inbox: a watch is answered after a look at its object, never by a post

issues/design-debt/toyos-poller-is-sync-and-a-watch-moves-the-tail-in-two-steps.md

@@ -0,0 +1,16 @@
+---
+status: open
+kind: defect
+opened: 2026-10-02
+---
+
+# `toyos::Poller` is `Sync`, and a watch moves the submission tail in two steps
+
+`Poller::watch_raw` loads the submission tail, writes the entry at it and
+stores the tail plus one, through `&self`, and `Poller` is `unsafe impl Sync`
+(`toyos/src/poller.rs`). Two threads watching through one `&Poller` write one
+slot at once and advance the tail once, so one watch is lost. `rg 'Arc<Poller>'`
+and `rg 'static.*Poller'` over `toyos`, `userland` and `tests` find no poller
+shared between threads.
+
+**Exit**: `Poller` is not `Sync`, or a watch claims its slot in one step.

issues/isolation/a-ring-handed-to-another-process-resolves-its-watches-in-the-receivers-table.md

@@ -0,0 +1,20 @@
+---
+status: open
+kind: defect
+opened: 2026-10-02
+---
+
+# A ring handed to another process resolves its watches in the receiver's table
+
+An `Inbox` handle carries `DUP` and `TRANSFER` (`ops::initial_rights`), and
+`inbox_submit` resolves every handle a watch names in the calling process's
+table (`inbox::resolve`): an `OP_WATCH` when it is submitted, and a fired
+poll's when its submitter looks at the object again. The ring's page is mapped
+into its creator alone, so a process handed the ring runs the submissions the
+creator wrote, and looks at the creator's fired polls, against whatever its
+own table holds under the creator's handle numbers. It reaches no object it
+does not hold.
+
+**Exit**: a ring cannot leave the process that made it, or a watch names its
+object by something its registrant's table decided; a test hands a ring to a
+child.

issues/kernel/a-close-of-one-handle-ends-every-rings-poll-on-its-object.md

@@ -0,0 +1,20 @@
+---
+status: open
+kind: defect
+opened: 2026-10-02
+---
+
+# A close of one handle ends every ring's poll on its object
+
+`ops::close` answers every poll on a watch its object ends with `-NotFound`
+(`Watch::cancel_polls`), in every ring, when any one handle to a pipe's read
+end or an acceptor closes. A sibling handle from `dup` keeps the object open,
+and its polls end all the same. `toyos::poller`'s `drain` hands the token of a
+negative completion to its caller as it does a ready one's, so a reader that
+takes that token for bytes and reads blocking parks on an object that is open
+and empty. No caller in the tree reaches it: fsd's acceptors are endowed and
+never duplicated. `inbox_cancel_wakes` stages the close.
+
+**Exit**: a poll ends only when the last handle to its source closes, or a
+completion's result reaches `Poller`'s caller; a test closes a duplicate under
+a watch and reads what the wait hands back.

issues/kernel/a-process-lengthens-an-interrupts-off-walk-by-the-threads-it-parks-on-one-ring.md

@@ -10,9 +10,9 @@ Held by the small-kernel track's stage 6 step 2
 (`issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md`),
 whose instrument is the only thing that can read it.
 
-Every poll ring's own watch and its completions sit behind an `IrqLock`
+Every poll ring's own watch sits behind an `IrqLock`
 (`kernel/src/inbox/mod.rs`), because a device handler's post
-reaches them through the polls it fires. So any process, not only a device's
+reaches it through the polls it fires. So any process, not only a device's
 holder, decides how long a CPU runs with interrupts masked:
 
 - **N threads parked in `submit` on one ring**
@@ -25,9 +25,9 @@ holder, decides how long a CPU runs with interrupts masked:
   that finds the list full copies it, all with interrupts masked.
 - **A claim's holder polling its claim from R rings, P polls each** (up to
   `MAX_PENDING_WATCHES`, 1024) makes its device's
-  handler fire R × P entries under the claim's list lock, each taking that
-  ring's completions lock and posting that ring's watch, whose own N threads
-  it notifies. Entries a post in place fired stay in the list until
+  handler fire R × P entries under the claim's list lock, each posting its
+  ring's watch, whose own N threads it notifies. Entries a post in place
+  fired stay in the list until
   registrations sweep them four at a time.
 
 Nothing caps N: a thread costs its process a 128 KiB kernel stack

issues/kernel/two-submitters-of-one-ring-race-its-last-completion-slot.md

@@ -0,0 +1,17 @@
+---
+status: open
+kind: defect
+opened: 2026-10-02
+---
+
+# Two submitters of one ring race its last completion slot
+
+`polls::deliver` asks the ring for room and then answers, in two holds of the
+completions' lock. Two threads in `inbox_submit` on one ring can both find the
+last slot free; the second answer finds the ring full, and `post_completion`
+drops it and counts it in `dropped`, as it does every completion written to a
+full ring. A ring one thread submits to drops no watch's answer, and
+`toyos::Poller` sizes its rings past what its watches can answer.
+
+**Exit**: the room an answer was looked up for is the room it is written
+into; a test runs two submitters against a ring with one slot.

kernel-loom/Cargo.toml

@@ -49,6 +49,15 @@ wake-fence-off = []
 #
 # Never on by default, and no kernel build can reach it.
 poll-fire-load-store = []
+# The negative control for a poll ring's answer. It makes `inbox/polls.rs`
+# answer a fired poll with its interest and look at nothing, so a post with
+# nothing behind it is an answer and `inbox_answer.rs` must red:
+#
+#   cargo test --manifest-path kernel-loom/Cargo.toml --features post-is-an-answer \
+#     --test inbox_answer
+#
+# Never on by default, and no kernel build can reach it.
+post-is-an-answer = []
 # The negative control for the ticket lock's acquire edge. It makes `sync.rs`'s
 # two loads of `now` — the ones that decide ownership — `Relaxed`, so the
 # previous owner's writes are unordered against the next owner's reads, and

kernel-loom/src/lib.rs

@@ -205,6 +205,18 @@ pub mod device_irq;
 #[path = "../../kernel/src/inbox/once.rs"]
 pub mod poll_once;
 
+/// `polls.rs` names its one-shot as `super::once`, which in the kernel is
+/// `crate::inbox::once`; this is what makes that path resolve here.
+pub use poll_once as once;
+
+extern crate alloc;
+
+/// A ring's polls and when one is answered, driven against a fake object by
+/// `tests/inbox_answer.rs`. It names the one-shot above, `toyos-abi` and
+/// `alloc`, and nothing of the kernel's.
+#[path = "../../kernel/src/inbox/polls.rs"]
+pub mod inbox_polls;
+
 /// What `sleeplock.rs` names of the kernel's watch, and nothing more.
 ///
 /// **The park is shimmed, and that is the scope statement for