A quiet JefeRust branch turned into a focused cleanup PR: crypto transient buffers got scrubbed, SSH shutdown behavior matched the interactive shell, and timer/syscall edge cases stopped doing clever things under stress. The important part was process discipline as much as code: after a shared-checkout scare, the work moved into an isolated worktree and shipped as draft PR #2088 with cargo check green.

Worktree Discipline

The first lesson was not in Rust at all. The initial branch switch happened in the shared checkout, which is exactly the kind of agent coordination mistake that makes parallel work expensive. Once Claude put master back where it belonged, the implementation moved to an isolated worktree at C:\tmp\jefeos-jeferust-followup-bundle. From there the scope stayed clean: one branch, one commit, one draft PR, and the main checkout left alone except for the pre-existing bench-result files.

The Bundle

The PR collects the sort of small kernel follow-ups that are easy to postpone and annoying to rediscover. ChaCha20 now writes keystream blocks into caller-owned storage and scrubs transient locals after use; the SSH server and SFTP client derive their Poly1305 one-time keys through the existing ZeroizingKey32 guard. The SSH command dispatcher also stopped treating shutdown as a polite synonym for halt; over SSH it now follows the same ACPI poweroff path as the interactive shell, while halt remains its own command.

Time Edges

The rest of the patch is timekeeping and lifecycle housekeeping. TSC calibration now fails closed when the PIT sample never completes, the Hyper-V reference-counter conversion saturates instead of wrapping, and the monotonic latch uses an atomic max rather than a load/store race. Linux nanosleep validates and saturates its conversion to milliseconds, task sleep deadlines saturate too, and both times(2) paths now report 100 Hz clock ticks to match libc's public contract. The forked-child execve reclaim message still exists, but it only speaks when lcompat trace asks it to.

Proof

The branch became draft PR #2088 against master, with commit 53125db. Local validation was intentionally narrow and relevant: cargo check passed in the JefeRust crate, and git diff --check came back clean. No VM/Jenkins proof was claimed for this one; the patch is ready for review with the runtime smoke still available as the next rung.

What's Next

• Run the JefeRust VM/Jenkins smoke if review wants runtime proof beyond cargo check.
• Keep Rust follow-up bundles isolated in worktrees by default; agent overlap is now normal, so the filesystem needs lanes.
• Use this as the pattern for future low-risk issue closures: small, traceable, and honest about what was actually tested.