issues: a panic is never an accident, the owner's rule as a track, not yet enforced; seven stale crafted-ELF clauses go

[Japabu]

This PR records the owner's no-panic rule as a track. The rule is decided, and nothing enforces it yet. It also deletes seven stale comment clauses. No code changes.

What changed

issues/kernel/a-panic-is-never-an-accident.md is a new kind: track. It carries:

• The tiers as the owner drew them.
  • Tier 1, input boundaries: no panic at all.
  • Tier 2, the kernel: no implicit panic. A deliberate stop is an #[expect(…, reason = "…")] whose reason names its invariant.
  • Tier 3, system services: the same rule as the kernel.
  • Tier 4: normal Rust.
• The set. It covers every operation that can panic on input, and each name was checked against clippy 0.1.98 (48a229ceae):
  • indexing_slicing and string_slice. Slicing a str draws only the second.
  • arithmetic_side_effects.
  • unwrap_used and expect_used.
  • panic, unreachable, todo, unimplemented and panic_in_result_fn.
  • cast_possible_truncation. The owner names it, although a truncating as does not panic. For tiers 1 to 3 this overrides the tree-wide rejection in issues/build/clippy-stage-two-is-lints-one-at-a-time.md, and the track says so.
  • disallowed_methods naming slice::split_at and slice::copy_from_slice.
  • disallowed_macros naming core::assert, assert_eq and assert_ne.
• How each stage's gate fails.
  • Tier 1 forbids the set, so an inner #[allow] or #[expect] is error E0453.
  • The kernel and the services deny the set and forbid clippy::allow_attributes and clippy::allow_attributes_without_reason.
  • A bare #[allow] therefore fails the gate. So does an #[expect] without a reason.
  • allow_attributes checks only outer attributes, so an inner #![allow(…, reason = …)] passes both lints. Stage 3's exit adds a --ci host step that refuses it.
• Four stages, each with an exit a gate can fail.
  • Stage 1's first exit is one declaration of the set.
  • Stage 2's link-proof exit is a step of --ci host.
  • Stage 4's first exit is a userland shape in src/clippy.rs.

Seven crafted-ELF clauses are deleted. They sat at Cargo.toml (two), bootloader/Cargo.toml, kernel/Cargo.toml, userland/Cargo.toml and src/build.rs (two). Each cited issues/ for two panics the tracker closed at fa2799ded. The issue file that recorded them is deleted too. None of the five files is a sysroot input.

Evidence

Each item comes from a command that was run. The commit message has the full lists.

• Lint names and coverage. A scratch crate ran under #![deny(unknown_lints)]. All fifteen lints drew a finding on their own form. A bogus clippy::no_such_lint_control was refused, and it was the only error.

• What the set misses. a << b, a >> b, a.pow(b) and a.abs() drew no finding. Built with -C overflow-checks=on, the shift, the pow and the abs each exit 101.

• The forbid and allow_attributes behaviour above was measured on the same scratch crate.

• clippy.toml. A child crate's own file replaces its parent's rather than adding to it. This was measured with a parent and a child that list different methods.

• Kernel count. cargo clippy --target x86_64-unknown-none ran in kernel/ with the set as warnings. It exited 101 under the kernel's -Dwarnings and reported 2,274 findings:

  • 992 arithmetic_side_effects
  • 408 indexing_slicing
  • 394 cast_possible_truncation
  • 208 disallowed_macros
  • 109 expect_used
  • 60 panic
  • 39 disallowed_methods
  • 29 unwrap_used
  • 16 unreachable
  • 14 panic_in_result_fn
  • 5 string_slice

  This is one of src/clippy.rs's ten kernel shapes: x86-64 with default features.

Gates

• cargo run -- --ci host: EXIT=0 ("Host: 56 step(s), all green"). It ran on the tree of f469e9022 except two wording edits to the track, made during the run; no host step reads the track.

🤖 Generated with Claude Code

https://claude.ai/code/session_016t9wjdQkB8SH7bmfUoiy6L

[Japabu]

Review of 6b2eef15d against .claude/agents/reviewer.md and issues/README.md.

CI: host passed at 6b2eef15d (run 36829602301; gh run watch --exit-status exit 0, gh pr checks 665 exit 0). The branch adds no tests and targets no hardware.
Net lines (git diff --shortstat origin/main...6b2eef15d): +86 −0 across 2 files. Production 0, tests 0, issues/ +86.
Numbers I reproduced:

• 157 occurrences on 154 lines: git grep -o -E '\.unwrap\(\)|\.expect\(' 6b2eef15d -- kernel/src | wc -l gives 157, and the per-file -c sum gives 154.
• The seven-lint breakdown sums to 2,008. I did not re-run it, because a clippy run is a build.
• overflow-checks = true is at Cargo.toml:254, kernel/Cargo.toml:387 and userland/Cargo.toml:85.
• Both kernel targets print "panic-strategy": "abort" (RUSTC_BOOTSTRAP=1 rustc -Z unstable-options --print target-spec-json --target <t>, exit 0).
• The no-panic README caveat at 9a0b1097 reads as quoted.
• The issues/ grep exits 1 at 1e4d3e0ec and at origin/main.
• da3f56573 is the commit that rewrote the seven citations.

Shape: a numbered stage list is the form the tree's tracks already use (24 of the 80 kind: track files carry one). The stage exits are what is wrong, not the list.

BLOCKER

• issues/kernel/a-panic-is-never-an-accident.md:14-15 — The lint set is not the owner's "panicking forms".
  • It adds truncating casts. A truncating as never panics, and issues/build/clippy-stage-two-is-lints-one-at-a-time.md records cast_possible_truncation as rejected, so the tracker would give both answers.
  • It leaves out clippy::todo, clippy::unimplemented and clippy::panic_in_result_fn. PR toyos-microcode: Intel microcode update files validated and matched to a CPU, pure, and no input can panic it; the kernel step's design in its issue #653 already denies all three (76031de27:toyos-microcode/src/lib.rs:23-33).
  • The table drops the owner's "where the build allows" from the link proof.
  • "or a named invariant" adds a second kind of deliberate stop to tier 2, and no gate checks it.
  • Fix: record the owner's set. Unless the owner named casts, the 394 cast findings leave the count too.
• issues/kernel/a-panic-is-never-an-accident.md:56-58,62-63 — The exits can pass while the rule fails.
  • "Denying the lints" still admits any #[allow], with or without a reason. toyos-transport/src/queue.rs:21 is one today.
  • Mutation that passes stage 3's exit as written: put #![deny(<the set>)] in kernel/src/main.rs and #[allow(clippy::arithmetic_side_effects, clippy::indexing_slicing)] on mod drivers; (kernel/src/main.rs:26). cargo run -- --clippy stays green and the rule is false.
  • Tier 1's exit should be forbid, as six of the seven crates already use. An inner #[allow] or #[expect] cannot override it.
  • Tier 2's exit should be deny with clippy::allow_attributes and clippy::allow_attributes_without_reason forbidden, so a deliberate stop is an #[expect(…, reason = …)] or nothing.
• issues/build/seven-comments-cite-crafted-elf-panics-no-issue-holds.md — The branch adds 17 lines to keep seven false clauses it can delete.
  • Delete the crafted-ELF clause in this PR at Cargo.toml:210-211 and :231-232, bootloader/Cargo.toml:45-46, kernel/Cargo.toml:376-377, userland/Cargo.toml:69-70, and src/build.rs:408-411 and :635-637.
  • Then drop this file and the track's :35-39.
  • None of these five files is a sysroot input (src/sysroot.rs:54-59), so the deletion rebuilds no toolchain.
  • Stale prose is deleted, and these clauses are chronology the comment rule already bars.

NOTE

• issues/kernel/a-panic-is-never-an-accident.md:66 — Stage 5 has no exit a gate can fail. Once the attributes land, the rule lives where it is enforced, and reviewer.md's "Edges" already holds the kernel half. Delete the stage.
• issues/kernel/a-panic-is-never-an-accident.md:59-61 — Stage 2's "a host build that refuses to link" is measured once and then rots unless it is a step of cargo run -- --ci host. Say so in the exit.
• issues/kernel/a-panic-is-never-an-accident.md:64-65 — Stage 4 waits on a clippy for the toyos toolchain that no issue owns (src/clippy.rs:7-8). Its first exit is a userland shape in src/clippy.rs.
• issues/kernel/a-panic-is-never-an-accident.md:56-58 — The set is already copied into seven crate roots, and PR toyos-microcode: Intel microcode update files validated and matched to a CPU, pure, and no input can panic it; the kernel step's design in its issue #653 carries a different nine. Stage 1's exit should name one declaration of the set that every tier-1 crate reads.

REMOVE

• issues/kernel/a-panic-is-never-an-accident.md:7, :9-10 and the PR title — "seven crates enforce it" is false by the file's own :25: none denies unreachable and none carries the proof. toyos-microcode: Intel microcode update files validated and matched to a CPU, pure, and no input can panic it; the kernel step's design in its issue #653 landing also moves the count.
• :14 — The parenthetical list of input boundaries is the implementer's, written into the owner's row.
• :16 — The service list rots when the next service lands. userland/ already answers it.
• :15 — "where a reviewer sees it".
• :20-25 — The per-crate lint inventory: the crate roots answer it, and "one #[allow] at queue.rs:21" misses :69 and :79.
• :26-28 — The rg count and its rg -c aside: the clippy count at :28-32 is the compiled measure of the same calls, and the aside exists only to correct the brief.
• :33-39 — The overflow-check provenance and crafted-ELF history. At most this clause stays: [profile.toyos] sets overflow-checks, so arithmetic is a panicking form.
• :40-42 — It cites toyos-microcode/src/lib.rs, which only open PR toyos-microcode: Intel microcode update files validated and matched to a CPU, pure, and no input can panic it; the kernel step's design in its issue #653 holds, and it is already false at that PR's head 76031de27: nine lints are denied there, and the table is read through split_first_chunk at :243.
• :45-47 — From "on a crate holding" on is provenance. The commit message already carries it.
• :68-69 — The "Mutation" line: a track has nothing to mutate, and the stage exits are the gates.
• PR body — "twelve kernel shapes" is wrong (src/clippy.rs has ten). The "Unsure" section and the first-person note on where the file lives would become main's merge record.

SEND BACK

[Japabu]

Round 2: review of f469e9022 against .claude/agents/reviewer.md, judged against round 1 (#665 (comment)).

CI: host passed at f469e9022 (run 36832634087; gh run watch --exit-status exited 0, and gh pr checks 665 exited 0). The branch adds no tests and targets no hardware.

Net lines (git diff --numstat origin/main...f469e9022): +79 −21.

• Production: +11 −21, all of it comments.
• Tests: 0.
• issues/: +68.

Round-1 BLOCKERs

• 1, the lint set — OPEN on one point.
  • Closed: :21-23 now names todo, unimplemented and panic_in_result_fn. :11 carries "where the build allows". :12 has a single kind of deliberate stop.
  • Open: the owner approved "lossy casts", but :24 records cast_possible_truncation alone.
  • cast_precision_loss is lossy by its name. cast_sign_loss and cast_possible_wrap change the value silently, and silent change is the reason the ruling gives for keeping truncating casts.
  • Fix: name all three beside truncation and re-measure the kernel count. Otherwise the orchestrator confirms with the owner that "lossy" meant truncation only, and :24 says so.
• 2, the exits pass while the rule fails — OPEN.
  • Closed: the named mutation, an #[allow] on mod drivers;, now fails :63-64, because allow_attributes is forbidden there. The evidence is the scratch-crate measurement in f469e9022's message.
  • Open: the same mutation written as an #[expect] still passes. Put #[expect(clippy::arithmetic_side_effects, clippy::indexing_slicing, reason = "drivers")] on kernel/src/main.rs:26 (mod drivers;), or #![expect(…, reason = "…")] at the top of any module file.
  • That passes every gate :62-66 names, because the module's first finding fulfils the expect. Tier 2's "no implicit panic" is then false for the whole module.
  • Fix: the --ci host step at :65 also refuses an #[expect] of the set on a mod, on an impl, and as an inner #![expect]. Then one expect covers one stop, as :12 says.
• 3, the seven clauses — CLOSED.
  • All seven are gone from the five files in the diff.
  • The second issue file does not appear in git diff origin/main...f469e9022.
  • git grep 'seven-comments-cite-crafted-elf' f469e9022 exits 1.

Round-1 NOTEs: all four are applied (stages 1, 2 and 4, and stage 5 is gone).
Round-1 REMOVEs: all are applied. The overflow clause stays at :19-20 in the form round 1 allowed.

BLOCKER

• issues/kernel/a-panic-is-never-an-accident.md:62-66 — Stage 3 ends at kernel/src/main.rs alone, but the kernel links 25 more crates.
  • kernel/Cargo.toml:390-414 links 25 toyos crates whose code runs in the kernel, among them toyos-sched, toyos-pcid, toyos-dma, toyos-userbound and toyos-quiesce.
  • A crate-root attribute in main.rs reaches none of them. The 2,274 at :33-35 counts the kernel package alone.
  • Mutation: stage 3 lands as written while toyos-sched keeps an unchecked +. cargo run -- --clippy stays green, and tier 2 is false.
  • Fix: stage 3 also ends with every crate kernel/Cargo.toml links, unless stage 1 already forbids the set in it.

NOTE

• :24-26 — Per the orchestrator's ruling, say why truncating casts are in the set: a truncating as degrades silently, and CLAUDE.md's "Fail fast" forbids silent degradation. "The owner names it" is not a reason.
• :56-57 and issues/design-debt/elf-domain-lint-line-not-yet-added.md — The track's treatment of the ELF issue is not right.
  • That issue's exit, "every site inside it is checked or carries a one-clause #[allow]", contradicts its own #![forbid] on lib.rs (E0453), whether or not this track exists.
  • issues/README.md, "Filing one", bars this branch from editing a file the orchestrator holds.
  • So the clause in the track goes. The holder deletes "or carries a one-clause #[allow]" from that exit and makes toyos-elf an area of stage 1, since its "…" is this set.
• :53-54 — Measure which mechanism "one declaration" is before promising it.
  • Cargo's [lints] applies to every target, so a forbid there reaches #[cfg(test)] code. Tier 4 frees test code, and the crates today exempt it with cfg_attr(not(test), …) (toyos-transport/src/lib.rs:26-27).
  • A kernel-module area cannot read a [lints] table at all.
• :27-29 — The set names split_at and copy_from_slice but not split_at_mut and clone_from_slice, which panic on the same length mismatch.
• PR body — The scratch-crate claims stand on no command, exit code or log in the body: forbid gives E0453, allow_attributes checks outer attributes only, string_slice, and shift, pow and abs. Stage 3's extra step rests on the outer-only claim.
• :7, :31 — The track says plainly that the rule is decided and not yet enforced. At 63 body lines it is about a screen, and the REMOVEs below shorten it.

REMOVE

• :16 — "every name checked against clippy 0.1.98 (48a229ceae)". It is provenance, the commit carries it, and it rots at the next toolchain bump.
• :12 — "A type that makes the broken state unrepresentable is preferred over any stop." and "(fail fast)". Both restate CLAUDE.md.
• :31-32 — Everything after "No crate carries the set.". It becomes false when toyos-microcode: Intel microcode update files validated and matched to a CPU, pure, and no input can panic it; the kernel step's design in its issue #653 lands: toyos-microcode/src/lib.rs at origin/wt/toyos-ucode denies panic_in_result_fn, todo and unimplemented.
• :56-57 — ", the #[allow] in issues/design-debt/elf-domain-lint-line-not-yet-added.md's exit too". It narrates another issue's defect, and it rots when that issue is fixed.
• PR body — "It covers every operation that can panic on input". The track's own :38-40 says otherwise.
• PR body — "The issue file that recorded them is deleted too." main never carried that file, so the merge deletes none.
• PR body, Gates — "except two wording edits to the track, made during the run; no host step reads the track". That is chronology, and CI at f469e9022 is the measurement.
• PR body, "What changed" — The tier, set and stage bullets restate the track, which is the record.

SEND BACK