# Bounded UTF-8 path components (K1541–K1545)

The resolver accepts at most 256 input bytes and at most 16 retained
components, each no longer than 64 UTF-8 bytes. Input must be valid UTF-8 and
contain no NUL. A leading slash begins at root; a relative path begins at
the current working directory (CWD). Empty input is rejected. Repeated
slashes and `.` leave the current component sequence unchanged. `..` removes
one component; it cannot escape root. A component is stored as bounded bytes,
so Turkish characters retain their original UTF-8 encoding.

Resolution produces a complete candidate path or an explicit error
(`InvalidUtf8`, `TooLong`, `TooDeep`, `AboveRoot`, or `InvalidComponent`).
It borrows no disk sector and owns no DMA frame. `chdir` publishes the entire
resolved path only after validation and checked generation increment. Invalid
UTF-8, an overlong component, a path deeper than 16 components, or an
attempt to climb above root leaves CWD and generation unchanged. The caller
may separately check that a resolved path exists; this contract covers
component parsing and CWD publication only.

K1543/K1544 require absolute and relative Turkish-path tests and negative
UTF-8/depth assertions with a red mutation of the depth guard. K1545 requires
the same product Image to show CWD before/after a failed resolution and an
unchanged service state across direct and UEFI boots at 256, 512, and
1024 MiB. Guest acceptance is a development result until canonical release
criteria are independently met.