BONE/SEA S8: mount the actual core inside one fixed S2-sized arena

[Deadbytes101]

BONE/SEA S8 FIXED-ARENA ACTUAL-CORE CANDIDATE

STACKED BASE

• base branch: ecosystem/shinesea-s7-allocation-envelope
• exact parent head: 9820e3cbedb6f73a271c3d7880c127812c360fdb
• exact S8 head: 39a1190a124017d0a7a7cb3ec869f23de19755f4
• exact N6 authority: 93ea5ffb59ff31e87ab7fd5ecb5570c89b29ffee
• N6 nano SHA256: 581d1a6c59580fedca7fca97035449521231f9450ca4a3c2cf35d6ed07640855
• exact SHINESEA v1.0.0 source: 3bc6343ecaeae27f0d01c6301cab01a0e77bfb96

PURPOSE

S7 proved the requested-live allocation envelope while std::alloc::System still backed successful allocations.

S8 removes System from the active mount window. The actual frozen SHINESEA read_verified_image implementation mounts the exact S1 image through the shared S3 sector adapter using one fixed static buffer equal to the S2 arena authority:

• region: 0x40000..0x80000
• bytes: 262144

This remains host/freestanding allocator-model evidence. It is not the N6 runtime allocator and is not a runtime PASS.

OBSERVED WINDOWS VALIDATION

Exact head:

39a1190a124017d0a7a7cb3ec869f23de19755f4

Observed with RUSTFLAGS=-Dwarnings:

• native library target: 0 / 0 PASS
• S1 contracts: 13 / 13 PASS
• S2 domain contracts: 14 / 14 PASS
• S2 control contracts: 6 / 6 PASS
• S3 adapter contracts: 15 / 15 PASS
• S4 orchestrator contracts: 7 / 7 PASS
• S5 orchestrator contracts: 7 / 7 PASS
• S6 orchestrator contracts: 8 / 8 PASS
• S7 orchestrator contracts: 8 / 8 PASS
• S8 orchestrator contracts: 8 / 8 PASS
• total defined tests: 86 / 86 PASS
• compiler warnings: 0
• exact S1 deterministic image and payload hashes: PASS
• inherited shared S3 release verifier: PASS
• actual SHINESEA no_std + alloc mount through shared S3 adapter: PASS
• static arena bytes: 262144
• peak requested-live bytes: 139264
• peak arena high-water: 139264
• requested-live bytes at publication: 66955
• arena high-water at publication: 77104
• arena headroom: 122880
• maximum observed alignment: 8
• allocation calls: 29
• deallocation calls: 24
• reallocation calls: 0
• System calls during complete active window including drop: 0
• final requested-live bytes: 0
• final arena high-water: 0
• final live records: 0
• exact sector transfers: 144
• deterministic first-fit reuse: PASS
• implicit adjacent-gap coalescing: PASS
• low-budget arena bytes: 65535
• low-budget high-water: 16384
• declared image allocation at 65536: REJECTED
• low-budget transfers: 16
• write authority: DISABLED
• temporary GPL driver removed on exit
• N6 runtime allocator PASS emitted: no

FIXED ARENA LAW

• static buffer bytes: 262144
• base alignment: 4096
• algorithm: deterministic first fit
• active records: sorted static table, maximum 256
• freed records expose directly reusable gaps
• adjacent free gaps are implicitly coalesced during first-fit scanning
• metadata is static storage outside the arena
• System allocator inside active window is forbidden
• absolute-address alignment is enforced
• alignment and fragmentation are included in arena high-water

SELF-TEST REPAIR HISTORY

The original exact head 2aeb49218c5d055d0fa8d307e9a66a26fe8ec6c8 compiled and passed all 86 / 86 static tests but failed before the actual-core mount at the combined reuse/coalescing self-test.

The repair at 39a1190a124017d0a7a7cb3ec869f23de19755f4 changed only tools/bone-sea/s8/driver.rs:

• the allocator implementation in arena.rs was unchanged;
• the policy self-test now invokes the same GlobalAlloc implementation directly;
• the actual SHINESEA mount still exercises the process-global allocator path;
• adversarial diagnostics were added for every self-test predicate.

The repaired exact head then passed reuse, coalescing, actual-core mount, zero-System-call, low-budget, and final-empty gates.

BUILD AND LICENSE BOUNDARY

• tools/bone-sea/src/bin/bone-sea-s8.rs: Apache-2.0 orchestrator
• tools/bone-sea/s8/arena.rs: GPL-2.0-or-later temporary allocator model
• tools/bone-sea/s8/driver.rs: GPL-2.0-or-later temporary actual-core driver
• exact SHINESEA no_std core and exact BONE/SEA library compiled as separate rlibs with direct rustc, panic=abort, and -Dwarnings
• no Cargo dependency from the orchestrator to SHINESEA
• combined executable retained: no
• committed binary: no
• CI artifact: no
• public combined release: not authorized

RUNTIME BOUNDARY

Actual N6 allocator integration, allocator metadata inside the S2 arena, execution at physical address 0x40000, real ATA, N6 I/O gate execution, CPU RIGHT_IO enforcement, ring3 execution, runtime PASS, and write authority remain unclaimed.

MERGE LAW

S8 is ready for review against exact S7 head. Merge is not performed automatically. Keep it stacked until prior PR disposition is deliberate; any retarget or integration into another tree requires fresh exact-head verification.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.

[Deadbytes101]

S8 CURRENT-HEAD VALIDATION GATE

Exact draft head:

2aeb49218c5d055d0fa8d307e9a66a26fe8ec6c8

Exact stacked parent:

9820e3cbedb6f73a271c3d7880c127812c360fdb

Required Windows validation with RUSTFLAGS=-Dwarnings:

• native library target: 0 / 0
• S1 contracts: 13 / 13
• S2 domain contracts: 14 / 14
• S2 control contracts: 6 / 6
• S3 adapter contracts: 15 / 15
• S4 orchestrator contracts: 7 / 7
• S5 orchestrator contracts: 7 / 7
• S6 orchestrator contracts: 8 / 8
• S7 orchestrator contracts: 8 / 8
• S8 orchestrator contracts: 8 / 8
• total defined tests: 86 / 86 PASS
• compiler warnings: 0

The actual S8 driver must additionally prove:

• actual SHINESEA no_std + alloc core through the shared S3 adapter;
• exact 144 sector transfers;
• deterministic first-fit reuse: PASS;
• adjacent-gap implicit coalescing: PASS;
• peak requested-live bytes nonzero;
• peak arena high-water nonzero and <=262144;
• arena headroom exactly 262144 - peak arena high-water;
• System calls during the complete active window including publication drop: 0;
• final requested-live bytes: 0;
• final arena high-water: 0;
• final live records: 0;
• low-budget high-water nonzero and <=65535;
• AllocationFailed { bytes: 65536 } after exactly 16 probe-sector transfers;
• temporary driver removed on exit;
• no N6 runtime allocator PASS claim.

The GitHub connector currently exposes no workflow run for this head. Keep PR #40 draft until observed exact-head evidence is attached.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.

[Deadbytes101]

S8 WINDOWS FAILURE EVIDENCE — OLD HEAD

Exact tested head:

2aeb49218c5d055d0fa8d307e9a66a26fe8ec6c8

Observed:

• RUSTFLAGS=-Dwarnings
• native defined tests: 86 / 86 PASS
• compiler warnings: 0
• exact S1 deterministic image: PASS
• inherited S3 release verifier: PASS
• S8 temporary driver build: PASS
• S8 allocator policy self-test: FAIL
• terminal: BONE/SEA S8 DRIVER ERROR: fixed arena reuse/coalescing proof failed
• actual-core fixed-arena mount reached: no
• fixed-arena PASS claim: no

CLASSIFICATION

The combined self-test error currently conflates six possible gates: allocator start/end, middle-span reuse, adjacent-gap coalescing, final live-byte state, final record state, and System-call count. The mathematical first-fit sequence should reuse offsets 4096 and 0, but the current output does not expose which observed condition differed on Windows.

ONE DECISION

Do not change allocator semantics from this report alone. Repair the self-test boundary so it invokes the exact GlobalAlloc implementation directly, while the subsequent actual SHINESEA mount continues to exercise process-global allocation dispatch. Add bounded diagnostics for every self-test predicate. Any new branch head requires fresh exact-head Windows evidence.

PR remains draft. No merge.

[Deadbytes101]

S8 SELF-TEST ISOLATION REPAIR

Current exact branch head:

39a1190a124017d0a7a7cb3ec869f23de19755f4

Parent tested failure head:

2aeb49218c5d055d0fa8d307e9a66a26fe8ec6c8

SURGICAL DELTA

Only tools/bone-sea/s8/driver.rs changed (+33 / -13). arena.rs, the first-fit algorithm, record table, alignment law, shared S3 adapter, SHINESEA source, config, docs, and workflow are unchanged.

The policy-only reuse/coalescing test now invokes GlobalAlloc::alloc/dealloc on ARENA_ALLOCATOR directly. This isolates the deterministic allocator algorithm from process-global dispatch and ambient runtime behavior.

The actual SHINESEA fixed-arena mount remains unchanged and still uses the process-global allocator path, so S8 cannot pass unless real Vec allocations from read_verified_image are served by the static arena.

New bounded failure output exposes:

• allocator end result;
• initial allocation validity;
• exact reuse verdict;
• exact coalescing verdict;
• all five pointer addresses;
• final requested bytes and high-water;
• live records;
• allocation/deallocation counts;
• denials;
• System calls.

REVALIDATION LAW

Old-head evidence cannot prove the repaired head. Required exact head is 39a1190a124017d0a7a7cb3ec869f23de19755f4; all 86 defined tests, S1, inherited S3, and S8 release proof must be rerun with RUSTFLAGS=-Dwarnings.

PR remains draft. No merge. No S9.

[Deadbytes101]

BONE/SEA S8 EXACT WINDOWS PROOF — PASS

Exact head:

39a1190a124017d0a7a7cb3ec869f23de19755f4

Observed with RUSTFLAGS=-Dwarnings:

• native library target: 0 / 0 PASS
• S1 contracts: 13 / 13 PASS
• S2 domain contracts: 14 / 14 PASS
• S2 control contracts: 6 / 6 PASS
• S3 adapter contracts: 15 / 15 PASS
• S4 orchestrator contracts: 7 / 7 PASS
• S5 orchestrator contracts: 7 / 7 PASS
• S6 orchestrator contracts: 8 / 8 PASS
• S7 orchestrator contracts: 8 / 8 PASS
• S8 orchestrator contracts: 8 / 8 PASS
• total defined tests: 86 / 86 PASS
• compiler warnings: 0
• exact S1 deterministic image and payload hashes: PASS
• inherited shared S3 release verifier: PASS
• exact SHINESEA no_std + alloc mount through shared S3 adapter: PASS
• arena backing: static 262144-byte buffer
• peak requested-live bytes: 139264
• peak arena high-water: 139264
• requested-live bytes at publication: 66955
• arena high-water at publication: 77104
• arena headroom: 122880
• maximum observed alignment: 8
• allocation calls: 29
• deallocation calls: 24
• reallocation calls: 0
• System calls during complete active window including drop: 0
• final requested-live bytes: 0
• final arena high-water: 0
• final live records: 0
• exact sector transfers: 144
• deterministic first-fit reuse: PASS
• implicit adjacent-gap coalescing: PASS
• low-budget arena bytes: 65535
• low-budget high-water: 16384
• declared image allocation at 65536: REJECTED
• low-budget transfers: 16
• write authority: DISABLED
• temporary GPL driver removed on exit
• N6 runtime allocator PASS emitted: no

The previous S8 failure on 2aeb49218c5d055d0fa8d307e9a66a26fe8ec6c8 was isolated to the allocator policy self-test harness. Commit 39a1190a124017d0a7a7cb3ec869f23de19755f4 changed only that harness to exercise the same GlobalAlloc implementation directly and emit adversarial diagnostics; the allocator algorithm itself was unchanged.

S8 is ready for review against exact S7 head. Do not merge automatically. Any retarget or integration requires fresh exact-head verification.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.