replace ad hoc driver loading with a proper driver manager, new DDK, new PnP manager with device matching, asynchronous startup, resource ownership and removal, add shared PCI capability helpers, replace typed, rigid services with a proper service manager, implement proper system shutdown and restart, shutting down unloads drivers and shuts down services, add simple power button, remove heavyweight boot self-tests and SMP stress runs, add monotonic timestamps to kernel debug output, fruitless USB and PS/2 fixes, make test builds opt in.

code/kernel/include/kernel/dm_config.h

@@ -0,0 +1,85 @@
+// Kernel driver configuration and dependency graph contract.
+
+#pragma once
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#define DM_MAX_DRIVERS 64u
+#define DM_MAX_CLASSES 32u
+#define DM_MAX_EDGES 16u
+#define DM_ID_MAX 64u
+#define DM_IMAGE_MAX 64u
+#define DM_CONFIG_MAX_BYTES (64u * 1024u)
+
+typedef enum DM_START_PHASE {
+    DmStartBoot,
+    DmStartRuntime,
+    DmStartDisabled,
+} DM_START_PHASE;
+
+typedef enum DM_DEPENDENCY_KIND {
+    DmDependencyClass,
+    DmDependencyDriver,
+} DM_DEPENDENCY_KIND;
+
+typedef struct DM_DEPENDENCY {
+    DM_DEPENDENCY_KIND Kind;
+    char Id[DM_ID_MAX];
+} DM_DEPENDENCY;
+
+typedef struct DM_EDGES {
+    DM_DEPENDENCY Items[DM_MAX_EDGES];
+    uint32_t Count;
+} DM_EDGES;
+
+typedef enum DM_RUN_STATE {
+    DmRunWaiting,
+    DmRunStarted,
+    DmRunFailed,
+    DmRunBlocked,
+    DmRunDisabled,
+} DM_RUN_STATE;
+
+typedef struct DM_DRIVER_CONFIG {
+    char Id[DM_ID_MAX];
+    char Image[DM_IMAGE_MAX];
+    char Class[DM_ID_MAX];
+    DM_EDGES Requires;
+    DM_EDGES After;
+    DM_START_PHASE Phase;
+    DM_RUN_STATE State;
+    bool Critical;
+    uint8_t Present;
+} DM_DRIVER_CONFIG;
+
+typedef struct DM_CLASS_CONFIG {
+    char Id[DM_ID_MAX];
+    DM_EDGES Requires;
+    DM_EDGES After;
+    uint8_t Present;
+} DM_CLASS_CONFIG;
+
+typedef struct DM_CONFIG {
+    DM_DRIVER_CONFIG Drivers[DM_MAX_DRIVERS];
+    DM_CLASS_CONFIG Classes[DM_MAX_CLASSES];
+    uint32_t DriverCount;
+    uint32_t ClassCount;
+    DM_START_PHASE ActivePhase;
+} DM_CONFIG;
+
+// Parses and validates a complete immutable configuration before any driver starts.
+// Empty optional values and omitted optional keys have identical semantics.
+bool DmConfigParse(DM_CONFIG* config, const char* bytes, size_t size,
+                   char* error, size_t errorCapacity);
+
+// Returns true once every configured provider in this class has reached a terminal state.
+bool DmClassSettled(const DM_CONFIG* config, const char* classId);
+bool DmClassAvailable(const DM_CONFIG* config, const char* classId);
+
+// Tests the current requirements/ordering gates for a single waiting module.
+bool DmDriverCanStart(const DM_CONFIG* config, uint32_t index);
+
+// Returns true once a waiting driver's required dependency cannot become available.
+bool DmDriverIsBlocked(const DM_CONFIG* config, uint32_t index);

code/kernel/include/kernel/driver_module.h

@@ -0,0 +1,9 @@
+#pragma once
+
+#include <stdint.h>
+#include <ntlite/status.h>
+
+
+KSTATUS DmStartLoadedDriver(const char* name, uintptr_t imageBase);
+KSTATUS DmPrepareShutdown(void);
+void DmCommitShutdown(void);

code/kernel/include/kernel/hal/hal_api.h

@@ -185,9 +185,14 @@ typedef struct HAL_INTERRUPT_CONTROLLER {
 } HAL_INTERRUPT_CONTROLLER;
 
 typedef struct HAL_POWER {
+    // ACPI fixed-feature button events. Control-method devices require an AML owner.
+    KSTATUS (*QueryFixedButtonIrq)(uint8_t* irqOut);
+    KSTATUS (*ArmFixedButton)(void);
+    bool (*ConsumeFixedButton)(void);
     // ACPI S5 soft-off. Disables interrupts, writes SLP_EN to PM1a/b_CNT,
     // and halts if firmware doesn't respond. Does not return.
     void (*Shutdown)(void);
+    void (*Reset)(void);
 } HAL_POWER;
 
 typedef struct HAL_API {
@@ -226,7 +231,7 @@ typedef struct HAL_INIT_PARAMS {
 } HAL_INIT_PARAMS;
 
 // Increment whenever the kernel/HAL table ABI changes.
-#define HAL_API_VERSION 2u
+#define HAL_API_VERSION 4u
 
 // Returns the HAL table. Processor interrupt-state operations are valid before HalInitialize().
 HAL_ENTRY const HAL_API* HalGetApi(void);

code/kernel/include/kernel/hal/hal_apic.h

@@ -7,6 +7,10 @@
 #include <kernel/hal/hal_api.h>
 
 void HalApicRouteIrq(uint8_t irq);
+void HalApicSetGsiBase(uint32_t gsiBase);
+void HalApicSetIsaOverride(uint8_t irq, uint32_t gsi, uint16_t flags);
+void HalApicSetSciIrq(uint16_t irq);
+bool HalApicCanRouteIrq(uint8_t irq);
 void HalApicMaskIrq(uint8_t irq);
 void HalApicUnmaskIrq(uint8_t irq);
 void HalApicSendEoi(void);

code/kernel/include/kernel/io_ddk.h

@@ -1,4 +1,4 @@
-// Kernel DDK-table provider declarations.
+// Kernel driver service initialization.
 
 #pragma once
 #include <stdint.h>
@@ -8,8 +8,5 @@
 struct HAL_API;
 typedef struct HAL_API HAL_API;
 
-// Initializes the kernel-owned DDK table from platform services.
-void IoInitializeDdk(const HAL_API* hal, uintptr_t physicalWindowBase);
 
-// Returns the kernel-owned DDK table passed to driver entrypoints.
-const NTL_DDK* IoGetDdk(void);
+void IoInitializeDdk(const HAL_API* hal, uintptr_t physicalWindowBase);

code/kernel/include/kernel/io_dma.h

@@ -4,6 +4,85 @@
 
 #include <ntlite/ddk/dma.h>
 
+typedef struct NTL_DDK_DMA {
+    // Returns the one adapter and requirement set owned by a device object.
+    KSTATUS (*GetAdapter)(struct DEVICE_OBJECT* device,
+                          const IO_DMA_REQUIREMENTS* requirements,
+                          IO_DMA_ADAPTER** outAdapter);
+
+    // Releases one caller-owned adapter reference.
+    void (*PutAdapter)(IO_DMA_ADAPTER* adapter);
+
+    // Allocates coherent memory with stable CPU and base device addresses. The
+    // caller must quiesce every device reference before releasing the buffer.
+    KSTATUS (*AllocateCommonBuffer)(IO_DMA_ADAPTER* adapter,
+                                    size_t size,
+                                    size_t alignment,
+                                    IO_DMA_BUFFER** outBuffer);
+
+    // Releases a coherent common buffer.
+    void (*FreeCommonBuffer)(IO_DMA_BUFFER* buffer);
+
+    // Returns the stable CPU address of a common buffer.
+    void* (*GetCommonBufferAddress)(const IO_DMA_BUFFER* buffer);
+
+    // Returns the stable device address of a common buffer.
+    uint64_t (*GetCommonBufferDeviceAddress)(const IO_DMA_BUFFER* buffer);
+
+    // Returns the caller-requested size of a common buffer.
+    size_t (*GetCommonBufferSize)(const IO_DMA_BUFFER* buffer);
+
+    // Stabilizes a kernel range for one or more streaming mappings. Pinning
+    // preserves the pages, but does not transfer ownership to a device.
+    KSTATUS (*PinKernelMemory)(void* address,
+                               size_t size,
+                               IO_DMA_DIRECTION direction,
+                               MM_PINNED_MEMORY** outMemory);
+
+    // Stabilizes a process-owned user range for one or more mappings. The
+    // descriptor retains the process and range until the final unpin.
+    KSTATUS (*PinUserMemory)(struct PROCESS* process,
+                             void* address,
+                             size_t size,
+                             IO_DMA_DIRECTION direction,
+                             MM_PINNED_MEMORY** outMemory);
+
+    // Releases one pinned-memory reference after all mappings leave.
+    void (*UnpinMemory)(MM_PINNED_MEMORY* memory);
+
+    // Maps a pinned subrange and creates a constrained segment list. A new
+    // mapping begins CPU-owned and requires external operation serialization.
+    KSTATUS (*MapPinnedMemory)(IO_DMA_ADAPTER* adapter,
+                               MM_PINNED_MEMORY* memory,
+                               size_t offset,
+                               size_t length,
+                               IO_DMA_DIRECTION direction,
+                               uint32_t flags,
+                               IO_DMA_MAPPING** outMapping);
+
+    // Releases a mapping and performs a final receive-side bounce copy only
+    // when ownership was transferred to the device and not returned to the CPU.
+    void (*UnmapMemory)(IO_DMA_MAPPING* mapping);
+
+    // Transfers mapping ownership from the CPU to the device. Streaming DMA
+    // must not begin before this operation succeeds.
+    KSTATUS (*SynchronizeForDevice)(IO_DMA_MAPPING* mapping);
+
+    // Transfers mapping ownership from the device to the CPU. CPU readers must
+    // not consume receive data before this operation succeeds.
+    KSTATUS (*SynchronizeForCpu)(IO_DMA_MAPPING* mapping);
+
+    // Returns the immutable segment count owned by a mapping.
+    uint32_t (*GetSegmentCount)(const IO_DMA_MAPPING* mapping);
+
+    // Returns the immutable segment array owned by a mapping.
+    const IO_DMA_SEGMENT* (*GetSegments)(const IO_DMA_MAPPING* mapping);
+
+    // Copies current DMA counters into caller-owned storage.
+    void (*QueryStats)(IO_DMA_STATS* outStats);
+} NTL_DDK_DMA;
+
+
 struct DEVICE_OBJECT;
 
 // Returns the kernel-owned DDK DMA table.

code/kernel/include/kernel/io_pnp.h

@@ -0,0 +1,19 @@
+#pragma once
+
+#include <stdint.h>
+#include <ntlite/status.h>
+#include <ntlite/ddk/device.h>
+
+struct DEVICE_OBJECT;
+struct NTL_MODULE;
+struct DRIVER_OBJECT;
+
+KSTATUS IoPnpInitialize(void);
+KSTATUS IoPnpPublishModule(struct NTL_MODULE* module,
+                           const NTL_DEVICE_DESC* descriptors, uint32_t count,
+                           struct DRIVER_OBJECT* const* ioDrivers, uint32_t ioCount);
+KSTATUS IoPnpPhysicalDeviceArrived(struct DEVICE_OBJECT* pdo);
+void IoPnpPhysicalDevicePublished(struct DEVICE_OBJECT* pdo);
+void IoPnpPhysicalDeviceRemoved(struct DEVICE_OBJECT* pdo);
+KSTATUS IoPnpWaitForIdle(uint64_t timeoutMs);
+KSTATUS IoPnpShutdown(uint64_t timeoutMs);

code/kernel/include/kernel/ke_audio.h

@@ -5,6 +5,34 @@
 #include <stdbool.h>
 #include <stdint.h>
 #include <ntlite/ddk/audio.h>
+
+typedef struct NTL_DDK_AUDIO {
+    // Registers one endpoint and returns a provider-owned reference valid until unregister returns.
+    KSTATUS (*RegisterEndpoint)(const IO_AUDIO_ENDPOINT_REGISTRATION* registration,
+                                IO_AUDIO_ENDPOINT** outEndpoint);
+
+    // Stops the endpoint, removes it from enumeration, and consumes the provider-owned reference.
+    void (*UnregisterEndpoint)(IO_AUDIO_ENDPOINT* endpoint, IO_AUDIO_REMOVAL_MODE mode);
+
+    // Reports one completed hardware period from ISR/DPC completion processing.
+    // presentedFrames, hardwarePositionFrames, and interruptCount must be monotonic for the
+    // endpoint lifetime. timestampTicks uses the DDK monotonic microsecond source.
+    void (*NotifyPeriod)(IO_AUDIO_ENDPOINT* endpoint,
+                         uint32_t completedPeriodIndex,
+                         uint64_t presentedFrames,
+                         uint64_t hardwarePositionFrames,
+                         uint64_t interruptCount,
+                         uint64_t timestampTicks);
+
+    // Updates jack-derived endpoint availability without changing endpoint identity.
+    void (*SetEndpointAvailable)(IO_AUDIO_ENDPOINT* endpoint, bool available);
+
+    // Fails an endpoint and wakes every stream owner.
+    void (*ReportEndpointFailure)(IO_AUDIO_ENDPOINT* endpoint,
+                                  KSTATUS status,
+                                  uint32_t flags);
+} NTL_DDK_AUDIO;
+
 #include <kernel/ob_object.h>
 #include <kernel/ke_event.h>
 

code/kernel/include/kernel/ke_named_queue.h

@@ -0,0 +1,12 @@
+// Named queue registry hooks shared by process handle cleanup and syscalls.
+
+#pragma once
+
+#include <stdint.h>
+#include <ntlite/handle.h>
+
+struct PROCESS;
+struct OBJECT;
+
+// Removes registry entries owned by the given process handle/object pair.
+void KeNamedQueueUnpublishHandle(struct PROCESS* process, SYS_HANDLE handle, struct OBJECT* object);

code/kernel/include/kernel/ke_power.h

@@ -0,0 +1,18 @@
+#pragma once
+#include <ntlite/status.h>
+#include <stdint.h>
+
+struct PROCESS;
+struct EVENT;
+
+struct HAL_API;
+KSTATUS KePowerInitialize(void);
+void KePowerInitializeButton(const struct HAL_API* hal);
+void KePowerSetInitProcess(struct PROCESS* init);
+KSTATUS KePowerRequest(uint32_t action);
+KSTATUS KePowerRequestHardware(uint32_t action);
+KSTATUS KePowerGetRequest(struct PROCESS* caller, uint32_t* actionOut);
+KSTATUS KePowerComplete(struct PROCESS* caller, uint32_t action);
+struct EVENT* KePowerRequestEvent(struct PROCESS* caller);
+struct EVENT* KePowerCompletionEvent(void);
+uint32_t KePowerCommittedAction(void);

code/kernel/include/kernel/ke_selftest.h

@@ -1,10 +1,6 @@
-// Kernel ke selftest declarations shared by implementation files and kernel clients.
+// Debug-only bootstrap checks and focused kernel diagnostics.
 
 #pragma once
-// ke_selftest.h - kernel bring-up and regression self-tests.
 
-#include <kernel/hal/hal_api.h>
-
-void KiRunCoreHardeningSelfTests(void);
-void KiRunEarlyKernelSelfTests(void);
-void KiRunKernelSelfTests(const HAL_API* hal);
+void KiCheckBootState(void);
+void KiRunKernelSelfTests(void);

code/kernel/include/kernel/ke_smp.h

@@ -19,8 +19,3 @@ KSTATUS KeAdmitApplicationProcessorsToScheduler(void);
 // KeStartApplicationProcessors calls this after MADT enumeration; it is also
 // safe to call again after failed AP startup disables a CPU record.
 void KeBuildProcessorTopology(void);
-
-// Run explicit AP-affine kernel workers that exercise the global scheduler,
-// reschedule IPIs, yield, and event wait/wake. Normal kernel/user/driver
-// threads remain boot-processor-affine unless their affinity is explicitly widened.
-KSTATUS KeRunApplicationProcessorSchedulerSelfTests(void);

code/kernel/include/kernel/ke_system_service.h

@@ -4,7 +4,7 @@
 
 #include <ntlite/service.h>
 #include <ntlite/status.h>
-#include <ntlite/security.h>
+#include <ntlite/ddk/object.h>
 
 struct PORT;
 
@@ -20,5 +20,9 @@ KSTATUS KeSystemServiceReference(SYS_SERVICE_ID serviceId, struct PORT** listene
 // Removes every service entry that refers to a listener being destroyed.
 void KeSystemServiceUnregisterListener(struct PORT* listener);
 
-// Returns the security-context claim required to register one service identity.
-SYS_SERVICE_CLAIMS KeSystemServiceRequiredClaim(SYS_SERVICE_ID serviceId);
+// Creates one kernel-issued, typed authority for a numeric registry identity.
+// Caller owns the returned object reference and may issue attenuated handles.
+KSTATUS KeSystemServiceCreateRegistrationAuthority(SYS_SERVICE_ID serviceId, OBJECT** authorityOut);
+
+// Reads the bound identity from a referenced, type-checked authority.
+KSTATUS KeSystemServiceRegistrationIdentity(const OBJECT* authority, SYS_SERVICE_ID* serviceIdOut);

code/kernel/include/kernel/ke_userenv.h

@@ -11,25 +11,31 @@
 
 #define SYS_PEB_MAGIC   0x30424550u  // "PEB0"
 #define SYS_TEB_MAGIC   0x30424554u  // "TEB0"
-#define SYS_ENV_VERSION 4u
+#define SYS_ENV_VERSION 5u
 
 #ifndef SYS_USER_ENV_TYPES_DEFINED
 #define SYS_USER_ENV_TYPES_DEFINED 1
 
-#define SYS_STARTUP_CAP_SYSTEM_VOLUME         1u
-#define SYS_STARTUP_CAP_SERVICE_CONTROL       2u
-#define SYS_STARTUP_CAP_SYSTEM_VOLUME_NAMESPACE 3u
-#define SYS_STARTUP_CAP_VOLUME_MANAGER          4u
-#define SYS_STARTUP_CAP_INPUT_MANAGER           5u
-#define SYS_STARTUP_CAP_DISPLAY_MANAGER         6u
-#define SYS_STARTUP_CAP_SESSION_CONTROL         7u
 #define SYS_STARTUP_CAPABILITY_MAX 32u
 
 typedef struct SYS_STARTUP_CAPABILITY {
-    uint32_t Tag;
+    char Name[SYS_STARTUP_CAPABILITY_NAME_MAX + 1u];
     SYS_HANDLE Handle;
 } SYS_STARTUP_CAPABILITY;
 
+// Kernel-side validation of canonical process startup capability names.
+static inline int SysStartupCapabilityNameValid(const char name[SYS_STARTUP_CAPABILITY_NAME_MAX + 1u]) {
+    if (!name || !name[0]) return 0;
+    int terminated = 0;
+    for (uint32_t i = 0; i <= SYS_STARTUP_CAPABILITY_NAME_MAX; ++i) {
+        char c = name[i];
+        if (!c) { terminated = 1; continue; }
+        if (terminated || !((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') ||
+                             (c >= '0' && c <= '9') || c == '_' || c == '-' || c == '.')) return 0;
+    }
+    return terminated;
+}
+
 typedef struct SYS_PEB {
     uint32_t Magic;
     uint32_t Version;

code/kernel/include/kernel/ldr_image.h

@@ -20,6 +20,9 @@ KSTATUS LdrLoadImageFileForProcess(struct PROCESS* process, struct FILE_OBJECT*
 size_t LdrGetImageSize(uintptr_t base);
 size_t LdrGetMappedImageSize(struct PROCESS* process, uintptr_t base);
 
+// Look up a named export in one already-mapped image.
+void* LdrGetImageExport(uintptr_t imageBase, const char* functionName);
+
 // Look up a named export in a loaded module.
 // 'moduleName' must match a registered kernel module name such as "hal.dll".
 void* LdrGetExport(const char* moduleName, const char* functionName);
@@ -40,4 +43,5 @@ KSTATUS LdrProtectImageForProcess(struct PROCESS* process, uintptr_t imageBase,
 struct BOOT_INFO; // forward declaration
 KSTATUS LdrRegisterModulesFromBootInfo(const struct BOOT_INFO* bootInfo);
 KSTATUS LdrRegisterModule(const char* name, uintptr_t base);
+KSTATUS LdrSetModuleExportsAvailable(const char* name, bool available);
 const char* LdrFindKernelModuleByAddress(uintptr_t address, uintptr_t* baseOut, size_t* sizeOut);

code/kernel/include/kernel/mm_file_cache.h

@@ -72,6 +72,7 @@ KSTATUS MmFileCacheWrite(FILE_OBJECT* file, uint64_t offset, const void* buf,
 
 // Flushes dirty cached pages for one file.
 KSTATUS MmFileCacheFlushFile(FILE_OBJECT* file);
+KSTATUS MmFileCacheFlushAll(void);
 
 // Drops cached clean pages overlapping the byte range. Dirty pages are flushed
 // by callers before destructive metadata operations.

code/kernel/include/kernel/se_security.h

@@ -13,8 +13,6 @@ typedef struct SECURITY_CONTEXT {
     uint32_t SecurityId;
     SYS_PRIVILEGES EffectivePrivileges;
     SYS_PRIVILEGES DelegablePrivileges;
-    SYS_SERVICE_CLAIMS ServiceClaims;
-    SYS_SERVICE_CLAIMS DelegableServiceClaims;
     uint32_t Flags;
 } SECURITY_CONTEXT;
 
@@ -24,19 +22,14 @@ KSTATUS SeInitializeSecurity(void);
 // Returns the bootstrap root context. The returned pointer is owned by the security subsystem.
 SECURITY_CONTEXT* SeGetRootSecurityContext(void);
 
-// Derives one immutable child context without allowing privilege or service-claim amplification.
+// Derives one immutable child context without allowing ambient privilege amplification.
 KSTATUS SeDeriveSecurityContext(SECURITY_CONTEXT* source,
                                 SYS_PRIVILEGES effectivePrivileges,
                                 SYS_PRIVILEGES delegablePrivileges,
-                                SYS_SERVICE_CLAIMS serviceClaims,
-                                SYS_SERVICE_CLAIMS delegableServiceClaims,
                                 SECURITY_CONTEXT** contextOut);
 
 // Returns whether one process currently carries all requested ambient privileges.
 bool SeProcessHasPrivilege(const struct PROCESS* process, SYS_PRIVILEGES privileges);
 
-// Returns whether one security context carries all requested service claims.
-bool SeContextHasServiceClaims(const SECURITY_CONTEXT* context, SYS_SERVICE_CLAIMS claims);
-
 // Copies one immutable security context into the public query layout.
 void SeQuerySecurityContext(const SECURITY_CONTEXT* context, SYS_SECURITY_CONTEXT_INFO* infoOut);

code/kernel/include/kernel/syscall_nr.h

@@ -193,4 +193,9 @@
 #define SYS_GET_SOCKET_OPTION        160
 #define SYS_POLL                     161
 
-#define SYS_MAX 162
+#define SYS_OPEN_POWER_EVENT         162
+#define SYS_REQUEST_SYSTEM_POWER     163
+#define SYS_QUERY_SYSTEM_POWER       164
+#define SYS_COMPLETE_SYSTEM_POWER    165
+
+#define SYS_MAX 166