# Resource Governance capOS uses capabilities to decide **what** an actor may use and an unforgeable owner ledger or grant to decide **how much** of a finite resource may be consumed and **when**. Identity, profile names, peer addresses, badges, and session metadata can select policy, but they are not spend authority by themselves. Availability is part of the security contract. A control that bounds retained state but lets an attacker cheaply occupy every slot, verifier, waiter, or accept loop has contained damage without providing availability. It must not be described as authorization, fair admission, or denial-of-service protection. ## Control Taxonomy Every finite-resource control has one of these roles. A design may need several of them at once, but it must not use the names interchangeably. | Control | Role | What it does not prove | | --- | --- | --- | | Isolation invariant | Preserves authority, generation, ownership, lifetime, or wire correctness. | Entitlement, throughput, or fairness. | | Structural safety ceiling | Caps one object's or pool's implementation/physical maximum so corruption or unbounded allocation is impossible. | That the physical cost is charged, or that one owner cannot consume the whole pool. | | Policy quota | Selects an administratively allowed amount below structural capacity. The resource owner translates it into an unforgeable ledger or grant. | Reservation, minimum service, or identity. | | Replenishable budget | Limits work or bytes in a time window and replenishes under a defined clock and burst rule. | A global try-lock, fixed slot count, or retry loop is not a budget. | | Reservation | Precharges capacity held until commit, rollback, expiry, or release. | A quota without aggregate admission is not a reservation. | | Donation | Leases a bounded part of one ledger to a callee for identified work and returns the unused remainder. | It never exposes the donor's unrelated budget or charges work spent before donation existed. | | Admission control | Atomically proves that all requested reservations, pool capacity, and protected housekeeping can coexist before publication. | A local per-object check is not aggregate admission. | | Backpressure | Reports temporary lack of admitted capacity through a bounded wait, partial operation, or typed overload result. | Retrying must not reset the deadline or create an unbounded queue. | | Deadline or lease | Bounds unproductive occupancy from one admission point through retries and partial progress. | A short arbitrary timeout is not resource accounting or fairness. | | Fairness, SLO, or SLA | Arbitrates admitted contention; an SLA additionally requires feasible reservations and accounting for kernel, IRQ, recovery, and background work. | WFQ weight, a hard throttle, or a quota alone is not a minimum-service promise. | | Proof or harness bound | Keeps one feature, manifest, or validation workload finite and reproducible. | It is not production policy unless the production owner enforces the same ledger contract. | For one resource dimension, the effective entitlement is bounded by all applicable sources: ```text effective = min( structural ceiling, admitted pool credit, delegated parent or subtree credit, selected policy quota, ) ``` Replenishable budgets, deadlines, and fairness arbitration then govern how that entitlement is used over time. Each field defines whether zero means invalid, disabled, or explicitly unbounded. Scarce production resources do not silently interpret zero as either one or infinity. ## Required Resource Descriptor Every bound, quota, or budget must name: - the resource dimension and unit, including worst-case physical memory, CPU, I/O, crypto, or continuation cost; - the authoritative owner and ledger, plus whether scope is per object, process, session, service, tenant, subtree, device, CPU, or system pool; - the structural derivation and every policy, delegated-credit, and pool limit that contributes to the effective value; - the authority needed to reserve or donate it, and the generation/lifetime to which that authority is bound; - who pays before identity exists, after authentication, during delegated server work, and during cleanup; - reserve, commit, rollback, cancellation, expiry, and exactly-once release behavior; - overload/backpressure behavior, one absolute deadline, and recovery path; - used, reserved, maximum, high-water, denial, timeout, and mismatch observability from the ledger of record; - manifest/profile configurability, validation, zero semantics, and effective readback; and - attacker cost versus defender cost, including whether one actor can exhaust unrelated progress or force global retries, hashing, logging, or scans. ## Core Invariants 1. Every finite resource has one authoritative owner and ledger. Mirrors may report state but never independently enforce it. 2. Profile and identity metadata select policy; only a generation-bound ledger or grant authorizes spend. Caller-provided strings, badges, peer addresses, account IDs, and cookies never select the charged kernel account directly. 3. Reservation happens before allocation or publication. Commit consumes exactly the reservation; rollback and release return it exactly once. Under-release, over-release, double release, and stale release are detected and audited or recovered, not hidden with saturating arithmetic. 4. A per-object limit is never described as a process, session, tenant, or system quota. Fan-out, fixed backing, and metadata are charged to an aggregate owner before another bounded object is created. 5. A logical queue or message bound reduces physical allocation or prepays the unchanged worst-case backing. Bounding retained records also bounds or charges the CPU and I/O used to reject, scan, format, hash, or log them. 6. Backpressure stays bounded end to end and preserves one absolute deadline across partial progress and retry. Waiting and cleanup remain charged to the responsible producer, service, or donor. 7. Ordinary traffic and diagnostics cannot starve lifecycle, audit, health, recovery, or credential-recovery paths. Protected lanes are themselves bounded and abuse resistant. 8. A quota is not a reservation, and a reservation is not an SLA. Minimum service claims require aggregate feasibility admission and accounting for system work that competes with the workload. 9. Proof-sized global tables are labeled as proof limits until they have aggregate owner admission. One workload must not consume every shared waiter, continuation, or verifier permit while another admitted workload has no progress. 10. Status comes from the ledger of record and exposes the effective-limit sources. A profile field with no resource-owner consumer is reported as policy-only or unwired, not as enforced. ## Role in the OS Resource governance keeps commitments feasible and assigns the cost of finite work; it is not a second identity or method-access system. Apply controls in this order: 1. The component that owns the physical resource enforces a structural safety ceiling derived from hardware, ABI, allocation, or verified implementation constraints. A hard-coded value is acceptable here only with that derivation, or as a clearly labeled proof/bring-up bound. 2. Admission withholds bounded lifecycle, health, audit, recovery, and local administrative reserves before publishing ordinary capacity. These reserves cannot be borrowed by normal traffic merely because the system is busy. A public path or caller-supplied route label is not enough to select a reserve; the protected lane needs distinct authority or non-bypassable listener/ transport provenance. 3. A parent ledger delegates bounded generation-tagged credit to services, processes, sessions, or subtrees. Resource owners accept that credit, not a caller-provided identity or quota number. 4. A work-conserving fair arbiter schedules admitted contention. An idle owner need not strand ordinary capacity, but opportunistic borrowing is revocable and never consumes protected reserves or creates an SLA. 5. Manifest/profile policy chooses administratively useful values below the admitted ceiling and exposes effective readback. Production policy values are calibrated from real workload and hostile-coexistence measurements, not copied from a proof topology or chosen solely to simplify an array. This gives an operator authority to tighten or enlarge a workload's policy within the parent pool without recompiling the kernel. Raising a quota still requires feasible pool credit; lowering it defines what happens to existing reservations rather than retroactively corrupting them. Integrity, authority isolation, secret handling, and memory safety remain non-negotiable. Within those constraints, prefer the design that preserves useful progress and has the better measured attacker/defender cost. If a stronger-looking control makes global denial cheaper, keep the safer usable mechanism and document the residual risk, capacity assumption, observability, and next mitigation. Before identity exists, there may be nothing meaningful to authorize at TCP or TLS level. The service therefore owns a bounded anonymous-ingress pool and fair queue, with progress deadlines and protected control capacity. Source-address signals may add defense in depth, but lack of a stable principal does not justify either unbounded work or one unauthenticated peer monopolizing a global slot. No scheduler can guarantee progress to one particular anonymous remote caller against an unbounded set of indistinguishable Sybil attempts. The honest contract is bounded attacker/defender cost, no privilege for queue-flooding or reconnect churn, randomized or aging-aware work-conserving selection, and observable overload. Deterministic progress needs distinguishable authority, such as the protected local recovery lane or a reviewed upstream admission token. ## Identity and Pre-Authentication Work TCP state, TLS work, request parsing, cookie rejection, login backoff, password hashing, and response bytes are consumed before or while identity is being established. They belong to a service or anonymous-ingress ledger. A successful login cannot retroactively charge already-spent work to the resulting operator session. After authentication, a session may explicitly donate bounded CPU, queue, buffer, or response-byte credit to identified server work. The donation is scoped to that request/session generation and returns on completion, cancellation, timeout, logout, or revocation. Source addresses and CIDRs may restrict network reachability, identify a trusted proxy, or feed one anti-abuse signal. They are not browser identity or resource-account identity. This distinction is mandatory behind a load balancer, where many users share one backend peer and forwarded headers are trustworthy only from an explicitly admitted proxy range. At hard emergency capacity, an L4 implementation may drop or reset before HTTP framing exists. Once HTTP framing is available, ordinary policy overload should return a typed `429` or `503` with bounded retry guidance. Neither outcome is authentication. ## Current Enforcement The repository has useful local ledgers, but it does not yet implement the full system contract. | Area | Current state | Missing contract | | --- | --- | --- | | Capability holds and transfer | Cap-table slots, generations, transfer scope, reservation, and rollback enforce qualitative authority. | Capability possession does not carry a quantitative service entitlement. | | Process profile application | Process construction applies cap and thread limits; ring/reply values influence ring construction. | Service entries do not select a resource profile explicitly; several profile fields have no resource-owner consumer, and unknown profile resolution may fall back to defaults. | | Frame and virtual memory | `ResourceLedger` preflights frame-grant and virtual-reservation pages on current paths. | Manifest memory/frame values are not the enforced maxima, their composition needs an explicit contract, and mismatched release must not be saturated away. | | Outstanding calls and scratch | Counters exist in `ResourceLedger`. | Production reservations are incomplete; per-thread ring scratch and fixed queues multiply outside aggregate scratch accounting. | | Endpoints | Per-endpoint queue and in-flight values bound logical state. | Backing is sized by structural maxima, limits are not aggregate per owner, and one endpoint can preallocate far more than its selected logical queue. | | Shared kernel continuations | Notification and pipe tables have finite proof bounds. See the [landed promised-answer descriptor inventory](#landed-promised-answer-descriptor-inventory) for the promise-pipeline table. | Notification and pipe bounds, and the promised-answer gaps recorded in its inventory, remain system-global without complete process/session credit or protected cross-owner progress. | | Scheduler | WFQ weight controls relative share; `SchedulingContext` enforces a spendable throttle; CPU isolation controls placement/nohz/exclusivity. | There is no general aggregate CPU feasibility admission that justifies a reservation or SLA claim. | | Logs and audit | See the [landed diagnostic output descriptor inventory](#landed-diagnostic-output-descriptor-inventory). | The inventory records the remaining accounting and lane-separation gaps. | | DMA/device resources | Generation-bound ownership, queue depth, and device budgets provide strong structural/isolation ledgers. | These limits do not by themselves grant a tenant quota or service guarantee. | | Virtio-9p client | See the [landed virtio-9p client descriptor inventory](#landed-virtio-9p-client-descriptor-inventory). | The fixture client has message, allocation, queue, polling, directory, and scratch-fid ceilings, but one completion-path failure can strand its sole descriptor for the rest of the boot. There is no per-caller charge, aggregate work budget, protected recovery reserve, or fairness contract. | | Task-coordinator core tables | See the [landed coordinator core-table descriptor inventory](#landed-task-coordinator-core-table-descriptor-inventory). | Task, retained-generation, and live-lease counts plus Rust-owned key/vector/string stored and allocated bytes are observable. All fixed scan classes retain visits and scanned-entry high-waters, including the readback's own table traversal; clock-bearing conflict, state-transfer, and lock-list dispatches additionally retain elapsed dispatch-envelope high-waters. Other visits, including every readback traversal, remain explicitly unmeasured. Ordered-map nodes and allocator-internal overhead remain unmeasured. There is no per-actor charge, protected recovery reserve, or admission budget for that work. | | Task-coordinator HTTP/JSON adapter | See the [landed adapter descriptor inventory](#landed-task-coordinator-httpjson-adapter-descriptor-inventory). | The request, parser, static-token, connection, and actor-projection ceilings are local structural bounds. Connection, projection, retained request/response-byte occupancy, and send-progress readback is landed, but there is no per-caller charging, protected recovery capacity, or charge for lower-layer slots, continuations, backend CPU, or coordinator work. | | Remote-session/WebUI network path | See [Remote-session/WebUI network-path enforcement](#remote-sessionwebui-network-path-enforcement), the [shared network-stack socket-object inventory](#shared-network-stack-socket-object-table), the [WebUI ingress inventory](#landed-webui-ingress-descriptor-inventory), and the separate [CapSet gateway connection inventory](#landed-capset-gateway-connection-descriptor-inventory). | See [WebUI proof boundary](#webui-proof-boundary) and the open gaps in the two service inventories. The shared socket-object readback observes fixed-class pending ring continuations, structural per-slot service-object backing, and smoltcp transport-buffer backing but accounts for neither service ledger and does not charge those memory classes or backend CPU. | The exact current consumers are also summarized in [Configuration](../configuration.md). Transaction and transfer mechanics stay in [Authority Accounting](../authority-accounting-transfer-design.md); memory, IPC, scheduling, manifest startup, and DMA pages own their subsystem details. The [Resource Accounting proposal](../proposals/resource-accounting-proposal.md) records unfinished extensions and rationale rather than overriding this current-state matrix. ### Landed promised-answer descriptor inventory This inventory applies the [Required Resource Descriptor](#required-resource-descriptor) to the kernel's shared promised-answer state. It is authoritative for the resource-governance status of kernel-served and Endpoint pipeline answers. The ring ABI remains authoritative for flags, result codes, and the per-caller limit; this section records how their retained continuation cost is owned and observed. #### Shared promised-answer table and per-caller admission - **Dimension, derivation, and effective value:** Retained promised answers, in fixed table entries. `MAX_ENDPOINT_PROMISED_ANSWERS` in `kernel/src/cap/ring.rs` fixes one system-global table at 64 entries. Its worst-case resident backing is exactly 64 `Option` records plus one fixed readback-counter block in kernel static memory; each live record carries the kernel-generated caller-thread/epoch key, the caller's answer id, frozen scope bounds, state, and storage for up to the ABI's 16 `CapTransferResult` records. The read-only ABI constant `MAX_PROMISED_ANSWERS` is 16 because one 16-entry SQ batch can allocate at most one answer per SQE; admission applies that cap per caller thread before using a global slot. Both values are code-owned nonzero structural ceilings. There is no manifest/profile override, delegated credit, selected policy quota, pool subdivision, or zero semantic. - **Authority, lifecycle, overload, and recovery:** A caller holding the target capability and submitting `CAP_SQE_PIPELINE_ANSWER` requests reservation. The kernel's `ENDPOINT_PROMISED_ANSWERS` mutex and array are the sole owner and ledger from reservation through retirement. Admission scans the bounded table for the caller's live count and duplicate id before publishing the record, then refuses before target dispatch if either the per-caller cap or global free-slot condition fails. The caller supplies no separate reservation authority and no process, session, service, tenant, or subtree ledger is charged. There is no donation, expiry deadline, wait queue, backpressure retry guidance, or protected lane; recovery requires an existing record to retire or caller teardown to remove it. - **Ledger observability, attacker/defender cost, and open gaps:** `promised-answer-readback` publishes configured global capacity and per-caller cap, live occupancy, service-lifetime high-water, cumulative successful reservations and removals, and saturating typed refusal totals. It cannot distinguish which owner occupies the table and deliberately carries no PID, thread reference, generation, answer id, capability id, opcode, or scope value. One caller is locally capped at 16, but four caller threads can consume the global 64 slots and deny unrelated callers. There is no per-process or per-session credit, aggregate owner admission, reservation charge, fairness, protected cross-owner progress, timeout, or minimum-service contract. Each admission/lookup scan costs at most 64 entries; retained result-cap storage is paid from fixed kernel memory rather than charged to the triggering caller. #### Drain and cross-drain lifetime - **Dimension, derivation, and effective value:** Kernel-served answers use the same global record and resolve within the allocating frozen SQ-tail scope. Endpoint answers may remain across drains while awaiting userspace `RETURN`; their private monotonically advanced epoch and full caller-thread generation key prevent a late return from resolving a newer batch that reused the userspace answer id. Both kinds retain state only through the frozen tail: ordinary drain completion removes matching records, while thread/process teardown removes all matching records. This is a generation/lifetime fence, not quantitative owner credit. - **Authority, lifecycle, overload, and recovery:** Reservation publishes exactly one `Reserved` record before dispatch. Synchronous completion commits resolved result capabilities or failure; an unresolved non-Endpoint pending call becomes `Unresolved`; an Endpoint pending call becomes `AwaitingEndpointReturn` and later commits resolved or failed state. Lookup never transfers ownership of the record. Frozen-tail retirement or teardown clears each occupied slot once and increments cumulative removals by the number cleared. A rejected reservation publishes no record and needs no rollback. Cancellation and endpoint-owner failure converge through the existing failed-answer and teardown paths; there is no independent lease, expiry, or reaper. The readback changes none of these transitions, wake latches, dispatch choices, or refusal results. - **Ledger observability, attacker/defender cost, and open gaps:** Live occupancy includes reserved, awaiting, unresolved, resolved, and failed records because all consume the same physical slot; there is no per-state occupancy split. Reservations and removals expose balance at quiescence, but there is no mismatch counter because removal is derived from occupied slots under the owning mutex. There is no absolute retention deadline or timeout counter. A server that retains an Endpoint call can hold the caller's slots and fixed result-cap backing until return, failure, or caller teardown; a caller can therefore impose bounded persistent kernel memory and bounded scans without a corresponding session/process charge. #### Typed overload and bounded readback - **Dimension, derivation, and effective value:** The existing typed CQE refusals remain authoritative: `CAP_ERR_PIPELINE_ANSWER_LIMIT` covers either the 16-answer caller cap or the exhausted 64-entry global table; `CAP_ERR_PIPELINE_DUPLICATE_ANSWER` covers reuse of a live caller/answer-id pair; `CAP_ERR_PIPELINE_UNKNOWN_ANSWER` covers a dependent naming no answer in its frozen scope; and `CAP_ERR_PIPELINE_UNRESOLVED` covers a present drain-local answer that did not resolve. No code or manifest value selects a different result. - **Authority, lifecycle, overload, and recovery:** Each refusal counter increments only on the pre-existing branch returning that result. The observer snapshots its counters inside the existing table transaction. Serial publication is compiled only for the `promise_pipeline_proof` feature used by the focused QEMU gate; ordinary production builds retain bounded counter updates but have no promised-answer readback output path. In that proof build, formatting starts only after releasing the mutex, allocates nothing, adds no interrupt-disabled section, and uses fixed 1,024-byte stack storage through `write_bounded_readback_line`; the saturated record remains below the Console call ceiling. The first successful reservation emits once, every occupancy or high-water change emits immediately, and counter-only changes emit only at exact powers of two. Restart resets the service-lifetime observations. - **Ledger observability, attacker/defender cost, and open gaps:** The record is proof-only read-side evidence, not admission authority. It reports neither caller identity nor whether `ANSWER_LIMIT` came from the local or global ceiling, and it has no wait time, deadline, CPU-time, UART-drop, or readback-delivery guarantee. Proof-feature occupancy output can add one bounded serial record per successful reservation and removal, while counter damping prevents linear output for repeated refusals; default builds grant no ambient diagnostic-output path to pipelining callers. The focused promise-pipeline proof requires nonzero reservations/high-water and a final `live=0` with reservations equal to removals; ordinary builds emit no record. The separate answer-limit/duplicate and unresolved-antecedent proof tasks remain the owners of those fail-closed behavior cases; zero refusal counters here do not claim their coverage. ### Landed virtio-9p client descriptor inventory This inventory applies the [Required Resource Descriptor](#required-resource-descriptor) to the current virtio-9p client bounds. It is authoritative for their resource- governance status. The [virtio-9p device page](../devices/virtio-9p.md) remains authoritative for the implemented wire subset, capability mapping, and failure semantics. The client is a QEMU development fixture, not production storage authority. #### Message, name, directory, and transient-memory ceilings - **Dimension, derivation, and effective value:** `VIRTIO_9P_MSIZE` in `kernel/src/virtio.rs` requests a 4,096-byte 9P message ceiling; `Virtio9pDriver::handshake` accepts a server-shrunk value and every later codec uses that negotiated value. `VIRTIO_9P_MAX_READ_BYTES` and `VIRTIO_9P_MAX_WRITE_BYTES` cap one capability read or write at 4,096 bytes; `MAX_FILE_BYTES` and `MAX_WRITE_BYTES` in `kernel/src/cap/virtio_9p_fs.rs` refuse larger ABI calls before transport use. `VIRTIO_9P_MAX_NAME_LEN` caps one path element at 255 bytes, `VIRTIO_9P_MAX_TAG_LEN` retains at most 64 device-config bytes, `VIRTIO_9P_MAX_DIR_ENTRIES` retains at most 64 listed entries, and `VIRTIO_9P_MAX_READDIR_ROUNDS` permits at most 64 server-driven listing rounds. `Virtio9pDriver::exchange` uses one dedicated request and one reply DMA page; fixed-size messages use 256-byte `VIRTIO_9P_HANDSHAKE_SCRATCH` stack arrays, while `Virtio9pDriver::read_scratch_once`, `Virtio9pDriver::write_scratch_once`, and `ninep_collect_root_names` allocate a heap frame no larger than negotiated `msize`. The read result can additionally retain up to 4,096 bytes, and a listing retains up to 64 names plus result metadata; these bounds do not account for allocator overhead as a whole-operation physical-memory budget. All values are code-owned structural ceilings with no manifest/profile value, delegated credit, pool share, or zero semantic. - **Authority, lifecycle, overload, and recovery:** Holding a fixture-gated `Directory` or `File` capability authorizes the operation; the calling process pays its ring payload and result capacity, while the kernel owns validation, transient allocation, driver work, and cleanup. Oversized names, writes, mount tags, directories, or listing-round counts fail closed; oversized reads and unrepresentable byte ranges are refused at the capability boundary. A server-shrunk `msize` reduces later wire and heap-frame limits. Transient frames and result vectors drop when the synchronous call returns. There is no reservation token, cancellation path, expiry, partial-memory credit, or protected allocation reserve. A later valid call can recover from a pre-transport structural refusal after the current call unwinds; a completion-path failure has the boot-lifetime failure mode described below. - **Ledger observability, attacker/defender cost, and open gaps:** `virtio-9p-queue-readback` publishes the configured and effective queue depths, five-page DMA ceiling, negotiated `msize`, queue occupancy, an aggregate saturating structural-refusal count, separate logical-length and allocated-capacity high-waters for the negotiated-`msize` transient heap frame, retained read result, and retained listing-name storage, and an allocated-capacity high-water for retained listing-container elements. The driver-local simultaneous transient-plus-retained peak and whole-operation peak include every published capacity value; encoded Cap'n Proto results remain logical bytes, and reply scratch uses its allocated backing. The companion `virtio-9p-device-backing-readback` record carries the whole-device resident backing this record excludes: `fixed_device_page_backing_bytes` is `dma_page_budget` times `dma_page_bytes` -- 20,480 configured bytes from the fixed five-page kernel pool (three split-ring pages plus request and reply bounce pages) -- and `whole_device_resident_backing_bytes_high_water` adds that structural value to the simultaneous transient-plus-retained capacity peak republished on the same line. `fixed_backing_derivation=code-owned-page-budget` marks both as structural derivations of the code-owned page budget rather than live physical-memory measurements or per-caller charges, and `resident_scope=fixed-pages-plus-driver-heap` names the total as device-owned backing only: the ring-owned reply scratch and the encoded result are charged to the calling process, so the combined value reads below the `operation_hw` peak on the paired queue record, which includes both. It is a separate record because the saturated queue line already sits at its Console-call length bound with the established headroom. That same length bound is why the device-backing record also carries the fixture family's own output cost as the base-36 `readback_cost=withheldPublications,formattedRecordBytes,consoleCalls` tuple, with `readback_cost_scope=queue,device-backing,scratch-fid` naming the three records it aggregates so it is not read as device-backing-only cost. The whole-operation value covers both the driver capacity phase plus scratch already allocated before transport and the later phase where retained read or listing capacity coexists with the encoded result and post-encoding scratch. Allocator-internal overhead, physical frames beyond the fixed five-page pool, and QEMU-side host-filesystem memory, CPU, cache, and I/O cost remain excluded. The record contains no caller, path, name, tag, fid, capability, or file-content material. It is observer evidence rather than an effective-limit capability: there is no per-caller charge or used/reserved-byte ledger, allocator-overhead accounting, aggregate work or CPU budget, protected recovery reserve, or fairness contract. A hostile caller can repeatedly submit maximum valid calls; a hostile server can force the bounded listing rounds and per-entry `Tgetattr` work. The client remains a QEMU development fixture rather than production storage authority. #### Single request queue and polled exchange - **Dimension, derivation, and effective value:** `VIRTIO_9P_REQUEST_QUEUE_SIZE` in `kernel/src/virtio.rs` and `VIRTIO_9P_KERNEL_DMA_QUEUE_DEPTH_BUDGET` in `kernel/src/device_dma.rs` cap queue depth at eight descriptors; initialization further clamps it to the device maximum and a power of two. Each `Virtio9pDriver::exchange` publishes one two-descriptor request/reply chain. `VIRTIO_9P_KERNEL_DMA_PAGE_BUDGET` fixes the device DMA pool at five pages: three split-ring pages plus the request and reply bounce pages. `Virtqueue::poll_used_within_ns` enforces the single five-second `VIRTIO_9P_COMPLETION_BUDGET_NS` contract in both usable clock modes: the calibrated clock uses an absolute monotonic-nanosecond deadline, while the tick-derived clock accumulates elapsed counts from the current CPU's calibrated periodic LAPIC timer. Tick-derived clock mode disables nohz, so that local counter remains periodic on both BSPs and APs while the poll preserves the interrupt-disabled syscall context. `VIRTIO_9P_COMPLETION_FALLBACK_SPIN_LIMIT` is used only before a calibrated clock or periodic LAPIC timer is available, not as the tick-derived deadline. The effective in-flight count is one because `with_9p_driver` holds the single driver mutex across the complete façade operation; unused ring capacity is not caller entitlement. - **Authority, lifecycle, overload, and recovery:** The kernel-owned `Virtio9pDmaLedger` owns page generations, queue registration, submission, and completion. `Virtio9pDriver::exchange` always submits on descriptor head 0, records submission before notification, and clears that active slot only after completion validation and DMA accounting both succeed. A timeout, malformed used-ring completion, or accounting failure returns a transport error before the slot is cleared. Every later exchange then fails `submit_request_chain(0, ...)` with `DescriptorAlreadyActive`; the resident driver is neither reset nor reinitialized, so the first such failure denies all later 9p work until reboot. There is no interrupt or queued waiter, because `QueueInterruptPlan::polled` claims no device `Interrupt` authority, and there is no operation cancellation, retry protocol, or recovery lane. The tick-derived poll reads the local LAPIC countdown without changing IF, so it admits neither timer delivery nor unrelated device/IPI vectors while the driver lock and descriptor ownership remain live. Bring-up failure leaves the device unpublished; `Virtio9pDriver::drop` resets before freeing DMA and quarantines the ring and bounce pages if reset cannot be confirmed, but the resident driver does not drop after an ordinary request failure. - **Ledger observability, attacker/defender cost, and open gaps:** `virtio-9p-queue-readback` reads the ledger through `virtio_9p_queue_account_snapshot` and publishes live/high-water in-flight submissions plus cumulative submissions/completions. It emits once after bring-up, immediately when the service-lifetime in-flight high-water changes, and after a completed exchange when either cumulative total reaches an exact power of two. Binary live occupancy is published in those snapshots but does not itself trigger output. Saturating mutually exclusive failure counters distinguish calibrated-monotonic, tick-derived, and spin-backstop poll expiry; malformed used-ring completion; DMA accounting failure; and `DescriptorAlreadyActive` refusal, with counter-only output at exact powers of two. The fixed production formatter remains below the 1,024-byte Console call ceiling, and the normal read/write QEMU proofs require an untruncated post-handshake record, nonzero structural-refusal attribution, and no more than 32 records per proof boot. These records change no transport or recovery decision and are read-side evidence over a QEMU fixture, not production storage authority. A slow or hostile server can still consume one active five-second bound and permanently deny every later 9p caller, including coordinator persistence, for the rest of the boot. The early-boot spin backstop remains hardware-speed-dependent. There is no queue wait, per-caller charge, aggregate work budget, protected recovery reserve, or fairness between persistence and another consumer. #### Singleton scratch fid and driver serialization - **Dimension, derivation, and effective value:** `VIRTIO_9P_SCRATCH_FID` in `kernel/src/virtio.rs` is the one server-side scratch fid for the bound device. `with_9p_driver` serializes every façade call under `VIRTIO_9P_DRIVER`; each transaction walks the attached root onto that fid, performs its operation, and calls `Virtio9pDriver::release_scratch`. The singleton is structural and device-lifetime scoped, not a per-process slot, manifest quota, or donated credit. - **Authority, lifecycle, overload, and recovery:** `Virtio9pDriver::walk_scratch` marks `scratch_bound` before sending `Twalk`, because a lost, malformed, or otherwise undecodable reply leaves server state unknown. Replies proving that no fid was bound clear the mark. `release_scratch` sends `Tclunk`; a confirmed `Rclunk` or server `Rlerror` clears the mark, while a preflight, transport, or protocol failure preserves it. While descriptor head 0 remains reusable, the next walk first attempts another clunk, so known server proof converges without silently reusing a possibly-live fid. A timeout, malformed used-ring completion, or accounting failure during the original exchange or reclaim instead leaves head 0 active and prevents every later reclaim submission until reboot. There is no second fid, cancellation, lease, protected recovery fid, or independent progress lane. - **Ledger observability, attacker/defender cost, and open gaps:** `virtio-9p-scratch-fid-readback` publishes current bound state, its binary high-water, and service-lifetime saturating attempt and terminal-outcome counts. Every walk attempt terminates as a confirmed bind, partial-walk no-bind, walk `Rlerror` no-bind, transport failure preserving the mark, or protocol failure preserving the mark. Every clunk attempt terminates as a confirmed `Rclunk`, clunk `Rlerror`, or preflight, transport, or protocol failure preserving the mark. Separate counts cover pre-walk reclaim retries and defensive releases observed while already unbound; a negative unit test drives the latter rather than treating a normal-path zero as behavioral proof. The observer emits once after bring-up, when the binary high-water first changes, after a confirmed `Rclunk` whose cumulative clunk-attempt count is an exact power of two, and at exact powers of two for failure, reclaim, and mismatch counters. Intermediate successful walk/clunk counters and live bound-state toggles never trigger output by themselves. The fixed formatter remains below the 1,024-byte Console call ceiling and contains no path, name, tag, fid value, capability, or file-content material. This record carries no self-cost tuple of its own: its bytes, its Console call, and its due-check misses are charged into the aggregate published on `virtio-9p-device-backing-readback`, and a miss count reaching an exact power of two republishes that paired queue/device-backing publication rather than this record. The normal read/write QEMU proofs require nonzero bind and confirmed-clear attribution, an unbound final record, and at most 32 scratch records per boot. This is observer evidence over a QEMU fixture and changes no walk, clunk, submission, timeout, or recovery decision. There is still no per-caller accounting, queue-time or CPU budget, fairness, protected recovery fid, or accounting of QEMU-side fid and host-filesystem cost. ### Landed diagnostic output descriptor inventory This inventory applies the [Required Resource Descriptor](#required-resource-descriptor) to the current console, diagnostic-readback, and audit-output bounds. It is the authority for their resource-governance status. The subsystem pages and code own their wire and lifecycle semantics. These controls bound individual calls, selected hostile counters, and retained records; they do not establish a system-wide log-byte quota, a CPU budget for ordinary formatting or UART polling, or a protected audit lane. #### Virtio-9p queue readback output - **Dimension, derivation, and effective value:** The [virtio-9p client descriptor inventory](#landed-virtio-9p-client-descriptor-inventory) owns the underlying queue, allocation-byte, and refusal semantics. `Virtio9pQueueReadbackSnapshot` formats one identity-free fixed-field record in 1,024-byte stack storage, and the saturated host test keeps the timestamped line below the 1,024-byte Console call ceiling without renaming the established readback fields. That line has no remaining length budget, so the fixed device-page bytes and the combined resident-backing high-water are published by the companion `Virtio9pDeviceBackingSnapshot` record, whose own saturated host test proves its bound at full-width decimal values rather than at a saturation sentinel, and now keeps a 32-byte reserve below the ceiling rather than the 7 bytes it needed before it carried a self-cost tuple. That test and the other virtio-9p fixture host tests run under the `test-kernel-virtio-9p-fixture` gate, because `cargo test-kernel` builds the default feature set and substitutes `virtio_stub.rs`. Both backing values are structural derivations from the kernel's configured five-page pool, not live measurements. The device-backing record additionally carries `Virtio9pReadbackOutputCost` as the base-36 `readback_cost=withheldPublications,formattedRecordBytes,consoleCalls` tuple, whose wire placement the [virtio-9p device page](../devices/virtio-9p.md) records; what the counters charge and what they leave uncharged is governed here. `formattedRecordBytes` counts the stable record handed to the bounded readback writer, including the line that publishes the count: `resolve_self_inclusive_output_cost` in `capos-lib/src/virtio_9p_readback.rs` solves that self-inclusive value by re-rendering candidates until the count stops moving, which terminates within one iteration per base-36 digit. Discarded candidates are formatter work and stay uncharged, as do the writer's tick prefix, the line terminator, the LF-to-CRLF expansion, and the UART polling those bytes cause. - **Authority, lifecycle, overload, and recovery:** `Virtio9pQueueObserver` emits once after bring-up, immediately on a service-lifetime in-flight or allocation-byte high-water increase, and at exact powers of two for completed-exchange totals and failure/refusal counters. A due-check miss is charged only when the observer is already live, so the published count means "sampled and not due" rather than folding in pre-bring-up consultations, and a reader can distinguish that from "never sampled". Only that miss count may make a cost-only publication due, and only at exact powers of two; formatted bytes and Console calls advance solely while a record is already being published, so no emission feedback loop exists. A cost-only publication republishes the paired queue and device-backing lines, which keeps their position-for-position correspondence intact and keeps per-boot record growth logarithmic in the miss count. A directory listing accumulates its driver and capability-encoding allocation peaks and publishes at most one allocation observation when the complete listing operation unwinds, including an error return; it never emits per entry or per `Treaddir` round. Binary live occupancy alone does not trigger output. Restart clears the observations. The observer reserves no memory or UART capacity and changes no allocation, admission, submission, timeout, reclaim, or recovery decision. - **Ledger observability, attacker/defender cost, and open gaps:** Successful-traffic emission is bounded per listing operation and otherwise high-water- and logarithmic-counter-driven. The read-only QEMU harness pins the observed 1,024-byte read to `simultaneous_bytes_high_water=5120`, `encoded_hw=1048`, `scratch_hw=65536`, and `operation_hw=70656`; the writable harness pins its 4,096-byte read to `retained_read_capacity_high_water=8170`, `simultaneous_bytes_high_water=12266`, `encoded_hw=4120`, `scratch_hw=65536`, and `operation_hw=77826`, proving retained spare vector backing is included. Both additionally require every transient, read-result, and listing-name capacity high-water to be at least its logical-length counterpart, require nonzero retained listing-element capacity, and require the simultaneous and whole-operation peaks to include that capacity. On the companion device-backing record both require a nonzero fixed backing equal to `dma_page_budget` times `dma_page_bytes`, and a combined resident total that is exactly that fixed value plus the simultaneous peak and never smaller than it; the writable harness additionally pins `whole_device_resident_backing_bytes_high_water=32746` against its 12,266-byte peak. Because that per-record arithmetic is what the formatter computes by construction, the cross-record check is what carries the load: both harnesses require the queue and device-backing records to agree on the simultaneous peak position-for-position, which detects a future desynchronization of the paired writes that no self-consistent single line could reveal. They also cap a normal proof boot at 32 records of each readback kind, require nonzero read/listing attribution, and exercise a nonzero structural refusal. The current frame and listing-name constructors produce capacity equal to logical length in these proofs; their separate fields make that allocation policy explicit and prevent a future constructor change from silently invalidating the accounting. Both harnesses additionally reconcile the published self-cost tuple against the boot's own Console transcript through `tools/virtio-9p-readback-cost-check.sh`: on every device-backing line the published Console-call count must equal the number of fixture records emitted so far and the published byte count must equal their summed record lengths, both including the publishing line, the miss count must never fall, the bring-up publication must read `0,,2`, and the final record must carry nonzero attribution in all three positions. That reconciliation is what makes the tuple evidence rather than a plausible counter: a counter advanced on the wrong events, double-charged, or blind to the scratch-fid record fails it while still reading well-formed. Record bytes are still only the bytes handed to the bounded writer. Every emitted record still performs uncharged formatting and bounded UART polling in the interrupt-disabled driver context, and the tick prefix, terminator, CRLF expansion, and UART bytes remain outside the charge. Allocator-internal overhead, physical frames beyond the fixed pool, and QEMU-side host cost remain excluded; the structural totals are neither live physical-memory measurements nor per-caller charges. There is no aggregate serial-byte quota, protected diagnostic lane, deadline, backpressure result, or dropped-readback count. #### Virtio-9p scratch-fid readback output - **Dimension, derivation, and effective value:** The [virtio-9p client descriptor inventory](#landed-virtio-9p-client-descriptor-inventory) owns the underlying singleton-fid state and recovery semantics. `Virtio9pScratchFidReadbackSnapshot` formats one identity-free fixed-field record in 1,024-byte stack storage; its saturated kernel test keeps the timestamped line below the 1,024-byte Console call ceiling. - **Authority, lifecycle, overload, and recovery:** `Virtio9pScratchFidObserver` emits once after bring-up, on the first binary bound high-water, after confirmed `Rclunk` outcomes at power-of-two cumulative clunk attempts, and at exact powers of two for failure, reclaim, and mismatch counters. Intermediate successful outcomes and live bound-state toggles never trigger output by themselves. Restart clears the observations. The observer reserves no UART capacity and changes no walk, clunk, submission, timeout, reclaim, or recovery decision. Its emissions and due-check misses are charged into the fixture family's shared `Virtio9pReadbackOutputCost`, and a miss count reaching an exact power of two republishes the queue and device-backing pair that carries the tuple rather than this record. - **Ledger observability, attacker/defender cost, and open gaps:** Successful-traffic emission grows logarithmically rather than twice per walk/clunk transaction. The read/write QEMU harnesses cap a normal proof boot at 32 scratch records, require nonzero confirmed bind and `Rclunk` attribution, and require the final sampled state to be unbound; the shared self-cost reconciliation additionally requires every emitted scratch record to appear in the Console-call and byte totals the device-backing record publishes, so dropping this record from the charge fails the gate. Every emitted record still performs uncharged formatting and bounded UART polling while the interrupt-disabled driver lock is held; the fixed set of independently sampled failure counters supplies no aggregate serial-byte quota, protected diagnostic lane, deadline, backpressure result, or per-caller charge. #### Console and terminal-session capability call ceilings - **Dimension, derivation, and effective value:** `MAX_SERIAL_CAP_WRITE_BYTES` in `kernel/src/serial.rs` is the code-owned structural ceiling of 1,024 caller payload bytes for both `Console.write`/`writeLine` and `TerminalSession.write`/`writeLine`. `ConsoleCap::call` in `kernel/src/cap/console.rs` enforces it before taking `console_uart`; `handle_write` and `handle_write_line` in `kernel/src/cap/terminal_session.rs` enforce it before taking the separate `terminal_uart`. A pending `TerminalSession.readLine` also retains one prompt in a fixed 1,024-byte array. `MAX_SERIAL_CALL_PARAMS = 1,024 + 256 = 1,280` bytes in `kernel/src/cap/ring.rs` is an earlier whole-params ceiling including Cap'n Proto framing for the implemented Console and TerminalSession methods. The ring classifies and refuses an oversized call before method decode while leaving unknown-method dispatch unchanged. Whole-params refusal returns the structural `CAP_ERR_INVALID_REQUEST` result rather than a decoded application exception; this is the same result contract as the pre-existing Console whole-params cut. There is no manifest value, delegated credit, aggregate owner quota, or zero semantic. These are not physical UART-byte budgets: `writeLine` translates every embedded LF to CRLF and appends another CRLF, so a valid 1,024-byte text can cause up to 2,050 UART bytes. - **Authority, lifecycle, overload, and recovery:** Holding the respective `Console` or live-caller `TerminalSession` capability authorizes a call. The caller pays its ring submission and payload; the kernel owns decoding, formatting, the selected global UART lock, and transmission. An oversized payload or prompt is refused before its caller-supplied bytes reach the selected capability UART, and a later smaller call can proceed immediately. The refusal counter may synchronously emit a sampled observer record on the console UART; that observation changes no admission decision but is UART work caused by the refused call. A valid write holds its selected UART lock through the complete output. `Serial::write_byte` bounds each byte to 100,000 transmitter-ready polls and then drops that byte; there is no whole-call deadline, reservation, rollback token, cancellation, or retry guidance. - **Ledger observability, attacker/defender cost, and open gaps:** Kernel-global saturating atomics retain dropped bytes for COM1 and COM2, aggregate poll exhaustion, separate oversized-refusal counts for Console writes, TerminalSession writes, and TerminalSession prompts, plus accepted-payload high-waters for those same three operation classes. Whole-params refusals are attributed to the selected operation class before decode, so an oversized `readLine` remains prompt-attributed rather than incrementing the write counter. Under the current one-attempt-per-byte behavior, every poll exhaustion drops exactly that byte, so the aggregate exhaustion count equals the sum of the two per-port dropped-byte counts; both are retained to distinguish event cause from per-UART loss attribution. `console-output-readback` publishes the selected console/terminal UARTs and every value in one fixed-field record: once after UART configuration, immediately on a high-water increase, and when a counter reaches an exact power of two. Formatting uses fixed 512-byte storage and the ordinary diagnostic try-lock with its bounded emergency fallback; the longest record is below the 1,024-byte Console ceiling. A global emission guard prevents dropped readback bytes from recursively emitting more records. Atomic updates and emission add no interrupt masking or interrupt-disabled lock section. The record contains no caller text, prompt, PID, capability, or other identity material. The TerminalSession QEMU proof accepts an exactly 1,280-byte write params buffer, requires 1,281-byte write and `readLine` buffers to return `CAP_ERR_INVALID_REQUEST`, observes one refusal in each TerminalSession operation counter with zero Console refusals, and completes a later valid write on the same capability. Counter-only emission is logarithmic, but immediate high-water emission is caller-driven and can remain linear: each of the three 0-to-1,024-byte payload classes can cause at most 1,024 high-water records per boot, and terminal traffic emits those records on the console UART. An attacker can still repeat valid calls without an aggregate charge and make the defender perform up to the per-byte polling bound. Contention remains global per selected UART; formatting and polling have no CPU budget, and no UART quota, deadline, backpressure result, protected audit/lifecycle lane, or recovery guarantee is established. #### Invalid ring/cap submission diagnostic ledger - **Dimension, derivation, and effective value:** `InvalidSubmissionLedger` in `kernel/src/cap/ring.rs` is the single kernel-global ledger; [Authority Accounting §3](../authority-accounting-transfer-design.md#3-diagnostic-rate-limiting-and-aggregation) owns its transaction and aggregation account. A key is `(pid, error_code, opcode, cap_id_bucket)` with the typed capability-error cause retained alongside it. Each key permits four detail emissions per one-second window, each process permits eight detail-or-summary emissions per window, and the global ledger permits 16. A process may retain eight active keys. The fixed 256-entry key table and 256-entry noisy-owner table each prove an entry is at most 64 bytes, so their static backing is at most 32 KiB in total, plus the fixed global-budget and saturating observation fields and mutex. These are immutable code ceilings with no profile, pool-credit, or zero semantic. - **Authority, lifecycle, overload, and recovery:** The rejected SQE automatically charges its process owner; no separate spend capability exists. Recording, observation updates, and bounded table scans occur with local interrupts disabled under the ledger lock. Only a copied, identity-free snapshot leaves the transaction; formatting happens after unlock through `serial::write_bounded_diagnostic_line`, whose stack buffer is 512 bytes and whose UART path uses a try-lock with a bounded emergency fallback. Suppressed counts become summary-eligible after one second; caller-driven ring service attempts at most one due summary, while process teardown emits one final aggregate and releases all keys and its owner slot. Timer-only quiet periods do not flush summaries. - **Ledger observability, attacker/defender cost, and open gaps:** `invalid-submission-readback` publishes live and service-lifetime high-water occupancy against both 256-entry tables, owner-slot exhaustion, emitted detail and summary totals, key/process/global budget suppression observations, key eviction and teardown-reclaim totals, and process-exit summaries in one fixed-field record. It emits once after configured UART selection, immediately on occupancy or high-water change, and at exact powers of two for counter-only changes. Each due caller formats exactly one copied snapshot. The emission guard prevents recursive ownership; contention retains the caller's snapshot through the ordinary non-blocking UART try-lock and bounded emergency fallback rather than waiting, retrying, or dropping the record. Concurrent emergency output may interleave. The QEMU harness bounds the complete record below the 1,024-byte Console ceiling. The record contains no PID, capability, opcode, error, or other identity material. The smoke's console-refusal process drives three same-bucket reserved-opcode submissions to prove nonzero state and counter damping; this is read-side evidence only. These observer records are outside the detail/summary output budgets: one process can cause at most eight key-insertion occupancy records before reaching its active-key share plus its teardown record, while process churn can repeat owner occupancy changes without a one-second charge. Key pressure and the per-process/global output ceilings still aggregate later detail attempts instead of formatting them. If all 256 owner slots remain unreclaimable, `ensure_owner` still refuses the new owner and the submission remains neither retained nor attributed, but the exhaustion total becomes observable. Fixed scans and rejection work remain attacker-triggered, and the final process-exit summary remains outside the ordinary one-second output charge. No UART quota, output authority, protected diagnostic lane, or recovery guarantee is established; UART byte loss remains separately observable through `console-output-readback`. The ledger covers only invalid ring/cap submissions; other diagnostics and audit events bypass it. #### Powers-of-two service-ledger readback sampling - **Dimension, derivation, and effective value:** Five service paths reduce counter-only serial amplification. `report_accepted_socket_lifecycle` in `demos/cloud-prod-network-stack-smoltcp-tcp-socket-cap-ipc-smoke/src/bin/server.rs` owns the shared network-stack socket-object readback used beneath task-API, WebUI, and remote-session traffic: boot and occupancy lifecycle changes emit immediately, while refusal/mismatch counters emit only when a `u32` value reaches an exact power of two. `payload_readback_due` and `sampled_counter_changed` in `demos/remote-session-capset-gateway/src/lib.rs` apply the same rule to selected `u64` gateway/principal counters, while principal occupancy changes emit immediately. That service's four sequence-correlated records also count due-check misses and allow only exact-power-of-two withheld-publication changes to publish on cost alone; their formatted bytes and Console calls advance only on an already-due publication. `ingress_reap_evidence_due` in `demos/remote-session-web-ui/src/lib.rs` emits reap overshoot/sweep-gap high-water changes immediately and samples counter-only reap-balance changes at powers of two once its two-phase, quiescent balance guard is satisfied. The same service's `ingress-live-ledger`, `ingress-live-budget-ledger`, `post-drain-response-capacity`, and `request-buffer-capacity` observers count due-check misses and allow only exact-power-of-two withheld-publication changes to trigger cost-only output; formatted bytes and Console calls advance only on an already-due publication. `connection_readback_due` in `demos/task-coordinator-api-service/src/main.rs` and `lease_actor_projection_readback_due` in `demos/task-coordinator-api-logic/src/lib.rs` are two of the adapter's nine per-record due checks: all nine records emit at boot, then only a record whose own occupancy, high-water, admission, or removal state changed emits, and counter-only connection/projection refusals, generation replacements, and projection mismatches emit at exact `u64` powers of two. Each of the adapter's nine records keeps its own due check and its own self-cost tuple: a miss on that check is charged to that record alone, and only an exact-power-of-two withheld-publication change publishes on cost alone, while its formatted bytes and Console calls advance only during an already-due publication. `occupancy_readback_due` in `demos/task-coordinator-service/src/main.rs` applies the same rule to task-count, retained-generation, and transfer-byte refusal counters while task occupancy, encoded bytes, high-water, lease occupancy, and admissions emit immediately when observed. Gateway snapshots are split into four fixed-field lines that share one due check, one gap-free sequence, and one publication, and each task-adapter or coordinator change-only line carries a gap-free sequence; every line is harness-checked against the 1,024-byte console ceiling. The WebUI reap balance remains one bounded record. - **Authority, lifecycle, overload, and recovery:** Each process owns its counters and decides when its `Console` capability is used; no caller owns emission credit. Counters are process-lifetime, saturating observations and recover only on service restart. Sampling changes no admission or release decision, reserves no UART capacity, and supplies no deadline or backpressure result. The WebUI ingress ledger's other general boot and proof records do not use this helper and must not be described as powers-of-two production readback. - **Ledger observability, attacker/defender cost, and open gaps:** For a monotonic sampled counter, emissions grow logarithmically with its value rather than once per refusal. Immediate occupancy or high-water changes can still produce linear output under churn. A connection-only lifecycle change still emits no projection snapshot on the sample path, but the projection record's own due check misses and charges a withheld publication, so an unchanged snapshot is now re-emitted whenever that count reaches an exact power of two. That is logarithmic in due-check misses rather than one line per miss: one unauthenticated proof run publishes the identical projection payload 13 times, 12 of them cost-only. The changed connection record remains linear under connection churn. None of the services coordinates with the kernel invalid-submission ledger or another service’s sampling. The coordinator, the four WebUI ingress records, the four CapSet gateway records, and the nine task-adapter records attribute per-record withheld publications, formatted bytes, and Console calls. Because the gateway's four records share one due check and one publication, their withheld and Console-call counts are equal by construction and only their byte counts distinguish the records; the adapter's nine records each own their due check, so all three counters diverge per record and a reader can separate "this record was sampled and withheld" from "this record was never sampled". No service charges formatting, Console calls, or UART polling to the actor that caused the counter. There is still no aggregate output high-water, UART-byte or polling attribution, Console backpressure result, dropped-readback count, protected diagnostic lane, or global retry/scan-cost budget. #### Ordinary `LogSink` retained-record ring - **Dimension, derivation, and effective value:** `LogRing` in `kernel/src/cap/log.rs` is the single system-global ordinary-log ledger: `LOG_RING_CAPACITY` retains 64 records, `MAX_COMPONENT_BYTES` retains 32 component bytes, `MAX_MESSAGE_BYTES` retains 160 message bytes, and `READ_MAX_RECORDS` caps one `LogReader.read` result at 16 records. The fixed text arrays statically reserve 12,288 retained text bytes from boot; the ring additionally retains each record's tick, level, producer-supplied PID, lengths, and Rust layout padding, so this is not a total-layout byte assertion. `SystemConfig.logLevel` selects the minimum accepted severity at boot; it does not alter capacity. The record and read ceilings are immutable and have no zero, delegated-credit, or per-producer quota semantic. - **Authority, lifecycle, overload, and recovery:** Holding `LogSink` authorizes writes and holding `LogReader` authorizes observation of the shared ring. `LogEntry::new` truncates and printable-ASCII-neutralizes producer text into fixed arrays. A below-threshold record returns `accepted = false` without append or ordinary record forward; its aggregate rejection counter can cause a sampled observer record. An accepted record is appended before one `kprintln!` serial forward; a full ring overwrites its oldest record and increments `dropped_records`, so the next accepted record always recovers space without waiting. Reads are non-consuming cursor scans; zero `maxRecords` returns no records, and an old cursor clamps past overwritten entries. Restart clears the volatile ring and all observations. - **Ledger observability, attacker/defender cost, and open gaps:** `LogReader.read` reports records, `nextCursor`, and cumulative overwrite loss. The identity-free `log-ring-readback` additionally publishes the four configured ceilings, 12,288 effective retained text bytes, live occupancy, cumulative overwrite loss, accepted appends, below-threshold rejections, component/message truncation events, and non-printable bytes neutralized within the retained component/message prefixes. It emits once after configured UART selection, immediately when occupancy changes, and at exact powers of two for counter-only changes. A copied snapshot leaves the ring transaction before formatting through fixed stack storage and the ordinary bounded diagnostic try-lock; concurrent due snapshots take that same non-blocking path rather than being suppressed by a second emission guard. The QEMU harness checks the complete line against the 1,024-byte Console ceiling. Producer `pid`, component, message, capability, and other identity material are excluded. This is observer evidence, not admission authority: there is still no authenticated per-producer charge, protected audit/lifecycle lane, persistent recovery, deadline, backpressure, or aggregate serial-byte budget. Every accepted write still makes the kernel append, format, and poll the ordinary console UART outside the invalid-submission budget, and drop-oldest bounds retained state rather than emission frequency or scan/format work. UART loss remains separately observable through `console-output-readback`. #### General `AuditLog` record field ceilings - **Dimension, derivation, and effective value:** `MAX_AUDIT_ID_BYTES` and `MAX_AUDIT_TEXT_BYTES` in `capos-abi/src/lib.rs` set each of the three opaque ID fields and two text fields to at most 32 bytes. `handle_record` in `kernel/src/cap/audit_log.rs` validates all five before `AuditLogState::record` assigns a kernel-global record ID and formats one `[audit]` line. The schema and ABI publish the same caller contract. These are per-field structural ceilings, not a retained-record count, byte-window quota, or persistence guarantee; `AuditLogState` retains observations but no records. - **Authority, lifecycle, overload, and recovery:** Holding an `AuditLog` capability authorizes append-only emission. An overlong field refuses the complete call before its audit line, increments the counter for that exact field, and permits a later valid retry. Valid capability events and the kernel-internal capability-grant and crash emitters format synchronously through the ordinary kernel diagnostic path, then charge the shared accepted-record and formatted-output-byte observations; only the five-field capability contract charges accepted-field-byte high-waters. Record IDs are process-independent and monotonic for the boot, but there is no reservation, commit/rollback ledger, expiry, cancellation, or durable recovery path. - **Ledger observability, attacker/defender cost, and open gaps:** Kernel-global saturating atomics retain cumulative accepted records; distinct `terminalEventId`, `sessionId`, `principalId`, `profile`, and `authMethod` ceiling refusals; accepted ID-class and text-class byte high-waters; cumulative logical `[audit]` record bytes; and the assigned-record-ID high-water. Logical record bytes cover every formatted `[audit]` body, excluding the generic timestamp prefix, line terminator, and UART LF-to-CRLF expansion. `audit-log-readback` publishes those observations and both configured ceilings in one fixed-field record: once after configured UART selection, immediately when either accepted-field-byte high-water increases, when a record or refusal counter reaches an exact power of two, and when the formatted-byte total crosses a power-of-two boundary. Formatting uses fixed stack storage and the ordinary bounded diagnostic try-lock/emergency path; copied snapshots cannot re-enter AuditLog accounting, and concurrent due records take the same non-blocking output path and may interleave. The host test plus QEMU harness keep the complete line below the 1,024-byte Console ceiling. The record contains no caller-supplied ID or text bytes, PID, capability, or other identity material. This is read-side evidence only: each valid call still makes the kernel format and poll the shared UART without a per-producer charge, protected audit lane, or aggregate output budget. The `volatile` field is descriptive and does not select a different physical sink. There is no reader, persistence, retained record, audit-specific loss attribution, deadline, backpressure result, or recovery guarantee; global UART loss remains separately observable through `console-output-readback`. #### Hardware-audit retained records - **Dimension, derivation, and effective value:** `HardwareAuditRing` in `kernel/src/cap/hardware_audit.rs` owns one system-global, statically backed 64-entry volatile ring. Each append overwrites the oldest entry when full and increments `dropped_records`; `snapshot` and each per-cap `drain` return at most 16 records. `HardwareAuditLogCap` owns a per-holder cursor, not a private record allocation. The optional userspace `AccumulatedAudit` in `demos/hardware-audit-service/src/main.rs` drains that ring, seals four records per Store segment, retains eight sealed segments, and can hold up to three records in its active segment: 35 decoded records in a stable retained state. Appending the fourth active record transiently raises the vector to 36 and writes a ninth sealed Store blob before retention deletes the oldest four-record segment. The count bounds are code-owned and have no manifest quota or zero semantic. The service observes encoded Store blobs and active payload bytes, but allocator capacity and decoded-record overhead remain uncharged, so the record-count derivation is not a complete physical-byte budget. - **Authority, lifecycle, overload, and recovery:** Kernel hardware-cap lifecycle events append without caller-selected identity or quota. Ring overflow drops oldest; a lagging drain re-anchors to the oldest retained sequence and exposes the gap through `dropped_records`, while a cursor ahead of the tail or unequal to the cap cursor fails closed. A successful drain advances its cursor only after result serialization succeeds. The service writes hash-chained, HMAC-sealed segments through its granted `Store` and `Namespace`; on a ninth sealed segment it deletes the oldest blob and removes its records. Store/namespace failure is fatal to the service, whose restart recovery verifies retained segments. Runtime reader admission remains refused because no authority-broker path exists. - **Ledger observability, attacker/defender cost, and open gaps:** Kernel snapshot readback exposes capacity, requested/available/returned counts, sequence bounds, dropped records, truncation, persistence/signature status, and subscriber-policy status. The service exposes accumulated/retained records, sealed and evicted segments, gap markers, chain head, and signing status. Its identity-free `retained-byte-ledger-readback` additionally publishes the configured segment and record ceilings; live retained sealed-blob bytes and their high-water; active payload bytes and records; cumulative written and evicted blob bytes; Store write/delete invocations; and recovery verification, replay, and refusal counts. It emits after startup recovery, immediately when retained sealed-blob occupancy changes, a segment is sealed or evicted, or the retained sealed-byte high-water increases, and at exact powers of two for active-payload occupancy and other counter-only changes. When a nonempty drain run reaches idle, one final record publishes a changed snapshot that the sampler withheld, so an active three-record tail does not remain stale indefinitely. The QEMU harness bounds the saturated fixed-field record below the Console call ceiling, requires startup, seal-boundary, and eviction-boundary records, and caps its bootstrap fixture at one drain readback per record except each complete four-record segment's unsampled third active record. This is a constant-factor reduction, not an asymptotic bound: active-record samples at one and two plus each fourth-record seal keep output linear under audit churn, and an exact-power active-payload value or changed idle tail can add another record. This observation changes no seal, retention, eviction, verification, drain-cursor, or refusal decision, but every readback still adds an unbudgeted Console call and shared UART formatting and polling work. Allocator overhead and decoded-record heap cost remain unobserved, there is no per-owner charge or protected audit lane, and every kernel append still makes an additional unbudgeted `cap-audit:` console forward outside the invalid-submission budget. The ring is global without per-device/owner admission, and protected audit still shares formatting, console, and UART resources with ordinary diagnostics. ### Landed task-coordinator core-table descriptor inventory This inventory applies the [Required Resource Descriptor](#required-resource-descriptor) to the coordinator-owned task map, retained generation high-water map, and live fenced leases. It is the single authority for those structural ceilings; the coordinator implementation and task-backend design remain authoritative for task, transition, dependency, lease-fencing, persistence, and transfer semantics. This is read-side proof over the bounded local/QEMU coordinator. It adds no capability call, table, production storage, authentication, or ingress authority. #### Live task records - **Dimension, derivation, and effective value:** Logical `TaskRecord` entries retained by `Coordinator::tasks` in `demos/task-coordinator-logic/src/lib.rs`. The code-owned `MAX_TASKS` ceiling is 256 and `MAX_STATE_TRANSFER_TASKS` is derived directly from it, so the core count ceiling and transfer count ceiling cannot drift. The independent `MAX_STATE_TRANSFER_BYTES` ceiling is 60 KiB. Effective task capacity is a conservative guarantee: current live tasks plus the remaining transfer bytes divided by the maximum encoded size of one legal create record (maximum key, 32 dependencies, and 16 conflict domains), capped at 256. It is 19 for an empty table; smaller records can raise the observed effective value and may reach 256. The optional 9p service applies its separate 20-task persistence limit before the core. There is no manifest/profile value, delegated credit, aggregate pool, or zero semantic. - **Authority, lifecycle, overload, and recovery:** The coordinator service process pays heap allocation and ordered-map maintenance. A caller presenting the existing Endpoint or HTTP path can request creation but receives no resource credit. `create_task` admits only after structural, dependency, and transfer-size checks; count, retained-generation, or byte exhaustion preserves state and returns the distinct `live-task-capacity-exhausted`, `retained-generation-capacity-exhausted`, or `state-transfer-capacity-exhausted` outcome. Malformed input remains `invalid-argument`. Import constructs and validates a candidate before atomic replacement, so a smaller or empty import removes live records only on success; restart rebuilds the bounded set from the configured persistence path. There is no reservation, rollback token, expiry, or protected task slot. - **Observability and open descriptor gaps:** `CoordinatorOccupancyReadback` publishes configured and effective task capacity, configured and live encoded transfer bytes, live tasks, service-lifetime task high-water, cumulative creation admissions, and distinct task-count and transfer-byte refusal counters. Its base-36 `heap=storedLength,allocationCapacity,capacityHighWater,capacityBelowLengthMismatches` tuple sums Rust-owned bytes for the `String` keys allocated separately by `Coordinator::tasks` and `Coordinator::generation_high_water`; the dependency and conflict-domain `Vec` backing arrays plus their string buffers; and retained lease worker strings, including expired leases whose records remain present. The lease actor is a fixed-width inline `CallerSessionRef`, not a heap string. Stored vector length/capacity includes `len * size_of::()` / `capacity * size_of::()`; string values contribute their byte length/capacity. Every aggregate saturates at `usize::MAX`. Capacity and its high-water must be at least stored length; an impossible aggregate violation increments the saturating mismatch counter without changing coordinator behavior. Ordered-map nodes, inline record fields, allocator-internal overhead, persistence bytes, and physical memory are excluded. The same fixed record attributes seven exclusive scan classes: conflict-domain acquisition, dependency/cycle validation, runnable-set construction, state-transfer size projection/validation (including mutation admission plus export/import), `listTasks` projection, `lockList` projection, and the readback's own table traversal. The lock projection uses the same live-lease predicate as acquisition. The compact tuple `scans=conflictVisits,dependencyVisits,runnableVisits,stateTransferVisits,visitSum,conflictHighWater,dependencyHighWater,runnableHighWater,stateTransferHighWater` gives the four non-projection dispatch classes' saturating visits, the seven-class sum, and their scanned-entry high-waters. Separate typed projection counters are encoded as `projection=listVisits,lockVisits,listHighWater,lockHighWater`. The observer's own traversal is encoded separately as `readback_scan=traversalVisits,traversalHighWater` so a reader cannot mistake it for one of the six dispatch classes; it is described below. The four creation admission/refusal counters share the positional tuple `creation=creationAdmissions,taskCapacityRefusals,generationCapacityRefusals,stateTransferByteRefusals`. Every numeric position in `heap`, `creation`, `scans`, `projection`, and `readback_scan` uses base 36, so no positional tuple mixes radices. The base-36 tuple `timing=conflictDurationHighNs,dependencyDurationHighNs,runnableDurationHighNs,stateTransferDurationHighNs,listDurationHighNs,lockListDurationHighNs,measuredVisitSum,unmeasuredVisitSum,largestDurationClass` uses the short final tokens `conflict`, `dependency`, `runnable`, `state-transfer`, `list`, and `lock-list`. Conflict acquisition, state-transfer validation reached from a clock-bearing transition, and `lockList` can retain measured durations. Dependency validation, runnable-set construction, and `listTasks` never sample `WallClock`, while state-transfer work reached from clock-free creation/export/import also remains unmeasured. A refused transition or lease acquisition that performs no scan takes no finishing sample. Failed, zero, equal, or backwards pairs likewise remain unmeasured and change no coordinator result. Each nonzero duration is a dispatch envelope between two granted clock timestamps: it includes the first clock call's return path, the second call's entry path, and coordinator work surrounding the classified scan; it is not scan CPU time. The `lockList` wire projection occurs after the finishing sample, but the other measured classes can include non-scan decision or mutation work. The base-36 tuple `readback_cost=withheldPublications,formattedRecordBytes,consoleCalls` adds saturating service-lifetime counters for this record. The byte count covers only the stable record passed to Console, including the current record; intermediate fixed-point candidate strings remain uncharged formatter CPU and allocator work. A due-check miss increments the withheld count, and only that counter can trigger a cost-only publication at exact powers of two. Formatted bytes and Console calls advance only during an already-due publication and never trigger another one, preventing an emission feedback loop. A host test pins immediate heap occupancy/high-water emission plus exact-power-of-two mismatch damping and renders the reachable saturated record through the production formatter with at least 32 bytes of headroom below the 1,024-byte Console ceiling. The `largest_scan=overallClass,dispatchClass` pair reports the largest observed scan across all seven classes and, separately, across the six dispatch classes; a third position after `timing=` reports the largest observed duration. The readback traversal is enrolled in the overall selection and structurally excluded from the duration one, so a saturating observer is visible rather than hidden behind a dispatch class. It does not merely compete for the overall position: it visits at least three entries per task plus one per retained generation key while no dispatch class exceeds two, so it takes and keeps that position as soon as any task exists. The dispatch position exists because of that: it is the one that still names driven serve-path work, stays `none` until a dispatch class scans an entry, and continues to move when a dispatch class takes a new lead. Boot emits immediately; occupancy, byte, count/duration high-water, and admission changes emit immediately; other counter-only changes emit at exact powers of two. The traversal counters are the one published pair the due-check ignores: the observer advances them on every sample, so comparing them would make the observer its own emission trigger and feed `readback_cost` back into itself. Any table change that can raise the traversal high-water already moves a live occupancy or retained-heap field. Nested diagnostic brackets drop the inner sample rather than changing coordinator behavior. The record contains no task key, actor, worker, lease holder, generation, expiry instant, or capability material. Endpoint and HTTP/JSON clients receive the same three typed capacity labels; the HTTP adapter returns each as a 409 state conflict without retry-after guidance. The in-memory QEMU proof requires nonzero heap length and capacity, capacity at or above length, zero mismatches, and nonzero withheld-publication, formatted-byte, and Console-call attribution. It also requires nonzero traversal-visit and scanned-entry attribution and that no record claims fewer traversals than published sequence numbers. The two-boot 9p proof requires the same nonzero heap and traversal attribution and zero mismatches on both sides of restart. These are Rust-owned stored/allocated bytes, not an admission charge or physical-memory claim. Remaining gaps include ordered-map nodes, allocator-internal overhead, per-actor charge, admission budget, protected recovery reserve, physical persistence I/O, cleanup CPU, UART bytes and polling, Console backpressure, and a protected diagnostic lane. #### 9p persistence work - **Dimension, derivation, and effective value:** The optional `DirectoryStore` in `demos/task-coordinator-service/src/main.rs` synchronously republishes the changed task record and the generation-floor record for each accepted ordinary mutation; state import alone republishes the complete bounded task set. Both paths use one current/temporary/backup transaction and rollback marker. Logical records are read and written through requests of at most 4,096 bytes, matching the virtio-9p fixture's fail-closed per-request limits; a floor record can therefore span up to five requests without exceeding its 18,695-byte logical bound. `CoordinatorPersistenceWorkReadback` counts commit invocations, successfully committed encoded bytes and the per-commit byte high-water, attempted list/open/read/create/write/sync/rename/remove operations, successful capability-release completions, boot-recovery directory entries examined, records replayed, and failures or refusals. The fixed `directory_ops` tuple orders those eight mutually exclusive attempted-operation classes as listed, and counts each chunked read or write request separately. The `io_bytes` tuple publishes cumulative logical read bytes requested, cumulative logical read bytes returned, cumulative logical write bytes submitted, and the read- and write-request byte high-waters in that order. Read requests and write submissions are charged before dispatch; returned read bytes advance only when the capability call returns a payload, including a short response. Each chunk high-water is structurally bounded by the 4,096-byte request limit. An open attempt is charged before dispatch; its release completion is charged only after the opened file's deferred release flush succeeds, so a release failure remains distinguishable in the fatal persistence-work sample. Each replacement record contributes one commit invocation after the candidate has passed structural validation; its encoded bytes and the byte high-water advance only after the transaction publication rename succeeds. Rolled-back records therefore contribute attempted commits and directory operations but no successfully committed bytes. The readback also brackets the three exclusive top-level transaction classes -- ordinary commit, import replacement, and boot recovery -- once per invocation rather than once per chunked request. Each class tuple publishes visits, measured visits, duration high-water, and logical transported-byte high-water; transported bytes are returned read bytes plus submitted write bytes during that top-level invocation. These are saturating logical request/response counts and byte observations plus elapsed-duration high-waters, not physical device bytes, CPU work, allocator occupancy, or a durability guarantee. - **Authority, lifecycle, overload, and recovery:** The granted writable `Directory` remains the complete storage authority; observing work adds no capability and changes no commit, recovery, failure, or admission decision. Duration sampling uses the already-granted `WallClock`; a failed, zero, equal, or backwards pair is retained as an unmeasured visit and does not refuse, retry, or change the persistence operation or its fatal-storage path. Calls remain synchronous and fail closed under the existing storage error path. A persistence-layer import refusal increments the service-wide refusal counter before returning `persistence-unsupported` without changing live state; fatal storage failures increment it before the existing process-failure path. Boot recovery restores the floor record before task replay, and each invalidated lease is republished through a scoped task-plus-floor transaction charged to the service-wide record rather than a task or caller. There is no reservation, per-owner charge, protected recovery budget, fairness policy, backpressure result, or CAPOSRS1 `BlockDevice` coverage. - **Observability and open descriptor gaps:** The fixed `persistence-work-readback` record is count-, logical-transport-byte-, and duration-shaped and omits task key, actor, worker, lease, generation, and capability material. It publishes each class's visit count, measured-visit count, duration high-water, transported-byte high-water, the class holding the largest observed duration, and aggregate measured and unmeasured visit sums. Every numeric position in `commits`, `recovery`, and `readback_cost` uses base 36, as do the duration/visit summary scalar fields; the remaining numeric fields and tuples stay decimal. `readback_cost=withheldPublications,formattedRecordBytes,consoleCalls` is saturating and service-lifetime scoped to this record. It counts only the stable line passed to Console, including the current line; discarded fixed-point candidates remain uncharged formatter CPU and allocator work. Only withheld-publication changes trigger cost-only output at exact powers of two; formatted bytes and Console calls advance only during an already-due publication. Boot emits after recovery; a larger successful encoded commit or new encoded, chunk, transaction-byte, or duration high-water emits immediately; other counter changes emit only at exact powers of two. Every publication occurs between synchronous persistence operations and says `bytes=logical-request excludes=physical,allocator,durability quiescent=true`. A host test pins the self-observation invariant and renders the longest reachable operation name with saturated values and at least 32 bytes of headroom below the Console capability’s 1,024-byte call ceiling. An isolated empty-share boot proves cold-start ordinary and import transactions perform zero reads while publishing their first floor backups. The two-boot 9p restart proof then seeds an exactly validated empty floor record so the unchanged recovery path observes read bytes on the first boot, requires nonzero read- and write-chunk byte attribution with both chunk high-waters at most 4,096 on both boots, and requires the oversized floor record to produce multi-chunk ordinary-commit and boot-recovery transaction byte high-waters after restart. It also requires nonzero commit/encoded-byte and measured duration attribution plus nonzero withheld-publication, formatted-byte, and Console-call attribution on both sides of restart; requires nonzero list/open/create/release counts on both boots; balances successful opens with release completions; expands the floor record past 4,096 bytes between boots and proves that restart reads and later mutation rewrites it; exercises a live oversized-import refusal on the restored service; proves an import-omitted key is recreated above its pre-restart floor and rejects its old token; and requires the final quiescent record to retain one refusal. Remaining gaps are per-actor charge, admission budget, protected recovery reserve, physical I/O attribution, CPU and allocator accounting, UART-byte and polling attribution, Console backpressure, and a protected diagnostic lane; the proof remains bounded QEMU dogfooding rather than production storage authority. #### Retained per-key generation high-water entries - **Dimension, derivation, and effective value:** Logical `(task key, issued generation)` entries in `Coordinator::generation_high_water`. The map and its canonical 9p floor record have the same 256-entry code ceiling as the task map. With a 64-byte maximum key, one-byte key length, and eight-byte generation, the floor record is bounded at 18,695 bytes including its seven-byte header. It occupies one logical record rather than one directory entry per retired key. The directory ceiling is 64 entries: 60 task current/temporary/backup slots, three floor-record slots, and one transaction marker. Entries survive release, expiry, reset, state replacement, temporary omission from an imported snapshot, and restart on the optional writable-9p path. The export/import snapshot format remains unchanged. - **Authority, lifecycle, overload, and recovery:** Creation of a previously seen key reuses its retained entry. Creation of a new key when all 256 generation entries are retained fails closed before task insertion with `retained-generation-capacity-exhausted`, including when an import has reduced live task occupancy below 256. A successful ordinary persistent mutation atomically publishes its changed task record with the complete floor record; state import atomically publishes the complete task set with that floor record. The floor record's chunked transport changes neither transaction publication nor recovery semantics. Boot recovery restores floors before task records or dispatch. The coordinator service pays retained key/map memory and synchronous scoped persistence work, while the originating actor is not charged. The in-memory path retains floors only for the service lifetime. - **Observability and open descriptor gaps:** The same record publishes `retained_generation_entries` and a distinct cumulative `generation_capacity_refusals` counter, making retained pressure and the full-generation/partially-empty-task-table case distinguishable from live task-table exhaustion without exposing keys or generations. Because retained entries are never removed during a service lifetime, the current count is already its service-lifetime high-water; a second equal field would add no information. The two-boot writable-9p proof removes a key through import, expands the durable floor record beyond one 4,096-byte request, restarts, recreates the omitted key strictly above its durable floor, rejects its pre-restart token, and rewrites the oversized floor record through bounded chunks. There is no per-actor subdivision, reclamation policy for permanently retired keys, mismatch counter, or protected reserve for recovery or administrative replacement. #### Live fenced leases - **Dimension, derivation, and effective value:** Logical leases whose `TaskRecord::lease` exists and whose deadline is strictly later than the sampled monotonic time. A task owns at most one lease, so live occupancy is structurally bounded by the effective task count and needs no second lease table or capacity value. Expired retained lease values are excluded by the same `live_lease` predicate used by acquisition and lock readback. - **Authority, lifecycle, overload, and recovery:** The coordinator service pays the retained lease string/state and conflict scan. Acquisition requires an existing task and refuses with typed `lease-held`, `conflict-domain`, or generation exhaustion outcomes without adding occupancy. Successful release and `active -> ready` reset clear the lease; expiry makes it non-live; import restores none; boot recovery invalidates boot-relative persisted leases; a later acquisition replaces expired state. There is no lease-slot reservation distinct from task admission and no protected lifecycle lane. - **Observability and open descriptor gaps:** The record publishes sampled `live_leases` and its service-lifetime high-water. The publisher reuses the most recent clock sample already required by boot or a clock-bearing transition/lease/lock dispatch, so observation adds no WallClock capability call to other dispatches. `lease_clock=sampleSequence,provenance,reusedReadbacks` identifies the readback sequence assigned to that sample, its fixed `boot`/`transition`/`lease`/`lock-projection` source class, and the saturating service-lifetime count of readbacks emitted without a refreshed sample. A reader can compare the current and sample sequences to detect reuse. There is no timer resampling: after traffic stops, an expiry can still leave the last published live count stale until another clock-bearing dispatch samples time. The record deliberately omits worker, actor, holder task, generation value, expiry instant, dispatch identifier, and capability material. Conflict-domain acquisition records one fixed-class visit and the number of task entries examined, but that observation is not a per-actor or per-worker quota, admission/fairness ledger, CPU charge, denial counter dedicated to lease-table capacity, cleanup deadline, or physical-byte charge. The heap sample itself walks every live task key, dependency and conflict-domain string, retained lease worker string, and retained generation key before the publication due-check, and the same sample walks each task again for the live encoded size and the live-lease predicate. That readback traversal is its own exclusive `readback-table-traversal` scan class: one bracket per sample counts a saturating visit and every string or record it touches, folds into the seven-class `visitSum`, and is enrolled in the overall largest-observed-scan selection. It is counted on every sample, including the samples whose record the due-check withholds, which is the case a per-record count alone cannot show. The class has no position in `timing=` and never records a duration, so it stays visible as an unmeasured visit and can never become the largest-duration class. The observer wins the overall largest-scan position by construction rather than by competition. It scans a key, every dependency and conflict-domain string, and any retained lease worker string per task, then walks each task twice more for the live encoded size and the live-lease predicate, plus one entry per retained generation key -- at least three entries per task where no dispatch class exceeds two. So `largest_scan=` reads `readback-table-traversal` on every record taken over a non-empty table, and its first position no longer distinguishes which serve-path scan is largest. The record therefore publishes a second position holding the largest dispatch class only, selected over the same scanned-entry high-waters with the traversal excluded. That position is `none` until a dispatch class scans an entry, so it remains a falsifiable witness that driven work was attributed, and both QEMU proofs require a named dispatch class and check each record's pair against the published high-waters. The traversal is still uncharged: there is no per-actor charge, admission budget, or protected recovery reserve for that work. The capacity-below-length counter is a defensive aggregation sentinel: safe `String` and `Vec` invariants make a nonzero value unreachable through the running service. Host tests inject the invalid aggregate directly to prove saturation and damping; the QEMU zero assertions confirm the emitted aggregate respects the invariant but do not exercise its failure path. Across all three rows, the coordinator has no protected recovery reserve and no per-actor subdivision. State-transfer size projection/validation, dependency-graph traversal, runnable-set construction, conflict scans, the full `listTasks` and `lockList` projections, and the occupancy readback's own table traversal now have fixed-class count attribution. Clock-bearing conflict, state-transfer, and lock-list dispatches also have elapsed dispatch-envelope high-waters; dependency, runnable-set, `listTasks`, and other clock-free visits remain unmeasured. There is no caller charge, pure scan-duration measurement, work admission, or protected lane. The 9p path has fixed-class logical persistence-work attribution, and both records count their own formatter bytes and Console calls, but physical I/O, UART work, and allocator work remain outside the count ledger. The fixed ceilings and readbacks contain retained state, distinguish the three creation-capacity refusal causes, expose retained-generation pressure and clock-sample reuse, and make the four named whole-table work classes, two projection classes, and the observer's own traversal visible; they do not establish fair admission, calibrated production capacity, time-fresh observation, or isolation from that work. ### Landed task-coordinator HTTP/JSON adapter descriptor inventory This inventory applies the [Required Resource Descriptor](#required-resource-descriptor) to the request, parser, static-token, and lease-actor-projection bounds plus the response-vector observer in the landed task-coordinator HTTP/JSON adapter. It is the authority for those controls' resource-governance status; the reusable HTTP state machine and coordinator code remain authoritative for their protocol and task semantics. The [coordinator core-table inventory](#landed-task-coordinator-core-table-descriptor-inventory) owns the `MAX_TASKS = 256` derivation used by the adapter's projection ceiling. The adapter depends on the separate [shared network-stack socket-object table](#shared-network-stack-socket-object-table), but none of the bounds below charges or reserves a slot in that table. These are code-owned structural ceilings for a bounded local/QEMU development path. The default empty static-token set leaves `/v1/` unauthenticated; the optional bounded bearer-token posture is proof-grade admission, not production authentication. The adapter has no public-ingress authority and no production storage authority. Its narrow coordinator client endpoint does not make the adapter the task-state or storage owner. The current proof boundary and the separately gated production work are tracked in [Self-Hosted Task Backend](../backlog/self-hosted-task-backend.md#gap-inventory). #### Whole request and route-specific body ceilings - **Dimension, derivation, and effective value:** Logical HTTP request bytes per admitted adapter connection. `MAX_REQUEST_BYTES` in `demos/task-coordinator-api-logic/src/lib.rs` is 64 KiB for request line, headers, and body together. `MAX_BODY_BYTES` is the 1 KiB declared-body default; `coordinator_body_limit` raises only `POST /v1/state/import` to `MAX_STATE_TRANSFER_BODY_BYTES` = 60 KiB. `REQUEST_POLICY` supplies all three values to `RequestPolicy::request_progress` in `capos-http-json-service/src/lib.rs`, which checks the declared body and the checked header-plus-body total before a complete request is dispatched. There is no manifest value, delegated credit, aggregate byte pool, or zero semantic. - **Authority, lifecycle, overload, and recovery:** Possession of an accepted socket facet lets a peer supply bytes; the adapter process owns the per-connection receive vector before authentication and the parsed method, path, authorization, and body clones during dispatch. `ConnTable::dispatch_response_ready` consumes the parsed request before returning its clone charge; `ConnTable::response_ready` installs refusal responses only when no parse clone exists, and slot release returns either remaining charge. Excess whole-request or body length becomes typed `RefuseReason::OversizedRequest` or `OversizedBody` and a fail-closed HTTP `413`; a later connection can submit a smaller request after ordinary response/close cleanup. Checked charge replacement increments `request_byte_release_mismatches` on arithmetic inconsistency but creates no new refusal or recovery authority. The bounds provide no reservation token, rollback ledger, or independent recovery deadline beyond the reusable connection state machine's absolute read/send deadlines. - **Observability and open descriptor gaps:** `RequestByteOccupancyReadback` publishes configured and effective whole-request limits, the default and state-transfer body limits, live retained receive-vector length and allocation capacity plus parse-clone bytes summed across the adapter table, their service-lifetime high-waters, the high-water of both request-length charges while they coexist, request-byte release mismatches, and cumulative typed oversized-request and oversized-body refusals. The observer derives receive length and capacity at the existing framing accumulation point and parse-clone occupancy from the already-known field lengths at successful parse/dispatch; response transition or slot release returns the exact charges without another buffer traversal. Its fixed-field shared-sequence record emits at boot, immediately on occupancy or high-water change, and with exact-power-of-two damping for counter-only changes at the existing request-classification, close, and release boundaries. The saturated production formatter remains below the 1,024-byte Console capability ceiling and carries no method, path, bearer, actor, task key, body, peer, address, or capability material. The QEMU proof requires a maximum-size state import to retain receive capacity at or above its retained length and drive the combined request-length peak above the retained-vector length high-water, then end with zero live request length, receive capacity, and parse-clone bytes plus zero mismatches. `FramingScanReadback` separately counts every framing-progress invocation and the delimiter-search prefix it examines: the accumulated buffer while no delimiter exists, or only through the first delimiter once headers are complete. Body accumulation therefore does not masquerade as delimiter rescan work. Release folds the connection counters and admitted receive bytes into saturating service-lifetime totals while retaining single-request scanned-byte and invocation high-waters plus the worst integer `scanned / admitted` ratio. Its fourth fixed-field shared-sequence record publishes those totals and high-waters without method, path, bearer, actor, body, peer, address, or capability material. The host proof retains a 32x ratio after a headerless 64 KiB request arrives through 64 one-KiB chunks and separately proves a one-chunk 60 KiB body charges only its header prefix. The QEMU harness requires the headerless chunked oversized request's scan high-water and ratio. This closes the delimiter-scan, parse-clone, and receive-vector-capacity observability gaps but does not charge bytes or work to a caller or change admission. Allocator-internal overhead remains uncharged. The ceiling also omits response bytes, receive/send calls, hashing, header parsing beyond the delimiter-search prefix, coordinator work, socket-table backing, cleanup cost, protected recovery capacity, and per-caller byte/work charging. #### Retained response bytes and send progress - **Dimension, derivation, and effective value:** Encoded response-vector bytes retained by each admitted adapter connection, plus transport progress over those bytes. `SEND_CHUNK_BYTES` in `capos-http-json-service/src/conntable.rs` limits each submitted chunk to 2,048 bytes. The two-slot connection table limits simultaneous vectors, but there is no per-response or aggregate response-byte admission ceiling, manifest value, delegated credit, or zero semantic; route and backend bounds only constrain individual response builders indirectly. - **Authority, lifecycle, overload, and recovery:** At the shared `ConnTable::install_response` boundary, the table first samples the encoded response vector's allocation capacity alongside the still-retained receive-vector capacity, then replaces the prior receive or response state and charges the installed vector's stored length and allocation capacity. Each validated `SendProgress` records its invocation and bytes handed to the transport. Full completion drops the vector and returns its exact charges before close, while response replacement and slot release subtract the stored length and capacity without another traversal. Checked charge replacement increments `response_byte_release_mismatches` on arithmetic inconsistency but does not create a new refusal or recovery authority. Ordinary completion, replacement, close cleanup, or process restart recovers the retained memory. - **Observability and open descriptor gaps:** `ResponseByteReadback` publishes the 2,048-byte send-chunk ceiling, live retained response-vector length and allocation capacity across the table, their service-lifetime high-waters, the service-lifetime high-water of receive capacity plus installed or pending encoded-response capacity only while both categories are nonzero, cumulative bytes handed and send-progress invocations, per-request response-byte and invocation high-waters, and release mismatches. Its sixth fixed-field shared-sequence record emits at boot, immediately on occupancy or high-water change, and with exact-power-of-two damping for counter-only changes at the existing request-classification, close, and release boundaries. The production formatter remains below the 1,024-byte console ceiling at saturated values and carries no method, path, bearer, actor, task key, body, peer, address, or capability material. The QEMU proof requires nonzero driven occupancy/progress, capacity at or above retained length, a simultaneous-capacity high-water above either individual capacity high-water, final zero live length and capacity, and zero mismatches. This closes response-vector length, allocation-capacity, and send-progress visibility only: it adds no response-byte refusal, per-caller charge, protected recovery capacity, or charge for allocator-internal overhead, lower-layer socket slots, ring continuations, backend CPU, or coordinator work. #### Request method and path ceilings - **Dimension, derivation, and effective value:** Request-line token bytes per request. `MAX_METHOD_BYTES` = 16 and `MAX_PATH_BYTES` = 128 feed `REQUEST_POLICY`; `RequestPolicy::request_line` rejects longer tokens before route-specific body selection. Together they bound the request-derived method and path inserted into the adapter's console status line in `ApiService::drive_connection_action`; `sanitize_log_text` neutralizes accepted control bytes before output. They are immutable structural values with no profile, pool, delegated credit, or zero semantic. - **Authority, lifecycle, overload, and recovery:** The adapter process owns validation and console formatting. An overlong token fails request-line validation as `RefuseReason::MalformedHeader`, maps to HTTP `400`, and is discarded on connection cleanup; a later valid request recovers without restart. These values neither reserve console capacity nor authorize a route, and no caller identity owns the formatting cost. - **Observability and open descriptor gaps:** `RequestLineReadback` publishes the configured method and path byte ceilings, per-request observed method-token and path-token byte high-waters clamped to those ceilings, request-line validation invocations, and mutually exclusive saturating refusal counters for oversized method, oversized path, and residual malformed request lines. Its seventh fixed-field record uses the adapter's shared gap-free `occupancy-readback` sequence: boot emits immediately, high-water changes emit immediately, and counter-only changes emit at exact powers of two at the existing request-classification, close, and release boundaries. The production formatter stays within the Console capability's 1,024-byte call ceiling at saturated values and carries no method text, path text, bearer, actor, task key, body, peer, address, or capability material. The refusal log still reports only the reason and connection id; successful logs still include sanitized method, path, status, and connection id. This readback changes no admission, refusal, or routing decision and adds no per-caller charge, console-byte budget, dropped-output observation, or protected diagnostic lane. The bound contains one log line's request-derived contribution but does not budget repeated formatting or UART work. #### Bounded JSON subset - **Dimension, derivation, and effective value:** Parsed object keys, strings, and array elements per routed JSON request. `MAX_JSON_KEYS` = 8, `MAX_JSON_STRING_BYTES` = 64, and `MAX_JSON_ARRAY_ITEMS` = 32 in `demos/task-coordinator-api-logic/src/lib.rs` are enforced by `JsonParser::parse_string`, `JsonParser::parse_array`, and `parse_json_object`. The parser accepts one flat object, printable unescaped strings, `u64` decimal numbers, and arrays of bounded strings; duplicate keys and trailing bytes fail closed. The request/body ceilings remain an earlier byte bound. There is no manifest policy, aggregate parser pool, delegated credit, or zero semantic. - **Authority, lifecycle, overload, and recovery:** The adapter process allocates parsed strings and vectors only while routing one already-admitted request. Any syntax or bound failure becomes `RouteError::BadRequest("malformed-json")` and HTTP `400`; dropping the request/route temporaries recovers the allocations. There is no explicit reserve/commit/rollback record, cancellation token, or parser-work deadline distinct from the connection/backend deadlines. - **Observability and open descriptor gaps:** `JsonParseReadback` retains the configured key, string-byte, and array-item ceilings; bounded per-request high-waters for observed keys, longest string, and array items; parse invocations; and mutually exclusive saturating refusal counters for key-count ceiling, string-byte ceiling, array-item ceiling, duplicate key, trailing bytes, and residual syntax/type failure. Its fifth fixed-field record uses the adapter's shared gap-free `occupancy-readback` sequence: it emits at boot, emits high-water changes immediately, and damps counter-only changes at exact powers of two at the existing request-classification, close, and release boundaries. The production formatter stays within the 1,024-byte console ceiling at saturated counters and carries no method, path, bearer, actor, task key, body, peer, address, or parsed request text. The outward request status remains only HTTP `400` with `malformed-json`; classification is read-side evidence. There is still no live allocation or allocator high-water, per-caller CPU or allocator charge, parser-work deadline, scan-work or mismatch readback, or protected recovery reserve. Duplicate-key detection scans at most eight existing entries and name validation scans bounded strings, and a caller can repeat malformed requests. #### Static API-token admission - **Dimension, derivation, and effective value:** Process-lifetime configured token entries and per-request bearer bytes. `MAX_API_TOKENS` = 4, `MAX_API_TOKEN_BYTES` = 64, and `MAX_AUTHORIZATION_HEADER_BYTES` = 71 in `demos/task-coordinator-api-logic/src/lib.rs` bound `ApiTokenSet`, the printable bearer token, and the trimmed `Authorization` field value. `ApiTokenSet::from_config_grant_names` reconstructs fixed SHA-256 hashes and 24-byte actor labels from spawn grants and rejects malformed, incomplete, duplicate, or excess configuration. When static tokens are non-empty, `AUTHENTICATED_REQUEST_POLICY` rejects a duplicate or overlong authorization field before allocation, and `ApiTokenSet::authenticate_with_readback` compares the candidate hash against the complete bounded set in constant time. An empty set is explicitly authentication-disabled rather than zero credit. - **Authority, lifecycle, overload, and recovery:** Spawn-time configuration grants select the process-lifetime set; they are configuration transport, not per-request spend authority. Valid bearer possession selects its fixed actor for `/v1/` admission. Invalid configuration prevents service initialization; a missing, malformed, unknown, or oversized request credential fails closed as HTTP `401`. Recovery is a valid request under the existing set or service restart with corrected configuration; there is no issuance, rotation, revocation, expiry, donation, or protected credential-recovery reserve. - **Observability and open descriptor gaps:** `TokenAdmissionReadback` publishes configured entry and byte ceilings, authentication invocations and admissions, mutually exclusive missing, malformed, duplicate, oversized-field, oversized-token, and unknown-token refusals, the clamped bearer-byte high-water, and cumulative hashing invocations and candidate bytes. A separate ninth `credential-verifier` record reads the same counters to publish the proof-grade credential-store `401` denied-credential and missing/stale-session outcomes and the `503` verifier-unavailable, transport-failure, and overload outcomes; the split exists because one line carrying all of them plus the self-cost tuple would consume the Console-call headroom. Both records use the adapter's shared gap-free `occupancy-readback` sequence, each with its own due check: they emit at boot, immediately on high-water changes, and with exact-power-of-two damping for counter-only changes at request-classification, close, and release boundaries. The saturated production formatter stays at least 32 bytes below the Console capability's 1,024-byte call ceiling and carries no token, hash, bearer, actor label, session, path, peer, address, or capability material. The QEMU proof requires the credential-verifier counters to stay zero in the unauthenticated and static-token postures. Static comparison still scans the complete bounded set and observation changes no admission, refusal, ordering, or routing decision. This is bounded local/QEMU read-side proof, not production authentication or ingress authority. There is still no per-caller or per-token charge, crypto budget, issuance, rotation, revocation, expiry, protected recovery capacity, or mismatch ledger. #### Lease actor projections - **Dimension, derivation, and effective value:** Retained authenticated lease-to-actor projections per adapter process. `MAX_LEASE_ACTOR_PROJECTIONS` = 256 in `demos/task-coordinator-api-logic/src/lib.rs`, matching `MAX_TASKS` in `demos/task-coordinator-logic/src/lib.rs`. `LeaseActorProjectionTable` retains one task id, generation, and fixed actor per task; a new generation replaces that task's entry without increasing occupancy. The value is a code-owned structural ceiling with no profile, delegated credit, per-actor subdivision, or zero semantic. - **Authority, lifecycle, overload, and recovery:** A successfully authenticated lease acquisition records the projection only after `check_capacity` proves capacity; that same check records an impossible new-task excess and returns HTTP `503` with `actor-projection-limit` before coordinator acquisition. Authenticated reset preflight classifies a missing task projection or a generation mismatch before preserving the existing stale-generation or actor-mismatch response; successful reset removes the matching generation. Authentication-disabled resets do not consult or mutate this table because that mode records no actor projections. Successful state import calls `LeaseActorProjectionTable::clear`, and process restart clears the volatile table. Successful release and lease expiry leave the projection in place; a later authenticated acquisition of the same task replaces it without increasing occupancy. The one-entry-per-task derivation therefore preserves capacity for every coordinator task despite retained released or expired projections. Failed post-acquisition insertion is treated as a service invariant error rather than ordinary overload. Replacement and clear continue after reconciling any observed internal occupancy inconsistency. - **Observability and open descriptor gaps:** `LeaseActorProjectionReadback` publishes configured/effective capacity 256, live occupancy, high-water, new-entry admissions, `actor-projection-limit` refusals, generation replacements, reset/clear removal counts, and mutually exclusive saturating counters for authenticated reset preflight missing its task, reset preflight naming a stale generation, and the defensive internal occupancy invariant failing during replacement or clear. The first two classes are reachable refusal observations and change no client-visible outcome. The occupancy class detects a future accounting regression rather than a separately admitted client action; the table's current private mutation paths maintain that invariant structurally. The record is one of the nine records sharing the adapter's gap-free `occupancy-readback` sequence; all nine emit at boot, then only a record whose own occupancy/removal state changed emits, while counter-only refusals, replacements, and mismatches are damped at exact powers of two. Its own due-check misses are charged to its self-cost tuple, which re-publishes the unchanged snapshot at exact powers of two of that count. The QEMU proof requires healthy authenticated reset traffic to leave the refusal counters zero and requires the internal occupancy invariant to remain intact; authentication-disabled traffic must leave the complete projection record at zero. The fixed count-only record carries no token, actor label, bearer, task key, request, path, peer, address, or capability material. Retained released or expired projections remain deliberately indistinguishable from live leases, and there is no per-caller or per-actor quota, protected lifecycle/recovery reserve, or charge for retained task-id allocation or authorization scans. The table projects actor correlation; it owns neither coordinator leases nor task authority. Across all rows, the adapter has no ledger that charges connections, shared network-stack slots, submitted ring continuations, backend CPU, or coordinator work. `MAX_TABLE_CONNECTIONS` in `demos/task-coordinator-api-service/src/main.rs` is a two-entry structural connection ceiling with fail-closed `503` refusal, not a per-caller charge or a reservation against the lower-layer socket table. `ConnectionOccupancyReadback` records configured capacity, admissions, and exhaustion refusals after the existing table outcomes; every report samples effective capacity and live occupancy from the owning `ConnTable`, then retains the observed high-water. All nine fixed-field records emit at boot; later reports emit only the changed record with one shared gap-free sequence, while counter-only changes are damped at exact powers of two. The harness checks each line against the console capability's 1,024-byte ceiling and rejects identity- or request-bearing fields. Each of those nine records also publishes a base-36 `readback_cost=withheldPublications,formattedRecordBytes,consoleCalls` tuple of saturating process-lifetime counters, in the shape and radix the coordinator service already uses. The byte count is self-inclusive and covers only the stable line handed to Console: candidate renders that lose the fixed point stay uncharged formatter and allocator work. A record charges a withheld publication whenever its own due check misses, and only that counter -- at exact powers of two -- may publish on cost alone, so formatted bytes and Console calls never feed emission back into themselves. `make test-task-coordinator-api` requires nonzero attribution in all three counters on every record under both the unauthenticated and static-token postures, pins each byte total to the lines it published, and `make test-task-coordinator-api-9p` requires the same on both boots. This is read-side attribution of the observer's own console output: it charges nothing to the caller whose traffic moved the counter, and it is not a console budget, backpressure result, or dropped-output ledger. There is still no per-caller or per-actor subdivision across these bounds, no protected recovery reserve, and no charge for lower-layer socket slots, ring continuations, backend CPU, allocator work, or coordinator work. Consequently the bounds contain selected local memory and parsing work but do not establish fair admission, calibrated production capacity, or isolation from other work that shares the network stack, kernel continuations, CPU, allocator, coordinator, or console. ### Remote-session/WebUI network-path enforcement #### Shared network-stack socket-object table This inventory applies the [Required Resource Descriptor](#required-resource-descriptor) to the Phase C network-stack process's shared socket-object table beneath the WebUI ingress and CapSet gateway ledgers. This section is the single authority for that table's resource-governance contract; the upper-layer inventories link here rather than restating it. ##### Shared network-stack socket-object table - **Dimension, derivation, and effective value:** Concurrent accepted `TcpSocket` service objects, in listener slots. `#NetworkSocketTablePolicyMarkers` lowers manifest-selected public, local-health, and provider-health backlog partitions to inert Endpoint markers. Each serving mode defaults omitted fields to its prior code-owned value and retains that value as the immutable structural maximum. The shipped production WebUI manifest explicitly selects the six-slot public partition: four maximum application-lane occupants plus one connection draining asynchronous close and one refusal probe. Its protected local-health/provider-health partitions omit markers and retain their seven/eight-slot defaults. The network-stack process rejects malformed, duplicate, zero, unsupported-partition, or above-maximum policy before listener construction or publication; accepted policy may narrow but never expand the table. `TcpListenerCapLayer::effective_accepted_socket_capacity` additionally subtracts slots retired after finite service-object generation exhaustion, so runtime effective capacity can fall below the manifest-configured backlog. - **Authority, lifecycle, overload, and recovery:** The network-stack process pays for and owns every slot before caller identity or upper-layer admission exists. `reserve_slot` advances the slot generation and charges occupancy before any facet is published; publication accepts only the matching reservation, and close, holder abandon, failed publication, peer/reset cleanup, and re-arm release it exactly once. Table exhaustion and excess pending accepts have distinct typed refusal counters. Generation exhaustion retires rather than reuses stale authority, leaving the retired socket's RX/TX buffers resident until process restart. - **Ledger observability and open descriptor gaps:** A bounded boot-only policy record publishes each partition's manifest/default source plus configured and structural values. Sequence-correlated capacity records separately publish total configured, generation-effective, live, and high-water slots without repeating immutable policy. The lifecycle records continue to publish typed refusals and cleanup, pending continuation occupancy, fixed-class service-object backing, smoltcp RX/TX backing, retirement stranding, and bounded pump-delay attribution without identity. Upper-layer WebUI and gateway comparison records remain observe-only: neither upper-layer ledger is derived from or charged against this table. Remaining gaps are no per-tenant subdivision, no protected recovery reserve, and no charge for continuation state, service objects, transport buffers, backend CPU, kernel tables, attacker-triggered polling/scans, cleanup, or readback output. ##### Idle and accepted-slot recovery windows - **Dimension, derivation, and effective value:** Inactivity in monotonic nanoseconds, measured separately for established-but-unaccepted/closing slots and accepted slots. The same manifest policy selects both windows at or below code-owned structural maxima. The shipped production WebUI manifest explicitly selects the 4 s idle window and 45 s accepted lease. The lease exceeds the WebUI client's 6 s request-read plus 30 s response-send deadlines by 9 s, so the client remains the effective bound for a legitimate large response. Omitted values retain the same code-owned defaults: WebUI 4 s/45 s, task API 60 s/60 s, and remote session 4 s/4 s. Zero is invalid for these multiplexed serving modes and never means unbounded; the separate single-socket compatibility path retains its existing zero-as-disabled behavior. - **Authority, lifecycle, overload, and recovery:** `track_and_reap` runs after stack polling. An unaccepted slot without buffered request is re-armed after the idle window; an accepted slot is re-armed after holder inactivity reaches the accepted lease; closing uses the idle window and closed recovers immediately. These remain inactivity recovery paths rather than absolute occupancy deadlines: buffered data and holder activity defer recovery, and synchronous pump delay can make expiry observation late. - **Ledger observability and open descriptor gaps:** The boot-only policy record publishes manifest/default source plus configured and structural values for both windows; the existing recovery-policy startup record confirms the listener-applied values. Counters retain idle/abandoned reap counts, expiry-overshoot high-waters, positional occupancy ages, release-age high-water, and measured/unmeasured fixed-class attribution. Remaining gaps are no absolute lifetime deadline, no independent reaper, no recovery guarantee while the single-threaded pump is delayed, and no CPU charge for scanning, abort, re-listen, or console work. #### Ingress profile and structural maxima - `IngressProfile` validates independent application-slot, backlog, release-debt, in-flight-byte, per-connection, and private `LocalHealth`/`ProviderHealth` reserve policy below code-owned structural maxima. - The effective backlog must retain one outstanding accept for every granted listener; remaining entries are armed round-robin, so an idle protected listener cannot consume the public listener's accept floor. - Fixed physical connection and release-debt tables remain structural ceilings rather than dynamic allocations. #### Application, backlog, release-debt, and in-flight-byte occupancy - `WebUiIngressLedger` enforces application admission, mirrored transport-backlog occupancy, accepted-socket release-debt occupancy, in-flight bytes, per-connection occupancy, reserves, lane-specific footprint/deadline bounds, replenishable protected-lane rate budgets, reserve-first then fair work-conserving selection, typed `429`/`503` overload, exact reservation/release, and fixed per-lane plus per-bound occupancy/high-water/refusal counters. #### Lane selection and reserves - The serve loop accepts optional `ui_local_listener` and `ui_provider_health_listener` capabilities in addition to public `ui_listener`, selects the lane solely from the listener whose accept completed, refuses duplicate ports before serving, and applies fail-closed protected route allowlists. - CUE exposes distinct `localReserve` and `providerReserve` fields lowered to inert Endpoint marker caps; the cloud network-stack handoff preserves their contiguous manifest-authored tail for WebUI validation, and legacy `reserve` selects local health only. #### Overload and retry guidance - Application `retryAfterMs` guidance is derived only from application-lane pressure, not transport-table occupancy. #### Counters and observability - Per-bound refusal counters count distinct blocked listener or connection-slot episodes, not polling attempts; a successful reservation clears that entry's refusal episode. - The live-ledger readback reports those enforced effective fields while preserving configured-versus-effective backlog and release-debt values; configured reserve readback remains distinct from the live reserves, which are zeroed for ungranted protected listeners. #### Session budget donation - A separate `SessionBudgetLedger` accounts authenticated requests without retroactively reclassifying pre-identity work. #### CapSet gateway connection table and deadlines - The CapSet gateway separately uses an eight-entry charged connection table over generation-bound per-slot transport facets, asynchronous accept/receive/send/close state machines, randomized work-conserving full-table scans, five-second initial-first-byte and frame-progress poll-time expiry thresholds, and one 30-second absolute request deadline instant that progress cannot extend. Synchronous backend work can delay observation of all three thresholds. - The transport accepts completed handshakes before their first byte and returns bounded non-fatal poll completions, so the gateway rather than an unaccepted backlog reaper owns pre-authentication admission and timeout classification. - Idle established sessions remain unbounded between complete frames; the next first byte admits the next bounded request. - Every close releases its admission exactly once with a typed reason, and counters expose occupancy/high-water, overload/saturation, timeout/reset/malformed/owner-death releases, authentication-denial events, progress latency, selection cycles, and starvation observations. - The local QEMU proof holds an idle peer and a partial-frame peer while a useful client completes the normal protocol, observes all three charged concurrently, then observes the two slow peers close under distinct first-byte and frame-progress reasons. #### Verifier-overload login mapping - The decoupled credential-verifier admission arbiter's saturation now surfaces to the WebUI login route as a typed `503`: `SessionManager.login` returns a typed `Overloaded` exception (audited as the contention `Unavailable` class, never `Denied`) that the route maps to a bounded overload and, unlike a wrong-password result, never charges the peer/listener login backoff, so transient login contention cannot masquerade as an authentication failure or amplify into an operator lockout. #### WebUI proof boundary ##### Current proof - The focused cloudboot manifest now grants disjoint public, local-health, and provider-health listeners, and the QEMU abuse matrix proves lane-specific authorization, overload isolation, recovery, and balanced release across all three lanes. ##### Remaining gaps - Session donation remains a proof-sized service-set concurrency budget rather than a generation-bound quantitative donor lease, and public multi-user availability and concurrency-above-four throughput remain unproved. ## WebUI and Remote-Session Application The current capOS-served WebUI has decoupled listener, application, release-debt, and byte capacities. Its service-side ingress topology supports public, local-health, and provider-health listener capabilities with private reserves, although shipped manifests still enable only the public listener. It also has one global browser session, listener-wide and peer-address login backoff, one nonblocking global password-verifier arena, generation-bound accepted-socket reservations with owner-local facet minting, complete static-response copies, and stable asset URLs with a one-year immutable cache policy. The remote-session CapSet gateway uses a charged eight-connection table with independently progressing frame state, absolute and occupancy deadlines, exact release, and randomized work-conserving scans. These remain bounded research/demo mechanisms, not public multi-user admission. ### Landed WebUI ingress descriptor inventory This inventory applies the [Required Resource Descriptor](#required-resource-descriptor) to the bounds enforced by the current WebUI serving process. It is a read-side account of landed behavior, not evidence of public-ingress authority, independent browser sessions, cache-correct delivery, the network-ceiling ladder, or adversarial live coexistence. The remote-session service has a separate [CapSet gateway connection inventory](#landed-capset-gateway-connection-descriptor-inventory); this WebUI ledger neither owns nor authorizes those gateway slots. Both services depend on the separate [shared network-stack socket-object inventory](#shared-network-stack-socket-object-table). The WebUI backlog ledger mirrors outstanding accepts but is not derived from or enforced against the network-stack's listener partitions. The network-stack's sequence-correlated `backlog-listener-partition` record makes their configured/effective relation observable at boot and after effective-capacity changes, but does not bind the two values or alter either layer's decisions. The authoritative owner is the process-lifetime `WebUiIngressLedger` in `demos/remote-session-web-ui/src/lib.rs`. `IngressProfile` and `DEFAULT_SERVICE_INGRESS_PROFILE` define its code-owned ceilings and default policy. `#WebUiIngressProfile` and `#WebUiIngressProfileMarkers` in `cue/defaults/defaults.cue` lower authored policy to inert `ingress_*` Endpoint marker capabilities. `apply_ingress_profile_marker` and `evaluate_service_capset_policy` in `demos/remote-session-web-ui/src/lib.rs` parse those markers and reject malformed, duplicate, zero-invalid, or inadmissible profiles before the service publishes. `IngressProfile::for_enabled_lanes` then removes private capacity for protected listeners the process was not granted. The service reports the resulting profile from `demos/remote-session-web-ui/src/main.rs`. The `ingress-live-ledger` and `ingress-live-budget-ledger` report at boot and from the serve loop's existing Timer tick. Before deriving each tick's live records, the service passes that Timer sample through `WebUiIngressLedger::refresh_rate_budgets`, applying the same lazy refill used by protected-lane admission. A missing Timer sample leaves the prior bucket state unchanged while the existing clock-loss path remains fail closed. They publish effective application slots, ledger-derived zero-at-boot occupancy, backlog, release debt, in-flight-byte use, cumulative reservation/release and per-lane charges, byte high-water and mismatch state, anonymous slots, live and aggregate protected reserves, protected-lane tokens, refill epochs, consumption and depletion high-water, effective per-connection slots, and retry guidance. The `ingress-policy`, `ingress-lane-policy`, and `ingress-budget-policy` lines additionally report configured, effective, and structural application, backlog, release-debt, and in-flight-byte capacities; the code-owned rate capacities and refill intervals; the physical seven/three admission/refusal split; configured and effective component and aggregate protected reserves; and configured/effective per-connection values. These records are split so every render remains within the console capability's 1,024-byte per-call bound. Occupancy, in-flight-byte, rate-token depletion, and high-water changes emit immediately; cumulative-only changes emit at exact powers of two. Replenishment and refill-epoch changes are withheld until another balance, counter, or cost-driven publication. The power-of-two withheld-publication schedule makes the refreshed balance observable without adding periodic Console work for a change that only increases admission headroom. Each live record carries a saturating service-lifetime `readback_cost=withheldPublications,formattedRecordBytes,consoleCalls` tuple. Only a withheld-publication change may make a cost-only record due, at exact powers of two; bytes and calls advance only during an already-due publication. `ingress-lane-policy` also distinguishes configured anonymous capacity from the effective capacity after absent protected listeners lose their reserves. The `ingress-profile-quota-provenance` and `ingress-profile-lane-provenance` lines report `default` or `manifest-marker` independently for all eight manifest-selectable fields; marker presence remains authoritative even when an authored value equals the default. The `ingress-physical-tables` and `per-connection deadlines` lines report the fixed table and deadline bounds. The bounded `webui-ingress-deadline-summary` and `webui-ingress-deadline` evidence records scan the live application-admission table without publishing ticket or connection tokens. They report observation time, live and already-past-current-phase counts, an observation-local ordinal, lane, current phase, age since the accept-anchored read phase, read/send anchors, and the code-owned phase durations. A quiescent record reports zero live and past-phase admissions after release. The accept timestamp is carried alongside the deadline, including across a TLS epoch deferral; it is not reconstructed by subtracting the configured duration. The send-phase update is authoritative for owner-driven expiry. A foreign or missing reservation increments `deadline_readback_mismatches`, and the serve loop fails closed rather than routing under the admission's stale read-phase deadline. Before each sweep, the serve loop completes any reservation whose full response wire body has already drained, even when close/drain transport cleanup remains. `WebUiIngressLedger::reap_expired` then scans that same fixed application-admission table from the shared monotonic sample. It observes the stored current-phase deadline without extending or recomputing it, treats clock loss as expiry for every still-unserved admission, and releases each expired application slot, lane reserve, and byte footprint through the same exact `cancel` path. The serve loop then detaches the matching move-only reservation while transport cleanup finishes, and fails closed if a returned ticket belongs to a response already classified as fully drained. `reaped_read_deadline`, `reaped_send_deadline`, and `reap_release_mismatches` are fixed counters and publish no ticket or connection identity; a fully drained response counts as a completion and cannot inflate the send-reap counter. The bounded `webui-ingress-reap-balance` record is emitted only after both phase-reap paths have run and the ledger is quiescent. Each readable reap sample contributes its saturating stored-deadline overshoot to separate read/send high-waters. The ledger counts completed sweeps and retains the largest gap between consecutive readable completed sweeps inside one serving epoch; clock loss still completes a fail-closed sweep but breaks the readable-pair anchor, and the quiescent epoch boundary resets that anchor before renewal/setup time can enter the cadence. Neither case changes overshoot. A reap whose overshoot exceeds the gap high-water from prior completed sweeps increments `reaps_over_prior_sweep_gap_high`; the current sweep updates the gap high-water only after classifying its reaps. This is a historical-cadence outlier. The serve loop additionally brackets accept arming, TLS handshake progress, request reads, routing/backend work, response sends, and close/drain plus accepted-socket release-debt retirement with completed sweeps. One Timer capability sample per tick remains the deadline and reap authority and is reused unchanged at every operation boundary. Serialized local cycle samples taken after the preceding sweep and before the following sweep measure only the bracketed operation; consecutive readable Timer anchors calibrate those cycles to nanoseconds without another capability call. A zero, backwards, initial, or clock-loss calibration records no class or duration, and clock loss still completes a fail-closed sweep while clearing both anchors. Each calibrated bracket increments one fixed per-class visit counter and updates that class's duration high-water; the largest attributed duration retains its class. The bounded `webui-ingress-reap-attribution` record publishes that class, its duration high-water, all six visit counters, and their sum without connection identity, ticket, peer address, or route text. The local cycle reads and repeated fixed-table scans are observer overhead and are not a charged synchronous-work budget; the measured duration excludes those scans. The balance record reports the phase/cadence observations, the phase-reap totals, the number of fully drained responses completed by the pre-sweep classification path, and the independently derived admission/completion/cancellation release balance. High-water changes emit immediately under the balance guard; counter-only changes use powers-of-two damping. Exact byte balance remains in `webui-ingress-byte-bounds`; mismatch and zero-current-use fields remain in their owning bounded records rather than being restated behind this record's emission guard. All application admissions are reserved before routing through `WebUiIngressLedger::request`. The accepted connection holds the move-only `IngressReservation`; the serve loop's `Progress::Finished` arm calls `WebUiIngressLedger::complete` after a served response or `WebUiIngressLedger::cancel` after timeout, close, cancellation, or error. Pre-identity TCP, parsing, response-buffer, and login work remains charged to the service ingress ledger even if authentication later succeeds. An authenticated request may additionally draw from the separate `SessionBudgetLedger`; it does not move or refund the ingress charge. Cleanup remains service-paid until both charges are released. #### Public lane capacity - **Dimension, derivation, and effective value:** Concurrent public/anonymous application admissions. `IngressProfile::anonymous_slots` is `effective_application_slots - local_health_reserve_slots - provider_health_reserve_slots`. Public traffic has **no private reserve**: `IngressProfile::lane_reserve_slots(Anonymous)` is zero and public work consumes the general pool. The configured default profile has four application slots minus two configured protected reserves, hence two anonymous slots. An anonymous-only boot grants neither protected listener, so `for_enabled_lanes` zeroes both live reserves and the enforced anonymous capacity becomes four. The binary additionally limits anonymous admissions to `WEB_UI_ANONYMOUS_CONNECTION_SLOTS` (four). - **Authority, lifecycle, overload, and recovery:** Only an accept from the public listener selects `IngressLane::Anonymous`; request fields, peer addresses, and later identity cannot select another lane. `WebUiIngressLedger::request` reserves and the serve-loop `complete`/`cancel` path releases. Saturation is typed `429` with bounded retry guidance; recovery requires a prior application reservation to release. - **Ledger observability and open descriptor gaps:** `anonymous_occupancy`, `anonymous_high_water`, `overload_anonymous_lane_pool_full`, and `admitted_anonymous` report bounded use and denial. Boot reports both configured and effective anonymous slots; no public-private-reserve field exists because public traffic has no private reserve. The two profile-provenance records report default-versus-marker selection independently for every manifest-selectable field. #### Local-health private reserve - **Dimension, derivation, and effective value:** Concurrent local-health admissions held outside the general pool. `local_health_reserve_slots` defaults to one and is selected by `ingress_local_reserve.*` (legacy `ingress_reserve.*` selects this lane only). It is not numerically clamped: profile validation requires the protected sum to leave anonymous capacity, and boot rejects a live protected sum above `WEB_UI_PROTECTED_CONNECTION_SLOTS` (three). `for_enabled_lanes` makes the enforced value zero when `ui_local_listener` is absent. - **Authority, lifecycle, overload, and recovery:** Only the dedicated `ui_local_listener` capability selects `IngressLane::LocalHealth`. The lane uses its private reserve first, may borrow only the general pool, and cannot borrow the provider reserve. Release follows the common application reservation path. Lane saturation or an absent live reserve is typed `429`; release of local or borrowed general capacity is the recovery path. - **Ledger observability and open descriptor gaps:** `local_health_occupancy` and `local_health_high_water` report use. `overload_local_health_reserve_full` counts requests that cannot use the private reserve, including requests subsequently admitted by general-pool borrowing; `overload_local_health_lane_pool_full` counts only final lane admission denials, so the two signals diverge under borrowing. Boot reports configured and live reserve values. A separate structural per-lane maximum is not defined; the application and physical protected partitions are the ceilings. #### Provider-health private reserve - **Dimension, derivation, and effective value:** Concurrent provider-health admissions held outside the general pool. `provider_health_reserve_slots` defaults to one and is selected by `ingress_provider_reserve.*`. Validation and the three-slot physical protected partition apply as for local health; `for_enabled_lanes` makes the enforced value zero when `ui_provider_health_listener` is absent. - **Authority, lifecycle, overload, and recovery:** Only the dedicated `ui_provider_health_listener` capability selects `IngressLane::ProviderHealth`. It uses its own reserve first, may borrow only the general pool, and cannot borrow the local reserve. Saturation is typed `429`; release of provider or borrowed general capacity recovers service. - **Ledger observability and open descriptor gaps:** `provider_health_occupancy` and `provider_health_high_water` report use. `overload_provider_health_reserve_full` counts private-reserve pressure before borrowing; `overload_provider_health_lane_pool_full` counts only final lane denial. Boot reports configured and live reserve values. A separate structural per-lane maximum is not defined. #### Aggregate protected reserve - **Dimension, derivation, and effective value:** Application slots withheld from public traffic, in slots. `IngressProfile::protected_reserve_slots` is the saturating sum of the two live protected reserves. The configured defaults sum to two, but the effective live sum is zero in an anonymous-only boot and includes only granted protected listeners. Validation requires the sum to be strictly smaller than effective application capacity; boot additionally limits it to the three physical protected serving slots. - **Authority, lifecycle, overload, and recovery:** The reserve is not separately transferable or donatable. Listener-capability provenance selects each component, and each component remains private; ordinary public work never borrows it. Recovery is component release through `complete` or `cancel`. - **Ledger observability and open descriptor gaps:** Boot reports the configured and effective sum. `protected_reserve_occupancy`, `protected_reserve_high_water`, `overload_protected_reserve_full`, and `protected_reserve_release_mismatches` provide aggregate readback; occupancy counts only the private portion of protected-lane use, not general-pool borrowing, and reserve pressure aggregates the two component attempts that could not use private capacity. #### Local-health rate budget - **Dimension, derivation, and effective value:** Replenishable local-health request tokens. `local_health_rate_capacity` defaults to 16 tokens and `local_health_refill_ns` to one token per 100,000,000 ns. These are code-owned policy values, not `#WebUiIngressProfile` fields, and `WebUiIngressLedger::consume_rate_token` enforces them. - **Authority, lifecycle, overload, and recovery:** A successfully capacity-admitted local request consumes one token. Tokens replenish from the caller-supplied monotonic `now`; they are not committed, rolled back, donated, or returned when the request ends. Exhaustion is typed `429`; time-based refill is the only recovery. - **Ledger observability and open descriptor gaps:** `overload_local_health_rate` reports denial. After `refresh_rate_budgets(now)` applies the same lazy refill used by admission, `local_health_rate_tokens` and `local_health_rate_refilled_at` expose the bucket and refill epoch at that observation time; `local_health_rate_consumed` is cumulative and `local_health_rate_high_water` is the greatest observed depletion from full capacity. Boot policy readback reports the capacity and interval, while `webui-ingress-rate-bounds` reports the refreshed driven values. #### Provider-health rate budget - **Dimension, derivation, and effective value:** Replenishable provider-health request tokens. `provider_health_rate_capacity` defaults to eight tokens and `provider_health_refill_ns` to one token per 250,000,000 ns. They are code-owned and enforced by `WebUiIngressLedger::consume_rate_token`, not manifest configurable. - **Authority, lifecycle, overload, and recovery:** Lifecycle matches the local-health rate budget. Exhaustion is typed `429`; monotonic refill is the recovery path. - **Ledger observability and open descriptor gaps:** The provider fields mirror the local-health readback: `provider_health_rate_tokens`, `provider_health_rate_refilled_at`, `provider_health_rate_consumed`, `provider_health_rate_high_water`, and `overload_provider_health_rate`. Boot reports capacity and interval; `webui-ingress-rate-bounds` refreshes both buckets from its observation time before reporting driven values. #### Per-connection application bound - **Dimension, derivation, and effective value:** Outstanding application admissions per opaque `IngressConnectionId`, in slots. `per_conn_max_slots` defaults to two and is selected by `ingress_perconn.*`; zero fails validation. The effective readback is `min(per_conn_max_slots, effective_application_slots)`; this expresses the existing aggregate ceiling rather than adding a new bound. In the live one-request-per-connection serve loop, an accepted connection currently requests at most one application admission. - **Authority, lifecycle, overload, and recovery:** The serve loop mints the token from the accept event; it is grouping metadata, not identity or spend authority. `WebUiIngressLedger::request` checks it before reservation. Refusal is typed `429`; a reservation release recovers capacity. Reconnects receive new tokens, so this is not per-browser or per-principal admission. - **Ledger observability and open descriptor gaps:** Boot reports configured and effective values. `per_connection_occupancy`, `per_connection_high_water`, and `overload_per_connection` report the maximum current/historical use of any opaque token and denials. There is deliberately no stable-principal aggregation. #### Application-slot capacity - **Dimension, derivation, and effective value:** Process-wide concurrent application admissions, in slots. `IngressProfile::effective_application_slots` is `min(struct_max_application_slots, application_slots_quota)`; defaults are structural 16, configured four, and effective four. `ingress_slots.*` selects the configured quota. The serving binary further refuses a profile above seven physical admission slots, partitioned as four anonymous plus three protected, and retains three additional `WEB_UI_REFUSAL_CONNECTION_SLOTS` for bounded overload handling. Each admitted slot also carries its lane-specific byte footprint described below. - **Authority, lifecycle, overload, and recovery:** `WebUiIngressLedger::request` reserves atomically before routing; `complete` or `cancel` returns a typed result while releasing. Per-lane pool exhaustion is typed `429`; aggregate exhaustion is typed `503`. A finished or abandoned connection releases one slot. A foreign-ledger, unknown-or-stale, or duplicate release leaves occupancy unchanged; the serve loop emits the incremented transport record and exits for every variant because no safe owner recovery exists after its move-only reservation invariant fails. - **Ledger observability and open descriptor gaps:** `high_water_slots` is the aggregate high-water; current use is `WebUiIngressLedger::outstanding`; admitted and lane-pool denial counters are fixed-size. `application_release_foreign_ledger_mismatches`, `application_release_unknown_reservation_mismatches`, and `application_release_duplicate_mismatches` classify rejected releases without retaining reservation or connection identity. Boot reports configured, effective, and structural values, zero-at-boot occupancy, and the physical seven/three admission/refusal split. #### Aggregate serving backstop - **Dimension, derivation, and effective value:** Process-wide outstanding admissions across all lanes, in slots. It is the same numeric `effective_application_slots` limit, checked independently after lane and per-connection policy so protected borrowing cannot exceed the ledger total. Default configured/effective values are four; the same structural and physical limits apply. - **Authority, lifecycle, overload, and recovery:** `WebUiIngressLedger::request` denies before publication when `pending.len()` reaches the backstop. Refusal is typed `503`; any exact application release recovers capacity. It is service-scoped, not per session, tenant, subtree, or system. - **Ledger observability and open descriptor gaps:** `overload_aggregate_backstop` reports denials; `outstanding` and `high_water_slots` report use. There is no separately configurable aggregate pool, no aggregate reservation-vs-commit split, and no system-pool admission proving a production service entitlement. #### In-flight byte budget - **Dimension, derivation, and effective value:** Modeled worst-case request plus TLS response bytes across application admissions. `IngressProfile::effective_inflight_bytes` is `min(struct_max_inflight_bytes, inflight_bytes_quota)`; both default to 4 MiB, and `ingress_bytes.*` selects the configured quota. `ingress_connection_footprint` charges public admissions `MAX_REQUEST_BYTES + WEB_UI_MAX_RESPONSE_WIRE_BYTES` and protected admissions `MAX_REQUEST_BYTES + WEB_UI_PROTECTED_RESPONSE_WIRE_BYTES`; boot assertions tie those bounds to the request parser and concrete response builders. A single footprint larger than the effective budget is refused. - **Authority, lifecycle, overload, and recovery:** Bytes reserve atomically with the application admission. `complete` releases the exact recorded footprint when the response wire body has fully drained, while `cancel` releases unfinished work; refusal is typed `503`. A connection's request and decrypted-plaintext staging vectors can retain allocation capacity during accumulation and classification. The request vector, TLS record-layer staging vectors, and outgoing response vector can retain allocation capacity through later close/drain cleanup and slot release, including after either release path returns the modeled charge. Those capacities are observed but remain uncharged and do not participate in admission. - **Ledger observability and open descriptor gaps:** `overload_byte_budget` reports denial; `WebUiIngressLedger::inflight_bytes` reports current use; and the fixed counters report cumulative reserved/released bytes, concurrent byte high-water, release mismatches, and cumulative anonymous/local-health/provider-health charges. Boot reports configured, effective, and structural byte capacities plus the zero-at-boot ledger state. `webui-ingress-byte-bounds` requires non-zero driven charges and high-water, zero current use and mismatch, balanced reservation/release at quiescence, and each lane's charged total to equal its admissions times its published fixed footprint. The identity-free `post-drain-response-capacity` record captures the installed response wire vector's stored length and allocation capacity in `WebUiConnection::begin_response`, then samples the same vector at completed, cancelled, or owner-reaped ledger release, subsequent close/drain visits, and slot release. It keeps the completed-drain class in its existing fields and publishes a sibling cancelled/reaped class: live retained allocation capacity summed across the fixed connection table, service-lifetime and per-connection high-waters, and a saturating count of released responses whose retained capacity can still hold the installed wire length. The companion identity-free `request-buffer-capacity` record sums stored length and allocation capacity for each connection's bounded request and decrypted-plaintext staging vectors across the same fixed table. It also uses `TlsServerHandshake::retained_record_buffer_usage` to publish table-wide stored length and allocation capacity for TLS inbound-record staging, handshake-message staging, and a pending alert record, with service-lifetime and per-connection high-waters plus a saturating capacity-below-length mismatch counter. The accessor returns byte counts only and exposes no record content, key material, certificate, transcript, hostname, or connection identity. The record retains the aggregate active-response capacity high-water sampled only while connections remain in `Phase::Sending`, and the service-lifetime high-water of table-wide request capacity plus table-wide active-response capacity while both categories are nonzero. That combined value is aggregate coexistence across the fixed table, not necessarily two vectors owned by one connection. Capacity and simultaneous high-water changes emit immediately. Peer-driven logical-length-only changes emit at zero or exact powers of two, and mismatch-counter-only changes emit at exact powers of two, so fragmented input causes logarithmic rather than per-byte synchronous Console calls. The response record's counter-only changes retain the same power-of-two discipline, and both observers reuse the serve loop's existing single Timer sample. The four saturated production formatters retain at least 32 bytes of headroom below the Console capability's 1,024-byte call ceiling. The two capacity records and the live ledger/budget records each carry a base-36 `readback_cost=withheldPublications,formattedRecordBytes,consoleCalls` tuple with saturating service-lifetime counters. The byte total covers only the stable record passed to Console, including the current record; discarded fixed-point candidates remain uncharged formatter CPU and allocator work. A due-check miss increments the withheld count. Only that count can trigger a cost-only publication, at exact powers of two; formatted bytes and Console calls advance only during an already-due publication and never feed back into another emission. The L4 QEMU proof requires nonzero request length and capacity, capacity at or above length with zero mismatches, a simultaneous request-plus-active-response capacity high-water above either individual high-water from that same record, nonzero completed and cancelled/reaped response attribution, nonzero withheld-publication, formatted-byte, and Console-call attribution on all four ingress observers, and later zero-live quiescent capacity records with zero release mismatches. The capOS-terminated TLS proof additionally fragments one ClientHello and requires nonzero TLS stored length and capacity, capacity at or above length, zero mismatches, and a later zero-live TLS record that retains the driven high-waters; asynchronous QEMU termination is not treated as a service quiescence boundary. These observers add no charge, admission, lane-selection, reservation, release, deadline, overload, or serving decision. All retained request, response, and TLS capacity remains outside the in-flight byte budget and unbounded by the ledger; allocator-internal overhead is neither measured nor charged. Residual diagnostic gaps are UART-byte and polling attribution, a Console backpressure result, a dropped-readback count, and a protected diagnostic lane; this evidence establishes neither production nor public-ingress authority. #### Mirrored accept-backlog capacity - **Dimension, derivation, and effective value:** Outstanding accept calls mirrored by the service, in entries. `IngressProfile::effective_backlog` is `min(struct_max_backlog, backlog_quota)`; defaults are structural 16, configured four, and effective four. `ingress_backlog.*` selects the quota. `validate_enabled_lanes` requires at least one effective entry per enabled listener, while the serve loop also stops arming at available physical connection slots. - **Authority, lifecycle, overload, and recovery:** Before publishing an accept call, the serve loop calls `reserve_bound(Backlog)`; successful publication calls `commit_bound`, a failed publication calls `rollback_bound`, and accept completion or failure calls `release_bound`. Full capacity returns an internal `BacklogFull` overload value, but no accepted connection exists at that point: the arming loop discards the value, stops submitting accepts for that tick, and sends no HTTP response. A completed or failed pending accept releases an entry and permits re-arming. One-call-per-listener floor is restored before round-robin extra accepts. One of the three typed transition errors remains fatal: the serve loop emits the incremented transport record immediately before its existing fail-closed process exit. - **Ledger observability and open descriptor gaps:** `backlog_occupancy`, `backlog_high_water`, and `backlog_refusals` are the ledger counters; refusals count distinct blocked-listener episodes rather than polling attempts and are the only live saturation signal. Fixed `backlog_foreign_ledger_mismatches`, `backlog_unknown_reservation_mismatches`, and `backlog_invalid_state_mismatches` counters classify rejected transitions without retaining reservation identity. The bounded `webui-ingress-transport-bounds` record maps them to `backlog_fgn`, `backlog_unk`, and `backlog_inv`; healthy QEMU requires zero, while a nonzero terminal record precedes process exit. The `ingress-policy` boot line reports configured, effective, and structural values. The adjacent `ingress-transport-structural-cost` boot record quantifies one outstanding accept as one shared network-stack socket slot's code-owned transport-buffer plus service-object backing and publishes the corresponding worst-case total at the effective backlog. This is a structural derivation of another process's backing, not a live measurement or WebUI-ledger charge; allocator overhead, kernel continuation depth, and backend CPU remain uncharged, and the record establishes no production capacity or public-ingress authority. #### Accepted-socket release-debt capacity - **Dimension, derivation, and effective value:** Finished accepted sockets awaiting successful capability release, in entries. `IngressProfile::effective_release_debt` is `min(struct_max_release_debt, release_debt_quota)`; defaults are structural 16, configured four, and effective four. `ingress_debt.*` selects the quota. The fixed `ReleaseDebtLedger` has ten entries, one per physical connection slot; live policy binds below that table. - **Authority, lifecycle, overload, and recovery:** Before recording a debt and dropping its owner, the serve loop calls `reserve_bound(ReleaseDebt)`; record failure rolls back, successful publication commits, and a successful ring release calls `release_bound`. Full capacity leaves the finished connection in its slot and queues no unaccounted release; retryable endpoint-state rejection retains the committed debt. Capacity recovers only after the matching physical capability release retires. One of the three typed transition errors remains fatal: the serve loop emits the incremented transport record immediately before its existing fail-closed process exit. - **Ledger observability and open descriptor gaps:** `release_debt_occupancy`, `release_debt_high_water`, and `release_debt_refusals` report the ledger state; refusals count distinct blocked-slot episodes. Fixed `release_debt_foreign_ledger_mismatches`, `release_debt_unknown_reservation_mismatches`, and `release_debt_invalid_state_mismatches` counters classify rejected transitions without retaining reservation identity. The bounded record maps them to `debt_fgn`, `debt_unk`, and `debt_inv`; healthy QEMU requires zero, while a nonzero terminal record precedes process exit. Boot and `webui-ingress-transport-bounds` evidence report configured/effective/structural values and counters. The adjacent `ingress-transport-structural-cost` boot record quantifies one release debt as one shared network-stack socket slot's code-owned transport-buffer plus service-object backing and publishes the corresponding worst-case total at effective release-debt capacity. This remains an observer-only structural derivation: allocator overhead, kernel continuation depth, and backend CPU are uncharged, and it establishes neither production capacity nor public-ingress authority. #### Absolute connection occupancy deadline - **Dimension, derivation, and effective value:** Monotonic nanoseconds from accepted connection through bounded read and response phases. `REQUEST_READ_DEADLINE_NS` is 6 s and `RESPONSE_SEND_DEADLINE_NS` is 30 s for public and local-health traffic; `PROVIDER_HEALTH_DEADLINE_NS` is 3 s for each provider phase. Progress does not extend either phase, so the maximum modeled public/local occupancy is 36 s and provider-health occupancy is 6 s. These constants are code-owned, not profile fields or manifest markers. - **Authority, lifecycle, overload, and recovery:** The read deadline and its timestamp anchor are captured together at accept and passed into `WebUiIngressLedger::request_with_read_anchor`; a deferred TLS accept carries both unchanged. The send deadline anchors before routing, so bounded backend work consumes that budget. `begin_send_phase` installs that deadline as authoritative ledger state before routing; a rejected transition fails the service closed instead of leaving the transport and ledger on different phases. Clock loss and expiry fail closed. An already-expired admission is typed `503`. The serve loop calls `WebUiIngressLedger::reap_expired_after` before work and after each classified synchronous operation, always reusing that tick's single authoritative Timer sample while scanning only its fixed live-admission table and cancelling entries past their stored current-phase deadline through the existing exact-release path; clock loss reaps every live entry. Local calibrated cycle samples measure bracket duration but never advance deadline or release authority. This returns the application slot, lane reserve, and byte charge before the matching connection finishes bounded transport cleanup. - **Ledger observability and open descriptor gaps:** The boot `per-connection deadlines` line reports all four phase values. `overload_deadline` counts requests already expired at admission; `read_deadline_expired` counts readable-clock expiry while handshaking/reading and `send_deadline_expired` counts readable-clock expiry while response bytes remain in `Sending`. `reaped_read_deadline` and `reaped_send_deadline` count owner-driven releases by stored current phase, while `reap_release_mismatches` counts a sweep candidate rejected by exact cancellation. `reaped_read_overshoot_high_ns` and `reaped_send_overshoot_high_ns` retain the largest readable observing-sample minus stored-deadline deltas; `completed_reap_sweeps`, `reap_sweep_gap_high_ns`, and `reaps_over_prior_sweep_gap_high` expose within-epoch cadence and historical-cadence outliers. Fixed per-class visit and duration high-water arrays retain calibrated operation brackets; the bounded attribution record publishes the largest attributed class and all visit counts without connection identity. The bounded deadline snapshot reports every live admission's lane, current phase, admission age, read/send anchors, and code-owned phase durations, plus the count already past its current phase deadline; its ordinal is observation-local and publishes no connection identity. `deadline_readback_mismatches` counts rejected authoritative send-phase transitions; the serve loop treats one as a fail-closed invariant failure. Clock loss and a `Finishing`-phase TLS close stall retain fail-closed cleanup without fabricating operation attribution or inflating either phase-work counter. Reaping remains on the single-threaded serve loop: there is no independent reaper thread, hard detection-latency bound, or separately charged synchronous-work budget. Reservation artifacts bind releases to the issuing ledger and reservation id. Backlog and release-debt transitions return explicit foreign-ledger, unknown-reservation, or invalid-state errors. Application release returns `ApplicationReleaseError::ForeignLedger`, `UnknownReservation`, or `DuplicateRelease` in every build. The serve loop treats every variant as a fatal owner-invariant failure after emitting the incremented transport record; none changes admission, serving, or healthy-path occupancy accounting. Fixed saturating application-release counters classify foreign-ledger, unknown or stale reservation, and duplicate-release faults; the bounded `webui-ingress-transport-bounds` record publishes them as `app_fgn`, `app_unk`, and `app_dup` without reservation or connection identity. Protected-reserve mismatches continue to increment their bounded aggregate counter, while `inflight_bytes_release_mismatches` continues to cover failed byte-charge release across every lane. This typed refusal adds no recovery authority, admission decision, overload response, retry guidance, lane selection, or serving decision. The ledger's fixed counter set and small structurally bounded scans keep denial accounting bounded, but the per-connection key is intentionally not a browser identity: an attacker may open fresh connections and consume the service-wide pool. Consequently these controls bound retained state and defender work; they do not establish a per-remote-caller SLA, calibrated production capacity, or isolation from every other service sharing CPUs, memory, the network stack, or kernel continuations. ### Landed CapSet gateway connection descriptor inventory This inventory applies the [Required Resource Descriptor](#required-resource-descriptor) to the connection and request-occupancy bounds enforced by the remote-session CapSet gateway. It is separate from the [WebUI ingress inventory](#landed-webui-ingress-descriptor-inventory): the process-lifetime `GatewayAdmissionLedger`, `PrincipalLoginTable`, and the eight-element connection slot vector in `demos/remote-session-capset-gateway/src/lib.rs` and `demos/remote-session-capset-gateway/src/main.rs` are authoritative only for the gateway. They do not reserve WebUI capacity, kernel continuations, network- stack backing, or a multi-user production entitlement. Both services depend on the separate [shared network-stack socket-object inventory](#shared-network-stack-socket-object-table); the gateway ledger does not charge those lower-layer slots. `GatewayConnection` retains the accepted `TcpSocket` client facet and its generation-bound transport state, one admission entry, deadline and state- machine metadata, at most one pending receive or send call plus one pending close call, an input vector limited to the four-byte frame header plus `MAX_FRAME_BYTES` (8,192 bytes) of logical content, and an output vector. After authentication the same slot may additionally retain `RemoteSessionState` capabilities, endpoint descriptors, two charged principal-id copies, and launched-process handles. `GatewayAdmissionLedger` gives those retained classes one 16,392-byte-equivalent per-slot ceiling: actual response-vector capacity, 64 bytes for each retained capability, process handle, or endpoint descriptor, and the capacities of both principal-id copies. The ceiling is derived as two complete 8,196-byte frame equivalents: one for a maximum accepted frame and one equally sized allowance for authenticated state. The full eight-slot table therefore retains at most 131,136 charged bytes for these classes. Pre-identity work, authenticated work retained by the connection, and cleanup all remain service-paid; authentication does not transfer the slot charge to a session ledger. The adjacent observer-only retained-object structural-cost record derives the current wrappers with `size_of`: the largest retained capability wrapper is 16 bytes, `OwnedCapability` is 8 bytes, `ShellBundleEndpoint` is 32 bytes, and one principal-id `Vec` header is 24 bytes. The largest current authenticated slot shape retains nine capability wrappers, seven process handles, two endpoint descriptors, and two principal-id copies. Across all eight slots those concrete headers total 1,152, 448, 512, and 384 bytes, respectively, or 2,496 bytes combined. Each inline wrapper layout is no larger than the configured 64-byte comparison charge. The record calls this relation `within-charge`; it is not a charge-sufficiency verdict because `size_of` does not include heap allocations reachable from a wrapper, including the endpoint name `String` buffer and capability-reference `Rc` allocation. The principal vectors' allocated byte capacities continue to be charged separately by the admission ledger; the observer's 64-byte comparison does not add a charge for their 24-byte headers. The host proof pins the operator endpoint names and count against the `AuthorityBroker.remoteClientBundle` policy source, pins the gateway's corresponding maximum, and pins every emitted per-slot maximum so a self-consistent drift still fails the gate. #### Gateway connection-table capacity - **Dimension, derivation, and effective value:** Concurrent accepted gateway connections, in slots. `GATEWAY_CONNECTION_SLOTS` is a code-owned structural proof ceiling of eight; `slots` has exactly eight entries and `GatewayAdmissionLedger.entries` refuses a ninth charge. There is no manifest/profile value, delegated credit, protected reserve, or zero semantic, so the effective value is always eight for one gateway process. Each charge retains the per-connection state described above. The connection state machine, not this ledger, separately limits a request payload to 8,192 bytes and retained logical input to the four-byte header plus payload (8,196 bytes). - **Authority, lifecycle, overload, and recovery:** A completed listener accept supplies the transport facet and gateway-owned `connection_id`; the gateway calls `GatewayAdmissionLedger::admit` before publishing `GatewayConnection` into a free slot. The move-only `GatewayAdmission` binds release to the ledger, admission id, and connection id. Normal saturation stops accept arming; a later exact release recovers capacity, while transport/backlog handling remains outside this ledger and no framed `429`/`503` exists. A direct `admit` refusal is treated as ledger/table divergence and terminates the gateway; only process restart recovers that path. - **Ledger observability and open descriptor gaps:** The bounded admission-ledger readback reports configured and effective capacity (both eight), `admitted`, current and high-water occupancy, saturation observations, authentication failures, every typed release reason, release mismatches, and the direct-refusal `overload_table_full` counter. Its sequence-correlated `retained-input` component additionally reports live table-wide input length and vector allocation capacity, the capacity service high-water, per-live-slot capacity high-waters, and capacity-below-length mismatches. This allocation observer is explicitly outside aggregate charging: the 16,392-byte per-slot and 131,136-byte table ceilings, refusal path, deadlines, close, selection, and release decisions are unchanged. The record carries no principal id, frame content, peer address, capability, or endpoint-name material. The separate sequence-correlated `gateway-listener-partition` record in the [shared network-stack socket-object inventory](#shared-network-stack-socket-object-table) publishes the same configured/effective table values beside port 2327's configured and generation-reduced effective partition. It classifies the boot mismatch as `table-exceeds-partition`, remains observer-only, and neither charges nor binds the two ledgers. Every readback line additionally carries a base-36 `readback_cost=withheldPublications,formattedRecordBytes,consoleCalls` tuple of saturating process-lifetime counters. The byte count covers only the stable line handed to `Console`, including the line publishing it; intermediate fixed-point candidates remain uncharged formatter and allocator work. A miss at any of the three due checks -- the selection-cycle boundary's payload high-water change, `gateway_observation_readback_due`, and `payload_readback_due` -- increments the withheld count for all four records, and only that counter may publish on cost alone, at exact powers of two, so no emission feedback loop exists. The cycle boundary dominates the count because it is the only due check reached while no slot is occupied. The event publications -- boot, connection admission, an available coexistence snapshot, an aggregate-cost refusal, and connection release -- are not due checks and withhold nothing, so they charge only their formatted bytes and Console call. The QEMU interop proof requires both observer records and nonzero withheld-publication, formatted-byte, and Console-call attribution on every record while its typed chat denial and Adventure launch path still complete. The analyzer pins each record's byte total from both sides: the first publication charges exactly its own line, and each later adjacent publication adds exactly the line it published. Open gaps: no owner/tenant subdivision or recovery reserve, no typed overload response for connections held outside the gateway while its table is full, no charge for the observed input-vector allocation, socket/backend, kernel continuation, synchronous CPU work, or cleanup, and no UART-byte or polling attribution, `Console` backpressure result, dropped-readback count, or protected diagnostic lane for the readback itself. #### Per-slot aggregate retained cost - **Dimension, derivation, and effective value:** Charged byte-equivalents for response-vector capacity plus authenticated capabilities, handles, descriptors, and principal bytes. `GATEWAY_SLOT_AGGREGATE_CEILING_BYTES` is derived as two complete accepted-frame equivalents, `2 * (4 + 8,192) = 16,392` bytes: one response-frame allowance and one authenticated-state allowance. `GATEWAY_RETAINED_OBJECT_CHARGE_BYTES` is 64 bytes per capability, process handle, or endpoint descriptor; both principal-id vector capacities are charged. Eight slots derive the 131,136-byte `GATEWAY_TABLE_AGGREGATE_CEILING_BYTES`. The value is code-owned and has no zero or delegated-credit semantic. - **Authority, lifecycle, overload, and recovery:** `GatewayAdmissionLedger::update_aggregate_charge` replaces the existing admission entry's exact charge before a response is retained. A response plus state that would exceed 16,392 bytes is dropped, authenticated state and its principal-table entry are released, and only that connection enters close with `AggregateCostCeilingExceeded`; no deadline is extended. The refusal emits an immediate ledger readback after cleanup. Completing a response releases its vector allocation and replaces the charge with retained-state cost. Final `GatewayAdmissionLedger::release` removes the entry and its remaining charge before incrementing the typed release reason. - **Ledger observability and open descriptor gaps:** Readback reports the per-slot and table ceilings, current aggregate occupancy, aggregate high-water, refusals, and typed aggregate-cost releases. A sequence-correlated `retained-object-structural-cost` boot record additionally publishes the four concrete inline wrapper layouts, their current maximum counts per slot and full-table derived totals, the configured 64-byte comparison charge, and a `within-charge` or `exceeds-charge` inline relation for each class. It explicitly excludes owned heap and therefore does not claim that the comparison charge covers each wrapper's complete retained allocation. It contains no identity or retained object value and changes no admission, refusal, close, deadline, selection, or release decision. The QEMU interop proof requires that fixed-field boot record, pins the expected layouts and maxima, and rejects any inline layout that exceeds the charge while the focused manifest's supported client behavior still completes: its chat worker is absent and the typed chat denial is expected, while its Adventure service launch succeeds. A separate client sends the reserved `__capos_aggregate_cost_probe__` CapSet lookup, whose impossible interface id makes it a self-closing proof request rather than remote authority. The harness correlates that client's expected connection close with the gateway's admission-specific proof-refusal line and typed release, then requires zero aggregate occupancy and zero release mismatches. Residual gaps: this is inline current-layout evidence, not owned-heap or allocator-wide introspection and not a per-tenant charge; the authenticated-state allowance remains structural rather than allocator introspection; shared lower-layer socket, ring, backend, CPU, and cleanup work remains outside this ledger; and the record establishes neither production capacity nor public-ingress authority. #### Per-principal authenticated-session capacity - **Dimension, derivation, and effective value:** Concurrent authenticated sessions per kernel-returned principal plus distinct retained principals. `MAX_CONCURRENT_LOGINS_PER_PRINCIPAL` is a code-owned ceiling of four; `PRINCIPAL_TABLE_SLOTS` is a nominal 32-entry table ceiling. Under the current eight-connection gateway, at most eight distinct principal entries can be live, so the connection table is the lower effective aggregate bound. Each `PrincipalSlot` retains one principal-id vector, a generation, an eight-bit count, and a fixed four-entry admission-id array; each admitted `RemoteSessionState` retains another principal-id copy plus its move-only `PrincipalLoginToken`. Both principal-vector capacities are conservatively charged to each authenticated gateway slot, including the shared table copy for repeated sessions of one principal. Neither constant is manifest/profile configurable and neither carries a zero semantic or delegated credit. - **Authority, lifecycle, overload, and recovery:** `PrincipalLoginTable::try_admit` charges only the principal id returned by `SessionManager` after authentication and session-info lookup; caller-supplied account/profile text does not select the ledger key. Its `PrincipalLoginToken` binds discharge to the issuing table instance, the principal-slot generation, and the admitted session id. Bundle/setup failure rolls the token back. Logout or connection teardown consumes it, and removal of the last live admission id removes the principal entry. A foreign, stale, duplicate, or unknown token cannot decrement occupancy and instead increments `release_mismatches`. Per-principal and table exhaustion remain counted and logged separately as `OverCap` and `TableFull`, and both retain the existing `ServiceUnavailable` wire outcome; an exact release permits later admission. Existing principals remain independently usable unless the global table limit is reached. - **Ledger observability and open descriptor gaps:** The secret-free readback reports configured and effective table and per-principal capacities, live and high-water session and distinct-principal occupancy, a fixed occupancy histogram for one through four sessions per principal, admissions, releases, release mismatches, and separate over-cap and table-full denials. The focused QEMU proof requires zero principal release mismatches with balanced admissions and releases. Open gaps: the nominal 32-entry `TableFull` path remains unreachable while the stricter eight-connection composition holds. An attacker must first authenticate a distinct principal to consume an entry, but eight authenticated principals can occupy every gateway connection and deny unrelated pre-authentication progress. #### Initial first-byte expiry threshold - **Dimension, derivation, and effective value:** Monotonic threshold from initial connection admission to the first received byte. `FIRST_BYTE_DEADLINE_NS` is a code-owned five seconds, capped by the same request's absolute threshold. It bounds the deadline value but not observed wall-clock slot occupancy because expiry is evaluated only when the single-threaded serve loop polls that connection. - **Authority, lifecycle, overload, and recovery:** `GatewayDeadline::from_connection_admission` starts the threshold when the accepted connection is charged. Actual byte progress changes the phase to active-frame; a later poll that observes expiry changes the release reason to `FirstByteTimeout`, closes the socket, and releases the connection charge exactly once after close handling. A later established session is deliberately unbounded while idle between complete frames; its next first byte starts a new request rather than consuming this initial-first-byte threshold. - **Ledger observability and open descriptor gaps:** The fixed slot arrays distinguish phase `A` (awaiting the initial first byte) from `I` (deliberately idle between complete frames). Both report saturating age from their stored phase anchor; `A` reports remaining time to the immutable absolute instant while `I` reports zero absolute remaining. The readback also carries a saturating count of connections newly observed with a positive idle-between-frames age and the service-lifetime high-water of that first positive age. A new age high-water emits immediately; a counter-only transition emits at exact powers of two. `released_first_byte_timeout` owns observed releases, and `first_byte_overshoot_high_ns` retains the largest observing-sample minus threshold-instant delta. The QEMU proof first requires the existing slow fixtures to publish concurrent `A`, `R`, and backend-work evidence. It then completes the aggregate-refusal client, records that sequence as a floor, and holds one supported client after a response so it is the only connection eligible to supply the later `I` observation. This ordered trace avoids treating event-driven slot phases as a stable simultaneous state while still attributing the populated idle age to the supported client. The proof also requires the typed first-byte close and populated overshoot high-water, and balanced final occupancy and releases. Open gap: no independent expiry reaper. Synchronous work for another slot can still delay initial-first-byte detection beyond five seconds, and established idle time remains deliberately unbounded. #### Active frame/response progress expiry threshold - **Dimension, derivation, and effective value:** Maximum encoded gap between observed bytes while receiving a started frame or sending its response, in monotonic nanoseconds. `FRAME_PROGRESS_DEADLINE_NS` is a code-owned five seconds. Each real receive/send progress observation refreshes this threshold but clamps it to the request's immutable absolute instant. It is not a hard wall-clock occupancy maximum. - **Authority, lifecycle, overload, and recovery:** The first frame byte (or `begin_response` after backend work) starts the window. Further byte progress refreshes it; non-progress does not. The same completion branch that refreshes the threshold also adds its logical byte count to `received_bytes` or `sent_bytes`; receive progress updates both the physical slot's retained-input high-water and a ledger-global high-water that survives release, each bounded by the complete 8,196-byte frame. A later poll that observes expiry is typed `FrameProgressTimeout`, drains/closes the transport, performs session cleanup, and releases the admission. `handle_payload` runs synchronously inside the slot-selection loop and can perform credential verification, session/broker calls, worker launch, wait, termination, logging, and release flushing, commonly through individual `WAIT_NS` five-second waits. While it runs, no other slot is polled and no deadline is evaluated. - **Ledger observability and open descriptor gaps:** The fixed arrays report `R`, `B`, `S`, and `C` for receive, synchronous backend work, response send, and close. For `R` and `S`, age is measured from the latest byte-progress sample that refreshed the progress threshold; for the other phases it is measured from phase entry. Remaining time is always against the immutable absolute request instant. The readback publishes cumulative logical receive/send bytes, the emitted retained-input ceiling, the durable service high-water, and the eight-slot live high-water array. Each recognized decoded `handle_payload` request is bracketed once, with no nested bracket, in fixed order as credential/authentication, session-manager or broker, worker launch, bounded wait, or cleanup/logging/release; an unknown discriminant returns the existing bad-request response without contributing to any fixed class. Consecutive increasing samples from the loop's existing Timer reads calibrate read-only cycle samples after at least three intervals and ten milliseconds; no additional capability call is made. `backend_counts_b36` carries the five visit counters followed by the five measured-visit counters, so initial, zero, backwards, and lost samples remain distinguishable. `backend_time_b36` carries the five duration high-waters followed by the largest class, its duration, and the count of other occupied slots that were not polled during that interval. `backend_calibration_b36` carries the calibration window and interval count. The class index is zero through four in the order above; five means no measured class. High-water changes emit immediately and counter-only changes emit at exact powers of two. `capacity_b36`, `admission_b36`, `release_counts_b36`, `principal_capacity_b36`, `readback_cost`, the slot-time array, and the retained-input array use fixed-order base-36 compaction; the analyzer expands and validates every shape. All four saturated lines retain at least a 32-byte structural reserve below the 1,024-byte Console ceiling. The per-record `readback_cost` tuple spends 56 bytes of the former 64-byte reserve, so the service-global `received_bytes` and `sent_bytes` counters moved from the `principal-progress` record to the `releases` record rather than letting one line consume the remaining headroom. They remain service-global gateway counters, not per-principal measurements or quota evidence. `frame_progress_overshoot_high_ns` retains the largest observed progress-threshold overshoot. `delayed_expiry` still compares against the previous completed selection cycle's occupied-slot poll cost; synchronous payload handling remains outside that baseline. The QEMU coexistence proof requires simultaneous `A`/`R`/`B` slot evidence, typed slow-peer closes and overshoots, useful-client protocol completion, populated attribution for all five backend classes, at least one other occupied slot left unpolled by the largest interval, zero release mismatches, balanced final occupancy, and the exact retained-input ceiling. This measures but does not bound head-of-line blocking: there is no independent reaper, protected progress for unrelated slots, synchronous-work budget, or calibrated attacker/defender CPU ratio, and no admission, deadline, close, or public-authority change. One unauthenticated peer can still spend a request plus credential proof to force hashing and serial multi-second waits, delaying all other slots and their timeout recovery. #### Absolute request expiry threshold - **Dimension, derivation, and effective value:** Immutable request deadline instant in monotonic nanoseconds. `REQUEST_DEADLINE_NS` is a code-owned 30 seconds. The first request anchors at connection admission; a later request anchors at its first byte. Receive progress, backend completion, and response progress cannot move the stored instant, but the single-threaded loop may observe it late, so 30 seconds is not a hard maximum request/slot lifetime. Idle time after a complete response is outside any request and is intentionally unbounded. - **Authority, lifecycle, overload, and recovery:** `GatewayDeadline` carries the same absolute instant through reading and sending. `finish_response` returns the connection to the unbounded between-frame state. A poll that observes absolute expiry is typed `AbsoluteRequestTimeout`; close and cleanup release the connection admission. Synchronous backend work on this or another slot can cross the instant before the loop reaches the expiry check, and sequential five-second waits can extend actual occupancy beyond 30 seconds. - **Ledger observability and open descriptor gaps:** Every occupied-slot sample reports saturating remaining nanoseconds against the stored absolute instant, and `absolute_request_overshoot_high_ns` retains the largest observed absolute-threshold overshoot. These values use the same monotonic sample as that slot's poll and never recompute or extend an instant. The QEMU coexistence proof keeps the production thresholds unchanged and sends a valid incomplete-frame prefix every four seconds until the gateway closes it. It requires exactly one typed absolute-request release, populated absolute overshoot, exact one-each first-byte/frame-progress/absolute timeout totals, sequence-correlated evidence after useful-client completion that an active-frame slot remains charged before absolute expiry, useful Adventure launch and typed chat-denial completion, and balanced final occupancy with two normal releases and zero release mismatches. The production-duration fixture adds roughly 35 seconds to the focused gate. Open gaps: no independent reaper and no separately charged or bounded aggregate backend-work budget within the nominal 30 seconds. #### Full-table selection work - **Dimension, derivation, and effective value:** Gateway scan work per completed serve-loop selection cycle, in slot visits. When reached, `GatewayFairSelector::order` returns all eight slot indices exactly once using a pseudo-randomized start and rotating odd stride; capacity eight and the power-of-two/odd-stride construction bound one completed cycle to eight visits. `ACTIVE_POLL_NS` requests at most one 50 ms ring wait after a cycle. There is no bound on wall-clock time between cycles because inline slot work may block. This is limited work-conserving ordering evidence, not isolation, a reservation, or an SLA. - **Authority, lifecycle, overload, and recovery:** `GatewayAdmissionLedger::begin_selection_cycle` advances the ledger cycle before every scan, and `note_selected` marks an occupied entry when the loop reaches it. Each occupied-slot `GatewayConnection::poll` is bracketed by monotonic samples; `note_slot_visit_duration` accumulates those poll costs and records the largest single poll's physical slot, excluding later synchronous payload handling, for publication when the next cycle begins. Each completed recognized `handle_payload` bracket separately adds its calibrated duration to the current cycle without another capability call. An attacker must retain a charged connection to add one occupied-slot poll, but a request on that slot can synchronously force credential hashing, broker/process work, logging, and multiple waits before the next slot visit. Closing a connection removes its future occupied-slot work. - **Ledger observability and open descriptor gaps:** `selection_cycles` reports started cycles; `selection_cycle_ns` remains the previous completed cycle's accumulated occupied-slot poll cost. The size-partitioned third line encodes the other values in lowercase base 36: `selection_age_b36` is the eight-position saturating `u32` ledger-cycle distance from the last `note_selected`, and `cycle_cost_b36` holds the poll-cost service high-water, previous-cycle largest single poll, that poll's physical slot, previous-cycle synchronous payload total, and payload-total service high-water. Slot eight is the no-nonzero-poll sentinel outside the valid zero-through-seven table indices. Release clears the corresponding selection-age position. Payload high-water changes emit at the next cycle boundary; backend visit-only changes retain exact-power-of-two sampling. The compact encoding keeps at least a 32-byte structural reserve below the console capability's 1,024-byte ceiling. These calibrated occupied-work fields do not measure full elapsed cycle wall time. `starvation_observations` still increments only when a later cycle begins and finds an entry skipped for more than one ledger cycle, so it does not measure time stalled within the current cycle. The host ledger test proves that two measured brackets in one cycle publish their exact sum rather than the larger duration. The QEMU proof drives synchronized requests on two admitted fixture connections and requires populated per-cycle payload cost at least as large as the correlated backend high-water while another occupied slot remains unpolled; it also requires populated selection-age and poll-cost values, useful progress, zero release mismatches, and balanced final occupancy. Open gaps: no protected recovery lane, adversarial attacker/defender throughput calibration, or production entropy; the selector seed is a deterministic proof constant. #### Close-drain expiry threshold - **Dimension, derivation, and effective value:** Encoded time from close initiation before an observed pending receive/send or close-completion drain is treated as fatal. `CLOSE_DRAIN_DEADLINE_NS` is a code-owned five seconds, but another slot's synchronous work can delay the next closing-slot poll beyond that instant. - **Authority, lifecycle, overload, and recovery:** All normal, timeout, reset, malformed-frame, aggregate-cost refusal, and owner-death paths enter `Closing`. Close initiation stores the threshold instant once. A later poll that observes that instant uses the same monotonic sample to produce `CloseDrainExpiry`, releases the gateway admission, and then terminates the gateway process because safe transport cleanup was not proved. Restart is the only service recovery from that fatal path. - **Ledger observability and open descriptor gaps:** `released_normal`, the three timeout counters, `released_reset`, `released_malformed_frame`, `released_aggregate_cost_ceiling`, `close_drain_expiry`, and `released_owner_death` classify exactly-once releases, and the readback emits every counter. `close_drain_expiry` does not increment `released_owner_death`; `close_drain_overshoot_high_ns` is zero until the fatal observation and then holds that one process-terminal saturating difference between the observing sample and stored threshold. The ledger update retains max semantics, but process termination prevents a second production sample, so this field is not a multi-expiry trend. An overshoot larger than the previous completed cycle's poll-only `selection_cycle_ns` increments `delayed_expiry` once on that path; the separate previous-cycle synchronous payload total in `cycle_cost_b36` exposes payload work that the comparison baseline intentionally omits. `release_mismatches` retains the same foreign/stale/duplicate accounting. The focused healthy coexistence proof requires both close-drain fields to remain zero and requires zero release mismatches. Open gaps: process termination still sacrifices unrelated gateway connections, and no protected recovery lane bounds close observation latency. `GatewayAdmissionLedger::release` increments a typed reason only after exactly one matching entry is removed and records mismatches without changing release or termination policy. The fixed entry count and full-table selection bound keep each reached ledger scan finite. Each snapshot is split into four sequence-correlated, fixed-field lines whose maximum rendered lengths remain below the console capability's 1,024-byte per-call ceiling. Boot, connection admission, connection release, and live principal occupancy changes emit immediately; counter-only changes from repeated frames emit at powers of two, so read-side visibility does not add linear serial-output amplification to the single-threaded request path. Each array position is the corresponding physical index in the gateway's fixed connection table; release clears that position, and a later admission reuses it rather than compacting another live slot into the gap. The connection source address is authentication metadata rather than resource-account authority, so reconnects can compete for the same service-wide table. These bounds limit retained connection count, charged response/authenticated-state cost, logical input bytes, and encoded deadline instants; they do not bound deadline- detection latency or synchronous backend work. One peer can therefore stall unrelated slot polling, timeout recovery, credential work, and selection-cycle completion. The gateway also lacks protected lifecycle capacity, calibrated production admission, and isolation from shared network-stack, kernel, CPU, and memory pools. The selected public-readiness direction is: - charge TCP, request, failed-cookie, login, crypto-arena, and unauthenticated response work to service/anonymous ingress before identity; - use independent generation-bound browser sessions after authentication and accept explicit per-session donation for subsequent work; - derive concurrency from accounted socket, buffer, heap, and work capacity, while reserving bounded health/lifecycle/recovery progress; - reserve accepted sockets by backlog slot and generation, mint their client-only facets through endpoint-owner-local authority without pausing shared receives or unrelated transfers, and stream bodies/TLS records without retaining full plaintext and ciphertext copies; - default route descriptors to denial and keep method, authority, body, and cache policy in one table; - serve non-authority static bytes publicly at content-addressed URLs so browser and explicitly configured shared caches may reuse them, while sizing origin admission for a cold or cache-bypass flood; reject non-canonical query strings on immutable asset routes; serve bootstrap HTML with revalidation or `no-cache`; - charge the ordinary public `/healthz` route to anonymous ingress. If provider health checks receive protected progress, admit them through a distinct listener/port or capability that the public frontend cannot select, rather than trusting the request path (the concrete listener/capability topology and per-lane accounting invariants for the public, local-health, and provider-health lanes are selected in the [WebUI Protected Ingress Lanes proposal](../proposals/webui-protected-ingress-lanes-proposal.md)); and - use authenticated static delivery only when an explicit confidentiality policy requires it. In that mode, validate the session before ETag/`304` handling and use private revalidation semantics. Keep a minimal public login bootstrap because a browser cannot obtain the session from an entirely protected asset graph. Protected asset requests perform a bounded live-session lookup, never password verification. Authentication is not a default optimization or denial-of-service defense; and - initialize production transport randomization from a generation-bound entropy grant. A deterministic seed belongs only to an explicitly selected proof fixture and production startup must not silently fall back to it. Landed for the web-ui serving path: the network stack draws one bounded block through a manifest-granted `EntropySource` and derives the listener and DHCP-client seeds under separate domains (`capos-lib/src/transport_seed.rs`); a boot without that grant refuses to publish with a typed, secret-free reason and binds no listener. The deterministic constant remains only on the focused proof modes, which report it as such. Gate `test-webui-transport-entropy`. The two background images total about 0.94 MiB and remain part of the real UI. They are useful correctness assets, not a steady-state throughput workload. Performance progress uses a deterministic payload of at least 8 MiB plus the unchanged cold browser graph and reports the same-boot ladder: ```text G_path -> G_stack -> G_ipc -> G_webui -> G_browser ``` Each synthetic rung uses identical bytes, direction, boot, sender/receiver, cache-off posture, connection schedule, and predeclared attempt IDs. `G_path` is the independently measured physical/provider/NIC-path ceiling without the capOS stack/application stages; `G_stack` adds the userspace transport stack; `G_ipc` adds socket-cap IPC; `G_webui` adds HTTP routing/delivery; and `G_browser` is the browser fetch of that proof-only payload. The unchanged real browser graph is a separate correctness/TTFB/load-time workload, not a steady-state goodput substitute. Adjacent-layer ratios, aggregate concurrent goodput, TTFB, CPU/queue occupancy, health latency, fairness, first-attempt refusals, browser failures, and cache hits identify where capacity is lost. Retrying or replacing a refused sample does not turn it into success, and improvement over a pathological historical baseline does not prove the implementation is near the network ceiling. The initial steady-state bands are `G_stack/G_path >= 0.90`, `G_ipc/G_stack >= 0.95`, `G_webui/G_ipc >= 0.95`, `G_webui/G_stack >= 0.90`, `G_browser/G_webui >= 0.95`, and four-flow aggregate goodput at least `0.85 * G_stack`; they are evidence targets, not quotas. Revising them is a separate reviewed decision made before the candidate measurement, never a same-run calibration escape. The synthetic payload is a proof-only route or fixture and must be absent from the default/production/ public route table and shipped bundle. The coexistence gate runs a cold/cache-bypass public-static flood alongside an already authenticated session/API stream, one fresh login stream, and genuine health/lifecycle work. Each class reports charged bytes/CPU, reserved or weighted progress, latency, denials, and starvation. Separate green tests do not prove that those classes coexist on the shared NIC and CPUs. ## Implementation Gaps The Loopyard records below separate the implementation work by owner and proof boundary: - [`resource-profile-service-binding-fail-closed`](https://tasks.cap-os.dev/p/capos/t/resource-profile-service-binding-fail-closed) makes service profile selection and binding explicit, validates supported fields, and makes unknown references fail closed; it does not implement hierarchical child credit. - [`resource-ledger-hierarchical-exact-release`](https://tasks.cap-os.dev/p/capos/t/resource-ledger-hierarchical-exact-release) adds hierarchical credit and exact reservation-token release. - [`kernel-bounded-object-amplification-accounting`](https://tasks.cap-os.dev/p/capos/t/kernel-bounded-object-amplification-accounting) charges fixed backing, fan-out, shared continuations, and diagnostic work. - [`memory-pressure-accounted-reclaim-work`](https://tasks.cap-os.dev/p/capos/t/memory-pressure-accounted-reclaim-work) bounds and charges reclaim scans, CPU, and optional I/O while preserving recovery progress. - [`scheduler-resource-reservation-semantics`](https://tasks.cap-os.dev/p/capos/t/scheduler-resource-reservation-semantics) separates share, throttle, placement, reservation, and SLA claims. - [`remote-session-gateway-concurrent-admission-deadlines`](https://tasks.cap-os.dev/p/capos/t/remote-session-gateway-concurrent-admission-deadlines) removed the serial slow-peer monopoly from the CapSet gateway with bounded concurrent admission, absolute request deadlines, progress occupancy bounds, exact release reasons, and coexistence evidence. - [`credential-verification-fair-anonymous-admission`](https://tasks.cap-os.dev/p/capos/t/credential-verification-fair-anonymous-admission) puts the shared Argon2 arena behind fair bounded admission with a protected local recovery/setup lane. Landed at the executor: `capos-lib`'s `CredentialAdmission` arbiter (protected local reserve, anonymous lane pool, per-connection bound on opaque non-peer tokens, aggregate backstop, non-destructive absolute-deadline handling with owner-driven exact reservation/release, work-conserving aging/randomized cross-connection `select_next`, typed `overloaded` with bounded `retryAfterMs`) fronts the single credential-hash slot in `kernel/src/cap/credential_store.rs`. The kernel enforces admission bounds and a fair *executor handoff*: anonymous callers take the slot non-blocking and defer while a protected local caller waits, so local recovery/setup is never blocked by anonymous *load* and cannot be starved by anonymous occupancy (the executor lock is unfair, so there is no per-waiter bound against *other* local callers, but local recovery/setup is a trusted, effectively serial operator action); the login path charges each connection's `terminalEventId` token. Residual: the kernel's synchronous inline path runs each admitted anonymous hash to completion under the pool/per-connection bounds, so fine cross-connection *selection* fairness (aging/randomized choice among many waiting anonymous connections) is delivered by the arbiter's `select_next` as consumed by the async admission owner (`webui-public-resource-accounting-admission`), which also supplies real per-browser connection tokens and request deadlines; no local scheduler can promise a per-remote-caller SLA against unbounded indistinguishable Sybils. - [`webui-public-resource-accounting-admission`](https://tasks.cap-os.dev/p/capos/t/webui-public-resource-accounting-admission) owns anonymous/session WebUI admission, consumes the credential executor without a global race, and preserves control progress within the current single-session model; it does not own multi-session coexistence. Landed at the ledger: `WebUiIngressLedger` (the pure host-tested accounted ledger of record — lanes, per-connection bound, aggregate backstop, protected reserve, in-flight byte budget, absolute deadline, reserve-first then work-conserving aging/randomized selection, exact reservation/release, typed `429`/`503` overload) plus the decoupling of the WebUI application-slot, backlog, and release-debt capacities onto independent effective profile fields with boot readback, and the manifest ingress/pre-auth profile binding: `ingress_*` marker caps (lowered from the `#WebUiIngressProfile` CUE schema) that the service parses and resolves fail-closed against the fixed structural maxima into a validated profile of record, read back at boot. The live TLS accept/close serve loop charges each accepted pre-identity connection to that ledger for the connection lifetime. It releases the reservation exactly once: `complete` after a served response, or `cancel` when timeout, close, or error abandons the connection before any response ([`webui-ingress-ledger-live-serve-loop-wiring`](https://tasks.cap-os.dev/p/capos/t/webui-ingress-ledger-live-serve-loop-wiring)). Explicit post-authentication session-budget donation also lands without retroactively charging pre-identity work ([`webui-authenticated-session-budget-donation`](https://tasks.cap-os.dev/p/capos/t/webui-authenticated-session-budget-donation)). The live ledger now derives its profile from the manifest-selected policy and granted protected listeners: disabled lanes lose only their private reserve, while the selected application, byte, per-connection, and retry limits remain binding and are read back as the enforced ledger profile. Backlog policy preserves one outstanding accept per granted listener before arming bounded extra accepts, while release-debt policy binds finished connections before capability release; both publish through the same ledger, with configured and clamped effective values read back separately. Their refusal counters count distinct blocked-entry episodes rather than repeated polling ticks. The broader adversarial coexistence proof remains open in [`webui-ingress-ledger-adversarial-live-matrix`](https://tasks.cap-os.dev/p/capos/t/webui-ingress-ledger-adversarial-live-matrix) while the distinct-listener abuse matrix is implemented in [`webui-multi-lane-abuse-proof-matrix`](https://tasks.cap-os.dev/p/capos/t/webui-multi-lane-abuse-proof-matrix). - [`webui-independent-browser-sessions`](https://tasks.cap-os.dev/p/capos/t/webui-independent-browser-sessions) replaces the one-session singleton. - [`webui-accepted-socket-lifecycle-no-global-quiesce`](https://tasks.cap-os.dev/p/capos/t/webui-accepted-socket-lifecycle-no-global-quiesce) removes per-accept helper churn and shared endpoint pauses. - [`webui-cache-correct-bounded-http-delivery`](https://tasks.cap-os.dev/p/capos/t/webui-cache-correct-bounded-http-delivery) depends on independent browser sessions, owns streaming, route policy, connection reuse, and cache generations, and runs the integrated static/auth/login/control coexistence gate. - [`webui-network-ceiling-benchmark-ladder`](https://tasks.cap-os.dev/p/capos/t/webui-network-ceiling-benchmark-ladder) establishes the local layered evidence contract. - [`network-stack-production-entropy-seeding`](https://tasks.cap-os.dev/p/capos/t/network-stack-production-entropy-seeding) removes the deterministic proof seed from production network-service startup. - [`webui-network-ceiling-real-gce-proof`](https://tasks.cap-os.dev/p/capos/t/webui-network-ceiling-real-gce-proof) runs the final private-provider proof only after those local dependencies and fresh explicit authorization. - [`cloud-gce-public-webui-readiness-preflight-extension`](https://tasks.cap-os.dev/p/capos/t/cloud-gce-public-webui-readiness-preflight-extension) makes the later public harness reject missing or non-ancestor readiness closeouts before any provider command. Public Internet ingress remains blocked behind the independent-session, real-GCE closeout, and no-spend readiness-preflight tasks. A provider firewall or peer CIDR can narrow transport reachability, but it does not close the application admission, accounting, or multi-user availability gaps.