diff --git a/issues/build/a-metal-failure-drops-every-row-its-boot-measured.md b/issues/build/a-metal-failure-drops-every-row-its-boot-measured.md
new file mode 100644
index 00000000000..0dabcc5249e
--- /dev/null
+++ b/issues/build/a-metal-failure-drops-every-row-its-boot-measured.md
@@ -0,0 +1,23 @@
+---
+status: open
+kind: tooling
+opened: 2026-09-30
+---
+
+# A metal failure drops every row its boot measured
+
+`tests/common/metal.rs`'s `judge_readbacks` puts boot labels in `failed`, and
+`Readback::measured` records a number with no test attached. One red test or
+shared member riding a boot therefore keeps every number that boot measured
+out of the record, and a number never recorded is never judged. A runner that
+carries every test in one session would drop every row of the session for one
+red test.
+
+It already costs rows. On the T14's full run at `0d2dda66f`, `testcases`,
+`shared`, `lancase` and `lantalkcase` each carried a known red, and
+`tests/metal/lenovo-20w0003amz.toml` holds no row of theirs, so nothing
+judges their numbers while those reds stand.
+
+## Exit condition
+
+Each number is recorded against its owner, and only that owner fails.
diff --git a/issues/build/a-metal-run-asks-ubuntu-which-machine-it-is-and-the-boot-says-nothing.md b/issues/build/a-metal-run-asks-ubuntu-which-machine-it-is-and-the-boot-says-nothing.md
new file mode 100644
index 00000000000..72312e6fb3a
--- /dev/null
+++ b/issues/build/a-metal-run-asks-ubuntu-which-machine-it-is-and-the-boot-says-nothing.md
@@ -0,0 +1,30 @@
+---
+status: open
+kind: tooling
+opened: 2026-09-29
+---
+
+# A metal run asks Ubuntu which machine it is, and the boot under test says nothing
+
+`src/metal.rs`'s `run` asks the operating system the T14 runs between boots
+for `metaltimings::Machine::QUERY` over ssh before the flash, and writes the
+answer into the readback's `boot.txt` under three keys (`VENDOR_KEY`,
+`PRODUCT_KEY`, `BIOS_KEY`); `tests/common/metal.rs` reads it back with
+`metal::machine`, and `metaltimings::Record::load` picks the machine's record
+by it. Both T14 runs of `wt/toyos-metaltimings` named the machine this way:
+`machine LENOVO 20W0003AMZ, BIOS N34ET71W (1.71 )`.
+
+A resident runner, tests inside a ToyOS that stays up on the machine with no
+Ubuntu and no reboot per test, has nothing to ask: the ssh read,
+`Refusal::Machine`, the three keys and `metal::machine` all go with Ubuntu.
+The record compares BIOS strings byte for byte, so identity has one reader:
+two that trim differently fail every run as a firmware change.
+
+## Exit condition
+
+The boot names its machine: the loader reads SMBIOS type 1's manufacturer and
+product and type 0's BIOS version from the UEFI configuration table before
+`ExitBootServices` and writes them as one `loader.log` line, the judge reads
+the machine from the readback's `loader.log`, the ssh read, `Refusal::Machine`,
+the three keys and `metal::machine` are deleted, and every record under
+`tests/metal/` names its machine in the loader's own strings.
diff --git a/issues/build/a-metal-timing-record-never-tightens.md b/issues/build/a-metal-timing-record-never-tightens.md
new file mode 100644
index 00000000000..5da31ff180f
--- /dev/null
+++ b/issues/build/a-metal-timing-record-never-tightens.md
@@ -0,0 +1,20 @@
+---
+status: open
+kind: tooling
+opened: 2026-09-29
+---
+
+# A metal timing record never tightens
+
+`src/metaltimings.rs`'s `judge` adds a name its machine has not recorded and
+never moves one it has, so a run cannot loosen the record that judges it. The
+same rule keeps a speed-up out: a number that halves keeps its old ceiling,
+and a regression that later doubles it back is inside that ceiling and passes.
+Only deleting the row re-records it.
+
+## Exit condition
+
+A recorded number that a run measures well under its record is either taken
+as the new record by a rule that a noisy run cannot ratchet into a false red,
+or reported by name so the row is deleted, and the choice is in
+`src/metaltimings.rs`'s module doc.
diff --git a/issues/build/the-metal-loop-cannot-judge-a-boot-that-panics.md b/issues/build/the-metal-loop-cannot-judge-a-boot-that-panics.md
index 6d24968cf73..c90ef0f23f8 100644
--- a/issues/build/the-metal-loop-cannot-judge-a-boot-that-panics.md
+++ b/issues/build/the-metal-loop-cannot-judge-a-boot-that-panics.md
@@ -18,9 +18,7 @@ the T14, and the reason is the loop rather than the kernel.
    `Boot: complete (Nms)` *and* a trailing `Rebooting.`. A boot whose subject is
    a panic correctly writes neither the second word nor anything after it, so
    the loop refuses it — the readback is still written, and
-   `tests/common/metal.rs`'s `Mode::Drive` tolerates the non-zero exit, but the
-   boot-level rows `tests/metal-profile.toml` prices are then judged against a
-   log the loop has already called unfit.
+   `tests/common/metal.rs`'s `Mode::Drive` tolerates the non-zero exit.
 
 2. `test-late-panic` fires in `kernel_main` after `spawn_init` and before
    `enter_idle_loop`, so `logd` has not run: that boot writes no `/log` file at
diff --git a/issues/build/the-usbload-boot-measures-a-panel-no-profile-row-prices.md b/issues/build/the-usbload-boot-measures-a-panel-no-profile-row-prices.md
deleted file mode 100644
index 4d22e673862..00000000000
--- a/issues/build/the-usbload-boot-measures-a-panel-no-profile-row-prices.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-29
----
-
-# The `usbload` boot measures a panel no `tests/metal-profile.toml` row prices
-
-`tests/metal-profile.toml` prices `panel_max_us` and `panel_us` for every
-metal boot but `usbload`, whose sealed page carries the panel census like any
-other. `tests/common/metal.rs` fails a measured number with no row, so every
-run that flashes `usbload` reds for it, whatever
-`usb_reset_records_the_phase_it_cut` — the boot's one rider — says.
-
-## Measured
-
-The full T14 run of `main` at `7e151819`
-(EXIT=1):
-
-```
-  usbload: Boot: complete 1166 ms, back in 164 s, the stick enumerated 0 s after that
-    the panel painted 10 time(s) and put 8741120 px on the glass
-    FAIL the metal suite measured "boot.usbload.panel_max_us" and tests/metal-profile.toml prices no such number; add a row with a ceiling and where it came from, because a measurement with no ceiling cannot fail
-    FAIL the metal suite measured "boot.usbload.panel_us" and tests/metal-profile.toml prices no such number; add a row with a ceiling and where it came from, because a measurement with no ceiling cannot fail
-```
-
-## Exit condition
-
-`tests/metal-profile.toml` carries `boot.usbload.panel_max_us` and
-`boot.usbload.panel_us` rows, each ceiling taken from a measurement of that
-boot rather than chosen, and a T14 run that flashes `usbload` prints
-neither refusal.
diff --git a/issues/diagnostics/the-lanleasecase-boot-is-a-third-t14-flash-for-one-exit-code.md b/issues/diagnostics/the-lanleasecase-boot-is-a-third-t14-flash-for-one-exit-code.md
index 2b1db4a1aa5..731723d4006 100644
--- a/issues/diagnostics/the-lanleasecase-boot-is-a-third-t14-flash-for-one-exit-code.md
+++ b/issues/diagnostics/the-lanleasecase-boot-is-a-third-t14-flash-for-one-exit-code.md
@@ -17,8 +17,7 @@ reaches no file
 (`issues/diagnostics/the-cable-judge-reads-three-netd-records-that-cannot-arrive-on-the-t14.md`):
 the kernel's `exit: netd pid=N code=N` record and a file netd writes itself are
 the two words of a process that cross. It is the `lan_lease_report` metal row,
-a third image flashed to the stick, a third boot of the machine and six rows of
-`tests/metal-profile.toml`.
+a third image flashed to the stick and a third boot of the machine.
 
 ## Owner
 
@@ -32,7 +31,7 @@ which the shipping `lancase` arm carries netd's own lines about the lease and
 the probe answers a question already answered. Then the arm is:
 `tests/lanleasecase/system.toml`, its row in `src/build.rs`'s `ALL_CONFIGS`,
 the `lan_lease_report` metal row in `tests/toyos.rs` with `LANLEASECASE` and
-`lan::leased_on_metal`, the six `tests/metal-profile.toml` rows,
+`lan::leased_on_metal`,
 `userland/netd/src/report.rs` and `toyos-i219/src/lease.rs`'s report lines —
 and netd's `--exit-with-lease` with `tests/e1000leasecase` and the
 `lan_lease_report` QEMU registration, the arm that proves the channel.
diff --git a/issues/hardware/a-boot-with-no-kernel-log-is-not-no-boot-complete.md b/issues/hardware/a-boot-with-no-kernel-log-is-not-no-boot-complete.md
index b23fed10af3..8c350ce6f26 100644
--- a/issues/hardware/a-boot-with-no-kernel-log-is-not-no-boot-complete.md
+++ b/issues/hardware/a-boot-with-no-kernel-log-is-not-no-boot-complete.md
@@ -22,8 +22,7 @@ readback could say about the run-22 class of hang.
 
 **Exit condition**: the loop names that case as itself — a readback with no
 `logd` file and no harvested report reported as "wedged before its first durable
-record", distinct from "no `Boot: complete`" and from "no readback at all" — and
-a metal-profile row that says which of the three a boot is.
+record", distinct from "no `Boot: complete`" and from "no readback at all".
 
 Off the path of whoever finds this: it is `src/metal.rs`'s verdict and belongs
 to the driver, not to the kernel side that produced the boot.
diff --git a/issues/hardware/metalprobes-usb-read-is-answered-from-fsds-cache.md b/issues/hardware/metalprobes-usb-read-is-answered-from-fsds-cache.md
index ff88f3818e9..aa89729ed65 100644
--- a/issues/hardware/metalprobes-usb-read-is-answered-from-fsds-cache.md
+++ b/issues/hardware/metalprobes-usb-read-is-answered-from-fsds-cache.md
@@ -11,9 +11,9 @@ and times reading it back as "a cache miss the stick has to answer" — true
 while the kernel's write-back dropped a closed file from its cache. `/log` is
 served by `/system/bin/fsd` now, whose block cache (`userland/fsd/src/cache.rs`)
 keeps clean blocks until it holds `CLEAN_LIMIT` of them and drops nothing at a
-close. So the timed read is fsd's memory, and the `usbread` span
-`tests/metal-profile.toml` prices is no longer the stick's.
+close. So the timed read is fsd's memory, and the `usbread` span is no longer
+the stick's.
 
 **Exit**: the timed read is one the stick answers — a file fsd has not read
 since it started, or a read through the partition claim that bypasses the
-file server — with the profile row re-measured on the T14.
+file server.
diff --git a/issues/hardware/the-lanicscase-boot-is-a-second-t14-flash-for-one-question.md b/issues/hardware/the-lanicscase-boot-is-a-second-t14-flash-for-one-question.md
index 27b2a5ff9c8..6f44546b60c 100644
--- a/issues/hardware/the-lanicscase-boot-is-a-second-t14-flash-for-one-question.md
+++ b/issues/hardware/the-lanicscase-boot-is-a-second-t14-flash-for-one-question.md
@@ -10,9 +10,7 @@ opened: 2026-09-13
 `--provoke-message`, which writes one enabled cause to `ICS` so the kernel's
 `pcidev: slot N took its first message` record says whether delivery works at
 all. It is the `lan_message_delivery` metal row, a second image flashed to the
-stick, a second boot of the machine and six rows of `tests/metal-profile.toml`
-(`boot.lanicscase.{complete_ms,back_secs,stick_secs,panel_max_us,panel_us}`,
-`list.lanicscase.job_ms`).
+stick and a second boot of the machine.
 
 **A count of no messages is two facts** — a part nothing made speak and a
 message that reached no CPU — and only this arm separates them. On a card that
@@ -30,8 +28,7 @@ The shipping `lancase` arm recording `pcidev: slot N took its first message`
 without the actuator. Then the actuator has no question left and the arm is
 four files: `tests/lanicscase/system.toml`, its row in `src/build.rs`'s
 `ALL_CONFIGS`, `tests/toyos.rs`'s `lan_message_delivery` row, its `METAL_ONLY`
-entry and `LANICSCASE` with the judge `lan::provoked_on_metal`, and the six
-`tests/metal-profile.toml` rows.
+entry and `LANICSCASE` with the judge `lan::provoked_on_metal`.
 
 Metal run 57 recorded `pcidev: slot 0 took its first message on vector 0x28`
 after the I219's hand-over on that slot and vector, so the second fact is read:
diff --git a/issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md b/issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md
index 0516d530fa0..1b0519288fc 100644
--- a/issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md
+++ b/issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md
@@ -107,16 +107,10 @@ runner asks for no reboot; the deadline was the only bound left, and it fired
 ## The instrument that measures this already exists
 
 `src/metal.rs:1591-1597`'s `deadline_lateness_ms` computes exactly
-`reached − bound` out of the `DEADLINE_EXPIRED` line (`src/bootlog.rs:28`);
-`tests/common/metal.rs:274-275` reads it off every readback and `:895-919`
-hands it to `profile.judge` as `boot.<label>.deadline_lateness_ms`;
-`tests/metal-profile.toml:409-414` prices that row for `deadlinewedge` —
-ceiling 10000 ms, "the widest true bound before [the timer period] has been"
-measured, `measured = 61`. 132859 is 13x that ceiling, on a boot the profile
-does not name: `lancase` is not among the labels the file prices, and is not
-in this tree. The arithmetic above is the instrument's own, done by hand
-because the run was `toyos-metal` invoked directly and not the harness. No
-second instrument is owed; a cause is.
+`reached − bound` out of the `DEADLINE_EXPIRED` line (`src/bootlog.rs:28`).
+The arithmetic above is the instrument's own, done by hand because the run
+was `toyos-metal` invoked directly and not the harness. No second instrument
+is owed; a cause is.
 
 ## What is known and what is not
 
@@ -148,5 +142,4 @@ second instrument is owed; a cause is.
   than the poll's one call site.
 
 **Exit condition**: the cause of a `poll` that ran 132859 ms past its bound is
-named with evidence and either removed or priced, so that a T14 expiry's
-lateness is held to the row that already exists.
+named with evidence and either removed or priced.
diff --git a/issues/kernel/mutual-kill-panicked-on-the-t14-with-stdio-slot-1-not-a-log-ring.md b/issues/kernel/mutual-kill-panicked-on-the-t14-with-stdio-slot-1-not-a-log-ring.md
new file mode 100644
index 00000000000..f7468dd32c5
--- /dev/null
+++ b/issues/kernel/mutual-kill-panicked-on-the-t14-with-stdio-slot-1-not-a-log-ring.md
@@ -0,0 +1,45 @@
+---
+status: open
+kind: defect
+opened: 2026-09-29
+---
+
+# `test_rs_mutual_kill` panicked on the T14: stdio slot 1 "holds a region that is not a log ring"
+
+The full metal run of `wt/toyos-metaltimings` at `db5e59bc4` failed
+`test_rs_mutual_kill` in the `shared-2` boot; the run of the same branch at
+`09fe6121e` passed it. `git diff --stat 09fe6121e db5e59bc4` names one file,
+`tests/metal/lenovo-20w0003amz.toml`, which the host harness reads and no image
+carries. Unexplained: nothing below says why.
+
+## What the log shows
+
+The job was spawned at 3.045 s as pid 28 and spawned its children, pid 29 to
+156, each ending `code=137` or `code=0`. The two exit records written just
+before the panic:
+
+    [2026-09-29 18:49:34 10.010 cpu4] exit: test_rs_mutual_kill pid=155 code=0 cpu=10ms
+    [2026-09-29 18:49:34 10.010 cpu5] exit: test_rs_mutual_kill pid=156 code=137 cpu=10ms
+
+Then pid 28 itself, under the runner's name:
+
+    {2026-09-29 18:49:34 10.011 error pid=28 test-runner} thread 'main' (1) panicked at /Users/jan/Dev/jan/toyos-phdr/toyos/src/log/stdio.rs:209:33:
+    {2026-09-29 18:49:34 10.011 error pid=28 test-runner} stdio: slot 1 holds a region that is not a log ring
+    ...
+      11:      0x1000006e6be - toyos[db68fa2b5c494fe7]::log::stdio::target::sink
+      12:      0x1000006e7c2 - toyos[db68fa2b5c494fe7]::log::stdio::target::write
+      13:      0x100000568d8 - <alloc[58e89b8cb86be8e3]::io::buffered::bufwriter::BufWriter<std[cb898f2ab581ea90]::io::stdio::StdoutRaw>>::flush_buf
+      ...
+      18:      0x10000063bc3 - std[cb898f2ab581ea90]::io::stdio::_print
+      19:      0x10000028f12 - mutual_kill[652ee4c06bb687b]::main
+    [2026-09-29 18:49:34 10.085 cpu5] exit: test_rs_mutual_kill pid=28 code=101 cpu=5840ms
+
+`toyos/src/log/stdio.rs:209` is `sink`'s panic on the first write to a
+stream whose slot `ask` refused, with `NotARing`'s words (`:276`). The path is
+the sysroot's source, which is keyed by content and so names whichever
+worktree built that key first.
+
+## Exit condition
+
+Why pid 28's slot 1 answered `NotARing` on its first `println!` is named with
+evidence and removed, and `test_rs_mutual_kill` passes on a T14 run.
diff --git a/issues/kernel/the-machine-stops-without-saying-which-thread-took-the-time.md b/issues/kernel/the-machine-stops-without-saying-which-thread-took-the-time.md
index f6122f83d53..084a956a7f6 100644
--- a/issues/kernel/the-machine-stops-without-saying-which-thread-took-the-time.md
+++ b/issues/kernel/the-machine-stops-without-saying-which-thread-took-the-time.md
@@ -72,7 +72,7 @@ record this issue is about.
 ## Why it is not free to answer
 
 The record is a fixed line rendered by `toyos-quiesce` and read back by
-`src/metal.rs` and the harness, and the profile prices two numbers out of it.
+`src/metal.rs` and the harness.
 Naming a thread means the record carries a pid, a tid and the class of wait
 that thread was in — which the sweep does not collect today, because it counts
 rather than remembers.
@@ -81,5 +81,4 @@ rather than remembers.
 
 The record naming the last thread to stop, and a boot of `tests/metalcase`
 whose stop time can then be attributed to it rather than inferred. Until the
-record names one, its `in N ms` explains nothing about itself, and no profile
-row prices it.
+record names one, its `in N ms` explains nothing about itself.
diff --git a/kernel/src/hardlockup/mod.rs b/kernel/src/hardlockup/mod.rs
index b91a0022b23..b2e80b8f4a6 100644
--- a/kernel/src/hardlockup/mod.rs
+++ b/kernel/src/hardlockup/mod.rs
@@ -72,12 +72,9 @@ pub mod probe;
 /// line and nothing links the two crates (`src/bootlog.rs`).
 pub const LOCKED_UP: &str = "a cpu locked up with interrupts off";
 
-/// How often an armed CPU samples itself, in nanoseconds of unhalted time.
-///
-/// A second: the bound is measured in tens of them, so a sample period this
-/// long costs one NMI per CPU per second and puts the detection within one
-/// period of the bound. It is also the period the report's ages are quoted at.
-const SAMPLE_NS: u64 = 1_000_000_000;
+/// Declared beside the bound it samples, so the host judging a lockup's
+/// lateness reads the same period.
+const SAMPLE_NS: u64 = toyos_tco::HARD_LOCKUP_SAMPLE_NS;
 
 /// The bound in TSC ticks, or 0 for a boot that armed none. Written on the BSP
 /// before any AP exists.
diff --git a/src/bootlog.rs b/src/bootlog.rs
index 8ac0fe2faee..f3665da49ab 100644
--- a/src/bootlog.rs
+++ b/src/bootlog.rs
@@ -34,6 +34,10 @@ pub const JOB_DEADLINE_SAID: &str =
 /// it has: a wedged boot's `logd` wrote nothing.
 pub const DEADLINE_EXPIRED: &str = "the boot deadline expired";
 
+/// What the kernel logs as it arms that deadline, in `kernel/src/deadline.rs`:
+/// the record whose time the bound is counted from.
+pub const DEADLINE_ARMED: &str = "boot deadline: ";
+
 /// What the `wedge-before-reset` actuator says before it stops every CPU, in
 /// `kernel/src/deadline.rs`. The witness that a deadline ended a wedge and not
 /// a boot merely slower than its bound, which is what makes that control one.
@@ -708,6 +712,7 @@ mod tests {
             ("kernel/src/arch/x86_64/smp.rs", format!("log!(\"{AP_BRINGUP}")),
             ("kernel/src/process.rs", format!("THREAD_NAME_LEN: usize = {NAME_LEN}")),
             ("kernel/src/deadline.rs", format!("EXPIRED: &str = \"{DEADLINE_EXPIRED}\"")),
+            ("kernel/src/deadline.rs", format!("\"{DEADLINE_ARMED}{{ms}} ms")),
             ("kernel/src/deadline.rs", format!("WEDGE_STAGED: &str = \"{WEDGE_STAGED}\"")),
             ("kernel/src/deadline.rs", format!("\"{WEDGE_ARRIVED_DEAF}\"")),
             ("kernel/src/usb_gate.rs", format!("USB_WEDGE_STAGED: &str = \"{USB_WEDGE_STAGED}\"")),
diff --git a/src/lib.rs b/src/lib.rs
index e4a81196fb4..256afb5fff7 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -31,9 +31,9 @@ pub mod licence;
 pub mod metal;
 pub mod metaldevices;
 pub mod metalimage;
-pub mod metalprofile;
 pub mod metalswap;
 pub mod metaltalk;
+pub mod metaltimings;
 pub mod redlist;
 pub mod release;
 pub mod sdkversion;
diff --git a/src/metal.rs b/src/metal.rs
index fd2554f786c..54a0bc8bded 100644
--- a/src/metal.rs
+++ b/src/metal.rs
@@ -23,6 +23,7 @@ use std::process::{Command, Output, Stdio};
 use crate::bootlog;
 use crate::flags::{declare_flags, Flag};
 use crate::image::LBA;
+use crate::metaltimings::Machine;
 
 const CONNECT_SECS: u64 = 10;
 
@@ -186,6 +187,9 @@ pub enum Refusal {
     /// binary in service**: init's words, the machine's answer or ssh
     /// afterwards, each finding by name.
     Swap(Vec<String>),
+    /// The machine did not name itself: its SMBIOS answer is not
+    /// [`Machine::QUERY`]'s three lines.
+    Machine(String),
     Usage(String),
 }
 
@@ -344,6 +348,7 @@ impl fmt::Display for Refusal {
                 "the swap did not put the new binary in service:\n  {}",
                 findings.join("\n  ")
             ),
+            Self::Machine(why) => write!(f, "the machine did not say what it is: {why}"),
             Self::Usage(why) => write!(f, "{why}"),
         }
     }
@@ -1405,8 +1410,7 @@ impl Driver {
     /// **A number and not an implication.** Whether the stick came back is what
     /// the T14 alone can say about the ruling, and before this it was only ever
     /// visible as `mount: special device /dev/sda3 does not exist` — a mount
-    /// that fails for a dozen other reasons too. Waited for by name, priced in
-    /// `tests/metal-profile.toml`, and refused as its own kind.
+    /// that fails for a dozen other reasons too.
     fn wait_for_the_stick(&self) -> Result<u64, Refusal> {
         let node = self.target.node.partition(self.target.log_part);
         let probe = format!("test -b {}", shell_word(&node));
@@ -2003,6 +2007,9 @@ pub fn run(args: &Args) -> Result<Option<u64>, Refusal> {
         identity.vendor,
         identity.model
     );
+    let machine = Machine::parse(&driver.ssh("reading the machine's SMBIOS", Machine::QUERY)?)
+        .map_err(Refusal::Machine)?;
+    println!("machine {} {}, BIOS {}", machine.vendor, machine.product, machine.bios);
     // Before the flash, because the address a boot of this image could answer
     // on is one only the operating system that is still up can be asked for.
     let wire = match &args.nic {
@@ -2096,17 +2103,35 @@ pub fn run(args: &Args) -> Result<Option<u64>, Refusal> {
         }
         println!("toyos-fat32-check: the log partition's {} bytes check out", bytes.len());
     }
-    if let Some(dir) = &args.readback {
-        write_readback(dir, &loader, &log, back, stick, wire.as_ref(), replied)?;
+    let boot = boot_file(back, stick, &machine, wire.as_ref(), replied);
+    judge_and_write_readback(&armed, &loader, &log, heard.as_ref(), args.readback.as_deref(), &boot)
+        .map(Some)
+}
+
+/// This boot's verdict, **judged before the readback is written, and written
+/// into it**, so a judge reading the directory later reads the verdict this
+/// run returns.
+fn judge_and_write_readback(
+    armed: &[String],
+    loader: &str,
+    log: &str,
+    heard: Option<&(Result<crate::metaltalk::Conversation, String>, Vec<String>)>,
+    readback: Option<&Path>,
+    boot: &str,
+) -> Result<u64, Refusal> {
+    let verdict = boot_verdict(armed, loader, log).and_then(|ms| {
+        // After the stick's own verdict, which stays the one that names a boot
+        // that never reached its network.
+        if let Some((heard, lines)) = heard {
+            talk_verdict(heard, lines)?;
+        }
+        Ok(ms)
+    });
+    if let Some(dir) = readback {
+        write_readback(dir, loader, log, boot, &verdict_file(verdict.as_ref().err()))?;
         println!("readback written to {}", dir.display());
     }
-    let ms = boot_verdict(&armed, &loader, &log)?;
-    // After the stick's own verdict, which stays the one that names a boot
-    // that never reached its network.
-    if let Some((heard, lines)) = &heard {
-        talk_verdict(heard, lines)?;
-    }
-    Ok(Some(ms))
+    verdict
 }
 
 /// The stick's own verdict on one boot, off what its image is armed with, the
@@ -2227,18 +2252,35 @@ fn sealed_by(loader: &str) -> Option<&str> {
 }
 
 /// The lateness of a deadline that expired, in milliseconds past the bound it
-/// was armed with, out of the line the pass after the reset printed.
+/// was armed with, out of the line the pass after the reset printed; `None` on
+/// a boot whose deadline did not expire.
 ///
-/// **The one number this arm measures.** The bound is a parameter and the
-/// expiry is what the poll actually reached, so the difference is what the
-/// timer entry costs a wedged machine — and it is the number a slower poll
-/// would move.
-pub fn deadline_lateness_ms(loader: &str) -> Option<u64> {
+/// **Counted from the kernel's own record of arming it** (`log`): the bound
+/// runs from the arm and the expiry is quoted since boot, so the difference
+/// alone is the boot's first tens of milliseconds and not the poll's lateness.
+/// Signed, because both instants are floored milliseconds: an expiry at its
+/// bound can read one early, and one before it is a reading, not an absence.
+pub fn deadline_lateness_ms(loader: &str, log: &str) -> Option<Result<i64, String>> {
     let said = loader.lines().find(|l| l.contains(bootlog::DEADLINE_EXPIRED))?;
-    let (_, rest) = said.split_once("a bound of ")?;
-    let (bound, rest) = rest.split_once(" ms, reached at ")?;
-    let (reached, _) = rest.split_once(" ms,")?;
-    reached.parse::<u64>().ok()?.checked_sub(bound.parse::<u64>().ok()?)
+    let fields = || {
+        let (_, rest) = said.split_once("a bound of ")?;
+        let (bound, rest) = rest.split_once(" ms, reached at ")?;
+        let (reached, _) = rest.split_once(" ms,")?;
+        Some((bound.parse::<i64>().ok()?, reached.parse::<i64>().ok()?))
+    };
+    let armed = || {
+        let line = log.lines().find(|line| line.contains(bootlog::DEADLINE_ARMED))?;
+        i64::try_from(bootlog::record_millis(line)?).ok()
+    };
+    Some(match (fields(), armed()) {
+        (Some((bound, reached)), Some(armed)) => Ok(reached - armed - bound),
+        (None, _) => Err(format!("{said:?} is not the expiry the kernel writes")),
+        (_, None) => Err(format!(
+            "the deadline expired and this boot's log carries no {:?} record to count its bound \
+             from",
+            bootlog::DEADLINE_ARMED
+        )),
+    })
 }
 
 /// What the kernel's stop wrote about itself in `text`: the loader's pass after
@@ -2255,15 +2297,17 @@ pub fn park(text: &str) -> Option<toyos_quiesce::Record> {
 ///
 /// **A number of its own and not [`deadline_lateness_ms`]'s**, because what
 /// bounds it is a different thing: this one lands within one of that detector's
-/// sample periods rather than within one timer period, so a ceiling written for
-/// the poll would say nothing about the counter.
-pub fn lockup_lateness_ms(loader: &str) -> Option<u64> {
+/// sample periods rather than within one timer period.
+pub fn lockup_lateness_ms(loader: &str) -> Option<Result<i64, String>> {
     let said = loader.lines().find(|l| l.contains(bootlog::LOCKED_UP))?;
-    let (_, rest) = said.split_once("has taken no interrupt for ")?;
-    let (reached, rest) = rest.split_once(" ms,")?;
-    let (_, rest) = rest.split_once("Its bound is ")?;
-    let (bound, _) = rest.split_once(" ms")?;
-    reached.parse::<u64>().ok()?.checked_sub(bound.parse::<u64>().ok()?)
+    let fields = || {
+        let (_, rest) = said.split_once("has taken no interrupt for ")?;
+        let (reached, rest) = rest.split_once(" ms,")?;
+        let (_, rest) = rest.split_once("Its bound is ")?;
+        let (bound, _) = rest.split_once(" ms")?;
+        Some(reached.parse::<i64>().ok()? - bound.parse::<i64>().ok()?)
+    };
+    Some(fields().ok_or_else(|| format!("{said:?} is not the lockup record the kernel writes")))
 }
 
 /// What the two files and this boot's own facts are called under `--readback`.
@@ -2276,6 +2320,35 @@ pub const READBACK_LOADER: &str = "loader.log";
 pub const READBACK_KERNEL: &str = "kernel.log";
 pub const READBACK_BOOT: &str = "boot.txt";
 
+/// The loop's own verdict on the boot: [`PASSED`], or [`REFUSED`] and the
+/// refusal on the lines after it. Written last, so a directory holding it holds
+/// the whole readback, and read by every judge of it, so a run judging these
+/// files later rules on the boot as the run that wrote them did.
+pub const READBACK_VERDICT: &str = "verdict.txt";
+const PASSED: &str = "passed";
+const REFUSED: &str = "refused";
+
+/// [`READBACK_VERDICT`]'s text.
+pub fn verdict_file(refused: Option<&Refusal>) -> String {
+    match refused {
+        None => format!("{PASSED}\n"),
+        Some(why) => format!("{REFUSED}\n{why}\n"),
+    }
+}
+
+/// The loop's verdict a readback carries: `Err` with the refusal's own words
+/// for a boot it refused, or with why the file says neither.
+pub fn loop_verdict(text: &str) -> Result<(), String> {
+    match text.split_once('\n') {
+        Some((PASSED, "")) => Ok(()),
+        Some((REFUSED, why)) if !why.trim().is_empty() => Err(why.trim_end().to_string()),
+        _ => Err(format!(
+            "{READBACK_VERDICT} reads {text:?}, which is neither {PASSED:?} nor {REFUSED:?} and a \
+             reason"
+        )),
+    }
+}
+
 /// The log partition's own bytes, kept beside them under `--fat32-check`: what
 /// the outside judge read, so a complaint can be looked at rather than retold.
 pub const READBACK_VOLUME: &str = "log-partition.img";
@@ -2284,6 +2357,11 @@ pub const READBACK_VOLUME: &str = "log-partition.img";
 pub const BACK_SECS: &str = "back_secs";
 pub const STICK_SECS_KEY: &str = "stick_secs";
 
+/// The machine the boot ran on, as [`Machine::QUERY`] answered before the flash.
+pub const VENDOR_KEY: &str = "machine_vendor";
+pub const PRODUCT_KEY: &str = "machine_product";
+pub const BIOS_KEY: &str = "machine_bios";
+
 /// The cable: the address this loop pinged, the MAC of the function holding it,
 /// and how far the machine's own clock stood from this host's. **All three
 /// together or none**: a judge reading two of them places an observation
@@ -2300,8 +2378,15 @@ pub const PING_AT_KEY: &str = "ping_at";
 
 /// Every file a readback directory carries, so a run that writes none of them
 /// leaves none of the last run's behind.
-pub const READBACK_FILES: &[&str] =
-    &[READBACK_LOADER, READBACK_KERNEL, READBACK_BOOT, READBACK_VOLUME, READBACK_STREAM, READBACK_TALK];
+pub const READBACK_FILES: &[&str] = &[
+    READBACK_LOADER,
+    READBACK_KERNEL,
+    READBACK_BOOT,
+    READBACK_VERDICT,
+    READBACK_VOLUME,
+    READBACK_STREAM,
+    READBACK_TALK,
+];
 
 /// Empty a readback directory, before this run can leave any of it standing.
 ///
@@ -2332,10 +2417,8 @@ fn write_readback(
     dir: &Path,
     loader: &str,
     log: &str,
-    back: u64,
-    stick: u64,
-    wire: Option<&Wire>,
-    replied: Option<Reply>,
+    boot: &str,
+    verdict: &str,
 ) -> Result<(), Refusal> {
     let wrote = |path: &Path, text: &str| -> Result<(), Refusal> {
         std::fs::write(path, text)
@@ -2345,10 +2428,24 @@ fn write_readback(
         .map_err(|e| Refusal::File { path: dir.display().to_string(), why: e.to_string() })?;
     wrote(&dir.join(READBACK_LOADER), loader)?;
     wrote(&dir.join(READBACK_KERNEL), log)?;
-    // The boot's own millisecond count is in the kernel log and read from
-    // there; this file carries only what the *host* clock measured, which no
-    // log can.
-    let mut boot = format!("{BACK_SECS} {back}\n{STICK_SECS_KEY} {stick}\n");
+    wrote(&dir.join(READBACK_BOOT), boot)?;
+    wrote(&dir.join(READBACK_VERDICT), verdict)
+}
+
+/// [`READBACK_BOOT`]'s text: what the host measured about the boot, and the
+/// machine it ran on.
+fn boot_file(
+    back: u64,
+    stick: u64,
+    machine: &Machine,
+    wire: Option<&Wire>,
+    replied: Option<Reply>,
+) -> String {
+    let mut boot = format!(
+        "{BACK_SECS} {back}\n{STICK_SECS_KEY} {stick}\n{VENDOR_KEY} {}\n{PRODUCT_KEY} {}\n\
+         {BIOS_KEY} {}\n",
+        machine.vendor, machine.product, machine.bios
+    );
     if let Some(wire) = wire {
         boot.push_str(&format!(
             "{PING_ADDR_KEY} {}\n{WIRE_MAC_KEY} {}\n{CLOCK_SKEW_KEY} {}\n",
@@ -2358,7 +2455,7 @@ fn write_readback(
             boot.push_str(&format!("{PING_SECS_KEY} {}\n{PING_AT_KEY} {}\n", reply.secs, reply.at));
         }
     }
-    wrote(&dir.join(READBACK_BOOT), &boot)
+    boot
 }
 
 /// Whether this boot was a loader pass that reported a record and booted no
@@ -2405,6 +2502,16 @@ pub fn stick_secs(text: &str) -> Option<u64> {
     key(text, STICK_SECS_KEY)
 }
 
+/// The machine a readback names, or why it names none.
+pub fn machine(text: &str) -> Result<Machine, String> {
+    match (word(text, VENDOR_KEY), word(text, PRODUCT_KEY), word(text, BIOS_KEY)) {
+        (Some(vendor), Some(product), Some(bios)) => Ok(Machine { vendor, product, bios }),
+        _ => Err(format!(
+            "names no machine: {VENDOR_KEY}, {PRODUCT_KEY} and {BIOS_KEY} are owed together"
+        )),
+    }
+}
+
 /// What one boot's readback says about the cable, or `None` where the loop was
 /// not asked to reach one.
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -2759,6 +2866,81 @@ mod tests {
         assert_eq!(back_secs("back_secs later\n"), None);
     }
 
+    #[test]
+    fn the_machine_crosses_in_the_boot_file() {
+        let t14 = Machine::parse("LENOVO\n20W0003AMZ\nN34ET71W (1.71 )\n").expect("three lines");
+        let boot = boot_file(47, 0, &t14, None, None);
+        assert_eq!(machine(&boot), Ok(t14));
+        assert_eq!(back_secs(&boot), Some(47));
+        assert!(machine("back_secs 47\nmachine_vendor LENOVO\n").is_err());
+    }
+
+    /// A judge reading the readback later rules on the boot as the loop did.
+    #[test]
+    fn the_loops_verdict_crosses_in_the_readback() {
+        assert_eq!(loop_verdict(&verdict_file(None)), Ok(()));
+        let refused = Refusal::HungWithoutARecord;
+        assert_eq!(
+            loop_verdict(&verdict_file(Some(&refused))),
+            Err(refused.to_string().trim_end().to_string())
+        );
+        for unread in ["", "passed", "passed\nand more\n", "refused\n", "refused\n  \n", "green\n"] {
+            assert!(loop_verdict(unread).is_err(), "{unread:?}");
+        }
+    }
+
+    /// The writer's half: the verdict the loop returns is the one its readback
+    /// carries, for a boot it refused, for one it passed, and for one whose
+    /// conversation it refused.
+    #[test]
+    fn the_readback_carries_the_verdict_the_loop_returns() {
+        let dir = toyos_tmpdir::TempDir::new("verdict");
+        let armed = [alloc_deadline()];
+        let boot = "back_secs 40\nstick_secs 0\n";
+        let written = || {
+            let at = dir.join(READBACK_VERDICT);
+            loop_verdict(&std::fs::read_to_string(&at).expect("the verdict is written"))
+        };
+
+        let hung = format!("{}\n{}\n", bootlog::LOADER_FIRST_LINE, bootlog::HUNG_WITHOUT_A_RECORD);
+        assert_eq!(
+            judge_and_write_readback(&armed, &hung, "", None, Some(dir.path()), boot),
+            Err(Refusal::HungWithoutARecord)
+        );
+        assert_eq!(written(), Err(Refusal::HungWithoutARecord.to_string().trim_end().to_string()));
+
+        let loader = format!(
+            "{}\n{}\n{}\n{}\nBlack box: {}, so it handed the machine back on purpose and this \
+             chain ends here\n| {} (16)\n| {}[1.516 cpu0] {}\n{}\n",
+            bootlog::LOADER_FIRST_LINE,
+            bootlog::LOADER_LAST_LINE,
+            bootlog::SEPARATOR,
+            bootlog::LOADER_FIRST_LINE,
+            bootlog::HANDED_BACK,
+            bootlog::LOG_TAIL_HEAD,
+            bootlog::LOG_TAIL,
+            bootlog::REBOOTING,
+            bootlog::CHAIN_ENDS_LINE,
+        );
+        let log = format!(
+            "[kernel 1.151 cpu0] Boot: complete (1151ms)\n{{1.203 init}} {} (Reboot)\n",
+            bootlog::STOPPING
+        );
+        assert_eq!(
+            judge_and_write_readback(&armed, &loader, &log, None, Some(dir.path()), boot),
+            Ok(1151)
+        );
+        assert_eq!(written(), Ok(()));
+
+        let unheard = Refusal::Talk(vec!["unheard".to_string()]);
+        let heard = (Err("unheard".to_string()), Vec::new());
+        assert_eq!(
+            judge_and_write_readback(&armed, &loader, &log, Some(&heard), Some(dir.path()), boot),
+            Err(unheard.clone())
+        );
+        assert_eq!(written(), Err(unheard.to_string().trim_end().to_string()));
+    }
+
     /// **A boot the cable did not answer is not a boot that answered in the
     /// first second, and neither is a boot that was never asked.**
     #[test]
@@ -3312,20 +3494,30 @@ mod tests {
         assert_eq!(ok.bytes % u64::from(LBA), 0);
         assert_ne!(ok.esp.guid, toyos_gpt::Guid::ZERO);
     }
-    /// The lateness comes off the line the kernel writes, and a boot that wrote
-    /// none measures nothing rather than zero.
+    /// The lateness comes off the line the kernel writes, counted from the
+    /// record of arming the bound, and a boot that wrote none measures nothing
+    /// rather than zero.
     #[test]
-    fn the_deadlines_lateness_is_read_off_the_record_the_loader_printed() {
+    fn the_deadlines_lateness_is_counted_from_its_arm() {
         let said = format!(
-            "| {}: a bound of 120000 ms, reached at 120153 ms, with this machine in `complete`. \
+            "| {}: a bound of 120000 ms, reached at 120064 ms, with this machine in `complete`. \
              The tail of the log ring follows.\n",
             bootlog::DEADLINE_EXPIRED
         );
-        assert_eq!(deadline_lateness_ms(&said), Some(153));
-        assert_eq!(deadline_lateness_ms("Previous boot's panic: nothing of the kind\n"), None);
-        // A bound the expiry did not reach is not a negative lateness.
-        let early = said.replace("reached at 120153", "reached at 119000");
-        assert_eq!(deadline_lateness_ms(&early), None);
+        let log = format!(
+            "[2026-09-29 18:22:39 0.060 cpu0] {}120000 ms, after which this kernel seals a \
+             WEDGED record and writes the reset register itself\n",
+            bootlog::DEADLINE_ARMED
+        );
+        assert_eq!(deadline_lateness_ms(&said, &log), Some(Ok(4)));
+        assert_eq!(deadline_lateness_ms("Previous boot's panic: nothing of the kind\n", &log), None);
+        // An expiry before its bound is a reading, not an absence.
+        let early = said.replace("reached at 120064", "reached at 119000");
+        assert_eq!(deadline_lateness_ms(&early, &log), Some(Ok(-1060)));
+        // An expiry with no arm to count from, or one not in the kernel's shape.
+        assert!(matches!(deadline_lateness_ms(&said, "nothing armed\n"), Some(Err(_))));
+        let unread = said.replace("reached at", "reached by");
+        assert!(matches!(deadline_lateness_ms(&unread, &log), Some(Err(_))));
     }
 
     /// The one boot judged by its sealed record and not by the shutdown's word:
@@ -3370,17 +3562,19 @@ mod tests {
             bootlog::LOCKED_UP
         );
         assert_eq!(wedged_boot(&locked, booted), Ok(1200));
-        assert_eq!(lockup_lateness_ms(&locked), Some(4));
+        assert_eq!(lockup_lateness_ms(&locked), Some(Ok(4)));
         // Each bound's lateness is read off its own record and off no other.
-        assert_eq!(deadline_lateness_ms(&locked), None);
+        assert_eq!(deadline_lateness_ms(&locked, booted), None);
         let expired = format!(
             "| {}: a bound of 120000 ms, reached at 120153 ms, with this machine in `complete`.\n",
             bootlog::DEADLINE_EXPIRED
         );
         assert_eq!(lockup_lateness_ms(&expired), None);
-        // A sample that landed before the bound is not a negative lateness.
+        // A sample that landed before the bound is a reading, not an absence.
         let early = locked.replace("for 60004 ms", "for 59000 ms");
-        assert_eq!(lockup_lateness_ms(&early), None);
+        assert_eq!(lockup_lateness_ms(&early), Some(Ok(-1000)));
+        let unread = locked.replace("Its bound is", "Its bound was");
+        assert!(matches!(lockup_lateness_ms(&unread), Some(Err(_))));
     }
 
     /// The foreign-record arm's pass after the reset: the hang it stages is its
diff --git a/src/metaldevices.rs b/src/metaldevices.rs
index 83bbd06278f..bea9ec723b4 100644
--- a/src/metaldevices.rs
+++ b/src/metaldevices.rs
@@ -7,12 +7,6 @@
 //! and nothing here touches a machine. `tests/metaldevicecase` is the boot that
 //! produces them: `userland/metalprobe`'s jobs measure, exit with their spans,
 //! and the kernel's own `exit:` record carries each one off the machine.
-//!
-//! **What a number may be is not here, and there is one place it is.** Every
-//! measurement the suite takes is priced by name in `tests/metal-profile.toml`
-//! and judged by [`crate::metalprofile`], which refuses a name with no row;
-//! what this holds is the *shape* both ends have to agree about, so a host and
-//! a guest cannot come to different answers about a word.
 
 #![forbid(unsafe_code)]
 
@@ -340,10 +334,6 @@ pub fn inventory(log: &str) -> Vec<String> {
 /// included, each table judged against its own writer's part of it. Each line
 /// opens with the `about` it failed, so a caller can name them without reading
 /// the prose.
-///
-/// A `Vec` of failures and not a `Vec<Verdict>`: the device suite's numbers are
-/// priced in `tests/metal-profile.toml` and judged there, so what is left here
-/// is the half that is about records.
 pub fn unmet(loader: &str, log: &str) -> Vec<String> {
     let mut out = Vec::new();
     let kernel = crate::bootlog::kernel_records(log);
diff --git a/src/metalprofile.rs b/src/metalprofile.rs
deleted file mode 100644
index f52462b1cea..00000000000
--- a/src/metalprofile.rs
+++ /dev/null
@@ -1,386 +0,0 @@
-//! Every number the metal suite measures on the T14, with the ceiling past
-//! which it is a red.
-//!
-//! One committed file, [`PATH`], read by the judge — so a slower boot or a
-//! wider tail reds against a number somebody wrote down and not against
-//! nothing. The judge asks by name and a name with no row is a **refusal**: a
-//! measurement nobody has priced must not pass by having no ceiling.
-//!
-//! `ceiling` is the verdict and `ceiling_from` says where it came from.
-//! `measured` is the last reading the machine gave and is absent until a run
-//! has taken one; it is evidence for the next author, never the gate — a bound
-//! asserted against its own measurement is not a bound.
-
-#![forbid(unsafe_code)]
-
-use std::collections::BTreeSet;
-use std::path::Path;
-
-use serde::Deserialize;
-
-/// Where the committed file lives, relative to the repository root.
-pub const PATH: &str = "tests/metal-profile.toml";
-
-/// What the boot around a job list costs it, in milliseconds.
-///
-/// The runner's bound is measured from boot rather than from its first job,
-/// so everything
-/// before the list comes off the bound before the members get any of it — and
-/// the `reboot` job the image derivation appends comes off the other end.
-///
-/// A tenth of the bound, derived rather than measured, and several times what
-/// either end has ever cost. Nine tenths is what the members may spend.
-pub const AROUND_THE_LIST_MS: u64 = toyos_tco::JOB_BOUND_MS / 10;
-
-/// The name under which one boot's per-member allowance is priced.
-pub fn job_ms_row(boot: &str) -> String {
-    format!("list.{boot}.job_ms")
-}
-
-/// How many members a job list may carry when one member is allowed `job_ms`.
-///
-/// **The runner's bound ends the whole list and not the job it is inside**,
-/// which is why a suite that runs seventy-two binaries on one boot needs this
-/// step at all: past this count the members never run, and the boot reports
-/// them as missing exit records rather than as a list nobody sized.
-pub fn members_per_boot(job_ms: u64) -> usize {
-    let spendable = toyos_tco::JOB_BOUND_MS.saturating_sub(AROUND_THE_LIST_MS);
-    // A member priced above the whole allowance still gets a boot of its own:
-    // one member per boot is the smallest a list can be cut to, and the boot
-    // then reds on its own measured cost rather than on being unsplittable.
-    usize::try_from(spendable / job_ms.max(1)).unwrap_or(usize::MAX).max(1)
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct Profile {
-    #[serde(default)]
-    pub number: Vec<Row>,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct Row {
-    /// What the judge asks for it by. One row per name.
-    pub name: String,
-    pub unit: String,
-    /// Past this is a red.
-    pub ceiling: u64,
-    /// Where the ceiling came from: a constant this repository declares, or the
-    /// margin over a reading. A ceiling with no derivation is a guess.
-    pub ceiling_from: String,
-    /// The last reading the machine gave, if one has been taken.
-    #[serde(default)]
-    pub measured: Option<u64>,
-}
-
-/// Why a profile could not be read, or why a reading is not one.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum Unfit {
-    /// The file itself.
-    File(String),
-    /// Two rows under one name: the judge would answer with whichever it found.
-    Duplicate(String),
-    /// A row whose committed reading is already past its own ceiling.
-    Stale { name: String, measured: u64, ceiling: u64 },
-    /// A number nobody has priced. **The gate fails closed here.**
-    Unpriced(String),
-    /// A reading past the ceiling.
-    Over { name: String, unit: String, value: u64, ceiling: u64, from: String },
-}
-
-impl std::fmt::Display for Unfit {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::File(why) => write!(f, "{PATH}: {why}"),
-            Self::Duplicate(name) => {
-                write!(f, "{PATH} carries two rows named {name:?}, and a judge reading it would \
-                          answer with whichever it found first")
-            }
-            Self::Stale { name, measured, ceiling } => write!(
-                f,
-                "{PATH}'s {name:?} records {measured} against its own ceiling of {ceiling}: the \
-                 committed reading is already a red"
-            ),
-            Self::Unpriced(name) => write!(
-                f,
-                "the metal suite measured {name:?} and {PATH} prices no such number; add a row \
-                 with a ceiling and where it came from, because a measurement with no ceiling \
-                 cannot fail"
-            ),
-            Self::Over { name, unit, value, ceiling, from } => write!(
-                f,
-                "{name} is {value} {unit} against a ceiling of {ceiling} ({from})"
-            ),
-        }
-    }
-}
-
-impl Profile {
-    /// Read and check the committed file. The checks are the file's own
-    /// well-formedness, never a machine's.
-    pub fn load(root: &Path) -> Result<Self, Unfit> {
-        let at = root.join(PATH);
-        let text = std::fs::read_to_string(&at)
-            .map_err(|e| Unfit::File(format!("{} — {e}", at.display())))?;
-        Self::parse(&text)
-    }
-
-    pub fn parse(text: &str) -> Result<Self, Unfit> {
-        let profile: Self = toml::from_str(text).map_err(|e| Unfit::File(e.to_string()))?;
-        let mut seen: BTreeSet<&str> = BTreeSet::new();
-        for row in &profile.number {
-            if !seen.insert(row.name.as_str()) {
-                return Err(Unfit::Duplicate(row.name.clone()));
-            }
-            if let Some(measured) = row.measured {
-                if measured > row.ceiling {
-                    return Err(Unfit::Stale {
-                        name: row.name.clone(),
-                        measured,
-                        ceiling: row.ceiling,
-                    });
-                }
-            }
-        }
-        Ok(profile)
-    }
-
-    pub fn row(&self, name: &str) -> Option<&Row> {
-        self.number.iter().find(|row| row.name == name)
-    }
-
-    /// How many members `boot`'s job list may carry, from the allowance this
-    /// file prices for it. A boot with no allowance is refused, like any other
-    /// unpriced number: a list nobody has priced cannot be sized to the bound.
-    pub fn members_per_boot(&self, boot: &str) -> Result<usize, Unfit> {
-        let name = job_ms_row(boot);
-        let row = self.row(&name).ok_or(Unfit::Unpriced(name))?;
-        Ok(members_per_boot(row.ceiling))
-    }
-
-    /// One reading against its row. A name with no row is refused.
-    pub fn judge(&self, name: &str, value: u64) -> Result<(), Unfit> {
-        let Some(row) = self.row(name) else { return Err(Unfit::Unpriced(name.to_string())) };
-        if value > row.ceiling {
-            return Err(Unfit::Over {
-                name: row.name.clone(),
-                unit: row.unit.clone(),
-                value,
-                ceiling: row.ceiling,
-                from: row.ceiling_from.clone(),
-            });
-        }
-        Ok(())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn root() -> &'static Path {
-        Path::new(env!("CARGO_MANIFEST_DIR"))
-    }
-
-    /// Every constant a `ceiling_from` may name, and what it holds.
-    ///
-    /// **The file says where a ceiling came from, and this is what makes that
-    /// true.** A row naming a constant carried a literal nobody re-derived when
-    /// the constant moved: fifteen rows read 360 against a `return_secs` of 420,
-    /// so a boot back in 361-420 s was inside the driver's own wait and red on a
-    /// ceiling nobody wrote.
-    const NAMED: &[(&str, u64)] = &[
-        ("toyos_build::metal::return_secs", 420),
-        ("toyos_build::metal::STICK_SECS", 30),
-        ("toyos_tco::JOB_BOUND_MS", toyos_tco::JOB_BOUND_MS),
-        ("toyos_tco::BOUND_MS", toyos_tco::BOUND_MS),
-        ("toyos_tco::WEDGE_BOUND_MS", toyos_tco::WEDGE_BOUND_MS),
-        ("toyos_tco::HARD_LOCKUP_BOUND_MS", toyos_tco::HARD_LOCKUP_BOUND_MS),
-    ];
-
-    /// A row whose ceiling *is* a constant this repository declares carries that
-    /// constant's value.
-    #[test]
-    fn a_ceiling_that_names_a_constant_carries_it() {
-        assert_eq!(crate::metal::return_secs(), 420, "the derivation moved");
-        assert_eq!(crate::metal::STICK_SECS, 30);
-        let profile = Profile::load(root()).expect(PATH);
-        let mut checked = 0usize;
-        for row in &profile.number {
-            let Some((named, want)) =
-                NAMED.iter().find(|(named, _)| row.ceiling_from.starts_with(named))
-            else {
-                continue;
-            };
-            checked += 1;
-            assert_eq!(
-                row.ceiling, *want,
-                "{:?} says its ceiling is {named}, and {named} is {want}",
-                row.name
-            );
-        }
-        assert!(checked > 0, "no row names a constant, so this gate holds nothing");
-    }
-
-    /// The committed file parses, no name is priced twice, and no row's own
-    /// recorded reading is already past the ceiling beside it.
-    #[test]
-    fn the_committed_profile_is_well_formed() {
-        let profile = Profile::load(root()).expect("tests/metal-profile.toml");
-        assert!(
-            !profile.number.is_empty(),
-            "{PATH} prices nothing, so every number the suite measures would be unpriced"
-        );
-        for row in &profile.number {
-            assert!(!row.unit.is_empty(), "{:?} has no unit", row.name);
-            assert!(
-                !row.ceiling_from.is_empty(),
-                "{:?}'s ceiling says nowhere it came from, which makes it a guess",
-                row.name
-            );
-        }
-    }
-
-    /// The gate is the ceiling and not the reading: a number nobody priced is
-    /// refused rather than passed.
-    #[test]
-    fn an_unpriced_number_is_refused_and_not_passed() {
-        let profile = Profile::parse(
-            "[[number]]\nname = \"boot.a.complete_ms\"\nunit = \"ms\"\nceiling = 100\n\
-             ceiling_from = \"a constant\"\n",
-        )
-        .unwrap();
-        assert_eq!(profile.judge("boot.a.complete_ms", 100), Ok(()));
-        assert!(matches!(profile.judge("boot.a.complete_ms", 101), Err(Unfit::Over { .. })));
-        assert_eq!(
-            profile.judge("boot.b.complete_ms", 1),
-            Err(Unfit::Unpriced("boot.b.complete_ms".to_string()))
-        );
-        let said = profile.judge("boot.b.complete_ms", 1).unwrap_err().to_string();
-        assert!(said.contains("cannot fail"), "{said}");
-    }
-
-    #[test]
-    fn a_row_whose_reading_is_past_its_own_ceiling_is_refused_at_the_file() {
-        let refusal = Profile::parse(
-            "[[number]]\nname = \"n\"\nunit = \"ms\"\nceiling = 10\nceiling_from = \"c\"\n\
-             measured = 11\n",
-        )
-        .unwrap_err();
-        assert_eq!(
-            refusal,
-            Unfit::Stale { name: "n".to_string(), measured: 11, ceiling: 10 }
-        );
-        assert!(matches!(
-            Profile::parse(
-                "[[number]]\nname = \"n\"\nunit = \"ms\"\nceiling = 10\nceiling_from = \"c\"\n\
-                 [[number]]\nname = \"n\"\nunit = \"ms\"\nceiling = 20\nceiling_from = \"c\"\n"
-            ),
-            Err(Unfit::Duplicate(_))
-        ));
-    }
-}
-
-#[cfg(test)]
-mod sizing_tests {
-    use super::*;
-
-    fn root() -> &'static Path {
-        Path::new(env!("CARGO_MANIFEST_DIR"))
-    }
-
-    /// **The overrun this rule exists for, in the machine's own numbers.** The
-    /// `shared` boot's seventy-two members at their committed 845 ms each are
-    /// 60.8 s inside a 60 s bound, so the runner resets the machine with the
-    /// tail unrun and each of those is reported as a missing exit record rather
-    /// than as a list too long for the bound.
-    #[test]
-    fn the_shared_list_does_not_fit_one_boot() {
-        let profile = Profile::load(root()).expect(PATH);
-        let per = profile.members_per_boot("shared").expect("shared is priced");
-        assert!(
-            per < 72,
-            "the allowance leaves room for {per} members and the list carries 72"
-        );
-        // Two chunks and not three: a list cut finer costs another minute of
-        // the machine for nothing.
-        assert_eq!(72_usize.div_ceil(per), 2, "{per} members a boot");
-        let measured =
-            profile.row(&job_ms_row("shared")).and_then(|r| r.measured).expect("a reading");
-        assert!(
-            72 * measured > toyos_tco::JOB_BOUND_MS,
-            "{measured} ms a member over 72 members fits the bound, so this rule cuts nothing"
-        );
-    }
-
-    /// `ccorpus` fits its bound and the same rule still cuts it: four fifths of
-    /// a bound is no margin for a slower stick, and the price of being wrong is
-    /// every member after the cut losing its verdict.
-    #[test]
-    fn a_corpus_that_fits_its_bound_is_cut_too() {
-        let profile = Profile::load(root()).expect(PATH);
-        let per = profile.members_per_boot("ccorpus").expect("ccorpus is priced");
-        assert_eq!(118_usize.div_ceil(per), 2, "{per} members a boot");
-    }
-
-    /// A member priced above the whole bound still gets a boot, rather than a
-    /// division that yields zero and a list that can hold nothing.
-    #[test]
-    fn a_member_priced_beyond_the_bound_still_gets_a_boot() {
-        assert_eq!(members_per_boot(toyos_tco::JOB_BOUND_MS * 10), 1);
-        let spendable = toyos_tco::JOB_BOUND_MS - AROUND_THE_LIST_MS;
-        assert_eq!(members_per_boot(spendable), 1);
-        assert_eq!(members_per_boot(spendable / 2), 2);
-    }
-
-    /// **`lan_hold` sleeps a bound this file prices.** The guest binary holds
-    /// the machine up for `toyos_tco::LEASE_BOUND_MS`, and the boot's own job
-    /// allowance has to outlast it or the runner's deadline cuts the window the
-    /// host reaches that machine across.
-    #[test]
-    fn the_window_lan_hold_sleeps_is_the_window_this_file_prices() {
-        let profile = Profile::load(root()).expect(PATH);
-        let hold = toyos_tco::LEASE_BOUND_MS;
-        let job = profile.row(&job_ms_row("lancase")).expect("lancase's own allowance");
-        assert!(job.ceiling > hold, "{} against a {hold} ms hold", job.ceiling);
-        for name in ["lan.lancase.link_up_ms", "lan.lancase.lease_ms"] {
-            let row = profile.row(name).unwrap_or_else(|| panic!("{name} is priced"));
-            assert_eq!(row.ceiling, hold, "{name}");
-        }
-    }
-
-    /// **`lan_talk_hold` sleeps to the runner's bound less the tenth this file
-    /// keeps for the boot around a list**, and the talking boot's allowance is
-    /// that span: a hold longer than it is cut by the runner, and the boot is
-    /// then ended by the bound it exists to stay inside.
-    #[test]
-    fn the_talking_boots_hold_ends_where_its_list_does() {
-        let profile = Profile::load(root()).expect(PATH);
-        let hold = toyos_tco::JOB_BOUND_MS - AROUND_THE_LIST_MS;
-        let job = profile.row(&job_ms_row("lantalkcase")).expect("lantalkcase's own allowance");
-        assert_eq!(job.ceiling, hold);
-        assert_eq!(members_per_boot(job.ceiling), 1);
-        let source = std::fs::read_to_string(
-            root().join("tests/toyos-rust-tests/src/bin/lan_talk_hold.rs"),
-        )
-        .expect("the hold's source");
-        assert!(
-            source.contains("toyos_tco::JOB_BOUND_MS - toyos_tco::JOB_BOUND_MS / 10"),
-            "lan_talk_hold no longer ends at the runner's bound less its tenth"
-        );
-        assert_eq!(AROUND_THE_LIST_MS, toyos_tco::JOB_BOUND_MS / 10);
-    }
-
-    /// A boot whose allowance nobody wrote down is refused, not given the
-    /// bound: the whole point of the row is that a list is cut to a number
-    /// somebody committed.
-    #[test]
-    fn a_boot_with_no_allowance_is_refused() {
-        let profile = Profile::parse("").expect("an empty profile parses");
-        assert_eq!(
-            profile.members_per_boot("nobody"),
-            Err(Unfit::Unpriced("list.nobody.job_ms".to_string()))
-        );
-    }
-}
diff --git a/src/metaltimings.rs b/src/metaltimings.rs
new file mode 100644
index 00000000000..de930057aee
--- /dev/null
+++ b/src/metaltimings.rs
@@ -0,0 +1,493 @@
+//! Every number the metal suite measures, recorded per machine and judged only
+//! against the record of the machine that measured it.
+//!
+//! One file per machine under [`DIR`], named for its SMBIOS vendor and product,
+//! written by a run and committed by whoever ran it. A run on a machine with no
+//! record is recorded and not judged; a name the record lacks is added and not
+//! judged, and only off a boot with no failure of its own; a recorded value is
+//! never moved by a run, so a slow run cannot become the baseline the next is
+//! judged by. A run under a BIOS other than the record's is judged against it,
+//! fails naming both, and records nothing. Deleting a row is how a number is
+//! re-recorded, and deleting the file is how a machine is, firmware and all.
+//!
+//! [`ceiling`] is the one rule.
+
+#![forbid(unsafe_code)]
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+
+use serde::{Deserialize, Serialize};
+
+/// Where the records live, relative to the repository root.
+pub const DIR: &str = "tests/metal";
+
+/// Past this a reading is a red: twice what the machine recorded, and a record
+/// of zero counts as one unit, the resolution the number was read at.
+pub fn ceiling(recorded: u64) -> u64 {
+    recorded.max(1).saturating_mul(2)
+}
+
+/// A machine as its own firmware names it: SMBIOS type 1's manufacturer and
+/// product and type 0's BIOS version.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Machine {
+    pub vendor: String,
+    pub product: String,
+    pub bios: String,
+}
+
+impl Machine {
+    /// Asked of the operating system the machine runs between boots; all three
+    /// files are world-readable, unlike the serial and UUID beside them.
+    pub const QUERY: &str =
+        "cat /sys/class/dmi/id/sys_vendor /sys/class/dmi/id/product_name /sys/class/dmi/id/bios_version";
+
+    /// [`Self::QUERY`]'s answer: one non-empty line per file.
+    pub fn parse(text: &str) -> Result<Self, String> {
+        let lines: Vec<&str> = text.lines().map(str::trim).collect();
+        match lines[..] {
+            [vendor, product, bios]
+                if !vendor.is_empty() && !product.is_empty() && !bios.is_empty() =>
+            {
+                Ok(Self {
+                    vendor: vendor.to_string(),
+                    product: product.to_string(),
+                    bios: bios.to_string(),
+                })
+            }
+            _ => Err(format!(
+                "`{}` answered {text:?}, not three non-empty lines",
+                Self::QUERY
+            )),
+        }
+    }
+
+    /// Where this machine's record lives, relative to the repository root.
+    pub fn path(&self) -> PathBuf {
+        path(&self.vendor, &self.product)
+    }
+}
+
+fn path(vendor: &str, product: &str) -> PathBuf {
+    let mut slug = String::new();
+    for c in format!("{vendor} {product}").chars() {
+        if c.is_ascii_alphanumeric() {
+            slug.push(c.to_ascii_lowercase());
+        } else if !slug.is_empty() && !slug.ends_with('-') {
+            slug.push('-');
+        }
+    }
+    Path::new(DIR).join(format!("{}.toml", slug.trim_end_matches('-')))
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Record {
+    pub vendor: String,
+    pub product: String,
+    pub bios: String,
+    pub measured: BTreeMap<String, u64>,
+}
+
+impl Record {
+    /// `machine`'s record under `root`, `None` where it has none.
+    pub fn load(root: &Path, machine: &Machine) -> Result<Option<Self>, String> {
+        let at = root.join(machine.path());
+        let record = match Self::read(&at) {
+            Ok(record) => record,
+            Err(Unread::Missing) => return Ok(None),
+            Err(Unread::Refused(why)) => return Err(why),
+        };
+        if (record.vendor.as_str(), record.product.as_str())
+            != (machine.vendor.as_str(), machine.product.as_str())
+        {
+            return Err(format!(
+                "{} records {} {} and {} {} ran: two machines share one file name",
+                at.display(),
+                record.vendor,
+                record.product,
+                machine.vendor,
+                machine.product
+            ));
+        }
+        Ok(Some(record))
+    }
+
+    fn read(at: &Path) -> Result<Self, Unread> {
+        let text = std::fs::read_to_string(at).map_err(|e| match e.kind() {
+            std::io::ErrorKind::NotFound => Unread::Missing,
+            _ => Unread::Refused(format!("{}: {e}", at.display())),
+        })?;
+        toml::from_str(&text).map_err(|e| Unread::Refused(format!("{}: {e}", at.display())))
+    }
+
+    pub fn save(&self, root: &Path) -> Result<PathBuf, String> {
+        let at = root.join(path(&self.vendor, &self.product));
+        let text = toml::to_string(self).map_err(|e| e.to_string())?;
+        std::fs::create_dir_all(root.join(DIR)).map_err(|e| format!("{DIR}: {e}"))?;
+        std::fs::write(&at, text).map_err(|e| format!("{}: {e}", at.display()))?;
+        Ok(at)
+    }
+}
+
+enum Unread {
+    Missing,
+    Refused(String),
+}
+
+/// One number a run measured, and whether the boot that measured it passed:
+/// every reading is judged, and only a passing boot's becomes a record.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Reading {
+    pub value: u64,
+    pub passed: bool,
+}
+
+/// A reading past [`ceiling`] of its record.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Over {
+    pub name: String,
+    pub value: u64,
+    pub recorded: u64,
+}
+
+impl std::fmt::Display for Over {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "{} is {} against {} recorded on this machine, past the ceiling of {}",
+            self.name,
+            self.value,
+            self.recorded,
+            ceiling(self.recorded)
+        )
+    }
+}
+
+/// A run under a BIOS other than the one its machine's record was taken under.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Firmware {
+    pub recorded: String,
+    pub ran: String,
+}
+
+impl std::fmt::Display for Firmware {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "this machine's record was taken under BIOS {:?} and this run booted under {:?}, so \
+             it records nothing; deleting the record is how this firmware is recorded afresh",
+            self.recorded, self.ran
+        )
+    }
+}
+
+/// What one run's readings come to on `machine`.
+#[derive(Debug)]
+pub struct Judged {
+    pub over: Vec<Over>,
+    pub firmware: Option<Firmware>,
+    /// Recorded names this run measured nothing for.
+    pub unmeasured: Vec<String>,
+    /// The record after this run, and whether this run changed it.
+    pub record: Record,
+    pub changed: bool,
+}
+
+pub fn judge(
+    machine: &Machine,
+    record: Option<Record>,
+    measured: &BTreeMap<String, Reading>,
+) -> Judged {
+    let mut record = record.unwrap_or_else(|| Record {
+        vendor: machine.vendor.clone(),
+        product: machine.product.clone(),
+        bios: machine.bios.clone(),
+        measured: BTreeMap::new(),
+    });
+    let firmware = (record.bios != machine.bios)
+        .then(|| Firmware { recorded: record.bios.clone(), ran: machine.bios.clone() });
+    let unmeasured =
+        record.measured.keys().filter(|name| !measured.contains_key(*name)).cloned().collect();
+    let mut over = Vec::new();
+    let mut changed = false;
+    for (name, reading) in measured {
+        match record.measured.get(name) {
+            Some(&recorded) if reading.value > ceiling(recorded) => {
+                over.push(Over {
+                    name: name.clone(),
+                    value: reading.value,
+                    recorded,
+                });
+            }
+            Some(_) => {}
+            None if reading.passed && firmware.is_none() => {
+                record.measured.insert(name.clone(), reading.value);
+                changed = true;
+            }
+            None => {}
+        }
+    }
+    Judged {
+        over,
+        firmware,
+        unmeasured,
+        record,
+        changed,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const BIOS: &str = "N34ET71W (1.71 )";
+
+    fn t14(bios: &str) -> Machine {
+        Machine {
+            vendor: "LENOVO".to_string(),
+            product: "20W0003AMZ".to_string(),
+            bios: bios.to_string(),
+        }
+    }
+
+    fn readings(pairs: &[(&str, u64)]) -> BTreeMap<String, Reading> {
+        pairs
+            .iter()
+            .map(|(name, value)| ((*name).to_string(), Reading { value: *value, passed: true }))
+            .collect()
+    }
+
+    fn values(pairs: &[(&str, u64)]) -> BTreeMap<String, u64> {
+        pairs.iter().map(|(name, value)| ((*name).to_string(), *value)).collect()
+    }
+
+    fn recorded(machine: &Machine, pairs: &[(&str, u64)]) -> Record {
+        judge(machine, None, &readings(pairs)).record
+    }
+
+    #[test]
+    fn a_known_machine_within_its_record_passes() {
+        let machine = t14(BIOS);
+        let record = recorded(
+            &machine,
+            &[("boot.a.complete_ms", 1166), ("boot.a.panel_max_us", 0)],
+        );
+        let judged = judge(
+            &machine,
+            Some(record.clone()),
+            &readings(&[("boot.a.complete_ms", 2332), ("boot.a.panel_max_us", 2)]),
+        );
+        assert_eq!(judged.over, Vec::new());
+        assert_eq!(judged.firmware, None);
+        assert!(!judged.changed);
+        assert_eq!(judged.record, record);
+    }
+
+    #[test]
+    fn a_known_machine_outside_its_record_fails_and_keeps_its_record() {
+        let machine = t14(BIOS);
+        let record = recorded(
+            &machine,
+            &[("boot.a.complete_ms", 1166), ("boot.a.panel_max_us", 0)],
+        );
+        let judged = judge(
+            &machine,
+            Some(record.clone()),
+            &readings(&[("boot.a.complete_ms", 2333), ("boot.a.panel_max_us", 3)]),
+        );
+        assert_eq!(
+            judged.over,
+            vec![
+                Over {
+                    name: "boot.a.complete_ms".to_string(),
+                    value: 2333,
+                    recorded: 1166
+                },
+                Over {
+                    name: "boot.a.panel_max_us".to_string(),
+                    value: 3,
+                    recorded: 0
+                },
+            ]
+        );
+        assert_eq!(
+            judged.record, record,
+            "a red reading moved the record it is judged by"
+        );
+    }
+
+    #[test]
+    fn an_unknown_machine_is_recorded_and_not_judged() {
+        let machine = t14(BIOS);
+        let judged = judge(
+            &machine,
+            None,
+            &readings(&[("boot.a.complete_ms", u64::MAX)]),
+        );
+        assert_eq!(judged.over, Vec::new());
+        assert!(judged.changed);
+        assert_eq!(
+            judged.record.measured,
+            values(&[("boot.a.complete_ms", u64::MAX)])
+        );
+        assert_eq!(judged.record.bios, machine.bios);
+    }
+
+    /// **A firmware update is no re-baseline.** The run is still judged
+    /// against what the machine recorded, fails naming both strings, and adds
+    /// nothing a later run under either BIOS would be judged by.
+    #[test]
+    fn another_bios_fails_naming_both_and_records_nothing() {
+        let old = recorded(
+            &t14("N34ET50W (1.50 )"),
+            &[("boot.a.complete_ms", 1000), ("boot.a.gone_ms", 5)],
+        );
+        let judged = judge(
+            &t14(BIOS),
+            Some(old.clone()),
+            &readings(&[("boot.a.complete_ms", 9000), ("boot.a.new_ms", 1)]),
+        );
+        assert_eq!(
+            judged.firmware,
+            Some(Firmware { recorded: "N34ET50W (1.50 )".to_string(), ran: BIOS.to_string() })
+        );
+        let said = judged.firmware.as_ref().expect("a firmware finding").to_string();
+        assert!(said.contains("N34ET50W (1.50 )") && said.contains(BIOS), "{said}");
+        assert_eq!(
+            judged.over,
+            vec![Over { name: "boot.a.complete_ms".to_string(), value: 9000, recorded: 1000 }]
+        );
+        assert!(!judged.changed);
+        assert_eq!(judged.record, old);
+    }
+
+    #[test]
+    fn a_new_name_on_a_known_machine_is_recorded_and_not_failed() {
+        let machine = t14(BIOS);
+        let record = recorded(&machine, &[("boot.a.complete_ms", 1166)]);
+        let judged = judge(
+            &machine,
+            Some(record),
+            &readings(&[
+                ("boot.a.complete_ms", 1166),
+                ("boot.usbload.panel_us", 21012),
+            ]),
+        );
+        assert_eq!(judged.over, Vec::new());
+        assert!(judged.changed);
+        assert_eq!(
+            judged.record.measured,
+            values(&[
+                ("boot.a.complete_ms", 1166),
+                ("boot.usbload.panel_us", 21012)
+            ])
+        );
+    }
+
+    /// **A failed boot's numbers are judged and never become a baseline.**
+    #[test]
+    fn a_failing_boots_reading_is_judged_and_not_recorded() {
+        let machine = t14(BIOS);
+        let record = recorded(&machine, &[("boot.a.complete_ms", 1000)]);
+        let failed = |value| Reading { value, passed: false };
+        let measured: BTreeMap<String, Reading> = [
+            ("boot.a.complete_ms".to_string(), failed(2001)),
+            ("boot.b.complete_ms".to_string(), failed(7)),
+            ("boot.c.complete_ms".to_string(), Reading { value: 9, passed: true }),
+        ]
+        .into_iter()
+        .collect();
+        let judged = judge(&machine, Some(record), &measured);
+        assert_eq!(
+            judged.over,
+            vec![Over { name: "boot.a.complete_ms".to_string(), value: 2001, recorded: 1000 }]
+        );
+        assert_eq!(
+            judged.record.measured,
+            values(&[("boot.a.complete_ms", 1000), ("boot.c.complete_ms", 9)])
+        );
+    }
+
+    #[test]
+    fn a_recorded_name_nothing_measured_is_named() {
+        let machine = t14(BIOS);
+        let record = recorded(&machine, &[("boot.a.complete_ms", 1), ("boot.b.complete_ms", 1)]);
+        let judged = judge(&machine, Some(record), &readings(&[("boot.a.complete_ms", 1)]));
+        assert_eq!(judged.unmeasured, vec!["boot.b.complete_ms".to_string()]);
+    }
+
+    #[test]
+    fn a_record_survives_the_file_it_is_written_to() {
+        let root = toyos_tmpdir::TempDir::new("metaltimings");
+        let machine = t14(BIOS);
+        assert_eq!(Record::load(&root, &machine), Ok(None));
+        let record = recorded(
+            &machine,
+            &[("boot.a.complete_ms", 1166), ("tlb.a.p50_ns", 2258)],
+        );
+        let at = record.save(&root).expect("save");
+        assert_eq!(at, root.join("tests/metal/lenovo-20w0003amz.toml"));
+        assert_eq!(Record::load(&root, &machine), Ok(Some(record)));
+    }
+
+    /// The file name folds case and punctuation, so two spellings of one
+    /// vendor land on one file, and the record inside says which it holds.
+    #[test]
+    fn two_machines_sharing_a_file_name_are_refused() {
+        let root = toyos_tmpdir::TempDir::new("metaltimings");
+        let lenovo = Machine { vendor: "Lenovo".to_string(), ..t14(BIOS) };
+        recorded(&lenovo, &[("boot.a.complete_ms", 1)]).save(&root).expect("save");
+        let why = Record::load(&root, &t14(BIOS)).expect_err("read as another machine");
+        assert!(why.contains("two machines share one file name"), "{why}");
+    }
+
+    #[test]
+    fn a_name_recorded_twice_is_refused() {
+        let root = toyos_tmpdir::TempDir::new("metaltimings");
+        let machine = t14(BIOS);
+        let at = recorded(&machine, &[("boot.a.complete_ms", 1)]).save(&root).expect("save");
+        let text = std::fs::read_to_string(&at).expect("the saved record");
+        std::fs::write(&at, format!("{text}\n\"boot.a.complete_ms\" = 2\n")).expect("write");
+        let why = Record::load(&root, &machine).expect_err("a second value under one name");
+        assert!(why.contains("duplicate"), "{why}");
+    }
+
+    /// **Every committed record, as the next run will read it.** A hand edit
+    /// that breaks a file, or a file not at the path its own machine derives,
+    /// is red here rather than at the end of a run on the machine.
+    #[test]
+    fn every_committed_record_loads_from_its_own_path() {
+        let root = Path::new(env!("CARGO_MANIFEST_DIR"));
+        let mut read = 0;
+        for entry in std::fs::read_dir(root.join(DIR)).expect(DIR) {
+            let at = entry.expect(DIR).path();
+            let named = at.strip_prefix(root).expect("under the root").to_path_buf();
+            let record = match Record::read(&at) {
+                Ok(record) => record,
+                Err(Unread::Missing) => panic!("{} went while this read it", named.display()),
+                Err(Unread::Refused(why)) => panic!("{why}"),
+            };
+            let machine = Machine {
+                vendor: record.vendor.clone(),
+                product: record.product.clone(),
+                bios: record.bios.clone(),
+            };
+            assert_eq!(machine.path(), named, "a record is not at its machine's path");
+            assert_eq!(Record::load(root, &machine), Ok(Some(record)));
+            read += 1;
+        }
+        assert!(read > 0, "{DIR} holds no record, so this read nothing");
+    }
+
+    #[test]
+    fn a_machine_is_three_non_empty_lines() {
+        assert_eq!(
+            Machine::parse("LENOVO\n20W0003AMZ\nN34ET71W (1.71 )\n"),
+            Ok(t14(BIOS))
+        );
+        assert!(Machine::parse("LENOVO\n20W0003AMZ\n").is_err());
+        assert!(Machine::parse("LENOVO\n\nN34ET71W (1.71 )\n").is_err());
+    }
+}
diff --git a/tests/checks.rs b/tests/checks.rs
index 0eada7d8b95..0bfca6e3cd7 100644
--- a/tests/checks.rs
+++ b/tests/checks.rs
@@ -11,6 +11,8 @@ mod checks {
     mod audio_checks;
     #[path = "clock.rs"]
     mod clock_checks;
+    #[path = "metal.rs"]
+    mod metal_checks;
     #[path = "qemu.rs"]
     mod qemu_checks;
     #[path = "screen.rs"]
@@ -690,8 +692,51 @@ mod checks {
         audio_checks::judges_verdict()
     }
 
-    /// `blackbox_unclaimed_page` is a registration `tests/metal-profile.toml` already prices,
-    /// so sizing and batching run for real.
+    #[test]
+    fn metal_stop_owes_its_record_and_leaves_no_operation_open() {
+        metal_checks::the_stop_owes_its_record_and_leaves_no_operation_open();
+    }
+
+    #[test]
+    fn metal_bound_fires_within_one_period_of_itself() {
+        metal_checks::a_bound_fires_within_one_period_of_itself();
+    }
+
+    #[test]
+    fn metal_name_measured_twice_is_refused() {
+        metal_checks::a_name_measured_twice_is_refused();
+    }
+
+    #[test]
+    fn metal_boot_with_a_failure_of_its_own_adds_no_row() {
+        metal_checks::a_boot_with_a_failure_of_its_own_adds_no_row();
+    }
+
+    #[test]
+    fn metal_name_two_boots_measured_is_refused() {
+        metal_checks::a_name_two_boots_measured_is_refused();
+    }
+
+    #[test]
+    fn metal_reading_past_its_record_fails_and_moves_nothing() {
+        metal_checks::a_reading_past_its_record_fails_and_moves_nothing();
+    }
+
+    #[test]
+    fn metal_run_under_another_bios_fails_and_records_nothing() {
+        metal_checks::a_run_under_another_bios_fails_and_records_nothing();
+    }
+
+    #[test]
+    fn metal_failing_shared_member_fails_its_boot() {
+        metal_checks::a_failing_shared_member_fails_its_boot();
+    }
+
+    #[test]
+    fn metal_cleared_page_owes_no_panel() {
+        metal_checks::a_cleared_page_owes_no_panel();
+    }
+
     #[test]
     fn metal_list_from_parse_reaches_run_without_the_machine() -> Result<(), String> {
         let args: Vec<String> = ["--metal", "--list"].iter().map(ToString::to_string).collect();
@@ -827,16 +872,6 @@ mod checks {
         assert!(judge(&[&readback("foreignrecord", &unbounded, kernel)]).is_err());
     }
 
-    /// The foreign-identity boot owes no fact off the page its next pass
-    /// cleared; any other boot owes each one but a path it did not take.
-    #[test]
-    fn a_cleared_page_owes_no_fact_off_it() {
-        let bound = "boot-deadline=120000";
-        assert!(metal::owes_nothing("panel_us", &[toyos_build::metal::FOREIGN_RECORD_ARM, bound]));
-        assert!(!metal::owes_nothing("panel_us", &[bound]));
-        assert!(metal::owes_nothing("park_open_operations", &[bound]));
-    }
-
     /// A T14 controller's handoff: it publishes USB Legacy Support and
     /// firmware never claimed it. The T14 has two, and each is judged.
     #[test]
diff --git a/tests/checks/metal.rs b/tests/checks/metal.rs
new file mode 100644
index 00000000000..fbcfa465905
--- /dev/null
+++ b/tests/checks/metal.rs
@@ -0,0 +1,356 @@
+//! The metal harness's rules over planted readbacks, each written as the loop
+//! writes one and read as a run reads one.
+
+use super::*;
+use metal::{Metal, Readback};
+use toyos_build::metal::{
+    verdict_file, Refusal, BACK_SECS, BIOS_KEY, PRODUCT_KEY, READBACK_BOOT, READBACK_KERNEL,
+    READBACK_LOADER, READBACK_VERDICT, STICK_SECS_KEY, VENDOR_KEY,
+};
+use toyos_build::metaltimings::{Machine, Record};
+
+const PANEL: &str = "| panel: paints=10 px=8741248 us=21751 max_us=3851\n";
+const BOOTED: &str = "[2026-09-29 18:22:39 1.165 cpu0] Boot: complete (1165ms)\n";
+
+fn t14() -> Machine {
+    Machine {
+        vendor: "LENOVO".to_string(),
+        product: "20W0003AMZ".to_string(),
+        bios: "N34ET71W (1.71 )".to_string(),
+    }
+}
+
+/// A `loader.log` whose pass after the reset reads `page`.
+fn loader(page: &str) -> String {
+    format!(
+        "{}\n{}\n{}\n{}\n{page}",
+        bootlog::LOADER_FIRST_LINE,
+        bootlog::LOADER_LAST_LINE,
+        bootlog::SEPARATOR,
+        bootlog::LOADER_FIRST_LINE
+    )
+}
+
+/// The record of arming the deadline, at the 60 ms the T14 arms it.
+fn armed() -> String {
+    format!(
+        "[2026-09-29 18:22:39 0.060 cpu0] {}120000 ms, after which this kernel seals a WEDGED \
+         record and writes the reset register itself\n{BOOTED}",
+        bootlog::DEADLINE_ARMED
+    )
+}
+
+fn expired_at(reached: i64) -> String {
+    format!(
+        "{PANEL}| {}: a bound of 120000 ms, reached at {reached} ms, with this machine in \
+         `complete`.\n",
+        bootlog::DEADLINE_EXPIRED
+    )
+}
+
+/// One boot's readback as the loop writes it.
+fn plant(dir: &Path, label: &str, page: &str, kernel: &str, verdict: Option<&Refusal>) {
+    let home = metal::at(dir, label);
+    fs::create_dir_all(&home).expect("a readback directory");
+    let boot = format!(
+        "{BACK_SECS} 40\n{STICK_SECS_KEY} 0\n{VENDOR_KEY} LENOVO\n{PRODUCT_KEY} 20W0003AMZ\n\
+         {BIOS_KEY} N34ET71W (1.71 )\n"
+    );
+    for (name, text) in [
+        (READBACK_LOADER, loader(page)),
+        (READBACK_KERNEL, kernel.to_string()),
+        (READBACK_BOOT, boot),
+        (READBACK_VERDICT, verdict_file(verdict)),
+    ] {
+        fs::write(home.join(name), text).expect("a planted file");
+    }
+}
+
+/// One boot the loop passed, read back.
+fn planted(page: &str, kernel: &str) -> Readback {
+    let dir = toyos_tmpdir::TempDir::new("metal-readback");
+    plant(&dir, "planted", page, kernel, None);
+    metal::read_readback(&dir, "planted").expect("a planted readback")
+}
+
+fn read(dir: &Path, labels: &[&str]) -> BTreeMap<String, Result<Readback, String>> {
+    labels.iter().map(|label| (label.to_string(), metal::read_readback(dir, label))).collect()
+}
+
+/// **The stop's two refusals, each on the page that has to draw it**: a boot
+/// that handed the machine back owes the stop's record, and a record with a
+/// block operation still open is a sync about a machine that was still writing.
+pub fn the_stop_owes_its_record_and_leaves_no_operation_open() {
+    let whole = toyos_quiesce::Record {
+        sweep: toyos_quiesce::Sweep { stopped: 6, running: 0 },
+        elapsed_ms: 11,
+        budget_ms: 2010,
+        sweeps: 3,
+        cpus: 8,
+        in_flight: 0,
+        begun: 4812,
+    };
+    let handed_back = |stop: &str| format!("Black box: {}\n{PANEL}{stop}", bootlog::HANDED_BACK);
+    assert_eq!(planted(&handed_back(&format!("| {whole}\n")), BOOTED).stop_completed(), Ok(()));
+    let why = planted(&handed_back(""), BOOTED)
+        .stop_completed()
+        .expect_err("a boot that handed the machine back with no record of its stop");
+    assert!(why.contains("carries no record of the stop"), "{why}");
+    let open = toyos_quiesce::Record { in_flight: 1, ..whole };
+    let why = planted(&handed_back(&format!("| {open}\n")), BOOTED)
+        .stop_completed()
+        .expect_err("a stop that left an operation open");
+    assert!(why.contains("1 block operation(s) open"), "{why}");
+    let ended = format!("Previous boot's panic: the last boot read WEDGED\n{PANEL}");
+    assert_eq!(planted(&ended, BOOTED).stop_completed(), Ok(()));
+}
+
+/// Each bound's lateness against the period of what polls it, a millisecond
+/// either way and no further.
+pub fn a_bound_fires_within_one_period_of_itself() {
+    let quantum = i64::try_from(toyos_sched::fair::QUANTUM_NS / 1_000_000).expect("ms");
+    let deadline = |late: i64| planted(&expired_at(120_060 + late), &armed()).deadline_on_time();
+    assert_eq!(deadline(4), Ok(()));
+    assert_eq!(deadline(quantum + 1), Ok(()));
+    assert!(deadline(quantum + 2).is_err());
+    assert_eq!(deadline(-1), Ok(()));
+    assert!(deadline(-2).is_err());
+    let unarmed = planted(&expired_at(120_064), BOOTED).deadline_on_time();
+    assert!(unarmed.is_err(), "an expiry with no arm to count from passed");
+
+    let sample = i64::try_from(toyos_tco::HARD_LOCKUP_SAMPLE_NS / 1_000_000).expect("ms");
+    let lockup = |late: i64| {
+        let page = format!(
+            "{PANEL}| {}: cpu7 has taken no interrupt for {} ms, with `IF` clear at every \
+             sample in that span. Its bound is 60000 ms.\n",
+            bootlog::LOCKED_UP,
+            60_000 + late
+        );
+        planted(&page, BOOTED).lockup_on_time()
+    };
+    assert_eq!(lockup(4), Ok(()));
+    assert_eq!(lockup(sample + 1), Ok(()));
+    assert!(lockup(sample + 2).is_err());
+
+    let neither = planted(PANEL, BOOTED);
+    assert_eq!((neither.deadline_on_time(), neither.lockup_on_time()), (Ok(()), Ok(())));
+}
+
+pub fn a_name_measured_twice_is_refused() {
+    let back = planted(PANEL, BOOTED);
+    assert_eq!(back.measured("span.planted.us", 1), Ok(()));
+    let why = back.measured("span.planted.us", 2).expect_err("a second value");
+    assert!(why.contains("twice"), "{why}");
+}
+
+fn span(b: &[&Readback]) -> Result<(), String> {
+    b[0].measured(&format!("span.{}.us", b[0].label), 7)
+}
+
+fn span_and_fail(b: &[&Readback]) -> Result<(), String> {
+    span(b)?;
+    Err("a planted failure".to_string())
+}
+
+fn unqualified(b: &[&Readback]) -> Result<(), String> {
+    b[0].measured("latency.p99_us", 16)
+}
+
+static PASSING: Metal =
+    Metal::Runs { arms: &[metal::once("passing", "tests/jobcase", &[], &[])], judge: span };
+static FAILING: Metal = Metal::Runs {
+    arms: &[metal::once("failing", "tests/jobcase", &[], &[])],
+    judge: span_and_fail,
+};
+static REFUSED: Metal =
+    Metal::Runs { arms: &[metal::once("refused", "tests/jobcase", &[], &[])], judge: span };
+static LATE: Metal =
+    Metal::Runs { arms: &[metal::once("late", "tests/jobcase", &[], &[])], judge: span };
+static ONE: Metal =
+    Metal::Runs { arms: &[metal::once("one", "tests/jobcase", &[], &[])], judge: unqualified };
+static TWO: Metal =
+    Metal::Runs { arms: &[metal::once("two", "tests/jobcase", &[], &[])], judge: unqualified };
+
+/// **The record is one function of the readbacks.** A boot the loop refused, a
+/// boot a riding test failed and a boot whose own check failed are each
+/// judged, and none adds a row; the one boot with no failure of its own is
+/// recorded whole.
+pub fn a_boot_with_a_failure_of_its_own_adds_no_row() {
+    let dir = toyos_tmpdir::TempDir::new("metal-readbacks");
+    let root = toyos_tmpdir::TempDir::new("metal-records");
+    plant(&dir, "passing", PANEL, BOOTED, None);
+    plant(&dir, "failing", PANEL, BOOTED, None);
+    plant(&dir, "refused", PANEL, BOOTED, Some(&Refusal::HungWithoutARecord));
+    plant(&dir, "late", &expired_at(120_160), &armed(), None);
+    let readbacks = read(&dir, &["passing", "failing", "refused", "late"]);
+    let why = readbacks["refused"].as_ref().err().expect("the loop's refusal, read back");
+    assert!(why.contains("never reported: no panic"), "{why}");
+
+    let tests = [("passes", &PASSING), ("fails", &FAILING), ("refused", &REFUSED), ("late", &LATE)];
+    let runs: Vec<&(&str, &'static Metal)> = tests.iter().collect();
+    assert!(metal::judge_readbacks(&root, &readbacks, &runs, &[]), "three failed boots judged green");
+    let record = Record::load(&root, &t14()).expect("a readable record").expect("a record");
+    let names: Vec<&str> = record.measured.keys().map(String::as_str).collect();
+    assert_eq!(
+        names,
+        [
+            "boot.passing.complete_ms",
+            "boot.passing.panel_max_us",
+            "boot.passing.panel_us",
+            "span.passing.us"
+        ]
+    );
+}
+
+/// Two boots under one name are judged on the first reading and recorded off
+/// neither.
+pub fn a_name_two_boots_measured_is_refused() {
+    let dir = toyos_tmpdir::TempDir::new("metal-readbacks");
+    let root = toyos_tmpdir::TempDir::new("metal-records");
+    plant(&dir, "one", PANEL, BOOTED, None);
+    plant(&dir, "two", PANEL, BOOTED, None);
+    let readbacks = read(&dir, &["one", "two"]);
+    let tests = [("one", &ONE), ("two", &TWO)];
+    let runs: Vec<&(&str, &'static Metal)> = tests.iter().collect();
+    assert!(metal::judge_readbacks(&root, &readbacks, &runs, &[]), "one name twice judged green");
+    let record = Record::load(&root, &t14()).expect("a readable record").expect("a record");
+    assert!(!record.measured.contains_key("latency.p99_us"), "{:?}", record.measured);
+    assert_eq!(record.measured.len(), 6, "{:?}", record.measured);
+}
+
+/// `passing`'s four rows under `bios`: its planted readings, with `complete_ms`
+/// as given.
+fn committed(bios: &str, complete_ms: u64) -> Record {
+    let machine = t14();
+    Record {
+        vendor: machine.vendor,
+        product: machine.product,
+        bios: bios.to_string(),
+        measured: [
+            ("boot.passing.complete_ms", complete_ms),
+            ("boot.passing.panel_max_us", 3851),
+            ("boot.passing.panel_us", 21751),
+            ("span.passing.us", 7),
+        ]
+        .into_iter()
+        .map(|(name, value)| (name.to_string(), value))
+        .collect(),
+    }
+}
+
+/// `passing`'s readback judged against `record`, committed first: whether the
+/// run was red, and the record it left.
+fn judged_against(record: &Record) -> (bool, Record) {
+    let dir = toyos_tmpdir::TempDir::new("metal-readbacks");
+    let root = toyos_tmpdir::TempDir::new("metal-records");
+    plant(&dir, "passing", PANEL, BOOTED, None);
+    record.save(&root).expect("a committed record");
+    let tests = [("passes", &PASSING)];
+    let runs: Vec<&(&str, &'static Metal)> = tests.iter().collect();
+    let red = metal::judge_readbacks(&root, &read(&dir, &["passing"]), &runs, &[]);
+    (red, Record::load(&root, &t14()).expect("a readable record").expect("a record"))
+}
+
+/// **A reading past its record reds the run and moves nothing**: one boot,
+/// green against a record it meets and red against one it is past.
+pub fn a_reading_past_its_record_fails_and_moves_nothing() {
+    let bios = t14().bios;
+    let met = committed(&bios, 1165);
+    assert_eq!(judged_against(&met), (false, met));
+    // 1165 ms against a ceiling of 1164.
+    let past = committed(&bios, 582);
+    assert_eq!(judged_against(&past), (true, past));
+}
+
+/// **A run under another BIOS reds and records nothing**, though every reading
+/// meets the record; the same record under this run's own BIOS is green and
+/// gains the row it lacks.
+pub fn a_run_under_another_bios_fails_and_records_nothing() {
+    let lacking = |bios: &str| {
+        let mut record = committed(bios, 1165);
+        record.measured.remove("span.passing.us");
+        record
+    };
+    let older = lacking("N34ET50W (1.50 )");
+    assert_eq!(judged_against(&older), (true, older));
+    let bios = t14().bios;
+    assert_eq!(judged_against(&lacking(&bios)), (false, committed(&bios, 1165)));
+}
+
+/// **A failing shared member fails its boot**: the run is red, and that boot
+/// adds no row while the shared boot whose members all passed is recorded
+/// whole.
+pub fn a_failing_shared_member_fails_its_boot() {
+    let dir = toyos_tmpdir::TempDir::new("metal-readbacks");
+    let root = toyos_tmpdir::TempDir::new("metal-records");
+    let jobs = ["test_rs_std_tls", "test_rs_fs_large_file"];
+    let exits = |code: i32| {
+        format!(
+            "{BOOTED}[2026-09-29 18:22:41 2.310 cpu3] exit: {} pid=12 code=0 cpu=4ms\n\
+             [2026-09-29 18:22:42 3.120 cpu5] exit: {} pid=13 code={code} cpu=9ms\n",
+            jobs[0], jobs[1]
+        )
+    };
+    plant(&dir, "passing", PANEL, &exits(0), None);
+    plant(&dir, "failing", PANEL, &exits(101), None);
+    let shared = |boot: &str| metal::SharedBoot {
+        boot: boot.to_string(),
+        config: "tests/testcases",
+        params: &[],
+        features: &[],
+        members: const { std::num::NonZeroUsize::new(38).expect("a chunk holds a member") },
+        jobs: Vec::from(jobs.map(String::from)),
+        files: Vec::new(),
+        links: Vec::new(),
+    };
+    let readbacks = read(&dir, &["passing", "failing"]);
+    assert!(
+        metal::judge_readbacks(&root, &readbacks, &[], &[shared("passing"), shared("failing")]),
+        "a failing member judged green"
+    );
+    let record = Record::load(&root, &t14()).expect("a readable record").expect("a record");
+    let names: Vec<&str> = record.measured.keys().map(String::as_str).collect();
+    assert_eq!(
+        names,
+        ["boot.passing.complete_ms", "boot.passing.panel_max_us", "boot.passing.panel_us"]
+    );
+}
+
+/// **A page the pass after the reset cleared owes no panel**: `foreignrecord`'s
+/// census went with its record, so the boot is green and records its
+/// `complete_ms` alone. The same record cleared by the pass before the handoff
+/// leaves this boot's own page owing the census, and without it the boot is red
+/// and records nothing.
+pub fn a_cleared_page_owes_no_panel() {
+    let cleared = format!(
+        "Black box: 0x8000000 {} ([3e, d4, 0b, d4, 87, ad, 6a, 47, 84, b4, af, c3, f3, 6b, f7, \
+         81], and this stick is [c1, d4, 0b, d4, 87, ad, 6a, 47, 84, b4, af, c3, f3, 6b, f7, 81]), \
+         armed at 2026-09-29-131341. It has been cleared and this pass boots its kernel\n",
+        bootlog::FOREIGN_DONE
+    );
+    let hung = format!(
+        "Boot attempts: this image has had the machine 1 time(s) without reporting; now 0\n{}\n{}\n",
+        bootlog::HUNG_WITHOUT_A_RECORD,
+        bootlog::CHAIN_ENDS_LINE
+    );
+    // `before` goes in the pass before the handoff, `page` in the pass after
+    // the reset.
+    let judged = |before: &str, page: &str| {
+        let dir = toyos_tmpdir::TempDir::new("metal-readbacks");
+        let root = toyos_tmpdir::TempDir::new("metal-records");
+        plant(&dir, "foreignrecord", page, BOOTED, None);
+        let at = metal::at(&dir, "foreignrecord").join(READBACK_LOADER);
+        let handoff = bootlog::LOADER_LAST_LINE;
+        let loader = fs::read_to_string(&at).expect("a planted loader.log");
+        fs::write(&at, loader.replacen(handoff, &format!("{before}{handoff}"), 1))
+            .expect("a planted loader.log");
+        let red = metal::judge_readbacks(&root, &read(&dir, &["foreignrecord"]), &[], &[]);
+        let record = Record::load(&root, &t14()).expect("a readable record");
+        (red, record.map(|record| record.measured.into_keys().collect::<Vec<_>>()))
+    };
+    assert_eq!(
+        judged("", &format!("{cleared}{hung}")),
+        (false, Some(vec!["boot.foreignrecord.complete_ms".to_string()]))
+    );
+    assert_eq!(judged(&cleared, &hung), (true, None));
+}
diff --git a/tests/common/devices.rs b/tests/common/devices.rs
index 7e5dff4412d..64f91c5fe69 100644
--- a/tests/common/devices.rs
+++ b/tests/common/devices.rs
@@ -5,13 +5,11 @@
 //! devices are emulated and every span is a fact about TCG, so what is judged
 //! there is the plumbing: each job ran, each returned a measurement rather than
 //! one of `metaldevices::Refused`'s codes, and the shutdown took the devices
-//! down in order. On the T14 the same log is judged against
-//! `tests/metal-profile.toml`, where the spans have ceilings.
+//! down in order.
 
 use std::path::Path;
 
 use toyos_build::metaldevices;
-use toyos_build::metalprofile::Profile;
 
 use super::metal;
 use super::qemu::{self, BootOptions, QemuInstance};
@@ -23,17 +21,12 @@ use super::serial;
 /// Held to the committed config by [`the_config_runs_exactly_these_jobs`].
 pub const JOBS: &[&str] = &["usbwrite", "usbread", "fbcheck", "fbfill", "fbread"];
 
-/// The boot config, and the name every profile row for this boot is under.
 pub const CONFIG: &str = "tests/metaldevicecase";
 pub const BOOT: &str = "metaldevicecase";
 
 const WAIT: std::time::Duration = std::time::Duration::from_secs(120);
 
-/// The T14's judge: every record the inventory owes, every span against its
-/// ceiling, and the shutdown's own account of what it handed back.
 pub fn on_metal(back: &metal::Readback) -> Result<(), String> {
-    let root = super::compile::repo_root();
-    let profile = Profile::load(&root).map_err(|why| why.to_string())?;
     let mut bad = metaldevices::unmet(back.loader().text(), back.log().text());
 
     for job in JOBS {
@@ -47,17 +40,11 @@ pub fn on_metal(back: &metal::Readback) -> Result<(), String> {
         match measurement(job, code) {
             Err(why) => bad.push(why),
             Ok(span) => {
-                let name = format!("{job}.{}.span_us", back.label);
-                if let Err(why) = profile.judge(&name, span) {
-                    bad.push(why.to_string());
-                }
+                bad.extend(back.measured(&format!("{job}.{}.span_us", back.label), span).err());
             }
         }
     }
 
-    // Printed whatever the verdict: these are the lines whoever tightens a
-    // ceiling or writes an inventory row next has to read, and they exist only
-    // in a log that came off the machine.
     eprintln!("  [devices] what {} answered:", back.label);
     for line in metaldevices::inventory(back.log().text()) {
         eprintln!("    {line}");
diff --git a/tests/common/lan.rs b/tests/common/lan.rs
index 1c64312111b..66036a8a136 100644
--- a/tests/common/lan.rs
+++ b/tests/common/lan.rs
@@ -15,7 +15,6 @@ use toyos_build::lan::{
     READY,
 };
 use toyos_build::metaldevices;
-use toyos_build::metalprofile::Profile;
 use toyos_i219::lease::{self, Event, Verdict};
 use toyos_i219::phy::PhyRefusal;
 
@@ -23,8 +22,6 @@ use super::metal;
 use super::qemu::{self, BootOptions, QemuInstance};
 use super::serial;
 
-/// The boot config the T14 arm flashes, and the name every profile row for that
-/// boot is under.
 pub const CONFIG: &str = "tests/lancase";
 pub const BOOT: &str = "lancase";
 
@@ -104,7 +101,6 @@ pub const NIC: &str = "0000:00:1f.6";
 
 /// The T14's judge: the claim, the card, the lease, and the host's own ping.
 pub fn on_metal(back: &metal::Readback) -> Result<(), String> {
-    let profile = Profile::load(&super::compile::repo_root()).map_err(|why| why.to_string())?;
     let kernel = back.kernel();
     let text = kernel.text();
     let mut bad: Vec<String> = Vec::new();
@@ -149,12 +145,7 @@ pub fn on_metal(back: &metal::Readback) -> Result<(), String> {
     }
 
     match link_up_ms(&netd) {
-        Ok(ms) => {
-            eprintln!("  [lan] the link came up {ms} ms after the driver did");
-            if let Err(why) = profile.judge(&format!("lan.{}.link_up_ms", back.label), ms) {
-                bad.push(why.to_string());
-            }
-        }
+        Ok(ms) => eprintln!("  [lan] the link came up {ms} ms after the driver did"),
         Err(why) => bad.push(why),
     }
 
@@ -164,9 +155,6 @@ pub fn on_metal(back: &metal::Readback) -> Result<(), String> {
                 "  [lan] leased {}/{} from {} in {} ms, gateway {}, dns {:?}",
                 lease.address, lease.prefix, lease.server, lease.ms, lease.gateway, lease.dns
             );
-            if let Err(why) = profile.judge(&format!("lan.{}.lease_ms", back.label), lease.ms) {
-                bad.push(why.to_string());
-            }
             if lease.address != cable.addr {
                 bad.push(format!(
                     "this boot leased {} and the host pinged {}, which the router hands this \
@@ -185,19 +173,9 @@ pub fn on_metal(back: &metal::Readback) -> Result<(), String> {
                 "  [lan] {} answered the host's ping {} s into the window",
                 cable.addr, reply.secs
             );
-            // The bracket first: a reply from the operating system on the other
-            // side of the reset is not this boot's reading, and a ceiling may
-            // only be tightened against a reading this boot answered.
-            match bootlog::host_second_inside_this_boot(log.text(), cable.skew, LEASE, reply.at) {
-                Ok(()) => {
-                    if let Err(why) =
-                        profile.judge(&format!("boot.{}.ping_secs", back.label), reply.secs)
-                    {
-                        bad.push(why.to_string());
-                    }
-                }
-                Err(why) => bad.push(why),
-            }
+            bad.extend(
+                bootlog::host_second_inside_this_boot(log.text(), cable.skew, LEASE, reply.at).err(),
+            );
         }
         None => bad.push(format!(
             "nothing answered a ping at {} while this machine was between its two operating \
diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index b67d0f5d34d..a633aad5206 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -13,30 +13,20 @@
 //! something an arm names rather than something derived, because sharing is not
 //! always safe and only the author knows.
 
+use std::cell::RefCell;
+use std::collections::btree_map::Entry;
 use std::collections::{BTreeMap, BTreeSet};
+use std::num::NonZeroUsize;
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
 use toyos_build::bootlog;
 use toyos_build::metalimage;
-use toyos_build::metalprofile::{job_ms_row, Profile, AROUND_THE_LIST_MS};
+use toyos_build::metaltimings::{self, Machine, Reading, Record};
 use toyos_build::testargs::MetalMode;
 
 use super::serial::Serial;
 
-/// The fields only the boots that took that path produce: the two bounds'
-/// lateness, and the stop's own count. Absent **and** unpriced is a boot that
-/// did not take the path and owes nothing; absent and priced is a boot armed
-/// for one path that ended on another, which is a red the pricing loop names.
-const PATH_TAKEN: &[&str] =
-    &["deadline_lateness_ms", "lockup_lateness_ms", "park_open_operations"];
-
-/// Whether a boot armed with `params` owes nothing for `field` where it produced
-/// none and the profile prices none.
-pub fn owes_nothing(field: &str, params: &[&str]) -> bool {
-    PATH_TAKEN.contains(&field) || toyos_build::metal::clears_its_own_page(params)
-}
-
 /// One boot a metal test needs.
 pub struct Arm {
     /// **The boot this test rides, named.** Two arms naming one boot share an
@@ -49,9 +39,6 @@ pub struct Arm {
     /// `create_dir` on that boot is refused with `OutOfMemory` and it panics —
     /// which is why each has a boot of its own in QEMU too. A test that must
     /// not share names its own; it costs a minute and it says so.
-    ///
-    /// It is also the label: the image directory, the readback directory and
-    /// every `tests/metal-profile.toml` row for that boot are named after it.
     pub boot: &'static str,
     /// The boot config's directory, relative to the repository root.
     pub config: &'static str,
@@ -114,13 +101,6 @@ pub const fn once(
 /// exit record for it. So they are a boot with a list rather than a row each,
 /// and each member is still reported under its own name.
 ///
-/// The list is **sized to the bound before it is flashed** ([`sized`]): the
-/// runner's deadline runs from boot and ends the whole list, so a list longer
-/// than the bound is a boot whose tail members never run and are reported as
-/// missing records rather than as the boot being too long. A boot named here
-/// may therefore become several, `<boot>`, `<boot>-2`, …, and each is a row in
-/// `tests/metal-profile.toml` like any other.
-///
 /// A chunk rides one flash. A member that takes the machine down takes every
 /// member after it *in its chunk* with it, and that is the honest price: on the
 /// T14 there is no `MAX_SHARED_REBOOTS` to answer a dead guest with a new one.
@@ -131,6 +111,7 @@ pub struct SharedBoot {
     pub params: &'static [&'static str],
     /// The kernel build, empty for the one an image ships.
     pub features: &'static [&'static str],
+    pub members: NonZeroUsize,
     /// What the runner spawns, in order — the whole binary name, `test_rs_`
     /// prefix and all, because that is what the kernel records it under.
     pub jobs: Vec<String>,
@@ -152,31 +133,13 @@ fn chunk_name(boot: &str, index: usize) -> String {
     }
 }
 
-/// Cut every shared boot's list to what the bound and the profile's allowance
-/// leave room for.
-///
-/// **A list nothing sized loses its tail without saying so.** The runner's
-/// bound ends the whole list rather than the job it is inside, so every member
-/// past the cut is reported as a missing exit record.
-///
 /// **A chunk carries only the files and links its own members name.** The C
 /// corpus stages a binary and an expectation per case; putting all of both on
 /// every chunk would double a flash that is already written over `ssh`.
-fn sized(shared: &[SharedBoot], profile: &Profile) -> Result<Vec<SharedBoot>, String> {
+fn sized(shared: &[SharedBoot]) -> Vec<SharedBoot> {
     let mut out = Vec::new();
     for boot in shared {
-        if boot.jobs.is_empty() {
-            continue;
-        }
-        let per = profile.members_per_boot(&boot.boot).map_err(|why| {
-            format!(
-                "the shared boot {:?} has {} member(s) and none of them is priced, so the list \
-                 cannot be cut to the runner's bound and would lose its tail: {why}",
-                boot.boot,
-                boot.jobs.len()
-            )
-        })?;
-        for (index, jobs) in boot.jobs.chunks(per).enumerate() {
+        for (index, jobs) in boot.jobs.chunks(boot.members.get()).enumerate() {
             let named: BTreeSet<&str> = jobs.iter().map(String::as_str).collect();
             let mine = |path: &str| {
                 let last = path.rsplit('/').next().unwrap_or(path);
@@ -188,6 +151,7 @@ fn sized(shared: &[SharedBoot], profile: &Profile) -> Result<Vec<SharedBoot>, St
                 config: boot.config,
                 params: boot.params,
                 features: boot.features,
+                members: boot.members,
                 jobs: jobs.to_vec(),
                 files: boot
                     .files
@@ -199,7 +163,7 @@ fn sized(shared: &[SharedBoot], profile: &Profile) -> Result<Vec<SharedBoot>, St
             });
         }
     }
-    Ok(out)
+    out
 }
 
 /// Whether a registration runs on the T14, and how.
@@ -230,16 +194,15 @@ pub struct Readback {
     /// What the machine spent getting back to `sshd`.
     pub back_secs: u64,
     /// How long after that the boot stick's own partition was there again.
-    ///
-    /// **The one judge of the device there is.** QEMU cannot wedge a stick, so
-    /// whether a reset left the bench's own device enumerable is a fact only
-    /// this machine holds, and it is a row rather than the reason a mount
-    /// happened to work.
     pub stick_secs: u64,
     /// What the host asked the cable while the machine was between its two
     /// operating systems, and `None` on every boot that named no function to
     /// ask over.
     pub cable: Option<toyos_build::metal::Cable>,
+    /// The machine the loop read before the flash.
+    pub machine: Result<Machine, String>,
+    /// What this boot's judges measured, for the machine's record to judge.
+    numbers: RefCell<BTreeMap<String, u64>>,
 }
 
 impl Readback {
@@ -262,6 +225,9 @@ impl Readback {
             back_secs,
             stick_secs,
             cable,
+            machine: toyos_build::metal::machine(boot)
+                .map_err(|why| format!("{label}'s boot file {why}")),
+            numbers: RefCell::new(BTreeMap::new()),
         })
     }
 
@@ -378,12 +344,18 @@ impl Readback {
         Ok(())
     }
 
-    /// How far past its bound this boot's deadline fired, or `None` on a boot
-    /// whose deadline did not — which is every boot but the one armed to stop
-    /// itself. Read out of the record the pass after the reset printed, because
-    /// that is the only channel a wedged boot has.
-    pub fn deadline_lateness_ms(&self) -> Option<u64> {
-        toyos_build::metal::deadline_lateness_ms(&self.loader)
+    /// Whether this boot's deadline, where it expired, fired within one timer
+    /// period of its bound: every CPU a staged wedge holds re-arms a one-shot of
+    /// one scheduler quantum, and the timer entry is what polls. Read out of the
+    /// record the pass after the reset printed, because that is the only
+    /// channel a wedged boot has.
+    pub fn deadline_on_time(&self) -> Result<(), String> {
+        let Some(late) = toyos_build::metal::deadline_lateness_ms(&self.loader, &self.kernel)
+        else {
+            return Ok(());
+        };
+        within_one_period(late?, toyos_sched::fair::QUANTUM_NS)
+            .map_err(|why| format!("{}'s boot deadline {why}", self.label))
     }
 
     /// What the on-screen panel cost this boot, off the kernel's own census.
@@ -398,11 +370,15 @@ impl Readback {
         bootlog::panel_census(after.text())
     }
 
-    /// The same for the other bound: how far past its own bound a hard-lockup
-    /// sample was when it found a cpu stuck, or `None` on a boot no cpu locked
-    /// up on. Read out of the same channel and for the same reason.
-    pub fn lockup_lateness_ms(&self) -> Option<u64> {
-        toyos_build::metal::lockup_lateness_ms(&self.loader)
+    /// The same for the other bound: a hard-lockup sample finds a stuck cpu
+    /// within one of its sample periods past its bound. Read out of the same
+    /// channel and for the same reason.
+    pub fn lockup_on_time(&self) -> Result<(), String> {
+        let Some(late) = toyos_build::metal::lockup_lateness_ms(&self.loader) else {
+            return Ok(());
+        };
+        within_one_period(late?, toyos_tco::HARD_LOCKUP_SAMPLE_NS)
+            .map_err(|why| format!("{}'s hard-lockup detector {why}", self.label))
     }
 
     /// The stop's own record, off the page its tail is sealed on: the stop
@@ -411,22 +387,15 @@ impl Readback {
         toyos_build::metal::park(self.after_the_reset().ok()?.text())
     }
 
-    /// Block-device operations still open where this boot's stop ended.
-    /// `None` on a boot that reset without going through `quiesce`. It is the
-    /// block layer's own count, so it is what the stop can be wrong against.
-    pub fn park_open_operations(&self) -> Option<u64> {
-        self.stop_record().map(|park| u64::from(park.in_flight))
-    }
-
-    /// Whether the stop stopped the machine, as against how long it spent
-    /// trying.
-    ///
-    /// **No ceiling can ask this.** A stop that gave up returns having spent
-    /// its budget and no more, and `park_open_operations` then reads whatever
-    /// the threads it left running happened to be doing. The shortfall the
-    /// record names is the only thing that says the machine was not stopped.
     pub fn stop_completed(&self) -> Result<(), String> {
+        let handed_back =
+            self.after_the_reset().is_ok_and(|after| after.text().contains(bootlog::HANDED_BACK));
         match self.stop_record() {
+            None if handed_back => Err(format!(
+                "{} handed the machine back and its page carries no record of the stop",
+                self.label
+            )),
+            None => Ok(()),
             Some(park) if !park.stopped_the_machine() => Err(format!(
                 "{}'s stop gave up on {} userland thread(s) that never reached a safe point, so \
                  this boot's sync and its last word are claims about a machine that was still \
@@ -434,7 +403,11 @@ impl Readback {
                 self.label,
                 park.sweep.running,
             )),
-            _ => Ok(()),
+            Some(park) if park.in_flight != 0 => Err(format!(
+                "{}'s stop ended with {} block operation(s) open:\n    {park}",
+                self.label, park.in_flight,
+            )),
+            Some(_) => Ok(()),
         }
     }
 
@@ -500,24 +473,21 @@ impl Readback {
             })
     }
 
-    /// One number this boot measured, against the ceiling
-    /// `tests/metal-profile.toml` holds for it.
-    ///
-    /// **The gate fails closed on a name with no row**, which is the profile's
-    /// own rule: a measurement nobody has priced must not pass by having no
-    /// ceiling. The file is read once and kept, because every judge that asks
-    /// asks inside one process and [`run`] has already read it to judge the
-    /// boots.
-    pub fn number(&self, name: &str, value: u64) -> Result<(), String> {
-        static PROFILE: std::sync::OnceLock<Result<Profile, String>> = std::sync::OnceLock::new();
-        PROFILE
-            .get_or_init(|| {
-                Profile::load(&super::compile::repo_root()).map_err(|why| why.to_string())
-            })
-            .as_ref()
-            .map_err(Clone::clone)?
-            .judge(name, value)
-            .map_err(|why| why.to_string())
+    /// One number this boot measured, judged by [`run`] against this machine's
+    /// record once every judge has spoken. A second value under one name is
+    /// refused: which of the two a record kept would be nobody's reading.
+    pub fn measured(&self, name: &str, value: u64) -> Result<(), String> {
+        match self.numbers.borrow_mut().entry(name.to_string()) {
+            Entry::Vacant(slot) => {
+                slot.insert(value);
+                Ok(())
+            }
+            Entry::Occupied(was) => Err(format!(
+                "{} measured {name} twice, {} and then {value}",
+                self.label,
+                was.get()
+            )),
+        }
     }
 
     /// The job ran and the kernel recorded it exiting cleanly.
@@ -557,6 +527,17 @@ impl Readback {
     }
 }
 
+/// A bound's lateness against the period of what polls it, and a millisecond
+/// either way for the two floored readings the lateness is the difference of.
+fn within_one_period(late_ms: i64, period_ns: u64) -> Result<(), String> {
+    let period_ms = i64::try_from(period_ns / 1_000_000).expect("a period in milliseconds");
+    if (-1..=period_ms + 1).contains(&late_ms) {
+        Ok(())
+    } else {
+        Err(format!("fired {late_ms} ms past its bound, and what polls it runs every {period_ms} ms"))
+    }
+}
+
 /// One image, and every test that rides it.
 struct Batch {
     config: &'static str,
@@ -584,7 +565,7 @@ impl Batch {
 }
 
 /// Where a batch's derived config, its image and its readback live.
-fn at(dir: &Path, label: &str) -> PathBuf {
+pub fn at(dir: &Path, label: &str) -> PathBuf {
     dir.join(label)
 }
 
@@ -596,7 +577,6 @@ fn at(dir: &Path, label: &str) -> PathBuf {
 fn batches(
     tests: &[(&str, &'static Metal)],
     shared: &[SharedBoot],
-    profile: &Profile,
 ) -> Result<BTreeMap<String, Batch>, String> {
     let mut out: BTreeMap<String, Batch> = BTreeMap::new();
     // First, so a registration naming a shared boot rides it rather than
@@ -664,32 +644,6 @@ fn batches(
             batch.add(arm.jobs.iter().map(|j| (*j).to_string()));
         }
     }
-    // **Every boot, and the shared ones have already been cut to fit.** An
-    // authored arm is refused rather than cut: the order of an arm's jobs is
-    // the author's, and only the author knows where one may be broken in two —
-    // `Arm::boot`'s own doc is that argument.
-    for (label, batch) in &out {
-        let row = job_ms_row(label);
-        let Some(priced) = profile.row(&row) else {
-            return Err(format!(
-                "the boot {label:?} runs {} job(s) and {row} prices none of them; a list nobody \
-                 has priced cannot be sized to the runner's bound",
-                batch.jobs.len()
-            ));
-        };
-        let per = toyos_build::metalprofile::members_per_boot(priced.ceiling);
-        if batch.jobs.len() > per {
-            return Err(format!(
-                "the boot {label:?} carries {} job(s) and {row} leaves room for {per} of them \
-                 ({} ms each inside {} ms, less the {AROUND_THE_LIST_MS} ms the boot around the \
-                 list costs). The runner's bound ends the whole list, so the members past that \
-                 would never run — split this boot's arms across two named boots",
-                batch.jobs.len(),
-                priced.ceiling,
-                toyos_tco::JOB_BOUND_MS,
-            ));
-        }
-    }
     Ok(out)
 }
 
@@ -904,7 +858,7 @@ fn swap_invocation(home: &Path, service: &str) -> Vec<String> {
     .to_vec()
 }
 
-fn read_readback(dir: &Path, label: &str) -> Result<Readback, String> {
+pub fn read_readback(dir: &Path, label: &str) -> Result<Readback, String> {
     let home = at(dir, label);
     let read = |name: &str| -> Result<String, String> {
         let at = home.join(name);
@@ -912,12 +866,30 @@ fn read_readback(dir: &Path, label: &str) -> Result<Readback, String> {
             format!("{}: {e} — no readback for {label}; run the driver on its image first", at.display())
         })
     };
+    toyos_build::metal::loop_verdict(&read(toyos_build::metal::READBACK_VERDICT)?)
+        .map_err(|why| format!("toyos-metal refused {label}: {why}"))?;
     let loader = read(toyos_build::metal::READBACK_LOADER)?;
     let log = read(toyos_build::metal::READBACK_KERNEL)?;
     let boot = read(toyos_build::metal::READBACK_BOOT)?;
     Readback::new(label, home, loader, log, &boot)
 }
 
+/// The machine every boot that came back names, or why there is not one.
+fn one_machine(readbacks: &BTreeMap<String, Result<Readback, String>>) -> Result<Machine, String> {
+    let mut named: Option<Machine> = None;
+    for back in readbacks.values().filter_map(|back| back.as_ref().ok()) {
+        let machine = back.machine.clone()?;
+        match &named {
+            Some(first) if *first != machine => {
+                return Err(format!("one run names two machines: {first:?} and {machine:?}"))
+            }
+            Some(_) => {}
+            None => named = Some(machine),
+        }
+    }
+    named.ok_or_else(|| "no boot came back to name the machine".to_string())
+}
+
 /// What a metal run established.
 #[derive(Clone, Copy, PartialEq, Eq, Debug)]
 pub enum Verdict {
@@ -944,24 +916,9 @@ pub fn run(
     quiet: bool,
 ) -> Verdict {
     let root = super::compile::repo_root();
-    let profile = match Profile::load(&root) {
-        Ok(profile) => profile,
-        Err(why) => {
-            eprintln!("[metal] {why}");
-            return Verdict::Red;
-        }
-    };
-    // Before anything is batched: what rides one flash is what the runner's
-    // bound leaves room for, and a boot named once here can be several.
-    let shared = match sized(shared, &profile) {
-        Ok(shared) => shared,
-        Err(why) => {
-            eprintln!("[metal] {why}");
-            return Verdict::Red;
-        }
-    };
+    let shared = sized(shared);
     let shared = shared.as_slice();
-    let batches = match batches(tests, shared, &profile) {
+    let batches = match batches(tests, shared) {
         Ok(batches) => batches,
         Err(why) => {
             eprintln!("[metal] {why}");
@@ -1074,9 +1031,7 @@ pub fn run(
     }
 
     // **The driver's exit is the boot's verdict, and nothing below reads a file
-    // instead of it.** `toyos-metal` exits 1 for the machine and 2 for the loop,
-    // and a boot it refused wrote no readback of its own — so a directory still
-    // holding files after one is holding somebody else's boot.
+    // instead of it.** `toyos-metal` exits 1 for the machine and 2 for the loop.
     let mut refused: BTreeMap<&str, String> = BTreeMap::new();
     if !offline {
         for (label, image) in &images {
@@ -1123,83 +1078,84 @@ pub fn run(
         };
         readbacks.insert(label.clone(), back);
     }
+    if judge_readbacks(&root, &readbacks, &runs, shared) {
+        Verdict::Red
+    } else {
+        Verdict::Green
+    }
+}
 
+/// Every verdict a run's readbacks carry, and this machine's record judged by
+/// them and added to off the boots that passed: one function of the readbacks,
+/// whether the loop wrote them a moment ago or a run long past did. Answers
+/// whether anything was red.
+pub fn judge_readbacks(
+    root: &Path,
+    readbacks: &BTreeMap<String, Result<Readback, String>>,
+    runs: &[&(&str, &'static Metal)],
+    shared: &[SharedBoot],
+) -> bool {
     let mut red = false;
+    // **A boot with any failure of its own adds no row**, whether the loop,
+    // the boot's own checks, or a test or member riding it failed.
+    let mut failed: BTreeSet<&str> = BTreeSet::new();
     eprintln!("\n[metal] the boots");
-    for (label, back) in &readbacks {
-        match back {
+    for (label, back) in readbacks {
+        let back = match back {
             Err(why) => {
                 eprintln!("  FAIL {label}: {why}");
-                red = true;
+                failed.insert(label);
+                continue;
             }
-            Ok(back) => {
-                let ms = back.boot_ms.map_or_else(|| "-".to_string(), |ms| ms.to_string());
-                eprintln!(
-                    "  {label}: Boot: complete {ms} ms, back in {} s, the stick enumerated {} s \
-                     after that",
-                    back.back_secs, back.stick_secs
-                );
-                let panel = back.panel();
-                // Evidence beside the two numbers that are priced: what a
-                // reader needs to tell a slower paint from more of them.
-                if let Some(panel) = panel {
-                    eprintln!(
-                        "    the panel painted {} time(s) and put {} px on the glass",
-                        panel.paints, panel.pixels
-                    );
-                }
-                // A boot the file prices a path-taken field for and that
-                // produced none is a boot some *other* bound ended.
-                let params = &batches[label.as_str()].params;
-                for (field, value) in [
-                    ("complete_ms", back.boot_ms),
-                    ("back_secs", Some(back.back_secs)),
-                    ("stick_secs", Some(back.stick_secs)),
-                    ("deadline_lateness_ms", back.deadline_lateness_ms()),
-                    ("lockup_lateness_ms", back.lockup_lateness_ms()),
-                    ("panel_max_us", panel.map(|panel| panel.max_micros)),
-                    ("panel_us", panel.map(|panel| panel.micros)),
-                    ("park_open_operations", back.park_open_operations()),
-                ] {
-                    let name = format!("boot.{label}.{field}");
-                    let priced = profile.row(&name).is_some();
-                    if value.is_none() && !priced && owes_nothing(field, params) {
-                        continue;
-                    }
-                    let Some(value) = value else {
-                        eprintln!(
-                            "    FAIL {name}: this boot recorded none, and the profile prices \
-                             it — so the bound this boot was armed for is not the one that \
-                             ended it"
-                        );
-                        red = true;
-                        continue;
-                    };
-                    if let Err(why) = profile.judge(&name, value) {
-                        eprintln!("    FAIL {why}");
-                        red = true;
-                    }
-                }
-                // **Every boot, and before any verdict is read out of its
-                // log.** A test's judge reads the file the stick came back
-                // with, so a file that stops before the boot does turns a
-                // machine fact into a missing line — and the missing line is
-                // what a reader would have to guess about.
-                if let Err(why) = back.log_reached_the_stick() {
-                    eprintln!("    FAIL {why}");
-                    red = true;
-                }
-                if let Err(why) = back.stop_completed() {
-                    eprintln!("    FAIL {why}");
-                    red = true;
-                }
+            Ok(back) => back,
+        };
+        let ms = back.boot_ms.map_or_else(|| "-".to_string(), |ms| ms.to_string());
+        eprintln!(
+            "  {label}: Boot: complete {ms} ms, back in {} s, the stick enumerated {} s after that",
+            back.back_secs, back.stick_secs
+        );
+        let panel = back.panel();
+        if let Some(panel) = panel {
+            eprintln!(
+                "    the panel painted {} time(s) and put {} px on the glass",
+                panel.paints, panel.pixels
+            );
+        }
+        let mut findings: Vec<String> = Vec::new();
+        // The census crosses only on the page, and a page the pass after the
+        // reset cleared as another image's carries none.
+        let owes_a_panel = bootlog::foreign_done(&back.loader).is_err();
+        for (field, value, owed) in [
+            ("complete_ms", back.boot_ms, true),
+            ("panel_max_us", panel.map(|panel| panel.max_micros), owes_a_panel),
+            ("panel_us", panel.map(|panel| panel.micros), owes_a_panel),
+        ] {
+            let name = format!("boot.{label}.{field}");
+            match value {
+                Some(value) => findings.extend(back.measured(&name, value).err()),
+                None if owed => findings.push(format!("{name}: this boot recorded none")),
+                None => {}
             }
         }
+        // **Every boot, and before any verdict is read out of its log.** A
+        // test's judge reads the file the stick came back with, so a file that
+        // stops before the boot does turns a machine fact into a missing line —
+        // and the missing line is what a reader would have to guess about.
+        findings.extend(back.log_reached_the_stick().err());
+        findings.extend(back.stop_completed().err());
+        findings.extend(back.deadline_on_time().err());
+        findings.extend(back.lockup_on_time().err());
+        for why in &findings {
+            eprintln!("    FAIL {why}");
+        }
+        if !findings.is_empty() {
+            failed.insert(label);
+        }
     }
 
     eprintln!("\n[metal] the tests");
     let mut passed = 0usize;
-    for (name, decl) in &runs {
+    for (name, decl) in runs {
         let Metal::Runs { arms, judge } = decl else { continue };
         let mut owed: Vec<&Readback> = Vec::new();
         let mut missing: Option<String> = None;
@@ -1220,7 +1176,7 @@ pub fn run(
             }
             Err(why) => {
                 eprintln!("  FAIL {name}: {why}");
-                red = true;
+                failed.extend(arms.iter().map(|arm| arm.boot));
             }
         }
     }
@@ -1247,34 +1203,91 @@ pub fn run(
                 // bury the four that matter.
                 Err(why) => {
                     eprintln!("  FAIL {job}: {}", why.lines().next().unwrap_or(&why));
-                    red = true;
+                    failed.insert(&boot.boot);
                 }
             }
         }
-        // **What a member of this list actually cost, against the allowance the
-        // split was derived from.** Over the members that ran and not the
-        // members the list named: a boot the bound cut short would otherwise
-        // report a cost that looks smaller the more of its list it lost.
         if let (Ok(back), true) = (back, ran > 0) {
             if let (Some(complete), Some(last)) = (back.boot_ms, back.last_record_ms()) {
                 let each = last.saturating_sub(complete) / ran as u64;
                 eprintln!("  {} ms per member over the {ran} that ran", each);
-                if let Err(why) = profile.judge(&job_ms_row(&boot.boot), each) {
-                    eprintln!("    FAIL {why}");
+            }
+        }
+    }
+    red |= !failed.is_empty();
+
+    eprintln!("\n[metal] the timings");
+    let mut measured: BTreeMap<String, Reading> = BTreeMap::new();
+    for (label, back) in readbacks {
+        let Ok(back) = back else { continue };
+        let passed = !failed.contains(label.as_str());
+        for (name, &value) in back.numbers.borrow().iter() {
+            match measured.entry(name.clone()) {
+                Entry::Vacant(slot) => {
+                    slot.insert(Reading { value, passed });
+                }
+                // Judged on the first, and recorded off neither.
+                Entry::Occupied(mut first) => {
+                    eprintln!("  FAIL {name} is measured by two boots, and {label} is the second");
+                    first.get_mut().passed = false;
                     red = true;
                 }
             }
         }
     }
+    let machine = one_machine(readbacks);
+    let record =
+        machine.as_ref().map_err(Clone::clone).and_then(|machine| Record::load(root, machine));
+    match (machine, record) {
+        (Ok(machine), Ok(record)) => {
+            let judged = metaltimings::judge(&machine, record, &measured);
+            if let Some(firmware) = &judged.firmware {
+                eprintln!("  FAIL {firmware}");
+                red = true;
+            }
+            for over in &judged.over {
+                eprintln!("  FAIL {over}");
+                red = true;
+            }
+            if !judged.unmeasured.is_empty() {
+                eprintln!(
+                    "  {} recorded number(s) this run measured nothing for: {}",
+                    judged.unmeasured.len(),
+                    judged.unmeasured.join(", ")
+                );
+            }
+            eprintln!(
+                "  {} number(s) on {} {}, BIOS {}; {} past its record, {} off a boot that failed",
+                measured.len(),
+                machine.vendor,
+                machine.product,
+                machine.bios,
+                judged.over.len(),
+                measured.values().filter(|reading| !reading.passed).count()
+            );
+            if judged.changed {
+                match judged.record.save(root) {
+                    Ok(at) => eprintln!(
+                        "  {} now records {} number(s) for this machine: commit it",
+                        at.display(),
+                        judged.record.measured.len()
+                    ),
+                    Err(why) => {
+                        eprintln!("  FAIL {why}");
+                        red = true;
+                    }
+                }
+            }
+        }
+        (Err(why), _) | (_, Err(why)) => {
+            eprintln!("  FAIL {} number(s) and no record to judge them by: {why}", measured.len());
+            red = true;
+        }
+    }
     eprintln!(
         "\n[metal] {passed} passed, {} failed, {} boot(s)",
         runs.len() + members - passed,
-        batches.len()
+        readbacks.len()
     );
-    if red {
-        Verdict::Red
-    } else {
-        Verdict::Green
-    }
+    red
 }
-
diff --git a/tests/common/power.rs b/tests/common/power.rs
index 989d66fc88b..03421a895ed 100644
--- a/tests/common/power.rs
+++ b/tests/common/power.rs
@@ -1739,10 +1739,10 @@ const WEDGE_PHASES: &[(&[&str], Phase)] = &[
 ///
 /// **What an emulator can prove here and what it cannot.** Whether a device
 /// survives being cut is the T14's own stick to answer and nothing here can ask
-/// it; `boot.usbload.stick_secs` is where it is asked. What this arm judges is
-/// that the machine really stopped inside a command and that the reset's
-/// account names which one — the only evidence a reset leaves about what it
-/// found. [`Profile::Metal`](qemu::Profile::Metal) carries the boot stick on
+/// it. What this arm judges is that the machine really stopped inside a
+/// command and that the reset's account names which one — the only evidence a
+/// reset leaves about what it found.
+/// [`Profile::Metal`](qemu::Profile::Metal) carries the boot stick on
 /// its xHCI, which is why the wedge has a device to be inside at all.
 pub fn usb_reset_records_the_phase_it_cut(
     _test_config: &Path,
@@ -1772,8 +1772,7 @@ pub fn usb_reset_records_the_phase_it_cut(
 /// **This machine's disk is the image, and no guest here has the gibibyte the
 /// sweep demands.** What a guest can establish is that the arm says so by name
 /// and lets the boot end, rather than silently staging nothing and reading back
-/// as a wedge that never happened. That it streams at all, and what a reset
-/// landing on it does to a device, is `boot.usbload.stick_secs` on the T14.
+/// as a wedge that never happened.
 fn the_load_refuses_a_disk_with_no_room() -> Result<(), String> {
     let config = super::compile::repo_root().join("tests/jobcase/system.toml");
     let case = config.parent().expect("system.toml has a directory");
@@ -2353,8 +2352,7 @@ fn sealed_state(qemu: &mut QemuInstance, within: Duration) -> Result<(State, Vec
 /// **The re-enumeration, taken off the boot after the reset.** Under QEMU it is
 /// weak on purpose: an emulated stick cannot be wedged, so this arm judges that
 /// the account is produced and that the machine still comes up on the same
-/// device. The T14 is the judge of the device itself, and `tests/metal-profile`
-/// carries its row.
+/// device.
 const STICK_ENUMERATED: &str = "usb-storage: 1 device(s)";
 
 /// Every way this kernel resets a machine, and the account each one leaves.
@@ -2540,12 +2538,9 @@ fn one_reset_path(case: &Path, arm: &ResetPath) -> Result<(), String> {
 /// The T14's judge for [`usb_reset_hands_devices_back`].
 ///
 /// **The machine is the judge of the device, and nothing else is.** QEMU cannot
-/// wedge a stick, and what says the boot before this one left the bench's own
-/// device enumerable is the driver's `boot.<boot>.stick_secs` row — recorded
-/// before the mount, so it is a number and not the reason a mount happened to
-/// work. What is left for this to read is the reset's own account, which on this
-/// machine is in `loader.log`'s pass after the reset rather than in any file the
-/// kernel wrote.
+/// wedge a stick. What is left for this to read is the reset's own account,
+/// which on this machine is in `loader.log`'s pass after the reset rather than
+/// in any file the kernel wrote.
 ///
 /// Both arms are orderly reboots, so both owe the barrier. The panic path's
 /// account is judged under QEMU only: on this machine a kernel that panics
diff --git a/tests/metal-profile.toml b/tests/metal-profile.toml
deleted file mode 100644
index fe8b9f813d8..00000000000
--- a/tests/metal-profile.toml
+++ /dev/null
@@ -1,1463 +0,0 @@
-# Every number the metal suite measures on the T14, with the ceiling past which
-# it is a red. `src/metalprofile.rs` is the reader and the grammar; a number the
-# suite measures and this file does not price is refused, not passed.
-#
-# `ceiling_from` says where the ceiling came from, and a row naming a constant
-# this repository declares is held to that constant's value by
-# `metalprofile::tests::a_ceiling_that_names_a_constant_carries_it`. A ceiling
-# derived from a constant is the widest true bound there is before the machine
-# has been read once, and a ceiling that had to be widened to pass is a finding
-# rather than an edit.
-#
-# `measured` is the reading the T14 gave the boot the row names, off that boot's
-# own readback. It is what a later author tightens a ceiling against and it is
-# never the gate; a row with no `measured` is a boot no run has taken yet.
-#
-# One row per number, named `<what>.<boot>.<field>`. The boot names are the ones
-# `METAL`'s arms give them in `tests/toyos.rs`: one image, one flash, one minute
-# of the machine.
-
-# --- the boot's own duration, out of the kernel's `Boot: complete (Nms)` ---
-# Nothing bounds the span before userland but the test runner's own deadline,
-# which is measured from boot and ends a boot whose job list has not finished:
-# a `Boot: complete` later than that is a boot the runner already reset.
-
-[[number]]
-name = "boot.testcases.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — the runner's deadline runs from boot, so a later `Boot: complete` is a boot already reset"
-measured = 1199
-
-[[number]]
-name = "boot.testcases-mkdir.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1200
-
-[[number]]
-name = "boot.testcases-readdir.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1256
-
-[[number]]
-name = "boot.testcases-watchdog.complete_ms"
-unit = "ms"
-ceiling = 9600
-ceiling_from = "toyos_tco::BOUND_MS — this image arms the chipset watchdog at the handoff, so the whole boot runs under it"
-measured = 1259
-
-[[number]]
-name = "boot.jobcase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1213
-
-[[number]]
-name = "boot.metalcase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1199
-
-# --- what the machine spent coming back, on the host's clock ---
-# The loop already refuses past this; the row exists so the number is read and
-# recorded rather than only bounded, and so a return that doubled is a red
-# before it is a hang.
-
-[[number]]
-name = "boot.testcases.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs — the longest watchdog a boot runs under plus what coming back costs"
-measured = 48
-
-[[number]]
-name = "boot.testcases-mkdir.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 46
-
-[[number]]
-name = "boot.testcases-readdir.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 49
-
-[[number]]
-name = "boot.testcases-watchdog.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 46
-
-[[number]]
-name = "boot.jobcase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 41
-
-[[number]]
-name = "boot.metalcase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 51
-
-[[number]]
-name = "boot.latencycase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1258
-
-[[number]]
-name = "boot.latencycase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 46
-
-# --- what this machine's scheduler costs a waiter, and what one machine-wide
-# --- TLB shootdown costs its initiator
-# `latency.p99_us` is bounded by the instrument: past its last bucket the figure
-# is a floor and not a measurement, which is a red whatever the machine did. The
-# two shootdown rows are bounded by the reading, half again — the margin this
-# file uses everywhere a first reading becomes a ceiling — because
-# `time::DEAF_CPU` is two million times the reading and a ceiling nothing
-# can reach is a row that cannot red.
-
-[[number]]
-name = "latency.p99_us"
-unit = "us"
-ceiling = 4095
-ceiling_from = "cyclictest's histogram is 4096 buckets of 1 us, so a p99 in its last bucket is a floor and not a measurement"
-measured = 16
-
-[[number]]
-name = "tlb.latencycase.p50_ns"
-unit = "ns"
-ceiling = 3387
-ceiling_from = "2,258 ns measured, and half again — 50 % over one machine's one reading, which is what this file gives every ceiling derived from a first one. `kernel time::DEAF_CPU` is 5 s and panics the machine; it bounds the wait and is not a ceiling this row could ever red on"
-measured = 2258
-
-[[number]]
-name = "tlb.latencycase.p99_ns"
-unit = "ns"
-ceiling = 4397
-ceiling_from = "2,931 ns measured, and half again — as tlb.latencycase.p50_ns. The tail and not the median, so what widens it is a shootdown that waited on one slow acknowledger rather than the machine getting slower everywhere"
-measured = 2931
-# --- the device boot, and every span `userland/metalprobe` measures on it ---
-# Each job exits with its span in microseconds and the kernel's `exit:` record
-# carries it; `src/metaldevices.rs` names the negative codes that are refusals
-# rather than numbers. A span and not a rate, because a ceiling is what this
-# file can express and a rate would have to be judged from below.
-#
-# Every ceiling here is the same derivation: `metalprobe`'s own `SHARE_PERCENT`
-# of `toyos_tco::JOB_BOUND_MS` is what its payload is sized against, and one job
-# may not outlast its share without putting the runner's reset inside a
-# transfer, which is what leaves a stick the next host cannot enumerate.
-
-[[number]]
-name = "boot.metaldevicecase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1255
-
-[[number]]
-name = "boot.metaldevicecase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 65
-
-[[number]]
-name = "usbwrite.metaldevicecase.span_us"
-unit = "us"
-ceiling = 4800000
-ceiling_from = "metalprobe's SHARE_PERCENT of toyos_tco::JOB_BOUND_MS — the share its payload is sized against, and the widest true bound before the machine has answered once"
-
-[[number]]
-name = "usbread.metaldevicecase.span_us"
-unit = "us"
-ceiling = 4800000
-ceiling_from = "as usbwrite.metaldevicecase.span_us"
-
-[[number]]
-name = "fbcheck.metaldevicecase.span_us"
-unit = "us"
-ceiling = 4800000
-ceiling_from = "as usbwrite.metaldevicecase.span_us — one whole-scanout write and one whole-scanout readback"
-
-[[number]]
-name = "fbfill.metaldevicecase.span_us"
-unit = "us"
-ceiling = 4800000
-ceiling_from = "as usbwrite.metaldevicecase.span_us — metalprobe's FILL_PASSES whole-scanout fills"
-
-[[number]]
-name = "fbread.metaldevicecase.span_us"
-unit = "us"
-ceiling = 4800000
-ceiling_from = "as usbwrite.metaldevicecase.span_us — metalprobe's READ_PASSES whole-scanout readbacks, the direction that misses every cache"
-
-# --- the self-test boot, and the shared block's two ---
-
-[[number]]
-name = "boot.selftests.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1267
-
-[[number]]
-name = "boot.selftests.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 44
-
-[[number]]
-name = "boot.shared.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-
-[[number]]
-name = "boot.shared.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-
-[[number]]
-name = "boot.shared-debug.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1210
-
-[[number]]
-name = "boot.shared-debug.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 61
-
-[[number]]
-name = "boot.ccorpus.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1200
-
-[[number]]
-name = "boot.ccorpus.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 95
-
-# --- the boot stick, after the boot ---
-# **The only judge of the device there is.** QEMU cannot wedge a stick, and a
-# wedged one shows as the log partition's device node missing after the machine
-# comes back. So the loop waits for that node by name and records what it
-# waited, per boot.
-
-[[number]]
-name = "boot.testcases.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "toyos_build::metal::STICK_SECS — ten times the three seconds Ubuntu's own enumeration spends giving up on a wedged stick (run 18's journal)"
-measured = 0
-
-[[number]]
-name = "boot.testcases-mkdir.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-[[number]]
-name = "boot.testcases-readdir.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-[[number]]
-name = "boot.testcases-watchdog.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-[[number]]
-name = "boot.jobcase.stick_secs"
-unit = "s"
-ceiling = 5
-ceiling_from = "the machine has answered: 0 s on run 20, at the driver's 1 s poll. Five is what one round of Linux's own enumeration retries would cost — run 18's journal spent three seconds on four addressing attempts and a port power cycle before it gave up — so a reading over it is a stick that needed rescuing rather than one that was simply there"
-measured = 0
-
-[[number]]
-name = "boot.metalcase.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-[[number]]
-name = "boot.latencycase.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-[[number]]
-name = "boot.metaldevicecase.stick_secs"
-unit = "s"
-ceiling = 5
-ceiling_from = "as boot.jobcase.stick_secs, and this is the boot that reads it hardest: it writes, fsyncs and reads back megabytes before the reset, which is the shape a stop that cut a transfer would leave unenumerable"
-measured = 0
-
-[[number]]
-name = "boot.selftests.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-[[number]]
-name = "boot.shared.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-
-[[number]]
-name = "boot.shared-debug.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-[[number]]
-name = "boot.ccorpus.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-[[number]]
-name = "boot.foreignrecord.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1254
-
-[[number]]
-name = "boot.logstallcase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "as boot.foreignrecord.complete_ms"
-
-[[number]]
-name = "boot.testcases-deaf.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "as boot.foreignrecord.complete_ms"
-
-[[number]]
-name = "boot.testcases-window.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "as boot.foreignrecord.complete_ms"
-
-[[number]]
-name = "boot.testcases-debug.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "as boot.foreignrecord.complete_ms"
-
-[[number]]
-name = "boot.foreignrecord.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 44
-
-[[number]]
-name = "boot.logstallcase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "as boot.foreignrecord.back_secs"
-
-[[number]]
-name = "boot.testcases-deaf.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "as boot.foreignrecord.back_secs"
-
-[[number]]
-name = "boot.testcases-window.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "as boot.foreignrecord.back_secs"
-
-[[number]]
-name = "boot.testcases-debug.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "as boot.foreignrecord.back_secs"
-
-[[number]]
-name = "boot.foreignrecord.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-# --- the boot that stops itself on purpose ---
-# `deadlinewedge` is the only boot here whose verdict is not `Rebooting.`: every
-# CPU stops taking scheduler passes at the shutdown syscall and the kernel's own
-# `boot-deadline` is what ends it. Its three ordinary numbers are priced against
-# that bound rather than against the runner's, because the runner never reaches
-# its own.
-
-[[number]]
-name = "boot.logstallcase.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-
-[[number]]
-name = "boot.testcases-deaf.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-
-[[number]]
-name = "boot.testcases-window.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-
-[[number]]
-name = "boot.testcases-debug.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-
-[[number]]
-name = "boot.deadlinewedge.complete_ms"
-unit = "ms"
-ceiling = 120000
-ceiling_from = "toyos_tco::WEDGE_BOUND_MS — on this boot the kernel's own deadline is what runs from boot, so a later `Boot: complete` is a boot the deadline already reset"
-measured = 1254
-
-[[number]]
-name = "boot.deadlinewedge.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs — which now derives from WEDGE_BOUND_MS, the longest watchdog a boot runs under, plus what coming back costs"
-measured = 231
-
-[[number]]
-name = "boot.deadlinewedge.stick_secs"
-unit = "s"
-ceiling = 5
-ceiling_from = "as boot.jobcase.stick_secs. It is the number this boot owes most: the deadline resets a machine whose USB was stopped by registers alone, and a stick the next host cannot enumerate is what `xhci::stop::before_reset` exists to prevent"
-measured = 0
-
-# --- and the one number only this boot measures ---
-# How far past its bound the deadline actually fired. The bound is a parameter;
-# the expiry is what the poll reached on a machine where every CPU was spinning
-# with preemption disabled, so the difference is what that poll costs in the
-# state it exists for.
-
-[[number]]
-name = "boot.deadlinewedge.deadline_lateness_ms"
-unit = "ms"
-ceiling = 10000
-ceiling_from = "the poll's own cadence: the deadline is read on every timer interrupt and an idle CPU re-arms its LAPIC one-shot per fire, so the lateness is one timer period. That period has not been measured on this machine, and ten seconds — a twelfth of the bound — is the widest true bound before it has been"
-measured = 60
-
-# --- the boot one CPU stops answering on ---
-# `hardlockup` is the deaf half of the boot above: the same staged wedge, and
-# then one CPU with `IF` clear spinning on a lock another holds and never gives
-# back. The boot deadline's poll cannot see it — nothing on that CPU runs to
-# poll anything — so what ends this machine is that CPU's own performance-counter
-# NMI, and the page it seals names the CPU rather than only the bound. Priced
-# against the earlier of the two bounds, which is the one this boot runs under.
-
-[[number]]
-name = "boot.hardlockup.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::HARD_LOCKUP_BOUND_MS — half the deadline and the earlier bound, so a later `Boot: complete` is a boot the detector already reset"
-measured = 1206
-
-[[number]]
-name = "boot.hardlockup.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "as boot.deadlinewedge.back_secs, toyos_build::metal::return_secs. It is the same wait: this boot ends itself half a bound earlier and then costs the same firmware, loader and Ubuntu as any other"
-measured = 170
-
-[[number]]
-name = "boot.hardlockup.stick_secs"
-unit = "s"
-ceiling = 5
-ceiling_from = "as boot.deadlinewedge.stick_secs. The reset is written from inside an NMI on a CPU that holds a lock, and `xhci::stop::before_reset` runs there like anywhere else — a stick the next host cannot enumerate is what that would have cost"
-measured = 0
-
-# --- and the one number only this boot measures ---
-# How far past its bound the counter's sample was when it found the CPU stuck.
-# Not the row above's number: what bounds this one is the detector's own sample
-# period, not the timer's.
-
-[[number]]
-name = "boot.hardlockup.lockup_lateness_ms"
-unit = "ms"
-ceiling = 2000
-ceiling_from = "twice the sample period `kernel/src/hardlockup`'s SAMPLE_NS states, 1000 ms: a CPU is found stuck at the first sample after its bound, so one period is the lateness and a second is the widest a delayed one costs"
-measured = 0
-
-# --- the boot that is never idle ---
-# `usbload` stops no CPU. It sweeps the last eighth of the stick once, reading
-# each run and writing it back, until the deadline takes the machine out from
-# under it — so the reset lands on a controller that is moving bytes rather than
-# on one idle for two minutes. `stick_secs` is the bench's own answer about its
-# own stick.
-
-[[number]]
-name = "boot.usbload.complete_ms"
-unit = "ms"
-ceiling = 120000
-ceiling_from = "as boot.deadlinewedge.complete_ms, toyos_tco::WEDGE_BOUND_MS — the same bound ends this machine and the runner never reaches its own. Not toyos_tco::HARD_LOCKUP_BOUND_MS, which is half of it: the sweep keeps its CPU taking interrupts so that this bound and not that one is what ends the boot, and the judge refuses a page that names the other"
-measured = 1204
-
-[[number]]
-name = "boot.usbload.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "as boot.deadlinewedge.back_secs, toyos_build::metal::return_secs — this boot ends itself at the same bound and then costs the same firmware, loader and Ubuntu as any other"
-measured = 219
-
-[[number]]
-name = "boot.usbload.stick_secs"
-unit = "s"
-ceiling = 5
-ceiling_from = "as boot.deadlinewedge.stick_secs. On this arm the reset is written while the controller is mid-transfer, which is the state a stick the next host cannot enumerate would be left by"
-measured = 0
-
-[[number]]
-name = "boot.usbload.deadline_lateness_ms"
-unit = "ms"
-ceiling = 10000
-ceiling_from = "as boot.deadlinewedge.deadline_lateness_ms — the poll's own cadence, read on every timer interrupt, so the lateness is one timer period whichever CPU reaches the bound first"
-measured = 66
-
-# --- the boot whose stick has one transfer abandoned under it ---
-# `usbbreak` is `jobcase` with the first WRITE(10) the boot stick takes abandoned
-# mid-flight, so the class's Reset Recovery runs against the bench's own device
-# on the bench's own controller. A recovery that takes ends like `jobcase`, by
-# its deliberate reboot; one that does not takes the root offline, and what then
-# ends the boot is the runner's bound. `stick_secs` is the row that says what
-# either left the stick in.
-
-[[number]]
-name = "boot.usbbreak.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-
-[[number]]
-name = "boot.usbbreak.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-
-[[number]]
-name = "boot.usbbreak.stick_secs"
-unit = "s"
-ceiling = 5
-ceiling_from = "as boot.jobcase.stick_secs. On this arm the stick was sent a Bulk-Only Mass Storage Reset while it may still have been inside a WRITE(10), and then either came back or was left at its Default state by a port reset"
-
-# --- what one member of a job list may cost this machine ---
-# **The number the suite sizes its lists by, and judges them against.** The
-# runner's bound (`toyos_tco::JOB_BOUND_MS`) runs from boot and ends the whole
-# list, not the job it is inside, so a list longer than the bound is a boot
-# whose tail members never run — reported as missing records rather than as a
-# list nobody sized. `tests/common/metal.rs` derives how many members one boot
-# may carry from the ceiling here, and then holds the boot to the same number:
-# a list is cut to what its members are priced at, and members slower than their
-# price red by name.
-#
-# Every reading below is the interval between successive `spawn: /system/bin/…`
-# records on that boot's own log.
-
-[[number]]
-name = "list.shared.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "845 ms measured (25 members spawned between 1.943 s and 23.066 s on run 24's `shared`), and a ceiling above the widest single member on that boot — test_rs_abuse_elf_loader at 1,358 ms — so one heavy member cannot put the mean over it"
-measured = 845
-
-[[number]]
-name = "list.shared-2.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.shared.job_ms — the same list, cut in two"
-
-[[number]]
-name = "list.shared-3.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.shared.job_ms — the same list, cut in three"
-
-[[number]]
-name = "list.shared-debug.job_ms"
-unit = "ms"
-ceiling = 2900
-ceiling_from = "1,926 ms measured (8 members between 2.624 s and 18.032 s on run 24's `shared-debug`), and half again: these are the eight binaries that re-execute themselves once per fault, and handle_kill_policy alone spawned 42 children"
-measured = 1926
-
-[[number]]
-name = "list.ccorpus.job_ms"
-unit = "ms"
-ceiling = 600
-ceiling_from = "396 ms measured (118 cases between 2.625 s and the reboot job at 49.366 s on run 24's `ccorpus`), and half again. That boot was green at 49.5 s of a 60 s bound — 82 % of it, with no margin for a slower stick — which is why the same rule cuts a list that passed"
-measured = 396
-
-[[number]]
-name = "list.ccorpus-2.job_ms"
-unit = "ms"
-ceiling = 600
-ceiling_from = "as list.ccorpus.job_ms — the same corpus, cut in two"
-
-[[number]]
-name = "list.metaldevicecase.job_ms"
-unit = "ms"
-ceiling = 4800
-ceiling_from = "metalprobe's SHARE_PERCENT of toyos_tco::JOB_BOUND_MS, which is what every one of that boot's own span rows is priced at: the list is sized to what its jobs are allowed to cost, and a job that outruns its allowance reds on its own span row"
-
-[[number]]
-name = "list.testcases.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.shared.job_ms: the same machine spawning the same kind of binary off the same stick"
-
-[[number]]
-name = "list.testcases-mkdir.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms"
-
-[[number]]
-name = "list.testcases-readdir.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms"
-
-[[number]]
-name = "list.testcases-watchdog.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms"
-
-[[number]]
-name = "list.jobcase.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms"
-
-[[number]]
-name = "list.metalcase.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms"
-
-[[number]]
-name = "list.latencycase.job_ms"
-unit = "ms"
-ceiling = 27000
-ceiling_from = "half of what the members of a list may spend — (toyos_tco::JOB_BOUND_MS - metalprofile::AROUND_THE_LIST_MS) / 2 — because this list is two benches that run for a stated span rather than binaries that exit as soon as they can, and they split the boot between them"
-
-[[number]]
-name = "list.selftests.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms"
-
-[[number]]
-name = "list.foreignrecord.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms"
-
-[[number]]
-name = "list.logstallcase.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms"
-
-[[number]]
-name = "list.testcases-deaf.job_ms"
-unit = "ms"
-ceiling = 22000
-ceiling_from = "as list.lancase.job_ms — the same one job"
-
-[[number]]
-name = "list.testcases-window.job_ms"
-unit = "ms"
-ceiling = 27000
-ceiling_from = "as list.latencycase.job_ms: one job each of whose pipe waits the actuator may hold for its window"
-
-[[number]]
-name = "list.testcases-debug.job_ms"
-unit = "ms"
-ceiling = 2900
-ceiling_from = "as list.shared-debug.job_ms: one of the same eight binaries"
-
-[[number]]
-name = "list.deadlinewedge.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms — the list is one job and a wedge, and what ends this boot is the kernel's own deadline rather than the runner's"
-
-[[number]]
-name = "list.hardlockup.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.deadlinewedge.job_ms"
-
-[[number]]
-name = "list.usbload.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.deadlinewedge.job_ms — the same list, and what ends this boot is the kernel's own deadline rather than the runner's"
-
-[[number]]
-name = "list.usbbreak.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.jobcase.job_ms — the same list"
-
-# --- the boots the split above adds ---
-
-[[number]]
-name = "boot.shared-2.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-
-[[number]]
-name = "boot.shared-3.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-
-[[number]]
-name = "boot.shared-2.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-
-[[number]]
-name = "boot.shared-3.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-
-[[number]]
-name = "boot.shared-2.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-
-[[number]]
-name = "boot.shared-3.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-
-[[number]]
-name = "boot.ccorpus-2.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-
-[[number]]
-name = "boot.ccorpus-2.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-
-[[number]]
-name = "boot.ccorpus-2.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-
-# --- the cable: the boot that runs netd in front of the T14's own I219 ---
-
-[[number]]
-name = "boot.lancase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1208
-
-[[number]]
-name = "boot.lancase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 82
-
-[[number]]
-name = "boot.lancase.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-# No `measured`: the one ping this row has been offered was answered by the
-# operating system on the other side of the reset, which the judge refuses, so
-# no boot has yet given this number a reading.
-[[number]]
-name = "boot.lancase.ping_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs — the loop's own wait for the machine to answer ssh again, which bounds the window a reply can fall in"
-
-[[number]]
-name = "list.lancase.job_ms"
-unit = "ms"
-ceiling = 22000
-ceiling_from = "toyos_tco::LEASE_BOUND_MS, which is lan_hold's whole sleep, plus two seconds for the spawn and the exit record around it"
-
-[[number]]
-name = "lan.lancase.link_up_ms"
-unit = "ms"
-ceiling = 20000
-ceiling_from = "toyos_tco::LEASE_BOUND_MS: a link that comes up later than lan_hold sleeps is a link this boot never had, because the machine has already handed itself back"
-
-[[number]]
-name = "lan.lancase.lease_ms"
-unit = "ms"
-ceiling = 20000
-ceiling_from = "as lan.lancase.link_up_ms, which is netd's own dhcp::LEASE_BOUND: a boot with no lease by then has already said so in its log"
-
-# `lanicscase` is `lancase` with one argument added to netd's manifest row, so
-# every bound it is under is that boot's.
-
-[[number]]
-name = "boot.lanicscase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "as boot.lancase.complete_ms — the same boot config with one netd argument added"
-
-[[number]]
-name = "boot.lanicscase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-
-[[number]]
-name = "boot.lanicscase.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.lancase.stick_secs"
-
-[[number]]
-name = "list.lanicscase.job_ms"
-unit = "ms"
-ceiling = 22000
-ceiling_from = "as list.lancase.job_ms — the same one job"
-
-# --- what the on-screen panel cost each boot ---
-# **The one window a person has into a machine that stopped.** Two numbers,
-# because the panel can fail a person in two ways: `panel_max_us` bounds one
-# paint, so a paint nobody can watch finish is a red; `panel_us` bounds the
-# boot's whole time inside the painter, so a panel that keeps pace per paint by
-# painting far more than it needs to is a red as well. Paints and pixels are
-# printed beside the boot as evidence and are not gates.
-
-[[number]]
-name = "boot.testcases.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "one frame at 60 Hz, which is the rate at which a person watching a panel sees it change; a paint that cannot finish inside one shows stale state during the event the panel exists for. 60 Hz is this bench's premise about its display and not a reading off it"
-
-[[number]]
-name = "boot.testcases-mkdir.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.testcases-readdir.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.testcases-watchdog.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.jobcase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-measured = 3332
-
-[[number]]
-name = "boot.metalcase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.latencycase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.metaldevicecase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.selftests.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.shared.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.shared-2.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.shared-3.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.shared-debug.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.ccorpus.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.ccorpus-2.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.logstallcase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.testcases-deaf.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.testcases-window.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.testcases-debug.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.deadlinewedge.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us; read off the sealed page, because this boot's logd wrote no file"
-measured = 3867
-
-[[number]]
-name = "boot.hardlockup.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.deadlinewedge.panel_max_us"
-measured = 3890
-
-[[number]]
-name = "boot.usbbreak.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.lancase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.lanicscase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.testcases.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "the panel reports the boot and may not become it: a tenth of the ~1.2 s these boots take to reach `Boot: complete`, which is what boot.testcases.complete_ms's readings stand at. A panel that re-renders the whole scanout for every record spends more than the boot does"
-
-[[number]]
-name = "boot.testcases-mkdir.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.testcases-readdir.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.testcases-watchdog.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.jobcase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-measured = 17408
-
-[[number]]
-name = "boot.metalcase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.latencycase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.metaldevicecase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.selftests.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.shared.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.shared-2.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.shared-3.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.shared-debug.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.ccorpus.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.ccorpus-2.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.logstallcase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.testcases-deaf.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.testcases-window.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.testcases-debug.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.deadlinewedge.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-measured = 18693
-
-[[number]]
-name = "boot.hardlockup.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-measured = 19488
-
-# --- what the block layer had open where the stop ended
-# How long the stop took is priced nowhere: a stop that gave up spends its
-# budget and no more, so the record's own shortfall clause is the verdict, and
-# `Readback::stop_completed` reads it on every boot.
-#
-# `deadlinewedge`, `hardlockup` and `usbload` are absent on purpose: those
-# reset on a bound without going through `quiesce`, so they stop nothing and
-# write no record.
-
-[[number]]
-name = "boot.testcases.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "the stop's own claim, judged by the block layer instead of by the stop: an operation lasts only while its opener is inside the device, so a thread the stop has stopped holds none and any number but zero is a sync claiming something about a machine that was still writing"
-
-[[number]]
-name = "boot.testcases-mkdir.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.testcases-readdir.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.testcases-watchdog.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.jobcase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.metalcase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-measured = 0
-
-[[number]]
-name = "boot.latencycase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.metaldevicecase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-measured = 0
-
-[[number]]
-name = "boot.selftests.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.shared.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.shared-2.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.shared-3.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.shared-debug.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.ccorpus.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.ccorpus-2.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.logstallcase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.testcases-deaf.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.testcases-window.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.testcases-debug.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.usbbreak.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.lancase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.lanicscase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.lanleasecase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.lantalkcase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.usbbreak.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.lancase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.lanicscase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.lanleasecase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "as boot.lancase.complete_ms — the same boot config with one netd argument added"
-
-[[number]]
-name = "boot.lanleasecase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-
-[[number]]
-name = "boot.lanleasecase.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.lancase.stick_secs"
-
-[[number]]
-name = "list.lanleasecase.job_ms"
-unit = "ms"
-ceiling = 22000
-ceiling_from = "as list.lancase.job_ms — the same one job"
-
-[[number]]
-name = "boot.lanleasecase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.lanleasecase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-# `lantalkcase` is `lancase` with sshd and its log served, talked to from the
-# host until it is told to reboot. Its one job holds the machine only as the
-# fallback for a host that never says so.
-
-[[number]]
-name = "boot.lantalkcase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "as boot.lancase.complete_ms"
-
-[[number]]
-name = "boot.lantalkcase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-
-[[number]]
-name = "boot.lantalkcase.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.lancase.stick_secs"
-
-[[number]]
-name = "list.lantalkcase.job_ms"
-unit = "ms"
-ceiling = 54000
-ceiling_from = "lan_talk_hold's end, toyos_tco::JOB_BOUND_MS less its tenth: the hold sleeps to that much boot time and no further"
-
-[[number]]
-name = "boot.lantalkcase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.lantalkcase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-# `lanswapcase` is `lantalkcase` flashed without `--talk`: netd is swapped while
-# it runs by the `--swap` invocation beside the loop, and its hold ends it.
-
-[[number]]
-name = "boot.lanswapcase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "as boot.lancase.complete_ms"
-
-[[number]]
-name = "boot.lanswapcase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-
-[[number]]
-name = "boot.lanswapcase.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.lancase.stick_secs"
-
-[[number]]
-name = "list.lanswapcase.job_ms"
-unit = "ms"
-ceiling = 54000
-ceiling_from = "as list.lantalkcase.job_ms"
-
-[[number]]
-name = "boot.lanswapcase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.lanswapcase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.lanswapcase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-measured = 0
diff --git a/tests/metal/lenovo-20w0003amz.toml b/tests/metal/lenovo-20w0003amz.toml
new file mode 100644
index 00000000000..ad31ea49a85
--- /dev/null
+++ b/tests/metal/lenovo-20w0003amz.toml
@@ -0,0 +1,80 @@
+vendor = "LENOVO"
+product = "20W0003AMZ"
+bios = "N34ET71W (1.71 )"
+
+[measured]
+"boot.ccorpus-2.complete_ms" = 1170
+"boot.ccorpus-2.panel_max_us" = 3878
+"boot.ccorpus-2.panel_us" = 21089
+"boot.ccorpus.complete_ms" = 1165
+"boot.ccorpus.panel_max_us" = 3759
+"boot.ccorpus.panel_us" = 22178
+"boot.deadlinewedge.complete_ms" = 1165
+"boot.deadlinewedge.panel_max_us" = 3850
+"boot.deadlinewedge.panel_us" = 21662
+"boot.foreignrecord.complete_ms" = 1165
+"boot.hardlockup.complete_ms" = 1164
+"boot.hardlockup.panel_max_us" = 3949
+"boot.hardlockup.panel_us" = 21772
+"boot.jobcase.complete_ms" = 1164
+"boot.jobcase.panel_max_us" = 3873
+"boot.jobcase.panel_us" = 21418
+"boot.lanicscase.complete_ms" = 1171
+"boot.lanicscase.panel_max_us" = 4000
+"boot.lanicscase.panel_us" = 21420
+"boot.lanleasecase.complete_ms" = 1165
+"boot.lanleasecase.panel_max_us" = 3841
+"boot.lanleasecase.panel_us" = 22280
+"boot.lanswapcase.complete_ms" = 1165
+"boot.lanswapcase.panel_max_us" = 7061
+"boot.lanswapcase.panel_us" = 26663
+"boot.latencycase.complete_ms" = 1165
+"boot.latencycase.panel_max_us" = 3887
+"boot.latencycase.panel_us" = 21459
+"boot.logstallcase.complete_ms" = 1165
+"boot.logstallcase.panel_max_us" = 3906
+"boot.logstallcase.panel_us" = 22531
+"boot.metalcase.complete_ms" = 1165
+"boot.metalcase.panel_max_us" = 3844
+"boot.metalcase.panel_us" = 21526
+"boot.metaldevicecase.complete_ms" = 1165
+"boot.metaldevicecase.panel_max_us" = 3837
+"boot.metaldevicecase.panel_us" = 23002
+"boot.selftests.complete_ms" = 1172
+"boot.selftests.panel_max_us" = 3950
+"boot.selftests.panel_us" = 22805
+"boot.shared-2.complete_ms" = 1165
+"boot.shared-2.panel_max_us" = 3721
+"boot.shared-2.panel_us" = 21855
+"boot.shared-debug.complete_ms" = 1165
+"boot.shared-debug.panel_max_us" = 3791
+"boot.shared-debug.panel_us" = 21483
+"boot.testcases-deaf.complete_ms" = 1165
+"boot.testcases-deaf.panel_max_us" = 5247
+"boot.testcases-deaf.panel_us" = 26659
+"boot.testcases-debug.complete_ms" = 1165
+"boot.testcases-debug.panel_max_us" = 3824
+"boot.testcases-debug.panel_us" = 22032
+"boot.testcases-mkdir.complete_ms" = 1166
+"boot.testcases-mkdir.panel_max_us" = 3839
+"boot.testcases-mkdir.panel_us" = 22100
+"boot.testcases-readdir.complete_ms" = 1166
+"boot.testcases-readdir.panel_max_us" = 3868
+"boot.testcases-readdir.panel_us" = 21680
+"boot.testcases-watchdog.complete_ms" = 1169
+"boot.testcases-watchdog.panel_max_us" = 3752
+"boot.testcases-watchdog.panel_us" = 21655
+"boot.testcases-window.complete_ms" = 1165
+"boot.testcases-window.panel_max_us" = 3822
+"boot.testcases-window.panel_us" = 22472
+"boot.usbload.complete_ms" = 1165
+"boot.usbload.panel_max_us" = 3837
+"boot.usbload.panel_us" = 21428
+"fbcheck.metaldevicecase.span_us" = 221570
+"fbfill.metaldevicecase.span_us" = 13885
+"fbread.metaldevicecase.span_us" = 313347
+"latency.p99_us" = 16
+"tlb.latencycase.p50_ns" = 2194
+"tlb.latencycase.p99_ns" = 3740
+"usbread.metaldevicecase.span_us" = 36393
+"usbwrite.metaldevicecase.span_us" = 2787258
diff --git a/tests/toyos-rust-tests/src/bin/cyclictest.rs b/tests/toyos-rust-tests/src/bin/cyclictest.rs
index c2dcca747c5..c554be9eee9 100644
--- a/tests/toyos-rust-tests/src/bin/cyclictest.rs
+++ b/tests/toyos-rust-tests/src/bin/cyclictest.rs
@@ -22,9 +22,8 @@
 //! writes itself is its `exit: <name> pid=N code=N cpu=Nms` record, which
 //! carries the whole `i32`.
 //! So the headline number leaves through the exit code: a non-negative code is
-//! a measured p99 in microseconds, bounded above by [`BUCKETS`] because a p99
-//! at the histogram's last bucket is a floor rather than a measurement; a
-//! negative one is a [`Refusal`] and no number in that run means anything.
+//! a measured p99 in microseconds; a negative one is a [`Refusal`] and no
+//! number in that run means anything.
 //! `userland/metalprobe` spells the same contract for the device suite, and the
 //! sign is what separates the two halves of it there as here. Every percentile
 //! is on stdout as well, for the host that has a console to read it on.
@@ -47,9 +46,6 @@ const SAMPLES: usize = 10_000;
 /// property of starting rather than of waking.
 const WARMUP: usize = 100;
 
-/// The widest lateness the histogram has a bucket for; a percentile that lands
-/// here is a floor rather than a measurement, and the caller is told so by the
-/// count of samples that had no bucket.
 const BUCKETS: usize = 4096;
 
 /// Why this run measured nothing, as the exit code carries it. Negative,
@@ -60,6 +56,8 @@ const BUCKETS: usize = 4096;
 enum Refusal {
     NoCapability = -1,
     BandRefused = -2,
+    /// The p99 is past the histogram's last bucket: a floor, not a measurement.
+    PastTheHistogram = -3,
 }
 
 fn refuse(why: Refusal, said: &str) -> ! {
@@ -111,27 +109,36 @@ fn main() {
         }
     }
 
-    let percentile = |want: usize| -> u64 {
+    // `None` where the sample wanted is in the overflow, which has no bucket to
+    // name.
+    let percentile = |want: usize| -> Option<u64> {
         let mut seen = 0usize;
         for (us, count) in histogram.iter().enumerate() {
             seen += *count as usize;
             if seen >= want {
-                return us as u64;
+                return Some(us as u64);
             }
         }
-        // Every remaining sample is in the overflow, which has no bucket to name.
-        BUCKETS as u64
+        None
     };
+    let shown = |p: Option<u64>| p.map_or_else(|| format!(">{}", BUCKETS - 1), |us| us.to_string());
 
     let p50 = percentile(SAMPLES / 2);
     let p90 = percentile(SAMPLES * 9 / 10);
     let p99 = percentile(SAMPLES * 99 / 100);
     let p999 = percentile(SAMPLES * 999 / 1000);
     println!(
-        "cyclictest: {SAMPLES} wakes at {}us: p50={p50}us p90={p90}us p99={p99}us \
-         p99.9={p999}us max={worst}us, {overflow} past the {BUCKETS}us histogram",
+        "cyclictest: {SAMPLES} wakes at {}us: p50={}us p90={}us p99={}us p99.9={}us \
+         max={worst}us, {overflow} past the {BUCKETS}us histogram",
         PERIOD_NS / 1_000,
+        shown(p50),
+        shown(p90),
+        shown(p99),
+        shown(p999),
     );
+    let Some(p99) = p99 else {
+        refuse(Refusal::PastTheHistogram, "the p99 is past the histogram, so it is a floor");
+    };
 
     exit(p99 as i32);
 }
diff --git a/tests/toyos-rust-tests/src/bin/lan_talk_hold.rs b/tests/toyos-rust-tests/src/bin/lan_talk_hold.rs
index e15dda115c3..9de3a7d87c5 100644
--- a/tests/toyos-rust-tests/src/bin/lan_talk_hold.rs
+++ b/tests/toyos-rust-tests/src/bin/lan_talk_hold.rs
@@ -10,9 +10,6 @@
 use std::thread::sleep;
 use std::time::Duration;
 
-/// Milliseconds of boot time this hold ends at: the runner's bound less the
-/// tenth `toyos_build::metalprofile::AROUND_THE_LIST_MS` keeps for the boot
-/// around the list, so the runner's own `reboot` still runs inside its bound.
 const UNTIL_MS: u64 = toyos_tco::JOB_BOUND_MS - toyos_tco::JOB_BOUND_MS / 10;
 
 fn main() {
diff --git a/tests/toyos.rs b/tests/toyos.rs
index 0966fa01db3..144cadf83d5 100644
--- a/tests/toyos.rs
+++ b/tests/toyos.rs
@@ -1499,8 +1499,7 @@ const METAL_SIM_CLIENTS: &[&str] = &[
 const METAL: &[(&str, metal::Metal)] = &[
     (
         // The device list: the T14's own xHCI, stick, i8042, HDA, framebuffer
-        // and NVMe, asserted from the records the shipping kernel writes, with
-        // every span `metalprobe` measured priced in `tests/metal-profile.toml`.
+        // and NVMe, asserted from the records the shipping kernel writes.
         "metal_device_probe",
         metal::Metal::Runs { arms: METALDEVICECASE, judge: |b| devices::on_metal(b[0]) },
     ),
@@ -1797,8 +1796,8 @@ const METAL: &[(&str, metal::Metal)] = &[
             // has.
             judge: |b| {
                 let (p50, p99) = tlb_shootdown_cost(b[0].kernel().text(), b[0].cpus()?)?;
-                b[0].number("tlb.latencycase.p50_ns", p50)?;
-                b[0].number("tlb.latencycase.p99_ns", p99)
+                b[0].measured("tlb.latencycase.p50_ns", p50)?;
+                b[0].measured("tlb.latencycase.p99_ns", p99)
             },
         },
     ),
@@ -1846,8 +1845,6 @@ const METAL: &[(&str, metal::Metal)] = &[
         // One boot: a machine writing to the stick continuously, reset out from
         // under itself by the deadline with the controller mid-transfer, and
         // the stick enumerable on the next host afterwards.
-        // `boot.usbload.stick_secs` is that, refused by the loop before this
-        // judge runs.
         "usb_reset_records_the_phase_it_cut",
         metal::Metal::Runs {
             arms: &[metal::once("usbload", "tests/jobcase", &["usb-reset-under-load"], &[])],
@@ -2219,6 +2216,7 @@ fn shared_metal(
             config: "tests/testcases",
             params: &[],
             features: &[],
+            members: const { std::num::NonZeroUsize::new(38).expect("a chunk holds a member") },
             jobs: shipping
                 .iter()
                 .filter(|n| keep(n))
@@ -2237,6 +2235,7 @@ fn shared_metal(
             config: "tests/testcases",
             params: &[],
             features: toyos_build::build::TEST_KERNEL,
+            members: const { std::num::NonZeroUsize::new(18).expect("a chunk holds a member") },
             jobs: debug.iter().filter(|n| keep(n)).map(|n| format!("test_rs_{n}")).collect(),
             files: Vec::new(),
             links: Vec::new(),
@@ -2354,6 +2353,7 @@ fn c_corpus_metal(
         config: "tests/testcases",
         params: &[],
         features: &[],
+        members: const { std::num::NonZeroUsize::new(90).expect("a chunk holds a member") },
         jobs,
         files,
         links,
@@ -15100,14 +15100,9 @@ fn tlb_shootdown_cost(log: &str, cpus: u32) -> Result<(u64, u64), String> {
         "  [tlb] {rounds} shootdowns across {across} CPUs: min={min}ns p50={p50}ns p90={p90}ns \
          p99={p99}ns max={max}ns"
     );
-    // The two the metal profile prices; the rest are the shape's own evidence.
     Ok((p50, p99))
 }
 
-/// `latency_wake` on a machine with no console: the p99,
-/// off the kernel's own exit record, against the ceiling the metal profile
-/// holds.
-///
 /// A negative code is `cyclictest`'s refusal and not a fast machine — the sign
 /// is the whole of what separates the two, and that contract is in the binary's
 /// own module header.
@@ -15115,11 +15110,11 @@ fn wake_latency_recorded(boot: &metal::Readback) -> Result<(), String> {
     let code = boot.exit_code("test_rs_cyclictest")?;
     if code < 0 {
         return Err(format!(
-            "cyclictest exited {code}, which is a refusal and not a measurement: -1 is no \
-             capability endowed, -2 is the real-time band refused"
+            "cyclictest exited {code}, which is a refusal and not a measurement; its own last \
+             line in the boot's log says which"
         ));
     }
-    boot.number("latency.p99_us", u64::try_from(code).expect("a non-negative code"))
+    boot.measured("latency.p99_us", u64::try_from(code).expect("a non-negative code"))
 }
 
 /// The negative control, executed: an AP left holding what `INIT` gave it, and
diff --git a/toyos-tco/src/lib.rs b/toyos-tco/src/lib.rs
index cc805064d09..bb4c4efccea 100644
--- a/toyos-tco/src/lib.rs
+++ b/toyos-tco/src/lib.rs
@@ -168,6 +168,15 @@ pub const HARD_LOCKUP_BOUND_MS: u64 = hard_lockup_bound_ms(WEDGE_BOUND_MS);
 /// hard-locked machine is reported as an ordinary wedge and the CPU is unnamed.
 const _: () = assert!(HARD_LOCKUP_BOUND_MS < WEDGE_BOUND_MS);
 
+/// How often an armed CPU samples itself against [`hard_lockup_bound_ms`], in
+/// nanoseconds of unhalted time, and so how late past that bound a stuck CPU
+/// can be found.
+///
+/// A second: the bound is measured in tens of them, so a sample period this
+/// long costs one NMI per CPU per second and puts the detection within one
+/// period of the bound. It is also the period the report's ages are quoted at.
+pub const HARD_LOCKUP_SAMPLE_NS: u64 = 1_000_000_000;
+
 /// The boot parameter that arms [`WEDGE_BOUND_MS`], with the bound in
 /// milliseconds after it. A value and not a flag, because the bound is the one
 /// thing about this mechanism a boot can legitimately differ on — a negative
diff --git a/userland/metalprobe/src/main.rs b/userland/metalprobe/src/main.rs
index fd6dbf5553e..b4a385137e6 100644
--- a/userland/metalprobe/src/main.rs
+++ b/userland/metalprobe/src/main.rs
@@ -11,10 +11,7 @@
 //! process name in the record is the symlink it was invoked under. The host
 //! reads both out of the log the stick came back with.
 //!
-//! **Every command's number is a span in microseconds**, and never a rate. The
-//! profile that prices them (`tests/metal-profile.toml`) holds a ceiling per
-//! number, and a ceiling is what a duration has: a rate would have to be judged
-//! from below, against a floor nothing in that file can express. What each span
+//! **Every command's number is a span in microseconds**, and never a rate. What each span
 //! covers is its own module's to say, and the byte count it covers is a
 //! constant there.
 //!
@@ -62,8 +59,7 @@ impl Refusal {
 /// there is none.
 pub type Measured = Result<i32, Refusal>;
 
-/// Every command by the name its symlink gives it. The name is what the
-/// kernel's `exit:` record carries, so it is also the name the profile prices.
+/// Every command by the name its symlink gives it.
 macro_rules! commands {
     ($($name:literal => $run:path),+ $(,)?) => {
         const COMMANDS: &[(&str, fn() -> Measured)] = &[$(($name, $run)),+];
@@ -101,9 +97,7 @@ fn main() {
 /// A span in whole microseconds, saturated at [`i32::MAX`] so a span too long
 /// for the channel is still a number and not a wrap.
 ///
-/// A span the clock could not tell from zero is refused rather than reported:
-/// the profile would price it against a ceiling it can never reach, and a
-/// measurement that cannot fail is what that file exists to refuse.
+/// A span the clock could not tell from zero is refused rather than reported.
 pub fn span(nanos: u128) -> Measured {
     let micros = nanos / 1_000;
     if micros == 0 {