rootd

rootd is the EriX bootstrap orchestrator. It validates the kernel handoff, constructs the authority graph described by boot policy, starts userspace services in dependency order, and then sheds bootstrap-only authority.

EriX is a clean-room, capability-based microkernel operating system written in Rust.

Integration VFS verification reports each completed proof through the existing logging adapter. The library selects new ERIX_ROOTD:PROGRESS:VFS:*_DONE markers only after the proof succeeds; optional-fixture checks report that the check finished, not that an optional fixture exists. The adapter requires its already supplied logd route before executing the pipeline, including read-only and verity verification, and propagates reporting failure without switching routes. Original completion markers remain after the full pipeline. Product builds, proof assertions and VM deadlines are unchanged. This is progress evidence, not a claim that the remote storage-stall failures are resolved.

See:

• docs for system design and technical requirements
• integration for image construction and VM scenarios

Purpose of This Repository

This repository owns the root-task runtime and its bootstrap policy implementation. Its maintained responsibilities are:

• validate the versioned kernel handoff and every referenced byte range
• retain validated borrowed BootConfig table views without treating configuration as authority
• execute the canonical topological service order encoded by BootConfig
• attenuate and transfer only each service's declared capability bundle
• select only authenticated TTY1 V2 terminal paths, separately from logd; no paths launch no shell, one or mirrored paths launch one, and independent framebuffer/serial paths launch two shells in distinct root-bound realms
• retire initial-shell launch aliases and temporary exact cancellation receipts after all selected START acknowledgements; partial startup cancels only the exact already-started jobs and retains cleanup failure as terminal uncertainty
• launch signed dynamically packaged executables through explicit process lifecycle interfaces
• seed service, device, storage, and filesystem policy through typed IPC
• trigger PCI discovery whenever signed BootConfig contains delegated-driver policy, independent of the selected validation profile; an Integration verifier may inspect the already-correlated discovery receipt but cannot suppress or repeat the product transaction
• execute optional integration contracts selected by semantic validation profiles while their scenario graph, startup-fault policy, transcripts, outcome policy, and extracted time, console, probe, hotplug, ACPI, driver lifecycle, normalized-input, input-authority, physical-input, interrupt, crash-reporting, logging, loader, core VFS, FAT/ext truncate, ext sparse, and FAT/exFAT/ext metadata evidence state machines, dynlinkd denial/start/ready evidence, and procd map-success evidence remain owned by the integration repository's authority-free orchestration library; one typed hardware/console runner now selects and orders hotplug through active-input verification and returns descriptive readiness products for rootd to report; startup-boundary request-ID/marker evidence is descriptive too, so rootd alone mutates startup capability routes, retires and proves absence of the pager fault source, and performs the selected explicit log effect; scenario module requirements and legacy BootConfig-role profile inference consume only a closed descriptive presence projection there, with no module descriptor or scenario choice crossing the boundary; final execution is an ordered fixed-capacity library plan carrying complete helper/extension contracts, bounded correlation ranges, and success-only descriptive completion evidence, so rootd only dispatches explicit effects and reports a completion after those effects succeed; RTC startup is requested from deviced, which owns materialization and one-shot lifecycle handling; late readiness follows that authenticated Integration-policy boundary directly and has no independent Cargo selector; the former inert framebuffer probe selector is removed too, because probe behavior is already fixed by authenticated scenario policy and the explicit fbcond/kernel fixtures; readiness-only input and multi-provider storage likewise use distinct signed BootConfig profiles instead of Cargo selectors; multiline interrupt delivery uses the signed interrupt profile and admits the COM1 fixture row only when the authenticated graph contains the exact drv-serial launch node, rather than using a rootd-local selector
• revoke bootstrap-only aliases and fail closed if cleanup cannot be confirmed

The canonical development build's exact non-physical-fixture Interactive plan uses the same authenticated zero/one/two-console runner as the product build. Authored physical-input scenarios remain interactive but retain their original runner, parent-session-ready input hook, terminal host report and authority/TTY evidence, just like explicit scripts and negative fixtures. The development package selects the existing interactive-escalation policy directly rather than borrowing the physical-powerbox fixture; its mediated session ceilings and prompt default are unchanged. With no console, rootd neither creates a TTY session nor emits a shell banner or physical-input fixture proof; service READY and logd output remain independent. Successful console completion retires all bootstrap and host-report authority before normal rootd process exit, without sending the terminal smoke-test success report that would stop surviving services. Failures and authored fixture reports are unchanged.

Hardware drivers, filesystem implementations, process policy, dynamic object resolution, and kernel resource management remain owned by their respective components.

Runtime Model

Startup is data-driven:

1. Validate handoff structure, module identities, the aligned, sorted, non-overlapping RAM extent inventory, and the exact capability inventory.
2. Parse BootConfig into lifetime-bound entry, dependency, mount, key-material, and external-journal views; reject unknown, duplicate, contradictory, or under-authorized declarations.
3. Verify that every dependency names an earlier entry and that the graph begins with the required direct-launch chain procd -> memd -> vspaced -> pagerd. No omitted, optional, reordered, inserted, or differently staged node can enter that foundation prefix. Execute the resulting canonical topological order directly.
4. Start the minimal process and memory substrate.
5. Create only the authenticated operation endpoints whose producers or consumers occur in the validated launch plan.
6. Launch remaining services through staged process creation, installing only their declared fixed endpoint roles, frames, grants, and hardware capabilities. Integration-only omission and misroute fixtures return only an optional descriptive source/destination pair; rootd validates the selected slots and remains the sole owner of the capability-transfer effect. Their descriptive evidence uses one generic best-effort boot transport with no fixture-local policy.
7. Seed and seal named, install only procd's declared pagerd, timed, and irqd target scopes, and activate a target only after that service reports ready.
8. Seed and seal runtime policy in deviced, VFS, storage, and related services as requested by BootConfig.
9. Drop every root-held operation-endpoint creator and discovery scope source, then run the selected semantic validation profile, if any.
10. Drop the exact root RAM allocator source, temporary aliases, install grants, and bootstrap query authority, except for an explicitly selected bounded initial-shell route.
11. Submit final readiness only after every declared service is ready, append a second line break to the serial and framebuffer surfaces, then retire the final debug logging authority.
12. When selected, print the light-gray EriX <integration-tag-or-commit> banner with two trailing line breaks, launch the ext4-resident shell through the authenticated ttyd/launchd transaction, observe typed terminal status, and retire its last temporary route. The canonical release build selects this bounded product hook; Integration builds use their separate evidence adapter. The fixed interactive transcript exports PATH=/bin:/usr/bin, so exsh receives command lookup state explicitly rather than inventing ambient defaults. Its complete native-command operation ceiling remains prompt-mediated by the authenticated tty session; it conveys no ambient filesystem or process authority. The shell is post-readiness user policy, not a boot service.

The bare-metal image keeps a terminal 64 KiB process-stack reserve after the deployment-sized early-link graph arena. Capacity packaging shifts that reserve with the arena, so graph initialization and cleanup cannot overwrite live stack frames.

Rootd keeps bootstrap and control messages within an 8 KiB local envelope even when storage-facing services use the wider canonical IPC transport. Early userspace has no bulk-data operation that would justify the extra stack or input surface.

Immediately after structural handoff validation, rootd derives its fixed send-only local query alias from the inherited query source. Required-module discovery and BootConfig semantics therefore cannot enter terminal cleanup without the exact absence-proof route needed to retire inherited authority. Before required-module discovery completes, terminal failures report one stable numeric boundary step through the already-installed host-report endpoint. The step is diagnostic data only: it creates no new endpoint, route, capability, or recovery authority.

Clock validation reads monotonic and wall-clock snapshots from timed. The expected values and ordering for that integration check live in the Integration library; rootd's build-gated adapter performs only the explicit typed timed calls requested by the state machine. The deterministic host-only clock simulator now lives in that library as one descriptive counter with no endpoint, clock, timer, or capability. Removing the duplicate rootd simulator shrinks rootd source by 33 lines and the compiler-qualified production baseline by 26 lines. The verifier now passes the descriptive timed route into every monotonic and wall read explicitly; rootd's stateless adapter performs one typed call, and the obsolete coarse wrapper plus its unused kernel-log/procd preconditions are absent. That final narrowing removes another 22 reviewed release-active lines and produces the then-current 15,674-line baseline. Moving the dynamic-helper policy adapter into a build-gated source file lowers the next baseline to 15,653 lines, and excluding the extension adapter lowers the next baseline to 15,634 lines. Excluding the complete negative-spawn adapter lowers the next baseline to 15,524 lines. Moving the dynamic launch constants into a build-gated thematic source and consuming Integration-owned plans lowers the current baseline to 15,514 lines. The same build-gated adapter now executes the Integration-owned bounded launch transcript one effect at a time: graph preparation, exact staging-slot retirement, create, dependency-first mapping, relocation, sealing, evidence, exact grant retirement, start, optional probe, and exact endpoint retirement. The effect API cannot split DROP from same-slot absence proof, so a lost reply cannot short-circuit proof. Rootd alone retains the borrowed graph, module bytes, and every authority-bearing route; deleting the superseded wrappers lowers the reviewed production-active surface from 15,514 to 15,325 lines while the 4,616-byte binary, eight unsafe blocks, direct syscalls, dependencies, and authority inventory remain unchanged. The deterministic host hotplug service state now lives in the same authority-free library, which also requires exact request and operation correlation for both hotplug observations. Rootd retains only the real freestanding typed IPC adapter; removing the atomic host model lowers the current baseline by another 103 lines to 15,873. The 4,616-byte binary and authority inventory remain unchanged. The deterministic host ACPI discovery model now follows the same boundary: the Integration library owns the fixed scan/device evidence and exact request, operation, device, and policy-identity correlation, while rootd retains only the freestanding typed IPC adapter. Removing the duplicate host replies lowers the current baseline by another 38 lines to 15,835. The stateless host PCI scan and known-device evidence now also live in the Integration library, which validates exact request, operation, device, and policy identities. Rootd retains the freestanding probed/deviced IPC adapter and a fail-closed non-target runtime stub, but no successful host probe model. This lowers the current baseline by another 26 lines to 15,809. The two-state host driver-lifecycle model now follows the same boundary and validates every start/read/stop correlation in the library. Rootd retains only the target deviced lifecycle adapter; its hardware observer and debug transport are no longer compiled on the host. This lowers the current baseline by another 30 lines to 15,779. The binary and authority inventory remain unchanged. The remaining target-only observer transport is now deleted as well. No VM scenario consumes its debug, numeric, or lifecycle-marker mirrors; Integration unit tests retain the descriptive transition checks without passing a kernel-log endpoint into rootd's probe, ACPI, hotplug, or driver adapters. Every authenticated service effect and evidence check is unchanged, as are all production measures. Serial and framebuffer evidence use the same effect boundary. The deterministic host serial-console lifecycle now lives in the Integration library too: it retains only driver-ready and peer-queried facts and rejects reordered or substituted requests. Rootd keeps real seriald IPC on the freestanding target, while its non-target product write path fails closed instead of fabricating success. This removes seven more release-active source lines, bringing the baseline to 15,772; the binary and authority inventory remain unchanged. The deterministic host framebuffer and normalized-input evidence now live in the Integration library as descriptive transition facts with exact request, operation, role, payload, cursor, and marker correlation. Rootd retains only the freestanding fbcond, i8042, and inputd IPC adapters; its non-target framebuffer write path fails closed. Removing the fabricated framebuffer, serial-mirror, and input replies lowers the reviewed baseline by another 76 lines to the then-current 15,696. Removing the coarse time wrapper lowers the next baseline to 15,674, and excluding the dynamic-helper policy adapter lowers the next baseline to 15,653. Excluding the extension adapter lowers the next baseline to 15,634, and excluding the complete negative-spawn adapter lowers the next baseline to 15,524. Consuming the Integration-owned dynamic launch catalog and excluding its constants file lowers the current baseline to 15,514. The binary, unsafe count, dependency set, syscall set, and authority inventory remain unchanged. The top-level hardware-console runner now issues hotplug discovery and last-event requests itself. Rootd exposes two single-IPC effects with explicit endpoint and request arguments instead of a coarse verify_hotplug adapter; its deterministic host implementation delegates to the same authority-free model. This build-gated narrowing does not change the production baseline. ACPI verification follows the same narrow boundary: the runner issues the exact deviced lookup, driver-capability query, discovery, last-scan read, and four device reads, while rootd implements one explicit operation per effect. The host delegates to the library model. Unconsumed per-operation ACPI debug observations are not transported; only the runner's top-level begin, failure, and success evidence remains. This Integration-only change also leaves every production measure unchanged. Serial verification now follows the same boundary: Integration selects the exact deviced route, serial device identity, seriald route, request identifiers, and payload before requesting one lookup, one capability query, and one typed write. Rootd rejects route substitution and performs only those operations; the prior multi-operation runner and unused IRQ endpoint guard are absent. Production measures remain unchanged. Framebuffer verification now follows that exact-effect shape as well. Integration selects the fbcond and logd descriptive routes and owns the peer, status, write, optional mirror, retained-stream, and bounded-yield transcript. Rootd validates each supplied route before performing one existing fixed-slot transport effect; the duplicate coarse framebuffer runner is absent. This build-gated narrowing leaves every production measure unchanged. Input-authority verification now uses the same exact-effect boundary. Integration owns the status, three-driver lookup, denied diagnostic, and marker transcript. Rootd validates the fixed inputd, deviced, and logd routes, binds the diagnostic effect to the i8042 endpoint returned by the exact lookup, and removes its duplicate coarse authority-partition runner. Production measures remain unchanged. Active-input verification completes the same lowering. Integration owns the lookup, injection, yield, status/event, and serial/framebuffer projection transcript. Rootd validates every fixed route and requires the injected i8042 route to match the prior authority-proof lookup; the duplicate coarse input runner is absent. Production measures remain unchanged. The semantic-bootstrap baseline links neither that library nor those validation paths. The canonical interactive product variant links only the library's authority-free shell transaction and keeps every Integration verifier, scenario-effect, and evidence-marker adapter out of rootd. The production-boundary gate checks both exact dependency closures, scans separately named bare-metal objects for scenario strings, caps the interactive hook's text increase at 16 KiB, and directly tests that only the runtime validation profile is accepted. Its objects are unique and removed on exit, so an older compiler object in a reused target directory cannot contaminate or satisfy the scan.

The checked semantic-bootstrap baseline complements that binary boundary. It builds the exact bare-metal release profile with warnings denied, derives the compiler input set from the release artifact, rejects dedicated test sources, and records release-active Rust code lines, unsafe blocks, normal dependencies, typed external decoders, direct syscall operations, and binary size. Binary size is compared only under the recorded compiler revision; semantic fields remain exact across compiler upgrades. The reviewed authority inventory has one row for every BootstrapStage, distinguishes release-reachable stages from Integration-only evidence stages, and describes root-held capability families after stage-local cleanup. Run python3 scripts/bootstrap_baseline.py to check it and use --write only after reviewing an intentional surface change. Temporary VM boundary probes are consolidated in integration_probe.rs and that file enters the crate only for unit tests or one of its six explicit rootd-integration-probe-* features. Their common call sites use compile-time cfg blocks rather than runtime-false cfg! values, so the production compiler-input set cannot absorb the probe implementation accidentally. The baseline parser has a regression for rustfmt's multiline trailing-comma form. The temporary RTC call-first probe was removed after retained serial evidence showed that the authenticated startup call queued, replied, and allowed rootd to progress. Rootd therefore uses the ordinary procd start and scheduler handoff in every build; the remaining RTC probes observe startup outcomes without modifying scheduling. The private RTC slice intentionally changes that reviewed production count from 18,735 to 19,150 Rust code lines, a net increase of 415. Of those lines, 66 implement the closed RTC-source final-use and cleanup rules, 42 bind the RTC role to one-shot lifecycle and failure cleanup, and 177 implement exact procd query/event reconciliation; the remaining 130 wire typed startup payloads, preflight checks, launch selection, completion reporting, and the stage ledger into existing modules. The increase is necessary because rootd alone owns the initial capability sources and bootstrap sequencing, while procd alone owns the managed-process record and event queue. Role 36 adds no publication, restart, named-resolution, or general-provider path. The release binary remains 4,728 bytes and the unsafe-block inventory is unchanged. A duplicate-validation audit retained only checks at distinct trust boundaries: typed startup decoding, kernel capability-kind validation, and the separate procd query and event replies. Moving the Integration-only dynlinkd denial tuple and deleting its dedicated production adapter reduce the current reviewed count by 19 lines to 19,131; the 4,728-byte release binary and eight unsafe blocks remain unchanged. Moving the adjacent dynamic-start and dynamic-ready tuples reduces the count by another 20 lines to 19,111 without changing either binary or unsafe inventory. Moving the MAP_OK value reduces the current count by one more line to 19,110; mapping, acceptance, cleanup, and failure diagnostics remain production-local. The completed MountRoot and StartRuntime transition adds 452 release-active Rust lines, bringing the reviewed count to 19,562 while staying below the 500-line slice ceiling. The compiler-derived unsafe inventory remains eight, and the optimized release binary decreases from 4,728 to 4,720 bytes. The final launchd wall-clock distribution and immediate source-retirement rule add nine release-active lines, bringing the current reviewed baseline to 19,571 lines and the optimized binary to 4,728 bytes; the unsafe inventory remains eight. The typed terminal transition adds 31 lines, bringing the final reviewed baseline to 19,602 lines while leaving the binary and unsafe count unchanged; deleting the receiver park removes ipc_recv from the direct syscall set. Moving the four cumulative dynamic-service START/READY plans into the authority-free Integration library removes 213 release-active lines, bringing the current baseline to 19,389. Exact role membership, request identifiers, marker strings, first-role selection, completion order, and descriptive route choice are no longer compiled into production; rootd retains only the explicit kernel-log and logd effects selected in Integration builds. The optimized binary remains 4,728 bytes, the unsafe inventory remains eight, and the twelve dependencies and five direct syscall operations are unchanged. Moving all scenario-specific boot-module masks and legacy role-to-profile priority removes another 412 release-active lines, bringing the reviewed count to 18,977. Production rootd now validates only the authenticated BootConfig and complete dynamic boot-artifact set at this boundary; ten fixture-only module descriptors are absent from its compiled RequiredModules state. The Integration build now also converts those descriptors to one closed 8-byte presence value inside handoff discovery, so no scenario mapping address, size, or hash survives in retained bootstrap state. Integration receives only closed 8-byte module and 4-byte role-presence values. The release binary remains 4,728 bytes, and unsafe, dependency, syscall, decoder, stage, and authority-family inventories are unchanged. Production no longer defines a scenario TestMode enum. Its signed runtime profile maps to one zero-state bootstrap context, while the full profile type compiles only for tests and explicit Integration builds. The legacy host launch catalogs now reside entirely in the authority-free Integration library; rootd borrows their descriptive role/stage rows and retains only stage validation and BootConfig execution. This removes the 779-line catalog plus its local selector without changing the bare-metal binary or authority inventories. The authenticated BootConfig validation profile is also the sole semantic scenario selector in Integration builds. Cargo enables one rootd-integration-policy boundary and retains separate switches only where a fixture changes an explicit fault injection or initial-shell transcript; it no longer duplicates the signed profile as a per-profile feature chain. The VFS verification adapters compile through that same boundary. Host fallback plans remain fixed to the runtime profile and therefore cannot emulate a different signed selection. Loader filesystem discovery, materialized-launch isolation, and cleanup-authority validation likewise use three distinct signed profile values rather than loader-specific Cargo switches. Their Integration-only loaderd calls tolerate only a pre-acceptance receiver-rebind absence: each retry re-proves the same retained generic SEND-only endpoint and shares the closed 66-retry product lifecycle ceiling. The same library supplies one typed final-verifier timing. Rootd executes module-backed proof effects before boot-module retirement, defers the storage proof until runtime is live, and skips a hardware/console proof already completed by the earlier phase. Rootd retains every module, endpoint, process, and cleanup disposition; the library receives only the signed profile value. The readiness path likewise retains only its reachable product states. The inert framebuffer-deferral and runtime-serial-only branches, their unused stage buffer, and their duplicate tests are deleted. This removes 164 reviewed production-active lines without changing the 4,616-byte image, unsafe blocks, dependency set, syscalls, stages, or capability inventory. Pre-mount and post-mount stages now also use the same readiness dispatcher. The duplicate post-mount context and routing implementation are deleted; a descriptive phase flag suppresses only the pre-mount trace helpers while preserving the prior failure-fixture and sink behavior. This removes another 65 reviewed active lines without changing the optimized image or authority. The disabled eager framebuffer-cursor branch is now deleted rather than kept as an unreachable alternate transport. Hardware verification continues from cursor zero through the Integration-owned deferred scan, so rootd no longer carries the superseded scan/capture wrapper or its duplicate tests. Production code falls by another 13 reviewed lines to 15,724; the optimized image and authority are unchanged. Integration readiness emission, internal-only retention, kernel/logd routing, serial echo order, and append-failure fatality now arrive as one authority-free disposition over report-stage and endpoint-presence facts. The shared bootstrap library owns the closed seriald/fbcond product markers and disposition, while the Integration library extends that same representation only in build-gated images. Rootd retains every request identifier, queue, retry, buffer, endpoint, and capability effect. Removing the duplicated pure matrix and its rootd tests lowers production code to 15,578 reviewed lines; the 4,616-byte image, eight unsafe blocks, and authority inventory are unchanged. The obsolete rootd-only driver-readiness catalog is also absent. Its six marker strings, two mask scanners, their endpoint projection, and four duplicate assertions were compiled only for tests and had no runtime consumer; Integration scenario manifests are the authoritative positive/negative marker contracts. Deleting that dead surface removes 296 Rust source lines, including one otherwise empty production include, and lowers the reviewed production baseline to 15,577 lines. The image, runtime behavior, and authority are unchanged. The unconsumed pre-mount READY_APPEND_CURRENT_* begin, success, and stage trace branches are deleted as well. No Integration scenario admits or rejects those diagnostics. Readiness publication, retry and fatality policy, product status, transport, and authority disposition remain unchanged. The Integration library now owns exact observable VFS trace strings, so rootd no longer rewrites debug prefixes; it retains only the explicit kernel-log and hexadecimal-output effects. The hexadecimal helper compiles only in freestanding Integration-policy builds with live verifier consumers. This cleanup lowers the reviewed production baseline from 15,577 to 15,500 Rust lines; the release image remains 4,616 bytes and the unsafe count remains eight. The authority-free Integration library also classifies its exact TRACE, READYTRACE, and DBG diagnostic namespaces. Rootd consumes the typed result and retains only the enable state plus explicit logging effects; it no longer parses those Integration namespaces in production. The reviewed production baseline consequently falls from 15,500 to 15,479 Rust lines; the release image and unsafe count remain unchanged. Named publication now obtains its fixed-width name from lib-capabi only after the role has passed that library's exact named-target policy. The former local eight-role catalog is deleted; pagerd, timed, and irqd are the only accepted targets, while rootd retains the explicit seed request and endpoint authority. This lowers the reviewed production baseline from 15,479 to 15,441 Rust lines; the 4,616-byte release image and eight unsafe blocks remain unchanged. Named seeding/activation and deviced registry seeding now follow only signed BootConfig publication flags, target scopes, and driver-policy rows in every validation profile. Removing the profile overrides lowers the reviewed production baseline from 15,441 to 15,435 Rust lines; image, unsafe, runtime, and authority measures remain unchanged. Rootd's manifest no longer forwards smoke, injected-failure, startup-authority, pre-procd cleanup, or focused VFS features. The fixture builder enables those switches directly on the optional Integration dependency, leaving no unused scenario alias in rootd's package feature table. Initial-shell transcript, launch-handle, powerbox, and trusted-terminal variants follow the same rule. Rootd retains only the rootd-integration-policy effect boundary; initial-shell and physical-input selection are direct Integration-library dependency features, with physical input implying the initial shell. Rootd queries those authority-free selections only inside its build-gated mechanical adapter and retains no parallel scenario Cargo gates. Production also no longer compiles false-valued scenario predicates or the IRQ fixture seed/seal/unmask transport. Endpoint requirements, interrupt seeding, and scenario-only deviced/input choices are evaluated only in explicit Integration builds; signed BootConfig endpoint validation and driver discovery remain product-owned. This removes another 142 release-active lines, reducing the reviewed count to 18,793 while the binary and authority inventories remain unchanged. Production startup-capability construction now compiles only the authenticated route plan and exact final-use retirement path. Startup-peer omission, misrouting, undeclared-peer injection, primary-control and explicit-endpoint fault selectors, their marker transport, and forced terminal-status overrides exist only in tests and explicit Integration builds. Removing their no-fault fallback enums and selectors saves another 252 release-active lines, reducing the reviewed count to 18,541 without changing the 4,728-byte binary, unsafe blocks, dependencies, syscalls, stages, or authority inventory. The remaining forced-terminal fixture precedence is now one closed Integration-library value. Rootd maps that authority-free enum to its existing success-only status-token update and no longer carries separate force-failure and spawn-failure branches. The consolidation removes six release-active lines, bringing the then-current production baseline to 16,045 without changing the binary or any authority measure. The exact logd-start and post-start-cleanup evidence strings are likewise library-owned. Rootd transports them only in tests or explicit Integration builds, so production cleanup and startup paths retain no corresponding log effect. Compiling out those effects removes six more release-active lines and sets the then-current baseline at 16,039; the image and authority measures remain unchanged. The dynlink-procd direct-kernel suppression prefix is also selected by the authority-free library inside rootd's existing Integration logging boundary; production logging policy contains no fixture marker namespace. Removing the table saves nine release-active lines and sets the then-current baseline at 16,030 without changing the image or authority measures. The remaining service/VFS readiness evidence catalog is selected from descriptive report-stage codes by the library. Production rootd retains only readiness state, ordering, retry, and explicit transport effects; the shared bootstrap library owns the two lifecycle-control strings and product disposition. The Integration library owns the extended emission, route, echo-order, and fatality matrix without receiving an endpoint or request identifier. Removing the other 27 strings saves 23 release-active lines and lowers the then-current baseline to 16,007; the image and authority measures remain unchanged. Post-shell authority-boundary and physical-input verification strings are also selected by the authority-free library from two descriptive facts. Rootd keeps the authenticated baseline, launch-source retirement, failure policy, logging endpoint, and marker transport; the library receives none of that authority. Dynlink readiness, pre-procd mapping, foundation process-control retention, failure-fixture ready suppression, multiple-provider selection, late markers, and Integration release-message admission no longer require false product selector functions. Their consumers compile only at the Integration boundary; product behavior is derived directly from the authenticated runtime topology and release policy. This removes another 76 release-active lines, bringing the reviewed count to 18,465 with every binary and authority measure unchanged. The remaining Integration release-image allowlist is now library-owned too. Rootd passes only a borrowed message to the pure exact-match policy and retains the explicit logd or kernel-log endpoint and transport; no logging authority enters the orchestration crate. Eight unconsumed DBG:BOOT progress and failure messages are deleted next. Typed handoff, module, BootConfig, endpoint, block-storage, and phase results remain authoritative, and the production-boundary gate rejects restoration of the removed marker family. This removes 21 release-active lines and records the then-current baseline at 17,121 lines, 4,728 bytes, and eight unsafe blocks. Deviced seed/seal failures still emitted typed warning details at that checkpoint, and source or device-control cleanup remained mandatory. Seven unconsumed debug progress messages around those operations and readiness are deleted; the release gate rejects restoration of their prefix. This removes another 29 active lines and records the then-current baseline at 17,092 lines with all other measures unchanged. Readiness and VFS mount paths next drop 22 unconsumed cursor, flush, progress, and failure strings. Retry, typed IPC correlation, response validation, stage reporting, and terminal status remain unchanged; the separately reviewed production storage trace family remains available behind the trace gate. This removes 91 active lines and records the then-current baseline at 17,001 lines. The Integration-only framebuffer verifier next drops eleven unconsumed progress and rejection strings. Its adapter no longer receives kernel-log authority; peer validation, status reads, writes, mirror append, stream scan, yielding, and fail-closed evidence evaluation remain unchanged behind the typed orchestration trait. The adapter stores only the exact fbcond slot; the logd slot is used solely for mirror preflight, and unrelated service slots do not cross the verifier boundary. Removing the logger parameter also removes one release-counted boundary line, bringing the then-current baseline to 17,000 lines; all other production measures remain unchanged. Four remaining unconsumed singleton debug messages for procd assignment, probe verification, and dynamic-map failure are deleted next. Probe execution, dynamic-map error propagation, and reverse staged-process cleanup remain typed and fail-closed. With the final production consumer gone, the serial-singleton and live-marker helpers compile only for tests and explicit Integration builds; the reviewed production baseline falls to 16,951 lines while the 4,728-byte binary and all authority measures remain unchanged. Removing raw-media verification and the transitive partition/CRC dependency then narrows the baseline to 16,461 release-active lines, a 4,616-byte optimized image, ten normal dependencies, eight unsafe blocks, and the same five direct syscall operations. The blockd client is retired at its final selector-enumeration use rather than surviving to terminal cleanup. Deleting the unconsumed launchd-only filesystem-launch warning catalog and its stable diagnostic hash then lowers the then-current baseline to 16,230 active lines without changing the image, dependency, syscall, unsafe, or authority counts. Typed validation, response classification, and exhaustive cleanup remain in the launch path; no log effect is attempted merely to describe its failure. The remaining eight specific bootstrap warning families likewise have no consumer and duplicate typed failure returns plus terminal status. Removing their formatter, stable request IDs, and warning-only log submissions lowers the then-current baseline to 16,051 active lines. The 4,616-byte image, ten normal dependencies, eight unsafe blocks, five syscalls, validation paths, and authority cleanup remain unchanged. The remaining smoke selector is now compiled only for tests and explicit Integration builds. Private numeric handoff, transport, storage, loader, startup, and ready-path telemetry had no consumer and duplicated textual or terminal evidence, so it has been removed. The production-boundary check now allows only five reviewed host-report definition/call sites and rejects the deleted telemetry helpers. This removes another 152 release-active lines and brings the reviewed base to 18,313. The signed input-subprofile handoff adds two release-counted cfg boundary lines, bringing the reviewed count to 18,315 without changing the 4,728-byte binary, unsafe blocks, dependencies, syscalls, stages, or authority inventory. The per-role module, spawn, startup, and staging debug-marker catalog also had no Integration consumer. It and its privileged log submissions are deleted; terminal status and the production framebuffer startup warning then remained the authoritative failure surfaces. This removes 118 release-active lines and brings the reviewed count to 18,197 without changing the 4,728-byte binary or any authority measure. The adjacent direct-launch telemetry is deleted on the same evidence rule. Rootd retains the cleanup-negative logd-start marker, but no longer builds or submits unconsumed module, staging, envelope, capability-transfer, or provider metadata traces. The launch record also stops retaining mount flags used only by that telemetry. This removes 432 more release-active lines and brings the reviewed count to 17,765 with the binary and authority measures unchanged. The procd startup-call and foundation-update adapters likewise no longer receive logging authority. Their 60 unconsumed status, envelope, transfer, capability, and failure markers duplicated typed results that rootd already validates and propagates. Removing that catalog saves another 249 release-active lines and brings the reviewed count to 17,516; the release binary remains 4,728 bytes and the syscall, dependency, unsafe-block, stage, and authority inventories are unchanged. Named-service seeding, sealing, activation, and dynamic staging now follow the same evidence rule. Fifteen unconsumed debug markers and their capability-query telemetry are deleted, while exact typed responses and the then-existing production warning surface remained fail-closed. This removes another 119 release-active lines and brings the reviewed count to 17,397 without changing the release binary or any authority measure. The serial verifier and seriald write adapter no longer receive kernel-log authority. Their twelve transition and transport debug markers had no consumer; peer-capability validation, typed response correlation, bounded retry, and the terminal direct-serial fallback remain unchanged. The production formatter used only by those diagnostics is compiled out as well, removing 56 release-active lines and bringing the reviewed count to 17,341. Kernel-root handoff parsing now accepts only the handoff bytes. Its former kernel-log argument existed solely for thirteen unconsumed parse-detail markers, which are deleted while all structural, module-range, allocator, alignment, ordering, and nonempty checks remain exact. Coarse phase and terminal status reporting stays outside the parser. This removes another 24 release-active lines and brings the reviewed count to 17,317. Runtime PCI discovery now accepts only the explicit probed endpoint. Its six unconsumed transport/result/counter markers and kernel-log argument are removed; the fixed request, typed backpressure retry, and terminal-result check remain unchanged. This removes another 38 release-active lines and brings the reviewed count to 17,279. Pre-procd graph construction, mapping, relocation, and sealing now receive no logging authority. Eleven unconsumed detail and failure markers are removed; the Integration-selected role-completion marker remains a separate best-effort effect after successful mapping. Every typed kernel operation and fail-closed result remains unchanged. This removes another 40 release-active lines and brings the reviewed count to 17,239. Dynamic extension and kernel-staging adapters now omit twenty-one unconsumed stage, drop, start, wait, result, and mapping-detail markers. The shared exact process-completion wait also drops its logging endpoint and two unconsumed status markers. Consumed procd-map and cleanup-fault evidence, exact identities, reverse cleanup, and result validation remain unchanged. This removes another 89 release-active lines and brings the reviewed count to 17,150. Framebuffer verification now emits each consumed event once through the reviewed debug transport. The former smoke-only forwarding wrapper duplicated the same privileged write and is deleted; marker values, order, and verifier outcomes are unchanged. This Integration-only cleanup does not change the then-current 17,150-line production baseline; subsequent reviewed reductions produce the then-current 16,002-line baseline; moving the host synthetic time source produces the then-current 15,976-line baseline. Moving the deterministic host hotplug service state produces the then-current 15,873-line baseline. Moving the deterministic host ACPI evidence into the same authority-free library produces the then-current 15,835-line baseline recorded above. Moving the stateless host probe evidence across that boundary produces the then-current 15,809-line baseline. Moving the host driver-lifecycle model and gating its target-only observer produces the then-current 15,779-line baseline. Moving the host serial-console lifecycle and deleting the fabricated successful write response produces the then-current 15,772-line baseline. Moving the host framebuffer and normalized-input evidence models across the same boundary, and deleting their fabricated transport replies, produces the then-current 15,696-line baseline. Removing the obsolete coarse time wrapper produces the then-current 15,674-line baseline. Excluding the dynamic-helper policy adapter from production compiler inputs produces the next 15,653-line baseline, and excluding the extension adapter produces the next 15,634-line baseline. Excluding the complete negative-spawn adapter produces the next 15,524-line baseline. Consuming the Integration-owned launch catalog and excluding its constants produces the current 15,514-line baseline. The companion checked threat model closes the review domain over malicious handoff, BootConfig, and module bytes; malformed service replies; forged descriptive identities; capability-receipt confusion; partial launch failure; and accidental Integration-code inclusion. It maps every release external decoder and every stage-ledger authority family to at least one threat, and anchors each required control in current source or tests. Run python3 scripts/bootstrap_threat_model.py after changing an external decoder, authority family, launch transaction, receipt contract, or production build boundary. The target semantic refactor is separately fixed by audit/bootstrap-phase-contract.json. It admits only ValidateHandoff, StartFoundation, StartCore, StartHardware, MountRoot, StartRuntime, RetireAuthority, and Exit. Authority is measured as a closed set of 13 lineages: deriving an attenuated alias stays within its input lineage, every phase output is a proper subset of its input, and Exit produces the empty set. The contract also assigns 33 bootstrap service roles to exactly one start phase, including private drv-rtc-cmos in StartRuntime, and excludes exsh, coreutils, extop, and all other ordinary programs. The checked phase chain is implemented through Exit. RetireAuthority follows exhaustive root-client cleanup, and Exit attempts exactly one final typed status report, retires its report endpoint, and calls process_exit; neither successful nor failed bootstrap has a terminal receive/parking loop. The phase-contract schema also closes its failure-evidence domain. Twelve repository-local Rust unit-test anchors cover every one of the eight phases and exactly the malformed-handoff, rejected-delegate, lost-reply, partial-capability-transfer, child-start-failure, and cleanup-failure classes. Validation rejects a missing phase or class, an invented class, a path outside src, or a stale/non-test function name. These executable anchors complement the contract's strict authority-subset rule and empty Exit postcondition. audit/bootstrap-operation-ownership.json separately closes the target operation boundary. Its seven families assign process lifecycle to procd/launchd, image materialization to loaderd/dynlinkd, publication to named, driver activation to deviced, public time to timed, namespace and mount work to vfsd, and terminal and authority policy to ttyd/powerboxd. The checker resolves each owner through the phase contract, rejects rootd or an ordinary program as an owner, and fixes five authority properties: exact authenticated routes, descriptive identities as data only, no ambient discovery, no rootd provider fallback, and cleanup before every transition. Rootd sequences bounded typed requests and reconciles receipts without taking over the operations assigned to the service owners. The same matrix is source-bound to the compiler-qualified semantic baseline: all 42 release-active protocol operation identifiers occur exactly once in 14 closed groups. Each group fixes its authenticated transport owner, semantic owner, optional target family, bounded rootd role, and retirement postcondition. Assigned service routes are distinct from scoped kernel capability plumbing and the three dedicated root-only observation, terminal, and boot-module-retirement routes. The ten direct kernel process operations are explicitly temporary foundation transport whose semantic owner is procd; they cannot be reclassified as a permanent rootd route. The checker rejects a compiler-observed addition, missing or duplicate binding, owner or family drift, rootd ownership, and authority-boundary promotion. The semantic baseline also records all 72 operation-to-source-file bindings. Moving an operation into another release compiler input, deleting its last site, or introducing it in a new product module is explicit baseline drift even when the 42-operation count stays fixed; comments and string literals remain excluded. Schema 3 closes those groups over all seven service families. Process, publication, driver, and namespace work must use their exact assigned-service groups; image materialization admits only loaderd's preparation request plus declared capability transfer to dynlinkd. Time and terminal policy are capability-transfer-only and must remain free of rootd service operations. Each row also states the provider semantics that must remain absent from rootd. The checker rejects a missing family, policy drift, a group assigned to the wrong family, or an operation added to a capability-transfer-only boundary. Together with the exact compiler-source inventory, this leaves rootd only generic sequencing, receipt reconciliation, and fail-closed retirement. Process-control routing is now selected exactly once before staging as the opaque BootstrapProcessTransport value. Its private route tag prevents consumers from constructing temporary-kernel transport or an unchecked delegated endpoint. Product bootstrap admits temporary kernel process control only for procd; every later launch carries either that exact disposition or the exact nonzero procd endpoint through staged, prepared, outcome, and retained-service state. Temporary-kernel launches also carry the entry and post-image stack top derived from the same mapped dynamic graph, preventing a capacity arena from overlapping the live child stack. The transport is deliberately neither Copy nor Clone: direct process-effect adapters take only a shared borrow, while each lifecycle transition consumes and transfers the sole owned value. Start reconciliation, abort, post-start cleanup, phase rollback, MountRoot rollback, and runtime rollback can only inspect the carried route and no longer accept a fresh mode/role choice or caller-supplied replacement procd endpoint. Both the operation-derived and explicit-slot kernel-control helpers reject all ten temporary process operations. A private transport module dispatches those operations to the fixed kernel process slot only when it receives the carried temporary route; a delegated route or a non-process operation fails closed. Runtime tests exercise both rejection directions, and the production-source audit fixes the complete direct-call, fallible-call, private-transport, and unchecked-transport site sets. The compiler-qualified source baseline is 14,678 lines; the 4,616-byte image, eight unsafe blocks, 42 operations, and 72 source bindings remain unchanged. The temporary compile-time gate and alternate start helper used by the completed RTC call-first diagnostic are absent, leaving only the ordinary RTC start path. Runtime failures now finish reverse service cleanup and source retirement and return the resulting status without attempting a second logd or seriald publication. RetireAuthority then retires every ordinary authenticated client before Exit performs the existing one-shot typed kernel host report, retires that report endpoint, and calls process_exit. This removes an unbounded output retry after the corresponding service graph has already been torn down. A missing program or command therefore reaches the terminal report even when no logging receiver can make progress, and no logging or terminal authority survives merely to report failure. Removing the duplicate terminal path lowers the reviewed production baseline from 15,000 to 14,825 lines; the 4,616-byte image, eight unsafe blocks, 42 operations, 72 source bindings, and capability inventory are unchanged. The first typed-plan implementation slice now collects every static authenticated startup endpoint route, including the supplemental procd, pagerd, and deviced bundles, into StartupRoutePlanV1. The internal plan has an exact 1.0 version and a fixed 32-transfer capacity. Before a descriptor is encoded, rootd rejects an unknown role, version drift, overflow, zero slot, non-endpoint type, rights outside send/receive/grant, or duplicate destination. This replaces separate route-emission branches without changing their wire output or granting lookup authority. Named resolution scopes and live peer routes now enter the same route plan, so static, scoped, and runtime-selected destinations share one capacity, rights, and uniqueness check. No peer route is appended after plan validation. Loader graph and private service tails enter a separate version-1.0 StartupPayloadPlanV1, which rejects role/version drift, loader-role mismatch, malformed private formats, arithmetic overflow, and a tail beyond the fixed envelope capacity before encoding. The startup-plan tracker gate and the one-way state transitions through StartRuntime are implemented. The first one-way transition is enforced in Rust. ValidateHandoff alone receives the borrowed raw handoff and returns ValidatedHandoffPhase, an owned state containing only copied module descriptors, the selected mode, bounded CPU metadata when Integration policy needs it, the explicit kernel-log slot, and a non-copy StartFoundationAuthority. The remainder of bootstrap cannot recover the raw byte slice or generic parsed header. Host-only fallback launch catalogs are excluded before macro expansion on the bare-metal target; signed BootConfig remains the sole production launch graph.

start_foundation_phase consumes that authority and launches only the exact validated procd -> memd -> vspaced -> pagerd prefix. After pagerd readiness and procd's authenticated foundation update, production runtime attempts eight independent retirements: the RAM allocator; the consumed memd, vspaced, and pagerd kernel primary-control endpoint sources; the rootd process-control source; and the inherited root TCB, CSpace, and VSpace capabilities. Any failed drop makes the transition fail closed, but does not skip another independent drop. Each drop is followed by an exact local-slot query; a lost reply is accepted only after absence is proven. Only a private StartCoreAuthority can enter the next phase. Each successful child first enters an exact-capacity, non-copy phase ledger. If a later child, readiness action, or source retirement fails, rootd cleans the current unrecorded child and every earlier child in reverse order before retiring the phase sources. Kernel-started procd uses the explicit kernel lifecycle route; procd-managed children use the authenticated procd route. Numeric process identities and generations remain descriptive and cannot select a substitute route. A confirmed procd STOP_PROCESS reply supplies the exact terminal evidence used to validate an exact process/generation WAIT, without a redundant query. A lost STOP reply is reconciled by validating the exact role, process, generation, state-matched terminal event, event status, and restart policy before consuming WAIT with the same terminal tuple. Procd leaves unrelated queued events untouched. A typed empty RETRY or BUSY response yields and repeats that same exact wait; a transient reply carrying residual identity fails closed. This admits an exact prior exit when startup rejection wins the STOP race without admitting or discarding another event. Pre-acceptance transport NOT_FOUND is retried only after rootd proves the selected local slot still contains exactly the retained generic endpoint with the caller-specified rights. The procd cleanup route requires its canonical SEND|GRANT shape and the retained logd route requires exactly SEND. Each retry re-proves that authority and yields once. The closed retry budget is 66: two scheduler rotations across the maximum 33-service signed Phase 5 graph. Exhaustion and every missing, excess, or substituted capability fail closed; no accepted request, BUSY, RETRY, or other error is resubmitted. Endpoint retirement likewise attempts the drop and then proves exact slot absence even when the drop reply is lost. Cleanup continues after every recoverable error, and its first failure takes precedence over the triggering error. Any identity, event, or absence-proof uncertainty fail-stops so kernel teardown removes the complete root CSpace. Deviced-driver rows carry an exact zero process/endpoint shape and therefore never become counterfeit root cleanup handles. Only the legacy Integration DynlinkPreProcd fixture retains rootd's process-control source after this boundary. The authority-free orchestration library selects an exact plan containing seven immediate retirement slots and the sole retained source number. Rootd carries that fact through non-copy Core, Hardware, and MountRoot phase states, then attempts DROP and proves exact absence immediately after the final direct storage launch and before any later verification or runtime-pair staging. Foundation, Core, Hardware, and MountRoot failure funnels independently attempt the same disposition; a substituted slot is rejected before an effect, and a lost DROP reply requires absence proof. Production cannot select the exception and does not compile the plan. Rootd passes 318 default and 317 all-feature tests. The reviewed production baseline falls by nine lines to 15,402; the 4,616-byte image, eight unsafe blocks, and authority inventory are unchanged. Logging and later device sources still remain, so the complete acceptance boundary remains open. The final-consumer decision for service-install retirement is no longer an encoded rootd bit mask. lib-capabi owns one closed 30-entry map from each root-held source to its exact final consumer role, including the four deviced-final and seven later deviced-consumer sources. Rootd consults it only after the separately validated install succeeds, then performs the existing exact DROP-and-absence-proof disposition. Unknown sources never enter this path. Rootd no longer carries deviced-specific final-use predicates or retirement helpers; the same catalog also drives exhaustive cleanup for absent optional consumers, including blockd. Removing the duplicated policy lowers the reviewed production baseline by another 99 lines to 15,280; the image, unsafe, syscall, decoder, stage, and authority inventories remain unchanged. The 31 wholly Integration-only adapter files now enter the crate through one integration_adapters.rs include guarded by the single rootd-integration-policy boundary. The first consolidation replaced 20 scattered crate-level cfg sites and removed scenario_policy.rs from the release compiler inputs. The follow-up folds hardware lifecycle verification, console input and verification, dynamic launch and monitoring, negative procd spawn, and VFS completion-marker adapters into the same boundary, removing eight more nested conditional include sites from production modules. The authority-free library still owns scenario policy, while every explicit endpoint and capability effect remains in rootd. The checked Integration surface falls from 268 to 240 items, classified as 227 move and 13 production validation rows. The next slice also moves integration_policy.rs behind that gate, leaving only its compile-time initial-shell source-retention result in the common mode adapter. Production fixes that value to false and therefore retires the launchd source immediately. The checked surface contracts again to 238 items, classified as 225 move and 13 production-validation rows, and the reviewed release baseline falls to 15,268 lines. The 4,616-byte image and all unsafe, dependency, syscall, decoder, stage, and authority inventories remain unchanged. The thirty-first adapter consolidates the legacy retained process-control exception's Foundation, Core, Hardware, failed-phase, and MountRoot effect implementations, which previously occupied five release-active phase files. Production retains no process-control exception; the adapter remains absent from its compiler inputs. Removing eight superseded cfg rows contracts the checked surface to 230 items, classified as 217 move and 13 production-validation rows, without changing the reviewed release baseline or any authority measure. The early dynamic-link path now consumes lib_bootstrap::boot_store_executable_name_v1 instead of carrying a second 29-role product catalog. Integration-only extension selectors remain a build-gated overlay. Post-mount and unknown roles still fail closed, and the descriptive selector grants no module, mapping, process, or capability authority. Removing the duplicate match lowers the reviewed release baseline by 31 lines to 15,237; the 4,616-byte image and every authority-relevant inventory remain unchanged. The Foundation, Core, Hardware, MountRoot storage, and StartRuntime ext4 role arrays now alias the exact shared Phase 5 catalogs in lib-bootstrap. The shared pre-staged pair completes the 33-role semantic membership contract. Rootd retains every ordering check, launch, lifecycle, endpoint, and capability effect; ordinary programs and extension roles remain outside the product catalog. Removing the four duplicate arrays lowers the reviewed release baseline by another 34 lines to 15,203 without changing the 4,616-byte image, eight unsafe blocks, dependencies, syscalls, decoders, stages, or authority inventory. The exact 22 Foundation, Core, and Hardware role/readiness/launch-owner rows now come from the corresponding lib-bootstrap signed-launch catalogs. Rootd converts the shared readiness report into its local stage type and enforces the shared rootd-direct or deviced-driver kind before making any effect. It retains the signed dependency-chain checks, selected-subsequence rules, authenticated launch routes, process ledgers, cleanup, and capability retirement. Removing the three stage tables, the hardware launch-kind table, and the product-host foundation table and its now-unneeded target-only method gate lowers the reviewed release baseline by 33 lines to 15,170; the 4,616-byte image, eight unsafe blocks, and all dependency, syscall, decoder, stage, and authority inventories remain unchanged. The remaining five MountRoot and six StartRuntime rows now consume the same shared signed-launch contract, completing exact role, readiness, and launch-owner validation for all 33 bootstrap services. Rootd proves that the adjacent dynlinkd/loaderd pair is direct-launched and that the selected ext4 suffix is filesystem-launched before entering the effect loop; its storage and suffix paths no longer carry independent stage or owner policy. The added fail-closed checks raise the reviewed production baseline by six lines to 15,176 while the 4,616-byte image, eight unsafe blocks, and every dependency, syscall, decoder, stage, and authority inventory remain unchanged. Focused coverage brings the host suites to 321 default and 320 all-feature tests. The product seriald/fbcond marker strings, exact release-admission membership, and disposition now come directly from lib-bootstrap, and the build-gated Integration policy returns that same shared type. Rootd deletes its duplicate record, field-copy adapter, marker match, product matrix, and release-filter literals while retaining every queue, retry, request, logd, kernel-log, and capability effect. The reviewed production baseline falls by 29 lines to 15,147; the 4,616-byte image, eight unsafe blocks, and every other measured authority surface remain unchanged. Integration-smoke selection now crosses one compile-time helper in mode.rs. The Integration build reads its authenticated scenario fact there, while the product build receives a constant false result. Entry-mode selection, release log suppression, and release readiness suppression no longer carry three separate positive/complement cfg pairs. The reviewed baseline falls by six more lines to 15,141; the binary, unsafe-block count, and authority inventories remain unchanged. Hardware-console Integration state now belongs to one typed context defined inside the already build-gated adapter boundary. The release-active bootstrap and hardware phase no longer carry the framebuffer cursor, runtime-mode field, or direct verifier call; they retain only one opaque guarded context crossing. Product compilation admits no context type, cursor, verifier, endpoint, transport, or capability effect. Three redundant classified cfg sites disappear while the 15,141-line, 4,616-byte, eight-unsafe-block, and authority baselines remain fixed. Build-specific bootstrap policy now has two explicit compile boundaries. Integration mode facts, module/profile projection, endpoint requirements, and the terminal-status override live in integration_policy.rs; product Foundation, Core, and Hardware retirement implementations live in the complementary bootstrap_authority/product_adapter.rs. Semantic phase files call uniform retirement and validation methods and no longer carry their positive/complement branches. Eighteen classified cfg sites disappear, the exact surface contracts to 197/186/11/0, and the reviewed production baseline falls to 15,139 lines. The 4,616-byte image, eight unsafe blocks, and every authority measure remain fixed. Integration-only handoff module recognition now crosses that boundary too. The Integration adapter owns its ten exact names, two aliases, module-type and required-flag checks, duplicate rejection, and descriptor-free presence projection. Product rootd uses a stateless observer that recognizes none of those names and retains no fixture state. A release-object assertion rejects seven distinctive fixture literals; the exact surface contracts to 196/185/11/0 and the reviewed production baseline falls to 15,097 lines while the image, unsafe blocks, dependencies, syscalls, stages, and authority inventory remain fixed. The remaining common build-policy counterparts now cross those same two adapters. Product mode identity, constants, module and endpoint validation, and host launch-row selection live only in the product adapter; Integration aliases and host launch ordering live only in integration_policy.rs. handoff.rs, required_modules.rs, and types.rs contain no Integration feature branch, the obsolete mode.rs is deleted, and product module presence is a zero-sized value. The production-boundary audit rejects restoration of those common branches. Thirteen classified cfg sites disappear, contracting the exact surface to 183/172/11/0 and the reviewed baseline to 15,095 lines; the image and every authority measure remain fixed. Validation-profile decoding and host encoding now cross the same adapters. Product accepts only the signed runtime profile; Integration maps its closed profile catalog inside integration_policy.rs. Target entry calls one uniform terminal-status hook, whose product implementation is a no-op, and the final Integration-only pre-module code lives with that hook instead of behind a common constant macro. bootcfg.rs, constants.rs, entry.rs, and status.rs now contain no Integration feature branch, and the source audit covers all seven cleaned common modules. Six more cfg sites disappear, contracting the exact surface to 177/166/11/0 and the reviewed baseline to 15,082 lines while the image and every authority measure stay fixed. Readiness and boot-log admission policy now crosses those adapters as well. Product owns its release-message allowlist, release suppression, product stage marker lookup, and ready disposition; Integration adds only its closed marker, debug/trace, suppression, and final-route policy. Common logging and ready-stamp code retains the explicit endpoint-bearing transports but no longer chooses between product and scenario policy. The source audit keeps the complete ready-stamp module branch-free and rejects restored adapter-owned definitions in either common transport module. Eight cfg sites disappear, contracting the exact surface to 169/158/11/0 and the reviewed baseline to 15,061 lines while the image and every authority measure stay fixed. The remaining Integration logging effects now live in a dedicated 103-line adapter. It owns live-marker submission, routed evidence, debug/trace enable state, and Integration marker flags, with every endpoint and request identifier passed explicitly. The common request-ID hash remains available for product terminal-status emission but carries no build branch. logging.rs is now entirely free of Integration feature policy and is covered by the source gate. Eight more cfg sites disappear, contracting the exact surface to 161/150/11/0 and the compiler-qualified product baseline to 15,006 lines while the image and every authority measure stay fixed. Console stream/status reads plus probe-history, ACPI, hotplug, and driver lifecycle effects now live in the existing explicit Integration verification adapters. Product console writes, product probe discovery, and product device reads stay in their semantic transports. The four common console/device files are Integration feature-free and source-gated; every moved call still requires its endpoint and request identifier from the caller. Ten cfg sites disappear, contracting the exact surface to 151/140/11/0 and the compiler-qualified product baseline to 14,736 lines. The accepted external typed-message surface falls from 39 to 29 because the ten corresponding verifier-only response decoders are absent from product inputs; the image, unsafe, syscalls, and every authority measure stay fixed. Initial-shell, physical-input, and loader-verification adapters now rely solely on their enclosing integration_adapters.rs admission boundary. Redundant nested Integration feature gates are removed while target-versus-host selection, explicit endpoint arguments, and fail-closed host behavior remain unchanged. The source audit rejects restoration in all three files. Eight cfg sites disappear, contracting the exact surface to 143/132/11/0; the 14,736-line product baseline, 29 accepted typed messages, image, and every authority measure remain fixed. IRQ fixture seed, seal, and mask effects now reside in a dedicated 203-line Integration adapter behind that same boundary. Product named and deviced registry behavior remains in the 183-line common hardware-seed module, which is Integration feature-free and source-gated. Every IRQD endpoint, request identity, reply check, and seed/seal/unmask order remains unchanged. Nine cfg sites disappear, contracting the exact surface to 134/123/11/0 and the compiler-qualified product baseline to 14,577 lines. The three IRQD verifier-only reply decoders leave product inputs, reducing accepted external typed messages from 29 to 26; the image, unsafe, syscall, dependency, stage, runtime-effect, and authority measures remain fixed. Integration-specific process-completion retry, terminal-state, and host-fixture policy now occupies a dedicated 70-line adapter behind the same outer boundary. The 156-line common procd host transport remains feature-free and source-gated; its WAIT operation stays available to product bootstrap cleanup and explicit dynamic effects. Endpoint and request inputs, response correlation, yielding, and fail-closed behavior are unchanged. Two cfg sites disappear, yielding an exact 132/121/11/0 surface and a 14,517-line product baseline while the 26 accepted typed messages and every other measure remain fixed. The target-only hexadecimal formatter and kernel boot-log effect used by library-owned VFS evidence now reside in the existing 148-line Integration logging adapter. The 737-line common kernel-control IPC module retains product capability operations, contains no Integration feature branch, and is source-gated. Its caller-provided kernel-log endpoint, prefix validation, exact rendering, and best-effort disposition are unchanged. One cfg site disappears, yielding 131/120/11/0 and a 14,478-line product baseline while accepted messages and every other measure remain fixed. Forced service-start failure selection now belongs to the Integration adapter's postcheck. The common procd service-start transport continues to own its caller-provided endpoint, authenticated request, correlated reply, role/status validation, and host fixture behavior, but contains no Integration feature branch and is source-gated. The complementary product postcheck always accepts an already validated READY status and receives no capability. One cfg site disappears, yielding 130/119/11/0; the explicit seam raises the reviewed product baseline by three lines to 14,481 while the 4,616-byte image, 26 accepted messages, eight unsafe blocks, and authority inventory remain fixed. Post-start cleanup evidence now belongs to the 155-line Integration logging adapter. The 986-line common cleanup module remains responsible for process kill, terminal wait, destruction, endpoint retirement, and fail-stop cleanup, but contains no Integration feature branch and is source-gated. Product builds compile a capability-free no-op disposition; Integration builds retain the same caller-provided kernel-log endpoint, marker, and best-effort behavior. One cfg site disappears, yielding 129/118/11/0 and lowering the reviewed product baseline by one line to 14,480 while the 4,616-byte image, 26 accepted messages, eight unsafe blocks, and authority inventory remain fixed. Retained pre-procd process authority now exists only in the Integration adapter's phase state. The product adapter supplies a zero-sized phase state, so the common foundation, core, and hardware tokens no longer declare conditional Option<u32> fields; the foundation and core definitions are feature-free and source-gated. Exact DROP-plus-absence handling remains in the privileged rootd adapter, and no endpoint or capability crosses into the authority-free Integration library. Three cfg sites disappear, yielding 126/115/11/0. The explicit zero-sized product boundary raises the reviewed source baseline by one line to 14,481 while the 4,616-byte image, 26 accepted messages, eight unsafe blocks, ten dependencies, five syscalls, and authority inventory remain fixed. MountRoot now invokes the build-selected authority adapter unconditionally for the retained process source's final use, failure cleanup, and success proof. It carries the source with both prepared runtime-pair nodes because a signed Integration profile can select temporary-kernel transport for loaderd. The verification transition aborts that pair before retirement, while transitions that start runtime reject and clean up any unexpectedly retained source. The deferred boundary accepts either authenticated transport only for dynlinkd or loaderd. Runtime authority exists only after absence is proved. The product implementation is capability-free and reports the source already absent; only the Integration adapter can retain and retire it. StartRuntime uses the same separation: product state is zero-sized, while only the Integration adapter stores the launchd-source disposition and executes its exact retirement. The common MountRoot phase is feature-free and source-gated. Five cfg sites disappear, yielding 121/110/11/0. The explicit product adapters raise the reviewed source baseline to 14,500 lines, but the optimized image remains 4,616 bytes and all 26 accepted messages, eight unsafe blocks, ten dependencies, five syscalls, stage counts, and authority inventories remain fixed. ValidateHandoff also uses build-selected policy state. Product state is zero-sized and capability-free; only the Integration adapter retains the descriptive CPU count required by its multicore scenario and conditionally emits the dynlink-rootd intake marker through rootd's explicit kernel-log route. The common validation phase retains every structural handoff, module, BootConfig, endpoint, and source check while becoming feature-free and source-gated. Four cfg sites disappear, yielding 117/106/11/0. The explicit product boundary raises the reviewed source baseline to 14,515 lines, but the 4,616-byte image and every message, unsafe, dependency, syscall, stage, and authority measure remain fixed. StartHardware now receives one build-selected policy state in common phase code. Product construction, readiness observation, and the post-launch policy call operate on a zero-sized, capability-free no-op state. Only the Integration adapter retains the framebuffer evidence cursor, executes hardware-console verification through explicit service routes, and borrows the live pre-retirement hardware authority token. The common phase is feature-free and source-gated. Six cfg sites disappear, yielding 111/100/11/0. The explicit product adapter raises the reviewed source baseline to 14,550 lines, but the 4,616-byte image and every message, unsafe, dependency, syscall, stage, and authority measure remain fixed. MountRoot block-storage completion now receives one build-selected policy state. Product state is zero-sized and capability-free; only the Integration adapter retains the signed scenario profile and validates the descriptive fact that multiple whole disks were observed. Device endpoints, namespace selection, blockd-source retirement, filesystem mounting, and every authority effect remain in rootd. The common storage module is feature-free and source-gated. Four cfg sites disappear, yielding 107/96/11/0. The explicit product adapter raises the reviewed source baseline to 14,566 lines, but the 4,616-byte image and every message, unsafe, dependency, syscall, stage, and authority measure remain fixed. BootConfig node finalization now invokes one build-selected post-node policy state unconditionally. Product state is zero-sized and capability-free, while the Integration adapter alone retains the signed scenario profile and selects an authority-free IRQ fixture plan. The IRQD endpoint, seed/seal/unmask calls, request correlations, reply validation, and failure mapping remain rootd-local. Common node finalization is Integration feature-free and source-gated. Two cfg sites disappear, yielding 105/94/11/0. The explicit product adapter raises the reviewed source baseline to 14,581 lines, but the 4,616-byte image and every message, unsafe, dependency, syscall, stage, and authority measure remain fixed. Startup-cap installation and its direct-launch observations now cross one build-selected policy state. Product state is zero-sized, stores no endpoint slots, preserves every declared transfer and primary-control source, and emits nothing. Only the Integration adapter retains the explicit kernel-log and logd slots, applies library-selected negative route substitutions, validates them against the declared authority, and emits startup-peer, logd-begin, pager-drop, and control-route evidence. Capability installation, source retirement, exact absence proof, and cleanup remain rootd-local. The direct and filesystem launch paths plus the common installer are Integration feature-free and source-gated. Seventeen cfg sites disappear, yielding 88/77/11/0 and lowering the reviewed product source baseline to 14,579 lines; the 4,616-byte image and every message, unsafe, dependency, syscall, stage, and authority measure remain fixed. Signed-BootConfig VFS smoke execution now crosses a build-selected compile adapter. The product macro expands directly to success without evaluating or retaining endpoint arguments; only the Integration adapter selects the authority-free storage or memory plan and invokes rootd's explicit VFS and logging effects. Filesystem mounting, the VFS endpoint, and readiness emission remain rootd-local. The common vfs_bootcfg.rs source is Integration feature-free and source-gated. Two cfg sites disappear, yielding 86/75/11/0. The explicit compile boundary raises the reviewed product source baseline by two lines to 14,581, while the 4,616-byte image and every message, unsafe, dependency, syscall, stage, and authority measure remain fixed. Pre-procd launch policy now crosses that same build-selected adapter boundary. Product code resolves only signed product executable names, launches only procd through the kernel path, and compile-elides readiness, role-evidence, and deliberate cleanup-fault arguments without retaining an endpoint. Only the Integration adapter extends the authority-free target catalog, selects the legacy kernel-launch path, snapshots the deliberate cleanup fixture, routes evidence through explicit rootd effects, and contains probe-start transport. Dynamic mapping, cleanup, endpoint use, and capability retirement remain rootd-local. The common dynlink_pre_procd.rs and launch_runtime.rs sources are Integration feature-free and source-gated. Eleven cfg sites disappear, yielding 75/64/11/0 and lowering the reviewed product source baseline by 57 lines to 14,524; the 4,616-byte image and every message, unsafe, dependency, syscall, stage, and authority measure remain fixed. Dynamic-spawn evidence now crosses a dedicated build-selected adapter too. Product macros compile-elide dynlinkd self-bootstrap denial, negative-spawn, map, START, and READY evidence arguments without reading their endpoint slots. Only the 268-line Integration adapter retains singleton-marker state, selects request and marker values, and routes them through caller-supplied rootd log effects. Common dynlink_support.rs is Integration feature-free, and common dynlink_procd_spawn.rs contains neither orchestration-library references nor evidence transport; its four remaining classified sites guard granular probe and relocation effects for the next boundary slice. Nineteen cfg sites disappear, yielding 56/45/11/0 and lowering the reviewed product source baseline by 48 lines to 14,476. The 4,616-byte image, 26 accepted messages, eight unsafe blocks, ten dependencies, five syscalls, stage counts, and authority inventory remain fixed. The final four dynamic-launch fixture effects now reside in the 769-line Integration-only effect adapter: lazy probe-page derivation, relocation-count projection, one exact relocation call, and one exact object-seal call. Each authority-bearing effect still requires its procd endpoint and correlated request/process/generation identity explicitly; no endpoint or handle enters the authority-free orchestration library. Common dynlink_procd_spawn.rs is now Integration feature-free and source-gated while retaining the complete product whole-graph map, relocation, seal, cleanup, and capability-retirement path. Four cfg sites disappear, yielding 52/41/11/0. The reviewed product source baseline falls by 118 lines to 14,358; the 4,616-byte image and every message, unsafe, dependency, syscall, stage, and authority measure remain fixed. Startup peer fault selection and undeclared-peer fixture injection now reside only in the Integration startup-capability adapter. The common startup-transfer and authenticated-route-plan files keep the explicit transfer-table effects, while build-adapter macros select product or Integration policy at compile time. Product expansion ignores fault inputs and cannot construct an undeclared transfer. Source gates keep both common files free of Integration feature checks and orchestration-library references. Twenty cfg sites disappear, yielding 32/21/11/0 and lowering the reviewed product source baseline by six lines to 14,352. The 4,616-byte image and every message, unsafe, dependency, syscall, stage, and authority measure remain fixed. Whole-bootstrap readiness routing, pre-runtime verification, scenario timing, post-runtime initial-shell/loader verification, and final debug-authority retirement now reside in a 320-line Integration-only adapter. The 506-line common bootstrap.rs has no Integration feature or library reference and uses build-selected macros with zero-sized, no-effect product state. Endpoints and capability-bearing operations remain explicit, invocation-scoped rootd inputs. Seventeen cfg sites disappear, yielding 15/4/11/0. The explicit product compile interfaces add 98 reviewed active lines, setting the source baseline to 14,450; the 4,616-byte image and every message, unsafe, dependency, syscall, stage, and authority measure remain fixed. The authority-free Integration library now owns the exhaustive final-execution action match and deferred storage-only admission rule. Rootd retains a narrow, invocation-scoped effect adapter with the explicit module view, service endpoints, kernel-log route, and every concrete launch, wait, checkpoint, and verifier effect; no authority crosses into the library. Removing the mechanical dispatcher row yields 14/3/11/0. Since execution.rs was already outside product compiler inputs, the 14,450-line source baseline, 4,616-byte image, and every runtime and authority measure remain fixed. The final residual audit classifies the two complementary crate-level adapter selection sites and rootd-integration-policy Cargo feature as the intentional product-exclusion boundary, not migratable scenario policy. Product builds compile only bootstrap_authority/product_adapter.rs and exclude the optional orchestration dependency plus every Integration effect adapter; explicit Integration builds select the opposite side. The exact checked ledger is therefore 14/0/14/0 with no remaining migration row. This classification changes no source, binary, runtime effect, or authority measure. The product kernel-control router now admits only operations used by release bootstrap. Five unreferenced kernel operations are rejected, while the resource-snapshot operation is supplied only by the build-selected Integration adapter. The compiler-qualified baseline records all 42 release-active protocol operation identifiers, so a restored or newly introduced operation requires an explicit review. The zero-effect product selector raises reviewed source by three lines to 14,453; the release image remains 4,616 bytes with eight unsafe blocks. All rootd-owned asynchronous DROP-plus-query dispositions now use one generic exact-absence primitive in authority_cleanup.rs; phase, service, named, authenticated-client, private-RTC, filesystem, staging, and retained Integration sources no longer carry parallel implementations. Exhaustive tests cover every one of the 30 shared final-use rows, a lost DROP reply, an uncertain absence result, and a non-final consumer. Private RTC cleanup no longer repeats the absence query already completed by its role-bounded retirement path. The reviewed 15,203-line, 4,616-byte, eight-unsafe-block baseline and every authority inventory remain unchanged. If startup-envelope construction fails after staging, rootd aborts that exact staged generation and independently retires the install grant, endpoint source, and service endpoint before reporting failure. A failed abort cannot skip the remaining capability drops. The next consuming transition is also explicit. start_core_phase accepts only the canonical signed prefix named -> logd -> crashd -> timed -> irqd -> deviced -> probed -> hotplugd; production requires the complete set, while a non-production validation profile may select only a prefix. No hardware node may be interleaved and no later node may reuse a core role or stage. After the selected prefix, rootd has retained a separate send-only query client and exhaustively retires the inherited time, IRQ, hotplug, platform-discovery, and transferable query sources. The log source remains outside this phase-local set because the authenticated logd client is still needed by later readiness stages and belongs to common retirement. A failed core transition reverse-cleans every core child started by that phase and attempts all five source drop-and-query dispositions. Common cleanup repeats independent dispositions as needed and retires the attenuated query client and authenticated service clients before the one-shot host report.

StartHardware applies the same phase-local ledger to serial, framebuffer, input, and block mediation processes. Deviced policy rows remain delegated zero-authority observations. A later launch or Integration-only evidence failure reverse-cleans only the root-started hardware children and then attempts every inherited hardware-source drop and exact absence proof; earlier committed core services are not falsely pulled back into the transaction. The shared retained-service record reuses MountRoot's existing exact procd cleanup identity instead of creating a second lifecycle model. The three early-phase ledgers and their fail-closed funnels intentionally increase the reviewed compiler-active surface from 15,335 to 15,680 Rust lines. The 345-line increase replaces implicit process abandonment with explicit current-child, reverse-prior-child, source-retirement, lost-reply, and partial-transfer reconciliation dispositions at three authority boundaries. Staged cleanup aborts first, then drops and proves absence of every local install grant, endpoint source, service endpoint, and published source. A previously retired source is accepted only after the same absence proof, and one uncertain proof does not skip later cleanup. Foundation, core, and hardware phase sources now use that same rule, including when DROP loses its reply. A lost procd START reply uses one shared exact query validator for both boot-module and ext4 launches. Exact STAGED evidence selects abort, exact RUNNING evidence continues startup, and a substituted operation, role, process, generation, event, restart policy, or terminal state fail-stops. A started ext4-service failure also drops and proves its optional published source absent even when the drop reply is lost. These additions move the reviewed active baseline to 15,827 lines. Terminal retirement now applies the same proof to every created named-resolution source, authenticated service source, ordinary root service client, and private RTC source. Root clients retire before the attenuated query alias; that alias is dropped last through the synchronous local-cap syscall, whose result is its absence receipt. This adds 22 reviewed lines for a 15,849-line baseline. The optimized release remains 4,616 bytes; unsafe blocks, dependencies, direct syscalls, decoders, stages, and authority families are unchanged.

MountRoot namespace and loader-materialization source retirement now delegates to the same exact DROP-then-query contract through a transition-local injected boundary. A lost DROP reply succeeds only when the matching slot is proven absent, and one proof failure cannot skip any later independent source. The two focused transition tests and injectable boundary add ten reviewed production lines, bringing the baseline to 15,859 lines without changing the 4,616-byte binary or any authority, unsafe, dependency, syscall, decoder, or stage count. The ext4-only one-shot RTC completion path now gives its local service endpoint the same exact DROP-then-query disposition. A lost DROP reply succeeds only after the expected role-derived slot is proven absent, while a substituted slot is rejected before any capability effect. Clean completion then emits the descriptive stage and routed ERIX_ROOTD:READY:RTC_PROVIDER evidence through the already retained send-only logd adapter; it does not reacquire retired kernel reporting authority. The role-specific proof boundary and tests add 23 reviewed production lines for a 15,882-line baseline; the binary and every other semantic measure remain unchanged. The StartRuntime failure funnel now exposes its complete cleanup sequence to deterministic injection without introducing a second production policy. It aborts both pending leases in reverse order, reverse-cleans every started service, retires authenticated service sources, and retires both private RTC sources even after an earlier cleanup fails; the first cleanup failure remains authoritative. The shared boundary and its exact-order regression add 21 reviewed production lines for a 15,903-line baseline. The 4,616-byte binary, eight unsafe blocks, and every authority inventory remain unchanged. RetireAuthority now has the same complete sequencing proof. Its injected descriptive boundary attempts named-resolution, authenticated-service, private RTC, core, hardware, and root-service-client retirement in that order. Later families still run after failure and the first cleanup error remains authoritative. Only after all six families does Exit perform the terminal host report; a failed report cannot skip host-report endpoint retirement. The current reviewed production baseline is 14,825 lines without changing the binary, unsafe count, or authority inventory. The final host-report receipt is accepted only when the syscall status, message header result, typed response result, operation, and zero-valued response fields agree exactly. A substituted or internally inconsistent receipt selects the existing internal-error exit path, while report-endpoint retirement still runs. The shared receipt validator adds 28 reviewed production lines for a 15,966-line baseline; the optimized binary remains 4,616 bytes and the unsafe, authority, dependency, syscall, decoder, and stage inventories do not change. The authority-ledger regression now drives an actually malformed empty handoff through validation, every independent terminal retirement family, the terminal status boundary, final reporting, report-endpoint retirement, and Exit. A rejected delegated-driver receipt is likewise passed directly from the shared shape validator into reverse prior-child cleanup and phase-source retirement; the first cleanup error wins without skipping later authority. These are test-only proofs and add no production code or authority surface. Initial-shell and physical-input selection now comes exclusively from the authority-free Integration dependency. Removing both rootd scenario features requires one cfg-scoped launchd-source retention constant: production fixes it to immediate retirement, while Integration binds it to the library selection. Those two reviewed active lines bring the current baseline to 15,968; the 4,616-byte binary, eight unsafe blocks, and every authority inventory remain unchanged. Timed-service verification policy remains in the authority-free Integration library, while rootd retains only the explicit timed IPC adapter. That adapter is now isolated in one crate-level Integration-gated source file instead of being interleaved with production named-publication code behind repeated item attributes. The stronger compile boundary removes 50 compiler-active production lines and both timed-response decoder types, yielding a 15,918-line baseline without changing the 4,616-byte binary, eight unsafe blocks, or any authority inventory. The VFS verifier transport now follows the same file-level rule. Production retains only the 37-line path encoder and mount transport core; the explicit file-operation adapter is compiled solely behind the crate-level Integration gate. This replaces twelve item gates with one include gate, corrects the reviewed production surface to 15,691 lines, and removes seven VFS verifier response types from the production decoder inventory without changing the binary or any authority. Deviced startup now retires all four child-only public endpoint sources through the shared exhaustive DROP-then-query disposition immediately after their final installs. A lost DROP reply is accepted only after exact local-slot absence proof, a failed proof cannot skip another independent source, and the first uncertain disposition remains authoritative. The focused boundary adds 12 reviewed production lines for a 15,703-line baseline; the release binary, unsafe count, and authority inventory remain unchanged. The seven root-retained deviced consumer sources now receive the same exact final-use proof when their probed, hotplugd, seriald, inputd, or blockd transfer completes. Sources for an absent optional consumer are retired exhaustively after deviced registry sealing, so one failed proof cannot skip another unused source. The reviewed boundary adds 39 production lines for a 15,742-line baseline without changing the release binary, unsafe count, or authority inventory. After deviced startup, rootd now retires its sole optional device-management capability, SLOT_IRQ_CONTROL, through the same DROP-then-query rule. A lost DROP reply must be resolved by exact absence proof before bootstrap proceeds. The focused correction adds 12 production lines for a 15,754-line baseline; binary size, unsafe count, and authority inventory remain unchanged. Pager fault-delivery source retirement now uses the same shared disposition. Even when the DROP reply is lost, rootd queries the exact source slot before continuing; the bespoke response validator and its proof-skipping error path are removed without changing the production baseline or authority inventory. Kernel and procd dynamic staging now share one exact three-slot scratch disposition for the install grant, endpoint source, and service endpoint. The helper runs before staging and again on staged-failure cleanup, always attempts all three DROP/query pairs, and retains the first failed proof. This adds 30 reviewed production lines for a 15,784-line baseline without changing binary, unsafe, or authority inventories. Integration-only dynamic launch and negative-spawn adapters expose that disposition only as exact retirement. No adapter method can issue DROP without the same-slot absence proof, including the one-shot install grant. The Integration-only legacy procd-spawn negative adapter applies the same closed three-slot absence contract before process creation and after an exact staged-process abort. A lost DROP reply is accepted only after an exact local absence proof, every later slot is still attempted after a proof failure, and an abort failure retains cleanup precedence. Its serial proof markers are best-effort observations: a lost marker reply cannot convert an already proven cleanup into a runtime bootstrap failure, while the host still fails closed if required evidence is absent. Each negative role constructs and releases its link graph before the ordinary positive graph acquires rootd's singleton deployment arena; no graph storage or descriptive image state remains live across that boundary. Because this adapter is excluded from production, the 15,802-line production baseline, 4,616-byte release binary, eight unsafe blocks, and authority inventory remain unchanged. The adapter executes the memd, named, and deviced transcripts together before memd staging. Their resource snapshots use the still-live explicit Foundation process source, which is then retired at the unchanged Foundation boundary instead of being retained solely for later integration probes. Post-start kernel service cleanup now retires the root-local service endpoint with DROP followed by an exact absence query after kill, terminal wait, and process destruction. A lost DROP reply is accepted only after proof, while any earlier lifecycle failure still permits the endpoint disposition attempt. The focused correction adds one reviewed production line for a 15,803-line baseline; the 4,616-byte binary, eight unsafe blocks, and authority inventory remain unchanged. Filesystem launch request-source replacement now retires and exactly proves the old canonical slot absent before copying the new attenuated SEND|GRANT source. A lost DROP reply can proceed only after that proof, while residual or uncertain authority prevents the copy. Reusing the shared disposition adds four reviewed production lines for a 15,807-line baseline; the binary, unsafe count, and authority inventory remain unchanged. Root-direct BootConfig staging now disposes the temporary process-endpoint and install-grant receipts as one ordered exact set after their final transfer. Every DROP is followed by an absence query, and a failed proof for the first receipt cannot skip disposition of the second. Replacing the two short-circuiting branches removes six production lines for a 15,801-line baseline; the binary, unsafe count, and authority inventory remain unchanged. Loaderd preparation cleanup now derives a procd abort identity only from an exact success reply bound to the request, transaction, role, child endpoint, loader receipt sources, header result, and runtime-graph digest. An exact service failure carries no process identity; malformed or substituted correlation retires both fixed root-local receipts and fail-stops without issuing an attacker-selected abort. The focused correction adds 31 reviewed production lines for a 15,832-line baseline; the 4,616-byte binary, eight unsafe blocks, and authority inventory remain unchanged. Transport failure or an invalid loader preparation envelope is likewise an unknown completion, because loaderd may already have staged a process before the caller can authenticate an abort identity. Rootd exhaustively retires and proves both fixed receipts absent, ignores cleanup failure as a recoverable outcome, and fail-stops. Correlated explicit loader failure remains the sole recoverable no-child result. This adds eleven reviewed production lines for a 15,843-line baseline; the binary, unsafe count, and authority inventory remain unchanged. Direct procd dynamic creation now applies the same committed-completion rule. Rootd binds the authenticated header result to the exact request, operation, child endpoint, and complete process identity before using that identity. A transport, decode, or correlation failure first attempts all three fixed local slot dispositions and then fail-stops. An exact non-success is recoverable only after those slots are proved absent. If an exact success carries missing or invalid receipts, rootd aborts the authenticated staged generation and retires all three slots; cleanup uncertainty fail-stops. This adds 67 reviewed production lines for a 15,910-line baseline without granting any new authority. All procd staged-abort cleanup now uses one bounded idempotent completion boundary. An exact OK response proves the staged generation was retired, and an exact NOT_FOUND response proves the same identity is already absent. A transport, decode, result, or correlation failure retries the identical abort once; a second uncertain result fail-stops. This replaces ordinary error propagation across dynamic, filesystem, loader, and Integration-only cleanup without introducing query authority or caller-selected cleanup identity. The focused correction adds 31 reviewed production lines for a 15,941-line baseline; binary, unsafe, dependency, syscall, stage, and authority inventories remain unchanged. Staged dynamic MAP, APPLY_RELOCATION, and SEAL receipts now also require the IPC header and typed body result to agree, in addition to their exact request, operation, process, staged generation, and object selector. A mismatch returns into the existing authenticated-generation abort boundary; it cannot be accepted as a successful graph mutation. The focused binding adds ten reviewed production lines for a 15,951-line baseline, with all other measured inventories unchanged. Boot-module services now submit their already validated relocations to procd in ordered batches of at most 64 records, flushing at each object and relocation table boundary. Each request is at most 1,096 bytes including the IPC header; the caller yields once per completed batch instead of once per relocation. The Root-only route preserves the exact unstarted process generation, object, and kernel-checked write authority. Ordinals remain descriptive correlation, not replay authority. Rootd accepts only a receipt-free, exactly correlated complete success; a partial write, typed failure, or uncertain reply enters the existing exact-generation abort and local-authority retirement boundary without retrying an accepted batch. No object is sealed or child started after failure. Named registry SEED, SEAL, and publication ACTIVATE receipts now bind the IPC-header result to the already exact typed response request and operation. This includes the authority-bearing activation call: conflicting completion evidence cannot be treated as successful publication, and phase failure cleanup retains responsibility for every started service and publication source. The focused binding adds 13 reviewed production lines for a 15,964-line baseline; all other measured inventories remain unchanged. Serial readiness writes now require both the IPC-header and typed response to report OK before their byte count can certify complete delivery. Serial and direct framebuffer completion additionally require that count to equal the exact requested length; partial and over-reported writes cannot advance the terminal READY visibility barrier. Transient status retains the existing retry path. The reviewed 15,966-line baseline and all other measured inventories remain unchanged; both test matrices pass 335 tests. Loaderd filesystem staging now gives its root-local install-grant and process endpoint receipts one shared DROP/query disposition. The pair is retired both after successful capability installation and during loader preparation cleanup; neither a lost reply nor an earlier proof failure can skip the other receipt. This adds 18 reviewed production lines for a 15,802-line baseline with unchanged binary, unsafe, and authority inventories.

MountRoot consumes the post-hardware authority before the first storage launch. It accepts only the four closed signed storage sequences, retains exact move-only process dispositions for reverse cleanup, completes the nonempty signed mount table for every validation profile, and retires the root VFS namespace source at its final use. Dynlinkd and loaderd are then fully staged but not started; their startup envelopes, graph digest, identities, and exact procd leases are owned and bounded, while installation grants and scratch sources are retired. After the borrowed BootConfig and module views are dropped, the phase invokes the zero-argument root-only kernel retirement operation. The kernel chooses and unmaps its sealed boot-blob set and consumes the endpoint; rootd accepts only an exact nonzero receipt and fail-stops on any transport or receipt uncertainty.

StartRuntime consumes that plan and starts dynlinkd followed by loaderd, then the exact ext4 suffix of optional drv-rtc-cmos, ttyd, powerboxd, and launchd. Each source is retired and proved absent immediately after its final install and before START. CMOS I/O remains the single typed primary-control route; the private timed provider is one authenticated send-only transfer. Failures reverse-clean the current and prior services through exact procd STOP/QUERY/WAIT reconciliation, while success relinquishes the exact committed ledger to procd. No borrowed boot metadata, repeatable staged lease, install grant, or boot-module mapping crosses MountRoot.

Production always executes the complete StartRuntime transition. A build-gated Integration image may instead finish a completed legacy-media proof by aborting both prepared leases, or start only the pair required by a loader fixture. Both reduced test dispositions retire their authenticated service and private RTC sources before readiness; only the dedicated ext4 runtime image enables the full filesystem suffix.

The additional typed boundaries and explicit retirement sets raise the audited production source from 18,011 to 18,620 Rust lines, still 230 lines below the pre-refactor 18,850-line baseline; the optimized binary remains 4,728 bytes, unsafe blocks remain eight, and dependencies, accepted operations, stages, and wire output are unchanged. The existing typed procd stop response is now one reviewed production decoder. The retirement path emits no best-effort debug marker: exhaustive unit tests assert the individual drop attempts, while later product stage markers prove that the residual bootstrap remains live without retaining logging authority for test evidence. Host simulation state, synthetic completion behavior, and test-only marker helpers are now compiled only for tests, Integration policy, or the bare-metal runtime path that actually consumes them. A warning-denied default host build therefore no longer admits dormant Integration helpers. The current BootConfig ingress now enforces the target's foundation boundary: the first four required direct-launch nodes and their readiness stages must be exactly procd, memd, vspaced, and pagerd, joined by the three exact hard dependency edges in that order. The general graph gate independently rejects duplicate roles, undeclared edges, and cycles. Later nodes cannot reuse a foundation role or readiness stage, so descriptive BootConfig data cannot silently expand StartFoundation. Probe, hotplug, ACPI, and driver lifecycle validation use the same boundary. Their Integration-owned traits require the probed, hotplugd, deviced, or returned private driver endpoint, request identifier, device selector, and bounded request arguments on every call. Rootd retains only a build-gated adapter that performs that exact typed IPC and emits the library-owned diagnostic event; it no longer decides the request sequence or accepted evidence. On the host, the Integration library supplies the deterministic hotplug insert/remove model directly; no mutable simulator state remains in rootd, and the target adapter remains the only implementation that performs hotplug IPC. The library likewise supplies the fixed host ACPI scan and device records and validates their complete correlation fields; only the target adapter can perform drv-acpi and deviced IPC. The runner selects the exact lookup, query, discovery, snapshot, and device-read sequence, and each rootd effect performs one operation. Serial verification likewise supplies its deviced and seriald routes explicitly and reduces rootd to one lookup, one capability query, and one write effect. The same is now true for probe evidence: host verification uses the library model, the non-target product stub fails closed, and only the target adapter can successfully call probed/deviced. Driver lifecycle verification likewise uses the library's descriptive host state; only the target adapter performs start/read/stop IPC or emits its debug observations. In an Integration build, only a signed profile that runs that verifier requests the private driver-hold and driver-capcheck catalog artifacts for deviced seeding. They remain outside the canonical product BootConfig topology; the product adapter requests neither fixture, and every target seed still uses the explicit deviced administrative route and catalog-validated image bounds. Normalized-input, input-authority, and physical-input validation also use that boundary. Rootd retains no input producer route; its adapter performs only the explicit deviced lookup, typed i8042/inputd reads, retained console reads, log write, or cooperative yield selected by Integration policy. The library owns the expected producer identities, projection evidence, diagnostic denial, counter baselines, and exact trusted-control delta. Interrupt verification uses the same boundary. Integration policy owns the line-bound client request, semantic role, accepted terminal status, and the profile-specific success marker. Rootd's adapter exposes launch and exact wait as separate effects: launch returns only a descriptive process identity, and wait consumes that identity and returns the correlated terminal observation. Integration rejects substitution before the marker effect. The adapter receives only explicit procd and logd endpoints; numeric process identities and request identifiers remain descriptive and confer no authority. Crash-reporting verification also follows this boundary. Integration owns the fault-client role and flags, expected terminal reason, crashd cursor/correlation rules, cooperative retry policy, and optional dynamic marker. Rootd receives only explicit procd, crashd, and logd endpoints. Its launch effect returns a descriptive process identity, its exact wait consumes that identity and returns the terminal observation, and Integration rejects substitution before crashd reads. Rootd relinquishes the launched client endpoint before observation and retains no report or child authority. Dynamic bootstrap helpers and extensions now use the same split effect boundary. Integration supplies the request identity, semantic role, launch flags, child-local endpoint slot, and expected terminal result from one closed catalog. Rootd retains the module graph, procd endpoint, capability transfer, staging and cleanup authority, exact launch transport, and exact terminal wait; it treats the supplied child slot as an explicit effect argument rather than selecting it locally. After the runtime transition disposes the prepared pair and retires the final direct kernel process-control source, the five-helper and bounded stress paths use only their explicit procd route and exact one-shot lifecycle results. They neither retain nor reacquire the retired source for global resource snapshots. Pre-procd negative tests keep their resource comparison because they execute before that source's final use. The required five-helper completion evidence is submitted through Rootd's retained send-only logd route, which performs the explicit serial projection; the helper path does not reuse the retired direct kernel-log route. The stress path retains all 1,000 exact lifecycles but launches them in 250 Integration-selected batches of at most four. Rootd authenticates the complete signed exit dependency graph, including its relocation tables, then sends a receipt-free batch request over its retained procd route. Procd asks the kernel to map, relocate, and seal that closed graph and returns only distinct process/generation identities; Rootd resubmits the exact unobserved suffix until procd validates status 42 and releases every generation-bound record. Rootd receives no child endpoint or install grant in this path. It submits one fixed progress marker through its retained send-only logd route only after a complete batch drains, and a distinct completion marker only after all 1,000 exact observations. Focused VM runs exhausted the fragmented kernel heap with eight and 32 simultaneously live signed helper graphs, while four completed the exact plan under the unchanged 120-second absolute and 45-second no-progress watchdogs. The same retained route carries one marker from a closed failure set for transport errors, malformed or mismatched replies, or a standard procd result; it carries no process identity or capability data. No broader process or logging authority enters the loop. The compiler-qualified production baseline is 14,999 Rust lines after recording the preceding graph-serialization slice's one-line reduction; the 4,616-byte release image and reviewed authority and operation inventories are unchanged. Logging verification likewise moves deterministic append content, required role selection, response validity, cursor and timestamp monotonicity, stress sequencing, and the dynamic marker into Integration policy. Rootd's 173-line adapter performs only explicit, disjoint authenticated-submit and generic-query effects and an explicitly requested kernel-log/submit marker effect; it never uses the broader query route to submit records. Readiness and retry paths do not retain time authority for backoff: they cooperatively yield between typed IPC or state checks. Blocking deadlines belong in a future scheduler-backed asynchronous interface rather than in a service request handler or caller-side busy loop. Successful RETRY/BUSY transport polling is intentionally silent; only terminal transport failures are reported, so early-log replay cannot be filled with non-actionable progress records. Every required user-service call uses the shared retained-call primitive. RETRY means the request is in flight, so rootd keeps the exact caller buffer alive until that reply is delivered instead of enqueueing duplicate work. BUSY alone permits resubmission because the endpoint did not accept the request. This rule also covers capability-bearing deviced READ_DRIVER replies; rootd never attempts to infer their completion from later buffer contents. Service-call helpers therefore expose no caller-supplied timeout. Process-event waits and readiness verifiers stop only on typed terminal state, completed monotonic cursor traversal, or a malformed/terminal reply; VM harnesses own test-duration policy outside the product.

Every service call advertises the complete writable transport buffer while the header retains the exact request extent. Replies therefore have room for their typed body and authenticated receipt prelude without turning a successful server reply into a permanently owned call. Before installing child authority, rootd compares every selected endpoint route with the route declared by the startup plan. Missing or substituted primary-control and peer routes fail before the install grant can delegate the wrong authority into the child. Startup-transfer descriptors are encoded directly into the caller-owned service envelope, validated from those same bytes, and streamed from that envelope during installation. The transport envelope's concrete byte capacity is the only descriptor capacity; rootd keeps no fixed descriptor array or independent row ceiling. Block-namespace selection likewise walks blockd's monotonic full-width provider-and-namespace cursor pair to completion. Rootd retains only the signed ESP and data selector records, rejects duplicate semantic names, and does not truncate the namespace through an unrelated enumeration scratch limit. Selection follows the signed mount table rather than the namespace's total device count, so unrelated devices do not constrain a valid deployment. Typed BUSY/RETRY responses and cursor-zero NOT_FOUND before provider publication yield and retry without a root-local ceiling. Once any record is visible, its terminal cursor makes the namespace complete; a missing or ambiguous required selector then fails immediately. Rootd admits only the enumeration operation, never reads or writes media, and drops plus proves absence of its blockd client before mounting. It does not acquire deviced, log, time, or filesystem- provider authority. Provider kind is authenticated BootConfig data; blockd, fatd, and e2fsd retain partition and media-format validation. Integration-mode volatile-memory smoke I/O uses the plan selected from that same signed mount table. A read-only ext root with writable memory-backed /tmp therefore executes the complete pipeline under /tmp, without ambient write assumptions or an additional filesystem authority route. multi-block-provider profile additionally requires at least two distinct physical whole disks, proving that blockd traversed beyond the first provider. The only accepted rootd block response is the fixed typed enumeration row; provider data buffers and variable block replies never enter rootd. Post-mount launchd failures preserve typed status, response validation, and exhaustive cleanup without a parallel phase-marker catalog or diagnostic log effect. Initial exsh lifecycle results still use rootd's explicit logd client. The Integration library owns the complete initial-exsh launch/TTY transaction and cleanup policy through explicit effect traits; rootd only performs the requested syscalls, physical-input wait, process exit, and marker submission. Rootd does not retain or reacquire the kernel-log capability after its normal retirement point.

Dynamic fixture cleanup follows the same narrow boundary. Integration selects the bounded STOP/QUERY/WAIT transcript and validates descriptive process and terminal observations. Every query sends the exact process ID and staged generation supplied by the authenticated launch result; a PID-only lookup is never attempted. Rootd retains the authenticated procd endpoint and staging capability, performs one requested operation per effect, proves the endpoint slot absent after retirement, and fail-stops instead of returning when cleanup authority is uncertain. A pre-acceptance NOT_FOUND from a STOP, QUERY, or WAIT call permits another attempt only after an exact local-capability query proves that the same generic procd endpoint with exact SEND|GRANT rights remains in the selected slot. Every subsequent absence repeats that proof and yields, up to the closed 66-retry ceiling derived from two rotations of the maximum 33-service Phase 5 graph. Every other transport result, authority mismatch, or budget exhaustion is terminal. The release image, unsafe blocks, syscall set, and authority-family count remain governed by the production baseline. Physical-input fixtures select a prompt-default bootstrap session explicitly; all scripted initial-exsh modes remain deny-default. After commit, rootd waits on its existing read-only inputd status route while the authenticated process session remains live, so evidence cannot race lifecycle hangup. After physical exsh exits, rootd reports that its complete startup CSpace proof admitted no direct loaderd or procd route before publishing the already-observed delivery evidence. The focused redirection-script variant changes only the initial command bytes: the ordinary ext4 exsh runtime creates and reopens the script through its job-bound resolver, launches the nested exsh through launchd, and exposes only the outer terminal status to rootd. The focused here-document variant likewise changes only command bytes. Exsh retains the selected literal body in its authenticated workspace, supplies it as the nested ext4 exsh standard input through the ordinary launch transcript, and erases the local producer after terminal observation. Rootd receives no body, descriptor, stream, or nested-job authority. The focused exit-status variant runs exit 7 in that nested ext4 exsh, then uses the outer shell's $? as its own exit operand. Rootd accepts only the exact terminal status seven for this variant and receives no nested process or descriptor authority. The focused function variant additionally calls break 3 and continue 3 from nested functions inside caller loops, requiring the caller bodies to continue after each callee returns. Its nested ext4 child calls exit 7 through two active function scopes. These checks change only command bytes and observe only the ordinary terminal status route. The focused for variant changes only the command string. It requires an omitted-in positional snapshot to survive body mutation and an explicit word list to be expanded once before iteration, then reports only the existing outer status. No authority record, endpoint, descriptor, or filesystem object is added. The focused parenthesized-subshell variant likewise changes only command bytes. It proves that inner variable, positional, option, and status effects are restored, that ! (exit 9) completes successfully without terminating the outer source, and that the fixed launch transcript and authority inventory are unchanged. Rootd observes only the existing outer terminal status. The focused function variant defines and invokes POSIX functions, shifts call-local arguments, returns status seven, and verifies restoration of the outer zero-argument scope. Its parenthesized list inherits an outer binding but keeps replacement, definition, and unset -f effects local; after leave the outer binding remains, the inner binding is absent with status 127, and ordinary function removal still falls through to command-not-found. The variant changes only the authority-free command string and reports success through the existing terminal-status route; rootd receives no function namespace or child authority. The focused eval variant replaces only those command bytes. It requires the filesystem-resident shell to retain and execute nested eval programs, suspend and resume a function around an eval-driven return, transfer continue and break across eval frames to the selected caller loop, replay a retained here-document, and preserve exact status and leading-negation behavior. Rootd observes only the same status-only lifecycle receipt and gains no evaluator, descriptor, stream, namespace, process, or launch authority. The focused dot variant also preserves the fixed launch transcript. Its outer command selects one non-executable shell file through PATH; that file sources a second ext4 file by direct path, and both execute in the caller environment. The files prove retained here-document parsing, invocation redirection cleanup, function-local return, eval-originated return from the nearest dot frame, exact status propagation, and noninteractive missing-source termination inside an isolated subshell. Rootd supplies only descriptive command bytes and observes the existing terminal-status route; it receives no opened-file, provider, evaluator, descriptor, stream, namespace, process, or added launch authority. The focused exec variant is a bounded sequence of five independently authenticated ext4 shells. Rootd retains its bootstrap launch creator only for the sequence, stages one attenuated SEND|GRANT alias at a time in a disjoint temporary slot, and consumes that alias before the next stage. Four stages carry distinct zero-authority script envelopes and prove exact-absence status 127, direct successor replacement with status 23, an immediate nested ext4 shell after successor retirement, and PATH-selected POSIX script fallback. The status-126 stage deliberately omits its script envelope, proving that an execution-only shell cannot turn selected data into a new launch route. The final shell sources the direct descriptor proof in its current environment, then persists descriptor 9 with redirection-only exec, exports its stable $$, and PATH-selects the second executable-mode script. Both scripts lack a native launch manifest, so only that exact absence admits the fixed ext4 shell interpreter. The successful scripts validate $0, remaining arguments, prefix export, stable identity, and the inherited descriptor. Every stage has a distinct transaction correlation; its status and TTY lifecycle receipts retire before reuse, and the retained creator retires after the final observation. Rootd receives no PTY stream, interpreter, opened-file, provider, descriptor, child-process, or successor authority. The focused pipeline variant changes only those command bytes. It first rejects a mixed AND-OR list containing a singleton compound pipeline with status 126 before stream allocation and proves that neither compound can mutate the parent. It then commits a finite ext4 exsh.elf -c : child before a missing second command produces status 127; partial-submission reconciliation must observe that finite child and retire its routes and provisional stream. It next places each state-sensitive compound command last in its pipeline. The default POSIX pipeline status proves that each isolated child retains nondefault IFS, a readonly set variable, or a readonly declared-unset variable, while the parent retains its own state. No environment field carries authority. The outer ext4 exsh then commits one three-stage pipeline: a function-definition child, a brace-group child that exports a changed variable, and an ext4 exsh.elf -s reader that consumes the reinput-safe declarations. The parent retains its original variable and no function binding, where invocation still returns status 127. It then launches one ext4 exsh writer and one ext4 exsh reader through launchd, connects them with a launchd-provisioned logical stream, and waits only after both commits. Before that final pair, an outer export built-in prepares valid shell input in ext4. The writer redirects stdout to a second ext4 file while the reader redirects stdin from the prepared file, proving parser-order redirections override the earlier pipeline assignment while explicit descriptor-three aliases retain each logical pipe half until child exit. The valid pipelines after both negative cases prove the allocator and launch routes remain reusable. Successful writer and reader statuses prove the output commit and redirected-input evaluation. Rootd accepts the outer zero status through its existing status route and receives no stream endpoint, nested-job route, descriptor, provider, or cancellation authority. The focused coreutils variant combines authenticated -c bytes with a narrow script/session authority ceiling. Its absolute /bin PATH entry lets exsh select each canonical applet policy without delegating a generic resolver. For this fixture alone, rootd requests the six filesystem operation families used by the script and encodes eight exact selector/lifetime/class rows in its shell envelope. It resolves the seventeen catalogued entries through the ordinary ext4 loader path and exercises read-only text pipelines, exact copy/rename/unlink, directory create/list/remove, deterministic status primitives, and current-directory reporting. Expected cat operand rejection plus file-versus-directory mutation failures prove that one multicall binary cannot select a different applet grammar or operation ceiling. Rootd receives only the bootstrap lifecycle and outer status routes; it never receives an applet manifest, VFS object endpoint, resolver, child job, or pipeline endpoint. The focused regular-builtins variant keeps that same outer launch transcript and empty script-authority table. Its bounded command bytes exercise fresh and resettable getopts state, octal and symbolic umask, function-bypassing command lookup and default-path execution, and operand-tolerant true and false. It also creates one mode-0600 file and requires exact /bin/grep readback through the shell's already-authorized redirection stream, proving the mask attenuates creation mode without revoking explicit object authority. Any external helper still enters through its exact /bin manifest; rootd observes only the outer terminal status and receives no child, resolver, VFS, or process-control authority. The focused extop positive instead requests the sole inspection bit for its root-authenticated bootstrap session and places the same exact session scope in the initial shell's script envelope. Its command runs /bin/extop for two live samples. The denial variant keeps the ordinary deny-all session and empty envelope, supplies only a forged numeric control claim, and requires a nonzero child result before reporting denial. Rootd receives neither inspection responses nor any job-control handle in either case. For VFS, the canonical service endpoint is retained only for root mount control. Rootd creates a separate read-write namespace session for itself and, only when loaderd is present in the validated graph, a distinct read-only loader session. Vfsd receives the corresponding receive-only halves, loaderd receives only its send-only half, and rootd retires both creator capabilities after launch. A separate powerbox resolver object gives vfsd the receiving route and powerboxd the send-and-transfer route; neither receives another namespace session. Vfsd receives a kernel endpoint-factory alias in its exact primary-control slot; that factory can create generic endpoints and attenuate local aliases but cannot populate staged children or install grants. Rootd extends vfsd's addressable process window through the exact-object receiver interval. Empty slots grant no authority, and vfsd's deployment-patched object storage bounds live endpoint occupancy.

Launch executable lookup uses a second resolver endpoint object shared only by launchd and vfsd. Launchd receives SEND | GRANT, vfsd receives RECV | GRANT, and loaderd receives neither half and no additional namespace session. Rootd creates this route only for either participant and retires its creator after startup transfer.

Rootd also creates one private session-provisioning endpoint when procd or ttyd participates in the validated graph. Procd receives only its send half; ttyd receives the receive-and-transfer half, plus a separate endpoint-factory alias in ttyd's primary-control slot. Neither capability can populate a child. The creator is retired with the other authenticated route sources. Ttyd's addressable process window reaches the architectural CSpace boundary so its deployment-bounded lifecycle, input, and output endpoint tuples can occupy the ABI-defined retained interval. Every live tuple still requires explicit attenuated copies, and the unmatched final slot is intentionally unusable.

Runtime image builds use validation_profile = "none" and do not infer test behavior from the set of packaged modules. Integration images select explicit semantic profiles such as discovery, driver lifecycle, logging, storage, loader, or dynamic-link validation. Pre-mount profiles that include the input stack verify the partitioned i8042, keyboard, mouse, and diagnostics endpoints without injecting an event. Active event injection is confined to the explicit input profile and first requires a live ttyd endpoint, because inputd synchronously preserves producer identity and delivery ordering through that post-mount session router. A graph without ext4-only ttyd fails closed instead of bypassing the route or synthesizing input authority. The physical-input profile instead launches explicit interactive exsh -i with an empty script-authority envelope that binds its sole launchd route. Only the powerbox fixture marks that envelope and its parent transaction as eligible for interactive escalation; the envelope grants no direct operation. After ttyd publishes the exact parent lifecycle receipt, rootd commits the launch, validates the status route, and only then emits a routed session-ready marker. Before retiring or hanging up the session authority, the same post-commit callback waits for the required inputd counter deltas and publishes a routed evidence-ready barrier. Focused multi-session profiles first create one empty secondary session through a second exact lifecycle receipt and prove that the two senders name independent objects. The VM may then deliver hardware keyboard and mouse activity through QEMU's emulated PS/2 devices. Rootd retains only its pre-existing read-only inputd client and accepts each focused proof only when keyboard and pointer counters advance and the trusted-delivery delta is exact: three for multi-session control, one for the PTY-output spoof profile. It receives no input producer, event replay, trusted target, PTY stream, or job-control authority. Integration now supplies those choices as one immutable trusted-terminal plan: whether a secondary is created, whether status must be independent from it, whether session-control retires it without a redundant hangup, the exact inputd delta, and the completion marker. Rootd's existing InitialExshIo adapter continues to own every lifecycle operation and fixed-slot retirement. Loader integration policy follows the same boundary. The Integration library owns loader ABI expectations, discovery and ELF/load-plan cases, materialized child isolation, cleanup-fault sequencing, evidence, and the final continuation or intentional fail-stop decision. Rootd implements only typed effects over explicit loaderd, procd, kernel-log, and logd routes; it does not retain a library-supplied capability or let descriptive process identifiers confer authority. Core VFS integration policy now follows that boundary as well. Integration owns the exact memory, ESP, data, htree, and volatile-/tmp paths, payloads, request ranges, fourteen-operation transcript, response expectations, cleanup order, and diagnostic trace strings. Rootd retains a narrow typed adapter that must receive the VFS and kernel-log endpoints for every effect; it retains no route in the policy library and treats endpoint numbers and object handles as descriptive values rather than authority. The same library owns the shared 22-operation FAT/ext truncate policy: exact paths, fill patterns, shrink and growth sizes, zero-fill evidence, request ranges, and trace behavior. Rootd's two filesystem-specific entry points are ten-line plan selectors over one endpoint-explicit transport adapter. The ext sparse proof is library-owned as well: its two exact paths, tail payload and offset, zero-hole reads, sparse truncation, request sequence, and trace are selected through a third ten-line plan adapter. FAT, exFAT, and ext metadata proofs follow the same boundary. Integration owns their host and created-file expectations, exact timestamp normalization, permission and filesystem flags, immutable-file denial, request sequence, and trace policy. Rootd's three entry points only select immutable plans; one target-only adapter performs explicitly addressed metadata and path operations and returns typed status observations without retaining either endpoint. FAT namespace proofs are library-owned too. The lowercase short-name plan owns its optional host fixture, exact directory enumeration bound, persistent-file payloads, and request order. The rename plan owns file and directory replacement plus nonempty-directory, type-mismatch, and descendant-cycle denials. Rootd retains two ten-line selectors and one endpoint-explicit adapter that stores no route after the call. The fourteen-operation extended VFS proof is also Integration-owned: exact mkdir/create/write/close/truncate/rename/symlink/readlink/denied-link/metadata/ stat/cleanup sequencing, root or signed-/tmp path plan, values, and traces. Rootd's adapter exposes only explicitly addressed typed effects and keeps no scenario expectation. The ext rename proof follows the same boundary. Integration owns file and directory replacement, cross-directory and HTree moves, symlink and device identity, descendant-cycle and nonempty-directory denials, prefix evidence, and the exact request transcript. Rootd retains one endpoint-explicit adapter; the encrypted-casefold lookup and case-preserving directory proof is now library-owned too, behind a separate 21-line endpoint-explicit adapter. Ext link and special-file policy has joined the library boundary: fast and slow symlinks, hard-link counts, character/block/FIFO modes, denied special-file operations, persistent-file evidence, cleanup, request order, and traces. Rootd retains a 124-line endpoint-explicit adapter including raw stat/open transport shared by the remaining VFS adapters. Persistent-media policy is library-owned too: FAT/ext host markers, the long indexed-directory entry, created marker files, large-file sample offsets and sizes, payloads, request sequences, and diagnostics. Rootd retains no dedicated persistent-plan adapter; the typed pipeline invokes the library state machine through the shared endpoint-explicit file effects. The signed BootConfig mount loop remains a production invariant, while its post-mount smoke-plan decision is now library-owned: rootd passes the validated descriptive mount table and executes the returned matching core-I/O and extended-API root or volatile-/tmp plans through the same explicit VFS adapter. No scenario path or provider expectation remains in rootd's 271-line BootConfig mount module. VFS completion-marker selection and ordering are library-owned as well. Rootd's 16-line adapter only iterates the supplied focused or baseline transcript through the explicit logd route; it contains no marker constant, feature precedence, optional-evidence decision, or expected order. Complete VFS pipeline selection and order are library-owned too. Immutable typed steps compose memory, read-only, verity, baseline FAT/ext, and every focused profile from the already bounded subplans. Rootd's 253-line dispatcher invokes each library state machine through explicit VFS, kernel-log, or logd effects and maps verifier failures in one place; the general VFS module is now 520 lines. Ten redundant high-level verifier/plan wrapper families and the dedicated persistent adapter have been removed. Together with the earlier nine selector files and four duplicated pipeline entries, the two VFS reductions remove a net 387 rootd source lines while preserving the exact IPC effects. Storage discovery remains a production selector boundary, not a media or scenario verifier. Rootd accepts only generic typed GPT partition facts for the signed ESP/data selectors and hands their descriptive IDs to vfsd. Raw MBR, FAT/exFAT, ext, journal, and sentinel policy is absent from rootd. The sole multi-provider scenario now receives only rootd's descriptive observation after ordinary product selection. The authority-free library owns expectation and acceptance; product storage code receives no scenario requirement. Removing the false product branch lowers the then-current baseline to 16,002 active lines without changing the 4,616-byte image or any authority measure. Fault-injection and negative-selftest calls are likewise confined to the profile that requests them. Ordinary bootstrap never sends an integration-only negative request merely because it launches a service used by that test. Dynamic-link fixture constants now follow the same boundary. Integration owns the rootd-intake marker and the complete negative-spawn transcript, including selection, exact create/map/cleanup requests, denial acceptance, resource-count equality, diagnostics, and ordered success evidence. Rootd retains only typed kernel-control, kernel-log, and procd effects. Its build-gated adapter now maps cleanup to one exact procd abort and one exact capability drop per requested slot; Integration owns their order, first-error precedence, and exhaustive attempt policy. The runner cleans every created stage before returning a later effect failure. This slice removes 48 net rootd Rust lines; the earlier dedicated policy-file extraction removed 31 more. The Integration library now also supplies every Integration-only dynamic executable name, the closed helper/core/interrupt role predicate, and the pure pre-procd kernel-launch selection. Rootd still recognizes every production service name, validates the signed manifest and ELF graph, and performs all mapping, procd, logging, and cleanup effects through explicit authority.

Dynamic Executables

Except for the bootloader, packaged userspace programs may be ELF64 x86_64 ET_DYN objects in the signed dynamic-link store. rootd validates catalog identity and the boot-catalog graph before requesting staged creation through procd. For filesystem launches, rootd extracts the unique runtime-graph SHA-256 digest and canonical VFS path from the kernel-delivered image manifest and delegates that exact trust root to loaderd in a loader-private startup tail. The loader must read and match that graph before submitting the complete selected dependency closure to dynlinkd; lookup-root and capacity policy are not delegated in that tail. After storage readiness, rootd's authenticated filesystem-launch rows permit only the canonical ttyd, launchd, and powerbox graph roots. Rootd asks loaderd for each staged process and authenticates the fixed process-endpoint and install-grant receipts plus image digest and bounds. For ttyd it installs the service receiver, nine peer routes, the separate send-only endpoint factory, and complete TTY1 envelope; for launchd it installs the dedicated child-local request receiver, seven peer routes, its separate send-only endpoint factory, and complete version-2 LCH1 envelope with authenticated stream-pair storage. Vfsd first receives that same public timed endpoint at its one fixed send-only query slot so it can derive trusted filesystem timestamps without delegating clock authority to providers. The seventh launchd peer is timed's public SEND endpoint; root retires its source immediately after this final transfer, before launchd starts, and powerboxd receives no wall-clock route. For powerboxd, rootd installs five peer routes and the complete PBX1 envelope. One shared pairwise route is delegated SEND only to powerboxd and RECV only to launchd for authority-free decision-ready notifications. Child-local receive slots remain distinct from root's attenuated steady clients. Rootd drops every creator, returned endpoint alias, and install grant before starting the exact generation through its private procd route and requiring typed role-specific readiness before final system READY.

drv-rtc-cmos is an ext4-only, one-shot private deviced driver. Rootd installs the exact CMOS-read, timed-provider, and RTC-only loader senders into deviced, then retires and proves absence of those source slots. Deviced authenticates loaderd's fixed receipt pair, installs the exact RTC1 bundle, starts the child through its restricted procd driver route, waits for acknowledged sampling and clean exit, and retires both temporary endpoint aliases. It returns zero persistent process and endpoint identities to rootd. The role never enters named publication, the resident-service table, or restart policy, and rootd never receives RTC child-lifecycle authority. The published powerboxd request source retains exactly SEND | GRANT only until its one launchd peer transfer succeeds, then rootd retires it. The published launchd source likewise retains exactly SEND | GRANT only for the selected initial-shell transaction. Ordinary root clients for both services remain separate send-only aliases.

When the initial-shell runtime feature is selected, rootd emits final ERIX_ROOTD:READY only on development images after the complete service graph; release images omit that diagnostic stamp. It then writes the exact light-gray EriX <integration-tag-or-commit> banner and a blank line through the already- authenticated seriald and fbcond routes. Only afterward does it launch the ext4-resident exsh.elf through ttyd and launchd rather than adding it to the boot image. It creates a one-shot deny-all parent terminal session by default; the focused extop positive alone requests the inspection-only job-lifetime variant. It copies only SEND | GRANT from rootd's already-owned canonical launchd endpoint source into a transaction-local slot, verifies that source names the same object as rootd's ordinary send-only launchd client, retires the canonical source, and submits one canonical nine-record launch intent for exsh -c :. Focused integration-only feature variants replace only the command string with an ordered PATH launch, an exact missing command, or a bounded POSIX script including parenthesized subshell state isolation, function-scoped redirections, nested eval, and direct or PATH-selected ext4 dot and exec scripts. The focused times variant changes only those command bytes: it emits four snapshots around a failed lookup, one waited ext4 child, and an in-place ext4 exec replacement so the host can prove exact two-line formatting, failed-launch exclusion, one-time child charging, and predecessor self-time continuity. The focused regular-builtins variant likewise changes only the bounded command bytes and leaves the script-authority table empty. It emits a success marker only after getopts, umask, command, true, and false cross their real ext4 runtime path with exact statuses and without changing rootd's capability inventory. The focused trap variant also changes only those command bytes. It proves persistent prefix/table replacement, deterministic default/ignore/action listings, condition-error continuation, direct-special-builtin syntax status, and output-failure status. Nested ext4 shells additionally prove EXIT action side effects, pre-action status visibility and restoration, explicit and operand-less exit selection, syntax-error status, primary-shell EOF dispatch, and consume-before-execute recursion prevention while rootd retains only the same terminal status route. It does not request signal, event, process, or job authority. The focused trap-dispatch variant likewise changes only the bounded command bytes. A build-gated ttyd fixture places one canonical INT in the existing session queue on the first authenticated event read; the shell defers its caught action until a bounded, syscall-yielding foreground child reaches signal-derived status 130, then resumes the following external list member exactly once. Without delivery, the child exits with a dedicated failure status instead of hanging the VM. Rootd still observes only the final status route and receives no event, job-control, process, or additional terminal authority. The focused wait variant keeps that identical rootd boundary and selects a distinct build-gated ttyd mode that preserves the post-asynchronous empty read, then injects once on the same generational session's read inside wait. The ext4 shell launches POSIX brace-group background children through its sole exact shell-child route, without recursively requesting another exsh launch, records only their descriptive $! identities, proves immediate status zero, interrupts wait with caught INT status 130, then observes and retires the original status seven. It also checks unknown-job status 127, distinct simultaneously live POSIX process identities, all-job waiting, parent-state isolation, asynchronous here-document status, and teardown cancellation of an unobserved final child. Evidence is rendered through special-builtin trap listings, so marker output launches no utility and requires no additional authority. Rootd still owns only the outer shell's status route and cannot select, inspect, signal, or control any background child. This allows distinct routed ext4 VM markers without changing the capability transcript. The intent transfers the root VFS namespace exactly twice—for executable lookup and the working directory—requests tty-provisioned standard streams, installs an empty script-authority envelope, and asks launchd to return only a read-only status route. Rootd never receives job-control or PTY stream authority. After commit it drops the launch client, retains the parent lifecycle route only while the child needs its endpoint-bound terminal identity, and waits for typed terminal status. It then hangs up the parent session and drops both lifecycle and status routes. Rejection aborts the transaction; lost authority-bearing replies or unprovable cleanup fail stop so process teardown removes every possible residual alias. For the physical-input profile, the launch transcript contains the program, the two exsh -i arguments, working directory, three tty-provisioned streams, and an empty script-authority envelope. Explicit -i records rootd's authenticated choice of the ttyd-backed interactive session. The envelope binds only the child launch route and grants no direct filesystem operation. Only the powerbox fixtures opt that envelope and transaction into interactive escalation while adding a one-shot CREATE_ENTRY session ceiling and prompt default; ordinary physical-input and secondary sessions stay deny-all. Omitting -c selects standard-input command acquisition. Typing exit through the emulated keyboard terminates the same status-only job. The launch-handle fixture preserves that status-only rootd boundary while the interactive ext4 exsh launches native children. /bin/false proves exact read-only status by producing status one; /bin/cat remains foreground until a physical Ctrl+C is forwarded through its distinct control sender and returns signal status 130. Exsh validates both child senders as independent from each other and from its launchd sender. Rootd receives neither child route, and QMP supplies input events rather than a process or job selector. The one-shot focused VM invocation stopped before image construction because BOOTIMG_SIGNING_KEY was unset (passed=0 failed=1 total=1); no target result is claimed, and the failure was neither investigated nor rerun. The multi-PTY fixture hangs up and retires the empty secondary session before the parent. In the emergency-kill profile, successful return to the primary shell proves ttyd already terminated the focused secondary session; rootd then retires its local sender without attempting authority through a dead endpoint. Separately, production BootConfig driver validation is named validate_*: each configured driver device must be present through the explicit deviced route before endpoint readiness. This is a signed bootstrap invariant, not an Integration verifier or a scenario-selectable fallback. Insufficient caller-owned launch storage uses the dedicated LAUNCH_STORAGE_EXHAUSTED failure class.

Rootd exposes only the complete staged dynamic-bootstrap profiles. The retired parser-, mapping-, library-, single-service-, and single-object-loader profiles are rejected instead of retaining compatibility-only code or authority paths.

Graph and plan storage are caller-provided. Callers size storage from validated input structure rather than imposing independent object, dependency, relocation, or path-depth policy caps. Catalog rows, filesystem mirror records, and object names are evidence and lookup keys, not authority. Before dynlinkd is available, rootd scans manifest dependencies, program headers, and DT_NEEDED entries directly from their validated source bytes. It unconditionally rejects a dynlinkd manifest that names dynlinkd as its own dependency. Integration builds may mechanically emit the authority-free library's exact denial and cumulative dynamic-service START/READY evidence through explicitly supplied logging routes. The library also selects exact group membership, first-role suppression, request identifiers, completion order, and the descriptive dynlinkd-versus-runtime route class; no endpoint or capability crosses that boundary. Ordered core lookup/time, hardware/console, and storage/VFS/loader checkpoints come from the library as immutable request/marker rows. Rootd converts its retired bootstrap-only blockd client to a retirement proof and its six downstream storage endpoint slots to presence booleans. It receives a plan only when blockd authority is absent and the complete downstream set exists, then transports each row through its explicit logging routes; slot values and capabilities remain local. Only the live graph-object set is retained, in an exact deployment-patched arena sized from the largest packaged dependency closure. Rootd erases and releases that sole arena lease after each launch and retains no allocator. The same authenticated deployment layout carries one managed-process record count for procd, pagerd, and vspaced. Rootd uses lib-capabi's shared five-slice multiplier to derive child-endpoint, working-directory-cleanup, install-grant, powerbox-revocation, and child-VSpace scratch ranges, plus the pager/vspace import range, from that count, extends only the affected child CSpace windows, and rejects layouts outside the shared capability-space ABI. Procd's window also covers the two fixed one-use launch-description and redirection-resolver receipts immediately before its scratch base. Deviced, vfsd, and ttyd have separate addressable windows that extend to the architectural CSpace boundary for their per-driver-instance, exact-filesystem-object, and retained-session aliases. Empty slots convey no authority: each live alias still requires an explicit attenuated copy, and deployment storage bounds vfsd and ttyd occupancy. Ttyd's three-slot tuple mapping leaves an unmatched tail slot unusable. Deviced's dedicated lifecycle-verifier aliases remain disjoint from production ACPI and i8042 sources. Blockd receives a separate shared window ending immediately after its one transaction-local provider endpoint. Empty intervening slots likewise convey no authority, and blockd never retains a provider table.

BootConfig follows the same count-derived policy. Rootd does not copy entries, dependency edges, mounts, key material, or external-journal selectors into service-local fixed arrays. It traverses the validated read-only boot-module tables in place, forwards the exact canonical private-table bytes only to their intended service, and retains only format-defined widths such as VFS path and individual key-material sizes. Compact entries contain no polling deadline; accepted launch work terminates through typed runtime state while the external VM harness owns scenario time.

Authority Discipline

• A slot number is never accepted as proof of identity. Local capability type, object identity, rights, and grant rights are queried and validated.
• Service authority comes only from the kernel handoff, an already-authorized parent, or an explicit transferred capability.
• Capabilities are attenuated before transfer; rootd does not add rights that the source capability lacks.
• Ordinary service replies must be authority-free. Rootd revokes every unexpected receipt destination before rejecting the reply and exits if a malformed receipt or failed cleanup makes residual authority uncertain.
• deviced READ_DRIVER is the narrow exception: a live driver response must carry exactly one normalized SEND endpoint receipt whose source, destination, typed response slot, and queried local generic endpoint all match the requested device contract. Seeded devices require the canonical source; a physical virtio-block response may use only deviced's per-instance source interval and must identify the requested activation policy. A not-yet-ready or failed response carries no endpoint authority.
• Successful procd CREATE_STAGED_DYNAMIC_PROCESS replies are the other explicit exception. They carry exactly two normalized receipts, in order: the child endpoint with exact SEND | RECV | GRANT rights and the install grant with exact GRANT | MINT rights. The request fixes both destination slots, and rootd queries both installed aliases before accepting the reply. The authenticated procd endpoint proves the sender; its private source slots remain an implementation detail. Failed replies carry no authority.
• Kernel-control operations use their dedicated endpoint families. Capability introspection uses only the query endpoint; the log endpoint carries only logging operations and is never accepted as query authority.
• Before logd is ready, the inherited early-log sink is optional observability. Readiness is queued for later publication and service launch never fails merely because that bootstrap-only logging authority is absent. Dynamic-link proof markers follow the same rule: scenarios may require them, but product availability does not.
• The pre-logd readiness queue retains each stage once and derives storage from the complete stage domain. It has no unrelated record ceiling and cannot silently drop a new stage before logd is available. The superseded framebuffer-deferred queue and serial-only branches are absent; direct framebuffer fallback emits only the terminal READY record through one exact write.
• Once logd is ready, transient BUSY/RETRY results for required readiness, live, dynamic-link checkpoint, and terminal markers are explicit backpressure. Rootd yields until logd accepts each marker or returns a terminal result; no service-local retry count converts temporary pressure into a false runtime failure. Direct framebuffer readiness writes follow the same typed completion policy.
• Routine service operations do not use discovery. Log submission, process crash reporting, serial and framebuffer writes, and PS/2-driver input appends use distinct endpoint objects per authenticated producer. Native launch, install, filesystem-resolution, terminal-policy, and prompt routes are likewise distinct objects shared only by their named participant pair. Receivers get receive-only bindings and producers get fixed send-only bindings; requests carry operation data, not caller identity or an endpoint selector.
• Rootd has no input append client. Input verification injects bytes only into the root-owned i8042 diagnostic interface and requires the keyboard and mouse translators to publish authenticated events; it cannot synthesize their identities as a fallback.
• Child launchers receive dedicated pass-through clients. Deviced forwards the drv-serial log client and the two PS/2 input clients without gaining either child's producer identity or substituting its own endpoint.
• Root creates distinct i8042 keyboard-read and mouse-read endpoint objects, transfers their lifecycle delegation sources to deviced, and drops its creator bindings. The shared i8042 service endpoint remains root-only diagnostics authority and is never passed to either PS/2 translator. Input verification emits ERIX_ROOTD:READY:I8042_AUTHORITY_PARTITION only after a keyboard read through that diagnostics endpoint receives transport-level DENIED.
• rootd creates an authenticated operation endpoint only when its validated launch plan contains a participant, attenuates its own fixed clients, and drops every creator source after static launch. Root's retained clients are dropped before terminal host reporting on both successful and failed bootstrap. An unprovable host-report capability drop changes the exit status to internal error and still enters the same one-shot process_exit path. The kernel retires rootd's recorded receiver and clears its complete root CSpace, so no reporting or service authority survives either terminal outcome.
• Remaining discovery authority is partitioned for the pagerd, timed, and irqd target endpoint objects. named receives one scoped receive-and-transfer capability per target, while procd receives only the corresponding send-and-transfer scopes. rootd uses the root-only publication route and publishes SEND for pagerd/timed or SEND|GRANT for IRQD's LAPIC-timer handler object. IRQD's administrative endpoint is never published. Root separately installs the COM1 handler object in deviced for delegation to drv-serial, and drops all temporary scope sources after static launch.
• Concurrent discovery verification consumes process completions by the first unseen matching launch record. Process identifiers may be reused after exit; root does not impose a uniqueness lifetime beyond the process service's contract or mistake a later completion for an already-consumed record.
• Driver lifecycle verification applies the same contract. A restart is accepted when deviced reports the replacement launch running, even if procd reused the synchronously retired process identifier.
• Runtime PCI discovery is one required probed transaction. Typed BUSY/RETRY responses retain the same request identity and yield without a root-local attempt ceiling; transport and terminal service failures stop the transaction. Once that scan completes, root queries every device required by the boot configuration exactly once. A typed absence is terminal instead of entering an endpoint wait for a driver that cannot be launched.
• Root retains the send-only IRQD administrative endpoint for registry seeding, sealing, and line-mask policy. IRQD receives distinct receive-and-grant LAPIC-timer and COM1 handler endpoints; consumers cannot register or acknowledge a caller-selected line. Integration supplies one complete descriptive admission, request-correlation, timer-only or timer-plus-serial plan; rootd applies it mechanically to seed, seal, and unmask calls and retains every endpoint, reply check, and failure disposition.
• memd and vspaced receive no resolution scope: both must serve foundation requests before named and logd are available.
• Procd authority is partitioned by endpoint object: rootd retains the root orchestration route, loaderd receives only the dedicated materialization route, and deviced receives only the driver-lifecycle route. The loader/procd pair alone carries GRANT so procd can return one staged-child install grant; it still cannot invoke root or driver operations. Rootd may validate loaderd discovery before mount completion, but it cannot query or consume lifecycle state for launch children: those records and events belong exclusively to launchd. The focused isolation profile requires an identity-only denial and terminates deliberately after proving it. Dynamic-storage and cleanup profiles inherit loader discovery, not the isolation profile's successful child creation; cleanup faults require their typed begin, segment, or commit failure class.
• Loader fixture request planning is authority-free and library-owned. Rootd receives complete typed discovery/launch requests or one bounded malformed byte sequence separately from the explicit loaderd endpoint, then performs only encoding, authenticated IPC, reply parsing, procd query, and evidence transport. No scenario path, operation identifier, or malformed-body builder remains in rootd.
• Pagerd's public registration endpoint remains transfer-bearing because process registration carries an explicit child VSpace capability. The separate kernel fault-delivery endpoint is moved receive-only to pagerd, and rootd proves its temporary source binding is gone.
• For each temporary-kernel child before procd owns its launch, rootd receives one role-derived map-only child-VSpace alias. A validation profile that keeps memd, vspaced, or pagerd on that route prebacks the provider's complete 256-KiB stack so it never pages through its dependency cycle. Procd and later temporary non-provider children retain lazy paging only after an initial backed prefix, exact pagerd registration, root-local alias retirement, and kernel pager registration. Procd-launched providers retain their existing launch contract. Every root-owned failure unregisters pagerd or retires the local alias before process teardown; no scratch capability survives.
• The reviewed compiler-qualified semantic-bootstrap surface is 15,248 Rust code lines after authenticated console route filtering, including the new console module and TTY1 V2 decoder. The preceding 15,158-line checkpoint corrected host/test-body overcounting, not additional runtime code removal. Authority, operation, syscall and dependency inventories remain unchanged. The optimized image is 4,672 bytes with eight unsafe blocks, while validation-only full-provider backing stays behind the Integration adapter.
• The focused write-protect validation profile launches a pager-registered helper that writes a present read-only page. Rootd accepts only the kernel's invalid-fault kill result; any pager-notification path fails the scenario.
• The kernel installs a distinct HostReport endpoint only in rootd. Rootd submits progress and one terminal event through its sole operation, then drops the capability; no child receives or inherits reporting authority.
• Startup aliases, transfer grants, and scratch capabilities have explicit owners and lifetimes. Executable mappings are established before process start; startup does not delegate a generic image frame.
• Independent cleanup operations all run even when one fails. Cleanup failure takes precedence because continuing could leave residual authority. Uncertain reply-authority cleanup terminates rootd so kernel process teardown revokes its complete local CSpace.
• Deprecated module aliases and compatibility-only runtime feature names are not accepted.

Build

cargo build --all-targets --all-features

All Git dependencies in Cargo.toml use full 40-character commit rev pins. Integration source revisions and CI caches preserve those identities without branch-head or synthetic-commit substitution.

Test

cargo fmt --all -- --check
RUSTFLAGS="-D warnings" cargo clippy --all-targets --all-features -- -D warnings
RUSTFLAGS="-D warnings" cargo test --all-targets --all-features
RUSTDOCFLAGS="-D warnings" cargo doc --all-features --no-deps

VM validation belongs in integration. New behavior that depends on real kernel scheduling, capability transfer, MMIO, paging, or image construction requires a focused new scenario; broad historical scenario sweeps are not a substitute for that test. The integration-only multiline interrupt selftest starts the ordinary line-bound timer client only after a serial-capable stack has registered the COM1 driver; it receives no administrative IRQD or interrupt-injection authority. Rootd derives the serial-row request from the exact authenticated drv-serial launch node and supplies only that descriptive fact to the Integration policy adapter. The kernel fixture requires both simultaneously outstanding events to be acknowledged through their respective handler paths before final readiness can pass.

Clean-Room Policy

• Do not copy external source code.
• Do not add external Rust crates.
• Do not use generators that embed third-party code.
• Keep all implementation and test inputs reviewable within the EriX project.

License

This repository is licensed under the ISC License.

Development Model

Rootd changes are developed with their direct service, library, kernel, image, and integration consumers. Contract changes update the corresponding architecture, roadmap, manual, and focused validation evidence in the same reviewable change set.

Governance Principles

rootd owns production bootstrap orchestration, not the policies implemented by the services it launches or the build-gated scenario policy supplied by the integration repository.

• Interface changes must update direct callers, component documentation, and focused integration coverage together.
• Pre-alpha wire and source interfaces may break when doing so removes stale, misleading, or authority-bearing compatibility fields.
• Runtime policy must be explicit in BootConfig or in a typed, documented startup contract.
• Non-obvious authority changes require documented rationale and review.

Contact

Development occurs in the EriX organization. Maintainers can be reached at admin@erikinkinen.fi.