# K1311 — rights attenuation on duplicate

This version extends the generation-tagged K1310 handle table in a separate
source snapshot. Isolated K1315 Image builds copy it into
`kernel/src/runtime/handles.rs`; the frozen root kernel source is untouched.

Every entry has a type, owner process generation, slot generation, object ID,
and rights. `READ` and `WRITE` are the only rights in this phase. A File may
have either or both. File read requires `READ`; File write requires `WRITE`.
Channel send requires `WRITE`; Task inspect requires `READ`. A typed lookup
with the wrong object kind returns `BadFd` (`EBADF`) before checking rights.
An operation on the right type without the required right returns `Access`
(`EACCES`). Neither failure changes the table or the underlying object.

`duplicate(owner, source, requested)` creates a second entry for the same
object and owner only when the source is live and `requested` is a nonempty
subset of its rights. The original entry is unchanged. Capacity and the
destination slot generation are checked before publishing the copy. A request
to widen rights, including RO→RW, returns `Access` without consuming a slot
or incrementing a generation. A foreign or stale source returns `BadFd`.
Failed duplication cannot leave a partially acquired reference.

Positive evidence opens one RW File and duplicates an RO handle. Both can
read; only the original can write. The complete snapshot has two entries,
the same object ID, the same owner and distinct generations/slots. Negative
evidence requests RW from the RO copy, checks `Access` and an identical
before/after snapshot, then confirms the original RW and copied RO handles
still work. Local tests and a widening mutant precede K1315 native EL0
acceptance across direct/UEFI 256/512/1024 MiB profiles.