[FEATURE] Audit authority, code quality and documentation in kernel #2

New issue

Open

opened 2026-09-12 07:57:38 +02:00 by erikinkinen · 0 comments

erikinkinen commented 2026-09-12 07:57:38 +02:00

Owner

Copy link

Problem and motivation

This issue tracks continuous Phase 6 audit closure for kernel. Implement capability enforcement, IPC, memory objects, scheduling, interrupt entry and the minimal boot/runtime hardware boundary.

An initial inventory is not a security or documentation closure claim. Evidence must follow each changed boundary through final heads, with priority security, reliability, then performance.

Proposed behavior and scope

Current inventory: 3 Cargo targets (1 bin, 1 lib, 1 standalone host test); manifests: Cargo.toml. Include explicit and automatically discovered targets, supported features and target-specific configurations.

Review user/kernel and bootstrap/runtime transitions, syscall validation, object aliases, generation reuse and SMP publication/teardown. Keep compatibility policy in userspace and separate hardware/ABI bounds from allocation policy.

The original 1,000-line runtime-call fixture has been split into 345-line transport and 670-line scheduling files. Current complete-source size evidence and remaining audit work are tracked in the linked WIP PR.

Authority, security and reliability

Maintain a finding register with public finding references, exact revisions, invariants, reproduction, owners, regression tests and closure evidence. Publish only non-sensitive status here; suspected vulnerabilities follow SECURITY.md. Each dimension below needs its own result and rationale; an absent daemon or current Rust target is not a blanket exemption.

Acceptance criteria

• Record origin, recipient, object, operations, delegation ceiling, lifetime and aliases for each relevant capability or caller-supplied authority-bearing value.
• Audit ambient discovery/selectors, cwd/PATH/environment, numeric identities, inherited routes and host fallbacks; require explicit authorized intake.
• Account for residual authority after success, error, cancellation, timeout, restart, failed transfer and teardown, including fork/exec where implemented.
• Remove unnecessary endpoints, broad rights, duplicate aliases, provider/admin grants and debug routes.
• Exercise stale generations, replay, pending replies, forged descriptive identity and object/path resolution races at the owned boundary.
• Prove independent cleanup attempts and caller-specific error precedence; quarantine or terminate when retained authority cannot be accounted for.
• Review unsafe/FFI/parser/arithmetic/lifetime/lock/publication invariants and add adversarial coverage where practical.
• Inventory obsolete APIs, wrappers, fallback/dead paths and duplicate validators with their maintained callers.
• Migrate callers and delete deprecated contracts/shims in a coherent signed revision graph; reject retired input versions where relevant.
• Classify each size/count/depth/time bound as ABI, hardware, explicit resource policy or accidental limitation.
• Test beyond removed boundaries and at allocation/ABI limits while preserving exhaustion errors, denial-of-service controls and bounded waits.
• Keep every tracked authored code/test/script/workflow file below 1000 physical lines through thematic refactoring.
• Run the deterministic tracked-source size gate, covering executable fixtures/generators and excluding only genuine non-code data or external payloads.
• Audit production/test feature and symbol separation, including this repository's effect on rootd test orchestration.
• Supply changes affecting rootd semantic surface to the maintained same-toolchain baseline; record a justified component-specific applicability result.
• Check bootstrap ownership and development/release authority parity at this repository's producer/consumer boundary.
• Use maintained integration#3 profiler evidence before optimizing; preserve live access checks, ownership and success criteria.
• Audit build/CI inputs, secret handling, private outputs, symlink containment, deletion, subprocess bounds, warnings and host dependencies.
• meaningful public/private inline documentation, crate/target missing_docs enforcement without blanket allowances or hidden-API escapes, warning-denied private-item rustdoc and an undocumented-public-API negative gate.
• Validation: Run cargo fmt --all -- --check, strict Clippy, unit/doctests and warning-denied builds/rustdoc for every owned crate/target under default and all valid feature, freestanding/host, SMP and profile combinations; test mutually exclusive combinations separately. Add focused VM regressions for runtime behavior and observe the older catalog and unit tests at the exact published heads.
• Documentation: update applicable README/ARCHITECTURE/ROADMAP in meta's canonical format and affected technical-manual TeX/API references; keep README evergreen and shared governance byte-identical to meta.
• Evidence: record exact source/dependency revisions, commands, configurations, real exit status, CI run URLs and results; repeat the audit on final heads and obtain independent review of security closures. No skipped/pending/predecessor result counts as a pass.

Alternatives and tradeoffs

Use cohesive local refactoring or a justified shared extraction only after identifying real common semantics and authority boundaries. Remove superseded paths after preserving maintained coverage. Profile before optimization; document unavoidable ABI/hardware limits and explicit quotas rather than weakening security for speed.

Validation checkpoint — 14 September 2026: Signed feature e6bea362f9199230bf84269b1a8da6bd8da6470d carries original signed maintenance ancestor 2f85d8a0e2e502ff1126ba40263296bc72f4635a. The ordinary and lifetime graphs preserve their respective IPC/capability selections. All strict default/all development/release checks pass; the final fixture matrix passes 610/634 units plus one standalone on the feature graph and 586/610 units on the maintenance graph, with three pre-existing ignores. CI 532 and 533 pass with four complete logs, 624,386 bytes and zero warning candidates. Integration 7cc0593e101b2e0ca42f24d4fa189dd96cb1455c passes the actual native distinct-argument/lifetime VM in 20.204185 seconds and the unchanged ordinary Rootd IPC-framing VM in 45.264436 seconds, with empty stderr. These are host build/run durations, not guest performance results. Both signed images are byte-identical to the preceding accepted transition images. Realm producer adoption and full guest builds remain open.

Allocator validation checkpoint — 14 September 2026: Signed Kernel feature ae0f3ab918abec71e809c3b4a68e54ec1c475e0d carries original signed maintenance ancestor 41b57a7a67e6fee71f5708b55ab386b72366b8d8. Both use the same CSpace allocator with their respective original dependency graphs. The feature tree equals the previously validated e5198f8f3ce0dbc1ee3658cdd21bf10f0beed63c tree. Strict development/release default/all checks pass: 613/637 units plus two standalone tests on the feature graph, 589/613 plus one standalone on maintenance, with three existing ignores. All eight feature and six maintenance freestanding builds pass without warnings. Kernel CI 536 and 537 pass with four complete logs, 643,867 bytes and zero warnings. The actual allocator rejection control fails the original signed library with next ID 5 instead of 4; the corrected test covers repeated failed growth, initialization failure and allocation-free reuse. ID exhaustion, duplicate destruction, occupied-record preservation and clean reuse pass. The same three-sample host profile reduces 32,768 reuse cycles at 32,768 retained spaces from 643.094176 ms to 1.172569 ms; host elapsed only, with no exclusive-CPU or guest timing claim. Signed Integration a869a81eb406a4f027a2b5db573b6330ca114d94 selects both final source graphs and passes all 159 helper suites plus strict 320/321-unit development/release default/all Rust matrices. The final ordinary Rootd IPC-framing VM passes in 45.832335 seconds and the native distinct-argument/lifetime VM passes in 13.026853 seconds, under unchanged exit/marker/deadline rules with empty QEMU stderr. These are host build-and-run durations. The ordinary image is 27,934,720 bytes, SHA256 2a187127696d569ae5c627d9c1d154ad53c024e98d9a181dbb6006790f01a0cc; the lifetime image is 2,142,208 bytes, SHA256 8fa4c7512a5916a51ba956b1e55c84ac2945c2580ff9556c99c27cbaa6e3321d. Its final image, ELF and EFI bytes equal the preceding validated feature-tree artifacts. Older full CI 1605/1606 is still running; new 1607/1608 is waiting. No full-catalog pass, realm implementation or full guest build is claimed.

Endpoint construction checkpoint — 14 September 2026: Signed Kernel f6489ff3f8fea88a26dad232cc45d0deb33fa30e carries original signed ordinary ancestor c7f8952c45a60ca451466d9731207c0a9a6a9a82. Its feature tree equals the validated fc3e1d5ea095fd17a9629a87d05ddad0863435ca tree. Copy, attenuated copy and move reject unbound endpoint metadata before destination installation; the original control materializes an endpoint and fails the new invariant. Explicit construction then preserves exact object identity and SEND-only rights. Positive fixtures now construct their intended endpoint kinds without widening rights or changing assertions. Strict development/release default/all checks pass 614/638 units plus two standalone tests on feature, 590/614 plus one on ordinary, with three existing ignores. Eight feature and six ordinary freestanding builds pass without warnings. Kernel CI 540/541 passes: four complete logs, 644,652 bytes, zero warnings. Earlier same-tree CI 538/539 also passes. The focused owned-invocation design defines actual caller/server generations, exact receiver registration, retained SEND carrier lineage, request/result byte and capability custody, fresh collection, exactly-once grants, invalidated deliveries, draining and terminal cleanup. It enumerates cumulative type-specific binding reservations and no-allocation rollback obligations. The owned transport remains unimplemented; no new opcode, wire layout or escrow representation is assigned. This is a deliberate construction boundary cleanup, not a demonstrated vulnerability finding.

Completed CI checkpoint — 15 September 2026: Signed Integration a869a81eb406a4f027a2b5db573b6330ca114d94 passes both 1607/1608; signed endpoint-construction checkpoint 989d44d604d07c4c9bcc23264912bdf2076b99eb passes both 1609/1610. Each run reports all 486 distinct VM scenarios passing, followed by the actual native lifetime scenario, physical/serial interactive checks and all four console modes. Rust and Markdown pass. The two six-log cohorts contain 26,769,289 and 26,769,316 bytes respectively, with zero warning candidates. The previously observed intermittent quota timeout remains documented without a causal-fix claim. These results establish the selected source checkpoints, not owned invocation transport, complete authority closure or either full in-EriX build generation.

Native transfer preparation checkpoint — 15 September 2026: Signed Kernel e91f47198748d8ce52fc7361f389836a6bc2a206 carries original signed ordinary ancestor d2438c7e56c964a9c16720586cf718ec11e7cc0a. The feature tree is byte-identical to validated d58efd8df18d63e5b97228c066f6d7623202e6d4. Complete destination slot, rollback, typed binding and revocation-lineage storage is reserved before native capability mutation; reservations accumulate across aliases of the same object. Preparation failure changes no capability inventory or unique-grant custody. Commit and pre-delivery rollback require no allocation under existing BSP serialization. Five actual-object controls cover a 62-capability mixed batch, real allocator rejection, exact backing and grant scope, nested revocation and same-CSpace transfer. The ordinary grant move now uses the ID-only lookup without cloning descendants or adopting the later lifetime representation. Independent strict development/release default/all checks pass 619/643 units plus two standalone tests on feature, and 595/619 plus one on ordinary, with three existing ignores. Eight feature and six ordinary freestanding builds pass without warnings. Kernel CI 544/545 passes: four complete logs, 649,206 bytes, zero warnings. Same-tree CI 542/543 also passes. This implements preparation for the current IPC path. Its private records cannot survive userspace scheduling and own no retained source authority. Persistent request/result bytes and capability custody, exact delivery state and terminal hooks remain unimplemented under Kernel issue 11. No opcode, wire record, bootstrap-frame escrow eligibility or application-cancellation semantics are assigned. The renewed contributor-source inventory covers 76 repositories and 2,898 code files, all below 1,000 lines. All 92 library/binary roots and 62 standalone Cargo roots have direct missing_docs gates. These static checks do not establish whole-codebase authority or private-item documentation closure.

Native invocation custody checkpoint — 15 September 2026: Signed Kernel 2e4deb7351184d3fe4517ce8d5d59eb9960f28ad carries the native invocation core from b1b632446ff5762761b5aee3fbdba320f5efff42 and the deterministic endpoint-fixture correction. Native Rust entry points implement explicit receiver registration, submit, claim, complete, fresh collection, progress, caller release and cleanup-only delivery relinquishment. They derive actual TCB/stage/CSpace identity, retain real request/result bytes and capabilities in a private CSpace, and keep a SEND-only carrier alias in its original revocation lineage. No CNode or private storage location escapes. Accepted results survive ordinary server death; repeated collection returns original descriptive receipts without reinstalling authority. Exact binding removal, process retirement and syscall-return hooks retain draining owners until native disposition and participant acknowledgements complete. Twelve actual-object controls cover caller/receiver scope, source-buffer mutation, duplicate destinations, moved unique grants and reused source slots, actual admission allocation rejection, six native object types, revocation, process death, replay and FIFO after registry vacancy reuse. The original draft FIFO control fails and the corrected selector passes. The disposal control proves actual guard revocation makes zero allocation requests; it does not prove a reachable backend disposal failure. Strict default/all development/release matrices pass 631/655 units plus two standalone tests, with three existing ignored experiments, private rustdoc, target Clippy and eight warning-free freestanding builds. Kernel issue 13 retains CI 546/547: both fail the same older endpoint fixture at setup with 630 passed, one failed and three ignored. Four related fixtures reset CSpaces without resetting preceding non-root TCB attribution. All four deterministic original controls fail with CspaceSlotMissing; resetting attribution before CSpace replacement makes them pass without changing any message, transfer or backpressure assertion. The correction is confined to test setup and thematic test organization; production behavior is unchanged. Corrected signed-head Kernel CI 548/549 and Docs 859/860 pass. All 8 complete logs total 1,413,966 bytes, with zero final warnings. The terminal cohort is classified. The syscall wire adapter, fresh userspace buffer/fault/overlap validation, authenticated caller-origin delivery fields and actual CPL3 owned-invocation peers remain unimplemented. Reachable backend disposal-failure coverage, sustained invocation-workload profiling, realm producer adoption, whole-codebase authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire record is assigned; the existing CALL/RECV/REPLY ABI is unchanged. The refreshed contributor-source inventory covers 76 repositories, 74 Cargo manifests and 2,913 code files, all below 1,000 physical lines. All 92 library/binary roots and 62 standalone Cargo roots have direct missing_docs gates. These static checks do not establish full authority or private-item documentation closure.

Authenticated delivery-origin checkpoint — 15 September 2026: Signed Kernel 69c5e1fe5ffa72522ff6611d8b2c0471e865115e adds CallerOrigin to each successful native request delivery. The process ID and staged generation come from the retained submitting actor in the native CREATE_STAGED_PROCESS identity domain; payload fields, receiving identity and equal numeric carrier slots cannot replace them. The pair exposes no private CSpace, grants no authority and promises no later liveness. Services must correlate it with exact retained process/realm ownership and revalidate after blocking effects. A two-submitter control sends mutually impersonating payloads through the same real carrier and validates both actual origins plus independent caller-local selector refusal. All 13 native custody controls pass. Strict default/all development/release matrices pass 632/656 units plus two standalone tests, with three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. Kernel CI 550/551 and Docs 861/862 pass. All eight complete logs total 1,414,891 bytes, with zero final warnings; the cohort is classified and stopped. The separate earlier fixture correction remains closed in Kernel issue 13, preserving original CI 546/547 and corrected 548/549. Sustained invocation-workload profiling, syscall wire and fresh-buffer/fault/overlap validation, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm producer adoption, whole authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire layout is assigned. Native progress and cleanup still do not certify application cancellation. The renewed inventory covers 76 repositories, 74 Cargo manifests and 2,914 code files below 1,000 physical lines. All 92 library/binary roots and 62 standalone roots have direct missing_docs gates. Source hashes, clean feature branches, signatures and remote equality are verified; these static gates do not close full authority or private-item documentation audits.

Native invocation profiling baseline — 15 September 2026: Signed Kernel 6cb703e1ed8b9de0d29a37189cd914cd501e732e provides an actual-object host workload for queued progress, collected progress, descriptive result reads and complete request/result cycles. Signed Integration f3e4359b34cb8f7db732fbf38823f722553c86d4 adds bounded capture, raw-evidence report verification and equivalent comparisons. Every sample checks exact bytes and SEND capability bindings, authenticated origin, foreign selection, duplicate completion refusal, FIFO position reuse, one-time collection and final invocation disposal. Source and executable bytes are observed against explicit original identities; compiler/host relationships remain declarations. Workload children and source Git reads receive minimal environments; capture owns memory, time, output and process cleanup. Completion is published only after deadline teardown succeeds. The operator guide and signed Docs 644273a0edd91e4c38dcd4418d6ae1119ff1f10b describe these boundaries. Kernel strict default/all development/release checks pass 632/656 units plus three standalone controls, three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. Integration passes all 161 helper commands, including 19 profiler controls and nine source-provenance controls, plus fresh strict 320/321-unit Rust matrices, private rustdoc and warning-free target builds. Four original socket-fixture failures are retained and attributed to the selected temporary directory exceeding the host Unix-socket path domain; a shorter explicit private directory passes the same fixtures. Docs passes 45 tests and renders 2,345 pages with zero final warnings; 427,592 word boxes fit page bounds and changed pages 2284/2285 pass visual review. Kernel CI 552/553 and Docs CI 863/864 pass; eight complete logs total 1,431,762 bytes with zero final warnings after manual reference convergence. The original signed Kernel baseline retains 48 measured samples and 16 checked warmups: four modes, populations 0/32/128/512, 256 operations per sample, three measured repetitions and one warmup. A single selected host CPU is used after local build/test work completes; external host scheduling is not isolated. At population 512, operation medians are 117,577.723 ns for queued progress, 8,927.977 ns for collected progress, 9,124.098 ns for descriptive reads and 1,167,847.016 ns for complete cycles. At population zero they are 223.328, 166.199, 213.137 and 4,556.867 ns respectively. Every raw sample, process disposition and final native cleanup passes. Timings include fixed semantic checks; no cost is subtracted and no ratio is a pass threshold. Source review identifies repeated carrier-binding scans during full registry refresh and a registry-lock acquisition for every inactive settlement position. The next bounded change will retain only non-authoritative numeric search positions: every fast path must still check current capability type/rights, endpoint identity/in-use state and exact CSpace/slot binding, with complete lookup on a stale hint. Existing revocation and terminal hooks remain authoritative. Settlement may scan for the next draining owner under one lock while retaining the original pass boundary, increasing index order, busy-position exclusion and allocation-free stack-owner return; disposal remains outside the table lock. Original workload bytes and sample policy must remain unchanged for comparison. No Kernel performance algorithm has changed in this baseline. Native syscall adapters, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The 76-repository inventory has 2,923 code files below 1,000 lines and 155 direct missing_docs crate-root gates; this does not close the semantic audits.

Measured native invocation lookup refinement — 15 September 2026: Signed Kernel 8349d68636382cc7e25a3347f5f1df216554203a retains only numeric carrier-search positions. Every use rechecks the actual CSpace capability type/rights, live endpoint identity and exact binding; stale positions take the complete search path. No successful authorization, capability or reference is cached. Draining scans fix their boundary on the first poll, visit each position at most once, skip busy stack owners and return exclusive custody after unlocking. Native disposal and first-failure retention preserve their existing semantics. Signed Integration 108501cf7ec20f05dd3d62ea401ea8adad6c6e9c selects this Kernel in its isolated native catalog, and signed Docs f10a1d375a326543ec0adda4569bc7cb4faca9b6 documents the invariants. The existing syscall ABI and ordinary image catalog are unchanged. All 15 actual-object native controls pass, including real alias compaction, rights/type/object replacement, busy ownership and allocation-free settlement. The unchanged four-mode workload control also passes. Full strict default/all development/release Kernel matrices pass 634/658 units plus three standalone controls, with three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. The existing native lifetime and entry-argument VM passes unchanged oracles in 21.978041 seconds of host build-and-run time, with clean teardown and empty QEMU stderr. Its signed boot image is 2,207,744 bytes, SHA-256 4030cdfb8a13c000ff4716ecdc5203cb46273d6117a282f7375f25dccbbeedc9. Exact unchanged Integration Rust/helper bytes preserve the preceding strict 320/321-unit matrices and all 161 helper-command results; changed catalog/scenario policies pass. Docs passes all 45 tests and a complete 2,345-page render with zero final warnings, 427,679 bounded word boxes and visual review of page 145 plus continuation page 146. The original signed Kernel 6cb703e1ed8b9de0d29a37189cd914cd501e732e and the new signed Kernel use byte-identical workload sources, the same selected CPU/toolchain/context and explicit limits, distinct source targets, four modes, populations 0/32/128/512 and 256 operations per sample. Each capture retains 48 measured samples and 16 warmups; every sample passes actual semantic and native/process-cleanup checks. At population 512, median queued-progress cost changes from 117.578 to 37.673 microseconds (3.12x observed ratio), and full-cycle cost from 1167.847 to 443.055 microseconds (2.64x). Collected progress changes from 8.928 to 6.015 microseconds and descriptive reads from 9.124 to 6.212 microseconds. Timings include fixed checks, with no subtracted overhead or timing-ratio pass gate. No managed build/test workload runs concurrently during capture; external host scheduling remains unisolated. These are host operation wall times, not guest startup/build acceptance or a statistical guarantee. Kernel CI 554/555 succeeds; four complete logs total 679,280 bytes with no warnings, and its completed cohort is stopped. Docs CI 865/866 succeeds at observation three; four complete logs total 754,424 bytes, all 45 tests pass and each manual has 2,345 pages. Its normal reference passes report 32/1/0 warnings, with zero final warnings and no box diagnostics. The completed Docs cohort is stopped. Integration CI 1619/1620 is waiting at its first observation. Older Integration 1613/1614 is running; 1615/1616 and 1617/1618 are waiting. Accepted older Integration 1611/1612 passes all 486 catalog scenarios and later probes with complete warning-free logs. This does not establish the intermittent quota cause tracked in Integration issue 18. Current full-suite CI remains required; stopped cohorts are not polled again. Owned syscall wire adapters, actual owned CPL3 peers, fresh-buffer validation, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The refreshed 76-repository inventory has 2,924 code files below 1,000 lines and 155 direct missing_docs crate-root gates; those checks do not close whole-codebase semantic audits.

Owned invocation wire and native acceptance — 15 September 2026: Signed Kernel 5f497adaefa526108a0439e0e071717dddb85334, shared IPC de968da19898bef532ddb3b5974bb9562f51dee5, capability ABI a001a26f0eb3aebec3f5fd02a28d98f1bc23f8a0 and Integration 9030b217c490db6ad3ec60a799cb025eccbfcdb1 implement and exercise the immediate owned invocation boundary. The allocation-free shared codecs and shim preserve exact return metadata, including a retained draining owner on failed submission. The Kernel checks fresh complete user mappings and packet framing under one lifecycle guard before native effects. No user pointer or caller-selected identity is retained. Destination capacity and descriptive receipt capacity are independent; spare capacity acquires no authority and repeated collection cannot duplicate transfers. Existing numeric binding hints still recheck live capabilities on every use. The real three-process CPL3 scenario passes all eight operations, full-span pointer/rights/overflow/reserved-field rejection, actual returned selectors, payload/capability/origin checks, collection after server exit and repeated receipts. A second request rejects premature relinquishment, enters draining on caller release and retires only after the exact server acknowledgment. Current signed owned and unchanged older lifetime images are each 2,232,320 bytes, with SHA-256 588c6097c57ebd2ed92e0f0b76f2b1ad6b82630b4a0da272ee98e218eb8e333d and 8f9026aaefd2c5a745e35467ac01c71789c5f469f9cd42a477f87818747ee673 respectively. Both runs have clean teardown and empty QEMU stderr. Ordinary images contain neither diagnostic hook. Strict default/all development/release host, freestanding and rustdoc matrices pass: IPC 368 units, shim 20, capability ABI 191, Kernel 642/666 and Integration 320/321. Existing ignores remain one shim and three Kernel tests. All 162 maintained Integration helper commands pass; three prior correct concurrent-run lock refusals are retained and their sequential checks pass on unchanged executable inputs. Docs 46da7a4cb4d38a2bea5b5491a68f51f33e4b4305 publishes the normative register/packet contract and regenerates the three affected API references from original signed revisions. All 45 documentation tests pass. The complete 2,363-page manual has zero final warnings, 430,365 word boxes within page bounds and reviewed changed ABI/API pages. Shared IPC CI 337/338 and capability ABI CI 214/215 pass with eight complete warning-free logs. Both Kernel revisions pass CI 556/557 and 558/559 with eight complete warning-free logs. Those cohorts are stopped. Current Docs CI 867/868 passes at observation four; four complete logs total 758,328 bytes. Both 2,363-page manuals pass all 45 tests, report normal reference-pass warnings of 32/1/0, and finish with zero warnings or box diagnostics. Its cohort is stopped. Current full Integration 1621/1622 is waiting. Older full Integration 1613/1614 now passes all 486 catalog scenarios and later native/console probes, with six complete warning-free logs; its cohort is stopped. Older 1615/1616 is running, and 1617/1618 plus 1619/1620 are waiting. Current full-suite acceptance remains open, as does the intermittent quota cause in Integration issue 18. This checkpoint supersedes the earlier pending wire/CPL3/manual status. Reachable backend disposal-failure coverage, broader revocation/generation-reuse scenarios, producer adoption, realm runtime, complete authority/inline-documentation audits and both full EriX-in-EriX build generations remain open. The current inventory checks 76 repositories, 2,943 code files below 1,000 lines and 157 crate roots with direct missing_docs gates; it does not establish semantic audit closure. No complete guest build or guest performance result is claimed.

Process-bound native acceptance — 15 September 2026: Signed Kernel 60da5858d7198185efd103f0e91e5ac2e0b63e67 implements control operation 52, checking the actual moved install grant against expected process/generation with exact rights, including zero, under existing endpoint policies. Signed Procd f1105706cc19ed024a6cca79a29abc57c90c6661 uses this operation in its actual ordinary launch-description producer while retaining the narrow SEND receipt, pending state and exact failure cleanup. IPC c453b697b8cdb9cc1c36f1ad89ff868648190025, capability ABI fe8d558253ad01301b99554e20d287c4ea35bb1d and five aligned helper commits preserve original Git/type identity. Integration 58c925c564b69bebce8df6f3e75a9312824e18c4 passes the expanded lifetime CPL3 scenario with thirteen actual control calls, user-side reply checks, two staged children and full added-custody disposal. The corrected lifetime image SHA-256 is 8e6a9e8f68b90cc1ede61300958cec122b82a7c6dfd6318a51e40fefc7ba166e; the unchanged owned-invocation scenario also passes with image SHA-256 b76a380d3cd6b03b0ff61a3b626ace0667679920684ad7356a1c3a36e2224953. Both have clean teardown and empty QEMU stderr. The initial fixture setup-order failure is retained and corrected in Kernel issue #14. All strict default/all development/release matrices pass: IPC 371, shim 20, capability ABI 191, Kernel 648/672 including standalone controls, Procd 227/232 including auxiliary binaries, and Integration 320/321 tests. Existing native-only ignores are unchanged. Procd passes forty native binary builds with repository linker scripts. All 162 Integration helpers pass after updating the exact policy assertion to require the new marker; its initial mismatch remains recorded. Docs b0fcf0f43af2af741d520a0b1373cc346e08863c updates the native wire/ownership contract, operation registry, Procd boundary and three generated shared APIs. All 45 tests and the complete 2,367-page manual pass, with zero final warnings, 431,138 word boxes within page bounds and four reviewed protocol/API pages. Current IPC 339/340, capability ABI 216/217, Kernel 560/561 and 562/563, Procd 266/267, Docs 869/870 and all five helper push/review CIs pass with complete classified logs and no final warnings. Those component cohorts are stopped. Current full Integration 1623/1624 waits at observation 01. Older full Integration 1615/1616 is running at observation 11; 1617/1618, 1619/1620 and 1621/1622 wait at observations 09, 07 and 04. No pending full suite is counted as passed. Typed realm bootstrap, mediator startup/readiness/configuration/seal, complete consumer image adoption, fair terminal/provider retirement, broader native disposal failures and both full EriX-in-EriX build generations remain open. The new inventory covers 76 repositories, 2,950 code files below 1,000 lines and 158 direct missing_docs crate-root gates; complete inline documentation and whole-codebase authority closure remain open. Prior performance measurements retain their original signed source identities; this checkpoint claims no new timing or guest performance result.

Native permission checkpoint — 16 September 2026: signed Kernel 32c70109fe7663440aa56de6a49975accc1f0057 carries explicit live execution permission through single-page, batch and permission-only mappings. Data and construction aliases remain non-executable; ancestor promotion and splitting preserve neighbouring restrictions. Processor activation validates and enables execute-disable support on the bootstrap and application processors. Seven independent controls accompany the repair. Strict default/all-feature development/release suites pass 666/690 kernel unit tests plus two external controls per selection, retaining three existing ignores. Host/native Clippy, private rustdoc, formatting and ten native builds pass without warnings.

Separate one-CPU and two-CPU diagnostic VMs pass the unchanged native command sequence. A read-only hardware observer matches all 233,755 selected coreutils executable bytes, verifies CPL3 and enabled paging/execute-disable state, and confirms both observed RELRO pages are user-readable, read-only and non-executable; the current stack is user-writable and non-executable. Both processors report execute-disable enabled. This is an exact process-entry/table observation, not an injected instruction-fault test or whole-system permission proof. The diagnostic image SHA-256 is 8c3c24639e8e1ca8c4f2ad4e485323abf32ec07408241c3e4fa9713f6e07e812.

Signed Docs d221e725c2543316680e63fc5e8314ce0fe3bdf1 documents the mapping and processor contracts. All 45 documentation tests and canonical checks pass; the 2,375-page manual has 434,308 in-bounds word boxes and zero final warnings, with three changed pages visually reviewed. Exported API snapshots are unchanged. Kernel CI 574/575 passes with four complete warning-free logs (708,112 bytes), including existing optimized workload examples. Docs CI 891/892 passes all four complete logs (762,176 bytes), with 45 tests per manual job and zero final warnings. The maintained permission VM regression, full frame proof, whole-codebase authority/documentation review, runnable realms and both complete guest build generations remain open.

Diagnostic lifetime checkpoint — 17 September 2026: Signed fb4e134f2130e9f60608bad0ecc02d8a278887a8 removes the obsolete RTC post-exit observer, three retained trace values and four lifecycle hooks. The remaining diagnostic contract uses scalar metadata and synchronous current-operation observations. Four strict matrices pass 671/695 units plus both standalone controls, with the three existing ignored experiments; six trace-enabled native builds and binary Clippy selections pass without warnings. Existing invocation/lifetime VM controls pass on the exact candidate under one explicit private trace-feature variation, original 60-second limits and normal stripped-artifact verification. Original current-head CI is pending. The complete syscall memory footprint, ordinary graph adoption and both full guest builds remain open.

VSpace fixture follow-up — 17 September 2026: Original diagnostic-cleanup CI 586 fails and 587 passes; all four complete logs contain zero warnings. Issue #17 tracks deterministic predecessor-attribution failures in the synthetic and mapping fixtures. The correction preserves production authority and all original test assertions, shares explicit test-only attribution setup, and partitions the large mapping suite. Strict corrected matrices are running. Earlier native entry and diagnostic VM results retain their exact source/feature scope.

VSpace fixture CI reconciliation — 17 September 2026: Current signed 28dfaea22796925ca438b4a57175520a8d9e7a8c passes original push CI 588 and PR CI 589. All four complete terminal logs are classified: 712,357 bytes and zero warning candidates. Both workflows retain the named regression controls, 671 default/695 all-feature unit results and both standalone controls; three existing experiments remain ignored. Local four strict matrices, host/native Clippy, rustdoc, formatting and two native builds also pass without warnings. No production attribution rule or global harness concurrency is changed. Issues #4, #5 and #17 close for their bounded host-fixture corrections, while full source/frame and guest-build acceptance remain open.

Borrowed capture checkpoint — 17 September 2026: signed f2489242be47654342c91ef3f05a2a12cdc15a4b
requires complete initialized frame ownership before native syscall dispatch.
Five new controls cover real allocation rejection, non-dispatch of a requested
capability drop, attribution, layout, stable copies and teardown. Four strict
676/700-unit matrices, both standalone controls, eight native builds/Clippy
selections and two original-budget invocation/lifetime candidates pass without
warnings. Candidate machine bytes and normal packaged stripping are verified;
no general syscall memory guarantee or ordinary-image adoption is claimed.
Original CI 590/591 passes: all four complete logs total 716,126 bytes,
zero warnings, with 676/700 unit results and both standalone controls. Prior CI 588/589 passes completely, closing
bounded fixture issues #4/#5/#17; their original failures remain retained.

VSpace cleanup checkpoint — 17 September 2026: signed 1af934ff48e6d5ad33fd1227c8d1ffdc40c7a06d
records access-withdrawal progress and exact frame-reference consumption while
rejecting ordinary use during retirement. Final process-reference cleanup keeps
its owner until teardown succeeds. Four new host controls, strict 680/704-unit
matrices, both standalone controls, eight native build/Clippy selections and two
original-scenario native candidates pass without warnings. Original CI 592/593 passes with all four complete logs classified and zero
warnings. Surrounding process-cleanup review, ordinary-image adoption
and both complete guest builds remain open.

Process cleanup checkpoint — 17 September 2026: signed c55ee8d6f12957b43c5fd6aaf31c9865656b5ae6
retains private CSpace identity through final release and excludes cleanup
owners from execution and live IPC. Four new owned controls, four strict
684/708-unit matrices, both standalone controls, eight native build/Clippy
selections and two original-budget native candidates pass without warnings.
Final rustdoc-only edits retain explicit candidate scope. Original CI 594/595
passes with four complete logs classified: 722,414 bytes and zero warnings. Preceding VSpace and capture cohorts pass with complete logs.
Ordinary-image, whole-code semantic and both complete guest-build gates remain open.

Tracking and rollout

The isolated native mechanism is accepted at signed Kernel 03e13a784bde08914864267a4e2a6324a22d05c7, selected by signed Integration 4b65755f, with Bootloader e7fa39357a38c21529cccfd16cf3446eb07e8aa5, IPC de6892790de69f40f749c393d24078b287b36175 and capability ABI 984c9f7b0ca910488f8c5b035d2f0cb88f18d304.

Two private CPL3 owners execute actual syscall entry for refusal, consumed custody and repeated-slot denial. Ordinary exit and an independent observer's SEND-only Process endpoint exercise both terminal paths. Unchanged dispatch witnesses require exact generations and returns, cross-CSpace SEND/zero-right descendant absence, preserved independent aliases and exact terminal events. The fixture removes temporary CNode/TCB/VSpace handles before entry and retains its 16 owned code/stack/message pages until shutdown. It changes neither scheduler decisions nor production cleanup. Normal images exclude the fixture.

The native scenario passes the required debug exit, ordered and unique begin/complete markers and all forbidden-marker checks. QEMU stderr is empty. The full build-and-run command takes 19.202361 seconds under the unchanged 60-second VM hard and 45-second silence limits, with one CPU, 1 GiB RAM, TCG and no network; this duration is not a guest performance measurement. The signed 2,142,208-byte image has SHA256 4f021a40264739fef4979da2b0cd4647bde3f76b9dada6816aba6faa3594a797. The 1,552-byte serial log has SHA256 8cc7f9a7250881eddbc056834c46d7437ce944dd4b60c8b96e2c622bad2a85f9. The exact 15-repository graph and all 16 Cargo manifests are validated.

Push CI 528 and PR CI 529 pass for that signed Kernel. Four complete logs total 623,648 bytes with no warning candidates. Each test job passes 609 development-default, 609 release-default and 633 release-all units plus the three standalone executions; three existing experiments remain ignored per unit suite. Local strict default/all-feature development/release host and freestanding checks, private rustdoc, four native/normal builds and symbol exclusion checks pass.

The failed pre-correction images remain retained: Bootloader issue 5 covers the runtime-name rejection; Kernel issue 9 covers markers suppressed by an unrelated Rootd smoke feature. The corrected entry point supplies a typed kernel-only begin/complete reporter without a new service route. Both defects now have exact-source CI and actual VM evidence.

The existing syscall and generated IPC manual is accepted at Docs 28b44183368c512da9c5b804f570ff497ae3b6fc with CI 839/840. The native diagnostic and runtime namespace manual is accepted at signed Docs 17b4d52a9a84e0803746e3a38eb34f070bfb28a4, with green CI 841/842 and zero final warnings. Integration CI 1603/1604 is running, including older VM regressions and the additional diagnostic. Realm producer migration, two-realms/two-clients actual byte I/O, pending-operation/provider completion, the complete authority audit and both full build generations inside EriX remain open.

Current signed 90fb945e291d1f8bb0b838d7ab8deccd1895600c passes push CI 524 and PR CI 525. Four complete logs total 622,018 bytes, with no compiler/lint warning candidates. Each test job passes 609 development-default, 609 release-default and 633 release-all units, plus the standalone allocation regression in all three selections. Three pre-existing experiments remain ignored per unit suite. The deterministic order regression and both originally failing allocator tests pass in all three selections; both Markdown jobs pass. Original CI523 and the deterministic pre-fix failure remain retained in #8. This closes the allocator fixture regression only; native VM, producer, audit and self-hosting gates remain open; the later manual checkpoint is recorded above.

The lifetime mechanism is implemented in signed 7eb9bc32a08a8a91db2b0e88d0d8e5f3174ece3e; current signed 90fb945e291d1f8bb0b838d7ab8deccd1895600c corrects the allocator fixture order regression tracked in #8. The coherent IPC/capability library checkpoints have green CI. The strict lifetime matrix, ten new unit regressions and measured allocation-free deposit/prepared terminal removal pass. Original kernel CI 522 passes/CI 523 fails are retained; the corrected host matrix passes 609/633 units with ordinary concurrency, and its own CI now passes as recorded below. WIP PR #3 retains complete scope. Native VM, manual/API and producer acceptance, broader audit and two-generation guest self-hosting remain open.

Current signed checkpoint a498af7c6535733127ba642d7297c4cedf9f18e2 removes the revoker lineage snapshot and corrects the optimized host fixtures tracked in kernel #6. The final 38-command strict matrix passes on Rust 1.97.1 with original unchanged Git dependencies: 598 default and 622 all-feature unit tests plus one standalone allocation regression in each development/release selection. Three existing experiments remain ignored per unit suite. Formatting, warning-denied host/target Clippy, builds, doctests, private-item rustdoc and twelve coherent freestanding kernel builds pass. Both new optimized CI commands also pass locally with ordinary harness concurrency. Final Markdown/governance/whitespace checks pass; all 2,870 discovered authored code files across the maintained workspace remain below 1,000 lines. This size check does not close the semantic authority or documentation audit. Signed a498af7c6535733127ba642d7297c4cedf9f18e2 passes push CI 520 and PR CI 521, both completed at 06:40:46 UTC on September 14. All four complete logs total 612,242 bytes and match the original workflow/source selection, with no compiler or lint warning candidates. Each test job passes 598 development-default, 598 release-default and 622 release-all-feature unit tests, retaining three pre-existing ignored experiments in each unit suite. The new custody regression and both corrected receive tests pass in all three selections. Both Markdown jobs pass. This component cohort is complete; native VM, startup-performance and self-hosting acceptance remain separate.

• Parent work: erix/integration#2 and erix/docs#1.
• Branch: feature/posix-compat; update linked WIP PRs after coherent signed checkpoints using canonical CONTRIBUTING.md messages.
• Baseline revision: 4330175e27718490f06b93098e95e3c1553cb765; refresh component/dependency heads and their own CI evidence as implementation advances.
• Cross-repository dependencies remain full lowercase commit hashes; update the selected graph deliberately. This issue does not authorize merges, release tags or replacement of published images.

Process-start census correction — 19 September 2026: signed Kernel b762e19d0c16acd605d0f6123994a586cc6fcde1 requires a successful install-grant absence census before process start. An unavailable census returns the existing refusal and preserves the whole staged child and grant state. Hosted controls cover unavailable census, actual grant disposal and malformed-target precedence. Normal bootstrap initializes tracking before admission; production reachability of the injected condition or a native authority escape is not established. Kernel issue 18 uses the canonical bug report and records the original failure and bounded correction.

Four strict Kernel matrices pass 704/728 library tests and two standalone controls each; three existing ignored tests remain ignored. Formatting, strict host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass. Original Kernel CI 606 and 607 pass from all four complete hashed logs (739,843 bytes), without warnings.

Signed Integration b65183ddb93eb4396d4140a002c3727fec42ff87 selects that Kernel and the reconciled Docs 7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d, preserving all other catalog entries and all previously checked orchestration bytes. The matching guarded-preparation VM passes both unique markers and ordinary successful shell exit under unchanged 120-second hard and 45-second progress limits. All 106 artifacts, all 73 original component identities and the actual signed image are verified without warnings. Serial SHA256: a373a8ccd81ac3efbaa492cbf2e1f991f3cc34dcbf23a1435c1c48cd75cd5c1c (55,776 bytes); signed boot-image SHA256: 3b88d37183cf36dcbd5f1105cc0fd86e79aa4489d311300003f3f362c24bcd0a. This remains an unstarted staging fixture. Normal native execution does not exercise the hosted unavailable-census condition.

The prior complete 169-helper/four-matrix Integration evidence is verified against unchanged implementation bytes. Focused catalog/source checks pass, including 46 immutable-source and five tool-selection tests. An initial host fixture failure caused by disabling its deliberate Git replacement setup is retained; the established helper environment passes without altering product checks. The static census covers 3,127 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 170 direct missing_docs gates and 92 conventional crate roots; complete semantic authority and private-documentation closure remain open.

Original Integration CI 1679 and 1680 are queued. Earlier 1677/1678 remains queued and 1675/1676 is running. No unchanged workflow is rerun or cancelled. Complete mediator execution, full source/effect/frame proof, upstream Rust/LLVM rebuilding and both full EriX build generations inside EriX remain required. No whole acceptance item is newly completed.

Shared native terminal transition — 19 September 2026: signed Kernel 37d9c74d6d1209729c520a52a274c1646efe225c consolidates exit and kill event reservation, lifetime preflight, exact-generation commit and receiver/invocation retirement into one documented implementation. Existing public behavior and root exit cleanup remain unchanged. Terminal state and actual resource destruction stay separate. This completes the terminal-refactor prerequisite in child lifetime design #19; it introduces no lifetime binding, new opcode or additional authority.

Four strict Kernel matrices pass 704/728 library tests and both standalone controls, with three existing ignored tests unchanged. All thirteen native build/Clippy profiles, formatting, host/native Clippy and private rustdoc pass without warnings. Original Kernel CI 608 and 609 pass from all four complete hashed logs (739,870 bytes), without warnings.

Signed Integration a62d1381f56a01afc692112d9b427205eaeb6a2e updates both full Kernel selectors and five stale native diagnostic selectors while preserving source memberships and tested orchestration bytes. Both maintained native runners pass their original 60-second scenarios: lifetime revocation and owned invocation. Complete serial logs are retained (1,807 and 1,587 bytes), QEMU stderr is empty, and build warnings are absent. Packaged Kernel bytes match retained unstripped artifacts; all fifteen exact original component trees and signatures verify. Four current strict 320/321-test Integration matrices, native builds, formatting, host/native Clippy and private rustdoc pass. Seven focused source/native-policy checks pass; the complete 169-helper evidence remains hash-bound to unchanged implementation bytes.

Original Integration CI 1681 and 1682 are queued; older corrected 1675/1676 remains running. The static census covers 3,128 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 170 direct missing_docs gates and 92 conventional roots. Full semantic authority and private rustdoc closure remain open. Native child-lifetime custody, running mediator lifecycle, full frame proof, upstream Rust/LLVM rebuilding and both full EriX build generations inside EriX remain required. No whole phase acceptance item is added.

Owned address-space preparation — 22 September 2026: Kernel issue 22 records the private hardware-root construction, exact authority, activation, invalidation, failure custody and retirement contract before implementation. Signed Kernel 5e818e8b6d1d, in Kernel PR 3, adds the design contract and an independent mapping-bit provenance regression. The current shared hierarchy and production permission encoder remain unchanged. An isolated rewrite produced the same 17 instructions and 63 bytes, so it was rejected as an optimization.

Four strict Kernel matrices pass 737 default / 761 all-feature tests in development and release, retaining the same three existing ignored cases. Formatting, host/native Clippy, all 13 native builds, private rustdoc and Markdown pass without warnings. Original CI 628/629 is running. No hardware-owned root, concurrent user execution, elapsed-time speedup or native isolation closure is claimed. The profiler and unchanged startup timing gates remain open in Integration 3 and Integration 72. The phase checklist stays at 15/460 accepted leaves, weighted 3.48%; external Rust/LLVM rebuilding inside EriX and both full guest-build generations remain mandatory and unproven.

Native table-custody checkpoint — 22 September 2026: signed Kernel 2e744897de7c, in Kernel PR 3, gives unpublished table allocations one cleanup owner through translation and initialization. Empty-table installation and huge splits transfer custody at parent publication. The raw allocation-return helper and duplicate huge-split initialization are removed. Parent/leaf invalidation, interrupt masking, permission templates and current shared-hierarchy lifetime remain intact. Five host controls cover allocation/translation failure, invalid geometry, abandoned preparation and publication. Four strict configurations pass 742 default / 766 all-feature tests, retaining three existing ignored cases; formatting, host/native Clippy, private rustdoc and thirteen native builds pass without warnings. Original Kernel CI 630/631 passes from four complete logs, 771,607 bytes and zero warnings.

Signed Integration fe63adde8ff9, in Integration PR 12, selects that exact Kernel in all three catalogs. Every other selection and Kernel dependency manifest is unchanged. All 172 maintained helper commands pass without warnings; unchanged Rust inputs retain their preceding strict matrices. Three original-source native executions pass lifetime revocation, owned invocation and mapping checks with unchanged 60-second guest limits, warning-free builds and empty QEMU stderr. Mapping isolation and sparse mappings have identical runtime settings; both maintained marker contracts pass on the retained mapping capture. All fifteen selected component signatures verify, and each packaged Kernel image equals its retained artifact after normal stripping. These results cover the current shared hierarchy, not independent hardware roots.

The Kernel evidence update and Integration evidence update change documentation only, with executable inputs proven unchanged. Their original Kernel CI 632/633 is running and Integration 1715/1716 is queued. Older full Integration CI 1701/1702 at b06dfad00202765491a64552dde29eaca1c24838 passes from six complete logs, 26,962,712 bytes and zero warnings, including both runs' ext4 quota, ext4 links and FAT32 directory-metadata cases. Their earlier timing failures remain retained with unestablished causes; 18, 20 and 70 have exact follow-up observations. No workflow was rerun or cancelled.

All 3,176 authored code files remain below 1,000 lines. The next work in Kernel 22 must resolve the supervisor baseline, bootstrap/saved-frame overlays and inactive-space population before adding root ownership, residency and retirement. Startup timing acceptance, complete authority cleanup and the profiler's measured speedup remain open. The phase checklist stays at 15/460 accepted leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven.

Ordinary mapping-domain checkpoint — 22 September 2026: resolved admission report records the original host failure and bounded fix. The fixture regression retains all three distinct failed attempts and the verified layout correction. Kernel now validates the complete ordinary user page before backing or mapping changes, with both control paths covered. Four strict 745/769-test configurations, thirteen native builds, Clippy and private rustdoc pass without warnings. Three exact-source native executions pass lifetime, invocation and mapping; four maintained scenario contracts are checked, with sparse and isolation sharing their identical runtime capture. All fifteen selected native signatures and packaged Kernel identities verify.

Integration pins the exact Kernel in all three catalogs, preserves every other selection and passes all 172 helpers. The unchanged ordinary exec-successor VM passes against the complete source graph, preserving its 120-second guest deadline, with no image warnings or QEMU stderr. Docs documents the domain and bootstrap distinction; all 45 tests and 2,431 pages pass, with 450,473 word bounds checked and no final warnings. The earlier Kernel CI 632/633 passes from four complete logs and zero warnings; current original CI remains under observation.

Bootstrap provenance, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

VSpace MAP authority checkpoint — 22 September 2026: the resolved bug report records three original failing host controls and the verified correction in Kernel. Current local MAP rights now govern map, protection and unmap requests. Empty and MANAGE-only aliases are denied; MAP-only access remains valid. Four strict 750/774-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.

The Integration catalog selects the exact signed Kernel in all three catalogs and passes all 172 helpers. Actual CPL3 calls preserve the authorized RW/NX page across restricted-alias refusals and drop all five temporary grants. Three native executions cover all four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signed sources and retained packaged artifacts. The original exec-successor service VM passes against all 73 components with its unchanged 120-second guest limit. All image warnings and QEMU stderr remain absent. Manual validation passes 45 tests, 2,431 pages and 450,550 checked word bounds, with both changed pages reviewed and zero final warnings.

The static audit covers 3,181 authored code files below 1,000 lines, 259 exact Git dependency pins and existing direct missing_docs gates. It does not close semantic authority review. Earlier full Integration runs 1705/1706 are running; 1707–1720 remain queued at the latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel 638/639 and Docs 1009/1010 pass. Each pair has four complete logs: Kernel totals 777,250 bytes with zero warnings, and Docs totals 774,674 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration 1721/1722 remains queued; it receives no CI acceptance credit.

Canonical acceptance remains 15/460 leaves, weighted 3.48%. Independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven.

Frame access checkpoint — 22 September 2026: the resolved bug report records three original failing host controls and the verified correction in Kernel. Explicit READ now governs admission and hardware activation. No-access mappings retain backing with USER/WRITE clear and NX set; write-only and execute-only requests are rejected without adding READ. Existing protection-transition rules remain in force. Four strict 757/781-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.

The Integration catalog selects the signed Kernel in all three catalogs and passes 172 helpers. Twenty-four actual CPL3 calls preserve earlier witnesses and cover no-access protection, write-only refusal, MAP-only frame derivation, denied READ and unmap after both frame grants are dropped. Three native executions pass four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signatures and retained packaged artifacts. The ordinary exec-successor VM passes against all 73 components with its unchanged 120-second guest limit. Builds emit no warnings and QEMU stderr is empty. Manual validation passes 45 tests, 2,433 pages and 450,702 checked word bounds, with the changed page reviewed and zero final warnings.

Static review covers 3,182 authored code files below 1,000 lines, 259 exact Git pins and existing direct missing_docs gates. This does not close semantic authority review. Earlier full Integration runs 1705/1706 remain running and 1707–1722 remain queued at their latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel 640/641 and Docs 1011/1012 pass. Each pair has four complete logs: Kernel totals 782,838 bytes with zero warnings, and Docs totals 775,110 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration 1723/1724 remains queued; it receives no CI acceptance credit.

Canonical acceptance remains 15/460 leaves, weighted 3.48%. Authorized protection restoration, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

Ordinary protection contract — 22 September 2026: the runtime memory design now specifies in-place no-access/R/RW/RX changes using current VSpace MAP and exact selected frame authority, including same-backing aliases and complete backing checks. Preserve W^X, explicit READ, object kind, reference custody, error ordering and all native witnesses. Kernel-owned anonymous loader materialization and Process endpoint target scope retain separate audit obligations. The implementation and exact-source VM evidence are pending. This earns no canonical acceptance credit; external toolchain rebuilding and both complete EriX guest-build generations remain mandatory.

Current-grant protection checkpoint — 22 September 2026: the resolved device-backing report distinguishes its original metadata-authority inconsistency from the separate restoration feature gaps. The Kernel implementation permits representable no-access/R/RW/RX changes through current exact-backing grants and aliases while active or inactive. It removes historical access ceilings and original-slot equality while preserving current VSpace MAP, selected frame rights, kind/range/identity checks, W^X, explicit READ, backing custody and failure ordering. Four strict 766/790-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.

The coordinated catalog selects that original signed Kernel in all three catalogs and passes all 172 helpers. Fifteen managed-frame calls and twenty-nine device/domain calls pass inside the original lifetime window and deadline. Actual user instructions write, execute, rewrite and execute managed RAM, check narrow alias authority and final disposal, while a reused device slot cannot authorize unrelated backing. Every prior marker remains required. Three native executions pass four original contracts with complete signed source and artifact checks; the ordinary exec-successor VM passes the full 73-component graph and original 120-second limit. Image warnings and QEMU stderr are absent. Manual validation passes 45 tests, 2,433 pages and 450,954 word bounds; both changed pages are reviewed with no final warnings or overflow.

Static review covers 3,184 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins and 174 direct missing_docs gates. Full semantic authority review remains open. Older Integration CI 1705/1706 has eleven real ext4 timeouts across eight scenarios, with complete retained logs and no accepted rerun. Their root cause and correction remain unresolved. Publication CI: Kernel 642/643 and Docs 1013/1014 pass. Each pair has four complete original logs: Kernel totals 790,650 bytes with 766/790 tests and zero warning candidates; Docs totals 775,150 bytes with 45 tests, 2,433 pages and zero final warnings or overflow. Retain the original 35/1/0 LaTeX warning convergence. Integration 1725/1726 remains queued and receives no completed CI acceptance. The separate older ext4 deadline report remains open.

Canonical acceptance remains 15/460 leaves, weighted 3.48%. Complete POSIX protection support, Process endpoint scope, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

VSpace ownership preparation — 22 September 2026:

Live VSpace records and production mapping tables are non-cloneable. Test observations contain descriptive metadata, synthetic selectors use independent tables, and leaf-encoder checks borrow live mappings under the record lock. Selectors accept only the mapping table they consume. Current grants, backing custody, first-match ordering, reference scans and hint visit-count controls remain intact; the rights control now uses actual activation/deactivation. The former whole-record snapshot helpers are removed.

Four strict Kernel configurations pass 766/790 tests with three existing ignored cases; thirteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. All 172 Integration helpers pass. Three exact-source native executions pass the four maintained mapping, sparse, invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Original 60/120-second guest limits, existing markers, exact component signatures and retained packaged artifacts remain required; image warnings and QEMU stderr are absent. No startup speedup or independent hardware-root acceptance is inferred.

The Kernel implementation and Integration source selection are published with Kernel validation evidence and Integration validation evidence. Continue under owned-root design 22, Kernel PR 3 and Integration PR 12. Publication CI: Kernel 644/645 pass with four complete original logs (790,604 bytes), 766/790 tests and zero warning candidates. Integration 1727/1728 remains queued and has no completed acceptance; earlier ext4 deadlines remain tracked in Integration report 73. Complete authority cleanup, external toolchain rebuilding within EriX and both full guest build generations remain open. Canonical acceptance remains 15/460 leaves (3.48% weighted).

Managed-frame diagnostic recovery — 22 September 2026: Kernel report 28 is resolved by the signed correction and coordinated catalog. The diagnostic admits an initially empty lower-half window while preserving the ordinary-domain guard and all 64-page, alias, hole, physical-byte and cleanup controls. The unnecessary heap allocation and raw-pointer cleanup state are removed, with expanded inline rustdoc.

Four strict 766/790-test configurations, fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. All 172 Integration helpers pass. Both maintained allocator scenarios pass independently with their original 60/120-second deadlines and complete markers; exact signed source and retained packaged-ELF checks pass. The ordinary exec-successor VM also passes against all 73 components. Image warnings and QEMU stderr are absent. The original failed native image remains retained; no unchanged rerun is used as the correction.

Static review still covers 3,186 code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Full semantic authority and inline-documentation review remain open. Older original Integration 1707/1708 both pass all 489 VM scenarios, Rust 320/321 and Markdown; six complete logs total 26,966,330 bytes with zero warning candidates. Publication CI: Kernel 646/647 pass with four complete original logs (790,634 bytes), 766/790 tests and zero warning candidates. Integration 1729/1730 remains queued and has no completed acceptance; earlier ext4 CI deadline failures remain unresolved. The separate supervisor physical-access window and independent hardware roots remain implementation work. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

Supervisor physical-access window — 22 September 2026: the signed Kernel implementation shares one restoring supervisor scratch transaction between frame scrubbing and physical mapping-byte copies. Caller backing custody and page-table/interrupt custody remain live through byte access, exact leaf restoration and local invalidation. Scratch is released afterward; read aliases clear the write bit and all temporary aliases clear user access and set NX. The unreachable raw-VA fallback is removed, and complete preflight rejects missing or ambiguous backing metadata before any range effects. No new userspace operation or capability grant is introduced. This is preparatory work for owned address spaces; independent roots and their switching/reclamation proof remain open.

Eight added host controls cover geometry, permissions, preparation and partial-effect failures, restoration/release ordering, and malformed later-page metadata without partial reads or writes. Four strict host configurations pass 774/798 tests with three existing ignored cases. Fourteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. The coordinated Integration catalog passes all 172 maintained helpers; its exact marker expectation is updated alongside the strengthened scenarios. Unchanged orchestration and profiler sources retain strict validation.

Six native executions satisfy seven maintained scenario contracts. Both allocator scenarios require the new same-VA/different-backing byte-and-leaf proof after complete cleanup, retaining every preceding marker and the original 60/120-second deadlines. Three further executions satisfy mapping, sparse, owned-invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Exact original signed source, retained artifacts and packaged Kernel matches are verified; no image warnings or QEMU stderr were observed. These checks establish no performance improvement. The technical manual documents backing and scratch custody; all 45 document tests and the complete manual build pass without final warnings.

Static checks cover 3,190 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Complete semantic authority and inline-documentation review remain open. Publication CI: Kernel 648/649 and Docs 1015/1016 pass. Eight complete original logs (1,572,758 bytes) confirm Kernel 774/798 tests, 45 document tests and the 2,433-page manual. Initial TeX reference warnings resolve through normal multipass generation; final passes are clean. Integration 1731/1732 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and its runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

Owned supervisor baseline — 22 September 2026: the signed Kernel implementation captures and verifies independently allocated supervisor tables before root VSpace creation, Rootd preparation and RAM seeding. Each copied page has one typed aligned Box owner before a parent references it; the recursive entry selects the copied root. Source boot/AP tables and mapped backing retain separate custody. User leaves, malformed geometry and invalid recursive identity are refused. Leaf permissions, cache policy and huge-page sizes are preserved; newly owned table branches use WriteBack and clear USER. Failed construction releases all unpublished allocations. This replaces a raw-pointer table-storage owner with shared typed storage and adds no unsafe Send/Sync implementation or userspace operation.

Eleven new host controls cover independent storage, allocation/read failures, invalid translation geometry, user leaves, recursive and huge-page errors, source-permission drift, retained owner links and table counts beyond the unrelated 64-page batch size. Four strict host configurations pass 785/809 tests with three existing ignored cases; fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The coordinated catalog passes all 172 maintained helpers. Both allocator scenarios require successful baseline capture before their original marker sequence, with capability grants and original 60/120-second deadlines preserved.

Six native executions satisfy seven maintained contracts: both allocator scenarios, mapping and sparse checks sharing identical runtime settings, owned invocation, lifetime revocation and ordinary exec-successor across all 73 components. Exact signed source and retained packaged artifacts are verified; no image warnings or QEMU stderr were observed. The technical manual specifies the custody boundary and passes 45 tests, complete 2,433-page generation, all 451,287 word bounds and changed-page visual review without final warnings or overflow. Static audits cover 3,194 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots.

Publication CI: original Kernel push 650 passes and PR 651 retains the host fixture failure. Regression 29 is resolved by signed Kernel 12184850cd73: a deterministic private predecessor reproduces the original defect, and the corrected fixture passes the complete local matrix and push CI 652/PR CI 653. Four complete corrected CI logs total 807,886 bytes with zero warning candidates. Only host tests and roadmap change; validated production sources and all catalog selections remain unchanged. Docs 1017/1018 pass with four complete logs (775,122 bytes), 45 tests and the 2,433-page manual. Initial TeX reference warnings resolve before clean final passes. Integration 1733/1734 remains queued at the latest retained observation and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. The retained baseline is a construction prerequisite for owned address spaces. Per-VSpace population, CR3 activation, invalidation and live-root reclamation remain open, and no speedup is claimed. Full semantic authority and inline-documentation review also remain open. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

Huge-leaf geometry correction — 22 September 2026: the bug report preserves four original host failures and one passing WriteBack control. The signed correction separates PAT from physical address bits, preserves permissions/cache indices across both huge splits, and gives newly allocated tables WriteBack policy. Scalar and batched translation, split preparation, snapshots and baseline validation share the documented geometry. No new userspace authority, original native exploit or universal boot failure is claimed.

Four strict Kernel configurations pass 796/820 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The catalog passes all 172 maintained helpers. Six native executions satisfy seven original contracts: mapping and sparse, lifetime, invocation, both allocator checks and ordinary exec-successor across all 73 components. The new native witness verifies real 2 MiB PAT translation, splitting and complete restoration; host controls additionally cover 1 GiB. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The manual passes 45 tests, 2,433 pages and changed-page visual review without final warnings or overflow.

Publication CI: Kernel 654/655 and Docs 1019/1020 pass. Eight complete original logs (1,592,794 bytes) confirm Kernel 796/820 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration 1735/1736 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Static audits cover 3,197 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, live-root reclamation and full semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven.

First-start register custody — 22 September 2026: the stack-domain bug report preserves three original host failures and one valid-stack control at unchanged production sources; the same four controls pass against the signed correction. Ordinary anonymous stack materialization now rejects addresses outside the existing user domain, and direct bootstrap writes require retained writable registered backing. Initial registers have Kernel-owned storage; stack preparation preserves the synthetic return slot, complete admission, startup arguments and rollback. The obsolete saved-frame user overlay and directory scan are removed. Complete external start-context admission and the separate bootstrap code/stack overlay remain distinct work.

Four strict Kernel configurations pass 807/831 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The catalog passes all 172 maintained helpers. Six native executions satisfy seven original contracts: lifetime, invocation, mapping and sparse, both allocator checks and ordinary exec-successor across all 73 components. The new witness checks all original initial register words after two real user stack mutations and before ordinary syscall capture. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The manual passes 45 tests, 2,433 pages and four changed-page visual reviews without final warnings or overflow.

Publication CI: Kernel 656/657 and Docs 1021/1022 pass. Eight complete original logs (1,600,791 bytes) confirm Kernel 807/831 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration 1737/1738 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Static audits cover 3,201 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, CPU residency, live-root reclamation and complete semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven.

## Problem and motivation This issue tracks continuous Phase 6 audit closure for `kernel`. Implement capability enforcement, IPC, memory objects, scheduling, interrupt entry and the minimal boot/runtime hardware boundary. An initial inventory is not a security or documentation closure claim. Evidence must follow each changed boundary through final heads, with priority security, reliability, then performance. ## Proposed behavior and scope Current inventory: 3 Cargo targets (1 bin, 1 lib, 1 standalone host test); manifests: `Cargo.toml`. Include explicit and automatically discovered targets, supported features and target-specific configurations. Review user/kernel and bootstrap/runtime transitions, syscall validation, object aliases, generation reuse and SMP publication/teardown. Keep compatibility policy in userspace and separate hardware/ABI bounds from allocation policy. The original 1,000-line runtime-call fixture has been split into 345-line transport and 670-line scheduling files. Current complete-source size evidence and remaining audit work are tracked in the linked WIP PR. ## Authority, security and reliability Maintain a finding register with public finding references, exact revisions, invariants, reproduction, owners, regression tests and closure evidence. Publish only non-sensitive status here; suspected vulnerabilities follow SECURITY.md. Each dimension below needs its own result and rationale; an absent daemon or current Rust target is not a blanket exemption. ## Acceptance criteria - [ ] Record origin, recipient, object, operations, delegation ceiling, lifetime and aliases for each relevant capability or caller-supplied authority-bearing value. - [ ] Audit ambient discovery/selectors, cwd/PATH/environment, numeric identities, inherited routes and host fallbacks; require explicit authorized intake. - [ ] Account for residual authority after success, error, cancellation, timeout, restart, failed transfer and teardown, including fork/exec where implemented. - [ ] Remove unnecessary endpoints, broad rights, duplicate aliases, provider/admin grants and debug routes. - [ ] Exercise stale generations, replay, pending replies, forged descriptive identity and object/path resolution races at the owned boundary. - [ ] Prove independent cleanup attempts and caller-specific error precedence; quarantine or terminate when retained authority cannot be accounted for. - [ ] Review unsafe/FFI/parser/arithmetic/lifetime/lock/publication invariants and add adversarial coverage where practical. - [ ] Inventory obsolete APIs, wrappers, fallback/dead paths and duplicate validators with their maintained callers. - [ ] Migrate callers and delete deprecated contracts/shims in a coherent signed revision graph; reject retired input versions where relevant. - [ ] Classify each size/count/depth/time bound as ABI, hardware, explicit resource policy or accidental limitation. - [ ] Test beyond removed boundaries and at allocation/ABI limits while preserving exhaustion errors, denial-of-service controls and bounded waits. - [ ] Keep every tracked authored code/test/script/workflow file below 1000 physical lines through thematic refactoring. - [ ] Run the deterministic tracked-source size gate, covering executable fixtures/generators and excluding only genuine non-code data or external payloads. - [ ] Audit production/test feature and symbol separation, including this repository's effect on rootd test orchestration. - [ ] Supply changes affecting rootd semantic surface to the maintained same-toolchain baseline; record a justified component-specific applicability result. - [ ] Check bootstrap ownership and development/release authority parity at this repository's producer/consumer boundary. - [ ] Use maintained [integration#3](https://git.erikinkinen.fi/erix/integration/issues/3) profiler evidence before optimizing; preserve live access checks, ownership and success criteria. - [ ] Audit build/CI inputs, secret handling, private outputs, symlink containment, deletion, subprocess bounds, warnings and host dependencies. - [ ] meaningful public/private inline documentation, crate/target `missing_docs` enforcement without blanket allowances or hidden-API escapes, warning-denied private-item rustdoc and an undocumented-public-API negative gate. - [ ] Validation: Run `cargo fmt --all -- --check`, strict Clippy, unit/doctests and warning-denied builds/rustdoc for every owned crate/target under default and all valid feature, freestanding/host, SMP and profile combinations; test mutually exclusive combinations separately. Add focused VM regressions for runtime behavior and observe the older catalog and unit tests at the exact published heads. - [ ] Documentation: update applicable README/ARCHITECTURE/ROADMAP in meta's canonical format and affected technical-manual TeX/API references; keep README evergreen and shared governance byte-identical to meta. - [ ] Evidence: record exact source/dependency revisions, commands, configurations, real exit status, CI run URLs and results; repeat the audit on final heads and obtain independent review of security closures. No skipped/pending/predecessor result counts as a pass. ## Alternatives and tradeoffs Use cohesive local refactoring or a justified shared extraction only after identifying real common semantics and authority boundaries. Remove superseded paths after preserving maintained coverage. Profile before optimization; document unavoidable ABI/hardware limits and explicit quotas rather than weakening security for speed. Validation checkpoint — 14 September 2026: Signed feature `e6bea362f9199230bf84269b1a8da6bd8da6470d` carries original signed maintenance ancestor `2f85d8a0e2e502ff1126ba40263296bc72f4635a`. The ordinary and lifetime graphs preserve their respective IPC/capability selections. All strict default/all development/release checks pass; the final fixture matrix passes 610/634 units plus one standalone on the feature graph and 586/610 units on the maintenance graph, with three pre-existing ignores. CI [532](https://git.erikinkinen.fi/erix/kernel/actions/runs/532) and [533](https://git.erikinkinen.fi/erix/kernel/actions/runs/533) pass with four complete logs, 624,386 bytes and zero warning candidates. Integration `7cc0593e101b2e0ca42f24d4fa189dd96cb1455c` passes the actual native distinct-argument/lifetime VM in 20.204185 seconds and the unchanged ordinary Rootd IPC-framing VM in 45.264436 seconds, with empty stderr. These are host build/run durations, not guest performance results. Both signed images are byte-identical to the preceding accepted transition images. Realm producer adoption and full guest builds remain open. Allocator validation checkpoint — 14 September 2026: Signed Kernel feature `ae0f3ab918abec71e809c3b4a68e54ec1c475e0d` carries original signed maintenance ancestor `41b57a7a67e6fee71f5708b55ab386b72366b8d8`. Both use the same CSpace allocator with their respective original dependency graphs. The feature tree equals the previously validated `e5198f8f3ce0dbc1ee3658cdd21bf10f0beed63c` tree. Strict development/release default/all checks pass: 613/637 units plus two standalone tests on the feature graph, 589/613 plus one standalone on maintenance, with three existing ignores. All eight feature and six maintenance freestanding builds pass without warnings. Kernel CI [536](https://git.erikinkinen.fi/erix/kernel/actions/runs/536) and [537](https://git.erikinkinen.fi/erix/kernel/actions/runs/537) pass with four complete logs, 643,867 bytes and zero warnings. The actual allocator rejection control fails the original signed library with next ID 5 instead of 4; the corrected test covers repeated failed growth, initialization failure and allocation-free reuse. ID exhaustion, duplicate destruction, occupied-record preservation and clean reuse pass. The same three-sample host profile reduces 32,768 reuse cycles at 32,768 retained spaces from 643.094176 ms to 1.172569 ms; host elapsed only, with no exclusive-CPU or guest timing claim. Signed Integration `a869a81eb406a4f027a2b5db573b6330ca114d94` selects both final source graphs and passes all 159 helper suites plus strict 320/321-unit development/release default/all Rust matrices. The final ordinary Rootd IPC-framing VM passes in 45.832335 seconds and the native distinct-argument/lifetime VM passes in 13.026853 seconds, under unchanged exit/marker/deadline rules with empty QEMU stderr. These are host build-and-run durations. The ordinary image is 27,934,720 bytes, SHA256 `2a187127696d569ae5c627d9c1d154ad53c024e98d9a181dbb6006790f01a0cc`; the lifetime image is 2,142,208 bytes, SHA256 `8fa4c7512a5916a51ba956b1e55c84ac2945c2580ff9556c99c27cbaa6e3321d`. Its final image, ELF and EFI bytes equal the preceding validated feature-tree artifacts. Older full CI [1605](https://git.erikinkinen.fi/erix/integration/actions/runs/1605)/[1606](https://git.erikinkinen.fi/erix/integration/actions/runs/1606) is still running; new [1607](https://git.erikinkinen.fi/erix/integration/actions/runs/1607)/[1608](https://git.erikinkinen.fi/erix/integration/actions/runs/1608) is waiting. No full-catalog pass, realm implementation or full guest build is claimed. Endpoint construction checkpoint — 14 September 2026: Signed Kernel `f6489ff3f8fea88a26dad232cc45d0deb33fa30e` carries original signed ordinary ancestor `c7f8952c45a60ca451466d9731207c0a9a6a9a82`. Its feature tree equals the validated `fc3e1d5ea095fd17a9629a87d05ddad0863435ca` tree. Copy, attenuated copy and move reject unbound endpoint metadata before destination installation; the original control materializes an endpoint and fails the new invariant. Explicit construction then preserves exact object identity and SEND-only rights. Positive fixtures now construct their intended endpoint kinds without widening rights or changing assertions. Strict development/release default/all checks pass 614/638 units plus two standalone tests on feature, 590/614 plus one on ordinary, with three existing ignores. Eight feature and six ordinary freestanding builds pass without warnings. Kernel CI [540](https://git.erikinkinen.fi/erix/kernel/actions/runs/540)/[541](https://git.erikinkinen.fi/erix/kernel/actions/runs/541) passes: four complete logs, 644,652 bytes, zero warnings. Earlier same-tree CI 538/539 also passes. The focused [owned-invocation design](https://git.erikinkinen.fi/erix/kernel/src/commit/f6489ff3f8fea88a26dad232cc45d0deb33fa30e/docs/owned-invocations.md) defines actual caller/server generations, exact receiver registration, retained SEND carrier lineage, request/result byte and capability custody, fresh collection, exactly-once grants, invalidated deliveries, draining and terminal cleanup. It enumerates cumulative type-specific binding reservations and no-allocation rollback obligations. The owned transport remains unimplemented; no new opcode, wire layout or escrow representation is assigned. This is a deliberate construction boundary cleanup, not a demonstrated vulnerability finding. Completed CI checkpoint — 15 September 2026: Signed Integration `a869a81eb406a4f027a2b5db573b6330ca114d94` passes both [1607](https://git.erikinkinen.fi/erix/integration/actions/runs/1607)/[1608](https://git.erikinkinen.fi/erix/integration/actions/runs/1608); signed endpoint-construction checkpoint `989d44d604d07c4c9bcc23264912bdf2076b99eb` passes both [1609](https://git.erikinkinen.fi/erix/integration/actions/runs/1609)/[1610](https://git.erikinkinen.fi/erix/integration/actions/runs/1610). Each run reports all 486 distinct VM scenarios passing, followed by the actual native lifetime scenario, physical/serial interactive checks and all four console modes. Rust and Markdown pass. The two six-log cohorts contain 26,769,289 and 26,769,316 bytes respectively, with zero warning candidates. The previously observed intermittent quota timeout remains documented without a causal-fix claim. These results establish the selected source checkpoints, not owned invocation transport, complete authority closure or either full in-EriX build generation. Native transfer preparation checkpoint — 15 September 2026: Signed Kernel `e91f47198748d8ce52fc7361f389836a6bc2a206` carries original signed ordinary ancestor `d2438c7e56c964a9c16720586cf718ec11e7cc0a`. The feature tree is byte-identical to validated `d58efd8df18d63e5b97228c066f6d7623202e6d4`. Complete destination slot, rollback, typed binding and revocation-lineage storage is reserved before native capability mutation; reservations accumulate across aliases of the same object. Preparation failure changes no capability inventory or unique-grant custody. Commit and pre-delivery rollback require no allocation under existing BSP serialization. Five actual-object controls cover a 62-capability mixed batch, real allocator rejection, exact backing and grant scope, nested revocation and same-CSpace transfer. The ordinary grant move now uses the ID-only lookup without cloning descendants or adopting the later lifetime representation. Independent strict development/release default/all checks pass 619/643 units plus two standalone tests on feature, and 595/619 plus one on ordinary, with three existing ignores. Eight feature and six ordinary freestanding builds pass without warnings. Kernel CI [544](https://git.erikinkinen.fi/erix/kernel/actions/runs/544)/[545](https://git.erikinkinen.fi/erix/kernel/actions/runs/545) passes: four complete logs, 649,206 bytes, zero warnings. Same-tree CI 542/543 also passes. This implements preparation for the current IPC path. Its private records cannot survive userspace scheduling and own no retained source authority. Persistent request/result bytes and capability custody, exact delivery state and terminal hooks remain unimplemented under [Kernel issue 11](https://git.erikinkinen.fi/erix/kernel/issues/11). No opcode, wire record, bootstrap-frame escrow eligibility or application-cancellation semantics are assigned. The renewed contributor-source inventory covers 76 repositories and 2,898 code files, all below 1,000 lines. All 92 library/binary roots and 62 standalone Cargo roots have direct missing_docs gates. These static checks do not establish whole-codebase authority or private-item documentation closure. Native invocation custody checkpoint — 15 September 2026: Signed Kernel `2e4deb7351184d3fe4517ce8d5d59eb9960f28ad` carries the native invocation core from `b1b632446ff5762761b5aee3fbdba320f5efff42` and the deterministic endpoint-fixture correction. Native Rust entry points implement explicit receiver registration, submit, claim, complete, fresh collection, progress, caller release and cleanup-only delivery relinquishment. They derive actual TCB/stage/CSpace identity, retain real request/result bytes and capabilities in a private CSpace, and keep a SEND-only carrier alias in its original revocation lineage. No CNode or private storage location escapes. Accepted results survive ordinary server death; repeated collection returns original descriptive receipts without reinstalling authority. Exact binding removal, process retirement and syscall-return hooks retain draining owners until native disposition and participant acknowledgements complete. Twelve actual-object controls cover caller/receiver scope, source-buffer mutation, duplicate destinations, moved unique grants and reused source slots, actual admission allocation rejection, six native object types, revocation, process death, replay and FIFO after registry vacancy reuse. The original draft FIFO control fails and the corrected selector passes. The disposal control proves actual guard revocation makes zero allocation requests; it does not prove a reachable backend disposal failure. Strict default/all development/release matrices pass 631/655 units plus two standalone tests, with three existing ignored experiments, private rustdoc, target Clippy and eight warning-free freestanding builds. [Kernel issue 13](https://git.erikinkinen.fi/erix/kernel/issues/13) retains CI [546](https://git.erikinkinen.fi/erix/kernel/actions/runs/546)/[547](https://git.erikinkinen.fi/erix/kernel/actions/runs/547): both fail the same older endpoint fixture at setup with 630 passed, one failed and three ignored. Four related fixtures reset CSpaces without resetting preceding non-root TCB attribution. All four deterministic original controls fail with CspaceSlotMissing; resetting attribution before CSpace replacement makes them pass without changing any message, transfer or backpressure assertion. The correction is confined to test setup and thematic test organization; production behavior is unchanged. Corrected signed-head Kernel CI [548](https://git.erikinkinen.fi/erix/kernel/actions/runs/548)/[549](https://git.erikinkinen.fi/erix/kernel/actions/runs/549) and Docs [859](https://git.erikinkinen.fi/erix/docs/actions/runs/859)/[860](https://git.erikinkinen.fi/erix/docs/actions/runs/860) pass. All 8 complete logs total 1,413,966 bytes, with zero final warnings. The terminal cohort is classified. The syscall wire adapter, fresh userspace buffer/fault/overlap validation, authenticated caller-origin delivery fields and actual CPL3 owned-invocation peers remain unimplemented. Reachable backend disposal-failure coverage, sustained invocation-workload profiling, realm producer adoption, whole-codebase authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire record is assigned; the existing CALL/RECV/REPLY ABI is unchanged. The refreshed contributor-source inventory covers 76 repositories, 74 Cargo manifests and 2,913 code files, all below 1,000 physical lines. All 92 library/binary roots and 62 standalone Cargo roots have direct missing_docs gates. These static checks do not establish full authority or private-item documentation closure. Authenticated delivery-origin checkpoint — 15 September 2026: Signed Kernel `69c5e1fe5ffa72522ff6611d8b2c0471e865115e` adds CallerOrigin to each successful native request delivery. The process ID and staged generation come from the retained submitting actor in the native CREATE_STAGED_PROCESS identity domain; payload fields, receiving identity and equal numeric carrier slots cannot replace them. The pair exposes no private CSpace, grants no authority and promises no later liveness. Services must correlate it with exact retained process/realm ownership and revalidate after blocking effects. A two-submitter control sends mutually impersonating payloads through the same real carrier and validates both actual origins plus independent caller-local selector refusal. All 13 native custody controls pass. Strict default/all development/release matrices pass 632/656 units plus two standalone tests, with three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. Kernel CI [550](https://git.erikinkinen.fi/erix/kernel/actions/runs/550)/[551](https://git.erikinkinen.fi/erix/kernel/actions/runs/551) and Docs [861](https://git.erikinkinen.fi/erix/docs/actions/runs/861)/[862](https://git.erikinkinen.fi/erix/docs/actions/runs/862) pass. All eight complete logs total 1,414,891 bytes, with zero final warnings; the cohort is classified and stopped. The separate earlier fixture correction remains closed in [Kernel issue 13](https://git.erikinkinen.fi/erix/kernel/issues/13), preserving original CI 546/547 and corrected 548/549. Sustained invocation-workload profiling, syscall wire and fresh-buffer/fault/overlap validation, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm producer adoption, whole authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire layout is assigned. Native progress and cleanup still do not certify application cancellation. The renewed inventory covers 76 repositories, 74 Cargo manifests and 2,914 code files below 1,000 physical lines. All 92 library/binary roots and 62 standalone roots have direct missing_docs gates. Source hashes, clean feature branches, signatures and remote equality are verified; these static gates do not close full authority or private-item documentation audits. Native invocation profiling baseline — 15 September 2026: Signed Kernel `6cb703e1ed8b9de0d29a37189cd914cd501e732e` provides an actual-object host workload for queued progress, collected progress, descriptive result reads and complete request/result cycles. Signed Integration `f3e4359b34cb8f7db732fbf38823f722553c86d4` adds bounded capture, raw-evidence report verification and equivalent comparisons. Every sample checks exact bytes and SEND capability bindings, authenticated origin, foreign selection, duplicate completion refusal, FIFO position reuse, one-time collection and final invocation disposal. Source and executable bytes are observed against explicit original identities; compiler/host relationships remain declarations. Workload children and source Git reads receive minimal environments; capture owns memory, time, output and process cleanup. Completion is published only after deadline teardown succeeds. The operator guide and signed Docs `644273a0edd91e4c38dcd4418d6ae1119ff1f10b` describe these boundaries. Kernel strict default/all development/release checks pass 632/656 units plus three standalone controls, three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. Integration passes all 161 helper commands, including 19 profiler controls and nine source-provenance controls, plus fresh strict 320/321-unit Rust matrices, private rustdoc and warning-free target builds. Four original socket-fixture failures are retained and attributed to the selected temporary directory exceeding the host Unix-socket path domain; a shorter explicit private directory passes the same fixtures. Docs passes 45 tests and renders 2,345 pages with zero final warnings; 427,592 word boxes fit page bounds and changed pages 2284/2285 pass visual review. Kernel CI 552/553 and Docs CI 863/864 pass; eight complete logs total 1,431,762 bytes with zero final warnings after manual reference convergence. The original signed Kernel baseline retains 48 measured samples and 16 checked warmups: four modes, populations 0/32/128/512, 256 operations per sample, three measured repetitions and one warmup. A single selected host CPU is used after local build/test work completes; external host scheduling is not isolated. At population 512, operation medians are 117,577.723 ns for queued progress, 8,927.977 ns for collected progress, 9,124.098 ns for descriptive reads and 1,167,847.016 ns for complete cycles. At population zero they are 223.328, 166.199, 213.137 and 4,556.867 ns respectively. Every raw sample, process disposition and final native cleanup passes. Timings include fixed semantic checks; no cost is subtracted and no ratio is a pass threshold. Source review identifies repeated carrier-binding scans during full registry refresh and a registry-lock acquisition for every inactive settlement position. The next bounded change will retain only non-authoritative numeric search positions: every fast path must still check current capability type/rights, endpoint identity/in-use state and exact CSpace/slot binding, with complete lookup on a stale hint. Existing revocation and terminal hooks remain authoritative. Settlement may scan for the next draining owner under one lock while retaining the original pass boundary, increasing index order, busy-position exclusion and allocation-free stack-owner return; disposal remains outside the table lock. Original workload bytes and sample policy must remain unchanged for comparison. No Kernel performance algorithm has changed in this baseline. Native syscall adapters, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The 76-repository inventory has 2,923 code files below 1,000 lines and 155 direct missing_docs crate-root gates; this does not close the semantic audits. Measured native invocation lookup refinement — 15 September 2026: Signed Kernel `8349d68636382cc7e25a3347f5f1df216554203a` retains only numeric carrier-search positions. Every use rechecks the actual CSpace capability type/rights, live endpoint identity and exact binding; stale positions take the complete search path. No successful authorization, capability or reference is cached. Draining scans fix their boundary on the first poll, visit each position at most once, skip busy stack owners and return exclusive custody after unlocking. Native disposal and first-failure retention preserve their existing semantics. Signed Integration `108501cf7ec20f05dd3d62ea401ea8adad6c6e9c` selects this Kernel in its isolated native catalog, and signed Docs `f10a1d375a326543ec0adda4569bc7cb4faca9b6` documents the invariants. The existing syscall ABI and ordinary image catalog are unchanged. All 15 actual-object native controls pass, including real alias compaction, rights/type/object replacement, busy ownership and allocation-free settlement. The unchanged four-mode workload control also passes. Full strict default/all development/release Kernel matrices pass 634/658 units plus three standalone controls, with three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. The existing native lifetime and entry-argument VM passes unchanged oracles in 21.978041 seconds of host build-and-run time, with clean teardown and empty QEMU stderr. Its signed boot image is 2,207,744 bytes, SHA-256 `4030cdfb8a13c000ff4716ecdc5203cb46273d6117a282f7375f25dccbbeedc9`. Exact unchanged Integration Rust/helper bytes preserve the preceding strict 320/321-unit matrices and all 161 helper-command results; changed catalog/scenario policies pass. Docs passes all 45 tests and a complete 2,345-page render with zero final warnings, 427,679 bounded word boxes and visual review of page 145 plus continuation page 146. The original signed Kernel `6cb703e1ed8b9de0d29a37189cd914cd501e732e` and the new signed Kernel use byte-identical workload sources, the same selected CPU/toolchain/context and explicit limits, distinct source targets, four modes, populations 0/32/128/512 and 256 operations per sample. Each capture retains 48 measured samples and 16 warmups; every sample passes actual semantic and native/process-cleanup checks. At population 512, median queued-progress cost changes from 117.578 to 37.673 microseconds (3.12x observed ratio), and full-cycle cost from 1167.847 to 443.055 microseconds (2.64x). Collected progress changes from 8.928 to 6.015 microseconds and descriptive reads from 9.124 to 6.212 microseconds. Timings include fixed checks, with no subtracted overhead or timing-ratio pass gate. No managed build/test workload runs concurrently during capture; external host scheduling remains unisolated. These are host operation wall times, not guest startup/build acceptance or a statistical guarantee. Kernel CI 554/555 succeeds; four complete logs total 679,280 bytes with no warnings, and its completed cohort is stopped. Docs CI 865/866 succeeds at observation three; four complete logs total 754,424 bytes, all 45 tests pass and each manual has 2,345 pages. Its normal reference passes report 32/1/0 warnings, with zero final warnings and no box diagnostics. The completed Docs cohort is stopped. Integration CI 1619/1620 is waiting at its first observation. Older Integration 1613/1614 is running; 1615/1616 and 1617/1618 are waiting. Accepted older Integration 1611/1612 passes all 486 catalog scenarios and later probes with complete warning-free logs. This does not establish the intermittent quota cause tracked in Integration issue 18. Current full-suite CI remains required; stopped cohorts are not polled again. Owned syscall wire adapters, actual owned CPL3 peers, fresh-buffer validation, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The refreshed 76-repository inventory has 2,924 code files below 1,000 lines and 155 direct missing_docs crate-root gates; those checks do not close whole-codebase semantic audits. Owned invocation wire and native acceptance — 15 September 2026: Signed Kernel `5f497adaefa526108a0439e0e071717dddb85334`, shared IPC `de968da19898bef532ddb3b5974bb9562f51dee5`, capability ABI `a001a26f0eb3aebec3f5fd02a28d98f1bc23f8a0` and Integration `9030b217c490db6ad3ec60a799cb025eccbfcdb1` implement and exercise the immediate owned invocation boundary. The allocation-free shared codecs and shim preserve exact return metadata, including a retained draining owner on failed submission. The Kernel checks fresh complete user mappings and packet framing under one lifecycle guard before native effects. No user pointer or caller-selected identity is retained. Destination capacity and descriptive receipt capacity are independent; spare capacity acquires no authority and repeated collection cannot duplicate transfers. Existing numeric binding hints still recheck live capabilities on every use. The real three-process CPL3 scenario passes all eight operations, full-span pointer/rights/overflow/reserved-field rejection, actual returned selectors, payload/capability/origin checks, collection after server exit and repeated receipts. A second request rejects premature relinquishment, enters draining on caller release and retires only after the exact server acknowledgment. Current signed owned and unchanged older lifetime images are each 2,232,320 bytes, with SHA-256 `588c6097c57ebd2ed92e0f0b76f2b1ad6b82630b4a0da272ee98e218eb8e333d` and `8f9026aaefd2c5a745e35467ac01c71789c5f469f9cd42a477f87818747ee673` respectively. Both runs have clean teardown and empty QEMU stderr. Ordinary images contain neither diagnostic hook. Strict default/all development/release host, freestanding and rustdoc matrices pass: IPC 368 units, shim 20, capability ABI 191, Kernel 642/666 and Integration 320/321. Existing ignores remain one shim and three Kernel tests. All 162 maintained Integration helper commands pass; three prior correct concurrent-run lock refusals are retained and their sequential checks pass on unchanged executable inputs. Docs `46da7a4cb4d38a2bea5b5491a68f51f33e4b4305` publishes the normative register/packet contract and regenerates the three affected API references from original signed revisions. All 45 documentation tests pass. The complete 2,363-page manual has zero final warnings, 430,365 word boxes within page bounds and reviewed changed ABI/API pages. Shared IPC CI 337/338 and capability ABI CI 214/215 pass with eight complete warning-free logs. Both Kernel revisions pass CI 556/557 and 558/559 with eight complete warning-free logs. Those cohorts are stopped. Current Docs CI 867/868 passes at observation four; four complete logs total 758,328 bytes. Both 2,363-page manuals pass all 45 tests, report normal reference-pass warnings of 32/1/0, and finish with zero warnings or box diagnostics. Its cohort is stopped. Current full Integration 1621/1622 is waiting. Older full Integration 1613/1614 now passes all 486 catalog scenarios and later native/console probes, with six complete warning-free logs; its cohort is stopped. Older 1615/1616 is running, and 1617/1618 plus 1619/1620 are waiting. Current full-suite acceptance remains open, as does the intermittent quota cause in Integration issue 18. This checkpoint supersedes the earlier pending wire/CPL3/manual status. Reachable backend disposal-failure coverage, broader revocation/generation-reuse scenarios, producer adoption, realm runtime, complete authority/inline-documentation audits and both full EriX-in-EriX build generations remain open. The current inventory checks 76 repositories, 2,943 code files below 1,000 lines and 157 crate roots with direct missing_docs gates; it does not establish semantic audit closure. No complete guest build or guest performance result is claimed. Process-bound native acceptance — 15 September 2026: Signed Kernel `60da5858d7198185efd103f0e91e5ac2e0b63e67` implements control operation 52, checking the actual moved install grant against expected process/generation with exact rights, including zero, under existing endpoint policies. Signed Procd `f1105706cc19ed024a6cca79a29abc57c90c6661` uses this operation in its actual ordinary launch-description producer while retaining the narrow SEND receipt, pending state and exact failure cleanup. IPC `c453b697b8cdb9cc1c36f1ad89ff868648190025`, capability ABI `fe8d558253ad01301b99554e20d287c4ea35bb1d` and five aligned helper commits preserve original Git/type identity. Integration `58c925c564b69bebce8df6f3e75a9312824e18c4` passes the expanded lifetime CPL3 scenario with thirteen actual control calls, user-side reply checks, two staged children and full added-custody disposal. The corrected lifetime image SHA-256 is `8e6a9e8f68b90cc1ede61300958cec122b82a7c6dfd6318a51e40fefc7ba166e`; the unchanged owned-invocation scenario also passes with image SHA-256 `b76a380d3cd6b03b0ff61a3b626ace0667679920684ad7356a1c3a36e2224953`. Both have clean teardown and empty QEMU stderr. The initial fixture setup-order failure is retained and corrected in Kernel issue #14. All strict default/all development/release matrices pass: IPC 371, shim 20, capability ABI 191, Kernel 648/672 including standalone controls, Procd 227/232 including auxiliary binaries, and Integration 320/321 tests. Existing native-only ignores are unchanged. Procd passes forty native binary builds with repository linker scripts. All 162 Integration helpers pass after updating the exact policy assertion to require the new marker; its initial mismatch remains recorded. Docs `b0fcf0f43af2af741d520a0b1373cc346e08863c` updates the native wire/ownership contract, operation registry, Procd boundary and three generated shared APIs. All 45 tests and the complete 2,367-page manual pass, with zero final warnings, 431,138 word boxes within page bounds and four reviewed protocol/API pages. Current IPC 339/340, capability ABI 216/217, Kernel 560/561 and 562/563, Procd 266/267, Docs 869/870 and all five helper push/review CIs pass with complete classified logs and no final warnings. Those component cohorts are stopped. Current full Integration 1623/1624 waits at observation 01. Older full Integration 1615/1616 is running at observation 11; 1617/1618, 1619/1620 and 1621/1622 wait at observations 09, 07 and 04. No pending full suite is counted as passed. Typed realm bootstrap, mediator startup/readiness/configuration/seal, complete consumer image adoption, fair terminal/provider retirement, broader native disposal failures and both full EriX-in-EriX build generations remain open. The new inventory covers 76 repositories, 2,950 code files below 1,000 lines and 158 direct missing_docs crate-root gates; complete inline documentation and whole-codebase authority closure remain open. Prior performance measurements retain their original signed source identities; this checkpoint claims no new timing or guest performance result. Native permission checkpoint — 16 September 2026: signed Kernel `32c70109fe7663440aa56de6a49975accc1f0057` carries explicit live execution permission through single-page, batch and permission-only mappings. Data and construction aliases remain non-executable; ancestor promotion and splitting preserve neighbouring restrictions. Processor activation validates and enables execute-disable support on the bootstrap and application processors. Seven independent controls accompany the repair. Strict default/all-feature development/release suites pass 666/690 kernel unit tests plus two external controls per selection, retaining three existing ignores. Host/native Clippy, private rustdoc, formatting and ten native builds pass without warnings. Separate one-CPU and two-CPU diagnostic VMs pass the unchanged native command sequence. A read-only hardware observer matches all 233,755 selected coreutils executable bytes, verifies CPL3 and enabled paging/execute-disable state, and confirms both observed RELRO pages are user-readable, read-only and non-executable; the current stack is user-writable and non-executable. Both processors report execute-disable enabled. This is an exact process-entry/table observation, not an injected instruction-fault test or whole-system permission proof. The diagnostic image SHA-256 is `8c3c24639e8e1ca8c4f2ad4e485323abf32ec07408241c3e4fa9713f6e07e812`. Signed Docs `d221e725c2543316680e63fc5e8314ce0fe3bdf1` documents the mapping and processor contracts. All 45 documentation tests and canonical checks pass; the 2,375-page manual has 434,308 in-bounds word boxes and zero final warnings, with three changed pages visually reviewed. Exported API snapshots are unchanged. Kernel CI 574/575 passes with four complete warning-free logs (708,112 bytes), including existing optimized workload examples. Docs CI 891/892 passes all four complete logs (762,176 bytes), with 45 tests per manual job and zero final warnings. The maintained permission VM regression, full frame proof, whole-codebase authority/documentation review, runnable realms and both complete guest build generations remain open. Diagnostic lifetime checkpoint — 17 September 2026: Signed `fb4e134f2130e9f60608bad0ecc02d8a278887a8` removes the obsolete RTC post-exit observer, three retained trace values and four lifecycle hooks. The remaining diagnostic contract uses scalar metadata and synchronous current-operation observations. Four strict matrices pass 671/695 units plus both standalone controls, with the three existing ignored experiments; six trace-enabled native builds and binary Clippy selections pass without warnings. Existing invocation/lifetime VM controls pass on the exact candidate under one explicit private trace-feature variation, original 60-second limits and normal stripped-artifact verification. Original current-head CI is pending. The complete syscall memory footprint, ordinary graph adoption and both full guest builds remain open. VSpace fixture follow-up — 17 September 2026: Original diagnostic-cleanup CI 586 fails and 587 passes; all four complete logs contain zero warnings. Issue #17 tracks deterministic predecessor-attribution failures in the synthetic and mapping fixtures. The correction preserves production authority and all original test assertions, shares explicit test-only attribution setup, and partitions the large mapping suite. Strict corrected matrices are running. Earlier native entry and diagnostic VM results retain their exact source/feature scope. VSpace fixture CI reconciliation — 17 September 2026: Current signed `28dfaea22796925ca438b4a57175520a8d9e7a8c` passes original [push CI 588](https://git.erikinkinen.fi/erix/kernel/actions/runs/588) and [PR CI 589](https://git.erikinkinen.fi/erix/kernel/actions/runs/589). All four complete terminal logs are classified: 712,357 bytes and zero warning candidates. Both workflows retain the named regression controls, 671 default/695 all-feature unit results and both standalone controls; three existing experiments remain ignored. Local four strict matrices, host/native Clippy, rustdoc, formatting and two native builds also pass without warnings. No production attribution rule or global harness concurrency is changed. Issues #4, #5 and #17 close for their bounded host-fixture corrections, while full source/frame and guest-build acceptance remain open. Borrowed capture checkpoint — 17 September 2026: signed `f2489242be47654342c91ef3f05a2a12cdc15a4b` requires complete initialized frame ownership before native syscall dispatch. Five new controls cover real allocation rejection, non-dispatch of a requested capability drop, attribution, layout, stable copies and teardown. Four strict 676/700-unit matrices, both standalone controls, eight native builds/Clippy selections and two original-budget invocation/lifetime candidates pass without warnings. Candidate machine bytes and normal packaged stripping are verified; no general syscall memory guarantee or ordinary-image adoption is claimed. Original CI 590/591 passes: all four complete logs total 716,126 bytes, zero warnings, with 676/700 unit results and both standalone controls. Prior CI 588/589 passes completely, closing bounded fixture issues #4/#5/#17; their original failures remain retained. VSpace cleanup checkpoint — 17 September 2026: signed `1af934ff48e6d5ad33fd1227c8d1ffdc40c7a06d` records access-withdrawal progress and exact frame-reference consumption while rejecting ordinary use during retirement. Final process-reference cleanup keeps its owner until teardown succeeds. Four new host controls, strict 680/704-unit matrices, both standalone controls, eight native build/Clippy selections and two original-scenario native candidates pass without warnings. Original CI 592/593 passes with all four complete logs classified and zero warnings. Surrounding process-cleanup review, ordinary-image adoption and both complete guest builds remain open. Process cleanup checkpoint — 17 September 2026: signed `c55ee8d6f12957b43c5fd6aaf31c9865656b5ae6` retains private CSpace identity through final release and excludes cleanup owners from execution and live IPC. Four new owned controls, four strict 684/708-unit matrices, both standalone controls, eight native build/Clippy selections and two original-budget native candidates pass without warnings. Final rustdoc-only edits retain explicit candidate scope. Original CI 594/595 passes with four complete logs classified: 722,414 bytes and zero warnings. Preceding VSpace and capture cohorts pass with complete logs. Ordinary-image, whole-code semantic and both complete guest-build gates remain open. ## Tracking and rollout The isolated native mechanism is accepted at signed Kernel `03e13a784bde08914864267a4e2a6324a22d05c7`, selected by signed [Integration `4b65755f`](https://git.erikinkinen.fi/erix/integration/commit/4b65755f1f2774798d4a909212db4e64c0349b86), with Bootloader `e7fa39357a38c21529cccfd16cf3446eb07e8aa5`, IPC `de6892790de69f40f749c393d24078b287b36175` and capability ABI `984c9f7b0ca910488f8c5b035d2f0cb88f18d304`. Two private CPL3 owners execute actual syscall entry for refusal, consumed custody and repeated-slot denial. Ordinary exit and an independent observer's SEND-only Process endpoint exercise both terminal paths. Unchanged dispatch witnesses require exact generations and returns, cross-CSpace SEND/zero-right descendant absence, preserved independent aliases and exact terminal events. The fixture removes temporary CNode/TCB/VSpace handles before entry and retains its 16 owned code/stack/message pages until shutdown. It changes neither scheduler decisions nor production cleanup. Normal images exclude the fixture. The native scenario passes the required debug exit, ordered and unique begin/complete markers and all forbidden-marker checks. QEMU stderr is empty. The full build-and-run command takes 19.202361 seconds under the unchanged 60-second VM hard and 45-second silence limits, with one CPU, 1 GiB RAM, TCG and no network; this duration is not a guest performance measurement. The signed 2,142,208-byte image has SHA256 `4f021a40264739fef4979da2b0cd4647bde3f76b9dada6816aba6faa3594a797`. The 1,552-byte serial log has SHA256 `8cc7f9a7250881eddbc056834c46d7437ce944dd4b60c8b96e2c622bad2a85f9`. The exact 15-repository graph and all 16 Cargo manifests are validated. [Push CI 528](https://git.erikinkinen.fi/erix/kernel/actions/runs/528) and [PR CI 529](https://git.erikinkinen.fi/erix/kernel/actions/runs/529) pass for that signed Kernel. Four complete logs total 623,648 bytes with no warning candidates. Each test job passes 609 development-default, 609 release-default and 633 release-all units plus the three standalone executions; three existing experiments remain ignored per unit suite. Local strict default/all-feature development/release host and freestanding checks, private rustdoc, four native/normal builds and symbol exclusion checks pass. The failed pre-correction images remain retained: Bootloader issue 5 covers the runtime-name rejection; Kernel issue 9 covers markers suppressed by an unrelated Rootd smoke feature. The corrected entry point supplies a typed kernel-only begin/complete reporter without a new service route. Both defects now have exact-source CI and actual VM evidence. The existing syscall and generated IPC manual is accepted at Docs `28b44183368c512da9c5b804f570ff497ae3b6fc` with CI 839/840. The native diagnostic and runtime namespace manual is accepted at signed Docs `17b4d52a9a84e0803746e3a38eb34f070bfb28a4`, with green CI 841/842 and zero final warnings. Integration CI 1603/1604 is running, including older VM regressions and the additional diagnostic. Realm producer migration, two-realms/two-clients actual byte I/O, pending-operation/provider completion, the complete authority audit and both full build generations inside EriX remain open. Current signed `90fb945e291d1f8bb0b838d7ab8deccd1895600c` passes [push CI 524](https://git.erikinkinen.fi/erix/kernel/actions/runs/524) and [PR CI 525](https://git.erikinkinen.fi/erix/kernel/actions/runs/525). Four complete logs total 622,018 bytes, with no compiler/lint warning candidates. Each test job passes 609 development-default, 609 release-default and 633 release-all units, plus the standalone allocation regression in all three selections. Three pre-existing experiments remain ignored per unit suite. The deterministic order regression and both originally failing allocator tests pass in all three selections; both Markdown jobs pass. Original CI523 and the deterministic pre-fix failure remain retained in #8. This closes the allocator fixture regression only; native VM, producer, audit and self-hosting gates remain open; the later manual checkpoint is recorded above. The lifetime mechanism is implemented in signed `7eb9bc32a08a8a91db2b0e88d0d8e5f3174ece3e`; current signed `90fb945e291d1f8bb0b838d7ab8deccd1895600c` corrects the allocator fixture order regression tracked in #8. The coherent IPC/capability library checkpoints have green CI. The strict lifetime matrix, ten new unit regressions and measured allocation-free deposit/prepared terminal removal pass. Original kernel CI 522 passes/CI 523 fails are retained; the corrected host matrix passes 609/633 units with ordinary concurrency, and its own CI now passes as recorded below. [WIP PR #3](https://git.erikinkinen.fi/erix/kernel/pulls/3) retains complete scope. Native VM, manual/API and producer acceptance, broader audit and two-generation guest self-hosting remain open. Current signed checkpoint `a498af7c6535733127ba642d7297c4cedf9f18e2` removes the revoker lineage snapshot and corrects the optimized host fixtures tracked in [kernel #6](https://git.erikinkinen.fi/erix/kernel/issues/6). The final 38-command strict matrix passes on Rust 1.97.1 with original unchanged Git dependencies: 598 default and 622 all-feature unit tests plus one standalone allocation regression in each development/release selection. Three existing experiments remain ignored per unit suite. Formatting, warning-denied host/target Clippy, builds, doctests, private-item rustdoc and twelve coherent freestanding kernel builds pass. Both new optimized CI commands also pass locally with ordinary harness concurrency. Final Markdown/governance/whitespace checks pass; all 2,870 discovered authored code files across the maintained workspace remain below 1,000 lines. This size check does not close the semantic authority or documentation audit. Signed `a498af7c6535733127ba642d7297c4cedf9f18e2` passes [push CI 520](https://git.erikinkinen.fi/erix/kernel/actions/runs/520) and [PR CI 521](https://git.erikinkinen.fi/erix/kernel/actions/runs/521), both completed at 06:40:46 UTC on September 14. All four complete logs total 612,242 bytes and match the original workflow/source selection, with no compiler or lint warning candidates. Each test job passes 598 development-default, 598 release-default and 622 release-all-feature unit tests, retaining three pre-existing ignored experiments in each unit suite. The new custody regression and both corrected receive tests pass in all three selections. Both Markdown jobs pass. This component cohort is complete; native VM, startup-performance and self-hosting acceptance remain separate. - Parent work: https://git.erikinkinen.fi/erix/integration/issues/2 and https://git.erikinkinen.fi/erix/docs/issues/1. - Branch: `feature/posix-compat`; update linked WIP PRs after coherent signed checkpoints using canonical CONTRIBUTING.md messages. - Baseline revision: `4330175e27718490f06b93098e95e3c1553cb765`; refresh component/dependency heads and their own CI evidence as implementation advances. - Cross-repository dependencies remain full lowercase commit hashes; update the selected graph deliberately. This issue does not authorize merges, release tags or replacement of published images. Process-start census correction — 19 September 2026: signed Kernel `b762e19d0c16acd605d0f6123994a586cc6fcde1` requires a successful install-grant absence census before process start. An unavailable census returns the existing refusal and preserves the whole staged child and grant state. Hosted controls cover unavailable census, actual grant disposal and malformed-target precedence. Normal bootstrap initializes tracking before admission; production reachability of the injected condition or a native authority escape is not established. [Kernel issue 18](https://git.erikinkinen.fi/erix/kernel/issues/18) uses the canonical bug report and records the original failure and bounded correction. Four strict Kernel matrices pass 704/728 library tests and two standalone controls each; three existing ignored tests remain ignored. Formatting, strict host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass. Original [Kernel CI 606](https://git.erikinkinen.fi/erix/kernel/actions/runs/606) and [607](https://git.erikinkinen.fi/erix/kernel/actions/runs/607) pass from all four complete hashed logs (739,843 bytes), without warnings. Signed Integration `b65183ddb93eb4396d4140a002c3727fec42ff87` selects that Kernel and the reconciled Docs `7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d`, preserving all other catalog entries and all previously checked orchestration bytes. The matching guarded-preparation VM passes both unique markers and ordinary successful shell exit under unchanged 120-second hard and 45-second progress limits. All 106 artifacts, all 73 original component identities and the actual signed image are verified without warnings. Serial SHA256: `a373a8ccd81ac3efbaa492cbf2e1f991f3cc34dcbf23a1435c1c48cd75cd5c1c` (55,776 bytes); signed boot-image SHA256: `3b88d37183cf36dcbd5f1105cc0fd86e79aa4489d311300003f3f362c24bcd0a`. This remains an unstarted staging fixture. Normal native execution does not exercise the hosted unavailable-census condition. The prior complete 169-helper/four-matrix Integration evidence is verified against unchanged implementation bytes. Focused catalog/source checks pass, including 46 immutable-source and five tool-selection tests. An initial host fixture failure caused by disabling its deliberate Git replacement setup is retained; the established helper environment passes without altering product checks. The static census covers 3,127 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 170 direct missing_docs gates and 92 conventional crate roots; complete semantic authority and private-documentation closure remain open. Original [Integration CI 1679](https://git.erikinkinen.fi/erix/integration/actions/runs/1679) and [1680](https://git.erikinkinen.fi/erix/integration/actions/runs/1680) are queued. Earlier 1677/1678 remains queued and 1675/1676 is running. No unchanged workflow is rerun or cancelled. Complete mediator execution, full source/effect/frame proof, upstream Rust/LLVM rebuilding and both full EriX build generations inside EriX remain required. No whole acceptance item is newly completed. Shared native terminal transition — 19 September 2026: signed Kernel `37d9c74d6d1209729c520a52a274c1646efe225c` consolidates exit and kill event reservation, lifetime preflight, exact-generation commit and receiver/invocation retirement into one documented implementation. Existing public behavior and root exit cleanup remain unchanged. Terminal state and actual resource destruction stay separate. This completes the terminal-refactor prerequisite in [child lifetime design #19](https://git.erikinkinen.fi/erix/kernel/issues/19); it introduces no lifetime binding, new opcode or additional authority. Four strict Kernel matrices pass 704/728 library tests and both standalone controls, with three existing ignored tests unchanged. All thirteen native build/Clippy profiles, formatting, host/native Clippy and private rustdoc pass without warnings. Original [Kernel CI 608](https://git.erikinkinen.fi/erix/kernel/actions/runs/608) and [609](https://git.erikinkinen.fi/erix/kernel/actions/runs/609) pass from all four complete hashed logs (739,870 bytes), without warnings. Signed Integration `a62d1381f56a01afc692112d9b427205eaeb6a2e` updates both full Kernel selectors and five stale native diagnostic selectors while preserving source memberships and tested orchestration bytes. Both maintained native runners pass their original 60-second scenarios: lifetime revocation and owned invocation. Complete serial logs are retained (1,807 and 1,587 bytes), QEMU stderr is empty, and build warnings are absent. Packaged Kernel bytes match retained unstripped artifacts; all fifteen exact original component trees and signatures verify. Four current strict 320/321-test Integration matrices, native builds, formatting, host/native Clippy and private rustdoc pass. Seven focused source/native-policy checks pass; the complete 169-helper evidence remains hash-bound to unchanged implementation bytes. Original [Integration CI 1681](https://git.erikinkinen.fi/erix/integration/actions/runs/1681) and [1682](https://git.erikinkinen.fi/erix/integration/actions/runs/1682) are queued; older corrected 1675/1676 remains running. The static census covers 3,128 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 170 direct missing_docs gates and 92 conventional roots. Full semantic authority and private rustdoc closure remain open. Native child-lifetime custody, running mediator lifecycle, full frame proof, upstream Rust/LLVM rebuilding and both full EriX build generations inside EriX remain required. No whole phase acceptance item is added. Owned address-space preparation — 22 September 2026: [Kernel issue 22](https://git.erikinkinen.fi/erix/kernel/issues/22) records the private hardware-root construction, exact authority, activation, invalidation, failure custody and retirement contract before implementation. Signed [Kernel 5e818e8b6d1d](https://git.erikinkinen.fi/erix/kernel/commit/5e818e8b6d1d6da7698cfff34820d0aa9de8c05a), in [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3), adds the [design contract](https://git.erikinkinen.fi/erix/kernel/src/commit/5e818e8b6d1d6da7698cfff34820d0aa9de8c05a/docs/owned-address-spaces.md) and an independent mapping-bit provenance regression. The current shared hierarchy and production permission encoder remain unchanged. An isolated rewrite produced the same 17 instructions and 63 bytes, so it was rejected as an optimization. Four strict Kernel matrices pass 737 default / 761 all-feature tests in development and release, retaining the same three existing ignored cases. Formatting, host/native Clippy, all 13 native builds, private rustdoc and Markdown pass without warnings. Original CI 628/629 is running. No hardware-owned root, concurrent user execution, elapsed-time speedup or native isolation closure is claimed. The profiler and unchanged startup timing gates remain open in [Integration 3](https://git.erikinkinen.fi/erix/integration/issues/3) and [Integration 72](https://git.erikinkinen.fi/erix/integration/issues/72). The [phase checklist](https://git.erikinkinen.fi/erix/integration/issues/65) stays at 15/460 accepted leaves, weighted 3.48%; external Rust/LLVM rebuilding inside EriX and both full guest-build generations remain mandatory and unproven. Native table-custody checkpoint — 22 September 2026: signed [Kernel 2e744897de7c](https://git.erikinkinen.fi/erix/kernel/commit/2e744897de7c330d3d095a65daed761a4e4a9406), in [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3), gives unpublished table allocations one cleanup owner through translation and initialization. Empty-table installation and huge splits transfer custody at parent publication. The raw allocation-return helper and duplicate huge-split initialization are removed. Parent/leaf invalidation, interrupt masking, permission templates and current shared-hierarchy lifetime remain intact. Five host controls cover allocation/translation failure, invalid geometry, abandoned preparation and publication. Four strict configurations pass 742 default / 766 all-feature tests, retaining three existing ignored cases; formatting, host/native Clippy, private rustdoc and thirteen native builds pass without warnings. Original Kernel CI 630/631 passes from four complete logs, 771,607 bytes and zero warnings. Signed [Integration fe63adde8ff9](https://git.erikinkinen.fi/erix/integration/commit/fe63adde8ff9529faf1261dbd5da3d7f39c0f2a6), in [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12), selects that exact Kernel in all three catalogs. Every other selection and Kernel dependency manifest is unchanged. All 172 maintained helper commands pass without warnings; unchanged Rust inputs retain their preceding strict matrices. Three original-source native executions pass lifetime revocation, owned invocation and mapping checks with unchanged 60-second guest limits, warning-free builds and empty QEMU stderr. Mapping isolation and sparse mappings have identical runtime settings; both maintained marker contracts pass on the retained mapping capture. All fifteen selected component signatures verify, and each packaged Kernel image equals its retained artifact after normal stripping. These results cover the current shared hierarchy, not independent hardware roots. The [Kernel evidence update](https://git.erikinkinen.fi/erix/kernel/commit/f50535bfcd9aa57271762bb0b4da7d759d08906e) and [Integration evidence update](https://git.erikinkinen.fi/erix/integration/commit/1621164b93a7705eae381ff95aeec59b4e9527c3) change documentation only, with executable inputs proven unchanged. Their original Kernel CI 632/633 is running and Integration 1715/1716 is queued. Older full Integration CI 1701/1702 at b06dfad00202765491a64552dde29eaca1c24838 passes from six complete logs, 26,962,712 bytes and zero warnings, including both runs' ext4 quota, ext4 links and FAT32 directory-metadata cases. Their earlier timing failures remain retained with unestablished causes; [18](https://git.erikinkinen.fi/erix/integration/issues/18), [20](https://git.erikinkinen.fi/erix/integration/issues/20) and [70](https://git.erikinkinen.fi/erix/integration/issues/70) have exact follow-up observations. No workflow was rerun or cancelled. All 3,176 authored code files remain below 1,000 lines. The next work in [Kernel 22](https://git.erikinkinen.fi/erix/kernel/issues/22) must resolve the supervisor baseline, bootstrap/saved-frame overlays and inactive-space population before adding root ownership, residency and retirement. Startup timing acceptance, complete authority cleanup and the profiler's measured speedup remain open. The [phase checklist](https://git.erikinkinen.fi/erix/integration/issues/65) stays at 15/460 accepted leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven. Ordinary mapping-domain checkpoint — 22 September 2026: [resolved admission report](https://git.erikinkinen.fi/erix/kernel/issues/23) records the original host failure and bounded fix. The [fixture regression](https://git.erikinkinen.fi/erix/kernel/issues/24) retains all three distinct failed attempts and the verified layout correction. [Kernel](https://git.erikinkinen.fi/erix/kernel/commit/ef3fd9293eaf691269fdb9e6b72eb15dac1f3f06) now validates the complete ordinary user page before backing or mapping changes, with both control paths covered. Four strict 745/769-test configurations, thirteen native builds, Clippy and private rustdoc pass without warnings. Three exact-source native executions pass lifetime, invocation and mapping; four maintained scenario contracts are checked, with sparse and isolation sharing their identical runtime capture. All fifteen selected native signatures and packaged Kernel identities verify. [Integration](https://git.erikinkinen.fi/erix/integration/commit/cd560584d034720ac179d5abc6f2a9d965943c63) pins the exact Kernel in all three catalogs, preserves every other selection and passes all 172 helpers. The unchanged ordinary exec-successor VM passes against the complete source graph, preserving its 120-second guest deadline, with no image warnings or QEMU stderr. [Docs](https://git.erikinkinen.fi/erix/docs/commit/043df99baaa9d4539da627fbfe4a234e41e74135) documents the domain and bootstrap distinction; all 45 tests and 2,431 pages pass, with 450,473 word bounds checked and no final warnings. The earlier Kernel CI 632/633 passes from four complete logs and zero warnings; current original CI remains under observation. Bootstrap provenance, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. VSpace MAP authority checkpoint — 22 September 2026: [the resolved bug report](https://git.erikinkinen.fi/erix/kernel/issues/25) records three original failing host controls and the verified correction in [Kernel](https://git.erikinkinen.fi/erix/kernel/commit/9fdf1a17acc9204719fee42d263dacfcd701d56c). Current local MAP rights now govern map, protection and unmap requests. Empty and MANAGE-only aliases are denied; MAP-only access remains valid. Four strict 750/774-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings. The [Integration catalog](https://git.erikinkinen.fi/erix/integration/commit/c62dbf9d7096d41b5d073bc497949e16f5f16e13) selects the exact signed Kernel in all three catalogs and passes all 172 helpers. Actual CPL3 calls preserve the authorized RW/NX page across restricted-alias refusals and drop all five temporary grants. Three native executions cover all four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signed sources and retained packaged artifacts. The original exec-successor service VM passes against all 73 components with its unchanged 120-second guest limit. All image warnings and QEMU stderr remain absent. [Manual validation](https://git.erikinkinen.fi/erix/docs/commit/a96c994750ed10205e7bac17be6922a53070e2d6) passes 45 tests, 2,431 pages and 450,550 checked word bounds, with both changed pages reviewed and zero final warnings. The static audit covers 3,181 authored code files below 1,000 lines, 259 exact Git dependency pins and existing direct missing_docs gates. It does not close semantic authority review. Earlier full Integration runs 1705/1706 are running; 1707–1720 remain queued at the latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel [638](https://git.erikinkinen.fi/erix/kernel/actions/runs/638)/[639](https://git.erikinkinen.fi/erix/kernel/actions/runs/639) and Docs [1009](https://git.erikinkinen.fi/erix/docs/actions/runs/1009)/[1010](https://git.erikinkinen.fi/erix/docs/actions/runs/1010) pass. Each pair has four complete logs: Kernel totals 777,250 bytes with zero warnings, and Docs totals 774,674 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration [1721](https://git.erikinkinen.fi/erix/integration/actions/runs/1721)/[1722](https://git.erikinkinen.fi/erix/integration/actions/runs/1722) remains queued; it receives no CI acceptance credit. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven. Frame access checkpoint — 22 September 2026: [the resolved bug report](https://git.erikinkinen.fi/erix/kernel/issues/26) records three original failing host controls and the verified correction in [Kernel](https://git.erikinkinen.fi/erix/kernel/commit/6671466a84cdc4994384e1b8391d6a01fa66fb09). Explicit READ now governs admission and hardware activation. No-access mappings retain backing with USER/WRITE clear and NX set; write-only and execute-only requests are rejected without adding READ. Existing protection-transition rules remain in force. Four strict 757/781-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings. The [Integration catalog](https://git.erikinkinen.fi/erix/integration/commit/b45edf143f599699f80e70a13827762d3e4da77e) selects the signed Kernel in all three catalogs and passes 172 helpers. Twenty-four actual CPL3 calls preserve earlier witnesses and cover no-access protection, write-only refusal, MAP-only frame derivation, denied READ and unmap after both frame grants are dropped. Three native executions pass four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signatures and retained packaged artifacts. The ordinary exec-successor VM passes against all 73 components with its unchanged 120-second guest limit. Builds emit no warnings and QEMU stderr is empty. [Manual validation](https://git.erikinkinen.fi/erix/docs/commit/45dae3cee4116b9387c4f3d3d2687a87f0fa340b) passes 45 tests, 2,433 pages and 450,702 checked word bounds, with the changed page reviewed and zero final warnings. Static review covers 3,182 authored code files below 1,000 lines, 259 exact Git pins and existing direct missing_docs gates. This does not close semantic authority review. Earlier full Integration runs 1705/1706 remain running and 1707–1722 remain queued at their latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel [640](https://git.erikinkinen.fi/erix/kernel/actions/runs/640)/[641](https://git.erikinkinen.fi/erix/kernel/actions/runs/641) and Docs [1011](https://git.erikinkinen.fi/erix/docs/actions/runs/1011)/[1012](https://git.erikinkinen.fi/erix/docs/actions/runs/1012) pass. Each pair has four complete logs: Kernel totals 782,838 bytes with zero warnings, and Docs totals 775,110 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration [1723](https://git.erikinkinen.fi/erix/integration/actions/runs/1723)/[1724](https://git.erikinkinen.fi/erix/integration/actions/runs/1724) remains queued; it receives no CI acceptance credit. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Authorized protection restoration, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. Ordinary protection contract — 22 September 2026: [the runtime memory design](https://git.erikinkinen.fi/erix/kernel/issues/1) now specifies in-place no-access/R/RW/RX changes using current VSpace MAP and exact selected frame authority, including same-backing aliases and complete backing checks. Preserve W^X, explicit READ, object kind, reference custody, error ordering and all native witnesses. Kernel-owned anonymous loader materialization and Process endpoint target scope retain separate audit obligations. The implementation and exact-source VM evidence are pending. This earns no canonical acceptance credit; external toolchain rebuilding and both complete EriX guest-build generations remain mandatory. Current-grant protection checkpoint — 22 September 2026: [the resolved device-backing report](https://git.erikinkinen.fi/erix/kernel/issues/27) distinguishes its original metadata-authority inconsistency from the separate restoration feature gaps. The [Kernel implementation](https://git.erikinkinen.fi/erix/kernel/commit/f5dd939c462de9d62f317ab7d29c21779cbe11c7) permits representable no-access/R/RW/RX changes through current exact-backing grants and aliases while active or inactive. It removes historical access ceilings and original-slot equality while preserving current VSpace MAP, selected frame rights, kind/range/identity checks, W^X, explicit READ, backing custody and failure ordering. Four strict 766/790-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings. The [coordinated catalog](https://git.erikinkinen.fi/erix/integration/commit/8a9f865364656351fd8b12914e404a97b0be11c7) selects that original signed Kernel in all three catalogs and passes all 172 helpers. Fifteen managed-frame calls and twenty-nine device/domain calls pass inside the original lifetime window and deadline. Actual user instructions write, execute, rewrite and execute managed RAM, check narrow alias authority and final disposal, while a reused device slot cannot authorize unrelated backing. Every prior marker remains required. Three native executions pass four original contracts with complete signed source and artifact checks; the ordinary exec-successor VM passes the full 73-component graph and original 120-second limit. Image warnings and QEMU stderr are absent. [Manual validation](https://git.erikinkinen.fi/erix/docs/commit/155b2a0cd2771cb45fa881155baf2cd0f1d1db27) passes 45 tests, 2,433 pages and 450,954 word bounds; both changed pages are reviewed with no final warnings or overflow. Static review covers 3,184 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins and 174 direct missing_docs gates. Full semantic authority review remains open. [Older Integration CI 1705/1706](https://git.erikinkinen.fi/erix/integration/issues/73) has eleven real ext4 timeouts across eight scenarios, with complete retained logs and no accepted rerun. Their root cause and correction remain unresolved. Publication CI: Kernel [642](https://git.erikinkinen.fi/erix/kernel/actions/runs/642)/[643](https://git.erikinkinen.fi/erix/kernel/actions/runs/643) and Docs [1013](https://git.erikinkinen.fi/erix/docs/actions/runs/1013)/[1014](https://git.erikinkinen.fi/erix/docs/actions/runs/1014) pass. Each pair has four complete original logs: Kernel totals 790,650 bytes with 766/790 tests and zero warning candidates; Docs totals 775,150 bytes with 45 tests, 2,433 pages and zero final warnings or overflow. Retain the original 35/1/0 LaTeX warning convergence. Integration [1725](https://git.erikinkinen.fi/erix/integration/actions/runs/1725)/[1726](https://git.erikinkinen.fi/erix/integration/actions/runs/1726) remains queued and receives no completed CI acceptance. The separate older ext4 deadline report remains open. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Complete POSIX protection support, Process endpoint scope, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. VSpace ownership preparation — 22 September 2026: Live VSpace records and production mapping tables are non-cloneable. Test observations contain descriptive metadata, synthetic selectors use independent tables, and leaf-encoder checks borrow live mappings under the record lock. Selectors accept only the mapping table they consume. Current grants, backing custody, first-match ordering, reference scans and hint visit-count controls remain intact; the rights control now uses actual activation/deactivation. The former whole-record snapshot helpers are removed. Four strict Kernel configurations pass 766/790 tests with three existing ignored cases; thirteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. All 172 Integration helpers pass. Three exact-source native executions pass the four maintained mapping, sparse, invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Original 60/120-second guest limits, existing markers, exact component signatures and retained packaged artifacts remain required; image warnings and QEMU stderr are absent. No startup speedup or independent hardware-root acceptance is inferred. The [Kernel implementation](https://git.erikinkinen.fi/erix/kernel/commit/fa9491c65d173fa618c4c0ad241a5c4fe93d28e2) and [Integration source selection](https://git.erikinkinen.fi/erix/integration/commit/c17d8f1f18f55c0d159a80772ab8e5bbad8d7f04) are published with [Kernel validation evidence](https://git.erikinkinen.fi/erix/kernel/commit/14e38ec244976759214a5421c659de9b6f27beaf) and [Integration validation evidence](https://git.erikinkinen.fi/erix/integration/commit/29d778de650ba665b1ad9f143c12ef22baf62cbc). Continue under [owned-root design 22](https://git.erikinkinen.fi/erix/kernel/issues/22), [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3) and [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). Publication CI: Kernel [644](https://git.erikinkinen.fi/erix/kernel/actions/runs/644)/[645](https://git.erikinkinen.fi/erix/kernel/actions/runs/645) pass with four complete original logs (790,604 bytes), 766/790 tests and zero warning candidates. Integration [1727](https://git.erikinkinen.fi/erix/integration/actions/runs/1727)/[1728](https://git.erikinkinen.fi/erix/integration/actions/runs/1728) remains queued and has no completed acceptance; earlier ext4 deadlines remain tracked in [Integration report 73](https://git.erikinkinen.fi/erix/integration/issues/73). Complete authority cleanup, external toolchain rebuilding within EriX and both full guest build generations remain open. Canonical acceptance remains 15/460 leaves (3.48% weighted). Managed-frame diagnostic recovery — 22 September 2026: [Kernel report 28](https://git.erikinkinen.fi/erix/kernel/issues/28) is resolved by the [signed correction](https://git.erikinkinen.fi/erix/kernel/commit/bc49d6da2684dae6073a03c422e0ea2265d03f31) and [coordinated catalog](https://git.erikinkinen.fi/erix/integration/commit/69a1303d848d629efebcc532fff73457c3ab834f). The diagnostic admits an initially empty lower-half window while preserving the ordinary-domain guard and all 64-page, alias, hole, physical-byte and cleanup controls. The unnecessary heap allocation and raw-pointer cleanup state are removed, with expanded inline rustdoc. Four strict 766/790-test configurations, fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. All 172 Integration helpers pass. Both maintained allocator scenarios pass independently with their original 60/120-second deadlines and complete markers; exact signed source and retained packaged-ELF checks pass. The ordinary exec-successor VM also passes against all 73 components. Image warnings and QEMU stderr are absent. The original failed native image remains retained; no unchanged rerun is used as the correction. Static review still covers 3,186 code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Full semantic authority and inline-documentation review remain open. Older original Integration [1707](https://git.erikinkinen.fi/erix/integration/actions/runs/1707)/[1708](https://git.erikinkinen.fi/erix/integration/actions/runs/1708) both pass all 489 VM scenarios, Rust 320/321 and Markdown; six complete logs total 26,966,330 bytes with zero warning candidates. Publication CI: Kernel [646](https://git.erikinkinen.fi/erix/kernel/actions/runs/646)/[647](https://git.erikinkinen.fi/erix/kernel/actions/runs/647) pass with four complete original logs (790,634 bytes), 766/790 tests and zero warning candidates. Integration [1729](https://git.erikinkinen.fi/erix/integration/actions/runs/1729)/[1730](https://git.erikinkinen.fi/erix/integration/actions/runs/1730) remains queued and has no completed acceptance; [earlier ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. The separate supervisor physical-access window and independent hardware roots remain implementation work. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. Supervisor physical-access window — 22 September 2026: the [signed Kernel implementation](https://git.erikinkinen.fi/erix/kernel/commit/046951899b8064be1cc90667a73e5abd2faa51ec) shares one restoring supervisor scratch transaction between frame scrubbing and physical mapping-byte copies. Caller backing custody and page-table/interrupt custody remain live through byte access, exact leaf restoration and local invalidation. Scratch is released afterward; read aliases clear the write bit and all temporary aliases clear user access and set NX. The unreachable raw-VA fallback is removed, and complete preflight rejects missing or ambiguous backing metadata before any range effects. No new userspace operation or capability grant is introduced. This is preparatory work for [owned address spaces](https://git.erikinkinen.fi/erix/kernel/issues/22); independent roots and their switching/reclamation proof remain open. Eight added host controls cover geometry, permissions, preparation and partial-effect failures, restoration/release ordering, and malformed later-page metadata without partial reads or writes. Four strict host configurations pass 774/798 tests with three existing ignored cases. Fourteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. The [coordinated Integration catalog](https://git.erikinkinen.fi/erix/integration/commit/4fe89e021e08e45e3a9ecb1c939aba03f90e5fb1) passes all 172 maintained helpers; its exact marker expectation is updated alongside the strengthened scenarios. Unchanged orchestration and profiler sources retain strict validation. Six native executions satisfy seven maintained scenario contracts. Both allocator scenarios require the new same-VA/different-backing byte-and-leaf proof after complete cleanup, retaining every preceding marker and the original 60/120-second deadlines. Three further executions satisfy mapping, sparse, owned-invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Exact original signed source, retained artifacts and packaged Kernel matches are verified; no image warnings or QEMU stderr were observed. These checks establish no performance improvement. The [technical manual](https://git.erikinkinen.fi/erix/docs/commit/589449e4172b48e31a889c82addc83096a94e02d) documents backing and scratch custody; all 45 document tests and the complete manual build pass without final warnings. Static checks cover 3,190 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Complete semantic authority and inline-documentation review remain open. Publication CI: Kernel [648](https://git.erikinkinen.fi/erix/kernel/actions/runs/648)/[649](https://git.erikinkinen.fi/erix/kernel/actions/runs/649) and Docs [1015](https://git.erikinkinen.fi/erix/docs/actions/runs/1015)/[1016](https://git.erikinkinen.fi/erix/docs/actions/runs/1016) pass. Eight complete original logs (1,572,758 bytes) confirm Kernel 774/798 tests, 45 document tests and the 2,433-page manual. Initial TeX reference warnings resolve through normal multipass generation; final passes are clean. Integration [1731](https://git.erikinkinen.fi/erix/integration/actions/runs/1731)/[1732](https://git.erikinkinen.fi/erix/integration/actions/runs/1732) remains queued and has no completed acceptance. [Earlier ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and its runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. Owned supervisor baseline — 22 September 2026: the [signed Kernel implementation](https://git.erikinkinen.fi/erix/kernel/commit/0f5049592f7801b2a2d92b1290fdcc655952f72f) captures and verifies independently allocated supervisor tables before root VSpace creation, Rootd preparation and RAM seeding. Each copied page has one typed aligned Box owner before a parent references it; the recursive entry selects the copied root. Source boot/AP tables and mapped backing retain separate custody. User leaves, malformed geometry and invalid recursive identity are refused. Leaf permissions, cache policy and huge-page sizes are preserved; newly owned table branches use WriteBack and clear USER. Failed construction releases all unpublished allocations. This replaces a raw-pointer table-storage owner with shared typed storage and adds no unsafe Send/Sync implementation or userspace operation. Eleven new host controls cover independent storage, allocation/read failures, invalid translation geometry, user leaves, recursive and huge-page errors, source-permission drift, retained owner links and table counts beyond the unrelated 64-page batch size. Four strict host configurations pass 785/809 tests with three existing ignored cases; fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The [coordinated catalog](https://git.erikinkinen.fi/erix/integration/commit/122a3d77f7f879c32eba45ccdf2eba2fd9f8d3db) passes all 172 maintained helpers. Both allocator scenarios require successful baseline capture before their original marker sequence, with capability grants and original 60/120-second deadlines preserved. Six native executions satisfy seven maintained contracts: both allocator scenarios, mapping and sparse checks sharing identical runtime settings, owned invocation, lifetime revocation and ordinary exec-successor across all 73 components. Exact signed source and retained packaged artifacts are verified; no image warnings or QEMU stderr were observed. The [technical manual](https://git.erikinkinen.fi/erix/docs/commit/18b8b7160fc2f058f059ea3c41adeca5846f9f69) specifies the custody boundary and passes 45 tests, complete 2,433-page generation, all 451,287 word bounds and changed-page visual review without final warnings or overflow. Static audits cover 3,194 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Publication CI: original Kernel [push 650](https://git.erikinkinen.fi/erix/kernel/actions/runs/650) passes and [PR 651](https://git.erikinkinen.fi/erix/kernel/actions/runs/651) retains the host fixture failure. [Regression 29](https://git.erikinkinen.fi/erix/kernel/issues/29) is resolved by [signed Kernel `12184850cd73`](https://git.erikinkinen.fi/erix/kernel/commit/12184850cd73fff066abcb7f97039a0828b2a928): a deterministic private predecessor reproduces the original defect, and the corrected fixture passes the complete local matrix and [push CI 652](https://git.erikinkinen.fi/erix/kernel/actions/runs/652)/[PR CI 653](https://git.erikinkinen.fi/erix/kernel/actions/runs/653). Four complete corrected CI logs total 807,886 bytes with zero warning candidates. Only host tests and roadmap change; validated production sources and all catalog selections remain unchanged. Docs [1017](https://git.erikinkinen.fi/erix/docs/actions/runs/1017)/[1018](https://git.erikinkinen.fi/erix/docs/actions/runs/1018) pass with four complete logs (775,122 bytes), 45 tests and the 2,433-page manual. Initial TeX reference warnings resolve before clean final passes. Integration [1733](https://git.erikinkinen.fi/erix/integration/actions/runs/1733)/[1734](https://git.erikinkinen.fi/erix/integration/actions/runs/1734) remains queued at the latest retained observation and has no completed acceptance. [Earlier ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. The retained baseline is a construction prerequisite for [owned address spaces](https://git.erikinkinen.fi/erix/kernel/issues/22). Per-VSpace population, CR3 activation, invalidation and live-root reclamation remain open, and no speedup is claimed. Full semantic authority and inline-documentation review also remain open. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. Huge-leaf geometry correction — 22 September 2026: [the bug report](https://git.erikinkinen.fi/erix/kernel/issues/30) preserves four original host failures and one passing WriteBack control. The [signed correction](https://git.erikinkinen.fi/erix/kernel/commit/4f9cfcaeb63e9080f6d6a3e9fd190e6cb288c6fc) separates PAT from physical address bits, preserves permissions/cache indices across both huge splits, and gives newly allocated tables WriteBack policy. Scalar and batched translation, split preparation, snapshots and baseline validation share the documented geometry. No new userspace authority, original native exploit or universal boot failure is claimed. Four strict Kernel configurations pass 796/820 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The [catalog](https://git.erikinkinen.fi/erix/integration/commit/ccc32eed0b4029a1ef82279c665811692c859985) passes all 172 maintained helpers. Six native executions satisfy seven original contracts: mapping and sparse, lifetime, invocation, both allocator checks and ordinary exec-successor across all 73 components. The new native witness verifies real 2 MiB PAT translation, splitting and complete restoration; host controls additionally cover 1 GiB. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The [manual](https://git.erikinkinen.fi/erix/docs/commit/587a280f59e55598e3a26b788d589955ebb84212) passes 45 tests, 2,433 pages and changed-page visual review without final warnings or overflow. Publication CI: Kernel [654](https://git.erikinkinen.fi/erix/kernel/actions/runs/654)/[655](https://git.erikinkinen.fi/erix/kernel/actions/runs/655) and Docs [1019](https://git.erikinkinen.fi/erix/docs/actions/runs/1019)/[1020](https://git.erikinkinen.fi/erix/docs/actions/runs/1020) pass. Eight complete original logs (1,592,794 bytes) confirm Kernel 796/820 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration [1735](https://git.erikinkinen.fi/erix/integration/actions/runs/1735)/[1736](https://git.erikinkinen.fi/erix/integration/actions/runs/1736) remains queued and has no completed acceptance. Earlier [ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. Static audits cover 3,197 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, live-root reclamation and full semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven. First-start register custody — 22 September 2026: [the stack-domain bug report](https://git.erikinkinen.fi/erix/kernel/issues/31) preserves three original host failures and one valid-stack control at unchanged production sources; the same four controls pass against the [signed correction](https://git.erikinkinen.fi/erix/kernel/commit/5bad7a1285089a20ee6425e0335ed3a5e96f7e29). Ordinary anonymous stack materialization now rejects addresses outside the existing user domain, and direct bootstrap writes require retained writable registered backing. Initial registers have Kernel-owned storage; stack preparation preserves the synthetic return slot, complete admission, startup arguments and rollback. The obsolete saved-frame user overlay and directory scan are removed. Complete external start-context admission and the separate bootstrap code/stack overlay remain distinct work. Four strict Kernel configurations pass 807/831 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The [catalog](https://git.erikinkinen.fi/erix/integration/commit/483da1e42cbdc79b56dea6fb0806980a128787b8) passes all 172 maintained helpers. Six native executions satisfy seven original contracts: lifetime, invocation, mapping and sparse, both allocator checks and ordinary exec-successor across all 73 components. The new witness checks all original initial register words after two real user stack mutations and before ordinary syscall capture. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The [manual](https://git.erikinkinen.fi/erix/docs/commit/57bdb2811e2a90d0121ff6de6ab58ff797806b78) passes 45 tests, 2,433 pages and four changed-page visual reviews without final warnings or overflow. Publication CI: Kernel [656](https://git.erikinkinen.fi/erix/kernel/actions/runs/656)/[657](https://git.erikinkinen.fi/erix/kernel/actions/runs/657) and Docs [1021](https://git.erikinkinen.fi/erix/docs/actions/runs/1021)/[1022](https://git.erikinkinen.fi/erix/docs/actions/runs/1022) pass. Eight complete original logs (1,600,791 bytes) confirm Kernel 807/831 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration [1737](https://git.erikinkinen.fi/erix/integration/actions/runs/1737)/[1738](https://git.erikinkinen.fi/erix/integration/actions/runs/1738) remains queued and has no completed acceptance. Earlier [ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. Static audits cover 3,201 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, CPU residency, live-root reclamation and complete semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven.

erikinkinen added the

enhancement

security

docs

refactor

phase-6

labels 2026-09-12 07:57:38 +02:00

erikinkinen referenced this issue from erix/integration 2026-09-12 08:02:00 +02:00

[FEATURE] Audit and refactor authority, lifecycle and code quality across every repository #2

erikinkinen changed title from [FEATURE] [P02.R25] Audit authority, code quality and documentation in kernel to [FEATURE] Audit authority, code quality and documentation in kernel 2026-09-12 08:02:21 +02:00

erikinkinen referenced this issue 2026-09-12 08:35:11 +02:00

WIP: Enforce native lifetime and staged construction authority #3

erikinkinen referenced this issue 2026-09-12 08:40:51 +02:00

[BUG] Parallel interrupt tests can reset each other’s pending events #4

erikinkinen referenced this issue 2026-09-12 08:49:31 +02:00

[BUG] Mapping-cleanup unit test loses its root CSpace slot in parallel CI #5

erikinkinen referenced this issue 2026-09-14 08:33:47 +02:00

[BUG] Optimized receive fixtures can select modeled stack backing #6

erikinkinen referenced this issue 2026-09-14 08:56:29 +02:00

[FEATURE] Bind a local SEND revoker to its holder's process lifetime #7

erikinkinen referenced this issue 2026-09-14 09:41:16 +02:00

[BUG] Host fixtures retain a predecessor process attribution #8

erikinkinen referenced this issue 2026-09-14 13:05:44 +02:00

[BUG] CPL3 entry can overwrite its third argument during register setup #10

erikinkinen referenced this issue 2026-09-14 13:56:58 +02:00

[FEATURE] Own native IPC requests, results and completion custody #11

erikinkinen referenced this issue 2026-09-14 14:29:11 +02:00

[BUG] Failed CSpace allocation consumes an identity before storage is reserved #12

erikinkinen referenced this issue 2026-09-15 05:18:38 +02:00

[BUG] Endpoint transfer fixtures inherit a previous non-root process #13

erikinkinen referenced this issue 2026-09-17 18:13:32 +02:00

WIP: Enforce native lifetime and staged construction authority #3

erikinkinen referenced this issue 2026-09-17 18:42:05 +02:00

[BUG] VSpace fixtures inherit a previous private process #17

erikinkinen referenced this issue from erix/integration 2026-09-19 11:36:52 +02:00

[FEATURE] Track Phase 6 POSIX compatibility and full EriX self-hosting #65

erikinkinen referenced this issue 2026-09-19 15:18:03 +02:00

[BUG] Process start must propagate grant census errors #18

erikinkinen referenced this issue 2026-09-19 15:39:29 +02:00

[FEATURE] Bind staged child cleanup to its native supervisor lifetime #19

erikinkinen referenced this issue 2026-09-21 23:45:23 +02:00

[FEATURE] Own hardware page-table roots for native address-space switching #22

erikinkinen added the

performance

label 2026-09-21 23:56:10 +02:00

erikinkinen referenced this issue 2026-09-22 07:39:20 +02:00

[BUG] Drop-local-cap window fixture inherits the previous private process #29

erikinkinen referenced this issue 2026-09-22 08:32:10 +02:00

[BUG] Huge-leaf translation and splitting confuse PAT with physical address bits #30

erikinkinen referenced this issue 2026-09-22 09:18:29 +02:00

[BUG] Initial stack materialization accepts addresses outside the ordinary user domain #31

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

feature/posix-compat

feature/native-cli

feature/phase-4-audit

feature/dynlink

feature/program-loader

feature/e2fs-fat

feature/block-devices

feature/vfs

feature/centralized-process-authority

No results found.

Labels

Clear labels

  

bug

Something is not working

  

ci

  

docs

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

performance

Measured performance profiling, bottleneck analysis, and regression budgets.

  

phase-6

Phase 6: POSIX compatibility, full EriX self-hosting, and its required audits and validation.

  

question

More information is needed

  

refactor

Code cleanup, removal of obsolete paths, and structural improvements preserving behavior.

  

security

  

wontfix

This won't be fixed

No labels

bug

ci

docs

duplicate

enhancement

help wanted

invalid

performance

phase-6

question

refactor

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

erix/kernel#2

No description provided.