Bind a worker’s positional read to its approved file range

Separate a resource handle from a reader’s position

Two trusted preprocessing readers inspect different parts of the same admitted note. A reviewer gives them different descriptor labels and assumes that each now has its own cursor. Object access and byte-position association are different questions; a permitted reader can still receive the wrong region.

Select one immutable ordinary regular file on a supported local Linux filesystem. The trusted service already retains the admitted object, knows the descriptors’ lifetime and alias relationships, and owns each proposed read plan. These prerequisites are unimplemented and unknown here. No descriptor acquisition or transfer procedure is supplied.

The readers are logical operations within the controlled service, not newly launched processes. This article does not modify the existing inheritance profile or add descriptors to its empty extra-resource allowlist. Current object rights and the consumer’s permitted input remain independent gates.

Freeze the documented cursor boundary

The open manual describes a descriptor as a reference to an open file description, which records the offset and file-status flags. A duplicated descriptor references the same description and consequently shares that offset and those flags. Different descriptor numbers therefore do not establish independent cursor state.

The pread manual specifies a read of up to the requested count at an explicit offset from the file start, without changing the file offset. The referenced file must support seeking. Both actual pages identify Linux man-pages 6.19, dated 8 February 2026; they establish no installed runtime or adapter behavior.

This worksheet selects that supported positional interface only. It supplies no seek-then-read substitute, buffered-wrapper assumption, descriptor-duplication command, reopening path or fallback API. If the actual interface does not preserve the selected contract, hold the plan rather than importing the documented behavior by name.

Assign two bounded regions of one invented input

Invent input I-A with declared length eight octets. Reader A owns offset zero and requested count four; reader B owns offset four and requested count four. The assignment is application policy, not permission inferred from the file descriptor. The numbers are teaching choices, not recommended chunk sizes.

Before eligibility, require a trusted association among I-A’s admitted revision, the retained object, reader, start, count and permitted consumer. Validate the range against the independently established size and application limit. Arithmetic must be supported for the actual interface; no integer conversion or overflow-handling implementation is provided here.

For the conditional positive, independently supported receipts establish four returned bytes for each reader’s exact assigned position, with every lifetime, immutability and authorization prerequisite still holding. Each slice is then eligible for its separate consumer checks. No bytes, descriptors, buffers or syscall results were produced for this exercise.

Use returned coverage rather than requested length

The pread return contract reports the number of bytes actually read. A successful transfer can be shorter than requested; zero indicates end of file, while an error returns minus one with errno. A nonnegative result is therefore not this worksheet’s complete-slice certificate.

Assign a negative teaching receipt to reader B: two returned bytes against its planned four. The proposed record retains partial coverage and withholds the complete slice. It does not pad the missing portion, report the requested length as received, or authorize another read automatically. Any remainder procedure needs its own supported review; no loop or retry recipe is supplied.

An unexpected end-of-file receipt before the approved span is complete requires reconciliation of the plan and its premises. It is not the positive example’s expected result, nor evidence that a supposedly complete immutable eight-octet object silently satisfied a shorter request. Keep errors and unavailable results distinct from complete coverage.

Preserving a shared cursor does not freeze content or prevent close-and-reuse mistakes. Stable bytes, retained-object ownership and bounded result handling remain separate requirements. This plan excludes writes, append behavior, mappings, direct I/O and network filesystems.

Walk eight inert range-admission cards

Keep the useful claim narrower than worker correctness

Actual kernel, userspace interface, seekable-object identity, alias graph, immutable contents, descriptor lifetime, range arithmetic, result capture and current rights remain unimplemented and unknown. Those gaps block real admission. Explicit addressing supplies neither an atomic multi-range snapshot nor correctness of a parser, summary or model answer.

The anchored-open contract still owns path resolution, and the sealed-input contract still owns its selected stability policy. None is implemented by this worksheet.

No candidate file, descriptor, duplication, seek, read, positional operation, byte buffer, worker or runtime fixture was created or exercised. Ordinary editorial file handling is separate. Boundary is prelaunch and supplies no shipped positional-read service; its synthetic policy evidence covers different behavior.