preceded that independent disposal. The third callback must perform normal VSpace release before all original terminal-event, generation and resource-absence checks pass. `ERIX_KERNEL:CHILD_RELEASE_ISOLATION_OK` requires exactly two refusals and complete eventual disposal. Fault control uses only atomics at the locked callback boundary and exists only in the isolated native diagnostic. No witness performs cleanup, supplies a successful release/syscall result or chooses a scheduler target. This establishes injected callback-refusal coverage, not an observed hardware or allocator malfunction. All earlier nested-child, allocation-refusal and no-successor pre-halt assertions remain required. Signed [Integration 294a467a](https://git.erikinkinen.fi/erix/integration/commit/294a467a3bcd9464ea55c32dbce98acf19d0e400) requires the added marker with both original 60-second limits unchanged. Both maintained native VMs pass: 1,988/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is `606fff037be022c876220d8e8f329c9046ffea5dcdf80831026649aedfbe0b08`. Packaged Kernel bytes match retained original unstripped artifacts after normal stripping, and all fifteen original component signatures verify. Post-VM changes only select the updated manual source in full catalogs and reconcile roadmap status. Four strict Kernel 720/744-test configurations, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test configurations, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed [Docs 2a0ccc1a](https://git.erikinkinen.fi/erix/docs/commit/2a0ccc1a595c3e03aa6c7b7ecbcaca8830082ddd) passes 45 tests, the complete 2,427-page manual, all 447,789 word bounds and actual visual review of pages 562–565 with zero final warnings. API reference source is unchanged. Static audit passes 3,143 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 171 direct missing_docs gates and 92 conventional roots; complete semantic authority/private-rustdoc closure remains open. Original Kernel CI 620/621 and Docs CI 989/990 pass from four complete hashed logs each (753,438/773,910 bytes), with zero final warnings. Current Integration originals are observed after publication. Earlier filesystem, directory, editor and full-frame regressions remain unresolved, with original evidence retained; no workflow is cancelled or retried unchanged. The grant-rights audit confirms actual Procd derivation callers and exact GRANT | MINT receipt checks in Procd and Launchd. Grant authority minimization must coordinate those consumers and distinguish the grant's own rights from its installation ceiling. Original generation-bound terminal accounting, Procd adoption, provider completion, hardware halt/wakeup and complete mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted. Related: [Kernel design](https://git.erikinkinen.fi/erix/kernel/issues/19), [Kernel WIP PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration WIP PR](https://git.erikinkinen.fi/erix/integration/pulls/12), [manual WIP PR](https://git.erikinkinen.fi/erix/docs/pulls/4), and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Manual and dependency validation — 20 September 2026: Docs commit [f4621ce2921b2b9fe3b1d25b4321d6b28289418e](https://git.erikinkinen.fi/erix/docs/commit/f4621ce2921b2b9fe3b1d25b4321d6b28289418e) is signed and pushed. Native selectors 32/33/54 now document exact own rights separately from installation ceilings. The process and launch chapters require GRANT-only final receipts, explicit derivation/source disposal, and original-generation rollback. Both IPC references are regenerated from signed source. All 45 tests and API checks pass; the complete 2,429-page manual has zero final warnings, all 448,913 word bounds pass, and eleven changed pages were visually reviewed. Original Docs CI 991/992 passes with four complete hashed logs, 774,346 bytes, both 45-test runs and final 2,429-page manuals. Intermediate TeX reference warnings resolve before the final pass. Canonical acceptance remains 15/460 leaves, 3.48% weighted. Full service lifecycle, terminal accounting, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain required. Static audit currently passes 3,150 authored code files below 1,000 lines, 74 manifests, 259 explicit Git pins, 172 direct missing_docs gates and 92 conventional Rust roots; full semantic authority and documentation review remain open. Verified managed installer recovery — 21 September 2026: Signed Integration [648fbd5614d3d0b82223b1c3bb7f1b5a0c81ea7d](https://git.erikinkinen.fi/erix/integration/commit/648fbd5614d3d0b82223b1c3bb7f1b5a0c81ea7d) in [WIP PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12) selects signed Procd [ac8a12993bc8cbf134a11e141e459cb63df71123](https://git.erikinkinen.fi/erix/procd/commit/ac8a12993bc8cbf134a11e141e459cb63df71123) and [Docs PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4). Both full original catalogs pass all 72/71 manifest checks against 73/70 clean selected checkouts and all 143 verified signatures. Twenty dependency and 46 immutable-source tests, native scenario policies, Markdown and whitespace pass. The unchanged orchestration crate retains its verified four 320/321-unit configurations, four native builds and strict Clippy/rustdoc evidence. Original Integration CI 1697/1698 is running; no complete regression-suite pass is claimed. [Procd bug 4](https://git.erikinkinen.fi/erix/procd/issues/4) is corrected. The added producer regression reproduces the original 1056/1040 mismatch. Procd derives exactly GRANT into disposed VSpace scratch, drops its delegating source and uniquely relocates the result into the now-empty managed grant slot before handoff. The downstream TTY checks remain strict. Four 291/296-unit configurations, four native builds, formatting, strict Clippy and private rustdoc pass without warnings; relocation refusal and occupied-destination controls retain original-stage cleanup. Original correction CI 294/295 passes from four complete logs, 344,660 bytes. The subsequent roadmap-only checkpoint keeps every runtime source byte unchanged and original CI 296/297 passes from four complete logs, 344,680 bytes, zero warnings. The maintained initial-shell start/exit, realm-admission and normal release-appliance VM scenarios all pass on their first corrected attempts with original guest bounds and watchdogs. The release appliance executes the real product-shell command and produces standalone LOOKUPOK output, separate from its echoed input. All three builds are warning-free and QEMU stderr is empty. Serial logs retain 55,702, 55,738 and 364 bytes respectively. Actual images, full artifact sets, scenario oracles and original signatures are retained. These runs execute Procd 10d972b652297fd656e9a6ac6dbdf197f362c7ce; the selected later Procd commit changes only its roadmap. All 73 executed component signatures and clean source trees verify. The earlier 431/489 and 430/489 full CI failures remain recorded, including the independent ext4 quota timeout; those runs are not rewritten as passes. The native-launch manual now explains the managed return destination, exact rights, unique relocation and partial-failure cleanup. All 45 tests, the complete 2,429-page manual, 448,970 word bounds and changed-page visual review pass without final warnings. Original Docs CI 993/994 passes from four complete logs, 774,342 bytes; each final TeX pass is warning-free after normal earlier reference resolution. Existing generated API references are unchanged. Canonical acceptance remains 15/460 leaves, 3.48% weighted. This is a repaired runtime regression, not completion of a canonical lifecycle leaf. Original-generation terminal accounting, provider/lifetime completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. Exsh's retained release compiler and frame-proof failures stay open. Committed terminal-accounting consumers — 21 September 2026: Procd [66934642c4464fc738152a9e60790914ba27dd1c](https://git.erikinkinen.fi/erix/procd/commit/66934642c4464fc738152a9e60790914ba27dd1c) in [WIP PR 2](https://git.erikinkinen.fi/erix/procd/pulls/2) reserves notification/crash/cleanup storage before effects, obtains exact final CPU evidence, commits local status and cleanup obligations, then acknowledges on every actual event polling path. Lost acknowledgement replies preserve the local result without duplicate counters or notifications. Mediators retain only scalar counters and the original authenticated supervisor identity after disposing all capability columns; supervisor death discharges the pending scalar observation and a replacement cannot inherit it. Four strict 299/305-test configurations, native builds, Clippy and private rustdoc pass. Original CI [298](https://git.erikinkinen.fi/erix/procd/actions/runs/298)/[299](https://git.erikinkinen.fi/erix/procd/actions/runs/299) passes from four complete hashed logs, 347,245 bytes, zero warnings. [Bug 5](https://git.erikinkinen.fi/erix/procd/issues/5) remains open for actual service acceptance. Rootd [64c97b13c450003d9c2b6bd9ed2a627088684b46](https://git.erikinkinen.fi/erix/rootd/commit/64c97b13c450003d9c2b6bd9ed2a627088684b46) in [WIP PR 2](https://git.erikinkinen.fi/erix/rootd/pulls/2) acknowledges bootstrap evidence only after exact native destruction and local endpoint absence; both operations remain unavailable after temporary Process custody transfers to Procd. Four strict 430/429-test configurations, native builds, Clippy and private rustdoc pass. Original 1039/1040 exposed [bug 7](https://git.erikinkinen.fi/erix/rootd/issues/7): a stale source-call inventory and its matching semantic operation declarations. The correction explicitly inventories acknowledgement consumers and preserves the same temporary route and eventual Procd owner. All 64 Python controls, production-boundary, semantic baseline, threat model, phase contract and operation-ownership gates pass. Corrected original CI [1041](https://git.erikinkinen.fi/erix/rootd/actions/runs/1041)/[1042](https://git.erikinkinen.fi/erix/rootd/actions/runs/1042) passes from four complete verified logs, 222,969 bytes, zero warnings. Bug 7 is corrected; failed original runs remain retained without reruns or weaker gates. Docs [e4525848ad4462901c9a6794ef1794cf85ea9e6b](https://git.erikinkinen.fi/erix/docs/commit/e4525848ad4462901c9a6794ef1794cf85ea9e6b) updates the native contract, Procd/Rootd consumer custody and original signed IPC API references. Selector 55 is retired in both the detailed contract and summary; 58/59/60 are cross-checked against the shared registry. All 45 documentation tests and generated-reference checks pass. The complete 2,431-page manual builds without warnings; changed prose, selector and API pages pass visual review. Original documentation CI [995](https://git.erikinkinen.fi/erix/docs/actions/runs/995)/[996](https://git.erikinkinen.fi/erix/docs/actions/runs/996) and corrected-table [997](https://git.erikinkinen.fi/erix/docs/actions/runs/997)/[998](https://git.erikinkinen.fi/erix/docs/actions/runs/998) passes from eight complete logs, 1,549,628 bytes, with zero warnings in the final LaTeX passes. The 37 earlier convergence candidates per manual log are retained and resolved. The separate Integration orchestration library checkpoint [b06dfad00202765491a64552dde29eaca1c24838](https://git.erikinkinen.fi/erix/integration/commit/b06dfad00202765491a64552dde29eaca1c24838) passes four strict 320/321-test host/native configurations. Full service catalogs remain on their prior coherent graph while 35 remaining application/service repositories adopt the original shared revisions. Integration 1697/1698 remains running, and 1699/1700 plus 1701/1702 waits at the latest bounded observations. These are pending full regressions, not successful runtime acceptance. No new canonical acceptance leaf is closed: 15/460 and 3.48% weighted. Ordinary Launchd metric-consumer restart/disposal semantics, coherent service CPU/profiler VMs, complete realm/provider authority and I/O, source/effect/frame proof, Pagerd, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. The static audit finds 3,162 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 173 direct missing-docs gates and 92 conventional crate roots; this does not establish semantic authority or complete private-documentation closure. Explicit frame-tool manual — 21 September 2026: signed [f8a40d45fbbd631660f3adca9152fbb398a4ee6d](https://git.erikinkinen.fi/erix/docs/commit/f8a40d45fbbd631660f3adca9152fbb398a4ee6d) documents selected disassembler/helper custody, minimal child environment, bounded cleanup and preserved failure evidence. All 45 tests, the complete 2,431-page manual and 449,997 rendered word bounds pass. The changed page passes visual review, final warnings are absent and shared API reference sources remain unchanged. Original CI [999](https://git.erikinkinen.fi/erix/docs/actions/runs/999)/[1000](https://git.erikinkinen.fi/erix/docs/actions/runs/1000) is monitored separately. Full native Rust/LLVM/runtime rebuilding and both EriX guest build generations remain required in [Phase 6 completion](https://git.erikinkinen.fi/erix/integration/issues/65). Original frame-manual CI acceptance — 21 September 2026: signed `f8a40d45fbbd631660f3adca9152fbb398a4ee6d` passes both original [999](https://git.erikinkinen.fi/erix/docs/actions/runs/999)/[1000](https://git.erikinkinen.fi/erix/docs/actions/runs/1000), including 45 tests and the complete 2,431-page manual. Four complete hashed logs total 774,750 bytes. Each manual log retains 37 initial warning candidates; LaTeX reference-convergence passes report 35/1/0 warnings, and the final pass has no warnings or layout overflow. These expected early convergence messages remain visible in the original logs. The native external toolchain rebuild and both full guest build requirements remain open. Signed startup source/feature correction — 21 September 2026: Integration [fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa](https://git.erikinkinen.fi/erix/integration/commit/fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa) requires the complete runtime transition in both Rootd and its orchestration policy. The direct Kernel builder records the actual local compiler feature closure, compares original source before and after linking, and includes source identity in its cache key. Contract v2 requires the Kernel revision/tree and actual artifact/metadata binding; old receipts, synthetic wrappers and modified source cannot acquire this declaration. This remains local observed provenance, not publisher authentication or complete compiler closure. All 171 maintained helper commands have successful, warning-free final evidence. Eight new Kernel controls cover original trees, actual cfg closure, changed inputs, hidden/redirected source, custom builds, synthetic wrappers and cache identity. Sixteen fixture readers/writers now close files explicitly; [bug 71](https://git.erikinkinen.fi/erix/integration/issues/71) retains the original 36 resource warnings from 15 exit-zero commands. The previously unlisted filesystem-mirror fixture now participates in CI. Earlier Markdown failures also remain retained. Formatting, source policy and final Markdown pass; identical Rust inputs retain four strict orchestration matrices. The technical manual update [76672dff8ff83](https://git.erikinkinen.fi/erix/docs/commit/76672dff8ff83b04914abe3c8f4b08b13835144f) passes 45 tests, 2,431 pages, 450,096 word bounds and both changed-page visual reviews. Original Docs [1001](https://git.erikinkinen.fi/erix/docs/actions/runs/1001)/[1002](https://git.erikinkinen.fi/erix/docs/actions/runs/1002) passes from four complete logs totaling 774,770 bytes. Each manual log retains its earlier reference-convergence warnings; final LaTeX passes have no warnings or layout overflow. A fresh ordinary package from the signed Integration runner is under construction. Actual corrected image admission and startup capture remain pending under [bug 69](https://git.erikinkinen.fi/erix/integration/issues/69); no threshold or 120/15/10 capture limit changes. Original Integration [1705](https://git.erikinkinen.fi/erix/integration/actions/runs/1705)/[1706](https://git.erikinkinen.fi/erix/integration/actions/runs/1706) is monitored separately. Native external Rust/LLVM/runtime rebuilding and both complete EriX guest build generations remain mandatory. Coherent scalar-consumer validation — 21 September 2026: signed [Integration 07c883525ee5](https://git.erikinkinen.fi/erix/integration/commit/07c883525ee5e23378008232760d045f74f60d32) selects [Procd 59ee30a88534](https://git.erikinkinen.fi/erix/procd/commit/59ee30a885346db4db8c8791a23c15694f2a90a8) in both complete catalogs. All 171 maintained helper commands pass without warnings; unchanged orchestration inputs retain four strict matrices. Five actual service VMs pass: shell CPU accounting, exec successor replacement, two-CPU read-only inspection, out-of-session denial and guarded realm preparation. Each preserves 106 hashed evidence files, clean QEMU stderr, warning-free image builds and all original markers under the unchanged 120-second guest limit. The build-plus-scenario times are 119.746880, 38.325332, 35.346729, 35.773237 and 55.339698 seconds respectively; these are not guest performance measurements. Inspection reports increasing job CPU counters with control disabled; numeric CPU utilization remains unproven. Procd's four strict 308/314-test configurations and original CI 302/303 pass. The [manual update](https://git.erikinkinen.fi/erix/docs/commit/2d05169e6974a495eab80b62edf0f23d1ad667da) passes 45 tests, all 2,431 pages, 450,185 word bounds and changed-page visual review. Original Docs CI 1003/1004 passes from four complete logs (774,710 bytes); retained reference-convergence warnings resolve to zero on final passes. All 3,166 authored code files remain below 1,000 lines. Original Integration 1701/1702 remains running; 1703–1710 remains queued. Logd 240 remains failed with terminal logs unavailable through HTTP 500; no cause is inferred. No original job was restarted or cancelled. Remaining lifecycle control/event ownership, complete native fault/cleanup acceptance and the measured startup timing failures remain open. No whole acceptance leaf closes: 15/460, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain inside EriX and using it in the required full EriX guest-build generations remain mandatory and unproven. Executed-code profiling checkpoint — 22 September 2026: signed [Integration 4fa27f942bc2](https://git.erikinkinen.fi/erix/integration/commit/4fa27f942bc2c6511eedceb5b20b8212f2bc94b0), tracked in [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12), adds bounded host TCG execution counters, explicit fresh-output ownership and exact packaged-ELF code candidates without adding guest authority. All 172 maintained helper commands pass without warnings. The profiler passes five Rust tests in both profiles, strict Clippy, private rustdoc, eleven Python controls and five actual selected-emulator controls. Unchanged orchestration inputs retain their preceding four strict matrices. The [operator guide](https://git.erikinkinen.fi/erix/integration/src/commit/4fa27f942bc2c6511eedceb5b20b8212f2bc94b0/docs/tcg-profiling.md) distinguishes complete counters from VM acceptance. One original-image diagnostic retains 92,896 translated blocks, 1,994,216 code bytes and zero missed execution counts. Its top 100 code groups cover 85.65% of the translated instruction upper bound; 33.30% has Kernel mapping-batch candidates and 7.70% has VSpace permission-switch candidates among the selected ELF inputs. Unknown and ambiguous work remains visible. These are code matches, not process ownership or elapsed-time attribution. Both the instrumented attempt and its same-emulator uninstrumented control fail waiting for the final native-command marker under unchanged 120/15/10 collection bounds. Neither proves startup acceptance, whole-transcript instrumentation overhead or a speedup. [Profiler acceptance](https://git.erikinkinen.fi/erix/integration/issues/3) and [startup performance](https://git.erikinkinen.fi/erix/integration/issues/72) remain open. The next optimization must preserve complete validation, live backing checks, page permissions, invalidation ordering and cleanup on errors. The signed [manual update](https://git.erikinkinen.fi/erix/docs/commit/1ade28490f4577bbf618f4cec49debf1f747aa6d), tracked in [Docs PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4), passes 45 tests, all 2,431 pages, 450,367 word bounds and both changed-page visual reviews with zero final warnings or overflow. Original Docs CI 1005/1006 passes from four complete logs (774,674 bytes); initial reference-convergence warnings resolve on the final passes. Integration 1711/1712 is queued, while original 1701/1702 still runs. Existing queued jobs remain untouched. All 3,174 authored code files remain below 1,000 lines. No whole acceptance leaf closes: 15/460, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain inside EriX and completing the required full guest-build generations remain mandatory and unproven.

erikinkinen added the

ci

docs

refactor

phase-6

enhancement

labels 2026-09-12 07:56:22 +02:00

erikinkinen referenced this issue from erix/integration 2026-09-12 07:56:30 +02:00

[FEATURE] Demonstrate two complete generations of EriX built inside EriX #9

erikinkinen referenced this issue from erix/integration 2026-09-12 07:56:30 +02:00

[FEATURE] Close final security, documentation, CI and self-hosting acceptance #10

erikinkinen referenced this issue from erix/blockd 2026-09-12 07:57:25 +02:00

[FEATURE] Audit authority, code quality and documentation in blockd #1

erikinkinen referenced this issue from erix/boot-tool 2026-09-12 07:57:25 +02:00

[FEATURE] Audit authority, code quality and documentation in boot-tool #1

erikinkinen referenced this issue from erix/bootloader 2026-09-12 07:57:25 +02:00

[FEATURE] Audit authority, code quality and documentation in bootloader #2

erikinkinen referenced this issue from erix/coreutils 2026-09-12 07:57:26 +02:00

[FEATURE] Audit authority, code quality and documentation in coreutils #1

erikinkinen referenced this issue from erix/crashd 2026-09-12 07:57:26 +02:00

[FEATURE] Audit authority, code quality and documentation in crashd #1

erikinkinen referenced this issue from erix/deviced 2026-09-12 07:57:27 +02:00

[FEATURE] Audit authority, code quality and documentation in deviced #1

erikinkinen referenced this issue 2026-09-12 07:57:28 +02:00

[FEATURE] Audit authority, code quality and documentation in docs #2

erikinkinen referenced this issue from erix/drv-acpi 2026-09-12 07:57:28 +02:00

[FEATURE] Audit authority, code quality and documentation in drv-acpi #1

erikinkinen referenced this issue from erix/drv-i8042 2026-09-12 07:57:29 +02:00

[FEATURE] Audit authority, code quality and documentation in drv-i8042 #1

erikinkinen referenced this issue from erix/drv-ps2-keyboard 2026-09-12 07:57:30 +02:00

[FEATURE] Audit authority, code quality and documentation in drv-ps2-keyboard #1

erikinkinen referenced this issue from erix/drv-ps2-mouse 2026-09-12 07:57:30 +02:00

[FEATURE] Audit authority, code quality and documentation in drv-ps2-mouse #1

erikinkinen referenced this issue from erix/drv-rtc-cmos 2026-09-12 07:57:31 +02:00

[FEATURE] Audit authority, code quality and documentation in drv-rtc-cmos #1

erikinkinen referenced this issue from erix/drv-serial 2026-09-12 07:57:31 +02:00

[FEATURE] Audit authority, code quality and documentation in drv-serial #1

erikinkinen referenced this issue from erix/drv-virtio-block 2026-09-12 07:57:33 +02:00

[FEATURE] Audit authority, code quality and documentation in drv-virtio-block #1

erikinkinen referenced this issue from erix/dynlinkd 2026-09-12 07:57:34 +02:00

[FEATURE] Audit authority, code quality and documentation in dynlinkd #2

erikinkinen referenced this issue from erix/e2fsd 2026-09-12 07:57:34 +02:00

[FEATURE] Audit authority, code quality and documentation in e2fsd #1

erikinkinen referenced this issue from erix/exsh 2026-09-12 07:57:35 +02:00

[FEATURE] Audit authority, code quality and documentation in exsh #2

erikinkinen referenced this issue from erix/extop 2026-09-12 07:57:35 +02:00

[FEATURE] Audit authority, code quality and documentation in extop #1

erikinkinen referenced this issue from erix/fatd 2026-09-12 07:57:35 +02:00

[FEATURE] Audit authority, code quality and documentation in fatd #1

erikinkinen referenced this issue from erix/fbcond 2026-09-12 07:57:36 +02:00

[FEATURE] Audit authority, code quality and documentation in fbcond #1

erikinkinen referenced this issue from erix/hotplugd 2026-09-12 07:57:36 +02:00

[FEATURE] Audit authority, code quality and documentation in hotplugd #1

erikinkinen referenced this issue from erix/inputd 2026-09-12 07:57:36 +02:00

[FEATURE] Audit authority, code quality and documentation in inputd #1

erikinkinen referenced this issue from erix/integration 2026-09-12 07:57:37 +02:00

[FEATURE] Audit authority, code quality and documentation in integration #11

erikinkinen referenced this issue from erix/irqd 2026-09-12 07:57:37 +02:00

[FEATURE] Audit authority, code quality and documentation in irqd #1

erikinkinen referenced this issue from erix/kernel 2026-09-12 07:57:38 +02:00

[FEATURE] Audit authority, code quality and documentation in kernel #2

erikinkinen referenced this issue from erix/keyd 2026-09-12 07:57:39 +02:00

[FEATURE] Audit authority, code quality and documentation in keyd #1

erikinkinen referenced this issue from erix/launchd 2026-09-12 07:57:39 +02:00

[FEATURE] Audit authority, code quality and documentation in launchd #1

erikinkinen referenced this issue from erix/lib-aes 2026-09-12 07:57:40 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-aes #1

erikinkinen referenced this issue from erix/lib-block 2026-09-12 07:57:40 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-block #1

erikinkinen referenced this issue from erix/lib-bootimg 2026-09-12 07:57:40 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-bootimg #1

erikinkinen referenced this issue from erix/lib-bootstrap 2026-09-12 07:57:41 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-bootstrap #1

erikinkinen referenced this issue from erix/lib-capabi 2026-09-12 07:57:41 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-capabi #1

erikinkinen referenced this issue from erix/lib-cli 2026-09-12 07:57:41 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-cli #1

erikinkinen referenced this issue from erix/lib-console 2026-09-12 07:57:42 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-console #1

erikinkinen referenced this issue from erix/lib-constant-time 2026-09-12 07:57:43 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-constant-time #1

erikinkinen referenced this issue from erix/lib-crc 2026-09-12 07:57:43 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-crc #1

erikinkinen referenced this issue from erix/lib-deflate 2026-09-12 07:57:45 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-deflate #1

erikinkinen referenced this issue from erix/lib-device 2026-09-12 07:57:45 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-device #1

erikinkinen referenced this issue from erix/lib-driver 2026-09-12 07:57:45 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-driver #1

erikinkinen referenced this issue from erix/lib-dynlink 2026-09-12 07:57:46 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-dynlink #1

erikinkinen referenced this issue from erix/lib-ed25519 2026-09-12 07:57:46 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-ed25519 #1

erikinkinen referenced this issue from erix/lib-elf 2026-09-12 07:57:47 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-elf #1

erikinkinen referenced this issue from erix/lib-fs-crypto 2026-09-12 07:57:48 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-fs-crypto #1

erikinkinen referenced this issue from erix/lib-fs-name 2026-09-12 07:57:48 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-fs-name #1

erikinkinen referenced this issue from erix/lib-handoff 2026-09-12 07:57:49 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-handoff #1

erikinkinen referenced this issue from erix/lib-input 2026-09-12 07:57:49 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-input #1

erikinkinen referenced this issue from erix/lib-interrupt 2026-09-12 07:57:49 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-interrupt #1

erikinkinen referenced this issue from erix/lib-ipc 2026-09-12 07:57:50 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-ipc #1

erikinkinen referenced this issue from erix/lib-log 2026-09-12 07:57:51 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-log #1

erikinkinen referenced this issue from erix/lib-partition 2026-09-12 07:57:53 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-partition #1

erikinkinen referenced this issue from erix/lib-service 2026-09-12 07:57:53 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-service #1

erikinkinen referenced this issue from erix/lib-sha2 2026-09-12 07:57:54 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-sha2 #1

erikinkinen referenced this issue from erix/lib-stdio 2026-09-12 07:57:54 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-stdio #1

erikinkinen referenced this issue from erix/lib-time 2026-09-12 07:57:54 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-time #1

erikinkinen referenced this issue from erix/lib-tty 2026-09-12 07:57:55 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-tty #1

erikinkinen referenced this issue from erix/lib-vfs 2026-09-12 07:57:55 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-vfs #1

erikinkinen referenced this issue from erix/loaderd 2026-09-12 07:57:56 +02:00

[FEATURE] Audit authority, code quality and documentation in loaderd #1

erikinkinen referenced this issue from erix/logd 2026-09-12 07:57:56 +02:00

[FEATURE] Audit authority, code quality and documentation in logd #1

erikinkinen referenced this issue from erix/memd 2026-09-12 07:57:57 +02:00

[FEATURE] Audit authority, code quality and documentation in memd #1

erikinkinen referenced this issue from erix/meta 2026-09-12 07:57:57 +02:00

[FEATURE] Audit authority, code quality and documentation in meta #3

erikinkinen referenced this issue from erix/named 2026-09-12 07:57:57 +02:00

[FEATURE] Audit authority, code quality and documentation in named #1

erikinkinen referenced this issue from erix/pagerd 2026-09-12 07:57:58 +02:00

[FEATURE] Audit authority, code quality and documentation in pagerd #1

erikinkinen referenced this issue from erix/powerboxd 2026-09-12 07:57:58 +02:00

[FEATURE] Audit authority, code quality and documentation in powerboxd #1

erikinkinen referenced this issue from erix/probed 2026-09-12 07:57:59 +02:00

[FEATURE] Audit authority, code quality and documentation in probed #1

erikinkinen referenced this issue from erix/procd 2026-09-12 07:57:59 +02:00

[FEATURE] Audit authority, code quality and documentation in procd #1

erikinkinen referenced this issue from erix/ramfsd 2026-09-12 07:57:59 +02:00

[FEATURE] Audit authority, code quality and documentation in ramfsd #1

erikinkinen referenced this issue from erix/rootd 2026-09-12 07:58:00 +02:00

[FEATURE] Audit authority, code quality and documentation in rootd #1

erikinkinen referenced this issue from erix/seriald 2026-09-12 07:58:00 +02:00

[FEATURE] Audit authority, code quality and documentation in seriald #1

erikinkinen referenced this issue from erix/sha2-tool 2026-09-12 07:58:00 +02:00

[FEATURE] Audit authority, code quality and documentation in sha2-tool #1

erikinkinen referenced this issue from erix/timed 2026-09-12 07:58:01 +02:00

[FEATURE] Audit authority, code quality and documentation in timed #1

erikinkinen referenced this issue from erix/ttyd 2026-09-12 07:58:01 +02:00

[FEATURE] Audit authority, code quality and documentation in ttyd #2

erikinkinen referenced this issue from erix/vfsd 2026-09-12 07:58:02 +02:00

[FEATURE] Audit authority, code quality and documentation in vfsd #1

erikinkinen referenced this issue from erix/vspaced 2026-09-12 07:58:04 +02:00

[FEATURE] Audit authority, code quality and documentation in vspaced #1

erikinkinen referenced this issue from erix/lib-posixabi 2026-09-12 07:58:04 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-posixabi #2

erikinkinen referenced this issue from erix/lib-cstd 2026-09-12 07:58:05 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-cstd #2

erikinkinen referenced this issue from erix/posixd 2026-09-12 07:58:05 +02:00

[FEATURE] Audit authority, code quality and documentation in posixd #4

erikinkinen changed title from [FEATURE] [P03] Enforce complete inline documentation and warning-free documentation builds to [FEATURE] Enforce complete inline documentation and warning-free documentation builds 2026-09-12 08:02:01 +02:00

erikinkinen referenced this issue 2026-09-12 08:05:32 +02:00

[BUG] Manual build succeeds with final-pass typesetting warnings #3

erikinkinen referenced this issue 2026-09-12 08:28:22 +02:00

WIP: Document native authority and verify workspace and command evidence #4

erikinkinen referenced this issue from erix/integration 2026-09-12 09:18:44 +02:00

WIP: Coordinate native authority, shell workspace and source transport #12

erikinkinen referenced this issue 2026-09-12 12:32:55 +02:00

[BUG] Generated API references misrepresent declaration shapes and field visibility #5

erikinkinen referenced this issue 2026-09-12 16:58:53 +02:00

[BUG] API trait summaries omit the implementing type and conversion direction #6

erikinkinen referenced this issue 2026-09-14 09:55:22 +02:00

[BUG] Private-item API exports lose named-struct opacity #7

erikinkinen referenced this issue 2026-09-15 22:15:32 +02:00

[BUG] Inline manual options replace double hyphens with an en dash #8

erikinkinen referenced this issue 2026-09-17 13:54:12 +02:00

[BUG] Detailed syscall reference marks owned invocation selectors as unassigned #9

erikinkinen referenced this issue 2026-09-17 14:37:48 +02:00

[BUG] Syscall reference describes an obsolete return instruction and frame layout #10

erikinkinen referenced this issue from erix/integration 2026-09-19 11:36:52 +02:00

[FEATURE] Track Phase 6 POSIX compatibility and full EriX self-hosting #65

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

feature/posix-compat

feature/native-cli

feature/phase-4-audit

feature/dynlink

feature/program-loader

feature/e2fs-fat

feature/block-devices

feature/vfs

feature/centralized-process-authority

ci-feature-posix-compat

nightly

ci-feature-native-cli

ci-feature-phase-4-audit

ci-feature-dynlink

ci-feature-program-loader

ci-feature-e2fs-fat

Labels

Clear labels

  

bug

Something is not working

  

ci

  

docs

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

performance

Measured performance profiling, bottleneck analysis, and regression budgets.

  

phase-6

Phase 6: POSIX compatibility, full EriX self-hosting, and its required audits and validation.

  

question

More information is needed

  

refactor

Code cleanup, removal of obsolete paths, and structural improvements preserving behavior.

  

security

  

wontfix

This won't be fixed

No labels

bug

ci

docs

duplicate

enhancement

help wanted

invalid

performance

phase-6

question

refactor

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

erix/docs#1

No description provided.