A freestanding Rust Ring-0 Single Address Space OS architecture uniting 1TB per-domain SFI arenas, Profile P-PKU/P-PKS protection keys (K0–K15), and Two-Stack IST pivots to contain localized faults (L0–L3) without full-system halts.
Exceptions enter on Supervisor IST stacks (U/S=0), apply bootstrap PKRU, and pivot onto k0_priv_rsp before routing local faults to SchedulerContinuation.
Finalizes the 48-bit VA map ((addr >> 40) == d), U/S=0 code vs. U/S=1, NX=1 data under SMEP=1, and Layer 0–5 26-crate APIs.
Separates localized request, domain, quota, and subsystem faults (L0–L3) from core TCB integrity loss (F1–F3), eliminating panic-induced DoS vectors.
Assigns 1TB virtual windows per domain (d << 40), resolves Ring-0 PKRU + SMEP=1 page attributes, and enforces 3-class SFI/CFG decoding.
Enters on Supervisor IST (U/S=0), applies PKRU_KERNEL_DEFAULT, pivots to k0_priv_rsp, and jumps to SchedulerContinuation on domain abort.
Enforces APIC timer CPU budgets (1 ms [T]), NMI lockup recovery, bounded memory/IPC quotas, and cross-core TLB/IOTLB shootdown barriers before frame reuse.
Tracks frame lifecycles in pangea-pfndb, serializes PTE updates through K13, and separates IPC into Class S (brokered copy) and Class B (re-keyed zero-copy).