The host job moves to Linux: FAT32 reads committed volumes, hex input is judged by exact rounding, and winit and softbuffer get their Wayland backends

.github/workflows/ci.yml

@@ -15,11 +15,9 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # macOS, because `toyos-fat32`'s fixtures are formatted with `newfs_msdos`
-  # and `hdiutil`.
   host:
     if: github.event_name == 'merge_group' || github.event.pull_request.draft == false
-    runs-on: macos-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
@@ -37,7 +35,7 @@ jobs:
             toyos/target
             kernel/target
             bootloader/target
-          key: host-${{ github.run_id }}
-          restore-keys: host-
+          key: host-linux-${{ github.run_id }}
+          restore-keys: host-linux-
 
       - run: cargo run -- --ci host

.github/workflows/nightly.yml

@@ -17,7 +17,7 @@ concurrency:
 
 jobs:
   host:
-    runs-on: macos-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
@@ -35,8 +35,8 @@ jobs:
             toyos/target
             kernel/target
             bootloader/target
-          key: host-${{ github.run_id }}
-          restore-keys: host-
+          key: host-linux-${{ github.run_id }}
+          restore-keys: host-linux-
 
       - run: cargo run -- --ci host
 
@@ -46,7 +46,7 @@ jobs:
         uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: *host-paths
-          key: host-${{ github.run_id }}
+          key: host-linux-${{ github.run_id }}
 
   # Publishes this tree's toolchain if nobody has, and on main moves the SDK
   # alias onto it. Bare `ubuntu-24.04`, not a container: its glibc is the
@@ -209,3 +209,5 @@ jobs:
           sh "$RUNNER_TEMP/rustup-init.sh" -y --profile minimal --default-toolchain stable
           echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
       - run: env -u GITHUB_ACTIONS -u CI cargo run -- --build-only
+      # The host suite's macOS arms run here alone: `ci.yml`'s `host` is Linux.
+      - run: cargo run -- --ci host

NOTICE

@@ -309,3 +309,88 @@ the tool, not the bytes a user's own data becomes when the tool writes it: the
 layout is a published on-disk format, not a copyrightable work of the program,
 and the file contents are ours. The tool is not distributed with this repository
 in any form.
+
+
+toyos-fat32/tests/fixtures/ — volumes macOS's FAT tools wrote
+--------------------------------------------------------------
+
+    blank-512.runs     3,672 bytes, of a  67,108,864-byte raw volume
+      sha256 4f1686152769fb4b064a78b0a2287c8b54bff3ec1e279b35c8f337d538a45f78
+      raw    51dfc22ac6ab939a28f8cf113da48cbb75eb0b4f5a4d2b79c9f09522a58fe052
+    blank-4k.runs      3,672 bytes, of a 314,572,800-byte raw volume
+      sha256 14e98fc505450882f4d284fb712d32b4f9e4d50c1bfc86702ace8f0adee745e0
+      raw    788974e418ac37cb43f65057f609bd4234b4f5fffb10e8be7563a608b423e137
+    read-512.runs    336,152 bytes, of a  67,108,864-byte raw volume
+      sha256 6bef14efca36070830f5a4a2b1dc9b69a0e2627679cc5c9ed542acaa4ece416c
+      raw    911903c9338144f65df86a6f98d87c375725806a709db3bb48d772fe3b719fbb
+    read-4k.runs      55,032 bytes, of a 314,572,800-byte raw volume
+      sha256 cab78e1ea6c46b0a04a0de32a24f1a6ac90a2017dd7188745de2d603c5ab121b
+      raw    cb4cefe9a9b2b17371ec20fa8a49b16475f2434ff5ed5d9277c99bef3cdd592c
+    hostile.runs      36,536 bytes, of a  67,108,864-byte raw volume
+      sha256 c570b3c6944f47d2cd1498da14f12c4a98dc85683f782624181917eba68f9066
+      raw    1750198122459dee8f1b4d54ac460d9689279189d6ff59f6072d57d00dbbd68e
+    empty-file.runs    6,264 bytes, of a  67,108,864-byte raw volume
+      sha256 68a6abf1626e4bdf6b3586d3f52b2d7051390e4e18beb31258dd0021bb3e96b9
+      raw    ff0e162a36ccf76d1aa5cb36ce47c0d728442bf926d59af498d0d55820bcfd85
+    Boot stub: Copyright (c) 1998 Robert Nordier
+    Licence text: licenses/BSD-2-Clause-newfs_msdos.txt
+    SPDX-License-Identifier: (MIT OR Apache-2.0) AND BSD-2-Clause
+
+`toyos-fat32`'s host tests read these volumes, and write into the two blank
+ones. The only honest judge of a FAT reader is bytes a FAT implementation that
+is not ours wrote, and these are those bytes. Each is committed as its runs of
+nonzero 512-byte sectors, which `Image::fixture` in
+`toyos-fat32/tests/common/mod.rs` expands into a sparse file; the raw digest is
+of that expansion, and equals the digest of what the tools wrote.
+
+They were made once, on macOS 27.0.1 (build 26A434), with Apple's `msdosfs`
+project at SourceVersion 845000003000001 (`/sbin/newfs_msdos`, sha256
+29b3d7daa299583015c823ea6ebce643c030a79c8bc26b9bf9c23deb4c6d1a73) and
+`/usr/bin/hdiutil`, by a throwaway program making the invocations
+`toyos-fat32/tests/common/mod.rs` made at fa134154c with a fixed label. Per
+volume, on a sparse file of the raw size:
+
+    hdiutil attach -imagekey diskimage-class=CRawDiskImage -nobrowse -nomount <file>
+    newfs_msdos -F 32 -S 512 -c <c> -v <label> /dev/disk4
+    hdiutil detach /dev/disk4
+    hdiutil attach -imagekey diskimage-class=CRawDiskImage -nobrowse <file>
+    # the files below written under /Volumes/<label> with std::fs, parents
+    # created, in order; then every `._*` sidecar macOS left there deleted
+    hdiutil detach /dev/disk4
+
+    volume      -c  label        files
+    blank-512    1  TFBLANK      none
+    blank-4k     8  TFBLANK4K    none
+    read-512     1  TFREAD       the ten `populated` lists in tests/host_read.rs
+    read-4k      8  TFREAD4K     the three `a_four_kib_cluster_volume_reads_the_same` lists
+    hostile      1  TFHOSTILE    sub/deeper/ (mkdir -p first), plain.txt "a short file",
+                                 "A Long Name For Entries.bin" pattern(20000, 5),
+                                 sub/inner.dat pattern(4000, 6), sub/deeper/leaf.txt "leaf"
+    empty-file   1  TFEMPTYFILE  empty.txt "", full.txt "twelve bytes"
+
+`pattern` is the one in `toyos-fat32/tests/common/mod.rs`. Nothing in this
+repository runs either tool: the suite reads only what is committed here.
+
+**What in them is not ours.** The names and contents of the files are this
+repository's test bytes, and the layout — boot sector, FSInfo, FATs, directory
+entries — is the published on-disk format, data the tools computed rather than
+a work of theirs. Two things the tools wrote are not:
+
+- Every boot sector, sector 0 and its backup at sector 6, carries at offset
+  0x5A the 84 bytes of `newfs_msdos`'s `bootcode[]`: 39 bytes of x86 that print
+  a message through the BIOS, wait for a key and reboot, then "Non-system disk"
+  and "Press any key to reboot". They are byte for byte that array in FreeBSD's
+  `sbin/newfs_msdos/mkfs_msdos.c`, Robert Nordier's under BSD-2-Clause, and in
+  Apple's `msdosfs` at tag `msdosfs-788.100.31`
+  (`lib_newfs_msdos/newfs_data_types.h`, taken from
+  `newfs_msdos.tproj/newfs_msdos.c`, which carries Nordier's notice under
+  Apple's). The volumes are declared as carrying it under BSD-2-Clause, whose
+  one condition on redistribution in binary form is reproducing the notice,
+  which the licence text above does verbatim.
+- The freed clusters still hold the AppleDouble sidecars macOS wrote beside
+  every file and the generation then deleted: Apple's AppleDouble header with
+  its `Mac OS X` filler, an eleven-byte `com.apple.provenance` attribute, and
+  the stock phrase "This resource fork intentionally left blank". That is
+  machine-written metadata and a short phrase, and no licence is claimed for
+  it. It stays because the deleted entries and their long-name runs in front
+  of them are input a reader has to skip.

issues/build/apps-on-toyos-window-terminal-toybox-and-doom-build-for-toyos-alone.md

@@ -0,0 +1,25 @@
+---
+status: open
+kind: defect
+opened: 2026-10-01
+---
+
+# Apps on toyos-window, terminal, toybox and doom build or run on ToyOS alone
+
+A userland app builds and runs on macOS, Linux, Windows and ToyOS from the same
+source (owner's ruling). These do not. Each row below is
+`cargo check --manifest-path userland/<app>/Cargo.toml --target x86_64-unknown-linux-gnu`,
+run on the macOS dev host:
+
+| app | exit | what stops it |
+|---|---|---|
+| editor, files, paint, filepicker | 0 | they compile, but `toyos-abi/src/syscall.rs` issues ToyOS's `syscall` on every OS, so `toyos-window` reaches no display off ToyOS |
+| terminal | 101 | "unresolved import `std::os::toyos`" |
+| toybox, doom | 101 | `alsa-sys`, which cpal's Linux backend links: its `build.rs` finds ALSA only through `pkg-config`, so a Linux build needs `libasound2-dev` installed |
+
+doom's `build.rs` also panics on any target the build system does not name a C
+compiler for. With `--target x86_64-pc-windows-msvc` it exits 101 with
+"CC_x86_64_pc_windows_msvc is unset".
+
+**Exit:** each builds with a plain `cargo build` for Linux, macOS and Windows,
+and opens its window there.

issues/build/the-build-runs-host-tools-outside-rust-and-qemu.md

@@ -32,7 +32,6 @@ arrives and is not one. M4 and M5 are stages of `issues/build/toyos-builds-itsel
 | `gh` | `src/release.rs` asks whether a toolchain release exists, creates it and moves the `sdk-<version>` alias, on the nightly's `build` runner | refused: not C or C++ source, it is Go | `src/release.rs` speaks GitHub's REST API itself |
 | `ssh` | `src/metal.rs` reaches the T14's Ubuntu with it, only in the metal loop | refused: a Rust tool does it, the repository's own russh client `crate::build::ssh_client_host`, which `src/metaltalk.rs` already drives | `src/metal.rs` drives that client, or Ubuntu leaves the loop |
 | `cc`, `c++`, `ar` and `xcrun` on a macOS host, Apple's Command Line Tools | what the Linux row's tools do, and rustc asks `xcrun` for the SDK on every host link that names no `SDKROOT` (`rust/compiler/rustc_codegen_ssa/src/back/apple.rs`), as `src/llvm.rs` does for the LLVM's key | refused: one host OS alone | M5: no host in the loop |
-| `newfs_msdos` and `hdiutil` | `toyos-fat32`'s host tests format and mount their fixtures with them (`toyos-fat32/tests/common/mod.rs`), which keeps the `host` job on `macos-latest` | refused: one host OS alone | `issues/filesystem/fat32-suite-needs-macos-binaries.md` |
 | `diag/flash.sh` | the owner's flash of a stick by hand: `bash`, and the `stat`, `seq`, `tr`, `grep`, `cut` and `sync` it strings together | refused: shell of our own | `issues/build/the-owners-flash-script-runs-diskutil.md` |
 | `diskutil` and `plutil` | `diag/flash.sh`, and `diskutil` in the README's flashing steps | refused: one host OS alone | `issues/build/the-owners-flash-script-runs-diskutil.md` |
 | `shasum`, a Perl script on macOS | `diag/flash.sh` hashes the image with it | refused: a Rust tool does it, `sha2`, which `src/release.rs` hashes with | `issues/build/the-owners-flash-script-runs-diskutil.md` |

issues/build/the-host-job-runs-the-toolchain-the-runner-ships.md

@@ -4,11 +4,11 @@ kind: tooling
 opened: 2026-09-03
 ---
 
-# The host job tracks whatever toolchain `macos-latest` ships, and a runner roll reds every open pull request at once
+# The host job tracks whatever toolchain ships, and a runner roll reds every open pull request at once
 
 `35383398^:.github/workflows/host-tests.yml`'s `host` job installs no Rust toolchain: it
 runs `rustc -vV; cargo -V; rustup component add clippy` on whatever
-`macos-latest` ships that day, and there is no root `rust-toolchain.toml` —
+ships that day, and there is no root `rust-toolchain.toml` —
 only `kernel/`, `bootloader/` and `userland/` pin one, each to a target list
 and none to a version.
 
@@ -64,20 +64,15 @@ default 1.97.1 after the fix.
 
 A moving input under every verdict is a supply-chain decision, not a
 convenience, and every guest lane's container image is pinned by digest, never
-by tag; the host job's `macos-latest` toolchain is not. The
+by tag; the host job's toolchain is not. The
 `CLAUDE.md` principle for
 `rust/`, this project's own compiler fork, is "kept current with upstream" — a
-deliberate track-stable choice, stated and owned. The host job's ambient
-`macos-latest` toolchain has never been stated as either: it is not pinned like
-a container image, and it is not declared track-stable like `rust/` — it simply
-moves when Apple's
-runner image moves, silently, until a new lint reds every open pull request on
-the same morning.
+deliberate track-stable choice, stated and owned.
 
 **The decision owed, not taken here:** pin a toolchain version in the host job
 (`actions-rs`-style `rust-toolchain` input, or a root `rust-toolchain.toml`
 covering the host workspace too) and roll it deliberately on its own PR when
 the tree is ready to adopt a new compiler's lints — or keep tracking whatever
-`macos-latest` ships and accept that a runner-image roll reds every open pull
+ships and accept that a runner-image roll reds every open pull
 request until someone lands the fix, the way today's did. Both are legitimate
 engineering positions; this entry does not choose between them.

issues/build/the-userland-gate-reads-an-attribute-only-where-a-line-starts.md

@@ -0,0 +1,25 @@
+---
+status: open
+kind: tooling
+opened: 2026-10-01
+---
+
+# The userland gate reads an attribute only where a line starts, so a test after code on its line runs nowhere
+
+`src/userlandhost.rs`'s `scan` reads a line for attributes only if the line
+starts with one. `fn _hidden() {} #[test] fn runs_nowhere() { panic!("never run") }`
+is a test to rustc and none to the gate. Appended to a package `host` never
+builds, it runs in no `cargo test`, and `every_userland_test_is_in_the_gate`
+stays green.
+
+Measured with `src/userlandhost.rs` byte for byte as at 5620b737e. Each row is
+a checked patch, built with `cargo run -- --build-only` (exit 0 for all),
+judged with `cargo test --lib userlandhost::tests::every_userland_test_is_in_the_gate`,
+and reverted:
+
+| appended to | form | gate |
+|---|---|---|
+| `userland/snake/src/main.rs` | the one line above | 0 |
+
+**Exit:** the scan reads an attribute wherever on a line it starts, a comment
+still holds none, and the one-line form reds.

licenses/BSD-2-Clause-newfs_msdos.txt

@@ -0,0 +1,24 @@
+Copyright (c) 1998 Robert Nordier
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in
+   the documentation and/or other materials provided with the
+   distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS
+OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
+GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

src/licence.rs

@@ -285,6 +285,46 @@ pub const COMMITTED_FILES: &[(&str, &str, &str, Terms)] = &[
         "NOTICE",
         Terms::Spdx("MIT OR Apache-2.0"),
     ),
+    // FAT32 volumes macOS's `newfs_msdos` formatted and its `msdosfs`
+    // populated, as runs of nonzero sectors. Each boot sector carries
+    // `newfs_msdos`'s boot stub; `NOTICE` carries its notice, each raw digest
+    // and the commands.
+    (
+        "toyos-fat32/tests/fixtures/blank-4k.runs",
+        "14e98fc505450882f4d284fb712d32b4f9e4d50c1bfc86702ace8f0adee745e0",
+        "NOTICE",
+        Terms::Spdx("(MIT OR Apache-2.0) AND BSD-2-Clause"),
+    ),
+    (
+        "toyos-fat32/tests/fixtures/blank-512.runs",
+        "4f1686152769fb4b064a78b0a2287c8b54bff3ec1e279b35c8f337d538a45f78",
+        "NOTICE",
+        Terms::Spdx("(MIT OR Apache-2.0) AND BSD-2-Clause"),
+    ),
+    (
+        "toyos-fat32/tests/fixtures/empty-file.runs",
+        "68a6abf1626e4bdf6b3586d3f52b2d7051390e4e18beb31258dd0021bb3e96b9",
+        "NOTICE",
+        Terms::Spdx("(MIT OR Apache-2.0) AND BSD-2-Clause"),
+    ),
+    (
+        "toyos-fat32/tests/fixtures/hostile.runs",
+        "c570b3c6944f47d2cd1498da14f12c4a98dc85683f782624181917eba68f9066",
+        "NOTICE",
+        Terms::Spdx("(MIT OR Apache-2.0) AND BSD-2-Clause"),
+    ),
+    (
+        "toyos-fat32/tests/fixtures/read-4k.runs",
+        "cab78e1ea6c46b0a04a0de32a24f1a6ac90a2017dd7188745de2d603c5ab121b",
+        "NOTICE",
+        Terms::Spdx("(MIT OR Apache-2.0) AND BSD-2-Clause"),
+    ),
+    (
+        "toyos-fat32/tests/fixtures/read-512.runs",
+        "6bef14efca36070830f5a4a2b1dc9b69a0e2627679cc5c9ed542acaa4ece416c",
+        "NOTICE",
+        Terms::Spdx("(MIT OR Apache-2.0) AND BSD-2-Clause"),
+    ),
     (
         "assets/DOOM1.WAD",
         "1d7d43be501e67d927e415e0b8f3e29c3bf33075e859721816f652a526cac771",