# K1061–K1080 bounded thread waits This new crate prepares host contracts and tests. It accepts no guest move. The actual continuation, IRQ, clock, stack and return proofs require canonical K1060 and a later source-bound K1080 overlay. Existing crates remain frozen. ## Ownership and observations `WaitSet` exclusively owns its backend, at most eight wait records, and every nonclone source pin, staged context handoff and frozen `threads::Wait`. An internal checked identity distinguishes independent sets. Constructor errors return the exact backend. Slot generation exhaustion permanently retires the slot. Handles contain set identity, slot and generation and cannot be used to wake a replacement waiter. An independent bounded `Ingress` owns a producer observation authority. Its IRQ operation reads the actual CPU, DAIF, source epoch, producer sequence, condition and clock before writing private bounded event metadata. It never borrows `WaitSet`, the thread table, context bank, allocator, heap, or runtime. It retains the producer's actual source ownership. Full ingress refuses before consuming producer progression. Its checked loss counter counts each distinct observed producer sequence refused while full once; retrying the same sequence does not count another loss. Clock/sequence regression is rejected, including full retries and the successive actual producer/backend clock observations. The architecture invokes a pure context gate before forming a raw mutable ingress or set loan. Each API repeats the actual immutable backend or producer observation. Caller supplied Task, IRQ, time, source epoch or current thread is never authority. Task mutations require the owning CPU and masked IRQs. ## Coordination with the frozen context and thread modules | Phase | Actual ownership and allowed operation | | --- | --- | | Armed | Both signal and deadline links published under the bounded masked guard; source and thread pins retained. | | Staged | `AsyncBank::sleep_to` has prepared while the frozen thread table still says Running. The actual Prepared remains retained. | | Departed | Backend departure performs the frozen table sleep and keeps its exact nonclone `threads::Wait`; no Rust set/bank loan spans assembly. | | Sleeping | Actual target landing has closed the handoff. Task service may claim one winner. | | Terminal | One outcome removed both links. Safe retirement consumes actual handoff/wait custody and source pins once. | | Quarantined | A possible transition or failed rollback retains every actual token and blocks release. | Before departure, actual producer sequence and condition are checked again. An early signal aborts the real Prepared before changing the thread table. After departure, task service refuses until actual landing closes the handoff; IRQ only records bounded producer events. This prevents lost wake and the invalid order of sleeping the table before `ContextBank::sleep_to` validates a Running source. `WaitTransfer` is nonclone lookup authority. Pins, Prepared and the frozen wait token stay inside the set/backend. Departure returns the transfer after the mutable loan ends; arrival receives it under a fresh actual context gate. No callback may run through a dead thread record. Cancellation resolves the exact sleep episode and does not permit stack or source release before safe retirement. ## Winner and failure rules Signal and timeout use actual producer and clock observations. An observed signal at the exact deadline wins over timeout when neither has committed. The first successful winner removes both links; later service cannot deliver a second completion. Service commits each wait independently. If a later record fails, earlier Terminal records and the winner count remain queryable; each original token retires its one outcome. An error makes no atomic rollback claim across independent waits. Cancelling one waiter leaves all other records and producer progression intact. Failures before a backing acquisition or context transition preserve the complete inventory. Failed releases return the exact owned token. Any uncertain departure/landing/resolve or rollback stores the real still-owned resources in quarantine; an error never drops them or reports completion. Host tests must link the actual frozen Threads and AsyncHandoff implementations and cover stale/foreign handles, same-channel reuse, early producer progression, same-tick signal/timeout, independent cancellation, capacity and generation exhaustion, actual IRQ/CPU gates, and error custody. Compiling mutants must demonstrate those checks matter. A host trace remains HOST_PREPARED.