[FEATURE] Freeze the complete source, build, ABI and self-hosting inventory #1

New issue

Open

opened 2026-09-12 07:56:21 +02:00 by erikinkinen · 0 comments

erikinkinen commented 2026-09-12 07:56:21 +02:00

Owner

Copy link

Problem and motivation

A full in-EriX build needs an explicit inventory of every product, generator and runtime dependency. POSIX and toolchain work otherwise risks targeting a small demonstration while leaving image assembly or documentation dependent on an external host.

Proposed behavior and scope

Caller-owned transport scratch — 15 September 2026

Move both full-capacity shell transport buffers into the authenticated caller-owned workspace: ordinary message I/O and the descriptor transaction's emergency cleanup. The current descriptor state is exclusively borrowed while a transaction lives, so the transaction can borrow its cleanup slice directly. No global scratch lookup, shared mutable cell, runtime lock or new capability is needed. Remove the unsafe static message accessor and the 32 KiB automatic cleanup array. Preserve the 64 KiB process stack and all current upper stack ceilings.

Group descriptor backing storage explicitly at startup, validate cleanup capacity and clean bytes before constructing effectful state, and keep the cleanup slice disjoint from ordinary transport, history and other arenas. A transaction temporarily borrows that slice, retires providers in the existing order, erases the full borrowed extent and returns the borrow; explicit restore and already-retired resolver paths retain their existing behavior. Failure and uncertain ownership must retain their existing fail-stop rules. Do not introduce shared aliases or fallback storage.

Coordinate target and image-builder layout version 22. Export the target transport-array size/alignment in the layout description, allocate both buffers in identical typed carve order, and reject old or mixed descriptors. Preserve caller resource policy and complete transport capacity; this is an ownership/layout change, not a smaller-message workaround. The frame inspector must eventually bind the full workspace reservation instead of requiring a now-removed stack array, while still rejecting unproved ordinary-source and direct/nested bounds.

Required evidence includes clean/short/dirty scratch, canary/erasure/reuse, early error, explicit restore, handoff, uncertain cleanup and existing shell regressions; exact target/producer layout agreement and old-version refusals; strict warning-denied Rust/helper matrices; actual optimized frame inspection; and relevant bounded runtime VMs before product acceptance. Keep the complete frame gate and full self-hosting criteria open until their own evidence exists.

Staged construction without root capabilities — 15 September 2026

Add kernel-control operation 54, CREATE_STAGED_PROCESS_WITHOUT_ROOT_CAPS, and checked StagedProcessWithoutRootCapsV1 scalar framing. Successful creation returns a live Created process and nonzero generation whose CSpace contains exactly its requested primary endpoint, with no CNode, VSpace or TCB capabilities. Native CSpace/TCB/VSpace objects and the process's VSpace lifetime reference still exist. No child code executes during construction. The endpoint initially retains its ordinary full endpoint rights; operation 53 independently narrows it before bootstrap execution.

Keep the existing creation operation 32 and its producer behavior unchanged. The new selector is independently recognized: an older kernel refuses it, and callers must not fall back to old ignored flags or a child self-report. Admit it only on the existing Process endpoint family, without adding a capability type, endpoint factory or ChildPopulate creation authority.

Use the existing fixed request envelope. arg0 contains the caller-local install-grant destination in its low 32 bits; its upper half is zero. arg1 low/high halves contain child-local primary endpoint and caller-local endpoint-master destinations. arg2 low/high halves contain the child window base and optional caller-local VSpace destination. arg3 contains the 32-bit window length, with a zero upper half. Flag bit 0 means that the VSpace receipt is requested; all other flag bits are zero. When the bit is clear, arg2's upper half must be zero. This explicit presence bit distinguishes an omitted receipt from a real receipt in slot zero. All slot fields retain their full unsigned width; slot zero and otherwise vacant former root positions are ordinary requested slots, subject to native bounds, actual caller-window visibility and occupancy. The checked codec validates framing, not native capacity or authority. The native constructor requires a valid child window containing the primary endpoint.

The caller receives only its actual unique stage-bound install grant, endpoint master and optional MAP-only VSpace receipt. The grant is bound to the returned process/generation and exact child window. Existing capability ceilings, actual object identity and explicit disposal rules remain in force. Temporary native setup bindings must be gone before constructing the final primary endpoint and publishing the grant; otherwise former root positions would remain an unnecessary destination restriction. The TCB's independently held VSpace reference must keep backing alive even without any child or parent VSpace capability.

On failure, destroy the partial child and dispose only successfully created parent receipts. Preserve pre-existing or overlapping destinations and the original failure; uncertain cleanup fail-stops. Never treat a requested slot as evidence that its capability was created. The new contract supplies an initial inventory, not a permanent prohibition on later explicitly authorized installations or a sealed realm. The returned grant remains a real pre-start population authority that its owner must account for and retire.

Required checks include full-width codec/reserved-field cases, omitted versus slot-zero VSpace receipts, zero/former-root/last-slot endpoint destinations, invalid or inaccessible windows, occupied/overlapping outputs, exact parent and child inventories, no residual native objects, mapping/startup backing retention, attenuation through the actual grant and abort/terminal cleanup. Actual CPL3 creation/refusal/disposal must complement host tests. Procd adoption must select this operation only for the mediator role and preserve all ordinary start gates until authenticated grant return, minimum typed startup, retained native/nested guards, readiness, configuration/seal and fair retirement are independently implemented. No runnable realm or guest build is established by this constructor alone.

Inventory the repository and target graph, create the required components from meta, freeze the tool/API workload and authority model, and define the complete two-generation acceptance contract. Include firmware, signing, manuals, console/input behavior and all four image profiles.

This issue records planned work; its unchecked criteria are not implementation proof. The normative basis is Phase 6 and AC1–AC24.

Authority, security and reliability

Define trusted owners and capability ceilings before implementation. POSIX metadata and ABI identifiers remain descriptive, resource budgets come from workload evidence, and immutable source selection uses full commit hashes. The inventory cannot authorize release promotion.

Apply the priority order: security, reliability, then performance. Keep suspected vulnerabilities in the repository’s restricted SECURITY.md reporting channel.

Acceptance criteria

• Inventory all existing repositories, nested Cargo workspaces and crates, targets,
  profiles, feature combinations, scripts and maintained tests. Record repository paths,
  remotes, exact heads, dirty state and build ownership.
• Record/create feature/posix-compat before each repository's first edit; verify
  exact dependency pins and signed ancestry from the accepted base.
• Verify whether lib-posixabi, lib-cstd and posixd already exist remotely before
  creating absent repositories in Forgejo from meta, then cloning. Record the
  existence/template/clone result for each of these three required components.
• Scaffold those three components with explicit responsibility and authority
  boundaries, rustdoc, strict CI, tests and specialized canonical docs. Keep import
  recipes/profiler in Integration; do not invent extra daemons/repos without a concrete
  ownership need and recorded design review.
• Add new components to Integration's commit-pinned catalogs and immutable dependency
  policy; validate the exact transitive source graph.
• Freeze a machine-readable full-build output inventory: every maintained EriX
  crate/library/binary, kernel, EFI bootloader, native build tools, boot image, dynamic/launch
  metadata, four image profiles and release manifests.
• Inventory all canonical generators, documentation/manual outputs,
  checksums/compression/signing steps and their host executables. Include these in the in-EriX
  build closure; distinguish external test execution from building.
• Record the build-host versus emitted-target matrix: EriX-hosted tools and
  compatibility libraries for x86_64-unknown-erix, plus the existing bare-metal and UEFI
  targets needed to rebuild the OS. Do not rewrite native target ABIs merely to make imported
  tools run.
• Produce an API/workload matrix from the exact intended Rust/LLVM, Cargo, Python,
  Git, shell, image and documentation recipes; map every required call/ELF feature to an owner,
  implementation item and independent test.
• Define the POSIX specification edition/profile, C ABI/data model, locale baseline
  and optional extensions. Mark unsupported optional surfaces explicitly; never claim full POSIX
  certification from a selected build workload.
• Resolve/document the existing Phase 6 close-on-exec-by-default policy versus
  standard descriptor inheritance expectations. Preserve native authority ceilings; specify any
  compatibility deviation before implementation.
• Approve the architecture/threat model for posixd isolation, process mediation,
  TLS, fork snapshotting, signal delivery and build realms. Enumerate trusted components and
  keep POSIX policy out of the kernel/rootd.
• Fix per-scenario resource budgets and progress/deadline contracts from measured
  workloads; distinguish ABI/hardware bounds, authorized quotas and accidental hard-coded
  limitations.
• Define exact self-host success/failure criteria and evidence schema before
  implementation: source-only inputs, no host build delegation, two clean in-EriX builds,
  deterministic artifacts, boot result and authority-negative tests.
• Extend inventories with rootfs authority-bearing files/signatures, firmware trust
  enrollment, native build-tool targets, man/help coverage and console/input interfaces; assign
  each an owning public issue and acceptance test.
• Record v1.0.0-alpha.1 as the intended manually reviewed release baseline,
  coordinating platform/component version policy without premature version bumps, tags, PR
  readiness or release publication.

For each implementation slice, retain actual formatting, strict Clippy, unit/doctest and warning-denied build results for all altered Rust repositories and valid configurations. Add relevant runtime VM coverage, monitor older unit/VM regressions in exact-head CI, and update canonical component documents and affected technical-manual/API material. Every authored code file must remain below 1,000 physical lines, with meaningful inline documentation and missing_docs enforcement in Rust crates.

Alternatives and tradeoffs

A target-triple-only port or single-crate smoke test leaves compiler-host APIs and packaging helpers unresolved. Freeze the actual required graph, while explicitly recording optional POSIX surfaces and later-phase non-goals.

Validation checkpoint — 14 September 2026: Signed Integration 7cc0593e101b2e0ca42f24d4fa189dd96cb1455c passes all 159 helper suites, the strict four-selection Rust matrix (320/321 units) and all 87 original Rootd feature selections from failed CI 1603/1604. Both final native VMs pass unchanged exit/marker rules with empty stderr. The lifetime image is 2,150,400 bytes, SHA256 7d8b99684110d38dd77d2be297f1d896d7bb94a2f60dc5a3ee3dcab06cea2c76; the ordinary Rootd image is 27,934,720 bytes, SHA256 3868790fac953843c62e3674ef149dc55e4502e5118212fcc95d1aef875cf1a0. Original compiler, runtime-import and entry-argument failures remain retained. Full CI 1605 and 1606 is running; no full-catalog pass is claimed.

Allocator validation checkpoint — 14 September 2026: Signed Integration a869a81eb406a4f027a2b5db573b6330ca114d94 selects both final source graphs and passes all 159 helper suites plus strict 320/321-unit development/release default/all Rust matrices. The final ordinary Rootd IPC-framing VM passes in 45.832335 seconds and the native distinct-argument/lifetime VM passes in 13.026853 seconds, under unchanged exit/marker/deadline rules with empty QEMU stderr. These are host build-and-run durations. The ordinary image is 27,934,720 bytes, SHA256 2a187127696d569ae5c627d9c1d154ad53c024e98d9a181dbb6006790f01a0cc; the lifetime image is 2,142,208 bytes, SHA256 8fa4c7512a5916a51ba956b1e55c84ac2945c2580ff9556c99c27cbaa6e3321d. Its final image, ELF and EFI bytes equal the preceding validated feature-tree artifacts. Older full CI 1605/1606 is still running; new 1607/1608 is waiting. No full-catalog pass, realm implementation or full guest build is claimed.

Endpoint construction checkpoint — 14 September 2026: Signed Integration 989d44d604d07c4c9bcc23264912bdf2076b99eb selects both endpoint-construction graphs with their original dependency objects. Fresh strict Rust checks pass 320/321 units in all four selections, doctests, private rustdoc and freestanding builds. The previous 159-helper result is reused only for unchanged helper implementation sources; changed catalog/scenario contracts are rechecked. The original Rootd IPC-framing VM passes in 45.868135 seconds and native lifetime/distinct-argument VM in 21.529775 seconds, with unchanged oracles and empty QEMU stderr. These are host build-and-run durations. The ordinary image is 27,934,720 bytes, SHA256 184a636fb1aec40bcefc04bbd23e4884c742f12ec2400428f40c88d597499dda; native image is 2,150,400 bytes, SHA256 616b6f18f9b47c5aefaae83f288284b5ab2f31242fc422cced8233f0dea490e8. Completed older Integration 1605/1606 at 7cc0593e101b2e0ca42f24d4fa189dd96cb1455c each reports 485 passes and one failure across all 486 scenarios. The sole failed scenario is the existing ext4 quota timeout tracked in #18. All six complete logs total 27,546,527 bytes with zero warning candidates; Rust and Markdown pass. There are no VM-worker dependency-feature compiler failures. Subsequent dependent image and terminal gates remain unestablished. The allocator cohort 1607/1608 is running; current endpoint-construction cohort 1609/1610 is waiting.

Completed CI checkpoint — 15 September 2026: Signed Integration a869a81eb406a4f027a2b5db573b6330ca114d94 passes both 1607/1608; signed endpoint-construction checkpoint 989d44d604d07c4c9bcc23264912bdf2076b99eb passes both 1609/1610. Each run reports all 486 distinct VM scenarios passing, followed by the actual native lifetime scenario, physical/serial interactive checks and all four console modes. Rust and Markdown pass. The two six-log cohorts contain 26,769,289 and 26,769,316 bytes respectively, with zero warning candidates. The previously observed intermittent quota timeout remains documented without a causal-fix claim. These results establish the selected source checkpoints, not owned invocation transport, complete authority closure or either full in-EriX build generation.

Native transfer preparation checkpoint — 15 September 2026: Signed Integration 97651e7289c23560d21cf6c41effa405c97bc80d selects both original Kernel source graphs. Fresh strict Rust checks pass 320/321 units across default/all development/release, doctests, private rustdoc and freestanding builds. The prior 159-helper result is reused only for unchanged helper implementation sources; changed catalog, scenario and native lifetime policy checks pass again. The actual Rootd IPC-framing VM passes in 54.851098 seconds and native lifetime/distinct-entry-argument VM in 21.601175 seconds, with unchanged oracles, clean process teardown and empty QEMU stderr. These are host build-and-run durations. The ordinary image is 27,951,104 bytes, SHA256 1aadb6a82edf2be056254365b94ba659210c076374b321384223c219ef499fcb; native image is 2,158,592 bytes, SHA256 95d0501b2164a4bd34e307347e174451fc9f05e49cd0d9477961c5c8f663e127. The 62-capability allocation-rejection controls execute against actual kernel objects on the host; these VMs validate the existing IPC/lifetime paths. All four completed Integration workflows 1607, 1608, 1609 and 1610 pass all 486 scenarios, the later native lifetime and interactive gates, and all four console modes. The two complete cohorts total 26,769,289 and 26,769,316 bytes with zero warning candidates. The existing intermittent quota timeout remains open in Integration issue 18; later successful runs do not establish its cause or a causal fix. Current transfer-preparation workflows 1611/1612 are running; their full-suite acceptance is pending.

Native invocation custody checkpoint — 15 September 2026: Signed Integration 660cdd99a5e9b36f88b21aaed6391569e0161926 selects this Kernel in its isolated native catalog while preserving the ordinary service graph at original Kernel d2438c7e56c964a9c16720586cf718ec11e7cc0a. The existing native lifetime and distinct-entry-argument VM passes unchanged oracles in 24.878415 seconds of host build-and-run time, with clean teardown and empty QEMU stderr. Its 2,207,744-byte image has SHA256 9fcdc589f4eb598978095e69122589f51a9bd8c841523a8004094ec288dd6be0. This validates existing behavior through the changed lifecycle hooks, not the absent owned-invocation syscall interface. Fresh Integration strict default/all development/release checks pass 320/321 units, private rustdoc and freestanding builds. All 159 prior helper-command results are reused only after source equality outside catalogs and roadmap; changed catalog/scenario/native-policy checks pass again. Full Integration 1613/1614 at the new catalog are waiting at their first observation; predecessor 1611/1612 remains running at its fourth observation. All four older 1607–1610 workflows passed 486/486 scenarios, later native/interactive checks and all four console modes. The existing intermittent quota timeout in Integration issue 18 remains open with unknown cause; later passes do not establish a causal fix. Corrected signed-head Kernel CI 548/549 and Docs 859/860 pass. All 8 complete logs total 1,413,966 bytes, with zero final warnings. The terminal cohort is classified. The syscall wire adapter, fresh userspace buffer/fault/overlap validation, authenticated caller-origin delivery fields and actual CPL3 owned-invocation peers remain unimplemented. Reachable backend disposal-failure coverage, sustained invocation-workload profiling, realm producer adoption, whole-codebase authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire record is assigned; the existing CALL/RECV/REPLY ABI is unchanged.

Authenticated delivery-origin checkpoint — 15 September 2026: Signed Integration 73924191bb6f9e9c9c740240fca957936360bba5 selects this Kernel only in the isolated native catalog. The unchanged lifetime and distinct-entry-argument VM passes in 23.292658 seconds of host build-and-run time, with clean teardown and empty QEMU stderr. Its 2,207,744-byte image has SHA256 d20f1b859228afbbf671c2c484efb24f2c1dd6d8e8d7c32f4560f33206b97df9. This is existing-path regression coverage; new owned-invocation CPL3 peer acceptance still requires a wire adapter. Exact source comparison preserves the preceding strict 320/321-unit Rust matrices, private rustdoc, freestanding builds and 159 helper-command results. Changed catalog/scenario/native policies pass again. The ordinary service graph and original dependencies remain unchanged. Kernel CI 550/551 and Docs 861/862 pass. All eight complete logs total 1,414,891 bytes, with zero final warnings; the cohort is classified and stopped. The separate earlier fixture correction remains closed in Kernel issue 13, preserving original CI 546/547 and corrected 548/549. Full Integration 1615/1616 is waiting at its first observation. Predecessor 1613/1614 is waiting at its second observation; 1611/1612 remains running at its fifth. Older complete 1607–1610 successes remain distinct from the unresolved intermittent quota timeout in Integration issue 18. Sustained invocation-workload profiling, syscall wire and fresh-buffer/fault/overlap validation, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm producer adoption, whole authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire layout is assigned. Native progress and cleanup still do not certify application cancellation.

Native invocation profiling baseline — 15 September 2026: Signed Kernel 6cb703e1ed8b9de0d29a37189cd914cd501e732e provides an actual-object host workload for queued progress, collected progress, descriptive result reads and complete request/result cycles. Signed Integration f3e4359b34cb8f7db732fbf38823f722553c86d4 adds bounded capture, raw-evidence report verification and equivalent comparisons. Every sample checks exact bytes and SEND capability bindings, authenticated origin, foreign selection, duplicate completion refusal, FIFO position reuse, one-time collection and final invocation disposal. Source and executable bytes are observed against explicit original identities; compiler/host relationships remain declarations. Workload children and source Git reads receive minimal environments; capture owns memory, time, output and process cleanup. Completion is published only after deadline teardown succeeds. The operator guide and signed Docs 644273a0edd91e4c38dcd4418d6ae1119ff1f10b describe these boundaries. Kernel strict default/all development/release checks pass 632/656 units plus three standalone controls, three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. Integration passes all 161 helper commands, including 19 profiler controls and nine source-provenance controls, plus fresh strict 320/321-unit Rust matrices, private rustdoc and warning-free target builds. Four original socket-fixture failures are retained and attributed to the selected temporary directory exceeding the host Unix-socket path domain; a shorter explicit private directory passes the same fixtures. Docs passes 45 tests and renders 2,345 pages with zero final warnings; 427,592 word boxes fit page bounds and changed pages 2284/2285 pass visual review. Kernel CI 552/553 and Docs CI 863/864 pass; eight complete logs total 1,431,762 bytes with zero final warnings after manual reference convergence. The original signed Kernel baseline retains 48 measured samples and 16 checked warmups: four modes, populations 0/32/128/512, 256 operations per sample, three measured repetitions and one warmup. A single selected host CPU is used after local build/test work completes; external host scheduling is not isolated. At population 512, operation medians are 117,577.723 ns for queued progress, 8,927.977 ns for collected progress, 9,124.098 ns for descriptive reads and 1,167,847.016 ns for complete cycles. At population zero they are 223.328, 166.199, 213.137 and 4,556.867 ns respectively. Every raw sample, process disposition and final native cleanup passes. Timings include fixed semantic checks; no cost is subtracted and no ratio is a pass threshold. Source review identifies repeated carrier-binding scans during full registry refresh and a registry-lock acquisition for every inactive settlement position. The next bounded change will retain only non-authoritative numeric search positions: every fast path must still check current capability type/rights, endpoint identity/in-use state and exact CSpace/slot binding, with complete lookup on a stale hint. Existing revocation and terminal hooks remain authoritative. Settlement may scan for the next draining owner under one lock while retaining the original pass boundary, increasing index order, busy-position exclusion and allocation-free stack-owner return; disposal remains outside the table lock. Original workload bytes and sample policy must remain unchanged for comparison. The older Integration CI 1611/1612 succeeds at all 486 catalog scenarios, native lifetime, interactive directory/editor and four console modes. Six complete logs total 26,771,244 bytes with zero warnings; this does not resolve the intermittent quota cause tracked in Integration issue 18. Integration 1613/1614 is running, 1615/1616 is waiting, and current profiler CI 1617/1618 is waiting. No completed cohort is polled again. No Kernel performance algorithm has changed in this baseline. Native syscall adapters, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The 76-repository inventory has 2,923 code files below 1,000 lines and 155 direct missing_docs crate-root gates; this does not close the semantic audits.

Measured native invocation lookup refinement — 15 September 2026: Signed Kernel 8349d68636382cc7e25a3347f5f1df216554203a retains only numeric carrier-search positions. Every use rechecks the actual CSpace capability type/rights, live endpoint identity and exact binding; stale positions take the complete search path. No successful authorization, capability or reference is cached. Draining scans fix their boundary on the first poll, visit each position at most once, skip busy stack owners and return exclusive custody after unlocking. Native disposal and first-failure retention preserve their existing semantics. Signed Integration 108501cf7ec20f05dd3d62ea401ea8adad6c6e9c selects this Kernel in its isolated native catalog, and signed Docs f10a1d375a326543ec0adda4569bc7cb4faca9b6 documents the invariants. The existing syscall ABI and ordinary image catalog are unchanged. All 15 actual-object native controls pass, including real alias compaction, rights/type/object replacement, busy ownership and allocation-free settlement. The unchanged four-mode workload control also passes. Full strict default/all development/release Kernel matrices pass 634/658 units plus three standalone controls, with three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. The existing native lifetime and entry-argument VM passes unchanged oracles in 21.978041 seconds of host build-and-run time, with clean teardown and empty QEMU stderr. Its signed boot image is 2,207,744 bytes, SHA-256 4030cdfb8a13c000ff4716ecdc5203cb46273d6117a282f7375f25dccbbeedc9. Exact unchanged Integration Rust/helper bytes preserve the preceding strict 320/321-unit matrices and all 161 helper-command results; changed catalog/scenario policies pass. Docs passes all 45 tests and a complete 2,345-page render with zero final warnings, 427,679 bounded word boxes and visual review of page 145 plus continuation page 146. The original signed Kernel 6cb703e1ed8b9de0d29a37189cd914cd501e732e and the new signed Kernel use byte-identical workload sources, the same selected CPU/toolchain/context and explicit limits, distinct source targets, four modes, populations 0/32/128/512 and 256 operations per sample. Each capture retains 48 measured samples and 16 warmups; every sample passes actual semantic and native/process-cleanup checks. At population 512, median queued-progress cost changes from 117.578 to 37.673 microseconds (3.12x observed ratio), and full-cycle cost from 1167.847 to 443.055 microseconds (2.64x). Collected progress changes from 8.928 to 6.015 microseconds and descriptive reads from 9.124 to 6.212 microseconds. Timings include fixed checks, with no subtracted overhead or timing-ratio pass gate. No managed build/test workload runs concurrently during capture; external host scheduling remains unisolated. These are host operation wall times, not guest startup/build acceptance or a statistical guarantee. Kernel CI 554/555 succeeds; four complete logs total 679,280 bytes with no warnings, and its completed cohort is stopped. Docs CI 865/866 succeeds at observation three; four complete logs total 754,424 bytes, all 45 tests pass and each manual has 2,345 pages. Its normal reference passes report 32/1/0 warnings, with zero final warnings and no box diagnostics. The completed Docs cohort is stopped. Integration CI 1619/1620 is waiting at its first observation. Older Integration 1613/1614 is running; 1615/1616 and 1617/1618 are waiting. Accepted older Integration 1611/1612 passes all 486 catalog scenarios and later probes with complete warning-free logs. This does not establish the intermittent quota cause tracked in Integration issue 18. Current full-suite CI remains required; stopped cohorts are not polled again. Owned syscall wire adapters, actual owned CPL3 peers, fresh-buffer validation, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The refreshed 76-repository inventory has 2,924 code files below 1,000 lines and 155 direct missing_docs crate-root gates; those checks do not close whole-codebase semantic audits.

Owned invocation wire and native acceptance — 15 September 2026: Signed Kernel 5f497adaefa526108a0439e0e071717dddb85334, shared IPC de968da19898bef532ddb3b5974bb9562f51dee5, capability ABI a001a26f0eb3aebec3f5fd02a28d98f1bc23f8a0 and Integration 9030b217c490db6ad3ec60a799cb025eccbfcdb1 implement and exercise the immediate owned invocation boundary. The allocation-free shared codecs and shim preserve exact return metadata, including a retained draining owner on failed submission. The Kernel checks fresh complete user mappings and packet framing under one lifecycle guard before native effects. No user pointer or caller-selected identity is retained. Destination capacity and descriptive receipt capacity are independent; spare capacity acquires no authority and repeated collection cannot duplicate transfers. Existing numeric binding hints still recheck live capabilities on every use. The real three-process CPL3 scenario passes all eight operations, full-span pointer/rights/overflow/reserved-field rejection, actual returned selectors, payload/capability/origin checks, collection after server exit and repeated receipts. A second request rejects premature relinquishment, enters draining on caller release and retires only after the exact server acknowledgment. Current signed owned and unchanged older lifetime images are each 2,232,320 bytes, with SHA-256 588c6097c57ebd2ed92e0f0b76f2b1ad6b82630b4a0da272ee98e218eb8e333d and 8f9026aaefd2c5a745e35467ac01c71789c5f469f9cd42a477f87818747ee673 respectively. Both runs have clean teardown and empty QEMU stderr. Ordinary images contain neither diagnostic hook. Strict default/all development/release host, freestanding and rustdoc matrices pass: IPC 368 units, shim 20, capability ABI 191, Kernel 642/666 and Integration 320/321. Existing ignores remain one shim and three Kernel tests. All 162 maintained Integration helper commands pass; three prior correct concurrent-run lock refusals are retained and their sequential checks pass on unchanged executable inputs. Docs 46da7a4cb4d38a2bea5b5491a68f51f33e4b4305 publishes the normative register/packet contract and regenerates the three affected API references from original signed revisions. All 45 documentation tests pass. The complete 2,363-page manual has zero final warnings, 430,365 word boxes within page bounds and reviewed changed ABI/API pages. Shared IPC CI 337/338 and capability ABI CI 214/215 pass with eight complete warning-free logs. Both Kernel revisions pass CI 556/557 and 558/559 with eight complete warning-free logs. Those cohorts are stopped. Current Docs CI 867/868 passes at observation four; four complete logs total 758,328 bytes. Both 2,363-page manuals pass all 45 tests, report normal reference-pass warnings of 32/1/0, and finish with zero warnings or box diagnostics. Its cohort is stopped. Current full Integration 1621/1622 is waiting. Older full Integration 1613/1614 now passes all 486 catalog scenarios and later native/console probes, with six complete warning-free logs; its cohort is stopped. Older 1615/1616 is running, and 1617/1618 plus 1619/1620 are waiting. Current full-suite acceptance remains open, as does the intermittent quota cause in Integration issue 18. This checkpoint supersedes the earlier pending wire/CPL3/manual status. Reachable backend disposal-failure coverage, broader revocation/generation-reuse scenarios, producer adoption, realm runtime, complete authority/inline-documentation audits and both full EriX-in-EriX build generations remain open. The current inventory checks 76 repositories, 2,943 code files below 1,000 lines and 157 crate roots with direct missing_docs gates; it does not establish semantic audit closure. No complete guest build or guest performance result is claimed.

Process-bound native acceptance — 15 September 2026: Signed Kernel 60da5858d7198185efd103f0e91e5ac2e0b63e67 implements control operation 52, checking the actual moved install grant against expected process/generation with exact rights, including zero, under existing endpoint policies. Signed Procd f1105706cc19ed024a6cca79a29abc57c90c6661 uses this operation in its actual ordinary launch-description producer while retaining the narrow SEND receipt, pending state and exact failure cleanup. IPC c453b697b8cdb9cc1c36f1ad89ff868648190025, capability ABI fe8d558253ad01301b99554e20d287c4ea35bb1d and five aligned helper commits preserve original Git/type identity. Integration 58c925c564b69bebce8df6f3e75a9312824e18c4 passes the expanded lifetime CPL3 scenario with thirteen actual control calls, user-side reply checks, two staged children and full added-custody disposal. The corrected lifetime image SHA-256 is 8e6a9e8f68b90cc1ede61300958cec122b82a7c6dfd6318a51e40fefc7ba166e; the unchanged owned-invocation scenario also passes with image SHA-256 b76a380d3cd6b03b0ff61a3b626ace0667679920684ad7356a1c3a36e2224953. Both have clean teardown and empty QEMU stderr. The initial fixture setup-order failure is retained and corrected in Kernel issue #14. All strict default/all development/release matrices pass: IPC 371, shim 20, capability ABI 191, Kernel 648/672 including standalone controls, Procd 227/232 including auxiliary binaries, and Integration 320/321 tests. Existing native-only ignores are unchanged. Procd passes forty native binary builds with repository linker scripts. All 162 Integration helpers pass after updating the exact policy assertion to require the new marker; its initial mismatch remains recorded. Docs b0fcf0f43af2af741d520a0b1373cc346e08863c updates the native wire/ownership contract, operation registry, Procd boundary and three generated shared APIs. All 45 tests and the complete 2,367-page manual pass, with zero final warnings, 431,138 word boxes within page bounds and four reviewed protocol/API pages. Current IPC 339/340, capability ABI 216/217, Kernel 560/561 and 562/563, Procd 266/267, Docs 869/870 and all five helper push/review CIs pass with complete classified logs and no final warnings. Those component cohorts are stopped. Current full Integration 1623/1624 waits at observation 01. Older full Integration 1615/1616 is running at observation 11; 1617/1618, 1619/1620 and 1621/1622 wait at observations 09, 07 and 04. No pending full suite is counted as passed. Typed realm bootstrap, mediator startup/readiness/configuration/seal, complete consumer image adoption, fair terminal/provider retirement, broader native disposal failures and both full EriX-in-EriX build generations remain open. The new inventory covers 76 repositories, 2,950 code files below 1,000 lines and 158 direct missing_docs crate-root gates; complete inline documentation and whole-codebase authority closure remain open. Prior performance measurements retain their original signed source identities; this checkpoint claims no new timing or guest performance result.

Corrected native staging checkpoint — 15 September 2026: Signed source f8fba7520df5b6e76662741cf72b3e8b6a1edf21 is recorded in the current review. Pin the corrected native graph and require ordered, unique constructor/cleanup evidence while preserving the owned-invocation and ordinary scenario oracles. 320/321 default/all Rust tests and the strict development/release matrix pass. All 162 maintained helpers pass. The lifetime image is 2269184 bytes, SHA256 70ef01f96694e0667c2317cf6076d6922b9cb36052b39de302bd3e1360cc3ce3; the owned-invocation image is 2232320 bytes, SHA256 7a6ed076de32320756e2ad99abf098d868989c72179c96bf3cbc47e9ba7fc81e. Both real VMs pass with empty QEMU stderr and clean owned teardown. Full CI 1625/1626 is pending; older completed 1615/1616 passes all 486 scenarios and subsequent native probes. Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed.

Native creation rollback acceptance — 15 September 2026: Staged construction now retains a receipt for each successful parent copy until commit. On later failure it destroys the child and disposes only those new endpoint/VSpace copies, preserving pre-existing or overlapping output bindings. The transaction has a separate documented module. Eight actual constructor refusal cases check complete parent inventory and native VSpace counts. Kernel b853d51cfb36c2fbc81eb565b7d2fc3ab731de2b passes 649/673 default/all tests, strict host/native development/release Clippy, private rustdoc, formatting and ten native builds, with three existing ignores. Matching CI 566/567 passes with four complete warning-free logs. Integration 3c4e260256 passes both actual native VMs with empty QEMU stderr and clean teardown. The lifetime fixture now includes seven creation/refusal/disposal calls alongside the thirteen installation calls; the existing owned-invocation oracle is preserved. Integration Rust/helper sources are unchanged and retain their completed 320/321-test strict matrix and all 162 helper results; changed native catalog inputs have fresh policy and VM checks. Full Integration CI 1627/1628 remains pending. Typed grant-return provisioning, independently constrained bootstrap authority before mediator execution, readiness, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. The code inventory covers 76 repositories and 2959 files below 1000 lines; all 158 scanned Rust roots enforce missing_docs. Whole-codebase semantic authority and private-item documentation audits remain incomplete.

Signed helper cdf15c52f24bd463dcabdddb945f779fff4ab367 excludes shallow local caches before an exact dependency fetch. It preserves the cache, selects the canonical catalog URL without following cache remotes, and requires original complete history. Three new real-Git controls and all 162 helper commands pass, along with 320/321 Rust tests per development/release configuration, strict host/native Clippy, four native builds, formatting, private rustdoc and Markdown with no warnings. Actual Rootd standalone preparation also passes using a shallow helper fixture and complete original Cargo metadata. Runtime library 2a16b1a7ac5514a43582025e5b9ba0a2f2ce2a29 and product catalogs remain unchanged. Full Integration CI for this helper commit is pending; no new VM or guest build is claimed.

Workspace ownership checkpoint — 15 September 2026: Signed Exsh b12e172e7b266842a8659104894f6821166165fb owns ordinary and emergency transport in distinct version-22 authenticated workspace slices. Descriptor startup rejects short or dirty cleanup storage before metadata effects; transactions exclusively reborrow the complete slice and erase it after emergency cleanup. The global UnsafeCell accessor and automatic 32 KiB cleanup array are removed. Larger valid caller slices retain their complete extent. Existing provider retirement, metadata rollback and uncertain-cleanup behavior remain enforced.

All 961 Rust tests pass in each default/all-feature/production development/release configuration, with formatting, strict host/native Clippy, private rustdoc and eight native builds without warnings. Four added tests cover workspace disjointness, malformed backing, complete caller extent and consecutive cleanup reuse; existing cleanup controls now also check buffer canaries and erasure. All 73 warning-denied checker tests pass.

Both actual optimized native fallbacks measure 48 local bytes, compared with the retained prior 32,816-byte frames. Their full checker reports remain INCOMPLETE: runtime/all graphs contain 691/604 unresolved observations, and the old 32 KiB initial stack-reservation requirement still needs a workspace-specific evidence contract. Ordinary-source membership and direct-versus-nested early-drop bounds remain open. The 8/33/56 KiB upper limits and 64 KiB stack are unchanged; this measurement is not an all-path stack-safety claim.

Matching producer 38424571b76b36c1e631d99fd2c859fb32311eea exports/consumes 96 capacity words plus 72 target layout words, reserves both transport arrays first and rejects old/mixed layouts. Packaging both actual optimized shell configurations under canonical dev/release policies derives 4,300,800 workspace bytes, with unchanged executable bytes and a separate 64 KiB stack. All 162 Integration helper commands and its strict 320/321-test Rust matrix pass, including four native builds. These are private artifact and host checks, not guest execution. The product catalog still selects the earlier shell; coordinated catalog adoption and matching runtime VMs remain required.

Documentation 79cdd4c3694e800091b55c737fca04c7bdd3d071 describes the ownership and compatibility contract. Its 45 tests and canonical checks pass. The full manual renders 2,375 pages without final warnings; all 433,713 word boxes are in bounds and changed page 2280 passes visual review. API snapshots are unchanged. Exsh CI 225/226 fails only the incomplete frame gate after 961 Rust and 73 checker tests; all four logs total 311,820 bytes with zero warnings. CI runtime/all graph observations are 662/587 and both fallbacks measure 48 bytes; these artifacts remain distinct from local images. Docs CI 883/884 passes with all four complete logs (762,212 bytes); reference passes converge with 35/1/0 warnings and zero final warnings. These component cohorts are fully classified. Integration CI 1637/1638 remains queued at its first observation. No full build within EriX or whole-codebase authority closure is claimed.

Native companion correction design — 15 September 2026: centralize the complete eight assembly body/export inputs and original producer script as one reviewed native support contract shared by selection and support-manifest validation. Compare the full producer input set without dropping unknown, missing, altered or misidentified records; retain exact waited tool, cleanup and output checks. Coordinate the native lib-cstd catalog pin with original bdcbbea43550e8b99cd9a8221e4bc5a645637990. Include the contract module in both outer artifact fingerprints, update independent fixture inventories, and exercise actual hidden/public output against that original source. The existing shell workspace/catalog and complete frame/VM acceptance requirements remain separate. Tracks #52.

Complete native companion checkpoint — 15 September 2026:

Signed Integration db80a2c1dfc669bd724762d476f5f5c0da005ff6 centralizes the complete eight assembly input roles plus the original producer script. Source selection and support-manifest validation share those roles; both outer artifact keys bind the contract module. The catalog changes only native lib-cstd to original bdcbbea43550e8b99cd9a8221e4bc5a645637990. Exact path/byte, tool, waited status, cleanup and output checks remain required.

Actual hidden/public production and missing/extra/altered receipt controls pass, as do both outer cache-key controls. All 162 helper commands are covered: 160 pass in the full run, and the two corrected test-only fixtures pass separately. The original missing-module and unclosed-fixture-stream failures are retained. The strict 320/321-test Rust matrix, Clippy, formatting, private rustdoc and four native builds pass without warnings.

A host-built diagnostic native image contains 38 executables and 27 shared objects, passes closure checks and builds without warnings. Its SHA-256 is ff5d774308cdf236c860a2423adab6e2594bf3c0991b26eb37cb3c64af96ddfe. It uses 73 original component selections with 72 coherent Cargo manifests and the five explicitly recorded helper corrections whose bytes match this signed checkpoint. It is not an unmodified product catalog. The unchanged editor/history, inherited-stream timing and runtime-error VM probes all pass with their original 120/15/10-second budgets and exact output checks; each leaves the source image unchanged.

Signed Docs 31bd9524c31c9d8d6a8f00248f702e6b7d428106 explains the complete source contract. All 45 tests and canonical checks pass. The complete manual renders 2,375 pages without final warnings; all 433,817 word boxes are in bounds and changed page 2281 passes visual review. Original API snapshots are unchanged. Docs CI 885/886 passes with all four complete logs (762,204 bytes); reference passes converge with 35/1/0 warnings and zero final warnings. Integration CI 1639/1640 remains queued at its first observation; the build compatibility issue stays open pending its complete CI. Full Exsh frame proof, coherent product adoption and both complete EriX-in-EriX build generations remain open.

Packaged workspace evidence design — 15 September 2026: Replace the obsolete automatic-stack-scratch requirement with a separate mandatory workspace mapping domain. The checker will accept an explicitly selected pristine ELF and optional corresponding packaged ELF, capture both under its existing owner/budgets, and require the packaged artifact to retain the pristine entry and executable bytes. Missing packaged input remains incomplete. A complete mapping domain requires the unique version-22 read-only descriptor, unchanged target type layout and full transport capacity, exact descriptor/arena extent, two disjoint complete transport spans, unique writable/non-executable zero-fill arena ownership, and the unchanged separate 64 KiB stack. Overlapping section/load/page claims, stale or mixed layouts, executable changes and relocation writes into the descriptor must fail. No cache receipt or caller-supplied success flag substitutes for actual artifact bytes.

Local fallback stack accounting remains independent and retains its existing upper bound; register pushes or an old 32 KiB stack reservation cannot certify workspace storage. This mapping domain does not prove source-level borrowing/erasure, complete typed arena carving or every machine call path. Existing source tests and exact build identity retain those separate contracts. Ordinary-source membership, direct-versus-nested bounds and unproved indirect targets remain incomplete, and the full gate remains nonzero until every required domain is established. Add original positive/malformed/overlap/mismatch fixtures and replay the unchanged actual runtime/all artifacts and their existing dev/release packaging. No runtime code or stack budgets change in this checker slice.

Paired workspace mapping checkpoint — 15 September 2026:

Signed Exsh f17670c7f0c3b6da4458deac534ba6210921550d adds paired pristine/packaged ELF workspace evidence under report schema 2. The checker captures both regular-file snapshots under its existing budgets and retains them when pair admission fails. It verifies the version-22 target descriptor, complete transport spans, exact arena extent, unique zero-fill arena/stack ownership and the unchanged separate 64 KiB stack. All mapped file bytes and permissions must match except tunable capacity words and the workspace owner's extent. Stale/mixed layouts, changed code/data, overlapping claims and relocation writes into descriptor/arena/stack bytes fail before the disassembler runs.

The obsolete automatic-stack-scratch requirement and redundant prologue-reservation scan are removed. Local frame ceilings remain 8/33/56 KiB in their existing domains; a local stack frame cannot supply workspace evidence. Mapping success assumes the native loader preserves the declared mappings and does not prove source borrowing, erasure, complete typed carving, ordinary-source membership or direct-versus-nested bounds. Unproved indirect targets remain unresolved.

All 90 warning-denied checker tests pass, including 17 new independent mapping/CLI controls. Formatting, Markdown and canonical checks pass. Four exact retained runtime/all-feature artifacts with canonical dev/release packaging establish the mapping domain: workspace 4,300,800 bytes, two complete 32 KiB buffers, separate 64 KiB stack. Both local fallback frames are complete at 48 bytes. Full reports remain INCOMPLETE with 691/604 unresolved observations and the original source/direct-path gaps; no full frame pass is claimed.

Rust, Cargo and linker source bytes are unchanged from workspace checkpoint b12e172e7b266842a8659104894f6821166165fb. Its 961-test strict matrices and eight native builds retain that source scope; the paired replays retain their original ELF hashes. The earlier three diagnostic guest probes also retain their original image/source identities and are not new runtime execution at this checker head. Exsh CI 227/228 fails the remaining full frame gate after all 961 Rust and 90 checker tests pass. All four logs are complete (311,713 bytes) with zero warnings. Both fallbacks are complete at 48 bytes; CI runtime/all graphs retain 662/587 unresolved observations. CI supplies no packaged counterpart, so its workspace mapping domain remains incomplete; the four local paired-artifact results retain their separate scope. The cohort is fully classified without accepting any missing proof. Matching Docs 5d77dc2b82bf5439e58234d901e30f4565aaa81a is signed and pushed: all 45 tests, the complete warning-free 2,375-page render, 433,924 in-bounds word boxes, literal-option extraction and nine-page visual review pass. Docs CI 887/888 passes with all four complete classified logs (762,236 bytes). Both manual jobs pass 45 tests and converge with 35/1/0 reference warnings, leaving zero final warnings; both Markdown jobs pass. Its issue erix/docs#8 records the 24 repaired inline-option/delimiter cases and is closed after complete CI classification. Full frame proof, coherent product admission, realm work and both complete guest build generations remain open.

CI packaged-input checkpoint — 15 September 2026:

Signed Exsh 453641cd19eaa7c85a8f6693363f8660c792ed73 supplies packaged counterparts in CI. Its helper is pinned to original Integration db80a2c1dfc669bd724762d476f5f5c0da005ff6. The actual producer packages separate copies of each optimized runtime/all-feature ELF using both canonical dev/release policies. Packaging has a 60-second deadline, refuses existing outputs and stops the job on failure. Each pristine/packaged pair gets its own complete checker invocation; any unresolved required domain keeps a nonzero status.

The exact changed workflow block was replayed against both retained native binaries. All four produced ELF hashes equal the previously independently validated production bytes, workspace mapping is complete, and pristine inputs remain unchanged. The full reports remain incomplete with 691/604 unresolved observations and unproved source/direct-path domains. YAML and shell syntax, 90 checker tests, formatting, Markdown, canonical and pinned dependency checks pass without warnings. Rust, linker and checker source bytes are unchanged, so their earlier strict validation retains its original source scope. Current Exsh CI 229/230 is fully classified: both runs pass 961 Rust and 90 checker tests and all four workspace-mapping domains, but fail the remaining full frame gate. All four complete logs total 314,746 bytes with zero warnings. Runtime/all graph observations remain 662/587 and fallback local frames remain 48 bytes. This resolves the missing packaged-input domain; source membership, non-returning/indirect targets and direct-versus-nested path proof remain open. No full frame proof, product admission or guest build is claimed.

Native final mapping design — 15 September 2026:

Implement validated RELRO final permissions within the existing native materialization protocol. Loaderd retains authenticated original ELF bytes and original PT_LOAD relocation ranges for Dynlinkd. It separately derives page-bounded final materialization fragments, clearing WRITE on the complete declared protected region. Procd's existing transaction remains the sole owner of privileged construction writes and final mappings; no new control endpoint, capability, lookup root or wire operation is introduced. The child remains unstarted until all bytes and authoritative relocation writes succeed.

Validate range arithmetic, mapped coverage and every writable byte sharing a protected hardware page before starting a transaction. Rounded protection must neither leave a declared byte writable nor silently remove write permission from unrelated mutable data. Permit multiple checked regions without a fixed region-count cap and preserve normal images that declare none. Preserve exact file/BSS coverage, load bias, initial writable stack selection, relocation authorization, abort precedence and uncertain-cleanup behavior. Final fragment counting uses checked arithmetic and caller-owned source bytes, without an additional persistent table.

Independent tests will cover partial and complete segments, page sharing, adjacent/multiple regions, missing mappings, overflow and mutable-page conflicts. Transaction tests must preserve original relocation ranges while emitting final read-only permissions, apply construction relocations successfully and retain failure/abort behavior. Run strict host/native Rust matrices, the complete existing tests, relevant native VM checks and warning-free manual/CI validation. This establishes final mapping permissions only; typed grant custody, whole-codebase authority closure, exact native frame proof and both complete guest builds remain separate requirements.

Specification provenance: the LSB program-header definition and GNU linker options describe the relocation-protected region and hardware page-size constraint. The implementation and fixtures will be original; no external implementation is copied.

Native RELRO checkpoint — 16 September 2026: signed ec353c90590b8b5529f34b43e48b61789c3ac70e validates protected ranges before effects and derives final read-only child mappings independently of original relocation authorization. Fifteen new independent ELF/handoff controls bring the suite to 105 tests in each of six configurations. Strict host/native Clippy, six native builds, formatting, private rustdoc and canonical Markdown checks pass without warnings. Static replay admits all 34 selected native dynamic artifacts. Existing construction writes, exact counts, authenticated bytes, writable initial stack and failure/abort semantics are retained. Matching native VM, complete current-head CI and the manual update are pending; full frame, realm and guest-build gates stay open.

Native RELRO manual — 16 September 2026: signed Docs 2560e70884ddcb1b2f262ef74ea0dd30084d4259 documents protected-page validation, exact final mapping fragments, the writable initial stack and privileged construction writes over an unstarted child. All 45 documentation tests and canonical checks pass. The complete manual has 2,375 pages and 434,088 in-bounds word boxes, with zero final warnings; both changed pages pass visual review. Exported API snapshots are unchanged. Loaderd CI 93/94 passes with all four complete classified logs (109,621 bytes) and zero warnings. Docs CI 889/890 passes with all four complete classified logs (762,216 bytes); both manual jobs pass 45 tests and converge with 35/1/0 reference warnings, leaving zero final warnings. The earlier diagnostic native command sequence passed while its permission observation failed; the subsequent repaired checkpoint below supersedes that scoped result. This checkpoint does not establish complete runtime permission, frame, authority, realm or guest-build acceptance.

Native permission checkpoint — 16 September 2026: signed Kernel 32c70109fe7663440aa56de6a49975accc1f0057 carries explicit live execution permission through single-page, batch and permission-only mappings. Data and construction aliases remain non-executable; ancestor promotion and splitting preserve neighbouring restrictions. Processor activation validates and enables execute-disable support on the bootstrap and application processors. Seven independent controls accompany the repair. Strict default/all-feature development/release suites pass 666/690 kernel unit tests plus two external controls per selection, retaining three existing ignores. Host/native Clippy, private rustdoc, formatting and ten native builds pass without warnings.

Separate one-CPU and two-CPU diagnostic VMs pass the unchanged native command sequence. A read-only hardware observer matches all 233,755 selected coreutils executable bytes, verifies CPL3 and enabled paging/execute-disable state, and confirms both observed RELRO pages are user-readable, read-only and non-executable; the current stack is user-writable and non-executable. Both processors report execute-disable enabled. This is an exact process-entry/table observation, not an injected instruction-fault test or whole-system permission proof. The diagnostic image SHA-256 is 8c3c24639e8e1ca8c4f2ad4e485323abf32ec07408241c3e4fa9713f6e07e812.

Signed Docs d221e725c2543316680e63fc5e8314ce0fe3bdf1 documents the mapping and processor contracts. All 45 documentation tests and canonical checks pass; the 2,375-page manual has 434,308 in-bounds word boxes and zero final warnings, with three changed pages visually reviewed. Exported API snapshots are unchanged. Kernel CI 574/575 passes with four complete warning-free logs (708,112 bytes), including existing optimized workload examples. Docs CI 891/892 passes all four complete logs (762,176 bytes), with 45 tests per manual job and zero final warnings. The later maintained permission regression is recorded below. Full frame proof, whole-codebase authority/documentation review, runnable realms and both complete guest build generations remain open.

Serial watchdog fixture checkpoint — 16 September 2026: signed Integration 01daadd3d775079a77dd3278f6b07ecbaebe3e84 replaces the two positive host timing schedules with deterministic child/clock schedules around real serial bytes and the actual watchdog loop. All 13 serial and 21 console tests pass with warnings denied. Four independently selected wrong refresh, exact-expiry, marker and status decisions are rejected. The real subprocess refusal cases and production watchdog code/deadlines are unchanged. The strict default/all-feature development/release Rust matrix, host/native Clippy, private rustdoc, formatting and four native builds pass; the unchanged helper inputs retain their prior coverage. Bug #53 remains open pending matching CI. The original CI1633 failure and incomplete paired review are retained; neither establishes a guest defect or a historical scheduling cause.

Maintained native permission regression design — 16 September 2026: add an explicit-input host runner and read-only hardware observer for a selected native image/ELF. Require selected QEMU, GDB, firmware, acceleration, CPU count, private temporary/evidence roots and recorded byte identities. Use a private Unix debugger endpoint, disable debugger auto-loading, match complete executable bytes at CPL3, and accumulate effective user/write/execute restrictions across the live four-level tables. Verify protected RELRO pages and the writable non-executable stack, plus execute-disable setup on every selected CPU. Continue the unchanged native inherited-stream commands and budgets after observation. Keep both process statuses, bounded cleanup and unchanged source-image checks mandatory. Extract pure ELF/page-table validation for independent malformed/permission-negative controls. Existing failed diagnostic images remain negative evidence. This adds no guest capability or lookup authority and does not replace instruction-fault, full frame, realm or guest-build acceptance. CI activation must use a coherent catalog containing the required Loaderd and Kernel revisions; the older maintained catalog must not be silently replaced or labeled accepted.

Maintained permission regression — 16 September 2026: signed Integration 89d15e4536004c087dcebd63c87216c0fd58958d supplies the explicit-input runner, pure ELF/page-table checks and read-only GDB observer. The final maintained source passes 21 independent host controls and the complete strict default/all-feature development/release Rust matrix, host/native Clippy, private rustdoc, formatting and four native builds. Canonical checks pass after correcting one Markdown line wrap. Both host groups are wired into ordinary CI. All 2,995 inventoried authored code files are below 1,000 lines; this is physical size evidence, not semantic authority closure.

Actual one-CPU and two-CPU runs on the repaired diagnostic image pass the original native-time command sequence and the expanded hardware checks: all 58 selected code pages are user-readable, read-only and executable; both RELRO pages are read-only/non-executable; the current stack is writable/non-executable. Complete executable bytes match and NX interpretation is enabled on every selected processor. An earlier image is rejected by the maintained observer. Both child outcomes, exact original input bytes and temporary cleanup are retained, with empty debugger stderr in both positive runs. The final cleanup code also preserves reaping when a direct child exits between poll and termination.

The command's image CI gate awaits adoption of a coherent product catalog containing both required component fixes. Its explicit diagnostic invocations do not silently replace the older maintained image graph. Signed Docs 3fb0b12ff55d044cc4bbe142418ab7a5b07bb42d documents the maintained operator contract. All 45 tests and canonical checks pass; the 2,377-page manual has 434,563 in-bounds word boxes with zero final warnings, and the changed subsection passes visual review. Exported API snapshots are unchanged. The preceding Docs CI result is recorded below; current Integration CI, complete frame proof, whole-codebase authority/documentation closure, runnable realms and both guest-build generations remain open.

Protected relative-target checkpoint — 16 September 2026: signed Exsh a26ecffb39b70abbf15fb300c5c8c703c6900c37 admits exact six-byte RIP-relative calls and tails only after complete relative-relocation, file ownership, protected RELRO page and target-entry checks. It shares the relocation inventory with guarded tables and rejects overlapping or executable-byte writes. Independent controls cover malformed ranges, writable neighbours, different stored words, negative displacements, self-entry loops and tail restoration. All 102 checker tests and all six strict Rust feature/profile configurations pass (961 tests each), together with six native builds, host/native Clippy, formatting and private rustdoc. Runtime Rust, linker scripts and Cargo selections are unchanged.

Replaying both unique original pristine/packaged artifact pairs preserves their hashes and all original stack/resource budgets. Runtime/all-feature reports retain 641/591 new call/tail proofs and reach 266/240 functions; unresolved observations fall from 691/604 to 271/232. Workspace mapping passes. Both full reports remain incomplete: unknown indirect control flow, non-returning semantics and source/direct-versus-nested boundaries remain separate obligations. These are partial static admission results, not a complete frame or authority proof.

Signed Docs 83b2d4a2dfc473bb8a99719f86fa1c3c33effa53 explains the proof contract and its limits. All 45 documentation tests and canonical checks pass; the 2,377-page manual has 434,680 in-bounds word boxes, zero final warnings and a visually reviewed changed page. API snapshots are unchanged. The preceding Docs permission-observer checkpoint passes CI 893/894 with four complete logs (762,616 bytes) and zero final warnings. Exsh CI 231/232 is fully classified: all 961 Rust tests, 102 checker tests and all four workspace domains pass, with four complete logs totaling 314,760 bytes and zero warnings. Only the complete frame gate fails. Its separately selected CI artifacts report 273/230 unresolved observations; these do not replace the retained local artifact identities/counts. The preceding Docs CI result is recorded below. All 2,997 inventoried authored code files remain below 1,000 lines; semantic authority/documentation closure, product catalog adoption, runnable realms and both complete guest builds remain open.

Grounded return-flow checkpoint — 16 September 2026: signed Exsh 4bb35938b52c0e6b20c65ccb861af79871272cbe derives no-ordinary-return facts from complete checked loop/trap bodies and earlier proved tail targets. Only these grounded exact callees suppress ordinary fallthrough. Calls retain target, depth and relocation evidence, and each fact preserves its original body evidence and earlier dependencies. Final reachability removes stale fallthrough descendants while keeping terminal callee obligations. Unknown calls, unsupported instructions, malformed boundaries and unproved tail cycles cannot establish facts.

All 114 checker tests pass, including twelve new literal controls and a 1,200-function chain requiring at most two body visits per function. All six strict Rust feature/profile configurations pass 961 tests each, with six native builds, host/native Clippy, formatting and private rustdoc. Runtime Rust, linker scripts and Cargo selections are unchanged. The physical inventory now covers 2,999 authored code files, all below 1,000 lines.

The same retained original artifact pairs yield thirteen grounded facts each. Runtime/all-feature unresolved observations fall from 271/232 to 181/150; every function-end boundary error disappears under the stated ordinary-call model. The work queue performs 347/313 body evaluations for 266/240 discovered functions and retains 263/237 in the final reachable graph. This is an analysis-work count, not a claimed runtime speedup. Remaining observations are 140/111 unknown calls, 40/38 unknown branches and one unsupported instruction per mode. Both workspace mappings pass; whole frame and source domains remain incomplete with unchanged budgets. A separate proof audit verifies earlier dependencies and retained terminal callees.

Signed Docs 97ce65dcb8cef7232b50d53af90ff8673d623e05 documents the refinement. All 45 tests and canonical checks pass, and the 2,377-page manual has 434,800 in-bounds word boxes, zero final warnings and a visually reviewed changed page. Exported API snapshots are unchanged. Exsh CI 233/234 is fully classified: 961 Rust tests, all 114 checker tests and four workspace mappings pass, while the full frame gate remains incomplete. All four logs total 314,776 bytes with zero warnings. Those separately selected CI artifacts retain 183/145 unresolved observations, distinct from the retained local pair counts. Matching Docs CI 897/898 passes with all four complete logs across the two terminal observations (762,600 bytes), 45 tests per manual job and zero final warnings. The preceding Docs target-contract checkpoint passes CI 895/896 with four complete logs totaling 762,636 bytes and zero final warnings. Full indirect/source proof, coherent catalog adoption, whole-codebase authority/documentation closure, runnable realms and both full guest-build generations remain open.

Exact direction-flag checkpoint — 16 September 2026: signed Exsh 05eeb7bc0b1bf1e6fa781b26ee83a8896263a439 admits operand-free single-byte FC/FD as stack-neutral direction-flag updates, preserving frame-pointer facts. Mismatched bytes, operands and prefixes refuse. Three original controls bring the full checker group to 117 passing tests, including a growing-stack negative case. Formatting, canonical documentation checks and the 2,999-file physical audit pass. The precise instruction contract is documented in Exsh; the existing manual's ordinary stack model remains applicable.

Replaying the same exact artifact pairs now admits each memmove frame at eight local bytes and removes its one unsupported-instruction observation. Runtime/all-feature reports retain 180/149 unresolved observations, all unknown indirect calls or branches, with thirteen grounded no-return facts each. Original input hashes and budgets are unchanged; workspace mappings pass and full frame/source domains remain incomplete.

Every Rust, Cargo, linker, build and workflow input is byte-identical to the preceding checkpoint's six strict 961-test configurations and six native builds. Those results are retained at their original identity; this checker-only follow-up claims no new Rust or guest execution. Matching Exsh CI 235/236 is fully classified: all 961 Rust tests, 117 checker tests and four workspace domains pass, while the full frame gate remains incomplete. All four complete logs total 314,740 bytes with zero warnings. Those CI artifact identities retain 182/144 unresolved observations, distinct from the local retained pairs. No whole authority, realm or full guest-build acceptance is added.

Release-input diagnostic design — 16 September 2026: foreground interrupt reuse #54 and COM1 shell lines #55 have complete terminal CI logs but unavailable inner artifacts. The original 486 scenario suites pass; the separate release input failures have no demonstrated shared cause.

Extend the existing bounded native-input progress formatter for the maintained three-line and physical interrupt/reuse profiles. Render only allowlisted event names and command indices from a complete sequential log prefix. Correlate the original private runner receipt and independently observed wrapper status; for physical VM stall/timeout, retain unknown input status and cleanup-request information rather than claiming injector failure or cleanup success. Read only existing fixed-name files through the retained private directory descriptor, keep current byte/record limits and mutation checks, and print no raw command, guest text, token, path or exception. Diagnostic output cannot change probe success, failure precedence or any original timer.

Add original literal positive/malformed/privacy controls, producer-contract checks and real wrapper status tests. Validate the complete changed Integration tree and document the operator interpretation before a signed checkpoint. This improves subsequent evidence; it neither recovers the missing original receipts nor fixes or closes the two underlying regressions.

Release-input diagnostic checkpoint — 16 September 2026: signed Integration df8147dfa437194cd091747fd7147941bd2793c4 adds fixed prefix summaries for shell lines and physical single/repeated interruption. Correlated physical VM-stall/timeout summaries retain unknown input status, failure stage and requested cleanup explicitly. They do not infer injector failure, cleanup success or the next operation's outcome. Only literal event names and bounded scalar fields can be printed; fixed private directory-relative reads, identity checks and original parsing limits remain unchanged. No guest authority, acceptance oracle, error precedence or 120/15/10-second limit changes.

All 172 host cases in eleven suites pass, including 28 diagnostic cases and eight new independent producer, malformed-prefix, private-receipt and actual-wrapper controls. The strict default/all-feature development/release matrix passes 320/321 tests per mode, host/native Clippy, four native builds, formatting and private rustdoc without warnings. A documentation line wrap is the only source change after the Rust matrix. One initial negative fixture had identical transport bytes when both exits were unknown; a distinct contradiction replaces it. An initially over-isolated console-suite invocation is corrected to its maintained CI invocation, without changing that suite or the watchdog.

Signed Docs c4bfc12245036f069d178a10183bb1ed15b4aab5 updates the operator manual. All 45 tests, canonical checks and full rendering pass: 2,377 pages, 435,037 in-bounds word boxes, zero final warnings and both changed pages visually reviewed. API snapshots are unchanged. Matching CI is pending. Release interrupt reuse #54 and release COM1 shell lines #55 remain open: missing original inner artifacts are not recovered, no shared cause is proved, and this checkpoint adds no successful guest run or full guest build.

Measured parser checkpoint — 16 September 2026: signed Exsh ffbe846cbcd0ab6ea12a476c2c84339f635ee50a compiles the three unchanged disassembly regexes once per input. It retains the exact grammar, instruction bytes, annotations and every disassembly deadline check. Three paired runtime host profiles against signed 05eeb7bc0b1bf1e6fa781b26ee83a8896263a439 reduce regex-cache lookups from 1,142,474 to 570,949; median profiled time falls from 5.088 to 4.214 seconds and complete wall time from 5.311 to 4.425 seconds. These measurements include profiler overhead and subprocess waiting. The 837,947 full matches, 189,680 splits and 375,664 disassembly deadline checks remain identical; they do not measure guest performance.

All eight runtime/all-feature observations preserve their original nonzero checker exits and identical complete decision reports. Only checker-source identity and private snapshot path metadata differ. Workspace mappings pass and the same 180/149 unknown indirect observations keep full frame/source admission incomplete. All 117 checker tests, formatting, canonical documentation checks and the 2,999-file physical ceiling audit pass. Every Rust, Cargo, linker, build and workflow input remains byte-identical to the existing six strict 961-test configurations and six native builds; no new Rust or guest execution is claimed. The focused contract documents the measurement and limits; the unchanged manual's stack model remains applicable. Matching Exsh CI 237/238 is fully classified: all 961 Rust tests, 117 checker tests, Markdown and four workspace domains pass; both runs fail the still-incomplete full frame gate. All four complete logs total 314,754 bytes with zero warnings. These CI artifacts retain 182/144 unresolved observations, the same counts as preceding CI and distinct from the local retained artifact pairs. Whole authority, realms and both full guest-build generations remain open.

Diagnostic manual CI — 16 September 2026: Docs c4bfc12245036f069d178a10183bb1ed15b4aab5 passes CI 899/900. All four complete logs total 762,668 bytes; both manual jobs pass 45 tests and produce 2,377 pages with zero final LaTeX warnings. All Markdown checks pass. Integration diagnostic CI 1645/1646 remains queued at its signed head; original release-input bugs 54/55 remain open.

Register-target proof design — 16 September 2026: the current runtime/all-feature artifacts retain 180/149 unresolved indirect observations. Six/seven immediately adjacent protected-slot loads are only candidates: textual proximity does not prove every incoming path. Extend the existing finite stack CFG with register facts for all sixteen baseline x86-64 general registers. Entry values are unknown. Exact byte-checked 64-bit RIP-relative loads can acquire a target only from the existing complete immutable relocation/RELRO proof; exact 64-bit register copies carry that evidence. Immediate integers, names, mutable data and stored pointer words supply no target.

Join facts only when every incoming path has the same target value, retaining all contributing load sites and protected-slot proofs. Explicit and implicit writes invalidate each affected full-register family, including partial aliases. Unknown effects, system calls and ordinary calls clear facts; no callee-saved convention, returned function pointer or stack spill becomes an unproved preservation premise. Existing probe/dispatch macros conservatively discard register facts until their complete effects are represented. Unsupported instruction/control-flow cases remain incomplete under the existing trusted-decoder and ordinary-call model.

Revisit weakened joins and replace stale call/branch evidence; an earlier strong path cannot survive as the only proof after another predecessor loses its value. Exact register-call/tail bytes must agree with the selected register. Preserve call depth, tail restoration, grounded return dependencies, unknown branches and the full source/domain gates. The finite worklist and provenance sets use the caller's original deadlines with no invented iteration or origin-count ceiling.

Add independently authored positive, alias/implicit-clobber, bypass, disagreeing/equal-join, loop, stale-edge, call/syscall and source-receipt controls. Replay both original artifact pairs, measure analysis work, update the focused/manual contracts, and validate/sign/push before any adoption. This is original code derived from the Intel instruction reference; it imports no implementation code. Complete guest-image identity, source membership, authority and both full guest-build generations remain separate required work.

Protected register checkpoint — 16 September 2026: signed Exsh da8b75c9063c52de2149f2a6c7ed170f720a6c62 propagates exact full-width protected-slot loads and register copies through the reached CFG. Equal-target joins retain every load origin; unknown or conflicting predecessors, alias/implicit writes, calls/syscalls and unknown effects discard facts. Weakening a join replaces stale edge proof. Complete admitted probe/dispatch effects preserve only unwritten register values. Supported REX forms permit unused bits with byte/text agreement. There is no caller-input, saved-register, spill-word or immediate-address target premise.

All 138 checker tests, formatting, canonical document checks and an independent original-byte/load/relocation and earlier no-return dependency audit pass. Retained runtime/all artifact pairs gain 16/18 register edges; the all-feature graph reaches one additional function. Remaining unresolved sites are 164/132, with thirteen grounded no-return facts per mode. Both workspace mappings pass. Full frame/source gates remain incomplete with actual exit 1 and unchanged 60/15-second and 64 MiB budgets. Every Rust/Cargo/linker/build/workflow byte is unchanged from six strict 961-test configurations and six native builds; no new Rust build or guest execution is claimed.

Profiling identified unnecessary effect parsing when all registers were unknown. Skipping those identity transfers and compiling fixed effect patterns once preserves every report decision, reducing runtime effect-parser calls from 34,901 to 1,334 and all-feature calls from 33,398 to 1,348. One before/after observation per identical pair measures 5.089 to 4.385 seconds and 4.997 to 4.358 seconds respectively, including observer overhead. These are bounded host work measurements, not a statistical timing guarantee or guest speedup.

Signed Docs 4f770bee4c6a4784b4fcce6ae606d1fc10b328da documents register provenance and limits. All 45 tests and the 2,377-page manual render pass, with 435,231 word boxes inside page bounds, no final warnings and visual review of the changed page. All 3,001 authored code files remain below 1,000 physical lines. Matching Exsh/Docs CI is pending. Complete source domains, authority closure, executable realms and both complete guest-build generations remain open.

Continued original CI failures — 16 September 2026: Integration 1636 at cdf15c52f24bd463dcabdddb945f779fff4ab367 passes all 486 catalog scenarios and earlier native probes, then the development COM1 directory gate fails after command 5 injection. Three complete warning-free logs total 13,307,223 bytes; bug #56 preserves its exact status and remaining diagnosis. Paired CI 1635 retains the separate release shell-line failure in bug #55; both original runs are terminal, with all six logs retained.

Integration 1637 at 38424571b76b36c1e631d99fd2c859fb32311eea passes 408/486 catalog scenarios and fails 78 during version-22 producer/version-21 catalog-shell preparation. Three complete warning-free logs total 13,031,316 bytes and retain 78 layout refusals. Bug #57 tracks coherent adoption after the source/frame/runtime prerequisites. Mixed-layout rejection remains required. The same paired CI 1638 remains live; later queued runs retain their original handles and observation policies. No retry, timer relaxation or full Integration acceptance is claimed.

Register checkpoint CI — 16 September 2026: Exsh da8b75c9063c52de2149f2a6c7ed170f720a6c62 is terminal in CI 239/240. Both runs pass 961 Rust tests, all 138 checker tests, strict warning-denied Rust checks and Markdown. All four paired workspace domains pass in each run. The required full-frame gate remains incomplete, with 168/131 unresolved observations on these CI artifacts, so both runs correctly fail overall. Four complete logs total 314,840 bytes and contain no compiler/lint warnings. These CI artifact observations remain distinct from the retained local pairs.

Docs 4f770bee4c6a4784b4fcce6ae606d1fc10b328da passes CI 901/902. Four complete logs total 762,604 bytes; each manual job passes 45 tests and renders 2,377 pages. Initial reference-resolution warnings clear during the normal three LaTeX passes; final renders have zero warnings. The full source/frame proof, coherent catalog adoption, authority closure and both complete confined guest-build generations remain open.

Bounded table checkpoint — 16 September 2026: signed Exsh efb542a3418badef951d01dff24eec88b8490aee tracks distinct unsigned bounds, original relative bases, signed table offsets and local targets. Exact constants, self-zeroing and zero extension establish numeric premises. Every selected immutable table byte, matching base addition and candidate instruction boundary must be proved before retaining any successor or branch evidence. Numeric/table values cannot authorize function calls. Joins preserve all alternatives and original premises; unknown predecessors and alias/implicit/call clobbers discard facts.

All 157 checker tests pass, including complete 256/65,536-entry domains, nonzero and signed read windows, extended register fields, joins, bypasses, loops, width controls and immutable/boundary refusals. Original-byte function/table/base/index/addition audits, formatting, Markdown and canonical checks pass. Final original runtime/all pairs admit two table branches each and retain 164/132 unresolved obligations: two entry branches resolve, while two newly exposed guard-interior conflicts remain. Both workspace mappings and thirteen grounded no-return facts per mode are retained. Full frame/source status remains incomplete with actual exit 1 and unchanged budgets. Initial partial-set exploration is diagnostic negative evidence, not accepted coverage.

Profiling identified repeated compilation of fixed stack patterns. Compiling sixteen unchanged patterns once and sharing the existing padding pattern preserves all report decisions and matching operations. One baseline/optimized observation per original pair reduces runtime/all regex-cache lookups from 651,254/627,530 to 135,274/131,391. Profiled times are 5.994 to 5.445 and 5.756 to 5.179 seconds, including overhead and waiting. These measurements establish reduced host work, not a timing guarantee or guest speedup. The final source has a clarified module docstring and separately reconciled complete replay decisions.

Every Rust/Cargo/linker/build/workflow byte retains the existing strict matrix; no new Rust build or guest execution is claimed. Signed Docs 242b78c8f35aeaef879f819c670574a4c1d95c3f explains complete read windows and target-set admission. All 45 tests and the 2,379-page render pass, with 435,421 word boxes inside page bounds, zero final warnings and visual review of both changed pages. All 3,003 authored code files remain below 1,000 physical lines. Matching CI is pending. Explicit flag/guard refinement, full source/frame proof, coherent catalog adoption, authority closure and both complete confined guest-build generations remain required.

Bounded table CI — 16 September 2026: signed Exsh efb542a3418badef951d01dff24eec88b8490aee is terminal in CI 241/242. Both runs pass 961 Rust tests, all 157 checker tests, strict warning-denied Rust checks and Markdown. Each run completes all four paired workspace domains. The required full-frame gate remains incomplete with 168/131 unresolved observations on the CI artifacts, so both runs fail overall. Four complete logs total 315,234 bytes, with no compiler/lint warnings. No incomplete proof is treated as acceptance.

Signed Docs 242b78c8f35aeaef879f819c670574a4c1d95c3f passes CI 903/904. All four logs are complete (763,044 bytes); each manual job passes 45 tests and renders 2,379 pages. Initial reference warnings clear in the normal LaTeX passes; final renders have zero warnings. An expanded local source/config inventory additionally checks 685 files, bringing the combined physical ceiling audit to 3,688 files, all below 1,000 lines. Flag/guard refinement, source/frame closure, coherent catalog adoption, complete authority review and both full confined guest-build generations remain required.

Ordinary comparison checkpoint — 16 September 2026: signed Exsh 4ed392bcc53cb46d0296cecbdd930c8be5cd7c28 replaces the fixed-register table macro with byte-checked CMP/Jcc facts, live comparison lifetime, unsigned/equality edge refinement and sound producer-width widening. A 32-bit comparison never zeroes upper bits. Every complete immutable target set remains mandatory, and numeric/table values cannot authorize function calls. Unknown predecessors, relevant flag/subject writes and unmodeled effects discard conditions. The obsolete dispatch report field is removed.

All 176 checker tests pass, including an independent exhaustive interval oracle, high-register dispatch, sign extension, bypasses, conflicting/unknown joins, stale proofs, complete table arms and large arithmetic loops. Independent original-byte audits check 354/321 comparison edges, eleven table branches per mode, protected function loads and thirteen earlier grounded no-return facts per mode. Original runtime/all pairs reach 271/246 functions and retain 158/126 unresolved observations, down from 164/132. Workspace domains pass; full frame/source status remains incomplete with actual exit 1 and unchanged budgets.

The audit also reproduces and fixes terminal-call discovery loss. A prior successor diagnostic no longer suppresses recomputation of a revisited call. Three independent controls retain grounded no-return, returning and unknown-target behavior. Original byte/range inspection corrects earlier descriptions of two guard-interior conflicts: these were fallthrough exactly at declared function ends. Padding remains outside those functions; callee names never supply no-return proof. Matching CI remains required before closing the defect.

Profiling identified repeated decoder-effect work. Sharing immutable effects only within one function-body analysis reduces runtime/all effect decoding from 72,668/69,784 to 34,499/32,576 and operand parsing from 75,637/72,547 to 37,468/35,339. Complete paired decisions remain identical. Final single paired profiled observations are 6.633 to 6.425 and 6.416 to 6.269 seconds, including overhead and waiting. The final baseline overlaps host test execution, and earlier pairs show timing variability; these diagnostic durations do not isolate a speedup. This establishes reduced host work, not a timing guarantee or guest speedup.

Every Rust/Cargo/linker/build/workflow byte retains the existing strict six-configuration 961-test matrix and six native builds. Formatting, Markdown and canonical checks pass. Signed Docs d8fbc3a1f3696e02954b81f23511cee513ddfa8c passes all 45 tests and complete 2,379-page rendering: 435,637 in-bounds word boxes, zero final warnings and two visually reviewed pages. The physical audit covers 3,005 authored code files below 1,000 lines. Matching CI is pending. Remaining indirect calls/branches, full source/direct-versus-nested proof, coherent catalog adoption, complete realm authority and both full confined guest-build generations remain required.

Comparison checkpoint CI — 16 September 2026: Exsh CI 243 and 244 are terminal. All four complete logs total 314,904 bytes with no compiler/lint warnings. Strict Rust checks, 961 Rust tests, 176 checker tests, Markdown and all four workspace domains per run pass. The required full-frame gate remains failed with 163/126 unresolved observations on these CI artifacts; their identities are distinct from the original static replay pairs. No full frame or guest-build acceptance is claimed.

Docs CI 905 and 906 pass with all four complete logs (763,056 bytes), 45 tests and 2,379-page manuals. Both final renders have zero warnings after ordinary reference convergence. The terminal-call discovery controls pass in both Exsh runs, resolving the scoped defect in Exsh #6 while the complete emitted-proof defect stays open. The current physical audit covers 3,690 authored source/config files below 1,000 lines; semantic authority and complete private documentation closure remain required. Original unfinished Integration jobs continue under their existing handles.

Arithmetic evidence checkpoint — 16 September 2026: signed Exsh 0cdaa8869545308c528f9cf5a2dc165cb286c6ef and Docs 07181c34b1a20150afe3380977ca5ba70c909b84 are pushed on feature/posix-compat. Immediate ADD/SUB now retains exact modular result pieces and derives unsigned/equality edges from carry/borrow and zero. Defined INC/DEC writes establish widths without preserving a stale combined flag condition. Full 64-bit comparisons may use the architectural numeric domain while keeping protected typed identities separate; narrow comparisons still require independent upper-bit proof. Known encoding/text contradictions remain explicit flow errors.

All 191 checker tests pass, including independent exhaustive concrete arithmetic and modular-interval oracles, wraparound and authority-negative controls. Original runtime/all artifact pairs admit fifteen table branches each and reach 271/246 functions, with 156/124 unresolved observations. Both workspace mappings pass; actual full-frame exits remain 1 and full source/direct domains remain incomplete. Independent original-byte audits check arithmetic/conditional/table premises, 16/18 protected register edges and thirteen grounded no-return facts per pair.

Profiling identified repeated stack-neutral grammar evaluation. A cache scoped to one function reduces those evaluations from 95,643 to 43,169 for runtime and 92,608 to 41,053 for all features, with complete paired report decisions equal. Cached values include refusals and contain no path facts. Timing observations include observer overhead and do not isolate a statistical speedup or guest performance.

Formatting, Markdown, whitespace and all 45 Docs tests pass. The 2,379-page manual has 435,808 in-bounds word boxes, zero final warnings and visual review of the changed pages. The physical inventory covers 3,691 authored source/configuration files, all below 1,000 lines. Semantic authority and complete private rustdoc closure remain open. Rust/Cargo/linker/build/workflow bytes are unchanged from the retained strict matrix and classified CI 243/244; new Exsh CI 245/246 independently reruns those checks. Docs CI 907/908 also runs. Matching CI is pending, and no full confined guest build or coherent product-catalog adoption is claimed.

Test-import correction and CI classification — 16 September 2026: original Exsh CI 245/246 failed before the frame gate because the arithmetic test could not import its checker module. They attempted 177 tests: 176 passed and one module import failed. The preceding 961 Rust tests and strict build stages passed; all four complete logs total 309,708 bytes with zero compiler/lint warnings. The earlier local 191-test pass used an explicitly supplied PYTHONPATH and did not prove equivalence to the clean workflow. This regression is retained in Exsh #7.

Signed correction 12331e26f3bb7a25c0146c8b314eef46dd451099 loads the repository's literal fixture setup before implementation imports in both affected modules. A new regression imports every checker test module in a fresh isolated interpreter; it reproduces both failures before correction and passes afterward. The exact clean workflow command now passes all 192 tests without PYTHONPATH. Formatting, Markdown and whitespace pass. Checker/runtime/Cargo/workflow bytes are unchanged, so the prior original-artifact and profiler evidence retains its exact scope. New CI 247/248 runs against the corrected source; issue #7 remains open pending matching CI.

Docs CI 907/908 now passes with four complete logs totaling 763,024 bytes, all 45 tests and 2,379-page manuals. Both final renders have zero warnings after ordinary reference convergence. Full frame/source proof, coherent catalog adoption and complete confined guest builds remain outstanding.

Corrected arithmetic checkpoint CI — 16 September 2026: Exsh CI 247 and 248 at signed 12331e26f3bb7a25c0146c8b314eef46dd451099 both pass all 192 checker tests, including the ten isolated module imports, and all 961 Rust tests. The preceding strict formatting/Clippy/documentation/build stages and Markdown pass. All four complete logs total 314,944 bytes with zero compiler/lint warning candidates. This confirms the scoped import correction in Exsh #7.

Both runs reach and fail the required full-frame gate. All four workspace mappings per run pass, while the emitted CI pairs retain unresolved counts [161, 161, 124, 124]; these artifacts are distinct from the original static pairs' 156/124 observations. Full source/direct domains remain incomplete, and Exsh #4 remains open. The original import-failed runs 245/246 stay classified and are not relabeled as passing.

Docs CI 907/908 passes all 45 tests and 2,379-page manuals with zero final warnings; four complete logs total 763,024 bytes. Signed trees are clean, canonical issue/PR metadata remains applied, and the 3,691-file physical inventory remains below 1,000 lines per authored source/configuration file. Semantic authority and private documentation closure, coherent catalog adoption, runnable realms and both full confined guest build generations remain outstanding. Original unfinished Integration runs continue under their existing handles and budgets.

Grounded call-preservation checkpoint — 16 September 2026: signed Exsh 641ac2fc7c3fba3ab351f2863df7e35117b2732a and Docs 7a7c3ff0095de8f008c9b534fd993554df37f976 are pushed on feature/posix-compat. Complete original bodies and earlier callee facts now prove never-written register families. Only existing typed values survive proved calls; live conditions clear. The separate stack-derived rbp fact follows the same rule. This corrects the reproduced stale-frame defect, which stays open pending matching CI. ABI conventions, spill restoration and current kernel behavior supply no preservation mask.

All 213 clean-environment checker tests pass, including 21 new controls, eleven isolated module imports and a 1,200-function grounded dependency chain. All six strict Rust feature/profile configurations pass 961 tests each, with host/native Clippy, private rustdoc and six native builds; no warnings. Original runtime/all artifact pairs retain 65/72 protected register edges and 70/77 load origins, reducing unresolved observations from 156/124 to 107/70. Both workspace mappings pass; full source/frame/direct gates retain actual exit 1. Independent audits bind 7,795/7,503 used-contract instructions and complete earlier-proof closure to the original captured bytes.

Profiling identified unnecessary empty-state scans and rejected-body suffix work. Removing them preserves every paired report decision and reduces total profiled Python calls from 32,160,478 to 26,673,252 and from 30,880,221 to 25,402,446. Single paired timings include observer overhead; they do not establish statistical or guest performance. Original timer, byte and stack budgets remain unchanged.

All 45 Docs tests, formatting, Markdown and canonical checks pass. The 2,379-page manual has 436,058 in-bounds word boxes, zero final warnings and visual review of both changed pages. The physical audit covers 3,693 source/configuration files, all below 1,000 lines. Semantic authority/private-documentation closure, product adoption, complete source/frame admission, runnable realms and both full in-EriX build generations remain open. Automatic CI for both exact signed heads is being followed; local passes are not reported as CI acceptance.

Matching preservation CI — 16 September 2026: Exsh 249 and 250 are fully classified at 641ac2fc7c3fba3ab351f2863df7e35117b2732a. Both pass all 213 checker tests, including eleven isolated imports and the stale-frame controls, all 961 Rust tests and preceding strict host/native Clippy, rustdoc and native build stages. Markdown and all four workspace mappings per run pass. The remaining full frame gate fails as required; original CI artifact observations are 111, 111, 74, 74], [111, 111, 74, 74. All four complete logs total 314,995 bytes without warnings. The independently retained local pairs remain 107/70, with their own original identities.

Docs 909 and 910 pass at 7a7c3ff0095de8f008c9b534fd993554df37f976. All four complete logs total 763,088 bytes; both manual jobs pass 45 tests and render 2,379 pages with zero final warnings after ordinary reference convergence. The corrected frame-pointer issue is closed on this matching evidence; the full source/frame issue remains open. No full confined build, runnable realm or coherent product-catalog adoption is established.

Matching native intake CI — 16 September 2026: Exsh 251 and 252 are fully classified at d67dcb963f1aa265b13dd0609a5f8488784b5822. Both pass 231 checker tests, twelve isolated imports, 961 Rust tests and the strict preceding Clippy/rustdoc/native build stages. All four workspace mappings per run and Markdown pass. The required full frame gate remains incomplete; the CI artifact counts are 111/111/74/74 unresolved observations in each run. Four complete logs total 315,371 bytes, with zero warnings. Retained local standalone and native artifacts keep their own separate identities and 107/70/299 counts.

Docs 911 and 912 pass at 12c6d0a91e5e9c5f170d6d0aa7f050dd60e883ef. Four complete logs total 763,452 bytes; each manual job passes 45 tests and renders 2,381 pages, with ordinary reference convergence followed by zero final warnings. No full source/frame proof, native dependency closure, runnable confined realm or full EriX-in-EriX build is established.

A separate original-source relocation calculation defect is now reproduced and tracked with the canonical bug template in lib-dynlink #2. Its two host failures do not imply a guest regression. All 107 symbol-only relocations in the seven retained native artifacts have zero addends; the supported nonzero-field case still requires correction before broader native binding admission.

Release-baseline planning acceptance — 16 September 2026: the existing signed release policy identifies 1.0.0-alpha.1 with OS self-hosting, defines the platform/component version relationship and retains all pre-alpha components at 0.1.0. A fresh read of all 74 tracked Cargo manifests confirms 0.1.0. Canonical contribution policy keeps release review and approval separate from development progress. This accepts recording the target and version policy only. Runtime acceptance, two complete guest builds, release readiness, merging, tagging and publication remain separate requirements; no release action was performed.

Matching closed dependency intake CI — 16 September 2026: Exsh 253 and 254, exact 9827896d1cb5ad834589045ee03390aec650df84, pass 259 checker controls, 16 isolated imports, 961 Rust tests and the strict preceding build/Clippy/rustdoc stages. All four workspace domains per run and Markdown pass. The required full frame gate remains incomplete, with 111/111/74/74 unresolved observations in each CI artifact set. Four complete logs total 315,052 bytes and contain zero warnings. Original local runtime/all/native replays retain separate input identities and 107/70/299 counts.

Docs 915 and 916, exact 88537b23e1def210eeff40b7ef90fce92fe2009e, pass 45 tests and complete 2,383-page renders. Four complete logs total 763,918 bytes. Reference convergence is 35/1/0 warnings across the three TeX passes, with zero final warnings. Both cohorts are classified without rerunning jobs or changing their budgets. The seven-object native dependency inventory is now checked; symbolic providers, ordered runtime binding, cross-object frames and source membership remain incomplete. No runnable realm, coherent product adoption or complete in-EriX build is established.

Remaining original CI results — 17 September 2026: permission CI 1644, exact 89d15e4536004c087dcebd63c87216c0fd58958d, finishes with 408 passing and 78 known layout refusals. Release-input CI 1645, exact df8147dfa437194cd091747fd7147941bd2793c4, finishes with 405 passes and 81 failures: those 78 layout refusals, the original quota timeout, and new 120-second FAT32 mirrored/Unicode timeouts. Paired CI 1646, at the same source revision, records 408 passes and only the 78 layout refusals. The separate FAT32 observations are tracked with the canonical bug template in #58; a common cause with quota is not established.

All nine terminal logs are complete, totaling 40,256,559 bytes with zero warning candidates; host/Rust/Markdown checks pass. Original artifact APIs expose no images or inner receipts. Both formerly pending cohorts are fully classified, with their original failures retained. No run was restarted, no limit was increased and no complete product or guest-build acceptance is asserted.

Ordered native symbol evidence — 17 September 2026: signed Exsh 469bf1f1b9d8301cf98a79d16c7c27660ecda2a1 enforces root-first depth-first discovery order and positional DT_NEEDED agreement, indexes exact strong/weak providers and preserves object-qualified relative function identities. Duplicate strong definitions fail; missing weak symbols remain zero data. S-only relocations ignore addends, while S+A must retain an exact original executable entry. Names confer no file reads and no load bias is invented.

All 276 checker tests, 17 isolated modules and six strict Rust configurations (961 tests each) pass, including host/native Clippy, rustdoc and six warning-free native builds. Independent original-byte inventory matches all 117 symbolic records: 112 exact function identities and five refused data targets. Provider indexing/reporting takes approximately 16 ms in the captured native profile. Original standalone runtime/all/native replays preserve 107/70/299 unresolved observations and actual exit 1 under unchanged budgets. This is conditional relative identity evidence only: load-base arithmetic, protected slots, cross-object calls/frames and source membership remain incomplete.

Signed Docs 24cefeb2dc6d3f163140d32f5fed5a7e1a768ebd updates the manual contract. All 45 documentation tests pass; the complete 2,383-page render has 436,737 in-bounds word boxes, zero final warnings and visual review of pages 2284–2285. The physical audit covers 3,706 source/configuration files, all below 1,000 lines. No runtime Rust, dependency, linker or workflow inputs changed. New host/CLI controls cover the analyzer behavior; no new guest feature is asserted. Exsh CI 255/256 is terminal: unit/strict/workspace stages pass, and the required full-frame gate remains incomplete. Docs CI 917/918 passes. Acceptance remains 15/459 leaves, 3.48% weighted. Both full in-EriX builds and the complete semantic authority audit remain open.

Ordered-provider automatic CI classification — 17 September 2026: Exsh 255/256 at 469bf1f1b9d8301cf98a79d16c7c27660ecda2a1 passes 961 Rust tests, the combined 276-test checker suite, strict preceding stages and all four workspace domains per run. The required full-frame gate fails with 111/111/74/74 unresolved observations per run. Four complete logs total 315,035 bytes with zero warnings. The 17 separate module executions are local evidence; CI uses combined test discovery.

Docs 917/918 at 24cefeb2dc6d3f163140d32f5fed5a7e1a768ebd passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,878 bytes. Reference-resolution passes produce 35/1/0 warnings; final output has zero warnings and no layout overflow. Original API snapshots remain unchanged. Both cohorts are fully classified, without restarting workflows or changing thresholds. Original Integration layout, quota and FAT32 failures remain open, including #58 in Integration. Acceptance remains 15/459 leaves, 3.48% weighted. Complete native source/frame proof, a runnable realm, the full semantic authority audit and both full in-EriX builds remain required.

Protected cross-object frame evidence — 17 September 2026: signed Exsh ac9646c84e432129a872737789a9be08f984b881 composes the seven explicitly selected native objects using protected relative/symbolic slots and object-qualified function identities. Local control-flow offsets cannot alias a foreign function or transfer the root fallback role. Register facts, grounded preservation/no-return dependencies and route accounting retain the selected object. Every captured decode shares the original output/time budgets; a late failure rejects the invocation. Native reports use schema 3; standalone schema 2 and input schema 1 remain unchanged.

All 299 checker tests and 20 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, rustdoc and six warning-free native builds; formatting and Markdown checks pass. Original runtime/all replays retain 107/70 unresolved observations. The composed native graph reaches 275 functions with 111 unresolved observations; all three actual checker exits remain 1. Native slots assume successful checked linking and unchanged disjoint mappings. Actual load bases, complete source/frame acceptance and coherent runtime adoption remain open.

Profiling identified redundant root-only analysis in native mode. Removing it preserved every composed decision while one profile changed from 41.52 to 25.81 seconds and 64.37M to 39.61M calls. This host profile pair includes observer overhead and gives no general or guest timing guarantee. The final source replay also preserves every decision; three register-proof records now correctly identify symbolic load provenance.

Signed Docs 44cd6c4aa95bebfa08c99804fab0f1551f537ae1 specifies the contract. All 45 documentation tests pass; the complete 2,383-page manual has 436,894 in-bounds word boxes, zero final warnings and visual review of the changed page. All 3,713 inventoried source/configuration files are below 1,000 lines. The broader documentation audit retains 108 unchanged older test definitions needing inline docstrings; current production and all new/modified definitions are documented. Runtime Rust, dependency, linker and workflow inputs are unchanged; added behavior has host and real CLI regressions, with no new guest runtime feature asserted. Original Exsh CI 257/258 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 919/920 passes. Both cohorts are fully classified. Both full builds inside EriX and complete semantic authority acceptance remain open.

Cross-object checkpoint CI classification — 17 September 2026: Exsh 257/258 at ac9646c84e432129a872737789a9be08f984b881 passes 961 Rust tests, the combined 299-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery also checks isolated module imports; the 20 separate module-suite executions are additional local evidence. The required full-frame gate fails with 111/111/74/74 unresolved observations on the four original CI artifact selections. Four complete logs total 315,180 bytes with zero warnings. Those CI selections remain distinct from the retained seven-object native replay.

Docs 919/920 at 44cd6c4aa95bebfa08c99804fab0f1551f537ae1 passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,906 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required.

Saved-value preservation evidence — 17 September 2026: signed Exsh 8b6b93a329757ae7f106e235761912b58a67deff derives incoming-register equality through exact full-width copies and owned live stack slots. Original byte decoders bind register, width and address forms. Partial or unknown aliases, conflicting paths, deallocation and reuse invalidate saved facts. Entry tokens carry equality only; they never supply a pointer or call target. A separate earlier callee contract must prove private stack writes before caller slots survive a call. Checked signed bounds and finite dependency order prevent wrapped offsets and recursive assumptions from granting evidence.

All 329 checker tests and 22 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, rustdoc and six warning-free native builds; formatting and Markdown checks pass. Independent eager scheduling controls agree with both filtered worklist orders. Original runtime/all/native replays retain 107/70/111 unresolved observations and actual checker exit 1. The native graph still reaches 275 functions. The startup iterator's unknown pointer writes remain a refusal; complete source/frame and runtime acceptance remain open.

Two initial native profiles exhausted the original 60-second budget and produced empty reports; both failures are retained. Immutable decode caches, retirement of exhausted equality state, fact-sensitive wakeups and dependency-first scheduling brought the final native replay within the unchanged budget: 57.45 seconds wall time, 53.94 profiled seconds and 72.27M calls. All 2,373 bodies are inspected once. This bounds one retained host replay and makes no general speedup or guest timing claim. Report schemas and original source, stack, byte and time gates are unchanged.

Signed Docs c3401e5f6bbc19a0ba695219ed551e29a29677ed specifies the contract. All 45 documentation tests pass; the complete 2,383-page manual has 436,968 in-bounds word boxes, zero final warnings and visual review of both changed continuation pages. All 3,717 inventoried source/configuration files are below 1,000 lines. The touched preservation tests now document 21 older methods; 87 unchanged older test definitions remain in the inline documentation audit. Current production and all new/modified definitions are documented. Runtime Rust, dependency, linker and workflow inputs are unchanged; no new guest runtime feature is asserted. Original Exsh CI 259/260 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 921/922 passes. Both cohorts are fully classified. Both full builds inside EriX and complete semantic authority acceptance remain open.

Saved-value checkpoint CI classification — 17 September 2026: Exsh 259/260 at 8b6b93a329757ae7f106e235761912b58a67deff passes 961 Rust tests, the combined 329-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery checks isolated module imports; the 22 separate module-suite executions are additional local evidence. The required full-frame gate fails with 111/111/74/74 unresolved observations on its four original CI artifact selections. Four complete logs total 315,234 bytes with zero warnings. These CI selections remain distinct from the retained seven-object native replay.

Docs 921/922 at c3401e5f6bbc19a0ba695219ed551e29a29677ed passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,958 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required.

Caller-bound stack preservation — 17 September 2026: signed Exsh e7ba974e96ee77a41c6a861150da843d4c84c7d6 binds formal GP arguments to independently proved live caller stack intervals. Exact callee write spans preserve return-address gaps and invalidate every overlapping save. Scoped masks never enter the unconditional function index; loaded words, unknown contents, released storage and recursive assumptions supply no binding. Byte-checked SETcc writes exactly one unknown byte.

All 355 checker tests and 23 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, private rustdoc and six warning-free native builds. Formatting, templates and Markdown pass. Original runtime/all/native replays retain 97/60/97 unresolved observations and actual exit 1. The native graph reaches 275 functions; the startup iterator now has caller-bound preservation for its exact live buffers. Complete source/frame and runtime acceptance remain open.

Profiling exposed repeated failed argument specializations. Mandatory opaque-prefix refusals, conservative GP demand and rejection-only control candidates avoid unnecessary interpretations without changing the original 60-second limit. Candidate records cannot become proofs, and incompatible fact kinds defer to actual interpretation: losing pointer identity can enable numeric refinement. Positive and negative controls compare filtered and eager behavior. Each CFG site has at most one pending visit and later changes still enqueue it without an iteration cap; every native proof decision agrees with the prior queue.

The final ordinary native replay takes 39.80 seconds. Complete tracing still exhausted the original deadline; failures and empty reports are retained. A separately identified selective profile measures only caller-context analysis: the complete invocation takes 56.59 seconds, with 26.92 profiled seconds in that scope. Instrumentation preserves the complete proof result. Different profiling scopes are not timing comparisons, and no guest performance claim is made. The replay selects 367 instances, evaluates 587 bodies, proves 190 and defers 51 candidate bodies for incompatible domains.

Signed Docs fc3ee44748c20a3aa6f55bd85ac1913c707e5d4e specifies these contracts. All 45 documentation tests pass. The complete 2,385-page manual has 437,275 in-bounds word boxes, zero final warnings and visual review of the changed pages. All 3,721 inventoried source/configuration files are below 1,000 lines. All new/modified definitions are documented; 87 unchanged older test definitions remain in the audit. Runtime Rust, dependencies, linker and workflow inputs are unchanged. Original Exsh CI 261/262 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 923/924 passes. Both cohorts are fully classified. Complete semantic authority acceptance, coherent runtime adoption and both full builds inside EriX remain required.

Caller-bound checkpoint CI classification — 17 September 2026: Exsh 261/262 at e7ba974e96ee77a41c6a861150da843d4c84c7d6 passes 961 Rust tests, the combined 355-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery checks isolated module imports; the 23 separate module-suite executions are additional local evidence. The required full-frame gate fails with 101/101/64/64 unresolved observations on its four original CI artifact selections. Four complete logs total 315,210 bytes with zero warnings. These CI selections remain distinct from the retained seven-object native replay.

Docs 923/924 at fc3ee44748c20a3aa6f55bd85ac1913c707e5d4e passes 45 tests and the complete 2,385-page manual. Four complete logs total 764,350 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required.

Caller-local query diagnostic selection — 17 September 2026: update the isolated lifetime/invocation catalog to one coherent original 15-repository dependency graph and the signed query kernel. Preserve ordinary image selections, all earlier native assertions and the 60-second scenario deadline. The invocation program adds fifteen actual CPL3 queries with private stack and saved-register checks; the lifetime scenario supplies independent regression coverage. The strict kernel matrix is complete; matching-image runtime evidence and automatic CI classification remain required.

Caller-local query checkpoint — 17 September 2026: signed Integration 75ebaa21e65542d5b553c1264f6e28c48ede0a44 carries the caller-selected component catalog into launch metadata and registry construction. Absent Exsh, Coreutils and Extop artifacts require no launch catalog; present artifacts retain capacity and missing-metadata checks. Seven new controls cover alternate and absent inputs. The isolated diagnostic catalog selects Kernel e15a045d7701030e58d9e59517406f8c79694ff8 and a coherent original 15-repository graph; ordinary image selections remain independent.

All 165 helper commands pass. Four strict Rust matrices pass 320 default or 321 all-feature tests, formatting, Clippy, native builds and private rustdoc. Matching query/invocation and lifetime VMs pass under unchanged 60-second deadlines without warnings. The original packaging refusal is retained in integration issue 59 and the initial canary failure in kernel issue 16. Automatic Integration runs 1647/1648 are being monitored; no full-suite or full guest-build acceptance is claimed while their original outcomes are pending.

Explicit entry-state checkpoint — 17 September 2026: signed Integration 110caecccf21ed7ae4ab66449c58c985f4c74695 adds the explicit entry-direction wrapper mode and native UD2 scenario, plus a workflow policy check. Its isolated catalog selects signed Kernel d4a8921fa8530419c3d9790b80ff3c601217906d through the coherent original component graph. Ordinary image selections remain independent.

All 166 helper commands and four strict Rust matrices pass, with 320 default or 321 all-feature tests, formatting, Clippy, native builds and private rustdoc. The standard wrapper passes invocation, entry-direction and lifetime VMs without build warnings under their unchanged 60-second deadlines and exact marker/exit requirements.

Original automatic CI 1649 and CI 1650 are being monitored. Earlier runs 1647/1648 remain separately monitored; no complete-suite or full guest-build acceptance is claimed while those outcomes are pending.

Original Integration regression classification — 17 September 2026: Original runs 1647–1650 are fully classified. Runs 1648, 1649 and 1650 each pass 408 of 486 scenarios and fail the same 78 known shell-layout refusals in issue 57. Run 1647 passes 407 and additionally repeats the existing ext4 quota timeout in issue 18. All twelve complete terminal logs total 52,533,051 bytes and contain no warnings. Rust and Markdown jobs pass. No additional failed scenario is identified; the complete catalogs remain failed. The separate local automatic-KVM preboot observation is tracked in issue 60.

Entry-frame and complete fixture checkpoint — 17 September 2026: Signed fa86d1b64f8e1299c0ee0c886e6f1b35d58ea15b adds exact callee-stack checks to both exception frame shapes and selects Kernel 829b949 through the isolated original diagnostic graph. Invocation, lifetime, UD2 and double-fault standard-wrapper VMs pass with warning-free images and unchanged 60-second gates. Original current-head CI 1651/1652 passes Rust/Markdown and is still running full VM suites. Earlier 1647–1650 are fully classified with the known layout/quota failures; issue #59 is closed for catalog packaging only. The separate KVM preboot observation in #60 and both full guest builds remain open.

Original CI reconciliation — 17 September 2026: CI 1651/1652 at
fa86d1b64f8e1299c0ee0c886e6f1b35d58ea15b retains full-catalog failure.
All six logs are complete, 27,230,062 bytes, zero warnings; Rust/Markdown pass.
Both runs retain 78 layout refusals and the quota timeout. PR CI 1652 also
retains the named idle-time-resolution timeout in #61, while original
push CI 1651 passes that scenario. Totals are 407/79 and 406/80 of 486.
No unchanged retry, increased deadline or accepted full guest build is claimed.

Runtime archive checkpoint — 17 September 2026, signed 77921a7d97874e3f44aae66ae9bef6e6196af2f5: Eight selector controls pass, including four original refusal subcases that fail against the predecessor. All 167 helper commands and four strict Rust configurations pass (320 default/321 all-feature tests), with formatting, Clippy, freestanding builds and private rustdoc. Both original 60-second native invocation/lifetime scenarios pass; their Kernel bytes match the earlier signed diagnostics. A separate retained-graph host package performs 38 fresh native links and reproduces its original Kernel ELF before and after stripping. These are host builds and bounded native regressions, not a complete guest build. Original automatic CI monitoring is pending; no earlier failed workflow is restarted.

Linker selection checkpoint — 17 September 2026, signed bc0e67f927ded76dd3ff5790180a7bded0886885: Thirteen focused controls pass, including real bundled-LLD linking and warning refusal. All 168 helper commands, four strict 320/321-unit configurations, freestanding builds, formatting, Clippy and private rustdoc pass. Both original 60-second native VMs pass and preserve earlier signed Kernel bytes. A retained older graph packages through 38 fresh native links with fatal linker warnings and reproduces its original Kernel ELF. An interleaved host cProfile comparison retains twelve identical shared ELFs and verifies elimination of one compiler query per standalone link; no guest or whole-build speedup is claimed. Original automatic CI remains pending. Complete compiler-source admission, ordinary runtime adoption and both full guest builds remain open.

Compiler metadata checkpoint — 17 September 2026, signed 56e035d46a11dc803d654bf2151e484fab307682: Fourteen focused controls and all 169 helper commands pass, including actual cache-key mutation coverage. Four strict 320/321-unit configurations, freestanding builds, formatting, Clippy and private rustdoc pass. Both original 60-second native VMs pass with unchanged signed diagnostic Kernel bytes. A retained older graph packages through 38 fresh native links and reproduces its original Kernel and six provider metadata/shared-object pairs. That host diagnostic retains the older deployment adapters with only the new cache-input declaration; complete current adapters have separate helper and native VM coverage. Earlier incomplete/mismatched diagnostic overlays remain recorded failures. Original automatic CI remains pending. Complete compiler-source admission, ordinary runtime adoption and both full guest builds remain open.

Coordinated terminal observation checkpoint — 17 September 2026: Signed revision 0db8a679f5d1acb50d9ff92e003cec91f145dfc8 is pushed. The isolated catalog selects the signed generation-bearing Kernel graph. Both original 60-second native gates pass with reviewed unstripped/packaged artifacts and fifteen clean component checkouts. Four strict Rust configurations and all 169 helper commands pass; the old marker assertion was corrected to require the added generation marker. Rootd orchestration selects the same immutable shared revisions. Typed mediator bootstrap, ordinary service-image adoption and both complete EriX builds inside EriX remain open.

Original archive-head CI 1653/1654 is fully classified with 406/486 passing in each run; layout and filesystem timeout failures remain in #18, #20 and #57. The bounded archive-selection repair #62 is closed on its specific evidence. Current CI 1659/1660 remains under observation without restarts.

Generation-bound cleanup consumer acceptance — 18 September 2026: Signed revision 4d4628f565d7102e6ef2987e4085fd8d97d247d3 is pushed. All 169 helpers and four strict 320/321-unit Rust matrices pass. Both actual 60-second native scenarios pass, including nineteen new CPL3 cleanup calls and the mandatory GENERATION_CLEANUP_OK marker. All earlier lifetime oracles remain required, and normally stripped packaged Kernels match their original builds. Both original CI 1661/1662 runs remain under observation. The ordinary service catalog is unchanged; ordinary source/effect/frame admission remains open. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain open.

Caller-local grant relocation checkpoint — 18 September 2026: Signed 8e66e54c86d93f257b6051da0381ff8cdc84fe2f selects Kernel 56d398e077c140c58e23f9cc2d8b79f19bc4cc2f and its coherent signed shared dependencies for the isolated native diagnostics. All 169 helpers, four strict 320/321-unit Rust matrices, formatting, strict Clippy, rustdoc and both actual native VMs pass without warnings. The lifetime scenario requires thirty-nine additional real CPL3 relocation controls before the original installation, revocation, terminal, inventory, queue and page oracles, with the original 60-second bound. Packaged artifacts reproduce the build outputs and all fifteen original component signatures are verified. Original CI 1663/1664 is waiting. Ordinary service source/effect and frame admission, actual owned consumer execution and both full guest builds remain separate open gates.

Explicit owned receiver admission acceptance — 18 September 2026: Signed 435e69a9840b37108529e5f9f9915937a12bafc9. The isolated native catalog selects the signed receiver-budget Kernel and coherent dependencies. All 169 helpers, four strict 320/321-unit Rust matrices and both actual native VMs pass without warnings. The owned scenario requires the receiver-admission marker before its final ownership marker; all prior lifetime and ordinary source/effect/frame gates remain intact. The existing profiler validates 48 current-source native sample processes. Costs still grow with retained populations and remain follow-up work. The changed registration fixture has a different workload hash, so no cross-source speedup comparison is admitted. Direct-native timings do not measure the separately removed packet descriptor allocation. Original CI is under observation. Actual owned Procd/Launchd service adoption, consumer VM execution, complete realm fairness/readiness/sealing and both full builds inside EriX remain open.

Original Integration catalog completion — 18 September 2026: At exact revision 0db8a679f5d1acb50d9ff92e003cec91f145dfc8, CI 1659 finishes with 396 passes and 90 failures out of 486; CI 1660 finishes with 393 passes and 93 failures. Each retains the 78 known Exsh layout refusals. The remaining 12 and 15 failures are original 120-second QEMU storage-scenario timeouts. All six terminal logs are complete (36,570,659 bytes), with zero warning candidates. Rust/unit and Markdown jobs pass. No workflow was restarted, no deadline was enlarged and no failed scenario is accepted. A shared guest or host cause is unestablished.

Caller-bound realm admission and retained storage contract — 18 September 2026

Use distinct Launchd operations BEGIN_REALM 0x6D0, PREPARE_REALM 0x6D1,
ABORT_REALM 0x6D2 and READ_REALM 0x6D3. The existing 0x6B0–0x6BF range belongs
to filesystem providers and is not reused. Little-endian bodies are exact, with
nonzero request correlation and no fallback to ordinary launch transactions.

BEGIN_REALM is an authority-free 8-byte request (request ID, operation). Derive
session, authority realm, original process/generation and Running job from the
actual native pending caller. Reserve an independently budgeted realm record,
a nonwrapping generation and one disjoint executable-scope receipt slot before
replying. Client numeric identities or a bearer sender cannot select ownership.

PREPARE_REALM has a 32-byte prefix: request ID and operation (u32), realm record
ID and generation (u64 each), and selector byte length (u64), followed by exactly
that nonempty UTF-8 selector without NUL. Parsing adds no pathname or packet-size
ceiling. The request carries exactly one actual SEND-only directory endpoint to
the reserved receipt slot. Verify the original caller/job/session/authority realm
again and retire every unretained received capability on refusal. Resolve only
inside this explicit directory, authenticate the exact executable and manifest,
and call Loaderd's existing private PREPARE_REALM. Never imply a Posixd pathname,
Named route, root, cwd, TTY stream, ordinary job or public PreparedProcess input.

ABORT_REALM and READ_REALM are authority-free 24-byte requests: request ID,
operation and complete realm-record ID/generation. They require the same original
Running native owner. READ observes retained state only; ABORT must complete
independent source, invocation and exact-child retirement before its successful
acknowledgment. Parent terminality initiates the same retained cleanup internally.

All four operations have an exact 40-byte capability-free response: request ID,
operation, raw result and state (u32 each), record ID and generation (u64 each),
receipt slot and zero reserved word (u32 each). States are Unconfirmed=0,
Reserved=1, Preparing=2, Guarded=3, Retiring=4 and Retired=5. Success at BEGIN
requires Reserved, a nonzero complete handle and receipt slot. PREPARE success
requires Guarded; ABORT success requires Retired. READ returns an authenticated
nonzero state. Only successful BEGIN returns a receipt slot; every other result
has zero there. Failure always has Unconfirmed state; failed BEGIN has a zero
handle while other failures echo the original complete request handle. Unknown
nonzero result codes remain full-width. Unconfirmed proves no resource absence.
Correlate the complete response with the original request before using evidence.

Replace obsolete LCH1 v2 with exact 72-byte version3 startup policy. Preserve the
first 68-byte field order and append realm_capacity (u32 at offset68). Require an
explicit deployment value: zero disables new realm reservations, and nonzero
values allocate that many retained records and disjoint receipt slots. Validate
checked job-route + stream-route + realm-receipt arithmetic before leaving any
ordinary transaction receipt storage. No default or incidental fixed array sets
realm count. Coordinate shared startup codecs, Rootd payloads, Launchd arena and
Integration policy/packaging; old version/width must reject. Extend the native
capacity descriptor with the realm record's size/alignment and a new layout
version; do not assume ordinary reply records survive long enough for realms.

Keep original child, local scope/grant obligations and native invocation owners
independent. Actual scheduler progress must exclude ordinary and indirect blocking
peer calls while any native invocation needs progress. A permanently discharged
source slot is never revisited after reuse. Native release precedes ordinary
exact-child abort; preserve first errors and exhaust independent cleanup without
returning uncertain state to normal operation. Guarded staging remains private
and unstarted, without exported SEND or a Running job. This initial admission
interface does not define configuration, readiness, sealing or publication.

Coordinated host negatives, strict source-bound build matrices and real consumer
VM execution are required. Two mediator processes, two clients per realm with
actual mediated I/O, complete fair progress, source/effect/frame admission and
both full builds inside EriX remain separate open acceptance requirements.

Original generation-cleanup catalog completion — 18 September 2026: At exact revision 4d4628f565d7102e6ef2987e4085fd8d97d247d3, CI 1661 and CI 1662 each finish with 408 passes and 78 failures out of 486. The exact failed set is the 78 known Exsh layout refusals. There are no storage timeout failures in these two observations; earlier timeout failures remain unresolved. All six terminal logs are complete (26,074,278 bytes), with zero warning candidates. Rust/unit and Markdown jobs pass. No workflow was restarted, no deadline was enlarged and no failed scenario is accepted.

Original realm contract library prerequisite — 18 September 2026: Signed ad85421257b7d964845fd4b84931966ad36cc122 selects the original bootstrap, capability and IPC revisions in Rootd orchestration. Only the Cargo dependency selection is published; Rust implementation and image policy remain unchanged in this commit. Four strict default/all development/release configurations pass 320/321 tests, host/native Clippy, native builds, formatting and private rustdoc without warnings. Compiler inputs contain no unpublished image-consumer changes. CI 1667 and CI 1668 are queued. Rootd can now pin this real original prerequisite before coordinated startup/image publication. Consumer VMs and both complete builds inside EriX remain required. Older CI 1663/1664 remains failed with 78 known layout refusals and one quota timeout per run; existing issues #57 and #18 retain the complete original evidence.

Coherent startup consumer acceptance — 18 September 2026: Signed Integration 8b1c037aed2503e1f2a4b17c8a8be0666d62a305 adopts exact 72-byte LCH1 version 3, explicit realm capacity and version-6 compiler-derived arena geometry across runtime profiles, wire/configuration boundaries and image packaging. Zero realm capacity disables admission while preserving native alignment; realm receipts remain separate from ordinary intake. Both catalogs retain their memberships and select one original 74-source union following 41 coordinated producer updates. The maintained 73-component source-policy gate passes. All 169 helpers and four strict 320/321-unit Rust configurations pass, including formatting, host/native Clippy, native builds and private rustdoc. Both actual consumer VMs pass their unchanged 120-second bounds: Launchd loads from ext4 and reaches ordered readiness; the initial shell prints its banner and exits successfully. Signed appliances, artifact and serial evidence are retained with zero build/VM warnings. Post-VM writable disk identity is recorded separately from the packaging checksum. Original Integration CI is under observation. Full source/effect/frame admission, complete realm operation and both full builds inside EriX remain required.

Explicit zero-realm startup acceptance — 19 September 2026: Signed Integration c479813423fb71c606fa30e5cf7d4dfb16f557d0 adds the bounded startup scenario using the existing explicit standard CLI policy. The actual VM passes the unchanged 120-second ceiling and ordered readiness checks; its signed image contains zero realm capacity in the exact 72-byte version-3 record, matching the version-6 native arena of 3,104,768 bytes. Eight route/capacity controls and four strict 320/321-unit Rust configurations pass, including fmt, host/native Clippy, native builds and private rustdoc. The original 169-helper run retains one physical-directory fixture timeout. The fixture now selects the probe’s existing ten-second command budget and has deterministic expiry controls; all four affected suites pass (9, 5, 5 and 7 tests), with unaffected source bytes verified unchanged. The original failure remains in bug 63. Build and validation streams contain no warnings. Original CI 1671/1672 is running. This proves ordinary startup with admission disabled; complete realm execution, source/effect/frame admission and both full builds inside EriX remain required.

Original coherent-graph CI classification — 19 September 2026: CI 1669 records 485 passes/1 failure; CI 1670 records 484 passes/2 failures, each across all 486 scenarios at 8b1c037aed2503e1f2a4b17c8a8be0666d62a305. Both retain the original 120-second ext4 quota timeout in bug 18; the latter also fails physical input observation in the exact-selector race scenario, now bug 64. That scenario explicitly passes in the paired run. All six terminal logs are complete (27,557,577 bytes), with no warning candidates; Rust and Markdown pass. No incompatible shell-layout refusal remains. The layout issue’s full source/frame prerequisites and later native-image gates remain unproved. Neither workflow was rerun, and no deadline or admission check was relaxed.

Tracking and rollout

The Phase 6 master completion checklist tracks all 460 acceptance items, including supplementary requirements, section weights, current acceptance, owning issues and PRs. Update it alongside this record whenever scope, accepted evidence, regressions or CI disposition changes. Current accepted completion is 15 items, 3.48% weighted; both complete builds inside EriX remain required.

Coordinated library dependency update — 15 September 2026

Signed 2a16b1a7ac5514a43582025e5b9ba0a2f2ce2a29 aligns existing dependency pins with the original foundation commits for coherent runtime adoption. This update changes Cargo selections and the roadmap; Rust implementation files in this repository are unchanged. All default/all-feature development/release configurations pass 320 default / 321 all-feature tests, strict host/native Clippy, formatting, four native builds and private rustdoc without warnings. Final canonical documentation checks pass. Component CI is being monitored. The product catalog remains unchanged; this update does not establish a new runtime VM, authority-lifecycle closure, performance result or guest build. All 162 workflow helper commands pass with retained original source identities and complete warning-free outputs. Full Integration CI is being monitored separately; earlier native-image serial-check failures remain open in issue #46. Review: #12.

Library dependency wave accepted — 15 September 2026

Eight more libraries now have signed dependency checkpoints and complete classified push/review CI: lib-block, lib-bootimg, lib-capabi, lib-driver, lib-stdio, lib-time, lib-tty and lib-vfs. Their strict default/all development/release matrices pass 22, 63, 192, 2, 21, 23, 12 and 6 tests respectively, plus host/native Clippy, 32 native builds, formatting and private rustdoc, with no warnings. Five missing WIP reviews were created with docs/enhancement/phase-6 metadata; existing reviews retain their scope and labels. Final roadmap checks correct the CapABI pin and remove superseded time-library dependency notes. The next layer includes runtime helpers, Kernel, build tools and command consumers. The product catalog and product VM acceptance remain pending.

First runtime dependency wave — 15 September 2026

Five signed dependency checkpoints now pass their complete applicable local matrices and classified push/review CI: lib-ed25519 (46 tests), lib-fs-crypto (15), lib-partition (11), lib-ipc (381 plus 20 syscall-shim tests and one existing native-only ignore), and the host sha2-tool (12). Their Rust implementation files are unchanged. Four missing WIP reviews were created with applicable docs/enhancement/phase-6 metadata; the existing shared IPC review retains its metadata. The product catalog is unchanged. Eight library dependents form the next pin-propagation wave before service adoption and actual product VM validation. Neither current runtime execution nor a complete guest build is claimed.

Coherent runtime source adoption — 15 September 2026

The product runtime catalog still selects the earlier source graph. Adopt the current original signed sources as one coherent graph before claiming product execution of the new kernel invocation, mediator construction and Procd caller-admission contracts. The frozen inventory covers 73 catalog components and 72 tracked Cargo manifests; 54 components need direct pin alignment, with further propagation after dependency commits are published.

Align dependency selections bottom-up, preserve original Git objects, and validate every altered repository under its supported strict configurations before signing and publishing its dependency commit. Full commit selectors remain mandatory. Unrelated work is preserved, and no synthetic replacement object or rewritten published history supplies build evidence. Update the runtime catalog only once all selected Cargo manifests and original metadata agree.

Run actual product images covering authenticated Launchd activity and the relevant lifecycle/authority regressions, adding negative caller controls where needed. Keep complete warning-free build/test/image evidence and monitor existing CI. Significant regressions use the canonical bug report format. Dependency alignment alone does not prove runtime authority closure, mediator execution, performance improvement or either complete guest build generation. Typed grant return and guarded bootstrap remain the next realm implementation boundaries.

Native caller admission checkpoint — 15 September 2026

Signed Procd c583614aa48f3e11a3ccabfeee06340f518de750 now checks the actual pending native caller on Launchd ingress against its retained running Launchd process and stage generation before operation-specific receipt validation or dispatch. Forwarded SEND aliases, request-body identities, other lifecycle roles, reused generations and unavailable identity cannot acquire this dispatch permission. Other receivers retain their policy; rejected delivered transfers still undergo local disposal, and uncertain disposal stops ordinary continuation.

Five new producer controls exercise accepted event dispatch and refusals without consuming the private event. The complete strict host/native development/release matrix passes: 239 default-feature tests, 244 all-feature tests, Clippy, rustdoc, formatting and forty native binary builds, with no warnings. The changed runtime-loop fragment is formatted by the repository formatter; its other code matches the formatted original outside the reviewed admission replacement.

Signed documentation 45d4d04c534f2ebca857ee203265232fd7c32bbe passes 45 tests and a frozen 2,375-page manual with 433,469 in-bounds word boxes and no final warnings. Page 212 was visually reviewed. The receiver inventory also corrects the existing powerbox omission and obsolete loader operation count. Shared API snapshots are unchanged.

Procd CI 274/275 and Docs CI 879/880 pass with complete classified logs and no final warnings. Both component cohorts are complete. Product runtime-image validation still requires a coherent original-commit dependency graph; this checkpoint does not claim a new Procd VM. Actual returned-grant custody, guarded bootstrap, readiness/configuration/seal, mediated client byte I/O, fair retirement and both complete guest build generations remain open.

Validated mediator constructor adoption — 15 September 2026

Procd selects checked native operation 54 only for mediator staging, without a parent VSpace receipt. The native TCB retains backing; the child initially holds only its primary endpoint. Other roles retain ordinary construction and its existing receipt/drop sequence. A refusal never falls back to operation 32. Scratch absence cleanup, exact stage retirement, private endpoint-master custody, grant-only handoff and all ordinary mediator start gates remain in place.

Producer implementation is signed at Procd 3d9fe97bb66ea82442728ef8a10b998d7159a9ba. Procd passes 55 focused materialization controls and 234/239 default/all tests, strict host/native Clippy, rustdoc, formatting and forty freestanding builds across ten binaries. Exact requests, omitted receipt/drop, materialization, refusal without fallback and unchanged ordinary behavior are covered. CI 272/273 passes with complete warning-free logs.

The previously accepted Kernel 6d2ca19c native fixture establishes the constructor object, root-absence and backing contract. This checkpoint adds producer transport controls; it does not claim a new Procd CPL3 VM, runtime-image adoption or runnable realm. Integration source and native VM inputs are unchanged. The manual is signed at Docs 8b30523f3d7e1c300f39e3418a8748dae10ec04f; all 45 tests, final warning-free rendering and CI 877/878 pass.

Runtime-image adoption, authenticated grant return, guarded bootstrap routes, private execution, receiver readiness, configuration/seal, client I/O, fair retirement and both full guest build generations remain open. Whole-codebase semantic authority and private-item documentation audits remain incomplete.

Mediator constructor adoption — 15 September 2026

Procd will select checked native operation 54 only for the mediator lifecycle class, with no parent VSpace receipt. Native TCB custody retains the mapped backing. Ordinary roles retain operation 32 and its existing receipt/drop sequence. Scratch absence cleanup, complete failed-stage retirement, grant-only handoff, retained endpoint master and all ordinary mediator start gates remain required. A refusal of operation 54 must never fall back to operation 32.

Extract the materialization constructor and test transport before adding coverage so each code file remains below 1,000 lines. Verify the exact constructor request, omitted receipt and drop, ordinary behavior, refused construction without fallback, materialization and final cleanup. Existing native construction evidence remains the authority/object proof; producer transport doubles do not establish a running mediator. Shared pins will select signed IPC 7c7712057cc5d16ab16a677a886caeac54814a16 and capability ABI 2d6b12832b3f0d798756a9c7f29a7c52a8b3bc70 through the existing dependency graph.

Authenticated grant return, guarded bootstrap routes, private execution, readiness, configuration/seal, fair retirement and both complete guest build generations remain open.

Construction without child root capabilities — 15 September 2026

Select the signed native construction graph and require actual root-capability-free construction and complete disposal in the existing lifetime VM oracle. Signed original revision: 9e607330da7a87a2a6cd84e76cb667387faab1e2. All 162 workflow helper commands and strict Rust default/all development/release checks pass, including 320/321 tests and profiler regressions. Both native VMs pass with actual exit status zero, clean owned teardown and empty QEMU stderr. The lifetime program adds fourteen actual CPL3 construction/attenuation/disposal calls while retaining its earlier thirteen installation and fifteen ordinary construction calls. All required markers occur once in order. Full Integration CI remains separate from local acceptance.

Procd adoption, authenticated grant return, guarded bootstrap authority, private mediator execution, readiness, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase semantic authority and private-item documentation audits remain incomplete.

Staged endpoint attenuation checkpoint — 15 September 2026

The native catalog selects signed Kernel d690eda817e56b515a278bdbb5ea6c5aedeb431b, IPC 74c75a5db226413c066b6582210a44cb21d968d8 and capability ABI 2a01c205701e5f976503b82742e1de54d3fbe950. The lifetime fixture retains thirteen installation and seven constructor/disposal calls, adding eight actual CPL3 staged endpoint attenuation calls. The new ordered, unique STAGED_ENDPOINT_ATTENUATION_OK marker requires actual returned identity, exact rights, refusal and complete cleanup. The separate owned-invocation oracle is unchanged.

Integration 2d6f830e84b561090fd6288bf26db0cce3b1b05a passes all 162 workflow helper commands and the fresh strict 320/321-test default/all development/release Rust matrix, formatting, Clippy, warning-denied native builds and private rustdoc. Both actual native VMs pass with empty QEMU stderr and clean teardown. Source byte checks bind both executions to the published tree. Full Integration CI 1629/1630 is waiting at its first bounded observation; pending runs are not passes.

Authenticated grant return, independently minimal root/bootstrap authority, retained native and nested guards, private execution, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates stay closed. Full semantic authority and inline-documentation audits remain incomplete; no new performance or guest-build claim is made.

Current Integration 4b65755f1f2774798d4a909212db4e64c0349b86 finishes with failed push CI 1603 and PR CI 1604. Each complete catalog reports 54 passes and 432 failures out of 486 scenarios. Six full terminal logs total 14,427,322 bytes, with no warning candidates. Both Rust and Markdown jobs pass. The later isolated native diagnostic, canonical images and terminal modes are not reached by these runs.

Issue 50 tracks the observed shared-compiler regression: valid dependency-qualified Rootd selections are rejected as unknown local features. A minimal original-manifest check confirms the failure. The correction separates compiler cfg ownership and adds direct, transitive, malformed and real-compiler coverage; its full local checks are underway. Original failures remain retained, and these terminal runs are not being replayed unchanged. Earlier isolated native VM acceptance retains its separate exact source and artifact scope.

Signed Integration 4b65755f1f2774798d4a909212db4e64c0349b86 adds the isolated native lifetime scenario and corrects standalone kernel service selection, target-scoped cache identity and original-manifest feature closure. The redundant feature implication table is removed and the shared resolver joins the builder fingerprint. The normal component catalog remains independently selected.

The strict development/release default/all-feature Rust matrix passes 320/321 units, doctests, private rustdoc and freestanding builds; missing documentation remains denied. All 159 helper suites are accepted across the complete run and justified follow-ups: installed filesystem-tool routes and actual stage tracing, serialization after the real VM releases the global scenario lock, and declaration of the compiler fixture's selected feature. Original failures and actual statuses remain retained; assertions and production deadlines are unchanged.

The actual native VM passes both ordered unique markers, expected exit and forbidden-marker checks using signed Kernel 03e13a784bde08914864267a4e2a6324a22d05c7 and Bootloader e7fa39357a38c21529cccfd16cf3446eb07e8aa5. The 2,142,208-byte image has SHA256 4f021a40264739fef4979da2b0cd4647bde3f76b9dada6816aba6faa3594a797; QEMU stderr is empty. Complete preparation and execution takes 19.20 seconds under the unchanged 60/45-second VM limits, not a guest performance measurement. Kernel CI 528/529 and Bootloader CI 135/136 are green. Integration CI 1603/1604 is running; older suite and complete current-head acceptance remain pending. Realm adoption and both full guest build generations are unproved.

Dependencies: meta#2

Dependencies identify required contracts and closure gates; preparatory inventory/design can proceed in parallel under one owner per edited file. Link bounded implementation issues and their PRs here before claiming acceptance. Use feature/posix-compat, regular signed commits in the canonical contribution format, and WIP PRs linked to the exact coherent component graph. All cross-repository Cargo/catalog selections and CI helpers use full 40-character lowercase commit hashes, including transitive dependencies; do not substitute branch, tag or implicit HEAD selection.

Close criteria only with their own reviewed deliverables and validation evidence. Pending, skipped, cancelled, failed or predecessor-only results remain distinct. Keep main images unchanged until explicit promotion direction; technical completion does not authorize merges, release tags or publication.

Native diagnostic observation — 19 September 2026: the first actual caller VM fails before its required success marker. Exsh exits 0xe5, Rootd exits 0xdc and the unchanged progress watchdog stops QEMU. Integration issue 66 records exact reproduction and retained appliance/log identities. All 169 Integration helpers and four strict Rust configurations pass; this does not establish native execution. Request/error telemetry through the existing stdout route is under validation. No cause, weakened gate or completion credit is inferred.

Signed reproducer — 19 September 2026: Integration 76411ed6d96356b20ee0a4c21ad219dacc56340d publishes the explicit scenario and selector. With the documented image signing inputs, run bash scripts/run-scenario.sh tests/scenarios/appliance-disk-image-realm-admission-positive.toml components.toml. The original failed runtime uses the same scenario, implementation and component graph; only roadmap status changed after validation. Its VM result remains FAIL. All 169 helpers and four strict Rust configurations pass without warnings. Original CI 1673 and 1674 are queued. Issue 66 retains the failure. No acceptance credit or complete realm execution is claimed.

Original CI observation — 19 September 2026: CI 1671 finishes with 471 passes/16 failures and CI 1672 with 465 passes/22 failures across all 487 scenarios at c479813423fb71c606fa30e5cf7d4dfb16f557d0. Every failed scenario is an ext3/ext4 positive filesystem case reporting error: qemu timed out after 120s, with scenario status 1. The existing filesystem deadline report retains the expanded matrix; quota issue 18 applies to the quota failure in 1672. All six complete logs are hashed (41,592,478 bytes), with zero warning candidates. Rust, Markdown and the full helper step pass. The zero-realm startup and exact-selector race scenarios explicitly pass in both runs. No common cause, source regression boundary or performance diagnosis is inferred; all actual deadlines and failure statuses remain unchanged, and neither workflow was rerun.

Corrected native caller VM — 19 September 2026: signed Integration 9139c6c5fa38c139e92520f6d410626b4cf1e4aa selects Launchd ca9e7f534e26023a6c011b5cb9a8e256fd56c2d6, Exsh 9c0f7ab851d527dd9dd10161d6a98e1fdc14598e and Docs ce8a1538ab2220f1b346e1a051265f58f83f47fc. The actual VM passes all eleven admission calls over the shell's existing private script route: reservation, reads, full-width stale-generation rejection, missing-scope refusal, acknowledged retirement, record reuse and stale-abort rejection. Exactly one ERIX_EXSH:REALM_ADMISSION:VERIFIED precedes ERIX_ROOTD:INITIAL_EXSH:EXITED_OK. The original 120-second hard limit and 45-second progress watchdog are unchanged; scenario status is 0 and no build warning is present.

All 106 actual appliance artifacts and complete logs are retained. The 55,738-byte serial log has SHA256 bbf41401e975cb0b39c6d62ca32f8e612f4f751a505a7dbb113fe1f05c6415f7; the post-VM writable disk has SHA256 8f7faf83e8923de675bf5d030458f7bf7e8065dc4fdb95ec98714dfebc5f7938. The earlier packaging checksum is retained separately. Independent review verifies all 73 original component revisions, the packaged diagnostic executable and the signed image's exact 72-byte LCH1 version-3 capacity record (four realm records; native arena 102,400 bytes). All 169 helper commands, twelve route/scenario controls and four strict 320/321-test Rust configurations pass, including native builds, fmt, strict host/native Clippy and private rustdoc; all 394 host streams are warning-free. Both failed predecessor images remain evidence in issue 66.

The first BEGIN failed because the shell's private script intake lacked realm dispatch. The correction retains active-envelope and original native-owner checks and original reply custody, without delegating a new sender. Exsh's uncertain-disposal path makes no stdout IPC before terminal failure. Original Integration CI 1675 and 1676 are queued. Successful preparation, mediator configuration/readiness/sealing, client byte I/O, complete source/effect/frame proof, native Rust/LLVM rebuilding and both full EriX builds remain required. This partial lifecycle acceptance adds no whole checklist item.

Next native validation — 19 September 2026: add an opt-in Exsh guarded-preparation diagnostic using the existing realm ABI. Keep the passing eleven-call admission-only scenario separate. The new diagnostic will reserve a record, transfer exactly one SEND-only copy of its explicitly supplied startup cwd to the BEGIN-reserved receipt slot, select bin/true within that initial root scope, require PREPARE/Guarded and READ/Guarded, then require ABORT/Retired and a stale READ/NOT_FOUND. The packaged native true executable is an unstarted staging fixture; it does not stand in for a running POSIX mediator.

The existing authenticated private Launchd route remains the sole request path. No ordinary start, new endpoint, root capability or implicit namespace is introduced. Launchd must retire its received directory copy after exact resolution; Loaderd must return the original staged child and grant, and Procd must retain the actual returned grant and guarded sender branch before acknowledging Guarded. Abort must retire that exact stage and retained custody. Error telemetry must preserve application refusal codes and stop ordinary output after uncertain receipt disposal. Independent host controls will cover literal operation order, transfer scope/rights, full correlation, missing or malformed acknowledgments, surplus receipts and no continuation after failure. The new actual VM retains the 120-second hard and 45-second progress limits and requires its own unique marker before ordinary shell exit. Full source/effect/frame proof, configured/sealed mediator execution, real client byte I/O, native Rust/LLVM rebuilding and both full EriX builds remain required.

Native guarded preparation — 19 September 2026: signed Integration 78557a6c672ecf426dfe894a01cc4aeec73b5e3c selects signed Exsh ffe50612889dd58a45a40d04593a4aa3a3ffa512 for the separate appliance-disk-image-realm-preparation-positive scenario. The actual VM passes the eleven existing admission calls followed by BEGIN/Reserved, PREPARE/Guarded, READ/Guarded, ABORT/Retired and stale READ/NOT_FOUND. It transfers exactly one SEND-only copy of the explicitly supplied initial cwd to the authenticated reservation and selects bin/true inside that scope. This packaged executable remains an unstarted staging fixture. The existing private Launchd route is reused; no new endpoint, root grant or implicit namespace is introduced.

Exactly one admission marker and one ERIX_EXSH:REALM_PREPARATION:VERIFIED precede ordinary successful initial-shell exit. The original 120-second hard deadline and 45-second progress watchdog remain unchanged; scenario status is zero and build warnings are absent. The separate admission-only scenario is preserved. All 106 actual appliance artifacts and complete logs are retained. Serial SHA256 is 7ef35833c2d88abcd093c8813791e11cea0d34edb2e29b8686df6996e2bc32ff (55,776 bytes); post-VM writable disk SHA256 is 3439d0750ea456ceb8d9fbb063d6af763b4198a85f0270ae8d22c76c6ff99499. Its earlier packaging checksum is retained separately. Independent artifact review verifies all 73 original component revisions, both diagnostic markers in the actual packaged executable, and the signed image's exact 72-byte LCH1 version-3 configuration with four realm records and a 102,400-byte native arena.

All 169 Integration helper commands, seventeen route/scenario controls and four strict 320/321-test Rust configurations pass, including native builds, fmt, strict host/native Clippy and private rustdoc; all 394 host streams are warning-free. The post-validation source delta changes only the two Exsh catalog pins and final documentation status, preserving checked implementation bytes. Exsh passes ten strict 976-test configurations, ten native builds and 355 frame-checker controls without warnings. Eight actual frame observations retain complete workspace mapping but incomplete 97/63/100/100 runtime/all/admission/preparation proof in both policies; the full frame gate remains required.

Original Integration CI 1677 and 1678 are queued. Original Exsh CI 271 and 272 are under observation. Complete typed mediator bootstrap, readiness/configuration/sealing, real client byte I/O, complete source/effect/frame proof, native upstream Rust/LLVM rebuilding and both full EriX build generations remain required. This prerequisite adds no accepted whole checklist item.

Original guarded-preparation CI — 19 September 2026: Exsh run 271 and 272, for signed ffe50612889dd58a45a40d04593a4aa3a3ffa512, both fail the required complete frame proof. All 976 Rust tests and 355 checker controls pass. Four complete hashed logs total 320,166 bytes without warnings; Markdown passes. Each original workflow reports four complete workspace mappings and incomplete runtime/all frame observations (101/68 unresolved). These actual CI observations are distinct from the local eight-configuration frame observations. The passing guarded-stage VM does not waive this failure. No workflow was rerun or cancelled to obtain acceptance.

Guarded-custody documentation reconciliation — 19 September 2026: signed Posixd PR 5, 9b031a8c2f996491a322046a4f2acd5dacdc55c2, replaces stale grant-return and proposed-custody gaps with the implemented producer boundary. Procd uses the actual returned grant to attenuate the initial endpoint to RECV before execution, removes bypass sources, and retains nested custody beneath Kernel lifetime custody. A later mediator disposal report cannot prove absence of bypass senders. Exact staged abort and the remaining counted startup, readiness, configuration, sealing, client I/O and running-realm retirement requirements are distinguished. This repository still has no Posixd executable.

Markdown, canonical headings/governance, local links, original source anchors and whitespace checks pass. Original Posixd CI 17 and 18 both pass from two complete hashed logs totaling 7,232 bytes without warnings. Rust checks do not apply to this documentation-only repository.

Signed Docs PR 4, 7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d, removes the matching stale passages from the process-services manual. All 45 tests and the full 2,419-page manual pass. All 445,847 word boxes lie within page bounds; the actual changed paragraphs and continuation on pages 222, 226 and 227 are visually reviewed, with zero final warnings. Shared API snapshots are unchanged. Original Docs CI 977 and 978 are running. These documentation corrections add no runtime behavior; the previously retained Integration 78557a6c672ecf426dfe894a01cc4aeec73b5e3c appliance retains its original source selection and passing guarded-preparation evidence. Native upstream Rust/LLVM rebuilding and both complete EriX builds remain required.

Process-start census correction — 19 September 2026: signed Kernel b762e19d0c16acd605d0f6123994a586cc6fcde1 requires a successful install-grant absence census before process start. An unavailable census returns the existing refusal and preserves the whole staged child and grant state. Hosted controls cover unavailable census, actual grant disposal and malformed-target precedence. Normal bootstrap initializes tracking before admission; production reachability of the injected condition or a native authority escape is not established. Kernel issue 18 uses the canonical bug report and records the original failure and bounded correction.

Four strict Kernel matrices pass 704/728 library tests and two standalone controls each; three existing ignored tests remain ignored. Formatting, strict host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass. Original Kernel CI 606 and 607 pass from all four complete hashed logs (739,843 bytes), without warnings.

Signed Integration b65183ddb93eb4396d4140a002c3727fec42ff87 selects that Kernel and the reconciled Docs 7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d, preserving all other catalog entries and all previously checked orchestration bytes. The matching guarded-preparation VM passes both unique markers and ordinary successful shell exit under unchanged 120-second hard and 45-second progress limits. All 106 artifacts, all 73 original component identities and the actual signed image are verified without warnings. Serial SHA256: a373a8ccd81ac3efbaa492cbf2e1f991f3cc34dcbf23a1435c1c48cd75cd5c1c (55,776 bytes); signed boot-image SHA256: 3b88d37183cf36dcbd5f1105cc0fd86e79aa4489d311300003f3f362c24bcd0a. This remains an unstarted staging fixture. Normal native execution does not exercise the hosted unavailable-census condition.

The prior complete 169-helper/four-matrix Integration evidence is verified against unchanged implementation bytes. Focused catalog/source checks pass, including 46 immutable-source and five tool-selection tests. An initial host fixture failure caused by disabling its deliberate Git replacement setup is retained; the established helper environment passes without altering product checks. The static census covers 3,127 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 170 direct missing_docs gates and 92 conventional crate roots; complete semantic authority and private-documentation closure remain open.

Original Integration CI 1679 and 1680 are queued. Earlier 1677/1678 remains queued and 1675/1676 is running. No unchanged workflow is rerun or cancelled. Complete mediator execution, full source/effect/frame proof, upstream Rust/LLVM rebuilding and both full EriX build generations inside EriX remain required. No whole acceptance item is newly completed.

Shared native terminal transition — 19 September 2026: signed Kernel 37d9c74d6d1209729c520a52a274c1646efe225c consolidates exit and kill event reservation, lifetime preflight, exact-generation commit and receiver/invocation retirement into one documented implementation. Existing public behavior and root exit cleanup remain unchanged. Terminal state and actual resource destruction stay separate. This completes the terminal-refactor prerequisite in child lifetime design #19; it introduces no lifetime binding, new opcode or additional authority.

Four strict Kernel matrices pass 704/728 library tests and both standalone controls, with three existing ignored tests unchanged. All thirteen native build/Clippy profiles, formatting, host/native Clippy and private rustdoc pass without warnings. Original Kernel CI 608 and 609 pass from all four complete hashed logs (739,870 bytes), without warnings.

Signed Integration a62d1381f56a01afc692112d9b427205eaeb6a2e updates both full Kernel selectors and five stale native diagnostic selectors while preserving source memberships and tested orchestration bytes. Both maintained native runners pass their original 60-second scenarios: lifetime revocation and owned invocation. Complete serial logs are retained (1,807 and 1,587 bytes), QEMU stderr is empty, and build warnings are absent. Packaged Kernel bytes match retained unstripped artifacts; all fifteen exact original component trees and signatures verify. Four current strict 320/321-test Integration matrices, native builds, formatting, host/native Clippy and private rustdoc pass. Seven focused source/native-policy checks pass; the complete 169-helper evidence remains hash-bound to unchanged implementation bytes.

Original Integration CI 1681 and 1682 are queued; older corrected 1675/1676 remains running. The static census covers 3,128 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 170 direct missing_docs gates and 92 conventional roots. Full semantic authority and private rustdoc closure remain open. Native child-lifetime custody, running mediator lifecycle, full frame proof, upstream Rust/LLVM rebuilding and both full EriX build generations inside EriX remain required. No whole phase acceptance item is added.

Original corrected-source CI checkpoint — 19 September 2026: at signed Integration 9139c6c5fa, original push CI 1675 passes all 488 VM scenarios. Original PR CI 1676 passes 487/488 and fails only subsystem-e2fs-fat-ext3-htree-positive at the unchanged 120-second QEMU limit. Both pass appliance-disk-image-realm-admission-positive; both Rust and Markdown jobs pass. Six complete hashed logs contain 27,276,890 bytes and no warnings. No rerun or cancellation supplies either result. The ext3 timeout remains tracked in issue 20; its cause is not inferred from the passing sibling run. The private script-route admission defect is corrected and natively demonstrated, while full realm lifecycle, complete frame proof and guest builds remain open.

Native child lifetime checkpoint — 19 September 2026: signed Kernel 1428885e6d27e8e2bcefbbf68caf22ece253aac9 implements operation 58 using the actual Running caller, an exact Created child, independent Process authority and its real local install grant. It consumes only that grant, reserves cohort events before terminal effects, stops descendants before their supervisor and retains each bound child's cleanup duty and first failure independently of userspace survival. Return-boundary disposal closes outgoing accounting and respects current/active-interval protection. Fourteen new real-object controls cover refusals, rollback, nested stopping, a 257-descendant tree, late preflight failure, exact reuse and failed explicit abort after unlinking. Four strict 718/742-test configurations and both standalone controls pass; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Original Kernel CI 610 and 611 pass from four complete hashed logs, 751,929 bytes, without warnings.

The matching maintained lifetime VM passes its original 60-second scenario with the additional ERIX_KERNEL:CHILD_LIFETIME_OK marker. A real CPL3 supervisor proves ChildPopulate refusal, malformed/generation refusal, actual Process-route binding, start and exit. An independent observer verifies both exact children, CSpaces and mappings absent before terminal-event consumption, then disposes the unbound supervisor. The runnable child has a faulting sentinel and intentionally does not execute. All sixteen additional mapped pages are disposed. The original owned-invocation VM also passes its unchanged scenario. Complete serial logs contain 1,838 and 1,587 bytes; QEMU stderr is empty and build warnings are absent. Packaged Kernel bytes match retained original unstripped artifacts and all fifteen selected component signatures verify. Lifetime serial SHA256 is 012b46541b7c1c89d954cdbebda855037152a4e39ffad20ad7bdcc8c7b5c2572.

This establishes explicit native supervision with actual caller-side CPL3 evidence. Executing-child, no-successor native idle, allocation/partial-effect failure coverage, Procd adoption, running-mediator failure, provider completion, complete source/effect/frame proof, upstream Rust/LLVM rebuilding and both full EriX-in-EriX generations remain open. Host idle controls do not establish native interrupt or wakeup behavior. No whole phase acceptance leaf is added.

Signed Docs 9ca5a5e811766a4506c0626cd58f8e228d0bacf8 updates the technical manual's native admission, preflight, stopping, partial cleanup and safe return/idle contracts. All 45 tests and the complete 2,425-page manual pass with zero final warnings. All 447,213 word boxes are in bounds and all three changed contract pages are visually reviewed. Shared API reference source is unchanged. Original Docs CI 981 and 982 pass from four complete hashed logs, 773,510 bytes. Both pass 45 tests and the complete 2,425-page manual. TeX pass warning counts are 36/1/0, with zero final-pass warnings; neither workflow was rerun or cancelled.

Signed Integration 581226ab54 selects the coherent original Kernel/lib-capabi/lib-ipc graph and updated manual. All four current strict 320/321-test configurations, four native builds, fmt, strict host/native Clippy and private rustdoc pass without warnings. Source and updated native-policy checks pass; the full 169-helper evidence remains bound to unchanged orchestration bytes. The final post-VM changes select only the newer Docs revision and update roadmap status; native source catalog, scenario, runtime and orchestration bytes are unchanged. Original Integration CI 1683 and 1684 are queued.

Executing-child and terminal-reply checkpoint — 19 September 2026: signed Kernel dd9eace5 validates actual CPL3 nested-child execution and current-child ancestor termination. Synchronous control dispatch now ends its request borrow before effects and checks original caller identity, generation and terminal state before any response write. It keeps terminal completion in Kernel-owned result registers with zero reply length; ordinary native return switches away. A surviving caller retains its normal encoded response. Two focused actual-object regressions cover terminal request preservation and the surviving-caller reply. The dispatcher is split from the tracing/policy file. A supervisor binds and starts a child; that child binds a staged grandchild and kills its supervisor through its own explicit Process SEND route. Read-only witnesses require terminal caller storage to survive dispatch, then exact child/grandchild absence before the independent observer reads child-before-supervisor events. Both terminal payloads have immediate UD2 sentinels. An unrelated Created process retains its exact record, empty capability inventory and mappings until explicitly aborted. All four additional lifetimes and twenty-two mapped pages must be disposed for ERIX_KERNEL:CHILD_EXECUTION_OK.

Four strict Kernel configurations pass 720/744 library tests and both standalone controls; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Signed Integration c14c5a61 requires the additional marker while preserving every earlier marker and the original 60-second limit. Both actual native scenarios pass, with 1,870/1,587 complete serial bytes, empty QEMU stderr and no build warnings. Packaged Kernel bytes equal retained original artifacts after normal stripping; all fifteen original source signatures verify. Lifetime serial SHA256 is 1b2f983239efca55c8bc0f6f08ee91cfdcd37d4d1f6951bbd740e4d9b45d1a2f. Four current Integration 320/321-test configurations, native builds, strict Clippy, formatting, private rustdoc and updated policy checks pass. Earlier 169-helper evidence is hash-verified against unchanged orchestration; it was not rerun for these scenario/catalog changes.

Signed Docs b4b01d87 documents the executing-child observations and remaining limits. All 45 tests, the full 2,425-page manual, 447,382 word bounds and visual review of the changed pages pass, with zero final warnings. The API reference source is unchanged.

This extends native executing-child evidence; it does not establish no-successor native idle/wake behavior, provider completion, Procd adoption or a complete service lifecycle. The original install-grant constructor still gives GRANT | MINT while binding needs only GRANT; move-only transfer preserves exact rights. Both diagnostic grants are consumed, but rights minimization remains an explicit audit follow-up. Full source/effect/frame proof, the Pagerd gate, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.

Related implementation tracking: Kernel feature, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.

Original Kernel CI 614 and 615 pass from four complete hashed logs, 753,462 bytes, without warnings. Original Docs CI 983 and 984 pass from four complete hashed logs, 773,542 bytes. Both pass all 45 tests and the complete 2,425-page final manual; reference-resolution warning counts are 36/1/0, with zero final warnings. Original Integration CI 1685/1686 remains queued at its second observation.

Older original Integration CI 1678 passes all 489 catalog scenarios and both native Kernel diagnostics, then fails the development COM1 editor probe after its physical counterpart passes. Rust and Markdown pass. All three complete logs total 13,384,697 bytes with no warnings; the outer input status does not establish cause. The canonical bug report is issue 67, with bug/ci/phase-6 metadata. Earlier editor and filesystem failures remain separate. No original workflow was cancelled or rerun.

Native cleanup without a userspace successor — 19 September 2026: signed Kernel 2cf5b34c adds a seventh actual CPL3 caller to the maintained lifetime diagnostic. After every earlier assertion, the observer binds/starts the final child and yields. The child kills that supervisor through its own explicit Process SEND route. Immediate faulting sentinels forbid either terminal payload from resuming. Ordinary native return closes CPU accounting, detaches current attribution, progresses reclamation and finds no runnable successor.

A diagnostic-only read-only witness then requires empty CPU accounting, only terminal retained records, no bound cleanup duties or event reservations, exact child identity/CSpace/mapping absence and both unconsumed child-before-supervisor events. All six final child pages retire; three original unbound terminal records remain for prior assertions. The witness neither performs cleanup nor selects a process nor installs an interrupt. ERIX_KERNEL:CHILD_IDLE_CLEANUP_OK precedes completion before HLT, so actual hardware halt/wakeup remains a separate gate.

Signed Integration 4d6f4fe8 requires the additional marker while preserving all earlier assertions and both 60-second scenario limits. Both actual native VMs pass: 1,905/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256: 4a7cba61f75f4eeac47896d165b8dbcd217e4c75e2a81c8ae0f29957facb929c. Packaged Kernel images match retained build artifacts after normal stripping; all fifteen original component signatures verify. Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Post-VM changes only select updated Docs in full catalogs and update roadmap status.

Signed Docs 69466a64 documents the pre-halt boundary and consolidates stale status paragraphs. All 45 tests, the complete 2,425-page manual, 447,534 word bounds and visual review of pages 562–564 pass with zero final warnings. API reference source remains unchanged. The static audit passes 3,140 authored code files below 1,000 lines, 74 manifests, 259 full Git selections, 171 direct missing_docs gates and 92 conventional crate roots; semantic authority and complete private-rustdoc closure remain open.

Original Kernel CI 616 and 617 pass from four complete hashed logs, 753,458 bytes, with no warnings. Original Docs CI 985 and 986 also pass: four complete hashed logs, 773,510 bytes; both pass 45 tests and the final 2,425-page manual. Reference-resolution warning counts are 36/1/0 with zero final warnings. Original Integration CI 1687/1688 remains queued at its first observation.

Older original Integration CI 1677 is now terminal failure: all 489 catalog cases, both native diagnostics, development physical/COM1 editor and release physical editor pass before release COM1 fails. Rust and Markdown pass. Three complete logs total 13,385,246 bytes without warnings; bug 37 retains this evidence. Companion 1678's earlier development COM1 failure remains separate in bug 67; a common cause is unproven. No original workflow was cancelled or rerun.

Further native failure controls, grant-rights minimization, terminal accounting, Procd adoption and complete service lifecycle acceptance remain open. Existing install-grant creation still supplies GRANT | MINT while binding needs GRANT, so minimum authority is not claimed. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.

Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.

Further original CI observations — 19 September 2026: original Integration b65183ddb93eb4396d4140a002c3727fec42ff87 now has both terminal outcomes recorded. Run 1679 passes 488/489 catalog cases; only ext4 quota exceeds its unchanged 120-second deadline, retained in bug 18. Its later native/interactive gates are not reached. Run 1680 passes all 489 catalog cases and both native diagnostics, then fails development COM1 directory input after its physical counterpart passes; the last observation is command 6 injection, retained in bug 56. Later release directory/editor gates are not reached. Both Rust and Markdown jobs pass. Six complete hashed logs total 27,238,688 bytes with zero warning candidates. Causes remain unclassified; no unchanged rerun, cancellation or deadline change occurred. Original current Integration 1687/1688 remains queued at its second observation. Acceptance stays 15/460, 3.48% weighted; native toolchain rebuilding and both full EriX-in-EriX generations remain open.

Native terminal-event allocation refusal — 19 September 2026: signed Kernel ba03995f extends the actual executing-child sequence with one deliberately refused heap allocation. Separate diagnostic preparation captures the original supervisor, child, staged grandchild and independent process records/capability inventories, then gives an empty event queue one-event capacity. No queued event or existing reservation is discarded. The first terminal-event reservation succeeds; the second arms exactly one null return from the real Kernel allocator. Ordinary collection growth and Process dispatch return RESOURCE_EXHAUSTED before any terminal effect.

Read-only witnesses require complete reservation rollback, an empty event queue, unchanged exact records and capabilities, and preserved code/stack/message mapping ranges. Actual CPL3 instructions validate the refusal reply before the next ordinary ancestor kill succeeds with allocation available. Every earlier terminal, descendant-disposal, independent-process and no-successor idle assertion remains required. ERIX_KERNEL:TERMINAL_EVENT_RESERVATION_OK requires one consumed allocator refusal and no remaining armed fault. Fault controls are absent from ordinary images; this covers injected allocation failure, not spontaneous heap exhaustion or independent resource-release failure. No witness supplies a syscall result, cleanup effect or scheduler choice.

Signed Integration cf5b2f5f requires the new marker without changing either 60-second limit. Both maintained native VMs pass: 1,948/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is d485019082175f769ecc2d406d88c6cc84a7df323605027663f5bcc79ca03ad9. Packaged Kernel bytes match retained original artifacts after normal stripping, and all fifteen original source signatures verify. Post-VM changes only select updated Docs in full catalogs and consolidate roadmap status.

Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and updated policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed Docs 62ba2ffa passes 45 tests, the complete 2,425-page manual, all 447,688 word bounds and actual visual review of pages 562–565, with zero final warnings; API reference source remains unchanged. The static audit passes 3,142 authored code files below 1,000 lines, 74 manifests, 259 full Git pins, 171 direct missing_docs gates and 92 conventional roots. Complete semantic authority and private-rustdoc closure remain open.

Original Kernel CI 618 and 619 pass from four complete hashed logs, 753,434 bytes, with zero warnings. Original Docs CI 987 and 988 pass from four complete hashed logs, 773,506 bytes: both pass 45 tests and the final 2,425-page manual, with reference-resolution warning counts 36/1/0 and zero final warnings. Original Integration CI 1689/1690 is queued. Earlier filesystem, directory, editor and full-frame regressions remain unresolved; original workflows were not cancelled or rerun.

The terminal-accounting audit confirms that ordinary Procd terminal handling queries original TCB counters after receiving its event, while automatic bound-child reclamation removes that TCB. Its separate private-mediator branch does not take the same query path; adoption must state which lifetimes require retained metrics and preserve their original generation without fabricated zero/wall-clock values. Independent release-failure coverage, grant-rights minimization, accounting, Procd adoption and full mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.

Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.

Historical pre-correction CI reconciliation — 19 September 2026: original Integration run 1673 and 1674, at 76411ed6d96356b20ee0a4c21ad219dacc56340d, are terminal failures. Each passes 487/488 catalog scenarios and fails only appliance-disk-image-realm-admission-positive, reporting the unchanged 45-second serial-progress watchdog. Later native and interactive workflow gates are not reached. Both Rust and Markdown jobs pass. Six complete hashed logs total 27,087,569 bytes with zero warning candidates. Neither workflow was cancelled or rerun.

These runs precede the retained correction at 9139c6c5fa38c139e92520f6d410626b4cf1e4aa; both later original runs 1675/1676 passed that realm-admission scenario. Issue 66 retains the historical evidence and its existing closed state. This does not establish a new current-source regression, full lifecycle acceptance or full guest builds. Current Integration 1689/1690 remains queued at its second observation; acceptance stays 15/460, 3.48% weighted.

Independent native child release recovery — 19 September 2026: signed Kernel 82d88b60 extends actual supervisor-exit coverage with two deliberate refusals at the original staged child's final VSpace-release callback, after capability disposal and unlinking. The first error is KernelHeapExhausted, the second CspaceSlotMissing. Read-only observations around two ordinary CPL3 observer yields require the original full record, generation, abort custody and first error retained, an empty original CSpace and retained mapped backing. The independent running child must already be absent from native TCB, CSpace and VSpace directories. The selected child's earlier directory position ensures its failure preceded that independent disposal.

The third callback must perform normal VSpace release before all original terminal-event, generation and resource-absence checks pass. ERIX_KERNEL:CHILD_RELEASE_ISOLATION_OK requires exactly two refusals and complete eventual disposal. Fault control uses only atomics at the locked callback boundary and exists only in the isolated native diagnostic. No witness performs cleanup, supplies a successful release/syscall result or chooses a scheduler target. This establishes injected callback-refusal coverage, not an observed hardware or allocator malfunction. All earlier nested-child, allocation-refusal and no-successor pre-halt assertions remain required.

Signed Integration 294a467a requires the added marker with both original 60-second limits unchanged. Both maintained native VMs pass: 1,988/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is 606fff037be022c876220d8e8f329c9046ffea5dcdf80831026649aedfbe0b08. Packaged Kernel bytes match retained original unstripped artifacts after normal stripping, and all fifteen original component signatures verify. Post-VM changes only select the updated manual source in full catalogs and reconcile roadmap status.

Four strict Kernel 720/744-test configurations, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test configurations, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed Docs 2a0ccc1a passes 45 tests, the complete 2,427-page manual, all 447,789 word bounds and actual visual review of pages 562–565 with zero final warnings. API reference source is unchanged. Static audit passes 3,143 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 171 direct missing_docs gates and 92 conventional roots; complete semantic authority/private-rustdoc closure remains open.

Original Kernel CI 620/621 and Docs CI 989/990 pass from four complete hashed logs each (753,438/773,910 bytes), with zero final warnings. Current Integration originals are observed after publication. Earlier filesystem, directory, editor and full-frame regressions remain unresolved, with original evidence retained; no workflow is cancelled or retried unchanged.

The grant-rights audit confirms actual Procd derivation callers and exact GRANT | MINT receipt checks in Procd and Launchd. Grant authority minimization must coordinate those consumers and distinguish the grant's own rights from its installation ceiling. Original generation-bound terminal accounting, Procd adoption, provider completion, hardware halt/wakeup and complete mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.

Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.

Explicit grant implementation progress — 20 September 2026:

Kernel commit 4a5333f760e258ebca23047a362d1cff4fded0c0 is signed and pushed. Creation preserves exact own grant rights, including zero. Derivation requires actual MINT and subsets of both own rights and installation scope. Zero-right custody still blocks process start until disposed. Four strict 724/748-unit configurations, both standalone controls and thirteen native build/Clippy profiles pass without warnings; three existing ignores remain. Original CI 622/623 passes from four complete hashed logs, 756,715 bytes, zero warnings. The new actual CPL3 derivation/disposal controls and GRANT-only relocation/installation compile; their matching VM execution remains pending.

Integration commit 9166f7bde6a0b42afd3ef1c9898b9e818df9af86 is a signed orchestration-library dependency checkpoint. Four strict 320/321-unit configurations and four native library builds pass without warnings. Original CI 1693/1694 is waiting at its first observation. The full image catalogs still retain their preceding coordinated selection until actual consumers are validated together.

Shared wire and dependency checkpoints, each with strict matrices and original CI passing: lib-ipc issue/PR, lib-capabi issue/PR, lib-bootstrap issue/PR, lib-interrupt issue/PR, lib-service issue/PR, lib-time issue/PR, lib-block issue/PR, lib-log issue/PR, lib-driver issue/PR, lib-vfs issue/PR. Their linked WIP PRs retain the detailed signed revisions and validation.

The consumer audit also identified Loaderd and Deviced receipt checks. Procd's move-only handoff cannot attenuate the original delegating grant: it now derives a GRANT-only final receipt into the already-disposed VSpace receipt slot and drops the source before returning that receipt. Nonderiving materialization and rootless mediator paths request GRANT directly. Partial failure retains original-generation rollback and all remaining local custody. Procd, Launchd, Rootd, Loaderd and Deviced pass their default unit suites; their full strict matrices and coherent guest validation remain open. Deviced bug 4 records a separately observed quarantine test race and its test-only serialization correction.

This is partial implementation evidence, not completed lifecycle or self-hosting acceptance. The canonical checklist remains 15 of 460 leaves, 3.48% weighted. Full terminal accounting, provider completion, consumer lifecycle, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both complete EriX-in-EriX generations remain required.

Verified grant-rights checkpoint — 20 September 2026:

Both maintained isolated native scenarios pass on their first attempts under the unchanged 60-second scenario limits, with no build warnings and empty QEMU stderr. Lifetime now exercises 27 ordinary CPL3 grant-right controls and requires INSTALL_GRANT_RIGHTS_OK before its existing cleanup assertions. Its 2,025-byte serial stream has SHA256 6c685f1ceaf9080bf0bec628a4fac512bf9049d0fbcfe2b3737666adf414ca3a; owned invocation retains 1,587 bytes. Normal stripping exactly matches both packaged kernels to retained original artifacts. All fifteen selected original source signatures and clean trees verify. These minimal native scenarios establish neither full service-image acceptance nor a guest build.

All thirteen shared libraries pass their strict matrices and original CI. The five direct receipt consumers pass four strict host/native configurations; original CI passes for procd 292/293, launchd 145/146, rootd 1037/1038, loaderd 99/100, deviced 206/207. Rootd baseline regression and Deviced quarantine fixture race are corrected with retained original failures and successful corrected-source CI. Manual/API updates and remaining full-catalog alignment are in progress.

Integration bug 68 records five original CI failures (1683/1684, 1685/1686 and 1688), each with 127 manifest/catalog revision mismatches before full VM execution. All fifteen complete logs are retained, 1,512,137 bytes with no warning candidates. Individual-crate and minimal-native validation did not prove full catalog coherence. Remaining dependents are being aligned and validated bottom-up; equality and immutable-source checks are unchanged. Earlier 1681/1682 separately reached 479/489 and 487/489 VM passes, with ten and two scenario timeouts at the original 120-second bounds. Those filesystem failures require separate analysis.

Canonical acceptance remains 15 of 460 leaves, 3.48% weighted. Complete lifecycle and terminal accounting, provider completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain required.

Manual and dependency validation — 20 September 2026:

Docs commit f4621ce2921b2b9fe3b1d25b4321d6b28289418e is signed and pushed. Native selectors 32/33/54 now document exact own rights separately from installation ceilings. The process and launch chapters require GRANT-only final receipts, explicit derivation/source disposal, and original-generation rollback. Both IPC references are regenerated from signed source. All 45 tests and API checks pass; the complete 2,429-page manual has zero final warnings, all 448,913 word bounds pass, and eleven changed pages were visually reviewed. Original Docs CI 991/992 passes with four complete hashed logs, 774,346 bytes, both 45-test runs and final 2,429-page manuals. Intermediate TeX reference warnings resolve before the final pass.

Thirty-one additional downstream consumers now have signed dependency-alignment checkpoints, each with four strict unit configurations, four native builds, host/native Clippy, formatting and private rustdoc passing without warnings. All 62 original CI runs pass. Their owning feature issues and WIP PRs retain exact revisions and log evidence. Catalog regression 68 remains open until the remaining Exsh selection and complete original catalog are validated together. Individual repository success is not full service-image acceptance.

Exsh's default development tests pass 976 units. Aggregate release-test compilation and a subsequent explicitly separated library compilation each reached the local unchanged 120-second silence limit before tests ran; both failures remain retained. No release-test success is inferred, no compiler setting or deadline was relaxed, and independent configurations are being collected without rerunning failed commands unchanged. The complete source/effect/frame gate also remains open.

Original Integration 1693/1694 also fails with 127 manifest/catalog mismatches each, before full VM execution. Six complete logs total 604,756 bytes, with no warning candidates. Together with 1683–1692 this is twelve retained original failing runs. Earlier full-VM filesystem timeouts remain separately tracked in ext-family issue 20 and FAT32 issue 58.

Canonical acceptance remains 15/460 leaves, 3.48% weighted. Full service lifecycle, terminal accounting, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain required. Static audit currently passes 3,150 authored code files below 1,000 lines, 74 manifests, 259 explicit Git pins, 172 direct missing_docs gates and 92 conventional Rust roots; full semantic authority and documentation review remain open.

Complete original catalog checkpoint — 20 September 2026:

Integration f9681efc30f1c48989def7f0e7db939974a30e27 is signed and pushed in WIP PR 12. Both complete catalogs now pass exact dependency equality against 73/70 clean original selected checkouts and 72/71 manifests; all 143 selected signatures verify. The original Integration library pin is retained independently of the catalog commit, avoiding a circular source reference. Twenty dependency-policy and 46 immutable-source tests, both native scenario policies, Markdown and whitespace pass. The unchanged orchestration crate retains its verified four 320/321-unit configurations, four native builds and strict Clippy/rustdoc evidence. Corrected-source original CI 1695/1696 is running; bug 68 remains open pending that observation and full consumer acceptance remains separate.

The executed inputs for both first-attempt native VM passes remain exact: 27 new ordinary CPL3 grant-right controls, every earlier lifetime/owned-invocation assertion, original 60-second bounds, zero build warnings and empty QEMU stderr. Both packaged kernels match retained original artifacts and all fifteen original source signatures verify. The final post-VM changes only select the full catalogs and reconcile documentation.

All 31 further fully validated consumer checkpoints pass four strict unit/native configurations and all 62 original CI runs; 124 complete logs total 3,041,213 bytes with no warning candidates. Their owning feature issues and WIP PRs preserve exact source and CI evidence. The full manual and regenerated IPC references are published in Docs WIP PR 4; its 45 tests, 2,429 pages, 448,913 word bounds and eleven changed-page reviews pass, as do original Docs CI 991/992 with zero final warnings.

Exsh dbc958bcdaa557a461e9308a31d23d3b8c189296 in WIP PR 3 is explicitly an incomplete-validation dependency checkpoint. Both development configurations pass 976 units, four native builds and strict Clippy/docs configurations pass, and all 355 checker tests pass. Three local release-unit compilation attempts reached the unchanged 120-second silence bound before tests ran. Four local frame checks return 1 with complete workspace mapping and 97/63 unresolved routes. Original CI 273/274 likewise passes 976 units and 355 checker tests, then fails the full frame/source gate with 101/68 unresolved observations. Four complete CI logs total 319,871 bytes with zero warning candidates. These local and CI artifacts are distinct; no frame or release-unit acceptance, relaxed deadline or unchanged retry is claimed.

Canonical acceptance remains 15/460 leaves, 3.48% weighted. The full in-EriX builds and native external Rust/LLVM/runtime rebuild remain unproven. Full consumer lifecycle, terminal accounting, source/effect/frame proof, the 128-page Pagerd gate and profiler attribution remain required; no canonical leaf closes at this checkpoint.

Installer return-slot regression — 21 September 2026:

Both original corrected-catalog runs are now classified: 1695 passes 431/489 VM scenarios and 1696 passes 430/489. All six complete logs are retained and hashed, 32,723,390 bytes, zero warning candidates. Rust, Markdown and full dependency equality pass. Catalog mismatch issue 68 is corrected; this does not establish full consumer acceptance. Each run has 57 initial-shell uncertain-disposition failures and a separately retained release-appliance stall. Run 1696 also retains the ext4 quota timeout under its original 120-second bound, tracked in issue 20.

Procd bug 4 records a concrete producer/consumer mismatch. The final installer was handed off from VSpace scratch slot 1056 while later TTY provisioning requires managed grant slot 1040. The added producer regression fails on the original code. Signed Procd 10d972b652297fd656e9a6ac6dbdf197f362c7ce in WIP PR 2 derives the exact GRANT-only result, disposes its delegating source and uniquely relocates the result back to the empty managed grant slot. Refusals preserve original-stage rollback and remaining custody. Four strict 291/296-unit configurations, four native builds, host/native Clippy, formatting, private rustdoc and policies pass with zero warnings. Corrected full-service VM validation and original CI remain open; bug 4 remains open.

Acceptance remains 15/460 leaves, 3.48% weighted. Full consumer lifecycle, terminal accounting, source/effect/frame proof, Pagerd, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full in-EriX build generations remain required.

Verified managed installer recovery — 21 September 2026:

Signed Integration 648fbd5614d3d0b82223b1c3bb7f1b5a0c81ea7d in WIP PR 12 selects signed Procd ac8a12993bc8cbf134a11e141e459cb63df71123 and Docs PR 4. Both full original catalogs pass all 72/71 manifest checks against 73/70 clean selected checkouts and all 143 verified signatures. Twenty dependency and 46 immutable-source tests, native scenario policies, Markdown and whitespace pass. The unchanged orchestration crate retains its verified four 320/321-unit configurations, four native builds and strict Clippy/rustdoc evidence. Original Integration CI 1697/1698 is running; no complete regression-suite pass is claimed.

Procd bug 4 is corrected. The added producer regression reproduces the original 1056/1040 mismatch. Procd derives exactly GRANT into disposed VSpace scratch, drops its delegating source and uniquely relocates the result into the now-empty managed grant slot before handoff. The downstream TTY checks remain strict. Four 291/296-unit configurations, four native builds, formatting, strict Clippy and private rustdoc pass without warnings; relocation refusal and occupied-destination controls retain original-stage cleanup. Original correction CI 294/295 passes from four complete logs, 344,660 bytes. The subsequent roadmap-only checkpoint keeps every runtime source byte unchanged and original CI 296/297 passes from four complete logs, 344,680 bytes, zero warnings.

The maintained initial-shell start/exit, realm-admission and normal release-appliance VM scenarios all pass on their first corrected attempts with original guest bounds and watchdogs. The release appliance executes the real product-shell command and produces standalone LOOKUPOK output, separate from its echoed input. All three builds are warning-free and QEMU stderr is empty. Serial logs retain 55,702, 55,738 and 364 bytes respectively. Actual images, full artifact sets, scenario oracles and original signatures are retained. These runs execute Procd 10d972b652297fd656e9a6ac6dbdf197f362c7ce; the selected later Procd commit changes only its roadmap. All 73 executed component signatures and clean source trees verify. The earlier 431/489 and 430/489 full CI failures remain recorded, including the independent ext4 quota timeout; those runs are not rewritten as passes.

The native-launch manual now explains the managed return destination, exact rights, unique relocation and partial-failure cleanup. All 45 tests, the complete 2,429-page manual, 448,970 word bounds and changed-page visual review pass without final warnings. Original Docs CI 993/994 passes from four complete logs, 774,342 bytes; each final TeX pass is warning-free after normal earlier reference resolution. Existing generated API references are unchanged.

Canonical acceptance remains 15/460 leaves, 3.48% weighted. This is a repaired runtime regression, not completion of a canonical lifecycle leaf. Original-generation terminal accounting, provider/lifetime completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. Exsh's retained release compiler and frame-proof failures stay open.

Verified native terminal accounting — 21 September 2026: Kernel a9bdf6163813d378e0b4a164bceb839e24fbb6b7 is signed/pushed. Terminal preflight reserves final scalar CPU evidence independently of TCB/CSpace/VSpace reclamation; exact queries preserve final results or explicit errors. Repeat observations belong to the actual original observer until exact acknowledgement, and observer death releases that claim. Independent authorized observers can progress. Selector 55 is retired; checked selectors 59/60 have no destructive fallback.

Four strict 736/760-unit configurations, both standalone controls and thirteen native build/Clippy profiles pass without warnings. Host controls include nonzero final counters after actual reclamation and ID reuse, original observer death, pending-final-charge destruction refusal, malformed requests, wrong callers, immutable errors and lost-acknowledgement reply retry. Original Kernel CI 624/625 and corrected 626/627 all pass from eight complete hashed logs (1,532,848 bytes), zero warnings.

Both maintained lifetime and owned-invocation VMs pass under the unchanged 60-second scenario limits and standard watchdogs, with no build warnings and empty QEMU stderr. Actual guest instructions check repeat observations and CPU queries, exact acknowledgement and absent-acknowledgement retry; executing children require nonzero user and kernel counters after native reclamation. Lifetime retains 2,025 serial bytes (SHA256 921edf5eadfdff61f2d85a63158555666e77e57a1e8aa4254ac30dcd216f8cf9); owned invocation retains 1,587 (SHA256 404bc4ecad5074349d9ba45d1caf5439aebe849d344b726e5dec2ee2b9c4d907). Normal stripping exactly matches both packaged kernels to retained original artifacts; all fifteen selected original signatures and clean checkouts verify.

Kernel regression 21 retains the first VM's final page-census failure. The corrected layout declares and allocates all six request pages and derives the independent census from that declaration. No unchanged retry or deadline relaxation occurred.

Integration fcd7b4a9608f629a12de78c53da5c3615d906b46 is signed/pushed with the verified isolated catalog. Twenty dependency and 46 immutable-source tests, native policies, Markdown and source checks pass. The unchanged orchestration crate, embedded fixture and original dependency closure retain verified four 320/321-unit and native/Clippy/rustdoc configurations. The full service catalogs retain their separately coordinated revisions; original Integration CI remains under observation.

Procd and Rootd consumer adoption, ordinary and mediator metric retention/consumer loss, manual updates, full service/profiler scenarios, complete authority/source/frame audits and full regression acceptance remain open under Kernel design 20. Canonical acceptance remains 3.48% weighted; 15 of 460 items. Native upstream Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain mandatory and unproven.

Committed terminal-accounting consumers — 21 September 2026:

Procd 66934642c4464fc738152a9e60790914ba27dd1c in WIP PR 2 reserves notification/crash/cleanup storage before effects, obtains exact final CPU evidence, commits local status and cleanup obligations, then acknowledges on every actual event polling path. Lost acknowledgement replies preserve the local result without duplicate counters or notifications. Mediators retain only scalar counters and the original authenticated supervisor identity after disposing all capability columns; supervisor death discharges the pending scalar observation and a replacement cannot inherit it. Four strict 299/305-test configurations, native builds, Clippy and private rustdoc pass. Original CI 298/299 passes from four complete hashed logs, 347,245 bytes, zero warnings. Bug 5 remains open for actual service acceptance.

Rootd 64c97b13c450003d9c2b6bd9ed2a627088684b46 in WIP PR 2 acknowledges bootstrap evidence only after exact native destruction and local endpoint absence; both operations remain unavailable after temporary Process custody transfers to Procd. Four strict 430/429-test configurations, native builds, Clippy and private rustdoc pass. Original 1039/1040 exposed bug 7: a stale source-call inventory and its matching semantic operation declarations. The correction explicitly inventories acknowledgement consumers and preserves the same temporary route and eventual Procd owner. All 64 Python controls, production-boundary, semantic baseline, threat model, phase contract and operation-ownership gates pass. Corrected original CI 1041/1042 passes from four complete verified logs, 222,969 bytes, zero warnings. Bug 7 is corrected; failed original runs remain retained without reruns or weaker gates.

Docs e4525848ad4462901c9a6794ef1794cf85ea9e6b updates the native contract, Procd/Rootd consumer custody and original signed IPC API references. Selector 55 is retired in both the detailed contract and summary; 58/59/60 are cross-checked against the shared registry. All 45 documentation tests and generated-reference checks pass. The complete 2,431-page manual builds without warnings; changed prose, selector and API pages pass visual review. Original documentation CI 995/996 and corrected-table 997/998 passes from eight complete logs, 1,549,628 bytes, with zero warnings in the final LaTeX passes. The 37 earlier convergence candidates per manual log are retained and resolved.

The separate Integration orchestration library checkpoint b06dfad00202765491a64552dde29eaca1c24838 passes four strict 320/321-test host/native configurations. Full service catalogs remain on their prior coherent graph while 35 remaining application/service repositories adopt the original shared revisions. Integration 1697/1698 remains running, and 1699/1700 plus 1701/1702 waits at the latest bounded observations. These are pending full regressions, not successful runtime acceptance.

No new canonical acceptance leaf is closed: 15/460 and 3.48% weighted. Ordinary Launchd metric-consumer restart/disposal semantics, coherent service CPU/profiler VMs, complete realm/provider authority and I/O, source/effect/frame proof, Pagerd, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. The static audit finds 3,162 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 173 direct missing-docs gates and 92 conventional crate roots; this does not establish semantic authority or complete private-documentation closure.

Original acknowledged service catalog — 21 September 2026:

Signed dff878dd3545c4751b3c05d37b2bdd5e21cce548 selects the original terminal-observation, exact-acknowledgement and final CPU dependency graph in both complete catalogs. All 35 application/service checkpoints are signed; the bounded VFS checker correction and its manual are included. Clean original checkouts pass manifest/catalog equality and signature checks. Exsh's release compiler and complete frame gates remain explicitly open in issue 9 and issue 4.

All 169 maintained helper commands pass with recorded source and stream identities. The original stale memory-source rejection, quiet storage-fixture timeout and overly long socket-fixture path remain retained. Their respective corrected inputs use the explicitly verified original memory checkout, the previously maintained traced disk invocation (258.975743 seconds under unchanged 600/120 bounds), and a fresh owned shorter temporary directory (all 14 socket controls pass without changing the Unix pathname limit). None of these setup corrections changes test sources or bypasses source, timing or cleanup checks. The unchanged orchestration library retains all four strict 320/321-test configurations; formatting, policies and Markdown pass without warnings.

The published runner and original full source graph are prepared for the maintained shell CPU-accounting, two-CPU inspection and out-of-session denial scenarios. Actual VM evidence remains pending and no full guest-build acceptance is awarded. Original CI 1703/1704 is being monitored without restart. Complete authority/source/effect/frame and Pagerd gates, native external Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain mandatory in Phase 6 completion.

Actual service CPU scenarios and startup admission — 21 September 2026:

The published original Integration catalog dff878dd3545c4751b3c05d37b2bdd5e21cce548 passes the maintained shell times, two-CPU Extop and out-of-session denial VM scenarios under their unchanged 120-second guest limits. Each retains 106 hashed evidence files, warning-free image builds, empty QEMU stderr and every required, forbidden, ordered and unique marker check. Build-plus-scenario wall times are 119.876978, 34.802620 and 36.173027 seconds respectively; these are not guest-only or startup measurements.

Times reports nonzero self and waited-child CPU. Extop observes both CPUs, memory and increasing job CPU nanoseconds with CTRL no; both per-CPU percentages remain --.--% in the two samples, so numeric utilization is unproven. The denial scenario confirms the existing out-of-session boundary. Complete mediator/lifecycle acceptance in Procd 5 remains open.

A separate ordinary development package also builds without warnings, but its required startup-contract preflight exits 1 before any VM or observer starts. Integration 69 records the missing full-runtime-transition contract selections and Kernel effective-feature/original-source evidence. Preserve the refused package and all admission controls; the 120/15/10 capture limits and performance thresholds are unchanged. No startup-profile acceptance is awarded. Complete source/effect/frame and Pagerd proof, native external Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain required by Phase 6 completion.

Signed startup source/feature correction — 21 September 2026:

Integration fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa requires the complete runtime transition in both Rootd and its orchestration policy. The direct Kernel builder records the actual local compiler feature closure, compares original source before and after linking, and includes source identity in its cache key. Contract v2 requires the Kernel revision/tree and actual artifact/metadata binding; old receipts, synthetic wrappers and modified source cannot acquire this declaration. This remains local observed provenance, not publisher authentication or complete compiler closure.

All 171 maintained helper commands have successful, warning-free final evidence. Eight new Kernel controls cover original trees, actual cfg closure, changed inputs, hidden/redirected source, custom builds, synthetic wrappers and cache identity. Sixteen fixture readers/writers now close files explicitly; bug 71 retains the original 36 resource warnings from 15 exit-zero commands. The previously unlisted filesystem-mirror fixture now participates in CI. Earlier Markdown failures also remain retained. Formatting, source policy and final Markdown pass; identical Rust inputs retain four strict orchestration matrices.

The technical manual update 76672dff8ff83 passes 45 tests, 2,431 pages, 450,096 word bounds and both changed-page visual reviews. Original Docs 1001/1002 passes from four complete logs totaling 774,770 bytes. Each manual log retains its earlier reference-convergence warnings; final LaTeX passes have no warnings or layout overflow.

A fresh ordinary package from the signed Integration runner is under construction. Actual corrected image admission and startup capture remain pending under bug 69; no threshold or 120/15/10 capture limit changes. Original Integration 1705/1706 is monitored separately. Native external Rust/LLVM/runtime rebuilding and both complete EriX guest build generations remain mandatory.

Actual original-source startup capture — 21 September 2026:

Signed Integration fd8a5cf0dbcf builds the ordinary image without warnings and its actual Kernel-bound contract passes preflight. The VM and complete observer finish with all required stages, zero dropped records, empty QEMU stderr, successful cleanup and unchanged source image. Admission bug 69 is resolved independently of performance.

The strict timing gate fails: root-to-final readiness 5.974133160 seconds (limit 5), largest service interval 3.098663889 (limit 1), final readiness to caret 1.262470092 (limit 1), and four native commands 4.769234506 (limit 2). The maintained offline profiler identifies RTC-provider to TTYD as the largest service interval, followed by roughly one-second Powerboxd and Launchd intervals. These are host observation windows, not loader-only causal measurements. The new canonical timing bug retains the exact image, timing and command identities and every original limit. Host/toolchain description fields remain explicitly incomplete; no provenance or speedup is invented.

The sixteen helper stream-custody corrections also pass all changed controls; all 171 selected helper commands have successful warning-free final evidence. Bug 71 is resolved with its original 36 warnings retained. Full CI for 1705/1706 remains separately monitored. No startup-performance or full native toolchain/EriX guest-build acceptance is awarded.

Coherent scalar-consumer validation — 21 September 2026: signed Integration 07c883525ee5 selects Procd 59ee30a88534 in both complete catalogs. All 171 maintained helper commands pass without warnings; unchanged orchestration inputs retain four strict matrices. Five actual service VMs pass: shell CPU accounting, exec successor replacement, two-CPU read-only inspection, out-of-session denial and guarded realm preparation. Each preserves 106 hashed evidence files, clean QEMU stderr, warning-free image builds and all original markers under the unchanged 120-second guest limit. The build-plus-scenario times are 119.746880, 38.325332, 35.346729, 35.773237 and 55.339698 seconds respectively; these are not guest performance measurements. Inspection reports increasing job CPU counters with control disabled; numeric CPU utilization remains unproven.

Procd's four strict 308/314-test configurations and original CI 302/303 pass. The manual update passes 45 tests, all 2,431 pages, 450,185 word bounds and changed-page visual review. Original Docs CI 1003/1004 passes from four complete logs (774,710 bytes); retained reference-convergence warnings resolve to zero on final passes. All 3,166 authored code files remain below 1,000 lines.

Original Integration 1701/1702 remains running; 1703–1710 remains queued. Logd 240 remains failed with terminal logs unavailable through HTTP 500; no cause is inferred. No original job was restarted or cancelled. Remaining lifecycle control/event ownership, complete native fault/cleanup acceptance and the measured startup timing failures remain open. No whole acceptance leaf closes: 15/460, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain inside EriX and using it in the required full EriX guest-build generations remain mandatory and unproven.

Executed-code profiling checkpoint — 22 September 2026: signed Integration 4fa27f942bc2, tracked in Integration PR 12, adds bounded host TCG execution counters, explicit fresh-output ownership and exact packaged-ELF code candidates without adding guest authority. All 172 maintained helper commands pass without warnings. The profiler passes five Rust tests in both profiles, strict Clippy, private rustdoc, eleven Python controls and five actual selected-emulator controls. Unchanged orchestration inputs retain their preceding four strict matrices. The operator guide distinguishes complete counters from VM acceptance.

One original-image diagnostic retains 92,896 translated blocks, 1,994,216 code bytes and zero missed execution counts. Its top 100 code groups cover 85.65% of the translated instruction upper bound; 33.30% has Kernel mapping-batch candidates and 7.70% has VSpace permission-switch candidates among the selected ELF inputs. Unknown and ambiguous work remains visible. These are code matches, not process ownership or elapsed-time attribution. Both the instrumented attempt and its same-emulator uninstrumented control fail waiting for the final native-command marker under unchanged 120/15/10 collection bounds. Neither proves startup acceptance, whole-transcript instrumentation overhead or a speedup. Profiler acceptance and startup performance remain open. The next optimization must preserve complete validation, live backing checks, page permissions, invalidation ordering and cleanup on errors.

The signed manual update, tracked in Docs PR 4, passes 45 tests, all 2,431 pages, 450,367 word bounds and both changed-page visual reviews with zero final warnings or overflow. Original Docs CI 1005/1006 passes from four complete logs (774,674 bytes); initial reference-convergence warnings resolve on the final passes. Integration 1711/1712 is queued, while original 1701/1702 still runs. Existing queued jobs remain untouched. All 3,174 authored code files remain below 1,000 lines. No whole acceptance leaf closes: 15/460, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain inside EriX and completing the required full guest-build generations remain mandatory and unproven.

Native table-custody checkpoint — 22 September 2026: signed Kernel 2e744897de7c, in Kernel PR 3, gives unpublished table allocations one cleanup owner through translation and initialization. Empty-table installation and huge splits transfer custody at parent publication. The raw allocation-return helper and duplicate huge-split initialization are removed. Parent/leaf invalidation, interrupt masking, permission templates and current shared-hierarchy lifetime remain intact. Five host controls cover allocation/translation failure, invalid geometry, abandoned preparation and publication. Four strict configurations pass 742 default / 766 all-feature tests, retaining three existing ignored cases; formatting, host/native Clippy, private rustdoc and thirteen native builds pass without warnings. Original Kernel CI 630/631 passes from four complete logs, 771,607 bytes and zero warnings.

Signed Integration fe63adde8ff9, in Integration PR 12, selects that exact Kernel in all three catalogs. Every other selection and Kernel dependency manifest is unchanged. All 172 maintained helper commands pass without warnings; unchanged Rust inputs retain their preceding strict matrices. Three original-source native executions pass lifetime revocation, owned invocation and mapping checks with unchanged 60-second guest limits, warning-free builds and empty QEMU stderr. Mapping isolation and sparse mappings have identical runtime settings; both maintained marker contracts pass on the retained mapping capture. All fifteen selected component signatures verify, and each packaged Kernel image equals its retained artifact after normal stripping. These results cover the current shared hierarchy, not independent hardware roots.

The Kernel evidence update and Integration evidence update change documentation only, with executable inputs proven unchanged. Their original Kernel CI 632/633 is running and Integration 1715/1716 is queued. Older full Integration CI 1701/1702 at b06dfad002 passes from six complete logs, 26,962,712 bytes and zero warnings, including both runs' ext4 quota, ext4 links and FAT32 directory-metadata cases. Their earlier timing failures remain retained with unestablished causes; 18, 20 and 70 have exact follow-up observations. No workflow was rerun or cancelled.

All 3,176 authored code files remain below 1,000 lines. The next work in Kernel 22 must resolve the supervisor baseline, bootstrap/saved-frame overlays and inactive-space population before adding root ownership, residency and retirement. Startup timing acceptance, complete authority cleanup and the profiler's measured speedup remain open. The phase checklist stays at 15/460 accepted leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven.

Ordinary mapping-domain checkpoint — 22 September 2026: resolved admission report records the original host failure and bounded fix. The fixture regression retains all three distinct failed attempts and the verified layout correction. Kernel now validates the complete ordinary user page before backing or mapping changes, with both control paths covered. Four strict 745/769-test configurations, thirteen native builds, Clippy and private rustdoc pass without warnings. Three exact-source native executions pass lifetime, invocation and mapping; four maintained scenario contracts are checked, with sparse and isolation sharing their identical runtime capture. All fifteen selected native signatures and packaged Kernel identities verify.

Integration pins the exact Kernel in all three catalogs, preserves every other selection and passes all 172 helpers. The unchanged ordinary exec-successor VM passes against the complete source graph, preserving its 120-second guest deadline, with no image warnings or QEMU stderr. Docs documents the domain and bootstrap distinction; all 45 tests and 2,431 pages pass, with 450,473 word bounds checked and no final warnings. The earlier Kernel CI 632/633 passes from four complete logs and zero warnings; current original CI remains under observation.

Bootstrap provenance, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

VSpace MAP authority checkpoint — 22 September 2026: the resolved bug report records three original failing host controls and the verified correction in Kernel. Current local MAP rights now govern map, protection and unmap requests. Empty and MANAGE-only aliases are denied; MAP-only access remains valid. Four strict 750/774-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.

The Integration catalog selects the exact signed Kernel in all three catalogs and passes all 172 helpers. Actual CPL3 calls preserve the authorized RW/NX page across restricted-alias refusals and drop all five temporary grants. Three native executions cover all four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signed sources and retained packaged artifacts. The original exec-successor service VM passes against all 73 components with its unchanged 120-second guest limit. All image warnings and QEMU stderr remain absent. Manual validation passes 45 tests, 2,431 pages and 450,550 checked word bounds, with both changed pages reviewed and zero final warnings.

The static audit covers 3,181 authored code files below 1,000 lines, 259 exact Git dependency pins and existing direct missing_docs gates. It does not close semantic authority review. Earlier full Integration runs 1705/1706 are running; 1707–1720 remain queued at the latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel 638/639 and Docs 1009/1010 pass. Each pair has four complete logs: Kernel totals 777,250 bytes with zero warnings, and Docs totals 774,674 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration 1721/1722 remains queued; it receives no CI acceptance credit.

Canonical acceptance remains 15/460 leaves, weighted 3.48%. Independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven.

Frame access checkpoint — 22 September 2026: the resolved bug report records three original failing host controls and the verified correction in Kernel. Explicit READ now governs admission and hardware activation. No-access mappings retain backing with USER/WRITE clear and NX set; write-only and execute-only requests are rejected without adding READ. Existing protection-transition rules remain in force. Four strict 757/781-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.

The Integration catalog selects the signed Kernel in all three catalogs and passes 172 helpers. Twenty-four actual CPL3 calls preserve earlier witnesses and cover no-access protection, write-only refusal, MAP-only frame derivation, denied READ and unmap after both frame grants are dropped. Three native executions pass four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signatures and retained packaged artifacts. The ordinary exec-successor VM passes against all 73 components with its unchanged 120-second guest limit. Builds emit no warnings and QEMU stderr is empty. Manual validation passes 45 tests, 2,433 pages and 450,702 checked word bounds, with the changed page reviewed and zero final warnings.

Static review covers 3,182 authored code files below 1,000 lines, 259 exact Git pins and existing direct missing_docs gates. This does not close semantic authority review. Earlier full Integration runs 1705/1706 remain running and 1707–1722 remain queued at their latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel 640/641 and Docs 1011/1012 pass. Each pair has four complete logs: Kernel totals 782,838 bytes with zero warnings, and Docs totals 775,110 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration 1723/1724 remains queued; it receives no CI acceptance credit.

Canonical acceptance remains 15/460 leaves, weighted 3.48%. Authorized protection restoration, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

Ordinary protection contract — 22 September 2026: the runtime memory design now specifies in-place no-access/R/RW/RX changes using current VSpace MAP and exact selected frame authority, including same-backing aliases and complete backing checks. Preserve W^X, explicit READ, object kind, reference custody, error ordering and all native witnesses. Kernel-owned anonymous loader materialization and Process endpoint target scope retain separate audit obligations. The implementation and exact-source VM evidence are pending. This earns no canonical acceptance credit; external toolchain rebuilding and both complete EriX guest-build generations remain mandatory.

Older VM regression observation — 22 September 2026: the ext4 deadline report preserves original Integration CI 1705/1706 at fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa. The complete 489-scenario catalog reports 482/7 and 485/4 pass/fail outcomes; eleven actual 120-second QEMU timeouts cover eight distinct ext4 scenarios. Rust 320/321-test configurations and Markdown pass. All six complete original logs are retained without warning candidates. Root cause, isolated reproduction and correction remain open; no rerun or relaxed limit supplies acceptance. External toolchain rebuilding and both complete EriX guest-build generations remain required.

Current-grant protection checkpoint — 22 September 2026: the resolved device-backing report distinguishes its original metadata-authority inconsistency from the separate restoration feature gaps. The Kernel implementation permits representable no-access/R/RW/RX changes through current exact-backing grants and aliases while active or inactive. It removes historical access ceilings and original-slot equality while preserving current VSpace MAP, selected frame rights, kind/range/identity checks, W^X, explicit READ, backing custody and failure ordering. Four strict 766/790-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.

The coordinated catalog selects that original signed Kernel in all three catalogs and passes all 172 helpers. Fifteen managed-frame calls and twenty-nine device/domain calls pass inside the original lifetime window and deadline. Actual user instructions write, execute, rewrite and execute managed RAM, check narrow alias authority and final disposal, while a reused device slot cannot authorize unrelated backing. Every prior marker remains required. Three native executions pass four original contracts with complete signed source and artifact checks; the ordinary exec-successor VM passes the full 73-component graph and original 120-second limit. Image warnings and QEMU stderr are absent. Manual validation passes 45 tests, 2,433 pages and 450,954 word bounds; both changed pages are reviewed with no final warnings or overflow.

Static review covers 3,184 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins and 174 direct missing_docs gates. Full semantic authority review remains open. Older Integration CI 1705/1706 has eleven real ext4 timeouts across eight scenarios, with complete retained logs and no accepted rerun. Their root cause and correction remain unresolved. Publication CI: Kernel 642/643 and Docs 1013/1014 pass. Each pair has four complete original logs: Kernel totals 790,650 bytes with 766/790 tests and zero warning candidates; Docs totals 775,150 bytes with 45 tests, 2,433 pages and zero final warnings or overflow. Retain the original 35/1/0 LaTeX warning convergence. Integration 1725/1726 remains queued and receives no completed CI acceptance. The separate older ext4 deadline report remains open.

Canonical acceptance remains 15/460 leaves, weighted 3.48%. Complete POSIX protection support, Process endpoint scope, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

VSpace ownership preparation — 22 September 2026:

Live VSpace records and production mapping tables are non-cloneable. Test observations contain descriptive metadata, synthetic selectors use independent tables, and leaf-encoder checks borrow live mappings under the record lock. Selectors accept only the mapping table they consume. Current grants, backing custody, first-match ordering, reference scans and hint visit-count controls remain intact; the rights control now uses actual activation/deactivation. The former whole-record snapshot helpers are removed.

Four strict Kernel configurations pass 766/790 tests with three existing ignored cases; thirteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. All 172 Integration helpers pass. Three exact-source native executions pass the four maintained mapping, sparse, invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Original 60/120-second guest limits, existing markers, exact component signatures and retained packaged artifacts remain required; image warnings and QEMU stderr are absent. No startup speedup or independent hardware-root acceptance is inferred.

The Kernel implementation and Integration source selection are published with Kernel validation evidence and Integration validation evidence. Continue under owned-root design 22, Kernel PR 3 and Integration PR 12. Publication CI: Kernel 644/645 pass with four complete original logs (790,604 bytes), 766/790 tests and zero warning candidates. Integration 1727/1728 remains queued and has no completed acceptance; earlier ext4 deadlines remain tracked in Integration report 73. Complete authority cleanup, external toolchain rebuilding within EriX and both full guest build generations remain open. Canonical acceptance remains 15/460 leaves (3.48% weighted).

Managed-frame diagnostic recovery — 22 September 2026: Kernel report 28 is resolved by the signed correction and coordinated catalog. The diagnostic admits an initially empty lower-half window while preserving the ordinary-domain guard and all 64-page, alias, hole, physical-byte and cleanup controls. The unnecessary heap allocation and raw-pointer cleanup state are removed, with expanded inline rustdoc.

Four strict 766/790-test configurations, fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. All 172 Integration helpers pass. Both maintained allocator scenarios pass independently with their original 60/120-second deadlines and complete markers; exact signed source and retained packaged-ELF checks pass. The ordinary exec-successor VM also passes against all 73 components. Image warnings and QEMU stderr are absent. The original failed native image remains retained; no unchanged rerun is used as the correction.

Static review still covers 3,186 code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Full semantic authority and inline-documentation review remain open. Older original Integration 1707/1708 both pass all 489 VM scenarios, Rust 320/321 and Markdown; six complete logs total 26,966,330 bytes with zero warning candidates. Publication CI: Kernel 646/647 pass with four complete original logs (790,634 bytes), 766/790 tests and zero warning candidates. Integration 1729/1730 remains queued and has no completed acceptance; earlier ext4 CI deadline failures remain unresolved. The separate supervisor physical-access window and independent hardware roots remain implementation work. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

Supervisor physical-access window — 22 September 2026: the signed Kernel implementation shares one restoring supervisor scratch transaction between frame scrubbing and physical mapping-byte copies. Caller backing custody and page-table/interrupt custody remain live through byte access, exact leaf restoration and local invalidation. Scratch is released afterward; read aliases clear the write bit and all temporary aliases clear user access and set NX. The unreachable raw-VA fallback is removed, and complete preflight rejects missing or ambiguous backing metadata before any range effects. No new userspace operation or capability grant is introduced. This is preparatory work for owned address spaces; independent roots and their switching/reclamation proof remain open.

Eight added host controls cover geometry, permissions, preparation and partial-effect failures, restoration/release ordering, and malformed later-page metadata without partial reads or writes. Four strict host configurations pass 774/798 tests with three existing ignored cases. Fourteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. The coordinated Integration catalog passes all 172 maintained helpers; its exact marker expectation is updated alongside the strengthened scenarios. Unchanged orchestration and profiler sources retain strict validation.

Six native executions satisfy seven maintained scenario contracts. Both allocator scenarios require the new same-VA/different-backing byte-and-leaf proof after complete cleanup, retaining every preceding marker and the original 60/120-second deadlines. Three further executions satisfy mapping, sparse, owned-invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Exact original signed source, retained artifacts and packaged Kernel matches are verified; no image warnings or QEMU stderr were observed. These checks establish no performance improvement. The technical manual documents backing and scratch custody; all 45 document tests and the complete manual build pass without final warnings.

Static checks cover 3,190 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Complete semantic authority and inline-documentation review remain open. Publication CI: Kernel 648/649 and Docs 1015/1016 pass. Eight complete original logs (1,572,758 bytes) confirm Kernel 774/798 tests, 45 document tests and the 2,433-page manual. Initial TeX reference warnings resolve through normal multipass generation; final passes are clean. Integration 1731/1732 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and its runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

Owned supervisor baseline — 22 September 2026: the signed Kernel implementation captures and verifies independently allocated supervisor tables before root VSpace creation, Rootd preparation and RAM seeding. Each copied page has one typed aligned Box owner before a parent references it; the recursive entry selects the copied root. Source boot/AP tables and mapped backing retain separate custody. User leaves, malformed geometry and invalid recursive identity are refused. Leaf permissions, cache policy and huge-page sizes are preserved; newly owned table branches use WriteBack and clear USER. Failed construction releases all unpublished allocations. This replaces a raw-pointer table-storage owner with shared typed storage and adds no unsafe Send/Sync implementation or userspace operation.

Eleven new host controls cover independent storage, allocation/read failures, invalid translation geometry, user leaves, recursive and huge-page errors, source-permission drift, retained owner links and table counts beyond the unrelated 64-page batch size. Four strict host configurations pass 785/809 tests with three existing ignored cases; fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The coordinated catalog passes all 172 maintained helpers. Both allocator scenarios require successful baseline capture before their original marker sequence, with capability grants and original 60/120-second deadlines preserved.

Six native executions satisfy seven maintained contracts: both allocator scenarios, mapping and sparse checks sharing identical runtime settings, owned invocation, lifetime revocation and ordinary exec-successor across all 73 components. Exact signed source and retained packaged artifacts are verified; no image warnings or QEMU stderr were observed. The technical manual specifies the custody boundary and passes 45 tests, complete 2,433-page generation, all 451,287 word bounds and changed-page visual review without final warnings or overflow. Static audits cover 3,194 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots.

Publication CI: original Kernel push 650 passes and PR 651 retains the host fixture failure. Regression 29 is resolved by signed Kernel 12184850cd73: a deterministic private predecessor reproduces the original defect, and the corrected fixture passes the complete local matrix and push CI 652/PR CI 653. Four complete corrected CI logs total 807,886 bytes with zero warning candidates. Only host tests and roadmap change; validated production sources and all catalog selections remain unchanged. Docs 1017/1018 pass with four complete logs (775,122 bytes), 45 tests and the 2,433-page manual. Initial TeX reference warnings resolve before clean final passes. Integration 1733/1734 remains queued at the latest retained observation and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. The retained baseline is a construction prerequisite for owned address spaces. Per-VSpace population, CR3 activation, invalidation and live-root reclamation remain open, and no speedup is claimed. Full semantic authority and inline-documentation review also remain open. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

Huge-leaf geometry correction — 22 September 2026: the bug report preserves four original host failures and one passing WriteBack control. The signed correction separates PAT from physical address bits, preserves permissions/cache indices across both huge splits, and gives newly allocated tables WriteBack policy. Scalar and batched translation, split preparation, snapshots and baseline validation share the documented geometry. No new userspace authority, original native exploit or universal boot failure is claimed.

Four strict Kernel configurations pass 796/820 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The catalog passes all 172 maintained helpers. Six native executions satisfy seven original contracts: mapping and sparse, lifetime, invocation, both allocator checks and ordinary exec-successor across all 73 components. The new native witness verifies real 2 MiB PAT translation, splitting and complete restoration; host controls additionally cover 1 GiB. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The manual passes 45 tests, 2,433 pages and changed-page visual review without final warnings or overflow.

Publication CI: Kernel 654/655 and Docs 1019/1020 pass. Eight complete original logs (1,592,794 bytes) confirm Kernel 796/820 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration 1735/1736 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Static audits cover 3,197 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, live-root reclamation and full semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven.

First-start register custody — 22 September 2026: the stack-domain bug report preserves three original host failures and one valid-stack control at unchanged production sources; the same four controls pass against the signed correction. Ordinary anonymous stack materialization now rejects addresses outside the existing user domain, and direct bootstrap writes require retained writable registered backing. Initial registers have Kernel-owned storage; stack preparation preserves the synthetic return slot, complete admission, startup arguments and rollback. The obsolete saved-frame user overlay and directory scan are removed. Complete external start-context admission and the separate bootstrap code/stack overlay remain distinct work.

Four strict Kernel configurations pass 807/831 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The catalog passes all 172 maintained helpers. Six native executions satisfy seven original contracts: lifetime, invocation, mapping and sparse, both allocator checks and ordinary exec-successor across all 73 components. The new witness checks all original initial register words after two real user stack mutations and before ordinary syscall capture. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The manual passes 45 tests, 2,433 pages and four changed-page visual reviews without final warnings or overflow.

Publication CI: Kernel 656/657 and Docs 1021/1022 pass. Eight complete original logs (1,600,791 bytes) confirm Kernel 807/831 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration 1737/1738 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Static audits cover 3,201 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, CPU residency, live-root reclamation and complete semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven.

## Problem and motivation A full in-EriX build needs an explicit inventory of every product, generator and runtime dependency. POSIX and toolchain work otherwise risks targeting a small demonstration while leaving image assembly or documentation dependent on an external host. ## Proposed behavior and scope ### Caller-owned transport scratch — 15 September 2026 Move both full-capacity shell transport buffers into the authenticated caller-owned workspace: ordinary message I/O and the descriptor transaction's emergency cleanup. The current descriptor state is exclusively borrowed while a transaction lives, so the transaction can borrow its cleanup slice directly. No global scratch lookup, shared mutable cell, runtime lock or new capability is needed. Remove the unsafe static message accessor and the 32 KiB automatic cleanup array. Preserve the 64 KiB process stack and all current upper stack ceilings. Group descriptor backing storage explicitly at startup, validate cleanup capacity and clean bytes before constructing effectful state, and keep the cleanup slice disjoint from ordinary transport, history and other arenas. A transaction temporarily borrows that slice, retires providers in the existing order, erases the full borrowed extent and returns the borrow; explicit restore and already-retired resolver paths retain their existing behavior. Failure and uncertain ownership must retain their existing fail-stop rules. Do not introduce shared aliases or fallback storage. Coordinate target and image-builder layout version 22. Export the target transport-array size/alignment in the layout description, allocate both buffers in identical typed carve order, and reject old or mixed descriptors. Preserve caller resource policy and complete transport capacity; this is an ownership/layout change, not a smaller-message workaround. The frame inspector must eventually bind the full workspace reservation instead of requiring a now-removed stack array, while still rejecting unproved ordinary-source and direct/nested bounds. Required evidence includes clean/short/dirty scratch, canary/erasure/reuse, early error, explicit restore, handoff, uncertain cleanup and existing shell regressions; exact target/producer layout agreement and old-version refusals; strict warning-denied Rust/helper matrices; actual optimized frame inspection; and relevant bounded runtime VMs before product acceptance. Keep the complete frame gate and full self-hosting criteria open until their own evidence exists. ### Staged construction without root capabilities — 15 September 2026 Add kernel-control operation 54, CREATE_STAGED_PROCESS_WITHOUT_ROOT_CAPS, and checked StagedProcessWithoutRootCapsV1 scalar framing. Successful creation returns a live Created process and nonzero generation whose CSpace contains exactly its requested primary endpoint, with no CNode, VSpace or TCB capabilities. Native CSpace/TCB/VSpace objects and the process's VSpace lifetime reference still exist. No child code executes during construction. The endpoint initially retains its ordinary full endpoint rights; operation 53 independently narrows it before bootstrap execution. Keep the existing creation operation 32 and its producer behavior unchanged. The new selector is independently recognized: an older kernel refuses it, and callers must not fall back to old ignored flags or a child self-report. Admit it only on the existing Process endpoint family, without adding a capability type, endpoint factory or ChildPopulate creation authority. Use the existing fixed request envelope. arg0 contains the caller-local install-grant destination in its low 32 bits; its upper half is zero. arg1 low/high halves contain child-local primary endpoint and caller-local endpoint-master destinations. arg2 low/high halves contain the child window base and optional caller-local VSpace destination. arg3 contains the 32-bit window length, with a zero upper half. Flag bit 0 means that the VSpace receipt is requested; all other flag bits are zero. When the bit is clear, arg2's upper half must be zero. This explicit presence bit distinguishes an omitted receipt from a real receipt in slot zero. All slot fields retain their full unsigned width; slot zero and otherwise vacant former root positions are ordinary requested slots, subject to native bounds, actual caller-window visibility and occupancy. The checked codec validates framing, not native capacity or authority. The native constructor requires a valid child window containing the primary endpoint. The caller receives only its actual unique stage-bound install grant, endpoint master and optional MAP-only VSpace receipt. The grant is bound to the returned process/generation and exact child window. Existing capability ceilings, actual object identity and explicit disposal rules remain in force. Temporary native setup bindings must be gone before constructing the final primary endpoint and publishing the grant; otherwise former root positions would remain an unnecessary destination restriction. The TCB's independently held VSpace reference must keep backing alive even without any child or parent VSpace capability. On failure, destroy the partial child and dispose only successfully created parent receipts. Preserve pre-existing or overlapping destinations and the original failure; uncertain cleanup fail-stops. Never treat a requested slot as evidence that its capability was created. The new contract supplies an initial inventory, not a permanent prohibition on later explicitly authorized installations or a sealed realm. The returned grant remains a real pre-start population authority that its owner must account for and retire. Required checks include full-width codec/reserved-field cases, omitted versus slot-zero VSpace receipts, zero/former-root/last-slot endpoint destinations, invalid or inaccessible windows, occupied/overlapping outputs, exact parent and child inventories, no residual native objects, mapping/startup backing retention, attenuation through the actual grant and abort/terminal cleanup. Actual CPL3 creation/refusal/disposal must complement host tests. Procd adoption must select this operation only for the mediator role and preserve all ordinary start gates until authenticated grant return, minimum typed startup, retained native/nested guards, readiness, configuration/seal and fair retirement are independently implemented. No runnable realm or guest build is established by this constructor alone. Inventory the repository and target graph, create the required components from meta, freeze the tool/API workload and authority model, and define the complete two-generation acceptance contract. Include firmware, signing, manuals, console/input behavior and all four image profiles. This issue records planned work; its unchecked criteria are not implementation proof. The normative basis is [Phase 6 and AC1–AC24](https://git.erikinkinen.fi/erix/docs/src/branch/main/phases/6.md). ## Authority, security and reliability Define trusted owners and capability ceilings before implementation. POSIX metadata and ABI identifiers remain descriptive, resource budgets come from workload evidence, and immutable source selection uses full commit hashes. The inventory cannot authorize release promotion. Apply the priority order: security, reliability, then performance. Keep suspected vulnerabilities in the repository’s restricted SECURITY.md reporting channel. ## Acceptance criteria - [ ] Inventory all existing repositories, nested Cargo workspaces and crates, targets, profiles, feature combinations, scripts and maintained tests. Record repository paths, remotes, exact heads, dirty state and build ownership. - [ ] Record/create `feature/posix-compat` before each repository's first edit; verify exact dependency pins and signed ancestry from the accepted base. - [ ] Verify whether lib-posixabi, lib-cstd and posixd already exist remotely before creating absent repositories in Forgejo from meta, then cloning. Record the existence/template/clone result for each of these three required components. - [ ] Scaffold those three components with explicit responsibility and authority boundaries, rustdoc, strict CI, tests and specialized canonical docs. Keep import recipes/profiler in Integration; do not invent extra daemons/repos without a concrete ownership need and recorded design review. - [ ] Add new components to Integration's commit-pinned catalogs and immutable dependency policy; validate the exact transitive source graph. - [ ] Freeze a machine-readable full-build output inventory: every maintained EriX crate/library/binary, kernel, EFI bootloader, native build tools, boot image, dynamic/launch metadata, four image profiles and release manifests. - [ ] Inventory all canonical generators, documentation/manual outputs, checksums/compression/signing steps and their host executables. Include these in the in-EriX build closure; distinguish external test execution from building. - [ ] Record the build-host versus emitted-target matrix: EriX-hosted tools and compatibility libraries for `x86_64-unknown-erix`, plus the existing bare-metal and UEFI targets needed to rebuild the OS. Do not rewrite native target ABIs merely to make imported tools run. - [ ] Produce an API/workload matrix from the exact intended Rust/LLVM, Cargo, Python, Git, shell, image and documentation recipes; map every required call/ELF feature to an owner, implementation item and independent test. - [ ] Define the POSIX specification edition/profile, C ABI/data model, locale baseline and optional extensions. Mark unsupported optional surfaces explicitly; never claim full POSIX certification from a selected build workload. - [ ] Resolve/document the existing Phase 6 close-on-exec-by-default policy versus standard descriptor inheritance expectations. Preserve native authority ceilings; specify any compatibility deviation before implementation. - [ ] Approve the architecture/threat model for `posixd` isolation, process mediation, TLS, fork snapshotting, signal delivery and build realms. Enumerate trusted components and keep POSIX policy out of the kernel/rootd. - [ ] Fix per-scenario resource budgets and progress/deadline contracts from measured workloads; distinguish ABI/hardware bounds, authorized quotas and accidental hard-coded limitations. - [ ] Define exact self-host success/failure criteria and evidence schema before implementation: source-only inputs, no host build delegation, two clean in-EriX builds, deterministic artifacts, boot result and authority-negative tests. - [ ] Extend inventories with rootfs authority-bearing files/signatures, firmware trust enrollment, native build-tool targets, man/help coverage and console/input interfaces; assign each an owning public issue and acceptance test. - [x] Record `v1.0.0-alpha.1` as the intended manually reviewed release baseline, coordinating platform/component version policy without premature version bumps, tags, PR readiness or release publication. For each implementation slice, retain actual formatting, strict Clippy, unit/doctest and warning-denied build results for all altered Rust repositories and valid configurations. Add relevant runtime VM coverage, monitor older unit/VM regressions in exact-head CI, and update canonical component documents and affected technical-manual/API material. Every authored code file must remain below 1,000 physical lines, with meaningful inline documentation and missing_docs enforcement in Rust crates. ## Alternatives and tradeoffs A target-triple-only port or single-crate smoke test leaves compiler-host APIs and packaging helpers unresolved. Freeze the actual required graph, while explicitly recording optional POSIX surfaces and later-phase non-goals. Validation checkpoint — 14 September 2026: Signed Integration `7cc0593e101b2e0ca42f24d4fa189dd96cb1455c` passes all 159 helper suites, the strict four-selection Rust matrix (320/321 units) and all 87 original Rootd feature selections from failed CI 1603/1604. Both final native VMs pass unchanged exit/marker rules with empty stderr. The lifetime image is 2,150,400 bytes, SHA256 `7d8b99684110d38dd77d2be297f1d896d7bb94a2f60dc5a3ee3dcab06cea2c76`; the ordinary Rootd image is 27,934,720 bytes, SHA256 `3868790fac953843c62e3674ef149dc55e4502e5118212fcc95d1aef875cf1a0`. Original compiler, runtime-import and entry-argument failures remain retained. Full CI [1605](https://git.erikinkinen.fi/erix/integration/actions/runs/1605) and [1606](https://git.erikinkinen.fi/erix/integration/actions/runs/1606) is running; no full-catalog pass is claimed. Allocator validation checkpoint — 14 September 2026: Signed Integration `a869a81eb406a4f027a2b5db573b6330ca114d94` selects both final source graphs and passes all 159 helper suites plus strict 320/321-unit development/release default/all Rust matrices. The final ordinary Rootd IPC-framing VM passes in 45.832335 seconds and the native distinct-argument/lifetime VM passes in 13.026853 seconds, under unchanged exit/marker/deadline rules with empty QEMU stderr. These are host build-and-run durations. The ordinary image is 27,934,720 bytes, SHA256 `2a187127696d569ae5c627d9c1d154ad53c024e98d9a181dbb6006790f01a0cc`; the lifetime image is 2,142,208 bytes, SHA256 `8fa4c7512a5916a51ba956b1e55c84ac2945c2580ff9556c99c27cbaa6e3321d`. Its final image, ELF and EFI bytes equal the preceding validated feature-tree artifacts. Older full CI [1605](https://git.erikinkinen.fi/erix/integration/actions/runs/1605)/[1606](https://git.erikinkinen.fi/erix/integration/actions/runs/1606) is still running; new [1607](https://git.erikinkinen.fi/erix/integration/actions/runs/1607)/[1608](https://git.erikinkinen.fi/erix/integration/actions/runs/1608) is waiting. No full-catalog pass, realm implementation or full guest build is claimed. Endpoint construction checkpoint — 14 September 2026: Signed Integration `989d44d604d07c4c9bcc23264912bdf2076b99eb` selects both endpoint-construction graphs with their original dependency objects. Fresh strict Rust checks pass 320/321 units in all four selections, doctests, private rustdoc and freestanding builds. The previous 159-helper result is reused only for unchanged helper implementation sources; changed catalog/scenario contracts are rechecked. The original Rootd IPC-framing VM passes in 45.868135 seconds and native lifetime/distinct-argument VM in 21.529775 seconds, with unchanged oracles and empty QEMU stderr. These are host build-and-run durations. The ordinary image is 27,934,720 bytes, SHA256 `184a636fb1aec40bcefc04bbd23e4884c742f12ec2400428f40c88d597499dda`; native image is 2,150,400 bytes, SHA256 `616b6f18f9b47c5aefaae83f288284b5ab2f31242fc422cced8233f0dea490e8`. Completed older Integration [1605](https://git.erikinkinen.fi/erix/integration/actions/runs/1605)/[1606](https://git.erikinkinen.fi/erix/integration/actions/runs/1606) at `7cc0593e101b2e0ca42f24d4fa189dd96cb1455c` each reports 485 passes and one failure across all 486 scenarios. The sole failed scenario is the existing ext4 quota timeout tracked in #18. All six complete logs total 27,546,527 bytes with zero warning candidates; Rust and Markdown pass. There are no VM-worker dependency-feature compiler failures. Subsequent dependent image and terminal gates remain unestablished. The allocator cohort 1607/1608 is running; current endpoint-construction cohort 1609/1610 is waiting. Completed CI checkpoint — 15 September 2026: Signed Integration `a869a81eb406a4f027a2b5db573b6330ca114d94` passes both [1607](https://git.erikinkinen.fi/erix/integration/actions/runs/1607)/[1608](https://git.erikinkinen.fi/erix/integration/actions/runs/1608); signed endpoint-construction checkpoint `989d44d604d07c4c9bcc23264912bdf2076b99eb` passes both [1609](https://git.erikinkinen.fi/erix/integration/actions/runs/1609)/[1610](https://git.erikinkinen.fi/erix/integration/actions/runs/1610). Each run reports all 486 distinct VM scenarios passing, followed by the actual native lifetime scenario, physical/serial interactive checks and all four console modes. Rust and Markdown pass. The two six-log cohorts contain 26,769,289 and 26,769,316 bytes respectively, with zero warning candidates. The previously observed intermittent quota timeout remains documented without a causal-fix claim. These results establish the selected source checkpoints, not owned invocation transport, complete authority closure or either full in-EriX build generation. Native transfer preparation checkpoint — 15 September 2026: Signed Integration `97651e7289c23560d21cf6c41effa405c97bc80d` selects both original Kernel source graphs. Fresh strict Rust checks pass 320/321 units across default/all development/release, doctests, private rustdoc and freestanding builds. The prior 159-helper result is reused only for unchanged helper implementation sources; changed catalog, scenario and native lifetime policy checks pass again. The actual Rootd IPC-framing VM passes in 54.851098 seconds and native lifetime/distinct-entry-argument VM in 21.601175 seconds, with unchanged oracles, clean process teardown and empty QEMU stderr. These are host build-and-run durations. The ordinary image is 27,951,104 bytes, SHA256 `1aadb6a82edf2be056254365b94ba659210c076374b321384223c219ef499fcb`; native image is 2,158,592 bytes, SHA256 `95d0501b2164a4bd34e307347e174451fc9f05e49cd0d9477961c5c8f663e127`. The 62-capability allocation-rejection controls execute against actual kernel objects on the host; these VMs validate the existing IPC/lifetime paths. All four completed Integration workflows [1607](https://git.erikinkinen.fi/erix/integration/actions/runs/1607), [1608](https://git.erikinkinen.fi/erix/integration/actions/runs/1608), [1609](https://git.erikinkinen.fi/erix/integration/actions/runs/1609) and [1610](https://git.erikinkinen.fi/erix/integration/actions/runs/1610) pass all 486 scenarios, the later native lifetime and interactive gates, and all four console modes. The two complete cohorts total 26,769,289 and 26,769,316 bytes with zero warning candidates. The existing intermittent quota timeout remains open in [Integration issue 18](https://git.erikinkinen.fi/erix/integration/issues/18); later successful runs do not establish its cause or a causal fix. Current transfer-preparation workflows [1611](https://git.erikinkinen.fi/erix/integration/actions/runs/1611)/[1612](https://git.erikinkinen.fi/erix/integration/actions/runs/1612) are running; their full-suite acceptance is pending. Native invocation custody checkpoint — 15 September 2026: Signed Integration `660cdd99a5e9b36f88b21aaed6391569e0161926` selects this Kernel in its isolated native catalog while preserving the ordinary service graph at original Kernel `d2438c7e56c964a9c16720586cf718ec11e7cc0a`. The existing native lifetime and distinct-entry-argument VM passes unchanged oracles in 24.878415 seconds of host build-and-run time, with clean teardown and empty QEMU stderr. Its 2,207,744-byte image has SHA256 `9fcdc589f4eb598978095e69122589f51a9bd8c841523a8004094ec288dd6be0`. This validates existing behavior through the changed lifecycle hooks, not the absent owned-invocation syscall interface. Fresh Integration strict default/all development/release checks pass 320/321 units, private rustdoc and freestanding builds. All 159 prior helper-command results are reused only after source equality outside catalogs and roadmap; changed catalog/scenario/native-policy checks pass again. Full Integration [1613](https://git.erikinkinen.fi/erix/integration/actions/runs/1613)/[1614](https://git.erikinkinen.fi/erix/integration/actions/runs/1614) at the new catalog are waiting at their first observation; predecessor 1611/1612 remains running at its fourth observation. All four older 1607–1610 workflows passed 486/486 scenarios, later native/interactive checks and all four console modes. The existing intermittent quota timeout in [Integration issue 18](https://git.erikinkinen.fi/erix/integration/issues/18) remains open with unknown cause; later passes do not establish a causal fix. Corrected signed-head Kernel CI [548](https://git.erikinkinen.fi/erix/kernel/actions/runs/548)/[549](https://git.erikinkinen.fi/erix/kernel/actions/runs/549) and Docs [859](https://git.erikinkinen.fi/erix/docs/actions/runs/859)/[860](https://git.erikinkinen.fi/erix/docs/actions/runs/860) pass. All 8 complete logs total 1,413,966 bytes, with zero final warnings. The terminal cohort is classified. The syscall wire adapter, fresh userspace buffer/fault/overlap validation, authenticated caller-origin delivery fields and actual CPL3 owned-invocation peers remain unimplemented. Reachable backend disposal-failure coverage, sustained invocation-workload profiling, realm producer adoption, whole-codebase authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire record is assigned; the existing CALL/RECV/REPLY ABI is unchanged. Authenticated delivery-origin checkpoint — 15 September 2026: Signed Integration `73924191bb6f9e9c9c740240fca957936360bba5` selects this Kernel only in the isolated native catalog. The unchanged lifetime and distinct-entry-argument VM passes in 23.292658 seconds of host build-and-run time, with clean teardown and empty QEMU stderr. Its 2,207,744-byte image has SHA256 `d20f1b859228afbbf671c2c484efb24f2c1dd6d8e8d7c32f4560f33206b97df9`. This is existing-path regression coverage; new owned-invocation CPL3 peer acceptance still requires a wire adapter. Exact source comparison preserves the preceding strict 320/321-unit Rust matrices, private rustdoc, freestanding builds and 159 helper-command results. Changed catalog/scenario/native policies pass again. The ordinary service graph and original dependencies remain unchanged. Kernel CI [550](https://git.erikinkinen.fi/erix/kernel/actions/runs/550)/[551](https://git.erikinkinen.fi/erix/kernel/actions/runs/551) and Docs [861](https://git.erikinkinen.fi/erix/docs/actions/runs/861)/[862](https://git.erikinkinen.fi/erix/docs/actions/runs/862) pass. All eight complete logs total 1,414,891 bytes, with zero final warnings; the cohort is classified and stopped. The separate earlier fixture correction remains closed in [Kernel issue 13](https://git.erikinkinen.fi/erix/kernel/issues/13), preserving original CI 546/547 and corrected 548/549. Full Integration [1615](https://git.erikinkinen.fi/erix/integration/actions/runs/1615)/[1616](https://git.erikinkinen.fi/erix/integration/actions/runs/1616) is waiting at its first observation. Predecessor 1613/1614 is waiting at its second observation; 1611/1612 remains running at its fifth. Older complete 1607–1610 successes remain distinct from the unresolved intermittent quota timeout in [Integration issue 18](https://git.erikinkinen.fi/erix/integration/issues/18). Sustained invocation-workload profiling, syscall wire and fresh-buffer/fault/overlap validation, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm producer adoption, whole authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire layout is assigned. Native progress and cleanup still do not certify application cancellation. Native invocation profiling baseline — 15 September 2026: Signed Kernel `6cb703e1ed8b9de0d29a37189cd914cd501e732e` provides an actual-object host workload for queued progress, collected progress, descriptive result reads and complete request/result cycles. Signed Integration `f3e4359b34cb8f7db732fbf38823f722553c86d4` adds bounded capture, raw-evidence report verification and equivalent comparisons. Every sample checks exact bytes and SEND capability bindings, authenticated origin, foreign selection, duplicate completion refusal, FIFO position reuse, one-time collection and final invocation disposal. Source and executable bytes are observed against explicit original identities; compiler/host relationships remain declarations. Workload children and source Git reads receive minimal environments; capture owns memory, time, output and process cleanup. Completion is published only after deadline teardown succeeds. The operator guide and signed Docs `644273a0edd91e4c38dcd4418d6ae1119ff1f10b` describe these boundaries. Kernel strict default/all development/release checks pass 632/656 units plus three standalone controls, three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. Integration passes all 161 helper commands, including 19 profiler controls and nine source-provenance controls, plus fresh strict 320/321-unit Rust matrices, private rustdoc and warning-free target builds. Four original socket-fixture failures are retained and attributed to the selected temporary directory exceeding the host Unix-socket path domain; a shorter explicit private directory passes the same fixtures. Docs passes 45 tests and renders 2,345 pages with zero final warnings; 427,592 word boxes fit page bounds and changed pages 2284/2285 pass visual review. Kernel CI 552/553 and Docs CI 863/864 pass; eight complete logs total 1,431,762 bytes with zero final warnings after manual reference convergence. The original signed Kernel baseline retains 48 measured samples and 16 checked warmups: four modes, populations 0/32/128/512, 256 operations per sample, three measured repetitions and one warmup. A single selected host CPU is used after local build/test work completes; external host scheduling is not isolated. At population 512, operation medians are 117,577.723 ns for queued progress, 8,927.977 ns for collected progress, 9,124.098 ns for descriptive reads and 1,167,847.016 ns for complete cycles. At population zero they are 223.328, 166.199, 213.137 and 4,556.867 ns respectively. Every raw sample, process disposition and final native cleanup passes. Timings include fixed semantic checks; no cost is subtracted and no ratio is a pass threshold. Source review identifies repeated carrier-binding scans during full registry refresh and a registry-lock acquisition for every inactive settlement position. The next bounded change will retain only non-authoritative numeric search positions: every fast path must still check current capability type/rights, endpoint identity/in-use state and exact CSpace/slot binding, with complete lookup on a stale hint. Existing revocation and terminal hooks remain authoritative. Settlement may scan for the next draining owner under one lock while retaining the original pass boundary, increasing index order, busy-position exclusion and allocation-free stack-owner return; disposal remains outside the table lock. Original workload bytes and sample policy must remain unchanged for comparison. The older Integration CI 1611/1612 succeeds at all 486 catalog scenarios, native lifetime, interactive directory/editor and four console modes. Six complete logs total 26,771,244 bytes with zero warnings; this does not resolve the intermittent quota cause tracked in Integration issue 18. Integration 1613/1614 is running, 1615/1616 is waiting, and current profiler CI 1617/1618 is waiting. No completed cohort is polled again. No Kernel performance algorithm has changed in this baseline. Native syscall adapters, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The 76-repository inventory has 2,923 code files below 1,000 lines and 155 direct missing_docs crate-root gates; this does not close the semantic audits. Measured native invocation lookup refinement — 15 September 2026: Signed Kernel `8349d68636382cc7e25a3347f5f1df216554203a` retains only numeric carrier-search positions. Every use rechecks the actual CSpace capability type/rights, live endpoint identity and exact binding; stale positions take the complete search path. No successful authorization, capability or reference is cached. Draining scans fix their boundary on the first poll, visit each position at most once, skip busy stack owners and return exclusive custody after unlocking. Native disposal and first-failure retention preserve their existing semantics. Signed Integration `108501cf7ec20f05dd3d62ea401ea8adad6c6e9c` selects this Kernel in its isolated native catalog, and signed Docs `f10a1d375a326543ec0adda4569bc7cb4faca9b6` documents the invariants. The existing syscall ABI and ordinary image catalog are unchanged. All 15 actual-object native controls pass, including real alias compaction, rights/type/object replacement, busy ownership and allocation-free settlement. The unchanged four-mode workload control also passes. Full strict default/all development/release Kernel matrices pass 634/658 units plus three standalone controls, with three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. The existing native lifetime and entry-argument VM passes unchanged oracles in 21.978041 seconds of host build-and-run time, with clean teardown and empty QEMU stderr. Its signed boot image is 2,207,744 bytes, SHA-256 `4030cdfb8a13c000ff4716ecdc5203cb46273d6117a282f7375f25dccbbeedc9`. Exact unchanged Integration Rust/helper bytes preserve the preceding strict 320/321-unit matrices and all 161 helper-command results; changed catalog/scenario policies pass. Docs passes all 45 tests and a complete 2,345-page render with zero final warnings, 427,679 bounded word boxes and visual review of page 145 plus continuation page 146. The original signed Kernel `6cb703e1ed8b9de0d29a37189cd914cd501e732e` and the new signed Kernel use byte-identical workload sources, the same selected CPU/toolchain/context and explicit limits, distinct source targets, four modes, populations 0/32/128/512 and 256 operations per sample. Each capture retains 48 measured samples and 16 warmups; every sample passes actual semantic and native/process-cleanup checks. At population 512, median queued-progress cost changes from 117.578 to 37.673 microseconds (3.12x observed ratio), and full-cycle cost from 1167.847 to 443.055 microseconds (2.64x). Collected progress changes from 8.928 to 6.015 microseconds and descriptive reads from 9.124 to 6.212 microseconds. Timings include fixed checks, with no subtracted overhead or timing-ratio pass gate. No managed build/test workload runs concurrently during capture; external host scheduling remains unisolated. These are host operation wall times, not guest startup/build acceptance or a statistical guarantee. Kernel CI 554/555 succeeds; four complete logs total 679,280 bytes with no warnings, and its completed cohort is stopped. Docs CI 865/866 succeeds at observation three; four complete logs total 754,424 bytes, all 45 tests pass and each manual has 2,345 pages. Its normal reference passes report 32/1/0 warnings, with zero final warnings and no box diagnostics. The completed Docs cohort is stopped. Integration CI 1619/1620 is waiting at its first observation. Older Integration 1613/1614 is running; 1615/1616 and 1617/1618 are waiting. Accepted older Integration 1611/1612 passes all 486 catalog scenarios and later probes with complete warning-free logs. This does not establish the intermittent quota cause tracked in Integration issue 18. Current full-suite CI remains required; stopped cohorts are not polled again. Owned syscall wire adapters, actual owned CPL3 peers, fresh-buffer validation, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The refreshed 76-repository inventory has 2,924 code files below 1,000 lines and 155 direct missing_docs crate-root gates; those checks do not close whole-codebase semantic audits. Owned invocation wire and native acceptance — 15 September 2026: Signed Kernel `5f497adaefa526108a0439e0e071717dddb85334`, shared IPC `de968da19898bef532ddb3b5974bb9562f51dee5`, capability ABI `a001a26f0eb3aebec3f5fd02a28d98f1bc23f8a0` and Integration `9030b217c490db6ad3ec60a799cb025eccbfcdb1` implement and exercise the immediate owned invocation boundary. The allocation-free shared codecs and shim preserve exact return metadata, including a retained draining owner on failed submission. The Kernel checks fresh complete user mappings and packet framing under one lifecycle guard before native effects. No user pointer or caller-selected identity is retained. Destination capacity and descriptive receipt capacity are independent; spare capacity acquires no authority and repeated collection cannot duplicate transfers. Existing numeric binding hints still recheck live capabilities on every use. The real three-process CPL3 scenario passes all eight operations, full-span pointer/rights/overflow/reserved-field rejection, actual returned selectors, payload/capability/origin checks, collection after server exit and repeated receipts. A second request rejects premature relinquishment, enters draining on caller release and retires only after the exact server acknowledgment. Current signed owned and unchanged older lifetime images are each 2,232,320 bytes, with SHA-256 `588c6097c57ebd2ed92e0f0b76f2b1ad6b82630b4a0da272ee98e218eb8e333d` and `8f9026aaefd2c5a745e35467ac01c71789c5f469f9cd42a477f87818747ee673` respectively. Both runs have clean teardown and empty QEMU stderr. Ordinary images contain neither diagnostic hook. Strict default/all development/release host, freestanding and rustdoc matrices pass: IPC 368 units, shim 20, capability ABI 191, Kernel 642/666 and Integration 320/321. Existing ignores remain one shim and three Kernel tests. All 162 maintained Integration helper commands pass; three prior correct concurrent-run lock refusals are retained and their sequential checks pass on unchanged executable inputs. Docs `46da7a4cb4d38a2bea5b5491a68f51f33e4b4305` publishes the normative register/packet contract and regenerates the three affected API references from original signed revisions. All 45 documentation tests pass. The complete 2,363-page manual has zero final warnings, 430,365 word boxes within page bounds and reviewed changed ABI/API pages. Shared IPC CI 337/338 and capability ABI CI 214/215 pass with eight complete warning-free logs. Both Kernel revisions pass CI 556/557 and 558/559 with eight complete warning-free logs. Those cohorts are stopped. Current Docs CI 867/868 passes at observation four; four complete logs total 758,328 bytes. Both 2,363-page manuals pass all 45 tests, report normal reference-pass warnings of 32/1/0, and finish with zero warnings or box diagnostics. Its cohort is stopped. Current full Integration 1621/1622 is waiting. Older full Integration 1613/1614 now passes all 486 catalog scenarios and later native/console probes, with six complete warning-free logs; its cohort is stopped. Older 1615/1616 is running, and 1617/1618 plus 1619/1620 are waiting. Current full-suite acceptance remains open, as does the intermittent quota cause in Integration issue 18. This checkpoint supersedes the earlier pending wire/CPL3/manual status. Reachable backend disposal-failure coverage, broader revocation/generation-reuse scenarios, producer adoption, realm runtime, complete authority/inline-documentation audits and both full EriX-in-EriX build generations remain open. The current inventory checks 76 repositories, 2,943 code files below 1,000 lines and 157 crate roots with direct missing_docs gates; it does not establish semantic audit closure. No complete guest build or guest performance result is claimed. Process-bound native acceptance — 15 September 2026: Signed Kernel `60da5858d7198185efd103f0e91e5ac2e0b63e67` implements control operation 52, checking the actual moved install grant against expected process/generation with exact rights, including zero, under existing endpoint policies. Signed Procd `f1105706cc19ed024a6cca79a29abc57c90c6661` uses this operation in its actual ordinary launch-description producer while retaining the narrow SEND receipt, pending state and exact failure cleanup. IPC `c453b697b8cdb9cc1c36f1ad89ff868648190025`, capability ABI `fe8d558253ad01301b99554e20d287c4ea35bb1d` and five aligned helper commits preserve original Git/type identity. Integration `58c925c564b69bebce8df6f3e75a9312824e18c4` passes the expanded lifetime CPL3 scenario with thirteen actual control calls, user-side reply checks, two staged children and full added-custody disposal. The corrected lifetime image SHA-256 is `8e6a9e8f68b90cc1ede61300958cec122b82a7c6dfd6318a51e40fefc7ba166e`; the unchanged owned-invocation scenario also passes with image SHA-256 `b76a380d3cd6b03b0ff61a3b626ace0667679920684ad7356a1c3a36e2224953`. Both have clean teardown and empty QEMU stderr. The initial fixture setup-order failure is retained and corrected in Kernel issue #14. All strict default/all development/release matrices pass: IPC 371, shim 20, capability ABI 191, Kernel 648/672 including standalone controls, Procd 227/232 including auxiliary binaries, and Integration 320/321 tests. Existing native-only ignores are unchanged. Procd passes forty native binary builds with repository linker scripts. All 162 Integration helpers pass after updating the exact policy assertion to require the new marker; its initial mismatch remains recorded. Docs `b0fcf0f43af2af741d520a0b1373cc346e08863c` updates the native wire/ownership contract, operation registry, Procd boundary and three generated shared APIs. All 45 tests and the complete 2,367-page manual pass, with zero final warnings, 431,138 word boxes within page bounds and four reviewed protocol/API pages. Current IPC 339/340, capability ABI 216/217, Kernel 560/561 and 562/563, Procd 266/267, Docs 869/870 and all five helper push/review CIs pass with complete classified logs and no final warnings. Those component cohorts are stopped. Current full Integration 1623/1624 waits at observation 01. Older full Integration 1615/1616 is running at observation 11; 1617/1618, 1619/1620 and 1621/1622 wait at observations 09, 07 and 04. No pending full suite is counted as passed. Typed realm bootstrap, mediator startup/readiness/configuration/seal, complete consumer image adoption, fair terminal/provider retirement, broader native disposal failures and both full EriX-in-EriX build generations remain open. The new inventory covers 76 repositories, 2,950 code files below 1,000 lines and 158 direct missing_docs crate-root gates; complete inline documentation and whole-codebase authority closure remain open. Prior performance measurements retain their original signed source identities; this checkpoint claims no new timing or guest performance result. Corrected native staging checkpoint — 15 September 2026: Signed source `f8fba7520df5b6e76662741cf72b3e8b6a1edf21` is recorded in [the current review](https://git.erikinkinen.fi/erix/integration/pulls/12). Pin the corrected native graph and require ordered, unique constructor/cleanup evidence while preserving the owned-invocation and ordinary scenario oracles. 320/321 default/all Rust tests and the strict development/release matrix pass. All 162 maintained helpers pass. The lifetime image is 2269184 bytes, SHA256 70ef01f96694e0667c2317cf6076d6922b9cb36052b39de302bd3e1360cc3ce3; the owned-invocation image is 2232320 bytes, SHA256 7a6ed076de32320756e2ad99abf098d868989c72179c96bf3cbc47e9ba7fc81e. Both real VMs pass with empty QEMU stderr and clean owned teardown. Full CI 1625/1626 is pending; older completed 1615/1616 passes all 486 scenarios and subsequent native probes. Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed. Native creation rollback acceptance — 15 September 2026: Staged construction now retains a receipt for each successful parent copy until commit. On later failure it destroys the child and disposes only those new endpoint/VSpace copies, preserving pre-existing or overlapping output bindings. The transaction has a separate documented module. Eight actual constructor refusal cases check complete parent inventory and native VSpace counts. Kernel b853d51cfb36c2fbc81eb565b7d2fc3ab731de2b passes 649/673 default/all tests, strict host/native development/release Clippy, private rustdoc, formatting and ten native builds, with three existing ignores. Matching CI 566/567 passes with four complete warning-free logs. Integration 3c4e26025668fa2a171b2c80017fd2b8bcb1924f passes both actual native VMs with empty QEMU stderr and clean teardown. The lifetime fixture now includes seven creation/refusal/disposal calls alongside the thirteen installation calls; the existing owned-invocation oracle is preserved. Integration Rust/helper sources are unchanged and retain their completed 320/321-test strict matrix and all 162 helper results; changed native catalog inputs have fresh policy and VM checks. Full Integration CI 1627/1628 remains pending. Typed grant-return provisioning, independently constrained bootstrap authority before mediator execution, readiness, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. The code inventory covers 76 repositories and 2959 files below 1000 lines; all 158 scanned Rust roots enforce missing_docs. Whole-codebase semantic authority and private-item documentation audits remain incomplete. Signed helper `cdf15c52f24bd463dcabdddb945f779fff4ab367` excludes shallow local caches before an exact dependency fetch. It preserves the cache, selects the canonical catalog URL without following cache remotes, and requires original complete history. Three new real-Git controls and all 162 helper commands pass, along with 320/321 Rust tests per development/release configuration, strict host/native Clippy, four native builds, formatting, private rustdoc and Markdown with no warnings. Actual Rootd standalone preparation also passes using a shallow helper fixture and complete original Cargo metadata. Runtime library `2a16b1a7ac5514a43582025e5b9ba0a2f2ce2a29` and product catalogs remain unchanged. Full Integration CI for this helper commit is pending; no new VM or guest build is claimed. Workspace ownership checkpoint — 15 September 2026: Signed Exsh `b12e172e7b266842a8659104894f6821166165fb` owns ordinary and emergency transport in distinct version-22 authenticated workspace slices. Descriptor startup rejects short or dirty cleanup storage before metadata effects; transactions exclusively reborrow the complete slice and erase it after emergency cleanup. The global UnsafeCell accessor and automatic 32 KiB cleanup array are removed. Larger valid caller slices retain their complete extent. Existing provider retirement, metadata rollback and uncertain-cleanup behavior remain enforced. All 961 Rust tests pass in each default/all-feature/production development/release configuration, with formatting, strict host/native Clippy, private rustdoc and eight native builds without warnings. Four added tests cover workspace disjointness, malformed backing, complete caller extent and consecutive cleanup reuse; existing cleanup controls now also check buffer canaries and erasure. All 73 warning-denied checker tests pass. Both actual optimized native fallbacks measure 48 local bytes, compared with the retained prior 32,816-byte frames. Their full checker reports remain INCOMPLETE: runtime/all graphs contain 691/604 unresolved observations, and the old 32 KiB initial stack-reservation requirement still needs a workspace-specific evidence contract. Ordinary-source membership and direct-versus-nested early-drop bounds remain open. The 8/33/56 KiB upper limits and 64 KiB stack are unchanged; this measurement is not an all-path stack-safety claim. Matching producer `38424571b76b36c1e631d99fd2c859fb32311eea` exports/consumes 96 capacity words plus 72 target layout words, reserves both transport arrays first and rejects old/mixed layouts. Packaging both actual optimized shell configurations under canonical dev/release policies derives 4,300,800 workspace bytes, with unchanged executable bytes and a separate 64 KiB stack. All 162 Integration helper commands and its strict 320/321-test Rust matrix pass, including four native builds. These are private artifact and host checks, not guest execution. The product catalog still selects the earlier shell; coordinated catalog adoption and matching runtime VMs remain required. Documentation `79cdd4c3694e800091b55c737fca04c7bdd3d071` describes the ownership and compatibility contract. Its 45 tests and canonical checks pass. The full manual renders 2,375 pages without final warnings; all 433,713 word boxes are in bounds and changed page 2280 passes visual review. API snapshots are unchanged. Exsh CI 225/226 fails only the incomplete frame gate after 961 Rust and 73 checker tests; all four logs total 311,820 bytes with zero warnings. CI runtime/all graph observations are 662/587 and both fallbacks measure 48 bytes; these artifacts remain distinct from local images. Docs CI 883/884 passes with all four complete logs (762,212 bytes); reference passes converge with 35/1/0 warnings and zero final warnings. These component cohorts are fully classified. Integration CI 1637/1638 remains queued at its first observation. No full build within EriX or whole-codebase authority closure is claimed. Native companion correction design — 15 September 2026: centralize the complete eight assembly body/export inputs and original producer script as one reviewed native support contract shared by selection and support-manifest validation. Compare the full producer input set without dropping unknown, missing, altered or misidentified records; retain exact waited tool, cleanup and output checks. Coordinate the native lib-cstd catalog pin with original `bdcbbea43550e8b99cd9a8221e4bc5a645637990`. Include the contract module in both outer artifact fingerprints, update independent fixture inventories, and exercise actual hidden/public output against that original source. The existing shell workspace/catalog and complete frame/VM acceptance requirements remain separate. Tracks https://git.erikinkinen.fi/erix/integration/issues/52. Complete native companion checkpoint — 15 September 2026: Signed Integration `db80a2c1dfc669bd724762d476f5f5c0da005ff6` centralizes the complete eight assembly input roles plus the original producer script. Source selection and support-manifest validation share those roles; both outer artifact keys bind the contract module. The catalog changes only native lib-cstd to original `bdcbbea43550e8b99cd9a8221e4bc5a645637990`. Exact path/byte, tool, waited status, cleanup and output checks remain required. Actual hidden/public production and missing/extra/altered receipt controls pass, as do both outer cache-key controls. All 162 helper commands are covered: 160 pass in the full run, and the two corrected test-only fixtures pass separately. The original missing-module and unclosed-fixture-stream failures are retained. The strict 320/321-test Rust matrix, Clippy, formatting, private rustdoc and four native builds pass without warnings. A host-built diagnostic native image contains 38 executables and 27 shared objects, passes closure checks and builds without warnings. Its SHA-256 is `ff5d774308cdf236c860a2423adab6e2594bf3c0991b26eb37cb3c64af96ddfe`. It uses 73 original component selections with 72 coherent Cargo manifests and the five explicitly recorded helper corrections whose bytes match this signed checkpoint. It is not an unmodified product catalog. The unchanged editor/history, inherited-stream timing and runtime-error VM probes all pass with their original 120/15/10-second budgets and exact output checks; each leaves the source image unchanged. Signed Docs `31bd9524c31c9d8d6a8f00248f702e6b7d428106` explains the complete source contract. All 45 tests and canonical checks pass. The complete manual renders 2,375 pages without final warnings; all 433,817 word boxes are in bounds and changed page 2281 passes visual review. Original API snapshots are unchanged. Docs CI 885/886 passes with all four complete logs (762,204 bytes); reference passes converge with 35/1/0 warnings and zero final warnings. Integration CI 1639/1640 remains queued at its first observation; the build compatibility issue stays open pending its complete CI. Full Exsh frame proof, coherent product adoption and both complete EriX-in-EriX build generations remain open. Packaged workspace evidence design — 15 September 2026: Replace the obsolete automatic-stack-scratch requirement with a separate mandatory workspace mapping domain. The checker will accept an explicitly selected pristine ELF and optional corresponding packaged ELF, capture both under its existing owner/budgets, and require the packaged artifact to retain the pristine entry and executable bytes. Missing packaged input remains incomplete. A complete mapping domain requires the unique version-22 read-only descriptor, unchanged target type layout and full transport capacity, exact descriptor/arena extent, two disjoint complete transport spans, unique writable/non-executable zero-fill arena ownership, and the unchanged separate 64 KiB stack. Overlapping section/load/page claims, stale or mixed layouts, executable changes and relocation writes into the descriptor must fail. No cache receipt or caller-supplied success flag substitutes for actual artifact bytes. Local fallback stack accounting remains independent and retains its existing upper bound; register pushes or an old 32 KiB stack reservation cannot certify workspace storage. This mapping domain does not prove source-level borrowing/erasure, complete typed arena carving or every machine call path. Existing source tests and exact build identity retain those separate contracts. Ordinary-source membership, direct-versus-nested bounds and unproved indirect targets remain incomplete, and the full gate remains nonzero until every required domain is established. Add original positive/malformed/overlap/mismatch fixtures and replay the unchanged actual runtime/all artifacts and their existing dev/release packaging. No runtime code or stack budgets change in this checker slice. Paired workspace mapping checkpoint — 15 September 2026: Signed Exsh `f17670c7f0c3b6da4458deac534ba6210921550d` adds paired pristine/packaged ELF workspace evidence under report schema 2. The checker captures both regular-file snapshots under its existing budgets and retains them when pair admission fails. It verifies the version-22 target descriptor, complete transport spans, exact arena extent, unique zero-fill arena/stack ownership and the unchanged separate 64 KiB stack. All mapped file bytes and permissions must match except tunable capacity words and the workspace owner's extent. Stale/mixed layouts, changed code/data, overlapping claims and relocation writes into descriptor/arena/stack bytes fail before the disassembler runs. The obsolete automatic-stack-scratch requirement and redundant prologue-reservation scan are removed. Local frame ceilings remain 8/33/56 KiB in their existing domains; a local stack frame cannot supply workspace evidence. Mapping success assumes the native loader preserves the declared mappings and does not prove source borrowing, erasure, complete typed carving, ordinary-source membership or direct-versus-nested bounds. Unproved indirect targets remain unresolved. All 90 warning-denied checker tests pass, including 17 new independent mapping/CLI controls. Formatting, Markdown and canonical checks pass. Four exact retained runtime/all-feature artifacts with canonical dev/release packaging establish the mapping domain: workspace 4,300,800 bytes, two complete 32 KiB buffers, separate 64 KiB stack. Both local fallback frames are complete at 48 bytes. Full reports remain INCOMPLETE with 691/604 unresolved observations and the original source/direct-path gaps; no full frame pass is claimed. Rust, Cargo and linker source bytes are unchanged from workspace checkpoint `b12e172e7b266842a8659104894f6821166165fb`. Its 961-test strict matrices and eight native builds retain that source scope; the paired replays retain their original ELF hashes. The earlier three diagnostic guest probes also retain their original image/source identities and are not new runtime execution at this checker head. Exsh CI 227/228 fails the remaining full frame gate after all 961 Rust and 90 checker tests pass. All four logs are complete (311,713 bytes) with zero warnings. Both fallbacks are complete at 48 bytes; CI runtime/all graphs retain 662/587 unresolved observations. CI supplies no packaged counterpart, so its workspace mapping domain remains incomplete; the four local paired-artifact results retain their separate scope. The cohort is fully classified without accepting any missing proof. Matching Docs `5d77dc2b82bf5439e58234d901e30f4565aaa81a` is signed and pushed: all 45 tests, the complete warning-free 2,375-page render, 433,924 in-bounds word boxes, literal-option extraction and nine-page visual review pass. Docs CI 887/888 passes with all four complete classified logs (762,236 bytes). Both manual jobs pass 45 tests and converge with 35/1/0 reference warnings, leaving zero final warnings; both Markdown jobs pass. Its issue https://git.erikinkinen.fi/erix/docs/issues/8 records the 24 repaired inline-option/delimiter cases and is closed after complete CI classification. Full frame proof, coherent product admission, realm work and both complete guest build generations remain open. CI packaged-input checkpoint — 15 September 2026: Signed Exsh `453641cd19eaa7c85a8f6693363f8660c792ed73` supplies packaged counterparts in CI. Its helper is pinned to original Integration `db80a2c1dfc669bd724762d476f5f5c0da005ff6`. The actual producer packages separate copies of each optimized runtime/all-feature ELF using both canonical dev/release policies. Packaging has a 60-second deadline, refuses existing outputs and stops the job on failure. Each pristine/packaged pair gets its own complete checker invocation; any unresolved required domain keeps a nonzero status. The exact changed workflow block was replayed against both retained native binaries. All four produced ELF hashes equal the previously independently validated production bytes, workspace mapping is complete, and pristine inputs remain unchanged. The full reports remain incomplete with 691/604 unresolved observations and unproved source/direct-path domains. YAML and shell syntax, 90 checker tests, formatting, Markdown, canonical and pinned dependency checks pass without warnings. Rust, linker and checker source bytes are unchanged, so their earlier strict validation retains its original source scope. Current Exsh CI 229/230 is fully classified: both runs pass 961 Rust and 90 checker tests and all four workspace-mapping domains, but fail the remaining full frame gate. All four complete logs total 314,746 bytes with zero warnings. Runtime/all graph observations remain 662/587 and fallback local frames remain 48 bytes. This resolves the missing packaged-input domain; source membership, non-returning/indirect targets and direct-versus-nested path proof remain open. No full frame proof, product admission or guest build is claimed. Native final mapping design — 15 September 2026: Implement validated RELRO final permissions within the existing native materialization protocol. Loaderd retains authenticated original ELF bytes and original PT_LOAD relocation ranges for Dynlinkd. It separately derives page-bounded final materialization fragments, clearing WRITE on the complete declared protected region. Procd's existing transaction remains the sole owner of privileged construction writes and final mappings; no new control endpoint, capability, lookup root or wire operation is introduced. The child remains unstarted until all bytes and authoritative relocation writes succeed. Validate range arithmetic, mapped coverage and every writable byte sharing a protected hardware page before starting a transaction. Rounded protection must neither leave a declared byte writable nor silently remove write permission from unrelated mutable data. Permit multiple checked regions without a fixed region-count cap and preserve normal images that declare none. Preserve exact file/BSS coverage, load bias, initial writable stack selection, relocation authorization, abort precedence and uncertain-cleanup behavior. Final fragment counting uses checked arithmetic and caller-owned source bytes, without an additional persistent table. Independent tests will cover partial and complete segments, page sharing, adjacent/multiple regions, missing mappings, overflow and mutable-page conflicts. Transaction tests must preserve original relocation ranges while emitting final read-only permissions, apply construction relocations successfully and retain failure/abort behavior. Run strict host/native Rust matrices, the complete existing tests, relevant native VM checks and warning-free manual/CI validation. This establishes final mapping permissions only; typed grant custody, whole-codebase authority closure, exact native frame proof and both complete guest builds remain separate requirements. Specification provenance: the [LSB program-header definition](https://refspecs.linuxfoundation.org/LSB_5.0.0/LSB-Core-generic/LSB-Core-generic/progheader.html) and [GNU linker options](https://sourceware.org/binutils/docs/ld/Options.html) describe the relocation-protected region and hardware page-size constraint. The implementation and fixtures will be original; no external implementation is copied. Native RELRO checkpoint — 16 September 2026: signed `ec353c90590b8b5529f34b43e48b61789c3ac70e` validates protected ranges before effects and derives final read-only child mappings independently of original relocation authorization. Fifteen new independent ELF/handoff controls bring the suite to 105 tests in each of six configurations. Strict host/native Clippy, six native builds, formatting, private rustdoc and canonical Markdown checks pass without warnings. Static replay admits all 34 selected native dynamic artifacts. Existing construction writes, exact counts, authenticated bytes, writable initial stack and failure/abort semantics are retained. Matching native VM, complete current-head CI and the manual update are pending; full frame, realm and guest-build gates stay open. Native RELRO manual — 16 September 2026: signed Docs `2560e70884ddcb1b2f262ef74ea0dd30084d4259` documents protected-page validation, exact final mapping fragments, the writable initial stack and privileged construction writes over an unstarted child. All 45 documentation tests and canonical checks pass. The complete manual has 2,375 pages and 434,088 in-bounds word boxes, with zero final warnings; both changed pages pass visual review. Exported API snapshots are unchanged. Loaderd CI 93/94 passes with all four complete classified logs (109,621 bytes) and zero warnings. Docs CI 889/890 passes with all four complete classified logs (762,216 bytes); both manual jobs pass 45 tests and converge with 35/1/0 reference warnings, leaving zero final warnings. The earlier diagnostic native command sequence passed while its permission observation failed; the subsequent repaired checkpoint below supersedes that scoped result. This checkpoint does not establish complete runtime permission, frame, authority, realm or guest-build acceptance. Native permission checkpoint — 16 September 2026: signed Kernel `32c70109fe7663440aa56de6a49975accc1f0057` carries explicit live execution permission through single-page, batch and permission-only mappings. Data and construction aliases remain non-executable; ancestor promotion and splitting preserve neighbouring restrictions. Processor activation validates and enables execute-disable support on the bootstrap and application processors. Seven independent controls accompany the repair. Strict default/all-feature development/release suites pass 666/690 kernel unit tests plus two external controls per selection, retaining three existing ignores. Host/native Clippy, private rustdoc, formatting and ten native builds pass without warnings. Separate one-CPU and two-CPU diagnostic VMs pass the unchanged native command sequence. A read-only hardware observer matches all 233,755 selected coreutils executable bytes, verifies CPL3 and enabled paging/execute-disable state, and confirms both observed RELRO pages are user-readable, read-only and non-executable; the current stack is user-writable and non-executable. Both processors report execute-disable enabled. This is an exact process-entry/table observation, not an injected instruction-fault test or whole-system permission proof. The diagnostic image SHA-256 is `8c3c24639e8e1ca8c4f2ad4e485323abf32ec07408241c3e4fa9713f6e07e812`. Signed Docs `d221e725c2543316680e63fc5e8314ce0fe3bdf1` documents the mapping and processor contracts. All 45 documentation tests and canonical checks pass; the 2,375-page manual has 434,308 in-bounds word boxes and zero final warnings, with three changed pages visually reviewed. Exported API snapshots are unchanged. Kernel CI 574/575 passes with four complete warning-free logs (708,112 bytes), including existing optimized workload examples. Docs CI 891/892 passes all four complete logs (762,176 bytes), with 45 tests per manual job and zero final warnings. The later maintained permission regression is recorded below. Full frame proof, whole-codebase authority/documentation review, runnable realms and both complete guest build generations remain open. Serial watchdog fixture checkpoint — 16 September 2026: signed Integration `01daadd3d775079a77dd3278f6b07ecbaebe3e84` replaces the two positive host timing schedules with deterministic child/clock schedules around real serial bytes and the actual watchdog loop. All 13 serial and 21 console tests pass with warnings denied. Four independently selected wrong refresh, exact-expiry, marker and status decisions are rejected. The real subprocess refusal cases and production watchdog code/deadlines are unchanged. The strict default/all-feature development/release Rust matrix, host/native Clippy, private rustdoc, formatting and four native builds pass; the unchanged helper inputs retain their prior coverage. [Bug #53](https://git.erikinkinen.fi/erix/integration/issues/53) remains open pending matching CI. The original CI1633 failure and incomplete paired review are retained; neither establishes a guest defect or a historical scheduling cause. Maintained native permission regression design — 16 September 2026: add an explicit-input host runner and read-only hardware observer for a selected native image/ELF. Require selected QEMU, GDB, firmware, acceleration, CPU count, private temporary/evidence roots and recorded byte identities. Use a private Unix debugger endpoint, disable debugger auto-loading, match complete executable bytes at CPL3, and accumulate effective user/write/execute restrictions across the live four-level tables. Verify protected RELRO pages and the writable non-executable stack, plus execute-disable setup on every selected CPU. Continue the unchanged native inherited-stream commands and budgets after observation. Keep both process statuses, bounded cleanup and unchanged source-image checks mandatory. Extract pure ELF/page-table validation for independent malformed/permission-negative controls. Existing failed diagnostic images remain negative evidence. This adds no guest capability or lookup authority and does not replace instruction-fault, full frame, realm or guest-build acceptance. CI activation must use a coherent catalog containing the required Loaderd and Kernel revisions; the older maintained catalog must not be silently replaced or labeled accepted. Maintained permission regression — 16 September 2026: signed Integration `89d15e4536004c087dcebd63c87216c0fd58958d` supplies the explicit-input runner, pure ELF/page-table checks and read-only GDB observer. The final maintained source passes 21 independent host controls and the complete strict default/all-feature development/release Rust matrix, host/native Clippy, private rustdoc, formatting and four native builds. Canonical checks pass after correcting one Markdown line wrap. Both host groups are wired into ordinary CI. All 2,995 inventoried authored code files are below 1,000 lines; this is physical size evidence, not semantic authority closure. Actual one-CPU and two-CPU runs on the repaired diagnostic image pass the original native-time command sequence and the expanded hardware checks: all 58 selected code pages are user-readable, read-only and executable; both RELRO pages are read-only/non-executable; the current stack is writable/non-executable. Complete executable bytes match and NX interpretation is enabled on every selected processor. An earlier image is rejected by the maintained observer. Both child outcomes, exact original input bytes and temporary cleanup are retained, with empty debugger stderr in both positive runs. The final cleanup code also preserves reaping when a direct child exits between poll and termination. The command's image CI gate awaits adoption of a coherent product catalog containing both required component fixes. Its explicit diagnostic invocations do not silently replace the older maintained image graph. Signed Docs `3fb0b12ff55d044cc4bbe142418ab7a5b07bb42d` documents the maintained operator contract. All 45 tests and canonical checks pass; the 2,377-page manual has 434,563 in-bounds word boxes with zero final warnings, and the changed subsection passes visual review. Exported API snapshots are unchanged. The preceding Docs CI result is recorded below; current Integration CI, complete frame proof, whole-codebase authority/documentation closure, runnable realms and both guest-build generations remain open. Protected relative-target checkpoint — 16 September 2026: signed Exsh `a26ecffb39b70abbf15fb300c5c8c703c6900c37` admits exact six-byte RIP-relative calls and tails only after complete relative-relocation, file ownership, protected RELRO page and target-entry checks. It shares the relocation inventory with guarded tables and rejects overlapping or executable-byte writes. Independent controls cover malformed ranges, writable neighbours, different stored words, negative displacements, self-entry loops and tail restoration. All 102 checker tests and all six strict Rust feature/profile configurations pass (961 tests each), together with six native builds, host/native Clippy, formatting and private rustdoc. Runtime Rust, linker scripts and Cargo selections are unchanged. Replaying both unique original pristine/packaged artifact pairs preserves their hashes and all original stack/resource budgets. Runtime/all-feature reports retain 641/591 new call/tail proofs and reach 266/240 functions; unresolved observations fall from 691/604 to 271/232. Workspace mapping passes. Both full reports remain incomplete: unknown indirect control flow, non-returning semantics and source/direct-versus-nested boundaries remain separate obligations. These are partial static admission results, not a complete frame or authority proof. Signed Docs `83b2d4a2dfc473bb8a99719f86fa1c3c33effa53` explains the proof contract and its limits. All 45 documentation tests and canonical checks pass; the 2,377-page manual has 434,680 in-bounds word boxes, zero final warnings and a visually reviewed changed page. API snapshots are unchanged. The preceding Docs permission-observer checkpoint passes CI 893/894 with four complete logs (762,616 bytes) and zero final warnings. Exsh CI 231/232 is fully classified: all 961 Rust tests, 102 checker tests and all four workspace domains pass, with four complete logs totaling 314,760 bytes and zero warnings. Only the complete frame gate fails. Its separately selected CI artifacts report 273/230 unresolved observations; these do not replace the retained local artifact identities/counts. The preceding Docs CI result is recorded below. All 2,997 inventoried authored code files remain below 1,000 lines; semantic authority/documentation closure, product catalog adoption, runnable realms and both complete guest builds remain open. Grounded return-flow checkpoint — 16 September 2026: signed Exsh `4bb35938b52c0e6b20c65ccb861af79871272cbe` derives no-ordinary-return facts from complete checked loop/trap bodies and earlier proved tail targets. Only these grounded exact callees suppress ordinary fallthrough. Calls retain target, depth and relocation evidence, and each fact preserves its original body evidence and earlier dependencies. Final reachability removes stale fallthrough descendants while keeping terminal callee obligations. Unknown calls, unsupported instructions, malformed boundaries and unproved tail cycles cannot establish facts. All 114 checker tests pass, including twelve new literal controls and a 1,200-function chain requiring at most two body visits per function. All six strict Rust feature/profile configurations pass 961 tests each, with six native builds, host/native Clippy, formatting and private rustdoc. Runtime Rust, linker scripts and Cargo selections are unchanged. The physical inventory now covers 2,999 authored code files, all below 1,000 lines. The same retained original artifact pairs yield thirteen grounded facts each. Runtime/all-feature unresolved observations fall from 271/232 to 181/150; every function-end boundary error disappears under the stated ordinary-call model. The work queue performs 347/313 body evaluations for 266/240 discovered functions and retains 263/237 in the final reachable graph. This is an analysis-work count, not a claimed runtime speedup. Remaining observations are 140/111 unknown calls, 40/38 unknown branches and one unsupported instruction per mode. Both workspace mappings pass; whole frame and source domains remain incomplete with unchanged budgets. A separate proof audit verifies earlier dependencies and retained terminal callees. Signed Docs `97ce65dcb8cef7232b50d53af90ff8673d623e05` documents the refinement. All 45 tests and canonical checks pass, and the 2,377-page manual has 434,800 in-bounds word boxes, zero final warnings and a visually reviewed changed page. Exported API snapshots are unchanged. Exsh CI 233/234 is fully classified: 961 Rust tests, all 114 checker tests and four workspace mappings pass, while the full frame gate remains incomplete. All four logs total 314,776 bytes with zero warnings. Those separately selected CI artifacts retain 183/145 unresolved observations, distinct from the retained local pair counts. Matching Docs CI 897/898 passes with all four complete logs across the two terminal observations (762,600 bytes), 45 tests per manual job and zero final warnings. The preceding Docs target-contract checkpoint passes CI 895/896 with four complete logs totaling 762,636 bytes and zero final warnings. Full indirect/source proof, coherent catalog adoption, whole-codebase authority/documentation closure, runnable realms and both full guest-build generations remain open. Exact direction-flag checkpoint — 16 September 2026: signed Exsh `05eeb7bc0b1bf1e6fa781b26ee83a8896263a439` admits operand-free single-byte `FC`/`FD` as stack-neutral direction-flag updates, preserving frame-pointer facts. Mismatched bytes, operands and prefixes refuse. Three original controls bring the full checker group to 117 passing tests, including a growing-stack negative case. Formatting, canonical documentation checks and the 2,999-file physical audit pass. The precise instruction contract is documented in Exsh; the existing manual's ordinary stack model remains applicable. Replaying the same exact artifact pairs now admits each `memmove` frame at eight local bytes and removes its one unsupported-instruction observation. Runtime/all-feature reports retain 180/149 unresolved observations, all unknown indirect calls or branches, with thirteen grounded no-return facts each. Original input hashes and budgets are unchanged; workspace mappings pass and full frame/source domains remain incomplete. Every Rust, Cargo, linker, build and workflow input is byte-identical to the preceding checkpoint's six strict 961-test configurations and six native builds. Those results are retained at their original identity; this checker-only follow-up claims no new Rust or guest execution. Matching Exsh CI 235/236 is fully classified: all 961 Rust tests, 117 checker tests and four workspace domains pass, while the full frame gate remains incomplete. All four complete logs total 314,740 bytes with zero warnings. Those CI artifact identities retain 182/144 unresolved observations, distinct from the local retained pairs. No whole authority, realm or full guest-build acceptance is added. Release-input diagnostic design — 16 September 2026: [foreground interrupt reuse #54](https://git.erikinkinen.fi/erix/integration/issues/54) and [COM1 shell lines #55](https://git.erikinkinen.fi/erix/integration/issues/55) have complete terminal CI logs but unavailable inner artifacts. The original 486 scenario suites pass; the separate release input failures have no demonstrated shared cause. Extend the existing bounded native-input progress formatter for the maintained three-line and physical interrupt/reuse profiles. Render only allowlisted event names and command indices from a complete sequential log prefix. Correlate the original private runner receipt and independently observed wrapper status; for physical VM stall/timeout, retain unknown input status and cleanup-request information rather than claiming injector failure or cleanup success. Read only existing fixed-name files through the retained private directory descriptor, keep current byte/record limits and mutation checks, and print no raw command, guest text, token, path or exception. Diagnostic output cannot change probe success, failure precedence or any original timer. Add original literal positive/malformed/privacy controls, producer-contract checks and real wrapper status tests. Validate the complete changed Integration tree and document the operator interpretation before a signed checkpoint. This improves subsequent evidence; it neither recovers the missing original receipts nor fixes or closes the two underlying regressions. Release-input diagnostic checkpoint — 16 September 2026: signed Integration `df8147dfa437194cd091747fd7147941bd2793c4` adds fixed prefix summaries for shell lines and physical single/repeated interruption. Correlated physical VM-stall/timeout summaries retain unknown input status, failure stage and requested cleanup explicitly. They do not infer injector failure, cleanup success or the next operation's outcome. Only literal event names and bounded scalar fields can be printed; fixed private directory-relative reads, identity checks and original parsing limits remain unchanged. No guest authority, acceptance oracle, error precedence or 120/15/10-second limit changes. All 172 host cases in eleven suites pass, including 28 diagnostic cases and eight new independent producer, malformed-prefix, private-receipt and actual-wrapper controls. The strict default/all-feature development/release matrix passes 320/321 tests per mode, host/native Clippy, four native builds, formatting and private rustdoc without warnings. A documentation line wrap is the only source change after the Rust matrix. One initial negative fixture had identical transport bytes when both exits were unknown; a distinct contradiction replaces it. An initially over-isolated console-suite invocation is corrected to its maintained CI invocation, without changing that suite or the watchdog. Signed Docs `c4bfc12245036f069d178a10183bb1ed15b4aab5` updates the operator manual. All 45 tests, canonical checks and full rendering pass: 2,377 pages, 435,037 in-bounds word boxes, zero final warnings and both changed pages visually reviewed. API snapshots are unchanged. Matching CI is pending. [Release interrupt reuse #54](https://git.erikinkinen.fi/erix/integration/issues/54) and [release COM1 shell lines #55](https://git.erikinkinen.fi/erix/integration/issues/55) remain open: missing original inner artifacts are not recovered, no shared cause is proved, and this checkpoint adds no successful guest run or full guest build. Measured parser checkpoint — 16 September 2026: signed Exsh `ffbe846cbcd0ab6ea12a476c2c84339f635ee50a` compiles the three unchanged disassembly regexes once per input. It retains the exact grammar, instruction bytes, annotations and every disassembly deadline check. Three paired runtime host profiles against signed `05eeb7bc0b1bf1e6fa781b26ee83a8896263a439` reduce regex-cache lookups from 1,142,474 to 570,949; median profiled time falls from 5.088 to 4.214 seconds and complete wall time from 5.311 to 4.425 seconds. These measurements include profiler overhead and subprocess waiting. The 837,947 full matches, 189,680 splits and 375,664 disassembly deadline checks remain identical; they do not measure guest performance. All eight runtime/all-feature observations preserve their original nonzero checker exits and identical complete decision reports. Only checker-source identity and private snapshot path metadata differ. Workspace mappings pass and the same 180/149 unknown indirect observations keep full frame/source admission incomplete. All 117 checker tests, formatting, canonical documentation checks and the 2,999-file physical ceiling audit pass. Every Rust, Cargo, linker, build and workflow input remains byte-identical to the existing six strict 961-test configurations and six native builds; no new Rust or guest execution is claimed. The focused contract documents the measurement and limits; the unchanged manual's stack model remains applicable. Matching Exsh CI 237/238 is fully classified: all 961 Rust tests, 117 checker tests, Markdown and four workspace domains pass; both runs fail the still-incomplete full frame gate. All four complete logs total 314,754 bytes with zero warnings. These CI artifacts retain 182/144 unresolved observations, the same counts as preceding CI and distinct from the local retained artifact pairs. Whole authority, realms and both full guest-build generations remain open. Diagnostic manual CI — 16 September 2026: Docs `c4bfc12245036f069d178a10183bb1ed15b4aab5` passes CI 899/900. All four complete logs total 762,668 bytes; both manual jobs pass 45 tests and produce 2,377 pages with zero final LaTeX warnings. All Markdown checks pass. Integration diagnostic CI 1645/1646 remains queued at its signed head; original release-input bugs 54/55 remain open. Register-target proof design — 16 September 2026: the current runtime/all-feature artifacts retain 180/149 unresolved indirect observations. Six/seven immediately adjacent protected-slot loads are only candidates: textual proximity does not prove every incoming path. Extend the existing finite stack CFG with register facts for all sixteen baseline x86-64 general registers. Entry values are unknown. Exact byte-checked 64-bit RIP-relative loads can acquire a target only from the existing complete immutable relocation/RELRO proof; exact 64-bit register copies carry that evidence. Immediate integers, names, mutable data and stored pointer words supply no target. Join facts only when every incoming path has the same target value, retaining all contributing load sites and protected-slot proofs. Explicit and implicit writes invalidate each affected full-register family, including partial aliases. Unknown effects, system calls and ordinary calls clear facts; no callee-saved convention, returned function pointer or stack spill becomes an unproved preservation premise. Existing probe/dispatch macros conservatively discard register facts until their complete effects are represented. Unsupported instruction/control-flow cases remain incomplete under the existing trusted-decoder and ordinary-call model. Revisit weakened joins and replace stale call/branch evidence; an earlier strong path cannot survive as the only proof after another predecessor loses its value. Exact register-call/tail bytes must agree with the selected register. Preserve call depth, tail restoration, grounded return dependencies, unknown branches and the full source/domain gates. The finite worklist and provenance sets use the caller's original deadlines with no invented iteration or origin-count ceiling. Add independently authored positive, alias/implicit-clobber, bypass, disagreeing/equal-join, loop, stale-edge, call/syscall and source-receipt controls. Replay both original artifact pairs, measure analysis work, update the focused/manual contracts, and validate/sign/push before any adoption. This is original code derived from the [Intel instruction reference](https://www.intel.com/content/www/us/en/developer/articles/technical/intel-sdm.html); it imports no implementation code. Complete guest-image identity, source membership, authority and both full guest-build generations remain separate required work. Protected register checkpoint — 16 September 2026: signed Exsh `da8b75c9063c52de2149f2a6c7ed170f720a6c62` propagates exact full-width protected-slot loads and register copies through the reached CFG. Equal-target joins retain every load origin; unknown or conflicting predecessors, alias/implicit writes, calls/syscalls and unknown effects discard facts. Weakening a join replaces stale edge proof. Complete admitted probe/dispatch effects preserve only unwritten register values. Supported REX forms permit unused bits with byte/text agreement. There is no caller-input, saved-register, spill-word or immediate-address target premise. All 138 checker tests, formatting, canonical document checks and an independent original-byte/load/relocation and earlier no-return dependency audit pass. Retained runtime/all artifact pairs gain 16/18 register edges; the all-feature graph reaches one additional function. Remaining unresolved sites are 164/132, with thirteen grounded no-return facts per mode. Both workspace mappings pass. Full frame/source gates remain incomplete with actual exit 1 and unchanged 60/15-second and 64 MiB budgets. Every Rust/Cargo/linker/build/workflow byte is unchanged from six strict 961-test configurations and six native builds; no new Rust build or guest execution is claimed. Profiling identified unnecessary effect parsing when all registers were unknown. Skipping those identity transfers and compiling fixed effect patterns once preserves every report decision, reducing runtime effect-parser calls from 34,901 to 1,334 and all-feature calls from 33,398 to 1,348. One before/after observation per identical pair measures 5.089 to 4.385 seconds and 4.997 to 4.358 seconds respectively, including observer overhead. These are bounded host work measurements, not a statistical timing guarantee or guest speedup. Signed Docs `4f770bee4c6a4784b4fcce6ae606d1fc10b328da` documents register provenance and limits. All 45 tests and the 2,377-page manual render pass, with 435,231 word boxes inside page bounds, no final warnings and visual review of the changed page. All 3,001 authored code files remain below 1,000 physical lines. Matching Exsh/Docs CI is pending. Complete source domains, authority closure, executable realms and both complete guest-build generations remain open. Continued original CI failures — 16 September 2026: Integration 1636 at `cdf15c52f24bd463dcabdddb945f779fff4ab367` passes all 486 catalog scenarios and earlier native probes, then the development COM1 directory gate fails after command 5 injection. Three complete warning-free logs total 13,307,223 bytes; [bug #56](https://git.erikinkinen.fi/erix/integration/issues/56) preserves its exact status and remaining diagnosis. Paired CI 1635 retains the separate release shell-line failure in [bug #55](https://git.erikinkinen.fi/erix/integration/issues/55); both original runs are terminal, with all six logs retained. Integration 1637 at `38424571b76b36c1e631d99fd2c859fb32311eea` passes 408/486 catalog scenarios and fails 78 during version-22 producer/version-21 catalog-shell preparation. Three complete warning-free logs total 13,031,316 bytes and retain 78 layout refusals. [Bug #57](https://git.erikinkinen.fi/erix/integration/issues/57) tracks coherent adoption after the source/frame/runtime prerequisites. Mixed-layout rejection remains required. The same paired CI 1638 remains live; later queued runs retain their original handles and observation policies. No retry, timer relaxation or full Integration acceptance is claimed. Register checkpoint CI — 16 September 2026: Exsh `da8b75c9063c52de2149f2a6c7ed170f720a6c62` is terminal in CI 239/240. Both runs pass 961 Rust tests, all 138 checker tests, strict warning-denied Rust checks and Markdown. All four paired workspace domains pass in each run. The required full-frame gate remains incomplete, with 168/131 unresolved observations on these CI artifacts, so both runs correctly fail overall. Four complete logs total 314,840 bytes and contain no compiler/lint warnings. These CI artifact observations remain distinct from the retained local pairs. Docs `4f770bee4c6a4784b4fcce6ae606d1fc10b328da` passes CI 901/902. Four complete logs total 762,604 bytes; each manual job passes 45 tests and renders 2,377 pages. Initial reference-resolution warnings clear during the normal three LaTeX passes; final renders have zero warnings. The full source/frame proof, coherent catalog adoption, authority closure and both complete confined guest-build generations remain open. Bounded table checkpoint — 16 September 2026: signed Exsh `efb542a3418badef951d01dff24eec88b8490aee` tracks distinct unsigned bounds, original relative bases, signed table offsets and local targets. Exact constants, self-zeroing and zero extension establish numeric premises. Every selected immutable table byte, matching base addition and candidate instruction boundary must be proved before retaining any successor or branch evidence. Numeric/table values cannot authorize function calls. Joins preserve all alternatives and original premises; unknown predecessors and alias/implicit/call clobbers discard facts. All 157 checker tests pass, including complete 256/65,536-entry domains, nonzero and signed read windows, extended register fields, joins, bypasses, loops, width controls and immutable/boundary refusals. Original-byte function/table/base/index/addition audits, formatting, Markdown and canonical checks pass. Final original runtime/all pairs admit two table branches each and retain 164/132 unresolved obligations: two entry branches resolve, while two newly exposed guard-interior conflicts remain. Both workspace mappings and thirteen grounded no-return facts per mode are retained. Full frame/source status remains incomplete with actual exit 1 and unchanged budgets. Initial partial-set exploration is diagnostic negative evidence, not accepted coverage. Profiling identified repeated compilation of fixed stack patterns. Compiling sixteen unchanged patterns once and sharing the existing padding pattern preserves all report decisions and matching operations. One baseline/optimized observation per original pair reduces runtime/all regex-cache lookups from 651,254/627,530 to 135,274/131,391. Profiled times are 5.994 to 5.445 and 5.756 to 5.179 seconds, including overhead and waiting. These measurements establish reduced host work, not a timing guarantee or guest speedup. The final source has a clarified module docstring and separately reconciled complete replay decisions. Every Rust/Cargo/linker/build/workflow byte retains the existing strict matrix; no new Rust build or guest execution is claimed. Signed Docs `242b78c8f35aeaef879f819c670574a4c1d95c3f` explains complete read windows and target-set admission. All 45 tests and the 2,379-page render pass, with 435,421 word boxes inside page bounds, zero final warnings and visual review of both changed pages. All 3,003 authored code files remain below 1,000 physical lines. Matching CI is pending. Explicit flag/guard refinement, full source/frame proof, coherent catalog adoption, authority closure and both complete confined guest-build generations remain required. Bounded table CI — 16 September 2026: signed Exsh `efb542a3418badef951d01dff24eec88b8490aee` is terminal in CI 241/242. Both runs pass 961 Rust tests, all 157 checker tests, strict warning-denied Rust checks and Markdown. Each run completes all four paired workspace domains. The required full-frame gate remains incomplete with 168/131 unresolved observations on the CI artifacts, so both runs fail overall. Four complete logs total 315,234 bytes, with no compiler/lint warnings. No incomplete proof is treated as acceptance. Signed Docs `242b78c8f35aeaef879f819c670574a4c1d95c3f` passes CI 903/904. All four logs are complete (763,044 bytes); each manual job passes 45 tests and renders 2,379 pages. Initial reference warnings clear in the normal LaTeX passes; final renders have zero warnings. An expanded local source/config inventory additionally checks 685 files, bringing the combined physical ceiling audit to 3,688 files, all below 1,000 lines. Flag/guard refinement, source/frame closure, coherent catalog adoption, complete authority review and both full confined guest-build generations remain required. Ordinary comparison checkpoint — 16 September 2026: signed Exsh `4ed392bcc53cb46d0296cecbdd930c8be5cd7c28` replaces the fixed-register table macro with byte-checked CMP/Jcc facts, live comparison lifetime, unsigned/equality edge refinement and sound producer-width widening. A 32-bit comparison never zeroes upper bits. Every complete immutable target set remains mandatory, and numeric/table values cannot authorize function calls. Unknown predecessors, relevant flag/subject writes and unmodeled effects discard conditions. The obsolete dispatch report field is removed. All 176 checker tests pass, including an independent exhaustive interval oracle, high-register dispatch, sign extension, bypasses, conflicting/unknown joins, stale proofs, complete table arms and large arithmetic loops. Independent original-byte audits check 354/321 comparison edges, eleven table branches per mode, protected function loads and thirteen earlier grounded no-return facts per mode. Original runtime/all pairs reach 271/246 functions and retain 158/126 unresolved observations, down from 164/132. Workspace domains pass; full frame/source status remains incomplete with actual exit 1 and unchanged budgets. The audit also reproduces and fixes [terminal-call discovery loss](https://git.erikinkinen.fi/erix/exsh/issues/6). A prior successor diagnostic no longer suppresses recomputation of a revisited call. Three independent controls retain grounded no-return, returning and unknown-target behavior. Original byte/range inspection corrects earlier descriptions of two guard-interior conflicts: these were fallthrough exactly at declared function ends. Padding remains outside those functions; callee names never supply no-return proof. Matching CI remains required before closing the defect. Profiling identified repeated decoder-effect work. Sharing immutable effects only within one function-body analysis reduces runtime/all effect decoding from 72,668/69,784 to 34,499/32,576 and operand parsing from 75,637/72,547 to 37,468/35,339. Complete paired decisions remain identical. Final single paired profiled observations are 6.633 to 6.425 and 6.416 to 6.269 seconds, including overhead and waiting. The final baseline overlaps host test execution, and earlier pairs show timing variability; these diagnostic durations do not isolate a speedup. This establishes reduced host work, not a timing guarantee or guest speedup. Every Rust/Cargo/linker/build/workflow byte retains the existing strict six-configuration 961-test matrix and six native builds. Formatting, Markdown and canonical checks pass. Signed Docs `d8fbc3a1f3696e02954b81f23511cee513ddfa8c` passes all 45 tests and complete 2,379-page rendering: 435,637 in-bounds word boxes, zero final warnings and two visually reviewed pages. The physical audit covers 3,005 authored code files below 1,000 lines. Matching CI is pending. Remaining indirect calls/branches, full source/direct-versus-nested proof, coherent catalog adoption, complete realm authority and both full confined guest-build generations remain required. Comparison checkpoint CI — 16 September 2026: [Exsh CI 243](https://git.erikinkinen.fi/erix/exsh/actions/runs/243) and [244](https://git.erikinkinen.fi/erix/exsh/actions/runs/244) are terminal. All four complete logs total 314,904 bytes with no compiler/lint warnings. Strict Rust checks, 961 Rust tests, 176 checker tests, Markdown and all four workspace domains per run pass. The required full-frame gate remains failed with 163/126 unresolved observations on these CI artifacts; their identities are distinct from the original static replay pairs. No full frame or guest-build acceptance is claimed. [Docs CI 905](https://git.erikinkinen.fi/erix/docs/actions/runs/905) and [906](https://git.erikinkinen.fi/erix/docs/actions/runs/906) pass with all four complete logs (763,056 bytes), 45 tests and 2,379-page manuals. Both final renders have zero warnings after ordinary reference convergence. The terminal-call discovery controls pass in both Exsh runs, resolving the scoped defect in [Exsh #6](https://git.erikinkinen.fi/erix/exsh/issues/6) while the complete emitted-proof defect stays open. The current physical audit covers 3,690 authored source/config files below 1,000 lines; semantic authority and complete private documentation closure remain required. Original unfinished Integration jobs continue under their existing handles. Arithmetic evidence checkpoint — 16 September 2026: signed Exsh `0cdaa8869545308c528f9cf5a2dc165cb286c6ef` and Docs `07181c34b1a20150afe3380977ca5ba70c909b84` are pushed on `feature/posix-compat`. Immediate ADD/SUB now retains exact modular result pieces and derives unsigned/equality edges from carry/borrow and zero. Defined INC/DEC writes establish widths without preserving a stale combined flag condition. Full 64-bit comparisons may use the architectural numeric domain while keeping protected typed identities separate; narrow comparisons still require independent upper-bit proof. Known encoding/text contradictions remain explicit flow errors. All 191 checker tests pass, including independent exhaustive concrete arithmetic and modular-interval oracles, wraparound and authority-negative controls. Original runtime/all artifact pairs admit fifteen table branches each and reach 271/246 functions, with 156/124 unresolved observations. Both workspace mappings pass; actual full-frame exits remain 1 and full source/direct domains remain incomplete. Independent original-byte audits check arithmetic/conditional/table premises, 16/18 protected register edges and thirteen grounded no-return facts per pair. Profiling identified repeated stack-neutral grammar evaluation. A cache scoped to one function reduces those evaluations from 95,643 to 43,169 for runtime and 92,608 to 41,053 for all features, with complete paired report decisions equal. Cached values include refusals and contain no path facts. Timing observations include observer overhead and do not isolate a statistical speedup or guest performance. Formatting, Markdown, whitespace and all 45 Docs tests pass. The 2,379-page manual has 435,808 in-bounds word boxes, zero final warnings and visual review of the changed pages. The physical inventory covers 3,691 authored source/configuration files, all below 1,000 lines. Semantic authority and complete private rustdoc closure remain open. Rust/Cargo/linker/build/workflow bytes are unchanged from the retained strict matrix and classified CI 243/244; new [Exsh CI 245](https://git.erikinkinen.fi/erix/exsh/actions/runs/245)/[246](https://git.erikinkinen.fi/erix/exsh/actions/runs/246) independently reruns those checks. [Docs CI 907](https://git.erikinkinen.fi/erix/docs/actions/runs/907)/[908](https://git.erikinkinen.fi/erix/docs/actions/runs/908) also runs. Matching CI is pending, and no full confined guest build or coherent product-catalog adoption is claimed. Test-import correction and CI classification — 16 September 2026: original Exsh CI 245/246 failed before the frame gate because the arithmetic test could not import its checker module. They attempted 177 tests: 176 passed and one module import failed. The preceding 961 Rust tests and strict build stages passed; all four complete logs total 309,708 bytes with zero compiler/lint warnings. The earlier local 191-test pass used an explicitly supplied PYTHONPATH and did not prove equivalence to the clean workflow. This regression is retained in [Exsh #7](https://git.erikinkinen.fi/erix/exsh/issues/7). Signed correction `12331e26f3bb7a25c0146c8b314eef46dd451099` loads the repository's literal fixture setup before implementation imports in both affected modules. A new regression imports every checker test module in a fresh isolated interpreter; it reproduces both failures before correction and passes afterward. The exact clean workflow command now passes all 192 tests without PYTHONPATH. Formatting, Markdown and whitespace pass. Checker/runtime/Cargo/workflow bytes are unchanged, so the prior original-artifact and profiler evidence retains its exact scope. New [CI 247](https://git.erikinkinen.fi/erix/exsh/actions/runs/247)/[248](https://git.erikinkinen.fi/erix/exsh/actions/runs/248) runs against the corrected source; issue #7 remains open pending matching CI. Docs CI 907/908 now passes with four complete logs totaling 763,024 bytes, all 45 tests and 2,379-page manuals. Both final renders have zero warnings after ordinary reference convergence. Full frame/source proof, coherent catalog adoption and complete confined guest builds remain outstanding. Corrected arithmetic checkpoint CI — 16 September 2026: [Exsh CI 247](https://git.erikinkinen.fi/erix/exsh/actions/runs/247) and [248](https://git.erikinkinen.fi/erix/exsh/actions/runs/248) at signed `12331e26f3bb7a25c0146c8b314eef46dd451099` both pass all 192 checker tests, including the ten isolated module imports, and all 961 Rust tests. The preceding strict formatting/Clippy/documentation/build stages and Markdown pass. All four complete logs total 314,944 bytes with zero compiler/lint warning candidates. This confirms the scoped import correction in [Exsh #7](https://git.erikinkinen.fi/erix/exsh/issues/7). Both runs reach and fail the required full-frame gate. All four workspace mappings per run pass, while the emitted CI pairs retain unresolved counts [161, 161, 124, 124]; these artifacts are distinct from the original static pairs' 156/124 observations. Full source/direct domains remain incomplete, and [Exsh #4](https://git.erikinkinen.fi/erix/exsh/issues/4) remains open. The original import-failed runs 245/246 stay classified and are not relabeled as passing. Docs CI 907/908 passes all 45 tests and 2,379-page manuals with zero final warnings; four complete logs total 763,024 bytes. Signed trees are clean, canonical issue/PR metadata remains applied, and the 3,691-file physical inventory remains below 1,000 lines per authored source/configuration file. Semantic authority and private documentation closure, coherent catalog adoption, runnable realms and both full confined guest build generations remain outstanding. Original unfinished Integration runs continue under their existing handles and budgets. Grounded call-preservation checkpoint — 16 September 2026: signed Exsh `641ac2fc7c3fba3ab351f2863df7e35117b2732a` and Docs `7a7c3ff0095de8f008c9b534fd993554df37f976` are pushed on `feature/posix-compat`. Complete original bodies and earlier callee facts now prove never-written register families. Only existing typed values survive proved calls; live conditions clear. The separate stack-derived rbp fact follows the same rule. This corrects [the reproduced stale-frame defect](https://git.erikinkinen.fi/erix/exsh/issues/8), which stays open pending matching CI. ABI conventions, spill restoration and current kernel behavior supply no preservation mask. All 213 clean-environment checker tests pass, including 21 new controls, eleven isolated module imports and a 1,200-function grounded dependency chain. All six strict Rust feature/profile configurations pass 961 tests each, with host/native Clippy, private rustdoc and six native builds; no warnings. Original runtime/all artifact pairs retain 65/72 protected register edges and 70/77 load origins, reducing unresolved observations from 156/124 to 107/70. Both workspace mappings pass; full source/frame/direct gates retain actual exit 1. Independent audits bind 7,795/7,503 used-contract instructions and complete earlier-proof closure to the original captured bytes. Profiling identified unnecessary empty-state scans and rejected-body suffix work. Removing them preserves every paired report decision and reduces total profiled Python calls from 32,160,478 to 26,673,252 and from 30,880,221 to 25,402,446. Single paired timings include observer overhead; they do not establish statistical or guest performance. Original timer, byte and stack budgets remain unchanged. All 45 Docs tests, formatting, Markdown and canonical checks pass. The 2,379-page manual has 436,058 in-bounds word boxes, zero final warnings and visual review of both changed pages. The physical audit covers 3,693 source/configuration files, all below 1,000 lines. Semantic authority/private-documentation closure, product adoption, complete source/frame admission, runnable realms and both full in-EriX build generations remain open. Automatic CI for both exact signed heads is being followed; local passes are not reported as CI acceptance. Matching preservation CI — 16 September 2026: [Exsh 249](https://git.erikinkinen.fi/erix/exsh/actions/runs/249) and [250](https://git.erikinkinen.fi/erix/exsh/actions/runs/250) are fully classified at `641ac2fc7c3fba3ab351f2863df7e35117b2732a`. Both pass all 213 checker tests, including eleven isolated imports and the stale-frame controls, all 961 Rust tests and preceding strict host/native Clippy, rustdoc and native build stages. Markdown and all four workspace mappings per run pass. The remaining full frame gate fails as required; original CI artifact observations are [[111, 111, 74, 74], [111, 111, 74, 74]]. All four complete logs total 314,995 bytes without warnings. The independently retained local pairs remain 107/70, with their own original identities. [Docs 909](https://git.erikinkinen.fi/erix/docs/actions/runs/909) and [910](https://git.erikinkinen.fi/erix/docs/actions/runs/910) pass at `7a7c3ff0095de8f008c9b534fd993554df37f976`. All four complete logs total 763,088 bytes; both manual jobs pass 45 tests and render 2,379 pages with zero final warnings after ordinary reference convergence. The corrected frame-pointer issue is closed on this matching evidence; the full source/frame issue remains open. No full confined build, runnable realm or coherent product-catalog adoption is established. Matching native intake CI — 16 September 2026: [Exsh 251](https://git.erikinkinen.fi/erix/exsh/actions/runs/251) and [252](https://git.erikinkinen.fi/erix/exsh/actions/runs/252) are fully classified at `d67dcb963f1aa265b13dd0609a5f8488784b5822`. Both pass 231 checker tests, twelve isolated imports, 961 Rust tests and the strict preceding Clippy/rustdoc/native build stages. All four workspace mappings per run and Markdown pass. The required full frame gate remains incomplete; the CI artifact counts are 111/111/74/74 unresolved observations in each run. Four complete logs total 315,371 bytes, with zero warnings. Retained local standalone and native artifacts keep their own separate identities and 107/70/299 counts. [Docs 911](https://git.erikinkinen.fi/erix/docs/actions/runs/911) and [912](https://git.erikinkinen.fi/erix/docs/actions/runs/912) pass at `12c6d0a91e5e9c5f170d6d0aa7f050dd60e883ef`. Four complete logs total 763,452 bytes; each manual job passes 45 tests and renders 2,381 pages, with ordinary reference convergence followed by zero final warnings. No full source/frame proof, native dependency closure, runnable confined realm or full EriX-in-EriX build is established. A separate original-source relocation calculation defect is now reproduced and tracked with the canonical bug template in [lib-dynlink #2](https://git.erikinkinen.fi/erix/lib-dynlink/issues/2). Its two host failures do not imply a guest regression. All 107 symbol-only relocations in the seven retained native artifacts have zero addends; the supported nonzero-field case still requires correction before broader native binding admission. Release-baseline planning acceptance — 16 September 2026: the existing [signed release policy](https://git.erikinkinen.fi/erix/docs/src/commit/214b08666b8b36ad4270bcfee3b3379d8dc08a79/policies/release-engineering.md) identifies `1.0.0-alpha.1` with OS self-hosting, defines the platform/component version relationship and retains all pre-alpha components at `0.1.0`. A fresh read of all 74 tracked Cargo manifests confirms `0.1.0`. [Canonical contribution policy](https://git.erikinkinen.fi/erix/docs/src/commit/214b08666b8b36ad4270bcfee3b3379d8dc08a79/CONTRIBUTING.md) keeps release review and approval separate from development progress. This accepts recording the target and version policy only. Runtime acceptance, two complete guest builds, release readiness, merging, tagging and publication remain separate requirements; no release action was performed. Matching closed dependency intake CI — 16 September 2026: [Exsh 253](https://git.erikinkinen.fi/erix/exsh/actions/runs/253) and [254](https://git.erikinkinen.fi/erix/exsh/actions/runs/254), exact `9827896d1cb5ad834589045ee03390aec650df84`, pass 259 checker controls, 16 isolated imports, 961 Rust tests and the strict preceding build/Clippy/rustdoc stages. All four workspace domains per run and Markdown pass. The required full frame gate remains incomplete, with 111/111/74/74 unresolved observations in each CI artifact set. Four complete logs total 315,052 bytes and contain zero warnings. Original local runtime/all/native replays retain separate input identities and 107/70/299 counts. [Docs 915](https://git.erikinkinen.fi/erix/docs/actions/runs/915) and [916](https://git.erikinkinen.fi/erix/docs/actions/runs/916), exact `88537b23e1def210eeff40b7ef90fce92fe2009e`, pass 45 tests and complete 2,383-page renders. Four complete logs total 763,918 bytes. Reference convergence is 35/1/0 warnings across the three TeX passes, with zero final warnings. Both cohorts are classified without rerunning jobs or changing their budgets. The seven-object native dependency inventory is now checked; symbolic providers, ordered runtime binding, cross-object frames and source membership remain incomplete. No runnable realm, coherent product adoption or complete in-EriX build is established. Remaining original CI results — 17 September 2026: permission [CI 1644](https://git.erikinkinen.fi/erix/integration/actions/runs/1644), exact `89d15e4536004c087dcebd63c87216c0fd58958d`, finishes with 408 passing and 78 known layout refusals. Release-input [CI 1645](https://git.erikinkinen.fi/erix/integration/actions/runs/1645), exact `df8147dfa437194cd091747fd7147941bd2793c4`, finishes with 405 passes and 81 failures: those 78 layout refusals, the original quota timeout, and new 120-second FAT32 mirrored/Unicode timeouts. Paired [CI 1646](https://git.erikinkinen.fi/erix/integration/actions/runs/1646), at the same source revision, records 408 passes and only the 78 layout refusals. The separate FAT32 observations are tracked with the canonical bug template in [#58](https://git.erikinkinen.fi/erix/integration/issues/58); a common cause with quota is not established. All nine terminal logs are complete, totaling 40,256,559 bytes with zero warning candidates; host/Rust/Markdown checks pass. Original artifact APIs expose no images or inner receipts. Both formerly pending cohorts are fully classified, with their original failures retained. No run was restarted, no limit was increased and no complete product or guest-build acceptance is asserted. Ordered native symbol evidence — 17 September 2026: signed Exsh `469bf1f1b9d8301cf98a79d16c7c27660ecda2a1` enforces root-first depth-first discovery order and positional DT_NEEDED agreement, indexes exact strong/weak providers and preserves object-qualified relative function identities. Duplicate strong definitions fail; missing weak symbols remain zero data. S-only relocations ignore addends, while S+A must retain an exact original executable entry. Names confer no file reads and no load bias is invented. All 276 checker tests, 17 isolated modules and six strict Rust configurations (961 tests each) pass, including host/native Clippy, rustdoc and six warning-free native builds. Independent original-byte inventory matches all 117 symbolic records: 112 exact function identities and five refused data targets. Provider indexing/reporting takes approximately 16 ms in the captured native profile. Original standalone runtime/all/native replays preserve 107/70/299 unresolved observations and actual exit 1 under unchanged budgets. This is conditional relative identity evidence only: load-base arithmetic, protected slots, cross-object calls/frames and source membership remain incomplete. Signed Docs `24cefeb2dc6d3f163140d32f5fed5a7e1a768ebd` updates the manual contract. All 45 documentation tests pass; the complete 2,383-page render has 436,737 in-bounds word boxes, zero final warnings and visual review of pages 2284–2285. The physical audit covers 3,706 source/configuration files, all below 1,000 lines. No runtime Rust, dependency, linker or workflow inputs changed. New host/CLI controls cover the analyzer behavior; no new guest feature is asserted. Exsh CI 255/256 is terminal: unit/strict/workspace stages pass, and the required full-frame gate remains incomplete. Docs CI 917/918 passes. Acceptance remains 15/459 leaves, 3.48% weighted. Both full in-EriX builds and the complete semantic authority audit remain open. Ordered-provider automatic CI classification — 17 September 2026: Exsh 255/256 at `469bf1f1b9d8301cf98a79d16c7c27660ecda2a1` passes 961 Rust tests, the combined 276-test checker suite, strict preceding stages and all four workspace domains per run. The required full-frame gate fails with 111/111/74/74 unresolved observations per run. Four complete logs total 315,035 bytes with zero warnings. The 17 separate module executions are local evidence; CI uses combined test discovery. Docs 917/918 at `24cefeb2dc6d3f163140d32f5fed5a7e1a768ebd` passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,878 bytes. Reference-resolution passes produce 35/1/0 warnings; final output has zero warnings and no layout overflow. Original API snapshots remain unchanged. Both cohorts are fully classified, without restarting workflows or changing thresholds. Original Integration layout, quota and FAT32 failures remain open, including #58 in Integration. Acceptance remains 15/459 leaves, 3.48% weighted. Complete native source/frame proof, a runnable realm, the full semantic authority audit and both full in-EriX builds remain required. Protected cross-object frame evidence — 17 September 2026: signed Exsh `ac9646c84e432129a872737789a9be08f984b881` composes the seven explicitly selected native objects using protected relative/symbolic slots and object-qualified function identities. Local control-flow offsets cannot alias a foreign function or transfer the root fallback role. Register facts, grounded preservation/no-return dependencies and route accounting retain the selected object. Every captured decode shares the original output/time budgets; a late failure rejects the invocation. Native reports use schema 3; standalone schema 2 and input schema 1 remain unchanged. All 299 checker tests and 20 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, rustdoc and six warning-free native builds; formatting and Markdown checks pass. Original runtime/all replays retain 107/70 unresolved observations. The composed native graph reaches 275 functions with 111 unresolved observations; all three actual checker exits remain 1. Native slots assume successful checked linking and unchanged disjoint mappings. Actual load bases, complete source/frame acceptance and coherent runtime adoption remain open. Profiling identified redundant root-only analysis in native mode. Removing it preserved every composed decision while one profile changed from 41.52 to 25.81 seconds and 64.37M to 39.61M calls. This host profile pair includes observer overhead and gives no general or guest timing guarantee. The final source replay also preserves every decision; three register-proof records now correctly identify symbolic load provenance. Signed Docs `44cd6c4aa95bebfa08c99804fab0f1551f537ae1` specifies the contract. All 45 documentation tests pass; the complete 2,383-page manual has 436,894 in-bounds word boxes, zero final warnings and visual review of the changed page. All 3,713 inventoried source/configuration files are below 1,000 lines. The broader documentation audit retains 108 unchanged older test definitions needing inline docstrings; current production and all new/modified definitions are documented. Runtime Rust, dependency, linker and workflow inputs are unchanged; added behavior has host and real CLI regressions, with no new guest runtime feature asserted. Original Exsh CI 257/258 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 919/920 passes. Both cohorts are fully classified. Both full builds inside EriX and complete semantic authority acceptance remain open. Cross-object checkpoint CI classification — 17 September 2026: Exsh 257/258 at `ac9646c84e432129a872737789a9be08f984b881` passes 961 Rust tests, the combined 299-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery also checks isolated module imports; the 20 separate module-suite executions are additional local evidence. The required full-frame gate fails with 111/111/74/74 unresolved observations on the four original CI artifact selections. Four complete logs total 315,180 bytes with zero warnings. Those CI selections remain distinct from the retained seven-object native replay. Docs 919/920 at `44cd6c4aa95bebfa08c99804fab0f1551f537ae1` passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,906 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required. Saved-value preservation evidence — 17 September 2026: signed Exsh `8b6b93a329757ae7f106e235761912b58a67deff` derives incoming-register equality through exact full-width copies and owned live stack slots. Original byte decoders bind register, width and address forms. Partial or unknown aliases, conflicting paths, deallocation and reuse invalidate saved facts. Entry tokens carry equality only; they never supply a pointer or call target. A separate earlier callee contract must prove private stack writes before caller slots survive a call. Checked signed bounds and finite dependency order prevent wrapped offsets and recursive assumptions from granting evidence. All 329 checker tests and 22 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, rustdoc and six warning-free native builds; formatting and Markdown checks pass. Independent eager scheduling controls agree with both filtered worklist orders. Original runtime/all/native replays retain 107/70/111 unresolved observations and actual checker exit 1. The native graph still reaches 275 functions. The startup iterator's unknown pointer writes remain a refusal; complete source/frame and runtime acceptance remain open. Two initial native profiles exhausted the original 60-second budget and produced empty reports; both failures are retained. Immutable decode caches, retirement of exhausted equality state, fact-sensitive wakeups and dependency-first scheduling brought the final native replay within the unchanged budget: 57.45 seconds wall time, 53.94 profiled seconds and 72.27M calls. All 2,373 bodies are inspected once. This bounds one retained host replay and makes no general speedup or guest timing claim. Report schemas and original source, stack, byte and time gates are unchanged. Signed Docs `c3401e5f6bbc19a0ba695219ed551e29a29677ed` specifies the contract. All 45 documentation tests pass; the complete 2,383-page manual has 436,968 in-bounds word boxes, zero final warnings and visual review of both changed continuation pages. All 3,717 inventoried source/configuration files are below 1,000 lines. The touched preservation tests now document 21 older methods; 87 unchanged older test definitions remain in the inline documentation audit. Current production and all new/modified definitions are documented. Runtime Rust, dependency, linker and workflow inputs are unchanged; no new guest runtime feature is asserted. Original Exsh CI 259/260 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 921/922 passes. Both cohorts are fully classified. Both full builds inside EriX and complete semantic authority acceptance remain open. Saved-value checkpoint CI classification — 17 September 2026: Exsh 259/260 at `8b6b93a329757ae7f106e235761912b58a67deff` passes 961 Rust tests, the combined 329-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery checks isolated module imports; the 22 separate module-suite executions are additional local evidence. The required full-frame gate fails with 111/111/74/74 unresolved observations on its four original CI artifact selections. Four complete logs total 315,234 bytes with zero warnings. These CI selections remain distinct from the retained seven-object native replay. Docs 921/922 at `c3401e5f6bbc19a0ba695219ed551e29a29677ed` passes 45 tests and the complete 2,383-page manual. Four complete logs total 763,958 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required. Caller-bound stack preservation — 17 September 2026: signed Exsh `e7ba974e96ee77a41c6a861150da843d4c84c7d6` binds formal GP arguments to independently proved live caller stack intervals. Exact callee write spans preserve return-address gaps and invalidate every overlapping save. Scoped masks never enter the unconditional function index; loaded words, unknown contents, released storage and recursive assumptions supply no binding. Byte-checked SETcc writes exactly one unknown byte. All 355 checker tests and 23 separately executed module suites pass. Six strict Rust configurations pass 961 tests each, host/native Clippy, private rustdoc and six warning-free native builds. Formatting, templates and Markdown pass. Original runtime/all/native replays retain 97/60/97 unresolved observations and actual exit 1. The native graph reaches 275 functions; the startup iterator now has caller-bound preservation for its exact live buffers. Complete source/frame and runtime acceptance remain open. Profiling exposed repeated failed argument specializations. Mandatory opaque-prefix refusals, conservative GP demand and rejection-only control candidates avoid unnecessary interpretations without changing the original 60-second limit. Candidate records cannot become proofs, and incompatible fact kinds defer to actual interpretation: losing pointer identity can enable numeric refinement. Positive and negative controls compare filtered and eager behavior. Each CFG site has at most one pending visit and later changes still enqueue it without an iteration cap; every native proof decision agrees with the prior queue. The final ordinary native replay takes 39.80 seconds. Complete tracing still exhausted the original deadline; failures and empty reports are retained. A separately identified selective profile measures only caller-context analysis: the complete invocation takes 56.59 seconds, with 26.92 profiled seconds in that scope. Instrumentation preserves the complete proof result. Different profiling scopes are not timing comparisons, and no guest performance claim is made. The replay selects 367 instances, evaluates 587 bodies, proves 190 and defers 51 candidate bodies for incompatible domains. Signed Docs `fc3ee44748c20a3aa6f55bd85ac1913c707e5d4e` specifies these contracts. All 45 documentation tests pass. The complete 2,385-page manual has 437,275 in-bounds word boxes, zero final warnings and visual review of the changed pages. All 3,721 inventoried source/configuration files are below 1,000 lines. All new/modified definitions are documented; 87 unchanged older test definitions remain in the audit. Runtime Rust, dependencies, linker and workflow inputs are unchanged. Original Exsh CI 261/262 passes unit/strict/workspace stages and retains the required full-frame failure; Docs CI 923/924 passes. Both cohorts are fully classified. Complete semantic authority acceptance, coherent runtime adoption and both full builds inside EriX remain required. Caller-bound checkpoint CI classification — 17 September 2026: Exsh 261/262 at `e7ba974e96ee77a41c6a861150da843d4c84c7d6` passes 961 Rust tests, the combined 355-test checker suite, strict preceding stages and four workspace domains per run. Combined discovery checks isolated module imports; the 23 separate module-suite executions are additional local evidence. The required full-frame gate fails with 101/101/64/64 unresolved observations on its four original CI artifact selections. Four complete logs total 315,210 bytes with zero warnings. These CI selections remain distinct from the retained seven-object native replay. Docs 923/924 at `fc3ee44748c20a3aa6f55bd85ac1913c707e5d4e` passes 45 tests and the complete 2,385-page manual. Four complete logs total 764,350 bytes; reference-resolution passes have 35/1/0 warnings, with zero final warnings or layout overflow. Both automatic cohorts are fully classified without workflow restarts or threshold changes. Existing Integration layout, quota and FAT32 regressions remain open. Full native source/frame acceptance, coherent runtime adoption, the semantic authority audit and both full builds inside EriX remain required. Caller-local query diagnostic selection — 17 September 2026: update the isolated lifetime/invocation catalog to one coherent original 15-repository dependency graph and the signed query kernel. Preserve ordinary image selections, all earlier native assertions and the 60-second scenario deadline. The invocation program adds fifteen actual CPL3 queries with private stack and saved-register checks; the lifetime scenario supplies independent regression coverage. The strict kernel matrix is complete; matching-image runtime evidence and automatic CI classification remain required. Caller-local query checkpoint — 17 September 2026: signed Integration `75ebaa21e65542d5b553c1264f6e28c48ede0a44` carries the caller-selected component catalog into launch metadata and registry construction. Absent Exsh, Coreutils and Extop artifacts require no launch catalog; present artifacts retain capacity and missing-metadata checks. Seven new controls cover alternate and absent inputs. The isolated diagnostic catalog selects Kernel `e15a045d7701030e58d9e59517406f8c79694ff8` and a coherent original 15-repository graph; ordinary image selections remain independent. All 165 helper commands pass. Four strict Rust matrices pass 320 default or 321 all-feature tests, formatting, Clippy, native builds and private rustdoc. Matching query/invocation and lifetime VMs pass under unchanged 60-second deadlines without warnings. The original packaging refusal is retained in integration issue 59 and the initial canary failure in kernel issue 16. Automatic Integration runs 1647/1648 are being monitored; no full-suite or full guest-build acceptance is claimed while their original outcomes are pending. Explicit entry-state checkpoint — 17 September 2026: signed Integration `110caecccf21ed7ae4ab66449c58c985f4c74695` adds the explicit entry-direction wrapper mode and native UD2 scenario, plus a workflow policy check. Its isolated catalog selects signed Kernel `d4a8921fa8530419c3d9790b80ff3c601217906d` through the coherent original component graph. Ordinary image selections remain independent. All 166 helper commands and four strict Rust matrices pass, with 320 default or 321 all-feature tests, formatting, Clippy, native builds and private rustdoc. The standard wrapper passes invocation, entry-direction and lifetime VMs without build warnings under their unchanged 60-second deadlines and exact marker/exit requirements. Original automatic [CI 1649](https://git.erikinkinen.fi/erix/integration/actions/runs/1649) and [CI 1650](https://git.erikinkinen.fi/erix/integration/actions/runs/1650) are being monitored. Earlier runs 1647/1648 remain separately monitored; no complete-suite or full guest-build acceptance is claimed while those outcomes are pending. Original Integration regression classification — 17 September 2026: Original runs 1647–1650 are fully classified. Runs 1648, 1649 and 1650 each pass 408 of 486 scenarios and fail the same 78 known shell-layout refusals in [issue 57](https://git.erikinkinen.fi/erix/integration/issues/57). Run 1647 passes 407 and additionally repeats the existing ext4 quota timeout in [issue 18](https://git.erikinkinen.fi/erix/integration/issues/18). All twelve complete terminal logs total 52,533,051 bytes and contain no warnings. Rust and Markdown jobs pass. No additional failed scenario is identified; the complete catalogs remain failed. The separate local automatic-KVM preboot observation is tracked in [issue 60](https://git.erikinkinen.fi/erix/integration/issues/60). Entry-frame and complete fixture checkpoint — 17 September 2026: Signed `fa86d1b64f8e1299c0ee0c886e6f1b35d58ea15b` adds exact callee-stack checks to both exception frame shapes and selects Kernel 829b949 through the isolated original diagnostic graph. Invocation, lifetime, UD2 and double-fault standard-wrapper VMs pass with warning-free images and unchanged 60-second gates. Original current-head CI 1651/1652 passes Rust/Markdown and is still running full VM suites. Earlier 1647–1650 are fully classified with the known layout/quota failures; issue #59 is closed for catalog packaging only. The separate KVM preboot observation in #60 and both full guest builds remain open. Original CI reconciliation — 17 September 2026: CI 1651/1652 at `fa86d1b64f8e1299c0ee0c886e6f1b35d58ea15b` retains full-catalog failure. All six logs are complete, 27,230,062 bytes, zero warnings; Rust/Markdown pass. Both runs retain 78 layout refusals and the quota timeout. PR CI 1652 also retains the named idle-time-resolution timeout in #61, while original push CI 1651 passes that scenario. Totals are 407/79 and 406/80 of 486. No unchanged retry, increased deadline or accepted full guest build is claimed. Runtime archive checkpoint — 17 September 2026, signed `77921a7d97874e3f44aae66ae9bef6e6196af2f5`: Eight selector controls pass, including four original refusal subcases that fail against the predecessor. All 167 helper commands and four strict Rust configurations pass (320 default/321 all-feature tests), with formatting, Clippy, freestanding builds and private rustdoc. Both original 60-second native invocation/lifetime scenarios pass; their Kernel bytes match the earlier signed diagnostics. A separate retained-graph host package performs 38 fresh native links and reproduces its original Kernel ELF before and after stripping. These are host builds and bounded native regressions, not a complete guest build. Original automatic CI monitoring is pending; no earlier failed workflow is restarted. Linker selection checkpoint — 17 September 2026, signed `bc0e67f927ded76dd3ff5790180a7bded0886885`: Thirteen focused controls pass, including real bundled-LLD linking and warning refusal. All 168 helper commands, four strict 320/321-unit configurations, freestanding builds, formatting, Clippy and private rustdoc pass. Both original 60-second native VMs pass and preserve earlier signed Kernel bytes. A retained older graph packages through 38 fresh native links with fatal linker warnings and reproduces its original Kernel ELF. An interleaved host cProfile comparison retains twelve identical shared ELFs and verifies elimination of one compiler query per standalone link; no guest or whole-build speedup is claimed. Original automatic CI remains pending. Complete compiler-source admission, ordinary runtime adoption and both full guest builds remain open. Compiler metadata checkpoint — 17 September 2026, signed `56e035d46a11dc803d654bf2151e484fab307682`: Fourteen focused controls and all 169 helper commands pass, including actual cache-key mutation coverage. Four strict 320/321-unit configurations, freestanding builds, formatting, Clippy and private rustdoc pass. Both original 60-second native VMs pass with unchanged signed diagnostic Kernel bytes. A retained older graph packages through 38 fresh native links and reproduces its original Kernel and six provider metadata/shared-object pairs. That host diagnostic retains the older deployment adapters with only the new cache-input declaration; complete current adapters have separate helper and native VM coverage. Earlier incomplete/mismatched diagnostic overlays remain recorded failures. Original automatic CI remains pending. Complete compiler-source admission, ordinary runtime adoption and both full guest builds remain open. Coordinated terminal observation checkpoint — 17 September 2026: Signed revision `0db8a679f5d1acb50d9ff92e003cec91f145dfc8` is pushed. The isolated catalog selects the signed generation-bearing Kernel graph. Both original 60-second native gates pass with reviewed unstripped/packaged artifacts and fifteen clean component checkouts. Four strict Rust configurations and all 169 helper commands pass; the old marker assertion was corrected to require the added generation marker. Rootd orchestration selects the same immutable shared revisions. Typed mediator bootstrap, ordinary service-image adoption and both complete EriX builds inside EriX remain open. Original archive-head CI 1653/1654 is fully classified with 406/486 passing in each run; layout and filesystem timeout failures remain in #18, #20 and #57. The bounded archive-selection repair #62 is closed on its specific evidence. Current CI 1659/1660 remains under observation without restarts. Generation-bound cleanup consumer acceptance — 18 September 2026: Signed revision `4d4628f565d7102e6ef2987e4085fd8d97d247d3` is pushed. All 169 helpers and four strict 320/321-unit Rust matrices pass. Both actual 60-second native scenarios pass, including nineteen new CPL3 cleanup calls and the mandatory GENERATION_CLEANUP_OK marker. All earlier lifetime oracles remain required, and normally stripped packaged Kernels match their original builds. Both original CI 1661/1662 runs remain under observation. The ordinary service catalog is unchanged; ordinary source/effect/frame admission remains open. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain open. Caller-local grant relocation checkpoint — 18 September 2026: Signed `8e66e54c86d93f257b6051da0381ff8cdc84fe2f` selects Kernel `56d398e077c140c58e23f9cc2d8b79f19bc4cc2f` and its coherent signed shared dependencies for the isolated native diagnostics. All 169 helpers, four strict 320/321-unit Rust matrices, formatting, strict Clippy, rustdoc and both actual native VMs pass without warnings. The lifetime scenario requires thirty-nine additional real CPL3 relocation controls before the original installation, revocation, terminal, inventory, queue and page oracles, with the original 60-second bound. Packaged artifacts reproduce the build outputs and all fifteen original component signatures are verified. Original CI 1663/1664 is waiting. Ordinary service source/effect and frame admission, actual owned consumer execution and both full guest builds remain separate open gates. Explicit owned receiver admission acceptance — 18 September 2026: Signed `435e69a9840b37108529e5f9f9915937a12bafc9`. The isolated native catalog selects the signed receiver-budget Kernel and coherent dependencies. All 169 helpers, four strict 320/321-unit Rust matrices and both actual native VMs pass without warnings. The owned scenario requires the receiver-admission marker before its final ownership marker; all prior lifetime and ordinary source/effect/frame gates remain intact. The existing profiler validates 48 current-source native sample processes. Costs still grow with retained populations and remain follow-up work. The changed registration fixture has a different workload hash, so no cross-source speedup comparison is admitted. Direct-native timings do not measure the separately removed packet descriptor allocation. Original CI is under observation. Actual owned Procd/Launchd service adoption, consumer VM execution, complete realm fairness/readiness/sealing and both full builds inside EriX remain open. Original Integration catalog completion — 18 September 2026: At exact revision `0db8a679f5d1acb50d9ff92e003cec91f145dfc8`, [CI 1659](https://git.erikinkinen.fi/erix/integration/actions/runs/1659) finishes with 396 passes and 90 failures out of 486; [CI 1660](https://git.erikinkinen.fi/erix/integration/actions/runs/1660) finishes with 393 passes and 93 failures. Each retains the 78 known Exsh layout refusals. The remaining 12 and 15 failures are original 120-second QEMU storage-scenario timeouts. All six terminal logs are complete (36,570,659 bytes), with zero warning candidates. Rust/unit and Markdown jobs pass. No workflow was restarted, no deadline was enlarged and no failed scenario is accepted. A shared guest or host cause is unestablished. Caller-bound realm admission and retained storage contract — 18 September 2026 Use distinct Launchd operations BEGIN_REALM 0x6D0, PREPARE_REALM 0x6D1, ABORT_REALM 0x6D2 and READ_REALM 0x6D3. The existing 0x6B0–0x6BF range belongs to filesystem providers and is not reused. Little-endian bodies are exact, with nonzero request correlation and no fallback to ordinary launch transactions. BEGIN_REALM is an authority-free 8-byte request (request ID, operation). Derive session, authority realm, original process/generation and Running job from the actual native pending caller. Reserve an independently budgeted realm record, a nonwrapping generation and one disjoint executable-scope receipt slot before replying. Client numeric identities or a bearer sender cannot select ownership. PREPARE_REALM has a 32-byte prefix: request ID and operation (u32), realm record ID and generation (u64 each), and selector byte length (u64), followed by exactly that nonempty UTF-8 selector without NUL. Parsing adds no pathname or packet-size ceiling. The request carries exactly one actual SEND-only directory endpoint to the reserved receipt slot. Verify the original caller/job/session/authority realm again and retire every unretained received capability on refusal. Resolve only inside this explicit directory, authenticate the exact executable and manifest, and call Loaderd's existing private PREPARE_REALM. Never imply a Posixd pathname, Named route, root, cwd, TTY stream, ordinary job or public PreparedProcess input. ABORT_REALM and READ_REALM are authority-free 24-byte requests: request ID, operation and complete realm-record ID/generation. They require the same original Running native owner. READ observes retained state only; ABORT must complete independent source, invocation and exact-child retirement before its successful acknowledgment. Parent terminality initiates the same retained cleanup internally. All four operations have an exact 40-byte capability-free response: request ID, operation, raw result and state (u32 each), record ID and generation (u64 each), receipt slot and zero reserved word (u32 each). States are Unconfirmed=0, Reserved=1, Preparing=2, Guarded=3, Retiring=4 and Retired=5. Success at BEGIN requires Reserved, a nonzero complete handle and receipt slot. PREPARE success requires Guarded; ABORT success requires Retired. READ returns an authenticated nonzero state. Only successful BEGIN returns a receipt slot; every other result has zero there. Failure always has Unconfirmed state; failed BEGIN has a zero handle while other failures echo the original complete request handle. Unknown nonzero result codes remain full-width. Unconfirmed proves no resource absence. Correlate the complete response with the original request before using evidence. Replace obsolete LCH1 v2 with exact 72-byte version3 startup policy. Preserve the first 68-byte field order and append realm_capacity (u32 at offset68). Require an explicit deployment value: zero disables new realm reservations, and nonzero values allocate that many retained records and disjoint receipt slots. Validate checked job-route + stream-route + realm-receipt arithmetic before leaving any ordinary transaction receipt storage. No default or incidental fixed array sets realm count. Coordinate shared startup codecs, Rootd payloads, Launchd arena and Integration policy/packaging; old version/width must reject. Extend the native capacity descriptor with the realm record's size/alignment and a new layout version; do not assume ordinary reply records survive long enough for realms. Keep original child, local scope/grant obligations and native invocation owners independent. Actual scheduler progress must exclude ordinary and indirect blocking peer calls while any native invocation needs progress. A permanently discharged source slot is never revisited after reuse. Native release precedes ordinary exact-child abort; preserve first errors and exhaust independent cleanup without returning uncertain state to normal operation. Guarded staging remains private and unstarted, without exported SEND or a Running job. This initial admission interface does not define configuration, readiness, sealing or publication. Coordinated host negatives, strict source-bound build matrices and real consumer VM execution are required. Two mediator processes, two clients per realm with actual mediated I/O, complete fair progress, source/effect/frame admission and both full builds inside EriX remain separate open acceptance requirements. Original generation-cleanup catalog completion — 18 September 2026: At exact revision `4d4628f565d7102e6ef2987e4085fd8d97d247d3`, [CI 1661](https://git.erikinkinen.fi/erix/integration/actions/runs/1661) and [CI 1662](https://git.erikinkinen.fi/erix/integration/actions/runs/1662) each finish with 408 passes and 78 failures out of 486. The exact failed set is the 78 known Exsh layout refusals. There are no storage timeout failures in these two observations; earlier timeout failures remain unresolved. All six terminal logs are complete (26,074,278 bytes), with zero warning candidates. Rust/unit and Markdown jobs pass. No workflow was restarted, no deadline was enlarged and no failed scenario is accepted. Original realm contract library prerequisite — 18 September 2026: Signed `ad85421257b7d964845fd4b84931966ad36cc122` selects the original bootstrap, capability and IPC revisions in Rootd orchestration. Only the Cargo dependency selection is published; Rust implementation and image policy remain unchanged in this commit. Four strict default/all development/release configurations pass 320/321 tests, host/native Clippy, native builds, formatting and private rustdoc without warnings. Compiler inputs contain no unpublished image-consumer changes. [CI 1667](https://git.erikinkinen.fi/erix/integration/actions/runs/1667) and [CI 1668](https://git.erikinkinen.fi/erix/integration/actions/runs/1668) are queued. Rootd can now pin this real original prerequisite before coordinated startup/image publication. Consumer VMs and both complete builds inside EriX remain required. Older CI 1663/1664 remains failed with 78 known layout refusals and one quota timeout per run; existing issues #57 and #18 retain the complete original evidence. Coherent startup consumer acceptance — 18 September 2026: Signed Integration `8b1c037aed2503e1f2a4b17c8a8be0666d62a305` adopts exact 72-byte LCH1 version 3, explicit realm capacity and version-6 compiler-derived arena geometry across runtime profiles, wire/configuration boundaries and image packaging. Zero realm capacity disables admission while preserving native alignment; realm receipts remain separate from ordinary intake. Both catalogs retain their memberships and select one original 74-source union following 41 coordinated producer updates. The maintained 73-component source-policy gate passes. All 169 helpers and four strict 320/321-unit Rust configurations pass, including formatting, host/native Clippy, native builds and private rustdoc. Both actual consumer VMs pass their unchanged 120-second bounds: Launchd loads from ext4 and reaches ordered readiness; the initial shell prints its banner and exits successfully. Signed appliances, artifact and serial evidence are retained with zero build/VM warnings. Post-VM writable disk identity is recorded separately from the packaging checksum. Original Integration CI is under observation. Full source/effect/frame admission, complete realm operation and both full builds inside EriX remain required. Explicit zero-realm startup acceptance — 19 September 2026: Signed Integration `c479813423fb71c606fa30e5cf7d4dfb16f557d0` adds the bounded startup scenario using the existing explicit standard CLI policy. The actual VM passes the unchanged 120-second ceiling and ordered readiness checks; its signed image contains zero realm capacity in the exact 72-byte version-3 record, matching the version-6 native arena of 3,104,768 bytes. Eight route/capacity controls and four strict 320/321-unit Rust configurations pass, including fmt, host/native Clippy, native builds and private rustdoc. The original 169-helper run retains one physical-directory fixture timeout. The fixture now selects the probe’s existing ten-second command budget and has deterministic expiry controls; all four affected suites pass (9, 5, 5 and 7 tests), with unaffected source bytes verified unchanged. The original failure remains in [bug 63](https://git.erikinkinen.fi/erix/integration/issues/63). Build and validation streams contain no warnings. Original CI 1671/1672 is running. This proves ordinary startup with admission disabled; complete realm execution, source/effect/frame admission and both full builds inside EriX remain required. Original coherent-graph CI classification — 19 September 2026: [CI 1669](https://git.erikinkinen.fi/erix/integration/actions/runs/1669) records 485 passes/1 failure; [CI 1670](https://git.erikinkinen.fi/erix/integration/actions/runs/1670) records 484 passes/2 failures, each across all 486 scenarios at `8b1c037aed2503e1f2a4b17c8a8be0666d62a305`. Both retain the original 120-second ext4 quota timeout in [bug 18](https://git.erikinkinen.fi/erix/integration/issues/18); the latter also fails physical input observation in the exact-selector race scenario, now [bug 64](https://git.erikinkinen.fi/erix/integration/issues/64). That scenario explicitly passes in the paired run. All six terminal logs are complete (27,557,577 bytes), with no warning candidates; Rust and Markdown pass. No incompatible shell-layout refusal remains. The layout issue’s full source/frame prerequisites and later native-image gates remain unproved. Neither workflow was rerun, and no deadline or admission check was relaxed. ## Tracking and rollout The [Phase 6 master completion checklist](https://git.erikinkinen.fi/erix/integration/issues/65) tracks all 460 acceptance items, including supplementary requirements, section weights, current acceptance, owning issues and PRs. Update it alongside this record whenever scope, accepted evidence, regressions or CI disposition changes. Current accepted completion is 15 items, 3.48% weighted; both complete builds inside EriX remain required. ### Coordinated library dependency update — 15 September 2026 Signed `2a16b1a7ac5514a43582025e5b9ba0a2f2ce2a29` aligns existing dependency pins with the original foundation commits for coherent runtime adoption. This update changes Cargo selections and the roadmap; Rust implementation files in this repository are unchanged. All default/all-feature development/release configurations pass 320 default / 321 all-feature tests, strict host/native Clippy, formatting, four native builds and private rustdoc without warnings. Final canonical documentation checks pass. Component CI is being monitored. The product catalog remains unchanged; this update does not establish a new runtime VM, authority-lifecycle closure, performance result or guest build. All 162 workflow helper commands pass with retained original source identities and complete warning-free outputs. Full Integration CI is being monitored separately; earlier native-image serial-check failures remain open in issue #46. Review: https://git.erikinkinen.fi/erix/integration/pulls/12. ### Library dependency wave accepted — 15 September 2026 Eight more libraries now have signed dependency checkpoints and complete classified push/review CI: lib-block, lib-bootimg, lib-capabi, lib-driver, lib-stdio, lib-time, lib-tty and lib-vfs. Their strict default/all development/release matrices pass 22, 63, 192, 2, 21, 23, 12 and 6 tests respectively, plus host/native Clippy, 32 native builds, formatting and private rustdoc, with no warnings. Five missing WIP reviews were created with docs/enhancement/phase-6 metadata; existing reviews retain their scope and labels. Final roadmap checks correct the CapABI pin and remove superseded time-library dependency notes. The next layer includes runtime helpers, Kernel, build tools and command consumers. The product catalog and product VM acceptance remain pending. ### First runtime dependency wave — 15 September 2026 Five signed dependency checkpoints now pass their complete applicable local matrices and classified push/review CI: lib-ed25519 (46 tests), lib-fs-crypto (15), lib-partition (11), lib-ipc (381 plus 20 syscall-shim tests and one existing native-only ignore), and the host sha2-tool (12). Their Rust implementation files are unchanged. Four missing WIP reviews were created with applicable docs/enhancement/phase-6 metadata; the existing shared IPC review retains its metadata. The product catalog is unchanged. Eight library dependents form the next pin-propagation wave before service adoption and actual product VM validation. Neither current runtime execution nor a complete guest build is claimed. ### Coherent runtime source adoption — 15 September 2026 The product runtime catalog still selects the earlier source graph. Adopt the current original signed sources as one coherent graph before claiming product execution of the new kernel invocation, mediator construction and Procd caller-admission contracts. The frozen inventory covers 73 catalog components and 72 tracked Cargo manifests; 54 components need direct pin alignment, with further propagation after dependency commits are published. Align dependency selections bottom-up, preserve original Git objects, and validate every altered repository under its supported strict configurations before signing and publishing its dependency commit. Full commit selectors remain mandatory. Unrelated work is preserved, and no synthetic replacement object or rewritten published history supplies build evidence. Update the runtime catalog only once all selected Cargo manifests and original metadata agree. Run actual product images covering authenticated Launchd activity and the relevant lifecycle/authority regressions, adding negative caller controls where needed. Keep complete warning-free build/test/image evidence and monitor existing CI. Significant regressions use the canonical bug report format. Dependency alignment alone does not prove runtime authority closure, mediator execution, performance improvement or either complete guest build generation. Typed grant return and guarded bootstrap remain the next realm implementation boundaries. ### Native caller admission checkpoint — 15 September 2026 Signed Procd `c583614aa48f3e11a3ccabfeee06340f518de750` now checks the actual pending native caller on Launchd ingress against its retained running Launchd process and stage generation before operation-specific receipt validation or dispatch. Forwarded SEND aliases, request-body identities, other lifecycle roles, reused generations and unavailable identity cannot acquire this dispatch permission. Other receivers retain their policy; rejected delivered transfers still undergo local disposal, and uncertain disposal stops ordinary continuation. Five new producer controls exercise accepted event dispatch and refusals without consuming the private event. The complete strict host/native development/release matrix passes: 239 default-feature tests, 244 all-feature tests, Clippy, rustdoc, formatting and forty native binary builds, with no warnings. The changed runtime-loop fragment is formatted by the repository formatter; its other code matches the formatted original outside the reviewed admission replacement. Signed documentation `45d4d04c534f2ebca857ee203265232fd7c32bbe` passes 45 tests and a frozen 2,375-page manual with 433,469 in-bounds word boxes and no final warnings. Page 212 was visually reviewed. The receiver inventory also corrects the existing powerbox omission and obsolete loader operation count. Shared API snapshots are unchanged. Procd CI 274/275 and Docs CI 879/880 pass with complete classified logs and no final warnings. Both component cohorts are complete. Product runtime-image validation still requires a coherent original-commit dependency graph; this checkpoint does not claim a new Procd VM. Actual returned-grant custody, guarded bootstrap, readiness/configuration/seal, mediated client byte I/O, fair retirement and both complete guest build generations remain open. ### Validated mediator constructor adoption — 15 September 2026 Procd selects checked native operation 54 only for mediator staging, without a parent VSpace receipt. The native TCB retains backing; the child initially holds only its primary endpoint. Other roles retain ordinary construction and its existing receipt/drop sequence. A refusal never falls back to operation 32. Scratch absence cleanup, exact stage retirement, private endpoint-master custody, grant-only handoff and all ordinary mediator start gates remain in place. Producer implementation is signed at Procd `3d9fe97bb66ea82442728ef8a10b998d7159a9ba`. Procd passes 55 focused materialization controls and 234/239 default/all tests, strict host/native Clippy, rustdoc, formatting and forty freestanding builds across ten binaries. Exact requests, omitted receipt/drop, materialization, refusal without fallback and unchanged ordinary behavior are covered. CI 272/273 passes with complete warning-free logs. The previously accepted Kernel 6d2ca19c native fixture establishes the constructor object, root-absence and backing contract. This checkpoint adds producer transport controls; it does not claim a new Procd CPL3 VM, runtime-image adoption or runnable realm. Integration source and native VM inputs are unchanged. The manual is signed at Docs `8b30523f3d7e1c300f39e3418a8748dae10ec04f`; all 45 tests, final warning-free rendering and CI 877/878 pass. Runtime-image adoption, authenticated grant return, guarded bootstrap routes, private execution, receiver readiness, configuration/seal, client I/O, fair retirement and both full guest build generations remain open. Whole-codebase semantic authority and private-item documentation audits remain incomplete. ### Mediator constructor adoption — 15 September 2026 Procd will select checked native operation 54 only for the mediator lifecycle class, with no parent VSpace receipt. Native TCB custody retains the mapped backing. Ordinary roles retain operation 32 and its existing receipt/drop sequence. Scratch absence cleanup, complete failed-stage retirement, grant-only handoff, retained endpoint master and all ordinary mediator start gates remain required. A refusal of operation 54 must never fall back to operation 32. Extract the materialization constructor and test transport before adding coverage so each code file remains below 1,000 lines. Verify the exact constructor request, omitted receipt and drop, ordinary behavior, refused construction without fallback, materialization and final cleanup. Existing native construction evidence remains the authority/object proof; producer transport doubles do not establish a running mediator. Shared pins will select signed IPC `7c7712057cc5d16ab16a677a886caeac54814a16` and capability ABI `2d6b12832b3f0d798756a9c7f29a7c52a8b3bc70` through the existing dependency graph. Authenticated grant return, guarded bootstrap routes, private execution, readiness, configuration/seal, fair retirement and both complete guest build generations remain open. ### Construction without child root capabilities — 15 September 2026 Select the signed native construction graph and require actual root-capability-free construction and complete disposal in the existing lifetime VM oracle. Signed original revision: `9e607330da7a87a2a6cd84e76cb667387faab1e2`. All 162 workflow helper commands and strict Rust default/all development/release checks pass, including 320/321 tests and profiler regressions. Both native VMs pass with actual exit status zero, clean owned teardown and empty QEMU stderr. The lifetime program adds fourteen actual CPL3 construction/attenuation/disposal calls while retaining its earlier thirteen installation and fifteen ordinary construction calls. All required markers occur once in order. Full Integration CI remains separate from local acceptance. Procd adoption, authenticated grant return, guarded bootstrap authority, private mediator execution, readiness, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase semantic authority and private-item documentation audits remain incomplete. ### Staged endpoint attenuation checkpoint — 15 September 2026 The native catalog selects signed Kernel `d690eda817e56b515a278bdbb5ea6c5aedeb431b`, IPC `74c75a5db226413c066b6582210a44cb21d968d8` and capability ABI `2a01c205701e5f976503b82742e1de54d3fbe950`. The lifetime fixture retains thirteen installation and seven constructor/disposal calls, adding eight actual CPL3 staged endpoint attenuation calls. The new ordered, unique STAGED_ENDPOINT_ATTENUATION_OK marker requires actual returned identity, exact rights, refusal and complete cleanup. The separate owned-invocation oracle is unchanged. Integration `2d6f830e84b561090fd6288bf26db0cce3b1b05a` passes all 162 workflow helper commands and the fresh strict 320/321-test default/all development/release Rust matrix, formatting, Clippy, warning-denied native builds and private rustdoc. Both actual native VMs pass with empty QEMU stderr and clean teardown. Source byte checks bind both executions to the published tree. Full Integration CI 1629/1630 is waiting at its first bounded observation; pending runs are not passes. Authenticated grant return, independently minimal root/bootstrap authority, retained native and nested guards, private execution, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates stay closed. Full semantic authority and inline-documentation audits remain incomplete; no new performance or guest-build claim is made. Current Integration `4b65755f1f2774798d4a909212db4e64c0349b86` finishes with failed [push CI 1603](https://git.erikinkinen.fi/erix/integration/actions/runs/1603) and [PR CI 1604](https://git.erikinkinen.fi/erix/integration/actions/runs/1604). Each complete catalog reports 54 passes and 432 failures out of 486 scenarios. Six full terminal logs total 14,427,322 bytes, with no warning candidates. Both Rust and Markdown jobs pass. The later isolated native diagnostic, canonical images and terminal modes are not reached by these runs. [Issue 50](https://git.erikinkinen.fi/erix/integration/issues/50) tracks the observed shared-compiler regression: valid dependency-qualified Rootd selections are rejected as unknown local features. A minimal original-manifest check confirms the failure. The correction separates compiler cfg ownership and adds direct, transitive, malformed and real-compiler coverage; its full local checks are underway. Original failures remain retained, and these terminal runs are not being replayed unchanged. Earlier isolated native VM acceptance retains its separate exact source and artifact scope. Signed Integration `4b65755f1f2774798d4a909212db4e64c0349b86` adds the isolated native lifetime scenario and corrects standalone kernel service selection, target-scoped cache identity and original-manifest feature closure. The redundant feature implication table is removed and the shared resolver joins the builder fingerprint. The normal component catalog remains independently selected. The strict development/release default/all-feature Rust matrix passes 320/321 units, doctests, private rustdoc and freestanding builds; missing documentation remains denied. All 159 helper suites are accepted across the complete run and justified follow-ups: installed filesystem-tool routes and actual stage tracing, serialization after the real VM releases the global scenario lock, and declaration of the compiler fixture's selected feature. Original failures and actual statuses remain retained; assertions and production deadlines are unchanged. The actual native VM passes both ordered unique markers, expected exit and forbidden-marker checks using signed Kernel `03e13a784bde08914864267a4e2a6324a22d05c7` and Bootloader `e7fa39357a38c21529cccfd16cf3446eb07e8aa5`. The 2,142,208-byte image has SHA256 `4f021a40264739fef4979da2b0cd4647bde3f76b9dada6816aba6faa3594a797`; QEMU stderr is empty. Complete preparation and execution takes 19.20 seconds under the unchanged 60/45-second VM limits, not a guest performance measurement. Kernel CI 528/529 and Bootloader CI 135/136 are green. Integration CI 1603/1604 is running; older suite and complete current-head acceptance remain pending. Realm adoption and both full guest build generations are unproved. Dependencies: [meta#2](https://git.erikinkinen.fi/erix/meta/issues/2) Dependencies identify required contracts and closure gates; preparatory inventory/design can proceed in parallel under one owner per edited file. Link bounded implementation issues and their PRs here before claiming acceptance. Use `feature/posix-compat`, regular signed commits in the canonical contribution format, and WIP PRs linked to the exact coherent component graph. All cross-repository Cargo/catalog selections and CI helpers use full 40-character lowercase commit hashes, including transitive dependencies; do not substitute branch, tag or implicit HEAD selection. Close criteria only with their own reviewed deliverables and validation evidence. Pending, skipped, cancelled, failed or predecessor-only results remain distinct. Keep main images unchanged until explicit promotion direction; technical completion does not authorize merges, release tags or publication. Native diagnostic observation — 19 September 2026: the first actual caller VM fails before its required success marker. Exsh exits 0xe5, Rootd exits 0xdc and the unchanged progress watchdog stops QEMU. [Integration issue 66](https://git.erikinkinen.fi/erix/integration/issues/66) records exact reproduction and retained appliance/log identities. All 169 Integration helpers and four strict Rust configurations pass; this does not establish native execution. Request/error telemetry through the existing stdout route is under validation. No cause, weakened gate or completion credit is inferred. Signed reproducer — 19 September 2026: Integration `76411ed6d96356b20ee0a4c21ad219dacc56340d` publishes the explicit scenario and selector. With the documented image signing inputs, run `bash scripts/run-scenario.sh tests/scenarios/appliance-disk-image-realm-admission-positive.toml components.toml`. The original failed runtime uses the same scenario, implementation and component graph; only roadmap status changed after validation. Its VM result remains FAIL. All 169 helpers and four strict Rust configurations pass without warnings. Original [CI 1673](https://git.erikinkinen.fi/erix/integration/actions/runs/1673) and [1674](https://git.erikinkinen.fi/erix/integration/actions/runs/1674) are queued. [Issue 66](https://git.erikinkinen.fi/erix/integration/issues/66) retains the failure. No acceptance credit or complete realm execution is claimed. Original CI observation — 19 September 2026: [CI 1671](https://git.erikinkinen.fi/erix/integration/actions/runs/1671) finishes with 471 passes/16 failures and [CI 1672](https://git.erikinkinen.fi/erix/integration/actions/runs/1672) with 465 passes/22 failures across all 487 scenarios at `c479813423fb71c606fa30e5cf7d4dfb16f557d0`. Every failed scenario is an ext3/ext4 positive filesystem case reporting `error: qemu timed out after 120s`, with scenario status 1. The existing [filesystem deadline report](https://git.erikinkinen.fi/erix/integration/issues/20) retains the expanded matrix; [quota issue 18](https://git.erikinkinen.fi/erix/integration/issues/18) applies to the quota failure in 1672. All six complete logs are hashed (41,592,478 bytes), with zero warning candidates. Rust, Markdown and the full helper step pass. The zero-realm startup and exact-selector race scenarios explicitly pass in both runs. No common cause, source regression boundary or performance diagnosis is inferred; all actual deadlines and failure statuses remain unchanged, and neither workflow was rerun. Corrected native caller VM — 19 September 2026: signed Integration `9139c6c5fa38c139e92520f6d410626b4cf1e4aa` selects Launchd `ca9e7f534e26023a6c011b5cb9a8e256fd56c2d6`, Exsh `9c0f7ab851d527dd9dd10161d6a98e1fdc14598e` and Docs `ce8a1538ab2220f1b346e1a051265f58f83f47fc`. The actual VM passes all eleven admission calls over the shell's existing private script route: reservation, reads, full-width stale-generation rejection, missing-scope refusal, acknowledged retirement, record reuse and stale-abort rejection. Exactly one `ERIX_EXSH:REALM_ADMISSION:VERIFIED` precedes `ERIX_ROOTD:INITIAL_EXSH:EXITED_OK`. The original 120-second hard limit and 45-second progress watchdog are unchanged; scenario status is 0 and no build warning is present. All 106 actual appliance artifacts and complete logs are retained. The 55,738-byte serial log has SHA256 `bbf41401e975cb0b39c6d62ca32f8e612f4f751a505a7dbb113fe1f05c6415f7`; the post-VM writable disk has SHA256 `8f7faf83e8923de675bf5d030458f7bf7e8065dc4fdb95ec98714dfebc5f7938`. The earlier packaging checksum is retained separately. Independent review verifies all 73 original component revisions, the packaged diagnostic executable and the signed image's exact 72-byte LCH1 version-3 capacity record (four realm records; native arena 102,400 bytes). All 169 helper commands, twelve route/scenario controls and four strict 320/321-test Rust configurations pass, including native builds, fmt, strict host/native Clippy and private rustdoc; all 394 host streams are warning-free. Both failed predecessor images remain evidence in [issue 66](https://git.erikinkinen.fi/erix/integration/issues/66). The first BEGIN failed because the shell's private script intake lacked realm dispatch. The correction retains active-envelope and original native-owner checks and original reply custody, without delegating a new sender. Exsh's uncertain-disposal path makes no stdout IPC before terminal failure. Original [Integration CI 1675](https://git.erikinkinen.fi/erix/integration/actions/runs/1675) and [1676](https://git.erikinkinen.fi/erix/integration/actions/runs/1676) are queued. Successful preparation, mediator configuration/readiness/sealing, client byte I/O, complete source/effect/frame proof, native Rust/LLVM rebuilding and both full EriX builds remain required. This partial lifecycle acceptance adds no whole checklist item. Next native validation — 19 September 2026: add an opt-in Exsh guarded-preparation diagnostic using the existing realm ABI. Keep the passing eleven-call admission-only scenario separate. The new diagnostic will reserve a record, transfer exactly one SEND-only copy of its explicitly supplied startup cwd to the BEGIN-reserved receipt slot, select `bin/true` within that initial root scope, require PREPARE/Guarded and READ/Guarded, then require ABORT/Retired and a stale READ/NOT_FOUND. The packaged native `true` executable is an unstarted staging fixture; it does not stand in for a running POSIX mediator. The existing authenticated private Launchd route remains the sole request path. No ordinary start, new endpoint, root capability or implicit namespace is introduced. Launchd must retire its received directory copy after exact resolution; Loaderd must return the original staged child and grant, and Procd must retain the actual returned grant and guarded sender branch before acknowledging Guarded. Abort must retire that exact stage and retained custody. Error telemetry must preserve application refusal codes and stop ordinary output after uncertain receipt disposal. Independent host controls will cover literal operation order, transfer scope/rights, full correlation, missing or malformed acknowledgments, surplus receipts and no continuation after failure. The new actual VM retains the 120-second hard and 45-second progress limits and requires its own unique marker before ordinary shell exit. Full source/effect/frame proof, configured/sealed mediator execution, real client byte I/O, native Rust/LLVM rebuilding and both full EriX builds remain required. Native guarded preparation — 19 September 2026: signed Integration `78557a6c672ecf426dfe894a01cc4aeec73b5e3c` selects signed Exsh `ffe50612889dd58a45a40d04593a4aa3a3ffa512` for the separate `appliance-disk-image-realm-preparation-positive` scenario. The actual VM passes the eleven existing admission calls followed by BEGIN/Reserved, PREPARE/Guarded, READ/Guarded, ABORT/Retired and stale READ/NOT_FOUND. It transfers exactly one SEND-only copy of the explicitly supplied initial cwd to the authenticated reservation and selects `bin/true` inside that scope. This packaged executable remains an unstarted staging fixture. The existing private Launchd route is reused; no new endpoint, root grant or implicit namespace is introduced. Exactly one admission marker and one `ERIX_EXSH:REALM_PREPARATION:VERIFIED` precede ordinary successful initial-shell exit. The original 120-second hard deadline and 45-second progress watchdog remain unchanged; scenario status is zero and build warnings are absent. The separate admission-only scenario is preserved. All 106 actual appliance artifacts and complete logs are retained. Serial SHA256 is `7ef35833c2d88abcd093c8813791e11cea0d34edb2e29b8686df6996e2bc32ff` (55,776 bytes); post-VM writable disk SHA256 is `3439d0750ea456ceb8d9fbb063d6af763b4198a85f0270ae8d22c76c6ff99499`. Its earlier packaging checksum is retained separately. Independent artifact review verifies all 73 original component revisions, both diagnostic markers in the actual packaged executable, and the signed image's exact 72-byte LCH1 version-3 configuration with four realm records and a 102,400-byte native arena. All 169 Integration helper commands, seventeen route/scenario controls and four strict 320/321-test Rust configurations pass, including native builds, fmt, strict host/native Clippy and private rustdoc; all 394 host streams are warning-free. The post-validation source delta changes only the two Exsh catalog pins and final documentation status, preserving checked implementation bytes. Exsh passes ten strict 976-test configurations, ten native builds and 355 frame-checker controls without warnings. Eight actual frame observations retain complete workspace mapping but incomplete 97/63/100/100 runtime/all/admission/preparation proof in both policies; the full frame gate remains required. Original [Integration CI 1677](https://git.erikinkinen.fi/erix/integration/actions/runs/1677) and [1678](https://git.erikinkinen.fi/erix/integration/actions/runs/1678) are queued. Original [Exsh CI 271](https://git.erikinkinen.fi/erix/exsh/actions/runs/271) and [272](https://git.erikinkinen.fi/erix/exsh/actions/runs/272) are under observation. Complete typed mediator bootstrap, readiness/configuration/sealing, real client byte I/O, complete source/effect/frame proof, native upstream Rust/LLVM rebuilding and both full EriX build generations remain required. This prerequisite adds no accepted whole checklist item. Original guarded-preparation CI — 19 September 2026: [Exsh run 271](https://git.erikinkinen.fi/erix/exsh/actions/runs/271) and [272](https://git.erikinkinen.fi/erix/exsh/actions/runs/272), for signed `ffe50612889dd58a45a40d04593a4aa3a3ffa512`, both fail the required complete frame proof. All 976 Rust tests and 355 checker controls pass. Four complete hashed logs total 320,166 bytes without warnings; Markdown passes. Each original workflow reports four complete workspace mappings and incomplete runtime/all frame observations (101/68 unresolved). These actual CI observations are distinct from the local eight-configuration frame observations. The passing guarded-stage VM does not waive this failure. No workflow was rerun or cancelled to obtain acceptance. Guarded-custody documentation reconciliation — 19 September 2026: signed [Posixd PR 5](https://git.erikinkinen.fi/erix/posixd/pulls/5), `9b031a8c2f996491a322046a4f2acd5dacdc55c2`, replaces stale grant-return and proposed-custody gaps with the implemented producer boundary. Procd uses the actual returned grant to attenuate the initial endpoint to RECV before execution, removes bypass sources, and retains nested custody beneath Kernel lifetime custody. A later mediator disposal report cannot prove absence of bypass senders. Exact staged abort and the remaining counted startup, readiness, configuration, sealing, client I/O and running-realm retirement requirements are distinguished. This repository still has no Posixd executable. Markdown, canonical headings/governance, local links, original source anchors and whitespace checks pass. Original [Posixd CI 17](https://git.erikinkinen.fi/erix/posixd/actions/runs/17) and [18](https://git.erikinkinen.fi/erix/posixd/actions/runs/18) both pass from two complete hashed logs totaling 7,232 bytes without warnings. Rust checks do not apply to this documentation-only repository. Signed [Docs PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4), `7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d`, removes the matching stale passages from the process-services manual. All 45 tests and the full 2,419-page manual pass. All 445,847 word boxes lie within page bounds; the actual changed paragraphs and continuation on pages 222, 226 and 227 are visually reviewed, with zero final warnings. Shared API snapshots are unchanged. Original [Docs CI 977](https://git.erikinkinen.fi/erix/docs/actions/runs/977) and [978](https://git.erikinkinen.fi/erix/docs/actions/runs/978) are running. These documentation corrections add no runtime behavior; the previously retained Integration `78557a6c672ecf426dfe894a01cc4aeec73b5e3c` appliance retains its original source selection and passing guarded-preparation evidence. Native upstream Rust/LLVM rebuilding and both complete EriX builds remain required. Process-start census correction — 19 September 2026: signed Kernel `b762e19d0c16acd605d0f6123994a586cc6fcde1` requires a successful install-grant absence census before process start. An unavailable census returns the existing refusal and preserves the whole staged child and grant state. Hosted controls cover unavailable census, actual grant disposal and malformed-target precedence. Normal bootstrap initializes tracking before admission; production reachability of the injected condition or a native authority escape is not established. [Kernel issue 18](https://git.erikinkinen.fi/erix/kernel/issues/18) uses the canonical bug report and records the original failure and bounded correction. Four strict Kernel matrices pass 704/728 library tests and two standalone controls each; three existing ignored tests remain ignored. Formatting, strict host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass. Original [Kernel CI 606](https://git.erikinkinen.fi/erix/kernel/actions/runs/606) and [607](https://git.erikinkinen.fi/erix/kernel/actions/runs/607) pass from all four complete hashed logs (739,843 bytes), without warnings. Signed Integration `b65183ddb93eb4396d4140a002c3727fec42ff87` selects that Kernel and the reconciled Docs `7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d`, preserving all other catalog entries and all previously checked orchestration bytes. The matching guarded-preparation VM passes both unique markers and ordinary successful shell exit under unchanged 120-second hard and 45-second progress limits. All 106 artifacts, all 73 original component identities and the actual signed image are verified without warnings. Serial SHA256: `a373a8ccd81ac3efbaa492cbf2e1f991f3cc34dcbf23a1435c1c48cd75cd5c1c` (55,776 bytes); signed boot-image SHA256: `3b88d37183cf36dcbd5f1105cc0fd86e79aa4489d311300003f3f362c24bcd0a`. This remains an unstarted staging fixture. Normal native execution does not exercise the hosted unavailable-census condition. The prior complete 169-helper/four-matrix Integration evidence is verified against unchanged implementation bytes. Focused catalog/source checks pass, including 46 immutable-source and five tool-selection tests. An initial host fixture failure caused by disabling its deliberate Git replacement setup is retained; the established helper environment passes without altering product checks. The static census covers 3,127 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 170 direct missing_docs gates and 92 conventional crate roots; complete semantic authority and private-documentation closure remain open. Original [Integration CI 1679](https://git.erikinkinen.fi/erix/integration/actions/runs/1679) and [1680](https://git.erikinkinen.fi/erix/integration/actions/runs/1680) are queued. Earlier 1677/1678 remains queued and 1675/1676 is running. No unchanged workflow is rerun or cancelled. Complete mediator execution, full source/effect/frame proof, upstream Rust/LLVM rebuilding and both full EriX build generations inside EriX remain required. No whole acceptance item is newly completed. Shared native terminal transition — 19 September 2026: signed Kernel `37d9c74d6d1209729c520a52a274c1646efe225c` consolidates exit and kill event reservation, lifetime preflight, exact-generation commit and receiver/invocation retirement into one documented implementation. Existing public behavior and root exit cleanup remain unchanged. Terminal state and actual resource destruction stay separate. This completes the terminal-refactor prerequisite in [child lifetime design #19](https://git.erikinkinen.fi/erix/kernel/issues/19); it introduces no lifetime binding, new opcode or additional authority. Four strict Kernel matrices pass 704/728 library tests and both standalone controls, with three existing ignored tests unchanged. All thirteen native build/Clippy profiles, formatting, host/native Clippy and private rustdoc pass without warnings. Original [Kernel CI 608](https://git.erikinkinen.fi/erix/kernel/actions/runs/608) and [609](https://git.erikinkinen.fi/erix/kernel/actions/runs/609) pass from all four complete hashed logs (739,870 bytes), without warnings. Signed Integration `a62d1381f56a01afc692112d9b427205eaeb6a2e` updates both full Kernel selectors and five stale native diagnostic selectors while preserving source memberships and tested orchestration bytes. Both maintained native runners pass their original 60-second scenarios: lifetime revocation and owned invocation. Complete serial logs are retained (1,807 and 1,587 bytes), QEMU stderr is empty, and build warnings are absent. Packaged Kernel bytes match retained unstripped artifacts; all fifteen exact original component trees and signatures verify. Four current strict 320/321-test Integration matrices, native builds, formatting, host/native Clippy and private rustdoc pass. Seven focused source/native-policy checks pass; the complete 169-helper evidence remains hash-bound to unchanged implementation bytes. Original [Integration CI 1681](https://git.erikinkinen.fi/erix/integration/actions/runs/1681) and [1682](https://git.erikinkinen.fi/erix/integration/actions/runs/1682) are queued; older corrected 1675/1676 remains running. The static census covers 3,128 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 170 direct missing_docs gates and 92 conventional roots. Full semantic authority and private rustdoc closure remain open. Native child-lifetime custody, running mediator lifecycle, full frame proof, upstream Rust/LLVM rebuilding and both full EriX build generations inside EriX remain required. No whole phase acceptance item is added. Original corrected-source CI checkpoint — 19 September 2026: at signed Integration 9139c6c5fa38c139e92520f6d410626b4cf1e4aa, original [push CI 1675](https://git.erikinkinen.fi/erix/integration/actions/runs/1675) passes all 488 VM scenarios. Original [PR CI 1676](https://git.erikinkinen.fi/erix/integration/actions/runs/1676) passes 487/488 and fails only `subsystem-e2fs-fat-ext3-htree-positive` at the unchanged 120-second QEMU limit. Both pass `appliance-disk-image-realm-admission-positive`; both Rust and Markdown jobs pass. Six complete hashed logs contain 27,276,890 bytes and no warnings. No rerun or cancellation supplies either result. The ext3 timeout remains tracked in [issue 20](https://git.erikinkinen.fi/erix/integration/issues/20); its cause is not inferred from the passing sibling run. The private script-route admission defect is corrected and natively demonstrated, while full realm lifecycle, complete frame proof and guest builds remain open. Native child lifetime checkpoint — 19 September 2026: signed Kernel 1428885e6d27e8e2bcefbbf68caf22ece253aac9 implements operation 58 using the actual Running caller, an exact Created child, independent Process authority and its real local install grant. It consumes only that grant, reserves cohort events before terminal effects, stops descendants before their supervisor and retains each bound child's cleanup duty and first failure independently of userspace survival. Return-boundary disposal closes outgoing accounting and respects current/active-interval protection. Fourteen new real-object controls cover refusals, rollback, nested stopping, a 257-descendant tree, late preflight failure, exact reuse and failed explicit abort after unlinking. Four strict 718/742-test configurations and both standalone controls pass; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Original [Kernel CI 610](https://git.erikinkinen.fi/erix/kernel/actions/runs/610) and [611](https://git.erikinkinen.fi/erix/kernel/actions/runs/611) pass from four complete hashed logs, 751,929 bytes, without warnings. The matching maintained lifetime VM passes its original 60-second scenario with the additional `ERIX_KERNEL:CHILD_LIFETIME_OK` marker. A real CPL3 supervisor proves ChildPopulate refusal, malformed/generation refusal, actual Process-route binding, start and exit. An independent observer verifies both exact children, CSpaces and mappings absent before terminal-event consumption, then disposes the unbound supervisor. The runnable child has a faulting sentinel and intentionally does not execute. All sixteen additional mapped pages are disposed. The original owned-invocation VM also passes its unchanged scenario. Complete serial logs contain 1,838 and 1,587 bytes; QEMU stderr is empty and build warnings are absent. Packaged Kernel bytes match retained original unstripped artifacts and all fifteen selected component signatures verify. Lifetime serial SHA256 is `012b46541b7c1c89d954cdbebda855037152a4e39ffad20ad7bdcc8c7b5c2572`. This establishes explicit native supervision with actual caller-side CPL3 evidence. Executing-child, no-successor native idle, allocation/partial-effect failure coverage, Procd adoption, running-mediator failure, provider completion, complete source/effect/frame proof, upstream Rust/LLVM rebuilding and both full EriX-in-EriX generations remain open. Host idle controls do not establish native interrupt or wakeup behavior. No whole phase acceptance leaf is added. Signed Docs 9ca5a5e811766a4506c0626cd58f8e228d0bacf8 updates the technical manual's native admission, preflight, stopping, partial cleanup and safe return/idle contracts. All 45 tests and the complete 2,425-page manual pass with zero final warnings. All 447,213 word boxes are in bounds and all three changed contract pages are visually reviewed. Shared API reference source is unchanged. Original [Docs CI 981](https://git.erikinkinen.fi/erix/docs/actions/runs/981) and [982](https://git.erikinkinen.fi/erix/docs/actions/runs/982) pass from four complete hashed logs, 773,510 bytes. Both pass 45 tests and the complete 2,425-page manual. TeX pass warning counts are 36/1/0, with zero final-pass warnings; neither workflow was rerun or cancelled. Signed Integration 581226ab5435dc66c6f93157606b6d4d83475b15 selects the coherent original Kernel/lib-capabi/lib-ipc graph and updated manual. All four current strict 320/321-test configurations, four native builds, fmt, strict host/native Clippy and private rustdoc pass without warnings. Source and updated native-policy checks pass; the full 169-helper evidence remains bound to unchanged orchestration bytes. The final post-VM changes select only the newer Docs revision and update roadmap status; native source catalog, scenario, runtime and orchestration bytes are unchanged. Original [Integration CI 1683](https://git.erikinkinen.fi/erix/integration/actions/runs/1683) and [1684](https://git.erikinkinen.fi/erix/integration/actions/runs/1684) are queued. Executing-child and terminal-reply checkpoint — 19 September 2026: signed [Kernel dd9eace5](https://git.erikinkinen.fi/erix/kernel/commit/dd9eace5b52edc02e624f142e92b85032f59bace) validates actual CPL3 nested-child execution and current-child ancestor termination. Synchronous control dispatch now ends its request borrow before effects and checks original caller identity, generation and terminal state before any response write. It keeps terminal completion in Kernel-owned result registers with zero reply length; ordinary native return switches away. A surviving caller retains its normal encoded response. Two focused actual-object regressions cover terminal request preservation and the surviving-caller reply. The dispatcher is split from the tracing/policy file. A supervisor binds and starts a child; that child binds a staged grandchild and kills its supervisor through its own explicit Process SEND route. Read-only witnesses require terminal caller storage to survive dispatch, then exact child/grandchild absence before the independent observer reads child-before-supervisor events. Both terminal payloads have immediate UD2 sentinels. An unrelated Created process retains its exact record, empty capability inventory and mappings until explicitly aborted. All four additional lifetimes and twenty-two mapped pages must be disposed for `ERIX_KERNEL:CHILD_EXECUTION_OK`. Four strict Kernel configurations pass 720/744 library tests and both standalone controls; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Signed [Integration c14c5a61](https://git.erikinkinen.fi/erix/integration/commit/c14c5a617196a9b135b479601ca47a21371a9482) requires the additional marker while preserving every earlier marker and the original 60-second limit. Both actual native scenarios pass, with 1,870/1,587 complete serial bytes, empty QEMU stderr and no build warnings. Packaged Kernel bytes equal retained original artifacts after normal stripping; all fifteen original source signatures verify. Lifetime serial SHA256 is `1b2f983239efca55c8bc0f6f08ee91cfdcd37d4d1f6951bbd740e4d9b45d1a2f`. Four current Integration 320/321-test configurations, native builds, strict Clippy, formatting, private rustdoc and updated policy checks pass. Earlier 169-helper evidence is hash-verified against unchanged orchestration; it was not rerun for these scenario/catalog changes. Signed [Docs b4b01d87](https://git.erikinkinen.fi/erix/docs/commit/b4b01d870757d9b626dd2cfa7c6424332087bf62) documents the executing-child observations and remaining limits. All 45 tests, the full 2,425-page manual, 447,382 word bounds and visual review of the changed pages pass, with zero final warnings. The API reference source is unchanged. This extends native executing-child evidence; it does not establish no-successor native idle/wake behavior, provider completion, Procd adoption or a complete service lifecycle. The original install-grant constructor still gives `GRANT | MINT` while binding needs only `GRANT`; move-only transfer preserves exact rights. Both diagnostic grants are consumed, but rights minimization remains an explicit audit follow-up. Full source/effect/frame proof, the Pagerd gate, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted. Related implementation tracking: [Kernel feature](https://git.erikinkinen.fi/erix/kernel/issues/19), [Kernel WIP PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration WIP PR](https://git.erikinkinen.fi/erix/integration/pulls/12), [manual WIP PR](https://git.erikinkinen.fi/erix/docs/pulls/4), and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Original [Kernel CI 614](https://git.erikinkinen.fi/erix/kernel/actions/runs/614) and [615](https://git.erikinkinen.fi/erix/kernel/actions/runs/615) pass from four complete hashed logs, 753,462 bytes, without warnings. Original [Docs CI 983](https://git.erikinkinen.fi/erix/docs/actions/runs/983) and [984](https://git.erikinkinen.fi/erix/docs/actions/runs/984) pass from four complete hashed logs, 773,542 bytes. Both pass all 45 tests and the complete 2,425-page final manual; reference-resolution warning counts are 36/1/0, with zero final warnings. Original Integration CI 1685/1686 remains queued at its second observation. Older original [Integration CI 1678](https://git.erikinkinen.fi/erix/integration/actions/runs/1678) passes all 489 catalog scenarios and both native Kernel diagnostics, then fails the development COM1 editor probe after its physical counterpart passes. Rust and Markdown pass. All three complete logs total 13,384,697 bytes with no warnings; the outer input status does not establish cause. The canonical bug report is [issue 67](https://git.erikinkinen.fi/erix/integration/issues/67), with bug/ci/phase-6 metadata. Earlier editor and filesystem failures remain separate. No original workflow was cancelled or rerun. Native cleanup without a userspace successor — 19 September 2026: signed [Kernel 2cf5b34c](https://git.erikinkinen.fi/erix/kernel/commit/2cf5b34c77451e4ddfa50f6bab9ae65cc5c47068) adds a seventh actual CPL3 caller to the maintained lifetime diagnostic. After every earlier assertion, the observer binds/starts the final child and yields. The child kills that supervisor through its own explicit Process SEND route. Immediate faulting sentinels forbid either terminal payload from resuming. Ordinary native return closes CPU accounting, detaches current attribution, progresses reclamation and finds no runnable successor. A diagnostic-only read-only witness then requires empty CPU accounting, only terminal retained records, no bound cleanup duties or event reservations, exact child identity/CSpace/mapping absence and both unconsumed child-before-supervisor events. All six final child pages retire; three original unbound terminal records remain for prior assertions. The witness neither performs cleanup nor selects a process nor installs an interrupt. `ERIX_KERNEL:CHILD_IDLE_CLEANUP_OK` precedes completion before HLT, so actual hardware halt/wakeup remains a separate gate. Signed [Integration 4d6f4fe8](https://git.erikinkinen.fi/erix/integration/commit/4d6f4fe8b383603b225b04a7771a11f32886e0a9) requires the additional marker while preserving all earlier assertions and both 60-second scenario limits. Both actual native VMs pass: 1,905/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256: `4a7cba61f75f4eeac47896d165b8dbcd217e4c75e2a81c8ae0f29957facb929c`. Packaged Kernel images match retained build artifacts after normal stripping; all fifteen original component signatures verify. Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Post-VM changes only select updated Docs in full catalogs and update roadmap status. Signed [Docs 69466a64](https://git.erikinkinen.fi/erix/docs/commit/69466a64c032d575569adeff14f17a445e5a9c03) documents the pre-halt boundary and consolidates stale status paragraphs. All 45 tests, the complete 2,425-page manual, 447,534 word bounds and visual review of pages 562–564 pass with zero final warnings. API reference source remains unchanged. The static audit passes 3,140 authored code files below 1,000 lines, 74 manifests, 259 full Git selections, 171 direct missing_docs gates and 92 conventional crate roots; semantic authority and complete private-rustdoc closure remain open. Original [Kernel CI 616](https://git.erikinkinen.fi/erix/kernel/actions/runs/616) and [617](https://git.erikinkinen.fi/erix/kernel/actions/runs/617) pass from four complete hashed logs, 753,458 bytes, with no warnings. Original [Docs CI 985](https://git.erikinkinen.fi/erix/docs/actions/runs/985) and [986](https://git.erikinkinen.fi/erix/docs/actions/runs/986) also pass: four complete hashed logs, 773,510 bytes; both pass 45 tests and the final 2,425-page manual. Reference-resolution warning counts are 36/1/0 with zero final warnings. Original Integration CI 1687/1688 remains queued at its first observation. Older original [Integration CI 1677](https://git.erikinkinen.fi/erix/integration/actions/runs/1677) is now terminal failure: all 489 catalog cases, both native diagnostics, development physical/COM1 editor and release physical editor pass before release COM1 fails. Rust and Markdown pass. Three complete logs total 13,385,246 bytes without warnings; [bug 37](https://git.erikinkinen.fi/erix/integration/issues/37) retains this evidence. Companion 1678's earlier development COM1 failure remains separate in [bug 67](https://git.erikinkinen.fi/erix/integration/issues/67); a common cause is unproven. No original workflow was cancelled or rerun. Further native failure controls, grant-rights minimization, terminal accounting, Procd adoption and complete service lifecycle acceptance remain open. Existing install-grant creation still supplies GRANT | MINT while binding needs GRANT, so minimum authority is not claimed. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted. Related: [Kernel design](https://git.erikinkinen.fi/erix/kernel/issues/19), [Kernel WIP PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration WIP PR](https://git.erikinkinen.fi/erix/integration/pulls/12), [manual WIP PR](https://git.erikinkinen.fi/erix/docs/pulls/4), and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Further original CI observations — 19 September 2026: original Integration `b65183ddb93eb4396d4140a002c3727fec42ff87` now has both terminal outcomes recorded. [Run 1679](https://git.erikinkinen.fi/erix/integration/actions/runs/1679) passes 488/489 catalog cases; only ext4 quota exceeds its unchanged 120-second deadline, retained in [bug 18](https://git.erikinkinen.fi/erix/integration/issues/18). Its later native/interactive gates are not reached. [Run 1680](https://git.erikinkinen.fi/erix/integration/actions/runs/1680) passes all 489 catalog cases and both native diagnostics, then fails development COM1 directory input after its physical counterpart passes; the last observation is command 6 injection, retained in [bug 56](https://git.erikinkinen.fi/erix/integration/issues/56). Later release directory/editor gates are not reached. Both Rust and Markdown jobs pass. Six complete hashed logs total 27,238,688 bytes with zero warning candidates. Causes remain unclassified; no unchanged rerun, cancellation or deadline change occurred. Original current Integration 1687/1688 remains queued at its second observation. Acceptance stays 15/460, 3.48% weighted; native toolchain rebuilding and both full EriX-in-EriX generations remain open. Native terminal-event allocation refusal — 19 September 2026: signed [Kernel ba03995f](https://git.erikinkinen.fi/erix/kernel/commit/ba03995fe0dcfc3d4a1f72eb000e0c7698bbcbaa) extends the actual executing-child sequence with one deliberately refused heap allocation. Separate diagnostic preparation captures the original supervisor, child, staged grandchild and independent process records/capability inventories, then gives an empty event queue one-event capacity. No queued event or existing reservation is discarded. The first terminal-event reservation succeeds; the second arms exactly one null return from the real Kernel allocator. Ordinary collection growth and Process dispatch return RESOURCE_EXHAUSTED before any terminal effect. Read-only witnesses require complete reservation rollback, an empty event queue, unchanged exact records and capabilities, and preserved code/stack/message mapping ranges. Actual CPL3 instructions validate the refusal reply before the next ordinary ancestor kill succeeds with allocation available. Every earlier terminal, descendant-disposal, independent-process and no-successor idle assertion remains required. `ERIX_KERNEL:TERMINAL_EVENT_RESERVATION_OK` requires one consumed allocator refusal and no remaining armed fault. Fault controls are absent from ordinary images; this covers injected allocation failure, not spontaneous heap exhaustion or independent resource-release failure. No witness supplies a syscall result, cleanup effect or scheduler choice. Signed [Integration cf5b2f5f](https://git.erikinkinen.fi/erix/integration/commit/cf5b2f5f1d63631e69df3074d7c1c0b9b4921480) requires the new marker without changing either 60-second limit. Both maintained native VMs pass: 1,948/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is `d485019082175f769ecc2d406d88c6cc84a7df323605027663f5bcc79ca03ad9`. Packaged Kernel bytes match retained original artifacts after normal stripping, and all fifteen original source signatures verify. Post-VM changes only select updated Docs in full catalogs and consolidate roadmap status. Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and updated policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed [Docs 62ba2ffa](https://git.erikinkinen.fi/erix/docs/commit/62ba2ffa30ff9f04840c8d38d188b414e5b24b90) passes 45 tests, the complete 2,425-page manual, all 447,688 word bounds and actual visual review of pages 562–565, with zero final warnings; API reference source remains unchanged. The static audit passes 3,142 authored code files below 1,000 lines, 74 manifests, 259 full Git pins, 171 direct missing_docs gates and 92 conventional roots. Complete semantic authority and private-rustdoc closure remain open. Original [Kernel CI 618](https://git.erikinkinen.fi/erix/kernel/actions/runs/618) and [619](https://git.erikinkinen.fi/erix/kernel/actions/runs/619) pass from four complete hashed logs, 753,434 bytes, with zero warnings. Original [Docs CI 987](https://git.erikinkinen.fi/erix/docs/actions/runs/987) and [988](https://git.erikinkinen.fi/erix/docs/actions/runs/988) pass from four complete hashed logs, 773,506 bytes: both pass 45 tests and the final 2,425-page manual, with reference-resolution warning counts 36/1/0 and zero final warnings. Original Integration CI 1689/1690 is queued. Earlier filesystem, directory, editor and full-frame regressions remain unresolved; original workflows were not cancelled or rerun. The terminal-accounting audit confirms that ordinary Procd terminal handling queries original TCB counters after receiving its event, while automatic bound-child reclamation removes that TCB. Its separate private-mediator branch does not take the same query path; adoption must state which lifetimes require retained metrics and preserve their original generation without fabricated zero/wall-clock values. Independent release-failure coverage, grant-rights minimization, accounting, Procd adoption and full mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted. Related: [Kernel design](https://git.erikinkinen.fi/erix/kernel/issues/19), [Kernel WIP PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration WIP PR](https://git.erikinkinen.fi/erix/integration/pulls/12), [manual WIP PR](https://git.erikinkinen.fi/erix/docs/pulls/4), and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Historical pre-correction CI reconciliation — 19 September 2026: original [Integration run 1673](https://git.erikinkinen.fi/erix/integration/actions/runs/1673) and [1674](https://git.erikinkinen.fi/erix/integration/actions/runs/1674), at `76411ed6d96356b20ee0a4c21ad219dacc56340d`, are terminal failures. Each passes 487/488 catalog scenarios and fails only `appliance-disk-image-realm-admission-positive`, reporting the unchanged 45-second serial-progress watchdog. Later native and interactive workflow gates are not reached. Both Rust and Markdown jobs pass. Six complete hashed logs total 27,087,569 bytes with zero warning candidates. Neither workflow was cancelled or rerun. These runs precede the retained correction at `9139c6c5fa38c139e92520f6d410626b4cf1e4aa`; both later original runs 1675/1676 passed that realm-admission scenario. [Issue 66](https://git.erikinkinen.fi/erix/integration/issues/66) retains the historical evidence and its existing closed state. This does not establish a new current-source regression, full lifecycle acceptance or full guest builds. Current Integration 1689/1690 remains queued at its second observation; acceptance stays 15/460, 3.48% weighted. Independent native child release recovery — 19 September 2026: signed [Kernel 82d88b60](https://git.erikinkinen.fi/erix/kernel/commit/82d88b609bd808a840780993da315230dd14399a) extends actual supervisor-exit coverage with two deliberate refusals at the original staged child's final VSpace-release callback, after capability disposal and unlinking. The first error is KernelHeapExhausted, the second CspaceSlotMissing. Read-only observations around two ordinary CPL3 observer yields require the original full record, generation, abort custody and first error retained, an empty original CSpace and retained mapped backing. The independent running child must already be absent from native TCB, CSpace and VSpace directories. The selected child's earlier directory position ensures its failure preceded that independent disposal. The third callback must perform normal VSpace release before all original terminal-event, generation and resource-absence checks pass. `ERIX_KERNEL:CHILD_RELEASE_ISOLATION_OK` requires exactly two refusals and complete eventual disposal. Fault control uses only atomics at the locked callback boundary and exists only in the isolated native diagnostic. No witness performs cleanup, supplies a successful release/syscall result or chooses a scheduler target. This establishes injected callback-refusal coverage, not an observed hardware or allocator malfunction. All earlier nested-child, allocation-refusal and no-successor pre-halt assertions remain required. Signed [Integration 294a467a](https://git.erikinkinen.fi/erix/integration/commit/294a467a3bcd9464ea55c32dbce98acf19d0e400) requires the added marker with both original 60-second limits unchanged. Both maintained native VMs pass: 1,988/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is `606fff037be022c876220d8e8f329c9046ffea5dcdf80831026649aedfbe0b08`. Packaged Kernel bytes match retained original unstripped artifacts after normal stripping, and all fifteen original component signatures verify. Post-VM changes only select the updated manual source in full catalogs and reconcile roadmap status. Four strict Kernel 720/744-test configurations, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test configurations, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed [Docs 2a0ccc1a](https://git.erikinkinen.fi/erix/docs/commit/2a0ccc1a595c3e03aa6c7b7ecbcaca8830082ddd) passes 45 tests, the complete 2,427-page manual, all 447,789 word bounds and actual visual review of pages 562–565 with zero final warnings. API reference source is unchanged. Static audit passes 3,143 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 171 direct missing_docs gates and 92 conventional roots; complete semantic authority/private-rustdoc closure remains open. Original Kernel CI 620/621 and Docs CI 989/990 pass from four complete hashed logs each (753,438/773,910 bytes), with zero final warnings. Current Integration originals are observed after publication. Earlier filesystem, directory, editor and full-frame regressions remain unresolved, with original evidence retained; no workflow is cancelled or retried unchanged. The grant-rights audit confirms actual Procd derivation callers and exact GRANT | MINT receipt checks in Procd and Launchd. Grant authority minimization must coordinate those consumers and distinguish the grant's own rights from its installation ceiling. Original generation-bound terminal accounting, Procd adoption, provider completion, hardware halt/wakeup and complete mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted. Related: [Kernel design](https://git.erikinkinen.fi/erix/kernel/issues/19), [Kernel WIP PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration WIP PR](https://git.erikinkinen.fi/erix/integration/pulls/12), [manual WIP PR](https://git.erikinkinen.fi/erix/docs/pulls/4), and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Explicit grant implementation progress — 20 September 2026: Kernel commit [4a5333f760e258ebca23047a362d1cff4fded0c0](https://git.erikinkinen.fi/erix/kernel/commit/4a5333f760e258ebca23047a362d1cff4fded0c0) is signed and pushed. Creation preserves exact own grant rights, including zero. Derivation requires actual MINT and subsets of both own rights and installation scope. Zero-right custody still blocks process start until disposed. Four strict 724/748-unit configurations, both standalone controls and thirteen native build/Clippy profiles pass without warnings; three existing ignores remain. Original CI 622/623 passes from four complete hashed logs, 756,715 bytes, zero warnings. The new actual CPL3 derivation/disposal controls and GRANT-only relocation/installation compile; their matching VM execution remains pending. Integration commit [9166f7bde6a0b42afd3ef1c9898b9e818df9af86](https://git.erikinkinen.fi/erix/integration/commit/9166f7bde6a0b42afd3ef1c9898b9e818df9af86) is a signed orchestration-library dependency checkpoint. Four strict 320/321-unit configurations and four native library builds pass without warnings. Original CI 1693/1694 is waiting at its first observation. The full image catalogs still retain their preceding coordinated selection until actual consumers are validated together. Shared wire and dependency checkpoints, each with strict matrices and original CI passing: [lib-ipc issue/PR](https://git.erikinkinen.fi/erix/lib-ipc/issues/1), [lib-capabi issue/PR](https://git.erikinkinen.fi/erix/lib-capabi/issues/1), [lib-bootstrap issue/PR](https://git.erikinkinen.fi/erix/lib-bootstrap/issues/1), [lib-interrupt issue/PR](https://git.erikinkinen.fi/erix/lib-interrupt/issues/1), [lib-service issue/PR](https://git.erikinkinen.fi/erix/lib-service/issues/1), [lib-time issue/PR](https://git.erikinkinen.fi/erix/lib-time/issues/1), [lib-block issue/PR](https://git.erikinkinen.fi/erix/lib-block/issues/1), [lib-log issue/PR](https://git.erikinkinen.fi/erix/lib-log/issues/1), [lib-driver issue/PR](https://git.erikinkinen.fi/erix/lib-driver/issues/1), [lib-vfs issue/PR](https://git.erikinkinen.fi/erix/lib-vfs/issues/1). Their linked WIP PRs retain the detailed signed revisions and validation. The consumer audit also identified Loaderd and Deviced receipt checks. Procd's move-only handoff cannot attenuate the original delegating grant: it now derives a GRANT-only final receipt into the already-disposed VSpace receipt slot and drops the source before returning that receipt. Nonderiving materialization and rootless mediator paths request GRANT directly. Partial failure retains original-generation rollback and all remaining local custody. Procd, Launchd, Rootd, Loaderd and Deviced pass their default unit suites; their full strict matrices and coherent guest validation remain open. [Deviced bug 4](https://git.erikinkinen.fi/erix/deviced/issues/4) records a separately observed quarantine test race and its test-only serialization correction. This is partial implementation evidence, not completed lifecycle or self-hosting acceptance. The canonical checklist remains 15 of 460 leaves, 3.48% weighted. Full terminal accounting, provider completion, consumer lifecycle, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both complete EriX-in-EriX generations remain required. Verified grant-rights checkpoint — 20 September 2026: Both maintained isolated native scenarios pass on their first attempts under the unchanged 60-second scenario limits, with no build warnings and empty QEMU stderr. Lifetime now exercises 27 ordinary CPL3 grant-right controls and requires INSTALL_GRANT_RIGHTS_OK before its existing cleanup assertions. Its 2,025-byte serial stream has SHA256 `6c685f1ceaf9080bf0bec628a4fac512bf9049d0fbcfe2b3737666adf414ca3a`; owned invocation retains 1,587 bytes. Normal stripping exactly matches both packaged kernels to retained original artifacts. All fifteen selected original source signatures and clean trees verify. These minimal native scenarios establish neither full service-image acceptance nor a guest build. All thirteen shared libraries pass their strict matrices and original CI. The five direct receipt consumers pass four strict host/native configurations; original CI passes for procd 292/293, launchd 145/146, rootd 1037/1038, loaderd 99/100, deviced 206/207. [Rootd baseline regression](https://git.erikinkinen.fi/erix/rootd/issues/6) and [Deviced quarantine fixture race](https://git.erikinkinen.fi/erix/deviced/issues/4) are corrected with retained original failures and successful corrected-source CI. Manual/API updates and remaining full-catalog alignment are in progress. [Integration bug 68](https://git.erikinkinen.fi/erix/integration/issues/68) records five original CI failures (1683/1684, 1685/1686 and 1688), each with 127 manifest/catalog revision mismatches before full VM execution. All fifteen complete logs are retained, 1,512,137 bytes with no warning candidates. Individual-crate and minimal-native validation did not prove full catalog coherence. Remaining dependents are being aligned and validated bottom-up; equality and immutable-source checks are unchanged. Earlier 1681/1682 separately reached 479/489 and 487/489 VM passes, with ten and two scenario timeouts at the original 120-second bounds. Those filesystem failures require separate analysis. Canonical acceptance remains 15 of 460 leaves, 3.48% weighted. Complete lifecycle and terminal accounting, provider completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain required. Manual and dependency validation — 20 September 2026: Docs commit [f4621ce2921b2b9fe3b1d25b4321d6b28289418e](https://git.erikinkinen.fi/erix/docs/commit/f4621ce2921b2b9fe3b1d25b4321d6b28289418e) is signed and pushed. Native selectors 32/33/54 now document exact own rights separately from installation ceilings. The process and launch chapters require GRANT-only final receipts, explicit derivation/source disposal, and original-generation rollback. Both IPC references are regenerated from signed source. All 45 tests and API checks pass; the complete 2,429-page manual has zero final warnings, all 448,913 word bounds pass, and eleven changed pages were visually reviewed. Original Docs CI 991/992 passes with four complete hashed logs, 774,346 bytes, both 45-test runs and final 2,429-page manuals. Intermediate TeX reference warnings resolve before the final pass. Thirty-one additional downstream consumers now have signed dependency-alignment checkpoints, each with four strict unit configurations, four native builds, host/native Clippy, formatting and private rustdoc passing without warnings. All 62 original CI runs pass. Their owning feature issues and WIP PRs retain exact revisions and log evidence. [Catalog regression 68](https://git.erikinkinen.fi/erix/integration/issues/68) remains open until the remaining Exsh selection and complete original catalog are validated together. Individual repository success is not full service-image acceptance. Exsh's default development tests pass 976 units. Aggregate release-test compilation and a subsequent explicitly separated library compilation each reached the local unchanged 120-second silence limit before tests ran; both failures remain retained. No release-test success is inferred, no compiler setting or deadline was relaxed, and independent configurations are being collected without rerunning failed commands unchanged. The complete source/effect/frame gate also remains open. Original Integration 1693/1694 also fails with 127 manifest/catalog mismatches each, before full VM execution. Six complete logs total 604,756 bytes, with no warning candidates. Together with 1683–1692 this is twelve retained original failing runs. Earlier full-VM filesystem timeouts remain separately tracked in [ext-family issue 20](https://git.erikinkinen.fi/erix/integration/issues/20) and [FAT32 issue 58](https://git.erikinkinen.fi/erix/integration/issues/58). Canonical acceptance remains 15/460 leaves, 3.48% weighted. Full service lifecycle, terminal accounting, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain required. Static audit currently passes 3,150 authored code files below 1,000 lines, 74 manifests, 259 explicit Git pins, 172 direct missing_docs gates and 92 conventional Rust roots; full semantic authority and documentation review remain open. Complete original catalog checkpoint — 20 September 2026: Integration [f9681efc30f1c48989def7f0e7db939974a30e27](https://git.erikinkinen.fi/erix/integration/commit/f9681efc30f1c48989def7f0e7db939974a30e27) is signed and pushed in [WIP PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). Both complete catalogs now pass exact dependency equality against 73/70 clean original selected checkouts and 72/71 manifests; all 143 selected signatures verify. The original Integration library pin is retained independently of the catalog commit, avoiding a circular source reference. Twenty dependency-policy and 46 immutable-source tests, both native scenario policies, Markdown and whitespace pass. The unchanged orchestration crate retains its verified four 320/321-unit configurations, four native builds and strict Clippy/rustdoc evidence. Corrected-source original CI 1695/1696 is running; [bug 68](https://git.erikinkinen.fi/erix/integration/issues/68) remains open pending that observation and full consumer acceptance remains separate. The executed inputs for both first-attempt native VM passes remain exact: 27 new ordinary CPL3 grant-right controls, every earlier lifetime/owned-invocation assertion, original 60-second bounds, zero build warnings and empty QEMU stderr. Both packaged kernels match retained original artifacts and all fifteen original source signatures verify. The final post-VM changes only select the full catalogs and reconcile documentation. All 31 further fully validated consumer checkpoints pass four strict unit/native configurations and all 62 original CI runs; 124 complete logs total 3,041,213 bytes with no warning candidates. Their owning feature issues and WIP PRs preserve exact source and CI evidence. The full manual and regenerated IPC references are published in [Docs WIP PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4); its 45 tests, 2,429 pages, 448,913 word bounds and eleven changed-page reviews pass, as do original Docs CI 991/992 with zero final warnings. Exsh [dbc958bcdaa557a461e9308a31d23d3b8c189296](https://git.erikinkinen.fi/erix/exsh/commit/dbc958bcdaa557a461e9308a31d23d3b8c189296) in [WIP PR 3](https://git.erikinkinen.fi/erix/exsh/pulls/3) is explicitly an incomplete-validation dependency checkpoint. Both development configurations pass 976 units, four native builds and strict Clippy/docs configurations pass, and all 355 checker tests pass. Three local release-unit compilation attempts reached the unchanged 120-second silence bound before tests ran. Four local frame checks return 1 with complete workspace mapping and 97/63 unresolved routes. Original CI 273/274 likewise passes 976 units and 355 checker tests, then fails the full frame/source gate with 101/68 unresolved observations. Four complete CI logs total 319,871 bytes with zero warning candidates. These local and CI artifacts are distinct; no frame or release-unit acceptance, relaxed deadline or unchanged retry is claimed. Canonical acceptance remains 15/460 leaves, 3.48% weighted. The full in-EriX builds and native external Rust/LLVM/runtime rebuild remain unproven. Full consumer lifecycle, terminal accounting, source/effect/frame proof, the 128-page Pagerd gate and profiler attribution remain required; no canonical leaf closes at this checkpoint. Installer return-slot regression — 21 September 2026: Both original corrected-catalog runs are now classified: [1695](https://git.erikinkinen.fi/erix/integration/actions/runs/1695) passes 431/489 VM scenarios and [1696](https://git.erikinkinen.fi/erix/integration/actions/runs/1696) passes 430/489. All six complete logs are retained and hashed, 32,723,390 bytes, zero warning candidates. Rust, Markdown and full dependency equality pass. Catalog mismatch [issue 68](https://git.erikinkinen.fi/erix/integration/issues/68) is corrected; this does not establish full consumer acceptance. Each run has 57 initial-shell uncertain-disposition failures and a separately retained release-appliance stall. Run 1696 also retains the ext4 quota timeout under its original 120-second bound, tracked in [issue 20](https://git.erikinkinen.fi/erix/integration/issues/20). [Procd bug 4](https://git.erikinkinen.fi/erix/procd/issues/4) records a concrete producer/consumer mismatch. The final installer was handed off from VSpace scratch slot 1056 while later TTY provisioning requires managed grant slot 1040. The added producer regression fails on the original code. Signed Procd [10d972b652297fd656e9a6ac6dbdf197f362c7ce](https://git.erikinkinen.fi/erix/procd/commit/10d972b652297fd656e9a6ac6dbdf197f362c7ce) in [WIP PR 2](https://git.erikinkinen.fi/erix/procd/pulls/2) derives the exact GRANT-only result, disposes its delegating source and uniquely relocates the result back to the empty managed grant slot. Refusals preserve original-stage rollback and remaining custody. Four strict 291/296-unit configurations, four native builds, host/native Clippy, formatting, private rustdoc and policies pass with zero warnings. Corrected full-service VM validation and original CI remain open; bug 4 remains open. Acceptance remains 15/460 leaves, 3.48% weighted. Full consumer lifecycle, terminal accounting, source/effect/frame proof, Pagerd, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full in-EriX build generations remain required. Verified managed installer recovery — 21 September 2026: Signed Integration [648fbd5614d3d0b82223b1c3bb7f1b5a0c81ea7d](https://git.erikinkinen.fi/erix/integration/commit/648fbd5614d3d0b82223b1c3bb7f1b5a0c81ea7d) in [WIP PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12) selects signed Procd [ac8a12993bc8cbf134a11e141e459cb63df71123](https://git.erikinkinen.fi/erix/procd/commit/ac8a12993bc8cbf134a11e141e459cb63df71123) and [Docs PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4). Both full original catalogs pass all 72/71 manifest checks against 73/70 clean selected checkouts and all 143 verified signatures. Twenty dependency and 46 immutable-source tests, native scenario policies, Markdown and whitespace pass. The unchanged orchestration crate retains its verified four 320/321-unit configurations, four native builds and strict Clippy/rustdoc evidence. Original Integration CI 1697/1698 is running; no complete regression-suite pass is claimed. [Procd bug 4](https://git.erikinkinen.fi/erix/procd/issues/4) is corrected. The added producer regression reproduces the original 1056/1040 mismatch. Procd derives exactly GRANT into disposed VSpace scratch, drops its delegating source and uniquely relocates the result into the now-empty managed grant slot before handoff. The downstream TTY checks remain strict. Four 291/296-unit configurations, four native builds, formatting, strict Clippy and private rustdoc pass without warnings; relocation refusal and occupied-destination controls retain original-stage cleanup. Original correction CI 294/295 passes from four complete logs, 344,660 bytes. The subsequent roadmap-only checkpoint keeps every runtime source byte unchanged and original CI 296/297 passes from four complete logs, 344,680 bytes, zero warnings. The maintained initial-shell start/exit, realm-admission and normal release-appliance VM scenarios all pass on their first corrected attempts with original guest bounds and watchdogs. The release appliance executes the real product-shell command and produces standalone LOOKUPOK output, separate from its echoed input. All three builds are warning-free and QEMU stderr is empty. Serial logs retain 55,702, 55,738 and 364 bytes respectively. Actual images, full artifact sets, scenario oracles and original signatures are retained. These runs execute Procd 10d972b652297fd656e9a6ac6dbdf197f362c7ce; the selected later Procd commit changes only its roadmap. All 73 executed component signatures and clean source trees verify. The earlier 431/489 and 430/489 full CI failures remain recorded, including the independent ext4 quota timeout; those runs are not rewritten as passes. The native-launch manual now explains the managed return destination, exact rights, unique relocation and partial-failure cleanup. All 45 tests, the complete 2,429-page manual, 448,970 word bounds and changed-page visual review pass without final warnings. Original Docs CI 993/994 passes from four complete logs, 774,342 bytes; each final TeX pass is warning-free after normal earlier reference resolution. Existing generated API references are unchanged. Canonical acceptance remains 15/460 leaves, 3.48% weighted. This is a repaired runtime regression, not completion of a canonical lifecycle leaf. Original-generation terminal accounting, provider/lifetime completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. Exsh's retained release compiler and frame-proof failures stay open. Verified native terminal accounting — 21 September 2026: Kernel [a9bdf6163813d378e0b4a164bceb839e24fbb6b7](https://git.erikinkinen.fi/erix/kernel/commit/a9bdf6163813d378e0b4a164bceb839e24fbb6b7) is signed/pushed. Terminal preflight reserves final scalar CPU evidence independently of TCB/CSpace/VSpace reclamation; exact queries preserve final results or explicit errors. Repeat observations belong to the actual original observer until exact acknowledgement, and observer death releases that claim. Independent authorized observers can progress. Selector 55 is retired; checked selectors 59/60 have no destructive fallback. Four strict 736/760-unit configurations, both standalone controls and thirteen native build/Clippy profiles pass without warnings. Host controls include nonzero final counters after actual reclamation and ID reuse, original observer death, pending-final-charge destruction refusal, malformed requests, wrong callers, immutable errors and lost-acknowledgement reply retry. Original Kernel CI 624/625 and corrected 626/627 all pass from eight complete hashed logs (1,532,848 bytes), zero warnings. Both maintained lifetime and owned-invocation VMs pass under the unchanged 60-second scenario limits and standard watchdogs, with no build warnings and empty QEMU stderr. Actual guest instructions check repeat observations and CPU queries, exact acknowledgement and absent-acknowledgement retry; executing children require nonzero user and kernel counters after native reclamation. Lifetime retains 2,025 serial bytes (SHA256 `921edf5eadfdff61f2d85a63158555666e77e57a1e8aa4254ac30dcd216f8cf9`); owned invocation retains 1,587 (SHA256 `404bc4ecad5074349d9ba45d1caf5439aebe849d344b726e5dec2ee2b9c4d907`). Normal stripping exactly matches both packaged kernels to retained original artifacts; all fifteen selected original signatures and clean checkouts verify. [Kernel regression 21](https://git.erikinkinen.fi/erix/kernel/issues/21) retains the first VM's final page-census failure. The corrected layout declares and allocates all six request pages and derives the independent census from that declaration. No unchanged retry or deadline relaxation occurred. Integration [fcd7b4a9608f629a12de78c53da5c3615d906b46](https://git.erikinkinen.fi/erix/integration/commit/fcd7b4a9608f629a12de78c53da5c3615d906b46) is signed/pushed with the verified isolated catalog. Twenty dependency and 46 immutable-source tests, native policies, Markdown and source checks pass. The unchanged orchestration crate, embedded fixture and original dependency closure retain verified four 320/321-unit and native/Clippy/rustdoc configurations. The full service catalogs retain their separately coordinated revisions; original Integration CI remains under observation. Procd and Rootd consumer adoption, ordinary and mediator metric retention/consumer loss, manual updates, full service/profiler scenarios, complete authority/source/frame audits and full regression acceptance remain open under [Kernel design 20](https://git.erikinkinen.fi/erix/kernel/issues/20). Canonical acceptance remains **3.48% weighted; 15 of 460 items**. Native upstream Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain mandatory and unproven. Committed terminal-accounting consumers — 21 September 2026: Procd [66934642c4464fc738152a9e60790914ba27dd1c](https://git.erikinkinen.fi/erix/procd/commit/66934642c4464fc738152a9e60790914ba27dd1c) in [WIP PR 2](https://git.erikinkinen.fi/erix/procd/pulls/2) reserves notification/crash/cleanup storage before effects, obtains exact final CPU evidence, commits local status and cleanup obligations, then acknowledges on every actual event polling path. Lost acknowledgement replies preserve the local result without duplicate counters or notifications. Mediators retain only scalar counters and the original authenticated supervisor identity after disposing all capability columns; supervisor death discharges the pending scalar observation and a replacement cannot inherit it. Four strict 299/305-test configurations, native builds, Clippy and private rustdoc pass. Original CI [298](https://git.erikinkinen.fi/erix/procd/actions/runs/298)/[299](https://git.erikinkinen.fi/erix/procd/actions/runs/299) passes from four complete hashed logs, 347,245 bytes, zero warnings. [Bug 5](https://git.erikinkinen.fi/erix/procd/issues/5) remains open for actual service acceptance. Rootd [64c97b13c450003d9c2b6bd9ed2a627088684b46](https://git.erikinkinen.fi/erix/rootd/commit/64c97b13c450003d9c2b6bd9ed2a627088684b46) in [WIP PR 2](https://git.erikinkinen.fi/erix/rootd/pulls/2) acknowledges bootstrap evidence only after exact native destruction and local endpoint absence; both operations remain unavailable after temporary Process custody transfers to Procd. Four strict 430/429-test configurations, native builds, Clippy and private rustdoc pass. Original 1039/1040 exposed [bug 7](https://git.erikinkinen.fi/erix/rootd/issues/7): a stale source-call inventory and its matching semantic operation declarations. The correction explicitly inventories acknowledgement consumers and preserves the same temporary route and eventual Procd owner. All 64 Python controls, production-boundary, semantic baseline, threat model, phase contract and operation-ownership gates pass. Corrected original CI [1041](https://git.erikinkinen.fi/erix/rootd/actions/runs/1041)/[1042](https://git.erikinkinen.fi/erix/rootd/actions/runs/1042) passes from four complete verified logs, 222,969 bytes, zero warnings. Bug 7 is corrected; failed original runs remain retained without reruns or weaker gates. Docs [e4525848ad4462901c9a6794ef1794cf85ea9e6b](https://git.erikinkinen.fi/erix/docs/commit/e4525848ad4462901c9a6794ef1794cf85ea9e6b) updates the native contract, Procd/Rootd consumer custody and original signed IPC API references. Selector 55 is retired in both the detailed contract and summary; 58/59/60 are cross-checked against the shared registry. All 45 documentation tests and generated-reference checks pass. The complete 2,431-page manual builds without warnings; changed prose, selector and API pages pass visual review. Original documentation CI [995](https://git.erikinkinen.fi/erix/docs/actions/runs/995)/[996](https://git.erikinkinen.fi/erix/docs/actions/runs/996) and corrected-table [997](https://git.erikinkinen.fi/erix/docs/actions/runs/997)/[998](https://git.erikinkinen.fi/erix/docs/actions/runs/998) passes from eight complete logs, 1,549,628 bytes, with zero warnings in the final LaTeX passes. The 37 earlier convergence candidates per manual log are retained and resolved. The separate Integration orchestration library checkpoint [b06dfad00202765491a64552dde29eaca1c24838](https://git.erikinkinen.fi/erix/integration/commit/b06dfad00202765491a64552dde29eaca1c24838) passes four strict 320/321-test host/native configurations. Full service catalogs remain on their prior coherent graph while 35 remaining application/service repositories adopt the original shared revisions. Integration 1697/1698 remains running, and 1699/1700 plus 1701/1702 waits at the latest bounded observations. These are pending full regressions, not successful runtime acceptance. No new canonical acceptance leaf is closed: 15/460 and 3.48% weighted. Ordinary Launchd metric-consumer restart/disposal semantics, coherent service CPU/profiler VMs, complete realm/provider authority and I/O, source/effect/frame proof, Pagerd, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. The static audit finds 3,162 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 173 direct missing-docs gates and 92 conventional crate roots; this does not establish semantic authority or complete private-documentation closure. Original acknowledged service catalog — 21 September 2026: Signed [dff878dd3545c4751b3c05d37b2bdd5e21cce548](https://git.erikinkinen.fi/erix/integration/commit/dff878dd3545c4751b3c05d37b2bdd5e21cce548) selects the original terminal-observation, exact-acknowledgement and final CPU dependency graph in both complete catalogs. All 35 application/service checkpoints are signed; the bounded VFS checker correction and its manual are included. Clean original checkouts pass manifest/catalog equality and signature checks. Exsh's release compiler and complete frame gates remain explicitly open in [issue 9](https://git.erikinkinen.fi/erix/exsh/issues/9) and [issue 4](https://git.erikinkinen.fi/erix/exsh/issues/4). All 169 maintained helper commands pass with recorded source and stream identities. The original stale memory-source rejection, quiet storage-fixture timeout and overly long socket-fixture path remain retained. Their respective corrected inputs use the explicitly verified original memory checkout, the previously maintained traced disk invocation (258.975743 seconds under unchanged 600/120 bounds), and a fresh owned shorter temporary directory (all 14 socket controls pass without changing the Unix pathname limit). None of these setup corrections changes test sources or bypasses source, timing or cleanup checks. The unchanged orchestration library retains all four strict 320/321-test configurations; formatting, policies and Markdown pass without warnings. The published runner and original full source graph are prepared for the maintained shell CPU-accounting, two-CPU inspection and out-of-session denial scenarios. Actual VM evidence remains pending and no full guest-build acceptance is awarded. Original CI [1703](https://git.erikinkinen.fi/erix/integration/actions/runs/1703)/[1704](https://git.erikinkinen.fi/erix/integration/actions/runs/1704) is being monitored without restart. Complete authority/source/effect/frame and Pagerd gates, native external Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain mandatory in [Phase 6 completion](https://git.erikinkinen.fi/erix/integration/issues/65). Actual service CPU scenarios and startup admission — 21 September 2026: The published original Integration catalog `dff878dd3545c4751b3c05d37b2bdd5e21cce548` passes the maintained shell times, two-CPU Extop and out-of-session denial VM scenarios under their unchanged 120-second guest limits. Each retains 106 hashed evidence files, warning-free image builds, empty QEMU stderr and every required, forbidden, ordered and unique marker check. Build-plus-scenario wall times are 119.876978, 34.802620 and 36.173027 seconds respectively; these are not guest-only or startup measurements. Times reports nonzero self and waited-child CPU. Extop observes both CPUs, memory and increasing job CPU nanoseconds with `CTRL no`; both per-CPU percentages remain `--.--%` in the two samples, so numeric utilization is unproven. The denial scenario confirms the existing out-of-session boundary. Complete mediator/lifecycle acceptance in [Procd 5](https://git.erikinkinen.fi/erix/procd/issues/5) remains open. A separate ordinary development package also builds without warnings, but its required startup-contract preflight exits 1 before any VM or observer starts. [Integration 69](https://git.erikinkinen.fi/erix/integration/issues/69) records the missing full-runtime-transition contract selections and Kernel effective-feature/original-source evidence. Preserve the refused package and all admission controls; the 120/15/10 capture limits and performance thresholds are unchanged. No startup-profile acceptance is awarded. Complete source/effect/frame and Pagerd proof, native external Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain required by [Phase 6 completion](https://git.erikinkinen.fi/erix/integration/issues/65). Signed startup source/feature correction — 21 September 2026: Integration [fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa](https://git.erikinkinen.fi/erix/integration/commit/fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa) requires the complete runtime transition in both Rootd and its orchestration policy. The direct Kernel builder records the actual local compiler feature closure, compares original source before and after linking, and includes source identity in its cache key. Contract v2 requires the Kernel revision/tree and actual artifact/metadata binding; old receipts, synthetic wrappers and modified source cannot acquire this declaration. This remains local observed provenance, not publisher authentication or complete compiler closure. All 171 maintained helper commands have successful, warning-free final evidence. Eight new Kernel controls cover original trees, actual cfg closure, changed inputs, hidden/redirected source, custom builds, synthetic wrappers and cache identity. Sixteen fixture readers/writers now close files explicitly; [bug 71](https://git.erikinkinen.fi/erix/integration/issues/71) retains the original 36 resource warnings from 15 exit-zero commands. The previously unlisted filesystem-mirror fixture now participates in CI. Earlier Markdown failures also remain retained. Formatting, source policy and final Markdown pass; identical Rust inputs retain four strict orchestration matrices. The technical manual update [76672dff8ff83](https://git.erikinkinen.fi/erix/docs/commit/76672dff8ff83b04914abe3c8f4b08b13835144f) passes 45 tests, 2,431 pages, 450,096 word bounds and both changed-page visual reviews. Original Docs [1001](https://git.erikinkinen.fi/erix/docs/actions/runs/1001)/[1002](https://git.erikinkinen.fi/erix/docs/actions/runs/1002) passes from four complete logs totaling 774,770 bytes. Each manual log retains its earlier reference-convergence warnings; final LaTeX passes have no warnings or layout overflow. A fresh ordinary package from the signed Integration runner is under construction. Actual corrected image admission and startup capture remain pending under [bug 69](https://git.erikinkinen.fi/erix/integration/issues/69); no threshold or 120/15/10 capture limit changes. Original Integration [1705](https://git.erikinkinen.fi/erix/integration/actions/runs/1705)/[1706](https://git.erikinkinen.fi/erix/integration/actions/runs/1706) is monitored separately. Native external Rust/LLVM/runtime rebuilding and both complete EriX guest build generations remain mandatory. Actual original-source startup capture — 21 September 2026: Signed Integration [fd8a5cf0dbcf](https://git.erikinkinen.fi/erix/integration/commit/fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa) builds the ordinary image without warnings and its actual Kernel-bound contract passes preflight. The VM and complete observer finish with all required stages, zero dropped records, empty QEMU stderr, successful cleanup and unchanged source image. Admission bug 69 is resolved independently of performance. The strict timing gate fails: root-to-final readiness 5.974133160 seconds (limit 5), largest service interval 3.098663889 (limit 1), final readiness to caret 1.262470092 (limit 1), and four native commands 4.769234506 (limit 2). The maintained offline profiler identifies RTC-provider to TTYD as the largest service interval, followed by roughly one-second Powerboxd and Launchd intervals. These are host observation windows, not loader-only causal measurements. [The new canonical timing bug](https://git.erikinkinen.fi/erix/integration/issues/72) retains the exact image, timing and command identities and every original limit. Host/toolchain description fields remain explicitly incomplete; no provenance or speedup is invented. The sixteen helper stream-custody corrections also pass all changed controls; all 171 selected helper commands have successful warning-free final evidence. Bug 71 is resolved with its original 36 warnings retained. Full CI for 1705/1706 remains separately monitored. No startup-performance or full native toolchain/EriX guest-build acceptance is awarded. Coherent scalar-consumer validation — 21 September 2026: signed [Integration 07c883525ee5](https://git.erikinkinen.fi/erix/integration/commit/07c883525ee5e23378008232760d045f74f60d32) selects [Procd 59ee30a88534](https://git.erikinkinen.fi/erix/procd/commit/59ee30a885346db4db8c8791a23c15694f2a90a8) in both complete catalogs. All 171 maintained helper commands pass without warnings; unchanged orchestration inputs retain four strict matrices. Five actual service VMs pass: shell CPU accounting, exec successor replacement, two-CPU read-only inspection, out-of-session denial and guarded realm preparation. Each preserves 106 hashed evidence files, clean QEMU stderr, warning-free image builds and all original markers under the unchanged 120-second guest limit. The build-plus-scenario times are 119.746880, 38.325332, 35.346729, 35.773237 and 55.339698 seconds respectively; these are not guest performance measurements. Inspection reports increasing job CPU counters with control disabled; numeric CPU utilization remains unproven. Procd's four strict 308/314-test configurations and original CI 302/303 pass. The [manual update](https://git.erikinkinen.fi/erix/docs/commit/2d05169e6974a495eab80b62edf0f23d1ad667da) passes 45 tests, all 2,431 pages, 450,185 word bounds and changed-page visual review. Original Docs CI 1003/1004 passes from four complete logs (774,710 bytes); retained reference-convergence warnings resolve to zero on final passes. All 3,166 authored code files remain below 1,000 lines. Original Integration 1701/1702 remains running; 1703–1710 remains queued. Logd 240 remains failed with terminal logs unavailable through HTTP 500; no cause is inferred. No original job was restarted or cancelled. Remaining lifecycle control/event ownership, complete native fault/cleanup acceptance and the measured startup timing failures remain open. No whole acceptance leaf closes: 15/460, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain inside EriX and using it in the required full EriX guest-build generations remain mandatory and unproven. Executed-code profiling checkpoint — 22 September 2026: signed [Integration 4fa27f942bc2](https://git.erikinkinen.fi/erix/integration/commit/4fa27f942bc2c6511eedceb5b20b8212f2bc94b0), tracked in [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12), adds bounded host TCG execution counters, explicit fresh-output ownership and exact packaged-ELF code candidates without adding guest authority. All 172 maintained helper commands pass without warnings. The profiler passes five Rust tests in both profiles, strict Clippy, private rustdoc, eleven Python controls and five actual selected-emulator controls. Unchanged orchestration inputs retain their preceding four strict matrices. The [operator guide](https://git.erikinkinen.fi/erix/integration/src/commit/4fa27f942bc2c6511eedceb5b20b8212f2bc94b0/docs/tcg-profiling.md) distinguishes complete counters from VM acceptance. One original-image diagnostic retains 92,896 translated blocks, 1,994,216 code bytes and zero missed execution counts. Its top 100 code groups cover 85.65% of the translated instruction upper bound; 33.30% has Kernel mapping-batch candidates and 7.70% has VSpace permission-switch candidates among the selected ELF inputs. Unknown and ambiguous work remains visible. These are code matches, not process ownership or elapsed-time attribution. Both the instrumented attempt and its same-emulator uninstrumented control fail waiting for the final native-command marker under unchanged 120/15/10 collection bounds. Neither proves startup acceptance, whole-transcript instrumentation overhead or a speedup. [Profiler acceptance](https://git.erikinkinen.fi/erix/integration/issues/3) and [startup performance](https://git.erikinkinen.fi/erix/integration/issues/72) remain open. The next optimization must preserve complete validation, live backing checks, page permissions, invalidation ordering and cleanup on errors. The signed [manual update](https://git.erikinkinen.fi/erix/docs/commit/1ade28490f4577bbf618f4cec49debf1f747aa6d), tracked in [Docs PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4), passes 45 tests, all 2,431 pages, 450,367 word bounds and both changed-page visual reviews with zero final warnings or overflow. Original Docs CI 1005/1006 passes from four complete logs (774,674 bytes); initial reference-convergence warnings resolve on the final passes. Integration 1711/1712 is queued, while original 1701/1702 still runs. Existing queued jobs remain untouched. All 3,174 authored code files remain below 1,000 lines. No whole acceptance leaf closes: 15/460, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain inside EriX and completing the required full guest-build generations remain mandatory and unproven. Native table-custody checkpoint — 22 September 2026: signed [Kernel 2e744897de7c](https://git.erikinkinen.fi/erix/kernel/commit/2e744897de7c330d3d095a65daed761a4e4a9406), in [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3), gives unpublished table allocations one cleanup owner through translation and initialization. Empty-table installation and huge splits transfer custody at parent publication. The raw allocation-return helper and duplicate huge-split initialization are removed. Parent/leaf invalidation, interrupt masking, permission templates and current shared-hierarchy lifetime remain intact. Five host controls cover allocation/translation failure, invalid geometry, abandoned preparation and publication. Four strict configurations pass 742 default / 766 all-feature tests, retaining three existing ignored cases; formatting, host/native Clippy, private rustdoc and thirteen native builds pass without warnings. Original Kernel CI 630/631 passes from four complete logs, 771,607 bytes and zero warnings. Signed [Integration fe63adde8ff9](https://git.erikinkinen.fi/erix/integration/commit/fe63adde8ff9529faf1261dbd5da3d7f39c0f2a6), in [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12), selects that exact Kernel in all three catalogs. Every other selection and Kernel dependency manifest is unchanged. All 172 maintained helper commands pass without warnings; unchanged Rust inputs retain their preceding strict matrices. Three original-source native executions pass lifetime revocation, owned invocation and mapping checks with unchanged 60-second guest limits, warning-free builds and empty QEMU stderr. Mapping isolation and sparse mappings have identical runtime settings; both maintained marker contracts pass on the retained mapping capture. All fifteen selected component signatures verify, and each packaged Kernel image equals its retained artifact after normal stripping. These results cover the current shared hierarchy, not independent hardware roots. The [Kernel evidence update](https://git.erikinkinen.fi/erix/kernel/commit/f50535bfcd9aa57271762bb0b4da7d759d08906e) and [Integration evidence update](https://git.erikinkinen.fi/erix/integration/commit/1621164b93a7705eae381ff95aeec59b4e9527c3) change documentation only, with executable inputs proven unchanged. Their original Kernel CI 632/633 is running and Integration 1715/1716 is queued. Older full Integration CI 1701/1702 at b06dfad00202765491a64552dde29eaca1c24838 passes from six complete logs, 26,962,712 bytes and zero warnings, including both runs' ext4 quota, ext4 links and FAT32 directory-metadata cases. Their earlier timing failures remain retained with unestablished causes; [18](https://git.erikinkinen.fi/erix/integration/issues/18), [20](https://git.erikinkinen.fi/erix/integration/issues/20) and [70](https://git.erikinkinen.fi/erix/integration/issues/70) have exact follow-up observations. No workflow was rerun or cancelled. All 3,176 authored code files remain below 1,000 lines. The next work in [Kernel 22](https://git.erikinkinen.fi/erix/kernel/issues/22) must resolve the supervisor baseline, bootstrap/saved-frame overlays and inactive-space population before adding root ownership, residency and retirement. Startup timing acceptance, complete authority cleanup and the profiler's measured speedup remain open. The [phase checklist](https://git.erikinkinen.fi/erix/integration/issues/65) stays at 15/460 accepted leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven. Ordinary mapping-domain checkpoint — 22 September 2026: [resolved admission report](https://git.erikinkinen.fi/erix/kernel/issues/23) records the original host failure and bounded fix. The [fixture regression](https://git.erikinkinen.fi/erix/kernel/issues/24) retains all three distinct failed attempts and the verified layout correction. [Kernel](https://git.erikinkinen.fi/erix/kernel/commit/ef3fd9293eaf691269fdb9e6b72eb15dac1f3f06) now validates the complete ordinary user page before backing or mapping changes, with both control paths covered. Four strict 745/769-test configurations, thirteen native builds, Clippy and private rustdoc pass without warnings. Three exact-source native executions pass lifetime, invocation and mapping; four maintained scenario contracts are checked, with sparse and isolation sharing their identical runtime capture. All fifteen selected native signatures and packaged Kernel identities verify. [Integration](https://git.erikinkinen.fi/erix/integration/commit/cd560584d034720ac179d5abc6f2a9d965943c63) pins the exact Kernel in all three catalogs, preserves every other selection and passes all 172 helpers. The unchanged ordinary exec-successor VM passes against the complete source graph, preserving its 120-second guest deadline, with no image warnings or QEMU stderr. [Docs](https://git.erikinkinen.fi/erix/docs/commit/043df99baaa9d4539da627fbfe4a234e41e74135) documents the domain and bootstrap distinction; all 45 tests and 2,431 pages pass, with 450,473 word bounds checked and no final warnings. The earlier Kernel CI 632/633 passes from four complete logs and zero warnings; current original CI remains under observation. Bootstrap provenance, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. VSpace MAP authority checkpoint — 22 September 2026: [the resolved bug report](https://git.erikinkinen.fi/erix/kernel/issues/25) records three original failing host controls and the verified correction in [Kernel](https://git.erikinkinen.fi/erix/kernel/commit/9fdf1a17acc9204719fee42d263dacfcd701d56c). Current local MAP rights now govern map, protection and unmap requests. Empty and MANAGE-only aliases are denied; MAP-only access remains valid. Four strict 750/774-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings. The [Integration catalog](https://git.erikinkinen.fi/erix/integration/commit/c62dbf9d7096d41b5d073bc497949e16f5f16e13) selects the exact signed Kernel in all three catalogs and passes all 172 helpers. Actual CPL3 calls preserve the authorized RW/NX page across restricted-alias refusals and drop all five temporary grants. Three native executions cover all four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signed sources and retained packaged artifacts. The original exec-successor service VM passes against all 73 components with its unchanged 120-second guest limit. All image warnings and QEMU stderr remain absent. [Manual validation](https://git.erikinkinen.fi/erix/docs/commit/a96c994750ed10205e7bac17be6922a53070e2d6) passes 45 tests, 2,431 pages and 450,550 checked word bounds, with both changed pages reviewed and zero final warnings. The static audit covers 3,181 authored code files below 1,000 lines, 259 exact Git dependency pins and existing direct missing_docs gates. It does not close semantic authority review. Earlier full Integration runs 1705/1706 are running; 1707–1720 remain queued at the latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel [638](https://git.erikinkinen.fi/erix/kernel/actions/runs/638)/[639](https://git.erikinkinen.fi/erix/kernel/actions/runs/639) and Docs [1009](https://git.erikinkinen.fi/erix/docs/actions/runs/1009)/[1010](https://git.erikinkinen.fi/erix/docs/actions/runs/1010) pass. Each pair has four complete logs: Kernel totals 777,250 bytes with zero warnings, and Docs totals 774,674 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration [1721](https://git.erikinkinen.fi/erix/integration/actions/runs/1721)/[1722](https://git.erikinkinen.fi/erix/integration/actions/runs/1722) remains queued; it receives no CI acceptance credit. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven. Frame access checkpoint — 22 September 2026: [the resolved bug report](https://git.erikinkinen.fi/erix/kernel/issues/26) records three original failing host controls and the verified correction in [Kernel](https://git.erikinkinen.fi/erix/kernel/commit/6671466a84cdc4994384e1b8391d6a01fa66fb09). Explicit READ now governs admission and hardware activation. No-access mappings retain backing with USER/WRITE clear and NX set; write-only and execute-only requests are rejected without adding READ. Existing protection-transition rules remain in force. Four strict 757/781-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings. The [Integration catalog](https://git.erikinkinen.fi/erix/integration/commit/b45edf143f599699f80e70a13827762d3e4da77e) selects the signed Kernel in all three catalogs and passes 172 helpers. Twenty-four actual CPL3 calls preserve earlier witnesses and cover no-access protection, write-only refusal, MAP-only frame derivation, denied READ and unmap after both frame grants are dropped. Three native executions pass four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signatures and retained packaged artifacts. The ordinary exec-successor VM passes against all 73 components with its unchanged 120-second guest limit. Builds emit no warnings and QEMU stderr is empty. [Manual validation](https://git.erikinkinen.fi/erix/docs/commit/45dae3cee4116b9387c4f3d3d2687a87f0fa340b) passes 45 tests, 2,433 pages and 450,702 checked word bounds, with the changed page reviewed and zero final warnings. Static review covers 3,182 authored code files below 1,000 lines, 259 exact Git pins and existing direct missing_docs gates. This does not close semantic authority review. Earlier full Integration runs 1705/1706 remain running and 1707–1722 remain queued at their latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel [640](https://git.erikinkinen.fi/erix/kernel/actions/runs/640)/[641](https://git.erikinkinen.fi/erix/kernel/actions/runs/641) and Docs [1011](https://git.erikinkinen.fi/erix/docs/actions/runs/1011)/[1012](https://git.erikinkinen.fi/erix/docs/actions/runs/1012) pass. Each pair has four complete logs: Kernel totals 782,838 bytes with zero warnings, and Docs totals 775,110 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration [1723](https://git.erikinkinen.fi/erix/integration/actions/runs/1723)/[1724](https://git.erikinkinen.fi/erix/integration/actions/runs/1724) remains queued; it receives no CI acceptance credit. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Authorized protection restoration, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. Ordinary protection contract — 22 September 2026: [the runtime memory design](https://git.erikinkinen.fi/erix/kernel/issues/1) now specifies in-place no-access/R/RW/RX changes using current VSpace MAP and exact selected frame authority, including same-backing aliases and complete backing checks. Preserve W^X, explicit READ, object kind, reference custody, error ordering and all native witnesses. Kernel-owned anonymous loader materialization and Process endpoint target scope retain separate audit obligations. The implementation and exact-source VM evidence are pending. This earns no canonical acceptance credit; external toolchain rebuilding and both complete EriX guest-build generations remain mandatory. Older VM regression observation — 22 September 2026: [the ext4 deadline report](https://git.erikinkinen.fi/erix/integration/issues/73) preserves original Integration CI 1705/1706 at `fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa`. The complete 489-scenario catalog reports 482/7 and 485/4 pass/fail outcomes; eleven actual 120-second QEMU timeouts cover eight distinct ext4 scenarios. Rust 320/321-test configurations and Markdown pass. All six complete original logs are retained without warning candidates. Root cause, isolated reproduction and correction remain open; no rerun or relaxed limit supplies acceptance. External toolchain rebuilding and both complete EriX guest-build generations remain required. Current-grant protection checkpoint — 22 September 2026: [the resolved device-backing report](https://git.erikinkinen.fi/erix/kernel/issues/27) distinguishes its original metadata-authority inconsistency from the separate restoration feature gaps. The [Kernel implementation](https://git.erikinkinen.fi/erix/kernel/commit/f5dd939c462de9d62f317ab7d29c21779cbe11c7) permits representable no-access/R/RW/RX changes through current exact-backing grants and aliases while active or inactive. It removes historical access ceilings and original-slot equality while preserving current VSpace MAP, selected frame rights, kind/range/identity checks, W^X, explicit READ, backing custody and failure ordering. Four strict 766/790-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings. The [coordinated catalog](https://git.erikinkinen.fi/erix/integration/commit/8a9f865364656351fd8b12914e404a97b0be11c7) selects that original signed Kernel in all three catalogs and passes all 172 helpers. Fifteen managed-frame calls and twenty-nine device/domain calls pass inside the original lifetime window and deadline. Actual user instructions write, execute, rewrite and execute managed RAM, check narrow alias authority and final disposal, while a reused device slot cannot authorize unrelated backing. Every prior marker remains required. Three native executions pass four original contracts with complete signed source and artifact checks; the ordinary exec-successor VM passes the full 73-component graph and original 120-second limit. Image warnings and QEMU stderr are absent. [Manual validation](https://git.erikinkinen.fi/erix/docs/commit/155b2a0cd2771cb45fa881155baf2cd0f1d1db27) passes 45 tests, 2,433 pages and 450,954 word bounds; both changed pages are reviewed with no final warnings or overflow. Static review covers 3,184 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins and 174 direct missing_docs gates. Full semantic authority review remains open. [Older Integration CI 1705/1706](https://git.erikinkinen.fi/erix/integration/issues/73) has eleven real ext4 timeouts across eight scenarios, with complete retained logs and no accepted rerun. Their root cause and correction remain unresolved. Publication CI: Kernel [642](https://git.erikinkinen.fi/erix/kernel/actions/runs/642)/[643](https://git.erikinkinen.fi/erix/kernel/actions/runs/643) and Docs [1013](https://git.erikinkinen.fi/erix/docs/actions/runs/1013)/[1014](https://git.erikinkinen.fi/erix/docs/actions/runs/1014) pass. Each pair has four complete original logs: Kernel totals 790,650 bytes with 766/790 tests and zero warning candidates; Docs totals 775,150 bytes with 45 tests, 2,433 pages and zero final warnings or overflow. Retain the original 35/1/0 LaTeX warning convergence. Integration [1725](https://git.erikinkinen.fi/erix/integration/actions/runs/1725)/[1726](https://git.erikinkinen.fi/erix/integration/actions/runs/1726) remains queued and receives no completed CI acceptance. The separate older ext4 deadline report remains open. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Complete POSIX protection support, Process endpoint scope, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. VSpace ownership preparation — 22 September 2026: Live VSpace records and production mapping tables are non-cloneable. Test observations contain descriptive metadata, synthetic selectors use independent tables, and leaf-encoder checks borrow live mappings under the record lock. Selectors accept only the mapping table they consume. Current grants, backing custody, first-match ordering, reference scans and hint visit-count controls remain intact; the rights control now uses actual activation/deactivation. The former whole-record snapshot helpers are removed. Four strict Kernel configurations pass 766/790 tests with three existing ignored cases; thirteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. All 172 Integration helpers pass. Three exact-source native executions pass the four maintained mapping, sparse, invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Original 60/120-second guest limits, existing markers, exact component signatures and retained packaged artifacts remain required; image warnings and QEMU stderr are absent. No startup speedup or independent hardware-root acceptance is inferred. The [Kernel implementation](https://git.erikinkinen.fi/erix/kernel/commit/fa9491c65d173fa618c4c0ad241a5c4fe93d28e2) and [Integration source selection](https://git.erikinkinen.fi/erix/integration/commit/c17d8f1f18f55c0d159a80772ab8e5bbad8d7f04) are published with [Kernel validation evidence](https://git.erikinkinen.fi/erix/kernel/commit/14e38ec244976759214a5421c659de9b6f27beaf) and [Integration validation evidence](https://git.erikinkinen.fi/erix/integration/commit/29d778de650ba665b1ad9f143c12ef22baf62cbc). Continue under [owned-root design 22](https://git.erikinkinen.fi/erix/kernel/issues/22), [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3) and [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). Publication CI: Kernel [644](https://git.erikinkinen.fi/erix/kernel/actions/runs/644)/[645](https://git.erikinkinen.fi/erix/kernel/actions/runs/645) pass with four complete original logs (790,604 bytes), 766/790 tests and zero warning candidates. Integration [1727](https://git.erikinkinen.fi/erix/integration/actions/runs/1727)/[1728](https://git.erikinkinen.fi/erix/integration/actions/runs/1728) remains queued and has no completed acceptance; earlier ext4 deadlines remain tracked in [Integration report 73](https://git.erikinkinen.fi/erix/integration/issues/73). Complete authority cleanup, external toolchain rebuilding within EriX and both full guest build generations remain open. Canonical acceptance remains 15/460 leaves (3.48% weighted). Managed-frame diagnostic recovery — 22 September 2026: [Kernel report 28](https://git.erikinkinen.fi/erix/kernel/issues/28) is resolved by the [signed correction](https://git.erikinkinen.fi/erix/kernel/commit/bc49d6da2684dae6073a03c422e0ea2265d03f31) and [coordinated catalog](https://git.erikinkinen.fi/erix/integration/commit/69a1303d848d629efebcc532fff73457c3ab834f). The diagnostic admits an initially empty lower-half window while preserving the ordinary-domain guard and all 64-page, alias, hole, physical-byte and cleanup controls. The unnecessary heap allocation and raw-pointer cleanup state are removed, with expanded inline rustdoc. Four strict 766/790-test configurations, fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. All 172 Integration helpers pass. Both maintained allocator scenarios pass independently with their original 60/120-second deadlines and complete markers; exact signed source and retained packaged-ELF checks pass. The ordinary exec-successor VM also passes against all 73 components. Image warnings and QEMU stderr are absent. The original failed native image remains retained; no unchanged rerun is used as the correction. Static review still covers 3,186 code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Full semantic authority and inline-documentation review remain open. Older original Integration [1707](https://git.erikinkinen.fi/erix/integration/actions/runs/1707)/[1708](https://git.erikinkinen.fi/erix/integration/actions/runs/1708) both pass all 489 VM scenarios, Rust 320/321 and Markdown; six complete logs total 26,966,330 bytes with zero warning candidates. Publication CI: Kernel [646](https://git.erikinkinen.fi/erix/kernel/actions/runs/646)/[647](https://git.erikinkinen.fi/erix/kernel/actions/runs/647) pass with four complete original logs (790,634 bytes), 766/790 tests and zero warning candidates. Integration [1729](https://git.erikinkinen.fi/erix/integration/actions/runs/1729)/[1730](https://git.erikinkinen.fi/erix/integration/actions/runs/1730) remains queued and has no completed acceptance; [earlier ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. The separate supervisor physical-access window and independent hardware roots remain implementation work. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. Supervisor physical-access window — 22 September 2026: the [signed Kernel implementation](https://git.erikinkinen.fi/erix/kernel/commit/046951899b8064be1cc90667a73e5abd2faa51ec) shares one restoring supervisor scratch transaction between frame scrubbing and physical mapping-byte copies. Caller backing custody and page-table/interrupt custody remain live through byte access, exact leaf restoration and local invalidation. Scratch is released afterward; read aliases clear the write bit and all temporary aliases clear user access and set NX. The unreachable raw-VA fallback is removed, and complete preflight rejects missing or ambiguous backing metadata before any range effects. No new userspace operation or capability grant is introduced. This is preparatory work for [owned address spaces](https://git.erikinkinen.fi/erix/kernel/issues/22); independent roots and their switching/reclamation proof remain open. Eight added host controls cover geometry, permissions, preparation and partial-effect failures, restoration/release ordering, and malformed later-page metadata without partial reads or writes. Four strict host configurations pass 774/798 tests with three existing ignored cases. Fourteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. The [coordinated Integration catalog](https://git.erikinkinen.fi/erix/integration/commit/4fe89e021e08e45e3a9ecb1c939aba03f90e5fb1) passes all 172 maintained helpers; its exact marker expectation is updated alongside the strengthened scenarios. Unchanged orchestration and profiler sources retain strict validation. Six native executions satisfy seven maintained scenario contracts. Both allocator scenarios require the new same-VA/different-backing byte-and-leaf proof after complete cleanup, retaining every preceding marker and the original 60/120-second deadlines. Three further executions satisfy mapping, sparse, owned-invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Exact original signed source, retained artifacts and packaged Kernel matches are verified; no image warnings or QEMU stderr were observed. These checks establish no performance improvement. The [technical manual](https://git.erikinkinen.fi/erix/docs/commit/589449e4172b48e31a889c82addc83096a94e02d) documents backing and scratch custody; all 45 document tests and the complete manual build pass without final warnings. Static checks cover 3,190 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Complete semantic authority and inline-documentation review remain open. Publication CI: Kernel [648](https://git.erikinkinen.fi/erix/kernel/actions/runs/648)/[649](https://git.erikinkinen.fi/erix/kernel/actions/runs/649) and Docs [1015](https://git.erikinkinen.fi/erix/docs/actions/runs/1015)/[1016](https://git.erikinkinen.fi/erix/docs/actions/runs/1016) pass. Eight complete original logs (1,572,758 bytes) confirm Kernel 774/798 tests, 45 document tests and the 2,433-page manual. Initial TeX reference warnings resolve through normal multipass generation; final passes are clean. Integration [1731](https://git.erikinkinen.fi/erix/integration/actions/runs/1731)/[1732](https://git.erikinkinen.fi/erix/integration/actions/runs/1732) remains queued and has no completed acceptance. [Earlier ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and its runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. Owned supervisor baseline — 22 September 2026: the [signed Kernel implementation](https://git.erikinkinen.fi/erix/kernel/commit/0f5049592f7801b2a2d92b1290fdcc655952f72f) captures and verifies independently allocated supervisor tables before root VSpace creation, Rootd preparation and RAM seeding. Each copied page has one typed aligned Box owner before a parent references it; the recursive entry selects the copied root. Source boot/AP tables and mapped backing retain separate custody. User leaves, malformed geometry and invalid recursive identity are refused. Leaf permissions, cache policy and huge-page sizes are preserved; newly owned table branches use WriteBack and clear USER. Failed construction releases all unpublished allocations. This replaces a raw-pointer table-storage owner with shared typed storage and adds no unsafe Send/Sync implementation or userspace operation. Eleven new host controls cover independent storage, allocation/read failures, invalid translation geometry, user leaves, recursive and huge-page errors, source-permission drift, retained owner links and table counts beyond the unrelated 64-page batch size. Four strict host configurations pass 785/809 tests with three existing ignored cases; fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The [coordinated catalog](https://git.erikinkinen.fi/erix/integration/commit/122a3d77f7f879c32eba45ccdf2eba2fd9f8d3db) passes all 172 maintained helpers. Both allocator scenarios require successful baseline capture before their original marker sequence, with capability grants and original 60/120-second deadlines preserved. Six native executions satisfy seven maintained contracts: both allocator scenarios, mapping and sparse checks sharing identical runtime settings, owned invocation, lifetime revocation and ordinary exec-successor across all 73 components. Exact signed source and retained packaged artifacts are verified; no image warnings or QEMU stderr were observed. The [technical manual](https://git.erikinkinen.fi/erix/docs/commit/18b8b7160fc2f058f059ea3c41adeca5846f9f69) specifies the custody boundary and passes 45 tests, complete 2,433-page generation, all 451,287 word bounds and changed-page visual review without final warnings or overflow. Static audits cover 3,194 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Publication CI: original Kernel [push 650](https://git.erikinkinen.fi/erix/kernel/actions/runs/650) passes and [PR 651](https://git.erikinkinen.fi/erix/kernel/actions/runs/651) retains the host fixture failure. [Regression 29](https://git.erikinkinen.fi/erix/kernel/issues/29) is resolved by [signed Kernel `12184850cd73`](https://git.erikinkinen.fi/erix/kernel/commit/12184850cd73fff066abcb7f97039a0828b2a928): a deterministic private predecessor reproduces the original defect, and the corrected fixture passes the complete local matrix and [push CI 652](https://git.erikinkinen.fi/erix/kernel/actions/runs/652)/[PR CI 653](https://git.erikinkinen.fi/erix/kernel/actions/runs/653). Four complete corrected CI logs total 807,886 bytes with zero warning candidates. Only host tests and roadmap change; validated production sources and all catalog selections remain unchanged. Docs [1017](https://git.erikinkinen.fi/erix/docs/actions/runs/1017)/[1018](https://git.erikinkinen.fi/erix/docs/actions/runs/1018) pass with four complete logs (775,122 bytes), 45 tests and the 2,433-page manual. Initial TeX reference warnings resolve before clean final passes. Integration [1733](https://git.erikinkinen.fi/erix/integration/actions/runs/1733)/[1734](https://git.erikinkinen.fi/erix/integration/actions/runs/1734) remains queued at the latest retained observation and has no completed acceptance. [Earlier ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. The retained baseline is a construction prerequisite for [owned address spaces](https://git.erikinkinen.fi/erix/kernel/issues/22). Per-VSpace population, CR3 activation, invalidation and live-root reclamation remain open, and no speedup is claimed. Full semantic authority and inline-documentation review also remain open. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. Huge-leaf geometry correction — 22 September 2026: [the bug report](https://git.erikinkinen.fi/erix/kernel/issues/30) preserves four original host failures and one passing WriteBack control. The [signed correction](https://git.erikinkinen.fi/erix/kernel/commit/4f9cfcaeb63e9080f6d6a3e9fd190e6cb288c6fc) separates PAT from physical address bits, preserves permissions/cache indices across both huge splits, and gives newly allocated tables WriteBack policy. Scalar and batched translation, split preparation, snapshots and baseline validation share the documented geometry. No new userspace authority, original native exploit or universal boot failure is claimed. Four strict Kernel configurations pass 796/820 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The [catalog](https://git.erikinkinen.fi/erix/integration/commit/ccc32eed0b4029a1ef82279c665811692c859985) passes all 172 maintained helpers. Six native executions satisfy seven original contracts: mapping and sparse, lifetime, invocation, both allocator checks and ordinary exec-successor across all 73 components. The new native witness verifies real 2 MiB PAT translation, splitting and complete restoration; host controls additionally cover 1 GiB. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The [manual](https://git.erikinkinen.fi/erix/docs/commit/587a280f59e55598e3a26b788d589955ebb84212) passes 45 tests, 2,433 pages and changed-page visual review without final warnings or overflow. Publication CI: Kernel [654](https://git.erikinkinen.fi/erix/kernel/actions/runs/654)/[655](https://git.erikinkinen.fi/erix/kernel/actions/runs/655) and Docs [1019](https://git.erikinkinen.fi/erix/docs/actions/runs/1019)/[1020](https://git.erikinkinen.fi/erix/docs/actions/runs/1020) pass. Eight complete original logs (1,592,794 bytes) confirm Kernel 796/820 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration [1735](https://git.erikinkinen.fi/erix/integration/actions/runs/1735)/[1736](https://git.erikinkinen.fi/erix/integration/actions/runs/1736) remains queued and has no completed acceptance. Earlier [ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. Static audits cover 3,197 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, live-root reclamation and full semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven. First-start register custody — 22 September 2026: [the stack-domain bug report](https://git.erikinkinen.fi/erix/kernel/issues/31) preserves three original host failures and one valid-stack control at unchanged production sources; the same four controls pass against the [signed correction](https://git.erikinkinen.fi/erix/kernel/commit/5bad7a1285089a20ee6425e0335ed3a5e96f7e29). Ordinary anonymous stack materialization now rejects addresses outside the existing user domain, and direct bootstrap writes require retained writable registered backing. Initial registers have Kernel-owned storage; stack preparation preserves the synthetic return slot, complete admission, startup arguments and rollback. The obsolete saved-frame user overlay and directory scan are removed. Complete external start-context admission and the separate bootstrap code/stack overlay remain distinct work. Four strict Kernel configurations pass 807/831 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The [catalog](https://git.erikinkinen.fi/erix/integration/commit/483da1e42cbdc79b56dea6fb0806980a128787b8) passes all 172 maintained helpers. Six native executions satisfy seven original contracts: lifetime, invocation, mapping and sparse, both allocator checks and ordinary exec-successor across all 73 components. The new witness checks all original initial register words after two real user stack mutations and before ordinary syscall capture. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The [manual](https://git.erikinkinen.fi/erix/docs/commit/57bdb2811e2a90d0121ff6de6ab58ff797806b78) passes 45 tests, 2,433 pages and four changed-page visual reviews without final warnings or overflow. Publication CI: Kernel [656](https://git.erikinkinen.fi/erix/kernel/actions/runs/656)/[657](https://git.erikinkinen.fi/erix/kernel/actions/runs/657) and Docs [1021](https://git.erikinkinen.fi/erix/docs/actions/runs/1021)/[1022](https://git.erikinkinen.fi/erix/docs/actions/runs/1022) pass. Eight complete original logs (1,600,791 bytes) confirm Kernel 807/831 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration [1737](https://git.erikinkinen.fi/erix/integration/actions/runs/1737)/[1738](https://git.erikinkinen.fi/erix/integration/actions/runs/1738) remains queued and has no completed acceptance. Earlier [ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. Static audits cover 3,201 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, CPU residency, live-root reclamation and complete semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven.

erikinkinen added the

phase-6

enhancement

docs

labels 2026-09-12 07:56:21 +02:00

erikinkinen referenced this issue 2026-09-12 07:56:23 +02:00

[FEATURE] Maintain bounded profiling and eliminate evidenced startup and build bottlenecks #3

erikinkinen referenced this issue from erix/lib-posixabi 2026-09-12 07:56:23 +02:00

[FEATURE] Define and validate the pure POSIX compatibility ABI #1

erikinkinen referenced this issue 2026-09-12 07:56:24 +02:00

[FEATURE] Admit declared tool payloads through four isolated image profiles #4

erikinkinen referenced this issue 2026-09-12 07:56:24 +02:00

[FEATURE] Unify real serial and PS/2 CLI input and visual acceptance #5

erikinkinen referenced this issue from erix/bootloader 2026-09-12 07:56:24 +02:00

[FEATURE] Enforce firmware-to-rootfs signatures and scoped signing of build outputs #1

erikinkinen referenced this issue from erix/posixd 2026-09-12 07:56:25 +02:00

[FEATURE] Implement isolated compatibility realms and exact grant lifecycles #1

erikinkinen referenced this issue from erix/kernel 2026-09-12 07:56:25 +02:00

[FEATURE] Supply authorized memory, TLS, threads and race-free blocking for runtimes #1

erikinkinen referenced this issue from erix/ttyd 2026-09-12 07:56:25 +02:00

[FEATURE] Complete independent consoles, vttys, TUI, keyboard layouts, mouse and boot logo #1

erikinkinen referenced this issue from erix/dynlinkd 2026-09-12 07:56:28 +02:00

[FEATURE] Load compatibility ELF, TLS, constructors and declared runtime modules safely #1

erikinkinen referenced this issue 2026-09-12 07:56:30 +02:00

[FEATURE] Build and assemble the entire EriX product graph within a confined guest realm #8

erikinkinen referenced this issue 2026-09-12 07:56:30 +02:00

[FEATURE] Demonstrate two complete generations of EriX built inside EriX #9

erikinkinen referenced this issue 2026-09-12 07:56:30 +02:00

[FEATURE] Close final security, documentation, CI and self-hosting acceptance #10

erikinkinen changed title from [FEATURE] [P01] Freeze the complete source, build, ABI and self-hosting inventory to [FEATURE] Freeze the complete source, build, ABI and self-hosting inventory 2026-09-12 08:01:58 +02:00

erikinkinen referenced this issue from erix/lib-cstd 2026-09-12 08:02:05 +02:00

[FEATURE] Implement the C runtime and libc required by the admitted toolchain #1

erikinkinen referenced this issue 2026-09-12 10:14:04 +02:00

[BUG] Build-scope target IDs can collapse distinct Cargo targets #15

erikinkinen referenced this issue 2026-09-12 10:21:05 +02:00

WIP: Coordinate native authority, shell workspace and source transport #12

erikinkinen referenced this issue 2026-09-12 11:03:28 +02:00

[BUG] Cargo setup helpers replace original Git identities with path packages #17

erikinkinen referenced this issue 2026-09-12 13:41:30 +02:00

[BUG] Dynamic kernel build cannot resolve allocation shim symbols with Rust 1.97.1 #19

erikinkinen referenced this issue from erix/lib-ed25519 2026-09-15 15:08:25 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/lib-fs-crypto 2026-09-15 15:08:27 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/lib-partition 2026-09-15 15:13:51 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/sha2-tool 2026-09-15 15:13:54 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/lib-block 2026-09-15 15:29:12 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/lib-bootimg 2026-09-15 15:29:19 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/lib-driver 2026-09-15 15:29:25 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/lib-stdio 2026-09-15 15:29:32 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/lib-tty 2026-09-15 15:29:39 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/boot-tool 2026-09-15 15:59:31 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/coreutils 2026-09-15 15:59:35 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/lib-input 2026-09-15 16:04:41 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/blockd 2026-09-15 16:09:25 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/crashd 2026-09-15 16:09:30 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/drv-acpi 2026-09-15 16:09:35 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/drv-i8042 2026-09-15 16:17:11 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/drv-rtc-cmos 2026-09-15 16:17:12 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/drv-virtio-block 2026-09-15 16:17:16 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/dynlinkd 2026-09-15 16:17:24 +02:00

WIP: Align signed runtime dependencies #3

erikinkinen referenced this issue from erix/extop 2026-09-15 16:24:52 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/fbcond 2026-09-15 16:25:00 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/hotplugd 2026-09-15 16:25:03 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/inputd 2026-09-15 16:25:07 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/irqd 2026-09-15 16:25:12 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/keyd 2026-09-15 16:25:19 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/e2fsd 2026-09-15 18:05:51 +02:00

WIP: Validate filesystem media and explicit build inputs #3

erikinkinen referenced this issue from erix/memd 2026-09-15 18:22:11 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/named 2026-09-15 18:22:15 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/pagerd 2026-09-15 18:22:20 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/powerboxd 2026-09-15 18:22:26 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/ramfsd 2026-09-15 18:22:30 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/seriald 2026-09-15 18:22:37 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/timed 2026-09-15 18:22:44 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/ttyd 2026-09-15 18:22:52 +02:00

WIP: Align signed runtime dependencies #3

erikinkinen referenced this issue from erix/vspaced 2026-09-15 18:23:14 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/drv-ps2-keyboard 2026-09-15 18:23:29 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/drv-ps2-mouse 2026-09-15 18:23:37 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/drv-serial 2026-09-15 18:23:44 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/probed 2026-09-15 18:32:58 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue 2026-09-15 19:23:40 +02:00

[BUG] Standalone dependency setup selects an unusable shallow cache #51

erikinkinen added the

security

refactor

labels 2026-09-15 21:00:36 +02:00

erikinkinen referenced this issue 2026-09-15 21:15:08 +02:00

[BUG] Native image consumer rejects the complete C companion source receipt #52

erikinkinen referenced this issue 2026-09-16 01:29:35 +02:00

[BUG] Release foreground interrupt reuse stops at the VM stall gate #54

erikinkinen referenced this issue 2026-09-16 01:29:35 +02:00

[BUG] Release COM1 shell-line input fails with VM status 125 #55

erikinkinen added the

performance

label 2026-09-16 02:01:20 +02:00

erikinkinen referenced this issue 2026-09-16 02:53:30 +02:00

[BUG] Development COM1 directory probe stops after command injection #56

erikinkinen referenced this issue 2026-09-16 02:53:31 +02:00

[BUG] Workspace producer and catalog shell layouts disagree in 78 scenarios #57

erikinkinen referenced this issue 2026-09-17 09:01:21 +02:00

[BUG] FAT32 mirrored and Unicode VM scenarios exceed their QEMU deadlines #58

erikinkinen referenced this issue 2026-09-17 13:25:30 +02:00

[BUG] Standalone kernel packaging reads an unrelated shell authority catalog #59

erikinkinen referenced this issue 2026-09-17 16:03:56 +02:00

[BUG] Automatic KVM exception VM stalls before EriX boot markers #60

erikinkinen referenced this issue 2026-09-17 20:01:05 +02:00

[BUG] Named idle-time-resolution VM reaches its original QEMU deadline #61

erikinkinen referenced this issue 2026-09-17 20:22:52 +02:00

[BUG] Runtime archive selection depends on filesystem modification time #62

erikinkinen referenced this issue 2026-09-19 11:36:52 +02:00

[FEATURE] Track Phase 6 POSIX compatibility and full EriX self-hosting #65

erikinkinen referenced this issue 2026-09-19 12:22:56 +02:00

[BUG] Native realm-admission diagnostic exits before its success marker #66

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

feature/posix-compat

feature/native-cli

feature/phase-4-audit

feature/dynlink

feature/program-loader

feature/e2fs-fat

feature/block-devices

feature/vfs

feature/centralized-process-authority

ci-feature-posix-compat

nightly

ci-feature-native-cli

ci-feature-phase-4-audit

ci-feature-dynlink

ci-feature-program-loader

ci-feature-e2fs-fat

ci-feature-block-devices

ci-feature-vfs

ci-feature-centralized-process-authority

Labels

Clear labels

  

bug

Something is not working

  

ci

  

docs

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

performance

Measured performance profiling, bottleneck analysis, and regression budgets.

  

phase-6

Phase 6: POSIX compatibility, full EriX self-hosting, and its required audits and validation.

  

question

More information is needed

  

refactor

Code cleanup, removal of obsolete paths, and structural improvements preserving behavior.

  

security

  

wontfix

This won't be fixed

No labels

bug

ci

docs

duplicate

enhancement

help wanted

invalid

performance

phase-6

question

refactor

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

erix/integration#1

No description provided.