feat(frame): an occupant of a place is handed a core, and finds a stack four pages wide

[dimmus]

Increment 6 of E1-B05: the decision, the mechanism, and the wall the mechanism found.

Read the last section before the code if you read nothing else — the gate this increment was written against is not met, deliberately, and the branch says so rather than rounding up.

What this is

kernel/src/runtime.rs has carried this sentence since RFC 0033:

there, a component is spawned into a place and never scheduled; here, a component is scheduled and never spawned into one.

The first half is now false. The supervisor's occupant is handed a core and enters ring 3 under its own address space on every boot. That is the first time any occupant of a place has executed.

RFC 0075 — the decision, made before the code

op::SPAWN/op::STOP landed in #44; this is the other half of the join. The plan said to make an Instance produce a process::Prepared, since the scheduled path already knows how to run one of those.

That is a double free. reap returns Prepared::pages to the FrameAllocator and checks them against the free count recorded in Prepared::before. An occupant's pages were derived from one supplied Untyped and are owed back to that account by tear_down. An Instance::into_prepared would be a value whose only purpose is to be handed to a function that must never see it, with nothing in the type system saying so — and it would quietly falsify RFC 0008's sentence that revoking the account ends the component.

What the code actually needs turned out to be much smaller: smp::run_on does not take a process. It publishes a Job { root, entry, stack, argument, hz, target } into a per-CPU slot. Six fields, every one of which an Instance has.

So: one scheduling interface, two ownership records. Job is what a core needs; Prepared and Instance differ in who is owed the memory; both build a Job, neither becomes the other. Two alternatives are recorded with why they lost — an account-aware reap (one name for two return disciplines, where Failure::Leaked exists precisely because the frame checks what it built against what it gave back) and a fourth Plan (the three that exist differ by how a run is judged, and an occupant has no verdict yet).

Two things the RFC did not anticipate, both found by running it

Writing Job alone is not scheduling. A core entering ring 3 runs against five per-core shards. A component given only a job runs against whatever the previous occupant left behind — which is how the first version handed the supervisor a core and watched it not execute. State, IN_RING3, the four arm_entries counters and Outcome are written beside it now.

The capability table is per-core, not per-instance. cap::of(cpu) is what a running component's calls resolve against; an Instance holds its own only while dormant. Importing a table built elsewhere breaks the generation arithmetic f_abi::door::Entry::granted rests on, and it broke it in exactly the way prepare_runtime's comment predicts:

init process  core 1, 3 call(s) answered, 1 refused, ended with status 5

So the excursion is made invisible: the core's previous table is restored afterwards, and only the occupant's own keeps what it derived. cap::Table's comment warns that a table copied by value is a second authority that can drift from the first — this is a swap, never two live copies, and the restore is what keeps it one.

A sibling session had reported two boots of one unchanged binary disagreeing — green once, status 5 the next. That was this. cargo xtask trace no longer reproduces it.

The wall: a four-page stack

The occupant dies on its first instruction, and this is the finding rather than a regression.

occupant  killed: exception 14 at 0x0000000000410ff8, error 0x6, rip 0x0000000000400000

0x415000 - 0x410ff8 is 0x4008 — the whole four-page stack plus eight bytes, a frame's stack probe walking down and stepping one word past the end. The guard page caught it exactly as designed: the fault is at SPAWN_GUARD, not in somebody else's memory.

Nothing had ever executed through the spawn path before this branch. user/init is a flat image on another path; a runtime comes from prepare_runtime. So SPAWN_STACK_PAGES = 4 had never been tested by anything except arithmetic.

Raising it is a cross-crate move and not a constant. Every spawn address above the stack derives from it, and three compile-time assertions pin them to constants owned elsewhere — SPAWN_HEAP against f_ring::heap::AT, BLK_BOARD against the block and network drivers' routing::AT. 4 -> 8 does not build:

assertion failed: SPAWN_HEAP == f_ring::heap::AT
the frame and the network driver disagree about where the routing page is

The tree refusing a layout change made in one place is the tree working. That finding is written beside the constant with the fault line, so the next reader meets it where it matters rather than in this description.

What a reviewer should know

The gate is not met and nothing here claims it is. HEAP_GAP's needle is still in kernel/src/runtime.rs and the boot still reports peak 0 byte(s), because the component dies before it allocates. intent/0005-the-datapath/plan-e1-b05.md records that rather than the outcome it predicted — a plan that only says what it intended is one nobody can use to find out what it cost.

The boot reports how the occupant ended rather than asserting it. A boot that hands over a core and says only that it did so cannot tell the component ran from a core was told to run it — which is the difference three wrong diagnoses of peak 0 turned on. Hence the occupant killed: … line naming exception, address and rip.

CHAOS_GAP is untouched. Its needle is prepare_driver( and it closes when a driver is scheduled inside its place, which this makes possible and does not do. E1-P06's remaining half stays open.

Evidence

• cargo xtask verify — verify: all green, exit 0
• cargo xtask trace — agrees on the pair that must agree, disagrees on the mutated control that must not
• cargo xtask run — reaches M0 ok; init process core 1, 4 call(s) answered, 0 refused, ended with status 0

Three failures the gate found before this was committed, each a real defect in my own diff: a SAFETY: comment orphaned from its unsafe block by an inserted line — twice, and an orphaned safety comment reads as discharged when nothing checked it, which is why the lint treats it as absent — and a needless_borrow.

🤖 Generated with Claude Code