Cohesix Build Plan (ARM64, Pure Rust Userspace)

Title/ID: m0-rust-1-97-1-security-refresh
Milestone: Milestone 0 — Repository Skeleton & Toolchain / Rust 1.97.1 security refresh
Goal: Replace the superseded Rust 1.93.1 baseline with exact stable Rust 1.97.1 while preserving the existing host and `aarch64-unknown-none` build contracts.
Inputs: rust-toolchain.toml, Cargo.toml, Cargo.lock, .github/workflows/ci.yml, toolchain/setup_macos_arm64.sh, toolchain/setup_linux_arm64.sh, scripts/ci/rust_risk_gate.sh, scripts/ci/test_rust_risk_gate.py, docs/TOOLCHAIN_MAC_ARM64.md, staged Test Plan gates.
Changes:
  - rust-toolchain.toml + setup scripts + CI — select exact Rust 1.97.1 with deterministic minimal-profile installation plus the declared rustfmt, clippy, and aarch64-unknown-none closure.
  - scripts/ci/rust_risk_gate.sh + focused tests — bind risk scanning to the exact named Rust 1.97.1 toolchain and refreshed bootstrap-file digest.
  - docs/TOOLCHAIN_MAC_ARM64.md — describe the refreshed as-built Rust contract.
Commands:
  - cargo fmt --all -- --check
  - cargo clippy --workspace --all-targets -- -D warnings
  - cargo check --workspace
  - cargo test --workspace -- --test-threads=1
  - cargo test -p rust-risk-audit
  - python3 scripts/ci/test_rust_risk_gate.py
  - scripts/ci/rust_risk_gate.sh --baseline docs/audit/rust_risk_baseline.toml
  - cargo audit
  - cargo deny check advisories
  - scripts/check-generated.sh
  - scripts/ci/check_test_plan.sh
  - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m0-rust-1-97-1-qemu
  - scripts/ci/test_plan_run.sh --target pi4 --stage 1 --state-dir out/test-plan/m0-rust-1-97-1-pi4
  - scripts/ci/test_plan_run.sh --target pi4 --stage 2 --state-dir out/test-plan/m0-rust-1-97-1-pi4
Checks: the exact compiler, Cargo, rustfmt, Clippy, host standard library, and aarch64-unknown-none standard library resolve from Rust 1.97.1; all mandatory repository gates pass without product, protocol, authority, generated-artifact, or evidence-tier drift.
Deliverables: synchronized exact toolchain pins and documentation plus host and bare-metal compile, lint, test, dependency, generated-artifact, risk-ratchet, and staged Test Plan evidence.

Title/ID: m0-rust-current-stable-dependency-refresh
Milestone: Milestone 0 — Repository Skeleton & Toolchain / Current stable Rust dependency refresh
Goal: Move every crates.io dependency to its current stable, maintained release while preserving Cohesix protocol, authority, no_std, target, and evidence contracts.
Inputs: Cargo.toml, Cargo.lock, all workspace Cargo.toml files, host and no_std Rust sources/tests, RustSec advisories, crates.io release metadata, and staged Test Plan gates.
Changes:
  - Cargo manifests + Cargo.lock — refresh compatible dependencies, migrate direct breaking releases, and remove or replace unmaintained dependency lanes.
  - host and no_std Rust sources/tests — adapt only the APIs required by the dependency migrations without changing Cohesix behavior, protocol, authority, or generated interfaces.
  - docs/BUILD_PLAN.md + dependency-policy evidence — record exact scope, validation, intentional retained exceptions if any, and the final dependency frontier.
Commands:
  - cargo update
  - cargo fmt --all -- --check
  - cargo clippy --workspace --all-targets -- -D warnings
  - cargo check --workspace
  - cargo check -p pi4-driver-runtime --target aarch64-unknown-none
  - cargo test --workspace -- --test-threads=1
  - cargo audit
  - cargo deny check advisories
  - scripts/check-generated.sh
  - scripts/ci/check_test_plan.sh
  - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m0-rust-current-stable-dependencies-qemu
Checks: every direct crates.io dependency resolves to its current stable maintained release or has a documented target/contract blocker; the resolved graph has no unaddressed advisory regression; all mandatory repository gates pass without product, protocol, authority, no_std, generated-artifact, or evidence-tier drift.
Deliverables: synchronized manifests and lockfile, required API migrations and tests, dependency/advisory evidence, generated-artifact verification, and staged Test Plan evidence.

Title/ID: m0-toml-1-1-4-maintenance
Milestone: Reopened Milestone 0 — Repository Skeleton & Toolchain / Current stable Rust dependency refresh
Goal: Qualify the TOML 1.1.4 patch refresh and close the generated-policy hash embedding drift exposed by its focused regression run without changing Cohesix behavior.
Inputs: Cargo.lock, the six direct TOML consumer manifests, exact Rust 1.97.1, coh-rtc generated policy/default artifacts, docs/USERLAND_AND_CLI.md, and dependency-policy checks.
Changes:
  - Cargo manifests + Cargo.lock — advance the six direct TOML consumers from 1.1.3 to 1.1.4 and retain the resolver-selected compatible transitive graph.
  - docs/USERLAND_AND_CLI.md — restore the two embedded generated hashes to the authoritative coh-rtc snippets; do not change policy/default semantics.
  - docs/BUILD_PLAN.md — record the bounded maintenance scope, exact resolved graph, and validation evidence.
Commands:
  - rustup show active-toolchain
  - cargo metadata --locked --no-deps --format-version 1
  - cargo fmt --all -- --check
  - cargo check --locked -p coh -p cohsh -p swarmui -p coh-rtc -p rust-risk-audit -p security-nist
  - cargo test --locked -p coh -p cohsh -p swarmui -p coh-rtc -p rust-risk-audit -p security-nist
  - cargo clippy --locked -p coh -p cohsh -p swarmui -p coh-rtc -p rust-risk-audit -p security-nist --all-targets -- -D warnings
  - python3 scripts/ci/check_swarmui_dependencies.py
  - cargo audit
  - cargo deny check advisories
  - scripts/check-generated.sh
Checks: all six affected packages compile and test under exact Rust 1.97.1; dependency/advisory policy remains green; generated artifacts and their embedded documentation blocks agree byte-for-byte.
Deliverables: synchronized manifests, lockfile, generated-doc embedding, and bounded validation evidence with Milestone 0 returned to Complete.

Title/ID: m0-host-setup-parity-repair
Milestone: Reopened Milestone 0 — Repository Skeleton & Toolchain / macOS and Ubuntu ARM64 host setup parity repair
Goal: Make one canonical setup command provision each supported host-build lane and a shared repository Python environment without overstating Linux target acceptance.
Inputs: toolchain/setup_macos_arm64.sh, toolchain/setup_linux_arm64.sh, scripts/setup_environment.sh, configs/test-plan-python-requirements.lock, tools/cohesix-py/pyproject.toml, README.md, docs/QUICKSTART.md, docs/TOOLCHAIN_MAC_ARM64.md, docs/PYTHON_SUPPORT.md, release inventory, and host setup tests.
Changes:
  - toolchain/setup_macos_arm64.sh — enforce macOS 26+, Apple Silicon, Xcode Command Line Tools, ripgrep, and HVF prerequisites before completing the existing pinned seL4 host setup.
  - toolchain/setup_linux_arm64.sh — enforce Ubuntu 22.04/24.04/26.04 ARM64, install the correct QEMU ARM system package and complete host-tool build dependencies, select Python 3.11+ per LTS, and verify diagnostic TCG.
  - toolchain/setup_repo_venv.sh — create the non-symlinked repository `.venv` from the hash-locked host-test closure and install `tools/cohesix-py` editable without optional integration or ML dependencies.
  - scripts/setup_environment.sh — keep the release-bundle path runtime-only, correct Ubuntu QEMU/GTK package selection, support the three ARM64 LTS releases, enable Universe only when installation is needed, fail closed on incompatible hosts, verify HVF or TCG, and install the exact bundled Python wheel into a protected `.venv` without conflating runtime readiness with target acceptance.
  - README.md + docs/QUICKSTART.md + docs/TOOLCHAIN_MAC_ARM64.md + docs/PYTHON_SUPPORT.md — project one-command setup for each OS and retain the distinct macOS construction, Linux diagnostic-QEMU, and target-acceptance boundaries.
  - tests/test_toolchain_setup.py + scripts/ci/check_test_plan.sh — guard platform, package, Python, documentation, and shell-syntax contracts. The complete host-tool suite, `tools/cohesix-py`, and performance benchmark scripts were reviewed; only Python environment installation is affected, with no protocol, benchmark workload, or report-schema change.
Commands:
  - bash -n toolchain/setup_macos_arm64.sh toolchain/setup_linux_arm64.sh toolchain/setup_repo_venv.sh
  - scripts/setup_environment.sh --check
  - .venv/bin/python -m pytest -q tests/test_toolchain_setup.py
  - scripts/check-generated.sh
  - scripts/ci/check_test_plan.sh
Checks: both installers reject hosts outside their exact support envelope before mutation, expose help without platform preflight, install the shared locked `.venv` by default, and preserve separate full-construction, diagnostic-QEMU, and acceptance claims; focused tests and repository consistency gates pass.
Deliverables: corrected canonical host installers, a shared repository Python bootstrap, simplified macOS/Linux quickstart documentation, and deterministic regression coverage with Milestone 0 returned to Complete.

Title/ID: m7a-event-pump-core
Goal: Replace the kernel_start spin loop with a cooperative no-std event pump.
Inputs: docs/ARCHITECTURE.md §§2,4; docs/SECURITY.md §§3-4; existing root-task entrypoint.
Changes:
  - crates/root-task/src/kernel.rs — remove spin loop, initialise serial/net/timer pollers, and document scheduling guarantees.
  - crates/root-task/src/event/mod.rs — new event pump coordinator orchestrating serial, timer, IPC, and networking tasks with explicit tick budgeting.
  - crates/root-task/tests/event_pump.rs — unit tests covering scheduling fairness, back-pressure propagation, and panic-free shutdown paths.
Commands: cd crates/root-task && cargo test event_pump && cargo check --features net && cargo clippy --features net --tests
Checks: Event pump drives serial, timer, and networking tasks deterministically; tests cover starvation and shutdown.
Deliverables: Root-task event pump replacing legacy loop with documented guarantees and regression tests.

Title/ID: m7a-serial-auth
Goal: Provide authenticated serial command handling with rate limiting and audit trails.
Inputs: docs/INTERFACES.md §§3,7-8; docs/SECURITY.md §5; embedded-io 0.4; heapless 0.8.
Changes:
  - crates/root-task/src/console/mod.rs — integrate heapless line editor, authentication state machine, and audit logging.
  - crates/root-task/src/console/serial.rs — implement no-std serial driver traits, UTF-8 sanitisation, and per-byte throttling metrics.
  - crates/root-task/tests/console_auth.rs — tests for login success/failure, rate limiting, control sequence rejection, and audit log outputs.
Commands: cd crates/root-task && cargo test console_auth && cargo check --features net && cargo clippy --features net --tests
Checks: Serial console authenticates commands, enforces throttling, and keeps event pump responsive under stress.
Deliverables: Hardened serial console with authentication, audit coverage, and passing tests.

Title/ID: m7a-net-loop
Goal: Embed the smoltcp-backed networking poller into the event pump with deterministic buffers.
Inputs: docs/ARCHITECTURE.md §§4,7; docs/SECURITY.md §4; smoltcp 0.11; heapless 0.8; portable-atomic 1.6.
Changes:
  - crates/root-task/src/net/mod.rs — finalise virtio-net PHY, smoltcp integration, and bounded queues with instrumentation.
  - crates/root-task/src/event/net.rs — event pump adapter scheduling smoltcp polls, handling link state, and surfacing metrics.
  - crates/root-task/tests/net_pump.rs — property tests for descriptor exhaustion, checksum validation, and PHY reset recovery.
Commands: cd crates/root-task && cargo test --features net net_pump && cargo check --features net && cargo clippy --features net --tests
Checks: Networking poller integrates with event pump, survives fault injection, and maintains deterministic buffer usage.
Deliverables: Networking subsystem integrated with event pump, documented, and guarded by targeted tests.

Title/ID: m7a-docs-migration
Goal: Update documentation for the event pump, authenticated console, and networking integration.
Inputs: docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/SECURITY.md, existing milestone notes.
Changes:
  - docs/ARCHITECTURE.md — describe event pump topology, serial/net modules, and removal of spin loop.
  - docs/SECURITY.md — record authenticated console threat model, rate limiting strategy, and memory quotas.
  - docs/REPO_LAYOUT.md & crate READMEs — outline developer workflows, feature flags, and testing commands for the new pump.
Commands: cargo doc -p root-task --document-private-items && mdbook build docs (if configured)
Checks: Documentation builds cleanly, reflects new architecture, and guides developers through migration.
Deliverables: Synchronized documentation explaining event pump adoption, security posture, and developer workflows.

Title/ID: m7b-serial-rx
Goal: Provide bidirectional serial I/O for the root-task console in QEMU.
Inputs: docs/ARCHITECTURE.md §2; docs/INTERFACES.md §7; seL4 virtio-console/PL011 specs; `embedded-io` 0.4 (optional traits).
Changes:
  - crates/root-task/src/console/serial.rs — MMIO-backed RX/TX driver exposing `read_byte`/`write_byte` without heap allocation, plus interrupt acknowledgement helpers and a shared rate-limiter primitive for reuse by the console loop.
  - crates/root-task/src/kernel.rs — initialise the serial driver, hook it into the event pump, remove the legacy busy loop, and document the wake-up ordering for timer/net/serial sources.
  - crates/root-task/tests/serial_stub.rs — host-side stub verifying backspace/line termination handling, throttle escalation, and the audit log entries emitted by repeated authentication failures.
Commands: cd crates/root-task && cargo test serial_stub && cargo check --features net && cargo clippy --features net --tests
Checks: Serial RX consumes interactive input without panics; console loop handles backspace/newline, rate limiting, and audit logging in QEMU.
Deliverables: Root-task serial driver initialised during boot with regression tests for RX edge cases and throttling safeguards.

Title/ID: m7b-net-substrate
Goal: Wire up a deterministic networking stack for the root task.
Inputs: docs/ARCHITECTURE.md §§4,7; docs/INTERFACES.md §§1,3,6; docs/SECURITY.md §4; smoltcp 0.11; heapless 0.8; portable-atomic 1.6.
Changes:
  - crates/root-task/Cargo.toml — add `smoltcp`, `heapless`, and `portable-atomic` dependencies behind a `net` feature along with feature docs explaining footprint impact.
  - crates/root-task/src/net/mod.rs — introduce PHY trait, virtio-net implementation (descriptor rings, IRQ handler), smoltcp device glue, bounded queues, and defensive checks for descriptor exhaustion.
  - crates/root-task/src/main.rs — initialise networking, register poller within the root-task event loop, and expose metrics hooks so audit logs can capture link bring-up status.
  - docs/SECURITY.md — document memory envelopes, networking threat considerations, and mitigations for RX flooding or malformed descriptors.
Commands: cd crates/root-task && cargo check --features net && cargo test --features net net::tests && cargo clippy --features net --tests
Checks: Smoltcp interface boots in QEMU with deterministic heap usage; unit tests cover RX/TX queue saturation, link bring-up, error paths, and descriptor validation.
Deliverables: Root-task networking module with virtio-net backend, updated security documentation, and passing feature-gated tests reinforced by lint coverage.

Title/ID: m7b-console-loop
Goal: Provide an authenticated serial/TCP command shell bound to capability checks.
Inputs: docs/INTERFACES.md §§3-5,8; docs/SECURITY.md §5; existing root-task timer/IPC code; heapless 0.8.
Changes:
  - crates/root-task/src/console/mod.rs — add finite-state parser, rate limiter, shared line editor for serial/TCP sources, and an authentication/session manager that reuses ticket validation helpers.
  - crates/root-task/src/main.rs — integrate console loop with networking poller and ticket validator while ensuring timer/NineDoor tasks retain service guarantees.
  - crates/root-task/tests/console_parser.rs — unit tests for verbs, overlong lines, login throttling, Unicode/control character handling, and audit log integration.
Commands: cd crates/root-task && cargo test --features net console_parser && cargo clippy --features net --tests
Checks: Parser rejects invalid verbs, enforces max length, rate limits failed logins, normalises newline sequences, and verifies capability enforcement via mocks.
Deliverables: Hardened console loop with comprehensive parser tests integrated into root-task and lint-clean CI coverage.

Title/ID: m7c-cohsh-tcp
Goal: Extend cohsh CLI with TCP transport parity while retaining existing flows.
Inputs: docs/USERLAND_AND_CLI.md §§2,6; docs/INTERFACES.md §§3,7; existing cohsh mock/QEMU transport code.
Changes:
  - apps/cohsh/Cargo.toml — gate TCP transport feature and dependencies, annotate default-off status, and document cross-compilation requirements for macOS hosts.
  - apps/cohsh/src/transport/tcp.rs — implement TCP client with ticket authentication, reconnect handling, heartbeats, and telemetry logging for CLI operators.
  - apps/cohsh/src/main.rs — add `--transport tcp` flag and configuration plumbing, including environment overrides and validation for mutually exclusive serial parameters.
  - docs/USERLAND_AND_CLI.md — document CLI usage, examples, regression scripts covering serial and TCP paths, and troubleshooting steps for QEMU port forwarding.
Commands: cd apps/cohsh && cargo test --features tcp && cargo clippy --features tcp --tests && cargo fmt --check
Checks: CLI attaches via TCP to QEMU instance, tails logs, forwards NineDoor commands, retains existing regression flow for serial transport, and recovers gracefully from simulated disconnects.
Deliverables: Feature-complete TCP transport with documentation, tests validating CLI behaviour, and formatting/lint coverage.

Title/ID: m7c-docs-integration-tests
Goal: Finalise documentation updates and cross-stack integration tests for networking milestone.
Inputs: docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/SECURITY.md, docs/USERLAND_AND_CLI.md; existing integration harness scripts.
Changes:
  - docs/ARCHITECTURE.md — describe networking module, console loop, PHY abstraction, and update diagrams to illustrate serial/net event pump interactions.
  - docs/INTERFACES.md — specify TCP listener protocol, authentication handshake, console commands, and error codes for throttling or malformed frames.
  - docs/SECURITY.md — extend threat model with networking attack surfaces, mitigations, audit expectations, and documented memory bounds.
  - tests/integration/qemu_tcp_console.rs — scripted boot + TCP session exercising help/attach/tail/log/quit verbs, plus negative tests for failed logins and overlong lines.
  - scripts/qemu-run.sh — accept networking flags, expose forwarded TCP port, document usage, and emit helpful diagnostics when host prerequisites (tap/tuntap) are missing.
Commands: ./scripts/qemu-run.sh --net tap --console tcp --exit-after 120 && cargo test -p tests --test qemu_tcp_console && cargo clippy -p tests --tests
Checks: Automated QEMU run brings up TCP console reachable from host; integration test passes end-to-end; documentation reviewed for consistency and security sign-off.
Deliverables: Updated documentation set, automation scripts, and passing QEMU TCP console integration test with lint coverage.

Title/ID: m7d-console-ack
Goal: Implement bidirectional console responses covering attach handshakes and command execution outcomes.
Inputs: docs/INTERFACES.md §7; docs/USERLAND_AND_CLI.md §6; apps/root-task/src/event/mod.rs; apps/root-task/src/net/virtio.rs; apps/cohsh/src/transport/tcp.rs.
Changes:
  - apps/root-task/src/event/mod.rs — introduce an acknowledgement dispatcher that emits success/error lines for each validated command, wiring into both serial and TCP paths.
  - apps/root-task/src/net/virtio.rs & apps/root-task/src/net/queue.rs — plumb outbound console buffers so TCP clients receive the acknowledgement lines generated by the event pump without blocking polling guarantees.
  - apps/cohsh/src/transport/tcp.rs — consume acknowledgement lines for attach/command verbs, surfacing them in CLI output and telemetry, and hardening reconnect flows when acknowledgements are missing.
  - docs/INTERFACES.md & docs/USERLAND_AND_CLI.md — document the acknowledgement grammar, heartbeat expectations, and troubleshooting guidance for mismatched responses.
Commands: (cd apps/root-task && cargo test --features net && cargo clippy --features net --tests && cargo fmt --check) && (cd apps/cohsh && cargo test --features tcp && cargo clippy --features tcp --tests && cargo fmt --check)
Checks: TCP console responds with acknowledgements for attach/log/tail commands; serial harness mirrors the same output; regression suite covers success and failure cases with deterministic logs.
Deliverables: Bidirectional console acknowledgements spanning serial and TCP transports, updated protocol documentation, and passing unit/integration tests with lint/format coverage.

Title/ID: m09-codec-core-split
Goal: Extract codec/core crates with bounded tag windows and batch iterators.
Inputs: crates/secure9p-codec, crates/secure9p-core, crates/secure9p-transport, configs/root_task.toml (new IR fields), docs/SECURE9P.md excerpts.
Changes:
  - crates/secure9p-codec/lib.rs — move frame encode/decode + batch iterators; add fuzz corpus harness.
  - crates/secure9p-core/lib.rs — session manager with tag window enforcement and queue depth accounting.
  - apps/nine-door/src/host/pipeline.rs — enforce queue limits and short-write retry back-off.
Commands:
  - cargo test -p secure9p-codec
  - cargo test -p secure9p-core
Checks:
  - Tag overflow attempt (tags_per_session + 1) returns deterministic ERR and audit line.
Deliverables:
  - Updated crate split, manifest IR additions, and queue depth limits documented in docs/SECURE9P.md.

Title/ID: m09-batched-io-regression
Goal: Prove batched write ordering and back-pressure across CLI + Regression Pack.
Inputs: scripts/cohsh/9p_batch.coh, apps/nine-door/tests/pipelining.rs.
Changes:
  - apps/nine-door/tests/pipelining.rs — four-session interleave with induced short writes.
  - scripts/cohsh/9p_batch.coh — add overflow case asserting ERR on batch > msize.
Commands:
  - cargo test -p nine-door --test pipelining
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/9p_batch.coh
Checks:
  - Out-of-order responses preserved; batch larger than msize is rejected with logged ERR.
Deliverables:
  - Regression outputs archived; docs/INTERFACES.md snippet refreshed from manifest.

Title/ID: m10-ring-impl
Goal: Implement bounded append-only rings with cursor state machine.
Inputs: apps/nine-door/src/host/telemetry/, configs/root_task.toml telemetry fields.
Changes:
  - apps/nine-door/src/host/telemetry/{ring.rs,cursor.rs} — ring write/read, cursor resume, wraparound handling.
  - crates/secure9p-core/lib.rs — append-only helpers for offsets and short-write signalling.
Commands:
  - cargo test -p nine-door --test telemetry_ring
  - cargo test -p secure9p-core
Checks:
  - Write past ring_bytes_per_worker rejects with ERR and audit entry; cursor resume returns deterministic frame ordering.
Deliverables:
  - Ring implementation and manifest-aligned quotas documented in docs/INTERFACES.md.

Title/ID: m10-cbor-schema-regen
Goal: Define CBOR frame schema and regenerate bootstrap/fixtures.
Inputs: tools/coh-rtc/src/codegen/cbor.rs, apps/root-task/src/generated/bootstrap.rs.
Changes:
  - tools/coh-rtc/src/codegen/cbor.rs — schema + Markdown export.
  - apps/root-task/src/generated/bootstrap.rs — emit ring quotas and cursor retention flags.
Commands:
  - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/telemetry_ring.coh
Checks:
  - CLI script proves wraparound and stale cursor rejection; regenerated schema matches docs snippet.
Deliverables:
  - Updated manifest IR, CBOR schema excerpts in docs/INTERFACES.md.

Title/ID: m11-sidecar-skeleton
Goal: Create host sidecar bridge and manifest-gated /host namespace.
Inputs: apps/host-sidecar-bridge/, configs/root_task.toml (ecosystem.host.*).
Changes:
  - apps/host-sidecar-bridge/src/main.rs — provider mounts, append-only control writers, mock mode.
  - apps/nine-door/src/host/namespace.rs — conditional mount for /host based on manifest.
Commands:
  - cargo test -p host-sidecar-bridge
  - cargo run -p host-sidecar-bridge -- --mock --mount /host
Checks:
  - Disabled manifest omits /host entirely; enabling exposes mocked controls without TCP listeners inside VM.
Deliverables:
  - Host bridge crate and manifest toggles documented in docs/ARCHITECTURE.md.

Title/ID: m11-policy-roles
Goal: Enforce role-based append-only controls with audit.
Inputs: docs/INTERFACES.md control grammar, scripts/cohsh/host_sidecar_mock.coh.
Changes:
  - apps/nine-door/src/host/control.rs — queen-only write enforcement and append-only audit logging.
  - scripts/cohsh/host_sidecar_mock.coh — denied-write then approved-write flow.
Commands:
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/host_sidecar_mock.coh
  - cargo test -p nine-door --test host_sidecar_policy
Checks:
  - Non-queen write returns ERR EPERM; audit line includes ticket and path; approved write succeeds deterministically.
Deliverables:
  - CLI regression outputs captured; docs/SECURITY.md mentions audit expectations.

Title/ID: m12-policyfs-provider
Goal: Implement PolicyFS nodes and append-only gating for risky controls.
Inputs: apps/nine-door/src/host/{policy.rs,namespace.rs}, configs/root_task.toml (ecosystem.policy.*).
Changes:
  - apps/nine-door/src/host/policy.rs — providers for /policy/ctl, /policy/rules, /actions/*.
  - apps/nine-door/src/host/control.rs — enforcement hook requiring approvals before queen/host writes.
Commands:
  - cargo test -p nine-door --test policyfs
  - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json
Checks:
  - Missing approval produces ERR EPERM with audit; enabling flag publishes /policy tree; disabling removes it.
Deliverables:
  - PolicyFS provider code and manifest schema updates referenced in docs/INTERFACES.md.

Title/ID: m12-approval-regression
Goal: Demonstrate denied→approved flow and replay refusal.
Inputs: scripts/cohsh/policy_gate.coh.
Changes:
  - scripts/cohsh/policy_gate.coh — stepwise denied action, approval append, approved retry, replay attempt.
  - docs/SECURITY.md appendix note on approval replay limits (snippet refreshed from manifest).
Commands:
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/policy_gate.coh
Checks:
  - Replay attempt after approval consumption returns ERR and no duplicate action; ACK/ERR sequence deterministic.
Deliverables:
  - CLI transcript stored; manifest hash recorded for regression comparison.

Title/ID: m13-auditfs-journal
Goal: Add append-only audit journal and decision logs with bounded storage.
Inputs: apps/nine-door/src/host/audit.rs, configs/root_task.toml (ecosystem.audit.*).
Changes:
  - apps/nine-door/src/host/audit.rs — /audit/journal and /audit/decisions providers, append-only enforcement.
  - apps/nine-door/src/host/telemetry/mod.rs — hook to emit audit lines into telemetry ring.
Commands:
  - cargo test -p nine-door --test auditfs
Checks:
  - Random-write attempts to journal rejected with ERR; storage cap enforced with deterministic truncation policy.
Deliverables:
  - Audit schema documented in docs/INTERFACES.md via compiler snippet.

Title/ID: m13-replayfs-determinism
Goal: Implement bounded replay control with deterministic ACK/ERR.
Inputs: apps/nine-door/src/host/replay.rs, scripts/cohsh/replay_journal.coh.
Changes:
  - apps/nine-door/src/host/replay.rs — /replay/ctl, /replay/status, cursor handling within bounded window.
  - scripts/cohsh/replay_journal.coh — record then replay sequence plus over-window abuse case.
Commands:
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/replay_journal.coh
  - cargo test -p nine-door --test replayfs
Checks:
  - Replay beyond window or when disabled returns ERR; successful replay reproduces byte-identical ACK/ERR.
Deliverables:
  - Replay semantics and bounds captured in docs/SECURITY.md and docs/INTERFACES.md.

Title/ID: m14-shard-mapping
Goal: Implement shard layout helper and sharded fid table.
Inputs: apps/nine-door/src/host/namespace.rs, crates/secure9p-core fid table.
Changes:
  - apps/nine-door/src/host/namespace.rs — ShardLayout mapping with alias toggle.
  - crates/secure9p-core/lib.rs — per-shard fid tables and lock partitioning.
Commands:
  - cargo test -p nine-door --test shard_scale
  - cargo test -p secure9p-core
Checks:
  - Over-depth shard+alias combination rejected by manifest validation; 1k worker attach latency within documented bounds.
Deliverables:
  - Shard tables emitted to generated bootstrap and referenced in docs/ROLES_AND_SCHEDULING.md.

Title/ID: m14-shard-regression
Goal: Validate legacy alias compatibility and sharded CLI flows.
Inputs: scripts/cohsh/shard_1k.coh (new), tests/integration shard_1k harness.
Changes:
  - scripts/cohsh/shard_1k.coh — attaches to shard and legacy alias paths; includes disabled-alias negative case.
  - docs/INTERFACES.md snippet showing shard path grammar generated from manifest.
Commands:
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/shard_1k.coh
Checks:
  - Legacy path fails deterministically when alias disabled; succeeds when enabled with identical ACK ordering.
Deliverables:
  - Regression transcript captured; manifest hash recorded for docs.

Title/ID: m15-session-pool
Goal: Add pooled sessions and retry policies to cohsh.
Inputs: apps/cohsh/src/lib.rs, configs/root_task.toml client_policies.*.
Changes:
  - apps/cohsh/src/lib.rs — session pool, batched Twrite helper, policy hash enforcement.
  - apps/cohsh/src/transport/tcp.rs — retry scheduling and reconnect handling.
Commands:
  - cargo test -p cohsh --tests
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/session_pool.coh
Checks:
  - Connection drop triggers retries without duplicate telemetry; pool exhaustion returns deterministic ERR and audit.
Deliverables:
  - Updated client policy TOML emitted by compiler and referenced in docs/USERLAND_AND_CLI.md.

Title/ID: m15-throughput-benchmark
Goal: Measure throughput improvements and ensure ordering stability.
Inputs: apps/cohsh/tests/pooling.rs, scripts/cohsh/session_pool.coh outputs.
Changes:
  - apps/cohsh/tests/pooling.rs — throughput benchmark comparing single vs pooled sessions with injected short writes.
  - docs/SECURITY.md — note on ordering/idempotency with snippet from manifest.
Commands:
  - cargo test -p cohsh --test pooling
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/session_pool.coh
Checks:
  - ACK/ERR ordering unchanged from baseline; retries logged once per failure; benchmark shows expected throughput gain.
Deliverables:
  - Benchmark data archived; manifest hash updated in docs.

Title/ID: m16-proc-providers
Goal: Implement observability providers without new protocols.
Inputs: apps/nine-door/src/host/observe.rs, apps/root-task/src/event/mod.rs.
Changes:
  - apps/nine-door/src/host/observe.rs — providers for /proc/9p/* and /proc/ingest/* with bounded buffers.
  - apps/root-task/src/event/mod.rs — metrics update hooks without heap allocation.
Commands:
  - cargo test -p nine-door --test observe
  - cargo test -p root-task
Checks:
  - Under stress, metrics remain accurate; abuse case polling watch node throttles without allocations.
Deliverables:
  - Observability nodes documented in docs/INTERFACES.md and docs/SECURITY.md via compiler snippets.

Title/ID: m16-cli-regressions
Goal: Validate CLI grammar and negative cases for observability nodes.
Inputs: scripts/cohsh/observe_watch.coh.
Changes:
  - scripts/cohsh/observe_watch.coh — tail watch node, induce back-pressure, request unsupported node to assert ERR.
  - docs/SECURITY.md — capture latency/metric tolerances.
Commands:
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/observe_watch.coh
Checks:
  - Unsupported node returns deterministic ERR; watch grammar matches golden; back-pressure logs recorded.
Deliverables:
  - Regression transcript stored; manifest hash noted in docs.

Title/ID: m17-cas-provider
Goal: Implement CAS provider and manifest validation for updates/models.
Inputs: apps/nine-door/src/host/cas.rs, configs/root_task.toml cas.* fields.
Changes:
  - apps/nine-door/src/host/cas.rs — chunk integrity checks, delta packs, signature enforcement.
  - tools/coh-rtc/src/codegen/cas.rs — emit IR v1.4 fields and templates.
Commands:
  - cargo test -p nine-door --test cas_provider
  - cargo test -p tools/coh-rtc
Checks:
  - Hash mismatch causes ERR and quarantine; chunk_size > msize rejected at compile time.
Deliverables:
  - CAS grammar documented in docs/INTERFACES.md with compiler snippets.

Title/ID: m17-cas-regressions
Goal: Validate end-to-end CAS roundtrip and model binding.
Inputs: scripts/cohsh/cas_roundtrip.coh, scripts/cohsh/model_cas_bind.coh, apps/cas-tool/.
Changes:
  - apps/cas-tool/src/main.rs — bundle creation, manifest generation, upload helper.
  - scripts/cohsh/cas_roundtrip.coh — resume + signature paths including negative signature case.
  - scripts/cohsh/model_cas_bind.coh — bind model into worker namespace and assert read-only.
Commands:
  - cargo test -p cas-tool
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/cas_roundtrip.coh
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/model_cas_bind.coh
Checks:
  - Replay after interruption resumes without duplication; signature failure returns deterministic ERR and audit.
Deliverables:
  - Regression outputs stored; docs/SECURITY.md updated with CAS threat model references.

Title/ID: m19-sidecar-framework
Goal: Build the host sidecar framework and bounded bus template.
Inputs: apps/sidecar-bus/, apps/worker-bus/, configs/root_task.toml sidecars.modbus and sidecars.dnp3.
Changes:
  - apps/sidecar-bus/src/lib.rs — capability-scoped adapters with feature gates for modbus/dnp3.
Commands:
  - cargo test -p sidecar-bus --features modbus,dnp3
  - cargo test -p worker-bus
Checks:
  - Unauthorized mount access returns ERR; bounded spool behavior is verified in tests.
Deliverables:
  - Sidecar patterns documented in docs/ARCHITECTURE.md and docs/INTERFACES.md.

Title/ID: m19-cli-regressions
Goal: Validate manifest-gated mounts and offline spooling behaviour.
Inputs: scripts/cohsh/sidecar_integration.coh, Regression Pack.
Changes:
  - scripts/cohsh/sidecar_integration.coh — mount enable/disable checks, offline spool replay, unauthorized write attempt.
  - docs/SECURITY.md — note on namespace collision avoidance via hash-prefix.
Commands:
  - cohsh --script scripts/cohsh/sidecar_integration.coh
Checks:
  - Disabled manifest hides mounts; offline spool flushes deterministically; unauthorized write produces ERR and audit.
Deliverables:
  - CLI transcript stored; manifest hash updated in docs.

Title/ID: m19-core-crate
Goal: Extract shared verb grammar and transports into cohsh-core.
Inputs: apps/cohsh/src/lib.rs existing grammar, scripts/cohsh/boot_v0.coh fixtures.
Changes:
  - crates/cohsh-core/lib.rs — verb parser, ACK/ERR model, smoltcp TCP transport feature.
  - apps/cohsh/src/lib.rs — refactor to consume cohsh-core.
Commands:
  - cargo test -p cohsh-core
  - cargo test -p cohsh --tests
Checks:
  - Invalid ticket returns deterministic ERR; heapless build passes without allocations beyond bounded buffers.
Deliverables:
  - Shared crate and regenerated grammar snippets in docs/USERLAND_AND_CLI.md.

Title/ID: m19-transcript-harness
Goal: Ensure transcript parity across console/TCP/core transports.
Inputs: scripts/cohsh/boot_v0.coh, new tests in crates/cohsh-core/tests/transcripts.rs.
Changes:
  - crates/cohsh-core/tests/transcripts.rs — compare serial vs TCP vs in-process transcripts.
Commands:
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/boot_v0.coh
  - cargo test -p cohsh-core --test transcripts
Checks:
  - Transcript diff produces zero-byte delta; abuse case with throttled login emits ERR and matches across transports.
Deliverables:
  - Stored golden fixtures owned by the focused transcript test.

Title/ID: m20a-client-api
Goal: Build CohClient library with tail and control helpers.
Inputs: apps/cohsh/src/lib.rs, crates/cohsh-core transport.
Changes:
  - apps/cohsh/src/client.rs — CohClient struct with open/read/write/clunk and tail helper.
  - apps/cohsh/src/queen.rs — spawn/kill/budget helpers wrapping JSON writes.
Commands:
  - cargo test -p cohsh --test client_lib
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/boot_v0.coh
Checks:
  - Walking `..` or disabled namespace returns ERR; tail stream matches console transcript.
Deliverables:
  - Client API docs in docs/USERLAND_AND_CLI.md via compiler snippet.

Title/ID: m20a-replay-harness
Goal: Replay sessions over 9P and compare to console baselines.
Inputs: scripts/cohsh/session_pool.coh, new regression harness for 9P replay.
Changes:
  - scripts/cohsh/session_pool.coh — add 9P-only replay path and abuse case for forbidden walk.
  - apps/cohsh/tests/client_lib.rs — compares ACK/ERR across transports without
    a one-line repository wrapper.
Commands:
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/session_pool.coh
Checks:
  - Replay harness shows zero diff between 9P and console outputs; abuse case logs ERR without side effects.
Deliverables:
  - Updated regression pack metadata and manifest hashes.

Title/ID: m20b-provider-impl
Goal: Implement bounded UI providers with CBOR/text outputs.
Inputs: apps/nine-door/src/host/{observe.rs,policy.rs,updates.rs}, manifest toggles.
Changes:
  - apps/nine-door/src/host/observe.rs — add text + CBOR variants with cursor resume.
  - apps/nine-door/src/host/policy.rs — /policy/preflight providers with diff output.
Commands:
  - cargo test -p nine-door --test ui_providers
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/observe_watch.coh
Checks:
  - Disabled provider returns ERR; read beyond 32 KiB rejected; fuzz harness passes without panics.
Deliverables:
  - Provider docs and CBOR schemas refreshed in docs/INTERFACES.md.

Title/ID: m20b-updates-status
Goal: Surface update status for UI consumption via NineDoor.
Inputs: apps/nine-door/src/host/cas.rs status hooks, scripts/cohsh/cas_roundtrip.coh.
Changes:
  - apps/nine-door/src/host/cas.rs — expose /updates/<epoch>/{manifest.cbor,status} read-only nodes.
  - scripts/cohsh/cas_roundtrip.coh — add status fetch and disabled-provider abuse case.
Commands:
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/cas_roundtrip.coh
Checks:
  - Status node respects cursor resume; disabled updates return ERR without touching CAS store.
Deliverables:
  - UI fixture outputs stored; docs reference status grammar.

Title/ID: m20c-ui-backend
Goal: Wire SwarmUI backend to cohsh-core with 9P-only transport and per-ticket sessions.
Inputs: apps/swarmui/src-tauri/, crates/cohsh-core, scripts/cohsh/telemetry_ring.coh.
Changes:
- apps/swarmui/src-tauri/main.rs — session management (per ticket), ticket auth, telemetry tail via cohsh-core.
- apps/swarmui/Cargo.toml — ensure no HTTP/REST deps; enable bounded offline cache feature.
Commands:
- cargo test -p swarmui
- cargo run -p cohsh –-features tcp – –transport tcp –script scripts/cohsh/telemetry_ring.coh
Checks:
- Unauthorized ticket returns ERR surfaced verbatim in UI; offline mode reads CBOR snapshot only.
Deliverables:
- UI backend notes and cache path documented in docs/USERLAND_AND_CLI.md.

Title/ID: m20c-ui-fixtures
Goal: Capture UI/CLI transcript parity and namespace-derived fleet rendering.
Inputs: UI snapshot fixtures, /proc/ingest providers.
Changes:
- apps/swarmui/tests/transcript.rs — compare UI-captured ACK/ERR/END to CLI golden.
- apps/swarmui/src/cache.rs — snapshot write/read with strict size bounds and expiry handling.
Commands:
- cargo test -p swarmui –test transcript
- cargo test -p cohsh-core
Checks:
- Transcript diff zero; cache bounded to documented size; expired cache rejected gracefully.
Deliverables:
- Updated docs/INTERFACES.md with SwarmUI consumption guidance and non-goals.

Title/ID: m20d-hive-renderer
Goal: Add GPU-first Live Hive renderer without altering protocol semantics.
Inputs: apps/swarmui/, crates/cohsh-core, telemetry streams, CBOR snapshots.
Changes:
- apps/swarmui/frontend/hive/ — PixiJS scene, simulation model, LOD rules.
- apps/swarmui/frontend/events.js — event → simulation diff mapping.
- apps/swarmui/src-tauri/ — replay mode wiring (no new verbs).
Commands:
- cargo test -p swarmui
- cargo run -p swarmui – –replay demo.cbor
Checks:
- Frame rate bounded; transcript parity preserved; no new deps.
Deliverables:
- Live Hive view documented as non-authoritative renderer in docs/INTERFACES.md.

Title/ID: m20d-hive-fixtures
Goal: Prove deterministic rendering and replay stability.
Inputs: golden transcripts, CBOR snapshots.
Changes:
- apps/swarmui/tests/replay.rs — snapshot-driven render smoke tests.
- docs/INTERFACES.md — Live Hive non-goals and degradation rules.
Commands:
- cargo test -p swarmui –test replay
Checks:
- Replay produces stable visual state; expired snapshots rejected cleanly.
Deliverables:
- Golden demo snapshots committed for CI and demos.

Title/ID: m20d-design-fonts
Goal: Establish a cross-platform, UI-safe font system aligned with Tauri and PixiJS best practices.
Inputs: apps/swarmui/, design guidelines, Tauri asset bundling.
Changes:
- apps/swarmui/frontend/assets/fonts/ — bundle Inter and JetBrains Mono font files (limited weights only).
- apps/swarmui/frontend/styles/fonts.css — define canonical font stacks and defaults.
- apps/swarmui/frontend/styles/tokens.css — expose font tokens (`--font-ui`, `--font-mono`, sizes, line-heights).
- Disable ligatures by default for monospace; expose opt-in toggle.
Commands:
- cargo test -p swarmui
Checks:
- Fonts load from local assets only (no system or network dependency).
- Text renders consistently across macOS, Windows, and Linux.
Deliverables:
- Documented font policy and usage rules in docs/INTERFACES.md.

Title/ID: m20d-design-colors
Goal: Define a minimal, dark-first color system shared by HTML UI and PixiJS hive renderer.
Inputs: SwarmUI frontend, PixiJS renderer.
Changes:
- apps/swarmui/frontend/styles/colors.css — base palette, semantic colors, opacity rules.
- apps/swarmui/frontend/styles/tokens.css — color tokens shared by UI and canvas overlays.
- apps/swarmui/frontend/hive/palette.js — PixiJS color constants derived from tokens.
Commands:
- cargo test -p swarmui
Checks:
- No hard-coded colors outside token files.
- Semantic colors (ACK/ERR/flow/load) map consistently between UI and hive.
Deliverables:
- Color token table and usage notes added to docs/INTERFACES.md.

Title/ID: m20d-design-layout
Goal: Lock down layout, spacing, and panel rules for a dense operator UI.
Inputs: SwarmUI frontend panels.
Changes:
- apps/swarmui/frontend/styles/layout.css — spacing scale (4/8/12/16/24/32), panel rules.
- Remove shadows; enforce separation via tone and spacing only.
- Standardise panel chrome (headers, dividers, empty states).
Commands:
- cargo test -p swarmui
Checks:
- No arbitrary spacing values outside the defined scale.
- Panels render consistently across platforms and DPI settings.
Deliverables:
- Layout and spacing rules documented for contributors.

Title/ID: m20d-design-icons
Goal: Standardise iconography for SwarmUI controls and panels.
Inputs: SwarmUI frontend.
Changes:
- apps/swarmui/frontend/assets/icons/ — bundle Phosphor Icons SVG subset.
- apps/swarmui/frontend/components/icon.js — single icon wrapper enforcing size/weight.
- Replace mixed or ad-hoc icons with Phosphor set.
Commands:
- cargo test -p swarmui
Checks:
- Single icon set used everywhere.
- Icon weights consistent for default vs active states.
Deliverables:
- Icon usage guidelines added to docs/INTERFACES.md.

Title/ID: m20d-hive-visual-language
Goal: Define and enforce the visual language for the Live Hive renderer.
Inputs: PixiJS hive renderer.
Changes:
- apps/swarmui/frontend/hive/style.js — shape, motion, glow, and blending constants.
- Enforce circle/soft-blob primitives only; no sharp geometry.
- Define motion easing and pulse rules for normal vs error states.
Commands:
- cargo test -p swarmui
Checks:
- Hive visuals conform to documented motion and shape rules.
- Error pulses are single-shot and bounded.
Deliverables:
- Live Hive visual language documented as non-authoritative rendering rules.

Title/ID: m20d-design-tokens
Goal: Centralise all design constants into a single token system.
Inputs: SwarmUI frontend, PixiJS renderer.
Changes:
- apps/swarmui/frontend/styles/tokens.css — fonts, colors, spacing, motion.
- apps/swarmui/frontend/hive/tokens.js — generated or mirrored constants for PixiJS.
- Remove duplicated constants across UI and renderer.
Commands:
- cargo test -p swarmui
Checks:
- No duplicated magic numbers in UI or hive renderer.
- Token changes propagate consistently.
Deliverables:
- Single source-of-truth design tokens referenced in docs/INTERFACES.md.

Title/ID: m20e-transcript-suite
Goal: Build shared transcript fixtures and comparison harness.
Inputs: tests/fixtures/transcripts/, console + TCP outputs.
Changes:
  - crates/cohsh-core/tests/transcripts.rs — own serial, TCP, and core fixture
    parity.
  - apps/cohsh/tests/transcripts.rs + apps/swarmui/tests/transcript.rs +
    apps/coh-status/tests/transcript.rs — own each frontend's current namespace
    projection and fixture.
Commands:
  - cargo test -p cohsh-core --test transcripts
  - cargo test -p cohsh --test transcripts
Checks:
  - Corrupted fixtures fail deterministically; each focused frontend transcript
    matches its TEST_PLAN-bound fixture.
Deliverables:
  - Transcript fixtures stored; docs/TEST_PLAN.md references their distinct
    hashes.

Title/ID: m20e-ui-cli-sync
Goal: Integrate SwarmUI/coh-status into convergence CI.
Inputs: apps/swarmui/tests/transcript.rs, apps/coh-status/tests/transcript.rs.
Changes:
  - apps/swarmui/tests/transcript.rs — capture UI transcript and feed into shared fixtures.
  - apps/coh-status/tests/transcript.rs — same for status tool.
Commands:
  - cargo test -p swarmui --test transcript
  - cargo test -p coh-status --test transcript
Checks:
  - UI/CLI/console retain shared ACK/ERR/END grammar while each current
    namespace projection matches its bound fixture.
Deliverables:
  - CI job definition referencing convergence tests; docs updated with expected tolerances.

Title/ID: m20f-ticket-quotas
Goal: Enforce per-ticket path/verb/rate quotas with audit metrics.
Inputs: apps/nine-door/src/host/security.rs, PumpMetrics.
Changes:
  - apps/nine-door/src/host/security.rs — quota checks, ui_denies/ui_reads metrics.
  - apps/nine-door/src/host/telemetry/mod.rs — audit lines for denials.
Commands:
  - cargo test -p nine-door --test ui_security
Checks:
  - Quota breach triggers ERR ELIMIT and increments metrics; replayed ticket denied deterministically.
Deliverables:
  - Quota tables documented via compiler output in docs/SECURITY.md.

Title/ID: m20f-cli-ui-regressions
Goal: Validate quota enforcement and multi-worker parity across CLI and UI clients.
Inputs: scripts/cohsh/telemetry_ring.coh, scripts/cohsh/shard_1k.coh, apps/cohsh/tests/script_catalog.rs, apps/swarmui/tests/security.rs.
Changes:
  - scripts/cohsh/telemetry_ring.coh — ensure read-only ticket write attempt and quota exhaustion loop remain deterministic.
  - scripts/cohsh/shard_1k.coh — add multi-worker coverage (second distinct-role spawn + telemetry checks).
  - apps/cohsh/tests/script_catalog.rs — refresh script hashes to include updated regression scripts.
  - apps/swarmui/tests/security.rs — mirror quota abuse from UI.
Commands:
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/telemetry_ring.coh
  - cargo test -p cohsh --test script_catalog
  - cargo test -p swarmui --test security
Checks:
  - ERR EPERM/ELIMIT identical across transports; metrics observed in /proc/ingest/watch.
  - Multi-worker telemetry paths pass `tail` without invalid path errors.
Deliverables:
  - Regression outputs captured; manifest hash noted in docs/USERLAND_AND_CLI.md.

Title/ID: m20f-regression-batch-determinism
Goal: Make the regression batch deterministic for worker-id dependent scripts and document it in the test plan.
Inputs: scripts/cohsh/run_regression_batch.sh, docs/TEST_PLAN.md, resources/proc_tests/selftest_full.coh.
Changes:
  - scripts/cohsh/run_regression_batch.sh — isolate worker-id scripts into dedicated boots and archive logs per script.
  - resources/proc_tests/selftest_full.coh — align worker ids with deterministic spawn ordering.
  - docs/TEST_PLAN.md — add regression batch requirements and ordering.
Commands:
  - scripts/cohsh/run_regression_batch.sh
Checks:
  - Regression batch passes with no worker-id drift across scripts.
Deliverables:
  - Updated test plan documenting the manual regression pack.

Title/ID: m20f-cohsh-tcp-pool-safety
Goal: Stabilize cohsh TCP pooling against the single-console connection while preserving pool bench semantics.
Inputs: apps/cohsh/src/transport/tcp.rs, apps/cohsh/src/main.rs, scripts/cohsh/session_pool.coh.
Changes:
  - apps/cohsh/src/transport/tcp.rs — add pooled TCP wrapper that avoids extra ATTACH/QUIT on shared connections.
  - apps/cohsh/src/main.rs — use pooled TCP wrapper for session pool factory.
  - apps/cohsh/src/lib.rs — adjust pool bench TCP expectations, payload limits, and skip CAT readback on console transports.
  - docs/USERLAND_AND_CLI.md — document TCP console pool bench expectations.
Commands:
  - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/session_pool.coh
Checks:
  - cohsh interactive commands do not drop the console connection; pool bench reports OK.
Deliverables:
  - Regression logs covering session_pool.coh.

Title/ID: m20f-swarmui-console-alignment
Goal: Align SwarmUI with the TCP console transport and add telemetry tail support without changing ACK/ERR grammar.
Inputs: apps/swarmui/src-tauri/main.rs, apps/swarmui/src/lib.rs, apps/root-task/src/event/mod.rs, apps/root-task/src/ninedoor.rs, docs/USERLAND_AND_CLI.md, docs/INTERFACES.md.
Changes:
  - apps/root-task/src/event/mod.rs — stream telemetry ring contents for tail requests with cursor tracking.
  - apps/root-task/src/ninedoor.rs — expose worker telemetry reads for console tail.
  - apps/swarmui/src/lib.rs — add console backend using cohsh transport and server-managed telemetry tails.
  - apps/swarmui/src-tauri/main.rs — select console vs 9P transport via env settings.
  - docs/USERLAND_AND_CLI.md — document SwarmUI transport selection and console telemetry tail behavior.
  - docs/INTERFACES.md — record SwarmUI console transport alignment and non-goals.
Commands:
  - cargo check -p cohsh -p swarmui -p root-task
  - SEL4_BUILD_DIR=$HOME/seL4/build ./scripts/cohesix-build-run.sh --sel4-build "$HOME/seL4/build" --out-dir out/cohesix --profile release --root-task-features cohesix-dev --cargo-target aarch64-unknown-none --raw-qemu --transport tcp
Checks:
  - SwarmUI connects via console transport and renders live hive updates.
  - Interactive cohsh command set succeeds against TCP console.
Deliverables:
  - Updated docs and telemetry tail audit logs.

Title/ID: m20f-console-frame-integrity
Goal: Prevent partial TCP console sends from corrupting frame boundaries for cohsh and SwarmUI sessions.
Inputs: apps/root-task/src/net/stack.rs, apps/root-task/src/drivers/virtio/net.rs, logs/qemu-run.log, logs/cohsh-queen-interactive.log.
Changes:
  - apps/root-task/src/net/stack.rs — gate TCP sends on available TX capacity; abort on partial send.
  - apps/root-task/src/drivers/virtio/net.rs — fix TX written_len accounting to avoid payload truncation on repeated bytes.
Commands:
  - cargo check -p root-task -p cohsh -p swarmui
  - SEL4_BUILD_DIR=$HOME/seL4/build ./scripts/cohesix-build-run.sh --sel4-build "$HOME/seL4/build" --out-dir out/cohesix --profile release --root-task-features cohesix-dev --cargo-target aarch64-unknown-none --raw-qemu --transport tcp
  - ./out/cohesix/host-tools/cohsh --transport tcp --tcp-host 127.0.0.1 --tcp-port 31337 --role queen
  - scripts/cohsh/run_regression_batch.sh
Checks:
  - Interactive cohsh commands (tail, ping, ls, cat, echo, spawn, kill, bind, mount) remain attached without reconnect loops.
  - SwarmUI console session stays connected and updates hive telemetry.
  - Applicable regression pack passes with existing contract outputs unchanged.
  - virtio-net TX logs show written_len == payload_len for console frames; no invalid UTF-8 in console stream.
Deliverables:
  - Updated qemu + cohsh logs showing stable tail output.

Title/ID: m20f-console-utf8-safe-truncation
Goal: Prevent log truncation from emitting invalid UTF-8 that drops console sessions.
Inputs: apps/root-task/src/net/outbound.rs, logs/cohsh-queen-*.log.
Changes:
  - apps/root-task/src/net/outbound.rs — truncate log lines on UTF-8 boundaries; add regression test.
Commands:
  - cargo test -p root-task
Checks:
  - LineBuf truncation preserves valid UTF-8; cohsh no longer drops on bind/mount sequence.
Deliverables:
  - Updated root-task test output; cohsh interactive logs for bind/mount.

Title/ID: m20f-console-parity-plan
Goal: Capture a reproducible trace of TCP console frame integrity issues and validate cohsh/SwarmUI parity before fixes.
Inputs: logs/tcpdump-new-*.log, logs/qemu-run-*.log, apps/root-task/src/net/stack.rs, apps/root-task/src/net/outbound.rs, apps/cohsh/src/transport/tcp.rs, apps/cohsh/src/lib.rs.
Changes:
  - docs/BUILD_PLAN.md — record the console parity debug/validation plan and required logs.
  - docs/BUILD_PLAN.md — capture interactive vs script-mode differences (auto-log, REPL keepalive, console lock) and trace-correlation checklist.
Commands:
  - SEL4_BUILD_DIR=$HOME/seL4/build ./scripts/cohesix-build-run.sh --sel4-build "$HOME/seL4/build" --out-dir out/cohesix --profile release --root-task-features cohesix-dev --cargo-target aarch64-unknown-none --raw-qemu --transport tcp
  - COHSH_TCP_DEBUG=1 ./out/cohesix/host-tools/cohsh --transport tcp --tcp-host 127.0.0.1 --tcp-port 31337 --role queen
  - COHSH_TCP_DEBUG=1 ./out/cohesix/host-tools/cohsh --transport tcp --tcp-host 127.0.0.1 --tcp-port 31337 --role worker
  - scripts/cohsh/run_regression_batch.sh
  - rg "Flags \\[R\\]" logs/tcpdump-new-*.log
Checks:
  - Console frames remain valid (no invalid UTF-8 payloads, no send.partial aborts) during the full interactive command surface.
  - Interactive vs script traces show consistent ACK/ERR/END ordering for log/tail/cat without server-side RST.
  - Console lock semantics preserved; concurrent attachments require explicit COHSH_CONSOLE_LOCK=0 (debug only).
Deliverables:
  - Updated cohsh/QEMU/tcpdump logs documenting frame integrity and interactive parity.
  - Trace-correlation notes mapping cohsh commands to tcpdump RST/FIN events.

Title/ID: m20f-cohsh-interactive-parity
Goal: Ensure interactive cohsh commands and SwarmUI console sessions match script-mode behavior without connection churn.
Inputs: apps/root-task/src/event/mod.rs, apps/root-task/src/net/stack.rs, apps/root-task/src/net/console_srv.rs, apps/cohsh/src/transport/tcp.rs, apps/swarmui/src/lib.rs, logs/cohsh-*.log.
Changes:
  - apps/root-task/src/event/mod.rs — align CAT/TAIL streaming with pending stream handling and consistent END emission.
  - apps/root-task/src/net/stack.rs — tune console send pacing/backpressure handling for stream output; rate-limit `tcp.flush.blocked` audit spam.
  - apps/root-task/src/net/console_srv.rs — preserve END delivery without reordering stream data lines.
  - apps/cohsh/src/transport/tcp.rs — harden console stream reads/reconnect logic and enforce exclusive console locking.
  - apps/swarmui/src/lib.rs — match SwarmUI console error handling to cohsh transport semantics.
Commands:
  - cargo check -p root-task -p cohsh -p swarmui
  - SEL4_BUILD_DIR=$HOME/seL4/build ./scripts/cohesix-build-run.sh --sel4-build "$HOME/seL4/build" --out-dir out/cohesix --profile release --root-task-features cohesix-dev --cargo-target aarch64-unknown-none --raw-qemu --transport tcp
  - ./out/cohesix/host-tools/cohsh --transport tcp --tcp-host 127.0.0.1 --tcp-port 31337 --role queen
  - ./out/cohesix/host-tools/cohsh --transport tcp --tcp-host 127.0.0.1 --tcp-port 31337 --role worker
  - scripts/cohsh/run_regression_batch.sh
Checks:
  - All interactive cohsh commands succeed without reconnect loops for both queen and worker roles.
  - SwarmUI console transport remains attached and renders hive updates.
  - Applicable regression pack passes with existing contract outputs unchanged.
Deliverables:
  - Updated QEMU + cohsh logs validating interactive parity and SwarmUI stability.

Title/ID: m20f-ticket-mint-oneshots
Goal: Add host-only ticket mint one-shots to cohsh and SwarmUI without changing console grammar.
Inputs: configs/root_task.toml, docs/WORKER_TICKETS.md, docs/HOST_TOOLS.md, docs/USERLAND_AND_CLI.md.
Changes:
  - apps/cohsh/src/main.rs — add `--mint-ticket` CLI path with config-backed secrets.
  - apps/cohsh/src/ticket_mint.rs — shared ticket mint helper (config parsing, defaults, subject validation).
  - apps/cohsh/tests/ticket_mint.rs — verify minted tickets decode with defaults and subject rules.
  - apps/cohsh/Cargo.toml — add test dependency for ticket mint fixtures.
  - apps/swarmui/src-tauri/main.rs — add `--mint-ticket` CLI path and Tauri command for UI button.
  - apps/swarmui/frontend/index.html — add Mint Ticket controls.
  - apps/swarmui/frontend/app.js — wire Mint Ticket button to backend.
  - docs/WORKER_TICKETS.md — document cohsh/SwarmUI one-shot minting.
  - docs/HOST_TOOLS.md — add CLI usage examples.
  - docs/USERLAND_AND_CLI.md — document flags and env vars.
  - docs/TEST_PLAN.md — add the ticket mint test step.
Commands:
  - cargo test -p cohsh --test ticket_mint
  - cargo test -p swarmui --test security
Checks:
  - Worker roles require subject; queen subject optional.
  - Minted ticket decodes with the role secret and includes default budgets.
Deliverables:
  - Cohsh/SwarmUI minting examples and updated docs.

Title/ID: m20f1-swarmui-packaging
Goal: Package SwarmUI with the cohesix-dev host tool set.
Inputs: scripts/cohesix-build-run.sh, apps/swarmui/Cargo.toml.
Changes:
  - scripts/cohesix-build-run.sh — include swarmui when cohesix-dev is enabled.
Commands:
  - rm -rf out target
  - ./scripts/cohesix-build-run.sh --root-task-features cohesix-dev ...
Checks:
  - out/cohesix/host-tools/swarmui exists.
Deliverables:
  - Updated build script; clean build output.

Title/ID: m20f1-tauri-invoke-bridge
Goal: Fix SwarmUI invoke bridge detection for Tauri.
Inputs: apps/swarmui/frontend/app.js.
Changes:
  - apps/swarmui/frontend/app.js — use supported invoke bridge.
Commands:
  - cargo run -p swarmui
Checks:
  - UI connects without "Tauri API unavailable".
Deliverables:
  - Updated frontend invoke path.

Title/ID: m20f1-default-port
Goal: Align SwarmUI default TCP port with the console listener.
Inputs: apps/swarmui/src-tauri/main.rs, crates/net-constants.
Changes:
  - apps/swarmui/src-tauri/main.rs — default to `COHSH_TCP_PORT` when `SWARMUI_9P_PORT` unset.
Commands:
  - cargo run -p swarmui
Checks:
  - SwarmUI connects with no `SWARMUI_9P_PORT` set when QEMU forwards port 31337.
Deliverables:
  - Default port matches console transport.

Title/ID: m20f1-clean-build-warnings
Goal: Eliminate root-task build warnings during cohesix-dev builds.
Inputs: apps/root-task/src/event/mod.rs.
Changes:
  - apps/root-task/src/event/mod.rs — remove unused assignments in log streaming path.
Commands:
  - ./scripts/cohesix-build-run.sh --root-task-features cohesix-dev ...
Checks:
  - No warnings emitted during root-task build.
Deliverables:
  - Clean build with zero root-task warnings.

Title/ID: m20g-trace-core
Goal: Implement trace recorder/replayer in cohsh-core with bounds.
Inputs: crates/cohsh-core, tests/fixtures/traces/, docs/TEST_PLAN.md.
Changes:
  - crates/cohsh-core/src/trace.rs — bounded recorder/replayer with hash validation.
  - crates/cohsh-core/tests/trace.rs — tampered trace negative case.
Commands:
  - cargo test -p cohsh-core --test trace
Checks:
  - Truncated or tampered trace rejected; valid trace replays byte-identical ACK/ERR.
Deliverables:
  - Trace schema referenced in docs/TEST_PLAN.md via compiler snippet.

Title/ID: m20g-cohsh-replay
Goal: Wire cohsh CLI record/replay to cohsh-core trace format.
Inputs: apps/cohsh/src/main.rs, apps/cohsh/src/lib.rs, apps/cohsh/src/trace.rs, tests/fixtures/traces/, tests/fixtures/transcripts/trace_v0/, docs/USERLAND_AND_CLI.md, docs/TEST_PLAN.md.
Changes:
  - apps/cohsh/src/main.rs — add `--record-trace` and `--replay-trace` CLI entry points using cohsh-core.
  - apps/cohsh/src/lib.rs — expose trace driver for CLI use.
  - apps/cohsh/tests/trace.rs — record/replay parity + tamper rejection.
Commands:
  - cargo test -p cohsh --test trace
Checks:
  - cohsh record/replay matches cohsh-core fixtures; tampered trace rejected deterministically.
Deliverables:
  - cohsh trace CLI documented; canonical trace capture path referenced in docs/TEST_PLAN.md.

Title/ID: m20g-ui-replay
Goal: Add offline replay to SwarmUI and coh-status for deterministic UI tests.
Inputs: apps/swarmui/src/transport.rs, apps/swarmui/src-tauri/main.rs, apps/swarmui/tests/trace.rs, apps/coh-status/src/lib.rs, apps/coh-status/tests/trace.rs, docs/TEST_PLAN.md.
Changes:
  - apps/swarmui/src/transport.rs — trace transport factory for replay.
  - apps/swarmui/src-tauri/main.rs — `--replay-trace` entry point and decoding.
  - apps/swarmui/tests/trace.rs — trace replay transcript parity.
  - apps/coh-status/src/lib.rs — trace replay client wrapper + policy.
  - apps/coh-status/tests/trace.rs — trace replay transcript parity.
Commands:
  - cargo test -p swarmui --test trace
  - cargo test -p coh-status --test trace
Checks:
  - Replay matches stored trace_v0 transcripts; tampered trace rejected deterministically.
Deliverables:
  - Offline replay documentation; trace fixture in tests/fixtures/traces/trace_v0.trace and transcripts in tests/fixtures/transcripts/trace_v0/.

Title/ID: m20g-swarmui-header
Goal: Add Cohesix header branding to the SwarmUI shell.
Inputs: apps/swarmui/frontend/index.html, docs/COHESIX_LOGO.png, apps/swarmui/frontend/styles/.
Changes:
  - apps/swarmui/frontend/index.html — add Cohesix header at the top of the SwarmUI shell.
  - apps/swarmui/frontend/styles/ — define header layout and spacing rules.
Commands:
  - cargo test -p swarmui
Checks:
  - Cohesix header renders at the top without disrupting layout or live hive rendering.
Deliverables:
  - SwarmUI displays the Cohesix header consistently across desktop and mobile sizes.

Title/ID: m21a-telemetry-namespace
Goal: Introduce a fixed telemetry namespace with OS-named segments.
Inputs: docs/ARCHITECTURE.md, docs/INTERFACES.md, existing NineDoor providers.
Changes:
	•	apps/nine-door/src/host/telemetry.rs — add provider for:
/queen/telemetry/<device_id>/ctl
/queen/telemetry/<device_id>/seg/<seg_id>
/queen/telemetry/<device_id>/latest
	•	apps/nine-door/src/host/namespace.rs — mount telemetry provider under /queen.
Commands:
	•	cargo test -p nine-door
Checks:
	•	Telemetry paths appear only when enabled.
	•	Segment files are append-only and OS-named.
Deliverables:
	•	Telemetry namespace live with no client-controlled naming.

Title/ID: m21a-telemetry-create-ctl
Goal: Implement severely limited “create” via control file.
Inputs: docs/INTERFACES.md (new schema), existing append-only control patterns.
Changes:
	•	apps/nine-door/src/host/telemetry.rs — handle ctl command:
{“new”:“segment”,“mime”:””}
	•	Emit deterministic ACK with assigned seg_id.
	•	Update /latest pointer on successful creation.
Commands:
	•	cargo test -p nine-door –test telemetry_create
Checks:
	•	Client cannot create files by path.
	•	Only ctl-based segment allocation is accepted.
Deliverables:
	•	OS-controlled segment allocation with deterministic responses.

Title/ID: m21a-telemetry-quotas
Goal: Enforce deterministic quotas and retention for telemetry segments.
Inputs: configs/root_task.toml (new fields), coh-rtc validation rules.
Changes:
	•	tools/coh-rtc/src/ir.rs — add telemetry_ingest.* fields:
max_segments_per_device
max_bytes_per_segment
max_total_bytes_per_device
eviction_policy (refuse | evict-oldest)
	•	apps/nine-door/src/host/telemetry.rs — enforce quotas and eviction.
Commands:
	•	cargo run -p coh-rtc – configs/root_task.toml
	•	cargo test -p nine-door –test telemetry_quotas
Checks:
	•	Quota exhaustion yields deterministic ERR or deterministic eviction.
Deliverables:
	•	Manifest-driven, bounded telemetry retention.

Title/ID: m21a-telemetry-envelope

Goal: Define and document the telemetry envelope format.
Inputs: docs/INTERFACES.md.
Changes:
	•	docs/INTERFACES.md — add schema cohsh-telemetry-push/v1.
	•	Enforce max_record_bytes (≤ 4096) server-side.
Commands:
	•	cargo test -p nine-door –test telemetry_envelope
Checks:
	•	Oversized records rejected deterministically.
Deliverables:
	•	Versioned, opaque telemetry envelope documented and enforced.

Title/ID: m21a-cohsh-telemetry-push
Goal: Add host-side telemetry push command to cohsh.
Inputs: docs/USERLAND_AND_CLI.md, existing cohsh 9P write helpers.
Changes:
	•	apps/cohsh/src/lib.rs — add command:
telemetry push <src_file> –device 
	•	Enforce file size limits, extension allowlist, chunking, and fixed destination.
	•	Resolve seg_id via ACK detail or /latest before appending.
Commands:
	•	cargo test -p cohsh
Checks:
	•	cohsh cannot write outside telemetry allowlist.
	•	Oversized files fail locally with deterministic ERR.
Deliverables:
	•	Safe host-side telemetry injection command.

Title/ID: m21a-telemetry-regression
Goal: Lock behaviour with deterministic CLI regression.
Inputs: scripts/cohsh/telemetry_push_create.coh.
Changes:
	•	scripts/cohsh/telemetry_push_create.coh — cover:
create success
push success
oversize failure
quota exhaustion behaviour
	•	Add script to the Regression Pack.
Commands:
	•	cargo run -p cohsh –features tcp – –transport tcp –script scripts/cohsh/telemetry_push_create.coh
Checks:
	•	Script passes unchanged across runs.
Deliverables:
	•	Regression coverage preventing scope

Title/ID: m21a-docs-sync
Goal: Update documentation to reflect as-built telemetry ingest.
Inputs: docs/ARCHITECTURE.md, docs/USERLAND_AND_CLI.md, docs/INTERFACES.md.
Changes:
	•	Document telemetry namespace, quotas, and create semantics.
Commands:
	•	mdbook build docs (if configured)
Checks:
	•	Docs match code behaviour exactly.
Deliverables:
	•	Docs-as-built alignment.

Title/ID: m21b-coh-cli-skeleton
Goal: Introduce coh host CLI with strict subcommand parsing and policy loading.
Inputs: crates/cohsh-core, docs/USERLAND_AND_CLI.md, docs/INTERFACES.md.
Changes:
  - apps/coh/src/main.rs — CLI entrypoint with mount/gpu/telemetry pull subcommands.
  - apps/coh/src/policy.rs — manifest-backed limits and allowlist loader.
Commands:
  - cargo test -p coh --features mock
Checks:
  - Unknown subcommand or invalid args returns deterministic ERR without side effects.
Deliverables:
  - coh CLI skeleton and policy loader documented in docs/USERLAND_AND_CLI.md.

Title/ID: m21b-coh-mount
Goal: Implement Secure9P-backed FUSE mount with bounded operations.
Inputs: secure9p-core, docs/SECURE9P.md.
Changes:
  - apps/coh/src/mount.rs — FUSE adapter enforcing path validation, append-only, and fid lifecycle.
  - apps/coh/tests/mount.rs — invalid path and offset denial tests.
Commands:
  - cargo test -p coh --features mock --test mount
Checks:
  - `..` walk attempts and oversized reads return deterministic ERR; mount never bypasses policy.
Deliverables:
  - FUSE mount docs and regression fixtures.

Title/ID: m21b-coh-gpu-telemetry
Goal: Add coh gpu UX and telemetry pull with mock backend.
Inputs: docs/GPU_NODES.md, docs/INTERFACES.md.
Changes:
  - apps/coh/src/gpu.rs — list/status/lease UX with mock and NVML backends.
  - apps/coh/src/telemetry.rs — resumable pull from /queen/telemetry/*.
Commands:
  - cargo run -p coh --features mock -- gpu list --mock
  - cargo run -p coh --features mock -- telemetry pull --mock --out out/telemetry
Checks:
  - Lease grant/deny is deterministic; telemetry pull resumes without duplicates.
Deliverables:
  - coh gpu + telemetry pull behavior documented with transcript fixtures.

Title/ID: m21c-swarmui-console-ui
Goal: Add a console panel with input, scrollback, and tail controls.
Inputs: apps/swarmui/frontend, docs/USERLAND_AND_CLI.md.
Changes:
  - apps/swarmui/frontend/components/console.js — input + scrollback UI.
  - apps/swarmui/frontend/styles/console.css — terminal styling.
Commands:
  - npm run lint (if configured) or cargo check -p swarmui
Checks:
  - Console renders without layout regressions; input accepts commands and displays output.
Deliverables:
  - SwarmUI console panel wired to the UI.

Title/ID: m21c-swarmui-console-bridge
Goal: Bridge console input/output through the existing SwarmUI session.
Inputs: apps/swarmui/src-tauri/main.rs, crates/cohsh-core.
Changes:
  - apps/swarmui/src-tauri/main.rs — expose send-line + stream events for prompt output.
  - apps/swarmui/src/lib.rs — reuse existing session; no new transport.
Commands:
  - cargo check -p swarmui
Checks:
  - Prompt uses the same TCP session; no parallel client sockets.
Deliverables:
  - Prompt input/output routed through existing console session.

Title/ID: m21c-swarmui-console-parity
Goal: Ensure prompt output ordering matches cohsh transcripts.
Inputs: crates/cohsh-core/tests/transcripts.rs, docs/TEST_PLAN.md.
Changes:
  - apps/swarmui/tests/console_parity.rs — compare prompt output framing to cohsh transcripts.
Commands:
  - cargo test -p swarmui --test console_parity
Checks:
  - ACK/ERR/END sequences match cohsh fixtures for baseline verbs.
Deliverables:
  - Parity test ensuring terminal output consistency.

Title/ID: m21d-maintenance-outstanding-work-restoration
Milestone: Reopened Milestone 21d — Deterministic Node Lifecycle & Operator Control; discovered in Milestone 26e / m26e-host-integration-dependency-contract and restored with m26e-worker-supervisor-child-isolation
Goal: Refuse maintenance while work retains authority and allow it after exact Worker containment, even while terminal evidence remains visible.
Inputs: The 2026-09-13 Pi GENET release burn-in reached 43 completed CUDA/PEFT jobs in 86 minutes, then drain reported 48 outstanding leases from retained Worker entries while the lease table was empty; current Worker projections and registered lease state.
Changes:
  - apps/root-task/src/{ninedoor.rs,worker_supervisor.rs,hal/worker_task.rs} — count queued, starting, ready, closing and faulted slots under the existing projection lock without copying the population; count registered active leases; preserve terminal identity and telemetry.
  - apps/nine-door/src/host/{core.rs,schedule.rs} — enforce registered lease obligations alongside active host-model Workers.
  - apps/root-task/tests/worker_supervisor.rs + apps/nine-door/tests/lifecycle.rs — independent state classification and lease refusal/preemption contracts.
  - docs/INTERFACES.md + docs/OPERATOR_RECIPES.md — distinguish Worker containment from the active lease table and retained evidence.
Compatibility review: cohsh, coh, Hive Gateway/REST, host-ticket-agent, gpu-bridge-host, host-sidecar-bridge, cas-tool, SwarmUI, cohesix-py and raw/REST performance scripts keep their existing grammar, schemas, finite budgets, error mappings, workloads and thresholds. Only the NineDoor host model and maintenance documentation require changes; generated contracts and other host implementations require none. This restores existing maintenance prerequisites without adding an admission path or changing Worker teardown.
Commands:
  - cargo test -p root-task --test worker_supervisor --test worker_fault_lifecycle
  - cargo test -p nine-door --test lifecycle
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml
  - scripts/check-generated.sh
  - scripts/ci/check_test_plan.sh
Checks: Queued/starting/ready/closing/faulted states block maintenance; absent/terminal states do not; registered leases refuse drain/quiesce/reset until preemption; fresh exact-image Pi work remains live, retires, permits drain with retained terminal evidence, and resumes new work after both host FUSE remounts. Preserve the original failed timed run and perform only the focused revalidation requested by the operator.
Deliverables: Scoped repair, host checks, exact Pi build/first-raw and focused maintenance evidence; no new full burn-in or release acceptance claim.

Title/ID: m21d-lifecycle-state-machine
Goal: Implement the node lifecycle state machine in root-task.
Inputs: docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/ROLES_AND_SCHEDULING.md.
Changes:
  - apps/root-task/src/lifecycle.rs — state machine + transition validation.
  - apps/root-task/src/lib.rs — hook lifecycle into boot + worker/ticket gating.
Commands:
  - cargo test -p root-task
Checks:
  - Invalid transitions return deterministic ERR with audit lines.
Deliverables:
  - Root-task lifecycle state machine with deterministic transitions.

Title/ID: m21d-lifecycle-ir
Goal: Add lifecycle policy fields to compiler IR and regenerate artifacts.
Inputs: configs/root_task.toml, tools/coh-rtc, docs/ARCHITECTURE.md.
Changes:
  - tools/coh-rtc/src/ir.rs — lifecycle policy fields (initial state, allowed auto transitions).
  - configs/root_task.toml — lifecycle policy configuration.
Commands:
  - cargo run -p coh-rtc
  - scripts/check-generated.sh
Checks:
  - Generated snippets update; invalid lifecycle policy is rejected.
Deliverables:
  - Manifest-backed lifecycle policy with validated defaults.

Title/ID: m21d-lifecycle-namespace
Goal: Expose lifecycle nodes via NineDoor and enforce permissions.
Inputs: apps/nine-door, docs/INTERFACES.md.
Changes:
  - apps/nine-door/src/host/lifecycle.rs — /proc/lifecycle/* + /queen/lifecycle/ctl.
  - apps/nine-door/src/host/namespace.rs — mount lifecycle provider.
Commands:
  - cargo test -p nine-door --test lifecycle
Checks:
  - `/proc/lifecycle/*` is read-only; `/queen/lifecycle/ctl` is queen-only append.
Deliverables:
  - Lifecycle nodes live with deterministic error semantics.

Title/ID: m21d-cohsh-lifecycle
Goal: Add cohsh lifecycle commands and update CLI docs.
Inputs: docs/USERLAND_AND_CLI.md, docs/INTERFACES.md.
Changes:
  - apps/cohsh/src/lib.rs — add `lifecycle` commands (cordon/drain/resume/quiesce/reset).
  - docs/USERLAND_AND_CLI.md — document lifecycle CLI surface and examples.
Commands:
  - cargo test -p cohsh
Checks:
  - CLI rejects invalid transitions locally with deterministic ERR.
Deliverables:
  - cohsh lifecycle commands with documented grammar.

Title/ID: m21d-lifecycle-regressions
Goal: Lock lifecycle behavior with deterministic regression scripts.
Inputs: scripts/cohsh/.
Changes:
  - scripts/cohsh/lifecycle_basic.coh
  - scripts/cohsh/lifecycle_drain_spool.coh
  - scripts/cohsh/lifecycle_reboot_resume.coh
Commands:
  - cohsh --script scripts/cohsh/lifecycle_basic.coh
Checks:
  - Scripts pass unchanged; transcript ordering stable.
Deliverables:
  - Regression coverage for lifecycle transitions and gating.

Title/ID: m21d-docs-failure-modes
Goal: Add operator-facing failure semantics and walkthroughs.
Inputs: docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/USERLAND_AND_CLI.md.
Changes:
  - docs/FAILURE_MODES.md — explicit failure behavior and recovery actions.
  - docs/OPERATOR_WALKTHROUGH.md — end-to-end lifecycle narrative with artifacts.
Commands:
  - mdbook build docs (if configured)
Checks:
  - Docs describe as-built behavior and reference canonical interfaces.
Deliverables:
  - Failure modes and operator walkthrough docs committed and referenced.

Title/ID: m21e-root-reachability-ir
Goal: Add root reachability and pressure nodes to IR and regenerate artifacts.
Inputs: configs/root_task.toml, tools/coh-rtc, docs/ARCHITECTURE.md, docs/INTERFACES.md.
Changes:
  - tools/coh-rtc/src/ir.rs — add /proc/root/* and /proc/pressure/* gates + bounds.
  - configs/root_task.toml — manifest toggles and size limits.
Commands:
  - cargo run -p coh-rtc
  - scripts/check-generated.sh
Checks:
  - Generated snippets list the new nodes with correct bounds.
Deliverables:
  - Regenerated snippets and manifest artifacts.

Title/ID: m21e-root-reachability-runtime
Goal: Track and expose root reachability and cut reason deterministically.
Inputs: apps/root-task, docs/ROLES_AND_SCHEDULING.md.
Changes:
  - apps/root-task/src/lifecycle.rs — integrate cut reason updates.
  - apps/root-task/src/observability.rs — emit /proc/root/* values.
Commands:
  - cargo test -p root-task
Checks:
  - reachable/cut_reason updates are deterministic and audited.
Deliverables:
  - Root reachability state wired to observability.

Title/ID: m21e-session-semantics
Goal: Expose per-session state for NineDoor sessions.
Inputs: apps/nine-door, docs/INTERFACES.md.
Changes:
  - apps/nine-door/src/host/session.rs — state tracking + /proc/9p/session/*.
  - apps/nine-door/src/host/namespace.rs — mount session provider.
Commands:
  - cargo test -p nine-door --test session_state
Checks:
  - Session transitions match SETUP/ACTIVE/DRAINING/CLOSED with stable output.
Deliverables:
  - Per-session observability nodes with deterministic state.

Title/ID: m21e-pressure-refusal
Goal: Standardize refusal reason tags and pressure counters.
Inputs: apps/root-task, apps/nine-door, docs/SECURITY.md.
Changes:
  - apps/root-task/src/event/mod.rs — emit ERR reason tags (busy/quota/cut/policy).
  - apps/nine-door/src/host/security.rs — increment /proc/pressure/* counters.
Commands:
  - cargo test -p root-task
  - cargo test -p nine-door --test pressure_counters
Checks:
  - Refusals increment counters and emit reason tags without new error names.
Deliverables:
  - Deterministic refusal tagging and pressure counters.

Title/ID: m21e-swarmui-livehive
Goal: Render root, session, and pressure state in Live Hive.
Inputs: apps/swarmui/frontend, apps/swarmui/src-tauri, docs/INTERFACES.md.
Changes:
  - apps/swarmui/frontend/hive/ — badges, counters, and session summary.
  - apps/swarmui/src-tauri/ — read new /proc text nodes.
Commands:
  - cargo check -p swarmui
Checks:
  - Live Hive displays root/cut, sessions, and pressure when view is active.
Deliverables:
  - Live Hive visuals wired to text-based /proc nodes.

Title/ID: m21e-regressions
Goal: Lock behavior with deterministic regression scripts and UI replay.
Inputs: scripts/cohsh/, docs/TEST_PLAN.md.
Changes:
  - scripts/cohsh/root_cut_basic.coh
  - scripts/cohsh/session_lifecycle.coh
  - scripts/cohsh/busy_backpressure.coh
Commands:
  - cohsh --script scripts/cohsh/root_cut_basic.coh
Checks:
  - Scripts pass unchanged; ACK/ERR ordering stable.
Deliverables:
  - Regression scripts for reachability, session lifecycle, and pressure.

Title/ID: m22-coh-run
Goal: Implement coh run wrapper with lease validation and bounded lifecycle logging.
Inputs: docs/GPU_NODES.md, docs/INTERFACES.md, cohsh-core transport.
Changes:
  - apps/coh/src/run.rs — lease check, command spawn, breadcrumb emission.
  - apps/coh/tests/run.rs — denial path and ordered breadcrumb tests.
Commands:
  - cargo test -p coh --features mock --test run
Checks:
  - No-lease path returns deterministic ERR; breadcrumbs are ordered and bounded.
Deliverables:
  - coh run behavior documented with transcript fixtures.

Title/ID: m22-breadcrumb-schema
Goal: Define and lock breadcrumb schema for /gpu/<id>/status entries.
Inputs: docs/GPU_NODES.md, manifest IR.
Changes:
  - tools/coh-rtc/ — emit breadcrumb schema and limits for host tooling.
  - docs/INTERFACES.md — update status schema snippet via codegen.
Commands:
  - cargo run -p coh-rtc
Checks:
  - Generated schema hash matches committed docs; invalid fields rejected by coh.
Deliverables:
  - Breadcrumb schema published and referenced by host tools.

Title/ID: m22-run-regressions
Goal: Add regression coverage for run wrapper ordering and denial semantics.
Inputs: scripts/cohsh/*.coh, tests/fixtures/transcripts/.
Changes:
  - scripts/cohsh/run_demo.coh — lease, run, observe, release sequence.
  - apps/coh/tests/transcript.rs — compare coh run transcript to cohsh baseline.
Commands:
  - cargo test -p coh --features mock --test transcript
Checks:
  - Transcript diff is zero; denial case emits deterministic ERR.
Deliverables:
  - Regression fixtures stored; CI hook updated.

Title/ID: m23-peft-export
Goal: Implement coh peft export from /queen/export/lora_jobs/* with bounded pulls.
Inputs: docs/GPU_NODES.md, docs/INTERFACES.md.
Changes:
  - apps/coh/src/peft/export.rs — pull job directory with manifest validation.
  - apps/coh/tests/peft_export.rs — resumable pull and idempotency tests.
Commands:
  - cargo test -p coh --features mock --test peft_export
Checks:
  - Export resumes without duplicates; missing job returns deterministic ERR.
Deliverables:
  - Export workflow documented with fixtures.

Title/ID: m23-peft-import-activate
Goal: Import adapters and atomically activate model pointers.
Inputs: host model registry, docs/GPU_NODES.md.
Changes:
  - apps/coh/src/peft/import.rs — hash/size/provenance checks for adapters.
  - apps/coh/src/peft/activate.rs — atomic pointer swap with rollback metadata.
Commands:
  - cargo test -p coh --features mock --test peft_import
Checks:
  - Invalid hashes rejected; pointer swap is atomic and rollback restores previous model.
Deliverables:
  - Activation/rollback behavior documented with transcript fixtures.

Title/ID: m23-peft-regressions
Goal: Validate end-to-end PEFT lifecycle flows.
Inputs: scripts/cohsh/*.coh, tests/fixtures/transcripts/.
Changes:
  - scripts/cohsh/peft_roundtrip.coh — export/import/activate/rollback sequence.
  - apps/coh/tests/transcript.rs — parity check with cohsh output.
Commands:
  - cargo test -p coh --features mock --test transcript
Checks:
  - Transcript diff zero; rollback emits deterministic ACK/ERR ordering.
Deliverables:
  - Regression fixtures stored and referenced in docs.

Title/ID: m23-dev-virt-gpu-mock
Goal: Provide mock `/gpu` entries for CLI demos in dev-virt.
Inputs: docs/GPU_NODES.md, docs/INTERFACES.md.
Changes:
  - apps/root-task/src/ninedoor.rs — seed mock `/gpu/<id>` entries and bounded logs when no host GPU bridge is present.
Commands:
  - cargo run -p cohsh --features mock -- --transport tcp --host 127.0.0.1 --port 31337 --script resources/proc_tests/selftest_quick.coh
Checks:
  - `coh gpu list` returns mock GPU-0/GPU-1 and reads `/gpu/<id>/info` without errors.
Deliverables:
  - Mock `/gpu` entries documented in GPU/NineDoor interface docs.

Title/ID: m23-swarmui-replay-path
Goal: Normalize SwarmUI replay paths for release bundle replay.
Inputs: docs/TEST_PLAN.md, release bundle layout.
Changes:
  - apps/swarmui/src-tauri/main.rs — resolve replay paths as absolute when provided relative inputs.
Commands:
  - cargo test -p swarmui --test trace
Checks:
  - `swarmui --replay-trace <relative path>` and `swarmui --replay <relative path>` work from bundle root.
Deliverables:
  - Replay instructions remain consistent in docs/TEST_PLAN.md.

Title/ID: m23-swarmui-pressure-layout
Goal: Improve SwarmUI pressure/error strip readability.
Inputs: apps/swarmui/frontend/index.html, apps/swarmui/frontend/styles/layout.css.
Changes:
  - apps/swarmui/frontend/styles/layout.css — line-break pressure/error labels and shrink status chips slightly.
Commands:
  - cargo test -p swarmui --test console_parity
Checks:
  - Pressure and error labels render above chips; chip text remains legible.
Deliverables:
  - UI layout changes tracked in the milestone.

Title/ID: m24-python-client
Goal: Build cohesix Python client with filesystem + TCP backends and parity tests.
Inputs: crates/cohsh-core, docs/USERLAND_AND_CLI.md, docs/INTERFACES.md.
Changes:
  - tools/cohesix-py/ — Python package with fs and TCP backends.
  - tools/cohesix-py/tests/parity.py — parity tests against cohsh transcripts.
Commands:
  - python -m pytest -k cohesix_parity
Checks:
  - Parity tests match cohsh transcripts; invalid ticket yields deterministic ERR.
Deliverables:
  - Python client package and parity fixtures.

Title/ID: m24-examples
Goal: Provide quick examples that leave inspectable artifacts.
Inputs: tools/cohesix-py/examples/, docs/GPU_NODES.md.
Changes:
  - tools/cohesix-py/examples/lease_run.py — lease -> run -> release example.
  - tools/cohesix-py/examples/peft_roundtrip.py — export/import/activate/rollback.
Commands:
  - python tools/cohesix-py/examples/lease_run.py --mock
Checks:
  - Example outputs are deterministic and bounded; artifacts stored under out/examples/.
Deliverables:
  - Example artifacts and docs/USERLAND_AND_CLI.md updates.

Title/ID: m24-doctor-release
Goal: Implement coh doctor and Alpha packaging/quickstart.
Inputs: apps/coh/, docs/USERLAND_AND_CLI.md, README.md.
Changes:
  - apps/coh/src/doctor.rs — deterministic checks for tickets, mounts, NVML/mock, runtime prerequisites.
  - docs/QUICKSTART_ALPHA.md — minimal Alpha quickstart for coh + cohesix.
Commands:
  - cargo run -p coh --features mock -- doctor --mock
Checks:
  - Doctor emits deterministic actionable output; packaging contains coh + cohesix.
Deliverables:
  - Alpha quickstart docs and packaging notes.

Title/ID: m24-swarmui-header-unify
Goal: Unify SwarmUI header alignment and scale so the banner reads as a single product surface.
Inputs: apps/swarmui/frontend/index.html, apps/swarmui/frontend/styles/layout.css.
Changes:
  - apps/swarmui/frontend/styles/layout.css — align banner grid, status rows, and header badge/chip sizing.
Commands:
  - npm run lint (if configured) or cargo check -p swarmui
Checks:
  - Header elements align cleanly at desktop and stack without overflow at 980px/720px breakpoints.
Deliverables:
  - Updated SwarmUI header styling.

Title/ID: m24b-gpu-bridge-publish
Goal: Enable live GPU bridge publishing of `/gpu/models` and telemetry schema into a running Queen.
Inputs: apps/gpu-bridge-host, apps/nine-door, docs/GPU_NODES.md.
Changes:
  - apps/gpu-bridge-host/src/main.rs — add `--publish`, `--interval-ms`, TCP config flags; serialize bounded snapshots.
  - apps/nine-door/src/host/core.rs — accept snapshot payloads and update `/gpu` namespace deterministically.
  - docs/GPU_NODES.md — document live publish flow and error semantics.
Commands:
  - cargo test -p gpu-bridge-host
  - cargo test -p nine-door --test integration
Checks:
  - Live `ls /gpu/models` succeeds after publish; invalid payloads return deterministic ERR.
Deliverables:
  - Live GPU bridge publish path + updated GPU docs.

Title/ID: m24b-peft-live-flow
Goal: Unblock non-mock PEFT import/activate by refreshing `/gpu/models` after registry updates.
Inputs: apps/coh/, docs/USERLAND_AND_CLI.md, docs/HOST_TOOLS.md.
Changes:
  - apps/coh/src/main.rs — add `--publish`/`--refresh-gpu-models` option for `peft import`.
  - docs/USERLAND_AND_CLI.md — document live PEFT flow and required commands.
  - docs/HOST_TOOLS.md — update PEFT examples to include live publish.
Commands:
  - cargo test -p coh --features nvml
Checks:
  - `coh peft import --host ... --publish` yields `/gpu/models/available/<model_id>/manifest.toml` in the VM.
Deliverables:
  - Live PEFT flow documented and validated.

Title/ID: m24b-host-telemetry-live
Goal: Provide live host telemetry providers for systemd/k8s/docker/NVML.
Inputs: apps/host-sidecar-bridge, docs/INTERFACES.md, docs/ARCHITECTURE.md.
Changes:
  - apps/host-sidecar-bridge/ — add live adapters and bounded snapshot formatting.
  - docs/INTERFACES.md — document `/host/*/status` line formats.
  - docs/ARCHITECTURE.md — record telemetry polling defaults.
Commands:
  - cargo test -p host-sidecar-bridge
Checks:
  - Live publish works over TCP; mock path remains deterministic.
Deliverables:
  - Live host telemetry adapters + updated docs.

Title/ID: m24b-live-hive-text
Goal: Render bounded telemetry text overlays and a details panel in Live Hive using cohsh-core tails.
Inputs: crates/cohsh-core, apps/swarmui, docs/INTERFACES.md.
Changes:
  - crates/cohsh-core/ — add tail polling policy and line budget enforcement.
  - apps/swarmui/ — render overlays + details panel; no UI polling logic.
  - docs/INTERFACES.md — Live Hive text overlay rules.
Commands:
  - cargo test -p cohsh-core
  - cargo test -p swarmui --test console_parity
Checks:
  - Overlay shows last N lines; details panel shows last M; line truncation enforced.
Deliverables:
  - Live Hive text overlay + deterministic bounds.

Title/ID: m24b-test-plan-release
Goal: Update Test Plan and cut a new release bundle after gates pass.
Inputs: docs/TEST_PLAN.md, scripts/release_bundle.sh, releases/.
Changes:
  - docs/TEST_PLAN.md — add non-mock PEFT flow + live telemetry checks.
  - releases/ — bump minor version bundle and tarball names.
Commands:
  - scripts/cohsh/run_regression_batch.sh
  - scripts/release_bundle.sh --name Cohesix-0.3.0-alpha2 --version 0.3.0-alpha2 --force
Checks:
  - Test Plan additions pass on macOS 26 and Ubuntu 24 bundles.
Deliverables:
  - Updated Test Plan and new release bundle.

Title/ID: m24b1-hive-perf-diagnose
Goal: Identify and fix the root cause of Live Hive slowness without changing protocols.
Inputs: apps/swarmui, crates/cohsh-core, docs/INTERFACES.md.
Changes:
  - apps/swarmui/ — profiling instrumentation + performance fixes (render loop, data diffs, throttling).
  - docs/INTERFACES.md — record any clarified UI constraints or telemetry rendering rules.
Commands:
  - cargo test -p swarmui --test console_parity
Checks:
  - UI remains responsive with 8 workers and active telemetry tails.
Deliverables:
  - Performance fix + recorded diagnosis summary.

Title/ID: m24b1-hive-labels-colors
Goal: Add worker labels and role-based color-coding to Live Hive.
Inputs: apps/swarmui, docs/INTERFACES.md.
Changes:
  - apps/swarmui/ — render numeric labels near worker dots; add role palette mapping.
  - docs/INTERFACES.md — document label format + role color scheme.
Commands:
  - cargo test -p swarmui --test console_parity
Checks:
  - Each worker dot has a stable numeric label; colors reflect worker role.
Deliverables:
  - Labeled and color-coded Live Hive nodes.

Title/ID: m24b1-hive-clickability
Goal: Guarantee worker dots are clickable and selection is deterministic.
Inputs: tools/swarmui-ui-tests, apps/swarmui.
Changes:
  - tools/swarmui-ui-tests/ — add Playwright test for worker selection.
  - apps/swarmui/ — ensure click targets map to selection state.
Commands:
  - cd tools/swarmui-ui-tests
  - npm test
Checks:
  - Playwright validates click selection updates the details panel.
Deliverables:
  - UI clickability test and stable selection behavior.

Title/ID: m24b1-hive-perf-telemetry-harness
Goal: Add a deterministic harness that checks performance and telemetry visibility.
Inputs: tools/swarmui-ui-tests, docs/TEST_PLAN.md.
Changes:
  - tools/swarmui-ui-tests/ — add perf + telemetry fixtures + thresholds.
  - docs/TEST_PLAN.md — add the harness run steps and expected thresholds.
Commands:
  - cd tools/swarmui-ui-tests
  - npm test
Checks:
  - Telemetry lines appear after selection; perf thresholds met.
Deliverables:
  - Performance + telemetry harness and Test Plan update.

Title/ID: m24c-grammar-manifest
Goal: Add manifest gates + bounds for new control files and `/proc` nodes.
Inputs: configs/root_task.toml, tools/coh-rtc, docs/INTERFACES.md.
Changes:
  - configs/root_task.toml — add scheduler/lease/export/policy gates + size bounds.
  - tools/coh-rtc — emit generated bounds for new control and `/proc` nodes.
Commands:
  - cargo run -p coh-rtc
  - scripts/check-generated.sh
Checks:
  - Generated outputs hash-match; bounds appear in snippets.
Deliverables:
  - IR-driven gates and bounds for new control files and `/proc` nodes.

Title/ID: m24c-grammar-runtime
Goal: Implement VM/NineDoor handling of new control files with strict JSONL validation + audit lines.
Inputs: apps/root-task/src/ninedoor.rs, apps/nine-door, docs/INTERFACES.md.
Changes:
  - apps/root-task/src/ninedoor.rs — handlers for `/queen/lease/ctl`, `/queen/schedule/ctl`,
    `/queen/export/ctl`, `/policy/ctl`.
  - apps/nine-door/ — host-mode providers for the same paths.
  - docs/INTERFACES.md — document schemas + error semantics.
  - docs/ARCHITECTURE.md — update control surfaces/data flows.
Commands:
  - cargo test -p nine-door --test schedule_create
  - cargo test -p nine-door --test schedule_bounds
  - cargo test -p nine-door --test lease_bounds
  - cargo test -p nine-door --test policy_ctl
  - cargo test -p nine-door --test export_ctl
Checks:
  - Valid lines accepted; invalid lines rejected deterministically; audit lines emitted.
Deliverables:
  - Authoritative scheduling/lease/policy/export grammar in VM and host NineDoor.

Title/ID: m24c-proc-observability
Goal: Add read-only `/proc` nodes for schedule + lease observability (bounded).
Inputs: apps/root-task, docs/INTERFACES.md.
Changes:
  - apps/root-task — `/proc/schedule/*` and `/proc/lease/*` providers.
  - docs/INTERFACES.md — new `/proc` node formats.
Commands:
  - cargo test -p nine-door --test schedule_bounds
  - cargo test -p nine-door --test lease_bounds
Checks:
  - `/proc` nodes respect manifest byte/line limits and stable formatting.
Deliverables:
  - Read-only schedule/lease observability nodes.

Title/ID: m24c-swarmui-scheduler-lease-panels
Goal: Add read-only Live Hive panels for scheduler queue and lease/preemption timeline.
Inputs: apps/swarmui, tools/swarmui-ui-tests, docs/INTERFACES.md.
Changes:
  - apps/swarmui/ — panels that read `/proc/schedule/*` and `/proc/lease/*`.
  - tools/swarmui-ui-tests/ — replay fixtures + Playwright checks for panel wiring.
  - docs/INTERFACES.md — UI expectations (read-only).
Commands:
  - cargo test -p swarmui --test console_parity
  - cd tools/swarmui-ui-tests
  - npm test
Checks:
  - Panels render bounded content and update on replay fixtures.
Deliverables:
  - Read-only SwarmUI panels for schedule and lease state.

Title/ID: m24c-host-rest-gateway
Goal: Provide host-only REST gateway mapping 1:1 to file/console semantics with systemd service support and reconnect behavior.
Inputs: crates/cohsh-core, docs/HOST_TOOLS.md.
Changes:
  - apps/hive-gateway/ — new host tool (REST server + OpenAPI 3.1 + Swagger UI).
  - docs/HOST_TOOLS.md — add gateway usage + auth/ticket guidance.
  - docs/HOST_API.md — OpenAPI spec + examples.
  - systemd unit file (Linux) — run gateway as a service with restart policy and env overrides.
Commands:
  - cargo test -p hive-gateway
Checks:
  - REST responses mirror OK/ERR/END; no new semantics.
  - Systemd unit reconnects to QEMU after console disconnect.
Deliverables:
  - REST gateway + OpenAPI spec + systemd service unit.

Title/ID: m24c-python-rest-backend
Goal: Add REST backend to cohesix-py with parity coverage.
Inputs: tools/cohesix-py, docs/PYTHON_SUPPORT.md.
Changes:
  - tools/cohesix-py/cohesix/backends.py — RestBackend.
  - tools/cohesix-py/tests/test_parity.py — REST parity fixtures.
  - docs/PYTHON_SUPPORT.md — REST usage docs.
Commands:
  - python -m pytest -k cohesix_parity
Checks:
  - REST backend matches cohsh semantics.
Deliverables:
  - REST backend + parity tests.

Title/ID: m24c-docs-quickstart-testplan
Goal: Update Quickstart and Test Plan for REST gateway + new control grammar.
Inputs: docs/QUICKSTART.md, docs/TEST_PLAN.md, docs/USERLAND_AND_CLI.md.
Changes:
  - docs/QUICKSTART.md — REST gateway quickstart (mock + live QEMU).
  - docs/TEST_PLAN.md — add schedule/lease/export/policy checks + REST gateway tests (including systemd service + reconnect).
  - docs/USERLAND_AND_CLI.md — document new control files (`echo` JSONL).
Commands:
  - scripts/ci/check_test_plan.sh
Checks:
  - Quickstart steps run on macOS 26 + QEMU.
  - New Test Plan steps executed and recorded as part of DoD.
Deliverables:
  - Updated docs for frictionless adoption.

Title/ID: m24c-regression-pack
Goal: Add fixtures and run the regression pack unchanged.
Inputs: scripts/cohsh/run_regression_batch.sh, tests/fixtures/*.
Changes:
  - tests/fixtures/ — add schedule/lease/export/policy fixtures.
Commands:
  - scripts/cohsh/run_regression_batch.sh
Checks:
  - No ACK/ERR/END drift outside updated fixtures.
Deliverables:
  - Updated fixtures and regression evidence.

Title/ID: m24d-gpu-bridge-cuda
Goal: Add CUDA inventory backend and deterministic NVML→CUDA fallback for GPU discovery.
Inputs: apps/gpu-bridge-host/src/lib.rs, apps/gpu-bridge-host/Cargo.toml, docs/INTERFACES.md.
Changes:
  - crates/host-cuda/ — CUDA driver/runtime probe (host-only, unsafe isolated).
  - apps/gpu-bridge-host/src/lib.rs — add CUDA inventory implementation and fallback logic.
  - apps/gpu-bridge-host/Cargo.toml — enable CUDA support by default.
  - docs/INTERFACES.md — document backend selection and Jetson behavior.
  - docs/REPO_LAYOUT.md — document the new host CUDA crate.
Commands:
  - cargo test -p host-cuda
  - cargo test -p gpu-bridge-host
Checks:
  - CUDA discovery succeeds on Jetson; NVML remains active on dGPU.
Deliverables:
  - CUDA-backed GPU discovery with deterministic fallback.

Title/ID: m24d-coh-doctor-cuda
Goal: Ensure `coh doctor` passes on Jetson by falling back to CUDA when NVML is feature-limited.
Inputs: apps/coh/src/doctor.rs, apps/coh/Cargo.toml, docs/USERLAND_AND_CLI.md.
Changes:
  - apps/coh/src/doctor.rs — detect NVML limitations and fallback to CUDA APIs.
  - apps/coh/Cargo.toml — enable CUDA support by default alongside NVML.
  - docs/USERLAND_AND_CLI.md — document NVML fallback behavior.
Commands:
  - cargo test -p coh --test transcript
Checks:
  - `coh doctor` succeeds on Jetson without `--mock` and emits a degraded CUDA fallback line.
Deliverables:
  - Deterministic Jetson-friendly doctor checks.

Title/ID: m24d-docs-host-tools
Goal: Update host tool docs for Jetson CUDA discovery and fallback semantics.
Inputs: docs/HOST_TOOLS.md, docs/GPU_NODES.md.
Changes:
  - docs/HOST_TOOLS.md — clarify CUDA-by-default behavior and NVML fallback.
  - docs/GPU_NODES.md — describe Jetson inventory via CUDA APIs and limits.
Commands:
  - scripts/ci/check_test_plan.sh
Checks:
  - Docs accurately describe as-built host discovery behavior.
Deliverables:
  - Jetson-ready host tool documentation.

Title/ID: m24d-host-setup-ubuntu
Goal: Support Ubuntu 22.04 host setup and document Python 3.11 venv usage for Quickstart.
Inputs: scripts/setup_environment.sh, docs/QUICKSTART.md.
Changes:
  - scripts/setup_environment.sh — allow Ubuntu 22.04; add explicit override for unsupported versions with best-effort package selection.
  - docs/QUICKSTART.md — add non-mock `coh doctor` expectations (NVML vs Jetson) and document Python 3.11 venv path for cohesix-py.
Commands:
  - scripts/ci/check_test_plan.sh
Checks:
  - Quickstart steps are clear for Ubuntu 22.04 + Python 3.11 venv users.
Deliverables:
  - Jetson-friendly host setup and Quickstart guidance.

Title/ID: m24d-coh-fuse-default
Goal: Enable FUSE support by default for Linux `coh` builds while keeping macOS opt-in.
Inputs: apps/coh/Cargo.toml, docs/HOST_TOOLS.md, docs/QUICKSTART.md, docs/PYTHON_SUPPORT.md, docs/USERLAND_AND_CLI.md, docs/TEST_PLAN.md.
Changes:
  - apps/coh/Cargo.toml — default FUSE on Linux, macOS opt-in via feature.
  - docs/HOST_TOOLS.md — update OS-specific FUSE defaults.
  - docs/QUICKSTART.md — document macOS opt-in behavior.
  - docs/PYTHON_SUPPORT.md — align FUSE notes with OS defaults.
  - docs/USERLAND_AND_CLI.md — clarify live mount prerequisites.
  - docs/TEST_PLAN.md — note macOS default FUSE disabled.
Commands:
  - cargo check -p coh
  - cargo test -p coh --test transcript
  - cargo test -p coh --test run
Checks:
  - `coh doctor` passes the mount check when Linux `/dev/fuse` (or macOS `/dev/macfuse0`) is available.
  - Docs reflect OS-specific FUSE defaults.
Deliverables:
  - Linux-default FUSE-enabled `coh` builds with aligned documentation.

Title/ID: m24d-toolchain-linux
Goal: Provide a Linux toolchain bootstrap script aligned with Cohesix host tool requirements.
Inputs: toolchain/setup_macos_arm64.sh, toolchain/setup_linux_arm64.sh.
Changes:
  - toolchain/setup_linux_arm64.sh — install build/runtime prerequisites, rustup, and QEMU checks for Ubuntu hosts.
Commands:
  - toolchain/setup_linux_arm64.sh
Checks:
  - Script installs required packages and reports tool versions.
Deliverables:
  - Linux toolchain setup script for host builds.

Title/ID: m24e-rest-client
Goal: Provide a shared hive-gateway REST client for host tools.
Inputs: docs/HOST_API.md.
Changes:
  - crates/cohesix-rest/ — add GatewayClient + response models.
  - Cargo.toml — add cohesix-rest to workspace.
Commands:
  - cargo check -p cohesix-rest
Checks:
  - REST client validates OK/ERR and preserves gateway error details.
Deliverables:
  - Shared REST client crate for host tools.

Title/ID: m24e-cohsh-rest-transport
Goal: Add a REST-backed transport that implements the cohsh Transport trait.
Inputs: apps/cohsh/src/lib.rs, apps/cohsh/src/transport.
Changes:
  - apps/cohsh/src/transport/rest.rs — implement Transport over hive-gateway.
  - apps/cohsh/src/transport/mod.rs — export rest transport.
  - apps/cohsh/Cargo.toml — add cohesix-rest dependency/feature.
Commands:
  - cargo test -p cohsh
Checks:
  - Transport methods (`list`, `read`, `write`, `tail`) map to REST without changing semantics.
Deliverables:
  - REST transport available to host tools and SwarmUI.

Title/ID: m24e-cohsh-rest-cli
Goal: Expose REST transport selection in the cohsh CLI.
Inputs: apps/cohsh/src/main.rs, docs/USERLAND_AND_CLI.md, docs/HOST_TOOLS.md.
Changes:
  - apps/cohsh/src/main.rs — add `--transport rest` + `--rest-url` resolution.
  - docs/USERLAND_AND_CLI.md — document REST transport option for cohsh.
  - docs/HOST_TOOLS.md — add cohsh REST example.
Commands:
  - cargo test -p cohsh
Checks:
  - `cohsh --transport rest --rest-url` connects to hive-gateway and supports core verbs.
Deliverables:
  - CLI access to REST multiplexer transport.

Title/ID: m24e-rest-proc-bounds
Goal: Clamp REST `/proc` reads to manifest bounds so SwarmUI shows schedule/lease data.
Inputs: apps/cohsh/src/transport/rest.rs, docs/HOST_API.md.
Changes:
  - apps/cohsh/src/transport/rest.rs — enforce `/proc` read bounds via gateway metadata.
Commands:
  - cargo test -p cohsh
Checks:
  - REST reads for `/proc/schedule/*` and `/proc/lease/*` succeed with bounded `max_bytes`.
Deliverables:
  - SwarmUI REST schedule/lease visibility retained.

Title/ID: m24e-bridge-rest-publish
Goal: Allow host bridge publishers to use hive-gateway as a multiplexer.
Inputs: apps/gpu-bridge-host/src/main.rs, apps/host-sidecar-bridge/src/main.rs.
Changes:
  - apps/gpu-bridge-host/src/main.rs — add `--rest-url` publish mode.
  - apps/host-sidecar-bridge/src/main.rs — add `--rest-url` publish mode.
  - apps/gpu-bridge-host/Cargo.toml — add cohesix-rest dependency.
  - apps/host-sidecar-bridge/Cargo.toml — enable cohsh REST transport feature.
Commands:
  - cargo test -p gpu-bridge-host
  - cargo test -p host-sidecar-bridge
Checks:
  - REST publish mode writes valid snapshot lines and respects bounds.
Deliverables:
  - REST-capable host publishers.

Title/ID: m24e-cas-tool-rest
Goal: Allow cas-tool to upload bundles through hive-gateway.
Inputs: apps/cas-tool/src/main.rs, docs/HOST_API.md.
Changes:
  - apps/cas-tool/src/main.rs — add `--rest-url` upload mode.
  - apps/cas-tool/Cargo.toml — add cohesix-rest dependency.
Commands:
  - cargo test -p cas-tool
Checks:
  - REST upload writes base64 chunks to `/updates/*` without console attachment.
Deliverables:
  - REST-capable cas-tool upload.

Title/ID: m24e-coh-rest-mount
Status: Reopened — M27g / m27g-two-hour-pi4-operator-burn-in found that REST FUSE reads exceeded advertised schedule and lease path bounds.
Milestone: Reopened 24e / coh-rest-mount; discovery Milestone 27g / two-hour-pi4-operator-burn-in.
Restoration: Share the existing bounded-path mapping with cohsh; cap coh read/tail requests and response checks at the advertised path bound, preserving caller limits and all gateway enablement/authority checks. Validate exact Mac and Linux mounts against the same current Pi; do not change target bounds or quotas.
Compatibility: coh/coh-status and cohsh share the corrected REST mapping. Review Hive Gateway, SwarmUI, host-ticket-agent, host-sidecar-bridge, gpu-bridge-host, cas-tool, sidecar-bus, Python SDK and benchmark paths; wire formats and target policy remain unchanged.
Goal: Add REST-backed CohAccess for `coh` and support `coh mount --rest-url`.
Inputs: apps/coh/src/main.rs, apps/coh/src/mount.rs, apps/coh/src/rest.rs.
Changes:
  - apps/coh/src/rest.rs — implement REST CohAccess.
  - apps/coh/src/mount.rs — add REST-backed mount path.
  - apps/coh/src/main.rs — add `--rest-url` handling for live operations.
  - apps/coh/Cargo.toml — add cohesix-rest dependency.
Commands:
  - cargo test -p coh
Checks:
  - REST mount uses queen-role gateway, preserves append-only semantics, and enforces a single mount per gateway URL.
Deliverables:
  - `coh` REST mode including mount support.

Title/ID: m24e-swarmui-rest-transport
Goal: Add SwarmUI transport option that connects through hive-gateway.
Inputs: apps/swarmui/src-tauri/main.rs, apps/swarmui/src/lib.rs.
Changes:
  - apps/swarmui/src-tauri/main.rs — support `SWARMUI_TRANSPORT=rest|gateway`.
  - apps/swarmui/Cargo.toml — enable cohsh REST transport feature.
Commands:
  - cargo test -p swarmui
Checks:
  - SwarmUI REST mode renders existing panels and console commands without regressions (REST transport enabled by default).
Deliverables:
  - SwarmUI gateway mode for REST multiplexing.

Title/ID: m24e-swarmui-pixi-perf
Goal: Keep SwarmUI Live Hive responsive under multi-worker telemetry load.
Inputs: apps/swarmui/frontend/hive/renderer.js, apps/swarmui/frontend/hive/index.js.
Changes:
  - apps/swarmui/frontend/hive/renderer.js — shift to particle containers + sprite-based clusters.
  - apps/swarmui/frontend/hive/index.js — cap sim steps per frame + throttle render rate under pressure.
Commands:
  - cargo test -p swarmui
Checks:
  - Live Hive view remains responsive (no UI stalls) with active telemetry and multiple workers.
Deliverables:
  - PixiJS rendering optimizations for live mode.

Title/ID: m24e-docs-rest-multiplexer
Goal: Document REST multiplexer usage and SwarmUI transport selection.
Inputs: docs/HOST_TOOLS.md, docs/API_GUIDELINES.md, docs/HOST_API.md, docs/USERLAND_AND_CLI.md.
Changes:
  - docs/HOST_TOOLS.md — add REST publish examples for host bridges and SwarmUI.
  - docs/API_GUIDELINES.md — add transport guidance for REST multiplexer deployments.
  - docs/HOST_API.md — add `/gpu/bridge/ctl` and `/host/*` REST examples.
  - docs/USERLAND_AND_CLI.md — document SwarmUI transport options.
Commands:
  - scripts/ci/check_test_plan.sh
Checks:
  - Docs reflect as-built REST multiplexer behavior.
Deliverables:
  - Updated operator-facing documentation.

Title/ID: m25c-smp-kernel-enable
Goal: Enable seL4 SMP in the external kernel build and document requirements.
Inputs: ~/seL4/SMP_build, docs/ARCHITECTURE.md, docs/BUILD_PLAN.md.
Changes:
  - ~/seL4/SMP_build/ — regenerate kernel artifacts with SMP enabled (do not touch ~/seL4/build).
  - docs/ARCHITECTURE.md — record SMP kernel requirements and QEMU CPU count.
Commands:
  - cmake --build ~/seL4/SMP_build
Checks:
  - SMP-enabled kernel boots under QEMU with >1 core.
Deliverables:
  - SMP kernel artifacts and documented build requirements.

Title/ID: m25c-smp-build-mirror
Goal: Mirror SMP build outputs into the repo and make SMP the default build path.
Inputs: ~/seL4/SMP_build, seL4/SMP_build, scripts/cohesix-build-run.sh.
Changes:
  - seL4/SMP_build/ — copy SMP build outputs from ~/seL4/SMP_build (leave seL4/build untouched).
  - scripts/cohesix-build-run.sh — default SEL4_BUILD_DIR to seL4/SMP_build; allow override to seL4/build.
Commands:
  - rsync -a ~/seL4/SMP_build/ seL4/SMP_build/
Checks:
  - `scripts/cohesix-build-run.sh` uses seL4/SMP_build by default; `--sel4-build seL4/build` overrides correctly.
Deliverables:
  - Repo-local SMP build outputs and updated build defaults.

Title/ID: m25c-smp-qemu-defaults
Goal: Default QEMU SMP topology to four single-threaded cores while keeping overrides explicit.
Inputs: scripts/qemu-run.sh, scripts/cohesix-build-run.sh, scripts/release_bundle.sh, releases/*/qemu/run.sh, docs/QUICKSTART.md, docs/TEST_PLAN.md.
Changes:
  - scripts/qemu-run.sh — default to `-smp 4,cores=4,threads=1,sockets=1`; allow overrides via `COHESIX_QEMU_SMP` / `QEMU_SMP` (count) and `COHESIX_QEMU_SMP_TOPO` / `QEMU_SMP_TOPO` (full topology string).
  - scripts/cohesix-build-run.sh — same default and override handling as `scripts/qemu-run.sh`.
  - scripts/release_bundle.sh — bake the SMP defaults and env overrides into generated `qemu/run.sh`.
  - releases/<next minor>-* — bump minor version per policy; update bundled `qemu/run.sh` defaults and rename tarballs accordingly.
  - docs/QUICKSTART.md, docs/TEST_PLAN.md — document the SMP default and override variables.
Commands:
  - COHESIX_QEMU_SMP=1 scripts/cohesix-build-run.sh --no-run --cargo-target aarch64-unknown-none
  - COHESIX_QEMU_SMP=4 scripts/cohesix-build-run.sh --no-run --cargo-target aarch64-unknown-none
Checks:
  - Default QEMU launches use `-smp 4,cores=4,threads=1,sockets=1`.
  - SMP overrides apply deterministically with no validation regressions.
  - Release bundle minor version increments and tarball names match directory names.
Deliverables:
  - SMP-aware QEMU launch defaults with documented override behavior.

Title/ID: m25c-authority-ipc
Goal: Serialize authoritative decisions behind a single IPC surface.
Inputs: apps/root-task, docs/ROLES_AND_SCHEDULING.md.
Changes:
  - apps/root-task/src/authority.rs — authority IPC entrypoint and queueing.
  - apps/root-task/src/lib.rs — route all authority mutations through IPC.
Commands:
  - cargo test -p root-task
Checks:
  - Authority decisions are serialized and replay-stable.
Deliverables:
  - Single-threaded authority IPC with deterministic ordering.

Title/ID: m25c-sharded-tasks
Goal: Run IO, parsing, and providers in separate single-threaded seL4 tasks.
Inputs: apps/nine-door, apps/console, apps/root-task.
Changes:
  - apps/root-task/src/spawn.rs — spawn NineDoor shards and provider tasks.
  - apps/nine-door/src/lib.rs — shard-aware request handling.
Commands:
  - cargo check -p root-task
  - cargo test -p nine-door --test sharding
Checks:
  - Shards execute in parallel without shared-memory coupling.
Deliverables:
  - Task-isolated protocol handling.

Title/ID: m25c-affinity-ir
Goal: Add optional affinity hints to IR and enforce bounds.
Inputs: configs/root_task.toml, tools/coh-rtc, docs/ARCHITECTURE.md.
Changes:
  - tools/coh-rtc/src/ir.rs — affinity hints and validation.
  - configs/root_task.toml — optional affinity policy.
Commands:
  - cargo run -p coh-rtc
  - scripts/check-generated.sh
Checks:
  - Invalid affinity configurations are rejected deterministically.
Deliverables:
  - Manifest-driven affinity policy (optional).

Title/ID: m25c-smp-replay-regressions
Goal: Prove SMP determinism vs single-core runs.
Inputs: docs/TEST_PLAN.md, scripts/cohsh/.
Changes:
  - scripts/cohsh/smp_parity.coh — compare ACK/ERR sequences across core counts.
Commands:
  - cohsh --script scripts/cohsh/smp_parity.coh
Checks:
  - Multicore and single-core transcripts match byte-for-byte.
Deliverables:
  - SMP parity regression coverage.

Title/ID: m25c-smp-cohsh-selftest
Goal: Add `cohsh test --mode smp` to pressure SMP and surface activity for the `smp` console command.
Inputs: apps/cohsh, apps/nine-door, resources/proc_tests, docs/USERLAND_AND_CLI.md, docs/TEST_PLAN.md.
Changes:
  - resources/proc_tests/selftest_smp.coh — SMP-oriented regression script.
  - apps/nine-door/src/host/namespace.rs — expose `/proc/tests/selftest_smp.coh`.
  - apps/cohsh/src/lib.rs — accept `test --mode smp` and map to the new script.
  - docs/USERLAND_AND_CLI.md — document the new selftest script and mode.
  - docs/TEST_PLAN.md — add `test --mode smp` to QEMU regression steps.
Commands:
  - cargo test -p cohsh
Checks:
  - `cohsh test --mode smp` completes without unexpected errors.
  - Root console `smp` shows bounded userspace activity.
Deliverables:
  - SMP selftest script and cohsh mode support.

Title/ID: m25-smp-console-metrics
Goal: Add a root console path to emit the raw seL4 scheduler snapshot.
Inputs: root console parser, seL4 debug syscall docs, docs/USERLAND_AND_CLI.md.
Changes:
  - apps/root-task/src/console.rs — invoke seL4 debug scheduler/CPU dump APIs (`seL4_DebugDumpScheduler`, `seL4_DebugDumpCPUInfo`) when enabled; bounded output, no shared-memory access. The later `m26d-smp-command-post-cutover-usability` correction makes this explicit as `smp dump`.
  - docs/USERLAND_AND_CLI.md — document the raw scheduler output and debug-build gating.
Commands:
  - QEMU diagnostic serial console: `smp dump`
Checks:
  - Debug builds emit per-core scheduler/CPU metrics (core id, runnable/idle summary) with bounded output.
  - Non-debug builds return deterministic `ERR reason=unsupported` with no side effects.
Deliverables:
  - Explicit raw SMP scheduler diagnostic with seL4-aligned semantics.

Title/ID: m25-smp-rest-regression-batch
Goal: Stress SMP using concurrent cohsh regression scripts via the REST multiplexer.
Inputs: scripts/cohsh/*.coh, apps/hive-gateway, docs/TEST_PLAN.md.
Changes:
  - scripts/cohsh/REST_regression_batch.sh — run multiple `cohsh --transport rest` scripts concurrently against `hive-gateway` using `COHESIX_GATEWAY_URL` (or `HIVE_GATEWAY_URL`/`COHSH_REST_URL`/`COH_REST_URL`); bounded concurrency, no script changes.
  - docs/TEST_PLAN.md — add a REST SMP stress run using the batch script.
Commands:
  - `COHESIX_GATEWAY_URL=http://<gateway-host>:<port> scripts/cohsh/REST_regression_batch.sh`
Checks:
  - All regression scripts pass unchanged under concurrent REST load.
  - `ERR ... reason=busy` appears only under saturation and is audited; ACK/ERR ordering remains deterministic.
Deliverables:
  - REST multiplexer SMP stress harness and documented runbook.

Title/ID: m25h-live-hive-turbo
Goal: Deliver ≥100x Live Hive responsiveness by prioritizing fresh telemetry visibility, bounded aggregation, and adaptive rendering without changing protocol semantics.
Inputs: apps/swarmui/src, apps/swarmui/frontend, tools/coh-rtc, docs/INTERFACES.md, docs/TEST_PLAN.md.
Changes:
  - apps/swarmui/src/hive.rs — O(1) telemetry line parsing, per-worker pending caps, fresh-only coalescing, round-robin worker sampling, overlay/detail caching.
  - apps/swarmui/src/lib.rs — Live Hive polling uses freshness-first policy; status snapshots rate-limited behind IR-driven bounds.
  - apps/swarmui/frontend/hive/index.js — ring-buffer ingestion, drop-oldest under pressure, index-range event application (no per-step slicing).
  - apps/swarmui/frontend/app.js + apps/swarmui/frontend/hive/index.js — keep Live Hive rendering active during scroll (no pause) while degrading cadence/quality; pause rendering only when the canvas is offscreen; throttle cadence, cap detail LOD, and drop render resolution when the canvas is idle to keep page interactions smooth.
  - apps/swarmui/frontend/hive/world.js — cache per-tick positions; in-place compaction for pollen/pulse particles.
  - apps/swarmui/frontend/hive/renderer.js — adaptive resolution/AA/particle budgets under degraded mode.
  - tools/coh-rtc/src/ir.rs + generated configs — manifest-backed Live Hive performance knobs (sample size, pending caps, degrade thresholds).
  - docs/INTERFACES.md — document freshness-first Live Hive guarantees and aggregation bounds.
  - docs/TEST_PLAN.md — add Live Hive performance regression harness (target freshness + frame budget).
Commands:
  - cargo run -p coh-rtc
  - cargo test -p swarmui
  - (SwarmUI UI regression) cd tools/swarmui-ui-tests && npm test
Checks:
  - Live Hive shows current telemetry within one poll under 3–100 workers with bounded backlog.
  - Aggregation/caching preserves latest state while historical detail remains bounded and replay-safe.
  - Renderer meets frame budget targets under load; degraded mode engages deterministically.
Deliverables:
  - Freshness-first Live Hive with documented bounds and ≥100x reduction in worst-case UI/ingest latency.

Title/ID: m25a-rest-perf-harness
Goal: Add a deterministic REST performance harness for Live Hive polling.
Inputs: scripts/rest_perf_harness.py.
Changes:
  - scripts/rest_perf_harness.py — sequential vs parallel REST timing for status + telemetry.
Commands:
  - python3 scripts/rest_perf_harness.py --help
Checks:
  - Harness reports averages and enforces optional min speedup ratio.
Deliverables:
  - REST performance harness script.

Title/ID: m25a-swarmui-rest-status
Goal: Parallelize and cache REST status polling in Live Hive.
Inputs: apps/swarmui/src/lib.rs.
Changes:
  - apps/swarmui/src/lib.rs — parallel `/proc` reads and honor `status_poll_ms` in REST mode.
Commands:
  - cargo test -p swarmui
Checks:
  - Live Hive status remains correct; poll latency drops.
Deliverables:
  - SwarmUI REST status polling improvements.

Title/ID: m25a-rest-pool-sizing
Goal: Increase REST session pool sizing to support parallel polling.
Inputs: configs/root_task.toml.
Changes:
  - configs/root_task.toml — adjust `client_policies.cohsh.pool` sizes.
  - configs/generated/cohsh_policy.toml — regenerated.
  - apps/cohsh/src/generated/policy.rs — regenerated.
  - docs/snippets/cohsh_policy.md — regenerated.
Commands:
  - cargo run -p coh-rtc
  - scripts/check-generated.sh
Checks:
  - Generated policy artifacts match manifest.
Deliverables:
  - Updated REST pool sizing and generated artifacts.

Title/ID: m25a-swarmui-rest-telemetry
Goal: Parallelize REST telemetry tails per worker after pool sizing.
Inputs: apps/swarmui/src/hive.rs, configs/root_task.toml, configs/generated/cohsh_policy.toml.
Changes:
  - apps/swarmui/src/hive.rs — parallel `tail` calls within pool-sized bounds.
Commands:
  - cargo test -p swarmui
Checks:
  - No changes to telemetry semantics; poll latency improves with multiple workers.
  - Parallelism never exceeds configured REST telemetry pool size.
Deliverables:
  - SwarmUI REST telemetry polling improvements with pool-capped concurrency.

Title/ID: m25a-root-affinity-wire
Goal: Apply manifest-driven CPU affinity to the root-task authority thread and role-specific operations (NineDoor attach and worker spawns) and extend SMP debug output to iterate configured cores.
Inputs: apps/root-task/src/affinity.rs, apps/root-task/src/sel4.rs, apps/root-task/src/kernel.rs, tools/coh-rtc, configs/root_task.toml, docs/ARCHITECTURE.md.
Changes:
  - apps/root-task/src/affinity.rs — policy validation and role-based core selection helpers.
  - apps/root-task/src/sel4.rs — guarded TCB affinity syscall wrapper.
  - apps/root-task/src/kernel.rs — validate policy and pin the init TCB to `authority_core`.
  - apps/root-task/src/userland/mod.rs — apply NineDoor affinity during bridge attach.
  - apps/root-task/src/ninedoor.rs — apply worker affinity during worker spawns.
  - apps/root-task/src/console/mod.rs — per-core SMP debug dumps using configured affinity cores.
  - apps/root-task/src/event/mod.rs — per-core SMP debug dumps using configured affinity cores.
  - tools/coh-rtc/src/codegen/rust.rs — emit affinity policy tables.
  - tools/coh-rtc/src/codegen/docs.rs — include affinity fields in manifest snippet.
  - docs/ARCHITECTURE.md — document root-task affinity application.
Commands:
  - cargo test -p root-task
  - cargo run -p coh-rtc
  - scripts/check-generated.sh
Checks:
  - Root-task bootstrap logs authority core pinning when affinity is enabled.
  - NineDoor attach and worker spawns log role-core affinity applications.
  - `smp` debug output cycles through configured role cores.
  - Generated manifest snippet includes affinity fields and matches configs.
Deliverables:
  - Manifest-driven root-task affinity wiring for the init TCB.

Title/ID: m25b-gateway-edge-auth
Goal: Close gateway-facing auth blockers while preserving VM authority semantics.
Inputs: apps/hive-gateway/src/main.rs, docs/HOST_API.md, docs/OPERATOR_WALKTHROUGH.md, docs/audit/findings.csv.
Changes:
  - apps/hive-gateway/src/main.rs - add required request authentication middleware for mutating routes and fail-fast startup when auth secrets are unset in non-test mode.
  - apps/hive-gateway/src/main.rs - enforce safe default exposure (loopback-only unless explicitly overridden with documented risk flags).
  - apps/hive-gateway/tests/* - add integration tests for unauthenticated/incorrect-token/authorized request paths.
  - docs/HOST_API.md - document request-auth contract, headers, and deployment hardening defaults.
Commands:
  - cargo test -p hive-gateway
Checks:
  - Unauthenticated POST `/v1/fs/echo` and equivalent write paths return deterministic authorization errors.
  - Gateway refuses insecure startup configuration in non-test mode.
Deliverables:
  - Closure evidence for DD-2026-0002 and DD-2026-0010 with logs and commit SHA.

Title/ID: m25b-console-token-hygiene
Goal: Remove insecure token defaults and prevent auth token leakage in logs.
Inputs: apps/root-task/src/net/mod.rs, apps/root-task/src/net/console_srv.rs, tools/coh-rtc, configs/root_task.toml, docs/audit/findings.csv.
Changes:
  - apps/root-task/src/net/mod.rs - remove production default auth token path and require explicit configured token source.
  - apps/root-task/src/net/console_srv.rs - replace raw auth-byte logging with structured redacted diagnostics.
  - apps/root-task/tests/* - add negative assertions proving token material is not logged on auth rejection.
  - tools/coh-rtc + generated outputs - wire token requirements through generated policy/config where applicable.
Commands:
  - cargo test -p root-task
  - cargo run -p coh-rtc
  - scripts/check-generated.sh
Checks:
  - Missing token config fails fast outside test profiles.
  - Auth failure logs do not expose token contents or byte-equivalent payload.
Deliverables:
  - Closure evidence for DD-2026-0001 and DD-2026-0003 with regenerated artifacts.

Title/ID: m25b-single-console-broker
Goal: Increase gateway multiplexing throughput under one attached console session.
Inputs: apps/hive-gateway/src/main.rs, apps/cohsh/src/session_pool.rs, apps/cohsh/src/transport/tcp.rs, docs/USERLAND_AND_CLI.md.
Changes:
  - apps/hive-gateway/src/main.rs - introduce bounded broker queueing with priority classes (control before telemetry), fairness scheduling, and explicit backpressure signals.
  - apps/hive-gateway/src/main.rs - add bounded read-through caches for hot `/proc` reads with deterministic TTL and invalidation.
  - apps/hive-gateway/src/main.rs - expose queue depth, saturation, timeout, and retry counters through gateway metrics/status paths.
  - docs/USERLAND_AND_CLI.md - clarify single-console behavior and REST multiplexer operational limits.
Commands:
  - cargo test -p hive-gateway
  - python3 scripts/rest_perf_harness.py --suite status --assert-min-ratio 2.0
Checks:
  - Parallel REST load no longer collapses into avoidable "session pool exhausted" behavior at configured policy limits.
  - No change to console grammar or in-VM listener topology.
Deliverables:
  - Single-console broker implementation with bounded throughput/fairness instrumentation.

Title/ID: m25b-rest-harness-1k
Goal: Extend the benchmark harness and report pipeline for deterministic 1k-worker readiness evidence.
Inputs: scripts/rest_perf_harness.py, docs/BENCHMARKS.md.
Changes:
  - scripts/rest_perf_harness.py - add deterministic seed handling for ramp profiles and worker bands up to 1000.
  - scripts/rest_perf_harness.py - require preflight boot/TCP/auth/LS checks before load execution.
  - scripts/rest_perf_harness.py - harden timeout/error handling so run summaries and per-op stats are always emitted.
  - scripts/rest_perf_harness.py - emit CSV/JSON artifacts consumable by benchmark graphs.
  - docs/BENCHMARKS.md - publish baseline vs aggressive 8..1000 runs, degradation thresholds, and graph-backed interpretation.
Commands:
  - python3 scripts/rest_perf_harness.py --mode simulate --workers-min 8 --workers-max 1000 --duration-mins 5 --seed 2501
  - python3 scripts/rest_perf_harness.py --mode simulate --workers-min 8 --workers-max 1000 --duration-mins 5 --seed 2501 --intensity-min 6 --intensity-max 6
Checks:
  - Both runs emit reproducible summaries and evidence files.
  - Report includes graphs and explicit onset points for buffer pressure and timeout behavior.
Deliverables:
  - 1k-worker readiness benchmark evidence pack and updated benchmark report.

Title/ID: m25b-regression-and-gate-closure
Goal: Repair failing release gates so scale evidence is release-grade.
Inputs: tests/tests/shard_1k.rs, scripts/cohsh/shard_1k.coh, crates/sel4-runtime/src/lib.rs, crates/sel4-sys/src/lib.rs, docs/TEST_PLAN.md, scripts/ci/due_diligence_gate.sh, docs/audit/*.
Changes:
  - tests/tests/shard_1k.rs + scripts/cohsh/shard_1k.coh - align policy queue and shard fixture expectations with current namespace semantics.
  - crates/sel4-runtime/src/lib.rs - add target-aware section annotation handling for macOS Mach-O compatibility.
  - crates/sel4-sys/src/lib.rs - cfg-gate affinity invocation wrapper for kernels lacking affinity labels.
  - docs/TEST_PLAN.md - normalize commands to `python3` and include `cargo test -p tests` plus `cargo test --workspace` gate coverage.
  - docs/audit/findings.csv + docs/audit/BLOCKERS.md + docs/audit/checklists/RELEASE_EVIDENCE_CHECKLIST.md - update dispositions, closure evidence, and independent verification records.
Commands:
  - cargo test -p tests --test shard_1k
  - cargo test --workspace
  - scripts/ci/check_test_plan.sh
  - scripts/ci/due_diligence_gate.sh
Checks:
  - DD-2026-0004, DD-2026-0005, DD-2026-0009, DD-2026-0006, DD-2026-0007, DD-2026-0011, and DD-2026-0012 have closure evidence and pass relevant gates.
  - Due-diligence gate completes with no `P0/P1` blockers open.
Deliverables:
  - Clean gate run logs and updated audit registers proving release-ready closure.

Title/ID: m25c-python-orchestration-core
Goal: Add typed, bounded orchestration APIs for schedule/lease/export/approval workflows.
Inputs: tools/cohesix-py/cohesix/client.py, docs/INTERFACES.md.
Changes:
  - tools/cohesix-py/cohesix/orchestration.py - typed request models, env backend discovery, /proc snapshot reads.
Commands:
  - python -m pytest tools/cohesix-py/tests/test_orchestration.py -q
Checks:
  - Control payloads are validated, bounded, and written only to canonical paths.
Deliverables:
  - Orchestration API module with deterministic tests.

Title/ID: m25c-python-host-integrations
Goal: Integrate systemd, docker, k8s, NVML, and PEFT probes with graceful fallback behavior.
Inputs: docs/HOST_TOOLS.md, docs/PYTHON_SUPPORT.md.
Changes:
  - tools/cohesix-py/cohesix/integrations.py - provider probes + NDJSON rendering for telemetry shipping.
  - tools/cohesix-py/tests/test_integrations.py - probe fallback/parse tests.
Commands:
  - python -m pytest tools/cohesix-py/tests/test_integrations.py -q
Checks:
  - Missing dependencies are reported as skipped/degraded, not hard failures.
Deliverables:
  - Provider adapter module and test coverage.

Title/ID: m25c-python-playbooks
Goal: Ship high-impact built-in playbooks for Mac, Jetson, and mixed 1k-fleet workflows.
Inputs: docs/USE_CASES.md, docs/PYTHON_SUPPORT.md.
Changes:
  - tools/cohesix-py/cohesix/playbooks.py - playbook catalog + execution helpers.
  - tools/cohesix-py/cohesix/playbook_cli.py - frictionless playbook CLI.
  - tools/cohesix-py/examples/use_case_playbook.py - example wrapper.
  - tools/cohesix-py/tests/test_playbooks.py - playbook catalog and execution tests.
Commands:
  - python -m pytest tools/cohesix-py/tests/test_playbooks.py -q
  - python -m cohesix.playbook_cli --list
Checks:
  - All nine use-case playbooks are discoverable and dry-run capable.
Deliverables:
  - Playbook SDK + CLI + tests.

Title/ID: m25c-python-docs-and-linux-validation
Goal: Document world-class Python UX and validate on local + G5g Linux.
Inputs: tools/cohesix-py/README.md, docs/PYTHON_SUPPORT.md, ~/cohesix_dev.txt.
Changes:
  - tools/cohesix-py/README.md - install/CLI/playbook UX updates.
  - docs/PYTHON_SUPPORT.md - orchestration + integration + playbook docs.
Commands:
  - source .venv/bin/activate
  - python -m pip install -e 'tools/cohesix-py[integrations,ml,dev]'
  - python -m pytest tools/cohesix-py/tests -q
  - ssh -i ~/.ssh/cohesix-cuda-builder.pem ubuntu@34.221.49.64 '<linux test commands>'
Checks:
  - Local and G5g test runs both pass; docs match as-built behavior.
Deliverables:
  - Updated docs + Linux validation evidence.

Title/ID: m25d-fuse-owner-mount-restoration
Milestone: Reopened Milestone 25d — REST Request-Auth Parity Across Host Tools / owner-only FUSE startup restoration; discovered under Milestone 26e / m26e-host-integration-dependency-contract
Goal: Restore native Mac and Linux FUSE startup without broadening host access or changing Cohesix namespace authority.
Inputs: apps/coh/src/mount.rs, fuser 0.18.0 owner-access contract, the exact Pi GENET burn-in image, MacFUSE 5.3.3, Linux FUSE, and retained failed mount evidence.
Changes:
  - apps/coh/src/mount.rs — retain explicit Owner access and ordinary session cleanup, remove the incompatible AutoUnmount option, preserve the private-mount invariant in a focused regression, and use uncached reads so a zero-length metadata fallback cannot conceal live content or a backend refusal.
  - Cargo.toml, apps/coh/Cargo.toml, Cargo.lock, third_party/fuser — pin the unchanged fuser 0.18.0 runtime with a documented build-script patch selecting its existing libfuse3 adapter on macOS; preserve the macFUSE protocol ABI and default Linux mount implementation.
  - tools/rust-risk-audit/src/main.rs and docs/audit/rust_risk_baseline.toml — seal the exact vendored dependency tree, reject drift and path redirection, and preserve every first-party risk ceiling.
  - docs/HOST_TOOLS.md — document host-user privacy, the macFUSE 5 library requirement, and normal/disconnected-mount cleanup.
  - Compatibility review: all coh mount backends share the corrected configuration. cohsh, hive-gateway, gpu-bridge-host, host-sidecar-bridge, host-ticket-agent, cas-tool, SwarmUI, tools/cohesix-py, and performance benchmark scripts keep their existing wire, policy, namespace, request-auth, and evidence contracts; no changes are required on those surfaces.
Commands:
  - cargo test --locked -p coh --features fuse
  - cargo clippy --locked -p coh --features fuse --all-targets -- -D warnings
  - cargo build --locked --release -p coh --features fuse,nvml
  - scripts/check-generated.sh
  - scripts/ci/check_test_plan.sh
Checks: focused host tests and exact native builds pass; both real host mounts read the Pi-backed namespace and unmount cleanly while owner-only access is retained. Failed pre-repair evidence remains distinct from the repaired diagnostic candidate and timed run.
Deliverables: bounded FUSE repair, native Mac/Linux command and mount evidence, and compatibility review. Broader release qualification is unchanged.

Title/ID: m25d-rest-auth-parity-host-tools
Goal: Ensure every REST-capable host tool resolves and attaches gateway request-auth headers.
Inputs: apps/coh/src/main.rs, apps/coh/src/rest.rs, apps/cas-tool/src/main.rs, apps/gpu-bridge-host/src/main.rs.
Changes:
  - apps/coh/src/main.rs, apps/coh/src/rest.rs - add `--rest-auth-token` support and env fallback resolution for REST mode.
  - apps/cas-tool/src/main.rs - add `--rest-auth-token` and env fallbacks for REST upload mode.
  - apps/gpu-bridge-host/src/main.rs - add `--rest-auth-token` and env fallbacks for REST publish mode.
Commands:
  - cargo test -p coh
  - cargo test -p cas-tool
  - cargo test -p gpu-bridge-host
Checks:
  - REST clients instantiate `GatewayClient` with request-auth when configured.
Deliverables:
  - Host-tool REST request-auth parity with deterministic fallback order.

Title/ID: m25d-swarmui-rest-auth-fanout
Goal: Propagate request-auth through SwarmUI REST boot and parallel fan-out reads/tails.
Inputs: apps/swarmui/src-tauri/main.rs, apps/swarmui/src/lib.rs, apps/swarmui/src/hive.rs.
Changes:
  - apps/swarmui/src-tauri/main.rs - resolve `SWARMUI_REST_AUTH_TOKEN` + canonical gateway env fallbacks.
  - apps/swarmui/src/lib.rs - carry request-auth token in REST parallel config and pass to all spawned transports.
  - apps/swarmui/src/hive.rs - attach request-auth token in parallel telemetry tail workers.
Commands:
  - cargo test -p swarmui
  - cargo check -p swarmui
Checks:
  - No SwarmUI REST code path creates `CohshRestTransport` without request-auth propagation.
Deliverables:
  - SwarmUI REST transport parity with gateway auth policy.

Title/ID: m25d-docs-as-built-rest-auth
Goal: Keep operator docs fully aligned with REST auth semantics after parity fixes.
Inputs: docs/HOST_TOOLS.md, docs/USERLAND_AND_CLI.md.
Changes:
  - docs/HOST_TOOLS.md - document per-tool `--rest-auth-token` and env fallback behavior.
  - docs/USERLAND_AND_CLI.md - reflect gateway request-auth requirements for `coh` and `swarmui` REST mode.
Commands:
  - scripts/ci/check_test_plan.sh
Checks:
  - Docs match shipped tool flags and env keys exactly.
Deliverables:
  - Updated host-tool operator guidance with no auth ambiguity.

Title/ID: m25d-coh-mount-rest-writable-and-bidir
Goal: Make `coh mount --rest-url` reliably readable/writable and suitable for safe bidirectional telemetry transfer (Milestone 21a semantics).
Inputs: apps/coh/src/mount.rs, apps/coh/src/main.rs, apps/coh/src/rest.rs, docs/OPERATOR_WALKTHROUGH.md, docs/TEST_PLAN.md.
Changes:
  - apps/coh/src/mount.rs - fix FUSE file attrs (non-zero file sizes), ensure `readdir` reports accurate directory vs file types (macOS uses the type eagerly), eliminate write-only “ghost” entries, allow host-side appends by avoiding POSIX-perm EPERM (kernel-level checks), and support limited dynamic telemetry roots under `coh.telemetry.root` without introducing generic POSIX create semantics.
  - apps/coh/src/main.rs, apps/coh/src/rest.rs - ensure REST request-auth token is accepted and attached for mount-backed `ECHO` paths so gateway mode stays writable when request-auth is enforced.
  - docs/OPERATOR_WALKTHROUGH.md - document FUSE mount prerequisites and a bidirectional telemetry transfer smoke using supported MIME types.
  - docs/TEST_PLAN.md - add a gateway-mode mount regression: REST mount can `cat` `/proc/*` and append to `/queen/telemetry/<device>/ctl` with request-auth enabled.
Commands:
  - cargo test -p coh
Checks:
  - REST mount `cat` shows non-empty content for bounded files like `/proc/lifecycle/state` and `/log/queen.log`.
  - REST mount can create a new telemetry device root by addressing `${coh.telemetry.root}/<device>/ctl`, then append records into the OS-named segment, and another host can read them via mount.
  - macOS REST mounts can append to `/queen/telemetry/<device>/ctl` without local EPERM/permission denials (errors must come from Cohesix bounds/policy, not host file mode bits).
  - No new generic create/mkdir/unlink/rename semantics are introduced; dynamic behavior is strictly scoped to telemetry ingest roots and remains OS-owned.
Deliverables:
  - Writable, bounded REST mount suitable for multi-host gateway ops with deterministic, policy-aligned behavior.

Title/ID: m25d-console-auth-timeout-remote-tcp-mount
Goal: Make remote TCP console attachments (and `coh mount --host/--port`) reliable over SSH tunnels/high-latency links without changing console grammar.
Inputs: apps/root-task/src/net/mod.rs, apps/root-task/src/net/console_srv.rs, apps/cohsh/src/transport/tcp.rs, docs/HOST_TOOLS.md, docs/OPERATOR_WALKTHROUGH.md.
Changes:
  - apps/root-task/src/net/mod.rs, apps/root-task/src/net/console_srv.rs - increase unauthenticated auth deadline (or implement a bounded auth window) so a client can deliver its token over WAN latency.
  - apps/cohsh/src/transport/tcp.rs - keep client-side retry/backoff bounded and emit a crisp error that points operators at gateway mode when auth times out.
  - docs/HOST_TOOLS.md, docs/OPERATOR_WALKTHROUGH.md - document that REST via `hive-gateway` is the default for remote multi-host ops; TCP console is best-effort over WAN until this is fixed.
Commands:
  - scripts/cohesix-build-run.sh --transport tcp --tcp-port 31337
  - (remote) cohsh/coh attach or mount over an SSH reverse tunnel
Checks:
  - g5g (AWS) can attach/mount over a reverse tunnel without `authentication timed out waiting for server response`.
Deliverables:
  - Remote-safe TCP auth window with unchanged console wire grammar and updated operator guidance.

Title/ID: m25d-macos-coh-fuse-default
Goal: Ship macOS `coh` builds with FUSE enabled so operators can use `coh mount` once MacFUSE is installed/approved.
Inputs: scripts/cohesix-build-run.sh, docs/HOST_TOOLS.md, docs/OPERATOR_WALKTHROUGH.md, docs/TEST_PLAN.md.
Changes:
  - scripts/cohesix-build-run.sh - build `coh` with `--features fuse` on macOS hosts.
  - docs/HOST_TOOLS.md, docs/OPERATOR_WALKTHROUGH.md, docs/TEST_PLAN.md - document MacFUSE prerequisites (`/dev/macfuse0`) and keep examples as-built.
Commands:
  - cargo build -p coh --release --features fuse
Checks:
  - macOS `coh mount` no longer reports “fuse support disabled”.
Deliverables:
  - macOS-ready `coh mount` binary and aligned operator docs.

Title/ID: m25e-session-evidence-byte-budget
Milestone: Milestone 25e — Evidence Packs + Integration Kits; discovered in Milestone 26e release burn-in
Goal: Make a full retained-log evidence capture usable with ordinary shared operator traffic under a finite default session allowance.
Inputs: Fresh-session Queen-log ELIMIT from exact Pi image c07fdd9c7ba3; explicit user instruction to increase the default byte budget.
Changes:
  - configs/root_task*.toml and tools/coh-rtc/src/ir.rs — set the default and manifest ceiling to 8388608 bytes (8 MiB); retain explicit smaller ticket quotas.
  - coh-rtc outputs, selected native host profiles and installed Python wheel — regenerate all affected fingerprints and projected defaults.
  - docs/SECURITY.md, docs/HOST_TOOLS.md and docs/OPERATOR_RECIPES.md — explain sizing, cumulative shared-session accounting and unchanged per-request/resource limits.
Commands: cargo test -p coh-rtc; scripts/check-generated.sh; scripts/ci/check_test_plan.sh; native host builds; fresh exact-image Pi raw entry and full evidence export.
Checks: 8 MiB is finite and exceeds three worst-case retained logs plus 2 MiB operator traffic; smaller explicit ticket values survive parsing and existing quota refusal tests still pass. No rate, cursor, payload, role or namespace limit increases.
Deliverables: regenerated contracts, configuration regression, native build identities, new frozen burn-in profile and live export evidence. No UEFI activation or release acceptance claim.

Title/ID: m25e-evidence-timeline-error-records
Milestone: Reopened Milestone 25e — Evidence Packs + Integration Kits; discovered during Milestone 26e release burn-in maintenance revalidation
Goal: Export a usable incident timeline when AuditFS includes correctly refused operations.
Inputs: The captured Pi maintenance case contains error={code:Permission,message:EPERM}; the existing timeline reader only accepted string errors and rejected the pack.
Changes:
  - apps/coh/src/evidence_timeline.rs — accept canonical structured errors and legacy strings; normalize objects to the unchanged timeline-v1 error string while retaining the original pack.
  - apps/coh/tests/evidence_timeline.rs — verify structured, legacy and null errors, retained refusal outcomes, and deterministic rejection of malformed objects.
  - docs/HOST_TOOLS.md — document input compatibility and unchanged timeline output.
Commands:
  - cargo test -p coh --test evidence_timeline
  - cargo build --release -p coh --features fuse,nvml
  - coh evidence timeline --input <captured-maintenance-case>
Checks: Native Mac and Linux readers consume the unchanged captured case, preserve all refusal events, and keep malformed input failing. The installed Python CI/SIEM consumers validate that same case without another target workload. All required repository checks pass before merge.
Compatibility review: Reviewed cohsh, coh, Hive Gateway/REST, gpu-bridge-host, host-ticket-agent, host-sidecar-bridge, cas-tool, SwarmUI, cohesix-py, and raw/REST benchmark scripts. Only coh timeline and its documentation need changes; Python SIEM already preserves object-valued errors, and the library/CI consumer parse JSON generically. Target producers, generated contracts, timeline schema, other binaries, SDK wheel, benchmark inputs and report schemas remain unchanged. No Pi rebuild or full burn-in rerun is needed for this host-only reader repair.
Deliverables: Bounded compatibility repair, focused tests, two native readers and offline validation of the original captured failure evidence.

Title/ID: m25e-evidence-export-failure-retention
Milestone: Milestone 25e — Evidence Packs + Integration Kits; discovered in Milestone 26e release burn-in
Goal: Preserve failed exports truthfully and restore bounded reads of legitimate long AuditFS records.
Inputs: Pi GENET image from commit 15923ebbfe8f, timed-01 Queen-log ELIMIT refusal, fresh-session audit-journal buffer-full result with prior exit code zero.
Changes:
  - apps/coh/src/evidence.rs — seal partial summaries on capture failure; return an error for retained capture errors; use a positive REST read bound to verify empty audit streams.
  - apps/root-task/src/ninedoor.rs — serialize AuditFS journal/decision records with the existing C1 framing, preserving line and stream bounds.
  - apps/coh/tests/evidence_pack.rs — assert required-read stop and optional-read error retention independently of target scheduling.
  - docs/OPERATOR_RECIPES.md and docs/HOST_TOOLS.md — describe nonzero failure, partial case inspection and unchanged quota boundaries.
Commands: cargo test --locked --release -p coh --features fuse --test evidence_pack; cargo build --locked --release -p coh --features fuse,nvml
Checks: both native builds preserve refusal detail and partial summary, return nonzero on capture errors, and retain exact successful-export contents and redaction.
Deliverables: native host evidence, focused AuditFS serialization regression, fresh exact-image Pi export and first-failure cases; no manifest, ticket quota, public framing or release acceptance changes.

Title/ID: m25e-coh-evidence-pack
Goal: Add a deterministic evidence pack exporter that captures bounded, auditor-friendly system state without new semantics.
Inputs: apps/coh/src/main.rs, apps/coh/src/lib.rs, apps/coh/src/telemetry.rs, crates/cohesix-rest/src/lib.rs, docs/INTERFACES.md.
Changes:
  - apps/coh/src/main.rs - add `coh evidence pack` subcommand (supports `--mock`, `--rest-url`, and TCP console flows).
  - apps/coh/src/lib.rs + apps/coh/src/evidence.rs - implement bounded evidence reads for canonical nodes (`/proc/*`, `/log/queen.log`, `/audit/*`, `/replay/*`, `/proc/lease/*`, `/proc/schedule/*`).
  - apps/coh/src/evidence.rs - include manifest fingerprint + gateway bounds snapshot (`GET /v1/meta/bounds`) to bind evidence packs to a concrete as-built contract.
  - apps/coh/src/evidence.rs - optionally reuse `telemetry::pull` to download telemetry segments into the pack under manifest bounds.
  - docs/HOST_TOOLS.md + docs/OPERATOR_WALKTHROUGH.md - document evidence pack usage and output layout.
Commands:
  - cargo test -p coh
  - cargo run -p coh -- --mock evidence pack --out out/evidence/mock
Checks:
  - Pack includes all required nodes and never reads past manifest-bounded byte caps.
  - Pack output is stable for identical inputs (deterministic file names + ordering).
Deliverables:
  - `coh evidence pack` implementation + docs.

Title/ID: m25e-coh-evidence-timeline
Goal: Produce a correlated timeline view from evidence packs for incident review and audit traceability.
Inputs: apps/coh/src/evidence.rs (from m25e-coh-evidence-pack), apps/nine-door/src/host/audit.rs (journal format reference), docs/audit/CONTROL_TRACEABILITY.md.
Changes:
  - apps/coh/src/main.rs - add `coh evidence timeline --in <pack-dir>` that emits `timeline.ndjson` and `timeline.md`.
  - apps/coh/src/evidence_timeline.rs - parse `/audit/journal` JSONL + `/audit/decisions`, correlate with `/proc/lease/*` snapshots and `seq` fields, and emit stable, bounded output.
  - apps/coh/tests/evidence_timeline.rs - add fixture-driven tests ensuring stable ordering and robust handling of partial packs.
Commands:
  - cargo test -p coh
Checks:
  - Timeline output is deterministic for a fixed evidence pack and does not require network access.
Deliverables:
  - Timeline generator suitable for postmortems and due diligence artifacts.

Title/ID: m25e-integration-kits-ci-siem
Goal: Ship turnkey, protocol-faithful integration kits that reduce adoption friction in CI and SIEM pipelines.
Inputs: docs/HOST_API.md (OpenAPI), docs/HOST_TOOLS.md, tools/cohesix-py.
Changes:
  - docs/HOST_TOOLS.md - add a dedicated section: CI usage (generate evidence pack, upload artifacts) and SIEM export patterns (audit journal + decisions + lease snapshots).
  - tools/cohesix-py/examples/ci_evidence_pack.py - run `coh evidence pack` (or REST equivalents) in mock/dry-run, validate output layout, emit a machine-readable summary JSON.
  - tools/cohesix-py/examples/siem_export_ndjson.py - read an evidence pack and emit normalized NDJSON suitable for Splunk/Elastic ingestion (no network by default; optional `--post` with env-configured URL/token).
  - tools/cohesix-py/tests/test_examples_ci_siem.py - ensure examples run deterministically in mock mode and never require external connectivity.
Commands:
  - python -m pytest tools/cohesix-py/tests -q
Checks:
  - Examples run in mock mode on macOS and produce stable outputs with no secrets in logs.
Deliverables:
  - Integration kits that demonstrate “buyable” workflows without new control semantics.

Title/ID: m25e-gpu-lease-receipts
Goal: Add receipt-backed GPU leasing outputs for audit and chargeback without changing lease enforcement.
Inputs: apps/coh/src/gpu.rs, apps/coh/src/run.rs, docs/INTERFACES.md.
Changes:
  - apps/coh/src/gpu.rs - add optional `--receipt-out` that writes a JSON receipt including request parameters, ACK line, and a bounded `/proc/lease/*` snapshot captured immediately after the lease request.
  - apps/coh/src/run.rs - extend host command wrapper to emit receipts for lease-validated runs (breadcrumb correlation).
  - apps/coh/tests/receipts.rs - validate receipt schema, bounds, and determinism.
Commands:
  - cargo test -p coh
Checks:
  - Receipts never include secrets (tokens, raw tickets) and are stable for fixed inputs.
Deliverables:
  - Receipt artifacts suitable for audit and internal billing pipelines.

Title/ID: m25f-gateway-broker-refactor
Goal: Replace lock-contention transport access with a bounded broker model while preserving single-console wire ownership.
Inputs: apps/hive-gateway/src/main.rs, apps/cohsh/src/session_pool.rs, apps/cohsh/src/transport/tcp.rs, docs/HOST_TOOLS.md.
Changes:
  - apps/hive-gateway/src/main.rs - add broker request queues (control + telemetry), deterministic scheduling/fairness, and queue-aware backpressure responses.
  - apps/hive-gateway/src/main.rs - keep `hive-gateway` as sole console client; remove direct per-request competition on shared transport mutex.
  - apps/cohsh/src/session_pool.rs, apps/cohsh/src/transport/tcp.rs - align lease/session lifecycle with broker ownership and bounded shutdown/reconnect behavior.
Commands:
  - cargo test -p hive-gateway
  - cargo test -p cohsh
Checks:
  - Under concurrent REST load, checkout timeout/backpressure rates fall materially from baseline and control-plane operations remain serviceable.
Deliverables:
  - Brokerized gateway transport path with deterministic backpressure telemetry.

Title/ID: m25f-telemetry-manifest-chunk-references
Goal: Support MB/GB telemetry artifacts via many bounded chunk references rather than bulk inline payload transfer.
Inputs: tools/coh-rtc/src/ir.rs, configs/root_task.toml, apps/nine-door/src/host/telemetry.rs, apps/root-task/src/ninedoor.rs, docs/INTERFACES.md.
Changes:
  - tools/coh-rtc/src/ir.rs + configs/root_task.toml - add manifest-driven limits for telemetry reference manifests (max refs, max manifest bytes, max referenced bytes scope as required).
  - apps/nine-door/src/host/telemetry.rs + apps/root-task/src/ninedoor.rs - enforce deterministic validation for reference-manifest envelopes and bounded append semantics.
  - apps/cohsh/src/lib.rs + apps/coh/src/telemetry.rs - add/extend host tooling for emitting reference manifests and resolving latest segment IDs without new control verbs.
  - docs/INTERFACES.md - document reference-manifest schema and limits as-built.
Commands:
  - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json
  - cargo test -p nine-door
  - cargo test -p cohsh
Checks:
  - Valid manifests append successfully; malformed and over-limit manifests fail with deterministic ERR details.
Deliverables:
  - Manifest-reference telemetry ingest path suitable for real-world artifact sizes while preserving Cohesix control-plane boundaries.

Title/ID: m25f-harness-large-scenarios-no-retry
Goal: Make gateway reliability regressions visible with explicit no-retry large-size scenario gates.
Inputs: scripts/rest_perf_harness.py, tests/test_rest_perf_harness.py, docs/TEST_PLAN.md.
Changes:
  - scripts/rest_perf_harness.py - add explicit scenario presets (`telemetry-1mb`, `telemetry-10mb`, `telemetry-100mb`, `telemetry-1gb`) routed through gateway paths.
  - scripts/rest_perf_harness.py - enforce `--no-retries` mode, fast-ramp controls, and strict `--error-budget-rate` pass/fail behavior.
  - tests/test_rest_perf_harness.py - cover scenario wiring, no-retry semantics, and error-budget failure behavior.
  - docs/TEST_PLAN.md - add canonical commands and required outputs for all four scenarios.
Commands:
  - .venv/bin/python -m pytest -q tests/test_rest_perf_harness.py
  - python scripts/rest_perf_harness.py --mode simulate --rest-url http://127.0.0.1:8080 --no-retries --fast-ramp --scenario telemetry-1mb --error-budget-rate 0.01
  - python scripts/rest_perf_harness.py --mode simulate --rest-url http://127.0.0.1:8080 --no-retries --fast-ramp --scenario telemetry-10mb --error-budget-rate 0.01
  - python scripts/rest_perf_harness.py --mode simulate --rest-url http://127.0.0.1:8080 --no-retries --fast-ramp --scenario telemetry-100mb --error-budget-rate 0.01
  - python scripts/rest_perf_harness.py --mode simulate --rest-url http://127.0.0.1:8080 --no-retries --fast-ramp --scenario telemetry-1gb --error-budget-rate 0.01
Checks:
  - Each scenario emits deterministic summary artifacts and fails hard (exit code non-zero) when error rate exceeds budget.
Deliverables:
  - A repeatable large-object gateway reliability gate with no hidden retries.

Title/ID: m25f-docs-sync-and-operator-guidance
Goal: Keep docs-as-built alignment for broker behavior, large telemetry references, and no-retry gates.
Inputs: docs/INTERFACES.md, docs/HOST_TOOLS.md, docs/TEST_PLAN.md, docs/ARCHITECTURE.md.
Changes:
  - docs/INTERFACES.md - describe telemetry reference-manifest envelopes and manifest-driven limits.
  - docs/HOST_TOOLS.md - document gateway broker behavior, expected backpressure signals, and operator tuning knobs.
  - docs/TEST_PLAN.md - codify the mandatory 1MB/10MB/100MB/1GB no-retry fast-ramp matrix and pass/fail policy.
  - docs/ARCHITECTURE.md - update transport implementation notes to reflect brokerized gateway path while preserving single-console architecture.
Commands:
  - scripts/ci/check_test_plan.sh
Checks:
  - Documentation matches implemented flags, limits, and failure semantics exactly.
Deliverables:
  - Canonical operator and test documentation for Milestone 25f.

Title/ID: m25g-ticket-ir-and-namespace
Goal: Define host control-ticket schema/bounds and expose append-only ticket streams in the namespace.
Inputs: tools/coh-rtc/src/ir.rs, configs/root_task.toml, apps/nine-door/src/host, apps/root-task/src/ninedoor.rs, docs/INTERFACES.md.
Changes:
  - tools/coh-rtc/src/ir.rs + configs/root_task.toml - add `host-ticket/v1` schema, action allowlist, byte caps, and lifecycle enums.
  - apps/nine-door/src/host/tickets.rs + apps/root-task/src/ninedoor.rs - add `/host/tickets/spec`, `/host/tickets/status`, `/host/tickets/deadletter`, and bounded snapshot nodes.
  - docs/INTERFACES.md - document ticket file paths, schema, and deterministic failure semantics.
Commands:
  - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json
  - scripts/check-generated.sh
  - cargo test -p nine-door
Checks:
  - Valid ticket lines append successfully; malformed/over-limit lines fail deterministically.
Deliverables:
  - Manifest-driven host ticket contract with generated artifacts and interface docs.

Title/ID: m25g-host-ticket-agent-core
Goal: Add a host-only ticket agent that watches mounted ticket streams and executes bounded work with idempotent claims.
Inputs: apps/coh/src/mount.rs, apps/host-ticket-agent (new), docs/HOST_TOOLS.md, docs/ARCHITECTURE.md.
Changes:
  - apps/host-ticket-agent/src/main.rs - tail/watch loop for `/host/tickets/spec` with deterministic cursor resume.
  - apps/host-ticket-agent/src/claim.rs - claim/idempotency handling keyed by `id` + `idempotency_key`.
  - apps/host-ticket-agent/src/status.rs - append bounded `host-ticket-result/v1` receipts to `/host/tickets/status`.
  - docs/HOST_TOOLS.md + docs/ARCHITECTURE.md - document runtime model, failure handling, and single-console constraints.
Commands:
  - cargo test -p host-ticket-agent
Checks:
  - Agent survives watcher interruptions, resumes from cursor, and avoids duplicate side effects for repeated tickets.
Deliverables:
  - Host ticket execution agent with deterministic claim/execute/report lifecycle.

Title/ID: m25g-gpu-peft-ticket-executors
Goal: Implement high-value GPU lease and PEFT lifecycle ticket actions.
Inputs: apps/gpu-bridge-host, apps/coh/src/peft, docs/GPU_NODES.md, docs/USE_CASES.md.
Changes:
  - apps/host-ticket-agent/src/executors/gpu.rs - execute `gpu.lease.grant|renew|release` and verify via `/gpu/<id>/lease`.
  - apps/host-ticket-agent/src/executors/peft.rs - execute `peft.import|activate|rollback` using existing host registry and `/gpu/models/*` flows.
  - docs/GPU_NODES.md + docs/USE_CASES.md - document ticket-driven GPU/PEFT orchestration for multi-tenant edge and model governance use cases.
Commands:
  - cargo test -p gpu-bridge-host
  - cargo test -p coh --features mock
Checks:
  - Ticketed GPU/PEFT flows are auditable, bounded, and preserve existing lease/model semantics.
Deliverables:
  - Ticket executors for the highest-value GPU/PEFT control loops.

Title/ID: m25g-systemd-docker-remediation
Goal: Add deterministic systemd/docker remediation ticket actions through host-side adapters.
Inputs: apps/host-sidecar-bridge, apps/host-ticket-agent, docs/HOST_TOOLS.md, docs/INTERFACES.md.
Changes:
  - apps/host-ticket-agent/src/executors/systemd.rs - support allowlisted `start|stop|restart|status-check` unit actions.
  - apps/host-ticket-agent/src/executors/docker.rs - support allowlisted container restart/stop/status actions with bounded output capture.
  - apps/host-sidecar-bridge/src/providers/* - normalize status verification for post-action receipts.
  - docs/HOST_TOOLS.md + docs/INTERFACES.md - document remediation action schemas and safeguards.
Commands:
  - cargo test -p host-sidecar-bridge
  - cargo test -p host-ticket-agent
Checks:
  - Remediation actions emit deterministic success/failure receipts and never execute non-allowlisted commands.
Deliverables:
  - Policy-bounded systemd/docker ticket remediation path.

Title/ID: m25g-k8s-rbac-ticket-translation
Goal: Preserve Kubernetes coexistence by translating RBAC-scoped intents into Cohesix host tickets.
Inputs: tools/cohesix-py, apps/host-ticket-agent, docs/USE_CASES.md, docs/PYTHON_SUPPORT.md.
Changes:
  - tools/cohesix-py/cohesix/orchestrator.py - add optional RBAC-to-ticket translation helpers for cordon/drain/lease workflows.
  - apps/host-ticket-agent/src/executors/k8s.rs - execute allowlisted K8s actions and emit bounded receipts.
  - docs/USE_CASES.md + docs/PYTHON_SUPPORT.md - document coexistence constraints, identity mapping, and ticket translation flow.
Commands:
  - python3 -m pytest tools/cohesix-py/tests -q
  - cargo test -p host-ticket-agent
Checks:
  - K8s coexistence remains out-of-band governance (no scheduler replacement) with deterministic ticket/audit linkage.
Deliverables:
  - RBAC-scoped K8s coexistence adapter over ticketed control semantics.

Title/ID: m25g-evidence-replay-and-testplan
Goal: Extend audit/evidence/replay and codify mandatory ticket-flow validation in the Test Plan.
Inputs: apps/coh/src/evidence.rs, apps/coh/src/evidence_timeline.rs, docs/TEST_PLAN.md, docs/SECURITY.md, docs/USERLAND_AND_CLI.md.
Changes:
  - apps/coh/src/evidence.rs + apps/coh/src/evidence_timeline.rs - correlate ticket `id`/`idempotency_key` across spec/status/audit/lease artifacts.
  - docs/TEST_PLAN.md - add mandatory control-ticket matrix: GPU/PEFT, systemd remediation, docker remediation, K8s coexistence translation, and replay/timeline validation.
  - docs/SECURITY.md + docs/USERLAND_AND_CLI.md - document token redaction, idempotency semantics, and operator procedures.
Commands:
  - cargo test -p coh
  - scripts/ci/check_test_plan.sh
Checks:
  - Evidence packs and timelines are deterministic and include ticket correlation for all mandatory ticket classes.
Deliverables:
  - Canonical docs and regression requirements for Milestone 25g ticketed orchestration.

Title/ID: m25h-federation-ir-and-policy
Goal: Add manifest-driven federation config and bounds for cross-hive relay behavior.
Inputs: tools/coh-rtc/src/ir.rs, configs/root_task.toml, docs/INTERFACES.md, docs/ARCHITECTURE.md.
Changes:
  - tools/coh-rtc/src/ir.rs + configs/root_task.toml - add `federation` section (peers, allowlisted actions, queue/WAL bounds, auth references).
  - Generated artifacts/snippets - emit federation bounds for docs and host tooling.
  - docs/INTERFACES.md + docs/ARCHITECTURE.md - document federation envelope and invariants.
Commands:
  - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json
  - scripts/check-generated.sh
Checks:
  - Invalid peer config or over-limit bounds fail generation deterministically.
Deliverables:
  - Manifest-backed federation policy with generated docs snippets and hash-checked artifacts.

Title/ID: m25h-relay-agent-core
Goal: Implement bounded cross-hive ticket relay with WAL and deterministic cursor resume.
Inputs: apps/host-ticket-agent, apps/hive-gateway, docs/HOST_TOOLS.md, docs/FAILOVER.md.
Changes:
  - apps/host-ticket-agent/src/relay.rs (or new apps/hive-federation-relay) - watch source `/host/tickets/spec`, forward allowlisted intents to target `/host/tickets/spec`.
  - apps/host-ticket-agent/src/wal.rs - persist pending relay intents and replay unapplied entries after restart.
  - apps/hive-gateway - expose relay observability counters under existing status surfaces.
Commands:
  - cargo test -p host-ticket-agent
  - cargo test -p hive-gateway
Checks:
  - Relay restarts resume from cursor/WAL without duplicate side effects.
Deliverables:
  - Host-side relay engine with bounded queueing and restart-safe behavior.

Title/ID: m25h-federated-ticket-envelope
Goal: Define cross-hive ticket envelope and status correlation rules.
Inputs: apps/nine-door/src/host/tickets.rs, apps/root-task/src/ninedoor.rs, docs/INTERFACES.md.
Changes:
  - Ticket schema evolution (`host-ticket/v1` additive fields or `host-ticket-federated/v1`) including `source_hive`, `target_hive`, `relay_hop`, and correlation IDs.
  - Deterministic mapping from target status receipts back to source status/deadletter.
  - docs/INTERFACES.md - normative schema and lifecycle transitions for federated flow.
Commands:
  - cargo test -p nine-door
  - cargo test -p host-ticket-agent
Checks:
  - Malformed or unauthorized federated envelopes are rejected with deterministic ERR/receipts.
Deliverables:
  - Stable cross-hive envelope contract and receipt-correlation semantics.

Title/ID: m25h-fleet-read-model
Goal: Add operator-grade fleet read model without introducing global write semantics.
Inputs: apps/coh, apps/hive-gateway, docs/HOST_TOOLS.md.
Changes:
  - apps/coh/src/fleet.rs - read-only fan-in helpers (`coh fleet status`, `coh fleet lease-summary`, `coh fleet pressure`).
  - docs/HOST_TOOLS.md - document read-only fleet commands and write-fencing guidance.
  - Optional REST/FUSE examples for multi-hive observability trees.
Commands:
  - cargo test -p coh
Checks:
  - Fleet read commands produce deterministic merged output and never mutate hive state.
Deliverables:
  - Read-only fleet observability surface aligned with single-writer control semantics.

Title/ID: m25h-failover-fencing-integration
Goal: Integrate relay behavior with failover fencing and cutover runbooks.
Inputs: scripts/failover_watchdog.py, docs/FAILOVER.md, docs/TEST_PLAN.md.
Changes:
  - scripts/failover_watchdog.py - add relay pause/resume hooks tied to hold-down and health thresholds.
  - docs/FAILOVER.md - federation-aware runbook: freeze relay, cut over, replay WAL, resume relay.
  - docs/TEST_PLAN.md - mandatory failover + relay consistency checks.
Commands:
  - python3 scripts/failover_watchdog.py --help
  - scripts/ci/check_test_plan.sh
Checks:
  - Planned/unplanned cutovers do not create split-brain relay writes or duplicate downstream actions.
Deliverables:
  - Federation-aware failover automation and validated operator procedure.

Title/ID: m25h-federation-scale-gate
Goal: Validate pragmatic multi-hive scale targets with deterministic pass/fail criteria.
Inputs: scripts/rest_perf_harness.py, docs/BENCHMARKS.md, docs/TEST_PLAN.md, docs/USE_CASES.md.
Changes:
  - scripts/rest_perf_harness.py - add multi-hive scenario mode (N gateways, per-hive worker caps, relay load profile).
  - docs/BENCHMARKS.md - publish 3-hive baseline and optional 10-hive stretch results with first-failure mode analysis.
  - docs/USE_CASES.md + docs/TEST_PLAN.md - map federated scale to concrete use-case flows and mandatory gate commands.
Commands:
  - python scripts/rest_perf_harness.py --mode simulate --multi-hive --hives 3 --workers-per-hive 1000 --no-retries --error-budget-rate 0.01
Checks:
  - Multi-hive scenarios hit target worker totals via federation without breaching per-hive invariants.
Deliverables:
  - Federation scale gate evidence and use-case-aligned capacity guidance.

Title/ID: m25h-evidence-and-timeline-correlation
Goal: Make cross-hive relay flows first-class in evidence packs and timelines.
Inputs: apps/coh/src/evidence.rs, apps/coh/src/evidence_timeline.rs, docs/HOST_TOOLS.md.
Changes:
  - apps/coh/src/evidence.rs - export source/target relay correlation fields and redacted auth metadata.
  - apps/coh/src/evidence_timeline.rs - stitch multi-hive ticket lifecycle into deterministic timeline ordering.
  - docs/HOST_TOOLS.md - operator guidance for multi-hive postmortems and chargeback.
Commands:
  - cargo test -p coh
Checks:
  - Evidence/timeline output is deterministic and sufficient to reconstruct federated control flow.
Deliverables:
  - Cross-hive evidence correlation integrated into existing audit-first tooling.

Title/ID: m26-uboot-bootchain
Goal: Boot Pi 4 via the staged U-Boot `bootm` handoff into seL4/root-task with stable manifest fingerprint output.
Inputs: `seL4/build_UBOOT/images/sel4test-driver-image-arm-bcm2711`, `third_party/u-boot`, Pi firmware boot partition files, profile manifest, staged driver-runtime CPIO, padded Pi 4 DTB.
Changes:
  - `scripts/pi4-image-build.sh` — build deterministic Pi 4 FAT payload (`u-boot.bin` + seL4 image + manifest artifacts).
  - `docs/HARDWARE_BRINGUP.md` — document canonical Pi 4 U-Boot command flow and SD layout.
  - `apps/root-task` — preserve boot fingerprint line ordering relative to serial/local seat.
Commands:
  - `scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml`
  - `make -C third_party/u-boot rpi_4_defconfig`
  - `make -C third_party/u-boot CROSS_COMPILE=aarch64-linux-gnu- -j$(sysctl -n hw.ncpu)`
Checks:
  - Pi 4 reaches root-task via staged `bootm <image> <runtime-cpio> <dtb>`; missing/invalid manifest or DTB policy aborts before ticket publication.
Deliverables:
  - Reproducible Pi 4 U-Boot boot artifacts with documented hashes and commands.

---

Title/ID: m26-uboot-mac-debug-harness
Goal: Provide a fast macOS U-Boot/QEMU harness for debugging boot scripts and future network env setup.
Inputs: `third_party/u-boot` (`qemu_arm64_defconfig`), `qemu-system-aarch64`, docs updates.
Changes:
  - `scripts/uboot/qemu-uboot-smoke.sh` — launch U-Boot on QEMU `virt` with deterministic serial logging.
  - `docs/HARDWARE_BRINGUP.md` — list supported harness use cases and explicit non-goals (no Pi4 USB/HDMI/GENET fidelity).
Commands:
  - `make -C third_party/u-boot qemu_arm64_defconfig`
  - `make -C third_party/u-boot CROSS_COMPILE=aarch64-linux-gnu- -j$(sysctl -n hw.ncpu)`
  - `qemu-system-aarch64 -machine virt -cpu cortex-a57 -m 2048 -nographic -bios third_party/u-boot/u-boot.bin`
Checks:
  - Harness reaches U-Boot prompt and can execute env and network setup commands deterministically.
Deliverables:
  - Faster pre-hardware debug loop for U-Boot setup logic.

---

Title/ID: m26-local-seat-minimal
Goal: Provide primitive local post-boot diagnostics on Pi 4 by wiring USB keyboard input and HDMI text output into existing root-console path.
Inputs: `apps/root-task/src/console/*`, `apps/root-task/src/userland/mod.rs`, `apps/root-task/src/event/*`, HAL mapping, `tools/coh-rtc`, profile manifest.
Changes:
  - HAL-bound USB keyboard input path feeding existing parser/dispatcher.
  - Primitive HDMI text sink mirroring root-console output lines with bounded memory and deterministic truncation.
  - `coh-rtc` schema/codegen for `hw.local_seat` (`enabled`, `required`, declared devices).
  - Pi 4 VL805 local-seat remains cold-boot-only: Linux/U-Boot captures may provide layout diagnostics, but root-port power readback, connected/enabled/speed state, and reset must be proven in the current Cohesix boot after command/event-ring proof.
Commands:
  - `cargo check -p root-task`
  - `cargo test -p root-task --features "kernel serial-console" local_seat`
  - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json`
Checks:
  - USB keyboard commands yield identical parser semantics to serial.
  - Pi 4 USB enumeration does not synthesize root-port state from Linux/U-Boot captures after command-ring proof.
  - HDMI output mirrors root-console lines deterministically.
  - `hw.local_seat.required=true` fails fast when dependencies are unsatisfied.
Deliverables:
  - Pi 4 local-seat evidence proving `cohesix>` command loop on USB keyboard + HDMI.

---

Title/ID: m26-device-identity-attestation-closure
Milestone: Milestone 26 — Official Pi 4 Bring-up / reopened device-identity, attestation, and ticket-secret defect
Goal: Replace configuration hashing presented as TPM/DICE evidence with real device-bound, freshness-protected attestation and prevent authority publication when no accepted trust root exists.
Inputs: apps/root-task/src/{attest.rs,kernel.rs,ninedoor.rs}, apps/pi4-driver-runtime/**, tools/coh-rtc/src/**, configs/root_task*.toml, selected seL4/U-Boot/QEMU/Pi images, host secret and trust-anchor tooling, docs/ARCHITECTURE.md, docs/HARDWARE_BRINGUP.md, docs/INTERFACES.md, docs/SECURITY.md, docs/TEST_PLAN.md, and the frozen CYW43 image identity when implementation begins.
Changes:
  - tools/coh-rtc/src/** + configs/root_task*.toml — replace ambiguous `tpm-or-dice` selection with explicit `disabled|measurement_only|tpm2_quote|dice_evidence` implementation modes plus `required`, algorithms, bounded measurement/PCR policy, trust-anchor references, evidence/challenge limits, freshness window, ticket-key policy, and exact device/boot-chain prerequisites. Production generation rejects an attestation claim without a declared usable trust root, rejects DICE with no device-bound CDI chain, rejects TPM mode with no isolated TPM device contract, and rejects literal/static production ticket keys.
  - apps/pi4-driver-runtime/** + HAL manifests — when TPM mode is selected, add the least-authority isolated TPM transport/runtime required for bounded TPM2 startup, PCR read/extend policy, quote, and sealed-object unseal. Root receives typed evidence/results only; it receives no direct physical bus/MMIO shortcut and no raw endorsement or storage key.
  - boot/U-Boot handoff + apps/root-task/src/attest.rs — for DICE mode, consume a read-once, versioned, signed evidence descriptor rooted in a device-bound CDI/attestation key established before root-task. For TPM mode, request a TPM2 Quote over the generated PCR selection. Both evidence forms bind verifier nonce, boot/session id, monotonic/replay data, firmware/U-Boot/seL4 kernel/root/runtime archives/resolved-manifest/image hashes, algorithms, public-key/certificate chain, and signature.
  - apps/root-task/src/ninedoor.rs + generated interface — add bounded `/proc/attest/{capabilities,status,challenge,evidence}` semantics. `challenge` accepts only an authenticated, rate-limited, fixed-schema nonce request; `evidence` returns the uniquely correlated signed result. This is an ephemeral evidence operation over existing transport/authority, not a general RPC or configuration mutation.
  - ticket authority — replace generated static production role keys with TPM-sealed role material or DICE-domain-separated key derivation. Ticket publication occurs only after the selected measurement policy and signed chain validate; failure leaves ticket/network write authority unavailable while preserving the emergency serial failure report required by the profile.
  - QEMU/Pi evidence — use a vTPM only as explicit QEMU virtual-device evidence and require real Pi hardware TPM or a genuine Pi device-bound DICE/secure-boot chain for Pi attestation acceptance. If neither exists, the Pi profile reports `measurement_only` or `unavailable`; it may boot only when attestation is not required and cannot make an attested-production claim.
  - docs/tests/release — add enrollment/trust-anchor, rotation, nonce freshness, replay, wrong-PCR, wrong-image, wrong-key, expired-chain, TPM reset, DICE-chain, unavailable-device, secret-scan, and power-loss cases; historical deterministic hashes remain measurement fixtures and are never promoted.
Commands:
  - cargo test -p coh-rtc attestation
  - cargo test -p root-task --tests attest
  - cargo test -p pi4-driver-runtime --features tpm2
  - scripts/check-generated.sh
  - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26-attestation-qemu
  - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26-attestation-pi4
Checks: a fresh verifier nonce produces a valid TPM2 Quote or DICE signature chain bound to the exact accepted image and manifest; replay, public-data hash synthesis, missing CDI/TPM, wrong measurement, stale nonce, signature/chain failure, static key material, and fixture substitution fail before ticket publication; QEMU virtual evidence and Pi hardware/device-root evidence remain distinct; no CYW43 behavior or proof classification is edited.
Deliverables: Honest measurement-versus-attestation states, real device-bound signed evidence, sealed/derived ticket authority, host-verifiable freshness, and separate QEMU/Pi acceptance records.

---

Title/ID: m26-hal-boundary
Goal: Keep all post-seL4 runtime device access HAL-owned while allowing U-Boot-only pre-boot control.
Inputs: `apps/root-task/src/hal/*`, `apps/root-task/src/drivers/*`, `apps/root-task/src/kernel.rs`, `tools/coh-rtc/src/*`, docs.
Changes:
  - Ensure all Milestone 26 runtime paths (serial, local seat, attestation, future network handoff points) are represented through HAL interfaces.
  - Add deterministic checks and documentation language for bootloader-owned vs Cohesix-owned responsibilities.
Commands:
  - `cargo check -p root-task`
  - `cargo test -p root-task hal:: -- --nocapture`
  - `rg -n "EFI_|boot_services|runtime_services|uefi::" apps/root-task/src apps/nine-door/src tools/coh-rtc/src`
Checks:
  - No direct firmware-service assumptions in runtime code.
  - HAL remains sole runtime device access surface.
Deliverables:
  - Auditable bootloader/runtime boundary with CI-friendly guard commands and docs-as-built updates.

Title/ID: m26a-driver-task-hal-contracts
Goal: Make hardware driver service admissible only through HAL-declared scheduling contracts.
Inputs: apps/root-task/src/hal/*, apps/root-task/src/net/*, apps/root-task/src/serial/*, apps/root-task/src/local_seat.rs, docs/DRIVERS.md, docs/TEST_PLAN.md.
Changes:
  - apps/root-task/src/hal/* — add driver-task contract types, built-in role contracts, and per-turn budget validation.
  - apps/root-task/src/net/mod.rs + apps/root-task/src/net/stack.rs — require valid NIC driver contracts before network device construction and expose active contract diagnostics.
  - apps/root-task/src/serial/mod.rs + apps/root-task/src/local_seat.rs — expose serial and local-seat contracts for event-loop admission.
Commands:
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::driver_task
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib net::tests::network_driver_task_contracts_match_backend_labels
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib serial::tests::poll_io_obeys_driver_task_budget
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests::serial_input_skips_ready_network_data_poll_for_driver_task_turn
Checks:
  - Missing, zero-budget, blocking, or non-preemptible driver contracts fail deterministically before service.
  - Built-in contracts preserve the priority order: serial/USB input before network control, network control before network data, diagnostics/display last.
Deliverables:
  - HAL scheduling-contract ratchet for current compatibility drivers and future dedicated seL4 driver tasks.

Title/ID: m26a-smp-activity-diagnostic
Goal: Add bounded root-console activity diagnostics for cross-core evidence without enabling seL4 kernel benchmark builds.
Inputs: crates/cohsh-core/src/command.rs, crates/cohsh-core/src/verb.rs, apps/root-task/src/event/mod.rs, apps/root-task/src/console/mod.rs, apps/root-task/src/local_seat.rs, apps/root-task/src/net/mod.rs, apps/root-task/src/hal/driver_task.rs, apps/root-task/src/affinity.rs, docs/USERLAND_AND_CLI.md.
Changes:
  - crates/cohsh-core/src/command.rs + crates/cohsh-core/src/verb.rs — expose the canonical grammar as `smp [activity|dump]`, reject unknown pseudo-profile arguments, map bare `smp` and explicit `smp activity` to bounded userspace telemetry, and retain the raw debug-kernel scheduler snapshot only as explicit `smp dump`.
  - apps/root-task/src/affinity.rs + apps/root-task/src/event/mod.rs — implement the default `smp` activity view from bounded userspace telemetry: event-pump command/timer counters, serial backpressure, local-seat keyboard/HDMI mirror counters, network status/counters when present, HAL driver-task contracts, driver-task runtime proof masks, manifest affinity assignments, and repeated-sample per-core counter-delta rows; keep `smp dump` on the same multi-assignment core bucket formatter.
  - apps/root-task/src/console/mod.rs — keep early-console behavior explicit when the event-pump telemetry source is unavailable.
  - docs/USERLAND_AND_CLI.md + docs/snippets/cohsh_grammar.md — document that default `smp` activity output is not a cycle-accurate profiler, does not require kernel benchmark builds, and is mirrored to HDMI through the local-seat path while explicit raw `smp dump` text remains UART-only.
Commands:
  - cargo test -p cohsh-core smp
  - cargo test -p root-task smp_activity
  - cargo test -p root-task --features net-console smp_activity
Checks:
  - `smp` and `smp activity` never depend on `CONFIG_BENCHMARK_TRACK_KERNEL_ENTRIES`, debug-kernel benchmark syscalls, PMU counters, or unbounded sampling.
  - Output is line-bounded and useful for Pi 4 diagnostics: it distinguishes parser/event-loop progress, serial pressure, HDMI/local-seat mirroring, attached network progress, driver-task compatibility vs dedicated proof, and configured role/driver affinity.
  - The htop-ish core rows are assignment buckets, not exclusive CPU owners: when multiple roles/drivers map to the same core, `tasks=` lists all of them and the rate fields aggregate only safe userspace counter deltas for that bucket while keeping `cpu_pct=unavailable`.
  - Explicit debug-kernel `smp dump` also treats core rows as assignment buckets: before each UART-only seL4 scheduler/CPU dump, the probe line includes every role/driver allocated to that core instead of dropping secondary assignments.
  - HDMI display receives the same event-pump activity lines when local-seat mirroring is active; raw kernel debug output from `smp dump` remains serial-only and unavailable after linked-UART cutover.
  - Unknown arguments such as `smp profile` fail grammar validation instead of silently aliasing to default `smp`.
Deliverables:
  - Root-console `smp` activity diagnostic, compatibility spelling, explicit raw dump path, event-pump/HDMI mirroring, and feature-scoped network test coverage.

Title/ID: m26a-driver-task-kernel-substrate
Goal: Add root-owned seL4 task/capability substrate for hardware driver tasks without changing authority semantics.
Inputs: apps/root-task/src/kernel.rs, apps/root-task/src/hal/*, apps/root-task/src/cspace*, configs/root_task.toml, docs/ROLES_AND_SCHEDULING.md.
Changes:
  - crates/sel4-sys/src/lib.rs + apps/root-task/src/sel4.rs — add driver TCB scheduling/resume/notification wrappers, CNode revoke, and remote-safe IPC buffer install.
  - apps/root-task/src/hal/* + apps/root-task/src/kernel.rs — add driver-task handles/rings for TCB creation, CSpace/VSpace setup, scheduling attributes, per-driver SMP affinity, notification binding, fault endpoint badges, and revocation.
  - configs/root_task.toml + coh-rtc outputs — add profile-gated driver-task specs, per-driver affinity, and bounds.
Commands:
  - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features release-pi4
  - cargo test -p sel4-sys
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::driver_task
Checks:
  - Root retains cap ownership and can fault-report/revoke a driver task.
  - Driver tasks receive only declared device grants and bounded ring frames.
Deliverables:
  - Dedicated driver-task creation substrate ready for serial/display, GENET, USB, CYW43, SDIO, and PCIe migration.

Title/ID: m26a-serial-display-driver-tasks
Goal: Move normal serial and HDMI display service behind dedicated driver-task contracts while preserving emergency debug fallback.
Inputs: apps/root-task/src/serial/*, apps/root-task/src/local_seat.rs, apps/root-task/src/event/*, docs/DRIVERS.md.
Changes:
  - apps/root-task/src/serial/* — replace blocking normal-output paths with bounded driver-task IPC after early boot handoff.
  - apps/root-task/src/local_seat.rs — route HDMI text refresh through a bounded display-sink task.
  - apps/root-task/src/event/* — preserve serial/USB priority over network data and display flushing.
Commands:
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib serial::tests
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib local_seat::tests
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests
Checks:
  - Serial echo and HDMI mirror remain fluid while GENET consumes its full data budget.
  - Emergency debug UART remains available only for boot/fault diagnostics, not normal console output.
Deliverables:
  - Serial/display task isolation proof with no ACK/ERR/END grammar drift.

Title/ID: m26a-genet-driver-task
Goal: Promote GENET from in-root compatibility driver to isolated frame driver task.
Inputs: apps/root-task/src/drivers/driver_task_net.rs, apps/root-task/src/net/*, apps/pi4-driver-runtime/src/lib.rs.
Changes:
  - apps/root-task/src/drivers/driver_task_net.rs — keep root as the GENET ring client only and fail closed when the isolated runtime has not returned owner progress.
  - apps/pi4-driver-runtime/src/lib.rs — keep DMA ring ownership, TX reclaim, RX refill, and service turns in the isolated `driver-genet` runtime.
  - apps/root-task/src/net/* — consume bounded Ethernet-frame IPC from the GENET task while keeping smoltcp/listener semantics in root.
Commands:
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml
Checks:
  - GENET static IPv4 reachability is preserved, ring pressure is observable, and serial/HDMI remain responsive under wired load.
Deliverables:
  - First production dataplane driver task and preserved 26a static IPv4 behavior.

Compatibility baseline tasks below are retained because they describe the original 26a GENET/static-IPv4 behavior that must keep working. They do not close reopened 26a by themselves; closure now requires both the baseline behavior and the driver-task substrate/migration checks above.

Title/ID: m26a-bcmgenet-driver
Goal: Preserve HAL-declared Broadcom GENETv5 NIC behavior through the isolated Pi driver runtime.
Inputs: apps/root-task/src/net/*, apps/root-task/src/drivers/driver_task_net.rs, apps/pi4-driver-runtime/src/lib.rs, crates/pi4-driver-abi/src/lib.rs, apps/root-task/src/hal/*, docs/SECURITY.md, Linux `bcmgenet` + Linux `bcm2711` DT binding notes + U-Boot `bcmgenet` bring-up notes (reference-only).
Changes:
  - apps/root-task/src/drivers/driver_task_net.rs — keep root as the GENET ring client only and fail closed when isolated runtime owner-state proof is missing.
  - apps/pi4-driver-runtime/src/lib.rs — carry the GENETv5 register/ring/IRQ/PHY implementation inside the isolated `driver-genet` runtime with HAL-declared MMIO/IRQ/DMA/MDIO resources only.
  - apps/root-task/src/net/mod.rs + apps/root-task/src/net/stack.rs — backend selection and ring-client init wiring.
  - docs/ARCHITECTURE.md + docs/SECURITY.md — record GENET design-reference provenance and explicit no-code-lift policy.
Commands:
  - cargo check -p root-task
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib drivers::driver_task_net
  - cargo test -p pi4-driver-runtime
  - rg -n "EFI_|boot_services|runtime_services|uefi::" apps/root-task/src tools/coh-rtc/src
Checks:
  - Link-up, RX/TX smoke, and deterministic error paths are covered by unit/integration tests.
  - GENET hardware service remains in the isolated runtime with HAL-declared resources; root exposes only the bounded ring client.
Deliverables:
  - Pi 4 GENETv5 isolated runtime backend integrated behind existing net abstractions with documented source provenance order (Linux `bcmgenet` -> Linux `bcm2711` DT -> U-Boot `bcmgenet`) and reference-only compliance.

Title/ID: m26a-static-ipv4-profile-gate
Goal: Make Pi 4 U-Boot static IPv4 config manifest-authoritative and profile-gated.
Inputs: configs/root_task.toml, tools/coh-rtc, apps/root-task/src/generated, docs/INTERFACES.md.
Changes:
  - tools/coh-rtc/src/* — add IR fields + validation for `pi4-uboot-aarch64` static IPv4 network config.
  - apps/root-task/src/generated/* — regenerated network config outputs.
  - apps/root-task/src/net/mod.rs — consume generated profile config before dev-virt fallback defaults.
Commands:
  - cargo test -p coh-rtc
  - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json
Checks:
  - Invalid static IPv4 entries fail deterministically; valid configs produce stable generated artifacts.
Deliverables:
  - Manifest-driven static IPv4 for Pi 4 U-Boot profile with docs-as-built parity.

Title/ID: m26a-pi4-uboot-validation
Goal: Prove end-to-end TCP console reachability on Pi 4 using static IPv4 with no protocol drift.
Inputs: scripts/pi4-image-build.sh, docs/HARDWARE_BRINGUP.md, scripts/cohsh/boot_v0.coh.
Changes:
  - docs/HARDWARE_BRINGUP.md — Pi 4 checklist, expected boot lines, static IPv4 examples.
  - docs/ARCHITECTURE.md + docs/SECURITY.md — backend and threat-model updates.
Commands:
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml
  - cargo run -p cohsh --features tcp -- --transport tcp --tcp-host <STATIC_IP> --tcp-port 31337 --script scripts/cohsh/boot_v0.coh
Checks:
  - Validation includes a before/after proof: Milestone 26 no-NIC transcript and Milestone 26a NIC-enabled transcript for the same board profile family.
  - Console attach/tail/test flows are unchanged except for profile-gated backend/address selection.
Deliverables:
  - Reproducible Pi 4 U-Boot network bring-up evidence and updated docs.

Title/ID: m26a-nettest-profile-gate
Goal: Extend `nettest` so the same command works on QEMU `dev-virt` and Pi 4 static IPv4 without changing console grammar.
Inputs: apps/root-task/src/net/*, apps/root-task/src/event/mod.rs, docs/INTERFACES.md, docs/USERLAND_AND_CLI.md.
Changes:
  - apps/root-task/src/net/stack.rs — remove `dev-virt`-only assumptions from self-test target selection and bind probe/echo targets to the active profile-gated interface config (including Pi 4 static IPv4/gateway paths).
  - apps/root-task/src/net/mod.rs — expose deterministic nettest target/report fields required by both QEMU and Pi 4 backends.
  - apps/root-task/src/event/mod.rs — update `help`/`netstats` lines so `nettest` no longer appears `dev-virt`-only when built for Pi 4 profiles.
  - docs/INTERFACES.md + docs/USERLAND_AND_CLI.md — document backend-agnostic `nettest` behavior and expected output fields.
Commands:
  - cargo check -p root-task
  - cargo test -p root-task net:: -- --nocapture
  - scripts/cohesix-build-run.sh --no-run --cargo-target aarch64-unknown-none
Checks:
  - `nettest` remains unchanged for QEMU (`127.0.0.1:{31338,31339}` hostfwd workflows still valid).
  - Pi 4 static IPv4 profile can run `nettest` and produce deterministic pass/fail evidence with no new in-VM listeners.
  - ACK/ERR/END console grammar and existing command names remain unchanged.
Deliverables:
  - Single `nettest` path that is profile-gated by backend/address config and validated on both QEMU and Pi 4 static IPv4.

Title/ID: m26b-usb-hdmi-local-seat-liveness
Milestone: Milestone 26b — Pi 4 USB/Wi-Fi Driver Tasks + DHCP/Benchmark Concurrency / reopened USB/local-seat and HDMI liveness defect
Goal: Restore truthful and fluid physical Pi local-seat behavior during selected-network startup without changing console grammar, device authority, or Wi-Fi progress.
Inputs: crates/pi4-driver-abi/src/lib.rs, apps/pi4-driver-runtime/src/lib.rs, apps/root-task/src/{local_seat.rs,event/mod.rs,hal/driver_task.rs}, scripts/{pi4_trace_normalize.py,pi4_gate_proof.sh,pi4_serial_reboot.py}, tests/test_pi4_{trace_normalize,serial_reboot,gate_proof}.py, scripts/ci/check_driver_test_coverage.py, docs/{DRIVERS,HARDWARE_BRINGUP,TEST_PLAN,USERLAND_AND_CLI}.md, current Wi-Fi-selected Pi USB/HDMI evidence.
Changes:
  - crates/pi4-driver-abi/src/lib.rs — retain one fixed 48-byte, commit-last, role-qualified USB old-good record reservation in the existing ring gap. It remains pointer-free and has no admission, command, wake, retry, recovery, scheduling, ownership, or acceptance semantics; root may passively project the zero record for compatibility.
  - apps/pi4-driver-runtime/src/lib.rs — request a one-second HID idle report on the existing interrupt-IN lifetime so an unchanged keyboard establishes its safe attach baseline before the separate five-second liveness deadline, repeat only held arrow usages from the exported virtual counter and selected timer frequency, preserve make/release edges for every ordinary key, and render bounded one-row HDMI scroll steps without report-count timing or a second input/display owner. Remove the USB old-good partial/final publication state and hooks after fresh exact-image regressions at phases 198, 316, and 412, restoring the prior physical enumeration/one-deep queue path while preserving every Wi-Fi change.
  - apps/root-task/src/local_seat.rs — revoke stale prompt and console-ready presentation across attach/recovery boundaries, re-release the interactive HDMI prompt after current USB command admission and display health, re-admit the ready banner after current USB command admission, retain the canonical prompt/input row until its matching display completion, preserve FIFO output and the prompt backspace floor, and chase completed viewport state through bounded receipts. Retain the bounded canonical `[local-seat] usb keyboard command-ready action=enable-command-input ...` receipt exactly once in `queen.log`, keep its verbose counter detail log-only, and do not project either through a pre-cutover raw-UART path. Restore the known-working `2668c34f76ff` command/first-report path: keep PCIe descriptor/prep and owner registration followed by USB descriptor replay/runtime init and USB owner registration before enumeration, but remove the second post-completion descriptor/owner proof scheduler and its deferred endpoint/byte cache. Valid linked input follows the existing parser-admission path once and a valid first report follows the existing command-ready transition.
    HAL and gate acceptance ordinarily require current USB/PCIe owners and descriptors, Gate 10, the exact one-deep queue, and real HID/parser/HDMI liveness. The final `7a10b8fd6acc` record uses the explicit operator-approved passive local-seat exception documented in the milestone status and does not claim a fresh key byte. An ordinary pending enumeration retry retains the existing pre-prompt deferral, which grants no descriptor or owner proof authority.
  - apps/root-task/src/event/mod.rs — project passive bounded USB controller, keyboard-enumeration, and first-report startup feedback, and attribute USB/HDMI SMP activity to each manifest-selected runtime core while preserving `Dispatch -> Display -> Serial` priority and granting no USB or HDMI scheduling authority. EventPump is the sole serial projector for the canonical command-ready receipt and queues it exactly once immediately before `[drivers] USB console ready` through the existing HighImpact/EventPump path. Sustained status treats the single armed interrupt-IN transfer and a zero current no-reply streak as healthy, and uses current HDMI driver-task active authority instead of cumulative submitted/completed gaps. The existing passive `usb diag`/`usb status` and `smp activity` response paths project compact current USB/PCIe owner state and the reserved zero compatibility record through the linked serial owner; they must fit the bounded line/backlog contract and cannot issue, retry, wake, or authorize hardware.
  - apps/root-task/src/hal/driver_task.rs — bound the retained steady USB poll to its existing finite no-progress allowance, fail closed instead of retaining a permanently split submitted/completed request, and require a current live-complete keyboard probe rather than promoting cached readiness. Classify the existing `USB_RESET_DONE` progress edge as part of the already bounded extended controller-init/reset timeout so the following run-stage setup is not cut down to the generic three-resume allowance. Preserve an exact retained descriptor request as pending rather than projecting a terminal no-reply blocker; only its own replacement, timeout, typed fault, or fail-closed terminal may make it red. Expose one shared compact owner-state formatter sourced only from the current HAL registration and descriptor-seal truth so USB, PCIe, CYW43, SDIO, and GENET diagnostic receipts cannot drift.
  - scripts/pi4_gate_proof.sh + focused gate-proof fixtures — keep passive `usb status` as the default hardware-proof action, make active `usb probe-kbd` opt-in, and accept only current end-to-end input/display receipt evidence.
  - scripts/pi4_serial_reboot.py + focused helper fixtures — preserve one bounded contiguous serial stream across the `OK PING`/fresh-root-prompt read boundary so a prompt split after its first byte cannot cause a false timeout, while rejecting an interrupted or noncontiguous tail and retaining existing secret redaction. This host-only orchestration repair adds no target command, proof authority, retry, or acceptance inference.
  - scripts/pi4_trace_normalize.py + focused Python fixtures — preserve the existing machine-consumed `usb-console-command-ready` token and keep display projection non-authorizing; report a command-ready boot with no current accepted linked-runtime byte as `usb-physical-input-unproven`, and never infer first-byte evidence from Gate 10 or emit a `usb-post-first-byte-*` blocker before that byte exists. Validate the current one-deep interrupt-IN queue, current no-progress/no-reply state, all exact `hdmi:` completion rows, and current USB/PCIe descriptor/owner proof without treating historical cumulative counters or the dormant receipt as live work. A pending retained descriptor identity is nonterminal; missing, replaced, timed-out, or faulted current proof remains acceptance-red. Under the reopened Wi-Fi DPC closure, scope selected-interface state separately from component-local booleans and bind DPC acceptance to the exact accounting/scope/live-ring-truth triplet, with stale client samples classified as rerun-required rather than live-ring poison.
  - focused Rust tests + scripts/ci/check_driver_test_coverage.py + docs — cover readiness revocation/re-release and bounded startup feedback, map the new USB/HDMI/event/local-seat invariants to production-feature tests, and describe the as-built local-seat behavior.
  - complete host-tool compatibility review — verify `coh`, `cohsh`, `hive-gateway`, SwarmUI, `tools/cohesix-py`, and the performance benchmark scripts require no implementation, fixture, schema, or workload change because the repair alters only physical local-seat projection and preserves authenticated console, Secure9P, REST, and benchmark semantics.
Commands:
  - scripts/ci/test_plan_run.sh --list
  - cargo fmt --all -- --check
  - cargo test -p pi4-driver-runtime --lib usb_keyboard -- --test-threads=1
  - cargo test -p pi4-driver-runtime --lib hdmi_runtime -- --test-threads=1
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib local_seat::tests -- --test-threads=1
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests -- --test-threads=1
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib local_seat::tests::usb_command_ready_receipt_and_details_fit_bounded_log_records
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests::usb_console_ready_projects_canonical_receipt_once_and_first
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests::linked_usb_runtime_queue_fields_decode_first_report_telemetry
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests::hdmi_completion_status_uses_current_active_request_not_cumulative_gap -- --exact
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::driver_task::tests::usb_engine_init_controller_reset_stage_uses_extended_bounded_timeout
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::driver_task::tests::retained_usb_keyboard_poll_fails_closed_at_its_protocol_bound -- --exact
  - python3 -m pytest tests/test_pi4_trace_normalize.py tests/test_pi4_serial_reboot.py tests/test_pi4_gate_proof.py -k 'usb or hdmi or local_seat or wifi_diag_complete'
  - python3 scripts/ci/check_driver_test_coverage.py
  - scripts/ci/check_test_plan.sh
  - scripts/check-generated.sh
  - cargo check -p pi4-driver-runtime --target aarch64-unknown-none
  - SEL4_BUILD_DIR=seL4/build_UBOOT cargo check -p root-task --target aarch64-unknown-none --no-default-features --features release-pi4
Checks:
  - Ordinary keys emit once per make/release edge; only held arrows repeat, after a 300 ms initial delay and at 50 ms intervals scaled from `CNTVCT_EL0` and `TIMER_CLOCK_HZ`, and arrow escape bytes never enter the command parser.
  - HID setup requests an unchanged boot report every one second on the existing endpoint lifetime, so an idle keyboard can establish the attach baseline before the unchanged five-second exact-transfer failure deadline; no additional poll, retry, wakeup, fallback, or owner is introduced.
  - A retained steady USB poll cannot remain permanently split between submitted and completed state: the existing bounded no-progress allowance terminalizes it fail-closed, and cached keyboard readiness alone cannot promote a pending live probe to attached.
  - The restored `2668c34f76ff` local-seat path has no second descriptor/owner proof scheduler or deferred endpoint/byte cache after a linked completion. The established attach phase performs PCIe descriptor/prep and owner registration, then USB descriptor replay and runtime initialization; it registers the USB owner once controller init is ready, before enumeration. HAL/gate acceptance ordinarily fails closed without current USB/PCIe owner and descriptor proof, Gate 10, the exact one-deep queue, and real HID/parser/HDMI liveness. The dormant old-good receipt authorizes neither progress nor acceptance. Exact image `7a10b8fd6acc` closes only through the separately recorded operator-approved passive exception.
  - `USB_RESET_DONE` retains the existing bounded extended controller-init/reset allowance; it does not create a new timeout, retry, wake, owner, or unbounded lifetime.
  - The canonical command-ready receipt remains exactly once in `queen.log` and appears exactly once on serial immediately before `[drivers] USB console ready`; EventPump is the only serial projector. Before a current linked-runtime HID byte is accepted, the truthful state is `usb-physical-input-unproven`, with no post-first-byte failure classification.
  - Serial remains usable during USB startup; HDMI shows bounded passive startup feedback but no interactive prompt until current USB command readiness and display health both hold. The console-ready banner is re-admitted canonically only after current USB command readiness and becomes visible only through healthy display service. Attach/recovery revokes stale first-report, command, prompt, and ready-banner presentation, and only current-lifetime proof re-releases them.
  - An older HDMI completion cannot acknowledge a newer canonical input row or viewport request; FIFO output remains ordered, backspace cannot erase the prompt prefix, and rapid arrows advance one completed viewport row per bounded display turn without stale tails, full-screen blink, or unbounded queue growth.
  - Passive hardware proof never turns a diagnostic into USB authority: default helpers use `usb status`, an active keyboard probe is explicit, and USB/HDMI SMP accounting names each selected runtime core from current manifest truth.
  - USB remains the sole xHCI/HID owner and HDMI remains child-only. The reserved fixed USB evidence record changes no authority or command ABI semantics and runtime publication remains dormant; no parser command, `ACK`/`ERR`/`END`, network, REST, `cohsh`, or benchmark semantic changes occur.
  - The exact rebuilt image preserves Wi-Fi first-pair progress and repeatedly proves USB enumeration, Gate 10, the one-deep idle-report queue, command readiness, zero current recovery/no-reply debt, and bounded HDMI completion under selected-network load. No fresh key was typed on `7a10b8fd6acc`; the closure record therefore makes no first-byte, printable-byte, arrow-history, or visible-key-echo claim.
  - Matrix closure ordinarily includes one same-image functional local-seat anchor captured after `usb diag` is armed, plus passive current owner/one-deep-queue/HDMI sentinels on each network-repeatability reboot. For `7a10b8fd6acc`, the operator explicitly accepted the passive sentinels and exact known-working-path restoration without a fresh anchor; this exception is image-specific and cannot be reused after changing the physical USB path.
Deliverables: Focused source/tests/docs repair, warning-free Pi target builds, exact rebuilt image, and the operator-approved same-image USB/HDMI evidence recorded above.

Title/ID: m26b-usb-driver-task
Goal: Move Pi 4 xHCI/HID keyboard service behind the realtime USB driver-task contract.
Inputs: apps/root-task/src/local_seat.rs, apps/pi4-driver-runtime/src/lib.rs, crates/pi4-driver-abi/src/lib.rs, apps/root-task/src/event/*, scripts/pi4_trace_normalize.py, tests/test_pi4_trace_normalize.py, docs/DRIVERS.md.
Changes:
  - apps/root-task/src/local_seat.rs — route local-seat keyboard-byte consumption through the isolated `driver-usb` runtime.
  - apps/pi4-driver-runtime/src/lib.rs — own the direct-root-port xHCI command/event/EP0/interrupt-IN rings, root-port reset, slot/address/configuration, HID boot-protocol setup, and DMA report polling in the isolated USB runtime.
  - apps/root-task/src/local_seat.rs — keep root-task as a ring-client/prompt consumer only; no root-owned USB implementation crate remains.
  - apps/root-task/src/event/* — consume bounded local-seat byte events and preserve USB priority over serial dispatch and all network work.
Commands:
  - cargo test -p pi4-driver-runtime --lib -- --test-threads=1
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib local_seat::tests
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests
Checks:
  - USB first-byte and first-printable-byte proof remain Gate 10.
  - Fast typing remains fluid while network data queues are saturated.
Deliverables:
  - Isolated USB keyboard task path with existing local-seat console semantics preserved.

Title/ID: m26b-wifi-driver-task
Goal: Move CYW43/SDIO Wi-Fi service behind a dedicated driver task with bounded control/data budgets.
Inputs: apps/root-task/src/drivers/driver_task_net.rs, apps/root-task/src/hal/pi4_wifi.rs, apps/root-task/src/hal/driver_task.rs, apps/pi4-driver-runtime/src/lib.rs, crates/pi4-driver-abi/src/lib.rs, apps/root-task/src/net/*, scripts/pi4_trace_normalize.py, scripts/pi4_compare_driver_models.py, tests/test_pi4_trace_normalize.py, tests/test_pi4_compare_driver_models.py, docs/DRIVERS.md.
Changes:
  - apps/root-task/src/hal/pi4_wifi.rs — grant only SDIO, fixed Pi 4 WL_ON power/reset, firmware-bundle, IRQ/OOB, and DMA/ring resources declared for `driver-wifi`; `sdio-host` owns the noncontiguous firmware-mailbox page, a channel-bounded BCM2835 DMA-controller mapping, one private low request page, one low control-block page, and eight low CMD53 bounce pages after a one-way root bootstrap handoff.
  - apps/root-task/src/drivers/driver_task_net.rs — keep root as the CYW43 ring client only and fail closed when isolated SDIO/CYW43 service has not returned owner progress; retain immutable firmware/control context for a complete pair replay after a partially issued bootstrap.
  - crates/pi4-driver-abi/src/lib.rs + apps/pi4-driver-runtime/src/lib.rs — define fixed-layout SDIO CMD52/CMD53/POLL_IRQ plus atomic card-reset/pending-generation/commit command records and service them in the isolated SDIO runtime as the bus-owner ABI that CYW43 must use. Function enable and ALP acquisition use elapsed virtual-counter deadlines and Linux-compatible default windows rather than CPU-speed spin timing.
  - apps/root-task/src/net/* + apps/root-task/src/userland/mod.rs + apps/root-task/src/event/mod.rs — consume bounded Ethernet-frame IPC without changing authenticated TCP console semantics; publish serial/local-seat first and run exactly one outer CYW43 boot episode as `attempt=1`, with no automatic whole-bootstrap backoff, reset, or attempt 2. Before the unique service-ready terminal, an uncertain exact owner may be drained and fenced but cannot restart the physical pair or renew the absolute Gate 8 deadline. Exact service readiness alone admits one later consumed-once runtime pair repair; restored service publishes `CYW43_RUNTIME_RECOVERY`, never a second bootstrap Ready. Gate-local association, DHCP, and protocol retries remain independently bounded.
Commands:
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::pi4_wifi
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib net::
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml
Checks:
  - Wi-Fi control progress yields on budget exhaustion instead of spinning.
  - Root accepts smoltcp TX tokens into the bounded queue without mirroring firmware credit. The CYW43 runtime alone admits physical issue while its SDPCM window is open and retains the exact op7 in `WAIT_CREDIT` without a root spin or second completion boundary when it is not.
  - Runtime CYW43 TX staging lets smoltcp fill the bounded SDPCM/BDC transmit frame directly instead of copying through an extra stack frame buffer.
  - CYW43 startup does not write `bus:rxglom=0` before `event_msgs_ext`/`WLC_UP`; aggregated RX is bounded, counted, and recoverable inside the Wi-Fi driver task.
  - A transient startup fault cannot kill the physical-Pi boot or operator surfaces. A terminal boot failure quarantines network service for that boot, reports the typed cause, and returns to the ordinary EventPump with serial, local-seat, HDMI diagnostics, authentication, and reboot live. There is no automatic second whole-bootstrap attempt.
Deliverables:
  - CYW43/SDIO driver task that can make Wi-Fi progress without stealing root-task USB/serial turns.

Title/ID: m26b-sdio-host-driver-task-graduation
Goal: Graduate standalone SDIO host service from diagnostic runtime to 26b acceptance-eligible driver task.
Inputs: configs/root_task*.toml, apps/root-task/src/hal/{mod.rs,driver_task.rs,pi4_wifi.rs}, apps/pi4-driver-runtime/src/lib.rs, crates/pi4-driver-abi/src/lib.rs, scripts/pi4_gate_proof.sh, scripts/pi4_trace_normalize.py, docs/DRIVERS.md, docs/TEST_PLAN.md.
Changes:
  - configs/root_task*.toml + generated manifest artifacts — declare `sdio-host` with one HAL-declared SDHCI MMIO page, one firmware-mailbox page, one channel-bounded BCM2835 DMA-controller page, ten private DMA pages, the shared budget, and `hardware_state_migrated=true`.
  - apps/root-task/src/hal/* — map SDHCI into the SDIO isolated runtime resource set, keep runtime commands pointer-free, and register `sdio-host` owner-state only after non-root-context CMD52/CMD53/POLL_IRQ hardware progress.
  - scripts/pi4_gate_proof.sh + scripts/pi4_trace_normalize.py — require SDIO dedicated-role and owner-state evidence as part of reopened 26a/26b Pi 4 acceptance.
  - docs/BUILD_PLAN.md + docs/DRIVERS.md + docs/TEST_PLAN.md + docs/HARDWARE_BRINGUP.md — record SDIO as a 26b acceptance hot path rather than a future diagnostic guard.
Commands:
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::driver_task
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::pi4_wifi
  - cargo test -p pi4-driver-runtime
  - python3 -m pytest -q tests/test_pi4_gate_proof.py tests/test_pi4_trace_normalize.py
  - scripts/check-generated.sh
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml
Checks:
  - Generated Pi 4 specs report `sdio-host root_context_required=false hardware_state_migrated=true mmio_pages=3 dma_pages=10`.
  - `scripts/pi4_gate_proof.sh --require-driver-task-proof` requires `DRIVER_TASK_SDIO_DEDICATED=yes` and a `DRIVER_TASK_OWNER_STATE ... hot_path=sdio-host ... root_pointer=no` descriptor.
  - SDIO production ring commands do not carry `DRIVER_TASK_RING_FLAG_ROOT_CONTEXT_NON_ACCEPTANCE`; root-context diagnostic turns remain explicitly non-acceptance.
Deliverables:
  - SDIO runtime acceptance promotion with generated, code, proof-gate, and docs-as-built alignment.

Title/ID: m26b-wifi-sdio-notification-dpc-closure
Goal: Restore the original 26b root-no-wait CYW43/SDIO contract with one durable persistent op11 transaction, one typed intake-sealed Host-EAPOL finite-op7 key-response transaction, one generation-long post-release DPC activation, a disjoint commit-last sideband RX/ACK handoff, a generated reciprocal notification topology, one bounded event-sequence DPC lease from the first post-release event through steady service, and fault-only deadline containment that cannot become a traffic scheduler.
Inputs: configs/root_task*.toml, tools/coh-rtc/src/{ir.rs,codegen/**}, apps/root-task/src/generated/**, crates/pi4-driver-abi/src/lib.rs, apps/root-task/src/{drivers/driver_task_net.rs,event/mod.rs,hal/{mod.rs,driver_task.rs}}, apps/pi4-driver-runtime/src/lib.rs, scripts/{pi4_trace_normalize.py,pi4_gate_proof.sh,pi4_serial_reboot.py}, scripts/ci/check_driver_test_coverage.py, tests/test_pi4_{trace_normalize,serial_reboot}.py, docs/{DRIVERS,HARDWARE_BRINGUP,TEST_PLAN}.md, fresh Pi serial/pcap evidence gathered during Milestone 26d.
Changes:
  - The generated reciprocal topology gives SDIO sole physical issue/IRQ ownership and CYW43 sole protocol/DPC ownership. Root is a bounded ring client. Sequence-last records bind each command, completion, RX batch, ACK and continuation to the exact physical epoch, generation and consumer sequence; badges supply wake hints only.
  - Persistent op11 crosses one HAL admission, commit and signal and remains owned until terminal. Finite urgent Host-EAPOL op7 uses a typed intake seal and the existing four-operation parent. Missing or competing seals return typed zero-I/O terminals. Other foreground work retains its exact grant/endpoint contract; no second root grant or independent issuer advances a persistent child.
  - Generation-long post-release DPC service retains software-pending work and wire order. Private phases run to bounded quiescence; exact child, credit, queue and peer waits block immediately after the final durable-state recheck. Coalesced notifications neither lose retained work nor authorize new work. Terminal IRQ closure, empty-ring rearm and disjoint commit-last RX/ACK handoff retain the accepted owner lifetime.
  - One no-allocation bootstrap/recovery supervisor owns the outer boot episode, initial physical pair and every later whole-pair recovery. Recovery records retain both current recovery and unresolved-action owner generations. Steady service cannot clear sticky failure, revive an old generation or become a deadline/hintless recovery scheduler.
  - TX submission is queue-only. The generation-scoped two-class queue has aggregate capacity 16; urgent/control traffic precedes bulk without changing admitted op7 cadence. An issued owner retires before promotion, committed RX has priority, joined Function-2 completion releases the root parent, and SDPCM tx_max remains runtime admission. Current causal PTK successors and reserved response space survive bounded rotation without another issuer.
  - Join keeps logical connection identity separate from physical bus epochs and retains its outer lease across named waits. EAPOL M2/M4/group-key replies use the sealed finite parent; pending CARD_INT cannot reject an already sealed data write. Accepted timing, register order, retries, fairness, pair restart, DHCP and local-seat contracts remain owned by the detailed checks and DRIVERS.md.
  - Non-authoritative diagnostics distinguish active owner state from stale compatibility snapshots. Current acceptance requires ABI v8 sealed-owner proof and exact nonzero diagnostic/pair/generation identity; older trace formats remain readable historical evidence. Counter normalization and gate validation reject missing, mixed, stale or poisoned ownership evidence.
  - Host tools, Python, SwarmUI, generated consumers and raw/REST benchmarks retain their public grammar, authority and workload contracts. Only affected diagnostic/proof readers track the versioned records. Exact-image multi-boot transport and unchanged USB/serial/HDMI evidence remain separate from pure-contract or source checks.
Commands:
  - cargo test -p coh-rtc
  - cargo test -p pi4-driver-abi
  - cargo test -p pi4-driver-runtime
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::driver_task
  - cargo test -p pi4-driver-abi cyw43_dpc_client_layout_is_bounded_and_sequence_last
  - cargo test -p pi4-driver-runtime cyw43_dpc_client_record_is_current_sequence_last_and_passive
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::driver_task::tests::cyw43_dpc_client_reader_is_stable_passive_and_sequence_last
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests::wifi_diag_authority_lines_fit_the_untruncated_console_budget
  - python3 -m pytest -q tests/test_pi4_wifi_repeatability.py tests/test_pi4_trace_normalize.py
  - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json
  - scripts/check-generated.sh
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml
Checks:
  - The current DPC-client record is exactly 128 bytes, 64-byte aligned at offset 49,984, ends at 50,112 without overlap, commits the nonzero publication sequence last, and is read only as one passive `ring -> record -> ring` snapshot. Exact physical epoch and live consumer sequence are mandatory; transient staleness requests a bounded rerun and never becomes recovery or owner authority.
  - Retained Gate 7 and current Gate 8 proof share one exact nonzero diagnostic id, pair, and generation between matching `diag_begin` and `diag_complete` records. Any clipped proof may be recovered only from that current terminal identity; malformed or cross-transaction evidence revokes acceptance.
  - HAL does not release an exact op11 at raw ring observation. It replaces the cleared active request with a sequence-last semantic-terminal receipt binding request, command fingerprint, logical `aux1`, and physical pair epoch. That receipt and the logical owner remain authoritative until the canonical consumer commits the copied or routed body and the complete outer policy turn compare-clears them. An interleaved physical terminal clears only its receipt and preserves the logical op11 owner; dropped, uncommitted, mismatched, or orphaned retirement authority fails closed through the existing pair-recovery lane.
  - Focused production-path root/HAL coverage proves healthy logical terminal retirement, interleaved physical-only retirement, recovery becoming sticky before canonical consumption, and successor fencing when an outer-turn finalizer is omitted. Construction-level raw-token-drop coverage proves that uncommitted authority fails closed; receipt matching separately proves every exact identity field gates release. Claims about duplicate or mismatch behavior require a production-reachable receipt test before publication.
  - EventPump derives one immutable canonical-owner snapshot and one combined service-routing snapshot per active outer policy turn, so repeated scheduling questions do not reconstruct staged WiFi payload identity or stable-read the same op7/op8/op11 and DPC state. Both snapshots are typed hints only: final consumer/HAL admission revalidate exact state, while the explicit before-sleep boundary double-samples a narrow current-lifetime and durable-level cut and HAL rechecks the active parent's sequence-last completion or op8 grant. Fresh DPC/runtime/root RX, control, requestless policy, or exact-parent progress overrides an idle same-turn routing hint; a merely waiting parent masks identity-only policy levels plus retained TCP flush, console, and ICMP demand and cannot hot-run, while independent committed driver progress still resumes the same episode. The finalizer invalidates both hints, outside-turn diagnostics bypass them, and no hint can issue, complete, retire, recover, or create notification-history authority.
  - Generation vocabulary is explicit throughout these checks: a root/CYW43 parent generation is logical connection identity, while a DPC ring generation is the generated physical bus-link epoch. Phrases such as `same-generation DPC ring` mean the same physical bus-link epoch and never authorize comparing it with parent `aux1`.
  - Generated topology contains exactly one SDIO physical owner for level-triggered SDHCI IRQ 158 and DMA channel-4 IRQ 116 plus one reciprocal `cyw43-sdio` link with bounded notification slots and four-entry event ring; malformed, split-owner, overlapping, unbounded, or unknown topology fails validation. PIO reaches one terminal from its SDHCI/host conditions with zero DMA use; external DMA joins the two IRQ results into one terminal for the immutable request in either arrival order.
  - A condition-first SDIO terminal cannot retire its cursor before the sole owner has closed the matching IRQ158 episode: request-owned residual bits are W1C/read-back exact, any visible or crossing `CARD_INT` is committed before exact handler ACK, otherwise crossing-safe rearm completes before the child terminal. An external-DMA terminal also joins exact IRQ116 ACK. Intake-sealed and active one-way children emit zero event/IRQ peer hints before completion commit and exactly one generic hint after sequence-last terminal; failed commit emits zero, while a standalone idle crossing emits one immediate post-event hint. The final valid-empty-ring/masked-`CARD_INT` level is serviced without a queued command and cannot require notification history.
  - Healthy current-physical-epoch activation is reused across the full control lifetime: only an explicitly owner-active, empty, unmasked ring reaches the Function-2 fence without a `DPC_ACTIVATE` child, while one visible front event is bound by exact sequence until its durable consumed watermark and later events cannot starve TX. Only when activation/mask state is absent or skewed may the physical-generation-bound Join source probe be admitted; if one IRQ158 ACK epoch becomes pending after its exact frontier is submitted, that same probe ACKs the epoch, commits cleared health, and reconciles state with zero SDHCI command issue before the parent continues. Removing or mutating the exact frontier, losing or replacing a bound event without consumed proof, wrong physical generation, absent owner-active proof, owner poison, invalid/poisoned/overrun ring, partial marker, and every non-activation child under the same unhealthy condition remain rejected. A failed final idle rearm records `DRIVER_RUNTIME_REJECT_SDIO_DPC_SOURCE_REARM_FAILED` rather than allowing the next child to appear marker-invalid.
  - Root never waits synchronously on SDIO credit, CMD52/CMD53, firmware replies, or glom work; durable DPC/transaction progress remains inside the isolated SDIO/CYW43 runtimes, notifications remain hints only, and pointer-free active-slot bounds hold. A stable `Waiting` result for the exact issued persistent op11 suppresses only that parent's root self-demand; independent committed DPC/RX work and `TerminalVisible` cannot be masked.
  - Driver-runtime ABI v8 wait-receipt tests prove exact offset 40, exact 24-byte size and distinct magic; logical generation zero; body clean/barrier and commit-last publication; a producer-monotonic nonzero epoch with overflow failure; root stable double-read; and rejection of torn, stale, wrong-request, wrong-fingerprint, wrong-generation, wrong-epoch, or wrong-commit state. Production composition crosses `Stage -> CommitRing -> Issued`, exactly one signal, prompt same-parent re-admission through Open and bounded Closing, exact receipt or terminal, ordinary park, later exact-terminal resume, semantic consumption, and deterministic lease release. It covers Stage clearing, changed-condition clearing, terminal-before-receipt, terminal-after-receipt, publish/clear failure, clear-before-wake interpretation, and proves receipt and terminal are alternative handoff proofs rather than simultaneous authority. It admits no second request, grant, signal, issue, rescue wake, unrelated NIC owner, idle policy gap, or duplicate path.
  - Driver-runtime ABI v7 placed the 128-byte episode ledger exactly at shared offset 49,344 with its publication sequence committed in the final word; ABI v8 retains that ledger unchanged and non-authoritative. Stable, staged, torn, stale-version, wrong-sequence, overlapping foreground/DPC, PIO, DMA, queue-only-op8, prewait, fairness, first-fault-dominant, reset, transaction-clear, and pair-scrub tests preserve one diagnostic identity without changing any command, notification, operation, retry, deadline, recovery, or queue count. The exact child descriptor records its selected PIO/DMA and required IRQ contract while the child-terminal flag distinguishes an expected active contract from a completed owner join. A condition changed across passive publication prevents sleep, and completion signalling precedes diagnostic work. Root rejects unstable records and emits at most one bounded `CYW43_BUS_EPISODE` line per `wifi diag`; current trace/gate fixtures require descriptor version 8 and reject version 7 or earlier as historical-only evidence.
  - An accepted normal exact `SteadyLease` completion releases the old global child before one bounded deterministic private `FifoWindow` `AdvanceState` transition may claim and publish exactly one successor. That CYW43 call returns at the successor's external child wait and performs no physical issue. Focused coverage compositionally proves the old terminal mailbox is stable-read into its immutable accepted CYW43 trace entry before coherent successor staging reuses the sequential mailbox, and `OrdinaryContinuation`, `RxQuantumBoundary`, `RxQueueWait`, `RecoverySettle`, `CompleteEvent`, `DeferredOwner`, contained or fatal fault, malformed identity, issued-unknown, quarantine, and recovery produce no same-call successor. The one-child-at-a-time invariant, later SDIO-only issue, foreground fairness, and zero new poll, signal, priority, EventPump, GENET, or authority behavior remain explicit.
  - The production reciprocal ring has one CYW43 producer and one SDIO physical owner. Non-op11 foreground commands preserve their exact endpoint/grant cadence. The finite urgent-op7 lease preserves its identity and budget, while its current durable condition decides the handoff: deterministic private phases continue even on an equal snapshot, and an exact child, credit, queue, or peer wait blocks immediately even when newly observed. An exact op11 crosses one sequence-last parent commit and exactly one root notification, stays `Issued` through every completion miss, and reaches one terminal with zero recurrent root grants or notification signals. Interleaved EVENT/DATA is delivered through the committed sideband batch plus exact disjoint ACK without completing or republishing op11. Each derived SDIO child carries the paired persistent marker and reaches its terminal under the sole SDIO owner with zero delegated grants. The one post-release activation remains valid for the physical generation; ordinary controls do not manufacture a new activation child. Before every persistent Function-2 child issues, the same owner proves a healthy empty same-generation DPC ring and physical `CARD_INT` enable; masked-empty state is rearmed and durably committed, pending source work defers without issue, and health or ACK debt fails closed. The final ring/register/source sample is the issue linearization point for both PIO and DMA. A committed sequence-last SDIO command always reaches matching owner dispatch; a missing or competing seal produces a typed zero-I/O terminal rather than disappearing as no intake. From the first post-release DPC event, the separate event-sequence steady lease is the only production DPC child mode and never falls back to ordinary recurrent grants based on Gate 8 state. Each immutable hardware request issues at most once; bounded condition-driven private progress may traverse consecutive owner-loop iterations to quiescence without a yield, while SDIO alone preserves one live joined-hardware sample after a changed steady cursor before blocking. Its final idle boundary rechecks the ring-only one-way intake, and a fresh command re-enters arbitration without another signal. Non-CYW43 retained endpoints cannot substitute for any boundary. The RX handoff above the CYW43 runtime is batch-shaped: a full 256-frame software backlog requires 32 committed eight-frame parents rather than 256 per-frame root grants, terminals, or notification signals. Current flags and pending state, not historical `ack_failures`, decide admission; DPC overrun and ACK-attempt counters are scoped to the current physical pair and reset on pair replacement. Every blockable active SDIO phase publishes its exact physical-lifetime counter deadline, including pre-issue inhibit/status-clear; containment clock settle publishes the earlier settle/overall expiry. Phase progress refreshes or clears the arm, terminal/reset clears it before publication, ordinary service records no hint, and an unchanged expired arm permits at most one root-to-CYW43-to-SDIO fault hint before SDIO alone terminalizes or contains it. EventPump/NetStack have no private Wi-Fi EAPOL, pre-root, tail-ingest, TCP-flush, hot-dispatch, or device-operation burst; stale completions and issued-unknown actions cannot mutate or replay into a replacement generation.
  - Real production-chain tests drive an exact op11 through one HAL admission with zero root continuation-grant publications, prove there is no grant 19 or second root notification after the `PreTxDrain -> WaitCredit` transition, and then drive its marker-paired cached-window F2 child to one terminal with no delegated grant. Focused scheduler coverage proves an owner-active healthy physical epoch reaches `PreTxDrain` without a `DPC_ACTIVATE` child; a committed front event binds exactly one attempt-scoped sequence, services that event through canonical DPC from `PreTxDpcProbe` without another wake, and advances after durable consumed proof even if a later event is queued. Wrapped sequence zero remains valid, and a missing or replaced bound event quarantines rather than creating activation work. Equal snapshots in deterministic private phases still route to `ContinueToQuiescence`, while exact child, credit, queue, and peer waits route to `WaitForWake` regardless of snapshot novelty; SDIO steady coverage separately preserves one changed-cursor live joined-hardware sample before blocking. A separate masked/ACK-pending production-chain test drives one marked logical-generation-zero persistent op11 through the retained `DPC_ACTIVATE` repair state machine, production SDIO intake and owner dispatch, a sequence-last terminal commit, a coalesced notification, and hintless exact-parent replay. The healthy control-lifetime composition then reuses the independent physical epoch, canonically consumes an owner-published source event, issues one persistent Function-2 TX child with exact terminal replay and no continuation grant, takes modeled IRQ158/CARD_INT capture through durable publication and Function-2 RX, publishes the control queue, and completes from the matching CONTROL reply. That Function-2 child must inherit the pre-TX arm fence even when its parent control flags are zero. Focused PIO and external-DMA tests prove masked-empty rearm and committed owner-active unmasked health before one command; existing-event and physical-source crossings produce a typed zero-I/O defer; event-plus-unmasked, ACK debt, bad epoch, absent activation, poison, and enable mismatch fail closed without command or DMA. Seal-conflict coverage proves an already committed command reaches a typed zero-I/O busy/missing-seal terminal and cannot be discarded as no intake. Tests separately exercise persistent op11 at logical generation zero and nonzero generations against a different physical epoch, prove parent `aux1` remains logical while every physical child uses the physical epoch, root masking for exact persistent-op11 `Waiting` without masking independent DPC/RX/sideband/deadline or `TerminalVisible`, the first post-release DPC event selecting the exact event lease before Gate 8 with no continuation grant, a PIO child terminalizing from IRQ158/host state with zero DMA use, external-DMA children joining IRQ158/IRQ116 in both arrival orders, an immediate terminal committed just before sleep, and missing, coalesced, and repeated notification hints. The idle-owner test commits a fresh ring-only one-way child after the earlier intake sample and requires the final sequence-last command-ring check to re-enter arbitration without another hint. Ordinary post-TX `WaitReply` must block because its current durable condition is an external peer wait, regardless of whether that condition was just observed, resume only for real CARD_INT/DPC/RX/credit/child-terminal progress, and record zero forced source probes or ordinary-traffic deadline hints. Production-reachable dependency tests retain a real op11 in `WaitReply` and a tagged no-credit op7 in `WAIT_CREDIT`, publish a current-physical-epoch DPC event after the original foreground watermark, and prove current durable state preflights that event despite a coalesced hint; the same sealed op7 then reaches its exact Function-2 child without a root or delegated continuation grant. The finite urgent-op7 lease and every non-op11 foreground retained grant cadence, including non-op11 bootstrap/recovery, receive regression coverage. Further production-chain coverage drives normal control and EAPOL TX through one cached-window F2 child, a genuine cold-window miss through exactly LOW/MID/HIGH/F2 with no steady-state IORx child, the 20-command post-F2 release culminating in the generation's one real DPC activation, and one physical DPC RX episode into the committed queue/batch handoff. The eight-frame case produces one immutable op8 parent and one terminal, survives missing/coalesced/repeated hints, and rejects torn queue/batch commits, stale logical or physical generation, mismatched queue commit or parent sequence, invalid entry bounds, and an authority-bearing header change during copy; a change confined to the passive packed timing word instead preserves the payload and exact ACK while degrading both timing halves to UNKNOWN. The same batch under active op11 must be nonterminal, deliver once, and advance only after the exact disjoint ACK commits last. A failed IRQ ACK followed by exact recovery clears current authority flags while retaining per-pair history and healthy admission. Deadline-arm tests cover phase selection for every timed autonomous owner wait, exact pre-issue inhibit and status-clear expiry publication, earlier settle/overall containment selection, body-before-commit, clear-before-terminal/reset, fail-closed handling when a blockable phase lacks a counter deadline, one stable-expired root-to-CYW43-to-SDIO hint, terminal-before-deadline, and zero ordinary-traffic hints. Reapplying one event's immutable frame hint, fabricating mailbox readiness or a terminal stream, substituting generic card commands for CMD52, or directly completing DPC activation fails this coverage.
  - Diagnostic split tests prove v3 size/offset/version stability, raw-zero and modulo-wrap handling, Q11 floor/saturation, first-`CHANNEL_DATA` selection after an EVENT, post-queue-commit admission stamping, physical-slot reorder/clear, stable-copy coverage, and sequence-last publication. They also prove body validity ignores the passive word and a timing-only stable-sample mismatch yields `0xffff/0xffff` without batch rejection or recovery. Every split field's leading `n` remains visible coverage but may legitimately be below `rx2a_mod32 n`, because only the first DATA entry in a batch carries the packed word; each missing, saturated, or invalid sample is individually UNKNOWN. The bottleneck decision is complete only when the valid same-sample `slow.total` equals `rx2a_mod32.max`; if `slow.total` is smaller, the worst sample remains UNKNOWN. The `slow=<total>/<s2q>/<q2p>/<p2r>/<r2a>` tuple must come from that single valid sample rather than mixing independent per-stage maxima.
  - The retained supervisor remains live after initial network attachment and deterministically owns every sticky pair, generation, association, EAPOL, and data recovery. Steady paths publish only an immutable recovery record that binds both the current recovery generation and the unresolved action's owner generation, then perform lock-free admission fencing. A logical association-epoch change or pair-restart signal while an op11 join cursor is unresolved retains that cursor's original owner generation and exact descriptor, payload digest, and ticket under the current recovery generation; it cannot collapse the cursor into an empty pair signal. After guards unwind, the supervisor alone clears retained session state and poisons the current generation. The sole outer boot episode is always `attempt=1`, admits one initial physical pair, and has zero pre-service pair-repair budget. Gate-local association, DHCP, and protocol retries remain bounded inside their owning gates, while Gate 8 commit, DHCP, and listener admission share the original absolute deadline. A pre-service physical fault drains/fences ownership and terminates/quarantines instead of opening pair 2. Exact service readiness alone admits one later consumed-once runtime repair; duplicate Ready cannot replenish it, and restored new-generation service uses `CYW43_RUNTIME_RECOVERY` before one later episode can be re-armed. Gate 10 remains downstream acceptance proof, not recovery authority. A lease conflict before issue that changed no scheduler state fails locally, while issued or scheduler-mutating uncertainty requires the bounded runtime repair. Duplicate current records coalesce, stale records cannot mask current faults, and neither can relock a steady session, replay a child operation, or mutate a replacement generation. Terminal boot failure quarantines network service and returns to ordinary operator service; recovery fencing never prevents independent linked serial, buffered local-seat input, HDMI status, timer/IPC, authentication, diagnostics, or reboot dispatch from remaining bounded and available.
  - Host tests execute the production descriptor-validation and SDHCI owner-transfer path through an injected deterministic controller model; cut every whole action in the production pair-restart schedule with stateful register/resume/ready/descriptor/engine transitions; inject each modeled CARD_INT and notification/IRQ substep plus persistent outer-suspend and CARD_INT-mask failures; and prove continuously reasserted CARD_INT remains bounded without weakening quarantine or issued-unknown ownership.
  - Fresh repeated Wi-Fi boots show no `DRIVER_TASK_NOTIFICATION_BIND_DEFERRED`, no DPC-ring overrun/drop, no IRQ-ACK failure, `sdio_deadline_hints=0` during ordinary traffic, ordered control/event/data delivery, working DHCP/TCP/cohsh, and unchanged serial/USB/local-seat gates. Per-pair counters are evaluated separately for every physical lifetime and must not be stitched across a restart.
Deliverables:
  - Generated reciprocal CYW43/SDIO notification contract, typed persistent op11 parent/child ABI, typed commit-last wait receipt, fixed bounded DPC event-ring ABI, diagnostic-only scrub-surviving episode ledger, isolated-runtime implementation, deterministic offline fault/schedule coverage, exact-image repeatability gate, docs-as-built alignment, and repeatable Wi-Fi TCP evidence.

Title/ID: m26b-net-control-priority
Goal: Split network-control and network-data work so EAPOL/DHCP/TCP ACK progress is prioritized without starving physical input.
Inputs: apps/root-task/src/net/*, apps/root-task/src/drivers/driver_task_net.rs, apps/pi4-driver-runtime/src/lib.rs, apps/root-task/src/event/*.
Changes:
  - apps/root-task/src/net/* — add diagnostics and scheduling hooks for network-control vs network-data service classes.
  - apps/root-task/src/drivers/driver_task_net.rs + apps/pi4-driver-runtime/src/lib.rs — expose ring-client/runtime counters for EAPOL/DHCP/control progress and bulk RX/TX data. Admit CYW43 stack output through one generation-scoped bounded aggregate of 16 immutable frames, represented as urgent-control and bulk FIFO classes but feeding the sole active op7 owner. ARP, EAPOL, DHCP, TCP SYN/FIN/RST, payload-free TCP control frames, and any copied-RX paired response are urgent; other payload-bearing TCP and fragmented or ordinary data remain bulk; FIFO order is preserved within each class. Ordinary TxTokens reserve at most 15 aggregate slots; a TxToken paired with copied RX may reserve the final slot before RX dequeue, and consumption remains queue-only. EventPump is the sole production TX coordinator. An exact retained foreign HAL descriptor, including NetData op8, is non-revocable and keeps op7 queued/requestless without spending TX budget, deadline, or recovery. An already-started op7 remains exact and advances to its terminal. Before promoting a fresh or requestless op7, however, one committed copied/DPC/runtime RX level receives the next bounded drain/op8 turn so an immediate peer reply cannot sit behind a later DHCP or TCP retransmit. At full capacity, promotion removes one eligible head and restores a paired slot before its one advance. A terminal never promotes a successor; that frame remains queued for a later EventPump coordinator turn. `Device::receive` and reservation failure do not service TX. Promotion starts the sole op7 lifetime without a root-owned predecessor-credit gate. The runtime alone owns `sdpcm_seq` and the dongle-advertised `tx_max` admission window; an exhausted window retains the same op7 in `WAIT_CREDIT` until DPC commits a newer window. The exact joined Function-2 terminal releases the root frame and may advance its ordered logical continuation without a later RX acknowledgement. A stable committed terminal wins before lifetime policy; a terminal-absent `Waiting` op7 remains retained only while its exact generation, pair epoch, and physical-lifetime epoch are current, and an invalidated lifetime enters the sole pair-recovery lane without replay. Generation/reset purges never-issued queued frames, while an issued or otherwise ambiguous active op7 deadline remains fail-closed; GENET is excluded.
  - apps/root-task/src/event/* — preserve actual serial/local-seat input and physical-response priority before either network class. For selected CYW43 only, a complete command belonging to the exact active authenticated connection may end its Network quantum and use the next existing hardware-free `Dispatch` turn before passive USB service debt. Its response advances only through the existing bounded connection-owned flush cursor; after any exact retained parent receives its current already-admitted turn, cursor completion hands passive USB debt the ordinary `Serial -> LocalSeat -> Dispatch` rotation before another buffered command. GENET and unauthenticated, stale-connection, physical-input, or response-tail cases retain the ordinary phase rotation.
  - Cross-task boundary (`m26b-net-control-priority` with `m26b-wifi-sdio-notification-dpc-closure`) — the root rule that an op7 terminal cannot promote a queued successor is unchanged. The only same-call continuation is inside one already-admitted CYW43 DPC runtime invocation after a normal exact `SteadyLease` child terminal: one bounded deterministic private `FifoWindow` `AdvanceState` transition may publish at most one next DPC child, which SDIO can issue only on its own later owner turn. `OrdinaryContinuation`, `RxQuantumBoundary`, `RxQueueWait`, `RecoverySettle`, `CompleteEvent`, `DeferredOwner`, fault, and every other external-wait boundary remain later-turn. It creates no EventPump admission, priority episode, physical-operation burst, or authority path.
Commands:
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib net::
Checks:
  - Synthetic Wi-Fi data backlog cannot delay keyboard bytes or serial command echo.
  - Control traffic is not blocked behind bulk data queue pressure. A received DHCP Offer cannot remain head-of-line behind the next retained Discover TX terminal.
  - An exact authenticated CYW43 command dispatches in a separate hardware-free outer turn before passive USB service debt, while actual input and physical response tails still preempt it and continuous TCP cannot defer one post-cursor USB rotation.
Deliverables:
  - Observable network-control/data scheduling contract for Pi 4 Wi-Fi and future high-performance drivers.

Title/ID: m26b-rest-normalized-parity
Goal: Reframe Wi-Fi performance proof as raw Pi Wi-Fi latency plus measured REST gateway overhead.
Inputs: scripts/rest_perf_harness.py, docs/BENCHMARKS.md, apps/hive-gateway/src/main.rs, apps/cohsh/src/transport/tcp.rs.
Changes:
  - scripts/rest_perf_harness.py — report raw/cold/hot modes separately and preserve no-retry failure accounting.
  - docs/BENCHMARKS.md — distinguish QEMU loopback capacity from Pi Wi-Fi physical proof.
  - apps/hive-gateway/src/main.rs — preserve cache/coalescing as host-side projection only; no write bypass.
Commands:
  - .venv/bin/python -m pytest -q tests/test_rest_perf_harness.py
  - cargo run -p cohsh --features tcp -- --transport tcp --tcp-host <wifi-lease-ip> --tcp-port 31337 --auth-token <token> --script scripts/cohsh/boot_v0.coh
  - python3 scripts/rest_perf_harness.py --mode perf --rest-url <pi4-rest-url> --suite status --runs 20 --no-transient-retries
Checks:
  - REST cold p95 is reported as raw `cohsh` p95 plus gateway overhead.
  - Hot projection results are labeled separately and cannot satisfy raw Wi-Fi hardware gates.
Deliverables:
  - Honest Pi Wi-Fi benchmark model that optimizes toward QEMU semantics without claiming impossible physical loopback parity.

Title/ID: m26b-benchmark-comparator
Goal: Define and enforce same-harness QEMU-vs-Pi isolated runtime throughput parity while evaluating Pi latency against documented physical-network norms instead of QEMU loopback parity.
Inputs: scripts/rest_perf_harness.py, tests/test_rest_perf_harness.py, tests/test_pi4_compare_driver_models.py, docs/BENCHMARKS.md, existing out/bench QEMU and Pi summaries.
Changes:
  - scripts/rest_perf_harness.py or scripts/pi4_compare_driver_models.py — emit/compare benchmark provenance, reject mismatched workloads, and calculate pass/fail from throughput/error metrics only.
  - tests/test_rest_perf_harness.py and tests/test_pi4_compare_driver_models.py — cover matched PASS, throughput FAIL, workload mismatch, stale-artifact rejection, and latency-excluded verdict behavior.
  - docs/BENCHMARKS.md — document the best-QEMU selection rule, Pi artifact requirements, and latency-exclusion rule.
Commands:
  - python3 -m pytest tests/test_rest_perf_harness.py tests/test_pi4_compare_driver_models.py
Checks: comparator rejects stale or mismatched artifacts and produces deterministic PASS/FAIL for matched QEMU/Pi runs without using QEMU latency parity as a verdict metric; it still flags Pi wired NIC/Wi-Fi latency outside documented industry-normal physical LAN/control-plane ranges.
Deliverables: benchmark comparator, tests, and documented parity rule.

Title/ID: m26b-linked-runtime-counters
Goal: Add bounded counters required to explain isolated runtime benchmark misses without UART spam.
Inputs: crates/pi4-driver-abi, apps/pi4-driver-runtime, apps/root-task/src/hal/driver_task.rs, apps/root-task/src/drivers/driver_task_net.rs.
Changes:
  - crates/pi4-driver-abi/src/** — fixed-layout counter fields for turns, drained descriptors, staged bytes, cache work, busy/backpressure, and overruns where existing records are insufficient.
  - apps/pi4-driver-runtime/src/** — update counters inside GENET, CYW43, SDIO, USB, HDMI, serial, and PCIe service loops.
  - apps/root-task/src/hal/driver_task.rs and apps/root-task/src/drivers/driver_task_net.rs — expose bounded, activity-gated counter snapshots through existing diagnostics/evidence surfaces.
  - scripts/pi4_trace_normalize.py + tests/test_pi4_trace_normalize.py — normalize `DRIVER_TASK_COUNTER_*` fields, reject empty or truncated counter lines through `DRIVER_TASK_COUNTER_INVALID`, and keep counters diagnostic-only.
Commands:
  - cargo test -p pi4-driver-abi
  - cargo test -p pi4-driver-runtime
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib drivers::driver_task_net
  - python3 -m pytest -q tests/test_pi4_trace_normalize.py
Checks: counters are fixed-layout, bounded, non-authority-bearing, activity-gated, not updated from polling-loop atomics, normalized with `DRIVER_TASK_COUNTER_INVALID=0`, and do not change console grammar or Secure9P semantics.
Deliverables: counter ABI, runtime updates, root-side evidence snapshots, normalizer guard fields, and tests.

Title/ID: m26b-linked-driver-hotpath-closure
Goal: Remove avoidable single-frame or single-descriptor overhead while preserving isolated runtime active-slot invariants.
Inputs: apps/pi4-driver-runtime, crates/pi4-driver-abi, apps/root-task/src/hal/driver_task.rs, docs/DRIVERS.md.
Changes:
  - apps/pi4-driver-runtime/src/** — bounded local batching for descriptor drain, cache maintenance, completion publication, and telemetry counters where benchmark evidence shows contention.
  - crates/pi4-driver-abi/src/** — fixed burst bounds and max-turn evidence where ABI fields are needed.
  - apps/root-task/src/hal/driver_task.rs — preserve staged active-slot submit, range validation, busy-on-conflict, and completion publication under batching.
Commands:
  - cargo test -p pi4-driver-abi
  - cargo test -p pi4-driver-runtime
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib
Checks: batching is bounded, cannot overwrite active payload-bearing turns, and does not add root-owned physical-driver service.
Deliverables: lower-contention isolated runtime hot paths with contract-local backpressure evidence.

Title/ID: m26b-target-benchmark-proof
Goal: Produce fresh same-harness QEMU and Pi 4 isolated runtime benchmark evidence before 26b closes.
Inputs: scripts/rest_perf_harness.py, selected QEMU reference, Pi 4 serial capture, active wired or Wi-Fi profile, docs/TEST_PLAN.md.
Changes:
  - out/bench/m26b-* — archived QEMU reference, Pi isolated runtime run, comparator output, and normalized serial evidence.
  - docs/BENCHMARKS.md — update benchmark verdict and artifact table after proof is produced.
  - docs/TEST_PLAN.md and scripts/ci/test_plan_run.sh — add 26b QEMU/Pi benchmark stages if not already covered by target-qualified runner configuration.
Commands:
  - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --log-dir out/bench --log-prefix m26b-qemu-reference
  - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --no-qemu --no-gateway --rest-url http://<pi4-gateway-host>:<port> --log-dir out/bench --log-prefix m26b-pi4-linked-runtime
Checks: Pi isolated runtime throughput meets or exceeds the selected QEMU reference under matched workload/provenance, latency remains recorded and checked against documented industry-normal physical LAN/control-plane ranges but excluded from the QEMU-throughput parity verdict, and side proof lanes stay separate.
Deliverables: fresh benchmark artifacts, comparator PASS/FAIL, normalized Pi proof, and updated benchmark docs.

Title/ID: m26b-authenticated-cohsh-reboot
Goal: Add an authenticated `cohsh reboot` command that works over TCP and local-seat without introducing a new in-VM listener or bypassing existing Queen secrets.
Inputs: crates/cohsh-core/src/{verb.rs,command.rs,help.rs}, apps/cohsh/src/lib.rs, apps/cohsh/src/transport/tcp.rs, apps/root-task/src/{event/mod.rs,reboot.rs,kernel.rs}, scripts/pi4-image-build.sh, third_party/u-boot/configs/rpi_4_defconfig, docs/{HARDWARE_BRINGUP.md,INTERFACES.md,USERLAND_AND_CLI.md}.
Changes:
  - crates/cohsh-core/src/* — add the shared `reboot` console verb and `REBOOT` ACK label so serial, TCP, cohsh, and local-seat parse the same command.
  - apps/root-task/src/reboot.rs + apps/root-task/src/kernel.rs — register the Pi 4 BCM2711 watchdog reset backend through HAL-owned device mapping, best-effort mark authenticated Pi resets as one-shot fast boots through a Cohesix-specific BCM2711 PM RSTS high marker before watchdog arming, report the retained watchdog software-reset status bit as diagnostics only, follow the BCM2711 PM WDOG/RSTC restart sequence for reset, and fail closed when that reset path is unavailable.
  - apps/root-task/src/event/mod.rs — require a secret-backed Queen session, emit `OK REBOOT detail=scheduled`, then defer the hardware reboot request long enough to flush the acknowledgement.
  - apps/cohsh/src/* — expose `cohsh reboot` through the existing authenticated TCP console flow and stop waiting for trailing lines once `OK REBOOT` is received.
  - scripts/pi4-image-build.sh + third_party/u-boot/configs/rpi_4_defconfig — generate a Pi 4 U-Boot script that loads saved `cohesix.env` policy, consumes and clears the authenticated reboot marker when visible, reports software-reset status as diagnostics only, enters the interactive Cohesix menu by default, and rejects stale U-Boot binaries that still use generic `bootflow scan`.
  - docs/USERLAND_AND_CLI.md + docs/snippets/cohsh_grammar.md — document reboot grammar and the TCP/local-seat authorization model.
  - docs/HARDWARE_BRINGUP.md + docs/INTERFACES.md — document the authenticated reboot fast-boot handoff and saved-policy behavior.
Commands:
  - cargo test -p cohsh-core
  - cargo test -p cohsh --lib network_console_verbs_forward_to_transport
  - cargo test -p root-task reboot --lib
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests::local_seat_ticket_backed_reboot_schedules_backend_request
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml
Checks: Bare `reboot` without an authenticated session fails; physical console/local-seat reboot requires a Queen ticket minted from the existing Queen secret; TCP reboot remains gated by the existing TCP auth token plus Queen session; Pi 4 reset access uses only HAL-mapped PM/watchdog registers; an authenticated Pi reset best-effort sets the Cohesix high RSTS marker without making marker readback a policy gate; the watchdog reset path follows the BCM2711 PM WDOG/RSTC restart sequence and fails closed if those reset-critical accesses are unavailable; the next generated U-Boot script load consumes high marker state before menu/input setup when present, reports the software-reset bit as diagnostics only, and enters the interactive Cohesix menu whose first action is `Boot with saved settings` or `Boot with default settings` as appropriate; the Pi 4 U-Boot default command sources `boot.scr.uimg` directly rather than entering EFI/bootflow scan.
Deliverables: Shared reboot verb, host CLI forwarding, authenticated root-task scheduling, HAL-backed Pi 4 reboot backend, one-shot authenticated reboot marker diagnostics, preserved interactive splash/menu behavior, generated-script validation, and tests for denial/success paths.

Title/ID: m26b-queen-log-evidence-dump
Goal: Make `/log/queen.log` a bounded, useful Pi 4 benchmark evidence surface and expose a host-side dump workflow through `cohsh` and SwarmUI without changing console or Secure9P semantics.
Inputs: apps/root-task/src/{log_buffer.rs,event/mod.rs,ninedoor.rs,bootstrap/log.rs}, apps/cohsh/src/lib.rs, apps/swarmui/src/{lib.rs,transport.rs}, apps/swarmui/frontend/{app.js,index.html,styles.css}, scripts/rest_perf_harness.py, docs/{HOST_TOOLS.md,USERLAND_AND_CLI.md,INTERFACES.md,TEST_PLAN.md}.
Changes:
  - apps/root-task/src/log_buffer.rs — raise live `/log/queen.log` retention to 2048 lines, add sequence/eviction metadata if needed for evidence integrity, and preserve bounded line storage.
  - apps/root-task/src/event/mod.rs + apps/root-task/src/ninedoor.rs — export the retained log through chunked, non-lossy streaming so `cat`/`tail`/`log` do not allocate or copy a 2048-line snapshot in one pending buffer and `END` is emitted only after the final retained line.
  - apps/root-task/src/bootstrap/log.rs + selected audit call sites — keep high-rate driver chatter out of the log while adding curated benchmark evidence markers: boot/build/session identity, log retention metadata, benchmark start/end, host write summaries, policy/lifecycle denials, telemetry wrap/quota, and bounded backpressure/error summaries.
  - apps/cohsh/src/lib.rs — add `log dump <local-file.txt>` as a host-only command that reads `/log/queen.log` through the existing transport, writes only payload lines to the destination, refuses existing files unless an explicit force form is documented, and preserves ACK/ERR/END grammar on the wire.
  - apps/swarmui/src/** + apps/swarmui/frontend/** — expose the same bounded log dump/read workflow as a SwarmUI projection over existing console/REST transport semantics, with no UI-owned evidence serializer, no second session in live console mode, and no hidden polling.
  - docs and tests — document the 2048-line bounded retention/export behavior, diagnostic contents, `cohsh log dump` usage after REST harness runs, SwarmUI workflow, and performance constraints.
Commands:
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib log_buffer event::tests
  - cargo test -p cohsh
  - cargo test -p swarmui
  - python3 -m pytest -q tests/test_rest_perf_harness.py
Checks: `/log/queen.log` retains up to 2048 curated lines with explicit oldest-line eviction, host/UI dumps preserve every retained line without truncation, generic command streaming remains bounded per turn, Pi 4 benchmark hot paths do not gain high-rate log writes, `cohsh log dump` and SwarmUI use existing read semantics only, and REST harness benchmark evidence can identify the run, transport/session, recent control failures, backpressure, and retention window without relying on UART spam.
Deliverables: 2048-line bounded queen log, non-lossy chunked dump path, curated benchmark evidence contents, `cohsh log dump` command, SwarmUI log dump/read projection, docs, and focused regression coverage.

Compatibility baseline tasks below are retained because they describe the original 26b DHCP, U-Boot policy, Wi-Fi, and QEMU guardrails that must not regress. They did not close reopened 26b by themselves; accepted closure combined the USB/Wi-Fi driver-task and concurrency/benchmark gates above with the retained baseline checks below.

Title/ID: m26b-dhcp-core-nostd
Goal: Implement bare-bones, bounded DHCPv4 client logic for root-task networking.
Inputs: apps/root-task/src/net/*, docs/INTERFACES.md, docs/SECURITY.md.
Changes:
  - apps/root-task/src/net/dhcp.rs — deterministic DHCP state machine and packet parser (DISCOVER/OFFER/REQUEST/ACK only).
  - apps/root-task/src/net/mod.rs — integrate DHCP mode into existing net bootstrap sequencing.
Commands:
  - cargo check -p root-task
  - cargo test -p root-task --features "kernel net-console" dhcp
Checks:
  - Lease acquisition and timeout paths are bounded and test-covered.
Deliverables:
  - `no_std` DHCP core integrated with deterministic diagnostics.

Title/ID: m26b-uboot-net-policy
Goal: Make wired/Wi-Fi DHCP policy compiler-authoritative with optional U-Boot-provided inputs.
Inputs: configs/root_task.toml, tools/coh-rtc, apps/root-task/src/generated, docs/HARDWARE_BRINGUP.md.
Changes:
  - tools/coh-rtc/src/* — add policy IR fields (`mode`, `interface`, DHCP bounds) and validation.
  - apps/root-task/src/generated/* — regenerated network policy constants/artifacts.
  - docs/HARDWARE_BRINGUP.md — document U-Boot policy source, fallback rules, and expected boot lines.
Commands:
  - cargo test -p coh-rtc
  - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json
Checks:
  - Invalid policy settings fail deterministically; valid settings generate stable artifacts.
Deliverables:
  - Manifest/U-Boot-policy-driven DHCP mode selection with docs-as-built parity.

Title/ID: m26b-uboot-network-wizard
Goal: Add an interactive Pi 4 U-Boot network wizard with saved-config continue flow, bounded static IPv4 prompts, and optional logo display.
Inputs: scripts/pi4-image-build.sh, third_party/u-boot/configs/rpi_4_defconfig, docs/HARDWARE_BRINGUP.md, docs/INTERFACES.md, docs/COHESIX_LOGO.png.
Changes:
  - scripts/pi4-image-build.sh — generate an `askenv`-driven Pi 4 boot script that can continue with saved policy, choose DHCP vs static, choose wired vs Wi-Fi, collect bounded static IPv4 fields, persist only Cohesix policy to a dedicated FAT-side file, and optionally render a staged BMP logo on HDMI.
  - third_party/u-boot/configs/rpi_4_defconfig — enable the `askenv` and `bmp display` support required by the wizard while keeping the seL4-recommended Pi 4 USB baseline.
  - docs/HARDWARE_BRINGUP.md + docs/INTERFACES.md — document the wizard flow, persisted `coh_*` variables, bounded `/chosen/cohesix,*` static IPv4 properties, and the saved-config fast path.
Commands:
  - bash -n scripts/pi4-image-build.sh
  - make -C third_party/u-boot rpi_4_defconfig
  - make -C third_party/u-boot CROSS_COMPILE=aarch64-linux-gnu- -j$(sysctl -n hw.ncpu)
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml
Checks:
  - The first wizard action is `Boot with saved settings` when a coherent persisted network override exists; a logo-only or cleared policy presents `Boot with default settings`.
  - `Manual (static IPv4)` collects bounded static IPv4 fields and mirrors them into DTB `/chosen/cohesix,static-*` properties before handoff.
  - Review distinguishes `Boot once without saving` from `Save settings and restart`; saved-settings reset requires explicit confirmation, and a new Wi-Fi policy can be entered without deleting or reflashing the SD image.
  - The HDMI logo is optional: it renders when enabled and available, and boot still proceeds cleanly when it is disabled or cannot be staged.
Deliverables:
  - Pi 4 U-Boot network wizard with deterministic saved-config continuation and optional logo display.

Title/ID: m26b-pi4-wifi-dhcp-baseline
Goal: Add minimal Pi 4 Wi-Fi path sufficient for DHCP-backed diagnostics connectivity.
Inputs: apps/root-task/src/drivers/*, apps/root-task/src/hal/*, docs/ARCHITECTURE.md, docs/SECURITY.md.
Changes:
  - apps/root-task/src/hal/* — add Pi 4 Wi-Fi HAL traits for SDIO host I/O, power/reset control, OOB/host-wake observation, and firmware/NVRAM/CLM handoff; default implementations must fail deterministically with `unsupported`.
  - apps/root-task/src/drivers/* — add a dedicated CYW43455/CYW43xx-class driver path that follows the reference shape `bwfm` -> Zephyr/WHD HAL split -> Linux `brcmfmac` (`sdio.c`, `firmware.c`, `cfg80211.c`) without lifting source.
  - apps/root-task/src/drivers/* — implement the Pi 4 SDIO transport path first (function-0 direct I/O, function-1/2 enable, mailbox/interrupt handling, bounded firmware download, NVRAM/CLM staging) before join/auth logic.
  - apps/root-task/src/net/* — bind Wi-Fi link state and Ethernet frame ingress/egress into the shared smoltcp bootstrap/DHCP flow without introducing any new in-VM listener surface.
  - docs/ARCHITECTURE.md + docs/SECURITY.md — update the network backend matrix, bounds, threat notes, silicon identification (Pi 4B uses CYW43455 over SDIO), and reference-only provenance (`bwfm` -> Zephyr/WHD HAL split -> `brcmfmac` edge-case guidance; no code lift).
Commands:
  - cargo check -p root-task
  - cargo test -p root-task wifi:: -- --nocapture
  - rg -n "EFI_|boot_services|runtime_services|uefi::" apps/root-task/src tools/coh-rtc/src
Checks:
  - Wi-Fi join + DHCP works when enabled and declared; failure modes remain deterministic and auditable.
  - Wi-Fi runtime/device access remains HAL-only; any non-HAL direct access path fails review.
Deliverables:
  - Profile-gated CYW43xx Wi-Fi DHCP diagnostics path for Pi 4 with explicit reference-only provenance documentation.

Title/ID: m26b-pi4-wifi-hal-foundation
Goal: Add the HAL surface required to support Pi 4 Wi-Fi without any direct MMIO or firmware-service bypass in drivers.
Inputs: apps/root-task/src/hal/*, apps/root-task/src/kernel.rs, docs/ARCHITECTURE.md.
Changes:
  - apps/root-task/src/hal/mod.rs — add bounded SDIO, Wi-Fi control GPIO, OOB/host-wake, and firmware bundle traits/types with deterministic `unsupported` defaults.
  - apps/root-task/src/kernel.rs — keep Wi-Fi runtime rejection paths explicit until HAL-backed implementations are present.
  - docs/ARCHITECTURE.md — document HAL ownership of Pi 4 Wi-Fi transport/control resources.
Commands:
  - cargo check -p root-task --no-default-features --features net-console
  - cargo test -p root-task hal:: -- --nocapture
Checks:
  - All Wi-Fi transport/control operations are represented in HAL before any driver code depends on them.
  - Non-Pi4 or pre-implementation HALs fail deterministically with `unsupported`.
Deliverables:
  - Auditable Wi-Fi HAL contract for subsequent 26b tasks.

Title/ID: m26b-pi4-sdio-host-bringup
Goal: Implement the Pi 4 SDIO host path needed by CYW43455.
Inputs: apps/root-task/src/hal/*, apps/root-task/src/drivers/*, Pi 4 DTB/U-Boot handoff artifacts.
Changes:
  - apps/root-task/src/hal/* — add Pi 4 SDIO host implementation for the BCM2835/BCM2711 SDIO controller used by the on-board Wi-Fi device.
  - apps/root-task/src/drivers/* — add bounded command/data path helpers for function-0 direct I/O and function-1/2 CMD53 transfers.
  - docs/HARDWARE_BRINGUP.md — record the Pi 4 SDIO host node/pin assumptions and bring-up evidence.
Commands:
  - cargo check -p root-task
  - cargo test -p root-task sdio:: -- --nocapture
Checks:
  - SDIO host init, clocking, bus-width changes, and direct/extended transfers are HAL-only and test-covered.
Deliverables:
  - Pi 4 SDIO transport substrate for CYW43455.

Title/ID: m26b-cyw43455-firmware-transport
Goal: Bring the CYW43455 to a firmware-ready state with bounded mailbox and firmware/NVRAM/CLM handling.
Inputs: apps/root-task/src/drivers/*, out/pi4-sd/*, docs/SECURITY.md.
Changes:
  - apps/root-task/src/drivers/* — add CYW43455 reset/attach sequencing, core discovery, mailbox handling, firmware download, NVRAM application, and CLM load.
  - docs/SECURITY.md — document firmware provenance, bounds, and runtime trust assumptions for the bundled Pi 4 Wi-Fi blobs.
Commands:
  - cargo check -p root-task
  - cargo test -p root-task cyw43:: -- --nocapture
Checks:
  - Firmware bundle validation is bounded and deterministic.
  - Driver reaches a ready-for-join state without bypassing HAL.
Deliverables:
  - CYW43455 transport/firmware path ready for association work.

Title/ID: m26b-cyw43455-join-dhcp
Goal: Complete Pi 4 Wi-Fi diagnostics connectivity by joining a network and binding the shared DHCP/bootstrap flow.
Inputs: apps/root-task/src/net/*, apps/root-task/src/drivers/*, docs/INTERFACES.md, docs/HARDWARE_BRINGUP.md.
Changes:
  - apps/root-task/src/drivers/* — add bounded open-network/WPA2-PSK join sequencing, link-state reporting, and audited failure reasons.
  - apps/root-task/src/net/* — route `wifi` and `auto` policy through the CYW43455 path while preserving single-active-interface guarantees.
  - docs/INTERFACES.md + docs/HARDWARE_BRINGUP.md — document required credentials handoff, join breadcrumbs, DHCP evidence, and operator workflow.
Commands:
  - cargo check -p root-task
  - cargo test -p root-task wifi:: -- --nocapture
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml
Checks:
  - `wifi` reaches link-up + DHCP when credentials are present.
  - `auto` prefers Wi-Fi only when the CYW43455 path is healthy and still exposes at most one active control-plane interface.
Deliverables:
  - End-to-end Pi 4 Wi-Fi diagnostics path with DHCP and console reachability.

Title/ID: m26b-pi4-wifi-hardware-validation
Goal: Capture Pi 4 on-device evidence for CYW43455 join, DHCP, and deterministic historical `auto` compatibility behavior before closing the retained 26b compatibility baseline.
Inputs: flashed Pi 4 SD image, serial capture, Linux known-good brcmfmac/MMC/SDHCI capture, U-Boot USB handoff trace, Wi-Fi credentials, direct-link/compatibility host setup, docs/HARDWARE_BRINGUP.md, docs/TEST_PLAN.md.
Changes:
  - scripts/pi4_trace_normalize.py — normalize Pi 4 USB/Wi-Fi serial traces into JSONL/summary artifacts for boot-to-boot comparison.
  - docs/HARDWARE_BRINGUP.md — record the exact serial breadcrumbs, host commands, and observed IP/console evidence for a successful Wi-Fi boot.
  - docs/TEST_PLAN.md — add the final Pi 4 Wi-Fi validation transcript and `auto` fallback proof.
Commands:
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml
  - minicom -D /dev/cu.usbserial-0001 -b 115200 -o -C pi4-serial.log
  - python3 scripts/pi4_trace_normalize.py pi4-serial.log --summary
  - python3 scripts/pi4_trace_normalize.py pi4-serial.log --gate-summary --expect USB_GATE=10 --expect USB_BLOCKER=none --expect WIFI_GATE=10 --expect WIFI_BLOCKER=none --expect WIFI_EXACT=none
  - python3 scripts/pi4_trace_normalize.py pi4-serial.log --gate-summary --expect USB_BOOTLOADER_HANDOFF_SEEN=no --expect USB_COLD_BOOT_SEEN=yes --expect BOOT_HALTED=no --expect TIMER_IRQ27_SEEN=no
  - python3 scripts/pi4_trace_normalize.py pi4-linux-known-good.log --domain wifi --summary
  - cargo run -p cohsh --features tcp -- --transport tcp --tcp-host <wifi-lease-ip> --tcp-port 31337 --auth-token bootstrap
Checks:
  - Normalized Cohesix, U-Boot, and Linux comparison traces preserve USB/Wi-Fi stages, blockers, and latest verdicts as machine-readable evidence.
  - Final Pi 4 USB acceptance requires `USB_COLD_BOOT_SEEN=yes`, command/event-ring proof before live Cohesix-owned root-port power assertion/readback/sampling/reset, and no Linux/U-Boot captured root-port enumeration.
  - Serial shows CYW43455 attach/join breadcrumbs followed by `[dhcp] lease bound ...`.
  - `netstats` / `netstatus` report the Wi-Fi lease on `policy=wifi`.
  - `auto` proves single-active-interface behavior; historical compatibility profiles may exercise absent-device wired fallback, while the physical driver-task profile treats selected-CYW43 attach/join/runtime failure as fatal driver evidence.
Deliverables:
  - Pi 4 hardware validation evidence, normalized trace summaries, and known-good Linux/U-Boot comparison artifacts required to preserve the historical Milestone 26b compatibility baseline.

Title/ID: m26b-qemu-compat-gate
Goal: Prove 26/26a/26b changes do not break macOS/Linux QEMU backward compatibility.
Inputs: scripts/qemu-run.sh, scripts/uboot/qemu-uboot-smoke.sh, regression fixtures, docs/TEST_PLAN.md.
Changes:
  - docs/TEST_PLAN.md — add explicit compatibility matrix checks for macOS/Linux QEMU after 26/26a/26b.
  - scripts/ci/* — add guard checks that fail on console/protocol drift for existing QEMU fixtures.
Commands:
  - scripts/cohesix-build-run.sh --no-run --cargo-target aarch64-unknown-none
  - scripts/uboot/qemu-uboot-smoke.sh --net user
Checks:
  - Existing QEMU fixtures on macOS/Linux remain passing with no operator-facing behavior regressions.
Deliverables:
  - Auditable compatibility evidence for the Pi 4 bare-metal rollout milestones.

Title/ID: m26b-nettest-interface-policy
Goal: Extend `nettest` to honor 26b network policy (`wired|wifi|auto`) while enforcing a single active control-plane interface at runtime.
Inputs: apps/root-task/src/net/*, tools/coh-rtc/src/*, apps/root-task/src/generated/*, docs/INTERFACES.md, docs/HARDWARE_BRINGUP.md.
Changes:
  - apps/root-task/src/net/mod.rs + apps/root-task/src/net/stack.rs — add policy-aware interface selection for self-test execution and report active/standby interface state in `netstats`.
  - apps/root-task/src/net/dhcp.rs — surface bounded lease/state signals needed by `nettest` diagnostics for DHCP paths.
  - tools/coh-rtc/src/* + apps/root-task/src/generated/* — emit and validate nettest-relevant policy fields (`mode`, `interface`, retry/timing bounds) for `pi4-uboot-aarch64`.
  - docs/INTERFACES.md + docs/HARDWARE_BRINGUP.md — codify deterministic single-active-interface behavior and failover evidence requirements for `auto`.
Commands:
  - cargo check -p root-task
  - cargo test -p root-task net:: -- --nocapture
  - cargo test -p coh-rtc
  - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json
Checks:
  - `nettest` on `wired` and `wifi` policies executes against only the selected interface.
  - `auto` policy uses deterministic priority/failover, with at most one active TCP console interface at any moment.
  - Existing QEMU `nettest` behavior and host workflows remain backward compatible with no required command changes.
Deliverables:
  - Policy-driven `nettest` behavior for Pi 4 DHCP milestones with explicit single-active-interface guarantees and compatibility evidence.

Title/ID: m26b-swarmui-tauri2-host-upgrade
Goal: Keep SwarmUI on the latest stable Tauri desktop line without changing Cohesix transport or UI semantics during the Pi 4 DHCP rollout.
Inputs: apps/swarmui/*, scripts/setup_environment.sh, scripts/linux_host_tools_sync.sh, docs/HOST_TOOLS.md.
Changes:
  - apps/swarmui/Cargo.toml + apps/swarmui/src-tauri/main.rs + apps/swarmui/tauri.conf.json — migrate SwarmUI from Tauri 1 to Tauri 2 while preserving the existing command surface, replay/bootstrap flow, CSP, and `window.__TAURI__` frontend bridge.
  - apps/swarmui/src-tauri/capabilities/default.json — add the minimum desktop capability set required by the Tauri 2 permission model.
  - apps/swarmui/tests/no_http_deps.rs — scope dependency-policy checks to the active desktop target so Tauri 2 mobile-only transitive crates do not create false failures.
  - scripts/setup_environment.sh + scripts/linux_host_tools_sync.sh + docs/HOST_TOOLS.md — align Linux runtime/build prerequisites to the Tauri 2 WebKitGTK 4.1 package line.
Commands:
  - cargo check -p swarmui
  - cargo test -p swarmui
Checks:
  - SwarmUI keeps the existing host-side command/invoke surface and passes its replay, cache, security, transcript, and console-parity tests after the Tauri 2 migration.
  - Linux host setup/build scripts install WebKitGTK 4.1 packages required by Tauri 2.
  - No new Cohesix protocol verbs, transports, or UI authority are introduced.
Deliverables:
  - SwarmUI upgraded to the current Tauri 2 desktop line with host-tool packaging and test coverage kept in sync.

Title/ID: m26b-swarmui-spectrum-shell
Goal: Rebuild the SwarmUI desktop shell around Spectrum Web Components while preserving Cohesix transport semantics, replay behavior, and Live Hive rendering.
Inputs: apps/swarmui/frontend/*, tools/swarmui-ui-tests/*, docs/USERLAND_AND_CLI.md.
Changes:
  - apps/swarmui/frontend/index.html + app.js + components/console.js + styles/* — adopt a vendored Spectrum-based shell (`sp-theme`, `sp-button`, `sp-textfield`, `sp-picker`, `sp-divider`) for operator controls while preserving all current IDs, panel outputs, and Pixi-backed Live Hive behavior.
  - apps/swarmui/frontend/vendor/spectrum.bundle.js — self-host the exact Spectrum Web Components bundle needed by SwarmUI so Tauri/release builds remain offline-safe and CDN-free.
  - tools/swarmui-ui-tests/tests/swarmui.spec.js + screenshots — update the Playwright harness for Spectrum-backed text fields/buttons, keep replay/canvas coverage intact, and add shell regression checks for ticket minting and control wiring.
  - docs/USERLAND_AND_CLI.md — record that SwarmUI ships a vendored Spectrum shell while remaining a presentation-only frontend over existing Cohesix transports.
Commands:
  - cargo check -p swarmui --all-targets
  - cargo clippy -p swarmui --all-targets -- -D warnings
  - cargo test -p swarmui
  - cd tools/swarmui-ui-tests && npm test
Checks:
  - SwarmUI keeps the same Tauri command surface, replay/bootstrap flow, and Live Hive polling semantics after the Spectrum shell migration.
  - The shell remains self-hosted for Tauri/release bundles with no CDN requirement and no new transport authority.
  - Playwright coverage exercises the Spectrum-backed controls without weakening existing Live Hive and transcript assertions.
Deliverables:
  - World-class SwarmUI shell using vendored Spectrum Web Components with replay-safe UI regression coverage and warning-free SwarmUI Rust builds.

Title/ID: m26c-as-built-blocker-ledger
Goal: Record and gate current as-built mismatches before 26c cleanup or downstream milestones claim alignment.
Inputs: docs/BUILD_PLAN.md, AGENTS.md, docs/SECURE9P.md, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/SECURITY.md, docs/SECURITY_NIST_800_53.md, docs/TEST_PLAN.md, docs/HARDWARE_BRINGUP.md, configs/root_task_pi4_uboot_aarch64.toml, scripts/ci/test_plan_run.sh, apps/root-task/src/net/**, apps/root-task/src/drivers/**, apps/root-task/src/hal/**, apps/root-task/src/ninedoor.rs, apps/pi4-driver-runtime/**, crates/pi4-driver-abi/**, apps/worker-heart/src/kernel.rs, apps/worker-gpu/src/kernel.rs, scripts/release_bundle.sh
Changes:
  - docs/audit/M26C_AS_BUILT_BLOCKERS.md — checked-in blocker ledger with owner, severity, dependency impact, evidence command, and closure/defer decision for each initial blocker.
  - docs/BUILD_PLAN.md — keep 26c and later milestones synchronized with blocker disposition changes.
  - docs/TEST_PLAN.md — reference target-qualified evidence expectations once the runner is implemented.
Commands:
  - rg -n "TCP_SMOKE_PORT|31339" apps/root-task scripts docs
  - rg -n "read_volatile|write_volatile|from_exposed_addr|phys|MMIO" apps/root-task/src/drivers apps/root-task/src/serial
  - cargo test -p secure9p-codec
  - scripts/ci/check_test_plan.sh
Checks:
  - Initial blocker entries cover 26b evidence, isolated Pi 4 runtime-image acceptance gaps, Pi 4 network IR/docs validation drift, target-qualified runner, Secure9P path validation, non-console in-VM TCP, HAL MMIO ownership, generated-doc drift, fixture/default secrets, placeholder auth defaults, worker-task docs/implementation mismatch, and later-milestone as-built overclaims for persistence, `coh-status`, delegated REST identity, writer-epoch fencing, AI namespace roots, and AWS/ENA/IMDS support.
  - No structural cleanup task starts until blockers are fixed or explicitly deferred with dependency impact.
Deliverables:
  - Auditable 26c blocker ledger that prevents downstream milestones from inheriting unresolved as-built drift silently.

Title/ID: m26c-target-qualified-runner-baseline
Goal: Make target-qualified staged-run semantics real before any cleanup or structural decomposition depends on them.
Inputs: docs/TEST_PLAN.md, docs/HARDWARE_BRINGUP.md, scripts/ci/test_plan_run.sh, scripts/ci/test_plan_stage_*.sh, scripts/ci/check_test_plan.sh, scripts/pi4-image-build.sh, scripts/uboot/qemu-uboot-smoke.sh
Changes:
  - scripts/ci/test_plan_run.sh — add explicit `--target qemu|pi4` selection, write target metadata into the shared state dir, pass the selected target to every stage, and reject unsupported target/stage combinations before a stage can write misleading evidence.
  - scripts/ci/test_plan_run.sh + scripts/ci/test_plan_common.sh — add explicit `--iteration` rerun semantics and per-stage input fingerprints so focused reruns cannot be mistaken for target-qualified PASS and stale earlier evidence is detected before later-stage reuse.
  - scripts/ci/test_plan_stage_*.sh — consume the selected target and write target-qualified stage markers, logs, iteration markers, input fingerprints, and incomplete records without treating QEMU artifacts as Pi 4 proof or Pi 4 hardware logs as QEMU proof.
  - scripts/ci/test_plan_stage_05_due_diligence.sh + scripts/ci/due_diligence_gate.sh — permit Stage 05 to validate and reuse fresh Stage 03 regression evidence from the same state dir while leaving standalone due-diligence exhaustive by default.
  - scripts/ci/check_test_plan.sh — enforce that docs, runner usage, stage scripts, and target matrix language agree.
  - docs/TEST_PLAN.md + docs/HARDWARE_BRINGUP.md — document the QEMU/Pi 4 target matrix, target-specific prerequisites, allowed stage combinations, state-dir metadata, and PASS/INCOMPLETE interpretation.
  - docs/audit/M26C_TARGET_RUNNER_BASELINE.md — checked-in evidence for runner syntax, target matrix, smoke commands, intentionally unsupported combinations, and the rule that Phase 4 cleanup cannot start without this gate.
Commands:
  - scripts/ci/test_plan_run.sh --list
  - scripts/ci/test_plan_run.sh --target qemu --stage 1 --state-dir out/test-plan/m26c-runner-qemu-smoke
  - scripts/ci/test_plan_run.sh --target pi4 --stage 1 --state-dir out/test-plan/m26c-runner-pi4-smoke
  - scripts/ci/check_test_plan.sh
Checks:
  - `--target qemu|pi4` is accepted by the runner, recorded in the state dir, and visible to every stage script.
  - Unsupported target/stage combinations fail before producing `stage_*.done` or target-qualified PASS evidence.
  - Focused `--iteration` runs write only `stage_*.iteration` / `stage_*.<target>.iteration` plus input fingerprints, never PASS markers.
  - `COHSH_BATCH_GROUPS` subsets are iteration-only; final Stage 03 and due-diligence runs require the full regression batch or verified reuse of a fresh full Stage 03 batch.
  - The checker fails if docs mention runner commands, stage matrices, or closure criteria that the scripts do not implement.
  - No Phase 4 cleanup or structural decomposition task may start until this runner baseline is present and PASS.
Deliverables:
  - Target-aware staged-runner contract and smoke evidence available early enough to guard all later cleanup.

Title/ID: m26c-authoring-charter-and-header-rules
Goal: Replace generic repository-wide authoring templates with explicit human-authored comment, header, and documentation rules.
Inputs: AGENTS.md, CONTRIBUTING.md, README.md, docs/CODING_GUIDELINES.md, docs/API_GUIDELINES.md, docs/BUILD_PLAN.md
Changes:
  - AGENTS.md — narrow file-header requirements to legal/provenance metadata plus rules for when comments are required.
  - CONTRIBUTING.md — codify review expectations for comment quality, diff shape, subtractive cleanup, and no-regression sequencing.
  - README.md — align contributor-facing quality language with the new authoring policy.
  - docs/CODING_GUIDELINES.md — define acceptable doc-comment content, prohibited template phrasing, when generic comments should be deleted rather than rewritten, and behavior-preserving cleanup rules.
  - docs/API_GUIDELINES.md — require interface docs to describe contracts, invariants, and failure modes instead of file/module summaries.
Commands:
  - rg -n "Purpose:|Defines the|Provide(s)? the|CLI entry point|library and public module surface|module for" AGENTS.md CONTRIBUTING.md README.md docs/CODING_GUIDELINES.md docs/API_GUIDELINES.md
  - cargo fmt --all -- --check
Checks:
  - Repository guidance no longer instructs contributors to write generic file-summary boilerplate.
  - Header and comment rules are internally consistent across canonical contributor documents.
Deliverables:
  - Canonical authoring policy for human-readable code and docs without hidden behavior changes.

Title/ID: m26c-ai-fingerprint-authorship-review
Goal: Make authored code, docs, tests, and examples read as repository-native work rather than template or model-generated filler.
Inputs: README.md, CONTRIBUTING.md, AGENTS.md, docs/**/*.md, apps/**/README.md, crates/**/README.md, tools/**/*.md, apps/**/src/**/*.rs, crates/**/src/**/*.rs, tools/**/*.rs, tools/cohesix-py/**/*.py, tests/**/*.rs, docs/audit/M26C_MARKDOWN_INVENTORY.csv, docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md, docs/audit/M26C_REFACTOR_MAP.md
Changes:
  - docs/audit/M26C_AI_FINGERPRINT_AUDIT.md — checked-in audit of generic phrasing, template comments, repetitive cadence, inflated adjectives, placeholder examples, and non-specific test names, with delete/rewrite/defer decisions and evidence links.
  - docs/audit/M26C_AGENT_HANDOFFS.md — record the independent authorship-review lane, reviewer, inspected surfaces, commands, residual gaps, and PASS/FAIL decision.
  - README.md + CONTRIBUTING.md + docs/CODING_GUIDELINES.md + docs/API_GUIDELINES.md — document authorship expectations and the difference between required provenance metadata and low-value boilerplate.
  - Cohesix-authored docs, comments, tests, and examples classified as low-risk by `M26C_REFACTOR_MAP.md` — delete or rewrite AI-fingerprint findings without changing behavior, grammar, fixture outputs, generated snippets, release snapshots, vendored references, or append-only audit evidence.
Commands:
  - rg -n "robust|flexible|seamless|world-class|comprehensive|easy to use|powerful|simple and intuitive|AI-generated|generated by" README.md CONTRIBUTING.md AGENTS.md docs apps crates tools
  - rg -n "Defines the|Provides the|CLI entry point|library surface|module for|This module" apps crates tools docs README.md CONTRIBUTING.md AGENTS.md
  - cargo fmt --all -- --check
  - scripts/check-generated.sh
Checks:
  - Every finding is classified as delete, rewrite, acceptable-as-specific, generated/do-not-edit, release-derived, vendored/reference-only, append-only, or deferred with rationale.
  - Rewritten prose names the actual Cohesix contract, invariant, failure mode, evidence path, or operator-visible behavior instead of using generic praise or template structure.
  - Generated snippets, release snapshots, vendored references, and append-only audit evidence are not hand-edited to satisfy style.
  - An independent reviewer lane signs off in `docs/audit/M26C_AGENT_HANDOFFS.md` before low-risk cleanup or public documentation polish is marked complete.
Deliverables:
  - Checked-in AI-fingerprint/authorship audit and cleanup evidence that make first-read code and documentation feel specific, technical, and maintained.

Title/ID: m26c-markdown-inventory-and-disposition
Goal: Inventory and disposition every tracked Markdown file in the main Cohesix repository so canonical, generated, release-derived, append-only, and vendored docs are handled correctly.
Inputs: `git ls-files '*.md' | sort`, root/project docs, apps/**/README.md, crates/**/README.md, docs/**/*.md, tracked release-cut docs, seL4/**/*.md, tests/integration/README.md, tools/**/*.md, third_party/**/*.md
Changes:
  - docs/audit/M26C_MARKDOWN_INVENTORY.csv — authoritative checked-in inventory/disposition source for every tracked Markdown file returned by `git ls-files '*.md'`.
  - docs/audit/M26C_MARKDOWN_INVENTORY.md — rendered human-readable report derived from the checked-in inventory source.
  - docs/BUILD_PLAN.md — record milestone scope, disposition rules, and inventory obligations.
  - docs/REPO_LAYOUT.md — document Markdown path classes and which ones are canonical, derived, or vendored.
  - docs/SECURITY.md — capture documentation provenance rules for generated, release, and vendored Markdown when they influence audit evidence.
Commands:
  - git ls-files '*.md' | sort > out/audit/m26c_markdown_inventory.txt
  - cut -d, -f1 docs/audit/M26C_MARKDOWN_INVENTORY.csv | sed '1d' | sort > out/audit/m26c_markdown_inventory_checked_in.txt
  - diff -u out/audit/m26c_markdown_inventory.txt out/audit/m26c_markdown_inventory_checked_in.txt
Checks:
  - Every tracked repository Markdown file is accounted for exactly once in the checked-in inventory.
  - Each entry has an explicit disposition and an update rule.
  - The rendered report is mechanically derived from the machine-readable source.
Deliverables:
  - Auditable Markdown inventory and disposition source/report pair covering canonical docs, release snapshots, audit evidence, reference mirrors, and vendored material.

Title/ID: m26c-mermaid-as-built-diagram-audit
Goal: Inventory, validate, and refine every Mermaid diagram in tracked Markdown so Cohesix visual documentation is as-built, review-grade, and 100% GitHub-online compatible.
Inputs: `git ls-files '*.md' | sort`, README.md, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/HOST_TOOLS.md, docs/USE_CASES.md, docs/FAILOVER.md, docs/GPU_NODES.md, docs/NETWORK_CONFIG.md, docs/SECURE9P.md, docs/HARDWARE_BRINGUP.md, docs/TEST_PLAN.md, docs/audit/M26C_MARKDOWN_INVENTORY.csv, docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md, apps/root-task/src/hal/**, apps/root-task/src/net/**, apps/root-task/src/event/**, apps/root-task/src/console/**, apps/nine-door/src/host/**, configs/root_task*.toml
Changes:
  - docs/audit/M26C_MERMAID_INVENTORY.csv — checked-in inventory of every Mermaid block in tracked Markdown with file, heading, diagram type, disposition, owner, as-built evidence source, GitHub compatibility status, and update rule.
  - docs/audit/M26C_MERMAID_GITHUB_RENDER_AUDIT.md — render evidence for every edited or newly added diagram, including GitHub-online proof or the exact compatibility check path used.
  - scripts/ci/mermaid_inventory.py — produce the Mermaid inventory from the tracked Markdown list without scanning ignored build outputs or local evidence directories.
  - scripts/ci/check_mermaid_github.sh + scripts/ci/render_mermaid_github.sh — fail on unsupported GitHub Mermaid syntax and render all accepted diagrams into 26c audit evidence.
  - README.md + docs/*.md + apps/**/README.md + crates/**/README.md + tools/**/*.md — refine stale or underspecified Mermaid diagrams; add new diagrams where canonical docs lack visual explanation of as-built contracts.
  - docs/ARCHITECTURE.md — add or refine a HAL architecture Mermaid diagram if the as-built audit shows HAL ownership, driver boundaries, or host/VM capability separation is not clear enough for external review.
Commands:
  - git ls-files '*.md' | sort > out/audit/m26c_markdown_inventory.txt
  - scripts/ci/mermaid_inventory.py --markdown-list out/audit/m26c_markdown_inventory.txt --out docs/audit/M26C_MERMAID_INVENTORY.csv
  - scripts/ci/check_mermaid_github.sh --markdown-list out/audit/m26c_markdown_inventory.txt
  - scripts/ci/render_mermaid_github.sh --markdown-list out/audit/m26c_markdown_inventory.txt --out out/audit/m26c-mermaid-rendered
Checks:
  - Every Mermaid block in tracked Markdown is inventoried exactly once and classified as canonical human-edited, generated/regenerate-only, release-derived, vendored/reference-only, append-only audit evidence, or external reference mirror.
  - Edited and newly added diagrams render correctly in GitHub online and avoid unsupported Mermaid features such as custom init directives, raw HTML labels, external assets, theme CSS, local renderer extensions, or experimental diagram syntax unless GitHub-online proof is archived.
  - Canonical diagrams describe the as-built system with enough detail to show authority boundaries, HAL ownership, host/VM separation, generated-manifest authority, Secure9P paths, worker roles, Pi 4 boot/network flows, and operator-visible control/data paths.
  - Diagram changes do not contradict generated snippets, manifests, fixtures, test-plan evidence, or the 26c blocker ledger.
Deliverables:
  - Review-grade GitHub-renderable Mermaid diagram set with inventory, compatibility proof, and as-built traceability for every tracked Markdown diagram.

Title/ID: m26c-refactor-map-and-risk-ratchet
Goal: Freeze the aggressive refactor scope, ownership, preserved contracts, simplicity targets, and risk-ratchet baseline before structural edits begin.
Inputs: docs/BUILD_PLAN.md, docs/audit/EXCEPTIONS.md, docs/audit/findings.csv, apps/**/src/**/*.rs, crates/**/src/**/*.rs, tools/**/src/**/*.rs, tools/cohesix-py/**/*.py, scripts/ci/*.sh
Changes:
  - docs/audit/M26C_REFACTOR_MAP.md — classify each Cohesix-authored candidate as no-touch, low-risk cleanup, characterization-first refactor, boundary-sensitive refactor, or deferred, and assign each accepted wave a single owned surface, preserved-contract list, characterization artifact, target test subset, and rollback-sized scope.
  - docs/audit/M26C_SIMPLICITY_SCORECARD.md — record before/after simplification targets for high-value authored surfaces: duplicate branches/helpers to collapse, generic comments to delete, large modules/functions to split or explicitly defer, docs to shorten, abstractions that must justify their existence, and the post-wave scorecard delta.
  - docs/audit/M26C_REFACTOR_RISK_RATCHET.csv — record the non-test `unsafe`, `unwrap`, `expect`, and `panic!` baseline plus allowed exceptions and reviewer sign-off requirements.
  - docs/audit/M26C_REFACTOR_OWNERSHIP.md — assign disjoint ownership for host tools, root-task adapters, HAL/network, docs/audit, and staged-run plumbing.
  - docs/BUILD_PLAN.md — keep 26c scope synchronized with the checked-in map if refactor lanes are added or deferred.
Commands:
  - rg -n "unsafe|unwrap\\(|expect\\(|panic!" apps crates tools
  - rg -n "Defines the|Provides the|CLI entry point|library surface|module for|This module|robust|flexible|seamless" apps crates tools docs README.md CONTRIBUTING.md AGENTS.md
  - cargo fmt --all -- --check
  - cargo clippy --workspace --all-targets -- -D warnings
Checks:
  - Every structural refactor target has a named owner, preserved external contracts, required characterization evidence, and an explicit rollback-sized scope.
  - Every accepted Phase 4 wave is independently reviewable and revertible, with its own target test subset and baseline comparison path.
  - Every cleanup/refactor target has a concrete simplicity target or a written deferral reason; "cleaned up" without before/after evidence is not acceptable closure.
  - New abstractions are accepted only when the scorecard shows they remove meaningful duplication, isolate authority, reduce module pressure, or make an invariant easier to audit.
  - Non-test risk indicators do not increase unless an approved exception is recorded before merge.
  - Deferred high-risk refactors have a concrete reason instead of being silently skipped.
Deliverables:
  - Checked-in refactor map, simplicity scorecard, ownership plan, and risk-ratchet baseline that make aggressive cleanup auditable.

Title/ID: m26c-docs-as-built-audit
Goal: Audit canonical documentation against the actual generated and observed system before any humanizing prose cleanup lands.
Inputs: docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/HOST_TOOLS.md, docs/SECURE9P.md, docs/SECURITY.md, docs/TEST_PLAN.md, docs/HARDWARE_BRINGUP.md, docs/USERLAND_AND_CLI.md, docs/BOOT_REFERENCE.md, docs/FAILURE_MODES.md, docs/OPERATOR_WALKTHROUGH.md, README.md, docs/snippets/*.md, apps/root-task/src/generated/*, configs/generated/root_task_resolved.json, tracked release-cut docs under releases/**, staged test evidence, scripts/ci/check_test_plan.sh
Changes:
  - docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md — trace each canonical doc surface to generated snippets, manifests, fixtures, release artifacts, or staged-run evidence.
  - docs/audit/M26C_DOC_DRIFT_LEDGER.md — record docs/script drift discovered during the audit and the closure evidence for each item.
  - docs/ARCHITECTURE.md + docs/INTERFACES.md + docs/HOST_TOOLS.md + docs/SECURE9P.md + docs/SECURITY.md + docs/TEST_PLAN.md + docs/HARDWARE_BRINGUP.md + docs/USERLAND_AND_CLI.md + docs/BOOT_REFERENCE.md + docs/FAILURE_MODES.md + docs/OPERATOR_WALKTHROUGH.md + README.md — correct any prose that does not match the current as-built system before tone cleanup begins.
  - docs/snippets/*.md + tracked release-cut docs under releases/** — verify provenance and regeneration paths; update only through the proper source or release-cut flow.
  - scripts/ci/check_test_plan.sh — update whenever 26c changes authoritative test-plan commands, stage semantics, or target-qualified PASS requirements.
Commands:
  - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json
  - scripts/check-generated.sh
  - scripts/ci/check_test_plan.sh
Checks:
  - Canonical docs can be traced to current manifests, generated snippets, fixtures, release snapshots, script behavior, or staged-run evidence.
  - Any docs/script drift is corrected or explicitly deferred with scope-safe rationale before humanizing edits are accepted.
Deliverables:
  - Auditable docs-as-built report and drift ledger proving documentation truth before presentation cleanup.

Title/ID: m26c-readme-linked-doc-suite-remediation
Milestone: Milestone 26c — Regression-Gated Refactor + Surface Audit / documentation-closure defects discovered during Milestone 26d
Goal: Maintain the human-authored documents linked directly or transitively from `README.md` as one concise, production-grade, as-built suite without changing system behavior or generated truth.
Inputs: README.md, its directly linked human-authored Markdown documents, historical glossary-bearing revisions of docs/HOST_TOOLS.md and docs/USERLAND_AND_CLI.md, AGENTS.md, docs/BUILD_PLAN.md, docs/HOST_API.md, resources/openapi/hive-gateway.yaml, docs/audit/M26C_MARKDOWN_INVENTORY.csv, docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md, docs/audit/M26C_DOC_DRIFT_LEDGER.md, docs/audit/M26C_MERMAID_INVENTORY.csv, configs/root_task*.toml, configs/generated/root_task_resolved.json, docs/snippets/*.md, current CLI help, source/tests, current target-qualified evidence, and the Milestone 26d Pi 4 proof boundary.
Changes:
  - README.md — present current scope, evidence status, supported targets, safe getting-started paths, and a categorized documentation map without release or hardware overclaiming.
  - docs/ARCHITECTURE.md + docs/INTERFACES.md + docs/SECURE9P.md + docs/ROLES_AND_SCHEDULING.md + docs/DRIVERS.md — establish non-overlapping ownership for architecture, external contracts, protocol invariants, role/scheduling policy, and physical-driver methodology.
  - docs/USERLAND_AND_CLI.md + docs/HOST_TOOLS.md + docs/API_GUIDELINES.md + docs/PYTHON_SUPPORT.md + docs/FAILURE_MODES.md + docs/OPERATOR_WALKTHROUGH.md — establish one operator journey, one tool catalogue, and cross-referenced API, Python, and recovery guidance grounded in current command help and fixtures.
  - resources/openapi/hive-gateway.yaml + docs/HOST_API.md — correct the machine-readable placement of the existing optional `TAIL lines` query and replace the stale duplicated schema mirror with a concise link-backed operator reference, without changing gateway behavior.
  - docs/USE_CASES.md + docs/HARDWARE_BRINGUP.md + docs/BOOT_REFERENCE.md + docs/GPU_NODES.md + docs/BENCHMARKS.md — separate implemented capability, current proof, historical evidence, candidate deployment patterns, and planned work; keep flash, current-image boot, transport, and benchmark proof lanes distinct.
  - docs/BUILD_PLAN.md — record this restoration-only scope and return 26c to `Complete` only after every check below passes.
  - docs/OPERATOR_RECIPES.md — when needed, own task-oriented evidence, mount, lifecycle, PEFT, and federation workflows so the canonical walkthrough remains one ordered journey.
  - docs/GLOSSARY.md — own plain-language definitions for Cohesix-specific terms and the foundational OS, security, protocol, AI, hardware, and proof concepts needed to understand them; link to owning contract documents rather than restating full schemas or limits.
  - CONTRIBUTING.md + docs/QUICKSTART.md + docs/SECURITY.md + docs/TOOLCHAIN_MAC_ARM64.md — keep the transitive onboarding and project-governance perimeter consistent with current security, validation, release, and seL4 16 requirements.
  - Canonical Mermaid blocks — retain only diagrams that materially clarify an as-built boundary or sequence; validate both syntax and semantic ownership against code, manifests, and current evidence.
  - docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md + docs/audit/M26C_DOC_DRIFT_LEDGER.md + docs/audit/M26C_MERMAID_INVENTORY.csv + docs/audit/M26C_MERMAID_GITHUB_RENDER_AUDIT.md + docs/audit/M26C_AGENT_HANDOFFS.md + docs/audit/M26C_SIMPLICITY_SCORECARD.md — refresh the live audit records with source anchors, before/after size and ownership evidence, lane handoffs, and the final Mermaid inventory/render result.
Commands:
  - git ls-files '*.md' | sort > out/audit/m26c-doc-remediation-markdown.txt
  - scripts/ci/mermaid_inventory.py --markdown-list out/audit/m26c-doc-remediation-markdown.txt --out docs/audit/M26C_MERMAID_INVENTORY.csv
  - scripts/ci/check_mermaid_github.sh --markdown-list out/audit/m26c-doc-remediation-markdown.txt
  - scripts/ci/render_mermaid_github.sh --markdown-list out/audit/m26c-doc-remediation-markdown.txt --out out/audit/m26c-doc-remediation-mermaid-rendered
  - scripts/check-generated.sh
  - scripts/ci/check_test_plan.sh
  - scripts/ci/test_plan_run.sh --list
  - python3 scripts/ci/check_driver_test_coverage.py
  - cargo check --workspace
  - cargo test -p hive-gateway
  - git diff --check
Checks:
  - Every directly linked canonical document has one stated purpose, an explicit as-built or planning boundary, retained 2026 Lukas Bower metadata, and useful cross-references instead of copied contracts.
  - Every transitive onboarding, contribution, security, and toolchain guide reached from the suite is current, secret-safe, reproducible, and consistent with the charter.
  - Durable public namespace, record, derivation, evidence-pack, driver-profile, and simulation contracts remain documented even when generated mirrors and historical debug prose are removed.
  - Every Cohesix-specific term used by the README documentation map is defined for a newcomer or points to a more specific canonical definition; collision-prone terms such as LoRA prose versus lowercase `lora` identifiers, NineDoor/NineDoorBridge, host/target, mock/QEMU/hardware, and source/resolved manifest are explicitly distinguished.
  - Selected-profile manifests, resolved output, generated snippets, current source/tests, and target-qualified evidence remain authoritative; generated snippets are linked or reproduced only through their generator and are not hand-edited.
  - Current QEMU evidence, accepted historical Pi 4 evidence, current-image Pi 4 revalidation, Wi-Fi research status, host-only integrations, and future milestones are never presented as interchangeable proof.
  - All local links and referenced anchors resolve, code fences are balanced, Markdown is structurally consistent, and every active Mermaid block passes the GitHub compatibility checker plus an available CLI render pass.
  - No runtime command, endpoint implementation, namespace, ACK/ERR/END behavior, authority path, release snapshot, or hardware acceptance state changes under the documentation rewrite; the OpenAPI correction describes existing handler behavior.
Deliverables:
  - A reviewable README-linked documentation suite with clear information ownership, materially less repetition, complete GitHub-compatible diagrams, and validation evidence.

Title/ID: m26c-runtime-boundary-and-semantic-parity-audit
Goal: Document the intentional host `std` / VM `no_std` runtime split and prove overlapping NineDoor semantics remain aligned without runtime convergence.
Inputs: apps/root-task/src/ninedoor.rs, apps/root-task/src/event/**, apps/root-task/src/console/**, apps/root-task/src/log_buffer.rs, apps/root-task/src/lib.rs, apps/root-task/src/net/**, apps/root-task/src/hal/**, apps/root-task/src/local_seat.rs, apps/root-task/tests/**, apps/nine-door/src/host/*.rs, apps/nine-door/tests/*.rs, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/SECURE9P.md, docs/SECURITY.md, docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md, docs/audit/M26C_REFACTOR_MAP.md
Changes:
  - docs/audit/M26C_RUNTIME_BOUNDARY_AUDIT.md — record VM TCB boundaries, forbidden host-side capabilities in the VM, and adapter ownership of host/VM surfaces.
  - docs/audit/M26C_NINEDOOR_PARITY_MATRIX.md — enumerate overlapping host/VM semantics, expected outputs, and evidence paths for each parity claim.
  - docs/ARCHITECTURE.md + docs/INTERFACES.md + docs/SECURE9P.md + docs/SECURITY.md — replace any ambiguous "eventual merge" language with explicit boundary language: separate adapters, shared contracts only.
  - apps/nine-door/tests/*.rs + apps/root-task/tests/** and host-mode root-task bridge tests — add or extend parity coverage for overlapping operator-visible surfaces without changing protocol grammar.
Commands:
  - cargo test -p nine-door --test integration
  - cargo test -p root-task --tests
  - cargo test -p root-task --lib
  - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json
Checks:
  - Checked-in audit artifacts state clearly that VM-side Cohesix remains `no_std` and that host `std` capability is not a valid convergence target.
  - Every overlapping host/VM semantic surface in the parity matrix has either passing test evidence from the relevant `apps/nine-door` and `root-task` test suites or an explicit host-only/VM-only disposition.
  - Canonical docs describe the runtime split as intentional architecture rather than an accidental temporary inconsistency.
Deliverables:
  - Auditable runtime-boundary report and semantic-parity matrix that establish the proof surface required before boundary-sensitive runtime refactors.

Title/ID: m26c-pi-runtime-dma-proof-closure
Goal: Define and prove Pi 4 isolated runtime descriptor, DMA, owner-state, and artifact-freshness evidence before 26c cleanup or later operator tooling cites the runtime path as closed.
Inputs: apps/root-task/src/hal/**, apps/root-task/src/local_seat.rs, apps/root-task/src/generated/**, apps/pi4-driver-runtime/src/**, crates/pi4-driver-abi/src/**, configs/root_task_pi4_uboot_aarch64.toml, scripts/pi4-image-build.sh, scripts/ci/test_plan_run.sh, docs/TEST_PLAN.md, docs/HARDWARE_BRINGUP.md, docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md
Changes:
  - crates/pi4-driver-abi/src/** — add or tighten descriptor-resource tests for runtime MMIO, DMA, shared-buffer, IRQ, bus-alias, and framebuffer ranges emitted by generated Pi 4 driver-image records.
  - apps/pi4-driver-runtime/src/** — add runtime tests that classify DMA reservation/allocation and owner-state evidence without relying on root-owned fallback paths.
  - apps/root-task/src/hal/** + apps/root-task/src/local_seat.rs — surface bounded evidence for DMA arena reservation, bus-address publication, cache maintenance, runtime-init descriptor delivery, and hardware-state handoff while preserving HAL-only authority.
  - docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md + docs/TEST_PLAN.md + docs/HARDWARE_BRINGUP.md — define absent, stale, generated-only, target-build, QEMU, fresh Pi hardware proof, valid counter snapshot, and arch-counter timer-backend proof states and require source artifact provenance for each claim.
  - scripts/ci/test_plan_run.sh + stage checks where needed — fail 26c Pi closure if runtime/DMA proof is absent, stale, or inferred from generated eligibility alone.
Commands:
  - cargo test -p pi4-driver-abi
  - cargo test -p pi4-driver-runtime
  - cargo test -p root-task --tests
  - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json
  - scripts/check-generated.sh
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml
  - scripts/pi4_gate_proof.sh --require-driver-task-proof
  - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26c-pi4
Checks:
  - Runtime-image eligibility, descriptor resource totals, DMA reservation/allocation evidence, owner-state fields, and source artifact freshness are reported separately.
  - Missing DMA proof is a blocking absent-evidence state, not inferred success from manifest generation, target compilation, QEMU smoke output, or stale serial logs.
  - Isolated runtime performance proof requires valid `DRIVER_TASK_COUNTER` evidence plus Pi arch-counter proof (`TIMER_BACKEND=arch-counter`, `TIMER_CLOCK_HZ=54000000`, `TIMER_EL0_COUNTER=vct`, `DUMMY_TIMER_SEEN=no`); counters alone remain diagnostic.
  - DMA ownership, cache maintenance, bus-address publication, runtime-init descriptor delivery, and hardware handoff remain behind HAL/generated interfaces with no direct MMIO or ad-hoc physical-address path.
  - Fresh Pi evidence, when claimed, names the exact serial log, manifest hash, image build, and test-plan state directory used for the claim.
Deliverables:
  - 26c-owned Pi 4 runtime/DMA proof semantics and evidence gates strong enough for later operator tools to project read-only summaries without defining acceptance.

Title/ID: m26c-dma-protection-profile-truth
Goal: Add compiler-owned DMA protection profiles that state Pi 4 as bounded no-IOMMU DMA discipline and reserve SMMU-backed isolation claims for future hardware profiles.
Inputs: tools/coh-rtc/src/ir.rs, tools/coh-rtc/src/validate.rs, configs/root_task_pi4_uboot_aarch64.toml, configs/root_task.toml, apps/root-task/src/hal/**, docs/ARCHITECTURE.md, docs/HARDWARE_BRINGUP.md, docs/SECURITY.md, docs/TEST_PLAN.md, docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md
Changes:
  - tools/coh-rtc/src/ir.rs + tools/coh-rtc/src/validate.rs — add a generated DMA protection profile enum such as `none`, `bounded_no_iommu`, `smmu_v2`, and `smmu_v3`, with Pi 4 profiles required to resolve to `bounded_no_iommu`.
  - configs/root_task_pi4_uboot_aarch64.toml + generated manifests/snippets — record Pi 4 DMA as HAL-mediated bounded DMA ownership, not hardware-enforced IOMMU/SMMU isolation.
  - apps/root-task/src/hal/** — expose profile-specific evidence fields for bounded arenas, descriptor validation, bus-address publication, cache maintenance, buffer quarantine, and absent SMMU capability.
  - docs/ARCHITECTURE.md + docs/HARDWARE_BRINGUP.md + docs/SECURITY.md + docs/TEST_PLAN.md — document the Pi 4 limitation, prohibit SMMU/IOMMU isolation wording for BCM2711, and define the future SMMU hardware contract separately.
  - docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md — add a docs-as-built check that rejects diagrams, prose, or evidence claims that imply Pi 4 malicious-device DMA confinement.
Commands:
  - cargo test -p coh-rtc dma_protection
  - cargo test -p root-task --tests dma
  - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json
  - scripts/check-generated.sh
  - rg -n "IOMMU|SMMU|hardware-enforced DMA|DMA isolation" docs README.md AGENTS.md
Checks:
  - Pi 4 manifests and docs resolve to bounded no-IOMMU DMA discipline and explicitly refuse hardware-enforced SMMU/IOMMU isolation claims.
  - Bounded Pi 4 DMA evidence covers per-driver arenas, descriptor validation, bus-address publication, cache maintenance, quarantine/reuse policy, and fresh proof provenance.
  - Future `smmu_v2` or `smmu_v3` profiles cannot be enabled unless generated per-device DMA-domain state, StreamID/context-bank or equivalent IO-space mapping policy, fault evidence, and revoke/unmap semantics are present.
  - No public doc, Mermaid diagram, evidence pack, or operator output describes BCM2711/Pi 4 as providing malicious-device DMA confinement.
Deliverables:
  - Review-grade DMA protection vocabulary that keeps Pi 4 claims honest while preserving a clean path to real SMMU-backed targets.

Inactive historical proposal — superseded as active Milestone 26c work and not
authorized by the truth-correction reopening:

Title/ID: m26c-worker-architecture-implementation
Status: Inactive and superseded as active 26c work; retained for historical traceability only.
Goal: Replace placeholder kernel-side worker GPU/LoRA paths with real seL4 worker ticket, lease, telemetry, and revocation loops matching public Queen/Worker documentation.
Inputs: apps/worker-heart/src/**, apps/worker-gpu/src/**, apps/worker-lora/src/**, apps/root-task/src/ninedoor.rs, apps/root-task/src/event/**, apps/root-task/src/lifecycle.rs, apps/root-task/src/generated/**, tools/coh-rtc/src/**, crates/cohesix-ticket/**, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/GPU_NODES.md, docs/WORKER_TICKETS.md, docs/ROLES_AND_SCHEDULING.md, docs/SECURITY.md, docs/TEST_PLAN.md
Changes:
  - apps/worker-heart/src/kernel.rs — implement the VM-side heartbeat worker loop that attaches with a scoped worker ticket, emits bounded telemetry to the documented worker path, observes lifecycle/revocation state, and exits deterministically on shutdown.
  - apps/worker-gpu/src/kernel.rs + apps/worker-gpu/src/lib.rs — replace placeholder spin/stub behavior with a no_std worker loop that consumes WorkerGpu tickets, reads lease/model pointers through the documented namespace, emits GPU lease/job telemetry receipts, and never touches CUDA/NVML or raw GPU hardware.
  - apps/worker-lora/src/lib.rs + apps/worker-lora/src/common.rs — implement the VM-side LoRA worker control/telemetry loop for ticket-scoped adapter/model lifecycle receipts while keeping training, TensorRT, CUDA, and PEFT execution host-side.
  - apps/root-task/src/ninedoor.rs + apps/root-task/src/event/** + apps/root-task/src/lifecycle.rs — publish worker namespace entries, ticket-gated attach state, lease/lifecycle revocation signals, and bounded telemetry paths needed by the VM workers without changing Secure9P grammar.
  - tools/coh-rtc/src/ir.rs + tools/coh-rtc/src/validate.rs + generated snippets — add worker-role implementation state, ticket scopes, lease paths, telemetry bounds, shutdown/revoke policy, and docs-as-built validation so public worker claims are compiler-aligned.
  - docs/ARCHITECTURE.md + docs/INTERFACES.md + docs/GPU_NODES.md + docs/WORKER_TICKETS.md + docs/ROLES_AND_SCHEDULING.md + docs/SECURITY.md + docs/TEST_PLAN.md — update public Queen/Worker behavior to match the implemented seL4 worker loops and host-only GPU/PEFT boundaries.
Commands:
  - cargo test -p worker-heart
  - cargo test -p worker-gpu
  - cargo test -p worker-lora
  - cargo test -p root-task --tests worker
  - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json
  - scripts/check-generated.sh
  - cargo check -p worker-heart --target aarch64-unknown-none
  - cargo check -p worker-gpu --target aarch64-unknown-none
  - cargo check -p worker-lora --target aarch64-unknown-none
Checks:
  - Worker-heart, worker-gpu, and worker-lora no longer rely on placeholder kernel spin loops for public VM worker semantics.
  - Each worker loop uses scoped tickets and documented namespace paths, emits bounded telemetry/receipts, and handles lease expiry, lifecycle cut, revocation, and shutdown deterministically.
  - GPU and LoRA workers remain control-plane workers only: CUDA, NVML, TensorRT, PEFT training/import execution, and raw hardware access stay host-side.
  - Generated manifests and docs agree on which worker roles are implemented, which paths they may access, and which telemetry/lease bounds apply.
  - Existing console grammar, Secure9P framing, ACK/ERR/END behavior, and host-side worker helper APIs do not drift.
Deliverables:
  - Real seL4 worker architecture matching public Queen/Worker docs, with host/VM boundaries and tests strong enough for 26c closure.

Inactive historical proposal — superseded as active Milestone 26c work and not
authorized by the truth-correction reopening:

Title/ID: m26c-cap-backed-worker-endpoints
Status: Inactive and superseded as active 26c work; retained for historical traceability only.
Goal: Make first-phase VM worker tickets cap-backed by requiring badged seL4 endpoint capabilities for worker attach, telemetry, lease renewal, and revocation-sensitive paths.
Inputs: apps/root-task/src/lifecycle.rs, apps/root-task/src/ninedoor.rs, apps/root-task/src/event/**, apps/root-task/src/generated/**, apps/worker-heart/src/**, apps/worker-gpu/src/**, apps/worker-lora/src/**, tools/coh-rtc/src/**, crates/cohesix-ticket/**, docs/WORKER_TICKETS.md, docs/ROLES_AND_SCHEDULING.md, docs/SECURITY.md, docs/INTERFACES.md
Changes:
  - apps/root-task/src/lifecycle.rs + apps/root-task/src/event/** — mint role/lease/epoch-badged endpoint caps for worker attach, control, telemetry, and revoke-sensitive receipt paths; retain the parent cap path needed to revoke derived lease caps.
  - apps/root-task/src/ninedoor.rs — reject worker attach, telemetry append, lease-renewal, and receipt paths when only ticket metadata is present and no matching badged endpoint cap was invoked.
  - apps/worker-heart/src/** + apps/worker-gpu/src/** + apps/worker-lora/src/** — replace metadata-only ticket presentation with endpoint-cap invocation in the worker loops while preserving bounded no_std behavior.
  - tools/coh-rtc/src/** + generated snippets — add the historical proposal's phase-1 cap-backed-ticket fields for endpoint badges, lease epochs, role scopes, revoke behavior, and explicit deferred full-cap-bundle status. This design was never accepted; Milestone 26e now owns the complete live Worker bundle and Milestone 27e only adds production ticket/lease ledger binding.
  - docs/WORKER_TICKETS.md + docs/ROLES_AND_SCHEDULING.md + docs/SECURITY.md + docs/INTERFACES.md — document Cohesix tickets as audit records backed by badged endpoint caps for VM worker authority.
Commands:
  - cargo test -p root-task --tests worker
  - cargo test -p worker-heart
  - cargo test -p worker-gpu
  - cargo test -p worker-lora
  - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json
  - scripts/check-generated.sh
  - cargo check -p worker-heart --target aarch64-unknown-none
  - cargo check -p worker-gpu --target aarch64-unknown-none
  - cargo check -p worker-lora --target aarch64-unknown-none
Checks:
  - Forged ticket strings or stale ticket metadata without the corresponding badged endpoint cap cannot attach as a worker, renew a lease, emit accepted telemetry, or publish a valid receipt.
  - Revocation deletes or invalidates the derived endpoint caps and late invocations from the old lease epoch fail deterministically.
  - Historical generated manifests and docs would have distinguished phase-1 endpoint-cap-backed tickets from later work; active planning instead requires complete live bundles in Milestone 26e and production ledger binding in Milestone 27e.
  - Existing Secure9P grammar, console ACK/ERR/END behavior, and host-ticket schemas do not drift.
Deliverables:
  - First-phase cap-backed VM worker ticket authority with concrete seL4 endpoint caps and negative tests, without overclaiming full frame/notification/DMA cap-bundle isolation.

Inactive historical proposal — superseded as active Milestone 26c work and not
authorized by the truth-correction reopening:

Title/ID: m26c-notification-backed-worker-lifecycle
Status: Inactive and superseded as active 26c work; retained for historical traceability only.
Goal: Replace lifecycle polling dependency with generated seL4 notification objects for worker revoke, shutdown, lease expiry, telemetry pressure, and driver IRQ wakeups.
Inputs: apps/root-task/src/lifecycle.rs, apps/root-task/src/event/**, apps/root-task/src/hal/**, apps/root-task/src/generated/**, apps/worker-heart/src/**, apps/worker-gpu/src/**, apps/worker-lora/src/**, apps/pi4-driver-runtime/src/**, tools/coh-rtc/src/**, docs/ROLES_AND_SCHEDULING.md, docs/SECURITY.md, docs/INTERFACES.md, docs/TEST_PLAN.md
Changes:
  - tools/coh-rtc/src/** — add generated notification lifecycle fields and badge classes for revoke, shutdown, lease-expiry, telemetry-pressure, and IRQ events where applicable.
  - apps/root-task/src/lifecycle.rs + apps/root-task/src/event/** — publish notification caps/badges to worker loops and signal lifecycle changes without introducing new protocols or namespace grammar.
  - apps/root-task/src/hal/** + apps/pi4-driver-runtime/src/** — keep driver IRQ delivery notification-backed and expose bounded evidence for notification badges and acknowledgement behavior.
  - apps/worker-heart/src/** + apps/worker-gpu/src/** + apps/worker-lora/src/** — wait on endpoint IPC plus notification delivery for lifecycle changes, and remove unbounded lifecycle polling from worker loops.
  - docs/ROLES_AND_SCHEDULING.md + docs/SECURITY.md + docs/INTERFACES.md + docs/TEST_PLAN.md — document the historical notification-backed lifecycle proposal and badge meanings. This design was never accepted; Milestone 26e now owns complete lifecycle/completion notification authority and Milestone 27e only binds the accepted Worker bundle to production ticket/lease ledgers.
Commands:
  - cargo test -p root-task --tests worker
  - cargo test -p root-task --tests notification
  - cargo test -p worker-heart
  - cargo test -p worker-gpu
  - cargo test -p worker-lora
  - cargo test -p pi4-driver-runtime
  - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json
  - scripts/check-generated.sh
Checks:
  - Revoke, shutdown, lease-expiry, telemetry-pressure, and applicable IRQ events are delivered through generated notification caps/badges rather than unbounded lifecycle polling.
  - Worker loops block or yield deterministically while waiting for endpoint IPC or notification events and still handle lease expiry, revoke, telemetry backpressure, and shutdown.
  - Driver IRQ notification behavior remains HAL-owned and does not create a new polling path or direct IRQ bypass outside generated descriptors.
  - Historical generated docs would have distinguished the 26c notification proposal from later work; active planning instead requires complete lifecycle/completion notification authority in Milestone 26e and production ledger binding in Milestone 27e.
Deliverables:
  - Event-driven worker and driver lifecycle signaling with seL4 notification objects, bounded tests, and no new Cohesix protocol surface.

Inactive historical proposal — superseded as active Milestone 26c work and not
authorized by the truth-correction reopening. Its future replacement is owned
by the staged Milestone 26e MCS tasks and must satisfy
`docs/audit/M26D_MCS_DECISION.md` first:

Title/ID: m26c-worker-driver-mcs-budget-evidence
Status: Inactive and superseded as active 26c work; retained for historical traceability only.
Goal: Preserve the record of the rejected 26c dual-scheduler proposal without authorizing its fallback design.
Inputs: docs/audit/M26D_MCS_DECISION.md, Milestone 26e `m26e-mcs-abi-foundation`, Milestone 26e `m26e-mcs-smp-target-acceptance`.
Changes:
  - None authorized. Milestone 26e replaces this proposal with one SMP+MCS QEMU/Pi architecture and no compiled classic fallback.
Commands:
  - None; this task is not executable.
Checks:
  - No implementation or fallback-profile claim cites this historical proposal.
Deliverables:
  - Traceability from the superseded proposal to the selected Milestone 26e SMP+MCS tasks.

Title/ID: m26c-post-behavior-baseline-freeze
Goal: Freeze the external behavior snapshot after the authorized 26c worker/runtime additions and before cleanup refactors begin.
Inputs: docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md, docs/audit/M26C_RUNTIME_BOUNDARY_AUDIT.md, docs/audit/M26C_NINEDOOR_PARITY_MATRIX.md, docs/audit/M26C_TARGET_RUNNER_BASELINE.md, docs/audit/M26C_REFACTOR_MAP.md, apps/root-task/tests/**, apps/nine-door/tests/**, worker test suites, generated snippets/manifests, scripts/ci/test_plan_run.sh, scripts/ci/check_test_plan.sh
Changes:
  - docs/audit/M26C_POST_BEHAVIOR_BASELINE.md — record the post-Phase-2 external contract snapshot: console grammar, Secure9P/NineDoor namespace semantics, manifest and generated-snippet hashes, worker ticket/lease/telemetry/lifecycle behavior, cap-backed endpoint evidence, notification evidence, then-current scheduling evidence, Pi runtime/DMA evidence classifications, and known deferred blockers.
  - docs/audit/M26C_REFACTOR_MAP.md — link every Phase 4 cleanup candidate to the relevant post-behavior baseline section and preserved-contract list.
  - docs/audit/M26C_AGENT_HANDOFFS.md — record the freeze decision, commands, skipped commands, residual blockers, and PASS/FAIL status before any cleanup lane starts.
  - docs/TEST_PLAN.md — state that Phase 4 refactors compare against the post-behavior baseline rather than pre-26c placeholder worker behavior.
Commands:
  - scripts/check-generated.sh
  - cargo test -p nine-door --test integration
  - cargo test -p root-task --tests
  - cargo test -p worker-heart
  - cargo test -p worker-gpu
  - cargo test -p worker-lora
  - scripts/ci/check_test_plan.sh
  - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26c-post-behavior-qemu
  - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26c-post-behavior-pi4
Checks:
  - The baseline is recorded only after all authorized Phase 2 behavior-changing tasks are complete or explicitly deferred without being used as satisfied evidence.
  - Refactor waves use this post-behavior snapshot as their preserved external contract, so cleanup does not accidentally revert or mutate the new intended worker/cap/notification/MCS behavior.
  - Any remaining Pi 4 or runner blocker is recorded with dependency impact, and no Phase 4 task cites blocked evidence as proof.
  - The target-qualified QEMU/Pi 4 state dirs and command outputs named in the baseline match the runner contract from `m26c-target-qualified-runner-baseline`.
Deliverables:
  - Hard baseline separating authorized 26c behavior changes from later behavior-preserving cleanup.

Title/ID: m26c-characterization-gates-before-refactor
Goal: Add characterization tests and merge gates around cleanup-sensitive crates before accepting structural refactors.
Inputs: .github/workflows/ci.yml, scripts/ci/test_plan_run.sh, scripts/ci/test_plan_stage_*.sh, scripts/ci/check_test_plan.sh, apps/coh/src/mount.rs, apps/cohsh/src/**, crates/cohsh-core/**, apps/host-ticket-agent/src/*.rs, apps/gpu-bridge-host/src/**, apps/root-task/src/net/**, apps/root-task/src/hal/**, apps/root-task/src/local_seat.rs, apps/root-task/src/ninedoor.rs, apps/root-task/src/event/**, apps/root-task/src/console/**, apps/pi4-driver-runtime/**, crates/pi4-driver-abi/**, apps/nine-door/tests/*.rs, docs/TEST_PLAN.md, docs/audit/M26C_REFACTOR_MAP.md
Changes:
  - .github/workflows/ci.yml — stop excluding cleanup-sensitive crates without compensating gate coverage, or add explicit targeted jobs for `coh`, `cohsh`, `cohsh-core`, `host-ticket-agent`, `gpu-bridge-host`, `root-task`, `pi4-driver-abi`, `pi4-driver-runtime`, and `nine-door` parity surfaces.
  - scripts/ci/test_plan_stage_02_host_fast.sh — exercise `coh`, `cohsh`, `cohsh-core`, `host-ticket-agent`, `gpu-bridge-host`, `nine-door` integration coverage, `root-task --tests`, `root-task --lib`, `pi4-driver-abi`, `pi4-driver-runtime`, and VM-target boundary checks as first-class checks.
  - scripts/ci/check_test_plan.sh — enforce the updated target-aware staged-run contract and authoritative command matrix.
  - docs/TEST_PLAN.md — document the expanded cleanup-target coverage, VM boundary evidence, target-qualified artifacts, post-behavior baseline comparison, and required artifact retention.
  - apps/coh/src/mount.rs + apps/cohsh/src/** + crates/cohsh-core/** + apps/host-ticket-agent/src/*.rs + apps/gpu-bridge-host/src/** + selected apps/root-task/src/* helpers + selected `apps/nine-door` and root-task parity surfaces — add characterization tests for current outputs, errors, and state transitions before refactor.
Commands:
  - cargo test -p coh --features mock
  - cargo test -p cohsh
  - cargo test -p cohsh-core
  - cargo test -p host-ticket-agent
  - cargo test -p gpu-bridge-host
  - cargo test -p nine-door --test integration
  - cargo test -p root-task --tests
  - cargo test -p root-task --lib
  - cargo test -p pi4-driver-abi
  - cargo test -p pi4-driver-runtime
  - cargo check -p pi4-driver-runtime --target aarch64-unknown-none
  - rg -n "unsafe|unwrap\\(|expect\\(|panic!" apps crates tools
  - scripts/ci/check_test_plan.sh
Checks:
  - Cleanup-sensitive crates have deterministic tests that pin current operator-visible behavior.
  - Characterization artifacts name the post-behavior baseline section they preserve, so behavior-changing Phase 2 work and behavior-preserving Phase 4 cleanup cannot be conflated.
  - Driver runtime ABI descriptors, isolated runtime service turns, acceptance-eligibility fixtures, and board-proof boundaries remain pinned before cleanup touches driver-task code.
  - CI and staged test-plan coverage run those tests automatically and retain root-task VM-boundary evidence and target-qualified staged-run artifacts.
  - Risk-ratchet output is attached to refactor reviews and does not drift without an approved exception.
Deliverables:
  - Regression safety net expanded ahead of structural cleanup.

Title/ID: m26c-no-std-boundary-gates
Goal: Add explicit CI and audit gates that fail if host-side capability leaks into the VM build across the closure profiles used by 26c.
Inputs: .github/workflows/ci.yml, scripts/ci/test_plan_stage_02_host_fast.sh, apps/root-task/Cargo.toml, apps/nine-door/Cargo.toml, apps/pi4-driver-runtime/Cargo.toml, crates/pi4-driver-abi/Cargo.toml, configs/root_task.toml, configs/root_task_pi4_uboot_aarch64.toml, docs/TEST_PLAN.md, docs/ARCHITECTURE.md
Changes:
  - .github/workflows/ci.yml — add root-task VM-profile and `pi4-driver-runtime` `no_std` checks and archive dependency-tree artifacts for the QEMU `cohesix-dev` and Pi 4 U-Boot closure profiles at minimum.
  - scripts/ci/test_plan_stage_02_host_fast.sh — emit `out/audit/m26c_root_task_tree_qemu.txt`, `out/audit/m26c_root_task_tree_pi4.txt`, and driver-runtime VM-target dependency evidence (or equivalent state-dir artifacts) from the VM-target dependency tree as part of cleanup gating.
  - docs/TEST_PLAN.md + docs/ARCHITECTURE.md — document the VM boundary gate, expected artifacts, and interpretation rules per closure profile.
  - docs/BUILD_PLAN.md — record that shared semantic helpers are allowed only when they remain `no_std`-safe and do not drag host-side crates into the VM build.
Commands:
  - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "cohesix-dev"
  - cargo tree -p root-task --target aarch64-unknown-none -e normal --no-default-features --features "cohesix-dev" > out/audit/m26c_root_task_tree_qemu.txt
  - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "kernel bootstrap-trace serial-console net-console"
  - cargo tree -p root-task --target aarch64-unknown-none -e normal --no-default-features --features "kernel bootstrap-trace serial-console net-console" > out/audit/m26c_root_task_tree_pi4.txt
  - cargo check -p pi4-driver-runtime --target aarch64-unknown-none
  - cargo tree -p pi4-driver-runtime --target aarch64-unknown-none -e normal > out/audit/m26c_pi4_driver_runtime_tree.txt
  - scripts/ci/check_test_plan.sh
Checks:
  - The VM-target root-task build and Pi 4 isolated driver runtime build remain `no_std` and succeed without host-side operator/tooling dependencies across the closure profiles.
  - The dependency-tree artifacts are reviewed as part of 26c evidence and show no accidental pull-in of host-only surfaces.
  - Cleanup work cannot merge if boundary evidence is missing or contradicts the documented VM/host split.
Deliverables:
  - Explicit per-profile `no_std` boundary gate for cleanup-era work, reducing drift risk without touching runtime behavior.

Title/ID: m26c-low-risk-surface-cleanup
Goal: Humanize the highest-visibility low-risk code and doc surfaces after docs-as-built, AI-fingerprint, characterization, and no-std gates cover the touched surface.
Inputs: apps/*/README.md, crates/**/README.md, tools/cohesix-py/README.md, tests/integration/README.md, public crate roots under apps/*/src/lib.rs, tests/**/*.rs, docs/OPERATOR_WALKTHROUGH.md, docs/QUICKSTART.md, docs/QUICKSTART_ALPHA.md, docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md, docs/audit/M26C_AI_FINGERPRINT_AUDIT.md
Changes:
  - apps/*/README.md + crates/**/README.md + tools/cohesix-py/README.md + tests/integration/README.md — replace template summaries with role-specific descriptions, assumptions, and operator-facing boundaries.
  - apps/*/src/lib.rs + apps/*/src/main.rs + crates/**/src/lib.rs — remove generic module-surface comments and rewrite surviving doc comments around invariants or usage.
  - tests/**/*.rs — rename template-like test names/descriptions to scenario-driven names and tighten helper naming.
  - docs/OPERATOR_WALKTHROUGH.md + docs/QUICKSTART.md + docs/QUICKSTART_ALPHA.md — remove repetitive prose and keep operator sequences concrete.
Commands:
  - cargo test -p secure9p-core
  - cargo test -p cohsh-core
  - cargo test -p tests --quiet
Checks:
  - High-visibility surface files read as authored, file-specific documentation instead of generated scaffolding.
  - Humanized docs remain consistent with the audit evidence produced by `m26c-docs-as-built-audit`.
  - AI-fingerprint findings for touched low-risk surfaces are closed or explicitly deferred in `docs/audit/M26C_AI_FINGERPRINT_AUDIT.md`.
  - Each cleanup batch maps to one accepted wave in `M26C_REFACTOR_MAP.md`, with a preserved-contract list, targeted tests, and before/after scorecard evidence.
  - The simplicity scorecard shows net clarity improvement for touched surfaces; cleanup-only changes that add more prose, wrappers, or concepts than they remove require explicit reviewer justification.
  - Test names and doc comments describe behaviors and scenarios, not file names.
Deliverables:
  - First-wave cleanup across low-risk surfaces with zero behavior changes and passing tests.

Title/ID: m26c-host-tool-structural-cleanup
Goal: Refactor repetitive host-side validation, transport, and ticket-processing flows once characterization tests are in place.
Inputs: apps/coh/src/**, apps/cohsh/src/**, crates/cohsh-core/**, apps/host-ticket-agent/src/**, apps/gpu-bridge-host/src/**, apps/hive-gateway/src/**, tools/cohesix-py/cohesix/**, docs/ARCHITECTURE.md, docs/HOST_TOOLS.md, docs/INTERFACES.md, docs/API_GUIDELINES.md
Changes:
  - apps/host-ticket-agent/src/** — factor manifest validation, ticket-processing branches, executor selection, and receipt handling into explicit invariant-bearing helpers without changing lifecycle semantics.
  - apps/coh/src/** + apps/cohsh/src/** + crates/cohsh-core/** — consolidate duplicated path, grammar, request-auth, mount, and transport validation while preserving ACK/ERR/END, FUSE, REST, and TCP behavior.
  - apps/gpu-bridge-host/src/** + apps/hive-gateway/src/** — tighten host-only boundary checks, error shaping, and telemetry/report formatting without changing documented host-side contracts.
  - tools/cohesix-py/cohesix/** — align Python-side validation and examples with the same documented host API contracts where characterization coverage exists.
  - docs/ARCHITECTURE.md + docs/HOST_TOOLS.md + docs/INTERFACES.md + docs/API_GUIDELINES.md — update any as-built explanations needed to reflect clearer code structure while preserving external contracts.
Commands:
  - cargo test -p host-ticket-agent
  - cargo test -p coh --features mock
  - cargo test -p cohsh
  - cargo test -p cohsh-core
  - cargo test -p gpu-bridge-host
  - cargo test -p hive-gateway
  - python3 -m pytest tools/cohesix-py/tests -q
  - cargo clippy --workspace --all-targets -- -D warnings
Checks:
  - Host-side cleanup reduces repetition and makes invariants explicit without protocol, file-layout, receipt, or request-auth drift.
  - Each host-tool refactor wave is independently reviewable and revertible, with one owner, one preserved-contract list, one characterization artifact, and one targeted test subset recorded before edits.
  - Characterization tests stay unchanged and passing across refactors.
Deliverables:
  - Human-readable host-side control-plane code with preserved external behavior and tighter shared validation boundaries.

Title/ID: m26c-root-task-runtime-decomposition
Goal: Decompose root-task runtime adapter code into smaller invariant-bearing modules after parity and `no_std` gates pin behavior.
Inputs: apps/root-task/src/lib.rs, apps/root-task/src/ninedoor.rs, apps/root-task/src/event/**, apps/root-task/src/console/**, apps/root-task/src/log_buffer.rs, apps/root-task/src/audit/**, apps/root-task/src/bootstrap/**, apps/root-task/src/hal/driver_task.rs, apps/root-task/tests/**, apps/pi4-driver-runtime/**, crates/pi4-driver-abi/**, configs/root_task*.toml, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/SECURE9P.md, docs/TEST_PLAN.md, docs/audit/M26C_RUNTIME_BOUNDARY_AUDIT.md, docs/audit/M26C_NINEDOOR_PARITY_MATRIX.md
Changes:
  - apps/root-task/src/ninedoor.rs + apps/root-task/src/event/** + apps/root-task/src/console/** — split parsing, dispatch, event pumping, completion formatting, and permission-denial paths into narrowly named modules without changing console grammar or Secure9P namespace semantics.
  - apps/root-task/src/log_buffer.rs + selected `/proc` emitters — extract append-only, cursor, and evidence formatting helpers while preserving current output fixtures.
  - apps/root-task/src/lib.rs + apps/root-task/src/bootstrap/** + apps/root-task/src/hal/driver_task.rs — clarify initialization sequencing, generated-manifest handoff boundaries, and manifest-declared isolated driver runtime descriptor ownership without moving authority out of compiler-generated artifacts.
  - apps/pi4-driver-runtime/** + crates/pi4-driver-abi/** — keep ABI and runtime changes behavior-preserving, pointer-free, and aligned with generated `root_task.driver_images` records.
  - apps/root-task/tests/** + apps/nine-door/tests/*.rs — preserve and extend parity fixtures before and after the decomposition.
  - docs/ARCHITECTURE.md + docs/INTERFACES.md + docs/SECURE9P.md + docs/TEST_PLAN.md — update as-built module ownership only when public contracts or evidence paths become clearer.
Commands:
  - cargo test -p nine-door --test integration
  - cargo test -p root-task --tests
  - cargo test -p root-task --lib
  - cargo test -p pi4-driver-abi
  - cargo test -p pi4-driver-runtime
  - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "cohesix-dev"
  - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "kernel bootstrap-trace serial-console net-console"
  - cargo check -p pi4-driver-runtime --target aarch64-unknown-none
  - cargo clippy --workspace --all-targets -- -D warnings
Checks:
  - Root-task decomposition preserves ACK/ERR/END grammar, namespace layout, `/proc` output shapes, event ordering, append-only behavior, and generated-manifest authority.
  - Linked driver-runtime descriptor handling, fixed-ring command/completion ABI, and acceptance-eligibility classification remain unchanged unless a reopened 26a/26b acceptance task changes them with hardware evidence.
  - VM-target builds remain `no_std` across QEMU and Pi 4 closure profiles.
  - Each root-task decomposition wave has a baseline-linked preserved-contract list and can be reverted without undoing unrelated worker/runtime behavior.
  - No new `unsafe`, `unwrap`, `expect`, or `panic!` appears in non-test root-task code without an approved exception.
Deliverables:
  - Smaller root-task runtime modules with preserved operator-visible behavior and explicit boundary evidence.

Title/ID: m26c-hal-network-and-local-seat-decomposition
Goal: Refactor Pi 4 HAL-facing network, Wi-Fi, and local-seat code into clearer bounded units and narrow SDIO/USB platform seams without changing boot policy, transcripts, or device authority.
Inputs: apps/root-task/src/hal/**, apps/root-task/src/net/**, apps/root-task/src/drivers/**, apps/root-task/src/local_seat.rs, apps/root-task/src/generated/**, apps/pi4-driver-runtime/**, crates/pi4-driver-abi/**, configs/root_task_pi4_uboot_aarch64.toml, docs/HARDWARE_BRINGUP.md, docs/NETWORK_CONFIG.md, docs/BOOT_REFERENCE.md, docs/TEST_PLAN.md
Changes:
  - apps/root-task/src/net/** — separate policy parsing, DHCP state, static IPv4 validation, active/standby interface selection, and evidence formatting while preserving manifest and DTB override semantics.
  - apps/root-task/src/hal/** + apps/root-task/src/drivers/** + apps/pi4-driver-runtime/** + crates/pi4-driver-abi/** — keep all device access behind HAL traits, split device-state and firmware/handoff bookkeeping from transcript emission, preserve isolated runtime command ownership, extract current-behavior-only SDIO host and USB platform/DMA seams after characterization tests exist, and remove duplicated bounds checks under the same evidence gate.
  - apps/root-task/src/local_seat.rs — isolate local-seat input/display policy from boot evidence and network policy handoff code without changing first-boot operator behavior.
  - docs/HARDWARE_BRINGUP.md + docs/NETWORK_CONFIG.md + docs/BOOT_REFERENCE.md + docs/TEST_PLAN.md — update as-built explanations and evidence commands for any clearer module boundaries.
Commands:
  - cargo test -p root-task --tests
  - cargo test -p root-task --lib
  - cargo test -p pi4-driver-abi
  - cargo test -p pi4-driver-runtime
  - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "kernel bootstrap-trace serial-console net-console"
  - cargo check -p pi4-driver-runtime --target aarch64-unknown-none
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml
  - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26c-pi4
Checks:
  - HAL access remains centralized behind HAL traits; no direct MMIO, physical address, DMA publication, IRQ binding, or firmware-service shortcuts are introduced outside HAL.
  - New SDIO/USB seams are extraction-only, have before/after characterization evidence, and do not add new hardware support or generic future-driver behavior.
  - Each HAL/network/local-seat wave is isolated to one preserved behavior surface and records the exact tests plus Pi 4/QEMU evidence needed to prove no transcript or authority drift.
  - Isolated runtime acceptance eligibility and the separate fresh-Pi board-proof boundary remain explicit until owner-state proof and fresh Pi hardware evidence close them.
  - Boot transcripts, `netstats`, `netstatus`, DHCP/static policy evidence, Wi-Fi fallback semantics, and no-NIC compatibility remain unchanged unless a separately approved breaking-change path is followed.
  - Pi 4 staged evidence proves the refactor did not regress local-seat, network-policy, or U-Boot handoff behavior.
Deliverables:
  - Clearer Pi 4 HAL/network/local-seat modules with preserved hardware bring-up semantics and explicit SDIO/USB platform seams ready for later milestone evaluation.

Title/ID: m26c-full-test-plan-qemu-and-pi4
Goal: Make full staged Test Plan PASS on both QEMU and Pi 4 the explicit closure gate for 26c.
Inputs: docs/TEST_PLAN.md, docs/HARDWARE_BRINGUP.md, docs/audit/M26C_TARGET_RUNNER_BASELINE.md, docs/audit/M26C_POST_BEHAVIOR_BASELINE.md, scripts/ci/test_plan_run.sh, scripts/ci/test_plan_stage_*.sh, scripts/ci/check_test_plan.sh, scripts/pi4-image-build.sh, scripts/uboot/qemu-uboot-smoke.sh
Changes:
  - docs/TEST_PLAN.md — verify QEMU and Pi 4 execution matrices, evidence paths, PASS criteria, and target-qualified artifact requirements still match the early runner baseline and post-behavior baseline.
  - docs/HARDWARE_BRINGUP.md — verify Pi 4 hardware setup, log capture, and operator prerequisites remain sufficient to run the full Test Plan.
  - scripts/ci/test_plan_run.sh + scripts/ci/test_plan_stage_*.sh — use the already implemented `--target qemu|pi4` contract to archive final target-qualified evidence without pretending QEMU and Pi 4 evidence are identical.
  - scripts/ci/check_test_plan.sh — enforce final alignment between target-aware docs, stage scripts, baseline artifacts, and authoritative commands.
  - scripts/pi4-image-build.sh — produce deterministic artifacts consumed by Pi 4 staged test-plan runs.
Commands:
  - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26c-qemu
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml
  - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26c-pi4
Checks:
  - The staged runner produces `stage_01.done` through `stage_05.done` for both QEMU and Pi 4 state dirs.
  - Neither state dir contains `*.incomplete` markers.
  - Stage 05 verifies the required target-qualified artifacts exist before writing `stage_05.done`.
  - Pi 4 evidence includes serial logs, network or console validation, and due-diligence outputs matching the documented PASS contract.
Deliverables:
  - Full Test Plan PASS on QEMU and Pi 4 as the hard milestone exit criterion, with archived evidence for both targets.

Title/ID: m26d-kernel-provenance-refresh
Goal: Refresh Cohesix seL4 baseline inputs and record accepted seL4 16.0.0 provenance.
Inputs: external seL4 source/build trees, seL4 16.0.0 release notes, official seL4 Reference Manual v16.0.0 PDF (`https://sel4.systems/Info/Docs/seL4-manual-16.0.0.pdf`), docs/TOOLCHAIN_MAC_ARM64.md, README.md.
Changes:
  - docs/TOOLCHAIN_MAC_ARM64.md — record the accepted seL4 16.0.0 baseline and external-build expectations.
  - README.md — update high-level kernel/manual baseline references if they mention stale versions or assumptions.
  - seL4/ — refresh tracked manual/reference artifacts only if the repo continues carrying them as canonical mirrors.
Commands: cargo check --workspace
Checks: canonical docs and carried references identify the accepted seL4 16.0.0 baseline with no stale older-manual pin left in normative guidance.
Deliverables: updated docs/reference provenance and a checked-in note of the accepted upstream version/commit.

Title/ID: m26d-sel4-api-compat-audit
Goal: Bring Cohesix-owned seL4 bindings/runtime/bootstrap code into clean alignment with seL4 16 generated artifacts.
Inputs: crates/sel4-sys, crates/sel4-runtime, crates/pi4-driver-abi, apps/pi4-driver-runtime, apps/root-task, configs/root_task*.toml, out/sel4/profile-v2/qemu-smp-production, out/sel4/profile-v2/qemu-smp-diagnostic, out/sel4/profile-v2/pi4-production, out/sel4/profile-v2/pi4-diagnostic, and the repo-managed `seL4/{build,SMP_build,build_UBOOT}` v16 reference mirrors.
Changes:
  - crates/sel4-sys — compatibility fixes required by seL4 16 headers/generated metadata.
  - crates/sel4-runtime — compatibility fixes required by seL4 16 root-task startup behavior.
  - crates/pi4-driver-abi + apps/pi4-driver-runtime — compatibility fixes required by seL4 16 runtime-init descriptor layout, pointer-free ring transport, or target build rules.
  - apps/root-task — bootstrap and generated driver-image handoff adjustments only where required by seL4 16 semantics.
Commands:
  - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "cohesix-dev"
  - cargo test -p pi4-driver-abi
  - cargo test -p pi4-driver-runtime
  - cargo check -p pi4-driver-runtime --target aarch64-unknown-none
Checks: direct-seL4 Cohesix builds compile on all supported kernel profiles, and manifest-declared isolated driver runtime ABI/build evidence stays green, without changing system model or operator-visible semantics.
Deliverables: passing workspace/build-target checks and refreshed low-level compatibility evidence.

Title/ID: m26d-pi4-counter-contract-refresh
Goal: Reprove the Pi 4 virtual-counter timer contract on the seL4 16 baseline before accepting isolated runtime latency or performance evidence.
Inputs: fresh-source Pi profile audit outputs, the repo-managed immutable `seL4/build_UBOOT` v16 diagnostic artifact input, apps/root-task/build.rs, apps/root-task/src/arch/aarch64/timer.rs, apps/pi4-driver-runtime/build.rs, apps/pi4-driver-runtime/src/lib.rs, scripts/pi4-image-build.sh, scripts/pi4_gate_proof.sh, scripts/pi4_trace_normalize.py, docs/HARDWARE_BRINGUP.md, docs/TEST_PLAN.md.
Changes:
  - scripts/pi4-image-build.sh — keep seL4 16 Pi 4 staging blocked unless VCNT export is enabled, physical counter/timer-control exports are disabled, and generated `TIMER_CLOCK_HZ` matches the accepted Pi profile.
  - apps/root-task/build.rs + apps/root-task/src/arch/aarch64/timer.rs — preserve root-task build/runtime checks that use `CNTVCT_EL0` only under the `timers-arch-counter` profile and scale elapsed-time proof from generated frequency.
  - apps/pi4-driver-runtime/build.rs + apps/pi4-driver-runtime/src/lib.rs — preserve isolated runtime build/runtime checks and `RuntimeDeadline` conversion from legacy retry counts to counter-backed deadlines.
  - scripts/pi4_gate_proof.sh + scripts/pi4_trace_normalize.py + docs/HARDWARE_BRINGUP.md + docs/TEST_PLAN.md — ensure refreshed Pi 4 proof gates require `TIMER_BACKEND=arch-counter`, `TIMER_CLOCK_HZ=54000000`, `TIMER_EL0_COUNTER=vct`, and `DUMMY_TIMER_SEEN=no` before latency proof is accepted.
Commands:
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml --venv .venv
  - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "kernel bootstrap-trace serial-console net-console"
  - cargo check -p pi4-driver-runtime --target aarch64-unknown-none
  - scripts/pi4_gate_proof.sh --require-driver-task-proof
Checks:
  - Refreshed seL4 16 Pi 4 generated headers and cache expose only the accepted virtual-counter path for EL0 timing.
  - Root-task and isolated runtime builds fail on missing VCNT export, nonzero physical-counter/timer-control export, or missing/nonzero-invalid `TIMER_CLOCK_HZ`.
  - Runtime latency telemetry and proof normalizer output reject dummy-timer captures, stale logs, physical-counter exports, and missing timer frequency as performance evidence.
Deliverables:
  - Checked-in 26d evidence tying seL4 16 provenance, Pi 4 counter configuration, isolated runtime deadline behavior, and target-qualified performance proof into one refreshed contract.

Title/ID: m26d-benchmark-revalidation-and-tuning
Goal: Revalidate and, where needed, recover the accepted 26b REST/driver-runtime benchmark envelope on the seL4 16 baseline.
Inputs: scripts/rest_perf_harness.py, tests/test_rest_perf_harness.py, tests/test_pi4_compare_driver_models.py, tools/host-bootpd/{start-en8-bootpd.zsh,install-root-bootpd.zsh,com.lukasbower.cohesix.en8-bootpd.plist,README.md}, tests/test_host_bootpd_supervisor.py, apps/root-task/src/{event/mod.rs,drivers/driver_task_net.rs,hal/driver_task.rs}, apps/pi4-driver-runtime/src/lib.rs, docs/{BENCHMARKS.md,DRIVERS.md,HARDWARE_BRINGUP.md,TEST_PLAN.md}, out/bench/m26b-* artifacts, refreshed seL4 16 QEMU/Pi build artifacts, fresh Pi serial/pcap proof for the selected transport.
Changes:
  - docs/BENCHMARKS.md — record refreshed artifact indexes, before/after verdicts, and any explicitly classified non-blocking debt.
  - scripts/rest_perf_harness.py + tests/test_rest_perf_harness.py — provenance/reporting or strictness fixes only when needed to compare the seL4 16 run against the accepted 26b workload without changing the workload contract.
  - tools/host-bootpd/{start-en8-bootpd.zsh,install-root-bootpd.zsh,com.lukasbower.cohesix.en8-bootpd.plist,README.md} + tests/test_host_bootpd_supervisor.py — keep the wired/GENET direct-link DHCP control deterministic when disposable runtime evidence is cleaned while the host supervisor remains alive; bind root LaunchDaemon state to `/Users/lukasbower/cohesix/host-bootpd`, migrate a sole legacy `out/host-bootpd` tree, and reject ambiguous dual runtime trees without writing new runtime state inside the repository.
  - apps/root-task/src/**, apps/pi4-driver-runtime/src/**, crates/pi4-driver-abi/src/**, or apps/hive-gateway/src/** — bounded tuning only where same-harness evidence points to a moved layer caused or exposed by the seL4 16 refresh. For CYW43, preserve one HAL/runtime issuer and the three exact authorities required by accepted Milestone 26b task `m26b-wifi-sdio-notification-dpc-closure`: persistent op11, the separate finite urgent-op7 lease, and the post-release event-sequence DPC lease. Ordinary non-op11 foreground commands alone retain recurrent exact grants. SDIO owns and joins IRQ158 and DMA4 IRQ116 into one immutable request terminal. Root admits at most one CYW43 parent per outer turn; an exact op11 commits and signals once, and its stable `Waiting` state masks only runtime-descriptor, logical-owner, and HAL-lease self-demand. Persistent op11, urgent op7, and DPC event service route from current durable conditions rather than snapshot novelty: deterministic private phases continue even on equal snapshots, while exact child, runtime-owned credit, queue, and peer waits block immediately even when newly observed. SDIO alone takes one live joined-controller sample after a changed steady cursor before blocking. Every helper remains bounded and each immutable hardware request issues at most once. Preserve commit-before-signal, condition-before-sleep, the post-f4 immutable descriptor requirement, issued-unknown reaping, and the exact recovery lane. Decouple smoltcp admission from the sole physical owner with one CYW43-only bounded aggregate of 16 TX frames and one committed RX batch parent carrying up to eight frames. Notifications only prompt a durable-state recheck; they carry no work history or authority. A sequence-last SDIO command always reaches matching owner dispatch or a typed zero-I/O missing/competing-seal terminal; it is never discarded as no intake. Ordinary TxTokens reserve 15 aggregate slots, copied RX reserves the final paired slot before dequeue, consumption remains queue-only, and EventPump is the sole production TX coordinator. ARP, EAPOL, DHCP, TCP SYN/FIN/RST, and payload-free TCP control preempt other payload-bearing TCP and bulk while preserving FIFO order within each class. Preserve any exact retained foreign HAL descriptor, including the one RX batch parent, before op7 admission. Once the lane is free, advance one active op7 or promote and advance one eligible FIFO head before copied-RX service so replenished RX cannot starve control TX. Copied RX precedes the coordinator's physical op only while no op7 is legally runnable; otherwise it remains preserved for the following smoltcp poll. When full, promotion removes one eligible head and restores a paired slot before at most one physical advance. A terminal never promotes a successor; that frame remains queued for a later coordinator turn. Neither `Device::receive` nor reservation failure services TX. The runtime is the sole SDPCM flow-control owner: it admits each exact op7 only while `sdpcm_seq` is within the dongle-advertised `tx_max` window and retains the same op7 in `WAIT_CREDIT` otherwise. A joined Function-2 terminal releases the root frame immediately and is never converted into a second root wait for a future RX credit observation. A stable committed terminal wins before lifetime policy; a terminal-absent `Waiting` op7 remains retained only while its exact generation, pair epoch, and physical-lifetime epoch are current, and an invalidated lifetime enters the sole pair-recovery lane without replay. An issued or otherwise ambiguous active op7 deadline remains fail-closed. Purge only never-issued queue entries at generation/reset boundaries, preserve active issued-unknown poisoning, and leave GENET unchanged. RX deadlines contain exact faults only and never create source probes, rescue transactions, or another physical action.
  - docs/DRIVERS.md + docs/HARDWARE_BRINGUP.md + docs/TEST_PLAN.md — record the measured transport-specific baseline, the as-built bounded cadence correction, and a fresh-hardware acceptance target without promoting source or model evidence into Pi performance proof.
Commands:
  - python3 -m pytest -q tests/test_rest_perf_harness.py tests/test_pi4_compare_driver_models.py
  - python3 -m pytest -q tests/test_host_bootpd_supervisor.py
  - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --log-dir out/bench --log-prefix m26d-qemu-sel4-16-initial
  - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --no-qemu --no-gateway --rest-url http://<pi4-gateway-host>:<port> --log-dir out/bench --log-prefix m26d-pi4-sel4-16-initial
  - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --log-dir out/bench --log-prefix m26d-qemu-sel4-16-final
  - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --no-qemu --no-gateway --rest-url http://<pi4-gateway-host>:<port> --log-dir out/bench --log-prefix m26d-pi4-sel4-16-final
Checks:
  - Historical top, accepted 26b, first seL4 16, and final seL4 16 lanes are all recorded with artifact paths, workload parameters, tool version/provenance, selected seL4 build, gateway/auth mode, QEMU SMP topology, target transport, and error-budget policy.
  - QEMU/Pi comparisons reject stale or mismatched artifacts before any verdict; Pi evidence remains fresh, timer-qualified, and paired with raw TCP/cohsh proof for the selected transport.
  - The live direct-link DHCP supervisor recreates its disposable runtime directory before every service attempt, so an `out/` cleanup cannot silently strand the GENET control lane.
  - Tuning preserves Secure9P bounds, console grammar, manifest authority, no-retry failure accounting, HAL/driver-task ownership, and root-task no-std constraints.
  - CYW43 performance comparison retains the approximately 315-ms request-to-first-payload mean and 407-ms p95 / approximately 2.9-command-per-second baseline. The earlier proposed tenfold-improvement target of request-to-first-payload p95 at or below 40 ms and at least 29 successful requests per second, and the aggressive low-overhead target of p95 at or below 10 ms and at least 100 successful requests per second, remain non-blocking optimization targets rather than Milestone 26b closure gates. Accepted exact-image hardware proof is the usable, repeatable no-semantic-loss envelope established by the operator-approved `2668c34f76ff` candidate transport matrix above and required again from the repaired candidate, including honest bounded recovered retransmission accounting and an unchanged GENET control within its accepted envelope.
  - Wi-Fi remains a research/diagnostic lane with the documented worker envelope; production throughput parity still requires fresh wired/GENET evidence.
Deliverables:
  - Benchmark ledger and refreshed artifacts that make the seL4 16 performance delta reviewable before later milestones depend on the refreshed baseline.

Title/ID: m26d-domain-schedule-debt-removal
Goal: Remove or explicitly resolve stale legacy domain-schedule dependencies from Cohesix seL4 build configurations.
Inputs: fresh-source Pi profile audit outputs, the repo-managed immutable `seL4/build_UBOOT` v16 diagnostic artifact input, Pi 4 build scripts, seL4 16.0.0 upgrade notes.
Changes:
  - scripts/pi4-image-build.sh and related build docs — ensure Cohesix-owned Pi 4 flows do not silently depend on stale `domain_schedule.c` defaults when domains are not in use.
  - docs/HARDWARE_BRINGUP.md and docs/BUILD_PLAN.md — document the resolved seL4 16 domain-schedule posture for Cohesix.
Commands: scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml --venv .venv
Checks: one-domain Cohesix builds no longer inherit accidental `sel4test` schedule-file assumptions.
Deliverables: documented and verified domain-schedule posture for Cohesix seL4 16 builds.

Title/ID: m26d-isolated-runtime-wx-closure
Milestone: Milestone 26d — seL4 16 Baseline Refresh + Reference/Performance Realignment / isolated-runtime W^X closure
Goal: Make every isolated-runtime VSpace mapping fail-closed for execute permission without changing the driver-task ABI or CYW43 behavior.
Inputs: apps/root-task/src/hal/mod.rs, apps/root-task/src/sel4.rs, seL4 16 AArch64 page attributes, profile-selected isolated runtime ELF images.
Changes:
  - apps/root-task/src/hal/mod.rs — validate ELF load flags and checked ranges, reject W+X and effective page-level permission collisions, and derive executable-page intent before child allocation.
  - apps/root-task/src/hal/mod.rs + apps/root-task/src/sel4.rs — add execute-never while preserving cache/device attributes for every non-code root alias and child mapping; retain only validated read-only code and the reviewed trampoline as executable.
  - apps/root-task/src/hal/mod.rs tests — cover malformed headers, unknown flags, RWX segments, page collisions, read-only code, data, holes, shared resources, DMA, and MMIO attribute policy.
Commands:
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::tests::runtime_
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::tests
  - SEL4_BUILD_DIR="$PWD/seL4/build_UBOOT" cargo check -p root-task --target aarch64-unknown-none --no-default-features --features release-pi4
Checks: no writable child page is executable, no unvalidated ELF flag can create executable authority, cache/device policy is preserved, and the isolated-runtime ABI plus CYW43-owned state machine are unchanged.
Deliverables: reviewed W^X implementation, focused regression tests, and Pi 4 target compile evidence.

Title/ID: m26d-canonical-sel4-profile-closure
Milestone: Milestone 26d — seL4 16 Baseline Refresh + Reference/Performance Realignment / canonical seL4 profile closure
Goal: Make the accepted seL4 16 production, diagnostic, and proof configurations reproducible and fail-closed from pinned upstream source, then make the validated production contract the operational QEMU default.
Inputs: official seL4 16.0.0 manifest and project revisions, official Arm GNU Toolchain 15.2.Rel1 macOS ARM64 archive, official DENX U-Boot 2026.01 archive, configs/sel4/profiles.toml, configs/sel4/python-*.lock, toolchain/setup_macos_arm64.sh, tools/sel4-profile-project/CMakeLists.txt, scripts/sel4_profile.py, scripts/cohesix-build-run.sh, scripts/release_bundle.sh, scripts/qemu-run.sh, scripts/cohsh/run_regression_batch.sh, staged Test Plan scripts, seL4 build outputs, QEMU launch inputs.
Changes:
  - configs/sel4/profiles.toml + configs/sel4/python-*.lock — pin official project revisions, the self-contained Arm compiler archive and executable identities, the exact Python distribution closure, the DENX mkimage source archive, and target, GIC, SMP, domain, debug, benchmark, counter-export, and claim-eligibility contracts for each supported profile.
  - toolchain/setup_macos_arm64.sh — provision the pinned compiler, isolated hash-locked Python environment, and mkimage build without using a rolling compiler formula or a dirty/incomplete repository source tree; emit provenance records bound to the setup script and profile contract.
  - tools/sel4-profile-project/CMakeLists.txt — configure upstream seL4 without inheriting the legacy sel4test domain-schedule assignment, regenerate the platform memory map required when fixed-address Pi elfloader images also load rootservers last, and add only the contract-selected bounded file-backed QEMU production placeholder reserve required for logical rootserver replacement.
  - scripts/sel4_profile.py — require fresh build directories, disable configure-time memoization, reject stale or pre-existing stamps and outputs, bind a causally fresh completed stamp to every input and output, reject unknown evidence classes or class/eligibility mismatches, and validate source provenance, compiler/Python/mkimage identities, caches, generated headers including the rootservers-last elfloader memory map, QEMU rootserver-archive capacity, independently parsed DTB/launcher agreement, strict executable ELF structure, shipping/RWX policy, forbidden settings, and proof eligibility without mutating evidence to make it pass.
  - scripts/cohesix-build-run.sh + scripts/release_bundle.sh + scripts/qemu-run.sh + scripts/tcp_*.sh + scripts/cohsh/run_regression_batch.sh + staged Test Plan scripts — default QEMU consumers to `out/sel4/profile-v2/qemu-smp-production`; validate runtime or release intent before consuming the canonical tree and classify explicit unvalidated alternatives as claim-ineligible.
  - README.md + docs/QUICKSTART.md + docs/HARDWARE_BRINGUP.md + docs/DRIVERS.md + docs/OPERATOR_WALKTHROUGH.md + docs/TEST_PLAN.md + apps/root-task/README.md — publish the same canonical default while preserving explicit diagnostic/historical qualifications.
  - docs/TOOLCHAIN_MAC_ARM64.md + docs/audit/M26D_SEL4_16_PROVENANCE.md — document the canonical workflow and distinguish accepted builds from legacy/diagnostic inputs.
Commands:
  - toolchain/setup_macos_arm64.sh
  - out/toolchain/sel4-profile-venv/bin/python -m pytest -q tests/test_sel4_profile.py
  - out/toolchain/sel4-profile-venv/bin/python scripts/sel4_profile.py validate --all --require-source --require-artifacts --evidence out/audit/m26d-profile-v2-all.json
  - scripts/cohesix-build-run.sh --sel4-build out/sel4/profile-v2/qemu-smp-production --no-run --cargo-target aarch64-unknown-none
Checks: QEMU uses GICv3 in both parsed DTBs; one-domain profiles have no schedule-file dependency; fixed-address Pi rootservers-last builds contain generated `memory_region` metadata; the QEMU production elfloader archive meets its declared minimum and accepts the current boot-minimized Cohesix root task without in-place ELF growth; source revisions and canonical Pi overlay digest match the official pin; compiler archive/version/target/binary identities, exact Python locks and installed-file digest, DENX source and mkimage provenance, caches, generated outputs, immutable input hashes/values, causal build times, and strict `ET_EXEC`/RX-entry ELF structure agree; aggregate closure requires all five fresh `out/sel4/profile-v2/*` source and artifact sets unless explicitly diagnostic-relaxed; evidence classes have fixed release/runtime eligibility; upstream wrapper artifacts remain machine-classified non-shipping; shipping artifacts reject RWX; diagnostic settings cannot earn proof claims; all active QEMU build/release/regression/test defaults consume the canonical production path and revalidate it before claims; validation fails on drift. A fresh target-qualified run at `out/test-plan/m26d-qemu-sel4-16-gap-audit` must pass linked GICv3 boot, authenticated TCP regression, REST parity, and due diligence before replacing the retained seL4 15 comparator.
Deliverables: source-controlled profile contract, wrapper, validator, operational/release adoption, tests, runbook alignment, and provenance record.

Title/ID: m26d-worker-execution-truth-repair
Milestone: Milestone 26d — seL4 16 Baseline Refresh + Reference/Performance Realignment / reopened Milestone 25 task-isolation and 26c Worker execution truth
Goal: Make generated and documented Worker execution claims match the currently launched target objects while preserving existing host/session behavior.
Inputs: configs/root_task*.toml, tools/coh-rtc, generated root-task artifacts, apps/root-task/src/worker_authority.rs, canonical Worker/security/interface docs, Milestone 25/26c audit ledgers.
Changes:
  - configs/root_task*.toml + tools/coh-rtc — emit model-only general Worker roles as not target-implemented, disable executable-role capability/notification claims consistently, and reject `implemented=true` until a generated task-object contract exists.
  - generated artifacts + focused tests — regenerate all profile outputs and reject manifests that claim executable-role authority or lifecycle notifications without an executable role contract.
  - canonical docs + audit ledgers — distinguish host/session tickets and in-process models from target TCB execution, and record the reopened closure phase for real Worker objects, badged IPC, lifecycle notifications, fault handling, and revocation.
Commands:
  - cargo test -p coh-rtc
  - cargo test -p root-task --lib worker_authority
  - scripts/check-generated.sh
Checks: generated truth, tests, and prose agree; no model-only role is called live or capability/notification-backed; existing namespace/ticket semantics remain unchanged; driver-runtime TCB proof is not reused as general Worker proof.
Deliverables: regenerated as-built Worker truth plus an explicit, separately gated target-execution closure phase.

Title/ID: m26d-sel4-capability-utilization-audit
Milestone: Milestone 26d — seL4 16 Baseline Refresh + Reference/Performance Realignment / capability, scheduling, and TCB decision closure
Goal: Bound what Cohesix uses from seL4 16 today and prevent unused features or model-only code from becoming product claims.
Inputs: seL4 Reference Manual v16.0.0, generated kernel headers, root-task/HAL/Worker code, docs/audit/M26D_SEL4_16_CAPABILITY_AUDIT.md, docs/audit/M26D_MCS_DECISION.md, docs/audit/M26D_ROOT_TCB_BOUNDARY_AUDIT.md.
Changes:
  - docs/audit/M26D_SEL4_16_CAPABILITY_AUDIT.md — classify each relevant kernel capability as implemented, partial/model-only, intentionally unused, or blocked, with direct evidence and closure routing.
  - docs/audit/M26D_MCS_DECISION.md — retain non-MCS for 26d, record the strong architectural-fit verdict and selected SMP+MCS successor, compare classic SMP/single-core MCS/SMP+MCS, define bindings, scheduling-contract, WCET/budget, fault, target-evidence, and atomic-reversion gates, and route implementation to `m26e-mcs-abi-foundation` and `m26e-mcs-smp-target-acceptance`.
  - docs/audit/M26D_ROOT_TCB_BOUNDARY_AUDIT.md — record current root-owned parsers, networking, supervision, policy, and audit surfaces plus the exact ordered Milestone 26e split tasks and required evidence.
Commands:
  - scripts/check-generated.sh
  - cargo test -p root-task --lib
Checks: no audit entry confuses API availability with Cohesix use; no live Worker or MCS claim lacks target evidence; root-owned services are named rather than implied isolated; every deferred capability has an explicit milestone route or rationale.
Deliverables: capability matrix and accepted MCS/root-TCB boundary decisions tied to as-built evidence.

Title/ID: m26d-smp-command-post-cutover-usability
Milestone: Milestone 26d — seL4 16 Baseline Refresh + Reference/Performance Realignment / linked-UART SMP diagnostic defect correction
Goal: Make bare `smp` useful after linked-UART cutover by routing it to the existing bounded activity report while preserving the raw scheduler snapshot as explicit debug-only `smp dump`.
Inputs: crates/cohsh-core/src/{command.rs,verb.rs,help.rs}, apps/root-task/src/{console/mod.rs,event/mod.rs,affinity.rs}, docs/USERLAND_AND_CLI.md, docs/HARDWARE_BRINGUP.md, docs/snippets/cohsh_grammar.md, current seL4 16 QEMU/Pi diagnostic profiles, and linked-UART Pi evidence.
Changes:
  - crates/cohsh-core/src/command.rs + crates/cohsh-core/src/verb.rs + crates/cohsh-core/src/help.rs — map bare `smp` and compatibility spelling `smp activity` to `SmpMode::Activity`, retain raw `SmpMode::Snapshot` only behind explicit `smp dump`, reject unknown/extra arguments, and align shared help/grammar.
  - apps/root-task/src/console/mod.rs + apps/root-task/src/event/mod.rs — route both activity spellings through the existing bounded userspace report; keep the raw scheduler helper available only for explicit debug dumps and reject it after linked-UART cutover without reclaiming UART ownership.
  - docs/USERLAND_AND_CLI.md + docs/HARDWARE_BRINGUP.md + generated grammar snippets — make bare `smp` the normal operator instruction, retain `smp activity` for compatibility, and describe the narrow pre-cutover/QEMU diagnostic use and UART restriction of `smp dump`.
Commands:
  - cargo test -p cohsh-core smp
  - cargo test -p cohsh-core --test doc_snippets
  - cargo test -p root-task smp_
  - cargo test -p root-task --features net-console smp_
  - cargo fmt --all -- --check
  - scripts/check-generated.sh
Checks:
  - `smp` and `smp activity` emit the same bounded userspace activity records and terminate with `OK SMP mode=activity`.
  - `smp dump` is the only operator route to the existing raw scheduler snapshot; non-debug builds and post-cutover linked-UART profiles reject it deterministically without touching UART MMIO.
  - The correction adds no telemetry fields, authority path, namespace, manifest field, kernel benchmark dependency, or root-owned steady-state UART fallback.
  - Shared help, generated grammar, canonical operator docs, parser tests, root-task tests, and generated-artifact drift checks agree.
Deliverables: One safe default SMP diagnostic, one explicit debug-only raw snapshot spelling, and aligned tests/operator instructions.

Title/ID: m26d-repository-gate-closure
Milestone: Milestone 26d — seL4 16 Baseline Refresh + Reference/Performance Realignment / repository-wide regression gate closure
Goal: Restore every mandatory repository-wide source, dependency, packaging, and staged-regression gate exposed while preparing the refreshed QEMU and Pi 4 evidence, without changing operator-visible semantics or hardware authority.
Inputs: Cargo.toml, Cargo.lock, deny.toml, apps/root-task/build.rs, apps/root-task/build_support.rs, apps/root-task/sel4.ld, apps/root-task/src, scripts/cohesix-build-run.sh, scripts/pi4-image-build.sh, scripts/pi4_image_identity.py, scripts/pi4_wifi_repeatability.py, scripts/pi4_trace_normalize.py, scripts/ci/test_plan_*.sh, scripts/ci/due_diligence_gate.sh, .github/workflows/*.yml, README.md, docs/TEST_PLAN.md, docs/audit risk registers, current M26b/M26d source and build evidence.
Changes:
  - Cargo.toml + Cargo.lock + CI — update vulnerable or yanked transitive dependency selections to supported compatible versions without widening VM dependency closure, track the lockfile, and reject stale resolution before build/test commands.
  - apps/root-task/build.rs + apps/root-task/build_support.rs + apps/root-task/src — correct fresh-checkout generated-artifact validation, deterministic test-contract drift, and strict lint failures exposed by the canonical Pi 4 Stage 02 feature set.
  - apps/root-task/src/hal + apps/root-task/src/sel4.rs + configs/sel4/profiles.toml + tools/sel4-profile-project/CMakeLists.txt — admit the complete selected linked-runtime capability inventory before creating any child, retain bounded post-bootstrap CSpace headroom, transfer child-only code/stack/framebuffer mappings without permanent root aliases, and establish the then-required 14-bit Pi root-CNode minimum so runtime-image growth fails in deterministic build/bootstrap gates instead of panicking during shared HDMI setup. Milestone 26e later supersedes that minimum with the 16-bit full-Worker profile.
  - apps/root-task/sel4.ld + scripts/pi4-image-build.sh + scripts/pi4_image_identity.py + scripts/pi4_wifi_repeatability.py — place one fixed-width marker in a dedicated file-backed root-task load section, keep the tracked `seL4/build_UBOOT` profile artifact tree immutable, reproduce its baseline elfloader byte-for-byte as a relink-tool oracle, compose the new rootserver/CPIO/wrapper only in disposable output, bind the canonical tree, tool identities, oracle, and derived tuple in provenance, seal the wrapper with the domain-separated normalized digest of the complete legacy Pi image, repair and revalidate U-Boot CRCs, and require staged/read-back bytes plus every UART slice to agree on that content-derived identity.
  - scripts/pi4-image-build.sh + focused host tests/docs — make routine Pi media refresh a single exact-child in-place synchronization on an already provisioned MBR/FAT32 `COHESIX` card, reject locked macOS sessions before mutation, keep the host awake through the critical section, preserve and verify the private policy, compare every staged file, and unmount only that child. Whole-disk initialization remains an explicit operation and is never an automatic fallback; normal reflash must not repartition, reformat, force-unmount the whole medium, or select another same-label volume after AppleSDXC re-enumeration.
  - scripts/cohesix-build-run.sh and focused tests/docs — keep the QEMU rootfs below the 4 MiB guard while preserving all manifest-declared runtime artifact names, bytes, and isolated-runtime lookup semantics.
  - scripts/ci, tools/rust-risk-audit, README.md, and canonical docs — make Python selection exact and recoverable, count cfg-test Rust separately from production risk, record the real linked-runtime unsafe delta, and align as-built packaging explanations with the canonical QEMU path.
  - .github/workflows/*.yml — keep one required per-change `ci` job as a small non-claiming health signal: locked dependency resolution, generated-contract integrity, one default workspace check/test pass, host compilation of the QEMU/Pi root-task feature test binaries, and the bare-metal Pi runtime target check. Keep fresh advisory checks weekly/manual, use least-privilege permissions and deterministic pins, rely on native job logs, and leave complete feature behavior, Python, UI, risk/lint, target, performance, and release qualification in focused developer validation or the canonical Test Plan instead of repeating them on every push. Stage 02 target compilation and QEMU packaging remain in the provisioned macOS ARM64 evidence lane because their canonical external seL4 build trees are intentionally not vendored.
  - CI compatibility review — the hosted-policy reduction and corrected eight-millisecond QEMU guard oracle change no host-tool, `tools/cohesix-py`, benchmark implementation, report schema, external interface, or target authority. The NIST documentation smoke uses base-system `grep -E`, and the seL4 syscall-routing guard scans Rust sources in-process, so a clean hosted runner does not require a separately installed search tool. Those surfaces remain catalogued for focused and staged validation and require no implementation change here.
Commands:
  - actionlint .github/workflows/*.yml
  - cargo metadata --locked --no-deps
  - cargo fmt --all -- --check
  - cargo clippy --workspace --all-targets -- -D warnings
  - cargo check --workspace
  - cargo test --workspace -- --test-threads=1
  - cargo test -p root-task --no-default-features --features driver-tests-qemu --lib --no-run
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib --no-run
  - cargo check -p pi4-driver-runtime --target aarch64-unknown-none
  - cargo test -p rust-risk-audit
  - scripts/ci/rust_risk_gate.sh --baseline docs/audit/rust_risk_baseline.toml
  - cargo audit
  - cargo deny check advisories
  - scripts/check-generated.sh
  - PATH=/usr/bin:/bin bash tests/security/nist_evidence_smoke.sh
  - cargo test -p root-task --test sel4_syscall_guard -- --test-threads=1
  - python3 -m pytest -q tests/test_pi4_image_identity.py tests/test_pi4_wifi_repeatability.py tests/test_pi4_trace_normalize.py
  - scripts/cohesix-build-run.sh --no-run --cargo-target aarch64-unknown-none
  - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26d-repository-gates-qemu
  - scripts/ci/test_plan_run.sh --target pi4 --stage 1 --state-dir out/test-plan/m26d-repository-gates-pi4
  - scripts/ci/test_plan_run.sh --target pi4 --stage 2 --state-dir out/test-plan/m26d-repository-gates-pi4
Checks: mandatory lint, workspace, dependency, generated-artifact, QEMU packaging, cfg-aware risk-ratchet, and offline staged-regression gates pass with no newly ignored advisory, forged or duplicated image marker, invalid U-Boot envelope/CRC, staged/read-back alias, truncated supervisor record, skipped stage, rootfs-size exception, operator grammar drift, or loss of manifest-declared driver-runtime artifact identity; ordinary Pi reflash proves exact whole/child ownership, refuses locked-session mutation, performs no whole-disk topology change or global label fallback, preserves the bounded private policy, and verifies every staged file before exact-child unmount; accepted production unsafe growth is explicit and expiry-bounded; live Pi stages remain separately hardware-gated; the required hosted check reports only material source-contract, compile, target-compile, and default-test failures, its NIST and syscall-routing guards need no separately installed search tool, and it cannot be cited as staged or target acceptance; every retained workflow parses cleanly, references only tracked commands, preserves required event coverage, and has no redundant or no-op job.
Deliverables: reviewable dependency resolution and risk register, deterministic root-task/Python regression coverage, sub-4-MiB QEMU payload, clean QEMU plus offline Pi target-qualified gate evidence, and one coherent GitHub Actions surface consisting of the small required `ci` signal plus separately scheduled/manual dependency visibility.

Title/ID: m26d-cyw43-hardware-free-closure
Milestone: Milestone 26d — seL4 16 Baseline Refresh + Reference/Performance Realignment / hardware-free CYW43 reliability closure; Reopened Milestone 26b / m26b-wifi-sdio-notification-dpc-closure and m26b-net-control-priority
Goal: Make the Pi 4 CYW43/SDIO linked-runtime design software-complete, deterministic, event-pump-driven, adversarially tested, artifact-bound, and repository-green without claiming unavailable repeatability proof from physical hardware.
Inputs: AGENTS.md, docs/BUILD_PLAN.md, docs/DRIVERS.md, docs/HARDWARE_BRINGUP.md, docs/TEST_PLAN.md, /Users/lukasbower/REBOOT.md, newest non-empty Pi serial logs and boot-paired pcaps, configs/root_task.toml, configs/root_task_pi4_uboot_aarch64.toml, configs/generated/root_task_resolved.json, tools/coh-rtc, generated bootstrap/profile outputs, crates/pi4-driver-abi/src/lib.rs, apps/pi4-driver-runtime/src/lib.rs, apps/root-task/Cargo.toml, apps/root-task/src/{drivers/driver_task_net.rs,event,hal,net/{mod.rs,queue.rs,stack.rs},serial,userland}, scripts/pi4-image-build.sh, scripts/pi4_image_identity.py, scripts/pi4_wifi_repeatability.py, scripts/pi4_trace_normalize.py, and focused/runtime/repository gate suites.
Changes:
  - The pointer-free ABI defines the 24-byte sequence-last continuation grant, 24-byte RX queue state at local offset 192 and 128-byte RX batch record at shared offset 36,864. Bounded records bind complete action identity, owner generation, grant/consumed sequence and immutable payload ownership; no partial record grants authority.
  - SDIO alone captures/clears/acknowledges physical IRQs and publishes durable child completion before waking CYW43. CYW43 retains exact foreground, DPC and RX transactions. Non-CYW43 commands retain endpoint rendezvous; admitted CYW43 commands use their exact grant/persistent/finite-op7 contracts without endpoint fallback, arbitrary root continuation or duplicated physical issue.
  - EventPump admits at most one root CYW43 parent per outer turn. Ordinary publication retains Stage, CommitRing, PublishGrant, NotifyRing and PollRing phases with signal last; exact persistent op11 commits and signals in its single admitted producer call. A terminal or accepted grant observed before replacement publication wins without redundant signal.
  - Bootstrap and recovery use one retained no-allocation supervisor. Logical connection identity, physical pair generation and immutable action identity remain distinct. Shared-page aliases, parent/child ownership, whole-pair reset and named child/credit/queue waits are validated before device activity; a consumable wake edge cannot become recovery authority.
  - RX uses immutable bounded batches and exact queue/ACK watermarks. TX consumption only enqueues into the generation-scoped urgent/bulk queue of aggregate capacity 16. One active op7 owner retires before another admission, committed RX precedes fresh TX, and a retained foreign HAL owner cannot be revoked to manufacture progress.
  - Production-chain tests exercise actual admission, durable-state, race and terminal helpers. Hardware-free checks establish these contracts only. The accepted 26b task supersedes earlier urgent-only, normal-deadline, hintless and zero/no-ACK proposals; its physical acceptance remains independently required.
  - Trace readers preserve historical formats and distinguish source/ABI evidence from exact-image radio, DHCP, TCP and local-seat proof. Public command, namespace, Secure9P, host-tool, Python and benchmark workload contracts remain unchanged.
Commands:
  - cargo fmt --all -- --check
  - cargo clippy --workspace --all-targets -- -D warnings
  - cargo check --workspace
  - cargo test --workspace -- --test-threads=1
  - cargo test -p pi4-driver-abi -- --test-threads=1
  - cargo test -p pi4-driver-runtime --lib -- --test-threads=1
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib -- --test-threads=1
  - cargo test -p root-task --lib --no-default-features --features net-console icmp_echo -- --test-threads=1
  - cargo check -p pi4-driver-runtime --target aarch64-unknown-none
  - cargo rustc --locked --release -p pi4-driver-runtime --lib --target aarch64-unknown-none -- -D warnings
  - .venv/bin/python -m pytest -q tests/test_pi4_image_identity.py tests/test_pi4_wifi_repeatability.py tests/test_pi4_trace_normalize.py
  - scripts/check-generated.sh
  - scripts/ci/check_test_plan.sh
  - scripts/ci/rust_risk_gate.sh --baseline docs/audit/rust_risk_baseline.toml
  - scripts/ci/due_diligence_gate.sh
  - scripts/ci/test_plan_run.sh --list
  - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26d-cyw43-hardware-free-qemu
  - scripts/ci/test_plan_run.sh --target pi4 --stage 1 --state-dir out/test-plan/m26d-cyw43-hardware-free-pi4
  - scripts/ci/test_plan_run.sh --target pi4 --stage 2 --state-dir out/test-plan/m26d-cyw43-hardware-free-pi4
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml --venv .venv
Checks: every outer EventPump turn admits at most one root CYW43 parent. Ordinary foreground publication preserves bounded `Stage`, `CommitRing`, `PublishGrant`, `NotifyRing`, and `PollRing` phases with signal last, while exact op11 crosses Stage, sequence-last commit, and its sole signal inside the same admitted producer call and remains persistent to terminal. Focused EventPump/root-admission models cover both an already-open pair lease and an initially inactive outer lease with no test pre-open. The inactive case must prove exact association claim -> EventPump outer lease open -> NetStack Join `Stage -> CommitRing -> Issued -> one signal`, with zero request-bound boost/restore actions; the already-open case must reuse its pair reservations without duplicate boosts. Both retain the outer lease `Open` across the exact persistent wait receipt without polling, then resume the same episode for the durable terminal and deterministic close/restore, with no second signal, request, grant, completion poll clock, idle scheduling gap, or unrelated policy admission; sideband ACK admission remains `Issued`-only and rejects every terminal-restore phase without signalling. A stable receipt permits the ordinary waiting park, and a later exact terminal resumes and retires the same parent. These warm seam models are necessary but cannot qualify a hardware candidate. Qualification additionally requires one bounded composition starting at cold `Cyw43BootstrapSupervisor::new` and using the production EventPump, HAL admission, root client, CYW43 runtime, and SDIO runtime dispatch through the prior `q=0x408` DPC/RX frontier, Gates 1 through 10, and the raw-TCP software consumer; only post-issue card/AP boundary responses may be scripted. Production DPC uses one event-sequence lease from the first post-release event and never selects recurrent grants from mutable Gate 8 state; urgent op7 retains its separate finite identity and budget. EAPOL-Start and ordinary control prove the ordinary retained cadence. Valid sealed current-generation M2, M4, and group-key replies alone prove the existing paired finite-op7 marker, exact one-frame/four-operation/1,536-byte bounds, request-bound CYW43-plus-SDIO priority, one notification, no later grant or signal, durable matching-terminal resume, and recovery-only expiry. Their Function-2 data child does not inherit persistent control's pre-TX fence; a concurrent source-bearing event remains durable DPC work. Steady parent identity remains exact through both committed-source and ACK-before-source publication states; only the committed event is DPC service authority, and neither state can select an ordinary grant. Malformed, untagged, stale, wrong-message, and ordinary Ethernet inputs fail before issue. Ordinary post-Gate-8 TCP proves its O(1) path without the EAPOL-Key parser, poller, or fallback. Current durable conditions—not snapshot novelty—route persistent op11, urgent op7, and DPC event service: deterministic private phases continue locally even when equal, while exact child, credit, queue, and peer waits block immediately even when first observed. The post-release activation remains live for the physical generation; healthy owner-active empty/unmasked control state skips `DPC_ACTIVATE`, and one exact visible event is consumed before TX. Only activation-absent or mask-skewed state, plus exact ACK debt bound to an already-submitted immutable activation frontier, uses the activation-repair child; invalid, wrong-generation, poisoned, overrun, or lost-authority state fails closed. SDIO alone takes one live joined-controller sample after a changed steady cursor before blocking. Every helper is bounded and every immutable hardware request issues at most once. Before blocking, CYW43 rechecks its selected marker/event lease, parent/child terminal, event frontier, and queue/batch/ACK condition. SDIO separately rechecks its selected persistent marker or ordinary grant, active child/completion, joined IRQ/CARD_INT, deadline arm, owner health, and—immediately before idle receive—its own sequence-last one-way command ring. A fresh child re-enters SDIO arbitration; unchanged owner-local conditions may block. A committed sequence-last SDIO command reaches owner dispatch and either the validated physical path or a typed zero-I/O missing/competing-seal terminal; it is never discarded as no intake. Production-chain coverage proves both healthy activation reuse with no child and the separate activation-absent or mask-skewed `DPC_ACTIVATE` repair, plus exact ACK debt retained by an already-submitted immutable activation frontier, through production SDIO, a sequence-last terminal, coalesced notification, and hintless exact-parent replay. ACK failure performs zero I/O; after exact ACK retry succeeds, cleared current fault/mask flags plus durable `OWNER_ACTIVE` re-admit healthy work even though the per-pair historical count remains nonzero. Once an exact wait receipt proves the child is blocked, root exact-op11 `Waiting` masking cannot suppress independent DPC/RX/sideband/deadline/terminal work. Immutable generation-bound descriptors cannot fall back to endpoint authority, and issued-unknown reaping preserves the exact continuation until its late terminal or canonical restart.

SDIO alone owns IRQ 158 and IRQ 116. Tests deliver them in both orders, coalesce them, and withhold each independently; exactly one terminal appears only after the immutable request's SDHCI and DMA conditions join. The RX producer clears the queue commit before mutation, writes the body, cleans/barriers, and writes a new nonzero commit last. One parent writes one through eight payloads and batch entries, cleans/barriers, and writes `committed_parent_sequence` last. Op8 then publishes one detail-`0x5803` completion with `result=count`; op11 instead remains active while root copies the batch, post-copy rechecks the header, and commits an exact disjoint ACK body then `committed_queue_commit_sequence` last. CYW43 must not mutate or reuse the batch until that ACK matches. Missing, coalesced, and repeated notification hints produce identical delivery. A full 256-frame software backlog uses 32 full batch handoffs, not 256 root grants, terminals, or notification signals. SDIO arms every blockable active autonomous phase with its exact counter expiry, including pre-issue inhibit/status-clear, and selects the earlier settle/overall expiry during containment clock settle; a blockable phase without a counter deadline fails closed. Terminal/reset clears the arm before publication. Normal traffic completes from physical IRQs and durable levels with zero root fault hints; a stable expired arm produces at most one hint across the existing root-to-CYW43-to-SDIO chain, and terminal/arm races resolve by SDIO's final recheck without a rescue poll or synthetic receive progress. DPC overrun and ACK-attempt counts reset at pair replacement; current flags/pending state are authority, while final acceptance still requires zero errors in every fresh pair.

For the ABI v8 receipt check, `contiguous` means one externally uninterrupted
same-parent bus-service episode across HAL admission, CYW43 protocol ownership,
and SDIO physical ownership. Open, bounded Closing, and the exact handoff
boundary may include required Serial/LocalSeat/Dispatch fairness checkpoints,
but no idle gap or unrelated policy/NIC owner. The receipt is the distinct-magic
24-byte record at auxiliary offset 40; CYW43 uses a producer-monotonic nonzero
epoch and fails closed on exhaustion, and root accepts only a stable exact-field
double-read. Receipt or terminal proves the handoff, never both as concurrent
authority.

The exact ordinary-traffic diagnostic requirement is `sdio_deadline_hints=0`.

The TX aggregate proves total capacity 16, urgent-control-before-bulk FIFO selection, the ordinary 15-slot boundary, the final paired-RX reservation, queue-only TxToken consumption, EventPump-only physical coordination, preservation of an exact foreign owner before op7 admission, active-op7 terminal priority, and committed copied/DPC/runtime RX before fresh or requestless op7 promotion. The real firmware parent crosses the retained SDIO controller as `511 * 64 + 1 * 64`; normal control and EAPOL-Start use the ordinary cached-window F2 child, while sealed M2/M4/group-key responses use the bounded request-bound finite parent without inheriting persistent control's F2 fence. A cold miss uses exact LOW/MID/HIGH/F2 children, and the post-F2 release culminates in the generation's one DPC activation. No test may fabricate child completions, mailbox readiness, terminal streams, or per-frame op8 handoffs. Stale, torn, mutated, wrong-generation, replayed, exhausted-id, issued-unknown, and replacement-generation cuts fail closed. The sole boot episode cannot produce attempt 2; only exact-generation bound DHCP plus an admitted TCP listener authorizes the later consumed-once runtime repair. Operator surfaces remain bounded after quarantine, GENET remains unchanged, deterministic repository gates pass, and the exact image remains commit-bound. The common raw-ICMP owner retains the cold-neighbor ARP/reply and warm one-request/one-reply checks without creating CYW43 source work.
The root notify boundary additionally accepts only the exact legal
`unconsumed -> current-id` acknowledgement race: if it occurs between poll and
notify, root commits `Issued`, sends no redundant signal, and polls on the next
turn. A matching late completion before replacement publication likewise wins
without publishing or signalling.
Deliverables: retained linked-runtime implementation, production-chain adversarial tests, aligned canonical docs, exact-image identity metadata, deterministic gate records, and a Pi-ready exact image. This task's closure was hardware-free only. Its original 10-cold plus 10-warm proposal was superseded for final physical Milestone 26b acceptance by the operator-approved matrices recorded above. Exact image `7a10b8fd6acc` completed one settled cold Wi-Fi boot, five reboot attempts, and one same-image GENET control with raw TCP, first-attempt `.coh`, no-retry pressure, and boot-paired pcap evidence. W04 remains an explicitly excluded RF-affected sample; cold, W01-W03, W05, and G01 form the accepted closure set. No fresh USB key was typed, so the current-image record claims only repeated Gate 10, one-deep idle-report, command-ready, recovery-free, and HDMI-complete evidence plus exact restoration of the previously board-proven path under the operator-approved image-specific exception.

Title/ID: m26d-linked-runtime-unsafe-exception-remediation
Milestone: Milestone 26d — seL4 16 Baseline Refresh + Reference/Performance Realignment / repository-wide regression gate closure; reopened Milestone 26b / m26b-wifi-sdio-notification-dpc-closure defect remediation
Goal: Remove the accepted linked-runtime Rust unsafe delta by enforcing shared-state exclusivity and concentrating fixed mapped-memory and seL4 operations behind bounded reviewed abstractions without changing the CYW43/SDIO protocol or hardware authority.
Inputs: Cargo.toml, Cargo.lock, rust-toolchain.toml, apps/pi4-driver-runtime/src/lib.rs, apps/pi4-driver-runtime/build.rs, apps/root-task/build.rs, apps/root-task/src/hal, apps/root-task/src/drivers/driver_task_net.rs, crates/pi4-driver-abi/src, crates/cargo-build-directive, crates/sel4-sys/build.rs, tools/rust-risk-audit, scripts/ci/rust_risk_gate.sh, scripts/ci/test_rust_risk_gate.py, scripts/ci/due_diligence_gate.sh, scripts/ci/test_due_diligence_lifecycle.py, docs/audit/rust_risk_baseline.toml, docs/audit/findings.csv, docs/audit/EXCEPTIONS.md, docs/audit/BLOCKERS.md, docs/audit/CONTROL_TRACEABILITY.md, docs/audit/checklists/RELEASE_EVIDENCE_CHECKLIST.md, the `cf8f9ee30` Milestone 26c baseline, and current repository-gate evidence.
Changes:
  - apps/pi4-driver-runtime/src/lib.rs — replace convention-only shared mutation with mechanically enforced exclusivity, keep volatile and syscall operations inside narrow fixed-resource helpers, and preserve sequence-last publication, reciprocal notification, DPC, MMIO, and bounded-yield behavior.
  - apps/root-task/src/hal/driver_task.rs — consume completion and DPC commit words with acquire-before-body ordering, stable commit rechecks, and focused access-order tests.
  - crates/cargo-build-directive + the three consuming build scripts — centralize control-character rejection for dynamic Cargo directives and tested Rust-string-literal escaping; bind the helper source, manifest, dependency wiring, and historical absence into the exact scanner contract.
  - tools/rust-risk-audit + docs/audit/rust_risk_baseline.toml + scripts/ci/rust_risk_gate.sh + scripts/ci/test_rust_risk_gate.py — retain the global production ratchet and add linked-runtime/HAL plus outside-component budgets replayed from exact commit `cf8f9ee30` only after every scanner-input path matches its raw `HEAD` blob and mode and the attested path set has no additions or omissions; count qualified/UFCS, raw-identifier, macro-indirected, and conditional unsafe-attribute syntax across repository-authored `apps/`, `crates/`, and `tools/` production sources; pin exact active and historical tuples; execute the scanner directly on the host after a hash-checked build in a fresh private target directory and Cargo home that re-extracts checksum-verified registry archives; resolve the exact repository-selected tools from the canonical OS-account Rustup home by named-toolchain lookup so directory overrides cannot supersede the pin; reject component relocation, baseline inflation, broad test-path hiding, workspace/package/Cargo target/dependency escapes, nested-package test relabeling, local proc-macro synthesis, source redirects, symlink/non-Rust includes, shadowable generated includes, unreviewed generated Rust, uncontracted build scripts/compiler wrappers or inputs, repository-controlled `cfg(test)` injection, Cargo runner/compiler/Rustup selectors, external Cargo configuration, inherited or redirected Git repository binding, replacement refs, clean filters, ignored extra sources, caller-supplied scanner artifacts, malformed metadata, and duplicate TOML keys.
  - scripts/ci/due_diligence_gate.sh + scripts/ci/test_due_diligence_lifecycle.py — enforce a one-to-one finding/exception lifecycle, exact CSV/table schemas and arity, known severities/states, non-expired complete policy metadata, and cover fail-closed mismatches with focused fixtures.
  - docs/audit/findings.csv + docs/audit/EXCEPTIONS.md + docs/audit/BLOCKERS.md + docs/audit/CONTROL_TRACEABILITY.md + docs/audit/checklists/RELEASE_EVIDENCE_CHECKLIST.md — reconcile superseded `DD-2026-0016`/`DD-2026-0017` lifecycle drift and close `DD-2026-0018`/`EX-2026-0018` only after current global, linked-runtime/HAL, and outside-component counts are at or below their replay-derived budgets, focused concurrency/bounds/order tests pass, and clean detached-worktree evidence is bound to the immutable remediation commit.
Commands:
  - cargo test -p pi4-driver-runtime -- --test-threads=1
  - cargo check -p pi4-driver-runtime --target aarch64-unknown-none
  - cargo test -p root-task --lib --features driver-tests-pi4 -- --test-threads=1
  - cargo test -p pi4-driver-abi
  - cargo test -p cargo-build-directive
  - cargo test -p rust-risk-audit
  - scripts/ci/rust_risk_gate.sh --baseline docs/audit/rust_risk_baseline.toml
  - scripts/ci/rust_risk_gate.sh --root <cf8f9ee30-scanner-input-worktree> --historical-replay
  - python3 scripts/ci/test_due_diligence_lifecycle.py
  - python3 scripts/ci/test_rust_risk_gate.py
  - bash scripts/ci/due_diligence_gate.sh --check-exceptions-register docs/audit/findings.csv docs/audit/EXCEPTIONS.md
  - cargo fmt --all -- --check
  - cargo clippy --workspace --all-targets -- -D warnings
  - cargo check --workspace
  - cargo test --workspace -- --test-threads=1
  - cargo audit
  - cargo deny check advisories
  - scripts/ci/check_test_plan.sh
  - go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/*.yml
  - scripts/check-generated.sh
  - scripts/cohesix-build-run.sh --no-run --cargo-target aarch64-unknown-none
  - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26d-unsafe-remediation-qemu
  - scripts/ci/test_plan_run.sh --target pi4 --stage 1 --state-dir out/test-plan/m26d-unsafe-remediation-pi4
  - scripts/ci/test_plan_run.sh --target pi4 --stage 2 --state-dir out/test-plan/m26d-unsafe-remediation-pi4
Checks: scanner v4 replays exact commit `cf8f9ee30` only after raw scanner-input attestation, yielding global `unsafe=693`, `unwrap=38`, `expect=240`, `panic=96`, linked-runtime/HAL `unsafe=146`, `unwrap=0`, `expect=2`, `panic=0`, and outside-component `unsafe=547`, `unwrap=38`, `expect=238`, `panic=96`; immutable remediation-commit ceilings are global `unsafe=691`, `unwrap=38`, `expect=240`, `panic=96`, linked-runtime/HAL `unsafe=144`, `unwrap=0`, `expect=2`, `panic=0`, and outside-component `unsafe=547`, `unwrap=38`, `expect=238`, `panic=96`; every dynamic generated-Rust include has one source/output/generator/hash contract; no active P2 exception remains; shared-state concurrency, mapped-range bounds/alignment, sequence-last publication/consumption, DPC ownership, reciprocal notification, and exception-lifecycle tests pass; offline evidence is not represented as live Pi Wi-Fi proof.
Deliverables: mechanically enforced linked-runtime state ownership, concentrated and documented hardware/ABI boundaries, global/component/outside risk-ratchet evidence, reconciled and closed P2 finding/exception records, and refreshed repository-wide offline gates.

Title/ID: m26d-full-regression-refresh
Goal: Prove the seL4 16 baseline refresh preserves operator-visible behavior and accepted benchmark envelopes across QEMU and Pi 4.
Inputs: refreshed generated artifacts, seL4 16 build trees, docs/TEST_PLAN.md, scripts/ci/test_plan_run.sh, m26d benchmark ledger.
Changes:
  - docs/TEST_PLAN.md — update kernel-baseline references only where needed to match the refreshed evidence.
  - out/test-plan/m26d-qemu-sel4-16-gap-audit and out/test-plan/m26d-pi4 — fresh target-qualified PASS evidence required on the refreshed baseline; QEMU is build/runtime-gated and the Pi path remains hardware-gated.
Commands:
  - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26d-qemu-sel4-16-gap-audit
  - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26d-pi4
Checks: QEMU and Pi 4 staged Test Plan runs are PASS with no undocumented drift, and benchmark revalidation has either recovered the accepted 26b envelope or recorded a scoped blocker/defer decision that downstream milestones cannot count as satisfied evidence.
Deliverables: target-qualified refreshed evidence proving seL4 16 upgrade safety and performance continuity for Cohesix.

Title/ID: m26e-mcs-abi-foundation
Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / MCS ABI and generated temporal-authority foundation
Goal: Establish the seL4 16 SMP+MCS syscall, object, IPC, profile, and compiler contract and prove it with minimal four-core QEMU and fresh Pi scheduler probes before service-child ABIs freeze.
Inputs: seL4 Reference Manual v16.0.0, tag-pinned seL4 16 headers/caveats, configs/sel4/profiles.toml, crates/sel4-sys/**, crates/sel4-runtime/**, apps/root-task/src/sel4/**, tools/coh-rtc/src/**, selected QEMU/Pi kernel builds, docs/audit/M26D_MCS_DECISION.md.
Changes:
  - crates/sel4-sys/** + crates/sel4-runtime/** — add version-pinned SchedContext, SchedControl, Reply, timeout-fault, `Consumed`, `YieldTo`, TCB setup, receive, call, reply, and reply-receive bindings with ABI/negative tests; remove classic reply/scheduling behavior from the QEMU/Pi operational VM closure.
  - configs/sel4/profiles.toml + profile tooling — make the four-node QEMU and Pi production/diagnostic runtime contracts MCS-only, validate `KernelIsMCS`, object sizes, cores, and generated headers, and provide no non-MCS runtime-eligible counterpart.
  - configs/sel4/profiles.toml + tools/sel4-profile-project/** + scripts/{sel4_profile.py,cohesix-build-run.sh,qemu-run.sh,release_bundle.sh} — restore the canonical macOS QEMU execution envelope to HVF and bind it as generated truth rather than a host heuristic. The QEMU profiles use `virt,gic-version=3,virtualization=off`, QEMU-native PSCI `method = "hvc"`, `cortex-a57`, and the host-visible 24,000,000 Hz virtual-counter frequency; the root console-network descriptor must carry the same frequency. Because upstream seL4 16 rejects HVC for SMP and implements only SMC `CPU_ON`, the wrapper owns a narrow DTB-selected HVC conduit while preserving the upstream SMC path for SMC-selected platforms. The wrapper also applies `-mgeneral-regs-only` to the elfloader-linked `cpio` target before the MMU/FP context exists. The profile validator rejects a mismatched DTB, timer header, CPU, machine, or compile command; it also requires exactly one wrapper dispatch object, exactly one HVC conduit object, no upstream duplicate PSCI driver, and the scalar libcpio compile-edge flag. Explicit TCG remains a claim-ineligible diagnostic comparator; it is not a performance fallback.
  - selected seL4 profiles + apps/root-task/src/{arch/aarch64/timer.rs,kernel.rs,userland/mod.rs} — require `KernelArmExportVCNTUser`/`CONFIG_EXPORT_VCNT_USER` and generated `TIMER_CLOCK_HZ` for both operational targets, include the architected-counter backend in `release-qemu` as well as Pi, remove the hard-coded frequency default, and make missing/zero counter truth or timer initialization fatal. `DummySoftTimer`, `bypass-timers`, and `bypass-timers-ipc` remain explicit host/bring-up fixtures only and are rejected from runtime-eligible feature closures and evidence.
  - tools/coh-rtc/src/** + generated artifacts — require each live TCB to declare either a bound active scheduling context or a compiler-validated passive donation chain. Active records carry SC object/size, SchedControl core, budget, period, refill/max-refill policy, priority/MCP, timeout/overrun policy, consumed-time evidence, and WCET/admission provenance; passive records carry allowed donor SCs/cores, Reply-object cardinality, timeout policy, and maximum donation depth.
  - apps/root-task/src/sel4/** + focused probe child — allocate/bind MCS objects only through BootInfo/untyped authority and prove active execution, passive donation and return, timeout-fault routing, Reply ownership, budget exhaustion/replenishment, consumed time, and four-core SC placement before broad extraction begins.
  - docs/ROLES_AND_SCHEDULING.md + docs/TEST_PLAN.md + docs/BENCHMARKS.md + docs/TOOLCHAIN_MAC_ARM64.md — define the selected MCS topology, offline admission calculation, exact accelerator/timer/DTB execution envelope, evidence schema, and explicit whole-change-reversion rule. The compatibility review records no console grammar, Secure9P, `.coh`, Hive REST, `coh`, `cohsh`, SwarmUI, or `tools/cohesix-py` schema change; launch/evidence tooling and performance methodology must consume the corrected profile atomically.
Commands:
  - cargo test -p sel4-sys -p sel4-runtime
  - cargo test -p coh-rtc
  - cargo test -p root-task --test schedule
  - python3 scripts/sel4_profile.py validate --profile qemu_smp_production --build-dir out/sel4/profile-v2/qemu-smp-production --require-source --require-artifacts --for-runtime
  - python3 scripts/sel4_profile.py validate --profile pi4_production --build-dir out/sel4/profile-v2/pi4-production --require-source --require-artifacts --for-runtime
  - scripts/check-generated.sh
  - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26e-mcs-foundation-qemu
  - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26e-mcs-foundation-pi4
Checks: both operational contracts are four-node MCS with no runtime-eligible classic profile; each uses the selected build's exported virtual counter and exact generated frequency with no dummy, bypass, read-count, or hard-coded fallback; every active probe TCB has an admitted SC/core/budget/period and every passive probe has an allowlisted donor/Reply/timeout chain; Reply/donation ownership returns on success, timeout, cancellation, and fault; root emergency/fault work retains independent time; a failed QEMU or Pi gate stops 26e and requires atomic source/configuration reversion.
Deliverables: One MCS-only QEMU/Pi scheduling ABI and compiler contract, minimal target evidence, and a stable foundation for every later 26e child.

The QEMU execution-envelope repair above is evidence-bound to the first
systemic failure behind the v6-v23 canaries, not a new leaf split. The exact
V23 root `e3d757a79f2fa186a405e3199d8b62633dbf22fb9c12462341f8344e94c04731`
failed under ordinary wall-clock TCG at moving boundaries across unrelated
owners. The same immutable image under instruction-counted TCG completed AUTH
and the write/read portion of `9p_batch.coh`, proving path reachability but not
acceptance. Its first HVF exception was EC `0x07` at `cpio_get_file+28` on
`ldr q25`, before seL4, because the release libcpio object was auto-vectorized
without `-mgeneral-regs-only`; its generated DTB and 62.5 MHz timer truth were
also TCG-shaped while this Mac exposes a 24 MHz counter under HVF. Conversely,
the historical 0.4 macOS release reached seL4 and root bootstrap under HVF on
this host. The repaired profile must therefore be rebuilt once and pass boot,
AUTH, focused `.coh`, REST core/parity/Python smoke, and Conditional B2's
no-retry exact-three executable QEMU pressure before any QEMU acceptance or
target benchmark claim. Conditional D is a separately retained host-model
gateway comparator and supplies no QEMU or Pi target evidence. Neither
`-icount` nor an artificial CNTFRQ override is admissible evidence.

Title/ID: m26e-production-surface-truth-and-stub-retirement
Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / production surface truth and mock-stub retirement
Goal: Inventory every reachable implementation surface, retain useful mocks only as explicit fixtures, and make the selected QEMU/Pi/runtime-release closure free of silent mock, stub, no-op, dummy, synthetic, or placeholder behavior.
Inputs: `m26e-mcs-abi-foundation`, Cargo.toml and all workspace Cargo metadata/targets/features, apps/**, crates/**, tools/**, configs/**, scripts/**, all tracked README/docs/generated snippets, release manifests/assets, current build/package scripts, and the frozen CYW43 source/artifact boundary.
Changes:
  - tools/coh-rtc/src/** + configs/implementation_surfaces.toml + configs/generated/implementation_surface_inventory.json — generate and validate `cohesix-implementation-surface-inventory/v1`. Each workspace member, binary, feature/profile, selected entrypoint, namespace seed, provider/action, host adapter, Python/example/playbook, proof source, package/release asset, and public claim has exactly one implementation class, owner, milestone, production reachability, selection source, package disposition, evidence requirement, and current observed mode. Only WorkerBus may be `model_only`; unclassified, duplicate, or production-reachable fixture/stub entries fail generation.
  - scripts/ci/check_implementation_surfaces.py + tests — scan source/config/build/release/docs for compiled spin stubs, `Ok(())` no-op provider success, dummy/null/bypass fallbacks, mock/default fixture selection, fabricated identities/state, placeholder credentials/private keys, client-authored proof, and public claims missing an inventory row. The scanner is an inventory/drift guard, not a keyword-only assertion; explicitly registered test fixtures remain legal.
  - apps/root-task/src/{kernel.rs,userland/mod.rs,serial/**,console/**,uart/**,trace.rs} — make missing operational serial or real time a fatal profile/construction error; keep emergency serial live; remove/profile-exclude the null serial and dummy/bypass clock from target closures; ensure early help exposes only implemented pre-auth diagnostics; return a typed authorization/unavailable refusal for pre-auth reboot instead of a stub; eliminate duplicate legacy bootstrap entrypoints from selected artifacts; and remove the unused `TraceSink::Ipc` alias unless it is wired to the generated bounded service IPC and proven as such.
  - apps/root-task/src/ninedoor.rs + generated host/GPU contracts — operational target state starts `unavailable source=none`, with no predefined units, nodes, temperatures, GPUs, models, lease, or active model. Populate it only from authenticated, versioned, sequence/epoch/time/TTL/manifest-bound host snapshots; atomically replace a provider generation, reject stale/forged snapshots, and withdraw expired data. Explicit dev-virt/mock profiles may retain clearly labelled fixture topology that never produces live evidence.
  - apps/gpu-bridge-host/** — live mode requires a validated real registry/CAS source or publishes an explicit empty/unavailable registry; invalid/missing state never installs fixture models or selects the first model as active. Model/source identity, sequence, epoch, observation time, TTL, manifest/CAS/base-adapter compatibility, activation generation, and receipt are explicit. Placeholder auth fails before connection outside explicit fixture mode.
  - binary/workspace disposition — stop building or staging the current spinning target `nine-door` binary; the later `nine-door-runtime` child is the only selected target namespace-service image. Make the host NineDoor crate library-only unless 27b supplies a real bounded host-service use case. Remove the unused all-mock `domain-intents` crate from the Cohesix workspace/release (optionally preserving deterministic records under test fixtures) rather than inventing media/finance authority. Label `coh-status` deferred to Milestone 40, not implemented.
  - packaging/release gate — replace non-empty-directory and wildcard-copy acceptance with the inventory's exact expected-artifact set for 26e runtime releases; reject unexpected/missing/wrong-kind/wrong-architecture/wrong-hash binaries, compiled stubs, mock-only configuration, placeholder tokens, private fixture signing keys, synthetic proof, and historical assets presented as current. Linux ARM64 host tools and the final Linux tarball are built on one explicitly selected remote ARM64 builder whose host, user, authentication, cargo, build, release, GLIBC ceiling, and local output locations are command-line inputs; release tooling never embeds a site-specific host, user, home, or NVMe path. The exact canonical Pi 4 SD staging file set is compiler-selected and converted into a peer `<release-name>-Pi4` bundle containing a compact raw MBR/FAT32 image, hash, layout/provenance metadata, documentation, and exact bundle manifest. Image size derives from the payload, and the metadata declares the minimum target byte capacity so the image works on any sufficiently large SD card without inheriting a build card's geometry. Packaging remains build proof only and cannot promote media, boot, network, performance, or Pi acceptance. Historical releases remain immutable and receive errata only.
  - Release-readiness closure for 1.0.0-beta — bind each host bundle to its native Mac/HVF or Linux/KVM accepted artifact and TCP result; retain source/profile/tool/image identities in BUILD_PROVENANCE.json; include all generated compile-time contracts in remote source transfer; require the executable Conditional G three-archive installation gate, exact Pi raw-image readback and observed fresh provisioning before publication. The complete host suite, target-neutral Python package and benchmark contracts receive the same-change compatibility review recorded in HOST_TOOLS.md. Historical release snapshots are unchanged.
  - Release source-identity repair — the staged runner's metadata-only source hash differs from the standalone artifact/factory hash for the same clean commit, rejecting passing native TCP evidence at assembly. Use the existing complete checkout/Git/mode/submodule digest for staged context v2 as well; retain the original metadata fingerprint as a separate source-state binding and bind the shared helper in the action digest. Preserve historical evidence without translation or relabeling. An end-to-end producer/factory regression must accept unchanged source and reject changed bytes or executable modes before fresh qualification; dirty submodule state must still invalidate staged resume.
  - Release quickstart — ship the maintained Mac/Linux/Pi guide at every archive root, preserve its first-boot and authentication instructions, and relocate its local documentation links. Include the referenced Pi network-policy runbook; native CLI, Python and benchmark contracts remain unchanged.
  - Release 1.0.0-beta publication preparation — update README, status, quickstart, failover and layout guidance, and document changes since v0.9.0-beta. Retain 0.9.0-beta and remove earlier superseded distribution files from the current tree while preserving their original Git tags and the build inputs, fixtures and audit records still required by this release. Review all eight host executables, tools/cohesix-py, generated contracts and performance scripts; this documentation and historical-package cleanup changes no runtime, protocol, policy, scheduling or workload contract. The owner explicitly directs this preparation to reuse qualification from the separate release-qualification task and run no tests. Retain every reused result at its original source/artifact identity; packaging must not create a new target PASS. The owner separately approves an explicit publication-only factory mode: compare two clean commits, reject every runtime or generated-contract change, preserve original qualified artifacts/results and Pi identity, and record the allowed documentation, retired-distribution and factory delta with before/after hashes. Additive publication metadata must be understood by the release collector without promoting the packaging commit to a staged or target PASS. The subsequent owner instruction authorizes fresh canonical builds without tests, explicit build-only factory provenance, completion and push to main, and a v1.0.0-beta lightweight tag following v0.9.0-beta. All built artifacts retain current-source identity and NOT_RUN status; the separate Stage 5 acceptance remains bound to 5be3ca588. The canonical Linux source transfer includes the pinned third_party/fuser Cargo patch so clean native builds retain the working FUSE implementation. Native host tools regenerate the complete selected KVM policy/default set from a full hash-checked Git tree, preventing Mac timer/manifest identities from leaking into the Linux host binaries.
  - Release-candidate host validation — restrict Pi handoff ring publication to the bare-metal runtime and its explicit unit-test buffer. Preserve the target publication path and align feature guards with their implementations. Give the Pi host library its compiler-generated Pi tables while retaining the QEMU partition tests in the QEMU suite; select SDIO fixture IRQs by owner rather than global list position. Restore stale sharding, temporal admission, NineDoor timeout, diagnostic counter, CLI grammar, SwarmUI transcript, artifact and toolchain fixtures to the canonical manifests and documented contracts. Align QEMU preflight timers with native Mac HVF and Linux KVM profiles. Bind QEMU Worker GDB fault tests to the current passive Worker ABI v2 and verify all three role bindings against the generated topology; reject old or unknown layouts before debugger attachment. The quarantine defect discovered here is restored under `m26e-driver-runtime-mcs-port-and-cyw43-coexistence` below.
  - QEMU release-pressure isolation — allow the canonical clean-build runner to use an explicitly selected disposable Git checkout with `--clean-root`. Preserve its exact-root, output ownership, no-writer, profile, pressure and five-stage acceptance checks; the development checkout's retained output is outside that clean boundary. Exercise hostile path admission in an explicitly selected clean test checkout, independent of the developer's path or uncommitted work. The bench-specific bootpd template test retains the installed host path even when read from a disposable checkout. Queue and verify one single-use `/queen/ctl` approval before each setup spawn/kill over direct TCP or REST, including capacity/model refusal probes and stale-generation recreation. Preserve the control result without retries or a policy bypass.
  - Release fleet discovery — restore SwarmUI direct/REST/Secure9P discovery and the executable benchmark census when the real population occupies more than one 64-entry aggregate directory reply. Enumerate only compiler-declared shard addresses and read actual per-shard Workers and structured state. Restore the target aggregate listing to a bounded view of up to 64 distinct active shard labels, consistent with the host model, instead of failing once that view fills. Retain read refusals, placement/identity validation, target buffers, quotas, workloads and thresholds. Record the complete host-suite and Python compatibility review in HOST_TOOLS.md; verify the failing 256-Worker native Jetson scenario before reporting closure.
  - Release-candidate compatibility review — reviewed `cohsh`, `coh` (including doctor), `hive-gateway`, `swarmui`, `gpu-bridge-host`, `host-sidecar-bridge`, `cas-tool`, `host-ticket-agent`, `tools/cohesix-py`, raw TCP and REST/Worker benchmark workloads and report schemas. Existing shared 256-shard and bounded timeout contracts require fixture/document synchronization; public commands, credentials, wire ABI, Python APIs, workload definitions and performance thresholds remain unchanged. Native QEMU, Jetson/Pi benchmarks, and Mac SwarmUI direct/gateway multi-Worker checks must retain separate evidence before release construction.
  - Provisioned component selection — build Stage 02 console-network images with the selected QEMU `direct-virtio` or canonical Pi `direct-genet` and optimization settings before checking exact root bindings. The normal QEMU production build selects its direct transport independently of optional diagnostic tracing. Keep exact generated page admission and image identity checks; no target budget, protocol, or benchmark threshold changes.
  - docs — correct nested crate READMEs and all current docs to distinguish `production_live`, fixture, host-model, diagnostic, deferred, and retired surfaces; current code/package state, not milestone prose, determines the initial row.
Commands:
  - cargo test -p coh-rtc implementation_surface
  - python3 scripts/ci/check_implementation_surfaces.py --inventory configs/generated/implementation_surface_inventory.json
  - cargo test -p root-task --tests production_fallbacks
  - cargo test -p gpu-bridge-host
  - scripts/cohesix-build-run.sh --clean --no-run --cargo-target aarch64-unknown-none
  - scripts/release_bundle.sh --check-manifest --pi4-stage-dir out/pi4-sd --macos-artifact <accepted-mac-artifact.json> --macos-result <accepted-mac-base.json>
  - scripts/check-generated.sh
Checks: operational QEMU/Pi feature and package closures contain real time/serial and no null, dummy, bypass, spin-stub, preseeded host/GPU/model state, implicit active model, fixture key/token, client-authored proof, or automatic live-to-mock fallback; expired provider state becomes unavailable; explicit fixtures still pass isolated tests; WorkerBus is the only model-only role; every other non-live surface is fixture/diagnostic/contract/not-enabled/deferred/retired with an exact owner and cannot satisfy target, integration, release, attestation, or use-case evidence; no CYW43 source, timing, state machine, or proof classification changes.
Deliverables: Compiler-owned production-surface inventory, fail-closed operational profiles, truthful target namespace state, exact release selection, and no ambiguous mock/stub functionality.

Title/ID: m26e-worker-resource-admission-critical-tcbs
Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / executable-slot admission and critical root TCB reserves
Goal: Prove the complete kernel-object, memory, CSpace, and per-core time budget for every executable slot while creating independent root-control, fault, emergency, Worker-supervisor, and driver-supervisor progress domains.
Inputs: `m26e-mcs-abi-foundation`, `m26e-production-surface-truth-and-stub-retirement`, selected seL4 16 generated headers/object sizes, BootInfo/untyped inventory, apps/root-task/src/hal/**, apps/root-task/src/kernel.rs, apps/root-task/src/sel4/**, tools/coh-rtc/src/**, configs/root_task*.toml, docs/ROLES_AND_SCHEDULING.md, docs/audit/M26D_ROOT_TCB_BOUNDARY_AUDIT.md.
Changes:
  - Release critical reservation exhaustion restoration — discovered by `m26e-mcs-smp-target-acceptance` on exact native KVM source `9b1bf2eaa057a268851d068a9b4372f37e692217`. A hardware breakpoint at the emitted seL4 `endTimeslice` timeout branch, before fault IPC, captured the LoRA executor at its blocking Wait with an empty request queue, one published completion, no pending root fault, and no fatal state. Its charged SC retained a 5,196-us head due in 2,000 us and a 2,804-us later refill. Earlier exact-source failures separately identify GPU-executor, Worker-supervisor, and root-fault timeouts; cumulative consumed fields do not establish single-operation WCET or distinguish guest execution from host scheduling delay. Select existing NaturalPostpone for the five resumable critical service loops (root-fault, both supervisors, both executors) in QEMU, regression, and Pi manifests, and reject terminal policy drift in the compiler. Preserve budgets, periods, refills, priorities, core placement, WCET/admission checks, standard-fault endpoints, emergency fail-stop, passive Worker timeout containment, and NineDoor recovery. Keep timeout capabilities reserved and accounted. Review the complete host-tool suite, Python library, and performance scripts: regenerated profile/hash bindings change; public protocols, workloads, thresholds, receipt requirements, and report schemas do not. Require focused generated/fault contracts, exact Mac/KVM/Pi builds, fresh target fault and pressure evidence, and all applicable staged gates before acceptance.
  - Pi exact-4c future-anchor collision restoration — image `b24b3eac1794570ba2b0c64b16570e7f92102437a545822d7ff8694faf7909c2` reaches console-network construction with ordinary root slots ending at `0x3f09`, the generated NineDoor anchor. The subsequent exact reservation fails with `seL4_DeleteFirst` before NineDoor construction or the registry seal. Exclude all enabled compiler-declared service, Worker and critical-retention anchors from ordinary allocation from the outset; retain one-time exact claims and rejection of occupied, duplicate, kernel-reserved, out-of-window or previously allocated ordinary slots. Preserve generated slot addresses, resource counts, constructors, revoke ownership, MCS contracts and physical-driver behavior. This restores executable-slot admission after the defect was discovered under `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`; focused allocator contracts, a narrow QEMU activation canary and a fresh exact-image Pi boot are distinct proof requirements.
  - Pi exact-4c repeated Worker service scan restoration — ordinary linked-runtime phases repeatedly inspect all 256 projection slots even with no claimed Workers. Maintain a bounded claimed-slot bitmap in the same existing admission/checkpoint transaction and snapshot it after immediate fault/policy work, then enforce every claimed deadline with the unchanged call time and manifest order. Preserve terminal claims, fault-mailbox precedence and QEMU service quantum; skip an empty pending-operation scan only after validating population bounds. This removes source-proven repeated lock/lookup work while the measured 4c GENET raw latency bands and remaining pressure dispatch-to-stage delay remain unassigned to actual SC consumption. Pure set/order/failure-atomicity tests, exact target compilation, QEMU canary and fresh physical performance must remain distinct.
  - tools/coh-rtc/src/** + configs/root_task*.toml — separate namespace/model capacity from per-role executable slots; declare allowed role mixes, fixed core placement, TCB/CNode/VSpace/page-table/ASID/frame/endpoint/notification/fault/timeout/Reply/SC/CSpace-slot/untyped costs, budget/period/deadline/refill/priority/MCP/blocking/jitter/WCET inputs, and fail-closed per-core response-time/admission results. The V26-era QEMU root-control repair candidate remains on core 0 with `5500 us / 10000 us`, `5000 us` per-phase WCET, `m26e-qemu-root-disconnect-single-issue-candidate-v26` provenance, and a derived `7600 us` per-phase response bound rather than an end-to-end host/TCP latency claim. Only the QEMU console-network task, matching service config, and SchedControl selection move from core 0 to core 2; its `3000 us / 10000 us` budget and `2400 us` WCET stay fixed while its response becomes `2400 us`; V26-era child provenance was `m26e-qemu-console-peer-close-timewait-relisten-candidate-v13`. The two same-priority core-2 GPU/LoRA Worker responses become `3000 us`; core-0 demand is `8750 us` and core-2 demand is `3800 us`, each within `9000 us` usable after the unchanged `1000 us` reserve. Pi root-control retains V23 provenance, placement, timing, response, and admission truth; its child at that chronology point advanced only to V13 provenance under schema 1.12, with timing and placement unchanged. Root-fault is `3000 us / 10000 us`, with `2400 us` per admitted containment unit, `2600 us` per-unit response, and `m26e-qemu-root-fault-service-units-candidate-v6` provenance. Root-fault V6 preserves `PrimeReceive -> Receive -> Classify`; service records then advance `ResolveService -> SuspendService -> RecoverPassiveService -> PublishService -> Receive`, with active console skipping `RecoverPassiveService`, while the legacy critical branch remains `SuspendCritical -> SignalEmergency -> Receive`. Resolution is one fixed generated lookup plus a nonblocking registry-lock/scalar-snapshot attempt with lossless retry, suspension is one quiet bounded syscall, passive recovery issues at most one Reply while active console issues zero, and publication is one mailbox action that retains its snapshot on backpressure. Terminal-critical and service containment span distinct admitted units, so `2600 us` is not an end-to-end terminal-fault latency claim. Root-fault numerics remain unchanged; V26 retained every V25 timing and placement value and changes only the QEMU root's successful Disconnect transaction from repeatable to per-connection single-issue. The v2 whole-turn interpretation and v3 combined Network/runtime-IPC phase are live-falsified; source `00bf02540` timed out `root-control` at the console-network control poll. Source `4d1a47b89` timed out in `VirtioTxToken::consume` after queue notify, falsifying v4's multi-unit Network turn. The following live v5 run raised child timeout badge `0x26ee0007` at `Send` after `publish_exchange` with exactly `3000 us` consumed, then raised root timeout badge `0x26ee0001` at the sole outer yield after containment/quarantine with exactly `2750 us` consumed, falsifying a multi-material child turn and whole-containment Recovery turn. The canonical v6 root ELF `0059fd675b476106888d6ca62c8bba21f9b340b9aa607e000fbf96997fd29900` then raised root badge `0x26ee0001` at the outer yield after a single Network visit composed empty ObserveChild, no-op StageOutput and Disconnect, and committed/signalled 60-byte ARP ingress sequence 1. The child was healthy and no Recovery ran, so v6 falsifies composition of no-op lower units rather than child or containment progress. None is qualification evidence.
  - apps/root-task/src/hal/** + generated records — reserve compiler-bounded per-slot untyped/CSpace pools and supervisor-owned revoke anchors without changing the existing isolated driver-runtime constructor or allocator contract. On the QEMU VirtIO profile, the ordinary root-control phase also suppresses the Pi/GENET-only synchronous raw-UART idle-input trace in live and quarantined adapter states; the pre-gate v3 run exhausted at the following outer yield after emitting that complete nonessential line.
  - apps/root-task/src/kernel.rs + apps/root-task/src/sel4/** — create distinct `root-control`, `root-fault`, `root-emergency`, `root-worker-supervisor`, and `root-driver-supervisor` TCBs with distinct active SCs and least-authority CSpace views; no reserve is a Worker or driver donor.
  - apps/root-task/src/kernel.rs + tools/coh-rtc/src/** — generate the bounded root-control-to-Worker-supervisor queue, per-admitted-Worker root-fault teardown mailboxes, Worker-supervisor wake notification, per-runtime root-fault-to-driver-supervisor records, driver-supervisor wake notification, reserved disjoint notification-badge ranges, exact Read/Write rights, one-hot signal caps, backpressure/refusal policy, and coalesced drain precedence. Critical producers never block on a supervisor and fault handoff cannot be dropped.
  - apps/root-task/src/sel4/** + tools/coh-rtc/src/** — generate one acyclic critical-TCB fault graph and exactly one blocking MCS fault receive endpoint with one serialized Reply: standard and timeout child fault caps are disjointly badged `Write + GrantReply` caps to that endpoint, root-fault's receive cap is Read-only, ordinary Worker faults suspend/terminate without Reply, only allowlisted timeout faults may reply once, and linked-driver faults retain the association while root-fault waits for the independent driver supervisor's exact release-badge notification after command-Reply failure and containment; root-fault failure routes to root-emergency, and root-emergency failure is fail-stop rather than self/cyclic recovery.
  - apps/root-task/src/kernel.rs + tools/coh-rtc/src/** — size the fault registry from every admitted service, Worker, driver, and critical root TCB and propagate duplicate/overflow registration as a fatal construction error.
  - docs/ROLES_AND_SCHEDULING.md + docs/TEST_PLAN.md — publish executable-slot/resource arithmetic, per-core reserves, response-time inputs, and allocation-failure gates separately from model capacity.
Commands:
  - cargo test -p coh-rtc worker_admission
  - cargo test -p root-task --test worker_resource_admission
  - cargo test -p root-task --test worker_fault_registry
  - cargo test -p root-task --test critical_tcb_reserves
  - cargo test -p root-task --test critical_tcb_handoff
  - cargo test -p root-task --test driver_supervisor_handoff
  - cargo test -p root-task --test mcs_fault_lanes
  - scripts/check-generated.sh
Checks: the maximum generated role mix fits exact selected-kernel object/untyped/CSpace/page and per-core time bounds; every critical duty runs on the named TCB/SC; Worker and driver handoff queues, mailboxes, badge ranges, cap rights, Reply cardinality, terminal/recoverable fault transitions, and the acyclic fault graph match generated truth under coalescence, saturation, simultaneous faults, handler fault, and allocation failure; no registration or construction error is ignored; model capacity cannot overcommit executable slots. This admission task does not edit driver-runtime or CYW43 behavior; the following driver-port task owns the required MCS rebuild.
Deliverables: Compiler-proven executable resource pools, generated fault capacity, and independent temporal reserves required before any 26e child is trusted to run.

Title/ID: m26e-driver-runtime-mcs-port-and-cyw43-coexistence
Status: Reopened narrowly — M27g / m27g-assembled-journeys-and-recovery found that long driver proof records become blank in the bounded Queen log, early constructor affinity records expire before export, and the descriptor checker still selects an obsolete ABI. Restore complete bounded receipt retention, preserve original constructor identity in the existing trusted boot reserve, and align fail-closed decoding with the current ABI; fresh exact-image physical proof remains required.
Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / linked-driver MCS port and behavioral coexistence proof
Goal: Replace the current MCS driver stubs with the real seL4 16 MCS command, Reply, notification, fault, active-SC, and faulted-call recovery paths for every linked Pi driver while preserving CYW43/SDIO behavior and re-proving it under the new binary identity.
Inputs: `m26e-mcs-abi-foundation`, `m26e-worker-resource-admission-critical-tcbs`, crates/pi4-driver-abi/**, apps/pi4-driver-runtime/**, apps/root-task/src/kernel.rs, apps/root-task/src/hal/driver_task.rs, apps/root-task/src/sel4/**, tools/coh-rtc/src/**, configs/root_task_pi4_uboot_aarch64.toml, scripts/cohesix-build-run.sh, scripts/pi4-image-build.sh, scripts/pi4_gate_proof.sh, the accepted classic driver archive/hash and exact CYW43 evidence, and selected QEMU/Pi MCS generated headers.
Changes:
  - Every linked Serial, USB, HDMI, GENET, CYW43, SDIO and PCIe runtime has a compiler-admitted active SC, core, command endpoint, exact command Reply, notifications and containment identity. MCS command receives use Recv/NBRecv with the declared Reply; the SC remains bound to the TCB. Drivers receive neither SchedControl nor ticket authority.
  - Root-driver-supervisor solely owns driver containment and command-Reply recovery. Root-fault publishes the separate fault record and holds its serialized fault Reply until the supervisor closes the exact command/recovery generation. Construction, call failure, teardown and recreation retain bounded cap, mapping, Reply and SC ownership.
  - Syscall wrappers use borrowed badge outputs, kernel-only child binding and private fast registers or the explicitly borrowed active IPC buffer. Restricted TCB waits and error cleanup cannot write the process-global root IPC pointer. Checked HAL windows and typed peer handoffs preserve volatile/publication order without duplicate raw-access boundaries.
  - PCIe admission requires complete endpoint/firmware owner proof, revokes it before reset or failure and measures hardware settling with the selected virtual counter. Local-seat profiles complete PCIe-to-USB owner publication before deferred Wi-Fi service. No partial link/MSI flags or CPU-spin timing substitute for admission.
  - Runtime continuation uses generated policy and durable identity. The ABI v13 DROW/DROA handshake binds request, action, generation and strictly-next wait slice; exact acknowledgement permits one continuation. Duplicate, skipped, stale, torn or mismatched records grant none. CYW43/SDIO retain their accepted source-yield, physical issue, retry, recovery and pair-restart contracts.
  - Serial uses two generation-bound, two-page 8,128-byte SPSC rings. CPU-only shared/control pages use matching coherent Normal/XN aliases and acquire/release publication; DMA, MMIO and framebuffer attributes remain separately admitted. Cursor wrap, rearm and both final wake races are bounded. Terminal serial poison retires only affected output and preserves other operator paths without root UART takeover.
  - HDMI keeps child-private terminal cells, a logical row ring and bounded dirty raster work; parse, clear, scroll, tab and raster turns remain capped at 1,280 operations. Boot framebuffer absence makes display work non-runnable. Startup takeover and bounded progress reporting preserve child-exclusive framebuffer authority and physical input priority.
  - GENET's direct path is a generated CPU-ring connection between the sole NIC owner and console child after bounded DHCP/cutover admission. Root remains control/lease owner and cannot reclaim physical service. Exact generation, quiesce, cursor and failure fences prevent dual ownership; direct RX and ACK progress survive retained response/control debt.
  - Wi-Fi preserves durable foreground publication, finite child/credit waits, exact RX queue/ACK watermarks and recovery identity. Root/child scheduling repairs do not change accepted register/wire order, retry ceilings, timing source, IRQ policy or evidence classes. New driver archives retain exact QEMU/Pi hashes and an immutable classic comparator.
  - Partial serial input does not exclude authenticated TCP; complete queued input/parser work retains its priority. Quarantined network adapters cannot be inspected for response progress. Serial, USB, HDMI, network and independent emergency/fault service retain bounded liveness under load and failure.
  - MCS/driver diagnostics are bounded passive projections of current and retained lifetime records. Complete CPU/consumption, wake, idle-fence, queue and stage receipts distinguish elapsed time from the owner actually consuming CPU; diagnostics cannot schedule work or qualify performance.
  - Host-tool, Python SDK, CLI/REST/UI, generated-profile and benchmark compatibility retains authority, public grammar and workload semantics; versioned driver/diagnostic consumers change atomically with the producer. Build, source, QEMU and image-readback checks do not prove Pi transport, latency or repeatability.
  - Release 1.0.0-beta closure retains the exact DD30 and carry-forward decisions linked above. DD30's dynamic fault/wake test remains unexecuted; permitted source, release, expiry and later retirement disposition come from the canonical audit records. Carry-forward preserves original Stage 01–04 identities and the failed fresh attempt; it cannot create replacement markers or relax ordinary resume rules. All other findings and target obligations remain mandatory.
Commands:
  - cargo test -p pi4-driver-abi -p pi4-driver-runtime
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib pi_attached_wifi_continuation_requires_one_productive_network_successor
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib linked_cyw43_rx_admission_honors_input_and_clears_on_guards
  - cargo test -p console-network-abi
  - cargo test -p root-task --tests driver_task
  - cargo test -p root-task --test driver_task_mcs
  - cargo test -p root-task --test driver_faulted_call_recovery
  - cargo test -p root-task --test mcs_activation_order
  - cargo test -p root-task --test direct_genet_network_phasing
  - cargo test -p cohsh --features tcp --test tcp_cli_script
  - python3 -m pytest -q tests/test_pi4_trace_normalize.py
  - cargo test -p coh-rtc --test pi4_profile
  - cargo test -p coh-rtc --test python_profile
  - cargo test -p coh-rtc resource_admission
  - .venv/bin/python -m pytest -q tools/cohesix-py/tests
  - cargo build --locked --release --target aarch64-unknown-none -p pi4-driver-runtime
  - scripts/cohesix-build-run.sh --clean --no-run --cargo-target aarch64-unknown-none
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml --clean
  - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26e-driver-mcs-qemu
  - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26e-driver-mcs-pi4
  - scripts/check-generated.sh
Checks: focused regressions prove exact two-by-two-page/8,128-byte serial SPSC layout, coherent cacheable Normal-memory mappings only for compiler-declared CPU rings, uncached DMA/MMIO retention, generation and cursor rejection, wrap/order isolation, both final wake-race rechecks, and pending UART IRQ-ACK continuation after full-ring drain; every HDMI parse, multi-cell clear/scroll/tab, and raster turn remains at or below 1,280 operations with no replay, an aligned tab advances eight cells, and only the final visible raster completes; SDIO bulk copies match bytewise truth at every source/destination alignment and reject zero-page, overflow, range, and discontinuity violations without altering the pre-scrub discriminator; Pi profile generation requires only IRQ 189/badge 1024 for GENET default queue 16, while QEMU retains exactly three driver-runtime IRQ entries and no GENET IRQ; GENET queue/DPC tests prove the 16-frame/24,576-byte quantum, overflow preservation, bounded control/data fairness, exact badge, store-completion/unmask readback, final source/ring recheck, and durable continuation before handler acknowledgement. Direct GENET tests prove the exact CPU-only 32-page split, no DMA/device-visible/paddr authority, reciprocal least-right notifications, generation and handoff identity, sequence-last publication, final sleep-race rechecks, corruption poison, one-way root mediation cut, and complete external-frame teardown. Direct-diagnostic tests additionally prove the `[320,512)` optional diagnostic-v3 record, record-relative commit 184, stable exact-generation read, still-reserved `[512,4096)` tail, raw notification receipts/rejections/32-bit badge union counted exactly once before filtering with no service authority, eleven ordered nontruncating rows, one-shot causal replay, legacy-normalizer compatibility, and no traffic or acceptance authority. Deferred WiFi tests prove exact bound DHCP selects one exclusive handoff turn before readiness evaluation, while retained-grant tests prove max-three pure bookkeeping, Service/Empty/Inactive/Ready and ACK-failure behavior, one physical quantum, and unchanged postphysical boundaries. Every linked runtime reaches real MCS Recv/service/Reply or IRQ/notification progress with the generated TCB-bound active SC/core and no unsupported stub; exact endpoint/notification rights and disjoint badge domains match generated truth; installed terminal policies retain timeout-fault coverage, while each selected Pi natural-postpone runtime proves current-refill exhaustion postponement plus explicit device-deadline and standard-fault containment; synchronous, one-way, IRQ/DPC, fault-before/during/after-command, caller-cancellation, restart, and command-versus-fault Reply tests return one normal or typed-failure result, preserve ownership, and leave no blocked caller, SC, Reply association, stale recovery cap, old-generation authority, or root packet fallback; the new archive differs only within the authorized shared MCS scheduler/IPC/runtime-init surface; normalized CYW43/SDIO traces, constants, ordering, timing, retries, rings, error outcomes, DHCP/raw TCP/cohsh behavior, and operator-liveness gates match the accepted contract on the new exact Pi image; an accepted CYW43 blocker permits preparatory work only and cannot produce this task's Pi PASS; classic comparator, new MCS driver, Worker, QEMU, Pi, and CYW43 evidence remain distinct.
Deliverables: Real active-SC MCS linked drivers, a newly hash-bound driver archive, immutable classic comparison evidence, and exact-image CYW43 coexistence proof with no behavioral rewrite.

Title/ID: m26e-ninedoor-service-isolation
Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / NineDoor parser-provider isolation
Goal: Move untrusted target namespace parsing and provider projection behind a bounded restricted seL4 child without moving Queen policy authority.
Inputs: `m26e-mcs-abi-foundation`, `m26e-production-surface-truth-and-stub-retirement`, `m26e-worker-resource-admission-critical-tcbs`, `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`, apps/root-task/src/ninedoor.rs, apps/root-task/src/event/**, apps/root-task/src/console/**, apps/nine-door/src/**, crates/secure9p-transport/**, tools/coh-rtc/src/**, configs/root_task*.toml, scripts/worker_task_evidence.py, scripts/m26e_qemu_pressure.sh, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/SECURITY.md.
Changes:
  - Release-candidate recovered-Call containment ordering — discovered by `m26e-mcs-smp-target-acceptance`: a RecoveryFault reply can return before root-fault publishes the durable service record. Keep each Recovery turn bounded and yield while that promised record is absent; consume it before teardown instead of treating the recovered standard fault as a manual revoke and abandoning its mailbox generation. The same ordering applies to terminal RecoveryTimeout; ordinary local transport revocation remains immediate. Test the stage contract and repeat exact QEMU fault/revoke evidence plus both affected target builds. Review coh/cohsh, SwarmUI, gateway, host bridges/agent, CAS, Python and benchmark surfaces: no public grammar, provider operation, generated contract or report-schema changes are needed.
  - Pi exact-1c5165 bounded passive timeout restoration — the unchanged
    two-WiFi/two-GENET matrix captures a donated root-control timeout during
    G00 medium16 discovery, with badge `0x26ee0001` and resettable SC consumed
    accounting of 121 us. Yield retires the current head, so elapsed time
    after Yield cannot prove a full reservation. Schema 1.17 introduces
    `resume-once-return-error` only for the exact local passive NineDoor
    donation contract. Root-fault resumes the first well-formed timeout of
    each armed Call with a zero-label, zero-length kernel Reply. It preserves
    the original request and donated SC; a second timeout, wrong donor,
    malformed payload, or standard fault retains typed terminal containment.
    QEMU keeps `return-error`. This is a candidate restoration, requiring
    exact target build and fresh physical pressure evidence.
  - Cross-surface review for the same candidate covers coh, cohsh, SwarmUI,
    Hive Gateway, host-side bridge/provider tools, tools/cohesix-py, all .coh
    scripts, and the raw/REST/pressure benchmark entry points. Their command,
    namespace, authority, request, timeout, retry, workload and report
    contracts remain unchanged. Compiler-owned policy, Python profiles and
    schema fixtures regenerate together. The Pi trace normalizer gains the
    passive timeout receipt; USERLAND_AND_CLI documents that row and the
    expanded CPU-owner rows. Host adapters need no hand-authored change.
  - Pi exact-fabc fault operand retention — the same unchanged four-boot matrix captures a NineDoor Timeout during G00 high32 discovery at LS /shard/dd/worker, followed by terminal teardown and refused later ATTACH/reboot admissions. G01 completes the same workload, so functional repeatability remains open. Retain the kernel fault label, exact length and two message registers already copied into the bounded fault mailbox, and render them after the existing diagnostic prefix in the ordinary output turn. No extra syscall, admission policy, restart, retry, timeout, budget or teardown change is authorized by this retention repair. Test maximum-width exact rendering and host evidence-prefix compatibility; interpret Timeout Data/Consumed only against the selected kernel ABI, without calling it remaining refill budget or per-call CPU cost.
  - tools/coh-rtc/src/** + configs/root_task*.toml — under selected `root_task.schema = "1.14"`, retain the compiler-owned NineDoor service-image, TCB, CSpace, VSpace, IPC-buffer, stack, endpoint, shared-frame, MCS Reply/donation/timeout, fault-badge, revoke records, one root-retained one-shot bootstrap SC (8 object bits, `3000 us / 10000 us`, `max_refills = 2`), and the profile-scoped root VirtIO Operator serial-I/O bound introduced by schema 1.11. Account for that fixed SC exactly once so aggregate QEMU/Pi SC totals are 18/25; schema 1.14 retains the console publication-ACK and ABI v3 SendBatch/response-lane contracts and owns `NaturalPostpone` for the active console child and the selected QEMU V35/Pi V24 root-control records, without changing NineDoor resources.
  - apps/nine-door-runtime/** — add a pure-Rust `no_std` child image that parses bounded namespace requests, returns typed prepared operations over the generated internal ABI, receives once for bootstrap, and uses atomic `seL4_ReplyRecv` for every reply-and-next-receive transition.
  - crates/secure9p-transport/** — replace the empty scaffold with the bounded transport-neutral request/response, partial-frame, close, backpressure, and cancellation traits actually consumed by the in-process host adapter and the generated seL4 endpoint/shared-frame adapter. It provides no target TCP listener. Migrate named consumers and prove revoke/short-frame/queue-full behavior; if the final child ABI cannot use this layer without duplicating semantics, remove the crate and its public claim atomically instead of retaining contract-only scaffolding.
  - apps/nine-door/src/{main.rs,kernel.rs,lib.rs} + scripts/cohesix-build-run.sh — remove/profile-exclude the host print-and-exit and target spin-loop binaries from selected packages; stage `nine-door-runtime` under its generated image identity. Keep `apps/nine-door` as the host library/fixture provider unless a later registered host-service use case owns a real executable.
  - apps/root-task/src/ninedoor.rs + apps/root-task/src/event/** — retain policy and authoritative mutation in root, replace in-root untrusted parsing for enabled profiles with bounded child IPC, and delete/profile-disable the duplicate parser path. Configure and bind only the root-retained bootstrap SC while the child is suspended and before registry seal; after root-fault activation perform `Resume -> validated empty Log prepare -> atomic ReplyRecv queued -> unbind -> steady passive donation`. Install no SC or SchedControl cap in the child, issue no NineDoor `TCB.SetAffinity`, and revoke the boundary on activation, probe, or unbind failure while suspending where possible.
  - apps/root-task/src/{ninedoor.rs,ninedoor_service.rs,event/**,hal/ninedoor_service.rs} + focused root-task tests — make terminal NineDoor containment resumable on the common MCS QEMU/Pi root-control path. The first exclusive Recovery turn only consumes the durable fault record, fences new Calls, retains the four mappings, initializes `SuspendTcb`, and returns `InProgress`. Later turns execute exactly one of 18 successor-committed units: `SuspendTcb`; request 0 `ScrubCleanRequestFrame`, `UnmapRequestFrame`; request 1 `ScrubCleanRequestFrame`, `UnmapRequestFrame`; response 0 `UnmapResponseRead`, `MapResponseWritable`, `ScrubCleanResponseWritable`, `UnmapResponseWritable`; response 1 with the same four units; `RevokeRecoveryReply`; `DeleteFaultCap(0)`; `DeleteFaultCap(1)`; `RevokeAnchor`; and pure `Finalize`. Scrub/clean uses the bounded lock-free cache path, each response `MapResponseWritable` performs exactly one `Page_Map`, and Reply/fault-cap deletion uses quiet bounded kernel operations. Every material unit exposes its successor before work and restores only that exact selected unit after a synchronous error. `Finalize` advances to `Complete` without removal; the next idempotent `Complete` turn publishes the five-field proof, and only that complete proof permits the old runtime record to be removed. `InProgress`, an incomplete proof, and every error fence the ordinary EventPump for the complete refill. This changes common MCS containment behavior, not ordinary Pi scheduling; fresh Pi containment evidence remains pending, and no QEMU result may substitute for it. Preserve schema, provenance, generated artifacts, capabilities, temporal numerics, and all external NineDoor semantics.
  - scripts/worker_task_evidence.py + scripts/m26e_qemu_pressure.sh — require one prior exact-artifact non-claiming `ninedoor` convergence PASS with a live authenticated-cohsh UART record, then run the donated-Call standard fault and root-local between-Calls transport revoke in distinct fresh terminal-service boots. Bind the exact emitted four-file target-session bundle, launch record/artifact bytes, observation/UART bytes, service ELF, and root ELF. The between-Calls hook may only request local boundary revoke after two successful post-prepare hits; it adds no command grammar, target authority, child fault, or replacement path. Collect the two NineDoor UART/GDB pairs separately so no same-boot reconstruction or fabricated between-Calls standard fault can satisfy the gate. For console-network, collect a fresh standard-fault terminal-containment boot and a distinct budget-exhaustion natural-postponement liveness/isolation boot; V18 retains V17's timeout contract and does not install or expect a console Timeout teardown.
  - compatibility review — `apps/cohsh/**`, `apps/coh/**`, `.coh` scripts, `apps/hive-gateway/**`, `tools/cohesix-py/**`, and the REST/performance harnesses retain their command grammar, ACK/ERR/END behavior, namespace and authority contracts, retry/timeout policy, workloads, evidence records, and report schemas. The bounded containment cursor is internal target recovery behavior and requires no host, script, Hive Gateway, Python, or performance-schema implementation change. Existing target regressions must still be rerun against the new exact image after QEMU containment qualifies; fresh Pi containment proof remains separate.
  - docs/ARCHITECTURE.md + docs/ROLES_AND_SCHEDULING.md + docs/TEST_PLAN.md + docs/BUILD_PLAN.md + docs/INTERFACES.md + docs/SECURITY.md — document the target child separately from host NineDoor, the frozen bootstrap/passive transition, and the no in-VM 9P/TCP-listener rule.
Commands:
  - cargo test -p coh-rtc
  - cargo test -p root-task --tests ninedoor
  - cargo test -p nine-door
  - cargo check -p nine-door-runtime --target aarch64-unknown-none
  - .venv/bin/python -m pytest -q tests/test_worker_task_evidence.py
  - bash -n scripts/m26e_qemu_pressure.sh
  - scripts/check-generated.sh
Checks: selected schema 1.14, including rejection of immediate predecessor 1.13, the profile-scoped serial-I/O bound, and any bootstrap-candidate drift fail closed; the exact root-retained SC is accounted once and raises QEMU/Pi SC totals to 18/25; source tests prove construction-time configure/bind while suspended before seal, one initial `seL4_Recv`, validated empty `Log` preparation, atomic `seL4_ReplyRecv` queueing, unbind before passive admission, repeated calls, and boundary revoke plus suspension where possible on activation/probe/unbind failure. Recovery tests prove the latch-only first turn; the exact 18-unit order and count; one unit per later refill; successor-before-action; exact-unit restoration on synchronous failure; bounded lock-free cache cleaning; one `Page_Map` per response remap; quiet Reply/fault-cap deletion; pure `Finalize`; the distinct idempotent `Complete` proof/removal turn; and zero ordinary EventPump work on `InProgress`, incomplete proof, or error. Malformed and over-limit requests are contained in the child; root receives only typed bounded operations; the passive donor/Reply/timeout chain returns its SC on success, denial, timeout, cancellation, and child fault; partial-frame, backpressure, close, and revoke behavior passes through the real shared transport boundary; the selected archive contains `nine-door-runtime` and no print-and-exit/spin stub; namespace, Secure9P, console, replay, error, host-tool, `.coh`, Hive Gateway, Python, and performance schemas do not drift; no broad namespace, target TCP listener, child SC/SchedControl cap, NineDoor `TCB.SetAffinity`, or root CSpace authority reaches the child. Four-core GICv3 QEMU must first pass one exact-artifact authenticated `ninedoor` convergence boot, then use separate fresh boots for a live standard fault during a donated Call and a root-local transport revoke after two completed Calls. The latter must begin with no outstanding Reply association and cannot be labeled a child standard fault. Both paths must complete every bounded containment turn without root-control timeout or pump fallthrough; exact artifact/session/observation hashes and bytes must match. The common MCS source applies to QEMU and Pi, but ordinary Pi scheduling is unchanged and fresh Pi containment evidence remains pending. A marker, successful boot, or QEMU result alone does not satisfy the Pi gate.
Deliverables: Executable target namespace service with generated least-authority objects, bounded IPC, fault containment, and unchanged external semantics.

Title/ID: m26e-console-network-service-isolation
Status: Reopened narrowly — M27g / m27g-assembled-journeys-and-recovery found that a physical PING can defer its prompt behind an unrelated TCP stream, leaving physical response priority to starve that stream and HDMI. Restore source-owned prompt completion without changing scheduling bounds, response authority or display rendering; require a deterministic ownership regression and fresh mixed-surface Pi evidence.
Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / TCP console-network isolation
Goal: Move TCP framing, authentication parsing, and smoltcp packet handling into a restricted child while preserving root-owned operator policy and emergency surfaces.
Inputs: `m26e-mcs-abi-foundation`, `m26e-worker-resource-admission-critical-tcbs`, `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`, `m26e-ninedoor-service-isolation`, crates/console-network-abi/**, apps/root-task/src/console_network_service.rs, apps/root-task/src/net/**, apps/root-task/src/console/**, apps/root-task/src/event/**, apps/root-task/src/serial/**, apps/root-task/src/hal/**, tools/coh-rtc/src/**, configs/generated/cohsh_policy.toml, scripts/cohsh/run_regression_batch.sh, scripts/ci/test_run_regression_batch.py, docs/ARCHITECTURE.md, docs/ROLES_AND_SCHEDULING.md, docs/SECURITY.md, docs/USERLAND_AND_CLI.md, docs/TEST_PLAN.md.
Changes:
  - The generated console/network child owns TCP framing, authentication parsing and smoltcp packet handling in a restricted address space. Root retains sole-listener admission, Queen policy, authoritative response ordering, emergency serial and fatal output. The child receives only the declared pages, caps, SC, Reply and fault/lifecycle channels.
  - Four fixed 4,096-byte exchange pages use compact scalar headers and active payload, commit-last publication and exact generation/connection/control sequence. Root-to-child pages are read-only in the child; child-to-root pages have only declared write authority. One-slot publication ACK credit is explicit: ordinary notifications cannot mint credit, overwrite pending publication or complete a control.
  - Root privately validates and retains a complete publication before acknowledging it. The child services retained completion/event/egress work before new ingress/control, rechecks badges and credit between bounded units, polls only eligible private work and waits when idle or uncredited. Selected NaturalPostpone policy enforces the admitted 3,000-us/10,000-us child budget without treating ordinary exhaustion as terminal failure.
  - Root activation, compact Operator/Runtime/Network phases and their retained cursors separate command dispatch, runtime IPC and NIC service. Recovery has precedence and advances one material containment unit per bounded turn. Console quarantine fences only its owned network work; it does not combine phases or starve physical input, NineDoor or independent root reserves.
  - The isolated VirtIO Operator shares one generated 64-byte serial credit across RX/TX; entry TX backlog reserves 32 bytes. It attempts at most one retained output record, while Pi/non-VirtIO retain their own bounds. Compact Runtime and Network cursors commit successors before work and preserve no-op, forced-observe, retained egress and deferred-diagnostic state.
  - Connection identity survives every control read and completion. Well-formed stale controls retire once without touching replacement-session output; malformed or unauthenticated current controls fail closed. Peer-first close, TIME_WAIT relisten, terminal-response Disconnect fencing and failed stream-producer retirement preserve exactly one listener and complete bounded ACK/ERR/END behavior.
  - Binary SendBatch retains complete-record encoding inside the existing 2,368-byte payload; later CommandBatch retains per-command timestamps and exact FIFO ownership. The bounded authenticated response lane preserves ordinary-service debt, operator/recovery fences and exact consumed-but-undrained control identity. Synchronous capture uses the selected adapter's real identity and bounded storage.
  - Stack ingress, egress and Session service are separately bounded. Nonzero receive or committed wire progress retains service; only zero receive with no commit quiesces. Authenticated oversize input drains exactly its declared body. Sending requires can_send and complete-frame capacity; backpressure never fabricates completion or discards a retained frame.
  - Routine QEMU audit output uses a private capacity-four drop-new FIFO with one admitted physical byte per eligible visit. It cannot populate public queen.log, outrank useful network/input work or suppress critical/fatal diagnostics. Pi diagnostics retain their selected route; MCS reports retain complete lifetime and CPU records within bounded transport output.
  - Compatibility repairs preserve one TCP owner per pooled connection, canonical generated cohsh policy selection, target-local policy/replay fixtures, composed REST deadlines and exact runner-environment restoration. CAS uses the shared maximum of eight chunks, preflights payload capacity and keeps the ninth-chunk failure atomic. Synthetic performance populations require exact host-model backend classification; target pressure uses generated executable populations.
  - Host tools, Python, SwarmUI, CAS/evidence tools and benchmark consumers preserve the external protocol and authority contract. Derived generated fields, fixtures and evidence readers follow their owning versioned changes; QEMU containment, host-model comparators and Pi performance remain separate proof classes.
Commands:
  - cargo test -p cohesix-cas
  - cargo test -p cas-tool
  - cargo test -p nine-door host::cas::tests::ninth_chunk_quota_refusal_preserves_exact_eight_chunk_state -- --exact
  - cargo test -p root-task --no-default-features --features driver-tests-qemu --lib ninedoor::tests::cas_ninth_chunk_quota_refusal_preserves_exact_eight_chunk_state -- --exact --test-threads=1
  - cargo test -p coh-rtc --test roundtrip manifest_codegen_is_deterministic -- --exact
  - cargo test -p coh-rtc --lib implementation_surface::tests -- --test-threads=1
  - .venv/bin/python -m pytest -q scripts/ci/test_check_implementation_surfaces.py tests/test_release_bundle.py
  - .venv/bin/python -m pytest -q tests/test_rest_perf_harness.py
  - cargo test -p coh-rtc root_control_turn_candidate_is_exactly_accounted
  - cargo test -p coh-rtc supervisor_cold_activation_candidates_are_profile_scoped
  - cargo test -p coh-rtc --test ai_lora_contract
  - cargo test -p console-network-abi -p console-network-runtime
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib pi_attached_wifi_continuation_requires_one_productive_network_successor
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib linked_cyw43_rx_admission_honors_input_and_clears_on_guards
  - cargo test -p console-network-runtime buffered_oversize_body_and_quit_retain_service_until_same_connection_parse -- --exact
  - cargo test -p root-task --no-default-features --features driver-tests-qemu isolated_response_lane_pays_exactly_one_ordinary_debt_after_eight_units -- --test-threads=1
  - cargo test -p root-task --no-default-features --features driver-tests-qemu isolated_help_capture_publishes_complete_body_then_one_terminal -- --test-threads=1
  - cargo test -p root-task --no-default-features --features driver-tests-qemu private_routine_audit -- --test-threads=1
  - cargo test -p root-task --no-default-features --features driver-tests-qemu stalled_routine_audit_uart_does_not_block_new_network_event_or_line -- --test-threads=1
  - cargo test -p root-task --no-default-features --features driver-tests-qemu routine_audit_tx_tag_survives_empty_record_and_promotes_on_ordinary_admission -- --test-threads=1
  - cargo test -p root-task --no-default-features --features driver-tests-qemu cat_queen_log_ack_includes_recent_echo_batch -- --exact --test-threads=1
  - cargo test -p root-task --no-default-features --features driver-tests-qemu hal::cache::tests -- --test-threads=1
  - cargo test -p root-task --test console_network_service
  - cargo test -p root-task --no-default-features --test mcs_activation_order -- --test-threads=1
  - cargo test -p root-task --no-default-features --features driver-tests-qemu --lib bootstrap::log::tests -- --test-threads=1
  - cargo test -p root-task --no-default-features --test isolated_virtio_network_phasing -- --test-threads=1
  - cargo test -p cohsh --test script_catalog
  - cargo test -p cohsh --features tcp pooled_tcp_uses_one_wire_attach_for_twenty_four_exact_authority_leases -- --exact --test-threads=1
  - cargo test -p cohsh --features tcp -- --test-threads=1
  - cargo test -p cohesix-rest
  - cargo test -p cohsh --features rest -- --test-threads=1
  - cargo test -p hive-gateway -- --test-threads=1
  - cargo clippy -p cohsh --features tcp --all-targets -- -D warnings
  - cargo build -p cohsh --release --features tcp
  - .venv/bin/python -m pytest -q tests/test_console_network_runtime_packaging.py
  - .venv/bin/python -m pytest -q tests/test_qemu_tcp_response_matrix.py scripts/ci/test_run_regression_batch.py
  - .venv/bin/python -m pytest -q scripts/ci/test_test_plan_evidence.py
  - .venv/bin/python -m pytest -q scripts/ci/test_rest_regression_batch.py
  - bash -n scripts/ci/test_plan_stage_04_rest_multiplexer.sh
  - cargo check -p console-network-runtime --target aarch64-unknown-none
  - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features release-qemu
  - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features release-pi4
  - cargo fmt --all -- --check
  - scripts/check-generated.sh
  - python3 scripts/ci/test_plan_catalog.py recommend scripts/qemu_tcp_response_matrix.py tests/test_qemu_tcp_response_matrix.py
  - python3 scripts/ci/test_plan_catalog.py converge --target qemu --format json scripts/qemu_tcp_response_matrix.py tests/test_qemu_tcp_response_matrix.py
  - scripts/ci/test_plan_run.sh --list
  - scripts/ci/check_test_plan.sh
  - scripts/cohsh/run_regression_batch.sh
  - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26e-console-qemu-v35-v18
  - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26e-console-pi4-v24-v18
Checks:
  - Malformed packet/auth/control input fails inside the restricted child. Page access, nonzero identity, lengths and commit sequence validate before mutation; inactive padding grants no authority. Emitted page-helper frames avoid whole-page copies and the nested child stack stays strictly within 32 pages.
  - Publication credit is consumed before mutation and restored only by the matching post-retention ACK (badge 64). Root clears ACK debt before signalling and forces observation. Duplicate/late ACK, stale sequence, coalesced hint and revoke cannot publish; graceful shutdown retires exact terminal debt before containment.
  - Authentication and a two-session stale-control canary precede pressure qualification. A streamed response retained when session 1 closes must retire once with no bytes entering session 2; session 2 must authenticate, attach and receive its own ACK/TAIL/END. Peer close/relisten, full-frame send capacity, oversize-body drain and failed producer cleanup retain the listener and exact response ownership.
  - The child retains completion -> event -> egress -> service continuation -> ingress -> control order. PollService commits StackIngress -> StackEgress -> Session before dispatch; each stack leaf performs one bounded poll. Nonzero RX or committed output returns Continuation; only zero RX and no commit return Complete. Idle/uncredited work blocks; ordinary SC exhaustion follows the selected NaturalPostpone policy.
  - Isolated QEMU serial credit is 64 bytes shared across helpers, with 32 reserved for entry TX backlog. One output-record attempt is permitted per Operator; linked/Pi paths retain their separate two-record bound. Routine audit drains one byte per eligible visit from a capacity-four private FIFO. No helper resets credit or advances later FIFO/response-tail state early.
  - Compact Runtime uses persistent Worker -> ControlEndpoint -> BootstrapDrain -> StreamFlush -> RebootTail ownership. Stream final line, cursor/bandwidth finalization and END occupy separate visits. Selected bulk Worker/command quanta remain generated and bounded. The HAL timebase/timer prelude cannot execute a second generic tail; Pi/non-VirtIO retains its own 48-line/16-KiB stream bound.
  - Network retains ObserveChild -> StageOutput -> Disconnect -> Ingress -> ServiceTick ordering, advances on no-op, forces observation after child signal, and commits Timer/Nic successors before work. Retained TX permits at most two reclaim checks and one transmit/notify; sampled diagnostics occupy a separate non-publish visit. Successful sequences 0–63 and every 64th later success are sampled without changing continuous counters. No buffer mutation, head reuse, duplicate publication, completion spin or dropped egress is allowed.
  - Containment advances one owner-local material unit per Recovery turn, preserves ordinary/runtime/network cursors and services console containment before NineDoor when both fault. Quarantine preserves operator liveness and prevents poisoned NIC access. Budget, Reply, independent root/emergency/fault reserves and authority boundaries remain generated; no second listener or root physical NIC owner appears.
  - The fixed one-socket HELP/NETSTATS/SMP/CACHELOG matrix, exact-session lifecycle canary, separate standard-fault and natural-postponement liveness/isolation evidence, canonical .coh batch, Stage 03/04 and required host/Python checks retain exact source and target provenance. Conditional B2 executable target pressure and Conditional D host-model comparison cannot substitute for each other; Pi performance requires fresh Pi evidence and the generated 54-MHz virtual counter.
  - Compact page/stack checks, stale-control rejection, negative CAS capacity, pooled-owner safety, deadline composition and backend/population classification remain independent contracts. Historical candidate failures and partial passes stay in the linked audit record; milestone completion is governed by the release qualifications above, not by those intermediate outcomes.
Deliverables: Restricted console/network child with bounded compact shared-page IPC, ABI v3 SendBatch plus explicit publication ACK, exact-identity bounded synchronous capture, a bounded authenticated response lane with ordinary-service debt, preserved external operator semantics, fixed response-matrix evidence, target-disassembly evidence, and live four-core GICv3 QEMU containment evidence.

Title/ID: m26e-qemu-shared-control-path-performance
Status: Reopened narrowly for the preemption-history byte-view restoration discovered by M27g / m27g-two-hour-pi4-operator-burn-in. Earlier release acceptance remains historical; this restoration requires focused host/model checks and fresh exact-image QEMU/Pi evidence before closure.
Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / QEMU pressure validation and shared bounded service quanta
Goal: Remove measured artificial service-turn, Worker-scan, activation, transport head-of-line, and per-instance-SC ceilings while preserving one bounded shared architecture across QEMU and Pi.
Inputs: `m26e-console-network-service-isolation`, `m26e-worker-supervisor-child-isolation`, accepted executable-Worker pressure harness, ABI v3 SendBatch/publication-ACK boundary, configs/root_task*.toml, crates/{console-network-abi,worker-task-abi}/**, apps/{cohsh,console-network-runtime,hive-gateway,nine-door,root-task,worker-heart}/**, tools/{coh-rtc,cohesix-py}/**, scripts/m26e_qemu_pressure.sh, scripts/rest_perf_harness.py, docs/{INTERFACES,ROLES_AND_SCHEDULING,USERLAND_AND_CLI,TEST_PLAN,BENCHMARKS}.md.
Changes:
  - The accepted GENET gate is unpaced 1,024-request canonical raw TCP at >=600 requests/s and <=5-ms p95 on two exact-image release boots. The owner-approved 9 September decision replaces the former 1.845-ms gate; controlled 180/s latency is diagnostic. Medium/high REST, cohsh, zero-failure and bounded-liveness checks remain required. Wi-Fi throughput/latency and complete <=42-second boot obligations remain unchanged. RAM results, QEMU evidence and final SD-boot qualification are distinct.
  - Console ABI v6 retains the v4-introduced CommandBatch=27 encoding: one through eight consecutive same-connection authenticated commands, each with its original timestamp and UTF-8 bytes inside the unchanged 2,368-byte payload. Lifecycle/identity transitions fence batches. Root validates and reserves capacity for the whole private batch before exact FIFO admission; malformed, stale or oversized batches execute nothing.
  - A rotating pending bitmap and fixed Worker quantum provide fair service, checking mailbox/fault priority between records. QEMU and Pi admit 256 executable Workers (1 Heartbeat, 127 GPU, 128 LoRA) through two active executor lanes and passive Worker SC donation. Pi uses a 16-bit root CNode with compiler-proved reserve and immutable role-image sharing. Generation-scoped Reply recovery returns donated time once and reclaims the faulted instance before recreation.
  - One authenticated target stream carries bounded command/read batches through three fixed host lanes: admitted ticket specifications, receipt/control progress, and bulk telemetry. Every input retains an exact result; capacity/backpressure and cancellation cannot manufacture authority or bypass the existing ticket/journal path.
  - Useful progress may retain a bounded activation through transient empty observations, with independent counter, quantum, completion and probe caps. GENET continuation binds exact generation, connection and control sequence; current-response completion retires that continuation. Fresh durable work earns one separately charged operator-first recheck. Empty rechecks stop; no speculative future-request spin, unbounded tail, larger hidden queue or new executor is admitted.
  - The physical-Pi direct-GENET idle path binds root-control's existing fan-in notification and exact Reply to multiplexed endpoint receive. One nonblocking receive and the complete timer, endpoint, durable producer, operator, network, fault/recovery, quarantine and reboot fences precede blocking. Endpoint messages are copied into dispatcher-owned storage; notification badges are hints. Wi-Fi does not enter this global-idle receive.
  - The existing isolated PCIe runtime solely owns the separately tagged system-timer page at 0xFE003000 and IRQ 99 (SPI 67), badge 2048, handler slot 4 and local notification slot 3. Descriptor adoption is Disarmed. The first exact direct-GENET enable uses a Reply-bearing call, publishes Enabled and arms channel 3 at 5,000 us, half the admitted 10,000-us owner period. Wi-Fi remains disarmed. IRQ service performs only bounded clear/sample/rearm/order/signal/ACK and then receives; no catch-up, retry or second timer owner exists. The lower timer page is pre-admitted before higher Pi MMIO and consumed only in the child VSpace.
  - Fresh foreground CYW43-to-SDIO publication captures the complete parent/child/route/generation and recovery fences before sequence-last commit. Selected MCS atomically prompts slot 8 and waits on slot 3 before another semantic operation. The returned path reclassifies the durable child and first-owner receipt; it never sends a second prompt. SDIO seals fresh one-way work before wake telemetry/blocking while preserving physical IRQ priority. Inexact/classic paths retain their original bounded behavior.
  - Driver runtime ABI v13 gives asynchronous generic MCS commands one initial prompt and an exact 24-byte DROW/DROA continuation handshake. Sequence, action, runtime generation and strictly-next wait slice validate before acknowledgement and one child resume. Bootstrap calls retain supervised Call/Reply donation; CYW43/SDIO retain their hard source-yield boundary. No retry, queue, physical owner or SC numeric changes are implied by a scheduling hint.
  - Passive NineDoor remains local to its sole root-control donor, with release/acquire publication around exact request/response frames. CPU-only shared/control aliases use coherent Normal/XN memory and barriers; MMIO, framebuffer and private DMA retain their own admitted attributes. The root stack reservation is 1 MiB with independent layout/emitted-frame checks and the 2-MiB heap retained; an upper IPC gap is not a downward-overflow guard.
  - Shared schedule dequeue is exact FIFO and rejects empty/stale/out-of-order IDs without mutation. Host-ticket compaction removes only terminal payloads after result publication and durable cursor advancement, retaining the cumulative admission fence. Completed preemptions use a fixed chronological ring whose oldest observation may be evicted without weakening active lease state. Restore the byte-limited preemption view to the newest complete chronological suffix: selecting the oldest prefix hid recent release effects from host-ticket-agent reconciliation after ordinary history growth. Preserve all entry/byte bounds, record grammar, cumulative counts and fail-closed ambiguous outcomes; do not replay an already admitted release.
  - M27g compatibility review: host-ticket-agent requires the matching retained release record; coh/cohsh, Hive Gateway, SwarmUI, coh-status, host-sidecar-bridge, gpu-bridge-host, cas-tool, sidecar-bus, the Python SDK and performance scripts retain their existing contracts. Only root and host-model history selection changes; readers keep the same schema and chronological ordering, and omitted history never establishes an outcome. Fresh target evidence remains required.
  - The compiler owns target population, runtime/console ABI, root fan-in, resource and temporal declarations. Worker and driver archives remain separate and hash-bound. Pi build compatibility derives from the selected SMP+MCS profile; the shared contract does not relabel earlier QEMU or classic evidence as Pi acceptance.
  - Host tools, Python, SwarmUI and evidence readers consume generated target identity and the complete 265-task QEMU/272-task Pi temporal seals while retaining three detailed role exemplars. Gateway metadata exposes configured-backend target_host/target_port for endpoint binding, not proof of a live target. TCP-only cohsh builds exclude model transport closure; CAS/UI test binary resolution and Python population checks retain portable host compatibility.
  - Benchmark comparison requires matched source, image, profile, target, population, harness, workload and error policy. It judges QEMU/Pi parity by successful throughput and errors while reporting physical latency separately. Exact-image diagnostics, scripts, raw TCP, pressure, operator liveness and repeatability determine Pi claims; successful builds, media verification, models and functional pressure alone do not.
Commands:
  - cargo test -p pi4-driver-runtime --lib persistent_child_publication_selects_atomic_mcs_handoff_and_classic_signal -- --test-threads=1
  - cargo test -p pi4-driver-runtime --lib sdio_peer_wake_admits_the_fresh_durable_one_way_command_immediately -- --test-threads=1
  - cargo test -p pi4-driver-runtime --lib atomic_sdio_publication_never_replays_legacy_wait_progress -- --test-threads=1
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib direct_genet_causal_wait_matches_only_the_current_control_identity -- --test-threads=1
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib pi_genet_completed_response_does_not_open_a_future_request_tail -- --test-threads=1
  - scripts/ci/test_plan_converge.sh --target qemu --focus root-mcs --path apps/root-task/src/event/mod.rs
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib pi_root_control_ -- --test-threads=1
  - cargo test -p root-task --test mcs_activation_order -- --test-threads=1
  - cargo test -p root-task --test mcs_fault_lanes -- --test-threads=1
  - cargo test -p root-task --lib service_fault_frontier -- --test-threads=1
  - cargo test -p root-task --lib service_call_arm -- --test-threads=1
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib isolated_self_test -- --test-threads=1
  - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib linked_cyw43_ -- --test-threads=1
  - cargo test -p pi4-driver-runtime --lib direct_genet_ -- --test-threads=1
  - python3 -m pytest -q tests/test_pi4_trace_normalize.py tests/test_pi4_gate_proof.py
  - cargo test -p console-network-abi
  - cargo test -p console-network-runtime
  - cargo test -p root-task --no-default-features --test console_network_service -- --test-threads=1
  - cargo test -p root-task --no-default-features --test isolated_virtio_network_phasing -- --test-threads=1
  - cargo test -p coh-rtc console_network_service
  - cargo test -p nine-door --test schedule_create --test schedule_bounds
  - cargo test -p nine-door lease_
  - cargo test -p host-ticket-agent
  - cargo test -p worker-task-abi -p worker-heart
  - cargo test -p root-task --test worker_ipc --test worker_supervisor --test worker_fault_lifecycle --test worker_resource_admission
  - cargo test -p coh-rtc temporal resource_admission
  - cargo test -p cohsh -p hive-gateway
  - cargo test -p cohsh --no-default-features --features tcp
  - python3 -m pytest -q tests/test_console_network_runtime_packaging.py
  - python3 -m pytest -q tests/test_rest_perf_harness.py tests/test_pi4_compare_driver_models.py tests/test_worker_task_evidence.py tools/cohesix-py/tests/test_orchestration.py
  - cargo test -p coh-rtc --test pi4_profile --test python_profile
  - cargo test -p coh-rtc resource_admission
  - cargo test -p root-task --test isolated_virtio_network_phasing
  - python3 -m pytest -q tests/test_pi4_image_build.py tests/test_pi4_prebuilt_composition.py tests/test_sel4_profile.py
  - scripts/check-generated.sh
  - scripts/ci/check_test_plan.sh
  - .venv/bin/python scripts/sel4_profile.py validate --repo-managed --profile pi4_diagnostic --build-dir seL4/build_UBOOT --require-artifacts --for-runtime
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml --clean
  - scripts/cohesix-build-run.sh --no-run --cargo-target aarch64-unknown-none
  - scripts/m26e_qemu_pressure.sh with the canonical medium and high executable-Worker REST profiles on macOS, followed by equivalent Linux/KVM runs for an accepted Mac candidate
Checks: one child publication admits at most eight already-authenticated commands; original timestamps, per-key FIFO order, connection identity, and queue bounds remain exact; lifecycle events never coalesce; peer-assisted self-test observes decisive state despite ordinary activity, uses one fresh per-connection epoch, and cannot combine replacement or post-retirement traffic; Worker selection is fair; every internal quantum and active window retains hard bounds; the CYW43 outer cap counts only active Network service while its real-wall operator checkpoint and 192-turn cap remain independent; a quiescent direct-GENET Block closes only its software episode while continuous durable work and endpoint freshness retain their guards; the QEMU and Pi 256-Worker populations each consume only the two generated executor-lane utilization reservations; the Pi fixed-plus-maximum-plus-reserve inventory fits its exact 16-bit root CNode with 46,020 slots left; each passive Worker has exactly one allowlisted donor lane and generation-scoped Reply path; shared mappings are immutable and role/image exact while all writable mappings remain private; fault/timeout injection releases the donor once before complete containment; the passive NineDoor service is compiler-rejected unless co-located with its sole root-control donor; the exact selected seL4-16 AArch64 MCS ABI admits eight but rejects eleven refills in an 8-bit SC; direct GENET compiler/profile validation rejects any `wcet_us` other than 800, handoff/runtime validation rejects drift from exact max-eight-refill `3,000/10,000 us`, each guarded slice admits at most one material packet operation, and continuous bidirectional pressure receives an exact 8/8 split inside the 16-slice window; diagnostic-v4 packet-slice high-water and dense-window reason fields round-trip and render without authority; nonforeground CYW43-to-SDIO copies pass both directions and every alignment without crossing either admitted arena or changing foreground trace/overlay authority; the exact authenticated response rotation retains activation only through `Network -> Serial -> LocalSeat -> Dispatch -> Network` and rechecks the loop-top guard before another Network unit; non-VirtIO profiles cannot select direct VirtIO DMA containment and reject an invalid cursor; the retained Pi manifest still hashes to the stage proof after canonical QEMU cleanup; the provenance-bound Pi driver-runtime CPIO rejects tampering and remains byte-identical in a skip-build stage even after later QEMU children occupy the Cargo target directory; schedule depth returns after each completed benchmark lifecycle; terminal execution journals compact without weakening exactly-once recovery; preemption evidence turns over without refusing valid lease control and retains cumulative accounting; public output is byte-compatible apart from documented additive diagnostics; no unbounded loop, queue, retry, donation chain, or authority exists; medium/high QEMU pressure improves materially without unexpected fault, MCS timeout, queue runaway, or operator-liveness regression on either host. Static Pi profile and stage-only PASS remain non-hardware evidence.
Deliverables: ABI v6 bounded command quantum retaining the v4-introduced
CommandBatch contract, two bounded Worker executor lanes, target-qualified QEMU
and Pi 256-Worker populations, a 16-bit Pi root-CNode profile with deterministic
reserve, immutable role-image sharing, generation-safe donated-SC recovery,
three-tier bounded authenticated transport progress, bounded progress-retaining
root activation, shared schedule consumer lifecycle, durable terminal-journal
compaction, rolling preemption evidence, focused regression evidence, and
same-source macOS/Linux QEMU before/after pressure records. Pi hardware
acceptance remains a separate future evidence lane.

Qualification: QEMU performance results retain their original source, host,
profile and proof class in the linked audit record and BENCHMARKS.md; they do
not establish Pi hardware acceptance.

Title/ID: m26e-mcs-operator-inspection
Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / bounded root-shell MCS operator inspection
Goal: Expose source-labelled generated and live seL4 MCS state through `bi`, `caps mcs`, and `smp mcs` without perturbing scheduler accounting.
Inputs: `m26e-mcs-abi-foundation`, `m26e-worker-resource-admission-critical-tcbs`, `m26e-console-network-service-isolation`, selected seL4 BootInfo, generated temporal/resource-admission records, live fault-registry and critical-domain state, crates/cohsh-core/**, apps/root-task/src/{console,event,critical_tcb.rs,hal/critical_tcb.rs}, docs/{INTERFACES,USERLAND_AND_CLI,SECURITY,TEST_PLAN}.md.
Changes:
  - crates/cohsh-core/** + generated grammar/fixtures — preserve bare `caps` and `smp`; add strict `caps mcs` and `smp mcs`; list both MCS spellings as explicit root-shell and host-client help rows; update every parser/help/transcript consumer.
  - apps/root-task/src/{console,event}/** — retain the legacy `bi` line, source every production help path from the shared root-console inventory, and emit bounded kernel BootInfo and generated profile records; keep every `caps mcs` record within the 77-byte Pi linked-HDMI fallback width without dropping fields.
  - apps/root-task/src/{critical_tcb.rs,hal/critical_tcb.rs,event/**} — copy the live registry nonblockingly, release its lock before output, and render authority/object, per-core admission, and per-task temporal/registration/generation state. Never call `seL4_SchedContext_Consumed`, mutate accounting, perform a debug dump, or create authority.
  - docs and compatibility — document provenance and separate QEMU/Pi evidence; review `coh`, `cohsh`, SwarmUI, Hive Gateway, `.coh`, `tools/cohesix-py`, fixtures, release, and performance surfaces without changing their semantics.
Commands:
  - cargo test -p cohsh-core
  - cargo test -p root-task mcs_operator_inspection
  - scripts/cohesix-build-run.sh --clean --no-run --cargo-target aarch64-unknown-none
  - python3 -m pytest -q tests/test_qemu_tcp_response_matrix.py
  - scripts/check-generated.sh
  - scripts/ci/check_test_plan.sh
  - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26e-mcs-operator-inspection-qemu
  - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26e-mcs-operator-inspection-pi4
Checks: legacy behavior remains; every production help path lists literal `caps mcs` and `smp mcs`; output is strict and bounded; every `caps mcs` field survives the Pi linked-HDMI fallback width; generated/live sources stay distinct; missing, contended, early, and fatal state are explicit; QEMU and fresh-Pi evidence remain separate.
Deliverables: Additive root-shell MCS inspection, grammar compatibility, deterministic tests, and separate exact-target evidence.

Title/ID: m26e-worker-abi-identity-notifications
Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / Worker task ABI v1 and exact executable-role matrix
Goal: Freeze one pointer-free namespace-projection ABI, collision-free instance identity, seL4-correct notification contract, and non-vacuous Heartbeat/GPU/LoRA role matrix before any Worker image or supervisor depends on it.
Inputs: `m26e-mcs-abi-foundation`, `m26e-worker-resource-admission-critical-tcbs`, `m26e-mcs-operator-inspection`, apps/worker-heart/**, apps/worker-gpu/**, apps/worker-lora/**, apps/root-task/src/worker_authority.rs, tools/coh-rtc/src/**, configs/root_task*.toml, docs/INTERFACES.md, docs/ROLES_AND_SCHEDULING.md, docs/USERLAND_AND_CLI.md, docs/WORKER_TICKETS.md, docs/GPU_NODES.md.
Changes:
  - crates/worker-task-abi/** — add `worker-task-abi/v1` runtime-init, identity, bounded control/completion, READY, telemetry/receipt, shutdown, standard-fault, timeout-fault, and evidence records with fixed layouts, explicit version/length/sequence/epoch/generation fields, release/acquire rules, and no pointers or extra caps. Define exact `GPU_LEASE_RECEIPT` and `PEFT_RECEIPT` labels/records carrying the generated action code, confirmed/rejected outcome, receipt sequence, full Worker identity, and fixed SHA-256 idempotency/operation/subject/result digests, plus their bounded `worker-gpu-receipt/v1` and `worker-lora-receipt/v1` canonical telemetry encodings.
  - tools/coh-rtc/src/** + configs/root_task*.toml — generate immutable `(role, slot, lease_epoch, supervisor_generation, cap_generation)` endpoint/fault identities; lifecycle and supervisor-wake notification objects; reserved disjoint endpoint/notification badge ranges; per-slot one-hot lifecycle/completion bits and precedence; per-slot durable control/completion records; exact holders/slots/rights/syscalls; one active Worker SC bound only to its TCB; zero normal-IPC blocking Send/Call/Reply/donation depth; standard/timeout fault caps with `Write + GrantReply`; exactly one root-fault Read cap and one serialized receive Reply; per-role slots/images; accepted host-ticket request/result schema sets; the action/receipt-mode version matrix; root-pinned version-2 Worker bindings; and Heartbeat/GPU/LoRA `implemented = true` candidate contracts while WorkerBus remains model-only.
  - tools/coh-rtc/src/** + evidence schema — distinguish model-only, configured executable, QEMU-accepted, Pi-accepted, Worker-runtime-release-accepted, and production-use-case-accepted states; define strict, non-interchangeable `cohesix-worker-observation/v1` (`record_kind=observation`), `cohesix-worker-integration-evidence/v1` (`record_kind=worker-integration`), `cohesix-worker-task-evidence/v1` (`record_kind=target-component`), `cohesix-root-tcb-acceptance/v1` (`record_kind=root-tcb`), `cohesix-mcs-smp-system-acceptance/v1` (`record_kind=full-system`), and `cohesix-worker-release-acceptance/v1` (`record_kind=release`, scope `worker-runtime`) schemas with per-kind required/forbidden field matrices. Exact-target component records key the sorted exact role-required Worker-integration rows plus target/kernel/resolved-manifest/root/MCS-driver-archive/MCS-driver-manifest/CYW43-coexistence-record/Worker-archive/Worker-image-manifest/Worker-image/ABI/evidence hashes; the release record contains exactly six matching component/root/system record references plus the recursively cross-checked runtime artifact/integration graph. No consumer infers record kind, `implemented = true` never depends on later hardware proof, and the runtime release record cannot be parsed as a production use-case acceptance record.
  - docs/INTERFACES.md + docs/USERLAND_AND_CLI.md + generated grammar/fixtures — add the manifest-gated `lora` value to the existing spawn operation and `peft.export` to the existing host-ticket action enum/allowlist; define strict per-action version-2 request/result schemas on the existing host-ticket paths with exact argument sets/bounds, `operation_id`, `subject_ref`, receipt Worker role/id/supervisor-generation/cap-generation, root-resolved Worker slot/lease epoch, and canonical `result_digest`; reject unknown args, free-form host paths, symlink/traversal PEFT inputs, ungenerated GPU/device ids, and cross-subject bindings before dispatch; publish the accepted-schema sets and action/receipt-mode matrix; retain version 1 only for actions requesting no Worker receipt; reject federation fields for receipt-bearing version 2; keep `ATTACH` non-instantiating; and map validated terminal GPU/PEFT results through the generated supervisor records and exact receipt labels without a new VM verb, namespace, or executor.
  - docs/ROLES_AND_SCHEDULING.md + docs/WORKER_TICKETS.md + docs/GPU_NODES.md + docs/TEST_PLAN.md — define exact rights, capacity, identity, coalescing, durable completion, terminal-versus-recoverable fault, PEFT idempotency/receipt, and acceptance-state contracts.
Commands:
  - cargo test -p worker-task-abi
  - cargo check -p worker-task-abi --target aarch64-unknown-none
  - cargo test -p coh-rtc worker_task
  - cargo test -p root-task --test worker_contract
  - scripts/check-generated.sh
  - scripts/ci/check_test_plan.sh
Checks: duplicate/overlapping badge domains, zero or multi-bit notification events, OR aliases, role/slot/epoch/supervisor-generation/cap-generation overflow, unknown or action-incompatible ABI/host-ticket schema versions, unknown/oversized/action-incompatible args, free-form or escaping host paths, missing root-resolved slot/lease epoch, missing/cross-role/non-READY receipt bindings, federated/relayed version-2 receipts, post-admission Worker rebinding, extra caps, unbounded frames, broadened or reversed cap rights, SC-to-notification binding, normal Worker Send/Call/Reply/donation, missing durable completion, invalid fault `GrantReply`/Reply cardinality, missing Heartbeat/GPU/LoRA contracts, executable WorkerBus, and circular evidence-dependent `implemented` validation all fail closed; every WorkerGpu record maps exactly one terminal `gpu.lease.grant|renew|release` result, every WorkerLora record maps exactly one terminal `peft.export|import|activate|rollback` result, and both prove id/ticket/idempotency/digest/generation/replay behavior without granting host execution, credential, model, or device authority.
Deliverables: Compiler-owned Worker ABI v1, exact mandatory role matrix, additive LoRA spawn value, and exact-image acceptance schema.

Title/ID: m26e-worker-image-pipeline-loader
Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / content-addressed Worker images and generic least-authority child loader
Goal: Build, validate, package, hash, and load the three mandatory Worker images before root compilation without repackaging or modifying the newly accepted 26e MCS driver archive.
Inputs: `m26e-mcs-abi-foundation`, `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`, `m26e-worker-abi-identity-notifications`, apps/worker-heart/**, apps/worker-gpu/**, apps/worker-lora/**, apps/root-task/build.rs, apps/root-task/src/hal/**, scripts/cohesix-build-run.sh, scripts/pi4-image-build.sh, scripts/ci/size_guard.sh, generated Worker ABI/slot records, and the newly hash-bound MCS driver/CYW43 coexistence identity.
Changes:
  - apps/worker-heart/** + apps/worker-gpu/** + apps/worker-lora/** — provide real `no_std` target binaries and linker contracts that consume only the sealed runtime-init descriptor, issue READY, block on real IPC/notifications, use admitted time, and remove hard-coded CPtrs, synthetic identity/time, and spin loops; LoRA emits bounded PEFT lifecycle receipts and never trains, imports, loads, activates, rolls back, or infers itself.
  - scripts/worker_image_manifest.py + tests — validate AArch64 ELF class/machine, entrypoint, relocation/load span, W^X segments, stack/IPC bounds, canonical stripped bytes, role/ABI identity, content hashes, duplicate names, and tampering.
  - scripts/cohesix-build-run.sh + scripts/pi4-image-build.sh + apps/root-task/build.rs — add `worker-heart`, `worker-gpu`, and `worker-lora` explicitly to the target Worker build/staging inventory, build Workers first, create a deterministic separate `cohesix-worker-images.cpio` plus `cohesix-worker-image-manifest/v1`, then compile root with generated target-qualified digest expectations and retain the exact archive/manifest in rootserver for target loading. Byte-identical system-CPIO copies remain the host/release projection; typed BootInfo FDT records are never treated as that CPIO. A selected executable role missing from the build list, staged directory, archive, or manifest fails instead of being silently skipped. Do not append to, rename, reorder, or reinterpret `cohesix-driver-runtimes.cpio`, `COHESIX_PI4_DRIVER_RUNTIME_PAYLOAD`, or its seven-driver evidence fields.
  - apps/root-task/src/hal/** — add an additive HAL-backed generic W^X child-image planner/loader for generated Worker records without refactoring or duplicating the MCS-ported physical driver-runtime loader and ABI path.
  - exact-image/release metadata — bind the Worker archive, Worker image-manifest, and per-image hashes separately into QEMU and Pi identity and preserve the rootfs `< 4 MiB` guard.
Commands:
  - cargo build --locked --release --target aarch64-unknown-none -p worker-heart -p worker-gpu -p worker-lora
  - cargo test -p root-task --test worker_image_loader
  - python3 -m pytest -q tests/test_worker_image_pipeline.py tests/test_pi4_image_build.py
  - scripts/cohesix-build-run.sh --clean --no-run --cargo-target aarch64-unknown-none
  - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml --clean
  - scripts/ci/size_guard.sh out/cohesix/cohesix-system.cpio
Checks: root builds only after all three canonical image hashes exist; the exact archive and manifest contain Heartbeat/GPU/LoRA and no WorkerBus; wrong architecture, W+X, bad entry/load bounds, stale/tampered hash, missing LoRA binary, malformed runtime-init bounds, or rootfs overflow fail; QEMU/Pi Worker archives are target-qualified; this task leaves the input MCS driver archive/hash, CYW43/SDIO behavior, inventory, timing, restart, and evidence classification unchanged.
Deliverables: Deterministic separately packaged Worker images, target-qualified image manifest, and reusable least-authority Worker loader without a driver/CYW43 packaging refactor.

Title/ID: m26e-worker-supervisor-child-isolation
Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / transactional executable Worker supervision
Goal: Replace model-only target claims with real Heartbeat/GPU/LoRA child tasks whose spawn, READY, operation, shutdown, fault, teardown, and fresh-generation recreation are atomic and authority-safe.
Inputs: `m26e-worker-resource-admission-critical-tcbs`, `m26e-worker-abi-identity-notifications`, `m26e-worker-image-pipeline-loader`, apps/root-task/src/worker_authority.rs, apps/root-task/src/lifecycle.rs, apps/root-task/src/event/**, apps/root-task/src/ninedoor.rs, apps/worker-heart/**, apps/worker-gpu/**, apps/worker-lora/**, generated slot/image records, canonical Worker docs.
Changes:
  - Release Worker bootstrap reservation restoration — discovered by `m26e-mcs-smp-target-acceptance` on native KVM source `3603bd507f2d252d3dec825dabcffcd15c76569c`: an initiating kernel timeout capture identifies LoRA slot 43 (`worker-172`) executing init-record hashing at PC `0x212700`, with its temporary 400-us SC exhausted before READY; the final population is 255. Under schema 1.18, explicitly select `bootstrap_timeout_policy = "natural-postpone"` for MCS Worker startup, retaining 400/10,000 us, two refills, priority/core assignment, the five-second READY deadline and standard-fault containment. Unbind that SC before installing the existing passive ReturnError timeout endpoint, and publish READY only after both operations succeed. A failed transition keeps admission closed and deadline containment armed. Missing or terminal bootstrap policy and the previous schema fail compilation. Review the complete host-tool suite, Python library and performance scripts: regenerate manifest/profile/hash bindings together; public protocols, workloads, receipt requirements, thresholds and report schemas remain unchanged. Require focused compiler/transition/deadline checks, exact Mac/KVM/Pi builds, full QEMU lifecycle/fault gates and fresh uninterrupted Jetson bootstrap/pressure repeatability. This is a defect restoration under the existing executable-admission and transactional-supervision tasks, not evidence of release acceptance.
  - apps/root-task/src/worker_authority.rs + lifecycle/event code — implement the generated free/allocate/verify/map/configure/admit/resume/READY state machine, reserve ids before READY without publishing live authority, validate every child record, and serialize Queen decisions without blocking root-control, root-fault, or root-emergency TCBs.
  - apps/root-task/src/ninedoor.rs + console projection — make accepted spawn acknowledge bounded queue admission, add the generated LoRA spawn target, expose bounded starting/live/closing/faulted/terminal state, stop new authority immediately on kill, and preserve `ATTACH` as session-only.
  - supervisor completion/fault handling — drain generated per-slot durable READY/operation/receipt records from the supervisor-wake notification, validate sequence/identity/digest, preserve one-in-flight semantics, count droppable telemetry, receive nonblocking critical-TCB handoffs, and keep fault Reply ownership in root-fault until its terminal or allowlisted-recoverable decision completes.
  - supervisor teardown — close admission, signal one-hot shutdown, enforce the grace bound, suspend, clear durable records and notification state, resolve fault Replies, unbind notification/SC, unmap/scrub frames, revoke descendants from retained anchors, delete child objects, prove zero old-generation authority and no blocking-send path, reclaim the slot, and advance generation before reuse.
  - apps/worker-heart/** + apps/worker-gpu/** + apps/worker-lora/** — validate init/control records, publish durable READY/completion/receipt records before signaling, produce only explicitly droppable endpoint telemetry, honor coalesced lifecycle precedence, block when idle, and reject late/stale generations; WorkerLora maps the four PEFT result actions exactly and only WorkerBus remains model-only.
  - generated artifacts + canonical Worker docs — use `implemented = true` only for complete static executable contracts and describe acceptance-pending versus exact-target-accepted state separately.
Commands:
  - cargo test -p root-task --test worker_ipc
  - cargo test -p root-task --test worker_supervisor
  - cargo test -p root-task --test worker_notification
  - cargo test -p root-task --test worker_fault_lifecycle
  - cargo test -p worker-heart -p worker-gpu -p worker-lora
  - cargo check -p worker-heart -p worker-gpu -p worker-lora --target aarch64-unknown-none
  - scripts/check-generated.sh
Checks: ring/control saturation, duplicate sequence, forged role/slot/epoch/supervisor-generation/cap-generation, two sequential same-role generations with a simultaneous second-live-slot refusal, coalesced notifications, durable-completion publish/signal races, READY timeout, construction failure at every phase, ordinary terminal fault, allowlisted timeout recovery, fault before READY/during IPC, attempted forbidden blocking send, dropped telemetry, late completion/receipt, kill/fault repetition, generation exhaustion, and repeated maximum-slot churn fail or recover deterministically with no orphan namespace state, cap, mapping, pending record/signal, Reply, SC, or executable TCB; PEFT export/import/activate/rollback receipts prove the exact host-ticket-result-to-supervisor-to-WorkerLora mapping without moving host work into the VM.
Deliverables: Real transactional Heartbeat/GPU/LoRA tasks and complete per-instance 26e containment/reclamation; WorkerBus remains honestly model-only.

Title/ID: m26e-gpu-refresh-control-retention
Milestone: Milestone 26e — host integration / m26e-host-integration-dependency-contract; release burn-in defect restoration
Goal: Keep admitted GPU control records readable during ordinary inventory refreshes from the same live publisher generation.
Inputs: exact Pi GENET burn-in 8c050a0aaf7b image, continuous real Orin inventory, 30-second GPU lease lost after a six-second observation interval, and WorkerGpu READY records.
Changes:
  - apps/root-task/src/ninedoor.rs — preserve bounded ctl/lease/status append logs for an unchanged GPU identity within the same unexpired publisher epoch; withdrawal, changed device/source/epoch, expiry and stale-snapshot rejection remain fail-closed.
  - apps/nine-door/src/host/{core.rs,namespace.rs} — preserve the corresponding host-model journal semantics without claiming target execution or provider freshness acceptance.
  - docs/GPU_NODES.md and docs/HOST_TOOLS.md — describe inventory seeds versus appended control history and record complete host-tool, Python SDK and benchmark compatibility review.
Commands:
  - cargo test --locked -p nine-door --test integration gpu_inventory_refresh
  - cargo test --locked -p root-task --lib --features driver-tests-pi4 gpu_snapshot
  - exact-profile Pi release build, image-bound RAM boot, first raw GENET gate, live refresh/lease/Worker and FUSE checks
Checks: successful same-generation refresh preserves control bytes; changed generation/device, withdrawal, expiry and rejected updates cannot retain or create stale authority. No new CUDA executor, lease enforcement claim, schema, namespace, unsafe code or performance threshold.
Deliverables: material retention repair with focused host contracts and fresh Pi evidence before a revised timed attempt.

Title/ID: m26e-host-integration-dependency-contract
Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / generated host-integration and use-case dependency contract
Goal: Inventory every advertised host integration and use case, generate its transitive Worker/provider/release dependencies and acceptance obligation, and prevent a Worker, release, use case, or playbook from being promoted while a required host path is mock-only, missing, or unowned.
Inputs: `m26e-production-surface-truth-and-stub-retirement`, `m26e-worker-abi-identity-notifications`, `m26e-worker-supervisor-child-isolation`, Cargo.toml, configs/root_task*.toml, configs/generated/implementation_surface_inventory.json, tools/coh-rtc/src/**, apps/cohsh/**, apps/coh/**, apps/coh-status/**, apps/hive-gateway/**, crates/cohesix-rest/**, apps/swarmui/**, tools/cohesix-py/**, apps/gpu-bridge-host/**, crates/host-cuda/**, apps/host-ticket-agent/**, apps/host-sidecar-bridge/**, apps/sidecar-bus/**, apps/cas-tool/**, scripts/release_bundle.sh, docs/USE_CASES.md, docs/HOST_TOOLS.md, docs/HOST_API.md, docs/GPU_NODES.md, docs/PYTHON_SUPPORT.md, docs/INTERFACES.md, docs/TEST_PLAN.md, and current release manifests.
Changes:
  - tools/coh-rtc/src/** + configs/root_task*.toml — add compiler-owned `host-integration-dependency/v1` records that reference existing generated namespace paths, host-ticket actions, schemas, and authority rather than redefining them. Require integration id/owner, host profiles, dependent Worker roles/use cases/playbooks, `role_required|release_required|use_case_required|optional|future` obligation, required/allowed observed modes, unavailable/future ownership, auth/secret refs, timeout/retry/cancel/idempotency/fencing posture, readiness/degraded semantics, package/artifact requirements, evidence lane, and owning milestone.
  - tools/coh-rtc/src/codegen/** + configs/generated/** + docs/snippets/** — extend the implementation-surface inventory with one bounded dependency graph and conformance vectors consumed by Rust/Python/REST/UI/release tools. Include every host-facing workspace binary and library API presented as a product surface, every host integration named by any tracked README/canonical doc/help/example, all six `docs/USE_CASES.md` scenarios, and every built-in `cohesix-playbook` id; fail generated-drift checks when an advertised surface is missing, hand-classified elsewhere, or reaches a live row through a fixture/model/no-op dependency.
  - crates/cohesix-worker-evidence/** + schemas — add strict validation for `cohesix-worker-integration-evidence/v1` (`record_kind=worker-integration`) and a sorted bounded reference list on target-component evidence. Each record covers exactly one dependency row and binds its observed `unknown|missing|disabled|fixture|mock|dry-run|live` mode to the exact dependency graph, manifest, component/config/artifact hashes, optional QEMU or Pi target session, host profile/OS/architecture, provider/package versions, action/observation/receipt outcomes, redacted raw evidence, PASS/FAIL, and blockers without containing secrets or becoming Worker READY evidence.
  - configs/host_integration_acceptance.toml + scripts/ci/host_integration_run.sh + scripts/ci/check_host_integration_inventory.py + tests/test_host_integration_run.py — create the matrix-only, fixture/mock/dry-run/live, projection-compatibility, and release validation lanes plus their schema, tamper, mode-substitution, missing-owner, and secret-redaction tests. The mandatory 26e live target-session rows are `worker-control`, `gpu-receipt-path`, and `peft-receipt-path`; external GPU/PEFT provider rows remain separately observed and cannot be promoted from the receipt fixture. Advertised FUSE, systemd, Docker, Kubernetes, federation, SIEM/evidence, sidecar, CAS/artifact, and packaging surfaces receive their exact release/use-case obligation and deterministic unavailable behavior. Later NeMo, MCP/A2A, Prometheus/OpenTelemetry, general inference/training, and unbuilt industry providers are explicit future records, never silent omissions.
  - docs/USE_CASES.md + docs/HOST_TOOLS.md + docs/GPU_NODES.md + docs/PYTHON_SUPPORT.md + docs/TEST_PLAN.md — generate or embed the dependency/support-level table and define that executable-Worker proof, provider availability, package presence, mock/dry-run success, and use-case promotion are independent states.
Commands:
  - cargo test -p coh-rtc host_integration
  - cargo test -p cohesix-worker-evidence
  - python3 scripts/ci/check_host_integration_inventory.py
  - python3 -m pytest -q tests/test_host_integration_run.py
  - scripts/ci/host_integration_run.sh --matrix configs/host_integration_acceptance.toml --matrix-only --state-dir out/host-integration/m26e-matrix
  - scripts/check-generated.sh
  - scripts/ci/check_test_plan.sh
Checks: Duplicate ids, unknown action/path/schema refs, missing owners, unclassified host binaries/docs/playbooks, circular dependencies, a role-required integration with no live runtime lane, fixture/mock/dry-run satisfying a provider-live row, a release-required surface with no package/evidence rule, a use case promoted with an unsatisfied dependency, a future provider selected as live, secret-bearing evidence, and host/provider readiness interpreted as Worker READY all fail deterministically; the resulting graph assigns every integration gap to exactly one task-owning milestone id that exists in this plan, including the distinct 31 semantic, 35 inference, 28d/28e selected MCP/A2A, 36 extended protocol, 33 production-bundle, and 27f UI owners under the ownership map, with no ambiguous or compound deferral.
Deliverables: One compiler-owned host-integration/use-case dependency graph, exhaustive inventory guard, strict per-row Worker-integration evidence schema, and exact milestone ownership for every dependency needed by fully functional Workers and their documented use cases.

Title/ID: m26e-host-worker-integration
Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / protocol-faithful host integration for real Workers
Goal: Make Cohesix host tools and every mandatory 26e host-integration lane discover, start, observe, correlate, execute, package, and evidence real Heartbeat/GPU/LoRA Workers through existing Secure9P/console projections with one generated state/dependency contract, no new authority plane, and no VM-local GPU/PEFT execution.
Inputs: `m26e-production-surface-truth-and-stub-retirement`, `m26e-worker-abi-identity-notifications`, `m26e-worker-image-pipeline-loader`, `m26e-worker-supervisor-child-isolation`, `m26e-host-integration-dependency-contract`, Cargo.toml, configs/root_task*.toml, configs/host_integration_acceptance.toml, crates/worker-task-abi/**, crates/cohsh-core/**, crates/cohesix-rest/**, apps/cohesix-proto/**, apps/nine-door/**, apps/cohsh/**, apps/coh/**, apps/coh-status/**, apps/gpu-bridge-host/**, crates/host-cuda/**, apps/host-ticket-agent/**, apps/host-sidecar-bridge/**, apps/sidecar-bus/**, apps/cas-tool/**, apps/hive-gateway/**, apps/swarmui/**, tools/cohesix-py/**, tools/swarmui-ui-tests/**, tools/coh-rtc/src/**, resources/openapi/hive-gateway.yaml, scripts/cohsh/**, scripts/ci/host_integration_run.sh, scripts/rest_perf_harness.py, tests/test_rest_perf_harness.py, scripts/release_bundle.sh, docs/USE_CASES.md, docs/HOST_TOOLS.md, docs/HOST_API.md, docs/GPU_NODES.md, docs/PYTHON_SUPPORT.md, docs/BENCHMARKS.md, docs/TEST_PLAN.md, docs/audit/checklists/RELEASE_EVIDENCE_CHECKLIST.md, generated Worker image manifests, and the accepted 26e MCS driver/CYW43 coexistence identities by immutable hash/reference only.
Changes:
  - Release host-model Queen-log tail restoration — discovered by `m26e-mcs-smp-target-acceptance` during Conditional E's native three-hive scale comparator. The in-process `cohsh` transport must apply the target's existing 64-record default specifically to `/log/queen.log`; preserve explicit 1..256 line requests, complete CAT reads, and other paths. Fresh native KVM and native model probes provide the independent default-window oracle. Keep every benchmark operation, byte limit, Worker count, timeout, retry rule, error budget and report schema unchanged; preserve the failed 3,000-Worker run. Review all host tools and Python consumers as recorded in HOST_TOOLS. Host-model success remains distinct from live federation/provider and target acceptance.
  - Release systemd status parsing restoration — discovered by `m26e-mcs-smp-target-acceptance` during Conditional E on native Linux: the compatibility executor flattened successful `systemctl show` property records before the line-based parser, rejecting a valid inactive/dead response. Preserve property line boundaries inside the existing UTF-8-safe 256-byte capture bound; flatten only operator receipt/error summaries. Test actual property framing, byte boundaries and single-line summaries. Provider publication availability and federation success remain separate live gates; do not manufacture target unit entries or treat this parser repair as provider acceptance. Review the complete eight-tool host suite, Python library, generated contracts and benchmark consumers together; only host-ticket-agent parsing and its focused fixtures change, with no interface, workload, retry or threshold change.
  - Release staged host-test restoration — QEMU `4474dafe4` passed its medium/high pressure workloads but Stage 01 exposed two test-isolation defects. Preserve the documented QEMU Worker-supervisor/GPU-executor refill allocations of 10/10 and Pi allocations of 2/8, assert each exact value and 256-byte SC size, and remove only those two fields from cross-target equality. Isolate all TCP authentication resolver environment inputs in SDK tests and retain the primary-token precedence contract so the authenticated release runner cannot contaminate fallback tests. Runtime, generated manifests, host-tool interfaces, SDK behavior and benchmark workloads remain unchanged; rerun the complete Python gate with the release environment present.
  - Release pressure proof retention — discovered by `m26e-mcs-smp-target-acceptance` on QEMU `4474dafe4`: 87,683 medium operations and 3,106 successful GPU/LoRA receipts completed, but periodic qlog exports lost the Heartbeat teardown during full-fleet discovery; per-Worker receipt counters also coincided across live slots. Capture target teardown/READY records before dependent discovery and exact receipt/completion records before reusing their Worker lane. Retain original unique fragments within the existing 64 MiB bound, with bounded serialized capture and fatal missing/conflicting evidence. New pressure rows carry the authenticated five-part identity; the collector correlates that identity with target records and preserves strict ambiguity rejection for legacy rows. Runtime, scheduling, raw benchmark thresholds, console/REST, the complete host-tool suite and Python SDK remain unchanged; the benchmark producer, shared host log collector, evidence consumer, focused tests and benchmark contract change together. Preserve the original run and require fresh actual pressure/log correlation before promotion.
  - Release executable pressure report restoration — discovered by `m26e-mcs-smp-target-acceptance` on exact QEMU source `1e8254be3`: medium pressure completed 1,664 GPU renewals and 1,547 LoRA exports with zero receipt errors, but report validation required a setup-only GPU grant that had left the bounded 256-record window. Require the actual timed GPU renewal and LoRA export actions plus positive timed receipt counts; setup grants alone cannot qualify pressure. Preserve the producer's existing per-receipt timing/read diagnostics and validate their exact optional shape, finite nonnegative timings and positive read counts at the collector boundary. Unknown fields, malformed diagnostics, stale identity, nonmonotonic sequence, unconfirmed receipts and missing target-log correlation still fail. The complete host-tool suite and Python SDK need no protocol or generated-contract changes; both QEMU/Pi report builders, benchmark documentation and deterministic producer/collector tests change together. Preserve the failed canonical run and rerun real target reporting before promotion.
  - Release-candidate PEFT projection restoration — discovered by `m26e-mcs-smp-target-acceptance`: restore host registry activation/rollback without writing the read-only `/gpu/models/active` view. The CLI publishes the existing validated bridge snapshot; ticket-agent and Python local commits report pending projection. Prepare bounded state before the atomic active-pointer commit and reject interrupted state/pointer disagreement. Apply the existing 32-byte lease-id bound before every version-2 GPU provider operation, preserving the one-round-trip renewal. Repair receipt fixtures to admit valid GPU subjects before provider rejection, deliver expired results to their exact READY Workers, and independently retain fault/teardown/generation tests. Review all host tools, Python, generated contracts and benchmark consumers together; do not relax target policy, receipt outcomes, workload, thresholds or evidence provenance.
  - Release-candidate integration evidence routing — discovered by `m26e-mcs-smp-target-acceptance` after all nine Worker fault cases and 21 host terminal results passed: decode the authenticated Worker fragment stream and hash its original bytes in host-integration observations. Retain service teardown validation in the existing preflight collector over its three separate exact-boot UART/GDB pairs. Wait for each exact Worker receipt and retain its authenticated log before eviction. Reconcile the target gate with the existing host-ticket mapping: failed and expired results produce Rejected on a live Worker; a late result after retirement is fenced as stale at root and never delivered to the replacement. Preserve all 21 live receipt cases and add seven real agent publication barriers with ordered teardown, fresh same-role READY, exact ticket snapshots and unchanged replacement sequences. After sealing those observations, require fresh confirmed GPU and LoRA receipts on the final live replacements before preflight; retired completions remain ineligible. Correct unattended PTY input ownership and recognize only the exact root shutdown completion following synchronous teardown. The full host-tool suite, Python library, generated contracts and benchmark report consumers require no interface changes; runtime behavior and provenance remain unchanged.
  - Release benchmark liveness verdict — discovered by `m26e-mcs-smp-target-acceptance` on native KVM: 64 GPU/LoRA receipt failures and root-emergency were hidden by an aggregate error rate below one percent. Preserve numerical metrics and the declared budget, but fail both executable modes on lost Worker receipts or fatal UART status. Review the complete host-tool suite, Python API and benchmark consumers: no transport, provider, generated contract or report schema changes are needed; the command verdict now preserves the existing execution-liveness contract. Retain the failed target for diagnosis before any runtime repair.
  - Release benchmark passive Heartbeat parity — discovered by `m26e-mcs-smp-target-acceptance` after exact QEMU component preflight passed: align the benchmark acceptance-summary parser with the existing shared Worker evidence contract. A freshly recreated READY Heartbeat may have zero workload completions; GPU and LoRA still require positive completion sequences and confirmed receipts. Reject malformed, negative and Boolean sequences. Independent Heartbeat progress, lifecycle and fault evidence remains mandatory. The complete host-tool suite and Python library already preserve this role distinction; no public protocol, schema, workload, threshold or target-runtime change is required.
  - Release pressure agent state isolation — discovered by `m26e-mcs-smp-target-acceptance` after component and live preflight passed: execution lane topology and completed ticket cursors must survive the transition into pressure. Use eight lanes from the first receipt-matrix invocation, preserve its completed state as evidence, and resume pressure from a copy of those same cursors and journals. Empty state replays deliberately retired tickets and blocks later live work. Keep the agent's topology mismatch rejection, journal reconciliation and receipt fencing unchanged. Verify both emitted lane configurations and exact state handoff, then rerun the real target transition. The complete host-tool suite, Python library, generated contracts and benchmark schemas need no changes; the canonical harness preserves existing agent restart semantics.
  - Pi exact-132a W02 host-profile correction — the target correctly publishes worker-15 under shard 0f, but the gateway unconditionally reports the QEMU six-bit profile and makes structured discovery expect 03. Add an explicit generated Worker runtime profile selection, retain the QEMU default and select the existing eight-bit Pi profile for managed Pi benchmark gateways. Preserve the shard algorithm, namespace, bounds response shape, authentication, broker/pool limits, workload, readiness predicates and evidence classes. Focused CLI/default/profile bounds and managed-launch tests must cover both targets; actual Pi discovery and pressure remain physical evidence.
  - Cargo.toml + crates/cohesix-worker-evidence/** — add a host-only bounded parser/validator shared by Rust host consumers. It represents transport/action outcome separately from declaration (`model-only` or `executable`), lifecycle (`absent`, `queued`, `starting`, `ready`, `closing`, `faulted`, or `terminal`), artifact (`missing`, `verified`, or `mismatch`), receipt (`none`, `pending`, `confirmed`, `rejected`, or `stale`), integration obligation/observed mode, and execution proof (`none`, `host-model`, `qemu`, or `fresh-pi`). It validates record kind and its required/forbidden field matrix, role, public instance id, slot, logical lease epoch, supervisor generation, cap generation, receipt sequence, ABI/schema version, target class, dependency-graph and Worker-integration record hashes, kernel/root/driver/CYW43/Worker archive/image-manifest/image hashes, record bounds, duplicate identity, and stale generation without exposing raw badges, CPtrs, capability values, or secrets. Worker-runtime release eligibility is derived separately from artifact state plus satisfied role/release compatibility rows and the matching QEMU/Pi component, root-TCB, and full-system acceptance graph; a missing or mismatched kind/hash/schema/target/evidence layer is a typed failure, never a downgraded proof class, and this release status never implies production use-case acceptance.
  - apps/cohesix-proto/src/lib.rs — provide stable canonical role labels, strict parse/round-trip behavior, and `ALL_ROLES`; preserve `Role::Worker` compatibility as canonical `worker-heartbeat`. WorkerBus recognition never implies executability, and profile-dependent declaration/lifecycle/receipt/proof state does not enter this protocol-label crate.
  - tools/coh-rtc/src/** + generated clients/docs — generate the executable-role matrix, host-integration dependency graph, Worker ABI/evidence schema versions, maximum live tasks, canonical sharded telemetry template, legacy-alias gate, lifecycle vocabulary, receipt bounds, archive identity, and proof vocabulary from the selected profile. Rust, Python, REST, and UI consumers use the same generated JSON schemas and conformance vectors; direct-TCP local manifests remain expectations, while remote declarations come from bounded remote metadata and proof comes only from hash-matched Worker plus per-row Worker-integration evidence.
  - crates/cohsh-core/** + apps/cohsh/** + scripts/cohsh/** — support `lora`/`worker-lora` in the existing spawn/kill flow through `/queen/ctl`, keep WorkerBus target spawn deterministically rejected as model-only, discover canonical sharded Worker paths, render queued/starting/ready/closing/faulted/terminal separately, and never treat a successful control write as READY. Ticket mint/attach for WorkerBus remains session/model authority and never task-creation proof; help, generated grammar, transcripts, and ACK/ERR/END fixtures land together.
  - apps/coh/** — preserve existing GPU/PEFT transport or host-action `status` meanings and add independent declaration, lifecycle, artifact, receipt, and proof fields. Connected receipt-bearing GPU lease and PEFT flows explicitly select or spawn the matching WorkerGpu/WorkerLora, wait for READY within the generated bound, submit the strict version-2 record on the existing host-ticket path, and correlate grant/renew/release or export/import/activate/rollback terminal results with bounded Worker receipt ids and canonical telemetry paths. Direct/local flows remain host-only; a successful write advances only to queued/request-admitted, never READY or target-accepted.
  - apps/root-task/src/ninedoor.rs + apps/host-ticket-agent/src/{claim,lib,main,status,wal}.rs — make root's existing `spec.snapshot` the canonical enriched version-2 admitted projection and forbid execution from raw request bytes. Add the local single-agent lock/fence and crash-safe version-2 `prepared -> executing -> provider-result-persisted -> result-published -> terminal/cursor` journal for exactly the seven receipt-bearing GPU/PEFT actions, with action-specific observe/reconcile recovery. Separate v2 Worker lifecycle from GPU lease lifecycle so grant/renew/release never implicitly spawn/kill the receipt Worker and release/preempt result delivery precedes any independent teardown. Preserve version-1 behavior as a separately classified compatibility input; do not claim its general provider/federation durability is repaired here.
  - apps/host-ticket-agent/src/** + provider executor helpers — replace every byte-indexed `str[..N]` output/error truncation touched by the v2 path with a shared UTF-8-boundary-safe bounded encoder; add multibyte, exact-boundary, oversized, provider-error, journal-recovery, and receipt-output tests so untrusted non-ASCII text cannot panic the agent or an executor.
  - apps/coh/src/evidence.rs + apps/coh/src/evidence_timeline.rs — discover generated canonical paths; validate Worker image identity, lifecycle, receipts, integration obligations/observed modes, and exact-target evidence; emit `cohesix-worker-observation/v1` for live/host-model observations and import but never synthesize the distinct worker-integration, target-component, root-TCB, full-system, or release records; and keep host, host-model, integration, QEMU, fresh-Pi, runtime-release, production-use-case, GPU, PEFT, provider, and CYW43 evidence separate. Missing or mismatched target or required integration evidence produces no proof and a typed blocker, never a degraded PASS.
  - crates/host-cuda/** + apps/gpu-bridge-host/** — retain deterministic NVML-to-CUDA discovery/fallback and publish the existing GPU/model/LoRA snapshots with bounded generated operation, lease, model, and exact version-2 WorkerGpu receipt correlation when a receipt-bearing lease action names one. Classify mock/demo catalogs as `host-model`, zero-device/unavailable probes explicitly, and real NVML/CUDA inventory as provider `live`; a missing, malformed, unsafe, or unreadable live model registry yields explicit empty/unavailable state and never falls back to the demo catalog or implicitly activates the first model. Live TCP/REST publication resolves a non-placeholder secret reference before connection. The 26e role gate injects bounded provider results to prove all three result-to-Worker paths but does not promote inventory, publication, or a fixture result into GPU execution/device-isolation proof. Keep CUDA, NVML, model registry, adapter bytes, training, activation, and inference host-side; never call an internal Worker endpoint, derive READY from bridge publication, grant hardware caps, or imply that receipt-only WorkerGpu performs GPU work. Milestone 27b owns live GPU provider/executor conformance.
  - apps/coh/src/peft/** + apps/host-ticket-agent/** — add `peft.export` through the existing bounded `coh` export helper and generated action allowlist; consume only root-admitted, exact-READY-Worker-pinned, local-hive version-2 records for all three GPU lease and all four PEFT actions; and produce the canonical immutable result digest. Make the local version-2 executor safe enough to prove every receipt path: confine canonical registry/export paths, reject symlinks/traversal, lock per registry/active pointer, use unique bounded temporary files with file/directory sync plus atomic rename where supported, preserve the prior active pointer until commit, record recoverable partial host/VM publish state, and verify adapter/manifest/base-model/job hashes before import or activation. Distinguish host action completion, VM request admission, Worker READY, Worker receipt confirmation/rejection/stale state, timeout, terminal fault, artifact identity, and target proof while preserving version-1 uncorrelated/federated action-result semantics. Executors use only the root-admitted canonical record, existing console/Secure9P paths, the v2 pre-execution journal, and bounded observation; disconnected/local direct work stays explicitly host-only and never synthesizes a Worker receipt. These fixture/local transaction tests do not provide the production PEFT registry, training, evaluation, scanning, runtime-reload, or provenance acceptance owned by Milestone 27d.
  - apps/coh/src/mount.rs + generated `coh.mount` policy + release packaging/tests — add canonical sharded Worker roots and bounded dynamic Worker entries to the FUSE allowlist instead of relying on the legacy `/worker` root; run real direct-console and REST-backed Worker telemetry/receipt append/read/unmount/cleanup smokes through FUSE 3 on supported Linux packages and MacFUSE on advertised macOS packages. Resolve the current REST-backed write `EINVAL` limitation without broadening append-only offsets or target policy. Verify generated mount allowlists, dynamic telemetry bounds, request-auth, one-gateway-mount locking, disconnect behavior, and no generic POSIX create/rename/delete semantics; `--mock`, mount-directory creation, or library presence alone is not FUSE acceptance and a mount never supplies Worker readiness.
  - apps/host-sidecar-bridge/** + apps/host-ticket-agent/src/executors/{systemd,docker,k8s}.rs + tools/cohesix-py/cohesix/integrations.py — preserve current schemas/actions and prove they do not drift or masquerade as Worker state while the dependency matrix classifies them as current primitives/integration patterns. Mock, probe, or basic command-adapter success cannot promote an action-airlock, self-healing, Kubernetes, systemd, or Docker use case. Milestones 27a/27b own delegated identity, writer fencing, disposable live-safe and negative fixtures, full provider/version conformance, rollback/fail-safe policy, and installable production deployment profiles; 26e must name those blockers rather than silently substituting mock data.
  - host federation, SIEM/evidence, CAS/artifact, sidecar, and release surfaces — attach every shipped surface to its generated obligation and evidence lane. Preserve version-1 federation/fleet compatibility tests while classifying current action-completion as non-promotable until the later owner proves true pre-forward write-ahead persistence, enforced relay timeout, no pending-entry eviction, source-visible terminal receipt correlation, live metrics, and writer fencing; reject version-2 Worker receipt relay outright in 26e. Prove SIEM and evidence output is bounded/redacted/reconstructable, hash CAS/model refs without packaging payload secrets, and prove sidecar/provider readiness cannot parse as Worker READY. Optional or future integrations produce explicit unavailable/future records.
  - apps/hive-gateway/** + crates/cohesix-rest/** + resources/openapi/hive-gateway.yaml — add optional declaration-only `WorkerRuntimeBounds` to the existing bounds response: role matrix, ABI/schema version, maximum live tasks, canonical telemetry template, and legacy-alias gate. Absence means `unknown`, never model-only. Add optional gateway `backend_class` (`host-model`, `console-projection`, or `unknown`) to status; even `console-projection` proves no target class. Add an explicit bounded `--worker-acceptance-evidence <path>`/generated-config import for a local evidence record or release-bundle acceptance file: require a size-bounded canonical regular file under the explicit operator/release root with no symlink traversal, validate its `record_kind`, complete hashes, target, and schema through `cohesix-worker-evidence`, then expose only a redacted optional `worker_acceptance` summary on the existing status response. Absence or validation failure yields no proof and a typed diagnostic. Live lifecycle/receipts stay on existing LS/CAT/TAIL namespace projections. Add canonical `/shard` post-control cache invalidation and backward-compatible absence tests; add no Worker REST action, direct Worker RPC, authority-bearing route, or optimistic success state.
  - apps/swarmui/** + tools/swarmui-ui-tests/** — stop inferring Worker roles from id prefixes or defaulting generic `worker-*` ids to Heartbeat. Render declaration, lifecycle, receipt, artifact, and proof separately from structured generated data; consume proof only from the gateway's shared-validator-backed optional `worker_acceptance` summary; version and migrate older model-only replay/snapshot fixtures so absent fields never default to READY; keep unrelated workbench redesign in Milestone 27f.
  - tools/coh-rtc/src/codegen/cohesix_py.rs + tools/cohesix-py/cohesix/generated.py — generate Worker declarations, ABI/host-ticket/evidence schema versions, maximum live tasks, sharding data, receipt bounds, and `/shard` mount permission. Add a typed bounded `cohesix/worker.py`; add existing-path `worker_spawn`, `worker_observe`, and bounded `worker_wait` APIs for Heartbeat/GPU/LoRA; reject WorkerBus spawn; and retain existing GPU lease entrypoints as compatibility wrappers over the same generated control and ticket projections.
  - tools/cohesix-py/cohesix/client.py + receipts.py + evidence.py — add grant/renew/release WorkerGpu and export/import/activate/rollback WorkerLora receipt consumers that explicitly bind a READY Worker through the existing host-ticket path while keeping `execution_location=host`; wait for and validate the root-admitted request, lease/Worker identity, terminal provider result, canonical result digest, Worker receipt, target manifest/image identity, and evidence reference. A successful append, local ACK, subprocess exit, local argument summary, unknown manifest, or `/proc` snapshot may be recorded only as a client transcript/observation and is never named or serialized as the authoritative receipt. Never invent or rebind a VM receipt when disconnected or after Worker teardown.
  - tools/cohesix-py/cohesix/backends.py + orchestration.py + playbooks.py + tests/examples/docs — classify MockBackend as `host-model`, REST from gateway `backend_class`, and TCP/filesystem as projection/unknown; model Heartbeat/GPU/LoRA lifecycle/receipts and reject WorkerBus in mocks; keep high-count playbooks explicitly control-model rather than task-creation proof; expose the typed API and host-only PEFT boundary.
  - apps/nine-door/src/host/** + Hive Gateway mock — mirror the generated Heartbeat/GPU/LoRA grammar and structured lifecycle/receipt records for compatibility tests, reject WorkerBus spawn, and mark every mock Worker `host-model`. Generic provider records such as `/host/... state=ready` cannot parse as Worker READY and mocks claim no image/task/MCS/fault/QEMU/Pi execution.
  - apps/host-sidecar-bridge/** + apps/sidecar-bus/** — keep provider/link readiness and WorkerBus session/model state independent of executable Worker lifecycle. These are regression-only surfaces in 26e: add no task-creation path, and prove their `ready`/linked/provider records cannot parse as Worker READY or target proof.
  - apps/coh-status/src/lib.rs + read-only tests — keep 26e to the existing library/replay surface: consume the shared Worker validator and generated canonical paths, replace the current generic `/queen/ctl`/legacy-`/worker` transcript with read-only canonical `/shard` and evidence fixtures, and prove no authority command or inferred proof exists. Do not add or claim a live `coh-status` binary here; Milestone 40 owns that standalone read-only CLI.
  - scripts/rest_perf_harness.py + tests/test_rest_perf_harness.py — add explicit `host-model` and `executable` population modes. Synthetic high-count workloads remain host-model; executable mode obeys generated `max_live_tasks`, discovers real structured READY instances through canonical `/shard` paths, forbids synthetic id expansion, records requested/discovered/READY populations plus backend/proof class, and calls a control write `admitted` rather than `accepted`. Starting QEMU alone never yields QEMU proof.
  - scripts/cohesix-build-run.sh + scripts/ci/host_integration_run.sh + scripts/release_bundle.sh — add `host-ticket-agent` and every selected-profile host tool explicitly to source-build/staging lists; execute selected target-session dependency rows and emit strict Worker-integration records; add verification-only `--verify-worker-acceptance`, Worker QEMU/Pi component, root-TCB QEMU/Pi, and full-system QEMU/Pi evidence inputs. Generate an exact named host-tool/image/evidence manifest and require externally supplied host-tool directories to match it; a missing required binary, Worker image, schema, or evidence file fails rather than being silently skipped or accepted because the directory is non-empty. Hash-validate the dependency graph and every role/release-required integration record plus `cohesix-worker-images.cpio`, its image manifest, ABI versions, MCS driver archive/manifest, CYW43 coexistence record, and every target acceptance input for selected executable 26e profiles. The release manifest selects the complete canonical Pi 4 SD stage by an exact compiler-owned file list, validates the sealed primary/fallback image identity against the current source commit, and rejects omitted, extra, linked, or stale stage files. Linux release production requires an argument-selected remote ARM64 builder, a source-bound exact host-tool provenance manifest, and remote creation plus local byte verification of the final tarball. Packaging alone yields artifact `verified` and execution proof `none`; it may report Worker-runtime release eligibility only after the matching integration/component/root/system graph exists, and it cannot emit the final release-accepted record before `m26e-mcs-smp-target-acceptance` or copy stale evidence onto a different host profile, provider, kernel, root image, driver archive, Worker archive, manifest, dependency graph, or CYW43 record.
  - canonical host/Worker/PEFT/interface/release docs and fixtures — document the shared state axes, existing-authority projections, host-only GPU/PEFT boundary, canonical sharded paths, evidence promotion, replay migration, and release requirements. No CYW43/SDIO timing, state-machine, restart, packaging, image-build, trace-normalization, or proof-classification file may be edited; this task consumes only its frozen artifact identity.
Commands:
  - cargo test -p cohesix-worker-evidence
  - cargo test -p nine-door -p coh-status
  - cargo test -p cohsh-core -p cohsh
  - cargo test -p host-cuda
  - cargo test -p coh --features fuse,nvml
  - cargo test -p gpu-bridge-host -p host-ticket-agent -p hive-gateway -p cohesix-rest
  - cargo test -p host-sidecar-bridge -p sidecar-bus
  - cargo test -p cohesix-proto
  - cargo check -p swarmui --bin swarmui
  - cargo test -p swarmui --tests
  - python3 scripts/ci/check_swarmui_dependencies.py
  - npm --prefix tools/swarmui-ui-tests test
  - python3 -m pytest -q tools/cohesix-py/tests
  - python3 -m pytest -q tests/test_rest_perf_harness.py tests/test_release_bundle.py tests/test_worker_task_evidence.py tests/test_worker_image_pipeline.py
  - scripts/cohsh/run_regression_batch.sh
  - cargo test -p coh-rtc
  - scripts/ci/host_integration_run.sh --matrix configs/host_integration_acceptance.toml --mode live --target qemu --target-session out/m26e-qemu/target-session.json --observations out/m26e-qemu/host-integration-observations.json --state-dir out/host-integration/m26e-qemu
  - scripts/ci/host_integration_run.sh --matrix configs/host_integration_acceptance.toml --mode live --target pi4 --target-session out/m26e-pi4/target-session.json --observations out/m26e-pi4/host-integration-observations.json --state-dir out/host-integration/m26e-pi4
  - scripts/check-generated.sh
Checks: Heartbeat/GPU/LoRA use the existing spawn, kill, namespace, console, policy, and ticket paths, while WorkerBus target spawn returns an existing-form deterministic model-only error; every host surface agrees on role, public instance id, slot, epoch, supervisor generation, cap generation, lifecycle, receipt, artifact, integration obligation/observed mode, execution proof, and separately derived runtime-release versus production-use-case state; control ACK proves only admission, `implemented = true` only executable declaration, READY only live runtime state, host-model only modelling, and QEMU/fresh-Pi proof only matching evidence; absent REST bounds mean unknown and gateway connection/QEMU launch never imply proof; generic ids are never inferred to be Heartbeat; GPU lease ACTIVE, bridge publication, ticket success, PEFT completion, FUSE mount, provider `ready`, package presence, or mocks cannot independently promote READY or target proof; connected GPU grant/renew/release and PEFT export/import/activate/rollback fixtures obtain the exact bounded WorkerGpu/WorkerLora confirmed/rejected/stale receipts without moving host hardware/registry/training/inference authority; mandatory live `worker-control`, `gpu-receipt-path`, and `peft-receipt-path` target-session rows pass, while every advertised FUSE/systemd/Docker/Kubernetes/federation/SIEM/CAS/sidecar/release/provider surface records its exact current mode and later blocker rather than being promoted by compatibility; canonical `/shard` invalidation, sharding, version-1/version-2 accepted-schema matrices, local-only v2 rejection, root-pinned admitted projections, crash-safe v2 journal recovery, replay retention on existing host-ticket status/deadletter paths, validated gateway evidence-file import, SwarmUI proof sourcing, and ACK/ERR/END fixtures pass; absent, wrong-kind, stale, forged, duplicate, late, oversized, wrong-role, wrong-generation, wrong-host-profile, wrong-provider-mode, wrong-target, wrong-ABI, hash-mismatched, mode-substituted, and secret-bearing records fail deterministically; release artifacts expose no ticket, host secret, raw badge, CPtr, or capability value; no CYW43 behavioral contract or evidence classification changes.
Deliverables: One generated protocol-faithful host Worker state/dependency contract; target-session per-row Worker-integration evidence; LoRA support across all four Cohesix PEFT receipt actions and Rust/Python/REST/UI compatibility projections; exact GPU/PEFT result-to-Worker correlation; canonical FUSE `/shard` compatibility; crash-safe local v2 execution; honest current modes for every shipped/future host surface; hash-bound Worker-runtime release inputs; and host tools ready for the separate exact QEMU/fresh-Pi promotion gate without claiming production provider/use-case completion.

Title/ID: m26e-python-library-as-built-compatibility
Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / Python SDK as-built compatibility gate
Goal: Verify and, where required, correct the non-authoritative `cohesix` Python package against the freeze-bound 26e generated Worker, integration, receipt, evidence, namespace, and backend contracts without creating a second protocol or authority path.
Inputs: `m26e-host-worker-integration`, configs/sel4/profiles.toml, configs/root_task.toml, configs/root_task_pi4_uboot_aarch64.toml, tools/coh-rtc/src/codegen/cohesix_py.rs, configs/generated/**, generated Worker/integration schemas and conformance vectors, tools/cohesix-py/pyproject.toml, tools/cohesix-py/cohesix/**, tools/cohesix-py/tests/**, resources/openapi/hive-gateway.yaml, configs/host_integration_acceptance.toml, scripts/ci/host_integration_run.sh, scripts/release_bundle.sh, docs/PYTHON_SUPPORT.md, docs/HOST_API.md, docs/INTERFACES.md, and the accepted QEMU/Pi `worker-control`, `gpu-receipt-path`, and `peft-receipt-path` integration records.
Changes:
  - tools/coh-rtc/src/codegen/cohesix_py.rs + tools/cohesix-py/cohesix/generated.py + configs/generated/cohesix_python_{qemu_smp_production,pi4_production}.json + scripts/check-generated.sh + tools/cohesix-py/tests/test_generated_contract.py — keep the wheel's generated module target-neutral and emit a versioned target-qualified `cohesix-python-profile/v1` contract for each selected resolved manifest. The profile contract, not a universal wheel constant, binds manifest hash, canonical role labels, executable-role matrix, Worker ABI/host-ticket/evidence schema versions, `/shard` paths and legacy-alias gate, lifecycle/receipt/proof vocabularies, operation and byte bounds, maximum live tasks, and host-integration modes. Extend the generated-artifact guard to resolve `configs/root_task.toml` through `qemu_smp_production` and `configs/root_task_pi4_uboot_aarch64.toml` through `pi4_production` into isolated temporary outputs, then byte-compare both committed target contracts in addition to the target-neutral default output; no target contract may be hand-edited or inferred from the other target. Static defaults are bounded fallback expectations only and cannot establish live target identity or proof; stale, hand-maintained, missing, one-sided, or mismatched contracts fail generated drift checks.
  - tools/cohesix-py/cohesix/{backends.py,client.py,worker.py,receipts.py,evidence.py,orchestration.py,playbooks.py} + focused tests — load an explicit target-qualified contract or bounded remote metadata for live use and verify Mock, filesystem, TCP, and REST behavior against the same fixtures. Cover Heartbeat/GPU/LoRA spawn, observe, wait, receipt, teardown, and stale-generation behavior; deterministic WorkerBus spawn refusal; canonical sharding; optional REST bounds and backend-class absence as `unknown`; version-1 compatibility versus local-only version-2 Worker receipts; all three GPU and four PEFT actions; and strict separation of request admission, READY, provider completion, Worker receipt, artifact verification, QEMU/Pi proof, runtime-release acceptance, and production-use-case acceptance.
  - scripts/ci/python_compat_run.sh + configs/host_integration_acceptance.toml — add a bounded `python-sdk-projection` release-required lane that runs the Python client through the existing target-session integration fixtures for QEMU and Pi and emits the existing `cohesix-worker-integration-evidence/v1` record. Package/backend conformance covers the minimum supported Python 3.11 and canonical macOS release-host Python 3.13; each target-session record names the exact interpreter/platform, shared wheel hash, and matching target-qualified profile-contract hash. The lane may consume but never replace the direct target role-required records, and it cannot promote external CUDA/NVML, PEFT, FUSE, systemd, Docker, Kubernetes, federation, or other provider modes.
  - tools/cohesix-py packaging/tests + scripts/release_bundle.sh — install and import the core package and declared `integrations`, `ml`, and `dev` extras on the Python 3.11/3.13 host matrix, build one target-neutral wheel, install that wheel into an isolated environment for import/public-entrypoint smoke, and emit an exact package manifest containing the wheel and QEMU/Pi profile-contract hashes. `dev` remains test-only and is excluded from deployed requirements; missing optional runtimes return typed unavailable rather than silently selecting mocks.
  - docs/PYTHON_SUPPORT.md + tools/cohesix-py/README.md + docs/TEST_PLAN.md — document the 26e Worker APIs, target-neutral wheel/profile-contract model, as-built proof boundaries, supported backend matrix, compatibility/migration rules, and the distinction between Python projection compatibility and target or provider acceptance.
Commands:
  - python3 -m pip install -e 'tools/cohesix-py[integrations,ml,dev]'
  - python3 -m pip check
  - python3 -m pytest -q tools/cohesix-py/tests
  - python3 -m pip wheel --no-deps --wheel-dir out/python-wheels tools/cohesix-py
  - scripts/ci/python_compat_run.sh --wheel-smoke --wheel-dir out/python-wheels --package-manifest out/python-compat/m26e-python-package.json --state-dir out/python-compat/m26e-wheel
  - scripts/ci/python_compat_run.sh --python-matrix 3.11,3.13 --target qemu --profile-contract configs/generated/cohesix_python_qemu_smp_production.json --package-manifest out/python-compat/m26e-python-package.json --wheel-dir out/python-wheels --matrix configs/host_integration_acceptance.toml --target-session out/host-integration/m26e-qemu/integration/worker-control.json --state-dir out/python-compat/m26e-qemu
  - scripts/ci/python_compat_run.sh --python-matrix 3.11,3.13 --target pi4 --profile-contract configs/generated/cohesix_python_pi4_production.json --package-manifest out/python-compat/m26e-python-package.json --wheel-dir out/python-wheels --matrix configs/host_integration_acceptance.toml --target-session out/host-integration/m26e-pi4/integration/worker-control.json --state-dir out/python-compat/m26e-pi4
  - scripts/check-generated.sh
Checks: The same isolated-wheel smoke and public API pass on Python 3.11 and 3.13; each target-qualified contract matches its selected resolved manifest byte-for-byte where specified, while the shared wheel remains target-neutral; all supported backends preserve ACK/ERR/END, bounds, canonical paths, role identity, lifecycle, receipt, and evidence semantics; existing public compatibility wrappers remain valid or receive an explicit versioned migration; malformed, oversized, absent, unknown, wrong-version, wrong-role, stale-generation, wrong-target, wrong-contract, hash-mismatched, client-authored, and secret-bearing inputs fail deterministically; static fallback defaults and mocks remain non-proof `host-model`; no Python ACK, local file, subprocess result, provider state, or JSON object can become READY, an authoritative receipt, target proof, runtime release acceptance, or production-use-case evidence; QEMU/Pi Python rows bind the same wheel to their respective generated profile contract and target-session records but remain projection evidence only.
Deliverables: One clean target-neutral wheel and exact package manifest, generated QEMU/Pi profile contracts, backend conformance tests, separate QEMU/Pi `python-sdk-projection` records, and release gating that proves the shipped Python SDK matches each 26e as-built target without widening Cohesix authority.

Title/ID: m26e-worker-target-evidence-promotion
Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / exact QEMU and Pi Worker acceptance
Goal: Emit separate QEMU-accepted and Pi-accepted component records for the three configured executable roles only after exact-image evidence proves real IPC, faults, complete teardown, and fresh-generation recreation; do not promote release acceptance yet.
Inputs: all preceding 26e target-runtime Worker tasks through `m26e-host-worker-integration`, matching live `worker-control`, `gpu-receipt-path`, and `peft-receipt-path` Worker-integration records for each target, selected QEMU/Pi SMP+MCS builds and manifests, positive exact-image CYW43 closure plus the matching 26e MCS-driver coexistence record, scripts/ci/test_plan_run.sh, scripts/pi4_gate_proof.sh, exact image identities, docs/TEST_PLAN.md, canonical Worker/security/interface docs. The adjacent `m26e-python-library-as-built-compatibility` task must finish any Python-only codegen/package corrections before the shared artifact freeze, but its PASS/FAIL record is not target-component evidence and cannot substitute for or alter this gate.
Changes:
  - scripts/worker_task_evidence.py + scripts/m26e_qemu_pressure.sh + tests/test_worker_task_evidence.py — replace the pressure runner's inline target-session synthesis with the standalone `emit-qemu-target-session` command. It accepts only the repository root, verified QEMU output, resolved manifest, generated topology, and a new output directory; validates the immutable launch record and exact launch/Worker/driver/archive bytes, stable git-visible source inventory, Worker ABI identity, and topology-to-manifest parity; derives the QEMU CYW43 not-applicable binding and current exact target-session schema without caller-supplied hashes; and publishes each artifact atomically without overwriting an existing session directory.
  - scripts/pi4_gate_proof.sh + scripts/worker_task_evidence.py + scripts/rest_perf_harness.py + focused tests — capture one fresh Wi-Fi boot's serial and packets concurrently, emit a positive CYW43 v2 record only after the exact live gate passes, and finalize those immutable bytes into a canonical Pi target-session bundle. The finalizer independently validates the clean v5 stage/image graph, generated topology, source and Worker ABI identities, archives/manifests, latest boot marker, live outcomes, and controlled pcap before exclusive publication. A later same-image GENET boot supplies its own current runtime/pcap; qualified performance freezes and revalidates every input, binds the exact session/topology/Worker manifest to the live census and role exemplars, and cannot turn build, stage, offline, stale, caller-authored, or QEMU evidence into Pi proof. The separately collected Pi Worker component remains a full-milestone acceptance prerequisite and is neither consumed nor claimed by this performance lane.
  - scripts/worker_task_evidence.py + tests/test_worker_task_evidence.py + docs/TEST_PLAN.md — create the emitter/validator and tamper/mode/hash/target tests for `cohesix-worker-task-evidence/v1` with `record_kind=target-component`, exactly one proof target/class, a sorted bounded list of the three exact live role-required Worker-integration records, source/resolved-manifest/kernel/root/MCS-driver-archive/MCS-driver-manifest/CYW43-coexistence-record/Worker-archive/Worker-image-manifest/Worker-image hashes, one detailed live Heartbeat/GPU/LoRA exemplar, the exact topology digest and complete compiler-declared temporal-task/fault-registry seal for the aggregate 256-Worker population, role/slot/epoch/supervisor-generation/cap-generation/badge/core/SC/object inventories, bounded event outcomes, raw-artifact hashes, PASS/FAIL, and blockers. The generic evidence-list bound remains unchanged; only the topology-derived list may exceed it, and any count, order, identity, role-class, driver, service, critical-TCB, or registry drift fails closed.
  - QEMU target gate — prove all three mandatory roles through the direct target authority/observation path, including Heartbeat progress, fixture-backed but live root-to-Worker GPU grant/renew/release and LoRA export/import/activate/rollback confirmed/rejected receipts for success, failure and expiry, plus stale root disposition after each action's pinned Worker retires before the result arrives; also prove two sequential same-role generations, simultaneous second-live-slot and maximum-slot refusal, bounded control/receipt paths, combined notifications, durable-completion publish/signal ordering, budget exhaustion/timeout attribution, fault before READY/during IPC, forbidden-blocking-send refusal, stale-record revocation, no post-revoke activity/leak, and fresh generation under four-core SMP+MCS. Rust/Python/REST/UI/FUSE compatibility records are separate projections and cannot raise or block this runtime claim unless an explicit release profile independently requires them.
  - fresh Pi target gate — prove the identical direct runtime and receipt-path matrix on the exact flashed/booted image while preserving serial, local-seat, TCP, fatal, driver, and Queen liveness; require positive exact-image CYW43 closure plus the matching MCS coexistence record by immutable artifact/hash without merging proof classes. An accepted CYW43 blocker cannot produce Pi component PASS, and no host integration record can substitute for Pi execution.
  - generated/docs gate — publish only separate QEMU/Pi component acceptance records and update as-built role wording only when the selected exact hashes pass; missing target evidence cannot degrade to host/model PASS, and this task cannot emit `release-accepted`.
Commands:
  - python3 scripts/worker_task_evidence.py emit-qemu-target-session --repo-root . --qemu-out out/cohesix --resolved-manifest configs/generated/root_task_resolved.json --topology configs/generated/root_task_topology.json --out-dir out/m26e-qemu/session
  - scripts/pi4_gate_proof.sh --skip-build --serial-device "$PI_SERIAL_DEVICE" --log "$PI_WIFI_SERIAL_LOG" --require-wifi-ready --require-driver-task-proof --network-interface "$PI_CAPTURE_INTERFACE" --network-capture-out "$PI_WIFI_NETWORK_CAPTURE" --gateway-status-url "$COH_REST_URL" --gateway-target-host "$PI_WIFI_TARGET_IP" --runtime-dma-proof-out "$PI_WIFI_RUNTIME_DMA_PROOF" --cyw43-coexistence-record-out "$PI_WIFI_CYW43_RECORD"
  - python3 scripts/worker_task_evidence.py emit-pi4-target-session --repo-root . --runtime-proof "$PI_WIFI_RUNTIME_DMA_PROOF" --cyw43-coexistence-record "$PI_WIFI_CYW43_RECORD" --max-age-secs 21600 --out-dir "$PI_SESSION_DIR"
  - python3 scripts/worker_task_evidence.py collect-pi4-component --target-session "$PI_SESSION_DIR/target-session.json" --generated-inventory out/pi4-sd/cohesix-root-task-topology.json --runtime-proof "$PI_RUNTIME_DMA_PROOF" --network-capture "$PI_NETWORK_CAPTURE" --transport genet --integration-dir "$PI_INTEGRATION_DIR" --max-age-secs 21600 --out-dir "$PI_COMPONENT_DIR"
  - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26e-worker-qemu
  - python3 scripts/worker_task_evidence.py validate --target qemu --evidence out/test-plan/m26e-worker-qemu/worker-task-evidence.json
  - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26e-worker-pi4
  - python3 scripts/worker_task_evidence.py validate --target pi4 --evidence out/test-plan/m26e-worker-pi4/worker-task-evidence.json
  - scripts/check-generated.sh
Checks: The QEMU session emitter refuses stale launch bytes, manifest/topology drift, malformed Worker/driver archives, aliases, source drift, unignored repository output, and any existing output directory before target execution; it derives every digest from exact bytes and emits only the current source-inventory, Worker-ABI, QEMU-CYW43, and target-session records. The complete topology/fault-registry seal covers all 256 Worker tasks plus the generated non-Worker tasks while the component retains only the three bounded live role exemplars; neither layer substitutes for the other. Heartbeat/GPU/LoRA each reach READY and complete their exact role contract on both exact targets through direct `cohsh` control/observation, root-admitted host-ticket v2 records, the host-ticket agent's crash-safe local receipt path, and the shared evidence validator; GPU grant/renew/release and PEFT export/import/activate/rollback receipt fixtures correlate with the complete root-resolved Worker identity/result digests without moving host execution or proving the external provider; confirmed/rejected live receipts and stale root fencing/replay behavior are deterministic across teardown; fault/timeout/revoke identity is unambiguous; combined notification, durable completion, stale-generation, and no-blocking-send tests pass; complete teardown leaves zero caps/mappings/pending records/signals/Replies/SCs/execution; recreation uses a fresh supervisor generation; operator and MCS-driver liveness hold; WorkerBus remains model-only; configured, queued, READY, host-model, projection compatibility, QEMU-only, or Pi-only state cannot satisfy runtime release acceptance, and runtime release acceptance cannot satisfy a production use-case row.
Deliverables: Separate exact QEMU and fresh-Pi Worker component evidence/acceptance records closing the Milestone 26d general-Worker execution-truth gap without premature release promotion.

Title/ID: m26e-root-tcb-target-proof
Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / target containment and regression proof
Goal: Prove the ordered service/Worker split reduces root authority and preserves deterministic QEMU/Pi behavior under normal, pressure, and injected-fault conditions.
Inputs: `m26e-worker-target-evidence-promotion`, selected generated profiles and images, scripts/ci/test_plan_run.sh, scripts/rest_perf_harness.py, docs/TEST_PLAN.md, docs/BENCHMARKS.md, docs/audit/M26D_ROOT_TCB_BOUNDARY_AUDIT.md.
Changes:
  - Production manifest and paired-kernel capacity parity (2026-09-08): refresh
    only `seL4/build_UBOOT` from the pinned external seL4 16 production profile,
    retaining its default immutable Pi image input. Align QEMU/Pi enabled
    production features and common scheduling policies at the existing safe
    256-Worker execution capacity and maximum 8-bit sharding. Preserve selected
    kernel SC object sizes, hardware driver topology, measured WCET envelopes,
    memory accounting and fault/operator reserves. Document every remaining
    target difference and guard common feature/resource parity. This authorizes
    the manifest/kernel compatibility repair; it does not expand execution
    counts beyond admitted inventories or substitute static/QEMU proof for Pi.
  - root-task/service/Worker tests — add critical-TCB reserve, cap-inventory, W^X, IPC-bound, wrong-badge, notification-coalescence, stale-frame, fault-injection, complete teardown, fresh-generation recreation, shutdown, replay, cancellation, and pressure coverage for every split child.
  - scripts/ci/test_plan_run.sh + docs/TEST_PLAN.md — add separate host/model, QEMU execution, fresh Pi execution, operator-liveness, and fault-containment gates; emit separate `cohesix-root-tcb-acceptance/v1` QEMU/Pi records with `record_kind=root-tcb`, exactly one target, and bindings to the exact kernel, root, MCS driver archive/manifest, CYW43 coexistence record, Worker archive/image manifest/images, generated topology, raw evidence hashes, and observed critical-TCB/cap/SC/Reply inventories.
  - docs/BENCHMARKS.md + evidence packs — archive before/after TCB inventory, authority matrices, latency, pressure, and same-harness QEMU/Pi results with atomic change-set and pre-change baseline identity.
Commands:
  - cargo fmt --all -- --check
  - cargo clippy --workspace --all-targets -- -D warnings
  - cargo check --workspace
  - cargo test --workspace -- --test-threads=1
  - scripts/check-generated.sh
  - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26e-root-tcb-qemu
  - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26e-root-tcb-pi4
  - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --log-dir out/bench --log-prefix m26e-root-tcb-qemu
Checks: generated and observed cap/SC/Reply inventories agree; root-control, root-fault, root-emergency, root-worker-supervisor, root-driver-supervisor, root-worker-executor-gpu, and root-worker-executor-lora each retain independent admitted progress; each child runs in the selected image, contains injected faults/timeouts, completes its 26e teardown/containment, loses stale authority, returns or revokes any service-only donated time, and cannot bypass serialized policy; QEMU and fresh Pi evidence preserve console/network/driver/operator behavior and separated proof lanes; the accepted split measurably reduces root authority without an unbounded latency, temporal-reserve, or TCB regression; each root-TCB acceptance record validates only against the exact immutable artifacts it names.
Deliverables: Separate hash-bound QEMU/Pi root-TCB acceptance records closing the reopened Milestone 25 root-service/Worker task-isolation claims and establishing the prerequisite for final 26e and Milestone 33 acceptance.

Title/ID: m26e-mcs-smp-target-acceptance
Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / full-system SMP+MCS target acceptance
Goal: Accept the single four-core SMP+MCS operational architecture on QEMU and Pi 4 using the real root, service, Worker, and driver topology under normal, overload, timeout, fault, complete task teardown, fresh-generation recreation, and operator-liveness conditions, as a verification-only gate over the frozen artifacts produced by preceding 26e implementation tasks.
Inputs: `m26e-mcs-abi-foundation`, `m26e-worker-resource-admission-critical-tcbs`, `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`, `m26e-python-library-as-built-compatibility` for the independent Python package gate, `m26e-worker-target-evidence-promotion`, `m26e-root-tcb-target-proof`, all enabled 26e child images and generated task records, separate matching QEMU/Pi Worker component records, separate matching QEMU/Pi root-TCB acceptance records, matching QEMU/Pi `python-sdk-projection` compatibility records plus their target-qualified contracts and shared wheel/package manifest for any release profile that ships Python, positive exact-image CYW43 closure plus matching MCS coexistence record, configs/sel4/profiles.toml, configs/root_task*.toml, scripts/worker_task_evidence.py, scripts/release_bundle.sh, scripts/ci/test_plan_run.sh, scripts/rest_perf_harness.py, tests/test_release_bundle.py, docs/ROLES_AND_SCHEDULING.md, docs/TEST_PLAN.md, docs/BENCHMARKS.md, docs/audit/M26D_MCS_DECISION.md.
Changes:
  - Release console convergence dispatch repair — the exact `a5ef48045` QEMU console canary passes, but the following filtered Cargo commands compile unrelated kernel integration binaries and fail to link ELF `_text`/`_end` symbols on macOS. Select the existing complete `host.root-task-qemu-features` library action as a console convergence regression and remove its ten overlapping filtered invocations. Preserve all separate ABI, console runtime, direct-GENET, service integration, transport and packaging checks, nonzero inventories and the canonical ban on filtered library suites. Regenerate the Test Plan projection and execute the selected regression actions. This changes only test dispatch; runtime, manifests, host tools, Python, benchmark workloads and target evidence requirements remain unchanged. Open P1 findings and independent review still block final release acceptance.
  - final artifact-freeze gate — make no runtime, generated-policy, manifest, kernel-profile, or image change in this task. Validate that the MCS-only profiles, per-core admission, seven critical root reserves including both Worker executor lanes, active/passive/Reply topology, child runtimes, and exact kernel/root/MCS-driver/CYW43/Worker-archive/Worker-image-manifest/Worker-image identities are unchanged from the preceding component and root-TCB records. Any hash or generated-output drift sends execution back to the owning implementation task and requires all affected evidence to be rerun before promotion.
  - scripts/ci/test_plan_run.sh + scripts/worker_task_evidence.py — run the complete frozen topology on each target, then emit separate `cohesix-mcs-smp-system-acceptance/v1` QEMU/Pi records with `record_kind=full-system`, exactly one target, and bindings to the exact Worker component record, root-TCB record, kernel/root images, MCS driver archive/manifest, positive CYW43 coexistence record, Worker archive/image manifest/images, ABI schemas, full-system raw evidence, admission totals, timeout/fault/Reply outcomes, and performance/liveness results.
  - configs/sel4/profiles.toml + build/release validators — verify that the already-produced four-core MCS contracts are the sole runtime/release profiles for QEMU and Pi 4 and that no non-MCS switch, compatibility profile, or fallback selection remains; do not modify the profile here.
  - scripts/worker_task_evidence.py + scripts/release_bundle.sh + tests/test_release_bundle.py — create/extend Worker-runtime release promotion tests and, only after both full-system records validate, consume all six immutable QEMU/Pi Worker-component, root-TCB, and full-system records; recursively cross-check their role-required Worker-integration rows and complete artifact/evidence hash graph including the Worker image manifest; emit the `release-accepted` `cohesix-worker-release-acceptance/v1` record with `record_kind=release`, explicit scope `worker-runtime`, no singular target field, and exactly those six references; and exercise release verification. Missing either target or evidence layer, missing/wrong-mode role-required integration row, QEMU-only/Pi-only proof, stale hashes, wrong kernel/root/driver/Worker image or Worker image manifest, wrong ABI/resolved-manifest/CYW43 record, or artifact-only packaging fails closed. This record cannot satisfy the Milestone 27b production use-case release schema.
  - scripts/release_bundle.sh + tests/test_release_bundle.py — independently verify every selected release-required projection through exact paths recorded in the generated package manifest. A release profile that ships Python must carry both exact `python-sdk-projection` records, the shared target-neutral wheel hash, and each record's matching target-qualified profile-contract hash; a missing, one-sided, stale, wrong-target, wrong-contract, or mismatched Python record fails Python packaging without entering, raising, lowering, or changing the six-reference Worker-runtime acceptance record.
  - docs/ROLES_AND_SCHEDULING.md + docs/TEST_PLAN.md + docs/BENCHMARKS.md + evidence packs — record WCET/admission inputs, per-core totals/reserves, full topology, exact build/image identity, timeout/fault/restart results, operator-liveness results, and performance deltas without overstating upstream AArch64 or SMP verification.
Commands:
  - cargo test -p sel4-sys -p sel4-runtime
  - cargo test -p coh-rtc
  - cargo test -p root-task --test schedule
  - cargo test -p pi4-driver-abi -p pi4-driver-runtime
  - scripts/check-generated.sh
  - python3 scripts/sel4_profile.py validate --profile qemu_smp_production --build-dir out/sel4/profile-v2/qemu-smp-production --require-source --require-artifacts --for-release --for-runtime
  - python3 scripts/sel4_profile.py validate --profile pi4_production --build-dir out/sel4/profile-v2/pi4-production --require-source --require-artifacts --for-release --for-runtime
  - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26e-mcs-smp-qemu
  - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26e-mcs-smp-pi4
  - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --log-dir out/bench --log-prefix m26e-mcs-smp-qemu
  - HIVE_GATEWAY_REQUEST_AUTH_TOKEN="$HIVE_GATEWAY_REQUEST_AUTH_TOKEN" .venv/bin/python scripts/rest_perf_harness.py --mode simulate --population-mode executable --benchmark-target pi4 --benchmark-transport genet --pi-runtime-dma-proof "$PI_RUNTIME_DMA_PROOF" --pi-network-capture "$PI_NETWORK_CAPTURE" --pi-cyw43-coexistence-record "$PI_CYW43_RECORD" --benchmark-evidence-max-age-secs 21600 --target-session "$PI_TARGET_SESSION" --no-qemu --no-gateway --rest-url "$COH_REST_URL" --tcp-host "$PI_TARGET_IP" --tcp-port 31337 --workers-min 256 --workers-max 256 --intensity-min 8 --intensity-max 8 --duration-mins 2 --base-rps 4 --max-inflight 32 --seed 2608 --no-transient-retries --strict-control-errors --error-budget-rate 0.01 --log-dir out/bench/pi4-genet --log-prefix m26e-pi4-genet-high
  - python3 scripts/pi4_compare_driver_models.py --qemu-report "$QEMU_HIGH_REPORT" --pi-report "$PI_GENET_REPORT" --reference-unix-s "$(date +%s)" --max-age-secs 21600 --min-throughput-ratio 1.0 --genet-max-p95-ms "$GENET_SAME_HARNESS_P95_MAX_MS" --output out/bench/pi4-genet/qemu-pi-parity.json
  - python3 scripts/worker_task_evidence.py validate-system --target qemu --worker out/test-plan/m26e-worker-qemu/worker-task-evidence.json --root out/test-plan/m26e-root-tcb-qemu/root-tcb-acceptance.json --run out/test-plan/m26e-mcs-smp-qemu --out out/test-plan/m26e-mcs-smp-qemu/system-acceptance.json
  - python3 scripts/worker_task_evidence.py validate-system --target pi4 --worker out/test-plan/m26e-worker-pi4/worker-task-evidence.json --root out/test-plan/m26e-root-tcb-pi4/root-tcb-acceptance.json --run out/test-plan/m26e-mcs-smp-pi4 --out out/test-plan/m26e-mcs-smp-pi4/system-acceptance.json
  - python3 scripts/worker_task_evidence.py promote-release --worker-qemu out/test-plan/m26e-worker-qemu/worker-task-evidence.json --worker-pi4 out/test-plan/m26e-worker-pi4/worker-task-evidence.json --root-qemu out/test-plan/m26e-root-tcb-qemu/root-tcb-acceptance.json --root-pi4 out/test-plan/m26e-root-tcb-pi4/root-tcb-acceptance.json --system-qemu out/test-plan/m26e-mcs-smp-qemu/system-acceptance.json --system-pi4 out/test-plan/m26e-mcs-smp-pi4/system-acceptance.json --out out/test-plan/m26e-mcs-smp/worker-release-acceptance.json
  - scripts/release_bundle.sh --verify-worker-acceptance --worker-qemu-evidence out/test-plan/m26e-worker-qemu/worker-task-evidence.json --worker-pi4-evidence out/test-plan/m26e-worker-pi4/worker-task-evidence.json --worker-root-qemu-evidence out/test-plan/m26e-root-tcb-qemu/root-tcb-acceptance.json --worker-root-pi4-evidence out/test-plan/m26e-root-tcb-pi4/root-tcb-acceptance.json --worker-system-qemu-evidence out/test-plan/m26e-mcs-smp-qemu/system-acceptance.json --worker-system-pi4-evidence out/test-plan/m26e-mcs-smp-pi4/system-acceptance.json
  - scripts/release_bundle.sh --verify-python-compatibility --python-package-manifest out/python-compat/m26e-python-package.json --python-qemu-evidence out/python-compat/m26e-qemu/python-sdk-projection.json --python-pi4-evidence out/python-compat/m26e-pi4/python-sdk-projection.json
  - python3 -m pytest -q tests/test_release_bundle.py tests/test_worker_task_evidence.py
Checks: every active TCB has an admitted MCS budget/period/core, every passive service TCB has a bounded allowlisted donor/Reply/timeout chain to an admitted active context, every passive Worker has zero bound SC, exactly one allowlisted active executor donor, and a generation-scoped Reply path that returns donated time once, every linked driver uses its admitted MCS path, and all paths preserve correct ownership; aggregate demand preserves all seven critical reserves: root-control, root-fault, root-emergency, root-worker-supervisor, root-driver-supervisor, root-worker-executor-gpu, and root-worker-executor-lora; four-core QEMU and fresh Pi pass cold/warm boot, the aggregate 256-Worker READY seal with three detailed role exemplars, mixed load, budget exhaustion, timeout, fault, faulted-driver-call recovery, complete Worker task-instance teardown, fresh supervisor-generation recreation, SC/Reply/cap/mapping/record leak, operator-liveness, protocol-regression, GPU/PEFT receipt, and positive CYW43 behavioral-coexistence; QEMU additionally passes Conditional B2 full-population executable pressure driven through the three role exemplars, fresh Pi independently passes its exact-evidence-bound same-harness performance gate, and the target-neutral comparator rejects stale or mismatched provenance and decides QEMU/Pi parity from successful throughput and error budgets only; Conditional D separately qualifies only the host-model gateway comparator. Worker-runtime release promotion binds exactly the six target/root/system records and complete artifact graph, rejecting every missing, one-sided, stale, or mismatched input; independently, a profile cannot ship or advertise Python without both exact `python-sdk-projection` records, the shared wheel/package manifest, and the corresponding QEMU/Pi profile-contract hashes, and Python compatibility cannot raise or lower target, component, full-system, or Worker-runtime acceptance; no implementation or artifact changes occur after component evidence, and no operational classic scheduler path or profile remains. Any failure blocks closure and requires whole-change source/configuration reversion rather than a shipped fallback.
Deliverables: One target-qualified SMP+MCS scheduling architecture for QEMU and Pi 4, final `cohesix-worker-release-acceptance/v1` evidence, and no runtime scheduler rollback path.

Title/ID: m27-owner-review-closure
Milestone: Milestone 27 — Operator Utilities / exact owner approval and due-diligence closure
Status: Complete — approved evidence basis recorded above
Goal: Record Lukas Bower's DD30/Rust sign-off and subsequent milestone completion approval without altering historical approvals or target results.
Inputs: Reviewed 7c3b82abbaf938f82f958dc40886d24fcf1c9f01; tested b54bdd2fcff97fe35c5e3a61faa4d5a761b2a1ac; both exact owner statements in docs/audit/M27_COMPLETION_EVIDENCE.md.
Changes: Separate DD30_M27_APPROVAL.toml; explicitly selected DD_MILESTONE_ID=27 lifecycle validation; negative approval/source/expiry checks; completion record and reconciled Build Plan, status, Test Plan and audit documentation.
Commands: scripts/check-generated.sh (includes scripts/ci/check_test_plan.sh); git diff --check; scoped documentation link, header and retained evidence hash checks.
Checks: Exact protected and complete host/target/SDK/manifest implementation binding; unchanged P1/ACCEPTED_RISK and 2026-10-13 expiry; dynamic fault/wake remains UNEXECUTED; final Pi boot/operator/Stages03–05 remain unexecuted under the separate completion approval.
Deliverables: Durable human review, residual-risk and completion decisions; passing QEMU evidence and explicitly unexecuted Pi checks bound to their original source.

Title/ID: m27-pi-regression-isolation
Milestone: Milestone 27 — Operator Utilities / physical regression prerequisite restoration
Status: Complete — approved evidence basis recorded above
Goal: Preserve exact append-stream assertions and fresh-boot Worker isolation across the complete physical TCP matrix.
Discovery: The exact 9a5eb97f1 Pi image passed 14 of 17 scripts; the append test inspected an ACK preview, and later groups inherited a live heartbeat slot and boot-local Worker IDs.
Changes:
  - scripts/cohsh/9p_batch.coh + TCP/REST batch runners — validate ordered appended records in the completed CAT data stream, independently of bounded ACK previews and interleaved audit records.
  - scripts/ci/pi4_regression_boot.py + TCP/Stage03 runners — invoke an explicitly configured, bounded external boot collector for each selected Pi group; verify fresh boot IDs and unchanged source/image/host/gateway bindings; retain each group's evidence and finish on base for existing Stage04 continuity.
Checks: Missing, reordered or repeated append records fail; boot-hook failure, stale boot identity and changed image/source fail; all four groups retain distinct exact-image boot records and the complete 17-script matrix remains required.
Compatibility: No target/runtime/Worker/console grammar change. Host suite, Python SDK, REST and benchmark consumers retain their contracts; only canonical test collection and evidence composition change.
Deliverables: Deterministic workflow tests, passing final-source QEMU matrix, preserved failed Pi attempt and owner-approved closure with final-source Pi execution unexecuted.

Title/ID: m27-live-operator-closure
Milestone: Milestone 27 — Operator Utilities / live inspect and evidence-pack composition
Status: Complete — approved evidence basis recorded above
Goal: Close fresh-Pi-discovered host collection defects without weakening missing/error or proof classifications.
Changes:
  - apps/coh/src/operator.rs + evidence.rs — use the bounded advertised /proc inventory for optional-root absence, preserve lease-ID directory semantics when empty, and retain nested directory listings in separate .listing leaves.
  - apps/coh/tests/operator.rs — exercise empty/populated lease directories, absent optional roots, refused parent listings, advertised-node read failures, and pack round trips.
  - docs/OPERATOR_EVIDENCE.md — document inventory-based availability and backward-readable listing storage.
Checks: Fresh Pi TCP/REST capture composes with complete packs and byte-stable offline inspection/replay; actual read failures remain incomplete exports; old inventory-selected paths remain readable.
Compatibility: Complete host-tool suite, Python SDK and benchmarks reviewed; inventory-based consumers need no schema or workload change. No target namespace, driver, scheduling, wire grammar or authority change.
Deliverables: Host collector correction and separate exact-image live evidence.

Title/ID: m27-build-evidence-blockers
Milestone: Milestone 27 — Operator Utilities / restoration of build and evidence prerequisites; discovery in m27-attestation-verifier, restoring the exact-source invariant of m26e-worker-target-evidence-promotion
Status: Reopened — M27g assembled-journeys-and-recovery discovered that the Pi build's exact generated-output allowlist omits the current provider projections; restore only that build prerequisite, retaining the prior completion evidence.
Goal: Restore canonical test and image-build prerequisites without relaxing source integrity, evidence bounds or target acceptance.
Changes:
  - scripts/pi4-image-build.sh + tests/test_pi4_image_build.py — recognize the exact compiler-emitted provider and recipe paths during temporary profile generation; continue refusing unrelated tracked or untracked changes and require canonical restoration after the build.
  - tests/test_linux_host_tools_sync.py, tests/test_release_bundle.py, tests/test_sel4_profile.py — exercise the existing exact tracked-tree archive and argument-driven packaging contracts; preserve export-ignore coverage and secret exclusion.
  - scripts/ci/test_run_regression_batch.py — explicitly select the QEMU fixture target and action so common-stage execution under Pi does not inherit physical transport requirements.
  - scripts/worker_task_evidence.py + tests/test_worker_task_evidence.py — stream every git-visible regular source file in at most 1 MiB reads, including shipped images larger than the evidence parser's 64 MiB allocation bound; retain exact extent, metadata, path-set and repeated-content checks. This restoration does not reopen M26e runtime or physical behavior.
  - toolchain and selected build outputs — restore pinned compiler/Python/mkimage and the pristine canonical QEMU profile through documented setup.
  - scripts/ci/test_plan_target_root_check.sh + focused workflow tests — route Pi Stage 02 through the canonical clean-source Pi builder, compare its retained resolved manifest to the compiler-selected Pi identity, and verify exact staged image/source binding. Preserve QEMU identity rejection and all physical acceptance requirements.
  - docs/TOOLCHAIN_MAC_ARM64.md — distinguish advertised HVF from the validated QEMU 10.1.0 HVF/GIC runtime; retain the QEMU 11.0.3 pre-guest assertion as failed evidence and select the verified external executable explicitly.
Commands: .venv/bin/python -m pytest -q tests/test_worker_task_evidence.py tests/test_linux_host_tools_sync.py tests/test_release_bundle.py tests/test_sel4_profile.py; scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml; scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m27-qualification-qemu
Checks: Source identities include exact large-image bytes without large allocations; same-read mutations and oversized evidence files still fail; canonical target and acceptance predicates remain unchanged.
Deliverables: Restored provenance/build workflows and fresh command evidence, separate from physical acceptance.

Title/ID: m27-evidence-case-summary
Milestone: Milestone 27 — Operator Utilities: Inspect, Trace, Bundle, Diff, Attest / reviewer-friendly evidence case summary
Status: Complete — approved evidence basis recorded above
Goal: Extend the canonical offline evidence workflow with a deterministic scenario-aware case summary that reconstructs observed request, admission/refusal, state/lease/lifecycle, host-result, and receipt/dead-letter links while declaring missing, errored, unknown, and ambiguous evidence without asserting target, hardware, health, or external-execution proof.
Inputs: apps/coh/src/evidence.rs, apps/coh/src/evidence_timeline.rs, apps/coh/src/main.rs, apps/coh/tests/evidence_pack.rs, apps/coh/tests/evidence_timeline.rs, tools/cohesix-py/examples/ci_evidence_pack.py, tools/cohesix-py/tests/test_examples_ci_siem.py, docs/USE_CASES.md, docs/OPERATOR_WALKTHROUGH.md, docs/OPERATOR_RECIPES.md, docs/HOST_TOOLS.md, docs/TEST_PLAN.md, current evidence-pack, audit, host-ticket, lease, lifecycle, and federation schemas.
Changes:
  - apps/coh/src/evidence_timeline.rs + apps/coh/src/main.rs — extend `coh evidence timeline` rather than introduce a second pack format; emit additive, atomically written `case.json` and `case.md` with an explicit `generic`, `incident`, `change`, `maintenance`, `rollout`, or `federation` scenario class.
  - case synthesis — consume `summary.json` and retained timeline sources, group records by stable correlation keys, preserve cross-hive identifiers, link every derived stage to its source path/event identity, and classify each request, decision, state/lease/lifecycle, host-result, receipt/dead-letter, and federation-relay stage as `observed`, `missing`, `error`, `unknown`, or `ambiguous`.
  - outcome boundary — use only non-authoritative review outcomes such as `recorded-terminal`, `refused`, `deadlettered`, `incomplete`, and `ambiguous`; a current host-ticket status or client-derived record never proves external execution, target state, hardware behavior, or an authoritative receipt. Authoritative graph validation and verified-execution semantics remain deferred to `m27b-authoritative-receipt-and-evidence-core`.
  - compatibility and safety — preserve existing `timeline.ndjson`, `timeline.md`, pack layout, redaction, generated byte bounds, deterministic ordering, atomic writes, missing/error inventory, partial-pack handling, and offline operation; unknown additive fields remain compatible and secret canaries never enter case outputs.
  - tests and operator contract — add deterministic fixtures for incident, change, maintenance, rollout, and federation review; cover incomplete and conflicting chains, missing/error inventory, cross-hive correlation, malformed bounded inputs, secret canaries, and byte-stable reruns; update CI structural validation and operator documentation for the additive outputs and their proof limitations.
Commands: cargo test -p coh --test evidence_pack --test evidence_timeline && python3 -m pytest -q tools/cohesix-py/tests/test_examples_ci_siem.py && cargo fmt --all -- --check && cargo clippy -p coh --all-targets -- -D warnings && scripts/check-generated.sh && scripts/ci/test_plan_run.sh --list
Checks: Fixed evidence packs produce byte-stable case outputs without network access; every causal stage is source-linked or explicitly missing, error, unknown, or ambiguous; federation correlation remains operator-visible; existing pack/timeline consumers remain compatible; secret canaries do not survive; no outcome claims target/hardware proof, external execution, or authoritative receipt validation.
Deliverables: Additive `case.json` and `case.md` in the canonical evidence pack, scenario and negative fixtures, CI structural coverage, and operator-facing documentation that keeps current evidence and future 27b authoritative receipt semantics distinct.

Title/ID: m27-live-trace-capture
Milestone: Milestone 27 — Operator Utilities: Inspect, Trace, Bundle, Diff, Attest / live canonical trace capture
Status: Complete — approved evidence basis recorded above
Goal: Make the existing bounded trace format record real TCP and REST/console-projection sessions while keeping replay offline, deterministic, and non-mutating.
Inputs: apps/cohsh/src/{main.rs,trace.rs,transport/**}, crates/cohsh-core/src/trace.rs, apps/coh/src/**, apps/hive-gateway/**, existing trace fixtures/policy, docs/USERLAND_AND_CLI.md, docs/SECURITY.md, docs/TEST_PLAN.md.
Changes:
  - crates/cohsh-core + apps/cohsh — wrap live TCP and REST transports with the existing recorder, preserve partial-stream/disconnect/reconnect boundaries, bind the header to schema, backend class, target/session id, manifest/image identity, capture time, and policy hash, and enforce generated byte/frame/duration limits with atomic finalization.
  - redaction — omit authentication frames and apply generated field-aware redaction before bytes reach disk; raw tickets, placeholder/real auth tokens, secret refs, host credentials, and secret-bearing control payloads are never recoverable from a trace. Redaction metadata is authenticated as part of the trace header/digest.
  - replay — keep replay transport-free and non-mutating, reject tamper/wrong-policy/oversize/secret-bearing input, and preserve byte-identical post-redaction ACK/ERR/END order across cohsh, SwarmUI, and shared read-only consumers.
  - public docs/tests — distinguish fixture, captured-QEMU, captured-Pi, and captured-host-projection traces and stop describing mock-only recordings as live artifacts.
Commands: cargo test -p cohsh-core && cargo test -p cohsh && scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m27-live-trace-qemu
Checks: real TCP and REST sessions produce bounded, identity-bound, atomically complete canonical traces; disconnect/reconnect and truncated captures are explicit; secret canaries never appear; replay is byte-stable and emits no writes; mock traces remain fixtures and cannot satisfy live target evidence.
Deliverables: One canonical trace recorder usable on real transports and one honest replay/evidence classification.

Title/ID: m27-attestation-verifier
Milestone: Milestone 27 — Operator Utilities: Inspect, Trace, Bundle, Diff, Attest / signed attestation verification
Status: Complete — approved evidence basis recorded above
Goal: Implement `coh attest` as a real verifier of the Milestone 26 device-bound evidence contract rather than a manifest-hash comparison.
Inputs: accepted `m26-device-identity-attestation-closure` schema/evidence, apps/coh/**, shared evidence/attestation parser crate, trust-anchor inputs, QEMU vTPM and Pi hardware/device-root fixtures, docs/SECURITY.md, docs/TEST_PLAN.md.
Changes:
  - shared host attestation core + apps/coh — generate a cryptographically random bounded nonce, submit the authenticated ephemeral challenge, correlate the response, parse TPM2 Quote or DICE evidence, validate algorithms/chain/signature/nonce/measurements/boot id/artifact identities/freshness/replay counter, and return stable machine-readable PASS/FAIL/UNAVAILABLE reasons.
  - evidence/bundle/diff — retain signed raw evidence only within generated bounds, record its digest and trust-policy id, redact enrollment metadata as configured, and keep QEMU virtual-device, Pi device-root, offline fixture, measurement-only, and unavailable classes distinct.
  - negative/conformance tests — replayed nonce, wrong PCR/manifest/image/kernel/root, wrong AK/DICE chain, expired or revoked trust anchor, malformed size, unsupported algorithm, measurement-only substitution, virtual-to-Pi proof substitution, and missing device all fail closed.
Commands: cargo test -p coh --test attest && cargo test -p coh --test evidence_pack && scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m27-attest-qemu && scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m27-attest-pi4
Checks: `coh attest` accepts only a fresh signed chain matching the exact target and configured trust policy; a matching public manifest hash alone never passes; no challenge grants or mutates authority; failure reasons and offline verification are deterministic.
Deliverables: Shared cryptographic verifier reused by evidence packs, SwarmUI, and later `coh-status` without a second attestation vocabulary.

Title/ID: m27-python-evidence-contract-parity
Milestone: Milestone 27 — Operator Utilities: Inspect, Trace, Bundle, Diff, Attest / Python evidence contract parity
Status: Complete — approved evidence basis recorded above
Goal: Keep the non-authoritative Python SDK compatible with the canonical evidence-pack, timeline, redaction, trace-reference, and attestation-result contracts established by Milestone 27.
Inputs: `m27-live-trace-capture`, `m27-attestation-verifier`, apps/coh evidence/attestation fixtures, canonical trace and legacy offline fixtures, generated evidence schemas and bounds, tools/cohesix-py/cohesix/{client.py,evidence.py}, tools/cohesix-py/tests/{test_evidence_receipts.py,test_examples_ci_siem.py}, docs/PYTHON_SUPPORT.md, docs/TEST_PLAN.md.
Changes:
  - tools/cohesix-py/cohesix/{client.py,evidence.py} — consume the canonical generated evidence-pack layout, timeline ordering, opaque bounded trace references, redaction rules, bounds, artifact classes, and typed attestation outcomes without defining a second pack format, parsing or replaying trace payloads, verifying against weaker inputs, or inferring attestation success. Authoritative receipt migration remains owned by `m27b-authoritative-receipt-and-evidence-core`.
  - tools/cohesix-py/tests/test_evidence_receipts.py + tools/cohesix-py/tests/test_examples_ci_siem.py — run the shared canonical fixtures plus explicitly classified legacy offline parser fixtures; cover unknown additive fields, missing optional artifacts, signed PASS/FAIL/UNAVAILABLE records, measurement-only inputs, virtual-versus-hardware proof separation, truncation, and secret canaries.
  - docs/PYTHON_SUPPORT.md + docs/TEST_PLAN.md — document that Python may project or analyze the canonical record but cannot manufacture authoritative evidence or upgrade an offline/legacy/measurement-only artifact.
Commands:
  - python3 -m pytest -q tools/cohesix-py/tests/test_evidence_receipts.py tools/cohesix-py/tests/test_examples_ci_siem.py
Checks: Rust and Python agree on canonical fixture bytes, ordering, classifications, bounds, and redaction; secret canaries never survive; matching hashes alone never become attestation PASS; legacy artifacts remain offline parser fixtures only; Python output cannot become a second evidence authority.
Deliverables: One evidence-pack/timeline/attestation-result contract shared by Rust producers and Python consumers.

Title/ID: m27-audit-ledger-refresh
Status: Complete — approved evidence basis recorded above
Goal: Refresh audit blockers, exceptions, findings, and risk baselines so later hardening milestones cite current state.
Inputs: docs/audit/, scripts/check-generated.sh, docs/BUILD_PLAN.md, current evidence-pack schema.
Changes:
  - docs/audit/BLOCKERS.md — update blocker status and classify remaining issues by milestone owner.
  - docs/audit/EXCEPTIONS.md — remove contradictory `None` state when active exceptions exist and cross-link accepted-risk ids.
  - docs/audit/findings.csv + docs/audit/rust_risk_baseline.toml — align risk ids, counts, and accepted exceptions with current code.
  - docs/TEST_PLAN.md — add audit-ledger consistency check before 27a/27d closure.
Commands: scripts/check-generated.sh && cargo test -p tests --test audit_ledgers
Checks: Blockers, exceptions, findings, and risk baseline agree; stale audit snapshots cannot be cited as current closure evidence.
Deliverables: Current, internally consistent audit ledgers for authority hardening and host-side AI milestones.

Title/ID: m27-readonly-command-latency
Status: Complete — approved evidence basis recorded above
Goal: Add bounded latency coverage for read-only operator utilities without treating Milestone 27 as a full runtime benchmark gate.
Inputs: apps/coh, tests/fixtures/traces/, representative evidence packs, docs/TEST_PLAN.md, docs/BENCHMARKS.md.
Changes:
  - apps/coh/tests/operator_latency.rs — deterministic fixture-backed checks for inspect, diff, attest, and evidence-pack read latency.
  - docs/TEST_PLAN.md + docs/BENCHMARKS.md — classify the evidence as host-tool latency, separate from REST/QEMU/Pi throughput proof.
Commands: cargo test -p coh --test operator_latency
Checks: Representative artifact sizes stay within declared parse/read bounds; failures classify parser, evidence-pack, transport, or artifact-size overhead.
Deliverables: Read-only operator utility latency evidence that later field and UI tools can cite without rerunning full hardware benchmarks.