# K1316 — last reference closes the object

This snapshot extends the earlier typed, generation-tagged rights table with
a fixed-capacity `SharedObjects` registry. Isolated K1320 Image builds copy
it into `kernel/src/runtime/handles.rs`; the frozen root kernel source stays
unchanged. The previous rights source and its evidence remain immutable.

The kernel creates one resource record for a fresh nonzero object name.
`grant_kernel` may give a second handle to another live process generation,
with rights no wider than the source. Both entries point to one resource
record, whose `refs` equals the number of live handles. Closing either entry
decrements `refs` exactly once. While `refs > 0`, the resource is live. The
last close changes it to Closed and ends its usable lifetime. Without a
waiter, its record is reclaimed immediately. No stale handle can resurrect
it; a new kernel object needs a new name.

A `watch_close` token is nonowning. It can be registered while the caller has
a live handle. `poll_close` returns Pending while the resource is live. If the
last close happens after a Pending poll, the next poll returns Closed exactly
once and consumes the token; the closed tombstone is then reclaimed. This is
the defined result for the “last close during wait” case. It does not leave a
waiter asleep on a destroyed object. A foreign or consumed wait token returns
`BadFd`. Watch creation, grant, and open check capacity, generation and ID
overflow before publication. Every failed operation leaves the complete
entry/resource/waiter snapshot unchanged.

Positive evidence uses two actual process identities with two references to
one object. Closing the first leaves one live resource and a healthy second
handle. Closing the second ends the resource lifetime. Negative evidence
registers a wait, observes Pending, closes the last handle, then observes
Closed and finally `BadFd` on repeated poll. A mutant that discards the
last-close notification must fail the negative test. K1320 additionally
requires the same behavior from native EL0 calls over six QEMU profiles.