From 9db14e71b3ccb67e760ad99655ec64a29ced1d41 Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Tue, 29 Sep 2026 19:02:02 +0200
Subject: [PATCH 01/10] Metal timings are recorded per machine and judged
 against that machine's own record

tests/metal-profile.toml priced every number the metal suite measures with a
ceiling somebody typed, and refused any number nobody had priced: the full T14
run of 2026-09-29 (616) went red on boot.usbload.panel_max_us and
boot.usbload.panel_us for exactly that. The file, src/metalprofile.rs and the
list-sizing allowance derived from its job_ms ceilings are deleted.

Machine identity. Nothing in a readback names the machine: the kernel log
carries ACPI OEM "LENOVO", a PCI inventory and a CPUID-stated TSC, none of
them a unit or a model. toyos-metal now reads SMBIOS over its existing ssh
session before the flash (/sys/class/dmi/id/sys_vendor, product_name,
bios_version, all 0444 in Linux's drivers/firmware/dmi-id.c, unlike
product_serial and product_uuid which are 0400) and writes it into boot.txt as
machine_vendor, machine_product and machine_bios.

One file per machine, tests/metal/<vendor>-<product>.toml, holding the BIOS it
was recorded under and a flat table of name -> value. A run writes it: an
unknown machine, or a known one under another BIOS, is recorded whole and not
judged; a name the record lacks is added and not judged; a recorded value is
never moved by a run, so a slow run never becomes the next run's baseline.
Re-recording a number is deleting its row. The harness prints the path when it
changed the file, for whoever ran it to commit.

The rule: a reading passes at most twice its record, a record of zero counting
as one unit. The widest spread between the readings the deleted profile
recorded and run 616's own is 1.55x (boot.hardlockup.back_secs, 170 against
110 s); complete_ms moved at most 1.08x, panel 1.21x, deadline lateness 1.1x,
stick_secs was 0 in both and lockup_lateness_ms went 0 -> 2 ms, which the
one-unit floor admits exactly. list.*.job_ms moved 2.4-5x, but between two
runs whose lists had different members.

Two ceilings in the profile were not timings and move to code:
park_open_operations (must be 0) is checked in Readback::stop_completed, which
also refuses a boot that handed the machine back with no stop record; the
cyclictest p99 at its histogram's 4096 is refused as a floor in
wake_latency_recorded.

A shared list's chunk size was derived from its job_ms ceiling; it is now
SharedBoot::members, set to what that derivation gave ((60000 - 6000) / 1400
= 38 for shared, / 2900 = 18 for shared-debug, / 600 = 90 for ccorpus), so the
images are cut as run 616's were. The refusal of an authored arm longer than
its allowance goes with the allowance.

No record is seeded: no readback, log or file in the tree carries the T14's
SMBIOS strings, so its record cannot be named until one run of this branch
reads them; that run records it.

issues/build/the-usbload-boot-measures-a-panel-no-profile-row-prices.md is
closed: an unrecorded name is now recorded rather than refused. Every citation
of the deleted file goes with it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ...al-loop-cannot-judge-a-boot-that-panics.md |    4 +-
 ...-measures-a-panel-no-profile-row-prices.md |   32 -
 ...-is-a-third-t14-flash-for-one-exit-code.md |    5 +-
 ...h-no-kernel-log-is-not-no-boot-complete.md |    3 +-
 ...-is-a-second-t14-flash-for-one-question.md |    7 +-
 ...eadline-fired-132859-ms-late-on-the-t14.md |   14 +-
 src/lib.rs                                    |    2 +-
 src/metal.rs                                  |   46 +-
 src/metaldevices.rs                           |   10 -
 src/metalprofile.rs                           |  386 -----
 src/metaltimings.rs                           |  361 +++++
 tests/checks.rs                               |    2 -
 tests/common/devices.rs                       |   16 +-
 tests/common/lan.rs                           |   23 +-
 tests/common/metal.rs                         |  257 ++-
 tests/common/power.rs                         |    3 +-
 tests/metal-profile.toml                      | 1439 -----------------
 .../toyos-rust-tests/src/bin/lan_talk_hold.rs |    3 -
 tests/toyos.rs                                |   24 +-
 userland/metalprobe/src/main.rs               |    5 +-
 20 files changed, 561 insertions(+), 2081 deletions(-)
 delete mode 100644 issues/build/the-usbload-boot-measures-a-panel-no-profile-row-prices.md
 delete mode 100644 src/metalprofile.rs
 create mode 100644 src/metaltimings.rs
 delete mode 100644 tests/metal-profile.toml

diff --git a/issues/build/the-metal-loop-cannot-judge-a-boot-that-panics.md b/issues/build/the-metal-loop-cannot-judge-a-boot-that-panics.md
index 6d24968cf73..c90ef0f23f8 100644
--- a/issues/build/the-metal-loop-cannot-judge-a-boot-that-panics.md
+++ b/issues/build/the-metal-loop-cannot-judge-a-boot-that-panics.md
@@ -18,9 +18,7 @@ the T14, and the reason is the loop rather than the kernel.
    `Boot: complete (Nms)` *and* a trailing `Rebooting.`. A boot whose subject is
    a panic correctly writes neither the second word nor anything after it, so
    the loop refuses it — the readback is still written, and
-   `tests/common/metal.rs`'s `Mode::Drive` tolerates the non-zero exit, but the
-   boot-level rows `tests/metal-profile.toml` prices are then judged against a
-   log the loop has already called unfit.
+   `tests/common/metal.rs`'s `Mode::Drive` tolerates the non-zero exit.
 
 2. `test-late-panic` fires in `kernel_main` after `spawn_init` and before
    `enter_idle_loop`, so `logd` has not run: that boot writes no `/log` file at
diff --git a/issues/build/the-usbload-boot-measures-a-panel-no-profile-row-prices.md b/issues/build/the-usbload-boot-measures-a-panel-no-profile-row-prices.md
deleted file mode 100644
index 4d22e673862..00000000000
--- a/issues/build/the-usbload-boot-measures-a-panel-no-profile-row-prices.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-29
----
-
-# The `usbload` boot measures a panel no `tests/metal-profile.toml` row prices
-
-`tests/metal-profile.toml` prices `panel_max_us` and `panel_us` for every
-metal boot but `usbload`, whose sealed page carries the panel census like any
-other. `tests/common/metal.rs` fails a measured number with no row, so every
-run that flashes `usbload` reds for it, whatever
-`usb_reset_records_the_phase_it_cut` — the boot's one rider — says.
-
-## Measured
-
-The full T14 run of `main` at `7e151819`
-(EXIT=1):
-
-```
-  usbload: Boot: complete 1166 ms, back in 164 s, the stick enumerated 0 s after that
-    the panel painted 10 time(s) and put 8741120 px on the glass
-    FAIL the metal suite measured "boot.usbload.panel_max_us" and tests/metal-profile.toml prices no such number; add a row with a ceiling and where it came from, because a measurement with no ceiling cannot fail
-    FAIL the metal suite measured "boot.usbload.panel_us" and tests/metal-profile.toml prices no such number; add a row with a ceiling and where it came from, because a measurement with no ceiling cannot fail
-```
-
-## Exit condition
-
-`tests/metal-profile.toml` carries `boot.usbload.panel_max_us` and
-`boot.usbload.panel_us` rows, each ceiling taken from a measurement of that
-boot rather than chosen, and a T14 run that flashes `usbload` prints
-neither refusal.
diff --git a/issues/diagnostics/the-lanleasecase-boot-is-a-third-t14-flash-for-one-exit-code.md b/issues/diagnostics/the-lanleasecase-boot-is-a-third-t14-flash-for-one-exit-code.md
index 2b1db4a1aa5..731723d4006 100644
--- a/issues/diagnostics/the-lanleasecase-boot-is-a-third-t14-flash-for-one-exit-code.md
+++ b/issues/diagnostics/the-lanleasecase-boot-is-a-third-t14-flash-for-one-exit-code.md
@@ -17,8 +17,7 @@ reaches no file
 (`issues/diagnostics/the-cable-judge-reads-three-netd-records-that-cannot-arrive-on-the-t14.md`):
 the kernel's `exit: netd pid=N code=N` record and a file netd writes itself are
 the two words of a process that cross. It is the `lan_lease_report` metal row,
-a third image flashed to the stick, a third boot of the machine and six rows of
-`tests/metal-profile.toml`.
+a third image flashed to the stick and a third boot of the machine.
 
 ## Owner
 
@@ -32,7 +31,7 @@ which the shipping `lancase` arm carries netd's own lines about the lease and
 the probe answers a question already answered. Then the arm is:
 `tests/lanleasecase/system.toml`, its row in `src/build.rs`'s `ALL_CONFIGS`,
 the `lan_lease_report` metal row in `tests/toyos.rs` with `LANLEASECASE` and
-`lan::leased_on_metal`, the six `tests/metal-profile.toml` rows,
+`lan::leased_on_metal`,
 `userland/netd/src/report.rs` and `toyos-i219/src/lease.rs`'s report lines —
 and netd's `--exit-with-lease` with `tests/e1000leasecase` and the
 `lan_lease_report` QEMU registration, the arm that proves the channel.
diff --git a/issues/hardware/a-boot-with-no-kernel-log-is-not-no-boot-complete.md b/issues/hardware/a-boot-with-no-kernel-log-is-not-no-boot-complete.md
index b23fed10af3..8c350ce6f26 100644
--- a/issues/hardware/a-boot-with-no-kernel-log-is-not-no-boot-complete.md
+++ b/issues/hardware/a-boot-with-no-kernel-log-is-not-no-boot-complete.md
@@ -22,8 +22,7 @@ readback could say about the run-22 class of hang.
 
 **Exit condition**: the loop names that case as itself — a readback with no
 `logd` file and no harvested report reported as "wedged before its first durable
-record", distinct from "no `Boot: complete`" and from "no readback at all" — and
-a metal-profile row that says which of the three a boot is.
+record", distinct from "no `Boot: complete`" and from "no readback at all".
 
 Off the path of whoever finds this: it is `src/metal.rs`'s verdict and belongs
 to the driver, not to the kernel side that produced the boot.
diff --git a/issues/hardware/the-lanicscase-boot-is-a-second-t14-flash-for-one-question.md b/issues/hardware/the-lanicscase-boot-is-a-second-t14-flash-for-one-question.md
index 27b2a5ff9c8..6f44546b60c 100644
--- a/issues/hardware/the-lanicscase-boot-is-a-second-t14-flash-for-one-question.md
+++ b/issues/hardware/the-lanicscase-boot-is-a-second-t14-flash-for-one-question.md
@@ -10,9 +10,7 @@ opened: 2026-09-13
 `--provoke-message`, which writes one enabled cause to `ICS` so the kernel's
 `pcidev: slot N took its first message` record says whether delivery works at
 all. It is the `lan_message_delivery` metal row, a second image flashed to the
-stick, a second boot of the machine and six rows of `tests/metal-profile.toml`
-(`boot.lanicscase.{complete_ms,back_secs,stick_secs,panel_max_us,panel_us}`,
-`list.lanicscase.job_ms`).
+stick and a second boot of the machine.
 
 **A count of no messages is two facts** — a part nothing made speak and a
 message that reached no CPU — and only this arm separates them. On a card that
@@ -30,8 +28,7 @@ The shipping `lancase` arm recording `pcidev: slot N took its first message`
 without the actuator. Then the actuator has no question left and the arm is
 four files: `tests/lanicscase/system.toml`, its row in `src/build.rs`'s
 `ALL_CONFIGS`, `tests/toyos.rs`'s `lan_message_delivery` row, its `METAL_ONLY`
-entry and `LANICSCASE` with the judge `lan::provoked_on_metal`, and the six
-`tests/metal-profile.toml` rows.
+entry and `LANICSCASE` with the judge `lan::provoked_on_metal`.
 
 Metal run 57 recorded `pcidev: slot 0 took its first message on vector 0x28`
 after the I219's hand-over on that slot and vector, so the second fact is read:
diff --git a/issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md b/issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md
index 0516d530fa0..9005b87e26d 100644
--- a/issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md
+++ b/issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md
@@ -107,16 +107,10 @@ runner asks for no reboot; the deadline was the only bound left, and it fired
 ## The instrument that measures this already exists
 
 `src/metal.rs:1591-1597`'s `deadline_lateness_ms` computes exactly
-`reached − bound` out of the `DEADLINE_EXPIRED` line (`src/bootlog.rs:28`);
-`tests/common/metal.rs:274-275` reads it off every readback and `:895-919`
-hands it to `profile.judge` as `boot.<label>.deadline_lateness_ms`;
-`tests/metal-profile.toml:409-414` prices that row for `deadlinewedge` —
-ceiling 10000 ms, "the widest true bound before [the timer period] has been"
-measured, `measured = 61`. 132859 is 13x that ceiling, on a boot the profile
-does not name: `lancase` is not among the labels the file prices, and is not
-in this tree. The arithmetic above is the instrument's own, done by hand
-because the run was `toyos-metal` invoked directly and not the harness. No
-second instrument is owed; a cause is.
+`reached − bound` out of the `DEADLINE_EXPIRED` line (`src/bootlog.rs:28`).
+The arithmetic above is the instrument's own, done by hand because the run
+was `toyos-metal` invoked directly and not the harness. No second instrument
+is owed; a cause is.
 
 ## What is known and what is not
 
diff --git a/src/lib.rs b/src/lib.rs
index 8b3e3a638cb..5fcc11e8b80 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -33,9 +33,9 @@ pub mod licence;
 pub mod metal;
 pub mod metaldevices;
 pub mod metalimage;
-pub mod metalprofile;
 pub mod metalswap;
 pub mod metaltalk;
+pub mod metaltimings;
 pub mod pr;
 pub mod redlist;
 pub mod release;
diff --git a/src/metal.rs b/src/metal.rs
index 516f2b9a860..3172701dece 100644
--- a/src/metal.rs
+++ b/src/metal.rs
@@ -23,6 +23,7 @@ use std::process::{Command, Output, Stdio};
 use crate::bootlog;
 use crate::flags::{declare_flags, Flag};
 use crate::image::LBA;
+use crate::metaltimings::Machine;
 
 const CONNECT_SECS: u64 = 10;
 
@@ -186,6 +187,9 @@ pub enum Refusal {
     /// binary in service**: init's words, the machine's answer or ssh
     /// afterwards, each finding by name.
     Swap(Vec<String>),
+    /// The machine did not name itself: its SMBIOS answer is not
+    /// [`Machine::QUERY`]'s three lines.
+    Machine(String),
     Usage(String),
 }
 
@@ -344,6 +348,7 @@ impl fmt::Display for Refusal {
                 "the swap did not put the new binary in service:\n  {}",
                 findings.join("\n  ")
             ),
+            Self::Machine(why) => write!(f, "the machine did not say what it is: {why}"),
             Self::Usage(why) => write!(f, "{why}"),
         }
     }
@@ -1408,8 +1413,7 @@ impl Driver {
     /// **A number and not an implication.** Whether the stick came back is what
     /// the T14 alone can say about the ruling, and before this it was only ever
     /// visible as `mount: special device /dev/sda3 does not exist` — a mount
-    /// that fails for a dozen other reasons too. Waited for by name, priced in
-    /// `tests/metal-profile.toml`, and refused as its own kind.
+    /// that fails for a dozen other reasons too.
     fn wait_for_the_stick(&self) -> Result<u64, Refusal> {
         let node = self.target.node.partition(self.target.log_part);
         let probe = format!("test -b {}", shell_word(&node));
@@ -2006,6 +2010,9 @@ pub fn run(args: &Args) -> Result<Option<u64>, Refusal> {
         identity.vendor,
         identity.model
     );
+    let machine = Machine::parse(&driver.ssh("reading the machine's SMBIOS", Machine::QUERY)?)
+        .map_err(Refusal::Machine)?;
+    println!("machine {} {}, BIOS {}", machine.vendor, machine.product, machine.bios);
     // Before the flash, because the address a boot of this image could answer
     // on is one only the operating system that is still up can be asked for.
     let wire = match &args.nic {
@@ -2100,7 +2107,7 @@ pub fn run(args: &Args) -> Result<Option<u64>, Refusal> {
         println!("toyos-fat32-check: the log partition's {} bytes check out", bytes.len());
     }
     if let Some(dir) = &args.readback {
-        write_readback(dir, &loader, &log, back, stick, wire.as_ref(), replied)?;
+        write_readback(dir, &loader, &log, back, stick, &machine, wire.as_ref(), replied)?;
         println!("readback written to {}", dir.display());
     }
     // **Named by evidence, before the boot record is missed.** A boot that
@@ -2277,6 +2284,11 @@ pub const READBACK_VOLUME: &str = "log-partition.img";
 pub const BACK_SECS: &str = "back_secs";
 pub const STICK_SECS_KEY: &str = "stick_secs";
 
+/// The machine the boot ran on, as [`Machine::QUERY`] answered before the flash.
+pub const VENDOR_KEY: &str = "machine_vendor";
+pub const PRODUCT_KEY: &str = "machine_product";
+pub const BIOS_KEY: &str = "machine_bios";
+
 /// The cable: the address this loop pinged, the MAC of the function holding it,
 /// and how far the machine's own clock stood from this host's. **All three
 /// together or none**: a judge reading two of them places an observation
@@ -2327,6 +2339,7 @@ fn write_readback(
     log: &str,
     back: u64,
     stick: u64,
+    machine: &Machine,
     wire: Option<&Wire>,
     replied: Option<Reply>,
 ) -> Result<(), Refusal> {
@@ -2341,7 +2354,11 @@ fn write_readback(
     // The boot's own millisecond count is in the kernel log and read from
     // there; this file carries only what the *host* clock measured, which no
     // log can.
-    let mut boot = format!("{BACK_SECS} {back}\n{STICK_SECS_KEY} {stick}\n");
+    let mut boot = format!(
+        "{BACK_SECS} {back}\n{STICK_SECS_KEY} {stick}\n{VENDOR_KEY} {}\n{PRODUCT_KEY} {}\n\
+         {BIOS_KEY} {}\n",
+        machine.vendor, machine.product, machine.bios
+    );
     if let Some(wire) = wire {
         boot.push_str(&format!(
             "{PING_ADDR_KEY} {}\n{WIRE_MAC_KEY} {}\n{CLOCK_SKEW_KEY} {}\n",
@@ -2398,6 +2415,16 @@ pub fn stick_secs(text: &str) -> Option<u64> {
     key(text, STICK_SECS_KEY)
 }
 
+/// The machine a readback names, or why it names none.
+pub fn machine(text: &str) -> Result<Machine, String> {
+    match (word(text, VENDOR_KEY), word(text, PRODUCT_KEY), word(text, BIOS_KEY)) {
+        (Some(vendor), Some(product), Some(bios)) => Ok(Machine { vendor, product, bios }),
+        _ => Err(format!(
+            "names no machine: {VENDOR_KEY}, {PRODUCT_KEY} and {BIOS_KEY} are owed together"
+        )),
+    }
+}
+
 /// What one boot's readback says about the cable, or `None` where the loop was
 /// not asked to reach one.
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -2752,6 +2779,17 @@ mod tests {
         assert_eq!(back_secs("back_secs later\n"), None);
     }
 
+    #[test]
+    fn the_machine_crosses_in_the_boot_file() {
+        let dir = toyos_tmpdir::TempDir::new("machine");
+        let t14 = Machine::parse("LENOVO\n20W000T9GE\nN34ET56W (1.56 )\n").expect("three lines");
+        write_readback(&dir, "", "", 47, 0, &t14, None, None).expect("write");
+        let boot = std::fs::read_to_string(dir.join(READBACK_BOOT)).expect("boot.txt");
+        assert_eq!(machine(&boot), Ok(t14));
+        assert_eq!(back_secs(&boot), Some(47));
+        assert!(machine("back_secs 47\nmachine_vendor LENOVO\n").is_err());
+    }
+
     /// **A boot the cable did not answer is not a boot that answered in the
     /// first second, and neither is a boot that was never asked.**
     #[test]
diff --git a/src/metaldevices.rs b/src/metaldevices.rs
index 4787182045b..97a81d70f44 100644
--- a/src/metaldevices.rs
+++ b/src/metaldevices.rs
@@ -7,12 +7,6 @@
 //! and nothing here touches a machine. `tests/metaldevicecase` is the boot that
 //! produces them: `userland/metalprobe`'s jobs measure, exit with their spans,
 //! and the kernel's own `exit:` record carries each one off the machine.
-//!
-//! **What a number may be is not here, and there is one place it is.** Every
-//! measurement the suite takes is priced by name in `tests/metal-profile.toml`
-//! and judged by [`crate::metalprofile`], which refuses a name with no row;
-//! what this holds is the *shape* both ends have to agree about, so a host and
-//! a guest cannot come to different answers about a word.
 
 #![forbid(unsafe_code)]
 
@@ -331,10 +325,6 @@ pub fn inventory(log: &str) -> Vec<String> {
 /// absent and was not — the loader's file and `logd`'s judged by their own
 /// tables, plus the two whose *content* is the assertion. Each line opens with
 /// the `about` it failed, so a caller can name them without reading the prose.
-///
-/// A `Vec` of failures and not a `Vec<Verdict>`: the device suite's numbers are
-/// priced in `tests/metal-profile.toml` and judged there, so what is left here
-/// is the half that is about records.
 pub fn unmet(loader: &str, log: &str) -> Vec<String> {
     let mut out = Vec::new();
     for (record, text) in
diff --git a/src/metalprofile.rs b/src/metalprofile.rs
deleted file mode 100644
index f52462b1cea..00000000000
--- a/src/metalprofile.rs
+++ /dev/null
@@ -1,386 +0,0 @@
-//! Every number the metal suite measures on the T14, with the ceiling past
-//! which it is a red.
-//!
-//! One committed file, [`PATH`], read by the judge — so a slower boot or a
-//! wider tail reds against a number somebody wrote down and not against
-//! nothing. The judge asks by name and a name with no row is a **refusal**: a
-//! measurement nobody has priced must not pass by having no ceiling.
-//!
-//! `ceiling` is the verdict and `ceiling_from` says where it came from.
-//! `measured` is the last reading the machine gave and is absent until a run
-//! has taken one; it is evidence for the next author, never the gate — a bound
-//! asserted against its own measurement is not a bound.
-
-#![forbid(unsafe_code)]
-
-use std::collections::BTreeSet;
-use std::path::Path;
-
-use serde::Deserialize;
-
-/// Where the committed file lives, relative to the repository root.
-pub const PATH: &str = "tests/metal-profile.toml";
-
-/// What the boot around a job list costs it, in milliseconds.
-///
-/// The runner's bound is measured from boot rather than from its first job,
-/// so everything
-/// before the list comes off the bound before the members get any of it — and
-/// the `reboot` job the image derivation appends comes off the other end.
-///
-/// A tenth of the bound, derived rather than measured, and several times what
-/// either end has ever cost. Nine tenths is what the members may spend.
-pub const AROUND_THE_LIST_MS: u64 = toyos_tco::JOB_BOUND_MS / 10;
-
-/// The name under which one boot's per-member allowance is priced.
-pub fn job_ms_row(boot: &str) -> String {
-    format!("list.{boot}.job_ms")
-}
-
-/// How many members a job list may carry when one member is allowed `job_ms`.
-///
-/// **The runner's bound ends the whole list and not the job it is inside**,
-/// which is why a suite that runs seventy-two binaries on one boot needs this
-/// step at all: past this count the members never run, and the boot reports
-/// them as missing exit records rather than as a list nobody sized.
-pub fn members_per_boot(job_ms: u64) -> usize {
-    let spendable = toyos_tco::JOB_BOUND_MS.saturating_sub(AROUND_THE_LIST_MS);
-    // A member priced above the whole allowance still gets a boot of its own:
-    // one member per boot is the smallest a list can be cut to, and the boot
-    // then reds on its own measured cost rather than on being unsplittable.
-    usize::try_from(spendable / job_ms.max(1)).unwrap_or(usize::MAX).max(1)
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct Profile {
-    #[serde(default)]
-    pub number: Vec<Row>,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct Row {
-    /// What the judge asks for it by. One row per name.
-    pub name: String,
-    pub unit: String,
-    /// Past this is a red.
-    pub ceiling: u64,
-    /// Where the ceiling came from: a constant this repository declares, or the
-    /// margin over a reading. A ceiling with no derivation is a guess.
-    pub ceiling_from: String,
-    /// The last reading the machine gave, if one has been taken.
-    #[serde(default)]
-    pub measured: Option<u64>,
-}
-
-/// Why a profile could not be read, or why a reading is not one.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum Unfit {
-    /// The file itself.
-    File(String),
-    /// Two rows under one name: the judge would answer with whichever it found.
-    Duplicate(String),
-    /// A row whose committed reading is already past its own ceiling.
-    Stale { name: String, measured: u64, ceiling: u64 },
-    /// A number nobody has priced. **The gate fails closed here.**
-    Unpriced(String),
-    /// A reading past the ceiling.
-    Over { name: String, unit: String, value: u64, ceiling: u64, from: String },
-}
-
-impl std::fmt::Display for Unfit {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::File(why) => write!(f, "{PATH}: {why}"),
-            Self::Duplicate(name) => {
-                write!(f, "{PATH} carries two rows named {name:?}, and a judge reading it would \
-                          answer with whichever it found first")
-            }
-            Self::Stale { name, measured, ceiling } => write!(
-                f,
-                "{PATH}'s {name:?} records {measured} against its own ceiling of {ceiling}: the \
-                 committed reading is already a red"
-            ),
-            Self::Unpriced(name) => write!(
-                f,
-                "the metal suite measured {name:?} and {PATH} prices no such number; add a row \
-                 with a ceiling and where it came from, because a measurement with no ceiling \
-                 cannot fail"
-            ),
-            Self::Over { name, unit, value, ceiling, from } => write!(
-                f,
-                "{name} is {value} {unit} against a ceiling of {ceiling} ({from})"
-            ),
-        }
-    }
-}
-
-impl Profile {
-    /// Read and check the committed file. The checks are the file's own
-    /// well-formedness, never a machine's.
-    pub fn load(root: &Path) -> Result<Self, Unfit> {
-        let at = root.join(PATH);
-        let text = std::fs::read_to_string(&at)
-            .map_err(|e| Unfit::File(format!("{} — {e}", at.display())))?;
-        Self::parse(&text)
-    }
-
-    pub fn parse(text: &str) -> Result<Self, Unfit> {
-        let profile: Self = toml::from_str(text).map_err(|e| Unfit::File(e.to_string()))?;
-        let mut seen: BTreeSet<&str> = BTreeSet::new();
-        for row in &profile.number {
-            if !seen.insert(row.name.as_str()) {
-                return Err(Unfit::Duplicate(row.name.clone()));
-            }
-            if let Some(measured) = row.measured {
-                if measured > row.ceiling {
-                    return Err(Unfit::Stale {
-                        name: row.name.clone(),
-                        measured,
-                        ceiling: row.ceiling,
-                    });
-                }
-            }
-        }
-        Ok(profile)
-    }
-
-    pub fn row(&self, name: &str) -> Option<&Row> {
-        self.number.iter().find(|row| row.name == name)
-    }
-
-    /// How many members `boot`'s job list may carry, from the allowance this
-    /// file prices for it. A boot with no allowance is refused, like any other
-    /// unpriced number: a list nobody has priced cannot be sized to the bound.
-    pub fn members_per_boot(&self, boot: &str) -> Result<usize, Unfit> {
-        let name = job_ms_row(boot);
-        let row = self.row(&name).ok_or(Unfit::Unpriced(name))?;
-        Ok(members_per_boot(row.ceiling))
-    }
-
-    /// One reading against its row. A name with no row is refused.
-    pub fn judge(&self, name: &str, value: u64) -> Result<(), Unfit> {
-        let Some(row) = self.row(name) else { return Err(Unfit::Unpriced(name.to_string())) };
-        if value > row.ceiling {
-            return Err(Unfit::Over {
-                name: row.name.clone(),
-                unit: row.unit.clone(),
-                value,
-                ceiling: row.ceiling,
-                from: row.ceiling_from.clone(),
-            });
-        }
-        Ok(())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn root() -> &'static Path {
-        Path::new(env!("CARGO_MANIFEST_DIR"))
-    }
-
-    /// Every constant a `ceiling_from` may name, and what it holds.
-    ///
-    /// **The file says where a ceiling came from, and this is what makes that
-    /// true.** A row naming a constant carried a literal nobody re-derived when
-    /// the constant moved: fifteen rows read 360 against a `return_secs` of 420,
-    /// so a boot back in 361-420 s was inside the driver's own wait and red on a
-    /// ceiling nobody wrote.
-    const NAMED: &[(&str, u64)] = &[
-        ("toyos_build::metal::return_secs", 420),
-        ("toyos_build::metal::STICK_SECS", 30),
-        ("toyos_tco::JOB_BOUND_MS", toyos_tco::JOB_BOUND_MS),
-        ("toyos_tco::BOUND_MS", toyos_tco::BOUND_MS),
-        ("toyos_tco::WEDGE_BOUND_MS", toyos_tco::WEDGE_BOUND_MS),
-        ("toyos_tco::HARD_LOCKUP_BOUND_MS", toyos_tco::HARD_LOCKUP_BOUND_MS),
-    ];
-
-    /// A row whose ceiling *is* a constant this repository declares carries that
-    /// constant's value.
-    #[test]
-    fn a_ceiling_that_names_a_constant_carries_it() {
-        assert_eq!(crate::metal::return_secs(), 420, "the derivation moved");
-        assert_eq!(crate::metal::STICK_SECS, 30);
-        let profile = Profile::load(root()).expect(PATH);
-        let mut checked = 0usize;
-        for row in &profile.number {
-            let Some((named, want)) =
-                NAMED.iter().find(|(named, _)| row.ceiling_from.starts_with(named))
-            else {
-                continue;
-            };
-            checked += 1;
-            assert_eq!(
-                row.ceiling, *want,
-                "{:?} says its ceiling is {named}, and {named} is {want}",
-                row.name
-            );
-        }
-        assert!(checked > 0, "no row names a constant, so this gate holds nothing");
-    }
-
-    /// The committed file parses, no name is priced twice, and no row's own
-    /// recorded reading is already past the ceiling beside it.
-    #[test]
-    fn the_committed_profile_is_well_formed() {
-        let profile = Profile::load(root()).expect("tests/metal-profile.toml");
-        assert!(
-            !profile.number.is_empty(),
-            "{PATH} prices nothing, so every number the suite measures would be unpriced"
-        );
-        for row in &profile.number {
-            assert!(!row.unit.is_empty(), "{:?} has no unit", row.name);
-            assert!(
-                !row.ceiling_from.is_empty(),
-                "{:?}'s ceiling says nowhere it came from, which makes it a guess",
-                row.name
-            );
-        }
-    }
-
-    /// The gate is the ceiling and not the reading: a number nobody priced is
-    /// refused rather than passed.
-    #[test]
-    fn an_unpriced_number_is_refused_and_not_passed() {
-        let profile = Profile::parse(
-            "[[number]]\nname = \"boot.a.complete_ms\"\nunit = \"ms\"\nceiling = 100\n\
-             ceiling_from = \"a constant\"\n",
-        )
-        .unwrap();
-        assert_eq!(profile.judge("boot.a.complete_ms", 100), Ok(()));
-        assert!(matches!(profile.judge("boot.a.complete_ms", 101), Err(Unfit::Over { .. })));
-        assert_eq!(
-            profile.judge("boot.b.complete_ms", 1),
-            Err(Unfit::Unpriced("boot.b.complete_ms".to_string()))
-        );
-        let said = profile.judge("boot.b.complete_ms", 1).unwrap_err().to_string();
-        assert!(said.contains("cannot fail"), "{said}");
-    }
-
-    #[test]
-    fn a_row_whose_reading_is_past_its_own_ceiling_is_refused_at_the_file() {
-        let refusal = Profile::parse(
-            "[[number]]\nname = \"n\"\nunit = \"ms\"\nceiling = 10\nceiling_from = \"c\"\n\
-             measured = 11\n",
-        )
-        .unwrap_err();
-        assert_eq!(
-            refusal,
-            Unfit::Stale { name: "n".to_string(), measured: 11, ceiling: 10 }
-        );
-        assert!(matches!(
-            Profile::parse(
-                "[[number]]\nname = \"n\"\nunit = \"ms\"\nceiling = 10\nceiling_from = \"c\"\n\
-                 [[number]]\nname = \"n\"\nunit = \"ms\"\nceiling = 20\nceiling_from = \"c\"\n"
-            ),
-            Err(Unfit::Duplicate(_))
-        ));
-    }
-}
-
-#[cfg(test)]
-mod sizing_tests {
-    use super::*;
-
-    fn root() -> &'static Path {
-        Path::new(env!("CARGO_MANIFEST_DIR"))
-    }
-
-    /// **The overrun this rule exists for, in the machine's own numbers.** The
-    /// `shared` boot's seventy-two members at their committed 845 ms each are
-    /// 60.8 s inside a 60 s bound, so the runner resets the machine with the
-    /// tail unrun and each of those is reported as a missing exit record rather
-    /// than as a list too long for the bound.
-    #[test]
-    fn the_shared_list_does_not_fit_one_boot() {
-        let profile = Profile::load(root()).expect(PATH);
-        let per = profile.members_per_boot("shared").expect("shared is priced");
-        assert!(
-            per < 72,
-            "the allowance leaves room for {per} members and the list carries 72"
-        );
-        // Two chunks and not three: a list cut finer costs another minute of
-        // the machine for nothing.
-        assert_eq!(72_usize.div_ceil(per), 2, "{per} members a boot");
-        let measured =
-            profile.row(&job_ms_row("shared")).and_then(|r| r.measured).expect("a reading");
-        assert!(
-            72 * measured > toyos_tco::JOB_BOUND_MS,
-            "{measured} ms a member over 72 members fits the bound, so this rule cuts nothing"
-        );
-    }
-
-    /// `ccorpus` fits its bound and the same rule still cuts it: four fifths of
-    /// a bound is no margin for a slower stick, and the price of being wrong is
-    /// every member after the cut losing its verdict.
-    #[test]
-    fn a_corpus_that_fits_its_bound_is_cut_too() {
-        let profile = Profile::load(root()).expect(PATH);
-        let per = profile.members_per_boot("ccorpus").expect("ccorpus is priced");
-        assert_eq!(118_usize.div_ceil(per), 2, "{per} members a boot");
-    }
-
-    /// A member priced above the whole bound still gets a boot, rather than a
-    /// division that yields zero and a list that can hold nothing.
-    #[test]
-    fn a_member_priced_beyond_the_bound_still_gets_a_boot() {
-        assert_eq!(members_per_boot(toyos_tco::JOB_BOUND_MS * 10), 1);
-        let spendable = toyos_tco::JOB_BOUND_MS - AROUND_THE_LIST_MS;
-        assert_eq!(members_per_boot(spendable), 1);
-        assert_eq!(members_per_boot(spendable / 2), 2);
-    }
-
-    /// **`lan_hold` sleeps a bound this file prices.** The guest binary holds
-    /// the machine up for `toyos_tco::LEASE_BOUND_MS`, and the boot's own job
-    /// allowance has to outlast it or the runner's deadline cuts the window the
-    /// host reaches that machine across.
-    #[test]
-    fn the_window_lan_hold_sleeps_is_the_window_this_file_prices() {
-        let profile = Profile::load(root()).expect(PATH);
-        let hold = toyos_tco::LEASE_BOUND_MS;
-        let job = profile.row(&job_ms_row("lancase")).expect("lancase's own allowance");
-        assert!(job.ceiling > hold, "{} against a {hold} ms hold", job.ceiling);
-        for name in ["lan.lancase.link_up_ms", "lan.lancase.lease_ms"] {
-            let row = profile.row(name).unwrap_or_else(|| panic!("{name} is priced"));
-            assert_eq!(row.ceiling, hold, "{name}");
-        }
-    }
-
-    /// **`lan_talk_hold` sleeps to the runner's bound less the tenth this file
-    /// keeps for the boot around a list**, and the talking boot's allowance is
-    /// that span: a hold longer than it is cut by the runner, and the boot is
-    /// then ended by the bound it exists to stay inside.
-    #[test]
-    fn the_talking_boots_hold_ends_where_its_list_does() {
-        let profile = Profile::load(root()).expect(PATH);
-        let hold = toyos_tco::JOB_BOUND_MS - AROUND_THE_LIST_MS;
-        let job = profile.row(&job_ms_row("lantalkcase")).expect("lantalkcase's own allowance");
-        assert_eq!(job.ceiling, hold);
-        assert_eq!(members_per_boot(job.ceiling), 1);
-        let source = std::fs::read_to_string(
-            root().join("tests/toyos-rust-tests/src/bin/lan_talk_hold.rs"),
-        )
-        .expect("the hold's source");
-        assert!(
-            source.contains("toyos_tco::JOB_BOUND_MS - toyos_tco::JOB_BOUND_MS / 10"),
-            "lan_talk_hold no longer ends at the runner's bound less its tenth"
-        );
-        assert_eq!(AROUND_THE_LIST_MS, toyos_tco::JOB_BOUND_MS / 10);
-    }
-
-    /// A boot whose allowance nobody wrote down is refused, not given the
-    /// bound: the whole point of the row is that a list is cut to a number
-    /// somebody committed.
-    #[test]
-    fn a_boot_with_no_allowance_is_refused() {
-        let profile = Profile::parse("").expect("an empty profile parses");
-        assert_eq!(
-            profile.members_per_boot("nobody"),
-            Err(Unfit::Unpriced("list.nobody.job_ms".to_string()))
-        );
-    }
-}
diff --git a/src/metaltimings.rs b/src/metaltimings.rs
new file mode 100644
index 00000000000..77b809ce4d8
--- /dev/null
+++ b/src/metaltimings.rs
@@ -0,0 +1,361 @@
+//! Every number the metal suite measures, recorded per machine and judged only
+//! against the record of the machine that measured it.
+//!
+//! One file per machine under [`DIR`], named for its SMBIOS vendor and product,
+//! written by a run and committed by whoever ran it. A run on a machine with no
+//! record, or with one taken under another BIOS, is recorded and not judged; a
+//! name the record lacks is added and not judged; a recorded value is never
+//! moved by a run, so a slow run cannot become the baseline the next is judged
+//! by. Deleting a row or the file is how a number is re-recorded.
+//!
+//! [`ceiling`] is the one rule.
+
+#![forbid(unsafe_code)]
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+
+use serde::{Deserialize, Serialize};
+
+/// Where the records live, relative to the repository root.
+pub const DIR: &str = "tests/metal";
+
+/// Past this a reading is a red: twice what the machine recorded, and a record
+/// of zero counts as one unit, the resolution the number was read at.
+pub fn ceiling(recorded: u64) -> u64 {
+    recorded.max(1).saturating_mul(2)
+}
+
+/// A machine as its own firmware names it: SMBIOS type 1's manufacturer and
+/// product and type 0's BIOS version.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Machine {
+    pub vendor: String,
+    pub product: String,
+    pub bios: String,
+}
+
+impl Machine {
+    /// Asked of the operating system the machine runs between boots; all three
+    /// files are world-readable, unlike the serial and UUID beside them.
+    pub const QUERY: &str =
+        "cat /sys/class/dmi/id/sys_vendor /sys/class/dmi/id/product_name /sys/class/dmi/id/bios_version";
+
+    /// [`Self::QUERY`]'s answer: one non-empty line per file.
+    pub fn parse(text: &str) -> Result<Self, String> {
+        let lines: Vec<&str> = text.lines().map(str::trim).collect();
+        match lines[..] {
+            [vendor, product, bios]
+                if !vendor.is_empty() && !product.is_empty() && !bios.is_empty() =>
+            {
+                Ok(Self {
+                    vendor: vendor.to_string(),
+                    product: product.to_string(),
+                    bios: bios.to_string(),
+                })
+            }
+            _ => Err(format!(
+                "`{}` answered {text:?}, not three non-empty lines",
+                Self::QUERY
+            )),
+        }
+    }
+
+    /// Where this machine's record lives, relative to the repository root.
+    pub fn path(&self) -> PathBuf {
+        let mut slug = String::new();
+        for c in format!("{} {}", self.vendor, self.product).chars() {
+            if c.is_ascii_alphanumeric() {
+                slug.push(c.to_ascii_lowercase());
+            } else if !slug.is_empty() && !slug.ends_with('-') {
+                slug.push('-');
+            }
+        }
+        Path::new(DIR).join(format!("{}.toml", slug.trim_end_matches('-')))
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Record {
+    pub vendor: String,
+    pub product: String,
+    pub bios: String,
+    pub measured: BTreeMap<String, u64>,
+}
+
+impl Record {
+    /// `machine`'s record under `root`, `None` where it has none.
+    pub fn load(root: &Path, machine: &Machine) -> Result<Option<Self>, String> {
+        let at = root.join(machine.path());
+        let text = match std::fs::read_to_string(&at) {
+            Ok(text) => text,
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+            Err(e) => return Err(format!("{}: {e}", at.display())),
+        };
+        let record: Self = toml::from_str(&text).map_err(|e| format!("{}: {e}", at.display()))?;
+        if (record.vendor.as_str(), record.product.as_str())
+            != (machine.vendor.as_str(), machine.product.as_str())
+        {
+            return Err(format!(
+                "{} records {} {} and {} {} ran: two machines share one file name",
+                at.display(),
+                record.vendor,
+                record.product,
+                machine.vendor,
+                machine.product
+            ));
+        }
+        Ok(Some(record))
+    }
+
+    pub fn save(&self, root: &Path) -> Result<PathBuf, String> {
+        let machine = Machine {
+            vendor: self.vendor.clone(),
+            product: self.product.clone(),
+            bios: self.bios.clone(),
+        };
+        let at = root.join(machine.path());
+        let text = toml::to_string(self).map_err(|e| e.to_string())?;
+        std::fs::create_dir_all(root.join(DIR)).map_err(|e| format!("{DIR}: {e}"))?;
+        std::fs::write(&at, text).map_err(|e| format!("{}: {e}", at.display()))?;
+        Ok(at)
+    }
+
+    /// The recorded value, only where this record was taken under `machine`'s
+    /// BIOS: a value from other firmware judges nothing.
+    pub fn get(&self, machine: &Machine, name: &str) -> Option<u64> {
+        (self.bios == machine.bios)
+            .then(|| self.measured.get(name).copied())
+            .flatten()
+    }
+}
+
+/// A reading past [`ceiling`] of its record.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Over {
+    pub name: String,
+    pub value: u64,
+    pub recorded: u64,
+}
+
+impl std::fmt::Display for Over {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "{} is {} against {} recorded on this machine, past the ceiling of {}",
+            self.name,
+            self.value,
+            self.recorded,
+            ceiling(self.recorded)
+        )
+    }
+}
+
+/// What one run's readings come to on `machine`.
+#[derive(Debug)]
+pub struct Judged {
+    pub over: Vec<Over>,
+    /// The record after this run, and whether this run changed it.
+    pub record: Record,
+    pub changed: bool,
+}
+
+pub fn judge(
+    machine: &Machine,
+    record: Option<Record>,
+    measured: &BTreeMap<String, u64>,
+) -> Judged {
+    let mut record = match record {
+        Some(record) if record.bios == machine.bios => record,
+        _ => Record {
+            vendor: machine.vendor.clone(),
+            product: machine.product.clone(),
+            bios: machine.bios.clone(),
+            measured: BTreeMap::new(),
+        },
+    };
+    let mut over = Vec::new();
+    let mut changed = false;
+    for (name, &value) in measured {
+        match record.measured.get(name) {
+            Some(&recorded) if value > ceiling(recorded) => {
+                over.push(Over {
+                    name: name.clone(),
+                    value,
+                    recorded,
+                });
+            }
+            Some(_) => {}
+            None => {
+                record.measured.insert(name.clone(), value);
+                changed = true;
+            }
+        }
+    }
+    Judged {
+        over,
+        record,
+        changed,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn t14(bios: &str) -> Machine {
+        Machine {
+            vendor: "LENOVO".to_string(),
+            product: "20W000T9GE".to_string(),
+            bios: bios.to_string(),
+        }
+    }
+
+    fn readings(pairs: &[(&str, u64)]) -> BTreeMap<String, u64> {
+        pairs
+            .iter()
+            .map(|(name, value)| ((*name).to_string(), *value))
+            .collect()
+    }
+
+    fn recorded(machine: &Machine, pairs: &[(&str, u64)]) -> Record {
+        judge(machine, None, &readings(pairs)).record
+    }
+
+    #[test]
+    fn a_known_machine_within_its_record_passes() {
+        let machine = t14("N34ET56W (1.56 )");
+        let record = recorded(
+            &machine,
+            &[("boot.a.complete_ms", 1166), ("boot.a.stick_secs", 0)],
+        );
+        let judged = judge(
+            &machine,
+            Some(record.clone()),
+            &readings(&[("boot.a.complete_ms", 2332), ("boot.a.stick_secs", 2)]),
+        );
+        assert_eq!(judged.over, Vec::new());
+        assert!(!judged.changed);
+        assert_eq!(judged.record, record);
+    }
+
+    #[test]
+    fn a_known_machine_outside_its_record_fails_and_keeps_its_record() {
+        let machine = t14("N34ET56W (1.56 )");
+        let record = recorded(
+            &machine,
+            &[("boot.a.complete_ms", 1166), ("boot.a.stick_secs", 0)],
+        );
+        let judged = judge(
+            &machine,
+            Some(record.clone()),
+            &readings(&[("boot.a.complete_ms", 2333), ("boot.a.stick_secs", 3)]),
+        );
+        assert_eq!(
+            judged.over,
+            vec![
+                Over {
+                    name: "boot.a.complete_ms".to_string(),
+                    value: 2333,
+                    recorded: 1166
+                },
+                Over {
+                    name: "boot.a.stick_secs".to_string(),
+                    value: 3,
+                    recorded: 0
+                },
+            ]
+        );
+        assert_eq!(
+            judged.record, record,
+            "a red reading moved the record it is judged by"
+        );
+    }
+
+    #[test]
+    fn an_unknown_machine_is_recorded_and_not_judged() {
+        let machine = t14("N34ET56W (1.56 )");
+        let judged = judge(
+            &machine,
+            None,
+            &readings(&[("boot.a.complete_ms", u64::MAX)]),
+        );
+        assert_eq!(judged.over, Vec::new());
+        assert!(judged.changed);
+        assert_eq!(
+            judged.record.measured,
+            readings(&[("boot.a.complete_ms", u64::MAX)])
+        );
+        assert_eq!(judged.record.bios, machine.bios);
+    }
+
+    #[test]
+    fn another_bios_is_recorded_afresh_and_not_judged() {
+        let old = recorded(
+            &t14("N34ET50W (1.50 )"),
+            &[("boot.a.complete_ms", 1000), ("boot.a.gone_ms", 5)],
+        );
+        let machine = t14("N34ET56W (1.56 )");
+        assert_eq!(old.get(&machine, "boot.a.complete_ms"), None);
+        let judged = judge(
+            &machine,
+            Some(old),
+            &readings(&[("boot.a.complete_ms", 9000)]),
+        );
+        assert_eq!(judged.over, Vec::new());
+        assert!(judged.changed);
+        assert_eq!(judged.record.bios, machine.bios);
+        assert_eq!(
+            judged.record.measured,
+            readings(&[("boot.a.complete_ms", 9000)])
+        );
+    }
+
+    #[test]
+    fn a_new_name_on_a_known_machine_is_recorded_and_not_failed() {
+        let machine = t14("N34ET56W (1.56 )");
+        let record = recorded(&machine, &[("boot.a.complete_ms", 1166)]);
+        let judged = judge(
+            &machine,
+            Some(record),
+            &readings(&[
+                ("boot.a.complete_ms", 1166),
+                ("boot.usbload.panel_us", 21012),
+            ]),
+        );
+        assert_eq!(judged.over, Vec::new());
+        assert!(judged.changed);
+        assert_eq!(
+            judged.record.measured,
+            readings(&[
+                ("boot.a.complete_ms", 1166),
+                ("boot.usbload.panel_us", 21012)
+            ])
+        );
+    }
+
+    #[test]
+    fn a_record_survives_the_file_it_is_written_to() {
+        let root = toyos_tmpdir::TempDir::new("metaltimings");
+        let machine = t14("N34ET56W (1.56 )");
+        assert_eq!(Record::load(&root, &machine), Ok(None));
+        let record = recorded(
+            &machine,
+            &[("boot.a.complete_ms", 1166), ("tlb.a.p50_ns", 2258)],
+        );
+        let at = record.save(&root).expect("save");
+        assert_eq!(at, root.join("tests/metal/lenovo-20w000t9ge.toml"));
+        assert_eq!(Record::load(&root, &machine), Ok(Some(record)));
+    }
+
+    #[test]
+    fn a_machine_is_three_non_empty_lines() {
+        assert_eq!(
+            Machine::parse("LENOVO\n20W000T9GE\nN34ET56W (1.56 )\n"),
+            Ok(t14("N34ET56W (1.56 )"))
+        );
+        assert!(Machine::parse("LENOVO\n20W000T9GE\n").is_err());
+        assert!(Machine::parse("LENOVO\n\nN34ET56W (1.56 )\n").is_err());
+    }
+}
diff --git a/tests/checks.rs b/tests/checks.rs
index 183e3c17eb8..df6e8f1ed7a 100644
--- a/tests/checks.rs
+++ b/tests/checks.rs
@@ -625,8 +625,6 @@ mod checks {
         audio_checks::judges_verdict()
     }
 
-    /// `blackbox_unclaimed_page` is a registration `tests/metal-profile.toml` already prices,
-    /// so sizing and batching run for real.
     #[test]
     fn metal_list_from_parse_reaches_run_without_the_machine() -> Result<(), String> {
         let args: Vec<String> = ["--metal", "--list"].iter().map(ToString::to_string).collect();
diff --git a/tests/common/devices.rs b/tests/common/devices.rs
index 40c5a1f4e6c..48078c7ff51 100644
--- a/tests/common/devices.rs
+++ b/tests/common/devices.rs
@@ -5,13 +5,11 @@
 //! devices are emulated and every span is a fact about TCG, so what is judged
 //! there is the plumbing: each job ran, each returned a measurement rather than
 //! one of `metaldevices::Refused`'s codes, and the shutdown took the devices
-//! down in order. On the T14 the same log is judged against
-//! `tests/metal-profile.toml`, where the spans have ceilings.
+//! down in order.
 
 use std::path::Path;
 
 use toyos_build::metaldevices;
-use toyos_build::metalprofile::Profile;
 
 use super::metal;
 use super::qemu::{self, BootOptions, QemuInstance};
@@ -29,11 +27,7 @@ pub const BOOT: &str = "metaldevicecase";
 
 const WAIT: std::time::Duration = std::time::Duration::from_secs(120);
 
-/// The T14's judge: every record the inventory owes, every span against its
-/// ceiling, and the shutdown's own account of what it handed back.
 pub fn on_metal(back: &metal::Readback) -> Result<(), String> {
-    let root = super::compile::repo_root();
-    let profile = Profile::load(&root).map_err(|why| why.to_string())?;
     let mut bad = metaldevices::unmet(back.loader().text(), back.kernel().text());
 
     for job in JOBS {
@@ -47,17 +41,11 @@ pub fn on_metal(back: &metal::Readback) -> Result<(), String> {
         match measurement(job, code) {
             Err(why) => bad.push(why),
             Ok(span) => {
-                let name = format!("{job}.{}.span_us", back.label);
-                if let Err(why) = profile.judge(&name, span) {
-                    bad.push(why.to_string());
-                }
+                back.measured(&format!("{job}.{}.span_us", back.label), span);
             }
         }
     }
 
-    // Printed whatever the verdict: these are the lines whoever tightens a
-    // ceiling or writes an inventory row next has to read, and they exist only
-    // in a log that came off the machine.
     eprintln!("  [devices] what {} answered:", back.label);
     for line in metaldevices::inventory(back.kernel().text()) {
         eprintln!("    {line}");
diff --git a/tests/common/lan.rs b/tests/common/lan.rs
index 1c64312111b..d2571d4ce27 100644
--- a/tests/common/lan.rs
+++ b/tests/common/lan.rs
@@ -15,7 +15,6 @@ use toyos_build::lan::{
     READY,
 };
 use toyos_build::metaldevices;
-use toyos_build::metalprofile::Profile;
 use toyos_i219::lease::{self, Event, Verdict};
 use toyos_i219::phy::PhyRefusal;
 
@@ -23,8 +22,6 @@ use super::metal;
 use super::qemu::{self, BootOptions, QemuInstance};
 use super::serial;
 
-/// The boot config the T14 arm flashes, and the name every profile row for that
-/// boot is under.
 pub const CONFIG: &str = "tests/lancase";
 pub const BOOT: &str = "lancase";
 
@@ -104,7 +101,6 @@ pub const NIC: &str = "0000:00:1f.6";
 
 /// The T14's judge: the claim, the card, the lease, and the host's own ping.
 pub fn on_metal(back: &metal::Readback) -> Result<(), String> {
-    let profile = Profile::load(&super::compile::repo_root()).map_err(|why| why.to_string())?;
     let kernel = back.kernel();
     let text = kernel.text();
     let mut bad: Vec<String> = Vec::new();
@@ -151,9 +147,7 @@ pub fn on_metal(back: &metal::Readback) -> Result<(), String> {
     match link_up_ms(&netd) {
         Ok(ms) => {
             eprintln!("  [lan] the link came up {ms} ms after the driver did");
-            if let Err(why) = profile.judge(&format!("lan.{}.link_up_ms", back.label), ms) {
-                bad.push(why.to_string());
-            }
+            back.measured(&format!("lan.{}.link_up_ms", back.label), ms);
         }
         Err(why) => bad.push(why),
     }
@@ -164,9 +158,7 @@ pub fn on_metal(back: &metal::Readback) -> Result<(), String> {
                 "  [lan] leased {}/{} from {} in {} ms, gateway {}, dns {:?}",
                 lease.address, lease.prefix, lease.server, lease.ms, lease.gateway, lease.dns
             );
-            if let Err(why) = profile.judge(&format!("lan.{}.lease_ms", back.label), lease.ms) {
-                bad.push(why.to_string());
-            }
+            back.measured(&format!("lan.{}.lease_ms", back.label), lease.ms);
             if lease.address != cable.addr {
                 bad.push(format!(
                     "this boot leased {} and the host pinged {}, which the router hands this \
@@ -185,17 +177,8 @@ pub fn on_metal(back: &metal::Readback) -> Result<(), String> {
                 "  [lan] {} answered the host's ping {} s into the window",
                 cable.addr, reply.secs
             );
-            // The bracket first: a reply from the operating system on the other
-            // side of the reset is not this boot's reading, and a ceiling may
-            // only be tightened against a reading this boot answered.
             match bootlog::host_second_inside_this_boot(log.text(), cable.skew, LEASE, reply.at) {
-                Ok(()) => {
-                    if let Err(why) =
-                        profile.judge(&format!("boot.{}.ping_secs", back.label), reply.secs)
-                    {
-                        bad.push(why.to_string());
-                    }
-                }
+                Ok(()) => back.measured(&format!("boot.{}.ping_secs", back.label), reply.secs),
                 Err(why) => bad.push(why),
             }
         }
diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 99144fafbfb..a80ae944c93 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -13,23 +13,21 @@
 //! something an arm names rather than something derived, because sharing is not
 //! always safe and only the author knows.
 
+use std::cell::RefCell;
 use std::collections::{BTreeMap, BTreeSet};
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
 use toyos_build::bootlog;
 use toyos_build::metalimage;
-use toyos_build::metalprofile::{job_ms_row, Profile, AROUND_THE_LIST_MS};
+use toyos_build::metaltimings::{self, Machine, Record};
 use toyos_build::testargs::MetalMode;
 
 use super::serial::Serial;
 
-/// The fields only the boots that took that path produce: the two bounds'
-/// lateness, and the stop's own count. Absent **and** unpriced is a boot that
-/// did not take the path and owes nothing; absent and priced is a boot armed
-/// for one path that ended on another, which is a red the pricing loop names.
-const PATH_TAKEN: &[&str] =
-    &["deadline_lateness_ms", "lockup_lateness_ms", "park_open_operations"];
+/// Produced only by a boot that took that bound's path: absent where the
+/// machine's record holds one is a boot another bound ended.
+const PATH_TAKEN: &[&str] = &["deadline_lateness_ms", "lockup_lateness_ms"];
 
 /// One boot a metal test needs.
 pub struct Arm {
@@ -43,9 +41,6 @@ pub struct Arm {
     /// `create_dir` on that boot is refused with `OutOfMemory` and it panics —
     /// which is why each has a boot of its own in QEMU too. A test that must
     /// not share names its own; it costs a minute and it says so.
-    ///
-    /// It is also the label: the image directory, the readback directory and
-    /// every `tests/metal-profile.toml` row for that boot are named after it.
     pub boot: &'static str,
     /// The boot config's directory, relative to the repository root.
     pub config: &'static str,
@@ -111,9 +106,7 @@ pub const fn once(
 /// The list is **sized to the bound before it is flashed** ([`sized`]): the
 /// runner's deadline runs from boot and ends the whole list, so a list longer
 /// than the bound is a boot whose tail members never run and are reported as
-/// missing records rather than as the boot being too long. A boot named here
-/// may therefore become several, `<boot>`, `<boot>-2`, …, and each is a row in
-/// `tests/metal-profile.toml` like any other.
+/// missing records rather than as the boot being too long.
 ///
 /// A chunk rides one flash. A member that takes the machine down takes every
 /// member after it *in its chunk* with it, and that is the honest price: on the
@@ -125,6 +118,9 @@ pub struct SharedBoot {
     pub params: &'static [&'static str],
     /// The kernel build, empty for the one an image ships.
     pub features: &'static [&'static str],
+    /// At most this many members ride one flash, and the list is cut into
+    /// `<boot>`, `<boot>-2`, … to fit.
+    pub members: usize,
     /// What the runner spawns, in order — the whole binary name, `test_rs_`
     /// prefix and all, because that is what the kernel records it under.
     pub jobs: Vec<String>,
@@ -146,9 +142,6 @@ fn chunk_name(boot: &str, index: usize) -> String {
     }
 }
 
-/// Cut every shared boot's list to what the bound and the profile's allowance
-/// leave room for.
-///
 /// **A list nothing sized loses its tail without saying so.** The runner's
 /// bound ends the whole list rather than the job it is inside, so every member
 /// past the cut is reported as a missing exit record.
@@ -156,21 +149,10 @@ fn chunk_name(boot: &str, index: usize) -> String {
 /// **A chunk carries only the files and links its own members name.** The C
 /// corpus stages a binary and an expectation per case; putting all of both on
 /// every chunk would double a flash that is already written over `ssh`.
-fn sized(shared: &[SharedBoot], profile: &Profile) -> Result<Vec<SharedBoot>, String> {
+fn sized(shared: &[SharedBoot]) -> Vec<SharedBoot> {
     let mut out = Vec::new();
     for boot in shared {
-        if boot.jobs.is_empty() {
-            continue;
-        }
-        let per = profile.members_per_boot(&boot.boot).map_err(|why| {
-            format!(
-                "the shared boot {:?} has {} member(s) and none of them is priced, so the list \
-                 cannot be cut to the runner's bound and would lose its tail: {why}",
-                boot.boot,
-                boot.jobs.len()
-            )
-        })?;
-        for (index, jobs) in boot.jobs.chunks(per).enumerate() {
+        for (index, jobs) in boot.jobs.chunks(boot.members).enumerate() {
             let named: BTreeSet<&str> = jobs.iter().map(String::as_str).collect();
             let mine = |path: &str| {
                 let last = path.rsplit('/').next().unwrap_or(path);
@@ -182,6 +164,7 @@ fn sized(shared: &[SharedBoot], profile: &Profile) -> Result<Vec<SharedBoot>, St
                 config: boot.config,
                 params: boot.params,
                 features: boot.features,
+                members: boot.members,
                 jobs: jobs.to_vec(),
                 files: boot
                     .files
@@ -193,7 +176,7 @@ fn sized(shared: &[SharedBoot], profile: &Profile) -> Result<Vec<SharedBoot>, St
             });
         }
     }
-    Ok(out)
+    out
 }
 
 /// Whether a registration runs on the T14, and how.
@@ -234,6 +217,10 @@ pub struct Readback {
     /// operating systems, and `None` on every boot that named no function to
     /// ask over.
     pub cable: Option<toyos_build::metal::Cable>,
+    /// The machine the loop read before the flash.
+    pub machine: Result<Machine, String>,
+    /// What this boot's judges measured, for the machine's record to judge.
+    numbers: RefCell<BTreeMap<String, u64>>,
 }
 
 impl Readback {
@@ -381,22 +368,20 @@ impl Readback {
         toyos_build::metal::park(self.after_the_reset().ok()?.text())
     }
 
-    /// Block-device operations still open where this boot's stop ended.
-    /// `None` on a boot that reset without going through `quiesce`. It is the
-    /// block layer's own count, so it is what the stop can be wrong against.
-    pub fn park_open_operations(&self) -> Option<u64> {
-        self.stop_record().map(|park| u64::from(park.in_flight))
-    }
-
     /// Whether the stop stopped the machine, as against how long it spent
-    /// trying.
-    ///
-    /// **No ceiling can ask this.** A stop that gave up returns having spent
-    /// its budget and no more, and `park_open_operations` then reads whatever
-    /// the threads it left running happened to be doing. The shortfall the
-    /// record names is the only thing that says the machine was not stopped.
+    /// trying, and left no block operation open: an operation lasts only while
+    /// its opener is inside the device, so an open one is a sync claiming
+    /// something about a machine that was still writing. A boot that handed the
+    /// machine back went through the stop and owes its record.
     pub fn stop_completed(&self) -> Result<(), String> {
+        let handed_back =
+            self.after_the_reset().is_ok_and(|after| after.text().contains(bootlog::HANDED_BACK));
         match self.stop_record() {
+            None if handed_back => Err(format!(
+                "{} handed the machine back and its page carries no record of the stop",
+                self.label
+            )),
+            None => Ok(()),
             Some(park) if !park.stopped_the_machine() => Err(format!(
                 "{}'s stop gave up on {} userland thread(s) that never reached a safe point, so \
                  this boot's sync and its last word are claims about a machine that was still \
@@ -404,7 +389,11 @@ impl Readback {
                 self.label,
                 park.sweep.running,
             )),
-            _ => Ok(()),
+            Some(park) if park.in_flight != 0 => Err(format!(
+                "{}'s stop ended with {} block operation(s) open:\n    {park}",
+                self.label, park.in_flight,
+            )),
+            Some(_) => Ok(()),
         }
     }
 
@@ -473,24 +462,10 @@ impl Readback {
             })
     }
 
-    /// One number this boot measured, against the ceiling
-    /// `tests/metal-profile.toml` holds for it.
-    ///
-    /// **The gate fails closed on a name with no row**, which is the profile's
-    /// own rule: a measurement nobody has priced must not pass by having no
-    /// ceiling. The file is read once and kept, because every judge that asks
-    /// asks inside one process and [`run`] has already read it to judge the
-    /// boots.
-    pub fn number(&self, name: &str, value: u64) -> Result<(), String> {
-        static PROFILE: std::sync::OnceLock<Result<Profile, String>> = std::sync::OnceLock::new();
-        PROFILE
-            .get_or_init(|| {
-                Profile::load(&super::compile::repo_root()).map_err(|why| why.to_string())
-            })
-            .as_ref()
-            .map_err(Clone::clone)?
-            .judge(name, value)
-            .map_err(|why| why.to_string())
+    /// One number this boot measured, judged by [`run`] against this machine's
+    /// record once every judge has spoken.
+    pub fn measured(&self, name: &str, value: u64) {
+        self.numbers.borrow_mut().insert(name.to_string(), value);
     }
 
     /// The job ran and the kernel recorded it exiting cleanly.
@@ -569,7 +544,6 @@ fn at(dir: &Path, label: &str) -> PathBuf {
 fn batches(
     tests: &[(&str, &'static Metal)],
     shared: &[SharedBoot],
-    profile: &Profile,
 ) -> Result<BTreeMap<String, Batch>, String> {
     let mut out: BTreeMap<String, Batch> = BTreeMap::new();
     // First, so a registration naming a shared boot rides it rather than
@@ -637,32 +611,6 @@ fn batches(
             batch.add(arm.jobs.iter().map(|j| (*j).to_string()));
         }
     }
-    // **Every boot, and the shared ones have already been cut to fit.** An
-    // authored arm is refused rather than cut: the order of an arm's jobs is
-    // the author's, and only the author knows where one may be broken in two —
-    // `Arm::boot`'s own doc is that argument.
-    for (label, batch) in &out {
-        let row = job_ms_row(label);
-        let Some(priced) = profile.row(&row) else {
-            return Err(format!(
-                "the boot {label:?} runs {} job(s) and {row} prices none of them; a list nobody \
-                 has priced cannot be sized to the runner's bound",
-                batch.jobs.len()
-            ));
-        };
-        let per = toyos_build::metalprofile::members_per_boot(priced.ceiling);
-        if batch.jobs.len() > per {
-            return Err(format!(
-                "the boot {label:?} carries {} job(s) and {row} leaves room for {per} of them \
-                 ({} ms each inside {} ms, less the {AROUND_THE_LIST_MS} ms the boot around the \
-                 list costs). The runner's bound ends the whole list, so the members past that \
-                 would never run — split this boot's arms across two named boots",
-                batch.jobs.len(),
-                priced.ceiling,
-                toyos_tco::JOB_BOUND_MS,
-            ));
-        }
-    }
     Ok(out)
 }
 
@@ -887,9 +835,28 @@ fn read_readback(dir: &Path, label: &str) -> Result<Readback, String> {
         back_secs,
         stick_secs,
         cable,
+        machine: toyos_build::metal::machine(&boot)
+            .map_err(|why| format!("{label}'s boot file {why}")),
+        numbers: RefCell::new(BTreeMap::new()),
     })
 }
 
+/// The machine every boot that came back names, or why there is not one.
+fn one_machine(readbacks: &BTreeMap<String, Result<Readback, String>>) -> Result<Machine, String> {
+    let mut named: Option<Machine> = None;
+    for back in readbacks.values().filter_map(|back| back.as_ref().ok()) {
+        let machine = back.machine.clone()?;
+        match &named {
+            Some(first) if *first != machine => {
+                return Err(format!("one run names two machines: {first:?} and {machine:?}"))
+            }
+            Some(_) => {}
+            None => named = Some(machine),
+        }
+    }
+    named.ok_or_else(|| "no boot came back to name the machine".to_string())
+}
+
 /// What a metal run established.
 #[derive(Clone, Copy, PartialEq, Eq, Debug)]
 pub enum Verdict {
@@ -920,24 +887,11 @@ pub fn run(
     quiet: bool,
 ) -> Verdict {
     let root = super::compile::repo_root();
-    let profile = match Profile::load(&root) {
-        Ok(profile) => profile,
-        Err(why) => {
-            eprintln!("[metal] {why}");
-            return Verdict::Red;
-        }
-    };
     // Before anything is batched: what rides one flash is what the runner's
     // bound leaves room for, and a boot named once here can be several.
-    let shared = match sized(shared, &profile) {
-        Ok(shared) => shared,
-        Err(why) => {
-            eprintln!("[metal] {why}");
-            return Verdict::Red;
-        }
-    };
+    let shared = sized(shared);
     let shared = shared.as_slice();
-    let batches = match batches(tests, shared, &profile) {
+    let batches = match batches(tests, shared) {
         Ok(batches) => batches,
         Err(why) => {
             eprintln!("[metal] {why}");
@@ -1099,6 +1053,14 @@ pub fn run(
         };
         readbacks.insert(label.clone(), back);
     }
+    // **One machine a run, and its record judges every number the run took.**
+    let machine = one_machine(&readbacks);
+    let record =
+        machine.as_ref().map_err(Clone::clone).and_then(|machine| Record::load(&root, machine));
+    let recorded = |name: &str| match (&machine, &record) {
+        (Ok(machine), Ok(Some(record))) => record.get(machine, name).is_some(),
+        _ => false,
+    };
 
     let mut red = false;
     eprintln!("\n[metal] the boots");
@@ -1116,16 +1078,12 @@ pub fn run(
                     back.back_secs, back.stick_secs
                 );
                 let panel = back.panel();
-                // Evidence beside the two numbers that are priced: what a
-                // reader needs to tell a slower paint from more of them.
                 if let Some(panel) = panel {
                     eprintln!(
                         "    the panel painted {} time(s) and put {} px on the glass",
                         panel.paints, panel.pixels
                     );
                 }
-                // A boot the file prices a path-taken field for and that
-                // produced none is a boot some *other* bound ended.
                 for (field, value) in [
                     ("complete_ms", back.boot_ms),
                     ("back_secs", Some(back.back_secs)),
@@ -1134,25 +1092,23 @@ pub fn run(
                     ("lockup_lateness_ms", back.lockup_lateness_ms()),
                     ("panel_max_us", panel.map(|panel| panel.max_micros)),
                     ("panel_us", panel.map(|panel| panel.micros)),
-                    ("park_open_operations", back.park_open_operations()),
                 ] {
                     let name = format!("boot.{label}.{field}");
-                    let priced = profile.row(&name).is_some();
-                    if value.is_none() && !priced && PATH_TAKEN.contains(&field) {
-                        continue;
-                    }
-                    let Some(value) = value else {
-                        eprintln!(
-                            "    FAIL {name}: this boot recorded none, and the profile prices \
-                             it — so the bound this boot was armed for is not the one that \
-                             ended it"
-                        );
-                        red = true;
-                        continue;
-                    };
-                    if let Err(why) = profile.judge(&name, value) {
-                        eprintln!("    FAIL {why}");
-                        red = true;
+                    match value {
+                        Some(value) => back.measured(&name, value),
+                        None if !PATH_TAKEN.contains(&field) => {
+                            eprintln!("    FAIL {name}: this boot recorded none");
+                            red = true;
+                        }
+                        None if recorded(&name) => {
+                            eprintln!(
+                                "    FAIL {name}: this boot recorded none, and this machine \
+                                 recorded one before — so the bound this boot was armed for is \
+                                 not the one that ended it"
+                            );
+                            red = true;
+                        }
+                        None => {}
                     }
                 }
                 // **Every boot, and before any verdict is read out of its
@@ -1226,20 +1182,57 @@ pub fn run(
                 }
             }
         }
-        // **What a member of this list actually cost, against the allowance the
-        // split was derived from.** Over the members that ran and not the
-        // members the list named: a boot the bound cut short would otherwise
-        // report a cost that looks smaller the more of its list it lost.
+        // **What a member of this list actually cost.** Over the members that
+        // ran and not the members the list named: a boot the bound cut short
+        // would otherwise report a cost that looks smaller the more of its list
+        // it lost.
         if let (Ok(back), true) = (back, ran > 0) {
             if let (Some(complete), Some(last)) = (back.boot_ms, back.last_record_ms()) {
                 let each = last.saturating_sub(complete) / ran as u64;
                 eprintln!("  {} ms per member over the {ran} that ran", each);
-                if let Err(why) = profile.judge(&job_ms_row(&boot.boot), each) {
-                    eprintln!("    FAIL {why}");
-                    red = true;
+                back.measured(&format!("list.{}.job_ms", boot.boot), each);
+            }
+        }
+    }
+    eprintln!("\n[metal] the timings");
+    let measured: BTreeMap<String, u64> = readbacks
+        .values()
+        .filter_map(|back| back.as_ref().ok())
+        .flat_map(|back| back.numbers.borrow().clone())
+        .collect();
+    match (machine, record) {
+        (Ok(machine), Ok(record)) => {
+            let judged = metaltimings::judge(&machine, record, &measured);
+            for over in &judged.over {
+                eprintln!("  FAIL {over}");
+                red = true;
+            }
+            eprintln!(
+                "  {} number(s) on {} {}, BIOS {}; {} past its record",
+                measured.len(),
+                machine.vendor,
+                machine.product,
+                machine.bios,
+                judged.over.len()
+            );
+            if judged.changed {
+                match judged.record.save(&root) {
+                    Ok(at) => eprintln!(
+                        "  {} now records {} number(s) for this machine: commit it",
+                        at.display(),
+                        judged.record.measured.len()
+                    ),
+                    Err(why) => {
+                        eprintln!("  FAIL {why}");
+                        red = true;
+                    }
                 }
             }
         }
+        (Err(why), _) | (_, Err(why)) => {
+            eprintln!("  FAIL {} number(s) and no record to judge them by: {why}", measured.len());
+            red = true;
+        }
     }
     eprintln!(
         "\n[metal] {passed} passed, {} failed, {} boot(s)",
diff --git a/tests/common/power.rs b/tests/common/power.rs
index 7b16b9f3a93..4d376d0238d 100644
--- a/tests/common/power.rs
+++ b/tests/common/power.rs
@@ -2377,8 +2377,7 @@ fn sealed_state(qemu: &mut QemuInstance, within: Duration) -> Result<(State, Vec
 /// **The re-enumeration, taken off the boot after the reset.** Under QEMU it is
 /// weak on purpose: an emulated stick cannot be wedged, so this arm judges that
 /// the account is produced and that the machine still comes up on the same
-/// device. The T14 is the judge of the device itself, and `tests/metal-profile`
-/// carries its row.
+/// device.
 const STICK_ENUMERATED: &str = "usb-storage: 1 device(s)";
 
 /// Every way this kernel resets a machine, and the account each one leaves.
diff --git a/tests/metal-profile.toml b/tests/metal-profile.toml
deleted file mode 100644
index 8118a7fd0fc..00000000000
--- a/tests/metal-profile.toml
+++ /dev/null
@@ -1,1439 +0,0 @@
-# Every number the metal suite measures on the T14, with the ceiling past which
-# it is a red. `src/metalprofile.rs` is the reader and the grammar; a number the
-# suite measures and this file does not price is refused, not passed.
-#
-# `ceiling_from` says where the ceiling came from, and a row naming a constant
-# this repository declares is held to that constant's value by
-# `metalprofile::tests::a_ceiling_that_names_a_constant_carries_it`. A ceiling
-# derived from a constant is the widest true bound there is before the machine
-# has been read once, and a ceiling that had to be widened to pass is a finding
-# rather than an edit.
-#
-# `measured` is the reading the T14 gave the boot the row names, off that boot's
-# own readback. It is what a later author tightens a ceiling against and it is
-# never the gate; a row with no `measured` is a boot no run has taken yet.
-#
-# One row per number, named `<what>.<boot>.<field>`. The boot names are the ones
-# `METAL`'s arms give them in `tests/toyos.rs`: one image, one flash, one minute
-# of the machine.
-
-# --- the boot's own duration, out of the kernel's `Boot: complete (Nms)` ---
-# Nothing bounds the span before userland but the test runner's own deadline,
-# which is measured from boot and ends a boot whose job list has not finished:
-# a `Boot: complete` later than that is a boot the runner already reset.
-
-[[number]]
-name = "boot.testcases.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — the runner's deadline runs from boot, so a later `Boot: complete` is a boot already reset"
-measured = 1199
-
-[[number]]
-name = "boot.testcases-mkdir.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1200
-
-[[number]]
-name = "boot.testcases-readdir.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1256
-
-[[number]]
-name = "boot.testcases-watchdog.complete_ms"
-unit = "ms"
-ceiling = 9600
-ceiling_from = "toyos_tco::BOUND_MS — this image arms the chipset watchdog at the handoff, so the whole boot runs under it"
-measured = 1259
-
-[[number]]
-name = "boot.jobcase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1213
-
-[[number]]
-name = "boot.metalcase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1199
-
-# --- what the machine spent coming back, on the host's clock ---
-# The loop already refuses past this; the row exists so the number is read and
-# recorded rather than only bounded, and so a return that doubled is a red
-# before it is a hang.
-
-[[number]]
-name = "boot.testcases.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs — the longest watchdog a boot runs under plus what coming back costs"
-measured = 48
-
-[[number]]
-name = "boot.testcases-mkdir.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 46
-
-[[number]]
-name = "boot.testcases-readdir.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 49
-
-[[number]]
-name = "boot.testcases-watchdog.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 46
-
-[[number]]
-name = "boot.jobcase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 41
-
-[[number]]
-name = "boot.metalcase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 51
-
-[[number]]
-name = "boot.latencycase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1258
-
-[[number]]
-name = "boot.latencycase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 46
-
-# --- what this machine's scheduler costs a waiter, and what one machine-wide
-# --- TLB shootdown costs its initiator
-# `latency.p99_us` is bounded by the instrument: past its last bucket the figure
-# is a floor and not a measurement, which is a red whatever the machine did. The
-# two shootdown rows are bounded by the reading, half again — the margin this
-# file uses everywhere a first reading becomes a ceiling — because
-# `time::DEAF_CPU` is two million times the reading and a ceiling nothing
-# can reach is a row that cannot red.
-
-[[number]]
-name = "latency.p99_us"
-unit = "us"
-ceiling = 4095
-ceiling_from = "cyclictest's histogram is 4096 buckets of 1 us, so a p99 in its last bucket is a floor and not a measurement"
-measured = 16
-
-[[number]]
-name = "tlb.latencycase.p50_ns"
-unit = "ns"
-ceiling = 3387
-ceiling_from = "2,258 ns measured, and half again — 50 % over one machine's one reading, which is what this file gives every ceiling derived from a first one. `kernel time::DEAF_CPU` is 5 s and panics the machine; it bounds the wait and is not a ceiling this row could ever red on"
-measured = 2258
-
-[[number]]
-name = "tlb.latencycase.p99_ns"
-unit = "ns"
-ceiling = 4397
-ceiling_from = "2,931 ns measured, and half again — as tlb.latencycase.p50_ns. The tail and not the median, so what widens it is a shootdown that waited on one slow acknowledger rather than the machine getting slower everywhere"
-measured = 2931
-# --- the device boot, and every span `userland/metalprobe` measures on it ---
-# Each job exits with its span in microseconds and the kernel's `exit:` record
-# carries it; `src/metaldevices.rs` names the negative codes that are refusals
-# rather than numbers. A span and not a rate, because a ceiling is what this
-# file can express and a rate would have to be judged from below.
-#
-# Every ceiling here is the same derivation: `metalprobe`'s own `SHARE_PERCENT`
-# of `toyos_tco::JOB_BOUND_MS` is what its payload is sized against, and one job
-# may not outlast its share without putting the runner's reset inside a
-# transfer, which is what leaves a stick the next host cannot enumerate.
-
-[[number]]
-name = "boot.metaldevicecase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1255
-
-[[number]]
-name = "boot.metaldevicecase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 65
-
-[[number]]
-name = "usbwrite.metaldevicecase.span_us"
-unit = "us"
-ceiling = 4800000
-ceiling_from = "metalprobe's SHARE_PERCENT of toyos_tco::JOB_BOUND_MS — the share its payload is sized against, and the widest true bound before the machine has answered once"
-
-[[number]]
-name = "usbread.metaldevicecase.span_us"
-unit = "us"
-ceiling = 4800000
-ceiling_from = "as usbwrite.metaldevicecase.span_us"
-
-[[number]]
-name = "fbcheck.metaldevicecase.span_us"
-unit = "us"
-ceiling = 4800000
-ceiling_from = "as usbwrite.metaldevicecase.span_us — one whole-scanout write and one whole-scanout readback"
-
-[[number]]
-name = "fbfill.metaldevicecase.span_us"
-unit = "us"
-ceiling = 4800000
-ceiling_from = "as usbwrite.metaldevicecase.span_us — metalprobe's FILL_PASSES whole-scanout fills"
-
-[[number]]
-name = "fbread.metaldevicecase.span_us"
-unit = "us"
-ceiling = 4800000
-ceiling_from = "as usbwrite.metaldevicecase.span_us — metalprobe's READ_PASSES whole-scanout readbacks, the direction that misses every cache"
-
-# --- the self-test boot, and the shared block's two ---
-
-[[number]]
-name = "boot.selftests.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1267
-
-[[number]]
-name = "boot.selftests.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 44
-
-[[number]]
-name = "boot.shared.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-
-[[number]]
-name = "boot.shared.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-
-[[number]]
-name = "boot.shared-debug.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1210
-
-[[number]]
-name = "boot.shared-debug.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 61
-
-[[number]]
-name = "boot.ccorpus.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1200
-
-[[number]]
-name = "boot.ccorpus.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 95
-
-# --- the boot stick, after the boot ---
-# **The only judge of the device there is.** QEMU cannot wedge a stick, and a
-# wedged one shows as the log partition's device node missing after the machine
-# comes back. So the loop waits for that node by name and records what it
-# waited, per boot.
-
-[[number]]
-name = "boot.testcases.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "toyos_build::metal::STICK_SECS — ten times the three seconds Ubuntu's own enumeration spends giving up on a wedged stick (run 18's journal)"
-measured = 0
-
-[[number]]
-name = "boot.testcases-mkdir.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-[[number]]
-name = "boot.testcases-readdir.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-[[number]]
-name = "boot.testcases-watchdog.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-[[number]]
-name = "boot.jobcase.stick_secs"
-unit = "s"
-ceiling = 5
-ceiling_from = "the machine has answered: 0 s on run 20, at the driver's 1 s poll. Five is what one round of Linux's own enumeration retries would cost — run 18's journal spent three seconds on four addressing attempts and a port power cycle before it gave up — so a reading over it is a stick that needed rescuing rather than one that was simply there"
-measured = 0
-
-[[number]]
-name = "boot.metalcase.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-[[number]]
-name = "boot.latencycase.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-[[number]]
-name = "boot.metaldevicecase.stick_secs"
-unit = "s"
-ceiling = 5
-ceiling_from = "as boot.jobcase.stick_secs, and this is the boot that reads it hardest: it writes, fsyncs and reads back megabytes before the reset, which is the shape a stop that cut a transfer would leave unenumerable"
-measured = 0
-
-[[number]]
-name = "boot.selftests.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-[[number]]
-name = "boot.shared.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-
-[[number]]
-name = "boot.shared-debug.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-[[number]]
-name = "boot.ccorpus.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-[[number]]
-name = "boot.foreignrecord.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1254
-
-[[number]]
-name = "boot.logstallcase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "as boot.foreignrecord.complete_ms"
-
-[[number]]
-name = "boot.testcases-deaf.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "as boot.foreignrecord.complete_ms"
-
-[[number]]
-name = "boot.testcases-window.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "as boot.foreignrecord.complete_ms"
-
-[[number]]
-name = "boot.testcases-debug.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "as boot.foreignrecord.complete_ms"
-
-[[number]]
-name = "boot.foreignrecord.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 44
-
-[[number]]
-name = "boot.logstallcase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "as boot.foreignrecord.back_secs"
-
-[[number]]
-name = "boot.testcases-deaf.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "as boot.foreignrecord.back_secs"
-
-[[number]]
-name = "boot.testcases-window.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "as boot.foreignrecord.back_secs"
-
-[[number]]
-name = "boot.testcases-debug.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "as boot.foreignrecord.back_secs"
-
-[[number]]
-name = "boot.foreignrecord.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-# --- the boot that stops itself on purpose ---
-# `deadlinewedge` is the only boot here whose verdict is not `Rebooting.`: every
-# CPU stops taking scheduler passes at the shutdown syscall and the kernel's own
-# `boot-deadline` is what ends it. Its three ordinary numbers are priced against
-# that bound rather than against the runner's, because the runner never reaches
-# its own.
-
-[[number]]
-name = "boot.logstallcase.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-
-[[number]]
-name = "boot.testcases-deaf.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-
-[[number]]
-name = "boot.testcases-window.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-
-[[number]]
-name = "boot.testcases-debug.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-
-[[number]]
-name = "boot.deadlinewedge.complete_ms"
-unit = "ms"
-ceiling = 120000
-ceiling_from = "toyos_tco::WEDGE_BOUND_MS — on this boot the kernel's own deadline is what runs from boot, so a later `Boot: complete` is a boot the deadline already reset"
-measured = 1254
-
-[[number]]
-name = "boot.deadlinewedge.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs — which now derives from WEDGE_BOUND_MS, the longest watchdog a boot runs under, plus what coming back costs"
-measured = 231
-
-[[number]]
-name = "boot.deadlinewedge.stick_secs"
-unit = "s"
-ceiling = 5
-ceiling_from = "as boot.jobcase.stick_secs. It is the number this boot owes most: the deadline resets a machine whose USB was stopped by registers alone, and a stick the next host cannot enumerate is what `xhci::stop::before_reset` exists to prevent"
-measured = 0
-
-# --- and the one number only this boot measures ---
-# How far past its bound the deadline actually fired. The bound is a parameter;
-# the expiry is what the poll reached on a machine where every CPU was spinning
-# with preemption disabled, so the difference is what that poll costs in the
-# state it exists for.
-
-[[number]]
-name = "boot.deadlinewedge.deadline_lateness_ms"
-unit = "ms"
-ceiling = 10000
-ceiling_from = "the poll's own cadence: the deadline is read on every timer interrupt and an idle CPU re-arms its LAPIC one-shot per fire, so the lateness is one timer period. That period has not been measured on this machine, and ten seconds — a twelfth of the bound — is the widest true bound before it has been"
-measured = 60
-
-# --- the boot one CPU stops answering on ---
-# `hardlockup` is the deaf half of the boot above: the same staged wedge, and
-# then one CPU with `IF` clear spinning on a lock another holds and never gives
-# back. The boot deadline's poll cannot see it — nothing on that CPU runs to
-# poll anything — so what ends this machine is that CPU's own performance-counter
-# NMI, and the page it seals names the CPU rather than only the bound. Priced
-# against the earlier of the two bounds, which is the one this boot runs under.
-
-[[number]]
-name = "boot.hardlockup.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::HARD_LOCKUP_BOUND_MS — half the deadline and the earlier bound, so a later `Boot: complete` is a boot the detector already reset"
-measured = 1206
-
-[[number]]
-name = "boot.hardlockup.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "as boot.deadlinewedge.back_secs, toyos_build::metal::return_secs. It is the same wait: this boot ends itself half a bound earlier and then costs the same firmware, loader and Ubuntu as any other"
-measured = 170
-
-[[number]]
-name = "boot.hardlockup.stick_secs"
-unit = "s"
-ceiling = 5
-ceiling_from = "as boot.deadlinewedge.stick_secs. The reset is written from inside an NMI on a CPU that holds a lock, and `xhci::stop::before_reset` runs there like anywhere else — a stick the next host cannot enumerate is what that would have cost"
-measured = 0
-
-# --- and the one number only this boot measures ---
-# How far past its bound the counter's sample was when it found the CPU stuck.
-# Not the row above's number: what bounds this one is the detector's own sample
-# period, not the timer's.
-
-[[number]]
-name = "boot.hardlockup.lockup_lateness_ms"
-unit = "ms"
-ceiling = 2000
-ceiling_from = "twice the sample period `kernel/src/hardlockup`'s SAMPLE_NS states, 1000 ms: a CPU is found stuck at the first sample after its bound, so one period is the lateness and a second is the widest a delayed one costs"
-measured = 0
-
-# --- the boot that is never idle ---
-# `usbload` stops no CPU. It sweeps the last eighth of the stick once, reading
-# each run and writing it back, until the deadline takes the machine out from
-# under it — so the reset lands on a controller that is moving bytes rather than
-# on one idle for two minutes. `stick_secs` is the bench's own answer about its
-# own stick.
-
-[[number]]
-name = "boot.usbload.complete_ms"
-unit = "ms"
-ceiling = 120000
-ceiling_from = "as boot.deadlinewedge.complete_ms, toyos_tco::WEDGE_BOUND_MS — the same bound ends this machine and the runner never reaches its own. Not toyos_tco::HARD_LOCKUP_BOUND_MS, which is half of it: the sweep keeps its CPU taking interrupts so that this bound and not that one is what ends the boot, and the judge refuses a page that names the other"
-measured = 1204
-
-[[number]]
-name = "boot.usbload.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "as boot.deadlinewedge.back_secs, toyos_build::metal::return_secs — this boot ends itself at the same bound and then costs the same firmware, loader and Ubuntu as any other"
-measured = 219
-
-[[number]]
-name = "boot.usbload.stick_secs"
-unit = "s"
-ceiling = 5
-ceiling_from = "as boot.deadlinewedge.stick_secs. On this arm the reset is written while the controller is mid-transfer, which is the state a stick the next host cannot enumerate would be left by"
-measured = 0
-
-[[number]]
-name = "boot.usbload.deadline_lateness_ms"
-unit = "ms"
-ceiling = 10000
-ceiling_from = "as boot.deadlinewedge.deadline_lateness_ms — the poll's own cadence, read on every timer interrupt, so the lateness is one timer period whichever CPU reaches the bound first"
-measured = 66
-
-# --- the boot whose stick has one transfer abandoned under it ---
-# `usbbreak` is `jobcase` with the first WRITE(10) the boot stick takes abandoned
-# mid-flight, so the class's Reset Recovery runs against the bench's own device
-# on the bench's own controller. A recovery that takes ends like `jobcase`, by
-# its deliberate reboot; one that does not takes the root offline, and what then
-# ends the boot is the runner's bound. `stick_secs` is the row that says what
-# either left the stick in.
-
-[[number]]
-name = "boot.usbbreak.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-
-[[number]]
-name = "boot.usbbreak.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-
-[[number]]
-name = "boot.usbbreak.stick_secs"
-unit = "s"
-ceiling = 5
-ceiling_from = "as boot.jobcase.stick_secs. On this arm the stick was sent a Bulk-Only Mass Storage Reset while it may still have been inside a WRITE(10), and then either came back or was left at its Default state by a port reset"
-
-# --- what one member of a job list may cost this machine ---
-# **The number the suite sizes its lists by, and judges them against.** The
-# runner's bound (`toyos_tco::JOB_BOUND_MS`) runs from boot and ends the whole
-# list, not the job it is inside, so a list longer than the bound is a boot
-# whose tail members never run — reported as missing records rather than as a
-# list nobody sized. `tests/common/metal.rs` derives how many members one boot
-# may carry from the ceiling here, and then holds the boot to the same number:
-# a list is cut to what its members are priced at, and members slower than their
-# price red by name.
-#
-# Every reading below is the interval between successive `spawn: /system/bin/…`
-# records on that boot's own log.
-
-[[number]]
-name = "list.shared.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "845 ms measured (25 members spawned between 1.943 s and 23.066 s on run 24's `shared`), and a ceiling above the widest single member on that boot — test_rs_abuse_elf_loader at 1,358 ms — so one heavy member cannot put the mean over it"
-measured = 845
-
-[[number]]
-name = "list.shared-2.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.shared.job_ms — the same list, cut in two"
-
-[[number]]
-name = "list.shared-debug.job_ms"
-unit = "ms"
-ceiling = 2900
-ceiling_from = "1,926 ms measured (8 members between 2.624 s and 18.032 s on run 24's `shared-debug`), and half again: these are the eight binaries that re-execute themselves once per fault, and handle_kill_policy alone spawned 42 children"
-measured = 1926
-
-[[number]]
-name = "list.ccorpus.job_ms"
-unit = "ms"
-ceiling = 600
-ceiling_from = "396 ms measured (118 cases between 2.625 s and the reboot job at 49.366 s on run 24's `ccorpus`), and half again. That boot was green at 49.5 s of a 60 s bound — 82 % of it, with no margin for a slower stick — which is why the same rule cuts a list that passed"
-measured = 396
-
-[[number]]
-name = "list.ccorpus-2.job_ms"
-unit = "ms"
-ceiling = 600
-ceiling_from = "as list.ccorpus.job_ms — the same corpus, cut in two"
-
-[[number]]
-name = "list.metaldevicecase.job_ms"
-unit = "ms"
-ceiling = 4800
-ceiling_from = "metalprobe's SHARE_PERCENT of toyos_tco::JOB_BOUND_MS, which is what every one of that boot's own span rows is priced at: the list is sized to what its jobs are allowed to cost, and a job that outruns its allowance reds on its own span row"
-
-[[number]]
-name = "list.testcases.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.shared.job_ms: the same machine spawning the same kind of binary off the same stick"
-
-[[number]]
-name = "list.testcases-mkdir.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms"
-
-[[number]]
-name = "list.testcases-readdir.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms"
-
-[[number]]
-name = "list.testcases-watchdog.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms"
-
-[[number]]
-name = "list.jobcase.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms"
-
-[[number]]
-name = "list.metalcase.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms"
-
-[[number]]
-name = "list.latencycase.job_ms"
-unit = "ms"
-ceiling = 27000
-ceiling_from = "half of what the members of a list may spend — (toyos_tco::JOB_BOUND_MS - metalprofile::AROUND_THE_LIST_MS) / 2 — because this list is two benches that run for a stated span rather than binaries that exit as soon as they can, and they split the boot between them"
-
-[[number]]
-name = "list.selftests.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms"
-
-[[number]]
-name = "list.foreignrecord.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms"
-
-[[number]]
-name = "list.logstallcase.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms"
-
-[[number]]
-name = "list.testcases-deaf.job_ms"
-unit = "ms"
-ceiling = 22000
-ceiling_from = "as list.lancase.job_ms — the same one job"
-
-[[number]]
-name = "list.testcases-window.job_ms"
-unit = "ms"
-ceiling = 27000
-ceiling_from = "as list.latencycase.job_ms: one job each of whose pipe waits the actuator may hold for its window"
-
-[[number]]
-name = "list.testcases-debug.job_ms"
-unit = "ms"
-ceiling = 2900
-ceiling_from = "as list.shared-debug.job_ms: one of the same eight binaries"
-
-[[number]]
-name = "list.deadlinewedge.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.testcases.job_ms — the list is one job and a wedge, and what ends this boot is the kernel's own deadline rather than the runner's"
-
-[[number]]
-name = "list.hardlockup.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.deadlinewedge.job_ms"
-
-[[number]]
-name = "list.usbload.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.deadlinewedge.job_ms — the same list, and what ends this boot is the kernel's own deadline rather than the runner's"
-
-[[number]]
-name = "list.usbbreak.job_ms"
-unit = "ms"
-ceiling = 1400
-ceiling_from = "as list.jobcase.job_ms — the same list"
-
-# --- the boots the split above adds ---
-
-[[number]]
-name = "boot.shared-2.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-
-[[number]]
-name = "boot.shared-2.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-
-[[number]]
-name = "boot.shared-2.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-
-[[number]]
-name = "boot.ccorpus-2.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-
-[[number]]
-name = "boot.ccorpus-2.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-
-[[number]]
-name = "boot.ccorpus-2.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-
-# --- the cable: the boot that runs netd in front of the T14's own I219 ---
-
-[[number]]
-name = "boot.lancase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "toyos_tco::JOB_BOUND_MS — as boot.testcases.complete_ms"
-measured = 1208
-
-[[number]]
-name = "boot.lancase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-measured = 82
-
-[[number]]
-name = "boot.lancase.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.testcases.stick_secs"
-measured = 0
-
-# No `measured`: the one ping this row has been offered was answered by the
-# operating system on the other side of the reset, which the judge refuses, so
-# no boot has yet given this number a reading.
-[[number]]
-name = "boot.lancase.ping_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs — the loop's own wait for the machine to answer ssh again, which bounds the window a reply can fall in"
-
-[[number]]
-name = "list.lancase.job_ms"
-unit = "ms"
-ceiling = 22000
-ceiling_from = "toyos_tco::LEASE_BOUND_MS, which is lan_hold's whole sleep, plus two seconds for the spawn and the exit record around it"
-
-[[number]]
-name = "lan.lancase.link_up_ms"
-unit = "ms"
-ceiling = 20000
-ceiling_from = "toyos_tco::LEASE_BOUND_MS: a link that comes up later than lan_hold sleeps is a link this boot never had, because the machine has already handed itself back"
-
-[[number]]
-name = "lan.lancase.lease_ms"
-unit = "ms"
-ceiling = 20000
-ceiling_from = "as lan.lancase.link_up_ms, which is netd's own dhcp::LEASE_BOUND: a boot with no lease by then has already said so in its log"
-
-# `lanicscase` is `lancase` with one argument added to netd's manifest row, so
-# every bound it is under is that boot's.
-
-[[number]]
-name = "boot.lanicscase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "as boot.lancase.complete_ms — the same boot config with one netd argument added"
-
-[[number]]
-name = "boot.lanicscase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-
-[[number]]
-name = "boot.lanicscase.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.lancase.stick_secs"
-
-[[number]]
-name = "list.lanicscase.job_ms"
-unit = "ms"
-ceiling = 22000
-ceiling_from = "as list.lancase.job_ms — the same one job"
-
-# --- what the on-screen panel cost each boot ---
-# **The one window a person has into a machine that stopped.** Two numbers,
-# because the panel can fail a person in two ways: `panel_max_us` bounds one
-# paint, so a paint nobody can watch finish is a red; `panel_us` bounds the
-# boot's whole time inside the painter, so a panel that keeps pace per paint by
-# painting far more than it needs to is a red as well. Paints and pixels are
-# printed beside the boot as evidence and are not gates.
-
-[[number]]
-name = "boot.testcases.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "one frame at 60 Hz, which is the rate at which a person watching a panel sees it change; a paint that cannot finish inside one shows stale state during the event the panel exists for. 60 Hz is this bench's premise about its display and not a reading off it"
-
-[[number]]
-name = "boot.testcases-mkdir.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.testcases-readdir.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.testcases-watchdog.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.jobcase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-measured = 3332
-
-[[number]]
-name = "boot.metalcase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.latencycase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.metaldevicecase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.selftests.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.shared.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.shared-2.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.shared-debug.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.ccorpus.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.ccorpus-2.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.foreignrecord.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.logstallcase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.testcases-deaf.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.testcases-window.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.testcases-debug.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.deadlinewedge.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us; read off the sealed page, because this boot's logd wrote no file"
-measured = 3867
-
-[[number]]
-name = "boot.hardlockup.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.deadlinewedge.panel_max_us"
-measured = 3890
-
-[[number]]
-name = "boot.usbbreak.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.lancase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.lanicscase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.testcases.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "the panel reports the boot and may not become it: a tenth of the ~1.2 s these boots take to reach `Boot: complete`, which is what boot.testcases.complete_ms's readings stand at. A panel that re-renders the whole scanout for every record spends more than the boot does"
-
-[[number]]
-name = "boot.testcases-mkdir.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.testcases-readdir.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.testcases-watchdog.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.jobcase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-measured = 17408
-
-[[number]]
-name = "boot.metalcase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.latencycase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.metaldevicecase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.selftests.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.shared.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.shared-2.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.shared-debug.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.ccorpus.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.ccorpus-2.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.foreignrecord.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.logstallcase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.testcases-deaf.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.testcases-window.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.testcases-debug.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.deadlinewedge.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-measured = 18693
-
-[[number]]
-name = "boot.hardlockup.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-measured = 19488
-
-# --- what the block layer had open where the stop ended
-# How long the stop took is priced nowhere: a stop that gave up spends its
-# budget and no more, so the record's own shortfall clause is the verdict, and
-# `Readback::stop_completed` reads it on every boot.
-#
-# `deadlinewedge`, `hardlockup` and `usbload` are absent on purpose: those
-# reset on a bound without going through `quiesce`, so they stop nothing and
-# write no record.
-
-[[number]]
-name = "boot.testcases.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "the stop's own claim, judged by the block layer instead of by the stop: an operation lasts only while its opener is inside the device, so a thread the stop has stopped holds none and any number but zero is a sync claiming something about a machine that was still writing"
-
-[[number]]
-name = "boot.testcases-mkdir.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.testcases-readdir.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.testcases-watchdog.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.jobcase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.metalcase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-measured = 0
-
-[[number]]
-name = "boot.latencycase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.metaldevicecase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-measured = 0
-
-[[number]]
-name = "boot.selftests.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.shared.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.shared-2.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.shared-debug.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.ccorpus.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.ccorpus-2.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.foreignrecord.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.logstallcase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.testcases-deaf.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.testcases-window.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.testcases-debug.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.usbbreak.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.lancase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.lanicscase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.lanleasecase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.lantalkcase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-
-[[number]]
-name = "boot.usbbreak.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.lancase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.lanicscase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.lanleasecase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "as boot.lancase.complete_ms — the same boot config with one netd argument added"
-
-[[number]]
-name = "boot.lanleasecase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-
-[[number]]
-name = "boot.lanleasecase.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.lancase.stick_secs"
-
-[[number]]
-name = "list.lanleasecase.job_ms"
-unit = "ms"
-ceiling = 22000
-ceiling_from = "as list.lancase.job_ms — the same one job"
-
-[[number]]
-name = "boot.lanleasecase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.lanleasecase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-# `lantalkcase` is `lancase` with sshd and its log served, talked to from the
-# host until it is told to reboot. Its one job holds the machine only as the
-# fallback for a host that never says so.
-
-[[number]]
-name = "boot.lantalkcase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "as boot.lancase.complete_ms"
-
-[[number]]
-name = "boot.lantalkcase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-
-[[number]]
-name = "boot.lantalkcase.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.lancase.stick_secs"
-
-[[number]]
-name = "list.lantalkcase.job_ms"
-unit = "ms"
-ceiling = 54000
-ceiling_from = "lan_talk_hold's end, toyos_tco::JOB_BOUND_MS less its tenth: the hold sleeps to that much boot time and no further"
-
-[[number]]
-name = "boot.lantalkcase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.lantalkcase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-# `lanswapcase` is `lantalkcase` flashed without `--talk`: netd is swapped while
-# it runs by the `--swap` invocation beside the loop, and its hold ends it.
-
-[[number]]
-name = "boot.lanswapcase.complete_ms"
-unit = "ms"
-ceiling = 60000
-ceiling_from = "as boot.lancase.complete_ms"
-
-[[number]]
-name = "boot.lanswapcase.back_secs"
-unit = "s"
-ceiling = 420
-ceiling_from = "toyos_build::metal::return_secs"
-
-[[number]]
-name = "boot.lanswapcase.stick_secs"
-unit = "s"
-ceiling = 30
-ceiling_from = "as boot.lancase.stick_secs"
-
-[[number]]
-name = "list.lanswapcase.job_ms"
-unit = "ms"
-ceiling = 54000
-ceiling_from = "as list.lantalkcase.job_ms"
-
-[[number]]
-name = "boot.lanswapcase.panel_max_us"
-unit = "us"
-ceiling = 16667
-ceiling_from = "as boot.testcases.panel_max_us"
-
-[[number]]
-name = "boot.lanswapcase.panel_us"
-unit = "us"
-ceiling = 100000
-ceiling_from = "as boot.testcases.panel_us"
-
-[[number]]
-name = "boot.lanswapcase.park_open_operations"
-unit = "operations"
-ceiling = 0
-ceiling_from = "as boot.testcases.park_open_operations"
-measured = 0
diff --git a/tests/toyos-rust-tests/src/bin/lan_talk_hold.rs b/tests/toyos-rust-tests/src/bin/lan_talk_hold.rs
index e15dda115c3..9de3a7d87c5 100644
--- a/tests/toyos-rust-tests/src/bin/lan_talk_hold.rs
+++ b/tests/toyos-rust-tests/src/bin/lan_talk_hold.rs
@@ -10,9 +10,6 @@
 use std::thread::sleep;
 use std::time::Duration;
 
-/// Milliseconds of boot time this hold ends at: the runner's bound less the
-/// tenth `toyos_build::metalprofile::AROUND_THE_LIST_MS` keeps for the boot
-/// around the list, so the runner's own `reboot` still runs inside its bound.
 const UNTIL_MS: u64 = toyos_tco::JOB_BOUND_MS - toyos_tco::JOB_BOUND_MS / 10;
 
 fn main() {
diff --git a/tests/toyos.rs b/tests/toyos.rs
index cbb7b0f466d..ce4f635cdfd 100644
--- a/tests/toyos.rs
+++ b/tests/toyos.rs
@@ -1532,8 +1532,7 @@ const METAL_SIM_CLIENTS: &[&str] = &[
 const METAL: &[(&str, metal::Metal)] = &[
     (
         // The device list: the T14's own xHCI, stick, i8042, HDA, framebuffer
-        // and NVMe, asserted from the records the shipping kernel writes, with
-        // every span `metalprobe` measured priced in `tests/metal-profile.toml`.
+        // and NVMe, asserted from the records the shipping kernel writes.
         "metal_device_probe",
         metal::Metal::Runs { arms: METALDEVICECASE, judge: |b| devices::on_metal(b[0]) },
     ),
@@ -1830,8 +1829,9 @@ const METAL: &[(&str, metal::Metal)] = &[
             // has.
             judge: |b| {
                 let (p50, p99) = tlb_shootdown_cost(b[0].kernel().text(), b[0].cpus()?)?;
-                b[0].number("tlb.latencycase.p50_ns", p50)?;
-                b[0].number("tlb.latencycase.p99_ns", p99)
+                b[0].measured("tlb.latencycase.p50_ns", p50);
+                b[0].measured("tlb.latencycase.p99_ns", p99);
+                Ok(())
             },
         },
     ),
@@ -2270,6 +2270,7 @@ fn shared_metal(
             config: "tests/testcases",
             params: &[],
             features: &[],
+            members: 38,
             jobs: shipping
                 .iter()
                 .filter(|n| keep(n))
@@ -2288,6 +2289,7 @@ fn shared_metal(
             config: "tests/testcases",
             params: &[],
             features: toyos_build::build::TEST_KERNEL,
+            members: 18,
             jobs: debug.iter().filter(|n| keep(n)).map(|n| format!("test_rs_{n}")).collect(),
             files: Vec::new(),
             links: Vec::new(),
@@ -2407,6 +2409,7 @@ fn c_corpus_metal(
         config: "tests/testcases",
         params: &[],
         features: &[],
+        members: 90,
         jobs,
         files,
         links,
@@ -15464,13 +15467,11 @@ fn tlb_shootdown_cost(log: &str, cpus: u32) -> Result<(u64, u64), String> {
         "  [tlb] {rounds} shootdowns across {across} CPUs: min={min}ns p50={p50}ns p90={p90}ns \
          p99={p99}ns max={max}ns"
     );
-    // The two the metal profile prices; the rest are the shape's own evidence.
     Ok((p50, p99))
 }
 
-/// `latency_wake` on a machine with no console: the p99,
-/// off the kernel's own exit record, against the ceiling the metal profile
-/// holds.
+/// `latency_wake` on a machine with no console: the p99, off the kernel's own
+/// exit record.
 ///
 /// A negative code is `cyclictest`'s refusal and not a fast machine — the sign
 /// is the whole of what separates the two, and that contract is in the binary's
@@ -15483,7 +15484,12 @@ fn wake_latency_recorded(boot: &metal::Readback) -> Result<(), String> {
              capability endowed, -2 is the real-time band refused"
         ));
     }
-    boot.number("latency.p99_us", u64::try_from(code).expect("a non-negative code"))
+    // cyclictest's `BUCKETS`: a p99 there is a floor and not a measurement.
+    if code >= 4096 {
+        return Err(format!("cyclictest's p99 is {code} us, past its histogram"));
+    }
+    boot.measured("latency.p99_us", u64::try_from(code).expect("a non-negative code"));
+    Ok(())
 }
 
 /// The negative control, executed: an AP left holding what `INIT` gave it, and
diff --git a/userland/metalprobe/src/main.rs b/userland/metalprobe/src/main.rs
index fd6dbf5553e..4b7fef5361e 100644
--- a/userland/metalprobe/src/main.rs
+++ b/userland/metalprobe/src/main.rs
@@ -11,10 +11,7 @@
 //! process name in the record is the symlink it was invoked under. The host
 //! reads both out of the log the stick came back with.
 //!
-//! **Every command's number is a span in microseconds**, and never a rate. The
-//! profile that prices them (`tests/metal-profile.toml`) holds a ceiling per
-//! number, and a ceiling is what a duration has: a rate would have to be judged
-//! from below, against a floor nothing in that file can express. What each span
+//! **Every command's number is a span in microseconds**, and never a rate. What each span
 //! covers is its own module's to say, and the byte count it covers is a
 //! constant there.
 //!

From d48bf860ed1843e3c78f275134d75417ce5dab74 Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Tue, 29 Sep 2026 19:03:28 +0200
Subject: [PATCH 02/10] One path derivation for a record, shared by load and
 save

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/metaltimings.rs | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/src/metaltimings.rs b/src/metaltimings.rs
index 77b809ce4d8..8ceda52b04d 100644
--- a/src/metaltimings.rs
+++ b/src/metaltimings.rs
@@ -63,16 +63,20 @@ impl Machine {
 
     /// Where this machine's record lives, relative to the repository root.
     pub fn path(&self) -> PathBuf {
-        let mut slug = String::new();
-        for c in format!("{} {}", self.vendor, self.product).chars() {
-            if c.is_ascii_alphanumeric() {
-                slug.push(c.to_ascii_lowercase());
-            } else if !slug.is_empty() && !slug.ends_with('-') {
-                slug.push('-');
-            }
+        path(&self.vendor, &self.product)
+    }
+}
+
+fn path(vendor: &str, product: &str) -> PathBuf {
+    let mut slug = String::new();
+    for c in format!("{vendor} {product}").chars() {
+        if c.is_ascii_alphanumeric() {
+            slug.push(c.to_ascii_lowercase());
+        } else if !slug.is_empty() && !slug.ends_with('-') {
+            slug.push('-');
         }
-        Path::new(DIR).join(format!("{}.toml", slug.trim_end_matches('-')))
     }
+    Path::new(DIR).join(format!("{}.toml", slug.trim_end_matches('-')))
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
@@ -110,12 +114,7 @@ impl Record {
     }
 
     pub fn save(&self, root: &Path) -> Result<PathBuf, String> {
-        let machine = Machine {
-            vendor: self.vendor.clone(),
-            product: self.product.clone(),
-            bios: self.bios.clone(),
-        };
-        let at = root.join(machine.path());
+        let at = root.join(path(&self.vendor, &self.product));
         let text = toml::to_string(self).map_err(|e| e.to_string())?;
         std::fs::create_dir_all(root.join(DIR)).map_err(|e| format!("{DIR}: {e}"))?;
         std::fs::write(&at, text).map_err(|e| format!("{}: {e}", at.display()))?;

From 070cb140dd9fb12536c47dc937a1cfc46d04fe21 Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Tue, 29 Sep 2026 19:13:43 +0200
Subject: [PATCH 03/10] The boot file is text, and the readback writer only
 writes it

clippy counted eight arguments on write_readback once the machine was one of
them; the boot file's text is now boot_file's, pure and testable, and the
writer takes it whole.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/metal.rs | 35 +++++++++++++++++------------------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/src/metal.rs b/src/metal.rs
index 3172701dece..71f79d33103 100644
--- a/src/metal.rs
+++ b/src/metal.rs
@@ -2107,7 +2107,8 @@ pub fn run(args: &Args) -> Result<Option<u64>, Refusal> {
         println!("toyos-fat32-check: the log partition's {} bytes check out", bytes.len());
     }
     if let Some(dir) = &args.readback {
-        write_readback(dir, &loader, &log, back, stick, &machine, wire.as_ref(), replied)?;
+        let boot = boot_file(back, stick, &machine, wire.as_ref(), replied);
+        write_readback(dir, &loader, &log, &boot)?;
         println!("readback written to {}", dir.display());
     }
     // **Named by evidence, before the boot record is missed.** A boot that
@@ -2333,16 +2334,7 @@ pub fn clear_readback(dir: &Path) -> Result<(), Refusal> {
     Ok(())
 }
 
-fn write_readback(
-    dir: &Path,
-    loader: &str,
-    log: &str,
-    back: u64,
-    stick: u64,
-    machine: &Machine,
-    wire: Option<&Wire>,
-    replied: Option<Reply>,
-) -> Result<(), Refusal> {
+fn write_readback(dir: &Path, loader: &str, log: &str, boot: &str) -> Result<(), Refusal> {
     let wrote = |path: &Path, text: &str| -> Result<(), Refusal> {
         std::fs::write(path, text)
             .map_err(|e| Refusal::File { path: path.display().to_string(), why: e.to_string() })
@@ -2351,9 +2343,18 @@ fn write_readback(
         .map_err(|e| Refusal::File { path: dir.display().to_string(), why: e.to_string() })?;
     wrote(&dir.join(READBACK_LOADER), loader)?;
     wrote(&dir.join(READBACK_KERNEL), log)?;
-    // The boot's own millisecond count is in the kernel log and read from
-    // there; this file carries only what the *host* clock measured, which no
-    // log can.
+    wrote(&dir.join(READBACK_BOOT), boot)
+}
+
+/// [`READBACK_BOOT`]'s text: what the host measured about the boot, and the
+/// machine it ran on.
+fn boot_file(
+    back: u64,
+    stick: u64,
+    machine: &Machine,
+    wire: Option<&Wire>,
+    replied: Option<Reply>,
+) -> String {
     let mut boot = format!(
         "{BACK_SECS} {back}\n{STICK_SECS_KEY} {stick}\n{VENDOR_KEY} {}\n{PRODUCT_KEY} {}\n\
          {BIOS_KEY} {}\n",
@@ -2368,7 +2369,7 @@ fn write_readback(
             boot.push_str(&format!("{PING_SECS_KEY} {}\n{PING_AT_KEY} {}\n", reply.secs, reply.at));
         }
     }
-    wrote(&dir.join(READBACK_BOOT), &boot)
+    boot
 }
 
 /// Whether this boot was a loader pass that reported a record and booted no
@@ -2781,10 +2782,8 @@ mod tests {
 
     #[test]
     fn the_machine_crosses_in_the_boot_file() {
-        let dir = toyos_tmpdir::TempDir::new("machine");
         let t14 = Machine::parse("LENOVO\n20W000T9GE\nN34ET56W (1.56 )\n").expect("three lines");
-        write_readback(&dir, "", "", 47, 0, &t14, None, None).expect("write");
-        let boot = std::fs::read_to_string(dir.join(READBACK_BOOT)).expect("boot.txt");
+        let boot = boot_file(47, 0, &t14, None, None);
         assert_eq!(machine(&boot), Ok(t14));
         assert_eq!(back_secs(&boot), Some(47));
         assert!(machine("back_secs 47\nmachine_vendor LENOVO\n").is_err());

From db5e59bc4385f24352e703a4158523cdb120186a Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Tue, 29 Sep 2026 20:17:12 +0200
Subject: [PATCH 04/10] The T14's timings, recorded by its first run of this
 branch

Recorded by the full metal run of 09fe6121e (143 numbers) and the offline
re-judge of the same readbacks, which added foreignrecord's and
lantalkcase's rows (151).

The run's FAILs are the same set main's run has, less four: lan_lease_report,
lan_swap, lanleasecase, lanswapcase.

Negative control: boot.jobcase.complete_ms set to 388 (a third) and
re-judged offline gives "FAIL boot.jobcase.complete_ms is 1164 against 388
recorded on this machine, past the ceiling of 776" and "1 past its record";
restored after.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tests/metal/lenovo-20w0003amz.toml | 156 +++++++++++++++++++++++++++++
 1 file changed, 156 insertions(+)
 create mode 100644 tests/metal/lenovo-20w0003amz.toml

diff --git a/tests/metal/lenovo-20w0003amz.toml b/tests/metal/lenovo-20w0003amz.toml
new file mode 100644
index 00000000000..7925a613041
--- /dev/null
+++ b/tests/metal/lenovo-20w0003amz.toml
@@ -0,0 +1,156 @@
+vendor = "LENOVO"
+product = "20W0003AMZ"
+bios = "N34ET71W (1.71 )"
+
+[measured]
+"boot.ccorpus-2.back_secs" = 51
+"boot.ccorpus-2.complete_ms" = 1170
+"boot.ccorpus-2.panel_max_us" = 3878
+"boot.ccorpus-2.panel_us" = 21089
+"boot.ccorpus-2.stick_secs" = 0
+"boot.ccorpus.back_secs" = 65
+"boot.ccorpus.complete_ms" = 1166
+"boot.ccorpus.panel_max_us" = 3802
+"boot.ccorpus.panel_us" = 22095
+"boot.ccorpus.stick_secs" = 0
+"boot.deadlinewedge.back_secs" = 162
+"boot.deadlinewedge.complete_ms" = 1165
+"boot.deadlinewedge.deadline_lateness_ms" = 65
+"boot.deadlinewedge.panel_max_us" = 3788
+"boot.deadlinewedge.panel_us" = 21678
+"boot.deadlinewedge.stick_secs" = 0
+"boot.foreignrecord.back_secs" = 42
+"boot.foreignrecord.complete_ms" = 1165
+"boot.foreignrecord.stick_secs" = 0
+"boot.hardlockup.back_secs" = 125
+"boot.hardlockup.complete_ms" = 1164
+"boot.hardlockup.lockup_lateness_ms" = 0
+"boot.hardlockup.panel_max_us" = 3949
+"boot.hardlockup.panel_us" = 21772
+"boot.hardlockup.stick_secs" = 0
+"boot.jobcase.back_secs" = 40
+"boot.jobcase.complete_ms" = 1164
+"boot.jobcase.panel_max_us" = 3793
+"boot.jobcase.panel_us" = 21957
+"boot.jobcase.stick_secs" = 0
+"boot.lancase.back_secs" = 61
+"boot.lancase.complete_ms" = 1164
+"boot.lancase.panel_max_us" = 3778
+"boot.lancase.panel_us" = 21602
+"boot.lancase.stick_secs" = 0
+"boot.lanicscase.back_secs" = 70
+"boot.lanicscase.complete_ms" = 1171
+"boot.lanicscase.panel_max_us" = 4000
+"boot.lanicscase.panel_us" = 21420
+"boot.lanicscase.stick_secs" = 0
+"boot.lanleasecase.back_secs" = 71
+"boot.lanleasecase.complete_ms" = 1165
+"boot.lanleasecase.panel_max_us" = 3841
+"boot.lanleasecase.panel_us" = 22280
+"boot.lanleasecase.stick_secs" = 0
+"boot.lanswapcase.back_secs" = 80
+"boot.lanswapcase.complete_ms" = 1165
+"boot.lanswapcase.panel_max_us" = 7061
+"boot.lanswapcase.panel_us" = 26663
+"boot.lanswapcase.stick_secs" = 0
+"boot.lantalkcase.back_secs" = 65
+"boot.lantalkcase.complete_ms" = 1165
+"boot.lantalkcase.panel_max_us" = 3733
+"boot.lantalkcase.panel_us" = 23197
+"boot.lantalkcase.stick_secs" = 0
+"boot.latencycase.back_secs" = 44
+"boot.latencycase.complete_ms" = 1165
+"boot.latencycase.panel_max_us" = 3887
+"boot.latencycase.panel_us" = 21459
+"boot.latencycase.stick_secs" = 0
+"boot.logstallcase.back_secs" = 55
+"boot.logstallcase.complete_ms" = 1165
+"boot.logstallcase.panel_max_us" = 3906
+"boot.logstallcase.panel_us" = 22531
+"boot.logstallcase.stick_secs" = 0
+"boot.metalcase.back_secs" = 39
+"boot.metalcase.complete_ms" = 1165
+"boot.metalcase.panel_max_us" = 3844
+"boot.metalcase.panel_us" = 21526
+"boot.metalcase.stick_secs" = 0
+"boot.metaldevicecase.back_secs" = 56
+"boot.metaldevicecase.complete_ms" = 1165
+"boot.metaldevicecase.panel_max_us" = 3837
+"boot.metaldevicecase.panel_us" = 23002
+"boot.metaldevicecase.stick_secs" = 0
+"boot.selftests.back_secs" = 44
+"boot.selftests.complete_ms" = 1171
+"boot.selftests.panel_max_us" = 3909
+"boot.selftests.panel_us" = 22457
+"boot.selftests.stick_secs" = 0
+"boot.shared-2.back_secs" = 59
+"boot.shared-2.complete_ms" = 1165
+"boot.shared-2.panel_max_us" = 3721
+"boot.shared-2.panel_us" = 21855
+"boot.shared-2.stick_secs" = 0
+"boot.shared-debug.back_secs" = 46
+"boot.shared-debug.complete_ms" = 1165
+"boot.shared-debug.panel_max_us" = 3791
+"boot.shared-debug.panel_us" = 21483
+"boot.shared-debug.stick_secs" = 0
+"boot.shared.back_secs" = 56
+"boot.shared.complete_ms" = 1202
+"boot.shared.panel_max_us" = 3868
+"boot.shared.panel_us" = 21247
+"boot.shared.stick_secs" = 0
+"boot.testcases-deaf.back_secs" = 61
+"boot.testcases-deaf.complete_ms" = 1165
+"boot.testcases-deaf.panel_max_us" = 5247
+"boot.testcases-deaf.panel_us" = 26659
+"boot.testcases-deaf.stick_secs" = 0
+"boot.testcases-debug.back_secs" = 44
+"boot.testcases-debug.complete_ms" = 1165
+"boot.testcases-debug.panel_max_us" = 3824
+"boot.testcases-debug.panel_us" = 22032
+"boot.testcases-debug.stick_secs" = 0
+"boot.testcases-mkdir.back_secs" = 54
+"boot.testcases-mkdir.complete_ms" = 1166
+"boot.testcases-mkdir.panel_max_us" = 3839
+"boot.testcases-mkdir.panel_us" = 22100
+"boot.testcases-mkdir.stick_secs" = 0
+"boot.testcases-readdir.back_secs" = 46
+"boot.testcases-readdir.complete_ms" = 1166
+"boot.testcases-readdir.panel_max_us" = 3868
+"boot.testcases-readdir.panel_us" = 21680
+"boot.testcases-readdir.stick_secs" = 0
+"boot.testcases-watchdog.back_secs" = 49
+"boot.testcases-watchdog.complete_ms" = 1190
+"boot.testcases-watchdog.panel_max_us" = 3815
+"boot.testcases-watchdog.panel_us" = 22451
+"boot.testcases-watchdog.stick_secs" = 0
+"boot.testcases-window.back_secs" = 47
+"boot.testcases-window.complete_ms" = 1165
+"boot.testcases-window.panel_max_us" = 3822
+"boot.testcases-window.panel_us" = 22472
+"boot.testcases-window.stick_secs" = 0
+"boot.testcases.back_secs" = 54
+"boot.testcases.complete_ms" = 1165
+"boot.testcases.panel_max_us" = 3827
+"boot.testcases.panel_us" = 21502
+"boot.testcases.stick_secs" = 0
+"boot.usbload.back_secs" = 166
+"boot.usbload.complete_ms" = 1170
+"boot.usbload.deadline_lateness_ms" = 68
+"boot.usbload.panel_max_us" = 3959
+"boot.usbload.panel_us" = 20656
+"boot.usbload.stick_secs" = 0
+"fbcheck.metaldevicecase.span_us" = 221570
+"fbfill.metaldevicecase.span_us" = 13885
+"fbread.metaldevicecase.span_us" = 313347
+"lan.lancase.lease_ms" = 13353
+"lan.lancase.link_up_ms" = 2797
+"latency.p99_us" = 16
+"list.ccorpus-2.job_ms" = 116
+"list.ccorpus.job_ms" = 123
+"list.shared-2.job_ms" = 419
+"list.shared-debug.job_ms" = 383
+"list.shared.job_ms" = 353
+"tlb.latencycase.p50_ns" = 2194
+"tlb.latencycase.p99_ns" = 3740
+"usbread.metaldevicecase.span_us" = 36393
+"usbwrite.metaldevicecase.span_us" = 2787258

From da9e8c07517d2986ecde15ca93f35a6d1ab603eb Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Tue, 29 Sep 2026 21:37:28 +0200
Subject: [PATCH 05/10] Answer the first review of #630: a failed boot never
 becomes a record

The review (issuecomment-5896707051) found the committed T14 record
holding rows from boots toyos-metal refused, a live run and an offline
re-judge of the same readbacks recording different things, a BIOS change
re-baselining silently, and rows that time Ubuntu, the router or a list's
membership rather than ToyOS.

The loop's verdict travels in the readback. `src/metal.rs` judges the boot
before it writes the readback (`boot_verdict`, shaped as #616 shapes it,
then the talk verdict) and writes `verdict.txt` last: `passed`, or
`refused` and the refusal's own words. `tests/common/metal.rs` refuses a
readback whose verdict is not `passed` in both modes, so a live run and an
offline re-judge read one verdict off one directory.

The record is one function of the readbacks. Everything after the
readbacks are read is `judge_readbacks(root, readbacks, runs, shared)`,
called by `run` in both modes. A boot with any failure of its own (the
loop's verdict, a missing boot number, `log_reached_the_stick`,
`stop_completed`, either bound's lateness, or any test or shared member
riding it) is judged and adds no row. A red run still judges every
reading. `measured` refuses a second value under one name on one boot,
and a name two boots measure is judged on the first and recorded off
neither.

A run under a BIOS other than the record's is judged against the record,
fails naming both strings, and records nothing; re-baselining is deleting
the file, which the module doc now states as the contract. `Record::get`
and the `recorded` arm of `PATH_TAKEN` go: the wedge judges already refuse
a page naming the other bound.

Rows that are not ToyOS's timing, or cannot fail, are no longer measured:
every `back_secs` (firmware POST, Ubuntu and ssh; the loop still refuses
past `return_secs` and the line still prints it), `stick_secs` (the loop
refuses past `STICK_SECS`), `ping_secs`, `link_up_ms`, `lan.*.lease_ms`
(its ceiling was past `LEASE_BOUND_MS`), and `list.*.job_ms` (a mean over
a membership every added test moves; a list past the bound already fails
as missing exit records). The per-member cost still prints.

The two lateness numbers become checks against the period of what polls
them, a millisecond either way for the two floored readings. The hard
lockup's against its sample period, now `toyos_tco::HARD_LOCKUP_SAMPLE_NS`
so the kernel and the host read one declaration. The deadline's against
one scheduler quantum, the one-shot every CPU a staged wedge holds
re-arms, and counted from the kernel's `boot deadline:` record
(`bootlog::DEADLINE_ARMED`, held to `kernel/src/deadline.rs` by the
kernel-spelling gate): the old reading was `reached - bound`, with the
expiry quoted since boot and the bound running from the arm at 60 ms, so
run 2's 64 and 67 were 4 and 7 ms of poll and 60 ms of boot. An early
expiry is now a reading and fails, where it used to read as no expiry.

`cyclictest` refuses a p99 past its histogram itself (-3), so the 4096
the harness restated goes. `SharedBoot::members` is a `NonZeroUsize`.

tests/metal/lenovo-20w0003amz.toml keeps only what this rule would have
recorded from the readbacks that wrote it (the offline re-judge of
09fe6121e's run): 151 rows become 56. Gone are the deleted classes above
and every row of the eleven boots that failed there: foreignrecord and
lantalkcase (refused by the loop), lancase (lan_dhcp_lease), testcases
(klogd_hosted, log_poll_outlives_a_close, hda_tone, hda_client_stall,
loader_watchdog_arms), testcases-watchdog (loader_watchdog_arms),
deadlinewedge (boot_deadline_ends_a_wedge), usbload
(usb_reset_records_the_phase_it_cut), jobcase (machine_reboot), selftests
(xhci_xecp_walk), shared (four members) and ccorpus (03_struct). The next
run records them once they pass.

Host checks: every committed record loads from its own path; a record
file naming another machine and a duplicated row are refused; the stop's
two refusals, each bound's lateness, the verdict round trip, the
failed-boot filter and the duplicate-name refusal each have a test that a
mutation of the rule turns red.

Filed: the identity read over ssh, whose exit is the boot naming its
machine; `test_rs_mutual_kill`'s stdio panic on run 2; and that a record
never tightens.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ...machine-it-is-and-the-boot-says-nothing.md |  30 +
 .../a-metal-timing-record-never-tightens.md   |  20 +
 ...eadline-fired-132859-ms-late-on-the-t14.md |   3 +-
 ...he-t14-with-stdio-slot-1-not-a-log-ring.md |  45 ++
 kernel/src/hardlockup/mod.rs                  |   9 +-
 src/bootlog.rs                                |   5 +
 src/metal.rs                                  | 194 +++++--
 src/metaltimings.rs                           | 257 ++++++---
 tests/common/devices.rs                       |   2 +-
 tests/common/lan.rs                           |  13 +-
 tests/common/metal.rs                         | 515 +++++++++++++-----
 tests/common/power.rs                         |  20 +-
 tests/metal/lenovo-20w0003amz.toml            |  95 ----
 tests/toyos-rust-tests/src/bin/cyclictest.rs  |  28 +-
 tests/toyos.rs                                |  27 +-
 toyos-tco/src/lib.rs                          |   9 +
 16 files changed, 886 insertions(+), 386 deletions(-)
 create mode 100644 issues/build/a-metal-run-asks-ubuntu-which-machine-it-is-and-the-boot-says-nothing.md
 create mode 100644 issues/build/a-metal-timing-record-never-tightens.md
 create mode 100644 issues/kernel/mutual-kill-panicked-on-the-t14-with-stdio-slot-1-not-a-log-ring.md

diff --git a/issues/build/a-metal-run-asks-ubuntu-which-machine-it-is-and-the-boot-says-nothing.md b/issues/build/a-metal-run-asks-ubuntu-which-machine-it-is-and-the-boot-says-nothing.md
new file mode 100644
index 00000000000..72312e6fb3a
--- /dev/null
+++ b/issues/build/a-metal-run-asks-ubuntu-which-machine-it-is-and-the-boot-says-nothing.md
@@ -0,0 +1,30 @@
+---
+status: open
+kind: tooling
+opened: 2026-09-29
+---
+
+# A metal run asks Ubuntu which machine it is, and the boot under test says nothing
+
+`src/metal.rs`'s `run` asks the operating system the T14 runs between boots
+for `metaltimings::Machine::QUERY` over ssh before the flash, and writes the
+answer into the readback's `boot.txt` under three keys (`VENDOR_KEY`,
+`PRODUCT_KEY`, `BIOS_KEY`); `tests/common/metal.rs` reads it back with
+`metal::machine`, and `metaltimings::Record::load` picks the machine's record
+by it. Both T14 runs of `wt/toyos-metaltimings` named the machine this way:
+`machine LENOVO 20W0003AMZ, BIOS N34ET71W (1.71 )`.
+
+A resident runner, tests inside a ToyOS that stays up on the machine with no
+Ubuntu and no reboot per test, has nothing to ask: the ssh read,
+`Refusal::Machine`, the three keys and `metal::machine` all go with Ubuntu.
+The record compares BIOS strings byte for byte, so identity has one reader:
+two that trim differently fail every run as a firmware change.
+
+## Exit condition
+
+The boot names its machine: the loader reads SMBIOS type 1's manufacturer and
+product and type 0's BIOS version from the UEFI configuration table before
+`ExitBootServices` and writes them as one `loader.log` line, the judge reads
+the machine from the readback's `loader.log`, the ssh read, `Refusal::Machine`,
+the three keys and `metal::machine` are deleted, and every record under
+`tests/metal/` names its machine in the loader's own strings.
diff --git a/issues/build/a-metal-timing-record-never-tightens.md b/issues/build/a-metal-timing-record-never-tightens.md
new file mode 100644
index 00000000000..5da31ff180f
--- /dev/null
+++ b/issues/build/a-metal-timing-record-never-tightens.md
@@ -0,0 +1,20 @@
+---
+status: open
+kind: tooling
+opened: 2026-09-29
+---
+
+# A metal timing record never tightens
+
+`src/metaltimings.rs`'s `judge` adds a name its machine has not recorded and
+never moves one it has, so a run cannot loosen the record that judges it. The
+same rule keeps a speed-up out: a number that halves keeps its old ceiling,
+and a regression that later doubles it back is inside that ceiling and passes.
+Only deleting the row re-records it.
+
+## Exit condition
+
+A recorded number that a run measures well under its record is either taken
+as the new record by a rule that a noisy run cannot ratchet into a false red,
+or reported by name so the row is deleted, and the choice is in
+`src/metaltimings.rs`'s module doc.
diff --git a/issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md b/issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md
index 9005b87e26d..1b0519288fc 100644
--- a/issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md
+++ b/issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md
@@ -142,5 +142,4 @@ is owed; a cause is.
   than the poll's one call site.
 
 **Exit condition**: the cause of a `poll` that ran 132859 ms past its bound is
-named with evidence and either removed or priced, so that a T14 expiry's
-lateness is held to the row that already exists.
+named with evidence and either removed or priced.
diff --git a/issues/kernel/mutual-kill-panicked-on-the-t14-with-stdio-slot-1-not-a-log-ring.md b/issues/kernel/mutual-kill-panicked-on-the-t14-with-stdio-slot-1-not-a-log-ring.md
new file mode 100644
index 00000000000..f7468dd32c5
--- /dev/null
+++ b/issues/kernel/mutual-kill-panicked-on-the-t14-with-stdio-slot-1-not-a-log-ring.md
@@ -0,0 +1,45 @@
+---
+status: open
+kind: defect
+opened: 2026-09-29
+---
+
+# `test_rs_mutual_kill` panicked on the T14: stdio slot 1 "holds a region that is not a log ring"
+
+The full metal run of `wt/toyos-metaltimings` at `db5e59bc4` failed
+`test_rs_mutual_kill` in the `shared-2` boot; the run of the same branch at
+`09fe6121e` passed it. `git diff --stat 09fe6121e db5e59bc4` names one file,
+`tests/metal/lenovo-20w0003amz.toml`, which the host harness reads and no image
+carries. Unexplained: nothing below says why.
+
+## What the log shows
+
+The job was spawned at 3.045 s as pid 28 and spawned its children, pid 29 to
+156, each ending `code=137` or `code=0`. The two exit records written just
+before the panic:
+
+    [2026-09-29 18:49:34 10.010 cpu4] exit: test_rs_mutual_kill pid=155 code=0 cpu=10ms
+    [2026-09-29 18:49:34 10.010 cpu5] exit: test_rs_mutual_kill pid=156 code=137 cpu=10ms
+
+Then pid 28 itself, under the runner's name:
+
+    {2026-09-29 18:49:34 10.011 error pid=28 test-runner} thread 'main' (1) panicked at /Users/jan/Dev/jan/toyos-phdr/toyos/src/log/stdio.rs:209:33:
+    {2026-09-29 18:49:34 10.011 error pid=28 test-runner} stdio: slot 1 holds a region that is not a log ring
+    ...
+      11:      0x1000006e6be - toyos[db68fa2b5c494fe7]::log::stdio::target::sink
+      12:      0x1000006e7c2 - toyos[db68fa2b5c494fe7]::log::stdio::target::write
+      13:      0x100000568d8 - <alloc[58e89b8cb86be8e3]::io::buffered::bufwriter::BufWriter<std[cb898f2ab581ea90]::io::stdio::StdoutRaw>>::flush_buf
+      ...
+      18:      0x10000063bc3 - std[cb898f2ab581ea90]::io::stdio::_print
+      19:      0x10000028f12 - mutual_kill[652ee4c06bb687b]::main
+    [2026-09-29 18:49:34 10.085 cpu5] exit: test_rs_mutual_kill pid=28 code=101 cpu=5840ms
+
+`toyos/src/log/stdio.rs:209` is `sink`'s panic on the first write to a
+stream whose slot `ask` refused, with `NotARing`'s words (`:276`). The path is
+the sysroot's source, which is keyed by content and so names whichever
+worktree built that key first.
+
+## Exit condition
+
+Why pid 28's slot 1 answered `NotARing` on its first `println!` is named with
+evidence and removed, and `test_rs_mutual_kill` passes on a T14 run.
diff --git a/kernel/src/hardlockup/mod.rs b/kernel/src/hardlockup/mod.rs
index b91a0022b23..b2e80b8f4a6 100644
--- a/kernel/src/hardlockup/mod.rs
+++ b/kernel/src/hardlockup/mod.rs
@@ -72,12 +72,9 @@ pub mod probe;
 /// line and nothing links the two crates (`src/bootlog.rs`).
 pub const LOCKED_UP: &str = "a cpu locked up with interrupts off";
 
-/// How often an armed CPU samples itself, in nanoseconds of unhalted time.
-///
-/// A second: the bound is measured in tens of them, so a sample period this
-/// long costs one NMI per CPU per second and puts the detection within one
-/// period of the bound. It is also the period the report's ages are quoted at.
-const SAMPLE_NS: u64 = 1_000_000_000;
+/// Declared beside the bound it samples, so the host judging a lockup's
+/// lateness reads the same period.
+const SAMPLE_NS: u64 = toyos_tco::HARD_LOCKUP_SAMPLE_NS;
 
 /// The bound in TSC ticks, or 0 for a boot that armed none. Written on the BSP
 /// before any AP exists.
diff --git a/src/bootlog.rs b/src/bootlog.rs
index 14aa18ad1e4..fd9ee1d93be 100644
--- a/src/bootlog.rs
+++ b/src/bootlog.rs
@@ -34,6 +34,10 @@ pub const JOB_DEADLINE_SAID: &str =
 /// it has: a wedged boot's `logd` wrote nothing.
 pub const DEADLINE_EXPIRED: &str = "the boot deadline expired";
 
+/// What the kernel logs as it arms that deadline, in `kernel/src/deadline.rs`:
+/// the record whose time the bound is counted from.
+pub const DEADLINE_ARMED: &str = "boot deadline: ";
+
 /// What the `wedge-before-reset` actuator says before it stops every CPU, in
 /// `kernel/src/deadline.rs`. The witness that a deadline ended a wedge and not
 /// a boot merely slower than its bound, which is what makes that control one.
@@ -671,6 +675,7 @@ mod tests {
             ("kernel/src/arch/x86_64/smp.rs", format!("log!(\"{AP_BRINGUP}")),
             ("kernel/src/process.rs", format!("THREAD_NAME_LEN: usize = {NAME_LEN}")),
             ("kernel/src/deadline.rs", format!("EXPIRED: &str = \"{DEADLINE_EXPIRED}\"")),
+            ("kernel/src/deadline.rs", format!("\"{DEADLINE_ARMED}{{ms}} ms")),
             ("kernel/src/deadline.rs", format!("WEDGE_STAGED: &str = \"{WEDGE_STAGED}\"")),
             ("kernel/src/deadline.rs", format!("\"{WEDGE_ARRIVED_DEAF}\"")),
             ("kernel/src/usb_gate.rs", format!("USB_WEDGE_STAGED: &str = \"{USB_WEDGE_STAGED}\"")),
diff --git a/src/metal.rs b/src/metal.rs
index 71f79d33103..6e686bfb6e2 100644
--- a/src/metal.rs
+++ b/src/metal.rs
@@ -2106,11 +2106,27 @@ pub fn run(args: &Args) -> Result<Option<u64>, Refusal> {
         }
         println!("toyos-fat32-check: the log partition's {} bytes check out", bytes.len());
     }
+    // **Judged before the readback is written, and written into it**, so a
+    // judge reading the directory later reads the verdict this run returns.
+    let verdict = boot_verdict(&armed, &loader, &log).and_then(|ms| {
+        // After the stick's own verdict, which stays the one that names a boot
+        // that never reached its network.
+        if let Some((heard, lines)) = &heard {
+            talk_verdict(heard, lines)?;
+        }
+        Ok(ms)
+    });
     if let Some(dir) = &args.readback {
         let boot = boot_file(back, stick, &machine, wire.as_ref(), replied);
-        write_readback(dir, &loader, &log, &boot)?;
+        write_readback(dir, &loader, &log, &boot, &verdict_file(verdict.as_ref().err()))?;
         println!("readback written to {}", dir.display());
     }
+    verdict.map(Some)
+}
+
+/// The stick's own verdict on one boot, off what its image is armed with, the
+/// loader's file and the log.
+fn boot_verdict(armed: &[String], loader: &str, log: &str) -> Result<u64, Refusal> {
     // **Named by evidence, before the boot record is missed.** A boot that
     // never happened and a boot that failed both leave no `Boot: complete`,
     // and `Unfit::NoBootRecord` says the second where it is often the first.
@@ -2124,7 +2140,7 @@ pub fn run(args: &Args) -> Result<Option<u64>, Refusal> {
     if loader.contains(bootlog::HUNG_WITHOUT_A_RECORD) {
         return Err(Refusal::HungWithoutARecord);
     }
-    if let Some(said) = reported_and_booted_nothing(&loader, &log) {
+    if let Some(said) = reported_and_booted_nothing(loader, log) {
         return Err(Refusal::ReportedAndBootedNothing { said });
     }
     // **An image armed to stop itself is judged by the record its own bound
@@ -2134,19 +2150,12 @@ pub fn run(args: &Args) -> Result<Option<u64>, Refusal> {
     // it was not flashed as. *Which* bound sealed it is the page's to say
     // and not this list's — the arm says a bound was staged, and two of them
     // can reach a staged boot.
-    let ms = if stages_a_wedge(&armed) {
-        wedged_boot(&loader, &log)?
-    } else {
-        let ms = bootlog::verdict(&log).map_err(Refusal::Log)?;
-        bootlog::handed_back(&loader).map_err(Refusal::Log)?;
-        ms
-    };
-    // After the stick's own verdict, which stays the one that names a boot
-    // that never reached its network.
-    if let Some((heard, lines)) = &heard {
-        talk_verdict(heard, lines)?;
+    if stages_a_wedge(armed) {
+        return wedged_boot(loader, log);
     }
-    Ok(Some(ms))
+    let ms = bootlog::verdict(log).map_err(Refusal::Log)?;
+    bootlog::handed_back(loader).map_err(Refusal::Log)?;
+    Ok(ms)
 }
 
 /// Where a conversation's facts are written, beside the stick's files.
@@ -2228,18 +2237,35 @@ fn sealed_by(loader: &str) -> Option<&str> {
 }
 
 /// The lateness of a deadline that expired, in milliseconds past the bound it
-/// was armed with, out of the line the pass after the reset printed.
+/// was armed with, out of the line the pass after the reset printed; `None` on
+/// a boot whose deadline did not expire.
 ///
-/// **The one number this arm measures.** The bound is a parameter and the
-/// expiry is what the poll actually reached, so the difference is what the
-/// timer entry costs a wedged machine — and it is the number a slower poll
-/// would move.
-pub fn deadline_lateness_ms(loader: &str) -> Option<u64> {
+/// **Counted from the kernel's own record of arming it** (`log`): the bound
+/// runs from the arm and the expiry is quoted since boot, so the difference
+/// alone is the boot's first tens of milliseconds and not the poll's lateness.
+/// Signed, because both instants are floored milliseconds: an expiry at its
+/// bound can read one early, and one before it is a reading, not an absence.
+pub fn deadline_lateness_ms(loader: &str, log: &str) -> Option<Result<i64, String>> {
     let said = loader.lines().find(|l| l.contains(bootlog::DEADLINE_EXPIRED))?;
-    let (_, rest) = said.split_once("a bound of ")?;
-    let (bound, rest) = rest.split_once(" ms, reached at ")?;
-    let (reached, _) = rest.split_once(" ms,")?;
-    reached.parse::<u64>().ok()?.checked_sub(bound.parse::<u64>().ok()?)
+    let fields = || {
+        let (_, rest) = said.split_once("a bound of ")?;
+        let (bound, rest) = rest.split_once(" ms, reached at ")?;
+        let (reached, _) = rest.split_once(" ms,")?;
+        Some((bound.parse::<i64>().ok()?, reached.parse::<i64>().ok()?))
+    };
+    let armed = || {
+        let line = log.lines().find(|line| line.contains(bootlog::DEADLINE_ARMED))?;
+        i64::try_from(bootlog::record_millis(line)?).ok()
+    };
+    Some(match (fields(), armed()) {
+        (Some((bound, reached)), Some(armed)) => Ok(reached - armed - bound),
+        (None, _) => Err(format!("{said:?} is not the expiry the kernel writes")),
+        (_, None) => Err(format!(
+            "the deadline expired and this boot's log carries no {:?} record to count its bound \
+             from",
+            bootlog::DEADLINE_ARMED
+        )),
+    })
 }
 
 /// What the kernel's stop wrote about itself in `text`: the loader's pass after
@@ -2258,13 +2284,16 @@ pub fn park(text: &str) -> Option<toyos_quiesce::Record> {
 /// bounds it is a different thing: this one lands within one of that detector's
 /// sample periods rather than within one timer period, so a ceiling written for
 /// the poll would say nothing about the counter.
-pub fn lockup_lateness_ms(loader: &str) -> Option<u64> {
+pub fn lockup_lateness_ms(loader: &str) -> Option<Result<i64, String>> {
     let said = loader.lines().find(|l| l.contains(bootlog::LOCKED_UP))?;
-    let (_, rest) = said.split_once("has taken no interrupt for ")?;
-    let (reached, rest) = rest.split_once(" ms,")?;
-    let (_, rest) = rest.split_once("Its bound is ")?;
-    let (bound, _) = rest.split_once(" ms")?;
-    reached.parse::<u64>().ok()?.checked_sub(bound.parse::<u64>().ok()?)
+    let fields = || {
+        let (_, rest) = said.split_once("has taken no interrupt for ")?;
+        let (reached, rest) = rest.split_once(" ms,")?;
+        let (_, rest) = rest.split_once("Its bound is ")?;
+        let (bound, _) = rest.split_once(" ms")?;
+        Some(reached.parse::<i64>().ok()? - bound.parse::<i64>().ok()?)
+    };
+    Some(fields().ok_or_else(|| format!("{said:?} is not the lockup record the kernel writes")))
 }
 
 /// What the two files and this boot's own facts are called under `--readback`.
@@ -2277,6 +2306,35 @@ pub const READBACK_LOADER: &str = "loader.log";
 pub const READBACK_KERNEL: &str = "kernel.log";
 pub const READBACK_BOOT: &str = "boot.txt";
 
+/// The loop's own verdict on the boot: [`PASSED`], or [`REFUSED`] and the
+/// refusal on the lines after it. Written last, so a directory holding it holds
+/// the whole readback, and read by every judge of it, so a run judging these
+/// files later rules on the boot as the run that wrote them did.
+pub const READBACK_VERDICT: &str = "verdict.txt";
+const PASSED: &str = "passed";
+const REFUSED: &str = "refused";
+
+/// [`READBACK_VERDICT`]'s text.
+pub fn verdict_file(refused: Option<&Refusal>) -> String {
+    match refused {
+        None => format!("{PASSED}\n"),
+        Some(why) => format!("{REFUSED}\n{why}\n"),
+    }
+}
+
+/// The loop's verdict a readback carries: `Err` with the refusal's own words
+/// for a boot it refused, or with why the file says neither.
+pub fn loop_verdict(text: &str) -> Result<(), String> {
+    match text.split_once('\n') {
+        Some((PASSED, "")) => Ok(()),
+        Some((REFUSED, why)) if !why.trim().is_empty() => Err(why.trim_end().to_string()),
+        _ => Err(format!(
+            "{READBACK_VERDICT} reads {text:?}, which is neither {PASSED:?} nor {REFUSED:?} and a \
+             reason"
+        )),
+    }
+}
+
 /// The log partition's own bytes, kept beside them under `--fat32-check`: what
 /// the outside judge read, so a complaint can be looked at rather than retold.
 pub const READBACK_VOLUME: &str = "log-partition.img";
@@ -2306,8 +2364,15 @@ pub const PING_AT_KEY: &str = "ping_at";
 
 /// Every file a readback directory carries, so a run that writes none of them
 /// leaves none of the last run's behind.
-pub const READBACK_FILES: &[&str] =
-    &[READBACK_LOADER, READBACK_KERNEL, READBACK_BOOT, READBACK_VOLUME, READBACK_STREAM, READBACK_TALK];
+pub const READBACK_FILES: &[&str] = &[
+    READBACK_LOADER,
+    READBACK_KERNEL,
+    READBACK_BOOT,
+    READBACK_VERDICT,
+    READBACK_VOLUME,
+    READBACK_STREAM,
+    READBACK_TALK,
+];
 
 /// Empty a readback directory, before this run can leave any of it standing.
 ///
@@ -2334,7 +2399,13 @@ pub fn clear_readback(dir: &Path) -> Result<(), Refusal> {
     Ok(())
 }
 
-fn write_readback(dir: &Path, loader: &str, log: &str, boot: &str) -> Result<(), Refusal> {
+fn write_readback(
+    dir: &Path,
+    loader: &str,
+    log: &str,
+    boot: &str,
+    verdict: &str,
+) -> Result<(), Refusal> {
     let wrote = |path: &Path, text: &str| -> Result<(), Refusal> {
         std::fs::write(path, text)
             .map_err(|e| Refusal::File { path: path.display().to_string(), why: e.to_string() })
@@ -2343,7 +2414,8 @@ fn write_readback(dir: &Path, loader: &str, log: &str, boot: &str) -> Result<(),
         .map_err(|e| Refusal::File { path: dir.display().to_string(), why: e.to_string() })?;
     wrote(&dir.join(READBACK_LOADER), loader)?;
     wrote(&dir.join(READBACK_KERNEL), log)?;
-    wrote(&dir.join(READBACK_BOOT), boot)
+    wrote(&dir.join(READBACK_BOOT), boot)?;
+    wrote(&dir.join(READBACK_VERDICT), verdict)
 }
 
 /// [`READBACK_BOOT`]'s text: what the host measured about the boot, and the
@@ -2782,13 +2854,27 @@ mod tests {
 
     #[test]
     fn the_machine_crosses_in_the_boot_file() {
-        let t14 = Machine::parse("LENOVO\n20W000T9GE\nN34ET56W (1.56 )\n").expect("three lines");
+        let t14 = Machine::parse("LENOVO\n20W0003AMZ\nN34ET71W (1.71 )\n").expect("three lines");
         let boot = boot_file(47, 0, &t14, None, None);
         assert_eq!(machine(&boot), Ok(t14));
         assert_eq!(back_secs(&boot), Some(47));
         assert!(machine("back_secs 47\nmachine_vendor LENOVO\n").is_err());
     }
 
+    /// A judge reading the readback later rules on the boot as the loop did.
+    #[test]
+    fn the_loops_verdict_crosses_in_the_readback() {
+        assert_eq!(loop_verdict(&verdict_file(None)), Ok(()));
+        let refused = Refusal::HungWithoutARecord;
+        assert_eq!(
+            loop_verdict(&verdict_file(Some(&refused))),
+            Err(refused.to_string().trim_end().to_string())
+        );
+        for unread in ["", "passed", "passed\nand more\n", "refused\n", "refused\n  \n", "green\n"] {
+            assert!(loop_verdict(unread).is_err(), "{unread:?}");
+        }
+    }
+
     /// **A boot the cable did not answer is not a boot that answered in the
     /// first second, and neither is a boot that was never asked.**
     #[test]
@@ -3342,20 +3428,30 @@ mod tests {
         assert_eq!(ok.bytes % u64::from(LBA), 0);
         assert_ne!(ok.esp.guid, toyos_gpt::Guid::ZERO);
     }
-    /// The lateness comes off the line the kernel writes, and a boot that wrote
-    /// none measures nothing rather than zero.
+    /// The lateness comes off the line the kernel writes, counted from the
+    /// record of arming the bound, and a boot that wrote none measures nothing
+    /// rather than zero.
     #[test]
-    fn the_deadlines_lateness_is_read_off_the_record_the_loader_printed() {
+    fn the_deadlines_lateness_is_counted_from_its_arm() {
         let said = format!(
-            "| {}: a bound of 120000 ms, reached at 120153 ms, with this machine in `complete`. \
+            "| {}: a bound of 120000 ms, reached at 120064 ms, with this machine in `complete`. \
              The tail of the log ring follows.\n",
             bootlog::DEADLINE_EXPIRED
         );
-        assert_eq!(deadline_lateness_ms(&said), Some(153));
-        assert_eq!(deadline_lateness_ms("Previous boot's panic: nothing of the kind\n"), None);
-        // A bound the expiry did not reach is not a negative lateness.
-        let early = said.replace("reached at 120153", "reached at 119000");
-        assert_eq!(deadline_lateness_ms(&early), None);
+        let log = format!(
+            "[2026-09-29 18:22:39 0.060 cpu0] {}120000 ms, after which this kernel seals a \
+             WEDGED record and writes the reset register itself\n",
+            bootlog::DEADLINE_ARMED
+        );
+        assert_eq!(deadline_lateness_ms(&said, &log), Some(Ok(4)));
+        assert_eq!(deadline_lateness_ms("Previous boot's panic: nothing of the kind\n", &log), None);
+        // An expiry before its bound is a reading, not an absence.
+        let early = said.replace("reached at 120064", "reached at 119000");
+        assert_eq!(deadline_lateness_ms(&early, &log), Some(Ok(-1060)));
+        // An expiry with no arm to count from, or one not in the kernel's shape.
+        assert!(matches!(deadline_lateness_ms(&said, "nothing armed\n"), Some(Err(_))));
+        let unread = said.replace("reached at", "reached by");
+        assert!(matches!(deadline_lateness_ms(&unread, &log), Some(Err(_))));
     }
 
     /// The one boot judged by its sealed record and not by the shutdown's word:
@@ -3400,16 +3496,18 @@ mod tests {
             bootlog::LOCKED_UP
         );
         assert_eq!(wedged_boot(&locked, booted), Ok(1200));
-        assert_eq!(lockup_lateness_ms(&locked), Some(4));
+        assert_eq!(lockup_lateness_ms(&locked), Some(Ok(4)));
         // Each bound's lateness is read off its own record and off no other.
-        assert_eq!(deadline_lateness_ms(&locked), None);
+        assert_eq!(deadline_lateness_ms(&locked, booted), None);
         let expired = format!(
             "| {}: a bound of 120000 ms, reached at 120153 ms, with this machine in `complete`.\n",
             bootlog::DEADLINE_EXPIRED
         );
         assert_eq!(lockup_lateness_ms(&expired), None);
-        // A sample that landed before the bound is not a negative lateness.
+        // A sample that landed before the bound is a reading, not an absence.
         let early = locked.replace("for 60004 ms", "for 59000 ms");
-        assert_eq!(lockup_lateness_ms(&early), None);
+        assert_eq!(lockup_lateness_ms(&early), Some(Ok(-1000)));
+        let unread = locked.replace("Its bound is", "Its bound was");
+        assert!(matches!(lockup_lateness_ms(&unread), Some(Err(_))));
     }
 }
diff --git a/src/metaltimings.rs b/src/metaltimings.rs
index 8ceda52b04d..de930057aee 100644
--- a/src/metaltimings.rs
+++ b/src/metaltimings.rs
@@ -3,10 +3,12 @@
 //!
 //! One file per machine under [`DIR`], named for its SMBIOS vendor and product,
 //! written by a run and committed by whoever ran it. A run on a machine with no
-//! record, or with one taken under another BIOS, is recorded and not judged; a
-//! name the record lacks is added and not judged; a recorded value is never
-//! moved by a run, so a slow run cannot become the baseline the next is judged
-//! by. Deleting a row or the file is how a number is re-recorded.
+//! record is recorded and not judged; a name the record lacks is added and not
+//! judged, and only off a boot with no failure of its own; a recorded value is
+//! never moved by a run, so a slow run cannot become the baseline the next is
+//! judged by. A run under a BIOS other than the record's is judged against it,
+//! fails naming both, and records nothing. Deleting a row is how a number is
+//! re-recorded, and deleting the file is how a machine is, firmware and all.
 //!
 //! [`ceiling`] is the one rule.
 
@@ -92,12 +94,11 @@ impl Record {
     /// `machine`'s record under `root`, `None` where it has none.
     pub fn load(root: &Path, machine: &Machine) -> Result<Option<Self>, String> {
         let at = root.join(machine.path());
-        let text = match std::fs::read_to_string(&at) {
-            Ok(text) => text,
-            Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
-            Err(e) => return Err(format!("{}: {e}", at.display())),
+        let record = match Self::read(&at) {
+            Ok(record) => record,
+            Err(Unread::Missing) => return Ok(None),
+            Err(Unread::Refused(why)) => return Err(why),
         };
-        let record: Self = toml::from_str(&text).map_err(|e| format!("{}: {e}", at.display()))?;
         if (record.vendor.as_str(), record.product.as_str())
             != (machine.vendor.as_str(), machine.product.as_str())
         {
@@ -113,6 +114,14 @@ impl Record {
         Ok(Some(record))
     }
 
+    fn read(at: &Path) -> Result<Self, Unread> {
+        let text = std::fs::read_to_string(at).map_err(|e| match e.kind() {
+            std::io::ErrorKind::NotFound => Unread::Missing,
+            _ => Unread::Refused(format!("{}: {e}", at.display())),
+        })?;
+        toml::from_str(&text).map_err(|e| Unread::Refused(format!("{}: {e}", at.display())))
+    }
+
     pub fn save(&self, root: &Path) -> Result<PathBuf, String> {
         let at = root.join(path(&self.vendor, &self.product));
         let text = toml::to_string(self).map_err(|e| e.to_string())?;
@@ -120,14 +129,19 @@ impl Record {
         std::fs::write(&at, text).map_err(|e| format!("{}: {e}", at.display()))?;
         Ok(at)
     }
+}
 
-    /// The recorded value, only where this record was taken under `machine`'s
-    /// BIOS: a value from other firmware judges nothing.
-    pub fn get(&self, machine: &Machine, name: &str) -> Option<u64> {
-        (self.bios == machine.bios)
-            .then(|| self.measured.get(name).copied())
-            .flatten()
-    }
+enum Unread {
+    Missing,
+    Refused(String),
+}
+
+/// One number a run measured, and whether the boot that measured it passed:
+/// every reading is judged, and only a passing boot's becomes a record.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Reading {
+    pub value: u64,
+    pub passed: bool,
 }
 
 /// A reading past [`ceiling`] of its record.
@@ -151,10 +165,31 @@ impl std::fmt::Display for Over {
     }
 }
 
+/// A run under a BIOS other than the one its machine's record was taken under.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Firmware {
+    pub recorded: String,
+    pub ran: String,
+}
+
+impl std::fmt::Display for Firmware {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "this machine's record was taken under BIOS {:?} and this run booted under {:?}, so \
+             it records nothing; deleting the record is how this firmware is recorded afresh",
+            self.recorded, self.ran
+        )
+    }
+}
+
 /// What one run's readings come to on `machine`.
 #[derive(Debug)]
 pub struct Judged {
     pub over: Vec<Over>,
+    pub firmware: Option<Firmware>,
+    /// Recorded names this run measured nothing for.
+    pub unmeasured: Vec<String>,
     /// The record after this run, and whether this run changed it.
     pub record: Record,
     pub changed: bool,
@@ -163,37 +198,41 @@ pub struct Judged {
 pub fn judge(
     machine: &Machine,
     record: Option<Record>,
-    measured: &BTreeMap<String, u64>,
+    measured: &BTreeMap<String, Reading>,
 ) -> Judged {
-    let mut record = match record {
-        Some(record) if record.bios == machine.bios => record,
-        _ => Record {
-            vendor: machine.vendor.clone(),
-            product: machine.product.clone(),
-            bios: machine.bios.clone(),
-            measured: BTreeMap::new(),
-        },
-    };
+    let mut record = record.unwrap_or_else(|| Record {
+        vendor: machine.vendor.clone(),
+        product: machine.product.clone(),
+        bios: machine.bios.clone(),
+        measured: BTreeMap::new(),
+    });
+    let firmware = (record.bios != machine.bios)
+        .then(|| Firmware { recorded: record.bios.clone(), ran: machine.bios.clone() });
+    let unmeasured =
+        record.measured.keys().filter(|name| !measured.contains_key(*name)).cloned().collect();
     let mut over = Vec::new();
     let mut changed = false;
-    for (name, &value) in measured {
+    for (name, reading) in measured {
         match record.measured.get(name) {
-            Some(&recorded) if value > ceiling(recorded) => {
+            Some(&recorded) if reading.value > ceiling(recorded) => {
                 over.push(Over {
                     name: name.clone(),
-                    value,
+                    value: reading.value,
                     recorded,
                 });
             }
             Some(_) => {}
-            None => {
-                record.measured.insert(name.clone(), value);
+            None if reading.passed && firmware.is_none() => {
+                record.measured.insert(name.clone(), reading.value);
                 changed = true;
             }
+            None => {}
         }
     }
     Judged {
         over,
+        firmware,
+        unmeasured,
         record,
         changed,
     }
@@ -203,53 +242,60 @@ pub fn judge(
 mod tests {
     use super::*;
 
+    const BIOS: &str = "N34ET71W (1.71 )";
+
     fn t14(bios: &str) -> Machine {
         Machine {
             vendor: "LENOVO".to_string(),
-            product: "20W000T9GE".to_string(),
+            product: "20W0003AMZ".to_string(),
             bios: bios.to_string(),
         }
     }
 
-    fn readings(pairs: &[(&str, u64)]) -> BTreeMap<String, u64> {
+    fn readings(pairs: &[(&str, u64)]) -> BTreeMap<String, Reading> {
         pairs
             .iter()
-            .map(|(name, value)| ((*name).to_string(), *value))
+            .map(|(name, value)| ((*name).to_string(), Reading { value: *value, passed: true }))
             .collect()
     }
 
+    fn values(pairs: &[(&str, u64)]) -> BTreeMap<String, u64> {
+        pairs.iter().map(|(name, value)| ((*name).to_string(), *value)).collect()
+    }
+
     fn recorded(machine: &Machine, pairs: &[(&str, u64)]) -> Record {
         judge(machine, None, &readings(pairs)).record
     }
 
     #[test]
     fn a_known_machine_within_its_record_passes() {
-        let machine = t14("N34ET56W (1.56 )");
+        let machine = t14(BIOS);
         let record = recorded(
             &machine,
-            &[("boot.a.complete_ms", 1166), ("boot.a.stick_secs", 0)],
+            &[("boot.a.complete_ms", 1166), ("boot.a.panel_max_us", 0)],
         );
         let judged = judge(
             &machine,
             Some(record.clone()),
-            &readings(&[("boot.a.complete_ms", 2332), ("boot.a.stick_secs", 2)]),
+            &readings(&[("boot.a.complete_ms", 2332), ("boot.a.panel_max_us", 2)]),
         );
         assert_eq!(judged.over, Vec::new());
+        assert_eq!(judged.firmware, None);
         assert!(!judged.changed);
         assert_eq!(judged.record, record);
     }
 
     #[test]
     fn a_known_machine_outside_its_record_fails_and_keeps_its_record() {
-        let machine = t14("N34ET56W (1.56 )");
+        let machine = t14(BIOS);
         let record = recorded(
             &machine,
-            &[("boot.a.complete_ms", 1166), ("boot.a.stick_secs", 0)],
+            &[("boot.a.complete_ms", 1166), ("boot.a.panel_max_us", 0)],
         );
         let judged = judge(
             &machine,
             Some(record.clone()),
-            &readings(&[("boot.a.complete_ms", 2333), ("boot.a.stick_secs", 3)]),
+            &readings(&[("boot.a.complete_ms", 2333), ("boot.a.panel_max_us", 3)]),
         );
         assert_eq!(
             judged.over,
@@ -260,7 +306,7 @@ mod tests {
                     recorded: 1166
                 },
                 Over {
-                    name: "boot.a.stick_secs".to_string(),
+                    name: "boot.a.panel_max_us".to_string(),
                     value: 3,
                     recorded: 0
                 },
@@ -274,7 +320,7 @@ mod tests {
 
     #[test]
     fn an_unknown_machine_is_recorded_and_not_judged() {
-        let machine = t14("N34ET56W (1.56 )");
+        let machine = t14(BIOS);
         let judged = judge(
             &machine,
             None,
@@ -284,36 +330,42 @@ mod tests {
         assert!(judged.changed);
         assert_eq!(
             judged.record.measured,
-            readings(&[("boot.a.complete_ms", u64::MAX)])
+            values(&[("boot.a.complete_ms", u64::MAX)])
         );
         assert_eq!(judged.record.bios, machine.bios);
     }
 
+    /// **A firmware update is no re-baseline.** The run is still judged
+    /// against what the machine recorded, fails naming both strings, and adds
+    /// nothing a later run under either BIOS would be judged by.
     #[test]
-    fn another_bios_is_recorded_afresh_and_not_judged() {
+    fn another_bios_fails_naming_both_and_records_nothing() {
         let old = recorded(
             &t14("N34ET50W (1.50 )"),
             &[("boot.a.complete_ms", 1000), ("boot.a.gone_ms", 5)],
         );
-        let machine = t14("N34ET56W (1.56 )");
-        assert_eq!(old.get(&machine, "boot.a.complete_ms"), None);
         let judged = judge(
-            &machine,
-            Some(old),
-            &readings(&[("boot.a.complete_ms", 9000)]),
+            &t14(BIOS),
+            Some(old.clone()),
+            &readings(&[("boot.a.complete_ms", 9000), ("boot.a.new_ms", 1)]),
         );
-        assert_eq!(judged.over, Vec::new());
-        assert!(judged.changed);
-        assert_eq!(judged.record.bios, machine.bios);
         assert_eq!(
-            judged.record.measured,
-            readings(&[("boot.a.complete_ms", 9000)])
+            judged.firmware,
+            Some(Firmware { recorded: "N34ET50W (1.50 )".to_string(), ran: BIOS.to_string() })
         );
+        let said = judged.firmware.as_ref().expect("a firmware finding").to_string();
+        assert!(said.contains("N34ET50W (1.50 )") && said.contains(BIOS), "{said}");
+        assert_eq!(
+            judged.over,
+            vec![Over { name: "boot.a.complete_ms".to_string(), value: 9000, recorded: 1000 }]
+        );
+        assert!(!judged.changed);
+        assert_eq!(judged.record, old);
     }
 
     #[test]
     fn a_new_name_on_a_known_machine_is_recorded_and_not_failed() {
-        let machine = t14("N34ET56W (1.56 )");
+        let machine = t14(BIOS);
         let record = recorded(&machine, &[("boot.a.complete_ms", 1166)]);
         let judged = judge(
             &machine,
@@ -327,34 +379,115 @@ mod tests {
         assert!(judged.changed);
         assert_eq!(
             judged.record.measured,
-            readings(&[
+            values(&[
                 ("boot.a.complete_ms", 1166),
                 ("boot.usbload.panel_us", 21012)
             ])
         );
     }
 
+    /// **A failed boot's numbers are judged and never become a baseline.**
+    #[test]
+    fn a_failing_boots_reading_is_judged_and_not_recorded() {
+        let machine = t14(BIOS);
+        let record = recorded(&machine, &[("boot.a.complete_ms", 1000)]);
+        let failed = |value| Reading { value, passed: false };
+        let measured: BTreeMap<String, Reading> = [
+            ("boot.a.complete_ms".to_string(), failed(2001)),
+            ("boot.b.complete_ms".to_string(), failed(7)),
+            ("boot.c.complete_ms".to_string(), Reading { value: 9, passed: true }),
+        ]
+        .into_iter()
+        .collect();
+        let judged = judge(&machine, Some(record), &measured);
+        assert_eq!(
+            judged.over,
+            vec![Over { name: "boot.a.complete_ms".to_string(), value: 2001, recorded: 1000 }]
+        );
+        assert_eq!(
+            judged.record.measured,
+            values(&[("boot.a.complete_ms", 1000), ("boot.c.complete_ms", 9)])
+        );
+    }
+
+    #[test]
+    fn a_recorded_name_nothing_measured_is_named() {
+        let machine = t14(BIOS);
+        let record = recorded(&machine, &[("boot.a.complete_ms", 1), ("boot.b.complete_ms", 1)]);
+        let judged = judge(&machine, Some(record), &readings(&[("boot.a.complete_ms", 1)]));
+        assert_eq!(judged.unmeasured, vec!["boot.b.complete_ms".to_string()]);
+    }
+
     #[test]
     fn a_record_survives_the_file_it_is_written_to() {
         let root = toyos_tmpdir::TempDir::new("metaltimings");
-        let machine = t14("N34ET56W (1.56 )");
+        let machine = t14(BIOS);
         assert_eq!(Record::load(&root, &machine), Ok(None));
         let record = recorded(
             &machine,
             &[("boot.a.complete_ms", 1166), ("tlb.a.p50_ns", 2258)],
         );
         let at = record.save(&root).expect("save");
-        assert_eq!(at, root.join("tests/metal/lenovo-20w000t9ge.toml"));
+        assert_eq!(at, root.join("tests/metal/lenovo-20w0003amz.toml"));
         assert_eq!(Record::load(&root, &machine), Ok(Some(record)));
     }
 
+    /// The file name folds case and punctuation, so two spellings of one
+    /// vendor land on one file, and the record inside says which it holds.
+    #[test]
+    fn two_machines_sharing_a_file_name_are_refused() {
+        let root = toyos_tmpdir::TempDir::new("metaltimings");
+        let lenovo = Machine { vendor: "Lenovo".to_string(), ..t14(BIOS) };
+        recorded(&lenovo, &[("boot.a.complete_ms", 1)]).save(&root).expect("save");
+        let why = Record::load(&root, &t14(BIOS)).expect_err("read as another machine");
+        assert!(why.contains("two machines share one file name"), "{why}");
+    }
+
+    #[test]
+    fn a_name_recorded_twice_is_refused() {
+        let root = toyos_tmpdir::TempDir::new("metaltimings");
+        let machine = t14(BIOS);
+        let at = recorded(&machine, &[("boot.a.complete_ms", 1)]).save(&root).expect("save");
+        let text = std::fs::read_to_string(&at).expect("the saved record");
+        std::fs::write(&at, format!("{text}\n\"boot.a.complete_ms\" = 2\n")).expect("write");
+        let why = Record::load(&root, &machine).expect_err("a second value under one name");
+        assert!(why.contains("duplicate"), "{why}");
+    }
+
+    /// **Every committed record, as the next run will read it.** A hand edit
+    /// that breaks a file, or a file not at the path its own machine derives,
+    /// is red here rather than at the end of a run on the machine.
+    #[test]
+    fn every_committed_record_loads_from_its_own_path() {
+        let root = Path::new(env!("CARGO_MANIFEST_DIR"));
+        let mut read = 0;
+        for entry in std::fs::read_dir(root.join(DIR)).expect(DIR) {
+            let at = entry.expect(DIR).path();
+            let named = at.strip_prefix(root).expect("under the root").to_path_buf();
+            let record = match Record::read(&at) {
+                Ok(record) => record,
+                Err(Unread::Missing) => panic!("{} went while this read it", named.display()),
+                Err(Unread::Refused(why)) => panic!("{why}"),
+            };
+            let machine = Machine {
+                vendor: record.vendor.clone(),
+                product: record.product.clone(),
+                bios: record.bios.clone(),
+            };
+            assert_eq!(machine.path(), named, "a record is not at its machine's path");
+            assert_eq!(Record::load(root, &machine), Ok(Some(record)));
+            read += 1;
+        }
+        assert!(read > 0, "{DIR} holds no record, so this read nothing");
+    }
+
     #[test]
     fn a_machine_is_three_non_empty_lines() {
         assert_eq!(
-            Machine::parse("LENOVO\n20W000T9GE\nN34ET56W (1.56 )\n"),
-            Ok(t14("N34ET56W (1.56 )"))
+            Machine::parse("LENOVO\n20W0003AMZ\nN34ET71W (1.71 )\n"),
+            Ok(t14(BIOS))
         );
-        assert!(Machine::parse("LENOVO\n20W000T9GE\n").is_err());
-        assert!(Machine::parse("LENOVO\n\nN34ET56W (1.56 )\n").is_err());
+        assert!(Machine::parse("LENOVO\n20W0003AMZ\n").is_err());
+        assert!(Machine::parse("LENOVO\n\nN34ET71W (1.71 )\n").is_err());
     }
 }
diff --git a/tests/common/devices.rs b/tests/common/devices.rs
index 48078c7ff51..225a8c864b6 100644
--- a/tests/common/devices.rs
+++ b/tests/common/devices.rs
@@ -41,7 +41,7 @@ pub fn on_metal(back: &metal::Readback) -> Result<(), String> {
         match measurement(job, code) {
             Err(why) => bad.push(why),
             Ok(span) => {
-                back.measured(&format!("{job}.{}.span_us", back.label), span);
+                bad.extend(back.measured(&format!("{job}.{}.span_us", back.label), span).err());
             }
         }
     }
diff --git a/tests/common/lan.rs b/tests/common/lan.rs
index d2571d4ce27..66036a8a136 100644
--- a/tests/common/lan.rs
+++ b/tests/common/lan.rs
@@ -145,10 +145,7 @@ pub fn on_metal(back: &metal::Readback) -> Result<(), String> {
     }
 
     match link_up_ms(&netd) {
-        Ok(ms) => {
-            eprintln!("  [lan] the link came up {ms} ms after the driver did");
-            back.measured(&format!("lan.{}.link_up_ms", back.label), ms);
-        }
+        Ok(ms) => eprintln!("  [lan] the link came up {ms} ms after the driver did"),
         Err(why) => bad.push(why),
     }
 
@@ -158,7 +155,6 @@ pub fn on_metal(back: &metal::Readback) -> Result<(), String> {
                 "  [lan] leased {}/{} from {} in {} ms, gateway {}, dns {:?}",
                 lease.address, lease.prefix, lease.server, lease.ms, lease.gateway, lease.dns
             );
-            back.measured(&format!("lan.{}.lease_ms", back.label), lease.ms);
             if lease.address != cable.addr {
                 bad.push(format!(
                     "this boot leased {} and the host pinged {}, which the router hands this \
@@ -177,10 +173,9 @@ pub fn on_metal(back: &metal::Readback) -> Result<(), String> {
                 "  [lan] {} answered the host's ping {} s into the window",
                 cable.addr, reply.secs
             );
-            match bootlog::host_second_inside_this_boot(log.text(), cable.skew, LEASE, reply.at) {
-                Ok(()) => back.measured(&format!("boot.{}.ping_secs", back.label), reply.secs),
-                Err(why) => bad.push(why),
-            }
+            bad.extend(
+                bootlog::host_second_inside_this_boot(log.text(), cable.skew, LEASE, reply.at).err(),
+            );
         }
         None => bad.push(format!(
             "nothing answered a ping at {} while this machine was between its two operating \
diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index a80ae944c93..311891198aa 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -14,21 +14,19 @@
 //! always safe and only the author knows.
 
 use std::cell::RefCell;
+use std::collections::btree_map::Entry;
 use std::collections::{BTreeMap, BTreeSet};
+use std::num::NonZeroUsize;
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
 use toyos_build::bootlog;
 use toyos_build::metalimage;
-use toyos_build::metaltimings::{self, Machine, Record};
+use toyos_build::metaltimings::{self, Machine, Reading, Record};
 use toyos_build::testargs::MetalMode;
 
 use super::serial::Serial;
 
-/// Produced only by a boot that took that bound's path: absent where the
-/// machine's record holds one is a boot another bound ended.
-const PATH_TAKEN: &[&str] = &["deadline_lateness_ms", "lockup_lateness_ms"];
-
 /// One boot a metal test needs.
 pub struct Arm {
     /// **The boot this test rides, named.** Two arms naming one boot share an
@@ -118,9 +116,7 @@ pub struct SharedBoot {
     pub params: &'static [&'static str],
     /// The kernel build, empty for the one an image ships.
     pub features: &'static [&'static str],
-    /// At most this many members ride one flash, and the list is cut into
-    /// `<boot>`, `<boot>-2`, … to fit.
-    pub members: usize,
+    pub members: NonZeroUsize,
     /// What the runner spawns, in order — the whole binary name, `test_rs_`
     /// prefix and all, because that is what the kernel records it under.
     pub jobs: Vec<String>,
@@ -152,7 +148,7 @@ fn chunk_name(boot: &str, index: usize) -> String {
 fn sized(shared: &[SharedBoot]) -> Vec<SharedBoot> {
     let mut out = Vec::new();
     for boot in shared {
-        for (index, jobs) in boot.jobs.chunks(boot.members).enumerate() {
+        for (index, jobs) in boot.jobs.chunks(boot.members.get()).enumerate() {
             let named: BTreeSet<&str> = jobs.iter().map(String::as_str).collect();
             let mine = |path: &str| {
                 let last = path.rsplit('/').next().unwrap_or(path);
@@ -207,11 +203,6 @@ pub struct Readback {
     /// What the machine spent getting back to `sshd`.
     pub back_secs: u64,
     /// How long after that the boot stick's own partition was there again.
-    ///
-    /// **The one judge of the device there is.** QEMU cannot wedge a stick, so
-    /// whether a reset left the bench's own device enumerable is a fact only
-    /// this machine holds, and it is a row rather than the reason a mount
-    /// happened to work.
     pub stick_secs: u64,
     /// What the host asked the cable while the machine was between its two
     /// operating systems, and `None` on every boot that named no function to
@@ -335,12 +326,18 @@ impl Readback {
         Ok(())
     }
 
-    /// How far past its bound this boot's deadline fired, or `None` on a boot
-    /// whose deadline did not — which is every boot but the one armed to stop
-    /// itself. Read out of the record the pass after the reset printed, because
-    /// that is the only channel a wedged boot has.
-    pub fn deadline_lateness_ms(&self) -> Option<u64> {
-        toyos_build::metal::deadline_lateness_ms(&self.loader)
+    /// Whether this boot's deadline, where it expired, fired within one timer
+    /// period of its bound: every CPU a staged wedge holds re-arms a one-shot of
+    /// one scheduler quantum, and the timer entry is what polls. Read out of the
+    /// record the pass after the reset printed, because that is the only
+    /// channel a wedged boot has.
+    pub fn deadline_on_time(&self) -> Result<(), String> {
+        let Some(late) = toyos_build::metal::deadline_lateness_ms(&self.loader, &self.kernel)
+        else {
+            return Ok(());
+        };
+        within_one_period(late?, toyos_sched::fair::QUANTUM_NS)
+            .map_err(|why| format!("{}'s boot deadline {why}", self.label))
     }
 
     /// What the on-screen panel cost this boot, off the kernel's own census.
@@ -355,11 +352,15 @@ impl Readback {
         bootlog::panel_census(after.text())
     }
 
-    /// The same for the other bound: how far past its own bound a hard-lockup
-    /// sample was when it found a cpu stuck, or `None` on a boot no cpu locked
-    /// up on. Read out of the same channel and for the same reason.
-    pub fn lockup_lateness_ms(&self) -> Option<u64> {
-        toyos_build::metal::lockup_lateness_ms(&self.loader)
+    /// The same for the other bound: a hard-lockup sample finds a stuck cpu
+    /// within one of its sample periods past its bound. Read out of the same
+    /// channel and for the same reason.
+    pub fn lockup_on_time(&self) -> Result<(), String> {
+        let Some(late) = toyos_build::metal::lockup_lateness_ms(&self.loader) else {
+            return Ok(());
+        };
+        within_one_period(late?, toyos_tco::HARD_LOCKUP_SAMPLE_NS)
+            .map_err(|why| format!("{}'s hard-lockup detector {why}", self.label))
     }
 
     /// The stop's own record, off the page its tail is sealed on: the stop
@@ -368,11 +369,6 @@ impl Readback {
         toyos_build::metal::park(self.after_the_reset().ok()?.text())
     }
 
-    /// Whether the stop stopped the machine, as against how long it spent
-    /// trying, and left no block operation open: an operation lasts only while
-    /// its opener is inside the device, so an open one is a sync claiming
-    /// something about a machine that was still writing. A boot that handed the
-    /// machine back went through the stop and owes its record.
     pub fn stop_completed(&self) -> Result<(), String> {
         let handed_back =
             self.after_the_reset().is_ok_and(|after| after.text().contains(bootlog::HANDED_BACK));
@@ -463,9 +459,20 @@ impl Readback {
     }
 
     /// One number this boot measured, judged by [`run`] against this machine's
-    /// record once every judge has spoken.
-    pub fn measured(&self, name: &str, value: u64) {
-        self.numbers.borrow_mut().insert(name.to_string(), value);
+    /// record once every judge has spoken. A second value under one name is
+    /// refused: which of the two a record kept would be nobody's reading.
+    pub fn measured(&self, name: &str, value: u64) -> Result<(), String> {
+        match self.numbers.borrow_mut().entry(name.to_string()) {
+            Entry::Vacant(slot) => {
+                slot.insert(value);
+                Ok(())
+            }
+            Entry::Occupied(was) => Err(format!(
+                "{} measured {name} twice, {} and then {value}",
+                self.label,
+                was.get()
+            )),
+        }
     }
 
     /// The job ran and the kernel recorded it exiting cleanly.
@@ -505,6 +512,17 @@ impl Readback {
     }
 }
 
+/// A bound's lateness against the period of what polls it, and a millisecond
+/// either way for the two floored readings the lateness is the difference of.
+fn within_one_period(late_ms: i64, period_ns: u64) -> Result<(), String> {
+    let period_ms = i64::try_from(period_ns / 1_000_000).expect("a period in milliseconds");
+    if (-1..=period_ms + 1).contains(&late_ms) {
+        Ok(())
+    } else {
+        Err(format!("fired {late_ms} ms past its bound, and what polls it runs every {period_ms} ms"))
+    }
+}
+
 /// One image, and every test that rides it.
 struct Batch {
     config: &'static str,
@@ -816,6 +834,8 @@ fn read_readback(dir: &Path, label: &str) -> Result<Readback, String> {
             format!("{}: {e} — no readback for {label}; run the driver on its image first", at.display())
         })
     };
+    toyos_build::metal::loop_verdict(&read(toyos_build::metal::READBACK_VERDICT)?)
+        .map_err(|why| format!("toyos-metal refused {label}: {why}"))?;
     let loader = read(toyos_build::metal::READBACK_LOADER)?;
     let log = read(toyos_build::metal::READBACK_KERNEL)?;
     let kernel = bootlog::kernel_records(&log);
@@ -1004,9 +1024,7 @@ pub fn run(
     }
 
     // **The driver's exit is the boot's verdict, and nothing below reads a file
-    // instead of it.** `toyos-metal` exits 1 for the machine and 2 for the loop,
-    // and a boot it refused wrote no readback of its own — so a directory still
-    // holding files after one is holding somebody else's boot.
+    // instead of it.** `toyos-metal` exits 1 for the machine and 2 for the loop.
     let mut refused: BTreeMap<&str, String> = BTreeMap::new();
     if !offline {
         for (label, image) in &images {
@@ -1053,84 +1071,80 @@ pub fn run(
         };
         readbacks.insert(label.clone(), back);
     }
-    // **One machine a run, and its record judges every number the run took.**
-    let machine = one_machine(&readbacks);
-    let record =
-        machine.as_ref().map_err(Clone::clone).and_then(|machine| Record::load(&root, machine));
-    let recorded = |name: &str| match (&machine, &record) {
-        (Ok(machine), Ok(Some(record))) => record.get(machine, name).is_some(),
-        _ => false,
-    };
+    if judge_readbacks(&root, &readbacks, &runs, shared) {
+        Verdict::Red
+    } else {
+        Verdict::Green
+    }
+}
 
+/// Every verdict a run's readbacks carry, and this machine's record judged by
+/// them and added to off the boots that passed: one function of the readbacks,
+/// whether the loop wrote them a moment ago or a run long past did. Answers
+/// whether anything was red.
+fn judge_readbacks(
+    root: &Path,
+    readbacks: &BTreeMap<String, Result<Readback, String>>,
+    runs: &[&(&str, &'static Metal)],
+    shared: &[SharedBoot],
+) -> bool {
     let mut red = false;
+    // **A boot with any failure of its own adds no row**, whether the loop,
+    // the boot's own checks, or a test or member riding it failed.
+    let mut failed: BTreeSet<&str> = BTreeSet::new();
     eprintln!("\n[metal] the boots");
-    for (label, back) in &readbacks {
-        match back {
+    for (label, back) in readbacks {
+        let back = match back {
             Err(why) => {
                 eprintln!("  FAIL {label}: {why}");
-                red = true;
+                failed.insert(label);
+                continue;
             }
-            Ok(back) => {
-                let ms = back.boot_ms.map_or_else(|| "-".to_string(), |ms| ms.to_string());
-                eprintln!(
-                    "  {label}: Boot: complete {ms} ms, back in {} s, the stick enumerated {} s \
-                     after that",
-                    back.back_secs, back.stick_secs
-                );
-                let panel = back.panel();
-                if let Some(panel) = panel {
-                    eprintln!(
-                        "    the panel painted {} time(s) and put {} px on the glass",
-                        panel.paints, panel.pixels
-                    );
-                }
-                for (field, value) in [
-                    ("complete_ms", back.boot_ms),
-                    ("back_secs", Some(back.back_secs)),
-                    ("stick_secs", Some(back.stick_secs)),
-                    ("deadline_lateness_ms", back.deadline_lateness_ms()),
-                    ("lockup_lateness_ms", back.lockup_lateness_ms()),
-                    ("panel_max_us", panel.map(|panel| panel.max_micros)),
-                    ("panel_us", panel.map(|panel| panel.micros)),
-                ] {
-                    let name = format!("boot.{label}.{field}");
-                    match value {
-                        Some(value) => back.measured(&name, value),
-                        None if !PATH_TAKEN.contains(&field) => {
-                            eprintln!("    FAIL {name}: this boot recorded none");
-                            red = true;
-                        }
-                        None if recorded(&name) => {
-                            eprintln!(
-                                "    FAIL {name}: this boot recorded none, and this machine \
-                                 recorded one before — so the bound this boot was armed for is \
-                                 not the one that ended it"
-                            );
-                            red = true;
-                        }
-                        None => {}
-                    }
-                }
-                // **Every boot, and before any verdict is read out of its
-                // log.** A test's judge reads the file the stick came back
-                // with, so a file that stops before the boot does turns a
-                // machine fact into a missing line — and the missing line is
-                // what a reader would have to guess about.
-                if let Err(why) = back.log_reached_the_stick() {
-                    eprintln!("    FAIL {why}");
-                    red = true;
-                }
-                if let Err(why) = back.stop_completed() {
-                    eprintln!("    FAIL {why}");
-                    red = true;
-                }
+            Ok(back) => back,
+        };
+        let ms = back.boot_ms.map_or_else(|| "-".to_string(), |ms| ms.to_string());
+        eprintln!(
+            "  {label}: Boot: complete {ms} ms, back in {} s, the stick enumerated {} s after that",
+            back.back_secs, back.stick_secs
+        );
+        let panel = back.panel();
+        if let Some(panel) = panel {
+            eprintln!(
+                "    the panel painted {} time(s) and put {} px on the glass",
+                panel.paints, panel.pixels
+            );
+        }
+        let mut findings: Vec<String> = Vec::new();
+        for (field, value) in [
+            ("complete_ms", back.boot_ms),
+            ("panel_max_us", panel.map(|panel| panel.max_micros)),
+            ("panel_us", panel.map(|panel| panel.micros)),
+        ] {
+            let name = format!("boot.{label}.{field}");
+            match value {
+                Some(value) => findings.extend(back.measured(&name, value).err()),
+                None => findings.push(format!("{name}: this boot recorded none")),
             }
         }
+        // **Every boot, and before any verdict is read out of its log.** A
+        // test's judge reads the file the stick came back with, so a file that
+        // stops before the boot does turns a machine fact into a missing line —
+        // and the missing line is what a reader would have to guess about.
+        findings.extend(back.log_reached_the_stick().err());
+        findings.extend(back.stop_completed().err());
+        findings.extend(back.deadline_on_time().err());
+        findings.extend(back.lockup_on_time().err());
+        for why in &findings {
+            eprintln!("    FAIL {why}");
+        }
+        if !findings.is_empty() {
+            failed.insert(label);
+        }
     }
 
     eprintln!("\n[metal] the tests");
     let mut passed = 0usize;
-    for (name, decl) in &runs {
+    for (name, decl) in runs {
         let Metal::Runs { arms, judge } = decl else { continue };
         let mut owed: Vec<&Readback> = Vec::new();
         let mut missing: Option<String> = None;
@@ -1151,7 +1165,7 @@ pub fn run(
             }
             Err(why) => {
                 eprintln!("  FAIL {name}: {why}");
-                red = true;
+                failed.extend(arms.iter().map(|arm| arm.boot));
             }
         }
     }
@@ -1178,45 +1192,70 @@ pub fn run(
                 // bury the four that matter.
                 Err(why) => {
                     eprintln!("  FAIL {job}: {}", why.lines().next().unwrap_or(&why));
-                    red = true;
+                    failed.insert(&boot.boot);
                 }
             }
         }
-        // **What a member of this list actually cost.** Over the members that
-        // ran and not the members the list named: a boot the bound cut short
-        // would otherwise report a cost that looks smaller the more of its list
-        // it lost.
         if let (Ok(back), true) = (back, ran > 0) {
             if let (Some(complete), Some(last)) = (back.boot_ms, back.last_record_ms()) {
                 let each = last.saturating_sub(complete) / ran as u64;
                 eprintln!("  {} ms per member over the {ran} that ran", each);
-                back.measured(&format!("list.{}.job_ms", boot.boot), each);
             }
         }
     }
+    red |= !failed.is_empty();
+
     eprintln!("\n[metal] the timings");
-    let measured: BTreeMap<String, u64> = readbacks
-        .values()
-        .filter_map(|back| back.as_ref().ok())
-        .flat_map(|back| back.numbers.borrow().clone())
-        .collect();
+    let mut measured: BTreeMap<String, Reading> = BTreeMap::new();
+    for (label, back) in readbacks {
+        let Ok(back) = back else { continue };
+        let passed = !failed.contains(label.as_str());
+        for (name, &value) in back.numbers.borrow().iter() {
+            match measured.entry(name.clone()) {
+                Entry::Vacant(slot) => {
+                    slot.insert(Reading { value, passed });
+                }
+                // Judged on the first, and recorded off neither.
+                Entry::Occupied(mut first) => {
+                    eprintln!("  FAIL {name} is measured by two boots, and {label} is the second");
+                    first.get_mut().passed = false;
+                    red = true;
+                }
+            }
+        }
+    }
+    let machine = one_machine(readbacks);
+    let record =
+        machine.as_ref().map_err(Clone::clone).and_then(|machine| Record::load(root, machine));
     match (machine, record) {
         (Ok(machine), Ok(record)) => {
             let judged = metaltimings::judge(&machine, record, &measured);
+            if let Some(firmware) = &judged.firmware {
+                eprintln!("  FAIL {firmware}");
+                red = true;
+            }
             for over in &judged.over {
                 eprintln!("  FAIL {over}");
                 red = true;
             }
+            if !judged.unmeasured.is_empty() {
+                eprintln!(
+                    "  {} recorded number(s) this run measured nothing for: {}",
+                    judged.unmeasured.len(),
+                    judged.unmeasured.join(", ")
+                );
+            }
             eprintln!(
-                "  {} number(s) on {} {}, BIOS {}; {} past its record",
+                "  {} number(s) on {} {}, BIOS {}; {} past its record, {} off a boot that failed",
                 measured.len(),
                 machine.vendor,
                 machine.product,
                 machine.bios,
-                judged.over.len()
+                judged.over.len(),
+                measured.values().filter(|reading| !reading.passed).count()
             );
             if judged.changed {
-                match judged.record.save(&root) {
+                match judged.record.save(root) {
                     Ok(at) => eprintln!(
                         "  {} now records {} number(s) for this machine: commit it",
                         at.display(),
@@ -1237,12 +1276,242 @@ pub fn run(
     eprintln!(
         "\n[metal] {passed} passed, {} failed, {} boot(s)",
         runs.len() + members - passed,
-        batches.len()
+        readbacks.len()
     );
-    if red {
-        Verdict::Red
-    } else {
-        Verdict::Green
-    }
+    red
 }
 
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use toyos_build::metal::{
+        verdict_file, Refusal, BACK_SECS, BIOS_KEY, PRODUCT_KEY, READBACK_BOOT, READBACK_KERNEL,
+        READBACK_LOADER, READBACK_VERDICT, STICK_SECS_KEY, VENDOR_KEY,
+    };
+
+    const PANEL: &str = "| panel: paints=10 px=8741248 us=21751 max_us=3851\n";
+    const BOOTED: &str = "[2026-09-29 18:22:39 1.165 cpu0] Boot: complete (1165ms)\n";
+
+    fn t14() -> Machine {
+        Machine {
+            vendor: "LENOVO".to_string(),
+            product: "20W0003AMZ".to_string(),
+            bios: "N34ET71W (1.71 )".to_string(),
+        }
+    }
+
+    /// A `loader.log` whose pass after the reset reads `page`.
+    fn loader(page: &str) -> String {
+        format!(
+            "{}\n{}\n{}\n{}\n{page}",
+            bootlog::LOADER_FIRST_LINE,
+            bootlog::LOADER_LAST_LINE,
+            bootlog::SEPARATOR,
+            bootlog::LOADER_FIRST_LINE
+        )
+    }
+
+    fn back(loader: String, kernel: &str) -> Readback {
+        Readback {
+            label: "planted".to_string(),
+            home: PathBuf::new(),
+            loader,
+            kernel: kernel.to_string(),
+            log: kernel.to_string(),
+            boot_ms: bootlog::boot_millis(kernel),
+            back_secs: 40,
+            stick_secs: 0,
+            cable: None,
+            machine: Ok(t14()),
+            numbers: RefCell::new(BTreeMap::new()),
+        }
+    }
+
+    /// The record of arming the deadline, at the 60 ms the T14 arms it.
+    fn armed() -> String {
+        format!(
+            "[2026-09-29 18:22:39 0.060 cpu0] {}120000 ms, after which this kernel seals a WEDGED \
+             record and writes the reset register itself\n{BOOTED}",
+            bootlog::DEADLINE_ARMED
+        )
+    }
+
+    fn expired_at(reached: i64) -> String {
+        format!(
+            "{PANEL}| {}: a bound of 120000 ms, reached at {reached} ms, with this machine in \
+             `complete`.\n",
+            bootlog::DEADLINE_EXPIRED
+        )
+    }
+
+    /// **The stop's two refusals, each on the page that has to draw it**: a
+    /// boot that handed the machine back owes the stop's record, and a record
+    /// with a block operation still open is a sync about a machine that was
+    /// still writing.
+    #[test]
+    fn the_stop_owes_its_record_and_leaves_no_operation_open() {
+        let whole = toyos_quiesce::Record {
+            sweep: toyos_quiesce::Sweep { stopped: 6, running: 0 },
+            elapsed_ms: 11,
+            budget_ms: 2010,
+            sweeps: 3,
+            cpus: 8,
+            in_flight: 0,
+            begun: 4812,
+        };
+        let handed_back =
+            |stop: &str| loader(&format!("Black box: {}\n{PANEL}{stop}", bootlog::HANDED_BACK));
+        assert_eq!(back(handed_back(&format!("| {whole}\n")), BOOTED).stop_completed(), Ok(()));
+        let why = back(handed_back(""), BOOTED)
+            .stop_completed()
+            .expect_err("a boot that handed the machine back with no record of its stop");
+        assert!(why.contains("carries no record of the stop"), "{why}");
+        let open = toyos_quiesce::Record { in_flight: 1, ..whole };
+        let why = back(handed_back(&format!("| {open}\n")), BOOTED)
+            .stop_completed()
+            .expect_err("a stop that left an operation open");
+        assert!(why.contains("1 block operation(s) open"), "{why}");
+        let ended = loader(&format!("Previous boot's panic: the last boot read WEDGED\n{PANEL}"));
+        assert_eq!(back(ended, BOOTED).stop_completed(), Ok(()));
+    }
+
+    /// Each bound's lateness against the period of what polls it, a
+    /// millisecond either way and no further.
+    #[test]
+    fn a_bound_fires_within_one_period_of_itself() {
+        let quantum = i64::try_from(toyos_sched::fair::QUANTUM_NS / 1_000_000).expect("ms");
+        let deadline = |late: i64| back(loader(&expired_at(120_060 + late)), &armed()).deadline_on_time();
+        assert_eq!(deadline(4), Ok(()));
+        assert_eq!(deadline(quantum + 1), Ok(()));
+        assert!(deadline(quantum + 2).is_err());
+        assert_eq!(deadline(-1), Ok(()));
+        assert!(deadline(-2).is_err());
+        let unarmed = back(loader(&expired_at(120_064)), BOOTED).deadline_on_time();
+        assert!(unarmed.is_err(), "an expiry with no arm to count from passed");
+
+        let sample = i64::try_from(toyos_tco::HARD_LOCKUP_SAMPLE_NS / 1_000_000).expect("ms");
+        let lockup = |late: i64| {
+            back(
+                loader(&format!(
+                    "{PANEL}| {}: cpu7 has taken no interrupt for {} ms, with `IF` clear at \
+                     every sample in that span. Its bound is 60000 ms.\n",
+                    bootlog::LOCKED_UP,
+                    60_000 + late
+                )),
+                BOOTED,
+            )
+            .lockup_on_time()
+        };
+        assert_eq!(lockup(4), Ok(()));
+        assert_eq!(lockup(sample + 1), Ok(()));
+        assert!(lockup(sample + 2).is_err());
+
+        let neither = back(loader(PANEL), BOOTED);
+        assert_eq!((neither.deadline_on_time(), neither.lockup_on_time()), (Ok(()), Ok(())));
+    }
+
+    #[test]
+    fn a_name_measured_twice_is_refused() {
+        let planted = back(loader(PANEL), BOOTED);
+        assert_eq!(planted.measured("span.planted.us", 1), Ok(()));
+        let why = planted.measured("span.planted.us", 2).expect_err("a second value");
+        assert!(why.contains("twice"), "{why}");
+    }
+
+    fn span(b: &[&Readback]) -> Result<(), String> {
+        b[0].measured(&format!("span.{}.us", b[0].label), 7)
+    }
+
+    fn span_and_fail(b: &[&Readback]) -> Result<(), String> {
+        span(b)?;
+        Err("a planted failure".to_string())
+    }
+
+    fn unqualified(b: &[&Readback]) -> Result<(), String> {
+        b[0].measured("latency.p99_us", 16)
+    }
+
+    static PASSING: Metal =
+        Metal::Runs { arms: &[once("passing", "tests/jobcase", &[], &[])], judge: span };
+    static FAILING: Metal =
+        Metal::Runs { arms: &[once("failing", "tests/jobcase", &[], &[])], judge: span_and_fail };
+    static REFUSED: Metal =
+        Metal::Runs { arms: &[once("refused", "tests/jobcase", &[], &[])], judge: span };
+    static LATE: Metal = Metal::Runs { arms: &[once("late", "tests/jobcase", &[], &[])], judge: span };
+    static ONE: Metal =
+        Metal::Runs { arms: &[once("one", "tests/jobcase", &[], &[])], judge: unqualified };
+    static TWO: Metal =
+        Metal::Runs { arms: &[once("two", "tests/jobcase", &[], &[])], judge: unqualified };
+
+    /// One boot's readback as the loop writes it.
+    fn plant(dir: &Path, label: &str, page: &str, kernel: &str, verdict: Option<&Refusal>) {
+        let home = at(dir, label);
+        std::fs::create_dir_all(&home).expect("a readback directory");
+        let boot = format!(
+            "{BACK_SECS} 40\n{STICK_SECS_KEY} 0\n{VENDOR_KEY} LENOVO\n{PRODUCT_KEY} 20W0003AMZ\n\
+             {BIOS_KEY} N34ET71W (1.71 )\n"
+        );
+        for (name, text) in [
+            (READBACK_LOADER, loader(page)),
+            (READBACK_KERNEL, kernel.to_string()),
+            (READBACK_BOOT, boot),
+            (READBACK_VERDICT, verdict_file(verdict)),
+        ] {
+            std::fs::write(home.join(name), text).expect("a planted file");
+        }
+    }
+
+    fn read(dir: &Path, labels: &[&str]) -> BTreeMap<String, Result<Readback, String>> {
+        labels.iter().map(|label| (label.to_string(), read_readback(dir, label))).collect()
+    }
+
+    /// **The record is one function of the readbacks.** A boot the loop
+    /// refused, a boot a riding test failed and a boot whose own check failed
+    /// are each judged, and none adds a row; the one boot with no failure of
+    /// its own is recorded whole.
+    #[test]
+    fn a_boot_with_a_failure_of_its_own_adds_no_row() {
+        let dir = toyos_tmpdir::TempDir::new("metal-readbacks");
+        let root = toyos_tmpdir::TempDir::new("metal-records");
+        plant(&dir, "passing", PANEL, BOOTED, None);
+        plant(&dir, "failing", PANEL, BOOTED, None);
+        plant(&dir, "refused", PANEL, BOOTED, Some(&Refusal::HungWithoutARecord));
+        plant(&dir, "late", &expired_at(120_160), &armed(), None);
+        let readbacks = read(&dir, &["passing", "failing", "refused", "late"]);
+        let why = readbacks["refused"].as_ref().err().expect("the loop's refusal, read back");
+        assert!(why.contains("never reported: no panic"), "{why}");
+
+        let tests =
+            [("passes", &PASSING), ("fails", &FAILING), ("refused", &REFUSED), ("late", &LATE)];
+        let runs: Vec<&(&str, &'static Metal)> = tests.iter().collect();
+        assert!(judge_readbacks(&root, &readbacks, &runs, &[]), "three failed boots judged green");
+        let record = Record::load(&root, &t14()).expect("a readable record").expect("a record");
+        let names: Vec<&str> = record.measured.keys().map(String::as_str).collect();
+        assert_eq!(
+            names,
+            [
+                "boot.passing.complete_ms",
+                "boot.passing.panel_max_us",
+                "boot.passing.panel_us",
+                "span.passing.us"
+            ]
+        );
+    }
+
+    /// Two boots under one name are judged on the first reading and recorded
+    /// off neither.
+    #[test]
+    fn a_name_two_boots_measured_is_refused() {
+        let dir = toyos_tmpdir::TempDir::new("metal-readbacks");
+        let root = toyos_tmpdir::TempDir::new("metal-records");
+        plant(&dir, "one", PANEL, BOOTED, None);
+        plant(&dir, "two", PANEL, BOOTED, None);
+        let readbacks = read(&dir, &["one", "two"]);
+        let tests = [("one", &ONE), ("two", &TWO)];
+        let runs: Vec<&(&str, &'static Metal)> = tests.iter().collect();
+        assert!(judge_readbacks(&root, &readbacks, &runs, &[]), "one name twice judged green");
+        let record = Record::load(&root, &t14()).expect("a readable record").expect("a record");
+        assert!(!record.measured.contains_key("latency.p99_us"), "{:?}", record.measured);
+        assert_eq!(record.measured.len(), 6, "{:?}", record.measured);
+    }
+}
diff --git a/tests/common/power.rs b/tests/common/power.rs
index 4d376d0238d..b1969430230 100644
--- a/tests/common/power.rs
+++ b/tests/common/power.rs
@@ -1756,10 +1756,10 @@ const WEDGE_PHASES: &[(&[&str], Phase)] = &[
 ///
 /// **What an emulator can prove here and what it cannot.** Whether a device
 /// survives being cut is the T14's own stick to answer and nothing here can ask
-/// it; `boot.usbload.stick_secs` is where it is asked. What this arm judges is
-/// that the machine really stopped inside a command and that the reset's
-/// account names which one — the only evidence a reset leaves about what it
-/// found. [`Profile::Metal`](qemu::Profile::Metal) carries the boot stick on
+/// it. What this arm judges is that the machine really stopped inside a
+/// command and that the reset's account names which one — the only evidence a
+/// reset leaves about what it found.
+/// [`Profile::Metal`](qemu::Profile::Metal) carries the boot stick on
 /// its xHCI, which is why the wedge has a device to be inside at all.
 pub fn usb_reset_records_the_phase_it_cut(
     _test_config: &Path,
@@ -1789,8 +1789,7 @@ pub fn usb_reset_records_the_phase_it_cut(
 /// **This machine's disk is the image, and no guest here has the gibibyte the
 /// sweep demands.** What a guest can establish is that the arm says so by name
 /// and lets the boot end, rather than silently staging nothing and reading back
-/// as a wedge that never happened. That it streams at all, and what a reset
-/// landing on it does to a device, is `boot.usbload.stick_secs` on the T14.
+/// as a wedge that never happened.
 fn the_load_refuses_a_disk_with_no_room() -> Result<(), String> {
     let config = super::compile::repo_root().join("tests/jobcase/system.toml");
     let case = config.parent().expect("system.toml has a directory");
@@ -2563,12 +2562,9 @@ fn one_reset_path(case: &Path, arm: &ResetPath) -> Result<(), String> {
 /// The T14's judge for [`usb_reset_hands_devices_back`].
 ///
 /// **The machine is the judge of the device, and nothing else is.** QEMU cannot
-/// wedge a stick, and what says the boot before this one left the bench's own
-/// device enumerable is the driver's `boot.<boot>.stick_secs` row — recorded
-/// before the mount, so it is a number and not the reason a mount happened to
-/// work. What is left for this to read is the reset's own account, which on this
-/// machine is in `loader.log`'s pass after the reset rather than in any file the
-/// kernel wrote.
+/// wedge a stick. What is left for this to read is the reset's own account,
+/// which on this machine is in `loader.log`'s pass after the reset rather than
+/// in any file the kernel wrote.
 ///
 /// Both arms are orderly reboots, so both owe the barrier. The panic path's
 /// account is judged under QEMU only: on this machine a kernel that panics
diff --git a/tests/metal/lenovo-20w0003amz.toml b/tests/metal/lenovo-20w0003amz.toml
index 7925a613041..ca67376be64 100644
--- a/tests/metal/lenovo-20w0003amz.toml
+++ b/tests/metal/lenovo-20w0003amz.toml
@@ -3,153 +3,58 @@ product = "20W0003AMZ"
 bios = "N34ET71W (1.71 )"
 
 [measured]
-"boot.ccorpus-2.back_secs" = 51
 "boot.ccorpus-2.complete_ms" = 1170
 "boot.ccorpus-2.panel_max_us" = 3878
 "boot.ccorpus-2.panel_us" = 21089
-"boot.ccorpus-2.stick_secs" = 0
-"boot.ccorpus.back_secs" = 65
-"boot.ccorpus.complete_ms" = 1166
-"boot.ccorpus.panel_max_us" = 3802
-"boot.ccorpus.panel_us" = 22095
-"boot.ccorpus.stick_secs" = 0
-"boot.deadlinewedge.back_secs" = 162
-"boot.deadlinewedge.complete_ms" = 1165
-"boot.deadlinewedge.deadline_lateness_ms" = 65
-"boot.deadlinewedge.panel_max_us" = 3788
-"boot.deadlinewedge.panel_us" = 21678
-"boot.deadlinewedge.stick_secs" = 0
-"boot.foreignrecord.back_secs" = 42
-"boot.foreignrecord.complete_ms" = 1165
-"boot.foreignrecord.stick_secs" = 0
-"boot.hardlockup.back_secs" = 125
 "boot.hardlockup.complete_ms" = 1164
-"boot.hardlockup.lockup_lateness_ms" = 0
 "boot.hardlockup.panel_max_us" = 3949
 "boot.hardlockup.panel_us" = 21772
-"boot.hardlockup.stick_secs" = 0
-"boot.jobcase.back_secs" = 40
-"boot.jobcase.complete_ms" = 1164
-"boot.jobcase.panel_max_us" = 3793
-"boot.jobcase.panel_us" = 21957
-"boot.jobcase.stick_secs" = 0
-"boot.lancase.back_secs" = 61
-"boot.lancase.complete_ms" = 1164
-"boot.lancase.panel_max_us" = 3778
-"boot.lancase.panel_us" = 21602
-"boot.lancase.stick_secs" = 0
-"boot.lanicscase.back_secs" = 70
 "boot.lanicscase.complete_ms" = 1171
 "boot.lanicscase.panel_max_us" = 4000
 "boot.lanicscase.panel_us" = 21420
-"boot.lanicscase.stick_secs" = 0
-"boot.lanleasecase.back_secs" = 71
 "boot.lanleasecase.complete_ms" = 1165
 "boot.lanleasecase.panel_max_us" = 3841
 "boot.lanleasecase.panel_us" = 22280
-"boot.lanleasecase.stick_secs" = 0
-"boot.lanswapcase.back_secs" = 80
 "boot.lanswapcase.complete_ms" = 1165
 "boot.lanswapcase.panel_max_us" = 7061
 "boot.lanswapcase.panel_us" = 26663
-"boot.lanswapcase.stick_secs" = 0
-"boot.lantalkcase.back_secs" = 65
-"boot.lantalkcase.complete_ms" = 1165
-"boot.lantalkcase.panel_max_us" = 3733
-"boot.lantalkcase.panel_us" = 23197
-"boot.lantalkcase.stick_secs" = 0
-"boot.latencycase.back_secs" = 44
 "boot.latencycase.complete_ms" = 1165
 "boot.latencycase.panel_max_us" = 3887
 "boot.latencycase.panel_us" = 21459
-"boot.latencycase.stick_secs" = 0
-"boot.logstallcase.back_secs" = 55
 "boot.logstallcase.complete_ms" = 1165
 "boot.logstallcase.panel_max_us" = 3906
 "boot.logstallcase.panel_us" = 22531
-"boot.logstallcase.stick_secs" = 0
-"boot.metalcase.back_secs" = 39
 "boot.metalcase.complete_ms" = 1165
 "boot.metalcase.panel_max_us" = 3844
 "boot.metalcase.panel_us" = 21526
-"boot.metalcase.stick_secs" = 0
-"boot.metaldevicecase.back_secs" = 56
 "boot.metaldevicecase.complete_ms" = 1165
 "boot.metaldevicecase.panel_max_us" = 3837
 "boot.metaldevicecase.panel_us" = 23002
-"boot.metaldevicecase.stick_secs" = 0
-"boot.selftests.back_secs" = 44
-"boot.selftests.complete_ms" = 1171
-"boot.selftests.panel_max_us" = 3909
-"boot.selftests.panel_us" = 22457
-"boot.selftests.stick_secs" = 0
-"boot.shared-2.back_secs" = 59
 "boot.shared-2.complete_ms" = 1165
 "boot.shared-2.panel_max_us" = 3721
 "boot.shared-2.panel_us" = 21855
-"boot.shared-2.stick_secs" = 0
-"boot.shared-debug.back_secs" = 46
 "boot.shared-debug.complete_ms" = 1165
 "boot.shared-debug.panel_max_us" = 3791
 "boot.shared-debug.panel_us" = 21483
-"boot.shared-debug.stick_secs" = 0
-"boot.shared.back_secs" = 56
-"boot.shared.complete_ms" = 1202
-"boot.shared.panel_max_us" = 3868
-"boot.shared.panel_us" = 21247
-"boot.shared.stick_secs" = 0
-"boot.testcases-deaf.back_secs" = 61
 "boot.testcases-deaf.complete_ms" = 1165
 "boot.testcases-deaf.panel_max_us" = 5247
 "boot.testcases-deaf.panel_us" = 26659
-"boot.testcases-deaf.stick_secs" = 0
-"boot.testcases-debug.back_secs" = 44
 "boot.testcases-debug.complete_ms" = 1165
 "boot.testcases-debug.panel_max_us" = 3824
 "boot.testcases-debug.panel_us" = 22032
-"boot.testcases-debug.stick_secs" = 0
-"boot.testcases-mkdir.back_secs" = 54
 "boot.testcases-mkdir.complete_ms" = 1166
 "boot.testcases-mkdir.panel_max_us" = 3839
 "boot.testcases-mkdir.panel_us" = 22100
-"boot.testcases-mkdir.stick_secs" = 0
-"boot.testcases-readdir.back_secs" = 46
 "boot.testcases-readdir.complete_ms" = 1166
 "boot.testcases-readdir.panel_max_us" = 3868
 "boot.testcases-readdir.panel_us" = 21680
-"boot.testcases-readdir.stick_secs" = 0
-"boot.testcases-watchdog.back_secs" = 49
-"boot.testcases-watchdog.complete_ms" = 1190
-"boot.testcases-watchdog.panel_max_us" = 3815
-"boot.testcases-watchdog.panel_us" = 22451
-"boot.testcases-watchdog.stick_secs" = 0
-"boot.testcases-window.back_secs" = 47
 "boot.testcases-window.complete_ms" = 1165
 "boot.testcases-window.panel_max_us" = 3822
 "boot.testcases-window.panel_us" = 22472
-"boot.testcases-window.stick_secs" = 0
-"boot.testcases.back_secs" = 54
-"boot.testcases.complete_ms" = 1165
-"boot.testcases.panel_max_us" = 3827
-"boot.testcases.panel_us" = 21502
-"boot.testcases.stick_secs" = 0
-"boot.usbload.back_secs" = 166
-"boot.usbload.complete_ms" = 1170
-"boot.usbload.deadline_lateness_ms" = 68
-"boot.usbload.panel_max_us" = 3959
-"boot.usbload.panel_us" = 20656
-"boot.usbload.stick_secs" = 0
 "fbcheck.metaldevicecase.span_us" = 221570
 "fbfill.metaldevicecase.span_us" = 13885
 "fbread.metaldevicecase.span_us" = 313347
-"lan.lancase.lease_ms" = 13353
-"lan.lancase.link_up_ms" = 2797
 "latency.p99_us" = 16
-"list.ccorpus-2.job_ms" = 116
-"list.ccorpus.job_ms" = 123
-"list.shared-2.job_ms" = 419
-"list.shared-debug.job_ms" = 383
-"list.shared.job_ms" = 353
 "tlb.latencycase.p50_ns" = 2194
 "tlb.latencycase.p99_ns" = 3740
 "usbread.metaldevicecase.span_us" = 36393
diff --git a/tests/toyos-rust-tests/src/bin/cyclictest.rs b/tests/toyos-rust-tests/src/bin/cyclictest.rs
index c2dcca747c5..65b2a207171 100644
--- a/tests/toyos-rust-tests/src/bin/cyclictest.rs
+++ b/tests/toyos-rust-tests/src/bin/cyclictest.rs
@@ -22,9 +22,8 @@
 //! writes itself is its `exit: <name> pid=N code=N cpu=Nms` record, which
 //! carries the whole `i32`.
 //! So the headline number leaves through the exit code: a non-negative code is
-//! a measured p99 in microseconds, bounded above by [`BUCKETS`] because a p99
-//! at the histogram's last bucket is a floor rather than a measurement; a
-//! negative one is a [`Refusal`] and no number in that run means anything.
+//! a measured p99 in microseconds; a negative one is a [`Refusal`] and no
+//! number in that run means anything.
 //! `userland/metalprobe` spells the same contract for the device suite, and the
 //! sign is what separates the two halves of it there as here. Every percentile
 //! is on stdout as well, for the host that has a console to read it on.
@@ -60,6 +59,8 @@ const BUCKETS: usize = 4096;
 enum Refusal {
     NoCapability = -1,
     BandRefused = -2,
+    /// The p99 is past the histogram's last bucket: a floor, not a measurement.
+    PastTheHistogram = -3,
 }
 
 fn refuse(why: Refusal, said: &str) -> ! {
@@ -111,27 +112,36 @@ fn main() {
         }
     }
 
-    let percentile = |want: usize| -> u64 {
+    // `None` where the sample wanted is in the overflow, which has no bucket to
+    // name.
+    let percentile = |want: usize| -> Option<u64> {
         let mut seen = 0usize;
         for (us, count) in histogram.iter().enumerate() {
             seen += *count as usize;
             if seen >= want {
-                return us as u64;
+                return Some(us as u64);
             }
         }
-        // Every remaining sample is in the overflow, which has no bucket to name.
-        BUCKETS as u64
+        None
     };
+    let shown = |p: Option<u64>| p.map_or_else(|| format!(">{}", BUCKETS - 1), |us| us.to_string());
 
     let p50 = percentile(SAMPLES / 2);
     let p90 = percentile(SAMPLES * 9 / 10);
     let p99 = percentile(SAMPLES * 99 / 100);
     let p999 = percentile(SAMPLES * 999 / 1000);
     println!(
-        "cyclictest: {SAMPLES} wakes at {}us: p50={p50}us p90={p90}us p99={p99}us \
-         p99.9={p999}us max={worst}us, {overflow} past the {BUCKETS}us histogram",
+        "cyclictest: {SAMPLES} wakes at {}us: p50={}us p90={}us p99={}us p99.9={}us \
+         max={worst}us, {overflow} past the {BUCKETS}us histogram",
         PERIOD_NS / 1_000,
+        shown(p50),
+        shown(p90),
+        shown(p99),
+        shown(p999),
     );
+    let Some(p99) = p99 else {
+        refuse(Refusal::PastTheHistogram, "the p99 is past the histogram, so it is a floor");
+    };
 
     exit(p99 as i32);
 }
diff --git a/tests/toyos.rs b/tests/toyos.rs
index 522252dfdd7..e8af71c8d94 100644
--- a/tests/toyos.rs
+++ b/tests/toyos.rs
@@ -1829,9 +1829,8 @@ const METAL: &[(&str, metal::Metal)] = &[
             // has.
             judge: |b| {
                 let (p50, p99) = tlb_shootdown_cost(b[0].kernel().text(), b[0].cpus()?)?;
-                b[0].measured("tlb.latencycase.p50_ns", p50);
-                b[0].measured("tlb.latencycase.p99_ns", p99);
-                Ok(())
+                b[0].measured("tlb.latencycase.p50_ns", p50)?;
+                b[0].measured("tlb.latencycase.p99_ns", p99)
             },
         },
     ),
@@ -1879,8 +1878,6 @@ const METAL: &[(&str, metal::Metal)] = &[
         // One boot: a machine writing to the stick continuously, reset out from
         // under itself by the deadline with the controller mid-transfer, and
         // the stick enumerable on the next host afterwards.
-        // `boot.usbload.stick_secs` is that, refused by the loop before this
-        // judge runs.
         "usb_reset_records_the_phase_it_cut",
         metal::Metal::Runs {
             arms: &[metal::once("usbload", "tests/jobcase", &["usb-reset-under-load"], &[])],
@@ -2270,7 +2267,7 @@ fn shared_metal(
             config: "tests/testcases",
             params: &[],
             features: &[],
-            members: 38,
+            members: const { std::num::NonZeroUsize::new(38).expect("a chunk holds a member") },
             jobs: shipping
                 .iter()
                 .filter(|n| keep(n))
@@ -2289,7 +2286,7 @@ fn shared_metal(
             config: "tests/testcases",
             params: &[],
             features: toyos_build::build::TEST_KERNEL,
-            members: 18,
+            members: const { std::num::NonZeroUsize::new(18).expect("a chunk holds a member") },
             jobs: debug.iter().filter(|n| keep(n)).map(|n| format!("test_rs_{n}")).collect(),
             files: Vec::new(),
             links: Vec::new(),
@@ -2409,7 +2406,7 @@ fn c_corpus_metal(
         config: "tests/testcases",
         params: &[],
         features: &[],
-        members: 90,
+        members: const { std::num::NonZeroUsize::new(90).expect("a chunk holds a member") },
         jobs,
         files,
         links,
@@ -15470,9 +15467,6 @@ fn tlb_shootdown_cost(log: &str, cpus: u32) -> Result<(u64, u64), String> {
     Ok((p50, p99))
 }
 
-/// `latency_wake` on a machine with no console: the p99, off the kernel's own
-/// exit record.
-///
 /// A negative code is `cyclictest`'s refusal and not a fast machine — the sign
 /// is the whole of what separates the two, and that contract is in the binary's
 /// own module header.
@@ -15480,16 +15474,11 @@ fn wake_latency_recorded(boot: &metal::Readback) -> Result<(), String> {
     let code = boot.exit_code("test_rs_cyclictest")?;
     if code < 0 {
         return Err(format!(
-            "cyclictest exited {code}, which is a refusal and not a measurement: -1 is no \
-             capability endowed, -2 is the real-time band refused"
+            "cyclictest exited {code}, which is a refusal and not a measurement; its own last \
+             line in the boot's log says which"
         ));
     }
-    // cyclictest's `BUCKETS`: a p99 there is a floor and not a measurement.
-    if code >= 4096 {
-        return Err(format!("cyclictest's p99 is {code} us, past its histogram"));
-    }
-    boot.measured("latency.p99_us", u64::try_from(code).expect("a non-negative code"));
-    Ok(())
+    boot.measured("latency.p99_us", u64::try_from(code).expect("a non-negative code"))
 }
 
 /// The negative control, executed: an AP left holding what `INIT` gave it, and
diff --git a/toyos-tco/src/lib.rs b/toyos-tco/src/lib.rs
index cc805064d09..bb4c4efccea 100644
--- a/toyos-tco/src/lib.rs
+++ b/toyos-tco/src/lib.rs
@@ -168,6 +168,15 @@ pub const HARD_LOCKUP_BOUND_MS: u64 = hard_lockup_bound_ms(WEDGE_BOUND_MS);
 /// hard-locked machine is reported as an ordinary wedge and the CPU is unnamed.
 const _: () = assert!(HARD_LOCKUP_BOUND_MS < WEDGE_BOUND_MS);
 
+/// How often an armed CPU samples itself against [`hard_lockup_bound_ms`], in
+/// nanoseconds of unhalted time, and so how late past that bound a stuck CPU
+/// can be found.
+///
+/// A second: the bound is measured in tens of them, so a sample period this
+/// long costs one NMI per CPU per second and puts the detection within one
+/// period of the bound. It is also the period the report's ages are quoted at.
+pub const HARD_LOCKUP_SAMPLE_NS: u64 = 1_000_000_000;
+
 /// The boot parameter that arms [`WEDGE_BOUND_MS`], with the bound in
 /// milliseconds after it. A value and not a flag, because the bound is the one
 /// thing about this mechanism a boot can legitimately differ on — a negative

From 9f99a908f73a84db5a9b12d219d147cf1369f5d0 Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Tue, 29 Sep 2026 21:46:54 +0200
Subject: [PATCH 06/10] The metal harness's checks live where only the checks
 target compiles them

`cargo clippy --all-targets` builds `tests/toyos.rs` as the `harness =
false` target too, with `cfg(test)` on and no `--test`: a `#[test]` there
is dropped and every helper it called is dead code, which `-D warnings`
refuses. The checks move to `tests/checks/metal.rs`, beside the other
harness checks, and build every readback the way the loop writes one and
a run reads one: planted files read back through `read_readback`, which
with `judge_readbacks` and `at` is now public. `run` calls all three, so
nothing is dead in either target.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tests/checks.rs       |  27 +++++
 tests/checks/metal.rs | 219 ++++++++++++++++++++++++++++++++++++++
 tests/common/metal.rs | 241 +-----------------------------------------
 3 files changed, 249 insertions(+), 238 deletions(-)
 create mode 100644 tests/checks/metal.rs

diff --git a/tests/checks.rs b/tests/checks.rs
index df6e8f1ed7a..6fa71583a06 100644
--- a/tests/checks.rs
+++ b/tests/checks.rs
@@ -11,6 +11,8 @@ mod checks {
     mod audio_checks;
     #[path = "clock.rs"]
     mod clock_checks;
+    #[path = "metal.rs"]
+    mod metal_checks;
     #[path = "qemu.rs"]
     mod qemu_checks;
     #[path = "screen.rs"]
@@ -625,6 +627,31 @@ mod checks {
         audio_checks::judges_verdict()
     }
 
+    #[test]
+    fn metal_stop_owes_its_record_and_leaves_no_operation_open() {
+        metal_checks::the_stop_owes_its_record_and_leaves_no_operation_open();
+    }
+
+    #[test]
+    fn metal_bound_fires_within_one_period_of_itself() {
+        metal_checks::a_bound_fires_within_one_period_of_itself();
+    }
+
+    #[test]
+    fn metal_name_measured_twice_is_refused() {
+        metal_checks::a_name_measured_twice_is_refused();
+    }
+
+    #[test]
+    fn metal_boot_with_a_failure_of_its_own_adds_no_row() {
+        metal_checks::a_boot_with_a_failure_of_its_own_adds_no_row();
+    }
+
+    #[test]
+    fn metal_name_two_boots_measured_is_refused() {
+        metal_checks::a_name_two_boots_measured_is_refused();
+    }
+
     #[test]
     fn metal_list_from_parse_reaches_run_without_the_machine() -> Result<(), String> {
         let args: Vec<String> = ["--metal", "--list"].iter().map(ToString::to_string).collect();
diff --git a/tests/checks/metal.rs b/tests/checks/metal.rs
new file mode 100644
index 00000000000..b612f56f2f3
--- /dev/null
+++ b/tests/checks/metal.rs
@@ -0,0 +1,219 @@
+//! The metal harness's rules over planted readbacks, each written as the loop
+//! writes one and read as a run reads one.
+
+use super::*;
+use metal::{Metal, Readback};
+use toyos_build::metal::{
+    verdict_file, Refusal, BACK_SECS, BIOS_KEY, PRODUCT_KEY, READBACK_BOOT, READBACK_KERNEL,
+    READBACK_LOADER, READBACK_VERDICT, STICK_SECS_KEY, VENDOR_KEY,
+};
+use toyos_build::metaltimings::{Machine, Record};
+
+const PANEL: &str = "| panel: paints=10 px=8741248 us=21751 max_us=3851\n";
+const BOOTED: &str = "[2026-09-29 18:22:39 1.165 cpu0] Boot: complete (1165ms)\n";
+
+fn t14() -> Machine {
+    Machine {
+        vendor: "LENOVO".to_string(),
+        product: "20W0003AMZ".to_string(),
+        bios: "N34ET71W (1.71 )".to_string(),
+    }
+}
+
+/// A `loader.log` whose pass after the reset reads `page`.
+fn loader(page: &str) -> String {
+    format!(
+        "{}\n{}\n{}\n{}\n{page}",
+        bootlog::LOADER_FIRST_LINE,
+        bootlog::LOADER_LAST_LINE,
+        bootlog::SEPARATOR,
+        bootlog::LOADER_FIRST_LINE
+    )
+}
+
+/// The record of arming the deadline, at the 60 ms the T14 arms it.
+fn armed() -> String {
+    format!(
+        "[2026-09-29 18:22:39 0.060 cpu0] {}120000 ms, after which this kernel seals a WEDGED \
+         record and writes the reset register itself\n{BOOTED}",
+        bootlog::DEADLINE_ARMED
+    )
+}
+
+fn expired_at(reached: i64) -> String {
+    format!(
+        "{PANEL}| {}: a bound of 120000 ms, reached at {reached} ms, with this machine in \
+         `complete`.\n",
+        bootlog::DEADLINE_EXPIRED
+    )
+}
+
+/// One boot's readback as the loop writes it.
+fn plant(dir: &Path, label: &str, page: &str, kernel: &str, verdict: Option<&Refusal>) {
+    let home = metal::at(dir, label);
+    fs::create_dir_all(&home).expect("a readback directory");
+    let boot = format!(
+        "{BACK_SECS} 40\n{STICK_SECS_KEY} 0\n{VENDOR_KEY} LENOVO\n{PRODUCT_KEY} 20W0003AMZ\n\
+         {BIOS_KEY} N34ET71W (1.71 )\n"
+    );
+    for (name, text) in [
+        (READBACK_LOADER, loader(page)),
+        (READBACK_KERNEL, kernel.to_string()),
+        (READBACK_BOOT, boot),
+        (READBACK_VERDICT, verdict_file(verdict)),
+    ] {
+        fs::write(home.join(name), text).expect("a planted file");
+    }
+}
+
+/// One boot the loop passed, read back.
+fn planted(page: &str, kernel: &str) -> Readback {
+    let dir = toyos_tmpdir::TempDir::new("metal-readback");
+    plant(&dir, "planted", page, kernel, None);
+    metal::read_readback(&dir, "planted").expect("a planted readback")
+}
+
+fn read(dir: &Path, labels: &[&str]) -> BTreeMap<String, Result<Readback, String>> {
+    labels.iter().map(|label| (label.to_string(), metal::read_readback(dir, label))).collect()
+}
+
+/// **The stop's two refusals, each on the page that has to draw it**: a boot
+/// that handed the machine back owes the stop's record, and a record with a
+/// block operation still open is a sync about a machine that was still writing.
+pub fn the_stop_owes_its_record_and_leaves_no_operation_open() {
+    let whole = toyos_quiesce::Record {
+        sweep: toyos_quiesce::Sweep { stopped: 6, running: 0 },
+        elapsed_ms: 11,
+        budget_ms: 2010,
+        sweeps: 3,
+        cpus: 8,
+        in_flight: 0,
+        begun: 4812,
+    };
+    let handed_back = |stop: &str| format!("Black box: {}\n{PANEL}{stop}", bootlog::HANDED_BACK);
+    assert_eq!(planted(&handed_back(&format!("| {whole}\n")), BOOTED).stop_completed(), Ok(()));
+    let why = planted(&handed_back(""), BOOTED)
+        .stop_completed()
+        .expect_err("a boot that handed the machine back with no record of its stop");
+    assert!(why.contains("carries no record of the stop"), "{why}");
+    let open = toyos_quiesce::Record { in_flight: 1, ..whole };
+    let why = planted(&handed_back(&format!("| {open}\n")), BOOTED)
+        .stop_completed()
+        .expect_err("a stop that left an operation open");
+    assert!(why.contains("1 block operation(s) open"), "{why}");
+    let ended = format!("Previous boot's panic: the last boot read WEDGED\n{PANEL}");
+    assert_eq!(planted(&ended, BOOTED).stop_completed(), Ok(()));
+}
+
+/// Each bound's lateness against the period of what polls it, a millisecond
+/// either way and no further.
+pub fn a_bound_fires_within_one_period_of_itself() {
+    let quantum = i64::try_from(toyos_sched::fair::QUANTUM_NS / 1_000_000).expect("ms");
+    let deadline = |late: i64| planted(&expired_at(120_060 + late), &armed()).deadline_on_time();
+    assert_eq!(deadline(4), Ok(()));
+    assert_eq!(deadline(quantum + 1), Ok(()));
+    assert!(deadline(quantum + 2).is_err());
+    assert_eq!(deadline(-1), Ok(()));
+    assert!(deadline(-2).is_err());
+    let unarmed = planted(&expired_at(120_064), BOOTED).deadline_on_time();
+    assert!(unarmed.is_err(), "an expiry with no arm to count from passed");
+
+    let sample = i64::try_from(toyos_tco::HARD_LOCKUP_SAMPLE_NS / 1_000_000).expect("ms");
+    let lockup = |late: i64| {
+        let page = format!(
+            "{PANEL}| {}: cpu7 has taken no interrupt for {} ms, with `IF` clear at every \
+             sample in that span. Its bound is 60000 ms.\n",
+            bootlog::LOCKED_UP,
+            60_000 + late
+        );
+        planted(&page, BOOTED).lockup_on_time()
+    };
+    assert_eq!(lockup(4), Ok(()));
+    assert_eq!(lockup(sample + 1), Ok(()));
+    assert!(lockup(sample + 2).is_err());
+
+    let neither = planted(PANEL, BOOTED);
+    assert_eq!((neither.deadline_on_time(), neither.lockup_on_time()), (Ok(()), Ok(())));
+}
+
+pub fn a_name_measured_twice_is_refused() {
+    let back = planted(PANEL, BOOTED);
+    assert_eq!(back.measured("span.planted.us", 1), Ok(()));
+    let why = back.measured("span.planted.us", 2).expect_err("a second value");
+    assert!(why.contains("twice"), "{why}");
+}
+
+fn span(b: &[&Readback]) -> Result<(), String> {
+    b[0].measured(&format!("span.{}.us", b[0].label), 7)
+}
+
+fn span_and_fail(b: &[&Readback]) -> Result<(), String> {
+    span(b)?;
+    Err("a planted failure".to_string())
+}
+
+fn unqualified(b: &[&Readback]) -> Result<(), String> {
+    b[0].measured("latency.p99_us", 16)
+}
+
+static PASSING: Metal =
+    Metal::Runs { arms: &[metal::once("passing", "tests/jobcase", &[], &[])], judge: span };
+static FAILING: Metal = Metal::Runs {
+    arms: &[metal::once("failing", "tests/jobcase", &[], &[])],
+    judge: span_and_fail,
+};
+static REFUSED: Metal =
+    Metal::Runs { arms: &[metal::once("refused", "tests/jobcase", &[], &[])], judge: span };
+static LATE: Metal =
+    Metal::Runs { arms: &[metal::once("late", "tests/jobcase", &[], &[])], judge: span };
+static ONE: Metal =
+    Metal::Runs { arms: &[metal::once("one", "tests/jobcase", &[], &[])], judge: unqualified };
+static TWO: Metal =
+    Metal::Runs { arms: &[metal::once("two", "tests/jobcase", &[], &[])], judge: unqualified };
+
+/// **The record is one function of the readbacks.** A boot the loop refused, a
+/// boot a riding test failed and a boot whose own check failed are each
+/// judged, and none adds a row; the one boot with no failure of its own is
+/// recorded whole.
+pub fn a_boot_with_a_failure_of_its_own_adds_no_row() {
+    let dir = toyos_tmpdir::TempDir::new("metal-readbacks");
+    let root = toyos_tmpdir::TempDir::new("metal-records");
+    plant(&dir, "passing", PANEL, BOOTED, None);
+    plant(&dir, "failing", PANEL, BOOTED, None);
+    plant(&dir, "refused", PANEL, BOOTED, Some(&Refusal::HungWithoutARecord));
+    plant(&dir, "late", &expired_at(120_160), &armed(), None);
+    let readbacks = read(&dir, &["passing", "failing", "refused", "late"]);
+    let why = readbacks["refused"].as_ref().err().expect("the loop's refusal, read back");
+    assert!(why.contains("never reported: no panic"), "{why}");
+
+    let tests = [("passes", &PASSING), ("fails", &FAILING), ("refused", &REFUSED), ("late", &LATE)];
+    let runs: Vec<&(&str, &'static Metal)> = tests.iter().collect();
+    assert!(metal::judge_readbacks(&root, &readbacks, &runs, &[]), "three failed boots judged green");
+    let record = Record::load(&root, &t14()).expect("a readable record").expect("a record");
+    let names: Vec<&str> = record.measured.keys().map(String::as_str).collect();
+    assert_eq!(
+        names,
+        [
+            "boot.passing.complete_ms",
+            "boot.passing.panel_max_us",
+            "boot.passing.panel_us",
+            "span.passing.us"
+        ]
+    );
+}
+
+/// Two boots under one name are judged on the first reading and recorded off
+/// neither.
+pub fn a_name_two_boots_measured_is_refused() {
+    let dir = toyos_tmpdir::TempDir::new("metal-readbacks");
+    let root = toyos_tmpdir::TempDir::new("metal-records");
+    plant(&dir, "one", PANEL, BOOTED, None);
+    plant(&dir, "two", PANEL, BOOTED, None);
+    let readbacks = read(&dir, &["one", "two"]);
+    let tests = [("one", &ONE), ("two", &TWO)];
+    let runs: Vec<&(&str, &'static Metal)> = tests.iter().collect();
+    assert!(metal::judge_readbacks(&root, &readbacks, &runs, &[]), "one name twice judged green");
+    let record = Record::load(&root, &t14()).expect("a readable record").expect("a record");
+    assert!(!record.measured.contains_key("latency.p99_us"), "{:?}", record.measured);
+    assert_eq!(record.measured.len(), 6, "{:?}", record.measured);
+}
diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 311891198aa..15541eb5e39 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -550,7 +550,7 @@ impl Batch {
 }
 
 /// Where a batch's derived config, its image and its readback live.
-fn at(dir: &Path, label: &str) -> PathBuf {
+pub fn at(dir: &Path, label: &str) -> PathBuf {
     dir.join(label)
 }
 
@@ -826,7 +826,7 @@ fn swap_invocation(home: &Path, service: &str) -> Vec<String> {
     .to_vec()
 }
 
-fn read_readback(dir: &Path, label: &str) -> Result<Readback, String> {
+pub fn read_readback(dir: &Path, label: &str) -> Result<Readback, String> {
     let home = at(dir, label);
     let read = |name: &str| -> Result<String, String> {
         let at = home.join(name);
@@ -1082,7 +1082,7 @@ pub fn run(
 /// them and added to off the boots that passed: one function of the readbacks,
 /// whether the loop wrote them a moment ago or a run long past did. Answers
 /// whether anything was red.
-fn judge_readbacks(
+pub fn judge_readbacks(
     root: &Path,
     readbacks: &BTreeMap<String, Result<Readback, String>>,
     runs: &[&(&str, &'static Metal)],
@@ -1280,238 +1280,3 @@ fn judge_readbacks(
     );
     red
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use toyos_build::metal::{
-        verdict_file, Refusal, BACK_SECS, BIOS_KEY, PRODUCT_KEY, READBACK_BOOT, READBACK_KERNEL,
-        READBACK_LOADER, READBACK_VERDICT, STICK_SECS_KEY, VENDOR_KEY,
-    };
-
-    const PANEL: &str = "| panel: paints=10 px=8741248 us=21751 max_us=3851\n";
-    const BOOTED: &str = "[2026-09-29 18:22:39 1.165 cpu0] Boot: complete (1165ms)\n";
-
-    fn t14() -> Machine {
-        Machine {
-            vendor: "LENOVO".to_string(),
-            product: "20W0003AMZ".to_string(),
-            bios: "N34ET71W (1.71 )".to_string(),
-        }
-    }
-
-    /// A `loader.log` whose pass after the reset reads `page`.
-    fn loader(page: &str) -> String {
-        format!(
-            "{}\n{}\n{}\n{}\n{page}",
-            bootlog::LOADER_FIRST_LINE,
-            bootlog::LOADER_LAST_LINE,
-            bootlog::SEPARATOR,
-            bootlog::LOADER_FIRST_LINE
-        )
-    }
-
-    fn back(loader: String, kernel: &str) -> Readback {
-        Readback {
-            label: "planted".to_string(),
-            home: PathBuf::new(),
-            loader,
-            kernel: kernel.to_string(),
-            log: kernel.to_string(),
-            boot_ms: bootlog::boot_millis(kernel),
-            back_secs: 40,
-            stick_secs: 0,
-            cable: None,
-            machine: Ok(t14()),
-            numbers: RefCell::new(BTreeMap::new()),
-        }
-    }
-
-    /// The record of arming the deadline, at the 60 ms the T14 arms it.
-    fn armed() -> String {
-        format!(
-            "[2026-09-29 18:22:39 0.060 cpu0] {}120000 ms, after which this kernel seals a WEDGED \
-             record and writes the reset register itself\n{BOOTED}",
-            bootlog::DEADLINE_ARMED
-        )
-    }
-
-    fn expired_at(reached: i64) -> String {
-        format!(
-            "{PANEL}| {}: a bound of 120000 ms, reached at {reached} ms, with this machine in \
-             `complete`.\n",
-            bootlog::DEADLINE_EXPIRED
-        )
-    }
-
-    /// **The stop's two refusals, each on the page that has to draw it**: a
-    /// boot that handed the machine back owes the stop's record, and a record
-    /// with a block operation still open is a sync about a machine that was
-    /// still writing.
-    #[test]
-    fn the_stop_owes_its_record_and_leaves_no_operation_open() {
-        let whole = toyos_quiesce::Record {
-            sweep: toyos_quiesce::Sweep { stopped: 6, running: 0 },
-            elapsed_ms: 11,
-            budget_ms: 2010,
-            sweeps: 3,
-            cpus: 8,
-            in_flight: 0,
-            begun: 4812,
-        };
-        let handed_back =
-            |stop: &str| loader(&format!("Black box: {}\n{PANEL}{stop}", bootlog::HANDED_BACK));
-        assert_eq!(back(handed_back(&format!("| {whole}\n")), BOOTED).stop_completed(), Ok(()));
-        let why = back(handed_back(""), BOOTED)
-            .stop_completed()
-            .expect_err("a boot that handed the machine back with no record of its stop");
-        assert!(why.contains("carries no record of the stop"), "{why}");
-        let open = toyos_quiesce::Record { in_flight: 1, ..whole };
-        let why = back(handed_back(&format!("| {open}\n")), BOOTED)
-            .stop_completed()
-            .expect_err("a stop that left an operation open");
-        assert!(why.contains("1 block operation(s) open"), "{why}");
-        let ended = loader(&format!("Previous boot's panic: the last boot read WEDGED\n{PANEL}"));
-        assert_eq!(back(ended, BOOTED).stop_completed(), Ok(()));
-    }
-
-    /// Each bound's lateness against the period of what polls it, a
-    /// millisecond either way and no further.
-    #[test]
-    fn a_bound_fires_within_one_period_of_itself() {
-        let quantum = i64::try_from(toyos_sched::fair::QUANTUM_NS / 1_000_000).expect("ms");
-        let deadline = |late: i64| back(loader(&expired_at(120_060 + late)), &armed()).deadline_on_time();
-        assert_eq!(deadline(4), Ok(()));
-        assert_eq!(deadline(quantum + 1), Ok(()));
-        assert!(deadline(quantum + 2).is_err());
-        assert_eq!(deadline(-1), Ok(()));
-        assert!(deadline(-2).is_err());
-        let unarmed = back(loader(&expired_at(120_064)), BOOTED).deadline_on_time();
-        assert!(unarmed.is_err(), "an expiry with no arm to count from passed");
-
-        let sample = i64::try_from(toyos_tco::HARD_LOCKUP_SAMPLE_NS / 1_000_000).expect("ms");
-        let lockup = |late: i64| {
-            back(
-                loader(&format!(
-                    "{PANEL}| {}: cpu7 has taken no interrupt for {} ms, with `IF` clear at \
-                     every sample in that span. Its bound is 60000 ms.\n",
-                    bootlog::LOCKED_UP,
-                    60_000 + late
-                )),
-                BOOTED,
-            )
-            .lockup_on_time()
-        };
-        assert_eq!(lockup(4), Ok(()));
-        assert_eq!(lockup(sample + 1), Ok(()));
-        assert!(lockup(sample + 2).is_err());
-
-        let neither = back(loader(PANEL), BOOTED);
-        assert_eq!((neither.deadline_on_time(), neither.lockup_on_time()), (Ok(()), Ok(())));
-    }
-
-    #[test]
-    fn a_name_measured_twice_is_refused() {
-        let planted = back(loader(PANEL), BOOTED);
-        assert_eq!(planted.measured("span.planted.us", 1), Ok(()));
-        let why = planted.measured("span.planted.us", 2).expect_err("a second value");
-        assert!(why.contains("twice"), "{why}");
-    }
-
-    fn span(b: &[&Readback]) -> Result<(), String> {
-        b[0].measured(&format!("span.{}.us", b[0].label), 7)
-    }
-
-    fn span_and_fail(b: &[&Readback]) -> Result<(), String> {
-        span(b)?;
-        Err("a planted failure".to_string())
-    }
-
-    fn unqualified(b: &[&Readback]) -> Result<(), String> {
-        b[0].measured("latency.p99_us", 16)
-    }
-
-    static PASSING: Metal =
-        Metal::Runs { arms: &[once("passing", "tests/jobcase", &[], &[])], judge: span };
-    static FAILING: Metal =
-        Metal::Runs { arms: &[once("failing", "tests/jobcase", &[], &[])], judge: span_and_fail };
-    static REFUSED: Metal =
-        Metal::Runs { arms: &[once("refused", "tests/jobcase", &[], &[])], judge: span };
-    static LATE: Metal = Metal::Runs { arms: &[once("late", "tests/jobcase", &[], &[])], judge: span };
-    static ONE: Metal =
-        Metal::Runs { arms: &[once("one", "tests/jobcase", &[], &[])], judge: unqualified };
-    static TWO: Metal =
-        Metal::Runs { arms: &[once("two", "tests/jobcase", &[], &[])], judge: unqualified };
-
-    /// One boot's readback as the loop writes it.
-    fn plant(dir: &Path, label: &str, page: &str, kernel: &str, verdict: Option<&Refusal>) {
-        let home = at(dir, label);
-        std::fs::create_dir_all(&home).expect("a readback directory");
-        let boot = format!(
-            "{BACK_SECS} 40\n{STICK_SECS_KEY} 0\n{VENDOR_KEY} LENOVO\n{PRODUCT_KEY} 20W0003AMZ\n\
-             {BIOS_KEY} N34ET71W (1.71 )\n"
-        );
-        for (name, text) in [
-            (READBACK_LOADER, loader(page)),
-            (READBACK_KERNEL, kernel.to_string()),
-            (READBACK_BOOT, boot),
-            (READBACK_VERDICT, verdict_file(verdict)),
-        ] {
-            std::fs::write(home.join(name), text).expect("a planted file");
-        }
-    }
-
-    fn read(dir: &Path, labels: &[&str]) -> BTreeMap<String, Result<Readback, String>> {
-        labels.iter().map(|label| (label.to_string(), read_readback(dir, label))).collect()
-    }
-
-    /// **The record is one function of the readbacks.** A boot the loop
-    /// refused, a boot a riding test failed and a boot whose own check failed
-    /// are each judged, and none adds a row; the one boot with no failure of
-    /// its own is recorded whole.
-    #[test]
-    fn a_boot_with_a_failure_of_its_own_adds_no_row() {
-        let dir = toyos_tmpdir::TempDir::new("metal-readbacks");
-        let root = toyos_tmpdir::TempDir::new("metal-records");
-        plant(&dir, "passing", PANEL, BOOTED, None);
-        plant(&dir, "failing", PANEL, BOOTED, None);
-        plant(&dir, "refused", PANEL, BOOTED, Some(&Refusal::HungWithoutARecord));
-        plant(&dir, "late", &expired_at(120_160), &armed(), None);
-        let readbacks = read(&dir, &["passing", "failing", "refused", "late"]);
-        let why = readbacks["refused"].as_ref().err().expect("the loop's refusal, read back");
-        assert!(why.contains("never reported: no panic"), "{why}");
-
-        let tests =
-            [("passes", &PASSING), ("fails", &FAILING), ("refused", &REFUSED), ("late", &LATE)];
-        let runs: Vec<&(&str, &'static Metal)> = tests.iter().collect();
-        assert!(judge_readbacks(&root, &readbacks, &runs, &[]), "three failed boots judged green");
-        let record = Record::load(&root, &t14()).expect("a readable record").expect("a record");
-        let names: Vec<&str> = record.measured.keys().map(String::as_str).collect();
-        assert_eq!(
-            names,
-            [
-                "boot.passing.complete_ms",
-                "boot.passing.panel_max_us",
-                "boot.passing.panel_us",
-                "span.passing.us"
-            ]
-        );
-    }
-
-    /// Two boots under one name are judged on the first reading and recorded
-    /// off neither.
-    #[test]
-    fn a_name_two_boots_measured_is_refused() {
-        let dir = toyos_tmpdir::TempDir::new("metal-readbacks");
-        let root = toyos_tmpdir::TempDir::new("metal-records");
-        plant(&dir, "one", PANEL, BOOTED, None);
-        plant(&dir, "two", PANEL, BOOTED, None);
-        let readbacks = read(&dir, &["one", "two"]);
-        let tests = [("one", &ONE), ("two", &TWO)];
-        let runs: Vec<&(&str, &'static Metal)> = tests.iter().collect();
-        assert!(judge_readbacks(&root, &readbacks, &runs, &[]), "one name twice judged green");
-        let record = Record::load(&root, &t14()).expect("a readable record").expect("a record");
-        assert!(!record.measured.contains_key("latency.p99_us"), "{:?}", record.measured);
-        assert_eq!(record.measured.len(), 6, "{:?}", record.measured);
-    }
-}

From 30253ef25c23a9ee59ea52db5560da9387a1c881 Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Tue, 29 Sep 2026 23:13:01 +0200
Subject: [PATCH 07/10] Answer the second review of #630: the record's judge is
 driven with a record and a shared boot

`judge_readbacks` was driven only with nothing recorded under its root
and no shared boot, so deleting `failed.insert(&boot.boot)`, or either
`red = true` of the firmware and over arms, left every check green.
Three checks now drive it with both:

- a reading past its record reds the run and moves nothing, and the
  same boot against a record it meets is green;
- a run under another BIOS reds and records nothing, and the same
  record under the run's own BIOS is green and gains the row it lacks;
- a failing shared member reds the run, and its boot adds no row while
  the boot beside it is recorded whole.

The verdict writer had no host check, because only `run` reached it
and `run` needs a machine. The tail of `run` (judge the boot, write the
readback with that verdict last, return the verdict) is now
`judge_and_write_readback`, and a lib test drives it with a boot the
loop refuses and one it passes and reads back what each wrote.

Deleted, as the review asked: the claims that a shared list is sized to
the runner's bound, that the profile prices a metalprobe command's name
or refuses a span it cannot fail, that a ceiling judges the lockup's
lateness, and that cyclictest's last bucket reports a floor.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/metal.rs                                 | 75 +++++++++++++---
 tests/checks.rs                              | 15 ++++
 tests/checks/metal.rs                        | 91 ++++++++++++++++++++
 tests/common/metal.rs                        |  7 --
 tests/toyos-rust-tests/src/bin/cyclictest.rs |  3 -
 userland/metalprobe/src/main.rs              |  7 +-
 6 files changed, 173 insertions(+), 25 deletions(-)

diff --git a/src/metal.rs b/src/metal.rs
index 6e686bfb6e2..f5a01bc11a6 100644
--- a/src/metal.rs
+++ b/src/metal.rs
@@ -2106,22 +2106,35 @@ pub fn run(args: &Args) -> Result<Option<u64>, Refusal> {
         }
         println!("toyos-fat32-check: the log partition's {} bytes check out", bytes.len());
     }
-    // **Judged before the readback is written, and written into it**, so a
-    // judge reading the directory later reads the verdict this run returns.
-    let verdict = boot_verdict(&armed, &loader, &log).and_then(|ms| {
+    let boot = boot_file(back, stick, &machine, wire.as_ref(), replied);
+    judge_and_write_readback(&armed, &loader, &log, heard.as_ref(), args.readback.as_deref(), &boot)
+        .map(Some)
+}
+
+/// This boot's verdict, **judged before the readback is written, and written
+/// into it**, so a judge reading the directory later reads the verdict this
+/// run returns.
+fn judge_and_write_readback(
+    armed: &[String],
+    loader: &str,
+    log: &str,
+    heard: Option<&(Result<crate::metaltalk::Conversation, String>, Vec<String>)>,
+    readback: Option<&Path>,
+    boot: &str,
+) -> Result<u64, Refusal> {
+    let verdict = boot_verdict(armed, loader, log).and_then(|ms| {
         // After the stick's own verdict, which stays the one that names a boot
         // that never reached its network.
-        if let Some((heard, lines)) = &heard {
+        if let Some((heard, lines)) = heard {
             talk_verdict(heard, lines)?;
         }
         Ok(ms)
     });
-    if let Some(dir) = &args.readback {
-        let boot = boot_file(back, stick, &machine, wire.as_ref(), replied);
-        write_readback(dir, &loader, &log, &boot, &verdict_file(verdict.as_ref().err()))?;
+    if let Some(dir) = readback {
+        write_readback(dir, loader, log, boot, &verdict_file(verdict.as_ref().err()))?;
         println!("readback written to {}", dir.display());
     }
-    verdict.map(Some)
+    verdict
 }
 
 /// The stick's own verdict on one boot, off what its image is armed with, the
@@ -2282,8 +2295,7 @@ pub fn park(text: &str) -> Option<toyos_quiesce::Record> {
 ///
 /// **A number of its own and not [`deadline_lateness_ms`]'s**, because what
 /// bounds it is a different thing: this one lands within one of that detector's
-/// sample periods rather than within one timer period, so a ceiling written for
-/// the poll would say nothing about the counter.
+/// sample periods rather than within one timer period.
 pub fn lockup_lateness_ms(loader: &str) -> Option<Result<i64, String>> {
     let said = loader.lines().find(|l| l.contains(bootlog::LOCKED_UP))?;
     let fields = || {
@@ -2875,6 +2887,49 @@ mod tests {
         }
     }
 
+    /// The writer's half: the verdict the loop returns is the one its readback
+    /// carries, for a boot it refused and for one it passed.
+    #[test]
+    fn the_readback_carries_the_verdict_the_loop_returns() {
+        let dir = toyos_tmpdir::TempDir::new("verdict");
+        let armed = [alloc_deadline()];
+        let boot = "back_secs 40\nstick_secs 0\n";
+        let written = || {
+            let at = dir.join(READBACK_VERDICT);
+            loop_verdict(&std::fs::read_to_string(&at).expect("the verdict is written"))
+        };
+
+        let hung = format!("{}\n{}\n", bootlog::LOADER_FIRST_LINE, bootlog::HUNG_WITHOUT_A_RECORD);
+        assert_eq!(
+            judge_and_write_readback(&armed, &hung, "", None, Some(dir.path()), boot),
+            Err(Refusal::HungWithoutARecord)
+        );
+        assert_eq!(written(), Err(Refusal::HungWithoutARecord.to_string().trim_end().to_string()));
+
+        let loader = format!(
+            "{}\n{}\n{}\n{}\nBlack box: {}, so it handed the machine back on purpose and this \
+             chain ends here\n| {} (16)\n| {}[1.516 cpu0] {}\n{}\n",
+            bootlog::LOADER_FIRST_LINE,
+            bootlog::LOADER_LAST_LINE,
+            bootlog::SEPARATOR,
+            bootlog::LOADER_FIRST_LINE,
+            bootlog::HANDED_BACK,
+            bootlog::LOG_TAIL_HEAD,
+            bootlog::LOG_TAIL,
+            bootlog::REBOOTING,
+            bootlog::CHAIN_ENDS_LINE,
+        );
+        let log = format!(
+            "[kernel 1.151 cpu0] Boot: complete (1151ms)\n{{1.203 init}} {} (Reboot)\n",
+            bootlog::STOPPING
+        );
+        assert_eq!(
+            judge_and_write_readback(&armed, &loader, &log, None, Some(dir.path()), boot),
+            Ok(1151)
+        );
+        assert_eq!(written(), Ok(()));
+    }
+
     /// **A boot the cable did not answer is not a boot that answered in the
     /// first second, and neither is a boot that was never asked.**
     #[test]
diff --git a/tests/checks.rs b/tests/checks.rs
index 6fa71583a06..f5d39992a53 100644
--- a/tests/checks.rs
+++ b/tests/checks.rs
@@ -652,6 +652,21 @@ mod checks {
         metal_checks::a_name_two_boots_measured_is_refused();
     }
 
+    #[test]
+    fn metal_reading_past_its_record_fails_and_moves_nothing() {
+        metal_checks::a_reading_past_its_record_fails_and_moves_nothing();
+    }
+
+    #[test]
+    fn metal_run_under_another_bios_fails_and_records_nothing() {
+        metal_checks::a_run_under_another_bios_fails_and_records_nothing();
+    }
+
+    #[test]
+    fn metal_failing_shared_member_fails_its_boot() {
+        metal_checks::a_failing_shared_member_fails_its_boot();
+    }
+
     #[test]
     fn metal_list_from_parse_reaches_run_without_the_machine() -> Result<(), String> {
         let args: Vec<String> = ["--metal", "--list"].iter().map(ToString::to_string).collect();
diff --git a/tests/checks/metal.rs b/tests/checks/metal.rs
index b612f56f2f3..711da6efae2 100644
--- a/tests/checks/metal.rs
+++ b/tests/checks/metal.rs
@@ -217,3 +217,94 @@ pub fn a_name_two_boots_measured_is_refused() {
     assert!(!record.measured.contains_key("latency.p99_us"), "{:?}", record.measured);
     assert_eq!(record.measured.len(), 6, "{:?}", record.measured);
 }
+
+/// Every row `passing` measures, at the values its planted readback carries,
+/// taken under `bios`.
+fn committed(bios: &str, complete_ms: u64) -> Record {
+    let machine = t14();
+    Record {
+        vendor: machine.vendor,
+        product: machine.product,
+        bios: bios.to_string(),
+        measured: [
+            ("boot.passing.complete_ms", complete_ms),
+            ("boot.passing.panel_max_us", 3851),
+            ("boot.passing.panel_us", 21751),
+            ("span.passing.us", 7),
+        ]
+        .into_iter()
+        .map(|(name, value)| (name.to_string(), value))
+        .collect(),
+    }
+}
+
+/// `passing`'s readback judged against `record`, committed first: whether the
+/// run was red, and the record it left.
+fn judged_against(record: &Record) -> (bool, Record) {
+    let dir = toyos_tmpdir::TempDir::new("metal-readbacks");
+    let root = toyos_tmpdir::TempDir::new("metal-records");
+    plant(&dir, "passing", PANEL, BOOTED, None);
+    record.save(&root).expect("a committed record");
+    let tests = [("passes", &PASSING)];
+    let runs: Vec<&(&str, &'static Metal)> = tests.iter().collect();
+    let red = metal::judge_readbacks(&root, &read(&dir, &["passing"]), &runs, &[]);
+    (red, Record::load(&root, &t14()).expect("a readable record").expect("a record"))
+}
+
+/// **A reading past its record reds the run and moves nothing**: one boot,
+/// green against a record it meets and red against one it is past.
+pub fn a_reading_past_its_record_fails_and_moves_nothing() {
+    let bios = t14().bios;
+    let met = committed(&bios, 1165);
+    assert_eq!(judged_against(&met), (false, met));
+    // 1165 ms against a ceiling of 1164.
+    let past = committed(&bios, 582);
+    assert_eq!(judged_against(&past), (true, past));
+}
+
+/// **A run under another BIOS reds and records nothing**, though every reading
+/// meets the record; the same record under this run's own BIOS is green and
+/// gains the row it lacks.
+pub fn a_run_under_another_bios_fails_and_records_nothing() {
+    let lacking = |bios: &str| {
+        let mut record = committed(bios, 1165);
+        record.measured.remove("span.passing.us");
+        record
+    };
+    let older = lacking("N34ET50W (1.50 )");
+    assert_eq!(judged_against(&older), (true, older));
+    let bios = t14().bios;
+    assert_eq!(judged_against(&lacking(&bios)), (false, committed(&bios, 1165)));
+}
+
+/// **A failing shared member fails its boot**: the run is red, and the boot the
+/// member rode adds no row while the boot beside it is recorded whole.
+pub fn a_failing_shared_member_fails_its_boot() {
+    let dir = toyos_tmpdir::TempDir::new("metal-readbacks");
+    let root = toyos_tmpdir::TempDir::new("metal-records");
+    plant(&dir, "passing", PANEL, BOOTED, None);
+    let exits = format!(
+        "{BOOTED}[2026-09-29 18:22:41 2.310 cpu3] exit: test_rs_std_tls pid=12 code=0 cpu=4ms\n\
+         [2026-09-29 18:22:42 3.120 cpu5] exit: test_rs_fs_large_file pid=13 code=101 cpu=9ms\n"
+    );
+    plant(&dir, "shared", PANEL, &exits, None);
+    let shared = metal::SharedBoot {
+        boot: "shared".to_string(),
+        config: "tests/testcases",
+        params: &[],
+        features: &[],
+        members: const { std::num::NonZeroUsize::new(38).expect("a chunk holds a member") },
+        jobs: vec!["test_rs_std_tls".to_string(), "test_rs_fs_large_file".to_string()],
+        files: Vec::new(),
+        links: Vec::new(),
+    };
+    let tests = [("passes", &PASSING)];
+    let runs: Vec<&(&str, &'static Metal)> = tests.iter().collect();
+    let readbacks = read(&dir, &["passing", "shared"]);
+    assert!(
+        metal::judge_readbacks(&root, &readbacks, &runs, &[shared]),
+        "a failing member judged green"
+    );
+    let record = Record::load(&root, &t14()).expect("a readable record").expect("a record");
+    assert_eq!(record, committed(&t14().bios, 1165));
+}
diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 15541eb5e39..dd592b5fdca 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -101,11 +101,6 @@ pub const fn once(
 /// exit record for it. So they are a boot with a list rather than a row each,
 /// and each member is still reported under its own name.
 ///
-/// The list is **sized to the bound before it is flashed** ([`sized`]): the
-/// runner's deadline runs from boot and ends the whole list, so a list longer
-/// than the bound is a boot whose tail members never run and are reported as
-/// missing records rather than as the boot being too long.
-///
 /// A chunk rides one flash. A member that takes the machine down takes every
 /// member after it *in its chunk* with it, and that is the honest price: on the
 /// T14 there is no `MAX_SHARED_REBOOTS` to answer a dead guest with a new one.
@@ -907,8 +902,6 @@ pub fn run(
     quiet: bool,
 ) -> Verdict {
     let root = super::compile::repo_root();
-    // Before anything is batched: what rides one flash is what the runner's
-    // bound leaves room for, and a boot named once here can be several.
     let shared = sized(shared);
     let shared = shared.as_slice();
     let batches = match batches(tests, shared) {
diff --git a/tests/toyos-rust-tests/src/bin/cyclictest.rs b/tests/toyos-rust-tests/src/bin/cyclictest.rs
index 65b2a207171..c554be9eee9 100644
--- a/tests/toyos-rust-tests/src/bin/cyclictest.rs
+++ b/tests/toyos-rust-tests/src/bin/cyclictest.rs
@@ -46,9 +46,6 @@ const SAMPLES: usize = 10_000;
 /// property of starting rather than of waking.
 const WARMUP: usize = 100;
 
-/// The widest lateness the histogram has a bucket for; a percentile that lands
-/// here is a floor rather than a measurement, and the caller is told so by the
-/// count of samples that had no bucket.
 const BUCKETS: usize = 4096;
 
 /// Why this run measured nothing, as the exit code carries it. Negative,
diff --git a/userland/metalprobe/src/main.rs b/userland/metalprobe/src/main.rs
index 4b7fef5361e..b4a385137e6 100644
--- a/userland/metalprobe/src/main.rs
+++ b/userland/metalprobe/src/main.rs
@@ -59,8 +59,7 @@ impl Refusal {
 /// there is none.
 pub type Measured = Result<i32, Refusal>;
 
-/// Every command by the name its symlink gives it. The name is what the
-/// kernel's `exit:` record carries, so it is also the name the profile prices.
+/// Every command by the name its symlink gives it.
 macro_rules! commands {
     ($($name:literal => $run:path),+ $(,)?) => {
         const COMMANDS: &[(&str, fn() -> Measured)] = &[$(($name, $run)),+];
@@ -98,9 +97,7 @@ fn main() {
 /// A span in whole microseconds, saturated at [`i32::MAX`] so a span too long
 /// for the channel is still a number and not a wrap.
 ///
-/// A span the clock could not tell from zero is refused rather than reported:
-/// the profile would price it against a ceiling it can never reach, and a
-/// measurement that cannot fail is what that file exists to refuse.
+/// A span the clock could not tell from zero is refused rather than reported.
 pub fn span(nanos: u128) -> Measured {
     let micros = nanos / 1_000;
     if micros == 0 {

From 0b938344669d4ab51bb21b2a03253268f9e4a989 Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Wed, 30 Sep 2026 13:09:45 +0200
Subject: [PATCH 08/10] The shared-member check holds a shared boot that passed
 to its record

The check that a failing shared member fails its boot planted only one
shared boot, the failing one, so a judge that failed every shared boot
passed it too. It now plants two shared boots with the same members, one
whose members all exit 0 and one where a member exits 101: the run is
red, and exactly the passing boot's three rows are recorded.

The doc of the record the other two checks commit said it carries the
planted readings, which is untrue of the `complete_ms` it is given; it
now says so.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016t9wjdQkB8SH7bmfUoiy6L
---
 tests/checks/metal.rs | 43 +++++++++++++++++++++++++------------------
 1 file changed, 25 insertions(+), 18 deletions(-)

diff --git a/tests/checks/metal.rs b/tests/checks/metal.rs
index 711da6efae2..c5bf8f622f0 100644
--- a/tests/checks/metal.rs
+++ b/tests/checks/metal.rs
@@ -218,8 +218,8 @@ pub fn a_name_two_boots_measured_is_refused() {
     assert_eq!(record.measured.len(), 6, "{:?}", record.measured);
 }
 
-/// Every row `passing` measures, at the values its planted readback carries,
-/// taken under `bios`.
+/// `passing`'s four rows under `bios`: its planted readings, with `complete_ms`
+/// as given.
 fn committed(bios: &str, complete_ms: u64) -> Record {
     let machine = t14();
     Record {
@@ -277,34 +277,41 @@ pub fn a_run_under_another_bios_fails_and_records_nothing() {
     assert_eq!(judged_against(&lacking(&bios)), (false, committed(&bios, 1165)));
 }
 
-/// **A failing shared member fails its boot**: the run is red, and the boot the
-/// member rode adds no row while the boot beside it is recorded whole.
+/// **A failing shared member fails its boot**: the run is red, and that boot
+/// adds no row while the shared boot whose members all passed is recorded
+/// whole.
 pub fn a_failing_shared_member_fails_its_boot() {
     let dir = toyos_tmpdir::TempDir::new("metal-readbacks");
     let root = toyos_tmpdir::TempDir::new("metal-records");
-    plant(&dir, "passing", PANEL, BOOTED, None);
-    let exits = format!(
-        "{BOOTED}[2026-09-29 18:22:41 2.310 cpu3] exit: test_rs_std_tls pid=12 code=0 cpu=4ms\n\
-         [2026-09-29 18:22:42 3.120 cpu5] exit: test_rs_fs_large_file pid=13 code=101 cpu=9ms\n"
-    );
-    plant(&dir, "shared", PANEL, &exits, None);
-    let shared = metal::SharedBoot {
-        boot: "shared".to_string(),
+    let jobs = ["test_rs_std_tls", "test_rs_fs_large_file"];
+    let exits = |code: i32| {
+        format!(
+            "{BOOTED}[2026-09-29 18:22:41 2.310 cpu3] exit: {} pid=12 code=0 cpu=4ms\n\
+             [2026-09-29 18:22:42 3.120 cpu5] exit: {} pid=13 code={code} cpu=9ms\n",
+            jobs[0], jobs[1]
+        )
+    };
+    plant(&dir, "passing", PANEL, &exits(0), None);
+    plant(&dir, "failing", PANEL, &exits(101), None);
+    let shared = |boot: &str| metal::SharedBoot {
+        boot: boot.to_string(),
         config: "tests/testcases",
         params: &[],
         features: &[],
         members: const { std::num::NonZeroUsize::new(38).expect("a chunk holds a member") },
-        jobs: vec!["test_rs_std_tls".to_string(), "test_rs_fs_large_file".to_string()],
+        jobs: Vec::from(jobs.map(String::from)),
         files: Vec::new(),
         links: Vec::new(),
     };
-    let tests = [("passes", &PASSING)];
-    let runs: Vec<&(&str, &'static Metal)> = tests.iter().collect();
-    let readbacks = read(&dir, &["passing", "shared"]);
+    let readbacks = read(&dir, &["passing", "failing"]);
     assert!(
-        metal::judge_readbacks(&root, &readbacks, &runs, &[shared]),
+        metal::judge_readbacks(&root, &readbacks, &[], &[shared("passing"), shared("failing")]),
         "a failing member judged green"
     );
     let record = Record::load(&root, &t14()).expect("a readable record").expect("a record");
-    assert_eq!(record, committed(&t14().bios, 1165));
+    let names: Vec<&str> = record.measured.keys().map(String::as_str).collect();
+    assert_eq!(
+        names,
+        ["boot.passing.complete_ms", "boot.passing.panel_max_us", "boot.passing.panel_us"]
+    );
 }

From fc1e65a24dbff06346c87c4d56fe735b0a4a18c0 Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Wed, 30 Sep 2026 15:59:17 +0200
Subject: [PATCH 09/10] The T14's record, re-recorded at the merge of #616

The T14's full metal run at 0d2dda66f, the merge of origin/main at
3af470121 (#616), wrote this file and nothing else:

- It printed "84 number(s) on LENOVO 20W0003AMZ, BIOS N34ET71W (1.71 );
  0 past its record, 9 off a boot that failed".
- It printed "now records 75 number(s) for this machine: commit it". The
  record held 56. The 19 added rows come from seven boots that the loop
  read back as `passed` and that carried no failing test or member:
  ccorpus, deadlinewedge, foreignrecord (`complete_ms` alone, because its
  page was cleared as another image's), jobcase, selftests,
  testcases-watchdog and usbload.
- Its only FAILs are main's known reds: hda_client_stall ("soundd resumed
  1 time(s)"), lan_dhcp_lease, lan_talk, lantalkcase, test_rs_fs_large_file
  and test_rs_home_backing_revoked. The 9 numbers off a failed boot are
  lancase's, testcases' and shared's. lantalkcase's readback was refused,
  so it measured none.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016t9wjdQkB8SH7bmfUoiy6L
---
 tests/metal/lenovo-20w0003amz.toml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/tests/metal/lenovo-20w0003amz.toml b/tests/metal/lenovo-20w0003amz.toml
index ca67376be64..ad31ea49a85 100644
--- a/tests/metal/lenovo-20w0003amz.toml
+++ b/tests/metal/lenovo-20w0003amz.toml
@@ -6,9 +6,19 @@ bios = "N34ET71W (1.71 )"
 "boot.ccorpus-2.complete_ms" = 1170
 "boot.ccorpus-2.panel_max_us" = 3878
 "boot.ccorpus-2.panel_us" = 21089
+"boot.ccorpus.complete_ms" = 1165
+"boot.ccorpus.panel_max_us" = 3759
+"boot.ccorpus.panel_us" = 22178
+"boot.deadlinewedge.complete_ms" = 1165
+"boot.deadlinewedge.panel_max_us" = 3850
+"boot.deadlinewedge.panel_us" = 21662
+"boot.foreignrecord.complete_ms" = 1165
 "boot.hardlockup.complete_ms" = 1164
 "boot.hardlockup.panel_max_us" = 3949
 "boot.hardlockup.panel_us" = 21772
+"boot.jobcase.complete_ms" = 1164
+"boot.jobcase.panel_max_us" = 3873
+"boot.jobcase.panel_us" = 21418
 "boot.lanicscase.complete_ms" = 1171
 "boot.lanicscase.panel_max_us" = 4000
 "boot.lanicscase.panel_us" = 21420
@@ -30,6 +40,9 @@ bios = "N34ET71W (1.71 )"
 "boot.metaldevicecase.complete_ms" = 1165
 "boot.metaldevicecase.panel_max_us" = 3837
 "boot.metaldevicecase.panel_us" = 23002
+"boot.selftests.complete_ms" = 1172
+"boot.selftests.panel_max_us" = 3950
+"boot.selftests.panel_us" = 22805
 "boot.shared-2.complete_ms" = 1165
 "boot.shared-2.panel_max_us" = 3721
 "boot.shared-2.panel_us" = 21855
@@ -48,9 +61,15 @@ bios = "N34ET71W (1.71 )"
 "boot.testcases-readdir.complete_ms" = 1166
 "boot.testcases-readdir.panel_max_us" = 3868
 "boot.testcases-readdir.panel_us" = 21680
+"boot.testcases-watchdog.complete_ms" = 1169
+"boot.testcases-watchdog.panel_max_us" = 3752
+"boot.testcases-watchdog.panel_us" = 21655
 "boot.testcases-window.complete_ms" = 1165
 "boot.testcases-window.panel_max_us" = 3822
 "boot.testcases-window.panel_us" = 22472
+"boot.usbload.complete_ms" = 1165
+"boot.usbload.panel_max_us" = 3837
+"boot.usbload.panel_us" = 21428
 "fbcheck.metaldevicecase.span_us" = 221570
 "fbfill.metaldevicecase.span_us" = 13885
 "fbread.metaldevicecase.span_us" = 313347

From 66e92caba1ffc5ca5c62d5b44bbbb6939ec6dc6a Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Wed, 30 Sep 2026 16:21:56 +0200
Subject: [PATCH 10/10] Answer the third review of #630: the talk verdict gets
 its written case, and the per-boot drop is filed

- `the_readback_carries_the_verdict_the_loop_returns` drives a passing boot
  whose conversation was never heard through `judge_and_write_readback`, and
  asserts `Refusal::Talk` and a `refused` `verdict.txt`. The review's patch,
  `let _ = talk_verdict(heard, lines);`, builds (EXIT=0) and turns it red
  (EXIT=101), alone of the 88 `--lib metal` tests.
- `issues/build/a-metal-failure-drops-every-row-its-boot-measured.md`: a red
  test drops every row its boot measured, with the exit condition that each
  number is recorded against its owner and only that owner fails.
- `tests/common/metal.rs`: the "A list nothing sized loses its tail" paragraph
  is deleted.

`cargo run -- --ci host`: EXIT=0, 54 steps, all green.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016t9wjdQkB8SH7bmfUoiy6L
---
 ...ilure-drops-every-row-its-boot-measured.md | 23 +++++++++++++++++++
 src/metal.rs                                  | 11 ++++++++-
 tests/common/metal.rs                         |  4 ----
 3 files changed, 33 insertions(+), 5 deletions(-)
 create mode 100644 issues/build/a-metal-failure-drops-every-row-its-boot-measured.md

diff --git a/issues/build/a-metal-failure-drops-every-row-its-boot-measured.md b/issues/build/a-metal-failure-drops-every-row-its-boot-measured.md
new file mode 100644
index 00000000000..0dabcc5249e
--- /dev/null
+++ b/issues/build/a-metal-failure-drops-every-row-its-boot-measured.md
@@ -0,0 +1,23 @@
+---
+status: open
+kind: tooling
+opened: 2026-09-30
+---
+
+# A metal failure drops every row its boot measured
+
+`tests/common/metal.rs`'s `judge_readbacks` puts boot labels in `failed`, and
+`Readback::measured` records a number with no test attached. One red test or
+shared member riding a boot therefore keeps every number that boot measured
+out of the record, and a number never recorded is never judged. A runner that
+carries every test in one session would drop every row of the session for one
+red test.
+
+It already costs rows. On the T14's full run at `0d2dda66f`, `testcases`,
+`shared`, `lancase` and `lantalkcase` each carried a known red, and
+`tests/metal/lenovo-20w0003amz.toml` holds no row of theirs, so nothing
+judges their numbers while those reds stand.
+
+## Exit condition
+
+Each number is recorded against its owner, and only that owner fails.
diff --git a/src/metal.rs b/src/metal.rs
index c9231bdd5c5..0ff2d83feda 100644
--- a/src/metal.rs
+++ b/src/metal.rs
@@ -2905,7 +2905,8 @@ mod tests {
     }
 
     /// The writer's half: the verdict the loop returns is the one its readback
-    /// carries, for a boot it refused and for one it passed.
+    /// carries, for a boot it refused, for one it passed, and for one whose
+    /// conversation it refused.
     #[test]
     fn the_readback_carries_the_verdict_the_loop_returns() {
         let dir = toyos_tmpdir::TempDir::new("verdict");
@@ -2945,6 +2946,14 @@ mod tests {
             Ok(1151)
         );
         assert_eq!(written(), Ok(()));
+
+        let unheard = Refusal::Talk(vec!["unheard".to_string()]);
+        let heard = (Err("unheard".to_string()), Vec::new());
+        assert_eq!(
+            judge_and_write_readback(&armed, &loader, &log, Some(&heard), Some(dir.path()), boot),
+            Err(unheard.clone())
+        );
+        assert_eq!(written(), Err(unheard.to_string().trim_end().to_string()));
     }
 
     /// **A boot the cable did not answer is not a boot that answered in the
diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 9dc5f1dba56..a633aad5206 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -133,10 +133,6 @@ fn chunk_name(boot: &str, index: usize) -> String {
     }
 }
 
-/// **A list nothing sized loses its tail without saying so.** The runner's
-/// bound ends the whole list rather than the job it is inside, so every member
-/// past the cut is reported as a missing exit record.
-///
 /// **A chunk carries only the files and links its own members name.** The C
 /// corpus stages a binary and an expectation per case; putting all of both on
 /// every chunk would double a flash that is already written over `ssh`.