USB mass storage: the BOT round trip and SCSI bring-up are toyos-xhci machines, and a stick that leaves its port is no break

[Japabu]

The USB mass-storage BOT round trip and the SCSI bring-up above it become pure toyos-xhci code with host tests. kernel/src/drivers/xhci/wait/msc.rs keeps the shim: it queues the transfers the machines ask for, waits for them in place, publishes the phase to the reset path, runs the staged actuators, and writes the log lines. It still runs the ladder's climb loop and decides that a disconnect mid-command goes to the port's teardown, offline: dev.failed, and data_out. A userland usbd can drive the same machines unchanged. The crate is no_std, has no unsafe code and makes no x86 assumptions.

The T14 reading of this branch showed one defect in the ladder that the branch carried over from main: a stick that left its port under the port rung's reset was counted as a break and narrated as taken offline. That is fixed here too; see the ladder section.

What changed and why

toyos_xhci::bot

• cbw() builds the 31-byte CBW (USB MSC BOT 1.0 §5.1): LUN 0, direction taken from the CDB.
• RoundTrip is the round trip as a stepped machine. Its acts are Command, Data(pipe), Status and Restart { pipe, then }, and it is answered with Moved { code, residue }, Silent, Gone or Restarted.
  • CBW and CSW are fixed-length legs: a short one is a break, not a short transfer.
  • A stalled data phase is restarted and its status is read (§6.7.2). What it delivers is the smaller of what the controller's residue and the CSW's leave.
  • A stalled CSW is retried once, as §5.3.3 / Figure 2 allows, and that includes a CSW after a data-stall restart.
  • CswDue::judge checks signature and tag (§6.3.1), then applies §6.3.2's meaningful test. Status 2 is a phase error whatever the residue. Statuses 0 and 1 are refused when the residue is larger than the transfer. Statuses 3..=255 are Broke::Reserved. Delivered bytes are min(controller's count, device's count), and a controller residue larger than the transfer delivers nothing.
• Broke<W> carries left() and event() and is generic over the driver's silence reason.
  • A disconnect is its own Gone variant; it used to be Silence { why: Quiet::Gone }. The crate has to tell a disconnect apart, and the kernel's Quiet is not a type the crate has.
  • Broke<Quiet>::Silence { why: Quiet::Gone } can still be built, and only completed() in msc.rs keeps it apart from Broke::Gone. It is not made unrepresentable because the price is a second kernel enum that mirrors three of Quiet's four variants (one of them cfg'd), with conversions both ways, all to guard one match in one function. Deleting that match's Gone arm is the negative control below, run in the guest.
  • left() matches on a Phase. It used to match on a phase's name string.
• CC_STALL joins CC_SUCCESS and CC_SHORT_PACKET in toyos_xhci::job. The kernel imports all three from there, and its own copies are deleted.

toyos_xhci::scsi

• Cdb can only be built inside this module, and it carries its own direction. The kernel's cdb_len/data_in parameters and its CDB-shape assert are gone, because a mismatch can no longer be written.
• Sense::of believes sense data only if at least 14 bytes arrived (ASCQ is byte 13; SPC-4 §4.5.3).
• Reply is the answer to one SCSI command. It is named apart from the crate root's toyos_xhci::Outcome.
• flushed(): INVALID COMMAND OPERATION CODE means the device has no cache, which is not a failure.
• Transfer does the READ/WRITE(10) batching and sector addressing. Only the first batch may answer "ask again". Geometry's fields are private and read through accessors, so only the bring-up can size a disk, and the expect in Transfer::next depends on that. Geometry::NONE fits no transfer, and a test checks it.
• BringUp is a stepped machine:
  • TEST UNIT READY on a budget, then sense or a recovery climb;
  • INQUIRY with the peripheral-type check;
  • READ CAPACITY(10), then (16) when the 10-byte answer is all ones;
  • every refusal by name (Refusal).
• The sector sizes served are 512, 1024, 2048 and 4096. This set is the driver's own and is carried over unchanged. It is not SBC-3's, which allows any logical block length. 256 divides the host block and is still refused, and the test says so.
• The kernel drives BringUp blocking, the same way the boot scan drives enumeration. A stepped kernel driver for the hot-plug bind is not built here; the renamed issue below owns that.
• Printable moved here unchanged.

toyos_xhci::ladder::Run holds a device's break count and highest rung. It used to be two loose fields. identity::first_language reads the LANGID of string descriptor zero.

The ladder: a rung whose device left its port ends as the device leaving.

• What the T14 showed at 95ebbaf (usb_transport_break on metal, SanDisk 0781:5581 on the xHC at 00:14.0):
  • The stick sat on port 1, one of the controller's USB 2.0 ports (its Supported Protocol capability: USB 2.0 on 1..=12, USB 3.1 on 13..=16), at high speed.
  • The staged break was in the data phase of a WRITE(10), so the stick was owed Data-Out and the ladder entered at the port rung with no class reset (ladder::enters_at, unchanged; the log says so by name). This is the ladder main has: enters_at, next, the port rung's steps and take_offline are the same there.
  • The port rung's hot reset completed with the port Enabled at high speed (PORTSC 0x00000e03 then 0x00200e03). 50 ms later Address Device answered USB Transaction Error.
  • The rung ended Failed, the climb counted break 2 and entered the Offline rung. That rung read port 1 Disconnected (0x000202a0: CCS clear, CSC set, RxDetect), wrote no reset and sent no command, and said is offline.
  • The disk was held. At 2.210 s, 0.93 s after port 1 read empty, the stick connected on port 13 at SuperSpeed, bound as the same device, took disk 0 back, and the WRITE went out again on it and completed.
• Why the rung could not see the stick go: a USB2 port detects no disconnect while it drives a reset (xHCI 1.2 §4.19.1.1.2, note 57), and it advances to Enabled when the reset ends (§4.19.1.1.4). A peripheral uses one connection at a time (§4.19.7). So a SuperSpeed stick that answers the reset by training on the USB3 half of its receptacle can only be seen to leave the USB2 port once the reset's completion has been read. The rung's next step then meets an empty port.
• Portsc::holds: connected, with no unconsumed connect change. The port machine, the HID recovery, the climb and reset_port all read it; the first two spelled it inline before.
• The decision is toyos_xhci::ladder's. Run::unverified(&Unverified<W>, holds) answers AfterRung::Left for a rung below Offline, whichever rung and however it ended, on a port that no longer holds its device: no break is counted and no rung above runs. Otherwise it answers the next climb and the transfer event the next rung quiesces against. The kernel reads PORTSC once the rung has ended, applies the answer, and writes the line: the port reset was not answered, and port 1 no longer holds the device (PORTSC 0x000202a0): its port's teardown takes it from here. The disk is held if a reset of this driver's earns it one, and the slot is the port's teardown's (§4.4). The kernel's Climbed enum is replaced by Result<(), ladder::Unverified<Quiet>>.
• AfterReset::goes_on is the port rung's decision to go on past its reset: only Enumerate. A reset that reads the port empty (AfterReset::Left) ends the rung Failed and reaches the same read. Every AfterReset::Left reads !holds there: an empty port reads connected again only on a new connect, which raises CSC, and the only acknowledge between the two reads is enumeration_ack, which clears CSC only after a warm reset whose read carried it.
• The arm reads every rung, so a class rung whose device left also ends there, without the port rung's quiesce. No guest test stages that direction; c1 below is its host control, and its outcome is main's: the device is left to the teardown.
• A bind whose TEST UNIT READY broke as Gone still climbs, and meets the empty port only at the first rung's end. main has that too: filed as issues/kernel/a-bind-whose-device-left-aims-the-ladder-at-its-empty-port.md.

usb_stick_left, the fix's test, with no redlist row (tests/common/usb.rs):

• The gate's data stick (Profile::UsbDisk) takes the staged break on its first WRITE(10), is owed its data, and the ladder enters at the port rung. reset_moves holds the rung once; the host unplugs the stick on the hold's cue (device_del of usbdev0) and never plugs it back, so no call waits on a device that returns.
• Three boots, one per hold:
  • usb-reset-moves, before the reset's completion is read: the reset reads the port empty.
  • usb-reset-moves-after, once the completion has been read with the stick on the port. QEMU 11.1.1 answers Address Device for a port with no device with TRB Error (hw/usb/hcd-xhci.c, xhci_address_slot through xhci_lookup_uport), so the rung fails at the step the T14's did.
  • usb-reset-moves-configured, once every step of the rung was answered and before its TEST UNIT READY. QEMU detaches the slot's port before it updates PORTSC (xhci_detach calls xhci_detach_slot first), and a doorbell on a slot whose port is detached kicks nothing (xhci_kick_epctx, xhci_slot_ok), so the CBW's wait reads the port disconnected and the rung ends OutOfStep(Broke::Gone).
• Each boot judges, in order after the staged break: the ladder entering at the port rung, the hold, the leave line naming the held port, then xHCI: slot N disabled for the stick's slot. It refuses usb-storage: <slot> is offline and any break 2 of line of that slot.
• The usb-reset-moves and -configured boots refuse Reset Device failed and Address Device (after the port reset) between the hold and the leave, which B2's fold would send to the empty port.
• The T14 row judged by transport_break_on_metal moves from usb_transport_break onto usb_stick_left; its arm (usbbreak, tests/jobcase, usb-transport-break) is unchanged.

usb_transport_break and its redlist row are as on main. This branch's AfterItsReset and BeforeItsTestUnitReady boots and its is offline refusal leave it, and every actuator only it arms is untouched for #639. It shares usb-reset-moves and the metal verdict's transport_break_on_metal with usb_stick_left.

The metal verdict (tests/common/usb.rs). Its kernel-log half is transport_break_recovered:

• The ladder entered at the port rung.
• The stick is never is offline.
• Either the stick was held, came back as the same device and the WRITE completed on it; or the port rung took and the WRITE completed. Each shape's lines are asserted in order.
• The old Reset Recovery took alternative is gone, since this break never enters at the class reset. The old moved branch did not refuse is offline, and it passed the reading above.
• metal_usb_judge (tests/checks/usb.rs) holds it to the T14's records at 95ebbaf (refused) and to the shape this branch writes (passed), beside five more.

Kernel shim: msc.rs goes from 2642 to 2372 lines, and kernel/src from 62668 to 62400, on main at 3c24b6e and on this head. The staged PortGone fault is now the Command act's completion, completed(Err(Quiet::Gone)), so the actuator goes through the arm that sends a disconnect to the teardown. Nothing is queued for it, as before.

Issues

• The slug the-bot-scsi-machine-is-still-hand-written-in-the-kernel is no longer true. What the issue still owes is the bind, which is the one call site inside a scheduling pass. So it is renamed to issues/hardware/a-disk-plugged-in-after-boot-is-bound-inside-a-scheduling-pass.md, and its citation moves with it (issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md).
• issues/hardware/the-t14s-superspeed-stick-enumerates-at-high-speed-under-toyos.md gains the reading above, and the open question of why the port rung's reset moved the stick where the scan's reset of the same port did not.
• Filed: issues/kernel/a-usb3-device-attached-but-untrained-reads-as-gone.md. A USB3 port that detected a device it could not enable reads CAS with CCS clear, so it reads !holds, and nothing here warm-resets it. That holds on main too.
• Filed: issues/kernel/a-bind-whose-device-left-aims-the-ladder-at-its-empty-port.md, above.

Behaviour

The refactor changes nothing on the wire: the commands, bytes, order, waits and recovery are the same. The two source spellings that toyos-blackbox checks against msc.rs are kept. The ladder fix above is the one behaviour change, and it sends nothing new.

These things changed off the wire:

• The CBW is written as one 31-byte copy instead of field writes through Unaligned: the same bytes at the same DMA offset. The CSW is read as one 13-byte copy.
• REQUEST SENSE's response is copied out whenever the round trip completed, and then thrown away if fewer than 14 bytes arrived.
• Bring-up copies the whole allocation (36/8/32 bytes) rather than the 36/8/12 it reads.
• A status-stall retry publishes StatusOwed twice, with the same value and ring positions.
• Transfer::next now panics (expect) where the old code silently truncated a sector number to 32 bits. Bring-up's refusal of disks past 2^32 sectors and the range check already make that case unreachable.
• msc_flush's inner if !dev.no_write_cache is removed. It was always true, because the latch is checked above it.
• Two log lines change. A CSW with status 2 and a residue larger than the transfer now logs as a phase error instead of CSW claims N B unmoved, and a reserved status (3..=255) logs the CSW carries status 0x.., which the class reserves instead of a phase error. Both break in the status phase and climb the same ladder as before.
• With boot-actuators, the staged PortGone now takes a tag and writes its CBW into the pool before its Command act completes as the disconnect. Nothing reaches the controller.

Gates

At 989aec4 (logs under the job scratchpad, orch/588r6/logs/):

gate	exit	log
cargo run -- --ci host ([ci] Host: 55 step(s), all green)	0	ci-host.txt
cargo run -- --build-only	0	build-only.txt
cargo test -p toyos-xhci (150 tests)	0	green-xhci.txt
kernel cargo clippy -- -D warnings with src/clippy.rs's adopted lints, x86_64 and AArch64, each with no features, boot-actuators, and boot-actuators,test-actuators	0 in all six	green-clippy-clippy-{1..6}.txt
cargo test --test toyos-checks metal_usb_judge	0	green-checks.txt
cargo test --test toyos-build --no-run	0	green-harness.txt

At d1471df, which adds the T14's three boot.usbbreak.* records (1160 / 3905 / 21851) from the 989aec4 run below to tests/metal/lenovo-20w0003amz.toml: cargo run -- --ci host ([ci] Host: 55 step(s), all green) exit 0, log orch/588r7/ci-host.txt.

The orchestrator's runs at 989aec4 (orch/logs/588r6-588r6-*.log, issuecomment-5919300334):

run	command	exit	log
usb_stick_left, run 1	cargo test --test toyos-build -- usb_stick_left	0	588r6-588r6-stick-left-1.log
usb_stick_left, run 2	cargo test --test toyos-build -- usb_stick_left	0	588r6-588r6-stick-left-2.log
usb_stick_left, run 3	cargo test --test toyos-build -- usb_stick_left	0	588r6-588r6-stick-left-3.log
b2k applied	cargo test --test toyos-build -- usb_stick_left	1: BeforeItsCompletion: "[kernel 0.324 cpu0] xHCI: Address Device (after the port reset) failed: code 5 (TRB Error)" between the hold and the leave	588r6-588r6-b2k-kernel-fold.log
whole	cargo test --test toyos-build	0: 499 passed, 499 total	588r6-588r6-whole.log
T14	cargo test --test toyos-build -- --metal usb_stick_left	0: PASS usb_stick_left	588r6-588r6-metal.log

The orchestrator's runs at 63a2a04 (orch/logs/588r5-*.log, issuecomment-5914619271), before the leave decision moved into toyos_xhci::ladder:

run	command	exit	log
T14, redlist row lifted	cargo test --test toyos-build -- --metal usb_transport_break	0: the port reset was not answered, and port 1 no longer holds the device (PORTSC 0x000202a0): its port's teardown takes it from here, then PASS usb_transport_break	588r5-metal-forced.log

High-risk: negative controls and the independent oracle

Negative controls. Each is a checked patch: git apply --check, applied, shown to build, its test run, git apply -R, and the tree clean after. The patches are in the comment "Mutation patches at 989aec4".

The green arm is the gates above at 989aec4.

mutation	built	result
n1 Run::unverified leaves only a Failed rung: if !holds && matches!(ended, Unverified::Failed)	cargo test -p toyos-xhci --no-run 0	cargo test -p toyos-xhci EXIT=101, a_rung_that_did_not_verify_left_exactly_where_its_port_no_longer_holds_the_device: ClassReset OutOfStep(Code { .. }) answered Climbs, not Left
c1 only a port rung leaves: if !holds && self.climbed == Some(Rung::PortReset)	0	EXIT=101, the same test: ClassReset Failed answered Climbs
k1 no rung ends as its device leaving: the !holds arm deleted	0	EXIT=101, the same test: ClassReset Failed answered Climbs
b2c AfterReset::goes_on folds Left into Enumerate, B2's fold in the crate	0	EXIT=101, a_device_is_addressed_again_only_as_what_it_was_enumerated_as: Left
b2k B2's fold at the kernel site: PortStep::Reset => matches!(self.reset_port(dev, RECOVERING), AfterReset::Enumerate | AfterReset::Left)	the six kernel clippy shapes 0; cargo test --test toyos-build --no-run 0	usb_stick_left EXIT=1, the Gates row "b2k applied"

Earlier rounds' controls, re-run at 989aec4, each built (EXIT=0) and red: m01 to m23 (cargo test -p toyos-xhci EXIT=101; m16 re-expressed at this head, since Run::unverified now follows Run::over), h1 and h2 (EXIT=101, a_port_holds_its_device_only_while_it_reads_connected_with_no_change_unconsumed), j0, j1 and j2 (cargo test --test toyos-checks metal_usb_judge EXIT=101). Log older-controls.txt.

mutation	red test(s)
m01 CBW direction flag inverted	a_cbw_is_laid_out_as_the_class_defines_it
m02 CSW tag not checked	a_csw_is_believed_only_when_it_is_valid_and_meaningful
m03 delivered trusts the device alone	what_is_delivered_is_what_both_the_controller_and_the_device_say_arrived, a_stalled_data_phase_delivers_what_both_the_controller_and_the_device_say_arrived
m04 status stall retried without bound	a_stalled_status_is_asked_for_again_once
m05 CSW residue unbounded	a_csw_is_believed_only_when_it_is_valid_and_meaningful, by the subtraction underflow the check exists to prevent
m06 short CBW/CSW accepted	a_command_or_status_block_that_moved_short_breaks
m07 data stall not restarted	five bot tests
m08 sense believed at 13 bytes	sense_is_believed_only_when_its_ascq_arrived
m09 "ask again" after blocks moved	only_the_first_batch_may_answer_ask_again
m10 READ CAPACITY(16) never asked	a_disk_too_big_for_read_capacity_10_is_asked_the_16_byte_form
m11 disk past READ(10) served	same
m12 no-cache flush is a failure	a_flush_the_device_does_not_implement_is_no_failure_and_every_other_refusal_is
m13 ready budget ignored	a_disk_that_never_becomes_ready_is_given_up_on_at_its_budget
m14 sector LBA unscaled	a_transfer_is_its_batches_in_order_and_only_a_whole_one_advances
m15 peripheral qualifier read as the type	a_device_that_is_not_a_disk_this_driver_serves_is_refused_by_name
m16 Run::over keeps its rung	a_run_climbs_one_rung_per_break_until_a_round_trip_ends_it
m17 skip-the-class-reset said on every rung	two ladder tests
m18 LANGID read from an empty descriptor	a_language_is_read_only_from_a_string_descriptor_that_carries_one
m19 after a data stall, moved: self.data_len (the device's residue alone)	a_stalled_data_phase_delivers_what_both_the_controller_and_the_device_say_arrived
m20 after a data stall, .status(true) (no §5.3.3 retry)	a_status_stalled_after_a_data_stall_is_still_asked_for_again
m21 data residue wrapping_sub	what_is_delivered_is_what_both_the_controller_and_the_device_say_arrived
m22 CSW residue checked before status 2	a_csw_is_believed_only_when_it_is_valid_and_meaningful
m23 data-stall residue wrapping_sub	a_stalled_data_phase_delivers_what_both_the_controller_and_the_device_say_arrived

The disconnect seam's control is gone-arm-deleted (the comment "Mutation patches at 95ebbaf"). It deletes Err(Quiet::Gone) => bot::Answer::Gone, from completed(), and it still applies here (git apply --check 0). At 95ebbaf, cargo test --test toyos-build -- usb_transport_break with it applied exited 1: the driver never said "… transport broke on SCSI 0x28: the port disconnected during the command phase; its port's teardown takes it from here" (log 588r3-control-gone-arm.log).

Independent oracles.

• The ladder fix is judged against real hardware first: the T14's records at 95ebbaf are the recorded failure, metal_usb_judge carries them, and the T14 at 63a2a04 passed. The xHCI 1.2 sections above were read from the specification's text. The QEMU stagings' completions and detach order were read from QEMU 11.1.1's hw/usb/hcd-xhci.c, the instrument .github/qemu-version declares.
• The crate's byte layouts and verdicts are written from the specifications' tables, not from the old code:
  • USB MSC BOT 1.0: §5.1 CBW, §5.2 CSW, §5.3.3 status retry, §6.3.1 valid and §6.3.2 meaningful CSW, §6.7.2 data stall.
  • SPC-4: §4.5.3 fixed sense, §6.4 INQUIRY, §6.29 REQUEST SENSE, §6.37 TEST UNIT READY.
  • SBC-3: §5.11 READ(10), §5.32 WRITE(10), §5.24 SYNCHRONIZE CACHE, and READ CAPACITY(10)/(16).
  • USB 2.0 §9.6.7 for LANGID.
• The sector-size set is the one exception. It has no oracle but the driver it was carried over from.
• QEMU's usb-storage device is a second implementation of the same protocol, reached through the guest USB suite. The T14's stick is a third.

What I am unsure of

• The T14 row now judges the boot stick's break under usb_stick_left, whose QEMU boots stage the data stick. The QEMU replay of the T14's own boot, power::transport_break_chain, is usb_transport_break's and goes with it in The redlist and the recorded durations go: a red test is fixed or deleted with its issue, a flaky test is deleted at once, and shards deal the task list in turn #639.

🤖 Generated with Claude Code

https://claude.ai/code/session_016t9wjdQkB8SH7bmfUoiy6L

[Japabu]

Review, round 1, at 627a715

CI host SUCCESS at 627a715 (run 36473180835, --ci host and --ci gate-stage steps success). git merge-tree origin/main 627a7150 is clean (exit 0). Guest: 19 USB/storage tests and Fast EXIT=0 (orchestrator logs 588-*.log). None of those runs reaches the ladder.

Growth, from git diff --shortstat origin/main...627a7150 (+1799 −601): production is about +559 (crate +849: bot +271, scsi +527, ladder +42, identity +8, lib +1; kernel −287; sourcegate −3), tests about +641, issues −2. I accept the growth for host-testable decisions that usbd can reuse. The deletions are named below.

BLOCKER

• toyos-xhci/src/bot.rs:108, kernel/src/drivers/xhci/mod.rs:116 — CC_STALL = 6 is now declared twice, once in the crate and once in the kernel. The crate's copy sits in bot.rs rather than in job.rs beside CC_SUCCESS/CC_SHORT_PACKET, and it is a sibling of the kernel constant. Move it to job.rs, have the kernel (wait/mod.rs:485) import it, and delete mod.rs:116.
• toyos-xhci/src/bot.rs:293-296 — two mutations on the data-stall route survive every host test. (a) Self { moved: self.data_len.saturating_sub(unmoved), ..self } → Self { moved: self.data_len, ..self }: after a stall the device's residue is trusted alone. (b) .status(false) → .status(true): a CSW STALL after a data-stall restart gets no §5.3.3 retry, which is a change on the wire. Add a walk with a Data STALL at residue 100 then CSW (TAG, 0, 0), asserting Done { delivered: 412 }. Add a walk with a Data STALL, then a Status STALL, then a whole CSW, asserting the second Status act and Ok. Show both mutations red.
• kernel/src/drivers/xhci/wait/msc.rs:763, :1374 — this is the new seam that sends a disconnect to the teardown and not up the ladder. Deleting the Err(Quiet::Gone) => bot::Answer::Gone, arm passes every test in the tree. The PortGone actuator returns a ready-made Broke::Gone from bot before any transfer, so port_gone_is_left_to_the_teardown never goes through completed(). Stage the fault as the Command act's completion (Err(Quiet::Gone) fed through completed) so the actuator exercises the seam. Then show the arm-deletion mutation red in usb_transport_break.
• tests/common/usb.rs:1414 (usb_transport_break, redlisted) — the paths this change moved most have no run at 627a715. That covers Run/skips_class_reset, Broke::Gone to the teardown, Told on OutOfStep, offline after "broke N times running", abandoned_write_is_taken_offline, and the moved sticks. The pcap wire oracle (command_blocks, every_port_reset_is_followed_by_a_test_unit_ready) is the only independent check of "no change on the wire" for the ladder, and it did not run either. The orchestrator must force it by name at 627a715 and at base bc9ccad, same run count, with the row removed in a scratch checkout only. Required: the first boot (pcap order, owed-data skip, port-gone), transport_gives_up and abandoned_write_is_taken_offline are green at head. Any red at head carries a signature from one of the four redlisted issues and also occurs at the base.
• (hardware) — there is no metal reading at 627a715. This is the T14's boot-stick driver, and the PR body itself says the metal run is what would show a difference on silicon. Required: a T14 stick boot and transport_break_on_metal (tests/common/usb.rs:2273) at this head, with exit code and log. QEMU is not the hardware.

NOTE

• toyos-xhci/src/scsi.rs:15 — pub type Nanos = u64; is a fifth copy of the alias the crate root already re-exports (port::Nanos). Use crate::Nanos.
• toyos-xhci/src/scsi.rs:143-149,229 — the expect rests on Geometry coming only from geometry(), but its fields are pub and so is NONE. Make the fields private with accessors so the premise is enforced by the type rather than by a comment.
• toyos-xhci/src/bot.rs:355-363 — the checks follow the old code's order, not §6.3.1. Status 02h is meaningful whatever the residue, but here a phase error with residue > length becomes Residue. The recovery is the same (both lead to Phase::Status), but the test claims §6.3 and pins the old order. PhaseError also carries statuses 3..=255.
• toyos-xhci/src/bot.rs:278 — saturating_sub → wrapping_sub survives: no test has a controller residue larger than the transfer. One assertion closes it.
• toyos-xhci/src/bot.rs:148-150 — Broke<Quiet>::Silence { why: Quiet::Gone } can still be built beside Broke::Gone, which gives one fact two representations. Only completed() keeps them apart.
• toyos-xhci/src/scsi.rs:121 — scsi::Outcome has the same name as the crate root's toyos_xhci::Outcome (job::Outcome). Rename one.
• toyos-xhci/src/scsi.rs:497 — the 512..=4096 sector set comes from the old code, not from SBC-3, which allows any logical block length. 256 divides HOST_BLOCK and is refused. The behaviour is unchanged, so keep it, but the test claims the spec as its oracle.

REMOVE

• kernel/src/drivers/xhci/wait/msc.rs:8-11 — "Every decision is the crate's …" is false: the climb loop, the Gone-to-teardown verdict, offline: dev.failed and data_out are decided in this file.
• toyos-xhci/src/scsi.rs:10-12 — "it is driven to its end in place today" describes the tree and marks a date; it will rot.
• toyos-xhci/src/scsi.rs:387 — "A sector size that does not divide [HOST_BLOCK]; zero among them." is false: 256 divides it and lands here.
• toyos-xhci/src/bot.rs:158-160 — "The CSW named somebody else's transfer" is false for what: "signature".
• PR body "## Overlap with Storage: file servers for DATA, the log and the boot volume; the kernel's NVMe and FAT go #536" — not the merge's record.
• PR body "## What I am unsure of" — review-time text; it goes stale in main's history.
• PR body "The guest runs are queued below." — nothing is queued below.

SEND BACK

[Japabu]

Review, round 2, at f90b2d2

CI host SUCCESS at f90b2d2. git merge-tree --write-tree origin/main HEAD (origin/main 8a8fe27) exits 0. The merge 435e00b touched none of the branch's files. Guest evidence is the orchestrator's 588r2 runs at f90b2d2: 20 USB/xHCI/storage tests and Fast, all EXIT=0. Forced usb_transport_break runs: head 2/2 EXIT=0, head with the gone arm deleted EXIT=1, base e3a1cdc 2/2 EXIT=0.

Growth, from git diff --shortstat origin/main...HEAD (+1869 −607): production is about +510 and tests about +750 (bot 376, scsi 339, ladder 27, identity 10). Accepted, on round 1's grounds.

Round-1 BLOCKERs

• CC_STALL declared twice: CLOSED. toyos-xhci/src/job.rs:54 is the only declaration left. wait/mod.rs:44 imports it, and mod.rs:116 is deleted.
• Two data-stall mutations survived: CLOSED. m-a-stall-trusts-device goes red in a_stalled_data_phase_delivers_what_both_the_controller_and_the_device_say_arrived, and m-b-stall-no-status-retry goes red in a_status_stalled_after_a_data_stall_is_still_asked_for_again. Each built with EXIT=0 and tested with EXIT=101, and the tree was restored by cmp (r2/mutations.log). Each patch is exactly the round-1 line.
• The Gone seam was never exercised: CLOSED. msc.rs:1417 feeds the staged PortGone through completed(Err(Quiet::Gone)), and gone-arm-deleted.patch deletes exactly msc.rs:761.
  • The mutated run exits 1 with the driver never said "... its port's teardown takes it from here". Its log shows the disconnect climbing the ladder instead: break 1 of 3 running, then Reset Recovery took.
  • Unmutated, the head is 2/2 EXIT=0.
• Forced usb_transport_break runs: CLOSED. Round 1 required the head to be green, and any red at the head to occur at the base as well. It never required a red at the base.
  • Head 2/2 and base 2/2 print the same lines: the pcap wire oracle (4 Bulk-Only resets, each followed by both clears and a TEST UNIT READY), the owed-data skip, 3 taken offline behind a last reset, the abandoned write, and all four moved-stick boots.
• No metal reading: OPEN. No T14 stick boot and no transport_break_on_metal exist at f90b2d2. This remains a landing condition, because QEMU is not the hardware. The branch owes no code for it; it waits for the T14.

The redlist

• The PR does not claim to fix usb_transport_break, and src/redlist.rs is not in the diff. The green at base contradicts nothing the PR says.
• The row stays, and so does issues/kernel/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md, unchanged.
  • The issue's red comes at a rate. The code it names (wait_for_return, and the disk call spinning with IF clear) is untouched by this diff. Two green runs on each side measure nothing about it.
  • The base did exercise the held-disk path. The defect the issue owes shows up identically at head and base: SameStick: the held call ended 2.000 s after the break on cpu1; the stick was bound on cpu0, after it ended. The test tolerates that shape; only the rarer interleaving that also loses the window goes red.

Mutation patches

• All seven revert what they claim: unredlist-transport-break, gone-arm-deleted, and m-a through m-e. m-d moves the residue guard ahead of every status, which is the old order in full, as the commit states.

BLOCKER

• (hardware): no metal reading at f90b2d2. Carried from round 1, not new.

NOTE

• kernel/src/drivers/xhci/mod.rs:115-116 — CC_SUCCESS and CC_SHORT_PACKET are still declared both here and in toyos-xhci/src/job.rs:51-52. At msc.rs:1416 the kernel's copy answers the crate's machine. This predates the branch, but the CC_STALL move is only complete once both kernel lines are deleted and imported from toyos_xhci::job.
• PR body, mutation table m01–m18: these were measured at 627a715, and CswDue::judge has changed since. Re-run them at the head, or state the head they were measured at.

REMOVE

• PR body: "Guest: at 627a715, the previous head, … No guest run has been made at this head." It is false at f90b2d2.
• PR body: "That run belongs to the orchestrator." This is review-time text, not main's record.
• PR body: "The orchestrator forces it with the row removed at this head and at the base. Those are the orchestrator's runs." This is review-time text as well.

SEND BACK

[Japabu]

Mutation patches at 95ebbaf

The patches behind the negative-control table in the description, exactly as applied. Each is one hunk against 95ebbafdd: git apply --check passes on it, git apply mutates the tree, and git apply -R restores it. m01 to m23 are the table's rows. gone-arm-deleted is the disconnect seam's guest control: with it applied, usb_transport_break must go red in port_gone_is_left_to_the_teardown.

m01-cbw-direction-inverted

--- a/toyos-xhci/src/bot.rs
+++ b/toyos-xhci/src/bot.rs
@@ -116,7 +116,7 @@
     out[0..4].copy_from_slice(&CBW_SIGNATURE.to_le_bytes());
     out[4..8].copy_from_slice(&tag.to_le_bytes());
     out[8..12].copy_from_slice(&data_len.to_le_bytes());
-    out[12] = if cdb.data_in() { 0x80 } else { 0x00 };
+    out[12] = if cdb.data_in() { 0x00 } else { 0x80 };
     let bytes = cdb.bytes();
     out[14] = bytes.len() as u8;
     out[15..15 + bytes.len()].copy_from_slice(bytes);

m02-csw-tag-not-checked

--- a/toyos-xhci/src/bot.rs
+++ b/toyos-xhci/src/bot.rs
@@ -348,7 +348,7 @@
         }
         // A mismatched tag would attribute one command's status to another — a
         // write reporting the read before it as success.
-        if tag != self.tag {
+        if tag != self.tag && false {
             return Err(Broke::Csw { what: "tag", got: tag, want: self.tag, status, residue });
         }
         match status {

m03-delivered-trusts-the-device-alone

--- a/toyos-xhci/src/bot.rs
+++ b/toyos-xhci/src/bot.rs
@@ -356,7 +356,7 @@
             0 | 1 if residue > self.data_len => Err(Broke::Residue { unmoved: residue, of: self.data_len }),
             // Neither account is trusted alone: a caller may read only what
             // both the device and the controller say arrived.
-            0 => Ok(Bot::Done { delivered: self.moved.min(self.data_len - residue) }),
+            0 => Ok(Bot::Done { delivered: self.data_len - residue }),
             1 => Ok(Bot::Failed),
             status => Err(Broke::Reserved { status }),
         }

m04-status-stall-retried-without-bound

--- a/toyos-xhci/src/bot.rs
+++ b/toyos-xhci/src/bot.rs
@@ -295,7 +295,7 @@
             (At::DataRestart { .. }, Answer::Restarted(false)) => Next::Broke(Broke::Stall { phase: Phase::Data }),
             // The class's one legal retry: a device may STALL the status
             // phase once (§5.3.3, Figure 2).
-            (At::Status { retried: false }, Answer::Moved { code: CC_STALL, .. }) => Next::Act(
+            (At::Status { .. }, Answer::Moved { code: CC_STALL, .. }) => Next::Act(
                 Self { at: At::StatusRestart, ..self },
                 Act::Restart { pipe: Pipe::In, then: Phase::StatusOwed },
             ),

m05-csw-residue-unbounded

--- a/toyos-xhci/src/bot.rs
+++ b/toyos-xhci/src/bot.rs
@@ -353,7 +353,7 @@
         }
         match status {
             2 => Err(Broke::PhaseError),
-            0 | 1 if residue > self.data_len => Err(Broke::Residue { unmoved: residue, of: self.data_len }),
+            0 | 1 if residue > self.data_len && false => Err(Broke::Residue { unmoved: residue, of: self.data_len }),
             // Neither account is trusted alone: a caller may read only what
             // both the device and the controller say arrived.
             0 => Ok(Bot::Done { delivered: self.moved.min(self.data_len - residue) }),

m06-short-cbw-or-csw-accepted

--- a/toyos-xhci/src/bot.rs
+++ b/toyos-xhci/src/bot.rs
@@ -318,7 +318,7 @@
 /// CSW on a 512-byte endpoint — so only the residue says it all moved.
 fn framed<W>(phase: Phase, pipe: Pipe, len: u32, answer: Answer<W>) -> Result<(), Broke<W>> {
     match answer {
-        Answer::Moved { code: CC_SUCCESS | CC_SHORT_PACKET, residue: 0 } => Ok(()),
+        Answer::Moved { code: CC_SUCCESS | CC_SHORT_PACKET, .. } => Ok(()),
         Answer::Moved { code: CC_SUCCESS | CC_SHORT_PACKET, residue } => {
             Err(Broke::Short { phase, moved: len.saturating_sub(residue), wanted: len })
         }

m07-data-stall-not-restarted

--- a/toyos-xhci/src/bot.rs
+++ b/toyos-xhci/src/bot.rs
@@ -279,7 +279,7 @@
             // A stalled data phase is ordinary — an unsupported command, a read
             // past the end — and the status that follows its recovery turns it
             // into a clean refusal (§6.7.2).
-            (At::Data, Answer::Moved { code: CC_STALL, residue }) => Next::Act(
+            (At::Data, Answer::Moved { code: CC_STALL, residue }) if false => Next::Act(
                 Self { at: At::DataRestart { unmoved: residue }, ..self },
                 Act::Restart { pipe: data_pipe, then: Phase::Data },
             ),

m08-sense-believed-at-13-bytes

--- a/toyos-xhci/src/scsi.rs
+++ b/toyos-xhci/src/scsi.rs
@@ -92,7 +92,7 @@
     /// The sense `response` carries, of which `delivered` bytes arrived. ASCQ
     /// is byte 13, so fourteen must have or none of it is believed.
     pub fn of(response: &[u8; SENSE_BYTES], delivered: u32) -> Self {
-        if delivered < 14 {
+        if delivered < 13 {
             return Self::NONE;
         }
         Self { key: response[2] & 0x0F, asc: response[12], ascq: response[13] }

m09-ask-again-after-blocks-moved

--- a/toyos-xhci/src/scsi.rs
+++ b/toyos-xhci/src/scsi.rs
@@ -257,7 +257,7 @@
             }
             Reply::Ok { delivered } => Moved::Short { delivered },
             Reply::Refused(sense) => Moved::Refused(sense),
-            Reply::Budget if first => Moved::Ended(Fail::Budget),
+            Reply::Budget => Moved::Ended(Fail::Budget),
             Reply::Broken | Reply::Budget => Moved::Ended(Fail::Device),
         }
     }

m10-read-capacity-16-never-asked

--- a/toyos-xhci/src/scsi.rs
+++ b/toyos-xhci/src/scsi.rs
@@ -487,7 +487,7 @@
                 Next::Disk(Self { at: At::Read(next), ..self }, Inquiry(said), Ask::Read(next))
             }
             // An all-ones last LBA says the disk needs the 16-byte form.
-            Query::Capacity10 if be32(0) == u32::MAX => {
+            Query::Capacity10 if be32(0) == u32::MAX && false => {
                 self.ask(At::Read(Query::Capacity16), Ask::Read(Query::Capacity16))
             }
             Query::Capacity10 => Next::Up(geometry(u64::from(be32(0)), be32(4))),

m11-disk-past-read-10-served

--- a/toyos-xhci/src/scsi.rs
+++ b/toyos-xhci/src/scsi.rs
@@ -506,7 +506,7 @@
     if !matches!(sector_bytes, 512 | 1024 | 2048 | 4096) {
         return Up::Refused(Refusal::SectorSize(sector_bytes));
     }
-    if last_lba > u64::from(u32::MAX) {
+    if last_lba > u64::from(u32::MAX) && false {
         return Up::Refused(Refusal::PastRead10 { last_lba });
     }
     let sectors = last_lba + 1;

m12-no-cache-flush-is-a-failure

--- a/toyos-xhci/src/scsi.rs
+++ b/toyos-xhci/src/scsi.rs
@@ -277,7 +277,7 @@
 
 pub fn flushed(reply: Reply) -> Flushed {
     match reply {
-        Reply::Refused(sense) if sense.unimplemented() => Flushed::NoCache,
+        Reply::Refused(sense) if sense.unimplemented() && false => Flushed::NoCache,
         Reply::Ok { .. } => Flushed::Emptied,
         Reply::Refused(sense) => Flushed::Refused(sense),
         Reply::Broken => Flushed::Ended(Fail::Device),

m13-ready-budget-ignored

--- a/toyos-xhci/src/scsi.rs
+++ b/toyos-xhci/src/scsi.rs
@@ -442,7 +442,7 @@
 
     /// Another attempt, if the budget has room for one at `now`.
     fn again(self, now: Nanos, offline: bool) -> Next {
-        if offline || now >= self.give_up {
+        if offline {
             return Next::Up(Up::Unready { sense: self.sense, offline });
         }
         self.ask(At::Ready, Ask::TestUnitReady)

m14-sector-lba-unscaled

--- a/toyos-xhci/src/scsi.rs
+++ b/toyos-xhci/src/scsi.rs
@@ -231,7 +231,7 @@
         }
         let blocks = (self.count - self.done).min(self.most);
         let block = self.lba + u64::from(self.done);
-        let sector = block * u64::from(self.sectors_per_block);
+        let sector = block;
         // `BringUp` refused a disk whose last sector does not fit 32 bits, and
         // `new` refused a transfer past the disk.
         let sector = u32::try_from(sector).expect("a sector past what READ(10) addresses");

m15-peripheral-qualifier-read-as-the-type

--- a/toyos-xhci/src/scsi.rs
+++ b/toyos-xhci/src/scsi.rs
@@ -477,7 +477,7 @@
         let be32 = |at: usize| u32::from_be_bytes([bytes[at], bytes[at + 1], bytes[at + 2], bytes[at + 3]]);
         match query {
             Query::Inquiry => {
-                let peripheral = bytes[0] & 0x1F;
+                let peripheral = bytes[0];
                 if peripheral != 0 {
                     return Next::Up(Up::Refused(Refusal::NotADisk(peripheral)));
                 }

m16-run-over-keeps-its-rung

--- a/toyos-xhci/src/ladder.rs
+++ b/toyos-xhci/src/ladder.rs
@@ -138,7 +138,9 @@
 
     /// A round trip completed: the run is over. How many breaks it held.
     pub fn over(&mut self) -> u8 {
-        core::mem::replace(self, Self::NONE).breaks
+        let breaks = self.breaks;
+        self.breaks = 0;
+        breaks
     }
 }
 

m17-skip-class-reset-said-on-every-rung

--- a/toyos-xhci/src/ladder.rs
+++ b/toyos-xhci/src/ladder.rs
@@ -131,7 +131,7 @@
     pub fn broke(&mut self, left: Left) -> Climb {
         self.breaks = self.breaks.saturating_add(1);
         let rung = next(self.climbed, left);
-        let skips_class_reset = self.climbed.is_none() && rung != Rung::ClassReset;
+        let skips_class_reset = rung != Rung::ClassReset;
         self.climbed = Some(rung);
         Climb { rung, skips_class_reset }
     }

m18-langid-read-from-an-empty-descriptor

--- a/toyos-xhci/src/identity.rs
+++ b/toyos-xhci/src/identity.rs
@@ -102,7 +102,7 @@
 /// arrived; a device offering none names no string.
 pub fn first_language(arrived: &[u8]) -> Option<u16> {
     match *arrived {
-        [length, 3, lo, hi, ..] if length >= 4 => Some(u16::from_le_bytes([lo, hi])),
+        [_length, 3, lo, hi, ..] => Some(u16::from_le_bytes([lo, hi])),
         _ => None,
     }
 }

m19-stall-delivers-the-devices-residue-alone

--- a/toyos-xhci/src/bot.rs
+++ b/toyos-xhci/src/bot.rs
@@ -289,7 +289,7 @@
             (At::Data, Answer::Silent(why)) => Next::Broke(Broke::Silence { phase: Phase::Data, why }),
             (At::Data, Answer::Gone) => Next::Broke(Broke::Gone { phase: Phase::Data }),
             (At::DataRestart { unmoved }, Answer::Restarted(true)) => {
-                let (trip, act) = Self { moved: self.data_len.saturating_sub(unmoved), ..self }.status(false);
+                let (trip, act) = Self { moved: self.data_len, ..self }.status(false);
                 Next::Act(trip, act)
             }
             (At::DataRestart { .. }, Answer::Restarted(false)) => Next::Broke(Broke::Stall { phase: Phase::Data }),

m20-data-stall-then-no-status-retry

--- a/toyos-xhci/src/bot.rs
+++ b/toyos-xhci/src/bot.rs
@@ -289,7 +289,7 @@
             (At::Data, Answer::Silent(why)) => Next::Broke(Broke::Silence { phase: Phase::Data, why }),
             (At::Data, Answer::Gone) => Next::Broke(Broke::Gone { phase: Phase::Data }),
             (At::DataRestart { unmoved }, Answer::Restarted(true)) => {
-                let (trip, act) = Self { moved: self.data_len.saturating_sub(unmoved), ..self }.status(false);
+                let (trip, act) = Self { moved: self.data_len.saturating_sub(unmoved), ..self }.status(true);
                 Next::Act(trip, act)
             }
             (At::DataRestart { .. }, Answer::Restarted(false)) => Next::Broke(Broke::Stall { phase: Phase::Data }),

m21-data-residue-wrapping-sub

--- a/toyos-xhci/src/bot.rs
+++ b/toyos-xhci/src/bot.rs
@@ -273,7 +273,7 @@
                 }
             },
             (At::Data, Answer::Moved { code: CC_SUCCESS | CC_SHORT_PACKET, residue }) => {
-                let (trip, act) = Self { moved: self.data_len.saturating_sub(residue), ..self }.status(false);
+                let (trip, act) = Self { moved: self.data_len.wrapping_sub(residue), ..self }.status(false);
                 Next::Act(trip, act)
             }
             // A stalled data phase is ordinary — an unsupported command, a read

m22-csw-residue-checked-before-status-2

--- a/toyos-xhci/src/bot.rs
+++ b/toyos-xhci/src/bot.rs
@@ -352,8 +352,8 @@
             return Err(Broke::Csw { what: "tag", got: tag, want: self.tag, status, residue });
         }
         match status {
+            _ if residue > self.data_len => Err(Broke::Residue { unmoved: residue, of: self.data_len }),
             2 => Err(Broke::PhaseError),
-            0 | 1 if residue > self.data_len => Err(Broke::Residue { unmoved: residue, of: self.data_len }),
             // Neither account is trusted alone: a caller may read only what
             // both the device and the controller say arrived.
             0 => Ok(Bot::Done { delivered: self.moved.min(self.data_len - residue) }),

m23-data-stall-residue-wrapping-sub

--- a/toyos-xhci/src/bot.rs
+++ b/toyos-xhci/src/bot.rs
@@ -289,7 +289,7 @@
             (At::Data, Answer::Silent(why)) => Next::Broke(Broke::Silence { phase: Phase::Data, why }),
             (At::Data, Answer::Gone) => Next::Broke(Broke::Gone { phase: Phase::Data }),
             (At::DataRestart { unmoved }, Answer::Restarted(true)) => {
-                let (trip, act) = Self { moved: self.data_len.saturating_sub(unmoved), ..self }.status(false);
+                let (trip, act) = Self { moved: self.data_len.wrapping_sub(unmoved), ..self }.status(false);
                 Next::Act(trip, act)
             }
             (At::DataRestart { .. }, Answer::Restarted(false)) => Next::Broke(Broke::Stall { phase: Phase::Data }),

gone-arm-deleted

--- a/kernel/src/drivers/xhci/wait/msc.rs
+++ b/kernel/src/drivers/xhci/wait/msc.rs
@@ -754,7 +754,6 @@
 fn completed(completion: Result<(u32, u32), Quiet>) -> bot::Answer<Quiet> {
     match completion {
         Ok((code, residue)) => bot::Answer::Moved { code, residue },
-        Err(Quiet::Gone) => bot::Answer::Gone,
         Err(why) => bot::Answer::Silent(why),
     }
 }

[Japabu]

Mutation patches at dc0863b

The patches behind this round's rows of the negative-control table in the description, exactly as applied. Each is one hunk against dc0863b11: git apply --check passes on it, git apply mutates the tree, and git apply -R restores it. h1, h2 are judged by cargo test -p toyos-xhci; j0 to j2 by cargo test --test toyos-checks metal_usb_judge; k1 builds in all six kernel clippy shapes, and its run is usb_transport_break, which must go red in Moved::AfterItsReset on is offline.

h1-holds-ignores-the-connect-change

diff --git a/toyos-xhci/src/ladder.rs b/toyos-xhci/src/ladder.rs
index dc9ddc936..f295d0269 100644
--- a/toyos-xhci/src/ladder.rs
+++ b/toyos-xhci/src/ladder.rs
@@ -198,7 +198,7 @@ pub const RESET_RECOVERY_NS: u64 = 50_000_000;
 /// no longer holds left: that is no break, no rung above reaches it, and its
 /// port's teardown owns what it held (§4.4).
 pub fn holds(port: Portsc) -> bool {
-    port.connected() && !port.connect_changed()
+    port.connected()
 }
 
 /// Whether a failed `step` ends [`Rung::PortReset`].

h2-holds-ignores-the-connection

diff --git a/toyos-xhci/src/ladder.rs b/toyos-xhci/src/ladder.rs
index dc9ddc936..a124096db 100644
--- a/toyos-xhci/src/ladder.rs
+++ b/toyos-xhci/src/ladder.rs
@@ -198,7 +198,7 @@ pub const RESET_RECOVERY_NS: u64 = 50_000_000;
 /// no longer holds left: that is no break, no rung above reaches it, and its
 /// port's teardown owns what it held (§4.4).
 pub fn holds(port: Portsc) -> bool {
-    port.connected() && !port.connect_changed()
+    !port.connect_changed()
 }
 
 /// Whether a failed `step` ends [`Rung::PortReset`].

j0-verdict-as-at-95ebbafdd

diff --git a/tests/common/usb.rs b/tests/common/usb.rs
index 1f98e47e7..45f4c1035 100644
--- a/tests/common/usb.rs
+++ b/tests/common/usb.rs
@@ -2156,25 +2156,25 @@ pub fn transport_break_recovered(kernel: &serial::Serial) -> Result<(), String>
         "transport broke on SCSI 0x2a: a staged break skipped the data phase wait; break 1 of ",
     )?;
     let under_test = broke_on(staged)?;
-    let entered = kernel.must_say_after(
-        staged,
-        &format!("usb-storage: {under_test} is owed the data of the command that broke"),
-    )?;
-    kernel.must_not_say(&format!("usb-storage: {under_test} is offline"))?;
-    kernel.must_not_say(" did not come back within ")?;
-    if let Ok(left) = kernel.must_say_after(entered, " after this driver reset it; it is held ") {
-        let back = kernel.must_say_after(left, " as the same device (USB ")?;
-        kernel.must_say_after(
-            back,
-            "is back, and the operation it was asked went out again on it: it completed",
-        )?;
+    if let Ok(left) = kernel.must_say(" after this driver reset it; it is held ") {
         eprintln!("  [usb] {left}");
+        let back = kernel.must_say(" as the same device (USB ")?;
         eprintln!("  [usb] {back}");
+        kernel.must_say("is back, and the operation it was asked went out again on it: it completed")?;
+        kernel.must_not_say(" did not come back within ")?;
         return Ok(());
     }
-    let took = kernel.must_say_after(entered, &format!("usb-storage: {under_test} the port reset took"))?;
-    kernel.must_say_after(took, &format!("usb-storage: {under_test} SCSI 0x2a completed after "))?;
+    let rungs = [
+        format!("usb-storage: {under_test} Reset Recovery took"),
+        format!("usb-storage: {under_test} the port reset took"),
+    ];
+    let took = rungs
+        .iter()
+        .find_map(|rung| kernel.must_say(rung).ok())
+        .ok_or_else(|| format!("neither {:?} nor {:?}: no rung verified", rungs[0], rungs[1]))?;
     eprintln!("  [usb] {took}");
+    kernel.must_say(&format!("usb-storage: {under_test} SCSI 0x2a completed after "))?;
+    kernel.must_not_say(&format!("usb-storage: {under_test} is offline"))?;
     Ok(())
 }
 

j1-verdict-lets-the-stick-go-offline

diff --git a/tests/common/usb.rs b/tests/common/usb.rs
index 1f98e47e7..dbc583377 100644
--- a/tests/common/usb.rs
+++ b/tests/common/usb.rs
@@ -2160,7 +2160,6 @@ pub fn transport_break_recovered(kernel: &serial::Serial) -> Result<(), String>
         staged,
         &format!("usb-storage: {under_test} is owed the data of the command that broke"),
     )?;
-    kernel.must_not_say(&format!("usb-storage: {under_test} is offline"))?;
     kernel.must_not_say(" did not come back within ")?;
     if let Ok(left) = kernel.must_say_after(entered, " after this driver reset it; it is held ") {
         let back = kernel.must_say_after(left, " as the same device (USB ")?;

j2-verdict-lets-the-class-reset-in

diff --git a/tests/common/usb.rs b/tests/common/usb.rs
index 1f98e47e7..4ecc1d192 100644
--- a/tests/common/usb.rs
+++ b/tests/common/usb.rs
@@ -2156,10 +2156,7 @@ pub fn transport_break_recovered(kernel: &serial::Serial) -> Result<(), String>
         "transport broke on SCSI 0x2a: a staged break skipped the data phase wait; break 1 of ",
     )?;
     let under_test = broke_on(staged)?;
-    let entered = kernel.must_say_after(
-        staged,
-        &format!("usb-storage: {under_test} is owed the data of the command that broke"),
-    )?;
+    let entered = staged;
     kernel.must_not_say(&format!("usb-storage: {under_test} is offline"))?;
     kernel.must_not_say(" did not come back within ")?;
     if let Ok(left) = kernel.must_say_after(entered, " after this driver reset it; it is held ") {

k1-climb-past-a-device-that-left

diff --git a/kernel/src/drivers/xhci/wait/msc.rs b/kernel/src/drivers/xhci/wait/msc.rs
index 9f29a8bbc..11ab6fbea 100644
--- a/kernel/src/drivers/xhci/wait/msc.rs
+++ b/kernel/src/drivers/xhci/wait/msc.rs
@@ -1134,15 +1134,6 @@ impl XhciController {
                 Climbed::Failed => None,
             };
             let ended = Unverified { rung, broke: out_of_step.as_ref() };
-            let port = self.read_portsc(dev.port_idx);
-            if !ladder::holds(port) {
-                log!("usb-storage: {slot} {ended}, and port {} no longer holds the device (PORTSC \
-                     {:#010x}): its port's teardown takes it from here",
-                    u32::from(dev.port_idx) + 1, port.raw());
-                dev.failed = true;
-                dev.left = true;
-                return false;
-            }
             log!("usb-storage: {slot} {ended}; break {} of {MAX_TRANSPORT_BREAKS} running",
                 dev.run.breaks().saturating_add(1));
             // After a step that was not answered the event is spent: the rung

[Japabu]

Review, round 3, at dc0863b

CI host SUCCESS at dc0863b (run 36713768883). git merge-tree --write-tree origin/main HEAD against origin/main deb8fa3 exits 0. The merge dc0863b resolved no conflict: --remerge-diff is empty.

Earlier BLOCKERs

• Round 2, no metal reading: CLOSED. The orchestrator ran the T14 at dc0863b with the redlist row lifted in a scratch copy (588r4-metal-transport-break.log): [metal] 1 passed, 0 failed, PASS usb_transport_break, EXIT 0.
  • The stick started on port 1 at speed 3. The log shows the port reset was not answered, and port 1 no longer holds the device (PORTSC 0x000202a0), then slot 1 disabled from the port's teardown, then disk 0 came back on port 13 slot 6 as the same device, then … went out again on it: it completed.
  • Neither break 2 nor is offline appears.
• The red reading at 95ebbaf: CLOSED.
  • Negative control k1 (the new climb arm deleted) exits 1: AfterItsReset: … slot 1 is offline … of a stick that came back as itself (588r4-k1.log).
  • Head, forced usb_transport_break: EXIT 0, with the AfterItsReset line (588r4-forced.log).
  • usb_ 10/10 and xhci_ 15/15: EXIT 0.
• Round 2 NOTEs and REMOVEs: CLOSED.
  • 95ebbaf imports CC_SUCCESS and CC_SHORT_PACKET from toyos_xhci::job and deletes the mod.rs copies.
  • m01–m23 are stated at dc0863b.
  • The three body lines are gone.

Growth, from git diff --shortstat origin/main...HEAD (+2130 −663):

• Production +627: toyos-xhci +877, kernel −250.
• Tests +835: toyos-xhci +707, harness +128.
• Issues +5.

This round (6211bb3e4..a2b229f4e, +268 −66): production +55, tests +140, issues +7. Accepted for a defect the T14 showed, less the exit that BLOCKER 2 folds.

BLOCKER

• kernel/src/drivers/xhci/wait/msc.rs:1138 — the claim "the climb asks it again whenever a rung ends unverified" is pinned only for a rung that ended Failed (usb-reset-moves-after, where Address Device is refused).
  • No test reaches this arm through a rung whose TEST UNIT READY broke (OutOfStep, e.g. Broke::Gone) on a port its device has left.
  • So - if !ladder::holds(port) { / + if out_of_step.is_none() && !ladder::holds(port) { passes every suite. It brings back main's is offline for a stick that leaves between the port rung's Configure Endpoint and its TEST UNIT READY.
  • Show this patch red in usb_transport_break: stage a leave at that point, and assert transport broke on the port reset's TEST UNIT READY: …, and port 1 no longer holds the device and no is offline.
• kernel/src/drivers/xhci/wait/msc.rs:1128-1145 — the new !ladder::holds arm repeats the Climbed::Gone arm six lines above it (dev.failed = true; dev.left = true; return false). That is two exits for one fact: the device left, and its port's teardown owns it.
  • Climbed::Gone comes only from the port rung's AfterReset::Left (msc.rs:1298).
  • Every AfterReset::Left also reads !holds at the climb's read: the port read empty, and only a new connect can make it read connected again, and a new connect raises CSC.
  • Fix, either way: AfterReset::Left ends the rung Failed and Climbed::Gone is deleted; or an unverified rung whose port no longer holds becomes Climbed::Gone before the match.

NOTE

• kernel/src/drivers/xhci/wait/msc.rs:1137 — judged sound: no transport failure on a port that still holds its device is read as a leave.
  • holds is the port machine's own teardown condition (kernel/src/drivers/xhci/mod.rs:1183). It is also main's Offline rung's refusal to reset (reset_port's here, msc.rs:1230).
  • Between the rung's end and that rung's read, nothing acknowledges CSC. So every reading this arm ends as a leave is one main already ended as Left, under an is offline line.
  • A port that reads connected with no change unconsumed still counts a break: abandoned_write_is_taken_offline for OutOfStep (green in the forced run), log_flush_retry for Failed.
• tests/common/volumes.rs:3047 — log_flush_retry is the only test of a Failed port rung on a port that still holds its device, which is the direction the new arm must not take. It is in neither usb_ nor xhci_ and has not run at dc0863b. The queued whole run must carry it green before landing.
• toyos-xhci/src/ladder.rs:200 — holds is a PORTSC predicate declared in the MSC ladder. kernel/src/drivers/xhci/mod.rs:982 (HID recovery) and :1183 (the port service) spell the same !connected() || connect_changed() inline. Declare it once on Portsc (toyos-xhci/src/portsc.rs) and read it at all four sites.
• toyos-xhci/src/ladder.rs:200 — a USB3 port whose device is present but untrained reads CAS with CCS 0 (xHCI 1.2 §5.4.8 bit 24, cleared by a warm reset), and so reads !holds.
  • Nothing in toyos-xhci names CAS or warm-resets such a port.
  • Such a stick is lost as having left, on main as here. File it.
• kernel/src/drivers/xhci/wait/msc.rs:1138 — the arm also ends a Rung::ClassReset whose device left, and skips main's port-rung quiesce.
  • if rung == Rung::PortReset && !ladder::holds(port) passes every suite. The outcome equals main's: quiesce, then reset_port reads the port empty, then Climbed::Gone.
  • The body's "a class rung whose device left no longer goes on to the port rung's quiesce" has no test.
• kernel/src/drivers/xhci/wait/msc.rs:1236-1242, 1273-1279 — two copies of one staging (log the held line, cue, wait for the port to read empty) that differ only in the line. Make one helper that takes HELD or HELD_AFTER.
• tests/common/usb.rs:2164 — no case in metal_usb_judge needs must_not_say(" did not come back within "): "a stick that never came back" is refused first, by its missing same-device line. Either add a case where the write completed on the returned stick and a later did not come back within follows, or delete the line.
• PR body, Metal and the k1 row — the head's readings exist, but the body says "owed" and "must go red". Main's record carries each with its command, exit and log:
  • T14 PASS with the new line and no is offline.
  • k1 EXIT 1.
  • Forced usb_transport_break EXIT 0.
• src/redlist.rs:97 — the row stays in this PR:
  • Its issue (expected-red: a held call's CPU and the bind) is untouched by this diff.
  • Three more open issues name other red modes of this test.
  • One forced green per instrument measures no rate.

REMOVE

• PR body, Metal: "The reading at this head is owed." — false: the T14 has read dc0863b.
• PR body, Metal: "That run's harness also failed the verdict for finding no kernel output in the readback; Metal judges read the channel their line crosses on #616, merged here, reads that channel." — a harness story, not this merge's record.
• PR body, "## Unsure" — review-time text, removed in round 1 as "What I am unsure of". Its open question belongs in the SuperSpeed issue.
• tests/checks/usb.rs:6-8 — "as the ladder told it when it climbed on past the stick that had left, … and as it tells it now" — chronology in source; the cases' own names say which log is refused.
• issues/kernel/a-disk-taken-offline-is-never-brought-back.md:24 — ", the T14 has not yet" — false: the T14 at dc0863b bound disk 0 back on port 13 as the same device.

SEND BACK

[Japabu]

Mutation patches at 63a2a04

Each is applied with git apply from the repository root. Results are in the PR body's negative-control table.

unredlist-transport-break

--- a/src/redlist.rs	2026-09-30 16:38:17
+++ b/src/redlist.rs	2026-09-30 16:38:31
@@ -84,10 +84,6 @@
     Disabled {
         test: "syscall_window_nmi",
         issue: "issues/kernel/syscall-window-nmi-shortfalls-on-a-contended-host.md",
-    },
-    Disabled {
-        test: "usb_transport_break",
-        issue: "issues/kernel/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md",
     },
     Disabled {
         test: "user_copy_races_munmap",

n1-a-broken-test-unit-ready-climbs-on-past-a-device-that-left

--- a/kernel/src/drivers/xhci/wait/msc.rs	2026-09-30 16:38:17
+++ b/kernel/src/drivers/xhci/wait/msc.rs	2026-09-30 16:38:31
@@ -1128,7 +1128,7 @@
             // disconnect while it drives a reset (xHCI 1.2 §4.19.1.1.2, note
             // 57) and reads Enabled once the reset ends (§4.19.1.1.4).
             let port = self.read_portsc(dev.port_idx);
-            if !port.holds() {
+            if out_of_step.is_none() && !port.holds() {
                 log!("usb-storage: {slot} {ended}, and port {} no longer holds the device (PORTSC \
                      {:#010x}): its port's teardown takes it from here",
                     u32::from(dev.port_idx) + 1, port.raw());
--- a/src/redlist.rs	2026-09-30 16:38:17
+++ b/src/redlist.rs	2026-09-30 16:38:31
@@ -84,10 +84,6 @@
     Disabled {
         test: "syscall_window_nmi",
         issue: "issues/kernel/syscall-window-nmi-shortfalls-on-a-contended-host.md",
-    },
-    Disabled {
-        test: "usb_transport_break",
-        issue: "issues/kernel/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md",
     },
     Disabled {
         test: "user_copy_races_munmap",

c1-only-the-port-rung-asks-whether-its-device-left

--- a/kernel/src/drivers/xhci/wait/msc.rs	2026-09-30 16:38:17
+++ b/kernel/src/drivers/xhci/wait/msc.rs	2026-09-30 16:38:31
@@ -1128,7 +1128,7 @@
             // disconnect while it drives a reset (xHCI 1.2 §4.19.1.1.2, note
             // 57) and reads Enabled once the reset ends (§4.19.1.1.4).
             let port = self.read_portsc(dev.port_idx);
-            if !port.holds() {
+            if rung == Rung::PortReset && !port.holds() {
                 log!("usb-storage: {slot} {ended}, and port {} no longer holds the device (PORTSC \
                      {:#010x}): its port's teardown takes it from here",
                     u32::from(dev.port_idx) + 1, port.raw());

h1-holds-ignores-the-connect-change

--- a/toyos-xhci/src/portsc.rs	2026-09-30 16:38:17
+++ b/toyos-xhci/src/portsc.rs	2026-09-30 16:38:31
@@ -115,7 +115,7 @@
     /// replugged between two looks reads connected again, and only CSC says
     /// the one that was here has gone.
     pub const fn holds(self) -> bool {
-        self.connected() && !self.connect_changed()
+        self.connected()
     }
 
     /// Whether reset signalling is still on the wire.

h2-holds-ignores-the-connection

--- a/toyos-xhci/src/portsc.rs	2026-09-30 16:38:17
+++ b/toyos-xhci/src/portsc.rs	2026-09-30 16:38:31
@@ -115,7 +115,7 @@
     /// replugged between two looks reads connected again, and only CSC says
     /// the one that was here has gone.
     pub const fn holds(self) -> bool {
-        self.connected() && !self.connect_changed()
+        !self.connect_changed()
     }
 
     /// Whether reset signalling is still on the wire.

j0-verdict-as-at-95ebbafdd

--- a/tests/common/usb.rs	2026-09-30 16:38:17
+++ b/tests/common/usb.rs	2026-09-30 16:38:45
@@ -2192,24 +2192,25 @@
         "transport broke on SCSI 0x2a: a staged break skipped the data phase wait; break 1 of ",
     )?;
     let under_test = broke_on(staged)?;
-    let entered = kernel.must_say_after(
-        staged,
-        &format!("usb-storage: {under_test} is owed the data of the command that broke"),
-    )?;
-    kernel.must_not_say(&format!("usb-storage: {under_test} is offline"))?;
-    if let Ok(left) = kernel.must_say_after(entered, " after this driver reset it; it is held ") {
-        let back = kernel.must_say_after(left, " as the same device (USB ")?;
-        kernel.must_say_after(
-            back,
-            "is back, and the operation it was asked went out again on it: it completed",
-        )?;
+    if let Ok(left) = kernel.must_say(" after this driver reset it; it is held ") {
         eprintln!("  [usb] {left}");
+        let back = kernel.must_say(" as the same device (USB ")?;
         eprintln!("  [usb] {back}");
+        kernel.must_say("is back, and the operation it was asked went out again on it: it completed")?;
+        kernel.must_not_say(" did not come back within ")?;
         return Ok(());
     }
-    let took = kernel.must_say_after(entered, &format!("usb-storage: {under_test} the port reset took"))?;
-    kernel.must_say_after(took, &format!("usb-storage: {under_test} SCSI 0x2a completed after "))?;
+    let rungs = [
+        format!("usb-storage: {under_test} Reset Recovery took"),
+        format!("usb-storage: {under_test} the port reset took"),
+    ];
+    let took = rungs
+        .iter()
+        .find_map(|rung| kernel.must_say(rung).ok())
+        .ok_or_else(|| format!("neither {:?} nor {:?}: no rung verified", rungs[0], rungs[1]))?;
     eprintln!("  [usb] {took}");
+    kernel.must_say(&format!("usb-storage: {under_test} SCSI 0x2a completed after "))?;
+    kernel.must_not_say(&format!("usb-storage: {under_test} is offline"))?;
     Ok(())
 }
 

j1-verdict-lets-the-stick-go-offline

--- a/tests/common/usb.rs	2026-09-30 16:38:17
+++ b/tests/common/usb.rs	2026-09-30 16:38:31
@@ -2196,7 +2196,6 @@
         staged,
         &format!("usb-storage: {under_test} is owed the data of the command that broke"),
     )?;
-    kernel.must_not_say(&format!("usb-storage: {under_test} is offline"))?;
     if let Ok(left) = kernel.must_say_after(entered, " after this driver reset it; it is held ") {
         let back = kernel.must_say_after(left, " as the same device (USB ")?;
         kernel.must_say_after(

j2-verdict-lets-the-class-reset-in

--- a/tests/common/usb.rs	2026-09-30 16:38:17
+++ b/tests/common/usb.rs	2026-09-30 16:38:31
@@ -2192,10 +2192,7 @@
         "transport broke on SCSI 0x2a: a staged break skipped the data phase wait; break 1 of ",
     )?;
     let under_test = broke_on(staged)?;
-    let entered = kernel.must_say_after(
-        staged,
-        &format!("usb-storage: {under_test} is owed the data of the command that broke"),
-    )?;
+    let entered = staged;
     kernel.must_not_say(&format!("usb-storage: {under_test} is offline"))?;
     if let Ok(left) = kernel.must_say_after(entered, " after this driver reset it; it is held ") {
         let back = kernel.must_say_after(left, " as the same device (USB ")?;

[Japabu]

Orchestrator runs at 63a2a04 (cargo test --test toyos-build -- <args>; logs orch/logs/588r5-*.log):

job	args	patch	exit
n1 narrowing (the review's out_of_step.is_none() && !holds)	usb_transport_break	n1-a-broken-test-unit-ready-climbs-on-past-a-device-that-left.patch + redlist row lifted	1 — BeforeItsTestUnitReady: "... slot 1 is offline ..." of a stick that came back as itself
forced	usb_transport_break	unredlist-transport-break.patch	0
whole	(none)	—	0 — 498 passed, 498 total
T14 forced	--metal usb_transport_break	unredlist-transport-break.patch	0 — the port reset was not answered, and port 1 no longer holds the device (PORTSC 0x000202a0): its port's teardown takes it from here, then PASS usb_transport_break

CI host at 63a2a04: success.

[Japabu]

Review at 63a2a04 (round 5)

CI host SUCCESS at 63a2a04 (run 36732205365). The orchestrator's runs at 63a2a04 are in issuecomment-5914619271:

• n1: EXIT 1.
• usb_transport_break, forced: EXIT 0.
• The whole suite: EXIT 0, 498/498.
• The T14, forced: EXIT 0.

The merges fef8cfd and 63a2a04 resolved nothing (--remerge-diff is empty). None of #536's hunks in this branch's files touches the ladder. git merge-tree --write-tree origin/main HEAD against 3c24b6e exits 1 (NOTE).

Earlier BLOCKERs (the review at dc0863b)

• msc.rs:1138, no staged leave for a rung whose TEST UNIT READY broke: CLOSED.
  • usb-reset-moves-configured stages it.
  • n1 (out_of_step.is_none() && !port.holds()), with the row lifted, exits 1: BeforeItsTestUnitReady: "… slot 1 is offline …" of a stick that came back as itself.
  • The head, forced, exits 0.
• msc.rs:1128-1145, two exits for one fact: CLOSED.
  • Climbed::Gone is deleted, and AfterReset::Left now ends the rung Failed (msc.rs:1297).
  • Every usb-reset-moves boot reaches the one read, and the forced run exits 0 with all of them.
  • The T14 exits 0 with the no longer holds the device line.
• The NOTE on log_flush_retry: met by the 498/498 run.

Growth

From git diff --shortstat origin/main...HEAD (+2222 −701):

• Production +1268 −648: toyos-xhci +869; kernel +399 −648.
• Tests +900 −37: toyos-xhci +707; harness +193 −37.
• Issues +54 −16.

This round (fef8cfdb7..1aa3a1b81, +149 −95): production +60 −67, tests +53 −25, issues +36 −3. Accepted.

BLOCKER

• tests/common/usb.rs:1521-1523, src/redlist.rs:89, kernel/src/actuator.rs:141-152 — the fix has no test that any gate runs, and The redlist and the recorded durations go: a red test is fixed or deleted with its issue, a flaky test is deleted at once, and shards deal the task list in turn #639 removes the only test it has.
  • The climb's arm (msc.rs:1131) and the fold (msc.rs:1297) are judged only by usb_transport_break. That test is redlisted at this head, and The redlist and the recorded durations go: a red test is fixed or deleted with its issue, a flaky test is deleted at once, and shards deal the task list in turn #639 deletes it with its QEMU and T14 rows.
  • The redlist and the recorded durations go: a red test is fixed or deleted with its issue, a flaky test is deleted at once, and shards deal the task list in turn #639's review also deletes usb-reset-moves, -after and -configured. transport_break_recovered and metal_usb_judge are then left judging nothing.
  • Whichever PR lands first, main ends up with the arm and with nothing that k1 or n1 turns red. In a device driver, that is an untested claim.
  • As it stands, the refactor and Portsc::holds are worth landing, because they stand on host tests that The redlist and the recorded durations go: a red test is fixed or deleted with its issue, a flaky test is deleted at once, and shards deal the task list in turn #639 leaves alone. The fix's test and its actuators are not worth landing: the next landing deletes them.
  • What changes:
    • The fix's boots (Moved::SameStick, AfterItsReset, BeforeItsTestUnitReady) and the T14 row judged by transport_break_on_metal move into a test of their own, with no redlist row.
    • That test is shown green at a rate under QEMU and on the T14, and red at this head under k1 and n1. A forced green is not a rate.
  • If the held-disk red modes (a-held-disk-waits-…, a-shutdown-on-a-held-usb-disk-…) reach those boots:
    • Stage the leave on a data stick that the host removes and does not plug back, so no call waits on a return.
    • Judge the leave line, no is offline, no break 2, and the teardown's slot N disabled.
  • If neither can be made green, these leave this PR: the arm, the fold, the two new holds, their Moved shapes and the verdict change. The refactor lands alone, and an issue records main's is offline for a stick that left.
• kernel/src/drivers/xhci/wait/msc.rs:1297 — this patch passes every suite:

  -                PortStep::Reset => self.reset_port(dev, RECOVERING) == AfterReset::Enumerate,
  +                PortStep::Reset => matches!(self.reset_port(dev, RECOVERING), AfterReset::Enumerate | AfterReset::Left),

  • With it, a reset that read the port empty goes on to Settle, Reset Device and Address Device on the empty port.
  • QEMU answers that Address Device with TRB Error, as the body cites for -after. The rung ends Failed, and the same leave line follows.
  • No Moved verdict refuses Reset Device failed or Address Device (after the port reset), and must_be_clean reads neither. So no test backs the body's "Nothing changes on the wire" for the fold.
  • Fix: the usb-reset-moves boot of the test above refuses both lines between the held reset and the leave line, and goes red under this patch. If the fix leaves this PR, this goes with it.

NOTE

• tests/checks.rs — conflicts with main at 3c24b6e (Metal timings are recorded per machine and judged against that machine's own record #630): merge-tree exits 1.
  • Metal timings are recorded per machine and judged against that machine's own record #630 adds metal_checks and its tests beside usb_checks and metal_usb_judge, and deletes the doc line and a_cleared_page_owes_no_fact_off_it next to them.
  • The merge keeps both sides' hunks, and CI runs again at the new head.
• PR body — n1's EXIT 1, the forced EXIT 0, the 498/498 run and the T14's EXIT 0 are in a comment, not in the body. The body's gates carry each one with its command, exit and log (588r5-*.log).
• msc.rs:1044, :1131, :2089-2102 — "the device left" has two exits: the Broke::Gone arm in scsi(), and the climb's read after a rung.
  • bring_up sends a Gone TEST UNIT READY into the climb, which then aims a class reset at the empty port before it reads.
  • Reading holds once, at the climb's entry and after each rung, makes that one exit.
  • Main has this too, and it is outside this round.
• msc.rs:1131 — c1 (rung == Rung::PortReset && !port.holds()) still passes every suite, as at dc0863b. Its outcome is main's.
• msc.rs:1096-1147 — the leave decision is kernel code.
  • Made an answer of toyos_xhci::ladder::Run, n1 and c1 become crate mutations that cargo test -p toyos-xhci turns red. That test outlives any guest test.
  • Only the port read would stay for a guest test to judge.

REMOVE

• issues/hardware/the-t14s-superspeed-stick-enumerates-at-high-speed-under-toyos.md:42-43 — ", which nobody here has read" — not load-bearing.
• tests/toyos.rs:1858-1861 — "comes back from the class's Reset Recovery on the machine's own controller" — false: the verdict this branch wrote for that row refuses a class reset on this break (j2).
• PR body, Gates — "The guest runs at 63a2a04 are requested from the orchestrator: …" — stale.
• PR body, the n1 row — "requested: usb_transport_break must exit 1 …" — stale.
• PR body, Metal — "and its T14 run is requested" — stale.
• PR body, the c1 row — "and the review read it green on every suite" — false: a review runs nothing.

SEND BACK

[Japabu]

Mutation patches at 989aec4

Each applies with git apply at 989aec4 (git apply --check 0). Results are in the pull request body.

n1-an-out-of-step-rung-on-an-empty-port-climbs-on

--- a/toyos-xhci/src/ladder.rs
+++ b/toyos-xhci/src/ladder.rs
@@ -150,7 +150,7 @@
     /// the device: its port's teardown owns what it held. Otherwise the rung
     /// is the next break.
     pub fn unverified<W>(&mut self, ended: &Unverified<W>, holds: bool) -> AfterRung {
-        if !holds {
+        if !holds && matches!(ended, Unverified::Failed) {
             return AfterRung::Left;
         }
         // After a step that was not answered the event is spent: the rung has

c1-only-a-port-rung-asks-whether-its-device-left

--- a/toyos-xhci/src/ladder.rs
+++ b/toyos-xhci/src/ladder.rs
@@ -150,7 +150,7 @@
     /// the device: its port's teardown owns what it held. Otherwise the rung
     /// is the next break.
     pub fn unverified<W>(&mut self, ended: &Unverified<W>, holds: bool) -> AfterRung {
-        if !holds {
+        if !holds && self.climbed == Some(Rung::PortReset) {
             return AfterRung::Left;
         }
         // After a step that was not answered the event is spent: the rung has

k1-no-rung-ends-as-its-device-leaving

--- a/toyos-xhci/src/ladder.rs
+++ b/toyos-xhci/src/ladder.rs
@@ -149,10 +149,7 @@
     /// however the rung ended.** That is no break, and no rung above reaches
     /// the device: its port's teardown owns what it held. Otherwise the rung
     /// is the next break.
-    pub fn unverified<W>(&mut self, ended: &Unverified<W>, holds: bool) -> AfterRung {
-        if !holds {
-            return AfterRung::Left;
-        }
+    pub fn unverified<W>(&mut self, ended: &Unverified<W>, _holds: bool) -> AfterRung {
         // After a step that was not answered the event is spent: the rung has
         // commanded the pair since, and only the fields speak for it now.
         let broke = match ended {

b2c-a-reset-that-read-the-port-empty-goes-on

--- a/toyos-xhci/src/ladder.rs
+++ b/toyos-xhci/src/ladder.rs
@@ -262,7 +262,7 @@
     /// was enumerated as, on its port. Any other reading ends the rung, and
     /// nothing is sent to a port that reads empty.
     pub fn goes_on(self) -> bool {
-        self == Self::Enumerate
+        matches!(self, Self::Enumerate | Self::Left)
     }
 }
 

b2k-the-kernel-folds-an-empty-port-into-a-reset-that-took

--- a/kernel/src/drivers/xhci/wait/msc.rs
+++ b/kernel/src/drivers/xhci/wait/msc.rs
@@ -1275,7 +1275,7 @@
                     self.quiesce_bulk_pair(dev, broke, "stopping it before its port is reset")
                 }
                 // `reset_port` has said which way it did not.
-                PortStep::Reset => self.reset_port(dev, RECOVERING).goes_on(),
+                PortStep::Reset => matches!(self.reset_port(dev, RECOVERING), AfterReset::Enumerate | AfterReset::Left),
                 PortStep::Settle => {
                     let _ = crate::clock::settles(
                         self.after_break

m16-run-over-keeps-its-rung

--- a/toyos-xhci/src/ladder.rs
+++ b/toyos-xhci/src/ladder.rs
@@ -138,7 +138,9 @@
 
     /// A round trip completed: the run is over. How many breaks it held.
     pub fn over(&mut self) -> u8 {
-        core::mem::replace(self, Self::NONE).breaks
+        let breaks = self.breaks;
+        self.breaks = 0;
+        breaks
     }
 
     /// The rung this run last climbed ended `ended`, below [`Rung::Offline`],

[Japabu]

Orchestrator runs at 989aec4 (logs orch/logs/588r6-*.log):

job	args	patch	exit	line
stick left, run 1	usb_stick_left	—	0	PASS usb_stick_left (15s)
stick left, run 2	usb_stick_left	—	0
stick left, run 3	usb_stick_left	—	0
kernel-side B2 fold	usb_stick_left	b2k-the-kernel-folds-an-empty-port-into-a-reset-that-took.patch	1	FAIL usb_stick_left: BeforeItsCompletion: "[kernel 0.324 cpu0] xHCI: Address Device (after the port reset) failed: code 5 (TRB Error)" between the hold and the leave
whole	(none)	—	0	test result: ok. 499 passed, 499 total (313.4s)
T14	--metal usb_stick_left	record rows for boot.testcases	0	PASS usb_stick_left

The T14 run also recorded three new rows for the usbbreak boot (boot.usbbreak.{complete_ms,panel_max_us,panel_us} = 1160 / 3905 / 21851). They are not committed; the orchestrator holds them.

[Japabu]

Review at 989aec4 (round 6, final)

CI host SUCCESS at 989aec4 (run 36772779867, pull_request, head 989aec4).

The orchestrator's runs at 989aec4 are in issuecomment-5919300334 (588r6-*.log):

• usb_stick_left: EXIT 0, three times.
• usb_stick_left with b2k applied: EXIT 1, BeforeItsCompletion: "… Address Device (after the port reset) failed: code 5 (TRB Error)" between the hold and the leave.
• The whole suite: EXIT 0, 499/499.
• --metal usb_stick_left on the T14: EXIT 0.

Crate controls, from the PR body: n1, c1, k1 and b2c each give cargo test -p toyos-xhci EXIT 101.

Merges: git merge-tree --write-tree origin/main HEAD against 649ea51 exits 0. The --remerge-diff of 92760ab keeps both sides' hunks in tests/checks.rs.

Earlier BLOCKERs (round 5, at 63a2a04)

• The fix had no test any gate runs, and The redlist and the recorded durations go: a red test is fixed or deleted with its issue, a flaky test is deleted at once, and shards deal the task list in turn #639 removed the only one it had: CLOSED.
  • toyos-xhci/src/ladder.rs:367 goes red under n1, c1 and k1 (EXIT 101 each). It runs in the required host check, and The redlist and the recorded durations go: a red test is fixed or deleted with its issue, a flaky test is deleted at once, and shards deal the task list in turn #639 touches nothing under toyos-xhci/.
  • The kernel side is judged by usb_stick_left. It has no redlist row, is green 3 of 3 plus the 499/499 run, and is green on the T14.
• msc.rs:1297, where B2's fold passed every suite: CLOSED. b2k at msc.rs:1278 turns usb_stick_left red (EXIT 1, the line above), and b2c turns the crate test red (EXIT 101).

Growth

Measured with git diff --shortstat origin/main...HEAD against base 3c24b6e: +2443 −720 in total.

part	whole branch	this round (989aec4)
production	+1323 −671 (toyos-xhci +920, kernel +403 −671)	+105 −73
tests	+1040 −33 (toyos-xhci +759, harness +281 −33)	+217 −73
issues	+80 −16	+28 −2

Accepted. This round's 32 net production lines move the leave decision into the crate, where a host test can turn red on it.

BLOCKER

None open.

NOTE

• Named change. tests/metal/lenovo-20w0003amz.toml: commit the three boot.usbbreak.* rows (1160 / 3905 / 21851) here, and only those rows, not the boot.testcases rows the T14 run carried as a patch.
  • They belong in this PR: on main the redlist keeps the usbbreak boot from running, and this PR is what runs it.
  • They come from a passing boot at this head, and src/metaltimings.rs has a run's new rows committed by whoever ran it.
  • The change is data only. every_committed_record_loads_from_its_own_path in host reads the file.
• Named change. PR body, Gates: add the 989aec4 guest runs, each with its command, exit and log.
  • They are the three usb_stick_left EXIT 0, b2k EXIT 1 with its line, the whole suite at 499/499, and the T14 at EXIT 0.
  • Today they are only in issuecomment-5919300334, and the body becomes main's record.
• Landing ahead of The redlist and the recorded durations go: a red test is fixed or deleted with its issue, a flaky test is deleted at once, and shards deal the task list in turn #639: yes.
  • The decision's test is in toyos-xhci, and usb_stick_left is not a name The redlist and the recorded durations go: a red test is fixed or deleted with its issue, a flaky test is deleted at once, and shards deal the task list in turn #639 deletes.
  • But The redlist and the recorded durations go: a red test is fixed or deleted with its issue, a flaky test is deleted at once, and shards deal the task list in turn #639's diff deletes what usb_stick_left arms:
    • the actuators usb-transport-break, usb-reset-moves, -after and -configured (actuator.rs:125/141/146/152);
    • msc::transport_break (msc.rs:300) and msc::reset_moves (msc.rs:535);
    • transport_break_on_metal and transport_break_recovered;
    • the usbbreak metal row (tests/toyos.rs:1858).
  • Its merge of main conflicts on those hunks and has to keep them. Only a guest run shows it if it does not; host stays green.
• kernel/src/drivers/xhci/wait/msc.rs:1118: deleting dev.left = true; from the AfterRung::Left arm passes usb_stick_left.
  • Why: the teardown's release_blocks holds the disk anyway ("its port disconnected"). Only the T14 row goes red, and only when the stick leaves and comes back.
  • Fix: at tests/common/usb.rs:2249, kernel.must_say_after(left, &format!("left port {port} (its port read empty) after this driver reset it")). Show it red under that deletion.
  • Taking this needs a new guest run.
• msc.rs:1112: port.holds() → port.connected() would, I expect, pass every suite.
  • Why: device_del clears CCS, so no staging reads a port that is connected again with its CSC unconsumed. That is the half of holds that "Every AfterReset::Left reads !holds there" relies on.
  • It is tracked: issues/kernel/a-device-swapped-into-its-port-inside-the-port-rungs-reset-is-taken-for-the-disk-it-replaced.md owns the staging.
  • Not measured: the guest arm's whole-fix revert, port.holds() → true. I expect it to go red on is offline.
• msc.rs:766: the disconnect seam has one guest control, gone-arm-deleted, and it runs in usb_transport_break. That test is redlisted, and The redlist and the recorded durations go: a red test is fixed or deleted with its issue, a flaky test is deleted at once, and shards deal the task list in turn #639 deletes it.
  • usb_stick_left's -configured boot passes through this arm, but its lines are identical under the mutation: Told prints Silence { why: Quiet::Gone } as it prints Gone, and the climb's port read ends it as a leave either way.
  • main's Silence { why: Quiet::Gone } arm has the same single, disabled check.
  • For The redlist and the recorded durations go: a red test is fixed or deleted with its issue, a flaky test is deleted at once, and shards deal the task list in turn #639's brief: move the usb-port-gone staging into a test that runs, or record the gap.
• T14 at 989aec4: the comment shows PASS, but not which branch of transport_break_recovered passed (its [usb] line). Only 63a2a04's run shows the leave line. The body names the shape.

REMOVE

• PR body, Gates: "Requested from the orchestrator at 989aec4 (orch/588r6/jobs.txt): …". Stale.
• PR body, the b2k row: "requested: usb_stick_left must exit 1 …". Stale.
• PR body, "What I am unsure of", first bullet ("usb_stick_left has not booted …"). Stale: it booted.
• PR body, "What I am unsure of", third bullet ("… the guest runs requested for this head have to show"). Stale.
• PR body: the n1, forced and whole rows of the 63a2a04 table, and the "At dc0863b … k1" line.
  • They measure a decision that was then inline in the kernel, and usb_transport_break boots this head no longer has.
  • The T14 row stays.

LAND AFTER NAMED CHANGES