Reproducer
A single downstream Rust binary links BatPak 0.10 plus bvisor 0.10 and runs the normal EventPayload registry uniqueness check.
The binary fails at startup:
EventPayload registry contains 4 duplicate kind assignment(s);
first collision is category=0xE type_id=0x002 between
bvisor::contract::events::BoundaryReportEvent and
<downstream domain>::ClaimRecordedV2
No bvisor operation needs to run. Linking the crate is enough for its inventory registrations to enter the process-wide registry.
This makes bvisor non-composable as an in-process BatPak-family library for any application that already allocated overlapping domain kinds. Weakening or skipping the registry check is not acceptable.
Requested neutral contract
- reserve and document a collision-free family-owned event-kind range for bvisor;
- distinguish substrate/family allocations from downstream domain allocations in the machine-readable kind table;
- add a registry allocation helper or branded kind constructor so crates cannot independently claim the same global coordinate;
- publish migration analysis for the existing bvisor kind bytes before changing them;
- make the intended embedding contract explicit: bvisor linked beside arbitrary domain payload crates must pass the process-wide registry uniqueness gate.
Proof requested
- one fixture binary links core + syncbat + hostbat + bvisor plus a representative downstream domain registry and has zero collisions;
- exhaustive family-workspace registry audit across all members/features;
- trybuild/compile-time or startup witness for an intentionally duplicated allocation;
- machine-readable allocation table checked in CI;
- old bvisor report-event fixtures either replay through an explicit migration or are documented as not-yet-durable if that is the factual state.
Downstream containment
The downstream is keeping bvisor in a standalone helper process so its inventory is isolated rather than weakening the registry. Once collision-free family kinds ship, the compatibility module can link bvisor directly.
Reproducer
A single downstream Rust binary links BatPak 0.10 plus bvisor 0.10 and runs the normal
EventPayloadregistry uniqueness check.The binary fails at startup:
No bvisor operation needs to run. Linking the crate is enough for its inventory registrations to enter the process-wide registry.
This makes bvisor non-composable as an in-process BatPak-family library for any application that already allocated overlapping domain kinds. Weakening or skipping the registry check is not acceptable.
Requested neutral contract
Proof requested
Downstream containment
The downstream is keeping bvisor in a standalone helper process so its inventory is isolated rather than weakening the registry. Once collision-free family kinds ship, the compatibility module can link bvisor directly.