# Wait and three-member Queue services preparation

This new source set links the exact frozen WaitSet, Threads, ContextBank,
AsyncBank, CompletionBank and ReturnQueue APIs. It accepts no numeric move,
kernel ELF, VM, assembly, physical source, timer IRQ or register measurement.
Host CPU, DAIF, roots, clock, source progression and continuation witnesses are
MODELED_ONLY. Canonical K1060 remains required before a future guest overlay.

WaitGuestBridge exclusively owns the three actual Queue members and their
Context/Table bindings and stacks. No member retirement or mutable backend
escape is exposed. Each wait registers its exact member and retains a nonclone
source authority Pin; the Queue continues to own all actual bindings/backing.
The registration never claims to be a new central memory lease.

Stage calls actual Queue.select(Sleeping), retaining the real private selection
and CompletionBank Prepared while Table remains Running. Requested capture must
equal the actual capture service, and requested target must be the actual FIFO
head. Depart uses the same real token and creates the actual nonclone Table Wait
inside the existing backend. Queue.landed closes that real handoff before a
narrow gated callback transfers the Wait into WaitPrepared. This releases the
old single custody field for a second sleeper. The callback's success must prove
the same sleeping ThreadId/wait epoch and the actual token, with full execution
unchanged. A post-landing custody refusal is After and retains the actual Wait
wherever the callback left it and every Queue owner; it cannot undo a handoff.

Before actual arrive, the existing Context backend's logical current remains
None. NEW unsafe WaitContextServices::physical_wait_landing observes actual root,
aligned physical SP on this uniquely owned stack, executed landing PC, whole retained wire/register image and actual
nonce against the retained Image/Prepared. CompletionBank performs its full pure
CPU/I1/task/FP/safe gate before owner access and ties that callback to its actual
Departed target/binding. The Queue layer binds its actual retained Prepared and
member to the same target. Bridge::execution exposes current only on this fresh
physical callback's success. A desired ThreadId and completed Queue.depart alone
never imply that assembly has landed. Raw old root/SP/nonce/landing frame refuse
without Table activation or token changes. Only then does Queue.landed validate
and close the real full handoff and publish logical current. The transient
expectation is cleared before custody. Host fixture models this split explicitly;
future physical callbacks must supply genuine hardware evidence, not test values.

Resolve consumes the exact retained Wait using Table.wake. Queue publishes Ready
at the FIFO tail only after real wake, unchanged context/thread generation and
wait epoch, and a fresh complete execution observation. Both Context and Queue
short circuit execution drift before any post-callback Table/stack observation.
Before retains the exact token for retry. After quarantines and keeps all
remaining resources; an already consumed real Wait is never claimed retained.

WaitSet provides early signal Prepared abort, same-tick single winner, deadline,
cancellation and generation rules. Retire consumes the source Pin only after
the Prepared is closed and has neither a lookup selection nor a Wait. Failed
release returns the actual pin. Successful release with execution drift retains
the logical claim and Queue bindings in quarantine, while explicitly reporting
that the actual source pin was retired.

IRQ owns a separate bounded Ingress and Producer. wait_guest_irq_poll performs a
pure trusted CPU/mask/IRQ gate before forming a raw mutable ingress reference;
no Queue, Table, WaitSet, allocator or bank pointer is accepted. Producer poll
repeats frozen gates and actual source observations. Architecture must establish
exclusive ingress access after the gate and supply a real architecture reader.
Future assembly uses copied immutable image/nonce metadata after every Rust
set/queue/bank loan has ended, then reacquires a fresh task loan for landing.