BONE/SEA S7: measure the actual-core allocation envelope under the S2 arena

[Deadbytes101]

BONE/SEA S7 ACTUAL-CORE ALLOCATION ENVELOPE CANDIDATE

STACKED BASE

• base branch: ecosystem/shinesea-s6-namespace-readback
• exact parent head: 7cb0adf092b027a19d1bffb8a8a5e6c7dbeec4c7
• exact S7 head: 9820e3cbedb6f73a271c3d7880c127812c360fdb
• exact N6 authority: 93ea5ffb59ff31e87ab7fd5ecb5570c89b29ffee
• N6 nano SHA256: 581d1a6c59580fedca7fca97035449521231f9450ca4a3c2cf35d6ed07640855
• exact SHINESEA v1.0.0 source: 3bc6343ecaeae27f0d01c6301cab01a0e77bfb96

PURPOSE

S7 measures requested-live allocation pressure while the actual frozen SHINESEA read_verified_image implementation mounts the exact S1 image through the shared S3 sector adapter.

The success path is hard capped at the exact S2 allocator arena authority:

• region: 0x40000..0x80000
• bytes: 262144

This is host allocation-envelope evidence. It is not an N6 allocator implementation or runtime allocator PASS.

OBSERVED WINDOWS VALIDATION

Exact head:

9820e3cbedb6f73a271c3d7880c127812c360fdb

Observed with RUSTFLAGS=-Dwarnings:

• native library target: 0 / 0 PASS
• S1 contracts: 13 / 13 PASS
• S2 domain contracts: 14 / 14 PASS
• S2 control contracts: 6 / 6 PASS
• S3 adapter contracts: 15 / 15 PASS
• S4 orchestrator contracts: 7 / 7 PASS
• S5 orchestrator contracts: 7 / 7 PASS
• S6 orchestrator contracts: 8 / 8 PASS
• S7 orchestrator contracts: 8 / 8 PASS
• total defined tests: 78 / 78 PASS
• compiler warnings: 0
• exact S1 deterministic image and payload hashes: PASS
• inherited shared S3 release verifier: PASS
• actual SHINESEA no_std + alloc mount through shared S3 adapter: PASS
• arena authority bytes: 262144
• peak requested-live bytes: 139264
• requested-live bytes at publication: 66955
• arena headroom: 122880
• allocation calls: 29
• deallocation calls: 24
• reallocation calls: 0
• final requested-live bytes after drop: 0
• exact sector transfers: 144
• low-budget bytes: 65535
• low-budget peak: 16384
• full image allocation at 65536: REJECTED
• low-budget transfers: 16
• write authority: DISABLED
• temporary GPL driver removed on exit
• runtime allocator PASS emitted: no

MEASUREMENT BOUNDARY

A temporary GPL-2.0-or-later driver installs a process-global quota allocator backed by std::alloc::System. The quota window opens immediately before actual read_verified_image and closes only after the returned VerifiedDeviceImage is dropped.

The observed peak uses 53.125% of the arena authority and leaves 46.875% headroom.

EXPLICIT EXCLUSIONS

The measurement does not include allocator metadata, heap headers, alignment padding introduced by System, fragmentation, pre-existing driver/device buffers, or actual N6 allocator behavior. Therefore this remains requested-live-byte evidence only.

LOW-BUDGET ADVERSARY

Under a quota of 65535 bytes, the superblock probe completes with exactly 16 sector transfers, the declared 65536-byte image allocation is denied, the full-volume read never starts, and live accounting returns to zero.

BUILD AND LICENSE BOUNDARY

• tools/bone-sea/src/bin/bone-sea-s7.rs: Apache-2.0 orchestrator
• tools/bone-sea/s7/driver.rs: GPL-2.0-or-later temporary allocation driver
• exact SHINESEA no_std core and exact BONE/SEA library compiled as separate rlibs with rustc, panic=abort, and -Dwarnings
• no Cargo dependency from the orchestrator to SHINESEA
• combined driver retained: no
• committed binary: no
• CI artifact: no
• public combined release: not authorized

RUNTIME BOUNDARY

Allocator metadata high-water, exact arena offset consumption, N6 allocator integration, real ATA, N6 I/O gate execution, CPU RIGHT_IO enforcement, ring3 execution, runtime PASS, and write authority remain unclaimed.

MERGE LAW

S7 is ready for review against exact S6 head. Merge is not performed automatically. Keep it stacked until prior PR disposition is deliberate; any retarget or integration into another tree requires fresh exact-head verification.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.

[Deadbytes101]

BONE/SEA S7 CURRENT VALIDATION GATE

Exact current head:

9820e3cbedb6f73a271c3d7880c127812c360fdb

Exact stacked parent:

7cb0adf092b027a19d1bffb8a8a5e6c7dbeec4c7

The release identity patch commit 7b1a41e1b2c6616566882ff94b9dc3918e996581 is an ancestor of the current head. The current head additionally contains the S7 documentation, license notice, and warning-denial workflow.

Required Windows evidence:

• RUSTFLAGS=-Dwarnings
• all native targets: expected 78 / 78 PASS
• exact S1 deterministic proof: PASS
• inherited shared S3 release verifier: PASS
• S7 actual-core allocation driver: compiles and executes
• peak requested-live bytes: non-zero and <= 262144
• live bytes at publication: non-zero and <= peak
• arena headroom: exactly 262144 - peak
• quota denials on success: 0
• final requested-live bytes after drop: 0
• valid composed sector transfers: 144
• low-budget quota: 65535
• low-budget result: AllocationFailed { bytes: 65536 }
• low-budget sector transfers: 16
• low-budget final requested-live bytes: 0
• write authority: DISABLED
• temporary GPL driver removed on exit
• runtime allocator PASS emitted: no

GitHub connector currently exposes no workflow run for this head. Keep PR #39 draft until exact Windows evidence is attached.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.

[Deadbytes101]

S7 EXACT-HEAD WINDOWS EVIDENCE — PASS

Exact observed head:

9820e3cbedb6f73a271c3d7880c127812c360fdb

Observed with RUSTFLAGS=-Dwarnings:

• native library target: 0 / 0 PASS
• S1 contracts: 13 / 13 PASS
• S2 domain contracts: 14 / 14 PASS
• S2 control contracts: 6 / 6 PASS
• S3 adapter contracts: 15 / 15 PASS
• S4 orchestrator contracts: 7 / 7 PASS
• S5 orchestrator contracts: 7 / 7 PASS
• S6 orchestrator contracts: 8 / 8 PASS
• S7 orchestrator contracts: 8 / 8 PASS
• total defined tests: 78 / 78 PASS
• compiler warnings: 0
• exact S1 deterministic proof: PASS
• inherited S3 release verifier: PASS
• actual SHINESEA no_std + alloc core through shared S3 adapter: PASS
• arena authority: 262144 bytes
• peak requested-live bytes: 139264
• requested-live bytes at publication: 66955
• arena headroom: 122880
• allocation calls: 29
• deallocation calls: 24
• reallocation calls: 0
• final requested-live bytes after drop: 0
• sector transfers: 144
• low-budget authority: 65535
• low-budget peak: 16384
• declared image allocation: 65536, REJECTED
• low-budget sector transfers: 16
• write authority: DISABLED
• temporary combined driver removed on exit
• runtime allocator PASS emitted: no

The observed peak uses 53.125% of the 262144-byte authority and leaves 46.875% headroom. Accounting remains requested-live bytes only; allocator metadata, alignment padding, fragmentation, and actual N6 allocator behavior remain outside this claim.

S7 gate is satisfied on the exact stacked head. No merge is performed automatically.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.