[stakach]

Plan and Implementation

• Keep the BKL identity value private and range checked; hardware is sampled once per non-migrating acquisition.
• Pass the same identity through retirement, quiescence and spec observation, including IF-clear nested waits.
• Standalone retirement ISR entry samples hardware independently. No user GS or TCB affinity becomes authority.
• Preserve mailbox ordering, exact ownership release and all-context CR4 flush before acknowledgement.
• Add focused host regressions and CI wrapper preserving child-module visibility.

Verification

Root alone ran serial validation. Nine actual-module host tests pass. New native-source plumbing regression fails against previous smp/quiescence sources (exit101); that is a source contract, not old hardware execution. Fresh native kernel/spec/rootserver build exited0 with explicit font-cleanup staged profile; bounded SMP guest exited0, all kernel specs and16 rootserver checks pass. Actual syscall idle backedges71; owned AP idle retirement probe64 rounds/20000 observations/2 replies. Initial image build correctly refused staged profile mismatch; no validation bypass.

Review

Independent source review found no blocker: retained physical identity cannot migrate during this scope; remote adoption changes user TCB state, not this executing kernel continuation. IRQ and bootstrap paths need not trust GS. Claim/flush/ACK and all-PCID/global alias semantics unchanged. Production does not include the spec counter/probe. Live NT performance/desktop claims require separate fresh acceptance; no speed claim from QMP snapshots.

Tracking: stakach/userspace-ntos#296. Parent integration only after upstream CI/merge.