[BUG] Exsh stack proof assumes incidental optimized symbol names #4

New issue

Open

opened 2026-09-12 13:31:29 +02:00 by erikinkinen · 0 comments

erikinkinen commented 2026-09-12 13:31:29 +02:00

Owner

Copy link

Summary

The existing emitted-frame gate rejects both optimized Exsh runtime builds on
Rust 1.97.1 because its required evaluator function is absent and its literal
closure spelling differs from the actual disassembly. This is a build proof
inventory problem under the selected toolchain. No stack overflow was demonstrated.
The unchanged gate remains failed; the declared direct-chain proof is unresolved.

Reproduction

Use the original source/dependency graph recorded below, a fresh Cargo home
prepared by the original Integration helper, and explicit x86_64-unknown-none
output. Compile once for each of --features exsh-runtime and --all-features:

CARGO_PROFILE_RELEASE_LTO=false CARGO_PROFILE_RELEASE_STRIP=false \
RUSTFLAGS='-D warnings -C link-arg=-Tlinker.ld' \
cargo rustc --release --bin exsh --target x86_64-unknown-none \
  --features exsh-runtime -- \
  -C opt-level=3 -C codegen-units=1 -C relocation-model=pic \
  -C no-redzone=y -C force-unwind-tables=no
python3 -B scripts/check-descriptor-cleanup-frames.py \
  "$CARGO_TARGET_DIR/x86_64-unknown-none/release/exsh"

Both build invocations exited 0 without warnings. Each original checker invocation
exited 1 on its respective preserved binary. These are two distinct configurations,
not repeated attempts to obtain a passing result. The runtime source, Cargo
manifests, linker script and checker equal the original selected commit; unrelated
concurrent edits added only test rustdoc, CI helper/gates and documentation.
No VM was used, and an untouched full-checkout rebuild was not repeated because
the complete production source/object equality is already recorded.

Expected and actual behavior

Expected: bound the actual optimized entry/cleanup paths with unchanged 8 KiB
normal, 33 KiB fallback and 56 KiB direct early-drop limits. Unknown or missing
proof must fail, but codegen changes should be handled through actual artifact
identity and path evidence rather than a mandatory incidental closure spelling.

Actual: both runs report missing emitted cleanup proof: ::evaluate_simple_command_resolved_inner. The source function exists without an
out-of-line guarantee, but its symbol is absent. Run-shell closures are emitted
as {closure#5} / {closure#19}; the gate requires literal {{closure}}.
The source parser tests all pass because their handcrafted positive text supplies
exactly the old expected names. No oracle was changed and no limit was adjusted.

Read-only diagnostics of the actual runtime/all-feature ELFs show entry frames
6800/6784 bytes, the main emitted run-shell closure 5136 bytes, and the fallback
32816 bytes. These individual measurements fit the existing limits. They do not
establish the missing direct-chain proof or a whole-program stack bound.

Environment and identity

• Exsh original runtime/checker commit:
  5249114a634ead34a32ccd44cba613021df1647f.
• Integration helper: e2b1cf5995bcf6334839cda9a013e90fa97787d5.
• Original dependencies: IPC/shim b452a46803982c57e474adcc318ce40bd281d621,
  capability ABI a68ce860e2bd90fa95feb9ada882ef547c7873df, filesystem names
  644e8e156d7eaa406b5b5b882980c3a435756425, standard I/O
  e4e094f8cc16662cf5200af6e47b3fe5a0b92a52, SHA-2
  fdc4c902ed9f8c2c95c8c167eac2efa345f3b4f9. Cargo retained their original
  Git source IDs; no path/registry replacement was used.
• Host compiler: Rust 1.97.1, commit
  8bab26f4f68e0e26f0bb7960be334d5b520ea452, LLVM 22.1.6;
  x86_64-unknown-linux-gnu host, x86_64-unknown-none target.
• Runtime ELF SHA-256:
  1e63b3930c3fb440e29461d96e19d7b63fb0977961d76ce3491ae739771ceecd.
• All-feature ELF SHA-256:
  b6b7676ac457308e8df150d12ecea60120e5325cf3a2d0dc2f90ea700ad22f75.
• rustc SHA-256: d3a664c970a9fd8361b64194861bebc1ae37b9054e5ee3400dc1c9e691797eea.
• Cargo SHA-256: 828980723df339d62434390e9fb8ef8831036583343ae2316b7ab5646b5c1953.
• objdump SHA-256: b947cc7fae5e951ca6009bbc72889a35d2af7a832416de0489c607c7598472b2.
• Checker SHA-256: 7039a8cc2c050beae145f275a55fd60612c5a049daa0b05cb95871ea0ef5c0fc.
• No image, firmware, guest session or runtime authority grant was involved.
  Last working artifact/toolchain for this exact gate was not established here.

Evidence and prior checks

Diagnostic guest evidence — 15 September 2026: The original serial editor/history, inherited-stream time and runtime-error probes pass on a newly built native image using Exsh b12e172e7b266842a8659104894f6821166165fb and the complete companion helper correction published as Integration db80a2c1dfc669bd724762d476f5f5c0da005ff6. All original timeout and exact output assertions are preserved; the image remains unchanged. This uses a separately recorded original-component catalog and explicitly identified helper delta, not an admitted product catalog. Full frame evidence remains INCOMPLETE, including workspace evidence, ordinary-source membership and direct-versus-nested bounds. The three probes do not establish either complete guest build generation. Build compatibility evidence: erix/integration#52.

Earlier receipts below retain their original revision and runtime scope.

The signed WIP checkpoint is 62a4f30ff5011ae6221925db9d9b1b58ec0ad71f on feature/posix-compat. It aligns the existing original dependency commits and extends the checker with exact accumulator identity padding and one guarded relative jump-table form. All 73 warning-denied checker tests pass, including literal guard bypass, every-arm stack depth, mapping and relocation controls. The original grammar's positive table control fails as expected. Original failures and true statuses are retained.

The previously validated Rust, Cargo and linker inputs match this checkpoint byte for byte: 957 tests pass in each default/all-feature and production development/release configuration, with formatting, strict host/native Clippy, eight native builds and private rustdoc. These are retained build receipts; changing the host checker required no rebuild of those inputs. Final Markdown and whitespace checks pass without warnings. Runtime Rust and the stack thresholds remain unchanged.

Fresh checker replays of the same retained runtime/all-feature images still return INCOMPLETE, with 690/603 unresolved observations and no intake error. Neither graph reaches a table admitted by the new narrow grammar. A separate outlined source-boundary experiment builds successfully; targeted inspection of its evaluator body resolves one ten-entry table, reducing that body's unresolved local sites from three to two. The entry-reachable graph remains incomplete. That runtime outlining is not included in this checkpoint and has no VM acceptance.

A separate optimized debug build identifies the evaluator declaration as inlined, but its emitted code differs from the retained non-debug image. Its metadata therefore does not certify that earlier image. Ordinary-source membership, non-returning and indirect calls, other branches and the direct-versus-nested contract remain open. No complete frame gate, product adoption, stack safety or full EriX-in-EriX build is claimed. CI 223/224 is now terminal: both pass 957 Rust and 73 checker tests, then fail the complete frame gate. All four complete logs total 310,250 bytes without warnings. Their runtime/all artifact graphs retain 661/585 unresolved observations, distinct from the local retained images. The failure remains tracked here; no full frame or product acceptance is claimed.

Current workspace implementation — 15 September 2026: Signed Exsh b12e172e7b266842a8659104894f6821166165fb owns ordinary and emergency transport in distinct version-22 authenticated workspace slices. Descriptor startup rejects short or dirty cleanup storage before metadata effects; transactions exclusively reborrow the complete slice and erase it after emergency cleanup. The global UnsafeCell accessor and automatic 32 KiB cleanup array are removed. Larger valid caller slices retain their complete extent. Existing provider retirement, metadata rollback and uncertain-cleanup behavior remain enforced.

All 961 Rust tests pass in each default/all-feature/production development/release configuration, with formatting, strict host/native Clippy, private rustdoc and eight native builds without warnings. Four added tests cover workspace disjointness, malformed backing, complete caller extent and consecutive cleanup reuse; existing cleanup controls now also check buffer canaries and erasure. All 73 warning-denied checker tests pass.

Both actual optimized native fallbacks measure 48 local bytes, compared with the retained prior 32,816-byte frames. Their full checker reports remain INCOMPLETE: runtime/all graphs contain 691/604 unresolved observations, and the old 32 KiB initial stack-reservation requirement still needs a workspace-specific evidence contract. Ordinary-source membership and direct-versus-nested early-drop bounds remain open. The 8/33/56 KiB upper limits and 64 KiB stack are unchanged; this measurement is not an all-path stack-safety claim.

Matching producer 38424571b76b36c1e631d99fd2c859fb32311eea exports/consumes 96 capacity words plus 72 target layout words, reserves both transport arrays first and rejects old/mixed layouts. Packaging both actual optimized shell configurations under canonical dev/release policies derives 4,300,800 workspace bytes, with unchanged executable bytes and a separate 64 KiB stack. All 162 Integration helper commands and its strict 320/321-test Rust matrix pass, including four native builds. These are private artifact and host checks, not guest execution. The product catalog still selects the earlier shell; coordinated catalog adoption and matching runtime VMs remain required.

Documentation 79cdd4c3694e800091b55c737fca04c7bdd3d071 describes the ownership and compatibility contract. Its 45 tests and canonical checks pass. The full manual renders 2,375 pages without final warnings; all 433,713 word boxes are in bounds and changed page 2280 passes visual review. API snapshots are unchanged. Exsh CI 225/226 fails only the incomplete frame gate after 961 Rust and 73 checker tests; all four logs total 311,820 bytes with zero warnings. CI runtime/all graph observations are 662/587 and both fallbacks measure 48 bytes; these artifacts remain distinct from local images. Docs CI 883/884 passes with all four complete logs (762,212 bytes); reference passes converge with 35/1/0 warnings and zero final warnings. These component cohorts are fully classified. Integration CI 1637/1638 remains queued at its first observation. No full build within EriX or whole-codebase authority closure is claimed.

Paired workspace mapping checkpoint — 15 September 2026:

Signed Exsh f17670c7f0c3b6da4458deac534ba6210921550d adds paired pristine/packaged ELF workspace evidence under report schema 2. The checker captures both regular-file snapshots under its existing budgets and retains them when pair admission fails. It verifies the version-22 target descriptor, complete transport spans, exact arena extent, unique zero-fill arena/stack ownership and the unchanged separate 64 KiB stack. All mapped file bytes and permissions must match except tunable capacity words and the workspace owner's extent. Stale/mixed layouts, changed code/data, overlapping claims and relocation writes into descriptor/arena/stack bytes fail before the disassembler runs.

The obsolete automatic-stack-scratch requirement and redundant prologue-reservation scan are removed. Local frame ceilings remain 8/33/56 KiB in their existing domains; a local stack frame cannot supply workspace evidence. Mapping success assumes the native loader preserves the declared mappings and does not prove source borrowing, erasure, complete typed carving, ordinary-source membership or direct-versus-nested bounds. Unproved indirect targets remain unresolved.

All 90 warning-denied checker tests pass, including 17 new independent mapping/CLI controls. Formatting, Markdown and canonical checks pass. Four exact retained runtime/all-feature artifacts with canonical dev/release packaging establish the mapping domain: workspace 4,300,800 bytes, two complete 32 KiB buffers, separate 64 KiB stack. Both local fallback frames are complete at 48 bytes. Full reports remain INCOMPLETE with 691/604 unresolved observations and the original source/direct-path gaps; no full frame pass is claimed.

Rust, Cargo and linker source bytes are unchanged from workspace checkpoint b12e172e7b266842a8659104894f6821166165fb. Its 961-test strict matrices and eight native builds retain that source scope; the paired replays retain their original ELF hashes. The earlier three diagnostic guest probes also retain their original image/source identities and are not new runtime execution at this checker head. Exsh CI 227/228 fails the remaining full frame gate after all 961 Rust and 90 checker tests pass. All four logs are complete (311,713 bytes) with zero warnings. Both fallbacks are complete at 48 bytes; CI runtime/all graphs retain 662/587 unresolved observations. CI supplies no packaged counterpart, so its workspace mapping domain remains incomplete; the four local paired-artifact results retain their separate scope. The cohort is fully classified without accepting any missing proof. Matching Docs 5d77dc2b82bf5439e58234d901e30f4565aaa81a is signed and pushed: all 45 tests, the complete warning-free 2,375-page render, 433,924 in-bounds word boxes, literal-option extraction and nine-page visual review pass. Docs CI 887/888 passes with all four complete classified logs (762,236 bytes). Both manual jobs pass 45 tests and converge with 35/1/0 reference warnings, leaving zero final warnings; both Markdown jobs pass. Its issue erix/docs#8 records the 24 repaired inline-option/delimiter cases and is closed after complete CI classification. Full frame proof, coherent product admission, realm work and both complete guest build generations remain open.

CI packaged-input checkpoint — 15 September 2026:

Signed Exsh 453641cd19eaa7c85a8f6693363f8660c792ed73 supplies packaged counterparts in CI. Its helper is pinned to original Integration db80a2c1dfc669bd724762d476f5f5c0da005ff6. The actual producer packages separate copies of each optimized runtime/all-feature ELF using both canonical dev/release policies. Packaging has a 60-second deadline, refuses existing outputs and stops the job on failure. Each pristine/packaged pair gets its own complete checker invocation; any unresolved required domain keeps a nonzero status.

The exact changed workflow block was replayed against both retained native binaries. All four produced ELF hashes equal the previously independently validated production bytes, workspace mapping is complete, and pristine inputs remain unchanged. The full reports remain incomplete with 691/604 unresolved observations and unproved source/direct-path domains. YAML and shell syntax, 90 checker tests, formatting, Markdown, canonical and pinned dependency checks pass without warnings. Rust, linker and checker source bytes are unchanged, so their earlier strict validation retains its original source scope. Current Exsh CI 229/230 is fully classified: both runs pass 961 Rust and 90 checker tests and all four workspace-mapping domains, but fail the remaining full frame gate. All four complete logs total 314,746 bytes with zero warnings. Runtime/all graph observations remain 662/587 and fallback local frames remain 48 bytes. This resolves the missing packaged-input domain; source membership, non-returning/indirect targets and direct-versus-nested path proof remain open. No full frame proof, product admission or guest build is claimed.

Protected relative-target checkpoint — 16 September 2026: signed Exsh a26ecffb39b70abbf15fb300c5c8c703c6900c37 admits exact six-byte RIP-relative calls and tails only after complete relative-relocation, file ownership, protected RELRO page and target-entry checks. It shares the relocation inventory with guarded tables and rejects overlapping or executable-byte writes. Independent controls cover malformed ranges, writable neighbours, different stored words, negative displacements, self-entry loops and tail restoration. All 102 checker tests and all six strict Rust feature/profile configurations pass (961 tests each), together with six native builds, host/native Clippy, formatting and private rustdoc. Runtime Rust, linker scripts and Cargo selections are unchanged.

Replaying both unique original pristine/packaged artifact pairs preserves their hashes and all original stack/resource budgets. Runtime/all-feature reports retain 641/591 new call/tail proofs and reach 266/240 functions; unresolved observations fall from 691/604 to 271/232. Workspace mapping passes. Both full reports remain incomplete: unknown indirect control flow, non-returning semantics and source/direct-versus-nested boundaries remain separate obligations. These are partial static admission results, not a complete frame or authority proof.

Signed Docs 83b2d4a2dfc473bb8a99719f86fa1c3c33effa53 explains the proof contract and its limits. All 45 documentation tests and canonical checks pass; the 2,377-page manual has 434,680 in-bounds word boxes, zero final warnings and a visually reviewed changed page. API snapshots are unchanged. The preceding Docs permission-observer checkpoint passes CI 893/894 with four complete logs (762,616 bytes) and zero final warnings. Exsh CI 231/232 is fully classified: all 961 Rust tests, 102 checker tests and all four workspace domains pass, with four complete logs totaling 314,760 bytes and zero warnings. Only the complete frame gate fails. Its separately selected CI artifacts report 273/230 unresolved observations; these do not replace the retained local artifact identities/counts. The preceding Docs CI result is recorded below. All 2,997 inventoried authored code files remain below 1,000 lines; semantic authority/documentation closure, product catalog adoption, runnable realms and both complete guest builds remain open.

Grounded return-flow checkpoint — 16 September 2026: signed Exsh 4bb35938b52c0e6b20c65ccb861af79871272cbe derives no-ordinary-return facts from complete checked loop/trap bodies and earlier proved tail targets. Only these grounded exact callees suppress ordinary fallthrough. Calls retain target, depth and relocation evidence, and each fact preserves its original body evidence and earlier dependencies. Final reachability removes stale fallthrough descendants while keeping terminal callee obligations. Unknown calls, unsupported instructions, malformed boundaries and unproved tail cycles cannot establish facts.

All 114 checker tests pass, including twelve new literal controls and a 1,200-function chain requiring at most two body visits per function. All six strict Rust feature/profile configurations pass 961 tests each, with six native builds, host/native Clippy, formatting and private rustdoc. Runtime Rust, linker scripts and Cargo selections are unchanged. The physical inventory now covers 2,999 authored code files, all below 1,000 lines.

The same retained original artifact pairs yield thirteen grounded facts each. Runtime/all-feature unresolved observations fall from 271/232 to 181/150; every function-end boundary error disappears under the stated ordinary-call model. The work queue performs 347/313 body evaluations for 266/240 discovered functions and retains 263/237 in the final reachable graph. This is an analysis-work count, not a claimed runtime speedup. Remaining observations are 140/111 unknown calls, 40/38 unknown branches and one unsupported instruction per mode. Both workspace mappings pass; whole frame and source domains remain incomplete with unchanged budgets. A separate proof audit verifies earlier dependencies and retained terminal callees.

Signed Docs 97ce65dcb8cef7232b50d53af90ff8673d623e05 documents the refinement. All 45 tests and canonical checks pass, and the 2,377-page manual has 434,800 in-bounds word boxes, zero final warnings and a visually reviewed changed page. Exported API snapshots are unchanged. Exsh CI 233/234 is fully classified: 961 Rust tests, all 114 checker tests and four workspace mappings pass, while the full frame gate remains incomplete. All four logs total 314,776 bytes with zero warnings. Those separately selected CI artifacts retain 183/145 unresolved observations, distinct from the retained local pair counts. Matching Docs CI 897/898 passes with all four complete logs across the two terminal observations (762,600 bytes), 45 tests per manual job and zero final warnings. The preceding Docs target-contract checkpoint passes CI 895/896 with four complete logs totaling 762,636 bytes and zero final warnings. Full indirect/source proof, coherent catalog adoption, whole-codebase authority/documentation closure, runnable realms and both full guest-build generations remain open.

Exact direction-flag checkpoint — 16 September 2026: signed Exsh 05eeb7bc0b1bf1e6fa781b26ee83a8896263a439 admits operand-free single-byte FC/FD as stack-neutral direction-flag updates, preserving frame-pointer facts. Mismatched bytes, operands and prefixes refuse. Three original controls bring the full checker group to 117 passing tests, including a growing-stack negative case. Formatting, canonical documentation checks and the 2,999-file physical audit pass. The precise instruction contract is documented in Exsh; the existing manual's ordinary stack model remains applicable.

Replaying the same exact artifact pairs now admits each memmove frame at eight local bytes and removes its one unsupported-instruction observation. Runtime/all-feature reports retain 180/149 unresolved observations, all unknown indirect calls or branches, with thirteen grounded no-return facts each. Original input hashes and budgets are unchanged; workspace mappings pass and full frame/source domains remain incomplete.

Every Rust, Cargo, linker, build and workflow input is byte-identical to the preceding checkpoint's six strict 961-test configurations and six native builds. Those results are retained at their original identity; this checker-only follow-up claims no new Rust or guest execution. Matching Exsh CI 235/236 is fully classified: all 961 Rust tests, 117 checker tests and four workspace domains pass, while the full frame gate remains incomplete. All four complete logs total 314,740 bytes with zero warnings. Those CI artifact identities retain 182/144 unresolved observations, distinct from the local retained pairs. No whole authority, realm or full guest-build acceptance is added.

Measured parser checkpoint — 16 September 2026: signed Exsh ffbe846cbcd0ab6ea12a476c2c84339f635ee50a compiles the three unchanged disassembly regexes once per input. It retains the exact grammar, instruction bytes, annotations and every disassembly deadline check. Three paired runtime host profiles against signed 05eeb7bc0b1bf1e6fa781b26ee83a8896263a439 reduce regex-cache lookups from 1,142,474 to 570,949; median profiled time falls from 5.088 to 4.214 seconds and complete wall time from 5.311 to 4.425 seconds. These measurements include profiler overhead and subprocess waiting. The 837,947 full matches, 189,680 splits and 375,664 disassembly deadline checks remain identical; they do not measure guest performance.

All eight runtime/all-feature observations preserve their original nonzero checker exits and identical complete decision reports. Only checker-source identity and private snapshot path metadata differ. Workspace mappings pass and the same 180/149 unknown indirect observations keep full frame/source admission incomplete. All 117 checker tests, formatting, canonical documentation checks and the 2,999-file physical ceiling audit pass. Every Rust, Cargo, linker, build and workflow input remains byte-identical to the existing six strict 961-test configurations and six native builds; no new Rust or guest execution is claimed. The focused contract documents the measurement and limits; the unchanged manual's stack model remains applicable. Matching Exsh CI 237/238 is fully classified: all 961 Rust tests, 117 checker tests, Markdown and four workspace domains pass; both runs fail the still-incomplete full frame gate. All four complete logs total 314,754 bytes with zero warnings. These CI artifacts retain 182/144 unresolved observations, the same counts as preceding CI and distinct from the local retained artifact pairs. Whole authority, realms and both full guest-build generations remain open.

Register-target proof design — 16 September 2026: the current runtime/all-feature artifacts retain 180/149 unresolved indirect observations. Six/seven immediately adjacent protected-slot loads are only candidates: textual proximity does not prove every incoming path. Extend the existing finite stack CFG with register facts for all sixteen baseline x86-64 general registers. Entry values are unknown. Exact byte-checked 64-bit RIP-relative loads can acquire a target only from the existing complete immutable relocation/RELRO proof; exact 64-bit register copies carry that evidence. Immediate integers, names, mutable data and stored pointer words supply no target.

Join facts only when every incoming path has the same target value, retaining all contributing load sites and protected-slot proofs. Explicit and implicit writes invalidate each affected full-register family, including partial aliases. Unknown effects, system calls and ordinary calls clear facts; no callee-saved convention, returned function pointer or stack spill becomes an unproved preservation premise. Existing probe/dispatch macros conservatively discard register facts until their complete effects are represented. Unsupported instruction/control-flow cases remain incomplete under the existing trusted-decoder and ordinary-call model.

Revisit weakened joins and replace stale call/branch evidence; an earlier strong path cannot survive as the only proof after another predecessor loses its value. Exact register-call/tail bytes must agree with the selected register. Preserve call depth, tail restoration, grounded return dependencies, unknown branches and the full source/domain gates. The finite worklist and provenance sets use the caller's original deadlines with no invented iteration or origin-count ceiling.

Add independently authored positive, alias/implicit-clobber, bypass, disagreeing/equal-join, loop, stale-edge, call/syscall and source-receipt controls. Replay both original artifact pairs, measure analysis work, update the focused/manual contracts, and validate/sign/push before any adoption. This is original code derived from the Intel instruction reference; it imports no implementation code. Complete guest-image identity, source membership, authority and both full guest-build generations remain separate required work.

Protected register checkpoint — 16 September 2026: signed Exsh da8b75c9063c52de2149f2a6c7ed170f720a6c62 propagates exact full-width protected-slot loads and register copies through the reached CFG. Equal-target joins retain every load origin; unknown or conflicting predecessors, alias/implicit writes, calls/syscalls and unknown effects discard facts. Weakening a join replaces stale edge proof. Complete admitted probe/dispatch effects preserve only unwritten register values. Supported REX forms permit unused bits with byte/text agreement. There is no caller-input, saved-register, spill-word or immediate-address target premise.

All 138 checker tests, formatting, canonical document checks and an independent original-byte/load/relocation and earlier no-return dependency audit pass. Retained runtime/all artifact pairs gain 16/18 register edges; the all-feature graph reaches one additional function. Remaining unresolved sites are 164/132, with thirteen grounded no-return facts per mode. Both workspace mappings pass. Full frame/source gates remain incomplete with actual exit 1 and unchanged 60/15-second and 64 MiB budgets. Every Rust/Cargo/linker/build/workflow byte is unchanged from six strict 961-test configurations and six native builds; no new Rust build or guest execution is claimed.

Profiling identified unnecessary effect parsing when all registers were unknown. Skipping those identity transfers and compiling fixed effect patterns once preserves every report decision, reducing runtime effect-parser calls from 34,901 to 1,334 and all-feature calls from 33,398 to 1,348. One before/after observation per identical pair measures 5.089 to 4.385 seconds and 4.997 to 4.358 seconds respectively, including observer overhead. These are bounded host work measurements, not a statistical timing guarantee or guest speedup.

Signed Docs 4f770bee4c6a4784b4fcce6ae606d1fc10b328da documents register provenance and limits. All 45 tests and the 2,377-page manual render pass, with 435,231 word boxes inside page bounds, no final warnings and visual review of the changed page. All 3,001 authored code files remain below 1,000 physical lines. Matching Exsh/Docs CI is pending. Complete source domains, authority closure, executable realms and both complete guest-build generations remain open.

Register checkpoint CI — 16 September 2026: Exsh da8b75c9063c52de2149f2a6c7ed170f720a6c62 is terminal in CI 239/240. Both runs pass 961 Rust tests, all 138 checker tests, strict warning-denied Rust checks and Markdown. All four paired workspace domains pass in each run. The required full-frame gate remains incomplete, with 168/131 unresolved observations on these CI artifacts, so both runs correctly fail overall. Four complete logs total 314,840 bytes and contain no compiler/lint warnings. These CI artifact observations remain distinct from the retained local pairs.

Docs 4f770bee4c6a4784b4fcce6ae606d1fc10b328da passes CI 901/902. Four complete logs total 762,604 bytes; each manual job passes 45 tests and renders 2,377 pages. Initial reference-resolution warnings clear during the normal three LaTeX passes; final renders have zero warnings. The full source/frame proof, coherent catalog adoption, authority closure and both complete confined guest-build generations remain open.

Bounded table checkpoint — 16 September 2026: signed Exsh efb542a3418badef951d01dff24eec88b8490aee tracks distinct unsigned bounds, original relative bases, signed table offsets and local targets. Exact constants, self-zeroing and zero extension establish numeric premises. Every selected immutable table byte, matching base addition and candidate instruction boundary must be proved before retaining any successor or branch evidence. Numeric/table values cannot authorize function calls. Joins preserve all alternatives and original premises; unknown predecessors and alias/implicit/call clobbers discard facts.

All 157 checker tests pass, including complete 256/65,536-entry domains, nonzero and signed read windows, extended register fields, joins, bypasses, loops, width controls and immutable/boundary refusals. Original-byte function/table/base/index/addition audits, formatting, Markdown and canonical checks pass. Final original runtime/all pairs admit two table branches each and retain 164/132 unresolved obligations: two entry branches resolve, while two newly exposed guard-interior conflicts remain. Both workspace mappings and thirteen grounded no-return facts per mode are retained. Full frame/source status remains incomplete with actual exit 1 and unchanged budgets. Initial partial-set exploration is diagnostic negative evidence, not accepted coverage.

Profiling identified repeated compilation of fixed stack patterns. Compiling sixteen unchanged patterns once and sharing the existing padding pattern preserves all report decisions and matching operations. One baseline/optimized observation per original pair reduces runtime/all regex-cache lookups from 651,254/627,530 to 135,274/131,391. Profiled times are 5.994 to 5.445 and 5.756 to 5.179 seconds, including overhead and waiting. These measurements establish reduced host work, not a timing guarantee or guest speedup. The final source has a clarified module docstring and separately reconciled complete replay decisions.

Every Rust/Cargo/linker/build/workflow byte retains the existing strict matrix; no new Rust build or guest execution is claimed. Signed Docs 242b78c8f35aeaef879f819c670574a4c1d95c3f explains complete read windows and target-set admission. All 45 tests and the 2,379-page render pass, with 435,421 word boxes inside page bounds, zero final warnings and visual review of both changed pages. All 3,003 authored code files remain below 1,000 physical lines. Matching CI is pending. Explicit flag/guard refinement, full source/frame proof, coherent catalog adoption, authority closure and both complete confined guest-build generations remain required.

Bounded table CI — 16 September 2026: signed Exsh efb542a3418badef951d01dff24eec88b8490aee is terminal in CI 241/242. Both runs pass 961 Rust tests, all 157 checker tests, strict warning-denied Rust checks and Markdown. Each run completes all four paired workspace domains. The required full-frame gate remains incomplete with 168/131 unresolved observations on the CI artifacts, so both runs fail overall. Four complete logs total 315,234 bytes, with no compiler/lint warnings. No incomplete proof is treated as acceptance.

Signed Docs 242b78c8f35aeaef879f819c670574a4c1d95c3f passes CI 903/904. All four logs are complete (763,044 bytes); each manual job passes 45 tests and renders 2,379 pages. Initial reference warnings clear in the normal LaTeX passes; final renders have zero warnings. An expanded local source/config inventory additionally checks 685 files, bringing the combined physical ceiling audit to 3,688 files, all below 1,000 lines. Flag/guard refinement, source/frame closure, coherent catalog adoption, complete authority review and both full confined guest-build generations remain required.

Ordinary comparison checkpoint — 16 September 2026: signed Exsh 4ed392bcc53cb46d0296cecbdd930c8be5cd7c28 replaces the fixed-register table macro with byte-checked CMP/Jcc facts, live comparison lifetime, unsigned/equality edge refinement and sound producer-width widening. A 32-bit comparison never zeroes upper bits. Every complete immutable target set remains mandatory, and numeric/table values cannot authorize function calls. Unknown predecessors, relevant flag/subject writes and unmodeled effects discard conditions. The obsolete dispatch report field is removed.

All 176 checker tests pass, including an independent exhaustive interval oracle, high-register dispatch, sign extension, bypasses, conflicting/unknown joins, stale proofs, complete table arms and large arithmetic loops. Independent original-byte audits check 354/321 comparison edges, eleven table branches per mode, protected function loads and thirteen earlier grounded no-return facts per mode. Original runtime/all pairs reach 271/246 functions and retain 158/126 unresolved observations, down from 164/132. Workspace domains pass; full frame/source status remains incomplete with actual exit 1 and unchanged budgets.

The audit also reproduces and fixes terminal-call discovery loss. A prior successor diagnostic no longer suppresses recomputation of a revisited call. Three independent controls retain grounded no-return, returning and unknown-target behavior. Original byte/range inspection corrects earlier descriptions of two guard-interior conflicts: these were fallthrough exactly at declared function ends. Padding remains outside those functions; callee names never supply no-return proof. Matching CI remains required before closing the defect.

Profiling identified repeated decoder-effect work. Sharing immutable effects only within one function-body analysis reduces runtime/all effect decoding from 72,668/69,784 to 34,499/32,576 and operand parsing from 75,637/72,547 to 37,468/35,339. Complete paired decisions remain identical. Final single paired profiled observations are 6.633 to 6.425 and 6.416 to 6.269 seconds, including overhead and waiting. The final baseline overlaps host test execution, and earlier pairs show timing variability; these diagnostic durations do not isolate a speedup. This establishes reduced host work, not a timing guarantee or guest speedup.

Every Rust/Cargo/linker/build/workflow byte retains the existing strict six-configuration 961-test matrix and six native builds. Formatting, Markdown and canonical checks pass. Signed Docs d8fbc3a1f3696e02954b81f23511cee513ddfa8c passes all 45 tests and complete 2,379-page rendering: 435,637 in-bounds word boxes, zero final warnings and two visually reviewed pages. The physical audit covers 3,005 authored code files below 1,000 lines. Matching CI is pending. Remaining indirect calls/branches, full source/direct-versus-nested proof, coherent catalog adoption, complete realm authority and both full confined guest-build generations remain required.

Comparison checkpoint CI — 16 September 2026: Exsh CI 243 and 244 are terminal. All four complete logs total 314,904 bytes with no compiler/lint warnings. Strict Rust checks, 961 Rust tests, 176 checker tests, Markdown and all four workspace domains per run pass. The required full-frame gate remains failed with 163/126 unresolved observations on these CI artifacts; their identities are distinct from the original static replay pairs. No full frame or guest-build acceptance is claimed.

Docs CI 905 and 906 pass with all four complete logs (763,056 bytes), 45 tests and 2,379-page manuals. Both final renders have zero warnings after ordinary reference convergence. The terminal-call discovery controls pass in both Exsh runs, resolving the scoped defect in Exsh #6 while the complete emitted-proof defect stays open. The current physical audit covers 3,690 authored source/config files below 1,000 lines; semantic authority and complete private documentation closure remain required. Original unfinished Integration jobs continue under their existing handles.

Arithmetic evidence checkpoint — 16 September 2026: signed Exsh 0cdaa8869545308c528f9cf5a2dc165cb286c6ef and Docs 07181c34b1a20150afe3380977ca5ba70c909b84 are pushed on feature/posix-compat. Immediate ADD/SUB now retains exact modular result pieces and derives unsigned/equality edges from carry/borrow and zero. Defined INC/DEC writes establish widths without preserving a stale combined flag condition. Full 64-bit comparisons may use the architectural numeric domain while keeping protected typed identities separate; narrow comparisons still require independent upper-bit proof. Known encoding/text contradictions remain explicit flow errors.

All 191 checker tests pass, including independent exhaustive concrete arithmetic and modular-interval oracles, wraparound and authority-negative controls. Original runtime/all artifact pairs admit fifteen table branches each and reach 271/246 functions, with 156/124 unresolved observations. Both workspace mappings pass; actual full-frame exits remain 1 and full source/direct domains remain incomplete. Independent original-byte audits check arithmetic/conditional/table premises, 16/18 protected register edges and thirteen grounded no-return facts per pair.

Profiling identified repeated stack-neutral grammar evaluation. A cache scoped to one function reduces those evaluations from 95,643 to 43,169 for runtime and 92,608 to 41,053 for all features, with complete paired report decisions equal. Cached values include refusals and contain no path facts. Timing observations include observer overhead and do not isolate a statistical speedup or guest performance.

Formatting, Markdown, whitespace and all 45 Docs tests pass. The 2,379-page manual has 435,808 in-bounds word boxes, zero final warnings and visual review of the changed pages. The physical inventory covers 3,691 authored source/configuration files, all below 1,000 lines. Semantic authority and complete private rustdoc closure remain open. Rust/Cargo/linker/build/workflow bytes are unchanged from the retained strict matrix and classified CI 243/244; new Exsh CI 245/246 independently reruns those checks. Docs CI 907/908 also runs. Matching CI is pending, and no full confined guest build or coherent product-catalog adoption is claimed.

Test-import correction and CI classification — 16 September 2026: original Exsh CI 245/246 failed before the frame gate because the arithmetic test could not import its checker module. They attempted 177 tests: 176 passed and one module import failed. The preceding 961 Rust tests and strict build stages passed; all four complete logs total 309,708 bytes with zero compiler/lint warnings. The earlier local 191-test pass used an explicitly supplied PYTHONPATH and did not prove equivalence to the clean workflow. This regression is retained in Exsh #7.

Signed correction 12331e26f3bb7a25c0146c8b314eef46dd451099 loads the repository's literal fixture setup before implementation imports in both affected modules. A new regression imports every checker test module in a fresh isolated interpreter; it reproduces both failures before correction and passes afterward. The exact clean workflow command now passes all 192 tests without PYTHONPATH. Formatting, Markdown and whitespace pass. Checker/runtime/Cargo/workflow bytes are unchanged, so the prior original-artifact and profiler evidence retains its exact scope. New CI 247/248 runs against the corrected source; issue #7 remains open pending matching CI.

Docs CI 907/908 now passes with four complete logs totaling 763,024 bytes, all 45 tests and 2,379-page manuals. Both final renders have zero warnings after ordinary reference convergence. Full frame/source proof, coherent catalog adoption and complete confined guest builds remain outstanding.

Corrected arithmetic checkpoint CI — 16 September 2026: Exsh CI 247 and 248 at signed 12331e26f3bb7a25c0146c8b314eef46dd451099 both pass all 192 checker tests, including the ten isolated module imports, and all 961 Rust tests. The preceding strict formatting/Clippy/documentation/build stages and Markdown pass. All four complete logs total 314,944 bytes with zero compiler/lint warning candidates. This confirms the scoped import correction in Exsh #7.

Both runs reach and fail the required full-frame gate. All four workspace mappings per run pass, while the emitted CI pairs retain unresolved counts [161, 161, 124, 124]; these artifacts are distinct from the original static pairs' 156/124 observations. Full source/direct domains remain incomplete, and Exsh #4 remains open. The original import-failed runs 245/246 stay classified and are not relabeled as passing.

Docs CI 907/908 passes all 45 tests and 2,379-page manuals with zero final warnings; four complete logs total 763,024 bytes. Signed trees are clean, canonical issue/PR metadata remains applied, and the 3,691-file physical inventory remains below 1,000 lines per authored source/configuration file. Semantic authority and private documentation closure, coherent catalog adoption, runnable realms and both full confined guest build generations remain outstanding. Original unfinished Integration runs continue under their existing handles and budgets.

Grounded call-preservation checkpoint — 16 September 2026: signed Exsh 641ac2fc7c3fba3ab351f2863df7e35117b2732a and Docs 7a7c3ff0095de8f008c9b534fd993554df37f976 are pushed on feature/posix-compat. Complete original bodies and earlier callee facts now prove never-written register families. Only existing typed values survive proved calls; live conditions clear. The separate stack-derived rbp fact follows the same rule. This corrects the reproduced stale-frame defect, which stays open pending matching CI. ABI conventions, spill restoration and current kernel behavior supply no preservation mask.

All 213 clean-environment checker tests pass, including 21 new controls, eleven isolated module imports and a 1,200-function grounded dependency chain. All six strict Rust feature/profile configurations pass 961 tests each, with host/native Clippy, private rustdoc and six native builds; no warnings. Original runtime/all artifact pairs retain 65/72 protected register edges and 70/77 load origins, reducing unresolved observations from 156/124 to 107/70. Both workspace mappings pass; full source/frame/direct gates retain actual exit 1. Independent audits bind 7,795/7,503 used-contract instructions and complete earlier-proof closure to the original captured bytes.

Profiling identified unnecessary empty-state scans and rejected-body suffix work. Removing them preserves every paired report decision and reduces total profiled Python calls from 32,160,478 to 26,673,252 and from 30,880,221 to 25,402,446. Single paired timings include observer overhead; they do not establish statistical or guest performance. Original timer, byte and stack budgets remain unchanged.

All 45 Docs tests, formatting, Markdown and canonical checks pass. The 2,379-page manual has 436,058 in-bounds word boxes, zero final warnings and visual review of both changed pages. The physical audit covers 3,693 source/configuration files, all below 1,000 lines. Semantic authority/private-documentation closure, product adoption, complete source/frame admission, runnable realms and both full in-EriX build generations remain open. Automatic CI for both exact signed heads is being followed; local passes are not reported as CI acceptance.

Matching preservation CI — 16 September 2026: Exsh 249 and 250 are fully classified at 641ac2fc7c3fba3ab351f2863df7e35117b2732a. Both pass all 213 checker tests, including eleven isolated imports and the stale-frame controls, all 961 Rust tests and preceding strict host/native Clippy, rustdoc and native build stages. Markdown and all four workspace mappings per run pass. The remaining full frame gate fails as required; original CI artifact observations are 111, 111, 74, 74], [111, 111, 74, 74. All four complete logs total 314,995 bytes without warnings. The independently retained local pairs remain 107/70, with their own original identities.

Docs 909 and 910 pass at 7a7c3ff0095de8f008c9b534fd993554df37f976. All four complete logs total 763,088 bytes; both manual jobs pass 45 tests and render 2,379 pages with zero final warnings after ordinary reference convergence. The corrected frame-pointer issue is closed on this matching evidence; the full source/frame issue remains open. No full confined build, runnable realm or coherent product-catalog adoption is established.

Native artifact intake checkpoint — 16 September 2026: signed Exsh d67dcb963f1aa265b13dd0609a5f8488784b5822 admits the retained original/stripped native pair with exact mapped bytes, allocated ownership and complete program contracts. Only absent packaged ordinary symbols are optional. The exact five-byte native entry jump preserves the shell's 8192-byte frame limit. Checked symbolic relocations contribute write footprints, never local targets or library-discovery authority. Code/dynamic metadata mutation, unknown streams, malformed names/links, resolver symbols and invalid relative prefixes refuse intake.

All 231 checker controls (18 new) and 12 isolated test modules pass in a clean environment. All six strict Rust configurations pass 961 tests each, host/native Clippy, private rustdoc and six native builds without warnings; formatting and canonical checks pass. Both retained standalone pairs have exactly unchanged proof decisions (107/70 unresolved). The original native pair inventories 1,345 functions, reaches 220, proves workspace mapping and retains 299 unresolved observations, including 102 symbolic-target refusals. The shell entry has 6,864 partially accounted bytes; its incomplete paths do not establish an upper bound. Independent original-byte audit checks all 1,086,955 executable bytes, exactly 154 changed capacity bytes and 627 relative call-load proofs. Full source/frame/direct gates remain incomplete, actual checker exit 1.

Native original SHA-256 879579542895f2f3fbda38972ebaaaf55e05857ffc456342117624a9bc8d24a9 and packaged SHA-256 183a1a2f1f4192ffd0b9c123ca50d33af6c584940ca51b156198f8822b718feb retain their original Exsh runtime selection b12e172e7b266842a8659104894f6821166165fb. The native producer already retains the original; no duplicate artifact or producer mutation was required. Profiling all three original pairs takes 16.60/16.47/17.02 seconds including observer work under unchanged 60/15-second and 64 MiB budgets. These are individual static observations, not guest performance claims.

Signed Docs 12c6d0a91e5e9c5f170d6d0aa7f050dd60e883ef documents the contract. All 45 tests and a complete 2,381-page manual pass, with 436,247 in-bounds word boxes, zero final warnings and changed-page visual review. The physical inventory covers 3,695 source/configuration files, all below 1,000 lines; semantic authority/private documentation closure remains open. New Exsh CI 251/252 and Docs CI 911/912 are running at their exact signed heads. Complete source membership, native dependency closure, coherent catalog adoption, runnable realms and both full guest builds remain required.

Matching native intake CI — 16 September 2026: Exsh 251 and 252 are fully classified at d67dcb963f1aa265b13dd0609a5f8488784b5822. Both pass 231 checker tests, twelve isolated imports, 961 Rust tests and the strict preceding Clippy/rustdoc/native build stages. All four workspace mappings per run and Markdown pass. The required full frame gate remains incomplete; the CI artifact counts are 111/111/74/74 unresolved observations in each run. Four complete logs total 315,371 bytes, with zero warnings. Retained local standalone and native artifacts keep their own separate identities and 107/70/299 counts.

Docs 911 and 912 pass at 12c6d0a91e5e9c5f170d6d0aa7f050dd60e883ef. Four complete logs total 763,452 bytes; each manual job passes 45 tests and renders 2,381 pages, with ordinary reference convergence followed by zero final warnings. No full source/frame proof, native dependency closure, runnable confined realm or full EriX-in-EriX build is established.

A separate original-source relocation calculation defect is now reproduced and tracked with the canonical bug template in lib-dynlink #2. Its two host failures do not imply a guest regression. All 107 symbol-only relocations in the seven retained native artifacts have zero addends; the supported nonzero-field case still requires correction before broader native binding admission.

Closed native dependency intake — 16 September 2026: signed Exsh 9827896d1cb5ad834589045ee03390aec650df84 adds an explicit JSON input contract for one runtime manifest and the exact original/packaged executable and library pairs. Complete file hashes, manifest records, package/feature identities and both needed-name inventories must agree. Only explicit host selectors authorize reads; runtime names and source paths remain data. Inputs share one aggregate byte budget and the original deadline. Library stripping permits only independently checked administrative header selectors, never executable-byte changes. All other mapped bytes, allocated owners, program fields and paired artifact metadata remain identical. Producer source revisions remain unverified claims.

The retained native closure binds seven objects, 2,373 ordinary functions and 1,608 relocation records. Intake does not yet resolve symbolic providers or compose cross-library frames. All 259 checker controls (28 new) and 16 isolated modules pass; six strict Rust configurations pass 961 tests each, host/native Clippy, private rustdoc and six native builds with zero warnings. Formatting, Markdown and canonical checks pass. All three retained artifact replays preserve their previous frame decisions: 107/70/299 unresolved observations for standalone runtime/all/native. Full frame/source gates retain actual exit 1. Profiling records 0.181 seconds in native dependency intake and 23.17/25.51/24.59 seconds for the three complete profiled runs, within unchanged 60/15-second and 64 MiB budgets. Concurrent Rust validation changes host contention, so elapsed differences from earlier runs are not a speedup or regression claim.

Signed Docs 88537b23e1def210eeff40b7ef90fce92fe2009e documents this contract. All 45 tests and the complete 2,383-page manual pass, with 436,642 in-bounds word boxes, zero final warnings and visual review of the changed page. An initial double-hyphen ligature was corrected and the full render revalidated. The physical census covers 3,704 source/configuration files, all below 1,000 lines; complete semantic authority and private documentation closure remain open. Exact-head Exsh CI 253/254 and Docs CI 915/916 are running. Symbol providers, ordered runtime binding, cross-object frame paths, source membership, coherent catalog adoption, runnable realms and both complete guest builds remain required.

Matching closed dependency intake CI — 16 September 2026: Exsh 253 and 254, exact 9827896d1cb5ad834589045ee03390aec650df84, pass 259 checker controls, 16 isolated imports, 961 Rust tests and the strict preceding build/Clippy/rustdoc stages. All four workspace domains per run and Markdown pass. The required full frame gate remains incomplete, with 111/111/74/74 unresolved observations in each CI artifact set. Four complete logs total 315,052 bytes and contain zero warnings. Original local runtime/all/native replays retain separate input identities and 107/70/299 counts.

Docs 915 and 916, exact 88537b23e1def210eeff40b7ef90fce92fe2009e, pass 45 tests and complete 2,383-page renders. Four complete logs total 763,918 bytes. Reference convergence is 35/1/0 warnings across the three TeX passes, with zero final warnings. Both cohorts are classified without rerunning jobs or changing their budgets. The seven-object native dependency inventory is now checked; symbolic providers, ordered runtime binding, cross-object frames and source membership remain incomplete. No runnable realm, coherent product adoption or complete in-EriX build is established.

Ordered native symbol evidence — 17 September 2026: signed Exsh 469bf1f1b9d8301cf98a79d16c7c27660ecda2a1 enforces root-first depth-first discovery order and positional DT_NEEDED agreement, indexes exact strong/weak providers and preserves object-qualified relative function identities. Duplicate strong definitions fail; missing weak symbols remain zero data. S-only relocations ignore addends, while S+A must retain an exact original executable entry. Names confer no file reads and no load bias is invented.

All 276 checker tests, 17 isolated modules and six strict Rust configurations (961 tests each) pass, including host/native Clippy, rustdoc and six warning-free native builds. Independent original-byte inventory matches all 117 symbolic records: 112 exact function identities and five refused data targets. Provider indexing/reporting takes approximately 16 ms in the captured native profile. Original standalone runtime/all/native replays preserve 107/70/299 unresolved observations and actual exit 1 under unchanged budgets. This is conditional relative identity evidence only: load-base arithmetic, protected slots, cross-object calls/frames and source membership remain incomplete.

Signed Docs 24cefeb2dc6d3f163140d32f5fed5a7e1a768ebd updates the manual contract. All 45 documentation tests pass; the complete 2,383-page render has 436,737 in-bounds word boxes, zero final warnings and visual review of pages 2284–2285. The physical audit covers 3,706 source/configuration files, all below 1,000 lines. No runtime Rust, dependency, linker or workflow inputs changed. New host/CLI controls cover the analyzer behavior; no new guest feature is asserted. Exsh CI 255/256 is terminal: unit/strict/workspace stages pass, and the required full-frame gate remains incomplete. Docs CI 917/918 passes. Acceptance remains 15/459 leaves, 3.48% weighted. Both full in-EriX builds and the complete semantic authority audit remain open.

Ordered-provider automatic CI classification — 17 September 2026: Exsh 255/256 at 469bf1f1b9d8301cf98a79d16c7c27660ecda2a1 passes 961 Rust tests, the combined 276-test checker suite, strict preceding stages and all four workspace domains per run. The required full-frame gate fails with 111/111/74/74 unresolved observations per run. Four complete logs total 315,035 bytes with zero warnings. The 17 separate module executions are local evidence; CI uses combined test discovery.

Docs 917/918 at 24cefeb2dc6d3f163140d32f5fed5a7e1a768ebd passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,878 bytes. Reference-resolution passes produce 35/1/0 warnings; final output has zero warnings and no layout overflow. Original API snapshots remain unchanged. Both cohorts are fully classified, without restarting workflows or changing thresholds. Original Integration layout, quota and FAT32 failures remain open, including #58 in Integration. Acceptance remains 15/459 leaves, 3.48% weighted. Complete native source/frame proof, a runnable realm, the full semantic authority audit and both full in-EriX builds remain required.

Protected cross-object frame evidence — 17 September 2026: signed Exsh ac9646c84e432129a872737789a9be08f984b881 composes the seven explicitly selected native objects using protected relative/symbolic slots and object-qualified function identities. Local control-flow offsets cannot alias a foreign function or transfer the root fallback role. Register facts, grounded preservation/no-return dependencies and route accounting retain the selected object. Every captured decode shares the original output/time budgets; a late failure rejects the invocation. Native reports use schema 3; standalone schema 2 and input schema 1 remain unchanged.

All 299 checker tests and 20 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, rustdoc and six warning-free native builds; formatting and Markdown checks pass. Original runtime/all replays retain 107/70 unresolved observations. The composed native graph reaches 275 functions with 111 unresolved observations; all three actual checker exits remain 1. Native slots assume successful checked linking and unchanged disjoint mappings. Actual load bases, complete source/frame acceptance and coherent runtime adoption remain open.

Profiling identified redundant root-only analysis in native mode. Removing it preserved every composed decision while one profile changed from 41.52 to 25.81 seconds and 64.37M to 39.61M calls. This host profile pair includes observer overhead and gives no general or guest timing guarantee. The final source replay also preserves every decision; three register-proof records now correctly identify symbolic load provenance.

Signed Docs 44cd6c4aa95bebfa08c99804fab0f1551f537ae1 specifies the contract. All 45 documentation tests pass; the complete 2,383-page manual has 436,894 in-bounds word boxes, zero final warnings and visual review of the changed page. All 3,713 inventoried source/configuration files are below 1,000 lines. The broader documentation audit retains 108 unchanged older test definitions needing inline docstrings; current production and all new/modified definitions are documented. Runtime Rust, dependency, linker and workflow inputs are unchanged; added behavior has host and real CLI regressions, with no new guest runtime feature asserted. Original Exsh CI 257/258 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 919/920 passes. Both cohorts are fully classified. Both full builds inside EriX and complete semantic authority acceptance remain open.

Cross-object checkpoint CI classification — 17 September 2026: Exsh 257/258 at ac9646c84e432129a872737789a9be08f984b881 passes 961 Rust tests, the combined 299-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery also checks isolated module imports; the 20 separate module-suite executions are additional local evidence. The required full-frame gate fails with 111/111/74/74 unresolved observations on the four original CI artifact selections. Four complete logs total 315,180 bytes with zero warnings. Those CI selections remain distinct from the retained seven-object native replay.

Docs 919/920 at 44cd6c4aa95bebfa08c99804fab0f1551f537ae1 passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,906 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required.

Saved-value preservation evidence — 17 September 2026: signed Exsh 8b6b93a329757ae7f106e235761912b58a67deff derives incoming-register equality through exact full-width copies and owned live stack slots. Original byte decoders bind register, width and address forms. Partial or unknown aliases, conflicting paths, deallocation and reuse invalidate saved facts. Entry tokens carry equality only; they never supply a pointer or call target. A separate earlier callee contract must prove private stack writes before caller slots survive a call. Checked signed bounds and finite dependency order prevent wrapped offsets and recursive assumptions from granting evidence.

All 329 checker tests and 22 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, rustdoc and six warning-free native builds; formatting and Markdown checks pass. Independent eager scheduling controls agree with both filtered worklist orders. Original runtime/all/native replays retain 107/70/111 unresolved observations and actual checker exit 1. The native graph still reaches 275 functions. The startup iterator's unknown pointer writes remain a refusal; complete source/frame and runtime acceptance remain open.

Two initial native profiles exhausted the original 60-second budget and produced empty reports; both failures are retained. Immutable decode caches, retirement of exhausted equality state, fact-sensitive wakeups and dependency-first scheduling brought the final native replay within the unchanged budget: 57.45 seconds wall time, 53.94 profiled seconds and 72.27M calls. All 2,373 bodies are inspected once. This bounds one retained host replay and makes no general speedup or guest timing claim. Report schemas and original source, stack, byte and time gates are unchanged.

Signed Docs c3401e5f6bbc19a0ba695219ed551e29a29677ed specifies the contract. All 45 documentation tests pass; the complete 2,383-page manual has 436,968 in-bounds word boxes, zero final warnings and visual review of both changed continuation pages. All 3,717 inventoried source/configuration files are below 1,000 lines. The touched preservation tests now document 21 older methods; 87 unchanged older test definitions remain in the inline documentation audit. Current production and all new/modified definitions are documented. Runtime Rust, dependency, linker and workflow inputs are unchanged; no new guest runtime feature is asserted. Original Exsh CI 259/260 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 921/922 passes. Both cohorts are fully classified. Both full builds inside EriX and complete semantic authority acceptance remain open.

Saved-value checkpoint CI classification — 17 September 2026: Exsh 259/260 at 8b6b93a329757ae7f106e235761912b58a67deff passes 961 Rust tests, the combined 329-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery checks isolated module imports; the 22 separate module-suite executions are additional local evidence. The required full-frame gate fails with 111/111/74/74 unresolved observations on its four original CI artifact selections. Four complete logs total 315,234 bytes with zero warnings. These CI selections remain distinct from the retained seven-object native replay.

Docs 921/922 at c3401e5f6bbc19a0ba695219ed551e29a29677ed passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,958 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required.

Caller-bound stack preservation — 17 September 2026: signed Exsh e7ba974e96ee77a41c6a861150da843d4c84c7d6 binds formal GP arguments to independently proved live caller stack intervals. Exact callee write spans preserve return-address gaps and invalidate every overlapping save. Scoped masks never enter the unconditional function index; loaded words, unknown contents, released storage and recursive assumptions supply no binding. Byte-checked SETcc writes exactly one unknown byte.

All 355 checker tests and 23 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, private rustdoc and six warning-free native builds. Formatting, templates and Markdown pass. Original runtime/all/native replays retain 97/60/97 unresolved observations and actual exit 1. The native graph reaches 275 functions; the startup iterator now has caller-bound preservation for its exact live buffers. Complete source/frame and runtime acceptance remain open.

Profiling exposed repeated failed argument specializations. Mandatory opaque-prefix refusals, conservative GP demand and rejection-only control candidates avoid unnecessary interpretations without changing the original 60-second limit. Candidate records cannot become proofs, and incompatible fact kinds defer to actual interpretation: losing pointer identity can enable numeric refinement. Positive and negative controls compare filtered and eager behavior. Each CFG site has at most one pending visit and later changes still enqueue it without an iteration cap; every native proof decision agrees with the prior queue.

The final ordinary native replay takes 39.80 seconds. Complete tracing still exhausted the original deadline; failures and empty reports are retained. A separately identified selective profile measures only caller-context analysis: the complete invocation takes 56.59 seconds, with 26.92 profiled seconds in that scope. Instrumentation preserves the complete proof result. Different profiling scopes are not timing comparisons, and no guest performance claim is made. The replay selects 367 instances, evaluates 587 bodies, proves 190 and defers 51 candidate bodies for incompatible domains.

Signed Docs fc3ee44748c20a3aa6f55bd85ac1913c707e5d4e specifies these contracts. All 45 documentation tests pass. The complete 2,385-page manual has 437,275 in-bounds word boxes, zero final warnings and visual review of the changed pages. All 3,721 inventoried source/configuration files are below 1,000 lines. All new/modified definitions are documented; 87 unchanged older test definitions remain in the audit. Runtime Rust, dependencies, linker and workflow inputs are unchanged. Original Exsh CI 261/262 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 923/924 passes. Both cohorts are fully classified. Complete semantic authority acceptance, coherent runtime adoption and both full builds inside EriX remain required.

Caller-bound checkpoint CI classification — 17 September 2026: Exsh 261/262 at e7ba974e96ee77a41c6a861150da843d4c84c7d6 passes 961 Rust tests, the combined 355-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery checks isolated module imports; the 23 separate module-suite executions are additional local evidence. The required full-frame gate fails with 101/101/64/64 unresolved observations on its four original CI artifact selections. Four complete logs total 315,210 bytes with zero warnings. These CI selections remain distinct from the retained seven-object native replay.

Docs 923/924 at fc3ee44748c20a3aa6f55bd85ac1913c707e5d4e passes 45 tests and the complete 2,385-page manual. Four complete logs total 764,350 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required.

Tracking

Owning component: Exsh build validation; component audit #2 and PR #3. Current signed checkpoint: 453641cd19eaa7c85a8f6693363f8660c792ed73.

Acceptance requires proof of the actual optimized paths while preserving existing stack limits. Renamed, outlined or inlined code needs actual artifact and path evidence. Missing evidence and excessive stack use must still fail. Changing closure spelling or deleting the missing function requirement cannot establish the direct-chain bound. The issue remains open until the complete proof is established.

Original terminal-accounting graph validation — 21 September 2026:

Signed 0d5d5ad9aff082ca75ec79dbc9c29d73f799d8ed adopts the original shared terminal-observation, exact-acknowledgement and final-CPU dependencies. Both development configurations pass 976 Rust tests; all four host/native Clippy, warning-denied host/native build, applicable doctest and private-rustdoc selections pass. All 355 checker controls pass. The shell implementation and release optimization/LTO policy are unchanged.

The new graph independently retains two release unit-test compilation failures: cargo test --locked --offline --release --all-targets stops at 126.117857 seconds and cargo test --locked --offline --all-features --release --all-targets at 120.024146 seconds. Both reach the existing 120-second silence bound within the 600-second hard bound; the child exits on signal 15, the owner reports status 124, and cleanup succeeds. No release unit test executes. These are new original-graph observations in compiler regression 9, with all prior failures retained. The cause needs an actual compiler profile; no optimization, LTO or deadline setting was relaxed.

Actual runtime and all-feature PIC artifacts are checked in both deployment profiles using the maintained frame configuration. All four reports return incomplete proof (exit 1), with 97 unresolved routes for runtime and 63 for all features. Workspace mapping passes separately. The original ELF and packaged artifact digests, selected tool/helper identities and failed reports remain retained. Frame regression 4 stays open. Original CI 275/276 is being observed without restart.

The WIP PR awards no complete runtime or self-hosting acceptance. Actual service CPU/profiler VMs, complete authority/source/effect/frame proof, native external Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain required in Phase 6 completion.

Original terminal-graph CI classification — 21 September 2026:

Signed 0d5d5ad9aff082ca75ec79dbc9c29d73f799d8ed reaches actual analysis in both original CI 275/276. Each passes 976 unit tests and 355 checker controls before the required frame gate fails. Each run retains four incomplete reports: 101 unresolved runtime observations in both profiles and 68 all-feature observations in both profiles. All four workspace mappings pass separately. These CI artifact observations differ from local 97/63 results and are not interchangeable proof.

All four terminal logs are complete and hash-verified (319,902 bytes), with zero warnings. The disassembler intake correction reaches the real proof boundary; tool-selection issue 5 is resolved. Complete frame issue 4 and local release compiler issue 9 remain open. No workflow restart, bound change or conversion of incomplete evidence to a pass occurred.

## Summary The existing emitted-frame gate rejects both optimized Exsh runtime builds on Rust 1.97.1 because its required evaluator function is absent and its literal closure spelling differs from the actual disassembly. This is a build proof inventory problem under the selected toolchain. No stack overflow was demonstrated. The unchanged gate remains failed; the declared direct-chain proof is unresolved. ## Reproduction Use the original source/dependency graph recorded below, a fresh Cargo home prepared by the original Integration helper, and explicit x86_64-unknown-none output. Compile once for each of `--features exsh-runtime` and `--all-features`: ```sh CARGO_PROFILE_RELEASE_LTO=false CARGO_PROFILE_RELEASE_STRIP=false \ RUSTFLAGS='-D warnings -C link-arg=-Tlinker.ld' \ cargo rustc --release --bin exsh --target x86_64-unknown-none \ --features exsh-runtime -- \ -C opt-level=3 -C codegen-units=1 -C relocation-model=pic \ -C no-redzone=y -C force-unwind-tables=no python3 -B scripts/check-descriptor-cleanup-frames.py \ "$CARGO_TARGET_DIR/x86_64-unknown-none/release/exsh" ``` Both build invocations exited 0 without warnings. Each original checker invocation exited 1 on its respective preserved binary. These are two distinct configurations, not repeated attempts to obtain a passing result. The runtime source, Cargo manifests, linker script and checker equal the original selected commit; unrelated concurrent edits added only test rustdoc, CI helper/gates and documentation. No VM was used, and an untouched full-checkout rebuild was not repeated because the complete production source/object equality is already recorded. ## Expected and actual behavior Expected: bound the actual optimized entry/cleanup paths with unchanged 8 KiB normal, 33 KiB fallback and 56 KiB direct early-drop limits. Unknown or missing proof must fail, but codegen changes should be handled through actual artifact identity and path evidence rather than a mandatory incidental closure spelling. Actual: both runs report `missing emitted cleanup proof: ::evaluate_simple_command_resolved_inner`. The source function exists without an out-of-line guarantee, but its symbol is absent. Run-shell closures are emitted as `{closure#5}` / `{closure#19}`; the gate requires literal `{{closure}}`. The source parser tests all pass because their handcrafted positive text supplies exactly the old expected names. No oracle was changed and no limit was adjusted. Read-only diagnostics of the actual runtime/all-feature ELFs show entry frames 6800/6784 bytes, the main emitted run-shell closure 5136 bytes, and the fallback 32816 bytes. These individual measurements fit the existing limits. They do not establish the missing direct-chain proof or a whole-program stack bound. ## Environment and identity - Exsh original runtime/checker commit: `5249114a634ead34a32ccd44cba613021df1647f`. - Integration helper: `e2b1cf5995bcf6334839cda9a013e90fa97787d5`. - Original dependencies: IPC/shim `b452a46803982c57e474adcc318ce40bd281d621`, capability ABI `a68ce860e2bd90fa95feb9ada882ef547c7873df`, filesystem names `644e8e156d7eaa406b5b5b882980c3a435756425`, standard I/O `e4e094f8cc16662cf5200af6e47b3fe5a0b92a52`, SHA-2 `fdc4c902ed9f8c2c95c8c167eac2efa345f3b4f9`. Cargo retained their original Git source IDs; no path/registry replacement was used. - Host compiler: Rust 1.97.1, commit `8bab26f4f68e0e26f0bb7960be334d5b520ea452`, LLVM 22.1.6; x86_64-unknown-linux-gnu host, x86_64-unknown-none target. - Runtime ELF SHA-256: `1e63b3930c3fb440e29461d96e19d7b63fb0977961d76ce3491ae739771ceecd`. - All-feature ELF SHA-256: `b6b7676ac457308e8df150d12ecea60120e5325cf3a2d0dc2f90ea700ad22f75`. - rustc SHA-256: `d3a664c970a9fd8361b64194861bebc1ae37b9054e5ee3400dc1c9e691797eea`. - Cargo SHA-256: `828980723df339d62434390e9fb8ef8831036583343ae2316b7ab5646b5c1953`. - objdump SHA-256: `b947cc7fae5e951ca6009bbc72889a35d2af7a832416de0489c607c7598472b2`. - Checker SHA-256: `7039a8cc2c050beae145f275a55fd60612c5a049daa0b05cb95871ea0ef5c0fc`. - No image, firmware, guest session or runtime authority grant was involved. Last working artifact/toolchain for this exact gate was not established here. ## Evidence and prior checks Diagnostic guest evidence — 15 September 2026: The original serial editor/history, inherited-stream time and runtime-error probes pass on a newly built native image using Exsh `b12e172e7b266842a8659104894f6821166165fb` and the complete companion helper correction published as Integration `db80a2c1dfc669bd724762d476f5f5c0da005ff6`. All original timeout and exact output assertions are preserved; the image remains unchanged. This uses a separately recorded original-component catalog and explicitly identified helper delta, not an admitted product catalog. Full frame evidence remains INCOMPLETE, including workspace evidence, ordinary-source membership and direct-versus-nested bounds. The three probes do not establish either complete guest build generation. Build compatibility evidence: https://git.erikinkinen.fi/erix/integration/issues/52. Earlier receipts below retain their original revision and runtime scope. The signed WIP checkpoint is `62a4f30ff5011ae6221925db9d9b1b58ec0ad71f` on `feature/posix-compat`. It aligns the existing original dependency commits and extends the checker with exact accumulator identity padding and one guarded relative jump-table form. All 73 warning-denied checker tests pass, including literal guard bypass, every-arm stack depth, mapping and relocation controls. The original grammar's positive table control fails as expected. Original failures and true statuses are retained. The previously validated Rust, Cargo and linker inputs match this checkpoint byte for byte: 957 tests pass in each default/all-feature and production development/release configuration, with formatting, strict host/native Clippy, eight native builds and private rustdoc. These are retained build receipts; changing the host checker required no rebuild of those inputs. Final Markdown and whitespace checks pass without warnings. Runtime Rust and the stack thresholds remain unchanged. Fresh checker replays of the same retained runtime/all-feature images still return INCOMPLETE, with 690/603 unresolved observations and no intake error. Neither graph reaches a table admitted by the new narrow grammar. A separate outlined source-boundary experiment builds successfully; targeted inspection of its evaluator body resolves one ten-entry table, reducing that body's unresolved local sites from three to two. The entry-reachable graph remains incomplete. That runtime outlining is not included in this checkpoint and has no VM acceptance. A separate optimized debug build identifies the evaluator declaration as inlined, but its emitted code differs from the retained non-debug image. Its metadata therefore does not certify that earlier image. Ordinary-source membership, non-returning and indirect calls, other branches and the direct-versus-nested contract remain open. No complete frame gate, product adoption, stack safety or full EriX-in-EriX build is claimed. CI 223/224 is now terminal: both pass 957 Rust and 73 checker tests, then fail the complete frame gate. All four complete logs total 310,250 bytes without warnings. Their runtime/all artifact graphs retain 661/585 unresolved observations, distinct from the local retained images. The failure remains tracked here; no full frame or product acceptance is claimed. Current workspace implementation — 15 September 2026: Signed Exsh `b12e172e7b266842a8659104894f6821166165fb` owns ordinary and emergency transport in distinct version-22 authenticated workspace slices. Descriptor startup rejects short or dirty cleanup storage before metadata effects; transactions exclusively reborrow the complete slice and erase it after emergency cleanup. The global UnsafeCell accessor and automatic 32 KiB cleanup array are removed. Larger valid caller slices retain their complete extent. Existing provider retirement, metadata rollback and uncertain-cleanup behavior remain enforced. All 961 Rust tests pass in each default/all-feature/production development/release configuration, with formatting, strict host/native Clippy, private rustdoc and eight native builds without warnings. Four added tests cover workspace disjointness, malformed backing, complete caller extent and consecutive cleanup reuse; existing cleanup controls now also check buffer canaries and erasure. All 73 warning-denied checker tests pass. Both actual optimized native fallbacks measure 48 local bytes, compared with the retained prior 32,816-byte frames. Their full checker reports remain INCOMPLETE: runtime/all graphs contain 691/604 unresolved observations, and the old 32 KiB initial stack-reservation requirement still needs a workspace-specific evidence contract. Ordinary-source membership and direct-versus-nested early-drop bounds remain open. The 8/33/56 KiB upper limits and 64 KiB stack are unchanged; this measurement is not an all-path stack-safety claim. Matching producer `38424571b76b36c1e631d99fd2c859fb32311eea` exports/consumes 96 capacity words plus 72 target layout words, reserves both transport arrays first and rejects old/mixed layouts. Packaging both actual optimized shell configurations under canonical dev/release policies derives 4,300,800 workspace bytes, with unchanged executable bytes and a separate 64 KiB stack. All 162 Integration helper commands and its strict 320/321-test Rust matrix pass, including four native builds. These are private artifact and host checks, not guest execution. The product catalog still selects the earlier shell; coordinated catalog adoption and matching runtime VMs remain required. Documentation `79cdd4c3694e800091b55c737fca04c7bdd3d071` describes the ownership and compatibility contract. Its 45 tests and canonical checks pass. The full manual renders 2,375 pages without final warnings; all 433,713 word boxes are in bounds and changed page 2280 passes visual review. API snapshots are unchanged. Exsh CI 225/226 fails only the incomplete frame gate after 961 Rust and 73 checker tests; all four logs total 311,820 bytes with zero warnings. CI runtime/all graph observations are 662/587 and both fallbacks measure 48 bytes; these artifacts remain distinct from local images. Docs CI 883/884 passes with all four complete logs (762,212 bytes); reference passes converge with 35/1/0 warnings and zero final warnings. These component cohorts are fully classified. Integration CI 1637/1638 remains queued at its first observation. No full build within EriX or whole-codebase authority closure is claimed. Paired workspace mapping checkpoint — 15 September 2026: Signed Exsh `f17670c7f0c3b6da4458deac534ba6210921550d` adds paired pristine/packaged ELF workspace evidence under report schema 2. The checker captures both regular-file snapshots under its existing budgets and retains them when pair admission fails. It verifies the version-22 target descriptor, complete transport spans, exact arena extent, unique zero-fill arena/stack ownership and the unchanged separate 64 KiB stack. All mapped file bytes and permissions must match except tunable capacity words and the workspace owner's extent. Stale/mixed layouts, changed code/data, overlapping claims and relocation writes into descriptor/arena/stack bytes fail before the disassembler runs. The obsolete automatic-stack-scratch requirement and redundant prologue-reservation scan are removed. Local frame ceilings remain 8/33/56 KiB in their existing domains; a local stack frame cannot supply workspace evidence. Mapping success assumes the native loader preserves the declared mappings and does not prove source borrowing, erasure, complete typed carving, ordinary-source membership or direct-versus-nested bounds. Unproved indirect targets remain unresolved. All 90 warning-denied checker tests pass, including 17 new independent mapping/CLI controls. Formatting, Markdown and canonical checks pass. Four exact retained runtime/all-feature artifacts with canonical dev/release packaging establish the mapping domain: workspace 4,300,800 bytes, two complete 32 KiB buffers, separate 64 KiB stack. Both local fallback frames are complete at 48 bytes. Full reports remain INCOMPLETE with 691/604 unresolved observations and the original source/direct-path gaps; no full frame pass is claimed. Rust, Cargo and linker source bytes are unchanged from workspace checkpoint `b12e172e7b266842a8659104894f6821166165fb`. Its 961-test strict matrices and eight native builds retain that source scope; the paired replays retain their original ELF hashes. The earlier three diagnostic guest probes also retain their original image/source identities and are not new runtime execution at this checker head. Exsh CI 227/228 fails the remaining full frame gate after all 961 Rust and 90 checker tests pass. All four logs are complete (311,713 bytes) with zero warnings. Both fallbacks are complete at 48 bytes; CI runtime/all graphs retain 662/587 unresolved observations. CI supplies no packaged counterpart, so its workspace mapping domain remains incomplete; the four local paired-artifact results retain their separate scope. The cohort is fully classified without accepting any missing proof. Matching Docs `5d77dc2b82bf5439e58234d901e30f4565aaa81a` is signed and pushed: all 45 tests, the complete warning-free 2,375-page render, 433,924 in-bounds word boxes, literal-option extraction and nine-page visual review pass. Docs CI 887/888 passes with all four complete classified logs (762,236 bytes). Both manual jobs pass 45 tests and converge with 35/1/0 reference warnings, leaving zero final warnings; both Markdown jobs pass. Its issue https://git.erikinkinen.fi/erix/docs/issues/8 records the 24 repaired inline-option/delimiter cases and is closed after complete CI classification. Full frame proof, coherent product admission, realm work and both complete guest build generations remain open. CI packaged-input checkpoint — 15 September 2026: Signed Exsh `453641cd19eaa7c85a8f6693363f8660c792ed73` supplies packaged counterparts in CI. Its helper is pinned to original Integration `db80a2c1dfc669bd724762d476f5f5c0da005ff6`. The actual producer packages separate copies of each optimized runtime/all-feature ELF using both canonical dev/release policies. Packaging has a 60-second deadline, refuses existing outputs and stops the job on failure. Each pristine/packaged pair gets its own complete checker invocation; any unresolved required domain keeps a nonzero status. The exact changed workflow block was replayed against both retained native binaries. All four produced ELF hashes equal the previously independently validated production bytes, workspace mapping is complete, and pristine inputs remain unchanged. The full reports remain incomplete with 691/604 unresolved observations and unproved source/direct-path domains. YAML and shell syntax, 90 checker tests, formatting, Markdown, canonical and pinned dependency checks pass without warnings. Rust, linker and checker source bytes are unchanged, so their earlier strict validation retains its original source scope. Current Exsh CI 229/230 is fully classified: both runs pass 961 Rust and 90 checker tests and all four workspace-mapping domains, but fail the remaining full frame gate. All four complete logs total 314,746 bytes with zero warnings. Runtime/all graph observations remain 662/587 and fallback local frames remain 48 bytes. This resolves the missing packaged-input domain; source membership, non-returning/indirect targets and direct-versus-nested path proof remain open. No full frame proof, product admission or guest build is claimed. Protected relative-target checkpoint — 16 September 2026: signed Exsh `a26ecffb39b70abbf15fb300c5c8c703c6900c37` admits exact six-byte RIP-relative calls and tails only after complete relative-relocation, file ownership, protected RELRO page and target-entry checks. It shares the relocation inventory with guarded tables and rejects overlapping or executable-byte writes. Independent controls cover malformed ranges, writable neighbours, different stored words, negative displacements, self-entry loops and tail restoration. All 102 checker tests and all six strict Rust feature/profile configurations pass (961 tests each), together with six native builds, host/native Clippy, formatting and private rustdoc. Runtime Rust, linker scripts and Cargo selections are unchanged. Replaying both unique original pristine/packaged artifact pairs preserves their hashes and all original stack/resource budgets. Runtime/all-feature reports retain 641/591 new call/tail proofs and reach 266/240 functions; unresolved observations fall from 691/604 to 271/232. Workspace mapping passes. Both full reports remain incomplete: unknown indirect control flow, non-returning semantics and source/direct-versus-nested boundaries remain separate obligations. These are partial static admission results, not a complete frame or authority proof. Signed Docs `83b2d4a2dfc473bb8a99719f86fa1c3c33effa53` explains the proof contract and its limits. All 45 documentation tests and canonical checks pass; the 2,377-page manual has 434,680 in-bounds word boxes, zero final warnings and a visually reviewed changed page. API snapshots are unchanged. The preceding Docs permission-observer checkpoint passes CI 893/894 with four complete logs (762,616 bytes) and zero final warnings. Exsh CI 231/232 is fully classified: all 961 Rust tests, 102 checker tests and all four workspace domains pass, with four complete logs totaling 314,760 bytes and zero warnings. Only the complete frame gate fails. Its separately selected CI artifacts report 273/230 unresolved observations; these do not replace the retained local artifact identities/counts. The preceding Docs CI result is recorded below. All 2,997 inventoried authored code files remain below 1,000 lines; semantic authority/documentation closure, product catalog adoption, runnable realms and both complete guest builds remain open. Grounded return-flow checkpoint — 16 September 2026: signed Exsh `4bb35938b52c0e6b20c65ccb861af79871272cbe` derives no-ordinary-return facts from complete checked loop/trap bodies and earlier proved tail targets. Only these grounded exact callees suppress ordinary fallthrough. Calls retain target, depth and relocation evidence, and each fact preserves its original body evidence and earlier dependencies. Final reachability removes stale fallthrough descendants while keeping terminal callee obligations. Unknown calls, unsupported instructions, malformed boundaries and unproved tail cycles cannot establish facts. All 114 checker tests pass, including twelve new literal controls and a 1,200-function chain requiring at most two body visits per function. All six strict Rust feature/profile configurations pass 961 tests each, with six native builds, host/native Clippy, formatting and private rustdoc. Runtime Rust, linker scripts and Cargo selections are unchanged. The physical inventory now covers 2,999 authored code files, all below 1,000 lines. The same retained original artifact pairs yield thirteen grounded facts each. Runtime/all-feature unresolved observations fall from 271/232 to 181/150; every function-end boundary error disappears under the stated ordinary-call model. The work queue performs 347/313 body evaluations for 266/240 discovered functions and retains 263/237 in the final reachable graph. This is an analysis-work count, not a claimed runtime speedup. Remaining observations are 140/111 unknown calls, 40/38 unknown branches and one unsupported instruction per mode. Both workspace mappings pass; whole frame and source domains remain incomplete with unchanged budgets. A separate proof audit verifies earlier dependencies and retained terminal callees. Signed Docs `97ce65dcb8cef7232b50d53af90ff8673d623e05` documents the refinement. All 45 tests and canonical checks pass, and the 2,377-page manual has 434,800 in-bounds word boxes, zero final warnings and a visually reviewed changed page. Exported API snapshots are unchanged. Exsh CI 233/234 is fully classified: 961 Rust tests, all 114 checker tests and four workspace mappings pass, while the full frame gate remains incomplete. All four logs total 314,776 bytes with zero warnings. Those separately selected CI artifacts retain 183/145 unresolved observations, distinct from the retained local pair counts. Matching Docs CI 897/898 passes with all four complete logs across the two terminal observations (762,600 bytes), 45 tests per manual job and zero final warnings. The preceding Docs target-contract checkpoint passes CI 895/896 with four complete logs totaling 762,636 bytes and zero final warnings. Full indirect/source proof, coherent catalog adoption, whole-codebase authority/documentation closure, runnable realms and both full guest-build generations remain open. Exact direction-flag checkpoint — 16 September 2026: signed Exsh `05eeb7bc0b1bf1e6fa781b26ee83a8896263a439` admits operand-free single-byte `FC`/`FD` as stack-neutral direction-flag updates, preserving frame-pointer facts. Mismatched bytes, operands and prefixes refuse. Three original controls bring the full checker group to 117 passing tests, including a growing-stack negative case. Formatting, canonical documentation checks and the 2,999-file physical audit pass. The precise instruction contract is documented in Exsh; the existing manual's ordinary stack model remains applicable. Replaying the same exact artifact pairs now admits each `memmove` frame at eight local bytes and removes its one unsupported-instruction observation. Runtime/all-feature reports retain 180/149 unresolved observations, all unknown indirect calls or branches, with thirteen grounded no-return facts each. Original input hashes and budgets are unchanged; workspace mappings pass and full frame/source domains remain incomplete. Every Rust, Cargo, linker, build and workflow input is byte-identical to the preceding checkpoint's six strict 961-test configurations and six native builds. Those results are retained at their original identity; this checker-only follow-up claims no new Rust or guest execution. Matching Exsh CI 235/236 is fully classified: all 961 Rust tests, 117 checker tests and four workspace domains pass, while the full frame gate remains incomplete. All four complete logs total 314,740 bytes with zero warnings. Those CI artifact identities retain 182/144 unresolved observations, distinct from the local retained pairs. No whole authority, realm or full guest-build acceptance is added. Measured parser checkpoint — 16 September 2026: signed Exsh `ffbe846cbcd0ab6ea12a476c2c84339f635ee50a` compiles the three unchanged disassembly regexes once per input. It retains the exact grammar, instruction bytes, annotations and every disassembly deadline check. Three paired runtime host profiles against signed `05eeb7bc0b1bf1e6fa781b26ee83a8896263a439` reduce regex-cache lookups from 1,142,474 to 570,949; median profiled time falls from 5.088 to 4.214 seconds and complete wall time from 5.311 to 4.425 seconds. These measurements include profiler overhead and subprocess waiting. The 837,947 full matches, 189,680 splits and 375,664 disassembly deadline checks remain identical; they do not measure guest performance. All eight runtime/all-feature observations preserve their original nonzero checker exits and identical complete decision reports. Only checker-source identity and private snapshot path metadata differ. Workspace mappings pass and the same 180/149 unknown indirect observations keep full frame/source admission incomplete. All 117 checker tests, formatting, canonical documentation checks and the 2,999-file physical ceiling audit pass. Every Rust, Cargo, linker, build and workflow input remains byte-identical to the existing six strict 961-test configurations and six native builds; no new Rust or guest execution is claimed. The focused contract documents the measurement and limits; the unchanged manual's stack model remains applicable. Matching Exsh CI 237/238 is fully classified: all 961 Rust tests, 117 checker tests, Markdown and four workspace domains pass; both runs fail the still-incomplete full frame gate. All four complete logs total 314,754 bytes with zero warnings. These CI artifacts retain 182/144 unresolved observations, the same counts as preceding CI and distinct from the local retained artifact pairs. Whole authority, realms and both full guest-build generations remain open. Register-target proof design — 16 September 2026: the current runtime/all-feature artifacts retain 180/149 unresolved indirect observations. Six/seven immediately adjacent protected-slot loads are only candidates: textual proximity does not prove every incoming path. Extend the existing finite stack CFG with register facts for all sixteen baseline x86-64 general registers. Entry values are unknown. Exact byte-checked 64-bit RIP-relative loads can acquire a target only from the existing complete immutable relocation/RELRO proof; exact 64-bit register copies carry that evidence. Immediate integers, names, mutable data and stored pointer words supply no target. Join facts only when every incoming path has the same target value, retaining all contributing load sites and protected-slot proofs. Explicit and implicit writes invalidate each affected full-register family, including partial aliases. Unknown effects, system calls and ordinary calls clear facts; no callee-saved convention, returned function pointer or stack spill becomes an unproved preservation premise. Existing probe/dispatch macros conservatively discard register facts until their complete effects are represented. Unsupported instruction/control-flow cases remain incomplete under the existing trusted-decoder and ordinary-call model. Revisit weakened joins and replace stale call/branch evidence; an earlier strong path cannot survive as the only proof after another predecessor loses its value. Exact register-call/tail bytes must agree with the selected register. Preserve call depth, tail restoration, grounded return dependencies, unknown branches and the full source/domain gates. The finite worklist and provenance sets use the caller's original deadlines with no invented iteration or origin-count ceiling. Add independently authored positive, alias/implicit-clobber, bypass, disagreeing/equal-join, loop, stale-edge, call/syscall and source-receipt controls. Replay both original artifact pairs, measure analysis work, update the focused/manual contracts, and validate/sign/push before any adoption. This is original code derived from the [Intel instruction reference](https://www.intel.com/content/www/us/en/developer/articles/technical/intel-sdm.html); it imports no implementation code. Complete guest-image identity, source membership, authority and both full guest-build generations remain separate required work. Protected register checkpoint — 16 September 2026: signed Exsh `da8b75c9063c52de2149f2a6c7ed170f720a6c62` propagates exact full-width protected-slot loads and register copies through the reached CFG. Equal-target joins retain every load origin; unknown or conflicting predecessors, alias/implicit writes, calls/syscalls and unknown effects discard facts. Weakening a join replaces stale edge proof. Complete admitted probe/dispatch effects preserve only unwritten register values. Supported REX forms permit unused bits with byte/text agreement. There is no caller-input, saved-register, spill-word or immediate-address target premise. All 138 checker tests, formatting, canonical document checks and an independent original-byte/load/relocation and earlier no-return dependency audit pass. Retained runtime/all artifact pairs gain 16/18 register edges; the all-feature graph reaches one additional function. Remaining unresolved sites are 164/132, with thirteen grounded no-return facts per mode. Both workspace mappings pass. Full frame/source gates remain incomplete with actual exit 1 and unchanged 60/15-second and 64 MiB budgets. Every Rust/Cargo/linker/build/workflow byte is unchanged from six strict 961-test configurations and six native builds; no new Rust build or guest execution is claimed. Profiling identified unnecessary effect parsing when all registers were unknown. Skipping those identity transfers and compiling fixed effect patterns once preserves every report decision, reducing runtime effect-parser calls from 34,901 to 1,334 and all-feature calls from 33,398 to 1,348. One before/after observation per identical pair measures 5.089 to 4.385 seconds and 4.997 to 4.358 seconds respectively, including observer overhead. These are bounded host work measurements, not a statistical timing guarantee or guest speedup. Signed Docs `4f770bee4c6a4784b4fcce6ae606d1fc10b328da` documents register provenance and limits. All 45 tests and the 2,377-page manual render pass, with 435,231 word boxes inside page bounds, no final warnings and visual review of the changed page. All 3,001 authored code files remain below 1,000 physical lines. Matching Exsh/Docs CI is pending. Complete source domains, authority closure, executable realms and both complete guest-build generations remain open. Register checkpoint CI — 16 September 2026: Exsh `da8b75c9063c52de2149f2a6c7ed170f720a6c62` is terminal in CI 239/240. Both runs pass 961 Rust tests, all 138 checker tests, strict warning-denied Rust checks and Markdown. All four paired workspace domains pass in each run. The required full-frame gate remains incomplete, with 168/131 unresolved observations on these CI artifacts, so both runs correctly fail overall. Four complete logs total 314,840 bytes and contain no compiler/lint warnings. These CI artifact observations remain distinct from the retained local pairs. Docs `4f770bee4c6a4784b4fcce6ae606d1fc10b328da` passes CI 901/902. Four complete logs total 762,604 bytes; each manual job passes 45 tests and renders 2,377 pages. Initial reference-resolution warnings clear during the normal three LaTeX passes; final renders have zero warnings. The full source/frame proof, coherent catalog adoption, authority closure and both complete confined guest-build generations remain open. Bounded table checkpoint — 16 September 2026: signed Exsh `efb542a3418badef951d01dff24eec88b8490aee` tracks distinct unsigned bounds, original relative bases, signed table offsets and local targets. Exact constants, self-zeroing and zero extension establish numeric premises. Every selected immutable table byte, matching base addition and candidate instruction boundary must be proved before retaining any successor or branch evidence. Numeric/table values cannot authorize function calls. Joins preserve all alternatives and original premises; unknown predecessors and alias/implicit/call clobbers discard facts. All 157 checker tests pass, including complete 256/65,536-entry domains, nonzero and signed read windows, extended register fields, joins, bypasses, loops, width controls and immutable/boundary refusals. Original-byte function/table/base/index/addition audits, formatting, Markdown and canonical checks pass. Final original runtime/all pairs admit two table branches each and retain 164/132 unresolved obligations: two entry branches resolve, while two newly exposed guard-interior conflicts remain. Both workspace mappings and thirteen grounded no-return facts per mode are retained. Full frame/source status remains incomplete with actual exit 1 and unchanged budgets. Initial partial-set exploration is diagnostic negative evidence, not accepted coverage. Profiling identified repeated compilation of fixed stack patterns. Compiling sixteen unchanged patterns once and sharing the existing padding pattern preserves all report decisions and matching operations. One baseline/optimized observation per original pair reduces runtime/all regex-cache lookups from 651,254/627,530 to 135,274/131,391. Profiled times are 5.994 to 5.445 and 5.756 to 5.179 seconds, including overhead and waiting. These measurements establish reduced host work, not a timing guarantee or guest speedup. The final source has a clarified module docstring and separately reconciled complete replay decisions. Every Rust/Cargo/linker/build/workflow byte retains the existing strict matrix; no new Rust build or guest execution is claimed. Signed Docs `242b78c8f35aeaef879f819c670574a4c1d95c3f` explains complete read windows and target-set admission. All 45 tests and the 2,379-page render pass, with 435,421 word boxes inside page bounds, zero final warnings and visual review of both changed pages. All 3,003 authored code files remain below 1,000 physical lines. Matching CI is pending. Explicit flag/guard refinement, full source/frame proof, coherent catalog adoption, authority closure and both complete confined guest-build generations remain required. Bounded table CI — 16 September 2026: signed Exsh `efb542a3418badef951d01dff24eec88b8490aee` is terminal in CI 241/242. Both runs pass 961 Rust tests, all 157 checker tests, strict warning-denied Rust checks and Markdown. Each run completes all four paired workspace domains. The required full-frame gate remains incomplete with 168/131 unresolved observations on the CI artifacts, so both runs fail overall. Four complete logs total 315,234 bytes, with no compiler/lint warnings. No incomplete proof is treated as acceptance. Signed Docs `242b78c8f35aeaef879f819c670574a4c1d95c3f` passes CI 903/904. All four logs are complete (763,044 bytes); each manual job passes 45 tests and renders 2,379 pages. Initial reference warnings clear in the normal LaTeX passes; final renders have zero warnings. An expanded local source/config inventory additionally checks 685 files, bringing the combined physical ceiling audit to 3,688 files, all below 1,000 lines. Flag/guard refinement, source/frame closure, coherent catalog adoption, complete authority review and both full confined guest-build generations remain required. Ordinary comparison checkpoint — 16 September 2026: signed Exsh `4ed392bcc53cb46d0296cecbdd930c8be5cd7c28` replaces the fixed-register table macro with byte-checked CMP/Jcc facts, live comparison lifetime, unsigned/equality edge refinement and sound producer-width widening. A 32-bit comparison never zeroes upper bits. Every complete immutable target set remains mandatory, and numeric/table values cannot authorize function calls. Unknown predecessors, relevant flag/subject writes and unmodeled effects discard conditions. The obsolete dispatch report field is removed. All 176 checker tests pass, including an independent exhaustive interval oracle, high-register dispatch, sign extension, bypasses, conflicting/unknown joins, stale proofs, complete table arms and large arithmetic loops. Independent original-byte audits check 354/321 comparison edges, eleven table branches per mode, protected function loads and thirteen earlier grounded no-return facts per mode. Original runtime/all pairs reach 271/246 functions and retain 158/126 unresolved observations, down from 164/132. Workspace domains pass; full frame/source status remains incomplete with actual exit 1 and unchanged budgets. The audit also reproduces and fixes [terminal-call discovery loss](https://git.erikinkinen.fi/erix/exsh/issues/6). A prior successor diagnostic no longer suppresses recomputation of a revisited call. Three independent controls retain grounded no-return, returning and unknown-target behavior. Original byte/range inspection corrects earlier descriptions of two guard-interior conflicts: these were fallthrough exactly at declared function ends. Padding remains outside those functions; callee names never supply no-return proof. Matching CI remains required before closing the defect. Profiling identified repeated decoder-effect work. Sharing immutable effects only within one function-body analysis reduces runtime/all effect decoding from 72,668/69,784 to 34,499/32,576 and operand parsing from 75,637/72,547 to 37,468/35,339. Complete paired decisions remain identical. Final single paired profiled observations are 6.633 to 6.425 and 6.416 to 6.269 seconds, including overhead and waiting. The final baseline overlaps host test execution, and earlier pairs show timing variability; these diagnostic durations do not isolate a speedup. This establishes reduced host work, not a timing guarantee or guest speedup. Every Rust/Cargo/linker/build/workflow byte retains the existing strict six-configuration 961-test matrix and six native builds. Formatting, Markdown and canonical checks pass. Signed Docs `d8fbc3a1f3696e02954b81f23511cee513ddfa8c` passes all 45 tests and complete 2,379-page rendering: 435,637 in-bounds word boxes, zero final warnings and two visually reviewed pages. The physical audit covers 3,005 authored code files below 1,000 lines. Matching CI is pending. Remaining indirect calls/branches, full source/direct-versus-nested proof, coherent catalog adoption, complete realm authority and both full confined guest-build generations remain required. Comparison checkpoint CI — 16 September 2026: [Exsh CI 243](https://git.erikinkinen.fi/erix/exsh/actions/runs/243) and [244](https://git.erikinkinen.fi/erix/exsh/actions/runs/244) are terminal. All four complete logs total 314,904 bytes with no compiler/lint warnings. Strict Rust checks, 961 Rust tests, 176 checker tests, Markdown and all four workspace domains per run pass. The required full-frame gate remains failed with 163/126 unresolved observations on these CI artifacts; their identities are distinct from the original static replay pairs. No full frame or guest-build acceptance is claimed. [Docs CI 905](https://git.erikinkinen.fi/erix/docs/actions/runs/905) and [906](https://git.erikinkinen.fi/erix/docs/actions/runs/906) pass with all four complete logs (763,056 bytes), 45 tests and 2,379-page manuals. Both final renders have zero warnings after ordinary reference convergence. The terminal-call discovery controls pass in both Exsh runs, resolving the scoped defect in [Exsh #6](https://git.erikinkinen.fi/erix/exsh/issues/6) while the complete emitted-proof defect stays open. The current physical audit covers 3,690 authored source/config files below 1,000 lines; semantic authority and complete private documentation closure remain required. Original unfinished Integration jobs continue under their existing handles. Arithmetic evidence checkpoint — 16 September 2026: signed Exsh `0cdaa8869545308c528f9cf5a2dc165cb286c6ef` and Docs `07181c34b1a20150afe3380977ca5ba70c909b84` are pushed on `feature/posix-compat`. Immediate ADD/SUB now retains exact modular result pieces and derives unsigned/equality edges from carry/borrow and zero. Defined INC/DEC writes establish widths without preserving a stale combined flag condition. Full 64-bit comparisons may use the architectural numeric domain while keeping protected typed identities separate; narrow comparisons still require independent upper-bit proof. Known encoding/text contradictions remain explicit flow errors. All 191 checker tests pass, including independent exhaustive concrete arithmetic and modular-interval oracles, wraparound and authority-negative controls. Original runtime/all artifact pairs admit fifteen table branches each and reach 271/246 functions, with 156/124 unresolved observations. Both workspace mappings pass; actual full-frame exits remain 1 and full source/direct domains remain incomplete. Independent original-byte audits check arithmetic/conditional/table premises, 16/18 protected register edges and thirteen grounded no-return facts per pair. Profiling identified repeated stack-neutral grammar evaluation. A cache scoped to one function reduces those evaluations from 95,643 to 43,169 for runtime and 92,608 to 41,053 for all features, with complete paired report decisions equal. Cached values include refusals and contain no path facts. Timing observations include observer overhead and do not isolate a statistical speedup or guest performance. Formatting, Markdown, whitespace and all 45 Docs tests pass. The 2,379-page manual has 435,808 in-bounds word boxes, zero final warnings and visual review of the changed pages. The physical inventory covers 3,691 authored source/configuration files, all below 1,000 lines. Semantic authority and complete private rustdoc closure remain open. Rust/Cargo/linker/build/workflow bytes are unchanged from the retained strict matrix and classified CI 243/244; new [Exsh CI 245](https://git.erikinkinen.fi/erix/exsh/actions/runs/245)/[246](https://git.erikinkinen.fi/erix/exsh/actions/runs/246) independently reruns those checks. [Docs CI 907](https://git.erikinkinen.fi/erix/docs/actions/runs/907)/[908](https://git.erikinkinen.fi/erix/docs/actions/runs/908) also runs. Matching CI is pending, and no full confined guest build or coherent product-catalog adoption is claimed. Test-import correction and CI classification — 16 September 2026: original Exsh CI 245/246 failed before the frame gate because the arithmetic test could not import its checker module. They attempted 177 tests: 176 passed and one module import failed. The preceding 961 Rust tests and strict build stages passed; all four complete logs total 309,708 bytes with zero compiler/lint warnings. The earlier local 191-test pass used an explicitly supplied PYTHONPATH and did not prove equivalence to the clean workflow. This regression is retained in [Exsh #7](https://git.erikinkinen.fi/erix/exsh/issues/7). Signed correction `12331e26f3bb7a25c0146c8b314eef46dd451099` loads the repository's literal fixture setup before implementation imports in both affected modules. A new regression imports every checker test module in a fresh isolated interpreter; it reproduces both failures before correction and passes afterward. The exact clean workflow command now passes all 192 tests without PYTHONPATH. Formatting, Markdown and whitespace pass. Checker/runtime/Cargo/workflow bytes are unchanged, so the prior original-artifact and profiler evidence retains its exact scope. New [CI 247](https://git.erikinkinen.fi/erix/exsh/actions/runs/247)/[248](https://git.erikinkinen.fi/erix/exsh/actions/runs/248) runs against the corrected source; issue #7 remains open pending matching CI. Docs CI 907/908 now passes with four complete logs totaling 763,024 bytes, all 45 tests and 2,379-page manuals. Both final renders have zero warnings after ordinary reference convergence. Full frame/source proof, coherent catalog adoption and complete confined guest builds remain outstanding. Corrected arithmetic checkpoint CI — 16 September 2026: [Exsh CI 247](https://git.erikinkinen.fi/erix/exsh/actions/runs/247) and [248](https://git.erikinkinen.fi/erix/exsh/actions/runs/248) at signed `12331e26f3bb7a25c0146c8b314eef46dd451099` both pass all 192 checker tests, including the ten isolated module imports, and all 961 Rust tests. The preceding strict formatting/Clippy/documentation/build stages and Markdown pass. All four complete logs total 314,944 bytes with zero compiler/lint warning candidates. This confirms the scoped import correction in [Exsh #7](https://git.erikinkinen.fi/erix/exsh/issues/7). Both runs reach and fail the required full-frame gate. All four workspace mappings per run pass, while the emitted CI pairs retain unresolved counts [161, 161, 124, 124]; these artifacts are distinct from the original static pairs' 156/124 observations. Full source/direct domains remain incomplete, and [Exsh #4](https://git.erikinkinen.fi/erix/exsh/issues/4) remains open. The original import-failed runs 245/246 stay classified and are not relabeled as passing. Docs CI 907/908 passes all 45 tests and 2,379-page manuals with zero final warnings; four complete logs total 763,024 bytes. Signed trees are clean, canonical issue/PR metadata remains applied, and the 3,691-file physical inventory remains below 1,000 lines per authored source/configuration file. Semantic authority and private documentation closure, coherent catalog adoption, runnable realms and both full confined guest build generations remain outstanding. Original unfinished Integration runs continue under their existing handles and budgets. Grounded call-preservation checkpoint — 16 September 2026: signed Exsh `641ac2fc7c3fba3ab351f2863df7e35117b2732a` and Docs `7a7c3ff0095de8f008c9b534fd993554df37f976` are pushed on `feature/posix-compat`. Complete original bodies and earlier callee facts now prove never-written register families. Only existing typed values survive proved calls; live conditions clear. The separate stack-derived rbp fact follows the same rule. This corrects [the reproduced stale-frame defect](https://git.erikinkinen.fi/erix/exsh/issues/8), which stays open pending matching CI. ABI conventions, spill restoration and current kernel behavior supply no preservation mask. All 213 clean-environment checker tests pass, including 21 new controls, eleven isolated module imports and a 1,200-function grounded dependency chain. All six strict Rust feature/profile configurations pass 961 tests each, with host/native Clippy, private rustdoc and six native builds; no warnings. Original runtime/all artifact pairs retain 65/72 protected register edges and 70/77 load origins, reducing unresolved observations from 156/124 to 107/70. Both workspace mappings pass; full source/frame/direct gates retain actual exit 1. Independent audits bind 7,795/7,503 used-contract instructions and complete earlier-proof closure to the original captured bytes. Profiling identified unnecessary empty-state scans and rejected-body suffix work. Removing them preserves every paired report decision and reduces total profiled Python calls from 32,160,478 to 26,673,252 and from 30,880,221 to 25,402,446. Single paired timings include observer overhead; they do not establish statistical or guest performance. Original timer, byte and stack budgets remain unchanged. All 45 Docs tests, formatting, Markdown and canonical checks pass. The 2,379-page manual has 436,058 in-bounds word boxes, zero final warnings and visual review of both changed pages. The physical audit covers 3,693 source/configuration files, all below 1,000 lines. Semantic authority/private-documentation closure, product adoption, complete source/frame admission, runnable realms and both full in-EriX build generations remain open. Automatic CI for both exact signed heads is being followed; local passes are not reported as CI acceptance. Matching preservation CI — 16 September 2026: [Exsh 249](https://git.erikinkinen.fi/erix/exsh/actions/runs/249) and [250](https://git.erikinkinen.fi/erix/exsh/actions/runs/250) are fully classified at `641ac2fc7c3fba3ab351f2863df7e35117b2732a`. Both pass all 213 checker tests, including eleven isolated imports and the stale-frame controls, all 961 Rust tests and preceding strict host/native Clippy, rustdoc and native build stages. Markdown and all four workspace mappings per run pass. The remaining full frame gate fails as required; original CI artifact observations are [[111, 111, 74, 74], [111, 111, 74, 74]]. All four complete logs total 314,995 bytes without warnings. The independently retained local pairs remain 107/70, with their own original identities. [Docs 909](https://git.erikinkinen.fi/erix/docs/actions/runs/909) and [910](https://git.erikinkinen.fi/erix/docs/actions/runs/910) pass at `7a7c3ff0095de8f008c9b534fd993554df37f976`. All four complete logs total 763,088 bytes; both manual jobs pass 45 tests and render 2,379 pages with zero final warnings after ordinary reference convergence. The corrected frame-pointer issue is closed on this matching evidence; the full source/frame issue remains open. No full confined build, runnable realm or coherent product-catalog adoption is established. Native artifact intake checkpoint — 16 September 2026: signed Exsh `d67dcb963f1aa265b13dd0609a5f8488784b5822` admits the retained original/stripped native pair with exact mapped bytes, allocated ownership and complete program contracts. Only absent packaged ordinary symbols are optional. The exact five-byte native entry jump preserves the shell's 8192-byte frame limit. Checked symbolic relocations contribute write footprints, never local targets or library-discovery authority. Code/dynamic metadata mutation, unknown streams, malformed names/links, resolver symbols and invalid relative prefixes refuse intake. All 231 checker controls (18 new) and 12 isolated test modules pass in a clean environment. All six strict Rust configurations pass 961 tests each, host/native Clippy, private rustdoc and six native builds without warnings; formatting and canonical checks pass. Both retained standalone pairs have exactly unchanged proof decisions (107/70 unresolved). The original native pair inventories 1,345 functions, reaches 220, proves workspace mapping and retains 299 unresolved observations, including 102 symbolic-target refusals. The shell entry has 6,864 partially accounted bytes; its incomplete paths do not establish an upper bound. Independent original-byte audit checks all 1,086,955 executable bytes, exactly 154 changed capacity bytes and 627 relative call-load proofs. Full source/frame/direct gates remain incomplete, actual checker exit 1. Native original SHA-256 `879579542895f2f3fbda38972ebaaaf55e05857ffc456342117624a9bc8d24a9` and packaged SHA-256 `183a1a2f1f4192ffd0b9c123ca50d33af6c584940ca51b156198f8822b718feb` retain their original Exsh runtime selection `b12e172e7b266842a8659104894f6821166165fb`. The native producer already retains the original; no duplicate artifact or producer mutation was required. Profiling all three original pairs takes 16.60/16.47/17.02 seconds including observer work under unchanged 60/15-second and 64 MiB budgets. These are individual static observations, not guest performance claims. Signed Docs `12c6d0a91e5e9c5f170d6d0aa7f050dd60e883ef` documents the contract. All 45 tests and a complete 2,381-page manual pass, with 436,247 in-bounds word boxes, zero final warnings and changed-page visual review. The physical inventory covers 3,695 source/configuration files, all below 1,000 lines; semantic authority/private documentation closure remains open. New Exsh CI 251/252 and Docs CI 911/912 are running at their exact signed heads. Complete source membership, native dependency closure, coherent catalog adoption, runnable realms and both full guest builds remain required. Matching native intake CI — 16 September 2026: [Exsh 251](https://git.erikinkinen.fi/erix/exsh/actions/runs/251) and [252](https://git.erikinkinen.fi/erix/exsh/actions/runs/252) are fully classified at `d67dcb963f1aa265b13dd0609a5f8488784b5822`. Both pass 231 checker tests, twelve isolated imports, 961 Rust tests and the strict preceding Clippy/rustdoc/native build stages. All four workspace mappings per run and Markdown pass. The required full frame gate remains incomplete; the CI artifact counts are 111/111/74/74 unresolved observations in each run. Four complete logs total 315,371 bytes, with zero warnings. Retained local standalone and native artifacts keep their own separate identities and 107/70/299 counts. [Docs 911](https://git.erikinkinen.fi/erix/docs/actions/runs/911) and [912](https://git.erikinkinen.fi/erix/docs/actions/runs/912) pass at `12c6d0a91e5e9c5f170d6d0aa7f050dd60e883ef`. Four complete logs total 763,452 bytes; each manual job passes 45 tests and renders 2,381 pages, with ordinary reference convergence followed by zero final warnings. No full source/frame proof, native dependency closure, runnable confined realm or full EriX-in-EriX build is established. A separate original-source relocation calculation defect is now reproduced and tracked with the canonical bug template in [lib-dynlink #2](https://git.erikinkinen.fi/erix/lib-dynlink/issues/2). Its two host failures do not imply a guest regression. All 107 symbol-only relocations in the seven retained native artifacts have zero addends; the supported nonzero-field case still requires correction before broader native binding admission. Closed native dependency intake — 16 September 2026: signed Exsh `9827896d1cb5ad834589045ee03390aec650df84` adds an explicit JSON input contract for one runtime manifest and the exact original/packaged executable and library pairs. Complete file hashes, manifest records, package/feature identities and both needed-name inventories must agree. Only explicit host selectors authorize reads; runtime names and source paths remain data. Inputs share one aggregate byte budget and the original deadline. Library stripping permits only independently checked administrative header selectors, never executable-byte changes. All other mapped bytes, allocated owners, program fields and paired artifact metadata remain identical. Producer source revisions remain unverified claims. The retained native closure binds seven objects, 2,373 ordinary functions and 1,608 relocation records. Intake does not yet resolve symbolic providers or compose cross-library frames. All 259 checker controls (28 new) and 16 isolated modules pass; six strict Rust configurations pass 961 tests each, host/native Clippy, private rustdoc and six native builds with zero warnings. Formatting, Markdown and canonical checks pass. All three retained artifact replays preserve their previous frame decisions: 107/70/299 unresolved observations for standalone runtime/all/native. Full frame/source gates retain actual exit 1. Profiling records 0.181 seconds in native dependency intake and 23.17/25.51/24.59 seconds for the three complete profiled runs, within unchanged 60/15-second and 64 MiB budgets. Concurrent Rust validation changes host contention, so elapsed differences from earlier runs are not a speedup or regression claim. Signed Docs `88537b23e1def210eeff40b7ef90fce92fe2009e` documents this contract. All 45 tests and the complete 2,383-page manual pass, with 436,642 in-bounds word boxes, zero final warnings and visual review of the changed page. An initial double-hyphen ligature was corrected and the full render revalidated. The physical census covers 3,704 source/configuration files, all below 1,000 lines; complete semantic authority and private documentation closure remain open. Exact-head Exsh CI 253/254 and Docs CI 915/916 are running. Symbol providers, ordered runtime binding, cross-object frame paths, source membership, coherent catalog adoption, runnable realms and both complete guest builds remain required. Matching closed dependency intake CI — 16 September 2026: [Exsh 253](https://git.erikinkinen.fi/erix/exsh/actions/runs/253) and [254](https://git.erikinkinen.fi/erix/exsh/actions/runs/254), exact `9827896d1cb5ad834589045ee03390aec650df84`, pass 259 checker controls, 16 isolated imports, 961 Rust tests and the strict preceding build/Clippy/rustdoc stages. All four workspace domains per run and Markdown pass. The required full frame gate remains incomplete, with 111/111/74/74 unresolved observations in each CI artifact set. Four complete logs total 315,052 bytes and contain zero warnings. Original local runtime/all/native replays retain separate input identities and 107/70/299 counts. [Docs 915](https://git.erikinkinen.fi/erix/docs/actions/runs/915) and [916](https://git.erikinkinen.fi/erix/docs/actions/runs/916), exact `88537b23e1def210eeff40b7ef90fce92fe2009e`, pass 45 tests and complete 2,383-page renders. Four complete logs total 763,918 bytes. Reference convergence is 35/1/0 warnings across the three TeX passes, with zero final warnings. Both cohorts are classified without rerunning jobs or changing their budgets. The seven-object native dependency inventory is now checked; symbolic providers, ordered runtime binding, cross-object frames and source membership remain incomplete. No runnable realm, coherent product adoption or complete in-EriX build is established. Ordered native symbol evidence — 17 September 2026: signed Exsh `469bf1f1b9d8301cf98a79d16c7c27660ecda2a1` enforces root-first depth-first discovery order and positional DT_NEEDED agreement, indexes exact strong/weak providers and preserves object-qualified relative function identities. Duplicate strong definitions fail; missing weak symbols remain zero data. S-only relocations ignore addends, while S+A must retain an exact original executable entry. Names confer no file reads and no load bias is invented. All 276 checker tests, 17 isolated modules and six strict Rust configurations (961 tests each) pass, including host/native Clippy, rustdoc and six warning-free native builds. Independent original-byte inventory matches all 117 symbolic records: 112 exact function identities and five refused data targets. Provider indexing/reporting takes approximately 16 ms in the captured native profile. Original standalone runtime/all/native replays preserve 107/70/299 unresolved observations and actual exit 1 under unchanged budgets. This is conditional relative identity evidence only: load-base arithmetic, protected slots, cross-object calls/frames and source membership remain incomplete. Signed Docs `24cefeb2dc6d3f163140d32f5fed5a7e1a768ebd` updates the manual contract. All 45 documentation tests pass; the complete 2,383-page render has 436,737 in-bounds word boxes, zero final warnings and visual review of pages 2284–2285. The physical audit covers 3,706 source/configuration files, all below 1,000 lines. No runtime Rust, dependency, linker or workflow inputs changed. New host/CLI controls cover the analyzer behavior; no new guest feature is asserted. Exsh CI 255/256 is terminal: unit/strict/workspace stages pass, and the required full-frame gate remains incomplete. Docs CI 917/918 passes. Acceptance remains 15/459 leaves, 3.48% weighted. Both full in-EriX builds and the complete semantic authority audit remain open. Ordered-provider automatic CI classification — 17 September 2026: Exsh 255/256 at `469bf1f1b9d8301cf98a79d16c7c27660ecda2a1` passes 961 Rust tests, the combined 276-test checker suite, strict preceding stages and all four workspace domains per run. The required full-frame gate fails with 111/111/74/74 unresolved observations per run. Four complete logs total 315,035 bytes with zero warnings. The 17 separate module executions are local evidence; CI uses combined test discovery. Docs 917/918 at `24cefeb2dc6d3f163140d32f5fed5a7e1a768ebd` passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,878 bytes. Reference-resolution passes produce 35/1/0 warnings; final output has zero warnings and no layout overflow. Original API snapshots remain unchanged. Both cohorts are fully classified, without restarting workflows or changing thresholds. Original Integration layout, quota and FAT32 failures remain open, including #58 in Integration. Acceptance remains 15/459 leaves, 3.48% weighted. Complete native source/frame proof, a runnable realm, the full semantic authority audit and both full in-EriX builds remain required. Protected cross-object frame evidence — 17 September 2026: signed Exsh `ac9646c84e432129a872737789a9be08f984b881` composes the seven explicitly selected native objects using protected relative/symbolic slots and object-qualified function identities. Local control-flow offsets cannot alias a foreign function or transfer the root fallback role. Register facts, grounded preservation/no-return dependencies and route accounting retain the selected object. Every captured decode shares the original output/time budgets; a late failure rejects the invocation. Native reports use schema 3; standalone schema 2 and input schema 1 remain unchanged. All 299 checker tests and 20 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, rustdoc and six warning-free native builds; formatting and Markdown checks pass. Original runtime/all replays retain 107/70 unresolved observations. The composed native graph reaches 275 functions with 111 unresolved observations; all three actual checker exits remain 1. Native slots assume successful checked linking and unchanged disjoint mappings. Actual load bases, complete source/frame acceptance and coherent runtime adoption remain open. Profiling identified redundant root-only analysis in native mode. Removing it preserved every composed decision while one profile changed from 41.52 to 25.81 seconds and 64.37M to 39.61M calls. This host profile pair includes observer overhead and gives no general or guest timing guarantee. The final source replay also preserves every decision; three register-proof records now correctly identify symbolic load provenance. Signed Docs `44cd6c4aa95bebfa08c99804fab0f1551f537ae1` specifies the contract. All 45 documentation tests pass; the complete 2,383-page manual has 436,894 in-bounds word boxes, zero final warnings and visual review of the changed page. All 3,713 inventoried source/configuration files are below 1,000 lines. The broader documentation audit retains 108 unchanged older test definitions needing inline docstrings; current production and all new/modified definitions are documented. Runtime Rust, dependency, linker and workflow inputs are unchanged; added behavior has host and real CLI regressions, with no new guest runtime feature asserted. Original Exsh CI 257/258 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 919/920 passes. Both cohorts are fully classified. Both full builds inside EriX and complete semantic authority acceptance remain open. Cross-object checkpoint CI classification — 17 September 2026: Exsh 257/258 at `ac9646c84e432129a872737789a9be08f984b881` passes 961 Rust tests, the combined 299-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery also checks isolated module imports; the 20 separate module-suite executions are additional local evidence. The required full-frame gate fails with 111/111/74/74 unresolved observations on the four original CI artifact selections. Four complete logs total 315,180 bytes with zero warnings. Those CI selections remain distinct from the retained seven-object native replay. Docs 919/920 at `44cd6c4aa95bebfa08c99804fab0f1551f537ae1` passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,906 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required. Saved-value preservation evidence — 17 September 2026: signed Exsh `8b6b93a329757ae7f106e235761912b58a67deff` derives incoming-register equality through exact full-width copies and owned live stack slots. Original byte decoders bind register, width and address forms. Partial or unknown aliases, conflicting paths, deallocation and reuse invalidate saved facts. Entry tokens carry equality only; they never supply a pointer or call target. A separate earlier callee contract must prove private stack writes before caller slots survive a call. Checked signed bounds and finite dependency order prevent wrapped offsets and recursive assumptions from granting evidence. All 329 checker tests and 22 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, rustdoc and six warning-free native builds; formatting and Markdown checks pass. Independent eager scheduling controls agree with both filtered worklist orders. Original runtime/all/native replays retain 107/70/111 unresolved observations and actual checker exit 1. The native graph still reaches 275 functions. The startup iterator's unknown pointer writes remain a refusal; complete source/frame and runtime acceptance remain open. Two initial native profiles exhausted the original 60-second budget and produced empty reports; both failures are retained. Immutable decode caches, retirement of exhausted equality state, fact-sensitive wakeups and dependency-first scheduling brought the final native replay within the unchanged budget: 57.45 seconds wall time, 53.94 profiled seconds and 72.27M calls. All 2,373 bodies are inspected once. This bounds one retained host replay and makes no general speedup or guest timing claim. Report schemas and original source, stack, byte and time gates are unchanged. Signed Docs `c3401e5f6bbc19a0ba695219ed551e29a29677ed` specifies the contract. All 45 documentation tests pass; the complete 2,383-page manual has 436,968 in-bounds word boxes, zero final warnings and visual review of both changed continuation pages. All 3,717 inventoried source/configuration files are below 1,000 lines. The touched preservation tests now document 21 older methods; 87 unchanged older test definitions remain in the inline documentation audit. Current production and all new/modified definitions are documented. Runtime Rust, dependency, linker and workflow inputs are unchanged; no new guest runtime feature is asserted. Original Exsh CI 259/260 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 921/922 passes. Both cohorts are fully classified. Both full builds inside EriX and complete semantic authority acceptance remain open. Saved-value checkpoint CI classification — 17 September 2026: Exsh 259/260 at `8b6b93a329757ae7f106e235761912b58a67deff` passes 961 Rust tests, the combined 329-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery checks isolated module imports; the 22 separate module-suite executions are additional local evidence. The required full-frame gate fails with 111/111/74/74 unresolved observations on its four original CI artifact selections. Four complete logs total 315,234 bytes with zero warnings. These CI selections remain distinct from the retained seven-object native replay. Docs 921/922 at `c3401e5f6bbc19a0ba695219ed551e29a29677ed` passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,958 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required. Caller-bound stack preservation — 17 September 2026: signed Exsh `e7ba974e96ee77a41c6a861150da843d4c84c7d6` binds formal GP arguments to independently proved live caller stack intervals. Exact callee write spans preserve return-address gaps and invalidate every overlapping save. Scoped masks never enter the unconditional function index; loaded words, unknown contents, released storage and recursive assumptions supply no binding. Byte-checked SETcc writes exactly one unknown byte. All 355 checker tests and 23 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, private rustdoc and six warning-free native builds. Formatting, templates and Markdown pass. Original runtime/all/native replays retain 97/60/97 unresolved observations and actual exit 1. The native graph reaches 275 functions; the startup iterator now has caller-bound preservation for its exact live buffers. Complete source/frame and runtime acceptance remain open. Profiling exposed repeated failed argument specializations. Mandatory opaque-prefix refusals, conservative GP demand and rejection-only control candidates avoid unnecessary interpretations without changing the original 60-second limit. Candidate records cannot become proofs, and incompatible fact kinds defer to actual interpretation: losing pointer identity can enable numeric refinement. Positive and negative controls compare filtered and eager behavior. Each CFG site has at most one pending visit and later changes still enqueue it without an iteration cap; every native proof decision agrees with the prior queue. The final ordinary native replay takes 39.80 seconds. Complete tracing still exhausted the original deadline; failures and empty reports are retained. A separately identified selective profile measures only caller-context analysis: the complete invocation takes 56.59 seconds, with 26.92 profiled seconds in that scope. Instrumentation preserves the complete proof result. Different profiling scopes are not timing comparisons, and no guest performance claim is made. The replay selects 367 instances, evaluates 587 bodies, proves 190 and defers 51 candidate bodies for incompatible domains. Signed Docs `fc3ee44748c20a3aa6f55bd85ac1913c707e5d4e` specifies these contracts. All 45 documentation tests pass. The complete 2,385-page manual has 437,275 in-bounds word boxes, zero final warnings and visual review of the changed pages. All 3,721 inventoried source/configuration files are below 1,000 lines. All new/modified definitions are documented; 87 unchanged older test definitions remain in the audit. Runtime Rust, dependencies, linker and workflow inputs are unchanged. Original Exsh CI 261/262 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 923/924 passes. Both cohorts are fully classified. Complete semantic authority acceptance, coherent runtime adoption and both full builds inside EriX remain required. Caller-bound checkpoint CI classification — 17 September 2026: Exsh 261/262 at `e7ba974e96ee77a41c6a861150da843d4c84c7d6` passes 961 Rust tests, the combined 355-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery checks isolated module imports; the 23 separate module-suite executions are additional local evidence. The required full-frame gate fails with 101/101/64/64 unresolved observations on its four original CI artifact selections. Four complete logs total 315,210 bytes with zero warnings. These CI selections remain distinct from the retained seven-object native replay. Docs 923/924 at `fc3ee44748c20a3aa6f55bd85ac1913c707e5d4e` passes 45 tests and the complete 2,385-page manual. Four complete logs total 764,350 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required. ## Tracking Owning component: Exsh build validation; component audit #2 and [PR #3](https://git.erikinkinen.fi/erix/exsh/pulls/3). Current signed checkpoint: `453641cd19eaa7c85a8f6693363f8660c792ed73`. Acceptance requires proof of the actual optimized paths while preserving existing stack limits. Renamed, outlined or inlined code needs actual artifact and path evidence. Missing evidence and excessive stack use must still fail. Changing closure spelling or deleting the missing function requirement cannot establish the direct-chain bound. The issue remains open until the complete proof is established. Original terminal-accounting graph validation — 21 September 2026: Signed [0d5d5ad9aff082ca75ec79dbc9c29d73f799d8ed](https://git.erikinkinen.fi/erix/exsh/commit/0d5d5ad9aff082ca75ec79dbc9c29d73f799d8ed) adopts the original shared terminal-observation, exact-acknowledgement and final-CPU dependencies. Both development configurations pass 976 Rust tests; all four host/native Clippy, warning-denied host/native build, applicable doctest and private-rustdoc selections pass. All 355 checker controls pass. The shell implementation and release optimization/LTO policy are unchanged. The new graph independently retains two release unit-test compilation failures: `cargo test --locked --offline --release --all-targets` stops at 126.117857 seconds and `cargo test --locked --offline --all-features --release --all-targets` at 120.024146 seconds. Both reach the existing 120-second silence bound within the 600-second hard bound; the child exits on signal 15, the owner reports status 124, and cleanup succeeds. No release unit test executes. These are new original-graph observations in [compiler regression 9](https://git.erikinkinen.fi/erix/exsh/issues/9), with all prior failures retained. The cause needs an actual compiler profile; no optimization, LTO or deadline setting was relaxed. Actual runtime and all-feature PIC artifacts are checked in both deployment profiles using the maintained frame configuration. All four reports return incomplete proof (exit 1), with 97 unresolved routes for runtime and 63 for all features. Workspace mapping passes separately. The original ELF and packaged artifact digests, selected tool/helper identities and failed reports remain retained. [Frame regression 4](https://git.erikinkinen.fi/erix/exsh/issues/4) stays open. Original CI [275](https://git.erikinkinen.fi/erix/exsh/actions/runs/275)/[276](https://git.erikinkinen.fi/erix/exsh/actions/runs/276) is being observed without restart. The [WIP PR](https://git.erikinkinen.fi/erix/exsh/pulls/3) awards no complete runtime or self-hosting acceptance. Actual service CPU/profiler VMs, complete authority/source/effect/frame proof, native external Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain required in [Phase 6 completion](https://git.erikinkinen.fi/erix/integration/issues/65). Original terminal-graph CI classification — 21 September 2026: Signed `0d5d5ad9aff082ca75ec79dbc9c29d73f799d8ed` reaches actual analysis in both original CI [275](https://git.erikinkinen.fi/erix/exsh/actions/runs/275)/[276](https://git.erikinkinen.fi/erix/exsh/actions/runs/276). Each passes 976 unit tests and 355 checker controls before the required frame gate fails. Each run retains four incomplete reports: 101 unresolved runtime observations in both profiles and 68 all-feature observations in both profiles. All four workspace mappings pass separately. These CI artifact observations differ from local 97/63 results and are not interchangeable proof. All four terminal logs are complete and hash-verified (319,902 bytes), with zero warnings. The disassembler intake correction reaches the real proof boundary; [tool-selection issue 5](https://git.erikinkinen.fi/erix/exsh/issues/5) is resolved. [Complete frame issue 4](https://git.erikinkinen.fi/erix/exsh/issues/4) and [local release compiler issue 9](https://git.erikinkinen.fi/erix/exsh/issues/9) remain open. No workflow restart, bound change or conversion of incomplete evidence to a pass occurred.

erikinkinen added the

bug

ci

phase-6

labels 2026-09-12 13:31:29 +02:00

erikinkinen referenced this issue 2026-09-12 13:31:30 +02:00

WIP: Bind shell workspace and cleanup frame evidence #3

erikinkinen referenced this issue 2026-09-12 15:28:36 +02:00

[BUG] Cleanup-frame CI selects a disassembler symlink rejected by intake #5

erikinkinen referenced this issue from a commit 2026-09-15 20:16:08 +02:00

fix: Account for guarded relative dispatch frames

erikinkinen referenced this issue 2026-09-16 04:06:28 +02:00

[BUG] Terminal call revisit drops callee discovery after a boundary issue #6

erikinkinen referenced this issue 2026-09-16 04:59:42 +02:00

[BUG] Checker test imports depend on discovery order and caller Python path #7

erikinkinen referenced this issue 2026-09-16 05:10:28 +02:00

[FEATURE] Audit authority, code quality and documentation in exsh #2

erikinkinen referenced this issue from erix/integration 2026-09-16 05:10:34 +02:00

[FEATURE] Freeze the complete source, build, ABI and self-hosting inventory #1

erikinkinen referenced this issue from erix/integration 2026-09-16 05:10:35 +02:00

WIP: Coordinate native authority, shell workspace and source transport #12

erikinkinen referenced this issue from erix/docs 2026-09-16 05:10:36 +02:00

[FEATURE] Enforce complete inline documentation and warning-free documentation builds #1

erikinkinen referenced this issue from erix/docs 2026-09-16 05:10:37 +02:00

WIP: Document native authority and verify workspace and command evidence #4

erikinkinen referenced this issue 2026-09-16 05:33:21 +02:00

[BUG] Frame checker retains unproved frame-pointer values across calls and syscalls #8

erikinkinen added the

performance

label 2026-09-16 06:27:11 +02:00

erikinkinen referenced this issue from erix/lib-dynlink 2026-09-16 06:34:09 +02:00

[BUG] Symbol-only relocations incorrectly apply the RELA addend #2

erikinkinen referenced this issue 2026-09-21 19:53:35 +02:00

[BUG] Release shell unit-test compilation exceeds the bounded silence deadline #9

erikinkinen referenced this issue 2026-09-21 20:28:17 +02:00

[FEATURE] Complete native shell/build utilities and provide help and offline manual pages #1

erikinkinen referenced this issue from erix/integration 2026-09-21 20:35:47 +02:00

[FEATURE] Track Phase 6 POSIX compatibility and full EriX self-hosting #65

erikinkinen referenced this issue from erix/integration 2026-09-21 20:54:15 +02:00

[FEATURE] Audit authority, code quality and documentation in integration #11

erikinkinen referenced this issue from erix/integration 2026-09-21 20:54:16 +02:00

WIP: Coordinate native authority, shell workspace and source transport #12

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

feature/posix-compat

feature/native-cli

No results found.

Labels

Clear labels

  

bug

Something is not working

  

ci

  

docs

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

performance

Measured performance profiling, bottleneck analysis, and regression budgets.

  

phase-6

Phase 6: POSIX compatibility, full EriX self-hosting, and its required audits and validation.

  

question

More information is needed

  

refactor

Code cleanup, removal of obsolete paths, and structural improvements preserving behavior.

  

security

  

wontfix

This won't be fixed

No labels

bug

ci

docs

duplicate

enhancement

help wanted

invalid

performance

phase-6

question

refactor

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

erix/exsh#4

No description provided.