[FEATURE] Supply authorized memory, TLS, threads and race-free blocking for runtimes #1

New issue

Open

opened 2026-09-12 07:56:25 +02:00 by erikinkinen · 0 comments

erikinkinen commented 2026-09-12 07:56:25 +02:00

Owner

Copy link

Problem and motivation

Imported Rust/C++ runtimes need real growing heaps, protected mappings, isolated TLS, threads and blocking synchronization. Global errno, spin-only waits and fabricated clocks cannot support correct parallel compilation.

Proposed behavior and scope

Ordinary frame protection through current grants — 22 September 2026

Permit in-place replacement of an ordinary managed/device mapping's access with any state that the architecture can enforce and the selected current frame grant authorizes: no access, R, RW or RX. The same rule applies while inactive or active. WRITE or EXECUTE requires requested READ, and W+X remains prohibited. This removes the need to unmap and recreate a mapping solely to restore access already authorized by the caller's retained capabilities.

The caller-local VSpace capability must carry MAP. The explicitly selected frame capability must independently carry MAP and every requested right; another held alias cannot supplement it. Establish current authority over the exact existing backing: managed mappings require their actual allocation identity and complete page containment, while device mappings require the complete existing physical page to lie inside the selected current device grant. Retained slot numbers, addresses supplied without a grant, and mapping permission metadata cannot replace those checks. Same-backing aliases may authorize protection, including a reused local slot holding a current valid grant to that backing. Unrelated, missing, retired or insufficient grants must fail before mutation; reuse for unrelated backing supplies no authority. Preserve managed/device/anonymous kind boundaries, backing identity and reference counts, original-leaf restoration and failure cleanup.

Use the existing MAP_FRAME request envelope with no new flags, capability type or fallback. Ordinary frame permissions describe current user access, not irreversible sealing of authority the issuer still holds. Irreversible handoff must dispose of the issuer's control grants. Kernel-owned anonymous loader materialization retains its separate internal contract; this work does not by itself implement all POSIX mprotect behavior or narrow the existing Process endpoint's target scope. Document and test those boundaries explicitly.

Acceptance requires paired in-place/unmap-remap controls for R/RW/RX in active and inactive states; same-backing aliases; insufficient, missing and reused grants; managed/device kind separation; complete range bounds; preserved refusal and allocation lifetime. Extend actual CPL3 coverage with an allocator-selected managed frame from the canonical validated boot reservations and usable-RAM inventory. Retire allocator authority before user entry. Actual user instructions must write a function under RW, remove access, restore RX and execute it, restore RW to change its bytes, and execute the changed function under RX. Check selected alias authority, retained mapping custody after final frame-grant disposal, final unmap reclamation, unchanged earlier witnesses and the original caller window and deadline. Preserve batch preparation/error ordering, fresh translation and TLB invalidation. Run all altered repository tests, formatting, strict Clippy, native builds, maintained native/service VMs and warning-free final documentation checks. Preserve original source and artifact identity, update the existing reviews and phase checklist, and monitor the exact CI runs. No performance or complete self-hosting acceptance is inferred from this change.

Staged construction without root capabilities — 15 September 2026

Add kernel-control operation 54, CREATE_STAGED_PROCESS_WITHOUT_ROOT_CAPS, and checked StagedProcessWithoutRootCapsV1 scalar framing. Successful creation returns a live Created process and nonzero generation whose CSpace contains exactly its requested primary endpoint, with no CNode, VSpace or TCB capabilities. Native CSpace/TCB/VSpace objects and the process's VSpace lifetime reference still exist. No child code executes during construction. The endpoint initially retains its ordinary full endpoint rights; operation 53 independently narrows it before bootstrap execution.

Keep the existing creation operation 32 and its producer behavior unchanged. The new selector is independently recognized: an older kernel refuses it, and callers must not fall back to old ignored flags or a child self-report. Admit it only on the existing Process endpoint family, without adding a capability type, endpoint factory or ChildPopulate creation authority.

Use the existing fixed request envelope. arg0 contains the caller-local install-grant destination in its low 32 bits; its upper half is zero. arg1 low/high halves contain child-local primary endpoint and caller-local endpoint-master destinations. arg2 low/high halves contain the child window base and optional caller-local VSpace destination. arg3 contains the 32-bit window length, with a zero upper half. Flag bit 0 means that the VSpace receipt is requested; all other flag bits are zero. When the bit is clear, arg2's upper half must be zero. This explicit presence bit distinguishes an omitted receipt from a real receipt in slot zero. All slot fields retain their full unsigned width; slot zero and otherwise vacant former root positions are ordinary requested slots, subject to native bounds, actual caller-window visibility and occupancy. The checked codec validates framing, not native capacity or authority. The native constructor requires a valid child window containing the primary endpoint.

The caller receives only its actual unique stage-bound install grant, endpoint master and optional MAP-only VSpace receipt. The grant is bound to the returned process/generation and exact child window. Existing capability ceilings, actual object identity and explicit disposal rules remain in force. Temporary native setup bindings must be gone before constructing the final primary endpoint and publishing the grant; otherwise former root positions would remain an unnecessary destination restriction. The TCB's independently held VSpace reference must keep backing alive even without any child or parent VSpace capability.

On failure, destroy the partial child and dispose only successfully created parent receipts. Preserve pre-existing or overlapping destinations and the original failure; uncertain cleanup fail-stops. Never treat a requested slot as evidence that its capability was created. The new contract supplies an initial inventory, not a permanent prohibition on later explicitly authorized installations or a sealed realm. The returned grant remains a real pre-start population authority that its owner must account for and retire.

Required checks include full-width codec/reserved-field cases, omitted versus slot-zero VSpace receipts, zero/former-root/last-slot endpoint destinations, invalid or inaccessible windows, occupied/overlapping outputs, exact parent and child inventories, no residual native objects, mapping/startup backing retention, attenuation through the actual grant and abort/terminal cleanup. Actual CPL3 creation/refusal/disposal must complement host tests. Procd adoption must select this operation only for the mediator role and preserve all ordinary start gates until authenticated grant return, minimum typed startup, retained native/nested guards, readiness, configuration/seal and fair retirement are independently implemented. No runnable realm or guest build is established by this constructor alone.

Native staged endpoint attenuation — 15 September 2026

Add kernel-control operation 53, ATTENUATE_STAGED_ENDPOINT_WITH_GRANT, with a checked ProcessBoundEndpointAttenuationV1 request. This is a new recognized operation; an older kernel must refuse it, and producers must never fall back to an unchecked or post-execution self-report. No syscall number or service endpoint permission is added.

Use the existing fixed KernelControlRequestV1 layout: arg0 low/high halves are the caller's actual install-grant slot and child endpoint destination; arg1 is the exact 32-bit rights mask, with its upper half zero; arg2 low/high halves are expected process and staging generation; arg3 and flags are zero. Both identity components are nonzero. Zero rights means exactly zero, never inheritance. Successful response values are zero.

The native handler must validate the actually held GRANT-bearing install grant, its record, exact expected process/generation, live Created child, grant window, endpoint type ceiling and actual primary endpoint slot. Its rights ceiling must cover the current endpoint rights as well as the requested result; a narrow installer cannot manage a broader existing binding. The new rights must be known, valid for endpoints and a subset of current rights. Update only that existing binding's rights, preserving native object identity, all other bindings and revocation associations. The change allocates no alias and needs no new destination. Repeating the same attenuation may succeed; restoring a removed right must fail. Running, dead, stale, foreign, missing and wrong-type targets must fail without effects.

Admit the operation only on the same Process and ChildPopulate control kinds as exact process-bound installation. Endpoint possession and descriptive IDs alone are insufficient: the actual held scoped grant remains mandatory. The immediate consumer is the future Procd bootstrap transaction, after the actual broad grant returns from Launchd. It will reduce the staged mediator's initial full endpoint to RECV before any private execution, providing independent native proof of that boundary.

Required coverage includes codec/reserved-field rejection, missing and moved grant, wrong process/generation, wrong target/type/window/ceiling, exact attenuation and retry, attempted amplification, post-start refusal, actual CPL3 effect checks and full cleanup. This primitive alone does not admit mediator execution: authenticated grant return, native lifetime and nested revoker custody, minimal root/bootstrap inventory, readiness, configuration/seal and fair retirement remain separate gates. The current ordinary start prohibition stays in force.

Implement the missing native memory/thread/wait mechanisms and their service adapters, including quotas, mmap/protection, TLS, wakeup races, fork interactions and required unwind boundaries. Profile their actual allocation and scheduling costs after lifecycle correctness is established.

This issue records planned work; its unchecked criteria are not implementation proof. The normative basis is Phase 6 and AC1–AC24.

Planned native terminal-generation contract — 17 September 2026: Introduce operation 55 for exact native process/staging-generation/event-kind/status observations. The request has zero flags and arguments; malformed requests fail before dequeue. Successful responses preserve all four 32-bit fields, captured with the actual native terminal transition and retained after destruction. Empty queues return RETRY with zero values. These records constrain existing authority and confer no process-control capability.

Kernel, shared IPC, Procd and Rootd migrate together. Procd must match the native process/generation pair before cleanup, CPU-time observation, restart or service-event publication. Remove the superseded identity-free native selector after all maintained consumers migrate, with no fallback on unsupported kernels. Preserve queue reservation, ordering, wake and failure semantics. Validate actual exit/kill, generation reuse, empty/malformed input and cleanup failure, then strict component checks and original bounded native VMs on a coherent immutable revision graph.

This is the terminal-observation prerequisite for typed mediator bootstrap. The actual returned install grant already has a generation-checked endpoint-attenuation primitive for the first bootstrap effect. Guard custody, final receiver readiness, sealed publication, two mediators with real client I/O and both full guest builds remain separate mandatory work; this planned contract implements none of those by itself.

Authority, security and reliability

Memory and thread operations consume explicit capabilities and resource budgets. Preserve W^X, backing rights, zero initialization, generation-bound wakeup ownership and complete OOM/cancellation cleanup. Clock and entropy sources must be explicit; deterministic fixtures cannot satisfy cryptographic entropy requests.

Apply the priority order: security, reliability, then performance. Keep suspected vulnerabilities in the repository’s restricted SECURITY.md reporting channel.

Acceptance criteria

• Inventory required allocation/mmap/protection/shared-memory/thread interfaces from
  selected tools and distinguish missing mechanisms from libc adapters over existing
  capabilities.
• Implement authorized anonymous allocation and release for growing heaps/stacks,
  with checked alignment, zero initialization, quotas and OOM cleanup.
• Implement required private/file-backed mmap, munmap, mprotect and synchronization
  behavior; preserve W^X, backing rights, dirty data and revocation.
• Specify thread/process address-space ownership, thread start/exit/ join/detach,
  stack guards and cleanup with no unintended capability inheritance.
• Implement per-thread TLS allocation, access base and destructor lifetime,
  integrating ABI and loader contracts; isolate errno and thread data.
• Implement mutex/condition/rwlock/once/TLS-key primitives required by libc/tools
  with correct atomic ordering, wakeup ownership and destruction.
• Implement race-free check/register/block/wake and actual monotonic deadlines; test
  notify-before-wait, wake-after-cancel, spurious wakeups, lost wakeups, priority/fairness
  effects and generation reuse.
• Define fork interactions with multiple threads, atfork handlers, runtime locks and
  child state; no inherited lock may require a vanished thread.
• Specify unwind/exception support needed by imported C++/Rust tools separately from
  native abort-only components; do not enable unwinding across kernel, IPC or incompatible FFI
  boundaries.
• Provide explicit clock and entropy access needed by runtimes. Distinguish
  reproducible timestamps/test randomness from security randomness; never satisfy a
  cryptographic entropy request with deterministic fixture data.
• Add stress/failure VMs for mapping protection, concurrent allocation, threaded
  compilation, TLS isolation, wakeups, joins and teardown under OOM.
• Profile allocation, faults, mapping transitions and synchronization; optimize only
  measured costs after safety and lifecycle tests pass.

For each implementation slice, retain actual formatting, strict Clippy, unit/doctest and warning-denied build results for all altered Rust repositories and valid configurations. Add relevant runtime VM coverage, monitor older unit/VM regressions in exact-head CI, and update canonical component documents and affected technical-manual/API material. Every authored code file must remain below 1,000 physical lines, with meaningful inline documentation and missing_docs enforcement in Rust crates.

Alternatives and tradeoffs

Linux syscall emulation is not implied by these runtime requirements. Reuse existing native mechanisms where sound and add only the mechanisms demonstrated missing by the selected tool workload.

Allocator validation checkpoint — 14 September 2026: Signed Kernel feature ae0f3ab918abec71e809c3b4a68e54ec1c475e0d carries original signed maintenance ancestor 41b57a7a67e6fee71f5708b55ab386b72366b8d8. Both use the same CSpace allocator with their respective original dependency graphs. The feature tree equals the previously validated e5198f8f3ce0dbc1ee3658cdd21bf10f0beed63c tree. Strict development/release default/all checks pass: 613/637 units plus two standalone tests on the feature graph, 589/613 plus one standalone on maintenance, with three existing ignores. All eight feature and six maintenance freestanding builds pass without warnings. Kernel CI 536 and 537 pass with four complete logs, 643,867 bytes and zero warnings. The actual allocator rejection control fails the original signed library with next ID 5 instead of 4; the corrected test covers repeated failed growth, initialization failure and allocation-free reuse. ID exhaustion, duplicate destruction, occupied-record preservation and clean reuse pass. The same three-sample host profile reduces 32,768 reuse cycles at 32,768 retained spaces from 643.094176 ms to 1.172569 ms; host elapsed only, with no exclusive-CPU or guest timing claim. Signed Integration a869a81eb406a4f027a2b5db573b6330ca114d94 selects both final source graphs and passes all 159 helper suites plus strict 320/321-unit development/release default/all Rust matrices. The final ordinary Rootd IPC-framing VM passes in 45.832335 seconds and the native distinct-argument/lifetime VM passes in 13.026853 seconds, under unchanged exit/marker/deadline rules with empty QEMU stderr. These are host build-and-run durations. The ordinary image is 27,934,720 bytes, SHA256 2a187127696d569ae5c627d9c1d154ad53c024e98d9a181dbb6006790f01a0cc; the lifetime image is 2,142,208 bytes, SHA256 8fa4c7512a5916a51ba956b1e55c84ac2945c2580ff9556c99c27cbaa6e3321d. Its final image, ELF and EFI bytes equal the preceding validated feature-tree artifacts. Older full CI 1605/1606 is still running; new 1607/1608 is waiting. No full-catalog pass, realm implementation or full guest build is claimed.

Endpoint construction checkpoint — 14 September 2026: Signed Kernel f6489ff3f8fea88a26dad232cc45d0deb33fa30e carries original signed ordinary ancestor c7f8952c45a60ca451466d9731207c0a9a6a9a82. Its feature tree equals the validated fc3e1d5ea095fd17a9629a87d05ddad0863435ca tree. Copy, attenuated copy and move reject unbound endpoint metadata before destination installation; the original control materializes an endpoint and fails the new invariant. Explicit construction then preserves exact object identity and SEND-only rights. Positive fixtures now construct their intended endpoint kinds without widening rights or changing assertions. Strict development/release default/all checks pass 614/638 units plus two standalone tests on feature, 590/614 plus one on ordinary, with three existing ignores. Eight feature and six ordinary freestanding builds pass without warnings. Kernel CI 540/541 passes: four complete logs, 644,652 bytes, zero warnings. Earlier same-tree CI 538/539 also passes. The focused owned-invocation design defines actual caller/server generations, exact receiver registration, retained SEND carrier lineage, request/result byte and capability custody, fresh collection, exactly-once grants, invalidated deliveries, draining and terminal cleanup. It enumerates cumulative type-specific binding reservations and no-allocation rollback obligations. The owned transport remains unimplemented; no new opcode, wire layout or escrow representation is assigned. This is a deliberate construction boundary cleanup, not a demonstrated vulnerability finding.

Completed CI checkpoint — 15 September 2026: Signed Integration a869a81eb406a4f027a2b5db573b6330ca114d94 passes both 1607/1608; signed endpoint-construction checkpoint 989d44d604d07c4c9bcc23264912bdf2076b99eb passes both 1609/1610. Each run reports all 486 distinct VM scenarios passing, followed by the actual native lifetime scenario, physical/serial interactive checks and all four console modes. Rust and Markdown pass. The two six-log cohorts contain 26,769,289 and 26,769,316 bytes respectively, with zero warning candidates. The previously observed intermittent quota timeout remains documented without a causal-fix claim. These results establish the selected source checkpoints, not owned invocation transport, complete authority closure or either full in-EriX build generation.

Native transfer preparation checkpoint — 15 September 2026: Signed Kernel e91f47198748d8ce52fc7361f389836a6bc2a206 carries original signed ordinary ancestor d2438c7e56c964a9c16720586cf718ec11e7cc0a. The feature tree is byte-identical to validated d58efd8df18d63e5b97228c066f6d7623202e6d4. Complete destination slot, rollback, typed binding and revocation-lineage storage is reserved before native capability mutation; reservations accumulate across aliases of the same object. Preparation failure changes no capability inventory or unique-grant custody. Commit and pre-delivery rollback require no allocation under existing BSP serialization. Five actual-object controls cover a 62-capability mixed batch, real allocator rejection, exact backing and grant scope, nested revocation and same-CSpace transfer. The ordinary grant move now uses the ID-only lookup without cloning descendants or adopting the later lifetime representation. Independent strict development/release default/all checks pass 619/643 units plus two standalone tests on feature, and 595/619 plus one on ordinary, with three existing ignores. Eight feature and six ordinary freestanding builds pass without warnings. Kernel CI 544/545 passes: four complete logs, 649,206 bytes, zero warnings. Same-tree CI 542/543 also passes. This implements preparation for the current IPC path. Its private records cannot survive userspace scheduling and own no retained source authority. Persistent request/result bytes and capability custody, exact delivery state and terminal hooks remain unimplemented under Kernel issue 11. No opcode, wire record, bootstrap-frame escrow eligibility or application-cancellation semantics are assigned. The renewed contributor-source inventory covers 76 repositories and 2,898 code files, all below 1,000 lines. All 92 library/binary roots and 62 standalone Cargo roots have direct missing_docs gates. These static checks do not establish whole-codebase authority or private-item documentation closure.

Native invocation custody checkpoint — 15 September 2026: Signed Kernel 2e4deb7351184d3fe4517ce8d5d59eb9960f28ad carries the native invocation core from b1b632446ff5762761b5aee3fbdba320f5efff42 and the deterministic endpoint-fixture correction. Native Rust entry points implement explicit receiver registration, submit, claim, complete, fresh collection, progress, caller release and cleanup-only delivery relinquishment. They derive actual TCB/stage/CSpace identity, retain real request/result bytes and capabilities in a private CSpace, and keep a SEND-only carrier alias in its original revocation lineage. No CNode or private storage location escapes. Accepted results survive ordinary server death; repeated collection returns original descriptive receipts without reinstalling authority. Exact binding removal, process retirement and syscall-return hooks retain draining owners until native disposition and participant acknowledgements complete. Twelve actual-object controls cover caller/receiver scope, source-buffer mutation, duplicate destinations, moved unique grants and reused source slots, actual admission allocation rejection, six native object types, revocation, process death, replay and FIFO after registry vacancy reuse. The original draft FIFO control fails and the corrected selector passes. The disposal control proves actual guard revocation makes zero allocation requests; it does not prove a reachable backend disposal failure. Strict default/all development/release matrices pass 631/655 units plus two standalone tests, with three existing ignored experiments, private rustdoc, target Clippy and eight warning-free freestanding builds. Kernel issue 13 retains CI 546/547: both fail the same older endpoint fixture at setup with 630 passed, one failed and three ignored. Four related fixtures reset CSpaces without resetting preceding non-root TCB attribution. All four deterministic original controls fail with CspaceSlotMissing; resetting attribution before CSpace replacement makes them pass without changing any message, transfer or backpressure assertion. The correction is confined to test setup and thematic test organization; production behavior is unchanged. Corrected signed-head Kernel CI 548/549 and Docs 859/860 pass. All 8 complete logs total 1,413,966 bytes, with zero final warnings. The terminal cohort is classified. The syscall wire adapter, fresh userspace buffer/fault/overlap validation, authenticated caller-origin delivery fields and actual CPL3 owned-invocation peers remain unimplemented. Reachable backend disposal-failure coverage, sustained invocation-workload profiling, realm producer adoption, whole-codebase authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire record is assigned; the existing CALL/RECV/REPLY ABI is unchanged. The refreshed contributor-source inventory covers 76 repositories, 74 Cargo manifests and 2,913 code files, all below 1,000 physical lines. All 92 library/binary roots and 62 standalone Cargo roots have direct missing_docs gates. These static checks do not establish full authority or private-item documentation closure.

Authenticated delivery-origin checkpoint — 15 September 2026: Signed Kernel 69c5e1fe5ffa72522ff6611d8b2c0471e865115e adds CallerOrigin to each successful native request delivery. The process ID and staged generation come from the retained submitting actor in the native CREATE_STAGED_PROCESS identity domain; payload fields, receiving identity and equal numeric carrier slots cannot replace them. The pair exposes no private CSpace, grants no authority and promises no later liveness. Services must correlate it with exact retained process/realm ownership and revalidate after blocking effects. A two-submitter control sends mutually impersonating payloads through the same real carrier and validates both actual origins plus independent caller-local selector refusal. All 13 native custody controls pass. Strict default/all development/release matrices pass 632/656 units plus two standalone tests, with three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. Kernel CI 550/551 and Docs 861/862 pass. All eight complete logs total 1,414,891 bytes, with zero final warnings; the cohort is classified and stopped. The separate earlier fixture correction remains closed in Kernel issue 13, preserving original CI 546/547 and corrected 548/549. Sustained invocation-workload profiling, syscall wire and fresh-buffer/fault/overlap validation, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm producer adoption, whole authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire layout is assigned. Native progress and cleanup still do not certify application cancellation. The renewed inventory covers 76 repositories, 74 Cargo manifests and 2,914 code files below 1,000 physical lines. All 92 library/binary roots and 62 standalone roots have direct missing_docs gates. Source hashes, clean feature branches, signatures and remote equality are verified; these static gates do not close full authority or private-item documentation audits.

Native invocation profiling baseline — 15 September 2026: Signed Kernel 6cb703e1ed8b9de0d29a37189cd914cd501e732e provides an actual-object host workload for queued progress, collected progress, descriptive result reads and complete request/result cycles. Signed Integration f3e4359b34cb8f7db732fbf38823f722553c86d4 adds bounded capture, raw-evidence report verification and equivalent comparisons. Every sample checks exact bytes and SEND capability bindings, authenticated origin, foreign selection, duplicate completion refusal, FIFO position reuse, one-time collection and final invocation disposal. Source and executable bytes are observed against explicit original identities; compiler/host relationships remain declarations. Workload children and source Git reads receive minimal environments; capture owns memory, time, output and process cleanup. Completion is published only after deadline teardown succeeds. The operator guide and signed Docs 644273a0edd91e4c38dcd4418d6ae1119ff1f10b describe these boundaries. Kernel strict default/all development/release checks pass 632/656 units plus three standalone controls, three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. Integration passes all 161 helper commands, including 19 profiler controls and nine source-provenance controls, plus fresh strict 320/321-unit Rust matrices, private rustdoc and warning-free target builds. Four original socket-fixture failures are retained and attributed to the selected temporary directory exceeding the host Unix-socket path domain; a shorter explicit private directory passes the same fixtures. Docs passes 45 tests and renders 2,345 pages with zero final warnings; 427,592 word boxes fit page bounds and changed pages 2284/2285 pass visual review. Kernel CI 552/553 and Docs CI 863/864 pass; eight complete logs total 1,431,762 bytes with zero final warnings after manual reference convergence. The original signed Kernel baseline retains 48 measured samples and 16 checked warmups: four modes, populations 0/32/128/512, 256 operations per sample, three measured repetitions and one warmup. A single selected host CPU is used after local build/test work completes; external host scheduling is not isolated. At population 512, operation medians are 117,577.723 ns for queued progress, 8,927.977 ns for collected progress, 9,124.098 ns for descriptive reads and 1,167,847.016 ns for complete cycles. At population zero they are 223.328, 166.199, 213.137 and 4,556.867 ns respectively. Every raw sample, process disposition and final native cleanup passes. Timings include fixed semantic checks; no cost is subtracted and no ratio is a pass threshold. Source review identifies repeated carrier-binding scans during full registry refresh and a registry-lock acquisition for every inactive settlement position. The next bounded change will retain only non-authoritative numeric search positions: every fast path must still check current capability type/rights, endpoint identity/in-use state and exact CSpace/slot binding, with complete lookup on a stale hint. Existing revocation and terminal hooks remain authoritative. Settlement may scan for the next draining owner under one lock while retaining the original pass boundary, increasing index order, busy-position exclusion and allocation-free stack-owner return; disposal remains outside the table lock. Original workload bytes and sample policy must remain unchanged for comparison. No Kernel performance algorithm has changed in this baseline. Native syscall adapters, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The 76-repository inventory has 2,923 code files below 1,000 lines and 155 direct missing_docs crate-root gates; this does not close the semantic audits.

Measured native invocation lookup refinement — 15 September 2026: Signed Kernel 8349d68636382cc7e25a3347f5f1df216554203a retains only numeric carrier-search positions. Every use rechecks the actual CSpace capability type/rights, live endpoint identity and exact binding; stale positions take the complete search path. No successful authorization, capability or reference is cached. Draining scans fix their boundary on the first poll, visit each position at most once, skip busy stack owners and return exclusive custody after unlocking. Native disposal and first-failure retention preserve their existing semantics. Signed Integration 108501cf7ec20f05dd3d62ea401ea8adad6c6e9c selects this Kernel in its isolated native catalog, and signed Docs f10a1d375a326543ec0adda4569bc7cb4faca9b6 documents the invariants. The existing syscall ABI and ordinary image catalog are unchanged. All 15 actual-object native controls pass, including real alias compaction, rights/type/object replacement, busy ownership and allocation-free settlement. The unchanged four-mode workload control also passes. Full strict default/all development/release Kernel matrices pass 634/658 units plus three standalone controls, with three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. The existing native lifetime and entry-argument VM passes unchanged oracles in 21.978041 seconds of host build-and-run time, with clean teardown and empty QEMU stderr. Its signed boot image is 2,207,744 bytes, SHA-256 4030cdfb8a13c000ff4716ecdc5203cb46273d6117a282f7375f25dccbbeedc9. Exact unchanged Integration Rust/helper bytes preserve the preceding strict 320/321-unit matrices and all 161 helper-command results; changed catalog/scenario policies pass. Docs passes all 45 tests and a complete 2,345-page render with zero final warnings, 427,679 bounded word boxes and visual review of page 145 plus continuation page 146. The original signed Kernel 6cb703e1ed8b9de0d29a37189cd914cd501e732e and the new signed Kernel use byte-identical workload sources, the same selected CPU/toolchain/context and explicit limits, distinct source targets, four modes, populations 0/32/128/512 and 256 operations per sample. Each capture retains 48 measured samples and 16 warmups; every sample passes actual semantic and native/process-cleanup checks. At population 512, median queued-progress cost changes from 117.578 to 37.673 microseconds (3.12x observed ratio), and full-cycle cost from 1167.847 to 443.055 microseconds (2.64x). Collected progress changes from 8.928 to 6.015 microseconds and descriptive reads from 9.124 to 6.212 microseconds. Timings include fixed checks, with no subtracted overhead or timing-ratio pass gate. No managed build/test workload runs concurrently during capture; external host scheduling remains unisolated. These are host operation wall times, not guest startup/build acceptance or a statistical guarantee. Kernel CI 554/555 succeeds; four complete logs total 679,280 bytes with no warnings, and its completed cohort is stopped. Docs CI 865/866 succeeds at observation three; four complete logs total 754,424 bytes, all 45 tests pass and each manual has 2,345 pages. Its normal reference passes report 32/1/0 warnings, with zero final warnings and no box diagnostics. The completed Docs cohort is stopped. Integration CI 1619/1620 is waiting at its first observation. Older Integration 1613/1614 is running; 1615/1616 and 1617/1618 are waiting. Accepted older Integration 1611/1612 passes all 486 catalog scenarios and later probes with complete warning-free logs. This does not establish the intermittent quota cause tracked in Integration issue 18. Current full-suite CI remains required; stopped cohorts are not polled again. Owned syscall wire adapters, actual owned CPL3 peers, fresh-buffer validation, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The refreshed 76-repository inventory has 2,924 code files below 1,000 lines and 155 direct missing_docs crate-root gates; those checks do not close whole-codebase semantic audits.

Owned invocation wire and native acceptance — 15 September 2026: Signed Kernel 5f497adaefa526108a0439e0e071717dddb85334, shared IPC de968da19898bef532ddb3b5974bb9562f51dee5, capability ABI a001a26f0eb3aebec3f5fd02a28d98f1bc23f8a0 and Integration 9030b217c490db6ad3ec60a799cb025eccbfcdb1 implement and exercise the immediate owned invocation boundary. The allocation-free shared codecs and shim preserve exact return metadata, including a retained draining owner on failed submission. The Kernel checks fresh complete user mappings and packet framing under one lifecycle guard before native effects. No user pointer or caller-selected identity is retained. Destination capacity and descriptive receipt capacity are independent; spare capacity acquires no authority and repeated collection cannot duplicate transfers. Existing numeric binding hints still recheck live capabilities on every use. The real three-process CPL3 scenario passes all eight operations, full-span pointer/rights/overflow/reserved-field rejection, actual returned selectors, payload/capability/origin checks, collection after server exit and repeated receipts. A second request rejects premature relinquishment, enters draining on caller release and retires only after the exact server acknowledgment. Current signed owned and unchanged older lifetime images are each 2,232,320 bytes, with SHA-256 588c6097c57ebd2ed92e0f0b76f2b1ad6b82630b4a0da272ee98e218eb8e333d and 8f9026aaefd2c5a745e35467ac01c71789c5f469f9cd42a477f87818747ee673 respectively. Both runs have clean teardown and empty QEMU stderr. Ordinary images contain neither diagnostic hook. Strict default/all development/release host, freestanding and rustdoc matrices pass: IPC 368 units, shim 20, capability ABI 191, Kernel 642/666 and Integration 320/321. Existing ignores remain one shim and three Kernel tests. All 162 maintained Integration helper commands pass; three prior correct concurrent-run lock refusals are retained and their sequential checks pass on unchanged executable inputs. Docs 46da7a4cb4d38a2bea5b5491a68f51f33e4b4305 publishes the normative register/packet contract and regenerates the three affected API references from original signed revisions. All 45 documentation tests pass. The complete 2,363-page manual has zero final warnings, 430,365 word boxes within page bounds and reviewed changed ABI/API pages. Shared IPC CI 337/338 and capability ABI CI 214/215 pass with eight complete warning-free logs. Both Kernel revisions pass CI 556/557 and 558/559 with eight complete warning-free logs. Those cohorts are stopped. Current Docs CI 867/868 passes at observation four; four complete logs total 758,328 bytes. Both 2,363-page manuals pass all 45 tests, report normal reference-pass warnings of 32/1/0, and finish with zero warnings or box diagnostics. Its cohort is stopped. Current full Integration 1621/1622 is waiting. Older full Integration 1613/1614 now passes all 486 catalog scenarios and later native/console probes, with six complete warning-free logs; its cohort is stopped. Older 1615/1616 is running, and 1617/1618 plus 1619/1620 are waiting. Current full-suite acceptance remains open, as does the intermittent quota cause in Integration issue 18. This checkpoint supersedes the earlier pending wire/CPL3/manual status. Reachable backend disposal-failure coverage, broader revocation/generation-reuse scenarios, producer adoption, realm runtime, complete authority/inline-documentation audits and both full EriX-in-EriX build generations remain open. The current inventory checks 76 repositories, 2,943 code files below 1,000 lines and 157 crate roots with direct missing_docs gates; it does not establish semantic audit closure. No complete guest build or guest performance result is claimed.

Process-bound native acceptance — 15 September 2026: Signed Kernel 60da5858d7198185efd103f0e91e5ac2e0b63e67 implements control operation 52, checking the actual moved install grant against expected process/generation with exact rights, including zero, under existing endpoint policies. Signed Procd f1105706cc19ed024a6cca79a29abc57c90c6661 uses this operation in its actual ordinary launch-description producer while retaining the narrow SEND receipt, pending state and exact failure cleanup. IPC c453b697b8cdb9cc1c36f1ad89ff868648190025, capability ABI fe8d558253ad01301b99554e20d287c4ea35bb1d and five aligned helper commits preserve original Git/type identity. Integration 58c925c564b69bebce8df6f3e75a9312824e18c4 passes the expanded lifetime CPL3 scenario with thirteen actual control calls, user-side reply checks, two staged children and full added-custody disposal. The corrected lifetime image SHA-256 is 8e6a9e8f68b90cc1ede61300958cec122b82a7c6dfd6318a51e40fefc7ba166e; the unchanged owned-invocation scenario also passes with image SHA-256 b76a380d3cd6b03b0ff61a3b626ace0667679920684ad7356a1c3a36e2224953. Both have clean teardown and empty QEMU stderr. The initial fixture setup-order failure is retained and corrected in Kernel issue #14. All strict default/all development/release matrices pass: IPC 371, shim 20, capability ABI 191, Kernel 648/672 including standalone controls, Procd 227/232 including auxiliary binaries, and Integration 320/321 tests. Existing native-only ignores are unchanged. Procd passes forty native binary builds with repository linker scripts. All 162 Integration helpers pass after updating the exact policy assertion to require the new marker; its initial mismatch remains recorded. Docs b0fcf0f43af2af741d520a0b1373cc346e08863c updates the native wire/ownership contract, operation registry, Procd boundary and three generated shared APIs. All 45 tests and the complete 2,367-page manual pass, with zero final warnings, 431,138 word boxes within page bounds and four reviewed protocol/API pages. Current IPC 339/340, capability ABI 216/217, Kernel 560/561 and 562/563, Procd 266/267, Docs 869/870 and all five helper push/review CIs pass with complete classified logs and no final warnings. Those component cohorts are stopped. Current full Integration 1623/1624 waits at observation 01. Older full Integration 1615/1616 is running at observation 11; 1617/1618, 1619/1620 and 1621/1622 wait at observations 09, 07 and 04. No pending full suite is counted as passed. Typed realm bootstrap, mediator startup/readiness/configuration/seal, complete consumer image adoption, fair terminal/provider retirement, broader native disposal failures and both full EriX-in-EriX build generations remain open. The new inventory covers 76 repositories, 2,950 code files below 1,000 lines and 158 direct missing_docs crate-root gates; complete inline documentation and whole-codebase authority closure remain open. Prior performance measurements retain their original signed source identities; this checkpoint claims no new timing or guest performance result.

Corrected native staging checkpoint — 15 September 2026: Signed source b98156427362a468ae78195a3582901e2474fea5 is recorded in the current review. Exercise the corrected native constructor and explicit cleanup through an actual host regression and six additional CPL3 calls. 648/672 default/all tests including standalone tests pass, with three existing ignores. Strict host/native matrices and ten native builds pass. The lifetime and unchanged owned-invocation VMs pass with empty QEMU stderr and clean teardown. CI 564/565 passes with complete warning-free logs. Additional construction failure-path coverage is being audited separately. Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed.

Native creation rollback acceptance — 15 September 2026: Staged construction now retains a receipt for each successful parent copy until commit. On later failure it destroys the child and disposes only those new endpoint/VSpace copies, preserving pre-existing or overlapping output bindings. The transaction has a separate documented module. Eight actual constructor refusal cases check complete parent inventory and native VSpace counts. Kernel b853d51cfb passes 649/673 default/all tests, strict host/native development/release Clippy, private rustdoc, formatting and ten native builds, with three existing ignores. Matching CI 566/567 passes with four complete warning-free logs. Integration 3c4e26025668fa2a171b2c80017fd2b8bcb1924f passes both actual native VMs with empty QEMU stderr and clean teardown. The lifetime fixture now includes seven creation/refusal/disposal calls alongside the thirteen installation calls; the existing owned-invocation oracle is preserved. Integration Rust/helper sources are unchanged and retain their completed 320/321-test strict matrix and all 162 helper results; changed native catalog inputs have fresh policy and VM checks. Full Integration CI 1627/1628 remains pending. Typed grant-return provisioning, independently constrained bootstrap authority before mediator execution, readiness, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. The code inventory covers 76 repositories and 2959 files below 1000 lines; all 158 scanned Rust roots enforce missing_docs. Whole-codebase semantic authority and private-item documentation audits remain incomplete.

Native permission checkpoint — 16 September 2026: signed Kernel 32c70109fe7663440aa56de6a49975accc1f0057 carries explicit live execution permission through single-page, batch and permission-only mappings. Data and construction aliases remain non-executable; ancestor promotion and splitting preserve neighbouring restrictions. Processor activation validates and enables execute-disable support on the bootstrap and application processors. Seven independent controls accompany the repair. Strict default/all-feature development/release suites pass 666/690 kernel unit tests plus two external controls per selection, retaining three existing ignores. Host/native Clippy, private rustdoc, formatting and ten native builds pass without warnings.

Separate one-CPU and two-CPU diagnostic VMs pass the unchanged native command sequence. A read-only hardware observer matches all 233,755 selected coreutils executable bytes, verifies CPL3 and enabled paging/execute-disable state, and confirms both observed RELRO pages are user-readable, read-only and non-executable; the current stack is user-writable and non-executable. Both processors report execute-disable enabled. This is an exact process-entry/table observation, not an injected instruction-fault test or whole-system permission proof. The diagnostic image SHA-256 is 8c3c24639e8e1ca8c4f2ad4e485323abf32ec07408241c3e4fa9713f6e07e812.

Signed Docs d221e725c2543316680e63fc5e8314ce0fe3bdf1 documents the mapping and processor contracts. All 45 documentation tests and canonical checks pass; the 2,375-page manual has 434,308 in-bounds word boxes and zero final warnings, with three changed pages visually reviewed. Exported API snapshots are unchanged. Kernel CI 574/575 passes with four complete warning-free logs (708,112 bytes), including existing optimized workload examples. Docs CI 891/892 passes all four complete logs (762,176 bytes), with 45 tests per manual job and zero final warnings. The later maintained permission regression is recorded below. Full frame proof, whole-codebase authority/documentation review, runnable realms and both complete guest build generations remain open.

Maintained permission regression — 16 September 2026: signed Integration 89d15e4536004c087dcebd63c87216c0fd58958d supplies the explicit-input runner, pure ELF/page-table checks and read-only GDB observer. The final maintained source passes 21 independent host controls and the complete strict default/all-feature development/release Rust matrix, host/native Clippy, private rustdoc, formatting and four native builds. Canonical checks pass after correcting one Markdown line wrap. Both host groups are wired into ordinary CI. All 2,995 inventoried authored code files are below 1,000 lines; this is physical size evidence, not semantic authority closure.

Actual one-CPU and two-CPU runs on the repaired diagnostic image pass the original native-time command sequence and the expanded hardware checks: all 58 selected code pages are user-readable, read-only and executable; both RELRO pages are read-only/non-executable; the current stack is writable/non-executable. Complete executable bytes match and NX interpretation is enabled on every selected processor. An earlier image is rejected by the maintained observer. Both child outcomes, exact original input bytes and temporary cleanup are retained, with empty debugger stderr in both positive runs. The final cleanup code also preserves reaping when a direct child exits between poll and termination.

The command's image CI gate awaits adoption of a coherent product catalog containing both required component fixes. Its explicit diagnostic invocations do not silently replace the older maintained image graph. Signed Docs 3fb0b12ff55d044cc4bbe142418ab7a5b07bb42d documents the maintained operator contract. All 45 tests and canonical checks pass; the 2,377-page manual has 434,563 in-bounds word boxes with zero final warnings, and the changed subsection passes visual review. Exported API snapshots are unchanged. Matching Docs CI 893/894 passes with all four complete logs (762,616 bytes) and zero final warnings. Current Integration CI, complete frame proof, whole-codebase authority/documentation closure, runnable realms and both guest-build generations remain open.

Explicit query caller context — 17 September 2026: isolate query-local-cap dispatch in a documented module. Resolve the kernel-attributed current TCB record once, validate the requested slot against that same record, and pass its explicit CSpace identity to both capability and endpoint-kind lookup. A descriptive source slot or process ID must never select a different owner, and a missing caller must retain DENIED rather than use the bootstrap root fallback.

Share the pure checked window predicate with the existing current-caller checks. Preserve parameter/error precedence, result-register encoding, diagnostics and the register-only wire interface. Add focused controls for a private CSpace shadowing root slots, denied/missing callers, malformed parameters and metadata observations without capability mutation. Keep new definitions documented and split the almost-full dispatch source by responsibility.

This removes repeated ambient CSpace selection and makes the memory-effect audit smaller; it does not itself certify the retained older kernel ELF. Keep the original syscall preservation refusal until selected kernel/source/artifact evidence and the relevant memory effects are grounded. Validate strict kernel feature matrices, applicable native/runtime controls, documentation and original automatic CI before claiming acceptance.

Caller-local query checkpoint — 17 September 2026: signed Kernel e15a045d7701030e58d9e59517406f8c79694ff8 selects one attributed TCB record for checked-window validation and both explicit CSpace metadata reads. Four added host controls cover independent owners, root shadows, missing callers, malformed inputs and unchanged inventories. Query results retain the register-only wire contract and clear descriptive payloads on errors.

Four strict development/release default/all-feature matrices pass 670/694 unit tests plus two external controls, with three existing ignores. Formatting, host/native Clippy, private rustdoc and thirteen native binaries pass without warnings. Original kernel CI 578/579 both pass; all four complete terminal logs contain no warnings.

The selected native image passes fifteen actual CPL3 queries with exact metadata, RSP, six saved-register and sixteen live-stack-word comparisons across three private owners, then all existing invocation custody/retirement checks. The separate lifetime/revocation scenario also passes all original markers. Both use one TCG CPU and unchanged 60-second deadlines. The first canary fixture failure is retained in kernel issue 16; the corrected fixture explicitly selects its owned stack before testing syscall preservation. This is finite selected-image evidence, not a generic kernel memory guarantee or full guest build.

Explicit entry-state checkpoint — 17 September 2026: signed Kernel d4a8921fa8530419c3d9790b80ff3c601217906d establishes forward live direction before compiled exception handling and explicitly masks IF/DF on syscall entry while retaining saved flags. Shared exception stubs preserve vector identity and the separate resumable page-fault frame. No capability, mapping or slot authority is added.

Four strict development/release default/all-feature matrices pass 670/694 unit tests plus two external controls, with three existing ignores. Formatting, host/native Clippy, private rustdoc and 19 native builds pass without warnings. Original CI 580 and CI 581 both pass; all four complete terminal logs contain no warnings.

The standard native wrapper passes invocation, entry-direction and lifetime scenarios on this signed Kernel. Thirty caller-local queries exercise both user direction states, retaining exact returned flags, metadata, RSP, six saved-register and sixteen live-stack-word checks. The separate UD2 scenario requires live forward direction, retained fault flags and the expected fatal exit. All original marker requirements and 60-second deadlines remain. This finite evidence does not establish general syscall memory preservation or a full guest build.

Entry-frame and complete fixture checkpoint — 17 September 2026: Signed 0bf941cf8ff4b7c1e8b6c9ed7941b5413250629a completes the full startup-window fixture correction after a deterministic original failure. Four strict matrices pass 671/695 unit tests plus both standalone controls, with three pre-existing ignored experiments. Original CI 584/585 passes with four complete zero-warning logs (712,326 bytes); issue #6 is closed. The preceding signed entry correction 829b949 passes four distinct native diagnostics. All native and full-build evidence retains its exact source scope; consumer adoption and both complete guest build generations remain open.

Diagnostic lifetime checkpoint — 17 September 2026: Signed fb4e134f2130e9f60608bad0ecc02d8a278887a8 removes the obsolete RTC post-exit observer, three retained trace values and four lifecycle hooks. The remaining diagnostic contract uses scalar metadata and synchronous current-operation observations. Four strict matrices pass 671/695 units plus both standalone controls, with the three existing ignored experiments; six trace-enabled native builds and binary Clippy selections pass without warnings. Existing invocation/lifetime VM controls pass on the exact candidate under one explicit private trace-feature variation, original 60-second limits and normal stripped-artifact verification. Original current-head CI is pending. The complete syscall memory footprint, ordinary graph adoption and both full guest builds remain open.

VSpace fixture follow-up — 17 September 2026: Original diagnostic-cleanup CI 586 fails and 587 passes; all four complete logs contain zero warnings. Issue #17 tracks deterministic predecessor-attribution failures in the synthetic and mapping fixtures. The correction preserves production authority and all original test assertions, shares explicit test-only attribution setup, and partitions the large mapping suite. Strict corrected matrices are running. Earlier native entry and diagnostic VM results retain their exact source/feature scope.

VSpace fixture CI reconciliation — 17 September 2026: Current signed 28dfaea22796925ca438b4a57175520a8d9e7a8c passes original push CI 588 and PR CI 589. All four complete terminal logs are classified: 712,357 bytes and zero warning candidates. Both workflows retain the named regression controls, 671 default/695 all-feature unit results and both standalone controls; three existing experiments remain ignored. Local four strict matrices, host/native Clippy, rustdoc, formatting and two native builds also pass without warnings. No production attribution rule or global harness concurrency is changed. Issues #4, #5 and #17 close for their bounded host-fixture corrections, while full source/frame and guest-build acceptance remain open.

Borrowed capture checkpoint — 17 September 2026: signed f2489242be47654342c91ef3f05a2a12cdc15a4b
requires complete initialized frame ownership before native syscall dispatch.
Five new controls cover real allocation rejection, non-dispatch of a requested
capability drop, attribution, layout, stable copies and teardown. Four strict
676/700-unit matrices, both standalone controls, eight native builds/Clippy
selections and two original-budget invocation/lifetime candidates pass without
warnings. Candidate machine bytes and normal packaged stripping are verified;
no general syscall memory guarantee or ordinary-image adoption is claimed.
Original CI 590/591 passes: all four complete logs total 716,126 bytes,
zero warnings, with 676/700 unit results and both standalone controls. Prior CI 588/589 passes completely, closing
bounded fixture issues #4/#5/#17; their original failures remain retained.

VSpace cleanup checkpoint — 17 September 2026: signed 1af934ff48e6d5ad33fd1227c8d1ffdc40c7a06d
records access-withdrawal progress and exact frame-reference consumption while
rejecting ordinary use during retirement. Final process-reference cleanup keeps
its owner until teardown succeeds. Four new host controls, strict 680/704-unit
matrices, both standalone controls, eight native build/Clippy selections and two
original-scenario native candidates pass without warnings. Original CI 592/593 passes with all four complete logs classified and zero
warnings. Surrounding process-cleanup review, ordinary-image adoption
and both complete guest builds remain open.

Process cleanup checkpoint — 17 September 2026: signed c55ee8d6f12957b43c5fd6aaf31c9865656b5ae6
retains private CSpace identity through final release and excludes cleanup
owners from execution and live IPC. Four new owned controls, four strict
684/708-unit matrices, both standalone controls, eight native build/Clippy
selections and two original-budget native candidates pass without warnings.
Final rustdoc-only edits retain explicit candidate scope. Original CI 594/595
passes with four complete logs classified: 722,414 bytes and zero warnings. Preceding VSpace and capture cohorts pass with complete logs.
Ordinary-image, whole-code semantic and both complete guest-build gates remain open.

Native terminal generation implementation — 17 September 2026: Signed revision 5b20519a72e1cbc797eb32a7687e78ac4a8a7133 is pushed. Native operation 55 captures the original TCB generation with exit/kill and preserves it across queued observation and ID reuse. Malformed waits cannot dequeue; selector 7 is retired. Four strict matrices pass with 686/710 units, host/native Clippy, rustdoc and eight native builds. The added CPL3 fixture checks every response word; corrected endpoint-refusal framing passes both native profiles. Matching native execution and coordinated consumer rollout remain in progress; runnable realm bootstrap and complete guest builds are not established. Original automatic CI is monitored without retries.

Coordinated terminal observation checkpoint — 17 September 2026: Signed revision 5b20519a72e1cbc797eb32a7687e78ac4a8a7133 is pushed. Both actual native VM gates now pass. Nine CPL3 terminal calls check malformed nonconsumption, retired-selector rejection without a fabricated response, original exit/kill generations and canonical empty queue. Exact build artifacts and all native component checkouts are verified. Original CI 596/597 has complete warning-free successful logs. Typed mediator bootstrap, ordinary service-image adoption and both complete EriX builds inside EriX remain open.

Planned exact-generation native cleanup — 17 September 2026: Define distinct native terminal-destruction and
staged-abort operations 56 and 57. A checked request carries the nonzero original
process/generation pair in the low/high 32-bit halves of arg0; flags and all other
arguments are zero. Retire selectors 8 and 35 without reinterpreting them or
adding a compatibility fallback. The existing held Process or Root route remains
required; descriptive identities do not grant authority.

Match the exact pair under the same TCB record lock that enters retained cleanup.
Preserve terminal-versus-Created eligibility, partial disposal and retry custody.
An absent or different generation acknowledges absence of only the requested
instance, with zero response values; it cannot mutate a replacement. Migrate
every native caller and carry creation/event generation through deferred retries.
Account for processes created before a service's own managed ledger without
reconstructing historical identity from the current record. Maintain separate
terminal observation, cleanup custody, provider completion and native absence.

Required evidence includes exact wire and reserved-field controls, actual-object
generation/reuse and failed-release controls, consumer cleanup tests, and bounded
CPL3 native coverage. Update all operation inventories, Rootd's measured audit
contracts, canonical documentation and manual/API references. Validate coherent
original commit dependencies, complete strict component matrices and repository
CI checks, then monitor original workflows. Ordinary mediator start, whole-image
admission and both complete builds inside EriX remain separate open gates.

Generation-bound native cleanup checkpoint — 18 September 2026: Signed revision bd81f0d8bbb3ce3d3e4d172667d1d12fbe155e6e is pushed. Native operations 56/57 match the original generation under the cleanup lock, preserve partial-disposal retries and retire selectors 8/35. Four strict host matrices pass 688/712 units plus standalone controls; all eight native builds and Clippy configurations pass. Both original 60-second VM scenarios pass. Nineteen actual CPL3 cleanup calls check malformed and retired selectors, stale identity, eligibility, repeated absence and preserved terminal evidence. All earlier lifetime oracles remain required; both packaged Kernels match their normally stripped original builds and all 15 component trees are clean. Formatting and Markdown checks pass. Original CI 598 and CI 599 passes; all four terminal logs are complete (725,508 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements.

Caller-local grant relocation design — 18 September 2026: Add immediate x86_64 syscall 0x54, RELOCATE_LOCAL_GRANT, taking source slot in argument 0 and destination slot in argument 1. Both fit u32, are nonzero and distinct; arguments 2–5 are zero. The return is the exact result in rax with zero auxiliary value. Admission uses the actual current Running native process and nonzero generation, checks both slots against its syscall window, and accepts only an actual held INSTALL_GRANT or REVOCATION_GRANT with its matching native record. Movement uses the existing unique-record rebinding within that same native CSpace; rights, child/generation installation scope and revocation lineage are preserved. No grant is constructed, copied, attenuated or retargeted. Malformed register shape rejects before context lookup; caller/window checks precede source lookup, then type/binding checks precede empty-destination admission. Ordinary validation refusal leaves inventory unchanged. The transition is serialized with process-terminal and reply-authority lifecycle changes. Owned CLAIM already selects receiving destinations before exposing request bytes; this operation lets a producer validate the received grant and then relocate it into an existing per-process custody slot. The operation itself does not validate a bootstrap request, install child authority or acknowledge application retirement. It adds no Process endpoint selector or general CNode route. Literal register, foreign/terminal caller, missing/fake binding, occupied destination, exact-rights/scope and actual CPL3 controls are required, followed by coordinated producer/consumer adoption and the remaining realm VM gates.

Caller-local grant relocation native acceptance — 18 September 2026: Signed Kernel 56d398e077c140c58e23f9cc2d8b79f19bc4cc2f implements register-only syscall 0x54 using the actual Running caller, both admitted local slots and native unique install/revocation binding owners. Rights, child generation, installation scope and revocation lineage remain unchanged. Seven new host controls and all four strict matrices pass: 695/719 units, both standalone controls, eight native builds, strict Clippy, rustdoc and formatting. Both actual native VMs pass under their original 60-second limits. The lifetime fixture executes thirty-nine new CPL3 relocation calls before its existing installation, revocation, terminal, inventory, queue and page checks; user instructions validate results and observers never replace them. Normal stripping reproduces both packaged Kernel artifacts, and all fifteen original selected component trees are verified clean. Original CI 600 and CI 601 pass from four complete logs (731,632 bytes), without warnings. This is native local custody evidence only: actual owned service adoption, consumer VM execution, complete realm fairness and both full builds inside EriX remain open.

Owned receiver request-budget contract — 18 September 2026: Extend register-only REGISTER (0x4C) to take the actual local RECV slot, maximum request payload bytes and maximum request capability count in arguments 0–2; arguments 3–5 remain zero and successful RDX is zero. Both budget values are explicit receiver declarations. Zero/zero admits only empty requests. The byte/slot/receipt receive layout must be addressable and capability capacity must fit native private CSpace storage. The actual Running generation and held generic RECV endpoint remain the registration authority. Exact repeated registration is idempotent only with the same budget; a different budget or owner conflicts without modifying the original registration. Replacement follows the existing actual receiver-binding removal and exact native retirement rules. SUBMIT compares actual payload length and capability count against that exact registration before request allocation, private-space reservation, native transfer or invocation serial acceptance. Oversized requests return ordinary INVALID_ARGUMENT with zero owner ID and unchanged source custody. The packet decoder passes its checked capability iterator directly to native preparation, removing its redundant temporary vector. Accepted invocation, result-budget, delivery, draining and retirement contracts remain explicit. Migrate every producer and fixture to the new signature without a deprecated unbounded fallback. These budgets describe service-owned receiving storage; they add no global CALL-size ceiling, user-pointer retention, foreign selector or capability grant. Literal malformed/zero/exact registration controls, rejected-inventory checks, actual CPL3 calls and existing VM oracles are required. Then connect the owned Procd/Launchd bootstrap path through its held private route, actual claimed caller identity, server-chosen grant receipt and local relocation, retaining each committed/draining owner through exhaustive cleanup. Actual consumer VMs, complete fair realm progress and both full guest builds remain open acceptance requirements.

Explicit owned receiver admission acceptance — 18 September 2026: Signed 7034572037d1217b841c04dd9f45d5b254122a91. REGISTER binds explicit byte/capability request limits to the actual receiver generation and RECV binding. Zero dimensions, exact repetition and conflicting changes are checked without additional authority. Oversize is refused before native request allocation, transfer or invocation acceptance. Checked packet descriptors feed native preparation without a redundant vector. Seven new host controls and four strict 702/726-unit matrices pass, with both standalone controls, eight warning-free native builds, Clippy and rustdoc. Both actual 60-second VMs pass; ten new CPL3 admission checks precede every existing ownership, mapping, origin, lifetime and retirement oracle. Original build outputs reproduce packaged artifacts; all fifteen native component signatures are verified. Allocation controls observe no requests on oversized refusal and equal direct-native/packet submission allocation. Original CI 602/603 passes from four complete logs (738,406 bytes), without warnings. Actual owned Procd/Launchd service adoption, consumer VM execution, complete realm fairness/readiness/sealing and both full builds inside EriX remain open.

Original coherent realm runtime prerequisites — 18 September 2026: Signed bd127228f62cd5320e87642e79aa7c1cd8212e24 selects original shared dependency revisions. Four strict default/all-feature development/release matrices pass 702/726 kernel units plus two external controls per configuration, retaining three pre-existing ignored tests. Thirteen native builds cover ordinary, tracing, owned-invocation, lifetime and coherent SMP configurations. Formatting, strict host/native Clippy, private rustdoc and Markdown pass with zero warnings. Direct Rust implementation bytes are unchanged. Original CI is under observation. Matching catalogs, source-bound consumer VMs, complete realm operation and both full guest builds remain required.

Original coherent realm source CI acceptance — 18 September 2026: Signed bd127228f62cd5320e87642e79aa7c1cd8212e24 passes CI 605 and CI 604. All four terminal logs are complete (738,372 bytes), with zero final warnings. This closes the original CI observation recorded above. Coherent catalog publication, actual consumer VMs and full guest-build acceptance remain separate open requirements.

Tracking and rollout

Runtime dependency alignment — 15 September 2026

Signed 6223e5dc40248fd41d5492d72158c7bc5099f122 aligns the existing dependency pins with the original signed library graph. This checkpoint changes Cargo selections and the roadmap; the repository's Rust implementation files are unchanged. The default/all-feature development/release matrix passes 661 default / 685 all-feature tests, formatting, strict host/native Clippy, 10 native builds and private rustdoc, without warnings. Canonical documentation checks pass. Three existing native-only test ignores remain unchanged. Push/review CI 572/573 passes with complete classified logs and no warnings. Coherent product catalog adoption and product VM acceptance remain pending. Review: #3.

Coherent runtime source adoption — 15 September 2026

The product runtime catalog still selects the earlier source graph. Adopt the current original signed sources as one coherent graph before claiming product execution of the new kernel invocation, mediator construction and Procd caller-admission contracts. The frozen inventory covers 73 catalog components and 72 tracked Cargo manifests; 54 components need direct pin alignment, with further propagation after dependency commits are published.

Align dependency selections bottom-up, preserve original Git objects, and validate every altered repository under its supported strict configurations before signing and publishing its dependency commit. Full commit selectors remain mandatory. Unrelated work is preserved, and no synthetic replacement object or rewritten published history supplies build evidence. Update the runtime catalog only once all selected Cargo manifests and original metadata agree.

Run actual product images covering authenticated Launchd activity and the relevant lifecycle/authority regressions, adding negative caller controls where needed. Keep complete warning-free build/test/image evidence and monitor existing CI. Significant regressions use the canonical bug report format. Dependency alignment alone does not prove runtime authority closure, mediator execution, performance improvement or either complete guest build generation. Typed grant return and guarded bootstrap remain the next realm implementation boundaries.

Construction without child root capabilities — 15 September 2026

Kernel operation 54 admits only actual Process endpoint holders and constructs a Created child with exactly one primary endpoint and no root capabilities. The native TCB retains address-space backing independently. The caller receives a unique install grant, an endpoint master and only an explicitly requested MAP-only VSpace receipt. The checked request distinguishes absence from a genuine slot-zero receipt. Former-root slots are usable; actual caller windows, native capacity, occupancy and child window scope remain enforced. Rollback disposes only successful new receipts and the partial child while preserving pre-existing bindings. Ordinary operation 32 remains unchanged. Initial inventory is not a seal or a permanent ban on later explicit installation. Signed original revision: 6d2ca19c48d3663db4b3a1eba4e9b7588b351f6f. Strict default/all development/release matrices pass 661/685 tests including two standalone controls, with three existing ignores. Host/native Clippy, private rustdoc, formatting and ten freestanding builds pass without warnings. Six added host controls cover 30 valid layouts, exact refusal inventories, actual caller windows and backing through abort or start/kill/destroy. Both isolated native VM scenarios pass; current component CI has complete warning-free logs.

Procd adoption, authenticated grant return, guarded bootstrap authority, private mediator execution, readiness, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase semantic authority and private-item documentation audits remain incomplete.

Staged endpoint attenuation checkpoint — 15 September 2026

Kernel operation 53 narrows only the actual install grant's matching Created child's primary endpoint. The grant must cover the current rights as well as the requested result. Final identity/state checks and the allocation-free CSpace mutation share the child record lock. Exact zero and repeated reduction preserve object identity, other aliases and revocation associations; restored rights, stale or foreign targets, malformed fields and started children refuse. Signed original revision: d690eda817e56b515a278bdbb5ea6c5aedeb431b. All 655/679 default/all tests pass, with three existing ignores, strict host/native development/release Clippy and private rustdoc, formatting and ten native build configurations. CI 568/569 passes with complete warning-free logs. Both actual native VMs pass with empty QEMU stderr and clean teardown. The lifetime fixture retains thirteen installation and seven construction/disposal calls, adding eight real CPL3 attenuation calls with actual returned identity and complete cleanup. The owned-invocation oracle remains unchanged.

Authenticated grant return, independently minimal bootstrap/root authority, retained native and nested guards, private mediator execution, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase authority and private-item documentation audits remain incomplete.

Dependencies: integration#1, lib-posixabi#1

Dependencies identify required contracts and closure gates; preparatory inventory/design can proceed in parallel under one owner per edited file. Link bounded implementation issues and their PRs here before claiming acceptance. Use feature/posix-compat, regular signed commits in the canonical contribution format, and WIP PRs linked to the exact coherent component graph. All cross-repository Cargo/catalog selections and CI helpers use full 40-character lowercase commit hashes, including transitive dependencies; do not substitute branch, tag or implicit HEAD selection.

Close criteria only with their own reviewed deliverables and validation evidence. Pending, skipped, cancelled, failed or predecessor-only results remain distinct. Keep main images unchanged until explicit promotion direction; technical completion does not authorize merges, release tags or publication.

Process-start census correction — 19 September 2026: signed Kernel b762e19d0c16acd605d0f6123994a586cc6fcde1 requires a successful install-grant absence census before process start. An unavailable census returns the existing refusal and preserves the whole staged child and grant state. Hosted controls cover unavailable census, actual grant disposal and malformed-target precedence. Normal bootstrap initializes tracking before admission; production reachability of the injected condition or a native authority escape is not established. Kernel issue 18 uses the canonical bug report and records the original failure and bounded correction.

Four strict Kernel matrices pass 704/728 library tests and two standalone controls each; three existing ignored tests remain ignored. Formatting, strict host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass. Original Kernel CI 606 and 607 pass from all four complete hashed logs (739,843 bytes), without warnings.

Signed Integration b65183ddb93eb4396d4140a002c3727fec42ff87 selects that Kernel and the reconciled Docs 7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d, preserving all other catalog entries and all previously checked orchestration bytes. The matching guarded-preparation VM passes both unique markers and ordinary successful shell exit under unchanged 120-second hard and 45-second progress limits. All 106 artifacts, all 73 original component identities and the actual signed image are verified without warnings. Serial SHA256: a373a8ccd81ac3efbaa492cbf2e1f991f3cc34dcbf23a1435c1c48cd75cd5c1c (55,776 bytes); signed boot-image SHA256: 3b88d37183cf36dcbd5f1105cc0fd86e79aa4489d311300003f3f362c24bcd0a. This remains an unstarted staging fixture. Normal native execution does not exercise the hosted unavailable-census condition.

The prior complete 169-helper/four-matrix Integration evidence is verified against unchanged implementation bytes. Focused catalog/source checks pass, including 46 immutable-source and five tool-selection tests. An initial host fixture failure caused by disabling its deliberate Git replacement setup is retained; the established helper environment passes without altering product checks. The static census covers 3,127 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 170 direct missing_docs gates and 92 conventional crate roots; complete semantic authority and private-documentation closure remain open.

Original Integration CI 1679 and 1680 are queued. Earlier 1677/1678 remains queued and 1675/1676 is running. No unchanged workflow is rerun or cancelled. Complete mediator execution, full source/effect/frame proof, upstream Rust/LLVM rebuilding and both full EriX build generations inside EriX remain required. No whole acceptance item is newly completed.

Shared native terminal transition — 19 September 2026: signed Kernel 37d9c74d6d1209729c520a52a274c1646efe225c consolidates exit and kill event reservation, lifetime preflight, exact-generation commit and receiver/invocation retirement into one documented implementation. Existing public behavior and root exit cleanup remain unchanged. Terminal state and actual resource destruction stay separate. This completes the terminal-refactor prerequisite in child lifetime design #19; it introduces no lifetime binding, new opcode or additional authority.

Four strict Kernel matrices pass 704/728 library tests and both standalone controls, with three existing ignored tests unchanged. All thirteen native build/Clippy profiles, formatting, host/native Clippy and private rustdoc pass without warnings. Original Kernel CI 608 and 609 pass from all four complete hashed logs (739,870 bytes), without warnings.

Signed Integration a62d1381f56a01afc692112d9b427205eaeb6a2e updates both full Kernel selectors and five stale native diagnostic selectors while preserving source memberships and tested orchestration bytes. Both maintained native runners pass their original 60-second scenarios: lifetime revocation and owned invocation. Complete serial logs are retained (1,807 and 1,587 bytes), QEMU stderr is empty, and build warnings are absent. Packaged Kernel bytes match retained unstripped artifacts; all fifteen exact original component trees and signatures verify. Four current strict 320/321-test Integration matrices, native builds, formatting, host/native Clippy and private rustdoc pass. Seven focused source/native-policy checks pass; the complete 169-helper evidence remains hash-bound to unchanged implementation bytes.

Original Integration CI 1681 and 1682 are queued; older corrected 1675/1676 remains running. The static census covers 3,128 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 170 direct missing_docs gates and 92 conventional roots. Full semantic authority and private rustdoc closure remain open. Native child-lifetime custody, running mediator lifecycle, full frame proof, upstream Rust/LLVM rebuilding and both full EriX build generations inside EriX remain required. No whole phase acceptance item is added.

Native child lifetime checkpoint — 19 September 2026: signed Kernel 1428885e6d implements operation 58 using the actual Running caller, an exact Created child, independent Process authority and its real local install grant. It consumes only that grant, reserves cohort events before terminal effects, stops descendants before their supervisor and retains each bound child's cleanup duty and first failure independently of userspace survival. Return-boundary disposal closes outgoing accounting and respects current/active-interval protection. Fourteen new real-object controls cover refusals, rollback, nested stopping, a 257-descendant tree, late preflight failure, exact reuse and failed explicit abort after unlinking. Four strict 718/742-test configurations and both standalone controls pass; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Original Kernel CI 610 and 611 pass from four complete hashed logs, 751,929 bytes, without warnings.

The matching maintained lifetime VM passes its original 60-second scenario with the additional ERIX_KERNEL:CHILD_LIFETIME_OK marker. A real CPL3 supervisor proves ChildPopulate refusal, malformed/generation refusal, actual Process-route binding, start and exit. An independent observer verifies both exact children, CSpaces and mappings absent before terminal-event consumption, then disposes the unbound supervisor. The runnable child has a faulting sentinel and intentionally does not execute. All sixteen additional mapped pages are disposed. The original owned-invocation VM also passes its unchanged scenario. Complete serial logs contain 1,838 and 1,587 bytes; QEMU stderr is empty and build warnings are absent. Packaged Kernel bytes match retained original unstripped artifacts and all fifteen selected component signatures verify. Lifetime serial SHA256 is 012b46541b7c1c89d954cdbebda855037152a4e39ffad20ad7bdcc8c7b5c2572.

This establishes explicit native supervision with actual caller-side CPL3 evidence. Executing-child, no-successor native idle, allocation/partial-effect failure coverage, Procd adoption, running-mediator failure, provider completion, complete source/effect/frame proof, upstream Rust/LLVM rebuilding and both full EriX-in-EriX generations remain open. Host idle controls do not establish native interrupt or wakeup behavior. No whole phase acceptance leaf is added.

Signed Docs 9ca5a5e811766a4506c0626cd58f8e228d0bacf8 updates the technical manual's native admission, preflight, stopping, partial cleanup and safe return/idle contracts. All 45 tests and the complete 2,425-page manual pass with zero final warnings. All 447,213 word boxes are in bounds and all three changed contract pages are visually reviewed. Shared API reference source is unchanged. Original Docs CI 981 and 982 pass from four complete hashed logs, 773,510 bytes. Both pass 45 tests and the complete 2,425-page manual. TeX pass warning counts are 36/1/0, with zero final-pass warnings; neither workflow was rerun or cancelled.

Signed Integration 581226ab5435dc66c6f93157606b6d4d83475b15 selects the coherent original Kernel/lib-capabi/lib-ipc graph and updated manual. All four current strict 320/321-test configurations, four native builds, fmt, strict host/native Clippy and private rustdoc pass without warnings. Source and updated native-policy checks pass; the full 169-helper evidence remains bound to unchanged orchestration bytes. The final post-VM changes select only the newer Docs revision and update roadmap status; native source catalog, scenario, runtime and orchestration bytes are unchanged. Original Integration CI 1683 and 1684 are queued.

Executing-child and terminal-reply checkpoint — 19 September 2026: signed Kernel dd9eace5 validates actual CPL3 nested-child execution and current-child ancestor termination. Synchronous control dispatch now ends its request borrow before effects and checks original caller identity, generation and terminal state before any response write. It keeps terminal completion in Kernel-owned result registers with zero reply length; ordinary native return switches away. A surviving caller retains its normal encoded response. Two focused actual-object regressions cover terminal request preservation and the surviving-caller reply. The dispatcher is split from the tracing/policy file. A supervisor binds and starts a child; that child binds a staged grandchild and kills its supervisor through its own explicit Process SEND route. Read-only witnesses require terminal caller storage to survive dispatch, then exact child/grandchild absence before the independent observer reads child-before-supervisor events. Both terminal payloads have immediate UD2 sentinels. An unrelated Created process retains its exact record, empty capability inventory and mappings until explicitly aborted. All four additional lifetimes and twenty-two mapped pages must be disposed for ERIX_KERNEL:CHILD_EXECUTION_OK.

Four strict Kernel configurations pass 720/744 library tests and both standalone controls; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Signed Integration c14c5a61 requires the additional marker while preserving every earlier marker and the original 60-second limit. Both actual native scenarios pass, with 1,870/1,587 complete serial bytes, empty QEMU stderr and no build warnings. Packaged Kernel bytes equal retained original artifacts after normal stripping; all fifteen original source signatures verify. Lifetime serial SHA256 is 1b2f983239efca55c8bc0f6f08ee91cfdcd37d4d1f6951bbd740e4d9b45d1a2f. Four current Integration 320/321-test configurations, native builds, strict Clippy, formatting, private rustdoc and updated policy checks pass. Earlier 169-helper evidence is hash-verified against unchanged orchestration; it was not rerun for these scenario/catalog changes.

Signed Docs b4b01d87 documents the executing-child observations and remaining limits. All 45 tests, the full 2,425-page manual, 447,382 word bounds and visual review of the changed pages pass, with zero final warnings. The API reference source is unchanged.

This extends native executing-child evidence; it does not establish no-successor native idle/wake behavior, provider completion, Procd adoption or a complete service lifecycle. The original install-grant constructor still gives GRANT | MINT while binding needs only GRANT; move-only transfer preserves exact rights. Both diagnostic grants are consumed, but rights minimization remains an explicit audit follow-up. Full source/effect/frame proof, the Pagerd gate, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.

Related implementation tracking: Kernel feature, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.

Original Kernel CI 614 and 615 pass from four complete hashed logs, 753,462 bytes, without warnings. Original Docs CI 983 and 984 pass from four complete hashed logs, 773,542 bytes. Both pass all 45 tests and the complete 2,425-page final manual; reference-resolution warning counts are 36/1/0, with zero final warnings. Original Integration CI 1685/1686 remains queued at its second observation.

Older original Integration CI 1678 passes all 489 catalog scenarios and both native Kernel diagnostics, then fails the development COM1 editor probe after its physical counterpart passes. Rust and Markdown pass. All three complete logs total 13,384,697 bytes with no warnings; the outer input status does not establish cause. The canonical bug report is issue 67, with bug/ci/phase-6 metadata. Earlier editor and filesystem failures remain separate. No original workflow was cancelled or rerun.

Native cleanup without a userspace successor — 19 September 2026: signed Kernel 2cf5b34c adds a seventh actual CPL3 caller to the maintained lifetime diagnostic. After every earlier assertion, the observer binds/starts the final child and yields. The child kills that supervisor through its own explicit Process SEND route. Immediate faulting sentinels forbid either terminal payload from resuming. Ordinary native return closes CPU accounting, detaches current attribution, progresses reclamation and finds no runnable successor.

A diagnostic-only read-only witness then requires empty CPU accounting, only terminal retained records, no bound cleanup duties or event reservations, exact child identity/CSpace/mapping absence and both unconsumed child-before-supervisor events. All six final child pages retire; three original unbound terminal records remain for prior assertions. The witness neither performs cleanup nor selects a process nor installs an interrupt. ERIX_KERNEL:CHILD_IDLE_CLEANUP_OK precedes completion before HLT, so actual hardware halt/wakeup remains a separate gate.

Signed Integration 4d6f4fe8 requires the additional marker while preserving all earlier assertions and both 60-second scenario limits. Both actual native VMs pass: 1,905/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256: 4a7cba61f75f4eeac47896d165b8dbcd217e4c75e2a81c8ae0f29957facb929c. Packaged Kernel images match retained build artifacts after normal stripping; all fifteen original component signatures verify. Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Post-VM changes only select updated Docs in full catalogs and update roadmap status.

Signed Docs 69466a64 documents the pre-halt boundary and consolidates stale status paragraphs. All 45 tests, the complete 2,425-page manual, 447,534 word bounds and visual review of pages 562–564 pass with zero final warnings. API reference source remains unchanged. The static audit passes 3,140 authored code files below 1,000 lines, 74 manifests, 259 full Git selections, 171 direct missing_docs gates and 92 conventional crate roots; semantic authority and complete private-rustdoc closure remain open.

Original Kernel CI 616 and 617 pass from four complete hashed logs, 753,458 bytes, with no warnings. Original Docs CI 985 and 986 also pass: four complete hashed logs, 773,510 bytes; both pass 45 tests and the final 2,425-page manual. Reference-resolution warning counts are 36/1/0 with zero final warnings. Original Integration CI 1687/1688 remains queued at its first observation.

Older original Integration CI 1677 is now terminal failure: all 489 catalog cases, both native diagnostics, development physical/COM1 editor and release physical editor pass before release COM1 fails. Rust and Markdown pass. Three complete logs total 13,385,246 bytes without warnings; bug 37 retains this evidence. Companion 1678's earlier development COM1 failure remains separate in bug 67; a common cause is unproven. No original workflow was cancelled or rerun.

Further native failure controls, grant-rights minimization, terminal accounting, Procd adoption and complete service lifecycle acceptance remain open. Existing install-grant creation still supplies GRANT | MINT while binding needs GRANT, so minimum authority is not claimed. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.

Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.

Native terminal-event allocation refusal — 19 September 2026: signed Kernel ba03995f extends the actual executing-child sequence with one deliberately refused heap allocation. Separate diagnostic preparation captures the original supervisor, child, staged grandchild and independent process records/capability inventories, then gives an empty event queue one-event capacity. No queued event or existing reservation is discarded. The first terminal-event reservation succeeds; the second arms exactly one null return from the real Kernel allocator. Ordinary collection growth and Process dispatch return RESOURCE_EXHAUSTED before any terminal effect.

Read-only witnesses require complete reservation rollback, an empty event queue, unchanged exact records and capabilities, and preserved code/stack/message mapping ranges. Actual CPL3 instructions validate the refusal reply before the next ordinary ancestor kill succeeds with allocation available. Every earlier terminal, descendant-disposal, independent-process and no-successor idle assertion remains required. ERIX_KERNEL:TERMINAL_EVENT_RESERVATION_OK requires one consumed allocator refusal and no remaining armed fault. Fault controls are absent from ordinary images; this covers injected allocation failure, not spontaneous heap exhaustion or independent resource-release failure. No witness supplies a syscall result, cleanup effect or scheduler choice.

Signed Integration cf5b2f5f requires the new marker without changing either 60-second limit. Both maintained native VMs pass: 1,948/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is d485019082175f769ecc2d406d88c6cc84a7df323605027663f5bcc79ca03ad9. Packaged Kernel bytes match retained original artifacts after normal stripping, and all fifteen original source signatures verify. Post-VM changes only select updated Docs in full catalogs and consolidate roadmap status.

Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and updated policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed Docs 62ba2ffa passes 45 tests, the complete 2,425-page manual, all 447,688 word bounds and actual visual review of pages 562–565, with zero final warnings; API reference source remains unchanged. The static audit passes 3,142 authored code files below 1,000 lines, 74 manifests, 259 full Git pins, 171 direct missing_docs gates and 92 conventional roots. Complete semantic authority and private-rustdoc closure remain open.

Original Kernel CI 618 and 619 pass from four complete hashed logs, 753,434 bytes, with zero warnings. Original Docs CI 987 and 988 pass from four complete hashed logs, 773,506 bytes: both pass 45 tests and the final 2,425-page manual, with reference-resolution warning counts 36/1/0 and zero final warnings. Original Integration CI 1689/1690 is queued. Earlier filesystem, directory, editor and full-frame regressions remain unresolved; original workflows were not cancelled or rerun.

The terminal-accounting audit confirms that ordinary Procd terminal handling queries original TCB counters after receiving its event, while automatic bound-child reclamation removes that TCB. Its separate private-mediator branch does not take the same query path; adoption must state which lifetimes require retained metrics and preserve their original generation without fabricated zero/wall-clock values. Independent release-failure coverage, grant-rights minimization, accounting, Procd adoption and full mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.

Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.

Independent native child release recovery — 19 September 2026: signed Kernel 82d88b60 extends actual supervisor-exit coverage with two deliberate refusals at the original staged child's final VSpace-release callback, after capability disposal and unlinking. The first error is KernelHeapExhausted, the second CspaceSlotMissing. Read-only observations around two ordinary CPL3 observer yields require the original full record, generation, abort custody and first error retained, an empty original CSpace and retained mapped backing. The independent running child must already be absent from native TCB, CSpace and VSpace directories. The selected child's earlier directory position ensures its failure preceded that independent disposal.

The third callback must perform normal VSpace release before all original terminal-event, generation and resource-absence checks pass. ERIX_KERNEL:CHILD_RELEASE_ISOLATION_OK requires exactly two refusals and complete eventual disposal. Fault control uses only atomics at the locked callback boundary and exists only in the isolated native diagnostic. No witness performs cleanup, supplies a successful release/syscall result or chooses a scheduler target. This establishes injected callback-refusal coverage, not an observed hardware or allocator malfunction. All earlier nested-child, allocation-refusal and no-successor pre-halt assertions remain required.

Signed Integration 294a467a requires the added marker with both original 60-second limits unchanged. Both maintained native VMs pass: 1,988/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is 606fff037be022c876220d8e8f329c9046ffea5dcdf80831026649aedfbe0b08. Packaged Kernel bytes match retained original unstripped artifacts after normal stripping, and all fifteen original component signatures verify. Post-VM changes only select the updated manual source in full catalogs and reconcile roadmap status.

Four strict Kernel 720/744-test configurations, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test configurations, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed Docs 2a0ccc1a passes 45 tests, the complete 2,427-page manual, all 447,789 word bounds and actual visual review of pages 562–565 with zero final warnings. API reference source is unchanged. Static audit passes 3,143 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 171 direct missing_docs gates and 92 conventional roots; complete semantic authority/private-rustdoc closure remains open.

Original Kernel CI 620/621 and Docs CI 989/990 pass from four complete hashed logs each (753,438/773,910 bytes), with zero final warnings. Current Integration originals are observed after publication. Earlier filesystem, directory, editor and full-frame regressions remain unresolved, with original evidence retained; no workflow is cancelled or retried unchanged.

The grant-rights audit confirms actual Procd derivation callers and exact GRANT | MINT receipt checks in Procd and Launchd. Grant authority minimization must coordinate those consumers and distinguish the grant's own rights from its installation ceiling. Original generation-bound terminal accounting, Procd adoption, provider completion, hardware halt/wakeup and complete mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.

Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.

Explicit grant implementation progress — 20 September 2026:

Kernel commit 4a5333f760e258ebca23047a362d1cff4fded0c0 is signed and pushed. Creation preserves exact own grant rights, including zero. Derivation requires actual MINT and subsets of both own rights and installation scope. Zero-right custody still blocks process start until disposed. Four strict 724/748-unit configurations, both standalone controls and thirteen native build/Clippy profiles pass without warnings; three existing ignores remain. Original CI 622/623 passes from four complete hashed logs, 756,715 bytes, zero warnings. The new actual CPL3 derivation/disposal controls and GRANT-only relocation/installation compile; their matching VM execution remains pending.

The consumer audit also identified Loaderd and Deviced receipt checks. Procd's move-only handoff cannot attenuate the original delegating grant: it now derives a GRANT-only final receipt into the already-disposed VSpace receipt slot and drops the source before returning that receipt. Nonderiving materialization and rootless mediator paths request GRANT directly. Partial failure retains original-generation rollback and all remaining local custody. Procd, Launchd, Rootd, Loaderd and Deviced pass their default unit suites; their full strict matrices and coherent guest validation remain open. Deviced bug 4 records a separately observed quarantine test race and its test-only serialization correction.

This is partial implementation evidence, not completed lifecycle or self-hosting acceptance. The canonical checklist remains 15 of 460 leaves, 3.48% weighted. Full terminal accounting, provider completion, consumer lifecycle, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both complete EriX-in-EriX generations remain required.

Verified grant-rights checkpoint — 20 September 2026:

Both maintained isolated native scenarios pass on their first attempts under the unchanged 60-second scenario limits, with no build warnings and empty QEMU stderr. Lifetime now exercises 27 ordinary CPL3 grant-right controls and requires INSTALL_GRANT_RIGHTS_OK before its existing cleanup assertions. Its 2,025-byte serial stream has SHA256 6c685f1ceaf9080bf0bec628a4fac512bf9049d0fbcfe2b3737666adf414ca3a; owned invocation retains 1,587 bytes. Normal stripping exactly matches both packaged kernels to retained original artifacts. All fifteen selected original source signatures and clean trees verify. These minimal native scenarios establish neither full service-image acceptance nor a guest build.

All thirteen shared libraries pass their strict matrices and original CI. The five direct receipt consumers pass four strict host/native configurations; original CI passes for procd 292/293, launchd 145/146, rootd 1037/1038, loaderd 99/100, deviced 206/207. Rootd baseline regression and Deviced quarantine fixture race are corrected with retained original failures and successful corrected-source CI. Manual/API updates and remaining full-catalog alignment are in progress.

Integration bug 68 records five original CI failures (1683/1684, 1685/1686 and 1688), each with 127 manifest/catalog revision mismatches before full VM execution. All fifteen complete logs are retained, 1,512,137 bytes with no warning candidates. Individual-crate and minimal-native validation did not prove full catalog coherence. Remaining dependents are being aligned and validated bottom-up; equality and immutable-source checks are unchanged. Earlier 1681/1682 separately reached 479/489 and 487/489 VM passes, with ten and two scenario timeouts at the original 120-second bounds. Those filesystem failures require separate analysis.

Canonical acceptance remains 15 of 460 leaves, 3.48% weighted. Complete lifecycle and terminal accounting, provider completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain required.

Owned address-space preparation — 22 September 2026: Kernel issue 22 records the private hardware-root construction, exact authority, activation, invalidation, failure custody and retirement contract before implementation. Signed Kernel 5e818e8b6d1d, in Kernel PR 3, adds the design contract and an independent mapping-bit provenance regression. The current shared hierarchy and production permission encoder remain unchanged. An isolated rewrite produced the same 17 instructions and 63 bytes, so it was rejected as an optimization.

Four strict Kernel matrices pass 737 default / 761 all-feature tests in development and release, retaining the same three existing ignored cases. Formatting, host/native Clippy, all 13 native builds, private rustdoc and Markdown pass without warnings. Original CI 628/629 is running. No hardware-owned root, concurrent user execution, elapsed-time speedup or native isolation closure is claimed. The profiler and unchanged startup timing gates remain open in Integration 3 and Integration 72. The phase checklist stays at 15/460 accepted leaves, weighted 3.48%; external Rust/LLVM rebuilding inside EriX and both full guest-build generations remain mandatory and unproven.

Native table-custody checkpoint — 22 September 2026: signed Kernel 2e744897de7c, in Kernel PR 3, gives unpublished table allocations one cleanup owner through translation and initialization. Empty-table installation and huge splits transfer custody at parent publication. The raw allocation-return helper and duplicate huge-split initialization are removed. Parent/leaf invalidation, interrupt masking, permission templates and current shared-hierarchy lifetime remain intact. Five host controls cover allocation/translation failure, invalid geometry, abandoned preparation and publication. Four strict configurations pass 742 default / 766 all-feature tests, retaining three existing ignored cases; formatting, host/native Clippy, private rustdoc and thirteen native builds pass without warnings. Original Kernel CI 630/631 passes from four complete logs, 771,607 bytes and zero warnings.

Signed Integration fe63adde8ff9, in Integration PR 12, selects that exact Kernel in all three catalogs. Every other selection and Kernel dependency manifest is unchanged. All 172 maintained helper commands pass without warnings; unchanged Rust inputs retain their preceding strict matrices. Three original-source native executions pass lifetime revocation, owned invocation and mapping checks with unchanged 60-second guest limits, warning-free builds and empty QEMU stderr. Mapping isolation and sparse mappings have identical runtime settings; both maintained marker contracts pass on the retained mapping capture. All fifteen selected component signatures verify, and each packaged Kernel image equals its retained artifact after normal stripping. These results cover the current shared hierarchy, not independent hardware roots.

The Kernel evidence update and Integration evidence update change documentation only, with executable inputs proven unchanged. Their original Kernel CI 632/633 is running and Integration 1715/1716 is queued. Older full Integration CI 1701/1702 at b06dfad00202765491a64552dde29eaca1c24838 passes from six complete logs, 26,962,712 bytes and zero warnings, including both runs' ext4 quota, ext4 links and FAT32 directory-metadata cases. Their earlier timing failures remain retained with unestablished causes; 18, 20 and 70 have exact follow-up observations. No workflow was rerun or cancelled.

All 3,176 authored code files remain below 1,000 lines. The next work in Kernel 22 must resolve the supervisor baseline, bootstrap/saved-frame overlays and inactive-space population before adding root ownership, residency and retirement. Startup timing acceptance, complete authority cleanup and the profiler's measured speedup remain open. The phase checklist stays at 15/460 accepted leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven.

Ordinary mapping-domain checkpoint — 22 September 2026: resolved admission report records the original host failure and bounded fix. The fixture regression retains all three distinct failed attempts and the verified layout correction. Kernel now validates the complete ordinary user page before backing or mapping changes, with both control paths covered. Four strict 745/769-test configurations, thirteen native builds, Clippy and private rustdoc pass without warnings. Three exact-source native executions pass lifetime, invocation and mapping; four maintained scenario contracts are checked, with sparse and isolation sharing their identical runtime capture. All fifteen selected native signatures and packaged Kernel identities verify.

Integration pins the exact Kernel in all three catalogs, preserves every other selection and passes all 172 helpers. The unchanged ordinary exec-successor VM passes against the complete source graph, preserving its 120-second guest deadline, with no image warnings or QEMU stderr. Docs documents the domain and bootstrap distinction; all 45 tests and 2,431 pages pass, with 450,473 word bounds checked and no final warnings. The earlier Kernel CI 632/633 passes from four complete logs and zero warnings; current original CI remains under observation.

Bootstrap provenance, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

VSpace MAP authority checkpoint — 22 September 2026: the resolved bug report records three original failing host controls and the verified correction in Kernel. Current local MAP rights now govern map, protection and unmap requests. Empty and MANAGE-only aliases are denied; MAP-only access remains valid. Four strict 750/774-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.

The Integration catalog selects the exact signed Kernel in all three catalogs and passes all 172 helpers. Actual CPL3 calls preserve the authorized RW/NX page across restricted-alias refusals and drop all five temporary grants. Three native executions cover all four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signed sources and retained packaged artifacts. The original exec-successor service VM passes against all 73 components with its unchanged 120-second guest limit. All image warnings and QEMU stderr remain absent. Manual validation passes 45 tests, 2,431 pages and 450,550 checked word bounds, with both changed pages reviewed and zero final warnings.

The static audit covers 3,181 authored code files below 1,000 lines, 259 exact Git dependency pins and existing direct missing_docs gates. It does not close semantic authority review. Earlier full Integration runs 1705/1706 are running; 1707–1720 remain queued at the latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel 638/639 and Docs 1009/1010 pass. Each pair has four complete logs: Kernel totals 777,250 bytes with zero warnings, and Docs totals 774,674 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration 1721/1722 remains queued; it receives no CI acceptance credit.

Canonical acceptance remains 15/460 leaves, weighted 3.48%. Independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven.

Frame access checkpoint — 22 September 2026: the resolved bug report records three original failing host controls and the verified correction in Kernel. Explicit READ now governs admission and hardware activation. No-access mappings retain backing with USER/WRITE clear and NX set; write-only and execute-only requests are rejected without adding READ. Existing protection-transition rules remain in force. Four strict 757/781-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.

The Integration catalog selects the signed Kernel in all three catalogs and passes 172 helpers. Twenty-four actual CPL3 calls preserve earlier witnesses and cover no-access protection, write-only refusal, MAP-only frame derivation, denied READ and unmap after both frame grants are dropped. Three native executions pass four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signatures and retained packaged artifacts. The ordinary exec-successor VM passes against all 73 components with its unchanged 120-second guest limit. Builds emit no warnings and QEMU stderr is empty. Manual validation passes 45 tests, 2,433 pages and 450,702 checked word bounds, with the changed page reviewed and zero final warnings.

Static review covers 3,182 authored code files below 1,000 lines, 259 exact Git pins and existing direct missing_docs gates. This does not close semantic authority review. Earlier full Integration runs 1705/1706 remain running and 1707–1722 remain queued at their latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel 640/641 and Docs 1011/1012 pass. Each pair has four complete logs: Kernel totals 782,838 bytes with zero warnings, and Docs totals 775,110 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration 1723/1724 remains queued; it receives no CI acceptance credit.

Canonical acceptance remains 15/460 leaves, weighted 3.48%. Authorized protection restoration, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

Current-grant protection checkpoint — 22 September 2026: the resolved device-backing report distinguishes its original metadata-authority inconsistency from the separate restoration feature gaps. The Kernel implementation permits representable no-access/R/RW/RX changes through current exact-backing grants and aliases while active or inactive. It removes historical access ceilings and original-slot equality while preserving current VSpace MAP, selected frame rights, kind/range/identity checks, W^X, explicit READ, backing custody and failure ordering. Four strict 766/790-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.

The coordinated catalog selects that original signed Kernel in all three catalogs and passes all 172 helpers. Fifteen managed-frame calls and twenty-nine device/domain calls pass inside the original lifetime window and deadline. Actual user instructions write, execute, rewrite and execute managed RAM, check narrow alias authority and final disposal, while a reused device slot cannot authorize unrelated backing. Every prior marker remains required. Three native executions pass four original contracts with complete signed source and artifact checks; the ordinary exec-successor VM passes the full 73-component graph and original 120-second limit. Image warnings and QEMU stderr are absent. Manual validation passes 45 tests, 2,433 pages and 450,954 word bounds; both changed pages are reviewed with no final warnings or overflow.

Static review covers 3,184 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins and 174 direct missing_docs gates. Full semantic authority review remains open. Older Integration CI 1705/1706 has eleven real ext4 timeouts across eight scenarios, with complete retained logs and no accepted rerun. Their root cause and correction remain unresolved. Publication CI: Kernel 642/643 and Docs 1013/1014 pass. Each pair has four complete original logs: Kernel totals 790,650 bytes with 766/790 tests and zero warning candidates; Docs totals 775,150 bytes with 45 tests, 2,433 pages and zero final warnings or overflow. Retain the original 35/1/0 LaTeX warning convergence. Integration 1725/1726 remains queued and receives no completed CI acceptance. The separate older ext4 deadline report remains open.

Canonical acceptance remains 15/460 leaves, weighted 3.48%. Complete POSIX protection support, Process endpoint scope, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

VSpace ownership preparation — 22 September 2026:

Live VSpace records and production mapping tables are non-cloneable. Test observations contain descriptive metadata, synthetic selectors use independent tables, and leaf-encoder checks borrow live mappings under the record lock. Selectors accept only the mapping table they consume. Current grants, backing custody, first-match ordering, reference scans and hint visit-count controls remain intact; the rights control now uses actual activation/deactivation. The former whole-record snapshot helpers are removed.

Four strict Kernel configurations pass 766/790 tests with three existing ignored cases; thirteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. All 172 Integration helpers pass. Three exact-source native executions pass the four maintained mapping, sparse, invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Original 60/120-second guest limits, existing markers, exact component signatures and retained packaged artifacts remain required; image warnings and QEMU stderr are absent. No startup speedup or independent hardware-root acceptance is inferred.

The Kernel implementation and Integration source selection are published with Kernel validation evidence and Integration validation evidence. Continue under owned-root design 22, Kernel PR 3 and Integration PR 12. Publication CI: Kernel 644/645 pass with four complete original logs (790,604 bytes), 766/790 tests and zero warning candidates. Integration 1727/1728 remains queued and has no completed acceptance; earlier ext4 deadlines remain tracked in Integration report 73. Complete authority cleanup, external toolchain rebuilding within EriX and both full guest build generations remain open. Canonical acceptance remains 15/460 leaves (3.48% weighted).

Managed-frame diagnostic recovery — 22 September 2026: Kernel report 28 is resolved by the signed correction and coordinated catalog. The diagnostic admits an initially empty lower-half window while preserving the ordinary-domain guard and all 64-page, alias, hole, physical-byte and cleanup controls. The unnecessary heap allocation and raw-pointer cleanup state are removed, with expanded inline rustdoc.

Four strict 766/790-test configurations, fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. All 172 Integration helpers pass. Both maintained allocator scenarios pass independently with their original 60/120-second deadlines and complete markers; exact signed source and retained packaged-ELF checks pass. The ordinary exec-successor VM also passes against all 73 components. Image warnings and QEMU stderr are absent. The original failed native image remains retained; no unchanged rerun is used as the correction.

Static review still covers 3,186 code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Full semantic authority and inline-documentation review remain open. Older original Integration 1707/1708 both pass all 489 VM scenarios, Rust 320/321 and Markdown; six complete logs total 26,966,330 bytes with zero warning candidates. Publication CI: Kernel 646/647 pass with four complete original logs (790,634 bytes), 766/790 tests and zero warning candidates. Integration 1729/1730 remains queued and has no completed acceptance; earlier ext4 CI deadline failures remain unresolved. The separate supervisor physical-access window and independent hardware roots remain implementation work. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

Supervisor physical-access window — 22 September 2026: the signed Kernel implementation shares one restoring supervisor scratch transaction between frame scrubbing and physical mapping-byte copies. Caller backing custody and page-table/interrupt custody remain live through byte access, exact leaf restoration and local invalidation. Scratch is released afterward; read aliases clear the write bit and all temporary aliases clear user access and set NX. The unreachable raw-VA fallback is removed, and complete preflight rejects missing or ambiguous backing metadata before any range effects. No new userspace operation or capability grant is introduced. This is preparatory work for owned address spaces; independent roots and their switching/reclamation proof remain open.

Eight added host controls cover geometry, permissions, preparation and partial-effect failures, restoration/release ordering, and malformed later-page metadata without partial reads or writes. Four strict host configurations pass 774/798 tests with three existing ignored cases. Fourteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. The coordinated Integration catalog passes all 172 maintained helpers; its exact marker expectation is updated alongside the strengthened scenarios. Unchanged orchestration and profiler sources retain strict validation.

Six native executions satisfy seven maintained scenario contracts. Both allocator scenarios require the new same-VA/different-backing byte-and-leaf proof after complete cleanup, retaining every preceding marker and the original 60/120-second deadlines. Three further executions satisfy mapping, sparse, owned-invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Exact original signed source, retained artifacts and packaged Kernel matches are verified; no image warnings or QEMU stderr were observed. These checks establish no performance improvement. The technical manual documents backing and scratch custody; all 45 document tests and the complete manual build pass without final warnings.

Static checks cover 3,190 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Complete semantic authority and inline-documentation review remain open. Publication CI: Kernel 648/649 and Docs 1015/1016 pass. Eight complete original logs (1,572,758 bytes) confirm Kernel 774/798 tests, 45 document tests and the 2,433-page manual. Initial TeX reference warnings resolve through normal multipass generation; final passes are clean. Integration 1731/1732 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and its runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

Owned supervisor baseline — 22 September 2026: the signed Kernel implementation captures and verifies independently allocated supervisor tables before root VSpace creation, Rootd preparation and RAM seeding. Each copied page has one typed aligned Box owner before a parent references it; the recursive entry selects the copied root. Source boot/AP tables and mapped backing retain separate custody. User leaves, malformed geometry and invalid recursive identity are refused. Leaf permissions, cache policy and huge-page sizes are preserved; newly owned table branches use WriteBack and clear USER. Failed construction releases all unpublished allocations. This replaces a raw-pointer table-storage owner with shared typed storage and adds no unsafe Send/Sync implementation or userspace operation.

Eleven new host controls cover independent storage, allocation/read failures, invalid translation geometry, user leaves, recursive and huge-page errors, source-permission drift, retained owner links and table counts beyond the unrelated 64-page batch size. Four strict host configurations pass 785/809 tests with three existing ignored cases; fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The coordinated catalog passes all 172 maintained helpers. Both allocator scenarios require successful baseline capture before their original marker sequence, with capability grants and original 60/120-second deadlines preserved.

Six native executions satisfy seven maintained contracts: both allocator scenarios, mapping and sparse checks sharing identical runtime settings, owned invocation, lifetime revocation and ordinary exec-successor across all 73 components. Exact signed source and retained packaged artifacts are verified; no image warnings or QEMU stderr were observed. The technical manual specifies the custody boundary and passes 45 tests, complete 2,433-page generation, all 451,287 word bounds and changed-page visual review without final warnings or overflow. Static audits cover 3,194 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots.

Publication CI: original Kernel push 650 passes and PR 651 retains the host fixture failure. Regression 29 is resolved by signed Kernel 12184850cd73: a deterministic private predecessor reproduces the original defect, and the corrected fixture passes the complete local matrix and push CI 652/PR CI 653. Four complete corrected CI logs total 807,886 bytes with zero warning candidates. Only host tests and roadmap change; validated production sources and all catalog selections remain unchanged. Docs 1017/1018 pass with four complete logs (775,122 bytes), 45 tests and the 2,433-page manual. Initial TeX reference warnings resolve before clean final passes. Integration 1733/1734 remains queued at the latest retained observation and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. The retained baseline is a construction prerequisite for owned address spaces. Per-VSpace population, CR3 activation, invalidation and live-root reclamation remain open, and no speedup is claimed. Full semantic authority and inline-documentation review also remain open. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

Huge-leaf geometry correction — 22 September 2026: the bug report preserves four original host failures and one passing WriteBack control. The signed correction separates PAT from physical address bits, preserves permissions/cache indices across both huge splits, and gives newly allocated tables WriteBack policy. Scalar and batched translation, split preparation, snapshots and baseline validation share the documented geometry. No new userspace authority, original native exploit or universal boot failure is claimed.

Four strict Kernel configurations pass 796/820 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The catalog passes all 172 maintained helpers. Six native executions satisfy seven original contracts: mapping and sparse, lifetime, invocation, both allocator checks and ordinary exec-successor across all 73 components. The new native witness verifies real 2 MiB PAT translation, splitting and complete restoration; host controls additionally cover 1 GiB. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The manual passes 45 tests, 2,433 pages and changed-page visual review without final warnings or overflow.

Publication CI: Kernel 654/655 and Docs 1019/1020 pass. Eight complete original logs (1,592,794 bytes) confirm Kernel 796/820 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration 1735/1736 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Static audits cover 3,197 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, live-root reclamation and full semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven.

First-start register custody — 22 September 2026: the stack-domain bug report preserves three original host failures and one valid-stack control at unchanged production sources; the same four controls pass against the signed correction. Ordinary anonymous stack materialization now rejects addresses outside the existing user domain, and direct bootstrap writes require retained writable registered backing. Initial registers have Kernel-owned storage; stack preparation preserves the synthetic return slot, complete admission, startup arguments and rollback. The obsolete saved-frame user overlay and directory scan are removed. Complete external start-context admission and the separate bootstrap code/stack overlay remain distinct work.

Four strict Kernel configurations pass 807/831 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The catalog passes all 172 maintained helpers. Six native executions satisfy seven original contracts: lifetime, invocation, mapping and sparse, both allocator checks and ordinary exec-successor across all 73 components. The new witness checks all original initial register words after two real user stack mutations and before ordinary syscall capture. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The manual passes 45 tests, 2,433 pages and four changed-page visual reviews without final warnings or overflow.

Publication CI: Kernel 656/657 and Docs 1021/1022 pass. Eight complete original logs (1,600,791 bytes) confirm Kernel 807/831 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration 1737/1738 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Static audits cover 3,201 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, CPU residency, live-root reclamation and complete semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven.

## Problem and motivation Imported Rust/C++ runtimes need real growing heaps, protected mappings, isolated TLS, threads and blocking synchronization. Global errno, spin-only waits and fabricated clocks cannot support correct parallel compilation. ## Proposed behavior and scope ### Ordinary frame protection through current grants — 22 September 2026 Permit in-place replacement of an ordinary managed/device mapping's access with any state that the architecture can enforce and the selected current frame grant authorizes: no access, R, RW or RX. The same rule applies while inactive or active. WRITE or EXECUTE requires requested READ, and W+X remains prohibited. This removes the need to unmap and recreate a mapping solely to restore access already authorized by the caller's retained capabilities. The caller-local VSpace capability must carry MAP. The explicitly selected frame capability must independently carry MAP and every requested right; another held alias cannot supplement it. Establish current authority over the exact existing backing: managed mappings require their actual allocation identity and complete page containment, while device mappings require the complete existing physical page to lie inside the selected current device grant. Retained slot numbers, addresses supplied without a grant, and mapping permission metadata cannot replace those checks. Same-backing aliases may authorize protection, including a reused local slot holding a current valid grant to that backing. Unrelated, missing, retired or insufficient grants must fail before mutation; reuse for unrelated backing supplies no authority. Preserve managed/device/anonymous kind boundaries, backing identity and reference counts, original-leaf restoration and failure cleanup. Use the existing MAP_FRAME request envelope with no new flags, capability type or fallback. Ordinary frame permissions describe current user access, not irreversible sealing of authority the issuer still holds. Irreversible handoff must dispose of the issuer's control grants. Kernel-owned anonymous loader materialization retains its separate internal contract; this work does not by itself implement all POSIX mprotect behavior or narrow the existing Process endpoint's target scope. Document and test those boundaries explicitly. Acceptance requires paired in-place/unmap-remap controls for R/RW/RX in active and inactive states; same-backing aliases; insufficient, missing and reused grants; managed/device kind separation; complete range bounds; preserved refusal and allocation lifetime. Extend actual CPL3 coverage with an allocator-selected managed frame from the canonical validated boot reservations and usable-RAM inventory. Retire allocator authority before user entry. Actual user instructions must write a function under RW, remove access, restore RX and execute it, restore RW to change its bytes, and execute the changed function under RX. Check selected alias authority, retained mapping custody after final frame-grant disposal, final unmap reclamation, unchanged earlier witnesses and the original caller window and deadline. Preserve batch preparation/error ordering, fresh translation and TLB invalidation. Run all altered repository tests, formatting, strict Clippy, native builds, maintained native/service VMs and warning-free final documentation checks. Preserve original source and artifact identity, update the existing reviews and phase checklist, and monitor the exact CI runs. No performance or complete self-hosting acceptance is inferred from this change. ### Staged construction without root capabilities — 15 September 2026 Add kernel-control operation 54, CREATE_STAGED_PROCESS_WITHOUT_ROOT_CAPS, and checked StagedProcessWithoutRootCapsV1 scalar framing. Successful creation returns a live Created process and nonzero generation whose CSpace contains exactly its requested primary endpoint, with no CNode, VSpace or TCB capabilities. Native CSpace/TCB/VSpace objects and the process's VSpace lifetime reference still exist. No child code executes during construction. The endpoint initially retains its ordinary full endpoint rights; operation 53 independently narrows it before bootstrap execution. Keep the existing creation operation 32 and its producer behavior unchanged. The new selector is independently recognized: an older kernel refuses it, and callers must not fall back to old ignored flags or a child self-report. Admit it only on the existing Process endpoint family, without adding a capability type, endpoint factory or ChildPopulate creation authority. Use the existing fixed request envelope. arg0 contains the caller-local install-grant destination in its low 32 bits; its upper half is zero. arg1 low/high halves contain child-local primary endpoint and caller-local endpoint-master destinations. arg2 low/high halves contain the child window base and optional caller-local VSpace destination. arg3 contains the 32-bit window length, with a zero upper half. Flag bit 0 means that the VSpace receipt is requested; all other flag bits are zero. When the bit is clear, arg2's upper half must be zero. This explicit presence bit distinguishes an omitted receipt from a real receipt in slot zero. All slot fields retain their full unsigned width; slot zero and otherwise vacant former root positions are ordinary requested slots, subject to native bounds, actual caller-window visibility and occupancy. The checked codec validates framing, not native capacity or authority. The native constructor requires a valid child window containing the primary endpoint. The caller receives only its actual unique stage-bound install grant, endpoint master and optional MAP-only VSpace receipt. The grant is bound to the returned process/generation and exact child window. Existing capability ceilings, actual object identity and explicit disposal rules remain in force. Temporary native setup bindings must be gone before constructing the final primary endpoint and publishing the grant; otherwise former root positions would remain an unnecessary destination restriction. The TCB's independently held VSpace reference must keep backing alive even without any child or parent VSpace capability. On failure, destroy the partial child and dispose only successfully created parent receipts. Preserve pre-existing or overlapping destinations and the original failure; uncertain cleanup fail-stops. Never treat a requested slot as evidence that its capability was created. The new contract supplies an initial inventory, not a permanent prohibition on later explicitly authorized installations or a sealed realm. The returned grant remains a real pre-start population authority that its owner must account for and retire. Required checks include full-width codec/reserved-field cases, omitted versus slot-zero VSpace receipts, zero/former-root/last-slot endpoint destinations, invalid or inaccessible windows, occupied/overlapping outputs, exact parent and child inventories, no residual native objects, mapping/startup backing retention, attenuation through the actual grant and abort/terminal cleanup. Actual CPL3 creation/refusal/disposal must complement host tests. Procd adoption must select this operation only for the mediator role and preserve all ordinary start gates until authenticated grant return, minimum typed startup, retained native/nested guards, readiness, configuration/seal and fair retirement are independently implemented. No runnable realm or guest build is established by this constructor alone. ### Native staged endpoint attenuation — 15 September 2026 Add kernel-control operation 53, ATTENUATE_STAGED_ENDPOINT_WITH_GRANT, with a checked ProcessBoundEndpointAttenuationV1 request. This is a new recognized operation; an older kernel must refuse it, and producers must never fall back to an unchecked or post-execution self-report. No syscall number or service endpoint permission is added. Use the existing fixed KernelControlRequestV1 layout: arg0 low/high halves are the caller's actual install-grant slot and child endpoint destination; arg1 is the exact 32-bit rights mask, with its upper half zero; arg2 low/high halves are expected process and staging generation; arg3 and flags are zero. Both identity components are nonzero. Zero rights means exactly zero, never inheritance. Successful response values are zero. The native handler must validate the actually held GRANT-bearing install grant, its record, exact expected process/generation, live Created child, grant window, endpoint type ceiling and actual primary endpoint slot. Its rights ceiling must cover the current endpoint rights as well as the requested result; a narrow installer cannot manage a broader existing binding. The new rights must be known, valid for endpoints and a subset of current rights. Update only that existing binding's rights, preserving native object identity, all other bindings and revocation associations. The change allocates no alias and needs no new destination. Repeating the same attenuation may succeed; restoring a removed right must fail. Running, dead, stale, foreign, missing and wrong-type targets must fail without effects. Admit the operation only on the same Process and ChildPopulate control kinds as exact process-bound installation. Endpoint possession and descriptive IDs alone are insufficient: the actual held scoped grant remains mandatory. The immediate consumer is the future Procd bootstrap transaction, after the actual broad grant returns from Launchd. It will reduce the staged mediator's initial full endpoint to RECV before any private execution, providing independent native proof of that boundary. Required coverage includes codec/reserved-field rejection, missing and moved grant, wrong process/generation, wrong target/type/window/ceiling, exact attenuation and retry, attempted amplification, post-start refusal, actual CPL3 effect checks and full cleanup. This primitive alone does not admit mediator execution: authenticated grant return, native lifetime and nested revoker custody, minimal root/bootstrap inventory, readiness, configuration/seal and fair retirement remain separate gates. The current ordinary start prohibition stays in force. Implement the missing native memory/thread/wait mechanisms and their service adapters, including quotas, mmap/protection, TLS, wakeup races, fork interactions and required unwind boundaries. Profile their actual allocation and scheduling costs after lifecycle correctness is established. This issue records planned work; its unchecked criteria are not implementation proof. The normative basis is [Phase 6 and AC1–AC24](https://git.erikinkinen.fi/erix/docs/src/branch/main/phases/6.md). Planned native terminal-generation contract — 17 September 2026: Introduce operation 55 for exact native process/staging-generation/event-kind/status observations. The request has zero flags and arguments; malformed requests fail before dequeue. Successful responses preserve all four 32-bit fields, captured with the actual native terminal transition and retained after destruction. Empty queues return RETRY with zero values. These records constrain existing authority and confer no process-control capability. Kernel, shared IPC, Procd and Rootd migrate together. Procd must match the native process/generation pair before cleanup, CPU-time observation, restart or service-event publication. Remove the superseded identity-free native selector after all maintained consumers migrate, with no fallback on unsupported kernels. Preserve queue reservation, ordering, wake and failure semantics. Validate actual exit/kill, generation reuse, empty/malformed input and cleanup failure, then strict component checks and original bounded native VMs on a coherent immutable revision graph. This is the terminal-observation prerequisite for typed mediator bootstrap. The actual returned install grant already has a generation-checked endpoint-attenuation primitive for the first bootstrap effect. Guard custody, final receiver readiness, sealed publication, two mediators with real client I/O and both full guest builds remain separate mandatory work; this planned contract implements none of those by itself. ## Authority, security and reliability Memory and thread operations consume explicit capabilities and resource budgets. Preserve W^X, backing rights, zero initialization, generation-bound wakeup ownership and complete OOM/cancellation cleanup. Clock and entropy sources must be explicit; deterministic fixtures cannot satisfy cryptographic entropy requests. Apply the priority order: security, reliability, then performance. Keep suspected vulnerabilities in the repository’s restricted SECURITY.md reporting channel. ## Acceptance criteria - [ ] Inventory required allocation/mmap/protection/shared-memory/thread interfaces from selected tools and distinguish missing mechanisms from libc adapters over existing capabilities. - [ ] Implement authorized anonymous allocation and release for growing heaps/stacks, with checked alignment, zero initialization, quotas and OOM cleanup. - [ ] Implement required private/file-backed mmap, munmap, mprotect and synchronization behavior; preserve W^X, backing rights, dirty data and revocation. - [ ] Specify thread/process address-space ownership, thread start/exit/ join/detach, stack guards and cleanup with no unintended capability inheritance. - [ ] Implement per-thread TLS allocation, access base and destructor lifetime, integrating ABI and loader contracts; isolate errno and thread data. - [ ] Implement mutex/condition/rwlock/once/TLS-key primitives required by libc/tools with correct atomic ordering, wakeup ownership and destruction. - [ ] Implement race-free check/register/block/wake and actual monotonic deadlines; test notify-before-wait, wake-after-cancel, spurious wakeups, lost wakeups, priority/fairness effects and generation reuse. - [ ] Define fork interactions with multiple threads, atfork handlers, runtime locks and child state; no inherited lock may require a vanished thread. - [ ] Specify unwind/exception support needed by imported C++/Rust tools separately from native abort-only components; do not enable unwinding across kernel, IPC or incompatible FFI boundaries. - [ ] Provide explicit clock and entropy access needed by runtimes. Distinguish reproducible timestamps/test randomness from security randomness; never satisfy a cryptographic entropy request with deterministic fixture data. - [ ] Add stress/failure VMs for mapping protection, concurrent allocation, threaded compilation, TLS isolation, wakeups, joins and teardown under OOM. - [ ] Profile allocation, faults, mapping transitions and synchronization; optimize only measured costs after safety and lifecycle tests pass. For each implementation slice, retain actual formatting, strict Clippy, unit/doctest and warning-denied build results for all altered Rust repositories and valid configurations. Add relevant runtime VM coverage, monitor older unit/VM regressions in exact-head CI, and update canonical component documents and affected technical-manual/API material. Every authored code file must remain below 1,000 physical lines, with meaningful inline documentation and missing_docs enforcement in Rust crates. ## Alternatives and tradeoffs Linux syscall emulation is not implied by these runtime requirements. Reuse existing native mechanisms where sound and add only the mechanisms demonstrated missing by the selected tool workload. Allocator validation checkpoint — 14 September 2026: Signed Kernel feature `ae0f3ab918abec71e809c3b4a68e54ec1c475e0d` carries original signed maintenance ancestor `41b57a7a67e6fee71f5708b55ab386b72366b8d8`. Both use the same CSpace allocator with their respective original dependency graphs. The feature tree equals the previously validated `e5198f8f3ce0dbc1ee3658cdd21bf10f0beed63c` tree. Strict development/release default/all checks pass: 613/637 units plus two standalone tests on the feature graph, 589/613 plus one standalone on maintenance, with three existing ignores. All eight feature and six maintenance freestanding builds pass without warnings. Kernel CI [536](https://git.erikinkinen.fi/erix/kernel/actions/runs/536) and [537](https://git.erikinkinen.fi/erix/kernel/actions/runs/537) pass with four complete logs, 643,867 bytes and zero warnings. The actual allocator rejection control fails the original signed library with next ID 5 instead of 4; the corrected test covers repeated failed growth, initialization failure and allocation-free reuse. ID exhaustion, duplicate destruction, occupied-record preservation and clean reuse pass. The same three-sample host profile reduces 32,768 reuse cycles at 32,768 retained spaces from 643.094176 ms to 1.172569 ms; host elapsed only, with no exclusive-CPU or guest timing claim. Signed Integration `a869a81eb406a4f027a2b5db573b6330ca114d94` selects both final source graphs and passes all 159 helper suites plus strict 320/321-unit development/release default/all Rust matrices. The final ordinary Rootd IPC-framing VM passes in 45.832335 seconds and the native distinct-argument/lifetime VM passes in 13.026853 seconds, under unchanged exit/marker/deadline rules with empty QEMU stderr. These are host build-and-run durations. The ordinary image is 27,934,720 bytes, SHA256 `2a187127696d569ae5c627d9c1d154ad53c024e98d9a181dbb6006790f01a0cc`; the lifetime image is 2,142,208 bytes, SHA256 `8fa4c7512a5916a51ba956b1e55c84ac2945c2580ff9556c99c27cbaa6e3321d`. Its final image, ELF and EFI bytes equal the preceding validated feature-tree artifacts. Older full CI [1605](https://git.erikinkinen.fi/erix/integration/actions/runs/1605)/[1606](https://git.erikinkinen.fi/erix/integration/actions/runs/1606) is still running; new [1607](https://git.erikinkinen.fi/erix/integration/actions/runs/1607)/[1608](https://git.erikinkinen.fi/erix/integration/actions/runs/1608) is waiting. No full-catalog pass, realm implementation or full guest build is claimed. Endpoint construction checkpoint — 14 September 2026: Signed Kernel `f6489ff3f8fea88a26dad232cc45d0deb33fa30e` carries original signed ordinary ancestor `c7f8952c45a60ca451466d9731207c0a9a6a9a82`. Its feature tree equals the validated `fc3e1d5ea095fd17a9629a87d05ddad0863435ca` tree. Copy, attenuated copy and move reject unbound endpoint metadata before destination installation; the original control materializes an endpoint and fails the new invariant. Explicit construction then preserves exact object identity and SEND-only rights. Positive fixtures now construct their intended endpoint kinds without widening rights or changing assertions. Strict development/release default/all checks pass 614/638 units plus two standalone tests on feature, 590/614 plus one on ordinary, with three existing ignores. Eight feature and six ordinary freestanding builds pass without warnings. Kernel CI [540](https://git.erikinkinen.fi/erix/kernel/actions/runs/540)/[541](https://git.erikinkinen.fi/erix/kernel/actions/runs/541) passes: four complete logs, 644,652 bytes, zero warnings. Earlier same-tree CI 538/539 also passes. The focused [owned-invocation design](https://git.erikinkinen.fi/erix/kernel/src/commit/f6489ff3f8fea88a26dad232cc45d0deb33fa30e/docs/owned-invocations.md) defines actual caller/server generations, exact receiver registration, retained SEND carrier lineage, request/result byte and capability custody, fresh collection, exactly-once grants, invalidated deliveries, draining and terminal cleanup. It enumerates cumulative type-specific binding reservations and no-allocation rollback obligations. The owned transport remains unimplemented; no new opcode, wire layout or escrow representation is assigned. This is a deliberate construction boundary cleanup, not a demonstrated vulnerability finding. Completed CI checkpoint — 15 September 2026: Signed Integration `a869a81eb406a4f027a2b5db573b6330ca114d94` passes both [1607](https://git.erikinkinen.fi/erix/integration/actions/runs/1607)/[1608](https://git.erikinkinen.fi/erix/integration/actions/runs/1608); signed endpoint-construction checkpoint `989d44d604d07c4c9bcc23264912bdf2076b99eb` passes both [1609](https://git.erikinkinen.fi/erix/integration/actions/runs/1609)/[1610](https://git.erikinkinen.fi/erix/integration/actions/runs/1610). Each run reports all 486 distinct VM scenarios passing, followed by the actual native lifetime scenario, physical/serial interactive checks and all four console modes. Rust and Markdown pass. The two six-log cohorts contain 26,769,289 and 26,769,316 bytes respectively, with zero warning candidates. The previously observed intermittent quota timeout remains documented without a causal-fix claim. These results establish the selected source checkpoints, not owned invocation transport, complete authority closure or either full in-EriX build generation. Native transfer preparation checkpoint — 15 September 2026: Signed Kernel `e91f47198748d8ce52fc7361f389836a6bc2a206` carries original signed ordinary ancestor `d2438c7e56c964a9c16720586cf718ec11e7cc0a`. The feature tree is byte-identical to validated `d58efd8df18d63e5b97228c066f6d7623202e6d4`. Complete destination slot, rollback, typed binding and revocation-lineage storage is reserved before native capability mutation; reservations accumulate across aliases of the same object. Preparation failure changes no capability inventory or unique-grant custody. Commit and pre-delivery rollback require no allocation under existing BSP serialization. Five actual-object controls cover a 62-capability mixed batch, real allocator rejection, exact backing and grant scope, nested revocation and same-CSpace transfer. The ordinary grant move now uses the ID-only lookup without cloning descendants or adopting the later lifetime representation. Independent strict development/release default/all checks pass 619/643 units plus two standalone tests on feature, and 595/619 plus one on ordinary, with three existing ignores. Eight feature and six ordinary freestanding builds pass without warnings. Kernel CI [544](https://git.erikinkinen.fi/erix/kernel/actions/runs/544)/[545](https://git.erikinkinen.fi/erix/kernel/actions/runs/545) passes: four complete logs, 649,206 bytes, zero warnings. Same-tree CI 542/543 also passes. This implements preparation for the current IPC path. Its private records cannot survive userspace scheduling and own no retained source authority. Persistent request/result bytes and capability custody, exact delivery state and terminal hooks remain unimplemented under [Kernel issue 11](https://git.erikinkinen.fi/erix/kernel/issues/11). No opcode, wire record, bootstrap-frame escrow eligibility or application-cancellation semantics are assigned. The renewed contributor-source inventory covers 76 repositories and 2,898 code files, all below 1,000 lines. All 92 library/binary roots and 62 standalone Cargo roots have direct missing_docs gates. These static checks do not establish whole-codebase authority or private-item documentation closure. Native invocation custody checkpoint — 15 September 2026: Signed Kernel `2e4deb7351184d3fe4517ce8d5d59eb9960f28ad` carries the native invocation core from `b1b632446ff5762761b5aee3fbdba320f5efff42` and the deterministic endpoint-fixture correction. Native Rust entry points implement explicit receiver registration, submit, claim, complete, fresh collection, progress, caller release and cleanup-only delivery relinquishment. They derive actual TCB/stage/CSpace identity, retain real request/result bytes and capabilities in a private CSpace, and keep a SEND-only carrier alias in its original revocation lineage. No CNode or private storage location escapes. Accepted results survive ordinary server death; repeated collection returns original descriptive receipts without reinstalling authority. Exact binding removal, process retirement and syscall-return hooks retain draining owners until native disposition and participant acknowledgements complete. Twelve actual-object controls cover caller/receiver scope, source-buffer mutation, duplicate destinations, moved unique grants and reused source slots, actual admission allocation rejection, six native object types, revocation, process death, replay and FIFO after registry vacancy reuse. The original draft FIFO control fails and the corrected selector passes. The disposal control proves actual guard revocation makes zero allocation requests; it does not prove a reachable backend disposal failure. Strict default/all development/release matrices pass 631/655 units plus two standalone tests, with three existing ignored experiments, private rustdoc, target Clippy and eight warning-free freestanding builds. [Kernel issue 13](https://git.erikinkinen.fi/erix/kernel/issues/13) retains CI [546](https://git.erikinkinen.fi/erix/kernel/actions/runs/546)/[547](https://git.erikinkinen.fi/erix/kernel/actions/runs/547): both fail the same older endpoint fixture at setup with 630 passed, one failed and three ignored. Four related fixtures reset CSpaces without resetting preceding non-root TCB attribution. All four deterministic original controls fail with CspaceSlotMissing; resetting attribution before CSpace replacement makes them pass without changing any message, transfer or backpressure assertion. The correction is confined to test setup and thematic test organization; production behavior is unchanged. Corrected signed-head Kernel CI [548](https://git.erikinkinen.fi/erix/kernel/actions/runs/548)/[549](https://git.erikinkinen.fi/erix/kernel/actions/runs/549) and Docs [859](https://git.erikinkinen.fi/erix/docs/actions/runs/859)/[860](https://git.erikinkinen.fi/erix/docs/actions/runs/860) pass. All 8 complete logs total 1,413,966 bytes, with zero final warnings. The terminal cohort is classified. The syscall wire adapter, fresh userspace buffer/fault/overlap validation, authenticated caller-origin delivery fields and actual CPL3 owned-invocation peers remain unimplemented. Reachable backend disposal-failure coverage, sustained invocation-workload profiling, realm producer adoption, whole-codebase authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire record is assigned; the existing CALL/RECV/REPLY ABI is unchanged. The refreshed contributor-source inventory covers 76 repositories, 74 Cargo manifests and 2,913 code files, all below 1,000 physical lines. All 92 library/binary roots and 62 standalone Cargo roots have direct missing_docs gates. These static checks do not establish full authority or private-item documentation closure. Authenticated delivery-origin checkpoint — 15 September 2026: Signed Kernel `69c5e1fe5ffa72522ff6611d8b2c0471e865115e` adds CallerOrigin to each successful native request delivery. The process ID and staged generation come from the retained submitting actor in the native CREATE_STAGED_PROCESS identity domain; payload fields, receiving identity and equal numeric carrier slots cannot replace them. The pair exposes no private CSpace, grants no authority and promises no later liveness. Services must correlate it with exact retained process/realm ownership and revalidate after blocking effects. A two-submitter control sends mutually impersonating payloads through the same real carrier and validates both actual origins plus independent caller-local selector refusal. All 13 native custody controls pass. Strict default/all development/release matrices pass 632/656 units plus two standalone tests, with three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. Kernel CI [550](https://git.erikinkinen.fi/erix/kernel/actions/runs/550)/[551](https://git.erikinkinen.fi/erix/kernel/actions/runs/551) and Docs [861](https://git.erikinkinen.fi/erix/docs/actions/runs/861)/[862](https://git.erikinkinen.fi/erix/docs/actions/runs/862) pass. All eight complete logs total 1,414,891 bytes, with zero final warnings; the cohort is classified and stopped. The separate earlier fixture correction remains closed in [Kernel issue 13](https://git.erikinkinen.fi/erix/kernel/issues/13), preserving original CI 546/547 and corrected 548/549. Sustained invocation-workload profiling, syscall wire and fresh-buffer/fault/overlap validation, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm producer adoption, whole authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire layout is assigned. Native progress and cleanup still do not certify application cancellation. The renewed inventory covers 76 repositories, 74 Cargo manifests and 2,914 code files below 1,000 physical lines. All 92 library/binary roots and 62 standalone roots have direct missing_docs gates. Source hashes, clean feature branches, signatures and remote equality are verified; these static gates do not close full authority or private-item documentation audits. Native invocation profiling baseline — 15 September 2026: Signed Kernel `6cb703e1ed8b9de0d29a37189cd914cd501e732e` provides an actual-object host workload for queued progress, collected progress, descriptive result reads and complete request/result cycles. Signed Integration `f3e4359b34cb8f7db732fbf38823f722553c86d4` adds bounded capture, raw-evidence report verification and equivalent comparisons. Every sample checks exact bytes and SEND capability bindings, authenticated origin, foreign selection, duplicate completion refusal, FIFO position reuse, one-time collection and final invocation disposal. Source and executable bytes are observed against explicit original identities; compiler/host relationships remain declarations. Workload children and source Git reads receive minimal environments; capture owns memory, time, output and process cleanup. Completion is published only after deadline teardown succeeds. The operator guide and signed Docs `644273a0edd91e4c38dcd4418d6ae1119ff1f10b` describe these boundaries. Kernel strict default/all development/release checks pass 632/656 units plus three standalone controls, three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. Integration passes all 161 helper commands, including 19 profiler controls and nine source-provenance controls, plus fresh strict 320/321-unit Rust matrices, private rustdoc and warning-free target builds. Four original socket-fixture failures are retained and attributed to the selected temporary directory exceeding the host Unix-socket path domain; a shorter explicit private directory passes the same fixtures. Docs passes 45 tests and renders 2,345 pages with zero final warnings; 427,592 word boxes fit page bounds and changed pages 2284/2285 pass visual review. Kernel CI 552/553 and Docs CI 863/864 pass; eight complete logs total 1,431,762 bytes with zero final warnings after manual reference convergence. The original signed Kernel baseline retains 48 measured samples and 16 checked warmups: four modes, populations 0/32/128/512, 256 operations per sample, three measured repetitions and one warmup. A single selected host CPU is used after local build/test work completes; external host scheduling is not isolated. At population 512, operation medians are 117,577.723 ns for queued progress, 8,927.977 ns for collected progress, 9,124.098 ns for descriptive reads and 1,167,847.016 ns for complete cycles. At population zero they are 223.328, 166.199, 213.137 and 4,556.867 ns respectively. Every raw sample, process disposition and final native cleanup passes. Timings include fixed semantic checks; no cost is subtracted and no ratio is a pass threshold. Source review identifies repeated carrier-binding scans during full registry refresh and a registry-lock acquisition for every inactive settlement position. The next bounded change will retain only non-authoritative numeric search positions: every fast path must still check current capability type/rights, endpoint identity/in-use state and exact CSpace/slot binding, with complete lookup on a stale hint. Existing revocation and terminal hooks remain authoritative. Settlement may scan for the next draining owner under one lock while retaining the original pass boundary, increasing index order, busy-position exclusion and allocation-free stack-owner return; disposal remains outside the table lock. Original workload bytes and sample policy must remain unchanged for comparison. No Kernel performance algorithm has changed in this baseline. Native syscall adapters, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The 76-repository inventory has 2,923 code files below 1,000 lines and 155 direct missing_docs crate-root gates; this does not close the semantic audits. Measured native invocation lookup refinement — 15 September 2026: Signed Kernel `8349d68636382cc7e25a3347f5f1df216554203a` retains only numeric carrier-search positions. Every use rechecks the actual CSpace capability type/rights, live endpoint identity and exact binding; stale positions take the complete search path. No successful authorization, capability or reference is cached. Draining scans fix their boundary on the first poll, visit each position at most once, skip busy stack owners and return exclusive custody after unlocking. Native disposal and first-failure retention preserve their existing semantics. Signed Integration `108501cf7ec20f05dd3d62ea401ea8adad6c6e9c` selects this Kernel in its isolated native catalog, and signed Docs `f10a1d375a326543ec0adda4569bc7cb4faca9b6` documents the invariants. The existing syscall ABI and ordinary image catalog are unchanged. All 15 actual-object native controls pass, including real alias compaction, rights/type/object replacement, busy ownership and allocation-free settlement. The unchanged four-mode workload control also passes. Full strict default/all development/release Kernel matrices pass 634/658 units plus three standalone controls, with three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. The existing native lifetime and entry-argument VM passes unchanged oracles in 21.978041 seconds of host build-and-run time, with clean teardown and empty QEMU stderr. Its signed boot image is 2,207,744 bytes, SHA-256 `4030cdfb8a13c000ff4716ecdc5203cb46273d6117a282f7375f25dccbbeedc9`. Exact unchanged Integration Rust/helper bytes preserve the preceding strict 320/321-unit matrices and all 161 helper-command results; changed catalog/scenario policies pass. Docs passes all 45 tests and a complete 2,345-page render with zero final warnings, 427,679 bounded word boxes and visual review of page 145 plus continuation page 146. The original signed Kernel `6cb703e1ed8b9de0d29a37189cd914cd501e732e` and the new signed Kernel use byte-identical workload sources, the same selected CPU/toolchain/context and explicit limits, distinct source targets, four modes, populations 0/32/128/512 and 256 operations per sample. Each capture retains 48 measured samples and 16 warmups; every sample passes actual semantic and native/process-cleanup checks. At population 512, median queued-progress cost changes from 117.578 to 37.673 microseconds (3.12x observed ratio), and full-cycle cost from 1167.847 to 443.055 microseconds (2.64x). Collected progress changes from 8.928 to 6.015 microseconds and descriptive reads from 9.124 to 6.212 microseconds. Timings include fixed checks, with no subtracted overhead or timing-ratio pass gate. No managed build/test workload runs concurrently during capture; external host scheduling remains unisolated. These are host operation wall times, not guest startup/build acceptance or a statistical guarantee. Kernel CI 554/555 succeeds; four complete logs total 679,280 bytes with no warnings, and its completed cohort is stopped. Docs CI 865/866 succeeds at observation three; four complete logs total 754,424 bytes, all 45 tests pass and each manual has 2,345 pages. Its normal reference passes report 32/1/0 warnings, with zero final warnings and no box diagnostics. The completed Docs cohort is stopped. Integration CI 1619/1620 is waiting at its first observation. Older Integration 1613/1614 is running; 1615/1616 and 1617/1618 are waiting. Accepted older Integration 1611/1612 passes all 486 catalog scenarios and later probes with complete warning-free logs. This does not establish the intermittent quota cause tracked in Integration issue 18. Current full-suite CI remains required; stopped cohorts are not polled again. Owned syscall wire adapters, actual owned CPL3 peers, fresh-buffer validation, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The refreshed 76-repository inventory has 2,924 code files below 1,000 lines and 155 direct missing_docs crate-root gates; those checks do not close whole-codebase semantic audits. Owned invocation wire and native acceptance — 15 September 2026: Signed Kernel `5f497adaefa526108a0439e0e071717dddb85334`, shared IPC `de968da19898bef532ddb3b5974bb9562f51dee5`, capability ABI `a001a26f0eb3aebec3f5fd02a28d98f1bc23f8a0` and Integration `9030b217c490db6ad3ec60a799cb025eccbfcdb1` implement and exercise the immediate owned invocation boundary. The allocation-free shared codecs and shim preserve exact return metadata, including a retained draining owner on failed submission. The Kernel checks fresh complete user mappings and packet framing under one lifecycle guard before native effects. No user pointer or caller-selected identity is retained. Destination capacity and descriptive receipt capacity are independent; spare capacity acquires no authority and repeated collection cannot duplicate transfers. Existing numeric binding hints still recheck live capabilities on every use. The real three-process CPL3 scenario passes all eight operations, full-span pointer/rights/overflow/reserved-field rejection, actual returned selectors, payload/capability/origin checks, collection after server exit and repeated receipts. A second request rejects premature relinquishment, enters draining on caller release and retires only after the exact server acknowledgment. Current signed owned and unchanged older lifetime images are each 2,232,320 bytes, with SHA-256 `588c6097c57ebd2ed92e0f0b76f2b1ad6b82630b4a0da272ee98e218eb8e333d` and `8f9026aaefd2c5a745e35467ac01c71789c5f469f9cd42a477f87818747ee673` respectively. Both runs have clean teardown and empty QEMU stderr. Ordinary images contain neither diagnostic hook. Strict default/all development/release host, freestanding and rustdoc matrices pass: IPC 368 units, shim 20, capability ABI 191, Kernel 642/666 and Integration 320/321. Existing ignores remain one shim and three Kernel tests. All 162 maintained Integration helper commands pass; three prior correct concurrent-run lock refusals are retained and their sequential checks pass on unchanged executable inputs. Docs `46da7a4cb4d38a2bea5b5491a68f51f33e4b4305` publishes the normative register/packet contract and regenerates the three affected API references from original signed revisions. All 45 documentation tests pass. The complete 2,363-page manual has zero final warnings, 430,365 word boxes within page bounds and reviewed changed ABI/API pages. Shared IPC CI 337/338 and capability ABI CI 214/215 pass with eight complete warning-free logs. Both Kernel revisions pass CI 556/557 and 558/559 with eight complete warning-free logs. Those cohorts are stopped. Current Docs CI 867/868 passes at observation four; four complete logs total 758,328 bytes. Both 2,363-page manuals pass all 45 tests, report normal reference-pass warnings of 32/1/0, and finish with zero warnings or box diagnostics. Its cohort is stopped. Current full Integration 1621/1622 is waiting. Older full Integration 1613/1614 now passes all 486 catalog scenarios and later native/console probes, with six complete warning-free logs; its cohort is stopped. Older 1615/1616 is running, and 1617/1618 plus 1619/1620 are waiting. Current full-suite acceptance remains open, as does the intermittent quota cause in Integration issue 18. This checkpoint supersedes the earlier pending wire/CPL3/manual status. Reachable backend disposal-failure coverage, broader revocation/generation-reuse scenarios, producer adoption, realm runtime, complete authority/inline-documentation audits and both full EriX-in-EriX build generations remain open. The current inventory checks 76 repositories, 2,943 code files below 1,000 lines and 157 crate roots with direct missing_docs gates; it does not establish semantic audit closure. No complete guest build or guest performance result is claimed. Process-bound native acceptance — 15 September 2026: Signed Kernel `60da5858d7198185efd103f0e91e5ac2e0b63e67` implements control operation 52, checking the actual moved install grant against expected process/generation with exact rights, including zero, under existing endpoint policies. Signed Procd `f1105706cc19ed024a6cca79a29abc57c90c6661` uses this operation in its actual ordinary launch-description producer while retaining the narrow SEND receipt, pending state and exact failure cleanup. IPC `c453b697b8cdb9cc1c36f1ad89ff868648190025`, capability ABI `fe8d558253ad01301b99554e20d287c4ea35bb1d` and five aligned helper commits preserve original Git/type identity. Integration `58c925c564b69bebce8df6f3e75a9312824e18c4` passes the expanded lifetime CPL3 scenario with thirteen actual control calls, user-side reply checks, two staged children and full added-custody disposal. The corrected lifetime image SHA-256 is `8e6a9e8f68b90cc1ede61300958cec122b82a7c6dfd6318a51e40fefc7ba166e`; the unchanged owned-invocation scenario also passes with image SHA-256 `b76a380d3cd6b03b0ff61a3b626ace0667679920684ad7356a1c3a36e2224953`. Both have clean teardown and empty QEMU stderr. The initial fixture setup-order failure is retained and corrected in Kernel issue #14. All strict default/all development/release matrices pass: IPC 371, shim 20, capability ABI 191, Kernel 648/672 including standalone controls, Procd 227/232 including auxiliary binaries, and Integration 320/321 tests. Existing native-only ignores are unchanged. Procd passes forty native binary builds with repository linker scripts. All 162 Integration helpers pass after updating the exact policy assertion to require the new marker; its initial mismatch remains recorded. Docs `b0fcf0f43af2af741d520a0b1373cc346e08863c` updates the native wire/ownership contract, operation registry, Procd boundary and three generated shared APIs. All 45 tests and the complete 2,367-page manual pass, with zero final warnings, 431,138 word boxes within page bounds and four reviewed protocol/API pages. Current IPC 339/340, capability ABI 216/217, Kernel 560/561 and 562/563, Procd 266/267, Docs 869/870 and all five helper push/review CIs pass with complete classified logs and no final warnings. Those component cohorts are stopped. Current full Integration 1623/1624 waits at observation 01. Older full Integration 1615/1616 is running at observation 11; 1617/1618, 1619/1620 and 1621/1622 wait at observations 09, 07 and 04. No pending full suite is counted as passed. Typed realm bootstrap, mediator startup/readiness/configuration/seal, complete consumer image adoption, fair terminal/provider retirement, broader native disposal failures and both full EriX-in-EriX build generations remain open. The new inventory covers 76 repositories, 2,950 code files below 1,000 lines and 158 direct missing_docs crate-root gates; complete inline documentation and whole-codebase authority closure remain open. Prior performance measurements retain their original signed source identities; this checkpoint claims no new timing or guest performance result. Corrected native staging checkpoint — 15 September 2026: Signed source `b98156427362a468ae78195a3582901e2474fea5` is recorded in [the current review](https://git.erikinkinen.fi/erix/kernel/pulls/3). Exercise the corrected native constructor and explicit cleanup through an actual host regression and six additional CPL3 calls. 648/672 default/all tests including standalone tests pass, with three existing ignores. Strict host/native matrices and ten native builds pass. The lifetime and unchanged owned-invocation VMs pass with empty QEMU stderr and clean teardown. CI 564/565 passes with complete warning-free logs. Additional construction failure-path coverage is being audited separately. Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed. Native creation rollback acceptance — 15 September 2026: Staged construction now retains a receipt for each successful parent copy until commit. On later failure it destroys the child and disposes only those new endpoint/VSpace copies, preserving pre-existing or overlapping output bindings. The transaction has a separate documented module. Eight actual constructor refusal cases check complete parent inventory and native VSpace counts. Kernel b853d51cfb36c2fbc81eb565b7d2fc3ab731de2b passes 649/673 default/all tests, strict host/native development/release Clippy, private rustdoc, formatting and ten native builds, with three existing ignores. Matching CI 566/567 passes with four complete warning-free logs. Integration 3c4e26025668fa2a171b2c80017fd2b8bcb1924f passes both actual native VMs with empty QEMU stderr and clean teardown. The lifetime fixture now includes seven creation/refusal/disposal calls alongside the thirteen installation calls; the existing owned-invocation oracle is preserved. Integration Rust/helper sources are unchanged and retain their completed 320/321-test strict matrix and all 162 helper results; changed native catalog inputs have fresh policy and VM checks. Full Integration CI 1627/1628 remains pending. Typed grant-return provisioning, independently constrained bootstrap authority before mediator execution, readiness, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. The code inventory covers 76 repositories and 2959 files below 1000 lines; all 158 scanned Rust roots enforce missing_docs. Whole-codebase semantic authority and private-item documentation audits remain incomplete. Native permission checkpoint — 16 September 2026: signed Kernel `32c70109fe7663440aa56de6a49975accc1f0057` carries explicit live execution permission through single-page, batch and permission-only mappings. Data and construction aliases remain non-executable; ancestor promotion and splitting preserve neighbouring restrictions. Processor activation validates and enables execute-disable support on the bootstrap and application processors. Seven independent controls accompany the repair. Strict default/all-feature development/release suites pass 666/690 kernel unit tests plus two external controls per selection, retaining three existing ignores. Host/native Clippy, private rustdoc, formatting and ten native builds pass without warnings. Separate one-CPU and two-CPU diagnostic VMs pass the unchanged native command sequence. A read-only hardware observer matches all 233,755 selected coreutils executable bytes, verifies CPL3 and enabled paging/execute-disable state, and confirms both observed RELRO pages are user-readable, read-only and non-executable; the current stack is user-writable and non-executable. Both processors report execute-disable enabled. This is an exact process-entry/table observation, not an injected instruction-fault test or whole-system permission proof. The diagnostic image SHA-256 is `8c3c24639e8e1ca8c4f2ad4e485323abf32ec07408241c3e4fa9713f6e07e812`. Signed Docs `d221e725c2543316680e63fc5e8314ce0fe3bdf1` documents the mapping and processor contracts. All 45 documentation tests and canonical checks pass; the 2,375-page manual has 434,308 in-bounds word boxes and zero final warnings, with three changed pages visually reviewed. Exported API snapshots are unchanged. Kernel CI 574/575 passes with four complete warning-free logs (708,112 bytes), including existing optimized workload examples. Docs CI 891/892 passes all four complete logs (762,176 bytes), with 45 tests per manual job and zero final warnings. The later maintained permission regression is recorded below. Full frame proof, whole-codebase authority/documentation review, runnable realms and both complete guest build generations remain open. Maintained permission regression — 16 September 2026: signed Integration `89d15e4536004c087dcebd63c87216c0fd58958d` supplies the explicit-input runner, pure ELF/page-table checks and read-only GDB observer. The final maintained source passes 21 independent host controls and the complete strict default/all-feature development/release Rust matrix, host/native Clippy, private rustdoc, formatting and four native builds. Canonical checks pass after correcting one Markdown line wrap. Both host groups are wired into ordinary CI. All 2,995 inventoried authored code files are below 1,000 lines; this is physical size evidence, not semantic authority closure. Actual one-CPU and two-CPU runs on the repaired diagnostic image pass the original native-time command sequence and the expanded hardware checks: all 58 selected code pages are user-readable, read-only and executable; both RELRO pages are read-only/non-executable; the current stack is writable/non-executable. Complete executable bytes match and NX interpretation is enabled on every selected processor. An earlier image is rejected by the maintained observer. Both child outcomes, exact original input bytes and temporary cleanup are retained, with empty debugger stderr in both positive runs. The final cleanup code also preserves reaping when a direct child exits between poll and termination. The command's image CI gate awaits adoption of a coherent product catalog containing both required component fixes. Its explicit diagnostic invocations do not silently replace the older maintained image graph. Signed Docs `3fb0b12ff55d044cc4bbe142418ab7a5b07bb42d` documents the maintained operator contract. All 45 tests and canonical checks pass; the 2,377-page manual has 434,563 in-bounds word boxes with zero final warnings, and the changed subsection passes visual review. Exported API snapshots are unchanged. Matching Docs CI 893/894 passes with all four complete logs (762,616 bytes) and zero final warnings. Current Integration CI, complete frame proof, whole-codebase authority/documentation closure, runnable realms and both guest-build generations remain open. Explicit query caller context — 17 September 2026: isolate query-local-cap dispatch in a documented module. Resolve the kernel-attributed current TCB record once, validate the requested slot against that same record, and pass its explicit CSpace identity to both capability and endpoint-kind lookup. A descriptive source slot or process ID must never select a different owner, and a missing caller must retain DENIED rather than use the bootstrap root fallback. Share the pure checked window predicate with the existing current-caller checks. Preserve parameter/error precedence, result-register encoding, diagnostics and the register-only wire interface. Add focused controls for a private CSpace shadowing root slots, denied/missing callers, malformed parameters and metadata observations without capability mutation. Keep new definitions documented and split the almost-full dispatch source by responsibility. This removes repeated ambient CSpace selection and makes the memory-effect audit smaller; it does not itself certify the retained older kernel ELF. Keep the original syscall preservation refusal until selected kernel/source/artifact evidence and the relevant memory effects are grounded. Validate strict kernel feature matrices, applicable native/runtime controls, documentation and original automatic CI before claiming acceptance. Caller-local query checkpoint — 17 September 2026: signed Kernel `e15a045d7701030e58d9e59517406f8c79694ff8` selects one attributed TCB record for checked-window validation and both explicit CSpace metadata reads. Four added host controls cover independent owners, root shadows, missing callers, malformed inputs and unchanged inventories. Query results retain the register-only wire contract and clear descriptive payloads on errors. Four strict development/release default/all-feature matrices pass 670/694 unit tests plus two external controls, with three existing ignores. Formatting, host/native Clippy, private rustdoc and thirteen native binaries pass without warnings. Original kernel CI 578/579 both pass; all four complete terminal logs contain no warnings. The selected native image passes fifteen actual CPL3 queries with exact metadata, RSP, six saved-register and sixteen live-stack-word comparisons across three private owners, then all existing invocation custody/retirement checks. The separate lifetime/revocation scenario also passes all original markers. Both use one TCG CPU and unchanged 60-second deadlines. The first canary fixture failure is retained in kernel issue 16; the corrected fixture explicitly selects its owned stack before testing syscall preservation. This is finite selected-image evidence, not a generic kernel memory guarantee or full guest build. Explicit entry-state checkpoint — 17 September 2026: signed Kernel `d4a8921fa8530419c3d9790b80ff3c601217906d` establishes forward live direction before compiled exception handling and explicitly masks IF/DF on syscall entry while retaining saved flags. Shared exception stubs preserve vector identity and the separate resumable page-fault frame. No capability, mapping or slot authority is added. Four strict development/release default/all-feature matrices pass 670/694 unit tests plus two external controls, with three existing ignores. Formatting, host/native Clippy, private rustdoc and 19 native builds pass without warnings. Original [CI 580](https://git.erikinkinen.fi/erix/kernel/actions/runs/580) and [CI 581](https://git.erikinkinen.fi/erix/kernel/actions/runs/581) both pass; all four complete terminal logs contain no warnings. The standard native wrapper passes invocation, entry-direction and lifetime scenarios on this signed Kernel. Thirty caller-local queries exercise both user direction states, retaining exact returned flags, metadata, RSP, six saved-register and sixteen live-stack-word checks. The separate UD2 scenario requires live forward direction, retained fault flags and the expected fatal exit. All original marker requirements and 60-second deadlines remain. This finite evidence does not establish general syscall memory preservation or a full guest build. Entry-frame and complete fixture checkpoint — 17 September 2026: Signed `0bf941cf8ff4b7c1e8b6c9ed7941b5413250629a` completes the full startup-window fixture correction after a deterministic original failure. Four strict matrices pass 671/695 unit tests plus both standalone controls, with three pre-existing ignored experiments. Original CI 584/585 passes with four complete zero-warning logs (712,326 bytes); issue #6 is closed. The preceding signed entry correction 829b949 passes four distinct native diagnostics. All native and full-build evidence retains its exact source scope; consumer adoption and both complete guest build generations remain open. Diagnostic lifetime checkpoint — 17 September 2026: Signed `fb4e134f2130e9f60608bad0ecc02d8a278887a8` removes the obsolete RTC post-exit observer, three retained trace values and four lifecycle hooks. The remaining diagnostic contract uses scalar metadata and synchronous current-operation observations. Four strict matrices pass 671/695 units plus both standalone controls, with the three existing ignored experiments; six trace-enabled native builds and binary Clippy selections pass without warnings. Existing invocation/lifetime VM controls pass on the exact candidate under one explicit private trace-feature variation, original 60-second limits and normal stripped-artifact verification. Original current-head CI is pending. The complete syscall memory footprint, ordinary graph adoption and both full guest builds remain open. VSpace fixture follow-up — 17 September 2026: Original diagnostic-cleanup CI 586 fails and 587 passes; all four complete logs contain zero warnings. Issue #17 tracks deterministic predecessor-attribution failures in the synthetic and mapping fixtures. The correction preserves production authority and all original test assertions, shares explicit test-only attribution setup, and partitions the large mapping suite. Strict corrected matrices are running. Earlier native entry and diagnostic VM results retain their exact source/feature scope. VSpace fixture CI reconciliation — 17 September 2026: Current signed `28dfaea22796925ca438b4a57175520a8d9e7a8c` passes original [push CI 588](https://git.erikinkinen.fi/erix/kernel/actions/runs/588) and [PR CI 589](https://git.erikinkinen.fi/erix/kernel/actions/runs/589). All four complete terminal logs are classified: 712,357 bytes and zero warning candidates. Both workflows retain the named regression controls, 671 default/695 all-feature unit results and both standalone controls; three existing experiments remain ignored. Local four strict matrices, host/native Clippy, rustdoc, formatting and two native builds also pass without warnings. No production attribution rule or global harness concurrency is changed. Issues #4, #5 and #17 close for their bounded host-fixture corrections, while full source/frame and guest-build acceptance remain open. Borrowed capture checkpoint — 17 September 2026: signed `f2489242be47654342c91ef3f05a2a12cdc15a4b` requires complete initialized frame ownership before native syscall dispatch. Five new controls cover real allocation rejection, non-dispatch of a requested capability drop, attribution, layout, stable copies and teardown. Four strict 676/700-unit matrices, both standalone controls, eight native builds/Clippy selections and two original-budget invocation/lifetime candidates pass without warnings. Candidate machine bytes and normal packaged stripping are verified; no general syscall memory guarantee or ordinary-image adoption is claimed. Original CI 590/591 passes: all four complete logs total 716,126 bytes, zero warnings, with 676/700 unit results and both standalone controls. Prior CI 588/589 passes completely, closing bounded fixture issues #4/#5/#17; their original failures remain retained. VSpace cleanup checkpoint — 17 September 2026: signed `1af934ff48e6d5ad33fd1227c8d1ffdc40c7a06d` records access-withdrawal progress and exact frame-reference consumption while rejecting ordinary use during retirement. Final process-reference cleanup keeps its owner until teardown succeeds. Four new host controls, strict 680/704-unit matrices, both standalone controls, eight native build/Clippy selections and two original-scenario native candidates pass without warnings. Original CI 592/593 passes with all four complete logs classified and zero warnings. Surrounding process-cleanup review, ordinary-image adoption and both complete guest builds remain open. Process cleanup checkpoint — 17 September 2026: signed `c55ee8d6f12957b43c5fd6aaf31c9865656b5ae6` retains private CSpace identity through final release and excludes cleanup owners from execution and live IPC. Four new owned controls, four strict 684/708-unit matrices, both standalone controls, eight native build/Clippy selections and two original-budget native candidates pass without warnings. Final rustdoc-only edits retain explicit candidate scope. Original CI 594/595 passes with four complete logs classified: 722,414 bytes and zero warnings. Preceding VSpace and capture cohorts pass with complete logs. Ordinary-image, whole-code semantic and both complete guest-build gates remain open. Native terminal generation implementation — 17 September 2026: Signed revision `5b20519a72e1cbc797eb32a7687e78ac4a8a7133` is pushed. Native operation 55 captures the original TCB generation with exit/kill and preserves it across queued observation and ID reuse. Malformed waits cannot dequeue; selector 7 is retired. Four strict matrices pass with 686/710 units, host/native Clippy, rustdoc and eight native builds. The added CPL3 fixture checks every response word; corrected endpoint-refusal framing passes both native profiles. Matching native execution and coordinated consumer rollout remain in progress; runnable realm bootstrap and complete guest builds are not established. Original automatic CI is monitored without retries. Coordinated terminal observation checkpoint — 17 September 2026: Signed revision `5b20519a72e1cbc797eb32a7687e78ac4a8a7133` is pushed. Both actual native VM gates now pass. Nine CPL3 terminal calls check malformed nonconsumption, retired-selector rejection without a fabricated response, original exit/kill generations and canonical empty queue. Exact build artifacts and all native component checkouts are verified. Original CI 596/597 has complete warning-free successful logs. Typed mediator bootstrap, ordinary service-image adoption and both complete EriX builds inside EriX remain open. Planned exact-generation native cleanup — 17 September 2026: Define distinct native terminal-destruction and staged-abort operations 56 and 57. A checked request carries the nonzero original process/generation pair in the low/high 32-bit halves of arg0; flags and all other arguments are zero. Retire selectors 8 and 35 without reinterpreting them or adding a compatibility fallback. The existing held Process or Root route remains required; descriptive identities do not grant authority. Match the exact pair under the same TCB record lock that enters retained cleanup. Preserve terminal-versus-Created eligibility, partial disposal and retry custody. An absent or different generation acknowledges absence of only the requested instance, with zero response values; it cannot mutate a replacement. Migrate every native caller and carry creation/event generation through deferred retries. Account for processes created before a service's own managed ledger without reconstructing historical identity from the current record. Maintain separate terminal observation, cleanup custody, provider completion and native absence. Required evidence includes exact wire and reserved-field controls, actual-object generation/reuse and failed-release controls, consumer cleanup tests, and bounded CPL3 native coverage. Update all operation inventories, Rootd's measured audit contracts, canonical documentation and manual/API references. Validate coherent original commit dependencies, complete strict component matrices and repository CI checks, then monitor original workflows. Ordinary mediator start, whole-image admission and both complete builds inside EriX remain separate open gates. Generation-bound native cleanup checkpoint — 18 September 2026: Signed revision `bd81f0d8bbb3ce3d3e4d172667d1d12fbe155e6e` is pushed. Native operations 56/57 match the original generation under the cleanup lock, preserve partial-disposal retries and retire selectors 8/35. Four strict host matrices pass 688/712 units plus standalone controls; all eight native builds and Clippy configurations pass. Both original 60-second VM scenarios pass. Nineteen actual CPL3 cleanup calls check malformed and retired selectors, stale identity, eligibility, repeated absence and preserved terminal evidence. All earlier lifetime oracles remain required; both packaged Kernels match their normally stripped original builds and all 15 component trees are clean. Formatting and Markdown checks pass. Original [CI 598](https://git.erikinkinen.fi/erix/kernel/actions/runs/598) and [CI 599](https://git.erikinkinen.fi/erix/kernel/actions/runs/599) passes; all four terminal logs are complete (725,508 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements. Caller-local grant relocation design — 18 September 2026: Add immediate x86_64 syscall `0x54`, `RELOCATE_LOCAL_GRANT`, taking source slot in argument 0 and destination slot in argument 1. Both fit u32, are nonzero and distinct; arguments 2–5 are zero. The return is the exact result in rax with zero auxiliary value. Admission uses the actual current Running native process and nonzero generation, checks both slots against its syscall window, and accepts only an actual held INSTALL_GRANT or REVOCATION_GRANT with its matching native record. Movement uses the existing unique-record rebinding within that same native CSpace; rights, child/generation installation scope and revocation lineage are preserved. No grant is constructed, copied, attenuated or retargeted. Malformed register shape rejects before context lookup; caller/window checks precede source lookup, then type/binding checks precede empty-destination admission. Ordinary validation refusal leaves inventory unchanged. The transition is serialized with process-terminal and reply-authority lifecycle changes. Owned CLAIM already selects receiving destinations before exposing request bytes; this operation lets a producer validate the received grant and then relocate it into an existing per-process custody slot. The operation itself does not validate a bootstrap request, install child authority or acknowledge application retirement. It adds no Process endpoint selector or general CNode route. Literal register, foreign/terminal caller, missing/fake binding, occupied destination, exact-rights/scope and actual CPL3 controls are required, followed by coordinated producer/consumer adoption and the remaining realm VM gates. Caller-local grant relocation native acceptance — 18 September 2026: Signed Kernel `56d398e077c140c58e23f9cc2d8b79f19bc4cc2f` implements register-only syscall 0x54 using the actual Running caller, both admitted local slots and native unique install/revocation binding owners. Rights, child generation, installation scope and revocation lineage remain unchanged. Seven new host controls and all four strict matrices pass: 695/719 units, both standalone controls, eight native builds, strict Clippy, rustdoc and formatting. Both actual native VMs pass under their original 60-second limits. The lifetime fixture executes thirty-nine new CPL3 relocation calls before its existing installation, revocation, terminal, inventory, queue and page checks; user instructions validate results and observers never replace them. Normal stripping reproduces both packaged Kernel artifacts, and all fifteen original selected component trees are verified clean. Original [CI 600](https://git.erikinkinen.fi/erix/kernel/actions/runs/600) and [CI 601](https://git.erikinkinen.fi/erix/kernel/actions/runs/601) pass from four complete logs (731,632 bytes), without warnings. This is native local custody evidence only: actual owned service adoption, consumer VM execution, complete realm fairness and both full builds inside EriX remain open. Owned receiver request-budget contract — 18 September 2026: Extend register-only REGISTER (0x4C) to take the actual local RECV slot, maximum request payload bytes and maximum request capability count in arguments 0–2; arguments 3–5 remain zero and successful RDX is zero. Both budget values are explicit receiver declarations. Zero/zero admits only empty requests. The byte/slot/receipt receive layout must be addressable and capability capacity must fit native private CSpace storage. The actual Running generation and held generic RECV endpoint remain the registration authority. Exact repeated registration is idempotent only with the same budget; a different budget or owner conflicts without modifying the original registration. Replacement follows the existing actual receiver-binding removal and exact native retirement rules. SUBMIT compares actual payload length and capability count against that exact registration before request allocation, private-space reservation, native transfer or invocation serial acceptance. Oversized requests return ordinary INVALID_ARGUMENT with zero owner ID and unchanged source custody. The packet decoder passes its checked capability iterator directly to native preparation, removing its redundant temporary vector. Accepted invocation, result-budget, delivery, draining and retirement contracts remain explicit. Migrate every producer and fixture to the new signature without a deprecated unbounded fallback. These budgets describe service-owned receiving storage; they add no global CALL-size ceiling, user-pointer retention, foreign selector or capability grant. Literal malformed/zero/exact registration controls, rejected-inventory checks, actual CPL3 calls and existing VM oracles are required. Then connect the owned Procd/Launchd bootstrap path through its held private route, actual claimed caller identity, server-chosen grant receipt and local relocation, retaining each committed/draining owner through exhaustive cleanup. Actual consumer VMs, complete fair realm progress and both full guest builds remain open acceptance requirements. Explicit owned receiver admission acceptance — 18 September 2026: Signed `7034572037d1217b841c04dd9f45d5b254122a91`. REGISTER binds explicit byte/capability request limits to the actual receiver generation and RECV binding. Zero dimensions, exact repetition and conflicting changes are checked without additional authority. Oversize is refused before native request allocation, transfer or invocation acceptance. Checked packet descriptors feed native preparation without a redundant vector. Seven new host controls and four strict 702/726-unit matrices pass, with both standalone controls, eight warning-free native builds, Clippy and rustdoc. Both actual 60-second VMs pass; ten new CPL3 admission checks precede every existing ownership, mapping, origin, lifetime and retirement oracle. Original build outputs reproduce packaged artifacts; all fifteen native component signatures are verified. Allocation controls observe no requests on oversized refusal and equal direct-native/packet submission allocation. Original CI 602/603 passes from four complete logs (738,406 bytes), without warnings. Actual owned Procd/Launchd service adoption, consumer VM execution, complete realm fairness/readiness/sealing and both full builds inside EriX remain open. Original coherent realm runtime prerequisites — 18 September 2026: Signed `bd127228f62cd5320e87642e79aa7c1cd8212e24` selects original shared dependency revisions. Four strict default/all-feature development/release matrices pass 702/726 kernel units plus two external controls per configuration, retaining three pre-existing ignored tests. Thirteen native builds cover ordinary, tracing, owned-invocation, lifetime and coherent SMP configurations. Formatting, strict host/native Clippy, private rustdoc and Markdown pass with zero warnings. Direct Rust implementation bytes are unchanged. Original CI is under observation. Matching catalogs, source-bound consumer VMs, complete realm operation and both full guest builds remain required. Original coherent realm source CI acceptance — 18 September 2026: Signed `bd127228f62cd5320e87642e79aa7c1cd8212e24` passes [CI 605](https://git.erikinkinen.fi/erix/kernel/actions/runs/605) and [CI 604](https://git.erikinkinen.fi/erix/kernel/actions/runs/604). All four terminal logs are complete (738,372 bytes), with zero final warnings. This closes the original CI observation recorded above. Coherent catalog publication, actual consumer VMs and full guest-build acceptance remain separate open requirements. ## Tracking and rollout ### Runtime dependency alignment — 15 September 2026 Signed `6223e5dc40248fd41d5492d72158c7bc5099f122` aligns the existing dependency pins with the original signed library graph. This checkpoint changes Cargo selections and the roadmap; the repository's Rust implementation files are unchanged. The default/all-feature development/release matrix passes 661 default / 685 all-feature tests, formatting, strict host/native Clippy, 10 native builds and private rustdoc, without warnings. Canonical documentation checks pass. Three existing native-only test ignores remain unchanged. Push/review CI 572/573 passes with complete classified logs and no warnings. Coherent product catalog adoption and product VM acceptance remain pending. Review: https://git.erikinkinen.fi/erix/kernel/pulls/3. ### Coherent runtime source adoption — 15 September 2026 The product runtime catalog still selects the earlier source graph. Adopt the current original signed sources as one coherent graph before claiming product execution of the new kernel invocation, mediator construction and Procd caller-admission contracts. The frozen inventory covers 73 catalog components and 72 tracked Cargo manifests; 54 components need direct pin alignment, with further propagation after dependency commits are published. Align dependency selections bottom-up, preserve original Git objects, and validate every altered repository under its supported strict configurations before signing and publishing its dependency commit. Full commit selectors remain mandatory. Unrelated work is preserved, and no synthetic replacement object or rewritten published history supplies build evidence. Update the runtime catalog only once all selected Cargo manifests and original metadata agree. Run actual product images covering authenticated Launchd activity and the relevant lifecycle/authority regressions, adding negative caller controls where needed. Keep complete warning-free build/test/image evidence and monitor existing CI. Significant regressions use the canonical bug report format. Dependency alignment alone does not prove runtime authority closure, mediator execution, performance improvement or either complete guest build generation. Typed grant return and guarded bootstrap remain the next realm implementation boundaries. ### Construction without child root capabilities — 15 September 2026 Kernel operation 54 admits only actual Process endpoint holders and constructs a Created child with exactly one primary endpoint and no root capabilities. The native TCB retains address-space backing independently. The caller receives a unique install grant, an endpoint master and only an explicitly requested MAP-only VSpace receipt. The checked request distinguishes absence from a genuine slot-zero receipt. Former-root slots are usable; actual caller windows, native capacity, occupancy and child window scope remain enforced. Rollback disposes only successful new receipts and the partial child while preserving pre-existing bindings. Ordinary operation 32 remains unchanged. Initial inventory is not a seal or a permanent ban on later explicit installation. Signed original revision: `6d2ca19c48d3663db4b3a1eba4e9b7588b351f6f`. Strict default/all development/release matrices pass 661/685 tests including two standalone controls, with three existing ignores. Host/native Clippy, private rustdoc, formatting and ten freestanding builds pass without warnings. Six added host controls cover 30 valid layouts, exact refusal inventories, actual caller windows and backing through abort or start/kill/destroy. Both isolated native VM scenarios pass; current component CI has complete warning-free logs. Procd adoption, authenticated grant return, guarded bootstrap authority, private mediator execution, readiness, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase semantic authority and private-item documentation audits remain incomplete. ### Staged endpoint attenuation checkpoint — 15 September 2026 Kernel operation 53 narrows only the actual install grant's matching Created child's primary endpoint. The grant must cover the current rights as well as the requested result. Final identity/state checks and the allocation-free CSpace mutation share the child record lock. Exact zero and repeated reduction preserve object identity, other aliases and revocation associations; restored rights, stale or foreign targets, malformed fields and started children refuse. Signed original revision: `d690eda817e56b515a278bdbb5ea6c5aedeb431b`. All 655/679 default/all tests pass, with three existing ignores, strict host/native development/release Clippy and private rustdoc, formatting and ten native build configurations. CI 568/569 passes with complete warning-free logs. Both actual native VMs pass with empty QEMU stderr and clean teardown. The lifetime fixture retains thirteen installation and seven construction/disposal calls, adding eight real CPL3 attenuation calls with actual returned identity and complete cleanup. The owned-invocation oracle remains unchanged. Authenticated grant return, independently minimal bootstrap/root authority, retained native and nested guards, private mediator execution, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase authority and private-item documentation audits remain incomplete. Dependencies: [integration#1](https://git.erikinkinen.fi/erix/integration/issues/1), [lib-posixabi#1](https://git.erikinkinen.fi/erix/lib-posixabi/issues/1) Dependencies identify required contracts and closure gates; preparatory inventory/design can proceed in parallel under one owner per edited file. Link bounded implementation issues and their PRs here before claiming acceptance. Use `feature/posix-compat`, regular signed commits in the canonical contribution format, and WIP PRs linked to the exact coherent component graph. All cross-repository Cargo/catalog selections and CI helpers use full 40-character lowercase commit hashes, including transitive dependencies; do not substitute branch, tag or implicit HEAD selection. Close criteria only with their own reviewed deliverables and validation evidence. Pending, skipped, cancelled, failed or predecessor-only results remain distinct. Keep main images unchanged until explicit promotion direction; technical completion does not authorize merges, release tags or publication. Process-start census correction — 19 September 2026: signed Kernel `b762e19d0c16acd605d0f6123994a586cc6fcde1` requires a successful install-grant absence census before process start. An unavailable census returns the existing refusal and preserves the whole staged child and grant state. Hosted controls cover unavailable census, actual grant disposal and malformed-target precedence. Normal bootstrap initializes tracking before admission; production reachability of the injected condition or a native authority escape is not established. [Kernel issue 18](https://git.erikinkinen.fi/erix/kernel/issues/18) uses the canonical bug report and records the original failure and bounded correction. Four strict Kernel matrices pass 704/728 library tests and two standalone controls each; three existing ignored tests remain ignored. Formatting, strict host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass. Original [Kernel CI 606](https://git.erikinkinen.fi/erix/kernel/actions/runs/606) and [607](https://git.erikinkinen.fi/erix/kernel/actions/runs/607) pass from all four complete hashed logs (739,843 bytes), without warnings. Signed Integration `b65183ddb93eb4396d4140a002c3727fec42ff87` selects that Kernel and the reconciled Docs `7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d`, preserving all other catalog entries and all previously checked orchestration bytes. The matching guarded-preparation VM passes both unique markers and ordinary successful shell exit under unchanged 120-second hard and 45-second progress limits. All 106 artifacts, all 73 original component identities and the actual signed image are verified without warnings. Serial SHA256: `a373a8ccd81ac3efbaa492cbf2e1f991f3cc34dcbf23a1435c1c48cd75cd5c1c` (55,776 bytes); signed boot-image SHA256: `3b88d37183cf36dcbd5f1105cc0fd86e79aa4489d311300003f3f362c24bcd0a`. This remains an unstarted staging fixture. Normal native execution does not exercise the hosted unavailable-census condition. The prior complete 169-helper/four-matrix Integration evidence is verified against unchanged implementation bytes. Focused catalog/source checks pass, including 46 immutable-source and five tool-selection tests. An initial host fixture failure caused by disabling its deliberate Git replacement setup is retained; the established helper environment passes without altering product checks. The static census covers 3,127 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 170 direct missing_docs gates and 92 conventional crate roots; complete semantic authority and private-documentation closure remain open. Original [Integration CI 1679](https://git.erikinkinen.fi/erix/integration/actions/runs/1679) and [1680](https://git.erikinkinen.fi/erix/integration/actions/runs/1680) are queued. Earlier 1677/1678 remains queued and 1675/1676 is running. No unchanged workflow is rerun or cancelled. Complete mediator execution, full source/effect/frame proof, upstream Rust/LLVM rebuilding and both full EriX build generations inside EriX remain required. No whole acceptance item is newly completed. Shared native terminal transition — 19 September 2026: signed Kernel `37d9c74d6d1209729c520a52a274c1646efe225c` consolidates exit and kill event reservation, lifetime preflight, exact-generation commit and receiver/invocation retirement into one documented implementation. Existing public behavior and root exit cleanup remain unchanged. Terminal state and actual resource destruction stay separate. This completes the terminal-refactor prerequisite in [child lifetime design #19](https://git.erikinkinen.fi/erix/kernel/issues/19); it introduces no lifetime binding, new opcode or additional authority. Four strict Kernel matrices pass 704/728 library tests and both standalone controls, with three existing ignored tests unchanged. All thirteen native build/Clippy profiles, formatting, host/native Clippy and private rustdoc pass without warnings. Original [Kernel CI 608](https://git.erikinkinen.fi/erix/kernel/actions/runs/608) and [609](https://git.erikinkinen.fi/erix/kernel/actions/runs/609) pass from all four complete hashed logs (739,870 bytes), without warnings. Signed Integration `a62d1381f56a01afc692112d9b427205eaeb6a2e` updates both full Kernel selectors and five stale native diagnostic selectors while preserving source memberships and tested orchestration bytes. Both maintained native runners pass their original 60-second scenarios: lifetime revocation and owned invocation. Complete serial logs are retained (1,807 and 1,587 bytes), QEMU stderr is empty, and build warnings are absent. Packaged Kernel bytes match retained unstripped artifacts; all fifteen exact original component trees and signatures verify. Four current strict 320/321-test Integration matrices, native builds, formatting, host/native Clippy and private rustdoc pass. Seven focused source/native-policy checks pass; the complete 169-helper evidence remains hash-bound to unchanged implementation bytes. Original [Integration CI 1681](https://git.erikinkinen.fi/erix/integration/actions/runs/1681) and [1682](https://git.erikinkinen.fi/erix/integration/actions/runs/1682) are queued; older corrected 1675/1676 remains running. The static census covers 3,128 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 170 direct missing_docs gates and 92 conventional roots. Full semantic authority and private rustdoc closure remain open. Native child-lifetime custody, running mediator lifecycle, full frame proof, upstream Rust/LLVM rebuilding and both full EriX build generations inside EriX remain required. No whole phase acceptance item is added. Native child lifetime checkpoint — 19 September 2026: signed Kernel 1428885e6d27e8e2bcefbbf68caf22ece253aac9 implements operation 58 using the actual Running caller, an exact Created child, independent Process authority and its real local install grant. It consumes only that grant, reserves cohort events before terminal effects, stops descendants before their supervisor and retains each bound child's cleanup duty and first failure independently of userspace survival. Return-boundary disposal closes outgoing accounting and respects current/active-interval protection. Fourteen new real-object controls cover refusals, rollback, nested stopping, a 257-descendant tree, late preflight failure, exact reuse and failed explicit abort after unlinking. Four strict 718/742-test configurations and both standalone controls pass; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Original [Kernel CI 610](https://git.erikinkinen.fi/erix/kernel/actions/runs/610) and [611](https://git.erikinkinen.fi/erix/kernel/actions/runs/611) pass from four complete hashed logs, 751,929 bytes, without warnings. The matching maintained lifetime VM passes its original 60-second scenario with the additional `ERIX_KERNEL:CHILD_LIFETIME_OK` marker. A real CPL3 supervisor proves ChildPopulate refusal, malformed/generation refusal, actual Process-route binding, start and exit. An independent observer verifies both exact children, CSpaces and mappings absent before terminal-event consumption, then disposes the unbound supervisor. The runnable child has a faulting sentinel and intentionally does not execute. All sixteen additional mapped pages are disposed. The original owned-invocation VM also passes its unchanged scenario. Complete serial logs contain 1,838 and 1,587 bytes; QEMU stderr is empty and build warnings are absent. Packaged Kernel bytes match retained original unstripped artifacts and all fifteen selected component signatures verify. Lifetime serial SHA256 is `012b46541b7c1c89d954cdbebda855037152a4e39ffad20ad7bdcc8c7b5c2572`. This establishes explicit native supervision with actual caller-side CPL3 evidence. Executing-child, no-successor native idle, allocation/partial-effect failure coverage, Procd adoption, running-mediator failure, provider completion, complete source/effect/frame proof, upstream Rust/LLVM rebuilding and both full EriX-in-EriX generations remain open. Host idle controls do not establish native interrupt or wakeup behavior. No whole phase acceptance leaf is added. Signed Docs 9ca5a5e811766a4506c0626cd58f8e228d0bacf8 updates the technical manual's native admission, preflight, stopping, partial cleanup and safe return/idle contracts. All 45 tests and the complete 2,425-page manual pass with zero final warnings. All 447,213 word boxes are in bounds and all three changed contract pages are visually reviewed. Shared API reference source is unchanged. Original [Docs CI 981](https://git.erikinkinen.fi/erix/docs/actions/runs/981) and [982](https://git.erikinkinen.fi/erix/docs/actions/runs/982) pass from four complete hashed logs, 773,510 bytes. Both pass 45 tests and the complete 2,425-page manual. TeX pass warning counts are 36/1/0, with zero final-pass warnings; neither workflow was rerun or cancelled. Signed Integration 581226ab5435dc66c6f93157606b6d4d83475b15 selects the coherent original Kernel/lib-capabi/lib-ipc graph and updated manual. All four current strict 320/321-test configurations, four native builds, fmt, strict host/native Clippy and private rustdoc pass without warnings. Source and updated native-policy checks pass; the full 169-helper evidence remains bound to unchanged orchestration bytes. The final post-VM changes select only the newer Docs revision and update roadmap status; native source catalog, scenario, runtime and orchestration bytes are unchanged. Original [Integration CI 1683](https://git.erikinkinen.fi/erix/integration/actions/runs/1683) and [1684](https://git.erikinkinen.fi/erix/integration/actions/runs/1684) are queued. Executing-child and terminal-reply checkpoint — 19 September 2026: signed [Kernel dd9eace5](https://git.erikinkinen.fi/erix/kernel/commit/dd9eace5b52edc02e624f142e92b85032f59bace) validates actual CPL3 nested-child execution and current-child ancestor termination. Synchronous control dispatch now ends its request borrow before effects and checks original caller identity, generation and terminal state before any response write. It keeps terminal completion in Kernel-owned result registers with zero reply length; ordinary native return switches away. A surviving caller retains its normal encoded response. Two focused actual-object regressions cover terminal request preservation and the surviving-caller reply. The dispatcher is split from the tracing/policy file. A supervisor binds and starts a child; that child binds a staged grandchild and kills its supervisor through its own explicit Process SEND route. Read-only witnesses require terminal caller storage to survive dispatch, then exact child/grandchild absence before the independent observer reads child-before-supervisor events. Both terminal payloads have immediate UD2 sentinels. An unrelated Created process retains its exact record, empty capability inventory and mappings until explicitly aborted. All four additional lifetimes and twenty-two mapped pages must be disposed for `ERIX_KERNEL:CHILD_EXECUTION_OK`. Four strict Kernel configurations pass 720/744 library tests and both standalone controls; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Signed [Integration c14c5a61](https://git.erikinkinen.fi/erix/integration/commit/c14c5a617196a9b135b479601ca47a21371a9482) requires the additional marker while preserving every earlier marker and the original 60-second limit. Both actual native scenarios pass, with 1,870/1,587 complete serial bytes, empty QEMU stderr and no build warnings. Packaged Kernel bytes equal retained original artifacts after normal stripping; all fifteen original source signatures verify. Lifetime serial SHA256 is `1b2f983239efca55c8bc0f6f08ee91cfdcd37d4d1f6951bbd740e4d9b45d1a2f`. Four current Integration 320/321-test configurations, native builds, strict Clippy, formatting, private rustdoc and updated policy checks pass. Earlier 169-helper evidence is hash-verified against unchanged orchestration; it was not rerun for these scenario/catalog changes. Signed [Docs b4b01d87](https://git.erikinkinen.fi/erix/docs/commit/b4b01d870757d9b626dd2cfa7c6424332087bf62) documents the executing-child observations and remaining limits. All 45 tests, the full 2,425-page manual, 447,382 word bounds and visual review of the changed pages pass, with zero final warnings. The API reference source is unchanged. This extends native executing-child evidence; it does not establish no-successor native idle/wake behavior, provider completion, Procd adoption or a complete service lifecycle. The original install-grant constructor still gives `GRANT | MINT` while binding needs only `GRANT`; move-only transfer preserves exact rights. Both diagnostic grants are consumed, but rights minimization remains an explicit audit follow-up. Full source/effect/frame proof, the Pagerd gate, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted. Related implementation tracking: [Kernel feature](https://git.erikinkinen.fi/erix/kernel/issues/19), [Kernel WIP PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration WIP PR](https://git.erikinkinen.fi/erix/integration/pulls/12), [manual WIP PR](https://git.erikinkinen.fi/erix/docs/pulls/4), and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Original [Kernel CI 614](https://git.erikinkinen.fi/erix/kernel/actions/runs/614) and [615](https://git.erikinkinen.fi/erix/kernel/actions/runs/615) pass from four complete hashed logs, 753,462 bytes, without warnings. Original [Docs CI 983](https://git.erikinkinen.fi/erix/docs/actions/runs/983) and [984](https://git.erikinkinen.fi/erix/docs/actions/runs/984) pass from four complete hashed logs, 773,542 bytes. Both pass all 45 tests and the complete 2,425-page final manual; reference-resolution warning counts are 36/1/0, with zero final warnings. Original Integration CI 1685/1686 remains queued at its second observation. Older original [Integration CI 1678](https://git.erikinkinen.fi/erix/integration/actions/runs/1678) passes all 489 catalog scenarios and both native Kernel diagnostics, then fails the development COM1 editor probe after its physical counterpart passes. Rust and Markdown pass. All three complete logs total 13,384,697 bytes with no warnings; the outer input status does not establish cause. The canonical bug report is [issue 67](https://git.erikinkinen.fi/erix/integration/issues/67), with bug/ci/phase-6 metadata. Earlier editor and filesystem failures remain separate. No original workflow was cancelled or rerun. Native cleanup without a userspace successor — 19 September 2026: signed [Kernel 2cf5b34c](https://git.erikinkinen.fi/erix/kernel/commit/2cf5b34c77451e4ddfa50f6bab9ae65cc5c47068) adds a seventh actual CPL3 caller to the maintained lifetime diagnostic. After every earlier assertion, the observer binds/starts the final child and yields. The child kills that supervisor through its own explicit Process SEND route. Immediate faulting sentinels forbid either terminal payload from resuming. Ordinary native return closes CPU accounting, detaches current attribution, progresses reclamation and finds no runnable successor. A diagnostic-only read-only witness then requires empty CPU accounting, only terminal retained records, no bound cleanup duties or event reservations, exact child identity/CSpace/mapping absence and both unconsumed child-before-supervisor events. All six final child pages retire; three original unbound terminal records remain for prior assertions. The witness neither performs cleanup nor selects a process nor installs an interrupt. `ERIX_KERNEL:CHILD_IDLE_CLEANUP_OK` precedes completion before HLT, so actual hardware halt/wakeup remains a separate gate. Signed [Integration 4d6f4fe8](https://git.erikinkinen.fi/erix/integration/commit/4d6f4fe8b383603b225b04a7771a11f32886e0a9) requires the additional marker while preserving all earlier assertions and both 60-second scenario limits. Both actual native VMs pass: 1,905/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256: `4a7cba61f75f4eeac47896d165b8dbcd217e4c75e2a81c8ae0f29957facb929c`. Packaged Kernel images match retained build artifacts after normal stripping; all fifteen original component signatures verify. Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Post-VM changes only select updated Docs in full catalogs and update roadmap status. Signed [Docs 69466a64](https://git.erikinkinen.fi/erix/docs/commit/69466a64c032d575569adeff14f17a445e5a9c03) documents the pre-halt boundary and consolidates stale status paragraphs. All 45 tests, the complete 2,425-page manual, 447,534 word bounds and visual review of pages 562–564 pass with zero final warnings. API reference source remains unchanged. The static audit passes 3,140 authored code files below 1,000 lines, 74 manifests, 259 full Git selections, 171 direct missing_docs gates and 92 conventional crate roots; semantic authority and complete private-rustdoc closure remain open. Original [Kernel CI 616](https://git.erikinkinen.fi/erix/kernel/actions/runs/616) and [617](https://git.erikinkinen.fi/erix/kernel/actions/runs/617) pass from four complete hashed logs, 753,458 bytes, with no warnings. Original [Docs CI 985](https://git.erikinkinen.fi/erix/docs/actions/runs/985) and [986](https://git.erikinkinen.fi/erix/docs/actions/runs/986) also pass: four complete hashed logs, 773,510 bytes; both pass 45 tests and the final 2,425-page manual. Reference-resolution warning counts are 36/1/0 with zero final warnings. Original Integration CI 1687/1688 remains queued at its first observation. Older original [Integration CI 1677](https://git.erikinkinen.fi/erix/integration/actions/runs/1677) is now terminal failure: all 489 catalog cases, both native diagnostics, development physical/COM1 editor and release physical editor pass before release COM1 fails. Rust and Markdown pass. Three complete logs total 13,385,246 bytes without warnings; [bug 37](https://git.erikinkinen.fi/erix/integration/issues/37) retains this evidence. Companion 1678's earlier development COM1 failure remains separate in [bug 67](https://git.erikinkinen.fi/erix/integration/issues/67); a common cause is unproven. No original workflow was cancelled or rerun. Further native failure controls, grant-rights minimization, terminal accounting, Procd adoption and complete service lifecycle acceptance remain open. Existing install-grant creation still supplies GRANT | MINT while binding needs GRANT, so minimum authority is not claimed. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted. Related: [Kernel design](https://git.erikinkinen.fi/erix/kernel/issues/19), [Kernel WIP PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration WIP PR](https://git.erikinkinen.fi/erix/integration/pulls/12), [manual WIP PR](https://git.erikinkinen.fi/erix/docs/pulls/4), and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Native terminal-event allocation refusal — 19 September 2026: signed [Kernel ba03995f](https://git.erikinkinen.fi/erix/kernel/commit/ba03995fe0dcfc3d4a1f72eb000e0c7698bbcbaa) extends the actual executing-child sequence with one deliberately refused heap allocation. Separate diagnostic preparation captures the original supervisor, child, staged grandchild and independent process records/capability inventories, then gives an empty event queue one-event capacity. No queued event or existing reservation is discarded. The first terminal-event reservation succeeds; the second arms exactly one null return from the real Kernel allocator. Ordinary collection growth and Process dispatch return RESOURCE_EXHAUSTED before any terminal effect. Read-only witnesses require complete reservation rollback, an empty event queue, unchanged exact records and capabilities, and preserved code/stack/message mapping ranges. Actual CPL3 instructions validate the refusal reply before the next ordinary ancestor kill succeeds with allocation available. Every earlier terminal, descendant-disposal, independent-process and no-successor idle assertion remains required. `ERIX_KERNEL:TERMINAL_EVENT_RESERVATION_OK` requires one consumed allocator refusal and no remaining armed fault. Fault controls are absent from ordinary images; this covers injected allocation failure, not spontaneous heap exhaustion or independent resource-release failure. No witness supplies a syscall result, cleanup effect or scheduler choice. Signed [Integration cf5b2f5f](https://git.erikinkinen.fi/erix/integration/commit/cf5b2f5f1d63631e69df3074d7c1c0b9b4921480) requires the new marker without changing either 60-second limit. Both maintained native VMs pass: 1,948/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is `d485019082175f769ecc2d406d88c6cc84a7df323605027663f5bcc79ca03ad9`. Packaged Kernel bytes match retained original artifacts after normal stripping, and all fifteen original source signatures verify. Post-VM changes only select updated Docs in full catalogs and consolidate roadmap status. Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and updated policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed [Docs 62ba2ffa](https://git.erikinkinen.fi/erix/docs/commit/62ba2ffa30ff9f04840c8d38d188b414e5b24b90) passes 45 tests, the complete 2,425-page manual, all 447,688 word bounds and actual visual review of pages 562–565, with zero final warnings; API reference source remains unchanged. The static audit passes 3,142 authored code files below 1,000 lines, 74 manifests, 259 full Git pins, 171 direct missing_docs gates and 92 conventional roots. Complete semantic authority and private-rustdoc closure remain open. Original [Kernel CI 618](https://git.erikinkinen.fi/erix/kernel/actions/runs/618) and [619](https://git.erikinkinen.fi/erix/kernel/actions/runs/619) pass from four complete hashed logs, 753,434 bytes, with zero warnings. Original [Docs CI 987](https://git.erikinkinen.fi/erix/docs/actions/runs/987) and [988](https://git.erikinkinen.fi/erix/docs/actions/runs/988) pass from four complete hashed logs, 773,506 bytes: both pass 45 tests and the final 2,425-page manual, with reference-resolution warning counts 36/1/0 and zero final warnings. Original Integration CI 1689/1690 is queued. Earlier filesystem, directory, editor and full-frame regressions remain unresolved; original workflows were not cancelled or rerun. The terminal-accounting audit confirms that ordinary Procd terminal handling queries original TCB counters after receiving its event, while automatic bound-child reclamation removes that TCB. Its separate private-mediator branch does not take the same query path; adoption must state which lifetimes require retained metrics and preserve their original generation without fabricated zero/wall-clock values. Independent release-failure coverage, grant-rights minimization, accounting, Procd adoption and full mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted. Related: [Kernel design](https://git.erikinkinen.fi/erix/kernel/issues/19), [Kernel WIP PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration WIP PR](https://git.erikinkinen.fi/erix/integration/pulls/12), [manual WIP PR](https://git.erikinkinen.fi/erix/docs/pulls/4), and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Independent native child release recovery — 19 September 2026: signed [Kernel 82d88b60](https://git.erikinkinen.fi/erix/kernel/commit/82d88b609bd808a840780993da315230dd14399a) extends actual supervisor-exit coverage with two deliberate refusals at the original staged child's final VSpace-release callback, after capability disposal and unlinking. The first error is KernelHeapExhausted, the second CspaceSlotMissing. Read-only observations around two ordinary CPL3 observer yields require the original full record, generation, abort custody and first error retained, an empty original CSpace and retained mapped backing. The independent running child must already be absent from native TCB, CSpace and VSpace directories. The selected child's earlier directory position ensures its failure preceded that independent disposal. The third callback must perform normal VSpace release before all original terminal-event, generation and resource-absence checks pass. `ERIX_KERNEL:CHILD_RELEASE_ISOLATION_OK` requires exactly two refusals and complete eventual disposal. Fault control uses only atomics at the locked callback boundary and exists only in the isolated native diagnostic. No witness performs cleanup, supplies a successful release/syscall result or chooses a scheduler target. This establishes injected callback-refusal coverage, not an observed hardware or allocator malfunction. All earlier nested-child, allocation-refusal and no-successor pre-halt assertions remain required. Signed [Integration 294a467a](https://git.erikinkinen.fi/erix/integration/commit/294a467a3bcd9464ea55c32dbce98acf19d0e400) requires the added marker with both original 60-second limits unchanged. Both maintained native VMs pass: 1,988/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is `606fff037be022c876220d8e8f329c9046ffea5dcdf80831026649aedfbe0b08`. Packaged Kernel bytes match retained original unstripped artifacts after normal stripping, and all fifteen original component signatures verify. Post-VM changes only select the updated manual source in full catalogs and reconcile roadmap status. Four strict Kernel 720/744-test configurations, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test configurations, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed [Docs 2a0ccc1a](https://git.erikinkinen.fi/erix/docs/commit/2a0ccc1a595c3e03aa6c7b7ecbcaca8830082ddd) passes 45 tests, the complete 2,427-page manual, all 447,789 word bounds and actual visual review of pages 562–565 with zero final warnings. API reference source is unchanged. Static audit passes 3,143 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 171 direct missing_docs gates and 92 conventional roots; complete semantic authority/private-rustdoc closure remains open. Original Kernel CI 620/621 and Docs CI 989/990 pass from four complete hashed logs each (753,438/773,910 bytes), with zero final warnings. Current Integration originals are observed after publication. Earlier filesystem, directory, editor and full-frame regressions remain unresolved, with original evidence retained; no workflow is cancelled or retried unchanged. The grant-rights audit confirms actual Procd derivation callers and exact GRANT | MINT receipt checks in Procd and Launchd. Grant authority minimization must coordinate those consumers and distinguish the grant's own rights from its installation ceiling. Original generation-bound terminal accounting, Procd adoption, provider completion, hardware halt/wakeup and complete mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted. Related: [Kernel design](https://git.erikinkinen.fi/erix/kernel/issues/19), [Kernel WIP PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration WIP PR](https://git.erikinkinen.fi/erix/integration/pulls/12), [manual WIP PR](https://git.erikinkinen.fi/erix/docs/pulls/4), and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Explicit grant implementation progress — 20 September 2026: Kernel commit [4a5333f760e258ebca23047a362d1cff4fded0c0](https://git.erikinkinen.fi/erix/kernel/commit/4a5333f760e258ebca23047a362d1cff4fded0c0) is signed and pushed. Creation preserves exact own grant rights, including zero. Derivation requires actual MINT and subsets of both own rights and installation scope. Zero-right custody still blocks process start until disposed. Four strict 724/748-unit configurations, both standalone controls and thirteen native build/Clippy profiles pass without warnings; three existing ignores remain. Original CI 622/623 passes from four complete hashed logs, 756,715 bytes, zero warnings. The new actual CPL3 derivation/disposal controls and GRANT-only relocation/installation compile; their matching VM execution remains pending. The consumer audit also identified Loaderd and Deviced receipt checks. Procd's move-only handoff cannot attenuate the original delegating grant: it now derives a GRANT-only final receipt into the already-disposed VSpace receipt slot and drops the source before returning that receipt. Nonderiving materialization and rootless mediator paths request GRANT directly. Partial failure retains original-generation rollback and all remaining local custody. Procd, Launchd, Rootd, Loaderd and Deviced pass their default unit suites; their full strict matrices and coherent guest validation remain open. [Deviced bug 4](https://git.erikinkinen.fi/erix/deviced/issues/4) records a separately observed quarantine test race and its test-only serialization correction. This is partial implementation evidence, not completed lifecycle or self-hosting acceptance. The canonical checklist remains 15 of 460 leaves, 3.48% weighted. Full terminal accounting, provider completion, consumer lifecycle, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both complete EriX-in-EriX generations remain required. Verified grant-rights checkpoint — 20 September 2026: Both maintained isolated native scenarios pass on their first attempts under the unchanged 60-second scenario limits, with no build warnings and empty QEMU stderr. Lifetime now exercises 27 ordinary CPL3 grant-right controls and requires INSTALL_GRANT_RIGHTS_OK before its existing cleanup assertions. Its 2,025-byte serial stream has SHA256 `6c685f1ceaf9080bf0bec628a4fac512bf9049d0fbcfe2b3737666adf414ca3a`; owned invocation retains 1,587 bytes. Normal stripping exactly matches both packaged kernels to retained original artifacts. All fifteen selected original source signatures and clean trees verify. These minimal native scenarios establish neither full service-image acceptance nor a guest build. All thirteen shared libraries pass their strict matrices and original CI. The five direct receipt consumers pass four strict host/native configurations; original CI passes for procd 292/293, launchd 145/146, rootd 1037/1038, loaderd 99/100, deviced 206/207. [Rootd baseline regression](https://git.erikinkinen.fi/erix/rootd/issues/6) and [Deviced quarantine fixture race](https://git.erikinkinen.fi/erix/deviced/issues/4) are corrected with retained original failures and successful corrected-source CI. Manual/API updates and remaining full-catalog alignment are in progress. [Integration bug 68](https://git.erikinkinen.fi/erix/integration/issues/68) records five original CI failures (1683/1684, 1685/1686 and 1688), each with 127 manifest/catalog revision mismatches before full VM execution. All fifteen complete logs are retained, 1,512,137 bytes with no warning candidates. Individual-crate and minimal-native validation did not prove full catalog coherence. Remaining dependents are being aligned and validated bottom-up; equality and immutable-source checks are unchanged. Earlier 1681/1682 separately reached 479/489 and 487/489 VM passes, with ten and two scenario timeouts at the original 120-second bounds. Those filesystem failures require separate analysis. Canonical acceptance remains 15 of 460 leaves, 3.48% weighted. Complete lifecycle and terminal accounting, provider completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain required. Owned address-space preparation — 22 September 2026: [Kernel issue 22](https://git.erikinkinen.fi/erix/kernel/issues/22) records the private hardware-root construction, exact authority, activation, invalidation, failure custody and retirement contract before implementation. Signed [Kernel 5e818e8b6d1d](https://git.erikinkinen.fi/erix/kernel/commit/5e818e8b6d1d6da7698cfff34820d0aa9de8c05a), in [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3), adds the [design contract](https://git.erikinkinen.fi/erix/kernel/src/commit/5e818e8b6d1d6da7698cfff34820d0aa9de8c05a/docs/owned-address-spaces.md) and an independent mapping-bit provenance regression. The current shared hierarchy and production permission encoder remain unchanged. An isolated rewrite produced the same 17 instructions and 63 bytes, so it was rejected as an optimization. Four strict Kernel matrices pass 737 default / 761 all-feature tests in development and release, retaining the same three existing ignored cases. Formatting, host/native Clippy, all 13 native builds, private rustdoc and Markdown pass without warnings. Original CI 628/629 is running. No hardware-owned root, concurrent user execution, elapsed-time speedup or native isolation closure is claimed. The profiler and unchanged startup timing gates remain open in [Integration 3](https://git.erikinkinen.fi/erix/integration/issues/3) and [Integration 72](https://git.erikinkinen.fi/erix/integration/issues/72). The [phase checklist](https://git.erikinkinen.fi/erix/integration/issues/65) stays at 15/460 accepted leaves, weighted 3.48%; external Rust/LLVM rebuilding inside EriX and both full guest-build generations remain mandatory and unproven. Native table-custody checkpoint — 22 September 2026: signed [Kernel 2e744897de7c](https://git.erikinkinen.fi/erix/kernel/commit/2e744897de7c330d3d095a65daed761a4e4a9406), in [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3), gives unpublished table allocations one cleanup owner through translation and initialization. Empty-table installation and huge splits transfer custody at parent publication. The raw allocation-return helper and duplicate huge-split initialization are removed. Parent/leaf invalidation, interrupt masking, permission templates and current shared-hierarchy lifetime remain intact. Five host controls cover allocation/translation failure, invalid geometry, abandoned preparation and publication. Four strict configurations pass 742 default / 766 all-feature tests, retaining three existing ignored cases; formatting, host/native Clippy, private rustdoc and thirteen native builds pass without warnings. Original Kernel CI 630/631 passes from four complete logs, 771,607 bytes and zero warnings. Signed [Integration fe63adde8ff9](https://git.erikinkinen.fi/erix/integration/commit/fe63adde8ff9529faf1261dbd5da3d7f39c0f2a6), in [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12), selects that exact Kernel in all three catalogs. Every other selection and Kernel dependency manifest is unchanged. All 172 maintained helper commands pass without warnings; unchanged Rust inputs retain their preceding strict matrices. Three original-source native executions pass lifetime revocation, owned invocation and mapping checks with unchanged 60-second guest limits, warning-free builds and empty QEMU stderr. Mapping isolation and sparse mappings have identical runtime settings; both maintained marker contracts pass on the retained mapping capture. All fifteen selected component signatures verify, and each packaged Kernel image equals its retained artifact after normal stripping. These results cover the current shared hierarchy, not independent hardware roots. The [Kernel evidence update](https://git.erikinkinen.fi/erix/kernel/commit/f50535bfcd9aa57271762bb0b4da7d759d08906e) and [Integration evidence update](https://git.erikinkinen.fi/erix/integration/commit/1621164b93a7705eae381ff95aeec59b4e9527c3) change documentation only, with executable inputs proven unchanged. Their original Kernel CI 632/633 is running and Integration 1715/1716 is queued. Older full Integration CI 1701/1702 at b06dfad00202765491a64552dde29eaca1c24838 passes from six complete logs, 26,962,712 bytes and zero warnings, including both runs' ext4 quota, ext4 links and FAT32 directory-metadata cases. Their earlier timing failures remain retained with unestablished causes; [18](https://git.erikinkinen.fi/erix/integration/issues/18), [20](https://git.erikinkinen.fi/erix/integration/issues/20) and [70](https://git.erikinkinen.fi/erix/integration/issues/70) have exact follow-up observations. No workflow was rerun or cancelled. All 3,176 authored code files remain below 1,000 lines. The next work in [Kernel 22](https://git.erikinkinen.fi/erix/kernel/issues/22) must resolve the supervisor baseline, bootstrap/saved-frame overlays and inactive-space population before adding root ownership, residency and retirement. Startup timing acceptance, complete authority cleanup and the profiler's measured speedup remain open. The [phase checklist](https://git.erikinkinen.fi/erix/integration/issues/65) stays at 15/460 accepted leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven. Ordinary mapping-domain checkpoint — 22 September 2026: [resolved admission report](https://git.erikinkinen.fi/erix/kernel/issues/23) records the original host failure and bounded fix. The [fixture regression](https://git.erikinkinen.fi/erix/kernel/issues/24) retains all three distinct failed attempts and the verified layout correction. [Kernel](https://git.erikinkinen.fi/erix/kernel/commit/ef3fd9293eaf691269fdb9e6b72eb15dac1f3f06) now validates the complete ordinary user page before backing or mapping changes, with both control paths covered. Four strict 745/769-test configurations, thirteen native builds, Clippy and private rustdoc pass without warnings. Three exact-source native executions pass lifetime, invocation and mapping; four maintained scenario contracts are checked, with sparse and isolation sharing their identical runtime capture. All fifteen selected native signatures and packaged Kernel identities verify. [Integration](https://git.erikinkinen.fi/erix/integration/commit/cd560584d034720ac179d5abc6f2a9d965943c63) pins the exact Kernel in all three catalogs, preserves every other selection and passes all 172 helpers. The unchanged ordinary exec-successor VM passes against the complete source graph, preserving its 120-second guest deadline, with no image warnings or QEMU stderr. [Docs](https://git.erikinkinen.fi/erix/docs/commit/043df99baaa9d4539da627fbfe4a234e41e74135) documents the domain and bootstrap distinction; all 45 tests and 2,431 pages pass, with 450,473 word bounds checked and no final warnings. The earlier Kernel CI 632/633 passes from four complete logs and zero warnings; current original CI remains under observation. Bootstrap provenance, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. VSpace MAP authority checkpoint — 22 September 2026: [the resolved bug report](https://git.erikinkinen.fi/erix/kernel/issues/25) records three original failing host controls and the verified correction in [Kernel](https://git.erikinkinen.fi/erix/kernel/commit/9fdf1a17acc9204719fee42d263dacfcd701d56c). Current local MAP rights now govern map, protection and unmap requests. Empty and MANAGE-only aliases are denied; MAP-only access remains valid. Four strict 750/774-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings. The [Integration catalog](https://git.erikinkinen.fi/erix/integration/commit/c62dbf9d7096d41b5d073bc497949e16f5f16e13) selects the exact signed Kernel in all three catalogs and passes all 172 helpers. Actual CPL3 calls preserve the authorized RW/NX page across restricted-alias refusals and drop all five temporary grants. Three native executions cover all four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signed sources and retained packaged artifacts. The original exec-successor service VM passes against all 73 components with its unchanged 120-second guest limit. All image warnings and QEMU stderr remain absent. [Manual validation](https://git.erikinkinen.fi/erix/docs/commit/a96c994750ed10205e7bac17be6922a53070e2d6) passes 45 tests, 2,431 pages and 450,550 checked word bounds, with both changed pages reviewed and zero final warnings. The static audit covers 3,181 authored code files below 1,000 lines, 259 exact Git dependency pins and existing direct missing_docs gates. It does not close semantic authority review. Earlier full Integration runs 1705/1706 are running; 1707–1720 remain queued at the latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel [638](https://git.erikinkinen.fi/erix/kernel/actions/runs/638)/[639](https://git.erikinkinen.fi/erix/kernel/actions/runs/639) and Docs [1009](https://git.erikinkinen.fi/erix/docs/actions/runs/1009)/[1010](https://git.erikinkinen.fi/erix/docs/actions/runs/1010) pass. Each pair has four complete logs: Kernel totals 777,250 bytes with zero warnings, and Docs totals 774,674 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration [1721](https://git.erikinkinen.fi/erix/integration/actions/runs/1721)/[1722](https://git.erikinkinen.fi/erix/integration/actions/runs/1722) remains queued; it receives no CI acceptance credit. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven. Frame access checkpoint — 22 September 2026: [the resolved bug report](https://git.erikinkinen.fi/erix/kernel/issues/26) records three original failing host controls and the verified correction in [Kernel](https://git.erikinkinen.fi/erix/kernel/commit/6671466a84cdc4994384e1b8391d6a01fa66fb09). Explicit READ now governs admission and hardware activation. No-access mappings retain backing with USER/WRITE clear and NX set; write-only and execute-only requests are rejected without adding READ. Existing protection-transition rules remain in force. Four strict 757/781-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings. The [Integration catalog](https://git.erikinkinen.fi/erix/integration/commit/b45edf143f599699f80e70a13827762d3e4da77e) selects the signed Kernel in all three catalogs and passes 172 helpers. Twenty-four actual CPL3 calls preserve earlier witnesses and cover no-access protection, write-only refusal, MAP-only frame derivation, denied READ and unmap after both frame grants are dropped. Three native executions pass four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signatures and retained packaged artifacts. The ordinary exec-successor VM passes against all 73 components with its unchanged 120-second guest limit. Builds emit no warnings and QEMU stderr is empty. [Manual validation](https://git.erikinkinen.fi/erix/docs/commit/45dae3cee4116b9387c4f3d3d2687a87f0fa340b) passes 45 tests, 2,433 pages and 450,702 checked word bounds, with the changed page reviewed and zero final warnings. Static review covers 3,182 authored code files below 1,000 lines, 259 exact Git pins and existing direct missing_docs gates. This does not close semantic authority review. Earlier full Integration runs 1705/1706 remain running and 1707–1722 remain queued at their latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel [640](https://git.erikinkinen.fi/erix/kernel/actions/runs/640)/[641](https://git.erikinkinen.fi/erix/kernel/actions/runs/641) and Docs [1011](https://git.erikinkinen.fi/erix/docs/actions/runs/1011)/[1012](https://git.erikinkinen.fi/erix/docs/actions/runs/1012) pass. Each pair has four complete logs: Kernel totals 782,838 bytes with zero warnings, and Docs totals 775,110 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration [1723](https://git.erikinkinen.fi/erix/integration/actions/runs/1723)/[1724](https://git.erikinkinen.fi/erix/integration/actions/runs/1724) remains queued; it receives no CI acceptance credit. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Authorized protection restoration, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. Current-grant protection checkpoint — 22 September 2026: [the resolved device-backing report](https://git.erikinkinen.fi/erix/kernel/issues/27) distinguishes its original metadata-authority inconsistency from the separate restoration feature gaps. The [Kernel implementation](https://git.erikinkinen.fi/erix/kernel/commit/f5dd939c462de9d62f317ab7d29c21779cbe11c7) permits representable no-access/R/RW/RX changes through current exact-backing grants and aliases while active or inactive. It removes historical access ceilings and original-slot equality while preserving current VSpace MAP, selected frame rights, kind/range/identity checks, W^X, explicit READ, backing custody and failure ordering. Four strict 766/790-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings. The [coordinated catalog](https://git.erikinkinen.fi/erix/integration/commit/8a9f865364656351fd8b12914e404a97b0be11c7) selects that original signed Kernel in all three catalogs and passes all 172 helpers. Fifteen managed-frame calls and twenty-nine device/domain calls pass inside the original lifetime window and deadline. Actual user instructions write, execute, rewrite and execute managed RAM, check narrow alias authority and final disposal, while a reused device slot cannot authorize unrelated backing. Every prior marker remains required. Three native executions pass four original contracts with complete signed source and artifact checks; the ordinary exec-successor VM passes the full 73-component graph and original 120-second limit. Image warnings and QEMU stderr are absent. [Manual validation](https://git.erikinkinen.fi/erix/docs/commit/155b2a0cd2771cb45fa881155baf2cd0f1d1db27) passes 45 tests, 2,433 pages and 450,954 word bounds; both changed pages are reviewed with no final warnings or overflow. Static review covers 3,184 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins and 174 direct missing_docs gates. Full semantic authority review remains open. [Older Integration CI 1705/1706](https://git.erikinkinen.fi/erix/integration/issues/73) has eleven real ext4 timeouts across eight scenarios, with complete retained logs and no accepted rerun. Their root cause and correction remain unresolved. Publication CI: Kernel [642](https://git.erikinkinen.fi/erix/kernel/actions/runs/642)/[643](https://git.erikinkinen.fi/erix/kernel/actions/runs/643) and Docs [1013](https://git.erikinkinen.fi/erix/docs/actions/runs/1013)/[1014](https://git.erikinkinen.fi/erix/docs/actions/runs/1014) pass. Each pair has four complete original logs: Kernel totals 790,650 bytes with 766/790 tests and zero warning candidates; Docs totals 775,150 bytes with 45 tests, 2,433 pages and zero final warnings or overflow. Retain the original 35/1/0 LaTeX warning convergence. Integration [1725](https://git.erikinkinen.fi/erix/integration/actions/runs/1725)/[1726](https://git.erikinkinen.fi/erix/integration/actions/runs/1726) remains queued and receives no completed CI acceptance. The separate older ext4 deadline report remains open. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Complete POSIX protection support, Process endpoint scope, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. VSpace ownership preparation — 22 September 2026: Live VSpace records and production mapping tables are non-cloneable. Test observations contain descriptive metadata, synthetic selectors use independent tables, and leaf-encoder checks borrow live mappings under the record lock. Selectors accept only the mapping table they consume. Current grants, backing custody, first-match ordering, reference scans and hint visit-count controls remain intact; the rights control now uses actual activation/deactivation. The former whole-record snapshot helpers are removed. Four strict Kernel configurations pass 766/790 tests with three existing ignored cases; thirteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. All 172 Integration helpers pass. Three exact-source native executions pass the four maintained mapping, sparse, invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Original 60/120-second guest limits, existing markers, exact component signatures and retained packaged artifacts remain required; image warnings and QEMU stderr are absent. No startup speedup or independent hardware-root acceptance is inferred. The [Kernel implementation](https://git.erikinkinen.fi/erix/kernel/commit/fa9491c65d173fa618c4c0ad241a5c4fe93d28e2) and [Integration source selection](https://git.erikinkinen.fi/erix/integration/commit/c17d8f1f18f55c0d159a80772ab8e5bbad8d7f04) are published with [Kernel validation evidence](https://git.erikinkinen.fi/erix/kernel/commit/14e38ec244976759214a5421c659de9b6f27beaf) and [Integration validation evidence](https://git.erikinkinen.fi/erix/integration/commit/29d778de650ba665b1ad9f143c12ef22baf62cbc). Continue under [owned-root design 22](https://git.erikinkinen.fi/erix/kernel/issues/22), [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3) and [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). Publication CI: Kernel [644](https://git.erikinkinen.fi/erix/kernel/actions/runs/644)/[645](https://git.erikinkinen.fi/erix/kernel/actions/runs/645) pass with four complete original logs (790,604 bytes), 766/790 tests and zero warning candidates. Integration [1727](https://git.erikinkinen.fi/erix/integration/actions/runs/1727)/[1728](https://git.erikinkinen.fi/erix/integration/actions/runs/1728) remains queued and has no completed acceptance; earlier ext4 deadlines remain tracked in [Integration report 73](https://git.erikinkinen.fi/erix/integration/issues/73). Complete authority cleanup, external toolchain rebuilding within EriX and both full guest build generations remain open. Canonical acceptance remains 15/460 leaves (3.48% weighted). Managed-frame diagnostic recovery — 22 September 2026: [Kernel report 28](https://git.erikinkinen.fi/erix/kernel/issues/28) is resolved by the [signed correction](https://git.erikinkinen.fi/erix/kernel/commit/bc49d6da2684dae6073a03c422e0ea2265d03f31) and [coordinated catalog](https://git.erikinkinen.fi/erix/integration/commit/69a1303d848d629efebcc532fff73457c3ab834f). The diagnostic admits an initially empty lower-half window while preserving the ordinary-domain guard and all 64-page, alias, hole, physical-byte and cleanup controls. The unnecessary heap allocation and raw-pointer cleanup state are removed, with expanded inline rustdoc. Four strict 766/790-test configurations, fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. All 172 Integration helpers pass. Both maintained allocator scenarios pass independently with their original 60/120-second deadlines and complete markers; exact signed source and retained packaged-ELF checks pass. The ordinary exec-successor VM also passes against all 73 components. Image warnings and QEMU stderr are absent. The original failed native image remains retained; no unchanged rerun is used as the correction. Static review still covers 3,186 code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Full semantic authority and inline-documentation review remain open. Older original Integration [1707](https://git.erikinkinen.fi/erix/integration/actions/runs/1707)/[1708](https://git.erikinkinen.fi/erix/integration/actions/runs/1708) both pass all 489 VM scenarios, Rust 320/321 and Markdown; six complete logs total 26,966,330 bytes with zero warning candidates. Publication CI: Kernel [646](https://git.erikinkinen.fi/erix/kernel/actions/runs/646)/[647](https://git.erikinkinen.fi/erix/kernel/actions/runs/647) pass with four complete original logs (790,634 bytes), 766/790 tests and zero warning candidates. Integration [1729](https://git.erikinkinen.fi/erix/integration/actions/runs/1729)/[1730](https://git.erikinkinen.fi/erix/integration/actions/runs/1730) remains queued and has no completed acceptance; [earlier ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. The separate supervisor physical-access window and independent hardware roots remain implementation work. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. Supervisor physical-access window — 22 September 2026: the [signed Kernel implementation](https://git.erikinkinen.fi/erix/kernel/commit/046951899b8064be1cc90667a73e5abd2faa51ec) shares one restoring supervisor scratch transaction between frame scrubbing and physical mapping-byte copies. Caller backing custody and page-table/interrupt custody remain live through byte access, exact leaf restoration and local invalidation. Scratch is released afterward; read aliases clear the write bit and all temporary aliases clear user access and set NX. The unreachable raw-VA fallback is removed, and complete preflight rejects missing or ambiguous backing metadata before any range effects. No new userspace operation or capability grant is introduced. This is preparatory work for [owned address spaces](https://git.erikinkinen.fi/erix/kernel/issues/22); independent roots and their switching/reclamation proof remain open. Eight added host controls cover geometry, permissions, preparation and partial-effect failures, restoration/release ordering, and malformed later-page metadata without partial reads or writes. Four strict host configurations pass 774/798 tests with three existing ignored cases. Fourteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. The [coordinated Integration catalog](https://git.erikinkinen.fi/erix/integration/commit/4fe89e021e08e45e3a9ecb1c939aba03f90e5fb1) passes all 172 maintained helpers; its exact marker expectation is updated alongside the strengthened scenarios. Unchanged orchestration and profiler sources retain strict validation. Six native executions satisfy seven maintained scenario contracts. Both allocator scenarios require the new same-VA/different-backing byte-and-leaf proof after complete cleanup, retaining every preceding marker and the original 60/120-second deadlines. Three further executions satisfy mapping, sparse, owned-invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Exact original signed source, retained artifacts and packaged Kernel matches are verified; no image warnings or QEMU stderr were observed. These checks establish no performance improvement. The [technical manual](https://git.erikinkinen.fi/erix/docs/commit/589449e4172b48e31a889c82addc83096a94e02d) documents backing and scratch custody; all 45 document tests and the complete manual build pass without final warnings. Static checks cover 3,190 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Complete semantic authority and inline-documentation review remain open. Publication CI: Kernel [648](https://git.erikinkinen.fi/erix/kernel/actions/runs/648)/[649](https://git.erikinkinen.fi/erix/kernel/actions/runs/649) and Docs [1015](https://git.erikinkinen.fi/erix/docs/actions/runs/1015)/[1016](https://git.erikinkinen.fi/erix/docs/actions/runs/1016) pass. Eight complete original logs (1,572,758 bytes) confirm Kernel 774/798 tests, 45 document tests and the 2,433-page manual. Initial TeX reference warnings resolve through normal multipass generation; final passes are clean. Integration [1731](https://git.erikinkinen.fi/erix/integration/actions/runs/1731)/[1732](https://git.erikinkinen.fi/erix/integration/actions/runs/1732) remains queued and has no completed acceptance. [Earlier ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and its runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. Owned supervisor baseline — 22 September 2026: the [signed Kernel implementation](https://git.erikinkinen.fi/erix/kernel/commit/0f5049592f7801b2a2d92b1290fdcc655952f72f) captures and verifies independently allocated supervisor tables before root VSpace creation, Rootd preparation and RAM seeding. Each copied page has one typed aligned Box owner before a parent references it; the recursive entry selects the copied root. Source boot/AP tables and mapped backing retain separate custody. User leaves, malformed geometry and invalid recursive identity are refused. Leaf permissions, cache policy and huge-page sizes are preserved; newly owned table branches use WriteBack and clear USER. Failed construction releases all unpublished allocations. This replaces a raw-pointer table-storage owner with shared typed storage and adds no unsafe Send/Sync implementation or userspace operation. Eleven new host controls cover independent storage, allocation/read failures, invalid translation geometry, user leaves, recursive and huge-page errors, source-permission drift, retained owner links and table counts beyond the unrelated 64-page batch size. Four strict host configurations pass 785/809 tests with three existing ignored cases; fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The [coordinated catalog](https://git.erikinkinen.fi/erix/integration/commit/122a3d77f7f879c32eba45ccdf2eba2fd9f8d3db) passes all 172 maintained helpers. Both allocator scenarios require successful baseline capture before their original marker sequence, with capability grants and original 60/120-second deadlines preserved. Six native executions satisfy seven maintained contracts: both allocator scenarios, mapping and sparse checks sharing identical runtime settings, owned invocation, lifetime revocation and ordinary exec-successor across all 73 components. Exact signed source and retained packaged artifacts are verified; no image warnings or QEMU stderr were observed. The [technical manual](https://git.erikinkinen.fi/erix/docs/commit/18b8b7160fc2f058f059ea3c41adeca5846f9f69) specifies the custody boundary and passes 45 tests, complete 2,433-page generation, all 451,287 word bounds and changed-page visual review without final warnings or overflow. Static audits cover 3,194 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Publication CI: original Kernel [push 650](https://git.erikinkinen.fi/erix/kernel/actions/runs/650) passes and [PR 651](https://git.erikinkinen.fi/erix/kernel/actions/runs/651) retains the host fixture failure. [Regression 29](https://git.erikinkinen.fi/erix/kernel/issues/29) is resolved by [signed Kernel `12184850cd73`](https://git.erikinkinen.fi/erix/kernel/commit/12184850cd73fff066abcb7f97039a0828b2a928): a deterministic private predecessor reproduces the original defect, and the corrected fixture passes the complete local matrix and [push CI 652](https://git.erikinkinen.fi/erix/kernel/actions/runs/652)/[PR CI 653](https://git.erikinkinen.fi/erix/kernel/actions/runs/653). Four complete corrected CI logs total 807,886 bytes with zero warning candidates. Only host tests and roadmap change; validated production sources and all catalog selections remain unchanged. Docs [1017](https://git.erikinkinen.fi/erix/docs/actions/runs/1017)/[1018](https://git.erikinkinen.fi/erix/docs/actions/runs/1018) pass with four complete logs (775,122 bytes), 45 tests and the 2,433-page manual. Initial TeX reference warnings resolve before clean final passes. Integration [1733](https://git.erikinkinen.fi/erix/integration/actions/runs/1733)/[1734](https://git.erikinkinen.fi/erix/integration/actions/runs/1734) remains queued at the latest retained observation and has no completed acceptance. [Earlier ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. The retained baseline is a construction prerequisite for [owned address spaces](https://git.erikinkinen.fi/erix/kernel/issues/22). Per-VSpace population, CR3 activation, invalidation and live-root reclamation remain open, and no speedup is claimed. Full semantic authority and inline-documentation review also remain open. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. Huge-leaf geometry correction — 22 September 2026: [the bug report](https://git.erikinkinen.fi/erix/kernel/issues/30) preserves four original host failures and one passing WriteBack control. The [signed correction](https://git.erikinkinen.fi/erix/kernel/commit/4f9cfcaeb63e9080f6d6a3e9fd190e6cb288c6fc) separates PAT from physical address bits, preserves permissions/cache indices across both huge splits, and gives newly allocated tables WriteBack policy. Scalar and batched translation, split preparation, snapshots and baseline validation share the documented geometry. No new userspace authority, original native exploit or universal boot failure is claimed. Four strict Kernel configurations pass 796/820 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The [catalog](https://git.erikinkinen.fi/erix/integration/commit/ccc32eed0b4029a1ef82279c665811692c859985) passes all 172 maintained helpers. Six native executions satisfy seven original contracts: mapping and sparse, lifetime, invocation, both allocator checks and ordinary exec-successor across all 73 components. The new native witness verifies real 2 MiB PAT translation, splitting and complete restoration; host controls additionally cover 1 GiB. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The [manual](https://git.erikinkinen.fi/erix/docs/commit/587a280f59e55598e3a26b788d589955ebb84212) passes 45 tests, 2,433 pages and changed-page visual review without final warnings or overflow. Publication CI: Kernel [654](https://git.erikinkinen.fi/erix/kernel/actions/runs/654)/[655](https://git.erikinkinen.fi/erix/kernel/actions/runs/655) and Docs [1019](https://git.erikinkinen.fi/erix/docs/actions/runs/1019)/[1020](https://git.erikinkinen.fi/erix/docs/actions/runs/1020) pass. Eight complete original logs (1,592,794 bytes) confirm Kernel 796/820 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration [1735](https://git.erikinkinen.fi/erix/integration/actions/runs/1735)/[1736](https://git.erikinkinen.fi/erix/integration/actions/runs/1736) remains queued and has no completed acceptance. Earlier [ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. Static audits cover 3,197 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, live-root reclamation and full semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven. First-start register custody — 22 September 2026: [the stack-domain bug report](https://git.erikinkinen.fi/erix/kernel/issues/31) preserves three original host failures and one valid-stack control at unchanged production sources; the same four controls pass against the [signed correction](https://git.erikinkinen.fi/erix/kernel/commit/5bad7a1285089a20ee6425e0335ed3a5e96f7e29). Ordinary anonymous stack materialization now rejects addresses outside the existing user domain, and direct bootstrap writes require retained writable registered backing. Initial registers have Kernel-owned storage; stack preparation preserves the synthetic return slot, complete admission, startup arguments and rollback. The obsolete saved-frame user overlay and directory scan are removed. Complete external start-context admission and the separate bootstrap code/stack overlay remain distinct work. Four strict Kernel configurations pass 807/831 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The [catalog](https://git.erikinkinen.fi/erix/integration/commit/483da1e42cbdc79b56dea6fb0806980a128787b8) passes all 172 maintained helpers. Six native executions satisfy seven original contracts: lifetime, invocation, mapping and sparse, both allocator checks and ordinary exec-successor across all 73 components. The new witness checks all original initial register words after two real user stack mutations and before ordinary syscall capture. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The [manual](https://git.erikinkinen.fi/erix/docs/commit/57bdb2811e2a90d0121ff6de6ab58ff797806b78) passes 45 tests, 2,433 pages and four changed-page visual reviews without final warnings or overflow. Publication CI: Kernel [656](https://git.erikinkinen.fi/erix/kernel/actions/runs/656)/[657](https://git.erikinkinen.fi/erix/kernel/actions/runs/657) and Docs [1021](https://git.erikinkinen.fi/erix/docs/actions/runs/1021)/[1022](https://git.erikinkinen.fi/erix/docs/actions/runs/1022) pass. Eight complete original logs (1,600,791 bytes) confirm Kernel 807/831 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration [1737](https://git.erikinkinen.fi/erix/integration/actions/runs/1737)/[1738](https://git.erikinkinen.fi/erix/integration/actions/runs/1738) remains queued and has no completed acceptance. Earlier [ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. Static audits cover 3,201 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, CPU residency, live-root reclamation and complete semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven.

erikinkinen added the

security

performance

phase-6

enhancement

labels 2026-09-12 07:56:25 +02:00

erikinkinen referenced this issue from erix/posixd 2026-09-12 07:56:26 +02:00

[FEATURE] Implement real fork, exec, wait, signals and terminal process groups #3

erikinkinen referenced this issue from erix/lib-cstd 2026-09-12 07:56:26 +02:00

[FEATURE] Implement the C runtime and libc required by the admitted toolchain #1

erikinkinen referenced this issue from erix/dynlinkd 2026-09-12 07:56:28 +02:00

[FEATURE] Load compatibility ELF, TLS, constructors and declared runtime modules safely #1

erikinkinen referenced this issue from erix/integration 2026-09-12 07:56:29 +02:00

[FEATURE] Run the complete admitted compiler and development toolchain inside EriX #7

erikinkinen referenced this issue from erix/integration 2026-09-12 07:56:30 +02:00

[FEATURE] Demonstrate two complete generations of EriX built inside EriX #9

erikinkinen referenced this issue from erix/integration 2026-09-12 07:56:30 +02:00

[FEATURE] Close final security, documentation, CI and self-hosting acceptance #10

erikinkinen changed title from [FEATURE] [P08] Supply authorized memory, TLS, threads and race-free blocking for runtimes to [FEATURE] Supply authorized memory, TLS, threads and race-free blocking for runtimes 2026-09-12 08:02:04 +02:00

erikinkinen referenced this issue 2026-09-14 13:41:07 +02:00

WIP: Enforce native lifetime and staged construction authority #3

erikinkinen referenced this issue 2026-09-14 13:56:58 +02:00

[FEATURE] Own native IPC requests, results and completion custody #11

erikinkinen referenced this issue 2026-09-15 05:18:38 +02:00

[BUG] Endpoint transfer fixtures inherit a previous non-root process #13

erikinkinen referenced this issue from erix/lib-ipc 2026-09-15 12:49:11 +02:00

WIP: Define native authority and staged construction contracts #2

erikinkinen referenced this issue from erix/lib-capabi 2026-09-15 12:49:13 +02:00

WIP: Align capability layouts and staged authority contracts #2

erikinkinen referenced this issue from erix/docs 2026-09-15 12:49:15 +02:00

WIP: Document native authority and verify workspace and command evidence #4

erikinkinen referenced this issue from erix/integration 2026-09-15 12:54:08 +02:00

WIP: Coordinate native authority, shell workspace and source transport #12

erikinkinen referenced this issue from erix/lib-bootstrap 2026-09-15 14:20:38 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-interrupt 2026-09-15 14:20:39 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-service 2026-09-15 14:20:40 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-time 2026-09-15 14:20:41 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-log 2026-09-15 14:20:42 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/procd 2026-09-15 14:20:43 +02:00

WIP: Guard mediator construction and Launchd admission #2

erikinkinen added the

refactor

label 2026-09-17 12:55:11 +02:00

erikinkinen referenced this issue from erix/integration 2026-09-17 13:25:30 +02:00

[BUG] Standalone kernel packaging reads an unrelated shell authority catalog #59

erikinkinen referenced this issue 2026-09-17 13:34:18 +02:00

[BUG] Query canary fixture assumes identical direct and scheduled entry stacks #16

erikinkinen referenced this issue from erix/docs 2026-09-17 13:54:12 +02:00

[BUG] Detailed syscall reference marks owned invocation selectors as unassigned #9

erikinkinen referenced this issue 2026-09-17 18:42:05 +02:00

[BUG] VSpace fixtures inherit a previous private process #17

erikinkinen referenced this issue from erix/integration 2026-09-19 11:36:52 +02:00

[FEATURE] Track Phase 6 POSIX compatibility and full EriX self-hosting #65

erikinkinen referenced this issue 2026-09-19 15:39:29 +02:00

[FEATURE] Bind staged child cleanup to its native supervisor lifetime #19

erikinkinen referenced this issue 2026-09-21 23:45:23 +02:00

[FEATURE] Own hardware page-table roots for native address-space switching #22

erikinkinen referenced this issue 2026-09-22 03:37:56 +02:00

[FEATURE] Audit authority, code quality and documentation in kernel #2

erikinkinen referenced this issue from erix/integration 2026-09-22 03:37:59 +02:00

[FEATURE] Freeze the complete source, build, ABI and self-hosting inventory #1

erikinkinen referenced this issue from erix/docs 2026-09-22 03:38:04 +02:00

WIP: Document native authority and verify workspace and command evidence #4

erikinkinen referenced this issue 2026-09-22 04:31:30 +02:00

[BUG] Reused device-frame slots authorize protection of unrelated backing #27

erikinkinen referenced this issue 2026-09-22 08:32:10 +02:00

[BUG] Huge-leaf translation and splitting confuse PAT with physical address bits #30

erikinkinen referenced this issue 2026-09-22 09:18:29 +02:00

[BUG] Initial stack materialization accepts addresses outside the ordinary user domain #31

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

feature/posix-compat

feature/native-cli

feature/phase-4-audit

feature/dynlink

feature/program-loader

feature/e2fs-fat

feature/block-devices

feature/vfs

feature/centralized-process-authority

No results found.

Labels

Clear labels

  

bug

Something is not working

  

ci

  

docs

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

performance

Measured performance profiling, bottleneck analysis, and regression budgets.

  

phase-6

Phase 6: POSIX compatibility, full EriX self-hosting, and its required audits and validation.

  

question

More information is needed

  

refactor

Code cleanup, removal of obsolete paths, and structural improvements preserving behavior.

  

security

  

wontfix

This won't be fixed

No labels

bug

ci

docs

duplicate

enhancement

help wanted

invalid

performance

phase-6

question

refactor

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

erix/kernel#1

No description provided.