[FEATURE] Own hardware page-table roots for native address-space switching #22
Labels
No labels
bug
ci
docs
duplicate
enhancement
help wanted
invalid
performance
phase-6
question
refactor
security
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
erix/kernel#22
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem and motivation
Native VSpace switches currently replay recorded mappings in the shared active page-table hierarchy. This makes each switch depend on the size of the participating address spaces, including during IPC. The executed-code investigation in Integration #3 identifies Kernel mapping batching and permission switching as leading code candidates. Those counts do not establish elapsed-time ownership or a speedup. Growing compiler heaps and threaded runtimes make this a relevant prerequisite for runtime memory and threading and complete native toolchain self-hosting.
Proposed behavior and scope
Give each native VSpace an owned hardware page-table root. Switching between already prepared address spaces must select the exact live root without replaying every recorded user mapping. Mapping creation, permission changes and revocation still update the authorized VSpace and complete required invalidation. Shared threads retain their existing VSpace identity; switching threads must preserve independent stack/TLS and process lifetime rules.
Kernel owns root construction, activation, table-page ownership and retirement. Coordinate existing Memd, Vspaced, Pagerd, Procd and Rootd consumers only where their contracts need changes. Integration owns native isolation/failure scenarios, exact-source images and profiling; Docs owns the memory, lifecycle and testing manual contracts. Preserve the native capability ABI unless a separately specified change is necessary. This is not a POSIX identity-based authority mechanism.
Authority, security and reliability
Acceptance criteria
Alternatives and tradeoffs
Further bit-expression rewrites are insufficient evidence: the first isolated permission-encoder comparison produces the same 17 instructions and 63 bytes. Scoped batching and live table hints remain useful for actual mutations, but preserving a shared hierarchy still requires per-page work on a switch. Independent roots add table ownership and invalidation complexity, so security and failure semantics precede performance. Root-layout sharing, bootstrap migration and CPU residency need explicit implementation evidence; no speedup or isolation claim follows from this proposal alone.
Tracking and rollout
Track under Kernel runtime support, Kernel authority audit, Kernel PR 3, Integration profiler, startup timing regression, and the phase completion checklist.
Sequence: freeze ownership and failure contracts; implement table ownership and construction; integrate mapping and exact-root activation; implement/validate invalidation and retirement; adopt coherent original-source images; prove native regressions and measured performance; remove replaced code. Keep full external Rust/LLVM rebuilding inside EriX and both full EriX guest-build generations mandatory and unproven until demonstrated.
Owned address-space preparation — 22 September 2026: Kernel issue 22 records the private hardware-root construction, exact authority, activation, invalidation, failure custody and retirement contract before implementation. Signed Kernel 5e818e8b6d1d, in Kernel PR 3, adds the design contract and an independent mapping-bit provenance regression. The current shared hierarchy and production permission encoder remain unchanged. An isolated rewrite produced the same 17 instructions and 63 bytes, so it was rejected as an optimization.
Four strict Kernel matrices pass 737 default / 761 all-feature tests in development and release, retaining the same three existing ignored cases. Formatting, host/native Clippy, all 13 native builds, private rustdoc and Markdown pass without warnings. Original CI 628/629 is running. No hardware-owned root, concurrent user execution, elapsed-time speedup or native isolation closure is claimed. The profiler and unchanged startup timing gates remain open in Integration 3 and Integration 72. The phase checklist stays at 15/460 accepted leaves, weighted 3.48%; external Rust/LLVM rebuilding inside EriX and both full guest-build generations remain mandatory and unproven.
Native table-custody checkpoint — 22 September 2026: signed Kernel 2e744897de7c, in Kernel PR 3, gives unpublished table allocations one cleanup owner through translation and initialization. Empty-table installation and huge splits transfer custody at parent publication. The raw allocation-return helper and duplicate huge-split initialization are removed. Parent/leaf invalidation, interrupt masking, permission templates and current shared-hierarchy lifetime remain intact. Five host controls cover allocation/translation failure, invalid geometry, abandoned preparation and publication. Four strict configurations pass 742 default / 766 all-feature tests, retaining three existing ignored cases; formatting, host/native Clippy, private rustdoc and thirteen native builds pass without warnings. Original Kernel CI 630/631 passes from four complete logs, 771,607 bytes and zero warnings.
Signed Integration fe63adde8ff9, in Integration PR 12, selects that exact Kernel in all three catalogs. Every other selection and Kernel dependency manifest is unchanged. All 172 maintained helper commands pass without warnings; unchanged Rust inputs retain their preceding strict matrices. Three original-source native executions pass lifetime revocation, owned invocation and mapping checks with unchanged 60-second guest limits, warning-free builds and empty QEMU stderr. Mapping isolation and sparse mappings have identical runtime settings; both maintained marker contracts pass on the retained mapping capture. All fifteen selected component signatures verify, and each packaged Kernel image equals its retained artifact after normal stripping. These results cover the current shared hierarchy, not independent hardware roots.
The Kernel evidence update and Integration evidence update change documentation only, with executable inputs proven unchanged. Their original Kernel CI 632/633 is running and Integration 1715/1716 is queued. Older full Integration CI 1701/1702 at b06dfad00202765491a64552dde29eaca1c24838 passes from six complete logs, 26,962,712 bytes and zero warnings, including both runs' ext4 quota, ext4 links and FAT32 directory-metadata cases. Their earlier timing failures remain retained with unestablished causes; 18, 20 and 70 have exact follow-up observations. No workflow was rerun or cancelled.
All 3,176 authored code files remain below 1,000 lines. The next work in Kernel 22 must resolve the supervisor baseline, bootstrap/saved-frame overlays and inactive-space population before adding root ownership, residency and retirement. Startup timing acceptance, complete authority cleanup and the profiler's measured speedup remain open. The phase checklist stays at 15/460 accepted leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven.
Ordinary mapping-domain checkpoint — 22 September 2026: resolved admission report records the original host failure and bounded fix. The fixture regression retains all three distinct failed attempts and the verified layout correction. Kernel now validates the complete ordinary user page before backing or mapping changes, with both control paths covered. Four strict 745/769-test configurations, thirteen native builds, Clippy and private rustdoc pass without warnings. Three exact-source native executions pass lifetime, invocation and mapping; four maintained scenario contracts are checked, with sparse and isolation sharing their identical runtime capture. All fifteen selected native signatures and packaged Kernel identities verify.
Integration pins the exact Kernel in all three catalogs, preserves every other selection and passes all 172 helpers. The unchanged ordinary exec-successor VM passes against the complete source graph, preserving its 120-second guest deadline, with no image warnings or QEMU stderr. Docs documents the domain and bootstrap distinction; all 45 tests and 2,431 pages pass, with 450,473 word bounds checked and no final warnings. The earlier Kernel CI 632/633 passes from four complete logs and zero warnings; current original CI remains under observation.
Bootstrap provenance, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.
Verified documentation and CI follow-up — 22 September 2026: Kernel documentation and Integration documentation record the accepted native mapping, three-grant cleanup and ordinary exec-successor evidence. Every executable file is identical to the tested implementation; Markdown and diff checks pass. All three failed fixture attempts remain in report 24, separately from the fixed admission defect. The complete manual passes 45 tests and 2,431 pages with no final warnings. The final static inventory covers 3,180 authored code files below 1,000 lines, 259 exact Git pins and the existing direct missing_docs declarations; it does not establish full semantic authority closure.
Original full Integration 1703/1704, source dff878dd3545c4751b3c05d37b2bdd5e21cce548, pass from six complete logs totalling 26,964,178 bytes and zero warnings. Their ext4 quota/links and FAT32 directory scenarios explicitly pass. Earlier timing failures remain retained and their causes are unestablished. Kernel 634/635 report cancelled, with runner context-cancellation messages and four complete logs. No cancellation request was issued during this work; the workflow declares no cancellation policy, and the initiating cause remains unestablished. These runs receive no CI acceptance credit. Current Kernel 636/637 and Docs 1007/1008 pass. Each pair has four complete logs: Kernel totals 773,796 bytes with zero warnings, and Docs totals 774,706 bytes with zero final warnings. Both manual builds retain their initial 35/1/0 LaTeX warning sequence through convergence. Integration 1717–1720 remains queued.
The phase checklist remains at 15/460 accepted leaves, weighted 3.48%. Private hardware roots, complete authority cleanup, measured startup improvement, native external Rust/LLVM/runtime rebuilding and both complete EriX guest-build generations remain open.
VSpace MAP authority checkpoint — 22 September 2026: the resolved bug report records three original failing host controls and the verified correction in Kernel. Current local MAP rights now govern map, protection and unmap requests. Empty and MANAGE-only aliases are denied; MAP-only access remains valid. Four strict 750/774-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.
The Integration catalog selects the exact signed Kernel in all three catalogs and passes all 172 helpers. Actual CPL3 calls preserve the authorized RW/NX page across restricted-alias refusals and drop all five temporary grants. Three native executions cover all four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signed sources and retained packaged artifacts. The original exec-successor service VM passes against all 73 components with its unchanged 120-second guest limit. All image warnings and QEMU stderr remain absent. Manual validation passes 45 tests, 2,431 pages and 450,550 checked word bounds, with both changed pages reviewed and zero final warnings.
The static audit covers 3,181 authored code files below 1,000 lines, 259 exact Git dependency pins and existing direct missing_docs gates. It does not close semantic authority review. Earlier full Integration runs 1705/1706 are running; 1707–1720 remain queued at the latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel 638/639 and Docs 1009/1010 pass. Each pair has four complete logs: Kernel totals 777,250 bytes with zero warnings, and Docs totals 774,674 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration 1721/1722 remains queued; it receives no CI acceptance credit.
Canonical acceptance remains 15/460 leaves, weighted 3.48%. Independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven.
Frame access checkpoint — 22 September 2026: the resolved bug report records three original failing host controls and the verified correction in Kernel. Explicit READ now governs admission and hardware activation. No-access mappings retain backing with USER/WRITE clear and NX set; write-only and execute-only requests are rejected without adding READ. Existing protection-transition rules remain in force. Four strict 757/781-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.
The Integration catalog selects the signed Kernel in all three catalogs and passes 172 helpers. Twenty-four actual CPL3 calls preserve earlier witnesses and cover no-access protection, write-only refusal, MAP-only frame derivation, denied READ and unmap after both frame grants are dropped. Three native executions pass four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signatures and retained packaged artifacts. The ordinary exec-successor VM passes against all 73 components with its unchanged 120-second guest limit. Builds emit no warnings and QEMU stderr is empty. Manual validation passes 45 tests, 2,433 pages and 450,702 checked word bounds, with the changed page reviewed and zero final warnings.
Static review covers 3,182 authored code files below 1,000 lines, 259 exact Git pins and existing direct missing_docs gates. This does not close semantic authority review. Earlier full Integration runs 1705/1706 remain running and 1707–1722 remain queued at their latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel 640/641 and Docs 1011/1012 pass. Each pair has four complete logs: Kernel totals 782,838 bytes with zero warnings, and Docs totals 775,110 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration 1723/1724 remains queued; it receives no CI acceptance credit.
Canonical acceptance remains 15/460 leaves, weighted 3.48%. Authorized protection restoration, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.
Ordinary protection contract — 22 September 2026: the runtime memory design now specifies in-place no-access/R/RW/RX changes using current VSpace MAP and exact selected frame authority, including same-backing aliases and complete backing checks. Preserve W^X, explicit READ, object kind, reference custody, error ordering and all native witnesses. Kernel-owned anonymous loader materialization and Process endpoint target scope retain separate audit obligations. The implementation and exact-source VM evidence are pending. This earns no canonical acceptance credit; external toolchain rebuilding and both complete EriX guest-build generations remain mandatory.
Current-grant protection checkpoint — 22 September 2026: the resolved device-backing report distinguishes its original metadata-authority inconsistency from the separate restoration feature gaps. The Kernel implementation permits representable no-access/R/RW/RX changes through current exact-backing grants and aliases while active or inactive. It removes historical access ceilings and original-slot equality while preserving current VSpace MAP, selected frame rights, kind/range/identity checks, W^X, explicit READ, backing custody and failure ordering. Four strict 766/790-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.
The coordinated catalog selects that original signed Kernel in all three catalogs and passes all 172 helpers. Fifteen managed-frame calls and twenty-nine device/domain calls pass inside the original lifetime window and deadline. Actual user instructions write, execute, rewrite and execute managed RAM, check narrow alias authority and final disposal, while a reused device slot cannot authorize unrelated backing. Every prior marker remains required. Three native executions pass four original contracts with complete signed source and artifact checks; the ordinary exec-successor VM passes the full 73-component graph and original 120-second limit. Image warnings and QEMU stderr are absent. Manual validation passes 45 tests, 2,433 pages and 450,954 word bounds; both changed pages are reviewed with no final warnings or overflow.
Static review covers 3,184 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins and 174 direct missing_docs gates. Full semantic authority review remains open. Older Integration CI 1705/1706 has eleven real ext4 timeouts across eight scenarios, with complete retained logs and no accepted rerun. Their root cause and correction remain unresolved. Publication CI: Kernel 642/643 and Docs 1013/1014 pass. Each pair has four complete original logs: Kernel totals 790,650 bytes with 766/790 tests and zero warning candidates; Docs totals 775,150 bytes with 45 tests, 2,433 pages and zero final warnings or overflow. Retain the original 35/1/0 LaTeX warning convergence. Integration 1725/1726 remains queued and receives no completed CI acceptance. The separate older ext4 deadline report remains open.
Canonical acceptance remains 15/460 leaves, weighted 3.48%. Complete POSIX protection support, Process endpoint scope, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.
VSpace ownership preparation — 22 September 2026:
Live VSpace records and production mapping tables are non-cloneable. Test observations contain descriptive metadata, synthetic selectors use independent tables, and leaf-encoder checks borrow live mappings under the record lock. Selectors accept only the mapping table they consume. Current grants, backing custody, first-match ordering, reference scans and hint visit-count controls remain intact; the rights control now uses actual activation/deactivation. The former whole-record snapshot helpers are removed.
Four strict Kernel configurations pass 766/790 tests with three existing ignored cases; thirteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. All 172 Integration helpers pass. Three exact-source native executions pass the four maintained mapping, sparse, invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Original 60/120-second guest limits, existing markers, exact component signatures and retained packaged artifacts remain required; image warnings and QEMU stderr are absent. No startup speedup or independent hardware-root acceptance is inferred.
The Kernel implementation and Integration source selection are published with Kernel validation evidence and Integration validation evidence. Continue under owned-root design 22, Kernel PR 3 and Integration PR 12. Publication CI: Kernel 644/645 pass with four complete original logs (790,604 bytes), 766/790 tests and zero warning candidates. Integration 1727/1728 remains queued and has no completed acceptance; earlier ext4 deadlines remain tracked in Integration report 73. Complete authority cleanup, external toolchain rebuilding within EriX and both full guest build generations remain open. Canonical acceptance remains 15/460 leaves (3.48% weighted).
Native occupancy diagnostic regression — 22 September 2026: the original failure is retained with exact signed source and packaged-ELF identity. The fixture maps a Kernel heap VA that the correct ordinary-domain guard rejects on the native upper-half heap. Host allocator addresses did not expose the mismatch. The correction must preserve the guard, 64-page/alias/hole/byte/cleanup controls and both maintained VM deadlines. The report was subsequently resolved by the verified recovery below. No canonical acceptance leaf closes.
Managed-frame diagnostic recovery — 22 September 2026: Kernel report 28 is resolved by the signed correction and coordinated catalog. The diagnostic admits an initially empty lower-half window while preserving the ordinary-domain guard and all 64-page, alias, hole, physical-byte and cleanup controls. The unnecessary heap allocation and raw-pointer cleanup state are removed, with expanded inline rustdoc.
Four strict 766/790-test configurations, fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. All 172 Integration helpers pass. Both maintained allocator scenarios pass independently with their original 60/120-second deadlines and complete markers; exact signed source and retained packaged-ELF checks pass. The ordinary exec-successor VM also passes against all 73 components. Image warnings and QEMU stderr are absent. The original failed native image remains retained; no unchanged rerun is used as the correction.
Static review still covers 3,186 code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Full semantic authority and inline-documentation review remain open. Older original Integration 1707/1708 both pass all 489 VM scenarios, Rust 320/321 and Markdown; six complete logs total 26,966,330 bytes with zero warning candidates. Publication CI: Kernel 646/647 pass with four complete original logs (790,634 bytes), 766/790 tests and zero warning candidates. Integration 1729/1730 remains queued and has no completed acceptance; earlier ext4 CI deadline failures remain unresolved. The separate supervisor physical-access window and independent hardware roots remain implementation work. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.
Supervisor physical-access window — 22 September 2026: the signed Kernel implementation shares one restoring supervisor scratch transaction between frame scrubbing and physical mapping-byte copies. Caller backing custody and page-table/interrupt custody remain live through byte access, exact leaf restoration and local invalidation. Scratch is released afterward; read aliases clear the write bit and all temporary aliases clear user access and set NX. The unreachable raw-VA fallback is removed, and complete preflight rejects missing or ambiguous backing metadata before any range effects. No new userspace operation or capability grant is introduced. This is preparatory work for owned address spaces; independent roots and their switching/reclamation proof remain open.
Eight added host controls cover geometry, permissions, preparation and partial-effect failures, restoration/release ordering, and malformed later-page metadata without partial reads or writes. Four strict host configurations pass 774/798 tests with three existing ignored cases. Fourteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. The coordinated Integration catalog passes all 172 maintained helpers; its exact marker expectation is updated alongside the strengthened scenarios. Unchanged orchestration and profiler sources retain strict validation.
Six native executions satisfy seven maintained scenario contracts. Both allocator scenarios require the new same-VA/different-backing byte-and-leaf proof after complete cleanup, retaining every preceding marker and the original 60/120-second deadlines. Three further executions satisfy mapping, sparse, owned-invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Exact original signed source, retained artifacts and packaged Kernel matches are verified; no image warnings or QEMU stderr were observed. These checks establish no performance improvement. The technical manual documents backing and scratch custody; all 45 document tests and the complete manual build pass without final warnings.
Static checks cover 3,190 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Complete semantic authority and inline-documentation review remain open. Publication CI: Kernel 648/649 and Docs 1015/1016 pass. Eight complete original logs (1,572,758 bytes) confirm Kernel 774/798 tests, 45 document tests and the 2,433-page manual. Initial TeX reference warnings resolve through normal multipass generation; final passes are clean. Integration 1731/1732 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and its runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.
Owned supervisor baseline — 22 September 2026: the signed Kernel implementation captures and verifies independently allocated supervisor tables before root VSpace creation, Rootd preparation and RAM seeding. Each copied page has one typed aligned Box owner before a parent references it; the recursive entry selects the copied root. Source boot/AP tables and mapped backing retain separate custody. User leaves, malformed geometry and invalid recursive identity are refused. Leaf permissions, cache policy and huge-page sizes are preserved; newly owned table branches use WriteBack and clear USER. Failed construction releases all unpublished allocations. This replaces a raw-pointer table-storage owner with shared typed storage and adds no unsafe Send/Sync implementation or userspace operation.
Eleven new host controls cover independent storage, allocation/read failures, invalid translation geometry, user leaves, recursive and huge-page errors, source-permission drift, retained owner links and table counts beyond the unrelated 64-page batch size. Four strict host configurations pass 785/809 tests with three existing ignored cases; fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The coordinated catalog passes all 172 maintained helpers. Both allocator scenarios require successful baseline capture before their original marker sequence, with capability grants and original 60/120-second deadlines preserved.
Six native executions satisfy seven maintained contracts: both allocator scenarios, mapping and sparse checks sharing identical runtime settings, owned invocation, lifetime revocation and ordinary exec-successor across all 73 components. Exact signed source and retained packaged artifacts are verified; no image warnings or QEMU stderr were observed. The technical manual specifies the custody boundary and passes 45 tests, complete 2,433-page generation, all 451,287 word bounds and changed-page visual review without final warnings or overflow. Static audits cover 3,194 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots.
Publication CI: original Kernel push 650 passes and PR 651 retains the host fixture failure. Regression 29 is resolved by signed Kernel
12184850cd73: a deterministic private predecessor reproduces the original defect, and the corrected fixture passes the complete local matrix and push CI 652/PR CI 653. Four complete corrected CI logs total 807,886 bytes with zero warning candidates. Only host tests and roadmap change; validated production sources and all catalog selections remain unchanged. Docs 1017/1018 pass with four complete logs (775,122 bytes), 45 tests and the 2,433-page manual. Initial TeX reference warnings resolve before clean final passes. Integration 1733/1734 remains queued at the latest retained observation and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. The retained baseline is a construction prerequisite for owned address spaces. Per-VSpace population, CR3 activation, invalidation and live-root reclamation remain open, and no speedup is claimed. Full semantic authority and inline-documentation review also remain open. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.Huge-leaf geometry correction — 22 September 2026: the bug report preserves four original host failures and one passing WriteBack control. The signed correction separates PAT from physical address bits, preserves permissions/cache indices across both huge splits, and gives newly allocated tables WriteBack policy. Scalar and batched translation, split preparation, snapshots and baseline validation share the documented geometry. No new userspace authority, original native exploit or universal boot failure is claimed.
Four strict Kernel configurations pass 796/820 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The catalog passes all 172 maintained helpers. Six native executions satisfy seven original contracts: mapping and sparse, lifetime, invocation, both allocator checks and ordinary exec-successor across all 73 components. The new native witness verifies real 2 MiB PAT translation, splitting and complete restoration; host controls additionally cover 1 GiB. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The manual passes 45 tests, 2,433 pages and changed-page visual review without final warnings or overflow.
Publication CI: Kernel 654/655 and Docs 1019/1020 pass. Eight complete original logs (1,592,794 bytes) confirm Kernel 796/820 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration 1735/1736 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Static audits cover 3,197 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, live-root reclamation and full semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven.
First-start register custody — 22 September 2026: the stack-domain bug report preserves three original host failures and one valid-stack control at unchanged production sources; the same four controls pass against the signed correction. Ordinary anonymous stack materialization now rejects addresses outside the existing user domain, and direct bootstrap writes require retained writable registered backing. Initial registers have Kernel-owned storage; stack preparation preserves the synthetic return slot, complete admission, startup arguments and rollback. The obsolete saved-frame user overlay and directory scan are removed. Complete external start-context admission and the separate bootstrap code/stack overlay remain distinct work.
Four strict Kernel configurations pass 807/831 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The catalog passes all 172 maintained helpers. Six native executions satisfy seven original contracts: lifetime, invocation, mapping and sparse, both allocator checks and ordinary exec-successor across all 73 components. The new witness checks all original initial register words after two real user stack mutations and before ordinary syscall capture. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The manual passes 45 tests, 2,433 pages and four changed-page visual reviews without final warnings or overflow.
Publication CI: Kernel 656/657 and Docs 1021/1022 pass. Eight complete original logs (1,600,791 bytes) confirm Kernel 807/831 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration 1737/1738 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Static audits cover 3,201 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, CPU residency, live-root reclamation and complete semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven.