# K1361–K1364 shared page object contract

An owner creates a fixed two-page object backed by two distinct page frames.
The owner may grant one named recipient a generation-bound handle. Acquiring a
grant checks the caller identity against that named recipient and checks the
object generation before publishing any holder state. A process that has no
acquired handle cannot map either page. Mapping by the owner and recipient
returns the same backing frame identity for each page.

The kernel adapter must bind process identities to live generations, validate
the actual physical frames and page table permissions, and enforce the handle
table boundary. This model does not implement a page table. An unauthorized C
acquiring B's handle, forging C's own handle, or attempting a map is rejected
with `Access` without changing grants, mappings, or frame ownership. Invalid
page indexes and stale generations are rejected before any mapping is
published. Revocation removes the recipient mappings; close removes every map.

The K1365 guest gate requires the same Image across direct/UEFI 256, 512,
and 1024 MiB profiles, plus source, Image, fixture, serial, QMP and ownership
hashes. The local model alone is not product acceptance.