Figure 13 — Mint Abstraction Nesting & Domain Purity

The caller sees only CALL(Thread.Mint(type, size, access)). The internal delegation chain — CR5 → self [E] → Namespace [E] → Mint method — is completely hidden. Domain purity: Turing permissions (RWX) OR Church permissions (LSE), never both.

WHAT THE CALLER SEES One instruction. No knowledge of internal structure. CALL(Thread.Mint(type, size, access)) DR1 = access rights • DR2 = object type • DR3 = size • Returns new GT in CR0 But internally... HIDDEN INTERNAL DELEGATION CHAIN Four nested layers. The caller never sees inside. Each layer enforces its own permissions. CR5 — Services C-List [E] Set at boot. Stable — does not change on CALL/RETURN. Contains the Thread's available services. Entry point for all resource requests. E only self [E] — Thread Abstraction The Thread's own abstraction, accessed via CR5. Manages per-thread scarce resources: memory budget, namespace slots. Enforces budgets before delegating to Namespace for actual allocation. E permission BUDGET ENFORCEMENT if (request.size > thread.budget) → FAULT (resource exhausted) thread.budget -= request.size DOMAIN PURITY CHECK if (has_turing(DR1) AND has_church(DR1)) → FAULT (domain violation) Turing [RWX] xor Church [LSE] both pass Namespace [E] — Memory Owner Owns all memory. Responsible for allocation and garbage collection. Accessed via self. The Namespace contains all methods including Mint, GC, Lookup. E permission Mint(type, size, access) — Allocation Method Creates namespace entry (Location, Limit, Seals). Computes MAC. Sets gBit = 0. Returns new Golden Token in CR0 with requested permissions. via mLoad 1 2 3 4 5 DOMAIN PURITY: OIL AND WATER DR1 access rights must be domain-pure. Turing permissions OR Church permissions. Never both. TURING DOMAIN Data objects • Computation R Read W Write X Execute CHURCH DOMAIN Capabilities • Abstraction access L Load (capability) S Save (capability) E Enter (abstraction) NEVER BOTH DR1 = RWX | LSE → FAULT DR1 = RW | E → FAULT DR1 = RWX → Turing GT DR1 = LSE → Church GT GT_MINT API — DATA REGISTER ARGUMENTS Arguments passed in data registers. Thread reads CR8 internally for memory accounting. Register Content Constraint DR1 Access rights Domain-pure: [RWX] xor [LSE] DR2 Object type Inform, Outform, or user-defined DR3 Size (words) Must fit within thread budget Returns: New Golden Token in CR0 with requested permissions CR8 (Thread identity) read internally by microcode — not passed by caller Every layer uses mLoad. No bypass. The caller sees one instruction — the machine enforces five.