R2Kernel 1.0.0rc7

Superseded by RC8

Later RC7 review found a plaintext Native Event regression and incomplete readiness, foreground, and managed-removal coverage. The changes described below do not establish closure of every supported mode or process branch. See RC8 notes for the follow-up contracts. Published RC7 artifacts remain immutable.

RC7 addresses residual correctness, availability, installed-workflow, and publication findings from the RC6 audit. It is a new release candidate, not a replacement of the immutable RC6 distribution. Upgrade the runtime and SDKs together. Local Control remains protocol v5; mixed v4/v5 peers are rejected before application effects, without a compatibility fallback.

SDK response ownership and preparation

The Python resource client receives one complete, bounded response under one absolute request deadline. It owns received descriptors before parsing or checking the response, rejects malformed or incomplete replies and unexpected rights, and closes owned descriptors on failure. An ambiguous response does not authorize resubmitting the resource operation.

Python bound Control, Procedure, and Operation preparation includes binding resolution in its original timeout. Strict lookup failure or expiry does not fall back to an earlier launch binding, start a fresh preparation budget, or publish readiness after expiry. Preparation does not invoke application callbacks.

C++ prepared lanes remain invalidated when their route or codec generation changes. Ordinary calls do not silently reconnect, increase capacities, or return to cold setup. Explicit idle rebind and preparation are required to recover; pending response ownership and reclamation failures remain barriers. The public split Control send/receive path includes optional handshake work in the original call budget and honors a declared budget longer than one second without extending shorter deadlines or replaying an operation.

Operation results

The manipulation tutorial checks transport success and the typed Boolean acknowledgement before advancing confirmed command state or returning success. Timeout, malformed acknowledgement, and a valid negative acknowledgement remain failures. Attempt bookkeeping is separate from confirmed state. A successful command acknowledgement is not a measurement of physical motion completion, and a timeout is not proof that an admitted physical effect did not occur. Automatic retries are not added. Only the decoded typed result can acknowledge the command; the echoed request payload is not provider confirmation and is not reported as observed world state.

Broker availability and process lifetime

Incomplete resource requests and pending network connects have bounded capacity and absolute deadlines. One incomplete request no longer serializes all new proof traffic. An in-progress connect does not hold the resource mutation owner in a blocking network wait. Overload can still reject requests; finite admission limits are not a guarantee against all local denial of service.

Caller closure, shutdown, and lease termination cancel pending work. The broker revalidates the lease and owned process identity before delivering a connected descriptor. Failed response delivery does not replay an operation that already committed.

Approved-operator foreground launches preserve their execution identity and stdio. Failure cleanup terminates the owned process scope, reaps the exact child, and then releases resources. A leader's exit alone is not whole-scope completion. Incomplete cleanup preserves the reservation and reports both the primary and cleanup failures rather than claiming release.

Event receipt and queued-source lifetime

Authenticated receipt freshness is installed independently of slow native resource reconciliation. Existing authentication, replay checks, topic identity checks, quarantine, and explicit binding approval remain enforced.

Inbound queued Event data retains its authenticated peer and publisher provenance together with the accepted source lifetime. Unknown or incompatible sources are rejected; source retirement or replacement invalidates queued data from that earlier lifetime before local publication. Unchanged accepted heartbeats preserve the lifetime rather than replacing it on every refresh.

This does not introduce per-packet cryptographic application-session proof or change the existing federation wire format. Shared-key peers remain inside the declared trust boundary. A packet first received after a new registration cannot be proven to have been produced in that new application session merely from the current frame fields. Registration, queue lifetime, transport authentication, and physical production time are different guarantees.

Installed tools and operator workflow

The retained Event readiness helper accepts separate protected credential files for the sender and receiver status APIs. Keys are sent in explicit supported headers, not URLs, query strings, or reports. Authentication failures do not open a start gate, and cross-host readiness is not inferred from topology alone. See the Federation tutorial.

Installed clock commands and doctor use the same protected managed storage settings as the service, including when invoked outside a sourced development shell. Unsafe storage is still rejected. Source/direct-run behavior is separate from an install with persisted managed policy. The public <prefix>/bin path resolves to the same installation as <prefix>/runtime/bin; clock tools do not derive policy from the symlink's parent.

Uninstall validates the selected installation and its protected IPC policy before teardown. It stops owned consumers, retires resources under existing identity and live-reference checks, and only then removes the remaining install metadata. Retirement failure preserves recovery information. An unmanaged prefix without persisted policy is removed only when its lack of managed or live runtime state can be established; ambiguous state is refused, not adopted or deleted by guessing permissions. On Linux, CLI uninstall replaces the delegating CLI rather than retaining it as a live prefix consumer. Dry-run inspection uses the same privileged safety checks as removal; --no-sudo explicitly declines automatic elevation. Only the invoking privileged monitor chain is excluded from the unused-prefix check; unrelated sudo processes and other live prefix users still block removal.

For editable Python development, source the installed helper first, clear the inherited installed PYTHONPATH, and then activate the development environment. Managed package launches still use the installation's selected interpreter. See Developer Guide.

Qualification boundaries

Strict local 1 ms periodic acceptance targets the declared C++ raw-eight-byte echo profile: period/deadline 1 ms, Core FIFO99 on CPUs 0 and 1, actual caller/handler FIFO80, and caller CPU3/handler CPU2 for affinity runs. The profile contains repeated five-second runs with and without application affinity and 30-second affinity runs on each host, with hosts measured sequentially and no tracing in acceptance windows. Final artifact measurements are distinct from unit tests, installation checks, and historical RC6 source-candidate results.

Python remains a functional and diagnostic target outside strict 1 ms periodic acceptance. A result under OTHER does not invalidate an accepted FIFO profile. Guest affinity is not physical CPU or hypervisor isolation. No cross-host 1 kHz Control, universal WCET/hard-real-time, physical effect timestamp, or hardware PTP guarantee is asserted. Benchmark demos remain withdrawn; tutorials and transport fixtures are not performance acceptance runners.

See Installation, Resource Control, and Time Sync Operations. RC6 notes retain historical results and limits, not claims that RC7 repairs were present in RC6.