# K1331 — handle transfer through a message

`TransferTable` models a kernel-mediated move of a typed, generation-tagged
handle with a copied message. The sender owns a live handle to a kernel-minted
object. `send_from` checks the sender and source generation, recipient identity,
rights subset, message limit, queue capacity and ticket overflow, then copies
the payload into private kernel storage. Only after the copy succeeds does it
remove the sender's live entry and publish one escrow record. The sender's old
handle immediately becomes `BadFd`; the escrow retains the object and
requested rights while the message is queued. No user pointer is retained.

`receive` permits only the designated recipient. It checks that a live handle
slot and a fresh generation are available before changing any state. It then
creates the recipient's handle, consumes exactly one FIFO message and escrow
record, and returns the copied bytes, ticket, object and attenuated rights.
A read-only `peek` lets a kernel adapter write the copied bytes to user memory
before committing receive, so a bad destination pointer does not consume the
transfer.
A foreign receiver gets `Access`; no free slot or generation overflow leaves
the queued transfer intact for a later retry. Closing the recipient handle
releases the final live reference in this isolated model. The kernel adapter
must bind process identifiers to live process generations and use
kernel-minted object names.

All denied operations and failed partial user copies leave the full handle,
generation, escrow and queue snapshot unchanged. The local gate tests a
successful cross-process move, stale sender rejection, rights attenuation,
FIFO and capacity boundaries, and a fault mutant that ignores a failed copy.
K1335 requires native EL0 execution over six direct/UEFI QEMU profiles on a
single experimental Image. This model does not claim channel transport
between arbitrary devices, a blocking scheduler wake, or product acceptance.