---
title: Private Working Sets and Recovery
description: Bounded memory, encrypted paging, incremental AI history and verified document recovery in WebGPU OS.
updated: 2026-09-20
---

<!-- SPDX-FileCopyrightText: 2026 Jake Wehmeier (BTSpaniel) <https://github.com/BTSpaniel> -->
<!-- SPDX-License-Identifier: LicenseRef-ParticleRealms-Alpha -->

# Private Working Sets and Recovery

Echo, Navi and the text factories share bounded working memory and encrypted browser storage. This guide describes their storage contract, account recovery, migration boundaries and measured validation. It is intended for maintainers and operators handling large histories or documents.

## Memory and workload boundaries

The kernel owns one working-set budget for the active operator. Applications reserve capacity before owned reads, decoding, encryption, worker copies and retained outputs. These figures describe accounted application allocations, not the browser process's complete memory use.

| Allocation | Normal | Conservative |
|---|---:|---:|
| Clean caches | 64 MiB | 32 MiB |
| Dirty and pending data | 32 MiB | 16 MiB |
| Crypto, worker and I/O buffers | 16 MiB | 8 MiB |
| Index and metadata pages | 16 MiB | 8 MiB |
| Total | 128 MiB | 64 MiB |

Conservative mode applies when device-memory information is absent or reports at most 4 GiB. Plaintext storage pages are at most 256 KiB; authenticated ciphertext adds overhead. Stream chunks are at most 1 MiB. Shared lanes admit two I/O operations, two crypto operations and one maintenance operation. Queues have a fixed capacity. Exhaustion pauses admission; it does not authorize deleting unsaved edits. Inactive clean caches can release capacity synchronously. Dirty revisions require verified recovery before eviction. (Sources: `webgpu-os/storage/WorkingSetBudget.js`, `webgpu-os/kernel/OperatorVaultService.js`, `webgpu-os/storage/PagedRecordStore.js`.)

Application paging uses IndexedDB and the origin-private filesystem. It cannot configure the operating system's swap file. Storage persistence and quota are browser capabilities. Quota observations can differ from the limit actually enforced, especially in a private browser context. OPFS preserves quota and permission exceptions so callers do not confuse them with a missing file. Low-space behavior stops disposable growth and retains recovery rather than removing the only document copy. (Sources: `webgpu-os/storage/OPFSDriver.js`, `webgpu-os/storage/StorageManager.js`; [browser persistence](https://developer.mozilla.org/en-US/docs/Web/API/StorageManager/persist).)

## Secret keys and account recovery

The operator vault generates a random secret root. Purpose-separated keys bind encrypted pages to the account, application, collection, key epoch, page identity and revision context. Applications receive scoped storage operations and memory reservations; they do not receive raw keys. Operator lock, replacement, revocation or disposal closes that authority and releases decrypted caches. Notepad can use this service without starting Navi. (Sources: `webgpu-os/storage/OperatorVaultKeyStore.js`, `webgpu-os/kernel/OperatorVaultService.js`.)

Verified, signed-in accounts automatically create and verify random local vault custody. Existing local data can migrate without entering an account recovery code. The local key stays separate from portable recovery: `localReady` means local storage can operate, while `portableEnrolled` means an account recovery code also wraps that same root. Account creation can enroll portable recovery while its newly generated code is available. Missing or damaged existing custody stops access instead of creating a replacement key. (Sources: `webgpu-os/storage/OperatorVaultKeyStore.js`, `webgpu-os/kernel/OperatorVaultService.js`, `webgpu-os/drivers/ProfileDriver.js`.)

User Management's Recovery panel shows local storage and portable recovery separately. Optional portable setup asks for the account's existing recovery code in a private prompt. Losing that code does not block local use or automatic migration. Rotating the signing key is a separate identity operation, not a way to reissue the same lost code. Keep the account bundle, private-data backup and recovery code for portable restoration; a code alone cannot recreate document bytes. Streaming backup export requires browser file-picker support. (Sources: `webgpu-os/factory/apps/user-management/UserManagementApp.js`, `webgpu-os/drivers/ProfileDriver.js`.)

Native key records and custody anchors commit together under an exact comparison. A separately verified, signed Files witness detects loss of the entire native key database. Startup also checks one paged-directory entry and the exact account catalog database before creating a root. It does not scan document bodies. Portable restore can replace an unused automatically created root only after proving that no collection uses it; the prior key is retained, and a signed transition allows interrupted Files publication to resume. Existing paged data without a surviving key or matching signed custody witness remains blocked rather than adopting an unproven replacement. (Sources: `webgpu-os/storage/OperatorVaultKeyStore.js`, `webgpu-os/kernel/OperatorVaultService.js`.)

Portable vault backups stream wrapped keys, encrypted pages and roots, with a signed footer binding the complete archive. Import verifies the complete archive before installing keys or publishing collection heads. Each collection activates only after its recovery representation verifies. A later collection failure can leave earlier verified collections restored; this is not a transaction across the entire backup. Truncation, appended bytes, wrong recovery codes, missing components and competing heads fail verification. (Sources: `webgpu-os/storage/OperatorVaultArchive.js`, `webgpu-os/kernel/OperatorVaultService.js`.)

Navi keeps its existing continuity key hierarchy and recovery policy. Its memory, relationships and derived projections use explicit encrypted record contracts. Disposable derived projections can be rebuilt from canonical sources; they are not an alternative authority for identity, permissions or forgetting. (Sources: `webgpu-os/kernel/navi/NaviContinuityService.js`, `webgpu-os/kernel/navi/NaviMemoryService.js`, `webgpu-os/kernel/navi/NaviPagedProjectionStore.js`.)

## Exact publication and uncertain completion

`PagedRecordStore` exposes `readHead`, `readPage`, bounded `query`, `commit`, `flush`, `status` and `dispose`. Queries stop at 128 entries or 256 KiB, and a 2 MiB decoded-allocation ceiling can return an earlier continuation for dense metadata. Large values span immutable pages. Index nodes are themselves paged; increasing the archive does not append every record name to one root. Readers pin the exact head they use and release returned byte ownership explicitly. External callers await a head pin's `ready` promise before a multi-call read and release the pin afterward.

Decoded metadata is admitted before JSON parsing, including authenticated heads, index nodes and outer recovery envelopes. Index splits consider both encoded page size and decoded allocation. Dense arrays cannot bypass admission by fitting into a small encoded page. Producer estimates cover sparse slots, undefined object fields and extra array fields retained during copying. Records require arrays or plain JSON objects, including objects with a null prototype. Model and host objects must export a plain snapshot first. Excessive depth, accessors and serialization hooks are rejected. Native storage operations settle after their transactions complete, so shutdown joins the actual database work. (Sources: `webgpu-os/storage/PagedRecordStore.js`, `webgpu-os/storage/PagedJsonRecordStore.js`, `webgpu-os/storage/ImmutablePagedIndex.js`.)

A commit stages and authenticates changed content, conditionally replaces the local head, publishes the matching filesystem recovery head, then verifies publication. Its receipt identifies the revision and recovery state. IndexedDB and files remain separate stores. A recoverable operation journal bridges the two; no single transaction is claimed to span them. `flush` observes or resumes the original operation ID and comparison token after an uncertain result. It never adopts a competing head as permission to overwrite it. (Sources: `webgpu-os/storage/PagedRecordStore.js`, `webgpu-os/storage/PagedJsonRecordStore.js`.)

Previous roots remain valid until publication succeeds. Checkpoints retain promised undo roots and pinned readers. Garbage collection traces retained roots and pending operations before retiring unreferenced ciphertext. Foreground saves verify changed content and authenticated references. Full archive health work runs independently. Strict IndexedDB durability is requested where supported and its actual capability is recorded. This is not a universal hardware power-loss guarantee. (Sources: `webgpu-os/storage/PagedRecordStore.js`, `webgpu-os/storage/IndexedDBTransaction.js`; [IndexedDB durability](https://developer.mozilla.org/en-US/docs/Web/API/IDBDatabase/transaction).)

Background collection advances one authenticated traversal or deletion unit at a time. Its encrypted progress and mark pages survive interruption. Every step checks the current recovery head and live reader roots; changed authority restarts marking before deletion. Filesystem-only orphans are inventoried with a native directory cursor, and deletion requires an exact content witness. JSON record compaction traces nested byte pages as well as directory entries. Foreground edits pause and join compaction before choosing a comparison token. Application shutdown cancels and joins dispatched maintenance. (Sources: `webgpu-os/storage/PagedCollectionMaintenance.js`, `webgpu-os/storage/PagedJsonRecordStore.js`, `webgpu-os/storage/OPFSDriver.js`.)

Temporary admission, quota and I/O failures schedule an owned retry with exponential delays from one to sixty seconds. Repeated identical failures produce one notice, and success resets the delay. Authentication failures stop maintenance for intervention. Disposal cancels pending retries. (Source: `webgpu-os/storage/PagedJsonRecordStore.js`.)

The vault feeds existing storage-health pressure levels into the shared budget. Low space stops disposable prefetch and cache growth; only unpinned disposable allocations may be evicted for this reason. Required reads and captured edits retain normal admission. A quota failure supersedes an older pending healthy observation. Health checks are coalesced, throttled and fenced by account generation, and account drain owns outstanding checks. (Sources: `webgpu-os/kernel/OperatorVaultService.js`, `webgpu-os/storage/WorkingSetBudget.js`, `webgpu-os/storage/StorageManager.js`.)

### Cognition startup admission

Valid saved Smart Routing configurations exposed an allocation-accounting error during Navi startup. The shared cognition encryption wrapper multiplied an already expanded JSON allocation estimate by sixteen for both sealing and opening. Configurations containing 142,745 and 273,977 UTF-8 bytes exceeded that calculation's crypto-buffer admission under the 64 MiB and 128 MiB tiers respectively. Startup reported `operator-error; WORKING_SET_EXHAUSTED` even though the encrypted records remained valid. (Sources: `webgpu-os/kernel/navi/NaviContinuityService.js`; regression fixture: `tests/navi/cognition-route-capacity.test.js`.)

Continuity reserves captured input in the dirty pool and temporary serialization, UTF-8, decoding and crypto buffers in the inflight pool. Before parsing decrypted JSON, it separately reserves the immutable output graph in the clean pool. That graph stays pinned through asynchronous consumption and the final authority check. Fresh parsed graphs use a direct finite-value check and freeze, avoiding descriptor maps for every object. Sealing also validates its private captured clone directly without descriptor maps, then checks future decoding and graph admission before returning ciphertext to a writer. The shared budgets, authenticated record format and exact revision checks remain unchanged. (Sources: `webgpu-os/kernel/navi/NaviContinuityService.js`, `webgpu-os/storage/WorkingSetBudget.js`.)

The shared JSON helpers distinguish these allocations. `estimateRetainedJsonAllocation` counts retained UTF-16 strings, keys, objects and array slots; `estimateJsonSerializedBytes` bounds the UTF-8 JSON representation, including escapes and surrogate pairs. `estimateParsedJsonAllocation` bounds a fresh parsed graph before `JSON.parse` creates it. The existing combined estimators keep their previous behavior. Input traversal still rejects accessors, serialization hooks, cycles and excessive depth before copying; semantic validation retains the finite-number, plain-data and dense-array requirements. (Sources: `webgpu-os/storage/PagedJsonRecordStore.js`, `webgpu-os/kernel/navi/NaviContinuityService.js`; native fixture: `tests/storage/paged-json-packed.test.js`.)

Base64 decoding validates canonical text before allocating the output, then decodes at most 8,192 characters per chunk. Encoding processes at most 6,144 input bytes per chunk. The wrapped data key must have its exact authenticated size before decoding. Ordinary cognition writes retain captured ciphertext separately from fixed hashing scratch and incrementally hash the same canonical bytes used by existing record hashes. Exact native comparisons and revision checks still prevent a competing writer from being overwritten. These changes reduce real intermediate allocations and repeated accounting; they do not increase a budget or bypass provider admission. (Sources: `webgpu-os/kernel/navi/NaviKeyVault.js`, `webgpu-os/kernel/navi/NaviCognitionStore.js`, `webgpu-os/storage/IncrementalSha256.js`.)

Copied Echo diagnostics distinguish current cognition status from a retained incident. The `naviCognition` block records its observation time, current state, error code and, when available, the capacity failure time. `incidentRelationToStartup` identifies whether the selected incident predates the current startup; an old incident cannot establish that the same operation failed after reload. Unset readiness timestamps remain absent. (Sources: `webgpu-os/apps/ai-echo/factory.js`, `webgpu-os/apps/ai-echo/DiagnosticReport.js`, `webgpu-os/kernel/KernelBootstrap.js`.)

Capacity evidence contains only validated scalars: allocation category, operation, phase, requested growth, complete reservation size, category usage and limit, and total usage and limit. The `working-set-failure-v1` record excludes owners, record identities and bodies. Cognition labels the failing capture, serialization, encryption, decryption, text-decoding or parse-admission phase without changing the original error or relaxing admission. (Sources: `webgpu-os/storage/WorkingSetBudget.js`, `webgpu-os/kernel/navi/NaviContinuityService.js`, `webgpu-os/apps/ai-echo/DiagnosticReport.js`.)

The existing authority recovery scheduler now recognizes a capacity failure as temporary only when its complete reservation independently fits both limits and another occupied lease caused the category shortage. Resize checks use the final reservation, not just its growth. It permits at most three scheduled attempts per binding generation, after 120, 600 and 1,800 ms, and rechecks authority and failure evidence before each attempt. Oversized records, malformed evidence and corruption do not gain capacity retries. Account changes, disabling Navi and shutdown retain the existing cancellation fences. (Source: `webgpu-os/kernel/KernelBootstrap.js`.)

A larger synthetic legacy configuration contains 1,042,849 UTF-8 bytes and 504 routes: 63 model candidates for each of eight purposes, including route metadata. Before the codec and ownership correction, its `cognition-open-decrypt` reservation requested 33,486,792 bytes with zero existing inflight usage and failed under both tiers. It now opens under both the 64 MiB and 128 MiB budgets, preserving the original encrypted source, revision and all candidates. Both unchanged and changed ordinary configuration writes also verify through readback without calling a provider. The failed and intermediate receipts remain retained; this proves the tested catalog rather than every possible catalog. Separately, the latest operator report confirms ready cognition, a ready route and a writable chat after reload. Its selected completed request predates that startup and does not establish a new successful request. The remaining Presence and Development failures are described below. (Receipts: `tmp/ai-heavy-workload-implementation-2026-09-08/navi-smart-route-capacity-user-size-before-r2-20260920.json`, `tmp/ai-heavy-workload-implementation-2026-09-08/navi-smart-route-capacity-user-size-after-r3-20260920.json`.)

## Text, Notepad and code documents

`AsyncByteSource` supplies immutable `size`, `revision`, `readRange` and `stream` operations for native Blob/File sources and encrypted pages. Encrypted asynchronous storage is not represented as a native Blob. Text consumers retain the existing `TextEditBuffer`, `LargeTextModel`, shared search, syntax and viewport limits. A 1 GiB source does not enable unrestricted rich-document rendering or whole-file regular expressions. (Sources: `webgpu-os/storage/AsyncByteSource.js`, `webgpu-os/factory/apps/notepad/large-text-edit-buffer.js`, `webgpu-os/factory/apps/notepad/large-text-model.js`, `webgpu-os/factory/apps/notepad/large-text-search.js`.)

Recovery captures the exact immutable base bytes, inserted pages, piece roots and the 128-entry undo window. A filesystem path, hash or browser file handle alone is not recovery. The workspace directory is small; independent document manifests hold source, format and revision witnesses. Opening restores metadata and active content first. Inactive document bodies are read on access or through bounded maintenance. Changed-document queues replace whole-workspace snapshots on every edit. (Sources: `webgpu-os/factory/apps/notepad/NotepadTextRecovery.js`, `webgpu-os/factory/apps/notepad/NotepadWorkspacePersistence.js`.)

Named text files keep their existing encoding, BOM, line endings and format. Atomic saves capture an immutable revision and the target's expected version. Rich-document and PDF saves capture the target witness before conversion and retain the exported revision in encrypted recovery. A successful older save marks only its captured revision saved; later edits remain dirty. External mounts retain their cooperative conflict guarantees. (Sources: `webgpu-os/factory/apps/notepad/index.js`, `webgpu-os/storage/StorageManager.js`.)

CodeWorkspace retains dirty tabs when another tab would exceed its admission limit. Its encrypted directory restores open tabs even if the original file has been deleted. Normal close flushes recovery before disposing an editor; account revocation still invalidates access immediately. ArtifactStudio admits file decoding, active content and retained scope drafts through the same application budget. Its existing format limits remain; large plain text belongs to the paged text editor. (Sources: `webgpu-os/apps/ai-echo/CodeWorkspace.js`, `webgpu-os/apps/ai-echo/ArtifactStudio.js`, `webgpu-os/apps/ai-echo/ArtifactWorkspace.js`, `webgpu-os/apps/ai-echo/factory.js`.)

Code folder browsing requests at most 128 directory entries and replaces its displayed page. New navigation cancels the previous request. The project summary requests only its remaining discovery window before reading metadata. Directory, DOM and retained summary ownership use the same budget; legacy storage adapters that cannot page a larger folder direct browsing to Files. (Sources: `webgpu-os/apps/ai-echo/CodeWorkspace.js`, `webgpu-os/apps/ai-echo/ProjectIntelligence.js`, `webgpu-os/kernel/Syscalls.js`.)

Artifact drafts use the shared paged vault through independent workspace manifests and immutable text chunks. Recovery preserves exact text, including BOM, CRLF and isolated UTF-16 surrogates. A small edit reuses unchanged chunks. A restart loads only the selected workspace; verified inactive drafts can release their text cache. The latest named revision has its own encrypted recovery slot, linked from the current draft. Later typing cannot supersede that captured representation. Both the named file and its exact recovery verify before the UI acknowledges completion. An explicit workspace retirement publishes a tombstone so closing and reopening does not resurrect it. Conflicts retain the competing pending draft and do not adopt another writer's head. (Sources: `webgpu-os/apps/ai-echo/ArtifactDraftRecovery.js`, `webgpu-os/apps/ai-echo/ArtifactStudio.js`.)

Learned text and OCR models use the same private record store and background maintenance. Their owner joins opening, reading, captured saves and legacy cleanup before releasing retained data. Cancellation also ends a queued migration-lock wait. PDF and OCR surfaces dispose only explicitly owned model adapters; borrowed adapters retain their separate lifetime. These adapters still load and save whole-model snapshots. Loading and teaching must fit admitted model allocations; paging persistence does not provide unlimited training outside RAM. (Sources: `webgpu-os/factory/core/storage/EncryptedRecordChunks.js`, `webgpu-os/factory/apps/notepad/pdf-document-surface.js`, `webgpu-os/factory/components/ocr/index.js`.)

## Echo and Navi history

Echo retains an active window of at most 96 conversation turns. The UI requests at most 512 KiB for a displayed history page, replaces the previous window and cancels obsolete reads. An in-flight read does not overwrite newly typed composer text. Complete session export streams the authenticated archive to an atomic file writer. Archive run details use exact session and turn identities instead of looking only in the active cache. Uncertain saves retain their original captured revision until recovery verifies. (Sources: `webgpu-os/apps/ai-echo/AgentStateStore.js`, `webgpu-os/apps/ai-echo/AgentPagedState.js`, `webgpu-os/apps/ai-echo/factory.js`, `webgpu-os/apps/ai-echo/AgentToolset.js`.)

The million-message workload is a test target, not a limit on the saved history format. Session counts and their directory total must remain exact nonnegative safe integers. Increment or aggregate overflow is rejected before publishing a new head, preserving both the previous verified revision and unsaved edits. Reopening accepts valid counts beyond one million. (Source: `webgpu-os/apps/ai-echo/AgentStateStore.js`.)

Navi indexes canonical memory by branch and sequence, relationships by their durable sequence and gateway deliveries by due time, status and thread. Queries select bounded references before decrypting bodies. Derived projections process at most 64 source events per refresh and continue through an owned, cancellable maintenance task. Covenant changes, expiry, forgetting and key revocation invalidate old visibility. Wiki browsing loads a 32-result page and retrieves the selected complete page separately. Partial indexing remains visible in the UI. (Sources: `webgpu-os/kernel/navi/NaviMemoryIndex.js`, `webgpu-os/kernel/navi/NaviRelationshipService.js`, `webgpu-os/kernel/navi/NaviAgentDeliveryIndex.js`, `webgpu-os/kernel/navi/NaviDerivedProjectionService.js`, `webgpu-os/apps/ai-echo/NaviKnowledgeWorkspace.js`.)

Gateway routing uses authenticated immutable index pages. Changed nodes are staged and verified before publishing a small root with the matching body and thread state. A missing referenced routing page fails verification even when the requested range would otherwise appear empty. This prevents deletion of an unauthenticated index pointer from silently hiding a delivery. Encrypted retirement journals identify obsolete pages. A shared reader barrier and exact current-root checks protect active reads; one maintenance candidate is processed at a time. Replaying an old pending journal cannot authorize deleting a currently referenced page. A bounded legacy sweep handles pages created before retirement journals existed. (Sources: `webgpu-os/storage/ImmutablePagedIndex.js`, `webgpu-os/kernel/navi/NaviAgentDeliveryIndex.js`, `webgpu-os/kernel/navi/NaviImmutableIndexGC.js`.)

New Navi cognition records have an atomic byte-size witness. Reads consult it before admitting the native body clone; failed writes roll the witness and body back together. Database version 11 also fences writers that could rebuild legacy memory behind a resumable inventory cursor. It retains the earlier witness, subject-checkpoint, index-retirement and pending-erasure fences. Legacy records without witnesses remain readable through a reported compatibility path. Their initial IndexedDB body clone cannot be certified as pre-admitted because the existing backend cannot inspect a value's size without reading it. Continuity encoding, decoding and producer staging still use the shared budget. (Sources: `webgpu-os/kernel/navi/NaviCognitionStore.js`, `webgpu-os/kernel/navi/NaviContinuityService.js`, `webgpu-os/kernel/KernelBootstrap.js`.)

Owned cognition inventory pages retain their reservations until release, cancellation or account closure. A native key cursor stops at 128 records or 256 KiB and checks the next record's witness before fetching its body. It does not fall back to a complete listing. A missing witness identifies one exact legacy record for separate compatibility enrollment: authenticate its unchanged content, enforce the small record-allocation window, then atomically record its size without rewriting its ciphertext. This enrollment preserves the legacy format's initial native-clone limitation; subsequent strict pages require the recorded witness. Large or corrupt old records remain intact when enrollment refuses. (Source: `webgpu-os/kernel/navi/NaviCognitionStore.js`.)

Each native record collection also has a small inventory revision. Source writes, portable imports, deletions and quarantine changes advance it in the same IndexedDB transaction; recording a byte witness alone does not. Migration captures that token in its authenticated journal and checks it during every progress or head publication. A current importer therefore cannot insert behind the scan cursor while leaving the old head unchanged and escape conflict detection. Aborted writes roll back the inventory revision with the record and its byte witness. (Source: `webgpu-os/kernel/navi/NaviCognitionStore.js`.)

First-index preparation inventories one admitted signed source at a time and stores an encrypted sequence witness and continuation. Ordered replay verifies sequence, ancestry and clocks while building the existing subject checkpoints. Progress and activation compare the exact canonical head, preparation journal and source inventory token. An uncertain acknowledgement is reconciled against those exact publications. Original signed events and payloads are never rewritten or deleted by this conversion. Current and promised preparation roots remain protected from collection. (Sources: `webgpu-os/kernel/navi/NaviMemoryIndexMigration.js`, `webgpu-os/kernel/navi/NaviMemoryIndex.js`.)

The preparation queue holds at most 32 jobs and advances one source or checkpoint step per maintenance turn. Suspension cancels scheduling and joins dispatched work before releasing ownership. Proven temporary admission shortages retry with delays from one to sixty seconds; ordinary refreshes cannot reset that delay. A permanent conversion failure remains paused across refreshes, so an oversized unwitnessed record is not repeatedly cloned. Reopening the account service after correcting the problem permits another attempt. An authenticated completed-empty proof avoids rescanning other branches on each unchanged opening; the first append removes that proof atomically with its new event and head. (Sources: `webgpu-os/kernel/navi/NaviMemoryService.js`, `webgpu-os/kernel/navi/NaviMemoryIndexMigration.js`.)

Echo displays preparation as a pending state and refreshes knowledge automatically on completion, including completion during startup hydration. A paused conversion has a separate message. Previously verified content remains visible only while its exact scope and authority remain valid; knowledge mutations wait for preparation. One selected page can retain bounded retry intent and is reread under current authority after completion. Account changes and lifecycle cleanup revoke cached content, pending loads, selection intent and scheduled refreshes. (Sources: `webgpu-os/apps/ai-echo/NaviKnowledgeWorkspace.js`, `webgpu-os/apps/ai-echo/NaviKnowledgePanel.js`, `webgpu-os/apps/ai-echo/factory.js`.)

Pending erasures use an authenticated work index. Preparing a journal and indexing it commit atomically; completion and pending-node retirement also share an exact transaction. Startup performs a bounded recovery window, then owned maintenance continues. A resumable legacy cursor visits one journal per step. Prepared journals suppress payload disclosure before physical deletion; final read checks reject content whose visibility changed while it was being decoded. Initialization and suspension own and join native work so a closed service cannot become ready later. (Sources: `webgpu-os/kernel/navi/NaviErasureIndex.js`, `webgpu-os/kernel/navi/NaviMemoryService.js`.)

Repeated revisions of a Navi subject use durable conflict-reduction checkpoints. Paged candidate, selection and contradiction records avoid reconstructing the subject's complete history for each append. The canonical branch head authenticates a paged subject directory containing exact revision and encrypted-envelope hashes, so replaying an older valid subject row fails verification. Legacy directory migration streams signed sources into resumable checkpoints and activates only after verification. (Sources: `webgpu-os/kernel/navi/NaviMemoryIndex.js`, `webgpu-os/kernel/navi/NaviMemorySubjectCheckpoint.js`, `webgpu-os/kernel/navi/NaviMemoryService.js`.)

The application memory gateway exposes `listPage` and `subjectState`. A memory page contains at most 128 records or 256 KiB of admitted decoded data. Its continuation binds the exact authenticated head, requester and selection; a fresh access grant is evaluated for every page. Current-state summaries require complete, visible checkpoint evidence and at most 64 selected event IDs. Oversized or incomplete summaries fail rather than returning misleading partial state. Compatibility `list`, `history` and explanation calls retain their data shapes but refuse results larger than one admitted window. Callers release owned results after copying into their own admitted storage. Cancellation, expiry, authority changes and disposal close issued windows. (Sources: `webgpu-os/kernel/navi/NaviMemoryService.js`, `webgpu-os/kernel/KernelBootstrap.js`, `webgpu-os/kernel/Syscalls.js`.)

Forgetting uses the exact authenticated target's metadata before checking mutation policy. Research promotion compares current-state summaries and exact event pages. Legacy knowledge imports read only a source's active head, desired event and required predecessors, including conflict reconciliation; they no longer build an inventory of unrelated branch history. Competing active source heads remain a collision. A failure after an attempted append is reported as uncertain completion, and the same original snapshot must be reconciled before retrying. Input copies, import scratch and signed receipts retain separate reservations. (Sources: `webgpu-os/kernel/navi/NaviLegacyKnowledgeImportService.js`, `webgpu-os/apps/ai-echo/AgentToolset.js`.)

Interactive readiness distinguishes authenticated local state, readable active content, writable recovery, provider readiness and background completion. Echo validates the selected provider independently. Kernel voice initialization, development-history processing and gateway catch-up retain cancellation and shutdown ownership without blocking unrelated active content. (Sources: `webgpu-os/apps/ai-echo/factory.js`, `webgpu-os/kernel/KernelBootstrap.js`, `webgpu-os/kernel/navi/NaviAgentGateway.js`.)

Echo's critical configuration load reads the authoritative local configuration. Provider definitions and Companion capability negotiation run in the existing owned background hydration, with account, mount and configuration checks before publication. A missing Companion can require repeated transport probes; those waits no longer hold the restored editor. The installation notice updates after capability evidence arrives, and sending still requires its verified route. (Sources: `webgpu-os/apps/ai-echo/factory.js`, `webgpu-os/kernel/ai-hub/AdaptiveProviderBridge.js`.)

A pending Navi service, missing primary Navi or invalid provider address no longer turns an authenticated local session into a restore failure. Echo keeps local editing and Settings available, shows a routing notice and retries through its existing cognition/continuity events. Route readiness remains false until synchronization verifies. Sending still requires the exact route and current provider admission; missing receipts, unknown synchronization failures and mismatched readback remain errors. (Source: `webgpu-os/apps/ai-echo/factory.js`; tests: `tests/navi/phase2-ai-echo-routes.test.js`, `webgpu-os/factory/testing/smoke/ai-echo.html`.)

The routing notice says Navi is preparing only while cognition explicitly reports initialization or operator rebinding without an error. Disabled cognition, an unconfigured or offline provider, memory exhaustion and other startup errors have separate messages. `WORKING_SET_EXHAUSTED` remains visible as the cause instead of an indefinite preparation promise. The notice reports a restored local session and continued draft editing only after active content and writable recovery are verified; those states do not imply that AI sending is available. (Source: `webgpu-os/apps/ai-echo/factory.js`, `_recordLocalRouteReadiness`; tests: `tests/navi/phase2-ai-echo-routes.test.js`.)

Provider streaming uses admitted batches with backpressure. The private spool retains encrypted immutable chunks and verifies their recovery before returning a saved receipt. Bounded reads return at most 64 chunks or 256 KiB, a continuation cursor and a release operation. Subscription replay consumes pages sequentially and cancels on view detach. Tool results retain their source and serialized output allocations until request cleanup or explicit release. (Sources: `webgpu-os/kernel/execution/TwoPassPlannerFinalizer.js`, `webgpu-os/kernel/execution/AIEchoStreamSpool.js`, `webgpu-os/kernel/execution/PagedSpoolStorage.js`, `webgpu-os/kernel/ToolDriver.js`.)

### Presence and bounded task viewing

Presence readiness is separate from cognition, routing and a selected execution incident. The latest operator diagnostic identifies a task-read failure, `NAVI_COGNITION_LEGACY_RECORD_TOO_LARGE`, while cognition, routing and writable chat are ready. Its selected completed 12.24-second request is older than the current startup. Current exports include a separate `naviPresence` projection containing only its state, phase, observation time, typed error code and validated working-set scalars. They exclude task identifiers, objectives and bodies. A successful incident does not erase a current Presence failure. (Sources: `webgpu-os/apps/ai-echo/DiagnosticReport.js`, `webgpu-os/apps/ai-echo/factory.js`.)

Presence refreshes read Manifestations, handoffs and tasks sequentially. Concurrent refresh requests share one active refresh and at most one trailing request. The already verified Manifestation list supplies the active and primary body without a second primary read. Tasks use `listTasksPage` through the operator-scoped gateway: the UI requests 32 records, while normal native pages retain the 128-record and 256 KiB estimated-allocation bounds. The returned summary page also stays within 256 KiB. Summaries contain bounded display evidence; they do not authorize handoff. The service pins its output until release, and the view separately admits option labels and rendered summaries. Replacing a page, clearing the view or changing authority releases those owners. (Sources: `webgpu-os/kernel/navi/NaviCognitionService.js`, `webgpu-os/kernel/KernelBootstrap.js`, `webgpu-os/apps/ai-echo/factory.js`.)

First and Next controls navigate the selected task inventory. Cursors are scoped to the Navi, service generation and inventory revision; changed source evidence invalidates them. Ordinary refreshes return to the first page. Opening task evidence or preparing a handoff reads only the selected exact task and checks its identity and revision against the summary. Review uses that verified task's complete authority and causal evidence. A newer revision requires a fresh page, and late reads cannot cross unmount or operator changes. A retained exact task and its rendered evidence have their own clean-memory owner. (Sources: `webgpu-os/kernel/navi/NaviCognitionService.js`, `webgpu-os/apps/ai-echo/factory.js`, `webgpu-os/apps/ai-echo/NaviPresenceSettings.js`.)

Task admission failures, including the exact legacy-record capacity error, disable task handoff while preserving verified Manifestation destinations. Corrupt or malformed responses still fail closed. A task that exceeds the ordinary page allowance can use an owned exact singleton read before its verified contents are reduced to a bounded summary. This path derives an allocation ceiling of approximately 3 MiB under the conservative budget and 7 MiB under the normal budget, leaving separate clean-memory headroom. These are estimated allocation limits, not plaintext file-size limits. Larger or currently inadmissible records remain retained and report their typed failure; they are never silently skipped. This change does not convert task bodies into chunks, alter the other Manifestation or handoff inventory APIs, or establish the million-task archive tier. The separate whole-legacy-archive Echo startup audit remains pending. (Sources: `webgpu-os/kernel/navi/NaviCognitionService.js`, `webgpu-os/kernel/navi/NaviCognitionStore.js`, `webgpu-os/apps/ai-echo/factory.js`.)

For an old native record without a byte witness, IndexedDB's first clone cannot be size-certified before the read. The exact reader reserves the bounded compatibility allowance first, immediately measures the returned value, and refuses an oversized result without changing its stored bytes. Once measured, it shrinks the reservation to the required allocation. Witness enrollment compares the exact canonical ciphertext hash and inventory revision transactionally; it does not rewrite the encrypted record or its revision. Known witnesses permit exact admission before retrieval. This explicit legacy limitation remains even though the successful result and subsequent owned reads are bounded. (Sources: `webgpu-os/storage/NativeOwnedInventory.js`, `webgpu-os/kernel/navi/NaviCognitionStore.js`.)

The native encrypted-task probe stored 48 tasks under the conservative budget and 96 under the normal budget. The earlier whole-history listing exceeded the respective 32 MiB and 64 MiB clean-memory limits. Paged listing visited every task across 24 and 48 pages, with a peak clean allocation of 2,789,824 bytes in both tiers. Total peak allocation was 2,853,312 and 2,871,744 bytes respectively. Additional real encrypted tasks with 128 KiB and 512 KiB fact bodies passed at first, middle and final page positions, with and without existing witnesses. Initial unknown-record compatibility reservations raised the clean peak to 24.25 MiB and 56.25 MiB respectively; these are accounted reservation ceilings, not browser heap measurements. The probe preserved exact selected-task evidence, read no bodies from an unrelated 330,903-byte route configuration and drained all owned allocations. These are service-level measurements for the recorded corpora; the Presence UI separately reserves its rendered page. They do not measure the operator's account after this Presence fix. (Receipt: `tmp/ai-heavy-workload-implementation-2026-09-08/presence-task-capacity-large-native-r1-20260920.json`.)

### Development binding and current failure evidence

Development has its own identity binding and readiness. A real native reproduction traced a generic bind failure to an unregistered record type during source refresh. The existing `development-program-evidence`, `development-screen-outcome` and `development-archive` types are now registered consistently in cognition storage, continuity encryption and the matching backup partition. A second reproduction found that unsaved default self-model data receives a new timestamp on each read, so it cannot serve as stable learned evidence. Development sources require persisted identity and self-model records before deriving those evidence references. (Sources: `webgpu-os/kernel/navi/NaviDevelopmentKernelBinding.js`, `webgpu-os/kernel/navi/NaviCognitionStore.js`, `webgpu-os/kernel/navi/NaviContinuityService.js`, `webgpu-os/kernel/navi/NaviBackupRecoveryService.js`.)

Each diagnostic export reads current Development gateway status separately from cognition, Presence and the selected historical incident. The closed `naviDevelopment` projection contains availability, state, the bind phase, observation time, a typed error code, an allowlisted error name and validated capacity scalars. It never includes graph contents, source identities, policy bodies, exception messages or stacks. Bind phases distinguish storage initialization, graph initialization, source refresh and screen restoration. Invalidation clears the previous authority's failure evidence; successful binding reports ready. A failed status read leaves the rest of the report available with its own typed status error. (Sources: `webgpu-os/kernel/navi/NaviDevelopmentKernelBinding.js`, `webgpu-os/apps/ai-echo/factory.js`, `webgpu-os/apps/ai-echo/DiagnosticReport.js`.)

Native checks now complete a fresh Development bind and a cold reopen under both memory budgets, preserving the exact graph without rewriting unchanged sources. They also save and read all three existing record contracts and verify their inclusion in the signed backup partition. Binding uses the operator's working-memory owner; the correction does not change record formats, delete data or treat unsaved defaults as learned history. This native reproduction and correction do not establish the operator's post-fix Development state; a new current-status observation is required for that claim. (Receipt: `tmp/ai-heavy-workload-implementation-2026-09-08/development-native64-r1-20260920.json`.)

## Migration and rollout

Legacy AppSandbox encryption derives keys from public fingerprints. It is a compatibility format, not a secret-key vault. Private collection migration requires verified local custody, copies forward into the shared paged store, verifies content and recovery, and then activates a versioned root that rejects older writers. Portable enrollment is optional for local migration. Legacy readers remain while migration is pending. Obsolete weakly encrypted copies are eligible for cleanup only after verified activation and reader retention. Ordinary named user files are not converted into encrypted vault files. (Sources: `webgpu-os/storage/AppSandbox.js`, `webgpu-os/apps/ai-echo/AgentStateStore.js`, `webgpu-os/factory/core/storage/EncryptedRecordChunks.js`, `webgpu-os/factory/apps/notepad/NotepadWorkspacePersistence.js`.)

Use a backup containing both keys and encrypted content before moving accounts or browser profiles. A migrated collection must never be opened by bypassing its version fence. Echo's copy checkpoints preserve the original source token, stable history identity and copied-row cursor. Initial activation still waits for all required source and recovery receipts. Stream migration can proceed independently for the requested stream.

Legacy reads derive a potential encrypted-envelope ceiling from the selected memory budget and its category limits, including the retained 6 MiB metadata allowance. The existing owner must reserve eight times the actual envelope bytes before IndexedDB fetch, then add twice the estimated decoded graph before JSON parsing. It retains the decoded source and a consumer snapshot until release. Actual occupied capacity can reject a read below that potential ceiling. Echo keeps an 8 MiB decoded-graph limit and the spool keeps 2.5 MiB. Without proven budget capabilities, the earlier per-record envelope ceilings remain 2 MiB and 512 KiB respectively. (Sources: `webgpu-os/storage/LegacyRecordAdmission.js`, `webgpu-os/apps/ai-echo/AgentStateStore.js`, `webgpu-os/kernel/execution/PagedSpoolStorage.js`.)

Each old AppSandbox value is one AES-GCM message held in one IndexedDB value. Native retrieval and authentication require the complete value; wrapping it in a byte source or worker does not create authenticated range reads. Records that cannot be admitted remain intact. Some existing large legacy archives therefore remain inaccessible through the bounded migration path. Exporting an already readable session is not a universal conversion workaround. Automatic key provisioning does not remove this legacy record-size limit. (Sources: `webgpu-os/storage/AppSandbox.js`, `webgpu-os/storage/LegacyRecordAdmission.js`, `webgpu-os/kernel/execution/PagedSpoolStorage.js`.)

For an account with verified local custody, Echo can activate a verified active conversation while retaining an oversized inactive session in its original format. The mixed root records the exact encrypted source token, byte count, source generation and checkpoint scope. AppSandbox authenticates inventory membership and streams verification of the matching Files recovery bytes without fetching the native data row. Activation compares the original global root and all retained source witnesses in one IndexedDB transaction, then verifies recovery publication. A newer format marker fences earlier writers. Original source records remain current and are excluded from cleanup; an unknown pending archive count is not reported as zero. (Sources: `webgpu-os/storage/AppSandbox.js`, `webgpu-os/apps/ai-echo/AgentStateStore.js`.)

Selecting retained history resumes its original copy checkpoint before changing the active session. If capacity is still insufficient, the current active conversation remains usable and the older bytes remain retained. Missing, changed or corrupt sources remain verification failures. The per-source witness check on a verified mixed root checks exact metadata without separately rehashing its recovery segment; first activation and selected-source preparation require full recovery proof. The older initial AppSandbox inventory audit still has separate whole-record work, so this optimization is not evidence of zero inactive I/O throughout cold boot. Verified local custody permits activation without a recovery code. Once paged storage owns the history, Echo disables its legacy accessor-based cache so ordinary draft saves still pass strict JSON admission after runtime startup. (Sources: `webgpu-os/apps/ai-echo/AgentStateStore.js`, `webgpu-os/storage/AppSandbox.js`; native tests: `tests/storage/ai-echo-paged-state.test.js`, `tests/storage/app-sandbox-record-witness.test.js`.)

Current startup still joins that whole-sandbox audit before paged opening completes. `_openPagedPersistence` awaits `cleanupReadback`, whose verification barrier authenticates the complete legacy inventory and recovery segments before comparing matching heads. Mixed roots also join the barrier through `readRecordWitness`, even when requesting source metadata without a new recovery check. An operator-provided diagnostic recorded about 333 MB across 29 recovery segments and 32 seconds of verification while the active session shard itself read in 23 ms. Its disabled decoded-history cache is consistent with paging, not evidence that automatic migration failed. The diagnostic does not distinguish a fully paged root from a mixed root. (Sources: `webgpu-os/apps/ai-echo/AgentStateStore.js`, `webgpu-os/storage/AppSandbox.js`.)

Deferring optional cleanup could improve the verified active preview for fully paged roots, but writable readiness still has its own verification barrier. Mixed roots need an explicit read-only source-witness contract; safely separating writable paged collections from unrelated legacy recovery needs a separate authority contract. Those changes remain pending. The cognition codec, allocation and retry corrections do not remove this archive-wide startup work or establish a faster large-archive opening. Legacy audit batching also uses browser heap headroom and reported CPU concurrency rather than the shared paged-store lanes, so its batch metrics must not be presented as accounted shared working-set peaks. (Sources: `webgpu-os/storage/AppSandbox.js`, `webgpu-os/apps/ai-echo/AgentStateStore.js`.)

The vault bounds collection and memory-owner handles and synchronously releases issued plaintext on account freeze. Worker owners receive a signal combining their lifetime, account authority and caller cancellation. They must terminate their worker and settle their operation when cancelled; an arbitrary non-cooperative JavaScript promise cannot be forcibly stopped. (Sources: `webgpu-os/kernel/OperatorVaultService.js`, `webgpu-os/factory/apps/notepad/large-text-model.js`.)

## Desktop boot and resident readiness

Standalone startup begins service-worker registration alongside kernel GPU and storage preparation. Application discovery still waits for registration to settle; installed runtime guests retain the stable parent's verified worker gate. Trust, account activation, local key custody, recovery and patch checks remain required before the desktop becomes ready. (Source: `webgpu-os/index.js`.)

Automatic resident Echo acquisition waits for two rendering frames and idle admission after the boot cover is hidden, with cancellable task fallbacks where those browser APIs are absent. Direct user launches remain available without waiting for that task. Stop, account replacement and desktop disposal invalidate queued acquisition. Installed guests also wait for a private, release-and-epoch-bound notification from the stable parent after the selected iframe is visible and the parent's boot cover is hidden. A hidden update candidate cannot admit automatic warmup merely by completing its local boot. Older stable hosts without this notification leave automatic warmup disabled until the host updates; explicit Echo launch remains available. (Sources: `webgpu-os/shell/Desktop.js`, `webgpu-os/platform/runtime-host/StableBootProgress.js`, `webgpu-os/platform/runtime-host/StableRuntimeHost.js`, `webgpu-os/bootstrap/StableBootstrap.js`.)

Boot telemetry distinguishes runtime readiness from visible desktop readiness and records bounded scalar operator-stage timings. These diagnostics include continuity, network and operator-context durations without account IDs, message bodies or document names. A stage's elapsed time can overlap other activity; it is not an exclusive CPU measurement. Cold module loading, warm navigation and Echo active-content readiness are measured separately. (Sources: `webgpu-os/platform/runtime-host/BootTelemetry.js`, `webgpu-os/kernel/KernelBootstrap.js`, `tests/run_webgpu_os_boot_performance.py`.)

A new Echo conversation remains loaded after its first verified encrypted shard commit. Only changed shards built from complete owned content receive this status; retained unopened archives still require authenticated loading. Failed readback cannot grant it. This also applies to the initial conversation created for an empty account. (Source: `webgpu-os/apps/ai-echo/AgentStateStore.js`; native regression: `tests/storage/ai-echo-paged-state.test.js`.)

An unsent fresh-conversation draft restores from a bounded encrypted draft list when Echo reopens. With paging available, each exact Navi identity has a separate draft record in Echo's existing account-encrypted paged collection; an account without a primary Navi retains its own separate scope. Echo prepares the selected scope before enabling writable chat and retains only the account record and the selected Navi record. Voice readiness does not change this storage owner. Local writes compare the exact collection head and verify the bounded draft record without rereading the session directory or inactive histories. The history format remains unchanged. (Sources: `webgpu-os/apps/ai-echo/factory.js`, `webgpu-os/apps/ai-echo/AgentStateStore.js`.)

A configured primary Navi can exist before its voice/assistant-state snapshot is ready. The actual desktop draft probe exposed a Stop path that incorrectly treated this pending snapshot as lost authority and released unsaved text. Account draft recovery now depends on the current account, mount and selected identity rather than voice readiness. A missing voice snapshot cannot authorize disposal. Account replacement, mount cancellation and revocation still invalidate access immediately; local writable readiness remains independent of provider and voice initialization. (Sources: `webgpu-os/apps/ai-echo/factory.js`, `webgpu-os/shell/Desktop.js`; probe: `tmp/verify_boot_source_draft_20260919.py`.)

Existing assistant-state drafts remain readable for compatibility. Copy-forward into the account collection verifies the exact local bytes before exposing them, including when the voice snapshot becomes ready later in the same untouched mount. A local draft or verified empty marker takes precedence; late recovery cannot replace typed or deliberately cleared text. Identity changes verify the previous scope's captured text before preparing the next scope. Clearing an older transferred draft preserves a newer encounter's precedence. Terminal unmount still resets transient conversation attention, and recovery never resumes a task automatically. (Sources: `webgpu-os/apps/ai-echo/factory.js`, `webgpu-os/apps/ai-echo/AgentStateStore.js`, `webgpu-os/kernel/navi/NaviAssistantStateStore.js`.)

Graceful Stop preserves mount authority while Echo verifies the current fresh draft and flushes document recovery. A failed save keeps the current window and text available for retry; forced termination and revocation still cancel immediately. Saves wait for preceding writes before accepting cached text, and New refuses to clear text edited during its save. Echo reserves pending draft bytes before queueing a save; failed admission retains the current text and earlier writes. Code and artifact recovery retain their existing mandatory flush checks. (Sources: `webgpu-os/apps/ai-echo/factory.js`, `webgpu-os/shell/Desktop.js`.)

The full-OS probe treats authenticated history, an editable composer and provider availability as separate observations. Its Echo lifecycle check requires an editable local session and rejects a terminal recovery surface. Hiding to the tray must preserve the same mounted surface; closing and remounting cannot count as a resident return. Timing comparisons use the same harness and record machine contention separately. (Source: `tests/run_webgpu_os_boot_performance.py`.)

## Validation and reference measurements

The native browser suites use isolated synthetic accounts and temporary browser profiles. They do not inspect the operator's real browser data. The historical workload reference used Chrome 151; the 2026-09-19 startup and compiled checks use Chrome 153 on Windows 11, with 16 reported hardware threads and 32 GiB reported device memory. Both budget tiers are explicitly forced in tests; those browser-reported values do not override the requested tier.

The correctness counts below describe completed checks. Large-workload measurements identify their recorded source revisions; they are not a claim that every later change has completed the same acceptance run.

The prior v8 checkpoint is `validation-source-20260913T001115Z-e3a3ca96`, containing 12,807 verified, read-only inputs. All eight Echo and Text workload results below are also bound to that checkpoint: their complete served-source, fixture and harness sets contain 321 distinct inputs, each identical in the original measurement, its manifest, the successor manifest and the successor files. The verifier rechecks each receipt's own success, actual workload size, selected budget and independent acceptance gates. It does not claim equivalence for the complete application or for canonical Navi archives. (Proof: the checkpoint's `tmp/echo-text-v8-exact-closure-reuse-20260913.json`; verifier: `tmp/verify_ai_reference_successor.py`, with five rejection-contract tests.)

The retained-archive startup correction has a separate frozen checkpoint, `validation-source-20260913T012013Z-59972d88`, with 12,809 inputs. Its compiled run passed all 30 pages, including the 22 Echo migration groups, 13 native record-witness groups and 88 knowledge/recovery UI cases. The 100 MiB/64 MiB Text page passed all 19 checks: active content in 120.0 ms, input-to-frame p95 of 26.9 ms, mixed input p95 of 24.3 ms, full saved-content hash after deleting the original, all 128 undo steps and zero retained owned resources. These results do not renew the previous eight large-workload measurements or include the later Navi backup foundation. (Receipt: the checkpoint's `tmp/compiled-30-final-v9.json`.)

The automatic-local first-launch check passed against `validation-source-20260919T182302Z-ea7987ce`: a synthetic signed-in account discarded its recovery code and stored an 8,034,440-byte legacy archive without constructing a vault. Native key storage and Files custody were both absent before the actual OS launch. The OS automatically created both, opened writable Echo, and retained the archive. After typing a draft and immediately using the actual Stop action, independent native readback first observed both custody records before binding its vault, then verified the exact draft and appended a message. The next real OS launch displayed that message and remained writable. Portable enrollment stayed false; the retained source verified and native ownership drained to zero. The first migration reached an editable composer in 3,370.3 ms after the launch click; the subsequent OS restart took 969.6 ms. These are single observations, not p95 results, and do not establish the 500 ms target. No external provider or real operator account was used. (Receipt: `tmp/ai-heavy-workload-implementation-2026-09-08/echo-mixed-auto-first-launch-full-os-20260919-r2.json`.)

The final 2026-09-19 compiled checkpoint, `validation-source-20260919T182449Z-b36942ba`, passed all 34 browser pages against 1,357 compiled modules, with raw production-module requests blocked. It includes 136 routing groups, 39 vault-integration checks, 30 key-custody checks, 203 Notepad smoke checks and the 100 MiB/64 MiB recovery page. The document page verified every saved byte after source deletion, all 128 undo entries and zero retained bytes, owners, reservations or queued operations. Observed active content was 130.2 ms; input-to-frame p95 was 19.1 ms and mixed-workload input p95 was 21.2 ms. These document results do not establish the full-OS startup target or renew canonical Navi extreme-archive acceptance. Source and fixture hashes, source-text witnesses, worker sidecars, harnesses and independent acceptance gates are bound by the receipt and its provenance proof. The verifier has ten negative-contract checks; the compiled fixture translator has seven checks, including fetch options and mixed imports. (Receipt: the checkpoint's `tmp/compiled-34-final-20260919-r3.json` and `.provenance.json`.)

The twenty-document text fixture contains one active 100 MiB or 1 GiB source and nineteen inactive 1 MiB documents. Concurrent work combines 128 encrypted archive records, twelve verified AI-record appends, search, recovery and 120 scripted input events, including composition events. It does not run a live provider or twenty maximum-sized files. Scripted composition exercises editor handling; it is not a complete native input-method compatibility test. Active readiness starts after the fixture's modules and account authority are ready.

| Evidence | Recorded result |
|---|---|
| Shared paging publication, faults, pinning, garbage collection and buffer admission | 50 assertions passed, including balanced trees and native transaction drain |
| Dense metadata and safe producer allocation | 8 assertions passed, including refusal before JSON parsing and cloning |
| Separate JSON graph and serialized-byte admission | 14 native allocation and packed-storage groups passed on 2026-09-20, including unchanged combined-estimator values, every UTF-16 code unit, surrogate pairs, numeric edge cases, sparse/hidden clone fields, rejected executable values, bounded parse admission and native encrypted publication. Receipt: `tmp/ai-heavy-workload-implementation-2026-09-08/paged-json-allocation-native14-20260920-r2.json` |
| Bounded Navi envelope codec | 23 native key-vault checks passed on 2026-09-20, including real large-payload crypto, bounded encoder/decoder chunks, canonical text and padding-bit rejection, exact wrapped-key size before decoding and unchanged key recovery behavior. Receipt: `tmp/ai-heavy-workload-implementation-2026-09-08/navi-bounded-base64-final-r3-20260920.json` |
| Incremental checkpointing and garbage collection | 17 assertions passed, including transient retry and cancellation |
| Legacy inventory authentication, writer fencing and native shutdown | 33 assertions passed; shutdown drains native transactions and releases the legacy key |
| Real account recovery, portable restore and operator lifecycle | 39 assertions passed on 2026-09-19, including automatic local custody, actual text-worker termination, shared crypto admission, blocked native-request drain, storage pressure and stale health observations |
| Echo migration, old history, uncertain publication and producer admission | 38 assertions passed on the boot-fix source, including mixed roots, retained inactive sources, exact checkpoint resume, immediate first-session read/append, failed-readback refusal, eviction/restart, key-failure preservation, independent account draft records, selected-Navi isolation, superseded preparation and scoped authority changes |
| Fresh composer recovery and resident lifecycle | 59 conversation-attention cases, 38 encrypted assistant-state cases and 33 resident lifecycle cases passed on 2026-09-20, including no-Navi recovery, an existing primary with unready voice state, verified legacy copy-forward, identity changes, empty recovery markers, overlapping writes, New during editing, failed Stop and authority revocation. Legacy attention cases exercise the legacy native persistence facade; account-scoped cases and the separate paged-state suite exercise current vault admission. Exact hashes and the 168-check aggregate are recorded in `tmp/ai-heavy-workload-implementation-2026-09-08/echo-draft-native-final-r7-20260920.json`; actual desktop source/package UI acceptance remains a separate check |
| Automatic local key custody and optional portable enrollment | 30 assertions passed, including concurrent creation, missing/corrupt custody, version-one upgrade, exact lost-acknowledgement observation and signed empty-root replacement |
| Account recovery UI | 21 assertions passed; missing recovery codes do not block local storage, and portable setup remains explicit |
| Echo local readiness and provider dispatch | 138 route groups passed on 2026-09-20, including separate preparation, disabled, memory-limit and provider-offline messages with strict Smart admission. The earlier 601 mounted-app checks passed on 2026-09-19; pending routing preserves drafts and Settings, exact dispatch stays required, and late route completion retains the account-transition freeze. Current route receipt: `tmp/ai-heavy-workload-implementation-2026-09-08/echo-route-status-native-bounded-capacity-final-r2-20260920.json` |
| Cognition crypto admission and persisted Smart route startup | 44 native production-path groups, 4 route-configuration checks and 42 continuity checks passed on 2026-09-20. The route checks cover both earlier admission boundaries and the full 1,042,849-byte catalog under both budgets. They preserve source revisions and candidates and verify unchanged and changed configuration writes. Production-path checks include multibyte text, refusal before parsing an oversized graph, output ownership through asynchronous rejection and private captured-data validation. These checks do not certify every catalog size. Receipts: `tmp/ai-heavy-workload-implementation-2026-09-08/navi-capacity-native-bounded-final-r8-20260920.json`, `tmp/ai-heavy-workload-implementation-2026-09-08/navi-smart-route-capacity-user-size-after-r3-20260920.json`, `tmp/ai-heavy-workload-implementation-2026-09-08/navi-continuity-bounded-final-r3-20260920.json` |
| Content-free capacity diagnostics and fenced recovery | 61 diagnostic and 22 kernel cognition checks passed on 2026-09-20, including current versus retained incidents, exact capacity scalars, genuine contention recovery, terminal oversized/corrupt records, the three-attempt bound and cancellation on account change or shutdown. Receipts: `tmp/ai-heavy-workload-implementation-2026-09-08/navi-capacity-diagnostics-bounded-final-r5-20260920.json`, `tmp/ai-heavy-workload-implementation-2026-09-08/navi-capacity-recovery-native22-20260920-r5.json` |
| Bounded Presence tasks, exact review and private diagnostics | 16 native capacity checks, 34 Presence UI checks and 71 diagnostic checks passed on the final Presence/Development source on 2026-09-20. Coverage includes both memory tiers, native encrypted-task traversal with larger witnessed and legacy records, cursor changes, corruption and cancellation, serialized/coalesced refresh, owned page and view release, exact task revision before review, operator-generation fencing, successful retry and separate getter-safe current Development status. Receipts: `tmp/ai-heavy-workload-implementation-2026-09-08/presence-task-capacity-large-native-r1-20260920.json`, `tmp/ai-heavy-workload-implementation-2026-09-08/navi-presence-ui-native-20260920-r3.json`, `tmp/ai-heavy-workload-implementation-2026-09-08/navi-capacity-diagnostics-development-native-r1-20260920.json` |
| Development binding, existing evidence contracts and backup | 64 native checks passed on 2026-09-20: 6 fresh/cold native binding cases across both budgets, 25 binding cases, 10 boundary cases and 23 backup/recovery cases. Unknown record types remain rejected; the three existing Development contracts persist and enter the signed backup partition. Receipt: `tmp/ai-heavy-workload-implementation-2026-09-08/development-native64-r1-20260920.json` |
| Metadata witnesses for retained legacy records | 13 assertions passed on the startup-fix source, including both budgets, bounded Files verification, scattered metadata, exact activation, corruption refusal and close during native I/O |
| Echo history/Wiki windows and streamed export | 7 assertions passed |
| Native private stream paging, migration and cancellation | 24 assertions passed, including pre-parse legacy admission, automatic local custody and refusal to fall back after key loss |
| Native legacy record admission under both budgets | 17 assertions passed, including larger admitted records, pressure before retrieval/parsing, exact source retention and cancellation |
| Artifact draft recovery, conflicts, small edits, eviction and restart | 20 assertions passed, including exact saved/current recovery after source deletion, compaction, bounded garbage collection and visible key failures |
| Artifact predecode admission, 20 dirty scopes, preview and download ownership | 9 assertions passed |
| Code editor tabs, navigation, project discovery and stale completion | 19 assertions passed |
| Native Code recovery, captured saves and dense workspace directory | 9 assertions passed |
| Notepad editing and document workflows | 203 assertions passed |
| Native Notepad binary and workspace recovery | 17 assertions passed on 2026-09-19, including blocked key recovery, mounted editing and named file receipts that cannot acknowledge Saved without recovery |
| Learned-text vault and PDF/OCR model ownership | 24 native assertions passed on 2026-09-19; earlier 19 legacy compatibility and 9 OCR isolation assertions passed |
| Navi memory semantics and native publication | 37 semantic and 38 native groups passed, including byte-limited continuation, resumable legacy conversion, source-set conflicts, suspension, lost acknowledgements, unchanged empty-branch proofs and automatic admission retries |
| Native cognition inventory, byte witnesses and ordinary ciphertext writes | 52 groups passed on 2026-09-20, including the prior 40 checks and 12 owned exact-read cases. Coverage includes pre-copy admission, large ordinary writes under both budgets, bounded canonical hashing, exact conflicts, failed admission before allocation, unknown-witness compatibility, cancellation, shutdown, lost acknowledgements and atomic inventory rollback. Receipt: `tmp/ai-heavy-workload-implementation-2026-09-08/navi-store-large-write-native-owned-exact-r2-20260920.json` |
| Navi kernel ownership, authority, legacy import and projections | 22 kernel, 21 import and 14 derived-projection assertions passed, including cancellation, expiry and exact-target forgetting |
| Echo knowledge and research promotion | 88 knowledge and 9 promotion assertions passed, including preparation, automatic completion refresh, selected-page retry, recovery guidance and lifecycle cleanup |
| Navi delivery indexes | 15 assertions passed |

The Echo archive evidence targets `validation-source-20260912T223550Z-dcf63d10`. Each row verifies the SHA-256 of every actual message page and checks an appended message through a second service reopening. That second reopening must remain writable and outside quarantine, with an exact count and at most 96 resident turns. Warm-read samples run before complete-archive verification. The 100,000-message rows reuse measurements from `validation-source-20260912T220213Z-71587f47` only after every one of their 102 served inputs and three harnesses matched the target snapshot byte for byte. The million-message rows were run afresh on the target snapshot. All rows released every owned allocation and lane.

| Actual Echo messages | Budget | Active open | Warm active p95 | Peak accounted bytes |
|---|---:|---:|---:|---:|
| 100,000 | 64 MiB | 70.5 ms | 33.6 ms | 15,642,915 |
| 100,000 | 128 MiB | 72.3 ms | 16.2 ms | 15,642,915 |
| 1,000,000 | 64 MiB | 62.7 ms | 24.3 ms | 16,071,751 |
| 1,000,000 | 128 MiB | 57.4 ms | 28.4 ms | 15,784,237 |

Each 100,000-message archive contains 41,700,000 plaintext bytes across 160 body pages. Initial import took 60.6 seconds under each budget; verified incremental appends took 704.5 and 733.2 ms. Each million-message archive contains 417,000,000 bytes across 1,593 body pages. Initial imports took 679.9 and 665.6 seconds; incremental appends took 867.0 and 987.3 ms. Both million-message archives reopened writable with exactly 1,000,001 messages. These save timings are separate from input response. (Exact receipts, hashes and reuse proof: the target snapshot's `tmp/echo-final-v7-matrix-20260912-v2.json` and `tmp/echo-100k-v5-to-v7-closure-compatibility.json`; fresh receipts `echo-1m-64-final-v7.json` and `echo-1m-128-final-v7.json` with matching provenance supplements. The first matrix verifier used the wrong success-field name for older provenance; its failed output is preserved and the corrected matrix rechecks the unchanged evidence.)

All four native Text reference tiers below passed 19 checks each on `validation-source-20260912T223550Z-dcf63d10`. Each opened twenty documents: one active file at the stated size and nineteen inactive 1 MiB files. Recovery verified every byte of the captured saved revision after deleting the named original, retained the 128-entry undo history and released all accounted bytes, owners and lanes. Each run's 259 served inputs and five harnesses, comprising 263 unique inputs, matched that frozen manifest and the actual files. These measurements do not represent twenty simultaneously maximum-sized files or unrestricted rich-text rendering.

| Active text size | Budget | Active open | Input p95 | Mixed-workload input p95 | Peak accounted bytes |
|---|---:|---:|---:|---:|---:|
| 100 MiB | 64 MiB | 148.8 ms | 37.5 ms | 23.0 ms | 15,808,612 |
| 100 MiB | 128 MiB | 165.7 ms | 44.8 ms | 35.7 ms | 15,808,300 |
| 1 GiB | 64 MiB | 233.4 ms | 17.9 ms | 22.0 ms | 15,963,138 |
| 1 GiB | 128 MiB | 150.9 ms | 18.6 ms | 23.3 ms | 15,963,138 |

The mixed workload combines encrypted records, verified appends and scripted input/composition. It does not establish full native IME or live-provider behavior. The 1 GiB captures took 238.0 and 221.9 seconds; named saves plus complete recovery verification after source deletion took 258.0 and 260.2 seconds. These complete-file operations are measured separately from active opening and input response. All four runs were serialized with other native reference jobs. (Matrix and exact receipt hashes: `tmp/ai-heavy-workload-implementation-2026-09-08/validation-source-20260912T223550Z-dcf63d10/tmp/notepad-final-v7-matrix-20260912.json`.)

Earlier reference revisions measured a real 417 MB million-message archive and real 1 GiB text recovery under both memory budgets. Those receipts remain historical evidence; they do not replace the stronger complete-content and second-reopening checks on the corrected source. The earlier 64 MiB text run preserved 128 undo entries, captured its 1 GiB source in 312.4 seconds and saved and hashed it in 232.7 seconds. Input-to-frame p95 was 47.2 ms and mixed-workload p95 was 30.7 ms. A competing-browser 100 MiB reference recorded 59.5 ms input p95 and remains failed; later tests keep the original 50 ms threshold. (Receipts: `tmp/ai-heavy-workload-implementation-2026-09-08/echo-1m-128.json`, `tmp/ai-heavy-workload-implementation-2026-09-08/echo-1m-64-final-reference.json`, `tmp/ai-navi-full-scan-2026-09-08/notepad-1gib-64mib-final.json`, `tmp/ai-navi-full-scan-2026-09-08/notepad-100mib-128mib-final-reference.json`.)

The acceptance targets remain p95 input response below 50 ms and warm active content below 500 ms after module loading and account authority are ready. Viewport seek, archive import, verified save and whole-OS cold boot are separate measurements. The current startup fix does not complete the whole workload plan: canonical Navi archives at 100,000 and one million events, the remaining Navi recovery integration and final native inventory-drain acceptance still require their own evidence.

The private-browser 1 GiB run failed at the browser's actual origin quota despite a larger reported quota. A fresh persistent temporary profile passed the 128 MiB run. This is storage-capability evidence, not permission to suppress quota failures. (Receipts: `tmp/ai-navi-full-scan-2026-09-08/notepad-1gib-128mib-current.json`, `tmp/ai-navi-full-scan-2026-09-08/notepad-1gib-64mib.json`.)

Source and compiled factories are verified independently. `tests/storage/run_vault_compiled.py` builds the factory closure with the repository's real Python bundler and blocks raw production-module requests during the browser contracts. It does not publish a complete OS release or modify release signing keys.

The v8 packaged run passed all 29 test pages against the immutable `validation-source-20260913T001115Z-e3a3ca96` snapshot. Its 1,302-module bundle and all source, fixture, worker-sidecar, harness and nonexecuting source-text witnesses remained unchanged. The strengthened 100 MiB/64 MiB recovery page passed 19 checks: active content appeared in 140.5 ms, input-to-frame p95 was 32.3 ms and mixed-workload p95 was 22.9 ms. It hashed every recovered saved byte after deleting the named original and retained all 128 undo entries. Peak accounted allocation was 15,341,161 bytes; bytes, reservations, owners and every active/queued lane were zero after disposal. (Receipt: `tmp/ai-heavy-workload-implementation-2026-09-08/validation-source-20260913T001115Z-e3a3ca96/tmp/compiled-29-final-v8.json` and its provenance supplement.)

The stronger archive check caught an incorrect one-million count ceiling: writing message 1,000,001 succeeded, but reopening quarantined that valid head. Every original message page and the appended row still matched their digests. The ceiling was removed, exact integer overflow checks were added before publication, and the failure receipt remains preserved. Small count-contract tests exercise that numeric boundary without claiming to contain a million records; actual archive-size acceptance uses its separate full workload. (Receipt: `tmp/ai-heavy-workload-implementation-2026-09-08/validation-source-20260912T200019Z-b9d91156/tmp/echo-1m-64-final-v3.json`; tests: `tests/storage/ai-echo-paged-state.test.js`, `tests/storage/ai-echo-archive-scale.test.js`.)

Navi foreground measurements pin the target's production reader before counting reads. Elapsed time includes admission and any collector wait. The shared fixture also initializes an empty second Navi; its independently scheduled maintenance is separately recorded and restricted to two distinct one-record queries. Unknown owners, other query types, repeated queries or larger limits fail the check. This separates maintenance ownership without excluding unexplained work. Reference runners independently reject incomplete content proof, changed inputs and retained resources even if a browser page reports success. (Sources: `tests/navi/phase4-production-path.test.js`, `tests/navi/navi-archive-estimate.js`, `tests/run_navi_archive_estimate.py`, `tests/run_ai_echo_archive_scale.py`, `tests/storage/run_notepad_paged_recovery.py`.)

The v8 native Navi cost probe wrote 1,024 actual signed, encrypted assertions about one subject under the 64 MiB budget. Reopening its services took 8.2 ms. Reading the final sixteen events took 130.8 ms across two pages of ten and six records, each below 256 KiB of admitted data. The receipt identifies every native event read by sequence and role: nineteen reads include the requested rows, authenticated heads and the one next-row boundary check; all sixteen payload reads belong to the requested rows. An unchanged refresh took 4.9 ms and read one event; a new revision after reopening took 166.9 ms and read three events. No foreground operation scanned the target inventory. Peak accounted allocation was 30,120,986 bytes, and every owned resource was released after drain. Initial sequential ingestion took 192.9 seconds. This is a real 1,024-event Navi measurement, not a 100,000-event or million-event canonical Navi acceptance result; Echo message archives have a separate workload and persistence contract. (Receipt and exact source proof: `tmp/ai-heavy-workload-implementation-2026-09-08/validation-source-20260913T001115Z-e3a3ca96/tmp/navi-real-1024-shared-64-final-v8.json` and its `.provenance.json`.)

That real workload exposed an earlier metadata-accounting defect: enough returned rows could exceed the byte window after per-entry admission succeeded. The corrected reader admits the complete wrapper, invalidations, array slots and root before returning each row, then continues on the next page. The final gate checks every read's exact sequence and allowed role; it does not hide additional reads behind an increased aggregate threshold. Earlier failed receipts remain preserved separately.

A frozen source snapshot captured on 2026-09-12 contains 12,798 verified, read-only inputs. Its full-OS browser probe reached OS readiness in 7,962.1 ms on the first navigation and 5,548.6 ms on reload. Echo then opened through the actual Start menu and became authenticated, active-readable and writable in about 2,591.8 ms; chat readiness followed at 2,724.7 ms. Module loading and desktop prefetch can overlap this first launch; it does not prove a cold module cache. Provider and background readiness remained false during the offline observation. These are individual observations, not p95 values or a reset of operating-system disk and shader caches. The probe recorded no current-navigation browser or HTTP failures, and served inputs and harnesses were unchanged. (Receipt: `tmp/ai-heavy-workload-implementation-2026-09-08/validation-source-20260912T190342Z-11d2ce33/tmp/full-os-cold-source-immutable-20260912.json`.)

A follow-up using the same frozen production inputs with a reviewed replacement of the two configuration methods reduced the warm capability phase from 2,333 ms to 14 ms. The verified history preview appeared in 345.2 ms, the full workspace in 506.4 ms and the editable composer in 641.2 ms. The ordinary resident tray return took 12.8 ms. These separate milestones matter: this single run supports faster reopening and a sub-500 ms active preview, but does not establish sub-500 ms full-editor readiness or a p95 restart result. Whole-archive verification is a separate test phase and must not prewarm opening measurements. (Receipt: `tmp/ai-heavy-workload-implementation-2026-09-08/full-os-echo-startup-overlay-20260912.json`.)

The v8 snapshot's actual desktop probe passed with all 12,807 input hashes unchanged, including 1,401 served inputs and three harnesses. Cold OS readiness took 8,312.9 ms and reload readiness took 4,514.0 ms. Each Echo launch reached authenticated, active-readable, writable and chat-ready states while provider/background readiness remained separately false in the offline probe. The live kernel served the legacy admission helper and shared memory owner. These are single UI observations, not p95 estimates or a measurement of live helper allocations. The Stop/restart composer observation was 468.3 ms; the active-content observation was 368.7 ms. (Receipt: `tmp/ai-heavy-workload-implementation-2026-09-08/validation-source-20260913T001115Z-e3a3ca96/tmp/full-os-cold-echo-ui-final-v8-20260913.json` and its provenance supplement.)

| Actual Echo action | Verified preview | Full editor | Editable composer |
|---|---:|---:|---:|
| First launch after OS readiness | 60.6 ms | 266.4 ms | 402.8 ms |
| Resident tray return | — | 12.8 ms | 12.8 ms |
| Stop, then restart with modules warm | 244.8 ms | 368.7 ms | 468.3 ms |

Example validation commands from the repository root:

```bash
python tests/run_paged_record_store.py
python tests/run_operator_vault_integration.py
python tests/navi/run_phase4_kernel_memory_tests.py
python tests/navi/run_browser_status_page.py --page tests/storage/ai-echo-paged-state.html --expected 24
python tests/navi/run_browser_status_page.py --page tests/storage/app-sandbox-record-witness.html --expected 13
python tests/navi/run_browser_status_page.py --page tests/storage/legacy-record-admission.html --expected 17
python tests/navi/run_browser_status_page.py --page tests/storage/ai-echo-paged-viewport.html --expected 7
python tests/navi/run_browser_status_page.py --page tests/storage/artifact-draft-recovery.html --expected 20
python tests/storage/run_vault_compiled.py
```

## See also

- [Operator, SecureMesh and agent boundaries](operator-securemesh.md)
- [Navi architecture and delivery](navi-architecture-and-delivery.md)
- [AI Echo knowledge workflows](ai-echo-design-and-knowledge-workflows.md)
- [Installed system releases](installed-system-releases.md)