fix(native): bind foreground ownership to stable boot sessions

docs/reference/native-authored-commands.md

@@ -38,7 +38,8 @@ and refuses replay; a missing ready mapping does not authorize a fresh start.
 
 `down --recover` explicitly retires a complete stored native generation whose
 foreground publisher and frontend admission owner are both dead on the same host
-boot. It requires the current version 3 native publication, the exact stored Ready,
+boot. New version 4 native publications use the kernel boot-session UUID, which
+remains independent of calendar clock correction. Recovery requires the exact stored Ready,
 startup intent and private source envelope, and the original guest incarnation.
 Live owners, older version 2 dead publications, partial startup, pending writes,
 changed files and rebooted guests refuse. Env/profile changes, service subsets and
@@ -47,6 +48,12 @@ nor acquires managed values or starts a provider.
 Omit `--profile` to recover the stored generation; explicit empty or named profile
 overrides both refuse.
 
+The closed version 3 publication and version 1 recovery selector remain supported
+with their original calendar boot qualifier; clock drift conservatively refuses
+that legacy recovery. New version 4 owners use version 2 UUID selectors. Missing,
+malformed or unavailable UUIDs refuse; no old record is migrated or given inferred
+session authority. PID birth/executable, peer, inode, gate and run-lock checks remain.
+
 Recovery commits a distinct private intent before calling the Rust cleanup owner.
 The original raw selectors and resource inventory remain fixed through retries;
 current cleanup phases may advance. Before retiring each frontend file, the owner
@@ -69,4 +76,4 @@ this operation does not repair arbitrary partial lock or file publications.
 The native receipt and source paths are distinct from strict Compose v1 artifacts.
 No native hash substitutes for a normalized Compose hash. Source and fake-driver
 checks do not qualify an installed frontend, a live provider, the full authored
-corpus, actual version 3 dead-owner recovery or resource overhead; those remain separate gates.
+corpus, actual dead-owner recovery or resource overhead; those remain separate gates.

packages/runtime-core/README.md

@@ -114,29 +114,46 @@ this same subset. Its private `native-graph-owner` record and authenticated v2
 `native-graph-control` status/cleanup protocol bind the native review, exact
 process incarnation, directory, socket, file and retained per-run lock. Direct
 run/cleanup and foreground publication exclude each other under that lock.
-New publications use a closed version3 owner record with independently captured
-native host boot time. Live authentication rechecks that boot together with the
-existing exact process and filesystem identities. The closed version2 live-owner
-decoder remains available without inferring host boot from PID birth or guest
-receipt boot. Version2 records reject the new field, and version3 records require
-it. Native runtime receipts and the authenticated control/ready wire remain v2;
+New publications use a closed version4 owner with `host_boot_uuid`, captured by
+the native read-only `kern.bootsessionuuid` sysctl. Its fixed 37-byte response must
+contain a nonzero ASCII UUID and terminal NUL; the reader canonicalizes lowercase.
+Persisted UUIDs must already be lowercase. Unavailable or malformed readings refuse,
+without a timestamp or shell fallback. Live authentication rechecks the session
+together with the exact nonzero process incarnation and filesystem identities;
+it does not compare process birth against mutable calendar boot time.
+The closed version2 live-owner decoder remains available without a boot qualifier.
+Version3 remains strictly qualified by its original `host_boot_micros`; it receives
+no inferred UUID or migration. Each version rejects the other versions' qualifiers.
+Native runtime receipts and the authenticated control/ready wire remain v2;
 Compose receipt and owner formats remain unchanged. This provenance alone grants
 no dead-owner recovery authority.
 The inactive read-only recovery selector admits only a complete Ready journal and
-a dead version3 publication on the same native host boot. It captures the current
+a dead version3 or version4 publication on the same qualified native host boot. It captures the current
 private owner bytes and inode; its raw SHA is a selector for later independent
 admission, not an external identity anchor from before that capture. After a
 durable intent, the saved inode and digest refuse replacement. Cleanup progress
 retains the original Ready selectors and exact inventory. Pending writes refuse;
 retired paths require the intent's preceding phase and unchanged archived inode.
 `graph native recovery-selection --run-id ID --json` exposes only the closed
 selection: run, original value-free Ready receipt, raw receipt/owner hashes and
-native host boot time. The receipt contains review hashes, workload readiness,
+the original boot qualifier. Version1 selections retain version3 calendar micros;
+version2 selections carry version4 `host_boot_uuid`. Neither rewrites original
+owner bytes, inode or digest. Version2 dead owners remain ineligible. Version3
+recovery conservatively refuses if its calendar qualifier has drifted.
+The receipt contains review hashes, workload readiness,
 resource IDs/images/networks and terminal observations; it contains no environment
 keys/values, command argv, source bytes or publication process/path metadata. The
 selector creates no intent and connects no provider. It grants no cleanup or
 frontend recovery authority.
 
+The UUID boundary addresses calendar correction without weakening reboot refusal.
+[XNU calendar updates adjust boot time](https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/kern/clock.c#L674-L752),
+while the [read-only boot-session sysctl](https://github.com/apple-oss-distributions/xnu/blob/main/bsd/kern/kern_sysctl.c#L2735-L2762)
+is [generated at boot](https://github.com/apple-oss-distributions/xnu/blob/main/iokit/Kernel/IOPMrootDomain.cpp#L3846-L3861).
+Unrelated legacy filesystem chronology still uses its existing calendar helper.
+Injected-reader and codec regressions qualify the ownership fences without changing
+the host clock or rebooting. They do not establish actual provider recovery.
+
 The separate explicit library recovery entrypoint re-admits both raw selectors
 and commits a bounded 64 KiB recovery intent before cleanup. It retains the
 publication gate, original operation lock and cleanup provider lease through

packages/runtime-core/src/provider/graph/native/foreground.rs

@@ -3,6 +3,7 @@ use super::*;
 use crate::provider::graph::foreground::{signals, transport};
 use serde::{Deserialize, Serialize};
 use std::{cell::Cell, io::Write};
+mod host_boot;
 mod owner;
 pub mod recovery;
 pub(super) use owner::DirectGuard;

packages/runtime-core/src/provider/graph/native/foreground/host_boot.rs

@@ -0,0 +1,148 @@
+//! Stable native host boot authority. Calendar boot time is not an incarnation ID.
+use super::{CandidateError, refused};
+use serde::{Deserialize, Deserializer, Serialize};
+
+/// Persisted boot qualifiers are canonical, nonzero UUIDs. No timestamp fallback.
+#[derive(Clone, PartialEq, Eq, Serialize)]
+#[serde(transparent)]
+pub(super) struct Session(String);
+impl Session {
+    fn parse(value: &str) -> Option<Self> {
+        let bytes = value.as_bytes();
+        if bytes.len() != 36
+            || bytes.iter().enumerate().any(|(i, byte)| {
+                if matches!(i, 8 | 13 | 18 | 23) {
+                    *byte != b'-'
+                } else {
+                    !byte.is_ascii_digit() && !(b'a'..=b'f').contains(byte)
+                }
+            })
+            || !bytes
+                .iter()
+                .any(|byte| matches!(byte, b'1'..=b'9' | b'a'..=b'f'))
+        {
+            return None;
+        }
+        Some(Self(value.into()))
+    }
+}
+impl<'de> Deserialize<'de> for Session {
+    fn deserialize<D: Deserializer<'de>>(reader: D) -> Result<Self, D::Error> {
+        let value = String::deserialize(reader)?;
+        Self::parse(&value).ok_or_else(|| serde::de::Error::custom("Invalid host boot qualifier"))
+    }
+}
+
+fn decode(buffer: &[u8; 37], length: usize) -> Result<Session, CandidateError> {
+    if length != buffer.len() || buffer[36] != 0 {
+        return Err(refused());
+    }
+    let text = std::str::from_utf8(&buffer[..36]).map_err(|_| refused())?;
+    // XNU publishes uppercase UUID text; only the native reader normalizes it.
+    Session::parse(&text.to_ascii_lowercase()).ok_or_else(refused)
+}
+
+pub(super) fn read() -> Result<Session, CandidateError> {
+    #[cfg(test)]
+    if let Some(value) = test::next() {
+        return value.ok_or_else(refused);
+    }
+    let mut buffer = [0u8; 37];
+    let mut length = buffer.len();
+    // SAFETY: the read-only sysctl writes at most this fixed initialized buffer;
+    // its size pointer is live, newp is null, and no pointer is retained.
+    if unsafe {
+        libc::sysctlbyname(
+            c"kern.bootsessionuuid".as_ptr(),
+            buffer.as_mut_ptr().cast(),
+            &mut length,
+            std::ptr::null_mut(),
+            0,
+        )
+    } != 0
+    {
+        return Err(refused());
+    }
+    decode(&buffer, length)
+}
+
+#[cfg(test)]
+pub(super) mod test {
+    use super::*;
+    use std::{cell::RefCell, collections::VecDeque};
+    thread_local! {
+        static OVERRIDE: RefCell<Option<VecDeque<Option<Session>>>> = const { RefCell::new(None) };
+    }
+    pub(super) fn next() -> Option<Option<Session>> {
+        OVERRIDE.with(|cell| {
+            let mut state = cell.borrow_mut();
+            let values = state.as_mut()?;
+            if values.len() > 1 {
+                values.pop_front()
+            } else {
+                values.front().cloned()
+            }
+        })
+    }
+    pub(in super::super) struct Guard(Option<VecDeque<Option<Session>>>);
+    impl Guard {
+        pub(in super::super) fn set(value: Option<&str>) -> Self {
+            Self::sequence(&[value])
+        }
+        pub(in super::super) fn sequence(values: &[Option<&str>]) -> Self {
+            assert!(!values.is_empty());
+            Self(OVERRIDE.with(|cell| {
+                cell.replace(Some(
+                    values
+                        .iter()
+                        .map(|value| value.map(|v| Session::parse(v).unwrap()))
+                        .collect(),
+                ))
+            }))
+        }
+    }
+    impl Drop for Guard {
+        fn drop(&mut self) {
+            OVERRIDE.with(|cell| cell.replace(self.0.take()));
+        }
+    }
+    #[test]
+    fn fixed_native_buffer_normalizes_only_valid_exact_uuid() {
+        let mut buffer = *b"12345678-ABCD-ABCD-ABCD-123456789ABC\0";
+        assert!(
+            decode(&buffer, 37).unwrap()
+                == Session::parse("12345678-abcd-abcd-abcd-123456789abc").unwrap()
+        );
+        for length in [0, 36, 38] {
+            assert!(decode(&buffer, length).is_err());
+        }
+        buffer[36] = b'x';
+        assert!(decode(&buffer, 37).is_err());
+        for value in [
+            "00000000-0000-0000-0000-000000000000",
+            "12345678-abcd-abcd-abcd-123456789abg",
+            "12345678_abcd-abcd-abcd-123456789abc",
+        ] {
+            let bytes: [u8; 37] = format!("{value}\0").into_bytes().try_into().unwrap();
+            assert!(decode(&bytes, 37).is_err());
+        }
+        buffer = *b"12345678-ABCD-ABCD-ABCD-123456789ABC\0";
+        buffer[0] = 0xff;
+        assert!(decode(&buffer, 37).is_err());
+        buffer[0] = 0;
+        assert!(decode(&buffer, 37).is_err());
+    }
+    #[test]
+    fn persisted_uuid_is_closed_and_reader_unavailability_never_falls_back() {
+        for value in [
+            serde_json::Value::Null,
+            serde_json::json!(1),
+            serde_json::json!("12345678-ABCD-ABCD-ABCD-123456789ABC"),
+            serde_json::json!("00000000-0000-0000-0000-000000000000"),
+        ] {
+            assert!(serde_json::from_value::<Session>(value).is_err());
+        }
+        let _guard = Guard::set(None);
+        assert!(read().is_err());
+    }
+}