# Bounded process table preparation

This new module prepares K1101–K1119. K1105/K1110/K1115/K1120 remain pending actual guest integration after K1100. No EL0 execution, general process scheduler or product acceptance is claimed.

The table exclusively owns its backend and every partial or published resource bag. A bag retains actual thread, address-space and frame-handle owners. Read-only observations use the frozen ThreadId, Spaces Handle and Registry Handle types; they cannot create those identities. The unsafe backend must derive observations from its retained owners and actual CPU/IRQ execution. Host tests label simulated CPU, mappings and hardware operations explicitly.

ProcessId contains a private table identity, slot and generation. A nonclone reservation identifies one hidden construction episode. Generation changes only on successful publication; failed preparation does not consume a PID generation. Reservation episodes never repeat. Hidden construction and quarantine entries are absent from published PID lookup and public process enumeration. Forgetting a reservation retains its actual bag and blocks slot reuse.

The first process is created only by the actual kernel bootstrap context. Child creation, termination and wait derive parent authority from the backend's actual current process, binding the entire parent identity. A foreign parent cannot collect or terminate a child. Child results are delivered once, after actual Dead state and successful full resource retirement. Address spaces, frame handles and thread identities cannot overlap another retained bag.

Preparation failures return a reservation. The table attempts to retire every returned partial bag. Failed retirement retains the exact bag in quarantine. A pure Before failure during publication keeps the prepared bag and receipt unchanged. An After failure, a changed CPU observation or an inconsistent success retains the bag in quarantine; no PID becomes public. Successful publication requires complete image and stack ownership before the backend enqueues its actual thread, and a matching fresh published observation afterward.

Every mutating operation checks the table's actual CPU, masked IRQ state and absence of IRQ context before touching resources. Backend callbacks are short loans; this module never switches stacks or executes assembly while borrowing its table. A backend's Before error guarantees no mutation. After errors may retain hardware uncertainty. No backend resource may be silently released by Drop. Table Drop deliberately retains its backend and bags; release is explicit and checks that every slot is vacant.

Explicit resource retirement repeats the CPU gate and compares the complete execution observation after the callback. A callback that successfully retires backing but changes CPU, IRQ mask or current process leaves an empty quarantined logical slot: no result is delivered and no PID is reused. This case does not claim the already returned bag remains owned.