Status: measurement round, executed on GPT's R1 order. Opens no new semantics; stops for adjudication. Numbers: receipts/KERNELLET-R1.md (generated, gated) and receipts/KERNELLET-R1-DYNAMIC-<stamp>.md (generated, stamped, not gated). Instrument: cd-kernellet/, tools/kernellet_abi.py, tools/kernellet_census.py, tools/kernellet_bench.py. R0 corrections applied: docs/floor-census.md §1 and §4.
No numeral in this document is a measurement.
GPT's ruling on the R0 census listed seven items. Each maps to something in the tree:
| order item | where it landed |
|---|---|
| fix the self-hashing manifest | scripts/make-floor-census-bundle.sh excludes SHA256SUMS from itself |
| relabel lifecycle "marginal" as removal-closure | tools/floor_census.py, receipt §1; docs/floor-census.md §1 |
| build all valid feature subsets | tools/floor_census.py builds every valid subset; conditional deltas, precedence-constrained Shapley, pairwise interactions |
| a non-instrumented production-floor image | cd-kernellet with no features; PRODUCTION FLOOR 8K gate in receipts/KERNELLET-R1.md §1 |
| an external witness battery | tools/kernellet_census.py::battery, driving the ELF through its ABI; receipt §3 |
| measure the hot instruction working set | ptrace single-step, exact; receipt §4. L1I misses per transition in the dynamic receipt |
| a 1…128-context run-to-completion scheduler on one image and one stack | cd-kernellet itself; bytes per context in receipt §2; cycles, misses, latency and shared-stack high-water in the dynamic receipt |
Not done, on the order's own instruction: no migration protocol, no shadow promotion, no new semantics.
One freestanding no_std ELF in the same 64 KiB RAM map as cd-micro. It contains: the entry and a fixed-frame invocation ABI on stdin/stdout, the memory intrinsics, cd-core's lifecycle transitions and finality, worker- authority reconstruction over a bounded per-context evidence ring, a table of N contexts, and the dispatch that runs one command to completion on one context. It contains no reporter, no size table, no strings, no replay, no codec, and no measurement ops. N is a build-time constant read from the environment, so bytes-per-context is the slope of .data + .bss across builds and is never printed by the image.
A context is one lineage: the admission, the finality warden, the current possession (vacant, attached, or with the custody feature suspended), and the evidence ring. The semantic part is what cd-floor sized as one live locus; the ring is the scheduler's addition and the receipt separates the two.
The ABI is the scheduler. step(context, input) -> outcome is the whole execution model: no threads, no resumption, one shared stack. A refused transition hands every value back, so the context is bit-for-bit what it was.
Evidence egress is not in the hot floor. cd-core mints an attach
record, a detach receipt or a loss finalization on every transition; the kernellet drops them, because it has nowhere to put them. A cold log is a service above the floor. The byte cost of evidence egress is therefore not in the gate figure and must be measured when that service exists.
A world root is born once. There is no second BOOT and no re-mark, so
a foreign root cannot enter through the ABI, and cd-core's ForeignProvenance path is unreachable from outside. It stays covered by cd-floor's internal witness. Several other refusals (NotVacant, WrongLocus, CustodyMismatch, MixedProvenance) are likewise pre-empted by the context state machine; the receipt names them.
The evidence ring refuses when full. Rolling the oldest entry away
could drop a revocation and change what reconstruct answers, so the ring refuses instead. The size of the ring is a scheduler decision the round did not rule; the receipt states it.
Gate: .text + .rodata of the production image against the limit,
and every external witness green. Both halves are required; a size under the limit with a failed witness is a FAIL.
External battery: a fresh process per session, driven one command at
a time; each check names the witness, the expected outcome fields, and the observed ones. A second battery runs on every slot the image has to show contexts are independent. The battery runs on the smallest and the largest image built, not only the default.
Bytes per context: the slope of .data + .bss over N must be the
same between every adjacent pair of builds, or the census refuses. (The table lands in .data, not .bss, because an empty slot is not all-zero.)
Hot instruction working set: the image is single-stepped under
ptrace over a deterministic command stream; the set of executed instruction addresses inside .text, their summed lengths from objdump, and the distinct 64-byte lines they touch. Exact, not sampled. The instruction count from this instrument agrees with the hardware instructions counter to within the exec stub, which is the control that the two instruments see the same run.
Cycles, instructions, L1 misses per transition: user-space-only
hardware counters opened before exec and enabled on exec, over the whole process. Per-transition figures are the difference between a run of 2K iterations and a run of K iterations, divided by the difference in transitions, so the fixed cost of boot, context birth, I/O and histogram readout cancels. Median of repeats. A transition is one attach or one detach.
Latency distribution: the bench feature adds an in-image op that
runs round-robin attach/detach with rdtsc around each transition and keeps a log2 histogram; p50 and p99 are reported as the bucket they fall in, which is a range, not a point. The rdtsc pair itself is inside the figure.
Shared stack high-water: the bench image paints the reserve under
the dispatcher's frame at start and scans for the deepest touched byte on request. A fixed margin under the paint point is never counted, so the figure never reads below the margin.
Intrinsics versus semantics: the fastmem feature swaps the byte-loop
memcpy/memset for rep movsb/rep stosb with no semantic change. The two rows bound how much of a transition's instruction count is the intrinsic moving a context into and out of its slot rather than cd-core.
The bench and fastmem images are not the production image; the gate
is measured on the image with no features. bench adds ops, statics and rdtsc; it is reported beside, never instead.
Hardware-counter figures are this CPU, this frequency, this day. The
dynamic receipt is stamped for that reason and must not be diffed.
p50/p99 are log2 buckets. A bucket is a factor-of-two range; do not quote
its lower edge as the percentile.
Cycles from rdtsc are TSC ticks; cycles from the counter are core
cycles. They differ by the frequency ratio and are reported in separate columns.
One image and one stack on one core is measured. **Nothing is measured
across cores**, and nothing about shadow promotion, which the order excluded and which remains the INDETERMINATE problem.
"Contexts scale to N" here means bytes and independence. Throughput per
core under a realistic mix of operations is not measured; the bench workload is attach/detach only.
A thread-or-process comparison was not run. The honest comparison needs
its own harness and its own round.
The single-slot battery expected the wrong thing. With one slot,
slot 0 is detached before the finalize step, so the finalize must be refused NotAttached, not admitted. The first version of the battery wrote the multi-slot expectation into the one-slot case and the receipt's PROBLEMS section caught it. Fixed; the one-slot witness now names the refusal it expects.
`.text` varies slightly with N. LLVM picks a different encoding when
N is an immediate that fits a shorter form, and unrolls at N=1. Recorded as a note, not a failure: the floor does not grow with N.
The hardware-counter probe read zero on its first run because the
enable-on-exec flag was set at the wrong bit. Found by the agreement check against ptrace; fixed before any figure was recorded.