Build Plan Implementation and Qualification History

**Status:** Complete — exact image `7a10b8fd6accc3d47ab4726cdd3de5828042c9f3` restored the previously reliable USB enumeration/command-ready path and passed the operator-approved current-image Wi-Fi and same-image GENET closure. The five requested Wi-Fi reboot attempts were completed; W01-W03 and W05 passed, while W04 is retained honestly as an operator-excluded RF-affected sample rather than counted as a passing lifetime. The accepted cold, W01-W03, and W05 Wi-Fi samples had no semantic errors, and the GENET control did not regress. No fresh USB key was typed during this matrix. The operator explicitly accepted current Gate 10, the exact one-deep idle-report queue, command readiness, zero current USB recovery/no-reply debt, and healthy HDMI completions together with exact restoration of the previously board-proven `2668c34f76ff` path as sufficient final local-seat evidence; this record does not claim a fresh first-byte or printable-key observation.

The **2026-08-11 accepted matrix** uses source `7a10b8fd6acc`: cold Wi-Fi, W01–W03 and W05 passed all fifteen early scripts and 16,446/16,446 no-retry pressure operations. Every tested lifetime completed raw64 and reached DHCP/USB Gate 10 with healthy HDMI; W01–W05 and GENET G01 also recorded the one-deep idle-report queue. W04 completed its scripts and every wire-command terminal but failed the REST error budget (25/757 timeouts, 3.3025%) amid RF/ingress delay; it remains operator-excluded, never a passing lifetime. GENET G01 passed 9,213/9,213 pressure operations and raw TCP at 180.269 requests/s with 1.677-ms p95, without wired regression.

The **2026-08-10 historical baseline**, source `2668c34f76ff`, passed one cold plus five rebooted Wi-Fi lifetimes and a same-image GENET control. Wi-Fi passed all 18 scripts and 18,363 pressure operations with no semantic errors; recovered retransmissions remained distinct from loss, reconnects and driver failures. GENET passed all scripts, raw TCP at 178.082 requests/s with 1.874-ms p95, and 9,711/9,712 REST operations; its one typed buffer-full refusal stayed within the accepted 1% budget. The operator accepted this research/diagnostic Wi-Fi envelope and unchanged wired control in place of the earlier 10-cold/10-warm, <=40-ms p95 and >=29-requests/s proposal. Semantic error accounting was unchanged. The host-only prompt-tail reboot repair passed 79 focused tests and added no target authority.

[Complete boot matrices and immutable provenance](https://raw.githubusercontent.com/lukeb-aidev/cohesix/fa55f5f18c0724ab8724f0d28defaf0dda5ce1b0/docs/BUILD_PLAN.md) retain both sources' build/image/manifest identities, every serial and paired-pcap SHA-256, per-lifetime latency/throughput and excluded samples. Capture hashes cover complete-record prefixes; live-writer tails were excluded. G01's 4,345 wire commands differ from its 9,213 REST operations; the excluded final FIN is supplemented by socket/process absence and zero reconnects. These historical records do not qualify a changed image.

**Reopened defect history and built result:** The accepted DHCP, USB/local-seat, QEMU compatibility and wired GENET baseline was retained. Investigation during 26d restored the original 26b root-no-wait contract through the task definitions below:

- `m26b-wifi-sdio-notification-dpc-closure` established generated IRQ/notification topology, sequence-last reciprocal DPC/RX records, bounded isolated owner service, Linux-aligned enable/ALP timing, persistent bootstrap supervision and whole-action pair restart. Persistent op11, finite urgent-op7 and event-bound DPC leases use durable conditions; coalesced notifications supply no authority. Private phases progress to bounded quiescence and named child/credit/queue/peer waits block immediately. Missing/competing intake seals produce typed zero-I/O terminals.
- Control/data restoration keeps TX submission queue-only, retires each issued op7 before fresh promotion, and prioritizes committed RX. A joined Function-2 terminal releases the root parent; SDPCM tx_max remains runtime admission, not a second root acknowledgement. Reserved response space and current-generation causal PTK successors survive bounded rotation without another issuer.
- Join/control restoration separates logical connection generations from physical bus epochs, opens and retains the outer Join lease across named waits, and makes DPC activation generation-long. Healthy owner-active state avoids redundant activation; committed events and exact ACK debt retain their existing authority. Function-2 control/Join retains its physical DPC fence, terminal IRQ closure and durable empty-ring rearm.
- EAPOL M2/M4/group-key replies use the sealed finite four-operation parent. The disproven EAPOL-only pre-TX fence was removed; pending CARD_INT does not reject an already-sealed data write. ACK_PENDING without a committed event is a publication window, not DPC authority. Generation-bound RX poison reaches the existing restart supervisor; the passive recovery-source-line record adds observation only.
- `m26b-usb-hdmi-local-seat-liveness` added counter-scaled held-arrow repeat and current-lifetime prompt/banner/display admission. Follow-up proof bookkeeping regressed enumeration at phases 198/316/412; runtime OldgoodReceipt publication and the redundant descriptor-proof scheduler were removed. The reserved ABI slot and zero-record projection remain passive. The board-proven `2668c34f76ff` enumeration/one-deep command path was restored, with PCIe/USB preparation in established attach order and one owner registration before enumeration. HDMI output/prompt progress is independent of Wi-Fi readiness; USB parser admission remains separate.

**Historical failure sequence:** `f9ba51abf` stopped after control TX before reply RX; `9e673510bf43` at redundant Join activation; `51741e5c25d9` at logical/physical generation comparison; `a9c01a58f2c0` at issued M2 before terminal; `5fa7c3871d96` at M4 or delivery of captured DHCP replies; `514036b706f5` at committed RX poison/PTK-successor/display progress; `325756c800b0` lacked the first recovery call-site identity; `5b57ebcdcf73` retained Join without command publication. These failed/partial runs are retained in the [immutable chronology](https://raw.githubusercontent.com/lukeb-aidev/cohesix/fa55f5f18c0724ab8724f0d28defaf0dda5ce1b0/docs/BUILD_PLAN.md); the later accepted matrix supersedes their pending-proof status without relabeling them. The earlier `78d5195582c7` 5/5 trace remains a historical oracle; its recurrent Poll/Grant cadence was not restored.

The accepted `7a10b8fd6acc` closure explicitly records `physical_input_proven=no`: no fresh key was typed. Repeated Gate 10, one-deep idle-report, command-ready, recovery-free and HDMI-complete sentinels plus exact restoration of the board-proven path were owner-accepted for this image only. Future changed images retain the normal physical-input and owner/descriptor proof requirements. The repairs added no operator protocol, namespace, second owner, poller, fallback or production Wi-Fi parity claim.

**Why now (operator continuity):**
Milestone 26b depends on completed 26a driver-task substrate and wired/serial/display isolation. Milestone 26b applies that model to the two paths that exposed the regression: USB keyboard/local-seat and CYW43 Wi-Fi. Wi-Fi and selected-network performance must improve by moving SDIO/firmware/RX/TX or GENET RX/TX progress onto bounded manifest-declared isolated driver runtimes, not by extending the root event-loop turn.

**Non-negotiable constraints:**
- DHCP implementation must be pure Rust, `no_std`, and intentionally bare-bones (DHCPv4 only: DISCOVER/OFFER/REQUEST/ACK plus bounded timeout/retry logic).
- No new in-VM listeners or protocols are permitted; DHCP is only a client-side address acquisition path for existing network surfaces.
- Post-seL4 runtime must remain HAL-only; no direct bootloader/firmware service calls are allowed in root-task.
- NIC and Wi-Fi DHCP behavior must be policy-configurable for `pi4-uboot-aarch64` through compiler-validated profile settings sourced from U-Boot environment configuration when available; if bootloader policy inputs are absent, the Pi 4 manifest defaults are authoritative and select DHCP/`auto` so GENET DHCP is the no-credential path and Wi-Fi DHCP is selected by explicit Wi-Fi policy or credentials.
- Wi-Fi scope is minimal diagnostics connectivity only (join + DHCP + existing TCP console path); no in-VM supplicant stack, roaming framework, or broad feature surface.
- Wi-Fi is a research, diagnostics, and degraded-link bring-up transport. Production Pi 4 deployments that require high worker concurrency or predictable REST latency should use the wired GENET path unless a site-specific Wi-Fi envelope is freshly proven and documented.
- Milestone 26b includes a new profile-gated Pi 4 CYW43xx Wi-Fi driver path; all Wi-Fi dataplane/control-plane access must be HAL-backed (SDIO, power/reset, IRQ/OOB, firmware handoff hooks) with no direct MMIO or firmware-service calls outside HAL.
- CYW43xx design references must be used in this order for architecture review: OpenBSD `bwfm` -> Zephyr/Infineon WHD HAL split -> Linux `brcmfmac` SDIO edge-case behavior. These are design references only; no source copy/paste is permitted.
- USB/xHCI/HID owns a higher-priority driver-task contract than Wi-Fi data. Keyboard first-byte and fast-typing proof are hard gates before Wi-Fi performance claims.
- CYW43/SDIO runs under separate network-control and network-data budgets. EAPOL, DHCP, ARP, and TCP ACK progress may preempt Wi-Fi bulk data, but neither class may preempt USB/local-seat or serial input.
- Runtime RX aggregation/glom may be enabled only after bounded superframe storage, capped deaggregation work, drop counters, and recovery gates are implemented inside the Wi-Fi driver task.
- Performance claims use normalized parity: raw `cohsh` over Pi Wi-Fi is measured first, REST gateway overhead is measured separately, QEMU remains a compatibility/capacity reference by itself, and production Pi throughput-parity claims must come from a fresh same-harness wired/GENET Pi run that meets or exceeds the selected best-QEMU throughput reference.
- Wi-Fi performance claims use the documented research envelope instead of QEMU parity: the safe sustained 26b Wi-Fi worker cap is `120` workers, short exploratory pressure may be run up to `300` workers, and `1500` workers is a fault-injection/stress ceiling only. Wi-Fi runs must pass the accepted error budget, preserve raw TCP/cohsh reachability, keep CYW43/SDIO counters free of drops/overflows/faults, and report latency separately as physical-link evidence.
- The isolated runtime throughput verdict excludes QEMU-latency parity only after recording latency fields in the artifacts and showing Pi 4 wired NIC and Wi-Fi latency is explained and aligned with the selected transport's documented physical-network expectations. Throughput, successful operation count, error rate, and bounded-backpressure behavior remain verdict inputs for production wired/GENET. Persistent second-scale stalls, unbounded queue growth, drops, or timeout-driven success remain blockers for production throughput claims even when exploratory Wi-Fi stress passes its error budget.
- Backward compatibility is mandatory: Milestone 26b must not break existing macOS/Linux QEMU workflows, fixtures, or transport semantics.

**Why now (reviewer trust):**
Milestones 25-26b establish technical capability, transport breadth, Pi 4 bring-up evidence, and isolated runtime benchmark closure, but the implementation has accumulated visible scaffolding, duplicated validation paths, long runtime modules, and uneven characterization coverage. Milestone 26c is the aggressive refactor window after isolated runtime benchmark closure and before seL4 15 realignment: it inventories tracked Markdown authoring surfaces, records docs-as-built truth, expands characterization and boundary gates, and then permits broad behavior-preserving refactors across Cohesix-authored host tools, root-task adapters, HAL-facing network code, tests, and public documentation. Cleanup is complete only when the target-qualified staged Test Plan passes on both QEMU and Pi 4 with evidence that external behavior did not drift.

**Current planning status:** Complete.

The documentation-only task
`m26c-readme-linked-doc-suite-remediation`, including its preservation and
newcomer-glossary follow-ups, completed on 15 July 2026. The later correction
that removed fabricated LoRa-radio semantics was authorized and closed
separately under Milestone 18; it does not leave Milestone 26c open. Historical
release snapshots remain immutable, and their superseded wording is recorded
in `docs/audit/M26C_DOC_DRIFT_LEDGER.md`.

Milestone 26d reopened only the truth and evidence attached to the former
Worker-execution, endpoint-cap, notification, and applied-scheduling claims.
The helper loops and generated badge/scheduling records remain useful model
artifacts, but they did not establish a loaded Worker image, TCB, CSpace,
VSpace, delivered cap, or target invocation. The historical implementation
tasks below are inactive and retained for traceability only; they may not be
executed under this reopening. Actual Worker objects, endpoint authority,
notifications, or MCS scheduling require a future explicitly authorized atomic
task that also satisfies the 26d MCS and root-TCB decision gates. Milestone 26e
owns root-service and Worker task isolation plus the SMP+MCS architecture and
target acceptance; Milestone 27d validates mixed-load operator scheduling on
that accepted architecture, and Milestone 27e owns production Worker
ticket/lease ledger binding, complete driver-inventory projection, and
structured quarantine/evidence. Other accepted 26c QEMU/Pi evidence remains
historical and is not invalidated by this correction.

The original QEMU and Pi 4 closure remains accepted. QEMU closure is anchored
by `out/test-plan/m26c-qemu` and Stage 05 due-diligence root
`out/audit/gate/20260628T015332Z`. Pi 4 closure is anchored by the final wired
GENET boot in `/Users/lukasbower/pi4-serial-20260629-135454.log`, paired
USB-Ethernet capture `/Users/lukasbower/tcpdump-usb-eth-20260629-135504.pcap`,
runtime/DMA proof bundle
`out/test-plan/m26c-pi4-live/pi4-runtime-dma-proof-genet-latest.env`, direct TCP
proof `out/test-plan/m26c-pi4-live/cohsh-tcp-proof-genet-latest.txt`, and Stage
05 due-diligence root `out/audit/gate/20260629T061204Z`. That accepted proof is
wired GENET at `192.168.10.50` with `PI4_RUNTIME_DMA_PROOF=fresh-pi`,
`PI4_RUNTIME_DMA_COUNTER_PROOF=counter-qualified`,
`TIMER_BACKEND=arch-counter`, `TIMER_CLOCK_HZ=54000000`,
`TIMER_EL0_COUNTER=vct`, DHCP-bound TCP `cohsh`, and REST/gateway validation.
It does not substitute for current-image Milestone 26d Pi 4 revalidation.

**Why now (kernel truth):**
Milestone 26c makes the docs-as-built audit, target-qualified Test Plan, host/VM boundary evidence, and regression-gated refactor baseline explicit. Milestone 26d refreshes the external kernel baseline and canonical references to seL4 16.0.0, anchors manual alignment to the official seL4 Reference Manual v16.0.0 ([PDF](https://sel4.systems/Info/Docs/seL4-manual-16.0.0.pdf)), proves the reopened 26a/26b driver-task model still holds on QEMU and Pi 4, and closes kernel-version drift before later feature work builds on stale assumptions. Because a kernel refresh changes scheduler, syscall, timer, cache, and generated-artifact behavior that can move measured latency or throughput, 26d also owns a bounded benchmark revalidation and regression-tuning lane: compare historical-best, accepted 26b, accepted seL4 15, first seL4 16, and post-tuning seL4 16 evidence before later milestones rely on the refreshed baseline.

Milestone 26b was subsequently reopened for the steady-data-plane and
local-seat regressions and returned to Complete on exact image
`7a10b8fd6acc` through the operator-approved matrix recorded above. Its
`2668c34f76ff` transport matrix remains the performance/reliability baseline;
the current-image record is final milestone closure. Urgent-only
lease eligibility, bulk exclusion, normal deadline or
hintless scheduling, and zero/no-ack fallback language retained inside the
completed 26d task records below describes the superseded evidence baseline;
it is not the current runtime contract. The accepted Milestone 26b contract is
the `m26b-wifi-sdio-notification-dpc-closure` task above: every admitted
current-generation post-Gate-8 op7 uses the same finite cadence, provenance
affects only capacity and urgent-before-bulk ordering, child completion is
durable before wake and rechecked before sleep, software-only drains are
bounded to eight terminals per Network wake, and accepted ordinary or pressure
traffic uses no deadline, hintless-watchdog, fallback, or second-owner lane.

The seL4 16 capability audit also found three pre-existing assurance defects that
must close before the refreshed-baseline claim is credible: isolated runtime
mappings were not uniformly fail-closed for execute permission, QEMU kernel
intent was not reproducible from one pinned upstream manifest/profile contract,
and generated Worker declarations overstated target execution. Milestone 26d
owns the bounded security and truth repairs below; it does not use those repairs
to imply new product behavior or completed Pi 4 Wi-Fi evidence.

**Evidence record:** [Benchmark results and run references](BENCHMARKS.md), [release audit](audit/AUDIT_REPORT_2026-09-13.md), and the approved carry-forward/waiver above retain the qualification basis. The [immutable historical evidence archive](https://raw.githubusercontent.com/lukeb-aidev/cohesix/fa55f5f18c0724ab8724f0d28defaf0dda5ce1b0/docs/BUILD_PLAN.md) retains the full earlier source/image hashes, serial/packet identities, per-run measurements and failed experiments summarized below. Historical failures remain failures for their original source, target and gate; they are not current acceptance.

**Why now (userspace TCB reduction):** Milestone 26d establishes honest
seL4 16 kernel/profile truth and records that NineDoor parsing, TCP/smoltcp,
provider dispatch, policy, supervision, and Worker model state still execute in
the principal root-task authority domain. It also corrects the former claim
that general Workers already run as isolated target tasks. Once the refreshed
QEMU/Pi baseline and CYW43 evidence are stable, Cohesix can reduce that
userspace TCB in the security-first order recorded by
`docs/audit/M26D_ROOT_TCB_BOUNDARY_AUDIT.md` without mixing a system-model
change into hardware bring-up.

The same audit found a second trust-boundary problem that must close before the
split can be accepted. Selected code can currently reach dummy time, a null
serial backend, preseeded target `/host` state (`systemd=active`, NVIDIA
`ok`/`42C`), mock 4090/4060 GPU entries, a spinning target `nine-door` binary,
and bootstrap commands that answer with `stub`/`not implemented`. The host GPU
bridge can also replace a missing or invalid live model registry with fixture
models and an implicit active model. Those paths are useful only as explicit
tests or developer simulations. They are prohibited from the 26e operational
QEMU/Pi dependency closure and from all target, Worker, integration, release,
and use-case evidence.

MCS is the preferred Cohesix temporal-isolation architecture, not a feature
checkbox or a throughput shortcut. Capability-controlled CPU time, enforced
budget/period ceilings, timeout faults, explicit Reply objects, and consumed
time evidence match Cohesix's mixed-criticality shape: root/Queen policy,
emergency serial, and fault supervision must remain live beside untrusted
parsers, network ingress, Workers, drivers, telemetry, and display work. The
split must therefore establish the MCS task/IPC contract before child ABIs
freeze. seL4 16 still describes SMP+MCS as less explored and experimental, so
exact QEMU/Pi acceptance is a hard evidence gate. Cohesix nevertheless selects
one architecture: accepted 26e operational profiles use SMP+MCS on both targets.
There is no compiled classic-SMP fallback; an unforeseen blocker requires
reverting the atomic 26e scheduler change set before another architecture can
be planned.

Changes:
  - Diagnostic compatibility note — this task intentionally versions the non-authority-bearing `wifi diag` accounting and truth telemetry with `owner_active=yes|no`, updates the trace normalizer and gate proof together, and keeps historical lines readable but non-acceptable without active-owner proof. It changes no authority-bearing console command, network protocol, namespace, or benchmark workload grammar; later references to no console/network protocol change use that narrower meaning.
  - Current DPC-client accounting repair — add one cache-isolated, exact 128-byte `DriverRuntimeCyw43DpcClientRecord` at shared offset 49,984 through 50,111 (`[49,984, 50,112)`), immediately after the DPC-child timing record and below the 53,248-byte CYW43-private RX-region end. CYW43 is the sole writer and publishes the current physical epoch, live consumer sequence, owner-rearm attempts, errors, cause counters, DPC turns, owner children/turns, and completed-frame counters at existing initialization, quiescent owner-rearm, and terminal-fault checkpoints by clearing the final commit word, writing and cleaning the body, then repeating a nonzero publication sequence last. Root stable-double-reads the record and accepts it only between identical stable reads of the live SDIO owner ring (`ring -> record -> ring`) with exact physical-epoch and live-consumer binding. A torn, stale, raced, or mismatched sample is rerun-required and acceptance-red, but grants no admission, notification, wake, issue, retry, rearm, recovery, deadline, scheduling, or physical-owner authority. The additive v11 completion trace remains historical/compatibility input, not current DPC-client truth.
  - Current Gate 7/Gate 8 diagnostic transaction — bracket each passive current `wifi diag` with a nonzero `wifi: diag_begin id=<id> pair_epoch=<pair> generation=<gen> snapshot=current` and matching `wifi: diag_complete id=<id> ... snapshot=current pair=<pair> gen=<gen> ...`. Emit the compact retained Gate 7 `7a>7b>7c>7d>7e` receipt only when its exact pair/generation matches that transaction; `src=sm` means current retained host-EAPOL state-machine proof, not generic Gate 8 inference. Bind every intervening Gate 8 subgate to the same pair/generation. The normalizer accepts retained or clipped proof only from one exact begin/rows/complete identity and fails closed on standalone, prior, reordered, malformed, scrubbed, or cross-identity rows; these records remain passive evidence only.
  - Current owner/old-good diagnostic closure — the exact `2668c34f76ff` matrix proved Gate 10 and a healthy current DPC ring while every post-settle serial slice still lacked durable CYW43/SDIO owner-state, firmware-identity, and ordered pre-association control receipts. Do not infer those prerequisites from Gate 7, Gate 8, DHCP, TCP, or a bootstrap-stage breadcrumb. Source compact owner rows only from current HAL owner registration plus descriptor-seal truth, and project one bounded retained old-good transaction only from the current supervisor's monotonic firmware/control/association/EAPOL state for the exact `wifi diag` id, pair epoch, and generation. Split any identity fields that cannot fit one untruncated 243-byte payload into exact ordered same-identity rows, keep the essential transaction within the bounded response backlog, and fail closed on missing, malformed, reordered, clipped, cross-command, cross-pair, cross-generation, replacement, recovery, or later-attempt evidence. These rows are passive acceptance receipts only and add no driver issue, notification, wake, retry, poll, deadline, recovery, scheduling, or owner authority.
  - scripts/pi4_serial_reboot.py + focused helper fixtures — on the settled WiFi diagnostics path, request `smp activity` before fresh `nettest`/terminal `netstats` and `wifi diag` so the retained ordered old-good prefix precedes its fresh network/DPC tail in the durable serial transcript. Preserve the existing settled-supervisor and DHCP barriers, command grammar, error handling, redaction, and bounded command synchronization; this host-only ordering carries no target or acceptance authority and cannot make missing proof pass.
  - Diagnostic RX timing split (`m26b-wifi-join-owner-forensic-decision`) — version the fixed 128-byte RX batch to v3 while preserving `source_cntvct_lo: [u32; 8]` at bytes 88-119 and the sequence-last parent commit at byte 124. Bytes 120-123 become one sequence-covered `first_data_stage_deltas_q11` for the first populated `CHANNEL_DATA` entry: low `u16` is the floor of DPC source to successful durable private-queue commit and high `u16` is the floor of that queue commit to the final precommit evidence-word sample, both in 2^11-CNTVCT-tick units (about 37.9 us). Values `0x0000..=0xfffe` are valid, including raw zero; `0xffff` is saturated/UNKNOWN. The runtime writes zero when no DATA entry exists, but the passive word is excluded from batch validity and authority identity. If two otherwise exact stable samples differ only in that word, root accepts the batch with both halves degraded to `0xffff`; the mismatch cannot reject traffic or authorize recovery. Root retains a private stable-copy CNTVCT word and, only after exact paired response acceptance, reports the existing source-to-acceptance interval plus `rxsplit_q11a` (`s2q`, `q2p`) and `rxsplit_q11b` (`p2r`, `r2a`, `sat`, `inv`, and one same-sample slow tuple). `p2r` is the exact source-to-copy residual after subtracting both independently floored Q11 stages, so it includes less than 4,096 ticks of combined quantization remainder (about 75.9 us at 54 MHz). This evidence adds no wake, poll, timer, owner, lane, issue, retry, deadline, recovery, or scheduling authority.
  - J4 per-child owner-seam decision (`m26b-wifi-join-owner-forensic-decision`) — exact image `aabb9b39ecc4` reached first-pair Gate 8 and DHCP with no live-ring poison, RX-queue poison, `recovery_required`, sticky pair restart, or priority-lease poison; its stale compatibility client snapshot did not poison or govern the healthy live owner. Raw TCP still missed acceptance. Its valid worst same-sample split was 33.841 ms total: `s2q=27.154 ms` (80.2%), `q2p=5.309 ms`, `p2r=1.228 ms`, and `r2a=0.148 ms`. This is J4: association and the J1/J2/J3 ownership chain are complete, while the first causal performance seam remains inside DPC source admission to durable private-RX queue commit. Add one passive two-region trace that follows the same immutable physical epoch, DPC event, child sequence, descriptor fingerprint, action, I/O phase, and selected engine. `DriverRuntimeSdioChildTimingMailbox` occupies one cache-isolated line in the SDIO owner ring at offset 1,920, wholly within bytes 1,920-1,983: the owner fault record ends at 1,912, the clock snapshot begins at 1,984, and the shared payload starts at 4,096. CYW43 stages the immutable child identity and publication CNTVCT before the normal sequence-last command handoff; SDIO validates and preserves that body, records exact owner intake, physical issue, and joined-terminal CNTVCT, and commits the child sequence last before the normal completion. CYW43 then stable-reads the exact committed mailbox through its mapped owner ring and adds the acceptance CNTVCT to one 28-byte entry. `DriverRuntimeCyw43DpcChildTimingRecord` is an exact 512-byte CYW43/root record with at most sixteen entries beginning at shared offset 49,472, immediately after the 49,344-49,471 bus-episode record and ending at 49,984, before the RX-batch-region end at 53,248. Root reads only the joined CYW43 trace and never writes either record. The numeric owner-mailbox offset aliases CYW43's parent-descriptor offset only on CYW43's physically distinct local ring; every writer and reader must name the runtime role and ring base, and SDIO must never access the CYW43-private 36,864-53,247 pages. The staged/commit writers are sequential and disjoint in time; neither may mutate the other side's fields after handoff. The mailbox/trace may record passive publication, owner intake, physical issue, physical terminal, CYW43 acceptance, and queue-commit timestamps, validity and overflow accounting, but may not signal, wake, issue, retry, rearm, recover, alter a deadline, retain work, or select scheduling.
  - J4 decision branches — classify only valid exact-identity samples from the same slow DPC episode. Dominant source-to-first-child-publication time selects CYW43's local pre-child DPC path; dominant publication-to-SDIO-intake selects the reciprocal CYW43-to-SDIO handoff/admission seam; dominant SDIO-intake-to-issue selects SDIO's preissue service; dominant issue-to-terminal selects the already-selected SDHCI/PIO-or-DMA physical child. Dominant terminal-to-CYW43-acceptance selects the final diagnostic mailbox publication plus normal SDIO completion publication/handoff and CYW43 acceptance; only dominant between-child acceptance-to-publication or final-acceptance-to-queue-commit selects CYW43 local DPC continuation. A torn, stale, overflowed, wrapped-ambiguous, missing, cross-epoch, cross-child, or non-worst sample is UNKNOWN and authorizes no behavior. Only one repeated dominant seam with a direct code-path counterfactual may admit one minimal architecture-preserving correction; otherwise stop the current repair sequence. Exact historical `494e9cb0e9ad` remains a negative physical-ordering control because it reproduced first-ACK delay, retransmission, and about 1.5-second raw-TCP p95, so stopping does not authorize merging or restoring that implementation.
  - Cross-task bounded accepted-child continuation (`m26b-wifi-sdio-notification-dpc-closure` and `m26b-net-control-priority`) — after CYW43 accepts a normal exact `SteadyLease` DPC child terminal and releases that exact global child, the same already-admitted runtime call may execute one bounded deterministic private `FifoWindow` `AdvanceState` transition and publish at most one successor DPC child before returning at that successor's external wait. The released child cannot overlap the successor claim, publication is not physical issue, and SDIO remains the sole later physical issuer. This adds no root admission, poll, wake, notification, priority lease, retry authority, or topology. A contained-preissue `FAULT` retry, `OrdinaryContinuation`, `RxQuantumBoundary`, `RxQueueWait`, `RecoverySettle`, `CompleteEvent`, `DeferredOwner`, and every other external child, credit, peer, or recovery wait remain later-turn boundaries; malformed, stale, mismatched, issued-unknown, and fault-terminal state retains its existing fail-closed path.
  - J4 host-tool compatibility review — `cohsh`, `hive-gateway`, `coh`, SwarmUI, `tools/cohesix-py`, the `.coh` fixtures, and the raw/REST/hive benchmark workloads require no implementation, schema, fixture, or workload change because the new current DPC-client record and exact diagnostic transaction add only bounded passive `wifi diag` evidence and change no console command, ACK/ERR/END grammar, namespace, request framing, or benchmark arithmetic. The changed host consumers are `scripts/pi4_trace_normalize.py` with its focused proof fixtures and `scripts/pi4_serial_reboot.py` with its focused bounded orchestration fixtures; older logs remain readable by the normalizer and produce typed `UNKNOWN` when the new record is absent.
  - crates/pi4-driver-abi/src/lib.rs + apps/pi4-driver-runtime/src/lib.rs + apps/root-task/src/hal/driver_task.rs + apps/root-task/src/drivers/driver_task_net.rs + apps/root-task/src/event/mod.rs — bump the sealed runtime descriptor to ABI v7 and reserve one cache-isolated 128-byte sequence-last `DriverRuntimeCyw43BusEpisodeRecord` at absolute shared offset 49,344. Separate foreground and DPC diagnostic accumulators preserve immutable parent/child identity, logical and physical generations, first/last CNTVCT, DPC sequence, bounded op8/RX/TX progress, final pending mask, and typed exit across foreground clear, runtime-state restoration, and pair-ring scrub. Publish only after a material terminal, typed fault, prewait checkpoint, or bounded fairness checkpoint; write body, clean/barrier, and commit the final publication sequence last with no signal. After a prewait publication, repeat the durable-condition and exact-child tests immediately before sleep. A parent terminal first commits and signals its authoritative completion, then updates this passive ledger so telemetry cannot lengthen the commit-to-signal path. Root double-samples and prints one bounded `CYW43_BUS_EPISODE` line in `wifi diag`. This record is diagnostic only and may not participate in admission, progress, recovery, retry, deadline, rearm, notification, or authority.
  - configs/root_task*.toml + tools/coh-rtc/src/** + generated artifacts — declare and validate SDHCI IRQ 158 and DMA channel-4 IRQ 116 under the sole SDIO physical owner, reciprocal CYW43/SDIO notification slots, the existing shared owner window, and a fixed four-entry DPC event ring as compiler-owned topology. PIO terminal state uses the SDHCI/host condition without DMA authority; when external DMA applies, the two physical IRQ results join into one immutable request terminal, either arrival order is legal, and neither creates another issuer.
  - crates/pi4-driver-abi/src/lib.rs — version the pointer-free reciprocal bus-link descriptor, define bounded sequence-stamped DPC event-ring metadata, and retain the fixed 24-byte sequence-last continuation-grant record for ordinary retained commands. Add a command-level persistent-transaction marker plus a paired SDIO-child marker that HAL/CYW43 may derive only from one fully validated, immutable op11 descriptor, payload, exact 192-operation/64-frame/65,536-byte budget, request, and logical generation. Logical zero and nonzero parents both remain immutable while CYW43 binds them once to the independent current physical epoch; retained transactions and SDIO children carry the physical epoch, and a changed logical parent, stale physical epoch, partial, caller-supplied, or mismatched marker fails closed. Version the fixed ring to v3 and add the durable `OWNER_ACTIVE` flag without changing its fixed size. A persistent Function-2 CMD53 write also carries the pre-TX DPC fence: it means the sole owner must establish and recheck same-physical-generation owner-active ring health plus a physically armed `CARD_INT` before issue, not merely sample one notification edge. Define the non-renewable 30-second root parent containment deadline. Add the fixed 24-byte sequence-last `DriverRuntimeCyw43RxQueueState` at CYW43 local-ring offset 192 and the 128-byte `DriverRuntimeCyw43RxBatchRecord` at shared offset 36,864. One immutable op8 parent or active persistent op11 commits one through eight entries whose fixed 1,536-byte payload slots begin at offset 36,992; the final parent-sequence word commits the batch after body/payload clean and barrier. Add the cache-line-isolated 64-byte `DriverRuntimeCyw43RxBatchAck` at shared offset 49,280; root clears its commit, writes the exact generation/parent/queue-commit/count body, cleans and barriers that disjoint line, and commits `queue_commit_sequence` last. Add the 20-byte sequence-last `DriverRuntimeSdioDeadlineArm` at SDIO owner-ring offset 2,028 with physical-lifetime epoch, request sequence, 64-bit expiry ticks, and request-sequence commit last. These records add no console or network protocol grammar.
  - apps/root-task/src/hal/{mod.rs,driver_task.rs} — admit only generated caps/topology, bind the selected runtime notifications, and keep root as a bounded ring client with no steady SDIO service loop. Non-op11 retained CYW43 foreground commands outside the finite urgent op7 path, including non-op11 bootstrap, recovery, EAPOL-Start, and ordinary control commands, keep their existing exact-grant cadence. The op7 steady lease remains a separate immutable identity with its existing admission and budget, while the linked runtime routes from its current durable condition: deterministic private phases continue even on an equal snapshot, and an exact child, credit, queue, or peer wait blocks immediately even when newly observed. Only a completely intake-sealed current-generation EAPOL-Key M2, M4, or group-key response may reuse its existing paired finite marker. HAL requires one frame, four owner operations, 1,536 bytes, and request-bound priority coverage for both CYW43 and SDIO; root commits and signals once, publishes no grant or later signal after issue, and resumes only for the durable matching terminal. Its deadline may enter recovery only. Ordinary post-Gate-8 TCP retains the O(1) finite-op7 path without the EAPOL-Key parser, poller, or fallback. Every exact op11 is persistent regardless of logical generation or lifecycle: HAL performs `Stage -> CommitRing` with body/payload clean and barrier, commits the command sequence last, transitions the retained request to `Issued`, and emits exactly one notification. It starts one non-renewable 30-second CNTVCT containment deadline at issue; a stable terminal wins at expiry and a double stable miss enters coordinated pair recovery without another grant, replay, or traffic-progress edge. Later root polls may observe only durable state or contain a fault. Root may copy and deliver a stable op11 sideband batch without terminating that parent, then publishes the exact disjoint sequence-last ACK; torn, stale, duplicate, mismatched, or authority-bearing post-copy-changed state fails closed; a change confined to the passive packed timing word instead preserves the copied payload and exact ACK while degrading both timing halves to UNKNOWN. Root also stable-reads the SDIO deadline arm during its existing outer service turn and, only after an unchanged exact arm has expired, emits at most one fault-containment hint through its existing reserved-root notification to CYW43. The hint carries no grant, retry, history, or direct SDIO authority.
  - apps/pi4-driver-runtime/src/lib.rs — let SDIO own IRQ capture/clear/ack and signal CYW43 only after durable publication; let CYW43 retain bounded software-pending DPC state and preserve wire order. Non-op11 root-to-runtime foreground commands keep their existing exact endpoint or grant contract. The urgent op7 parent retains its separate finite steady-service identity, and its current durable condition—not snapshot novelty—decides whether deterministic private work continues locally or an exact external wait blocks. The typed host-EAPOL specialization accepts only the already paired finite marker on a fully sealed M2, M4, or group-key response; it preserves the one-frame/four-operation/1,536-byte parent and keeps the current request authoritative to sequence-last terminal without another grant or signal. Its Function-2 child does not inherit the persistent-control pre-TX fence: a concurrent committed CARD_INT remains independent DPC work and cannot turn the already-sealed data write into a synthetic pre-issue rejection. EAPOL-Start and ordinary control do not self-promote into it, while ordinary post-Gate-8 TCP stays on the O(1) descriptor path. CYW43 admits an exact marker-paired op11 once, seals its immutable parent identity, and advances that parent from durable queue, credit, CARD_INT/DPC, control-phase, exact-child, sideband-batch, and exact sideband-ACK state without another root grant or notification. The root-owned logical connection generation remains sealed in parent `aux1`; CYW43 binds that parent once to the independent generated SDIO bus-link epoch, and every retained transaction and physical child carries only that physical epoch. Logical zero and nonzero parents follow the same rule, and neither domain is compared with or rewritten into the other. EVENT/DATA preceding the exact BCDC reply remain ordered and are exported in one durable sideband batch; they neither terminalize nor republish op11. CYW43 advances only after a stable ACK exactly matches generation, parent sequence, queue commit, and count. Every CMD52, CMD53, or `DPC_ACTIVATE` child derived from that parent carries the paired persistent marker; the sole SDIO owner validates the pair and retains the exact child with zero delegated continuation grants. Post-release `DPC_ACTIVATE` establishes one generation-long activation lifetime rather than a per-control prerequisite. The fixed v3 DPC ring publishes an explicit durable `OWNER_ACTIVE` bit with owner health; only a healthy current-physical-epoch, owner-active, empty, unmasked ring advances control locally. A committed event binds one exact sequence until durable consumption, including wrapped sequence zero, and a later reassertion cannot extend that dependency. Missing/replaced bound state quarantines the generation. Only activation-absent or mask-skewed state, plus exact ACK debt bound to an already-submitted immutable activation frontier, may enter activation repair; invalid, wrong-generation, poisoned, overrun, or lost-authority state fails closed and quarantines the generation. Every persistent Function-2 write additionally inherits the pre-TX DPC fence. Before request installation, that fence requires exact physical generation, valid owner-active ring, no ACK/poison/overrun state, and mask agreement. For every healthy empty ring the owner commits a fresh masked baseline and runs the existing crossing-safe rearm rather than trusting an arm inherited from an earlier control lifetime. SDIO re-reads committed ring health and both enables after rearm, then repeats ring/enable/source checks immediately before `SDHCI_COMMAND`. A durable event or crossing source returns a typed proven-not-issued defer; an invariant failure performs zero command/DMA I/O and fails closed. This applies equally to PIO and external DMA, adds no recurring probe, and leaves steady op7 unchanged. Steady-parent identity is independent of the DPC publication phase: a source-bearing front event is immediately serviceable, while an earlier `ACK_PENDING` observation with no committed front is a blocked producer window that retains the exact parent and can never enter the ordinary grant lane. Once a sequence-last SDIO command is committed, pre-admission cannot discard it after consuming its prompt: a missing or competing intake seal reaches owner dispatch, performs zero physical I/O, and publishes the typed terminal. After firmware release, every production DPC event instead binds its own immutable event sequence and current physical generation to the existing finite steady-service child marker, before or after Gate 8; mutable `steady_data_plane_live` state cannot select an ordinary recurrent-grant path. The immutable DPC cursor and committed ring state—not `CYW43_DPC_DEFERRED` or notification history—remain authoritative between exact children until that event terminal; the semantic snapshot is diagnostic only. Persistent op11, urgent op7, and the DPC event lease route every owner turn from the current durable condition. An exact source-bearing event already bound during `PreTxDpcProbe` is service authority in that same owner turn, including its exact submitted ACK debt, rather than requiring another wake. Deterministic private phases continue to bounded quiescence even when the semantic snapshot is equal; an exact child, credit, queue, or peer wait blocks immediately even when its snapshot is newly observed, and returned RX-queue capacity resumes immediately without another hint. Each service helper remains bounded and each immutable hardware request issues at most once, but no yield, notification, or scheduler placement is a required transaction edge. PIO terminalizes from SDHCI IRQ158/host state with zero DMA authority; when external DMA applies, IRQ158 and DMA channel-4 IRQ116 join into one immutable child terminal in either order. SDIO alone takes one live joined-controller sample after a changed steady cursor before it may classify an external wait; this hardware-sample exception does not make snapshot novelty transaction authority. At the final condition-before-sleep boundary, every active autonomous SDIO phase that can remain blocked commits its exact counter expiry through the deadline-arm body then request sequence last. This includes pre-issue inhibit and status-clear admission, issued polling, containment/reset polls, and host-clock polls; containment clock settle publishes the earlier of its settle and overall expiries. Terminal/reset clears the commit before publishing terminal/reset state. Root and CYW43 may relay one expired-arm hint over the existing root-to-CYW43-to-SDIO notification chain only after stable exact-identity rechecks; SDIO alone rechecks terminal-before-deadline and owns containment. Completion body/cache clean/barrier precede sequence-last commit and only then may the owner signal CYW43. Immediately before blocking, CYW43 re-reads its authoritative parent/child terminal, DPC event frontier, RX queue/batch/ACK, credit, and foreground state. SDIO separately re-reads its active physical child/completion, joined IRQ/CARD_INT, deadline arm, owner health, and—immediately before idle receive—its own sequence-last one-way command ring. A fresh command re-enters SDIO arbitration. Neither runtime reads or acquires the other runtime's private authority, and missing, coalesced, or repeated notifications change no outcome. A normal post-TX op11 `WaitReply` parks because its current durable condition is an external peer wait, even when that condition was just observed, and does not force a source probe; ordinary traffic records zero fault-hint wakes. A retained foreground phase snapshots the DPC producer and ordinarily drains only work at or before that watermark before one foreground quantum, so a continuously reasserted level source cannot starve unrelated control progress. The sole dependency exception is durable rather than notification-driven: a persistent op11 in credit/reply wait and a sealed urgent op7 in `WAIT_CREDIT` admit a later committed front DPC event because it can carry that parent's reply or credit; private pre-TX phases and all other later events retain the watermark and RXBOUND fairness policy. Each immutable DPC event source/frame-length condition is admitted once when its sequence becomes active, and an overlapping sequence poisons rather than merging event identities. One physical interrupt episode completes active transfer state, drains bounded RX, applies SDPCM credit progress, admits an already-ready urgent TX before quiescence, and rechecks the durable condition before blocking. Current ring flags and exact pending-ACK state are live authority; the per-pair `ack_failures` count is historical telemetry and cannot revoke healthy work after exact ACK recovery. It does not require a second scheduling edge or fallback lane.
  - apps/pi4-driver-runtime/src/lib.rs — treat the Function-2 fence's request-local mask/readback/rearm as a linearization step inside the already-live generation activation, never as closure or recreation of that activation lifetime.
  - apps/pi4-driver-runtime/src/lib.rs — close a condition-first request terminal and its shared IRQ episode in the sole SDIO owner before exposing the child completion. Mask request and `CARD_INT` signalling with verified readback, W1C and re-read only exact request-owned residual status, then either commit visible `CARD_INT` durably before exact IRQ158 ACK or ACK IRQ158 and complete crossing-safe rearm. External DMA additionally joins exact IRQ116 ACK before the single terminal. While an immutable one-way command is intake-sealed or cursor-active, treat its event publication and joined IRQ state as terminal body and emit no inner peer hint; clean/barrier and commit the generic child completion sequence last, then emit exactly one CYW43 hint. A failed terminal commit emits none. Standalone idle `CARD_INT` and non-one-way service retain immediate post-event signalling because no later child terminal owns that handoff. Independently, make the final valid-empty-ring/masked-`CARD_INT` rearm due from durable owner state before command arbitration even when the command queue is empty; peer notifications remain optional hints. Add no poller, fallback, source probe, smoltcp change, GENET change, or second issuer.
  - apps/pi4-driver-runtime/src/lib.rs — admit a marker-paired persistent `DPC_ACTIVATE` from exact generation/link/non-poisoned/ring health even when activation or state/ring `CARD_INT` mask parity is not yet established, because this sole-owner operation creates and republishes those two postconditions. When IRQ158 is delivered after that exact immutable frontier is submitted, admit its current `ACK_PENDING` state only while the active parent, child ticket, generation, descriptor/source-probe identity, and global child sequence still match; this same retained owner cursor commits or coalesces the source, ACKs the frozen epoch, republishes cleared health, and terminalizes. Latch and retain that IRQ epoch across a zero host-status sample while the pre-activation immutable command or private cursor exists; only an unclaimed zero-status badge may be released immediately. ACK debt without that exact frontier remains fail-closed. Its retained state machine rechecks exact owner binding before MMIO and issues no SDHCI command. Ordinary persistent CMD52/CMD53 and urgent-op7 children retain the existing activation, ring, and mask-coherence gates. If the dedicated final empty-ring rearm fails, preserve its typed owner-health result before any later child can obscure the first break.
  - apps/root-task/src/drivers/driver_task_net.rs + apps/root-task/src/event/mod.rs + apps/root-task/src/net/stack.rs + apps/root-task/src/userland/mod.rs — retain one no-allocation bootstrap/recovery owner for the network lifetime; run exactly one outer boot episode as `attempt=1` and one initial physical pair with zero pre-service pair restarts; publish atomic 8a-through-8h plus nonterminal `CYW43_GATE8_COMMIT`, then publish the unique bootstrap Ready only after exact-generation DHCP/listener readiness; advance descriptor, firmware/control, association/EAPOL, data-TX, ARP/GARP, and post-up work through immutable generation-bound cursors; admit one bounded pair-repair episode only after service readiness and report restored service with a distinct runtime marker; preserve linked-runtime-only serial, buffered-only local-seat, and reboot-first operator liveness while recovery fences NetStack. Root treats the CYW43 notification as a prompt to stable-read committed state. The canonical-terminal retirement exception is fenced only by an actually pending or in-progress pair restart: the HAL context-replay `required` state rejects generic submissions until the bootstrap supervisor atomically owns it, and that owned replay capability must admit the firmware/control actions that finish the same replay. Thus context replay cannot self-classify as a fresh recovery fence, while a superseding pair restart still wins and invalidates it. Bootstrap failure policy also preserves an already committed sequence-last HAL receipt and pair-drain exception until the enclosing outer-turn semantic finalizer releases their exact identity. When the exact issued persistent op11 parent or typed finite Host-EAPOL key-response parent has no stable terminal and HAL reports `Waiting`, EventPump masks only that exact parent's runtime-descriptor, logical-owner, and HAL-lease self-demand so repeated root polls cannot become a scheduling clock; independent committed DPC/RX work, sideband-batch consumption, deadline containment, recovery, and a newly visible exact terminal remain schedulable. For finite op7, HAL validates immutable request/ring/command identity and stable-reads the exact completion before consulting transient lease phase or priority coverage; those scheduler facts decide only whether a terminal-absent parent may wait. A committed terminal owns one explicit consume reason, while a waiting parent suppresses all Host-EAPOL policy self-demand, including BSSID refresh and active-session levels, without suppressing CARD_INT/DPC or root RX. Identity loss or typed deadline containment enters the sole recovery path instead of hot-running policy. The passive bounded `wifi: finite_parent` line exposes raw stable completion, immutable identity, wait identity, and the derived condition but grants no scheduling or recovery authority. One op8 parent returns detail `0x5803`, `result=count`, and the batch-header frame reference; root may copy one through eight entries only after validating generation, queue-commit, parent sequence, bounds, and a matching post-copy header re-read. The same validated record may be consumed as op11 sideband without closing op11, followed by one disjoint exact ACK. Remaining committed queue depth retains service without another notification. Deadlines contain an exact fault; the only hint they may cause is the one-shot stable-expired SDIO arm relay, never receive progress or an alternate transaction.
  - crates/pi4-driver-abi/src/lib.rs + apps/pi4-driver-runtime/src/lib.rs + apps/root-task/src/hal/driver_task.rs + apps/root-task/src/drivers/driver_task_net.rs + apps/root-task/src/event/mod.rs — bump the sealed runtime descriptor to ABI v8 and overlay one distinct-magic, exact 24-byte `DriverRuntimePersistentWaitReceipt` at auxiliary offset 40, mutually exclusive with continuation grants and finite-progress records. CYW43 alone allocates a producer-monotonic nonzero wait epoch for an exact persistent op11; exhaustion fails closed. It clears the commit, writes request sequence, action fingerprint, logical generation including zero, and epoch, cleans/barriers, and commits the same epoch last only after its final durable-condition and child-terminal checks. A changed condition clears the receipt before local continuation; an actually blocked owner retains it only while armed on its generated local notification and clears it before interpreting a wake or publishing terminal. Root accepts only a stable double-read of the exact request, fingerprint, generation, epoch, and commit. Before that receipt or terminal, EventPump promptly re-admits the same parent across the existing Open, bounded Closing, and exact handoff boundary while preserving one externally uninterrupted bus-service episode; after the receipt it parks ordinarily. No receipt can grant, signal, issue, retry, renew a deadline, or authorize recovery, and publication/clear failure poisons the exact transaction through the sole fail-closed pair path.
  - scripts/pi4_trace_normalize.py + scripts/pi4_gate_proof.sh + scripts/pi4_wifi_repeatability.py + docs/DRIVERS.md — keep notification deferral red, reject any automatic attempt 2, bootstrap backoff, or whole-bootstrap reset, expose single-episode terminal state, require ABI v8 for current sealed-owner acceptance while retaining v7 text only as historical ledger evidence, and require bounded IRQ/DPC, ordered RX, exact-image multi-boot TCP/cohsh, and unchanged USB/serial proof.

Changes:
  - crates/pi4-driver-abi/src/lib.rs — use reserved shared owner-ring bytes for one fixed 24-byte sequence-last `DriverRuntimeContinuationGrant` containing magic, request sequence, complete action fingerprint, authoritative owner generation, monotonic nonzero grant id, and consumer-published consumed id. Define the 24-byte sequence-last `DriverRuntimeCyw43RxQueueState` at local-ring offset 192 and the 128-byte `DriverRuntimeCyw43RxBatchRecord` at shared offset 36,864. Its one through eight entries address fixed 1,536-byte payload slots starting at offset 36,992; `committed_parent_sequence` at byte 124 is the final batch commit. Define the disjoint cache-line-aligned 64-byte `DriverRuntimeCyw43RxBatchAck` at shared offset 49,280 with generation, parent sequence, queue commit, count, and `committed_queue_commit_sequence` last. Define the 20-byte `DriverRuntimeSdioDeadlineArm` in SDIO owner-ring bytes 2,028 through 2,047 with physical-lifetime epoch, request sequence, expiry ticks low/high, and `committed_request_sequence` last.
  - configs/root_task*.toml + tools/coh-rtc + generated outputs + crates/pi4-driver-abi/src/lib.rs — declare and validate the sole physical SDIO owner with SDHCI IRQ 158, DMA channel-4 IRQ 116, three MMIO pages, ten DMA pages, 32 shared pages, and one exact 32-KiB CYW43-SDIO aperture; reject split IRQ ownership or under- or over-provisioned geometry instead of selecting another launch lane.
  - apps/pi4-driver-runtime/src/lib.rs — preserve endpoint rendezvous only for non-CYW43 root-to-runtime retained commands. Non-op11 CYW43 foreground commands keep their acknowledged exact shared-grant authority plus send-only reserved-root-badge hint with no endpoint fallback. Exact op11 instead uses one HAL-derived persistent parent marker and paired child markers with no recurrent root or delegated grant. Urgent op7 keeps its separate finite steady-service identity and budget. EAPOL-Start and ordinary control remain on the ordinary retained cadence; only a completely intake-sealed current-generation EAPOL-Key M2, M4, or group-key response may use the existing paired finite-op7 marker, with one frame, four owner operations, 1,536 bytes, and a Function-2 pre-TX DPC fence. Its exact request retains CYW43-plus-SDIO priority and durable terminal authority after one notification, with no later grant or signal; deadline expiry is recovery-only. Ordinary post-Gate-8 TCP retains its O(1) finite-op7 classification and does not run the EAPOL-Key parser. From the first post-release event, production DPC binds its exact event sequence and physical generation to the finite steady-service child marker; mutable Gate 8 state cannot select the ordinary recurrent-grant mode. Replace the remaining lossy delegated endpoint `NBSend` with one generated send-only badge-256 cap to the SDIO owner's bound notification. Notifications are coalescing prompts only; immutable command identity, generation, selected grant/marker/event lease, sequence-last ring state, and current fault flags remain authoritative. The SDIO owner joins SDHCI IRQ158, DMA4 IRQ116 when applicable, and durable CARD_INT/controller state into exactly one terminal for each immutable request. SDIO alone takes one live joined-controller sample after a changed steady cursor before it may block; that hardware-sample exception does not make snapshot novelty transaction authority. Once a sequence-last SDIO command is committed, missing or competing pre-admission seal state cannot erase it after the prompt is consumed: owner dispatch performs zero physical I/O and publishes the typed terminal. Every helper is bounded and each immutable hardware request issues at most once. Persistent op11, urgent op7, and DPC event service route from current durable conditions rather than snapshot novelty: deterministic private phases continue locally even on equal snapshots, while exact child, credit, queue, and peer waits block immediately even when newly observed. EVENT/DATA discovered while op11 awaits its exact BCDC reply is committed as sideband RX state; CYW43 preserves the op11 parent until root copies the batch and commits the exact disjoint ACK. Completion body/cache clean/barrier precede sequence-last commit and any signal. A recovered IRQ acknowledgement leaves `ack_failures` as per-pair history but clears current pending/fault state; that historical count cannot revoke op11, steady TX, RX batching, or DPC urgency. Issued-unknown containment preserves the exact transaction and cannot fall back or replay. Retain Linux-ordered power sequencing, inhibit/preflight, register programming, indivisible COMMAND-plus-DMA-start issue, request snapshots, containment, host configuration, DPC activation, generation publication, and Function 2 ready/window service under the sole SDIO owner. At condition-before-sleep, every active autonomous phase that can remain blocked publishes its exact counter deadline commit last: pre-issue inhibit/status-clear, issued poll, containment/reset polls, and host-clock polls are covered, while containment clock settle selects the earlier settle/overall expiry. Terminal/reset clears the arm before its publication. An unchanged expired arm may prompt one existing root-to-CYW43-to-SDIO fault hint, after stable identity checks at each hop; SDIO alone rechecks terminal-before-deadline and contains the request. One physical interrupt episode completes the active transfer, drains bounded RX, applies SDPCM credits, admits an already-ready urgent TX, and rechecks the durable condition before blocking. CYW43 publishes queue state by clearing its commit, writing and cleaning the body, barriering, and writing a new nonzero commit sequence last. One immutable parent similarly commits one through eight batch payloads and entries; op8 then publishes its single terminal, while op11 waits for the separate root ACK and remains active. Missing, coalesced, or repeated hints change no authority or progress. Each DPC event's immutable source/frame-length condition is applied only on first sequence admission; an overlapping sequence poisons the generation. Keep both the complete retained trace and an explicitly invalid `MaybeUninit` full-baseline slot in loader-zeroed storage. The former raw non-descriptor service shape is rejected before card access.
  - apps/pi4-driver-runtime/src/lib.rs target-warning closure — remove orphaned synchronous SDIO/CYW43 wrappers and disconnected policy oracles superseded by the retained exact-grant/DPC lane, and compile retained host-compatibility RX models only for unit tests. Keep the bare-metal build featureless and warning-clean without a second physical path or a crate-wide lint allowance.
  - apps/pi4-driver-runtime/src/lib.rs + apps/root-task/src/{local_seat.rs,event/mod.rs} — restore the reopened 26b local-seat liveness contract without changing CYW43 authority: keep one Linux-usbhid-shaped interrupt-IN transfer active for the keyboard lifetime and rearm one successor after each completion instead of expanding from one to 32 active TRBs after the first idle report. Treat one armed idle transfer as command-ready but not physical-input proof. At each declared CYW43 fairness stride, preserve the exact parent and pair-priority lease while running one bounded `Serial -> LocalSeat -> Dispatch -> pending Display` checkpoint with zero NIC operations; a CYW43 notification may prompt a later queue-state read but cannot latch admission or rewrite an already-scheduled physical-console phase. GENET scheduling remains unchanged.
  - apps/root-task/Cargo.toml + apps/root-task/src/net/{mod.rs,queue.rs,stack.rs} + apps/root-task/src/event/mod.rs — replace smoltcp's transient automatic ICMPv4 echo response with one common fixed-capacity raw IPv4/ICMP socket owner. From its two-frame full-MTU RX queue, the service admits only checksum-valid Echo Requests from a unicast source to the exact assigned local IPv4 address and constructs at most one reply per NetStack service turn. Its one-frame full-MTU TX queue preserves identifier, sequence, and payload while ordinary smoltcp neighbor resolution is pending, then emits exactly one reply. Drop malformed, nonlocal, non-Echo, saturated, or competing work; expire unresolved reply state after three virtual-counter seconds; and purge/recreate both queues on Wi-Fi connection-generation change, DHCP address change, and explicit stack reset so no reply crosses a network lifetime. Keep this lane above both physical drivers: it creates no CYW43 source probe or packet issuer and does not change GENET scheduling.
  - apps/root-task/src/drivers/driver_task_net.rs + apps/root-task/src/hal/{mod.rs,driver_task.rs} + apps/root-task/src/event/mod.rs + apps/root-task/src/net/{mod.rs,stack.rs} + apps/root-task/src/userland/mod.rs — retain the no-allocation bootstrap/recovery owner under the ordinary EventPump, stage all published shared-page aliases, clear cached progress identity when transport ownership is cleared, and mint the CYW43-only root scheduling cap only after fallible construction. Enforce at most one root CYW43 parent admission per outer turn. Ordinary non-op11 foreground commands retain their bounded `Stage`, priority transition, sequence-last `CommitRing`, exact `PublishGrant`, signal-last `NotifyRing`, and later `PollRing` phases. Exact op11 instead crosses its sequence-zero `Stage`, sequence-last `CommitRing`, and sole signal inside the same already-admitted producer call, remains `Issued` through misses, and publishes no recurrent grant or signal. EventPump evaluates NetStack's side-effect-free exact association-owner predicate and opens the outer pair lease before the first association poll can allocate Join, even when rendered status is stale; presentation text is not scheduling authority. The ordinary Join then crosses `Stage`, `CommitRing`, `Issued`, and its sole signal under that already-open lease; it performs zero request-bound boost/restore actions. A stable exact Join terminal remains canonically admissible while the outer pair episode enters its bounded Closing path, restores CYW43, restores SDIO, and completes, one bounded HAL step per later EventPump turn and with no new signal or request. Driver-runtime ABI v8 overlays one typed `DriverRuntimePersistentWaitReceipt` on the existing mutually exclusive 24-byte grant/progress slot. After sequence-last issue and before that exact same-request receipt or terminal is stable, root retains the open Network lease for ordinary association. The only named request-bound paired lifetime is the intake-sealed current-generation EAPOL-Key M2, M4, or group-key finite-op7 class; this closes the notify/wake scheduling handoff without granting, signalling, issuing, or creating a completion poll clock. CYW43 commits the exact request/fingerprint/logical-generation/wait-epoch receipt last only after its final durable-condition and child-terminal checks, retains it only while armed on the generated local notification, and clears it before wake re-entry or terminal publication. Publication or clear failure poisons the exact transaction and uses the existing fail-closed pair path. Once the receipt proves the external wait and HAL reports the exact issued op11 as `Waiting`, root masks only its runtime-descriptor, logical-owner, and HAL-lease self-demand; it performs no CYW43/SDIO poll but retains both outer pair reservations while required operator phases rotate. Committed DPC/RX, urgent TX, sideband consumption, deadline containment, terminal-drain, and recovery remain schedulable, and `TerminalVisible` resumes the exact consumer inside the same episode. Recovery, stale, reservation-mismatched, and GENET requests retain their fail-closed paths. Root stable-reads `DriverRuntimeCyw43RxQueueState`, then accepts a `DriverRuntimeCyw43RxBatchRecord` only when its generation, queue commit, parent sequence, one-through-eight count, remaining depth, and entry bounds match. It copies the fixed payload slots and re-reads the batch header; an authority-bearing change rejects the batch, while a change confined to the passive packed timing word preserves the payload and exact ACK and degrades both split halves to UNKNOWN. An op8 detail `0x5803` represents the entire terminal parent, not one frame. For an active op11, the same batch is nonterminal sideband: root delivers it once and commits the exact cache-line-disjoint ACK last. A notification only prompts these reads. Root also observes the stable deadline arm in its existing service loop and sends at most one fault-only reserved-root hint for an unchanged expired identity; it never issues, polls, retries, or directly signals SDIO. Visible committed depth retains Network service; exact committed empty state ends it. No root wake bit, hit epoch, clear/recheck history, or per-frame terminal authorizes work.
  - current CYW43 lifetime correction to the preceding receive rule — EventPump alone coordinates the generation-scoped two-class, aggregate-capacity-16 TX queue and its sole active op7 owner. TxToken consumption remains queue-only. An exact retained foreign HAL owner, including the immutable RX batch op8 parent, remains non-revocable and leaves op7 queued/requestless until that parent terminal. Once the lane is free, EventPump advances one active op7 or promotes and advances one eligible FIFO head before copied-RX service, so sustained RX cannot starve urgent DHCP/control TX. The runtime alone gates physical issue with `sdpcm_seq` and `tx_max`; a closed window retains that promoted exact op7 in `WAIT_CREDIT`. The joined Function-2 terminal releases root immediately and is not converted into a later RX-credit acknowledgement wait. The finite host-EAPOL key-response parent suppresses only its own waiting root cursor after issue; DPC/RX/recovery remain runnable and its committed terminal re-enables the exact consumer. The post-release activation is generation-long: healthy control work reuses it, and one exact already-committed pre-TX event is consumed without admitting an unbounded later-event stream. Only activation-absent or mask-skewed state, plus exact ACK debt bound to an already-submitted immutable activation frontier, creates an activation-repair child; invalid, wrong-generation, poisoned, overrun, or lost-authority state fails closed. The persistent CYW43 transaction services physical progress to bounded quiescence: joined IRQ completion, bounded RX drain, SDPCM-credit update, already-ready urgent TX admission, and a final durable-condition recheck. Queue state is committed before any optional signal, and one op8 parent commits up to eight frames before its one optional root signal. SDIO also re-reads its sequence-last ring-only command intake immediately before idle receive, so a fresh child re-enters arbitration without notification history. Deadlines only fence or poison an exact active autonomous phase or ambiguous owner; normal ingress has zero timer-created source polls or watchdog rescue. These are one-lane liveness corrections, add no fallback or poller, preserve post-Gate-8 TCP's O(1) lane, and do not apply to GENET.
  - persistent-op11 sideband and physical-deadline closure — while op11 remains the sole immutable control parent, commit preceding EVENT/DATA as one batch and let root publish the exact cache-line-disjoint ACK after stable delivery; only the exact CONTROL reply terminalizes the parent. At condition-before-sleep, commit `DriverRuntimeSdioDeadlineArm` for every blockable active autonomous SDIO phase, including pre-issue inhibit/status-clear; use the exact phase counter expiry and the earlier settle/overall expiry during containment clock settle, and clear the arm before terminal/reset publication. Ordinary traffic requires `sdio_deadline_hints=0`; one unchanged expired exact arm may produce at most one fault-only hint over the existing root-to-CYW43-to-SDIO chain, with SDIO retaining sole containment authority. Current DPC flags/pending state govern work; per-pair `ack_failures` is historical telemetry and cannot disable healthy work after exact retry recovery.
  - retained-parent time-cap validation — let elapsed time defer only to a HAL-validated open root-continuation parent whose nonzero immutable fingerprint, request, logical generation, pair epoch, priority reservations, and restart-free state remain current across the EventPump check. Simultaneous hard-turn and elapsed bounds report the hard turn-cap yield.
  - recovery policy — run exactly one outer boot episode as `attempt=1`, with one initial physical pair, zero pre-service pair restarts, and no automatic whole-bootstrap backoff, reset, or attempts 2 through 5. A pre-service typed fault drains/fences its exact owner, terminates the boot episode, quarantines network service, and restores bounded diagnostics, authentication, reboot, serial, local-seat, and HDMI service. Atomic Gate 8 commit opens DHCP but remains nonterminal; the unique bootstrap Ready requires exact-generation bound DHCP plus the admitted TCP listener, and the original deadline terminates missing service readiness. Gate-local association, DHCP, and protocol retries remain bounded and do not create outer attempts. Exact service readiness authorizes one later consumed-once steady-state pair repair; duplicate Ready cannot replenish it, and restored service uses a distinct runtime Ready marker before one later episode can be armed. Gate 10 remains downstream acceptance proof rather than recovery authority. Pre-issue contention that issued nothing and changed no scheduler state clears locally; issued or scheduler-mutating uncertainty requires the ordered runtime repair.
  - scripts/pi4_image_identity.py + scripts/pi4_wifi_repeatability.py + scripts/pi4_trace_normalize.py and tests — bind evidence to one clean expected commit/build/image, reject duplicate or aliased run/log/image inputs, validate stable single-descriptor log reads, parse exact rootserver archive membership, expose separately bounded current-episode, boot-cumulative transition/fault, immutable first-pre-fence scheduler, and split root-grant records, reject impossible phases/masks/widths, and preserve honest separation between deterministic offline proof and later physical repeatability evidence.
  - docs/DRIVERS.md + docs/HARDWARE_BRINGUP.md + docs/TEST_PLAN.md — record the as-built split between non-CYW43 root endpoint authority, root-to-CYW43 exact-grant plus hint-only reserved-root notification, delegated exact-grant plus hint-only owner notification, joined SDHCI/DMA IRQ completion, durable sequence-last RX queue state, one-parent bounded RX batches, the exact association claim and retained-open Join episode, and the complete passive priority/recovery/root-grant grammar; record the July 24 failure as reliance on a consumable scheduling edge rather than absence of a rescue watchdog; and retain the July 10 all-gates/DHCP/TCP boot only as a compatibility oracle for the upper Linux-shaped path.

Changes:
  - Stage 05 syscall IPC ownership restoration — independent review under `m26e-mcs-smp-target-acceptance` finds that restricted critical TCB notification waits and kernel-error cleanup can write through the process-global root IPC pointer. Safe badge wrappers also accept arbitrary raw output addresses, and binding a child IPC address incorrectly returns a caller memory view. Require borrowed badge outputs, a kernel-only child bind result, private fast registers or the explicitly borrowed caller buffer throughout restricted cleanup, and no implicit IPC-buffer access for zero-length Send/NBSend or MCS Wait/NBWait returns. Preserve nonempty endpoint payloads, generic libsel4 error-word behavior, capability checks, fault/Reply ordering, scheduling bounds and every operator surface. Retain selected-kernel and exact-image evidence separately from any unproved physical-fault attribution. Review the complete host-tool suite, Python SDK and benchmarks; these internal Rust ownership contracts change no public wire or generated schema. Focused ABI/storage contracts, exact QEMU/Pi compilation, independent review, fresh target fault/wake evidence and applicable staged gates precede DD-2026-0030 closure. The canonical Worker convergence script must publish and acknowledge a distinct `/actions/queue` approval before each create/kill/create write, preserving the selected single-use `/queen/ctl` policy gate. Observe bounded authenticated READY/terminal telemetry before dependent lifecycle operations, and validate complete retained Queen-log records for two increasing generations around terminal containment; nonessential UART mirroring cannot own this proof.
  - Release 1.0.0-beta DD30 owner decision — on 2026-09-13 Lukas Bower explicitly accepts the remaining dynamic fault/wake evidence gap after source, selected ABI, pure-test and emitted-code verification of the IPC ownership repair. This supersedes the unconditional pre-closure fault/wake requirement above only for this release and this finding. Keep DD30 at P1 / ACCEPTED_RISK under EX-2026-0030; the unexecuted target test is not PASS. The machine-readable docs/audit/DD30_RELEASE_WAIVER.toml binds the exact owner statement and ten reviewed production-file hashes, with a conservative administrative expiry of 2026-10-13. Require explicit DD_RELEASE_ID=1.0.0-beta selection and fail closed for changed source, mismatched records, expired or withdrawn approval. All other findings, target evidence, staged source bindings and acceptance checks remain mandatory; no VM fault-injection authority is introduced.
  - Release 1.0.0-beta approved evidence carry-forward and host-model restoration — on 2026-09-13 Lukas Bower approved the exact two-file host repair and reuse of authentic prior Stage 01–04 records plus later scoped fix evidence without duplicate stages. Restore typed host Suspend/Delete/Revoke/Consumed models at the object-only boundary while keeping target fast-register IPC and endpoint echo unchanged; assert the deadline fixture's existing admitted/outer-turn invariant during each iteration. Bind the approved Rust patch, original four attestations and exact successor source in docs/audit/RELEASE_1_0_0_BETA_CARRY_FORWARD.toml. The dedicated release Stage 05 entry point may issue PASS_WITH_RESIDUAL_RISK only after immutable evidence, owner authority, exact source continuity and unique governance checks pass. Preserve old source/target identities, the failed fresh-run attempt and DD30's UNEXECUTED dynamic test; never create replacement Stage 01–04 markers or relax ordinary resume checks. Release-bundle source/integrity and other target requirements remain separate and unchanged.
  - Stage 05 independent-review restoration — discovery under `m26e-mcs-smp-target-acceptance` identifies two remaining PCIe admission defects: USB and SDIO consumers can accept partial link/MSI flags before endpoint/firmware completion, and physical settle intervals are expressed as CPU spin counts. Require one complete owner proof before either consumer proceeds, revoke it before reset and on failure, and measure the existing hardware intervals using exported CNTVCT and generated timer frequency. Retain the existing root-text and bounded reset/readback/firmware observations without requiring an admitted UART sink. Three fixed private slots preserve the original early root-entry, IPC-installation and fault-receiver measurements through bulk child admission; publish those captured values once at the common pre-PCIe boundary without re-sampling. The exact 25dc WiFi boot exposed ordinary-log eviction of every audit receipt after longer firmware startup. Add an explicit trusted boot reserve for at most 63 complete 256-byte original records plus one reserved sticky failure receipt, preserving the ordinary 2048-line ring. Admit saved and ordinary copies atomically under the existing nonblocking lock; user prefixes cannot claim trusted slots. Full export merges original sequence identities without duplicate copies, freezes the exact union byte count and end sequence, preserves unread saved records across ordinary eviction between batches, and keeps latest-N tail semantics. Materialize capture failure at its actual later export sequence before freezing the cursor; never resample text or reissue hardware. Nonblocking capture/publication failures remain explicit and collectors must require the actual exact-ELF checksum cuts and complete ordered receipts. Preserve sole device ownership, MMIO barriers, protocol/ABI, scheduling bounds, operator service and raw/pressure thresholds. Review every host tool, Python SDK, generated contract and benchmark consumer; these private HAL/boot diagnostics require no consumer or workload changes. Meaningful publication/failure/timer/sink tests, exact Pi compilation, independent review and fresh dual-mode Pi evidence precede audit closure; canonical final-source Stages 01–05 remain required.
  - Release partial-input liveness restoration — discovered by `m26e-mcs-smp-target-acceptance` on exact Pi source `2be878d8d1645718d9420a7144a10fd4003bd4b2`, W02 image `ce4b681f72a435a7305b4553a7c51ba9e4fe7709538a7b6fd59a269773b52f31`: a two-byte unfinished serial line excludes TCP for the entire bounded 20-second probe; clearing the line restores it in 0.325 seconds on the same boot. Distinguish queued bytes and active parser chunks from retained partial text at the physical-operator fence. Preserve serial-first dispatch, every partial byte, response-tail priority, immutable CYW43 ownership, input echo and bounded USB/HDMI service. The existing partial-USB presentation shortcut is earned only by newly consumed bytes, so a stationary line cannot perpetually re-enter it. This supersedes only the older partial-line fence wording below; it changes no owner, timer, SC numeric, ABI, protocol or generated contract. Review coh/cohsh, SwarmUI, Hive Gateway, host bridges/agent, CAS, Python SDK and performance scripts: no consumer or workload changes are required. Require independent parser/fence contracts, exact Pi and QEMU builds, a fresh physical partial-input/TCP control, raw and pressure reruns, and the applicable staged gates before acceptance.
  - Release-candidate quarantine restoration — retain the network attachment class before failure and reject response-lane inspection before touching a quarantined adapter. The cached VirtIO class preserves its bounded rotor through containment; direct GENET and CYW43 selectors cannot inspect a poisoned driver. A failed CYW43 runtime must leave serial/local operator service live. The existing terminal-quarantine tests require zero poisoned-adapter reads; host tests do not replace the requested fresh target checks. Discovery: `m26e-production-surface-truth-and-stub-retirement`.
  - Release-candidate unsafe-boundary repair — use the existing checked HAL register window for continuation-grant publication and parked-child acknowledgement, preserving every volatile store and cache publication order. Reuse the uncached DMA word writer for zeroing and a typed fixed-peer NBSendWait wrapper for root/SDIO/CYW43 handoffs. This removes four duplicate raw-access sites; canonical counts are global 827 and linked-runtime/HAL 173, within the unchanged approved limits. Existing sequence/receipt/zeroing tests, explicit fixed-slot and invalid-address checks, and exact target compilation precede fresh performance evidence.
  - Pi exact-bed6 overlapping-command ACK progress restoration — host windows on unchanged GENET G04/G05 stall with a full direct RX ring and root awaiting the previous response drain, while serialized 400-request/s controls complete on G06. A later command publication fences transport until new root control, but root cannot stage that control until the preceding TCP response is acknowledged. Preserve already-retained transport work and permit peer-triggered progress under the existing three-unit command-wait bound while the previous exact output control remains pending. Pending output alone cannot mint polling; a no-progress cycle ending at the bound must quiesce. Keep the command latch, OutputDrained plus ControlCompleted retirement, publication credit, sole device owner, ABI v13, SC numerics, WiFi path and qualified QEMU behavior. Focused permission/quiescence contracts, exact Pi compilation and a narrow QEMU console-network canary precede fresh raw64 and the failed overlapping host scenario. This restores a defect discovered under `m26e-console-network-service-isolation`; it does not establish the cause of every raw or REST tail. Review all host tools, tools/cohesix-py, generated contracts and raw/REST benchmarks: protocol, workloads, retries and report schemas require no changes. Hardware improvement and repeatability remain unproven until measured.
  - Pi MCS source-pass reservation candidate — the exact ae6f1029b two-WiFi/two-comparable-GENET matrix remains below performance targets; WiFi DPC child timing contains 9,911 us publication-to-intake and 7,871 us issue-to-terminal waits, without proving whether individual gaps are voluntary Yield or kernel postponement. Generic CYW43/SDIO source-return paths unconditionally yielded by role, including rejected/quiescent sources. Under selected MCS, retire that bounded source arbitration pass and re-enter ordinary immutable intake/grant/recovery checks without charging the remaining head refill. Preserve classic cooperative behavior, retained-grant failure/recovery yields, GENET DPC policy, CPU allocations, all physical operation/deadline bounds and operator/Worker functionality. Focused terminal-baton and source-priority tests plus exact target compilation protect the code contract; fresh Pi timing and pressure remain required. Host-tool catalog, Python SDK and every benchmark entry point retain their command, schema, workload, target and retry contracts; no consumer change is needed for this scheduling-only behavior.
  - Pi exact-1c5165 idle and scheduling attribution — seal the 138-artifact
    unchanged four-boot matrix before edits. Successful WiFi raw64 reaches
    18.0104 requests/s; GENET p95 is 5.659959/5.946875 ms. G00 stalls in
    Signal while G01 stalls in IRQ completion without a signal due; neither
    wall interval identifies the competing CPU owner. Add the existing
    serial, USB, HDMI and PCIe SCs to session CPU receipts, sampled by their
    current supervisor authority. Permit ready WiFi to enter the existing
    root fan-in receive only with an Idle one-way owner and every existing
    operator, output, child, fault and recovery fence empty. Recheck all
    levels after the existing one-time PCIe timer enable. No scheduling
    numbers, device ownership, GENET issue path or benchmark bounds change.
    Keep all CPU rows and the end marker within the Pi SMP output envelope;
    detailed network rows remain available through NETSTATS.
  - Pi exact-5750 copied publication and response-stage attribution — the sealed 175-artifact two-WiFi/two-GENET headless matrix misses WiFi throughput and GENET p95. WiFi wire request-to-ACK averages 42.5–47.8 ms while GENET averages 0.61–0.67 ms with its tail mostly after ACK. The child serializes already-ready command and copied egress pages across separate publication credits. Permit one copied command plus one prepared packet under the existing credit: packet commit precedes command event barrier, one event/fan-in notification pair, and root validates and retains both before ACK. Watermark-only wakes cannot consume partial bundles; direct paths and lifecycle events cannot pair. Use existing CommandBatch nested timestamps to separate creation from publication start on Pi, correcting the prior mislabeled creation-to-root metric. Add seven bounded schema-v2 seam rows with fixed age histograms and accepted-pair count; preserve per-command policy timestamps, QEMU representation, physical owner boundaries, protocol, packet workload, MCS budgets and guards. Regress barrier/identity/credit exclusion, batch timestamps, histogram bounds and complete serial/TCP diagnostic tails; compile exact Pi and run the shared root-MCS QEMU canary. Discovery also belongs to `m26e-console-network-service-isolation`. Compatibility review covers coh/cohsh, coh-status, Hive Gateway/REST, SwarmUI, GPU bridge, host-ticket agent, sidecar/bus, CAS tool, all .coh scripts, tools/cohesix-py, generated contracts, trace/evidence tools and performance workloads/report schemas: they do not parse the old seam row or depend on internal command encoding; no consumer implementation or generated schema changes are required. USERLAND_AND_CLI owns the explicitly versioned operator-row change. Hardware scheduling effect and performance remain unproven until fresh exact-image raw TCP and repeatability evidence.
  - Pi exact-5750 display-disconnected scheduling restoration — the unchanged two-WiFi/two-GENET matrix seals 175 artifacts before edits. The operator confirms HDMI was disconnected; HAL therefore has no bootloader framebuffer, while queued display bytes fence every GENET raw idle cut and passive HDMI status labels completed faults ready. Treat new HDMI output and startup milestones as non-runnable without boot framebuffer authority, preserving bounded buffers, any already-retained completion, serial and USB service. Skip futile engine attachment and nonessential network mirroring to that absent display. Report unavailable framebuffer or unproven owner independently of completion counts. Keep connected-display rendering, generated budgets, wake and driver protocols, benchmark workloads and QEMU scheduling unchanged. Regress missing/present framebuffer scheduling, retained output, and truthful status; compile the exact Pi profile and protect shared EventPump behavior with the root-MCS QEMU canary. Discovery also belongs to `m26e-console-network-service-isolation`; review the host-tool suite, Python library, generated contracts and benchmark parsers. No performance success is claimed until a fresh exact-image Pi run.
  - Pi exact-80 GENET private control-copy reduction — sealed four-boot matrix `out/bench/80c3d8c03-four-boot-matrix.json` keeps GENET p95 above target with substantial console-network CPU. Exact-image disassembly proves each direct ring sample clears and returns a 4-KiB scratch page for 320 bytes of header/cursor state. Add an exact private-prefix codec and retain strict full-page admission through the existing API; use the compact copy in both isolated peers, preserving every identity, poison, cursor, final reconciliation and wake check. Mapped pages, wire ABI/version, scheduling, DMA, IRQ, packet workloads and WiFi behavior stay unchanged. Test exact bytes, length rejection, tail preservation and reciprocal publication/poison contracts, compile both selected profiles and compare emitted code. Source proves reduced copying; fresh Pi CPU, raw latency and repeatability must determine its effect. Discovery also belongs to `m26e-console-network-service-isolation`. Review the complete host-tool catalog, Python package, generated contracts and benchmark consumers; no external grammar, report, workload or generated schema changes are required.
  - Pi exact-80 startup background takeover — the unchanged `80c3d8c03b8924da89d0ec43cfb5a4525f1bd5b4` two-WiFi/two-GENET matrix seals 193 artifacts before edits. User observation requires clearing U-Boot at the first startup banner instead of ordinary-console takeover. Retain the existing immutable HDMI init command after its bounded tile write, then clear the surrounding framebuffer with the existing format/budget row bound while preserving the tile. Publish init completion only after every background row is cleared. Keep pre-banner boot video, the child counter, sole framebuffer ownership, normal terminal takeover and USB/serial priority. Regress full-background coverage, tile preservation, immutable-command mismatch and each turn's write bound alongside existing compositor cases. No manifest, SC values, protocol, benchmark or QEMU path changes. Review host-tool/Python/benchmark compatibility as unchanged. Exact Pi build and fresh visible hardware proof remain required; source tests do not establish immediate physical display behavior or network closure. Discovery also belongs to `m26e-console-network-service-isolation`.
  - Pi 8af diagnostic delivery and boot-video restoration — unchanged `8af555da207a726617304db9b243fe31af944a38` completes two WiFi and two GENET boots before edits, sealed with 169 artifacts. All raw64, focused scripts, Worker32 and canonical pressure workloads complete, but WiFi throughput and GENET p95 remain below target. All four `smp mcs` bodies lose owner CPU rows and their end marker at the 69-line physical limit; TCP capture is limited to 64 lines. Pair adjacent copied non-Worker registrations, preserve all generations/validity/counters, and document the two static legends instead of repeating them, so the selected Pi WiFi body fits both existing bounds. Regress the actual selected-Pi registry and complete physical/TCP body. User feedback confirms timer, arrows and help, but reports premature blanking: remove the boot script's pre-kernel clear and retain vidconsole through bootm until child-only HDMI takeover. Restore canonical docs atomically; no SC numerics, physical protocols, queue bounds, workloads, thresholds or QEMU output change. Fresh CPU and display receipts remain required; this delivery repair alone does not establish a performance cause or acceptance.
  - Pi exact-493 CPU-accounting discriminator — the unchanged two-WiFi/two-GENET set on `493caa7f8a84b3ed40a576aa772552fe8ea13cc0`, image `20c06aa6a8869623571edbd2cba6e354a13cf41dc11cbb1076087329cc2eefca`, passes raw64, representative scripts, Worker32 and medium/high pressure on every boot but fails one raw performance metric per lane. GENET G01 has 7.412 ms p95 with a 173 us maximum driver slice and no elapsed-guard flag; wall receipts cannot establish consumed CPU. Sample the selected root-control, console-network and network-driver SCs at observed TCP lifecycle edges through their existing owners. Preserve intermediate root Consumed drains in a cumulative evidence sum; driver-supervisor samples only its moved SC caps, one selected driver per wake, after fault work. Keep capability generation, syscall time brackets, missing/error validity and latest-session identity explicit in bounded `smp mcs` rows. No budget, period, refill, priority, core, physical protocol, benchmark workload or QEMU scheduling change is authorized by this diagnostic. Discovery also belongs to `m26e-console-network-service-isolation`. Fresh Pi evidence must distinguish CPU demand from blocking before a performance repair.
  - Pi exact-0783 lost evidence at teardown and Yield — unchanged source `0783c5aa10b1879623f3be748f7deef7901fa0f5`, image `d1d7e73e8de472dc0387b6cb51017af5f344e50a8a2124425f51ff909ac3c26c`, completes two WiFi and two GENET evidence boots before edits. WiFi W00 fails a TAIL terminal after nine host pure ACKs but six root-dequeued/staged/completed ACK increments; the final receipt describes teardown, so it cannot locate the absent body ACKs. W01 passes scripts/pressure at 12.909 requests/s, 88.195 ms p95 and 47.408-second ready. GENET passes scripts/pressure at 263.184/217.319 requests/s but 7.036/9.428 ms p95; one exact wire tuple binds a 34.037-ms Signal interval, while the other boot's raw maximum physical slice is only 110.704 microseconds. Retain the latest same-flow ACK admission at an exact received FIN and the latest TCP session's first maximum valid Yield with pre-Yield work counters, phase and observed child publication. Preserve identity/generation fences, fixed row capacity, every existing scheduling/driver contract and QEMU behavior. Update additive-row documentation and the host parser fixture; review the complete host/Python/benchmark suite without changing workloads or acceptance. These are diagnostic retention repairs, not a performance fix or proof of SC consumption. Discovery also belongs to `m26e-console-network-service-isolation`; fresh exact-image hardware must resolve the remaining causal interval.
  - Pi exact-e11b initial-wake restoration — two WiFi and two GENET boots on `e11b3fb677e7fc57f7e728bc71c7a122d95b9f52`, image `81e76dab2ab78e347f6271b77eb3a5c0796f4d3c853459741892206bc8ac2ae0`, pass scripts and mid/high pressure but miss raw targets. GENET G01 repeats HDMI command60/completion59 with fresh previous-idle child progress and absent DROW/DROA. Reconcile only that unbound initial endpoint rendezvous under the exact retained identity and existing generated wake-period gate; current admission, continuation, terminal or changed identity prevents another hint. Preserve the binding guard, one action per slice, Reply/SC ownership, physical driver protocols and QEMU behavior. Carry the two-second child startup counter across serial cutover using one ordinary retained Display slice per operator rotation until normal-frame takeover, without delaying readiness. Review all host tools, Python and benchmarks with no API/workload/schema changes. Focused admission/clock checks, exact Pi compilation and the root-MCS QEMU canary qualify the candidate; fresh Pi display/input and transport performance/repeatability remain required. Discovery also belongs to `m26e-console-network-service-isolation`.
  - Pi exact-a176 four-boot admission discriminator — WiFi W00/W01 and GENET G00/G01 all pass representative scripts and medium/high functional pressure, but raw TCP misses targets; GENET G01 repeatedly ACKs in about0.2ms while command publication waits up to10ms for root. Cumulative idle masks include subsequent paced UART diagnostic typing and cannot prove the raw operator fence. Retain one bounded latest nonzero TCP generation/connection record for existing idle cuts, six independent operator predicates and exact Yield wall intervals; preserve it across disconnect and reset only at a newly observed nonzero identity. Emit seven additive rows only in explicit Pi smp mcs; no admission predicate, scheduling syscall/number, driver authority, physical protocol, QEMU route or benchmark workload changes. Cover identity retention/reset, invalid clocks, independent counts, saturation and complete output; update operator/host contracts and passive trace fixtures. Fresh raw-first Pi evidence must decide whether absent wake-friendly idle or another admission boundary dominates; do not call this telemetry a performance repair or infer consumed CPU/refill exhaustion from elapsed time. Discovery also belongs to m26e-console-network-service-isolation.
  - Pi exact-a0efe bounded RX root episode — source `a0efeecded25c946e14c91495380e987e813261b`, image `b883a92de767f183f52d1748b5e4439c67863d61555866c43f182097ff21dd4f`, WiFi W01 passes raw64 at 12.147632 requests/s and 91.073916 ms p95, three representative scripts and medium16/high32 pressure; ready is 45.025658 seconds after reset. Its 12.137 ms mean queue-to-publication and 7.376 ms publication-to-root intervals motivate composing the existing MCS root bookkeeping for the exact queue-only NetData op8. Bound first admission to six existing calls ending at its first notification; separately bound already-stable terminal retirement to four calls. Preserve strict request/fingerprint/generation identity, reservations, all producer/lifetime/recovery guards, the child grant and batch-ACK protocol, operator rotation and the outer 64-turn bound. Source proves the MCS boost/restore steps make no scheduling syscall; eliminating these intervening outer turns is a candidate latency repair, not measured savings. GENET G01 remains 232.580571 requests/s and 7.076542 ms p95: v6 proves 37.931667 ms inside Signal and 0.481481 microseconds in retirement, but does not distinguish kernel execution from descheduling. GENET behavior is unchanged pending that discriminator. Review the complete host suite, Python library, workloads and report consumers in the same change; run focused identity/phase invariants, exact-profile compilation and the narrow QEMU canary. Fresh Pi targets and qualifying reboot proof remain open under this task and `m26e-console-network-service-isolation`.
  - Pi exact-d7fab continuation and RX-tail discriminator — source `d7fab675f0814e1af11bdd32aff050c06ae00bd0`, image `8e19922926731d86d020a67bd8e68e0b46697dd7ed07e3481d9ca80ad719d3cd` passes WiFi W00/W01 raw TCP and representative scripts, including W01's first TCP without prior nettest; W00 passes medium16/high32 pressure. WiFi remains near 12 requests/s and 83 ms p95, with substantial queue-to-publication delay. Complete the exact op8 frontier relation over observable HAL calls: admit initialization that performs its first operation and coalesced retirement of an already-visible terminal, while rejecting unrelated phase/grant jumps even when a terminal appears. Preserve identities, consumer monotonicity, one-take accounting, operator rotation, the 64-turn cap and physical authority. GENET G00 passes 232.449 requests/s, scripts and pressure but misses p95 at 6.679 ms; an exact prior-response ACK tuple binds 36.453 ms between confirmed RX publication and packet completion. Extend only the separate diagnostic to v6, retaining its 320-byte layout and adding bounded Signal entry/return and RX retirement timestamps within the existing maximum-slice receipt. Preserve Signal placement, DMA/ring ordering, scheduling and IRQ behavior until fresh hardware distinguishes kernel time from retirement. Recurrent GENET response delays are not attributed to the maximum slice or to aggregate SC CPU use. Same-change host-suite and Python/benchmark compatibility review, focused invariants, exact builds and the QEMU root-MCS canary qualify the candidate only; fresh dual-transport physical proof and qualifying reboots remain required.
  - Pi exact-0feb receive and firmware convergence — source `0feb46e3e556afed1ca6392a23b58dadc1e8f93b`, image `f2725455836f0212e90b8088cc3d1154281ee61b8af5f15bebea4291895c003d`, WiFi W00/W01 and GENET G00 provide the hardware comparator. WiFi W01 resets to ready in 54.210080 seconds, including a 14.469793-second firmware interval; both first cold TCP attempts fail, while delivered W00 packets show substantial runtime queue-to-publication delay. Recognize exact already-queued DATA and retain strictly advancing same-request op8 admission through existing bounded arbitration and owed-signal waits, without reporting unfinished admission as material ingress. Batch firmware transaction borrowing and validated volatile payload stores while preserving every baseline restore, sealed byte, overlay, replay, physical command and recovery boundary. Under this task and `m26e-console-network-service-isolation`, extend only the separately versioned GENET observational diagnostic to v5: retain one bounded maximum-slice receipt with stage timestamps and optional exact TCP header identity, because G00's 193.070 requests/s meets throughput but 7.502 ms p95 includes approximately 39 ms before-ACK stalls whose physical cause is unproven. Preserve MCS reservations, priorities, refills, active SC/Reply ownership, physical ring semantics, QEMU behavior and all host workloads. Focused invariant checks and exact compilation qualify the candidate; fresh dual-transport Pi boot, raw TCP, scripts, pressure, operator and repeatability evidence must establish any improvement. The cold WiFi loss is not claimed repaired by these source changes.
  - Pi exact-4c retained DPC peer-wait follow-up — both source-Service exits preserve retained intake and CheckGrant while using the existing exact steady-lease peer wait for an outstanding healthy CYW43 DPC child. Require the existing no-Reply/no-in-flight-grant boundary, no foreground transaction or watermark fault, exact current event/child identity and the existing AwaitExactPeer classification/final condition-before-block checks. Childless, RXBOUND, queue-capacity, recovery and ambiguous states retain Yield; cold-successor bounds and all physical authority remain unchanged. The source proves a redundant refill-forfeiting boundary in this exact waiting state; its frequency and contribution to WiFi performance are unproven until a fresh boot passes the separately repaired bootstrap anchor collision. No firmware/SDIO protocol, deadline, ring, owner, MCS numeric or QEMU path changes.
  - Pi exact-eed4 causal performance correction — baseline image `15695c455ad673c9a0d23ea1d4299d641f7e9a002b037ad21d9ac812132aebe0` measures WiFi 10.888 req/s with 108.686 ms terminal p95 and GENET 90.870 req/s with 10.214 ms p95. The suspended PCIe timer PC resolves to Yield entry, whose selected-kernel minimum-budget check runs before nonfaulting retirement. Keep the existing completed-IRQ blocking receive and sole command Reply; remove only that post-IRQ Yield and declare four PCIe refills for the two 5 ms fragments, active head and enable/call carry-in, preserving the 400/10000 us budget/period, priority and terminal timeout policy. For exact copied CYW43 service, choose already retained egress, admitted output, exact disconnect/publication or passive current-generation copied RX ahead of empty lower probes; retain one separately charged unit, child-signal observation, response bounds, operator rotation and every physical admission/recovery gate. Productive child input/control still executes the retained three-phase service cycle with current hardware time; idle probes retain observation, ingress and ServiceTick. Direct QEMU/GENET paths and physical driver authority remain unchanged. Focused pure invariants, generated profile checks, exact-profile builds and the root-MCS QEMU canary qualify the candidate only; fresh image-bound WiFi/GENET raw TCP, representative scripts, medium/high REST and physical operator stress remain necessary, followed by two qualifying reboots per transport. See DRIVERS and ROLES_AND_SCHEDULING for the current contract and `~/cohesix/26e.md` for exact per-boot evidence and falsified hypotheses.
  - Pi exact-132a admission follow-up — GENET retains an 8.899 ms mean command-publication gap despite zero timer rejections; a completed response may retire its token and admit one fresh durable-publication recheck through the full ordinary rotor, preserving the clock, causal-wait count, 64-quantum cap, SC and every lane/operator/recovery fence. A failed recheck cannot rearm; an executed empty turn consumes one quantum. CYW43 association admission and its runtime body now use one fresh timer sample, with the prelude included in active Network accounting, so a due retry cannot appear only after the outer lease decision. Keep the typed inactive-outer Join rejection and all physical deadlines, protocols and recovery unchanged. Focused bounds/identity/time-order tests and the QEMU root-MCS canary qualify source; fresh Pi evidence must establish performance and reliability.
  - Pi exact-132a retained cold-service and receive evidence follow-up — both retained source-Service exits may reach the existing cold command body only after the existing exact terminal helper proves an immutable cold parent with remaining 64-successor allowance, no Reply, no in-flight grant and no watermark fault. Retire the gate without falling through to its inactive Yield; all failed guards retain that boundary. Add only bounded root-dequeue timing from the existing first-DATA timestamp tuple and one slow TCP header tuple, with missing, saturated and invalid samples kept separate. Firmware timing improvement and the WiFi receive bottleneck remain unproven until the next exact Pi image; change no physical protocol, deadline, recovery, ABI, owner or MCS reservation.
  - crates/pi4-driver-abi/** + tools/coh-rtc/src/** — add/version the scheduler-specific runtime-init fields and generated cap/slot inventory required for active SCs, per-runtime command Reply objects, standard/timeout fault caps sharing root-fault's single receive endpoint and Reply, command endpoints, IRQ/DPC notifications, one-way completion wakes, containment anchors, the generated driver-supervisor-to-root-fault release signal, and at most one in-flight root command per runtime without changing device command/completion ring semantics. Root command caps are `Write + GrantReply` with no `Grant`; driver receive and IRQ-wait caps are Read-only; software signal/completion caps are Write-only; SCs bind only to driver TCBs; and command, IRQ, completion, fault, and release badge domains are disjoint.
  - apps/root-task/src/hal/driver_task.rs + apps/root-task/src/sel4/** — replace the MCS `wfe`/unsupported trampoline with generated construction and dispatch. Every linked runtime gets one admitted active SC on its generated core; synchronous root commands use the active server's MCS `Recv` with the exact supervisor-owned command Reply object and reply exactly once, while existing one-way bootstrap/background turns remain nonblocking ring/notification operations with no Reply or donated SC.
  - apps/pi4-driver-runtime/** — implement the MCS receive/Reply loop for serial, USB, HDMI, GENET, CYW43, SDIO, and PCIe images; keep the active SC bound to the TCB rather than a notification, make IRQ/DPC work notification-woken on that same admitted SC, validate runtime-init identity/cap rights, and remove `RuntimeWake::None`/unsupported MCS paths. No runtime receives SchedControl or ticket material.
  - apps/root-task/src/event/** + apps/root-task/src/local_seat.rs — on the physical Pi profile with required local-seat, finish the retained PCIe-to-USB controller owner-publication chain through ordinary one-operation EventPump turns before the deferred CYW43/SDIO supervisor can take its first driver turn. USB keyboard command admission remains an independent gate rather than a Wi-Fi prerequisite; QEMU VirtIO scheduling is unchanged.
  - apps/root-task/src/kernel.rs + apps/root-task/src/hal/driver_task.rs — make `root-driver-supervisor` the sole driver-containment and command-Reply recovery owner. It retains least-authority origin/recovery/TCB caps and per-runtime in-flight command state. If a driver faults during `Call`, root-fault only publishes the separate fault record, wakes the driver supervisor, and waits with its sole fault Reply still serialized. The supervisor closes command admission, uses the retained command Reply cap to return exactly one typed failure to the blocked caller, verifies that command association is clear, suspends the driver TCB to clear the independent fault Reply association, verifies both associations are clear, revokes the old runtime generation, signals root-fault's exact generated release badge, and only then permits reconstruction. The normal driver and recovery paths are mutually exclusive, so neither Reply object can be reused or answered twice.
  - CYW43/SDIO behavioral guard — freeze ownership, register/wire ordering, DPC/foreground fairness, deadlines, virtual-counter timing, retry ceilings, pair-restart cuts, completion-ring layout, IRQ ack/mask rules, and error classification. Compare generated constants and normalized state-machine traces against the accepted classic artifact; any semantic delta is a blocker rather than an MCS adaptation.
  - scripts/cohesix-build-run.sh + scripts/pi4-image-build.sh + evidence identity — build a new deterministic MCS `cohesix-driver-runtimes.cpio`, record every component hash plus the immutable classic comparator hash, and bind the new archive to exact QEMU/Pi image identity. Do not merge the Worker archive or reclassify historical/current CYW43 evidence.
  - docs/HARDWARE_BRINGUP.md + docs/TEST_PLAN.md + docs/audit/M26D_MCS_DECISION.md — document the MCS driver command/Reply ownership, behavior-freeze boundary, new artifact identity, and separate exact-image coexistence gate.
  - bounded USB/Wi-Fi diagnostic correction — fix the Pi-only USB startup table so `device-addressed` is Gate 6 under a host-tested ordered gate contract; render invalid USB queue companions as `unknown`; keep the 48-byte non-network cadence slot while versioning it to report separate previous-entry `gap` and in-episode `run`; split compact causal `wifi diag` from verbose `wifi dump-state`; preflight the causal batch to eight body lines/2,048 bytes; retain exact CYW43/SDIO episode, child timing, grant, wake, and fault identity without adding device work or scheduling authority; and update normalization plus guarded live command sequencing. This is diagnostic/evidence correctness under the active coexistence task, not a CYW43 transport repair or physical acceptance claim.
  - Pi retained-runtime refill correction — exact Pi image `4db449bbc605728eef70d4c1671d1a84344921caf30f3042300f10906c76eaab` proves USB request 2 completing individually bounded roughly 100 us DMA slices until the installed terminal timeout endpoint converts current-refill exhaustion into terminal containment at Gate 5; HDMI request 3 and SDIO request 2 retain the corresponding command-entered/no-terminal shape. Select `NaturalPostpone` only for the Pi serial, USB, HDMI, CYW43, and SDIO active runtimes so their bounded resumable physical lifetimes cross ordinary MCS refill boundaries without a false driver fault. Exact follow-up image `136aa611f22832498352332d3ac37efd2354eba87d354cf122d34ea540993fb8` proves that manifest selection alone is insufficient: the driver TCB constructor still installed timeout badge `0x26ee000c` unconditionally and reproduced the same USB containment. Make the constructor consume each generated driver's timeout policy, omit only a `NaturalPostpone` TCB timeout endpoint, and emit the selected policy plus installed/omitted state in the existing bounded MCS construction line. Keep their exact SC budgets, periods, deadlines, refill counts, priorities, cores, standard fault endpoints, generated timeout identities/resources, explicit device deadlines, command/Reply ownership, and protocol state machines unchanged. PCIe and dormant GENET retain their existing terminal timeout policy; QEMU manifests and the validated QEMU behavior remain unchanged. The next exact Pi boot must prove forward progress beyond all three recorded frontiers, absence of unexpected target faults, operator liveness, and bounded cadence before this candidate can be promoted.
  - Pi local-operator cadence correction — exact image `3a44087b6ad2bfa5acd9bbaa8d95974671150de6d1589ebf70dd6afa572a7f7e` proves the constructor-policy correction: USB reaches Gate 10 with functional HID/parser/HDMI input, HDMI requests complete, no driver fault occurs, and serial/USB/HDMI remain lossless. The same boot also proves a common approximately 80 ms retained-runtime entry gap despite 10 ms generated periods; USB controller/enumeration/command startup takes 30.51 seconds, serial and HDMI feedback are correspondingly slow, and SDIO request 2 reaches `sdio-hw-entry` without first MMIO before the parent deadline. The physical preflight path had serialized Serial, LocalSeat, Dispatch, and Display across four root-control periods; terminal Wi-Fi quarantine additionally retained a hardware-free Network cursor. On the physical Pi path only, compose at most one complete four-phase preflight rotation or one complete post-quarantine local rotation before root-control's explicit cooperative yield, with hard caps of four and five existing one-operation polls respectively. Stop on reboot, containment, or return to the starting phase. The compiler-generated per-driver period gate remains the sole child-wake admission authority, so composition cannot wake one runtime twice inside its period. Keep active Network ownership, QEMU, non-MCS profiles, SC budgets/periods, Reply/fault behavior, device deadlines, USB/HDMI/CYW43/SDIO protocol logic, and generated contracts unchanged. The next exact Pi boot must materially reduce same-driver gaps and USB startup/command latency without drops, faults, or no-reply growth, retain HDMI completion, and determine whether SDIO advances beyond phase 157 before any device-specific repair is authorized.
  - Pi MCS pair-recovery command-cap identity correction — exact image `1199991dc6bc4da9f2f349251169f6326035b6f709c22ff2bda530a77d055ae6` restores USB Gate 10 and terminal HDMI receipts under conservative retained-wake admission, then isolates SDIO request 2 at phase 157 `sdio-hw-entry`: the sequence-last shared ring admits the first engine slice, but no later power-sequence phase, MMIO, or terminal appears despite repeated root replay turns. Source authority proves the recovery-only root cap was copied unbadged from the endpoint origin, while the MCS runtime accepts each retained endpoint continuation only with `driver_runtime_command_badge(task_key)`. Mint both ordinary and recovery MCS command caps through one helper with identical task-key badge and `Write + GrantReply` rights; retain the classic non-MCS recovery copy. Do not change the endpoint object, Reply cap, recovery ownership, pair ordering, SDIO/CYW43 protocol, MMIO, retries, deadlines, budgets/periods, USB/HDMI, or QEMU behavior. The next exact Pi boot must advance request 2 from phase 157 into the bounded Wi-Fi power sequence and either complete SDIO engine initialization or expose the first later physical terminal; absence of that continuation is a capability-path failure, not evidence for changing SDHCI registers.
  - Pi 256-Worker pair-restart and operator-throughput correction — exact source `f4fa54161bc959427eaeb805841fc8962c5c186a` and image `2e74eff228fea5fb2125856774d8e9d922ac81070d44221dc398526fe959bdb9` prove the 16-bit-CNode, 256-executable-Worker Pi profile sealing its exact 272/272 fault registry, USB reaching all ten gates with a valid linked-runtime queue and no drop/no-reply/recovery growth, and HDMI requests completing without a driver fault. That same Wi-Fi boot terminates at supervisor turn 103 in `replay-sdio-engine` with `aggregate-deadline-expired`: one Operator turn for every Driver turn spends the unchanged 3,000,000 us whole-attempt deadline before the finite physical pair-restart cursor can retire, while the earlier four-Driver-turn diagnostic cadence crossed this exact edge. Grant up to four consecutive Driver turns only while the exact `cyw43-cold-physical-lifetime` or `cyw43-pair-restart` cursor is active; retain an Operator reconciliation before every bounded burst and immediately discard any unused burst tail on complete or superseded state. Descriptor publication, firmware/control, association, EAPOL, DHCP, attached recovery, and steady service remain one Operator turn per Driver turn. Suppress only routine per-Worker successful fault-registration UART rows after each registration succeeds; the exact expected/registered seal, every service/driver/critical-root registration, and every missing/failed record remain mandatory, removing 36,180 bytes of redundant boot UART output in the observed 256-Worker boot without changing construction. Synchronize the authenticated serial root prompt after Queen attachment before issuing `reboot`, preventing a retained attach prompt from consuming the reboot command. Do not change the manifest, executable population, CNode size, capability authority, generated profile, MCS budget/period/deadline/refill/priority/core, device deadline, command/Reply/fault semantics, driver ownership, or QEMU scheduler behavior. Deterministic Pi- and QEMU-feature tests prove burst scoping, successor non-leakage, exact seal policy, and the serial command barrier; fresh exact-image Pi Wi-Fi, GENET, USB, HDMI, serial, and TCP evidence remains required before promotion.
  - Pi post-handoff network and display convergence correction — exact source `8492c379f7c8f8b9f8de27613c9879a3da554551` physically proves Wi-Fi failing before radio emission after CYW43 publishes high-bit child identity `0xeff090d9`, while the recovery fence scrubs the delegated SDIO ring before later diagnostics can distinguish coherent publication from a missed wake/final-prewait observation. Capture one immutable, passive stable-double-read of the delegated SDIO command/completion records inside the existing first-recovery cut before scrub; perform no wake, retry, consume, owner transition, or protocol action. The same exact source proves GENET receiving two DHCP frames and then freezing all hardware RX after `NetStack<GenetDriverTaskDevice>` hands its copied queue to the isolated console adapter. Preserve the existing sole GENET physical pre-poll lane at the wrapper after handoff in ordinary poll, budgeted poll, TCP flush, and console-response poll, charging the existing operation/frame/byte bounds. HDMI is functionally correct but cadence-bound: for aligned XRGB8888 only, pair two pixels through the existing 64-bit framebuffer writer so 16 clear rows preserve the prior eight-row worst-case store count, and unroll bounded forward/backward scroll copies without changing memmove semantics; RGB888, unaligned, and unknown formats retain the conservative path. Do not change any manifest, CNode, executable population, capability, driver owner, MCS timing/refill/priority/core, device deadline, IRQ/DPC rule, Reply/fault semantics, USB protocol, serial transport, CYW43 retry, or QEMU scheduler. A fresh exact Pi boot must classify the SDIO ring boundary, prove GENET ARP/ICMP/TCP/cohsh and scripts, materially improve HDMI first draw/scroll, and remeasure USB/serial without loss before any physical fix claim.
  - Pi MCS command-receive and active physical-rotation correction — selected seL4 MCS maps `seL4_Poll` to nonblocking Wait, which supplies no Reply object. A queued root `Call` consumed through that spelling can therefore leave the caller inactive without the compiler-declared reply association. Centralize the runtime nonblocking command receive: classic seL4 retains `seL4_Poll`, while MCS uses `seL4_NBRecv` with the runtime's sole generated Reply slot 6. Once either kernel has a retained Call, do not receive from the endpoint again: selected MCS would cancel the blocked caller when the associated Reply object is reused, while classic receive would replace its implicit reply state. Retained arbitration samples only the generated bound local notification in slot 3; a defensive blocking retained state waits only there. An ordinary synchronous multi-turn command instead preserves the Reply association and yields between its existing bounded service phases because its blocked caller cannot publish an endpoint continuation. Generation-bound continuation lanes remain one-way and reject a Reply-bearing form. This corrects the synchronous command path only; sequence-last one-way ring admission remains prior to the endpoint receive and the exact `80aab1322` passive CYW43 ring discriminator must still run before a causal Wi-Fi transport edit. Extend the existing physical-owner plus linked-serial local quantum to active GENET without changing its five-poll hard cap: stop on reboot, containment, any self-retained phase, or return to the starting phase, so one useful rotation may compose Network, bounded HDMI, serial, USB/local-seat, and Dispatch but can never repeat the NIC or a retained display/command action before Yield. On the physical Pi only, collapse exact duplicate bootstrap rows to the ownership-aware forced-log sink; non-Pi debug-console behavior is retained. Do not change baud, queues, MCS timing/resources, driver periods, manifest, protocol, retry, device deadline, capability, ownership, QEMU scheduling, or generated contracts. Host and target tests prove the Reply selection and retained-association preservation, five-turn bound, active-GENET single-NIC rule, quarantine/display-debt rule, and Pi single-sink selector; fresh exact-image Pi evidence must still prove GENET/USB/serial/HDMI cadence and no loss.
  - Pi retained-recovery, console-network parity, and contention correction — exact source `c4c784bae3e777ff6a3eac9c2a3e6c41ecd62564` and its bound WiFi/GENET boots prove three independent frontiers. First, a linked serial RX completion with activity can consume its grant before rearming the combined mini-UART IRQ; admitting TX immediately then emits exactly one eight-byte FIFO prefix and strands both directions. Retain one subsequent empty RX owner turn before the next TX chunk without changing baud, FIFO width, queues, budget, timeout, or owner. Second, a linked CYW43 turn can discover `cyw43-canonical-parent-retirement-fenced` after its exact parent is issued; classify that as `cyw43-pair-recovery-signalled`, retain the immutable request, and enter the existing terminal-drain/pair-restart path without replay. Before the existing first-recovery scrub, passively stable-double-read the exact shared SDIO completion and its version-3 116-byte fault frame; accept only an aligned in-ring cursor, Fault completion, exact length and containment disposition, matching magic/version/result, then retain all 29 words for bounded SDHCI/DMA4 diagnostic rows. This observation performs no wake, consume, retry, reset, or owner transition. Third, post-DHCP 26e gives the isolated console child sole TCP/IP ownership, so the old root self-test is inactive: implement a bounded generation-tagged peer-assisted test at the adapter, require an exact child response drain plus physical-NIC TX completion (or direct-VirtIO drain), RX/TCP progress, authenticated identity, and listener readiness, and enable the child's native ICMPv4 echo response without adding a second socket or root TCP/IP path. Emit bounded isolated turn/queue/drain/backpressure counters through `netstats`. Suppress only routine WiFi, GENET, and HDMI call tracing in steady/nonblocking/prompt-slice/retained modes; retain init, non-acceptance, fault, budget-exhaustion, and non-quiet timeout evidence. The bound USB boot is already Gate 10 clean, and HDMI remains functionally correct but cadence-bound, so do not change XHCI/HID/display protocol, framebuffer batch size, MCS budget, or allocation without a fresh physical discriminator. Fresh exact-image WiFi and GENET boots must prove complete serial responses, pair recovery or expose exact pre-scrub DMA4 cause, ICMP/nettest/TCP/cohsh, sustained oversized-input recovery, and HDMI/USB responsiveness before any target-fix or acceptance claim.
  - Pi HDMI damage-compositor and admitted burst correction — the operator-authorized follow-up to the preceding physical discriminator addresses the proven 1920x1080 XRGB8888 display cost rather than treating completion as performance closure. Replace physical-framebuffer-as-terminal-state with a compact child-private cell plane, logical row ring, dirty-cell/row tracking, and write-only glyph-band rasterization inside the existing isolated HDMI runtime. Retain a parser cursor across turns so each immutable input byte is consumed at most once and no later byte is admitted until the current byte's bounded clear, scroll, tab, or other multi-cell effect is completely staged; a tab advances to the next eight-column stop by exactly 1 through 8 cells, including 8 when already aligned. Coalesce final visible state, never read live scanout during scroll, and preserve exact terminal cursor/CSI behavior plus the existing RGB888, alignment, geometry, bounds, and first-takeover behavior. Retain one physical framebuffer owner and the existing pointer-free command/Reply generation; a command completes only after every parser/plane cursor is retired and every dirty band for its exact generation is visible. Bind every parser, wide-plane, clear, and raster turn to the shared exact 1,280-operation, 4,096-byte-envelope, 80-display-row HAL grant, reject any narrower or broader grant before state or scanout mutation, and retain the same cursor rather than replaying a prefix when a turn reaches its bound. The existing pointer-free frame transport still admits at most 1,536 payload bytes, so 4,096 is a parser/grant ceiling for pure bound proof, not a newly accepted single command or widened ABI. Raise only the generated Pi HDMI reservation from 400 us to a statically admitted 2,000 us per unchanged 10,000 us period, using 1,800 us only as the candidate WCET input to static response analysis; neither value is hardware timing evidence. Keep core 2, priority, refill, deadline, timeout policy, PCIe allocation, and the passive GPU executor unchanged. Core-2 admitted demand must remain at or below the generated 9,000 us usable bound with at least the mandatory 1,000 us reserve. Do not add BCM DMA, mailbox/HVS authority, a framebuffer alias, cacheable live-scanout mapping, fallback owner, unbounded clear, or QEMU scheduling change in this correction. Focused host tests must prove resumable row-ring/parser semantics, exact 1-through-8 tab expansion, no scanout reads, no duplicated prefix or scroll effect, bounded wide clear and raster progress, exact final raster state, invalid geometry failure, exact grant enforcement, and unchanged terminal grammar. Fresh exact-image Pi evidence must time first takeover, printable text, one-row and ten-row scroll, prove bounded serial/USB liveness under display pressure, and is required before any polished-performance or 60 Hz claim; cache-cleaned double buffering and vblank page flipping remain a separately governed follow-up after explicit alias/coherency and display-authority proof.
  - Pi bounded serial, SDIO/CYW43, and GENET transport correction — reuse the serial runtime's existing four shared pages as two exact two-page, 8,128-byte, generation-bound SPSC rings, one root-to-runtime and one runtime-to-root. Map only those CPU-to-CPU ring pages as identically cacheable, execute-never, coherent Normal memory in root and child so AArch64 atomic acquire/release cursors never operate on seL4's Device-nGnRnE `Page_Uncached` mapping; physical DMA, MMIO, and every other driver payload keep their existing uncached attributes. Publish and consume commit-paired cursors with final post-commit state/epoch rechecks so empty/full boundary races cannot lose a wake; poison invalid or discontinuous cursors; and retain a pending combined mini-UART handler acknowledgement across software continuations after root drains a full RX ring. Root observes the rings through existing cooperative EventPump polling, so this change makes no unsupported direct interrupt-wake claim and changes no baud, UART owner, FIFO, IRQ, budget, period, or timeout policy. At the SDIO/CYW43 shared/private boundary, replace byte-at-a-time movement only with an alignment-safe bounded prefix/`u64`-body/tail copy between the existing shared payload and the existing private uncached DMA4 bounce region. Validate both complete ranges before copying and retain the exact pre-scrub DMA4 discriminator, sole owners, register ordering, retries, pair-restart cuts, and device/aggregate deadlines. For Pi GENET only, admit the exact first-line DTS interrupt as seL4 IRQ 189 with badge 1024 for default queue 16. The child masks and services that owned source through a bounded DPC, drains at most 16 frames and 24,576 bytes per quantum into a fixed 16-frame private queue, preserves bounded control/data fairness, and performs device-store/unmask readback plus a final source/ring recheck before handler acknowledgement; remaining work retains one durable continuation. QEMU keeps its exact three-entry driver-runtime IRQ topology with no GENET IRQ, and GENET keeps `1000 us / 10000 us`, core 3, owner, descriptor DMA, deadline, and terminal timeout policy. Do not generate direct GENET-to-console rings in this correction: no reciprocal link authority/cacheable shared-frame topology safely bridges the pre-DHCP GENET and post-DHCP console lifetimes, their revoke generations are independent, and a nine-page proposal exceeds the current eight-page generated export helper. That redesign requires one atomic authority, cacheability, bootstrap, and containment contract rather than a shortcut around root mediation.
  - Pi early HDMI pre-cutover progress restoration — exact a1766887f/image1518e7bb completes two WiFi and two GENET evidence boots before source changes; the operator confirms the two-line startup tile but requires a status update every five seconds before serial cutover. Preserve child-exclusive framebuffer authority and the existing static admission tile. At quiescent bootstrap page/driver boundaries, then separate pre-release serial-cutover turns with physical input/response priority, root may submit one canonical empty HDMI frame every five elapsed seconds through the existing command/Reply transport. The display child independently checks exported CNTVCT elapsed time and rewrites only the fixed second-row span as bounded elapsed startup status, coalescing missed periods. Invalid geometry stores nothing, failure disables optional root polls, and first ordinary-frame admission permanently stops the tile refresh before retained clear/terminal takeover. Do not add a timer owner, framebuffer alias, opcode, payload, scheduling change, prompt or ready claim. Review all host/Python/benchmark consumers, test clock arithmetic, exact raster bounds and takeover, compile exact profiles, and require fresh visible hardware cadence plus preserved input and network evidence. This supersedes the preceding static-only restriction within this active restoration task; network performance and qualifying repeatability remain open.
  - Pi 55fc diagnostic delivery and two-second progress follow-up — unchanged source `55fc7125eb82cea3b0c43efdaef8fe565c7eb8fe` completes two WiFi and two GENET evidence boots before edits. GENET raw throughput 502.169/508.023 requests/s exceeds target, but p95 6.589/7.731 ms fails; WiFi raw 3.066/10.849 requests/s and p95 1067.466/89.212 ms fail, with repeated missing response terminals. W01 functional failure withholds dependent pressure. Physical `smp mcs` loses six session rows and its end marker because its synchronous body exceeds the 69-line ordinary backlog. Move all seven existing session rows to Pi `netstats`, preserving the complete 27-row detailed MCS batch in `smp mcs`, every existing queue bound and QEMU output. Reuse the bounded WiFi RX recorder for one exact latest ACK-only header and root-dequeue/copied-page/child-ingress receipts independent of missing DPC timing; do not label ingress acceptance TCP retirement. The operator confirms working keyboard/arrows and one initial counter update, then requests two-second updates: use that cadence at both existing safe root and child clock guards, preserving raster and takeover contracts. This supersedes only the preceding five-second display cadence. No MCS numerical, physical-driver, ABI, protocol, recovery or QEMU scheduling change is authorized by these receipts; fresh exact Pi evidence is required for definitive network fixes and performance acceptance.
  - Pi ec3b display-stall causal restoration — unchanged `ec3b81e669df6a540f6f24cc4ecc8998ca1766e7` completes the requested two WiFi and two GENET evidence boots before edits. G01 retains HDMI request58/completion57 for minutes and pending display work fences every later raw-session idle check; the missing consumer boundary remains unproven. Preserve initial endpoint/notification selection and the early-binding guard. For a generic one-way runtime with no physical notification source, consume only an already durable exact DROW-to-DROA acknowledgement before blocking, retaining the existing one-action-per-slice identity and all physical-source arbitration. Explicit USB diagnostics stable-read fresh child progress and pending DROW/DROA state alongside root command, completion, issued edge and notification binding; absent records are unknown, never recovery authority. The repeated3.7second early PCIe preparation gap also requires bounded display checkpoints within existing flushed HAL waits: preserve every settle iteration, use the existing two-second CNTVCT guard and child-only tile, and stop at serial cutover. Test exact ACK identity/retirement and physical-source exclusions, preserved waits and maximum-width diagnostic lines; compile exact Pi and protect QEMU with the narrow root-MCS canary. WiFi W01 failed TAIL and99.622second readiness remain open, as do both transports' performance targets. This task and discovery task `m26e-console-network-service-isolation` authorize only this bounded causal restoration, not changed MCS numerics or driver protocols.

  - Pi MCS notification-intake and mini-UART contract correction — exact source `092d192053818b649e511422998b201e700f121e`, image SHA-256 `69a7892e2d05af7332a5572661bf45ec6968a0bcc77f61726d174f7b64bf0828`, and its boot-paired WiFi/GENET evidence expose one shared runtime seam plus one serial-specific register defect. The WiFi boot reaches linked-serial cutover and emits only 16 bytes before losing console liveness; the GENET boot transmits DHCP Discovers while hundreds of checksum-valid, matching Offers reach the host-facing Pi link, but the child reports no hardware RX progress and never advances to Request. A TCB-bound notification may win the initial Reply-bearing MCS `seL4_NBRecv` as a zero-length, nonzero-badge result; discarding that badge leaves the physical handler unacknowledged across serial, GENET, SDIO, and CYW43. Preserve and validate the exact generated badge, service one bounded persistent owner quantum, then re-read the durable command on a later turn without consuming, replacing, or replaying its Reply association. For serial, retain the hardware-validated BCM2711 mini-UART IER assignment of RX bit 0 and TX-empty bit 1, and derive the exact zero-through-eight-byte write capacity from `MU_STAT[27:24]`; `MU_LSR` bit 5 proves only one admissible byte and cannot authorize an eight-byte cursor advance. An impossible status level consumes and writes zero, retains the pending handler, and fails closed. Keep the existing baud, rings, FIFO width, owner, caps, Reply/fault semantics, IRQ identity, MCS resources, device deadlines, USB/XHCI logic, HDMI compositor, SDIO/CYW43 protocol, GENET descriptors/registers, QEMU scheduling, manifest, and generated contracts unchanged. The matching host regressions prove badge preservation/routing, exact Reply-slot selection, IER numerics, capacity bounds, invalid-level cursor retention, and byte order across later wakes; fresh exact-image WiFi and GENET boots remain required to prove serial/USB cadence, GENET ingress/DHCP/TCP, and SDIO/CYW43 association rather than converting the source repair into hardware acceptance.
  - Pi serial durable-TX notification-lifetime correction — exact source `5d8d4ffa7b5bce4e922eb7e188cc101909199d10`, image SHA-256 `79f367bb390b0dd7b49816ff785a29a1f8be2fb6bf9cf8a4d9559f56d33ed049`, image ID `7d6ad6e42c910dd47bd196a4898bf769c27df7c28366a9c8d2f4a609019e4d16`, and its boot-paired WiFi evidence reach a complete four-core, 16-bit-CNode, 272-task MCS construction and linked serial takeover, then emit exactly 16 bytes—one root-doorbell FIFO fill plus one zero-badge prewait fill—before TX and RX stop. The SPSC transition had rejected the former retained-command direct-wait lifetime but still sent later TX-empty work through the combined endpoint receive. While the exact live TX ring has committed nonzero occupancy, block on generated local-notification slot 3, admit only the exact root, serial-IRQ, or coalesced badge, service one bounded FIFO quantum, and return to the outer `seL4_NBRecv` opportunity before re-reading durable occupancy; at zero, resume the ordinary combined blocking receive. A missing, poisoned, discontinuous, or over-capacity cursor poisons TX and disables TX-empty rather than polling, replaying, or selecting a fallback. Order takeover and steady IRQ completion as device writes, DSB, same-aperture IER/`MU_STAT` readback, DSB, then handler ACK; a readback or ACK failure retains evidence, fences TX, and becomes an exact TX-idle `FAULT_DEVICE_UNAVAILABLE`. Keep baud, FIFO, rings, sole UART owner, IRQ identity, Reply/fault objects, MCS numerics, USB/XHCI, HDMI, SDIO/CYW43, GENET, manifest/schema, generated contracts, QEMU scheduling, and benchmark interfaces unchanged. Host and target compile regressions prove only route, badge, cursor, readback, ordering, and containment contracts; fresh exact-image WiFi and GENET boots remain required to prove serial and USB operator liveness, CYW43 association, GENET DHCP/TCP/cohsh, HDMI cadence, and benchmark performance.
  - Pi source-polled serial rearm, SDIO host-config cadence, and GENET durable-RX correction — exact source `ed06c28e5970b7c511fc0d44a1915ac4e4e0f6ff`, image ID `83e880be9a387e17476d28be2b9e3e12c258cad33b9fe1a57ebf4a7affad7fb4`, image SHA-256 `6366924ffe02b6b2c2462773895c254c1b211370be30c7e14230d9f58e66ead0`, and its boot-paired WiFi/GENET evidence isolate three independent regressions. Both boots end after serial parses `help` and transmits exactly the first eight response bytes `Commands`; the USB keyboard remains clean and its later input is blocked only by the shared physical-response barrier. Make every source-polled/root-doorbell RX or TX turn establish and retire the combined IRQ handler-rearm obligation before waiting, re-enter one bounded owner turn when durable TX plus current `MU_STAT` capacity exists, and retain slot-3 blocking only while the FIFO is full. WiFi reaches the initial SDIO `HOST_CONFIG` child terminal `0x5104` under CYW43 parent `0x5310` before CMD0, firmware, radio, association, or DHCP; batch only deterministic containment and host-config transitions under exact 24/18-step bounds, stop at real DMA/reset/clock/time waits, preserve condition-before-deadline ordering and no replay, and retain the immutable first stage-9 subphase plus a controller/DMA snapshot captured before abort, W1C, reset, or clock mutation. A successful speculative host-config snapshot is discarded so only an actual first terminal can publish it. The GENET capture contains 96 Pi DHCP Discovers and 96 matching checksum-valid Offers, but zero Pi Requests and `genet_rx_hw=0`: the MCS IRQ/DPC port had removed the August 10 same-owner command check of the durable RDMA producer. Restore that check inside the existing RX command operation/frame/byte grant without creating an IRQ lifetime, poller, retry, second consumer, or shared DMA alias. Refine compact WiFi diagnosis only from a current result-bearing ring transaction correlated to the immutable nonzero parent sequence, matching nonzero physical epoch and child sequence, exact child completion/result, matching episode exit/result, and concrete causal fault. Early schema-v2 rows without a ring, unknown rings, and exact historical seven-field rings remain parseable evidence but cannot refine the blocker. Current USB queue/HID counters and HDMI completion/redraw health expose no independent protocol fault, so keep XHCI/HID and display mechanics unchanged. Do not change the manifest, 16-bit CNode, 256-Worker population, caps, Reply/fault semantics, MCS budgets/periods/deadlines/refills/priorities/cores, device timeouts, firmware, association, retry ceilings, network grammar, or QEMU scheduling. Host regressions and target compilation can reject this candidate but cannot establish physical recovery; fresh exact-image WiFi and GENET boots must prove complete serial/USB commands, SDIO host-config through firmware/Gate 8, DHCP, ARP/ICMP, authenticated `cohsh`, focused `.coh` scripts, HDMI polish, and benchmark cadence before any Pi or performance claim.
  - compatibility review — `apps/cohsh/**`, `apps/coh/**`, all `.coh` scripts, `apps/hive-gateway/**` and its REST surface, `tools/cohesix-py/**`, generated-profile consumers, and benchmark scripts were reviewed for the HDMI, serial, SDIO/CYW43, and GENET corrections. No console verb, command-line grammar, namespace, authentication/authority rule, REST request or response, `.coh` operation, benchmark workload, or report schema changes. `cohsh`, `coh`, scripts, Hive Gateway/REST, `tools/cohesix-py`, generated-profile consumers, and benchmark implementations therefore need no hand-authored change except the additive GENET `netstats` capture fixture recorded immediately below. The compact diagnostic's private schema-v2 `causal_progress ring` field now emits the completion result. Its normalizer keeps early schema-v2 rows without a ring, `ring=u`, the exact historical seven-field tuple, and the exact current eight-field tuple parseable without reinterpreting any form. Only a current eight-field result correlated with the immutable nonzero parent sequence, matching nonzero physical epoch and child sequence, exact Fault completion/result, matching bus-episode exit/result, and concrete causal fault can refine the containment blocker. `scripts/pi4_trace_normalize.py`, its fixtures/tests, and the owning driver/test documentation change atomically; this backward-compatible additive field does not require a schema bump. The earlier schema-v2 command split changed `scripts/pi4_serial_reboot.py`, `scripts/pi4_gate_proof.sh`, their tests, and console/docs fixtures atomically. Additive `scheduler_sdio` and exact pre-scrub SDIO rows remain bounded passive triage: wrappers retain them as ordinary payload and the normalizer grants them no Gate 7/8/DPC/network authority. Isolated `nettest` retains the existing command, admission ACK, canonical asynchronous result grammar, terminal status schema, 15-second bound, and already-supported `peer-assisted-pass`; native ICMP echo and additive `netstats: isolated_*` rows add no host API or workload field. The canonical serial helper remains peer-neutral. The SPSC and DMA copy contracts are private driver/HAL mechanics using already-declared Pi page inventories; the HDMI compositor changes selected Pi temporal values and private renderer mechanics; and the added GENET IRQ uses the existing generic IRQ array. `coh-rtc` validation/profile oracles and regenerated Pi projections must reflect those exact selected values, while downstream generated-profile consumers already iterate generic temporal/resource fields and need no parser or schema change. Canonical QEMU outputs must retain their three-entry driver-runtime IRQ topology with no GENET IRQ and unchanged scheduling. Historical verbose Wi-Fi logs remain parseable; no new host, QEMU, construction, or static-admission result can satisfy Pi acceptance.
  - GENET route-discriminator compatibility clarification — use previously unallocated packed-completion bit 30 as the cumulative passive `command_rx_drain_seen` proof, set only after the admitted same-owner command lane successfully queues at least one durable frame and projected as `runtime_cmd_drain_seen=0|1` on the existing bounded `netstats: genet_rxq` row. Legacy packed results decode zero; the packed marker, ABI version, existing field layout, all work bounds, and IRQ/DPC/ACK/DMA authority remain unchanged. The captured `apps/cohsh/tests/tcp_cli_script.rs` netstats row is the sole hand-authored host fixture updated for this additive field. `coh`, `cohsh` implementation, Hive Gateway/REST, `.coh` scripts, `tools/cohesix-py`, generated-profile consumers, trace normalization, benchmark implementations/workloads, and report schemas require no change and derive no authority or acceptance from this field.
  - fail-closed evidence and operator-liveness clarification — a terminal linked-serial generation poison records one bounded Queen-log `SERIAL_TRANSPORT status=failed` row, retires only output targeting the failed owner and its physical-response barrier, preserves later serial RX and USB/local-seat parsing plus HDMI mirroring, and never restores root UART MMIO ownership. The current Wi-Fi normalizer additionally requires nonzero unsigned-32-bit publication, episode, physical, parent, child, command, completion, and ring-epoch identities; logical generation alone may be zero but must remain unsigned-32-bit. Every stage-9 containment subphase 1 through 12 and the unknown case has an independent literal blocker regression. These are additive private diagnostic and failure-containment contracts, not console response grammar, host API, network acceptance, or physical recovery evidence.
  - exact `2c64fe73ad54794f46249df72c731dcf25aa1cf7` and `786e52b3636667804a004e35e0abb37e55ace864` physical follow-up plus bounded convergence correction — both guarded-readback images boot both selected network lanes. A separately paced pyserial transaction proves the isolated UART command path; the boots retain clean ten-gate USB with no HID drop and bounded HDMI raster work, so no new serial, USB, or HDMI protocol change is authorized. WiFi fails before CMD0, firmware, radio, association, DHCP, or packet work: the first `HOST_CONFIG` terminal is `0x5104/0x09000005`, stage 9 subphase 5. The later exact image proves the immutable parent/child episode ages 362,893,456 counter ticks, or 6.720249 seconds at 54 MHz, after `HostConfigStart` arms the unchanged 220-millisecond deadline but before deterministic containment begins. Enter the existing bounded containment helper directly from `HostConfigStart` inside the already-admitted 1,500-microsecond SDIO owner SC, consume at most the two exact timer-only settles using exported `CNTVCT_EL0`, and prohibit the pre-containment outer-owner boundary. For the observed initial differing-clock, quiescent request, the first post-containment boundary is `HostConfigClock1Disable`; an equal-clock request resumes at `HostConfigControl`, and genuine DMA/reset/inhibit waits remain legal internal persistence boundaries. Preserve condition-before-outer-deadline ordering, with no SDHCI condition poll, card-command or DMA-transfer/descriptor issue, retry, timeout/budget extension, or new owner; an unarmed or invalid retained cursor fails through the existing typed path. GENET proves DHCP, bidirectional ICMP, raw TCP, authenticated `cohsh`, and three focused `.coh` scripts, but a strict five-unit isolated rotor revisits one class only about every 50 milliseconds. An exact retained authenticated response flush may select one useful response unit under the same one-op/two-frame/fixed-byte charge; ordinary service retains its rotor and no multi-unit burst is permitted because prior target evidence falsified composed lower work under the root MCS budget. Correct GENET reclaim telemetry by accumulating IRQ/DPC deltas until one eligible command completion consumes them, preserving them across a zero-reclaim poll or budget-exhausted completion without a reclaim field, and never reporting one twice. This changes values only, not the existing completion ABI or `netstats` grammar. The complete `coh`/`cohsh` host suite, Hive Gateway/REST, all `.coh` scripts, `tools/cohesix-py`, generated profile consumers, `scripts/m26e_qemu_pressure.sh`, `scripts/rest_perf_harness.py`, benchmark workloads, and report schemas were reviewed and require no change. No manifest, 16-bit CNode, 256-Worker population, capability, Reply/fault rule, MCS timing/refill/priority/core, physical-input priority, device deadline, retry ceiling, driver placement, network grammar, or QEMU scheduling value changes. Host tests and rebuilt Pi/QEMU artifacts can reject the candidate but cannot prove WiFi recovery or Pi performance; fresh exact-image WiFi and GENET boots remain mandatory.
  - Pi GENET direct-data-plane performance restoration — cite the same exact physical follow-up under this reopened driver/coexistence task and `m26e-console-network-service-isolation`. The roughly 200-millisecond SYN response and 50-millisecond service-class staircase are structural root packet-mediation costs, not a GENET line-rate limit. After the root stack has obtained the production DHCP lease and every root GENET command/RX/TX cursor is quiescent, perform one generation-bound, zero-payload `DGHO` transfer with an exact typed terminal and no fallback. Reuse the existing 32 GENET shared pages only after that cut: page 0 is an aligned sequence-last control page, pages 1 through 15 are GENET-to-console RX slots, and pages 16 through 31 are console-to-GENET TX slots. Map those pages cacheable Normal/XN into only the GENET and console children; classify the range CPU-only with no device-visible, DMA, or physical-address authority. Give each peer one send-only, fixed-slot, fixed-badge notification hint. Durable monotonic cursors, not notifications, carry work; both consumers perform a final recheck before sleeping, validate generation/sequence/length, and poison discontinuity or corruption. GENET remains the sole MMIO/DMA/IRQ owner and copies between its private DMA rings and the CPU link; console-network remains the sole smoltcp/TCP/auth owner. Root retains lifecycle, fault, and control-event supervision but performs no steady packet copy, poll, or GENET packet command after handoff. A failed handoff, peer fault, invalid cursor, stale generation, containment error, or descriptor drift fails closed and never revives root packet mediation. Version the private driver-init and console-network ABIs, consume representation padding as explicit zero-validated fields, and contain every external console frame mapping before its revoke anchor. Retain the Pi console-network child's bounded `3000 us / 10000 us` SC and priority/MCP 180/200 below priority-200 root-control so unauthenticated serial and local-seat input remain first; the direct data plane and bounded authenticated-response selection, not an unsafe static priority inversion, remove steady root packet mediation. Retain the existing budget, period, core, refill count, fault/Reply semantics, emergency/fault priorities, and every QEMU value. The compiler must re-prove the unchanged priority ordering, resulting response bounds, and exact 32-slot external-page CSpace increase. The current linked direct-GENET child footprint is 66 image pages rather than the common 60-page child; admit its six additional immutable executable frame caps only on the derived Pi GENET profile, producing service totals of 104 frames and 161 retained root slots without changing the one-MiB child untyped, data-plane or scheduling budgets, or any QEMU inventory. This is an architecture intended to remove the measured root staircase; neither host checks nor the rebuilt image may claim a 100-times improvement, line rate, QEMU parity, or Pi acceptance before a fresh exact-image GENET benchmark. `coh`, `cohsh`, Hive Gateway/REST, `.coh` scripts, `tools/cohesix-py`, generated-profile consumers, benchmark workloads, and report schemas retain their external contracts; build/package selection, generated temporal/resource projections, private ABIs, tests, and driver/performance documentation change atomically.
  - Pi exact-e046 post-boot convergence correction — exact source `e046a7eb470ae0dee9601749508e4248cce51c80`, image ID `33cc8a0e21de62a7738587b83b695daea41884b169f16c12dad8f23f39b82fcc`, and image SHA-256 `d650bbc29ff6bf28bea468d788c5a2cfcd3be8242173a91ac07f1f94c9ff5e4c` bind the WiFi boot beginning at line 23805 and GENET boot beginning at line 24816 of `/Users/lukasbower/pi4-serial-20260822-134045-cont.log`, plus `/Users/lukasbower/pi4-serial-20260828-e046-genet-G02-pyserial.log` and the boot-paired `/Users/lukasbower/tcpdump-wifi-20260828-072409.pcap`/`/Users/lukasbower/tcpdump-usb-eth-20260828-072409.pcap` captures. WiFi completes cold SDIO/CYW43, firmware, control, association, EAPOL, all eight Gate 8 subgates, and a captured DHCP DORA plus following Pi ARP, but misses `CONSOLE_NETWORK_HANDOFF phase=dhcp-bound` and reaches `service-readiness-deadline` quarantine before the child listener can become ready. Make exact DHCP/address truth expose a side-effect-free pending predicate, then select one exclusive `ConsoleHandoff` root-control turn before readiness evaluation: it alone borrows HAL, finalizes and resumes the already registered child, yields, and leaves child Ready consumption to a later Network turn. Recovery/canonical-owner work still preempts handoff, an error retains the existing failed state, and no root-owned TCP fallback, deadline renewal, new retry, or mixed CYW43/HAL turn is admitted. The same boots show roughly 8,565 retained WiFi turns and approximately 171 seconds of bootstrap latency. For only the retained CYW43/SDIO exact-grant lanes, fuse at most three pure `CheckWake`/`CheckGrant`/condition-before-sleep bookkeeping states inside one admission turn: `Service` is a hard stop before any grant read, `Empty` permits exactly one recheck, `Inactive` fails closed without a recheck, and `Ready` must revalidate and ACK the exact immutable grant before returning authority for exactly one existing bounded physical quantum. ACK failure restores the complete pre-grant gate and performs zero device I/O. This removes scheduler edges between pure local states only; it changes no physical-operation/postphysical boundary, owner, grant cardinality, device deadline, retry, fault/Reply rule, MCS budget/period/refill/priority/core, manifest, CNode, Worker population, 54 MHz timer truth, or QEMU behavior.
  - Pi direct-GENET causal-observation correction — the same exact wired boots prove DHCP and direct cutover but then freeze at two RX/two TX packets with zero direct ingress, ICMP reply, or port-31337 reachability. Extend only the formerly reserved portion of direct-link control page 0 with an optional aligned 192-byte diagnostic-v2 record at bytes `[320,512)`, committing its publication sequence last at record offset 184. Version 2 assigns record offset 108 to cumulative `dpc_level_adoptions`, the number of badge-zero or peer-turn joins of durable physical work to the same sole-owner direct IRQ episode; all other reserved fields retain zero validation. GENET is the sole writer; root accepts only a stable exact-generation record. One operator `netstats` may issue one exact idempotent generation-bound DGHO replay and reports the pre-replay plus pre-idle-service snapshots as ten ordered `genet_direct*` rows. This is a causal probe: waking the owner may let its normal post-command idle path drain durable RX, so it is neither passive telemetry nor performance/acceptance evidence and cannot form a recurring poll, fallback, retry, IRQ-ack, packet-service, or recovery path. Bytes `[512,4096)` remain reserved. ABI/layout, stable/torn/stale/wrong-generation, maximum-width rendering, host fixture, and trace-normalizer regressions change atomically. The complete `coh`/`cohsh` implementations, `coh-status`, Hive Gateway/REST, SwarmUI, GPU bridge, host-ticket agent, sidecar and sidecar bus, CAS tool, every `.coh` script, `tools/cohesix-py`, generated-profile consumers, build/manifest contracts, benchmark workloads, and report schemas were reviewed and require no hand-authored change beyond the focused `cohsh` capture fixture and Pi trace normalizer/tests. Source tests, QEMU packaging, Pi staging, or a rebuilt image may reject this candidate but cannot establish WiFi recovery, GENET packet correctness or performance, QEMU parity, or Pi acceptance; a fresh exact-image Pi boot and benchmark remain mandatory.
  - Pi exact-5a post-handoff convergence correction — exact source `5a8917b09d7f2bda2c5fbe18a08340e0fbae5d58`, image ID `ce2dbbc0ed8b4c613caec554ce729815f090e015a82b94e0b16dec8ea74d6d71`, and image SHA-256 `4d64fb29a38e58103d3d1d80b8a2718ac39bf85d93384f0a12b390aa9431b230` bind the WiFi and GENET boots in `/Users/lukasbower/pi4-serial-20260822-134045-cont.log`, the guarded GENET diagnostic in `/Users/lukasbower/pi4-serial-20260828-5a8917-genet-live-diagnostics.log`, and boot-paired `20260828-093745` WiFi/USB captures. WiFi completes cold SDIO/CYW43, firmware, association, EAPOL, Gate 8, and DHCP, then runs the isolated child for 518 turns at child generation 1 while its projected device counters retain generation 0. Seed the isolated adapter from the complete device-owned snapshot before moving the NIC, project the live CYW43 generation only for the exact WiFi contract, and use the same projection for every refresh while preserving child-owned protocol counters. A DHCP-producing NetworkControl turn may authorize one exclusive handoff only when it began strictly before the original Gate 8 deadline and the exact committed generation remains operational; recovery, raw DHCP truth alone, proof drift, an at-deadline or late start, or missing/zero/inactive/non-admitted generated authority cannot select the handoff. Revalidate immediately before and after activation, then start the separately derived child-plus-root Ready window from the post-activation clock sample; every invalid phase, generation, authority, or clock transition fails closed without an intervening child poll, retry, fallback, deadline renewal, or budget change. GENET still completes DORA through the root-polled legacy path but stalls after DGHO with no ARP/ICMP/TCP progress; delegate `refresh_direct_genet_diagnostics` through the selected GENET wrapper only so the already-declared ten causal rows can distinguish IRQ delivery, owner drain, peer publication, and child consumption on the next physical boot. `OK NETTEST detail=started run_generation=<n>` remains command admission only; the same-generation terminal `netstats` verdict is authoritative. Isolated physical `tcp_ready` now additionally requires current-generation accept/auth proof, the gate wrapper waits through the fixed terminal window and accepts only the exact admitted successful generation, and REST benchmark preflight accepts only terminal `OK AUTH`. Both canonical Pi diagnostic helpers bracket connectivity work with two `smp activity` samples so the second yields target-owned counter deltas instead of another unusable first sample. The serial helper also validates a clean canonical identity sidecar before opening the UART and admits the boot only after its exact full sealed marker, preventing stale or wrong-image diagnostics from being attributed to the current candidate. Identity-v2 canonicalizes equivalent image-path spellings to the resolved staged path, while the benchmark validator runs the canonical verifier against the original exact files and rechecks both bytes and the image's recorded device/inode/size/mtime/ctime after validation. The complete `coh`, `cohsh`, `coh-status`, Hive Gateway/REST, SwarmUI, GPU bridge, host-ticket agent, sidecar/sidecar bus, CAS tool, all `.coh` scripts, `tools/cohesix-py`, generated profile consumers/contracts, trace normalizer, benchmark workloads, and report schemas were reviewed; only `scripts/pi4_gate_proof.sh`, `scripts/pi4_serial_reboot.py`, `scripts/pi4_image_identity.py`, and `scripts/rest_perf_harness.py` require the bounded evidence-truth changes just described, with no generated contract or report-schema change. No manifest, 16-bit CNode, 256-Worker population, device owner, capability, MCS budget/period/deadline/refill/priority/core, Reply/fault rule, retry ceiling, hardware configuration, network grammar, or QEMU scheduling value changes. Host tests, QEMU packaging, Pi staging, or a rebuilt image can reject the candidate but cannot prove WiFi, GENET TCP, `cohsh`, performance, or Pi acceptance; those require fresh exact-image boots and benchmarks.
  - Pi exact-24e handoff, cutover, and physical-operator performance correction — exact source `24e1c1c7778a3dc7ad8460c9ef644992814e41a5`, image ID `33298abaa8751693f6fcc5c05655d5837a32a9c2c710dc64907a4a61cab03061`, and image SHA-256 `f0c2aaa840b6d88948bf938837c5ae6ed538b37862c937a59f05ab2c5e0965d7` bind the two boots in `/Users/lukasbower/pi4-serial-20260822-134045-cont.log`, the guarded wired snapshot in `/Users/lukasbower/pi4-serial-20260828-24e-genet-live-diagnostics.log`, and boot-paired `20260828-125527` WiFi/USB captures. WiFi completes association, EAPOL, Gate 8, and DORA, but root tests the child-Ready deadline before consuming an already durable publication. The child timestamp is absolute CNTVCT milliseconds, so root must sample that same domain immediately before and after resume, require identical nonzero generated/runtime counter frequency and a nondecreasing cursor, retain the pre-resume sample as the inclusive publication lower bound, and derive the exclusive deadline from the post-resume sample plus the generated 15 ms response bound. This admits Ready published between resume and root return. At or after the deadline permit exactly one child-publication-only shared-page observation that performs no NIC work, policy advance, retry, wake, or composed Network unit; zero, pre-resume, at-boundary, late, missing, replayed, generation/identity/sequence-drifted, backwards, overflowed, or frequency-invalid evidence fails closed. The same boot performs 6,324 productive CYW43 supervisor Driver turns at an approximately 20 ms MCS-yield cadence. On the deferred physical WiFi supervisor only, replace the per-productive-subturn replenishment tax with one counter-guarded activation: alternate exactly one Operator and one Driver turn, check CNTVCT before every fresh logical unit, and stop at the generated root-control `budget_us - wcet_us` reserve or 64 productive units. The selected Pi values make the strict elapsed-time cut 250 us (`2,750 - 2,500`), leaving one complete declared 2,500 us WCET for the newly admitted logical unit plus yield/epilogue. After service readiness, an attached Network unit may retain the same window only when EventPump proves actual CYW43 activity, exactly one service-unit advance, an immediate Network successor, durable schedulable work, and no operator rotation, recovery, quarantine, or reboot. Invalid configuration/timing, wait, idle/no progress, backpressure, handoff, terminal, fault, or reboot yields and resets; invalid evidence admits only one legacy logical turn. This retains one physical operation and finalizer per Driver turn, removes the prior Driver-to-Driver restart burst, and changes no QEMU or generic scheduler path. GENET completes DORA and legacy ARP, then DGHO exposes asserted raw/active sources `0x00012000`, zero IRQ wakes/DPC turns, and RDMA producer/consumer divergence. Before READY, the sole GENET child must drain every durable legacy RX/TX frontier, mask and clear retained raw sources, perform the existing store barrier and unmask readback, and recheck raw/active sources plus RDMA/TDMA indices; any source retains QUIESCING for a later clean pass, and unmask failure faults closed. DGHO neither fabricates an IRQ lifetime nor acknowledges one. HDMI may render one bounded child-owned `Cohesix starting...` tile only after exact framebuffer resource and geometry admission; the first ordinary frame clears and replaces it. Ordinary scroll rotates the private row ring only after bounded old/new nonblank-column union damage is retained, clears only newly exposed rows, and reserves full redraw for takeover/recovery. USB HID decoding, arrow mapping/repeat, queues, and ownership remain unchanged because the bound boots prove lossless accepted/drained/echoed input; the apparent down-arrow hang is display redraw debt. The complete host-tool suite, `tools/cohesix-py`, generated profile consumers/contracts, `.coh` workloads, benchmark scripts, evidence records, and report schemas are reviewed and require no behavior or schema change. No manifest, CNode, Worker population, capability, owner, MCS budget/period/deadline/refill/priority/core, device deadline, retry ceiling, network grammar, or QEMU value changes. Source tests, target builds, QEMU packaging, and Pi staging may reject this candidate but cannot prove TCP, `cohsh`, `.coh`, visible HDMI polish, performance parity, repeatability, or Pi acceptance; all remain fresh exact-image hardware gates.
  - Pi exact-24e GENET finite-cutover and MCS latency candidate — the same exact wired failure oracle proves PHY/MAC, legacy DMA, DHCP, and ARP before the old quiet-wire DGHO fence: raw/active source `0x00012000`, RDMA producer/consumer `27/2`, and zero IRQ wakes/DPC turns isolate the ownership transition rather than link configuration. Replace quiet-wire retry with one generation-bound finite state machine: mask the exact source; stop MAC RX with readback; wait 10 ms in generated CNTVCT time; clear only RDMA `DMA_EN` while retaining the default-ring enable/configuration; require DMA status bit 0 within 5 ms; snapshot a producer no more than 32 descriptors ahead; drain only that frozen legacy frontier and retained handler/TX state; publish direct ownership while ingress remains stopped; resume RDMA, MAC RX, then the source. A queued exact seL4 IRQ after READY belongs to the same sole owner and is direct-epoch work. Status timeout, frozen-producer or cursor movement, generation/token drift, ACK failure, or stop/unmask/readback failure stops MAC RX/TX plus RDMA/TDMA, masks the source, poisons the direct link, signals the peer, and raises the standard terminal fault; no root packet fallback is admitted. Move only Pi `bcmgenet-v5`/`driver-genet` to core 1 and raise its active SC from `1,000` to `3,000 us / 10,000 us`, retaining priority 160, two refills, 800 us WCET, terminal timeout, IRQ/DMA ownership, 16-frame material quantum, and all WiFi values. The compiler must derive a 3,400 us GENET response, core-1 demand `6,250/9,000 us`, core-3 demand `8,000/9,000 us`, and the LoRA executor's reduced 7,400 us response. Update manifest/profile, gate-proof, trace-normalizer, scheduling, and adverse-order regressions atomically. The complete `coh`/`cohsh`, Hive Gateway/REST, every `.coh` workload, `tools/cohesix-py`, benchmark implementation/workload/report schema, console ABI, Worker/CNode population, QEMU values, and CYW43/SDIO scheduling were reviewed and require no behavior change; only the Pi affinity-aware proof/normalization expectations change. Static admission, source tests, QEMU packaging, and Pi staging cannot establish wired TCP, authenticated `cohsh`, `.coh`, consumed time, latency, throughput, August 10 parity, or Pi acceptance; all require a fresh exact-image GENET boot and canonical benchmark.
  - Pi exact-a7 MCS work-conserving WiFi/GENET and operator correction — source `a7dfa38b42` passed seven authenticated WiFi sessions and focused scripts without packet loss or queue/quarantine failures, but retained 118–167-ms SYN responses, 237–290-ms command responses and about 3.2 KiB/s output. USB conserved all 30 bytes internally while timely physical echo failed only in WiFi mode. The boot-paired 20260828-192427 captures and exact serial/image identities are retained in the historical evidence archive. The selected MCS kernel charges a Yield caller's complete remaining head refill, so the former unconditional postphysical `seL4_Yield` turns sub-millisecond generation-bound CYW43/SDIO phases into repeated 10 ms period edges. Intentionally supersede only that source-level Yield boundary: after one bounded operation/finalizer, re-enter the existing maximum-three pure-state exact-grant admission; a consumed old grant blocks with no ACK or I/O, a fresh immutable grant authorizes exactly one next operation, and missing work blocks on the already-declared local notification. Producer/root reconciliation, one grant/one operation, sole CYW43/SDIO owners, external-condition waits, deadlines, retry ceilings, Reply/fault rules, and every generated SC value remain mandatory; rejected, ambiguous, dual-admitted, Reply-bearing, unsupported, GENET, serial, HDMI, USB, PCIe, and QEMU routes cannot enter this lane. Retain the root's strict 250 us pre-admission reserve and 64-unit cap. An exact active/authenticated response cursor may retain only the next separately charged root Network turn after actual activity and one service-turn advance; containment, quarantine, recovery, reboot, stale or zero identity, no progress, or operator rotation stops it. The isolated child's ordinary `ObserveChild -> StageOutput -> Disconnect -> Ingress -> ServiceTick` rotor remains one unit per visit and never bursts. A partial local-seat line routes one bounded `Dispatch -> Display -> Serial` successor before Network with the exact CYW43 fence/parent retained; reboot ACK and physical response tails keep immediate Serial priority. For direct GENET, an admitted owner/peer turn or final pre-sleep cut may join a raw owned interrupt level or advanced DMA index to the existing sole-owner IRQ episode, then uses the existing mask/clear/drain/unmask/recheck/rearm sequence; no software state, badge zero alone, periodic poll, synthetic wake, fallback owner, or retry creates work. Advance the optional 192-byte causal record in place to diagnostic v2 and expose cumulative `dpc_level_adoptions` at record offset 108 without changing its size, commit offset, page topology, or authority. The complete `coh`/`cohsh` host suite, Hive Gateway/REST, all `.coh` scripts, `tools/cohesix-py`, generated-profile consumers/contracts, build/manifest paths, benchmark workloads, evidence records, and report schemas were reviewed; only the focused `cohsh`/trace fixtures for the additive GENET field require change. Source tests, QEMU packaging, Pi staging, or an image build can reject this candidate but cannot prove Pi recovery, latency, throughput, visible echo, August parity, or acceptance; fresh exact-image WiFi and GENET boots with same-boot captures remain mandatory.
  - Pi exact-069 MCS seam oracle and productive-micro-unit correction — source `0696803f55` passed WiFi Gate 8/DHCP, first-attempt scripts and raw64, but achieved only 7.196 requests/s at 159.456-ms p95. GENET passed DHCP, scripts and raw64 at 47.167 requests/s with 20.052-ms p95. Paired captures show near-baseline GENET ingress followed by approximately 20-ms response spacing, locating the remaining delay in root/console MCS composition. Full source/image bindings and serial/packet records remain in the historical evidence archive. Consume the qualified QEMU design as a temporal oracle, not target proof: direct GENET quiesces the child after an exact `Command`/`CommandBatch` publication and releases it only when a newly sequenced, exact-identity `StageOutput` control is applied; root may compose only the adapter's bounded response stage, never NIC work or a generic child burst. Copied WiFi may mint one non-transferable transient publication credit only when one Network poll advances exactly one material isolated-child unit with unchanged lifetime, response cursor, authenticated identity, command count, and service accounting. The next composer must cross the ordinary `Serial -> LocalSeat? -> Dispatch` operator cut, revalidate the complete snapshot again immediately before one Network poll, and revoke the credit on Yield, identity/cursor drift, operator work, passive admission, recovery, containment, quarantine, reboot, or handoff. Add only bounded Pi-private causal telemetry. The detailed 22-row batch is emitted only by explicit `smp mcs`: raw 54 MHz CNTVCT composer-quantum periods and run ticks are distinct from the exact one-block `CNTVCT -> svc -> CNTVCT` Yield hiatus, fixed progress/pending legends and one-hot Yield triggers retain causal state, and WiFi reserve rejection retains cut and reason. These measurements are composer and explicit-Yield observations, not kernel activation, refill, or consumed-time proof. Pi `netstats` retains five fast-path rows for WiFi per-cut transient-publication rejection, typed GENET response composition, and one-hot aggregate compact-Deferred classification, plus five isolated publication/control/drain seam ages when available. Every aggregate compact Deferred increments exactly one `genet_defer` counter; `compose_open` corresponds to typed `NotSealed`. The control watermark has no timestamp, so `stage-control-observe` intentionally combines child consumption with root observation. All aggregates saturate and count invalid/backwards evidence separately; the recorder never reads `SchedContext_Consumed`, emits a routine hot-path log, mints a wake/credit/retry, or influences admission. QEMU release builds retain their existing hot path and output without these accounting writes or rows. The full host-tool suite, `tools/cohesix-py`, generated contracts/profile consumers, `.coh` scripts, benchmark workloads/arithmetic, evidence records, and report schemas were reviewed and need no behavior change; additive target diagnostics are ignored by key-based parsers until explicitly consumed. Host tests, QEMU, compilation, packaging, image creation, or flashing can reject this candidate but cannot claim Pi correctness, latency, throughput, WiFi/GENET parity, or acceptance. A fresh exact-candidate dual-mode Pi run with boot-paired captures, first-attempt scripts, raw TCP, medium/high REST pressure, causal `netstats`, and pre/post-workload `smp mcs` remains mandatory.

Changes:
  - Pi complete MCS report restoration — ae6f1029b's four successful network cohorts retain CPU rows but expose an output-routing regression: the twenty lifetime MCS records were removed from SMP and were never emitted by NETSTATS. Restore every lifetime value to SMP: combine pending/stalled with quantum exits, combine the two Yield-cause rows, and combine budget totals/pending into version-2 records, giving seventeen lifetime rows. Compact the sixteen global u64 idle-fence counters into two version-2 eight-counter rows plus their existing header; all three remain in SMP. Preserve the existing 64-line TCP capture and 69-line physical body without larger queues or omitted evidence. Add six saturating valid-sample cause counts to the existing latest-session Yield row so raw-session scheduling delays can be separated from lifetime boot activity. Preserve all grammar terminals, runtime scheduling, budgets, profile identity and device ownership. The exact selected-Pi renderer must retain 64 SMP rows including every CPU row and end marker, maximum-width causes, all NETSTATS batches and both TCP/physical terminals. Complete host-tool, Python SDK and benchmark compatibility review: the compact records are explicitly versioned passive text evidence, session causes are additive, and no suite consumer parses the changed lifetime records; raw workloads/thresholds/report schemas remain unchanged. Record the failed 95763116b initial-SC enlargement as reverted: root-control reuses the fixed 7-bit initial kernel cap, and the compiler must retain that exact bound.
  - Pi exact-fabc four-boot ACK handoff repair — unchanged fabc657cbee920fd827e72ba218035892cfbc71a, image c9f5c4da0e22afefca3ed461b2ac481f3ede9a82a7287f478db0322ec4e57bba, completes two WiFi and two GENET cohorts before edits. WiFi reports 13.306/16.523 requests/s and 108.305/61.955 ms p95; GENET reports 390.690/315.902 requests/s and 5.666/8.921 ms p95. Both WiFi command/egress pair counts remain zero: immediate transport ACK egress precedes Session command creation and consumes the copied publication credit first. Retain the pinned smoltcp 10 ms ACK timer and Nagle-disabled Pi socket so a prompt response can carry the ACK without that separate handoff. Real two-stack tests must prove piggybacked prompt reply, bounded ACK on absent root reply, and small-response progress before the prior peer ACK. While direct GENET waits for root control, admit a due child-owned timer or peer-ready retained egress through both service-entry cuts with at most three existing units, preserving the command latch and blocked-TX peer wait. Preserve child unit bounds, device/IPC ownership, QEMU TCP policy, MCS settings, and benchmark workload. This is an unmeasured candidate until fresh exact-image Pi evidence; the four-boot matrix remains failed.
  - tools/coh-rtc/src/** + generated artifacts — add the console/network service image, object inventory, endpoint/notification badges, bounded packet/request frames, active MCS scheduling context, Reply/timeout records, fault, shutdown, and revoke policy. The V26-era child repair candidate binds the 59-page target ELF plus 32 stack pages, one IPC page, one init page, and four shared pages into an exact 97-frame inventory with 122 retained root slots, a 32-page stack at `0x72030000..0x72050000`, and `3000 us / 10000 us` active-SC budget with `2400 us` WCET and `m26e-qemu-console-peer-close-timewait-relisten-candidate-v13` provenance. QEMU V25 places it on core 2 with `2400 us` response; Pi retains core 0 with `7500 us` response. Schema 1.12 and console-network ABI v2 add one compiler-declared publication-ACK badge and a fifth root Write-only mint on the existing root-to-child notification; the child slot and the two Notification objects are unchanged. The derived QEMU fixed/maximum frame-slot totals are `2017/4057` and `2065/4249`; the Pi totals are `4065/8961` and `4113/9153`. Maximum admitted totals are `2577/6297` for QEMU and `4625/11201` for Pi. These values are not target-qualified until a fresh four-core GICv3 QEMU run passes raw session-1 AUTH, host close, same-boot raw session-2 AUTH, two sequential direct `cohsh` sessions, and standard/timeout injection without stack or budget failure.
  - crates/console-network-abi/** + apps/console-network-runtime/** — advance the console-network contract to ABI v2 while retaining the four fixed 4096-byte page layouts. Add required descriptor flag `INIT_FLAG_PUBLICATION_ACK`, root wake badge `WAKE_PUBLICATION_ACK = 64`, and Ready identity `console-network-service/v2`; compact 40-byte packet and 64-byte control/event scalar headers plus active-payload copies remain unchanged. Publish sequence-last by clearing commit, release-fencing, writing the validated header/body, release-fencing, then publishing the final commit before notification; validate scalar reserved header fields as zero and treat reserved page-tail bytes plus inactive payload suffixes as non-authoritative outside construction zeroing and containment scrub.
  - apps/console-network-runtime/src/kernel.rs — close at most one logical unit per active-MCS refill in retained-first order: completion publication, service-event publication, egress publication, service-poll continuation, new ingress, then new control. Commit or retain that unit and execute one `seL4_Yield` before any successor. Internal `PollService`, `IngestPacket`, and `ApplyControl` units may Poll after replenishment without publication credit because they mutate only private queues. Ready begins with no credit; only the distinct root Observe ACK grants one global publication credit, internal units preserve it, and exactly one `Publish*` consumes it before touching retained state or a shared page. Ordinary packet, control, shutdown, and revoke wakes never grant credit. A stable empty packet/control hint retires before requesting one separate service cycle, preventing a self-Poll loop while preserving later sequence-and-signal authority. Immediate revoke parks without publication; graceful shutdown retains its intent until one ACK credit can be consumed by `ShutdownComplete`, then parks.
  - apps/root-task/src/hal/console_network.rs + apps/root-task/src/net/isolated_console.rs — retain a root `publication_ack_owed` latch. `poll_turn` refuses another observation while owed and sets the latch only after every indicated event/egress record validates and copies. ObserveChild returns after event handling and egress retention both succeed, leaving the latch owed without signalling. A later QEMU Network visit selects the distinct `AcknowledgePublication` unit ahead of diagnostic, retained-egress, and lower-cursor work; that unit clears the latch before Release+Signal, and a successful ACK forces the following lower unit to ObserveChild. Duplicate or late ACK, malformed/stale output, adapter retention failure, containment, and revoke fail closed without granting credit. A valid `ShutdownComplete` retires the latch without ACK, starts the existing bounded containment cursor, and marks the adapter terminal only after the complete teardown proof; terminal plus egress coalescing fails closed. Coalesced nonterminal event+egress is durably retained before one global credit is granted.
  - scripts/cohsh/run_regression_batch.sh + scripts/ci/test_run_regression_batch.py — make the Stage03 wrapper copy and export the canonical `configs/generated/cohsh_policy.toml` that matches the current `cohsh` binary and resolved-manifest fingerprint; reject the legacy stale `out/cohsh_policy.toml` path in both implementation and regression fixtures so a pre-transport policy mismatch cannot masquerade as a QEMU script failure.
  - apps/root-task/src/console_network_service.rs + apps/root-task/src/net/** + apps/root-task/src/event/** + apps/root-task/src/hal/** — replace enabled-profile packet/parser ownership with bounded child exchanges while retaining sole-listener admission, Queen policy decisions, response ordering, emergency serial, and fatal output in root. Give the child read-only mappings for root-produced packet ingress and control, and read-write mappings only for child-produced packet egress and events. For the isolated VirtIO path, retain the exclusive outer EventPump order Operator/Dispatch -> Runtime/IPC -> Network -> Operator/Dispatch. Operator alone owns root policy and command dispatch, and Network alone owns VirtIO/NIC service. Runtime/IPC owns a persistent internal cursor in the exact order Worker -> ControlEndpoint -> BootstrapDrain -> StreamFlush -> RebootTail; each Runtime visit attempts exactly one selected unit, including an idle Worker check or another no-op, commits the cursor successor, and executes only the compact isolated-VirtIO prelude before the selected unit. That prelude reads HAL timebase and polls the timer once; an observed tick updates `now_ms`, increments timer metrics, publishes HAL timebase, and runs the existing conditional trace, while no tick refreshes `now_ms` from the read timebase. It then reconciles CYW43 network-ready HDMI state. The visit returns to the sole recurring outer yield and does not execute the generic Runtime-without-control tail. The MCS fault-endpoint poll is a compile-time no-op and consumes no Runtime unit. StreamFlush emits at most one retained line per selected visit; after the retained final-line visit, a later selected no-line visit performs cursor/bandwidth finalization only and the following selected visit emits END only. Legacy Pi/non-VirtIO Runtime retains its existing 48-line/16-KiB behavior. Persist the exact lower Network cursor ObserveChild -> StageOutput -> Disconnect -> Ingress -> ServiceTick -> ObserveChild and attempt exactly one selected unit per Network visit, including a no-op. A no-op advances; any successful child-signal unit forces the next lower attempt to ObserveChild. If a compact normal-success diagnostic is pending, emit at most that one record on a non-publish visit and return; otherwise retained egress receives at most two bounded reclaim checks and exactly one atomic TX publication attempt plus any required notify before returning on success or backpressure. Both preemptions preserve the lower cursor and forced-observe state. The bounded gate samples successful attempt sequences 0 through 63 and every 64th eligible success thereafter rather than imposing a diagnostic visit after every TX; counters remain continuous. ObserveChild may copy and retain one coalesced event/egress result but returns without TX. For a sampled success, preserve Observe -> TX -> DeferredDiagnostic before resuming the preserved lower state so a second publication cannot overwrite or merge the pending record; anomalies remain immediate. Preserve pending egress across backpressure, initialize the descriptor-bounded device-owned range before publication, perform no post-notify buffer write or completion wait, and retain in-flight identity until bounded reclaim. Commit the outer successor before early return and use the existing outer yield as the sole recurring replenishment boundary; the universal one-time post-activation yield is the separate startup boundary described below. Preserve Network -> Operator adjacency for buffered TCP dispatch and Operator -> Runtime/IPC outer adjacency for newly published control work. Before every ordinary phase, probe console-network's durable fault mailbox first and NineDoor only when the console probe reports no work. Each pending owner advances at most one material containment unit in fixed order per exclusive Recovery refill, persists its cursor, skips and preserves the selected ordinary phase plus both retained Runtime- and Network-unit cursors, and reaches the same sole outer yield without pump fallthrough. Mailbox contention returns `Retry` without fencing authority. The first latched console turn performs only its value/resource latch and a lock-free scalar authority fence. Later Recovery turns execute exactly one of fourteen material units: suspend; unbind; separate scrub/clean and unmap units for each shared-frame index 0 through 3; two indexed fault-cap deletes; anchor revoke/reset; and pure `Finalize`. `Finalize` commits `Complete`; the following idempotent `Complete` turn alone publishes the proof and permits quarantine. Console-network retains precedence across turns until no console work remains; only then may NineDoor advance. Ordinary retained-output turns then execute exactly one state of the quiet cleanup cursor `RootSessionTicket -> RootTicketUsage -> NineDoorSessionTicket -> NineDoorSessionScope -> NineDoorSessionBinds -> PendingStreamCursor -> PendingStream -> Finalize -> Complete`, committing each successor before moving heap owners into reboot-lifetime tombstones. Cleanup precedes its conditional reboot/parser/serial/local-seat/tail/detach diagnostics. Service fault/failure/teardown records precede cleanup diagnostics; console precedes NineDoor; admission commits before record removal, never evicts older output, retains on backpressure, and flushes on a later distinct turn. This adds no authority, SC, budget, refill, or root inner yield. Retain all three exclusive ordinary phases after console-network quarantine, with Runtime and Network preserving their retained unit state and Network fencing NIC polls rather than falling back to a combined Operator+Runtime/IPC turn; leave non-VirtIO and Pi outer-runtime behavior unchanged.
  - apps/root-task/src/event/** + apps/root-task/src/serial/** + tools/coh-rtc/src/** + configs/root_task*.toml + focused root-task/compiler tests — under the isolated VirtIO Operator only, create one compiler-owned serial-I/O credit from `virtio_operator_serial_io_bytes_per_turn = 64` and share it across every root-context RX poll and TX flush in that turn. Re-entry into a helper must not reset credit; exhausted bytes remain queued for a later Operator. If TX backlog exists at Operator entry, reserve exactly `32` bytes for TX and permit at most `32` bytes of RX; without entry backlog RX may consume all `64`. Set every non-root row and Pi/non-VirtIO root-control row to zero, retain the physical linked-runtime `max_bytes=1024` contract, and change no Pi event ordering, temporal budget, capability, or external grammar. This runtime, compiler, generated-artifact, and test scope is authorized by this active console-isolation task because the v7 exact-image timeout occurred inside the first steady Operator serial flush while the UART-visible lifecycle marker remained queued, before Network, Recovery, or authentication.
  - apps/root-task/src/event/** + configs/root_task*.toml + tools/coh-rtc/src/** + focused root-task/compiler tests — when the generated VirtIO serial-I/O bound is nonzero, permit at most one retained output-record attempt in the complete Operator turn and leave all later FIFO and response-tail records ordered for later Operators. Preserve the existing two-record attempt limit and phasing for Pi/non-VirtIO profiles, schema 1.11, the exact `64`/`32` serial admission, every numeric temporal field and constant, and every external grammar and authority boundary. Advance root provenance to `m26e-qemu-root-bounded-output-record-attempt-candidate-v9`. This scope is authorized because canonical v8 root ELF `5052e7a5070987c252d3c1f5cf6f27172bd5ece1836a8f6c2a5c329c789a0a61` exhausted the full `2750 us` root-control refill and raised current-fault `Timeout`, badge `0x26ee0001`, at PC `0xede84` immediately after `emit_prompt_now`, falsifying v8's remaining multi-record Operator composition.
  - apps/root-task/src/userland/** + apps/root-task/tests/mcs_activation_order.rs + configs/root_task*.toml + tools/coh-rtc/src/** — after the generated root-control SC and timeout endpoint are installed, execute exactly one universal MCS `seL4_Yield` before either containment mailbox probe or the first EventPump phase. This one-time activation seam sacrifices the partially consumed initial refill and waits for the next replenishment; it is distinct from the sole recurring outer yield after every Recovery or ordinary phase. Preserve the queued startup marker and prompt for the first steady Operator rather than draining them under bootstrap authority. Apply the seam to QEMU and Pi so both profiles have truthful per-phase WCET accounting; Pi gains one startup-period wait but no phase, driver, serial, capability, grammar, or numeric contract changes. Keep schema 1.11, all `2750/10000`, `2500`, `5100`, `64/32`, one-record, two-record, and physical `1024` values unchanged, and advance root provenance to `m26e-qemu-root-post-activation-refill-boundary-candidate-v10`. This scope is authorized because canonical v9 root ELF `fa488c9367136f0eadef7182a18691664c3ae51c2ac2974e12000ff5d27f38ed` with CPIO `aca549e99e0d86299e9f98348d896b730259277654544ebd22a74595b61e9bfb` exhausted the complete first post-bind `2750 us` refill and raised current-fault `Timeout`, badge `0x26ee0001`, at PC `0x13a798`, the first `compiler_builtins` `memmove` instruction reached from `heapless::Vec<PendingConsoleOutput, 72>::remove(0)` (LR `0x79ccc`, prospective `x2 = 0x110`). Zero bytes were copied, the one-record cursor remained full, serial was idle, and the marker plus prompt remained queued, so this is aggregate first-post-bind refill exhaustion rather than copy-cost or one-record-bound failure.
  - apps/root-task/src/event/** + apps/root-task/src/kernel.rs + apps/console-network-runtime/src/kernel.rs + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior tests — retain the v10 activation seam and every serial/output bound, but advance root provenance to `m26e-qemu-root-bounded-runtime-unit-candidate-v11` and child provenance to `m26e-qemu-console-one-unit-per-refill-candidate-v4`. This scope is authorized by canonical v10 root ELF SHA-256 `022908395c954f73a67136f70fe4404d96e0cf1ff16f4531fa95eae7a6f57cb5`: UART crossed the retained startup marker and prompt, proving the post-activation boundary and two one-record Operator visits completed, but the second fresh Runtime consumed the full `2750 us` and raised root timeout badge `0x26ee0001` at PC `0xce98c`, the `seL4_NBWait`/nonblocking receive on root endpoint `0x0a70`. The same run recorded console timeout sequence 1, badge `0x26ee0007`, Terminal policy, with the child saved at `seL4_Wait` while `service_pending=1` and `control_pending=1`; one logical unit had completed, but the pending successor composed on the residual child SC. Recovery reached Complete with TCB suspended, SC unbound, mappings scrubbed, capabilities revoked, objects deleted, and generation fenced; NineDoor remained healthy. Give QEMU Runtime the persistent Worker -> ControlEndpoint -> BootstrapDrain -> StreamFlush -> RebootTail cursor described above, and make the active-MCS child execute Yield then Wait after Ready and each later logical unit. Recovery preserves all ordinary cursors. Keep schema 1.11, every numeric timing/resource field, `64/32` serial admission, one-record/two-record output admission, capability, ABI, grammar, and authority unchanged; Pi/non-VirtIO outer runtime remains unchanged. Neither candidate is qualified until fresh canonical QEMU passes.
  - apps/root-task/src/event/** + apps/console-network-runtime/src/{kernel.rs,lib.rs} + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior tests — retain the v10 activation seam, the complete v11 Runtime cursor, every Network/Recovery/serial/output bound, and the child Yield-then-Wait seam, but advance root provenance to `m26e-qemu-root-empty-operator-cut-candidate-v12` and child provenance to `m26e-qemu-console-resumable-poll-service-candidate-v5`. This scope is authorized by the exact canonical v11/v4 artifacts: root ELF SHA-256 `44971429e4941d751248c216082256f01e187930d9a6d40028e5c89d8611b597`, console child ELF SHA-256 `af08f817191cc51c9354b61f09f3eeb50c8cdf875c660c7231987a426886666d`, and CPIO SHA-256 `9fbb58e1dc6dc508361f37ce0c24219e3e9029dae101e2be789df1bcb1a5b11d`. There were four TCP connects: the first three completed authentication attempts each wrote 18 bytes and read zero, while the fourth connect had no completed authentication record. The child consumed exactly `3000 us`, raised timeout badge `0x26ee0007`, and stopped at PC `0x213458`, the `seL4_Yield` immediately after the composite `PollService` completed and cleared; saved retained state identified `PollService` as that completed unit. Root completed console containment through cursor discriminant `Complete(6)`, then consumed exactly `2750 us` and raised timeout badge `0x26ee0001` at PC `0xf5fbc`, the sole outer `seL4_Yield` after an empty Operator; the committed successors were ordinary phase `Runtime` and Runtime unit `ControlEndpoint`, and root output was empty. V11/v4 therefore fail the live bound and are not qualification evidence; Stage 03 and pressure were withheld. On isolated QEMU VirtIO only, v12 snapshots serviceable Operator work after the first bounded priority pass and returns before the repeated tail when empty. V5 retains `ChildTurnUnit::PollService` but commits a private `ServicePollUnit::StackPoll -> Session` successor before work; `ServicePollOutcome::Continuation` retains `service_pending` across the existing Yield-then-Wait seam, and only `Complete` clears it. Keep schema 1.11, every numeric timing/resource field, `64/32` serial admission, one-record/two-record output admission, capability, ABI, grammar, and authority unchanged; Pi/non-VirtIO outer behavior is unchanged. Neither candidate is qualified until fresh canonical QEMU passes authentication and standard/timeout injection.
  - apps/root-task/src/event/** + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior tests — retain every v12 empty-Operator and v5 child boundary but advance root provenance to `m26e-qemu-root-compact-runtime-prelude-candidate-v13`; child provenance remains `m26e-qemu-console-resumable-poll-service-candidate-v5`. This scope is authorized by non-claiming run `out/test-plan-convergence/v12-v5-auth-20260812T010200Z`: root ELF SHA-256 `7cec5bd582d063adc73830af8cc62e0ec8dbbb33d91bd4701db09ca69e32e6ca`, console child ELF SHA-256 `920883c5e706688a65e7f168a643dbc527d09d7f48584bfb41fbd0c0ae823cb6`, and CPIO SHA-256 `dc36495a5de0df13bfb853ffa33fdc6e7ccc3bbf3a1a3c8c4cd74c8551160c16`. All four authentication attempts wrote 18 bytes and read zero. Root-control was the only timeout: badge `0x26ee0001`, exactly `2750 us`, outer-Yield PC `0xf612c`; stored ordinary successor `Network(2)`, Runtime successor `StreamFlush(3)`, and staged bootstrap `Option = None` prove the prior Runtime selected empty `BootstrapDrain`. Fault sequence 2 and the child healthy at Yield-then-Wait prove no prior child fault or Recovery. The run embedded dirty commit `a533290ffe264f0a2bf0af3db4bb4c45d1a4a278` and HEAD later advanced to `84934dda6`, so it is immutable diagnostic/failure evidence only. Replace only the split isolated-VirtIO Runtime's generic Runtime-without-control prelude with the compact timebase/timer/conditional-trace plus CYW43 network-ready HDMI reconciliation described above, then execute the already-selected cursor unit. Preserve schema 1.11, all timing/resource/serial/output numerics, capability, ABI, grammar, authority, Pi/non-VirtIO Runtime, and child v5 unchanged. V13/v5 remain unqualified until fresh canonical QEMU passes authentication and standard/timeout injection.
  - apps/root-task/src/event/** + apps/root-task/src/net/** + apps/root-task/src/kernel.rs + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior tests — retain every v13 Runtime and v5 child boundary but advance root-control provenance to `m26e-qemu-root-compact-network-turn-candidate-v14` and root-fault provenance to `m26e-qemu-root-fault-resumable-containment-candidate-v3`; child provenance remains `m26e-qemu-console-resumable-poll-service-candidate-v5`. This scope is authorized by non-claiming run `out/test-plan-convergence/v13-v5-auth-20260812T014607Z`, bound to dirty source commit `84934dda6fcffbfa536d4e437cc1904c7fdeb0b1`, root ELF SHA-256 `0275cd7d701263cc1731ca3301d9aeab8a0393651745659f192106a0d558d78f`, console child ELF SHA-256 `920883c5e706688a65e7f168a643dbc527d09d7f48584bfb41fbd0c0ae823cb6`, and CPIO SHA-256 `142e2aec64662888a9872ff77ff85d1f5f7c351b7aaa478ded8cf99ba9e64f29`. All four authentication attempts wrote 18 bytes and read zero, so the run failed at `real-target-operation`. Exact live state identified the initiating root-control timeout, badge `0x26ee0001`, at `sel4::poll` SVC PC `0xce98c` with caller `0x108910` immediately after the child-notification poll inside `IsolatedVirtioConsole::poll`; committed ordinary successor `Operator` and lower successor `StageOutput` identify selected unit `ObserveChild`. The child remained healthy at `seL4_Wait`. Root-fault then timed out with badge `0x26ee0002` at `suspend_tcb` SVC PC `0xce0cc` while targeting root-control TCB cap `0x10`, and root-emergency fail-stop followed. This falsifies v13's generic Network prelude plus compiler-expanded all-unit adapter closure and v2 root-fault's composed receive/classify/suspend handling; it does not falsify child v5. V14 executes the already-selected isolated Network unit through a compact Network-only turn and direct bounded unit adapters; v3 makes terminal-critical receive/classify, suspend, and emergency signal distinct successor-before-work admitted units while retaining the single Reply association until the terminal signal. Preserve schema 1.11, every numeric timing/resource/serial/output field, capability, ABI, grammar, authority, nonterminal Worker/driver/service fault paths, Pi/non-VirtIO behavior, and child v5. V14/v3/v5 remain unqualified until fresh canonical QEMU passes authentication and standard/timeout injection.
  - configs/root_task.toml + tools/coh-rtc/src/** + exact compiler fixtures — advance only QEMU `root-worker-supervisor` and `root-driver-supervisor` cold-activation admission to v15. The exact v14 artifact set binds root ELF `4265ee26a8a23b38851167aa046f4adce50764715131d044059b4e08211b9361`, system CPIO `85a1e211f5cb83ad8ace277d0a4cfe89c22317ffa148e0aeae64611f1bd315d6`, kernel `865b5a0614f1633ca636800705f97339e78f47065fdaffd2cb4139e4a25630c0`, driver archive `88a3a9f1df93cb560501ac13275efb20b52985db8878b54372e29a397539474d`, and driver manifest `ef168c902062ff1c9f08208bc1eadf92773991ee2ce297a28da5ee26e2cfa385`. `root-worker-supervisor` first exhausted its complete `750 us` refill at entry PC `0x1143dc`, timeout badge `0x26ee0004`; root-fault received that record, then `root-driver-supervisor` exhausted its complete `1000 us` refill at entry PC `0x113d98`, current timeout badge `0x26ee0005`. Both generated tasks select core 1. The core-specific SchedControl ConfigureFlags call precedes SC binding, and the MCS bind migrates the TCB to its SC core; do not add the invalid direct `TCB.SetAffinity` path. Use the proven core-1 NineDoor bootstrap envelope plus 20 percent margin: each supervisor becomes `3000 us / 10000 us` with `2400 us` WCET; Worker response is `4800 us` with `m26e-qemu-root-worker-supervisor-cold-activation-candidate-v15`, and driver response is `2400 us` with `m26e-qemu-root-driver-supervisor-cold-activation-candidate-v15`. Preserve every core, priority, period, deadline, refill, cap, and runtime value. Their steady active demand is `6000 us`; with the root-retained `3000 us` NineDoor bootstrap envelope at priority 128 below both supervisors, transient demand equals the exact `9000 us` usable core-1 capacity and leaves the `1000 us` reserve. Keep the Pi manifest's supervisor and driver values/provenance unchanged and unqualified pending its required checkpoint. The exact v15 QEMU image later proved both supervisors reached their healthy blocking waits; broader v16 target acceptance and the Pi checkpoint remain pending.
  - apps/root-task/src/event/** + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior/compiler tests — retain every v14 Network, v13 Runtime, v12 empty-Operator, v5 child, v3 root-fault, and v15 supervisor boundary, but advance root-control provenance to `m26e-qemu-root-exclusive-retained-output-candidate-v16`. The exact v15 non-claiming run bound dirty source HEAD `84934dda6`, root ELF SHA-256 `6c145a1d81bd57e791781a052f62dfc6dd5d34c7c7ca0aa4e3311a9b5696018c`, system CPIO SHA-256 `07b84ff5dc2a40e2b9039d49b1e37bb88824909fe2fd902c9dd0165b4a643529`, and resolved-manifest SHA-256 `46f3264e862944b84188064941bd581e60a78d80d9a7590dfe4b42fcfa3e7482`. Root-control consumed exactly `2750 us` and raised timeout badge `0x26ee0001` at the outer yield after the second retained-output Operator emitted and cleared the initial prompt; saved successors `Runtime` and `ControlEndpoint` prove the prior Runtime selected `Worker`, while the cleared output state proves that entry-time TX history—not remaining work—admitted the generic Runtime tail. Root-fault then consumed exactly `3000 us` at the `SignalEmergency` send return, emergency delivery and fail-stop completed, and both v15 supervisors remained healthy at `seL4_Wait`. Make only the isolated QEMU VirtIO retained-output Operator exclusive after its bounded output service; it must return before generic Runtime-tail work. Preserve every timing, schema, capability, ABI, grammar, authority, Pi/non-VirtIO behavior, child v5, root-fault v3, and supervisor v15 value. Keep QEMU and Pi root provenance consistent with the existing universal root candidate convention; v16 remains pending fresh QEMU authentication and standard/timeout injection.
  - apps/root-task/src/event/** + apps/root-task/src/hal/critical_tcb.rs + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior/compiler tests — retain the v16 output ordering, v14 Network, v13 Runtime, v5 child, and v15 supervisor contracts, but advance root-control provenance to `m26e-qemu-root-compact-event-dispatch-candidate-v17` and root-fault provenance to `m26e-qemu-root-fault-classify-boundary-candidate-v4`. The exact v16 image bound root ELF SHA-256 `4fab7abc8707b9829ba66ac525efdfc7afefa812df4bab9abb8cb67d504a76a6` and system CPIO SHA-256 `456558cac05e4d136d3cbc18d1290cc48bebf619ba5459cd623b667dbfff3e96`. The startup prompt reached serial and the retained output completed, but root-control still consumed the full `2750 us` and raised timeout badge `0x26ee0001` at outer-Yield PC `0xf61c4`; saved successors `Runtime` and `ControlEndpoint` identify the completed phase as Operator and the earlier Runtime unit as Worker. Target-ELF disassembly shows the supposedly exclusive path still entered an approximately `0x42c0`-byte generic EventPump frame and an approximately `0x12a0`-byte generic Operator frame before the output leaf. Root-fault then consumed the full `3000 us` at the first post-classification Yield, PC `0x113938`, before critical suspension or emergency signalling. V17 therefore dispatches the exact isolated QEMU VirtIO contract through a tiny noinline split entry before allocating the generic EventPump frame; that path commits the outer successor and admits at most one material Operator leaf in strict priority: SerialIo/SerialDispatch, LocalSeat, response-ordered RetainedOutput, NetEvent, NetLine, background/high-impact RetainedOutput, then DisplayAttach. Each material leaf is noinline, commits its successor before work, and cannot call the generic Operator or Runtime bodies. Runtime and Network retain their existing compact one-unit paths. Root-fault v4 uses `Receive -> Classify -> SuspendCritical -> SignalEmergency`: Receive commits Classify before blocking receive and yields after copying only label/badge; Released classifications yield before another Receive; RetainedByDriver waits for and validates the exact release then yields; Critical commits SuspendCritical then yields; SuspendCritical commits SignalEmergency, suspends, and yields; SignalEmergency commits Receive, signals, and yields. The serialized Reply association and all noncritical fault semantics remain unchanged. Pi/non-VirtIO EventPump dispatch stays on the generic path. Preserve schema 1.11, every numeric timing/resource/serial/output field, capability, ABI, grammar, authority, child v5, and supervisor v15 values. V17/v4/v5 remain pending fresh canonical QEMU authentication and standard/timeout injection.
  - apps/root-task/src/event/** + apps/root-task/src/serial/** + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior/compiler tests — retain the complete v17 compact dispatcher, v14 Network, v13 Runtime, v4 root-fault, v5 child, and v15 supervisor contracts, but advance root-control provenance to `m26e-qemu-root-split-serial-io-candidate-v18`. The exact v17 non-claiming run `out/test-plan-convergence/v17-v4-auth-20260812T041428Z` bound root ELF SHA-256 `3d0641bac42d21ce383c47f38628a05db0d2474fab69fc6e14b67ba39a71bd47`, unchanged child ELF SHA-256 `920883c5e706688a65e7f168a643dbc527d09d7f48584bfb41fbd0c0ae823cb6`, and CPIO SHA-256 `fa478638d6d2b93b654a2615e4dcd1e1d7f666d0945d4e012adcf28da2292af1`. All four authentication attempts wrote 18 bytes and read zero, so the first failed proof layer remained `real-target-operation`. Exact fault state identified current root-control timeout `.1` at outer-Yield PC `0xf6624`; committed successors were ordinary phase `Runtime`, Runtime unit `Worker`, and Operator unit `SerialDispatch`. This proves the compact dispatcher and successor-before-work attribution ran, but falsifies v17 `SerialIo`, which still composed generic `SerialPort::poll_io` driver admission/RX work with TX flushing in one selected leaf. V18 keeps `OrdinaryOperatorUnit::{SerialIo, SerialDispatch, RetainedOutput, NetEvent, NetLine, LocalSeat, DisplayAttach}` but makes `SerialIo` RX-only: it performs exactly one bounded `poll_rx_only`, admits no TX/dispatch/flush, and retains `SerialDispatch` when entry TX or admitted input exists. A later Operator selects retained `SerialDispatch` first, commits `RetainedOutput` before work, performs bounded serial consume/echo and TX flush, and returns without another RX probe or another material leaf. The existing raw-UART RX trace is suppressed only while this admitted ordinary root-control turn is active, so trace formatting cannot become a hidden part of the selected RX unit; generic/Pi tracing is unchanged. An idle RX-only probe restores `SerialIo` eligibility and continues the unchanged strict-priority selector. Preserve schema 1.11, every `64/32` serial admission and one-record/two-record output value, every temporal/resource numeric, capability, ABI, grammar, external operator ordering, Pi/non-VirtIO behavior, root-fault v4, child v5, and supervisor v15 value. V18/v4/v5 remain pending fresh canonical QEMU authentication and standard/timeout injection.
  - apps/root-task/src/event/** + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior/compiler tests — retain every v18 Operator, v13 Runtime, v14 one-unit Network, v4 root-fault, v5 child, and v15 supervisor boundary, but advance root-control provenance to `m26e-qemu-root-virtio-network-prelude-candidate-v19`. The exact v18 non-claiming artifact bound root ELF SHA-256 `e7d34f018ff308c575fedb79ca7cef5542a7da8e753c09ddb9d55cf9daa79d4e` and system CPIO SHA-256 `0dca41cc6fdd9a877144dcd2db610beaeafef95423a81ce6896b01bb9b8f5cf5`. All four authentication attempts wrote 18 bytes and read zero. Root-control consumed exactly `2750 us` and raised timeout badge `0x26ee0001` at outer-Yield FaultIP `0xf66e4` after a completed Network phase. The ordinary successor was `Operator(0)`; isolated lower successor `Disconnect(2)` proves the selected lower unit was `StageOutput(1)`. Pending egress was zero, deferred diagnostic state was `2`, and no child signal occurred. Root-fault timeout `.2` was downstream at `suspend_tcb` SVC PC `0xce1f4` with its retained cursor already `SignalEmergency`; root-fault v4 and child v5 are not the initiating failure. V19 changes only the true isolated-QEMU split Network prelude: `poll_split_ordinary_virtio_network_prelude` calls exactly `poll_runtime_timer_prelude`, then `poll_split_ordinary_virtio_network_turn` invokes exactly one retained `poll_one_split_ordinary_virtio_network_unit`. It does not call `reconcile_cyw43_network_ready_hdmi`. The split Runtime prelude retains timer plus CYW43/HDMI reconciliation, and generic/Pi Network and Runtime paths remain unchanged. Preserve schema 1.11, every timing/resource/serial/output numeric, capability, ABI, grammar, authority, root-fault v4, child v5, and supervisor v15 value. V19/v4/v5 remain pending fresh canonical QEMU authentication and standard/timeout injection.
  - apps/root-task/src/event/** + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior/compiler tests — retain every v19 split-Network prelude, v18 Operator, v13 Runtime, v14 one-unit Network, v4 root-fault, v5 child, and v15 supervisor boundary, but advance root-control provenance to `m26e-qemu-root-virtio-netdiag-postlude-candidate-v20`. The exact clean v19 non-claiming artifact bound root ELF SHA-256 `0737a6f008197fd5b931af104c95164ddcd925fa04a8440439895c1e76b26fca` and system CPIO SHA-256 `51e7b955b449b42b7a0cad569aa187e19a0f71464ffb81080d29733a589e7ed0`. All four authentication attempts wrote 18 bytes and read zero. Root-control exhausted its refill at outer-Yield FaultIP `0xf66dc` after a completed Network phase. The lower successor `Ingress(3)` proves selected `Disconnect(2)` was a no-op and did not signal the child; pending egress was empty, the child remained healthy at Wait PC `0x21343c`, and root `smoltcp_polls` was `250098`. This falsifies the post-leaf composition of counter refresh, NETDIAG, and NineDoor ingest aggregation, not the timer prelude, selected NIC unit, child v5, or root-fault v4. V20 changes only the true isolated-QEMU VirtIO Network path. A NIC visit performs the timer prelude and exactly one selected NIC unit, then retains one compact diagnostic observation containing the telemetry snapshot, originating `now_ms`, and last-RX-progress horizon. The next Network visit takes that observation before any timer or NIC work, runs only NETDIAG, and returns. Immediate flush accounting, connection identity, and NineDoor ingest accounting remain in the originating NIC visit unchanged; quarantine clears the retained observation. Generic and Pi paths remain unchanged. This intentional postlude boundary halves NIC service cadence per Network visit and therefore requires fresh Hive Gateway REST performance measurement after functional target gates. Preserve schema 1.11, every timing/resource/serial/output numeric, capability, ABI, grammar, authority, root-fault v4, child v5, and supervisor v15 value. V20/v4/v5 remain pending fresh canonical QEMU authentication and standard/timeout injection.
  - apps/root-task/src/event/** + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior/compiler tests — retain every v20 exclusive diagnostic-postlude, v19 split-Network prelude, v18 Operator, v13 Runtime, v14 one-unit NIC, v4 root-fault, v5 child, and v15 supervisor boundary, but advance root-control provenance to `m26e-qemu-root-virtio-network-timer-nic-split-candidate-v21`. The exact immutable v20 launch set `out/cohesix-v20-final-qemu-20260812T062442Z` bound root ELF SHA-256 `ed5cb9f587d0d63e6121f8b00b083e68f5a0a7dd23dd6d2bbf0c899e1e85e80f`, system CPIO SHA-256 `ca2a52038eb0814a17c8609f03bec32ff357fdd524edee3e7080ac69ceb7823b`, kernel SHA-256 `865b5a0614f1633ca636800705f97339e78f47065fdaffd2cb4139e4a25630c0`, and resolved-manifest SHA-256 `6dd92e0015a1ec7c14af5321fc35ebc9143673dbe71b09766a83bf3b77a36e0a`. The non-claiming authentication canary bound dirty commit `bf77d71946e958c5a4671db1c4f5bd9edd959aae` and source digest `sha256:bdb2411efaf5b8e50d57ff8673605b7798cd7a6638801f77546ba347f77541c8`; all four attempts wrote 18 bytes and read zero. A same-artifact no-input run reached `[mark] root-console.start.ok` and the prompt before root-emergency fail-stop. Exact GDB state found root timeout `.1` at outer-Yield FaultIP `0xf680c`, ordinary successor `Operator`, and retained NETDIAG `Some`. That proves the originating normal Network visit completed both its timer prelude and NIC unit and retained its diagnostic, while the diagnostic-only successor had not run. Exact v20 lower-cursor, pending-egress, and child state are unconfirmed and must not be inferred from stale layout offsets. This falsifies only timer-plus-NIC composition, not the selected NIC/lower unit, exclusive diagnostic visit, child v5, root-fault v4, or v15 supervisors. V21 adds a QEMU-only persistent `OrdinaryVirtioNetworkUnit::{Timer, Nic}` cursor. When no retained diagnostic exists, the Network visit reads the cursor, commits `unit.next()` before work, and performs only the selected unit: Timer calls `poll_runtime_timer_prelude`; Nic calls one unchanged `poll_one_split_ordinary_virtio_network_unit`, retains the compact v20 diagnostic observation, and preserves immediate flush, connection-id, and NineDoor ingest accounting. A retained diagnostic still preempts first, runs only NETDIAG, returns without advancing the Timer/Nic cursor, and leaves the next ordinary visit at Timer. The recurring featured sequence is therefore Timer -> Nic -> DeferredDiagnostic -> Timer. Quarantine clears retained diagnostics but preserves the Timer/Nic cursor; generic and Pi paths neither use nor mutate it. Preserve schema 1.11, every timing/resource/serial/output numeric, capability, ABI, grammar, authority, root-fault v4, child v5, and supervisor v15 value. V21/v4/v5 remain pending fresh canonical QEMU authentication and standard/timeout injection.
  - apps/console-network-runtime/src/{lib.rs,kernel.rs} + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior/compiler tests — the v22 repair slice retains root-control provenance `m26e-qemu-root-virtio-network-timer-nic-split-candidate-v21`, root-fault v4, supervisor v15, and every v21 root boundary, but advances child provenance to `m26e-qemu-console-bounded-stack-steps-candidate-v6`. This scope is authorized by the exact immutable v21 launch set `out/cohesix-v21-qemu-20260812T070200Z`: root ELF SHA-256 `c3d45ee5650373ed6064de1a7d13691d9473f300ac5ffec11d0f1719ab877de2`, system CPIO SHA-256 `4d164fcc7c9a3605d3d5ca7430895e3cf911f4a294ddb0432d8afafb0966ed64`, console child ELF SHA-256 `920883c5e706688a65e7f168a643dbc527d09d7f48584bfb41fbd0c0ae823cb6`, and kernel SHA-256 `865b5a0614f1633ca636800705f97339e78f47065fdaffd2cb4139e4a25630c0`. The non-claiming official convergence run `out/test-plan-convergence/v21-v4-auth-20260812T070901Z` bound dirty commit `bf77d71946e958c5a4671db1c4f5bd9edd959aae` and source digest `sha256:1b9cbf5125e24c9e36741bfc558d9d5a50cf5f193a4840158a007ab00ac11251`; it and the controlled exact-image run `out/live-diag/v21-20260812T071219Z` each completed four authentication attempts that wrote 18 bytes and read zero. The controlled run stayed healthy at the prompt without TCP input, then AUTH reproduced terminal child timeout current-fault `[0x5, 0x26ee0007]`. The child consumed its full `3000 us` refill and stopped at post-unit `seL4_Yield` FaultIP `0x213434`; retained `service_pending=1`, `control_pending=1`, and `ingress_pending=0`, together with the v5 successor-before-work contract, identify completed `StackPoll` returning `Continuation` with `Session` committed next. Smoltcp 0.13.1 explicitly documents `Interface::poll` as potentially unbounded because it loops ingress and egress, so v5 is live-falsified rather than qualified. V6 replaces only the private service cursor with `ServicePollUnit::StackIngress -> StackEgress -> Session`: commit each successor before work, let `StackIngress` call exactly one `poll_ingress_single` and return `Continuation`, let `StackEgress` call one `poll_egress` and return `Continuation`, and leave `Session` unchanged as the only `Complete` result. Preserve the same child Yield-then-Wait seam after each nonterminal unit, retained-first publication priority, root v21 behavior, schema 1.11, all numerics, ABI, grammar, capability, and authority. V21/v4/v6 remain pending fresh canonical QEMU authentication and standard/timeout injection; the v21 runs are diagnostic failure evidence only.
  - apps/console-network-runtime/src/lib.rs + configs/root_task*.toml + tools/coh-rtc/src/codegen/root_tcb_topology.rs + generated default/QEMU/Pi projections + focused runtime/compiler tests — the historical V7 child candidate was `m26e-qemu-console-closing-send-guard-candidate-v7`. The immutable diagnostic artifact `out/cohesix-m26e-hvf-20260813T054027Z` bound rootserver SHA-256 `48ae02bd3faae9626a03c29932ca15b809d30f9552404ddfbe81051d24dace95`, child SHA-256 `89c241b6198a140170744b02b707a6000486acf39dee0799a302d74605fde52b`, and CPIO SHA-256 `0619e47f1157815f43629ab56c03b39f342e44460b931efd822bc93e42e0c689`. The fresh map `out/m26e-qemu/v23-v6-tcg-gateway-fault-map-20260813T172000Z` localized the console fault to FaultIP/NextIP `0x213d58` (`BRK`), LR `0x21373c`, `x0 = 5` (`RuntimeError::Backpressure`), and the old image's shared send/backpressure exit `0x21832c` with smoltcp TCP state `FinWait2`. V7 gated `send_slice` on both `can_send()` and complete-frame capacity, retaining closing-state output without commit or false `OutputDrained` until peer close reached the existing `end`/one-`Disconnected`/relisten path. Other Session errors remained terminal. Preserve this exact V7 evidence as the historical predecessor; it is not current V8 qualification.
  - apps/console-network-runtime/src/{lib.rs,kernel.rs} + apps/root-task/src/net/isolated_console.rs + configs/root_task*.toml + tools/coh-rtc/src/codegen/root_tcb_topology.rs + generated default/QEMU/Pi projections + focused child/root/compiler tests — the historical V8 console child advanced to `m26e-qemu-console-stale-control-generation-fence-candidate-v8`. The canonical HVF V24 artifact `out/cohesix-v24-attach-fastpath-hvf-qemu10-20260813T081651Z` bound rootserver SHA-256 `e2386dc044fb78ab2cf757db3304bf918847b99990f7aa7869eb366647cbdcb7`, console child SHA-256 `b1689774784e6e2ab11d5ac878fee173f42150deb6c371baa26017a8a81f18db`, CPIO SHA-256 `d9dc4058acb5f97d65af7ff17219dfc4034e0527c407b063f2bcd482ea97316b`, and kernel SHA-256 `8aa06eaf462a87d3aa6c1f8500ad1d1ed5632f5ad8031c5eab53fdd2095257da`. The sequential diagnostic `out/m26e-qemu/v24-attach-sequential-20260813T083057Z/boot_v0.log` completed `OK AUTH` and `OK ATTACH role=queen`, then timed out waiting for the first `TAIL /log/queen.log` response. Live UART explicitly reported `terminal-fault class=Standard`, and the read-only map placed the child at FaultIP/NextIP `0x213d80` (`BRK`) with LR `0x2136cc`; the TCB fault payload had already been consumed and read as zero. The value `0x26ee0007` at SC offset `0x30` was only the configured timeout-handler badge, not evidence that Timeout initiated this fault. Exact source/state mapping placed the child in retained `ApplyControl(SendLine)` after the owning session had ended and `AuthState` was inactive. The control page carried a connection identity, but the V7 reader discarded it, so a valid already-staged old-generation line was misclassified as a current unauthenticated error and entered terminal fault. V8 preserves and validates the nonzero connection identity. A well-formed control for an ended or different connection is consumed as `StaleConnection`, advances the accepted sequence, and publishes its exact `ControlCompleted` without output, `OutputDrained`, or fault; malformed records and matching-current pre-authentication or queue errors remain terminal. A stale control can therefore neither mutate nor reorder a replacement session. Root retains the one-slot in-flight record until that exact completion, and the isolated adapter reports backpressure rather than success when no authenticated connection exists so a not-yet-staged stream record cannot advance silently. Preserve V7's closing-send guard, v6 service cursor, one-unit/refill boundary, schema 1.11, every numeric, page, field, event kind, grammar, capability, and authority value. V24 is exact failure evidence, not V8 qualification.
  - apps/root-task/src/{sel4.rs,bootstrap/log.rs,ninedoor.rs,event/mod.rs} + focused logger/activation/attach tests — keep the existing bootstrap-readiness and namespace-authority boundaries without another provenance change. Once endpoint ready, endpoint validated, IPC send unlocked, and post-commit IPC unlocked are all true, the syscall wrapper returns through an inline four-read fast gate before shared bootstrap trace counters, tracer snapshots, formatting, locks, or UART diagnostics; any failed readiness condition enters the unchanged cold diagnostic/refusal path. A successful target namespace `prepare_namespace(Attach)` is the sole fallible application attach transaction: NineDoor commits its local attached/session context before best-effort audit, logger, or boot-tracer observation, and root commits its session plus `OK ATTACH` only after that transaction succeeds. Attachment enters nonblocking UART+EP mirroring only. The optional ping/ack self-test and EP-only promotion may run only from a later explicit request and cannot veto, roll back, or weaken namespace authority; UART+EP mirroring remains functional. These are bounded implementation corrections within the existing root v23 and namespace contracts, not a new root/supervisor provenance or numeric change.
  - apps/root-task/src/event/** + apps/root-task/src/hal/critical_tcb.rs + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior/compiler tests — retain every v21 Timer/Nic/diagnostic, v18 Operator, v13 Runtime, v4 recurring root-fault, v11 child, and v15 supervisor boundary, but advance root-control provenance to `m26e-qemu-root-exclusive-predispatch-candidate-v23` and root-fault provenance to `m26e-qemu-root-fault-service-units-candidate-v6`. The exact immutable v22 launch set `out/cohesix-v22-qemu-20260812T074004Z` bound root ELF SHA-256 `d392ee72ada945f5b5ae52e4dee285ed3e7ff67fa9283103a234af9d15e389fc`, system CPIO SHA-256 `7055a956cf84cbaa2c6b00b8c9fe59d73c52c7cd157e07b66960434ac66af64c`, console child ELF SHA-256 `89c241b6198a140170744b02b707a6000486acf39dee0799a302d74605fde52b`, and kernel SHA-256 `865b5a0614f1633ca636800705f97339e78f47065fdaffd2cb4139e4a25630c0`. Non-claiming run `out/test-plan-convergence/v22-v4-v6-auth-20260812T074300Z` bound dirty commit `bf77d71946e958c5a4671db1c4f5bd9edd959aae` and source digest `sha256:4f7473411494f351def533a52e6bf8e3f02037b75c8945992171a16108cf7c28`; all four authentication attempts wrote 18 bytes and read zero. A controlled exact-image AUTH run first remained healthy at the prompt, then recorded initiating root-control timeout badge `0x26ee0001`; the secondary current fault was root-fault timeout badge `0x26ee0002`. Root-control was inactive with FaultIP/NextIP `0xe9ddc`, the not-yet-executed outer phase-successor store after `reconcile_physical_response_barrier` and `queue_stream_prompt_tail_if_ready`; the selected and retained phase was `Operator`, so no Operator leaf ran. The child remained healthy at `seL4_Wait` after completed `StackEgress`, with `Session` committed and `service_pending=1`, `ingress_pending=1`, and `control_pending=0`. This falsifies v21 root's composed compact predispatch housekeeping, not child v6. Exact V22 root-fault state separately binds secondary timeout badge `0x26ee0002` to FaultIP/NextIP `0x113e70`, immediately after the Receive turn terminal Yield SVC at `0x113e6c`; LR `0x113e5c` followed publication of initiating label `5` and badge `0x26ee0001`, with Classify already committed. That secondary fault was not the initiating root failure, but it independently falsifies v4's unprimed first Receive boundary. V23 keeps compact QEMU predispatch success-sensitive without adding a phase or cursor: `TailInFlight` performs one response-barrier reconciliation and returns if the barrier clears, otherwise exactly one compact Operator unit runs before return; an eligible stream prompt performs one queue attempt and returns if pending clears, otherwise bounded queue backpressure likewise falls through to exactly one compact Operator unit before return. Ready reboot retains its exclusive pre-phase return. Every path preserves the ordinary phase and both retained Runtime/Network cursors; only the fallback Operator subcursor may advance. Only a turn with no predispatch duty reads the ordinary phase, commits its successor, and dispatches one existing phase. Generic and Pi paths keep their existing behavior. Root-fault V6 retains initial `PrimeReceive`: once constructed, sealed, resumed, and runnable, it commits Receive and yields before any endpoint receive, copied fault value, or Reply association; an early sender may remain queued on the already constructed endpoint. All recurring legacy lanes continue to commit Receive directly. Service classification instead commits `ResolveService`, which performs one fixed generated lookup and one nonblocking registry-lock/scalar-snapshot attempt, retrying without loss on contention. It then advances `SuspendService -> RecoverPassiveService -> PublishService -> Receive`; active console service records skip `RecoverPassiveService`. Suspension performs one quiet bounded syscall, passive recovery may issue at most one Reply while active console recovery issues zero, and publication performs one mailbox action while retaining the snapshot on backpressure. Preserve schema 1.12, every timing/resource/serial/output numeric, grammar, external authority, root-fault V6, child v11, and supervisor v15 value. V23/root-fault-V6/child-V11 remain pending fresh canonical QEMU authentication and standard/timeout injection.
  - apps/root-task/src/hal/console_network.rs + apps/root-task/src/net/{isolated_console.rs,isolated_network_turn.rs} + configs/root_task.toml + tools/coh-rtc/src/codegen/root_tcb_topology.rs + generated default/QEMU projections + focused root tests — advance only QEMU root-control provenance to `m26e-qemu-root-publication-ack-unit-candidate-v24`. The exact V23/root-fault-V6/child-V11 canary timed out root-control at the sole outer Yield after ObserveChild completed while the console child remained healthy, falsifying same-visit observation-plus-ACK composition rather than child V11. V24 records debt only after valid copy and durable adapter retention, returns without signalling, then selects one distinct highest-priority `AcknowledgePublication` Network unit on a later root refill. That unit clears debt before Release+Signal; success forces the following lower unit to ObserveChild, while failure contains without granting credit. Preserve V23 predispatch and Timer/Nic/diagnostic behavior, Pi V23 provenance, child V11, root-fault V6, supervisor V15, schema 1.12, ABI v2, every timing/resource/capability value, and all external grammar. V24 is now exact failed evidence under the following chronology entry; it is not qualification.
  - configs/root_task.toml + tools/coh-rtc/src/codegen/root_tcb_topology.rs + generated default/QEMU projections + focused temporal/resource-admission tests — advance only QEMU root-control temporal provenance to `m26e-qemu-root-temporal-envelope-candidate-v25`. The exact read-only V24 snapshot `out/m26e-qemu/ack-split-v24-20260813T122117Z/v24-gdb-readonly-snapshot.txt` records current-fault label `5`, badge `0x26ee0001`, root ELR/FaultIP `0x5361c` at `KernelSerialDriver::read_byte+84`, and LR `0x5391c` at `SerialPort::poll_rx_current_tcb+92`; the committed outer successor was Runtime and Operator successor was SerialDispatch. The child was healthy at Wait `0x21360c`, root-fault was receiving, and root-emergency alone was fail-stop. This exactly falsifies V24's `2750 us` QEMU root envelope during an admitted SerialIo unit; it does not falsify the ACK split or child V11. Keep root-control on core 0 but set only its QEMU budget/WCET/response to `5500/5000/7600 us`. Move only the QEMU console-network task, matching service core, and SchedControl row from core 0 to core 2; keep child budget/WCET/period and V11 provenance unchanged, derive child response `2400 us`, and update same-priority GPU/LoRA responses to `3000 us`. Compiler admission must prove core-0 demand `8750 us` and core-2 demand `3800 us` within the unchanged per-core `9000 us` usable window. Pi root-control retains exact V23 placement, numerics, response, provenance, and source; its child remains V11 under schema 1.12. Schema, ABI, caps, periods, refills, priorities, MCPs, and product source remain unchanged. These values are a conservative pending envelope, not proven numerically minimal. V25 remains pending fresh canonical QEMU authentication, the two-session generation-fence canary, and standard/timeout injection.
  - apps/console-network-runtime/src/lib.rs + configs/root_task*.toml + tools/coh-rtc/tests/ai_lora_contract.rs + generated default/QEMU/Pi projections + focused runtime/compiler tests — advance only the console child lifecycle provenance to `m26e-qemu-console-peer-close-relisten-candidate-v12`. The immutable V25 artifact `out/m26e-qemu/temporal-v25-20260813T125130Z/artifact` completed the first raw AUTH, but replacement raw connections were reset at both `+1 s` and `+10 s`; the retained logs are `raw-auth-twice.log` and `raw-auth-after-10s.log`. A live read-only snapshot, whose transcript was not retained, showed root current fault `NullFault`, root-control fully replenished at budget `5500 us`, and the healthy child blocked in core-2 Wait. Source comparison then found that peer FIN advanced the isolated child socket to `CloseWait` but no child transition requested the server half-close or relisten; M26b Complete `72288c7d` had explicitly converted `CloseWait` into its bounded disconnect/close path. V12 invokes the existing idempotent `session.request_disconnect()` only while the socket is `CloseWait`; it preserves already-authorized exact-generation output, then reuses the existing `close_ready`/`Closed`/`end`/`listen` path and emits exactly one `Disconnected`. A real two-stack in-memory regression proves peer-FIN relisten without root disconnect control. This changes no ABI, READY identity, schema, page, capability, timing, grammar, host timeout, retry policy, root-control, root-fault, supervisor, Worker, NineDoor, or gateway contract. V25 and every V11 ACK invariant remain intact; only child provenance advances to V12 on QEMU and Pi. Fresh target proof must perform raw session-1 AUTH, close that host socket, obtain same-boot raw session-2 AUTH, then complete two sequential direct `cohsh` sessions before any downstream regression or performance claim.
  - apps/cohsh/** + apps/coh/** + all `.coh` scripts + apps/swarmui/** + apps/hive-gateway/** + tools/cohesix-py/** + scripts/{m26e_qemu_pressure.sh,rest_perf_harness.py} + docs/BENCHMARKS.md — perform the same-change host-tool and performance-harness compatibility review for v25/root-fault-V6/child-V12 and the common-MCS bounded NineDoor containment cursor. The repairs, including V12's peer-close/relisten transition, V7's internal closing-state sendability guard, V8's connection-generation disposition and root unauthenticated-output retention, the all-ready IPC fast gate, and the nonblocking ATTACH logger transition, add no verb, frame, ACK/ERR/END state, namespace or authority path, timeout, quota, benchmark workload, retry policy, evidence record, or report-schema change, so these implementations, fixtures, benchmark inputs, and report schemas remain unchanged. NineDoor's latch-only turn, 18 material units, and proof-only Complete turn alter only internal target recovery scheduling; ordinary Pi scheduling remains unchanged, while fresh Pi containment evidence is pending. V25 preserves V24's ACK split and V23's featured internal NIC cadence of one NIC visit per three Network visits. Successful physical-tail reconciliation or prompt-tail queueing returns before phase selection; bounded backpressure may run exactly one compact Operator unit without ordinary-phase advance, and ready reboot remains exclusive. After AUTH and standard/timeout injection pass, run the focused direct base `.coh` batch, the Hive Gateway REST core/parity batches plus Python smoke, and Conditional B2's exact-three executable QEMU pressure. Run Conditional D's no-retry `1 MiB`, `10 MiB`, `100 MiB`, and `1 GiB` telemetry matrix separately against the exact packaged gateway's explicit host-model backend. Regenerate compiler-owned default/QEMU/Pi projections and hashes for the V12 provenance change; Pi scheduling, placement, and V23 root-control truth must remain unchanged, and any unrelated drift is a blocker. Stage 03, Hive Gateway REST regression, Conditional B2 executable QEMU pressure, Conditional D host-model comparison, and complete host-tool acceptance remain withheld until the v25/root-fault-V6/child-V12 same-boot peer-close/relisten and generation-fence gate plus unchanged v15 QEMU gate and bounded NineDoor QEMU containment pass; Pi acceptance additionally requires fresh Pi containment and target-performance evidence.
  - docs/ARCHITECTURE.md + docs/ROLES_AND_SCHEDULING.md + docs/SECURITY.md + docs/INTERFACES.md + docs/USERLAND_AND_CLI.md + docs/TEST_PLAN.md + docs/BENCHMARKS.md — preserve authentication, sole-listener, transport-confidentiality, external ACK/ERR/END, fixed page layouts, and operator-priority contracts while advancing the internal console contract to ABI v2 and schema 1.12 while recording the compact shared-page implementation, strict Operator/Runtime/Network unit boundaries, one-unit-per-refill child boundary, resumable root-control Recovery, exact live v5/v6/v7/v8/v9/v10/v11-root/v4-child/v12-v5/v13-v5/v14-supervisor/v15/v16/v17/v18/v19/v20/v21/v22 root, V22 secondary root-fault, V24 stale-control child failure, the exact V24 SerialIo timeout above, the QEMU-only V24 publication-ACK-unit split, the V25 temporal envelope/core placement, and the V25/V11 peer-close failure, V12 correction, and pending v25/root-fault-V6/child-V12 qualification plus the evidenced v15 supervisor entry. `USERLAND_AND_CLI.md` keeps its human-authored command, framing, grammar, and response contract unchanged; only its compiler-owned generated identity mirrors refresh.
  - focused runtime-source nomenclature — freeze the exact isolated-QEMU selector, `OrdinaryOperatorUnit::{SerialIo, SerialDispatch, RetainedOutput, NetEvent, NetLine, LocalSeat, DisplayAttach}`, the tiny `poll_split_ordinary_virtio_compact` phase dispatcher, and distinct noinline Operator leaves. In that compact dispatcher, `PhysicalResponseBarrier::TailInFlight` must call `reconcile_physical_response_barrier`, inspect the resulting barrier, and return if cleared or run exactly one compact Operator unit before return if still in flight. `!stream_end_pending && stream_prompt_pending` must call `queue_stream_prompt_tail_if_ready`, inspect the resulting pending bit, and return if cleared or run exactly one compact Operator unit before return on bounded queue backpressure. Ready reboot must retain its exclusive return. Each path must precede ordinary phase selection and preserve the ordinary, Runtime, and Network cursors; only a fallback Operator subcursor may advance. Only when no predispatch duty applies may the dispatcher read `ordinary_service_phase`, commit `phase.next()`, and dispatch one existing phase. The compact selected path must never call `poll_generic`, `poll_ordinary_operator_turn`, or a generic Runtime body. `SerialIo` calls only the bounded RX-only serial probe and may retain `SerialDispatch`; retained `SerialDispatch` is selected before a new probe, commits `RetainedOutput`, and owns serial consume/echo plus TX flush. Neither unit may call the other's work or select another material leaf in the same Operator. With no retained diagnostic, `poll_split_ordinary_virtio_network_turn` must read `ordinary_virtio_network_unit`, commit its `OrdinaryVirtioNetworkUnit::{Timer, Nic}` successor before work, and dispatch exactly one unit. Timer calls only `poll_runtime_timer_prelude`; Nic calls only one noinline `poll_one_split_ordinary_virtio_network_unit`, then retains one compact diagnostic observation after unchanged immediate flush, connection-id, and NineDoor ingest accounting. The former composite `poll_split_ordinary_virtio_network_prelude` must be absent. With a retained observation, the Network visit takes it before reading or advancing the Timer/Nic cursor, runs NETDIAG only, and returns; quarantine clears the observation but preserves the cursor. The distinct split Runtime prelude retains CYW43/HDMI reconciliation. Retain private `OrdinaryVirtioOperatorWork::{serial_input, serial_output, local_seat_input, dispatchable_network_line, pending_console_output, physical_response, stream_or_tail, reboot, serviceable_display, serviceable_frontier, serviceable_attach}` with pure `is_empty` only for the unchanged generic path, plus private `ServicePollUnit::{StackIngress, StackEgress, Session}`, public `ServicePollOutcome::{Continuation, Complete}`, and `poll_service_unit`. Root-fault must retain private `RootFaultCriticalTurn::{PrimeReceive, Receive, Classify, ResolveService, SuspendService, RecoverPassiveService, PublishService, SuspendCritical, SignalEmergency, ResumeService}` with the atomic default at PrimeReceive. Service classification selects the exact generated bounded timeout continuation or commits `ResolveService`; registry contention retains Classify and its pending fault. ResumeService commits Receive before one zero-label, zero-length kernel Timeout Reply; resolution owns one fixed generated lookup plus a nonblocking registry-lock/scalar-snapshot attempt and retries without loss; service suspension owns one quiet bounded syscall; only passive donated Calls select the at-most-one-Reply recovery unit; active console selects `PublishService` directly; and mailbox backpressure retains the snapshot. PrimeReceive commits Receive then yields exactly once without receive, Reply use, copied fault value, classification, cap lookup, suspension, or signal; every recurring return path commits Receive directly. For Session output, tests must require both `socket.can_send()` and complete-frame capacity before `send_slice`, retain closing-state output without commit or `OutputDrained`, and prove a peer-initiated `CloseWait` requests the existing graceful disconnect, retains exact-generation output until `close_ready`, then reaches `Closed`, exactly one `Disconnected`, and relisten through the existing path; other Session errors remain terminal. Tests must reject successful predispatch fallthrough, ordinary-phase or Runtime/Network cursor advance during housekeeping, more than one Operator fallback or fallback on helper success, cursor advance after rather than before selected work, more than one material compact Operator leaf, Timer/Nic composition in one visit, Network reconciliation, advancing the Timer/Nic cursor during NETDIAG, stale postlude retention across quarantine, any `Interface::poll` call in the v6 service path, composing ingress and egress in one service step, clearing `service_pending` on `Continuation` or error, treating unattached-seat flags or broad hints as Operator work, or applying the QEMU-only split when the exact selector is inactive.
  - focused lifecycle guards — require the child control reader to carry the committed `connection_id` into application, validate kind/payload/nonzero identity before stale classification, return `StaleConnection` only for a well-formed record not owned by the exact current session, publish the matching `ControlCompleted`, and neither enqueue bytes nor fault nor expose `OutputDrained`. Prove an ended connection and a newly authenticated replacement both reject the old control while the exact replacement control remains applicable. A real two-stack regression must drive a peer FIN without root disconnect control and prove `CloseWait -> request_disconnect -> close_ready -> Closed`, one `Disconnected`, cleared generation state, and restored LISTEN. Root boundary tests must keep the one-slot control in flight across `Disconnected` and release it only for exact `ControlCompleted`; isolated root output without an authenticated connection must return backpressure before line normalization or queue mutation. The QEMU root Disconnect transaction must set its issued latch only after successful publication, leave it clear on backpressure, retain the requested Quit reason across `ControlCompleted` and `OutputDrained`, refuse a second publication for that connection, and then let the unchanged lower cursor reach Ingress and ServiceTick. `Connected`, `Disconnected`, no-active, graceful terminal, and fail-closed transitions clear the latch for the appropriate generation. ATTACH tests must prove namespace preparation precedes local NineDoor authority commit, that commit precedes audit/logger/tracer observation, root session/`OK ATTACH` follows bridge success, and attachment itself cannot run the optional EP-only ping/ack loop. IPC source tests must prove the all-ready path reads all four gates before returning and cannot reach the shared bootstrap counter, tracer snapshot, formatting, or UART path; the cold not-ready path retains those diagnostics.
  - apps/console-network-runtime/src/lib.rs + configs/root_task*.toml + tools/coh-rtc/src/codegen/root_tcb_topology.rs + generated default/QEMU/Pi projections + focused real-stack runtime/compiler tests — advance only the console child lifecycle provenance to `m26e-qemu-console-peer-close-timewait-relisten-candidate-v13`. Preserve V12 as historical evidence: immutable set `out/m26e-qemu/peer-close-v12-20260813T133000Z` bound source digest `sha256:c047b0886ba42ba1dfe0004009a8e9377d4d2cbd98e997e8dfd463e4bc80eaa0`; raw session-1 AUTH, host close, and same-boot raw session-2 AUTH passed, then a `cohsh` session passed AUTH, ATTACH, four-line TAIL, END, and QUIT. Replacement AUTH timed out at `+5 s`, raw AUTH still timed out at `+30 s`, and UART recorded no fault. The read-only GDB reproduction in `out/m26e-qemu/peer-close-v12-20260813T133000Z/attached-teardown-gdb-20260813T134100Z` found all CPUs kernel-idle. QUIT made the server the active closer; smoltcp 0.13.1 retained the sole socket in `TimeWait` for its fixed `10 s` close delay and re-armed that timer for each incoming replacement SYN, so repeated probes could prevent passive expiry indefinitely. M26b Complete `72288c7d` explicitly treated `TimeWait` as terminal. V13 restores only that boundary: on `TimeWait`, call `TransportSession::end` once for the old generation, abort the completed TCP control block, and immediately relisten; retain the existing `Closed` path. A real two-stack exact regression must authenticate replacement connection 2 immediately and preserve one old-generation `Disconnected`, cleared auth/output state, and generation ordering. This changes no ABI/READY identity, schema, page, capability, timing, placement, grammar, authority, host retry, or timeout. V12 is failure evidence, not V13 qualification; fresh V13 target proof must repeat the raw two-session gate and then complete two sequential direct `cohsh` sessions, with the first END/QUIT active close followed by immediate replacement AUTH, before downstream regression or performance claims.
  - apps/cohsh/** + apps/coh/** + all `.coh` scripts + apps/swarmui/** + apps/hive-gateway/** + tools/cohesix-py/** + scripts/{m26e_qemu_pressure.sh,rest_perf_harness.py} + docs/BENCHMARKS.md — review V13 against the V12-compatible host and performance surfaces. V13 changes only the internal completed active-close terminal transition and provenance; it adds no verb, frame, ACK/ERR/END state, namespace or authority path, timeout, quota, benchmark workload, retry policy, evidence record, or report schema. No hand-authored host-tool, Python-library, workload, fixture, or report-schema change is required. Regenerate compiler-owned default/QEMU/Pi projections and hashes once; Pi timing, placement, and V23 root-control truth remain unchanged, and unexplained drift blocks the target canary.
  - docs/ARCHITECTURE.md + docs/ROLES_AND_SCHEDULING.md + docs/SECURITY.md + docs/INTERFACES.md + docs/USERLAND_AND_CLI.md + docs/TEST_PLAN.md + docs/BENCHMARKS.md — preserve the V12 historical CloseWait correction and exact V12 target chronology while selecting V13 as current internal lifecycle provenance. `USERLAND_AND_CLI.md` receives no human-authored change because V13 changes no command, framing, grammar, retry, timeout, or response contract; its compiler-owned generated identity alone refreshes if selected by canonical regeneration.
  - apps/root-task/src/net/isolated_console.rs + apps/root-task/tests/isolated_virtio_network_phasing.rs + configs/root_task.toml + tools/coh-rtc/src/codegen/root_tcb_topology.rs + generated default/QEMU projections + canonical lifecycle docs — advance only QEMU root-control provenance to `m26e-qemu-root-disconnect-single-issue-candidate-v26`. Preserve V25 and V13 history. The immutable V13 artifact bound rootserver SHA-256 `d91c89bc9e076097e45085c92a368760ecf39cb36fbf1fede2faa9099d87f31d`, console child SHA-256 `4057c1b6a850ae806e2d9d5fde018ad88a831b66c606f4cf7a105ea38fe3f387`, and CPIO SHA-256 `bb60bfaf2b9b0775361ecc111b972ab8f8f9ae1b0d9d9afd672bac3e56e4cdf1`. In `out/m26e-qemu/peer-close-timewait-v13-20260813T140319Z/same-boot-two-complete-sessions-20260813T141000Z`, session A completed AUTH, ATTACH, four-line TAIL, END, and QUIT; same-boot session B connected twice but each authentication wrote 18 bytes and read zero, then failed after 21 seconds. QEMU remained alive, UART reported no runtime fault, and the exact child ELF contained V13's `TimeWait -> end -> abort -> listen` path. Root nevertheless kept `disconnect_requested` true after the first successful Disconnect. The child's `ControlCompleted` reopened the one-slot control page and `OutputDrained` marked that newest sequence drained, so the next strict `ObserveChild -> StageOutput -> Disconnect` pass published another Disconnect. Each successful child signal reset the lower cursor to ObserveChild; repeated transactions therefore starved Ingress and ServiceTick, preventing the peer ACK/FIN from reaching the child and preventing the packaged V13 branch from executing. V26 adds one per-connection issued latch: set only after successful Disconnect publication, unchanged on backpressure, retained across completion/drain while the requested Quit reason remains, and cleared on the connection/generation terminal paths. The next Disconnect visit becomes a no-op and advances to Ingress and ServiceTick. This changes no ABI/READY identity, schema, field, page, badge, capability, timing, placement, resource, grammar, authority, declared retry, or timeout; Pi root-control remains V23, child lifecycle remains V13 on QEMU and Pi, and V25's complete temporal envelope remains unchanged. Host tools, `.coh`, SwarmUI, Hive Gateway, `tools/cohesix-py`, benchmark workloads, evidence records, and report schemas require no hand-authored change. V13 is failure evidence for V26, not V26 qualification; a fresh exact V26 boot must complete the same two direct sessions before downstream gates.
  - retained V26 target result — preserve immutable artifact `out/m26e-qemu/disconnect-single-issue-v26-20260813T145200Z/artifact`, source digest `sha256:8c8ef66e0434852a9974bf9ba8d87e40062f46f4d6e9c95fc4496f7a28adda39`, root SHA-256 `6ec97ca4633e7d81ba75907ccc4080392385310a88c96a3239a2f8dea9b5d110`, child SHA-256 `4057c1b6a850ae806e2d9d5fde018ad88a831b66c606f4cf7a105ea38fe3f387`, CPIO SHA-256 `00474245ff59d239e87814ed97cf1c821c166989aca0c993ebcc42ed49f40317`, kernel SHA-256 `8aa06eaf462a87d3aa6c1f8500ad1d1ed5632f5ad8031c5eab53fdd2095257da`, and exact same-boot evidence `same-boot-two-complete-sessions-20260813T150000Z`. Sessions A and B each completed AUTH, ATTACH, four-line TAIL, END, and QUIT without reconnect or target fault. This qualifies the narrow V26 Disconnect/relisten transition only; it does not qualify large responses, REST, performance, full Stage 03, or Milestone 26e.
  - crates/console-network-abi/** + apps/console-network-runtime/** + configs/root_task*.toml + tools/coh-rtc/** — V14 introduced console ABI/READY identity v3 under manifest schema 1.13 and binary root control `SendBatch = 3` inside the existing 2368-byte exchange payload: header `(encoding_version=1, count, used_bytes, reserved=0)`, one through eight exact records, and each record `(line_len, UTF-8 bytes)` with `1..=256` bytes and no CR/LF. The child validates the complete payload before mutation, retains one private batch, stages at most one external response frame per replenishment-bounded Session unit, and binds `ControlCompleted`/`OutputDrained` to the exact connection and batch sequence. After Session commits one complete retained wire frame, including the final batch frame, it retains exactly one following `StackIngress -> StackEgress -> Session` service cycle; the next no-progress Session completes and quiesces. Pending batch state or a capacity/sendability failure alone cannot retain that cycle. This avoids one root ServiceTick per batch record without a child self-spin, and `SendLine` remains supported. The first exact V14 target build stopped at the root image-binding layer before a root ELF or QEMU artifact existed: console child ELF SHA-256 `e16fc715975d4d73959c6536d9c4246058857040339c3c05a68721223a2d3f16`, 73,568 bytes, had page-rounded PT_LOAD span `0x200000..0x23c000` with the final LOAD ending at `0x23b540`, so it required 60 image pages while generated truth admitted 59. That is build-failure evidence, not target evidence. V15 advances the common child to `m26e-qemu-console-send-batch-60-page-candidate-v15` and reconciles only that exact footprint: 60 image pages plus 32 stack, one IPC, one init, and four shared pages total 98 frames; the additional retained frame cap raises root slots to 123. QEMU fixed/maximum frame-slot totals become `2018/4058` and `2066/4250`; Pi totals become `4066/8962` and `4114/9154`; adding the unchanged reserve yields admitted totals `2578/6298` and `4626/11202`. The four page layouts, offsets, notification objects, ACK badge 64, untyped bytes, timing, placement, and every non-frame/cap resource remain unchanged. Pi root-control remains exact V23; only its common child provenance/ABI/schema/resource selection advances to V15/v3/1.13 pending fresh Pi evidence.
  - apps/root-task/src/event/** + apps/root-task/src/net/** + focused root tests + configs/root_task.toml + tools/coh-rtc/** — advance only QEMU root-control provenance to `m26e-qemu-root-bounded-authenticated-response-lane-candidate-v27`. An exact authenticated connection may activate one generation/connection-bound response lane. One producer unit fills only the existing eight-line adapter queue; one Network unit performs exactly one useful ACK, egress, batch-stage, ingress, or child-service action; routine success diagnostics remain retained for ordinary service. After exactly eight response units, root executes exactly one ordinary Operator/Runtime/Network debt turn, preserving physical input, fatal output, timers, diagnostics, and ordinary cursors before resuming the same response identity. Terminal completion requires the exact terminal batch's `ControlCompleted` and `OutputDrained`; disconnect and generation fencing remain V26. V27 changes no budget, WCET, response-time admission value, SC, core, page, cap, badge, external line grammar, host retry, or timeout.
  - apps/root-task/src/net/isolated_console.rs + apps/root-task/tests/isolated_virtio_network_phasing.rs + configs/root_task.toml + profile-scoped coh-rtc oracles + generated default/QEMU projections + canonical lifecycle docs — advance only QEMU root-control provenance to `m26e-qemu-root-terminal-response-disconnect-fence-candidate-v28`. Preserve V27 and V15 as historical evidence. Exact immutable artifact directory `out/m26e-qemu/bounded-response-v27-v15-20260813T164606Z/artifact` bound rootserver SHA-256 `a2070492a08a8b30f0fbc15047443ec35ee82bd4c31345352a354479387cc8e8`, console child SHA-256 `e16fc715975d4d73959c6536d9c4246058857040339c3c05a68721223a2d3f16`, system CPIO SHA-256 `21530c54e416a4bb0690d383813de932379e990f4df6b00c1f6b785cc4330fa3`, kernel SHA-256 `8aa06eaf462a87d3aa6c1f8500ad1d1ed5632f5ad8031c5eab53fdd2095257da`, and launch-record SHA-256 `87b615d808a7ba6f1789ee81a204145191e2fe730fba2f2b8b50e5323bf52ea8`. Its non-claiming evidence directory `out/m26e-qemu/bounded-response-v27-v15-20260813T164606Z/sendbatch-tail64-cat-20260813T165110Z` completed boot, AUTH, ATTACH, the 64-record TAIL, bounded CAT, and host-side script exit zero, then QUIT reached `closing session` before UART fail-closed with exact reason `response-completion-sequence`. V27 allowed the Disconnect control to become eligible from child-side output drain before root had retired the terminal SendBatch response lane's exact `ControlCompleted` plus `OutputDrained` identity. The resulting Disconnect `ControlCompleted` could therefore be observed while that lane still owned a different terminal batch sequence and was correctly rejected as a sequence collision. V28 adds only a root-local terminal-response fence: while any response lane remains present, Disconnect publication is ineligible; after the exact lane retires, the existing V26 per-connection issued latch permits one successful Disconnect publication, remains clear on backpressure, and prevents restaging. Preserve the V27 response cadence and ordinary debt, V26 one-shot lifecycle semantics, V15 child, schema 1.13, ABI v3, every resource/timing/placement/capability/badge value, external grammar, host retry, timeout, workload, evidence record, and report schema. Pi root-control remains V23 and common child remains V15. This target result is V27 failure evidence, not V28 qualification; the retained V28 result below qualifies only the fence and same-boot reconnect transition.
  - retained V28 target result — preserve immutable artifact `out/m26e-qemu/terminal-disconnect-fence-v28-v15-20260813T171339Z/artifact`, rootserver SHA-256 `ed20cddd0d2c7b269101a56cc548dec2e5d26f648923f505ee9743e5eaf0efec`, console child SHA-256 `e16fc715975d4d73959c6536d9c4246058857040339c3c05a68721223a2d3f16`, system CPIO SHA-256 `02bd7f7b914ca070ad06b43e0f15066d59fbad6a7419bdacb4cea2e46cf2b9df`, kernel SHA-256 `8aa06eaf462a87d3aa6c1f8500ad1d1ed5632f5ad8031c5eab53fdd2095257da`, launch-record SHA-256 `0937cebd1af7035ab2028558c7c9a66ac6440252ba5062717d3f376b406eed2a`, and resolved-manifest SHA-256 `1c1091695d958339b268340b6fddbe3bb70a6ffe65050e25757e4517d8477333`. Evidence `two-session-sendbatch-20260813T171736Z` recorded both sessions exit zero, one connection per session, 25 retained records between TAIL and CAT in session one, and zero UART terminal faults. This qualifies only V28's terminal-response fence and same-boot reconnect; it does not qualify generalized synchronous producers, Stage 03, REST, performance, or Milestone 26e.
  - apps/root-task/src/event/** + apps/root-task/src/net/** + apps/root-task/src/hal/cache.rs + focused root tests + scripts/qemu_tcp_response_matrix.py + tests/test_qemu_tcp_response_matrix.py + configs/root_task.toml + profile-scoped coh-rtc oracles + generated default/QEMU projections + canonical docs — advance only QEMU root-control provenance to `m26e-qemu-root-bounded-synchronous-response-stream-candidate-v29`. For an exact isolated authenticated generation and connection, capture HELP, NETSTATS, SMP, and CACHELOG body lines plus the exact ACK or ERR terminal root-locally before publication, seal that response immutable, and drain it through the existing bounded response lane on later Network visits. Retain identity and cursor state across backpressure, preserve V27's eight-useful-unit/one-ordinary-debt cadence and V28's terminal Disconnect fence, and discard stale identity without publishing to a replacement session. CACHELOG takes one immutable newest-first snapshot: reserve its bounded vector before taking the cache-log lock, copy at most the existing 1920-record capacity while holding the lock once, render later, and return a typed bounded error on allocation failure. Conflicting physical synchronous producers receive bounded BUSY while the network response owns shared state. This changes no external verb, frame, line, ACK/ERR/END ordering, retry, timeout, authority, SC, core, page, cap, badge, placement, or resource numeric. Pi root-control remains V23; the common child remains V15 under schema 1.13 and ABI v3.
  - apps/root-task/src/net/stack.rs + focused root wrapper-delegation tests + configs/root_task.toml + profile-scoped coh-rtc oracles + generated default/QEMU projections + canonical docs — advance only QEMU root-control provenance to `m26e-qemu-root-default-netstack-response-delegation-candidate-v30`. Preserve immutable V29 artifact `out/m26e-qemu/bounded-sync-response-v29-v15-20260813T190157Z/artifact`, rootserver SHA-256 `f60d716573afe3387360689b20f5e9012171a0c4e34ebdd7d4b21bf89811b9a6`, and resolved-manifest SHA-256 `983b5433ec4b4138ebc5bc05401393bcd6f623bae96e46d9ca4ad52694889adc`. Its fixed matrix completed AUTH and ATTACH, then HELP returned zero bytes before the unchanged 30-second client timeout. A read-only live snapshot showed clean root and child state. Breakpoints proved HELP reached root command handling and finished with `capture_started=false`; the selected live `DefaultNetStack` vtable used the trait-default bounded response identity and returned `None`. V29 implemented four isolated response hooks on `IsolatedVirtioConsole` but the selected enum wrapper did not delegate terminal-line publication, bounded response identity, response-lane inspection, or response-budget polling; it also omitted the preexisting `console_event_pending` delegation. V30 forwards all five hooks to every selected backend, with the VirtIO arm preserving the isolated implementation. This changes no capture, lane, child, external grammar, ABI, schema, resource, timing, placement, capability, authority, timeout, retry, workload, evidence-record, or report-schema contract. Pi root-control remains exact V23 and the common child remains exact V15 under schema 1.13 and ABI v3. V29 is failure evidence for the wrapper boundary, not V30 qualification.
  - apps/console-network-runtime/src/{kernel.rs,lib.rs} + apps/root-task/src/{console_network_service.rs,hal/console_network.rs} + configs/root_task*.toml + tools/coh-rtc/src/** + generated default/QEMU/Pi projections + focused runtime/compiler tests — select common child provenance `m26e-qemu-console-natural-postpone-full-budget-candidate-v16` under schema 1.14. Preserve V30/V15 history: immutable artifact `out/m26e-qemu/default-netstack-response-v30-v15-20260813T200444Z/artifact` completed HELP and NETSTATS before its child fault localized to the Yield SVC with two adjacent refills totalling exactly `3000 us`; the terminal timeout endpoint converted that exhausted fragmented refill into terminal service containment. Non-claiming local-Poll diagnostic artifact `out/m26e-qemu/local-poll-diagnostic-v30-v15-20260813T204840Z/artifact` then completed HELP, NETSTATS, and the correct first-call SMP body count of 16 on its first boot; the then-stale host oracle expected 26 and was repaired without changing target behavior. A second fresh boot of those same artifact bytes reached `root-console.start.ok` and then emitted `root-emergency fail-stop` before any TCP probe. These runs are failure diagnostics only and disprove promotion of V30/V15 with a terminal console timeout endpoint; neither is qualification. V16 gives only the active console child manifest policy `NaturalPostpone`: root leaves that child's TCB timeout-handler slot empty, so seL4 natively postpones an exhausted active SC until replenishment instead of manufacturing a console `Timeout` teardown. The standard fault endpoint remains terminal. The compiler still mints, reserves, badges, accounts, and registers the console timeout cap/resource for stable containment topology, but does not install it as the child TCB timeout handler. The child rechecks the coalesced badge and publication credit before every retained logical unit. Eligible retained private work uses local `seL4_Poll`; an idle or publication-uncredited child calls `seL4_Wait` directly, with no ordinary `seL4_Yield`. Natural postponement, not a source-level one-unit-per-refill claim, bounds a retained burst by the unchanged `3000 us / 10000 us` SC. Its honest WCET and QEMU response become `3000 us`; Pi response becomes `8100 us`; same-priority QEMU GPU/LoRA responses become `3600 us`. The already admitted QEMU core-2 demand remains `3800/9000 us`, and the Pi core-0 demand remains `9000/9000 us`; all other budgets, periods, priorities, MCPs, placements, resource counts, ABI v3 pages, ACK badge 64, external grammar, host timeout, retry, workload, evidence record, and report schema remain unchanged.
  - apps/console-network-runtime/src/lib.rs + configs/root_task*.toml + tools/coh-rtc/src/** + canonical docs + focused runtime tests — advance the common child to `m26e-qemu-console-authenticated-oversize-drain-candidate-v17`. V16 target regression exposed that an authenticated frame whose declared payload exceeded the child buffer was incorrectly classified as pre-authentication failure: it emitted `ERR AUTH`, closed the connection, and forced host reconnect churn. V17 queues exact `ERR FRAME reason=invalid-length`, drains exactly the complete declared payload across fragments, and resumes parsing only after that drain on the same authenticated connection. A payload above the 2304-byte command bound receives the same treatment. Pre-authenticated oversize remains terminal `ERR AUTH`. Preserve schema 1.14, ABI/Ready v3, V16's `NaturalPostpone` policy and local-Poll/direct-Wait cadence, every budget/WCET/response/period/priority/MCP/core, all pages/caps/badges/resources, external command grammar, client timeout/retry policy, workloads, evidence records, and report schemas.
  - apps/root-task/src/event/mod.rs + focused root regressions + configs/{root_task,root_task_regression}.toml + exact coh-rtc oracles + canonical docs — advance only QEMU root-control provenance to `m26e-qemu-root-failed-stream-producer-retirement-candidate-v31`. Preserve the non-claiming V30/V17 Stage 03 artifact ID `sha256:466f8210e6aa98757f6393758bfed0cee24e15272f95e680a5263feab26ea90e`, root SHA-256 `47df96e2a444e507a6872bf43af5ddd47133f960c8daebdc2dba71d10f53b690`, and resolved-manifest SHA-256 `eb274d4358345ddef0d4a191d75fd2bd40ff98c6577f0135fd18cd599f9afbd0`. Its fixed matrix, `boot_v0.coh`, `9p_batch.coh`, and `host_absent.coh` passed. `observe_watch.coh` then received the correct typed invalid-path `ERR CAT`, but provisional ordinary `pending_stream` remained owned while `stream_end_pending` was false, so same-connection QUIT could not dispatch and timed out. V31 invokes the narrow `retire_failed_stream_producer` transition after failed CAT, LS, TAIL, or LOG only: it drops an uncommitted ordinary stream shell, while a committed/successful stream, synchronous response mode, and every other command remain unchanged. Preserve Pi root V23, child V17 on QEMU and Pi, schema 1.14, ABI/Ready v3, all scheduling/resource numerics, command/error grammar, retry/timeout policy, workloads, evidence records, and report schemas. This V30/V17 result is failure evidence, not V31 qualification.
  - apps/root-task/src/{debug_uart.rs,event/mod.rs} + focused root regressions + configs/{root_task,root_task_regression}.toml + exact coh-rtc oracles + canonical docs — advance only QEMU root-control provenance to `m26e-qemu-root-bounded-routine-audit-buffer-candidate-v32`. Preserve the non-claiming V31/V17 Stage 03 run `out/m26e-qemu/stage03-v31-v17-20260814T005001Z`, invocation/source SHA-256 `21b37c19572ef05accf6258c602442d21cd2ee24ff9594a2a3e0d2ab489bfae3`, and base launch record SHA-256 `099e8de70ece2c38f38ebf1cd7d1b1acaf730e5baa5d7ca20d3ba6021ce2d94e`. Its base artifact ID was `sha256:a1f6953065daa1dac388ba249c302a0acf8563e3e75546da9f94a1ab9a1454f5`, with resolved-manifest SHA-256 `29f5c8c7a044fa3b9c611bad06be30904a6f77db43d17cabce53e30cfa89545e`, rootserver SHA-256 `919de64dfe7e69e627e7461e1f6822cc7714f3fbaf2171cb84b59592189084f9`, CPIO SHA-256 `62ba464d2613206526f8d2b3d001cbea233ba3b32d5a81e95885a2ec426bf12e`, and kernel SHA-256 `8aa06eaf462a87d3aa6c1f8500ad1d1ed5632f5ad8031c5eab53fdd2095257da`. The fixed matrix passed 7/7, followed by passing `boot_v0.coh`, `9p_batch.coh`, and `host_absent.coh`. The first two rapid TAILs in `observe_watch.coh` passed. Its third TAIL reached target command begin, `tail.start`, `tail.stop reason=eof`, and command end with status OK, but `cohsh` received no complete response before the unchanged five-second deadline; CAT and QUIT were not reached. The gated image was built but never target-run: launch record SHA-256 `2925c2c8540e3b1034d0d949c4852a16d97b64439bde8eb9e5ddfad0a5820f04`, artifact ID `sha256:650b5b5c171f2cc18c0ad2ba3ffa2f65157625cd49c11b951e57c69f41765000`, resolved-manifest SHA-256 `2ae9b9afdcd3bf9c1cf90db81822636ca69cbbe66774bddb3aab542e099dd100`, rootserver SHA-256 `e1dc0c5664c4834e451c5bbc396cd98b9dc30130802e0a209f8a04fb198df0ee`, and CPIO SHA-256 `cfa93f1591b50928622ac8fc3a638afa2ab000c926e9830c6f099aad7270bfb8`, with the same source and kernel. V32 preserves V31's failed-producer retirement and all response scheduling, but routes routine command, session, TAIL, and NineDoor audit lines to the existing bounded log once either that log channel or the linked serial owner is active. Pre-handoff routine audit falls back to the existing diagnostic helper. V32 does not reroute ordinary console-failure, critical/fatal, or fail-stop sites; in the selected isolated QEMU failure path they retain raw UART. Preserve Pi root V23, child V17 on QEMU and Pi, schema 1.14, ABI/Ready v3, every scheduling/resource numeric, external response text/order, command/error grammar, timeout/retry policy, workload, evidence record, and report schema. This V31 result is failure evidence for V32, not Stage 03 qualification.
  - apps/root-task/src/{debug_uart.rs,event/mod.rs,serial/mod.rs} + focused root regressions + configs/{root_task,root_task_regression}.toml + exact coh-rtc oracles + canonical docs — advance only QEMU root-control provenance to `m26e-qemu-root-private-routine-audit-idle-drain-candidate-v33`. Preserve the immutable non-claiming V32/V17 Stage 03 run `out/m26e-qemu/stage03-v32-v17-20260814T014606Z` and invocation/source SHA-256 `3e1d02dac334fbe0019f517b34a3aad13f483e52e9d07570b52d122391a14eb1`. Its base artifact ID was `sha256:105b33911515641a19cde0a7c670c848911c16e14134bdf00efcdeba418c0483`, launch-record SHA-256 `94d409d0b5bdae883c929defaf801ee3cbaeb2d88688bf690b71f40ff983199b`, resolved-manifest SHA-256 `03f72150a556b78a897ae291752c81d9def8cf283a930a8cd8b55b92464270e1`, rootserver SHA-256 `592b60dc45597f1ca29d646ae9cf0fd4c8df86298f393016ee915f0e91ce161e`, CPIO SHA-256 `2fd94dad9e75b43ea7eb8f42c38a4a587dc5e07a1c8f33cb10c2a6444fa29500`, console child SHA-256 `513ec72cf5174c2765d46696a41d28610b1171ee880b23720cfab0b261f51f40`, and kernel SHA-256 `8aa06eaf462a87d3aa6c1f8500ad1d1ed5632f5ad8031c5eab53fdd2095257da`. Its fixed matrix passed 7/7 and `boot_v0.coh` passed. `9p_batch.coh` then wrote `batch-1`, `batch-2`, and `batch-3` successfully but failed line 12 because V32 routine command/session diagnostics entered public `/log/queen.log`; the bounded CAT preview was contaminated and did not contain exact ordered substring `batch-1|batch-2|batch-3`. One of 17 selected operational `.coh` scripts passed before the runner stopped. The gated image was built but never target-run: artifact ID `sha256:6b9b281b4c872c588154f5d9a309797d4ec20e263943e0920e49ca0af492f1f0`, launch-record SHA-256 `b4d7babfad21b2a70aa9311900e7f0692ecfbb6a4a772f5d933bd31909f8ace9`, resolved-manifest SHA-256 `aeb4e263793c7b25bc1c4fc00983e25de033298c71fa8ce447a5a24eae19e101`, rootserver SHA-256 `841ed16776c3dca1b1e3b1c6b7599d5a7b001e67f83f6a98cc889c33740688ad`, and CPIO SHA-256 `22c24fc9d72c4c66a820986869786ca596efe9f0707a1404e089ed8c2636d40f`, with the same source, child, and kernel. V33 removes selected-QEMU routine diagnostics from both the response path and public log. A QEMU-only, EventPump-private four-record FIFO retains routine command begin/end, session attach/detach, TAIL start/stop, NineDoor error, and CAT-ack diagnostics. Saturation or an oversized record drops only the new best-effort diagnostic and preserves older FIFO order, with no retry or fallback. `RoutineAudit` is the final-idle OrdinaryOperator unit: it attempts one nonblocking serial admission, pops only after success, and cannot run while response/input/stream/flush, retained-output, containment, network, or display work is eligible. Once admitted, the QEMU-only `SerialPort` provenance flag marks the complete staged TX backlog as audit-only. Ordinary `SerialDispatch` skips retrying that exact audit-only backlog while the UART remains stalled, so a newly eligible `NetEvent` and then `NetLine` can run before a later final-idle `RoutineAudit` retry. Admission of any nonempty ordinary serial record or bytes promotes the staged backlog to ordinary dispatch priority without reordering it; audit admission remains atomic and preserves FIFO plus exact `\r\n` framing. The public `/log/queen.log` contract is unchanged. Compile-time `net-backend-virtio` selection excludes the FIFO storage, provenance flag, and unit from Pi; Pi root V23, linked-runtime, legacy/non-VirtIO, ordinary console-failure, critical/fatal, and fail-stop paths retain their existing raw diagnostic route. Preserve child V17 on QEMU and Pi, schema 1.14, ABI/Ready v3, every scheduling/resource numeric, external response text/order, command/error grammar, timeout/retry policy, workload, evidence record, and report schema. The V32 result is failure evidence for V33, not Stage 03 qualification.
  - V33 Stage 03 CAS-routing repair — preserve the immutable non-claiming run `out/m26e-qemu/stage03-v33-v17-20260814T024137Z` with invocation/source SHA-256 `4c186a1114d06b7fc1744ff49f7553363d49f6924fec9d4fc2a431cebfde94ec`. Its base artifact ID was `sha256:e3f5108fdeb3e4e190a879dd7ec63b7857cbffaf9b1a28bb08badad700ee1cf2`, resolved-manifest SHA-256 `aeb07bd7f8c78a2f070a156817f19d00d1789070feeb18c5cd5f9b61abc312e1`, rootserver SHA-256 `8cdcfb9de60aa91f5e1758ee853e2835fc7c8dc94dc69b443d5c92022d64c508`, CPIO SHA-256 `07f4a9eb864467e98aca709ac7e1bbc6851695adfa8830c841f2d49569d04d5e`, and kernel SHA-256 `8aa06eaf462a87d3aa6c1f8500ad1d1ed5632f5ad8031c5eab53fdd2095257da`. The fixed matrix and seven base `.coh` scripts through `busy_backpressure.coh` passed. `cas_roundtrip.coh` then failed at line 22: its first two 96-byte manifest fragments were incomplete CBOR and correctly returned `OK`, while the third completed a manifest signed by the repository fixture key `207a0678…`; the operational base profile correctly verified against public key `9d96cc26…` and returned `ERR ECHO reason=policy detail=denied ... EPERM`. The gated artifact was built but never target-run: artifact ID `sha256:9391ad8b68ec149909cd9364b723567d1efdd6da801d0acd1331a5bf6def84e3`, resolved-manifest SHA-256 `d043d827ea98f57248d6838b2bff6d56f18fd4ba6fd2250545b5f76a8d66699f`, rootserver SHA-256 `e91855a1814174ddb60d18d7f2c1f3108d92c8610a02714f609e91e25090162c`, and CPIO SHA-256 `ebf9b4d377efd922e1c8c668530c0a7bfa221f971b53d104377ca4bfa74cdd33`, with the same source and kernel. This is a harness trust-profile routing failure, not a target CAS defect or V33 qualification. Keep the operational public key and private signing material boundary unchanged: base QEMU and Pi run only `cas_fixture_signature_rejected.coh`, while the full fixture-positive resume/signature/delta `cas_roundtrip.coh` runs only in the QEMU gated fixture-key artifact. A full QEMU batch is exactly 18 `.coh` scripts plus the fixed matrix, for 19 recorded workloads; a full Pi batch remains exactly 17 `.coh` scripts, with no fixed matrix and no fixture-positive CAS upload. Focused QEMU base is 10 `.coh` plus the matrix, QEMU gated is four common gated scripts plus one CAS fixture script, Pi base is 10 `.coh`, and Pi gated is the four common scripts. The unrelated policy-preflight assertion is not part of the CAS fixture-positive script.
  - V33 target-local policy/replay routing repair — the same Stage 03 selection audit found that `policy_gate.coh` and `replay_journal.coh` still named fixture-populated `/host` children. Their live QEMU/Pi gated coverage uses uniquely named, approved session-local `/queen/ctl` binds from `/proc/boot`: PolicyFS proves missing approval, consumption, applied alias readability, and one-shot refusal; ReplayFS records successful Cohesix control ACKs, matches from cursor zero, and rejects a future cursor. `QUIT` clears the binds, and no Worker, lifecycle, provider, or predefined-host state is created. The intended bounded audit and decision records remain same-boot state.
  - apps/root-task/src/{event/mod.rs,serial/mod.rs} + focused root regressions + configs/{root_task,root_task_regression}.toml + exact coh-rtc oracles + canonical docs — advance only selected-QEMU root-control provenance to `m26e-qemu-root-single-byte-routine-audit-drain-candidate-v34`. Preserve the immutable non-claiming V33/V17 Stage 03 run `out/m26e-qemu/stage03-v33-v17-20260814T031936Z` and source digest `sha256:6e5a11b51a744d584a1d839421a047b21bd2093aa2d4840ecee2797100ca668c`. Its base artifact ID was `sha256:33007af1046bbf1bb4b09a60182104f5224d807e1f17c2c3ad0929f5675af238`, with rootserver SHA-256 `7c4a8eaca8aba695a3aefd294e06379d831f5d2b8719627a08a5342a6df398ef`, resolved-manifest SHA-256 `aeb07bd7f8c78a2f070a156817f19d00d1789070feeb18c5cd5f9b61abc312e1`, CPIO SHA-256 `af683916fdbd2eba0bf6eca3c3e3e15613482484933ea763dcfbaf941441c938`, and launch-record SHA-256 `0ea06f80a124dd474215e04214587236b504e65a15ea2dbdd3726d8e9883345b`. Its gated artifact ID was `sha256:de3a14760a8d6df84c69f24e289f0c51f54de16a4802d6ec880b9358e5055dbb`, with rootserver SHA-256 `11460ae9449bcaa6a6ff462dc0f00ea58f454e09f101a630f9e41a46dfdb80d1`, resolved-manifest SHA-256 `d043d827ea98f57248d6838b2bff6d56f18fd4ba6fd2250545b5f76a8d66699f`, CPIO SHA-256 `de7bf9c197b39fc17325c2c0b36288f553d6f42e83a3ad1a89e3fb606acc7c01`, and launch-record SHA-256 `b452eb2f1a671928899d711bf82d83c0e9506d21ffe411c195ae44eaa717fdde`. The fixed matrix passed 7/7, then `boot_v0.coh` and `9p_batch.coh` passed. Immediately after the final successful QUIT audit and before `host_absent.coh` could authenticate, root-emergency fail-stopped. Exact same-base-artifact GDB evidence at `out/m26e-qemu/v33-post-9p-critical-gdb-20260814T035000Z` captured root-fault classification at `commit_root_fault_suspend` with task index `0`, timeout badge `0x26ee0001`, and seL4 Timeout label `5`, proving root-control exhausted its temporal budget; the emergency and `host_absent` failure were downstream. V34 changes only selected-QEMU routine-audit physical TX: each eligible final-idle `RoutineAudit` Operator visit may transmit at most one byte, while the complete record and its audit-only provenance tag remain retained across later visits until the record drains. Response, stream, input, retained-output, containment, `NetEvent`, `NetLine`, display, and ordinary serial priority are unchanged. Preserve Pi root V23, child V17 on QEMU and Pi, root-fault V6, schema 1.14, ABI/Ready v3, every timing and resource numeric, external response text/order, command/error grammar, timeout/retry policy, workload, evidence record, and report schema. This V33 result is failure evidence for V34, not Stage 03 qualification.
  - compatibility and promotion gate — the complete host-tool suite, including `coh`, `cohsh`, `coh-status`, Hive Gateway, SwarmUI, `gpu-bridge-host`, `host-ticket-agent`, `host-sidecar-bridge`, `sidecar-bus`, and `cas-tool`, plus every `.coh` script, `tools/cohesix-py`, `scripts/m26e_qemu_pressure.sh`, and `scripts/rest_perf_harness.py`, continues to consume unchanged external `OK`/body/`END` lines. Historical V34 changes only selected-QEMU private routine-audit physical-TX granularity. The reopened M20f restoration below changes only `cohsh` pooled attachment bookkeeping: a cold, disconnected, reset, or changed exact authority still performs the existing authenticated wire ATTACH, while later logical leases for the same attached role and normalized ticket allocate host-local session IDs without another wire ATTACH; pooled QUIT remains a no-op. These changes alter no public `/log/queen.log`, grammar, response order, timeout, retry, namespace authority, Python contract, benchmark workload, evidence record, or report schema, so the other host-tool and library implementations and schemas require no compatibility edit. The Stage 03 CAS script selection changes only which declared trust profile exercises each existing signature outcome. Existing `scripts/cohsh/9p_batch.coh` remains the direct unchanged-log oracle and must receive exact ordered `batch-1|batch-2|batch-3`. The fixed one-socket QEMU matrix must return HELP `15 + OK`, NETSTATS `19 + OK`, first-call selected-QEMU SMP activity `16 + OK`, and CACHELOG `9 + OK`, then PING and QUIT without retry or reconnect and within the preexisting client timeout. The authenticated oversize regression must then receive exact `ERR FRAME reason=invalid-length`, drain the declared body, complete QUIT, and observe EOF on that same connection with no retry or reconnect. A refused CAT/LS/TAIL/LOG must likewise emit its exact typed ERR and then complete QUIT plus EOF on the same connection, with no retained provisional ordinary stream, retry, or reconnect. The internal 1920-record CACHELOG ring capacity remains an implementation bound, not a separate 1920-record/five-second promotion gate. The Stage 03 base boot runs the fixed matrix before its operational `.coh` group; it excludes fixture-only `scripts/cohsh/host_sidecar_mock.coh`, because operational `/host` begins `unavailable source=none` with no predefined units until an authenticated host snapshot populates it. Isolated `policyfs` and `host_sidecar_policy` fixtures retain restart approval/EPERM/consumption coverage without producing live host evidence. A missing, duplicate, reordered, or unexpected body or terminal line, public-log contamination, timeout, retry, reconnect, fixture-selection leak, multi-byte routine-audit TX visit, lost record, lost audit-only tag, or extra pooled wire ATTACH/QUIT fails Stage 03. The V34/V18 requirement is retained as historical failure chronology. Fresh V35/V18 exact-artifact evidence must prove standard-fault terminal containment and root budget-exhaustion natural-postponement liveness/isolation; it must not expect a root-control `Timeout` teardown. Stage 03, REST, performance, and Milestone 26e promotion remain withheld until those gates and all later applicable stages pass.
  - V34 Stage 03 telemetry-fixture repair — preserve the immutable non-claiming run `out/m26e-qemu/stage03-v34-v17-20260814T040349Z` (full identities archived). The fixed matrix and ten base scripts passed, then telemetry_ring line 56 expected ELIMIT but received OK CAT: the ticket had no explicit bandwidth quota and its rate window could elapse during TAIL. This was a timing-dependent fixture, not a deterministic quota oracle. Replace only the short-lived pre-workload denial ticket with an otherwise scoped, bootstrap-signed `bandwidth_bytes=8` fixture, prove CAT `ELIMIT` immediately after the existing write `EPERM`, then detach; retain the existing operational ticket and complete wrap workload, and remove the late timing-sensitive CAT. The gated artifact ID `sha256:b71799152fed6e06124a62933d256b22f4091557abf79c71c671168bbe2dcece` was built but never target-run. This repairs only script authority and its structural oracle; it changes no target implementation, manifest, generated artifact, public log, quota semantics, timing, workload payload, grammar, or acceptance boundary, and the run remains failure evidence rather than Stage 03 qualification.
  - V34 Stage 03 pooled TCP safety restoration — cite discovery task `m26e-console-network-service-isolation` together with Reopened Milestone 20f task `m20f-cohsh-tcp-pool-safety`, whose existing contract requires logical pool leases over one locked TCP owner without extra ATTACH/QUIT. Preserve the failed staged run `out/test-plan/m26e-console-qemu-v34-v17-20260814T063134Z`. Stages 01–02, the fixed matrix and nine scripts passed; session_pool failed during its ordinary baseline, before short-write injection. Commit `a8a692da7e` had turned 24 logical pool leases into redundant wire ATTACHes. Replacement connections accepted TCP but returned no AUTH response; no target fault established the close cause. Stage 03 did not complete and the gated image was never booted. Full attempt/artifact identities remain in the archived record. Restore the M20f/M25f contract in `PooledTcpTransport`: validate and normalize every requested ticket; when the live attached connection has the exact cached role and normalized ticket, allocate only a distinct host-local logical session ID; otherwise perform the existing real ATTACH so cold start, reset, disconnect, or changed authority remains target-proven. Keep pooled QUIT a no-op. The deterministic listener regression must prove one AUTH plus one ATTACH across 24 exact-authority logical leases, deterministic 25th-lease exhaustion, a subsequent PING, a second real ATTACH for changed normalized authority, and zero pooled QUIT. QEMU artifact v2 must also reject a duplicate or incomplete file inventory and content-bind all eight packaged host executables before any exact-version host-tool result. Fresh same-boot Stage 03 evidence must then prove no redundant pool ATTACH churn before the intentional short write, exact reconnect recovery, `expected=64 observed=64`, clean QUIT/EOF, and all remaining groups. The mixed old-target/current-host replay that later fail-stopped before reaching this workload is non-claiming diagnostic evidence only. This host-only restoration changes no target, wire grammar, target ATTACH semantics, timeout/retry policy, workload, evidence record, or report schema and introduces no target counter, delay, or clock dependency; QEMU's 24 MHz and Pi 4's 54 MHz generated timer truth remain unchanged, while fresh Pi execution remains separately required for Pi acceptance.
  - apps/console-network-runtime/src/lib.rs + configs/root_task*.toml + exact coh-rtc oracles + canonical docs + focused real-stack runtime test — advance the common child to `m26e-qemu-console-received-progress-retention-candidate-v18`. Preserve the failed canonical Stage 03 state `out/test-plan/m26e-console-qemu-v34-v17-poolfix-timerfix-20260814T092311Z`, resumed attempt `20260814T094657.522207Z-26353-639b8740c198`, and source digest `sha256:e69fb97d01a4199c77ff7f44b4a071d73e615a9d36e0f8013422545decbd0e62`. Its base artifact ID was `sha256:61453059dcc4f6eb91ee636e4eb3a7f52cb7ad056b90b640e0ffe7348e32eead`; its built but unbooted gated artifact ID was `sha256:f0b27ffef079cd5494d19e12e12797d969d1b050a55b514e668cd4c093d114a1`. The canonical QEMU 10.1.0 resume passed the fixed response matrix 7/7 and `boot_v0.coh`. `9p_batch.coh` then completed three writes, exact ordered CAT, and authenticated oversize `ERR FRAME reason=invalid-length`, but line 15 QUIT timed out with no response. The target logged the exact frame error and no root-emergency, fail-stop, panic, or unhandled fault. V17's Session unit retained `PollService` only after committing an outbound wire frame; consuming a bounded fragment of the already-buffered oversize body without such a commit returned `Complete`, cleared child scheduler `service_pending`, and blocked even though later body bytes and QUIT remained in the smoltcp receive queue. V18 treats every nonzero successful socket receive as durable private progress: Session returns `Continuation` and retains one fresh `StackIngress -> StackEgress -> Session` cycle; only a Session unit with zero received bytes and no committed wire frame returns `Complete`. The focused `buffered_oversize_body_and_quit_retain_service_until_same_connection_parse` two-stack regression buffers an oversize body plus QUIT together, proves at least four bounded Session reads progress with no fresh packet/control notification, parses QUIT on the same authenticated connection, and then quiesces on the first zero-progress cycle. Add no poller, synthetic wake, retry, timer, delay, or clock-speed assumption. Preserve QEMU root V34, Pi root V23, root-fault V6, schema 1.14, ABI/Ready v3, all timing/resource numerics, page/cap/badge layouts, grammar, response order, timeout/retry policy, workloads, evidence records, and report schemas. Because this is common child code, QEMU and Pi select V18 provenance; QEMU evidence cannot substitute for a fresh Pi build and hardware run at the generated 54 MHz timer truth.
  - V18 packaging-oracle closure — `tests/test_console_network_runtime_packaging.py` independently requires the exact `committed_wire_frame || received != 0` result after receive admission and after complete-send/commit ordering. Fresh Stage 01 attempt `20260814T102527.190708Z-45453-417ba8e027f2` passed 17 actions, then exposed only the stale V17 return-expression oracle after 1,773 Python tests and 7 subtests passed. The corrected focused file passed 11/11 and the complete standalone Python gate passed 1,774 tests plus 7 subtests. This host closure is not Stage 01 qualification; use a fresh state and source identity.
  - common root-control adjacent-refill temporal restoration — cite discovery task `m26e-console-network-service-isolation` together with the reopened Milestone 25 root-service temporal-restoration authority carried by `m26e-root-tcb-target-proof`. Preserve the immutable non-claiming V34/V18 staged state `out/test-plan/m26e-console-qemu-v34-v18-oraclefix-20260814T104728Z`. Stages 01–02, the fixed matrix, all ten base scripts and telemetry_ring passed. After telemetry_push_create's expected invalid-path denial, the connection closed; replacement connections returned no AUTH response and line 26 could not run. Stage 03 remained failed. Exact source/base/gated artifact identities and the failed attempt are archived.
  - exact immutable replay of that V34/V18 base artifact proves the adjacent-refill cause and bounds the restoration. The retained root-control timeout followed the Network Timer unit's outer Yield; the timer-trace branch did not execute. The current 38,090-tick refill was exhausted while an adjacent 93,910-tick refill was already valid (5,500 us total at QEMU's 24 MHz). Installing a terminal timeout endpoint converted that boundary into fail-stop. This does not falsify child V18, timer arithmetic, grammar or host behavior. Exact fault registers and artifact identities remain archived. Advance the selected QEMU root only to `m26e-qemu-root-adjacent-refill-natural-postpone-candidate-v35` and the selected Pi root only to `m26e-pi4-root-adjacent-refill-natural-postpone-candidate-v24`. Both root-control records select `NaturalPostpone`: retain the generated timeout cap, badge, resource, and registry identity, but omit the TCB timeout endpoint so current-refill exhaustion postpones onto the already-valid adjacent refill. The standard fault endpoint remains installed and terminal. Preserve QEMU/Pi root budgets, periods, deadlines, WCETs, response bounds, priorities, MCPs, refills, cores, reserves, timer clocks (`24 MHz` QEMU and `54 MHz` Pi), every other resource numeric, root-fault V6, common child V18, supervisor V15, schema 1.14, ABI/Ready v3, page/cap/badge layouts, grammar, response order, timeout values, retry policy, workloads, evidence records, and report schemas.
  - V35/V24 compatibility and promotion gate — this common root-control scheduling-policy repair changes no public schema, API, wire frame, namespace, command, ACK/ERR/END contract, workload, retry, client or protocol timeout, host-tool implementation, `tools/cohesix-py` contract, benchmark implementation, evidence record, or report schema. The complete cross-surface review covers `coh`, `cohsh`, `coh-status`, Hive Gateway, SwarmUI, `gpu-bridge-host`, `host-ticket-agent`, `host-sidecar-bridge`, `sidecar-bus`, `cas-tool`, every `.coh` script, `tools/cohesix-py`, `scripts/m26e_qemu_pressure.sh`, and `scripts/rest_perf_harness.py`; no hand-authored compatibility edit is required outside canonical truth and generated target policy. Fresh exact V35 QEMU evidence must pass boot, fixed matrix, the full `.coh` regression harness including the V34/V18 failure sequence, root standard-fault terminal handling, root budget-exhaustion postponement/liveness, complete staged QEMU acceptance, Hive Gateway REST core/parity and Python smoke, the complete exact-version host-tool suite, the Python library gate, Conditional B2 exact-three executable target pressure, and the companion Conditional D host-model gateway matrix before promotion. QEMU evidence cannot qualify Pi. Fresh V24 Pi proof must use a regenerated `54 MHz` Pi profile, exact build and media identity, flash/readback, cold boot, the complete applicable Pi staged/hardware path, standard-fault terminal handling, root budget-exhaustion postponement/liveness, operator and driver coexistence, host-tool/Python compatibility, and a Pi-selected target-performance path; Conditional D is only companion host-model gateway evidence. Until both exact targets pass their own gates, V35/V24 are selected candidates and the V34/V18 run remains failure evidence only.
  - Stage 04 REST operation-deadline restoration — cite active discovery task `m26e-console-network-service-isolation` together with Reopened Milestone 24e tasks `m24e-rest-client` and `m24e-cohsh-rest-transport`, Reopened Milestone 25 task `m25-smp-rest-regression-batch`, and only the deadline-composition portion of Reopened Milestone 25f task `m25f-gateway-broker-refactor`. The fresh V35/V18 staged state `out/test-plan/m26e-console-qemu-v35-v18-full-20260814T134855Z` passed Stages 01–03, including the fixed matrix and all 18 scripts. Stage 04 passed REST boot_v0 but observe_watch line 8 failed with a gateway transport error. QEMU remained responsive and the gateway retained one upstream connection/ATTACH without target faults. Exact source, artifacts and attempt identities remain archived. The Rust REST client had a three-second operation deadline even though the gateway may legally wait `5,000 ms` for broker admission plus up to the larger configured control/telemetry broker response deadline plus `5,000 ms` for HTTP response delivery. Define the client filesystem-operation response window as `5,000 + max(control_response_ms, telemetry_response_ms) + 5,000`; the canonical `120,000/120,000 ms` gateway therefore requires `130,000 ms`. Keep metadata, DNS resolution, connect, and response-body transfer separately short. Apply the composed window to the shared `GatewayClient`, the primary and every pooled `cohsh` REST transport, the Stage 04 Python smoke, and Stage 04 readiness/core/parity calls. Stage 04 must configure and retain the local gateway's two broker deadlines, or require an external gateway to declare both; an explicit client window below the composition fails before execution. This repair changes no HTTP endpoint, request/response schema, target wire frame, command grammar, ACK/ERR/END meaning, namespace, authority, Stage 04 concurrency, pool size, workload, retry policy, performance error budget, or performance report schema. Compatibility review covers the eight packaged host executables (`cas-tool`, `coh`, `cohsh`, `gpu-bridge-host`, `hive-gateway`, `host-sidecar-bridge`, `host-ticket-agent`, and `swarmui`), `tools/cohesix-py`, and `scripts/rest_perf_harness.py`: shared Rust consumers inherit the safe default; `cohsh` additionally exposes the checked override; the Stage 04 Python caller supplies the same explicit window without changing the library's public default or retry policy; and the performance workloads, no-retry semantics, and report schema remain unchanged. This is a host deadline-alignment repair, not new Stage 04 acceptance; rerun Stage 04 and every later applicable gate against a fresh source-bound artifact.
  - Stage 04 runner-environment provenance restoration — preserve exact state `out/test-plan/m26e-console-qemu-v35-v18-rest-timeout-enumbound-20260814T150747Z` passed REST core/parity and Python behavior, but finalization recorded stale-inputs: seven runner-owned URL/deadline exports changed the context while source, toolchain, actions and dependencies stayed fixed. This was provenance self-mutation; Stage 04 was not qualified and Stage 05 did not run. The exact initial/final contexts and result hashes are archived. Before exporting any endpoint, deadline, auth, or FUSE helper selector, capture the exact inherited set/unset state and value of every Stage 04 runner-owned variable. Restore that snapshot before normal `tp_stage_complete` and before failure/cleanup delegates to `tp_stage_exit_trap`, preserving inherited values rather than merely unsetting them. Focused regression `test_stage4_restores_runner_owned_environment_before_final_context` must prove both finalization paths restore an inherited URL exactly, remove runner-created selectors, and retain the existing timeout composition. A fresh source-bound Stage 04 run is still required.
  - Stage 04 immutable PASS and Stage 05 due-diligence selector isolation — preserve exact state `out/test-plan/m26e-console-qemu-v35-v18-rest-timeout-envrestore-20260814T154759Z` passed Stage 04 with identical initial/final contexts, the 130,000-ms composed response window, REST core/parity and Python smoke. This is exact-source QEMU REST PASS only. Stage 05 then failed stage-01-attestation because DD_GATE_LOG_DIR and the two DD_REUSE_STAGED_EVIDENCE selectors entered the verifier's earlier-stage context; source/toolchain/actions/dependencies were unchanged and no later gate ran. Exact records are archived. Keep the reused-stage verifier direct. `test_plan_evidence.selected_environment(scope, stage)` now records `DD_*` controls only for Stage 05 and ignores them for Stages 01-04, where they do not govern behavior, while each context continues to bind its applicable `TP_*` selectors, toolchain, source, and target. Focused regression `test_due_diligence_selectors_bind_only_stage_five_context` passed; the complete evidence suite passed 30 tests plus 5 subtests, and the complete due-diligence lifecycle suite passed 27 tests plus 2 subtests. Stage 05 and full acceptance remain open pending a fresh all-stage run.
  - CAS host-tool capacity-projection restoration — cite discovery task `m26e-console-network-service-isolation` together with Reopened Milestone 17 task `m17-cas-regressions` and Reopened Milestone 24e task `m24e-cas-tool-rest`. The exact historical QEMU state `out/test-plan/m26e-console-qemu-v35-v18-rest-timeout-ddscope-20260814T163813Z` passed all five stages for source `sha256:ea8bc5458e4ccbbcd1ecb2731030b66e7ec05782750534c0bf4a683a3fba9b60`: Stage 01 passed `21/21` with manifest `sha256:4320add56bd34ce7c4461507703eb6be4a22ee44b70424c4a8f5dedb5acc1f5f`; Stage 02 passed `2/2` with manifest `sha256:c9ae96134c2d2e2211c51e4524a98f1f6aa0654b75130a8ac5e596ef42ac6c03` and resolved manifest `sha256:72b6fdbd175150ec352f9345d99791a1d576cf01de47363aed2a64ad0c463a93`; and Stage 03 passed its full 19-workload selection (fixed matrix `7/7` plus 18 `.coh` scripts). Stage 03 bound manifest `sha256:71092307be0d3501b47b12191604d698656fcb773007ede12fda798ae961499d`, aggregate `sha256:b65136f01a90d0f06ba192cdfe7252a29dff5e5f113d72f613a2d6609dc4976e`, base artifact `sha256:2491dc27b6b27a939b4427742c517405376516c27fbcb00962da03f1036f3012`, and gated artifact `sha256:1b0345bc385ef50480a439fb274e72f11877e40ef70f9ce5bae58ca00bd9939e`. Stage 04 passed REST core `3/3`, parity `1/1`, and Python smoke with manifest `sha256:f0c960c1a4b4103b851b71fb928fa54a5c96b30a43abf35558d3c9bf81456bee` and result `sha256:a8cd9ded3369ba74daf4e21bdad144a1d49eba3eb8a92e6d13d069836fb3d246`; Stage 05 passed with manifest `sha256:f03756e37da6eaef8edea929da5512144d80f4608a4b7296c486b12dabeceb88`.
  - The exact-version post-pass under `out/host-tool-postpass/ddscope-stage03-20260815` then found the first later failure in the gated `cas-tool` REST upload. The packaged tool, gated artifact, host template, payload and manifest digests are retained in that run and the historical archive. The retained `tests/fixtures/traces/trace_v0.trace` is 1,073 bytes and the documented zero-padding produced 1,152 bytes, or nine 128-byte chunks. Manifest-v1 has always admitted at most eight chunks; the target correctly accepted the first eight and refused digest `247fbe6cb8e8f54887478fb4b4ffc1c8ca21324c5b0640db57fe638c0023196f` with typed `ERR ECHO reason=quota detail=buffer-full`. The packer and generated host template had not projected or preflighted that bound. Therefore the five-stage record remains valid only for its exact source and staged workloads; it does not close the later host-tool gate or qualify changed source.
  - Restore one shared `cohesix-cas` maximum consumed by the compiler, both target CAS implementations, and `cas-tool`. The generated host JSON template projects tooling-only `limits.max_chunks = 8` plus `limits.max_payload_bytes = chunk_bytes * max_chunks`; neither key is serialized into the unchanged eight-field CBOR manifest-v1 wire. A legacy template with no `limits` falls back to the shared eight-chunk maximum, while an explicitly present maximum must equal the shared value exactly and its byte capacity must match the selected chunk size. `--chunk-bytes`, when supplied, must equal the selected template rather than overriding it. Pack rejects over-limit input before creating a bundle, and upload rejects an over-limit legacy or foreign manifest before reading chunks or opening TCP/REST. These structural preflights do not reserve the independent bounded target store, which may still return typed `buffer-full` when other chunks or models consume global capacity.
  - Conditional B retains the full trace unchanged for replay and as the exact `1,073 -> 1,152` byte, nine-chunk negative pack preflight. It adds the 359-byte source fixture `tests/fixtures/cas/max_chunks_v1.txt` at `sha256:7f97db91e95d67b8cdd7baa194c563e2a03f94045a4e5c3282b4bb8e7fc3fda1`, packaged byte-identically as release `cas/max_chunks_v1.txt` with its digest sidecar. Extend that whole separately named fixture to exactly 1,024 bytes with the documented deterministic nonzero tail and require eight distinct chunk digests for the positive pack/upload lane; do not truncate or relabel the trace. This restoration changes no target capacity, namespace, ACK/ERR/END grammar, retry, timeout, authority, Python API, benchmark workload or report schema, evidence schema, root/child provenance, manifest schema, QEMU 24 MHz truth, or Pi 54 MHz truth. The host-only Python wheel checks are not target Python evidence; Conditional D host-model comparator execution and formal Python target projection remain withheld after the first Conditional B failure. No Pi image, boot, or hardware test ran, so QEMU cannot qualify Pi. Fresh exact QEMU artifacts and the complete staged, eight-tool, Python, and Conditional B2 executable-pressure post-pass are required; Conditional D remains separately scoped, and Pi acceptance remains a separate fresh 54 MHz build/media/boot/hardware and target-performance lane.
  - Conditional D population-authority restoration — cite active discovery task `m26e-host-worker-integration` together with Reopened Milestone 25f task `m25f-harness-large-scenarios-no-retry`. The retained `cas-capacity-releasefix-stage03-20260815` source passed all five QEMU stages and the exact-version CAS/host/Python post-pass. Conditional D then requested host-model population against a live console projection with one generated Heartbeat slot: the first spawn succeeded and the second returned Busy before measurement, with no gateway retries. Its immutable Worker-slot canary independently reproduced one live Worker and the refused second mutation. Full source/artifact/canary identities are archived. This is `WorkerSupervisorError::SlotBusy` before `TARGET_HANDOFF`; it does not authorize policy restoration, handoff repair, target-capacity growth, Busy retry, or wire-error remapping.
  - Restore the benchmark owner boundary before population work. `scripts/rest_perf_harness.py` must require exact connected `backend_class=host-model` for synthetic high-count host-model population and reject `console-projection`, unknown, missing, malformed, or unreadable backend metadata before `/worker`, `/actions/queue`, `/queen/ctl`, or the benchmark start marker. Conditional D keeps its 24-to-120 population, operation weights, random-input policy, no-retry semantics, broker deadlines, 1200 ms gateway retry window, 1% error budget, and report schema, but runs each scenario against a fresh exact packaged Hive Gateway with the explicit in-process host model. Its report must retain `backend_class=host-model`, `proof_class=host-model`, no population cap, and the configured endpoint observed. Read-only `--mode perf` records the actual gateway backend without applying synthetic-population admission and does not derive QEMU or Pi proof from a console projection. Conditional B2 remains the distinct accepted-QEMU exact-three executable lane. The independently generated QEMU and Pi role maps currently both contain one Heartbeat, GPU, and LoRA slot, but their manifests, gateway contracts, and target evidence are distinct; a QEMU gateway or QEMU acceptance validator cannot qualify Pi. Pi remains a fresh Pi-selected 54 MHz build/media/boot/hardware and performance lane. This repair changes no target code, target capacity, public HTTP/console/NineDoor schema, namespace, ACK/ERR/END meaning, timeout, retry classification, Python API, generated target manifest, or benchmark report schema.
  - The first managed-host-model canary retained at `out/bench/perf-backend-managed-mock-canary-20260814T2030Z` proved the owner boundary and four synthetic Workers, then exposed the next exact comparator defect. One 381-byte Worker observation exceeded the inherited 256-byte TAIL ceiling; the gateway correctly refused it. The canary failed its 1% budget with 1/12 errors and no broker exhaustion or retries. This is benchmark input drift, not target, pressure or capacity failure. Advance only the Worker telemetry read ceiling to the existing complete-state bound `8192`, make `--tail-bytes 8192` explicit in every Conditional D command and retained report, and state that revised results are not directly comparable to historical 256-byte Worker-tail runs. Keep the request single-attempt and leave the schema, response bytes, operation weight, ramp, timeout, retry, error budget, and report schema unchanged; do not truncate the record or copy the adaptive Queen-log path. The focused 81-test suite passed, including exact-record, path and endpoint cases. The repaired `managed-mock-tail8192` canary then passed 12/12 with zero errors/retries, recording host-model proof and tail_bytes=8192. Its complete summary and digest remain archived. These are repair diagnostics, not final Conditional D or target acceptance; rerun complete source-bound acceptance and all four canonical scenarios.
  - The first full revised `telemetry-1mb` comparator retained at `out/bench/conditional-d-tail8192-diagnostic-20260815/telemetry-1mb` used the canonical revised workload. Worker telemetry passed 360/360, but 643/7,636 operations failed after host schedule/lease mirrors filled their 8,192-byte readback bound; target mirrors already rotated complete records. Exact gateway, summary and log identities are archived. Restore exact host/target parity in the shared schedule/lease/export mirror helper: reject only one individually oversized record, otherwise evict oldest complete mirror records before append, without changing the independent queue/list/window capacities, payloads, weights, retry classification, or error budget. The same failed report observed only `114/120` Workers because elapsed-time interpolation never began the configured endpoint before the run ended. Compute ramp progress so the configured Worker/intensity maximum is held for the final ramp interval; endpoint observation remains a qualification requirement. This diagnostic supplies no QEMU or Pi evidence and the remaining three scenarios were correctly not run after the first failure.
  - The repaired full-matrix diagnostic retained at `out/bench/conditional-d-tail8192-rolling-endpoint-diagnostic-20260815` passed the aggregate budgets for all four scenarios at the 120/120 host-model endpoint, with tail_bytes=8192 and no gateway retry/exhaustion events. However, strict_control_errors=false could classify bounded refusals as success. This is diagnostic evidence for the rolling-mirror and endpoint repairs only, with no QEMU/Pi or final exact-source claim. All scenario counts, identities and summaries remain archived. Final Conditional D commands therefore add explicit `--strict-control-errors`, require `report.workload.strict_control_errors=true`, and must rerun all four scenarios under that named comparator revision. Together, strict handling and `--no-retries` ensure a returned refusal is counted once without harness replay or success reclassification; the separately configured and reported 1,200 ms gateway control-write window remains unchanged.
  - The strict four-scenario Conditional D diagnostic retained at `out/bench/conditional-d-strict-rolling-endpoint-final-20260815` kept `strict_control_errors=true`, `no_retries=true`, `backend_class=host-model`, `proof_class=host-model`, and observed the configured `120/120` endpoint. All four aggregate error budgets passed, but the first two scenarios misclassified 43 and 70 schedule-capacity refusals as generic HTTP 503 instead of buffer-full. Interval-budget crossings and all scenario measurements remain in the original summaries. Aggregate `report.reliability.error_budget_pass` remains the scenario verdict and interval crossings remain diagnostics, but the required lossless bounded-refusal classification did not pass. The matrix is therefore diagnostic and non-qualifying. The locally present release gateway was SHA-256 `e4a1a57ad868536b25ad17d9bfdabed7a7dd53b1a2d6d733515ca34835d56188`, but the summaries contain no source, Git, or gateway-binary identity and cannot establish exact-source Conditional D provenance.
  - Restore only the exact in-process `NineDoorError::Protocol { code: TooBig, ... }` schedule, lease, and export capacity cases to the canonical `ERR ECHO reason=quota detail=buffer-full path=<path> error=buffer full`; retain the typed source error and leave unmatched paths, messages, and error codes generic. Hive Gateway preserves that canonical semantic refusal as HTTP `200` with `GatewayResponse.status=ERR`. Conditional D's joint strict-plus-no-retries handling counts each returned refusal once and performs no harness retry; the gateway's independent bounded retry window, cooldown, and counters remain unchanged. This changes no HTTP field, response-code catalog, NineDoor or console grammar, capacity, operation weight, workload, report schema, or error budget.
  - The following staged attempt retained at `out/test-plan/m26e-console-qemu-v35-v18-strict-perf-final-20260814T214011Z/evidence/attempts/stage-01/20260814T214030.244940Z-23431-989e20fcd8a5` passed actions 1–20; action 21, host.rust-risk-ratchet, stopped with exit 130. Exact source/context, action-record, log and failed-stage digests remain in that retained attempt and the historical archive. Stage 01 emitted no pass attestation; Stages 02–05 and exact-source Conditional D did not run. Nothing from this state may be reused as staged or Conditional D PASS evidence.
  - M26e production-surface release-truth closure — the strict release input-set check introduced with compiler-owned `configs/generated/root_task_topology.json` rejected the canonical source because `[release].generated_configs` omitted that tracked as-built topology while requiring an exact generated-directory set. Under active task `m26e-production-surface-truth-and-stub-retirement`, package the topology beside the resolved manifest and lock its selection in the release-manifest regression. Do not weaken the exact-set check, add a redundant topology sidecar, or rewrite historical bundles. This inventory-only correction changes no runtime, target image, protocol, host-tool, Python, benchmark, QEMU, or Pi behavior, but it must precede fresh source-bound acceptance so later release repair cannot invalidate the staged source identity.
  - Pi exact-a7 isolated-console cadence and current-contract correction — cite the same exact `a7dfa38b42beddfe5fa353ed8b5cbd0803212635` source, `ac42859d4aa14b7b0d4894b077dd3b8bb85b37fc397a6fab0e3a763a8d0de9c8` image ID, `ae43686674df7e01f25f12b7e693f535f8ebe8f943ea025c04ceb801e928396e` image SHA-256, `4231476a82e8cef643a26ac5fa126d1c6cae06d76fba09693af8dd2964d1195b` manifest, exact serial boundaries, and boot-paired `20260828-192427` captures under this task as well as `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`. Functional WiFi TCP with 118.198-166.825 ms SYN response, 237.421-290.250 ms command response, about 3.2 KiB/s output and post-flush exhaustion 20 proves a root/child response-cadence defect rather than packet loss; 30/30 internal USB byte conservation without timely visible WiFi echo, versus healthy same-image GENET echo, separately proves presentation-arbitration debt. Preserve the target-falsified ordinary isolated lower rotor exactly one unit per Network visit. Only a nonzero retained response cursor whose identity matches both current active and authenticated connection may retain the root's already-guarded activation for its next separately charged useful response turn, and only after actual Network activity plus exactly one service-turn advance; stale identity, no progress, containment, quarantine, recovery, reboot, or operator rotation stops it. This is not a multi-unit child burst and changes no one-op/two-frame/fixed-byte charge, 8/16 response bound, ordinary debt, manifest or MCS numeric, child authority, physical-input priority, QEMU direct-VirtIO path, or external grammar. A partial local-seat line must take one bounded `Dispatch -> Display -> Serial` path before Network while retaining the immutable CYW43 parent/operator fence; a reboot acknowledgement or physical response tail retains immediate Serial priority and leaves echo queued. Reconcile current generated truth atomically: schema remains 1.15, console ABI and Ready identity are v5, and the convergence catalog rather than the generated TEST_PLAN table is edited before regeneration. Historical ABI v2/v3/v4 chronology remains evidence for those candidates, not current selected truth. At that exact-a7 chronology point, Direct-GENET diagnostic v2 kept the exact 192-byte layout while offset 108 reported cumulative physical-level DPC adoption and the `genet_direct_dpc` row added `level_adoptions`; the later exact-5f current contract below supersedes it with diagnostic-v3 raw receive-boundary evidence, the eleven-row focused fixtures, and the authenticated peer-driving helper while leaving console grammar, Python, REST, `.coh`, workload, benchmark, report-schema, generated-profile, and build/manifest consumers unchanged. Host/source/QEMU/image results cannot claim Pi latency, throughput, visible echo, WiFi/GENET parity, or acceptance; fresh exact-image dual-mode hardware evidence remains authoritative.

Checks: malformed packets/auth frames fault or fail inside the child; its active
SC stays inside the generated `3000 us / 10000 us` budget/period and selected
natural-postpone policy; historical ABI v2/schema 1.12 retains the
publication-ACK transition, ABI v3/schema 1.13 added only the bounded binary
SendBatch control, and selected schema 1.14 adds the manifest-owned
console-child `NaturalPostpone` choice. V35 and Pi V24 additionally select the
same kernel-native policy for root-control while preserving every numeric and
external contract. V34 preserves V33/V32/V31/V30/V29's bounded synchronous capture, V27
response scheduling, and V28's terminal-response Disconnect fence while
retaining V30's selected-wrapper delegation and V31's failed-producer
retirement; V16 changes only the child
timeout-policy/cadence contract and its derived WCET/response inputs, V17
changes only authenticated oversize rejection and exact declared-body drain,
and V18 retains a fresh private service cycle after every nonzero bounded
socket receive until a zero-receive/no-commit Session unit quiesces.
V34 retains V33's selected-QEMU private routine-diagnostic FIFO and final-idle
serial admission, but permits at most one physical audit byte in each eligible
`RoutineAudit` Operator visit. The complete record and its audit-only tag remain
retained across later visits until the exact `\r\n`-terminated record drains.
Its private capacity-four FIFO still uses bounded drop-new saturation and never
enters public `/log/queen.log`. A stalled UART cannot make ordinary
`SerialDispatch` outrank a newly eligible `NetEvent` or `NetLine`; response,
input, stream, retained-output, containment, network, display, and ordinary
serial priorities are unchanged. The next admitted nonempty ordinary serial
bytes still promote the backlog to ordinary dispatch without changing FIFO or
exact byte order. Compile-time
`net-backend-virtio` selection leaves Pi, linked-runtime, legacy/non-VirtIO, ordinary
console-failure, critical/fatal, and fail-stop paths on their existing raw
diagnostic route. All four
fixed page sizes/offsets, ACK badge 64, and resource numerics remain unchanged; packet/control publication is true commit-last
and bounded to the compact scalar header plus active payload; commit mismatch and
oversized length fail before accepted-sequence advance; inactive padding conveys
no authority; the child receives read-only root-to-child pages and read-write
child-to-root pages only. Target disassembly must show bounded small page-helper
frames, no whole-page aggregate load/store/copy, and a nested stack chain
strictly inside 32 pages. The live QEMU run at source `290ef6028` reached
readiness but failed its first authenticated packet with timeout badge
`0x26ee0007` inside the compiler-expanded 4096-byte `PacketPage` read, followed
by a root timeout before containment-mailbox drain; it is failure evidence and
cannot qualify the repair. The compact-page live run at source `00bf02540`
reached the root prompt and then timed out `root-control` at the console-network
control poll, disproving the v3 combined Network/runtime-IPC phase; it is also
failure evidence. The later live run at source `4d1a47b89` preserved all three
outer phases but timed out in `VirtioTxToken::consume` after queue notify,
falsifying v4's multi-unit Network visit rather than showing a device-completion
wait; it also cannot qualify the repair. The subsequent live v5 run consumed
exactly `3000 us` in `console-network-service` and raised timeout badge
`0x26ee0007` at `Send` after `publish_exchange`, then consumed exactly `2750 us`
in root Recovery and raised timeout badge `0x26ee0001` at the sole outer yield
after containment/quarantine. Those failures invalidate the multi-material child
turn and whole-containment root turn; they are not qualification evidence.
The canonical v6 run used root ELF SHA-256
`0059fd675b476106888d6ca62c8bba21f9b340b9aa607e000fbf96997fd29900`.
Its healthy child remained blocked on notification and no Recovery ran, but
`root-control` consumed exactly `2750 us` and raised timeout badge `0x26ee0001`
at the sole outer yield after a Network visit attempted empty ObserveChild,
no-op StageOutput and Disconnect, then committed and signalled the first
60-byte ARP ingress as sequence 1. This is failure evidence for v6's composed
no-op lower path, not qualification.

Historical QEMU v7–v10 results remain failures. V7 exhausted the first Operator during serial poll/flush; v8 still composed multiple output records; v9 exhausted the initial post-bind refill before copying any FIFO bytes, so it did not prove copy cost or disprove the one-record bound. V10 emitted marker/prompt after the activation Yield but exhausted a fresh Runtime visit; its v3 child separately composed a successor on the residual SC. Complete child containment and healthy NineDoor were observed. These results preserve the activation, serial/output, Network and Recovery distinctions and confer no qualification. Exact ELF/CPIO identities, fault registers and traces are retained in the milestone's historical evidence archive.

A fresh four-core GICv3 QEMU run must pass authentication and the exact
two-session generation-fence canary before separate fresh-boot standard-fault
containment and budget-exhaustion/postponement liveness-isolation injection, the
full canonical `.coh` batch, Hive Gateway pressure
benchmarks, or complete host-tool validation can begin. On one boot, session 1
must authenticate, attach, begin a streamed response, and close with a control
still staged or retained; session 2 must then authenticate and attach. The old
control must complete once without child fault or any byte entering session 2,
and session 2 must receive its own bounded ACK/TAIL/END response while the sole
listener remains live. After root-control
binds its generated SC and timeout endpoint, one universal activation-seam
yield must sacrifice the initial remainder and wait for the next replenishment
before any containment probe or first Operator. Root-control then cycles exclusive
Operator/Dispatch, Runtime/IPC, and Network phases across the sole recurring outer
yield with the exact ownership and adjacency defined above; buffered TCP commands
never execute in the NIC turn, runtime IPC never shares that turn, and physical
input/output remains bounded and live. Each isolated QEMU Runtime visit selects
exactly one persistent unit in the order Worker -> ControlEndpoint ->
BootstrapDrain -> StreamFlush -> RebootTail, commits the successor before the
compact isolated-VirtIO Runtime prelude, and returns to the sole outer yield.
That prelude reads the HAL timebase and performs one timer poll. An observed
tick updates `now_ms`, increments the timer metric, publishes HAL timebase, and
runs the existing conditional timer trace; without a tick, `now_ms` takes the
read timebase. It then reconciles CYW43 network-ready HDMI state and must not
execute the generic Runtime-without-control tail. Worker consumes at
most one pending mailbox operation or checks one retained
Heartbeat/GPU/LoRA role slot; ControlEndpoint performs at most one poll and its
immediate forward; BootstrapDrain takes exactly one staged `Option`; RebootTail
owns its visit. The MCS fault poll is absent from the cursor. StreamFlush uses distinct
visits for its terminal sequence: one visit emits one retained final line and
returns; the next no-line visit performs cursor/bandwidth finalization only and
returns; the third visit emits END only and returns. Every earlier line likewise
uses its own visit. Legacy Pi/non-VirtIO Runtime retains its existing
48-line/16-KiB bound. Each isolated VirtIO Operator must create
one generated `64`-byte serial-I/O credit, share it across every root-context
RX poll and TX flush, and retain unfinished bytes after exhaustion. Entry-time
TX backlog reserves exactly `32` bytes for TX and caps RX at `32`; without
entry backlog RX may consume all `64`. Tests must reject helper-local credit
reset, total service above `64`, pending output starvation under sustained RX,
or application of this cut to linked-runtime/Pi paths. With a nonzero generated
VirtIO serial bound, the Operator must attempt at most one retained output
record and preserve every later FIFO and response-tail record for a later
Operator. Tests must reject a second record attempt or helper-local reset of
that admission; Pi and non-VirtIO turns must retain the existing two-record
attempt limit and prior phasing. Each isolated Network visit must attempt
exactly one internal unit, including a no-op. The persistent lower cursor must
cycle ObserveChild -> StageOutput -> Disconnect -> Ingress -> ServiceTick ->
ObserveChild. Every no-op advances; every successful unit that signals the child
forces the next lower attempt to ObserveChild. A pending compact normal-success
diagnostic emits first, at most once on a non-publish visit, and returns.
Otherwise retained TX preempts the lower cursor, performs no more than two
reclaim checks, atomically attempts at most one TX plus any required notify, and
returns on success or backpressure. Both preemptions must preserve the exact
lower cursor and forced-observe state. The bounded gate must sample successful
attempt sequences 0 through 63 and every 64th eligible success thereafter,
never every post-window TX, while counters remain continuous. ObserveChild may
retain egress but must return without TX. Tests must prove Observe -> TX ->
DeferredDiagnostic before resuming the preserved lower state for a sampled
success, while anomalies remain immediate.
Tests must reject post-publication buffer mutation, completion waiting, duplicate
publication, premature head reuse, or dropped retained egress.
The V18 child must recheck its badge and publication-credit gates between
logical units in retained-first order: completion publication, service-event
publication, egress publication, service-poll continuation, new ingress, then
new control. Exact eligible private `PollService`, `IngestPacket`, or
`ApplyControl` work uses `seL4_Poll`; idle or publication-uncredited work calls
`seL4_Wait` directly with no ordinary `seL4_Yield`. Natural postponement, not a
terminal timeout handler, bounds SC exhaustion. Ready and ordinary wakes grant no credit;
internal work preserves it, and one Publish consumes it before mutation.
Stable empty packet/control hints must retire before their one separate service
cycle so Poll cannot self-loop. Root sets ACK debt only after valid copy, clears
it before post-retention signal, and forces ObserveChild; duplicate/late ACK
fails closed. Revoke parks without publication; graceful shutdown waits for
credit, retires terminal debt without ACK, and starts bounded containment.
Within retained `ChildTurnUnit::PollService`, tests must prove the private
`StackIngress -> StackEgress -> Session` cursor commits before dispatch,
`StackIngress` executes exactly one `poll_ingress_single`, `StackEgress`
executes one `poll_egress`, and both return `Continuation`; `Session` owns the
connection/session RX, tick, TX, close, and relisten work. Any nonzero receive
or committed wire frame returns `Continuation`; only zero receive plus no
commit returns `Complete`, and the kernel clears `service_pending` only after
that `Complete`.
Session output must call `send_slice` only when the socket reports both
`can_send()` and complete-frame capacity. Free capacity in `FinWait2` must
retain the complete output without commit, `OutputDrained`, or error; peer
close must reach exactly one `Disconnected`, clear the ended connection, and
relisten. Established-state complete sends remain covered, and no other
Session backpressure or error is converted to continuation.
Every committed control must retain its nonzero connection identity through
the child reader. Kind and payload validation precede identity disposition.
A well-formed stale identity must advance the exact accepted sequence and
publish `ControlCompleted` without output, `OutputDrained`, or fault; zero-id,
malformed, and matching-current pre-authentication errors remain fail-closed.
After connection 1 ends and connection 2 authenticates, a delayed connection-1
`SendLine` must leave connection-2 output byte-for-byte unchanged, while a
connection-2 control remains applicable. Root must retain the one-slot control
owner across `Disconnected` until its exact completion, and an unauthenticated
isolated adapter must return backpressure so the root stream cursor cannot
advance before lifecycle cleanup.
An error or coalesced badge cannot skip the one-unit/refill Yield boundary or
falsely complete PollService. Retained publication must force a blocking Wait
until explicit ACK credit; eligible internal work may Poll after Yield. The isolated QEMU
VirtIO Operator must also prove that the first bounded priority pass returns
before its repeated tail when the exact serviceable-work snapshot is empty,
while any real serial/local-seat/authenticated-line/output/barrier/reboot or
attached display/attach work prevents that cut. Pi/non-VirtIO behavior must not
use the v12 empty-Operator cut.

Before every phase, console-network containment has conditional-probe precedence
over NineDoor; any attempted containment owns one complete Recovery refill,
advances at most one material unit in fixed owner-local order, persists its
cursor, performs zero ordinary phase work, preserves that phase plus both
retained Runtime- and Network-unit cursors, and reaches the sole outer yield
without pump fallthrough.
Simultaneous faults require every console unit before any NineDoor unit, with
one outer yield per material unit and no interleaved ordinary turn.
Console-network quarantine retains the three ordinary phases and retained unit
state while fencing NIC polls in Network rather than combining Operator and
Runtime/IPC. The Stage03 wrapper and its regression must select the canonical
generated cohsh policy whose hash and resolved-manifest fingerprint match the
current binary, never the legacy stale `out/` policy. Root policy cannot be
bypassed; TCP load and child failure never consume the independent
root/emergency/fault reserves or starve serial/local-seat/fatal output; no second
listener or root-owned physical NIC path appears. The v5 candidate remains
falsified; the v6 root candidate is falsified by the exact composed no-op
Network turn; the v7 root candidate is falsified by the exact first-Operator
serial-flush timeout with its lifecycle marker still queued; the v8 root
candidate is falsified by the exact post-`emit_prompt_now` output-record
timeout; the v9 root candidate is falsified by aggregate first-post-bind refill
exhaustion before its first prospective FIFO move copied any byte; and the v10
root plus v3 child candidates are falsified by the exact fresh-Runtime and
residual-child-SC evidence above. The exact v11 root and v4 child artifacts are
falsified by the `PollService` and post-empty-Operator outer-Yield timeouts
above, despite complete containment. Historical QEMU failure sequence (full identities and traces in the milestone evidence archive): v12/v5 failed authentication after the generic Runtime prelude composed with empty BootstrapDrain; its dirty source differs from the later HEAD. V13/v5 failed ObserveChild in the generic Network adapter, followed by root-fault terminal-path timeout; the child remained healthy. V16 still paid generic EventPump/Operator frames and then root-fault timed out before suspension. V17 executed the compact path but retained combined serial RX/TX work. V18 exhausted StageOutput's Network prelude before any child signal. V19 exhausted the post-leaf counter/NETDIAG/NineDoor aggregate after a no-op Disconnect. These were non-claiming failures; none qualifies child v5 or later artifacts.

V20 retains one compact
diagnostic observation after each timer-plus-one-NIC visit and consumes it in
the next Network visit through NETDIAG only, without timer or NIC work.

The exact immutable v20 root ELF
`ed5cb9f587d0d63e6121f8b00b083e68f5a0a7dd23dd6d2bbf0c899e1e85e80f`
and CPIO
`ca2a52038eb0814a17c8609f03bec32ff357fdd524edee3e7080ac69ceb7823b`
reached the root marker and prompt but then entered root-emergency fail-stop.
Root-control timeout `.1` was at outer-Yield PC `0xf680c`; successor Operator
and retained NETDIAG `Some` prove the timer-plus-NIC visit completed while the
exclusive diagnostic visit had not run. Exact lower-cursor, egress, and child
state remain unconfirmed. V21 therefore splits only the QEMU Network timer and
NIC units through a successor-before-work `Timer -> Nic` cursor; the retained
diagnostic preempts without advancing it, producing
`Timer -> Nic -> DeferredDiagnostic -> Timer` when diagnostics are featured.

The exact V8 artifact
`out/cohesix-v8-stale-control-hvf-qemu10-20260813T090943Z` bound rootserver
SHA-256 `f200ecf56021e5eb712e28ecd3ea290d476552166ba2ce3a6b6b5d959f811910`,
console child SHA-256
`ed0b2b7ecbf2c9f302a30d087d54fbfe264fbfe6857f1717f94319ae4735b551`,
CPIO SHA-256 `991ea1d85fa8fb5a2d1146cbe9b183eaf3c204301d8348d4f18a722cb490156d`,
and kernel SHA-256
`8aa06eaf462a87d3aa6c1f8500ad1d1ed5632f5ad8031c5eab53fdd2095257da`.
Its live canary reached `root-console.start.ok`, then two TCP connections each
wrote 18 AUTH bytes and received zero bytes for five seconds without a target
fault or UART AUTH response. V9 then attempted local Poll with a global
post-publication fence, but exact artifact
`out/cohesix-v9-retained-work-hvf-qemu10-20260813T095338Z` still wrote 18 AUTH
bytes and read zero. V11 permits private internal Poll but requires explicit
post-observation ACK credit for each publication; ordinary wakes never credit.
V8 and V9 are exact liveness-failure evidence, not V11 qualification.

The narrow V26 root-control/V13-child two-session canary and retained V28
terminal-response-fence/two-session result are passing evidence for only their
stated transitions. The V27 artifact remains exact terminal-response/Disconnect
sequence-collision failure evidence. The immutable V29 artifact is selected-wrapper
failure evidence: AUTH and ATTACH completed, HELP returned zero bytes before the
unchanged 30-second timeout, clean root/child snapshots ruled out a target
fault, and breakpoint plus live-vtable proof showed `capture_started=false`
because `DefaultNetStack` returned its default bounded identity instead of
delegating the isolated implementation. The selected V35 QEMU root-control, V24
Pi root-control, V6 root-fault, and V18 child candidates remain pending fresh
exact target builds,
the fixed one-socket HELP/NETSTATS/SMP/CACHELOG matrix, standard-fault
containment, budget-exhaustion natural-postponement liveness/isolation, and all
downstream gates. Stage 03, Hive Gateway REST regression, Conditional B2
executable target pressure, companion Conditional D host-model performance, and
complete host-tool and Python-library acceptance remain withheld until that
exact-artifact QEMU evidence passes. Fresh Pi 4 build, flash, hardware, and a
Pi-selected target-performance path at generated `54 MHz` remain independently
required; Conditional D supplies no Pi target proof.
Pi/non-VirtIO EventPump behavior remains on the generic path apart
from the universal one-period startup activation wait. The active-MCS child
rechecks badge and publication-credit gates between retained units, uses local
Poll only while eligible work remains, and calls Wait directly when idle or
publication-uncredited, with no ordinary Yield; natural SC postponement
supplies the budget boundary.

Changes:
  - GENET acceptance and release-preparation decision, 2026-09-09 — the
    operator explicitly authorizes replacing the 1.845-ms latency requirement
    with the measured sustained performance envelope: unpaced 1,024-request
    canonical raw TCP runs must achieve >=600 requests/s and <=5-ms p95 on
    two exact-image release boots. Controlled 180/s latency is diagnostic.
    Preserve the successful passive-read repair, complete runtime ABI v13,
    causal continuation, existing MCS reservations, ownership and liveness.
    Protected release runs measured 627.000/627.579 requests/s with
    4.779/4.818-ms p95; main `11f61938c` GENET G00/G01 measured
    620.448/673.663 requests/s with 4.748/4.085-ms p95. These support the
    revised numerical target without another speculative runtime change.
    Preserve G00's earlier controlled-load failure (4.015-ms p95) and later
    0.732-ms repeat; active diagnostics preceded that original measurement.
    Packet/queue evidence identifies bounded initial root/display interference
    without proving every delay is necessary or all defects are eliminated.
    No samples or historical verdicts are removed. Further optimization
    requires a reproduced material defect, not failure of the retired limit.
    Medium/high REST, cohsh, zero-failure and bounded-liveness checks remain
    required; the earlier 25/50-ms batch proposal remains a reference rather
    than a newly imposed gate. WiFi throughput/latency and full <=42-second
    boot requirements remain unchanged. Freeze a clean-main release build
    using the default release `seL4/build_UBOOT` kernel. Review the complete
    host-tool suite, Python SDK and benchmark consumers: this acceptance-only
    change requires no CLI, schema, generated output or runtime modification.
    Existing exact-image RAM results and retained release-QEMU evidence remain
    distinct from the final staged image's normal SD boot qualification.
    Scope remains this task restoring `m26e-console-network-service-isolation`.
  - Explicit controlled-load GENET measurement — preserve the protected
    release image and successful passive-read repair while evaluating the
    user-selected latency contract at controlled target load and reporting
    saturation separately. Add optional `--raw-request-rate` to the canonical
    harness, preserving unpaced defaults, every latency sample, one outstanding
    PING, complete-session throughput and exact terminal/EOF checks. Record
    actual starts and rate policy; use actual-start spacing without catch-up
    bursts, never hidden pacing. Deterministic tests cover rate validation,
    early/late host wakeups, slow responses, arithmetic and unchanged unpaced
    behavior. The additive report fields do not change target ABI, manifests,
    kernels, cohsh, REST modes or the Python SDK. Compare 1,024 PINGs at a
    recorded 180/s ceiling with separately measured unpaced capacity on two
    protected GENET boots before refining performance targets. Historical
    failed results retain their original workload and verdict. Scope remains
    `m26e-qemu-shared-control-path-performance`, restoring
    `m26e-console-network-service-isolation`; no new runtime policy is authorized
    by the measurement. Two protected release RAM boots subsequently measured
    172.279/171.093 requests/s at the recorded 180/s ceiling, with
    0.744/0.896-ms p95, passing both numerical operating-load gates. Separate
    unpaced 1,024-request runs delivered 627.000/627.579 requests/s with
    4.779/4.818-ms p95. TCP scripts and complete wire audits pass. An earlier
    host-undersupplied run remains failed against the throughput floor;
    bounding each blocking host sleep to 1 ms addressed timer overshoot
    without changing target policy, sending early, spinning or hiding samples.
    At that stage, recommend a separate sustained floor of 600 requests/s
    with <=5-ms p95 and <=25/50-ms medium16/high32 mean batch references from
    the protected two-boot REST evidence. The subsequent acceptance decision
    above adopts the capacity target and supersedes the controlled-load gate;
    it does not retroactively rewrite these results. Retain first-connection tails,
    maximum latency and zero-failure/liveness requirements. Further runtime
    changes require a reproduced material defect in the defined workload.
    RAM transfer evidence is not complete runtime BUILD or cold-SD proof;
    WiFi and full staged acceptance remain separate. Evidence:
    `out/bench/pi4-genet-load-envelope-20260909/REPORT.md`.
  - GENET/console placement experiment retired — under
    `m26e-qemu-shared-control-path-performance`, restoring
    `m26e-console-network-service-isolation`, source `b58fc32552f5` tested
    independent GENET and console-network owners together on core 2, with
    root on core 0. HDMI moved to core 2 and the GPU executor/passive Workers
    to core 1, preserving every per-core reservation sum and all budgets,
    refills, priorities, guards, memory and capability bounds. Two release RAM boots passed functional workloads; first-64 latency worsened and sustained/batch results were mixed, with no repeatable overall gain. The linked experiment report retains every sample. Retire the
    placement portfolio; preserve the successful root passive-read repair
    and baseline fixture corrections. Exact packet traces still show
    millisecond delays before Signal and after Signal on the same core:
    cross-core transport is not necessary for this delay, but the experiment
    does not identify scheduling-context eligibility or rule out every
    alternative placement. Exact Pi build and focused checks passed. Release
    QEMU live convergence passed; its original aggregate stale-fixture FAIL
    remains preserved alongside the corrected canonical 37-guard PASS.
    Evidence: `out/bench/pi4-genet-colocated-20260909/REPORT.md`.
  - GENET IRQ owner-core routing experiment retired — under
    `m26e-qemu-shared-control-path-performance`, restoring
    `m26e-console-network-service-isolation`, exact release RAM source
    `bd539e48ff5f` tested aligning the MCS GENET SPI's physical delivery with
    its active scheduling-context core. The
    selected GICv2 kernel initializes SPIs to the boot CPU; the existing
    four-word ARM GetTrigger call does not retarget them, despite GENET's
    generated core-1 execution. The candidate used the selected upstream
    five-word GetTriggerCore contract, with target in MR4 and validated owner
    authority. All IRQ189 capabilities, triggers, notifications, badges,
    driver images, budgets/refills, guards and packet bounds stayed unchanged.
    Both boots passed raw/coh/REST and wire checks, but neither the original p95 gate nor a material repeatable tail improvement passed. Full measurements remain in the linked experiment report. Retire the
    routing change and its private marshaller/selector, preserving the
    successful passive-read repair and optional v3 timing evidence. Focused
    IRQ23 checks, release QEMU root-MCS convergence and exact Pi build passed;
    the experiment is not acceptance. Evidence:
    `out/bench/pi4-genet-irq-owner-20260909/REPORT.md`.
  - GENET exact-packet wake/receive discriminator — under
    `m26e-qemu-shared-control-path-performance`, restoring
    `m26e-console-network-service-isolation`, reuse the bounded queue timing
    probe and extend its optional v3 peak with the exact producer's completed
    Signal, consumer's last blocking receive entry/return/badge/kind, and
    GENET's last explicit Yield entry/return and existing route reason.
    Prior queue traces place millisecond gaps across both reciprocal rings;
    refill10 and RX grouping do not close raw p95. Distinguish pre-notification,
    receive-boundary and post-return delay without copying VirtIO ownership,
    changing the release kernel, any MCS number, packet authority, deadline,
    retry or the successful 28d3 root dispatch repair. Missing/raced timing is
    unavailable and cannot change transport. Fixed wire/bounds and existing
    ring/driver/format contracts, exact target builds and narrow QEMU proof
    precede raw-first Pi observation and the unchanged medium/high harness.
    Review complete host tools, Python SDK, cohsh/scripts, generated manifests
    and performance/evidence consumers: only documented optional diagnostics
    change; transport, workloads and report schemas remain unchanged. This is
    a non-claiming discriminator, not a latency fix or acceptance evidence.
    The temporary observer requires a 70-page console image: admit exactly
    108 service frames and 165 retained slots, one page and cap above the
    qualified 69-page image. The fixed/maximum/reserve inventory uses 7,667
    of 8,192 frames and 19,517 of 65,536 root slots. Retire this temporary
    admission with the observer. Stack, queues, untyped and QEMU stay fixed;
    regenerate the Pi SDK profile digest without changing its public fields.
    Keep the root constructor at the same 70-page/108-frame/165-slot
    inventory. The first diagnostic boot retained the former root inventory
    and failed before console readiness despite verified RAM delivery; bind
    both source manifests to the root inventory in a deterministic regression.
    This is candidate construction repair, with no new performance result.
    SD0880 restored readiness and function but failed raw latency. The optional v3 discriminator fits the unchanged 256-byte record without new scheduling authority. Exact `006c883f8638` passed focused checks, release QEMU convergence and the Pi build. Two CRC-verified GENET RAM boots passed raw/scripts/REST function but still failed the original 1.845-ms p95 gate. TX traces place substantial delay before Yield in one run and before Signal in another; they identify boundaries, not CPU use/refill eligibility or a complete latency fix. All timings and paired records remain in the report below.
    Preserve the successful passive-read repair and unchanged scheduling
    authority. Evidence: `out/bench/pi4-genet-yield-binding-20260909/REPORT.md`;
    RAM delivery is not SD/cold-boot or complete runtime BUILD attestation.
  - GENET bounded hardware RX interrupt grouping experiment retired — exact
    release source `f24f2b9a648519fcb3605368c0d4c1f8fad71e71` tested two
    packets or thirteen hardware timer ticks (106.496 us) on two RAM boots,
    keeping all MCS numerics and the root read-dispatch repair unchanged.
    Both boots passed functional workloads and throughput but failed the original 1.845-ms latency gate. Concurrent batches improved while sequential ones regressed; the retained experiment establishes no overall benefit. Restore immediate RX interrupts; retain the complete
    experiment under `out/bench/pi4-genet-irq-batch-20260909`. First-boot
    p95 remained 5.239 ms despite a maximum recorded driver slice of 93 us:
    lower interrupt work does not identify the owner delaying a slow PING.
    The original tail-latency frontier remains open. The complete host-tool
    suite, Python SDK, .coh, generated profiles and harness were reviewed;
    protocols, workloads, report schemas and implementations need no change.
    QEMU execution, the release kernel, owner/IRQ/cursor bounds and the
    successful root dispatch repair remain unchanged.
  - GENET owner refill-capacity experiment retired — exact release RAM image
    `a142b05b347c9a92dcf882b3540e370bc147f3c4` tested ten total refills in the
    existing 256-byte GENET SC with unchanged budget, period, priority, core,
    WCET, packet bounds, root/console and successful passive-read dispatch.
    Both boots passed raw/coh/REST function but failed the original 1.845-ms latency gate; high32 batches were essentially unchanged and no overall gain was established. Full measurements remain in the linked experiment record. Restore the exact eight-refill implementation,
    compiler/profile and fixtures while preserving the root-dispatch repair.
    Keep the stale root-SC test correction and production QEMU console
    documentation aligned with existing as-built truth. All raw, cohsh,
    Worker32 and medium/high REST workloads and complete wire audits passed
    functionally. QEMU live canary passed; stale Pi fixture failures and the
    corrected 37-guard pass remain separate evidence. Host-suite, SDK and
    benchmark contracts remain unchanged. Evidence is non-claiming under
    `out/bench/pi4-genet-refill10-20260909`; this does not exclude refill
    postponement generally or authorize a wider scheduling change.
  - GENET bounded passive-read dispatch candidate — restores
    `m26e-console-network-service-isolation`. Two exact release-Pi queue-timing
    boots show sub-0.16 ms packet handoffs under high TAIL pressure but roughly
    10 ms per command at root admission/dispatch. Permit authenticated direct
    GENET TAIL/CAT/LS to use ordinary bounded dispatch with existing generated
    NaturalPostpone and per-Call ResumeOnceReturnError enforcement. Keep exact
    topology, connection/generation, physical-operator, response-owner and
    recovery fences; retain the Pi reserve path for all other commands and
    WiFi. No retained response token, concurrent passive Calls, SC numeric,
    manifest, kernel, ABI or timeout-policy change is included. The existing
    Yield/Consumed preparation guard cannot prove remaining CPU refill credit;
    this change explicitly uses kernel postponement, not invented WCET credit.
    Focused admission tests, release QEMU root-MCS, exact Pi compilation and
    fresh same-image GENET/WiFi harness evidence qualify the candidate. Review
    the complete host-tool suite, Python SDK, .coh, raw/REST workloads and
    report schemas: their public contracts and implementations remain
    unchanged because only target read admission changes. Physical performance
    and original raw p95 remain unclaimed until measured.
  - Initial-SC runtime admission repair — the unchanged `d16284b35`
    GENET pair regressed to approximately 20 ms per PING because the runtime
    continuation predicate still required root SC bits 7/refills 2. Kernel
    allocation and compiler admission correctly selected bits 8/refills 8;
    the stale runtime check disabled continuation and caused a Yield on almost
    every turn. Preserve the selected storage experiment and bind this runtime
    predicate to the same exact 8/8 policy. Its positive test reads those
    fields from the actual Pi TOML manifest, with a host-test-only TOML parser,
    and rejects the stale values independently. Other budgets, fields, fences,
    queues and fault routes remain exact. The complete unchanged dual-mode
    matrix precedes the repair; repeat the exact Pi and QEMU checks and a new
    two-GENET/two-WiFi matrix to test storage with continuation actually enabled.
    Host tools, Python SDK, public protocols, benchmarks and evidence formats
    retain their existing contracts; only the root's development dependency
    and its lockfile entry change for the manifest-binding regression test.
  - CYW43 completed-batch publication repair — the same unchanged matrix's
    W00 medium pressure run retained parent `0x559`, a valid one-frame batch
    at queue commit `0x402`, and the queue-after pair `0` then `0x403`.
    Treat only internally valid same-generation queue publication as pending
    before HAL retires op8. Retain its immutable request and original deadline,
    then carry one exact validation receipt to the immediate payload consumer.
    Preserve malformed/stale/poison rejection, both payload header fences,
    ordered pair recovery and receipt clearing before request-sequence reuse.
    Sideband op11 defers before copy; its validated admission, still-issued
    parent and immutable header protect the subsequent ACK from independent
    queue publication. This restores `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`,
    discovered through `m26e-console-network-service-isolation`. Deterministic
    publication/identity/copy/ACK tests and exact Pi compilation qualify source;
    a fresh exact-image dual-mode matrix must establish physical recovery and
    performance. No SC numeric, retry, deadline, physical I/O, shared ABI,
    command grammar or benchmark change is included. The complete host-tool
    suite, `tools/cohesix-py`, generated contracts, `.coh`, raw framed TCP and
    REST benchmarks retain their implementations and schemas. The existing
    `wifi dump-state` rejection row now describes actual rejection, excluding
    deferred publication; operator and driver documentation change together.
  - Pi initial scheduling-context storage candidate — discovered through
    `m26e-console-network-service-isolation`, restore the selected
    `m26e-mcs-abi-foundation` allocation/admission contract. After the unchanged
    `9e99701e1` two-WiFi/two-GENET matrix, both WiFi gates pass and GENET p95
    remains 5.5–6.2 ms. A separate, benchmark-ineligible 0/12/0/12 ms load
    discriminator gives burst p95 5.05/5.30 ms and paced p95 0.71/0.75 ms.
    Actual root CPU and blocking receipts distinguish this from the already
    repaired empty-receive and completed-response Yield defects; they motivate
    testing refill fragmentation, without claiming per-packet exhaustion proof.
    The prior manifest-only eight-refill attempt was invalid because upstream
    allocates a 128-byte initial SC. Extend the exact authenticated Pi source
    overlay to reserve, allocate and describe that same initial SC as 256 bytes,
    then select eight refills. Preserve root budget 5,500 us, period 10,000 us,
    WCET 2,500 us, priority, admission, every other task and upstream scheduler
    algorithm. Clean QEMU/proof sources retain their upstream initial SC.
    Source-profile schema 3 declares the complete sorted patch path set;
    preparation, tamper rejection, source/build stamps, compiler target checks,
    generated artifacts, the Python Pi target descriptor's manifest hash and
    exact Pi profile outputs change atomically.
    Review the complete host-tool suite, `tools/cohesix-py`, `.coh` scripts,
    trace and evidence consumers, raw/REST harnesses, workload arithmetic and
    report schemas. Only the source-profile preparation interface changes from
    singular `target` to `targets`; its tests/docs change together. Other public
    interfaces and benchmark gates require no change. Exact kernel/Pi builds,
    QEMU root-MCS and fresh two-WiFi/two-GENET evidence can falsify this candidate;
    no static or paced result is performance acceptance.
  - Empty receive register restoration — discovered through
    `m26e-console-network-service-isolation`, restore the
    `m26e-mcs-abi-foundation` receive contract after the unchanged `425b75684`
    two-WiFi/two-GENET matrix. The selected seL4 16 kernel clears only the
    badge on failed NBRecv. The emitted steady root path leaves `now_ms` in
    AArch64 x1, while root interprets that stale MessageInfo as endpoint work.
    Seed x1 to zero in the receive-only assembly for MCS and classic bindings;
    real IPC still supplies its tag, bound notifications remain badge-first,
    and send/receive retains its outgoing MessageInfo. Preserve all Reply,
    donated-call, queue, retry, timer, SC and operator fences. Verify the trap
    register contract, existing empty/real-message classifiers, exact QEMU and
    Pi compilation, emitted instructions and fresh unchanged dual-mode boots.
    The full host-tool suite, `tools/cohesix-py`, compiler/generated contracts,
    `.coh` scripts, raw/REST workloads, benchmark arithmetic, trace consumers
    and report schemas require no change: no public surface or target setting
    changes. Build or static correctness does not establish a speedup.
  - WiFi first RX-batch rejection operands — under
    `m26e-qemu-shared-control-path-performance`, discovered through
    `m26e-console-network-service-isolation`, the sealed unchanged `02dd1a964`
    two-GENET/two-WiFi matrix retains W00's first root restart at
    `driver_task_net.rs:28073`, parent 692/op8, FrameReady/detail 0x5803/result 1.
    Selection failed before payload copy; its merged Option does not distinguish
    an unavailable queue publication from invalid metadata or stale identity.
    Retain the exact original validation samples and failed stage before the
    unchanged restart. Preserve first evidence until accepted Gate 8 and expose
    eleven bounded metadata-only rows through explicit `wifi dump-state`.
    No new read, clock, poll attempt, retry, queue, recovery decision, runtime
    ABI, compiler manifest, SC setting or compact diagnostic row is introduced.
    The complete host-tool suite, `tools/cohesix-py`, compiler/generated
    consumers, `.coh` scripts, raw/REST benchmark workloads, arithmetic and report
    schemas were reviewed. The trace normalizer retains the four new row
    prefixes as passive metadata and excludes even malformed or unknown versions
    from gate classifiers, with a focused regression. Other host consumers need
    no implementation or workload change.
    Exact sample-retention, invalid identity/commit/header and output-bound
    regressions plus exact Pi compilation/layout are required. This Pi-only
    diagnostic cannot establish a fix or replace fresh dual-mode hardware.
  - GENET ready-publication charge equivalence — the unchanged `40b7ff26f`
    pair reduces console CPU about 30% but retains p95 7.112/6.082 ms and
    in-flight causal-limit Yields. Preserve the final typed Wait/Arbitrate/Closed
    result across the existing single poll/recheck/receive helper. A durable
    publication seen before receiving returns to ordinary arbitration without
    charging the causal-wait allowance, whether the poll observed an empty
    notification or a coalesced hint. Actual receive returns, endpoints and
    hints without ready publication retain their existing charge. Preserve
    both 64-count bounds, unslid clocks, periodic operator wake, all fences and
    unchanged WiFi empty-poll-only routing. No added accounting syscall or
    numeric scheduling change. Test notification equivalence, real-wait charge,
    retained endpoints, unavailable Reply authority and exact production branch
    ordering. Qualify exact Pi/layout and pinned QEMU, then repeat both modes.
    Discovery: `m26e-console-network-service-isolation`. The complete host-tool
    suite, Python SDK, generated contracts, raw/REST workloads, diagnostic
    readers and report schemas need no changes. Other latency tails and the
    earlier WiFi recovery quarantine remain open pending physical evidence.
  - Pi TCP execution-cost candidate — the sealed unchanged `c47da0a6d`
    two-GENET/two-WiFi matrix retains GENET p95 6.595/6.752 ms and console-child
    CPU 32.395/32.329 ms per full 64-request session. Compile only Pi
    console-network-runtime and smoltcp at level 3 in the runtime invocation;
    root retains its separate level-3 build, other children and QEMU retain z.
    Admit the measured 69-page ELF with 107 service frames and 164 retained
    root slots, three additional image frames/caps relative to the 66-page
    comparator. Update the compiler, constructor, source manifest, projections
    and generated profiles atomically, retaining exact-size rejection. Earlier
    global-profile attempts stopped at the 69/66 guard and have no physical
    speed result. Qualify emitted child/root stack use, all image bounds and
    pinned QEMU before fresh unchanged dual-mode Pi measurement. No scheduling
    numbers, ownership, packet/session logic or wire workload changes.
    Discovery: `m26e-console-network-service-isolation`. Review the complete
    host-tool catalog/suite, tools/cohesix-py, raw/REST benchmark scripts and
    evidence consumers: only the generated Pi resource profile changes; public
    interfaces, workload arithmetic, thresholds and report schemas need no edit.
    WiFi first-SYN loss and the earlier recovery quarantine remain open;
    neither a faster build nor later healthy traffic closes those failures.
  - GENET condition-after-hint repair — both unchanged `75a5be626` boots
    reach the causal-return limit of 64 with an exact response still pending,
    only 15–21 completed quanta and no productive-cap or policy rejection.
    The complete traces contain only seven/five blocking-receive invocations;
    most logical returns therefore came from a nonblocking fan-in observation.
    After the existing single poll, revalidate the same exact child debt and
    full operator/recovery fence. An empty poll or fan-in-only hint may then
    enter the existing single receive; a new durable publication returns to
    ordinary arbitration. A retained endpoint or unavailable Reply authority
    must never receive again. This is bounded by one poll and at most one wait,
    with the same 64-return/quantum caps, clock, cursor, SC and physical owners.
    There is no repeated notification drain, increased allowance or reset.
    Require the existing identity-bound PCIe periodic wake before this GENET
    receive, enabling it once if still Disarmed. The mixed fan-in can name
    operator bytes not yet imported into root queues, and TCP backpressure
    cannot strand their service. Observe absolute timer duty around the typed
    enable and repeat the full exact debt/operator/recovery check afterwards;
    a rejected timer retains ordinary arbitration. No timer interval changes.
    Test closure order, state-change rejection, endpoint retention and a second
    coalesced wake; qualify exact Pi layout and pinned QEMU root-MCS before
    fresh dual-mode raw/CPU/Yield/receive and functional/pressure comparison.
    Discovery: `m26e-console-network-service-isolation`. The complete host-tool
    catalog/suite, Python SDK, generated interfaces, diagnostic readers and
    raw/REST workloads/report schemas require no changes. No target gain or
    reliability closure is established until fresh physical evidence passes.
  - Exact final GENET Yield decision — the unchanged c45d79075 pair retains
    p95 7.603/7.670 ms while complete receive traces total only 453/421 us.
    Recorded explicit Yields overlap several slow PINGs, but 21/20 of 64 exceed
    the latency gate; elapsed non-Yield poll gaps remain separately unresolved.
    Preserve one packed word in each existing Yield context: this loop's
    identity-matched cached idle mask, retained continuation class, hint state,
    quantum/wait counts, rejection bits and tail/clock/profile state. It must
    not resample hardware, call kernel accounting, change a scheduling decision
    or add an output row. Cover field packing, unavailable/stale cuts and full
    maximum-width rendering. Discovery: `m26e-console-network-service-isolation`.
    The complete host-tool catalog/suite, Python SDK, passive trace consumers,
    generated interfaces and raw/REST benchmark arithmetic require no changes;
    existing key/value readers ignore the additive field. This diagnostic is
    not a performance fix or target acceptance claim. Fresh same-image dual-mode
    evidence remains required before selecting a further behavioral repair.
  - GENET consumed-control continuation — a successful StageOutput may accept
    the child's consumption watermark during its existing immediate observation.
    Preserve the new stage's exact generation/connection/control sequence from
    its root-owned consumed-but-undrained batch when no control remains inflight.
    An invalid extant control never falls back to another batch; missing, stale,
    zero-sequence or already-drained debt grants no continuation. Existing final
    condition-before-block, durable-publication arbitration, operator/fault
    fences and episode limits remain authoritative. This closes the constructor
    gap before the already-supported response-drain wait. The final shared
    publication-service level also retains root's copied-but-unacknowledged
    credit. A parked child cannot publish its successor until the ordinary
    root rotor returns that ACK; neither causal nor global idle may strand it.
    Validate all shared frontiers before considering local ACK debt, so malformed
    or stale pages still fail. Keep raw publication peeks and `pub` trace
    fields distinct from this service-readiness predicate; their meaning stays
    unchanged. Propagate service readiness through both driver adapters and
    the selected network wrapper. Cover real READY publication acceptance, owed
    credit, completed credit and stale-page rejection. Discovery:
    `m26e-console-network-service-isolation`; unchanged `9992131b5` evidence still
    has pending-response Yields and non-Yield root gaps.
    Add two CNTVCT reads around an existing root receive/endpoint-handler call
    only for a live nonzero Pi TCP identity. Retain its slowest sixteen brackets
    with stable ties and explicit totals/omissions/invalid counts under existing
    `smp poll-time`; the full command remains within 58 body rows and existing
    queue bounds. A bracket includes endpoint handling and preemption, so it
    cannot prove sleep duration, CPU consumption or refill exhaustion. No new
    accounting syscall, device action, wake, timer or scheduling parameter.
    Cover exact continuation debt, stale/final rejection, bounded sorted trace,
    arithmetic and complete maximum fields; qualify Pi/QEMU before fresh boots.
    Host-tool catalog/suite, Python SDK, generated grammar/ABI and raw/REST
    workloads/report consumers reviewed: additive diagnostic documentation is
    required, with no protocol/parser/schema/workload changes elsewhere.
  - Exact-6f26 first WiFi recovery provenance — four unchanged boots retain
    WiFi raw passes at 26.984/29.039 requests/s and GENET latency failures at
    8.134/5.995 ms p95. W01 then loses QUIT after successful AUTH/HELP/TAIL;
    root remains live while the pair quarantines. Preserve the first root
    recovery call site and exact CYW43 completion before scrub, without changing
    any owner, recovery decision, deadline, scheduling number or physical path.
    Emit one bounded passive `scheduler_root` row in the existing recovery
    transaction and verbose snapshot. The full host-tool suite, Python SDK,
    generated interfaces and raw/REST workloads require no contract change;
    the trace normalizer preserves this diagnostic without gate authority.
    Require first-wins/reset, exact-sequence, complete bounded-output checks,
    exact Pi layout qualification and fresh physical fault evidence before a
    behavioral repair. Discovery: `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`
    and `m26e-console-network-service-isolation`.
  - GENET productive-progress wake recheck — after the unchanged `223133490`
    dual-mode comparison, renew one nonblocking fan-in race allowance only
    when a private exact productive continuation is successfully consumed.
    Preserve the enclosing 64-quantum cap, clock, causal-wait count and every
    identity/operator/recovery fence. Observing a publication or an empty
    rotor does not renew this allowance. This repairs stale spent-hint state
    crossing new work; it does not assume every slow PING contains a Yield.
    Retain the first 32 valid explicit Yield records for the latest nonzero
    session, with complete total/omitted/invalid counts and original counter
    frequency/context, under existing `smp poll-time`. No extra clock reads,
    accounting calls, output-queue growth or scheduler numbers are introduced.
    Discovery: `m26e-console-network-service-isolation`. Cover productive
    renewal, signal-only rejection, unchanged episode limits and trace bounds;
    qualify exact Pi layout and pinned QEMU, then correlate fresh first-raw
    hardware evidence. The complete host-tool suite/catalog, Python SDK,
    generated grammar/ABI and raw/REST workload/report consumers were reviewed:
    the additive diagnostic rows need owning CLI/evidence documentation, with
    no parser, schema, workload, credential or namespace changes elsewhere.
  - Isolated peer-first close restoration — sealed `5e54f83d9` two-WiFi and
    two-GENET evidence proves improved WiFi raw throughput but also a W01
    sequential connection refusal. The sole isolated TCP socket starts a
    simultaneous FIN exchange and rejects replacement SYNs until the final
    FIN retransmission. Restore the existing peer-first close contract for
    exact authenticated root Disconnect controls: drain application and TCP
    output, wait up to one second for the peer FIN, and close from CloseWait;
    expire the bounded drain or peer grace by abort, without renewing either
    deadline on duplicate controls. Preserve independent authentication/error
    close, end/relisten and revocation, existing socket/buffer inventory, ABI,
    scheduling and benchmark bounds. Discovery task:
    `m26e-console-network-service-isolation`. Reproduce FIN ordering with the
    real two-stack host fixture, qualify exact Pi and pinned QEMU, and require
    fresh immediate sequential scripts on both physical backends. The complete
    host-tool suite, Python SDK, generated contracts and raw/REST workloads
    already require exact QUIT acknowledgement and peer EOF; no consumer or
    schema changes are needed. This repair does not establish GENET latency.
  - Pi root execution cost after memory repairs — the sealed `31cf29b35`
    two-WiFi/two-GENET matrix leaves GENET root CPU at 69.2/71.0 ms per
    64-request session and p95 at 5.75/5.57 ms. Maintenance consolidation has
    no demonstrated improvement; WiFi passes throughput only once. Select
    execution-speed optimization for the Pi root package alone and preserve
    all child/dependency/QEMU policies and scheduling values. Earlier compiler
    trials stopped at stack, null PCIe mapping and interrupt-bank defects;
    those now have independent repairs and dual-mode boot proof. Require
    retained baseline artifacts, exact emitted stack/TLS/text and archive
    admission, focused builder tests and pinned QEMU before RAM reset/CRC
    tests. Compare first raw CPU/wire and later functional/pressure evidence
    twice per backend. No performance result is inferred from compilation.
    The complete host-tool suite/catalog, Python SDK, generated interfaces,
    evidence consumers and raw/REST workloads retain their contracts and
    need no consumer changes. Never transplant the old defective image or
    enlarge object, memory or temporal bounds to admit this candidate.
  - GENET operator maintenance rotation — the exact `33227d8da` four-boot
    comparison meets both WiFi gates twice, while GENET p95 remains 5.43/5.62 ms.
    Retain the coherent-memory correction. During exact authenticated direct
    GENET with no physical input/response, stream/synchronous output, reboot,
    quarantine or containment debt, run composite IPC/Worker/bootstrap/output
    maintenance in Dispatch once per operator rotation. Serial, LocalSeat and
    Display keep their physical work and timer/reconciliation preludes; Network
    retains its existing no-control-tail contract. Urgent work, missing or
    mismatched identity and WiFi preserve all existing maintenance cuts. Do not
    change SC numerics, wake allowances, the 64-quantum cap, device ownership or
    command semantics. Test maintenance counts and fallbacks, preserve passive
    admission and physical-operator contracts, qualify exact Pi and QEMU, then
    compare raw CPU/latency and functional/pressure evidence on fresh hardware.
    Host-tool suite, Python SDK, generated interfaces and raw/REST workloads are
    compatible without consumer changes. Repetition is source-proven; its
    contribution to GENET latency must be measured.
  - Pi coherent driver control memory — after the unchanged `1096630c9`
    two-WiFi/two-GENET matrix, map CPU-only control and SHARED resources as
    identical cacheable Normal/XN memory in root, owner and reciprocal driver
    aliases. The selected SMP kernel supplies inner shareability. The device
    address audit binds SDIO DMA4 control/bounce and firmware requests, GENET
    buffers and USB rings to separate private DMA resources; retain their
    Device attributes and all MMIO/framebuffer mappings. Preserve barriers,
    publication and range contracts, owner boundaries, SC numerics and targets.
    Emit `coherent-shared-plus-barriers` with zero cache-operation counters and
    retain both historical trace policies. Test resource-class mapping and
    receipt validation, inspect exact Pi aliases/stack and run pinned QEMU
    root-MCS before fresh RAM reset/CRC dual-mode measurements. WiFi source-to-
    queue means near 13.38 ms and long post-root-dequeue response tails identify
    shared CPU service as a candidate, not proof of a cache-only bottleneck.
    Host-tool suite/catalog, Python SDK, generated manifests/ABIs and raw/REST
    workloads retain their contracts; only the trace-policy consumer changes.
  - Pi packet and poll correlation — the unchanged `e8929515a` two-WiFi,
    two-GENET comparison contains one passing Wi-Fi raw run, one retransmission
    tail failure, and unchanged GENET p95 around 5.55-5.71 ms. Preserve targets
    and compare against the exact August 10 pre-26e software path. Add a bounded
    latest-flow TCP-header journal at the existing Wi-Fi dequeue observation,
    retaining available source/Q11/root-copy/full-counter metadata without a
    new device call or payload. Six `wifi rx-trace` pages expose independent
    packet receipts. Separate `smp poll-time` records root ordinary poll phases
    and between-poll wall intervals by connection without resetting kernel CPU
    accounting or modifying exclusive passive-admission ordering. Validate
    parsing, missing evidence, eviction, clocks, output bounds, shared host
    forwarding, exact Pi code/stack and pinned QEMU root-MCS. Existing SMP CPU
    rows and report capacities remain intact. No budget, guard, scheduling,
    device, retry, manifest or ABI changes are part of this diagnostic batch.
    Host-tool catalog/suite, Python SDK, raw/REST workloads and arithmetic are
    reviewed; only shared command/help forwarding and the physical diagnostic
    command-marker inventory require consumer changes. Fresh packet/service
    correlation must select the next performance correction; aggregate maxima
    alone do not establish the responsible owner or a hardware limit.
  - Root CPU-sharing synchronization — after the unchanged `db420f1c1` two-WiFi,
    two-GENET matrix, remove kernel cache-maintenance calls from HAL-owned
    shared control and payload handoffs. Control pages and ordinary payloads
    are identically uncached; serial/GENET CPU-only SPSC payloads are identically
    coherent Normal memory. Preserve all range checks, release/acquire barriers,
    sequence-last publication, stable rereads, owner/generation fences and
    physical DMA/image maintenance. Remove obsolete cache-call accounting;
    the fixed counter fields remain present and zero for these shared handoffs.
    Emit `cache_policy=uncached-plus-root-barriers`; the trace normalizer accepts
    this only with four explicit zero cache counters and retains historical
    maintenance receipts. Test mapping classes, publication/queue contracts and
    both receipt policies; inspect exact emitted Pi code and retained stack,
    then run pinned QEMU root-MCS and fresh dual-mode Pi raw/functional/pressure
    checks. The redundant work is source-proven; its performance contribution
    remains a hypothesis until measured. Complete host tools, Python library,
    generated manifests/ABIs, `.coh` workloads and raw/REST arithmetic require
    no implementation or schema changes beyond the affected trace consumer.
  - Pi WiFi idle Retry and GENET root overhead — route the attached WiFi final
    idle `Retry` through the existing one-shot outer recheck. Renew that hint
    only after proven productive attached Network progress without resetting
    either activation counter or the 64-turn cap. Exact GENET rotor units no
    longer open unrelated CYW43 operation/cache/retirement scopes, and NIC
    selection precedes WiFi admission snapshot derivation. Validate immutable
    generated GENET continuation topology once per EventPump; retain all live
    transaction and fault fences. Read narrow local-seat ingress/recovery
    fields and avoid parser-readiness queries for empty ingress. Preserve
    operator service, SDIO deadline fault hints, MCS numerics, driver ownership,
    all protocol/manifest/ABI and workload contracts. Exercise progress/cap,
    topology drift, GENET operator ownership, USB input/debt and WiFi rotor
    contracts; qualify exact Pi code/stack and pinned QEMU root-MCS before
    delivery. Existing session Yield/CPU/idle and wire timing receipts remain
    the discriminator. This is a candidate optimization, not proof of either
    target; fresh repeatable dual-mode raw TCP remains required. Complete host
    tools, `tools/cohesix-py`, generated contracts, raw/REST benchmarks, `.coh`
    workloads and trace consumers require no changes to code or schemas.
  - Exact-d35fc94f0 USB controller recovery — the cold PCIe sequence now
    passes in both modes with stable root text and live serial; GENET reaches
    DHCP. USB EngineInit completes with device-unavailable while networking
    remains gated, so neither boot measures the retained performance changes.
    Seal serial, diagnostics and boot-paired capture prefixes in
    `out/bench/d35fc94f0-startup-stall/` before edits. Complete the initial
    PERST sequence with one firmware reload after full endpoint configuration;
    extend phase admission through mailbox completion and rearm failed proofs.
    Preserve same-command USB failure phase in the existing terminal result,
    prioritize that fault over later idle progress and queue one bounded
    physical fault notice. Keyboard absence must not block controller or
    network admission; keyboard enumeration remains downstream. Preserve all
    earlier address, stack, TLS, ownership and unmeasured performance fixes.
    Complete host tools, `tools/cohesix-py`, generated interfaces, raw/REST
    workloads, report schemas and trace normalization consumers were reviewed:
    existing key/value diagnostics retain the additional phase without layout
    or parser changes. DRIVERS owns the additive diagnostic semantics. Exact
    Pi and narrow QEMU qualification cannot replace physical recovery or raw
    performance evidence. Discovery remains console/network isolation and
    driver-runtime MCS/CYW43 coexistence; both performance targets stay fixed.
  - Exact-6ffce5702 cold PCIe handoff recovery — one WiFi and one GENET
    boot halt with SError before either network driver starts. Preserve both
    serial slices and their shared capture window in
    `out/bench/6ffce5702-failed-boots/baseline.json`; these failures provide no
    performance matrix. Correct host text sampling to the runtime interval
    `[4,4096)`: both boots match the exact ELF (`bbe04ea4`, word34 `d2850e89`),
    so the current evidence does not show text drift. Selected U-Boot removes
    the bridge with INIT/PERST asserted and SerDes powered down. Make SW_INIT
    the first controller access; verify reset release before hard-debug,
    configuration, MSI or status access. Retain the existing settle bounds,
    physical ownership and endpoint proof. Separate in-progress from completed
    phase admission and rearm all typed failures. Remove the unreachable
    status-only shortcut and its unsafe pre-reset diagnostic read. Retain the
    prior WiFi idle-Retry/productive-rearm and GENET root hot-path changes;
    neither has fresh Pi performance evidence yet. Compile and inspect the
    exact Pi image before the next physical attempt. Full host-tool suite,
    `tools/cohesix-py`, generated contracts, raw/REST benchmark workloads and
    report schemas require no changes; private HAL receipt changes are
    documented in DRIVERS. Discovery remains
    `m26e-console-network-service-isolation` and
    `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`. No target is relaxed.
  - Exact-b8e293bc9 shared PCIe bootstrap recovery — the user's WiFi and GENET
    boots both halt with kernel SError at `0x624cc`, immediately following the
    first write to legacy interrupt MASK_SET at `0xfd504310`. Preserve both
    exact serial segments and the shared capture window in
    `out/bench/b8e293bc9-failed-boots/baseline.json`; individual reset wall times
    are unobserved and this is not a four-boot performance matrix. Restore the
    workspace `z` compiler profile because root-only level `3` has no repeatable
    dual-backend performance result. Keep the proven 1-MiB stack, occupied TLS
    storage and nonzero PCIe cache-publication repairs. Match selected BCM2711
    U-Boot setup: quiesce the dedicated MSI bank after root reset/window setup,
    use command aliases only for writes and separate mask/pending status for
    proof, never access the legacy STB bank as an additional MSI bank. Clear
    the prior proof before an attempt and return typed errors for invalid
    addresses or unsuccessful masking; retain endpoint interrupt suppression.
    Add bounded begin/result receipts and exact register/status contracts;
    compile and inspect the exact Pi image and stack before fresh hardware.
    No MCS numerics, physical owner, manifest, ABI, protocol or workload change.
    Full host-tool suite, Python library, generated contracts, raw/REST and
    trace consumers require no implementation or schema changes; the private
    HAL boot diagnostic fields are documented in DRIVERS. Discovery remains
    `m26e-console-network-service-isolation` and
    `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`. Source qualification
    cannot close SError recovery, GENET recovery or either performance target.
  - Exact-1894029de PCIe mapping publication repair — the unchanged two-WiFi,
    two-GENET matrix completes before edits. Both GENET boots prove code word
    `0x34` changes from `0x91002100` to PCIe BAR2 value `0x11` before network
    construction, then fault at that address. The first successful mapping
    cache compare-exchange returned its previous zero instead of the new page;
    register offsets therefore addressed low root text. Return the published
    page or existing winner, and reject zero or unaligned page bases before
    register access. Preserve HAL ownership, mapping/capability policy, memory,
    SC, driver, protocol and workload bounds. Test first publication, existing
    winner and invalid address contracts; retain exact Pi code-integrity and
    network proof before claiming recovery or performance. Complete host-tool,
    Python library, generated interface, raw/REST benchmark and trace-consumer
    review finds no consumer, schema or workload change. Discovery remains
    `m26e-console-network-service-isolation` and
    `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`.
  - Exact-7b6 bootstrap storage and instruction investigation — collect two
    WiFi and two GENET boots before edits. Both GENET boots report the same
    root UserException at PC `0x34` after `stack-allocation.ok`; the saved ELF
    contains a valid ADD instruction there. Independently, the exported
    zero-sized `__tls_base` aliases local-seat flags despite an eight-byte
    bootstrap store. Let `sel4-sys` own both the real, aligned atomic word and
    its accessors; remove the mismatched runtime declaration. Retain bounded
    Pi bootstrap samples of the first text page, excluding its null-address
    entry word, at root entry, IPC installation, fault-receiver activation,
    and GENET constructor cuts. Compare these with the exact ELF to distinguish
    live code alteration from a saved-image or instruction-cache question.
    Preserve all scheduling, mapping, owner, memory-reservation and external
    interface contracts. This repairs proven storage corruption but does not
    yet attribute the GENET exception or prove either performance goal.
    Review the complete host-tool suite, Python library, raw/REST workloads,
    generated contracts and trace consumers: additive diagnostic text needs
    no consumer or report-schema change. Exact builds, symbol-size/non-overlap
    checks, focused contracts and the shared root-MCS QEMU canary precede fresh
    Pi proof. Discovery remains console-network isolation and driver-runtime
    MCS/CYW43 coexistence.
  - Exact-17e bootstrap fault reporting repair — two WiFi cohorts complete raw,
    functional and pressure tests before edits, but reach only 15.583/16.811
    requests/s with p95 114.550/115.978 ms. GENET's controlled boot expires its
    300-second shell deadline; two externally reset attempts repeat the same
    `stack-construction.begin` stop after `owner-proof.return`. Their shared
    outer capture interval is retained without fabricated per-reset packet
    timing. No GENET TCP test runs. Start only the existing Pi root-fault and
    root-emergency receivers after their construction, before the vulnerable
    constructor; keep full registry sealing mandatory for service/Worker
    activation and recovery. Unsealed faults retain copied raw operands and
    emit sixteen-byte raw UART chunks across explicit replenishment boundaries,
    independently of logging/registry locks and normal queues. QEMU retains
    late receiver activation. Narrow GENET-only constructor cuts distinguish
    allocation/storage/socket frontiers if no fault arrives. Preserve all SC,
    capability, memory, driver, protocol and generated numeric contracts.
    Full host-tool suite, `tools/cohesix-py`, raw/REST workloads, generated
    consumers and trace parsers reviewed: additive bootstrap fatal text requires
    no external grammar, workload or report-schema change. Source and QEMU
    regression checks cannot prove this Pi fault branch, the constructor fix,
    or either performance goal; exact Pi failure operands and fresh target
    validation remain required. Discovery tasks are
    `m26e-console-network-service-isolation` and
    `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`.
  - Exact-8d0 root execution-cost experiment after stack repair — the unchanged
    1-MiB-stack image completed two WiFi and two GENET boots before edits.
    All raw64, four command scripts, Worker32, medium16/high32 application and
    strict wire audits pass; all eight WiFi or seven GENET CPU rows complete.
    WiFi reaches 11.614/14.036 requests/s with p95 136.251/137.229 ms; GENET
    reaches 350.343/417.612 requests/s with p95 5.682/5.625 ms. Both performance
    goals remain open. WiFi root CPU totals 2.373/2.027 seconds per session,
    compared with 13/13 ms in console-network; GENET root totals 73/71 ms.
    These asynchronous session receipts motivate reducing root execution cost
    but cannot prove a particular request exhausted its SC. Re-evaluate speed
    optimization now that both backend boots pass the corrected stack layout:
    the experiment selected level `3` only for root-task, leaving
    QEMU, child packages and dependencies at `z`. The b8e recovery above retires
    that experiment without a repeatable performance gain. Preserve constructor logic,
    all scheduling numerics, physical ownership, memory declarations and archive
    limits. Require exact Pi compilation, retained ELF/call-frame and image
    admission, then fresh raw and pressure hardware evidence before attributing
    any gain. Previous failed compiler/stack artifacts remain immutable. Complete
    host-tool suite, `tools/cohesix-py`, generated contracts, raw/REST workloads
    and report schemas were reviewed: no external format or consumer change.
    Discovery tasks remain `m26e-console-network-service-isolation` and
    `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`.
  - Exact-772 optimized GENET bootstrap discriminator — `772f4a40b` builds and
    passes image admission with an inspected 266,688-byte bootstrap/GENET call
    chain inside the corrected 1-MiB stack. Verified RAM transfers and post-reset
    CRCs reach exact BUILD and GENET owner-state readiness, but the shell does
    not appear within 300 seconds; one subsequent serial PING also times out.
    No TCP workload runs. The earlier stack defect alone cannot explain this
    repeated boundary; the terminal instruction remains unknown. Retain the
    failed boot and use four Pi bootstrap-trace-only raw UART receipts around
    the owner-proof snapshot and fallible network-shell constructor. Preserve
    optimization, constructor and driver behavior so the next physical boot
    discriminates this gap. No source/build result claims a performance repair.
    Full host-tool, Python, `.coh`, raw/REST benchmark and trace-consumer review:
    additive bootstrap text is retained as diagnostic data, requires no parser
    or workload change, and cannot create driver or performance acceptance.
  - Exact-8d34 performance evidence and rejected compiler experiment — two
    WiFi and two GENET cohorts completed before edits. WiFi raw64 reaches
    16.563/13.275 requests/s, p95 87.489/127.706 ms; GENET reaches
    404.704/382.062 requests/s, p95 5.825/5.625 ms. All four functional,
    Worker32, medium16 and high32 workloads pass, including boot-paired wire
    audits. WiFi records 106/152 root Yields, 105/151 at the other-boundary
    cut; their elapsed handoffs total 0.769/1.029 seconds. GENET records five
    root Yields per session; packet-owner maximum slices of 99/158 us do not
    hit the elapsed guard. These observations do not identify a per-request
    SC exhaustion cause. The original speed-optimization variants were rejected:
    driver and console variants exceed declared page bounds, global root
    optimization exceeds QEMU archive capacity, and the Pi-only `e3fc025cb`
    physical boot stops before shell construction. Its exact ELF proves nested
    frames of at least 266,688 bytes against the 262,144-byte root stack; the
    terminal instruction is unobserved. Destination-first construction in
    `a5e1add5b` leaves that bound unchanged, while the no-inline `0cf98579f`
    variant still requires at least 265,568 bytes. Both are rejected statically
    before hardware execution. Restore the original `z` profile and constructor;
    preserve all failed evidence and unchanged child/SC admission bounds.
  - Root bootstrap stack admission repair — the exact restored size-optimized
    `bc6bf415d` Pi ELF also violates the prior 256-KiB declaration: retained
    `kernel::start` (24,368 bytes), `kernel::bootstrap` (303,824 bytes), and
    GENET construction (208,688 bytes) already total 536,880 bytes before deeper
    calls. Outlined probe loops are included; direct call edges are verified.
    Reject this candidate before flash. Set the root linker reservation and
    independent layout policy to 1 MiB, with headroom for deeper service calls,
    retaining the 2-MiB heap, child declarations, SC policy and archive limits.
    Correct the misleading guard comment: the mapped gap above the stack only
    separates IPC storage and cannot detect downward overflow into the heap.
    This repairs a measured memory-layout defect, not a compiler speed claim.
    Inspect exact emitted frames and memory admission, run layout contracts and
    the shared root-MCS QEMU canary, then require fresh physical boot evidence.
    No existing successful boot establishes absence of prior heap corruption;
    no specific NineDoor fault or latency sample is attributed to it without
    further evidence. Full host-tool/Python/benchmark compatibility review:
    initial image memory footprint changes by 768 KiB; packaging and loader
    consume the ELF bounds. Wire/API/workload/report formats need no change.
  - Deadline-complete WiFi causal waits — retain the distinct persistent/steady
    parent deadline classification, but permit its bounded fan-in wait after
    exact physical WiFi topology and the existing PCIe timer's live, sealed
    lifetime are proven. Poll root's absolute timer before and after the enable
    Call, then re-read physical completion, empty child publication and all
    operator/recovery/fault fences. A timer hint returns to the normal rotor and
    parent-deadline observation. Ready, revoked, unknown child state or rejected
    timer proof cannot authorize blocking. Preserve the existing activation and
    causal-wait caps, physical ownership, scheduling numerics and GENET path.
    Discovery tasks: `m26e-console-network-service-isolation` and
    `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`. Pure classifier tests,
    condition-before-block source guards, exact Pi build and pinned QEMU 10.1
    root-MCS canary qualify only the candidate; fresh Pi raw evidence must
    establish any performance gain. Complete host-tool, `tools/cohesix-py`,
    generated-contract and benchmark compatibility review finds no changed API,
    command, wire format, workload, measurement arithmetic, report schema,
    artifact path or object declaration; those consumers need no code change.
  - console-network ABI — advance the common READY/ABI identity to v4 and add child event `CommandBatch = 27`, encoding version 1, with one through eight exact same-connection authenticated commands. Each record retains its own `now_ms`, length, and UTF-8 bytes inside the unchanged 2368-byte payload and four-page/capability topology.
  - restricted child — use generated `max_commands_per_wake <= 8` to coalesce only consecutive command events that fit the fixed page. A lifecycle or connection-identity event is an absolute fence; a single command remains the legacy `Command` record.
  - root boundary — validate the complete private batch, reserve the complete bounded command-queue capacity before mutation, then admit exact FIFO command/timestamp records. Any malformed, over-capacity, cross-identity, or stale batch fails closed without partial execution.
  - Worker service — use a rotating pending bitmap and a fixed internal Worker quantum so every executable slot receives fair service and one activation may complete a bounded useful batch while rechecking mailbox/fault priority between records.
  - Worker execution topology — replace one active sporadic SC per Worker with compiler-expanded passive Worker records and two fixed active executor lanes, one on each Worker core. Each lane owns a bounded generated budget, accepts only its generated role set, selects instances through a fixed allocation-free fair queue, donates its SC through a depth-one endpoint Call, and regains it only through the instance-owned Reply object. Root-control remains the sole admission/policy owner; executors gain no root CSpace, untyped, namespace, or cross-role authority.
  - scalable isolation — the QEMU and Pi profiles each admit 256 simultaneous executable Workers (one Heartbeat, 127 GPU, and 128 LoRA) and retain `max_workers=256` plus per-role `namespace_capacity=256`. The Pi profile selects a 16-bit root CNode: 65,536 slots, with 19,516 consumed by the compiler-accounted fixed inventory, complete Worker mix, and post-construction reserve, leaving 46,020 slots of deterministic headroom. Neither target weakens instance VSpace, CSpace, identity, fault, timeout, Reply, generation, or teardown boundaries. Share only sealed read-only/read-execute image frames within an exact role/image identity; every writable image page, ABI page, IPC buffer, and stack remains instance-private. Replace single-word pending state with a fixed compiler-bounded bitmap and retain allocation-free bounded selection/drop accounting. This is static configuration and build admission, not Pi construction, READY, driver-coexistence, performance, or hardware acceptance evidence; executable population remains capped at 256.
  - passive fault recovery — retain one generation-scoped recovery view of each Worker Reply in root-fault. A standard or timeout fault suspends the exact passive generation, issues at most one typed failure reply to release the blocked executor, returns the donated SC, and then performs the existing bounded containment and fresh-generation fence. Stale Reply, cross-lane donation, missing caller, nested donation, or incomplete SC return fails closed.
  - transport progress — retain the single authenticated target connection and add bounded command/read batching with an exact response for every input. Schedule three fixed host lanes over it: root-admitted host-ticket specification ingress first, receipt/control progress second, and bulk telemetry third. Bound every queue and burst; follow each execution burst with control and telemetry service so priority cannot become starvation. Remove the idle broker's artificial 20--40 ms ordered-channel wait without adding a retry or alternate transport.
  - root activation — after useful QEMU progress, retain a bounded active window through transient empty snapshots until the existing counter guard, completion cap, or probe cap. A genuinely idle activation still stops after the minimum probe quantum. A mechanical quota with durable work may re-enter the outer loop without `seL4_Yield`, but every re-entry retains the original counter-window start and checks the guard before its next bounded leaf. Reaching the guard requires an explicit yield so the passive-call and epilogue reserve cannot be consumed by a restarted local timer. The unchanged MCS scheduling context remains the hard execution bound. Generic and non-CYW43 Pi paths retain their explicit-yield boundary. The deferred physical CYW43 supervisor alone may retain the current refill across strict Operator/Driver alternation under the generated root-control `budget_us - wcet_us = 250 us` pre-admission cut and a 64-productive-unit cap; equality stops new-unit admission so one complete declared 2,500 us WCET remains inside the unchanged 2,750 us SC. An independent WCET audit rejected the proposed 2,500 us elapsed work window because it could admit a fresh leaf at 2,499 us with only 251 us of SC budget remaining. After service readiness, an actually productive attached CYW43 Network unit with exactly one service advance and an immediate Network successor with durable schedulable work may retain that window. An authenticated response cursor may instead cross exactly `Network -> Serial -> LocalSeat -> Dispatch -> Network` when its connection, one-step cursor and flush advances, unchanged command count, and generation/pair/lifetime rotation token remain exact; this admits LocalSeat exactly once, performs one backend poll only when USB service debt exists, performs no second Network operation in the wrapper, and rechecks the unchanged loop-top reserve before the next separately charged Network turn. Physical input or response, terminal return, identity drift, operator conflict, recovery, quarantine, containment, or reboot denies that exception. Invalid configuration/timing, waits, idle/nonprogress, handoff, terminal state, or the guard restores the explicit yield. Only the Pi direct-GENET-feature isolated authenticated console socket disables delayed ACK and Nagle for its bounded interactive request/response protocol; QEMU retains its qualified TCP policy. These corrections change no SC budget, period, fault priority, epilogue slack, listener, queue, authority, or wire grammar.
  - exact-5f Pi network latency correction — exact source `5f145d2ba316c0b510788b760f54ad0e170216f9`, image ID `6f050f6f840a53595d4a04233bc32a6c45ad9b74a1e09e9d274d2e2c8d064874`, image SHA-256 `d1aacfd13d97f3f06db6656f112255f6ff2605a4692816861e2708da515e4b0a`, build ID `8ff606e5a57f9723179b3a581ddbc8820f18932e17d62df029497df82f91aaec`, exact serial boundaries, and boot-paired `20260828-210830` WiFi/USB captures prove both selected Pi interfaces accept authenticated TCP and pass `boot_v0.coh`, `tcp_basic.coh`, `smp_parity.coh`, and `converge_target_activity.coh` on the first attempt without retransmission, zero-window, reset, quarantine, or containment evidence. WiFi nevertheless retained 114.684 ms median handshake, 266.080 ms median request-to-first-data, and 151.224 ms median streaming gaps; GENET retained sub-millisecond handshake/DHCP but 30.186 ms median request-to-data and only 24.993 request/s versus the August comparator's 180.269 request/s. These are functional proof and latency failure evidence, not parity. Retain the safe generated CYW43 admission guard at `budget_us - wcet_us = 250 us` inside the unchanged 2,750 us natural-postpone SC. An independent WCET audit rejected the proposed 2,500 us productive wall-time expansion because it could admit a fresh 2,500 us leaf at 2,499 us elapsed with only 251 us of SC budget remaining. The Pi feature alone still disables delayed ACK and Nagle. Direct GENET supersedes the earlier exact-a7 strict-ordinary-rotor candidate only for its own driver contract: select exact ready StageOutput, then exact ready Disconnect, otherwise alternate one ObserveChild/ServiceTick unit; QEMU direct-VirtIO remains byte-for-byte on its strict selector. When one first GENET Network visit observes one exact nonsaturated authenticated command, preserve Serial and LocalSeat priority, Dispatch it, and spend the fifth existing Pi quantum unit on exact response staging while leaving Display as the next debt. Add diagnostic-v3 raw receive-boundary notification receipt/rejection/badge-union evidence in the existing 192-byte record, counted once before filtering with no service authority, and make the canonical serial helper launch one validated generation-bound `boot_v0.coh` peer so `nettest` exercises real TCP while the target's exact final terminal remains authoritative. Preserve schema 1.15, the 256-Worker population, 16-bit Pi root CNode, every manifest/MCS numeric, core placement, Reply/fault/isolation boundary, queue/frame/unit bound, QEMU packaging behavior, and public console grammar. `cohsh` needs only its additive eleven-row captured fixture; the trace normalizer and serial helper need focused tests. The complete remaining host-tool suite, `tools/cohesix-py`, generated-profile consumers, `.coh` workloads, benchmark arithmetic, and report schemas were reviewed and require no implementation change. Source, host tests, QEMU, static Pi validation, construction, or image identity can reject this candidate but cannot prove either physical speedup; fresh exact-image WiFi and GENET captures plus authenticated benchmark evidence remain mandatory.
  - exact-38a Pi dual-mode latency routing — source `38a28fad6e` passed both modes' first-attempt scripts without packet-loss or NIC-delay evidence explaining the regression. WiFi retained 233–266-ms command responses; GENET passed ping/raw64 but delivered 24.997 requests/s with 39.885-ms median first payload. Function passed and latency parity failed. Exact images, timings and 20260828-230431 captures remain archived. For direct GENET only, the generation- and connection-bound isolated response lane now supersedes the weaker legacy post-dispatch cursor once it owns exact `ControlCompleted` plus `OutputDrained` proof; the fifth existing Pi unit stages the response without manufacturing eight redundant Network debts, while any generation, authentication, connection, or runtime drift fails closed to the bounded legacy cursor. CYW43 keeps that cursor because its ordinary smoltcp path still needs it. When one exact authenticated CYW43 cursor flush accepts exactly one response frame after the turn's ordinary TX opportunity, and no physical operator, recovery, containment, reboot, quarantine, or earlier CYW43 operation owns the cut, the same remaining `DriverServiceBudget` may offer that frame to the sole op7 owner before returning. The existing outer-operation claim still caps the complete turn at one physical operation; zero, multiple, saturated, stale, unauthenticated, cross-generation, or already-claimed evidence denies the opportunity. This changes no SC, priority, period, budget, refill, queue, cursor limit, physical-input precedence, driver authority, schema, generated profile, protocol, or retry. A Pi-only static root/console priority equality plus `SchedContext_YieldTo` was reviewed and rejected for this 26e repair because equal-priority FIFO weakens the current kernel-enforced pre-authentication physical-operator precedence; authenticated/no-TCP priority modes remain compiler-owned Milestone 29b scope. Existing `netstats`, TX phase, MCS, and queue evidence already distinguishes the repaired seams, so no console grammar or telemetry schema change is warranted. The host-tool suite, `tools/cohesix-py`, generated contracts, `.coh` workloads, benchmark arithmetic, and report schemas remain compatible and require no target behavior change. Fresh exact-image WiFi and GENET hardware evidence remains mandatory before any speedup or parity claim.
  - exact-de930 Pi refill and direct-owner convergence — source `de930ab607` passed WiFi DHCP, authenticated TCP and three scripts, but raw64 delivered 2.740 requests/s at 269-ms p95. Child traces put 98.2% of the slow interval between physical SDIO completion and CYW43 acceptance. GENET passed DHCP, direct rings, nettest and two scripts before smp_parity reproduced spurious IRQ/direct-peer containment. Both remain non-qualifying; exact identities and boot-paired evidence are archived. The selected seL4-16 AArch64 MCS object ABI proves an 8-bit scheduling context holds ten total refill records (`sched_context_t=96`, `refill_t=16`). Supersede only CYW43 and SDIO `max_refills=2` with eight while preserving each 1,500/10,000 us budget/period, priority 184, core, timeout, Reply, fault, authority, and WCET value; the compiler must bind this capacity to the exact selected kernel/profile/build identity and reject eleven. Root may make one immediate exact terminal-only CYW43 Network revisit after the intervening Serial unit only when the same parked parent request, generation, canonical runnable cut, and captured open pair-lease identity remain exact, with no command, successor, operator, recovery, quarantine, reboot, or physical operation; it then stops the turn. Finite bootstrap keeps bounded HID polling after command-ready so HDMI cannot advertise an interactive prompt before local-seat input is serviceable. Direct GENET supersedes the one-productive-quantum-per-Yield candidate with a dense owner-local MCS window: preserve accounting across Block, admit exactly one material packet operation per guard sample, alternate RX/TX first choice with an exact 8/8 split under continuous bidirectional pressure, charge retained cursor reconciliation to the same 16-slice cap, re-enter only while durable work remains, and force a post-command fresh-refill boundary, half-budget elapsed guard, one bounded no-progress retry, exact max-two-refill `3,000/10,000 us` handoff/runtime truth, exact compiler/profile `wcet_us=800`, terminal counter fault, and fail-closed handoff preflight. Diagnostic v4 reuses record offset 12 for measured packet-slice high-water and adds cumulative fresh, guard, counter, cap, and stalled dense-window reason flags without changing the 192-byte record, commit offset 184, page topology, packet authority, or eleven-row ordering. Mandatory driver-fault output retains one bounded record until both physical output and qlog accept it, without duplicate output or falsely incrementing best-effort drop telemetry. This candidate changes no public AUTH/framing/command/ACK/ERR/END behavior, listener, namespace, queue/frame bound, QEMU direct-VirtIO behavior, Worker population, CNode, schema 1.15, or hardware configuration. `cohsh` and trace-normalizer fixtures require the additive DPC fields; `coh`, `coh-status`, Hive Gateway, SwarmUI, GPU/sidecar/ticket tools, `tools/cohesix-py`, generated profile consumers, `.coh` workloads, benchmark arithmetic, and report schemas are reviewed and require no behavior change. Source, host tests, QEMU packaging, static profile validation, construction, image identity, and flashing cannot prove WiFi/GENET latency, throughput, August parity, or Pi acceptance; fresh exact-image dual-mode hardware benchmarks remain mandatory.
  - exact-2be Pi packet-slice and response-continuation correction — exact source `2be53e2270562be0a2b9d6435b831c826a9dde37`, image ID `21f4a24b173609992e43cd18c852a29fca58aa833ea59600a7b44f2509a603eb`, image SHA-256 `7e5cf5fbdd7721c9a4b8f345c35026df87d991ead6b8ff5259ad2914854b9587`, resolved-manifest SHA-256 `28f99df3f09adc490c25c82625e7ef89d4335cba0563efd3a07b6a806e1e0650`, and boot-paired `20260829-085248` captures prove WiFi first-generation Ready, DHCP, authenticated TCP, and three focused scripts without loss or quarantine, but only 2.630 raw requests/s and 306.254 ms p95 first response. The same exact image reaches GENET link, DHCP, valid direct rings, and an 11 us pre-load window high-water before the first authenticated `nettest` ingress raises the terminal `bcmgenet-v5` MCS timeout and correctly quarantines the pair; no post-containment wired TCP, REST, script, or performance result is admissible. The next candidate replaces each direct-active 16-frame attempt with at most one material TX or RX/finalization operation per guarded slice, alternates first choice for an exact eight/eight split across the 16-slice dense window under continuous bidirectional pressure, and permits an empty side to donate its slice. A malformed RX descriptor recycle consumes its guarded slice and cannot also donate it to TX. Compiler/profile validation requires exact `wcet_us=800`; handoff/runtime validation retains exact max-two-refill `3,000/10,000 us`, the half-budget elapsed guard, command-freshness boundary, one no-progress retry, and fail-closed counter/cursor behavior. Nonforeground CYW43-to-SDIO bus-link copies validate both complete runtime/owner ranges and actual virtual-address alignment, use bounded word copies only when both mappings permit them, preserve invalidate/barrier/clean ordering, and cannot cross the runtime-ring/shared-payload seam; foreground sealed-parent trace and prepared-write/overlay authority remain bytewise unchanged. An authenticated CYW43 response may retain the current activation across exactly `Network -> Serial -> LocalSeat -> Dispatch -> Network` only with one service and flush advance, a one-step still-active connection-bound cursor, unchanged accepted-command count, and one exact generation/pair/lifetime token consumed at Dispatch. That wrapper admits LocalSeat exactly once, performs one backend poll when USB service debt exists, performs no second Network operation, and returns through the unchanged loop-top 250 us reserve and 64-unit guard before another separately charged Network turn. This changes no manifest allocation, SC numeric, CNode or Worker population, public command/wire/namespace, ABI field/layout, QEMU direct-VirtIO path, `.coh` workload, benchmark arithmetic, or report schema. A REST `perf` status/telemetry run made after executable READY preflight blocks is transport/read-path diagnostic only and cannot substitute for Worker pressure, capacity, Pi acceptance, or QEMU parity. Source, deterministic tests, static profile validation, QEMU checks, image construction, and flashing cannot prove the physical correction; fresh exact-image dual-mode hardware and qualified benchmark evidence remain mandatory.
  - exact-0745 direct-GENET retained-window candidate — exact source `0745e3592778ba802453735d8015d8f4be934d41`, image ID `af050eb6a31ddb676214b3b425a902a09fce2d5260fb632da4893d6d2f1a7529`, image SHA-256 `c43082a92ead026254bdc07420d6c773617c64e1ec9200d7b045ed9a743934a5`, serial diagnostics, and boot-paired `20260829-124133` captures prove WiFi Gate 8/DHCP/authenticated TCP/three focused scripts and a first GENET lifetime with DHCP, direct rings, peer-assisted `nettest`, authenticated TCP, and post-ARP 0.676 ms SYN-to-SYNACK. They reject performance and repeatability closure: WiFi raw 64/64 remains 2.396 requests/s with 362.848 ms p95 first response, and a clean second GENET boot raises the terminal `bcmgenet-v5` timeout during its first material direct episode with fresh plus elapsed-guard reason evidence before correct pair quarantine. Keep the exact `3,000/10,000 us`, two-refill, half-budget, 16-attempt, 800 us WCET, one-stalled-retry, wall-accounting, timeout, fault, DMA/IRQ, direct-ring, and containment contracts. A `Reenter` successor now remains inside the same notification or final-prewait handler instead of escaping through the generic command-ring loop between packet slices; a successor guard Yield returns to outer arbitration, and only an actual TX/RX owned-state advance is productive. Unresolved reconciliation still consumes its exact slice without resetting the no-progress retry. Descriptor-admitted uncached payload copies use the existing audited aligned volatile 64-bit primitive with bounded byte prefixes/tails while preserving DMA barriers and sequence-last cursor commits. Focused regressions must prove local multi-slice re-entry, successor-Yield return, zero-progress peer/IRQ/ambiguous-cursor bookkeeping, retained wall guard and stalled Yield, unchanged non-test unsafe count, word-copy bytes/order, and invalid-cursor fail-closed behavior. No budget, priority, refill, retry, queue, manifest, schema, telemetry, QEMU direct-VirtIO, or hardware setting changes. Source, host tests, QEMU packaging, static profile validation, image construction, and flashing cannot prove repaired GENET continuity or August parity; fresh exact-image dual-mode hardware evidence remains mandatory.
  - exact-3ad Pi child-handoff and sustained-GENET candidate — exact source `3ad239e95c7e145c28a2fbc9a2f5b5b291eba652`, build `d50b3c2b4c43ff6c3c4b5a38c9cf86284fbbf1558f65ea946ee8d354d6083f3b`, image ID `fcd8c0609b3575ba2770cf3ad74def759c53e04e489ab4af39c7e72e63b3f567`, image SHA-256 `b55da37cc692542939aa991f33b4175569c3ec783cbebfbe884f9c0acc36c658`, serial evidence, and boot-paired `20260829-163547` captures prove the corrected 104-frame/161-slot child contract, WiFi DHCP plus three canonical scripts, GENET DHCP/direct-ring health/peer-assisted `nettest`, and one complete 10,771-byte authenticated wired response without retransmission or reset. They reject performance and repeatability closure: WiFi remains on a repeated 10 ms root/child scheduling staircase, while a controlled later GENET `boot_v0.coh` reproduction first raises `bcmgenet-v5` Timeout during a sustained TAIL response and then correctly pair-quarantines the console child. Supersede only the disproven scheduling assumptions. A final direct-GENET slice that leaves no durable ring condition returns `Block` before guard/cap/stalled Yield, so quiescence cannot charge the remaining refill. Sustained ready traffic retains the exact `3,000/10,000 us`, two-refill, priority-160, core-1, 800-us-WCET, half-budget guard, 16-attempt, ownership, DMA/IRQ, standard-fault, protocol-fault, cursor-fault, and pair-containment contracts, but selects `NaturalPostpone`: ordinary budget exhaustion is kernel-postponed rather than misclassified as a terminal device fault. This does not enlarge CPU authority or create a fallback. On Pi only, root-control and console-network select equal priority/MCP `200/200` on core 0 and retain their existing `2,750/10,000 us` and `3,000/10,000 us` SCs. After an exact sequence-last packet/control/publication-ACK commit, or after electing one bounded service-tick wake, root must successfully signal the one-hot child notification before it may invoke `SchedContext_YieldTo` on the already retained child SC; inactive, contained, null-SC, wrong-core, unequal-priority, insufficient-MCP, unsignalled, or syscall-failure cases fail closed. Root's physical-input rotor and all budgets, refills, queue/credit bounds, ABI v5, schema 1.15, 256-Worker population, 16-bit CNode, hardware configuration, QEMU priority and direct-VirtIO path remain unchanged; compiler response analysis records `8,100 us` for both Pi root-control and console-network. The complete host-tool suite, `tools/cohesix-py`, `.coh` workloads, REST harness arithmetic, generated external profile contract, and report schemas were reviewed and require no behavior change. Source tests, QEMU packaging, static Pi validation, construction, image identity, and flashing cannot claim fixed GENET continuity, WiFi latency, August parity, or Pi acceptance; a fresh exact-image dual-mode boot and benchmark remain mandatory.
  - exact-0be4 dual-backend active-time and connection-proof correction — exact source `0be4e9f4027d0cdf694ba09ef73f6d94b0076182`, build `d945d7d493093286fcd1057e5d9c1acd6832a1e7977a16425024b20af294c397`, image ID `8f607abebae9da4ac9811cff7f0e2f8768deaa79e67cb9eae5da00bfed4ddfbe`, image SHA-256 `55367a1aa518b5dffca14d1844c7bebda867d7cfdab7b6f261412b0c8c777d70`, serial evidence, and boot-paired `20260829-180642` captures prove WiFi Gate 8, DHCP, authenticated TCP, three focused scripts, and 8/32 medium/high REST pressure with zero transport/control errors, plus GENET DHCP, balanced lossless direct rings, authenticated TCP, the same scripts, and the same pressure with zero errors. They reject latency closure: WiFi needs about 93.5 seconds to become ready and records 3,155 outer 25-ms time-cap exits, while GENET retains a 10.251-ms mean ping floor and MCS fresh/guard/cap reasons on otherwise quiescent wakes. Preserve the audited 250-us root pre-admission reserve; do not reinterpret it as a 2,500-us work window. Instead, accumulate the outer 25-ms CYW43 cap only across admitted Network-service intervals, excluding replenishment gaps, exact-child waits between turns, and physical-operator phases while retaining the independent 25-ms real-wall operator checkpoint and absolute 192-turn cap. A direct-GENET final slice with exact empty rings and rearmed source closes only the userspace episode start/attempt/stalled state before Block; a later real IRQ or reciprocal peer wake starts a new episode on the same unchanged kernel SC. Continuously durable work retains GUARD/CAP/STALLED, and endpoint-command FRESH survives quiescent closure. The peer-assisted self-test must execute its observation on every selected console poll, bind a first later authenticated connection at its fresh zero counter epoch, and latch that identity's command-read, response-write/drain, TX, RX, and listener facts; retirement prevents a replacement peer or later unrelated NIC traffic from completing missing proof. The complete host-tool suite, `tools/cohesix-py`, generated profile/contracts, manifests, `.coh` workloads, REST harness arithmetic, report schemas, ABI v5, schema 1.15, every manifest/MCS numeric, core/priority/refill, queue, ownership, and public command/diagnostic format were reviewed and require no implementation or schema change. Focused tests, QEMU packaging, profile validation, image construction, and flashing cannot prove the latency repairs; the next exact image must repeat both backend scripts and medium/high REST pressure.
  - exact-f754 dual-backend root/child latency correction — exact source `f7544e88868d77ca90e7bcd687fedb66c1d11f02`, build ID `bbc72b4085fd69d7d2e613b037df8c80df148a92b97a4a9e52b5f77b0386a71b`, image ID `63ce19d903d15a2369b8c7fa5d0dae2e24898ee1b5f05a9b286dc1fd2913c68d`, image SHA-256 `fa74ee65dab14b5258c72882cea956d7537c43aae48e07d00f44a474a71ea85b`, exact serial evidence, and boot-paired `20260829-192549` captures prove both backends remain functionally correct while rejecting August latency parity. WiFi completes 64/64 framed requests on one connection without retry at 3.786 requests/s, 234.838 ms median, and 301.319 ms p95; its physical SDIO/CYW43 DPC work is predominantly sub-millisecond while root/console-child progress retains the repeated near-10-ms scheduling staircase. GENET completes the same 64/64 workload without retry at 24.646 requests/s, 38.323 ms median, and 45.511 ms p95; its rings conserve every observed descriptor without drop or poison, and the paired capture places target TCP ACK below one millisecond while application response remains 39--45 ms later. The next candidate removes those two root/child seams without changing public telemetry. The physical linked-runtime Network leaf runs only its timer/NIC/reconciliation responsibilities; the existing Serial, LocalSeat, Dispatch, and Display leaves retain the bounded root IPC/bootstrap/stream/reboot control tail, preventing that composite tail from being multiplied by every retained child microstep. The already compiler-admitted equal-priority Pi child handoff extends to mediated WiFi only after the service is exactly `Authenticated`, root committed and successfully signalled one one-hot wake, the runtime is active and uncontained, and its retained SC is live; pre-authentication and closing/fault/terminal states keep the ordinary physical-operator rotor, while QEMU direct-VirtIO remains non-YieldTo and direct GENET keeps its existing policy. When one direct-GENET Network unit observes an exact authenticated command with no physical-operator, response, recovery, containment, reboot, quarantine, pressure, or identity debt, the existing five-unit composer may run `Network -> Dispatch -> Network` to stage its exact response, then must return to Serial and stop. It adds no unit: a queued second command remains behind the restored `Serial -> LocalSeat -> Dispatch -> Display` debt, and every rejected or drifted entitlement falls back to the ordinary bounded rotor. All SC budgets, periods, refills, priorities, MCPs, cores, WCET inputs, queues, authorities, ABI v5, schema 1.15, 256-Worker population, 16-bit CNode, manifest, hardware configuration, and public command/diagnostic formats remain unchanged. The complete host-tool suite, `tools/cohesix-py`, generated profile consumers, `.coh` workloads, QEMU response matrix, REST benchmark arithmetic, and report schemas were reviewed and require no implementation change. Focused source tests, QEMU checks, static profile validation, image construction, identity verification, or flashing cannot prove latency or performance improvement; the next exact-image boot must rerun first-attempt scripts plus medium/high and raw framed benchmarks on both WiFi and GENET before any August-parity claim.
  - exact-ae2 passive-service and MCS-wake correction — source `ae2dd77412` passed WiFi readiness, all Gate 8 phases, DHCP, 272/272 registration and five TCP/AUTH handshakes. Every Queen operation and serial reboot then failed at busy ATTACH; scripts could not start and REST failed on its first request. Target-only peer-assisted PASS conflicts with the failed host peer. No GENET result or function/performance closure is claimed; the exact matrix is archived. Route this first to `SERVICE_RUNTIME` under `m26e-console-network-service-isolation` and `m26e-root-tcb-target-proof`, not to RF, SDIO, CYW43, DHCP, queues, retries, or GENET tuning. Supersede only the disproven authenticated mediated-WiFi handoff: WiFi is signal-only in every lifecycle state, while direct GENET alone retains the compiler-validated guarded `SchedContext_YieldTo`; QEMU direct-VirtIO remains on its existing branch. On selected MCS, runtime receive classification uses the exact compiler-owned 64-bit command badge plus nonzero length for IPC and treats an admitted low-32 nonzero badge as notification work regardless of stale `MessageInfo`; zero, zero-length command, wrong-task, and foreign high-domain observations fail closed, while classic behavior remains length-first. Before any physical-Pi serial, local-seat, or TCP path dequeues a command that may donate root's SC to passive NineDoor, validate generated root budget/WCET/period/admission/consumed-evidence truth and accumulate `SchedContext_Consumed` over a conservative full-period window. Admit only strictly below the checked `budget_us - wcet_us` limit of 250 us, leaving the complete 2,500 us WCET inside the unchanged SC; retain the exact command and yield without resampling or sliding while blocked; carry the first post-expiry sample into the next window; and latch invalid profile, counter, period, or syscall evidence fail closed with one bounded operator marker. A `Closed` result at exact `CallArm`, `Call`, recovered timeout, or recovered fault stage revokes and fences the generation, preserves its first evidence through containment, and cannot reset/retry a `REPLIED` lane. No SC budget, period, refill, priority, MCP, core, queue, retry, owner, capability allocation, 16-bit CNode, 256-Worker population, schema 1.15 manifest, ABI layout, hardware configuration, public AUTH/framing/ATTACH busy response, `.coh` workload, benchmark arithmetic, or report schema changes. The full host-tool suite, `tools/cohesix-py`, generated profile consumers, QEMU response matrix, `.coh` workloads, REST harness, and evidence scripts were reviewed and require no implementation change. Focused source checks must be followed by a fresh canonical QEMU boot with TCP AUTH/ATTACH, one representative NineDoor operation, and fault scan; QEMU remains a rejection gate, not Pi evidence. Fresh exact-image WiFi and GENET boots must independently pass scripts, raw framed latency, and medium/high pressure before function, performance, or August parity can be claimed.
  - exact-284 Pi operator-liveness correction — exact source `284926dacef4b7ee892d2c861ae2e8d2232a7b9b`, build ID `02e611f7b6347c68c0889d033d9529b9a81977df37d4ae5d4d665a5b19bbbb10`, image ID `6de50f3ba2ee24bb87fe0f6082c823ba2164f161301a8d85e5fc33b8161618188`, and image SHA-256 `e1961fd8e37bbf646ade643595565a3c7c4e87d8ec94b9ef5ff3e42c8c971554` reached root and USB command-ready in both network modes but the operator observed neither serial nor USB command response. Selected seL4 source confirms `seL4_SchedContext_Consumed` returns microseconds, rejecting a unit-conversion defect. The shared regression is instead the newly introduced reserve check ahead of raw serial, local-seat, and TCP dequeue: it can suppress a byte or diagnostic that cannot donate to NineDoor. Move that unchanged fail-closed reserve to the parsed-command boundary. Raw bounded ingress, echo, parsing, and root-owned diagnostics remain live; only `ATTACH`, NineDoor namespace operations, and other commands that can enter the passive service sample the unchanged conservative window and receive typed `busy detail=root-sc-reserve` when denied. Preserve every SC numeric, Reply/fault/isolation boundary, driver owner, queue, manifest/schema, CNode/Worker allocation, hardware setting, QEMU selector, public framing, `.coh` workload, benchmark arithmetic, and report schema. Focused Pi-feature regressions must force admission closed and prove serial, USB, and TCP `help` still execute while a passive command cannot reach NineDoor. Static tests, image construction, identity verification, and flashing cannot prove physical liveness or August parity; the next exact-image dual-mode boot must rerun operator diagnostics, authenticated scripts, raw framed requests, and medium/high pressure.
  - bounded sub-MSS response wire-train candidate — replace one-smoltcp-enqueue-per-response-record draining with complete-record trains capped at 1,400 bytes, below the qualified Pi TCP MSS. The maximum eight-by-256-byte response remains eight unchanged length-prefixed external frames and drains as exact 1,300-byte and 780-byte trains; no aggregate frame or new grammar is introduced. Preparation is non-mutating, socket capacity is preflighted for the complete train, and only an exact enqueue may commit the connection-, batch-identity-, and cursor-bound advance. Backpressure or stale preparation consumes nothing; a partial enqueue is a terminal invariant failure rather than a retry that could duplicate output. Preserve ABI v5, schema 1.15, AUTH/ATTACH and ACK/ERR/END behavior, queue and record bounds, publication credit, retry policy, QEMU direct-VirtIO behavior, and every manifest/MCS numeric. Compatibility review covers `coh`, `cohsh`, `coh-status`, Hive Gateway, SwarmUI, GPU/sidecar/ticket tools, `cas-tool`, every `.coh` workload, `tools/cohesix-py`, generated profile consumers, REST benchmark arithmetic, and report schemas; unchanged length-prefixed framing requires no consumer or schema change. Focused source tests and QEMU packaging can reject this candidate but cannot prove Pi throughput or August parity; fresh exact-image WiFi and GENET benchmarks remain mandatory.
  - exact-324 Pi response-publication discriminator and bounded correction — cite both `m26e-qemu-shared-control-path-performance` and its owning `m26e-console-network-service-isolation` boundary. Source `324abf4a8` passed WiFi readiness, Gate 8/DHCP, scripts, peer-assisted nettest and raw64 without fault, but delivered 7.190 requests/s at 161.167-ms p95. REST function passed; cached results do not prove target latency. GENET passed DHCP and authenticated ingress before QUIT triggered pair quarantine: the composer mistook an absent SyncCapture for containment although the exact terminal was already queued. Full boot-paired provenance is archived. Admit that typed `NoPending` outcome only when the ordinary stage-ready predicate independently proves the exact sealed lane; otherwise defer as `OutputMissing`, while identity drift retains the existing fail-closed containment. For copied WiFi, permit one already-minted credit to rebase after the ordinary Dispatch cut only when exactly one authenticated network command advances, the previously empty response lane becomes one exact nonempty sealed completed lane, the previously empty flush becomes one bounded same-connection flush, and lifetime, generation, response identity, service progress, operator rotor, recovery, containment, quarantine, reboot, and handoff evidence remain exact; every other delta rejects before Network. Finally, repair only Pi causal telemetry: child publication time and root observation/stage/drain samples use the same absolute `CNTVCT_EL0` epoch scaled by generated `TIMER_CLOCK_HZ`, and the GENET/CYW43/default wrappers forward the exact dispatch observation to the isolated adapter. Root elapsed time remains the runtime/smoltcp clock and is never compared with the child's absolute epoch; host tests and QEMU retain their existing fallback and release hot path. This changes no SC budget, period, refill, priority, MCP, core, MCS authority, queue, retry, owner, capability, CNode/Worker allocation, manifest/schema, ABI layout, hardware setting, QEMU selector, command/framing/ACK/ERR/END grammar, namespace, authentication, or `netstats` row shape. `docs/HOST_TOOLS.md`, the complete host-tool suite, `tools/cohesix-py`, `coh-rtc` and generated profiles/contracts, all `.coh` scripts, `cohsh`, Hive Gateway/REST, Pi helper and trace consumers, raw/REST benchmark workloads and arithmetic, evidence records, and report schemas were reviewed and require no implementation, fixture, generated-output, workload, or schema change. Source and QEMU checks can reject this correction, but neither the exact-324 failure evidence nor the corrected next image proves WiFi/GENET throughput, latency, August parity, repeatability, or Pi acceptance; fresh exact-image dual-mode Pi scripts, raw TCP, medium/high REST pressure, causal diagnostics, operator liveness, and boot-paired captures remain mandatory.
  - exact-082f dual-backend MCS response-episode correction — source `082fce832a` passed WiFi Gate 8/DHCP and authenticated TCP but could wait seconds between response stage and drain. GENET retained sub-millisecond handshake/ingress while response p95 was 16.428 ms versus the August 1.582-ms comparator. Paired traces locate deterministic 10/20/30-ms response delay after TCP admission; exact source/image and 20260831-070751 capture identities remain archived. For direct GENET, admit one cross-core root successor after exact `StagePublished` or fused `CommandAcceptedAndStagePublished` progress under the existing identity, topology, operator, recovery, and zero-`YieldTo` accounting fences. Stage-only authority is one-shot and cannot open the drain-only active tail. For copied WiFi, mint a separate exact authenticated response-episode token only from the already proven one-command Dispatch rebase. Bind it to physical generation/pair/lifetime, isolated generation, authenticated connection, accepted-command epoch, sealed response lane, service cursor, and bounded same-connection flush. The token may survive the selected Yield, but each resumed turn retains the current strict activation only after one exact response-owned stage, drain, or TCP/CYW43 egress successor; the existing exact response-rotation predicate remains the sole flush-continuation authority. An observe-only notification preserves the cursor but yields because it cannot prove response ownership; an unchanged observation, bare flush decrement, timer tick, generic network activity, or mixed-counter delta also yields. A second command, multiple physical operations, identity/cursor drift, physical-operator debt, passive admission, recovery, containment, quarantine, reboot, handoff, or local fault revokes it. Preserve the existing unslid manifest-derived `budget_us - wcet_us = 3,000 us` guard, 64-unit cap, one-physical-operation turn, every SC budget/period/refill/priority/core, queue, retry, driver owner, ABI v5, schema 1.15, 256-Worker population, 16-bit CNode, hardware configuration, and public command/telemetry shape. QEMU direct VirtIO and its qualified retained loop remain unchanged. The complete host-tool suite, `tools/cohesix-py`, generated profile/contracts, `cohsh`, all `.coh` workloads, REST/raw benchmark arithmetic, evidence consumers, and report schemas were reviewed and require no implementation or fixture change. Focused source tests, QEMU packaging, static Pi validation, image construction, identity verification, and flashing can reject this candidate but cannot prove either speedup or August parity; the next exact-image WiFi and GENET boots must rerun first-attempt scripts, raw framed latency, medium/high REST pressure, causal diagnostics, and operator liveness.
  - Historical Pi console image allocation correction — admitted the then-current direct-GENET console executable as 66 PT_LOAD pages, 104 service frames, and 161 retained root CSpace slots. This Pi-only increment is exactly one immutable executable image frame and its retained mapping cap; fixed, maximum, and admitted Pi frame/slot totals rise by one while the 32 external GENET pages, stack, CNode, Worker population, schema, MCS/timing values, and every data-plane and scheduling budget remain unchanged. QEMU allocations remain unchanged.
  - schedule lifecycle — add an exact FIFO `dequeue` record to the shared target/host NineDoor contract. Empty, stale, and out-of-order IDs fail without mutation; one success removes one pending record and increments the existing `dequeued` evidence. The REST workload measures an enqueue/dequeue lifecycle without widening the queue or treating consumer acceptance as Worker completion.
  - host execution recovery — compact only terminal host-ticket journal payloads after exact result publication and durable lane-cursor advancement. A durable cumulative admission-sequence fence preserves replay rejection and crash recovery while nonterminal provider state remains intact; a lane therefore has no fixed lifetime-operation ceiling.
  - lease lifecycle — retain completed preemptions in a fixed-capacity chronological ring in both target and host NineDoor implementations. A valid preemption evicts the oldest observation instead of failing control when evidence storage turns over; `/proc/lease/summary` keeps the cumulative successful-preemption count, preserving exact turnover accounting without widening the generated bound.
  - passive-service locality — place NineDoor on core 0 beside its sole `root-control` donor and require the common compiler-validated `locality_bound` invariant in QEMU, regression, and Pi manifests. This removes a cross-core synchronous handoff without changing the passive Reply-object topology, any SC budget/period, or any Pi-specific driver, hardware path, build/flash logic, or diagnostic.
  - passive-service publication — pair root and child release/acquire fences around each ordinary cached request/response frame before publishing or consuming the matching IPC sequence. IPC retains its sole notification/Reply role and no longer substitutes for AArch64 shared-memory ordering under high request pressure.
  - exact-077 passive-admission correction — exact source
    `077578a475c1916dcdcbc9119c2e27a960e25c58`, build ID
    `599797d9fbf4960dbf988082ebe308f2bc4b1711ebe11894fad1fa4e25d407c6`,
    image ID
    `aac79c8f539939eb3530cfd4ccd6ec958842d866b22e58cbefef6a111fd461e1`,
    image SHA-256
    `634aec4a37e2a398cad629e43df709043bd873d924d29cc7090d5f96b6f3c679`,
    exact serial diagnostics, and boot-paired `20260829-230338` captures
    prove WiFi Gate 8, DHCP, authenticated TCP, responsive serial diagnostics,
    zero console/runtime drops, and a sealed 272/272 MCS registry without fault
    or quarantine. They reject functional and performance closure because the
    first passive command fails `busy detail=root-sc-reserve`: the first
    `SchedContext_Consumed` sample includes all prior root work and the
    retrospective accumulator can never establish a fresh 250-us reserve.
    Retain the exact parsed passive command and its session/connection identity
    after one baseline/reset sample, enter one mandatory selected periodic MCS
    Yield boundary, then on the first resumed activation refresh policy time
    and decide from one fresh sample. A value strictly below 250 us admits once;
    equality or excess emits one typed refusal and terminates without retry.
    Raw serial, local-seat, and TCP diagnostics remain live before retention.
    Newly published raw, intermediate, or final isolated-service recovery,
    reboot, containment, quarantine, timer/accounting invalidity, or authority
    drift preempts and cancels before sampling or dispatch; `CallArm` brackets
    its exact sequence with complete frontier checks and exact rollback.
    A proposed same-activation direct-GENET response-successor was audited and
    deliberately omitted: the generated contracts contain no independent
    worst-case bound for each fused root leaf plus epilogue, so a pre-unit wall
    check could not prevent the last unit from crossing the unchanged root MCS
    WCET. The established direct-GENET, mediated-WiFi, five-unit rotor, SC
    budget/period/refill/priority/core/WCET, Worker/CNode/manifest/schema, public
    grammar, and QEMU direct-VirtIO paths therefore remain unchanged. Current
    WiFi has no under-load proof after ATTACH and receives no speculative
    CYW43/SDIO mutation. The complete host-tool suite, `tools/cohesix-py`,
    generated profile consumers/contracts, `.coh` workloads, REST benchmark
    arithmetic, and report schemas retain unchanged external behavior and need
    no implementation change. Focused source and QEMU checks can reject the
    candidate but cannot prove Pi function, latency, throughput, or August
    parity; fresh exact-image WiFi and GENET scripts plus raw and medium/high
    pressure remain mandatory.
  - exact-1c MCS Yield-evidence correction — source `1c269ed97f` passed WiFi Gate 8/DHCP, TCP, serial/USB, 272/272 registration and the exact peer transaction. The first script's log and the raw session failed passive admission with `root-sc-reserve`; usable readiness remained about 136 seconds. Service/performance closure failed. Exact identities and 20260830-071519 captures are archived. Do not run medium/high REST pressure past this first failed
    invariant or claim GENET, benchmark, or August parity from this WiFi-only
    boot. Selected repository-managed seL4 source proves the accounting cause:
    MCS `handleYield` relinquishes the remaining refill, then restores actual
    `scConsumed`, so the capture-time baseline leaves parse unwind and rotor
    work in the supposed fresh post-Yield sample. The original second
    pre-Yield Consumed-reset proposal is now disproven: that syscall clears
    stored `scConsumed` evidence but cannot clear the live per-core
    `ksConsumed` value which Yield preserves. Retain the baseline only for
    validation, perform the existing Yield, capture `CNTVCT_EL0` as the first
    resumed userland operation, then drain and discard the preserved Consumed
    evidence once. Complete bounded policy, authority, environment, and
    recovery preparation before the final admission sample, then decide from
    the strict wall interval between the resumed capture and that final
    admission/WCET cut. The strict comparison, direct dispatch, and bounded
    response/epilogue remain inside the declared 2,500-us WCET. Snapshot the
    cheap recovery frontier first; an
    already-published fault cancels and performs material recovery in the same
    turn, while a healthy retained command runs before ordinary no-fault
    containment probes and retains the post-decision and `CallArm` frontiers.
    Preserve strict `<250 us`, equality refusal, timer/frequency/counter drift
    refusal, one attempt/no retry, every MCS numeric and WCET, all driver
    owners and queues,
    schema 1.15, the 16-bit Pi root CNode, 256 executable Workers, hardware
    settings, public protocol, QEMU direct-VirtIO branch, `.coh` workloads, and
    benchmark arithmetic. The full host-tool suite, `tools/cohesix-py`,
    generated contracts/consumers, evidence tools, and REST reports were
    reviewed; unchanged external behavior requires no implementation or schema
    change. Focused state/source tests plus a canonical QEMU TCP/NineDoor canary
    are rejection gates only; fresh exact-image WiFi and GENET scripts, raw
    framed tests, and medium/high pressure remain mandatory for closure.
  - exact-91b complete-service-frontier correction — source `91b2c529ce` passed generation-bound nettest and all three first-attempt scripts, then refused raw ATTACH and serial reboot with `root-sc-reserve`. Gate 8 took about 149.690 seconds versus the accepted 10.6–12.7-second baseline. Two service-fault lookups scanned all 272 temporal tasks on each hot-path visit, including passive admission's 250-us margin. This is failure evidence for sustained service and latency; exact identities and traces are archived. Replace those two O(Workers) lookups with one fresh call to
    the existing complete-service frontier. It must sample raw,
    intermediate, and final-handoff service state with the existing Acquire
    ordering, treat handoff contention as pending, preserve existing
    invalid-state handling, cache no result, and preserve recovery-first
    arbitration, post-sample `CallArm`,
    strict `<250 us`, every MCS numeric/WCET, and all QEMU/GENET/driver
    behavior. Focused tests must prove empty, raw, intermediate, final, and
    contended frontier outcomes plus source ordering and absence of an
    O(Workers) lookup in either hot predicate. Public grammar and ABI, the
    complete host-tool suite, `tools/cohesix-py`, generated profiles, contracts,
    and consumers, every `.coh` script, and benchmark implementations,
    workloads, arithmetic, and report schemas are unchanged and require no
    consumer change. The canonical `root-mcs` QEMU canary is a shared-root
    rejection
    gate; only fresh exact-image WiFi and GENET scripts, raw latency, and
    medium/high pressure can prove sustained function, the expected Gate-8
    reduction, or August parity.
  - exact-bdb Pi resumed-lease and reciprocal-progress correction — source `bdb33f82ca` reached root/USB readiness and Gate 8, but retained 193–250-ms responses and about 3.42 kB/s output. Passive admission and serial reboot failed with `root-sc-reserve`; no valid REST benchmark or GENET run resulted. The selected kernel source disproved the second Consumed reset: it clears stored scConsumed, not live per-core ksConsumed. Exact boot identities, timing and captures remain archived. Retain one baseline validation sample, Yield once, capture `CNTVCT_EL0` as
    the first resumed userland operation, drain and ignore the preserved
    pre-Yield Consumed evidence once, then admit only when the exact
    capture-to-final-admission/WCET-cut wall interval is strictly below
    `budget_us - wcet_us = 250 us`; the strict comparison, direct dispatch,
    and bounded response/epilogue remain inside the declared 2,500-us WCET.
    Equality, timer-frequency drift,
    backwards/missing evidence, accounting failure, or invalid period
    conversion fails closed with no retry. In the CYW43 runtime, only an exact
    successful child completion under a sealed ordinary firmware-chunk or
    NVRAM-chunk parent may publish at most one following immutable SDIO child
    in that same root-granted turn. A fault terminal, other parent operation,
    steady or persistent path, pending child, stale/unknown identity, or
    consumed submit slot admits no new child, and a turn can never publish two
    new physical commands. This removes one avoidable reciprocal scheduling
    edge in the dominant cold streaming phases while preserving the sole SDIO
    physical issuer, every MCS numeric, generated manifest/profile, schema,
    ABI, queue, timeout, retry, recovery, Reply, containment, Worker/CNode,
    hardware, public protocol, and QEMU direct-VirtIO contract. The complete
    host-tool suite, `tools/cohesix-py`, generated contracts, profiles and
    consumers, selected manifests, `.coh` workloads, and benchmark arithmetic
    and report schemas were reviewed and require no implementation change.
    Focused source tests and the shared `root-mcs` QEMU canary can reject this
    source candidate, but build, QEMU, static-profile, image, and flash results
    cannot prove Pi behavior. Fresh exact-image WiFi and GENET scripts, raw
    latency, and medium/high pressure are mandatory before any function,
    speedup, or August-parity claim.
  - exact-3f87 dual-backend retained-quantum and USB-debt correction — source `3f87bca1f9` passed both modes' DHCP, scripts and raw64 but failed August latency parity: WiFi 4.404 requests/s at 249.597-ms p95; GENET 24.473 requests/s at 44.989-ms p95. GENET's healthy DHCP/ACK and loss-free ingress locate the delay before application response. Full paired timings and identities remain archived.

    Supersede only the disproven direct-GENET one-quantum stop: after the
    mandatory Yield, retain the first resumed `CNTVCT_EL0` origin across
    another complete ordinary five-phase root quantum only when the exact
    authenticated generation and connection remain current and one accepted
    command and its response-stage unit made durable progress. Before every new
    complete quantum, elapsed wall time must remain strictly below the
    unchanged generated `budget_us - wcet_us = 250 us` cut; equality refuses,
    and at most 64 complete quanta may be retained. A final side-effect-free
    recovery/operator/fault check, passive admission, reboot, containment,
    quarantine, handoff, identity drift, invalid timing, or no progress forces
    Yield and fails closed. No repeated Consumed sample creates authority.
    CYW43 retains its existing separate 250-us/64-unit semantics, and QEMU
    direct-VirtIO behavior is unchanged.

    The same boot exposes a separate USB eligibility defect rather than an
    xHCI timeout: once the required controller is admitted and ready,
    `controller_ready && !command_ready` remains bounded bootstrap
    `LocalSeat` debt even before backend polling is enabled. The finite CYW43
    operator rotation grants one existing bounded local-seat turn, alternates
    with serial, and stops that extra debt at command readiness. This neither
    makes USB command readiness a CYW43 prerequisite nor changes a USB/CYW43
    budget, retry, deadline, owner, or operation bound. Current WiFi still
    requires fresh physical proof that its synchronous child-Yield cadence is
    closed; no WiFi parity claim is made. The complete host-tool suite,
    `tools/cohesix-py`, generated contracts and consumers, `.coh` scripts, and
    benchmark workloads, arithmetic, and report schemas were reviewed and
    require no behavior or schema change. Fresh exact-image dual-mode scripts,
    raw latency, and medium/high pressure remain mandatory before promotion.
  - exact-5094 physical routing and bounded child-credit/stream/HDMI
    correction — source `509445402f` passed both modes' readiness, DHCP, TCP and focused scripts. WiFi raw latency was unmeasured; GENET raw64 delivered 25.805 requests/s at 44.943-ms p95, failing August parity. Healthy hardware/rings/ingress locate the wired bottleneck in root/console MCS cadence. Full boot/image records remain archived.

    Supersede the disproven all-wall, command-plus-stage continuation. For the
    exact direct-GENET generation, classify one root quantum as exactly one of
    command accepted, command accepted plus durable stage, durable stage,
    response drained, or drain plus durable stage. Before every direct child
    dispatch, drain its prior SC accounting, measure only the adjacent
    `YieldTo` call wall, and credit no more than both the returned child
    consumption and that call wall. Retained root time remains strictly below
    the unchanged generated 250-us cut, equality refuses, and the independent
    64-quantum cap and every identity, operator, recovery, containment,
    quarantine, reboot, handoff, and no-progress fence remain exact. Invalid
    accounting is sticky and denies retention without stopping ordinary
    service. The mediated WiFi runtime in the same Pi image remains signal-only
    and performs neither the pre-drain nor `YieldTo`. This changes no MCS
    numeric, Reply semantic, ownership, ABI,
    manifest, or QEMU direct-VirtIO behavior.

    During an exact ACKed ordinary CYW43 firmware/NVRAM root grant, each exact
    immutable successful terminal may publish its single immutable successor,
    up to an independent 64-successor cap. Fault, malformed or waiting
    terminals, stale generation or descriptor identity, unknown issue state,
    pair restart, recovery, persistent/steady operations, and unacknowledged or
    delegated grants fail closed without moving the frontier or cap. The sole
    SDIO physical issuer, DPC/CARD_INT fairness, budgets, retries, deadlines,
    and recovery authority are unchanged.

    USB arrow input continues to move the desired HDMI viewport one row per
    repeat, while accumulated render debt uses the largest exact symmetric CSI
    `nT`/`nS` span fitting the bounded 512-byte frame. Every retained receipt is
    generation-anchored; wrap, eviction, missing history, and invalid anchors
    collapse to one canonical redraw. Pending tail bytes cannot be overtaken by
    a scroll departure, and the canonical `Cohesix console ready` rendering is
    queued ahead of the HDMI `cohesix>` prompt. The complete host-tool suite,
    `tools/cohesix-py`, generated contracts and profiles, `.coh` workloads,
    and benchmark workloads, arithmetic, and report schemas were reviewed and
    require no implementation or schema change. Focused source, target-compile,
    and QEMU gates can reject this candidate; a clean image or flash cannot
    prove physical speedup. Fresh exact-image WiFi and GENET raw latency,
    scripts, and medium/high pressure remain mandatory before parity or
    acceptance claims.
  - exact-a6c dual-mode discriminator and bounded refill-boundary correction —
    source `a6cdb7a40c` passed WiFi DHCP/TCP/nettest, scripts and REST, but raw64 was 4.350 requests/s at 250.393-ms p95. GENET passed a functional prefix before smp_parity and REST hit root-sc-reserve; raw64 was 23.016 requests/s at 48.759-ms p95. Paired ACK/response timing places the wired delay after healthy ingress. Performance parity failed; full provenance is archived.

    Supersede the stream-only cold CYW43 wording: within one exact ACKed root
    grant, immutable terminal-local continuation applies to every finite cold
    parent—transport init, firmware prep, firmware chunk, NVRAM chunk/tail,
    and release—under the unchanged 64-successor cap. Zero-payload parents
    additionally require zero descriptor and retained payload identity.
    Control, RX, steady, persistent, recovery, restart, issued-unknown,
    watermark-fault, generation, descriptor, payload, and ticket drift retain
    the ordinary root boundary. Healthy steady op7 already uses its durable
    lease and condition-before-sleep path without an explicit runtime Yield;
    no fabricated steady grant or budget increase is authorized by the cold
    correction.

    Preserve one parsed passive-service command across at most one genuinely
    new Yield/refill after an expired strict reserve lease. Each attempt starts
    from `AwaitingYield`, drains fresh Consumed evidence, retains the unchanged
    strict `<250 us` comparison, and rechecks every identity, authority,
    recovery, containment, quarantine, reboot, and session fence. A second
    expiry emits the existing single typed refusal. For exact direct GENET
    only, a successful response `StageOutput` may immediately observe and ACK
    the causal child publication after its same-core `YieldTo`; an absent,
    unrelated, backpressured, or faulted publication leaves any observed ACK
    pending for the ordinary `ObserveChild` turn, while non-GENET, QEMU, and
    WiFi paths never enter this observation. Exact stage-plus-drain progress
    accounts both child calls and cannot admit a second command ahead of the
    response lane.

    Local HDMI readiness is independent of network readiness: emit the ready
    banner only after root and USB command admission, and expose the prompt
    only after that exact banner frame completes. An arrow at the live tail
    seals and drains only the already-pending output prefix, rebases its
    completion with generation and logical-tail identity, then uses the
    bounded CSI scroll path. Later output remains ordered behind the fence;
    mismatch, wrap, eviction, or unavailable history requests exactly one
    canonical snapshot. This changes no xHCI issue, poll, completion, owner,
    retry, or budget path.

    The complete host-tool suite, `tools/cohesix-py`, generated profile and ABI
    consumers, `.coh` workloads, and benchmark workload, arithmetic, and
    report schemas were reviewed. The public console grammar, REST/TCP
    framing, manifest schema, generated contracts, and report formats do not
    change, so those surfaces require no implementation or fixture update.
    Pi-only source tests, exact AArch64 target compilation, and a nonclaiming
    QEMU root-MCS canary are required before a clean candidate image. A fresh
    dual-mode Pi run remains the only authority for boot speed, physical
    console behavior, sustained latency, pressure, and August parity.
  - exact-4be QEMU-shaped Pi scheduling and bounded active-response candidate —
    source `4be7bad98b` passed both modes' nettest, scripts, REST and raw64 with healthy devices and conserved queues. WiFi/GENET p95 remained 263.210/48.847 ms, failing August parity. GENET admitted only 62/271 productive continuations within the existing 250-us reserve; Yield forfeited the remaining refill. Full measurements and artifact identities remain archived.

    Adopt the bounded QEMU topology principle without copying QEMU numerics or
    weakening Pi admission. Pi root-control remains on core 0, keeps
    `max_refills=2`, priority/MCP 200/200, period 10,000 us, and exact
    2,500-us WCET, but selects a compiler-admitted 5,500-us budget and 5,100-us
    response bound. Move the isolated console-network service from core 0 to
    core 2 with its unchanged 3,000/10,000-us budget/period, priority/MCP,
    WCET, authority, and queues, and select eight refill records in its existing
    8-bit SC. Move HDMI from core 2 to core 1 without changing its
    2,000/10,000-us reservation or priority. Keep PCIe on core 2, GENET on
    core 1, CYW43/SDIO on core 3, and both passive-Worker executor lanes on
    cores 2 and 3. The compiler must derive exact active demand
    `8,750/8,250/8,400/8,000 us` on cores 0--3 against each 9,000-us usable
    capacity, response bounds root/console/HDMI/PCIe/GPU executor
    `5,100/3,000/5,200/3,300/8,300 us`, and root's strict productive reserve
    `budget - WCET = 3,000 us`. Adjacent drift in budget, core, response,
    reserve, refill, sched-control core, or mirrored console configuration
    fails closed. QEMU retains its existing 9,000-us root, core-2 lower-priority
    console child, max-two-refill selections, affinities, and response bounds.

    Direct GENET becomes cross-core signal-only: root commits the one-hot wake
    but performs no `SchedContext_YieldTo`, pre-drain, child-consumed credit, or
    same-core accounting. Same-core and cross-core authority are distinct
    generated states; a missing or failed same-core Yield can never be
    reinterpreted as signal-only progress. An exact authenticated
    generation/connection `OutputDrained` transition may open one unslid
    root-local active response tail for at most 8 ms and at most 64 complete
    physical-rotor quanta. The scheduling context remains the hard CPU bound,
    and every quantum rechecks passive admission, physical operator work,
    response priority, recovery, containment, quarantine, reboot, handoff,
    local fault, generation, connection, phase, counter frequency, wall expiry,
    and the shared cap. Mediated WiFi remains signal-only and gains no direct
    GENET authority; its CYW43/SDIO SCs and physical protocol stay unchanged.
    GENET and console-network each select eight refill records only to preserve
    bounded fragmented wake progress; no device budget, period, WCET, packet
    bound, retry, or fallback is enlarged.

    Add root-local scalar telemetry for active-tail opened/admitted/closed and
    maximum wall time plus distinct same-core versus cross-core productive
    authority; change no shared child ABI, public command grammar, TCP framing,
    REST schema, or benchmark report. The complete host-tool suite,
    `tools/cohesix-py`, generated-profile consumers, `.coh` workloads,
    benchmark workloads/arithmetic, and report schemas remain compatible and
    require no consumer change. The internal Pi hardware-evidence normalizer
    and its proof fixtures advance only their exact HDMI affinity oracle from
    core 2 to core 1; this changes no public evidence schema. Focused
    source/profile tests, exact Pi target
    compilation, generated/Test Plan checks, and a QEMU root-MCS canary can
    reject this candidate. A clean image or flash cannot prove boot speed,
    operator quality, WiFi/GENET latency, or August parity; the next exact-image
    dual-mode boot must rerun diagnostics, three scripts, raw 64, medium/high
    pressure, and USB/HDMI/serial checks before any performance claim.
  - exact-0c refill-loss discriminator and bounded transaction-window candidate
    — source `0c734db753` passed both modes' functional paths but failed performance parity. WiFi reached Gate 8 at 34.110 seconds and raw64 at 7.02 requests/s, 166.209-ms p95; reserve/Yield cuts explain about 22.17 seconds of cold delay. GENET reached 113.884 requests/s at 16.459-ms p95 with repeated no-successor exits inside transactions. The evidence routes both regressions to MCS continuation; complete paired records are archived.

    Preserve all selected budgets, periods, WCETs, priorities, refills, queues,
    retries, owners, capabilities, and physical-driver protocols. During cold
    CYW43 bootstrap, retain exact useful progress and transient-empty child
    observations only inside the existing unslid 3,000-us/64-turn activation.
    During attached WiFi service, bind that sticky progress to the exact
    physical lifetime, authenticated generation/connection, and accepted-command
    epoch; every operator, passive, fault, recovery, containment, quarantine,
    reboot, handoff, identity, time, and cap drift closes it. For current
    cross-core signal-only GENET, exact authenticated command acceptance may
    open the existing unslid transaction tail before stage/drain publication;
    stage-only progress cannot mint it, and dormant same-core mode retains its
    exact successful-`YieldTo` requirement. Sample one common absolute Pi
    dispatch timestamp for both causal recorders. Add only the bounded Pi
    `cyw43_productive_window` diagnostic row; it grants no scheduling or device
    authority. The complete host-tool suite, `tools/cohesix-py`, generated
    profile consumers, `.coh` workloads, benchmark workloads/arithmetic,
    evidence records, and report schemas were reviewed and require no consumer
    change. Focused Pi/QEMU tests and a QEMU root-MCS canary can reject the
    candidate, but only a fresh exact-image dual-mode Pi boot can prove the
    expected cold-start and latency improvement or August parity.
  - exact-a9 typed physical-operator fence correction — source `a9a852a589` failed both performance gates despite healthy devices. GENET raw64 reached 82.556 requests/s at 18.944-ms p95; ACK/response splits and pending mask 0x100 locate the shared defect in post-Dispatch collectors that collapsed Idle, already-serviced UsbServiceDebt and real Input into one Boolean. Full identities and timing records remain archived.

    Preserve that three-state physical-operator classification through the
    CYW43 transient-credit, authenticated-response, productive-window, and
    direct-GENET transaction-tail snapshots. At a post-Dispatch or
    complete-rotor continuation cut, `UsbServiceDebt` does not retain the
    Network fence after its one ordinary `LocalSeat` opportunity; real decoded
    or buffered `Input` still does. A missing direct-GENET snapshot fails
    closed. The pre-rotation transient probe, terminal-return shortcut, serial
    and local-seat priority, physical console response, display phase,
    passive-admission, recovery, containment, quarantine, handoff, reboot,
    identity, wall, and work-cap fences remain unchanged. This correction adds
    no notification, poll, retry, fallback owner, grant, or refill and changes
    no SC budget, period, WCET, priority, Reply semantics, isolation boundary,
    queue, device owner, or QEMU selector.

    `docs/HOST_TOOLS.md`, the complete host-tool suite, `tools/cohesix-py`, all
    `.coh` scripts, `scripts/rest_perf_harness.py`, raw/REST benchmark workload
    and arithmetic, evidence consumers, and benchmark report schemas were
    reviewed. The correction changes only an internal typed scheduling
    predicate, so those surfaces require no implementation, fixture, workload,
    arithmetic, or schema change. Focused predicate tests, exact Pi target
    compilation, generated/Test Plan checks, and the narrow QEMU root-MCS
    canary may reject the source correction; only a fresh exact-image dual-mode
    Pi run can prove WiFi or GENET performance and repeatability.
  - exact-4b notification-backed continuation and complete typed-gate
    correction — source `4b16de9b4f` passed raw64 and 960/960 REST operations per backend without semantic/transport/driver faults, but failed performance: WiFi Gate 8 took 144.825 seconds and p95 was 167.253 ms; GENET p95 was 28.047 ms. Typed operator-debt preservation was safe but did not remove the dominant publication/Yield gap. Full paired diagnostics and artifact bindings remain archived.

    The cross-commit cold discriminator also selects removal of exact-a9's
    transient-empty local retention. With the same selected driver/runtime
    architecture, exact `0c734db75` reached Gate 8 at 34.110 seconds; adding
    local re-entry after a useful turn followed by an empty child observation
    moved exact a9 to 124.145 seconds, and exact 4b remained at 144.825 seconds.
    An empty observation is not an event or durable successor. It must Yield;
    only the existing exact Operator-to-Driver or operation-executed
    Driver-to-Operator continuation may retain the cold activation.

    The cold Gate 8 path cannot use authenticated-response publication credit:
    it precedes stack attachment, DHCP, TCP authentication, and service
    readiness. Close only the narrower condition-before-Yield race with the
    existing generated CYW43 child-to-root notification. After one selected
    bounded operator condition turn, read the retained parent. If it is still
    waiting, poll the unbound receive cap once and re-read durable parent state.
    Only an exact current terminal or fault may select the ordinary Driver
    phase. An absent, stale, sideband-only, still-waiting, or attached-service
    hint preserves Yield; attached EventPump remains the sole consumer after
    stack attachment. This is a narrow race closure and the next Pi Gate 8
    measurement, not source reasoning, decides whether it is sufficient.

    During attached WiFi service, retain a consumed root-wake edge only as a
    stack-local identity token. It must bind the exact CYW43 physical lifetime,
    authenticated response identity, accepted-command epoch, and a complete
    `Serial -> LocalSeat? -> Dispatch` rotor after the first Network unit. A
    fresh durable recheck at the return-to-Network cut may retain the caller's
    activation, but this wrapper performs no second Network unit. During direct
    GENET service, one stack-local token may bind an already staged batch and
    accept only its exact same-identity `OutputDrained` transition after the
    complete operator rotor; consumption forces the next phase to Serial and
    stops before a second command or Network leaf.

    Remove the older attached productive-window fallback that retained an
    unchanged empty snapshot after prior progress. A consumed wake plus durable
    identity is now the only post-rotor successor; an absent event yields. The
    additive `idle_admitted` counter remains in the diagnostic schema for
    comparable hardware evidence but this candidate does not increment it.

    Complete the typed correction at the earliest CYW43 transient-publication
    probe and the three direct-GENET compact command/stage gates. A CYW43 probe
    may preserve `UsbServiceDebt` only because successful minting installs the
    complete mandatory operator rotor before Network re-entry; real `Input`
    rejects. A direct-GENET one-command leaf may carry passive USB debt only
    while returning to Serial before another command; real Input and missing
    evidence reject. Every identity, response, recovery, containment,
    quarantine, handoff, reboot, wall, work-cap, and ownership fence remains
    unchanged. No spin, blocking wait, new notification, software work latch,
    local empty-state polling, fallback owner, queue, retry, grant, refill, SC
    budget, period, WCET, priority, Reply rule, isolation boundary, manifest
    population, or QEMU selector changes.

    `docs/HOST_TOOLS.md`, the complete host-tool suite, `tools/cohesix-py`, all
    `.coh` scripts, `scripts/rest_perf_harness.py`, raw/REST workload and
    arithmetic, evidence consumers, and report schemas were reviewed. These
    internal scheduling predicates change none of their interfaces, fixtures,
    arithmetic, or schemas. Focused predicate tests, exact Pi target
    compilation, generated/Test Plan checks, and the narrow QEMU root-MCS
    canary may reject the correction. Only the next exact-image cold WiFi plus
    warm GENET hardware run can prove Gate 8 or raw performance; passing that
    discriminator is still insufficient for the required multi-lifetime
    reliability depth.
  - exact-e957 hardware discriminator and exact-child root-control fan-in
    candidate — source `e95799d65d` failed WiFi readiness and raw performance gates: Gate 8 took 33.670 seconds and raw64 achieved 7.669 requests/s at 128.214-ms p95, with most delay before target ACK. All three first-attempt scripts and 960/960 REST operations passed without semantic, transport or driver faults. Exact identities and paired captures remain archived.

    GENET's matching one-connection 64/64 run sustained 120.824 requests/s with
    11.582-ms p95, failing the 162.242 requests/s and 1.845-ms targets. Its
    request-to-target-ACK p95 was 0.642 ms while ACK-to-response p95 was 10.902
    ms, locating the deterministic gap after healthy ingress. All three scripts
    and 960/960 REST operations passed first attempt; DMA, IRQ, rings, queues,
    and driver state remained clean. WiFi root composer period hiatus averaged
    7,668 us and reached 9,991 us; GENET averaged 8,995 us and reached 9,993 us,
    with 16,266 `NO_PRODUCTIVE_SUCCESSOR` exits. These are functional and
    reliability-prefix passes but explicit performance failures.

    The first shared failed invariant is root calling `seL4_Yield` while an
    exact finite child result remains pending. On the selected MCS kernel that
    forfeits the remaining head refill, so a later durable child notification
    cannot restore root until the roughly 10-ms replenishment boundary;
    August's non-MCS Yield merely rotated runnable work. The e957 follow-up
    candidate retained the event-driven fan-in only as a nonblocking hint
    immediately before the existing Yield boundary; it added no longer spin,
    budget, retry, poller, blocking wait, or fallback owner.

    Advance compiler truth from manifest schema 1.15 to 1.16 for this
    manifest-controlled capability change, console-network ABI v5 to v6, and Pi
    driver runtime-init ABI v10 to v11 without changing either fixed descriptor
    size. ABI v6 assigns the former console descriptor `reserved0` to child slot
    6; ABI v11 assigns the former driver reserved field to child slot 12. HAL
    mints only Write-only badge-1 aliases of the additional root-control wake
    notification. CYW43's dedicated slot 11 remains distinct. The critical
    runtime receives separate restricted slot-5 aliases in the root-fault and
    Worker-supervisor task-local CSpaces; executor children use slot 5 only in
    their distinct CSpaces. The Worker supervisor publishes completion bits
    and exact fault bodies into its durable root mailbox before signalling the
    fan-in. Critically validated controls remain solely in the existing bounded
    sequence-last FIFO; the validator signals only after accepting that
    publication and adds no second counter or queue. Physical console and
    driver children commit their sequence-last event, packet-TX, terminal, RX,
    TX, or completion record, signal the existing component-specific
    notification first, then signal the fan-in; direct-VirtIO QEMU emits only
    its semantic publication signal because QEMU never consumes the Pi fan-in.
    On Pi only, the critical runtime signals only after its durable
    fault/service publication. QEMU retains the common sealed alias slots but
    compiles out this unconsumed syscall. In that e957 candidate every wake was
    a hint and the durable record remained authoritative. At an already-fenced
    ordinary or no-successor exit, root polled the fan-in once. A nonzero badge
    prompted
    exactly one return to outer operator/recovery-first arbitration, where all
    durable state was re-read; zero fell through to the existing bounded Yield.
    The badge granted no work or continuation authority, and root did not block
    on this fan-in. SDIO deadline publication and clear retained their prior
    commit-only behavior and do not signal root merely because an arm changed.

    Preserve every SC budget, period, refill, priority, MCP, WCET, Reply
    semantic, isolation boundary, quarantine/recovery rule, owner, queue, retry
    bound, manifest population, and QEMU selector. Compatibility review covers
    the public console/network grammar and framing, every `.coh` workload,
    `coh`, `cohsh`, the complete host-tool suite, `tools/cohesix-py`, raw/REST
    benchmark workloads and arithmetic, and report schemas; none changes.
    Generated target profiles and resolved manifests update for schema 1.16 and
    the two internal ABI versions. The target-common archive growth exceeded
    the former contract-bound QEMU placeholder capacity by exactly 7,220 bytes.
    Both release-QEMU profiles therefore reserve an exact 8 MiB non-shipping
    seL4Test placeholder and require an exact 9 MiB minimum validated elfloader
    archive. Whole-placeholder replacement remains fail-closed; the shipping
    rootfs bound and every MCS/runtime numeric and QEMU selector remain
    unchanged. Focused ABI/fan-in/profile-order tests, generated/Test Plan
    checks, exact Pi compilation, and the narrow QEMU root-MCS canary may reject
    the candidate. Only a fresh exact-image WiFi plus GENET boot can prove the
    performance targets, and the required multi-lifetime pressure depth remains
    separate acceptance evidence.
  - Pi cross-core complete causal-round-trip correction — source `61b9fdddf8` rejected the V26/V20 same-core YieldTo candidate. WiFi Gate 8 took 60.190 seconds; WiFi/GENET raw64 p95 was 319.353/31.396 ms despite healthy links, rings and ingress. Useful boundaries still forfeited the causal activation before the child result became visible. This is failure evidence, not performance/repeatability acceptance; full identities and timings are archived.

    Restore the independent Pi topology: root-control on core 0,
    console-network on core 2, and root-fault on core 0. Root and console remain
    equal priority/MCP 200/200. Every budget, period, priority, MCP, refill
    count, WCET, Reply rule, queue, owner, retry, recovery, containment,
    quarantine, and QEMU selector remains unchanged. The admitted per-core
    demands remain `8,750/8,250/8,400/8,000 us`; fixed-priority recurrence
    derives root/console `5,100/3,000 us`, root-fault `2,600 us`, and
    PCIe/GPU-executor `3,300/8,300 us` response bounds. Select exact Pi
    provenance
    `m26e-pi4-root-cross-core-causal-fanin-wait-candidate-v27` and
    `m26e-pi4-console-cross-core-causal-publication-candidate-v21`.

    Both Pi network modes use post-commit Release plus exact one-hot Signal
    only; neither pre-drains a child SC nor invokes
    `seL4_SchedContext_YieldTo`. Complete one causal round trip inside the
    current bounded activation only when durable state proves either an exact
    signal-bound finite one-way CYW43 operation whose sequence-last terminal is
    still absent, or an exact staged console control whose child-consumption
    watermark is still owed. Persistent and steady CYW43 parents retain
    root-polled deadlines and never block on the fan-in. The final
    condition-before-block cut revalidates every identity and
    operator/recovery/fault fence and proves the complete child frontier has no
    pending semantic event, packet egress, ingress watermark, or control
    watermark; it consumes a pending edge with one Poll and calls Wait only
    after an empty Poll. A stable terminal or publication already visible
    returns directly to the ordinary rotor. Once the exact control watermark is
    accepted, remote TCP ACK and `OutputDrained` work also return to ordinary
    timer/network arbitration rather than retaining Wait. Every wake returns
    through operator/recovery-first durable arbitration; the badge remains a
    coalescing hint and grants no work or identity. Bare physical idle,
    deadline, recovery, containment, quarantine, reboot, and operator-owned
    cuts never grant wait authority. The existing 64 logical/productive
    activation limits also bound causal waits; there is no longer spin, larger
    budget, polling loop, arbitrary retry, fallback owner, new queue, or
    weakened safety boundary.

    Compatibility review confirms no change to the host-tool suite, `cohsh`,
    `tools/cohesix-py`, any `.coh` workload, `scripts/rest_perf_harness.py`
    workload or report schema, public console grammar/framing, console ABI,
    manifest schema, evidence record, or raw/REST arithmetic. Canonical Pi
    generated truth, focused topology/condition-before-block/order tests, and
    the narrow QEMU root-MCS canary may reject the source correction. Only the
    next exact-image WiFi and GENET boot can prove the performance gates;
    repeatability and pressure depth remain separate physical acceptance
    evidence.
  - exact-ee post-action causal-frontier correction — cite this performance
    correction together with its owning
    `m26e-driver-runtime-mcs-port-and-cyw43-coexistence` and
    `m26e-console-network-service-isolation` tasks. Source `ee667bea33` reached root/USB readiness, Gate 8 and DHCP; actual service readiness was 30.835 seconds. Gate 8 uses next_attempt_ms, not the future stabilization deadline_ms; this also corrects the preceding 61b reading from 144.455 to 60.190 seconds. Publication ACK then quarantined the network before TCP. TCP/scripts/raw/REST/GENET are unscored, not failed-throughput samples. Serial remained live; fresh USB input and late HDMI were unaccepted. Full paired records and image bindings remain archived.

    The first functional invariant is backend-independent: the compiler-sealed
    Pi cross-core signal-only topology is valid for both selected packet modes,
    but runtime admission incorrectly required a live direct-GENET mapping and
    rejected the intentional mediated-WiFi shell. Admit either Pi backend only
    under the unchanged generated cross-core, zero-`YieldTo`, activated,
    uncontained, live-SC fences; retain every direct-GENET-specific data-plane
    identity fence and the QEMU selector.

    The first performance invariant is the root-owned CYW43 continuation's
    missing post-action frontier. The child formerly published the exact
    consumed grant before physical service, so root could not distinguish an
    admitted action from a completed action; a full generated 10-ms wall-period
    veto then prevented overlap but imposed one dead interval per grant. Advance
    driver runtime-init ABI v11 to v12 without changing the fixed descriptor or
    24-byte grant layout. Restrict root grant IDs to the low 31 bits and publish
    `0 -> grant_id|ACTION_ADMITTED_BIT -> grant_id`: the high-bit state proves
    ACK-before-I/O admission, the exact low-domain value is written only after
    one bounded arbitration or physical action, and only that exact completion
    may publish a successor. Commit the post-action value before the root fan-in;
    a sequence-last terminal instead retains its existing terminal fan-in and
    forbids a late grant write. The same admitted/action-complete distinction
    applies to delegated CYW43-to-SDIO grants: the initial grant-free action
    returns an exact service receipt, while every later exact grant uses the
    identical high-bit admission then low-domain post-action transition. Only a
    fully revalidated exact root grant bypasses the wall-period wake gate;
    unrelated retained, recovery, terminal, and endpoint lanes keep their
    existing cadence and fences.

    Preserve every SC budget, period, priority, MCP, refill count, WCET, Reply
    rule, operator priority, owner, queue, retry, deadline, recovery,
    containment, quarantine, manifest population, schema-1.16 field shape, and
    QEMU selector. Driver-runtime manifest schema v1 remains unchanged but its
    existing ABI field must carry v12. Compatibility review confirms no public
    TCP/REST/console/netstats schema, AUTH/framing/command behavior, `.coh`
    workload, `cohsh`, complete host-tool suite, `tools/cohesix-py`, benchmark
    workload/arithmetic, or report-schema change. Focused ABI/state-machine,
    generated-consistency, exact Pi compilation, and the pinned QEMU 10.1/HVF
    root-MCS canary may reject this candidate. Only the next exact-image WiFi
    boot and authenticated serial GENET reboot can prove the stated performance
    gates; repeatability and pressure depth remain separate hardware evidence.
  - exact-743e/51bf discriminators and superseding exact-publication/current-response correction — cite this
    performance correction together with its owning
    `m26e-driver-runtime-mcs-port-and-cyw43-coexistence` and
    `m26e-console-network-service-isolation` tasks. Source `743e554d9c` failed all three WiFi lifetimes before Gate 8/DHCP: the exact committed SDIO command remained visible without owner intake or terminal before recovery/quarantine. The first failure is the CYW43-to-SDIO scheduling handoff; RF, DHCP, firmware retry and performance were not reached. Exact command tuples, captures and image identities remain archived.

    The same 743e image passed both GENET raw64 runs without retry/reconnect but failed both original performance gates (143.263/137.130 requests/s; 16.939/11.625-ms p95). First-lifetime REST passed 960/960 with conserved rings; causal traces locate period-scale gaps between command, observation and stage. The second lifetime's duplicate host ATTACH is excluded from script acceptance. Full-precision results and provenance are archived.

    Source `51bf6581f7` again failed all three WiFi lifetimes before Gate 8/DHCP with a visible command and no matching SDIO intake. Both GENET raw64 runs and first-attempt scripts/REST passed functionally but failed raw performance: approximately 101–107 requests/s at 19–20-ms p95. Balanced hardware and packet timing locate the regression after ingress, including late OutputDrained continuation and cross-Yield observation/stage gaps. Exact measurements and image identities remain archived.

    Repair the proven WiFi publication cut and the current-request GENET
    regression without changing either physical owner. Immediately after an
    exact persistent CYW43 parent commits its nonzero sequence-last SDIO child
    command, and before later semantic
    bookkeeping can unwind the publisher, revalidate the complete parent,
    child, generation, immutable frontier, root-grant environment, route,
    issued-unknown, pair-restart, and `Waiting` completion fences. Only that
    exact selected-MCS `Cyw43Client` publication may execute one
    `seL4_NBSendWait`: nonblocking-send the existing send-only slot-8 SDIO
    doorbell and atomically park CYW43 on its bound read-only slot-3 local
    notification. The durable ring command and completion, not either badge,
    remain authority. A returned root badge may enter only the existing exact
    expired-deadline classifier; without its immutable arm, lifetime, sequence,
    and expiry proof it schedules nothing. Every classic publication and every inexact,
    nonpersistent, stale, recovery, wrong-route, zero-sequence, replaced, or
    otherwise fenced MCS publication retains the existing single slot-8
    signal-only path. The later finite foreground/DPC root-causal wait remains
    separately fenced; neither path creates another command, physical
    operation, retry, poller, queue, or owner.

    For direct GENET, bind every stage-bearing cross-core continuation to the
    exact nonzero one-slot child-control sequence in addition to the current
    authenticated generation and connection. The condition-before-block
    fan-in may wait only while that exact control still owes its child
    watermark; if the child wins the race, its durable publication returns to
    outer recovery/operator-first arbitration without an intervening Yield.
    Once the current request reaches its exact response terminal—either fused
    stage-and-drain or `OutputDrained`—retire that request's continuation. A
    fresh unconsumed child frontier may justify one separately charged
    Serial-first recheck after the lane and operator/recovery fences pass;
    preserve the enclosing clock, causal-wait count and 64-quantum cap. An
    executed empty recheck spends one quantum and stops; only fresh productive
    progress establishes another continuation. An absent frontier retains the
    existing idle/Yield route. Do not mint a post-response Network baton, open a
    cross-core empty hot tail, wait broadly for a future event, or admit a
    speculative sequential request. A future request must publish its own
    command and re-enter the ordinary Serial-first rotor. Identity, sequence,
    operator, display, passive, fault, recovery, containment, quarantine,
    reboot, or handoff drift fails closed without child work, NIC authority,
    queue entry, refill, or owner transfer.

    Exact 132a physical evidence retains an 8.899 ms mean publication-to-root
    gap after the declared timer repair removes idle timer rejection. The
    existing bound fan-in, endpoint/Reply multiplexing and periodic timer
    remain authoritative. The fresh-frontier recheck addresses a completed
    response's spent race allowance despite already durable child work; it
    does not replace the complete global-idle predicate. Do not add
    a post-response wait, spin, retry, poll loop, fallback owner, or unbounded
    future-request promise as a local substitute. Until hardware measurement,
    the current source is a discriminator, not certainty that GENET meets its
    raw gate.

    Preserve every SC budget, WCET, period, priority, MCP, refill count, Reply
    rule, operator ordering, physical owner, queue, retry, deadline, recovery,
    containment, quarantine, manifest population, ABI layout/version, schema,
    and QEMU selector. For this GENET continuation correction,
    `docs/INTERFACES.md`, the complete host-tool suite,
    `tools/cohesix-py`, compiler/generated contracts, all `.coh` workloads,
    `scripts/rest_perf_harness.py` workloads and arithmetic, benchmark evidence
    records, and report schemas were reviewed and require no change because the
    existing slots, rights, durable records, public grammar, and measurement
    contracts are unchanged. Focused state-machine/order tests, exact Pi target
    compilation, generated and Test Plan consistency, and the pinned QEMU
    10.1/HVF root-MCS canary may reject this correction. They cannot prove a Pi
    speedup: a new exact-image cold WiFi boot, authenticated GENET reboot,
    first-attempt scripts, raw64, medium/high REST, operator liveness, causal
    diagnostics, and boot-paired captures remain mandatory before either
    performance or repeatability acceptance.
  - exact-2143 discriminator and authorized physical-Pi idle-receive closure —
    cite this performance correction together with its owning
    `m26e-driver-runtime-mcs-port-and-cyw43-coexistence` and
    `m26e-console-network-service-isolation` tasks. Source `2143ec6816` failed three WiFi lifetimes before Gate 8/DHCP: the ordinary HOST_CONFIG command was visible, but the persistent-only selector rejected it before NBSendWait and the SDIO owner produced no matching intake/completion. No RF, firmware, DHCP, physical issue or retry result follows. Exact source/image/manifest and command records remain archived.

    The same 2143 image passed both GENET raw64 runs and all first-attempt scripts but failed raw performance at about 47 requests/s and 20.136-ms p95. ACK p95 stayed below 0.667 ms; balanced hardware and 8.8–9.0-ms root Yield gaps locate the delay above the NIC. First-lifetime REST passed 960/960; that proves pressure/liveness only. Exact results remain archived.

    Supersede the persistent-only WiFi selector with one exact fresh-foreground
    publication admission. Before any admitted nonzero sequence-last
    foreground SDIO child, including cold HOST_CONFIG, commits, capture its
    route, turn, parent, child, physical generation, `Waiting` completion,
    issued-unknown, pair-restart, live-recovery, and immutable transaction
    fences and precompute the exact kernel-profile handoff. After the
    sequence-last commit and mandatory cache clean, selected MCS must execute
    the existing atomic slot-8 prompt plus slot-3 wait without an intervening
    passive read, diagnostic/progress publication, cache clean, or semantic
    operation. When that syscall returns, re-prove the same durable child and
    its exact first SDIO-owner action receipt. Only an unchanged child without
    that receipt takes one ordinary slot-3 wait, with no second slot-8 prompt;
    a visible first action, terminal, replacement, recovery, or identity drift
    continues through durable reclassification. The atomic route never replays
    legacy producer `SEND_DONE` or `WAIT_BEGIN` over newer owner evidence.
    On either SDIO peer-notification return, the sole owner stable-reads and
    seals a fresh one-way command in that activation before wake telemetry,
    source service, or another blocking boundary. A coalesced physical IRQ
    retains first physical-service priority, but the sealed command survives
    that boundary without another notification. Classic and every inexact
    publication remain signal-only and gain no additional wait.
    A release/acquire suppression latch may project private recovery into this
    scheduling decision, but it cannot initiate, complete, or clear recovery;
    only the existing pair-generation scrub clears it after canonical recovery
    authority has reset.

    Close the proven GENET/root seam as one physical-Pi direct-GENET-only,
    compiler-declared idle-receive topology. Bind the existing root-control fan-in notification
    to the init root-control TCB when its selected MCS temporal runtime is
    activated. Retain the already-allocated root-control Reply object and use
    it for every MCS endpoint receive and reply. Descriptor replay leaves the
    PCIe timer disarmed in every mode. At the exact direct-GENET ordinary
    global-idle cut, a completed empty quantum first permits exactly one
    nonblocking multiplexed receive. If that receive is empty, recheck timer,
    endpoint, durable producer, serial/local-seat/display, network, fault,
    recovery, quarantine, containment, and reboot state. At the first complete
    pre-enable fence only, issue one synchronous Reply-bearing typed enable
    Call, require the matching completion and durable identity-bound `Enabled`
    publication, then repeat the complete fence before blocking on the
    root-control endpoint. Later idle entries reuse that exact enabled
    lifetime without another programming operation. The bound notification may
    satisfy that receive only as a hint; an endpoint message must be copied
    into dispatcher-owned storage before returning, and all work is
    reclassified from durable state. A completed response may use the bounded
    fresh-publication recheck above. Reserve, operator,
    recovery, fault, and
    every non-global-idle boundary retain their explicit handoff. WiFi never
    enables the timer or enters this global-idle receive; it may wait only for
    a currently issued finite operation or an exact current-transaction causal
    child. Do not add a
    future-request tail, spin, retry, poll loop, larger root window, fallback
    owner, or notification-only wait.

    Authorize the minimum missing timer producer without adding a runtime,
    task, SC, refill, or owner population. Extend the always-present isolated
    `driver-pcie` runtime's manifest-declared physical authority with exactly
    one separately tagged, discontiguous BCM2711 system-timer page at
    `0xFE003000` and level IRQ 99 (GIC SPI 67), badge `2048`, handler slot 4,
    local-notification slot 3. Its existing 10-page PCIe host aperture remains
    separately tagged and contiguous. Descriptor adoption publishes
    `Disarmed` without programming channel 3. The first exact direct-GENET
    enable programs it at exactly half the unchanged generated `10000 us`
    PCIe-owner period, hence `5000 us`, and publishes `Enabled`; every WiFi
    lifetime remains disarmed. Each interrupt service performs only the bounded
    source clear, `CLO` sample, next-compare self-arm, ordering/readback,
    existing root-fan-in signal, and IRQ acknowledgement. It then immediately
    enters the existing combined command-endpoint/local-notification receive,
    returning a Reply-bearing command to ordinary dispatch or servicing one
    next genuine timer edge before blocking again. It performs no PCIe work,
    root timer processing, retry, polling, or catch-up loop. Missing or malformed
    hot-path, MMIO resource, physical address, page count, IRQ, badge, handler,
    notification, trigger, period, or interval identity must fail before MMIO,
    signal, or ACK. The
    isolated runtime remains sole owner of both its PCIe aperture and this
    exact channel; root remains a timer consumer and never maps or programs the
    device.

    The extra discontiguous resource uses the existing pointer-free runtime
    descriptor layout with additive internal resource tag 15; manifest schema
    1.16 and runtime ABI v12 remain unchanged because no serialized field,
    width, offset, or interpretation of an existing tag changes. Regenerate
    all selected profile, resolved-manifest, topology, policy, and resource
    accounting outputs from the source manifest. Preserve every existing SC
    budget, WCET, period, priority, MCP, refill count, Reply association,
    core, operator ordering, driver issue owner, queue, retry, deadline,
    recovery, containment, quarantine, Worker population, listener, namespace,
    wire grammar, and QEMU selector. Clear the final U-Boot video frame before
    `bootm`, keep subsequent handoff diagnostics on serial, and construct the
    bounded HDMI runtime immediately after Serial while retaining PCIe before
    USB; this removes stale U-Boot text without changing HDMI budget or local
    operator precedence.

    Compatibility review covers `docs/INTERFACES.md`, the complete host-tool
    suite, `tools/cohesix-py`, `coh-rtc`, generated consumers, all `.coh`
    workloads, `cohsh`, Hive Gateway/REST, raw and REST benchmark workloads and
    arithmetic, trace/evidence readers, and report schemas. Only compiler,
    generated resource-accounting, Pi descriptor/IRQ/runtime, root MCS receive,
    scheduling documentation, and focused fixtures require change; public
    TCP/REST/console/netstats behavior and benchmark schemas do not. Focused
    ABI/IR/runtime/root-idle tests, exact AArch64 Pi compilation, generated and
    Test Plan consistency, and the pinned QEMU 10.1/HVF root-MCS canary may
    reject this candidate. A clean build, image hash, guarded flash, and media
    readback remain qualification only. Fresh exact-image WiFi and GENET
    hardware lifetimes must still pass their raw, Gate-8, script, REST,
    operator-liveness, packet/ring, and repeatability gates before performance
    or reliability acceptance is claimed.

    Source `88c2142838` failed two WiFi boots and one wired boot before root shell. Device-untyped admission had advanced past the lower timer page 0xFE003000; PCIe timer mapping and USB bus-link construction then failed, leaving the fault registry at 270/272. No Gate 8, DHCP, shell, TCP or performance gate was reached. Exact images and diagnostics remain in the historical archive.

    Repair that one construction invariant by pre-admitting `0xFE003000` first
    for every physical Pi network selection, followed by the existing
    `0xFE007000` DMA admission only for WiFi, before any higher root MMIO
    mapping. QEMU and host profiles admit no Pi device page. PCIe construction
    must require the timer admission to remain root-unmapped and consume it
    through the exclusive child-VSpace path; an ordinary cached or root-mapped
    substitute fails closed. This changes no resource count, manifest row,
    task, owner, SC numeric, IRQ identity, runtime ABI, or public surface.
    Compatibility review finds no required change to the host-tool suite,
    `tools/cohesix-py`, cohsh grammar, or raw/REST benchmark workload and report
    schemas because the repair is confined to pre-runtime physical-Pi device-cap
    construction order.
    Focused admission-order, exclusive-consumption, Pi target compile,
    generated-consistency, and narrow QEMU root-MCS checks qualify only the
    next candidate; a fresh exact-image Pi boot must clear registry seal and
    reach root shell before backend testing resumes.
  - runtime ABI v13 exact one-way causal activation — the same-image `0c734db`
    discriminator proves healthy RF/link, DHCP, GENET DMA/IRQ/rings, TCP
    ingress, `.coh` semantics, and clean REST pressure while failing both raw
    targets: WiFi 6.668 requests/s at 168.133-ms p95 and GENET 115.516
    requests/s at 16.532-ms p95. WiFi request-to-ACK p95 is 150.479 ms; GENET
    ACK-to-response p95 is 15.793 ms. The first shared invariant is the useful
    root/runtime MCS activation ending before a finite child result or exact
    next action becomes visible, not a NIC, RF, DMA, IRQ, ring, retry, or queue
    defect.

    Advance the fixed-size driver runtime-init shared protocol from v12 to v13.
    Reply-consuming MCS bootstrap calls retain the supervised Call/Reply lane,
    donating the current root activation through the exact first descriptor or
    QEMU trampoline completion; classic bootstrap retains its bounded one-way
    behavior. A genuinely asynchronous generic MCS one-way command uses one
    initial notification prompt. After each bounded pending action, its linked
    runtime commits an exact 24-byte `DROW` record in the auxiliary slot with
    request sequence, command-action fingerprint, sealed runtime identity,
    strictly-next wait slice, and sequence-last commit, then atomically
    `NBSendWait`s the existing slot-12 root-control fan-in and slot-3 local
    notification. Root accepts only the current stable record, current ring,
    and current capability generation, changes only the magic to durable
    `DROA`, then signals that child once. The child resumes only after observing
    the exact acknowledgement and clears it before the next action. Stale or
    coalesced badges, duplicate or skipped slices, wrong identity, torn state,
    a terminal race, or an auxiliary grant/steady/persistent record grant no
    authority and fail closed. CYW43/SDIO keep their existing hard source-yield
    boundary; Serial, GENET, HDMI, USB, and PCIe generic work no longer insert
    an unconditional post-action Yield that forfeits the current refill.

    Preserve every SC budget, period, refill, priority, MCP, WCET, Reply and
    fault-supervisor rule, isolation boundary, queue, owner, retry, recovery,
    containment, quarantine, manifest population, and QEMU selector. The
    driver-runtime manifest producer and its independent pipeline oracle advance
    to v13 in the same change. The remaining host-tool suite,
    `tools/cohesix-py`, `.coh` workloads, public console/TCP/REST grammar,
    `scripts/rest_perf_harness.py`, raw/REST workload arithmetic, and report
    schemas were reviewed and require no change.
    Focused ABI/runtime/root tests and the pinned QEMU 10.1/HVF root-MCS canary
    qualify only a candidate. A fresh exact-image cold/warm WiFi and two GENET
    lifetimes with canonical scripts, raw64, medium/high REST, paired captures,
    diagnostics, and operator-path checks remain the direct performance and
    repeatability discriminator.
  - platform consistency — select the same v6 shared contract, including the
    v4-introduced bounded command batch, complete 256-Worker population, two
    passive-Worker executor-lane architecture, and passive-service locality
    invariant for QEMU and Pi manifests. Pi selects a larger root CNode only
    for its additional driver inventory and future capability headroom; QEMU
    optimization and static Pi composition require no Pi hardware interaction.
  - Pi build compatibility — refresh the repository-managed `pi4_diagnostic` tree from the freshly built SMP+MCS profile, require exact current-profile validation and deterministic immutable-tree composition, use the selected `CARGO_TARGET_DIR` for every Pi runtime payload, and compile direct VirtIO DMA containment only for QEMU/VirtIO profiles. Bind the pre-root-task Pi driver-runtime CPIO into image provenance and copy that exact archive into the SD stage, so `--skip-build` cannot repackage a later QEMU-feature child from the shared Cargo target directory. Retain the exact selected Pi resolved manifest beside the staged image before cleanup restores canonical QEMU generated outputs, and bind the stage-only runtime/DMA proof to that retained file and digest.
  - compatibility — preserve public AUTH/framing/command/ACK/ERR/END behavior, one-slot publication ACK semantics, root policy authority, MCS admission, evidence, and fault containment; advance the selected manifest through schema 1.16: schema 1.15 retains the generated internal Worker execution contract and transport correlation identity, while schema 1.16 seals the root-control fan-in slots and internal console/driver ABI versions. Update compiler, generated truth, host/target NineDoor, focused tests, host tools, Python library, SwarmUI projections, and benchmark compatibility review together. Full host-tool and `tools/cohesix-py` review preserves the public grammar, generated target-profile contract, and host dependencies. It requires bounded host-only compatibility repairs: `cohsh` TCP-only builds no longer compile in the in-process NineDoor/mock/trace implementation, in-process integration tests declare that required feature explicitly, `cas-tool` and SwarmUI integration tests resolve their Cargo-provided binaries at runtime so all-target linting remains portable, and the Python target validator adopts the generated Pi 1/127/128 population. The evidence and benchmark tools additionally derive the complete 265-task QEMU and 272-task Pi temporal seals from generated truth, keep exactly one detailed live exemplar for each executable role, admit target-neutral fresh-Pi proof, and compare provenance-compatible QEMU/Pi throughput and errors without turning QEMU latency into a physical-network gate. Hive Gateway's `/v1/meta/status` projection adds required normalized configured-backend `target_host` and `target_port` fields so fresh-Pi evidence binds the live gateway to the exact Pi console endpoint; it does not expose the REST bind endpoint or create target proof for host-model mode. `coh`, `cohsh`, `coh-status`, SwarmUI, `gpu-bridge-host`, `host-ticket-agent`, `host-sidecar-bridge`, `sidecar-bus`, `cas-tool`, every `.coh` workload, and `tools/cohesix-py` tolerate or ignore those additive status fields and require no behavior or schema change. Existing QEMU results do not claim Pi performance, and the enlarged Pi declaration requires fresh exact-image physical evidence. The original manifest/build integration performed no Pi hardware interaction; later exact-image bullets bind their own fresh Pi evidence and still require a new exact-image boot after each source candidate.

Result (2026-08-25): the v152 same-source performance candidate passed fresh
MEDIUM and HIGH boots on macOS 26.6.2/QEMU 10.1.0 HVF and Jetson Ubuntu
24.04/QEMU 10.1.0 KVM. Both hosts sealed all 265 fault sources, published
256/256 structured Worker READY records, completed authenticated NineDoor,
console, GPU, and LoRA work, and recorded no unexpected standard fault, MCS
timeout, receipt loss, reconnect, or queue runaway. Mac sustained 628.5 and
673.825 successful operations/s; Jetson sustained 93.142 and 100.65. Relative
to the first 37-Worker same-harness Mac baseline, successful MEDIUM/HIGH
throughput improved 14.3x/14.2x while the isolated population grew 6.9x. At
HIGH, the guest used the complete bounded 4096-unit service quantum: aggregate
drainage was 0.994 on Mac and 0.844 on Jetson, with zero flight-recorder
`YIELD`, `TIMEOUT`, or `FAULT` exits. Mac QEMU averaged approximately one host
CPU, so the remaining material ceiling is the deliberately single
authenticated target-control stream rather than artificial MCS fragmentation.
Exact metrics, typed retained-state refusals, commands, identities, and
artifact paths are qualified in `docs/BENCHMARKS.md`; this is QEMU performance
evidence and not Pi hardware acceptance.

### Agent adoption validation — 19 September 2026 <a id="m27c-agent-adoption-validation"></a>

#### Design and authority

The owner explicitly added this documentation-only task to 27c on 19 September.
It is independent of concurrent CUDA recipe development and does not close the
recipe milestone or activate 27d/27e. Validation used an isolated checkout of
`3452248de`; unrelated working-tree implementation and evidence were excluded.

Three job-oriented skills cover inspection, governed GPU outcomes and evidence.
Python belongs inside those jobs; Jetson and PEFT remain conditional. Each skill
is standalone with no scripts, assets or installation-specific metadata. The
root map and README expose them. Absolute Markdown source links survive copying
a skill folder; instructions require matching local references or pinning the
URL to the installed source revision. No source-only command is promised in an
older release. Release discovery uses actual artifact metadata rather than a
hard-coded release label.

Format follows the [Agent Skills specification](https://agentskills.io/specification)
and current [llms.txt convention](https://llmstxt.org/), consulted on this date.
The skills are operating guidance; AGENTS.md remains the contributor charter.

#### Executed checks

All final checks below passed. Logs and temporary probes were kept under ignored
`out/agent-adoption/` in the validation checkout; no one-off helper was added to
tracked `scripts/`.

- `cargo build -p coh -p cohsh`: native macOS ARM64 default-feature host binaries
  for command checks; not a release/FUSE/GPU-feature or target qualification build.
- `scripts/check-generated.sh`: source/generated contracts match.
- `scripts/ci/check_test_plan.sh`: catalog, documentation and cross-file integrity.
- `python3 scripts/ci/check_implementation_surfaces.py --inventory configs/generated/implementation_surface_inventory.json`.
- `python3 scripts/ci/check_host_integration_inventory.py --matrix-only --state-dir out/agent-adoption/inventory`:
  metadata only; 47 surfaces, 29 dependencies, 9 playbooks, 6 use cases. The first
  invocation omitted required `--state-dir`; the corrected command passed.
- `scripts/ci/check_mermaid_github.sh --markdown-list out/agent-adoption/markdown-list.txt`
  and `git diff --check`.
- Skill-creator `quick_validate.py` for all three skills; independent frontmatter,
  directory/name, description length, file-header and under-500-line checks.
- All new map/skill links resolved to local candidate files; existing remote
  canonical targets returned HTTP 200. New unpublished links were checked locally
  before publication. Links use no author-home or source-relative parent paths.
  Shell fences passed `bash -n`; Python snippets parsed successfully.
- Exact `cohsh --transport mock --role queen` tour: root listing, boot, scheduler
  and lease reads, then quit. All returned OK with simulated records.
- Exact temporary-directory Python `MockBackend` snippet, run from outside the
  source checkout with the candidate SDK: synthetic MockGPU returned; temporary
  storage removed. No target selected via ambient environment.
- `coh evidence pack --mock --out DIR`, `inspect --input DIR --json`,
  `evidence timeline --input DIR`, and `diff --left DIR --right DIR`: successful
  model pack, offline inspection, four derived timeline/case files and same-pack
  comparison. `coh gpu --mock list` and `status --gpu GPU-0` also passed.
- `coh providers`, `coh plan jetson-traffic-safety`, and `coh explain jetson-traffic-safety`:
  read-only generated declarations, explicitly not production use-case acceptance.
- Exact live-read curl and Python snippets exercised against a localhost HTTP
  fixture: required request-auth/delegated headers, GET paths and 1024-byte CAT
  query verified. This tests client construction, not real gateway authorization.
- CLI help/parser plus source review verified every documented command family,
  option order and outcome path. Live GPU submission and signed verification
  were not executed; no deployment request, enrolled trust or live graph was
  supplied for this task. Mutations were not sent to a target.

#### Fresh-context trials

An independent agent began with only `llms.txt`, task prompts and permission to
resolve candidate links locally. It executed the exact mock Python example,
mock cohsh tour and CLI help checks. Other scenarios were static task trials:

| Request | Observed routing and decision |
| --- | --- |
| Inspect configured Queen | Select inspection, preserve sole gateway owner, require identity and scoped read credentials; distinguish connected mock from live console. |
| Python without target | Explicit temporary MockBackend, model-labelled synthetic output; executed. |
| GPU submit timed out | Preserve original identity, reconcile journal/native/evidence, no blind resubmit or implicit recovery. |
| Sealed partial pack / signed failure | Inspect partial coverage, copy before timeline, independent trust; signed failure does not establish requested success. |
| Jetson PEFT activation | Separate local registry, publication, native serving and verified deployment; no complete 27d claim. |
| Standalone training, CUDA installation, unrestricted shell | Route native host tasks away from Cohesix; no widened authority or shell fallback. |
| MCP/A2A | Current REST implementation, future 28g scope; no invented endpoint or server. |

The first trial found missing delegated read credentials and a nonexistent
`/host/tickets/result` path. Both were corrected and independently rereviewed;
recovery now reads bounded `status.snapshot` and `deadletter.snapshot`. That
review also exposed stale read-auth paragraphs and bare curl examples in the
linked canonical guides. The same scoped change aligns those read instructions
with the existing gateway read classifier and Rust/Python header handling.

#### Benefit-led discovery correction — 19 September 2026

The owner reopened this documentation task to replace unexplained terminology
with user benefits and make every target playbook discoverable. `llms.txt` now
leads with useful delegation, shared GPU coordination, reusable CUDA work and
reviewable outcomes; defines Queen and Worker on first use; maps all six use
cases and nine playbooks to plain-language goals; and invites a no-hardware
inspection trial. Catalogue mappings were checked against the generated registry
at `ff646848f`. Format, 26 unique HTTP links, local anchors, generated consistency,
Test Plan integrity and `git diff --check` passed in isolation. This was a static
copy/coverage review, not a new agent-adoption or live-execution trial. No command,
interface, permission, benchmark or implementation changed.

#### Compatibility and limits

Reviewed all eight host tools: coh, cohsh, hive-gateway, gpu-bridge-host,
host-sidecar-bridge, host-ticket-agent, cas-tool and SwarmUI; also cohesix-py,
`rest_perf_harness.py`, benchmark methodology, generated provider/implementation
inventories and packaged release guidance. No command, schema, bound, default,
permission, transport, executor, benchmark workload or report format changes.
The three guides need only read-auth documentation corrections. Other surfaces
require no implementation/fixture change because this task adds entry points to
existing contracts rather than changing those contracts.

No live Queen/GPU/Jetson execution, fresh Pi evidence, target acceptance,
production identity enrollment, external-user adoption study or website deployment
was performed. Signed-verifier positive/negative runtime behavior was reviewed
in implementation and existing tests, not freshly exercised with enrolled graphs.
Link/format checks and mock or HTTP-fixture results cannot establish adoption,
live authorization, native completion, workload success or release acceptance.