# K1306 — slot generation reuse

This version extends the K1305 typed table without changing its archived
source. Isolated K1310 Image builds copy `handles.rs` into their native
`kernel/src/runtime/handles.rs`. The frozen root `kernel/src` stays intact.

Each occupied table slot has a nonzero `u32` generation. A handle is an opaque
`u64`: high 32 bits are that generation, low 32 bits are the one-based slot.
The table owns `last_generation[slot]` even while the slot is vacant. A new
`open` of a vacant slot increments its last generation before publishing the
entry. `close` and process-exit cleanup remove entries but do not rewind the
generation. The caller's live kernel process ID, including its own generation,
is also required on every operation.

For capacity one, three `open → close` cycles issue distinct handles for the
same slot with generations 1, 2, and 3. After each close, every older number
returns `BadFd` (`EBADF`) and the current entry remains usable. A foreign
process generation also receives `BadFd` without changing the table.

If a vacant slot's last generation is `u32::MAX`, another open returns
`IdExhausted` before any entry or owner is published. Full capacity and an
invalid zero object ID also fail before publication. Complete snapshots of
the entries, generation array, and occupied count must match before and after
each failure. The kernel-only `with_generation_seed` constructor exists for
deterministic overflow injection; user code never controls the seed.

The positive local test asserts all three slot generations and exact resource
counts. The negative local test injects overflow, checks unchanged inventory,
and then runs a healthy independent table. K1310 must additionally prove the
stale rejection in actual EL0 calls on one development Image over six QEMU
profiles; a local model cannot close the guest gate.