kernel: update to Tarver's S41.2 (2026-07-11 refresh)

ARCHITECTURE.md

@@ -56,7 +56,7 @@ against the tree-walker, all 134/0):
    explicit **trampoline** for tail calls (Rust has no guaranteed TCO and the
    kernel is heavily tail-recursive). `let`/`lambda` push/pop a scope stack
    rather than cloning locals.
-2. **AOT kernel** (`aot/`, `klcompile`) — the 21 kernel files are compiled to
+2. **AOT kernel** (`aot/`, `klcompile`) — the kernel files are compiled to
    Rust at build time: self-tail-calls become loops, `if`/`let`/`cond` and ~18
    primitives are inlined, the rest route through `rt::apply_*`. Installed over
    the tree-walked defuns at boot, preserving function-cell late binding.

README.md

@@ -62,7 +62,7 @@ The same Shen semantics run on tiers chosen for the workload:
 | Tier | When | Notes |
 |---|---|---|
 | **Tree-walker** | default | Allocation-light interpreter over the KL AST. Best for one-shot runs. |
-| **AOT kernel** | build time | The 21 kernel KL files are compiled to Rust ahead of time by `crates/klcompile` — control flow lowered (self-tail-calls → loops; `if`/`let`/`cond` and ~18 primitives inlined). |
+| **AOT kernel** | build time | The kernel KL files are compiled to Rust ahead of time by `crates/klcompile` — control flow lowered (self-tail-calls → loops; `if`/`let`/`cond` and ~18 primitives inlined). |
 | **Bytecode VM** | `--served` / `SHEN_RUST_VM=1` | Runtime closures (`defun`/`lambda`/`freeze`) compile to bytecode. **~2.3× faster than the tree-walker on warm / served workloads** (load a theory once, serve many requests), where the compile cost amortizes. Not the bare default because a one-shot run can't amortize it. See `scripts/warm-bench.sh`. |
 | **AOT overlay** | opt-in, per `.shen` file | Known `.shen` files are compiled to Rust offline (`scripts/codegen-shen-aot.sh`, same klcompile) and committed; after a normal load (all side effects live) the host swaps the loaded defuns for the native versions via a verified manifest (`Interp::install_overlay_if_match` — source hash + kernel digest, silent fallback on mismatch). **~3.1× over the VM, ~11.7× over the tree-walker on served authz workloads** (`benches/authz_served.rs`). |
 | **Cranelift JIT** | `--features jit`, `SHEN_RUST_JIT=1` | Experimental; native codegen for runtime closures. Wins on compute loops but was falsified for the type-checker's CPS continuations — kept gated/off. See `design/jit-productionization-plan.md`. |

STATUS.md

@@ -2,8 +2,9 @@
 
 ## Current state
 
-A working port of the Shen language to Rust. It boots the upstream
-**ShenOSKernel-41.2** and passes the full conformance suite — **134 / 134**
+A working port of the Shen language to Rust. It boots Mark Tarver's
+**Shen S41.2 (2026-07-11 refresh)** kernel (see
+`kernel/klambda/PROVENANCE.md`) and passes the full conformance suite — **134 / 134**
 kernel tests (`scripts/kernel-tests.sh`) — in every execution mode. All gates
 green (`scripts/gates.sh`): shengen-codegen, fmt+clippy, build, test
 (unit + integration suites), shen-check, tcb-audit, kernel-aot-audit,
@@ -107,7 +108,7 @@ model, not a single hot spot. On served workloads the story inverts: VM
 
 ## Known limitations
 
-- Boot loads + AOT-installs 21 kernel files every startup (~sub-second release);
+- Boot loads + AOT-installs 18 kernel files every startup (~sub-second release);
   shen-cl uses pre-compiled FASLs.
 - GC collection is opt-in (`SHEN_RUST_GC=1`) and requires aarch64
   macOS/Linux (the conservative stack scan is unimplemented elsewhere —