This selected glibc has thirteen categories; CTYPE is 0 and ALL 6.

One authoritative logical locale state. The codec is opaque, not inferred from an ASCII name. Representation owns internal roots and exclusive release permissions; names themselves confer no ownership.

Release eligibility is distinct from writable pointer authority. Exclusive ownership itself belongs to the trusted representation.

The selected implementation's borrowed names have aligned object bases, even when the returned character address is unaligned. This is the source-object premise of copy_domain, not write permission.

Every current name is readable through NUL and every write root is independently writable. The opaque representation includes actual initialized libc/environment/TLS state and exclusive release rights. locale_names_aligned holds at entry and after every setter endpoint.

A current name can supply memcpy's object-base alignment without aligning its character address or changing its borrowed capability.

A current name's NUL-inclusive borrowed source span.

Private objects whose own capabilities may survive a setter. Neither the caller's input nor capabilities loaded from aux enter this pool.

Retained authority has object-level private provenance. Zero-sized spans still carry their object's own capability. Fresh objects may be retained as Obj or Ro; old authority is never upgraded.

Null is tested by address, as in native C. No capability or input string is required for the null-query operand.

Independent input admission; computing a source span never admits an unterminated or incorrectly-capabilitied setter string.

Exact P result and W/P argument classes, including discarded results.

Existing libc roots and current borrowed names supply retained authority. The setter input contributes its independently admitted string span, but never becomes writable merely by being an input.

Only setters may mutate or allocate. Querying is a pure projection.

Queries have no release permission either.

Keeping an epoch preserves every current borrowed pointer. A successor may replace them, even when effective locale names stay the same; a setter never promises persistence of an old borrow.

Refusal leaves the effective locale unchanged, not necessarily all internal allocations or errno. Its borrow window stays valid.

Successful selection may change the requested category and ALL's composite name. Encoding changes only for CTYPE or ALL. Empty input selects from the represented environment; no C/ASCII restriction.

Retained names, read spans and roots inherit only private own capabilities or born objects, not the setter input or aux-loaded caller authority. Apply this to all three to prevent laundering on a later call, including through a zero-sized root. Ordinary transient effects still use locale_sources; exclusive releases stay separate.

The entire next private pool, not just this call's returned name, has private provenance. Clients apply object-level separation and fresh-allocation facts to this lemma across repeated setters.

Silent logical segment endpoints, NOT arbitrary native instruction cutpoints: setname can free before installing a replacement. Native allocation/resource/safepoint coverage needs an in-progress view. Serialized coherent locale/environment access remains trusted.

Queries return exactly the current name, never NULL at an admitted initialized category. Setters may refuse, or return the new current category's readable borrowed name. Neither path transfers ownership.

The complete trusted call contract. Allocation policy is explicit; refusal as NULL and terminal runtime resource endings stay distinct.

The identity evolution retains the logical locale and its window.

Current names are explicit sources, not unexplained return authority.