The language-security audit, solved at the root

Five independent audits of the language itself were folded into one ranked register (docs/design/language-security-hardening-2026-08.md), which first records what holds up (the per-commit Trusting-Trust chain, the Coq-checked E0404 confinement, container isolation that exceeds a default Docker profile, complete overflow checking) and then the holes in the flagship claims, traced to four root causes and fixed at that level rather than per symptom.

Containment

The seccomp seal denied socket/openat/execve by syscall number, but an io_uring ring could issue the same operations without the syscall entry; io_uring_setup/enter/register are now denied unconditionally under the seal and in containers. Cap<Net> egress narrowing was advisory; KERN_NET_ALLOW is now enforced at the C connect leaf, so even an RCE is bounded. Forwarder revocation was decorative (no use path); forwarder_use_* now fails closed, the alive flag is atomic, and a new compile error E0406 forbids an extracted capability from escaping its frame (return, field store, module global, spawn capture), so revocation gates the lifetime, not just the extraction event.

Taint

Enforcement was per-site code that each forgot a different tag; it is now one env-aware predicate routed through every boundary, string interpolation parts included, and it recurses into struct and union fields, so serialising a struct with a PersonalData field to a log or a DB row no longer launders the tag.

Codegen

Integer / and % trap on a zero divisor and INT64_MIN / -1 instead of LLVM undefined behaviour.

Stdlib

Fallible crypto returns Result<str> rather than an in-band "ERROR:" string or an empty key, Untrusted discharges only into structured sinks (argv, params, auto-escaped templates) with the string escapers gone, CSV cells are quoted against formula injection, and the audit and revocation-feed chains are keyed to the box anchor.

Trust

A seed-faithfulness CI gate re-derives the seed IR with kern_v4 and byte-compares it to the manifest, stated as trusting kern_v4 (a consistently poisoned seed pair would still pass; that is what the independent bootstrap and DDC gates are for). Every fix is box-verified and pinned by a negative test; the register keeps the honest T-model status alongside: flow soundness remains test-backed rather than machine-checked, and the external audit is a business decision not yet taken.