nt-lite/roadmap.md

nt-lite — remaining roadmap

Status: working plan; remaining implementation, integration, and validation only. Scope: lean-boot verification, the Linux-derived USB/SCSI/HID/input replacement, parallel driver/services startup, then deferred native filesystem/security, POSIX, desktop, personality, debugging, graphics, and driver compatibility work.

Current state and evidence

• Latest boot result: user reports roughly 8 seconds, with tests enabled. This is a substantial improvement over the earlier approximately 96-second ThinkPad run. Exact build flags and measured interval were not supplied; retain the report as an observed result, not a verified per-stage benchmark or proof that all regressions are fixed.
• Implemented foundation: POSIX P0–P7 (including server-owned execve() and vfork()), native UABI.1–UABI.4 cleanup, drivers.ini v2 class/exact-dependency parsing and driver-state management, driver/device prepare/commit shutdown, and prior USB/display shutdown-lifetime fixes. Preserve and test these contracts rather than rewriting them.
• Lean-boot work: a patch implementing reduced/gated boot checks, deletion of the unconditional SMP scheduler self-test, central monotonic DbgPrint timestamps, lightweight default debug flags, and opt-in test packaging was prepared (ntlite_lean_boot_after_usb_lifetime.patch). Before marking every component integrated, compare it against the actual current tree; the user-reported eight-second result is not a substitute for checking what was applied.
• Graphical system: native DWM/surfaces and DOOM integration work, but native console/window management, shell policy, and restart semantics are still incomplete.
• Desktop PC unresolved: AMD xHCI 1022:43d5/1022:149c stalls with both external hubs connected. Latest supplied build marker phase2-usb-rundown-20261022 reached root hub started ... scan=queued and initial scan wake returned for 28:00.3 before the log ended; source patches have yet to establish a hardware fix.
• ThinkPad T14 Gen 5 (AMD, machine 21MDS30F00): four xHCI PCI functions (1022:15b9, 15ba, 15c0, 15c1), recurring USB control-transfer timeouts and hub-attached child descriptor failures. A directly connected 09da:2268 boot keyboard works despite a secondary nonboot HID interface returning PnP unsupported; the built-in keyboard/TrackPoint provide no confirmed input events. Linux identifies i8042/serio keyboard and TrackPoint, plus ELAN0676 HID-over-I²C on AMDI0010:01. The Unifying receiver (046d:c52b) has boot mouse capability, so report parsing alone does not explain its missing input. ACPI fixed power button is unavailable and AML event handling remains open.
• No claim of a real integration test follows from syntax checks, patch apply checks, or host models. Use the current real-hardware logs and fresh checkout for the next change.

Operating decisions

1. Favor one clean owner and one native interface per concern. Breaking obsolete APIs is acceptable; delete stale callers and compatibility paths as part of a change.
2. Normal boot is not a regression harness. Runtime failure checks remain mandatory, but deterministic regression, synchronization stress, and intrusive diagnostics must be explicit. Avoid creating a new standalone test for every feature.
3. Use centrally timestamped DbgPrint records to find waits before adding profiling frameworks or blindly parallelizing work. Times must be monotonic elapsed values, prefixed once per logical line in both console/file output, safely under concurrent writers. Pre-clock logging may remain unprefixed.
4. No permanent vendor/model shortcut in place of standard hardware protocols. Use imported Linux state machines where practicable; otherwise implement the narrowest native component to Linux/spec behavior, with tests and recorded provenance. Protocol-defined fallback remains legitimate.
5. The driver/module dependency graph and the runtime PnP device topology are distinct. requires needs provider success; after needs provider settlement, regardless of success. Reverse dependency order governs graceful shutdown.
6. The user-mode service manager should be generic: RSSRV is an ordinary critical service with declared bootstrap resources and authority, not type=resource and not selected by hard-coded executable name. No service gains privileges merely because it uses a familiar image/ID.
7. A service's privilege mask and granted capabilities are separate: use minimal named ambient privileges where unavoidable; delegate scoped handles for actual resources. The current shared-address-space/SASOS model does not promise hostile-user-process memory isolation.
8. Prioritize a usable, correct system. Do not keep testing, scaffolding, or instrumentation merely because it already exists. Preserve only focused coverage for genuinely subtle regressions.

---

Active modernization: three phases

Phase 1 — Close lean boot and make delays observable

Status: substantially progressed; verification and any measured residual stalls remain.

Work

• Verify that the current source contains the intended self-test cleanup:
  • Rename KiRunCoreHardeningSelfTests() to a modest KiCheckBootState() (or equivalent), containing only cheap indispensable consistency checks, gated by the existing explicit diagnostic flag.
  • Remove KiRunEarlyKernelSelfTests() and its unconditional call; do not run 64 rounds of AP-affine scheduler workers as part of boot.
  • Heavily prune debug-only KiRunKernelSelfTests(); retain at most focused, uniquely valuable concurrency/memory tests (the prepared patch keeps APC wait-race and COW coverage). Remove in-kernel STRINGVIEW, trap-frame, filesystem/path, async-file, extensive scheduler, PFN/DMA/PTE/VAD and similar redundant tests instead of blindly relocating everything.
  • Keep actual failure handling and initialization assertions where correctness requires them. Compile-time ABI layout checks belong in compile-time assertions.
• Verify the central DbgPrint monotonic timestamp implementation, across logical lines and persisted kernel.log; guard early/pre-clock and concurrent output without allocation or blocking hot paths.
• Default to light diagnostics (debug=0x004 for file logs, optionally 0x005 with console mirroring); reserve intrusive flags and 0x002 regression diagnostics for explicit investigations. Do not assume a user must always use one particular mask.
• Normal build must not compile/package the fleet of test executables into /tests by default. The proposed build option is --with-tests. Prune duplicate/low-value tests selectively; preserve a runnable development suite.
• Use timestamps to distinguish firmware/EFI loading, CPU admission, PCI enumeration, storage readiness, USB timeouts, and service READY latency. Measure cold boots on both QEMU and real machines. Profile 256-bus PCI probing before replacing it; prefer real bridge-topology discovery when justified, while preserving access to buses c4 and c6.

Done when: ordinary boot invokes no regression/stress suite; debug-mode tests are opt-in; logs identify meaningful delay intervals; production images exclude test programs by default; the ~8-second result is reproducible with a defined start/end point and actual flags. This phase is not blocked on achieving an arbitrary sub-second boot time.

Phase 2 — Linux-derived USB, SCSI, block, HID and input replacement

Status: architecture approved in principle; source import, compatibility runtime, new module graph, and hardware validation remain open. Existing usb.sys is a diagnostic baseline, not the implementation to extend feature by feature. The code already booted with direct USB storage and boot keyboards on some runs, but desktop hub hangs, ThinkPad full-/low-speed control timeouts, hub-child enumeration, generic HID coverage, and built-in input remain unresolved. Earlier patch application and syntax checks do not establish hardware fixes.

Implementation rule: prefer a pinned, upstream Linux implementation for USB, xHCI, HID, input, SCSI and its necessary block support. Port closely where possible, adapt through private runtime/platform layers where needed, and rewrite the smallest problematic dependency or native boundary against Linux's semantics if a direct port costs more than a tested native implementation. Preserve provenance, specification-level behavior and the relevant licensing obligations in all cases. Avoid keeping a parallel bespoke USB core or two owners of USB device state.

P2.0 — Source freeze, dependency closure and legal provenance. Pin an exact upstream Linux revision and imported-file hash manifest; derive the selected sources and transitive symbols using upstream Kconfig, Makefiles and actual code, across drivers/usb/core, drivers/usb/host/xhci*, drivers/usb/storage, drivers/hid, drivers/hid/usbhid, drivers/input, drivers/scsi and the required block/ support. Exclude USB gadget, unrelated HCDs and class drivers until demanded by a real feature. Stage third-party notices, original per-file SPDX/copyright, GPLv2 text, modifications, complete corresponding-source/build-script distribution procedures; a notice alone does not discharge all license obligations. Record a port/adapt/rewrite decision per component based on dependency cost and testable semantics. Maintain the last bootable source as a regression baseline, not an ongoing duplicate stack.

P2.1 — Compiler and module ABI feasibility gate. Build, link and execute representative upstream units from xHCI, USB core, HID/input and SCSI/block. Explicitly audit MSVC x64's LLP64 model and Microsoft calling convention versus Linux x86-64 LP64 and System V; audit layout, atomics, bitmaps, pointer-sized fields, inline asm, object relocation and compiler builtins. Compare native PE/COFF with a contained alternative internal Linux ABI/module format. Choose by measured total integration and maintenance cost; retain nt-lite's kernel/public ABI at the external boundary. A successful syntax-only build cannot close this gate.

P2.2 — Shared Linux compatibility runtime. Supply exactly the used allocator/page, coherent and streaming DMA, SG, atomic/refcount, spinlock/IRQ masking, mutex/completion/wait, worker/workqueue, delayed work, timer, device/refcount and driver-binding, PCI/IRQ/MMIO, clock, error and logging contracts. Their cancellation, concurrency, memory-order and sleepability semantics must match the imported components. Avoid a second general native device manager: native PnP owns PCI discovery; Linux's device graph owns imported USB/HID/SCSI children. Test allocation failures, work cancellation, timer teardown, interrupt/thread context, DMA rundown and exactly-once callbacks independently before relying on the runtime.

P2.3 — External object/authority boundary. Native PnP initiates physical xHCI controller binding; the imported USB graph owns root hubs, downstream devices, interfaces, endpoints and URBs. Translate only at deliberately narrow native publication boundaries: Linux input event -> native KeInput/RSSRV and Linux SCSI disk -> native DEVICE_OBJECT/disk I/O. Keep Linux URB/HID/SCSI/block structures private. Derive errors and rights explicitly; assign references on both sides; stop publication and new I/O before draining callbacks on removal. Avoid native filesystem dependencies on Linux bio, gendisk, or SCSI command internals.

P2.4 — Native disk substrate prerequisite. Remove the eight-disk registry limit and uint8_t identity constraint; adopt reusable generation-safe device identities. Publish logical/physical sector geometry, capacity, alignment, flush/removal and transfer limits. Remove 512-byte assumptions from disk I/O and GPT/MBR discovery; verify native AHCI/ATA remains functional. Test 512/4096-byte devices, partitions, disappearing devices, simultaneous operations and stable system-volume selection.

P2.5 — Linux USB core and xHCI together. Retain upstream HCD/URB, command and transfer ring bookkeeping, TD completion matching, endpoint state transitions, cancellation, command timeout/recovery, protocol-based USB2/USB3 root hubs, external hubs, hub routing and TTs, composite/alternate configurations, interrupt/bulk/control/isoc and streams where enabled. Integrate native PCI, DMA, MSI/IRQ and module lifecycle beneath the Linux USB model. Avoid placing the old nt-lite URB model between Linux USB and Linux xHCI. Begin with QEMU controllers and hub topology, then enumerate/transfer/fail/recover on both AMD machines. Use traced TRB/completion and device path evidence rather than timing workarounds.

P2.6 — Linux SCSI and block. Port the SCSI host/device/LUN midlayer, command lifecycle, sense/error/timeout recovery, SCSI disk upper layer (sd) and required blk-mq/request infrastructure. Prefer upstream block privately inside the imported storage stack. If blk-mq imports disproportionate unrelated kernel machinery, rewrite only the block-facing queue adapter while preserving SCSI ordering, asynchronous completion, timeout and recovery guarantees. Validate first with a synthetic SCSI host: INQUIRY, TEST UNIT READY, READ CAPACITY, READ/WRITE, SYNCHRONIZE CACHE, multi-LUN, injected errors and hot-remove. Publish a disk through the native adapter only after this path works end to end.

P2.7 — USB-storage and UAS. Import the Linux Bulk-Only Transport drivers, transport helpers, device quirks and UAS where stream/queue semantics are ready. Feed Linux SCSI rather than a parallel native command implementation. Test direct and hub-attached media; multiple disks/LUNs; read/write/flush; disconnect while busy; reconnect; reset; shutdown. Boot-critical SCSI, USB and host-controller modules must be available from EFI/bootstrap media before the configured system volume is mounted.

P2.8 — Linux HID and input. Port the HID core and generic report parser, usbhid, necessary input event core and required key/mouse/multitouch mappings. Decode real report descriptors and composite interfaces rather than relying solely on boot protocol or QEMU device shortcuts. Map Linux input codes to nt-lite's native usage/event representations at one boundary; retain RSSRV's focus/capture/session and typematic policy. Support LEDs/output reports, mouse motion/buttons/wheel, disconnect release of pressed state and multi-device use. The secondary interface of a working USB keyboard must have an explicit supported or correctly scoped outcome, without making the functioning boot interface fail.

P2.9 — Physical input follow-on. Evaluate importing i8042, serio, atkbd and psmouse for the ThinkPad's internal keyboard and TrackPoint; rewrite only a narrow host/interrupt adaptation when useful. Evaluate Linux I²C host/core, i2c-hid and HID multitouch for AMDI0010:01 / ELAN0676; use ACPI-described resources and interrupt/power methods. These devices feed the same canonical input path. Retain the ACPI PNP0C0C/AML power-button gap as independent platform work; consider ACPICA before authoring a new AML engine. No xHCI patch can fix that firmware-control path.

P2.10 — Module graph, builds and distribution. Provide real dynamic ownership boundaries: internal Linux runtime, USB core/HCD, xHCI, HID, input, SCSI/required block support, usbhid, USB-storage/UAS. Combine units when upstream ownership and linkage make a separate DLL artificial; do not force module count for its own sake. Update imports/exports, driver requires/after, source builds, packaging, runtime discovery, bootstrap preload, shutdown and unload rundown together. Linux device enumeration is an asynchronous runtime event, distinct from driver DriverEntry readiness. No hidden dependency cycle through the USB boot volume.

P2.11 — Verification and deliberate cutover. Require synthetic concurrency tests, QEMU enumeration/hub/transfer tests, hardware tests on the desktop 03:00.0 (1022:43d5) and 28:00.3 (1022:149c), and all four ThinkPad xHCI functions (1022:15b9/15ba/15c0/15c1). Validate physical/USB2/USB3 mapping, mixed-speed hubs, the desktop's two hubs with wired keyboard, Logitech receiver, Bluetooth dongle and storage, and ThinkPad direct/hub-connected input/storage. Stress concurrent URBs, timeout, endpoint reset, hotplug, I/O cancellation, sleepable/IRQ context and shutdown. Measure throughput and tail latency rather than presuming an upstream port will automatically be faster. Delete bespoke USB enumeration, controller, HID and storage code and stale APIs after the Linux-derived path passes acceptance. Retain no permanent shadow enumeration path.

P2.12 — Upstream maintenance. Record original source hashes, local adaptation patches, component decisions, test ownership and imported licenses. Track security fixes, protocol fixes and AMD controller quirks against the pinned release; review dependency changes when updating. Keep the imported source materially recognizable to upstream wherever possible.

Phase 2 acceptance: QEMU boots and enumerates keyboard/tablet/storage; both real machines boot reliably with the previously failing hub topologies; direct and behind-hub control/bulk/interrupt transfers work; generic HID/Unifying input reaches RSSRV; storage survives multiple LUNs and abort/reconnect tests; native disk geometry/partition discovery is correct; shutdown/reboot drain owned DMA and callbacks. ThinkPad PS/2/TrackPoint, I²C touchpad and AML power button retain their separately tracked hardware/platform gates. A release with only syntax checks, successful module loading or direct-device enumeration leaves this phase open.

Phase 3 — Parallel graph startup and native service manager

Status: dependency-graph foundation implemented for drivers; concurrency, service policy and remaining lifecycle work open. Its service design work may proceed in parallel with Phase 2 import feasibility, while shared module/runtime and authorization decisions are coordinated.

Driver initialization

• Evolve the existing drivers.ini v2 manager—not another parser—into a bounded graph worker scheduler. Start independent drivers concurrently, with exact- and class-level requires/after semantics unchanged. Deterministic eligibility and reporting do not require deterministic completion order.
• Protect image loading, import/export/module registries and module-state transitions with precisely scoped synchronization. Distinguish module DriverEntry completion from runtime device readiness. Preserve boot-critical storage availability, PnP/device ownership, failure propagation, and reverse-order shutdown. Recheck imported xHCI/USB/SCSI module startup, AHCI, PS/2, HDA, PCI and network on SMP hardware.
• Preserve the soft NIC-first behavior: a network stack may wait for the adapter class to settle (after=network-adapter) rather than fail if no NIC works. No file-order coupling.
• Driver start=demand, unload/reload, and optional cascade reload are later extensions, not prerequisites to making service demand startup work. Before unloading images: block new binding, quiesce owned device stacks, drain IRPs/DPCs/timers/threads/IRQs/DMA, and prove no import/executable references remain.

Simpler services.ini

• Adopt the useful dependency model of drivers.ini: stable service IDs ([service.id]), optional display name, image, requires, after, optional classes, strict whole-file validation and cycle rejection. Defaults should eliminate mandatory noise; omit type entirely. Services may have no published endpoint.
• Support start=auto|delayed|demand|disabled. delayed becomes eligible after the interactive session is usable, not after an arbitrary sleep. Demand services start through explicit authorized management requests and optional declared resource/connection activation. Coalesce simultaneous activations into one startup attempt; never start a disabled service through dependency resolution.
• Startup is dependency-driven and concurrent. Launch all currently eligible services before waiting for READY; collect asynchronous READY/exit/timeout events. Do not bind the long-term manager to one fixed 32-handle WaitMany array. Failed requires blocks dependents; after only waits for settlement. Shutdown stops in reverse graph order and prevents new demand activation.
• Per-service restart policy: never|on-failure|always plus optional retry limit, time window, initial delay, backoff scheme and maximum delay. Avoid hard-coding one 3-in-5-minutes policy for all services. Prevent restart storms, exclude deliberate stops, and define failure behavior for exhausted budgets. DWM restarts only once window/client reconstruction or explicit-loss semantics are defined.
• Expose human-readable name, stable service identity, status, reason for waiting/failure, and explicit service administration. The service manager's control plane is separate from ordinary client access to a service Port.
• Resource publication: /Services is an RSSRV-owned resource namespace, not a disk directory. Declare publication/activation endpoints explicitly where useful; the desktop session endpoint is separate (e.g. /Sessions/0/Desktop). Document this in a dedicated short service/namespace specification, not misleading comments in the INI.
• RSSRV remains generic: configuration declares a namespace-provider role/resource contract, critical=true, and narrowly defined bootstrap capabilities. Init gives the designated provider the primordial namespace/bootstrap handles via a generic descriptor-driven mechanism. No magic [service.rssrv], type=resource, or privileged image-name comparison. Resolve the one-provider/bootstrap-cycle invariant explicitly in the schema/validator.
• Privileges: parse named privileges into a derived immutable service security context; separately grant handles/capabilities with scoped rights (storage, Port publication, display/session, network where needed). An ordinary database service must not inherit RSSRV authority. Enforce who may configure, activate, query, stop, or reconfigure services. Integrate later with SEC principals/ACLs rather than inventing an alternate security framework now.
• Move the session image selection out of [init] commandline in boot.ini into init-owned configuration (for example [session] image=...). Define executable path separately from future command-line arguments. Keep boot.ini for EFI/bootstrap selection and kernel diagnostics; no Windows Boot Manager clone.

Illustrative policy only; final grammar needs a small design review:

[session]
image=apps/shell_native.exe

[service.namespace]
name=Resource Service
image=system/rssrv.exe
class=resource-namespace
critical=true
privileges=resource-admin

[service.posix]
name=POSIX Server
image=system/posixsrv.exe
requires=namespace

[service.dwm]
name=Desktop Window Manager
image=system/dwm.exe
requires=namespace

[service.mysql]
name=MySQL Server
image=apps/mysql.exe
start=demand
requires=posix
privileges=network

mysql is an example of service policy, not a claim that the program already runs; its writable database storage should be delegated as a scoped resource. The example resource-admin and role syntax are provisional: use existing native privilege/capability vocabulary rather than freeze arbitrary new policy names.

Acceptance: independent drivers and services visibly overlap in timestamped logs; dependency failures and shutdown remain correct; services can be auto/delayed/demand/disabled; resource activation deduplicates; per-service restarts obey their own budgets; RSSRV and ordinary services share one lifecycle mechanism but different delegated authority; configuration is shorter and self-explanatory.

---

Deferred work after the three active phases

These are still outstanding. The previous roadmap's detailed designs should not be mistaken for implemented behavior. Resume in dependency order, not by the age of its section numbers.

D1 — Native filesystem substrate: KFS.1–KFS.7

Do this before POSIX P8 and before attaching durable ACL identity.

• KFS.1: refcounted native file-backing identity separate from each FILE_OBJECT/open description; key by mounted volume + stable provider file ID + generation where available; coherent shared file size/page cache/mapping/security across aliases/opens.
• KFS.2: unlink removes a directory link while live open/mapping references retain backing until final release.
• KFS.3: genuine capability-relative hard links, stable link counts; native cross-volume status; NTFS/ext4 providers where supported; FAT may report unsupported.
• KFS.4: atomic rename replacement where supported and canonical cross-volume failures.
• KFS.5: generic metadata setter and UTC persistent timestamps, without repurposing system-clock/provenance structures.
• KFS.6: native directory enumeration reset/restart without pathname reopen.
• KFS.7: focused provider/runtime validation of independent opens, aliases, mmap/page-cache coherence, unlink lifetime, hard links, replacement, timestamps and directory iteration.

D2 — Native security: SEC.0–SEC.15

Native authorization remains capability-first. Keep userspace account identities separate from kernel principals; do not claim full inter-process memory protection under shared-PML4 SASOS.

• SEC0/1: threat boundary and rights taxonomy; stable opaque principal IDs and immutable/materialized security contexts with groups, privileges, restrictions and audit identity.
• SEC2/3/4: one native security descriptor with owner, owning group, allow/deny ACL, creation templates; matching denies win independent of ACE order; authorize capability acquisition through the object manager. Ownership grants authority to mutate security policy, not implicit read/write of data.
• SEC5–9: provider contract, ext4/NTFS translation, creation-time inheritance, owner/security mutation; metadata lives with coherent file backing. Existing granted capabilities survive ACL changes unless explicitly revoked.
• SEC10/11: separate named privileges and derived restricted contexts; don't introduce Unix root as a kernel special case.
• SEC12/13: user-mode accounts/authentication/password storage and kernel-stamped audit with userspace persistence/filtering.
• SEC14/15: process/device/IPC/service authorization sweep and POSIX/Win32 personality mapping.

Phase 3's service-specific privilege/capability grants must be designed to extend naturally into SEC rather than build a second authorization regime.

D3 — Finish POSIX personality: P8–P10

P0–P7 complete; preserve the existing posixsrv-owned stable PID, non-fork execve, vfork, spawn/wait and signals design. fork() stays deliberately unsupported; do not add Unix kernel process semantics.

• P8 (after KFS/SEC): project native principal/ACL ownership and permissions into POSIX uid/gid/mode, chmod/chown/access; preserve umask as creation-time restriction; native hard-link/rename/timestamp/directory-reset APIs; FIFO namespace and rendezvous policy in posixsrv with native pipe data transport; correct errno and path/directory APIs.
• P9: POSIX tty/termios as userspace adapter over RSSRV console/session, canonical/raw input, echo, drain/flow, VMIN/VTIME, controlling tty and foreground process-group signaling (VINTR/VQUIT).
• P10: remaining leaf/profile APIs (uname, times, sysconf, pathconf/fpathconf, etc.), canonical status mappings, header/export/profile audit, removal of obsolete helpers. Validate the end-to-end spawn/pipe/signal/wait/exec scenario and deliberately unsupported operations.

D4 — Native desktop/session completion

• Represent the RSSRV-owned console as a DWM-managed surface/window. RSSRV keeps console state and session input authority; DWM owns graphical geometry, clipping, composition and physical presentation.
• Add native decorations, close lifecycle, move/resize, title/app identity, pointer capture, activation/focus/z-order rules, minimize/maximize policy, damage rectangles, occlusion and incremental composition; keep the CPU compositor as reference.
• Shell (taskbar/launcher/notifications/work area) is not DWM policy. Use explicit capabilities for privileged window enumeration/capture/input injection/secure surfaces and display control.
• Delete legacy application direct input/console/display APIs after the canonical RSSRV/DWM route is complete; choose an explicit DWM crash/restart model (reconstruct state or invalidate/reconnect clients). Native UI toolkit/theme can follow.

D5 — Loader, native runtime, and personalities

• Finish cross-personality KSTATUS to POSIX errno / Win32 LastError mapping; keep one mapping owner per personality.
• Identify loaded modules by resolved backing-file/object identity, with aliases and import/reference ownership; prerequisite to reliable kernel module unload and CRT aliases.
• Use PE32+ subsystem to select native (1), Win32 GUI/CUI (2/3), or POSIX marker (7). Win32 userspace bootstrap creates its PEB/TEB shim and uses generic persistent per-thread FS/GS bases; native and POSIX remain on their existing TEB layout. Do not introduce personality-specific kernel scheduler state.
• Split crt.dll, posix.dll, and Win32-facing libraries along true ownership boundaries; add thin USER/GDI translation to native DWM/surfaces only when the native desktop is mature.

D6 — Driver on-demand lifecycle, observability, and cleanup

• Complete module import/reference accounting and PnP-owned device/worker/DPC/IRP/IRQ/DMA quiescence before any actual unload; then exact-driver reload and optional cascade reload over the same graph.
• Add start=demand for drivers, activated by PnP IDs, authorized management requests, or dependency demand, not by a parallel private graph.
• Structured native read-only driver/class status and wait/failure causes; no requirement to scrape DbgPrint for management.
• Complete justified driver decomposition (upstream-derived USB submodules, NTFS glue, VMware SVGA hardware vs generic raster), remaining input typematic cleanup, and future power/hotplug lifecycle testing.

D7 — Debugger and compatibility/graphics research

These are intentionally not prerequisites for boot, service cleanup, KFS, or POSIX completion.

• Minimal serial KD: debugger-owned polling UART independent of normal serial driver; KD packet/ACK/resend, context/memory/breakpoint/single-step, panic/break-in, SMP stop/release, minimal module/PDB metadata, first verified against WinDbg/QEMU. No need for KDNET initially.
• Native 2D/text and graphics split: mapped kernel surfaces remain canonical. Userspace 2D and Unicode font/shaping/raster layers, software reference raster; hardware miniports own modes, VRAM, scanout, DMA/fences; optional validated batched acceleration stays behind generic graphics abstractions.
• USER/GDI and X11: future Win32 USER/GDI wrappers map to native DWM/RSSRV/surfaces; x11srv is a userspace X protocol server (nested and rootless modes) with native capture/focus authority preserved. Neither redefines kernel surfaces.
• Networking and compatibility drivers: neutral native NET_DEVICE/packet contract; eventual protocol stack in userspace where practical; NDIS 6 Ethernet miniport experiment only after native mechanics stabilize; proprietary/vendor Wi-Fi work preferably as clean native hardware/firmware ports with userspace wifisrv. A future NVIDIA/GSP/Mesa/NVK experiment must consume nt-lite GPU APIs rather than impose Linux DRM as the native ABI.

---

Verification and handoff rules

• Boot: record source revision/patch set, machine, firmware, debug mask, --with-tests mode, wall-clock start/end definition, and timestamped kernel log. Keep cold/warm comparisons distinct. The ~8-second result is the latest user report, not a universal target or a subsystem timing profile.
• Hardware: validate each controller/port/hub/interface separately and capture the first failing stage. For imported USB/xHCI/SCSI/HID ensure timeout, disconnect, cancellation, DPC, I/O, remove, shutdown and reboot ownership. Include both desktop external hubs and ThinkPad 046d:c52b/09da:2268, plus USB storage directly and behind hubs.
• Concurrency: stress dependency cycles/failure/settlement, deterministic selection, ready-event races, service activation coalescing, cancellation and reverse shutdown—not only a clean boot. Do not restore mandatory stress tests to the boot path.
• Services/security: prove a minimally privileged database-like service cannot obtain RSSRV namespace management, display, input, raw storage or shutdown capabilities; explicit granted handles work; only authorized callers can control services.
• KFS/SEC/POSIX: preserve file/provider identity across rename/unlink and native capability rights; run the focused filesystem, security and POSIX integration suite in development builds.
• Code baseline: use a newly provided current source tree when starting implementation. Earlier chat archives, code(5).zip, and prior cumulative patches may not represent the user's latest checkout. Never call a patch 'built' when only git apply --check, a syntax check, or a standalone model has passed.

Next work item — docs/services.md contract review

Review the revised service architecture against init/service_config.{h,c}, init.c, services.ini, service_control.h and RSSRV namespace/publication code. Agree the minimal grammar and authority/bootstrap contracts before changing the service ABI. First choices: how a service declares the unique namespace-provider role, how config requests audited named privileges versus capability grants, and how READY exports name resources without service-type adapters. Then implement a strict parser and deterministic graph validator, followed by event-driven parallel startup, demand activation, restart budgets and management authorization. Keep service boot independent from the Phase 2 imported USB device model: drivers remain driver-manager/PnP objects, not ordinary user-mode services.

Parallel Phase 2 first action: pin Linux source and complete the compiler/ABI + minimal-runtime feasibility gate before large-scale driver import.