Module boundary 

Explicit slice-boundary protocol. A complete typed stream keeps ordinary events and actual scheduling boundaries in one causal order.

A boundary is evidence of an existing scheduling request, not an instruction or permission to introduce a request. Its identity must come from the actual semantic callback, before the completed slice is reset. Replay expectations cannot supply observed identities. The controller must report any error here as a failed replay, irrespective of the legacy die_on_desync setting.

Structs

Boundary

Cursor

Strict protocol cursor. A failed observation never advances it. There is deliberately no fast-forward or permissive-desync option. Production integration must route these errors through the controller refusal path.

Identity

Owner

Stable owner identity. These are logical generations, never host PIDs or addresses. Exec advances the address-space generation; thread creation must allocate a new thread identity even if a deterministic TID is reused.

Schedule

A separate envelope prevents an old PreemptionRecord reader from silently ignoring a new metadata field, including for a recording with zero markers. No implicit conversion to a vector of legacy events is provided.

Enums

Cause

The mechanism actually delivered to Detcore. RIP availability does not distinguish these causes, and stripping a timestamp must not erase them.

Edit

Entry

A semantic entry into Detcore. Hidden backend stops, injected-call retries and dropped host signals are not entries. A signal delivery number comes from the already selected logical delivery, not its host arrival time.

Error

Named failures, carrying the stored stream index where applicable. These are errors, not recovery hints, skipped edits or successful partial replays.

Phase

Record

The stored stream index includes boundary records. Keeping a single stream prevents an inspector from accidentally indexing only guest operations.