# Service registry wire protocol V1 (K1386–K1390)

The registry process owns a bounded `Registry<N>` and its name grants. The
process boundary supplies the caller's authenticated `PublisherId`; bytes in a
request cannot choose or replace it. A failed request leaves the registry,
grants, resource count, and response buffer unchanged.

## Frame and operations

The eight-byte header is `"SR"`, version `1`, kind, little-endian `u16`
payload length, and two zero flags bytes. A frame has exactly the declared
length and at most 33 payload bytes. Kinds `1` and `2` are publish and
unpublish requests. Their payload starts with a one-byte name length (1–24)
and the lowercase ASCII service name. Publish adds a little-endian `u64`
endpoint. Unpublish has no endpoint. A publish endpoint must be nonzero.

A successful response is exactly 17 bytes: the same magic and version,
response kind `0x81` or `0x82`, payload length `9`, zero flags, status `0`,
and the little-endian endpoint that was published or released. The caller
provides at least 17 bytes of response space before a registry operation is
attempted. The implementation performs no fallible work after mutation.

## State and errors

Publish changes only the caller's vacant granted name to a bound endpoint.
Unpublish changes only the caller's bound name to vacant. A malformed frame,
unsupported version (including V255), truncated header or payload, wrong
kind, invalid name, denied ownership, occupied name, absent binding, invalid
endpoint, or short response buffer returns `WireError` without a state change
or response write. `WireError::Registry` carries the name ownership error.
The decoder uses checked slices and fixed storage; it has no `unsafe` block.

K1388 tests the V1 publish response and unpublish response, full registry
state, and resource count. K1389 tests V255, every truncated header prefix,
truncated and oversized payloads, flags, wrong kind, insufficient response
space, foreign caller, and successful recovery after rejection. The V1
version guard is subject to a mutation test. K1390 still requires a real
guest process rejection and six-profile development matrix; local tests do
not establish product integration.