Repository navigation
Toolchain Bootstrap
Fresh Windows flat calls pass for native and Cupid-built callers on drive and UNC paths. Both distinct-parent drive calls pass; both distinct-parent UNC calls reach the original sixty-second deadline. The complete owner remains outside accepted native image discovery and publication.
Native diagnosis attributes all 39,243 measured metadata queries in a
512-parent caller. Whole-observer revalidation contributes 20,748 queries.
FileStatInformation rejects UNC queries. FileAllInformation returns the
tested fields but takes longer. Source, custody checks and capacity bounds
retain their contracts. Normal ownership remains 449 CupidBuild actions and
three Python coordinators.
The follow-up record preserves the complete measurement scope.
The OS manual records the Windows full-path output allocation and its bounded conversion, errors and cleanup. Dirty-storage tests and the allocation's source acceptance retain their measured scope. Complete native input ownership and publication remain open.
Both complete host builds and normal-root verification pass. All 429 objects, four linked products, six user products and every byte of the 209,715,200-byte image agree. All six strict four-CPU boots, sixteen exact artifact gates per build and seventeen root artifact-policy methods pass.
The manual grows by 1,168 bytes to 84,889 bytes. The raw kernel grows by 1,168 bytes to 9,314,136 bytes. Raw-kernel and manual growth agree exactly. The raw-kernel and pass-one ELF exact policy rows change. Only the embedded manual object changes; the other 428 objects retain their preceding bytes. Normal ownership remains 449 CupidBuild actions and three Python coordinators. The 99 producer inputs and installed seeds retain their allocation acceptance bytes.
The manual record contains the complete measured acceptance.
The Windows UTF-8 adapter built by CupidC allocates its full-path output without an initial 65,536-byte clear. The API fills the same bounded buffer before conversion. Length checks, errors, cleanup and source custody keep their contracts. Dirty-storage and failure tests pass on both hosts.
Normal-root verification passes all sixteen artifact gates and both strict four-CPU boots. All 429 objects, four linked products, six user products and the complete 209,715,200-byte image match the preceding acceptance. Installed execution seeds are unchanged. Normal ownership remains at 449 CupidBuild actions and three Python coordinators. Complete native input ownership and publication remain open.
The acceptance record contains the measurements and preserved failures.
The OS manual records initial source-leaf kind and metadata capture from one opened handle. Later path bindings, root and parent validation, payload custody and provisional callbacks retain their existing contracts. Both host builds and normal root verification pass. Independent review compares all 429 whole objects, four linked products, six user products and every byte of the 209,715,200-byte image. All six strict SMP boots, sixteen exact artifact gates per build and seventeen root artifact-policy methods pass.
The manual grows by 1,391 bytes to 83,721 bytes. The raw
kernel grows by 1,392 bytes to 9,312,968 bytes.
Layout padding grows by 1 byte. Only the raw-kernel exact policy row changes.
Only the embedded manual object changes; the other 428 objects retain their preceding bytes.
The held metadata-reuse component keeps 53041192 and its original manual
and policy. Complete native input ownership and publication remain open. Normal
ownership stays at 449 CupidBuild actions and three Python coordinators.
The manual record contains measured sizes and complete paired and root receipts.
The held source observer captures an unknown leaf's kind and first metadata snapshot from the same opened handle. Ordinary walking and grouped path-kind capture use that snapshot when retaining the leaf. Later path bindings, parent and root checks, payload custody and provisional callbacks keep their contracts.
Both complete repository replays pass all 3,630 existing outcomes, with 99 strict checks and 23 whole portable object pairs. Four unchanged-copy controls pass and 152 altered-evidence controls reject. Eleven malformed-patch or invalid-output controls reject before compiler or runtime commands.
Three native-reference comparisons, covering six calls, record 1,030 fewer initial metadata helper reads for 512 staged inputs. Two Windows namespace comparisons, covering four native calls, also record 1,030 fewer direct handle-information calls, while sixteen other instrumented API counters retain their values. These counters cover specific modules and call sites. They do not establish complete platform work or a capacity speedup.
The separate private complete owner passes 236 lifetime processes and all 192
existing selection-group cases. Four Linux capacity calls and four Windows
drive calls pass; four Windows UNC calls reach their original sixty-second
deadline. The cause remains unproven, and the complete owner stays outside the
held component. Normal ownership remains 449 CupidBuild actions and three
Python coordinators. The component captures the 82,330-byte manual and
9,311,576-byte raw kernel at 53041192.
The component record contains the complete receipts and preserved failures.
The OS manual records temporary source selection observation groups, their optional-source validation profile, provisional callbacks and permanent publication-borrowing rejection. Both complete host builds and normal-root acceptance pass. Independent review compares all 429 whole objects, four linked products, six user products and every byte of the 209,715,200-byte image. All six strict SMP boots, sixteen exact artifact gates per build and seventeen root artifact-policy methods pass.
The manual grows by 2,219 bytes to 82,330 bytes. The raw
kernel grows by 2,220 bytes to 9,311,576 bytes.
Layout padding grows by 1 byte. 3 measured kernel policy rows change.
Only the embedded manual object changes; the other 428 objects retain their preceding bytes.
The held source selection group keeps f64b6382 and its original manual and
policy. Complete native input ownership and publication remain open. Normal
ownership stays at 449 CupidBuild actions and three Python coordinators.
The manual record contains measured sizes and complete paired and root receipts.
The held host API captures source path kinds through a temporary selection observer. Selection validation brackets capture; source-root identity follows the optional selection contract, while captured descendants and leaves retain their existing checks. The ordinary path group keeps full root metadata. Temporary selectors permanently reject publication borrowing.
Both complete repository replays pass 192 new cases and all 3,438 preceding outcomes, with 99 strict checks and 23 whole object pairs. Independent review rereads every whole product and runtime stream. Four unchanged-copy controls pass; 152 altered-evidence controls reject. Eleven patch and output preflights reject before compiler or runtime calls.
Separate private owner probes pass six flat capacity calls and 236 lifetime processes. A temporary-observer release change fixes the 4,096-parent Linux descriptor failure under the original bounds, but a native Windows UNC timeout remains preserved and complete owner qualification stays open. Neither owner implementation is included in the held component patch.
The 99 producer inputs, fifteen installed seeds and three Python coordinators
retain their ownership. Normal ownership remains 449 CupidBuild actions across
452 transforms. This component keeps the accepted 80,111-byte manual and
9,309,356-byte raw kernel at f64b6382.
The component record carries the held patch, portable receipts and preserved failures.
The OS manual records retained original file-request binding groups, parent validation modes, provisional callbacks and caller root and payload custody. Both complete host builds and normal-root acceptance pass. Independent review compares all 429 whole objects, four linked products, six user products and every byte of the 209,715,200-byte image. All six strict SMP boots, sixteen exact artifact gates per build and seventeen root artifact-policy methods pass.
The manual grows by 2,309 bytes to 80,111 bytes. The raw
kernel grows by 2,308 bytes to 9,309,356 bytes.
Layout padding shrinks by 1 byte. Only the raw-kernel exact policy row changes.
Only the embedded manual object changes; the other 428 objects retain their
preceding bytes. The held file-request replay keeps 29929d49 and its original
manual and policy. Complete native input ownership and publication remain open.
Normal ownership stays at 449 CupidBuild actions and three Python coordinators.
The manual record contains measured sizes and complete paired and root receipts.
The held host API groups file-binding metadata checks by original parent spelling. It retains both parent resolutions, captured parent identities and fresh no-follow file checks before and after each callback. Complete root and payload validation remains the caller's responsibility. Callback results stay provisional; failure poisons the observer. Directory metadata reuse removes duplicate stats from the same resolution handles.
Both complete repository replays pass 210 new cases and all 3,228 preceding outcomes, with 95 strict checks and 22 whole object pairs. Independent review rereads every whole product and runtime stream. Four unchanged-copy controls pass; one hundred altered-evidence controls reject. Seven patch or output preflights reject before compiler or runtime calls.
The separate complete owner passes five of six 4,096-stage probes but still times out on the Cupid-built Windows UNC caller. A 512-stage diagnosis reduces constructor directory stats from 4,735 to 3,709 and directory resolutions from 2,066 to 1,040 while retaining all 515 original-request checks. Per-file opens, metadata checks and both views remain intact. The old single-request counter excludes the new groups.
The 99 producer inputs, fifteen installed seeds and three Python coordinators retain their ownership. Normal ownership remains 449 CupidBuild actions across 452 transforms. This component keeps the accepted 77,802-byte manual and 9,307,048-byte raw kernel.
The component record carries the held patch, portable receipts and preserved failures.
The OS manual records retained path observation groups, provisional callback kinds, permanent failure and borrower lifetime. Both complete host builds and normal-root acceptance pass. Independent review compares all 429 whole objects, four linked products, six user products and every byte of the 209,715,200-byte image. All six strict SMP boots, sixteen exact artifact gates per build and seventeen root artifact-policy methods pass.
The manual grows by 1,839 bytes to 77,802 bytes. The raw kernel grows by
1,840 bytes to 9,307,048 bytes. One byte of layout padding accounts for the difference between raw-kernel
and manual growth.
Three measured kernel policy rows change. Only the embedded manual object changes;
the other 428 objects retain their preceding bytes. The held path-group replay
keeps cf52cd12 and its original manual and policy. Complete native input
ownership remains unqualified on Windows UNC paths. Normal ownership stays
at 449 CupidBuild actions and three Python coordinators.
The manual record contains the measured sizes and complete paired and root receipts.
The held host API captures ordinary file, directory and first-absence observations as one serialized group. Complete validation brackets capture, while every path keeps root metadata, immediate-parent and fresh no-follow leaf checks. Callback kinds remain provisional; failure clears results and poisons the observer. Active capture rejects revalidation, closure, reentry and transaction borrowing.
Both complete repository replays pass 168 new cases and all 3,060 preceding API outcomes, with 91 strict checks and 21 whole object pairs. Independent review rereads every whole product and runtime result. Four unchanged-copy controls pass; sixty altered-evidence controls reject. The complete owner still times out on both Windows UNC callers at sixty seconds. Its separate query diagnosis preserves both views and payload checks while identifying temporary selection and original-request validation as the sources of repeated parent-directory resolution.
The 99 active producer inputs, fifteen installed seeds and three Python coordinators retain their ownership. Normal ownership remains 449 CupidBuild actions across 452 transforms. The OS manual retains its accepted 75,963-byte baseline and the raw kernel its 9,305,208-byte baseline.
The component record carries the held patch, complete receipts and constructor diagnosis.
The OS manual records retained file stream groups, provisional callback bytes, permanent failure, borrower lifetime and directory-metadata reuse. Both complete host builds and normal-root acceptance pass. Independent review compares all 429 whole objects, four linked products, six user products and every byte of the 209,715,200-byte image. All six strict SMP boots, sixteen exact artifact gates per build and seventeen root artifact-policy methods pass.
The manual grows by 1,369 bytes to 75,963 bytes. The raw kernel grows by
1,368 bytes to 9,305,208 bytes because layout padding shrinks by one byte.
Both ELF sizes stay unchanged. Only the raw-kernel policy row and embedded
manual object change; the other 428 objects retain their preceding bytes.
The held group replay uses c2eabb95 with its original manual and policy.
Complete native input ownership remains unqualified on Windows UNC paths.
Normal ownership stays at 449 CupidBuild actions and three Python coordinators.
The manual record contains the measured sizes and complete paired and root receipts.
The held host API captures retained regular files as one serialized group. Complete observer validation runs before and after capture; every file keeps its immediate parent, no-follow leaf, metadata and digest checks. Callback bytes remain provisional until success. Failure clears results and poisons the observer. Active capture rejects revalidation, closure, recursion and transaction borrowing, including validation through an existing borrower. Owners must outlive their borrowing transactions.
Both complete Windows and Linux repository replays pass 144 new cases and all 2,916 preceding API outcomes, with 340 legacy passes, twelve declared skips, 48 alias methods and 87 strict checks. Independent review rereads every whole product and complete runtime result; twenty whole object pairs agree. Four unchanged-copy controls pass, forty altered-evidence controls reject, and seven malformed-patch or invalid-output preflights reject before compilation.
The combined patch includes 35 logical sources and 26 helpers. Its fresh
complete-owner probe still exceeds sixty seconds on both Windows UNC callers;
that owner remains outside acceptance. Normal ownership remains 449 CupidBuild
actions and three Python coordinators, with the same 99 producer inputs and
fifteen installed seed files. Group replay uses c2eabb95 and its original
74,594-byte manual and exact kernel policy.
The implementation record carries source, complete receipts and
reproduction commands.
The preceding OS manual refresh records temporary source selection, captured file and parent comparisons, first-view construction and fresh original-request checks. Complete publication custody remains with retained observers. The complete input owner remains unqualified on Windows.
Both complete host builds and normal-root acceptance pass. Independent review compares all 429 whole object pairs, four linked products, six user products and all 209,715,200 image bytes. All six strict boots, sixteen exact artifact gates per build and seventeen root policy methods pass. Only the embedded manual object changes; the other 428 objects retain their preceding bytes.
The manual grows by 939 bytes to 74,594 bytes. The raw kernel grows by 940 bytes
to 9,303,840 bytes, including one byte of layout alignment. Both ELF sizes stay
unchanged. Only the raw-kernel policy row changes. The complete archives retain
the failed execute-mode and alignment assumptions, twelve successful original
measurement commands, corrections and full continued acceptance. Shared
selection replays retain 4dab700c for their original manual/policy guards.
All 99 producer inputs, fifteen installed seed files and the three Python
coordinators retain their accepted ownership.
The manual acceptance carries complete evidence.
The held source-selection APIs retain an original request, selected parent and regular leaf without repeating full physical ancestor capture. They permanently reject publication borrowing. Complete retained observers still own root, metadata and payload validation. Captured file/parent comparisons and fresh request checks add no observations. Indexed lookup preserves older observations for full validation; checked Windows resolution reuses the existing wide calls with strict UTF-8 and normalized physical names.
Both complete repository replays pass 862 new calls and all 2,054 preceding outcomes, for 2,916 current API calls. They preserve 340 legacy passes, twelve declared skips and 48 alias methods. All 83 strict checks pass. Independent review rereads 28 whole checked objects on Windows, 23 on Linux and sixteen checked programs per host. Nineteen whole object pairs agree. Complete runtime output, streams and case plans pass independent review; all twenty altered-product, stream, case, deadline and scope controls reject.
The complete private input owner remains unqualified. Thirty Linux capacity calls and 222 owner-allocation failure checks pass, but both final Windows 4,096-input UNC phase processes exceed sixty seconds. The accepted shared patch excludes that owner. All 99 producer inputs, fifteen installed seed files and the three Python coordinators retain their existing ownership. The selection record keeps the complete patch, original receipts, fresh replays and failed investigation.
The installed manual now documents the held image-stage owner, its complete missing-path checks, copied request names, borrowed views and permanent rejection after failed validation. It distinguishes that contract from the optional file owner's first-absence contract.
Windows, Linux and the normal root pass complete builds, users/ABI, all sixteen exact artifact gates and six strict boots. Every whole object, linked product, user product and complete 200 MiB image agrees. Only the embedded manual object changes; all 428 other production objects and six user products retain their previous bytes. The root also passes all seventeen unchanged artifact-policy methods.
The manual grows by 624 bytes to 73,655 bytes and the raw kernel to
9,302,900 bytes. Both ELF sizes stay unchanged. Only the raw-kernel
policy row changes; the other fifteen rows remain exact. Complete
manual acceptance retains the paired
and root receipts. The stage replay retains 7765296f; the optional
replay retains 76f345f9. Installed tools, all 99 producer inputs and
the three Python coordinators remain unchanged. Full input discovery
and native image publication remain open.
The held image-stage owner copies the complete original request. Present regular files retain the optional file owner's observations; missing views expose only the requested name. Missing parents may appear or change while the final leaf stays absent. Children of broken parent aliases remain missing on both hosts; children of regular-file parents remain missing on Windows and reject on Linux. Every borrowed view revalidates, and a failed view remains rejected after the earlier path state returns.
Four native/Cupid callers pass 312 new calls: 150 successes and 162 rejections. Thirty-six capacity calls retain all 4,096 distinct missing requests each. Both fresh repository replays preserve all 2,054 current API outcomes, 340 legacy passes with twelve declared skips and 48 alias methods. Twenty-four whole checked objects on Windows and nineteen on Linux, twelve complete checked programs per host, fifteen shared object pairs and all 69 strict checks pass independent review. The first summary's omitted alias object and four checks have a separate correction; its archive and original receipts retain their original bytes.
The implementation record contains the combined unapplied patch, complete archives, reproduction commands and separate product verifier. Existing file-owner contracts, sixty-second runtime deadlines and Linux's 32 MiB/10,240-descriptor limits remain. Complete input discovery, root interning, distinct present-stage capacity and publication remain open. All 99 normal inputs, fifteen seed files, 449 CupidBuild actions and three Python coordinators keep their existing ownership. TempleOS stays read-only reference material.
The installed manual records the held required/optional source-file APIs, original parent bindings, borrowed lifetimes and retained-stream payload checks. It keeps the unresolved Python parent-path differences explicit. Both host builds pass users/ABI, all sixteen artifact gates and four strict boots. All 429 whole object pairs, four linked products, six user products and every byte of both 200 MiB images agree. Fresh normal-root build and both strict boots also pass with the same whole products.
The manual grows to 73,031 bytes and the raw kernel to 9,302,276 bytes.
Both kernel ELFs grow by one page. Three measured kernel policy rows
change; the thirteen other rows remain exact. Original failed harness
receipts, ELF measurements and complete corrected commands remain in the
manual acceptance record. Optional replays
retain their 76f345f9 checkpoint; earlier packets retain ffdbc419.
Installed tools, all 99 producer inputs and the three Python coordinators
remain unchanged.
The held source-file owner selects regular inputs or retains their first absence beneath the nearest existing parent. It keeps original parent bindings, copied requests and complete logical suffixes. Optional views permit uncaptured sibling changes in that parent; required-file metadata checks and captured membership remain strict. The existing five-field view remains unchanged.
Four native/Cupid callers pass 382 new contracts: 170 successes and 212 rejections, with 294 actual Python oracles. Both fresh repository replays preserve all 1,742 current API calls, 340 legacy passes with twelve declared skips and 48 alias methods. All 37 distinct whole checked objects and twenty programs equal their originals; thirteen whole shared object pairs agree. All 59 strict checks and the original runtime bounds remain.
Original UNC oracle, host-profile, capacity-timeout and Python boundary
failures remain archived. The full UNC retry and all four unchanged-capacity
controls pass; the first timeout's cause is unproven. Python treats broken
parent children as missing on both hosts and file-parent children as missing
on Windows. The held owner rejects those parent forms. Those compatibility
differences and complete native image integration remain open. The 99-input
normal cohort and three Python coordinators remain unchanged. The
implementation record retains complete
source, original and replay evidence. Earlier held replays retain their
ffdbc419 checkpoint. This combined packet uses the adopted heap seeds
at 76f345f9, before the later manual/policy refresh.
The later missing-path diagnostic compares twenty unchanged native/Cupid calls. Python permits missing ancestors to appear while the leaf stays absent; the held owner rejects that change. Eight calls differ and twelve controls agree. These calls evaluate the publication predicate without authoring a complete image. The existing first-absence contract remains unchanged.
The shared runtime for Cupid-built host commands now searches free blocks by
size on Linux and Windows. Small Windows allocations share regions of at least
64 KiB. Both adapters retain sixteen-byte alignment, data during realloc, and
reusable storage after failed OS release. Cupid-built tests exercise 65,536
simultaneous allocations, fragmented reuse, a 20,000-operation mixed-size replay,
overflow, failure recovery and the complete existing platform runtime contract.
The normal Windows UTF-8/long-path profile also passes a Unicode filename beyond
260 characters. Both hosts finish prepared cohorts with 97 complete equal
stage-three/stage-four object and tool pairs from the same 99-input snapshot.
Run python -m unittest -v tests.test_hosted_heap to reproduce the current-host
checks. Both complete source qualifications pass for committed 1d852023.
Independent checks reread 291 staged files, 97 complete final-generation pairs,
7,761 published files and all 99 committed inputs. Both private candidate pairs
verify and start from zero production objects. The installed pair now carries
the qualified heap after complete consumer and normal-root acceptance. Three
normal Python coordinators remain. The
heap record
contains the implementation and verification scope.
The replacement tools also pass cold normal image builds, fresh user and ABI
checks, all sixteen artifact gates per host and four strict four-CPU ls/SMP and
ISO boots on Windows and Linux. Independent paired rereading checks all 429
object pairs, six user pairs and the complete 200 MiB image pair against the
source-accepted products. Both full compatibility selections pass all 367 methods
per host: 341 passes and 26 declared skips on Linux, 364 passes and three skips
on Windows. Independent checks reread every outcome, all 99 committed inputs,
the complete candidate pair and unchanged installed seeds. All four original
SDK profiles pass complete publication and independent 77-pair audits, with 22
programs and 104 SDK inputs each. A
four-profile comparison
rereads all 616 raw stage files and 88 published programs; every complete stream
agrees across Linux and Windows, with both default and long-path profiles.
The original Linux public selection also passes with its Windows-only boundary
skip. Independent review accepts all 4,338 published files, 132 stage files,
44 fixed-point pairs and 1,823 complete named behavior pairs. The fresh
Windows public selection
passes both methods without skips after correcting two stale runtime-image byte
locks. Independent review accepts all 4,351 published files, the same 44 complete
fixed-point pairs, thirteen native objects and three matching full PE relinks.
Both actual Make consumers
and complete independent audits now pass. Linux checks 4,338 published files,
132 staged products, 44 whole fixed-point pairs and 1,823 behavior pairs.
Native Windows checks 3,423 files, 159 products, 53 whole pairs and 1,366
behavior pairs. The unchanged Windows diagnostic replay passes after the first
run loses its private CupidDis copy; that disappearance has no established
cause. A separate audit selects the native Windows report schema and preserves
every other predicate. Both failures and complete read/cleanup traces are
retained in commit d833e690. Both fresh seed/manual cold consumers now pass
independent audits of all 1,764 controls, 429 objects, six user products, sixteen
artifact gates and two strict boots per host. The final 72,415-byte manual
passes complete paired builds and boots. All 429 whole objects, four linked
outputs, six user products and the complete 209,715,200-byte image agree across
the pair. The twenty-file root projection is installed. Normal-root build,
user/ABI, artifact checks, all 170 unchanged seed-reader/release-operation
methods and both strict boots also pass. Exact method-name review combines
153 retained seed-reader passes with seventeen native comparison passes after
correcting their inherited producer sentinels. Every complete product equals the
accepted pair. The raw kernel is 9,301,660 bytes. The
adoption record retains paired and root receipts.
Earlier held observer and source-owner replays retain their ffdbc419
checkpoint and original seed/reader guards.
The existing historical release
fixtures keep their recognized pre-ISO no-context contract; all sixteen unchanged
methods pass on each host.
The required source-file owner retains a lexical request, original parent binding, physical parent and regular leaf. Views revalidate before exposing borrowed strings and an observer. Retained streams add payload custody; metadata alone accepts restored-time edits. Four native/Cupid callers pass 232 new contracts: 102 successes and 130 useful rejections. Both complete repository replays preserve all 1,360 current API outcomes, 340 original legacy methods with twelve declared skips and 48 alias methods. All 35 whole checked objects and eighteen programs equal their originals; twelve whole cross-host object pairs agree. The first Windows sparse-file timeout has no established cause; its unchanged controls and the fresh complete prerequisite pass. The first Linux prerequisite passes before an incorrect outer source-copy directory rejects. The corrected runner copies the complete product-source directory and validates any reused prerequisite run. All first failures and exact corrections remain archived. Optional missing-parent selection, complete discovery and native image publication remain open; three Python coordinators remain.
The held source-root constructor keeps the first directory resolution handle through observer construction, copies the original absolute request and physical name, then rechecks that request during complete validation and borrowed publication. Four native/Cupid callers pass 176 new calls, including retargeted aliases whose first physical payload remains intact. All 952 preceding API calls, 340 legacy methods with twelve declared skips and 48 alias methods also pass. Eight whole shared object pairs agree; all 44 strict checks pass.
Both full repository replays repeat every outcome. Independent review accepts
all 28 whole checked objects and sixteen complete programs against the original
products. The patch, ten public scripts and complete compressed receipts are
committed at 6b5174b9 on the bootstrap branch. Per-file original requests,
optional missing-parent selection and complete image discovery remain open.
The 99-input producer cohort and normal recipe ownership are unchanged.
The held source observer
accepts literal POSIX colon and backslash input names through file, retained
stream, membership and revalidation checks. Windows keeps its preceding name
policy; ordinary observers and output-name rules remain unchanged. Four
native/Cupid callers pass 564 new calls and every original observer selection.
Seven complete shared object pairs agree and all forty strict checks pass.
Both complete repository replays reproduce every result. Independent review
compares all 26 whole checked objects and fourteen complete programs with their
original builds. The exact patch, nine public scripts and full compressed
receipts are committed at 9c75676b on the bootstrap branch.
Physical selection, original-request custody and complete image ownership remain open. All 99 normal producer inputs and fifteen installed seeds are unchanged; normal ownership remains 449 CupidBuild actions and three Python coordinators.
The held C spelling component preserves the image command's lexical host paths before filesystem aliases are resolved. Four native/Cupid callers pass 354 calls covering actual Python spellings and useful C failures. Three complete shared object pairs agree, and all eight strict checks pass. Both complete repository replays repeat every case; their six checked objects and two complete programs equal the originals. The unapplied patch, actual host oracles, failed source generations and full receipt archives are retained. Physical pathname selection and complete native image discovery remain open. The 99-input cohort, installed seeds and three Python coordinators are unchanged.
The held observer extension retains first absences, opens ordinary Windows UNC roots and resolves Unicode/long directories, alongside quotas, retained streams and captured identities. Four native/Cupid callers pass 388 API calls, including all 4,096 distinct present and missing flat/nested inputs under the original deadlines and Linux bounds. Both complete legacy selections pass 340 methods with twelve declared skips; all 48 original alias methods pass. Six complete shared object pairs agree and all 36 strict checks pass.
The unapplied patch, complete original receipts, failed probes and repository replay are retained. Both installed-seed replays pass every outcome again; all 24 complete checked objects and twelve programs equal the original builds. The Windows resolver uses existing codecs and imports; the default runtime profile remains unchanged. Native pathname selection and complete image discovery still precede normal command adoption. The 99-input cohort and three normal Python coordinators are unchanged.
The reproducible C owner interprets required image values, repeated stages and the final WAD group under both actual host option grammars. Four native/Cupid callers pass all 11,954 captured sequences: 47,816 calls with equal complete results and seven equal shared object pairs. Both installed-seed repository replays pass and recheck their actual host's complete original parser output. Allocation probes verify failure unwinding and borrowed pathname/owned destination lifetimes.
The source remains an unapplied patch outside the normal 99-input cohort. Native physical pathname selection, discovery, observers, complete diagnostics and publication still precede normal recipe adoption. The Linux fixture's mounted-filesystem timeout is repaired with 64 KiB I/O buffers under the original bounds; failed receipts and the filesystem diagnostic remain recorded. Three normal Python coordinators remain.
The held C source
interprets the existing image command's decimal geometry values under the
actual Linux Unicode 15 and Windows Unicode 16 profiles. All four native and
Cupid-built callers pass both complete oracles: 66,816 parser calls, including
30,928 positive and 35,888 negative results. Oversized values retain a range
flag so a later repeated option can replace them before geometry validation.
Three complete checked object pairs agree between hosts. A separate fgetc
extension passes all 256 byte values, repeated EOF and seek recovery.
The unapplied patch and frozen oracle fixture have a repository replay that rebuilds both callers with verified installed seeds. Both hosts pass all 16,704 cases per caller under the original bounds. The 99-input producer cohort and installed seed files remain unchanged. Complete argv interpretation, native discovery, observer lifetimes and publication still precede the normal image recipe handoff. Three Python coordinators remain.
This section records the preceding installed cohort. The 2026-10-10 heap adoption above carries its successors.
The exact qualified acbbd834 seed cohort is installed and pushed in
commit cf5976b8. All fifteen files bind the twelve qualified tools, both
manifests and reviewed release to the unchanged 99 committed producer inputs.
The tools carry hosted byte output, unsigned conversion, line/EOF state and
wide computation before narrow compound-assignment stores. Private host,
observer, heap and publisher follow-ups remain outside this installed cohort.
All four ordinary/long-path SDK profiles, complete public bootstrap methods and both actual Make bootstraps pass their complete original independent checks. Qualification retains 291 staged products, 97 whole fixed-point pairs and 7,761 published files. The final adoption audit rereads 1,757 source/control files per host and verifies exact root seed bytes, reader pins and the measured native runtime fixture.
The revised 181,994-byte manual passes fresh current normal image and user builds on Windows and Linux. All four ls/SMP and feature 17 ISO boots pass with four max-model CPUs, e1000, private images, required completion and the original 150-second limit. Independent comparison checks all 429 objects, 431 inspection inputs, sixteen artifacts, six user products, the 103-field/101-provider ABI and the complete paired images. The raw kernel measures 9,300,124 bytes.
Both complete 200 MiB images have SHA-256
3ad5400a92a761e5a654c8f0dc1cff2dfb15d872e366a5bff73d667d4c61d3da.
The entire baseline FAT suffix remains preserved. Both actual Make negative
gates reject the earlier kernel length before the new measured policy is
applied. Original policy fields and producer bounds remain intact. Earlier
cold acceptance remains separate from the current accepted-object refresh.
The deliberate private combination of required-file capture and POSIX discovery passes all twelve actual native/Cupid builders. Its complete discovery and legacy observer review accepts 270 discovery executions, 476 discovery calls, 128 identity comparisons and all 100 legacy executions with 106 calls. Twenty actual full eight-MiB path-case images are independently reconstructed from raw inputs. The empty-script false pass and the verifier's corrected publication-count predicate remain explicitly recorded. Complete combined handoff regressions and their original independent verifier are still queued.
The original required-file large cohort and six guest boots continue with the original eight cases, 600-second limits and Linux 32 MiB bound. The separate external-seed capture source is prepared with all original same-root tests retained; its four actual caller profiles and independent acceptance are pending. These private results do not qualify or install a native image command.
The normal graph remains 449 CupidBuild operations and three Python coordinators across 452 transforms. Full native image ownership, both SDK coordinator retirements, all remaining C migrations, Doom/vendor runtime and in-OS tools remain in scope. TempleOS stays read-only and excluded. PR 33 remains open as a draft; the bootstrap branch is not merged into main.
The private hosted heap now shares Windows allocation regions and searches free
blocks on both hosts. The original Windows allocator exhausts address placement
near 32,500 live requests; Linux's old search inspects 523,776 allocated blocks
for 1,024 live requests. Actual process maps and Cupid-built work counters retain
those causes. The new runtime accepts 65,536 one-byte and 64-byte allocations,
alignment/reuse checks, useful failure cases and both complete original runtime
contracts. The implementation and regression fixture are retained as an
unapplied prototype in ADR 0461 and docs/bootstrap/HOSTED-HEAP.md.
Guarded cohort ten passes all four complete discovery selections with the original sixty-second runtime limits, Linux 32 MiB bound, two-worker checked builds and nine forbidden host producers. Paired independent review accepts 256 selected methods, 242 executions, fourteen declared skips and 410 discovery calls. It rereads 206 controls, 109 private inputs, five whole object pairs, 128 direct identity comparisons and all 100 legacy observer executions with 106 calls. Every checked object except the runtime retains its source-seven bytes on each host. Initial missed sentinels, allocator failures, nested timeout and corrected checker assumptions remain preserved. Named-commit qualification and normal CLI integration remain open.
The original Linux Make bootstrap and both native Windows public methods pass complete current independent review. Linux Make retains 132 staged products, 4,338 files and 1,867 complete generation pairs. Windows public review retains 4,351 files, 132 stage products, 132 behavior pairs and its separate native boundary with three complete PE relinks. The final original Windows Make build passes in 1,974.688 seconds; its current independent review accepts 159 staged artifacts, 3,423 files and 1,419 generation pairs in 153.300 seconds. All four SDK profiles, complete public selections and both actual Make consumers are now accepted. Linux retains its declared Windows-method skip. Earlier-cohort checker validation is kept separate from these current results.
All 99 normal producer inputs still match committed acbbd834. The fifteen
installed seed files still match that committed parent release, whose producer
revision is a1cc8f3a. Seed and manual adoption require their separate audit.
The separate 200 MiB checked Linux reuse failure, complete required-file image
acceptance and strict boots remain open. All three Python coordinators, full
Doom/vendor work, in-OS tools and remaining C migrations stay in the mission.
TempleOS remains read-only and excluded. The bootstrap branch is pushed; PR 33
stays open as a draft and is not merged.
The coalesced required-file handoff passes all four complete native/Cupid runtime selections. Independent checking accepts all 664 selections, 652 calls and 23 complete checked object pairs, including full image/FAT reconstruction and preserved negative bytes, timestamps and namespaces. Seven of eight original 200 MiB cases pass. Checked Linux reuse still times out at 600 seconds with 32 MiB, so complete large-image, independent boot and adoption acceptance stays open. The original failed attempts remain preserved.
The separate distinct-input prototype adds explicit observer quotas, retained-file streaming and complete validation before discovery exposes a view. Both native callers pass all 64 methods, including 4,096 distinct present, missing and nested inputs. All four builders and all 100 ordinary/UNC observer regression executions pass. Construction-time kernel and parent-binding changes reject before return. Checked Windows still rejects four capacity cases during allocation; checked Linux still exceeds its original bound in four cases. The unchanged Windows missing-stage replay passes at 3,607 inputs and rejects at 3,608. Full paired acceptance remains open without reducing input capacity, deadlines or memory limits.
All four original replacement-seed SDK profiles now pass complete independent review of 104 SDK inputs, 77 whole stage pairs and 22 published images per profile. The original Linux public bootstrap selection also passes with its Windows skip. Independent rereading accepts all 4,338 retained files, 99 committed inputs, 132 stage products, 44 final-stage pairs and 132 complete behavior pairs. The original actual Linux Make bootstrap is running, followed by the native Windows public and Make consumers. Separate predecessor validations accept the new public-boundary and Make checkers; those records do not accept the pending current consumers. Their unretained producer-command, private-kernel-output and internal-timestamp limits stay explicit.
Commit 43459f3a records the evidence and retained failures in seven documents,
including ADR 0460; fd1a1873 records independent Linux public acceptance.
All 99 normal producer inputs, fifteen installed parent files
and the held manual remain unchanged. Root seed/manual adoption, native image
command ownership and retirement of the three Python coordinators remain open.
TempleOS stays read-only and excluded.
Commit 8163b77a records the frozen-input work counts and compiler entry-guard
controls in ADR 0459
and the required-file handoff record.
The clean source-four copies pass all four five-program builds and both complete native regression selections. Windows closes in 323.663 seconds and Linux in 270.108 seconds. Both checked selections, complete independent acceptance, all eight clean-source large cases and strict guest boots remain required. The source-three acceptance still retains all 664 selections and 652 calls.
One live-input validation now walks the entire required frozen set once after ordinary observations. The actual FAT-reuse feedback rejects duplicate or missing passes. Its checked Linux diagnostic reduces whole 200 MiB digest passes from 49 to 44 and closes in 542.555 seconds under the original 600-second and 32 MiB limits, with the same complete image. Instrumented timing does not establish a stable ratio or accept the original failed large cohort.
The separate literal-transfer prototype passes 32 regular controls through native and Cupid-built callers. A legal caller-saved ECX clobber exposes both isolated entry-guard mutants as wrong runtime results on both hosts. Their unaffected modes and malformed-IR rejection remain exact; strict disassembly accepts both wrong programs. Independent rereading checks all 32 verdicts, four wrong-runtime cases and complete object comparisons. Full compiler qualification and normal source integration remain open.
The first clean Windows runtime stops on explicit disk-full errors; its fresh complete retry passes. The original Windows long-path SDK attempt stops on a compiler output I/O error and retains its partial workspace. Its fresh retry preserves the three independently accepted SDK profiles and original bounds. The checked regressions and SDK retry are running; public methods and actual Make bootstraps retain their place in the original consumer queue.
Nine explicitly selected closed large fixtures are compressed without deletion. Complete hashes, lengths and modification times remain unchanged. Concurrent filesystem activity means the volume-space change is not exact recovered storage.
All 99 normal producer inputs still match committed acbbd834 and the fifteen
installed seed files retain parent revision a1cc8f3a. Ownership remains
449 CupidBuild and three Python actions across 452 transforms. Root seed and
manual adoption await complete replacement-tool consumers. Full command
ownership, qualification, coordinator retirement, Doom/runtime acceptance and
in-OS tools remain open. TempleOS stays read-only and excluded.
The private required-file handoff now carries selected external bootloader and kernel files through retained observers, checked template production and one guarded publication transaction. Complete small-image and legacy acceptance passes on Windows and Linux. This work is recorded in 7e80ba98; the normal command, source integration and producer qualification remain open.
Independent review checks all 664 selections, 646 executions, eighteen platform skips and 652 actual calls across four native/Cupid callers. It rereads 209 source/support controls, 109 private producer inputs and 23 complete checked object pairs. Every positive eight-MiB image is reconstructed independently; raw FAT memberships, mirrors, chains and padding, negative prior bytes, timestamps and cleanup are checked. Existing template, external publisher and ordinary/UNC observer regressions remain included. The handoff record keeps exact source, caller and authority bindings.
The same private shared runtime supplies standard fgetc and getchar through
the existing stream state. All four callers pass byte values including 255,
EOF, rewind, indicator reset and write-only read errors. Both runtime objects
pass strict disassembly. The
byte-input record
retains the specific native Windows errno difference.
All four native 200 MiB fresh/reuse cases and both checked fresh cases pass. Both checked reuse cases still time out at the original 600-second limit; Linux retains 32 MiB of address space. Separate unchanged-library traces reach close after publication returns. A literal-transfer compiler experiment reaches a limited emitter fixed point on both hosts and passes its capability controls. Its single-object Windows diagnostic reuse closes in 589.996 seconds, while Linux still times out. Complete branch-entry controls, producer qualification, large-image acceptance and subsequent strict guest boots remain open.
Both Linux replacement-seed SDK profiles and the Windows default profile now pass independent review: 104 SDK inputs, 77 complete stage pairs and all 22 published artifacts per profile. The default profiles retain 98 bootstrap inputs; Linux long-path publication retains 99. Windows long-path SDK, full public methods and actual Make bootstraps continue in the original serial queue. All 99 normal producer inputs and fifteen installed parent seed files remain unchanged. Root seed/manual adoption awaits the remaining consumer checks. Ownership stays at 449 CupidBuild and three Python actions across 452 measured transformations. TempleOS remains read-only and excluded.
b64dd829
provides standard hosted putchar through fputc and the current stdout stream.
Both methods pass through native and Cupid-built callers on both hosts, for eight
executions. They check all 768 signed arguments, exact byte returns, complete
output, read-only errors and preservation of the original file and timestamp.
The preceding committed 178,330-byte manual passes fresh normal kernel, image and user builds
on both hosts with conventional producers forbidden. Complete paired comparison
checks all 429 objects, sixteen artifacts, six user products and the full
103-field/101-provider syscall ABI. Only the manual wrapper changes. Both complete
200 MiB images have SHA-256
301da60d5ec6166a3740dbd57d4bf8ee0e0957d9120e5d47be3172917b92ea2f,
with every baseline FAT suffix byte preserved. The measured raw kernel is
9,296,460 bytes. All four strict four-CPU max/e1000 ls/SMP and ISO boots pass
at the original 150-second bounds.
Both full preparations pass for the new 99-input producer snapshot
682eb4d8c80fb348280e42db3e6a43f0292258c137017265b39d9741797a0be2.
Both complete qualifications pass against that committed source and the retained
preparations. Windows takes 2,464.580 seconds and Linux 2,756.732. Independent
checks cover all 291 staged products, 97 complete fixed-point pairs, 7,761
published regular files, 99 committed producer inputs and fifteen unchanged
installed parent files. Seed carriage remains open; installed seeds retain their
earlier qualified identities. The
runtime record
gives the commands, source controls and retained failed recipes.
84ae3852
adds hosted strtoull, fgets, feof and clearerr. All 34 conversion,
line/state and putchar methods pass through native and Cupid-built callers on
both hosts, for 136 fresh executions without skips. Independent checking
separately verifies the 128 conversion and line/state executions, 103 source
controls, 99 producer inputs and 5,856 conversion inputs.
The committed 179,862-byte manual passes both normal kernel/image builds, fresh
user checks and all four strict private four-CPU max/E1000 boots. Independent
checking compares every byte of all 429 objects, sixteen artifacts, six user
products, the 103-field/101-provider ABI and both complete 200 MiB images.
Both images have SHA-256
beb2df2cd69eb2290486564a598fe8bfb6f4acfb52f0f0c5882ca14a25736b79,
with the baseline FAT suffix preserved. The raw kernel measures 9,297,992 bytes;
only the manual wrapper changes from the preceding image.
Both complete preparations pass with 291 products and 97 complete fixed-point
pairs. Independent checking binds all 99 producer files to exact committed Git
blobs and both retained preparations. Both complete library qualifications now pass,
in 2,413.305 seconds on Windows and 2,580.462 on Linux. Independent checking
verifies 291 staged products, 97 complete fixed-point pairs, 7,761 published
files and all 99 raw committed inputs. Seed carriage and acceptance through
replacement tools remain open; the fifteen installed files still belong to
the accepted a1cc8f3a cohort. The
library record
retains commands, source controls and failed attempts.
The separate optional publisher retains its 236 passing executions and one broader Windows standalone cleanup failure whose cause remains unproven. A separate external-root observer passes 72 cases. The private external frozen input API passes 200 selections, with 196 executions and four platform skips. Independent checking binds 117 source controls, 106 private producer paths, complete frozen outputs and the original bounds, including 200 MiB transfers with 32 MiB on Linux. External stage capture then passes 220 selections, with 212 executions and eight platform skips, across 119 captured controls.
The next private external publisher stages authorized external payloads into complete eight-MiB FAT images. Four native and Cupid callers pass 176 selections, with 172 executions and four platform skips. Independent checking reconstructs complete images, reads final FAT payloads and verifies prior bytes/timestamps, external archives, all 188 source controls, 106 producer inputs and actual objects and callers. Each invocation retains 180 seconds and each Linux caller retains its 32 MiB limit. Required and optional callers pass another 106 executions without skips. Independent checking reconstructs their complete positive images, reads FAT payloads and verifies preservation facts, actual standalone programs, source/compiler bindings and unchanged installed seeds.
All four native and Cupid external publisher callers now also pass both normal-geometry methods, for eight complete 200 MiB publications without skips. They use actual accepted OS bootloader/kernel bytes and external synthetic eight-MiB WAD-shaped payloads. Independent reconstruction verifies every whole image, FAT mirrors/chains/padding and all previous regular files on reuse. The check binds 190 controls, 106 producer inputs, actual compilers and receipts, external archives and unchanged installed files. Each invocation retains the full-image 600-second limit and Linux 32 MiB bound; the small cases retain 180 seconds. Six strict private four-CPU boots pass for these accepted images: fresh/reused ls/SMP and reused ISO completion on both hosts, under the original 150-second bound. Independent review verifies actual commands, serial contracts, driver sources and complete preserved images. These images carry the preceding 179,862-byte manual and kernel. Synthetic WAD payloads do not prove Doom runtime acceptance.
Commit acbbd834 accepts wide integer compound calculations before converting and storing narrow destinations. The original publisher expression is preserved. All ten operators, narrow widths/enums, wide divisors/remainders, single operand evaluation, chained results, volatile exact stores and adjacent bit fields pass execution checks. Atomic/boolean mutation, wide counts and partial volatile bit fields retain their useful rejections and preserve prior output. Exactly two normal producer files change; private host and publisher extensions remain separate.
Both complete preparations pass with 291 products and 97 fixed-point pairs.
Native and new Cupid callers pass all forty methods and twelve native IR/object
contracts; fresh bootstrap-worktree checks repeat that complete selection.
Independent checking compares complete emitted objects and same-host linked
products. All 99 producer files match exact committed Git blobs and both
retained preparations. Both complete qualifications now pass for committed
acbbd834, in 2,158.125 seconds on Windows and 2,252.197 on Linux. Conventional
producers remain blocked, with two workers and the original bounds. Independent
rereading verifies all 291 staged products, 97 complete fixed-point pairs,
7,761 published files, 99 exact committed inputs and twelve reviewed final
tool identities. Both behavior generations pass their original success,
rejection and help groups.
The qualified fifteen-file replacement is projected into two fresh private OS consumers. Each starts with 1,743 complete source/control files, zero objects and the complete accepted 200 MiB image. Both installed-pair verifiers pass; the Windows plan binding names the actual replacement Linux manifest while retaining its qualified parent lineage.
Both 277-method compatibility selections pass, with 534 executions and twenty
expected platform skips. Both cold kernels, complete image builds and fresh
user checks pass through the replacement tools. Independent rereading compares
all 429 objects, sixteen artifacts, six user products, fifteen candidate files,
the complete 103-field/101-provider syscall ABI and both complete 200 MiB images.
Both images have SHA-256
e549ca8a89e1c5edb95e91888aee03fa2bc17b3094752ea4699cc468436bb754,
with every baseline FAT suffix byte preserved. The complete pending 181,631-byte
manual occurs once as nonexecuting data. All four strict private four-CPU
max/e1000 ls/SMP and ISO boots pass under their original 150-second bounds.
The four SDK profiles, complete public-bootstrap methods and actual Make
bootstraps remain in their serial queue. Root seed adoption and the manual
commit await those checks; the ordinary installed fifteen files retain the
qualified a1cc8f3a identities. All earlier accepted consumer files remain
preserved. The seed candidate record
binds the exact private projection, complete source observations and remaining
consumer checks. The earlier committed manual retains its acceptance below.
The first separate native image-option owner passes all 25 methods through four native/Cupid callers, for 100 executions and 780 actual invocations. Complete independent rereading checks 113 source/support controls, all output sequences and four whole checked object pairs. Native and Cupid output bytes agree on each host. Required values, repeated options, explicit stages before the final WAD group, both basename profiles, Unicode decimal input and the full 4,096-stage capacity are covered. The new source stays outside the normal 99-input producer closure while the consumer queue runs. Complete CLI compatibility, path discovery, observer lifetimes and publisher integration remain open; the normal image recipe still uses Python. The native option record keeps the exact evidence and both retained fixture corrections.
A subsequent private option copy preserves unknown/help order, short help clusters, option-like paths with spaces and both installed commands' ambiguity timing. Its grammar profile is independent of basename rules. All four callers pass the complete expanded 30-method suite, for 120 executions and 1,032 actual invocations. Independent review checks 168 complete original-help oracle records, all 113 controls, every repeated output sequence and four whole checked object pairs. Native and Cupid bytes agree on each host; twelve shared cross-host argument keys also agree. The preceding source and its complete 780-call acceptance remain preserved. Commit 594980f2 records that evidence while the normal producer snapshot and installed seeds remain unchanged. Full native command and whole publication still remain open.
The separate native input-discovery owner now retains required and optional paths, physical roots, original parent bindings and owned strings after the options/argv storage is released. Four native/Cupid callers select forty methods each, execute 148 and retain twelve platform skips. All 236 actual calls pass, including 48 direct file-identity calls. Those comparisons reject unobserved files, invalid paths, null arguments, metadata drift and streamed digest drift. Complete independent review checks 206 source/support controls, every result and five whole checked object pairs. The changed host also passes all 100 ordinary/UNC regression executions and 106 actual calls. The preceding complete 188-call acceptance stays preserved. Commit 2d4a8e54 and the discovery record retain exact source, tools, profiles, failed fixtures and checker corrections. All 99 normal producer inputs and fifteen installed seeds remain unchanged. Complete seed/output authority, external required-file freezing, output-parent preparation, unique-input capacity, full CLI compatibility and whole publisher handoff remain open. The 4,096-stage case repeats one source; it does not claim 4,096 distinct retained observations. Source integration and qualification still precede normal recipe adoption.
The replacement-seed Linux default SDK consumer passes in 4,588.616 seconds. Its original independent review passes in 63.093 seconds and checks all 104 SDK inputs, 98 bootstrap inputs, 77 complete stage pairs and 22 published images. The Linux long-path SDK profile has started; the two Windows SDK profiles, complete public methods and actual Make bootstraps remain in their serial queue. Root seed adoption and the pending manual commit still await those remaining consumer gates. The full self-hosting mission and its runtime requirements remain open.
The new normal-source compilers build all four private publisher programs per host. Every actual object and eight complete same-host program pairs match the preceding accepted builds byte for byte. Their preceding checked execution scope covers 198 selections, 196 executions and two platform skips; this byte comparison adds no fresh runtime count. Independent review binds 190 caller controls, 106 private producer inputs and the actual normal-source compilers.
The complete committed 181,453-byte manual passes both normal kernel/image
builds, fresh normal user checks and all four strict private four-CPU max/e1000
ls/SMP and ISO boots under the original 150-second bounds. Complete independent
comparison checks all 429 objects, sixteen artifacts, six user products, fifteen
seed files, the 103-field/101-provider ABI and both 200 MiB images. Their SHA-256
is 8869c891beafa901eeb9b9adae791831659de0b16e22683deb812a2fdce9d158,
with the baseline FAT suffix preserved. Only the manual object changes; the raw
kernel measures 9,299,584 bytes, and only that measured policy row changes.
Canonical ownership generation/checking and useful policy regressions pass
after four exact fixture entries are added; no source is removed.
Separate native stage interpretation passes 32 methods and 464 actual invocations through four callers, preserving the existing Python drive-colon and WAD alias behavior. Retained physical-root comparison selects 56 methods, executes 52 and skips four Windows-only cases on Linux. Its negative cases retain metadata, streamed-payload and absence checks. Complete independent review verifies both scopes, actual tools, source copies and result bytes. A subsequent private observer copy now opens ordinary Windows UNC share anchors while retaining the existing no-reparse descendant walk and complete metadata, streamed-payload and absence checks. Native and Cupid Windows callers pass all 24 UNC methods each, for 48 method executions and 54 actual invocations. Real local shares cover long Unicode paths, share-only anchors, drive/share and server aliases, and useful file/junction/device/unavailable-root rejections. The ordinary four-caller selection also passes all 52 executions with four expected platform skips. Independent checking verifies all 193 controls, actual compiler preparations, exact profiles, complete results and original bounds. Every Linux checked object and the complete program match the preceding accepted comparison build byte for byte. All 99 normal producer inputs and fifteen installed seed files remain unchanged. The first junction fixture resolves the path before invocation; preserving its absolute spelling repairs the test without changing C/header bytes. Failed source copies and receipts remain retained. ADR 0454 and the UNC observer record describe this separate implementation and its acceptance.
Full option parsing, path discovery, observer lifetime and whole-publisher integration, the other accepted large geometries, committed qualification of the changed host copy and normal recipe adoption remain open. The mutation record and native disk handoff retain the exact acceptance boundaries. The external publisher record keeps these scopes and failed copies. The normal disk recipe and two SDK coordinators still use Python.
Both complete qualifications pass for committed a1cc8f3a and its 99-input
producer snapshot. Independent checks cover 291 staged products, 97 complete
fixed-point pairs, 7,761 published regular files and fifteen unchanged parent
files. Windows takes 2,439.406 seconds and Linux 2,221.945, with the original
producer bounds and complete behavior cases.
The bootstrap branch adopts the twelve exact tools, two manifests
and reviewed release after complete paired consumer checks. The Windows manifest binds the actual replacement Linux
manifest. Both complete manifest verifiers and the installed pair check pass.
Both normal OS and user builds and all four strict boots pass through the new
seeds. Independent comparisons cover all 429 objects, sixteen artifacts, six
user products, the complete ABI and both complete images with preserved FAT data.
All four ordinary/long SDK profiles pass complete independent review of 104
inputs, 77 stage pairs and 22 published ELF images each. Corrected complete
Linux public methods and the actual Linux Make bootstrap also pass. Independent
public checking covers all 99 committed inputs, 132 staged products and 132
complete behavior artifact pairs. Both complete Windows public methods also
pass in 2,672.293 seconds. Independent rereading checks all 4,351 retained files,
99 committed inputs, 132 staged products and 132 complete behavior pairs.
The actual Windows Make bootstrap also passes in 1,988.571 seconds.
The preceding 177,436-byte manual
passes both normal image builds and all four strict boots. Both complete
209,715,200-byte images have SHA-256
10f5995aa214346c34fe4c45e4ca3c278f145266f8e7fc08f4d8b84a7388829b;
every object, user product, artifact and baseline FAT byte passes paired review.
The
qualified seed record
contains the identities, retained projection rejection and remaining work.
The normal disk publisher and two SDK coordinators still belong to Python.
The prototype connects retained paired-tool capture, required files, checked template production, native composition, sequential FAT16 staging, independent validation and guarded publication. All 132 current small-image executions and 24 publication-boundary cases pass complete independent checks. Fresh native and Cupid-built callers on both hosts also publish the complete 200 MiB oracle. Matched publication and cleanup take 576.097 seconds on Windows and 576.810 on Linux, within the original 600-second bound; Linux also keeps 32 MiB. Independent checking reconstructs every complete image and separately reads FAT mirrors, payload chains and padding. All four strict four-CPU boots pass.
The original failed full-image cohorts remain recorded. Instrumented copies measure about 11 to 12 GB of digest input per 200 MiB operation; their timing does not replace ordinary acceptance. The observed 105-input source remains a separate unqualified prototype. Optional discovery, the normal command, complete large-geometry templates, integration and qualification remain open. The normal disk recipe still uses Python. The publisher record binds the commands, original bounds, archives and independent evidence.
a1cc8f3a
adds signed and unsigned eight-byte integer offsets to CupidC pointer
arithmetic, subscripts and compound assignment. i386 emission preserves element
stride and single operand evaluation. The hosted Windows seek declaration now
uses LONG * for its high word. The
implementation record
records the compiler, runtime and build evidence.
Both source/manual consumer cohorts pass: 429 matching objects, sixteen exact artifacts, identical complete images and all four strict boots. Only the manual wrapper changes from the accepted baseline. Both prepared stage-four compilers pass all four pointer/header methods. Matched hosted runtimes pass all seventeen sparse-file methods, including operations above four GiB.
All 99 prepared producer inputs match the committed source. Complete Linux and
Windows qualification is running against that commit and the 2d04ff25 parents.
Installed seeds keep their qualified checkpoint. Wider disk transactions and
producer adoption remain separate gates.
The 24-file source step is committed and pushed as
3072bc4f
on bootstrap/cupid-self-hosting. All 99 committed producer blobs match the
reviewed preparations. The accepted embedded manual and installed seeds keep
their exact bytes; the final log addition records completed controls.
All six complete public modules select 139 methods per host. Their 272 passing executions retain six declared skips. Both full 156-source kernel cohorts compile twice within 2,340 seconds, with every installed-seed object lock preserved. Independent checks reread 112 native API invocations and 84 complete exported copies. Both Linux large-copy controls retain the 32 MiB memory limit. All twenty strict build contracts and 26 ownership methods also pass, including the negative cases. Both review axes report zero findings.
The older complete preparations retain their actual 76914250 parents and
remain unqualified. The current committed verifier correctly rejects that
older parent selection. Fresh preparations now use the published source and
the currently qualified 2d04ff25 parents. Qualification, seed adoption and
subsequent OS/runtime acceptance through the new tools remain required.
Both fresh normal OS builds start with 1,704 source inputs and zero copied objects, with twelve conventional code producers blocked. Independent paired checks cover all 429 objects, sixteen artifacts, six user products, the complete ABI and the preserved FAT suffix. All four original strict four-CPU ls/SMP and feature 17 boots pass within 150 seconds. The complete 175,777-byte manual occurs once in each kernel output. Every other object, including generated symbol data, matches the accepted installed-seed baseline.
Both complete 200 MiB images have SHA-256
b018117c0cb21a677ce55a341dd1cdde5092a51ec73537988e1e0c9465015db8.
The measured kernel sizes are 9,293,908 raw bytes, 9,523,644 final ELF bytes and
9,392,572 pass-one ELF bytes. Only those three policy rows change. The 478-input
kernel fingerprint matches all four accepted complete frontier captures; every
kernel source and object lock remains unchanged. Evidence is
result-source-os1-paired-independent.json and
result-source-kernel-snapshot1-independent.json.
The canonical LF frozen-input fixture compiles through both complete prepared Cupid compiler cohorts. Its whole object and linked executable match the previously accepted CRLF caller exactly. This binds the staged source bytes to the retained complete runtime evidence; it does not claim another execution. Both complete native retained-API modules also pass all 31 selected methods per host, preserving the two declared Windows memory-control skips.
The existing geometry chooser accepts the measured 2,048, 2,050 and 4,096 MiB cases, which exceed the native bounded transaction's 2,147,483,647-byte limit. These are geometry checks without allocated images. Native publication still needs owned I/O with 64-bit offsets and snapshots, complete identity checks, flush and rollback. The old bounded APIs and their useful negatives remain.
The installed 2d04ff25 seeds supply the source/manual consumer gate.
Committed qualification, adoption and OS acceptance through the further
result-transfer compiler remain separate. Native disk/SDK recipe ownership,
the original EHCI failure and full Doom gameplay/timedemo acceptance stay open.
Both complete new-cohort Cupid callers pass all 62 original ordinary and
self-host modes per host. Independent rereading checks all 138 build/mode phases,
complete sources, linked components, commands and original limits. All eight
linked products match the accepted native products and each other. The final
seven-tool links take 1,748.247 seconds on Windows and 1,751.607 on Linux, within
the original 1,800-second limit. Both actual i386 adapters and complete hosted
runtimes also pass four executions with their original ten- and sixty-second
bounds and exact expected bytes. Evidence is
result-fullcohort-controls2-paired-independent.json and
result-cupid-linked-runtime-fullcohort2-paired-independent.json.
The original Linux derivative timeout remains failed. The first independent checker also retains its incorrect copied-host-object assumption. Its replacement checks the unchanged actual link inventory and retained stage input; no source, runtime predicate or deadline changes.
The reviewed bounded input, previous-output and further result-transfer source entered integration through thirteen implementation, test and ownership paths. Its 99 producer inputs match the checked preparations. Installed seeds retain their separate qualification. The revised 175,777-byte manual passes paired cold OS builds and all four strict boots through those installed tools. Only the measured kernel fingerprint and three kernel-size policy rows change. New producer qualification, replacement adoption, OS acceptance through the new tools and native disk recipe ownership remain open.
The earlier qualified scalar-seed carriage and public-bootstrap context step is
committed and pushed as
261a4221
on bootstrap/cupid-self-hosting. Its 33 files carry the qualified 2d04ff25
tools, reviewed locks, public entry-point fixes and accepted 174,193-byte manual.
All 99 producer inputs stay unchanged. Fresh complete context, stage-release and
manifest modules add 140 passing executions and four declared platform skips.
The separate new API/emitter integration is not included in that commit.
The committed 2d04ff25 producer passes complete Linux and native Windows
qualification with conventional host producers forbidden. Its source snapshot
contains 99 inputs. Independent paired checks reread all 291 staged products
and 7,761 published files. The exact fifteen-file seed and release cohort is
carried privately while Windows external-user acceptance remains open.
Public bootstrap commands accept an explicit reviewed behavior release. Both staged tool sets must match that cohort exactly; an earlier release cannot authorize changed tools. Both complete public selections and both actual Make bootstraps pass. Each complete kernel-frontier module passes all 36 methods, including the full 156-source cohort compiled twice with sixty reviewed locks.
Both fresh normal OS builds pass independent review of all 429 objects,
sixteen artifacts, six user products, full ABI and preserved FAT data. Four
strict four-CPU max/e1000 boots pass completed ls/SMP and feature 17 ISO checks.
The revised 174,193-byte embedded manual also passes paired controlled
link refreshes, complete payload and symbol reconstruction, and four strict
boots. Its complete images agree: 209,715,200 bytes with SHA-256
774925f38151973ce91ed4fd4103c4cf28e985264723ada750a3500b06f89781.
Only the raw-kernel size changes to 9,292,324 bytes; fifteen other policy rows
and all producer inputs remain unchanged.
Linux external hello, ls and cat pass independent FAT payload and PID-bound runtime checks. Windows hello and a separate cat case pass. The initial Windows ls attempt retains an EHCI DMA-revocation panic before program execution. Two traced replays, an untraced replay and a fixed six-case diagnostic cohort do not reproduce it. Those results establish neither its cause nor resolution.
Ordinary and explicit long-path SDK publication pass on both hosts. Each of the four profiles passes independent review of 104 inputs, 77 complete stage pairs, 22 strict ELF artifacts and its manifest. The initial concurrent Windows proof collector fails during directory publication; a direct publisher control reproduces WinError 5 with a held file reader. The replacement collector runs after the SDK body and before normal cleanup. Production sources, guards and deadlines stay unchanged.
The streamed previous-output API and further result-transfer emitter remain separate prototypes. Their retained four i386 callers pass complete 200 MiB runtime controls, both Linux 32 MiB controls, ordinary publication regressions and ownership audits. The corrected enum-transfer emitter separately passes 23 capability methods through each of four producers. Both native callers pass all 58 ordinary modes; all 307 complete outputs agree with the reviewed corpus. Its 162 changed objects contain 1,325 same-address register transfers, while 145 objects are unchanged. Removing only the conversion branch-entry guard makes both strict disassemblers reject a branch into the middle of an instruction. Both actual corrected Cupid-built ordinary callers now pass all 58 original modes. All 156 kernel sources compile twice through each of four producers, for 1,248 complete compilations with matching whole objects. Strict review permits 15,303 same-address register transfers across 153 changed objects; three objects remain identical.
The full self-host corpus also receives complete paired review of 115 current-source objects: 114 contain 32,357 same-address register transfers and one is unchanged. Sixteen exact encoding locks change while all function counts, synthetic inventory counts, 10,268 original strings, semantic oracles, negative controls and deadlines remain. Both native callers then pass all 62 ordinary and self-host modes. All 422 reviewed objects and eight linked products agree across hosts. Actual i386 adapter execution and the complete hosted runtime contract pass on both hosts under their original bounds. Initial failed inventory controls remain retained.
Both complete three-stage preparations now pass. Independent checks reread
198 producer source copies, 291 staged artifacts and 97 fixed-point pairs.
Every stage-three/four product agrees within its host profile. The preparations
retain their actual parents and remain uncommitted and unqualified. Evidence is
result-full-preparations1-paired-independent.json.
A separate 1,704-input integration candidate preserves current public bootstrap
controls, installed seeds, Python expectations, policy and embedded manual.
Its 99 producer inputs exactly match the preparations. Both hosts pass all
twenty strict audit contracts, twenty-six ownership methods and forty-six native
capability methods in total. Both review axes report zero new findings.
Evidence is result-integration-candidate2-paired-independent.json.
Both retained-copy API callers also build through the complete new stage-four
cohort on each host. Independent checks verify all sixteen compile, strict
disassembly and link phases, including the exact fixed-point host API objects.
Evidence is result-fullcohort-api-build1-paired-independent.json.
Both retained-copy APIs now pass complete runtime with that cohort: 57
previous-output cases and 31 frozen-input cases, with 68 complete exported copies
and twelve expected capacity or ordinary-input rejection exits. Both Linux
complete 200 MiB controls pass under a 32 MiB address-space limit. Every original
600-second process bound and semantic predicate remains. Evidence is
result-fullcohort-api2-previous-runtime-paired-independent.json and
result-fullcohort-api1-frozen-runtime-paired-independent.json.
Windows blocks the attempted live-output write; Linux permits it and rejects
the changed observation. Both preserve the complete previous copy. The first
new checker incorrectly requires universal cross-host output equality after
all original per-host checks pass. Its failed source and result remain retained.
The corrected checker preserves every per-host predicate and checks both exact
outcomes. Runtime cases, programs, source and bounds remain unchanged. Fresh
complete object callers and their actual linked runtimes now pass independently.
The derivative caller passes all 62 original modes on Windows. Linux passes
61, then times out on self-host-link-tools at the original 1,800-second limit.
No diagnostic or final tool executable is produced; the earlier linked adapter
remains retained. Independent checks record 123 passes and one failed mode in
result-complete-controls6-measured-independent.json. This result is not paired
acceptance. Separate complete-cohort callers retain every original mode and bound.
Full source qualification, normal OS/runtime acceptance and production adoption remain required. The normal graph retains its three Python actions; full disk publication and self-hosting remain open.
Commit a2e97f97 caps allocation before reserved FAT16 cluster
0xfff0, while retaining 0xffef as the last usable cluster. All fifteen
allocator methods pass through native and Cupid-built callers on both hosts.
The full 156-source frontier compiles every source twice within its original
deadline, and all nineteen post-build assertions pass with measured locks.
Both normal Make derivatives pass with conventional producers forbidden.
Independent comparison verifies all 429 production objects, sixteen artifacts,
six unchanged user products and the complete ABI. Every frontier object
matches both production cohorts. Only FAT, the embedded manual wrapper and
generated symbols change. Both hosts produce the same 9,599,128-byte raw kernel
and preserved 200 MiB image, SHA-256
cf5f4ded28e6c14fa3a6e896ff96c39eed00f7ad96ba48c13232fb3938248e3f.
The 164,948-byte manual appears once in all three kernel outputs. All four
strict private four-CPU max/e1000 sessions pass completed ls/SMP and feature 17
ISO checks. The normal graph retains 449 CupidBuild actions and three Python
actions; the qualified fifteen-file seed cohort stays unchanged.
See the complete FAT16 record.
Commit 51f3c9ee
installs the qualified paired tool cohort from committed producer 344a9eee.
The complete 92-input source snapshot is
829f923bdfefcfab5d1d9b2caacb466853a1c21ca1537a6517ddf83e1a6f7d4d.
Linux retains 34 C sources and one startup object; Windows retains 39 C sources
and five startup objects. Both six-tool cohorts and their reviewed release
keep the exact independently checked identities.
Normal ISO fixture publication now runs CupidBuild's retained
publish-iso-fixture transaction. Every fixture member and all fifteen paired
seed/release files are content inputs. Normal user Make directly invokes the
read-only native verify-user-abi command with the absolute repository root,
six declarations and selected complete seed trust unit. Ten actual ISO Make
commands and ten user Make commands pass across both hosts, including equal
timestamp reuse, same-size drift rejection and recovery.
The hosted SDK carries explicit reviewed behavior authority through capture, bootstrap, cache reuse and final publication. It captures 101 inputs and retains all 74 native stage comparisons. Both actual default and long-profile publications pass on both hosts, with original stage deadlines and full behavior fixtures. Independent checking rereads their raw stage pairs, 22 ELF products and native-authored manifests. Both hosts also verify the actual installed fifteen-file seed pair and read-only native ABI command against the complete independent report.
Fresh paired OS/user acceptance checks all 429 objects, sixteen artifacts and
six user products. Four strict private four-CPU max/e1000 sessions pass completed
ls/SMP and feature 17 ISO tests. The 164,380-byte manual appears once in all
three kernel outputs. Both hosts produce the same preserved 200 MiB image,
SHA-256 eb9c8531022cd5fdb3dd5450aabd7c5bb86968205f05ecca53049339133ccde9.
The complete frontier input lock records 474 files; all 156 production objects
retain their identities and 4,421,572-byte total.
The normal graph has 449 CupidBuild and three Python actions across 452
transforms. Python still owns disk-image publication, hosted SDK publication
and hosted SDK verification. Optional staging and developer harnesses remain
separate work. TempleOS/ remains read-only reference material and is excluded.
See ADR 0431
and ADR 0432.
Commit 344a9eee
adds the source CupidBuild command publish-iso-fixture. It freezes complete
fixture inputs, both six-tool seed cohorts and the selected release, launches
the host's frozen CupidObj and independently checks every candidate image byte
before publication. Retained observations stay bound through the final rename
checks. Equal output keeps its timestamp; ordinary rejection restores verified
prior bytes or absence.
Native and Cupid-built API and command checks pass on Windows and Linux. The
composed matrix has 343 executions and three platform skips. Four complete
512-entry requests produce the same 66,342,912-byte image from 67,176,834 input
bytes, SHA-256
44f47e3463e4a7f046b7d52034b7fcf411b799b9d1ecbf71a316bf7f8378ebe1.
Seven checked object pairs match. The publisher is 22,200 bytes, SHA-256
94695810e4e385bfb78724a34307455cc215cbd93e202595560846d61e44761c.
The production author deadline remains sixty seconds.
Native Make and both producer plans carry the codec and all four ISO modules. The Linux plan has 34 C sources; five new Windows profiles bind source counts 85, 90, 91, 91 and 92 to both plan digests. Historical supported plans remain. Both complete preprocessing suites and seven-tool source-link/runtime parity checks pass. The graph has 780 active inputs and 452 transforms, with 447 CupidBuild and five Python actions.
The 162,971-byte manual passes installed-seed OS/image checks and strict private
four-CPU max/e1000 boot with completed ls and SMP verification. Independent
rereading checks all 429 objects and sixteen artifacts. Its 200 MiB image has
SHA-256 f30afc3b7e591146e1457d5aa65e7447454df5f1a5eeee98915080b258d150e5.
Complete new source-cohort bootstrap qualification, seed installation, normal
ISO regeneration and feature 17 remain open. The installed normal ISO recipe
retains its accepted cohort and Python coordinator. See
ADR 0430.
Commit 564ec4f2 lets a private checked input retain its explicit capacity through capture, revalidation and tool launches. The complete ISO request can use 68,165,648 bytes, matching CupidObj's existing payload allowance plus bounded metadata. Existing candidate and public-image bounds remain 64 MiB.
A valid 512-entry, eight-level bundle measures 67,176,834 bytes while its image is 66,342,912 bytes. Native and Cupid-built producers on both hosts emit the same retained image; the independent Python oracle and native checker agree. All nine new methods pass through both host adapters and toolchains. Complete observer and 528-input regressions and eight injected rename-boundary faults also pass. Independent evidence verifies 328 executions and ten platform skips, with matching 40,128-byte caller objects. Conditional-inventory and unknown-token checks add four passing executions. The graph still records 775 active sources, 452 transforms and 447 CupidBuild/five Python actions.
The 161,772-byte manual passes installed-seed kernel/image checks and strict
private four-CPU max/e1000 boot with completed ls and SMP verification. Independent
rereading checks all 429 objects and sixteen artifacts; only its wrapper changes,
and FAT data stays intact. The raw kernel measures 9,595,904 bytes. The 200 MiB
image has SHA-256
89b1fe8694fd8fa99a53b5b29fea6977743237baed895a1de22285980552e25a.
Complete guarded ISO publication, committed-source seed qualification and normal
recipe handoff remain open. See
ADR 0429.
Commit 2d47b100 binds one retained observer to a transaction with the same root identity before any publication attempt. Every publication boundary rechecks captured payloads, metadata, ancestors and exact memberships, including after candidate installation. Binding after changed publication or equal-output reuse fails. Source observation drift can still restore verified old output through the existing recovery checks.
Ten binding methods pass with native and Cupid-built callers on Windows and Linux. Eight injected rename-boundary faults preserve prior bytes and timestamp or absence, clean state and permit recovery. The complete observer and 528-input regressions pass: 292 executions and ten platform skips. Fresh preprocessing and conditional-inventory checks add 82 passing executions without skips. The graph still records 775 active sources, 452 transforms and 447 CupidBuild/five Python actions.
The 161,127-byte manual passes installed-seed kernel/image checks and a strict
private four-CPU max/e1000 boot with completed ls and SMP verification. Independent
rereading checks all 429 objects and sixteen artifacts; only its wrapper changes,
and FAT data stays intact. The raw kernel measures 9,595,256 bytes. The 200 MiB
image has SHA-256
4250559828b4a1553b1d32bcbe042c91ed20662a3a5287f7d571273d45a192f4.
Complete guarded ISO publication, committed-source seed qualification and normal
recipe handoff remain open. See
ADR 0428.
13f19582
adds native inventory validation, retained file/directory observation, complete
input capture, independent image checking and bounded CUPISO1 transport.
The source preserves all 512 fixture entries, 127-byte names, eight directory
levels, empty files/directories and exact membership. A real full Windows
request now uses 310 UTF-16 command units instead of the rejected 182,582-unit
launch. Both checked CupidObj producers emit the same independently verified
1,224,704-byte image.
The shared reader recognizes the complete codec plan and all five current Windows profiles through an explicit release record. It keeps the original strict entry point and separate parent authority. Native and Cupid-built manifest/profile selections execute 162 methods across both hosts without skips, with matching reader/caller objects. Transactions now retain 528 inputs, enough for a full file fixture, its manifest and fifteen cohort files. All 32 new capacity executions pass; existing observer tests bring that selection to 248 executions and ten platform skips.
Both complete 129-method graph suites pass. The combined FAT16/native ISO stale-source and negative-gate selection also passes, for 259 independently reread graph methods without skips. The canonical audit and its check record 775 active sources, 53 sources outside supported roots and unchanged ownership of 447 CupidBuild and five Python actions across 452 transforms.
The combined 160,376-byte embedded manual passes installed-seed kernel, image and strict private four-CPU max/e1000 boot with completed ls and SMP checks. Independent verification rereads 1,589 source controls, all 429 objects and sixteen artifacts. Only the manual wrapper changes from the accepted FAT16 control, and the 200 MiB image preserves existing FAT data. Raw, final and pass-one kernels measure 9,594,508, 9,822,652 and 9,691,580 bytes.
Windows rebuilt working-source qualification passes seven help, sixty success and fifty-four failure groups in both final stages. Independent rereading checks 138 stage artifacts and 100 matching behavior product pairs. Linux retry four completes stages two and three, then times out on the stage-four frontend under the unchanged 360-second bound. All 92 retained Linux artifacts match preparation; no Linux behavior acceptance follows that failure.
Seed installation, committed-source qualification and guarded ISO publication
remain open. Python still coordinates the normal complete ISO publication.
New sources use .cc, and TempleOS remains read-only reference material outside
the audit. See the handoff
and ADR 0427.
8f885f02 keeps lowest-free-cluster allocation while reading each examined FAT sector once per scan. A controlled 317-cluster HomeFS replacement uses 9,708 reads instead of 2,284,936 and preserves both FAT copies byte for byte. Invalid geometry and scan-read failures stop before marking an entry. Existing FAT-copy marking and durable HomeFS publication ordering remain intact.
Thirteen methods run with native and Cupid-built callers on both hosts, including twelve invalid geometries and storage failures. All 52 case executions pass. Complete FAT compilation through both normal Make paths produces identical 65,672-byte objects. The 37-method kernel/storage regression also passes on each host.
The complete checked-seed frontier compiles all 156 sources twice, with no boundaries. Independent checking validates each i386 object and matches both copies to the qualified OS cohort, totaling 4,421,572 bytes. The final canonical audit and check pass with unchanged build ownership.
The new embedded manual and FAT source pass independent checks of all 429 objects, sixteen artifacts and strict private four-CPU max/e1000 boot with completed ls. Only FAT, the manual wrapper and generated symbols change. The raw kernel is 9,590,484 bytes, and the 200 MiB image preserves the accepted FAT data.
The 180-second IWAD observation reaches five game tics and renderer frame count one, with OPL audio generation active. No completed draw call is observed. The separate full-audio demo1 replay also fails its existing 1,200-second completion deadline and retains a later EHCI async-schedule error. Gameplay, timedemo, audio quality and save/load acceptance remain open. The allocator measurement is not a whole-game performance comparison. Normal ownership remains 447 CupidBuild and five Python actions, with installed seeds unchanged. See ADR 0425 and the runtime record.
ed8eed3b adds a bounded coordinator request for reusing an explicitly selected seed release. It validates the complete record against independent reviewed pins and requires both staged Linux tool sets to match the six reviewed images exactly. Wrong tools, plans, membership, selection, format or live release bytes fail before fixture materialization. The existing runner carries and rechecks the release through real child execution.
The ordinary publication's provenance rejection is reproduced in the unchanged SDK helper in 0.397 seconds. Supplying the reviewed release makes the real helper pass. The new boundary selection passes 37 methods per host, with two declared POSIX skips on Windows. Real unchanged helper probes pass through the new API on both hosts and reject a changed staged tool. They preserve the actual 81-input source inventory alongside the reviewed 82-input seed provenance; these fixtures reuse qualified images rather than proving fresh SDK-generated stages.
The updated 155,616-byte manual passes an incremental Cupid-only kernel/image build, all sixteen artifact checks, the complete three-root audit and a strict private four-CPU max/e1000 boot with completed ls. Only its wrapped object changes among 429 objects. The raw kernel measures 9,588,404 bytes; only that exact policy row changes. Compiler inputs, installed seeds and FAT contents stay unchanged. Failed collectors and independent recovery remain documented in the bootstrap log.
The SDK production path still needs explicit release propagation, capture of the coordinator and pin-validator dependencies, and observations retained through final publication. Its current 92-input inventory and native stage comparisons remain unchanged. Public ownership stays 447 CupidBuild and five Python actions; ordinary publication, seed installation and the native ABI recipe handoff remain pending. See ADR 0418.
e44c5eac
preserves the drive colon in entries such as
C:/Cupid assets/freedoom1.wad:/wads/freedoom1.wad. Both image and standalone
staging use the corrected parser. Eight positive and negative methods include
a real Unicode host source, independent FAT payload inspection and rejection
before image writes. Both complete host-build selections pass 98 methods.
A fresh absolute-path IWAD replay reproduces the entire accepted relative-path
staged image.
The corrected 154,880-byte embedded manual passes incremental Cupid-only build
acceptance. Only its wrapped object changes among 429 objects. The raw kernel
is 9,587,668 bytes; only that exact policy row changes. All sixteen artifact
checks, the complete source audit and a private four-CPU max/e1000 boot with
completed ls pass. Existing FAT contents are preserved, and the base image
remains unchanged through the boot. This reuses the earlier complete C/assembly
build and the older installed seeds.
All four new-parent default/long consumption qualifications pass independent verification. Ordinary publication first reaches a frontend deadline, then its retry fails at checked-runner fixed-point provenance. Seed installation and the native ABI recipe remain pending at 447 CupidBuild and five Python actions. The separate Doom probe proves no rendered frame. See the runtime evidence and limits and the bootstrap log.
9e566013 adds CUPMAN5 author and CUPMAN6 verification requests after shared-reader validation of the selected Linux seed. The captured manifest, supported plan and six image identities remove historical release pins from the production policy path. CUPMAN4 and CUPMAN2 keep their historical checks. Publication schemas, inventories and all sixty-nine raw comparisons remain unchanged. See ADR 0417.
The source checkpoint passes 163 test methods per host, with three POSIX skips on Windows, and direct policy probes built with the qualified candidate tools. Incremental manual acceptance embeds 154,351 bytes, measures a 9,587,136-byte raw kernel, passes all sixteen artifact checks and publishes the image with host code producers forbidden. The strict private four-CPU max/e1000 smoke completes ls and leaves all artifacts and the base image unchanged. This acceptance reuses the earlier complete C/assembly build.
Both complete f6a8b6dd producer qualifications and independent source/artifact rereads pass: 243 stage files, 81 final-stage pairs and the complete ABI behavior gate on each host. The new-parent default Windows preparation also passes. The first Windows long-path and both Linux preparations hit the unchanged 360-second frontend timeout with four preparations and a kernel build active. Failures remain retained; reduced-concurrency diagnosis and retries are pending. Installed seeds and ownership remain 447 CupidBuild and five Python actions across 452 transforms. Release consumption, full hosted publication acceptance, installation and the native ABI recipe handoff remain required.
f6a8b6dd fixes Linux qualification fixtures that retained the 27-source parent plan while the ABI release required 29 sources. Authorization now retains immutable candidate-plan bytes. Materialization checks their release-bound digest before publication and preserves parent lineage, tool images and release payload. Windows execution manifests keep their existing layout.
The actual prepared Linux tools reproduce the failure, pass after changing
only the fixture plan, then pass the complete checked-runner helper with the
fix. Both host release test selections and sixteen related behavior tests per
host pass. Incremental installed-seed acceptance embeds the 153,587-byte manual,
checks all sixteen exact artifacts, publishes the image and passes the private
four-CPU max/e1000 smoke with completed ls. The raw kernel measures 9,586,372
bytes. This reuses the earlier complete C/assembly build.
Fresh committed captures contain 1,584 files per host and the unchanged 82-input compiler snapshot. Independent source, plan, parent and artifact rereads permit reuse of the unqualified 819cb3d4 preparations: 243 stage files and 81 final-stage pairs. Fresh complete qualification is running on both hosts with a new caller-owned release record. Consumption, installation and the default native ABI Make handoff remain pending. Ownership stays at 447 CupidBuild actions and five Python actions across 452 transforms.
819cb3d4 separates artifact policy from an older manifest parser that stopped at 78 inputs. CupidBuild validates the release-bound pair, supported plans and all twelve actual ELF32/PE32 images through the shared readers, then submits captured sizes and digests through CUPSIZE3. The policy checks all sixteen artifact paths, owners and exact sizes. CUPSIZE2 keeps its historical checks. New reviewed parent tuples require no added hashes in C source. The caller still owns release authority and observation lifetime.
The source selections contain 96 methods per host. Windows executes 95 with one POSIX skip; Linux passes all 96 across closed groups and retries. Fresh Cupid-built dispatchers accept the 82-input fixtures and reject wrong release, plan, target and image claims. Synthetic claims are verifier fixtures.
The fresh Windows kernel build passes with host code-producing tools forbidden.
The embedded manual adds 1,008 raw-kernel bytes. Only the measured raw row
changes to 9,586,032; all sixteen artifact checks then pass. Make image
publication consumes the freshly built kernel/boot outputs through four
explicit old-target options. A strict private four-CPU max/e1000 boot and
completed ls check pass, with base image and artifacts unchanged afterward.
See the interface and acceptance scope.
Windows complete qualification passes the earlier frozen 30598dd1 ABI source with 60 success, 54 failure and seven help cases. Linux's unchanged-timeout retry remains in progress. Those sources do not qualify the changed policy bytes. Fresh committed paired producer and consumption proofs are required before installation. The explicit private ABI Make preview passes on both hosts and preserves all six accepted user outputs through rejection/recovery. Installed ownership remains 447 CupidBuild and five Python actions across 452 transforms; the pending shared ABI handoff would leave 448 and four.
Both complete bootstrap matrices require the native verify-user-abi --root ROOT command in stage three and stage four. Each generation runs eleven
positive and eleven negative cases. The gate compares the complete independent
oracle report, tests Unicode paths and escaped literals, rejects semantic and
input drift, checks invalid arguments, and requires recovery after failures.
It retains the six declaration identities, executable hashes and case results,
and checks that each command preserves its input tree.
The Linux matrix requires 73 success, 66 failure and seven help cases. Native Windows requires 60 success, 54 failure and seven help cases. Fresh command builds pass on both hosts, as do all 262 fixed-point audit mutation cases. Supplemental checks on retained final-stage tools pass all 44 ABI calls per host. These checks do not replace a fresh complete paired release qualification.
The implementation is committed in 30598dd1. ADR 0414 keeps behavior fixtures separate from compiler producer snapshots. Installed seeds and the normal ABI recipe retain their current roles. Ownership remains 447 CupidBuild actions and five Python actions across 452 transforms. The five Python actions are the shared ABI gate, disk/ISO publication and the two hosted contract actions. Three user compilations depend on the one ABI gate; those edges are not separate actions.
Source-head CupidBuild provides verify-user-abi --root ROOT. It observes the
six syscall ABI sources and their ancestors, validates the captured bytes,
rechecks those observations, and closes them before emitting JSON. The
standalone ABI contract uses the same semantic module. Both check version 5,
103 fields, 412 table bytes, both VFS layouts, scalar and socket constants,
and all 101 providers.
The memory API borrows bounded UTF-8 spans without trailing NUL bytes. Calls share no mutable state; failures clear the report. The command creates no files, locks or child processes. POSIX roots accept dot and repeated slash components and reject parent components to preserve ancestor checks. Source rechecks are sequential, so they do not imply an atomic filesystem snapshot. Incomplete string and character literals fail, including an escaped final quote. Well-formed escaped literals remain valid.
Fresh command builds use checked CupidC, CupidASM and CupidLD on Windows and Linux. Allocation, malformed-input, source-drift, close-failure and concurrent call tests cover the shared module and its filesystem coordinator. The final selection executes all 41 methods on Linux and 40 on Windows, with one POSIX-only Windows skip. The forced normal Windows user build also passes and retains the same complete ABI report. ADR 0413 records the ownership boundary.
Checks across three staged CupidBuild executables per host pass all 66 ABI commands. Complete reports match the independent oracle; incomplete literals and a missing input fail without success output, and every repair succeeds. The original inputs and staged executable bytes stay unchanged.
Windows long/alias preparation passes with 82 captured sources, 135 staged artifacts and 45 equal final-stage pairs. Its actual staged CupidBuild rejects the changed parent through the original provenance check. This preparation remains unqualified and contains no complete bootstrap report.
The complete Linux bootstrap passes with 29 C objects, one startup object and six tools in each of three stages. All 36 final-stage pairs match, and both final generations pass 62 success, 55 failure and seven help cases plus the Windows runtime bridge checks. Independent verification rehashes all 81 compiler inputs and 108 stage artifacts. This uses the installed Linux seed; a paired release remains required for promotion.
Removing one extra blank line at the validator's end of file preserves its recorded 79,452-byte object with all eight installed and staged compilers. The frozen bootstrap reports retain their earlier input hashes. Seed promotion still requires fresh qualification from the committed source.
The source audit records both native fault probes as host test fixtures. Its active inventory stays at 770 sources and 452 transforms; the unreachable inventory contains 43 files. The probes do not count as production migration.
The candidate has 29 C objects and four exact UTF-8 Windows profiles with 80, 81 or 82 source inputs. Installed seeds and the normal Python ABI gate retain their current roles. Ownership remains 447 CupidBuild actions and five Python actions across 452 transforms. A paired release and the Make recipe handoff remain required.
The normal Windows OS replay passes with host C/ASM tools forbidden and all sixteen exact artifact checks satisfied. Its complete embedded manual is 152,237 bytes; the measured raw kernel is 9,585,024 bytes. Only the three changed kernel size-policy rows are updated.
A strict private-image max/e1000 four-CPU boot passes the SMP, FPU, RDRAND,
62-check crypto and DHCP contract, reaches the desktop and Terminal, and
completes ls. The original 200 MiB image stays unchanged, with SHA-256
738742dc1060dff777f36f3cc4dc43e6c092a5ceaa47d1737cb299c460c79e87.
The normal image replay preserves existing FAT data. This result covers the
Windows normal build and boot; paired Linux OS and full Doom runtime acceptance
remain separate qualifications.
Shared CupidC accepts C11 _Static_assert declarations in function compounds.
Lexical names and target layout determine the result. Successful checks add no
runtime code; introduced enum names remain scoped to their block. Checked
production seeds and build ownership are unchanged.
ADR 0412 records the frontend and object contracts.
The shared IR also passes strict GCC compilation after a postfix validation
change that preserves floating update bytes and behavior.
The local receipts under
build/bootstrap/native-profile-validation-258bb5f3/ were deleted.
Earlier dated sections record results observed at the time; their named
receipts are now unavailable. The saved staged source and both complete LFS
assets have been recovered and checked against the surviving source export.
Replacement image, forced-user and strict four-CPU runtime qualification now
passes on both hosts, with an independent paired comparison. The new runs
reuse observed surviving generated files and objects; they do not qualify a
fresh clean kernel or complete six-tool bootstrap. See
the recovery and qualification scope.
Normal Make now uses the paired cfd9f140 release and native CupidBuild for all
three default user links. The graph retains 452 transforms, with 447 CupidBuild
actions and five Python actions. Custom address spellings keep their existing
numeric override path.
The terminal completion message now uses the existing serial formatter.
Five deterministic POSIX checks pass, and all eight new strict four-CPU boots
pass on native Windows and Linux. The paired gate compares 1,567 source files,
431 production inputs, all sixteen artifacts, complete ABI, user objects and
executables, and the settled embedded manual. Both fresh 200 MiB images have
SHA-256 151145dbb680bf9ee256f018bcbf788b58dddfdc2d041c936cfcc6602d19e1b9.
The selected suites pass 577 executions with five named Windows pthread skips.
The exact raw-kernel policy remains 9,583,576 bytes. Full Doom acceptance
remains open.
See the implementation and qualification status.
The private persistent-image suffix primitive also passes native large-disk tests and fresh Cupid-built small-case tests on both hosts. A real FAT file and disk tail survive publication with each allocation below 16 MiB. Checked large-disk tests and a guarded image coordinator remain required; the normal image action stays with Python.
The proposed cfd9f140 seeds pass complete release-aware self-consumption on
native Windows and Linux for both default and long-file profiles. Independent
acceptance checks 228 stage artifacts and 76 final-stage pairs for default,
or 231 artifacts and 77 pairs for long. Each profile retains 7,300 behavior
files. Both terminal review axes pass. The bootstrap guide records source, preparation,
parent, plan, release and final file/directory checks.
The first Windows long failure remains preserved. Its targeted replay passes, and a fresh full retry completes successfully. The independent long verifier binds Windows v260 and Linux v236. Windows retains 612 resource observations without sampling errors, with minimum free space 1,169,780,736 bytes. These observations do not identify the earlier failure's cause.
Installed seeds remain 78e71bd6; normal ownership remains 444 CupidBuild
actions and eight Python actions across 452 transforms, including three user
links. Isolated adoption candidates pass both 129-method audit suites. Normal
Windows Make matches the complete 103-field, 101-provider, 412-byte user ABI
and all three accepted user objects/executables. Full seed/provenance suites,
Linux publication/users and normal OS image/runtime adoption remain required.
The embedded manual and policy update belongs with that implementation and
fresh OS validation. Full Doom gameplay, audio, save/load, reboot and performance
acceptance remains open. TempleOS is read-only reference material.
The proposed cfd9f140 seeds pass complete release-aware default qualification
on native Windows and Linux. Independent acceptance rereads 228 stage artifacts,
76 final-stage pairs and 7,300 behavior files, together with source captures,
Git indexes, preparations and exact file/directory membership. Linux passes
62 success, 55 failure and seven help cases; Windows passes 49 success, 43 failure
and seven help cases. The bootstrap guide records
the evidence and remaining gates.
Long consumption remains separate. Linux completes its long qualification; the first Windows run fails during production behavior with a checked-tool digest diagnostic. A retained replay of that operation passes fourteen positive and ten negative calls. The replay does not identify the earlier failure's cause. A fresh Windows retry and the paired independent long check remain due.
Installed seeds remain 78e71bd6; normal ownership remains 444 CupidBuild
actions and eight Python actions across 452 transforms, including three user
links. Proposed seed installation and native user-link recipes still require
the canonical audit, provenance regressions, normal Make, ABI, user, publication,
OS image and runtime gates. Full Doom gameplay, audio, save/load, reboot and
performance acceptance remains open. TempleOS is reference material.
Commit 06aafd8b records the committed
cfd9f140 producer proofs and the remaining new-parent qualification. All four
native/profile producer runs from that committed source pass with the installed
78e71bd6 parents. They retain all 1,564 captured source files and the 77-input
default or 78-input long producer closure.
The proposed cfd9f140 parent pair has four complete staged preparations.
Independent checks compare 76 default or 77 long final-stage pairs, and separate
authors create twelve-tool release candidates from those exact bytes. These
new-parent candidates remain unqualified; results obtained with the installed
parents cannot establish their behavior.
The private projected Make audit passes seventeen queries and ten contracts. Qualification preflights pass fifteen positives per host and 63 Windows or 65 Linux rejections. The independent acceptance verifier passes ten metadata and inventory positives and 112 rejections. Its explicitly named metadata fixtures and older report summaries establish readiness only.
The first fresh Linux default qualification fails at profile-behavior setup:
the 100-control execution projection lacks the drivers include root. The
closed failed run and its final diagnostic remain preserved. Complete behavior
execution also requires the original kernel, driver and Doom source/header
tree. Fresh complete roots and qualification runs are still required.
Installed seeds remain 78e71bd6. Ownership remains 444 CupidBuild actions and
eight Python actions across 452 transforms, including three Python user links.
Installation and recipe adoption require the canonical audit and normal Make,
ABI, users, publication and OS/runtime checks. The
release-context guide
separates the accepted evidence from those remaining steps.
Commit cfd9f140 adds release-aware CupidBuild operations and
the --seed-release option. A caller-reviewed paired release lets a new
producer validate its actual parent manifests without embedding the completed
manifest hashes into its own source. Original C request layouts and strict
entry points retain their historical rules. Transactions capture the release
with bounded reads, reserve the complete input closure and recheck identities
before publication. Linux rejects FIFO inputs without waiting for a writer.
python -m tools.bootstrap_stage_release separates preparation, release
authoring and full qualification. Preparation retains three stages and an
explicitly unqualified receipt. Authoring checks both hosts' sources, plans,
actual parents and twelve prepared tools. Qualification rebuilds every stage,
matches all prepared objects and tools, then runs complete behavior checks.
The release remains caller-selected review evidence.
Both default and long-file profiles pass complete staged qualification on Windows and Linux. Independent checks cover 228 default or 231 long-profile artifacts, 76 or 77 matching final-stage pairs, and 7,300 behavior files per profile. The broader 580-method selection on each host executes 1,129 tests with 31 platform skips. Ordinary Linux publications and their native Windows consumption also pass.
Both normal OS builds pass with host C/ASM tools forbidden. Paired independent
checks cover 1,564 source inputs per host, 431 production ELF inputs and sixteen
artifacts. The 68,681-byte manual is embedded in both 9,581,716-byte raw kernels;
pass-one and final kernels are 9,679,292 and 9,810,364 bytes. Both 200 MiB images
have SHA-256
f7fbd52ee59cb1b92914a55e745d22baface5dc723ab28d5974edffff88f8b91.
Complete user ABI checks and paired objects and executables pass. All eight
private four-CPU max/e1000 boots pass the kernel/disassembly/shell/SMP checks
and separate cat, hello and ls runs. Canonical audits and four conditional
checks per host pass. The bootstrap log preserves failed collectors and setup
attempts beside the separate acceptance records.
Installed seeds remain 78e71bd6. Production ownership remains 444 CupidBuild
and eight Python actions, including three user links. Fresh producer proofs
from this committed source are required before installing new seeds or
adopting the link recipes. Checked deterministic release drift, serial record
atomicity and full Doom gameplay, audio, save/load, reboot and performance
acceptance remain open. TempleOS/ remains reference material.
The release workflow gives the preparation and qualification commands. ADR 0411 records the release and transaction checks.
Commit c05c287e adds the alias-aware cupidbuild link-user command.
Source-built CupidBuild resolves existing repository and parent aliases for the
approved cat, hello and ls objects, retains the physical directory chain and
freezes the object and six-tool cohort. Checked CupidLD and CupidDis, the loader
validator and live identity checks must all pass before publication. Equal
executable bytes preserve timestamps. Missing parents, escaping aliases and
linked or nonregular leaves are rejected. Windows requires a drive-rooted
canonical path; UNC roots remain unsupported.
Both hosts complete the 477-method regressions and the native/checked resolver, operation and command tests. Independent qualification rereads 1,558 source inputs per host, sixteen exact artifacts and 431 matching link inputs. Both normal OS builds forbid host C/ASM tools and retain the preceding user binaries. Both hosts pass their platform ABI check, kernel/disassembler smoke and three separate external-program boots. All eight private four-CPU max/e1000 boots validate SMP runtime and preserve their base or staged images.
The 66,594-byte manual is embedded in both 9,579,628-byte raw kernels. Both
200 MiB images have SHA-256
a9c44748cff1c04339c4d2c6f62b117e404fb98874d4bfddd61a374e1f346ed4.
Linux passes both complete publications with 90 controls, 77 default or 78
long-profile producer inputs, 22 artifacts and 67 matching pairs each. The
source log retains failed fixtures, size-policy rejection and the first
Windows kernel setup failure; the setup failure's cause remains unconfirmed.
Installed seeds remain 78e71bd6, with ownership at 444 CupidBuild/eight Python
actions. The three normal user links still use Python. Committed producer proof,
new seed carriage and recipe adoption remain separate acceptance steps. Serial
record atomicity and full Doom runtime acceptance remain open.
Alias resolution and the command record describe the implementation, limits and qualified evidence.
Commit 77a114a0 integrates the physical
cupidbuild_link_user_object API. It retains an existing output-parent chain,
freezes the approved object and six-tool cohort, runs checked CupidLD and
CupidDis, validates the user ELF and publishes through the guarded transaction.
CupidLD accepts one caller-owned output flag; ordinary invocation retains its
atomic publisher. Equal validated executable bytes preserve timestamps.
Both hosts pass 172 native methods, fourteen checked link methods, 57 checked
observer methods and sixteen user compiler methods. Corrected conditional
audit fixtures pass their affected methods and all 39 native and 39 checked
preprocessor methods. Both normal OS builds forbid host code-producing tools.
Final independent verification rereads 1,549 inputs per host, sixteen artifacts,
431 link inputs, unchanged user executables and eight private four-CPU boots.
Both hosts pass the platform ABI, kernel/disassembly/shell/SMP smoke and separate
cat, hello and ls boots. Base and staged images remain unchanged.
The 65,853-byte manual is embedded in both kernels. Raw kernels are
9,578,888 bytes; pass-one and final ELFs are 9,675,196 and 9,806,268 bytes.
Both 200 MiB images have SHA-256
784d906d6a122e7a600a0a8a1fe0022e7cfa7a291f959605c0898f37d25a80db.
Linux passes complete default and long-profile publications with 89 control
inputs, 76 or 77 producer inputs, 22 artifacts and 67 matching contract pairs.
The source record retains the stale-fixture and evidence-wrapper failures.
The installed seeds remain 78e71bd6, and production ownership remains 444
CupidBuild/eight Python actions. The three normal user links still use Python.
Alias resolution, CLI exposure, new checked seeds and recipe adoption remain
separate acceptance steps. Serial record atomicity and full Doom gameplay,
audio, save/load, reboot and performance acceptance remain open.
The source record binds the implementation and final evidence.
Commit 1440d33f installs the paired 78e71bd6 seeds and direct CupidBuild
recipes for cat, hello and ls objects. Production ownership is 444
CupidBuild and eight Python actions across 452 transforms. Both installed hosts
pass the five focused ownership methods and complete generated audit check;
the 77-input producer snapshot remains unchanged.
Linux and Windows pass final normal Make builds with host code-producing tools
forbidden. Independent paired verification rereads 1,547 captured inputs per
host, sixteen artifacts and 431 link inputs. Complete publications also match
their 89 inputs, 77 producer inputs and 22 artifacts. Both hosts pass the user
ABI and artifact gates, private four-CPU kernel/disassembly/shell/SMP checks,
and separate boots for all three external programs with PID-bound output and
process-exit checks. Both 200 MiB images have SHA-256
e1ea00d86c9aa3ab083931fc72ef2e6362c2f5445aaf6d379ac6280a93b0e56a
and remain unchanged through acceptance.
The settled manual is 65,057 bytes. Paired measurements establish the 9,578,092-byte raw kernel before its policy row changes by 340 bytes. Earlier replays reject the old size before image publication. Only the manual object and two kernel ELFs differ from the preceding accepted link cohort; the other 428 link inputs retain their bytes. The handoff record and proof record retain the completed evidence and failed attempts.
Python still coordinates three user links, two image publications, user syscall
ABI and Toolchain manifest verification, and one Toolchain build/manifest
publication. Full Doom gameplay, audio quality, save/load, reboot and performance
acceptance remain open, along with serial record atomicity and long Windows
child working directories. TempleOS/ remains outside builds and metrics.
Source-head compile-user captures each approved example with user/cupid.h
in a closed two-record bundle. It retains the fixed freestanding profile,
configurable output parents, source/output binding and the guarded publication
checks. Native and CupidC-built coordinators reproduce all three real objects
on both hosts. Long Windows repository arguments launch from a short directory.
Seventeen staged-helper and related methods pass on each host. The helper checks the three sources, logical filenames, lexical aliases, unchanged timestamps, eight failures and recovery. Checked readers also pass the next exact parent tuple: 1,367 manifest cases, fifteen pair cases and 320 policy requests per host. The complete sixteen-method caller suite also passes after integration, with thirteen unchanged source/test files bound before and after each host run.
The source step is committed as 78e71bd6. Both normal OS kernel targets and
images match, with sixteen artifacts, 431 link inputs and 1,544 source/control
inputs rechecked. The 64,715-byte manual produces a 9,577,752-byte raw kernel;
only that measured size row changes. Windows user and private four-CPU boot
checks pass and preserve the image. Linux's updated publication, user ABI gate
and final user/boot replay also pass. Both hosts retain identical images and
unchanged user executables.
Fresh native proofs from committed producer 78e71bd6 pass with the same
77-input snapshot. Linux matches 34 stage-three/four pairs and passes 55/7/62
failure/help/success groups; Windows matches 42 pairs and passes 43/7/49.
Independent verification checks all 1,544 root inputs and the committed
producer. The nineteen-path release preview passes independent manifest and
release author checks. Both long-profile consumers now pass, with independent
verification of every stage, committed inputs and agreement with the original
proved tool images. The complete default Windows consumer also passes its own
76-input plan and 41 equal stage-three/four pairs. A combined independent reread
checks all three consumers. Both proposed-seed regression roots
pass all 254 methods; Linux skips sixteen Windows-only cases and Windows skips
none. Independent rereads retain all 1,544 inputs in each root. Both fresh normal
make -j4 all builds pass with host code-producing tools forbidden. Their
sixteen artifacts, 431 link inputs and images match the accepted source replay.
New-seed publication, user ABI and runtime checks remain separate acceptance.
Windows's native closed ABI gate, three unchanged executables, sixteen artifact checks and private four-CPU disassembly/shell/SMP replay now also pass. An independent reread verifies the captured inputs, link cohort and unchanged image. Full Windows publication remains a separate promotion gate.
Both proposed contract publications exceed the unchanged 360-second stage-four frontend compiler deadline during concurrent build work. Single frontend replays pass in 329.777 seconds on Linux and 206.295 seconds on Windows; both produce the exact proved object with the unchanged compiler image. These failed publications remain recorded. The complete Linux retry passes its checked-seed bootstrap and continues through contracts. The Windows complete retry is now running after the heavier self/OS builds finish. Both retain the original deadlines. The proposed pair remains uninstalled.
The installed release and normal Make recipes remain unchanged. Seed carriage and paired Make handoff remain required. The isolated Windows handoff passes default, nested, lexical and accented directories, with all three objects and executables matching the Python wrappers and equal-object timestamps retained. Independent verification checks all 1,545 inputs and outputs. Each Windows external program also passes a separate private four-CPU boot, its PID-bound output/process-exit predicate and the complete SMP verifier. The images remain unchanged. Earlier private launchers expose split serial terminal markers; serial record atomicity remains open. The corrected complete audits pass all 131 methods on each host, with five identical unchanged files independently rechecked. Linux's four-path Make handoff and all three private external runtime boots now also pass. Paired verification matches all user objects and executables, unchanged timestamps and staged/base image identities. The complete Linux publication retry passes build and verification with the original limits; independent verification checks 89 inputs, 77 producer inputs and 22 artifacts. Its completed publication supplies the Linux OS and handoff ABI checks. Both hosts' OS/artifact/private-boot records independently match. Windows full publication, seed installation, active recipe adoption and final embedded-manual replay remain required. The repository proof record retains exact identities and failed setup records. Ownership stays at 441 CupidBuild actions and eleven Python actions. The three user links and full Doom runtime gate remain separate work. The source record retains tests, failed approaches and Linux recovery evidence.
The checked Linux and Windows six-tool seeds now come from 8403b0a8 and the
same 77-input source snapshot. Both native fixed points and both long-profile
self-bootstrap proofs pass. The complete default 76-input Windows bootstrap
also passes with its own exact plan. Independent verification binds the
committed closure, captured parents and every staged artifact.
Both hosts pass the complete OS build, the three unchanged user programs, sixteen artifact checks and private four-CPU disassembly/shell/SMP smoke. Their 431 link inputs and images match. The corrected Linux ABI recipe produces a fresh publication; native Windows verifies its current 89 inputs, 77 producer inputs and 22 artifacts. The reviewed nineteen-path release is installed. The final embedded-manual replay has its own acceptance record.
The final 63,444-byte manual produces matching 9,576,480-byte raw kernels and
9,806,268-byte final ELFs. Native checks reject both obsolete policy values
before their measured rows change. Both final user/artifact/private-boot
replays pass and preserve the images. Final image SHA-256 is
af2a2c537facca3aa5ac4a38af47685f82873e6c58a960c24a979621893b3165.
The installed regression selection passes 253 methods, followed by twenty-five
manifest methods with explicit historical fixtures.
The final 79-method manifest and size-policy replay passes after kernel size
calibration, with its captured inputs unchanged.
Ownership remains 441 CupidBuild actions and eleven Python actions. Native user compilation, links and full Doom runtime acceptance remain open. The repository release record retains exact identities, commands, failed harness attempts and evidence. The following entries retain their earlier checkpoint states.
The Linux user recipe now passes --windows-long-paths to its syscall ABI
operation. The API and CLI keep their default profile when this option is absent.
Windows retains the native contract path. Six new methods check dispatch,
non-Boolean rejection before execution, the recipe, reuse of an authenticated
89-input/77-producer publication, and live-input replacement. The initial four
fail before the change. All twenty ABI/profile methods pass on each host.
The first live-drift fixture expected the later ABI check's diagnostic; the
existing runner correctly rejects that replacement during contract execution.
The corrected fixture asserts that earlier rejection and preserves the report.
Both hosts also pass the 148-method driver selection and all 54 policy methods; Linux has sixteen expected driver skips. All 129 audit methods pass on both hosts. Linux runs without Git environment overrides. Driver, ABI and policy selections retain their separate passing records. The generated audit and current-source check pass. Ownership remains 441 CupidBuild actions and eleven Python actions. This selection repair does not move user compilation or linking into CupidBuild.
The 63,220-byte manual is embedded in a 9,576,256-byte raw kernel. Its first-pass
ELF is 9,675,196 bytes after a page-boundary increase; the final ELF remains
9,802,172 bytes. Size checks reject the obsolete raw and first-pass values before
those two policy rows are calibrated. The installed-seed Windows image build,
sixteen native artifact checks, three unchanged user programs and the private
four-CPU max/e1000 disassembly, shell and SMP smoke pass. Its source image is
unchanged through the smoke. All 241 compiler closures remain unchanged.
Its 431 link inputs and image match both final proposed-seed image builds;
proposed-seed Windows smoke also passes. Image SHA-256 is
ce64fd631010ff723af7840d77ace5eea3788cfe66be2be99a0ab7181ea21e83.
The ABI driver itself is a captured publication control input. Updating it correctly invalidates the earlier publication, even though the compiled C inputs are unchanged. A copied cohort is rejected rather than relabeled as current. A fresh complete Linux publication is rebuilding through the corrected user recipe. Its acceptance and final native Windows verification remain open. The earlier default-profile Linux user rebuild was stopped, and its unsuccessful record is retained. An acceptance harness also used an obsolete artifact-log suffix after its native check passed; the corrected Windows replay completes the smoke. These harness failures are separate from OS and contract failures.
Evidence is under build/bootstrap/native-profile-validation-258bb5f3/:
user-profile-red-windows-v1.log, user-abi-regressions-*-v3.log,
user-profile-regressions-*-v1.log, user-profile-policy-suite-*-v1.log,
fresh-audit-suite-windows-v1.log, user-profile-installed-os-acceptance-v1.json
and fresh-final-os-windows-acceptance-v5.json. The installed 5ba6ea24 seed
pair remains unchanged; reviewed preview v4 carries the settled size policy.
Its paired fixed points, self-consumption and default-profile bootstrap have
passed, but the preview stays separate until the remaining publication and
Linux user/boot checks pass. Full Doom runtime acceptance remains open.
The reviewed pair names producer 8403b0a82b5693409d2242fdbff32688c8f2cac5
and the 77-input snapshot
25b05a6cb0e824136db8df79b4e7f2e176aea88f0446be550f36ece04798bbf9.
Linux manifest SHA-256 is
84b8bef11969bac58d69e97baacd86d8f1b4aa030ecd25359bb1dcdb8f679cbc;
Windows manifest SHA-256 is
5d129b2575450dac756d75a4dc859501fdcd9bacf53190ed360ec66f68e21297.
The complete 5ba6ea24 pair remains their captured parent generation.
Fresh native proofs compare 42 Windows artifacts and 34 Linux artifacts per stage. Long-profile self-consumption passes on each host and reproduces all twelve proposed tools. The complete default Windows bootstrap also passes with its own 76-input closure and exact default plan. Independent checks bind the committed source, captured parents, actual executable formats and hashes, all three stages, behavior results, and all 1,540 frozen repository inputs. Default-profile output is checked against its own stage pairs; it is not claimed to equal the long-profile executable cohort.
Both complete fresh OS builds pass with host code-producing tools forbidden. All 431 link inputs, sixteen artifacts and the 209,715,200-byte image match across hosts. The first build contains the older captured manual and a 9,575,044-byte kernel. Its 428 other link inputs match the current installed-seed image; only the embedded manual object and two linked ELFs differ. Windows user-program, native artifact, disassembly, shell and SMP checks also pass. The final manual replay and publication acceptance are recorded separately.
The proposed-pair regression selection passes 208 methods per host, with sixteen expected Linux skips. CupidC-built policy readers pass 54 methods and 288 requests on each host. Profile fixtures now select default and long counts explicitly, including their different historical-parent rejection boundaries.
Evidence is under build/bootstrap/native-profile-validation-258bb5f3/:
fresh-native-both-proof-verification-v1.json, all three
fresh-consumer-verification-*-v1.json reports, paired
fresh-os-*-verification-v1.json, fresh-os-windows-acceptance-v1.json,
and fresh-regressions-*-v2.log. Production ownership remains 441 CupidBuild
actions and eleven Python actions. Native user compilation/link coordination
and complete Doom runtime acceptance remain open.
Publication and final-manual acceptance are still pending. The checked seeds remain unchanged until those records pass.
A proposed-seed regression run reaches 208 methods on each host. Both initial runs report two failures in one policy method: its fixture inherits the installed seed's source count and expects a generation-comparison diagnostic. With a 77-input seed, the reader correctly rejects the historical parent earlier, at the individual parent check. The narrow Linux reproduction takes 1.1 seconds of test time. Host-built and CupidC-built readers agree on all nine diagnostic probes, ruling out a compiler difference or malformed fixture digest.
The fixture now selects the default 76-input and long 77-input profiles
explicitly. It checks the default generation comparison and the long profile's
individual historical-parent rejection, with accepted baselines and recovery
after each negative request. Reader code and seed identities are unchanged.
Both CupidC-built readers pass all 54 policy methods and 288 requests against
the proposed pair. The corrected 208-method selection passes on both hosts;
Linux has sixteen expected skips. Evidence includes policy-parent-fixture-probes-v1.json,
fresh-native-policy-*-v2.json and fresh-regressions-*-v2.log under
build/bootstrap/native-profile-validation-258bb5f3/.
The 62,214-byte manual is embedded in a 9,575,248-byte kernel. An isolated
Windows image build, all sixteen artifact checks, three unchanged user binaries
and the private four-CPU max/e1000 disassembly, ls and SMP smoke pass. The
source image is unchanged by the smoke. All 241 compiler input closures remain
unchanged, including 83 Doom sources; only the manual object and two kernel ELFs
change among 431 link inputs. policy-fixture-windows-os-acceptance-v2.json
records this installed-seed replay. Proposed-seed OS acceptance remains separate.
Both native staged proofs pass from producer commit 8403b0a8, with the same
77-input snapshot 25b05a6cb0e824136db8df79b4e7f2e176aea88f0446be550f36ece04798bbf9.
Windows compares 36 objects and six tools per generation; Linux compares 28
objects and six tools. Every stage-three artifact equals stage four. Independent
verification checks all three stages, the named Git archive, captured parents
and 1,540 repository inputs. The fresh paired release preview passes its pinned
verifier and release author. It remains uninstalled while self-consumption,
complete default-profile compatibility, publication and OS acceptance run.
The audit now resolves a Windows linked worktree from WSL after native Git
rejects its drive-letter metadata path. It reads the existing link, converts
that path with wslpath, and supplies explicit Git metadata and worktree paths.
The top-level root must still match before tracked files are enumerated. Native
Git lookup, invalid-link fallback and listing errors retain their behavior.
Git metadata is unchanged, and untracked bootstrap fixtures remain outside the
tracked source inventory.
The minimized real probe fails before the change and passes afterward in
0.076 seconds. Four new methods cover tracked selection, unchanged link bytes,
invalid links and translations, missing conversion support, wrong-root rejection,
listing failure and native lookup. All eight selected methods, including the
original full CLI case and resolver ownership cases, pass on each host. Linux
runs without GIT_DIR or GIT_WORK_TREE overrides. The regenerated audit and
its independent check pass. An inline WSL probe first corrupted a regex during
argument transport; the file-based probe establishes the path diagnosis.
The updated manual is embedded in a 9,575,044-byte kernel. The isolated Windows
image build, all sixteen artifact checks, three unchanged user binaries and a
private four-CPU max/e1000 boot smoke pass. The smoke disassembles /bin/ls.cc,
runs ls and verifies SMP runtime behavior without changing the source image.
All 241 retained compiler input closures, including 83 Doom sources, remain
unchanged. Only the manual object and two linked kernel ELFs change among 431
link inputs. This replay uses the installed seeds; proposed-seed OS acceptance
remains a separate requirement.
The repository records evidence under build/bootstrap/native-profile-validation-258bb5f3/, including
fresh-native-both-proof-verification-v1.json, fresh-promotion-preview-v2/,
git-inventory-red-linux-v1.log, git-inventory-green-linux-v2.log and both
worktree-audit-regressions-*-v1.log files, plus
worktree-windows-os-acceptance-v2.json. Producer source and installed seed
identities remain unchanged by this audit repair. Ownership stays at 441
CupidBuild actions and eleven Python actions. Full Doom runtime acceptance
and native user compilation/link coordination remain open.
The shared manifest reader accepts the complete installed 5ba6ea24 parent
pair for the default 76-input profile as well as the explicit 77-input long
profile. Windows still requires the selected profile's exact plan and import
table. Linux shares one plan across these profiles; the reviewed release and
captured inventory bind the selected count and source digest.
The artifact-policy reader accepts the 77-input profile only with that complete current parent tuple. Its Windows record requires the exact long-profile plan and matching Linux candidate plan. The default 76-input record can also use the current parent tuple. Existing historical combinations retain their checks. The retained native coordinator separately validates release identity, actual manifest bytes, all twelve seed images and the sixteen artifact observations. The standalone policy API does not authenticate executable payloads.
Both hosts pass 164 regressions; Windows has four expected skips. CupidC-built shared readers match the host reference for 1,313 manifest and fifteen paired cases on each host. Cupid-built policy contracts pass 54 methods and 280 requests per host, including count, plan, mixed parent and recovery cases. An incrementally linked CupidBuild passes all sixteen actual artifact checks in both proposed 77-input OS roots. The previous binary rejects those same roots at the source count. Source captures and artifacts remain unchanged. This is verifier evidence; neither earlier failed OS build is relabeled as an accepted image.
Evidence is under build/bootstrap/native-profile-validation-258bb5f3/.
The three focused methods first failed, then passed after both native readers
were extended. The first Linux policy launch passed a Windows path spelling
through WSL and failed before executing the caller; the corrected POSIX spelling
passes. A default-profile metadata probe cannot establish that ordinary Windows
images have the correct default import table. Fresh staged proofs, the complete
default bootstrap path, self-consumption and OS acceptance from the new producer
revision remain required before promotion. The installed seed pins stay unchanged.
Both proposed seeds rebuild themselves with the explicit long profile. All six initial tools equal their stage-two outputs; every stage-three artifact equals stage four, and the final files equal the earlier paired proof. Independent verification checks the named 77-input producer closure and 1,540 source inputs per host. The Windows replay uses the corrected behavior-fixture lineage helper. The selected driver regressions pass 144 methods on each host, with sixteen expected Linux skips, against both installed and proposed seed cohorts.
The installed seeds also pass a separate incremental Windows OS replay of the
updated manual. Rechecks retain 241 compiler closures and their outputs,
including all 83 Doom objects, with unchanged source and producers. The manual,
both kernel links, symbol generation, flattening and image publication run again.
Only the manual object and two linked ELFs change in the recorded 431-input
cohort. Sixteen artifact checks, three unchanged user executables and the
private four-CPU max/e1000 disassembly, shell and SMP smoke pass. The manual's
60,531 bytes are present in its object, ELF and raw kernel. The kernel is
9,573,568 bytes; the 209,715,200-byte image has SHA-256
bda15e5128b6b740c104c6eb552c0da26a26f6ff663abc8ad27d8126245bb09e.
The source image remains unchanged after the smoke. Independent evidence is
build/bootstrap/long-profile-proofs-909d84ef/driver-independent-acceptance-v1.json.
The first replay incorrectly retained both linked kernels. Make returned success, but an independent byte check found that the raw kernel lacked the new manual. That run is rejected. Removing the linked kernels from the retained set rebuilt the links and exposed the expected size-policy mismatch. The policy now records the measured raw size, 1,036 bytes above the previous accepted image. The corrected build and independent checks pass. The installed seeds remain unchanged.
Promotion still needs two native checks fixed. The default 76-input Windows bootstrap fixture rejects the proposed release's parent tuple. Both clean OS builds with the proposed 77-input pair reach native artifact verification, which rejects their source input count. Independent verification matches the complete 431-input kernel cohort and raw kernel across hosts. Both builds fail and have no accepted image. The separate contract publication remains recorded by its durable state file. These failures must be resolved before installing a new paired release. Full Doom gameplay, audio, save/load, reboot and performance acceptance remains open.
Native Windows and Linux proofs pass from the installed 5ba6ea24 seeds.
Both capture the same 77 producer inputs at source revision
909d84ef66cd16210898057f842fe742e601bbd2, with snapshot SHA-256
a4656b38c82cd4e0acc2ba69328f8e4a1347aaaaa22e312957689ee12a989dd6.
Windows builds 36 objects and six tools in each generation; Linux builds 28
objects and six tools. Every stage-three artifact equals its stage-four result.
The Windows behavior matrix passes 35 failure, seven help and 42 success cases;
Linux passes 47 failure, seven help and 55 success cases.
Independent verification rehashes 1,540 captured source inputs, compares the
complete producer inventory with a Git archive of the named commit, validates
all three stages, and checks both reported seed parents. Evidence is under
build/bootstrap/long-profile-proofs-909d84ef/, including
native-both-proof-verification-v1.json. The proposed paired release passes its
pinned verifier and independent author. It remains a preview while seed
self-consumption, contract publication and OS acceptance run.
The repaired driver fixtures pass 143 methods on each host, with sixteen expected Linux skips. Named-commit checks translate Windows worktree links for WSL without editing Git metadata. Artifact assertions independently hash the reported files, while keeping exact import and behavior checks.
Both proposed seeds compile cat.cc, hello.cc and ls.cc through the current
wrapper at paths longer than 400 characters, including Unicode components and
lexical source aliases. Each object equals its short-path result and the prior
accepted object. Nine invalid output bindings per host fail. These are compiler
path checks; the closed native user transaction and its separate links remain
open. A direct Windows probe also rejects an inherited long working directory
with error 87. A short explicit child directory succeeds even when the parent
has a long working directory. Preserve the wrapper's short project-directory
launch and pass the private compiler root as an argument.
Source head now resolves lexical user source/output aliases and prepares a retained output directory chain. The transaction checks the full chain before lock acquisition and source capture, then at publication boundaries. Four focused caller configurations pass 49 methods each, including nested creation, UTF-8 names, long components, links, sibling jobs, parent replacement and unchanged-output publication. The seven-method lexical/ELF caller suites also pass on both hosts.
Native Windows file adapters now resolve long names once and pass extended
absolute paths to wide file APIs. A separate checked long-path profile adds
GetFullPathNameW to ordinary tool imports. Both native and checked CupidC pass
five real compiler cases: long source/output paths, lexical aliases, long and
relative roots, missing-source preservation and resolved device output. Long-path objects match the
short-path references. Checked adapter contracts pass on Windows and Linux;
they cover allocation failures, API errors and unchanged command text.
These capabilities have not transferred user recipes to CupidBuild. The installed seed profile remains pinned. Its original 310-character Windows compiler probe still fails; the new checked fixture fixes that case through a separate profile. The selected long profile now freezes and rechecks all 77 source inputs, including its resolver shim. Bootstrap CLI selection, shared manifest validation and contract publication now carry the exact profile. Promotion, closed user compilation and the separate user-link transaction remain open. Production ownership remains 441 CupidBuild and eleven Python actions. See the user compilation design and ADR 0409 for the contracts and remaining work.
Windows incremental OS acceptance passes after the manual update. The kernel is
9,572,532 bytes. Independent verification checks 1,540 source inputs, sixteen
artifacts and the 431-input code cohort. All three user executables match the
previous accepted bytes. The image contains the measured kernel, and the private
four-CPU max/e1000 smoke passes disassembly, shell completion and SMP checks
without changing the source image. Its SHA-256 is
5b155c56e4a0461b446d9a71385789a6afd96262b6ef031aa8b8ba46d87199a0.
Evidence is under build/bootstrap/long-path-profile-os-v1/. This is incremental Windows
acceptance; full Doom gameplay, audio, save/load, reboot and performance remain open.
The bootstrap and contract-publication drivers accept --windows-long-paths.
Both proof drivers capture the same selected 77-file producer inventory. The
Windows plan builds 32 C objects, four assembly objects and six tools; Linux
builds 27 C objects, startup and six tools. Default producer capture remains at
76 files. Publication captures 89 inputs, with a 116-file producer/publication
union for either mode.
The shared reader accepts count 77 only with the exact Windows plan digest and
the complete installed 5ba6ea24 parent tuple. Linux shares the existing plan
digest, so its count and parent distinguish the new profile. Windows image
validation has a distinct exact import table: ordinary tools gain one
GetFullPathNameW; publication and build tools retain their existing wide tables.
Historical profiles keep their count, plan, parent and import rules. Behavior
fixtures bind the actual captured execution and plan parents.
Publication authoring and verification admit either complete 76- or 77-file producer inventory. Only the latter contains the ordinary resolver shim. Live verification recaptures that inventory, and reuse requires the requested profile. Invalid selection fails before input or output preparation. Installed seed identities and production ownership remain unchanged.
Both hosts pass 259 profile/publication methods. Checked Cupid readers agree on
1,267 structural manifest cases and fourteen release/manifest pair cases; five
shared object pairs also match. The native Windows six-tool suite passes three
methods in 396.262 seconds and builds the complete checked long profile. Evidence
is under build/bootstrap/long-path-profile-v1/, including
paired-checked-reader-v1.json and the v3 profile/publication logs.
The selected driver rerun passes seventeen regressions on each host, with four expected Linux skips. The audit mutation corpus passes in 309.522 seconds. The generated graph has 765 active source inputs, 41 unreachable files and 452 transforms; ownership remains 441 CupidBuild actions and eleven Python actions.
Windows OS acceptance uses an isolated incremental build. All 83 fresh Doom
objects match the previous accepted objects; 156 retained kernel objects have
byte-identical source-specific closed inputs and the same installed producers.
The final manual is present in its object, ELF kernel and raw kernel. Sixteen
artifact checks and all three user programs pass. The private four-CPU max/e1000
smoke completes disassembly, ls and SMP runtime checks without changing the
source image. Independent rechecks cover 1,540 source inputs and 431 recorded
link inputs. The raw kernel is 9,572,532 bytes. The 209,715,200-byte image has
SHA-256 5b155c56e4a0461b446d9a71385789a6afd96262b6ef031aa8b8ba46d87199a0.
Evidence is under build/bootstrap/long-path-profile-os-v1/. This acceptance
uses the installed seeds and does not promote the new long-file profile.
Paired stage-three/four proofs pass; reviewed promotion and closed user compilation remain open. Long file names do not establish long process working-directory support. ADR 0410 records the profile boundary.
Production artifact verification now runs directly through the promoted CupidBuild command. Make passes both manifest selection options and waits for ISO publication before the verifier observes the repository. The audited graph has 441 CupidBuild actions and eleven Python actions across 452 transforms. Python still coordinates three user compilations, three user links, two image operations, two verification operations and hosted contract publication.
The corrected hosted inventory contains 412 active preprocessor cases. Fresh
publication verifies 22 artifacts and 67 stage pairs; all three hosted contracts
pass, including seven linked i386 executables. Independent paired OS verification
checks 1,534 captured sources, sixteen artifacts and 431 linker inputs per host.
Windows and Linux images and all three user programs match. Both private
four-CPU max/e1000 smokes pass disassembly, shell completion and SMP checks
without changing their source images. The kernel is 9,571,268 bytes; the image
SHA-256 is ef8b033647fd7d68ca4dbb54c01f500ce3c9b4efaf12c488b24cbf8b78254a23.
The retained reports are under
build/bootstrap/native-artifact-handoff-os-v2/: paired-os-acceptance-v3.json,
linux-promoted-hosted-verification-v3.json,
independent-publication-files-v3.json, graph-verification-v3.json and
paired-policy-regressions-v1.json. The graph suite covers 125 tests and policy
regressions cover 77 tests per host. Full Doom gameplay, audio, save/load, reboot
and performance acceptance remains outstanding.
The installed Linux and Windows seeds now carry selected execution-seed
verification from source commit 5ba6ea24fdef3b23c505551ab537688e681c9593.
Native verify-artifact-sizes accepts paired --checked-manifest and
--execution-manifest options while preserving its original API and command.
Windows requires its canonical execution cohort; Linux can retain a separate
copy of the reviewed six-tool cohort through the final drift check.
Fresh staged proofs match 41 Windows and 34 Linux outputs. Both promoted-seed self-bootstrap proofs reproduce all twelve installed tools. Promotion regressions pass 352 unique methods per host, with platform skips recorded separately. Checked callers pass 4,919 reader cases and 52 policy methods per host; installed artifact-verifier fixtures pass 40 Windows and 56 Linux cases across ASCII, accented, Japanese and emoji paths. All 28 converged Windows Unicode-path commands pass.
Linux publication verifies 22 artifacts, 88 publication inputs and 67 stage
pairs. All three hosted contracts pass independent verification, including seven
i386 executables. Both hosts produce the same 9,571,000-byte kernel with the
updated embedded manual. All 74 policy regression tests pass per host.
Independent paired OS acceptance checks 1,534 source inputs, sixteen artifacts
and 431 linker inputs per host. Images and all three user programs match.
Both private four-CPU max/e1000 smokes pass disassembly, shell completion and
SMP checks while preserving their source images. The image SHA-256 is
8ea7d8eabd6937ad71f5d2ec0ec1cdabf1ac649466a4fc8450f49b987d60ff81.
Production still uses the Python artifact verifier: 440 CupidBuild actions and twelve Python actions. The native Make handoff must pass both selection options and receive fresh graph and OS acceptance. Full Doom gameplay, audio, save/load, reboot and performance acceptance remains outstanding. See selected-seed evidence and limits for captured inputs, independent reports and remaining production work.
The preceding accepted manual update is recorded below.
The embedded CupidC manual now describes the installed 76-input seed pair,
native artifact verification, UTF-8 paths and the remaining production work.
Windows and Linux rebuilds produce identical kernels and disk images. The
updated text increases kernel.bin by 1,100 bytes to 9,570,572; the exact-size
policy records that measured result. All 73 policy regression tests pass on
each host. Independent acceptance verifies 1,533 source inputs, sixteen
artifacts, 431 link inputs and all three user programs. Both private four-CPU
max/e1000 smokes pass disassembly, shell completion and SMP checks while
preserving their source images. The current image SHA-256 is
df295c648d180247baa79670c0b7029de5fec8227abe2df260ff52c6187f00da.
Production ownership remains 440 CupidBuild and twelve Python actions. Full
Doom gameplay, audio, save/load and reboot acceptance remains outstanding.
Native verify-artifact-sizes passes source integration acceptance. It checks
the paired release and sixteen artifacts through retained read-only observations.
The plans contain 76 producer inputs and 88 publication inputs. Staged proofs
match 41 Windows and 34 Linux outputs; full publication matches 67 stage pairs
and verifies 22 artifacts. Hosted acceptance and both private four-CPU
max/e1000 disassembly, shell and SMP smokes pass. Independent paired verification
checks 1,533 source inputs, sixteen artifacts and 431 link inputs per host;
images and all three user programs match. ADR 0408 records the boundary and limits.
The installed Linux and Windows seed pair comes from accepted source
ec896462586597893dd197697ee3b68ce2c8e69b and its 76-input snapshot. Both
promoted-seed self-bootstrap proofs reproduce all twelve installed tools,
with 41 Windows and 34 Linux stage-three/four artifacts matching. All 28
converged Windows Unicode-path commands pass. Promotion regressions cover
345 unique methods per host, with platform skips recorded separately; checked
callers pass 4,901 reader cases and 51 policy methods per host.
Full publication verifies 22 artifacts, 88 publication inputs and 67 stage
pairs. Hosted acceptance passes three commands and checks seven resulting
i386 executables. Independent paired OS acceptance rehashes 1,533 sources,
sixteen artifacts and 431 link inputs per host. Images and all three user
programs match; both private four-CPU max/e1000 disassembly, shell and SMP
smokes pass without changing their source images. The image SHA-256 is
60743ecd68d29b13b7e63090f272f73cfffd14fe01772d273b10288a58b633d0.
The promoted CupidBuild carries native verify-artifact-sizes. Production
still invokes the Python verifier, so ownership remains 440 CupidBuild and
twelve Python actions. Switching that Make edge and its dependency audit is
the next implementation step. ADR 0408 describes the native operation.
The installed UTF-8 seed pair from accepted commit 72170b06 passes promotion
acceptance. Its 73 producer inputs match the reviewed snapshot. Both hosts pass
425 native regression and API methods, 4,801 checked reader cases and 48 checked
artifact-policy tests. Platform skips remain recorded. Fresh staged proofs
match all 39 Windows and 32 Linux artifact pairs and reproduce the installed
tools; all 28 converged Windows Unicode-path commands pass.
Full publication passes with 22 artifacts and 65 stage pairs. Independent
paired OS verification checks 1,525 source files, sixteen artifacts and 431
link inputs per host. Images and all three user programs match. Both private
four-CPU max/e1000 smokes pass disassembly, shell completion and SMP checks,
without changing their source images. The accepted image SHA-256 is
0faa80ca9d44fe8d32dda5c10fbfe8859e25ebb0543e547181b27af8187e7759.
Promotion exposed a second parent-generation check in the artifact-size reader. It now admits the exact conditional-assembly parent tuple and retains the two preceding tuples. Tests reject unknown identities, mixed fields and complete Windows parents from different generations. This reader is a publication input; the 73 producer inputs remain unchanged. Ownership stays at 440 CupidBuild and twelve Python participations.
The preceding source acceptance used 73 tool producer inputs and 87 Toolchain publication inputs, with the accepted 66-input seeds driving those builds. The corrected graph audit includes all eight startup files. A checked-Cupid preprocessor run passes 412 active source/profile cases, including the codec, all three Windows adapter roles and the wide runtime configuration. Both staged proofs pass independent byte verification, and all 28 converged Unicode-path commands pass. The updated publication passes all 65 stage pairs and its checked manifest verifier. Paired OS/runtime acceptance also passes independent verification of 1,525 source inputs, sixteen artifacts and 431 link inputs. Images and all three user programs match across hosts; both private four-CPU smokes preserve their source images. Seed promotion remains separate.
The UTF-8 promotion attempt exposed a missing parent generation in the shared manifest reader. The accepted conditional-assembly seeds are restored. The reader now recognizes their exact parent tuple; mixed revisions or manifests still fail. Both staged proofs and paired production acceptance cover this correction. Seed promotion remains separate. See ADR 0407.
The first source acceptance runs pass. A pre-commit check found CRLF bytes that Git would normalize when staged, so acceptance was repeated on canonical LF inputs. Paired staged proofs, the 28 Unicode-path commands, regression suites and paired kernel verification now pass on those inputs. Full publication and its checked manifest verifier also pass. Paired image/user/runtime acceptance passes independent verification. Images and user programs match across hosts; both private four-CPU smokes preserve their images. The completed first-run evidence is described below.
The current source candidate uses UTF-8 inside all six hosted tools and wide Windows APIs at command-line, filesystem and process boundaries. A shared codec rejects malformed UTF-8 or UTF-16. Native Windows builds use a wide entry point; Cupid-built tools select explicit startup files and exact imports for their role.
The candidate captures 73 bootstrap inputs and 87 publication inputs. Its Windows plan builds 30 C objects and three startup objects. Historical seed profiles retain separate validation. Adapter, command, observer and publication tests pass. Paired staged proofs, full publication and its checked manifest verifier pass. Paired OS/runtime acceptance also passes: images and user programs match across hosts, and private four-CPU disassembly/shell smokes preserve their source images. The installed release below is unchanged. See ADR 0406.
Commit 88bb2d26 promotes both six-tool seed sets from the canonical proofs
for e4f2ed65. Each proof records 66 source inputs. The Linux seed manifest
has SHA-256 da26556401dd20d039ed1175f3bf857c4c8bebd50fb52b3bd75a06b95fdf41ed;
the Windows manifest has SHA-256
c715ce354c28b97c6b9c4e5702c98d368d07dff9e52bc2f0deb71ab3194d2395.
CupidASM now carries %ifdef, %ifndef, %else and %endif through the
installed toolchain. The artifact-policy reader accepts this manifest
generation only with its corresponding Linux and Windows plan identities.
It continues to reject mixed plans and unsupported source counts.
Windows and Linux image and user builds pass, along with private four-CPU max/E1000 disassembly and shell smokes. Independent verification rehashes 1,501 source inputs, sixteen artifacts and 431 link inputs. Both hosts produce identical images and user programs. The committed-byte audit also verifies all 1,501 inputs, including the two Freedoom LFS payloads. The original failed regression and image reports remain in the bootstrap evidence history.
Ownership remains 440 CupidBuild and twelve Python participations. Artifact verification still uses Python coordination. Doom interactive gameplay, audio quality and persistence are unfinished runtime work.
The records below describe preceding releases and their acceptance evidence.
Artifact verification now captures bootstrap/seeds/release.json, a reviewed
record of both installed six-tool cohorts. Python checks its semantic identities
against the retained release pins before launching the Cupid contract and
rechecks the captured bytes afterward. The 26-input closure includes its helper
and Python package marker. Both hosts pass 104 related tests and real checked
verification of all sixteen artifacts. Final image/user builds and four-CPU
boot/disassembly/shell smokes pass on both hosts, with matching images unchanged
through runtime checks. ADR 0402 records the candidate-authoring and authority
rules. Native command ownership and installed seeds are unchanged.
The read-only filesystem observer passes 36 filesystem/runtime methods with native and Cupid-built callers on Windows and Linux. It retains original files and ancestors, verifies exact membership, supports Unicode paths and 64-bit metadata sizes, and rechecks captured payload hashes. Both candidate staged proofs, contract publication and paired OS/runtime acceptance pass independent verification. The final images match; all sixteen artifacts, three unchanged user executables and private four-CPU disassembly/shell smokes pass. Production verification still uses Python, and installed seeds remain unchanged. ADR 0401 records the implementation and its limits.
Source head exposes shared byte APIs for artifact-size policy, seed-image validation, either host's seed manifest, and a paired twelve-image release record. CupidBuild uses the shared manifest reader. The pair validator checks both manifests against the release and hashes the supplied Linux manifest bytes to verify the Windows plan binding. Release-file authority and retained filesystem observations remain separate requirements.
The ADR 0400 integration used 66 bootstrap inputs and 80 Toolchain publication inputs. Installed seeds then retained their verified 59-input generation. That integration passed 46 API methods, 107 publication/manifest methods, 148 CLI methods, and 4,694 checked byte cases per host. Both staged proofs pass: 32 Linux and 35 Windows artifact pairs match, with independently verified source and artifact bytes. Paired OS/runtime acceptance passes under ADR 0400: ABI validation, sixteen artifact checks, three user builds and private four-CPU disassembly and shell smokes. Independent comparison confirms matching outputs and images. The twelve remaining Python-coordinated operations have not moved.
The preceding ADR 0399 extraction passed paired staged proofs, normal OS builds,
all sixteen
artifact checks, user ABI validation, and three user builds. Private four-CPU
boots pass SMP checks, dis /bin/ls.cc, and ls. Independent checks confirm
matching kernel artifacts, generated objects, user executables, ABI reports,
and image bytes across Windows and Linux. The updated embedded manual is the
only changed kernel input object; its 884-byte growth is reflected in the
measured size policy. The bootstrap log retains the original size failures,
reconciled builds, and full acceptance evidence.
Make invokes checked cupidbuild compile-production for the three generated
installation tables. CupidObj still generates their source. Each compilation
captures its source and five headers in a closed six-record CUPSRC1 bundle:
drivers/serial.h, kernel/core/types.h, kernel/fs/homefs.h,
kernel/fs/ramfs.h, and kernel/fs/vfs.h. All five headers are Make
prerequisites for every table, including the two that previously omitted
homefs.h. The fixed kernel profile and 180-second compiler deadline remain
unchanged. Complete input checks precede reuse of an equal object, whose
timestamp is preserved. Failed transactions retain the previous output or
verified recovery evidence under the existing filesystem policy.
The 157 kernel-profile and 83 Doom recipes retain their checked native
coordinators. These 243 compiler roots already use .cc. The handoff changes
coordination without changing their language, arguments, or installed content.
Both checked six-tool cohorts come from source
142a9737f618ab8500308576a1c222501d639e5f and the same 59-input snapshot
2346284239faf9f5571223587f2e2b2dfdd5197cffd41b97a12e234386810695.
Clean proofs match all 29 Linux and 32 native Windows stage-three/stage-four
artifact pairs. Linux passes 46 failure, seven help, and 54 success groups;
Windows passes 34 failure, seven help, and 41 success groups. Each coordinator
uses its own generation's complete tool cohort. Independent promotion checks
bind the source inventory to the commit and verify stage membership and bytes,
executable formats, build plans, parent lineage, and the proposed seed pair.
The report checks reject ten altered Linux reports and thirteen Windows reports.
The promoted tools also carry the shared decoder initialization change from ADR 0398. Candidate records are initialized after early rejection checks and before decoded fields are written. Catalogue order, aliases, classifications, and public-result initialization remain unchanged. CupidBuild carries the in-memory user ELF validator, but the three user links still use their Python transaction. Native path handling, input capture, inspection, and publication remain required before that handoff.
The Linux manifest has SHA-256 7eeb40dcb6a66fbd6f3e5cc1798695d5b2895c8e1f693451684a9864f1733b52;
the Windows manifest has SHA-256 2d2cb287d90dd942b95629472e72f74013d8fcc4da64187fe87c0bcd0973cccd.
The build-graph audit records 440 CupidBuild and 12 Python participations across 452 transforms. Python still coordinates three user compilations, three user links, two image publications, three verification operations (artifact sizes, user syscall ABI, and the Toolchain manifest), and one Toolchain build/manifest publication. Make and host operating-system services remain required. GCC, NASM, and host linkers are absent from the normal code-producing path.
User compilation must retain configurable BUILD directories, safe creation
of missing parents, and existing pathname support. A failed proof under a long
Windows checkout reproduced a pre-existing native compiler path limit with the
preceding checked seed: a 237-character output path succeeded and a
276-character path failed. The complete retry uses a shorter checkout without
changing source, tests, or deadlines. This workaround does not fix the compiler
limit; the user-compilation plan records the remaining work.
Both hosts pass normal OS builds, all sixteen artifact-size checks, the
generated-install replay, user syscall ABI checks, and all three user builds.
Private four-CPU boots pass SMP runtime checks, dis /bin/ls.cc, and ls
without changing the source images. Independent post-run checks verify 448
artifacts and 478 control files per host. Kernel files, generated objects, and
user executables match across hosts. The bootstrap log records these production
and runtime results separately from the fixed-point proofs.
Fixed-point convergence, production replay, and runtime acceptance remain
separate checks. IWAD-backed Doom gameplay acceptance remains open.
TempleOS/ remains read-only reference material and is excluded from builds
and progress counts.
Committed source 16a86f5b runs anonymous POSIX publication tools from the
retained /proc directory; generic checked commands keep their requested
working directory. This keeps relative writes by typed author and inspection
calls away from the repository. It is not a process sandbox. ADR 0389 records
the launch boundary.
On WSL Windows-mounted filesystems, a concurrent parent-directory replacement
can invalidate retained relative lookup. CupidBuild rejects the publication
and preserves the verified old file and transaction evidence when it cannot
restore the old output safely. Foreign files remain untouched. Native Linux
filesystems with stable lookup still require exact restoration. ADR 0388
records this recovery limit; /mnt/c remains a supported build location.
Recovery inspection must preserve the displaced directory, its
.cupidbuild-old-* backup, and transaction files. Stop concurrent writers and
verify the regular, non-symlink backup against the known old output before
manual restoration. The replacement public directory may belong to the
concurrent writer; a matching backup name does not establish safe recovery.
The committed Windows repair passes short private filenames to the
disassembler during whole-kernel inspection. This admits all 500 supported
inputs without exceeding the command line. Linux keeps sealed descriptor
paths. The transaction still verifies every input and compares the complete
flat output with an independent renderer. ADR 0387 records the repair. Both
checked seeds retain these changes; the earlier 16a86f5b clean paired proofs
and the current 9d2529a7 proofs independently compare final-stage artifacts.
The final-cohort 155-test CupidBuild CLI suite passed on each host. Both
500-input cases passed; only platform-specific skips remained. Linux ran from
the supported /mnt/c location. These results are separate from the earlier
source preflight with the 962e476b tools.
The corrected 167-case production suite and the isolated Linux archive's 48-case handoff suite also passed. Linux executes the profile-parent symlink and replaced-output-directory cases skipped on Windows, as well as parallel ordering and ISO publication checks.
The pre-correction Linux normal build passed all 16 exact artifact rows and
published an image byte-identical to the successful private four-CPU
validation frontier. The first main Windows replay timed out, but an
isolated guarded replay later published the Linux-matching raw kernel with
unchanged timeouts. That diagnostic-root result does not establish main
Windows Make acceptance or the original timeout's cause. Both hosts later
passed their default builds at the first corrected-manual checkpoint. The
earlier five-manual freeze produced matching 9,550,844-byte raw kernels. Both
repaired parallel replays pass all 16 artifact checks and image publication.
The private four-CPU runtime frontiers on the Linux image with E1000 and
RTL8139 pass compiler, ISO, swap, graphics, audio, USB replug, and SMP
checks. The earlier 962e476b Windows replay exceeded the command-line
limit with 431 absolute kernel-flatten input paths and preserved the old raw
kernel. That failed replay is separate from the new paired proofs. The
Windows image with preserved FAT contents separately passes an SMP and ls
smoke.
The ordinary GUI smoke requires Cupid OS to remain running through its post-command survival interval. An early QEMU exit reports its status and bounded host output; a live boot timeout remains a separate failure. The runner retains its panic, command-completion, and SMP runtime checks.
The GUI smoke can type FAT short paths such as /disk/wads/freedo~1.wad.
It validates all command characters before sending keys, so unsupported text
cannot leave a partial command in the guest. The final-manual asset-free
runtime frontier passes. An earlier pinned-IWAD timedemo probe panicked
during HomeFS rewriting with an EHCI DMA-ownership error. Later private
probes did not reproduce the panic but missed timedemo completion. A longer
1,200-second diagnostic completed renderer initialization and reached
ST_Init; Doom runtime acceptance remains open.
Checked cupidbuild assemble-iso-pattern publishes the ISO spanning
fixture from test_iso/big_pattern.asm. It requires exactly 4,096 bytes that
repeat 00 through ff, plus a base-zero raw map containing one data range
and no control edges. Checked CupidDis inspects the pinned bytes before the
guarded transaction can publish them. Failed checks preserve the previous
fixture, and equal bytes retain its timestamp. The normal recipe selects this
command directly with the source, Makefile, and full seed closure. Its
production transaction is carried by both repaired seeds. ADR 0386 records
the handoff. The enclosing ISO image remains a separate Hostbuild publication.
Make finishes test_iso/hello.iso before verify-artifact-sizes through an
order-only prerequisite. The pattern transaction's temporary root entries
change directory mtime even when it reuses equal output. Finishing ISO work
first keeps those writes outside the artifact verifier's pinned-directory
check. The audit enforces this exact edge without changing size-policy inputs.
That scheduling repair changed no production owner; both repaired builds passed.
The promoted CupidBuild seeds provide generate-profile-manifest for the closed
Doom compile profiles. It discovers the exact 83-source cohort and 304 .h
and .inc inputs, freezes them with the complete seed, builds CUPROF1 from
frozen input bytes, and runs frozen CupidObj first. An independent native
renderer must produce the same canonical JSON before CupidBuild rechecks the
closure and publication state. Equal bytes retain the existing timestamp;
links, aliases, parity failures, locks, and drift preserve the previous file.
Windows may create a missing build or build/bootstrap component with
parent-relative NtCreateFile and removes only an empty directory whose
returned identity still matches. POSIX requires both parents to exist, so Make
runs mkdir -p build/bootstrap after rejecting existing links at either
component. CupidBuild does not
claim those directories for rollback.
At the earlier kernel-compiler handoff (ADR 0393), the recorded state was:
The normal recipe calls the host-selected CupidBuild image directly. Its
prerequisites include Makefile, the profile headers, the selected manifest, and
all six manifest-bound tools. Make fixes the output path and seed-derived
directory, suffix, and image closure with override assignments. The graph
records 354 CupidBuild and 98 Python participations across 452 transforms.
Disk and ISO publication remain the two Python-coordinated CupidObj paths.
ADR 0383 records this handoff.
Make finishes the profile before any of the 254 normal writers beneath
kernel/, drivers/, or toolchain/ can run. The order-only barrier covers
the complete matching artifact cohort and the three generated installation
sources. Other roots remain parallel. The audit records scheduling edges as
order_only_inputs, keeps them reachable, and does not count them as file
content consumed by the writer. Its checked user ABI gate retains the same
distinction.
Every discovered directory stays pinned. Two complete validation passes run at each closure checkpoint. POSIX compares nanosecond mtime and ctime. Windows compares the retained handle with exact named file ID, LastWriteTime, and ChangeTime records. The final pass is a checkpoint, not a durable source-tree snapshot.
POSIX flat transactions keep frozen inputs, maps, and captured streams in
sealed anonymous memfds and pass /proc/self/fd/N paths to checked tools. The
reservation, lock, candidate, publication alias, and parked old output stay
named. DrvFS no-replace fallback links the destination before unlinking the
source, while existing-output fallback parks a verified hard link before
replacement. These POSIX compare-then-unlink steps retain a formal same-user
race. Verified source drift rolls back and cleans normally. Ambiguous namespace
bindings preserve the old output and leave transaction residue for recovery.
The following seed evidence belongs to the preceding 9d2529a7 checkpoint.
The Windows runner supplies an exact inherited-handle list containing standard
input, standard output, and standard error. An unrelated inheritable handle is
not passed to the child. The promoted pair binds revision
9d2529a718672edcd970f24960535db6ddbde5e4 and the 59-input snapshot
bb4f598b2f72140d82d01fbfdedc14e4c774965d08c155ca848596daf3aa054f.
Its candidate fixed points matched every final object and tool image, then
passed 36/7/42 failure/help/success groups on Linux and 24/7/29 on Windows.
Those matrices cover the checked CupidC runner, typed profile publication,
the ISO pattern transaction, and closed kernel compilation.
ADR 0377 records the transaction, and ADR 0393 records seed promotion.
Windows separates read-shared frozen inputs from mutable candidates,
and it reopens the same verified frozen identity with delete access only for
cleanup. Guarded CupidASM calls write directly to the candidate retained by
CupidBuild instead of nesting a second publisher. The common Windows startup
provides the file-information wrapper used by the shared host adapter, and
the ordinary and linker profiles include its import.
The repaired Windows publisher restores a rejected candidate through a verified read/traverse directory handle, then reacquires cleanup authority. This avoids the rename-back sharing violation without relaxing frozen-input protection. ADR 0385 records the repair now carried by the checked seed.
The repaired Windows plan is
98e09aab876a9fa37ec07c38a0a57a014549a14c0ab10c740b3f80ede9d65669.
Temporary Windows behavior manifests name the plan executed by their copied tool cohort. This keeps the behavior fixture's import checks consistent with the images under test.
Source-head CupidBuild now provides flatten-kernel for the full production
code cohort. The transaction freezes the manifest, 431 active inputs, and the
complete seed. It keeps one broad CupidDis request, checks both linked kernels,
runs CupidObj flat, and compares the result with an independent native ELF
renderer before publication. POSIX keeps frozen file descriptors open through
cleanup, and Windows uses a pinned private working directory with short input
names. The hosted runtime now supplies strrchr for that path handling.
A CupidC-built source-head image reproduced the tracked 9,513,536-byte kernel
with SHA-256
3aac627568da71fe5478732c3b1adf8bf3c0cbf8678d63868a4f5982b5097773.
The fixed-point matrices include a successful pair and malformed-manifest
rollback. Both active seeds carry the transaction, and the normal Make recipe
now invokes the platform seed directly. Hostbuild remains an optional parity
oracle. ADR 0372 records the source capability, ADR 0374 records paired seed
carriage, and ADR 0375 records the production handoff.
The normal build then compiled the complete kernel and all 83 Doom roots,
linked both kernel stages with CupidLD, and passed broad CupidDis inspection.
Its first artifact check exposed a stale parent-lineage rule in the independent
Cupid-built contract. That contract now accepts either complete adjacent
parent pair and rejects mixed digest/revision combinations. The corrected
replay accepts all 16 exact rows, publishes a 9,513,992-byte flat kernel, and
passes a private four-vCPU E1000 /bin/ls.cc smoke with strong SMP checks.
Source head has since moved the promoted-v2 window forward one generation. It
accepts the kernel-symbol and kernel-flattening parent pairs, while
the v1 reader keeps its historical contract. The Windows execution and plan
parents must select the same generation. ADR 0380 records the exact digest
and revision pairs that prepare the next seed candidate.
The checked normal build accepts all 16 exact artifacts, and a private
four-vCPU max/E1000 boot reaches /bin/ls.cc JIT completion with all CPUs
online.
The native Windows fixed point now runs every stage-two producer from the checked PE32 execution seed. The checked Linux seed remains the reviewed plan and paired provenance input, but its executables do not run during native reconstruction. A complete source-current proof passed while WSL was unavailable: stages three and four matched across 23 C objects, three assembly objects, and all six tools, and the 13/6/18 behavior matrix passed. ADR 0359 records the removal of the temporary compiler bridge. That checkpoint's production build and four-CPU GUI-terminal smoke passed with the Windows checked seed. At the ADR 0361 checkpoint, both the Linux and native Windows end-to-end fixed-point tests passed. That Linux cohort rebuilt all six tools; its paired Windows cohort retained five exact images and rebuilt only CupidBuild.
At the earlier kernel-compiler handoff (ADR 0393), the recorded state was:
Checked cupidbuild run admits exactly CupidC, CupidObj, and CupidLD. A
checked CupidC compile matches the direct i386 relocatable bytes, while a
syntax error forwards the same status and diagnostic without replacing an
existing object. The Linux and native Windows fixed-point drivers retain the
checked CupidObj comparison and add checked CupidC help, success, and failure
cases. Together with typed profile publication, the promoted candidate
matrices include closed kernel compilation and passed 36/7/42 on Linux and
24/7/29 on Windows. ADR 0360 records the original runner
boundary, ADR 0361 records the preceding paired promotion, and ADR 0376 records
the source-head compiler admission. ADRs 0367 and 0370 record earlier pairs;
ADR 0393 records the current promotion. The
normal graph now runs 186 ordinary CupidObj recipes through CupidBuild. The
two normal kernel links use the same checked runner. After the typed JPEG and
kernel-symbol, kernel-flatten, profile, ISO-pattern, and 157 kernel compiler
handoffs, the audit records 354 CupidBuild and 98 Python participations. ADR 0363 records the link handoff, ADR 0371
records direct kernel-symbol publication, and ADR 0375 records direct raw
kernel publication.
The audit derives that split from each graph's evaluated CUPIDOBJ command;
it does not treat the variable name itself as proof of CupidBuild ownership.
Both promoted CupidBuild seeds now provide generate-ksyms. It freezes the pass-one
kernel ELF and complete promoted seed, captures private CupidDis symbol rows,
and asks CupidObj to render the generated source. A separate native parser and
renderer reconstruct the KSYM bytes and source spelling, and the guarded
transaction publishes only when both results agree exactly. The behavior
matrix covers successful generation and malformed-ELF rollback on Linux and
native Windows. The normal Make edge invokes the platform CupidBuild seed
directly with the manifest and complete six-image closure. ADR 0369 records
the source boundary, ADR 0370 records paired seed carriage, and ADR 0371
records production ownership.
Source-head CupidBuild now adds a typed embed-jpeg transaction. The command
freezes the asset and complete v2 seed, runs private CupidObj wrap-jpeg with
the original logical identity, requires the exact JPEG payload and three
identity symbols in the data-only i386 relocatable, and checks the frozen JPEG
with a separate native SOF0/SOF1 parser. It owns the
lock, drift checks, rollback, and atomic publication boundary. Both source-head
fixed-point matrices compare the operation and preserve sentinel outputs on a
progressive input. Both active seed cohorts carry the command. The normal Make
recipes invoke it directly with the complete production seed closure. ADR 0364
records the source capability, ADRs 0367 and 0370 record earlier seed carriage,
and ADR 0368 records the handoff.
The first paired refresh for that command stopped before either candidate
could publish. Linux failed after about 412.25 seconds, and native Windows
failed after about 449.43 seconds, because cupidbuild.h included the missing
hosted <stddef.h>. The hosted i386 header set now provides the target
size_t, ptrdiff_t, wchar_t, max_align_t, NULL, and offsetof
contract. Source-head CupidC treats the typed __builtin_offsetof operation as
strict C implementation support instead of a GNU-only extension.
The ADR 0374 source closure had 59 inputs and snapshot SHA-256
0b591a0bef928186641b3aa1fb98c1e145e6c4905c8b6cb87c34a1ace4bc87d2.
The Linux and Windows build-plan hashes did not change at that checkpoint.
CupidBuild accepted a promoted v2 manifest with source_input_count 58 or 59
and rejected 57 or 60. Paired artifact verification also required the Linux
and Windows counts to match, so a mixed 58/59 pair failed. This kept the
preceding 58-input pair usable and made that 59-input promotion consumable.
The first promotion attempt failed closed with
fixed-point provenance differs. It did not replace either active seed, and
no invalid seed became active. Fresh candidates from revision
9d10c223fc7aa22901e6f4ae81ce800ff1b62ad6 converged. After promotion,
separate self-consumption reproofs passed on both hosts. The normal JPEG
recipes now enter the promoted typed transaction directly. ADR 0365 records
the hosted header repair, ADR 0366 records manifest compatibility, ADR 0367
records the accepted pair, and ADR 0368 records the handoff.
The kernel-flatten refresh also failed closed twice before promotion. The
first behavior fixture used the wrong linked-kernel identities; the second did
not create its separate behavior workspace. Neither attempt published a
candidate. Corrected candidates from revision
0232cb57aad5d6bdfd7bd77499762514b2f0ebfd converged on Linux and native
Windows. Those ADR 0374 manifests have SHA-256
470fcd1b8b1a1506f26d3dd33d51f55d6896571aacb7329b792d4612f9434781
and
e7e65908eb03eec43e44e2946b395723b164f5701d980aae8ffaaf1006c3d7e4.
ADR 0374 records the accepted pair.
The ADR 0374 policy-bound OS build passed all 83 Doom roots, both CupidLD links, strict
CupidDis inspection, all 16 exact artifact rows, and image publication. The
flat kernel was 9,536,524 bytes; the final and pass-one ELFs were 9,765,196 and
9,634,124 bytes. A preceding 9,501,220-byte checkpoint, which differed only in
embedded manual text, passed a four-vCPU E1000 boot and ran /bin/ls.cc. The
final documentation-bearing image passed the same private gate and reached
normal /bin/ls.cc JIT completion.
Source-head CupidBuild now has a native checked CupidObj runner. Linux creates
no .cupidbuild-run namespace. It freezes the manifest and all six tools in
fully sealed anonymous memfds and pins the working directory by descriptor.
The child calls fchdir before remapping captured streams. A tool descriptor
in slot 0, 1, or 2 is duplicated above the standard descriptors before
fexecve or execveat. The dup2, pipe read and write, and wait loops retry
EINTR; dup2 also retries EBUSY. Captured streams are fully sealed
anonymous memfds. The close-on-exec launch-status pipe preserves a genuine
exit of 125, and the static i386 startup provides cupid_linux_syscall5.
Windows pins and rechecks the working-directory identity, then uses a
handle-pinned private root and files. It retains a tool handle without write or
delete sharing through CreateProcessA and forwards the captured streams in
binary mode to preserve exact bytes. Cleanup removes an identity-owned file
even if it changed in place, but preserves a replacement identity. Both paths
recheck the live seed before forwarding output.
The production seeds carry this interface, and the normal Make graph uses it for all 186 direct root CupidObj calls and both normal kernel links. ADR 0358 records the source capability, ADR 0361 records seed carriage, ADR 0362 records the object-recipe handoff, and ADR 0363 records the kernel-link handoff.
The Windows CupidBuild CLI suite completed 66 tests in 65.934 seconds with three expected skips. The host-runner Python module completed eight tests in 0.962 seconds with four POSIX skips, and its dedicated Make contract passed. All six CupidASM source tests passed in 3.771 seconds. Strict Windows and freestanding i386 adapter compilation passed, along with the timeout-and-seed-drift precedence case.
The earlier ADR 0374 top-level replay passed after the exact-size check rejected the
updated CTXT payload and its policy was updated. All 16 exact artifacts passed.
The checkpoint sizes were 9,536,524 bytes for kernel/kernel.bin, 9,765,196 bytes
for kernel/kernel.elf, and 9,634,124 bytes for
kernel/kernel.elf.pass1. Whole-image CupidDis inspection and disk-image
staging passed as part of that replay.
A preceding 9,501,220-byte checkpoint, which differed only in embedded manual
text, passed a private four-vCPU E1000 QEMU smoke with
--cpu max --verify-smp-runtime and ran /bin/ls.cc. The final
documentation-bearing image passed the same private gate and reached normal
/bin/ls.cc JIT completion.
The complete 129-case bootstrap-seed module finished with 126 passes. Both fixed points built successfully. The three failures were stale assertions about the initial seed comparisons and the Windows CupidC suffix. The focused privacy case passed after correction in 0.700 seconds. Complete reruns then passed the native Windows fixed point in 1,847.207 seconds and the Linux fixed point in 2,158.113 seconds. The complete module then passed all 129 cases in 3,569.451 seconds.
CupidBuild is present in both promoted seed cohorts and directly owns four
normal guarded assembly publications: the ISR and context-switch objects, the
bootloader, and the SMP trampoline. Its first hosted command performs a
guarded CupidASM relocatable-object transaction: it freezes the source and
checked seed, parses the exact host schema, target, provenance, artifact
inventory, producer roles, and Linux build plan, then runs private checked
tools. It validates and inspects the candidate,
rechecks every live boundary, and publishes through pinned Linux or Windows
directories. It records the owner lock created during acquisition, rejects a
replacement found at either final boundary, and quarantines the lock path so
cleanup can restore a successor instead of deleting it. The check and object
rename remain separate operations; the protocol serializes cooperating
CupidBuild publishers. CupidDis now requires known instructions, local targets,
and function anchors at instruction starts. The complete command suite passes
on Windows and Linux. It also rejects unlisted .elf or .exe peers before
execution and after each attempted checked command, including failures and
timeouts. Every frozen tool must match the static i386 ELF32 or strict CupidLD
PE32 profile before either tool runs. The active v2 seeds contain all six
tools. The object Make recipes invoke the host seed with the full seed closure and
absolute repository root. ADRs 0339, 0342, and 0344 record the guarded
transaction, and ADR 0354 records direct production ownership.
CupidBuild also has typed bootloader and SMP-trampoline operations. They assemble a private raw image and v2 map, enforce the artifact's size and layout policy, and run strict source-edge inspection before publishing only the image. The fixed-point behavior gate exercises both operations across its two compared generations. The refreshed checked seeds carry both commands, and both normal raw-image recipes invoke the promoted CupidBuild seed directly. ADR 0355 records the source boundary, ADR 0356 records carriage, and ADR 0357 records the recipe handoff. The ADR 0353 refresh candidates found CupidBuild alone different from the preceding seed at stage two, then matched all six final tools.
That paired v2 trust unit froze 58 source inputs and built 22 Linux C objects,
one startup object, and all six tools. Native Windows added its
publication runtime and CupidBuild startup bridge, with the exact
KERNEL32.dll and NTDLL.dll imports. Both final-stage comparisons and
behavior gates include CupidBuild. The Toolchain publication contract carries
the sixth tool and publishes 22 artifacts across 62 stage pairs. This seed
promotion established the seed used by the later object-recipe transfer. ADR
0345 records the candidate boundary, ADR 0353 records promotion, and ADR 0354
records the first normal use.
Both ADR 0353 candidate proofs passed. Linux matched 22 C objects, startup,
and six tools with 24/6/31 failure, help, and success cases. Native Windows
matched 23 C objects, three assembly objects, and six tools with 13/6/18
behavior. Both froze revision 43c747f0e683d0527984bae05bf944879e64a07b
and the same
58-file source snapshot,
4cd9d583933d8a9f1dbfb63425bc3665fe6c306db8ae76606f40a0ade49afe70.
Each gate also runs both CupidBuild images through the guarded object command,
requires equal relocatable output, and proves missing-source rollback. Each
final-stage CupidDis strictly certifies the corresponding six images. Both
generations must also reject a private CupidBuild copy with an invalid
file-backed entry instruction. ADR 0346 records this pre-promotion gate.
Source head now applies the same strict CupidDis policy to every generated C object before either fixed-point driver links it. The Windows CupidBuild startup marks all fourteen exports as functions, so its anchors participate in that proof. CupidDis reuses each executable section's instruction map for reporting, relocation ownership, anchors, and local-target setup. The fresh Linux and Windows candidates converged and now supply the active v2 cohorts. Promoted-seed self-consumption also passes on both platforms, with all six initial images equal to stage two. ADR 0347 records object certification and the startup closure, and ADR 0350 records decode-map reuse.
The preceding five-tool Linux fixed point completed with the 55-source closure. Its coordinator reads only four bytes when it selects the runner for a checked tool, so tool-image size no longer controls probe memory. All generation, comparison, behavior, and native evidence gates passed in 1,295.031 seconds. After the hosted runtime and source-head link grew, a fresh reconstruction refreshed the affected current-image locks without changing either promoted seed. The definitive fixed-point unittest passed in 1,241.572 seconds with 19 C objects, one startup object, and all five tool images equal between stages three and four. The complete checked Toolchain target also passed all 21 artifacts and 58 author-oracle stage pairs in 7,586.378 seconds.
The hosted link builds CupidBuild beside CupidC, CupidASM,
CupidDis, CupidLD, CupidObj, and the static runtime contract. The link exposed
and closed a missing standard memchr boundary in the hosted i386 runtime.
The active checked production seeds now carry that six-tool closure.
Cupid OS carries a checked static i386 Linux seed for six hosted tools:
CupidC, CupidASM, CupidDis, CupidLD, CupidObj, and CupidBuild. The seed starts
a complete toolchain rebuild without GCC, Clang, NASM, a host linker, nm, or
objcopy. CupidBuild is checked as an artifact but is not a code producer.
Cupid OS also carries a checked native i386 Windows execution seed for those six tools. Windows selects the PE32 cohort for output-bearing production commands. The Linux cohort remains the bootstrap seed for fixed-point, and the complete Toolchain contract cohort because only its manifest carries the full build plan. Artifact-size policy still reads that Linux manifest as provenance, but its Windows gate builds and runs a temporary PE contract from the native execution seed. The Windows user ABI gate uses the same temporary contract pattern. Neither gate treats the PE manifest as a bootstrap plan. The promoted Windows manifest records clean stage-four provenance and keeps the Linux plan as a separate verified parent. ADR 0272 records the two roles, ADR 0292 records the strict-relocation promotion, and ADRs 0295 and 0297 record the native Windows contracts.
Checked-seed CupidASM and CupidDis share raw-map v2 control-edge metadata. The assembler records the resolved destination for relative and immediate far transfers, marks out-of-image destinations as external, and leaves indirect runtime destinations explicitly unprovable. CupidDis can require those rows and reject a changed destination even when it remains a valid instruction boundary. Guarded boot and SMP publication now require these rows. ADR 0340 records the source step. ADR 0336 records v1 carriage and adoption. ADR 0353 records the paired v2 contract, and ADR 0367 records preceding carriage, and ADR 0370 records active carriage.
The checked Windows execution seed supplies every stage-two producer. Its CupidC uses 64 KiB arena blocks and can compile the complete current source closure. Native stage two builds stage three, native stage three builds stage four, and the final two generations must match before publication. The checked Linux seed supplies the reviewed plan and paired provenance only. ADR 0341 records the former bridge; ADR 0359 records its removal. The reproducible operator entry points are:
make verify-windows-bootstrap-seed
make bootstrap-windows-from-seedThe bootstrap target publishes only to
build/bootstrap/checked-windows-seed. Its dry run and two Make contract tests
pass. For debugging, the underlying command is:
python tools/bootstrap_toolchain.py bootstrap-windows \
--manifest bootstrap/seeds/i386-windows/manifest.json \
--plan-manifest bootstrap/seeds/i386-linux/manifest.json \
--root . --output build/bootstrap/checked-windows-seedThe command freezes and verifies both manifest roles, derives the native plan,
builds stage two from the checked PE producer trio, builds stage three from
the new trio, and builds stage four from stage three. Stages two and three are
transition generations; stages three and four are the convergence pair. The
driver compares every object and all six tools, then runs useful native
success and failure cases on the final pair. It publishes one
cupid.windows-bootstrap-report.v1 bundle only after rehashing the frozen and
live source closures. A source-stable Windows run stopped safely at
cupidobj_main after 821.9 seconds under the old comparison. Linux stopped at
the same transition after 883.3 seconds. Neither published. Later uncapped
proofs passed. Windows matched 20 C objects, two assembly objects, and five
tools in 20 minutes 43 seconds with 5/5/5 behavior cases. Linux matched 19 C
objects, startup, and five tools in 24 minutes 22 seconds with 5/18/16 behavior
cases. Both preliminary reports bind the same 50-input snapshot, SHA-256
d8481a39e0d1c7f42779a8c9f5fc5de10d7e5b9bc4df63ce6afe9ddd9c9716da.
They began from uncommitted source. Linux later passed a clean proof in
1,294.3 seconds, promoted the stage-four seed, and passed a 1,473.9-second
reproof with every initial seed comparison true. Native Windows then passed a
clean 1,253.4-second proof, promoted its stage-four PE32 seed, and passed a
1,061.3-second reproof with every initial seed comparison true. The reproofs
pass 5/18/17 and 5/5/6 behavior, including executable relocation ownership.
ADRs 0278 and 0279 record the driver and added generation. ADRs 0280 and 0281
preserve the preceding promotions, and ADR 0292 records the strict-relocation promotion.
A preliminary Linux behavior reconstruction matched four direct Windows tools
and exposed a CupidDis-only profile difference. Both CupidDis images were
387,584 bytes, but
the reconstruction had compiled cupiddis_main.cc without _WIN32=1.
Compile and link parity tests plus the bootstrap audit now guard the Windows
profile for all six tool mains.
At that earlier v1 checkpoint, the seed lived under
bootstrap/seeds/i386-linux/. Its manifest recorded each
file's size and SHA-256 value, the static i386 Linux ABI, entry point, source
revision, producer lineage, all 19 C sources, startup, include arguments, and
the exact link order for every tool. Verification pins every source name,
path, position, and GNU-mode flag rather than trusting a manifest-supplied
digest alone. It also rejects unknown fields, dynamic images, an interpreter,
duplicate JSON keys, numeric and Boolean type substitutions, writable
executable load segments, entry points outside executable file bytes, unlisted
ELF files, and unexpected target metadata.
The separate i386 runtime contract is not part of those 19 tool inputs. It
uses .cc because CupidC compiles it, CupidLD links it with CupidASM startup
and the repository runtime, and Linux or WSL runs the result. The normal
Toolchain publication owns fifteen .cc contract programs. Stage-two and
stage-three CupidC compile them at the checked i386 ABI, CupidLD links each
one against matching stage objects, and the harness requires all seventeen new
objects and sixteen executables to match across stages. At source head, it freezes
76 publication inputs and reconstructs that exact inventory under a private
source root. The inventory includes the exact-decimal and x86 catalogue
fixtures, small Windows probe, native Windows tool runtime and startup,
CupidLD publication runtime and
bridge, direct runtime contract, direct.h, windows.h, user syscall ABI
contract and its six declarations, CupidBuild and its hosted declarations and
startup, hosted stddef.h, the PE32 reader, Toolchain Makefile, publisher, and independent Python
ABI oracle.
Newly discovered contract inventories catch additions, removals, and a
transient edit copied before the live file is restored. The public manifest
also binds the checked seed, build plan, and 59-file candidate source
inventory. Verify and run reconstruct both inventories before execution.
Hashing, JSON decoding, schema checks, and build-plan use share one captured
seed-manifest byte sequence. Replacing the file during validation cannot mix
facts from separate reads. The publisher accepts only a dedicated
cupidc-contracts directory inside the
source tree. It validates that target before work and again before promotion,
and an existing destination must already verify as a complete cohort.
Arbitrary directories, source trees, files, and symbolic links remain
untouched. It publishes all sixteen contract executables, six candidate
tools, and a manifest together. A separate Toolchain contract source implements
the author and verifier modes. The checked stage-four Linux CupidC, CupidASM,
and CupidLD build the author from its direct inputs. Linux runs a static ELF.
Windows runs a validated native PE made from the same author source, checked
Windows runtime, startup, and exact imports. Its framed CUPMAN4 request carries
the publication facts and raw stage-three and stage-four bytes for 62 fixed-point
pairs: 17 contract objects, 16 contract executables, 22 bootstrap C objects,
one startup object, and six tool images. The author requires regular,
nonempty, byte-identical streams and hashes both sides independently. It
derives the 17 schema-v3 object records, checks executable pairs against their
artifact facts, and derives the fixed-point summary from the exact pair
inventories. The protocol has no caller all_equal field. Python repeats all
62 comparisons after author acceptance and keeps no-follow capture, private
staging, process launch, drift checks, rollback, and atomic replacement. The
complete cohort must verify before one directory replacement, and any failure
preserves the prior publication. The
host-selected checked seed then builds the
CUPMAN2 verifier as a static ELF on Linux or a native PE on Windows. ADR 0195
records the runtime probe rename, ADR 0196 records the complete transfer, ADR
0264 records the ABI checker transfer, ADR 0302 records the verifier, ADR 0304
records the manifest author, ADR 0307 records raw stage-pair evidence, and ADR
0322 records native Windows author execution.
At the ADR 0360 checkpoint, the complete schema v3 CUPMAN4 publication
passed and wrote 22 artifacts from 75 publication inputs and the exact 58-file bootstrap
inventory. The Cupid author and Python oracle agreed on all 62 stage pairs.
Its 29,271-byte manifest has SHA-256
5fab9706abe6d938e9aa4a355ebbae293fee5404475d3d20d2591d6a9e464011.
Its final verifier accepted all 22 artifacts.
Both checked Python contract launchers resolve tools from this checkout. The
direct contract suite passes 40 tests, the publisher suite passes 65 tests,
and the pinned verifier runner passes 25 tests
in 32.773 seconds with three POSIX-only Windows skips. ADR 0311 records this
host import boundary.
The final poisoned build and private guest results are in the latest complete
production checkpoint.
The audit assigns generation ownership for the author only to those 20 build inputs. The 76 publication inputs and 59 bootstrap inputs are observed facts, so they do not inherit compiler or assembler ownership from the author transform.
Source head adds the PE32 reader, CupidBuild publication surface, and hosted
stddef.h to the checked Toolchain source closure. The source-current
inventories contain 76 publication inputs and 59 candidate files. The
75-input, 58-file publication above is historical. The earlier 16a cohort
published all 22 artifacts with the 76/59 inventories and passed native
CUPMAN2 verification in a stable copy. Its manifest has SHA-256
ba5e531172f4861237238d403f8119f229c3e6d1267a483277efc3f19e615c92.
That earlier publication after the preprocessor-count and ABI-consumer
repairs in b25a3374, plus refreshed object expectations, agreed on all 62
stage pairs. All six published tools matched the preceding checked Linux
seed, and all 22 artifacts passed native CUPMAN2 verification on Linux and
Windows. Its 29,619-byte manifest has SHA-256
419d1e6f3b4a90b1cbfae04f5aa397c900449efe7d4197b7116f0cadb5070afd.
The full executable suite and user build passed at that checkpoint.
The compiled candidate plan contains 22 C objects. Hosted CupidDis uses
the new reader to inspect the deterministic static i386 PE32 profile emitted
by CupidLD. It reports headers, sections, and named imports, decodes every
executable section, and can require valid entry and direct-local-target
anchors. It rejects loaded spans above CupidLD's 2 GiB RVA limit. At ADR 0338,
all five checked Windows seed reports matched an independent Python
reconstruction, but the promoted CupidDis executables then predated the
reader. The current six-tool seeds carry it.
Fourteen ordinary contract compiles use the worker pool and 900-second plan
budgets. The pool drains before the heavyweight cupidc-object compile starts
alone with a 1,800-second budget. The separate runtime compile and all contract
links retain their 360-second limits, and links remain parallel. ADR 0282
records the resource boundary.
The staged cupidasm-kernel-elf plan also names as_elf, CupidLD, CupidASM,
x86, and ELF32. This matches its native contract closure. The first scheduler
gate found the old three-object omission after the isolated compile completed;
CupidLD failed before any partial publication. A direct plan test locks the
correct closure.
The v2 manifest also requires stage-three and stage-four as the fixed-point
comparison pair. A complete 4,480.3-second private rebuild reached this final
check after every earlier gate passed. The stale verifier rejected it without
publication; positive and wrong-pair tests now lock the exact record.
The preceding full publication gate passed in 4,589.9 seconds. It compared seventeen
objects and sixteen executables between stages three and four, ran and
published stage four, verified 21 artifacts from 65 inputs, then matched the
three native Windows user objects and executables to the checked-seed frontier.
The 22,591-byte manifest has SHA-256
ff193cf81293553706373f5a37d0fedf3dfae0bebcbc608d892a4f40ea3d9629.
The warmed verification path for that publication passed in 12.2 seconds.
Every normal Toolchain run derives the cohort from its requested executable,
requires a named manifest artifact, and verifies the target, fixed-point
record, exact filenames, sizes, hashes, and current live input hashes before
execution.
The runtime probe also exercises signed and unsigned long long formatting,
sixteen-digit zero-padded hexadecimal output, and precision-bounded strings.
Those forms come from the unchanged Toolchain contract diagnostics.
make verify-bootstrap-seedThis command validates the seed without executing it.
make bootstrap-from-seedThe full command reads all 50 current source inputs once. The closure includes
the 19 tool C sources, startup and hosted declarations, link.ld, the
freestanding Windows probe, the Windows runtime wrapper, and the direct
runtime contract. It copies those exact bytes into a private compiler root.
Checked CupidC compiles stage two below that root, checked CupidASM assembles
its startup, and checked CupidLD links all five tools. The stage-two producer
trio builds stage three below the same root, then the stage-three trio builds
stage four.
The gate compares all 19 C objects, the startup object, and all five linked
images between stages three and four. Both stages run five help checks,
twenty-two successful operations, and twenty-one useful failure cases across
compilation,
assembly, disassembly, symbol
inspection and source generation, linking, profile-manifest authoring, JPEG
validation, disk-template and ISO fixture construction, wrapping, and flattening. The
harness rehashes both
the private closure and the live closure at each generation boundary, after
the behavior suite, and before publication. It applies the same checks to the
live seed manifest and artifacts. A live edit that is made and restored during
a compile cannot change the captured compiler input.
Checked-seed CupidObj includes ksyms-source in that behavior matrix. The
command turns canonical CupidDis symbol text into the exact packed
kernel-symbol .cc source. It retains t, T, w, and W symbols except
private .L labels, sorts by address and input order, and keeps the first name
at a shared address. The focused seed contract checks exact Python-oracle
parity and preserves an existing destination after a malformed second line.
The normal image now passes CupidDis's exact text to this checked command.
Python freezes the inputs, independently renders the expected bytes, and
publishes only a complete match.
Before execution, the harness reads the manifest and each seed binary once. It verifies those captured bytes, keeps the manifest hash, and runs private copies of the five binaries. It reloads the checked files at every generation boundary and before publication. A later replacement cannot alter the private run, and detected live drift prevents publication.
The default output is build/bootstrap/checked-seed/. It must be absent or
empty at the start. The harness keeps stages two through four, behavior
fixtures, and the report private until every check succeeds, then publishes
them as one complete directory. A nonempty output is rejected without
modification. The report
keeps the historical seed source revision separate from the captured source
snapshot. ADR 0142 records this source and publication boundary.
Linux runs private copies of the static bootstrap tools directly. Windows
stages those ELF images in a mode-0700 WSL directory created by mktemp for
fixed-point and Linux-contract work. Output-bearing production recipes freeze
and run private copies of the checked native PE32 cohort directly.
This seed makes the hosted static toolchain reproducible from a clean
checkout. make -C toolchain all uses it for the normal contract cohort and
does not invoke a host C compiler or native linker. Native contracts remain
available under native-oracles, and hosted development commands may still
use a host compiler. Normal OS objects do not.
An earlier promoted-seed user frontier passed with exit 0 in 3,291.317 seconds. It
rebuilt and transactionally published the complete 21-artifact contract
cohort after stage two matched stage three. The checked ABI report confirms
schema cupid.user-syscall-abi.v1, version 5, 103 fields, a 412-byte table,
and 101 providers. The repeated hello, ls, and cat builds cover 23 inputs with
SHA-256
f63919f4b4307278c825ebedf99391e3ec110646042ee397dac3a7ba330435d3.
A fresh build in a unique output directory passed in 10.492 seconds and reproduced the promoted frontier's six files:
| Program | Object bytes | Object SHA-256 | Executable bytes | Executable SHA-256 |
|---|---|---|---|---|
| hello | 6,124 | 64e0a6ee0d7a45a0901d3db614e73481cdc6b30903345c5015601b2bf344be04 |
13,992 | 4c5622969f39ffe7c2427d65abae2d293dfbd76db2aa80c96f9e6cf01613600c |
| ls | 7,120 | e0627996a1d9cd6fd428642ffdfada7e07afa81d9267bc714360014af0dd3971 |
18,112 | 094b017eb6914bce6fbc1e99adeae845d5dc05280c1c1d897e68ab9d687c8d79 |
| cat | 6,292 | ff002fc4710704c3941bf6320249e772a3448d15f99269987ab1b9b608b3acb4 |
13,992 | b66cba4c98221f5006ad4aeee70349a82db20410e027aa863bc33fa5818b5f4c |
Disposable staged-copy runs returned 0 for hello in 54.546 seconds, ls in
52.637 seconds, and cat in 80.043 seconds. Cat used a 62-byte marker-shaped
fixture and passed the negative serial-event boundary. The source and evidence
images remained unchanged at SHA-256
326844ca58c1f864a6b9a2480dfaeb5ed71ec3df22cdb46da17a6bb356e7e726.
Host Python still coordinates each fixed point. Windows rebuilds native tools
from the checked PE execution seed and the verified Linux plan seed without
WSL. Most of the Linux Toolchain contract cohort still runs through WSL on
Windows, but the final CUPMAN4 author runs as a native PE. Output-bearing
production calls and the user ABI contract use the
checked PE32 cohort directly. Linux and native Windows now use clean promoted
stage-four seeds.
Python-free coordination remains open.
make verify-artifact-sizes uses one wrapper command to pin the raw policy,
both v2 manifests, the complete six-image Windows seed, and all sixteen file
observations. Checked CupidC compiles a strict C11 policy contract, CupidASM
supplies startup, and CupidLD links a static ELF on Linux or a native PE on
Windows. The contract validates the policy, Linux manifest, exact manifest
pairing, producer roles, and every observation, rereads its request, and emits
canonical JSON. Python
also validates the captured Windows cohort and must produce
the same report independently. Its final check walks each logical path again
from the pinned repository root and compares identity. Leaf and parent
replacement both fail. The audit binds the full 35-input transform closure.
The verifier is a direct prerequisite of cupidos.img. A
failure prevents image publication and preserves the existing image. An intended change updates
bootstrap/artifact-size-policy.json in the same review. ADR 0267 records the
policy, and ADR 0297 records the contract transfer.
This exact Cupid-output check does not replace the proposed 20 percent
Cupid-to-oracle quality comparison. Older Windows and Linux host .text
measurements differ by 22.73 percent for the same revision, so neither host
measurement can define that future gate. Linker capacity checks remain
separate.
Checked-seed CupidLD serializes one deterministic fixed-layout i386 PE32
console image. The format uses image base 0x00400000, places .text at RVA
0x1000, and lays out each nonempty later section category at the next page
boundary. Empty output categories do not get PE section headers. Repeatable
import options append canonical descriptors, lookup tables, IAT cells, and
strings in writable .idata. The image has no base relocations, and writable
executable input is rejected. Imported slots require zero-addend absolute
relocations. Import ordering uses an in-place heap, repeated slots are tracked
through symbol resolution, and name imports stay below the PE32 high-bit
boundary.
Both rebuilt CupidASM stages assemble the Windows entry, both CupidC stages
compile its freestanding main, and both CupidLD stages produce identical PE
bytes. An independent parser reconstructs the exact .idata layout before
Windows runs the stage-two image. The loader check requires the exact stdout
marker, empty stderr, exit 37, and a ten-second timeout. The report retains the
observed result and hashes for both object and image pairs. The checked-seed
matrix is 5/18/16. The promoted Linux seed carries imports, but Windows still
needs WSL to execute its static i386 Linux producers. ADR
0247
records the format boundary. ADR
0248
records imports and direct loader execution. ADR
0258 records seed
carriage.
Source head extends that PE path to complete native CupidASM, CupidC,
CupidDis, CupidLD, and CupidObj commands. The
shared hosted runtime selects a Windows implementation for command-line
parsing, VirtualAlloc heap storage, standard streams, file reads and writes,
seeking, current-directory lookup, and useful errno values. CupidASM
provides the entry and cdecl API bridges. CupidLD supplies the shared twelve
imports, plus four publication imports for its own image.
The preceding paired-stage proof produced matching PE images for all five tools.
Windows runs help plus a useful success and failure case for each. CupidDis
also requires a quoted two-byte input to match the Linux tool's 56-byte report
exactly. The direct runtime contract checks allocation, named-file append,
directory failures, and argument parsing. CupidLD also checks replacement over
a sentinel, candidate collision, exact output, failure diagnostics, and cleanup.
That complete proof passed in 801.9 seconds. Its 50-input source
closure has SHA-256
5bfbca2cbe30f2fa4b638cbf462b306cc05dc50a4604fd887f89426dbe091e63.
All five Linux and native Windows tools match from stage two to stage three.
The 38,164-byte report has SHA-256
3c63664f08e7bcdc639a88ca6ada6cf5143100eac966d748660b65d537b01e10.
That matching PE generation formed the preceding checked Windows execution
seed. Its CupidC image is 2,594,304 bytes
with SHA-256
209b493c73ff2b30ef38f0161491dacd5564f995a019876d96e8bc805b5c83e9.
Every image reserves and commits a one MiB stack; its heap reserves one MiB and
commits 4 KiB. Native reconstruction takes the Linux manifest as a separate
verified plan input because the execution manifest deliberately carries no
Windows build plan. Its first complete run rejected live source drift, so the
checked Windows seed still recorded the earlier paired-stage proof at that
checkpoint. Source head builds stage four and compares the final pair. Preliminary uncapped Windows
and Linux proofs pass. Linux later completed its clean proof, stage-four
promotion, and promoted-seed reproof. Native Windows later completed its clean
proof, stage-four promotion, and promoted-seed reproof.
The preceding strict-relocation Windows execution seed was:
| Tool | Bytes | SHA-256 |
|---|---|---|
| CupidASM | 438,784 | c54bb09f1eb317a23d1680da25c78a5a439bde44654ae8b908ddca11fd7e56d6 |
| CupidC | 2,592,768 | 765fa14724c1615088fb9280a16f3457a4c4f14fa2d1915d3c56ff73b2b797cd |
| CupidDis | 391,680 | f6d38d66f002c4440aacea08ca32b848d470665679afc13dca5f5ae8ce6b913b |
| CupidLD | 296,448 | 9fe3bd4fda9b87d678aa2eb6305e65b706ecdff074b16722faab23ce05cd8e02 |
| CupidObj | 375,808 | 079bc115e74772e6224e4da164115cc5696e357cca0cb1a0583985b88381cb79 |
Its 2,118-byte manifest has SHA-256
ae1d3dfb10604bba419c5936884668d10595f6c671915a4ae5f16706204bb41e.
It binds clean revision bf52d135348bc33ff32e66d549bbee5edc69d8ad, the
50-input snapshot
e76d36ed4edc7679e91ac237135fe476dff6e69946bbffca56077afbf19a47f9,
native stage-three producers, and Linux parent manifest
d571125256d11dd707f661299738891edc5c1a8d3358554076875a3e0cac22d0.
The clean proof passed in 1,253.4 seconds. Its old match vector was false for
CupidASM, CupidC, and CupidDis and true for CupidLD and CupidObj. The
1,061.3-second reproof matched all five initial seed images and repeated the
20/2/5 artifact and 5/5/6 behavior gates.
The earlier v1 Windows execution seed was:
| Tool | Bytes | SHA-256 |
|---|---|---|
| CupidASM | 444,928 | 5c21d79b1822831e5d81359fa2b31d85b731ead5a88c6596ced38585e64b87cb |
| CupidC | 2,613,760 | c768223d4dcd36023e9793b65d86f7bcbd641e921d6a6febf0a255eb7a0e1002 |
| CupidDis | 452,608 | 1e357223bfa0d967e5fe96ac180279f508271c4efed0f20d2c8d094726ff0eef |
| CupidLD | 296,448 | 9fe3bd4fda9b87d678aa2eb6305e65b706ecdff074b16722faab23ce05cd8e02 |
| CupidObj | 375,808 | 079bc115e74772e6224e4da164115cc5696e357cca0cb1a0583985b88381cb79 |
Its 2,118-byte manifest has SHA-256
751e1d7787a4be08e4e86814bbb7473979fe2eb8a3292baed0241967f772eaef.
It binds revision a17c9465911da41d59b7ada71733d36c39faa5ea, the exact
50-input snapshot
46c5335c80d822dd5085ee22077486ea647e5396482d42454847c87e4222aa67,
and Linux parent manifest
b6e34a2e18dd18aba91c6358116eafde39953566efeadb224575ac8c13ab2c1b.
The candidate proof passed cleanly. It matched 20 C objects, two
assembly objects, and five tools with every initial seed comparison true, then
passed the 5/8/9 behavior matrix. ADR 0336 records this
promotion and reproof.
ADR
0268 records the
shared runtime, and ADR
0269 records the
publication boundary. ADR
0272
records checked carriage and production selection. ADR
0274 records the
stack policy, and ADR
0278 records the
native driver. ADR 0292
records the preceding strict-relocation promotion. ADR
0323
records the preceding code-anchor promotion and production adoption. ADR 0336
records the parent v1 pair. ADR 0353 records the paired v2 contract, ADR 0367
records the preceding pair, and ADR 0370 records the preceding pair; ADR 0393 records the active pair.
The checked-seed CLI stages both ELF and PE images in an adjacent candidate
created with exclusive-create semantics. It writes and closes the candidate,
then reopens the file and checks its size and contents before replacing the
destination. Fault injection preserves an old destination across partial-write,
close, verification, and replacement errors. On POSIX, CupidLD requests mode
0777; the process umask may remove any permission bits. The directory must
remain stable under the caller's control; this standalone path has no
destination lock or directory pin.
The production boot source assembles to an exact 2,560-byte image with SHA-256
46cc9778da2b5cc5e8f04d7cc4b07243c3e07d466626ad84fb813dc6fef3a0d3.
CupidASM and the optional NASM oracle produce the same bytes for the current
0x01100000 stack top and LBA 20480 FAT boundary.
One checked raw-image transaction serves the SMP and bootloader callers. It
owns output locking, source and seed freezing, drift checks, private candidates,
and atomic publication. Each caller keeps its image-size and raw-map policy.
The expanded eleven-test suite passed in 1.708 seconds, including direct
mismatch and live-output drift checks for both callers. Parent-replacement
tests exposed a POSIX candidate leak when private work lived below the output
parent. Windows keeps a handle-pinned private directory below the stable
repository root. POSIX reserves one exclusive file there. Maps, captured
streams, and frozen inputs are sealed anonymous memfds; the candidate and
publication alias stay named for installation on the target filesystem.
Checked tools receive direct /proc/self/fd/N paths. Both caller modules pass
all 10 tests on Windows and through WSL. The normal bootloader Make edge now calls that transaction
with the production manifest and full checked-seed closure. Standalone
CupidASM overrides cannot bypass the
guard. ADR 0283 records the cutover.
Raw CupidASM requests accept one source ORG and one source section identity.
An equ preamble is sectionless, so the first section-bound statement or
explicit section directive makes the section claim. The same section may be
selected again. A duplicate ORG or a switch to a different section fails at
that directive with a stable diagnostic, clears the assembly result, and
leaves the hosted destination unchanged. ELF32 and fixed-image requests keep
their multi-section layouts. ADR 0285 records the boundary.
The ISR and context-switch rules call the promoted CupidBuild seed directly. Each operation freezes the source and six-tool seed, validates a private i386 relocatable with executable bytes, and runs strict CupidDis over every executable section. Drift or a failed tool leaves the prior object in place. This closes the earlier gap in which the final kernel check ran only after both public objects had already fed the link. ADR 0286 records the guarded boundary, and ADR 0354 records direct publication ownership.
Source-head CupidASM also accepts align POWER_OF_TWO[, FILL_BYTE]. Raw
output aligns the absolute ORG address, ELF32 output carries the required
section alignment, and fixed images include the absolute region base in the
calculation. NOBITS padding consumes memory but no file bytes. The FPU demo
now declares its 16-byte FXSAVE requirement directly. This language change
does not move a build owner or add a host dependency. ADR 0197 records it.
The checked seed includes the complete 83-root Doom compiler frontier,
current GNU entity metadata, the active x87 and SSE memory forms, descriptor
and segment assembly, every represented assembly effect in libm.cc, the
exact dglibc jump block, pointer-preserving static address casts, explicit
double to unsigned long long conversion, exact naked IPI entries, runtime
floating truth, runtime and static integer to long double conversion,
canonical static x87 payloads, static long-double arithmetic, ordinary
float and double updates, and Cupid's native type spellings. CupidASM and
CupidDis carry the 604-row, 249-mnemonic shared x86 catalogue with fingerprint
55A8970F, signed x87 integer conversion forms, and canonical SETP and
SETNP. CupidLD retains deterministic PE32 imports. CupidDis also carries
typed raw code and data ranges, strict --require-known inspection, and
indexed decode candidate selection. CupidObj carries installation-source
generation, transactional kernel-symbol source generation, transactional
sequential-JPEG validation, pristine disk-template construction,
deterministic ISO fixture authoring, and profile-manifest authoring.
The preceding strict-relocation stage-four seed came from clean revision
bf52d135348bc33ff32e66d549bbee5edc69d8ad:
| Tool | Bytes | SHA-256 |
|---|---|---|
| CupidASM | 458,256 | 1eb32e11f85bb18d39a122853dfc1ad4a446ae7516e3d810c60d5f90b43fed8e |
| CupidC | 2,666,324 | 8b6b0f0508b1565d095297f3571ef9bb4d444d19be0700165706877b210b087c |
| CupidDis | 413,204 | ff2e345c1000c7e4843b91e5d17d9a171e76b0d6fbae2871ce879b338691555a |
| CupidLD | 312,792 | a2119556894903b662d2e131a9a2436b99a3afdd1b1600a3df4d4669569a0295 |
| CupidObj | 392,688 | 99111b5db7586ac4b2ed00005f2fe2e89c66ed48f007d796206b116a088cdf7a |
The 5,573-byte manifest has SHA-256
d571125256d11dd707f661299738891edc5c1a8d3358554076875a3e0cac22d0.
It binds generation four, the clean revision, the 50-input snapshot
e76d36ed4edc7679e91ac237135fe476dff6e69946bbffca56077afbf19a47f9,
and the stage-three producers. The clean candidate proof passed in 1,294.3
seconds. Stages three and four matched 19 C objects, startup, and five tools,
and both stages passed the 5/18/16 behavior matrix. A 1,473.9-second reproof
from the promoted manifest reproduced all five seed images and passed the
stronger 5/18/17 matrix, including executable relocation ownership. ADR 0265
and ADR 0280 preserve the earlier promotion records. ADR 0292 records the
current strict-relocation promotion.
The earlier v1 Linux seed was:
| Tool | Bytes | SHA-256 |
|---|---|---|
| CupidASM | 462,600 | a6c2f07e722fb4b5152326773a240722d1065785c1110d65c593445b0e88dc80 |
| CupidC | 2,687,436 | 273f2621401878f673cc3d2987e267cf188ed016ac2005dc9573b3242b225094 |
| CupidDis | 476,092 | 2853dfa068af8716dde1e501fb5a6c11e73dcaae182fdba6ca45ef4f2a65fb89 |
| CupidLD | 312,792 | a2119556894903b662d2e131a9a2436b99a3afdd1b1600a3df4d4669569a0295 |
| CupidObj | 392,688 | 99111b5db7586ac4b2ed00005f2fe2e89c66ed48f007d796206b116a088cdf7a |
Its 5,573-byte manifest has SHA-256
b6e34a2e18dd18aba91c6358116eafde39953566efeadb224575ac8c13ab2c1b.
It binds revision a17c9465911da41d59b7ada71733d36c39faa5ea and the exact
50-input snapshot
46c5335c80d822dd5085ee22077486ea647e5396482d42454847c87e4222aa67.
The clean candidate proof passed. It matched 19 C objects, startup, and five
tools between stages three and four; CupidASM and CupidDis differed from the
preceding seed. Both compared stages passed five help, 22 success, and 21
useful failure cases. The promoted-seed reproof reports all five initial
comparisons false because the new startup function types remain in static ELF
symbol tables and flow into every linked tool; its final stages still match
exactly. ADR 0336 records this promotion and reproof.
The first full run of the intermediate 86-test seed suite completed
in 2,394.660 seconds but failed on stale test data. The tiny source roots lacked
the Windows publication_start.asm and publication_runtime.cc inputs now
required by the frozen closure. The v1 Windows CupidASM report also
expected the older four-byte result. The fixtures now include both publication
inputs, and the report expects the current six-byte result with SHA-256
95d76dfca4cb4f279611a6ea7a86202898305a4906c6c822c1bfce2ec9ecf06b.
Six focused source-freeze and PE tests passed in 0.736 seconds. The isolated
fixed-point test passed in 1,187.863 seconds. That suite passed all 86 tests in
2,444.917 seconds. After the relocatable-object cases were added, the ADR 0312
checkpoint passed all 89 tests in 3,145.502 seconds. The complete source-head
module later passed all 92 tests in 2,820.626 seconds. Those v1 seeds carried
that snapshot. The normal kernel publisher applies strict linked-image
target and code-anchor validation before flattening; ADR 0323 records the promotion and
adoption. With the grouped-address and native Windows diagnostic cases
included, the current source-head module passes all 99 tests in 3,377.405
seconds.
The refreshed seed represents operand-free GNU assembly statements inside functions and emits exact PAUSE, NOP, STI, HLT, CLI, CLD, SFENCE, and FNINIT sequences. The normal build uses that path for e1000, the desktop shell, the socket layer, and TCP. The earlier detached hybrid linked the same four objects through both CupidLD passes and booted them under QEMU before the ownership hand-off.
The checked seed handles the exact per-CPU pointer output
mov %%gs:0, %0 with one four-byte =r object or void pointer. The frontend
and IR preserve its pointer type and evaluate the destination once. The x86
model emits 65 A1 00 00 00 00.
The checked seed handles the independent r and c inputs used by
kernel/cpu/idt.cc, kernel/mm/paging.cc, and kernel/smp/lapic.cc.
Exact CR0, CR2, CR3, and CR4 moves and RDMSR emit directly into deterministic
i386 ELF32 objects. The three double-compiled objects are 8,756, 2,336, and
4,184 bytes and pass the shared validator. Focused frontend, Linear IR,
object, and decoder contracts cover the supported forms and their failures
without executing privileged instructions. The normal recipes now compile
all three roots with the checked seed.
The checked seed handles the exact volatile fxsave (%0) form used twice in
kernel/core/process.cc. Its independent r input must be a
four-byte object or void pointer, and the statement must retain its
memory clobber. The emitter places the pointer in EAX and asks the shared
x86 model for 0F AE 00. Two full-profile compiles produce the same
validated 30,216-byte object, with FXSAVE at text offsets 0x1967 and
0x4d7c. The normal recipe now compiles this root with the checked seed.
The checked compiler's atomic slice handles integer load, store, exchange,
and fetch-add builtins with constant orders. Its i386 path selects ordinary
loads and release stores, memory XCHG, and LOCK XADD. That brings
unchanged acpi.cc and mp_tables.cc through i386 ELF32 object emission.
The normal Make graph owns both through the checked seed. Their renamed paths
must pass the final four-vCPU e1000, desktop, terminal, and CupidC runtime
smoke.
The checked seed carries __atomic_fetch_or at the same one-, two-, and four-byte
integer widths. It emits a LOCK CMPXCHG retry loop because LOCK OR cannot
return the old value. Exact byte and execution checks cover a competing
update, signed narrow results, guard bytes, one-time operand evaluation, and
callee-saved EBX. The checked stage-three seed carries this operation and
compiles the active EHCI path.
The checked seed parses all eight helpers in unchanged
kernel/core/ports.h. It retains the 8-, 16-, and 32-bit accumulator lanes,
the 16-bit DX port, the read/write ESI or EDI buffer, the read/write ECX
count, and the INSW memory clobber. Scalar port I/O and the CLD plus REP word
forms emit through the shared x86 model. The checked-seed C11 standalone sweep
passes 161 of 164 active non-Doom headers. scheduler.h, simd_intrin.h, and
the macro-driven exact-decimal test fixture remain exact C11-profile failures.
The checked seed parses all 29 declarations in
unchanged simd_intrin.h under the Cupid profile. Its shared frontend now
recognizes Cupid's sized scalar, Boolean, and vector type spellings directly.
The checked seed retains GNU noinline and the exact
target("general-regs-only") option on compatible file-scope function
declarations. Each IR function carries the canonical code generation mask.
Linear IR rejects compiler-generated floating work in a
general-register-only function, and the emitter repeats the mask and
frozen-metadata checks. Explicit source assembly remains under its own
contract. It also keeps the exact volatile ldmxcsr %0 memory
input as one address-valued 32-bit integer lvalue and emits 0F AE 10
through the shared x86 model. It also keeps the exact MOVSS float-memory
round trip in fpu_boot_smoke() and the matching one-way load and store.
Each form requires the xmm0 clobber, evaluates each object address once,
and emits F3 0F 10 00 or F3 0F 11 00 through EAX. The unchanged
stress_sin() x87 statement is also represented. It evaluates one double
output address before one double input address, permits no clobbers, and
emits balanced FLD, FSIN, and FSTP instructions with no frame
temporary. Two complete builds of kernel/cpu/fpu.cc produce the same
validated 6,620-byte object with SHA-256
14c3ea232b7d4455ceabd561c69293cc5849abae24d9f210aa69d64ed8c8a5cb.
The normal build owns the root through the checked wrapper. A typed policy
decodes fpu_init_cpu(), rejects helper calls and floating work before the
CR4 write, and requires FNINIT before one 32-bit memory LDMXCSR.
Checked-seed CupidC extends the state-memory input seam with exact fldcw %0 and
one addressable, non-atomic 16-bit integer m input. GNU semantics make the
no-output statement volatile even when the keyword is omitted. Linear IR
evaluates the address once, and the emitter produces D9 /5 through EAX. ADR
0258 records checked-seed carriage.
The checked seed represents the exact volatile EFLAGS restore in
simd_cpu_has_cpuid(). One 32-bit r input and one cc clobber reach
Linear IR as checked public metadata. The emitter produces POP EAX,
PUSH EAX, and POPF through the shared x86 model, leaving ESP balanced.
Both unchanged restore statements pass.
It accepts the CPUID statement's fixed EAX input/output overlap.
The a input keeps its original spelling and points to the compatible
write-only =a output in the public operand record. Linear IR checks that
tie, including represented integer types and equal widths. Emission repeats
the check and loads EAX immediately before CPUID. A frozen same-width
non-integer substitute fails transactionally. The checked seed emits the six
packed SSE2 statements in kernel/cpu/simd.cc. It checks their ordered pointer
and 32-bit integer inputs, exact memory and XMM0 through XMM7 clobbers, and
uses Cupid's shared x86 model for every packed instruction. The production
wrapper freezes the source and its seven-header closure. Two checked-seed
builds produce the same validated 8,768-byte object with SHA-256
fd280c321b8eb38a90d4f0982d70b8df0364585e3da322eb2c9de722e071f8d4.
The normal SIMD recipe now uses this checked object.
The checked seed represents the complete x87 round-down statement
in unchanged str_floor(). It requires one modifiable double output, one
addressable double input, and the exact ax plus memory clobber set.
After loading the input, emission reuses its consumed address slot below ESP
for the saved and temporary control words. The pending output address stays
intact. The sequence selects round toward negative infinity for FRNDINT,
then restores the incoming x87 control word before storing the result.
Two exact compiles of the extracted active helper produce the same 420-byte
ELF32 object with SHA-256
448012fe57ec625c6075e97cf91163b994a0443238c5d6bdf25e4b839763f14e.
It also emits the later explicit double-to-uint64_t casts. It
splits the result around 2^32 and uses a 2^31-safe truncation for each word.
The decoder-driven oracle covers positive and negative fractions and the
active range through the largest binary64 value below 2^64. Full unchanged
kernel/core/string.cc compiles
twice to the same 14,460-byte object with SHA-256
d48bb6ea18b7124fbefeaca0d5d5ee8a517db950f21ea88e30ededd6c5c2a577.
The production wrapper freezes the source and its two headers, validates the
ELF32 object, and publishes it without a host compiler.
Compiler head now represents the exact operand-free BSS-clear statement only
at the direct start of the external .text.start _start() definition. It
keeps the EAX, ECX, EDI, and memory clobbers, requires visible object
declarations for _bss_start and _kernel_end, and rejects a
compiler-managed frame. Frontend depth rejects leading, label-wrapped, and
otherwise nested copies. The emitter installs the fixed stack, writes two
R_386_32 symbol relocations, derives the doubleword count, and clears the
linked range with CLD and REP STOSD.
The following kmain() call uses the reset stack residue and adds no stale
padding. If it returns, the entry disables interrupts and remains in a halt
loop. The 42-byte fixture has three relocations and a 27-byte assembly body.
Two Cupid-built compiler runs emit kernel/core/kernel.cc as the
same 25,920-byte object with SHA-256
ed42676ad0d7f16b1fb83442ead1b0082781324dca719104922099cee34b5ab0.
The normal image built with that object passes the four-CPU frontier gate on
both supported NICs. The production wrapper freezes the source and its
63-header closure, and the normal recipe uses the checked object. ADR 0187
records the coordinated memory-map move.
The checked seed retains GNU naked and __naked__ for the exact IPI
entries. A naked definition must be
void (void) and contain one complete wrapper or panic-loop assembly
statement. The emitter adds no C frame or return instruction. Its direct call
uses one typed R_386_PC32 relocation, and the panic loop uses a local
relative jump. Two exact-profile compiles reproduce an 8,444-byte object with
SHA-256
806509a6dd1ac7eb34b7ffcb67a1f8852950663a274145584d0260da76dcba54.
The earlier smp.c proof produced an 8,444-byte object with SHA-256
806509a6dd1ac7eb34b7ffcb67a1f8852950663a274145584d0260da76dcba54.
The production kernel/smp/smp.cc object remains 8,444 bytes and has SHA-256
bd3189b2a1a6d15728c559172f5d6acca0889103428085cec8cc1024742a22d1.
The existing __FILE__ diagnostic accounts for the difference.
The strict non-Doom portion of the normal image has 157 checked CupidC
transforms: 156 checked-in sources and the generated
kernel/cpu/ksyms_data.cc source. All 157 sources use .cc. The 83 Doom
roots bring the normal checked-in total to 239. The five shared Toolchain
roots also belong to the 22-source i386 Linux fixed point. Native GCC and
Clang rules select C with -x c only for optional oracles. ADR 0124
records the first 111-root transfer, ADR 0126 records the complete
fixed-point rename and old-seed proof, ADR 0129 records the lexer transfer,
ADR 0135 records the Nuked OPL3 transfer, ADR 0139 records the JPEG and
glyph-raster transfer, ADR 0167 records the FPU and SMP transfer, ADR 0176
records the libm transfer, ADR 0180 records the kernel entry and SIMD
transfer, and ADR 0181 records the string transfer. No strict checked-in
kernel or driver root remains host-owned.
The checked seed accepts ordered -include inputs through both the native
and Cupid-built driver. That command reproduces both complete audited Doom
preprocessing profiles without source-shaping workarounds. It also
retains the sound driver's empty volatile memory barrier without emitting an
instruction. An integer-only IEEE evaluator folds the unchanged static
fixed-point table in kernel/doom/src/am_map.cc without a host floating
operation. A one-active-member union initializer also emits
kernel/doom/src/info.cc. An explicit --doom-compat switch represents the
five calls in i_system.cc that precede a declaration and permits the eleven
audited, bit-preserving conversions between unqualified function pointers and
unqualified four-byte data or void pointers. Strict C and plain GNU mode
still reject those implicit conversions, and explicit function/data casts
remain outside Linear IR. The checked seed retains member provenance while
narrow unsigned int color fields promote to signed int in
kernel/doom/src/i_video.cc. It emits all 80 Doom-tree objects.
The production wrapper also emits the three compatibility roots. It keeps the
explicit static string cast in doom_libc_stubs.cc and emits the exact
dg_setjmp and dg_longjmp file-scope block through Cupid's x86 model. A
second checked-seed compile matches the first for all three objects. The
normal graph owns all 83 roots through CupidC, and every source uses .cc.
The wrapper fixes exact three-source and 80-source allowlists and freezes all
304 .h and .inc inputs. Its input manifest detects source removal,
while the wrapper recursively checks visible .c and .cc files and live
bytes before publication. A legacy .c file, an unlisted .cc file, header
drift, a symbolic link, or an NTFS junction fails closed. The 52,004-byte
g_game.cc object has SHA-256
51aff2138ff2ee51bae9cc18e1dcc415567c6be1699ef0ef6f1ed2b009c30df1
and keeps two R_386_32 relocations with addend 4. The 67,155-byte dglibc
source produces a 93,332-byte object with SHA-256
e2496b01c93a7858a0c035b53aea0ad834d95d2be3f7ae49574d1759ebec34d6.
Repeated compatibility compiles also reproduce the 17,084-byte libc-stub and
10,352-byte platform objects. The 72,950-byte closed profile manifest has
SHA-256
eeb25fe8855563247c29bdd08a4fcc880ac023d37df810969251ba63177223f8.
Checked-seed CupidObj reproduces that manifest through profile-manifest. The
command reads one bounded CUPROF1 snapshot, hashes the 304 captured inputs,
and emits canonical JSON for both profiles. At the preceding seed checkpoint,
the matrices had 28 failure, six help, and 35 success groups on Linux, plus
17 failure, six help, and 22 success groups on Windows. The typed CupidBuild
transaction and checked CupidC runner extended the source definitions to
31/7/37 and 19/7/24 before their seed promotion. These checks include SHA
padding boundaries, unsafe paths, case collisions, and preserved failure
output. The earlier Python wrapper derived the snapshot and independent
oracle from one stable capture, ran CupidObj from the frozen seed, and
required byte parity. Its no-follow lock guarded input, seed, candidate,
parent, and output rechecks before unchanged or atomic publication. ADRs 0382
and 0383 record the repaired seed and current native transaction. CupidObj authors
the production bytes; Python retains discovery, native-path checks, freezing,
parity, drift detection, locking, and publication. ADR 0242 records the format
boundary, ADR 0243 records seed carriage, and ADR 0244 records production
ownership.
Full IWAD gameplay remains a separate runtime gate.
Checked-seed CupidC represents GNU returns_twice on file-scope function
declarations. Marked functions must remain direct call targets. Supported
calls use four-byte cdecl arguments and may return void or any nonaggregate
type. The emitter preserves live four-byte expression operands in call-owned
frame slots. It rejects a live-prefix site that any returns-twice continuation
can reach again, while a call with no live prefix may repeat. Aggregate,
wide-integer, and wider-than-four-byte floating arguments, aggregate results,
and marked-function pointer conversions fail explicitly.
Active dglibc uses the corrected template. Its 31-byte dg_setjmp saves
ESP + 4 and is returns_twice; dg_longjmp, dg_exit, and dg_abort are
noreturn. The decoder oracle models both returns, and the guest self-test
executes direct longjmp plus two quit and two error sessions. Callback order,
error filtering, and cleanup between shell launches are checked directly.
This changes no production owner or host dependency. ADR 0212 records the
compiler boundary, ADR 0213 its promotion, and ADR 0214 active adoption.
Doom's active config and game-save paths now write checked temporary streams
and use native same-mount VFS rename. HomeFS and RamFS reject busy
replacement. Failed block-cache fills leave the victim's bytes and identity
paired. FAT16 propagates cache errors, distinguishes handle exhaustion from a
missing file, rejects file/directory collisions and live-entry replacement,
enforces its one-level 8.3 namespace, and flushes a replacement or deletion
before releasing the detached chain. HomeFS rejects malformed containers and
duplicate mounts, reserves HOMEFS.SYS against raw writes and deletion, and
supports nested mutation batches with one durable outer publish. Buffered FAT
close and the high-level write/copy helpers treat close as the commit boundary.
Asset-free tests exercise every one of these paths. ADR 0211 records the
storage boundary; power-cut injection and WAD-backed save/load remain open.
The checked seed resolves the C11 inline declaration set in
kernel/audio/nuked_opl3.cc. The ordinary declaration in its header means
the later inline body provides a global OPL3_Generate4Ch definition. Two
kernel-profile compiles produce the same validated 40,424-byte object with
SHA-256
a3a04ade4029d9333902bb93376fb5eef21f349ee5a1406bd0751cc4cee9f2a1.
The object imports only memset. Prior static linkage remains internal, and
an external-linkage inline declaration requires a definition in the same
translation unit. The closed production recipe, frontier, image builds, and
dual-NIC runtime gates pass. The wrapper compiles from a private copy of the
source and its three headers, then rejects live input drift before it replaces
the object.
The strict cohort now contains 156 approved sources. The latest complete
two-pass proof predates the last addition and covers 155 sources.
Forced Make runs with the host compiler command poisoned cover every
production wrapper recipe, and each recipe lists its exact recursive header
closure. A valid data-only object can omit .text when its other sections
and symbols pass validation. Final frontier publication retries only short
permission-style directory locks with five bounded delays. A persistent lock
or any other filesystem error publishes nothing. Input discovery skips hidden
paths under active include roots, so private compiler staging headers from a
concurrent build do not enter the repository snapshot. That complete frontier
compiles all 155 roots twice against a 445-file snapshot with SHA-256
99d03de14f544f6a76d21ed147e62018873f1e2e8dfa2f4459830b69314432c2.
Both object sets are byte-identical; each totals 3,749,796 bytes. The combined graph passes the
two-link symbol and memory checks, clean normal and partitioned image builds,
and strong four-vCPU runtime gates with both NICs.
The current 156-source production build passes. The broader two-pass frontier
targets 156 sources and 312 checked compilations. Its latest rerun exceeded
2,340 seconds without a compiler diagnostic and remains incomplete.
Checked-seed CupidObj generates three installation tables, and checked-seed
CupidC compiles them. CupidC also compiles the three example external ELF
programs. All six source files use .cc names. The generated tables keep the
kernel profile. hello.cc, ls.cc, and cat.cc use the closed user profile.
CupidLD links each private ELF, then CupidDis requires known instructions,
valid local targets, and valid static code anchors before publication. Linux
runs the checked bootstrap seed directly. Windows
freezes a 26-file source and control closure and the six-file PE seed
separately. Checked CupidC, CupidASM, and CupidLD build a private ABI contract,
validate it, and run it directly against the same six-file snapshot as the
Python oracle. The operation leaves the Linux contract publication untouched.
Checked native CupidC, CupidLD, and CupidDis then perform output compilation,
linking, and inspection. The compiler and link transaction
freeze their complete input and control sets and pass the same frozen
six-tool capture to the shared runner. It verifies the complete live cohort
after CupidC, CupidLD, or CupidDis returns. Both wrappers validate every ELF result and
replace an artifact only after the operation succeeds. The default frontier
tracks 23 checked-seed inputs. An explicit 46-input Windows frontier runs
private native hosted CupidC and CupidLD snapshots. It requires all six files
to match checked-seed output.
CupidObj now implements the bin, docs, and demos table formats through its
public install-source command. It keeps caller order, validates the path
category and extension, rejects duplicates and mixed lists, applies one
overflow-safe 512-path limit across the complete request, and rolls back a
partial result on failure. Mixed home-asset extensions retain their supplied
order in the checked seed, source head, and Python oracle. The active
inventories already satisfy both rules. A Cupid-built
command reproduced all three live tables twice with exact Python-oracle
parity. The normal Make recipes now run that checked command for all three
outputs. tools/hostbuild.py is no longer a prerequisite or recipe owner for
them, but it remains the parity oracle. ADR 0204 records the transfer, ADR
0206 records the linked-symbol contract, and ADR 0208 records the earlier x87
seed carriage. ADR 0228 records the first SHRD-carrying seed, and ADR 0234
records an earlier seed. ADR 0280 records the preceding seed, and ADR 0292
records the following strict-relocation seed. ADR 0318 records the preceding
linked-image seed, ADR 0323 records the preceding code-anchor seed, and ADR
0336 records the parent v1 seed. ADR 0353 records the paired v2 contract, and
ADR 0367 records the preceding pair, and ADR 0370 records the preceding pair; ADR 0393 records the active pair.
The checked seed, source head, and Python oracle also compare the full wrapped
symbol name for every typed entry. Distinct paths that collapse to one symbol
fail before publication. The exact same BMP may remain in both the docs and
home lists, where both entries use the same object. Every normal
installation-table recipe now enforces this guard.
Before compilation, the user ABI operation captures the exact bytes of its six kernel and public declarations. It compares the reviewed i386 layout and rechecks every input before reporting success.
The external-program runtime gate boots the validated hello, ls, and cat
executables separately through the ordinary loader. Each QEMU process gets a
private copy of the same staged image. The cat copy also receives a fixed FAT
fixture at /home/readme.txt. Serial events carry the running PID. Print
events record a byte count and FNV-1a fingerprint instead of caller text,
which keeps newline and marker-shaped file contents inside one event. The
checks cover hello's numeric writes, ls reading the shell root, cat reading
the fixture, and a PID-matched exit from each program. Kernel and JIT printing
remain on their existing path. ADR 0133 records the ABI and image boundaries.
The refreshed checked seed emits weak symbols and arbitrary compatible named
sections, records unused and used declarations, preserves typed static
null pointers, treats known-true loops as non-fallthrough, and lowers comma
expressions in source order. It also keeps all target bits through represented
function-pointer casts and supports bounded output-only register and EFLAGS
snapshots. The checked production wrapper now compiles the generated
kernel/cpu/ksyms_data.cc root. The generator writes little-endian
unsigned int words and records the logical 130,506-byte blob length
separately. Promoted CupidBuild freezes the pass-one kernel and checked seed,
captures canonical text through checked CupidDis, and gives the exact text to
checked CupidObj. Its independent native renderer catches malformed text,
missing output, byte mismatch, lock contention, or live input drift before
atomic publication. The
checked compiler wrapper freezes that source and its header closure before it
publishes the object. The word array ends with two zero pad bytes. The final
kernel retains all 5,161 selected pass-one text-symbol entries. ADR 0224
records the generator handoff.
The checked seed emits the exact volatile
call 1f\n1: popl %0 address capture used by the stack-trace helpers in
kernel/lang/as.cc and kernel/lang/cupidc.cc. The instruction pair is a
zero-displacement CALL followed by POP r32, with no relocation. Both
roots compile twice to matching validated i386 ELF32 objects under the
complete kernel profile. The as.cc object is 148,056 bytes with SHA-256
f05ffb741a81403f3bfb86358b3f96011b2ddef65c87e291f582c1d77b0cedfd.
The cupidc.cc object is 288,180 bytes with SHA-256
4e8501e628a770b346bbe16e23d9549c4320f1f01f0ddcb9309b907a8c898046.
Their normal recipes now use this checked-seed capability. Other call
templates and general inline-assembly labels remain unsupported.
The checked seed also accepts the GNU Nd port alternative in
kernel/cpu/pic.cc. It selects the valid DX branch and emits both unchanged
8-bit PIC templates through Cupid's x86 model. The normal recipe compiles the
root with the checked seed.
The checked seed emits the three machine-state memory outputs in
kernel/core/panic.cc. The exact volatile fnstsw %0 and fnstcw %0 forms
require a 16-bit =m destination, and stmxcsr %0 requires a 32-bit
destination. Linear IR evaluates each lvalue once, and the i386 emitter writes
through that address with the shared x86 model. The exact call-next support
above also handles the later local-label statement in the unchanged panic
source. Two full kernel-profile compiles produce the same validated
10,212-byte ELF32 object. The normal recipe now uses the checked seed.
The last completed audit found 428 active i386 ELF objects. CupidDis accepts every object, including all current symbols and relocations. Cupid-built objects, checked tool images, and user executables have no unsupported instruction fallback. The remaining measured gap comes from a legacy native-oracle kernel and Doom corpus, not an active host-owned build path.
Checked-seed CupidDis turns that census into a typed policy with
--require-known FILE [FILE...]. It counts known, unknown, invalid, and
truncated instructions only in selected code regions, validates every input,
and writes no listing. Both active CupidASM relocatable objects pass while
ordinary output keeps their relocation symbols. The normal kernel path now
runs strict validation and flat extraction against one frozen cohort. Its
9,076-byte LF-only manifest has
SHA-256
4f1936423ae06418fc2f75603c29a91997608fe82f48c323321523aed25a2ab0
and lists 431 unique graph-ordered paths: all 429 audited root object outputs
plus the pass-one and final kernel ELFs. Make keeps every path as a direct
prerequisite. The first separate gate froze and rehashed the preceding 429-path manifest and
inputs. It passed in 185.526 seconds with empty streams and exit 0. The current
hostbuild transaction also freezes the selected seed manifest and all six
artifacts plus the existing kernel.bin boundary. Checked CupidDis validates
the private cohort, then checked CupidObj flattens its frozen final ELF.
Hostbuild rechecks live trust inputs and output before parent-relative atomic
publication. Every failure preserves the prior raw kernel. At the first
reviewed transaction checkpoint, the operation passed with exit 0 in 187.054
seconds and published an 8,946,332-byte
kernel.bin with SHA-256
4f5f2591d01bcc4007773844e9bfb8112a16dd17fbd178014cc2056fefaab67d.
The focused hostbuild suites each passed 31 tests on Windows and in WSL;
platform-specific cases were skipped on the opposite host. Moving private
flatten extraction onto the shared pinned-path helper remains deferred
maintenance.
Source-head and checked-seed CupidDis also check the relocation fields in executable ELF32
object sections. R_386_PC32 must begin at a decoded four-byte relative
field, while R_386_32 must begin at a decoded four-byte non-relative field.
The typed report counts total and unmatched executable relocations, and
--require-known fails on a mismatch even when every byte decodes. Relocations
in data sections do not enter this check. The checked Linux and Windows seeds
carry the rule, so normal object publication enforces it on both supported
hosts. ADR 0290 records the boundary, and ADR 0292 records the promotion.
Promoted-seed CupidDis applies explicit raw control-flow checks in both
production raw-image transactions. --require-local-targets requires
--require-known; these production calls also supply --raw. It verifies
constant relative calls and jumps against the image's instruction starts and
typed ranges. A local-target check on raw input that contains code16 rejects
images larger than 65,536 bytes because wrapped target mapping would be
ambiguous. The report separates targets outside the image, in data, in another
code mode, and in the middle of an instruction.
The 2,560-byte boot image contributes nine local relative, two local far, and
one resolved external far edge. The 4,096-byte SMP trampoline contributes four
local relative, one local far, and one indirect unprovable edge. The source
edge policy rejects a changed destination even when it remains a valid decoded
start. ADR 0300 records the decoder rule, ADR 0305 records earlier raw-image
carriage, ADR 0340 records source-resolved edges, and ADR 0336 records their
v1 promotion and adoption. ADR 0353 records the paired v2 contract, and ADR
0367 records active carriage.
CupidDis also applies the option to static ELF32 relocatable
objects. It gives each executable PROGBITS section its own instruction-start
map and checks unrelocated direct targets against that section. A relocation
at the operand field leaves the destination for link time, while relocation
ownership still validates the field. The report distinguishes targets outside
the section from targets inside an instruction. Checked-seed ET_EXEC still
receives the focused rejection. Both active CupidASM objects pass the check.
The promoted seeds carry it, and production object publication selects it
before replacement. ADR 0309 records the source boundary, and ADR 0312 records
carriage and adoption.
Checked CupidDis also applies the option to linked i386 ELF32 images. It
scans nonoverlapping file-backed executable load regions twice and accepts a
cross-region target only when it lands on an instruction start. Failures
distinguish an address outside loaded memory, loaded memory without file-backed
executable code, and the middle of an instruction. A PT_DYNAMIC or
PT_INTERP header rejects the image as outside the static certification
domain. Typed and CLI negative cases cover both forms. The normal kernel
transaction applies the linked rule to its frozen pass-one and final ELFs
before CupidObj flattening. ADR 0314 records the decoder boundary, and ADR 0318
records seed carriage and production adoption.
The generated active-source audit and its check both pass. The Linux audit records 23 failure groups, six help groups, and 29 success groups. The Windows audit records 12 failure groups, six help groups, and 16 success groups. Candidate and promoted-seed fixed-point proofs cover the preceding linked-image behavior on Linux and Windows.
Checked CupidDis provides --require-code-anchors for static ELF objects and
linked images. An object function must name a decoded start in executable
PROGBITS. A linked image adds the ELF entry and file-backed executable
regions. Function aliases count separately. The local-target and code-anchor
policies share one instruction-start map when selected together. Production
checks the ISR, context-switch, hosted startup, and linked kernel boundaries.
ADR 0320 records the linked source boundary, ADR 0335 records the object rule,
and ADR 0336 records its v1 promotion and adoption. ADR 0353 records the paired
v2 contract, and ADR 0367 records preceding carriage, and ADR 0370 records active carriage.
The poisoned-host normal make -j2 then passed in 1,057.969 seconds. All
eleven host code-generation variables named invalid commands, and that
historical build ran the separate strict gate before CupidObj flattened the
kernel. It produced these
outputs:
| Output | Bytes | SHA-256 |
|---|---|---|
boot/boot.bin |
2,560 | 46cc9778da2b5cc5e8f04d7cc4b07243c3e07d466626ad84fb813dc6fef3a0d3 |
kernel/kernel.elf.pass1 |
9,039,936 | b21fa8954499a7857ee4b12fa3950fcc08ff3c6a6234c8ae72effc38c51fdc6d |
kernel/kernel.elf |
9,162,816 | a0b57cd886369762b65d657bb3f2915ada8f30b52102535add89466eaf4f5976 |
kernel/kernel.bin |
8,946,332 | 4f5f2591d01bcc4007773844e9bfb8112a16dd17fbd178014cc2056fefaab67d |
cupidos.img |
209,715,200 | 4548005bd0aa1a3cffb74620c2309d53c6b291ea2505ed187034bf6b13f1bb37 |
On 2026-08-13, a preceding poisoned-host make -j2 all build completed
through the checked native Windows execution seed. The command harness stopped
the first invocation after 602.5 seconds; the resumed build finished in another
968.5 seconds, for 1,571.0 seconds of cumulative build work. These artifacts
superseded the earlier identities above when this checkpoint was recorded:
| Output | Bytes | SHA-256 |
|---|---|---|
boot/boot.bin |
2,560 | 46cc9778da2b5cc5e8f04d7cc4b07243c3e07d466626ad84fb813dc6fef3a0d3 |
kernel/kernel.elf.pass1 |
9,056,612 | e2f63b5cd9c4e2769b9d6bc893ab5cf778951b97aec954ece6cbac0cc429e92a |
kernel/kernel.elf |
9,179,492 | 1bc06263dbf9849e6d2c594b6fb4be2a3f3b673c91f69d23a2d2e639b1f64776 |
kernel/kernel.bin |
8,962,776 | 3170aa71eafa656b1f6e23c918f1f472860f513c9c5cd0376d7d4f5f8a7d891c |
cupidos.img |
209,715,200 | 3b5dd6523a90d6ed0543a6ab2464892f3289b876654f9869f88db0901940b91e |
The exact-size prerequisite accepted all nine artifacts before image
publication. A four-vCPU RTL8139 frontier passed from this image in 820.7
seconds. All four CPUs came online. Private CupidC emitted the broad indirect
update marker, compiled /bin/feature13_derived_aot.cc, loaded the resulting
ELF as PID 4, emitted
[feature13-derived-aot] PASS score=41 once=2 zero=0x80000000, and reported
that same PID exiting. The 640 by 480 framebuffer changed 96,101 pixels. AC97
produced 33,452,396 frames at peak 25,600, and the PC speaker produced 76,614
frames at peak 31,877. USB detach/replug and the post-replug survival window
also passed. The private run left the source image unchanged.
The private CupidC source accepts direct file-scope function-pointer typedefs in free-function parameters, Cupid class method parameters, and declaration-initialized automatic objects. Each automatic declarator gets an independent signature copy. JIT, AOT, and persistent REPL compilation retain the callback result, fixed and variadic parameters, record identities, and prototype state. The call reuses direct cdecl coercion and 4-, 8-, and 16-byte layout, including SIMD results through XMM0. A file object declared directly with the typedef keeps the same signature across null or compatible function initialization, checked plain assignment, indirect call, and null clearing. A defined function address is written into initialized data. A later definition receives an absolute data patch before JIT or fixed-address AOT execution. A structure or class field declared directly with the typedef keeps the signature for checked stores, copies into named callbacks, null checks, and clearing. Direct, nested, and indexed record-array member paths share that behavior. Raw callback fields retain the same signature. Direct postfix calls through either field form use typed fixed and variadic cdecl conversion and evaluate the designator once. Typedef-backed callback arrays on structure and class fields retain the signature through indexed stores, named copies, and direct calls. Each index is evaluated once. Raw callback scalars with static storage use the initialized-data path at file scope, block-static scope, and persistent REPL scope. One-dimensional raw callback arrays work in those same contexts with a fixed count or a count inferred from a nonempty braced initializer. Known functions are written into their four-byte slots, later functions receive absolute data patches, null entries remain zero, and omitted fixed-array entries are zero-filled. Indexed stores and calls retain the signature and evaluate the index once.
A fixed callback parameter may itself have a retained callback signature. Raw nested declarators use child handles from the raw-signature pool, while typedef-backed children keep their typedef handles. Compatibility checking walks those handles recursively across initialization, assignment, higher-order arguments, indirect calls, conditionals, and matching function declarations or definitions. Each level checks its result, fixed parameters, record-pointer identities, and variadic boundary. Compatible uses keep the existing unprototyped callback rule, while declaration and definition matching also requires the same prototype state. Raw and typedef children may be mixed when the applicable structure agrees.
The nested callback remains one four-byte i386 cdecl argument. Private CupidC
accepts 16 signature levels. A 33-record backing pool uses one record for the
active kernel callback and preserves 32 distinct source signatures. A rejected
depth, capacity, or structural mismatch restores the pool and the surrounding
source or REPL state. The active
void (*p_icon_set_drawer)(int, void (*)(int, int)) binding supplies
set_icon_drawer from kernel/lang/cupidc.cc. It retains void(int, int) and
places that handle in the outer native descriptor. The production compiler
source continues to be built by checked-seed hosted CupidC; retaining this
shape in the private parser does not transfer it to in-OS CupidC.
The private compiler now exposes a public registration seam for reviewed
native signatures. It copies the existing result, record, fixed parameter,
prototype, and variadic fields onto a kernel symbol only after validating the
whole descriptor. Typed SYM_KERNEL calls reuse the existing cdecl conversion,
layout, cleanup, arity, promotion, and return paths. Console, string, port, all
50 libm bindings, and set_icon_drawer form the reviewed cohort. The icon
setter retains its child through the same public seam. A malformed, corrupt,
over-depth, or over-capacity child descriptor consumes no new record. A
rejected outer registration consumes no symbol, and a valid operation can
follow in the same state. Unreviewed bindings retain their legacy source-width
behavior. This private change moves no object owner or host dependency. ADR
0332 records fixed signatures, and ADR 0333 records the nested binding.
The source contract matches the active six-entry wipes table in
kernel/doom/src/f_wipe.cc. Its three phases select wipeno*3,
wipeno*3+1, and wipeno*3+2. Fixed-size automatic raw callback arrays use
cleared local frame storage and retain their signature through brace
initialization, indexed stores, copies, and calls. Unsized automatic arrays,
raw callback array parameters, raw callback arrays in records or classes, and
multidimensional raw callback arrays remain unsupported. Alias chains,
conditional field values, aggregate results,
and arbitrary computed callback expressions remain outside this typed path.
ADR 0325 records direct field calls, ADR 0328 records callback field arrays,
and ADR 0330 records data-backed raw callback arrays and block-static scalar
callbacks. The production Doom cohort remains built by checked-seed hosted
CupidC. This private compiler capability does not transfer that cohort to
in-OS CupidC, promote a seed, or remove a remaining bootstrap dependency. The
AOT writer uses one executable
PT_LOAD for zero-data programs and adds the writable data segment only when
data is present; code begins at file offset 0x80 in both layouts. Focused
private compiler contracts cover these source decisions. The exact
artifact-size policy covers sixteen paths, including all six Windows seed
executables. One wrapper captures the Linux policy manifest and the full
Windows seed cohort before it runs the checked contract. Its CUPSIZE2
request lets the C contract validate the Windows target, provenance, Linux
parent link, exact six-tool inventory, and observed sizes and digests. The
historical schema-v3 CUPMAN4 publication and final CUPMAN2 verification
for this checkpoint are recorded above. Its build and private guest evidence are
recorded below.
At this checkpoint, the artifact-size modules contained 54 tests. They passed
with four platform-specific skips. The checkpoint's artifact contract passed
against all sixteen exact artifacts. Its 3,382-byte policy had SHA-256
78d1d4cc4b5411cc73523b88166e75fba876b2cd78f1d9c9118b1367fa86ec21
and covered 38,144,480 bytes across those paths.
| Checkpoint artifact | Bytes | SHA-256 |
|---|---|---|
kernel/kernel.elf.pass1 |
9,605,148 | e54c2fcefb432bc0cab314411a4dfb0dda377169c613497487f0eb6ec75c4b63 |
kernel/kernel.elf |
9,736,220 | c4004b2b9b003b8c0174a32d11948a228b50ec57e97d69532c2c514834adc436 |
kernel/kernel.bin |
9,507,804 | 2efdc4df2a71cc6e889acd67f9322bf449692ee046d089762df3575dba90143f |
cupidos.img |
209,715,200 | 1276de1dc03ed01cbcc90e95e9a4d0b71abd0751bd9c74251ab0ccac2719c9bc |
That normal build passed the exact policy and strict 431-input
local-target and code-anchor scan. It preserved the image's FAT contents while
staging hello.iso. A private four-vCPU max and E1000 copy brought all CPUs
online and completed the full graphics, audio, and in-OS CupidC frontier. The
framebuffer changed 69,823 pixels; both audio captures were non-silent. Its
147,526-byte log has SHA-256
252d3ef3796233cd752754c19aaa85a7311010bd75d0d5d57264fd6919584b56
and no rejected runtime marker.
The preceding source-head cohort used the same pass-one and final ELF sizes
with SHA-256 values
c694ba70e37e711c6490db2f17fb1869300c26703017cb1bd8adb3b51cce1c60
and bbdb974acc12bf57dd95bff4f734ad9ad75dd8d11dfec3267a22df455666f459.
Its 9,504,760-byte raw kernel had SHA-256
346063e08f2fef5550e2a40b8edb1ea7cbe2f242a3084f1137a9552ed7baf84a,
and its disk image had SHA-256
aa9bc411d48625837b511b32444019f0aa555a48fc5aaa2400c9259dd8607333.
Its private four-vCPU E1000 frontier smoke left the source image unchanged.
The framebuffer changed 101,335 pixels. AC97 produced 36,533,414 stereo 44.1
kHz frames at peak 25,600, and the PC speaker produced 79,215 frames at peak
30,937. The guest reported
[feature14-callback-raw-automatic-array] PASS zeroed=4 initialized=2 assigned=1 copied=2 later=1 calls=4.
The 143,084-byte serial log has SHA-256
6b5c6a4ca5daf9f19ec099d45609f385e0cf983f945a40433ebc3f1921e8ffab.
The first nine-artifact checkpoint on this path guarded the normal boot edge
with a CupidC-built artifact-size contract. All 443 root transforms had a
Cupid participant. Its first poisoned-host build reached the new gate in 695.8
seconds and rejected the embedded-manual change that made kernel.bin 436
bytes larger. After that one policy row moved, a complete poisoned-host rebuild
passed in 693.5 seconds. The contract report matched the independent Python
oracle, and all nine exact artifacts passed at that checkpoint.
The fixed SIMD call boundary then changed the private compiler, feature-14
guest, and embedded manuals. Its first poisoned-host build reached the
exact-size gate in 659.6 seconds and measured both ELFs 8,228 bytes larger and
kernel.bin 8,252 bytes larger. A 600-second replay allowance expired during
strict inspection and is not counted as a result. The direct contract passed
in 12.4 seconds, and an uninterrupted poisoned-host build passed in 668.5
seconds.
The named local callback boundary then expanded the private compiler, feature-14 guest, and embedded manuals. Review discarded an intermediate image whose build predated the settled CTXT text. The settled poisoned-host build reached the exact-size gate in 690.910 seconds and reported only the pass-one ELF and raw-kernel changes. All 38 artifact-size policy and semantic-contract tests passed in 2.650 seconds, with two Windows replacement cases skipped because pinned handles already deny those operations. A repeated poisoned-host build passed in 692.768 seconds and published that checkpoint's image.
At that checkpoint, Toolchain manifest verification ran through a checked
CupidC contract.
The final 21-artifact publication passed in 3,933.424 seconds. Its 22,931-byte
manifest has SHA-256
8909105d516ef53d3c5081e5752fbef8596458fdfa673ec08275e7e435cd059a.
An earlier final-source poisoned-host build reached only the exact-size gate in
633.542 seconds and measured kernel.bin 1,188 bytes above the prior policy.
After that row moved, all 38 policy and semantic-contract tests passed in
2.784 seconds, with two Windows replacement cases skipped. The repeated
poisoned build passed in 651.193 seconds and published that checkpoint's image.
| Earlier checkpoint output | Bytes | SHA-256 |
|---|---|---|
boot/boot.bin |
2,560 | 46cc9778da2b5cc5e8f04d7cc4b07243c3e07d466626ad84fb813dc6fef3a0d3 |
kernel/kernel.elf.pass1 |
9,299,616 | 7fe8556bae4262a1c16a206182b704310791874cb9d8ac61be6b9c5f671d2b90 |
kernel/kernel.elf |
9,422,496 | 8ceee43d12586d9fff73f1752940d295a2fc20e9e6364e37d7078c6ca2418027 |
kernel/kernel.bin |
9,203,248 | 403034fe4d727bba0fc4ee15545b5bc6f47840c541e95761f9cdc841ce19372f |
cupidos.img |
209,715,200 | 3a2e5acc63b50d27aca68e4e7e8872adbfcab96674040a08a22c2c6aa614bebc |
A private four-vCPU e1000 boot compiled /bin/feature14_simd.cc through in-OS
CupidC and passed the SMP runtime contract in 61.926 seconds. The guest printed
[feature14-call] PASS float4=4 double2=2 nested=2 calls=6,
[feature14-callback] PASS float4=4 double2=2 calls=2, overall PASS, and clean
JIT completion. Its 33,483-byte log has SHA-256
1bfea969c354abd447aada31982011082538fe1de6a9ea1dff61927bd76c73bb.
The private run left the source image unchanged.
The preceding poisoned-host make -j4 all checkpoint passed in 684.260 seconds.
All fourteen exact artifacts passed the policy. The 2,960-byte policy had
SHA-256
b23bdcb3757a7ddc2a49eeef51cad48cdbd6899f0080c75896b67ef0c665da6e.
Its 39 focused tests passed in 2.739 seconds, with two skips. These figures are
retained as checkpoint history.
| Preceding checkpoint output | Bytes | SHA-256 |
|---|---|---|
boot/boot.bin |
2,560 | 46cc9778da2b5cc5e8f04d7cc4b07243c3e07d466626ad84fb813dc6fef3a0d3 |
kernel/smp_trampoline.bin |
4,096 | b738ebb68f28b9b07e330761f4e9a7898f0424ab0a3835cd6079ae7d4a189e90 |
kernel/kernel.elf.pass1 |
9,320,424 | 3f9a1c681fbcfb1aa453e42a9d77ed1069b9a487110c9ec22ac318d278bdd1e6 |
kernel/kernel.elf |
9,447,400 | 92d4e2f890b657c9881eb2184c7f8f9f0e96b18b5b060dbabab17e7ea305b1ce |
kernel/kernel.bin |
9,224,756 | 4d53e0456d8e63e140f6dcab135765662d12df6e4a83b246409572501f3b4cbd |
cupidos.img |
209,715,200 | 43409d159d2da70feb20deccda0d79a695c6ab56d87a179fe21a66ab40c5eedd |
A private four-vCPU max/e1000 smoke of that image passed in 64.601
seconds. It printed the callback markers in this order:
[feature14-call] PASS float4=4 double2=2 nested=2 calls=6,
[feature14-callback] PASS float4=4 double2=2 calls=2, and
[feature14-callback-typedef] PASS float4=4 calls=1. The overall
PASS feature14_simd and [cupidc] JIT execution complete markers followed.
No reject marker appeared, and the source image was unchanged. The 33,219-byte
log has SHA-256
e39a1905002c2baa483c65eb6e763f4f62907c22f8954873dbb20f4ba5a53e93.
The pre-documentation artifact gate passed in 651.3 seconds and accepted all
fourteen exact paths. It measured kernel/kernel.bin at 9,225,092 bytes. The
pinned contract runner passed 24 tests in 27.752 seconds, and the complete
artifact group passed 45 tests in 2.557 seconds.
The preceding integrated fully poisoned make -j4 all first reached the exact-size gate
with three rebuilt kernel outputs. The artifact group passed all 46 tests in
4.160 seconds, with four expected Windows skips. After the pass-one ELF, final
ELF, and raw kernel policy rows were updated, the repeated build passed in
874.531 seconds. All fourteen artifacts matched the exact-size policy,
existing FAT contents were preserved, and hello.iso was staged.
| Historical integrated output | Bytes | SHA-256 |
|---|---|---|
boot/boot.bin |
2,560 | 46cc9778da2b5cc5e8f04d7cc4b07243c3e07d466626ad84fb813dc6fef3a0d3 |
kernel/smp_trampoline.bin |
4,096 | b738ebb68f28b9b07e330761f4e9a7898f0424ab0a3835cd6079ae7d4a189e90 |
kernel/kernel.elf.pass1 |
9,345,464 | 5dbd2c5acb7b1604cf6daf6f311e88015d0762125c60920da3737d7e10d76f06 |
kernel/kernel.elf |
9,472,440 | 5810ddcb963cfadb4fea3b1343bb38c17ce3f762a48f25615b3feb653f1638e3 |
kernel/kernel.bin |
9,251,100 | 4014b1b2acf34be4dd7483fb8aa9e8a8b0e76eea771c83669571cbf7b66fe0e3 |
cupidos.img |
209,715,200 | 31b25b6881419b1bb8a04b2b3765323b21c5706ac114af1a07b514dcdcd07ea3 |
bootstrap/artifact-size-policy.json |
2,960 | 7b12be6d0dd33f9016ecb4287f5c9414e1da79ffc61e7957aab60cea94850474 |
The integrated strong full private frontier smoke passed in 883.513 seconds
with e1000, four max vCPUs, SMP and frontier checks, and the private USB
fixture. The 640-by-480 framebuffer changed 89,630 pixels. AC97 produced
36,877,878 stereo 44.1 kHz frames with a peak of 25,600, and the PC speaker
produced 76,251 stereo 44.1 kHz frames with a peak of 29,912. The expected
direct-call, named-callback, typedef-callback, global-callback,
automatic-callback, and overall feature14 PASS markers each appeared once and
in order. The feature run then printed a clean JIT completion. The 161,418-byte
log has SHA-256
bc30f5083b96a36362bec5975c0a88437c4f23515de329328bb03d8f6c3e9326.
The source image was unchanged at SHA-256
31b25b6881419b1bb8a04b2b3765323b21c5706ac114af1a07b514dcdcd07ea3.
The preceding dual-NIC checkpoint used image SHA-256
326844ca58c1f864a6b9a2480dfaeb5ed71ec3df22cdb46da17a6bb356e7e726.
Both runs used the partitioned USB fixture, --smp 4, --cpu max, SMP and
frontier runtime verification, a private image, and a 300-second phase
timeout:
| NIC | Result | Framebuffer | AC97 | PC speaker |
|---|---|---|---|---|
| E1000 | PASS, exit 0 in 725.058 seconds | 640 by 480, 103,673 changed pixels | 29,608,822 frames, peak 25,600 | 76,784 frames, peak 30,710 |
| RTL8139 | PASS, exit 0 in 725.406 seconds | 640 by 480, 106,151 changed pixels | 29,601,879 frames, peak 25,600 | 76,719 frames, peak 31,501 |
Those private-image runs left their source image unchanged.
The earlier dual-NIC four-vCPU frontiers remain pre-freeze runtime evidence.
E1000 exited 0
in 794.034 seconds, and RTL8139 exited 0 in 758.667 seconds. Both used the
partitioned USB fixture, --cpu max, SMP and frontier runtime verification,
and a private image copy. The framebuffer, AC97, and PC speaker checks passed,
and the source image kept SHA-256
4548005bd0aa1a3cffb74620c2309d53c6b291ea2505ed187034bf6b13f1bb37.
Raw inspection uses an ordered range map with 16-bit code, 32-bit code, and
data kinds. Code ranges enter the shared decoder, while data ranges print as
literal db rows. The active SMP trampoline gate assembles the unchanged
4,096-byte source and marks [0x000, 0x01f) as code16,
[0x01f, 0x210) as data, [0x210, 0x254) as code32, and
[0x254, 0x1000) as data. CupidDis requires every code instruction to be
known before CupidBuild atomically publishes the CupidASM candidate. A failure
preserves the prior trampoline. ADR 0271 records the production gate, and ADR
0357 records direct publication ownership.
The shared catalogue
now covers 16-bit and 32-bit three-operand IMUL through both 69 /r and
6B /r. It also covers ordinary compiler padding from 66 90 through the
ten-byte 66 2E 0F 1F 84 00 00 00 00 00 form. An independent census found
1,100 such multibyte NOPs and 6,610 padding bytes in 74 native-oracle objects.
Across the 228 i386 kernel objects in that corpus, CupidDis
fallback rows first fall from 6,952 in 77 objects to 3,597 in 68 objects.
A private decoder exception then recognizes 568 exact Clang forms with two
through six leading 66 bytes and the fixed
2E 0F 1F 84 00 00 00 00 00 tail. The final scan has 1,901 fallback rows
in 36 objects and renders 1,781 NOP rows. Other repeated prefixes remain
invalid, and CupidASM cannot emit the redundant forms. That historical
host-built census ranked packed-integer SSE2 next. A fresh source-head
CupidDis scan covered 377 active ELF objects across the kernel, programs,
drivers, Toolchain, and user build. Every object decoded, and none produced a
true db 0x fallback row. The active SIMD object already uses the shared
model for its packed SSE2 instructions, so the investigation added no
speculative opcode. The checked seed and source head have 604 catalogue rows,
249 canonical mnemonics, and fingerprint 55A8970F. One deterministic
witness now reaches every encodable row in every legal mode. The 1,202
witnesses pass the real encoder, both real decoders, and exact-form replay.
The same proof checks all aliases, invalid rows, illegal modes, declared row
flags, and 2,641 proper byte prefixes under digest 8C570035. A source-level
selector test runs representative CupidASM output through strict CupidDis
inspection and checks stable canonical aliases. The proof is exhaustive by
form and legal mode; active-source and focused contracts retain broader
operand and value coverage. The catalogue includes
signed x87 FILD and FISTP memory operands at 16, 32, and 64 bits and
canonical SETP and SETNP byte predicates. They keep private CupidC's
floating comparison and truth sequences aligned under CupidDis. The guest
disassembles and executes the bounded test_fpaug.cc parity cases before it
runs the full feature-13 behavior. GUI-mode listings stay visible in the
terminal and are mirrored to serial after the ordinary sink and redirection
checks, so the runtime proof reads production CupidDis output rather than a
separate oracle.
ADR 0258 records the preceding seed, ADR 0259 records the parity rows, ADR
0265 records their checked-seed carriage, and ADR 0298 records the every-form
proof.
The four SHRD
forms cover 16-bit and 32-bit SHRD with register or memory destinations and
either an immediate byte or fixed CL count. Active checked-CupidC objects now
decode their shrd eax, edi, cl sites directly. The forward x87 form encodes
canonical FSUB ST(1), ST(0) as DC E9 for corrected exponent range
reduction. The four preceding x87 forms are 80-bit FLD and FSTP
memory forms, i686
FUCOMIP ST0, ST(i), and operand-free FLDZ, used by represented long double values. File-scope and
block-static scalars, fixed arrays, and complete records may contain
non-atomic long-double leaves initialized with a represented integer constant
expression or a bounded decimal L literal. Exact payloads and padding reach
.bss, .data, or .rodata. The
scalar and aggregate proofs cover both scopes, signed zero, const and mutable
objects, section placement, symbols, malformed metadata, recovery, and
deterministic repeated emission. The hosted runtime reads each target payload
word. Checked-seed CupidC converts between runtime long double and every
signed or unsigned i386 integer width. The unsigned 64-bit correction and
every long-double-to-integer conversion restore the control word they save.
Other integer-to-long-double conversions do not change it. A 12-case runtime
matrix covers every valid precision and rounding combination. ADR
0251 records the static-data boundary, ADR 0252 records the x87 integer forms,
ADR 0253 records runtime conversion, and ADR 0258 records seed carriage.
Compiler head and checked-seed CupidC apply that same conversion during runtime arithmetic, all six
comparisons, and conditional selection for every represented value integer
and enum. Linear IR keeps the usual-arithmetic conversion, and a conditional
converts only its selected arm. ADR 0288 records the source boundary, and ADR
0291 records its fixed-point promotion.
Compiler head and checked-seed CupidC also convert signed and unsigned integers through 64 bits to
float or double through casts, assignment conversion, runtime arithmetic,
all six comparisons, and conditional selection. Inputs through four bytes use
SSE. A wide input uses x87 FILD, applies the unsigned 2^64 correction when
needed, and stores at the requested floating width. The four arithmetic
compound operators accept mixed integer and floating operands in either
lvalue direction, convert the result back to the declared left type, and
evaluate the destination once. The 74-function object proof contains 13,549
text bytes with fingerprint 4FC4077B, 75 symbols, and 135 relocations.
Thirty-three execution cases cover endpoints, precision boundaries,
operators, predicates, both conditional directions, mixed compound assignment
results, and one-time destination evaluation. Hosted CupidC and the checked
Cupid-built driver emit byte-identical objects. ADR 0289 records the wide input
boundary, ADR 0292 records its fixed-point promotion, and ADR 0296 records mixed
compound assignment. ADR 0312 first carried the extension. The unchanged
CupidC images in the preceding linked-image cohort carried it under ADR 0318.
ADR 0353 records the paired v2 contract, and the active cohort retains it under
ADR 0367. No
active source needs the expression shape, so
no normal transform changes owner.
Hosted CupidC forms decimal float and double tokens in a
private 1536-bit integer workspace and rounds once at binary32 or binary64
width, with ties going to even. Public frontend, Linear IR, and ELF32 contracts
cover halfway parity, subnormal and normal boundaries, maximum finite values,
infinity, signed underflow zero, extreme exponents, deterministic object bytes,
and same-job recovery. A complete token may contain 95 characters. ADR 0312
first carried the capability. The preceding linked-image cohort carried it
under ADR 0318. ADR 0353 records the paired v2 contract, and the active cohort
retains it under ADR 0367.
ADR 0293 records the language boundary.
Compiler head also converts static initializers between bounded finite long double and every
represented value integer and an enum whose compatible integer type has the
represented target layout. It packs integer input into exact x87 metadata. For
integer destinations other than _Bool, it truncates long-double input before
the range check. _Bool tests the original floating value. The shared fixture
converts -0.5L to both targets, producing true for _Bool and zero for an
unsigned integer. Integer zero stays ZERO, and the initializer emits no
runtime conversion work. Linear IR checks each INTEGER leaf against the
standard target kind and representation tables. An unwrapped primitive base
must have a recognized standard integer kind with its canonical target size,
signedness, and alignment. Wrapper and base size, signedness, integer, object,
and completeness flags must match. An enum's compatible integer kind must be
recognized. The enum, its unwrapped base, and its compatible type must agree on
those five fields and on alignment. A QUALIFIED node copies referenced
alignment unless it introduces _Atomic. An atomic introduction at any layer
raises alignment to at least the target atomic alignment. An
ALIGNED node requires an explicit, nonzero power-of-two alignment and may
lower the referenced alignment.
_Bool has one payload bit.
The check runs during whole-unit initializer ownership and block-static
declaration lowering. ADR 0254 records this static conversion.
Checked-seed CupidC also folds static long-double truth, all six comparisons,
short-circuit logic, conditional selection, and conversion to or from
binary32 and binary64. One target-only decoder handles canonical x87 zero,
subnormal, normal, infinity, and NaN classes while rejecting pseudo encodings.
Infinity keeps its sign during widening, and NaN uses one canonical quiet
payload at each destination width. The final values stay in initializer
records, so Linear IR publishes no runtime instruction for the shared fixture.
Object contracts pin exact bytes, x87 padding, section and symbol order,
deterministic repeat emission, and same-job recovery. ADR 0255 records static
control folding and finite conversion. ADR 0256 records the canonical classes
and special-value conversion.
Compiler head also folds static long-double +, -, *, and / with an
unsigned 128-bit target packer. A shared 80-result fixture covers rounding,
gradual underflow, finite limits, infinity, and NaN. Linear IR emits no runtime
instruction, and the deterministic object proof checks all twelve bytes of
every value. ADR 0260 records this source-head capability. The checked seed is
not promoted by that decision.
Both compiler stages in the normal contract cohort rebuild the source
catalogue. ADR 0203 records the checked seed, ADR 0207 records the subtraction
form, ADR 0226 records SHRD, ADR 0228 records its seed carriage, ADR 0252
records the x87 integer forms, and ADR 0258 records their seed carriage.
The four-vCPU GUI runtime starts every discovered CPU, reaches e1000 or
RTL8139 traffic,
passes all 62 crypto checks, opens the desktop and terminal, and completes
embedded CupidC execution at 0x01100000. The established e1000 and RTL8139
gates continue to cover audio, input reattachment, and six EHCI storage
lifetimes. Both NIC runs print [fpu] SSE2 enabled,
[fpu] boot smoke ok, and FPU boot smoke passed, then finish
feature16_asm_fpu.cc. A private-image smoke loads the same external ELF
program twice at 0x01C00000; cleanup releases the first arena lease before
the second load. Current private-image runs finish the full e1000 and RTL8139
frontiers in 235.259 and 232.832 seconds. Both reach
[feature13-call] PASS checks=10, [feature15-x87] 7 range checks, 0 failed,
and [feature15] 29 checks total, 0 failed before clean CupidC completion.
They also complete the GodSong interaction.
The gate rejects SMP, storage, crypto, exception, panic, corruption, and
illegal-instruction failure markers. The X.509 checks exercise parser,
hostname, chain state, and embedded-root lookup paths. They are not a full
trust-validation claim.
At the earlier kernel-compiler handoff (ADR 0393), the recorded state was:
Across the root and supplemental builds, the stable ownership counts assign 250
participations to CupidC and none to a host C compiler. Of those, 246 are
ordinary C-output transforms; the checked native Windows user ABI,
artifact-size, Toolchain manifest author, and Toolchain manifest verifier
supply the other four.
Python participates in 98 transforms, and CupidBuild in 354. The ordinary CupidC
total is 240 normal transforms plus three generated installation tables and
the hello.cc, ls.cc, and cat.cc programs. Root all has 443 transforms:
all 443 have a Cupid participant. The size verifier emits no OS artifact; it
builds and runs a private CupidC contract with CupidASM and CupidLD. The 442
artifact transforms retain five CupidASM, 192 CupidObj, two CupidLD, and six
root CupidDis participations from the manifest-checked six-tool seed. Three
user ELF inspections bring the three-root CupidDis total to nine. Across all
three roots, CupidASM and CupidLD each participate in nine transforms because
the native Windows user ABI, artifact-size, Toolchain manifest author, and
Toolchain manifest verifier assemble and link their checked contracts
directly.
Other native hosted commands remain explicit oracle targets. The same runner
handles root commands.
Checked production CupidC and checked user CupidLD plus CupidDis pass it their caller-owned
frozen captures. It rechecks the complete live seed cohort after each command.
Make passes wildcard-discovered output sources through $(sort ...)
before generation or link. Windows and Linux therefore consume the same root
order across host locales.
The stable audit counts record 748 active language inputs, 452 transforms, 255
features, and 28 unreachable inputs across the three roots. It includes 443
transforms under root all. Four transforms use Cupid-built semantic
contracts, and no transform is Python-only. Python participates in 98 as
orchestrator, while CupidBuild participates in 354, including two guarded assembly objects,
three guarded raw images, the typed JPEG object, the generated kernel-symbol
source, final kernel flattening, 157 kernel compilations, Doom profile publication, 186 ordinary CupidObj calls, and two normal
kernel links.
The assembly ownership contract covers all 32 active assembly sources. All are owned by CupidASM, including five Toolchain startup inputs. An ownerless source fails unless it has a reviewed host-only classification. ADR 0327 records the complete ownership rule.
An earlier attempt at this audit stopped after 65.183 seconds because the
test still locked the old artifact-size recipe. The audit and its test now
require one $(ARTIFACT_SIZE_CONTRACT) command with the Linux policy manifest,
checked Windows manifest, and host-selected execution manifest.
At that checkpoint, make bootstrap-audit and make check-bootstrap-audit
both passed. The Linux audit recorded 23 failure groups, six help groups, and
29 success groups. Windows recorded 12 failure groups, six help groups, and
16 success groups. The active seed section records the current matrices.
The build audit finds seventeen tracked .c files outside TempleOS/ and none
in a supported transform. It records seven historical copies, three
superseded implementations, one dormant runtime draft, five native host test
fixtures, and one optional host oracle. Renaming a bin/*.c copy would activate
it through wildcard discovery. Renaming a fixture would silently select C++
semantics. The audit rejects an active tracked .c source owned by CupidC. A
.cc suffix does not supply the opposite ownership claim. Checked compile
and Toolchain contract edges prove 280 active sources. An exact policy names
the other 130 sources delivered as text by CupidObj, all seventeen residual
.c paths, and the six unreachable .cc paths. A host or inactive source
therefore cannot claim CupidC ownership through a suffix-only rename. The safe
rename set is empty. ADR 0284 records the first gate, and ADR 0291 records the
independent provenance rule. Every audit requires active ownership evidence,
including an audit without a policy file. A nonproduction audit accepts policy,
a recorded source relation, or an explicit Make exclusion for an unreachable
.cc. The complete production graph requires exact policy coverage, while a
partial production view defers that census.
The native process fixture supplies the four host adapters required by the
current cleanup path. Its 20 focused cases pass, and the combined native C
evidence passes all 56 kernel, USB, and ELF32 oracle cases without changing
fixture language mode.
ADR 0190 records the root handoff, and ADR 0196 records the Toolchain contract
handoff. The user compiler and Toolchain contract publisher create their own
output directories. The compiler pins each POSIX or Windows directory
component during preparation and rejects links, junctions, and a changed
resolved path. No supplemental output is Python-only. The
user/test-syscall-abi, root artifact-size, Toolchain manifest author, and
Toolchain manifest verifier transforms have Cupid-built contract and Python
participants. The contracts own their semantic decisions, while Python checks
independent results and controls the native boundary. ADR 0245 records the
graph boundary, ADR 0246 records the shared invocation and post-run five-image
check, ADR 0264 records the ABI transfer, and ADR 0297 records artifact-size
verification. ADR 0302 records Toolchain manifest verification, and ADR 0304
records authorship.
The separate private in-kernel CupidC compiler now uses one scalar cdecl
layout for direct, function-pointer, and method calls. Represented scalars and
pointers occupy four-byte slots, while double occupies eight. Calls retain
left-to-right evaluation, then arrange complete words at increasing source
addresses. Callees and caller cleanup use the same widths. This repairs guest
JIT and AOT behavior without moving a build owner. ADR 0198 records the
boundary.
A fixed private int or unsigned int parameter can also receive a
represented object pointer as one unchanged i386 word. Narrow and floating
destinations remain rejected, and the existing represented pointer-category
rule is unchanged. The unchanged /bin/ctxt.cc call to
ctxt_parse_action exposed this coercion boundary. That file is an include
fragment; /bin/notepad.cc includes it and passes private AOT compilation.
ADR 0230 records the focused call and recovery contracts.
The Browser's JavaScript runtime keeps decimal, hexadecimal, binary, and octal
tokens in a binary64 lane and accepts separators between valid digits. Its
primitive path covers whole-string numeric conversion with ECMAScript
whitespace, equality, UTF-16 string relations, IEEE remainder, %= and string
+=. Concatenation uses the remaining 64 KiB string pool and reports
exhaustion instead of truncating a result. Assignment records a binding,
member receiver, or computed key before its right side and stores through that
same reference. The guest checks replace receivers, advance keys, and run
1,100 plain writes. Every string interning lane checks capacity before it
publishes runtime state, and failed global installation blocks queued scripts.
Native function IDs survive user-function arguments and returns. Array writes
grow the signed length lane, reject unsupported canonical indices and direct
length assignment, and preserve 4,294,967,295 as an ordinary property. Finite
formatting handles 1e20 and 1e-7 without narrowing the integer part to a
signed int. The asset-free browser --selftest command drives the real
lexer, parser, and interpreter.
It reports 26 computed fields after ten useful malformed-input diagnostics and
a valid recovery script. ADR 0210 records the first binary64 slice, and ADR
0218 records this expansion.
The larger active script also exercises private adjacent C strings. CupidC writes neighboring tokens into one data object for automatic expressions, file-scope initializers, and persistent REPL declarations. Each decoded token is limited to 1,023 bytes; the joined string can use the remaining 8 MiB data section. Overlong tokens and data exhaustion fail with focused diagnostics.
The saved Browser reference uses typedef struct Tag { ... } Alias. Private
CupidC now parses that tagged form and the anonymous form through one layout
path. The typedef table keeps the structure index through alias chains and
pointer aliases in normal and persistent REPL source. The active Browser
therefore keeps ordinary C spelling instead of working around its bootstrap
compiler. Fixed array products, cumulative record layout, final alignment,
REPL data capacity, and cumulative local frames are checked before allocation.
Signed constant expressions reject overflow; expressions with an unsigned
operand wrap in the represented uint32_t lane. Integer literals stop at
UINT32_MAX, hexadecimal literals require at least one digit, and the suffix
counts inside the 95-character limit. REPL rollback restores complete record
definitions, so rejected source
cannot fill a committed forward tag. ADR 0219 records the boundary.
Those five numeric tables exposed integer-only lowering for fixed floating
array symbols. CupidC now records the declared scalar type and remaining row
stride on one-, two-, and three-dimensional global, automatic, block-static,
and persistent REPL arrays. Depth-one floating pointers keep the same type
through address expressions, returns, array-parameter decay, dereference,
subscripts, direct pointer updates, and assignment. Scalar floating updates
also work through dereference, array index, and direct, pointer, or
indexed-record members while evaluating the destination once. Structure and class
objects, arrays, and pointers retain scalar floating fields and
one-dimensional fixed floating field arrays. Unevaluated
sizeof(array[index]) reports the row without running the index. Checked
bounds and dimension products protect storage, and fresh expression metadata
prevents stride leakage. Deeper floating pointers, pointer-to-array types, and assignment through a
pointer-valued floating field subscript remain unsupported.
Private packed values now keep their type through matching float4 or
double2 arithmetic and fixed arrays with one, two, or three dimensions.
Global, automatic, block-static, and persistent REPL arrays keep declared rank
separately from checked byte strides, including when an inner extent is one.
The final 16-byte vector leaf uses unaligned-safe loads and stores. Indexed
plain assignment and the four arithmetic compound assignments evaluate every
destination index once and preserve lane reads. Row and vector sizeof do not
evaluate their indexes. Every direct operator keeps the written left value in
the machine destination. Whole-vector prefix and postfix ++ and -- work on
direct objects and fully indexed leaves. The indexed path retains its computed
address, prefix returns the stored vector, and postfix returns the exact old
128-bit payload. Automatic, global, block-static, and persistent REPL direct
objects use complete 16-byte storage. Const qualification is retained through
typedef aliases. Const direct vectors and fixed-array leaves remain readable.
Plain and arithmetic compound assignment, plus prefix and postfix ++ and
--, are rejected before a store. Every update index runs once. The feature-14
guest reports these checks separately from its array and matrix markers. MIN
and MAX intrinsics preserve their second-operand NaN and signed-zero behavior.
For a both-NaN ADD or MUL, the processor or emulator may preserve either input
payload. Incomplete rows are rejected rather than treated as untyped pointers.
SIMD pointers, record fields, new, array parameters, row values, lane updates,
and computed vector updates remain unsupported.
Fixed-prototype direct functions and methods pass float4 and double2 by
value in 16-byte cdecl stack slots and return matching vectors through XMM0.
The slots are packed at four-byte granularity and use MOVUPS; this private
boundary does not claim 16-byte call-site alignment. Left-to-right argument
evaluation, all four raw vector words, exact caller cleanup, pass-by-value
mutation, const parameters, prototypes, methods, and nested returns have JIT
and AOT execution coverage. SIMD values in a variadic tail, unprototyped SIMD
calls, and calls through signature-erased function pointers remain rejected.
A named block-local function pointer with an explicit prototype keeps its
fixed parameter types, variadic state, and result. Its indirect call reuses the
same conversions and 4-, 8-, or 16-byte slots, including SIMD arguments and
XMM0 results. A free-function or Cupid class method parameter declared with a
direct file-scope function-pointer typedef carries the same metadata and call
path. A declaration-initialized automatic object carries it too. A file object
declared directly with the typedef retains the metadata across
null initialization, checked plain assignment, indirect call, and clearing.
A structure or class field declared through the typedef or a raw
function-pointer declarator retains the same metadata for checked stores, named
copies, null checks, clearing, and direct postfix calls. Direct, nested, and
indexed record-array member paths share that behavior and evaluate the selected
designator once. Raw callback scalars and one-dimensional arrays at file scope,
block-static scope, or persistent REPL scope retain that signature in
data-backed storage. Fixed-size automatic raw callback arrays use cleared
local frame storage and keep the same signature. Unsized automatic arrays,
callback array parameters, raw callback arrays in records, multidimensional raw callback arrays, empty
(), callback alias chains, and void * forms remain
unsupported or signature-erased. A
plain function initializer or direct callback argument must match the retained
signature. Local copies share the check, later addresses are fixed up, and a
provisional signature must match its definition. An explicit cast opts into
erasure only for the value it covers.
Compatible conditional selection checks every named arm. A represented integer
constant expression that evaluates to zero is a null pointer; runtime zeros are
not. Null arms are neutral for erasure, while every non-null object arm must be
cast. Failed functions, methods, and sources restore typedef entries, emission,
patches, control state, touched function symbols, kernel bindings, and a reused void(void)
__start thunk.
A named raw callback file object and direct free-function parameter also retain
the parsed signature. The file object uses the existing null, function-address,
assignment, call, and clear rules. The parameter uses the existing cdecl slot
and arity checks. The private pool accepts 32 distinct raw signatures, rejects
the next one, and restores the pool before a valid retry. ADR 0315 records this
source boundary. Runtime initialization and assignment accept &(function)
and nested grouping.
ADR 0321 records the typedef-backed field boundary, ADR 0324 records grouped
runtime addresses, ADR 0325 records raw fields and direct field calls, and ADR
0328 records typedef-backed callback field arrays. ADR 0330 records data-backed
raw callback arrays and block-static scalar callbacks.
The source-current private callback ABI module passes all 318 tests in 60.519
seconds, and the full GUI module passes all 128 tests in 0.955 seconds. A
private four-vCPU frontier boot records all four CPUs online,
[feature14-callback-raw-array] PASS modes=2 phases=3 calls=12 stored=1 persistent=1,
[feature14-callback-nested] PASS outer=1 inner=1 value=43,
PASS feature14_simd, and clean in-OS CupidC JIT completion. Its 157,520-byte
log has SHA-256
b34a68aebdfecaeeb347c1ff4764cbe609a6ed2f154557a15133a601101585c6.
The broader frontier changes 109,518 framebuffer pixels and captures
32,701,862 AC97 frames and 76,710 PC-speaker frames.
The standalone CupidC seeds do not contain this private parser. The active Doom
source remains in the production Doom cohort built by checked-seed hosted
CupidC. This private parser capability does not transfer that cohort to in-OS
CupidC, promote a seed, or remove a remaining bootstrap dependency.
The feature-14 guest publishes
[feature14-call] PASS float4=4 double2=2 nested=2 calls=6 followed by
[feature14-callback] PASS float4=4 double2=2 calls=2.
The preceding private e1000 smoke checkpoint printed a separate
[feature14-callback-typedef] PASS float4=4 calls=1 marker for the
typedef-parameter path after the direct and named callback markers.
Source head then requires
[feature14-callback-global] PASS float4=4 initialized=1 assigned=1
cleared=1 calls=2, followed by
[feature14-callback-automatic] PASS local=4 method=4 calls=2 and
[feature14-callback-field] PASS stored=1 copied=1 cleared=1 float4=4 calls=1.
The focused JIT and AOT contracts pass the typedef-global, automatic, method,
and field paths. Host tests prove the source and marker contract for the field
path. A focused four-vCPU QEMU boot observes the field marker,
PASS feature14_simd, and clean in-OS CupidC JIT completion. Its 33,347-byte
log has SHA-256
14511351d544fe8c4d4293b64fbaa7de9a3fdcaeb69f2ac0553e9d0a71d29696.
ADR 0216 records the fixed-array boundary. ADR 0257 records multidimensional
row descent. ADR 0294 records whole-vector updates. ADR 0299 records fixed SIMD
calls. ADR 0301 records named local callbacks, ADR 0303 records callback
typedef parameters and the zero-data AOT layout, and ADR 0306 records global
callback storage and checked assignment. ADR 0310 records automatic
callback objects and Cupid class method parameters. ADR 0313 records static
callback initialization. ADR 0319 records direct explicit function addresses.
ADR 0321 records typedef-backed record and class fields.
ADR 0330 records data-backed raw callback arrays and block-static scalar
callbacks.
Private decimal literals now use a fixed 1536-bit integer workspace. CupidC
forms the exact decimal ratio and rounds once to the selected binary32 or
binary64 width with ties going to even. An f suffix selects binary32 before
rounding. The path covers subnormals, finite limits, infinity, and signed zero.
It accepts numeric tokens through 95 characters, consumes a rejected longer
token completely, and keeps the first lexer diagnostic through parser
recovery. This changes private JIT and AOT behavior without moving a build
owner. ADR 0217 records the boundary.
Direct functions and methods retain parsed fixed parameter types. Known fixed
arguments convert among represented integer, char, float, and double
types before cdecl layout. Represented pointer categories and integer null
forms can fill a pointer slot. Character arithmetic follows integer promotion
and uses the scalar integer conversion path when mixed with floating values.
A parsed variadic tail widens float to double and promotes char to int.
A named block-local function pointer with an explicit prototype uses those
same conversions and keeps its declared result. A free-function or Cupid class
method parameter declared with a direct file-scope function-pointer typedef
does the same. A declaration-initialized automatic object does too. A file
object declared directly with the typedef keeps the signature across
null initialization, checked assignment, indirect call, and clearing. Raw
callback scalars and one-dimensional arrays with data-backed static storage
keep the signature too. Fixed-size automatic raw callback arrays use cleared
local frame storage and keep the same signature. Unsized automatic arrays,
callback array parameters, raw callback arrays in records, multidimensional raw callback
arrays, empty (), callback alias chains, and void *
forms remain unsupported or metadata-free. A structure or class field
declared through the typedef or a raw function-pointer declarator retains the
signature for checked stores, named copies, null checks, clearing, and direct
postfix calls, including nested and indexed record-array member paths. Kernel
bindings and other calls without fixed
parameter metadata retain source-width arguments. A plain function
initializer or direct callback argument is checked before storage or call,
while an explicit cast remains the deliberate erasure path. Later targets
receive absolute fixups; their definitions must match any signature inferred
during prescan. Compatible conditionals retain each named candidate, and a
failed source discards all new forward fixups. It also restores typedef entries,
touched prototypes, definitions, kernel bindings, and a reused implicit __start. The
thunk has a complete void(void) signature. Null initializers use represented
integer constant expressions that evaluate to zero; sizeof(int) - 4 is
covered, while runtime zero is not. Explicit erasure survives a conditional
only when every non-null object-pointer arm is cast.
ADR 0210 records the first typed-array slice and the Browser path that requires
it. ADR 0215 records the expanded private floating lvalue model, and ADR 0301
records named local callbacks. ADR 0303 records callback typedef parameters.
ADR 0306 records global callback storage and checked assignment. ADR 0310
records automatic callback objects and Cupid class method parameters. ADR 0313
records static callback initialization. ADR 0319 records direct explicit
function addresses. ADR 0321 records typedef-backed record and class fields.
ADR 0330 records data-backed raw callback arrays and block-static scalar
callbacks.
Checked CupidASM assembles the ISO spanning fixture from
test_iso/big_pattern.asm. Hostbuild freezes that source and the checked seed,
checks the exact 4,096-byte lane pattern, then rechecks the live inputs before
atomic publication. Python is the verifier and publisher, not the byte author.
NASM freezes $ across this TIMES statement, so this fixture is the one
explicit production-source exception to optional NASM byte parity. ADR 0227
records the transfer.
ISO test-fixture packaging no longer hides an external tool behind Python.
test_iso/fixtures.manifest pins every directory and file. Make declares the
same seven portable paths explicitly, and a test keeps that prerequisite list
equal to the manifest. Raw manifest text never enters Make grammar, and Make
never recurses through an unchecked fixture path. The graph includes the
manifest, fixture root, all seven members, tools/hostbuild.py, its imported
bootstrap helper, and the Makefile. The writer produces the tracked ECMA-119 and
RRIP_1991A bytes directly. Its continuation follows the directory stream,
so sequential readers retain every long name. Hostbuild then rechecks the
manifest and tree before atomic publication. Rebuilding the fixture does not
need mkisofs, genisoimage, or xorrisofs. ADR 0191 records the format
boundary and negative cases.
The first direct comparison matched 426 of 430 kernel artifacts. The remaining
four were one JPEG object and the three outputs that consumed it. Host FFmpeg
had rewritten the tracked progressive image differently on Windows and Linux.
The repository stores the accepted sequential baseline bytes. At that
checkpoint, Hostbuild froze the exact source and gave the private snapshot to checked CupidObj
wrap-jpeg. CupidObj validates and wraps sequential SOF0 or SOF1 input and
rejects progressive, unsupported, or malformed marker streams. Python then
checked the accepted snapshot independently, required unchanged bytes, rechecked
live inputs, and published atomically. A validator disagreement was distinct
from a failed private oracle copy; either one preserved the prior object.
The current Make edge runs promoted CupidBuild embed-jpeg with its independent
native check and guarded publication.
FFmpeg, jpegtran, djpeg, and cjpeg are no longer root dependencies. The Linux kernel build passed in 607.7 seconds, and the Windows
root build passed in 341.6 seconds. All 430 frozen kernel artifacts match byte
for byte. The matching raw kernel is 8,490,228 bytes with SHA-256
53770a93658e757d25f5aeab9d3e434d4a3be2a1dc3fbe4b19869e5bf9820a06.
The fresh normal image has SHA-256
e815d2ef67f114a26181f0e2cbde85f892cdadd487f8d9cbee9715e720800b3e.
A private /bin/ls.cc JIT boot from it passed in 49.8 seconds.
ADR 0231 records the CupidObj capability, ADR 0234 records seed carriage, and
ADR 0235 records the production acceptance transfer.
The normal image target runs checked-seed CupidObj disk-template before
Python begins disk composition. The command consumes private boot and kernel
copies, the total sector count, and the FAT partition LBA. It writes the
deterministic prefix from the MBR through the empty FAT16 root directory, with
the kernel at LBA 5. The active prefix is 10,697,216 bytes, so CupidObj does
not need a full 200 MiB command buffer.
Python builds an independent layout oracle from the same frozen inputs and
requires byte parity. It extends a fresh template to the requested image size,
or copies a valid persistent image and replaces only the prefix before the FAT
partition. Python also stages frozen files, checks the seed and live paths for
changes, and publishes the complete candidate atomically. CupidObj's 192
normal transforms include disk-template, iso-fixture, and the guarded Doom
profile manifest. ADR 0236 records the
command, ADR 0237 records seed carriage, and ADR 0238
records production ownership.
The guarded normal recipe built a fresh 209,715,200-byte image with SHA-256
8ad90a91103bf48d1e8d1e20b1b3dee48122ed1e4059b3f94cce7d750c262f16.
A private four-CPU /bin/ls.cc JIT boot passed from that image in 61.9 seconds.
The later handoff checkpoint preserved the existing FAT data and produced
image SHA-256
d1bfab4aed1f2116768ceed3e301fb14ffe2a36418eb4d4ebdf1108097cb2b05.
Its private four-CPU JIT boot passed in 66.8 seconds.
Checked-seed CupidObj now carries iso-fixture. The
freestanding operation consumes a manifest and typed logical inventory rather
than walking a host directory. It reproduces the tracked 61,440-byte
ECMA-119 and RRIP_1991A image exactly, including both path-table byte orders,
fixed metadata, block-contained directories, the forward continuation, and
the absence of ST fields. Eleven core selectors and all 31 hosted CupidObj
tests pass. The fixed-point gate exercises the command and its rollback path
in the 5/22/21 behavior matrix. The normal recipe freezes the typed inventory,
runs this checked command first, and accepts the image only after an
independent Python render agrees. Python retains path safety, drift checks,
locking, and atomic publication. ADR 0239 records the source capability, ADR
0240 records seed carriage, and ADR 0241 records production ownership.
The checked audit uses the canonical Windows Make branch and C locale on every host. Direct Linux builds test the separate Linux execution branch.
At this earlier checkpoint, the checked seed came from revision
95f5bb6cfd0468bb8852c670ada849cb5bde79a7.
The ISO source-capability Toolchain cohort passed in 2,764.533 seconds. Its
two stages matched sixteen objects and fifteen linked executables, the hosted
runtime passed, and all 20 published artifacts verified. The 18,232-byte
contract manifest covers 45 inputs and has SHA-256
8cd0ea08454d9d672e6890e040fce85ba02b2c101c21599aa3933b0d89eee202.
It records seed manifest
019c77d53ddaf64a382962e1d9588a60046b75a7661f70beb0da7510945f35d0
and source snapshot
bac03a6d2b36dff48983221aae209a6688b408232b5d5373b6c2128082228a66.
This cohort predates the seed promotion; the independent 794.6-second reproof
above validates the promoted trust unit.
The manifest also records equality across 19 C objects, one startup object,
and five rebuilt tool images.
The latest normal root build passed in 1,482 seconds. Its 9,089,676-byte
final ELF has SHA-256
fe3f04f89287237440136bab88ad4436e43202a36a0325dd02b5e5270d08eef0;
the 8,883,276-byte raw kernel has SHA-256
6604b7a366a83ff3f0062e434f2d64bc3726e23d7fd6f2720f9d65636a56cad1.
The 209,715,200-byte image has SHA-256
d64b4fd5b31a814c1fb3bd5c08c187bcba5cd0ac4e35bd42d5de86813853663f.
A private four-vCPU e1000 boot ran /bin/feature13_double.cc from that image
in 66.7 seconds. It observed the unsigned conversion and remainder marker,
the program pass line, and clean JIT completion. Its 34,908-byte log has
SHA-256
0aed6bf022bdb3b9a5c689b64473e2e6da7dfddfd4e7bec9956c03a7189da596.
This boot checks the existing ELF path; it does not execute a PE image.
The earlier ADR 0235
checkpoint used a 209,715,200-byte image with SHA-256
c71fd7f5a03a4e55f4de45e6b93d4284375fb5600f4df3cda62b7f4043c33b33.
Its private four-vCPU runs covered the complete frontier with both supported
NICs. The e1000 run finished in 545.151 seconds with 94,495 changed pixels,
21,537,672 AC97 frames, and 76,810 PC-speaker frames. Its 147,159-byte log has
SHA-256
183971318a33ff4ac5aebf7bf80e2ad606a65a435d34fca6bc84c4a1063fba22.
The RTL8139 run finished in 536.668 seconds with 100,166 changed pixels,
21,064,744 AC97 frames, and 79,268 PC-speaker frames. Its 136,003-byte log has
SHA-256
372164df1e8cf93a5f780da3b1da2f2b03113fdfba61c5ceda13c2c59a367353.
Neither historical log contains a panic, fatal error, assertion failure,
exception, or triple-fault marker.
The fixed frontier compiles /bin/gfxgui_test.cc to a private ELF image,
runs that image, then runs the source through private JIT. It next runs a
nested fullscreen owner that exits without explicit teardown and starts the
AOT graphics image again. It requires the AOT write marker, setup, frame 0,
frame 240, cleanup, process-exit recovery, and clean JIT completion. Any unresolved
native symbol or explicit fixture failure stops the gate immediately. Theme
and BMP checks plus an exact custom-font pixel, an isolated blurred-surface
pixel with unchanged screen state, and center and off-center
transformed-image pixels prevent a skipped API path from satisfying the
markers. An off-origin rotation and scale point plus exact identity after
popping the transform cover the linear matrix and stack. The 46 previously
missing kernel bindings bring the source-driven private AOT census to all 107
runnable top-level programs. Disposable test artifacts stay in RamFS. The
affine inverse keeps the full 32.32 determinant and inverse translation
arithmetic in checked 64-bit form. This fixes the identity zero divisor,
preserves representable sub-word determinants and large scales, and rejects
unrepresentable inverse words. GodSong publishes a local settings line, then
the popup publishes a marker after acquiring raw-input ownership. The harness
uses neither a timed settle nor startup-only graphics diagnostics. ADR 0233
records this boundary.
ADR 0261 records the shared graphics ownership boundary. Desktop composition, retained and legacy window rendering, and fullscreen programs use one PID-tagged writer handoff. Fullscreen entry waits for earlier desktop work, and process reaping releases abandoned ownership before PID reuse. Raw gfx2d calls and borrowed resource pointers require an outer render scope. Published resource handles are not owner-tagged yet, so abrupt process death can still leak a finite pool slot.
The production Doom runtime proof uses private four-CPU images on e1000 and
RTL8139. Both NICs pass the full asset-free frontier. Separate one-boot gates
run two different missing-IWAD launches, require two returns to the shell, and
then complete dglibc_test. A second stateful gate on each NIC reaches the
same storage diagnostic after the swap feature has kept one FAT handle open,
then completes the framebuffer, audio, speaker, desktop, terminal, and in-OS
CupidC checks. The checkout has no WAD, so this evidence stops before gameplay,
game input and audio, menu-driven save/load, and reboot persistence.
The fixed frontier command sequence now adds doom, an explicit
doom -iwad /disk/missing.wad, the shell-return marker, and a fresh
CupidC-built ls. This makes the no-IWAD recovery reproducible in the normal
frontier without treating it as gameplay proof. ADR 0232 records the gate.
Checked-seed CupidC accepts optional [identifier] labels on GNU extended
assembly outputs and inputs. It collects the complete operand namespace and
normalizes each unescaped %[identifier] reference to the existing numeric
operand index before public frontend metadata freezes. Escaped %% pairs
remain literal. Linear IR and the i386 emitter therefore keep their numeric
contracts and apply the same validation to named and numeric source.
The checked seed accepts the complete volatile assembly statements in
libm_pow_impl() and libm_powf_impl(). The double form requires one
modifiable double output and four addressable double inputs. The mixed
form requires one modifiable float output, two addressable float inputs,
and two addressable double inputs. Both require one memory clobber and no
other clobber. Linear IR evaluates each statement's five addresses once in
source order.
Each focused function has 116 exact text bytes and no relocations. Shared
decoding checks all seventeen x87 instructions, the active DC E9
forward-subtract bytes, maximum stack depth three, balanced depth on return,
deterministic output, rollback, and same-job recovery. The old DC E1 form
remains an explicit compatibility case.
The checked seed accepts the exact volatile sqrtsd %1, %0 statement in
libm_sqrt_impl(). It requires one modifiable, non-atomic double =x
output, one non-atomic double x input, and no clobbers. Linear IR
evaluates the output address before the input value.
The emitter loads the input into XMM0 with MOVSD, applies
SQRTSD XMM0, XMM0, and stores the result through the saved output address.
The focused function has 65 text bytes and no relocations. Contracts cover
the exact bytes, forged metadata, useful operand diagnostics, deterministic
output, unreachable validation, rollback, and same-job recovery.
The checked seed accepts the exact volatile statement in libm_atan2_impl().
It requires one modifiable, non-atomic double =m output, two addressable,
non-atomic double m inputs in y, x order, and one memory clobber.
The named spelling normalizes to the same frozen metadata as the numeric
form. Linear IR evaluates all three addresses once in source order.
The 53-byte focused function has no relocations. The direct 15-byte sequence
loads y, loads x, applies FPATAN, and stores through the saved output
address with balanced x87 depth. Contracts cover shared decoding, forged
metadata, operand diagnostics, deterministic output, unreachable validation,
rollback, and same-job recovery.
The checked seed accepts the exact volatile statement in libm_exp_impl(). It
requires one modifiable, non-atomic double =m output, two addressable,
non-atomic double m inputs in x, log2e order, and one memory
clobber. The named spelling and normalized numeric form use the same
validation. Linear IR evaluates all three addresses once in source order.
The 71-byte focused function has no relocations. Its direct 33-byte sequence
computes exp2(x * log2(e)), reaches x87 depth three, and returns to the
incoming depth before storing through the saved output address. Contracts
cover shared decoding, forged metadata, operand diagnostics, deterministic
output, unreachable validation, rollback, and same-job recovery. The
source then reaches the aligned file-scope fabs mask block.
The checked seed accepts the exact mask block followed by fabs and fabsf.
The mask effect reserves the first 32 bytes of .rodata at alignment 16 and
defines local STT_NOTYPE symbols at offsets 0 and 16. It is placed before
ordinary and block-static objects, so later read-only C data starts at offset
32 or later.
The wrappers retain their source prototypes and global function symbols.
fabs contains 15 text bytes and an R_386_32 relocation at function offset
10 to fabs_mask_d. fabsf contains 14 bytes and the same relocation type at
function offset 9 to fabs_mask_s. Both use Cupid's shared x86 model.
Contracts cover exact bytes, symbols, relocations, mixed read-only data,
source ordering, forged metadata, deterministic output, rollback, and
same-job recovery.
The checked seed accepts the exact floor, floorf, ceil, ceilf, round,
roundf, trunc, and truncf definitions. Each wrapper loads its scalar
argument, saves the x87 control word, clears the RC field with 0xf3ff, and
installs the source mode before FRNDINT. It restores the original control
word before returning the result through XMM0. The nearest-even pair uses
RC=00 and omits the OR instruction.
The eight functions add 384 text bytes and no relocations. Exact symbol
offsets and sizes are checked, as are every decoded instruction and operand,
the float and double widths, the four control modes, balanced ESP, and
balanced x87 depth. Negative cases alter the control mask and the floor
prototype, then check output rollback and same-job recovery.
At this boundary the unchanged source reaches fmod at line 465. Named
matching constraints, operand modifiers, and general XMM or x87 constraints
remain separate work. The then-host-owned libm.c recipe remained unchanged
at that compiler boundary.
The checked seed accepts the exact fmod and fmodf definitions. Each wrapper
loads y and then x, leaving the dividend in ST(0) and divisor in ST(1).
It repeats FPREM while C2 in the x87 status word remains set. FNSTSW AX
and TEST AX, 0x0400 feed a rel8 JNE with displacement -10 back to the
reduction instruction.
After convergence, FSTP ST(1) removes the divisor without losing the
remainder. The wrapper stores the result at the source width, moves it to
XMM0, restores ESP, and returns. Both functions contain 35 text bytes. The
pair adds 70 bytes to the fixture, for a total of 702, and has no
relocations. Each reaches x87 depth two and returns to its incoming depth.
The decoder checks every instruction and operand, including the C2 mask and
short branch target. Negative cases alter the mask and give fmod the float
prototype, then check output rollback and same-job recovery.
That remainder slice ended at the aligned libm_log2e_const and
libm_ln2_const block on line 544. The next section records the later
checked-seed ownership of that exact data and its wrappers.
The checked seed accepts that exact constant block and the following exp2,
exp2f, exp, expf, log2, log2f, log, and logf definitions. The
two local STT_NOTYPE symbols occupy offsets 0 and 8 in a 16-byte .rodata
section with alignment eight.
The exponent wrappers share the source FRNDINT, F2XM1, and FSCALE
sequence. The natural pair loads libm_log2e_const, multiplies, and then
uses that sequence. The logarithm wrappers use FYL2X; the base-two pair
loads one, and the natural pair loads libm_ln2_const.
The eight functions occupy 264 text bytes. exp2 and exp2f are 37 bytes
each, exp and expf are 45 each, log2 and log2f are 23 each, and
log and logf are 27 each. The natural forms contribute four
R_386_32 relocations. Decoder checks cover every instruction and operand,
x87 depth up to three, and balanced ESP and x87 state.
Negative contracts change one constant bit, remove or move the data block,
duplicate it, collide a label with a C declaration, forge metadata, and give
exp the float prototype. Each failure rolls back cleanly, and the same job
can emit the valid object afterward.
The source then reaches pow at line 846.
The checked seed accepts pow, powf, asin, asinf, acos, acosf,
sinh, sinhf, cosh, coshf, tanh, tanhf, cbrt, cbrtf,
hypot, hypotf, nextafter, and nextafterf. Each exact file-scope
template copies the original cdecl words, calls a matching external
libm_*_impl function, reclaims the copied words, stores the ST(0) result,
and moves it into XMM0.
Four shared stack shapes cover unary and binary float and double functions.
The family occupies 558 text bytes. Its 18 direct calls each use one
R_386_PC32 relocation with known addend -4. Decoder contracts check all
push displacements and widths, the call fields, cleanup, result bridge,
return, ESP balance, and x87 balance.
Negative contracts change a template, remove a callee, change a wrapper or callee prototype, forge metadata, and exhaust the output limit. Each failure rolls back, and the same job can emit the valid object afterward.
Two exact kernel-profile compiles of corrected kernel/cpu/libm.cc now
produce the same valid 16,164-byte ELF32 relocatable object with SHA-256
c0911732361f2e1ea78aa778f834719ba12208cc2d9f0a312455a5e6a38a75b4.
General GAS remains unsupported.
The checked seed carries this whole boundary. The normal libm.cc recipe now
uses the checked production wrapper with kernel/core/types.h and
kernel/cpu/libm.h frozen beside the source. The guest gate runs
/bin/feature15_libm.cc and requires the seven-case x87 summary, all 29
checks, and PASS feature15_libm. ADR 0176 records production ownership, and
ADR 0209 records the numerical correction.
This dated checkpoint records the earlier schema v3 publication, audit,
poisoned build, artifact identities, and private runtime smoke. The current
seed identities below are separate from those earlier build and guest results.
The stable audit counts are 748 active language inputs, 452 transforms, 255
feature requirements, six CupidDis production checks, and no active
CupidC-owned .c source.
The checked runner gives every native tool invocation its own private copy. After the process exits, Windows sharing violation 32 is retried for up to two seconds because the executable image may still be mapped. Other cleanup errors are not retried, and a persistent lock still stops the build. The seed, arguments, timeout, output validation, live cohort check, and atomic publisher keep their existing behavior.
The following seed evidence belongs to the preceding 9d2529a7 checkpoint.
Both v2 manifests bind revision
9d2529a718672edcd970f24960535db6ddbde5e4 and the 59-input snapshot
bb4f598b2f72140d82d01fbfdedc14e4c774965d08c155ca848596daf3aa054f.
They list CupidC, CupidASM, CupidDis, CupidLD, CupidObj, and CupidBuild.
CupidC, CupidASM, and CupidLD remain the fixed-point producers; CupidBuild is
a checked non-producer with a separate production coordination role.
The 6,602-byte Linux manifest has SHA-256
30adaac167ee6cdde136ce5d957e6b4ca0b0a2bdc23ff376436634a6a0db027e
and binds plan
52dd857bcb74e079e7e2eec45eaa90a0a0838ad2f4e817bebc35c9904efbecbd.
The 2,852-byte Windows manifest has SHA-256
6960e4cb8bd26c3711db85aede44655f0f9b83a0a2fc3612053bb5d91674ff6a
and binds native plan
98e09aab876a9fa37ec07c38a0a57a014549a14c0ab10c740b3f80ede9d65669.
Its pairing field names those exact Linux manifest bytes.
The clean candidate fixed points matched every final object and tool image and passed 36/7/42 failure/help/success groups on Linux and 24/7/29 on Windows. ADR 0393 records promotion and its verification. CupidBuild accepts source counts of 58 or 59 and rejects 57 or 60; the historical v1 parser remains separate.
At the earlier kernel-compiler handoff (ADR 0393), the recorded state was:
CupidBuild coordinates five guarded assembly publications, including the ISO pattern, plus JPEG wrapping, kernel-symbol generation, kernel flattening, Doom profile publication, and all 157 kernel-profile compilations. It also runs 186 ordinary CupidObj calls and both normal kernel links. Participation is 354 for CupidBuild and 98 for Python across 452 transforms. Disk and ISO publication remain Python-coordinated CupidObj transactions. ADR 0383 records the profile handoff, ADR 0386 records the ISO pattern handoff, and ADR 0393 records the kernel compiler handoff.
Doom music production limits each call to the ring space available at entry. An interrupt consumer can free space for the next call without extending the current one. This fixes a reproduced clock-query stall while keeping music synthesis on the Doom main thread. A private diagnostic image advances demo tics, but still fails the 1,200-second timedemo deadline. Full gameplay and audio-performance acceptance remain open, as does the earlier EHCI panic.
The integrated fix passes Windows/Linux kernel, image and user-program builds, both private four-CPU E1000 shell smokes and 24 regression tests on each host. The fresh IWAD run records game tics 48, 114, 182 and 249, then fails the unchanged 1,200-second timedemo deadline. Full runtime acceptance remains open.
The first proposed Windows self-bootstrap completed its stages but rejected a behavior fixture whose driver had replaced the exact profile's recorded parents. A direct typed assembly probe reproduces the provenance error. The driver now retains lineage only when the captured source count, source digest and both plans match exactly, after validating the execution/plan pair. Changed captures, plans, a floating source count, missing parents and mismatched pairs cannot reuse that lineage. The corrected checked assembly probe passes; a fresh Windows self-bootstrap runs from the corrected driver.
The preview driver suite passes 144 methods on Windows and Linux, with sixteen
expected Linux skips. Native negative cases remove the resolver import from
ordinary tools. Historical profile fixtures use their own accepted parent tuple,
so an import rejection reaches the intended check. Evidence is in the v2 preview
logs and self-consumption-lineage-probe-v2.json under
build/bootstrap/long-profile-proofs-909d84ef/.
The proposed 77-input release still needs default-profile compatibility before
promotion. A default 76-input Windows behavior fixture inherits the long
release's parent tuple, which the shared reader currently rejects. The direct
probe is default-profile-parent-probe-v1.json. Explicit long-profile proofs
and normal OS recipes do not establish that separate default bootstrap path.
The installed 76-input cohort remains unchanged while this boundary is resolved.
The final audit check found a stale conditional-expression fixture. The long-file
adapter adds two expressions and one existing _WIN32 occurrence. The checked
inventory now has 418 #if and nineteen #elif occurrences, 61 expressions and
64 directive/expression pairs. The first ten-method audit run passed nine methods
and failed this count check. Its corrected rerun passes, as do four Windows host
cases and four cases in a freshly CupidC-built Linux contract, including precise
errors and recovery. The paired producer closure remains the same 77 inputs.
The separate publication uses its captured earlier contract fixtures; it cannot
establish acceptance for this corrected fixture. Evidence includes
conditional-audit-v2.log, conditional-host-windows-v1.log and
conditional-checked-v1.json under the current proof evidence directory.
The corrected conditional fixture belongs to the closed header set for 83 Doom
objects and two generated installation tables. A Linux checked-tool replay
recompiles all 85 through their existing native CupidBuild operations; every
object equals its accepted bytes. The other 156 source-specific compiler
closures remain unchanged. Final independent verification rechecks all 1,540
captured source inputs, sixteen artifacts, the 431-input cohort and the unchanged
boot-tested image. fixture-os-refresh-v1.json records the fresh outputs;
driver-final-source-transition-v2.json binds the final documentation and
verification fixtures to the active worktree. Ownership remains 441 CupidBuild
and eleven Python actions.
The first complete long-profile contract build publishes 22 artifacts, and its Cupid author and Python oracle agree on all 67 stage pairs. Its separate verifier then rejects an unchanged input set: the final membership check had recomputed the default 76-input profile after capturing the selected 77-input profile. The final check now retains that selection from its captured resolver observation. It still rejects extra or missing members and accepts a recovered unchanged set.
The focused regression fails before the fix and passes afterward. All 27 runner
methods pass on each host, with three expected Windows skips. The first concurrent
run correctly rejects repository-root changes from the other host's temporary
build directory; sequential runs pass. An isolated replay of the actual
publication passes the checked verifier with 89 publication and 77 producer
inputs. Its 22 artifacts and all captured source bytes remain unchanged, apart
from the explicitly replaced verifier. Evidence is under
build/bootstrap/long-profile-proofs-909d84ef/: the v4 runner logs,
linux-promoted-publication-replay-v3.json and verification-audit-v4.json.
This replay retains the earlier contract fixtures; the corrected conditional
fixture has its separate checked-Cupid evidence. The two native promotion
requirements remain default-profile parent compatibility and artifact-policy
support for count 77. The installed seeds and ownership counts are unchanged.
The manual replay passes with installed seeds: all sixteen artifact checks,
three unchanged user executables and a private four-CPU max/e1000 disassembly,
shell and SMP smoke. The 60,670-byte manual is present in its object,
ELF and raw kernel. The measured raw kernel is 9,573,704 bytes, 136 bytes
above the preceding accepted image. The first size-policy gate rejects that
increase; the calibrated policy and rebuilt image pass. The unchanged source
image has SHA-256 f1f9896e9aae2c55a6bf834db84ae81a4290e5abec44db7950ef5d070bebe018.
Independent source and artifact evidence is
verification-final-acceptance-v4.json under the current proof directory.
Installed seeds pass the updated manual image, all sixteen native artifact
checks, three unchanged user executables and the private four-CPU max/e1000
disassembly, shell and SMP smoke. The source image remains unchanged. All 241
compiler closures remain identical, including the 83 Doom objects. Only the
manual object and two kernel ELFs change in the 431-input cohort. The 61,483-byte
manual is present in its object, ELF and raw kernel. The measured raw kernel is
9,574,520 bytes, and the 209,715,200-byte image has SHA-256
adc4222825b715b8762836058a5fb953a9918702cf7da6838264cd5a4bca71c8.
The first size gate rejects the manual's 816-byte kernel increase. Updating only
the raw-kernel policy row to the measured value makes the image build pass.
The calibrated policy suite passes 79 methods. Evidence includes
os-build-v1.json, os-build-v2.json and windows-os-acceptance-v2.json under
build/bootstrap/native-profile-validation-258bb5f3/.
A separate native assembly transaction uses the real default 76-input UTF-8
images with a synthetic current-parent provenance fixture. It passes and emits
the reference CupidASM bytes, rejects a mixed parent and a long-profile CupidC
image, then passes recovery. This checks the default executable boundary without
claiming a complete named-commit default bootstrap. Its evidence is
default-profile-transaction-v1.json. Fresh staged proofs and seed promotion
remain open; the installed cohort and ownership counts are unchanged.
The complete 125-method audit run reports five failures in four stale inventory
methods. The exact long-profile inventory has 765 active and 41 unreachable
source files, 36 CupidASM-owned assemblies, nine hosted startup assemblies,
6,976 sizeof expressions across 183 files, and 114 Toolchain source files.
Both Make host branches include the resolver shim in their declared bootstrap
closure. The producer's default capture remains 76 inputs; its long capture
remains 77.
The fixtures now assert that inventory and check the resolver's positive
ownership and missing-input failure. Their complete closure comparisons still
reject extra or missing members. The first four-method rerun passes three and
reaches a further stale expression count; the next reaches the old Toolchain
cohort count. These assertions are corrected against the generated audit without
changing the inventory or build recipes. Original and focused logs are under
build/bootstrap/native-profile-validation-258bb5f3/.
The fresh native staged proofs use the unchanged producer closure from commit
8403b0a8. This fixture repair changes tests and documentation only. Installed
seed identities and production ownership remain unchanged.
The corrected four-method Windows rerun passes. The initial suite's other
121 methods passed before this test-only repair. The first Linux invocation
cannot resolve the Windows worktree's Git metadata and falls back to a filesystem
scan that includes leftover bootstrap fixtures. An obsolete repeat is stopped;
the corrected invocation supplies POSIX GIT_DIR and GIT_WORK_TREE paths.
Repository metadata and inventory rules remain unchanged. Its log is
audit-focused-linux-v5.log.
The updated assembly-inventory manual also passes installed-seed image acceptance:
sixteen artifacts, three unchanged user programs and the private four-CPU smoke.
The 61,700-byte manual is embedded in the object, ELF and raw kernel. Only its
object and two linked ELFs change in the 431-input cohort. The raw kernel is
9,574,736 bytes; its 216-byte increase is measured before changing the policy.
The unchanged source image has SHA-256
6476cbe7174f7c0e3fdefc96a4db8f38a5b94ddd6bb2b97a645c70d46047d093.
Evidence includes fixture-os-build-v3.json, fixture-os-build-v4.json and
fixture-windows-os-acceptance-v5.json in the same directory.
The corrected four-method Linux rerun also passes with the explicit Git paths. Both hosts now pass every affected method, including missing-resolver rejection and the final manifest-drift failure. The full initial 125-method run and the separate corrected reruns remain recorded as distinct evidence.
Getting Started
Shell & Scripting
Compilers
- CupidC Compiler
- CupidC Language Reference
- CupidC 2D Graphics Library
- CupidASM Assembler
- Toolchain Bootstrap
- Floating Point
Programs & Docs
GUI
Kernel
Filesystems
Hardware