Fix memory, native runtime, Store, and HIL review boundaries

[ramen-implementer]

Summary

Close review findings that let shared-memory reuse expose prior contents, mappings lose isolation/execute restrictions, native WASM calls write into disconnected memory, Store signatures fail verification, CAS ingestion publish bytes under the wrong digest, and concurrent trace operations observe corrupted events.

• Clear full shared-memory frames and tails; reserve the common VA in every recipient, reject collisions, and preserve mappings until the last reference.
• Preserve x86 NX through page-table updates and enable EFER.NXE before mapping. The QEMU gate inspects the actual leaf and CPU enablement.
• Generate native WASM bindings that access the calling guest's exported memory and honor the signed output-slice capacity, reject invalid/overlapping ranges, and preflight predictable reply sizes before bridge side effects. Final copies reject oversized replies without touching output or its length word.
• Verify deterministic unsigned manifest bytes in all three Store read/verify handlers; hash and publish the same privately staged bytes.
• Synchronize per-domain trace contents and cursors, with producer/consumer wrap regressions.

This branch includes the previously unpublished prerequisite commit 5c8a443 unchanged, followed by remediation commit 6674f9e and WASM capacity follow-up commit 3fb3c0c. The prerequisite persists Store ownership and domain-filtered projections, restricts shared-memory page sizes, makes CI classification fail closed, binds HIL evidence to prepared artifacts and fresh boot challenges, and updates the M900/Pi appliance inventory and evidence boundaries. It is included because the reviewed implementation and regression gate build on it.

Pillar / slice

OS Core + Store Platform + Foundry. Preserve the active S12.4 serial-observer-first track and the S13 QEMU/metal evidence distinction.

Evidence

GitHub CI passed on follow-up commit 3fb3c0c: changes, org-governance, full foundry, and merge-gate are green in both the PR run and the push run.

Local validation passed on the final implementation:

• cargo test --workspace --exclude kernel_uefi --exclude kernel_aarch64: 742 passed, 0 failed, 11 existing ignored tests (rerun after the WASM capacity follow-up).
• just foundry-review-boundaries: PASS, including the new kernel/native regressions, full Store tests, and existing ownership/tooling/HIL tests.
• just codegen, just idl-lint, cargo fmt --all -- --check, git diff --check, just clippy, just build-targets, just build-uefi: PASS.
• just foundry-shmem-dataplane-s8-phase4-integration: 7/7 QEMU checks pass.
• just foundry-s0: PASS on x86_64 and aarch64.
• just s11, just s12, just s13, just foundry-org-governance-g0: PASS.
• just foundry-native-runner-s10-0, just foundry-native-runner-s10-1-ci: PASS; S10.1 CI retains three explicit full-E2E skips.
• just foundry-s7-store-signature-security, just foundry-v007-phase4-crypto-signatures: PASS; Linux-only SO_PEERCRED checks are skipped on the macOS validation host.

Focused pre-fix regressions reproduced the affected behavior. Post-fix tests cover cross-owner frame reuse/tails, VA conflicts and rollback, repeated mappings, guest-visible nonempty replies, invalid output ranges, signed and tampered manifests through all three handlers, source replacement and special-file ingestion, and concurrent trace wrap. Seven capacity regressions additionally verify adjacent-sentinel preservation, signed/invalid/overlapping capacities, preflight before create-region side effects, valid exact/larger buffers, unexpected backend reply sizes, zero-byte write replies, and the older echo helper. Legacy ownership metadata is explicitly documented as administrator-controlled migration input outside the typed artifact signature. An independent read-only candidate review covered the original seven-finding scope; a fresh independent read-only review of the capacity follow-up also found no concrete surviving bypass or regression.

Evidence level: host tests and PASS/QEMU only. No physical HIL or metal graduation was performed. NX evidence is encoded/live page-table and CPU state, not an execution-fault recovery test. Trace locking does not establish complete SMP or interrupt-reentry support. Staged ingestion guarantees that the published digest names the exact stored bytes, not an atomic filesystem snapshot of a changing source.

Local detailed report and logs: out/reviews/2026-09-16/fixes.md and adjacent ramenos-fix-*.log files (ignored build artifacts, not included in this PR).

Claim-boundary check

• Does not claim metal graduation, security readiness, or release readiness beyond its evidence.
• Native wire/IDL layouts are unchanged; host bindings regenerated with just codegen, with no hand-edited generated files.
• Preserves boundaries: kernel ≠ services ≠ store. No new kernel dependencies or production heap allocation.

Docs

• CURRENT_STATUS.md and CHANGELOG.md updated.
• DECISIONS.md records signing bytes, common-VA mapping behavior, caller-memory ABI, staging guarantees, and trace/NX evidence limits.

Separation of duties

Opened as ramen-implementer[bot] (A2). A different A3 reviewer must approve and merge after required checks pass.