# Bounded mount crossing under a process root (K1546–K1550)

A namespace has one process root, a current working directory within that
root, and two immutable mount points with distinct nonzero volume IDs. Mount
points must lie below the process root. Paths remain bounded by the UTF-8,
component-length, and depth limits from K1541–K1545. An absolute path begins
at the process root; a relative path begins at the current directory.

`.` changes nothing. `..` may remove a component only while the candidate
path is deeper than the process root. Attempting to climb above that root
returns `AboveRoot` before mount lookup. After normalization, the longest
matching mount prefix selects a volume. A path outside both mounts returns
`NoMount`; duplicate or outside-root mount definitions are rejected.

`chdir` publishes the whole normalized path and advances its generation only
after UTF-8, root, depth, and mount checks pass. Failed paths leave CWD,
mount definitions, and generation unchanged. The resolver holds no disk or
DMA resource and has no write path. A caller may separately check that the
selected path exists on the mounted filesystem.

Local tests cover navigation from an `alt` directory in one mount through
the process root to an `alt` directory in the second mount, longest-prefix
selection, and a `..` escape attempt. K1550 requires the same product Image
to show the selected volume remains inside the process namespace and an
escape leaves CWD and frame count unchanged across direct and UEFI boots at
256, 512, and 1024 MiB.