# K1326 — owned message copies

This snapshot extends the bounded channel queue with `OwnedChannel`. An
accepted send copies bytes from the caller into a kernel-owned fixed-size
slot and records the sender's full process generation in a parallel metadata
slot. The queue stores no pointer into user memory. A receiver gets both a
copy of the payload and the sender identity. Mutation or reuse of the source
buffer after send cannot change the queued payload.

The sender may close its channel handle and exit after a successful send. A
message remains available while another process still holds a read-capable
reference. The last reference close destroys the queue and clears both
payload and sender metadata. A receive removes one payload and its sender
metadata together. `peek` reads both without consuming either, so a kernel
adapter can write the payload to user memory before committing the receive.

Validation and user-data copying complete before message or sender metadata
is published. A bad owner, denied right, oversized message, full queue or
partial user-copy failure leaves the complete snapshot unchanged. The
underlying queue keeps FIFO order and the fixed `DEPTH` and `MAX` limits.

K1326–K1329 require local positive and boundary tests, an AArch64 `no_std`
metadata build and a mutation that publishes sender metadata before a failed
copy; the negative test must reject it. K1330 requires native EL0 execution
over six direct/UEFI profiles with one byte-identical experimental Image.
This does not establish a scheduler blocking wake or product release gate.