1.  Data flow direction is structural.
    Forward data flow defines scope; faults propagate against it.

2.  Instance is the unit of state.
    Always Image-bound. Persistent state = cnode contents.
    Image (Cap::Image) is the spec; cnode contents are the state.

3.  Caps are values; cnode is a table of values.
    Slots reference Instance values by hash. Slots only update at apply
    termination.

4.  Caps are uniformly copyable.
    All five cap kinds (Instance, Image, Data, CNode, Type) are
    content-addressed copyable. No kernel-level linearity. Conservation
    of resources lives in authority bytecode; structural forgery
    resistance comes from image_hash chain.

5.  Memory is static, declared by Image.
    Two purposes: ro reference data (Image-baked or pinned cnode
    DataCaps) and rw working/persistent areas (mapped via cnode
    DataCap slots). No dynamic mapping; no lazy paging.

6.  Apply is a pure function.
    apply : (input, state, scratchpad) → (new_state, reply, emits)
            | yield(slot, reason)
            | fault.
    No side effects during execution. Effects are encoded as outputs.

7.  Sub-tree atomicity is structural.
    A's HALT commits everything A did including changes to sub-Instances
    A owns. A's fault discards all of it. By-value with slot-only-
    updates-at-termination.

8.  CALL is the only invocation primitive.
    CALL_RESUME and DROP_PAUSED handle Paused Instances. No CALL_TO.

9.  slot[0] is the universal scratchpad channel.
    All inbound/outbound payload between instances flows through slot[0].
    CALL/CALL_RESUME move caller's slot[0] into target's slot[0]
    (down). HALT/yield/fault reflect target's slot[0] back to caller's
    slot[0] (up). host_yield takes only a marker reference (a
    Cap::Instance whose instance_hash is the routing key — see §14); the
    marker's payload reflects via slot[0]. Apply discipline: keep
    slot[0] in a safe-to-reflect state at all times (OOG can yield
    at any instruction; mid-mutation states would expose partial
    data).

10. OOG is just kernel-triggered host_yield with the kernel-issued
    OOGMarker (§4). Captures continuation; reflects a
    Cap::Instance[Gas{meter_id}] payload to caller; caller typically
    SetGasMeter's a topup and CALL_RESUMEs.

11. Saga is for peer coordination only.
    Sub-Instance ownership is structurally atomic. Saga (emit +
    on_failure) covers the case where A doesn't own B.

12. Gas accounting is STM-exempt.
    Debited at every termination (HALT, yield, fault) regardless.
    Validators are paid for compute they performed.

13. Encapsulation = data-flow isolation + trusted apply.
    Two related properties; they apply at different levels.

    (a) Data-flow isolation. An Instance can only access caps that have
        flowed to it via legitimate cap-flow. Siblings, parents, and
        unrelated Instances are structurally unreachable.

    (b) Trusted apply. An Instance's state changes only via running its
        Image's bytecode. Kernel-enforced; no ABI op writes content
        into another Instance's state. Load-bearing at levels where
        state encodes authorization (orchestrators).

    INTEGRITY, not confidentiality (σ is public). What makes
    sandbox, replay, trustless composition, and the orchestrator-
    mediated authority pattern (§14) work.

14. Image is mutated as a unit; set_image is a "push".
    The only on-self spec-changing primitive is
    set_image(new_image: Cap::Image). Each set_image:
      - swaps pinned slots (from old image's to new image's),
      - installs new_image as current,
      - updates image_hash = hash(self.image_hash || hash(new_image)).
    Lineage chain extends; it does not contract.
    No host_set_code / host_set_endpoints / etc. — those would let
    userspace mutate spec piecewise, breaking atomicity.
    Sub-type Instance creation uses host_derive_spawn (spawning a fresh
    Instance with chosen image), which extends the chain on the *spawned*
    Instance, not self. Same-type Instance creation uses MGMT_COPY (preserves
    image_hash; content-shared copy).

15. Pinned slots are per-Image, not per-Instance.
    Image.pinned_slots declares which cnode slots hold pinned ro caps
    (Cap::Data or Cap::Image — content-addressed copyable kinds).
    They're part of the program's spec: LLVM jump tables, baked-in
    constants, Cap::Image references for derive_spawn, etc.
    set_image swaps pinned slots atomically with the rest of the spec.

16. image_hash captures lineage as a cumulative chain hash.
    Canonical formulae:
      genesis:                  image_hash = hash(initial_image)
      after set_image(new):     image_hash = hash(image_hash_before
                                                   || hash(new))
      via derive_spawn(new):    spawned.image_hash =
                                  hash(spawner.image_hash || hash(new))
      via MGMT_COPY:            copy.image_hash = source.image_hash
                                  (preserved, not extended)
    Forgery resistance: post-extension hashes are recursive and never
    equal hash(any single Image). Only genesis Instances have image_hash
    of the form hash(Image). Cap-flow on the genesis Kernel Instance +
    cap-runtime integrity prevent adversary from producing Instances with
    canonical image_hash chains.

17. Type query is semantic, not raw; types are identification, not
    authorization.
    Userspace cannot read raw image_hash. Two type-query host calls:
      host_same_type(a, b)
                  — image_hash equality between two caps the caller
                    holds.
      host_same_type_as(comparer, comparee, [images])
                  — relative-chain comparison: returns true iff
                    comparer's image_hash equals the hash chain
                    extension of comparee's image_hash through the
                    given Cap::Image derivation steps.
    Plus the Cap::Type primitives (host_type_of, host_subtype,
    host_type_eq) for working with types as caps. See §8.
    
    **Type queries identify; possession authorizes.** Two Instances
    being "the same type" doesn't grant authority. Authority requires
    possession of Cap::Instance (the actual instance) used per the
    yield-marker pattern (§14, userspace/generic-authority-pattern.md).
    Raw image_hash and full lineage walking are not exposed; if
    needed, chains track
    ancestors in their own state.

18. Authority within σ is conveyed by capabilities.
    σ is public, but caps in v3 are not bearer tokens whose security
    depends on secrecy — their unforgeability is structural via
    image_hash chain (§16 principle) plus cnode ownership discipline
    (§13). Authority is expressed by minting EndpointRefCap-style
    caps and granting them via cap-flow (§14). Possession = right
    to invoke; intermediates can route but cannot inspect endpoints
    that gate on caller-witness image_hash. No σ-resident signing
    keys; no per-user ACL tables.

19. Instance creation is via MGMT_COPY (for siblings) and host_derive_spawn
    (for sub-types).
    Cap::Instance is uniformly copyable; new Instances are produced by:
      - MGMT_COPY of a Cap::Instance:   content-shared copy with the
                                     same image_hash. Mutations to
                                     either ref diverge per §9 case
                                     (b). For "same type with fresh
                                     state", caller follows MGMT_COPY
                                     with a CALL into an image-defined
                                     setup endpoint.
      - host_derive_spawn(image, cnode):
                                     new image; image_hash chain
                                     extends from self. For sub-type
                                     creation (user contract
                                     instantiation, authority chains,
                                     etc.). Only callable from within
                                     self's apply; consumes the cnode
                                     arg.

20. Instance's root cnode is fixed at 256 slots.
    Variable-size storage uses Cap::CNode (size = 2^k slots; minted
    via host_mint_cnode). Cap::CNode is uniformly copyable; copying a
    populated Cap::CNode produces a content-addressed share.

21. Authority + Subject pattern for issued resources.
    Authority Instances (Kernel, MintInstances, chain-defined issuers) are
    held by the chain orchestrator. They mint Subject Instances via
    host_derive_spawn or by issuing typed handles. Subjects can be
    cloned via MGMT_COPY (content-shared) where applicable; for
    resource splitting, the operation routes to the authority's
    bytecode (or kernel, for kernel-assisted resources) which
    allocates a new ledger entry and constructs the new handle.
    Conservation is enforced by the authority's bytecode + ledger
    (or by kernel-internal tables for kernel-assisted resources, per
    principle 22).

22. Kernel resources are exposed via the kernel-assisted Instance
    pattern.
    Where the kernel needs to maintain state that userspace interacts
    with (yield routing, gas accounting, storage accounting, future
    kernel-mediated operations), that state lives in an Instance whose
    Image is in a kernel-reserved namespace (e.g.,
    `kernel:yieldcatcher`, `kernel:gasmeter`). Properties:
      - Userspace sees a regular Cap::Instance; cap-flow works uniformly.
      - The Image is kernel-implemented in native code (no userspace
        bytecode runs); the state layout is a kernel-known struct.
      - The kernel may short-circuit access to the state during the
        fast path (e.g., per-instruction gas debit) — but the
        abstraction at the user-facing level is plain Instance.
      - Some kernel-assisted Instances live in user Instances' cnodes
        (e.g., YieldCatcher held in an Instance's `yield_marker_slot`);
        others are kernel-internal and never appear in chain hands
        (e.g., GasMeter, StorageQuota — accessed only via kernel-
        issued caps like SetGasMeter).
      - Unit handles into kernel-internal tables (Gas{meter_id},
        Quota{quota_id}) are regular Cap::Instance; conservation lives
        in the kernel-internal table, so cap copies don't multiply
        balance.
    See [discussions/kernel-assisted-instances.md](discussions/kernel-assisted-instances.md)
    for the full design and rationale.

Instance {
  image_id:    ImageHash      -- hash of current Image
  cnode:       RootCNode      -- fixed 256 slots; caps as values;
                              --   persistent state (pinned slots are
                              --   populated from Image.pinned_slots;
                              --   non-pinned slots are mutable state)
  status:      Idle
             | Paused {
                 regs:           ...
                 pc:             u64
                 yield_marker:   Cap::Instance  -- the marker yielded with
               }
             | Faulted { fault_info }

  -- derived (kernel-attested):
  image_hash:    Hash         -- canonical formulae:
                              --   genesis: hash(initial_image)
                              --   after set_image(new):
                              --     hash(image_hash_before || hash(new))
                              --   via derive_spawn(new, cnode):
                              --     spawned.image_hash =
                              --       hash(spawner.image_hash || hash(new))
                              --   via MGMT_COPY of Cap::Instance:
                              --     copy.image_hash = source.image_hash
                              --       (preserved; not a chain extension)
}

RootCNode {                   -- the Instance's root cnode (fixed 256 slots).
  slots:         [Option<Cap>; 256]
}

CNode {                       -- variable size in Cap::CNode (2^k slots).
  slots:         [Option<Cap>; SIZE]
}

Image {                        -- content-addressed; Cap::Image kind
                               -- the smallest unit of program specification
  code:            Bytes            -- bytecode embedded directly
                                    -- (validated at Image construction:
                                    --  parseable; no malformed instructions)
  memory_mappings: [MemoryMapping]
  endpoints:       [Option<EndpointDef>; 256]
  gas_slots:       [SlotIdx]        -- slots that hold Cap::Instance[Gas{meter_id}]
                                    -- (kernel-assisted Instances; see §22).
                                    -- Kernel debits the meter named by the
                                    -- active gas slot while this Instance runs.
                                    -- Convention: gas_slots[0] = primary
                                    --  meter; subsequent entries are
                                    --  fallback reserves (chain-spec policy).
  quota_slots:     [SlotIdx]        -- slots that hold Cap::Instance[Quota{quota_id}]
                                    -- (kernel-assisted Instances; see §22).
                                    -- Kernel debits the named quota when
                                    -- pages are dirtied by this Instance.
                                    -- Convention same as gas_slots: [0] is
                                    --  primary; rest are fallback reserves.
  pinned_slots:    Map<SlotIdx, ContentAddressedCap>
                                    -- pinned ro caps that the program
                                    -- needs. ContentAddressedCap ∈
                                    -- { Cap::Data, Cap::Image }:
                                    --   Cap::Data: LLVM jump tables,
                                    --     baked-in constants, etc.
                                    --   Cap::Image: derive_spawn target
                                    --     images for authority Instances.
                                    -- All slot indices in [0, 256).
  yield_marker_slot: Option<SlotIdx>
                                    -- The slot in the Instance's cnode that
                                    -- holds Cap::Instance[YieldCatcher] — a
                                    -- kernel-assisted Instance (see §22)
                                    -- whose state is the list of markers
                                    -- this Instance catches. On YIELD, kernel
                                    -- walks the call stack and consults each
                                    -- Instance's YieldCatcher via short-circuit
                                    -- (no endpoint dispatch), matching by
                                    -- instance_hash equality.
                                    -- See §4 (host_yield) and §14 (yield-
                                    -- marker authority pattern).
                                    -- None = this Instance catches no yields.
}

MemoryMapping {
  start:   u64                  -- virtual address; MUST be 4 KiB-aligned
  size:    u64                  -- bytes; MUST be a multiple of 4 KiB
  source:  Persistent(SlotPath) -- cnode-DataCap-backed; mutations COW'd
        |  Ephemeral            -- kernel-allocated per-apply; not in cnode;
                                --   captured into Paused on yield
}

-- Page-alignment rationale: DataCap content is page-multiple by
-- construction (see §2). Page-aligning mappings lets the kernel map
-- DataCap pages directly into ring-3 page tables without copying
-- bytes through an intermediate per-call buffer. Pinned-RO mappings
-- of the same DataCap across multiple Instances share physical pages.

EndpointDef {
  entry_pc:          u64
  initial_registers: ...
  arg_registers:     ...
  arg_cnode_size:    u8
}

set_image(new_image: Cap::Image) → ()
  Pre: caller is running an apply on self.

  Kernel:
    1. Pinned-slot diff:
       old_pinned = self.image.pinned_slots.keys()
       new_pinned = new_image.pinned_slots.keys()

    2. Clear old pinned slots:
       For each idx in old_pinned:
         self.cnode[idx] = (empty)

    3. Install new pinned slots:
       For each (idx, ro_cap) in new_image.pinned_slots:
         if self.cnode[idx] is non-empty:
           FAIL — collision (caller has non-pinned content where
                  new image needs pinned).
         else:
           self.cnode[idx] = ro_cap
           (kernel may optimize as content-shared reference)

    4. Update image:
       self.image_id = hash(new_image)

    5. Update image_hash chain:
       self.image_hash = hash(self.image_hash_before || hash(new_image))
       (kernel-attested; chain extends)

    6. New image's spec takes effect at next CALL.

Kernel: image_id = hash(KernelImage), image_hash = hash(KernelImage)

Property A: image_hash = hash(Image_X) for some Image X
  ⟺ this is THE genesis Instance for Image X
    (or a MGMT_COPY descendant that preserved hash(Image_X)).

Property B: image_hash = hash(some_image_hash || hash(Image_X))
  ⟺ this Instance was produced via set_image(Image_X) on an Instance with
    image_hash = some_image_hash, OR via host_derive_spawn(Image_X, ...)
    by a spawner with image_hash = some_image_hash, OR is a MGMT_COPY
    descendant of either.

Property C: image_hash chain rooted at hash(KernelImage)
  ⟺ at some point, this Instance's lineage traced through the genesis
    Kernel Instance.

host_same_type(a: SlotPath, b: SlotPath) → bool
  Returns true iff a.image_hash == b.image_hash.

host_same_type_as(
    comparer: SlotPath,
    comparee: SlotPath,
    images:   [SlotPath of Cap::Image]
) → bool
  Returns true iff:
    comparer.image_hash == fold_left(
      images, comparee.image_hash,
      (acc, img) -> hash(acc || hash(img))
    )
  i.e., comparer is what you'd get by deriving comparee through the
  given Image steps. Relative-chain comparison; comparee must be a
  Cap::Instance (anchor relative to known reference); absolute Cap::Image
  anchors are deliberately not supported.

Image declares:
  memory_mappings: [
    {start: 0x10000, size: 64KB,  source: MainCnode[3]}    -- pinned (ro)
    {start: 0x20000, size: 1MB,   source: Persistent(MainCnode[5])}  -- unpinned (rw)
    {start: 0x120000,size: 16MB,  source: Persistent(Scratchpad[5])} -- caller-provided
    {start: 0x800000,size: 8MB,   source: Ephemeral}                 -- stack/scratch
  ]
  cnode initial state (at construction):
    [3] = Cap::Data(BAKED_RO_BYTES)           -- baked-in ro data
    [5] = Cap::Data(EMPTY)                     -- mutable working area
    ...
  pinned_slots = {3: Cap::Data(...), ...}

DataCap {
  content: Bytes              -- length is always a multiple of 4 KiB
}

hash(DataCap) = hash_tree_root(content)

DataCap.content.len() = N      (both 4 KiB-multiples)
region.size           = S      (both 4 KiB-multiples)

if N == S:  direct page-by-page mapping.
if N <  S:  map the N bytes of the DataCap; map the remaining S − N
            bytes from the shared global zero page (RO).
if N >  S:  CALL faults. Caller is responsible for sizing.

At HALT:
  If apply explicitly replaced the source slot via cap-table ops:
    Use the replaced cap. Discard memory modifications from this region.
  Else if any pages in the region are dirty:
    Mint a new DataCap whose content is the modified pages verbatim
      (page-multiple, no trailing-zero stripping). Place at source slot.
  Else:
    Source slot unchanged.

Apply:
  ... uses scratch region during execution ...

  -- Before HALT:
  reset(VOLATILE_SLOT, empty_DataCap)
  HALT

host_read_data_cap(cap, dst_offset, len) → actual_len
  -- copy bytes from a DataCap into a writable mapped region.

host_mint_data_cap(src_offset, len) → DataCap
  -- read bytes from any region; strip trailing zeros; mint a fresh
  -- DataCap; debit StorageQuota ledger entry of self's quota slot.

Apply:
  At apply start: HEAP region zeroed.
  Allocator operates over the region.
  At HALT/fault: heap discarded.
  At yield: heap captured into Paused.volatile_bytes.

            spawn          CALL @ endpoint        HALT
   ────────────────► Idle ─────────────────► [apply runs] ──► Idle (new value)
                        ▲    ▲                   │  (target.slot[0]
                        │    │                   │   reflects to caller)
                        │    │                   │
                        │    │                   │ host_yield(marker)
                        │    │                   │   OR kernel OOG (= yield
                        │    │                   │   to OOG-marker)
                        │    │                   │ (target.slot[0] reflects
                        │    │                   │   to caller-handler; per
                        │    │                   │   discipline, slot[0]
                        │    │                   │   is in a safe state)
                        │    └───────────────────┤
                        │   CALL_RESUME(target): │  capture continuation
                        │   caller's slot[0]     │  (regs, pc, marker)
                        │   moves into target's  │
                        │   slot[0]              │
                        │                        ┴
                        │                     Paused
                        │                        │
                        │                        │ panic / illegal access /
                        │                        │ memory fault / etc.
                        │                        │ (target.slot[0] reflects
                        │                        │  to caller; then target
                        │                        │  dropped)
                        │                        ▼
                        │                   Faulted (dead)
                        │                        │
                        │                        │ MGMT_DROP
                        ▼                        ▼
                     [N/A]                    [removed]

CALL(target: SlotPath, endpoint_idx: u8) → result
  Pre: target Instance is Idle.
  Effect:
    Caller's slot[0] moves into target's slot[0] (the scratchpad).
    Kernel pushes an InstanceEntry for target on the call stack.
    Kernel materializes mapped regions from cnode DataCaps.
    Apply runs; per-instruction gas debit comes from the meter
      named by target's active gas slot (see §22 and "Gas
      accounting" below).
  On HALT:    target ← Idle (new value); target's slot[0] reflects
              to caller's slot[0].
  On yield:   target enters Waiting on the call stack (or Paused if
              the yield is preserved across blocks); target's
              slot[0] reflects to caller's slot[0]; phi[7] holds the
              yield payload reference (typically a marker / unit
              cap copy).
  On fault:   target ← Faulted, then dropped; target's slot[0]
              reflects to caller's slot[0]; phi[7] = fault info.
  Return: phi[7] = (return value | yield payload ref | fault info);
          phi[8] = status.

CALL_RESUME(target: SlotPath) → result
  Pre: target Instance is Paused, or target is at the top of a Waiting
       chain on the call stack expecting resumption.
  Effect:
    Caller's slot[0] moves into target's slot[0] (same as CALL).
    Continuation restored; apply resumes from saved pc.
    Apply reads the response (caller's prepared scratchpad) from slot[0].
  Termination semantics same as CALL.

DROP_PAUSED(target: SlotPath)
  Pre: target Instance is Paused.
  target slot becomes empty (Instance and its cnode discarded).
  Caller's slot[0] unchanged (no reflection).

host_yield(marker: SlotPath)   -- does not return to apply
  Pre: marker holds a Cap::Instance (the yield marker; see §14).
  Effect:
    Read marker; compute marker.instance_hash.
    Walk kernel call stack from top (yielder) toward bottom (root).
    For each InstanceEntry F encountered:
      If F.image.yield_marker_slot is set, F's cnode at that slot
      holds a Cap::Instance[YieldCatcher] (a kernel-assisted Instance;
      §22). Kernel short-circuits into the YieldCatcher's state —
      its marker list — and tests each entry:
        If entry is Cap::Instance and entry.instance_hash == marker.instance_hash:
          Match. Push ReferenceEntry pointing to F. F resumes at its
          post-CALL continuation with the marker payload reflected
          into slot[0].
          Return; control transfers to F.
    No match found: fault yielder with "unhandled marker."

    Per slot[0] discipline: the yielder's slot[0] should be in a safe
    state before calling host_yield, since on resume it will hold the
    handler's response.

  Capture continuation (regs, pc) for the yielder.
  Yielder transitions to Waiting on the kernel stack.
  Gas debited for the yielder (STM-exempt; debited from the meter
    named by yielder's active gas slot).

  On CALL_RESUME from the handler:
    Caller-handler's slot[0] reflects to yielder's slot[0].
    Yielder's apply resumes from saved pc.
    Returns: phi[7..] = registered args; phi[8] = status.

Kernel-issued markers (placed in chain's initial YieldCatcher at
boot; see §12):
  OOGMarker             -- kernel-injected on gas exhaustion. Payload:
                           a Cap::Instance[Gas{meter_id}] copy naming
                           the meter that ran out. Nothing else (no
                           caller context — see "OOG payload" below).
  StorageExhaustedMarker
                        -- kernel-injected on quota exhaustion.
                           Payload: Cap::Instance[Quota{quota_id}] copy.

Chain-defined markers: per chain spec; minted by chain orchestrator
via host_derive_spawn and distributed via cap-flow.

host_read_data_cap(cap: SlotPath, dst_offset: u64, len: u64) → actual_len
  Copy bytes from the DataCap at `cap` into a writable region at
  dst_offset. Returns actual bytes copied (may be less than len if
  cap.size is smaller).

host_mint_data_cap(src_offset: u64, len: u64, quota_slot: SlotPath,
                   dst: SlotPath) → ()
  Read len bytes from any region starting at src_offset.
  Strip trailing zeros to get canonical content.
  Read quota_slot (holds Cap::Instance[Quota{quota_id}]); debit
    kernel-internal StorageQuota[quota_id] by stripped size.
  Mint a fresh Cap::Data; place at dst.

set_image(new_image: SlotPath) → ()
  Pre: caller is running self's apply.
       new_image at SlotPath holds a Cap::Image.
  Atomically swaps Image; updates image_hash chain (see §1).

host_derive_spawn(image: SlotPath, cnode: SlotPath, dst: SlotPath) → ()
  Pre: caller is running self's apply.
       image holds a Cap::Image.
       cnode holds a Cap::CNode of size 256.
       dst is empty.
  Effect:
    Constructs a fresh Instance:
      image:       (the Cap::Image at `image`)
      image_hash:  hash(self.image_hash || hash(image))   (chain extends)
      cnode:       initialized from input cnode's slots, with the
                   spawned image's pinned slots overlaid.
      status:      Idle
    Consumes the input Cap::CNode (Cap::Image is content-addressed
    copyable; reading it doesn't consume).
    Places Cap::Instance at dst.

host_same_type(a: SlotPath, b: SlotPath) → bool
  Returns true iff a.image_hash == b.image_hash.
  
  USE FOR IDENTIFICATION ONLY. Two Instances being "the same type" does
  not grant authority — possession of a Cap::Instance is what grants
  authority. See §14 for the proper authority pattern.

host_same_type_as(
    comparer: SlotPath,
    comparee: SlotPath,
    images:   [SlotPath of Cap::Image]
) → bool
  Returns true iff comparer.image_hash equals the chain extension
  of comparee.image_hash through the given Image derivation steps.
  
  USE FOR IDENTIFICATION ONLY. Same caveat as host_same_type: type
  matching is not an authority proof. Use Cap::Instance possession for
  authority.

-- Cap::Type ops (see §8 for Cap::Type definition):

host_type_of(instance: SlotPath, dst: SlotPath) → ()
  Pre: instance holds a Cap::Instance; dst is empty.
  Effect: extract the Instance's image_hash; place Cap::Type{image_hash}
  at dst.
  
  USE FOR IDENTIFICATION ONLY. Possession of Cap::Type does not grant
  authority equivalent to possession of Cap::Instance. See §8 and §14.

host_subtype(
    base: SlotPath,
    images: [SlotPath of Cap::Image],
    dst: SlotPath
) → ()
  Pre: base holds a Cap::Type; dst is empty; images are Cap::Images.
  Effect: compute the chain-extended image_hash:
    result_hash = fold(base.image_hash, hashes(images),
                       (acc, h) -> hash(acc || h))
  Place Cap::Type{result_hash} at dst.
  
  Pure computation. No Instance derivation. No authority granted.

host_type_eq(a: SlotPath, b: SlotPath) → bool
  Pre: a, b hold Cap::Type.
  Returns true iff a.image_hash == b.image_hash.

MGMT_COPY(src: SlotPath, dst: SlotPath) → Result
  Clone source cap into dst slot. All cap kinds are copyable.
  Rejects if source slot is `pinned`.
  Cost: O(1) (content-addressed; both slots reference the same hash).

MGMT_MOVE(src: SlotPath, dst: SlotPath) → Result
  Move source cap to dst slot. Rejects if source slot is `pinned`.

MGMT_DROP(src: SlotPath) → Result
  Remove cap from slot. Rejects if `pinned`.

host_mint_cnode(slot: SlotPath, cnode_size_log: u8, quota_slot: SlotPath)
  -- Mints a fresh empty Cap::CNode of size 2^cnode_size_log slots.
  -- Places at the given slot in self's cnode (slot must be empty).
  -- Debits StorageQuota[quota_slot's quota_id] by metadata size.

MGMT_CNODE_SWAP(a: SlotPath, b: SlotPath)
  -- Swap contents of two slots. Both slots must be either both in
  -- self's root cnode, or both in the same Cap::CNode reachable from
  -- self. Useful for atomic batch operations.

On CALL entry (target's apply starts at endpoint.entry_pc):
  phi[i]      = endpoint.initial_regs[i]  for each i (snapshot)
  phi[7..10]  = register args (4 u64 args supplied by caller; overlay)
  all other phi = 0
  slot[0]     = scratchpad (moved from caller's slot[0])

On CALL_RESUME entry (target's apply resumes from saved pc):
  slot[0]     = scratchpad (moved from caller's slot[0]; the response)
  -- no register args: target's registers are restored from the saved
     continuation (regs, pc captured at host_yield).

On apply termination, return registers (kernel writes into CALLER):
  caller's phi[7]  = on HALT:    u64 return value
                     on Paused:  yield payload reference
                     on Faulted: fault info pointer
  caller's phi[8]  = system status (Ok | Paused | Faulted)
  caller's slot[0] = reflected from target's slot[0]

GasMeter (kernel-internal, kernel-assisted Instance):
  Image: kernel:gasmeter
  State: meters: Map<MeterId, RemainingGas>
  Lifecycle: kernel initializes at block start with
    { root_meter_id: <chain-spec block budget> }; all other meters
    are populated lazily by chain via SetGasMeter; kernel discards
    GasMeter at block end (kernel is stateless across blocks).

Gas{meter_id} (per-Instance unit handle, kernel-assisted Instance):
  Image: kernel:gas
  State: meter_id: u64
  Created via Cap::Instance[MintGas].mint(meter_id) — caller supplies
    the meter_id (chain-chosen; kernel cannot assign uniquely
    without persistent state).
  Conservation lives in GasMeter, not in the cap — cap copies all
    name the same meter; debiting any copy debits the same meter.

Cap::Instance[SetGasMeter] (kernel-internal access):
  endpoint set(meter_id: u64, value: u64) → u64
    Atomically GasMeter[meter_id] := value; return previous value.
    If no entry exists, "previous" is 0 and the entry is created.
    The atomic set+read enables the "harvest remaining" idiom.

Cap::Instance[SetStorageQuota] (kernel-internal access):
  endpoint set(quota_id: u64, value: u64) → u64
    Same semantics as SetGasMeter for StorageQuota.

Cap::Instance[MintGas] (factory):
  endpoint mint(meter_id: u64) → Cap::Instance[Gas{meter_id}]
    Constructs a fresh Gas unit handle naming the given meter_id.
    Chain is responsible for meter_id uniqueness (collisions
    silently alias).

Cap::Instance[MintQuota] (factory):
  endpoint mint(quota_id: u64) → Cap::Instance[Quota{quota_id}]
    Symmetric.

Cap::Instance[CreateYieldCatcher] (factory):
  endpoint create() → Cap::Instance[YieldCatcher]
    Constructs a fresh empty YieldCatcher (no markers).

Cap::Instance[YieldCatcher] (per-Instance, kernel-assisted):
  endpoint add(marker: Cap::Instance) → ()
    Add a marker template to the catch list.
  endpoint remove(marker: Cap::Instance) → ()
    Remove a marker template.
  endpoint read() → Cap::Data
    Serialize the marker list as a DataCap for inspection.

HALT(phi[7] = return_value)
  → Instance becomes Idle with new value.
  → Target's slot[0] reflects to caller's slot[0] (apply's chosen
    output, atomically placed via MGMT_MOVE just before HALT).
  → Emits returned for orchestrator processing.
  → Caller: phi[8] = Ok.
  → Gas debited.

host_yield(marker)              -- includes kernel-triggered OOG
  → Instance becomes Waiting on the call stack (or Paused if the yield
    is preserved across blocks).
  → Target's slot[0] reflects to caller's slot[0] (carrying the
    marker's payload — typically a unit cap copy like
    Cap::Instance[Gas{meter_id}] for OOG, per §4).
  → Emits returned for orchestrator processing.
  → Caller: phi[8] = Paused; phi[7] = yield payload reference.
  → Caller may CALL_RESUME (with new scratchpad in caller's slot[0])
    or DROP_PAUSED.
  → Gas debited (from the active gas meter).

panic / illegal access / memory fault / write to pinned region / ...
  → Instance becomes Faulted.
  → Target's slot[0] reflects to caller's slot[0]
    (whatever was there at fault; per discipline, safe-to-reflect).
  → Target then dropped (cnode discarded except for the reflected slot[0]).
  → Emits discarded.
  → Caller: phi[8] = Faulted.
  → Instance cannot be invoked further.
  → Gas debited.

for event in block_body:
  -- prepare scratchpad in self.slot[0]
  build event-specific Cap::CNode into self.slot[0]
  -- ensure target's gas_slots[0] names a meter with enough balance
  -- (typically chain has already done SetGasMeter for this user's
  -- meter_id; see §22 lazy-load OOG-catch pattern).
  match CALL(target_slot, endpoint):
    Ok:
      target updated; self.slot[0] now has target's reply.
      proceed.
    Paused via OOGMarker:
      -- payload (slot[0]) holds Cap::Instance[Gas{meter_id}].
      -- Chain looks meter_id up in its GasLedger.
      record / decide topup-or-fail; if topup:
        SetGasMeter(meter_id, more); CALL_RESUME.
      else DROP_PAUSED (fault propagation).
    Paused via StorageExhaustedMarker:
      -- payload holds Cap::Instance[Quota{quota_id}].
      analogous; SetStorageQuota then CALL_RESUME, or fail.
    Paused via chain-defined marker:
      marker-specific handling per chain spec.
      (self.slot[0] has the marker's payload from yield.)
    Faulted:
      drop target; chain-spec policy decides (log, governance, etc.).
      (self.slot[0] has whatever target had at fault.)

MGMT_COPY(T_slot, T_copy_slot)
  -- content-shared copy; same image_hash; mutations to T_copy or T
  -- will diverge per §9 case (b).
build query args into self.slot[0]
match CALL(T_copy_slot, query_endpoint):
  Ok:    self.slot[0] has reply; use it; MGMT_DROP T_copy.
  ...:   handle; MGMT_DROP T_copy.

let backup = MGMT_COPY(target_slot)   -- O(1); content-shared
do_risky_work_on_target()
if bad_outcome:
  MGMT_COPY(backup, target_slot)      -- restore
else:
  MGMT_DROP(backup)                    -- discard backup

Cap::Instance   — Instance value reference. Content-addressed copyable.
               MGMT_COPY produces a content-shared reference;
               mutations diverge per §9 case (b).
               AUTHORITY-BEARING. Possession is structural proof of
               authority. Use this for authority routing.
Cap::Image   — Image (spec, including bytecode) reference.
               Content-addressed copyable.
Cap::Data    — Bytes (trailing-zero-stripped). Content-addressed
               copyable.
Cap::CNode   — Variable-size cnode (size = 2^k slots).
               Content-addressed copyable.
Cap::Type    — Cumulative image_hash chain identifier.
               Content-addressed copyable. Opaque to bytecode reads;
               equality-comparable via host calls; composable via
               host_subtype.
               IDENTIFICATION-ONLY. NOT an authority credential.
               See "Cap::Type vs Cap::Instance" below.

MGMT_COPY(src, dst):
  cap = read(src)
  copy share into dst (content-addressed; both refs point to same hash)

A.apply:
  MGMT_COPY(template_slot, clone_slot)
  build init_args Cap::CNode into self.slot[0]
  CALL(clone_slot, setup_endpoint)
  -- clone is now mutated per the image's setup logic

Slot's cap = reference (by hash) to a specific Instance or Data value.

Apply runs:
  Kernel materializes Instance value into apply's working memory.
  Apply mutates working memory (with COW per page for mapped DataCaps).
  Slot is NOT updated yet.

At termination:
  HALT  → kernel computes hash of new Instance value (with new mapped
          DataCaps); slot updates to that hash.
  yield → kernel computes hash of Paused Instance value (with continuation);
          slot updates.
  fault → slot was never updated; outer's view of pre-call value is
          preserved structurally.

No explicit STM buffer; no merge-or-discard ceremony. Atomicity comes
from "slots only update at termination."

Per-block hashing = O(modified pages × log(num pages))
                      [paid at outermost termination, once per block]
                  + Σ O(divergence event sizes)
                      [paid per explicit copy of a working-memory
                       singleton, mid-block]

A → B → C, all sync CALLs:

If C HALTs and B HALTs and A HALTs: all changes commit to σ.
If C HALTs but B faults: B's working state (including the new C
   value) discarded. A sees pre-call B and pre-call C.
If A faults: no changes commit; σ unchanged.

Automatic transactional rollback for sync CALL chains. Each apply's
cap-reference updates live in working memory until that apply HALTs.
Failures unwind everything below.

A.apply HALTs with emit{target=B, args, on_failure=A.refund}.
  → A's new state committed to orchestrator's cnode.

Orchestrator processes emit (sync CALL to B):
  B HALTs   → both A and B committed.
  B Paused  → orchestrator handles per reason.
  B faults  → orchestrator invokes A's refund (compensating action).

Hardware → Kernel: (parent chain Instance value, block_body)
Kernel:
  Materialize chain Instance from parent state.
  Initialize per-block kernel-assisted Instances (§22):
    GasMeter      := { root_meter_id: <chain-spec block budget> }
    StorageQuota  := { root_quota_id: <chain-spec block budget> }
  Place block_body Cap::CNode into kernel's slot[0].
  CALL(chain_Frame, process_endpoint).
  Apply runs; processes events; sub-CALLs and emits chain.
  HALT.
  state_root = hash(new chain Instance value); commit in block header.
  Discard per-block kernel state (GasMeter, StorageQuota); kernel
    is stateless across blocks.

Gas / storage management:
  Cap::Instance[Gas{root_meter_id}]      -- initial root gas budget
  Cap::Instance[Quota{root_quota_id}]    -- initial root storage budget
  Cap::Instance[SetGasMeter]             -- modify GasMeter (returns prev)
  Cap::Instance[SetStorageQuota]         -- modify StorageQuota
  Cap::Instance[MintGas]                 -- factory for Gas unit handles
  Cap::Instance[MintQuota]               -- factory for Quota unit handles

Yield routing:
  Cap::Instance[CreateYieldCatcher]      -- factory for per-Instance catchers
  
  Pre-placed in chain's initial YieldCatcher
  (chain.cnode[yield_marker_slot]):
    OOGMarker                         -- caught when any meter hits 0
    StorageExhaustedMarker            -- caught when any quota hits 0
    (others as chain spec requires)

Block N: spawn fresh Dispatch Instance; first message is
  aggregate_{N-1}; produce aggregate_N; sign; submit; destroy.

Yield routing:
  yielder.bytecode places Cap::Instance[marker_M] in scratchpad
  yielder.bytecode invokes host_yield(scratchpad_slot)
  Kernel:
    target_hash := marker_M.instance_hash
    for each InstanceEntry F on stack from top down:
      if F.image.yield_marker_slot is set:
        let YC = F.cnode[F.yield_marker_slot]
                 (a Cap::Instance[YieldCatcher])
        for each marker template in YC.state.markers:
          if marker.instance_hash == target_hash:
            push ReferenceEntry(F); transfer control to F.
            return.
    fault yielder with "unhandled marker"

Setup phase (Chain init):

  -- Chain mints a marker for each authority type:
  marker_invoke = host_derive_spawn(InvokeMarkerImage, init={})
  
  -- Chain adds the marker to its YieldCatcher
  -- (chain.cnode[yield_marker_slot] holds Cap::Instance[YieldCatcher],
  --  pre-populated at chain init per §12 with OOGMarker etc.):
  CALL(chain.cnode[yield_marker_slot], add, marker=Cap::Instance[marker_invoke])

Image EndpointRefCap (well-known image):
  state:
    marker:         Cap::Instance[marker_invoke]    -- in self.cnode slot
    target_address: ContractId                   -- which contract
    endpoint_idx:   u8                           -- which endpoint
  endpoints:
    invoke(args)
      -- 1. Compose payload from self.state + args:
      --     payload = { target_address, endpoint_idx, args }
      -- 2. Place payload in arg slot (slot for handler to read).
      -- 3. Place self.cnode[marker_slot] (Cap::Instance[marker_invoke])
      --    into yield-scratchpad slot.
      -- 4. host_yield(yield-scratchpad).
      -- 5. On resume, slot[0] holds the handler's response. HALT.

Chain mints these:

O.endpoint grant_endpoint_access(target, endpoint_idx) → Cap::Instance[EndpointRefCap]:
  cap = host_derive_spawn(EndpointRefCapImage,
                          init = { marker: Cap::Instance[marker_invoke],
                                   target_address: target,
                                   endpoint_idx: endpoint_idx })
  return cap

A.endpoint do_something():
  ref_cap = self.slot[7]   -- holds Cap::Instance[EndpointRefCap(B, 5)]
  slot[0] := args
  CALL(ref_cap, "invoke")
  -- ref_cap's invoke endpoint runs; yields with marker; kernel
  --   routes to Chain; Chain dispatches to B; response returns.
  result = slot[0]
  ...

Kernel
  └── ChainRoot (handles chain-wide policy)
       ├── DomainOrch_DeFi
       │    ├── ProtocolOrch_AMM
       │    │    └── ...
       │    └── ProtocolOrch_Lending
       │         └── ...
       ├── DomainOrch_NFT
       │    └── ...
       └── DomainOrch_Identity

Image AttestationAuthority (well-known image; minted by kernel):
  state:
    marker: Cap::Instance[attest_marker]    -- in self.cnode
  endpoints:
    attest(key, blob) → AttestStatus
      -- 1. Compose payload: { key, blob }, place in arg slot.
      -- 2. Place Cap::Instance[attest_marker] in yield-scratchpad.
      -- 3. host_yield(yield-scratchpad).
      -- 4. On resume, slot[0] holds the kernel's response (status).
      -- 5. HALT returning status to caller.

Setup (kernel/chain init):
  attest_marker = host_derive_spawn(AttestMarkerImage, init={})
  -- Add to the kernel handler instance's YieldCatcher
  -- (kernel's handler is a kernel-internal instance whose
  --  yield_marker_slot points to its own YieldCatcher):
  CALL(kernel_handler.YieldCatcher, add,
       marker=Cap::Instance[attest_marker])
  -- Now kernel catches yields with this marker.

  -- AA caps are minted with marker in their state:
  aa_cap = host_derive_spawn(AAImage, init={ marker: Cap::Instance[attest_marker] })
  -- Distribute aa_cap to chain code that needs to attest.

enum AttestStatus {
  Recorded,         -- request was recorded; kernel will sign at
                    -- termination (sign mode) or has verified
                    -- (verify mode). Userspace sees the same value.
  InvalidKey,
  MalformedBlob,
  QuotaExceeded,
  ... (mode-invariant failure modes)
}

Block carries an optional sidecar attestation_traces:
  None         → sign mode (this validator is the proposer).
  Some(sigs)   → verify mode (this validator is a verifier).

Kernel injects a Cap::Instance[AA] at apply start, in scratchpad of
the top-level apply. AA's image_hash_chain extends from the kernel-
bridge image, structurally proving "minted by this kernel."

Apply (or downstream Instances receiving AA via cap-flow) calls
AA.attest(key, blob) at every signature obligation.

Per-attest yield handling:
  - AA's bytecode yields with attest_marker; kernel walks the call
    stack and consults each InstanceEntry's YieldCatcher (via short-
    circuit). Match found at kernel handler instance.
  - Intermediates don't catch (their YieldCatcher's marker list
    doesn't contain attest_marker). They have no access to the
    yielded payload — it never lands in their slot[0].
  - The kernel reads the payload (key, blob) from the yield's arg
    slot — these are part of AA's payload composition, not part of
    AA's identity.
  - The kernel performs the mode-appropriate work:
      Verify mode: hw_verify(key, blob, traces[next_slot]).
                   Status = Recorded on success; else mode-invariant
                   failure or block-fault (see attestation-authority.md).
      Sign mode:   if validator has authority to sign with key,
                     hw_sign(key, blob) → sig; append to outgoing
                     attestation_traces; Status = Recorded.
                   else: mode-invariant failure (consensus safe
                     because failure conditions are deterministic
                     functions of apply-visible state).
  - The kernel places status in slot[0]; CALL_RESUME returns control
    to AA's bytecode.

Apply HALTs. At HALT, kernel knows:
  Verify mode: did every required position in traces get consumed?
               If not, block invalid (apply produced fewer attestations
               than the block claims).
  Sign mode:   are all hw_sign calls done? Block is finalized with
               the attestation_traces sidecar.

AA.aggregate(group_key, partial_sig) → AggregateStatus
  -- builds an Aggregate request Instance (state: { group_key, partial_sig });
  -- yields up; kernel collects partials per group;
  -- at block finalization, kernel BLS-aggregates and appends final
  -- sig to block sidecar.
  -- Returns mode-invariant status.

Image MintInstance (owned by O, well-known image):
  state:
    issued:  Map<MintHandle, Issuance>,
    policy:  ...
  endpoints:
    mint(domain, content) → Issuance       -- only callable from O.apply
    burn(handle)                           -- only callable from O.apply
    transfer(handle, from, to)             -- only callable from O.apply

Image MintRefCap (granted by O to user contracts that may mint):
  state:
    domain: DomainId                       -- which mint domain this cap is for
    marker: Cap::Instance[mint_marker]        -- in self.cnode
    -- possibly: policy fields (rate limits, etc.) baked in per §14
  endpoints:
    mint(content) → MintStatus
      -- Per the canonical authority pattern (§14, §17):
      -- 1. Compose payload from { domain, content } + args.
      -- 2. Place Cap::Instance[mint_marker] in yield-scratchpad.
      -- 3. host_yield(yield-scratchpad).
      -- 4. Kernel routes to O (which has mint_marker in its
      --    yield_marker_slot). O invokes MintInstance.mint internally
      --    and returns status via CALL_RESUME.
      -- 5. On resume, slot[0] holds status (and any new Issuance cap).
      -- 6. HALT to caller.
    burn(handle) → BurnStatus    -- symmetric pattern
    transfer(...) → TransferStatus

Alice's tx (off-chain, signed):
  "Alice transfers 10 to Bob."

Chain Orchestrator's apply:
  1. Record Alice's signature into AttestationAuthority:
       AA.attest(alice_pubkey, tx_payload_hash).
  2. Look up Alice's user contract A (just a contract registry
     lookup — no auth_table).
  3. Update Alice's account state (decrement) and Bob's (increment).
  4. If a typed stamp is needed, O calls MintInstance.mint directly
     (O holds the cap to MintInstance, intra-O cap-flow).

Cross-contract case (A invokes an operation that mints):
  1. A holds Cap::Instance[MintRefCap(domain_X)] in its cnode (granted
     by O earlier via O's grant endpoint).
  2. A.apply calls MintRefCap.mint(content).
  3. MintRefCap's bytecode yields with mint_marker; kernel walks
     the call stack; finds O's YieldCatcher contains a matching
     marker template; routes to O.
  4. O's bytecode reads payload (domain_X, content), invokes
     MintInstance.mint(domain_X, content) → Issuance.
  5. O places result in slot[0]; CALL_RESUME. MintRefCap resumes,
     HALTs with status to A.

Forgery resistance: a malicious A cannot yield with mint_marker
without holding a real MintRefCap (the marker is in MintRefCap's
state, opaque from outside). And A can't fabricate a MintRefCap
because Chain's chain prefix can't be replicated.

Instance (always Image-bound):
  image_id:     ImageHash
  cnode:        256 slots; pinned slots per Image; non-pinned mutable
  status:       Idle | Paused {...} | Faulted
  image_hash:   derived; kernel-attested chain hash:
                  genesis:                  hash(initial_image)
                  after set_image(new):     hash(image_hash_before
                                                  || hash(new))
                  via derive_spawn(new):    hash(spawner.image_hash
                                                  || hash(new))
                  via MGMT_COPY:            preserved

Cap::Image (content-addressed, copyable):
  - code:            Bytes  (bytecode embedded; validated at construction)
  - memory_mappings: [{start, size, source}]
  - endpoints:       [Option<EndpointDef>; 256]
  - gas_slots:       [SlotIdx]    -- slots holding Cap::Instance[Gas{meter_id}]
  - quota_slots:     [SlotIdx]    -- slots holding Cap::Instance[Quota{quota_id}]
  - pinned_slots:    Map<SlotIdx, ContentAddressedCap>
                       (ContentAddressedCap ∈ { Cap::Data, Cap::Image })
  - yield_marker_slot: Option<SlotIdx>
                       -- slot holding Cap::Instance[YieldCatcher]

Cap::CNode (uniformly copyable; mintable):
  - size: 2^k slots
  - slots: [Option<Cap>; size]
  - Used for storage exceeding 256-slot Instance root cnode, for
    state-snapshot/revert patterns, and as the cnode argument to
    host_derive_spawn.

Memory model:
  - Static layout per Image; no dynamic mapping; no lazy paging.
  - Persistent mapping = backed by cnode DataCap; mutations COW'd.
  - Ephemeral mapping = kernel-allocated; per-apply.
  - DataCap canonical form: trailing-zero-stripped.
  - Size-mismatch: small DataCap zero-padded; large DataCap faults.

Apply terminations (all reflect target.slot[0] to caller.slot[0]):
  HALT  → Idle (new value)
  yield → Waiting on call stack (Paused if preserved across blocks);
          continuation is regs+pc; yield payload (typically a marker
          / unit cap) reflects to caller via slot[0].
          (kernel OOG = host_yield with kernel-issued OOGMarker;
           payload is Cap::Instance[Gas{meter_id}].)
  fault → Faulted, then dropped
  Gas debited STM-exempt: from the meter named by the active Instance's
    gas slot; debits are per-instruction; no per-CALL budget.
  Apply discipline: keep slot[0] in a safe-to-reflect state at all
    times (input scratchpad, empty, or complete output Cap::CNode
    atomically MGMT_MOVE'd in). OOG and fault can happen at any
    instruction; partial slot[0] would expose mid-mutation state.

Kernel ABI:
  Invocation:           CALL, CALL_RESUME, DROP_PAUSED
                        (no gas_budget — gas via gas_slots)
  Yield:                host_yield (YieldCatcher-routed marker)
  Data:                 host_read_data_cap, host_mint_data_cap
  Cap-table:            MGMT_COPY/MOVE/DROP/CNODE_SWAP
  Image / spawn:        set_image, host_derive_spawn
  Type-query:           host_same_type, host_same_type_as,
                        host_type_of, host_subtype, host_type_eq
  CNode:                host_mint_cnode

Kernel-issued caps at chain init (see §4, §12):
  Gas/storage:          SetGasMeter, SetStorageQuota, MintGas,
                        MintQuota, root Gas/Quota unit handles.
  Yield routing:        CreateYieldCatcher; chain's initial
                        YieldCatcher pre-populated with OOGMarker,
                        StorageExhaustedMarker.

Cap kinds (five; all copyable):
  Cap::Instance   — Instance value reference. AUTHORITY-BEARING.
                 Includes kernel-assisted Instances (§22): YieldCatcher,
                 Gas{meter_id}, Quota{quota_id}, etc.
  Cap::Image   — spec including embedded bytecode.
  Cap::Data    — arbitrary bytes.
  Cap::CNode   — variable-size cnode (mintable).
  Cap::Type    — image_hash chain identifier. IDENTIFICATION-ONLY;
                 NOT for authority routing (see §8).

  Resource caps (Gas, StorageQuota) are NOT separate cap kinds —
  they are kernel-assisted Cap::Instances:
    Gas{meter_id}   — per-Instance unit handle naming a meter in the
                      kernel-internal GasMeter table. Conservation
                      lives in the table; cap copies all name the
                      same meter; no narrow linearity needed.
    Quota{quota_id} — symmetric for StorageQuota.
  Chain accesses kernel-internal GasMeter/StorageQuota only via
  the kernel-issued SetGasMeter/SetStorageQuota caps.
  Custom (non-kernel-assisted) resources are typed handles into
  authority ledgers.

  No σ-resident signing primitive. Signing/verification happen
  kernel-side post-HALT against AttestationAuthority records (§15).

Image mutation:
  set_image(new_image: Cap::Image) is the only on-self spec-changing
  primitive.

Instance creation:
  MGMT_COPY of Cap::Instance:
    content-shared copy; same image_hash. Mutations diverge per §9
    case (b). For "same type with fresh state": follow MGMT_COPY
    with CALL into image-defined setup endpoint.
  host_derive_spawn(image, cnode):
    new image; image_hash = hash(self.image_hash || hash(image));
    consumes cnode. For sub-type creation (authority Instances creating
    subjects, etc.). Only callable from within self's apply.

Authority + Subject pattern:
  Authority Instances: held by chain orchestrator (Kernel, MintInstances,
    chain-defined issuers). They mint Subject Instances via
    host_derive_spawn or issue typed handles.
  Subject Instances: e.g., user contracts, custom token handles.
  Conservation enforced by authority bytecode (ledger arithmetic)
    for userspace resources, or by the kernel-internal table for
    kernel-assisted resources (Gas/Quota, §22).
  Forgery resistance via image_hash chain.

Type query:
  host_same_type(a, b)  → image_hash equality
  host_same_type_as(comparer, comparee, [images])
                        → comparer is comparee derived through images
  Lineage walking and raw image_hash are not exposed.

Forgery resistance (structural):
  Genesis Kernel Instance has image_hash = hash(KernelImage).
  Post-set_image / post-derive_spawn image_hashes are recursive;
    never equal hash(any single Image).
  Cap-flow on the genesis Kernel Instance gates entry.
  Cap-runtime integrity: caps not synthesizable from bytes.

By-value with content-addressed slot references:
  Slots only update at apply termination.
  Sub-tree atomicity structural.
  No STM buffer required.

Snapshot/revert universal:
  MGMT_COPY of any Cap::Instance produces a content-shared reference.
  Mutations diverge per §9 case (b).
  Always available; always works.

Pinned cnode slots: kernel-locked, declared by current Image's
  `pinned_slots`. Holds Cap::Data (baked-in ro bytes) or Cap::Image
  (derive_spawn targets).

Pure-function apply; effects as outputs.
Saga pattern for peer coordination via emit + on_failure.
Per-block kernel as top orchestrator.
Off-chain Dispatch ephemeral per block.

Authority model:
  In-σ authority is conveyed by capabilities; possession = right to
  invoke. Caps are unforgeable (image_hash chain) and unappropriable
  (cnode ownership); secrecy of σ is unnecessary. Orchestrators mint
  EndpointRefCap-style caps and grant them via cap-flow; no per-user
  ACL tables. No σ-resident signing keys; no Cap::Authority cap kind.
  Off-chain → on-chain authority via AttestationAuthority cap (status-
  only return; per-attest yield mediated by kernel against block-
  supplied traces). Hierarchical orchestrators compose by minting and
  granting caps at each layer.