Update hardening metadata and Chez provenance docs

ober

4ea7d5197b7d0e62092dae394a274f21bd821ff7

diff --git a/data/changelog.sexp b/data/changelog.sexp
index c6d9301..fddb795 100644
--- a/data/changelog.sexp
+++ b/data/changelog.sexp
@@ -2,7 +2,20 @@
    .
    "Machine-readable changelog of Jerboa API drift. Consumers (LLM tooling, lints, jerboa_verify) use this to invalidate stale recommendations and to suggest migrations when a symbol is renamed or relocated.")
   ("entries"
-    (("added" "sqlite-open-v2" "sqlite-open-bytevector"
+    (("added" "*sandbox-max-memory-size*"
+        "sandbox-config-max-memory-size")
+      ("date" . "2026-06-25")
+      ("modules_added")
+      ("moved")
+      ("notes"
+        .
+        "(std security sandbox) now accepts 'max-memory-size in make-sandbox-config and installs the corresponding child-process memory limit before running the sandbox thunk. The result channel already uses pipe(2), so stale temp-file race documentation was retired. (std async) run-async/workers now enforces its worker count with a semaphore for spawned async tasks. Vendored Chez --enable-harden now compiler-probes optional register-clearing, stack-auto-init, format-security, and static -fPIE flags. WASM, safety, hardening, Chez-fork, bundling, and API metadata docs were updated to match current implementation state.")
+      ("removed")
+      ("renamed")
+      ("tier_changes")
+      ("tools_added")
+      ("version" . "v0.2.3"))
+     (("added" "sqlite-open-v2" "sqlite-open-bytevector"
         "sqlite-db->bytevector" "sqlite-db?" "sqlite-execute"
         "sqlite-stmt?" "sqlite-bind-int!" "sqlite-bind-real!"
         "sqlite-bind-text!" "sqlite-bind-blob!"
diff --git a/data/cookbooks.sexp b/data/cookbooks.sexp
index 4a5d0a0..0151a1e 100644
--- a/data/cookbooks.sexp
+++ b/data/cookbooks.sexp
@@ -6483,4 +6483,16 @@
      "vendoring")
    ("title"
      .
-     "Compile static C shims without OpenSSL crypto sections")))
+     "Compile static C shims without OpenSSL crypto sections"))
+ (("code"
+    .
+    "(import (std security sandbox))\n\n(define sandbox-cfg\n  (make-sandbox-config\n    'timeout 2\n    'seccomp #f\n    'landlock #f\n    'seatbelt #f\n    'capsicum #f\n    'max-memory-size (* 256 1024 1024)))\n\n(run-safe\n  (lambda ()\n    ;; Untrusted or adversarial work runs in the forked child.\n    (+ 20 22))\n  sandbox-cfg)") ("id" . "run-safe-child-memory-limit")
+   ("imports" "(std security sandbox)")
+   ("notes"
+     .
+     "max-memory-size installs a child-process memory limit after fork and before the thunk runs. The default is #f because RLIMIT_AS behavior and Chez heap layout vary by platform. If the requested limit cannot be installed, run-safe raises a sandbox error instead of silently continuing. Use OS cgroups/containers when you need process-tree memory enforcement.")
+   ("tags" "run-safe" "sandbox" "memory-limit" "setrlimit"
+     "std-security-sandbox" "rlimit")
+   ("title"
+     .
+     "Cap run-safe Child Memory with max-memory-size")))
diff --git a/docs/Chez-changes.md b/docs/Chez-changes.md
index 18bd7bd..05c8f7e 100644
--- a/docs/Chez-changes.md
+++ b/docs/Chez-changes.md
@@ -10,8 +10,10 @@ maintainer narrative (themes, motivations, provenance) see
 [`chez-fork.md`](chez-fork.md); for the exact line-level diffs see the
 `.patch`-per-change series in [`../vendor/ChezScheme-patches/`](../vendor/ChezScheme-patches/).
 
-**Scope:** 24 source-affecting changes (the rest of the divergence is the
-internal logs in §6). Net diff vs. the cisco base: **63 files, +5498 / −243**.
+**Scope:** source-affecting changes are tracked by the patch series in
+`vendor/ChezScheme-patches/` plus the live diff command in
+[Re-deriving the divergence](#re-deriving-the-divergence). The internal logs in
+§6 are Jerboa-maintainer files, not Chez changes.
 
 ---
 
@@ -38,7 +40,9 @@ FASL/data; stock Chez assumes a trusted build env.
   (`c/fasl.c`, `c/vfasl.c`, `c/ffi.c`, `c/foreign.c`, `c/main.c`).
 - **`--static` / `--foreign-libs`** configure options — hermetic static binaries
   (the musl-static pipeline depends on these).
-- **`--enable-harden`** configure flag — opt-in hardening switch.
+- **`--enable-harden`** configure flag — opt-in hardening switch, including
+  compiler-probed register clearing, stack auto-initialization, format-string
+  hardening, and static-build `-fPIE` when supported.
 - **Intel CET/IBT** — `ENDBR64` emission at function entries (`s/x86_64.ss`).
 - **ARM64 BTI** — branch-target-identification landing pads (`s/arm64.ss`).
 
@@ -66,10 +70,12 @@ Performance only — semantics unchanged, each guarded by a regression mat.
 - **`sync-upstream` / `sync-upstream-status`** make targets — helpers for
   rebasing a Chez git checkout onto cisco upstream (`makefiles/Makefile.in`).
 
-## 5. Routine fix not yet upstreamed
+## 5. Routine fix now upstreamed
 
-- **ppc32 + logtest repairs** (cisco PR #1045) — carried in-tree until it lands
-  upstream (`s/ppc32.ss`).
+- **ppc32 + logtest repairs** (cisco PR #1045) — originally carried in-tree at
+  snapshot import time; merged into `cisco/ChezScheme` on May 11, 2026. This
+  divergence should collapse on the next upstream-base refresh that includes
+  cisco merge commit `0f1d0d8`.
 
 ## 6. Internal logs riding inside the Chez tree — NOT Chez changes
 
diff --git a/docs/api-index.md b/docs/api-index.md
index 77f57ad..19322cb 100644
--- a/docs/api-index.md
+++ b/docs/api-index.md
@@ -12728,7 +12728,7 @@ All 626 modules sorted by name. Export count in parentheses.
 | `(jerboa lock)` | 19 | `lib/jerboa/lock.sls` |
 | `(jerboa pkg)` | 25 | `lib/jerboa/pkg.sls` |
 | `(jerboa prelude clean)` | 116 | `lib/jerboa/prelude/clean.sls` |
-| `(jerboa prelude safe)` | 200 | `lib/jerboa/prelude/safe.sls` |
+| `(jerboa prelude safe)` | 202 | `lib/jerboa/prelude/safe.sls` |
 | `(jerboa prelude)` | 438 | `lib/jerboa/prelude.sls` |
 | `(jerboa reader)` | 21 | `lib/jerboa/reader.sls` |
 | `(jerboa registry)` | 9 | `lib/jerboa/registry.sls` |
diff --git a/docs/bundling-chez.md b/docs/bundling-chez.md
index c4a24e2..dd99c38 100644
--- a/docs/bundling-chez.md
+++ b/docs/bundling-chez.md
@@ -19,9 +19,9 @@ part of the normal build. This doc records how that works and what's left.
 | Cross-compilation | **Done** — `make chez-cross` for Linux/FreeBSD/macOS-x86 targets |
 | Docker | **Done** — image builds the same `vendor/ChezScheme` (glibc + a `--static` musl variant) |
 | `--static` musl | **Done** — `support/musl-chez-build*.sh`, Docker musl stage |
-| `--static` everywhere | **Partial** — a hermetic-build knob beyond musl/Linux isn't generalized |
+| `--static` everywhere | **Partial** — Linux musl and FreeBSD release paths are wired; a single native `STATIC=1` knob is still not generalized |
 | Licensing / attribution | **Done** — `LICENSE-CHEZ` + README + `--version`; all bundled deps permissive; lz4 reduced to BSD `lib/` + LICENSE (zero GPL) |
-| Distribution story | **Open** — release-engineering decision |
+| Distribution story | **Done** — `jerboa-portable`, `release-artifact(s)`, signing, SBOM, and release evidence targets exist |
 
 ## How it works today
 
@@ -118,13 +118,16 @@ dirs; supports multiple independent instances.
    divergence to re-apply on any lz4 re-vendor.
 
 2. **Generalize `--static` (partial).** Static, hermetic Chez is wired for
-   musl/Linux (`musl-chez-build*.sh`, the Docker musl stage). A single
-   cross-platform knob (e.g. `make chez STATIC=1`, including a non-dlopen macOS
-   build) doesn't exist yet.
-
-3. **Distribution story (open).** Decide what ships: a source tarball with
-   `vendor/ChezScheme/` (à la Gerbil), pre-built per-arch tarballs, or both.
-   Release-engineering, not code.
+   Linux/musl (`musl-chez-build*.sh`, Docker musl, `jerboa-linux-*`) and the
+   FreeBSD release path uses the system static toolchain. A single native knob
+   (e.g. `make chez STATIC=1`, including macOS behavior that does not depend on
+   `dlopen`) still does not exist.
+
+3. **Distribution story (done).** `make jerboa-portable` stages the supported
+   target directories, `make release-artifact` packages one target, and
+   `make release-artifacts` packages the supported target set. Signing, SBOM,
+   reproducibility, and release-evidence targets are part of the same release
+   pipeline.
 
 ## Risks and non-goals
 
diff --git a/docs/chez-fork.md b/docs/chez-fork.md
index c3d929a..4e3acb6 100644
--- a/docs/chez-fork.md
+++ b/docs/chez-fork.md
@@ -26,10 +26,9 @@ drill into the patches for specifics.
   `10.5.0-pre-release.1`)
 - **Lives in:** `vendor/ChezScheme/` (in-tree; snapshot originally imported at
   `a4be658a` — see `vendor/ChezScheme/UPSTREAM.md`)
-- **Divergence:** 63 files, +5498 / −243 vs. the cisco base
-- **Source-affecting changes:** 24, recorded one-per-file in
-  `vendor/ChezScheme-patches/`; the rest of the divergence is the internal
-  logs in "Logs that ride along" below.
+- **Divergence:** re-derived with the diff command below; source-affecting
+  changes are recorded one-per-file in `vendor/ChezScheme-patches/`, plus live
+  in-tree updates made after the snapshot import.
 
 To re-derive the divergence yourself:
 
@@ -56,7 +55,9 @@ FASL/data; stock Chez defaults assume a trusted build env.
 - harden FASL deserialization, FFI, and build scripts against malformed input
 - vfasl bounds checks + `path_append` hardening + HPUX typo
 - ENDBR64 emission at function entries (Intel CET/IBT)
-- `--enable-harden` configure flag + ARM64 BTI landing pads
+- `--enable-harden` configure flag + ARM64 BTI landing pads + optional probed
+  compiler mitigations (`-fzero-call-used-regs`, stack auto-init,
+  format-security, static `-fPIE`)
 
 Touches: `c/fasl.c`, `c/vfasl.c`, `c/main.c`, `s/x86_64.ss`, `s/arm64.ss`,
 `configure`, `c/build.zuo`.
@@ -115,9 +116,12 @@ source. They ride along for editing convenience but are **not upstream-relevant*
 - `CLAUDE.md` — Claude instructions for work *inside* the Chez tree
 - `bench/jerboa-bench.ss` — jerboa-specific benchmark suite
 
-### Routine fixes not yet upstreamed
+### Routine fixes now upstreamed
 
-- ppc32 + logtest repairs (cisco PR #1045) — carried until it lands upstream
+- ppc32 + logtest repairs (cisco PR #1045) — carried in the imported snapshot;
+  merged into `cisco/ChezScheme` on May 11, 2026. This divergence should drop
+  out on the next upstream-base refresh that includes cisco merge commit
+  `0f1d0d8`.
 
 ## Keeping this doc current
 
diff --git a/vendor/ChezScheme/UPSTREAM.md b/vendor/ChezScheme/UPSTREAM.md
index 60e5d7e..50c5202 100644
--- a/vendor/ChezScheme/UPSTREAM.md
+++ b/vendor/ChezScheme/UPSTREAM.md
@@ -21,6 +21,9 @@ This file (UPSTREAM.md) records *provenance* only.
   10.5.0-pre-release.1)
 - **Snapshot imported:** 2026-05-14, at fork commit
   `a4be658a9ff07fcbc3b578aad28aec317422862c` ("ppc32 and logtest repairs (#1045)")
+- **Upstream status of snapshot head:** cisco/ChezScheme PR #1045 was merged on
+  2026-05-11 as merge commit `0f1d0d8`; the next upstream-base refresh can
+  collapse that local routine-fix divergence.
 - **Method:** flat snapshot — `.git/` stripped, no history preserved here; now
   maintained in-tree as ordinary files