diff --git a/issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md b/issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md
index 6d5c436518e..2eed1c81742 100644
--- a/issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md
+++ b/issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md
@@ -242,7 +242,9 @@ Host: `toyos-net-tcp`, `toyos-dns`, `toyos-mdns`, `toyos-swap`, `toyos-inspect`,
   - an `env` request is answered with a failure, never left unanswered;
   - a program whose connection goes is ended: no `spin` left running for the next exec to list.
 - metal `https_tls13` (and `https_tls13_e1000e`, the same fetch on the 82574): ureq and rustls
-  fetch over TLS 1.3 on the I219.
+  fetch over TLS 1.3 on the I219. Stage 3 of
+  `issues/design-debt/the-internet-clients-work-unchanged.md` owns this row and deletes this
+  line.
 - metal `sshd_files`: sftp moves files byte for byte.
 - unrepresentable `netd_seeds_its_stack`: the stack cannot be built without the kernel's seed.
 
diff --git a/issues/build/toyos-builds-itself.md b/issues/build/toyos-builds-itself.md
index ee911f995f3..59bc559ade3 100644
--- a/issues/build/toyos-builds-itself.md
+++ b/issues/build/toyos-builds-itself.md
@@ -32,6 +32,75 @@ AArch64 one step behind, on `issues/kernel/toyos-runs-on-arm64.md`'s track.
   again to the same bytes.
   *Exit*: the fixed point, reached with no host in the loop.
 
+**Decided** (owner, 2026-10-01).
+- LLVM ships as a binary seed. C is accepted because the compiler is LLVM, in
+  programs too, important ones included.
+- cargo's C dependencies are accepted.
+- Perl and Python come to ToyOS.
+- Make it work, then optimise, then compare: no performance study now, and no
+  comparison before a compilation inside ToyOS succeeds.
+
+**To build** (2026-10-01), in an order that is open. Where a stage names
+libc's state it is `userland/libc` at `15625e0cb`.
+- **The `libc` crate gains a ToyOS module**, checked by `ctest` against
+  `userland/libc`'s headers. `libc` 0.2.189 has none (`rg -i toyos` over its
+  `src` matches nothing) and is empty for an OS it does not know
+  (`src/lib.rs`), and `ToyOSOrg/libc` does not exist (GitHub's API answers
+  404). cargo's `curl-sys`, `libssh2-sys` and `libgit2-sys` import its C types
+  unconditionally.
+- **libc gains `select`.** curl 8.21.0, which `curl-sys` 0.4.90 builds, does
+  not compile without it (`lib/curlx/wait.c`: `#error "We cannot compile
+  without select() support."`) and waits on its sockets through it: `select.c`
+  calls `poll` only under `HAVE_POLL`, which `curl-sys` does not define. Stage
+  3 of `issues/kernel/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md`
+  builds none, because a descriptor is a handle and passes `FD_SETSIZE`; what
+  `select` answers for such a descriptor is open.
+- **libc gains what cargo's libraries call**, among them `setvbuf` and
+  `socketpair`, which it does not define; a `realpath` that resolves, a file
+  `mmap` and record locks
+  (`issues/build/libc-refuses-what-toyos-cannot-yet-answer.md`); file
+  identities
+  (`issues/build/libc-stat-answers-one-serial-number-for-every-file.md`),
+  served like the locks by fsd; and socket descriptors that are pollable and
+  can be non-blocking
+  (`issues/build/libc-close-of-a-socket-ends-the-process.md`). Read from each
+  library's source and not run: SQLite's default VFS takes `fcntl` record
+  locks and keys them on `st_dev` and `st_ino`; libgit2 opens every repository
+  through `realpath` and reads packs through a file `mmap`; curl and libssh2
+  wait on non-blocking sockets, curl's multi handle wakes through a
+  `socketpair`, and its TLS key log sets its buffering through `setvbuf`.
+- **cargo's eight C libraries are cross-built for ToyOS**: curl, libgit2,
+  libssh2, OpenSSL, SQLite, nghttp2, zlib and blake3. Compiled and linked
+  with the toolchain's clang against that libc's C sysroot, the sources of
+  nghttp2, zlib and blake3 build with nothing undefined, and the other five
+  stop on headers, types or functions libc lacks. `openssl-src` 300.6.1 knows
+  no ToyOS target and refuses one it does not know (`src/lib.rs`), and
+  `openssl-sys` is a `cfg(unix)` dependency of `curl-sys` and `libssh2-sys`,
+  which ToyOS is not. Open until M4: whether cargo's OpenSSL is built for
+  ToyOS through its Perl `Configure`, or cargo takes curl's rustls backend
+  there.
+- **The tools a self-build runs are built for ToyOS**: Perl and Python, ported
+  to start a child by spawn and never by fork; brush as the POSIX `sh`
+  (`issues/build/ninja-runs-every-command-through-a-bin-sh-toyos-does-not-have.md`);
+  uutils; make; CMake, its libuv ported to spawn; and awk. Those written in C
+  or C++ wait on stage 3 of the child-process track and on
+  `issues/filesystem/there-is-no-dev-null.md`. A search of Perl 5.44.0's
+  sources for `posix_spawn` matches nothing. Open: which Python, which make and
+  which awk.
+- **`pkg` installs a toolchain**: an archive past 256 MiB, and links. It
+  inflates a whole archive in memory under `MAX_INFLATED`, 256 MiB, and refuses
+  every link (`userland/pkg/src/main.rs`, `archive.rs`). A toolchain's size is
+  measured on a proxy, the Linux-host release
+  `toolchain-linux-x86_64-48dd24f826263d6c`: stripped with `llvm-objcopy
+  --strip-all`, its `librustc_driver` is 184.7 MB, its clang 122.8 MB and its
+  lld 78.6 MB, beside 181.1 MB of `x86_64-unknown-toyos` libraries. And the
+  loader finds a package's own libraries
+  (`issues/filesystem/a-package-cannot-ship-its-own-libraries.md`): rustc's
+  launcher names `librustc_driver` as needed (`llvm-readobj --needed-libs`).
+- **The toolchain is `pkg` packages, and the image carries none of it.** Open:
+  how it is split into packages, and how a self-host test's guest reaches
+  them.
+
 **Blocked on other tracks.** M2 needs packages over HTTPS
 (`issues/filesystem/a-package-is-a-directory-under-apps-and-the-installer-is-a-program.md`)
 and the network stack under it (`issues/hardware/the-lan-is-not-yet-production-grade.md`,
diff --git a/issues/design-debt/the-internet-clients-work-unchanged.md b/issues/design-debt/the-internet-clients-work-unchanged.md
index 586b9b46e1c..053f8a76a96 100644
--- a/issues/design-debt/the-internet-clients-work-unchanged.md
+++ b/issues/design-debt/the-internet-clients-work-unchanged.md
@@ -23,12 +23,26 @@ netd, `toyos::net` and std's ToyOS networking in the `rust/` fork.
    lossy transfers byte-exact, timeouts honoured, a departed client freeing
    everything in netd. **Exit**: each is a guest test against the host's own
    TCP stack, with a hash over every byte moved.
-3. **TLS.** `rustls` with the `graviola` provider and the Mozilla root set
-   as a pinned data file in the signed image, used as published; what breaks
-   is fixed in this repository's layers or carried upstream as a fork.
-   **Exit**: an unmodified `rustls` client completes a handshake with a
-   host-side server in the harness, and refuses a wrong name and an untrusted
-   root.
+3. **TLS.** `rustls` with the `ring` provider (owner, 2026-10-02; `graviola`
+   is an option for later) and the Mozilla root set as a pinned data file in
+   the signed image, used as published; what breaks is fixed in this
+   repository's layers or carried upstream as a fork. This stage owns the
+   T14's `https_tls13` row, and stage H of
+   `issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md`
+   points here for it. The guest test of that name ran the tree's one ToyOS
+   program on `rustls`; the program and its judge's server installed
+   `rustls-rustcrypto` 0.0.2-alpha, and #660 cut both. The row comes back on
+   `ring` and waits for it; `rustls-rustcrypto` does not come back (owner,
+   2026-10-02). Whether `ring` builds for the ToyOS target is open and
+   untried: no build compiles it. `rustls-rustcrypto` is still named by
+   doom's build script, which installs it on the host, and by a line the cut
+   left in `tests/toyos-rust-tests`
+   (`issues/build/the-guest-test-crate-depends-on-three-crates-no-test-uses.md`).
+   Open: what doom's build script installs instead.
+   **Exit**: `https_tls13` is a `METAL` row: on the T14's I219 an unmodified
+   `ureq` and `rustls` client on the `ring` provider fetches over TLS 1.3
+   from a server the harness runs, and refuses a wrong name and an untrusted
+   root; and no manifest names `rustls-rustcrypto`.
 4. **HTTP.** An HTTP crate used as published. **Exit**: an unmodified client
    fetches a body over HTTPS, following a redirect, byte-exact.
 5. **The proof is `pkg install <url>`** — the package track's HTTPS stage
diff --git a/issues/kernel/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md b/issues/kernel/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md
index f22a4a92526..04be91853b4 100644
--- a/issues/kernel/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md
+++ b/issues/kernel/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md
@@ -77,8 +77,8 @@ directory is `issues/isolation/every-program-sees-only-the-files-it-was-given.md
    signal-set calls; `environ`, `setenv`, `unsetenv`; `kill` with `SIGKILL` for
    a child or a `-pgid` of its children, 0 as a probe, `EINVAL` for other
    signals until stage 6; `system`, `popen` and `pclose` through
-   `/system/bin/shell -c`. No `select`: a descriptor is a handle and passes
-   `FD_SETSIZE`. A handler for any signal libc imitates runs at once, beside the
+   `/system/bin/shell -c`. No `select` in this stage: `issues/build/toyos-builds-itself.md`
+   owns it. A handler for any signal libc imitates runs at once, beside the
    program: inside a blocking call of a thread that leaves the signal unblocked
    (`ppoll` and `sigsuspend` under their mask), and, while no thread is in one,
    on libc's own thread. After it `read`, `recv`, `accept`, `wait`, `waitpid`
diff --git a/issues/kernel/kernel-issues-cite-the-cut-https-tests-as-cover-that-runs.md b/issues/kernel/kernel-issues-cite-the-cut-https-tests-as-cover-that-runs.md
new file mode 100644
index 00000000000..b96b872cc56
--- /dev/null
+++ b/issues/kernel/kernel-issues-cite-the-cut-https-tests-as-cover-that-runs.md
@@ -0,0 +1,29 @@
+---
+status: open
+kind: tooling
+opened: 2026-10-02
+---
+
+# Kernel issues cite the cut HTTPS tests as cover that runs
+
+`520c0d129` deleted the guest tests `https_tls13` and `https_tls13_e1000e`, and
+three issues still give one or both as tests that run:
+
+- `issues/kernel/a-claims-own-refusals-are-read-by-nothing.md`
+- `issues/kernel/no-boot-reaches-the-refusal-that-keeps-a-bar-read-inside-a-declared-window.md`
+- `issues/kernel/no-boot-reaches-the-retry-that-undoes-a-placement-nothing-answered.md`
+
+One citation is cover no tier holds and no track owes. The last two give
+`https_tls13_e1000e` as what reads `Refusal::BarReferenceEmpty`: its judge
+asserted how many BARs the boot kept back, and that refusal's words. Outside
+`kernel/` and `issues/` no file names the refusal, its words or the kept-BAR
+record, and stage H of
+`issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md` lists
+that test for its fetch alone, on a line stage 3 of
+`issues/design-debt/the-internet-clients-work-unchanged.md` deletes.
+
+**Exit**: none of the three cites a test of either name that the tree lacks,
+and `BarReferenceEmpty` has a reader that reds when the refusal goes, or one of
+the three lists it as unread.
+
+Owner: the orchestrator.