Start boot/system drivers before win32k admission

[stakach]

Dependency of #56 and #17. NT boot ordering starts registry-selected boot/system drivers before GUI win32k.

Plan

• Verify the win32k Phase-2b block has no dependency on boot-driver locals and the boot-driver block has no dependency on win32k registration.
• Move the existing win32k Phase-2b block after the existing boot/system driver block and before B3 PnP, without duplicating driver startup or adding a special-case service identity.
• Preserve existing startup checks and phase state; run focused crate tests and native build under the single build owner.
• Bounded boot: prove the real NPFS File CREATE/release lifecycle gate runs before strict win32k import rejection. CREATE, connected endpoints, read/write, and pending completion pass; final CLEANUP/CLOSE projection remains.
• Review boot ordering, regressions, and retire obsolete comments/checks introduced by the old order.

No synthetic pass condition: use the selected NPFS provider and canonical File IRPs. Dependencies: #61 (hosted high-canonical shared data) and #62 (occupied leaf mapping).

[stakach]

First native trial: code motion compiles and boot/system service selection now runs before win32k admission. Ndis, Msfs, Npfs and others load their images, but each IoManager Driver object publication fails STATUS_INVALID_PARAMETER (0xC000000D); NPFS does not publish \Device\NamedPipe, so the lifecycle test is not reached. QEMU stopped at the understood failure; win32k still later reports the same 27 unresolved imports. Investigating exact Object Manager boundary before continuing.

[stakach]

Boot diagnostics isolated a real dependency: reentrant timer/IRQ dispatch during a synchronous Object Manager request overwrote the shared request frame. Every OB_OP_CREATE_DRIVER reached the server with abi_size=12 (a lookup request) instead of the 32-byte create-driver header, producing STATUS_INVALID_PARAMETER. The current change retains timer/IRQ work until the Object Manager reply is collected and ACKs the one-shot timer; the root service loop remains the owner of deferred dispatch. Native and bounded boot verification are next.

[stakach]

Verification update: focused nt-object-client and nt-object-server tests passed, but the bounded native boot still rejected all Driver object publications with STATUS_INVALID_PARAMETER after timer/IRQ dispatch was deferred inside RingChannel::raw. Therefore timer/IRQ draining alone was not the full source of request-frame reuse. Stopped QEMU at the understood failure. Investigating actual channel re-entry and will not mark the boot/lifecycle checklist complete yet.

[stakach]

Root cause correction: the PE selftest scratch VA was exactly the Object Manager request-ring VA (0x0000010010520000). rust-micro currently replaces an occupied leaf PTE on map, so spawn_pe_thread disconnected the executive from the request frame still mapped by the Object Manager server. The stale lookup ABI header seen by create-driver was an address-ownership failure, not timer/IRQ re-entry. The speculative RingChannel change was reverted. Fix now gives PE scratch a bounded dedicated window and checked mappings; next bounded boot must prove real driver publication and NPFS File lifecycle.

[stakach]

Boot after the PE scratch VA fix: Ndis/Msfs/Npfs Driver objects now publish, NPFS DriverEntry returns STATUS_SUCCESS and its named device is registered. The proof was moved to run immediately after device discovery while preserving the registry iterator; it now executes but its first real CREATE_NAMED_PIPE returns STATUS_INVALID_PARAMETER, so exec_npfs_canonical_file_lifecycle fails. The next selected driver, tcpip, then faults on NT high shared-user-data VA 0xfffff78000000014 (#61). QEMU was stopped at the understood fatal wall. #62 tracks the microkernel occupied-leaf replacement that made the alias silent. Issue #60 remains open pending the real File lifecycle proof.

[stakach]

Root cause of the first real NPFS CREATE failure: the shared IrpDispatchRequest was placed at FSD_DATA+0x1000, exactly the hosted driver KPCR page. Component-side wire diagnostics showed ABI 15/size 256 intact but target cookie overwritten with KPCR pointer 0x1000f301000, provider ID overwritten with another KPCR pointer, and provider cookie zero. The domain-route validator correctly returned STATUS_INVALID_PARAMETER before any WDM stack construction. The request now follows the pending-IRP table at a computed page-aligned offset with a compile-time bound below the physical-map region; native boot verification is running.

[stakach]

Verified increment: moving IrpDispatchRequest out of the KPCR page made component-side route validation pass. In a bounded native boot, NPFS DriverEntry succeeded and real IRP_MJ_CREATE_NAMED_PIPE(\ntstest) returned STATUS_SUCCESS, Information=FILE_CREATED, with a live FsContext. The following client-open IRP (major 0) faults at address 0x3d8 in hosted code, so canonical File lifecycle remains unproven; QEMU stopped at that understood wall. The next step is symbolication and a focused test of the client-open path, not a synthetic result.

[stakach]

Verified increment 29071b16: corrected ReactOS x64 IRP Tail.Overlay.Thread/AuxiliaryBuffer offsets; focused nt-io-manager layout test failed before the fix and passed after. Hosted IRP dispatch now reads the canonical current Reply from the enrolled primary ingress route, retaining the full physical/domain/Reply precheck. Bounded native boot entered 29 real NPFS IRPs and passed client connect, set-info, pending read/write, split write, exact pending completion, and File-object lifetime checks. Final File release reaches IRP_MJ_CLEANUP but currently panics at component_scheduler.rs:117: deferred dispatch lacks its exact retained thread projection. Full canonical lifecycle gate and desktop are not yet proven. The later tcpip high-canonical shared-data fault remains #61; occupied leaf mapping is #62.

[stakach]

Reopened after #63 squash merge: the boot-order and NPFS transport increment passed CI, but the checklist remains incomplete. Exact-caller owned File CLEANUP/CLOSE is tracked in #64; TCPIP high-canonical shared data is #61. No complete lifecycle or desktop claim yet.

[stakach]

Current dynamic boot frontier after merged #70: tcpip/afd/netio load, Mup now stops at missing IoCreateFile. Tracked the full canonical file-handle/reference/close bridge in #71. This is not a simple import-table binding: the existing hosted ObReferenceObjectByHandle and ZwClose adapters are insufficient for a real returned file handle.