diff --git a/issues/audio/hda-client-stall-reads-one-resume-where-its-judge-wants-two.md b/issues/audio/hda-client-stall-reads-one-resume-where-its-judge-wants-two.md
new file mode 100644
index 00000000000..01804c4d582
--- /dev/null
+++ b/issues/audio/hda-client-stall-reads-one-resume-where-its-judge-wants-two.md
@@ -0,0 +1,50 @@
+---
+status: open
+kind: defect
+opened: 2026-09-29
+---
+
+# `hda_client_stall` reads one resume on the T14 where its judge wants two
+
+The T14 run of `wt/toyos-metaljudges` at `6737a442` reds the row with:
+
+```
+FAIL hda_client_stall: soundd resumed 0 time(s) — the second stream did not find a suspended daemon, so nothing here tests a resume:
+```
+
+The job itself exits 0 and prints `stalled 8 then 2 times, soundd survived`.
+Its cause is not measured; whether the judge or soundd is wrong is open.
+
+## Measured
+
+The `testcases` boot's log, from the job's spawn to its end, in order:
+
+```
+{… 6.275 soundd} soundd: client 0 removed (closed)
+[… 6.276 cpu6] spawn: /system/bin/test_rs_hda_client_stall pid=9 …
+{… 6.276 soundd} soundd: wakes=662 … clients=0 …
+{… 6.333 tid=1 soundd} soundd: opening stream: 44100Hz 2ch fmt=0
+{… 6.333 soundd} soundd: client 0 connected (id=1)
+{… 8.565 soundd} soundd: client 1 removed (closed)
+{… 8.565 soundd} soundd: wakes=126 … clients=0 …
+{… 8.585 soundd} soundd: suspended
+{… 8.836 tid=1 soundd} soundd: opening stream: 44100Hz 2ch fmt=0
+{… 8.836 soundd} soundd: client 0 connected (id=2)
+{… 8.836 soundd} soundd: resumed
+{… 9.755 soundd} soundd: wakes=480 … clients=0 …
+{… 9.780 soundd} soundd: suspended
+```
+
+- The window `tests/common/audio.rs`'s `job_window` cut for two sessions ends
+  at the `8.565` stats line: the `clients=0` stats line at `6.276`, after the
+  spawn and before the first stream opens, is counted as the first session's
+  end. The printed window carries no `soundd: resumed`.
+- Across the job's whole span the log carries one `soundd: resumed`, at the
+  second stream. The first stream opens with no `soundd: suspended` between
+  the previous client's removal at `6.275` and its open at `6.333`, so
+  `client_stall_on_metal`'s `resumes < 2` reds on that span too.
+
+## Exit condition
+
+`hda_client_stall` PASS on the orchestrator's T14 run of the head that lands
+the fix, and this file is deleted.
diff --git a/issues/audio/hda-tone-reads-underruns-on-the-t14-where-its-judge-wants-none.md b/issues/audio/hda-tone-reads-underruns-on-the-t14-where-its-judge-wants-none.md
new file mode 100644
index 00000000000..662d835b131
--- /dev/null
+++ b/issues/audio/hda-tone-reads-underruns-on-the-t14-where-its-judge-wants-none.md
@@ -0,0 +1,50 @@
+---
+status: open
+kind: defect
+opened: 2026-09-29
+---
+
+# `hda_tone` reads underruns on the T14 where its judge wants none
+
+The T14 run of `wt/toyos-metaljudges` at `f5c80264f` reds the row with:
+
+```
+FAIL hda_tone: soundd filled 104 period(s) the tone client had not covered, on a client that keeps its ring full:
+```
+
+The job itself exits 0 and prints `tone done`. Its cause is not measured;
+whether the judge or soundd is wrong is open.
+
+The T14 run of `main` at `7e151819` reddened the row earlier, on `the
+testcases's log carried no kernel output at all`.
+
+## Measured
+
+The `testcases` boot's log over the window the judge printed, selected lines in
+order:
+
+```
+{… 3.021 tid=1 soundd} soundd: opening stream: 44100Hz 2ch fmt=0
+{… 3.021 soundd} soundd: client 0 connected (id=0)
+{… 3.021 soundd} soundd: resumed
+{… 5.024 soundd} soundd: wakes=984 completions=689 submitted=697 underruns=0 drains=0 … clients=1 …
+[… 6.252 cpu0 tid=1] exit: test_rs_audio_tone tid=1 code=0 cpu=12ms (after 48 like it suppressed)
+{… 6.252 pid=8 test-runner} tone done
+{… 6.252 test-runner} ===TEST_END test_rs_audio_tone exit=0===
+{… 6.252 test-runner} ===TEST_START test_rs_hda_client_stall===
+[… 6.253 cpu7] spawn: /system/bin/test_rs_hda_client_stall pid=9 …
+{… 6.254 tid=1 soundd} soundd: opening stream: 44100Hz 2ch fmt=0
+{… 6.254 soundd} soundd: client 1 connected (id=1)
+{… 6.258 soundd} soundd: client 0 removed (closed)
+{… 7.024 soundd} soundd: wakes=989 completions=688 submitted=688 underruns=39 drains=0 … clients=1 …
+{… 8.412 soundd} soundd: client 1 removed (closed)
+{… 8.418 soundd} soundd: wakes=741 completions=479 submitted=479 underruns=65 drains=0 … clients=0 …
+```
+
+The printed window carries three stats lines, with `underruns=0`, `underruns=39`
+and `underruns=65`, which sum to the 104 the row names.
+
+## Exit condition
+
+`hda_tone` PASS on the orchestrator's T14 run of the head that lands the fix,
+and this file is deleted.
diff --git a/issues/build/a-metal-judge-reads-the-log-file-for-a-record-written-after-it-was-made-whole.md b/issues/build/a-metal-judge-reads-the-log-file-for-a-record-written-after-it-was-made-whole.md
deleted file mode 100644
index 4639c7e91e0..00000000000
--- a/issues/build/a-metal-judge-reads-the-log-file-for-a-record-written-after-it-was-made-whole.md
+++ /dev/null
@@ -1,47 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-29
----
-
-# A metal judge reads the log file for a record the kernel writes after init made the file whole
-
-On the T14 a boot's `/log` file ends where init had `logd` make it whole
-(`Readback::log_reached_the_stick`, `tests/common/metal.rs`). What the kernel
-writes after that — `Rebooting.`, and every line an actuator staged inside the
-stop prints — reaches only the black-box page, and comes back in the next
-loader pass's `loader.log` under `| log-tail:` or the page's ring. Three
-judges still ask `Readback::kernel()` for such a record:
-
-- `machine_reboot` — `b[0].kernel().must_say(bootlog::REBOOTING)`;
-- `log_poll_outlives_a_close` — the same line at the end of
-  `log_close_survived` (`tests/toyos.rs`);
-- `usb_reset_records_the_phase_it_cut` — `power::usb_load_chain`'s
-  `kernel.must_say(bootlog::USB_LOAD_RUNNING)`.
-
-## Measured
-
-The full T14 run of `main` at `7e151819`
-(EXIT=1):
-
-```
-FAIL log_poll_outlives_a_close: "Rebooting." never reached the testcases's kernel log:
-FAIL usb_reset_records_the_phase_it_cut: "usb-load: sweeping disk 0" never reached the usbload's kernel log:
-FAIL machine_reboot: "Rebooting." never reached the jobcase's kernel log:
-```
-
-Each record is on the page, in each boot's `loader.log`:
-
-```
-testcases/loader.log:53:| log-tail: [12.838 cpu0] Rebooting.
-jobcase/loader.log:52:| log-tail: [1.516 cpu0] Rebooting.
-usbload/loader.log:77:| [1.526 cpu0] usb-load: sweeping disk 0 from block 6569336 to 7507812, rewriting each run with the bytes just read from it, until this machine is reset out from under it
-```
-
-and in no `kernel.log` of the three. Every other assertion these judges make
-before the refused one passed.
-
-## Exit condition
-
-The three judges read each post-flush record off the pass after the reset,
-and a T14 run of the three names reaches their verdicts; then this file is deleted.
diff --git a/issues/build/a-metal-only-row-cannot-be-disabled.md b/issues/build/a-metal-only-row-cannot-be-disabled.md
index f45d44f82db..8e7e5939ccc 100644
--- a/issues/build/a-metal-only-row-cannot-be-disabled.md
+++ b/issues/build/a-metal-only-row-cannot-be-disabled.md
@@ -16,8 +16,7 @@ row before any boot.
 
 ## Measured
 
-`hda_tone` and `hda_client_stall` red on the T14 run of `main` at `7e151819`
-(`issues/build/a-readbacks-kernel-records-never-count-as-kernel-output.md`).
+`hda_tone` and `hda_client_stall` red on the T14 run of `main` at `7e151819`.
 Only the code reading is verified: `check_redlist` tests `schedule.contains`, and
 the metal branch filters `METAL` rows through the same `keep`. Running
 `--known-red hda_tone` and `--list` against a tree with such a row is owed and
diff --git a/issues/build/a-readbacks-kernel-records-never-count-as-kernel-output.md b/issues/build/a-readbacks-kernel-records-never-count-as-kernel-output.md
deleted file mode 100644
index 7a884c03676..00000000000
--- a/issues/build/a-readbacks-kernel-records-never-count-as-kernel-output.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-29
----
-
-# A readback's kernel records never count as kernel output, so every metal judge that asserts an absence reds unjudged
-
-`Serial::alive` (`tests/common/serial.rs`) counts the lines `qemu::is_kernel_line`
-accepts, and that predicate is `line.starts_with("[kernel ")` — the head
-`klogd` gives a record on the virtio console. The stick's `/log` file spells
-the same records `[<date> <time> <secs> cpuN]`, so on a `metal::Readback` the
-count is zero whatever the boot wrote. `must_not_say` and `must_be_clean` call
-`alive()` first, so every metal judge that asserts an absence on
-`Readback::kernel()` or `Readback::log()` refuses before it judges anything.
-
-## Measured
-
-The full T14 run of `main` at `7e151819`
-(EXIT=1), all four off one `testcases` boot that reached `Boot: complete` in
-1165 ms:
-
-```
-FAIL klogd_hosted: the testcases's kernel log carried no kernel output at all (56038 bytes): every assertion below it would be a claim about nothing
-FAIL hda_tone: the testcases's log carried no kernel output at all (69292 bytes): every assertion below it would be a claim about nothing
-FAIL hda_client_stall: the testcases's log carried no kernel output at all (69292 bytes): every assertion below it would be a claim about nothing
-FAIL loader_watchdog_arms: the testcases's kernel log carried no kernel output at all (56038 bytes): every assertion below it would be a claim about nothing
-```
-
-The `testcases` readback's `kernel.log` first line:
-`[2026-09-29 11:11:20 0.000 cpu0 boot] panic console: armed 1920x1080 ...`.
-
-The callers: `klogd_hosted` (`must_be_clean`), `audio::tone_on_metal` and
-`audio::client_stall_on_metal` (`must_not_say`), `power::watchdog_quiet`
-(`kernel.must_not_say`). `hda_tone` and `hda_client_stall` are `METAL_ONLY`
-rows no schedule registers, so `src/redlist.rs` cannot hold them
-(`issues/build/a-metal-only-row-cannot-be-disabled.md`).
-
-## Exit condition
-
-`Serial::alive` recognises a kernel record in the spelling a readback carries,
-and a T14 run of the four names above reaches each judge's own assertions; then this file is deleted.
diff --git a/issues/build/a-shared-metal-chunk-stages-no-test-binary-another-member-reads.md b/issues/build/a-shared-metal-chunk-stages-no-test-binary-another-member-reads.md
deleted file mode 100644
index 651d99549d2..00000000000
--- a/issues/build/a-shared-metal-chunk-stages-no-test-binary-another-member-reads.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-29
----
-
-# A shared metal chunk stages no test binary another member reads, so `dlopen_dedup` finds no `test_rs_std_tls`
-
-`dlopen_dedup`'s last arm reads `/system/bin/test_rs_std_tls` as a
-`DT_NEEDED`-carrying binary. `tests/common/metal.rs`'s `build` puts on an
-image the binaries its own jobs name, every `.so`, and only those `RUST_SKIP`
-helpers some job's source names; `std_tls` is a test and not a helper, so it
-is on an image only when it is a job there. `sized` cut the shared list into
-`shared` and `shared-2`, and `std_tls` ran on `shared-2` while
-`dlopen_dedup` ran on `shared`.
-
-## Measured
-
-The full T14 run of `main` at `7e151819`
-(EXIT=1), boot `shared`, after the two dedup checks passed:
-
-```
-PASS: 8 concurrent loads of one name returned one handle (1)
-thread 'main' (1) panicked at src/bin/dlopen_dedup.rs:42:63:
-read /system/bin/test_rs_std_tls: entity not found
-[... cpu5] exit: test_rs_dlopen_dedup pid=70 code=101 cpu=197ms
-```
-
-`===TEST_START test_rs_std_tls===` is at line 20467 of that log, inside the
-`shared-2` boot.
-
-## Exit condition
-
-A binary a staged job's source names by path is on that job's image whether
-or not it is itself a job there, and a T14 run exits `dlopen_dedup` 0; then this file is deleted.
diff --git a/issues/build/allocator-stress-bounds-a-failed-reservation-by-sixteen-gib.md b/issues/build/allocator-stress-bounds-a-failed-reservation-by-sixteen-gib.md
new file mode 100644
index 00000000000..ef9dc06a8b8
--- /dev/null
+++ b/issues/build/allocator-stress-bounds-a-failed-reservation-by-sixteen-gib.md
@@ -0,0 +1,20 @@
+---
+status: open
+kind: tooling
+opened: 2026-09-29
+---
+
+# `allocator_stress` expects a 16 GiB reservation to fail, which a machine with more memory grants
+
+`test_oom_graceful` (`tests/toyos-rust-tests/src/bin/allocator_stress.rs`)
+asserts `try_reserve(16 * 1024 * 1024 * 1024)` is refused as "way more than
+available RAM". That is a guest's size, as the total-memory range beside it
+was: the shared metal boot runs the same binary on the T14, which reports
+`mem_total=16777216000` (main's T14 run at `7e151819`, boot `shared`), 384 MiB
+short of the reservation. A machine with more than 16 GiB free grants it and
+reds the test.
+
+## Exit condition
+
+The refused size derives from the total `sysinfo` reports rather than from a
+constant.
diff --git a/issues/build/allocator-stress-bounds-total-memory-by-a-qemu-guests-size.md b/issues/build/allocator-stress-bounds-total-memory-by-a-qemu-guests-size.md
deleted file mode 100644
index c07400c6d96..00000000000
--- a/issues/build/allocator-stress-bounds-total-memory-by-a-qemu-guests-size.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-29
----
-
-# `allocator_stress` bounds total memory by a QEMU guest's size, so the T14's 15 GB reds it
-
-`test_memory_stats` (`tests/toyos-rust-tests/src/bin/allocator_stress.rs`)
-asserts `sysinfo`'s total is 2 to 9 GB, because "QEMU is configured with
-8GB". The shared metal boot runs the same binary on the T14.
-
-## Measured
-
-The full T14 run of `main` at `7e151819`
-(EXIT=1), boot `shared`, after every earlier check printed `ok`:
-
-```
-thread 'main' (1) panicked at src/bin/allocator_stress.rs:270:5:
-mem_total=16777216000 (15 GB) out of range
-[... cpu6] exit: test_rs_allocator_stress pid=46 code=101 cpu=92ms
-```
-
-## Exit condition
-
-The bound derives from what the machine reports rather than from one
-guest's size, and a T14 run of the shared boot exits `allocator_stress` 0; then this file is deleted.
diff --git a/issues/build/the-guest-c-comparator-keeps-the-tinycc-warnings-the-host-one-drops.md b/issues/build/the-guest-c-comparator-keeps-the-tinycc-warnings-the-host-one-drops.md
deleted file mode 100644
index 4d40b75ef1c..00000000000
--- a/issues/build/the-guest-c-comparator-keeps-the-tinycc-warnings-the-host-one-drops.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-29
----
-
-# The guest C comparator keeps the TinyCC warnings the host one drops, so `03_struct` reds on the T14
-
-`check_c_result` (`tests/toyos.rs`) drops every `<case>.c:<n>: ... warning:`
-line from a committed `.expect` before comparing, because TinyCC's runner
-captured its warnings with the output. `ccheck`
-(`tests/toyos-rust-tests/src/bin/ccheck.rs`), the metal corpus's comparator,
-compares the staged `.expect` whole. `the_two_comparisons_use_one_rule`
-holds the two to one `trim_end` and does not see the difference.
-`tests/testcases/tinycc/03_struct.expect` opens with
-`03_struct.c:14: warning: attribute '__cleanup__' ignored on type`, and it is
-the one staged case whose expectation carries a warning.
-
-## Measured
-
-The full T14 run of `main` at `7e151819`
-(EXIT=1), boot `ccorpus`:
-
-```
-ccheck: 03_struct: differed at byte 0 — 25 byte(s) produced against 90 expected
-ccheck: 03_struct: got      "12\n34\n12\n34\n56\n78\n~fred()"
-ccheck: 03_struct: expected "03_struct.c:14: warning: attribute '__cleanup__' ignored on type\n12\n34\n12\n34\n56\n78\n~fred()"
-[... cpu7] exit: 03_struct pid=12 code=1 cpu=62ms
-```
-
-The case binary itself exited 0 (`exit: test_c_03_struct pid=13 code=0`).
-
-## Exit condition
-
-The guest and host comparators apply one rule to an expectation's warning
-lines, with the gate that holds them together reading that rule too, and a
-T14 run of the corpus exits `03_struct` 0; then this file is deleted.
diff --git a/issues/build/the-metal-loop-refuses-the-hang-the-foreign-record-arm-stages.md b/issues/build/the-metal-loop-refuses-the-hang-the-foreign-record-arm-stages.md
deleted file mode 100644
index e10ecd63f2b..00000000000
--- a/issues/build/the-metal-loop-refuses-the-hang-the-foreign-record-arm-stages.md
+++ /dev/null
@@ -1,50 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-29
----
-
-# The metal loop refuses the hang the foreign-record arm stages, so `blackbox_foreign_record` never reaches its judge
-
-`blackbox_foreign_record`'s metal arm flashes `tests/jobcase` armed with
-`blackbox-foreign-identity`: the stop seals its record under an identity one
-bit away from the stick's. The pass after the reset clears that record as
-another image's, so no record of this image's boot reaches it, and the
-attempt count reads the boot as a hang and hands the machine back. The QEMU
-half (`power::blackbox_foreign_record`, `tests/common/power.rs`) says that
-second pass "also hands the machine back, and that is right". `toyos-metal`
-(`src/metal.rs`) returns `Refusal::HungWithoutARecord` on any `loader.log`
-carrying `bootlog::HUNG_WITHOUT_A_RECORD`, before the arm's judge runs and
-whatever the image is armed with.
-
-## Measured
-
-The full T14 run of `main` at `7e151819`
-(EXIT=1):
-
-```
-toyos-metal: the last boot of this image was handed the machine and never reported: no panic, no fault and no deliberate handover, which is a hang. This pass refused to boot the same kernel again and gave the machine back, so the machine is free and nothing needs a hand — but this boot measured no test, and why that kernel stopped is the boot before it
-  FAIL foreignrecord: toyos-metal exited exit status: 1
-  FAIL blackbox_foreign_record: toyos-metal exited exit status: 1
-```
-
-The pass after the reset
-(`loader.log`)
-carries the line the judge asks for, then the hang:
-
-```
-Black box: 0x8000000 held a DONE record another image left in this memory ([63, 12, b3, ...], and this stick is [9c, 12, b3, ...]), armed at 2026-09-29-103651. It has been cleared and this pass boots its kernel
-Boot attempts: this image has had the machine 1 time(s) without reporting; now 0
-Slot A: its image 5d1a1666... died on its last boot, so no pass boots it again until an update replaces it
-Boot attempts: the previous boot of this image never reported; the machine is handed back
-```
-
-The kernel's own boot was sound: `Boot: complete (1171ms)`, then init's
-`power: the machine stops`.
-
-## Exit condition
-
-`toyos-metal` hands a boot armed with `blackbox-foreign-identity` to its judge
-instead of refusing the hang it stages, and a T14 run of
-`blackbox_foreign_record` reaches `record another image left in this memory`
-in the judge; then this file is deleted.
diff --git a/issues/build/the-xecp-judge-names-no-line-the-t14s-handoff-prints.md b/issues/build/the-xecp-judge-names-no-line-the-t14s-handoff-prints.md
deleted file mode 100644
index efe1a8083e2..00000000000
--- a/issues/build/the-xecp-judge-names-no-line-the-t14s-handoff-prints.md
+++ /dev/null
@@ -1,34 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-29
----
-
-# The xECP judge names no line the T14's handoff prints
-
-`xhci_xecp` (`tests/toyos.rs`), `xhci_xecp_walk`'s judge on QEMU and on the
-T14, finds the handoff by a line containing `USB Legacy Support` or
-`ownership`. `take_ownership` (`kernel/src/drivers/xhci/legacy.rs`) prints
-one of four lines, and only the one for a controller with no such capability
-— QEMU's — contains either needle. The T14's controllers publish the
-capability with firmware not owning them, and that line is
-`xHCI: firmware did not claim the controller (USBLEGSUP 0x...)`.
-
-## Measured
-
-The full T14 run of `main` at `7e151819`
-(EXIT=1): `FAIL xhci_xecp_walk: no line about the handoff at all:`. The
-`selftests` readback's `kernel.log`
-carries, for each of the two controllers, the self-test and the handoff
-before the reset:
-
-```
-193:[2026-09-29 11:05:25 0.253 cpu0] xHCI: xecp selftest 8/8 malformed lists refused
-194:[2026-09-29 11:05:25 0.253 cpu0] xHCI: firmware did not claim the controller (USBLEGSUP 0x01002201)
-199:[2026-09-29 11:05:25 0.253 cpu0] xHCI: controller reset
-```
-
-## Exit condition
-
-The judge recognises every line `take_ownership` can print about the
-handoff, and a T14 run of `xhci_xecp_walk` passes; then this file is deleted.
diff --git a/issues/hardware/the-metal-wedge-judge-reads-a-channel-the-wedge-cannot-write.md b/issues/hardware/the-metal-wedge-judge-reads-a-channel-the-wedge-cannot-write.md
deleted file mode 100644
index 37af003564b..00000000000
--- a/issues/hardware/the-metal-wedge-judge-reads-a-channel-the-wedge-cannot-write.md
+++ /dev/null
@@ -1,58 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-14
----
-
-# The metal wedge judge asserts two records on a channel a wedge cannot write to, so its arm has never passed
-
-`tests/common/power.rs`'s `deadline_wedge_chain` — the judge
-`boot_deadline_ends_a_wedge`'s metal arm runs (`tests/toyos.rs`, `arms:
-&[metal::once("deadlinewedge", ...)]`) — opens with
-
-```rust
-kernel.must_say(bootlog::WEDGE_STAGED)?;
-kernel.must_say(bootlog::WEDGE_ARRIVED_DEAF)?;
-```
-
-`kernel` is `Readback::kernel()`, which is the concatenation of `logd`'s files
-off the stick. Both records are written by `kernel/src/deadline.rs` after every
-CPU has stopped taking scheduler passes, so `logd` is already wedged and neither
-can reach a file it writes. The two records do cross, on the sealed page, and
-the same function asserts them there four lines further down —
-`after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::WEDGE_STAGED)` — which
-is the channel that carries them.
-
-## Measured
-
-Three readbacks, one command each
-(`cargo test --test toyos-build -- --metal --metal-readback <dir>
-boot_deadline_ends_a_wedge`):
-
-| readback | `wedge: staged` in `kernel.log` | in `loader.log` | judge |
-|---|---|---|---|
-| run 50 `deadlinewedge` | 0 | 1, at line 253, under `Previous boot's panic:` at line 34 | EXIT=1 |
-| run 44 `metal-r2-wedge-deadlinewedge` | 0 | 1 | EXIT=1 |
-| run 44 `metal-ctl-wedge-deadlinewedge` | 0 | 0 | — |
-
-The refusal is the same on both: `"wedge: staged, and only the boot deadline
-ends this machine" never reached the deadlinewedge's kernel log`. The boots
-themselves are sound — run 50 read `PASS: the machine booted ToyOS in 1164 ms`,
-EXIT=0, and every number the profile prices for that boot passed its ceiling.
-
-The control arm's zero in both columns is a second fact and not this one: that
-page kept the oldest records that fit, which is
-`issues/diagnostics/a-wedged-boots-record-outgrows-both-channels-that-carry-it.md`.
-
-The full T14 run of `main` at `7e151819`
-(EXIT=1) reds with the same refusal: `wedge: staged` is at `loader.log:258` of
-its `deadlinewedge` readback and in no line of its `kernel.log`.
-
-`power::hard_lockup_chain` beside it was already moved off that channel for this
-reason and says so at the site; the wedge judge was not.
-
-## Exit condition
-
-A `deadlinewedge` readback on which `boot_deadline_ends_a_wedge`'s metal arm
-passes, with the two records asserted on the channel that carries them — and
-nothing asserted on `kernel.log` that a wedge cannot write to it. Then this file is deleted.
diff --git a/src/bootlog.rs b/src/bootlog.rs
index 14aa18ad1e4..8ac0fe2faee 100644
--- a/src/bootlog.rs
+++ b/src/bootlog.rs
@@ -116,6 +116,12 @@ pub const LOG_TAIL: &str = "log-tail: ";
 /// two registrations whose whole subject is that it stopped.
 pub const HANDED_BACK: &str = "the last boot read DONE";
 
+/// What the loader says, in `bootloader/src/blackbox.rs`, of a `DONE` record
+/// sealed under another stick's identity: the foreign-identity arm's
+/// [`HANDED_BACK`]. The kernel seals every state under that identity, so only
+/// this word says the stop finished rather than panicked or wedged.
+pub const FOREIGN_DONE: &str = "held a DONE record another image left in this memory";
+
 /// The bootloader's own file at the root of the log partition.
 pub const LOADER_LOG: &str = "loader.log";
 
@@ -317,6 +323,9 @@ pub enum Unfit {
     /// The loader pass after the reset read no `DONE`, or read one with no
     /// [`REBOOTING`] in its tail: the stop never finished.
     NotHandedBack,
+    /// The loader pass after the foreign-identity arm's reset read no
+    /// [`FOREIGN_DONE`]: the stop it staged never finished.
+    NoForeignDone,
 }
 
 impl fmt::Display for Unfit {
@@ -334,6 +343,11 @@ impl fmt::Display for Unfit {
                 "the loader's pass after the reset carries no {HANDED_BACK:?} with {REBOOTING:?} \
                  under {LOG_TAIL:?}: the stop this boot asked for never reached the reset"
             ),
+            Self::NoForeignDone => write!(
+                f,
+                "the loader's pass after the reset carries no {FOREIGN_DONE:?}: the stop this \
+                 boot asked for never sealed its record DONE"
+            ),
         }
     }
 }
@@ -350,6 +364,22 @@ pub fn handed_back(loader: &str) -> Result<(), Unfit> {
     }
 }
 
+/// The loader's half of a passing foreign-identity boot, whose own chain the
+/// loader ends as a hang: the record it cleared was sealed `DONE`.
+pub fn foreign_done(loader: &str) -> Result<(), Unfit> {
+    // The pass before the handoff clears a stale foreign record the same way.
+    match after_the_reset(loader) {
+        Some(after) if after.contains(FOREIGN_DONE) => Ok(()),
+        _ => Err(Unfit::NoForeignDone),
+    }
+}
+
+/// `loader.log` from [`SEPARATOR`] on: the pass that read what this boot left,
+/// or `None` where the chain did not go round.
+pub fn after_the_reset(loader: &str) -> Option<&str> {
+    loader.find(SEPARATOR).map(|at| &loader[at..])
+}
+
 /// Init's line saying the machine stops, the last one `log` carries.
 pub fn stopping_line(log: &str) -> Option<&str> {
     log.lines().rfind(|line| {
@@ -640,6 +670,13 @@ mod tests {
                 path.display()
             );
         }
+        // A format and not a constant: the loader fills its hole with the
+        // state's own word.
+        let path =
+            std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("bootloader/src/blackbox.rs");
+        let source = std::fs::read_to_string(&path).expect("a loader module");
+        let format = FOREIGN_DONE.replacen(toyos_blackbox::State::Done.named(), "{}", 1);
+        assert!(source.contains(&format), "{} formats no {format:?}", path.display());
     }
 
     #[test]
diff --git a/src/metal.rs b/src/metal.rs
index 516f2b9a860..3990647ce04 100644
--- a/src/metal.rs
+++ b/src/metal.rs
@@ -775,7 +775,7 @@ pub const FLASHABLE: &[(&str, Flash)] = &[
     // It seals this boot's own record under an identity one bit from this
     // stick's, so the pass that finds it clears it and boots a kernel. The page
     // is memory the loader allocated and the machine is what it was after.
-    ("blackbox-foreign-identity", Flash::Ok),
+    (FOREIGN_RECORD_ARM, Flash::Ok),
     // **The one arm that deliberately stops this machine.** At the shutdown
     // syscall, after the job list, every CPU stops taking scheduler passes.
     // Admissible only because `kernel/src/deadline.rs` is what ends it, which
@@ -864,12 +864,24 @@ pub const LOAD_ARM: &str = "usb-reset-under-load";
 /// forgot it reds every boot it was staged for.
 pub const WEDGE_ARMS: &[&str] = &[WEDGE_ARM, LOCKUP_ARM, LOAD_ARM];
 
+/// The arm whose boot the pass after it reads as a hang on purpose: its record
+/// is sealed under another stick's identity, so that pass clears it and finds
+/// an attempt nothing reported, and hands the machine back.
+pub const FOREIGN_RECORD_ARM: &str = "blackbox-foreign-identity";
+
 /// Whether this image is armed to stop itself, and so owes a sealed record
 /// rather than `Rebooting.`.
 pub fn stages_a_wedge(armed: &[String]) -> bool {
     armed.iter().any(|name| WEDGE_ARMS.contains(&name.as_str()))
 }
 
+/// Whether this image is armed so the pass after its reset clears its record
+/// as another image's: nothing crosses on the page but the record's state, and
+/// that pass hands the machine back as a hang.
+pub fn clears_its_own_page(armed: &[impl AsRef<str>]) -> bool {
+    armed.iter().any(|name| name.as_ref() == FOREIGN_RECORD_ARM)
+}
+
 /// [`FLASHABLE`]'s ruling on `name`, or `None` where nobody has made one.
 pub fn flash_ruling(name: &str) -> Option<Flash> {
     // The two parameters that carry a value are not names: the black-box page's
@@ -2103,6 +2115,19 @@ pub fn run(args: &Args) -> Result<Option<u64>, Refusal> {
         write_readback(dir, &loader, &log, back, stick, wire.as_ref(), replied)?;
         println!("readback written to {}", dir.display());
     }
+    let ms = boot_verdict(&armed, &loader, &log)?;
+    // After the stick's own verdict, which stays the one that names a boot
+    // that never reached its network.
+    if let Some((heard, lines)) = &heard {
+        talk_verdict(heard, lines)?;
+    }
+    Ok(Some(ms))
+}
+
+/// The stick's own verdict on one boot, off what its image is armed with, the
+/// loader's file and the log.
+fn boot_verdict(armed: &[String], loader: &str, log: &str) -> Result<u64, Refusal> {
+    let staged_hang = clears_its_own_page(armed);
     // **Named by evidence, before the boot record is missed.** A boot that
     // never happened and a boot that failed both leave no `Boot: complete`,
     // and `Unfit::NoBootRecord` says the second where it is often the first.
@@ -2113,10 +2138,10 @@ pub fn run(args: &Args) -> Result<Option<u64>, Refusal> {
     // hand.** The loader bounded a hang and gave the machine back; every
     // other reading of an empty kernel log would send a reader to the wrong
     // place, and `NoBootRecord` would send them to a kernel that never ran.
-    if loader.contains(bootlog::HUNG_WITHOUT_A_RECORD) {
+    if loader.contains(bootlog::HUNG_WITHOUT_A_RECORD) && !staged_hang {
         return Err(Refusal::HungWithoutARecord);
     }
-    if let Some(said) = reported_and_booted_nothing(&loader, &log) {
+    if let Some(said) = reported_and_booted_nothing(loader, log) {
         return Err(Refusal::ReportedAndBootedNothing { said });
     }
     // **An image armed to stop itself is judged by the record its own bound
@@ -2126,19 +2151,16 @@ pub fn run(args: &Args) -> Result<Option<u64>, Refusal> {
     // it was not flashed as. *Which* bound sealed it is the page's to say
     // and not this list's — the arm says a bound was staged, and two of them
     // can reach a staged boot.
-    let ms = if stages_a_wedge(&armed) {
-        wedged_boot(&loader, &log)?
+    if stages_a_wedge(armed) {
+        return wedged_boot(loader, log);
+    }
+    let ms = bootlog::verdict(log).map_err(Refusal::Log)?;
+    if staged_hang {
+        bootlog::foreign_done(loader).map_err(Refusal::Log)?;
     } else {
-        let ms = bootlog::verdict(&log).map_err(Refusal::Log)?;
-        bootlog::handed_back(&loader).map_err(Refusal::Log)?;
-        ms
-    };
-    // After the stick's own verdict, which stays the one that names a boot
-    // that never reached its network.
-    if let Some((heard, lines)) = &heard {
-        talk_verdict(heard, lines)?;
+        bootlog::handed_back(loader).map_err(Refusal::Log)?;
     }
-    Ok(Some(ms))
+    Ok(ms)
 }
 
 /// Where a conversation's facts are written, beside the stick's files.
@@ -3375,4 +3397,62 @@ mod tests {
         let early = locked.replace("for 60004 ms", "for 59000 ms");
         assert_eq!(lockup_lateness_ms(&early), None);
     }
+
+    /// The foreign-record arm's pass after the reset: the hang it stages is its
+    /// verdict's premise, the record it cleared says the stop finished, and the
+    /// same pass under any other arm is the hang refusal.
+    #[test]
+    fn the_foreign_record_arm_reaches_its_judge_through_the_hang_it_stages() {
+        let loader = format!(
+            "Loader log: the kernel handoff begins, so this file ends here\n{}\n\
+             ToyOS Bootloader 1.0\n\
+             Black box: 0x8000000 held a DONE record another image left in this memory ([63, 12, \
+             b3, 41, e8, dd, 26, 4a, b9, d6, e7, 17, 3a, 83, d6, 18], and this stick is [9c, 12, \
+             b3, 41, e8, dd, 26, 4a, b9, d6, e7, 17, 3a, 83, d6, 18]), armed at \
+             2026-09-29-103651. It has been cleared and this pass boots its kernel\n\
+             Boot attempts: this image has had the machine 1 time(s) without reporting; now 0\n\
+             Boot attempts: the previous boot of this image never reported; the machine is \
+             handed back\n\
+             Loader log: the last boot is accounted for, so this pass resets the machine\n",
+            bootlog::SEPARATOR
+        );
+        let log = "[2026-09-29 10:36:53 1.171 cpu0] Boot: complete (1171ms)\n\
+                   {2026-09-29 10:36:53 1.186 init} init: power: the machine stops, and logd makes \
+                   the log whole first (Reboot)\n";
+        let armed = |names: &[&str]| -> Vec<String> { names.iter().map(|n| (*n).to_string()).collect() };
+        assert_eq!(
+            boot_verdict(&armed(&[FOREIGN_RECORD_ARM, "boot-deadline=120000"]), &loader, log),
+            Ok(1171)
+        );
+        assert_eq!(
+            boot_verdict(&armed(&["boot-deadline=120000"]), &loader, log),
+            Err(Refusal::HungWithoutARecord)
+        );
+        // A stop that panicked or that a bound ended seals under the foreign
+        // identity too, and hands the machine back the same way.
+        for state in ["PANIC", "WEDGED"] {
+            let ended = loader.replace("held a DONE record", &format!("held a {state} record"));
+            assert_eq!(
+                boot_verdict(&armed(&[FOREIGN_RECORD_ARM, "boot-deadline=120000"]), &ended, log),
+                Err(Refusal::Log(bootlog::Unfit::NoForeignDone))
+            );
+            // The pass before the handoff cleared a stale foreign `DONE`.
+            let stale = format!(
+                "Black box: 0x8000000 held a DONE record another image left in this memory\n{ended}"
+            );
+            assert_eq!(
+                boot_verdict(&armed(&[FOREIGN_RECORD_ARM, "boot-deadline=120000"]), &stale, log),
+                Err(Refusal::Log(bootlog::Unfit::NoForeignDone))
+            );
+        }
+        // A chain that never went round has no pass after the reset to read.
+        let unreturned = format!(
+            "Black box: 0x8000000 held a DONE record another image left in this memory\n{}\n",
+            bootlog::LOADER_LAST_LINE
+        );
+        assert_eq!(
+            boot_verdict(&armed(&[FOREIGN_RECORD_ARM, "boot-deadline=120000"]), &unreturned, log),
+            Err(Refusal::Log(bootlog::Unfit::NoForeignDone))
+        );
+    }
 }
diff --git a/tests/checks.rs b/tests/checks.rs
index 183e3c17eb8..5bb70c8525f 100644
--- a/tests/checks.rs
+++ b/tests/checks.rs
@@ -641,10 +641,202 @@ mod checks {
             .find(|(name, _)| *name == "blackbox_unclaimed_page")
             .map(|(name, decl)| vec![(*name, decl)])
             .ok_or_else(|| "blackbox_unclaimed_page is not registered".to_string())?;
-        let verdict = metal::run(mode, &selected, &[], &[], &[], true);
+        let verdict = metal::run(mode, &selected, &[], &[], true);
         if verdict != metal::Verdict::Green {
             return Err(format!("--metal --list produced {verdict:?}, not Green"));
         }
         Ok(())
     }
+
+    /// The judge a metal registration runs.
+    fn metal_judge(name: &str) -> fn(&[&metal::Readback]) -> Result<(), String> {
+        match METAL.iter().find(|(row, _)| *row == name) {
+            Some((_, metal::Metal::Runs { judge, .. })) => *judge,
+            _ => panic!("{name} runs no metal judge"),
+        }
+    }
+
+    /// One boot's readback, out of a `loader.log` and a `logd` text.
+    fn readback(label: &str, loader: &str, log: &str) -> metal::Readback {
+        let boot = "back_secs 50\nstick_secs 0\n";
+        metal::Readback::new(label, std::path::PathBuf::new(), loader.into(), log.into(), boot)
+            .expect("a boot file naming both numbers")
+    }
+
+    /// The pass before the handoff, which every `loader.log` opens with.
+    const HANDOFF: &str = "Loader log: the kernel handoff begins, so this file ends here\n";
+
+    /// Four judges fed a T14 readback's lines: each record they ask for is
+    /// written after the file was made whole, so it crosses only on the sealed
+    /// page — and a page without it still reds.
+    #[test]
+    fn metal_judges_read_the_page_for_what_only_the_page_carries() {
+        let done = |tail: &str| {
+            format!(
+                "{HANDOFF}{}\nToyOS Bootloader 1.0\n\
+                 Black box: the last boot read DONE, so it handed the machine back on purpose and \
+                 this chain ends here\n\
+                 | log: this boot's newest records follow, newest first (16)\n{tail}\
+                 Loader log: the last boot is accounted for, so this pass resets the machine\n",
+                bootlog::SEPARATOR
+            )
+        };
+        let rebooted = "| log-tail: [1.516 cpu0] Rebooting.\n";
+        let synced = "| log-tail: [1.516 cpu0] Syncing filesystems...\n";
+
+        let jobcase =
+            "[2026-09-29 10:40:36 0.000 cpu0 boot] ACPI: reset register SystemIO 0xcf9 <- 0x06\n";
+        let judge = metal_judge("machine_reboot");
+        assert_eq!(judge(&[&readback("jobcase", &done(rebooted), jobcase)]), Ok(()));
+        assert!(judge(&[&readback("jobcase", &done(synced), jobcase)]).is_err());
+
+        let testcases = "[2026-09-29 11:11:32 12.720 cpu2] exit: test_rs_null_sink_client_ex pid=12 \
+                         code=0 cpu=42ms\n\
+                         [2026-09-29 11:11:32 12.725 cpu7] exit: echo pid=15 code=0 cpu=0ms\n";
+        let judge = metal_judge("log_poll_outlives_a_close");
+        assert_eq!(judge(&[&readback("testcases", &done(rebooted), testcases)]), Ok(()));
+        assert!(judge(&[&readback("testcases", &done(synced), testcases)]).is_err());
+
+        let wedged = |tail: &str| {
+            format!(
+                "{HANDOFF}{}\nToyOS Bootloader 1.0\n\
+                 Previous boot's panic: the last boot read WEDGED, so a bound of its own ended it \
+                 and this chain ends here\n\
+                 | the boot deadline expired: a bound of 120000 ms, reached at 120061 ms, with this \
+                 machine in `complete`. The tail of the log ring follows ... which is what nothing \
+                 was draining.\n\
+                 | usb-quiesce: no barrier was taken, so this reset is not the shutdown's\n{tail}\
+                 Loader log: the last boot is accounted for, so this pass resets the machine\n",
+                bootlog::SEPARATOR
+            )
+        };
+        let kernel = "[2026-09-29 10:33:28 0.000 cpu0 boot] panic console: armed 1920x1080 \
+                      stride=1920 format=1 at 0x4000000000, write-combining\n";
+        let wedge = "| [1.509 cpu0] wedge: staged, and only the boot deadline ends this machine: \
+                     every CPU stops taking scheduler passes from here\n\
+                     | [1.509 cpu0] wedge: cpu0 arrived with interrupts off, through the syscall \
+                     gate, and takes them again here\n\
+                     | [1.509 cpu1] wedge: cpu1 arrived with interrupts on\n";
+        let judge = metal_judge("boot_deadline_ends_a_wedge");
+        assert_eq!(judge(&[&readback("deadlinewedge", &wedged(wedge), kernel)]), Ok(()));
+        assert!(judge(&[&readback("deadlinewedge", &wedged(""), kernel)]).is_err());
+
+        let sweep = "| [1.526 cpu0] usb-load: sweeping disk 0 from block 6569336 to 7507812, \
+                     rewriting each run with the bytes just read from it, until this machine is \
+                     reset out from under it\n";
+        let judge = metal_judge("usb_reset_records_the_phase_it_cut");
+        assert_eq!(judge(&[&readback("usbload", &wedged(sweep), kernel)]), Ok(()));
+        assert!(judge(&[&readback("usbload", &wedged(""), kernel)]).is_err());
+    }
+
+    /// The foreign-identity arm's pass after the reset: the record it cleared
+    /// was sealed `DONE`, so the stop the arm staged finished.
+    #[test]
+    fn the_foreign_record_judge_demands_the_stop_sealed_done() {
+        let loader = format!(
+            "{HANDOFF}{}\nToyOS Bootloader 1.0\n\
+             Black box: 0x8000000 held a DONE record another image left in this memory ([3e, d4, \
+             0b, d4, 87, ad, 6a, 47, 84, b4, af, c3, f3, 6b, f7, 81], and this stick is [c1, d4, \
+             0b, d4, 87, ad, 6a, 47, 84, b4, af, c3, f3, 6b, f7, 81]), armed at 2026-09-29-131341. \
+             It has been cleared and this pass boots its kernel\n\
+             Boot attempts: this image has had the machine 1 time(s) without reporting; now 0\n\
+             {}\n\
+             Loader log: the last boot is accounted for, so this pass resets the machine\n",
+            bootlog::SEPARATOR,
+            bootlog::HUNG_WITHOUT_A_RECORD
+        );
+        let kernel = "[2026-09-29 13:13:43 1.171 cpu0] Boot: complete (1171ms)\n";
+        let judge = metal_judge("blackbox_foreign_record");
+        assert_eq!(judge(&[&readback("foreignrecord", &loader, kernel)]), Ok(()));
+        for state in ["PANIC", "WEDGED"] {
+            let ended = loader.replace("held a DONE record", &format!("held a {state} record"));
+            assert!(judge(&[&readback("foreignrecord", &ended, kernel)]).is_err());
+            let stale = format!(
+                "Black box: 0x8000000 held a DONE record another image left in this memory\n{ended}"
+            );
+            assert!(judge(&[&readback("foreignrecord", &stale, kernel)]).is_err());
+        }
+        let unbounded = loader.replace(bootlog::HUNG_WITHOUT_A_RECORD, "");
+        assert!(judge(&[&readback("foreignrecord", &unbounded, kernel)]).is_err());
+    }
+
+    /// The foreign-identity boot owes no fact off the page its next pass
+    /// cleared; any other boot owes each one but a path it did not take.
+    #[test]
+    fn a_cleared_page_owes_no_fact_off_it() {
+        let bound = "boot-deadline=120000";
+        assert!(metal::owes_nothing("panel_us", &[toyos_build::metal::FOREIGN_RECORD_ARM, bound]));
+        assert!(!metal::owes_nothing("panel_us", &[bound]));
+        assert!(metal::owes_nothing("park_open_operations", &[bound]));
+    }
+
+    /// A T14 controller's handoff: it publishes USB Legacy Support and
+    /// firmware never claimed it. The T14 has two, and each is judged.
+    #[test]
+    fn the_xecp_judge_reads_the_t14s_handoff() {
+        let t14 = "[2026-09-29 11:05:25 0.253 cpu0] xHCI: xecp selftest 8/8 malformed lists refused\n\
+                   [2026-09-29 11:05:25 0.253 cpu0] xHCI: firmware did not claim the controller \
+                   (USBLEGSUP 0x01002201)\n\
+                   [2026-09-29 11:05:25 0.253 cpu0] xHCI: USBLEGCTLSTS 0xe0000000 -> 0x00000000 \
+                   (SMI generation off)\n\
+                   [2026-09-29 11:05:25 0.253 cpu0] xHCI: controller reset\n\
+                   [2026-09-29 11:05:25 0.254 cpu0] xHCI: controller started\n";
+        assert_eq!(xhci_xecp(t14), Ok(()));
+        assert_eq!(xhci_xecp(&format!("{t14}{t14}")), Ok(()));
+        // Firmware that kept the controller handed nothing over.
+        let held = t14.replace(
+            "firmware did not claim the controller (USBLEGSUP 0x01002201)",
+            "firmware still owns the controller after 1000ms (USBLEGSUP 0x01010001 -> \
+             0x01010001) — resetting it anyway",
+        );
+        assert!(xhci_xecp(&held).is_err());
+        assert!(xhci_xecp(&format!("{t14}{held}")).is_err());
+        let kept = held.replace("xHCI: controller reset", "xHCI: 34 scratchpad buffers configured");
+        assert!(xhci_xecp(&format!("{t14}{kept}")).is_err());
+        // A second controller's handoff with no reset of its own, and a reset
+        // with no handoff before it.
+        let unreset = t14.replace("xHCI: controller reset", "xHCI: 34 scratchpad buffers configured");
+        assert!(xhci_xecp(&format!("{t14}{unreset}")).is_err());
+        assert!(xhci_xecp(&format!("{unreset}{t14}")).is_err());
+        let unhanded = t14.replace("firmware did not claim the controller", "USB 3.1 on ports 2..=5");
+        assert!(xhci_xecp(&format!("{t14}{unhanded}")).is_err());
+        let silent = unhanded.replace("xHCI: controller reset", "xHCI: 34 scratchpad buffers configured");
+        assert!(xhci_xecp(&silent).is_err());
+    }
+
+    /// `dlopen_dedup` reads `test_rs_std_tls` by path.
+    #[test]
+    fn a_shared_chunk_stages_every_binary_its_members_name() {
+        let source = "const NEEDS_A_LIB: &str = \"/system/bin/test_rs_std_tls\";\n";
+        let bins: Vec<(String, Vec<u8>)> = ["dlopen_dedup", "std_tls", "fs_large_file", "libfoo.so"]
+            .iter()
+            .map(|name| ((*name).to_string(), Vec::new()))
+            .collect();
+        let jobs = vec!["test_rs_dlopen_dedup".to_string()];
+        let staged = |text: &str| -> Vec<String> {
+            metal::reached(text, &jobs, &bins).into_iter().map(|(path, _)| path).collect()
+        };
+        assert_eq!(
+            staged(&format!("test_rs_dlopen_dedup\n{source}")),
+            ["bin/test_rs_std_tls", "lib/libfoo.so"]
+        );
+        // A longer name is another binary's.
+        let longer = source.replace("test_rs_std_tls", "test_rs_std_tls_dlopen");
+        assert_eq!(staged(&format!("test_rs_dlopen_dedup\n{longer}")), ["lib/libfoo.so"]);
+    }
+
+    /// `03_struct`'s output as `ccheck` prints it: the expectation the corpus
+    /// stages is that, under the guest's `trim_end`.
+    #[test]
+    fn the_c_corpus_stages_the_expectation_the_host_compares() {
+        let got = "12\n34\n12\n34\n56\n78\n~fred()";
+        let boot = c_corpus_metal(&[("03_struct".to_string(), Vec::new())], |_| true);
+        let staged = boot
+            .files
+            .iter()
+            .find(|(path, _)| path == "expect/03_struct")
+            .map(|(_, bytes)| String::from_utf8(bytes.clone()).expect("an expectation is text"))
+            .expect("03_struct's expectation is staged");
+        assert_eq!(staged.trim_end(), got);
+    }
 }
diff --git a/tests/checks/serial.rs b/tests/checks/serial.rs
index 0bb9935412d..5c2c60e9c65 100644
--- a/tests/checks/serial.rs
+++ b/tests/checks/serial.rs
@@ -23,6 +23,15 @@ pub fn self_check() -> Result<(), String> {
     // capture looks like when it is not simply empty, and the case a
     // `text.is_empty()` guard would wave through.
     let mute = Serial::named("test capture", "hello from userland\n");
+    // A readback of `/log`, whose kernel records open with a date.
+    let readback = Serial::named(
+        "test capture",
+        "[2026-09-29 11:11:20 0.000 cpu0 boot] panic console: armed 1920x1080 stride=1920 \
+         format=1 at 0x4000000000, write-combining\n\
+         {2026-09-29 11:11:21 1.170 init} init: started logd\n",
+    );
+    let readback_mute =
+        Serial::named("test capture", "{2026-09-29 11:11:21 1.170 init} init: started logd\n");
     let panicking = Serial::named(
         "test capture",
         "[kernel 0.001 cpu0] NVMe: found\n[kernel 0.002 cpu0] PANIC: nope\n",
@@ -42,6 +51,11 @@ pub fn self_check() -> Result<(), String> {
         // The dead gate itself, from both directions.
         ("must_not_say on an empty capture", false, &|| dead.must_not_say("anything")),
         ("must_not_say with no kernel output", false, &|| mute.must_not_say("anything")),
+        ("must_not_say on a /log readback", true, &|| readback.must_not_say("no such line")),
+        ("must_be_clean on a /log readback", true, &|| readback.must_be_clean()),
+        ("must_not_say on a /log readback of programs only", false, &|| {
+            readback_mute.must_not_say("anything")
+        }),
         // must_be_clean
         ("must_be_clean on a clean boot", true, &|| live.must_be_clean()),
         ("must_be_clean on a panic", false, &|| panicking.must_be_clean()),
@@ -173,6 +187,9 @@ pub fn self_check() -> Result<(), String> {
         ("libc panic: panicked at src/main.rs:9:1:", Some(Died::Panicked)),
         // The one the naive fix cannot tell from the kernel's, and must.
         ("PANIC: printed by a program that felt like printing it", Some(Died::Panicked)),
+        // A `/log` readback's heads: the kernel's panic, and a program's.
+        ("[2026-09-29 11:11:22 2.000 cpu1] PANIC: nope", Some(Died::Kernel)),
+        ("{2026-09-29 11:11:22 2.000 init} PANIC: printed by init", Some(Died::Panicked)),
         // Nothing died.
         ("[kernel 0.377 cpu0] NVMe: found", None),
         ("hello from userland", None),
diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 99144fafbfb..b67d0f5d34d 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -31,6 +31,12 @@ use super::serial::Serial;
 const PATH_TAKEN: &[&str] =
     &["deadline_lateness_ms", "lockup_lateness_ms", "park_open_operations"];
 
+/// Whether a boot armed with `params` owes nothing for `field` where it produced
+/// none and the profile prices none.
+pub fn owes_nothing(field: &str, params: &[&str]) -> bool {
+    PATH_TAKEN.contains(&field) || toyos_build::metal::clears_its_own_page(params)
+}
+
 /// One boot a metal test needs.
 pub struct Arm {
     /// **The boot this test rides, named.** Two arms naming one boot share an
@@ -237,6 +243,28 @@ pub struct Readback {
 }
 
 impl Readback {
+    /// One boot's readback out of the three files the loop wrote for it:
+    /// `loader.log`, the `logd` files as one text, and the boot file.
+    pub fn new(label: &str, home: PathBuf, loader: String, log: String, boot: &str) -> Result<Self, String> {
+        let kernel = bootlog::kernel_records(&log);
+        let back_secs = toyos_build::metal::back_secs(boot)
+            .ok_or_else(|| format!("{label}'s boot file names no `back_secs`: {boot:?}"))?;
+        let stick_secs = toyos_build::metal::stick_secs(boot)
+            .ok_or_else(|| format!("{label}'s boot file names no `stick_secs`: {boot:?}"))?;
+        let cable = toyos_build::metal::cable(boot).map_err(|why| format!("{label}: {why}"))?;
+        Ok(Readback {
+            label: label.to_string(),
+            home,
+            boot_ms: bootlog::boot_millis(&kernel),
+            loader,
+            kernel,
+            log,
+            back_secs,
+            stick_secs,
+            cable,
+        })
+    }
+
     /// What the loop heard over the boot's own cable, and the log the machine
     /// served it — or why a boot that was to be talked to has neither.
     ///
@@ -290,6 +318,8 @@ impl Readback {
 
     /// Every `logd` file this boot wrote, as one text, less every program's
     /// line ([`bootlog::kernel_records`]): no program's line is read as the kernel's.
+    /// It ends where init had `logd` make it whole, so what the kernel writes
+    /// inside the stop or a wedge is only on the page ([`Self::after_the_reset`]).
     pub fn kernel(&self) -> Serial {
         Serial::named(&format!("{}'s kernel log", self.label), self.kernel.as_str())
     }
@@ -412,17 +442,14 @@ impl Readback {
     /// report is. `None` where the chain did not go round — which for a boot
     /// that ended itself is a finding, not an absence.
     pub fn after_the_reset(&self) -> Result<Serial, String> {
-        let at = self.loader.find(bootlog::SEPARATOR).ok_or_else(|| {
+        let after = bootlog::after_the_reset(&self.loader).ok_or_else(|| {
             format!(
                 "{}'s loader.log carries no pass after the reset: the loader did not point \
                  `BootNext` at itself, or the machine went back to the boot manager\n{}",
                 self.label, self.loader
             )
         })?;
-        Ok(Serial::named(
-            &format!("{}'s loader pass after the reset", self.label),
-            &self.loader[at..],
-        ))
+        Ok(Serial::named(&format!("{}'s loader pass after the reset", self.label), after))
     }
 
     /// What the kernel recorded about the process the *runner* spawned as
@@ -666,6 +693,35 @@ fn batches(
     Ok(out)
 }
 
+/// What `reachable`, a batch's text, names beside its `jobs`: every binary it
+/// spells `test_rs_<name>` that is not one of them, and every shared library.
+pub fn reached(
+    reachable: &str,
+    jobs: &[String],
+    rust_bins: &[(String, Vec<u8>)],
+) -> Vec<(String, Vec<u8>)> {
+    // Whole: a longer name that opens with this one is another binary's.
+    let names = |staged: &str| {
+        reachable.match_indices(staged).any(|(at, _)| {
+            !reachable[at + staged.len()..]
+                .starts_with(|c: char| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '_')
+        })
+    };
+    let mut out = Vec::new();
+    for (name, data) in rust_bins {
+        let staged = format!("test_rs_{name}");
+        // The shared libraries go on whole: a `dlopen` names a path and never a
+        // `test_rs_` literal, so no text could find one — and all of them
+        // together are a fraction of one helper binary.
+        if name.ends_with(".so") {
+            out.push((format!("lib/{name}"), data.clone()));
+        } else if !jobs.contains(&staged) && names(&staged) {
+            out.push((format!("bin/{staged}"), data.clone()));
+        }
+    }
+    out
+}
+
 /// Build one batch's image, and answer where it landed.
 fn build(
     root: &Path,
@@ -673,7 +729,6 @@ fn build(
     label: &str,
     batch: &Batch,
     rust_bins: &[(String, Vec<u8>)],
-    helpers: &[&str],
     quiet: bool,
 ) -> Result<PathBuf, String> {
     let home = at(dir, label);
@@ -711,13 +766,13 @@ fn build(
     // and `fault_gates` each panicked on `entity not found`
     // looking for a child nothing had staged.
     //
-    // **Which helper, though, is read rather than assumed.** Staging all of them
+    // **Which binary, though, is read rather than assumed.** Staging all of them
     // on every image cost 150 MB a boot, and a stick is written over `ssh`. A
     // driver reaches a binary as the literal `test_rs_<name>` — the same
     // spelling `suite_split` reads the harness for — so the text a boot could
     // possibly name it in is its job list, its symlink targets, and the source
-    // of every Rust job on it. A helper named nowhere in that is a helper this
-    // boot cannot reach.
+    // of every Rust job on it. A binary named nowhere in that is one this boot
+    // cannot reach.
     if !batch.jobs.is_empty() {
         let bin = root.join("tests/toyos-rust-tests/src/bin");
         let mut reachable = batch.jobs.join(" ");
@@ -734,18 +789,7 @@ fn build(
                 reachable.push_str(&source);
             }
         }
-        for (name, data) in rust_bins {
-            // The shared libraries go on whole: a `dlopen` names a path and
-            // never a `test_rs_` literal, so nothing above could find one — and
-            // all of them together are a fraction of one helper binary.
-            if name.ends_with(".so") {
-                extra.push((format!("lib/{name}"), data.clone()));
-            } else if helpers.contains(&name.as_str())
-                && reachable.contains(&format!("test_rs_{name}"))
-            {
-                extra.push((format!("bin/test_rs_{name}"), data.clone()));
-            }
-        }
+        extra.extend(reached(&reachable, &batch.jobs, rust_bins));
     }
 
     // The build a boot asked for, or — where it asked for none — the one its
@@ -870,24 +914,8 @@ fn read_readback(dir: &Path, label: &str) -> Result<Readback, String> {
     };
     let loader = read(toyos_build::metal::READBACK_LOADER)?;
     let log = read(toyos_build::metal::READBACK_KERNEL)?;
-    let kernel = bootlog::kernel_records(&log);
     let boot = read(toyos_build::metal::READBACK_BOOT)?;
-    let back_secs = toyos_build::metal::back_secs(&boot)
-        .ok_or_else(|| format!("{label}'s boot file names no `back_secs`: {boot:?}"))?;
-    let stick_secs = toyos_build::metal::stick_secs(&boot)
-        .ok_or_else(|| format!("{label}'s boot file names no `stick_secs`: {boot:?}"))?;
-    let cable = toyos_build::metal::cable(&boot).map_err(|why| format!("{label}: {why}"))?;
-    Ok(Readback {
-        label: label.to_string(),
-        home,
-        boot_ms: bootlog::boot_millis(&kernel),
-        loader,
-        kernel,
-        log,
-        back_secs,
-        stick_secs,
-        cable,
-    })
+    Readback::new(label, home, loader, log, &boot)
 }
 
 /// What a metal run established.
@@ -913,10 +941,6 @@ pub fn run(
     tests: &[(&str, &'static Metal)],
     shared: &[SharedBoot],
     rust_bins: &[(String, Vec<u8>)],
-    // Binaries a job spawns that are not jobs themselves: the shared block's
-    // helper children, which discovery leaves out and which nothing else would
-    // then put on the image.
-    helpers: &[&str],
     quiet: bool,
 ) -> Verdict {
     let root = super::compile::repo_root();
@@ -997,7 +1021,7 @@ pub fn run(
             toyos_build::build::build_host_judges(&root, quiet);
         }
         for (label, batch) in &batches {
-            match build(&root, dir, label, batch, rust_bins, helpers, quiet) {
+            match build(&root, dir, label, batch, rust_bins, quiet) {
                 Ok(image) => {
                     eprintln!(
                         "[metal] {label}: {} job(s), armed with {:?} — {}",
@@ -1126,6 +1150,7 @@ pub fn run(
                 }
                 // A boot the file prices a path-taken field for and that
                 // produced none is a boot some *other* bound ended.
+                let params = &batches[label.as_str()].params;
                 for (field, value) in [
                     ("complete_ms", back.boot_ms),
                     ("back_secs", Some(back.back_secs)),
@@ -1138,7 +1163,7 @@ pub fn run(
                 ] {
                     let name = format!("boot.{label}.{field}");
                     let priced = profile.row(&name).is_some();
-                    if value.is_none() && !priced && PATH_TAKEN.contains(&field) {
+                    if value.is_none() && !priced && owes_nothing(field, params) {
                         continue;
                     }
                     let Some(value) = value else {
diff --git a/tests/common/power.rs b/tests/common/power.rs
index 7b16b9f3a93..538e5902422 100644
--- a/tests/common/power.rs
+++ b/tests/common/power.rs
@@ -964,11 +964,6 @@ fn armed_and_nothing_else() -> String {
     format!("{} the page still reads {}", bootlog::PREVIOUS_PANIC, State::Armed.named())
 }
 
-/// What it writes about a kernel that handed the machine back on purpose.
-fn done_line() -> String {
-    format!("the last boot read {}", State::Done.named())
-}
-
 /// The two-boot shape both chain judges use: a guest that takes its own reset,
 /// so the loader pass after it is observable.
 fn chained(params: &'static [&'static str]) -> BootOptions {
@@ -1177,7 +1172,7 @@ pub fn blackbox_done_chain(
     first.must_say(&armed_line())?;
 
     let second = after_the_reset(&mut qemu, bootlog::CHAIN_ENDS_LINE);
-    second.must_say(&done_line())?;
+    second.must_say(bootlog::HANDED_BACK)?;
     done_chain(&second)?;
     ended_in_a_reset(&mut resets)?;
     drop(qemu);
@@ -1662,11 +1657,10 @@ pub fn blackbox_foreign_record(
     // The pass that finds it: it must name it and clear it, and it must never
     // report it as this stick's predecessor — which is the whole defect.
     let found = after_the_reset(&mut qemu, bootlog::CHAIN_ENDS_LINE);
-    let said = found.must_say("record another image left in this memory")?.to_string();
-    for word in [State::Done.named(), "cleared and this pass boots its kernel"] {
-        if !said.contains(word) {
-            return Err(format!("the pass reported a foreign record without {word:?}: {said}"));
-        }
+    let said = found.must_say(bootlog::FOREIGN_DONE)?.to_string();
+    let cleared = "cleared and this pass boots its kernel";
+    if !said.contains(cleared) {
+        return Err(format!("the pass reported a foreign record without {cleared:?}: {said}"));
     }
     says_nothing_of(&found, bootlog::PREVIOUS_PANIC)?;
     says_nothing_of(&found, "the last boot read")?;
@@ -1692,7 +1686,7 @@ pub fn blackbox_foreign_record(
 /// points `BootNext` at itself before each handoff and a pass with a finding
 /// appends to the same `loader.log` — so the argument is that file's tail.
 pub fn done_chain(after: &serial::Serial) -> Result<(), String> {
-    after.must_say(&done_line())?;
+    after.must_say(bootlog::HANDED_BACK)?;
     the_tail_is_the_stops(after)?;
     // The distinction the whole state machine exists for: a deliberate stop is
     // not a panic and not a kernel that vanished.
@@ -1703,7 +1697,7 @@ pub fn done_chain(after: &serial::Serial) -> Result<(), String> {
     says_nothing_of(after, bootlog::LOADER_LAST_LINE)?;
     // What its transport went through is on every record, in one line where
     // nothing broke.
-    after.must_say_after(&done_line(), toyos_blackbox::RECOVERY_OPENS_WITH)?;
+    after.must_say_after(bootlog::HANDED_BACK, toyos_blackbox::RECOVERY_OPENS_WITH)?;
     after.must_say(bootlog::CHAIN_ENDS_LINE)?;
     eprintln!("  [power] a deliberate reboot sealed DONE and the chain ended in a reset");
     Ok(())
@@ -1714,7 +1708,7 @@ pub fn done_chain(after: &serial::Serial) -> Result<(), String> {
 /// the last word. Read after the seal,
 /// because the same lines are in the capture on the first boot's console.
 fn the_tail_is_the_stops(after: &serial::Serial) -> Result<(), String> {
-    let head = after.must_say_after(&done_line(), bootlog::LOG_TAIL_HEAD)?.to_string();
+    let head = after.must_say_after(bootlog::HANDED_BACK, bootlog::LOG_TAIL_HEAD)?.to_string();
     let tail: Vec<&str> = after
         .text()
         .lines()
@@ -1867,18 +1861,19 @@ fn one_wedge_phase(params: &'static [&'static str], phase: Phase) -> Result<(),
 /// (`usb_gate::sweep_under_load`): a CPU that takes none is ended half a bound
 /// earlier by `kernel/src/hardlockup`, which is a different mechanism reported
 /// under this arm's name, so this judge names the bound it demands.
-pub fn usb_load_chain(kernel: &serial::Serial, after: &serial::Serial) -> Result<(), String> {
-    kernel.must_say(bootlog::USB_LOAD_RUNNING)?;
+pub fn usb_load_chain(after: &serial::Serial) -> Result<(), String> {
+    after.must_say(bootlog::PREVIOUS_PANIC)?;
+    after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::DEADLINE_EXPIRED)?;
+    // The sweep starts inside the stop, after init had the file made whole, so
+    // its records cross only in the page's tail.
+    after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::USB_LOAD_RUNNING)?;
     // A sweep that refused, one the disk stopped answering, and one that swept
     // its whole span before the reset: each is a boot that measured the idle
     // case again under this arm's name.
-    says_nothing_of(kernel, bootlog::USB_LOAD_REFUSED)?;
-    says_nothing_of(kernel, bootlog::USB_LOAD_STOPPED)?;
-    says_nothing_of(kernel, bootlog::USB_LOAD_SWEPT)?;
-    says_nothing_of(kernel, REBOOTING)?;
-
-    after.must_say(bootlog::PREVIOUS_PANIC)?;
-    after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::DEADLINE_EXPIRED)?;
+    says_nothing_of(after, bootlog::USB_LOAD_REFUSED)?;
+    says_nothing_of(after, bootlog::USB_LOAD_STOPPED)?;
+    says_nothing_of(after, bootlog::USB_LOAD_SWEPT)?;
+    says_nothing_of(after, REBOOTING)?;
     // A page that names the other bound is this arm measuring a hard lockup.
     says_nothing_of(after, bootlog::LOCKED_UP)?;
     // **The account reaching the page is itself under test**: it is made a line
@@ -1942,25 +1937,18 @@ fn usb_wedge_chain(
 /// kernel log to the stick, and a wedged boot's `logd` never runs again — so
 /// everything after the wedge exists only in the record ring, and the black box
 /// is the one channel that carries a copy of it across the reset.
-pub fn deadline_wedge_chain(
-    kernel: &serial::Serial,
-    after: &serial::Serial,
-) -> Result<(), String> {
+pub fn deadline_wedge_chain(after: &serial::Serial) -> Result<(), String> {
+    after.must_say(bootlog::PREVIOUS_PANIC)?;
+    let said = after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::DEADLINE_EXPIRED)?.to_string();
     // The control: the machine reached the staged wedge, and then never reached
     // the reset it was one statement away from.
-    kernel.must_say(bootlog::WEDGE_STAGED)?;
+    after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::WEDGE_STAGED)?;
     // And the CPU that asked for it took interrupts again: it comes through the
     // syscall gate with `IF` masked, and one left deaf is what the lockup
     // detector ends a machine for. On this machine the assertion has a counter
     // behind it, which is what the guest's has not.
-    kernel.must_say(bootlog::WEDGE_ARRIVED_DEAF)?;
-    says_nothing_of(kernel, bootlog::REBOOTING)?;
-
-    after.must_say(bootlog::PREVIOUS_PANIC)?;
-    let said = after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::DEADLINE_EXPIRED)?.to_string();
-    // The tail crossed with it, which is what makes the record an instrument
-    // and not just a verdict.
-    after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::WEDGE_STAGED)?;
+    after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::WEDGE_ARRIVED_DEAF)?;
+    says_nothing_of(after, bootlog::REBOOTING)?;
     // **The two bounds composing, on the one machine that has both.** This
     // wedge spins with `IF` set, so every CPU still takes its timer interrupt
     // and every CPU's performance counter still samples it — and the
@@ -1996,7 +1984,6 @@ pub fn hard_lockup_chain(
     // arm line and the record itself.
     kernel.must_say("by each cpu's own performance counter")?;
     says_nothing_of(kernel, "CPUID states no architectural performance counter")?;
-    says_nothing_of(kernel, bootlog::REBOOTING)?;
 
     after.must_say(bootlog::PREVIOUS_PANIC)?;
     let said = after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::LOCKED_UP)?.to_string();
diff --git a/tests/common/qemu.rs b/tests/common/qemu.rs
index 18b6efae246..5149182ea10 100644
--- a/tests/common/qemu.rs
+++ b/tests/common/qemu.rs
@@ -2706,11 +2706,12 @@ pub fn build_toyos_bin(arch: Arch, crate_path: &Path, name: &str) -> Vec<u8> {
     toyos_build::build::build_toyos_bin(&compile::repo_root(), arch, crate_path, name, quiet)
 }
 
-/// A kernel record's console line: `klogd` renders every one with this head,
-/// and nothing else writes it — a program's line reaches the console only
-/// through `logd`, under the program's own head.
+/// A kernel record's line, whichever writer spelled its head: `klogd`'s console
+/// `[kernel …]` and a `/log` file's `[<date> <time> …]` alike. Nothing else
+/// writes either — a program's line reaches both only through `logd`, under the
+/// program's own head.
 pub fn is_kernel_line(line: &str) -> bool {
-    line.starts_with(toyos_build::kernelconsole::HEAD)
+    line.starts_with(toyos_build::kernelconsole::HEAD) || toyos_logstream::record_ms(line).is_some()
 }
 
 /// A console line's text as its program wrote it: a program's line without
diff --git a/tests/metal-profile.toml b/tests/metal-profile.toml
index 8118a7fd0fc..ded7ce1d4d4 100644
--- a/tests/metal-profile.toml
+++ b/tests/metal-profile.toml
@@ -952,12 +952,6 @@ unit = "us"
 ceiling = 16667
 ceiling_from = "as boot.testcases.panel_max_us"
 
-[[number]]
-name = "boot.foreignrecord.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
 [[number]]
 name = "boot.logstallcase.panel_max_us"
 unit = "us"
@@ -1099,12 +1093,6 @@ unit = "us"
 ceiling = 100000
 ceiling_from = "as boot.testcases.panel_us"
 
-[[number]]
-name = "boot.foreignrecord.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
 [[number]]
 name = "boot.logstallcase.panel_us"
 unit = "us"
@@ -1238,12 +1226,6 @@ unit = "operations"
 ceiling = 0
 ceiling_from = "as boot.testcases.park_open_operations"
 
-[[number]]
-name = "boot.foreignrecord.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
 [[number]]
 name = "boot.logstallcase.park_open_operations"
 unit = "operations"
diff --git a/tests/toyos-rust-tests/src/bin/allocator_stress.rs b/tests/toyos-rust-tests/src/bin/allocator_stress.rs
index 65ad51f8d1c..ec6049cdc68 100644
--- a/tests/toyos-rust-tests/src/bin/allocator_stress.rs
+++ b/tests/toyos-rust-tests/src/bin/allocator_stress.rs
@@ -264,16 +264,11 @@ fn test_memory_stats() {
     let total = u64::from_le_bytes(buf[0..8].try_into().unwrap());
     let used = u64::from_le_bytes(buf[8..16].try_into().unwrap());
 
-    // QEMU is configured with 8GB (test harness uses 4GB)
-    // Total should be in a reasonable range (2-9 GB)
-    let total_gb = total / (1024 * 1024 * 1024);
-    assert!(total_gb >= 2 && total_gb <= 9, "mem_total={total} ({total_gb} GB) out of range");
-
-    // Used should be less than total and non-zero
+    // Bounded by each other and by no machine's size: the T14 runs this too.
     assert!(used > 0, "mem_used=0 — allocator not tracking");
     assert!(used < total, "mem_used={used} >= mem_total={total}");
 
-    println!("  memory stats: ok (total={total_gb}GB, used={}MB)", used / (1024 * 1024));
+    println!("  memory stats: ok (total={}MB, used={}MB)", total / (1024 * 1024), used / (1024 * 1024));
 }
 
 /// Verify that OOM returns an error instead of crashing the kernel.
diff --git a/tests/toyos.rs b/tests/toyos.rs
index b86007fbf0f..70dc6817c91 100644
--- a/tests/toyos.rs
+++ b/tests/toyos.rs
@@ -1872,7 +1872,7 @@ const METAL: &[(&str, metal::Metal)] = &[
         "boot_deadline_ends_a_wedge",
         metal::Metal::Runs {
             arms: &[metal::once("deadlinewedge", "tests/jobcase", &["wedge-before-reset"], &[])],
-            judge: |b| power::deadline_wedge_chain(&b[0].kernel(), &b[0].after_the_reset()?),
+            judge: |b| power::deadline_wedge_chain(&b[0].after_the_reset()?),
         },
     ),
     (
@@ -1884,7 +1884,7 @@ const METAL: &[(&str, metal::Metal)] = &[
         "usb_reset_records_the_phase_it_cut",
         metal::Metal::Runs {
             arms: &[metal::once("usbload", "tests/jobcase", &["usb-reset-under-load"], &[])],
-            judge: |b| power::usb_load_chain(&b[0].kernel(), &b[0].after_the_reset()?),
+            judge: |b| power::usb_load_chain(&b[0].after_the_reset()?),
         },
     ),
     (
@@ -1916,24 +1916,21 @@ const METAL: &[(&str, metal::Metal)] = &[
         // Its own boot, and it must not share one: it deliberately leaves the
         // page holding a record no stick owns, and a boot that then read it as
         // a predecessor's is exactly what the arm above judges.
-        // Its own boot: it deliberately leaves the page holding a record no
-        // stick owns, and a boot that then read it as a predecessor's is the
-        // defect. The T14 runs the same three passes QEMU does — the loader
-        // points `BootNext` at itself, so they are one flash.
         "blackbox_foreign_record",
         metal::Metal::Runs {
             arms: &[metal::once(
                 "foreignrecord",
                 "tests/jobcase",
-                &["blackbox-foreign-identity"],
+                &[toyos_build::metal::FOREIGN_RECORD_ARM],
                 &[],
             )],
             judge: |b| {
                 let after = b[0].after_the_reset()?;
-                let said = after.must_say("record another image left in this memory")?.to_string();
-                // Named and cleared, and never reported as this stick's own.
+                let said = after.must_say(bootlog::FOREIGN_DONE)?.to_string();
                 power::says_nothing_of(&after, bootlog::PREVIOUS_PANIC)?;
                 power::says_nothing_of(&after, "the last boot read")?;
+                // The hang `toyos-metal` admits for this arm, and only this one.
+                after.must_say(bootlog::HUNG_WITHOUT_A_RECORD)?;
                 eprintln!("  [power] {}", said.trim());
                 Ok(())
             },
@@ -1949,7 +1946,7 @@ const METAL: &[(&str, metal::Metal)] = &[
             arms: JOBCASE,
             judge: |b| {
                 power::reset_register_decoded(&b[0].kernel())?;
-                b[0].kernel().must_say(bootlog::REBOOTING).map(|_| ())
+                bootlog::handed_back(b[0].after_the_reset()?.text()).map_err(|why| why.to_string())
             },
         },
     ),
@@ -2373,7 +2370,6 @@ fn c_corpus_metal(
     c_bins: &[(String, Vec<u8>)],
     keep: impl Fn(&str) -> bool,
 ) -> metal::SharedBoot {
-    let dir = compile::testcases_dir();
     let mut jobs = Vec::new();
     let mut files = Vec::new();
     let mut links = Vec::new();
@@ -2382,10 +2378,9 @@ fn c_corpus_metal(
         if !keep(case) || C_METAL_SKIP.iter().any(|(name, _)| name == case) {
             continue;
         }
-        let expect = dir.join(format!("{case}.expect"));
         // A case with no committed expectation is one nothing could judge, and
         // shipping it would be a job that passes by comparing nothing.
-        let Ok(expected) = fs::read(&expect) else { continue };
+        let Some(expected) = c_expectation(case) else { continue };
         // **The kernel truncates a process name**, so two cases whose names
         // agree that far would land under one record. Refused rather than
         // reported, because the second one's verdict would be read as the
@@ -2397,7 +2392,7 @@ fn c_corpus_metal(
                  boot's log cannot tell their verdicts apart"
             );
         }
-        files.push((format!("expect/{case}"), expected));
+        files.push((format!("expect/{case}"), expected.into_bytes()));
         files.push((format!("bin/test_c_{case}"), data.clone()));
         links.push((format!("bin/{case}"), format!("/system/bin/{CCHECK}")));
         jobs.push(case.clone());
@@ -2437,7 +2432,7 @@ fn log_close_survived(back: &metal::Readback) -> Result<(), String> {
              only if the poll outlived the close"
         )
     })?;
-    back.kernel().must_say(bootlog::REBOOTING).map(|_| ())
+    bootlog::handed_back(back.after_the_reset()?.text()).map_err(|why| why.to_string())
 }
 
 /// The renderer's two text colours, as the screendump reports them.
@@ -2888,6 +2883,26 @@ fn kernel_account(result: &TestResult) -> String {
     format!("\n--- what the kernel said{how_many} ---\n{}", lines[dropped..].join("\n"))
 }
 
+/// A case's committed expectation as both comparators read it, the host's and
+/// the guest's `ccheck`, or `None` where none is committed. TinyCC's runner
+/// captured its warnings about the case with its output, and neither compares
+/// them.
+fn c_expectation(case: &str) -> Option<String> {
+    let at = compile::testcases_dir().join(format!("{case}.expect"));
+    let text = match fs::read_to_string(&at) {
+        Ok(text) => text,
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return None,
+        Err(e) => panic!("{}: {e}", at.display()),
+    };
+    let warned = format!("{case}.c:");
+    Some(
+        text.lines()
+            .filter(|l| !(l.starts_with(&warned) && l.contains(": warning: ")))
+            .map(|l| format!("{l}\n"))
+            .collect(),
+    )
+}
+
 fn check_c_result(result: &TestResult) -> bool {
     let test_name = result.name.strip_prefix("test_c_").unwrap_or(&result.name);
 
@@ -2898,16 +2913,7 @@ fn check_c_result(result: &TestResult) -> bool {
 
     match result.exit_code {
         Some(0) => {
-            let expect_file = compile::testcases_dir().join(format!("{test_name}.expect"));
-            if expect_file.exists() {
-                // TinyCC's runner captured its warnings about the case with its output.
-                let warned = format!("{test_name}.c:");
-                let expected: String = fs::read_to_string(&expect_file)
-                    .unwrap()
-                    .lines()
-                    .filter(|l| !(l.starts_with(&warned) && l.contains(": warning: ")))
-                    .map(|l| format!("{l}\n"))
-                    .collect();
+            if let Some(expected) = c_expectation(test_name) {
                 // **The one comparison in this suite that reads a whole capture
                 // as one program's output, on a console every process shares.**
                 // `common::console::verdict` takes the lines that are some
@@ -14707,7 +14713,7 @@ fn xhci_descriptors(log: &str) -> Result<(), String> {
         Ok(())
 }
 
-/// Eight malformed extended-capability lists refused, and the handoff on the real controller.
+/// Eight malformed extended-capability lists refused, and the handoff on every controller.
 ///
 /// Text in, a verdict out: every line it reads is a kernel record, so the
 /// T14's readback and a QEMU boot log are judged by this one predicate.
@@ -14723,30 +14729,52 @@ fn xhci_xecp(log: &str) -> Result<(), String> {
         if !verdict.contains("8/8") {
             return Err(format!("not every malformed list was refused: {verdict}"));
         }
-        // And the walk on the controller QEMU does provide.
-        let Some(real) = log
-            .lines()
-            .find(|l| l.contains("USB Legacy Support") || l.contains("ownership"))
-        else {
-            return Err(format!("no line about the handoff at all:\n{log}"));
-        };
-        // The handoff must precede the reset — a reset that already
+        // And the handoff on every controller, in `take_ownership`'s words for
+        // each outcome that leaves the kernel owning it: no capability
+        // (QEMU's), firmware that never claimed it (the T14's), and firmware
+        // that released it. Each precedes its own reset — a reset that already
         // happened is what the whole capability exists to avoid.
-        let reset = log
-            .find("xHCI: controller reset")
-            .ok_or_else(|| format!("the controller was never reset:\n{log}"))?;
-        let handoff = log.find(real).expect("just found");
-        if handoff > reset {
-            return Err(format!(
-                "the ownership handoff runs after HCRST, which is no handoff at all:\n{log}"
-            ));
+        const HANDED_OVER: &[&str] = &[
+            "xHCI: no USB Legacy Support capability",
+            "xHCI: firmware did not claim the controller",
+            "xHCI: firmware released the controller",
+        ];
+        const KEPT: &[&str] = &[
+            "xHCI: extended capability list unusable",
+            "runs past the register window — no handoff",
+            "xHCI: firmware still owns the controller",
+        ];
+        let mut handoffs = Vec::new();
+        let mut pending: Option<&str> = None;
+        for line in log.lines() {
+            if KEPT.iter().any(|said| line.contains(said)) {
+                return Err(format!("a controller was never handed over: {line}\n{log}"));
+            }
+            if HANDED_OVER.iter().any(|said| line.contains(said)) {
+                if let Some(earlier) = pending.replace(line) {
+                    return Err(format!("a handoff with no reset of its own: {earlier}\n{log}"));
+                }
+            } else if line.contains("xHCI: controller reset") {
+                let Some(handoff) = pending.take() else {
+                    return Err(format!("a controller reset before its handoff: {line}\n{log}"));
+                };
+                handoffs.push(handoff);
+            }
+        }
+        if let Some(unreset) = pending {
+            return Err(format!("a handoff with no reset of its own: {unreset}\n{log}"));
+        }
+        if handoffs.is_empty() {
+            return Err(format!("no controller was handed over and reset:\n{log}"));
         }
         // A controller that still enumerates its bus afterwards.
         if !log.contains("xHCI: controller started") {
             return Err(format!("the controller did not come up:\n{log}"));
         }
         eprintln!("  [xhci] {}", verdict.trim());
-        eprintln!("  [xhci] {}", real.trim());
+        for handoff in handoffs {
+            eprintln!("  [xhci] {}", handoff.trim());
+        }
         Ok(())
 }
 
@@ -17410,7 +17438,7 @@ fn main() {
         // ordinary suite has: green, red, and "measured nothing" — a run that
         // staged images and never reached the machine has no claim to make.
         run.exit(
-            match metal::run(mode, &selected, &boots, &rust_bins, RUST_SKIP, !nocapture && !debug_mode)
+            match metal::run(mode, &selected, &boots, &rust_bins, !nocapture && !debug_mode)
             {
                 metal::Verdict::Green => 0,
                 metal::Verdict::Red => 1,