From c204db14e449dddf6d467eaae5eeb5ee232d1196 Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Tue, 29 Sep 2026 14:53:16 +0200
Subject: [PATCH 1/7] Metal judges read the channel their line crosses on

main's full T14 run at 7e151819 (233 passed, 19 failed) red eleven names
on judges and harness that were wrong about the machine, not on the OS.
Each fix below has a host check fed the readback lines that run printed,
and a mutation that turns it red.

- Serial::alive counted only `[kernel ` heads, so a /log readback, whose
  records open `[<date> <time> <secs> cpuN]`, carried "no kernel output"
  and every must_not_say / must_be_clean refused before judging
  (klogd_hosted, loader_watchdog_arms, hda_tone, hda_client_stall).
  kernel_lines now counts what toyos_logstream::record_ms parses, the one
  reader of a record's head.
- machine_reboot and log_poll_outlives_a_close asked kernel.log for
  `Rebooting.`, which the stop writes after init had the file made whole;
  they now ask bootlog::handed_back of the pass after the reset.
  deadline_wedge_chain and usb_load_chain read `wedge: staged`, the
  arrived-deaf line and `usb-load: sweeping` (and the absences beside
  them) off the page, where they cross; both lose their kernel argument.
  Deletes issues/hardware/the-metal-wedge-judge-reads-a-channel-the-
  wedge-cannot-write.md.
- toyos-metal refused HungWithoutARecord for blackbox_foreign_record's
  image, whose pass after the reset hands the machine back by design. The
  verdict is now boot_verdict(armed, loader, log): an image armed with
  FOREIGN_RECORD_ARM is judged on its log and not refused for that hang,
  and its judge asserts the hand-back line. That page is cleared as
  another image's, so the loop no longer demands the panel census and
  park count off it; their three foreignrecord profile rows are deleted.
- xhci_xecp matched `USB Legacy Support` / `ownership`; the T14 prints
  `firmware did not claim the controller`. The judge now names the three
  outcomes that leave the kernel owning the controller, and no longer
  accepts the "runs past the register window - no handoff" line.
- allocator_stress bounded total memory to 2..=9 GB, a QEMU guest's size;
  the T14 reports 16777216000 bytes. The range is gone; used < total
  stays.
- A shared metal chunk staged only RUST_SKIP helpers its text names, so
  dlopen_dedup's read of /system/bin/test_rs_std_tls failed when std_tls
  rode the other chunk. metal::reached stages every binary the chunk's
  text names that is not already a job; run() and build() lose helpers.
- The guest C comparator compared 03_struct's committed warning line the
  host drops. c_expectation drops it once, and the corpus stages that.

Files issues/build/allocator-stress-bounds-a-failed-reservation-by-
sixteen-gib.md for the 16 GiB try_reserve beside the deleted range.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U6SVYFkdvV2t38KzNrESxs
---
 ...nds-a-failed-reservation-by-sixteen-gib.md |  20 +++
 ...-reads-a-channel-the-wedge-cannot-write.md |  58 --------
 src/metal.rs                                  |  76 ++++++++--
 tests/checks.rs                               | 136 +++++++++++++++++-
 tests/common/metal.rs                         |  96 ++++++++-----
 tests/common/power.rs                         |  38 +++--
 tests/common/serial.rs                        |  19 ++-
 tests/metal-profile.toml                      |  18 ---
 .../src/bin/allocator_stress.rs               |   9 +-
 tests/toyos.rs                                |  68 +++++----
 10 files changed, 351 insertions(+), 187 deletions(-)
 create mode 100644 issues/build/allocator-stress-bounds-a-failed-reservation-by-sixteen-gib.md
 delete mode 100644 issues/hardware/the-metal-wedge-judge-reads-a-channel-the-wedge-cannot-write.md

diff --git a/issues/build/allocator-stress-bounds-a-failed-reservation-by-sixteen-gib.md b/issues/build/allocator-stress-bounds-a-failed-reservation-by-sixteen-gib.md
new file mode 100644
index 00000000000..ef9dc06a8b8
--- /dev/null
+++ b/issues/build/allocator-stress-bounds-a-failed-reservation-by-sixteen-gib.md
@@ -0,0 +1,20 @@
+---
+status: open
+kind: tooling
+opened: 2026-09-29
+---
+
+# `allocator_stress` expects a 16 GiB reservation to fail, which a machine with more memory grants
+
+`test_oom_graceful` (`tests/toyos-rust-tests/src/bin/allocator_stress.rs`)
+asserts `try_reserve(16 * 1024 * 1024 * 1024)` is refused as "way more than
+available RAM". That is a guest's size, as the total-memory range beside it
+was: the shared metal boot runs the same binary on the T14, which reports
+`mem_total=16777216000` (main's T14 run at `7e151819`, boot `shared`), 384 MiB
+short of the reservation. A machine with more than 16 GiB free grants it and
+reds the test.
+
+## Exit condition
+
+The refused size derives from the total `sysinfo` reports rather than from a
+constant.
diff --git a/issues/hardware/the-metal-wedge-judge-reads-a-channel-the-wedge-cannot-write.md b/issues/hardware/the-metal-wedge-judge-reads-a-channel-the-wedge-cannot-write.md
deleted file mode 100644
index a180904bb63..00000000000
--- a/issues/hardware/the-metal-wedge-judge-reads-a-channel-the-wedge-cannot-write.md
+++ /dev/null
@@ -1,58 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-14
----
-
-# The metal wedge judge asserts two records on a channel a wedge cannot write to, so its arm has never passed
-
-`tests/common/power.rs`'s `deadline_wedge_chain` — the judge
-`boot_deadline_ends_a_wedge`'s metal arm runs (`tests/toyos.rs`, `arms:
-&[metal::once("deadlinewedge", ...)]`) — opens with
-
-```rust
-kernel.must_say(bootlog::WEDGE_STAGED)?;
-kernel.must_say(bootlog::WEDGE_ARRIVED_DEAF)?;
-```
-
-`kernel` is `Readback::kernel()`, which is the concatenation of `logd`'s files
-off the stick. Both records are written by `kernel/src/deadline.rs` after every
-CPU has stopped taking scheduler passes, so `logd` is already wedged and neither
-can reach a file it writes. The two records do cross, on the sealed page, and
-the same function asserts them there four lines further down —
-`after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::WEDGE_STAGED)` — which
-is the channel that carries them.
-
-## Measured
-
-Three readbacks, one command each
-(`cargo test --test toyos-build -- --metal --metal-readback <dir>
-boot_deadline_ends_a_wedge`):
-
-| readback | `wedge: staged` in `kernel.log` | in `loader.log` | judge |
-|---|---|---|---|
-| run 50 `deadlinewedge` | 0 | 1, at line 253, under `Previous boot's panic:` at line 34 | EXIT=1 |
-| run 44 `metal-r2-wedge-deadlinewedge` | 0 | 1 | EXIT=1 |
-| run 44 `metal-ctl-wedge-deadlinewedge` | 0 | 0 | — |
-
-The refusal is the same on both: `"wedge: staged, and only the boot deadline
-ends this machine" never reached the deadlinewedge's kernel log`. The boots
-themselves are sound — run 50 read `PASS: the machine booted ToyOS in 1164 ms`,
-EXIT=0, and every number the profile prices for that boot passed its ceiling.
-
-The control arm's zero in both columns is a second fact and not this one: that
-page kept the oldest records that fit, which is
-`issues/diagnostics/a-wedged-boots-record-outgrows-both-channels-that-carry-it.md`.
-
-`cargo run -- --known-red boot_deadline_ends_a_wedge` answers `NOT ON THE LIST`,
-so nothing declared this. `src/tiers.rs`'s relegation record for the name says
-"the metal arm is the machine's own", which reads as an arm that runs.
-
-`power::hard_lockup_chain` beside it was already moved off that channel for this
-reason and says so at the site; the wedge judge was not.
-
-## Exit condition
-
-A `deadlinewedge` readback on which `boot_deadline_ends_a_wedge`'s metal arm
-passes, with the two records asserted on the channel that carries them — and
-nothing asserted on `kernel.log` that a wedge cannot write to it.
diff --git a/src/metal.rs b/src/metal.rs
index b71edc5cd51..845abd37e41 100644
--- a/src/metal.rs
+++ b/src/metal.rs
@@ -775,7 +775,7 @@ pub const FLASHABLE: &[(&str, Flash)] = &[
     // It seals this boot's own record under an identity one bit from this
     // stick's, so the pass that finds it clears it and boots a kernel. The page
     // is memory the loader allocated and the machine is what it was after.
-    ("blackbox-foreign-identity", Flash::Ok),
+    (FOREIGN_RECORD_ARM, Flash::Ok),
     // **The one arm that deliberately stops this machine.** At the shutdown
     // syscall, after the job list, every CPU stops taking scheduler passes.
     // Admissible only because `kernel/src/deadline.rs` is what ends it, which
@@ -864,6 +864,11 @@ pub const LOAD_ARM: &str = "usb-reset-under-load";
 /// forgot it reds every boot it was staged for.
 pub const WEDGE_ARMS: &[&str] = &[WEDGE_ARM, LOCKUP_ARM, LOAD_ARM];
 
+/// The arm whose boot the pass after it reads as a hang on purpose: its record
+/// is sealed under another stick's identity, so that pass clears it and finds
+/// an attempt nothing reported, and hands the machine back.
+pub const FOREIGN_RECORD_ARM: &str = "blackbox-foreign-identity";
+
 /// Whether this image is armed to stop itself, and so owes a sealed record
 /// rather than `Rebooting.`.
 pub fn stages_a_wedge(armed: &[String]) -> bool {
@@ -2103,6 +2108,19 @@ pub fn run(args: &Args) -> Result<Option<u64>, Refusal> {
         write_readback(dir, &loader, &log, back, stick, wire.as_ref(), replied)?;
         println!("readback written to {}", dir.display());
     }
+    let ms = boot_verdict(&armed, &loader, &log)?;
+    // After the stick's own verdict, which stays the one that names a boot
+    // that never reached its network.
+    if let Some((heard, lines)) = &heard {
+        talk_verdict(heard, lines)?;
+    }
+    Ok(Some(ms))
+}
+
+/// The stick's own verdict on one boot, off what its image is armed with, the
+/// loader's file and the log.
+fn boot_verdict(armed: &[String], loader: &str, log: &str) -> Result<u64, Refusal> {
+    let staged_hang = armed.iter().any(|name| name == FOREIGN_RECORD_ARM);
     // **Named by evidence, before the boot record is missed.** A boot that
     // never happened and a boot that failed both leave no `Boot: complete`,
     // and `Unfit::NoBootRecord` says the second where it is often the first.
@@ -2113,10 +2131,10 @@ pub fn run(args: &Args) -> Result<Option<u64>, Refusal> {
     // hand.** The loader bounded a hang and gave the machine back; every
     // other reading of an empty kernel log would send a reader to the wrong
     // place, and `NoBootRecord` would send them to a kernel that never ran.
-    if loader.contains(bootlog::HUNG_WITHOUT_A_RECORD) {
+    if loader.contains(bootlog::HUNG_WITHOUT_A_RECORD) && !staged_hang {
         return Err(Refusal::HungWithoutARecord);
     }
-    if let Some(said) = reported_and_booted_nothing(&loader, &log) {
+    if let Some(said) = reported_and_booted_nothing(loader, log) {
         return Err(Refusal::ReportedAndBootedNothing { said });
     }
     // **An image armed to stop itself is judged by the record its own bound
@@ -2126,19 +2144,15 @@ pub fn run(args: &Args) -> Result<Option<u64>, Refusal> {
     // it was not flashed as. *Which* bound sealed it is the page's to say
     // and not this list's — the arm says a bound was staged, and two of them
     // can reach a staged boot.
-    let ms = if stages_a_wedge(&armed) {
-        wedged_boot(&loader, &log)?
-    } else {
-        let ms = bootlog::verdict(&log).map_err(Refusal::Log)?;
-        bootlog::handed_back(&loader).map_err(Refusal::Log)?;
-        ms
-    };
-    // After the stick's own verdict, which stays the one that names a boot
-    // that never reached its network.
-    if let Some((heard, lines)) = &heard {
-        talk_verdict(heard, lines)?;
+    if stages_a_wedge(armed) {
+        return wedged_boot(loader, log);
     }
-    Ok(Some(ms))
+    let ms = bootlog::verdict(log).map_err(Refusal::Log)?;
+    // The staged hang's pass reads no `DONE`; its judge reads the hand-back.
+    if !staged_hang {
+        bootlog::handed_back(loader).map_err(Refusal::Log)?;
+    }
+    Ok(ms)
 }
 
 /// Where a conversation's facts are written, beside the stick's files.
@@ -3375,4 +3389,36 @@ mod tests {
         let early = locked.replace("for 60004 ms", "for 59000 ms");
         assert_eq!(lockup_lateness_ms(&early), None);
     }
+
+    /// The foreign-record arm's pass after the reset, verbatim from main's T14
+    /// run of `foreignrecord`: the hang it stages is its verdict's premise, and
+    /// the same pass under any other arm is the hang refusal.
+    #[test]
+    fn the_foreign_record_arm_reaches_its_judge_through_the_hang_it_stages() {
+        let loader = format!(
+            "Loader log: the kernel handoff begins, so this file ends here\n{}\n\
+             ToyOS Bootloader 1.0\n\
+             Black box: 0x8000000 held a DONE record another image left in this memory ([63, 12, \
+             b3, 41, e8, dd, 26, 4a, b9, d6, e7, 17, 3a, 83, d6, 18], and this stick is [9c, 12, \
+             b3, 41, e8, dd, 26, 4a, b9, d6, e7, 17, 3a, 83, d6, 18]), armed at \
+             2026-09-29-103651. It has been cleared and this pass boots its kernel\n\
+             Boot attempts: this image has had the machine 1 time(s) without reporting; now 0\n\
+             Boot attempts: the previous boot of this image never reported; the machine is \
+             handed back\n\
+             Loader log: the last boot is accounted for, so this pass resets the machine\n",
+            bootlog::SEPARATOR
+        );
+        let log = "[2026-09-29 10:36:53 1.171 cpu0] Boot: complete (1171ms)\n\
+                   {2026-09-29 10:36:53 1.186 init} init: power: the machine stops, and logd makes \
+                   the log whole first (Reboot)\n";
+        let armed = |names: &[&str]| -> Vec<String> { names.iter().map(|n| (*n).to_string()).collect() };
+        assert_eq!(
+            boot_verdict(&armed(&[FOREIGN_RECORD_ARM, "boot-deadline=120000"]), &loader, log),
+            Ok(1171)
+        );
+        assert_eq!(
+            boot_verdict(&armed(&["boot-deadline=120000"]), &loader, log),
+            Err(Refusal::HungWithoutARecord)
+        );
+    }
 }
diff --git a/tests/checks.rs b/tests/checks.rs
index e1ede6b6831..0add1b5df86 100644
--- a/tests/checks.rs
+++ b/tests/checks.rs
@@ -630,10 +630,144 @@ mod checks {
             .find(|(name, _)| *name == "blackbox_unclaimed_page")
             .map(|(name, decl)| vec![(*name, decl)])
             .ok_or_else(|| "blackbox_unclaimed_page is not registered".to_string())?;
-        let verdict = metal::run(mode, &selected, &[], &[], &[], true);
+        let verdict = metal::run(mode, &selected, &[], &[], true);
         if verdict != metal::Verdict::Green {
             return Err(format!("--metal --list produced {verdict:?}, not Green"));
         }
         Ok(())
     }
+
+    /// The judge a metal registration runs.
+    fn metal_judge(name: &str) -> fn(&[&metal::Readback]) -> Result<(), String> {
+        match METAL.iter().find(|(row, _)| *row == name) {
+            Some((_, metal::Metal::Runs { judge, .. })) => *judge,
+            _ => panic!("{name} runs no metal judge"),
+        }
+    }
+
+    /// One boot's readback, out of a `loader.log` and a `logd` text.
+    fn readback(label: &str, loader: &str, log: &str) -> metal::Readback {
+        let boot = "back_secs 50\nstick_secs 0\n";
+        metal::Readback::new(label, std::path::PathBuf::new(), loader.into(), log.into(), boot)
+            .expect("a boot file naming both numbers")
+    }
+
+    /// The pass before the handoff, which every `loader.log` opens with.
+    const HANDOFF: &str = "Loader log: the kernel handoff begins, so this file ends here\n";
+
+    /// Four judges fed what main's T14 run's readbacks carried, verbatim: each
+    /// record they ask for is written after the file was made whole, so it
+    /// crosses only on the sealed page — and a page without it still reds.
+    #[test]
+    fn metal_judges_read_the_page_for_what_only_the_page_carries() {
+        let done = |tail: &str| {
+            format!(
+                "{HANDOFF}{}\nToyOS Bootloader 1.0\n\
+                 Black box: the last boot read DONE, so it handed the machine back on purpose and \
+                 this chain ends here\n\
+                 | log: this boot's newest records follow, newest first (16)\n{tail}\
+                 Loader log: the last boot is accounted for, so this pass resets the machine\n",
+                bootlog::SEPARATOR
+            )
+        };
+        let rebooted = "| log-tail: [1.516 cpu0] Rebooting.\n";
+        let synced = "| log-tail: [1.516 cpu0] Syncing filesystems...\n";
+
+        let jobcase =
+            "[2026-09-29 10:40:36 0.000 cpu0 boot] ACPI: reset register SystemIO 0xcf9 <- 0x06\n";
+        let judge = metal_judge("machine_reboot");
+        assert_eq!(judge(&[&readback("jobcase", &done(rebooted), jobcase)]), Ok(()));
+        assert!(judge(&[&readback("jobcase", &done(synced), jobcase)]).is_err());
+
+        let testcases = "[2026-09-29 11:11:32 12.720 cpu2] exit: test_rs_null_sink_client_ex pid=12 \
+                         code=0 cpu=42ms\n\
+                         [2026-09-29 11:11:32 12.725 cpu7] exit: echo pid=15 code=0 cpu=0ms\n";
+        let judge = metal_judge("log_poll_outlives_a_close");
+        assert_eq!(judge(&[&readback("testcases", &done(rebooted), testcases)]), Ok(()));
+        assert!(judge(&[&readback("testcases", &done(synced), testcases)]).is_err());
+
+        let wedged = |tail: &str| {
+            format!(
+                "{HANDOFF}{}\nToyOS Bootloader 1.0\n\
+                 Previous boot's panic: the last boot read WEDGED, so a bound of its own ended it \
+                 and this chain ends here\n\
+                 | the boot deadline expired: a bound of 120000 ms, reached at 120061 ms, with this \
+                 machine in `complete`. The tail of the log ring follows ... which is what nothing \
+                 was draining.\n\
+                 | usb-quiesce: no barrier was taken, so this reset is not the shutdown's\n{tail}\
+                 Loader log: the last boot is accounted for, so this pass resets the machine\n",
+                bootlog::SEPARATOR
+            )
+        };
+        let kernel = "[2026-09-29 10:33:28 0.000 cpu0 boot] panic console: armed 1920x1080 \
+                      stride=1920 format=1 at 0x4000000000, write-combining\n";
+        let wedge = "| [1.509 cpu0] wedge: staged, and only the boot deadline ends this machine: \
+                     every CPU stops taking scheduler passes from here\n\
+                     | [1.509 cpu0] wedge: cpu0 arrived with interrupts off, through the syscall \
+                     gate, and takes them again here\n\
+                     | [1.509 cpu1] wedge: cpu1 arrived with interrupts on\n";
+        let judge = metal_judge("boot_deadline_ends_a_wedge");
+        assert_eq!(judge(&[&readback("deadlinewedge", &wedged(wedge), kernel)]), Ok(()));
+        assert!(judge(&[&readback("deadlinewedge", &wedged(""), kernel)]).is_err());
+
+        let sweep = "| [1.526 cpu0] usb-load: sweeping disk 0 from block 6569336 to 7507812, \
+                     rewriting each run with the bytes just read from it, until this machine is \
+                     reset out from under it\n";
+        let judge = metal_judge("usb_reset_records_the_phase_it_cut");
+        assert_eq!(judge(&[&readback("usbload", &wedged(sweep), kernel)]), Ok(()));
+        assert!(judge(&[&readback("usbload", &wedged(""), kernel)]).is_err());
+    }
+
+    /// The selftests boot's handoff on the T14, verbatim: the controller
+    /// publishes USB Legacy Support and firmware never claimed it.
+    #[test]
+    fn the_xecp_judge_reads_the_t14s_handoff() {
+        let t14 = "[2026-09-29 11:05:25 0.253 cpu0] xHCI: xecp selftest 8/8 malformed lists refused\n\
+                   [2026-09-29 11:05:25 0.253 cpu0] xHCI: firmware did not claim the controller \
+                   (USBLEGSUP 0x01002201)\n\
+                   [2026-09-29 11:05:25 0.253 cpu0] xHCI: USBLEGCTLSTS 0xe0000000 -> 0x00000000 \
+                   (SMI generation off)\n\
+                   [2026-09-29 11:05:25 0.253 cpu0] xHCI: controller reset\n\
+                   [2026-09-29 11:05:25 0.254 cpu0] xHCI: controller started\n";
+        assert_eq!(xhci_xecp(t14), Ok(()));
+        // Firmware that kept the controller handed nothing over.
+        let held = t14.replace(
+            "firmware did not claim the controller (USBLEGSUP 0x01002201)",
+            "firmware still owns the controller after 1000ms (USBLEGSUP 0x01010001 -> \
+             0x01010001) — resetting it anyway",
+        );
+        assert!(xhci_xecp(&held).is_err());
+    }
+
+    /// `dlopen_dedup` reads `test_rs_std_tls` by path, and main's T14 run cut
+    /// the shared list so that `std_tls` rode the other chunk.
+    #[test]
+    fn a_shared_chunk_stages_every_binary_its_members_name() {
+        let source = "const NEEDS_A_LIB: &str = \"/system/bin/test_rs_std_tls\";\n";
+        let bins: Vec<(String, Vec<u8>)> = ["dlopen_dedup", "std_tls", "fs_large_file", "libfoo.so"]
+            .iter()
+            .map(|name| ((*name).to_string(), Vec::new()))
+            .collect();
+        let jobs = vec!["test_rs_dlopen_dedup".to_string()];
+        let staged: Vec<String> = metal::reached(&format!("test_rs_dlopen_dedup\n{source}"), &jobs, &bins)
+            .into_iter()
+            .map(|(path, _)| path)
+            .collect();
+        assert_eq!(staged, ["bin/test_rs_std_tls", "lib/libfoo.so"]);
+    }
+
+    /// `03_struct` on the T14, as `ccheck` printed what the case produced: the
+    /// expectation the corpus stages is that, under the guest's `trim_end`.
+    #[test]
+    fn the_c_corpus_stages_the_expectation_the_host_compares() {
+        let got = "12\n34\n12\n34\n56\n78\n~fred()";
+        let boot = c_corpus_metal(&[("03_struct".to_string(), Vec::new())], |_| true);
+        let staged = boot
+            .files
+            .iter()
+            .find(|(path, _)| path == "expect/03_struct")
+            .map(|(_, bytes)| String::from_utf8(bytes.clone()).expect("an expectation is text"))
+            .expect("03_struct's expectation is staged");
+        assert_eq!(staged.trim_end(), got);
+    }
 }
diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 99144fafbfb..9cf80aeb6d6 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -237,6 +237,28 @@ pub struct Readback {
 }
 
 impl Readback {
+    /// One boot's readback out of the three files the loop wrote for it:
+    /// `loader.log`, the `logd` files as one text, and the boot file.
+    pub fn new(label: &str, home: PathBuf, loader: String, log: String, boot: &str) -> Result<Self, String> {
+        let kernel = bootlog::kernel_records(&log);
+        let back_secs = toyos_build::metal::back_secs(boot)
+            .ok_or_else(|| format!("{label}'s boot file names no `back_secs`: {boot:?}"))?;
+        let stick_secs = toyos_build::metal::stick_secs(boot)
+            .ok_or_else(|| format!("{label}'s boot file names no `stick_secs`: {boot:?}"))?;
+        let cable = toyos_build::metal::cable(boot).map_err(|why| format!("{label}: {why}"))?;
+        Ok(Readback {
+            label: label.to_string(),
+            home,
+            boot_ms: bootlog::boot_millis(&kernel),
+            loader,
+            kernel,
+            log,
+            back_secs,
+            stick_secs,
+            cable,
+        })
+    }
+
     /// What the loop heard over the boot's own cable, and the log the machine
     /// served it — or why a boot that was to be talked to has neither.
     ///
@@ -290,6 +312,8 @@ impl Readback {
 
     /// Every `logd` file this boot wrote, as one text, less every program's
     /// line ([`bootlog::kernel_records`]): no program's line is read as the kernel's.
+    /// It ends where init had `logd` make it whole, so what the kernel writes
+    /// inside the stop or a wedge is only on the page ([`Self::after_the_reset`]).
     pub fn kernel(&self) -> Serial {
         Serial::named(&format!("{}'s kernel log", self.label), self.kernel.as_str())
     }
@@ -666,6 +690,28 @@ fn batches(
     Ok(out)
 }
 
+/// What `reachable`, a batch's text, names beside its `jobs`: every binary it
+/// spells `test_rs_<name>` that is not one of them, and every shared library.
+pub fn reached(
+    reachable: &str,
+    jobs: &[String],
+    rust_bins: &[(String, Vec<u8>)],
+) -> Vec<(String, Vec<u8>)> {
+    let mut out = Vec::new();
+    for (name, data) in rust_bins {
+        let staged = format!("test_rs_{name}");
+        // The shared libraries go on whole: a `dlopen` names a path and never a
+        // `test_rs_` literal, so no text could find one — and all of them
+        // together are a fraction of one helper binary.
+        if name.ends_with(".so") {
+            out.push((format!("lib/{name}"), data.clone()));
+        } else if !jobs.contains(&staged) && reachable.contains(&staged) {
+            out.push((format!("bin/{staged}"), data.clone()));
+        }
+    }
+    out
+}
+
 /// Build one batch's image, and answer where it landed.
 fn build(
     root: &Path,
@@ -673,7 +719,6 @@ fn build(
     label: &str,
     batch: &Batch,
     rust_bins: &[(String, Vec<u8>)],
-    helpers: &[&str],
     quiet: bool,
 ) -> Result<PathBuf, String> {
     let home = at(dir, label);
@@ -711,13 +756,13 @@ fn build(
     // and `fault_gates` each panicked on `entity not found`
     // looking for a child nothing had staged.
     //
-    // **Which helper, though, is read rather than assumed.** Staging all of them
+    // **Which binary, though, is read rather than assumed.** Staging all of them
     // on every image cost 150 MB a boot, and a stick is written over `ssh`. A
     // driver reaches a binary as the literal `test_rs_<name>` — the same
     // spelling `suite_split` reads the harness for — so the text a boot could
     // possibly name it in is its job list, its symlink targets, and the source
-    // of every Rust job on it. A helper named nowhere in that is a helper this
-    // boot cannot reach.
+    // of every Rust job on it. A binary named nowhere in that is one this boot
+    // cannot reach.
     if !batch.jobs.is_empty() {
         let bin = root.join("tests/toyos-rust-tests/src/bin");
         let mut reachable = batch.jobs.join(" ");
@@ -734,18 +779,7 @@ fn build(
                 reachable.push_str(&source);
             }
         }
-        for (name, data) in rust_bins {
-            // The shared libraries go on whole: a `dlopen` names a path and
-            // never a `test_rs_` literal, so nothing above could find one — and
-            // all of them together are a fraction of one helper binary.
-            if name.ends_with(".so") {
-                extra.push((format!("lib/{name}"), data.clone()));
-            } else if helpers.contains(&name.as_str())
-                && reachable.contains(&format!("test_rs_{name}"))
-            {
-                extra.push((format!("bin/test_rs_{name}"), data.clone()));
-            }
-        }
+        extra.extend(reached(&reachable, &batch.jobs, rust_bins));
     }
 
     // The build a boot asked for, or — where it asked for none — the one its
@@ -870,24 +904,8 @@ fn read_readback(dir: &Path, label: &str) -> Result<Readback, String> {
     };
     let loader = read(toyos_build::metal::READBACK_LOADER)?;
     let log = read(toyos_build::metal::READBACK_KERNEL)?;
-    let kernel = bootlog::kernel_records(&log);
     let boot = read(toyos_build::metal::READBACK_BOOT)?;
-    let back_secs = toyos_build::metal::back_secs(&boot)
-        .ok_or_else(|| format!("{label}'s boot file names no `back_secs`: {boot:?}"))?;
-    let stick_secs = toyos_build::metal::stick_secs(&boot)
-        .ok_or_else(|| format!("{label}'s boot file names no `stick_secs`: {boot:?}"))?;
-    let cable = toyos_build::metal::cable(&boot).map_err(|why| format!("{label}: {why}"))?;
-    Ok(Readback {
-        label: label.to_string(),
-        home,
-        boot_ms: bootlog::boot_millis(&kernel),
-        loader,
-        kernel,
-        log,
-        back_secs,
-        stick_secs,
-        cable,
-    })
+    Readback::new(label, home, loader, log, &boot)
 }
 
 /// What a metal run established.
@@ -913,10 +931,6 @@ pub fn run(
     tests: &[(&str, &'static Metal)],
     shared: &[SharedBoot],
     rust_bins: &[(String, Vec<u8>)],
-    // Binaries a job spawns that are not jobs themselves: the shared block's
-    // helper children, which discovery leaves out and which nothing else would
-    // then put on the image.
-    helpers: &[&str],
     quiet: bool,
 ) -> Verdict {
     let root = super::compile::repo_root();
@@ -997,7 +1011,7 @@ pub fn run(
             toyos_build::build::build_host_judges(&root, quiet);
         }
         for (label, batch) in &batches {
-            match build(&root, dir, label, batch, rust_bins, helpers, quiet) {
+            match build(&root, dir, label, batch, rust_bins, quiet) {
                 Ok(image) => {
                     eprintln!(
                         "[metal] {label}: {} job(s), armed with {:?} — {}",
@@ -1126,6 +1140,10 @@ pub fn run(
                 }
                 // A boot the file prices a path-taken field for and that
                 // produced none is a boot some *other* bound ended.
+                // The foreign-identity boot's page is cleared by the pass that
+                // reads it, so it owes no field that crosses only there.
+                let cleared =
+                    batches[label.as_str()].params.contains(&toyos_build::metal::FOREIGN_RECORD_ARM);
                 for (field, value) in [
                     ("complete_ms", back.boot_ms),
                     ("back_secs", Some(back.back_secs)),
@@ -1138,7 +1156,7 @@ pub fn run(
                 ] {
                     let name = format!("boot.{label}.{field}");
                     let priced = profile.row(&name).is_some();
-                    if value.is_none() && !priced && PATH_TAKEN.contains(&field) {
+                    if value.is_none() && !priced && (cleared || PATH_TAKEN.contains(&field)) {
                         continue;
                     }
                     let Some(value) = value else {
diff --git a/tests/common/power.rs b/tests/common/power.rs
index 7b16b9f3a93..a7d812fe940 100644
--- a/tests/common/power.rs
+++ b/tests/common/power.rs
@@ -1867,18 +1867,19 @@ fn one_wedge_phase(params: &'static [&'static str], phase: Phase) -> Result<(),
 /// (`usb_gate::sweep_under_load`): a CPU that takes none is ended half a bound
 /// earlier by `kernel/src/hardlockup`, which is a different mechanism reported
 /// under this arm's name, so this judge names the bound it demands.
-pub fn usb_load_chain(kernel: &serial::Serial, after: &serial::Serial) -> Result<(), String> {
-    kernel.must_say(bootlog::USB_LOAD_RUNNING)?;
+pub fn usb_load_chain(after: &serial::Serial) -> Result<(), String> {
+    after.must_say(bootlog::PREVIOUS_PANIC)?;
+    after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::DEADLINE_EXPIRED)?;
+    // The sweep starts inside the stop, after init had the file made whole, so
+    // its records cross only in the page's tail.
+    after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::USB_LOAD_RUNNING)?;
     // A sweep that refused, one the disk stopped answering, and one that swept
     // its whole span before the reset: each is a boot that measured the idle
     // case again under this arm's name.
-    says_nothing_of(kernel, bootlog::USB_LOAD_REFUSED)?;
-    says_nothing_of(kernel, bootlog::USB_LOAD_STOPPED)?;
-    says_nothing_of(kernel, bootlog::USB_LOAD_SWEPT)?;
-    says_nothing_of(kernel, REBOOTING)?;
-
-    after.must_say(bootlog::PREVIOUS_PANIC)?;
-    after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::DEADLINE_EXPIRED)?;
+    says_nothing_of(after, bootlog::USB_LOAD_REFUSED)?;
+    says_nothing_of(after, bootlog::USB_LOAD_STOPPED)?;
+    says_nothing_of(after, bootlog::USB_LOAD_SWEPT)?;
+    says_nothing_of(after, REBOOTING)?;
     // A page that names the other bound is this arm measuring a hard lockup.
     says_nothing_of(after, bootlog::LOCKED_UP)?;
     // **The account reaching the page is itself under test**: it is made a line
@@ -1942,25 +1943,18 @@ fn usb_wedge_chain(
 /// kernel log to the stick, and a wedged boot's `logd` never runs again — so
 /// everything after the wedge exists only in the record ring, and the black box
 /// is the one channel that carries a copy of it across the reset.
-pub fn deadline_wedge_chain(
-    kernel: &serial::Serial,
-    after: &serial::Serial,
-) -> Result<(), String> {
+pub fn deadline_wedge_chain(after: &serial::Serial) -> Result<(), String> {
+    after.must_say(bootlog::PREVIOUS_PANIC)?;
+    let said = after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::DEADLINE_EXPIRED)?.to_string();
     // The control: the machine reached the staged wedge, and then never reached
     // the reset it was one statement away from.
-    kernel.must_say(bootlog::WEDGE_STAGED)?;
+    after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::WEDGE_STAGED)?;
     // And the CPU that asked for it took interrupts again: it comes through the
     // syscall gate with `IF` masked, and one left deaf is what the lockup
     // detector ends a machine for. On this machine the assertion has a counter
     // behind it, which is what the guest's has not.
-    kernel.must_say(bootlog::WEDGE_ARRIVED_DEAF)?;
-    says_nothing_of(kernel, bootlog::REBOOTING)?;
-
-    after.must_say(bootlog::PREVIOUS_PANIC)?;
-    let said = after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::DEADLINE_EXPIRED)?.to_string();
-    // The tail crossed with it, which is what makes the record an instrument
-    // and not just a verdict.
-    after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::WEDGE_STAGED)?;
+    after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::WEDGE_ARRIVED_DEAF)?;
+    says_nothing_of(after, bootlog::REBOOTING)?;
     // **The two bounds composing, on the one machine that has both.** This
     // wedge spins with `IF` set, so every CPU still takes its timer interrupt
     // and every CPU's performance counter still samples it — and the
diff --git a/tests/common/serial.rs b/tests/common/serial.rs
index 94d65a9c1ab..8160ed3d217 100644
--- a/tests/common/serial.rs
+++ b/tests/common/serial.rs
@@ -239,8 +239,10 @@ impl Serial {
         &self.text
     }
 
+    /// Lines that open a kernel record, whichever writer spelled its head: the
+    /// console's `[kernel …]` and a `/log` file's `[<date> <time> …]` alike.
     pub fn kernel_lines(&self) -> usize {
-        self.text.lines().filter(|l| is_kernel_line(l)).count()
+        self.text.lines().filter(|l| toyos_logstream::record_ms(l).is_some()).count()
     }
 
     /// A line carrying a kernel prefix somewhere other than its start, which
@@ -421,6 +423,16 @@ pub fn self_check() -> Result<(), String> {
     // capture looks like when it is not simply empty, and the case a
     // `text.is_empty()` guard would wave through.
     let mute = Serial::named("test capture", "hello from userland\n");
+    // A T14 readback of `/log`, verbatim from the `testcases` boot whose
+    // `klogd_hosted` was refused as carrying no kernel output.
+    let readback = Serial::named(
+        "test capture",
+        "[2026-09-29 11:11:20 0.000 cpu0 boot] panic console: armed 1920x1080 stride=1920 \
+         format=1 at 0x4000000000, write-combining\n\
+         {2026-09-29 11:11:21 1.170 init} init: started logd\n",
+    );
+    let readback_mute =
+        Serial::named("test capture", "{2026-09-29 11:11:21 1.170 init} init: started logd\n");
     let panicking = Serial::named(
         "test capture",
         "[kernel 0.001 cpu0] NVMe: found\n[kernel 0.002 cpu0] PANIC: nope\n",
@@ -440,6 +452,11 @@ pub fn self_check() -> Result<(), String> {
         // The dead gate itself, from both directions.
         ("must_not_say on an empty capture", false, &|| dead.must_not_say("anything")),
         ("must_not_say with no kernel output", false, &|| mute.must_not_say("anything")),
+        ("must_not_say on a /log readback", true, &|| readback.must_not_say("no such line")),
+        ("must_be_clean on a /log readback", true, &|| readback.must_be_clean()),
+        ("must_not_say on a /log readback of programs only", false, &|| {
+            readback_mute.must_not_say("anything")
+        }),
         // must_be_clean
         ("must_be_clean on a clean boot", true, &|| live.must_be_clean()),
         ("must_be_clean on a panic", false, &|| panicking.must_be_clean()),
diff --git a/tests/metal-profile.toml b/tests/metal-profile.toml
index 8118a7fd0fc..ded7ce1d4d4 100644
--- a/tests/metal-profile.toml
+++ b/tests/metal-profile.toml
@@ -952,12 +952,6 @@ unit = "us"
 ceiling = 16667
 ceiling_from = "as boot.testcases.panel_max_us"
 
-[[number]]
-name = "boot.foreignrecord.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
 [[number]]
 name = "boot.logstallcase.panel_max_us"
 unit = "us"
@@ -1099,12 +1093,6 @@ unit = "us"
 ceiling = 100000
 ceiling_from = "as boot.testcases.panel_us"
 
-[[number]]
-name = "boot.foreignrecord.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
 [[number]]
 name = "boot.logstallcase.panel_us"
 unit = "us"
@@ -1238,12 +1226,6 @@ unit = "operations"
 ceiling = 0
 ceiling_from = "as boot.testcases.park_open_operations"
 
-[[number]]
-name = "boot.foreignrecord.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
 [[number]]
 name = "boot.logstallcase.park_open_operations"
 unit = "operations"
diff --git a/tests/toyos-rust-tests/src/bin/allocator_stress.rs b/tests/toyos-rust-tests/src/bin/allocator_stress.rs
index 65ad51f8d1c..ec6049cdc68 100644
--- a/tests/toyos-rust-tests/src/bin/allocator_stress.rs
+++ b/tests/toyos-rust-tests/src/bin/allocator_stress.rs
@@ -264,16 +264,11 @@ fn test_memory_stats() {
     let total = u64::from_le_bytes(buf[0..8].try_into().unwrap());
     let used = u64::from_le_bytes(buf[8..16].try_into().unwrap());
 
-    // QEMU is configured with 8GB (test harness uses 4GB)
-    // Total should be in a reasonable range (2-9 GB)
-    let total_gb = total / (1024 * 1024 * 1024);
-    assert!(total_gb >= 2 && total_gb <= 9, "mem_total={total} ({total_gb} GB) out of range");
-
-    // Used should be less than total and non-zero
+    // Bounded by each other and by no machine's size: the T14 runs this too.
     assert!(used > 0, "mem_used=0 — allocator not tracking");
     assert!(used < total, "mem_used={used} >= mem_total={total}");
 
-    println!("  memory stats: ok (total={total_gb}GB, used={}MB)", used / (1024 * 1024));
+    println!("  memory stats: ok (total={}MB, used={}MB)", total / (1024 * 1024), used / (1024 * 1024));
 }
 
 /// Verify that OOM returns an error instead of crashing the kernel.
diff --git a/tests/toyos.rs b/tests/toyos.rs
index 49200b8c00b..815ff87de51 100644
--- a/tests/toyos.rs
+++ b/tests/toyos.rs
@@ -1854,7 +1854,7 @@ const METAL: &[(&str, metal::Metal)] = &[
         "boot_deadline_ends_a_wedge",
         metal::Metal::Runs {
             arms: &[metal::once("deadlinewedge", "tests/jobcase", &["wedge-before-reset"], &[])],
-            judge: |b| power::deadline_wedge_chain(&b[0].kernel(), &b[0].after_the_reset()?),
+            judge: |b| power::deadline_wedge_chain(&b[0].after_the_reset()?),
         },
     ),
     (
@@ -1866,7 +1866,7 @@ const METAL: &[(&str, metal::Metal)] = &[
         "usb_reset_records_the_phase_it_cut",
         metal::Metal::Runs {
             arms: &[metal::once("usbload", "tests/jobcase", &["usb-reset-under-load"], &[])],
-            judge: |b| power::usb_load_chain(&b[0].kernel(), &b[0].after_the_reset()?),
+            judge: |b| power::usb_load_chain(&b[0].after_the_reset()?),
         },
     ),
     (
@@ -1900,14 +1900,13 @@ const METAL: &[(&str, metal::Metal)] = &[
         // a predecessor's is exactly what the arm above judges.
         // Its own boot: it deliberately leaves the page holding a record no
         // stick owns, and a boot that then read it as a predecessor's is the
-        // defect. The T14 runs the same three passes QEMU does — the loader
-        // points `BootNext` at itself, so they are one flash.
+        // defect.
         "blackbox_foreign_record",
         metal::Metal::Runs {
             arms: &[metal::once(
                 "foreignrecord",
                 "tests/jobcase",
-                &["blackbox-foreign-identity"],
+                &[toyos_build::metal::FOREIGN_RECORD_ARM],
                 &[],
             )],
             judge: |b| {
@@ -1916,6 +1915,8 @@ const METAL: &[(&str, metal::Metal)] = &[
                 // Named and cleared, and never reported as this stick's own.
                 power::says_nothing_of(&after, bootlog::PREVIOUS_PANIC)?;
                 power::says_nothing_of(&after, "the last boot read")?;
+                // The hang `toyos-metal` admits for this arm, and only this one.
+                after.must_say(bootlog::HUNG_WITHOUT_A_RECORD)?;
                 eprintln!("  [power] {}", said.trim());
                 Ok(())
             },
@@ -1931,7 +1932,7 @@ const METAL: &[(&str, metal::Metal)] = &[
             arms: JOBCASE,
             judge: |b| {
                 power::reset_register_decoded(&b[0].kernel())?;
-                b[0].kernel().must_say(bootlog::REBOOTING).map(|_| ())
+                bootlog::handed_back(b[0].after_the_reset()?.text()).map_err(|why| why.to_string())
             },
         },
     ),
@@ -2355,7 +2356,6 @@ fn c_corpus_metal(
     c_bins: &[(String, Vec<u8>)],
     keep: impl Fn(&str) -> bool,
 ) -> metal::SharedBoot {
-    let dir = compile::testcases_dir();
     let mut jobs = Vec::new();
     let mut files = Vec::new();
     let mut links = Vec::new();
@@ -2364,10 +2364,9 @@ fn c_corpus_metal(
         if !keep(case) || C_METAL_SKIP.iter().any(|(name, _)| name == case) {
             continue;
         }
-        let expect = dir.join(format!("{case}.expect"));
         // A case with no committed expectation is one nothing could judge, and
         // shipping it would be a job that passes by comparing nothing.
-        let Ok(expected) = fs::read(&expect) else { continue };
+        let Some(expected) = c_expectation(case) else { continue };
         // **The kernel truncates a process name**, so two cases whose names
         // agree that far would land under one record. Refused rather than
         // reported, because the second one's verdict would be read as the
@@ -2379,7 +2378,7 @@ fn c_corpus_metal(
                  boot's log cannot tell their verdicts apart"
             );
         }
-        files.push((format!("expect/{case}"), expected));
+        files.push((format!("expect/{case}"), expected.into_bytes()));
         files.push((format!("bin/test_c_{case}"), data.clone()));
         links.push((format!("bin/{case}"), format!("/system/bin/{CCHECK}")));
         jobs.push(case.clone());
@@ -2419,7 +2418,7 @@ fn log_close_survived(back: &metal::Readback) -> Result<(), String> {
              only if the poll outlived the close"
         )
     })?;
-    back.kernel().must_say(bootlog::REBOOTING).map(|_| ())
+    bootlog::handed_back(back.after_the_reset()?.text()).map_err(|why| why.to_string())
 }
 
 /// The renderer's two text colours, as the screendump reports them.
@@ -2870,6 +2869,26 @@ fn kernel_account(result: &TestResult) -> String {
     format!("\n--- what the kernel said{how_many} ---\n{}", lines[dropped..].join("\n"))
 }
 
+/// A case's committed expectation as both comparators read it, the host's and
+/// the guest's `ccheck`, or `None` where none is committed. TinyCC's runner
+/// captured its warnings about the case with its output, and neither compares
+/// them.
+fn c_expectation(case: &str) -> Option<String> {
+    let at = compile::testcases_dir().join(format!("{case}.expect"));
+    let text = match fs::read_to_string(&at) {
+        Ok(text) => text,
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return None,
+        Err(e) => panic!("{}: {e}", at.display()),
+    };
+    let warned = format!("{case}.c:");
+    Some(
+        text.lines()
+            .filter(|l| !(l.starts_with(&warned) && l.contains(": warning: ")))
+            .map(|l| format!("{l}\n"))
+            .collect(),
+    )
+}
+
 fn check_c_result(result: &TestResult) -> bool {
     let test_name = result.name.strip_prefix("test_c_").unwrap_or(&result.name);
 
@@ -2880,16 +2899,7 @@ fn check_c_result(result: &TestResult) -> bool {
 
     match result.exit_code {
         Some(0) => {
-            let expect_file = compile::testcases_dir().join(format!("{test_name}.expect"));
-            if expect_file.exists() {
-                // TinyCC's runner captured its warnings about the case with its output.
-                let warned = format!("{test_name}.c:");
-                let expected: String = fs::read_to_string(&expect_file)
-                    .unwrap()
-                    .lines()
-                    .filter(|l| !(l.starts_with(&warned) && l.contains(": warning: ")))
-                    .map(|l| format!("{l}\n"))
-                    .collect();
+            if let Some(expected) = c_expectation(test_name) {
                 // **The one comparison in this suite that reads a whole capture
                 // as one program's output, on a console every process shares.**
                 // `common::console::verdict` takes the lines that are some
@@ -14569,10 +14579,16 @@ fn xhci_xecp(log: &str) -> Result<(), String> {
         if !verdict.contains("8/8") {
             return Err(format!("not every malformed list was refused: {verdict}"));
         }
-        // And the walk on the controller QEMU does provide.
-        let Some(real) = log
-            .lines()
-            .find(|l| l.contains("USB Legacy Support") || l.contains("ownership"))
+        // And the handoff on the real controller, in `take_ownership`'s words
+        // for each outcome that leaves the kernel owning it: no capability
+        // (QEMU's), firmware that never claimed it (the T14's), and firmware
+        // that released it.
+        const HANDED_OVER: &[&str] = &[
+            "xHCI: no USB Legacy Support capability",
+            "xHCI: firmware did not claim the controller",
+            "xHCI: firmware released the controller",
+        ];
+        let Some(real) = log.lines().find(|l| HANDED_OVER.iter().any(|said| l.contains(said)))
         else {
             return Err(format!("no line about the handoff at all:\n{log}"));
         };
@@ -17257,7 +17273,7 @@ fn main() {
         // ordinary suite has: green, red, and "measured nothing" — a run that
         // staged images and never reached the machine has no claim to make.
         run.exit(
-            match metal::run(mode, &selected, &boots, &rust_bins, RUST_SKIP, !nocapture && !debug_mode)
+            match metal::run(mode, &selected, &boots, &rust_bins, !nocapture && !debug_mode)
             {
                 metal::Verdict::Green => 0,
                 metal::Verdict::Red => 1,

From 6737a4427d1e1eb8a078810a96af71f95a505db8 Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Tue, 29 Sep 2026 14:54:49 +0200
Subject: [PATCH 2/7] Issues: close the seven triage files this branch fixes

#615 filed one issue per cause of main's T14 reds at 7e151819. The
seven whose cause c204db14e removes go, each on the host check and
mutation that commit names; the T14 rows they name are the close's
remaining evidence, run before this lands:

- a-readbacks-kernel-records-never-count-as-kernel-output
- a-metal-judge-reads-the-log-file-for-a-record-written-after-it-was-made-whole
- the-metal-loop-refuses-the-hang-the-foreign-record-arm-stages
- the-xecp-judge-names-no-line-the-t14s-handoff-prints
- allocator-stress-bounds-total-memory-by-a-qemu-guests-size
- a-shared-metal-chunk-stages-no-test-binary-another-member-reads
- the-guest-c-comparator-keeps-the-tinycc-warnings-the-host-one-drops

The one citation of the first, in a-metal-only-row-cannot-be-disabled,
goes with it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U6SVYFkdvV2t38KzNrESxs
---
 ...-record-written-after-it-was-made-whole.md | 47 -----------------
 .../a-metal-only-row-cannot-be-disabled.md    |  3 +-
 ...el-records-never-count-as-kernel-output.md | 42 ----------------
 ...ges-no-test-binary-another-member-reads.md | 35 -------------
 ...unds-total-memory-by-a-qemu-guests-size.md | 27 ----------
 ...-the-tinycc-warnings-the-host-one-drops.md | 37 --------------
 ...-the-hang-the-foreign-record-arm-stages.md | 50 -------------------
 ...e-names-no-line-the-t14s-handoff-prints.md | 34 -------------
 8 files changed, 1 insertion(+), 274 deletions(-)
 delete mode 100644 issues/build/a-metal-judge-reads-the-log-file-for-a-record-written-after-it-was-made-whole.md
 delete mode 100644 issues/build/a-readbacks-kernel-records-never-count-as-kernel-output.md
 delete mode 100644 issues/build/a-shared-metal-chunk-stages-no-test-binary-another-member-reads.md
 delete mode 100644 issues/build/allocator-stress-bounds-total-memory-by-a-qemu-guests-size.md
 delete mode 100644 issues/build/the-guest-c-comparator-keeps-the-tinycc-warnings-the-host-one-drops.md
 delete mode 100644 issues/build/the-metal-loop-refuses-the-hang-the-foreign-record-arm-stages.md
 delete mode 100644 issues/build/the-xecp-judge-names-no-line-the-t14s-handoff-prints.md

diff --git a/issues/build/a-metal-judge-reads-the-log-file-for-a-record-written-after-it-was-made-whole.md b/issues/build/a-metal-judge-reads-the-log-file-for-a-record-written-after-it-was-made-whole.md
deleted file mode 100644
index 4639c7e91e0..00000000000
--- a/issues/build/a-metal-judge-reads-the-log-file-for-a-record-written-after-it-was-made-whole.md
+++ /dev/null
@@ -1,47 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-29
----
-
-# A metal judge reads the log file for a record the kernel writes after init made the file whole
-
-On the T14 a boot's `/log` file ends where init had `logd` make it whole
-(`Readback::log_reached_the_stick`, `tests/common/metal.rs`). What the kernel
-writes after that — `Rebooting.`, and every line an actuator staged inside the
-stop prints — reaches only the black-box page, and comes back in the next
-loader pass's `loader.log` under `| log-tail:` or the page's ring. Three
-judges still ask `Readback::kernel()` for such a record:
-
-- `machine_reboot` — `b[0].kernel().must_say(bootlog::REBOOTING)`;
-- `log_poll_outlives_a_close` — the same line at the end of
-  `log_close_survived` (`tests/toyos.rs`);
-- `usb_reset_records_the_phase_it_cut` — `power::usb_load_chain`'s
-  `kernel.must_say(bootlog::USB_LOAD_RUNNING)`.
-
-## Measured
-
-The full T14 run of `main` at `7e151819`
-(EXIT=1):
-
-```
-FAIL log_poll_outlives_a_close: "Rebooting." never reached the testcases's kernel log:
-FAIL usb_reset_records_the_phase_it_cut: "usb-load: sweeping disk 0" never reached the usbload's kernel log:
-FAIL machine_reboot: "Rebooting." never reached the jobcase's kernel log:
-```
-
-Each record is on the page, in each boot's `loader.log`:
-
-```
-testcases/loader.log:53:| log-tail: [12.838 cpu0] Rebooting.
-jobcase/loader.log:52:| log-tail: [1.516 cpu0] Rebooting.
-usbload/loader.log:77:| [1.526 cpu0] usb-load: sweeping disk 0 from block 6569336 to 7507812, rewriting each run with the bytes just read from it, until this machine is reset out from under it
-```
-
-and in no `kernel.log` of the three. Every other assertion these judges make
-before the refused one passed.
-
-## Exit condition
-
-The three judges read each post-flush record off the pass after the reset,
-and a T14 run of the three names reaches their verdicts; then this file is deleted.
diff --git a/issues/build/a-metal-only-row-cannot-be-disabled.md b/issues/build/a-metal-only-row-cannot-be-disabled.md
index f45d44f82db..8e7e5939ccc 100644
--- a/issues/build/a-metal-only-row-cannot-be-disabled.md
+++ b/issues/build/a-metal-only-row-cannot-be-disabled.md
@@ -16,8 +16,7 @@ row before any boot.
 
 ## Measured
 
-`hda_tone` and `hda_client_stall` red on the T14 run of `main` at `7e151819`
-(`issues/build/a-readbacks-kernel-records-never-count-as-kernel-output.md`).
+`hda_tone` and `hda_client_stall` red on the T14 run of `main` at `7e151819`.
 Only the code reading is verified: `check_redlist` tests `schedule.contains`, and
 the metal branch filters `METAL` rows through the same `keep`. Running
 `--known-red hda_tone` and `--list` against a tree with such a row is owed and
diff --git a/issues/build/a-readbacks-kernel-records-never-count-as-kernel-output.md b/issues/build/a-readbacks-kernel-records-never-count-as-kernel-output.md
deleted file mode 100644
index 7a884c03676..00000000000
--- a/issues/build/a-readbacks-kernel-records-never-count-as-kernel-output.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-29
----
-
-# A readback's kernel records never count as kernel output, so every metal judge that asserts an absence reds unjudged
-
-`Serial::alive` (`tests/common/serial.rs`) counts the lines `qemu::is_kernel_line`
-accepts, and that predicate is `line.starts_with("[kernel ")` — the head
-`klogd` gives a record on the virtio console. The stick's `/log` file spells
-the same records `[<date> <time> <secs> cpuN]`, so on a `metal::Readback` the
-count is zero whatever the boot wrote. `must_not_say` and `must_be_clean` call
-`alive()` first, so every metal judge that asserts an absence on
-`Readback::kernel()` or `Readback::log()` refuses before it judges anything.
-
-## Measured
-
-The full T14 run of `main` at `7e151819`
-(EXIT=1), all four off one `testcases` boot that reached `Boot: complete` in
-1165 ms:
-
-```
-FAIL klogd_hosted: the testcases's kernel log carried no kernel output at all (56038 bytes): every assertion below it would be a claim about nothing
-FAIL hda_tone: the testcases's log carried no kernel output at all (69292 bytes): every assertion below it would be a claim about nothing
-FAIL hda_client_stall: the testcases's log carried no kernel output at all (69292 bytes): every assertion below it would be a claim about nothing
-FAIL loader_watchdog_arms: the testcases's kernel log carried no kernel output at all (56038 bytes): every assertion below it would be a claim about nothing
-```
-
-The `testcases` readback's `kernel.log` first line:
-`[2026-09-29 11:11:20 0.000 cpu0 boot] panic console: armed 1920x1080 ...`.
-
-The callers: `klogd_hosted` (`must_be_clean`), `audio::tone_on_metal` and
-`audio::client_stall_on_metal` (`must_not_say`), `power::watchdog_quiet`
-(`kernel.must_not_say`). `hda_tone` and `hda_client_stall` are `METAL_ONLY`
-rows no schedule registers, so `src/redlist.rs` cannot hold them
-(`issues/build/a-metal-only-row-cannot-be-disabled.md`).
-
-## Exit condition
-
-`Serial::alive` recognises a kernel record in the spelling a readback carries,
-and a T14 run of the four names above reaches each judge's own assertions; then this file is deleted.
diff --git a/issues/build/a-shared-metal-chunk-stages-no-test-binary-another-member-reads.md b/issues/build/a-shared-metal-chunk-stages-no-test-binary-another-member-reads.md
deleted file mode 100644
index 651d99549d2..00000000000
--- a/issues/build/a-shared-metal-chunk-stages-no-test-binary-another-member-reads.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-29
----
-
-# A shared metal chunk stages no test binary another member reads, so `dlopen_dedup` finds no `test_rs_std_tls`
-
-`dlopen_dedup`'s last arm reads `/system/bin/test_rs_std_tls` as a
-`DT_NEEDED`-carrying binary. `tests/common/metal.rs`'s `build` puts on an
-image the binaries its own jobs name, every `.so`, and only those `RUST_SKIP`
-helpers some job's source names; `std_tls` is a test and not a helper, so it
-is on an image only when it is a job there. `sized` cut the shared list into
-`shared` and `shared-2`, and `std_tls` ran on `shared-2` while
-`dlopen_dedup` ran on `shared`.
-
-## Measured
-
-The full T14 run of `main` at `7e151819`
-(EXIT=1), boot `shared`, after the two dedup checks passed:
-
-```
-PASS: 8 concurrent loads of one name returned one handle (1)
-thread 'main' (1) panicked at src/bin/dlopen_dedup.rs:42:63:
-read /system/bin/test_rs_std_tls: entity not found
-[... cpu5] exit: test_rs_dlopen_dedup pid=70 code=101 cpu=197ms
-```
-
-`===TEST_START test_rs_std_tls===` is at line 20467 of that log, inside the
-`shared-2` boot.
-
-## Exit condition
-
-A binary a staged job's source names by path is on that job's image whether
-or not it is itself a job there, and a T14 run exits `dlopen_dedup` 0; then this file is deleted.
diff --git a/issues/build/allocator-stress-bounds-total-memory-by-a-qemu-guests-size.md b/issues/build/allocator-stress-bounds-total-memory-by-a-qemu-guests-size.md
deleted file mode 100644
index c07400c6d96..00000000000
--- a/issues/build/allocator-stress-bounds-total-memory-by-a-qemu-guests-size.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-29
----
-
-# `allocator_stress` bounds total memory by a QEMU guest's size, so the T14's 15 GB reds it
-
-`test_memory_stats` (`tests/toyos-rust-tests/src/bin/allocator_stress.rs`)
-asserts `sysinfo`'s total is 2 to 9 GB, because "QEMU is configured with
-8GB". The shared metal boot runs the same binary on the T14.
-
-## Measured
-
-The full T14 run of `main` at `7e151819`
-(EXIT=1), boot `shared`, after every earlier check printed `ok`:
-
-```
-thread 'main' (1) panicked at src/bin/allocator_stress.rs:270:5:
-mem_total=16777216000 (15 GB) out of range
-[... cpu6] exit: test_rs_allocator_stress pid=46 code=101 cpu=92ms
-```
-
-## Exit condition
-
-The bound derives from what the machine reports rather than from one
-guest's size, and a T14 run of the shared boot exits `allocator_stress` 0; then this file is deleted.
diff --git a/issues/build/the-guest-c-comparator-keeps-the-tinycc-warnings-the-host-one-drops.md b/issues/build/the-guest-c-comparator-keeps-the-tinycc-warnings-the-host-one-drops.md
deleted file mode 100644
index 4d40b75ef1c..00000000000
--- a/issues/build/the-guest-c-comparator-keeps-the-tinycc-warnings-the-host-one-drops.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-29
----
-
-# The guest C comparator keeps the TinyCC warnings the host one drops, so `03_struct` reds on the T14
-
-`check_c_result` (`tests/toyos.rs`) drops every `<case>.c:<n>: ... warning:`
-line from a committed `.expect` before comparing, because TinyCC's runner
-captured its warnings with the output. `ccheck`
-(`tests/toyos-rust-tests/src/bin/ccheck.rs`), the metal corpus's comparator,
-compares the staged `.expect` whole. `the_two_comparisons_use_one_rule`
-holds the two to one `trim_end` and does not see the difference.
-`tests/testcases/tinycc/03_struct.expect` opens with
-`03_struct.c:14: warning: attribute '__cleanup__' ignored on type`, and it is
-the one staged case whose expectation carries a warning.
-
-## Measured
-
-The full T14 run of `main` at `7e151819`
-(EXIT=1), boot `ccorpus`:
-
-```
-ccheck: 03_struct: differed at byte 0 — 25 byte(s) produced against 90 expected
-ccheck: 03_struct: got      "12\n34\n12\n34\n56\n78\n~fred()"
-ccheck: 03_struct: expected "03_struct.c:14: warning: attribute '__cleanup__' ignored on type\n12\n34\n12\n34\n56\n78\n~fred()"
-[... cpu7] exit: 03_struct pid=12 code=1 cpu=62ms
-```
-
-The case binary itself exited 0 (`exit: test_c_03_struct pid=13 code=0`).
-
-## Exit condition
-
-The guest and host comparators apply one rule to an expectation's warning
-lines, with the gate that holds them together reading that rule too, and a
-T14 run of the corpus exits `03_struct` 0; then this file is deleted.
diff --git a/issues/build/the-metal-loop-refuses-the-hang-the-foreign-record-arm-stages.md b/issues/build/the-metal-loop-refuses-the-hang-the-foreign-record-arm-stages.md
deleted file mode 100644
index e10ecd63f2b..00000000000
--- a/issues/build/the-metal-loop-refuses-the-hang-the-foreign-record-arm-stages.md
+++ /dev/null
@@ -1,50 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-29
----
-
-# The metal loop refuses the hang the foreign-record arm stages, so `blackbox_foreign_record` never reaches its judge
-
-`blackbox_foreign_record`'s metal arm flashes `tests/jobcase` armed with
-`blackbox-foreign-identity`: the stop seals its record under an identity one
-bit away from the stick's. The pass after the reset clears that record as
-another image's, so no record of this image's boot reaches it, and the
-attempt count reads the boot as a hang and hands the machine back. The QEMU
-half (`power::blackbox_foreign_record`, `tests/common/power.rs`) says that
-second pass "also hands the machine back, and that is right". `toyos-metal`
-(`src/metal.rs`) returns `Refusal::HungWithoutARecord` on any `loader.log`
-carrying `bootlog::HUNG_WITHOUT_A_RECORD`, before the arm's judge runs and
-whatever the image is armed with.
-
-## Measured
-
-The full T14 run of `main` at `7e151819`
-(EXIT=1):
-
-```
-toyos-metal: the last boot of this image was handed the machine and never reported: no panic, no fault and no deliberate handover, which is a hang. This pass refused to boot the same kernel again and gave the machine back, so the machine is free and nothing needs a hand — but this boot measured no test, and why that kernel stopped is the boot before it
-  FAIL foreignrecord: toyos-metal exited exit status: 1
-  FAIL blackbox_foreign_record: toyos-metal exited exit status: 1
-```
-
-The pass after the reset
-(`loader.log`)
-carries the line the judge asks for, then the hang:
-
-```
-Black box: 0x8000000 held a DONE record another image left in this memory ([63, 12, b3, ...], and this stick is [9c, 12, b3, ...]), armed at 2026-09-29-103651. It has been cleared and this pass boots its kernel
-Boot attempts: this image has had the machine 1 time(s) without reporting; now 0
-Slot A: its image 5d1a1666... died on its last boot, so no pass boots it again until an update replaces it
-Boot attempts: the previous boot of this image never reported; the machine is handed back
-```
-
-The kernel's own boot was sound: `Boot: complete (1171ms)`, then init's
-`power: the machine stops`.
-
-## Exit condition
-
-`toyos-metal` hands a boot armed with `blackbox-foreign-identity` to its judge
-instead of refusing the hang it stages, and a T14 run of
-`blackbox_foreign_record` reaches `record another image left in this memory`
-in the judge; then this file is deleted.
diff --git a/issues/build/the-xecp-judge-names-no-line-the-t14s-handoff-prints.md b/issues/build/the-xecp-judge-names-no-line-the-t14s-handoff-prints.md
deleted file mode 100644
index efe1a8083e2..00000000000
--- a/issues/build/the-xecp-judge-names-no-line-the-t14s-handoff-prints.md
+++ /dev/null
@@ -1,34 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-29
----
-
-# The xECP judge names no line the T14's handoff prints
-
-`xhci_xecp` (`tests/toyos.rs`), `xhci_xecp_walk`'s judge on QEMU and on the
-T14, finds the handoff by a line containing `USB Legacy Support` or
-`ownership`. `take_ownership` (`kernel/src/drivers/xhci/legacy.rs`) prints
-one of four lines, and only the one for a controller with no such capability
-— QEMU's — contains either needle. The T14's controllers publish the
-capability with firmware not owning them, and that line is
-`xHCI: firmware did not claim the controller (USBLEGSUP 0x...)`.
-
-## Measured
-
-The full T14 run of `main` at `7e151819`
-(EXIT=1): `FAIL xhci_xecp_walk: no line about the handoff at all:`. The
-`selftests` readback's `kernel.log`
-carries, for each of the two controllers, the self-test and the handoff
-before the reset:
-
-```
-193:[2026-09-29 11:05:25 0.253 cpu0] xHCI: xecp selftest 8/8 malformed lists refused
-194:[2026-09-29 11:05:25 0.253 cpu0] xHCI: firmware did not claim the controller (USBLEGSUP 0x01002201)
-199:[2026-09-29 11:05:25 0.253 cpu0] xHCI: controller reset
-```
-
-## Exit condition
-
-The judge recognises every line `take_ownership` can print about the
-handoff, and a T14 run of `xhci_xecp_walk` passes; then this file is deleted.

From f792460d0a2b13af6c5fb0f07f07fe686c106014 Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Tue, 29 Sep 2026 16:02:49 +0200
Subject: [PATCH 3/7] Metal judges: every controller's handoff, and a foreign
 record sealed DONE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The foreign-identity arm's verdict dropped `handed_back` and put nothing in
its place, so a stop that panicked or that the deadline ended after init's
STOPPING line passed: the kernel seals every state under the foreign
identity. `boot_verdict` and the `blackbox_foreign_record` judge now demand
the loader's `held a DONE record another image left in this memory`
(`bootlog::FOREIGN_DONE`), refused as `Unfit::NoForeignDone`.

`xhci_xecp` judged only the first handoff line and the first reset, and the
T14 prints two controllers. Every `take_ownership` outcome is now paired with
the reset after it: each is one that hands the controller over, precedes its
own reset, and there are as many as there are resets.

`is_kernel_line` is the one definition of a kernel line again: it reads a
`/log` file's dated head as well as the console's `[kernel …]`, and
`kernel_lines` calls it, so `died()` reads a readback's kernel `PANIC:` as
the kernel's.

Answers the review of #616; provenance prose removed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U6SVYFkdvV2t38KzNrESxs
---
 src/bootlog.rs         | 24 ++++++++++++++++
 src/metal.rs           | 20 ++++++++++----
 tests/checks.rs        | 50 ++++++++++++++++++++++++++++------
 tests/common/qemu.rs   |  9 +++---
 tests/common/serial.rs | 10 +++----
 tests/toyos.rs         | 62 ++++++++++++++++++++++++++----------------
 6 files changed, 128 insertions(+), 47 deletions(-)

diff --git a/src/bootlog.rs b/src/bootlog.rs
index 14aa18ad1e4..1614c899284 100644
--- a/src/bootlog.rs
+++ b/src/bootlog.rs
@@ -116,6 +116,12 @@ pub const LOG_TAIL: &str = "log-tail: ";
 /// two registrations whose whole subject is that it stopped.
 pub const HANDED_BACK: &str = "the last boot read DONE";
 
+/// What the loader says, in `bootloader/src/blackbox.rs`, of a `DONE` record
+/// sealed under another stick's identity: the foreign-identity arm's
+/// [`HANDED_BACK`]. The kernel seals every state under that identity, so only
+/// this word says the stop finished rather than panicked or wedged.
+pub const FOREIGN_DONE: &str = "held a DONE record another image left in this memory";
+
 /// The bootloader's own file at the root of the log partition.
 pub const LOADER_LOG: &str = "loader.log";
 
@@ -317,6 +323,9 @@ pub enum Unfit {
     /// The loader pass after the reset read no `DONE`, or read one with no
     /// [`REBOOTING`] in its tail: the stop never finished.
     NotHandedBack,
+    /// The loader pass after the foreign-identity arm's reset read no
+    /// [`FOREIGN_DONE`]: the stop it staged never finished.
+    NoForeignDone,
 }
 
 impl fmt::Display for Unfit {
@@ -334,6 +343,11 @@ impl fmt::Display for Unfit {
                 "the loader's pass after the reset carries no {HANDED_BACK:?} with {REBOOTING:?} \
                  under {LOG_TAIL:?}: the stop this boot asked for never reached the reset"
             ),
+            Self::NoForeignDone => write!(
+                f,
+                "the loader's pass after the reset carries no {FOREIGN_DONE:?}: the stop this \
+                 boot asked for never sealed its record DONE"
+            ),
         }
     }
 }
@@ -350,6 +364,16 @@ pub fn handed_back(loader: &str) -> Result<(), Unfit> {
     }
 }
 
+/// The loader's half of a passing foreign-identity boot, whose own chain the
+/// loader ends as a hang: the record it cleared was sealed `DONE`.
+pub fn foreign_done(loader: &str) -> Result<(), Unfit> {
+    if loader.contains(FOREIGN_DONE) {
+        Ok(())
+    } else {
+        Err(Unfit::NoForeignDone)
+    }
+}
+
 /// Init's line saying the machine stops, the last one `log` carries.
 pub fn stopping_line(log: &str) -> Option<&str> {
     log.lines().rfind(|line| {
diff --git a/src/metal.rs b/src/metal.rs
index 845abd37e41..0d55daf7632 100644
--- a/src/metal.rs
+++ b/src/metal.rs
@@ -2148,8 +2148,9 @@ fn boot_verdict(armed: &[String], loader: &str, log: &str) -> Result<u64, Refusa
         return wedged_boot(loader, log);
     }
     let ms = bootlog::verdict(log).map_err(Refusal::Log)?;
-    // The staged hang's pass reads no `DONE`; its judge reads the hand-back.
-    if !staged_hang {
+    if staged_hang {
+        bootlog::foreign_done(loader).map_err(Refusal::Log)?;
+    } else {
         bootlog::handed_back(loader).map_err(Refusal::Log)?;
     }
     Ok(ms)
@@ -3390,9 +3391,9 @@ mod tests {
         assert_eq!(lockup_lateness_ms(&early), None);
     }
 
-    /// The foreign-record arm's pass after the reset, verbatim from main's T14
-    /// run of `foreignrecord`: the hang it stages is its verdict's premise, and
-    /// the same pass under any other arm is the hang refusal.
+    /// The foreign-record arm's pass after the reset: the hang it stages is its
+    /// verdict's premise, the record it cleared says the stop finished, and the
+    /// same pass under any other arm is the hang refusal.
     #[test]
     fn the_foreign_record_arm_reaches_its_judge_through_the_hang_it_stages() {
         let loader = format!(
@@ -3420,5 +3421,14 @@ mod tests {
             boot_verdict(&armed(&["boot-deadline=120000"]), &loader, log),
             Err(Refusal::HungWithoutARecord)
         );
+        // A stop that panicked or that a bound ended seals under the foreign
+        // identity too, and hands the machine back the same way.
+        for state in ["PANIC", "WEDGED"] {
+            let ended = loader.replace("held a DONE record", &format!("held a {state} record"));
+            assert_eq!(
+                boot_verdict(&armed(&[FOREIGN_RECORD_ARM, "boot-deadline=120000"]), &ended, log),
+                Err(Refusal::Log(bootlog::Unfit::NoForeignDone))
+            );
+        }
     }
 }
diff --git a/tests/checks.rs b/tests/checks.rs
index 0add1b5df86..ba2730918dc 100644
--- a/tests/checks.rs
+++ b/tests/checks.rs
@@ -655,9 +655,9 @@ mod checks {
     /// The pass before the handoff, which every `loader.log` opens with.
     const HANDOFF: &str = "Loader log: the kernel handoff begins, so this file ends here\n";
 
-    /// Four judges fed what main's T14 run's readbacks carried, verbatim: each
-    /// record they ask for is written after the file was made whole, so it
-    /// crosses only on the sealed page — and a page without it still reds.
+    /// Four judges fed a T14 readback's lines: each record they ask for is
+    /// written after the file was made whole, so it crosses only on the sealed
+    /// page — and a page without it still reds.
     #[test]
     fn metal_judges_read_the_page_for_what_only_the_page_carries() {
         let done = |tail: &str| {
@@ -718,8 +718,33 @@ mod checks {
         assert!(judge(&[&readback("usbload", &wedged(""), kernel)]).is_err());
     }
 
-    /// The selftests boot's handoff on the T14, verbatim: the controller
-    /// publishes USB Legacy Support and firmware never claimed it.
+    /// The foreign-identity arm's pass after the reset: the record it cleared
+    /// was sealed `DONE`, so the stop the arm staged finished.
+    #[test]
+    fn the_foreign_record_judge_demands_the_stop_sealed_done() {
+        let loader = format!(
+            "{HANDOFF}{}\nToyOS Bootloader 1.0\n\
+             Black box: 0x8000000 held a DONE record another image left in this memory ([3e, d4, \
+             0b, d4, 87, ad, 6a, 47, 84, b4, af, c3, f3, 6b, f7, 81], and this stick is [c1, d4, \
+             0b, d4, 87, ad, 6a, 47, 84, b4, af, c3, f3, 6b, f7, 81]), armed at 2026-09-29-131341. \
+             It has been cleared and this pass boots its kernel\n\
+             Boot attempts: this image has had the machine 1 time(s) without reporting; now 0\n\
+             {}\n\
+             Loader log: the last boot is accounted for, so this pass resets the machine\n",
+            bootlog::SEPARATOR,
+            bootlog::HUNG_WITHOUT_A_RECORD
+        );
+        let kernel = "[2026-09-29 13:13:43 1.171 cpu0] Boot: complete (1171ms)\n";
+        let judge = metal_judge("blackbox_foreign_record");
+        assert_eq!(judge(&[&readback("foreignrecord", &loader, kernel)]), Ok(()));
+        for state in ["PANIC", "WEDGED"] {
+            let ended = loader.replace("held a DONE record", &format!("held a {state} record"));
+            assert!(judge(&[&readback("foreignrecord", &ended, kernel)]).is_err());
+        }
+    }
+
+    /// A T14 controller's handoff: it publishes USB Legacy Support and
+    /// firmware never claimed it. The T14 has two, and each is judged.
     #[test]
     fn the_xecp_judge_reads_the_t14s_handoff() {
         let t14 = "[2026-09-29 11:05:25 0.253 cpu0] xHCI: xecp selftest 8/8 malformed lists refused\n\
@@ -730,6 +755,7 @@ mod checks {
                    [2026-09-29 11:05:25 0.253 cpu0] xHCI: controller reset\n\
                    [2026-09-29 11:05:25 0.254 cpu0] xHCI: controller started\n";
         assert_eq!(xhci_xecp(t14), Ok(()));
+        assert_eq!(xhci_xecp(&format!("{t14}{t14}")), Ok(()));
         // Firmware that kept the controller handed nothing over.
         let held = t14.replace(
             "firmware did not claim the controller (USBLEGSUP 0x01002201)",
@@ -737,10 +763,16 @@ mod checks {
              0x01010001) — resetting it anyway",
         );
         assert!(xhci_xecp(&held).is_err());
+        assert!(xhci_xecp(&format!("{t14}{held}")).is_err());
+        // A second controller's handoff with no reset of its own, and a reset
+        // with no handoff before it.
+        let unreset = t14.replace("xHCI: controller reset", "xHCI: 34 scratchpad buffers configured");
+        assert!(xhci_xecp(&format!("{t14}{unreset}")).is_err());
+        let unhanded = t14.replace("firmware did not claim the controller", "USB 3.1 on ports 2..=5");
+        assert!(xhci_xecp(&format!("{t14}{unhanded}")).is_err());
     }
 
-    /// `dlopen_dedup` reads `test_rs_std_tls` by path, and main's T14 run cut
-    /// the shared list so that `std_tls` rode the other chunk.
+    /// `dlopen_dedup` reads `test_rs_std_tls` by path.
     #[test]
     fn a_shared_chunk_stages_every_binary_its_members_name() {
         let source = "const NEEDS_A_LIB: &str = \"/system/bin/test_rs_std_tls\";\n";
@@ -756,8 +788,8 @@ mod checks {
         assert_eq!(staged, ["bin/test_rs_std_tls", "lib/libfoo.so"]);
     }
 
-    /// `03_struct` on the T14, as `ccheck` printed what the case produced: the
-    /// expectation the corpus stages is that, under the guest's `trim_end`.
+    /// `03_struct`'s output as `ccheck` prints it: the expectation the corpus
+    /// stages is that, under the guest's `trim_end`.
     #[test]
     fn the_c_corpus_stages_the_expectation_the_host_compares() {
         let got = "12\n34\n12\n34\n56\n78\n~fred()";
diff --git a/tests/common/qemu.rs b/tests/common/qemu.rs
index fb4b98710d4..8ec716ce41e 100644
--- a/tests/common/qemu.rs
+++ b/tests/common/qemu.rs
@@ -3004,11 +3004,12 @@ pub fn build_toyos_bins(crate_path: &Path) -> Vec<(String, Vec<u8>)> {
     toyos_build::build::build_toyos_bins(&repo, SUITE_ARCH, crate_path, quiet)
 }
 
-/// A kernel record's console line: `klogd` renders every one with this head,
-/// and nothing else writes it — a program's line reaches the console only
-/// through `logd`, under the program's own head.
+/// A kernel record's line, whichever writer spelled its head: `klogd`'s console
+/// `[kernel …]` and a `/log` file's `[<date> <time> …]` alike. Nothing else
+/// writes either — a program's line reaches both only through `logd`, under the
+/// program's own head.
 pub fn is_kernel_line(line: &str) -> bool {
-    line.starts_with(toyos_build::kernelconsole::HEAD)
+    line.starts_with(toyos_build::kernelconsole::HEAD) || toyos_logstream::record_ms(line).is_some()
 }
 
 /// A console line's text as its program wrote it: a program's line without
diff --git a/tests/common/serial.rs b/tests/common/serial.rs
index 8160ed3d217..5e0d4344ca0 100644
--- a/tests/common/serial.rs
+++ b/tests/common/serial.rs
@@ -239,10 +239,8 @@ impl Serial {
         &self.text
     }
 
-    /// Lines that open a kernel record, whichever writer spelled its head: the
-    /// console's `[kernel …]` and a `/log` file's `[<date> <time> …]` alike.
     pub fn kernel_lines(&self) -> usize {
-        self.text.lines().filter(|l| toyos_logstream::record_ms(l).is_some()).count()
+        self.text.lines().filter(|l| is_kernel_line(l)).count()
     }
 
     /// A line carrying a kernel prefix somewhere other than its start, which
@@ -423,8 +421,7 @@ pub fn self_check() -> Result<(), String> {
     // capture looks like when it is not simply empty, and the case a
     // `text.is_empty()` guard would wave through.
     let mute = Serial::named("test capture", "hello from userland\n");
-    // A T14 readback of `/log`, verbatim from the `testcases` boot whose
-    // `klogd_hosted` was refused as carrying no kernel output.
+    // A readback of `/log`, whose kernel records open with a date.
     let readback = Serial::named(
         "test capture",
         "[2026-09-29 11:11:20 0.000 cpu0 boot] panic console: armed 1920x1080 stride=1920 \
@@ -588,6 +585,9 @@ pub fn self_check() -> Result<(), String> {
         ("libc panic: panicked at src/main.rs:9:1:", Some(Died::Panicked)),
         // The one the naive fix cannot tell from the kernel's, and must.
         ("PANIC: printed by a program that felt like printing it", Some(Died::Panicked)),
+        // A `/log` readback's heads: the kernel's panic, and a program's.
+        ("[2026-09-29 11:11:22 2.000 cpu1] PANIC: nope", Some(Died::Kernel)),
+        ("{2026-09-29 11:11:22 2.000 init} PANIC: printed by init", Some(Died::Panicked)),
         // Nothing died.
         ("[kernel 0.377 cpu0] NVMe: found", None),
         ("hello from userland", None),
diff --git a/tests/toyos.rs b/tests/toyos.rs
index 64c58961fc6..61dd7a86bfc 100644
--- a/tests/toyos.rs
+++ b/tests/toyos.rs
@@ -1904,9 +1904,6 @@ const METAL: &[(&str, metal::Metal)] = &[
         // Its own boot, and it must not share one: it deliberately leaves the
         // page holding a record no stick owns, and a boot that then read it as
         // a predecessor's is exactly what the arm above judges.
-        // Its own boot: it deliberately leaves the page holding a record no
-        // stick owns, and a boot that then read it as a predecessor's is the
-        // defect.
         "blackbox_foreign_record",
         metal::Metal::Runs {
             arms: &[metal::once(
@@ -1917,8 +1914,9 @@ const METAL: &[(&str, metal::Metal)] = &[
             )],
             judge: |b| {
                 let after = b[0].after_the_reset()?;
-                let said = after.must_say("record another image left in this memory")?.to_string();
-                // Named and cleared, and never reported as this stick's own.
+                // Named and cleared, and never reported as this stick's own; and
+                // `DONE`, so the stop it staged finished.
+                let said = after.must_say(bootlog::FOREIGN_DONE)?.to_string();
                 power::says_nothing_of(&after, bootlog::PREVIOUS_PANIC)?;
                 power::says_nothing_of(&after, "the last boot read")?;
                 // The hang `toyos-metal` admits for this arm, and only this one.
@@ -14573,7 +14571,7 @@ fn xhci_descriptors(log: &str) -> Result<(), String> {
         Ok(())
 }
 
-/// Eight malformed extended-capability lists refused, and the handoff on the real controller.
+/// Eight malformed extended-capability lists refused, and the handoff on every controller.
 ///
 /// Text in, a verdict out: every line it reads is a kernel record, so the
 /// T14's readback and a QEMU boot log are judged by this one predicate.
@@ -14589,36 +14587,52 @@ fn xhci_xecp(log: &str) -> Result<(), String> {
         if !verdict.contains("8/8") {
             return Err(format!("not every malformed list was refused: {verdict}"));
         }
-        // And the handoff on the real controller, in `take_ownership`'s words
-        // for each outcome that leaves the kernel owning it: no capability
+        // And the handoff on every controller, in `take_ownership`'s words for
+        // each outcome that leaves the kernel owning it: no capability
         // (QEMU's), firmware that never claimed it (the T14's), and firmware
-        // that released it.
+        // that released it. Each precedes its own reset — a reset that already
+        // happened is what the whole capability exists to avoid.
         const HANDED_OVER: &[&str] = &[
             "xHCI: no USB Legacy Support capability",
             "xHCI: firmware did not claim the controller",
             "xHCI: firmware released the controller",
         ];
-        let Some(real) = log.lines().find(|l| HANDED_OVER.iter().any(|said| l.contains(said)))
-        else {
-            return Err(format!("no line about the handoff at all:\n{log}"));
-        };
-        // The handoff must precede the reset — a reset that already
-        // happened is what the whole capability exists to avoid.
-        let reset = log
-            .find("xHCI: controller reset")
-            .ok_or_else(|| format!("the controller was never reset:\n{log}"))?;
-        let handoff = log.find(real).expect("just found");
-        if handoff > reset {
-            return Err(format!(
-                "the ownership handoff runs after HCRST, which is no handoff at all:\n{log}"
-            ));
+        const KEPT: &[&str] = &[
+            "xHCI: extended capability list unusable",
+            "runs past the register window — no handoff",
+            "xHCI: firmware still owns the controller",
+        ];
+        let mut handoffs = Vec::new();
+        let mut pending: Option<&str> = None;
+        for line in log.lines() {
+            if KEPT.iter().any(|said| line.contains(said)) {
+                return Err(format!("a controller was never handed over: {line}\n{log}"));
+            }
+            if HANDED_OVER.iter().any(|said| line.contains(said)) {
+                if let Some(earlier) = pending.replace(line) {
+                    return Err(format!("a handoff with no reset of its own: {earlier}\n{log}"));
+                }
+            } else if line.contains("xHCI: controller reset") {
+                let Some(handoff) = pending.take() else {
+                    return Err(format!("a controller reset before its handoff: {line}\n{log}"));
+                };
+                handoffs.push(handoff);
+            }
+        }
+        if let Some(unreset) = pending {
+            return Err(format!("a handoff with no reset of its own: {unreset}\n{log}"));
+        }
+        if handoffs.is_empty() {
+            return Err(format!("no controller was handed over and reset:\n{log}"));
         }
         // A controller that still enumerates its bus afterwards.
         if !log.contains("xHCI: controller started") {
             return Err(format!("the controller did not come up:\n{log}"));
         }
         eprintln!("  [xhci] {}", verdict.trim());
-        eprintln!("  [xhci] {}", real.trim());
+        for handoff in handoffs {
+            eprintln!("  [xhci] {}", handoff.trim());
+        }
         Ok(())
 }
 

From b4e752c120e3d7c5a8235e544157160adb45ea2f Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Tue, 29 Sep 2026 16:09:52 +0200
Subject: [PATCH 4/7] Issues: hda_client_stall reads one resume where its judge
 wants two

The T14 run at 6737a442 cleared the kernel-output cause of the row's red,
and it reds now on `soundd resumed 0 time(s)`. The file records the lines
the log carries and the window the judge cut; the cause is not measured.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U6SVYFkdvV2t38KzNrESxs
---
 ...ds-one-resume-where-its-judge-wants-two.md | 50 +++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 issues/audio/hda-client-stall-reads-one-resume-where-its-judge-wants-two.md

diff --git a/issues/audio/hda-client-stall-reads-one-resume-where-its-judge-wants-two.md b/issues/audio/hda-client-stall-reads-one-resume-where-its-judge-wants-two.md
new file mode 100644
index 00000000000..01804c4d582
--- /dev/null
+++ b/issues/audio/hda-client-stall-reads-one-resume-where-its-judge-wants-two.md
@@ -0,0 +1,50 @@
+---
+status: open
+kind: defect
+opened: 2026-09-29
+---
+
+# `hda_client_stall` reads one resume on the T14 where its judge wants two
+
+The T14 run of `wt/toyos-metaljudges` at `6737a442` reds the row with:
+
+```
+FAIL hda_client_stall: soundd resumed 0 time(s) — the second stream did not find a suspended daemon, so nothing here tests a resume:
+```
+
+The job itself exits 0 and prints `stalled 8 then 2 times, soundd survived`.
+Its cause is not measured; whether the judge or soundd is wrong is open.
+
+## Measured
+
+The `testcases` boot's log, from the job's spawn to its end, in order:
+
+```
+{… 6.275 soundd} soundd: client 0 removed (closed)
+[… 6.276 cpu6] spawn: /system/bin/test_rs_hda_client_stall pid=9 …
+{… 6.276 soundd} soundd: wakes=662 … clients=0 …
+{… 6.333 tid=1 soundd} soundd: opening stream: 44100Hz 2ch fmt=0
+{… 6.333 soundd} soundd: client 0 connected (id=1)
+{… 8.565 soundd} soundd: client 1 removed (closed)
+{… 8.565 soundd} soundd: wakes=126 … clients=0 …
+{… 8.585 soundd} soundd: suspended
+{… 8.836 tid=1 soundd} soundd: opening stream: 44100Hz 2ch fmt=0
+{… 8.836 soundd} soundd: client 0 connected (id=2)
+{… 8.836 soundd} soundd: resumed
+{… 9.755 soundd} soundd: wakes=480 … clients=0 …
+{… 9.780 soundd} soundd: suspended
+```
+
+- The window `tests/common/audio.rs`'s `job_window` cut for two sessions ends
+  at the `8.565` stats line: the `clients=0` stats line at `6.276`, after the
+  spawn and before the first stream opens, is counted as the first session's
+  end. The printed window carries no `soundd: resumed`.
+- Across the job's whole span the log carries one `soundd: resumed`, at the
+  second stream. The first stream opens with no `soundd: suspended` between
+  the previous client's removal at `6.275` and its open at `6.333`, so
+  `client_stall_on_metal`'s `resumes < 2` reds on that span too.
+
+## Exit condition
+
+`hda_client_stall` PASS on the orchestrator's T14 run of the head that lands
+the fix, and this file is deleted.

From a18220a0652a5b18daafa46f8baec5c7de2af421 Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Tue, 29 Sep 2026 22:00:49 +0200
Subject: [PATCH 5/7] Answer the third review of #616: the foreign verdict
 reads the pass after the reset

- `bootlog::foreign_done` searched the whole `loader.log`. The pass before
  the handoff clears a stale foreign `DONE` record with the same line, so it
  let `toyos-metal` exit 0 for a stop that the pass after the reset read as
  `PANIC` or `WEDGED`. It now reads from `SEPARATOR` on, through
  `bootlog::after_the_reset`, and `Readback::after_the_reset` makes its cut
  with the same function. `metal::tests` carries the review's stale case,
  and the registered judge's check carries it too.
- `xhci_xecp` had two arms that no check could fail: the `KEPT` refusal, and
  the refusal of a handoff that the next one overtakes. The review's cases
  `{t14}{kept}` and `{unreset}{t14}` now cover them.
- `metal::clears_its_own_page` says which arm's page the pass after its
  reset clears. `boot_verdict` and the harness's boot facts both ask it.
- `reached` stages a binary only where the text names it whole:
  `test_rs_std_tls_dlopen` does not name `test_rs_std_tls`.
- The QEMU half of `blackbox_foreign_record` reads `bootlog::FOREIGN_DONE`.
  `the_loader_writes_the_lines_the_host_reads` holds that line to the
  loader's format, with `State::Done`'s own word in its hole.
- The judge's `HUNG_WITHOUT_A_RECORD` assertion gets a case that fails it.
- `hard_lockup_chain` stops asserting that `/log` lacks `Rebooting.`, a line
  that never appears there.
- The "Named and cleared" comment is deleted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/bootlog.rs        | 21 +++++++++++++++++----
 src/metal.rs          | 17 ++++++++++++++++-
 tests/checks.rs       | 24 +++++++++++++++++++-----
 tests/common/metal.rs | 19 +++++++++++--------
 tests/common/power.rs | 10 ++++------
 tests/toyos.rs        |  2 --
 6 files changed, 67 insertions(+), 26 deletions(-)

diff --git a/src/bootlog.rs b/src/bootlog.rs
index 1614c899284..8ac0fe2faee 100644
--- a/src/bootlog.rs
+++ b/src/bootlog.rs
@@ -367,13 +367,19 @@ pub fn handed_back(loader: &str) -> Result<(), Unfit> {
 /// The loader's half of a passing foreign-identity boot, whose own chain the
 /// loader ends as a hang: the record it cleared was sealed `DONE`.
 pub fn foreign_done(loader: &str) -> Result<(), Unfit> {
-    if loader.contains(FOREIGN_DONE) {
-        Ok(())
-    } else {
-        Err(Unfit::NoForeignDone)
+    // The pass before the handoff clears a stale foreign record the same way.
+    match after_the_reset(loader) {
+        Some(after) if after.contains(FOREIGN_DONE) => Ok(()),
+        _ => Err(Unfit::NoForeignDone),
     }
 }
 
+/// `loader.log` from [`SEPARATOR`] on: the pass that read what this boot left,
+/// or `None` where the chain did not go round.
+pub fn after_the_reset(loader: &str) -> Option<&str> {
+    loader.find(SEPARATOR).map(|at| &loader[at..])
+}
+
 /// Init's line saying the machine stops, the last one `log` carries.
 pub fn stopping_line(log: &str) -> Option<&str> {
     log.lines().rfind(|line| {
@@ -664,6 +670,13 @@ mod tests {
                 path.display()
             );
         }
+        // A format and not a constant: the loader fills its hole with the
+        // state's own word.
+        let path =
+            std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("bootloader/src/blackbox.rs");
+        let source = std::fs::read_to_string(&path).expect("a loader module");
+        let format = FOREIGN_DONE.replacen(toyos_blackbox::State::Done.named(), "{}", 1);
+        assert!(source.contains(&format), "{} formats no {format:?}", path.display());
     }
 
     #[test]
diff --git a/src/metal.rs b/src/metal.rs
index 429213b0925..3b7966c2846 100644
--- a/src/metal.rs
+++ b/src/metal.rs
@@ -875,6 +875,13 @@ pub fn stages_a_wedge(armed: &[String]) -> bool {
     armed.iter().any(|name| WEDGE_ARMS.contains(&name.as_str()))
 }
 
+/// Whether this image is armed so the pass after its reset clears its record
+/// as another image's: nothing crosses on the page but the record's state, and
+/// that pass hands the machine back as a hang.
+pub fn clears_its_own_page(armed: &[impl AsRef<str>]) -> bool {
+    armed.iter().any(|name| name.as_ref() == FOREIGN_RECORD_ARM)
+}
+
 /// [`FLASHABLE`]'s ruling on `name`, or `None` where nobody has made one.
 pub fn flash_ruling(name: &str) -> Option<Flash> {
     // The two parameters that carry a value are not names: the black-box page's
@@ -2120,7 +2127,7 @@ pub fn run(args: &Args) -> Result<Option<u64>, Refusal> {
 /// The stick's own verdict on one boot, off what its image is armed with, the
 /// loader's file and the log.
 fn boot_verdict(armed: &[String], loader: &str, log: &str) -> Result<u64, Refusal> {
-    let staged_hang = armed.iter().any(|name| name == FOREIGN_RECORD_ARM);
+    let staged_hang = clears_its_own_page(armed);
     // **Named by evidence, before the boot record is missed.** A boot that
     // never happened and a boot that failed both leave no `Boot: complete`,
     // and `Unfit::NoBootRecord` says the second where it is often the first.
@@ -3429,6 +3436,14 @@ mod tests {
                 boot_verdict(&armed(&[FOREIGN_RECORD_ARM, "boot-deadline=120000"]), &ended, log),
                 Err(Refusal::Log(bootlog::Unfit::NoForeignDone))
             );
+            // The pass before the handoff cleared a stale foreign `DONE`.
+            let stale = format!(
+                "Black box: 0x8000000 held a DONE record another image left in this memory\n{ended}"
+            );
+            assert_eq!(
+                boot_verdict(&armed(&[FOREIGN_RECORD_ARM, "boot-deadline=120000"]), &stale, log),
+                Err(Refusal::Log(bootlog::Unfit::NoForeignDone))
+            );
         }
     }
 }
diff --git a/tests/checks.rs b/tests/checks.rs
index 399e72a9499..13ec946e22e 100644
--- a/tests/checks.rs
+++ b/tests/checks.rs
@@ -751,7 +751,13 @@ mod checks {
         for state in ["PANIC", "WEDGED"] {
             let ended = loader.replace("held a DONE record", &format!("held a {state} record"));
             assert!(judge(&[&readback("foreignrecord", &ended, kernel)]).is_err());
+            let stale = format!(
+                "Black box: 0x8000000 held a DONE record another image left in this memory\n{ended}"
+            );
+            assert!(judge(&[&readback("foreignrecord", &stale, kernel)]).is_err());
         }
+        let unbounded = loader.replace(bootlog::HUNG_WITHOUT_A_RECORD, "");
+        assert!(judge(&[&readback("foreignrecord", &unbounded, kernel)]).is_err());
     }
 
     /// A T14 controller's handoff: it publishes USB Legacy Support and
@@ -775,10 +781,13 @@ mod checks {
         );
         assert!(xhci_xecp(&held).is_err());
         assert!(xhci_xecp(&format!("{t14}{held}")).is_err());
+        let kept = held.replace("xHCI: controller reset", "xHCI: 34 scratchpad buffers configured");
+        assert!(xhci_xecp(&format!("{t14}{kept}")).is_err());
         // A second controller's handoff with no reset of its own, and a reset
         // with no handoff before it.
         let unreset = t14.replace("xHCI: controller reset", "xHCI: 34 scratchpad buffers configured");
         assert!(xhci_xecp(&format!("{t14}{unreset}")).is_err());
+        assert!(xhci_xecp(&format!("{unreset}{t14}")).is_err());
         let unhanded = t14.replace("firmware did not claim the controller", "USB 3.1 on ports 2..=5");
         assert!(xhci_xecp(&format!("{t14}{unhanded}")).is_err());
     }
@@ -792,11 +801,16 @@ mod checks {
             .map(|name| ((*name).to_string(), Vec::new()))
             .collect();
         let jobs = vec!["test_rs_dlopen_dedup".to_string()];
-        let staged: Vec<String> = metal::reached(&format!("test_rs_dlopen_dedup\n{source}"), &jobs, &bins)
-            .into_iter()
-            .map(|(path, _)| path)
-            .collect();
-        assert_eq!(staged, ["bin/test_rs_std_tls", "lib/libfoo.so"]);
+        let staged = |text: &str| -> Vec<String> {
+            metal::reached(text, &jobs, &bins).into_iter().map(|(path, _)| path).collect()
+        };
+        assert_eq!(
+            staged(&format!("test_rs_dlopen_dedup\n{source}")),
+            ["bin/test_rs_std_tls", "lib/libfoo.so"]
+        );
+        // A longer name is another binary's.
+        let longer = source.replace("test_rs_std_tls", "test_rs_std_tls_dlopen");
+        assert_eq!(staged(&format!("test_rs_dlopen_dedup\n{longer}")), ["lib/libfoo.so"]);
     }
 
     /// `03_struct`'s output as `ccheck` prints it: the expectation the corpus
diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 9cf80aeb6d6..b806177e62b 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -436,17 +436,14 @@ impl Readback {
     /// report is. `None` where the chain did not go round — which for a boot
     /// that ended itself is a finding, not an absence.
     pub fn after_the_reset(&self) -> Result<Serial, String> {
-        let at = self.loader.find(bootlog::SEPARATOR).ok_or_else(|| {
+        let after = bootlog::after_the_reset(&self.loader).ok_or_else(|| {
             format!(
                 "{}'s loader.log carries no pass after the reset: the loader did not point \
                  `BootNext` at itself, or the machine went back to the boot manager\n{}",
                 self.label, self.loader
             )
         })?;
-        Ok(Serial::named(
-            &format!("{}'s loader pass after the reset", self.label),
-            &self.loader[at..],
-        ))
+        Ok(Serial::named(&format!("{}'s loader pass after the reset", self.label), after))
     }
 
     /// What the kernel recorded about the process the *runner* spawned as
@@ -697,6 +694,13 @@ pub fn reached(
     jobs: &[String],
     rust_bins: &[(String, Vec<u8>)],
 ) -> Vec<(String, Vec<u8>)> {
+    // Whole: a longer name that opens with this one is another binary's.
+    let names = |staged: &str| {
+        reachable.match_indices(staged).any(|(at, _)| {
+            !reachable[at + staged.len()..]
+                .starts_with(|c: char| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '_')
+        })
+    };
     let mut out = Vec::new();
     for (name, data) in rust_bins {
         let staged = format!("test_rs_{name}");
@@ -705,7 +709,7 @@ pub fn reached(
         // together are a fraction of one helper binary.
         if name.ends_with(".so") {
             out.push((format!("lib/{name}"), data.clone()));
-        } else if !jobs.contains(&staged) && reachable.contains(&staged) {
+        } else if !jobs.contains(&staged) && names(&staged) {
             out.push((format!("bin/{staged}"), data.clone()));
         }
     }
@@ -1142,8 +1146,7 @@ pub fn run(
                 // produced none is a boot some *other* bound ended.
                 // The foreign-identity boot's page is cleared by the pass that
                 // reads it, so it owes no field that crosses only there.
-                let cleared =
-                    batches[label.as_str()].params.contains(&toyos_build::metal::FOREIGN_RECORD_ARM);
+                let cleared = toyos_build::metal::clears_its_own_page(&batches[label.as_str()].params);
                 for (field, value) in [
                     ("complete_ms", back.boot_ms),
                     ("back_secs", Some(back.back_secs)),
diff --git a/tests/common/power.rs b/tests/common/power.rs
index a7d812fe940..b16cd0777f1 100644
--- a/tests/common/power.rs
+++ b/tests/common/power.rs
@@ -1662,11 +1662,10 @@ pub fn blackbox_foreign_record(
     // The pass that finds it: it must name it and clear it, and it must never
     // report it as this stick's predecessor — which is the whole defect.
     let found = after_the_reset(&mut qemu, bootlog::CHAIN_ENDS_LINE);
-    let said = found.must_say("record another image left in this memory")?.to_string();
-    for word in [State::Done.named(), "cleared and this pass boots its kernel"] {
-        if !said.contains(word) {
-            return Err(format!("the pass reported a foreign record without {word:?}: {said}"));
-        }
+    let said = found.must_say(bootlog::FOREIGN_DONE)?.to_string();
+    let cleared = "cleared and this pass boots its kernel";
+    if !said.contains(cleared) {
+        return Err(format!("the pass reported a foreign record without {cleared:?}: {said}"));
     }
     says_nothing_of(&found, bootlog::PREVIOUS_PANIC)?;
     says_nothing_of(&found, "the last boot read")?;
@@ -1990,7 +1989,6 @@ pub fn hard_lockup_chain(
     // arm line and the record itself.
     kernel.must_say("by each cpu's own performance counter")?;
     says_nothing_of(kernel, "CPUID states no architectural performance counter")?;
-    says_nothing_of(kernel, bootlog::REBOOTING)?;
 
     after.must_say(bootlog::PREVIOUS_PANIC)?;
     let said = after.must_say_after(bootlog::PREVIOUS_PANIC, bootlog::LOCKED_UP)?.to_string();
diff --git a/tests/toyos.rs b/tests/toyos.rs
index 9359eded3ec..70dc6817c91 100644
--- a/tests/toyos.rs
+++ b/tests/toyos.rs
@@ -1926,8 +1926,6 @@ const METAL: &[(&str, metal::Metal)] = &[
             )],
             judge: |b| {
                 let after = b[0].after_the_reset()?;
-                // Named and cleared, and never reported as this stick's own; and
-                // `DONE`, so the stop it staged finished.
                 let said = after.must_say(bootlog::FOREIGN_DONE)?.to_string();
                 power::says_nothing_of(&after, bootlog::PREVIOUS_PANIC)?;
                 power::says_nothing_of(&after, "the last boot read")?;

From f5c80264f3d4d87f3f6b3bf79d260f4b3b557112 Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Tue, 29 Sep 2026 22:02:20 +0200
Subject: [PATCH 6/7] The boot facts a cleared page owes nothing for are one
 tested predicate

The third review of #616 found that deleting `cleared ||` from the metal
loop's boot-facts skip left every host check green. The skip is now
`metal::owes_nothing(field, params)`: a path the boot did not take, or a
page that `toyos_build::metal::clears_its_own_page` says the pass after the
reset cleared. `a_cleared_page_owes_no_fact_off_it` checks it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tests/checks.rs       | 10 ++++++++++
 tests/common/metal.rs | 13 +++++++++----
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/tests/checks.rs b/tests/checks.rs
index 13ec946e22e..0368bab9f83 100644
--- a/tests/checks.rs
+++ b/tests/checks.rs
@@ -760,6 +760,16 @@ mod checks {
         assert!(judge(&[&readback("foreignrecord", &unbounded, kernel)]).is_err());
     }
 
+    /// The foreign-identity boot owes no fact off the page its next pass
+    /// cleared; any other boot owes each one but a path it did not take.
+    #[test]
+    fn a_cleared_page_owes_no_fact_off_it() {
+        let bound = "boot-deadline=120000";
+        assert!(metal::owes_nothing("panel_us", &[toyos_build::metal::FOREIGN_RECORD_ARM, bound]));
+        assert!(!metal::owes_nothing("panel_us", &[bound]));
+        assert!(metal::owes_nothing("park_open_operations", &[bound]));
+    }
+
     /// A T14 controller's handoff: it publishes USB Legacy Support and
     /// firmware never claimed it. The T14 has two, and each is judged.
     #[test]
diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index b806177e62b..c2254eeb0a1 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -31,6 +31,13 @@ use super::serial::Serial;
 const PATH_TAKEN: &[&str] =
     &["deadline_lateness_ms", "lockup_lateness_ms", "park_open_operations"];
 
+/// Whether a boot armed with `params` owes nothing for `field` where it produced
+/// none and the profile prices none: a path it did not take, or a field that
+/// crosses only on a page the pass after its reset cleared.
+pub fn owes_nothing(field: &str, params: &[&str]) -> bool {
+    PATH_TAKEN.contains(&field) || toyos_build::metal::clears_its_own_page(params)
+}
+
 /// One boot a metal test needs.
 pub struct Arm {
     /// **The boot this test rides, named.** Two arms naming one boot share an
@@ -1144,9 +1151,7 @@ pub fn run(
                 }
                 // A boot the file prices a path-taken field for and that
                 // produced none is a boot some *other* bound ended.
-                // The foreign-identity boot's page is cleared by the pass that
-                // reads it, so it owes no field that crosses only there.
-                let cleared = toyos_build::metal::clears_its_own_page(&batches[label.as_str()].params);
+                let params = &batches[label.as_str()].params;
                 for (field, value) in [
                     ("complete_ms", back.boot_ms),
                     ("back_secs", Some(back.back_secs)),
@@ -1159,7 +1164,7 @@ pub fn run(
                 ] {
                     let name = format!("boot.{label}.{field}");
                     let priced = profile.row(&name).is_some();
-                    if value.is_none() && !priced && (cleared || PATH_TAKEN.contains(&field)) {
+                    if value.is_none() && !priced && owes_nothing(field, params) {
                         continue;
                     }
                     let Some(value) = value else {

From 7b0ee7fd93dc92fc7b8c809ca15e72651f6dcdcf Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Tue, 29 Sep 2026 23:32:48 +0200
Subject: [PATCH 7/7] Answer the fourth review of #616: two arms no check could
 fail get a case, and the T14's hda_tone red is filed

- `xhci_xecp` refuses a log in which it recognises no handoff, and no check
  could fail that refusal: without it, a log with no outcome and no reset
  passed as long as the controller started. `silent`, the review's case,
  fails it.
- `bootlog::foreign_done`'s `None` arm, a chain that never went round, was
  reached by no case: reading the whole `loader.log` there passed a stop
  that only the pass before the handoff had said. The review's `unreturned`
  log now reaches it through `boot_verdict`.
- `power::done_line` spelled `bootlog::HANDED_BACK` a second time, from
  `State::Done.named()`. Its four callers read the constant and it is
  deleted.
- `owes_nothing`'s doc said a field crosses only on the cleared page. The
  cleared arm ignores the field, so that clause is deleted.
- The orchestrator's T14 run at `f5c80264f` reads `hda_tone` red on the
  judge's own assertion, where `main`'s run read it red before it judged.
  `issues/audio/hda-tone-reads-underruns-on-the-t14-where-its-judge-wants-none.md`
  files the line and the window, and claims no cause. The exit of the
  deleted `a-readbacks-kernel-records-never-count-as-kernel-output` was that
  a T14 run of the four rows it names reaches each judge's own assertions,
  and each does.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 ...s-on-the-t14-where-its-judge-wants-none.md | 50 +++++++++++++++++++
 src/metal.rs                                  |  9 ++++
 tests/checks.rs                               |  2 +
 tests/common/metal.rs                         |  3 +-
 tests/common/power.rs                         | 13 ++---
 5 files changed, 66 insertions(+), 11 deletions(-)
 create mode 100644 issues/audio/hda-tone-reads-underruns-on-the-t14-where-its-judge-wants-none.md

diff --git a/issues/audio/hda-tone-reads-underruns-on-the-t14-where-its-judge-wants-none.md b/issues/audio/hda-tone-reads-underruns-on-the-t14-where-its-judge-wants-none.md
new file mode 100644
index 00000000000..662d835b131
--- /dev/null
+++ b/issues/audio/hda-tone-reads-underruns-on-the-t14-where-its-judge-wants-none.md
@@ -0,0 +1,50 @@
+---
+status: open
+kind: defect
+opened: 2026-09-29
+---
+
+# `hda_tone` reads underruns on the T14 where its judge wants none
+
+The T14 run of `wt/toyos-metaljudges` at `f5c80264f` reds the row with:
+
+```
+FAIL hda_tone: soundd filled 104 period(s) the tone client had not covered, on a client that keeps its ring full:
+```
+
+The job itself exits 0 and prints `tone done`. Its cause is not measured;
+whether the judge or soundd is wrong is open.
+
+The T14 run of `main` at `7e151819` reddened the row earlier, on `the
+testcases's log carried no kernel output at all`.
+
+## Measured
+
+The `testcases` boot's log over the window the judge printed, selected lines in
+order:
+
+```
+{… 3.021 tid=1 soundd} soundd: opening stream: 44100Hz 2ch fmt=0
+{… 3.021 soundd} soundd: client 0 connected (id=0)
+{… 3.021 soundd} soundd: resumed
+{… 5.024 soundd} soundd: wakes=984 completions=689 submitted=697 underruns=0 drains=0 … clients=1 …
+[… 6.252 cpu0 tid=1] exit: test_rs_audio_tone tid=1 code=0 cpu=12ms (after 48 like it suppressed)
+{… 6.252 pid=8 test-runner} tone done
+{… 6.252 test-runner} ===TEST_END test_rs_audio_tone exit=0===
+{… 6.252 test-runner} ===TEST_START test_rs_hda_client_stall===
+[… 6.253 cpu7] spawn: /system/bin/test_rs_hda_client_stall pid=9 …
+{… 6.254 tid=1 soundd} soundd: opening stream: 44100Hz 2ch fmt=0
+{… 6.254 soundd} soundd: client 1 connected (id=1)
+{… 6.258 soundd} soundd: client 0 removed (closed)
+{… 7.024 soundd} soundd: wakes=989 completions=688 submitted=688 underruns=39 drains=0 … clients=1 …
+{… 8.412 soundd} soundd: client 1 removed (closed)
+{… 8.418 soundd} soundd: wakes=741 completions=479 submitted=479 underruns=65 drains=0 … clients=0 …
+```
+
+The printed window carries three stats lines, with `underruns=0`, `underruns=39`
+and `underruns=65`, which sum to the 104 the row names.
+
+## Exit condition
+
+`hda_tone` PASS on the orchestrator's T14 run of the head that lands the fix,
+and this file is deleted.
diff --git a/src/metal.rs b/src/metal.rs
index 3b7966c2846..3990647ce04 100644
--- a/src/metal.rs
+++ b/src/metal.rs
@@ -3445,5 +3445,14 @@ mod tests {
                 Err(Refusal::Log(bootlog::Unfit::NoForeignDone))
             );
         }
+        // A chain that never went round has no pass after the reset to read.
+        let unreturned = format!(
+            "Black box: 0x8000000 held a DONE record another image left in this memory\n{}\n",
+            bootlog::LOADER_LAST_LINE
+        );
+        assert_eq!(
+            boot_verdict(&armed(&[FOREIGN_RECORD_ARM, "boot-deadline=120000"]), &unreturned, log),
+            Err(Refusal::Log(bootlog::Unfit::NoForeignDone))
+        );
     }
 }
diff --git a/tests/checks.rs b/tests/checks.rs
index 0368bab9f83..5bb70c8525f 100644
--- a/tests/checks.rs
+++ b/tests/checks.rs
@@ -800,6 +800,8 @@ mod checks {
         assert!(xhci_xecp(&format!("{unreset}{t14}")).is_err());
         let unhanded = t14.replace("firmware did not claim the controller", "USB 3.1 on ports 2..=5");
         assert!(xhci_xecp(&format!("{t14}{unhanded}")).is_err());
+        let silent = unhanded.replace("xHCI: controller reset", "xHCI: 34 scratchpad buffers configured");
+        assert!(xhci_xecp(&silent).is_err());
     }
 
     /// `dlopen_dedup` reads `test_rs_std_tls` by path.
diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index c2254eeb0a1..b67d0f5d34d 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -32,8 +32,7 @@ const PATH_TAKEN: &[&str] =
     &["deadline_lateness_ms", "lockup_lateness_ms", "park_open_operations"];
 
 /// Whether a boot armed with `params` owes nothing for `field` where it produced
-/// none and the profile prices none: a path it did not take, or a field that
-/// crosses only on a page the pass after its reset cleared.
+/// none and the profile prices none.
 pub fn owes_nothing(field: &str, params: &[&str]) -> bool {
     PATH_TAKEN.contains(&field) || toyos_build::metal::clears_its_own_page(params)
 }
diff --git a/tests/common/power.rs b/tests/common/power.rs
index b16cd0777f1..538e5902422 100644
--- a/tests/common/power.rs
+++ b/tests/common/power.rs
@@ -964,11 +964,6 @@ fn armed_and_nothing_else() -> String {
     format!("{} the page still reads {}", bootlog::PREVIOUS_PANIC, State::Armed.named())
 }
 
-/// What it writes about a kernel that handed the machine back on purpose.
-fn done_line() -> String {
-    format!("the last boot read {}", State::Done.named())
-}
-
 /// The two-boot shape both chain judges use: a guest that takes its own reset,
 /// so the loader pass after it is observable.
 fn chained(params: &'static [&'static str]) -> BootOptions {
@@ -1177,7 +1172,7 @@ pub fn blackbox_done_chain(
     first.must_say(&armed_line())?;
 
     let second = after_the_reset(&mut qemu, bootlog::CHAIN_ENDS_LINE);
-    second.must_say(&done_line())?;
+    second.must_say(bootlog::HANDED_BACK)?;
     done_chain(&second)?;
     ended_in_a_reset(&mut resets)?;
     drop(qemu);
@@ -1691,7 +1686,7 @@ pub fn blackbox_foreign_record(
 /// points `BootNext` at itself before each handoff and a pass with a finding
 /// appends to the same `loader.log` — so the argument is that file's tail.
 pub fn done_chain(after: &serial::Serial) -> Result<(), String> {
-    after.must_say(&done_line())?;
+    after.must_say(bootlog::HANDED_BACK)?;
     the_tail_is_the_stops(after)?;
     // The distinction the whole state machine exists for: a deliberate stop is
     // not a panic and not a kernel that vanished.
@@ -1702,7 +1697,7 @@ pub fn done_chain(after: &serial::Serial) -> Result<(), String> {
     says_nothing_of(after, bootlog::LOADER_LAST_LINE)?;
     // What its transport went through is on every record, in one line where
     // nothing broke.
-    after.must_say_after(&done_line(), toyos_blackbox::RECOVERY_OPENS_WITH)?;
+    after.must_say_after(bootlog::HANDED_BACK, toyos_blackbox::RECOVERY_OPENS_WITH)?;
     after.must_say(bootlog::CHAIN_ENDS_LINE)?;
     eprintln!("  [power] a deliberate reboot sealed DONE and the chain ended in a reset");
     Ok(())
@@ -1713,7 +1708,7 @@ pub fn done_chain(after: &serial::Serial) -> Result<(), String> {
 /// the last word. Read after the seal,
 /// because the same lines are in the capture on the first boot's console.
 fn the_tail_is_the_stops(after: &serial::Serial) -> Result<(), String> {
-    let head = after.must_say_after(&done_line(), bootlog::LOG_TAIL_HEAD)?.to_string();
+    let head = after.must_say_after(bootlog::HANDED_BACK, bootlog::LOG_TAIL_HEAD)?.to_string();
     let tail: Vec<&str> = after
         .text()
         .lines()