Recomposed Enforcement Paths: A Comparative Framework for Hardware-Security History

Abstract

English author preprint v5. This article compares historically bounded hardware-security guarantees across memory protection, privilege, device mediation, measurement, execution metadata, microarchitectural state, physical roots, and capabilities. It argues that enforcement paths were repeatedly recomposed without establishing a single lineage or a monotonic shift toward distributed enforcement. The revised paper expands the 80386 design episode, traces VFIO/IOMMU-group proposals through selected Linux v3.6 and v3.7 release paths, and adds a narrow Intel CET near-return negative case. The accompanying v5 supplement includes a 46-reference evidence concordance, a 65-record claim register, primary-source ledgers, release-tag and group-26 source traces, a bounded guarantee extension, revision notes, and file hashes. Earlier v4.4 matrices and audits remain available in the preceding version and are inherited where identified; they are not represented as a fresh independent audit of v5. This is an author preprint and working paper, not a journal-submitted, peer-reviewed, or accepted IEEE article. AI assistance is disclosed in the manuscript. No external human coding or review of v5 is claimed.