Module resource 

Invoking a delegated resource capability, once, for everything that has one.

fs mints file capabilities and net-stack mints socket, listener and connection capabilities. They are the same mechanism (CLAUDE.md 7.10) with different payloads, so the parts that are easy to get subtly wrong live here rather than once per module:

• the reply cap is one-shot and per-invocation, derived from our own endpoint and consumed by the kernel on delivery. Reclaim it ONLY where the send never delivered - 8.5 removes an embedded cap from the sender’s table, so removing it again removes whatever the kernel has since put in that slot. That is how a file capability was once deleted out from under its holder.
• a message that is not our reply is HELD, never dropped. A caller waits on its own ordinary endpoint - the same one its clients send to - because a task has exactly one. Draining would destroy real client requests; that is what services/shell does, and it is safe only because the shell serves nobody.
• the kernel’s refusal is READ, not inferred. An earlier cut guessed from the rights mask and reported a revoked capability as “could not be reached”, which named the wrong fault and sent an operator to check a service that was running perfectly.

Constants

HELD_MAX

How many messages that are NOT our reply one invocation will hold before it stops taking them.

Functions

last_badge

The resource id and right the kernel badged the message just received with.

mint

Mint a fresh resource capability that THIS service owns (CLAUDE.md 7.10).

revoke

Revoke a resource this service owns, invalidating EVERY capability to it.