From ab18c430f57f4fec468b4351311b0d4d13c14585 Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Sun, 4 Oct 2026 01:43:03 +0200
Subject: [PATCH 1/4] issues: record the owner's 2026-10-03 rulings where their
 tracks live
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Notes only. The observability umbrella track
issues/diagnostics/toyos-explains-itself.md, from strategy v2 and its
roast (adopt with named changes), with the owner's rulings: shipped
readers, "Keep crash records", "Only with permission", "General
counters", "Always on", symbols "adopt". The pillar tracks point at it.

The trace track keeps only the owner's words as his; the rest is
"proposal accepted". The memory-overwrite request is declined
(kind: rejected) and the parity track says so; the T14's MOR reads set
under Ubuntu, so clearing it is a new defect. The latency bar is
"131 µs". Linux's turbostat and perf msr readings of the T14 go into
the before-the-wipe issue with their commands. The ACPI rulings (back
to legacy mode, extracts only, clean-room AML) and the views rulings
(restrict, adopt, /tmp per session) go into their tracks. Issue files
naming toyos-sched, toyos-proclife or toyos-pcid point at kernel/pure,
kernel/loom and kernel/sim (#694), save transcripts run at a named
commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WcU2Dsw6mDYtwYfzVHPzM8
---
 ...t-ubuntu-left-set-stays-set-under-toyos.md |  39 ++++
 ...-the-firmwares-memory-overwrite-request.md |  37 ++--
 ...ge-takes-a-names-lowest-pid-for-the-job.md |   2 +-
 ...he-table-lock-again-is-gated-by-nothing.md |   2 +-
 ...clippy-stage-two-is-lints-one-at-a-time.md |   2 +-
 .../parallel-tests-red-under-other-suites.md  |   4 +-
 ...dropped-watchs-answer-as-its-completion.md |   2 +-
 ...ig-the-guest-cut-deleted-is-still-cited.md |   5 +-
 .../design-debt/redesign-the-log-subsystem.md |   5 +
 .../design-debt/what-is-owed-on-file-size.md  |   2 +-
 ...-in-the-machine-can-read-the-trace-ring.md |  22 +-
 .../the-kernel-keeps-nothing-it-enumerates.md |   4 +
 issues/diagnostics/toyos-explains-itself.md   | 139 +++++++++++++
 issues/filesystem/where-everything-lives.md   |   6 +-
 ...el-lack-reads-owed-before-the-t14s-wipe.md | 192 ++++++++++++++++++
 .../process-start-skew-on-a-runner.md         |   2 +-
 ...rupts-every-cpu-every-2-2-s-under-toyos.md |   4 +-
 ...rogram-sees-only-the-files-it-was-given.md |  15 +-
 ...nds-its-wake-on-a-waiter-that-then-dies.md |   2 +-
 ...e-before-its-child-lands-claims-nothing.md |   2 +-
 ...alk-by-the-threads-it-parks-on-one-ring.md |   4 +-
 ...-four-billion-threads-panics-the-kernel.md |   2 +-
 ...-total-that-reads-zero-under-contention.md |   2 +
 ...ntry-under-preemption-has-no-loom-model.md |   2 +-
 issues/kernel/desktop-window-child-freeze.md  |   2 +-
 ...ness-is-per-thread-so-thread-count-wins.md |   2 +-
 ...ranularity-bound-crossed-at-four-widths.md |   2 +-
 ...ing-enter-trips-the-one-queue-invariant.md |   2 +-
 ...ducer-and-a-kernel-that-waits-on-nobody.md |   4 +
 ...hing-charges-kernel-memory-to-a-process.md |   4 +
 ...s-without-the-timer-stop-before-cpu-off.md |   2 +-
 ...acement-is-blind-to-caches-and-topology.md |   2 +-
 ...ve-up-on-one-thread-beside-the-held-one.md |   2 +-
 ...-thread-disagrees-about-a-reaped-parent.md |   4 +-
 issues/kernel/spawned-process-never-starts.md |   6 +-
 .../steal-probe-node-dies-with-its-victim.md  |   6 +-
 .../the-global-pipe-lock-spans-a-user-copy.md |   2 +-
 ...s-linux-on-every-machine-toyos-supports.md |   5 +-
 ...-small-interrupts-post-and-threads-wait.md |   2 +-
 ...ernel-still-parses-what-userland-writes.md |   5 +-
 ...heduler-explorer-never-generates-a-stop.md |   6 +-
 ...exits-completion-post-is-the-second-one.md |   2 +-
 .../toyos-beats-linuxs-latency-on-the-t14.md  |   8 +-
 issues/kernel/toyos-runs-on-arm64.md          |  12 +-
 ...ine-in-acpi-mode-and-interprets-its-aml.md |  15 ++
 45 files changed, 509 insertions(+), 84 deletions(-)
 create mode 100644 issues/boot-media/a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos.md
 create mode 100644 issues/diagnostics/toyos-explains-itself.md

diff --git a/issues/boot-media/a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos.md b/issues/boot-media/a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos.md
new file mode 100644
index 00000000000..d409fa5294b
--- /dev/null
+++ b/issues/boot-media/a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos.md
@@ -0,0 +1,39 @@
+---
+status: open
+kind: defect
+opened: 2026-10-04
+---
+
+# A memory-overwrite request Ubuntu left set stays set under ToyOS
+
+The owner's ruling "Keep crash records" (2026-10-03,
+`issues/diagnostics/toyos-explains-itself.md`) has ToyOS not ask the firmware
+to wipe memory at reset. On the T14 the request is already made: under its
+Ubuntu (`6.8.0-142-generic`), whose EFI stub sets it on every boot
+(`issues/boot-media/the-loader-never-sets-the-firmwares-memory-overwrite-request.md`),
+
+```
+ls /sys/firmware/efi/efivars/ | grep -i -E "MemoryOverwrite|MOR"
+for f in /sys/firmware/efi/efivars/MemoryOverwriteRequestControl*; do [ -e "$f" ] && { echo "$f"; od -An -tx1 "$f"; }; done
+```
+
+read `07 00 00 00 01` for `MemoryOverwriteRequestControl` and `07 00 00 00 00`
+for `MemoryOverwriteRequestControlLock`: efivarfs's four attribute bytes
+(non-volatile, boot-service and runtime access), then the value: the request
+0x01, set, and its lock 0x00, unlocked. The variable is
+non-volatile, so it stays set into every ToyOS boot that follows Ubuntu, and
+`bootloader/src` neither reads nor writes it. Whether this firmware honours it
+on the reset paths ToyOS takes is unmeasured: a black-box record has survived
+two hours of Ubuntu, which does not say what an unclean reset does. Every
+UEFI call ToyOS makes is the loader's, so the write belongs with
+`issues/boot-media/the-loader-does-only-what-must-precede-the-handover.md`.
+
+**Exit**: where the firmware defines `MemoryOverwriteRequestControl` and it
+reads non-zero, the loader writes 0 before `ExitBootServices` and logs the
+value it found; where the firmware defines none, it makes no `SetVariable`
+call under that GUID. A guest test on a fresh OVMF variable store planted with
+1 reads 0 after the loader's pass, and one planted with nothing finds no
+variable under the GUID; deleting the write reds the first, and an
+unconditional write reds the second. On the T14, a boot that follows Ubuntu
+logs the 1 it found, and a black-box record sealed by a forced reset of that
+boot is read by the next.
diff --git a/issues/boot-media/the-loader-never-sets-the-firmwares-memory-overwrite-request.md b/issues/boot-media/the-loader-never-sets-the-firmwares-memory-overwrite-request.md
index 8520f027d76..b7e313b5516 100644
--- a/issues/boot-media/the-loader-never-sets-the-firmwares-memory-overwrite-request.md
+++ b/issues/boot-media/the-loader-never-sets-the-firmwares-memory-overwrite-request.md
@@ -1,6 +1,6 @@
 ---
-status: open
-kind: defect
+status: none
+kind: rejected
 opened: 2026-09-29
 ---
 
@@ -13,26 +13,17 @@ At `Ubuntu-6.8.0-142.142`, the x86 EFI stub runs
 `MemoryOverwriteRequestControl`=1 under vendor
 `e20939be-32d4-41be-a150-897f85d49829`
 (`drivers/firmware/efi/libstub/tpm.c:20-21`) so firmware wipes RAM
-on the next boot after an unclean reset. That function first reads the
-existing variable and returns without writing when the firmware has none
-defined (`tpm.c:36-40`), and it never inspects
-the status of the `set_efi_var` call it does make (`tpm.c:42-45`).
-`bootloader/src` writes no variable under this GUID at all.
+on the next boot after an unclean reset, where the firmware already defines
+the variable (`tpm.c:36-40`). `bootloader/src` writes no variable under this
+GUID.
 
-Root `CLAUDE.md`'s firmware rule puts every UEFI call ToyOS makes in the
-loader, before `ExitBootServices`: the write is a `SetVariable` there, and
-belongs with
-`issues/boot-media/the-loader-does-only-what-must-precede-the-handover.md`.
+**Declined** (owner, 2026-10-03): **"Keep crash records"**. ToyOS does not ask
+the firmware to wipe memory at reset; crash records survive a reset in RAM
+(`issues/diagnostics/toyos-explains-itself.md`). So ToyOS stays below Linux on
+this one line of
+`issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md`:
+whoever resets a ToyOS machine into a boot medium of their own can read what
+the last boot left in RAM.
 
-**Exit**: on firmware that already defines `MemoryOverwriteRequestControl`,
-the loader sets it to 1 before `ExitBootServices` and does not act on whether
-the write succeeded; on firmware that does not define it, the loader performs
-no `SetVariable` call under that GUID. The guest test `mor_is_set_where_defined`
-has two boots, each on a fresh OVMF `VARS`. The first plants
-`MemoryOverwriteRequestControl`=0 under that GUID with `vars::plant`
-(`tests/common/update.rs`), boots, and asserts `vars::live` reads it as 1;
-both helpers take only the anti-rollback floor's vendor today, so they gain
-the vendor as an argument. The second plants nothing and asserts no variable
-exists under that GUID afterward. Deleting the loader's `SetVariable` leaves
-the planted 0 and reds the first boot; dropping its read of the variable
-first makes the write unconditional and reds the second.
+A request already set by another system is a different matter:
+`issues/boot-media/a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos.md`.
diff --git a/issues/build/a-metal-judge-takes-a-names-lowest-pid-for-the-job.md b/issues/build/a-metal-judge-takes-a-names-lowest-pid-for-the-job.md
index dd9cf30e3a0..261a81fe34b 100644
--- a/issues/build/a-metal-judge-takes-a-names-lowest-pid-for-the-job.md
+++ b/issues/build/a-metal-judge-takes-a-names-lowest-pid-for-the-job.md
@@ -13,7 +13,7 @@ job before the job spawned anything.
 
 The kernel does not issue pids in landing order. A spawn refused after its
 admission gives its pid back, and the next admission takes it
-(`toyos_proclife::pids`). A spawn admitted before a job and refused after the
+(`kernel::proclife::pids`). A spawn admitted before a job and refused after the
 job landed hands a pid below the job's to the next spawn, and if that is the
 job's child of the same name the judge reads the child's exit as the job's.
 
diff --git a/issues/build/a-settled-thread-join-taking-the-table-lock-again-is-gated-by-nothing.md b/issues/build/a-settled-thread-join-taking-the-table-lock-again-is-gated-by-nothing.md
index e61c9f7c81b..9bb8a169122 100644
--- a/issues/build/a-settled-thread-join-taking-the-table-lock-again-is-gated-by-nothing.md
+++ b/issues/build/a-settled-thread-join-taking-the-table-lock-again-is-gated-by-nothing.md
@@ -6,7 +6,7 @@ opened: 2026-09-28
 
 # A settled thread join taking the table lock again is gated by nothing
 
-`toyos_proclife::join::Join::ask` calls its `collect` only while the join is
+`kernel::proclife::join::Join::ask` calls its `collect` only while the join is
 unsettled, and `a_settled_join_does_not_take_the_table_again` holds that.
 Whether `collect` is where the kernel takes `PROCESS_TABLE` is
 `kernel/src/process.rs`'s `ask_join`, in no crate a host test compiles. PR
diff --git a/issues/build/clippy-stage-two-is-lints-one-at-a-time.md b/issues/build/clippy-stage-two-is-lints-one-at-a-time.md
index cc889c0c357..806aca4bb7f 100644
--- a/issues/build/clippy-stage-two-is-lints-one-at-a-time.md
+++ b/issues/build/clippy-stage-two-is-lints-one-at-a-time.md
@@ -48,7 +48,7 @@ the group).
 | lint | count | why |
 |---|---:|---|
 | `checked_conversions` | 1 | `4a98107f^:kernel/src/arch/syscall.rs`'s device-register-write syscall bounded a `u64` against `u32::MAX` with a manual `as` comparison, then cast twice more in the body. Restructured through `u32::try_from` — one conversion, no repeated casts, at a trust-boundary site that is exactly what this bar is for. |
-| `manual_midpoint` | 3 | `(a + b) / 2` can overflow near the integer's max; `T::midpoint` can't. Two in a `toyos-desktop` test, one in `toyos-sched/sim`'s binary-search shrinker — no realistic overflow today, but the fix is free and closes the class everywhere, forever. |
+| `manual_midpoint` | 3 | `(a + b) / 2` can overflow near the integer's max; `T::midpoint` can't. Two in a `toyos-desktop` test, one in `kernel/sim`'s binary-search shrinker — no realistic overflow today, but the fix is free and closes the class everywhere, forever. |
 | `redundant_clone` | 6 | Real, not the false-positive-prone lint its `nursery` placement suggested — every instance checked was a clone of a binding never used again after (verified by hand, not by trusting the lint): `4a98107f^:kernel/src/arch/syscall.rs`, a `kernel-loom` test, `toyos-cc`'s parser (a double clone — the match scrutinee was already an owned value), and three in `tests/toyos.rs`. |
 | `unchecked_time_subtraction` | 1 | `tests/toyos.rs`: a bare `Duration - Duration` that panics identically today either way — `.checked_sub().expect(msg)` says why it can't underflow instead of hiding the same panic behind an operator. No behavior change; an honesty win at zero cost. |
 | `unnecessary_semicolon` | 2 | Two dead `;` after `if` statements in `kernel/src/process.rs` and `kernel/src/main.rs`. Nothing to weigh. |
diff --git a/issues/build/parallel-tests-red-under-other-suites.md b/issues/build/parallel-tests-red-under-other-suites.md
index bdb5567824f..bf4fc12c3ab 100644
--- a/issues/build/parallel-tests-red-under-other-suites.md
+++ b/issues/build/parallel-tests-red-under-other-suites.md
@@ -70,7 +70,7 @@ changes.
 - **`netd_connection_caps`** — retired 2026-09-04, green 5 of 5 beside a full
   fast tier.
 - **`metal_sim_pointer_churn`** — observed once, on a host carrying three other
-  suites *and* a `toyos-sched-sim` run. Not investigated. Still
+  suites *and* a `kernel-sim` run. Not investigated. Still
   `Sched::Parallel`.
 - **`dump_nmi_probe`** — retired 2026-09-04, green 3 of 3 beside a full fast
   tier. `4ad8875` made it `Sched::Serial`,
@@ -163,7 +163,7 @@ changes.
   of its own — five sightings, each carrying the *guest's own panic text* — and
   that class has since been diagnosed and fixed: a CPU could hand a thief the
   task whose context it was still standing on, so two CPUs ran one kernel stack
-  (`SchedPass::answer_steal_requests`, `toyos-sched/src/cpu.rs`). This sighting
+  (`SchedPass::answer_steal_requests`, `kernel/pure/sched/cpu.rs`). This sighting
   carried no console at all — `TestResult::error` held the verdict, a failing
   test's guest console is not printed, and by the time the re-runs were green
   the capture was gone — so it can be neither confirmed as that class nor ruled
diff --git a/issues/build/the-two-watch-poll-model-counts-a-dropped-watchs-answer-as-its-completion.md b/issues/build/the-two-watch-poll-model-counts-a-dropped-watchs-answer-as-its-completion.md
index 899c9c18517..4e131baa43e 100644
--- a/issues/build/the-two-watch-poll-model-counts-a-dropped-watchs-answer-as-its-completion.md
+++ b/issues/build/the-two-watch-poll-model-counts-a-dropped-watchs-answer-as-its-completion.md
@@ -6,7 +6,7 @@ opened: 2026-09-30
 
 # The two-watch poll model counts a dropped watch's answer as its completion
 
-`toyos-sched/loom/tests/loom_watch.rs`'s
+`kernel/loom/tests/loom_watch.rs`'s
 `a_poll_on_two_watches_racing_both_posts_completes_exactly_once` moves both
 worlds into their producer threads, so both watches drop before its assertion,
 and a watch's drop fires every live entry as `Fire::Gone`, which the model's
diff --git a/issues/build/the-update-rig-the-guest-cut-deleted-is-still-cited.md b/issues/build/the-update-rig-the-guest-cut-deleted-is-still-cited.md
index 52745ef69bb..218017c7ecc 100644
--- a/issues/build/the-update-rig-the-guest-cut-deleted-is-still-cited.md
+++ b/issues/build/the-update-rig-the-guest-cut-deleted-is-still-cited.md
@@ -9,7 +9,7 @@ opened: 2026-10-03
 #660 (`06788146b`) deleted `tests/common/update.rs` with its `Rig`,
 `tests/common/fwvars.rs` and `tests/updatecase/system.toml`. `git grep -n
 'fwvars\|updatecase\|common/update\.rs\|Rig::\|vars::plant\|vars::live'` finds
-nine lines in three files, each planning or describing a test on them:
+seven lines in two files, each planning or describing a test on them:
 
 - `issues/boot-media/the-loader-does-only-what-must-precede-the-handover.md`,
   six lines. Stage 3's exit takes `fwvars::live` as
@@ -17,9 +17,6 @@ nine lines in three files, each planning or describing a test on them:
   `tests/updatecase/system.toml` grants `slots` and that two tests run
   `updatecase`; one of its negative controls signs with `Rig::update` and
   reads the floor with `fwvars::live`, which its oracles name too.
-- `issues/boot-media/the-loader-never-sets-the-firmwares-memory-overwrite-request.md`,
-  two lines: its exit's `mor_is_set_where_defined` plants and reads the vars
-  store with `vars::plant` and `vars::live`.
 - `issues/build/the-kernel-console-split-does-not-re-arm-across-a-guest-reset.md`,
   one line: the reset in place it describes is `Rig::boot`'s.
 
diff --git a/issues/design-debt/redesign-the-log-subsystem.md b/issues/design-debt/redesign-the-log-subsystem.md
index c3d4a99a434..e49abb550e2 100644
--- a/issues/design-debt/redesign-the-log-subsystem.md
+++ b/issues/design-debt/redesign-the-log-subsystem.md
@@ -17,6 +17,11 @@ names nothing that will land. The directory re-shape is a scheduling matter
 exactly as priced below: one clean pass in a window with few worktrees in
 flight, and never interleaved with a code change.
 
+The log is a pillar of `issues/diagnostics/toyos-explains-itself.md`, and
+its ring is
+`issues/kernel/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md`'s;
+this file holds the sinks and the layout.
+
 The target shape stands as reviewed: a log core (ring + context stamping,
 once) with serial, file and screen as independent sinks carrying explicit
 backpressure — a slow sink drops-and-counts, never blocks, does no unbounded
diff --git a/issues/design-debt/what-is-owed-on-file-size.md b/issues/design-debt/what-is-owed-on-file-size.md
index 306c88deed9..42fd77d9c95 100644
--- a/issues/design-debt/what-is-owed-on-file-size.md
+++ b/issues/design-debt/what-is-owed-on-file-size.md
@@ -44,7 +44,7 @@ what survives it is a different question.
   no function body changed. The split made two facts visible and filed:
   58 refusal `return`s exit past the epilogue, and a refused syscall is counted
   but not timed.
-- `process.rs` — the lifecycle state machine is `toyos-proclife/` (pure,
+- `process.rs` — the lifecycle state machine is `kernel/pure/proclife/` (pure,
   `forbid(unsafe_code)`, every interleaving of a scripted pair of paths
   enumerated; #142's mechanism class now has a host reproduction). Three
   subjects are still decided inside the file and reachable only by a booted
diff --git a/issues/diagnostics/nothing-in-the-machine-can-read-the-trace-ring.md b/issues/diagnostics/nothing-in-the-machine-can-read-the-trace-ring.md
index 9522e85abcd..efa32ab5211 100644
--- a/issues/diagnostics/nothing-in-the-machine-can-read-the-trace-ring.md
+++ b/issues/diagnostics/nothing-in-the-machine-can-read-the-trace-ring.md
@@ -8,13 +8,17 @@ opened: 2026-07-30
 
 `kernel/src/trace.rs` is a per-CPU ring of `RING_CAPACITY` 24-byte `repr(C)`
 records, enabled from `main.rs` at boot and written by the timer, the
-scheduler, `irq_ring` and every `toyos_sched::hw::TraceEvent` the core emits.
+scheduler, `irq_ring` and every `kernel::sched::hw::TraceEvent` the core emits.
 Its one reader is LLDB: `p &TRACE_RINGS` and then `memory read`, which is why
 the discriminants are fixed by hand and held there by const assertions. A
 booted machine can ask itself nothing: no syscall, no tool, no gate.
 
-**Ruled** (owner, 2026-10-03): the ring is finished in three steps, and the
-work then stops and is judged before anything more is built on it.
+Part of `issues/diagnostics/toyos-explains-itself.md`, whose shared
+foundations this track obeys.
+
+**Proposal accepted** (owner, 2026-10-03): the ring is finished in three
+steps, and the work then stops and is judged before anything more is built on
+it.
 
 1. **The ring is readable**: the log's slot protocol, raw counter stamps,
    `SYS_TRACE_READ` in the shape of the log's read, the `trace` right it
@@ -27,7 +31,10 @@ work then stops and is judged before anything more is built on it.
    pick events, with no tracer in the kernel. **Exit**, on the T14: the 50 ms
    for which `hold_once` keeps both windows open once a boot
    (`kernel/src/windows.rs`) reads back as at least that much lateness.
-3. **Windows over a threshold, and shootdown records.** **Exit**: `SYS_DEBUG`'s
+3. **Windows over a threshold, shootdown records, and slow system calls.**
+   A system call over the threshold is recorded with its number and its
+   program, in the shipped kernel: **"Always on"** (owner, 2026-10-03).
+   **Exit**: `SYS_DEBUG`'s
    shootdown-acknowledgement delay names the delayed CPU and its time in the
    trace. A window's record names its opener by address, which
    `issues/kernel/the-cpu-that-spawns-a-toybox-applet-reads-1-4-ms-of-interrupts-and-preemption-off-on-the-t14.md`
@@ -39,13 +46,16 @@ Behind that judgement, and not before it: interrupt enter and exit records
 with a noise reader, the profiling sample, and the censuses moved onto the
 ring.
 
-The lines he drew:
+The proposal's other lines, accepted with it:
 
 - The ring stays always written in the shipping kernel.
 - Reading it needs a new `trace` right.
-- The reader tool is not in the shipped image.
 - The LLDB reading path and its pinned numbers go.
 - A T14 judge may read a binary trace file, the decoder printing the lines a
   pull request quotes.
 - The profiling sample shares the ring.
 - 2 MiB of rings at eight CPUs is accepted.
+
+The reader ships with ToyOS, in the owner's words (2026-10-03): "its obvious
+that we want to be able to understand kernel metrics from within toyos ...
+thats an important and productive tool that should be shipped with toyos."
diff --git a/issues/diagnostics/the-kernel-keeps-nothing-it-enumerates.md b/issues/diagnostics/the-kernel-keeps-nothing-it-enumerates.md
index 4a34a411442..35c4b960333 100644
--- a/issues/diagnostics/the-kernel-keeps-nothing-it-enumerates.md
+++ b/issues/diagnostics/the-kernel-keeps-nothing-it-enumerates.md
@@ -11,6 +11,10 @@ goes for NVMe Identify strings, USB INQUIRY strings, the GPT table and mount
 metadata. There is no `hw` and no `disk`, because there is nothing for them to
 read. Retention is the bulk of this work and it is blocked on nothing.
 
+`inspect` is a pillar of `issues/diagnostics/toyos-explains-itself.md`, which
+adds a `kernel.*` root rendered from the counters and a `supervisor.*` root
+from the program table.
+
 On top of retention, in dependency order:
 
 1. **Retention plus one query syscall and a topic decoder**, with `hw` and
diff --git a/issues/diagnostics/toyos-explains-itself.md b/issues/diagnostics/toyos-explains-itself.md
new file mode 100644
index 00000000000..e06f266eced
--- /dev/null
+++ b/issues/diagnostics/toyos-explains-itself.md
@@ -0,0 +1,139 @@
+---
+status: open
+kind: track
+opened: 2026-10-04
+---
+
+# ToyOS explains itself: log, diary, counters, accounting, inspect, sizes and post-mortem on shared foundations
+
+ToyOS answers what it is doing, what it did and what it is made of from
+inside itself, with programs it ships. Today the answers are scattered: the
+log carries numbers in prose (`irq:`, `tlb:`, `PMM:`, `sched:`, `syscalls:`),
+the trace ring has LLDB as its only reader, nothing reads APERF, MPERF,
+`MSR_SMI_COUNT`, RAPL or C-state residency, a process's memory is a byte sum
+that reads 0 under contention, and a user symbol is resolved by the kernel.
+This track is the one plan for all of it; each pillar's own track carries its
+steps and its exits, and nothing here restates them.
+
+## The owner's rulings (2026-10-03)
+
+- **Shipped**: "its obvious that we want to be able to understand kernel
+  metrics from within toyos ... thats an important and productive tool that
+  should be shipped with toyos." Every reader (`trace`, `inspect kernel.*`,
+  `size`) is in every image, and access is by rights alone.
+- **"Keep crash records"**: ToyOS does not ask the firmware to wipe memory at
+  reset; crash records survive a reset in RAM
+  (`issues/boot-media/the-loader-never-sets-the-firmwares-memory-overwrite-request.md`,
+  `issues/boot-media/a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos.md`).
+- **"Only with permission"**: reading counters takes a right. The revealing
+  ones (power, frequency, per-device interrupt counts and per-CPU wake counts)
+  take the strict diary (`trace`) right. Admin tools hold it; toybox does not.
+- **"General counters"**: the firmware-interrupt (`MSR_SMI_COUNT`) reading of
+  stage 1 of
+  `issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md`
+  is built as the first piece of the general counters, not as a one-off check.
+- **"Always on"**: the shipped kernel records a system call that runs over the
+  threshold in the diary, with its number and its program.
+- **Symbols, "adopt"**: the kernel names only itself. A killed program is
+  reported as file and offset, and userland names it. The kernel keeps its
+  own ELF reader (`toyos-elf`).
+
+Every answer to "where does this run" is ToyOS: the decoder, the reducers, the
+symbolizer and every tool run inside ToyOS, and nothing in the build, the tests
+or the reading of a record rests on another machine. Linux's readings of the
+T14 are oracles recorded as data
+(`issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md`).
+
+## The architecture (proposal accepted, 2026-10-03, with the roast's changes)
+
+Four kinds of answer, four places, and no pillar keeps a store of its own:
+words go to the **log**, events to the **diary** (the trace ring), numbers
+about now to **counters**, the Process object and `inspect`, and static facts
+to the ELF files. The kernel records, stamps and counts; userland reduces,
+symbolizes and renders. No kernel thread writes a record: the thread or
+interrupt that caused it does.
+
+| Pillar | Where it lives | Its track |
+|---|---|---|
+| Log | the kernel's ring and each program's ring, read by `logkeeper` | `issues/kernel/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md`; the sinks half of `issues/design-debt/redesign-the-log-subsystem.md` |
+| Diary | per-CPU rings of 32-byte slots, `SYS_TRACE_READ`, the `trace` tool | `issues/diagnostics/nothing-in-the-machine-can-read-the-trace-ring.md` |
+| Counters | one table declared once in `toyos-abi`, per-CPU software words and a per-CPU hardware block | this file |
+| Profile | samples are diary records; the sampler is the hard-lockup detector's | behind the diary's judgement; `issues/hardware/a-frozen-toyos-waits-for-a-hand-on-the-power-button.md` arms it every boot |
+| Accounting | the Process object (`SYS_PROCESS_STATS`) and the roster | `issues/kernel/nothing-charges-kernel-memory-to-a-process.md`, `issues/kernel/a-processs-memory-is-a-byte-total-that-reads-zero-under-contention.md`, `issues/diagnostics/blocked-time-is-invisible-while-the-park-lasts.md` |
+| Inspect | one root per owner over its connector; `kernel.*` from counters, `supervisor.*` from the program table | `issues/diagnostics/the-kernel-keeps-nothing-it-enumerates.md` |
+| Sizes | a pure crate over `toyos-elf` behind a toybox `size` applet, and the same crate in `--ci host` | this file |
+| Post-mortem | one reset-surviving region holding the black box, the previous boot's log and later its diary | the log's step 1, the diary, this file |
+| Symbols | userland names user addresses; the kernel names only its own | `issues/kernel/the-kernel-still-parses-what-userland-writes.md` Move 3, `issues/build/debug-true-produces-no-debug-info.md` |
+
+Shared foundations, which every pillar's track obeys:
+
+- **One clock.** Every stamp is the CPU's free-running counter (TSC,
+  `CNTVCT_EL0`); binary records carry raw ticks, text carries nanoseconds by
+  `toyos-abi/src/clock.rs`'s formula; a persisted region's header carries the
+  clock words.
+- **One identity.** pid and tid (`issues/diagnostics/a-record-cannot-name-thread-zero.md`);
+  the CPU is implied by the ring; a pid is never authority.
+- **One vocabulary per stream, in `toyos-abi`.** A persisted region carries the
+  vocabulary itself, not a digest of it. A program's events are keyed records
+  in its own log ring, their keys the program's own and opaque to a decoder
+  that does not know them.
+- **Two reader shapes.** A tap (log, diary): many readers, each its own
+  position; a read names one stream and a `u64` position, and the kernel clamps
+  it and computes loss saturating, never taking a count from the caller. A
+  queue (a program's ring read by `logkeeper`): one reader, and a full ring
+  refuses and counts.
+- **One right per kind of disclosure**, each right's doc listing what it
+  discloses: `log`, `trace` (every schedule, syscall numbers and durations,
+  input timing through interrupt drains, sampled addresses, and the revealing
+  counters), `counters`, roster, inventory, Process `READ`, and one connector
+  per server. `ps` stays on `SYS_SYSINFO`'s ambient header, and no toybox
+  applet gains a right before per-applet rows exist
+  (`issues/isolation/one-manifest-row-grants-every-applet-and-one-is-compared.md`).
+- **One decoder crate**, pure, `no_std` with `alloc`, forbidding unsafe: the
+  diary, persisted bytes and counter deltas, with its reducers checked on the
+  host against the scheduler simulator (`kernel/sim/src/latency.rs`). The log
+  stays with `toyos-logstream`; `ps` and `stats` link neither.
+- **One reset-surviving region**, which absorbs the black box under one
+  header: the writer's identity and kernel build-id, the clock words, the
+  vocabulary, a previous and a current half. The previous boot's bytes are
+  handed out raw and decoded in userland as untrusted input.
+- **One sampler per CPU**: the PMU-overflow NMI the hard-lockup detector arms.
+  The profile and the detector share one counter, at one fixed rate (997 Hz)
+  held by a profile handle and reverted when it closes. The NMI writes only
+  per-CPU words and a staging array its own CPU moves into the diary at its
+  next kernel exit; it never writes a ring and never dereferences a thread. A
+  Ring 3 sample raises a self-IPI so its user call chain is walked from the
+  sample's own stack. The boot deadline's seal names each CPU's last `rip`
+  from the Ring 0 timer frame.
+- **One cross-CPU request vector per architecture**, carrying kicks, counter
+  requests and the self-IPI; the timer's vector means expiry only. A
+  counter request is served by the requester on its own CPU, which then parks
+  on a Watch the last answer posts, under a bound; a CPU silent at the bound
+  is reported stale, never waited on without a bound and never a panic.
+- **Counters are monotonic counts and alloc/free pairs only.** A maximum is
+  an over-threshold diary record. A hardware counter is read only where a pure
+  function of the CPU's vendor, family and model says it exists, and every
+  counter it admits is read on each CPU at bring-up, so a wrong verdict ends
+  the boot rather than a user's read.
+- **"Now" stays "now".** `inspect` and counters answer now; the log and the
+  diary answer what happened. A list of processes or modules is a paged read,
+  and a module record is written at an executable file mapping.
+
+## What is to be built, in order
+
+Lane A, what the latency work
+(`issues/kernel/toyos-beats-linuxs-latency-on-the-t14.md`) needs: the
+diary's tid 0 and the NMI `rflags` defect
+(`issues/kernel/the-nmi-entry-can-hand-the-lockup-sample-cs-for-rflags-and-no-test-reds.md`)
+ahead of the step that reads them; then the counters with their right, the
+request vector and the kick moved onto it, whose T14 exit is that in legacy
+mode the SMI count rises alike on every CPU, and through which ACPI stage 1
+reads its flatness; then interrupts on in syscalls; then the diary's three
+steps and their judgement. Lane B, behind the judgement: the profile, call
+chains, the remaining record kinds (waker-to-woken records before usbd). Lane
+C, beside them: the rest of the counters (RAPL, C-state residency, thermal),
+the log's steps, the accounting fixes, the `inspect` roots, and `size`.
+
+**Exit**: every pillar track above is closed, and at a ToyOS shell on the T14
+`inspect kernel.*`, `trace` and `size` answer, each under the right its
+manifest row names.
diff --git a/issues/filesystem/where-everything-lives.md b/issues/filesystem/where-everything-lives.md
index 9fa3b2de22f..01bf18711c7 100644
--- a/issues/filesystem/where-everything-lives.md
+++ b/issues/filesystem/where-everything-lives.md
@@ -24,7 +24,7 @@ may reach it. Every line below is the owner's ruling.
 /home/<user>           Desktop Documents Downloads Music Pictures Videos Fonts Apps/<name>/
 /boot                  bootloader, kernel, kernel arguments; the updater's alone
 /log  /media           logs; foreign volumes, one /media/<label> each
-/tmp                   private per program
+/tmp                   one per session; each service and app its own
 ```
 
 `/system` is signed because the image is:
@@ -40,7 +40,9 @@ until that lands nothing verifies it.
   its own app folder: the owner accepted that as the honest limit.
 - **English names, never translated.**
 - **A path means the same file in every view.** `/tmp` is the one exception:
-  it is private per program. A view hides names and never renames one.
+  a session's programs share one, and each service and each app has its own
+  (amended by the owner, 2026-10-03: "Per session"). A view hides names and
+  never renames one.
 - **A program learns a location from an environment variable init sets**
   (`HOME` and those like it). A location grants nothing, because the view
   decides what a program can reach. On ToyOS `std::env::home_dir()` is `$HOME`
diff --git a/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md b/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md
index d5d7cf9ff2a..fde924bf123 100644
--- a/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md
+++ b/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md
@@ -28,4 +28,196 @@ it, and `the_t14s_facts_are_linuxs_reading_of_it` holds `T14`'s `feat_ctl`
 to 0x3A's. **Mutation**: an added reading off by one bit reds the test that
 reads it. **Oracle**: that Linux.
 
+## The counters' oracle, read 2026-10-03
+
+The T14's hardware counters (`issues/diagnostics/toyos-explains-itself.md`)
+have no independent oracle but this Linux. Run as root under Ubuntu's
+`6.8.0-142-generic` from 16:22:37 UTC, one after the other; each output below
+is whole but for trailing blanks, and none was read by a test yet: the
+counters' host test reads them when it lands.
+
+Idle, 60 s: `turbostat --quiet --interval 10 --num_iterations 6 --show
+Core,CPU,Avg_MHz,Busy%,Bzy_MHz,TSC_MHz,IRQ,SMI,CPU%c1,CPU%c6,CPU%c7,CoreTmp,PkgTmp,Pkg%pc2,Pkg%pc3,Pkg%pc6,Pkg%pc7,Pkg%pc8,Pkg%pc9,Pk%pc10,PkgWatt,CorWatt`.
+Machine-wide per 10 s: busy 0.11 to 0.36%, busy clock 980 to 1668 MHz, TSC
+2419 MHz, SMI 0, core C7 98.78 to 100.08%, package PC8 75.47 to 82.10%,
+package 1.14 to 1.88 W, cores 0.07 to 0.13 W.
+
+```
+Core	CPU	Avg_MHz	Busy%	Bzy_MHz	TSC_MHz	IRQ	SMI	CPU%c1	CPU%c6	CPU%c7	CoreTmp	PkgTmp	Pkg%pc2	Pkg%pc3	Pkg%pc6	Pkg%pc7	Pkg%pc8	Pkg%pc9	Pk%pc10	PkgWatt	CorWatt
+-	-	1	0.11	994	2419	1160	0	0.47	0.00	99.98	29	31	17.46	2.01	0.03	0.29	77.22	0.00	0.00	1.30	0.07
+0	0	1	0.11	1012	2419	131	0	0.12	0.00	100.42	26	31	17.46	2.01	0.03	0.29	77.22	0.00	0.00	1.30	0.07
+0	4	0	0.05	910	2419	53	0	0.12
+1	1	1	0.08	986	2419	57	0	0.30	0.00	100.18	27
+1	5	1	0.12	999	2419	119	0	0.30
+2	2	1	0.13	933	2419	423	0	1.29	0.00	99.04	29
+2	6	2	0.19	1002	2419	157	0	1.29
+3	3	1	0.14	978	2419	148	0	0.16	0.00	100.27	28
+3	7	1	0.09	1115	2419	72	0	0.16
+Core	CPU	Avg_MHz	Busy%	Bzy_MHz	TSC_MHz	IRQ	SMI	CPU%c1	CPU%c6	CPU%c7	CoreTmp	PkgTmp	Pkg%pc2	Pkg%pc3	Pkg%pc6	Pkg%pc7	Pkg%pc8	Pkg%pc9	Pk%pc10	PkgWatt	CorWatt
+-	-	1	0.11	980	2419	1009	0	0.38	0.00	100.08	29	30	19.01	1.80	0.05	0.22	76.10	0.00	0.00	1.81	0.07
+0	0	1	0.07	975	2419	46	0	0.14	0.00	100.37	26	30	19.01	1.80	0.05	0.22	76.10	0.00	0.00	1.81	0.07
+0	4	1	0.11	913	2419	72	0	0.14
+1	1	0	0.03	997	2419	23	0	0.19	0.00	100.34	25
+1	5	1	0.13	993	2419	130	0	0.19
+2	2	1	0.11	943	2419	386	0	1.14	0.00	99.27	29
+2	6	2	0.18	1035	2419	155	0	1.14
+3	3	1	0.14	967	2419	141	0	0.06	0.00	100.36	27
+3	7	1	0.09	997	2419	56	0	0.06
+Core	CPU	Avg_MHz	Busy%	Bzy_MHz	TSC_MHz	IRQ	SMI	CPU%c1	CPU%c6	CPU%c7	CoreTmp	PkgTmp	Pkg%pc2	Pkg%pc3	Pkg%pc6	Pkg%pc7	Pkg%pc8	Pkg%pc9	Pk%pc10	PkgWatt	CorWatt
+-	-	1	0.11	1005	2419	1125	0	0.42	0.00	100.03	29	31	19.47	1.35	0.06	0.23	75.87	0.00	0.00	1.43	0.07
+0	0	1	0.12	1081	2419	42	0	0.08	0.00	100.39	26	31	19.47	1.35	0.06	0.23	75.87	0.00	0.00	1.43	0.07
+0	4	1	0.13	998	2419	56	0	0.08
+1	1	1	0.10	1006	2419	127	0	0.22	0.00	100.21	25
+1	5	1	0.14	1004	2419	132	0	0.22
+2	2	2	0.16	981	2419	513	0	1.33	0.00	99.12	29
+2	6	1	0.08	1028	2419	75	0	1.33
+3	3	1	0.13	953	2419	137	0	0.05	0.00	100.42	28
+3	7	1	0.06	1019	2419	43	0	0.05
+Core	CPU	Avg_MHz	Busy%	Bzy_MHz	TSC_MHz	IRQ	SMI	CPU%c1	CPU%c6	CPU%c7	CoreTmp	PkgTmp	Pkg%pc2	Pkg%pc3	Pkg%pc6	Pkg%pc7	Pkg%pc8	Pkg%pc9	Pk%pc10	PkgWatt	CorWatt
+-	-	6	0.36	1668	2419	1966	0	1.14	0.00	98.78	29	32	18.49	1.12	0.04	0.33	75.47	0.00	0.00	1.14	0.13
+0	0	7	0.43	1587	2419	231	0	0.90	0.00	99.10	26	32	18.49	1.12	0.04	0.33	75.47	0.00	0.00	1.14	0.13
+0	4	2	0.15	994	2419	96	0	0.90
+1	1	11	0.48	2410	2419	185	0	1.08	0.00	98.67	27
+1	5	7	0.46	1450	2419	348	0	1.08
+2	2	8	0.48	1564	2419	635	0	1.97	0.00	98.11	29
+2	6	1	0.08	1040	2419	72	0	1.97
+3	3	12	0.69	1725	2419	326	0	0.60	0.00	99.24	28
+3	7	1	0.08	1053	2419	73	0	0.60
+Core	CPU	Avg_MHz	Busy%	Bzy_MHz	TSC_MHz	IRQ	SMI	CPU%c1	CPU%c6	CPU%c7	CoreTmp	PkgTmp	Pkg%pc2	Pkg%pc3	Pkg%pc6	Pkg%pc7	Pkg%pc8	Pkg%pc9	Pk%pc10	PkgWatt	CorWatt
+-	-	1	0.12	984	2419	1166	0	0.39	0.00	100.01	29	31	13.62	2.79	0.04	0.39	80.55	0.00	0.00	1.30	0.07
+0	0	0	0.05	957	2419	34	0	0.09	0.00	100.41	26	31	13.62	2.79	0.04	0.39	80.55	0.00	0.00	1.30	0.07
+0	4	1	0.13	943	2419	78	0	0.09
+1	1	1	0.05	982	2419	47	0	0.36	0.00	100.00	27
+1	5	2	0.23	1023	2419	186	0	0.36
+2	2	1	0.05	1001	2419	45	0	0.09	0.00	100.38	29
+2	6	2	0.15	989	2419	135	0	0.09
+3	3	2	0.22	959	2419	535	0	1.04	0.00	99.26	28
+3	7	1	0.10	994	2419	106	0	1.04
+Core	CPU	Avg_MHz	Busy%	Bzy_MHz	TSC_MHz	IRQ	SMI	CPU%c1	CPU%c6	CPU%c7	CoreTmp	PkgTmp	Pkg%pc2	Pkg%pc3	Pkg%pc6	Pkg%pc7	Pkg%pc8	Pkg%pc9	Pk%pc10	PkgWatt	CorWatt
+-	-	1	0.12	980	2419	1156	0	0.39	0.00	100.03	28	31	13.35	1.53	0.07	0.41	82.10	0.00	0.00	1.88	0.07
+0	0	1	0.05	958	2419	40	0	0.16	0.00	100.38	26	31	13.35	1.53	0.07	0.41	82.10	0.00	0.00	1.88	0.07
+0	4	1	0.11	947	2419	82	0	0.16
+1	1	1	0.09	989	2419	76	0	0.26	0.00	100.09	26
+1	5	2	0.19	990	2419	174	0	0.26
+2	2	1	0.09	965	2419	335	0	0.96	0.00	99.42	28
+2	6	2	0.19	995	2419	178	0	0.96
+3	3	2	0.19	976	2419	242	0	0.18	0.00	100.24	28
+3	7	0	0.04	1021	2419	29	0	0.18
+```
+
+Loaded, 60 s, eight `yes > /dev/null` started 2 s before: `for i in 1 2 3 4 5
+6 7 8; do timeout 65 sh -c "yes > /dev/null" & done; sleep 2; turbostat
+--quiet --interval 10 --num_iterations 6 --show
+Core,CPU,Avg_MHz,Busy%,Bzy_MHz,TSC_MHz,IRQ,SMI,CPU%c1,CPU%c6,CPU%c7,CoreTmp,PkgTmp,Pkg%pc2,Pkg%pc6,Pk%pc10,PkgWatt,CorWatt;
+wait`. Busy 99.77%; busy clock 3800 MHz at 30.24 and 30.73 W package for the
+first two intervals, 3555 MHz at 27.20 W in the third, then 3075 to 3094 MHz
+at 19.62 to 19.92 W; about 10,000
+interrupts per CPU per 10 s; SMI 0.
+
+```
+Core	CPU	Avg_MHz	Busy%	Bzy_MHz	TSC_MHz	IRQ	SMI	CPU%c1	CPU%c6	CPU%c7	CoreTmp	PkgTmp	Pkg%pc2	Pkg%pc6	Pk%pc10	PkgWatt	CorWatt
+-	-	3791	99.77	3800	2419	80691	0	0.00	0.00	0.00	71	71	0.00	0.00	0.00	30.24	27.88
+0	0	3791	99.77	3800	2419	10023	0	0.00	0.00	0.00	61	71	0.00	0.00	0.00	30.24	27.88
+0	4	3791	99.77	3800	2419	10021	0	0.00
+1	1	3791	99.77	3800	2419	10066	0	0.00	0.00	0.00	71
+1	5	3791	99.77	3800	2419	10102	0	0.00
+2	2	3791	99.77	3800	2419	10031	0	0.00	0.00	0.00	62
+2	6	3791	99.77	3800	2419	10274	0	0.00
+3	3	3791	99.77	3800	2419	10125	0	0.00	0.00	0.00	71
+3	7	3791	99.77	3800	2419	10049	0	0.00
+Core	CPU	Avg_MHz	Busy%	Bzy_MHz	TSC_MHz	IRQ	SMI	CPU%c1	CPU%c6	CPU%c7	CoreTmp	PkgTmp	Pkg%pc2	Pkg%pc6	Pk%pc10	PkgWatt	CorWatt
+-	-	3791	99.77	3800	2419	80659	0	0.00	0.00	0.00	79	79	0.00	0.00	0.00	30.73	28.29
+0	0	3791	99.77	3800	2419	10012	0	0.00	0.00	0.00	68	79	0.00	0.00	0.00	30.73	28.29
+0	4	3791	99.77	3800	2419	10014	0	0.00
+1	1	3791	99.77	3800	2419	10026	0	0.00	0.00	0.00	79
+1	5	3791	99.77	3800	2419	10095	0	0.00
+2	2	3791	99.77	3800	2419	10017	0	0.00	0.00	0.00	69
+2	6	3791	99.77	3800	2419	10364	0	0.00
+3	3	3791	99.77	3800	2419	10122	0	0.00	0.00	0.00	78
+3	7	3791	99.77	3800	2419	10009	0	0.00
+Core	CPU	Avg_MHz	Busy%	Bzy_MHz	TSC_MHz	IRQ	SMI	CPU%c1	CPU%c6	CPU%c7	CoreTmp	PkgTmp	Pkg%pc2	Pkg%pc6	Pk%pc10	PkgWatt	CorWatt
+-	-	3547	99.77	3555	2419	80555	0	0.00	0.00	0.00	66	66	0.00	0.00	0.00	27.20	24.72
+0	0	3547	99.77	3555	2419	10021	0	0.00	0.00	0.00	58	66	0.00	0.00	0.00	27.20	24.72
+0	4	3547	99.77	3555	2419	10010	0	0.00
+1	1	3547	99.77	3555	2419	10028	0	0.00	0.00	0.00	65
+1	5	3547	99.77	3555	2419	10037	0	0.00
+2	2	3547	99.77	3555	2419	10028	0	0.00	0.00	0.00	60
+2	6	3547	99.77	3555	2419	10246	0	0.00
+3	3	3547	99.77	3555	2419	10173	0	0.00	0.00	0.00	66
+3	7	3547	99.77	3555	2419	10012	0	0.00
+Core	CPU	Avg_MHz	Busy%	Bzy_MHz	TSC_MHz	IRQ	SMI	CPU%c1	CPU%c6	CPU%c7	CoreTmp	PkgTmp	Pkg%pc2	Pkg%pc6	Pk%pc10	PkgWatt	CorWatt
+-	-	3068	99.77	3075	2419	80909	0	0.00	0.00	0.00	65	65	0.00	0.00	0.00	19.62	17.18
+0	0	3068	99.77	3075	2419	10054	0	0.00	0.00	0.00	59	65	0.00	0.00	0.00	19.62	17.18
+0	4	3068	99.77	3075	2419	10029	0	0.00
+1	1	3068	99.77	3075	2419	10121	0	0.00	0.00	0.00	65
+1	5	3068	99.77	3075	2419	10039	0	0.00
+2	2	3068	99.77	3075	2419	10069	0	0.00	0.00	0.00	59
+2	6	3068	99.77	3075	2419	10276	0	0.00
+3	3	3068	99.77	3075	2419	10229	0	0.00	0.00	0.00	64
+3	7	3068	99.76	3075	2419	10092	0	0.00
+Core	CPU	Avg_MHz	Busy%	Bzy_MHz	TSC_MHz	IRQ	SMI	CPU%c1	CPU%c6	CPU%c7	CoreTmp	PkgTmp	Pkg%pc2	Pkg%pc6	Pk%pc10	PkgWatt	CorWatt
+-	-	3083	99.77	3090	2419	80593	0	0.00	0.00	0.00	65	65	0.00	0.00	0.00	19.85	17.43
+0	0	3083	99.77	3090	2419	10008	0	0.00	0.00	0.00	58	65	0.00	0.00	0.00	19.85	17.43
+0	4	3083	99.77	3090	2419	10020	0	0.00
+1	1	3083	99.77	3090	2419	10006	0	0.00	0.00	0.00	64
+1	5	3083	99.77	3090	2419	10019	0	0.00
+2	2	3083	99.77	3090	2419	10028	0	0.00	0.00	0.00	60
+2	6	3083	99.77	3090	2419	10282	0	0.00
+3	3	3083	99.77	3090	2419	10221	0	0.00	0.00	0.00	65
+3	7	3083	99.77	3090	2419	10009	0	0.00
+Core	CPU	Avg_MHz	Busy%	Bzy_MHz	TSC_MHz	IRQ	SMI	CPU%c1	CPU%c6	CPU%c7	CoreTmp	PkgTmp	Pkg%pc2	Pkg%pc6	Pk%pc10	PkgWatt	CorWatt
+-	-	3087	99.77	3094	2419	80544	0	0.00	0.00	0.00	65	65	0.00	0.00	0.00	19.92	17.49
+0	0	3087	99.77	3094	2419	10009	0	0.00	0.00	0.00	58	65	0.00	0.00	0.00	19.92	17.49
+0	4	3087	99.77	3094	2419	10011	0	0.00
+1	1	3087	99.77	3094	2419	10012	0	0.00	0.00	0.00	65
+1	5	3087	99.77	3094	2419	10009	0	0.00
+2	2	3087	99.77	3094	2419	10017	0	0.00	0.00	0.00	59
+2	6	3087	99.77	3094	2419	10273	0	0.00
+3	3	3087	99.77	3094	2419	10205	0	0.00	0.00	0.00	65
+3	7	3087	99.77	3094	2419	10008	0	0.00
+```
+
+Idle, 60 s: `perf stat -a -A -e msr/aperf/,msr/mperf/,msr/smi/,msr/tsc/ sleep
+60`. `msr/smi/` 0 on all eight CPUs; `msr/tsc/` 145,157,230,321 to
+145,157,642,420 per CPU over 60.002902881 s, 2419.2 MHz.
+
+```
+ Performance counter stats for 'system wide':
+
+CPU0           98,079,648      msr/aperf/
+CPU1          181,130,722      msr/aperf/
+CPU2          121,578,728      msr/aperf/
+CPU3          140,715,079      msr/aperf/
+CPU4           61,297,064      msr/aperf/
+CPU5          191,874,303      msr/aperf/
+CPU6           96,508,493      msr/aperf/
+CPU7           74,201,638      msr/aperf/
+CPU0          150,186,840      msr/mperf/
+CPU1          192,582,720      msr/mperf/
+CPU2          234,799,920      msr/mperf/
+CPU3          313,507,656      msr/mperf/
+CPU4          156,309,048      msr/mperf/
+CPU5          326,606,712      msr/mperf/
+CPU6          227,450,760      msr/mperf/
+CPU7          156,326,856      msr/mperf/
+CPU0                    0      msr/smi/
+CPU1                    0      msr/smi/
+CPU2                    0      msr/smi/
+CPU3                    0      msr/smi/
+CPU4                    0      msr/smi/
+CPU5                    0      msr/smi/
+CPU6                    0      msr/smi/
+CPU7                    0      msr/smi/
+CPU0      145,157,386,466      msr/tsc/
+CPU1      145,157,434,015      msr/tsc/
+CPU2      145,157,376,550      msr/tsc/
+CPU3      145,157,230,321      msr/tsc/
+CPU4      145,157,567,260      msr/tsc/
+CPU5      145,157,642,420      msr/tsc/
+CPU6      145,157,528,396      msr/tsc/
+CPU7      145,157,356,567      msr/tsc/
+
+      60.002902881 seconds time elapsed
+```
+
 Owner: the orchestrator, which holds the T14 the exit runs on.
diff --git a/issues/hardware/process-start-skew-on-a-runner.md b/issues/hardware/process-start-skew-on-a-runner.md
index a9df9a83d4b..b99a8495c4c 100644
--- a/issues/hardware/process-start-skew-on-a-runner.md
+++ b/issues/hardware/process-start-skew-on-a-runner.md
@@ -27,7 +27,7 @@ time.
 
 **One of the three candidates has narrowed, and nothing here has been
 re-measured** (read 2026-08-24). `Balance::PushOnSurplus` ships as of the owner's
-2026-08-23 decision (`toyos-sched/src/cpu.rs`, `Balance`): the pull half was
+2026-08-23 decision (`kernel/pure/sched/cpu.rs`, `Balance`): the pull half was
 one-shot, so a CPU reaching its idle pass while every sibling still published
 zero surplus halted with no probe outstanding and nothing in the protocol woke
 it — which is exactly the shape "the scheduler leaving a task unclaimed"
diff --git a/issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md b/issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md
index 71e05398e98..3a28f1e3a96 100644
--- a/issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md
+++ b/issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md
@@ -74,7 +74,9 @@ are this by reading, those kernels not reading the count.
 **Owner**: stage 1 of
 `issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md`,
 for the fix and for the reading: its exit holds the count flat on the T14 over
-this exit's interval, so the stage builds the row.
+this exit's interval, so the stage builds the row, and it reads the count
+through the general counters ("General counters", owner, 2026-10-03,
+`issues/diagnostics/toyos-explains-itself.md`).
 
 **Exit**: a T14 row reads `MSR_SMI_COUNT` on every CPU after init is spawned
 and after the boot's last write to `SMI_CMD`, whoever makes it, and again at
diff --git a/issues/isolation/every-program-sees-only-the-files-it-was-given.md b/issues/isolation/every-program-sees-only-the-files-it-was-given.md
index 25a65f939bd..7ace38ef042 100644
--- a/issues/isolation/every-program-sees-only-the-files-it-was-given.md
+++ b/issues/isolation/every-program-sees-only-the-files-it-was-given.md
@@ -37,6 +37,19 @@ was handed, so isolating people follows from isolating programs.
   With that, the mount guard is deleted. Login data sits in the login
   authority's view alone.
 
+**Ruled** (owner, 2026-10-03):
+
+- **Who starts programs, "Restrict"**: a program starts only the programs its
+  own `system.toml` row lists, and a system program is swapped or updated only
+  from the login session.
+- **Grants, "Adopt"**: a file grant is an unforgeable badge on a connection,
+  written by whoever minted the connection; the kernel vouches for what was
+  granted, never for who connects. Revocation comes later.
+- **`/tmp`, "Per session"**: a session's programs share one `/tmp`, and each
+  service and each app has its own. This amends the 2026-09-26 ruling of
+  `issues/filesystem/where-everything-lives.md` that `/tmp` is private per
+  program.
+
 Unix permission bits and numeric user ids are rejected: they leave every path
 nameable by every program and make confused-deputy bugs structural.
 
@@ -70,7 +83,7 @@ nameable by every program and make confused-deputy bugs structural.
    on top of views: a login authority (sshd, and later a local greeter) holds
    a `login` right and asks init's `launcher` for a session, and init builds
    the session's view from the user's row: the user's home, `/system`
-   read-only, and a private `/tmp`. The machine's SSH identity is sshd's own
+   read-only, and the session's own `/tmp`. The machine's SSH identity is sshd's own
    state, not a user's. There is no `root` user and no `/home/root`, and a
    single key list sits in the login authority's view. **Exit**: a program in
    one user's session cannot name a file in another's, and appending to the
diff --git a/issues/kernel/a-bounded-post-spends-its-wake-on-a-waiter-that-then-dies.md b/issues/kernel/a-bounded-post-spends-its-wake-on-a-waiter-that-then-dies.md
index ec77998b07b..395467db746 100644
--- a/issues/kernel/a-bounded-post-spends-its-wake-on-a-waiter-that-then-dies.md
+++ b/issues/kernel/a-bounded-post-spends-its-wake-on-a-waiter-that-then-dies.md
@@ -6,7 +6,7 @@ opened: 2026-09-26
 
 # A bounded post spends its wake on a waiter that then answers Killed
 
-`toyos-sched/src/watch.rs`'s `Watch::post_n` counts a waiter whose word it
+`kernel/pure/sched/watch.rs`'s `Watch::post_n` counts a waiter whose word it
 claimed `Committing → WakeQueued` (`Notify::PrePark`) as woken. That waiter's
 own commit reads the kill bit before the claim (`park::WaitTicket::commit`) and
 answers `Commit::Killed`, so the claim was spent on a thread that unwinds and
diff --git a/issues/kernel/a-kill-on-a-spawns-handle-before-its-child-lands-claims-nothing.md b/issues/kernel/a-kill-on-a-spawns-handle-before-its-child-lands-claims-nothing.md
index d2618675d9f..164da477bc0 100644
--- a/issues/kernel/a-kill-on-a-spawns-handle-before-its-child-lands-claims-nothing.md
+++ b/issues/kernel/a-kill-on-a-spawns-handle-before-its-child-lands-claims-nothing.md
@@ -11,7 +11,7 @@ handle to its child in the spawner's table before `loader::spawn` lands the
 child in the process table, and a handle's number is its table's own
 arithmetic, so another thread of the spawner can name the handle in between.
 A `SYS_PROCESS_KILL` on it there claims nothing:
-`toyos_proclife::teardown::claim_teardown` answers `false` for a pid not in
+`kernel::proclife::teardown::claim_teardown` answers `false` for a pid not in
 the table, and `process::kill_process` answers `Ok`. The child then lands and
 runs. `kill_process`'s "`Ok` for an already-gone process: the caller asked for
 it to be dead and it is" does not cover a process not yet there.
diff --git a/issues/kernel/a-process-lengthens-an-interrupts-off-walk-by-the-threads-it-parks-on-one-ring.md b/issues/kernel/a-process-lengthens-an-interrupts-off-walk-by-the-threads-it-parks-on-one-ring.md
index d0dc5d77598..8e4395730d2 100644
--- a/issues/kernel/a-process-lengthens-an-interrupts-off-walk-by-the-threads-it-parks-on-one-ring.md
+++ b/issues/kernel/a-process-lengthens-an-interrupts-off-walk-by-the-threads-it-parks-on-one-ring.md
@@ -18,8 +18,8 @@ holder, decides how long a CPU runs with interrupts masked:
 - **N threads parked in `submit` on one ring**
   are N registrations on its watch. Every completion into that ring posts the
   watch in place, which notifies all N under the list lock
-  (`toyos-sched/src/watch.rs`), each a word exchange and, for a parked
-  thread, a mailbox push and perhaps an IPI (`toyos-sched/src/park.rs`).
+  (`kernel/pure/sched/watch.rs`), each a word exchange and, for a parked
+  thread, a mailbox push and perhaps an IPI (`kernel/pure/sched/park.rs`).
   Each woken thread's unregister is a `position` and a
   `remove` over the N, and a registration
   that finds the list full copies it, all with interrupts masked.
diff --git a/issues/kernel/a-process-that-starts-four-billion-threads-panics-the-kernel.md b/issues/kernel/a-process-that-starts-four-billion-threads-panics-the-kernel.md
index 121776c2d33..0d510e254aa 100644
--- a/issues/kernel/a-process-that-starts-four-billion-threads-panics-the-kernel.md
+++ b/issues/kernel/a-process-that-starts-four-billion-threads-panics-the-kernel.md
@@ -18,7 +18,7 @@ fault that thread takes.
 
 Userland reaches it by starting and joining threads in a loop; only a
 successful start spends an id, so it costs 2^32 thread starts, never measured.
-A pid had the same shape until `toyos_proclife::pids` (stops below `Pid::MAX`
+A pid had the same shape until `kernel::proclife::pids` (stops below `Pid::MAX`
 and refuses the next spawn by name); a thread id needs the same: never
 `Tid::MAX`, and a refused start once the ids are spent.
 
diff --git a/issues/kernel/a-processs-memory-is-a-byte-total-that-reads-zero-under-contention.md b/issues/kernel/a-processs-memory-is-a-byte-total-that-reads-zero-under-contention.md
index f7a52d3b124..98b0df1fd99 100644
--- a/issues/kernel/a-processs-memory-is-a-byte-total-that-reads-zero-under-contention.md
+++ b/issues/kernel/a-processs-memory-is-a-byte-total-that-reads-zero-under-contention.md
@@ -51,6 +51,8 @@ silent zero. Then bounded spawn/join plateaus driven through the real std path.
 not retain the objects it counts. Both are proved by comparing its total against
 a quiescent page-table and PMM walk at the start and at the end.
 
+Accounting is a pillar of `issues/diagnostics/toyos-explains-itself.md`.
+
 **Half the defect is not the joined half.** A `JoinHandle` dropped without `join`
 detaches, and the record's exit condition currently closes only the joined path.
 The plateau must cover both.
diff --git a/issues/kernel/crash-entry-under-preemption-has-no-loom-model.md b/issues/kernel/crash-entry-under-preemption-has-no-loom-model.md
index eae310ac233..3b0e21c2f73 100644
--- a/issues/kernel/crash-entry-under-preemption-has-no-loom-model.md
+++ b/issues/kernel/crash-entry-under-preemption-has-no-loom-model.md
@@ -7,7 +7,7 @@ opened: 2026-09-01
 # Crash entry under preemption has no loom model, and a Boolean one would pass
 
 The rule that a model must import its subject rather than transliterate it is
-already this tree's, and already enforced. `toyos-sched/loom/src/lib.rs` pulls
+already this tree's, and already enforced. `kernel/loom/src/lib.rs` pulls
 every scheduler source in by `#[path]` (`:26-49`), and its header at `:6-8` says
 why: "loom explores the interleavings of the *real* primitives, not of a
 re-implementation — a re-implementation is exactly the divergence risk this
diff --git a/issues/kernel/desktop-window-child-freeze.md b/issues/kernel/desktop-window-child-freeze.md
index e6e58d22998..c20cc4dded9 100644
--- a/issues/kernel/desktop-window-child-freeze.md
+++ b/issues/kernel/desktop-window-child-freeze.md
@@ -125,7 +125,7 @@ The family's other half is closed: a CPU that stops taking passes no longer
 keeps being *chosen*. `CpuHandle::answering` refuses a CPU whose doorbell edge
 has stood longer than a pass may take, and spawn placement, the RT
 wake-forward, the surplus push and the steal probe's victim all ask it
-(`toyos-sched/src/cpu.rs`). So one route from "a core goes quiet" to "the
+(`kernel/pure/sched/cpu.rs`). So one route from "a core goes quiet" to "the
 machine gets progressively worse" is gone.
 
 **Nothing in that explains this entry.** The signature at the top is a machine
diff --git a/issues/kernel/fairness-is-per-thread-so-thread-count-wins.md b/issues/kernel/fairness-is-per-thread-so-thread-count-wins.md
index 65aee5ccee2..acd38f55709 100644
--- a/issues/kernel/fairness-is-per-thread-so-thread-count-wins.md
+++ b/issues/kernel/fairness-is-per-thread-so-thread-count-wins.md
@@ -12,7 +12,7 @@ Queued track from the 2026-08-16 owner conversation on scheduler direction.
 work is the rest of the hierarchy.** Fair scheduling no longer shares the CPU
 between *threads*. All threads of one process share a vruntime, so a second
 runnable thread bumps a refcount and buys no second slice
-(`toyos-sched/src/fair.rs:95-99`), and the state it advances is one `KShare`
+(`kernel/pure/sched/fair.rs:95-99`), and the state it advances is one `KShare`
 per `Pid` (`kernel/src/scheduler.rs:249`, minted at `:257-268`). A process with
 100 threads no longer out-schedules one with 8 by showing up more.
 
diff --git a/issues/kernel/granularity-bound-crossed-at-four-widths.md b/issues/kernel/granularity-bound-crossed-at-four-widths.md
index 1504031a2f8..e063b45e83f 100644
--- a/issues/kernel/granularity-bound-crossed-at-four-widths.md
+++ b/issues/kernel/granularity-bound-crossed-at-four-widths.md
@@ -13,7 +13,7 @@ sharper statement.
 
 The bound is derived from granularities the policy itself picked:
 `lag_spread + (ΣT_i + 1) × (QUANTUM + max KernelSection + 2 × RUN_CHUNK)`
-(`toyos-sched/sim/src/invariants.rs:695-697`).
+(`kernel/sim/src/invariants.rs:695-697`).
 
 **Re-measured 2026-08-24 at `739af0c2`**, the whole sweep, 500 seeds a width:
 
diff --git a/issues/kernel/io-uring-enter-trips-the-one-queue-invariant.md b/issues/kernel/io-uring-enter-trips-the-one-queue-invariant.md
index 62618d13e81..537462dec0b 100644
--- a/issues/kernel/io-uring-enter-trips-the-one-queue-invariant.md
+++ b/issues/kernel/io-uring-enter-trips-the-one-queue-invariant.md
@@ -41,7 +41,7 @@ and once with `q35,i8042=off`, so both the PS/2 and the USB delivery paths reach
 it, and the victim both times was the in-guest runner blocked on stdin at
 `===READY===`. It does not reproduce at ordinary typing rates. Two ways in, one
 subject: a `waiting` flag left set by a previous wait of that thread, over
-`set_waiting()` in `toyos-sched/src/task.rs`.
+`set_waiting()` in `kernel/pure/sched/task.rs`.
 
 What the assertion says happened: this thread's task word still carried
 *waiting* when `enter` prepared a new wait. `enter`'s loop consumes its ticket
diff --git a/issues/kernel/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md b/issues/kernel/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md
index 95296355cf6..cb75e547afd 100644
--- a/issues/kernel/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md
+++ b/issues/kernel/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md
@@ -18,6 +18,10 @@ nor at a stop, which init sequences through `logd`'s flush. `logd` syncs on an
 alert or an interval, keeps every boot's first part, and holds each program
 to an allowance. Severity is an ordered ladder.
 
+The log is a pillar of `issues/diagnostics/toyos-explains-itself.md`,
+whose shared foundations its steps obey: step 1's ring is the reset-surviving
+region's, and step 2's keys are how a program writes an event.
+
 What is left, in order:
 
 **1. The kernel's ring, rebuilt as one lockless variable-length ring with a
diff --git a/issues/kernel/nothing-charges-kernel-memory-to-a-process.md b/issues/kernel/nothing-charges-kernel-memory-to-a-process.md
index 7a003252238..fc04e7904ed 100644
--- a/issues/kernel/nothing-charges-kernel-memory-to-a-process.md
+++ b/issues/kernel/nothing-charges-kernel-memory-to-a-process.md
@@ -23,6 +23,10 @@ user-string copy has a ceiling. What survives is the *accounting*, which nothing
 has touched, plus one item: peak memory is written by two paths that overwrite
 each other.
 
+Accounting is a pillar of `issues/diagnostics/toyos-explains-itself.md`:
+a process's counts and the machine's per-category counters are two sums of
+the same charges.
+
 Blocked on nothing. Two things worth knowing before it is restarted, because
 both cost a day to discover:
 
diff --git a/issues/kernel/nothing-fails-without-the-timer-stop-before-cpu-off.md b/issues/kernel/nothing-fails-without-the-timer-stop-before-cpu-off.md
index c066f9d10f4..45fb33fe79d 100644
--- a/issues/kernel/nothing-fails-without-the-timer-stop-before-cpu-off.md
+++ b/issues/kernel/nothing-fails-without-the-timer-stop-before-cpu-off.md
@@ -19,7 +19,7 @@ test can fail if the stop is deleted:
 - No AArch64 metal target exists. By the owner's ruling in
   `issues/kernel/toyos-runs-on-arm64.md`, no ARM hardware is a target.
 - `SGI_OFF` lands on idle CPUs. An idle CPU with no parked deadline has
-  already stopped its one-shot (`toyos-sched/src/timer.rs:43`), so deleting
+  already stopped its one-shot (`kernel/pure/sched/timer.rs:43`), so deleting
   the stop changes nothing even on metal in that case.
 
 The stop serves a wider claim: no interrupt reaches a core `CPU_OFF` turned
diff --git a/issues/kernel/placement-is-blind-to-caches-and-topology.md b/issues/kernel/placement-is-blind-to-caches-and-topology.md
index ac3b962d19d..c1a29123cc9 100644
--- a/issues/kernel/placement-is-blind-to-caches-and-topology.md
+++ b/issues/kernel/placement-is-blind-to-caches-and-topology.md
@@ -25,5 +25,5 @@ placement story has three parts none of which we have:
   kernel currently does not model at all.
 
 Composes with the reservation model (placement decides *where*, reservations
-decide *how much*) and with the toyos-sched sim, which would need a topology
+decide *how much*) and with the scheduler simulator (`kernel/sim`), which would need a topology
 model to gate any of this.
diff --git a/issues/kernel/quiesce-wakes-on-the-last-park-gave-up-on-one-thread-beside-the-held-one.md b/issues/kernel/quiesce-wakes-on-the-last-park-gave-up-on-one-thread-beside-the-held-one.md
index a36c9da628a..5d41dcf17a3 100644
--- a/issues/kernel/quiesce-wakes-on-the-last-park-gave-up-on-one-thread-beside-the-held-one.md
+++ b/issues/kernel/quiesce-wakes-on-the-last-park-gave-up-on-one-thread-beside-the-held-one.md
@@ -34,7 +34,7 @@ the `stop:` record carries only counts.
 
 **Hypothesis A, untested.** The hold's yield loop keeps its CPU busy. A Ready
 thread queued on that CPU then runs only if `dispose_yield`
-(`toyos-sched/src/cpu.rs`) re-inserts the spinner behind it.
+(`kernel/pure/sched/cpu.rs`) re-inserts the spinner behind it.
 
 **What no guest test checks while these are deleted.**
 
diff --git a/issues/kernel/spawn-thread-disagrees-about-a-reaped-parent.md b/issues/kernel/spawn-thread-disagrees-about-a-reaped-parent.md
index 65ea7db4cd7..1351d58dc5d 100644
--- a/issues/kernel/spawn-thread-disagrees-about-a-reaped-parent.md
+++ b/issues/kernel/spawn-thread-disagrees-about-a-reaped-parent.md
@@ -43,11 +43,11 @@ yet answers it.
 one sentence at the site saying whether the entry can be missing, and the two
 phases made to agree with it.
 
-Found while extracting the lifecycle's decisions into `toyos-proclife`
+Found while extracting the lifecycle's decisions into what is now `kernel/pure/proclife`
 (2026-08-24), which is what made the two spellings of one lookup visible: they
 are now one function asked twice, and the callers still disagree about its
 `NoSuchProcess` answer.
-`toyos_proclife::interleave::tests::a_thread_exit_that_outlived_its_entry_still_leaves`
+`kernel::proclife::interleave::tests::a_thread_exit_that_outlived_its_entry_still_leaves`
 holds the schedule that reaches the state at `thread_exit`. **It reaches it by
 routing rather than by running**: the model's `retire` takes a thread off every
 CPU, so no schedule it can enumerate has a live thread arriving at a syscall
diff --git a/issues/kernel/spawned-process-never-starts.md b/issues/kernel/spawned-process-never-starts.md
index 7ade9abb9a8..7790d691d02 100644
--- a/issues/kernel/spawned-process-never-starts.md
+++ b/issues/kernel/spawned-process-never-starts.md
@@ -107,7 +107,7 @@ which is what the rotating scan start produces when several CPUs publish zero
 and one of them is dead. What `min_by_key` over a stale zero adds is that the
 fraction never shrinks, however long the CPU has been gone.
 
-`CpuHandle::answering` is the rule now, in `toyos-sched`: a CPU whose doorbell
+`CpuHandle::answering` is the rule now, in `kernel/pure/sched`: a CPU whose doorbell
 edge has stood for longer than a pass may take is not a claim about the present,
 and the four paths that choose a CPU — spawn placement, the RT wake-forward,
 the surplus push and the steal probe's victim — all ask it. **What is left of
@@ -115,7 +115,7 @@ this defect after that is one task per CPU that goes quiet**, because the first
 message posted to a silent CPU is what raises the edge the rule reads. The
 simulator measures exactly that: `scenarios::stopped_cpu` loses 1 program of 24
 on every one of 16 seeds, against 10 at worst and 114 in total with the rule
-reverted (`toyos-sched/sim/tests/policy.rs`,
+reverted (`kernel/sim/tests/policy.rs`,
 `a_stopped_cpu_stops_taking_work`).
 
 ## What is still open here, stated as the two things it is
@@ -135,7 +135,7 @@ stays open for it.
 
 ## The process table is not where this is, and that is now checked rather than argued
 
-`toyos-proclife` enumerates every interleaving of the paths this file's shapes
+`kernel/pure/proclife` enumerates every interleaving of the paths this file's shapes
 implicate — a spawn racing a kill and the idle pass that reaps the entry, a
 sibling's `SYS_THREAD_EXIT` beside the process's own exit and a spawn, two
 spawns racing one teardown, a join racing the kill that takes its target — and
diff --git a/issues/kernel/steal-probe-node-dies-with-its-victim.md b/issues/kernel/steal-probe-node-dies-with-its-victim.md
index c5a46a0db65..754a94865f6 100644
--- a/issues/kernel/steal-probe-node-dies-with-its-victim.md
+++ b/issues/kernel/steal-probe-node-dies-with-its-victim.md
@@ -27,7 +27,7 @@ for the boot.
 
 Nor can the node be reclaimed. It may still be linked into the stopped CPU's
 queue, and re-posting a linked node is what invariant N1 in
-`toyos-sched/src/mailbox.rs` exists to forbid: the consumer would walk a node
+`kernel/pure/sched/mailbox.rs` exists to forbid: the consumer would walk a node
 whose `next` had been rewritten under it. Whatever closes this has to be a
 second node, a probe that is not node-shaped, or a way for a CPU to disown its
 whole mailbox — none of which is a change to `post_steal_probe`.
@@ -39,7 +39,7 @@ is still open (`issues/kernel/spawned-process-never-starts.md`).
 
 ## It reproduces in a second, on the real primitive
 
-`toyos-sched/loom/tests/loom_mailbox.rs`'s `steal_probe_model` drives the real
+`kernel/loom/tests/loom_mailbox.rs`'s `steal_probe_model` drives the real
 `MailboxNode`, `MailboxProducer` and `MailboxConsumer` through claim, post, pop
 and repost. The `victim-retires-mid-probe` feature makes the victim's last pass
 its last, and loom finds the schedule:
@@ -61,7 +61,7 @@ measure is the width of the window: the model's thief posts unconditionally,
 where `best_victim` posts only into a CPU `CpuHandle::answering` still admits.
 
 **No drop edge is modelled, and an earlier draft of this entry claimed one.**
-`MailboxConsumer` has no `Drop` impl — `toyos-sched/src/mailbox.rs` has two,
+`MailboxConsumer` has no `Drop` impl — `kernel/pure/sched/mailbox.rs` has two,
 `MailboxNode:172` and `PostSlot:200` — so dropping the consumer runs no code,
 and the count above already clears `in_flight` before any assertion. The line
 that dropped it was deleted after it was measured bit-identical in both arms.
diff --git a/issues/kernel/the-global-pipe-lock-spans-a-user-copy.md b/issues/kernel/the-global-pipe-lock-spans-a-user-copy.md
index 237e07851bc..400bd73c381 100644
--- a/issues/kernel/the-global-pipe-lock-spans-a-user-copy.md
+++ b/issues/kernel/the-global-pipe-lock-spans-a-user-copy.md
@@ -28,7 +28,7 @@ Everything pipe-shaped in the kernel goes through the same static: `create` (`pi
 
 This is **not** the device-I/O class. The copy is memory-speed and takes no device round trip, so it does not approach `sync::Lock`'s 500,000,000-spin `DEADLOCK` panic (`sync.rs:72-75`) the way a `block::Handle`'s device lock does — that class is tracked in `issues/hardware/xhci-waits-are-spins.md` and is not what this file is about.
 
-What it is: a global lock held with preemption disabled for a stretch that scales with a userland-chosen length up to 2 MiB, on the path that carries every IPC message in the system. The scheduler's own bar for an uninterruptible stretch is `MAX_PASS_NS = 200_000` ns (`toyos-sched/src/cpu.rs:1235`); a 2 MiB copy plus, on first write, a 2 MiB zeroing and a bitmap scan is on the wrong side of that at any plausible memory bandwidth. **The hold time is not measured and that is the first thing owed.**
+What it is: a global lock held with preemption disabled for a stretch that scales with a userland-chosen length up to 2 MiB, on the path that carries every IPC message in the system. The scheduler's own bar for an uninterruptible stretch is `MAX_PASS_NS = 200_000` ns (`kernel/pure/sched/cpu.rs:1235`); a 2 MiB copy plus, on first write, a 2 MiB zeroing and a bitmap scan is on the wrong side of that at any plausible memory bandwidth. **The hold time is not measured and that is the first thing owed.**
 
 Two things make it worth closing rather than noting. The convoy is machine-wide, not per-pipe: one process reading 2 MiB out of a full pipe stalls an unrelated process's `SYS_CONNECT` and an unrelated inbox's readiness poll. And it is directly userland-driven — the length is the caller's, so a program that wants the stall only has to ask for it.
 
diff --git a/issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md b/issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md
index 6f55f33dbb5..08e1b574abc 100644
--- a/issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md
+++ b/issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md
@@ -12,6 +12,10 @@ security feature such a CPU offers. The proving machines are the T14 and
 AMD EPYC KVM guests; the PR gate's TCG model proves wiring only. A
 probe is a `boot-actuators` arm or a `test-actuators` `SYS_DEBUG` action.
 
+One line of Linux's is declined, and ToyOS stays below it there: the
+firmware's memory-overwrite request, by the owner's "Keep crash records"
+(`issues/boot-media/the-loader-never-sets-the-firmwares-memory-overwrite-request.md`).
+
 **Exit**: every issue below is closed, in the order listed.
 
 - `issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md`
@@ -33,7 +37,6 @@ probe is a `boot-actuators` arm or a `test-actuators` `SYS_DEBUG` action.
 - `issues/kernel/kernel-text-is-writable-and-every-kernel-page-executable.md`
 - `issues/kernel/the-kernel-heap-has-none-of-slubs-hardening.md`
 - `issues/kernel/a-device-without-a-domain-of-its-own-reaches-all-memory.md`
-- `issues/boot-media/the-loader-never-sets-the-firmwares-memory-overwrite-request.md`
 - `issues/kernel/user-programs-run-without-a-shadow-stack.md`
 - `issues/kernel/the-kernel-runs-without-indirect-branch-tracking.md`
 - `issues/kernel/the-kernel-runs-without-a-shadow-stack.md`
diff --git a/issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md b/issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md
index 9ebf9e99773..b72c844e22d 100644
--- a/issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md
+++ b/issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md
@@ -48,7 +48,7 @@ times:
    the per-thread record ring, the `Source` double dispatch and the per-module
    watcher lists are deleted. **Exit**: making an object waitable is one field,
    and the interleaving models check the smaller protocol.
-   **Done** (#513): `toyos-sched/src/watch.rs` and `park.rs`. `kernel/src` is
+   **Done** (#513): `kernel/pure/sched/watch.rs` and `park.rs`. `kernel/src` is
    720 lines smaller (62931 to 62211). No instrument in the tree measures an
    interrupts-off or a preemption-off span. The nearest, `sched_check_build`'s
    pass cost, separated nothing on the dev host: the largest pass per CPU was
diff --git a/issues/kernel/the-kernel-still-parses-what-userland-writes.md b/issues/kernel/the-kernel-still-parses-what-userland-writes.md
index b591a5a2ff5..b82b529e6f9 100644
--- a/issues/kernel/the-kernel-still-parses-what-userland-writes.md
+++ b/issues/kernel/the-kernel-still-parses-what-userland-writes.md
@@ -41,7 +41,10 @@ needs the blocking story to be efficient, and the boot path needs its story told
 first: the kernel mounts ROOT itself, but what mounts `/boot` and `/home`, and
 with what authority, is the open question.
 
-**Move 3 — the panic-time symbol resolver**, small and independent. ELF parsing
+**Move 3 — the panic-time symbol resolver**, small and independent. Ruled
+(owner, 2026-10-03, "adopt", `issues/diagnostics/toyos-explains-itself.md`): the
+kernel names only itself, a killed program is reported as file and offset and
+userland names it, and the kernel keeps its own ELF reader. ELF parsing
 is already a pure crate that forbids unsafe and is tested against a crafted
 corpus, and the symbol machinery moved onto it in the 2026-08-15 consolidation —
 so what is left of this move is one decision: `rustc-demangle`'s standing. It is
diff --git a/issues/kernel/the-scheduler-explorer-never-generates-a-stop.md b/issues/kernel/the-scheduler-explorer-never-generates-a-stop.md
index daa9446a811..868732b893a 100644
--- a/issues/kernel/the-scheduler-explorer-never-generates-a-stop.md
+++ b/issues/kernel/the-scheduler-explorer-never-generates-a-stop.md
@@ -6,7 +6,7 @@ opened: 2026-09-25
 
 # The scheduler's interleaving explorer never generates a stop
 
-`toyos-sched/sim` explores interleavings of blocks, wakes, migrations and
+`kernel/sim` explores interleavings of blocks, wakes, migrations and
 teardowns across CPUs, but no `Op` it generates marks a task `STOP`. The machine's
 stop adds three routes into the per-CPU `stopped` band:
 
@@ -16,8 +16,8 @@ stop adds three routes into the per-CPU `stopped` band:
   mark.
 
 Each of them races a cross-CPU wake, an adopt in transit or a retire. The only
-coverage is the single-CPU unit tests in `toyos-sched/src/cpu.rs` and
-`toyos-sched/src/task.rs`, which drive each route once and in order. The sim's
+coverage is the single-CPU unit tests in `kernel/pure/sched/cpu.rs` and
+`kernel/pure/sched/task.rs`, which drive each route once and in order. The sim's
 invariants include I1, every task in exactly one container. None of them has
 been checked with a stopped task in the machine.
 
diff --git a/issues/kernel/thread-exits-completion-post-is-the-second-one.md b/issues/kernel/thread-exits-completion-post-is-the-second-one.md
index c16fbc16c55..f9444a61d54 100644
--- a/issues/kernel/thread-exits-completion-post-is-the-second-one.md
+++ b/issues/kernel/thread-exits-completion-post-is-the-second-one.md
@@ -33,7 +33,7 @@ zombie mark that the joiner's predicate reads is already in the table before
 either post, because `release_thread` writes it before returning.
 
 **How this was found, and why it is filed rather than acted on.** The host
-model of the lifecycle (`toyos-proclife`) was built with a negative control
+model of the lifecycle (`kernel/pure/proclife`) was built with a negative control
 that reverted the post's subject to the process's main thread — the kernel this
 tree had before `1bfe4e5b`, when the wake was by name into a shared parking lot.
 The control had no teeth: with `publish_released` modelled faithfully, the
diff --git a/issues/kernel/toyos-beats-linuxs-latency-on-the-t14.md b/issues/kernel/toyos-beats-linuxs-latency-on-the-t14.md
index 4805b66b62e..4a52f599e9e 100644
--- a/issues/kernel/toyos-beats-linuxs-latency-on-the-t14.md
+++ b/issues/kernel/toyos-beats-linuxs-latency-on-the-t14.md
@@ -31,12 +31,12 @@ It samples: a window under 1 ms is seen only when a tick falls in it.
 - No firmware interrupt on any CPU in 120.378 s, with `SCI_EN` set (#681,
   comments 5962619169 and 5962768253).
 
-Open with the owner: which figure of Linux's is the bar, cpu4's 2.9 ms or
-the other CPUs' longest.
+**Ruled** (owner, 2026-10-03): **"131 µs"**. ToyOS must beat Linux's worst
+delay on the other seven CPUs, 131 µs, not cpu4's one-off 2.9 ms event.
 
 **Exit**: each step's exit is met, in the file the step names, and on the T14
-the longest lateness of a 1 kHz timer's interrupt and of the thread it wakes,
-on each CPU, reads under Linux's. Nothing takes that reading of ToyOS today:
+the longest lateness of a 1 kHz timer's interrupt on each CPU reads under
+131 µs, and of the thread it wakes under Linux's longest on those seven CPUs. Nothing takes that reading of ToyOS today:
 `latency_wake` reads one thread's p99 and `mask_windows` each CPU's longest
 masked windows. Two files owe it: step 2 of
 `issues/diagnostics/nothing-in-the-machine-can-read-the-trace-ring.md`, a
diff --git a/issues/kernel/toyos-runs-on-arm64.md b/issues/kernel/toyos-runs-on-arm64.md
index 37f44bc331a..8f4242a54fb 100644
--- a/issues/kernel/toyos-runs-on-arm64.md
+++ b/issues/kernel/toyos-runs-on-arm64.md
@@ -70,8 +70,8 @@ Every x86 guest on this host runs under TCG emulation instead — there is no
 160, `rtc.rs` (CMOS through port I/O) 222. Also `drivers/serial.rs` (433
 lines: a 16550 at a port, `serial.rs:28-39,157-165,389-396`).
 
-**x86-only pure crates, 1,305 lines:** `toyos-ps2` 377, `toyos-tco` 313,
-`toyos-pcid` 388 (it becomes an ASID allocator), `toyos-bootmap` 227
+**x86-only pure code, 1,305 lines:** `toyos-ps2` 377, `toyos-tco` 313,
+`kernel/pure/pcid` 388 (it becomes an ASID allocator), `toyos-bootmap` 227
 (PML4[0]/PML4[256], `toyos-bootmap/src/lib.rs:21-29`).
 
 **Inline assembly**, 834 lines by a paren-depth scan of
@@ -146,9 +146,9 @@ output (`collect.rs` 80 `Aarch64` mentions, `reloc.rs` 69) but hardwires
 refuses anything but `EM_X86_64` (`toyos-elf/src/header.rs:24,75`).
 
 **Already abstracted.** The syscall stub already has both arms
-(`toyos-abi/src/syscall.rs:678,703`: `syscall` and `svc #0`). `toyos-sched`
+(`toyos-abi/src/syscall.rs:678,703`: `syscall` and `svc #0`). `kernel/pure/sched`
 (8,099 lines) is pure behind `Machine`/`Hw`
-(`toyos-sched/src/hw.rs:88-158`: `now`, `set_timer`, `stop_timer`,
+(`kernel/pure/sched/hw.rs:88-158`: `now`, `set_timer`, `stop_timer`,
 `irq_guard`, `halt`, `need_resched`, `switch`), with `kernel/src/arch/x86_64/hw.rs` as
 the one x86 implementation and a simulator as the other. PCI is
 ECAM/MMIO-only (`drivers/pci.rs:134-154`), no `0xCF8`. NVMe, xHCI and virtio
@@ -194,7 +194,7 @@ before any aarch64 file exists, with x86 as its only user:
   language.
 - **Pure crates stay arch-free.** A per-arch decision that becomes pure lives
   in its own crate, as `toyos-bootmap` does: it grows a TTBR plan, and
-  `toyos-pcid` becomes an ASID/PCID allocator.
+  `kernel/pure/pcid` becomes an ASID/PCID allocator.
 
 ## x86 left in generic code
 
@@ -254,7 +254,7 @@ Each stage names its exit; "measured" means a number from a run.
    and each of the three deletions is shown red.
    **Built on one CPU, ahead of small-kernel stage 6 by the owner's word:**
    the kernel's own tables (`TTBR1_EL1` holding memory and nothing else, each
-   user space on `TTBR0_EL1` under a 16-bit ASID from `toyos-pcid`), the
+   user space on `TTBR0_EL1` under a 16-bit ASID from `kernel/pure/pcid`), the
    GICv3's SGIs and the virtual timer's PPI, the EL0 entry, and the context
    switch carrying FP/SIMD; the `virt_` tests other than `virt_early_panic`,
    `virt_early_fault` and `virt_el2_drop` judge it under the EL2 profile, emulated, because HVF
diff --git a/issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md b/issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md
index 3cb371c922e..b16d52b5f89 100644
--- a/issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md
+++ b/issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md
@@ -39,6 +39,21 @@ writes its own, and the battery comes first (his direction of `0ee814f5a`).
   built and reviewed first; he then presses the button once, briefly, on a
   boot held open for it.
 
+**Ruled** (owner, 2026-10-03), on the server, the tables and the interpreter:
+
+- **"General counters"**: stage 1's `MSR_SMI_COUNT` reading is built as the
+  first piece of the general counters
+  (`issues/diagnostics/toyos-explains-itself.md`), not as a one-off check.
+- **"Back to legacy mode"**: when the server dies and its `acpi` claim is
+  released, the kernel writes `ACPI_DISABLE` to `SMI_CMD`, so the firmware
+  handles the buttons again.
+- **"Extracts only"**: the repository holds small decoded extracts of the
+  T14's ACPI tables; the whole tables stay out of the tree, read only by a
+  check run outside it.
+- **"full clean room write with the spec"**: the AML interpreter is written
+  from the ACPI specification. uACPI and ACPICA are run only as black-box
+  oracles, and whoever writes the interpreter never reads their source.
+
 **Stage 1: ACPI mode, its SCI served in userland.** The switch to ACPI mode,
 and a userland server that claims the SCI, handles the power button, a
 fixed event that needs no AML, and takes the EC's events. **Exit**: on the

From e97189ac34f7ef09d90f8c45571d68a0b071195e Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Sun, 4 Oct 2026 02:25:55 +0200
Subject: [PATCH 2/4] Answer review round 1: every line says whose it is

The umbrella track keeps only the owner's rulings, quoted, and a short list
of the orchestrator's decisions, each marked whether it was told to the owner
with his veto or came from the roast and was never put to him; the
architecture and shared-foundations sections go. The counters ruling is his
option text verbatim: power and per-device interrupts are the revealing
counters, and toybox goes without only until each program can be granted
rights on its own.

Move 3 cites the crate ruling for the kernel's ELF reader, names the work
"adopt" leaves (no kernel naming of a program's addresses, no per-spawn
backtrace table, a userland namer) and gains an exit. The diary's step 3 exit
reads a slow system call's record; ACPI stage 1 gains a T14 row for "Back to
legacy mode", and the oracle use of uACPI and ACPICA is the orchestrator's
reading, not the ruling. The latency exit names the spawning load under which
Linux read 131 us. The counters' Linux readings name the T14 row that reads
them; a deleted test's citation says it was deleted in fa1e3254d; a past
toyos-sched-sim transcript stays as written.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WcU2Dsw6mDYtwYfzVHPzM8
---
 ...t-ubuntu-left-set-stays-set-under-toyos.md |   2 +-
 .../parallel-tests-red-under-other-suites.md  |   2 +-
 ...-in-the-machine-can-read-the-trace-ring.md |  13 +-
 .../the-kernel-keeps-nothing-it-enumerates.md |   6 +-
 issues/diagnostics/toyos-explains-itself.md   | 166 ++++++------------
 ...el-lack-reads-owed-before-the-t14s-wipe.md |  12 +-
 ...ducer-and-a-kernel-that-waits-on-nobody.md |   6 +-
 ...hing-charges-kernel-memory-to-a-process.md |   4 +-
 ...-thread-disagrees-about-a-reaped-parent.md |  14 +-
 ...ernel-still-parses-what-userland-writes.md |  28 ++-
 .../toyos-beats-linuxs-latency-on-the-t14.md  |   8 +-
 ...ine-in-acpi-mode-and-interprets-its-aml.md |   9 +-
 12 files changed, 120 insertions(+), 150 deletions(-)

diff --git a/issues/boot-media/a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos.md b/issues/boot-media/a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos.md
index d409fa5294b..198f227bf65 100644
--- a/issues/boot-media/a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos.md
+++ b/issues/boot-media/a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos.md
@@ -34,6 +34,6 @@ value it found; where the firmware defines none, it makes no `SetVariable`
 call under that GUID. A guest test on a fresh OVMF variable store planted with
 1 reads 0 after the loader's pass, and one planted with nothing finds no
 variable under the GUID; deleting the write reds the first, and an
-unconditional write reds the second. On the T14, a boot that follows Ubuntu
+unconditional write reds the second. On the T14, a boot that finds it set
 logs the 1 it found, and a black-box record sealed by a forced reset of that
 boot is read by the next.
diff --git a/issues/build/parallel-tests-red-under-other-suites.md b/issues/build/parallel-tests-red-under-other-suites.md
index bf4fc12c3ab..386f8380d6f 100644
--- a/issues/build/parallel-tests-red-under-other-suites.md
+++ b/issues/build/parallel-tests-red-under-other-suites.md
@@ -70,7 +70,7 @@ changes.
 - **`netd_connection_caps`** — retired 2026-09-04, green 5 of 5 beside a full
   fast tier.
 - **`metal_sim_pointer_churn`** — observed once, on a host carrying three other
-  suites *and* a `kernel-sim` run. Not investigated. Still
+  suites *and* a `toyos-sched-sim` run. Not investigated. Still
   `Sched::Parallel`.
 - **`dump_nmi_probe`** — retired 2026-09-04, green 3 of 3 beside a full fast
   tier. `4ad8875` made it `Sched::Serial`,
diff --git a/issues/diagnostics/nothing-in-the-machine-can-read-the-trace-ring.md b/issues/diagnostics/nothing-in-the-machine-can-read-the-trace-ring.md
index efa32ab5211..0a346c25365 100644
--- a/issues/diagnostics/nothing-in-the-machine-can-read-the-trace-ring.md
+++ b/issues/diagnostics/nothing-in-the-machine-can-read-the-trace-ring.md
@@ -13,12 +13,11 @@ Its one reader is LLDB: `p &TRACE_RINGS` and then `memory read`, which is why
 the discriminants are fixed by hand and held there by const assertions. A
 booted machine can ask itself nothing: no syscall, no tool, no gate.
 
-Part of `issues/diagnostics/toyos-explains-itself.md`, whose shared
-foundations this track obeys.
+Part of `issues/diagnostics/toyos-explains-itself.md`.
 
-**Proposal accepted** (owner, 2026-10-03): the ring is finished in three
-steps, and the work then stops and is judged before anything more is built on
-it.
+**Proposal accepted** (owner, 2026-10-03, "Build it as proposed"): the ring
+is finished in three steps, and the work then stops and is judged before
+anything more is built on it.
 
 1. **The ring is readable**: the log's slot protocol, raw counter stamps,
    `SYS_TRACE_READ` in the shape of the log's read, the `trace` right it
@@ -36,7 +35,9 @@ it.
    program, in the shipped kernel: **"Always on"** (owner, 2026-10-03).
    **Exit**: `SYS_DEBUG`'s
    shootdown-acknowledgement delay names the delayed CPU and its time in the
-   trace. A window's record names its opener by address, which
+   trace. A system call held past the threshold in a shipped-configuration
+   kernel reads back from the trace with its number and its program. A
+   window's record names its opener by address, which
    `issues/kernel/the-cpu-that-spawns-a-toybox-applet-reads-1-4-ms-of-interrupts-and-preemption-off-on-the-t14.md`
    and
    `issues/kernel/the-supervisors-claim-of-a-pci-function-the-t14-lacks-holds-interrupts-off-for-3-8-ms.md`
diff --git a/issues/diagnostics/the-kernel-keeps-nothing-it-enumerates.md b/issues/diagnostics/the-kernel-keeps-nothing-it-enumerates.md
index 35c4b960333..0d4e7bbf256 100644
--- a/issues/diagnostics/the-kernel-keeps-nothing-it-enumerates.md
+++ b/issues/diagnostics/the-kernel-keeps-nothing-it-enumerates.md
@@ -11,9 +11,9 @@ goes for NVMe Identify strings, USB INQUIRY strings, the GPT table and mount
 metadata. There is no `hw` and no `disk`, because there is nothing for them to
 read. Retention is the bulk of this work and it is blocked on nothing.
 
-`inspect` is a pillar of `issues/diagnostics/toyos-explains-itself.md`, which
-adds a `kernel.*` root rendered from the counters and a `supervisor.*` root
-from the program table.
+`inspect` is a pillar of `issues/diagnostics/toyos-explains-itself.md`. The
+orchestrator's plan, not ruled: a `kernel.*` root rendered from the counters
+and a `supervisor.*` root from the program table.
 
 On top of retention, in dependency order:
 
diff --git a/issues/diagnostics/toyos-explains-itself.md b/issues/diagnostics/toyos-explains-itself.md
index e06f266eced..7db62c15d38 100644
--- a/issues/diagnostics/toyos-explains-itself.md
+++ b/issues/diagnostics/toyos-explains-itself.md
@@ -4,7 +4,7 @@ kind: track
 opened: 2026-10-04
 ---
 
-# ToyOS explains itself: log, diary, counters, accounting, inspect, sizes and post-mortem on shared foundations
+# ToyOS explains itself: log, diary, counters, accounting, inspect, sizes and post-mortem
 
 ToyOS answers what it is doing, what it did and what it is made of from
 inside itself, with programs it ships. Today the answers are scattered: the
@@ -12,128 +12,78 @@ log carries numbers in prose (`irq:`, `tlb:`, `PMM:`, `sched:`, `syscalls:`),
 the trace ring has LLDB as its only reader, nothing reads APERF, MPERF,
 `MSR_SMI_COUNT`, RAPL or C-state residency, a process's memory is a byte sum
 that reads 0 under contention, and a user symbol is resolved by the kernel.
-This track is the one plan for all of it; each pillar's own track carries its
-steps and its exits, and nothing here restates them.
+Each pillar's own track carries its steps and its exits; this track holds the
+counters and sizes pillars, which no other track does.
 
 ## The owner's rulings (2026-10-03)
 
-- **Shipped**: "its obvious that we want to be able to understand kernel
-  metrics from within toyos ... thats an important and productive tool that
-  should be shipped with toyos." Every reader (`trace`, `inspect kernel.*`,
-  `size`) is in every image, and access is by rights alone.
+- On the diary's reader: "its obvious that we want to be able to understand
+  kernel metrics from within toyos ... thats an important and productive tool
+  that should be shipped with toyos."
 - **"Keep crash records"**: ToyOS does not ask the firmware to wipe memory at
-  reset; crash records survive a reset in RAM
-  (`issues/boot-media/the-loader-never-sets-the-firmwares-memory-overwrite-request.md`,
-  `issues/boot-media/a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos.md`).
-- **"Only with permission"**: reading counters takes a right. The revealing
-  ones (power, frequency, per-device interrupt counts and per-CPU wake counts)
-  take the strict diary (`trace`) right. Admin tools hold it; toybox does not.
+  reset, and crash records survive a reset in RAM
+  (`issues/boot-media/the-loader-never-sets-the-firmwares-memory-overwrite-request.md`).
+- **"Only with permission"**, the option he chose: "A program needs a
+  permission to read counters; the revealing ones (power, per-device
+  interrupts) need the strict diary permission. Admin tools get them; ordinary
+  programs and the toolbox don't until each program can be granted rights on
+  its own."
 - **"General counters"**: the firmware-interrupt (`MSR_SMI_COUNT`) reading of
   stage 1 of
   `issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md`
   is built as the first piece of the general counters, not as a one-off check.
 - **"Always on"**: the shipped kernel records a system call that runs over the
   threshold in the diary, with its number and its program.
-- **Symbols, "adopt"**: the kernel names only itself. A killed program is
-  reported as file and offset, and userland names it. The kernel keeps its
-  own ELF reader (`toyos-elf`).
+- **Symbols, "adopt"**: the kernel names only itself; a killed program is
+  reported as file and offset, and one userland naming service shares the
+  kernel's lookup and demangling code. He asked that it never panic or fail.
 
-Every answer to "where does this run" is ToyOS: the decoder, the reducers, the
-symbolizer and every tool run inside ToyOS, and nothing in the build, the tests
-or the reading of a record rests on another machine. Linux's readings of the
-T14 are oracles recorded as data
-(`issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md`).
-
-## The architecture (proposal accepted, 2026-10-03, with the roast's changes)
+## Decided by the orchestrator, not ruled (2026-10-03)
 
-Four kinds of answer, four places, and no pillar keeps a store of its own:
-words go to the **log**, events to the **diary** (the trace ring), numbers
-about now to **counters**, the Process object and `inspect`, and static facts
-to the ELF files. The kernel records, stamps and counts; userland reduces,
-symbolizes and renders. No kernel thread writes a record: the thread or
-interrupt that caused it does.
+From the orchestrator's strategy and the roast of it that he adopted. A line
+marked *told* was told to the owner with his veto open; the rest were not put
+to him.
 
-| Pillar | Where it lives | Its track |
-|---|---|---|
-| Log | the kernel's ring and each program's ring, read by `logkeeper` | `issues/kernel/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md`; the sinks half of `issues/design-debt/redesign-the-log-subsystem.md` |
-| Diary | per-CPU rings of 32-byte slots, `SYS_TRACE_READ`, the `trace` tool | `issues/diagnostics/nothing-in-the-machine-can-read-the-trace-ring.md` |
-| Counters | one table declared once in `toyos-abi`, per-CPU software words and a per-CPU hardware block | this file |
-| Profile | samples are diary records; the sampler is the hard-lockup detector's | behind the diary's judgement; `issues/hardware/a-frozen-toyos-waits-for-a-hand-on-the-power-button.md` arms it every boot |
-| Accounting | the Process object (`SYS_PROCESS_STATS`) and the roster | `issues/kernel/nothing-charges-kernel-memory-to-a-process.md`, `issues/kernel/a-processs-memory-is-a-byte-total-that-reads-zero-under-contention.md`, `issues/diagnostics/blocked-time-is-invisible-while-the-park-lasts.md` |
-| Inspect | one root per owner over its connector; `kernel.*` from counters, `supervisor.*` from the program table | `issues/diagnostics/the-kernel-keeps-nothing-it-enumerates.md` |
-| Sizes | a pure crate over `toyos-elf` behind a toybox `size` applet, and the same crate in `--ci host` | this file |
-| Post-mortem | one reset-surviving region holding the black box, the previous boot's log and later its diary | the log's step 1, the diary, this file |
-| Symbols | userland names user addresses; the kernel names only its own | `issues/kernel/the-kernel-still-parses-what-userland-writes.md` Move 3, `issues/build/debug-true-produces-no-debug-info.md` |
+- Every reader (`trace`, `inspect kernel.*`, `size`) is in every image, and
+  access is by rights alone.
+- The decoder, reducers and symbolizer are a Rust crate built and tested for
+  ToyOS and run inside it, so reading a record rests on no other machine.
+- *Told*: words go to the log, events to the diary, numbers about now to
+  counters, the Process object and `inspect`, and static facts to the ELF
+  files; no pillar keeps a store of its own.
+- *Told*: counters are read on demand. The roast's bound: the requester serves
+  its own CPU and parks on a Watch under a bound, and a CPU silent at the
+  bound reads as stale.
+- *Told*: one sampler per CPU, the hard-lockup detector's PMU NMI, at one
+  fixed rate held by a profile handle. The roast's: a Ring 3 sample raises a
+  self-IPI.
+- The kick leaves the timer's vector for one cross-CPU request vector, which
+  counter requests share.
 
-Shared foundations, which every pillar's track obeys:
+| Pillar | Its track |
+|---|---|
+| Log | `issues/kernel/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md`; the sinks half of `issues/design-debt/redesign-the-log-subsystem.md` |
+| Diary | `issues/diagnostics/nothing-in-the-machine-can-read-the-trace-ring.md` |
+| Counters, sizes | this file |
+| Profile | behind the diary's judgement; `issues/hardware/a-frozen-toyos-waits-for-a-hand-on-the-power-button.md` |
+| Accounting | `issues/kernel/nothing-charges-kernel-memory-to-a-process.md`, `issues/kernel/a-processs-memory-is-a-byte-total-that-reads-zero-under-contention.md`, `issues/diagnostics/blocked-time-is-invisible-while-the-park-lasts.md` |
+| Inspect | `issues/diagnostics/the-kernel-keeps-nothing-it-enumerates.md` |
+| Post-mortem | step 1 of `issues/kernel/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md` |
+| Symbols | `issues/kernel/the-kernel-still-parses-what-userland-writes.md` Move 3 |
 
-- **One clock.** Every stamp is the CPU's free-running counter (TSC,
-  `CNTVCT_EL0`); binary records carry raw ticks, text carries nanoseconds by
-  `toyos-abi/src/clock.rs`'s formula; a persisted region's header carries the
-  clock words.
-- **One identity.** pid and tid (`issues/diagnostics/a-record-cannot-name-thread-zero.md`);
-  the CPU is implied by the ring; a pid is never authority.
-- **One vocabulary per stream, in `toyos-abi`.** A persisted region carries the
-  vocabulary itself, not a digest of it. A program's events are keyed records
-  in its own log ring, their keys the program's own and opaque to a decoder
-  that does not know them.
-- **Two reader shapes.** A tap (log, diary): many readers, each its own
-  position; a read names one stream and a `u64` position, and the kernel clamps
-  it and computes loss saturating, never taking a count from the caller. A
-  queue (a program's ring read by `logkeeper`): one reader, and a full ring
-  refuses and counts.
-- **One right per kind of disclosure**, each right's doc listing what it
-  discloses: `log`, `trace` (every schedule, syscall numbers and durations,
-  input timing through interrupt drains, sampled addresses, and the revealing
-  counters), `counters`, roster, inventory, Process `READ`, and one connector
-  per server. `ps` stays on `SYS_SYSINFO`'s ambient header, and no toybox
-  applet gains a right before per-applet rows exist
-  (`issues/isolation/one-manifest-row-grants-every-applet-and-one-is-compared.md`).
-- **One decoder crate**, pure, `no_std` with `alloc`, forbidding unsafe: the
-  diary, persisted bytes and counter deltas, with its reducers checked on the
-  host against the scheduler simulator (`kernel/sim/src/latency.rs`). The log
-  stays with `toyos-logstream`; `ps` and `stats` link neither.
-- **One reset-surviving region**, which absorbs the black box under one
-  header: the writer's identity and kernel build-id, the clock words, the
-  vocabulary, a previous and a current half. The previous boot's bytes are
-  handed out raw and decoded in userland as untrusted input.
-- **One sampler per CPU**: the PMU-overflow NMI the hard-lockup detector arms.
-  The profile and the detector share one counter, at one fixed rate (997 Hz)
-  held by a profile handle and reverted when it closes. The NMI writes only
-  per-CPU words and a staging array its own CPU moves into the diary at its
-  next kernel exit; it never writes a ring and never dereferences a thread. A
-  Ring 3 sample raises a self-IPI so its user call chain is walked from the
-  sample's own stack. The boot deadline's seal names each CPU's last `rip`
-  from the Ring 0 timer frame.
-- **One cross-CPU request vector per architecture**, carrying kicks, counter
-  requests and the self-IPI; the timer's vector means expiry only. A
-  counter request is served by the requester on its own CPU, which then parks
-  on a Watch the last answer posts, under a bound; a CPU silent at the bound
-  is reported stale, never waited on without a bound and never a panic.
-- **Counters are monotonic counts and alloc/free pairs only.** A maximum is
-  an over-threshold diary record. A hardware counter is read only where a pure
-  function of the CPU's vendor, family and model says it exists, and every
-  counter it admits is read on each CPU at bring-up, so a wrong verdict ends
-  the boot rather than a user's read.
-- **"Now" stays "now".** `inspect` and counters answer now; the log and the
-  diary answer what happened. A list of processes or modules is a paged read,
-  and a module record is written at an executable file mapping.
+## What is to be built, in order (the orchestrator's)
 
-## What is to be built, in order
+Lane A, what `issues/kernel/toyos-beats-linuxs-latency-on-the-t14.md` needs:
+the diary's tid 0 and
+`issues/kernel/the-nmi-entry-can-hand-the-lockup-sample-cs-for-rflags-and-no-test-reds.md`;
+then the counters with their rights and the request vector, whose T14 exit is
+that in legacy mode the SMI count rises alike on every CPU; then interrupts on
+in syscalls; then the diary's three steps. Lane B, behind the diary's
+judgement: the profile and call chains. Lane C: RAPL, C-state residency and
+thermal counters, the log's steps, accounting, `inspect` and `size`.
 
-Lane A, what the latency work
-(`issues/kernel/toyos-beats-linuxs-latency-on-the-t14.md`) needs: the
-diary's tid 0 and the NMI `rflags` defect
-(`issues/kernel/the-nmi-entry-can-hand-the-lockup-sample-cs-for-rflags-and-no-test-reds.md`)
-ahead of the step that reads them; then the counters with their right, the
-request vector and the kick moved onto it, whose T14 exit is that in legacy
-mode the SMI count rises alike on every CPU, and through which ACPI stage 1
-reads its flatness; then interrupts on in syscalls; then the diary's three
-steps and their judgement. Lane B, behind the judgement: the profile, call
-chains, the remaining record kinds (waker-to-woken records before usbd). Lane
-C, beside them: the rest of the counters (RAPL, C-state residency, thermal),
-the log's steps, the accounting fixes, the `inspect` roots, and `size`.
-
-**Exit**: every pillar track above is closed, and at a ToyOS shell on the T14
+**Exit**: every pillar track above is closed; at a ToyOS shell on the T14
 `inspect kernel.*`, `trace` and `size` answer, each under the right its
-manifest row names.
+manifest row names; and a T14 row holds each counter ToyOS reads there
+against Linux's reading of it
+(`issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md`).
diff --git a/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md b/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md
index fde924bf123..68e258ba237 100644
--- a/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md
+++ b/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md
@@ -28,13 +28,13 @@ it, and `the_t14s_facts_are_linuxs_reading_of_it` holds `T14`'s `feat_ctl`
 to 0x3A's. **Mutation**: an added reading off by one bit reds the test that
 reads it. **Oracle**: that Linux.
 
-## The counters' oracle, read 2026-10-03
+## Linux's counter readings, read 2026-10-03
 
-The T14's hardware counters (`issues/diagnostics/toyos-explains-itself.md`)
-have no independent oracle but this Linux. Run as root under Ubuntu's
-`6.8.0-142-generic` from 16:22:37 UTC, one after the other; each output below
-is whole but for trailing blanks, and none was read by a test yet: the
-counters' host test reads them when it lands.
+The orchestrator takes this Linux as the one independent oracle for the T14's
+hardware counters (`issues/diagnostics/toyos-explains-itself.md`). Run as root
+under Ubuntu's `6.8.0-142-generic` from 16:22:37 UTC, one after the other;
+each output below is whole but for trailing blanks. No test reads them yet:
+the T14 row the umbrella track's exit names does.
 
 Idle, 60 s: `turbostat --quiet --interval 10 --num_iterations 6 --show
 Core,CPU,Avg_MHz,Busy%,Bzy_MHz,TSC_MHz,IRQ,SMI,CPU%c1,CPU%c6,CPU%c7,CoreTmp,PkgTmp,Pkg%pc2,Pkg%pc3,Pkg%pc6,Pkg%pc7,Pkg%pc8,Pkg%pc9,Pk%pc10,PkgWatt,CorWatt`.
diff --git a/issues/kernel/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md b/issues/kernel/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md
index cb75e547afd..12f7240c6dd 100644
--- a/issues/kernel/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md
+++ b/issues/kernel/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md
@@ -18,9 +18,9 @@ nor at a stop, which init sequences through `logd`'s flush. `logd` syncs on an
 alert or an interval, keeps every boot's first part, and holds each program
 to an allowance. Severity is an ordered ladder.
 
-The log is a pillar of `issues/diagnostics/toyos-explains-itself.md`,
-whose shared foundations its steps obey: step 1's ring is the reset-surviving
-region's, and step 2's keys are how a program writes an event.
+The log is a pillar of `issues/diagnostics/toyos-explains-itself.md`. The
+orchestrator's plan, not ruled: step 1's ring is the reset-surviving region's,
+and step 2's keys are how a program writes an event.
 
 What is left, in order:
 
diff --git a/issues/kernel/nothing-charges-kernel-memory-to-a-process.md b/issues/kernel/nothing-charges-kernel-memory-to-a-process.md
index fc04e7904ed..77b4d34a871 100644
--- a/issues/kernel/nothing-charges-kernel-memory-to-a-process.md
+++ b/issues/kernel/nothing-charges-kernel-memory-to-a-process.md
@@ -23,9 +23,7 @@ user-string copy has a ceiling. What survives is the *accounting*, which nothing
 has touched, plus one item: peak memory is written by two paths that overwrite
 each other.
 
-Accounting is a pillar of `issues/diagnostics/toyos-explains-itself.md`:
-a process's counts and the machine's per-category counters are two sums of
-the same charges.
+Accounting is a pillar of `issues/diagnostics/toyos-explains-itself.md`.
 
 Blocked on nothing. Two things worth knowing before it is restarted, because
 both cost a day to discover:
diff --git a/issues/kernel/spawn-thread-disagrees-about-a-reaped-parent.md b/issues/kernel/spawn-thread-disagrees-about-a-reaped-parent.md
index 1351d58dc5d..ca471c47c55 100644
--- a/issues/kernel/spawn-thread-disagrees-about-a-reaped-parent.md
+++ b/issues/kernel/spawn-thread-disagrees-about-a-reaped-parent.md
@@ -47,9 +47,11 @@ Found while extracting the lifecycle's decisions into what is now `kernel/pure/p
 (2026-08-24), which is what made the two spellings of one lookup visible: they
 are now one function asked twice, and the callers still disagree about its
 `NoSuchProcess` answer.
-`kernel::proclife::interleave::tests::a_thread_exit_that_outlived_its_entry_still_leaves`
-holds the schedule that reaches the state at `thread_exit`. **It reaches it by
-routing rather than by running**: the model's `retire` takes a thread off every
-CPU, so no schedule it can enumerate has a live thread arriving at a syscall
-body with its entry gone. That gap is what leaves this file's question open —
-the model cannot exhibit the state the kernel would have to survive.
+`toyos_proclife::interleave::tests::a_thread_exit_that_outlived_its_entry_still_leaves`
+held the schedule that reached the state at `thread_exit` until `fa1e3254d`
+deleted it with the reaper, and it reached it by routing rather than by
+running: the model's `retire` took a thread off every CPU, so no schedule it
+enumerated had a live thread arriving at a syscall body with its entry gone,
+the state the kernel would have to survive. Whether the model in
+`kernel/pure/proclife/interleave.rs` that replaced it reaches that state is
+unread.
diff --git a/issues/kernel/the-kernel-still-parses-what-userland-writes.md b/issues/kernel/the-kernel-still-parses-what-userland-writes.md
index b82b529e6f9..6a46f578b80 100644
--- a/issues/kernel/the-kernel-still-parses-what-userland-writes.md
+++ b/issues/kernel/the-kernel-still-parses-what-userland-writes.md
@@ -43,14 +43,26 @@ with what authority, is the open question.
 
 **Move 3 — the panic-time symbol resolver**, small and independent. Ruled
 (owner, 2026-10-03, "adopt", `issues/diagnostics/toyos-explains-itself.md`): the
-kernel names only itself, a killed program is reported as file and offset and
-userland names it, and the kernel keeps its own ELF reader. ELF parsing
-is already a pure crate that forbids unsafe and is tested against a crafted
-corpus, and the symbol machinery moved onto it in the 2026-08-15 consolidation —
-so what is left of this move is one decision: `rustc-demangle`'s standing. It is
-an unforked crates.io dependency, ~2k lines of third-party string parsing in
-Ring 0 on the panic path. Fork it into the estate like every other third-party
-source, or record the exemption deliberately.
+kernel names only itself; a killed program is reported as file and offset, and
+one userland naming service shares the kernel's lookup and demangling code.
+The kernel keeps its own ELF reader, `toyos-elf`: the orchestrator's reading
+of the owner's crate ruling of the same day, "if it makes sense we wrote our
+own elf parser or aml interpreter due to security or other important reasons
+we do it". ELF parsing is already a pure crate that forbids unsafe and is
+tested against a crafted corpus, and the symbol machinery moved onto it in the
+2026-08-15 consolidation. What is left: the kernel stops naming a program's
+addresses (`resolve_user_symbol` in `kernel/src/process.rs`); the per-spawn
+table `read_backtrace_table` builds in `kernel/src/loader/symbols.rs`, and the
+copy each task carries, are deleted; a userland service names a reported file
+and offset; and `rustc-demangle`'s standing is decided. It is an unforked
+crates.io dependency, ~2k lines of third-party string parsing in Ring 0 on the
+panic path: fork it into the estate like every other third-party source, or
+record the exemption deliberately. **Exit**: a guest test whose program dies
+of a fault reads the kernel's report as the program's file and the faulting
+offset, with no user symbol in it, and the userland service names the
+faulting function from that file and offset; no kernel source builds a backtrace
+table from a program's file; and `rustc-demangle` is forked or its exemption
+recorded.
 
 **Small trim to evaluate:** main-thread exit killing the process is kernel policy
 the review called unnecessary. A process could end when its last thread does, or
diff --git a/issues/kernel/toyos-beats-linuxs-latency-on-the-t14.md b/issues/kernel/toyos-beats-linuxs-latency-on-the-t14.md
index 4a52f599e9e..588cb2c64a1 100644
--- a/issues/kernel/toyos-beats-linuxs-latency-on-the-t14.md
+++ b/issues/kernel/toyos-beats-linuxs-latency-on-the-t14.md
@@ -34,9 +34,11 @@ It samples: a window under 1 ms is seen only when a tick falls in it.
 **Ruled** (owner, 2026-10-03): **"131 µs"**. ToyOS must beat Linux's worst
 delay on the other seven CPUs, 131 µs, not cpu4's one-off 2.9 ms event.
 
-**Exit**: each step's exit is met, in the file the step names, and on the T14
-the longest lateness of a 1 kHz timer's interrupt on each CPU reads under
-131 µs, and of the thread it wakes under Linux's longest on those seven CPUs. Nothing takes that reading of ToyOS today:
+**Exit**: each step's exit is met, in the file the step names, and on the T14,
+with every CPU spawning `/bin/true` as under Linux's 131 µs reading, the
+longest lateness of a 1 kHz timer's interrupt on each CPU reads under 131 µs,
+and of the thread it wakes under Linux's loaded longest on those seven CPUs,
+503 µs. Nothing takes that reading of ToyOS today:
 `latency_wake` reads one thread's p99 and `mask_windows` each CPU's longest
 masked windows. Two files owe it: step 2 of
 `issues/diagnostics/nothing-in-the-machine-can-read-the-trace-ring.md`, a
diff --git a/issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md b/issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md
index b16d52b5f89..76d32790e47 100644
--- a/issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md
+++ b/issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md
@@ -51,8 +51,11 @@ writes its own, and the battery comes first (his direction of `0ee814f5a`).
   T14's ACPI tables; the whole tables stay out of the tree, read only by a
   check run outside it.
 - **"full clean room write with the spec"**: the AML interpreter is written
-  from the ACPI specification. uACPI and ACPICA are run only as black-box
-  oracles, and whoever writes the interpreter never reads their source.
+  from the ACPI specification.
+
+The orchestrator's reading of the clean-room ruling, not his: uACPI and
+ACPICA are run only as black-box oracles, and whoever writes the interpreter
+never reads their source.
 
 **Stage 1: ACPI mode, its SCI served in userland.** The switch to ACPI mode,
 and a userland server that claims the SCI, handles the power button, a
@@ -62,3 +65,5 @@ flat on every CPU over the interval the firmware issue's exit defines, and a
 press of the power button stops the machine cleanly, through ToyOS's own
 power-off path (`SYS_SHUTDOWN`), and the boot's log records the press and that
 stop, and each EC query number once with its count: a T14 row reads them there.
+A second T14 row kills the server and reads `SCI_EN` clear in `PM1_CNT`
+afterwards, the kernel having written `ACPI_DISABLE` to `SMI_CMD`.

From 566d07196406ca1484136f3d7f4f4149e994f337 Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Sun, 4 Oct 2026 02:43:28 +0200
Subject: [PATCH 3/4] Answer review round 2: the exits read the counters'
 rights and the general counters

- toyos-explains-itself: the roast was adopted by the orchestrator, not the
  owner; the exit refuses a counter read to a program without the counters
  right, and the power and per-device interrupt counters to one without
  `trace`, so the track cannot close past "Only with permission"; the self-IPI
  leaves the *told* bullet; the three design bullets (readers in every image,
  the decoder crate, the four places) are cut.
- ACPI stage 1's exit reads MSR_SMI_COUNT through the general counters, not a
  check of its own, so "General counters" is read by an exit.
- The latency exit's load names a program that exits at once, not a
  `/bin/true` ToyOS does not have.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WcU2Dsw6mDYtwYfzVHPzM8
---
 issues/diagnostics/toyos-explains-itself.md   | 23 ++++++++-----------
 .../toyos-beats-linuxs-latency-on-the-t14.md  |  4 ++--
 ...ine-in-acpi-mode-and-interprets-its-aml.md |  6 ++---
 3 files changed, 14 insertions(+), 19 deletions(-)

diff --git a/issues/diagnostics/toyos-explains-itself.md b/issues/diagnostics/toyos-explains-itself.md
index 7db62c15d38..fe72cae3f42 100644
--- a/issues/diagnostics/toyos-explains-itself.md
+++ b/issues/diagnostics/toyos-explains-itself.md
@@ -40,23 +40,16 @@ counters and sizes pillars, which no other track does.
 
 ## Decided by the orchestrator, not ruled (2026-10-03)
 
-From the orchestrator's strategy and the roast of it that he adopted. A line
-marked *told* was told to the owner with his veto open; the rest were not put
-to him.
+From the orchestrator's strategy and the roast of it that the orchestrator
+adopted. A line marked *told* was told to the owner with his veto open; the
+rest were not put to him.
 
-- Every reader (`trace`, `inspect kernel.*`, `size`) is in every image, and
-  access is by rights alone.
-- The decoder, reducers and symbolizer are a Rust crate built and tested for
-  ToyOS and run inside it, so reading a record rests on no other machine.
-- *Told*: words go to the log, events to the diary, numbers about now to
-  counters, the Process object and `inspect`, and static facts to the ELF
-  files; no pillar keeps a store of its own.
 - *Told*: counters are read on demand. The roast's bound: the requester serves
   its own CPU and parks on a Watch under a bound, and a CPU silent at the
   bound reads as stale.
 - *Told*: one sampler per CPU, the hard-lockup detector's PMU NMI, at one
-  fixed rate held by a profile handle. The roast's: a Ring 3 sample raises a
-  self-IPI.
+  fixed rate held by a profile handle.
+- The roast's: a Ring 3 sample raises a self-IPI.
 - The kick leaves the timer's vector for one cross-CPU request vector, which
   counter requests share.
 
@@ -84,6 +77,8 @@ thermal counters, the log's steps, accounting, `inspect` and `size`.
 
 **Exit**: every pillar track above is closed; at a ToyOS shell on the T14
 `inspect kernel.*`, `trace` and `size` answer, each under the right its
-manifest row names; and a T14 row holds each counter ToyOS reads there
-against Linux's reading of it
+manifest row names; a program without the counters right is refused a
+counter read, and one that holds it but not `trace` is refused the power and
+per-device interrupt counters; and a T14 row holds each counter ToyOS reads
+there against Linux's reading of it
 (`issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md`).
diff --git a/issues/kernel/toyos-beats-linuxs-latency-on-the-t14.md b/issues/kernel/toyos-beats-linuxs-latency-on-the-t14.md
index 588cb2c64a1..09b21cc81db 100644
--- a/issues/kernel/toyos-beats-linuxs-latency-on-the-t14.md
+++ b/issues/kernel/toyos-beats-linuxs-latency-on-the-t14.md
@@ -35,8 +35,8 @@ It samples: a window under 1 ms is seen only when a tick falls in it.
 delay on the other seven CPUs, 131 µs, not cpu4's one-off 2.9 ms event.
 
 **Exit**: each step's exit is met, in the file the step names, and on the T14,
-with every CPU spawning `/bin/true` as under Linux's 131 µs reading, the
-longest lateness of a 1 kHz timer's interrupt on each CPU reads under 131 µs,
+with every CPU spawning a program that exits at once, as under Linux's
+131 µs reading, the longest lateness of a 1 kHz timer's interrupt on each CPU reads under 131 µs,
 and of the thread it wakes under Linux's loaded longest on those seven CPUs,
 503 µs. Nothing takes that reading of ToyOS today:
 `latency_wake` reads one thread's p99 and `mask_windows` each CPU's longest
diff --git a/issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md b/issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md
index 76d32790e47..0bd119348e7 100644
--- a/issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md
+++ b/issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md
@@ -60,9 +60,9 @@ never reads their source.
 **Stage 1: ACPI mode, its SCI served in userland.** The switch to ACPI mode,
 and a userland server that claims the SCI, handles the power button, a
 fixed event that needs no AML, and takes the EC's events. **Exit**: on the
-T14, `MSR_SMI_COUNT` stays
-flat on every CPU over the interval the firmware issue's exit defines, and a
-press of the power button stops the machine cleanly, through ToyOS's own
+T14, `MSR_SMI_COUNT`, read through the general counters and not by a check of
+its own, stays flat on every CPU over the interval the firmware issue's exit
+defines, and a press of the power button stops the machine cleanly, through ToyOS's own
 power-off path (`SYS_SHUTDOWN`), and the boot's log records the press and that
 stop, and each EC query number once with its count: a T14 row reads them there.
 A second T14 row kills the server and reads `SCI_EN` clear in `PM1_CNT`

From accd59656c41cffeabb79d820d672401753a19e8 Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Sun, 4 Oct 2026 02:52:58 +0200
Subject: [PATCH 4/4] Answer review round 3: cut the untold self-IPI line from
 the explains-itself track

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WcU2Dsw6mDYtwYfzVHPzM8
---
 issues/diagnostics/toyos-explains-itself.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/issues/diagnostics/toyos-explains-itself.md b/issues/diagnostics/toyos-explains-itself.md
index fe72cae3f42..a1f9badb6f1 100644
--- a/issues/diagnostics/toyos-explains-itself.md
+++ b/issues/diagnostics/toyos-explains-itself.md
@@ -49,7 +49,6 @@ rest were not put to him.
   bound reads as stale.
 - *Told*: one sampler per CPU, the hard-lockup detector's PMU NMI, at one
   fixed rate held by a profile handle.
-- The roast's: a Ring 3 sample raises a self-IPI.
 - The kick leaves the timer's vector for one cross-CPU request vector, which
   counter requests share.