std's ToyOS backend lives in sdk/std, and the fork names it by #[path]

[Japabu]

What changed

The 21 files that implement std on ToyOS leave the rust fork for sdk/std/, laid out as std lays them out (os/, sys/, sys/pal/, sys/net/). Fork commit cc9c8b1be68 (on the fork's main, appended to 7fa3f566c28) removes them and gives each of the 14 arms that selects one a #[path] naming the file here; the rust gitlink moves to it. The owner ruled the move and the mechanism ("MOVE IT", by #[path]).

Why: of the 25 times main moved the fork pin (git log --first-parent origin/main -- rust, each compared with git -C rust diff --name-only <old pin> <new pin>), 13 changed nothing but these files and 4 more these and one shared std file. Such a change is now one commit in one repository.

	files	lines
fork, cc9c8b1be68	35	+14 −4,155
this tree, sdk/std	21	+4,155
this tree, src/ production	3	+10 −6 (one list entry in sysroot.rs, one in sourcegate.rs, three doc comments)
this tree, src/ tests	2	+3 −3
src/CLAUDE.md	1	+1 −1
issues/	40	+145 −78 (3 filed, 2 renamed, the rest citations repointed and the track's tree)

git diff --shortstat origin/main...HEAD: 66 files, +4,315 −89.

Decisions

• Where. sdk/std/. issues/the-tree-says-who-uses-each-thing.md, rule step 3: what something outside this repository uses goes to sdk/, and the rule already names std as that user ("what std links"). Step 3 is asked before step 4, and step 4's answer, inside its one user, is the fork. sdk/ did not exist; this is its first entry, at its final place, because a later move would break every fork commit pinned before it. The track's tree and its list of differences record it.
• A move, and nothing else. No backend code changes. The two #[path]s the files hold themselves (os/unix/ffi/os_str.rs, sys/pal/unsupported/common.rs) now point back into the fork.
• The build system: one list entry. sdk/std joins SYSROOT_SOURCES. That list is read by sysroot::witness, which is in the sysroot key a dev host builds under, in the key of the sysroot layer CI's toolchain job restores and saves (release::layers), and is the record an installed toolchain is matched to its checkout by (release::lay_out, toolchain::check_installed_toolchain). A backend edit moves the sysroot key alone; the fork's library/ no longer moves with it, so the freestanding libraries (the kernel's and the loader's) stay.
• The dep-info gate is not extended. assert_std_built_from decides that std's toyos-abi and toyos sources are this worktree's, which says the fork checkout that built it is this worktree's own. The backend is named relative to the same fork checkout, so the same answer covers it. STD_SOURCES' comment and its test's fixture say so.
• sourcegate's GUEST_CODE names sdk/std. The first --ci host was red on every_host_scratch_is_the_guard: temp_dir() in sdk/std/sys/pal/os.rs is std's own definition, in code compiled for the guest.
• The tracker. The citations of the moved files in 35 issue files are repointed, and the sentences that placed them in the fork corrected. Two slugs the move refuted are renamed (two-std-maps-…, stds-toyos-files-carry-lines-rustfmt-would-rewrap; neither was cited anywhere). Three issues are filed for what the move leaves:
  • issues/std-names-its-toyos-backend-by-a-path-out-of-the-fork.md: the 14 lines are not upstream-mergeable as written, tree and fork each know the other's layout, and a panic in the backend prints its file through the arm (library/std/src/sys/time/../../../../../../sdk/std/sys/time.rs, read out of the built libstd; relative, so no checkout path enters the bytes).
  • issues/stds-toyos-backend-keeps-assembly-outside-an-architecture-module.md: sys/pal/mod.rs and sys/pal/tls.rs hold naked functions under target_arch, which reviewer.md's "Fit" keeps in an architecture's module. Restructuring them here would have made the move uncheckable as a move.
  • issues/nothing-refuses-a-std-that-read-a-worktree-file-its-key-does-not-name.md: the stale arm below, as a class.
• src/CLAUDE.md's std type-check recipe gains the sdk symlink it now needs. Run once with it: std compiled from the recipe's tree (the probe program then failed to link, which the recipe does not ask for).

High-risk: the checks

Build system and toolchain. All at head 3831f291b, on an M4 Pro with 14 cores, shared with other agents' builds; each arm's log opens with uptime.

Negative control, three arms in one script, each a checked patch, built with cargo run -- --build-only --arch aarch64, run as cargo test --test toyos-build -- virt_readonly_copyout, restored, tree clean after. M2 makes std's start_rust exit with code + 1; M-key takes sdk/std off SYSROOT_SOURCES. Both patches are in the comment below.

arm	sysroot key	freestanding key	std built	build	guest test
green: the tree	62be33c18be17168	5681eaf54286442e	(already there)	exit 0, 2.17 s	exit 0
red: M2	b60346da611e8cea	5681eaf54286442e	yes	exit 0, 142.92 s	exit 1, test_rs_abuse_readonly_copyout exit=1
stale base: M-key	46c572c6e5176094	5681eaf54286442e	yes	exit 0, 143.08 s	exit 0
stale: M-key + M2	46c572c6e5176094	5681eaf54286442e	no	exit 0, 1.94 s	exit 0, on the std built before M2

The fourth row is the scout's silent stale std: the tree says every program exits one higher and the guest test passes.

The key's own test. sysroot::tests::a_comment_is_the_same_sysroot_and_a_signature_is_another now edits sdk/std and asserts the sysroot key moves and the freestanding key does not. Under M-key: exit 101, sdk/std kept the old sysroot. This is a host test; the key is a function of files, so no guest is needed for it.

CI's layers, by the function CI runs. GITHUB_OUTPUT=<file> cargo run -- --ci toolchain in each arm, exit 0: llvm, compiler and freestanding keys identical in all arms (b84b400f23c42d55, c58d859550c29f65, 5681eaf54286442e), sysroot as in the table. These are this host's keys, not a runner's; what carries over is which layers move.

Independent oracles.

• Differential against the fork: each of the 21 files, diffed against git show 7fa3f566c28:<its old path>. 19 identical; os/ffi.rs and sys/pal/mod.rs differ in the one #[path] line each.
• Differential of the product: every defined symbol of libstd-*.rlib (GNU nm --defined-only -S) in main's sysroot 9c33148e3d5ab541 against the moved one's, with crate disambiguators, legacy hashes and anonymous-label numbers normalised: same names, types and sizes, 1,758 symbols for x86_64-unknown-toyos and 1,723 for aarch64-unknown-toyos, diff exit 0 for both.
• The built library names all its backend files under sdk/std (strings in libstd), and the sysroot's SOURCES records 21 sdk/std witness lines.

Gates, at 3831f291b

command	exit
cargo run -- --ci host	0 (Host: 75 step(s), all green)
cargo run -- --build-only	0
cargo run -- --build-only --arch aarch64	0
cargo test	0 (28 passed, 28 total, 30 guests; 4 x86-64 screen tests, 3 machine tests, 21 AArch64 virt_* boots)

AArch64 boots: the virt_* tests boot the AArch64 image and run programs built on the moved std to exit 0 (virt_user_mode, virt_smp, virt_readonly_copyout among them).

The first build of the move (measured on the branch before its rebase onto #743 and #744): --build-only exit 0 in 467 s, building the freestanding libraries and the sysroot once, since the fork's library/ changed; --arch aarch64 exit 0 in 79 s.

How long an edit takes to rebuild

cargo run -- --build-only, x86-64 image, same session, load average 25 to 36:

edit	what is rebuilt	wall
none	nothing	6.1 s
one line in sdk/std/sys/time.rs	sysroot (62be33c1… to d8831cdf…), then userland	201.5 s
one line in the fork's library/std/src/sys/time/mod.rs, as a backend edit was before	freestanding libraries, sysroot, then kernel, loader and userland	314.2 s

A change under the fork's compiler/ builds a compiler first; that was not run here. The research report cites 12:58 to 22:05 for the compiler alone on this machine (#597's and #629's bodies).

Not measured, and unsure

• CI did not run: ci.yml skips a draft. Read from the code and from the keys above, the first run builds the freestanding and sysroot layers and restores llvm and compiler; after landing, a backend edit moves the sysroot layer alone. git submodule update --init --depth 1 rust needs the fork commit reachable, and it is on the fork's main.
• The hosted rustc was not built. Only the primary checkout builds it, in its own rust/ under the global lock (issues/a-worktree-cannot-build-a-hosted-rustc-of-its-own.md); src/build.rs refuses hosted-rustc = true; and the primary holds none today. By reading: its std is compiled in place from <primary>/rust/library, so the arms resolve to <primary>/sdk/std, which the primary has once it is at a main with this change. Nothing keys the hosted rustc on std's sources, before or after.
• std's own tests are metal rows, and ran green on the T14 at 3831f291b (Round 2 below). wall_clock_now, std_fs and the rest run on the T14's shared boots, not in cargo test. The metal profile was staged without touching the machine: cargo test --test toyos-build -- --metal --metal-readback <dir>, exit 2, 28 images.
• The fork's main already carries cc9c8b1be68, as the fork's rules ask. A branch that edits the backend in the fork meets a modify/delete conflict when it takes this one; its edit moves to sdk/std.
• sdk/std has no formatter and no lint of its own; issues/stds-toyos-files-carry-lines-rustfmt-would-rewrap.md now names the files there.

Round 2: head d4452b4df

3831f291b, a merge of origin/main (257ebea2a: #740, #741, #713), and one commit answering review round 1. That commit touches issues/, src/CLAUDE.md and tests/metal alone (14 files, +74 −19): the hosted rustc's std is filed as issues/nothing-keys-the-hosted-rustc-on-stds-sources.md with the exit the review gave; the std type-check recipe says which fork files it reads through the sdk link; ten issue files stop placing the backend in the fork beside a path already repointed; the three boot.testcases-bounds rows the metal run asked for are recorded; and issues/the-t14s-record-keeps-three-rows-of-a-boot-nothing-stages.md is filed. The fork pin is unchanged, cc9c8b1be68.

Gates at d4452b4df, one script from a clean tree, each log opening with the head and status lines 0:

command	exit
cargo run -- --build-only	0
cargo run -- --build-only --arch aarch64	0
cargo run -- --ci host	0, Host: 76 step(s), all green
cargo test	0, 30 passed, 30 total

The metal profile ran at 3831f291b, before the merge, on the T14: cargo test --test toyos-build -- --metal from the clean worktree, EXIT=0, [metal] 294 passed, 0 failed, 28 boot(s); each row that is std's only test ended exit=0 (std_alloc, std_fs, std_fs_write, std_io, std_mmap, std_process, std_sync, std_threading, std_tls, std_tls_cranelift, std_tls_dlopen, std_tls_multi_crate, std_unwind, std_unwind_so, wall_clock_now). It was not re-run at d4452b4df: the merge brings main's kernel and servers under the same moved std, and the guest suite above is the run of that combination.

Still not measured: the hosted rustc (the new issue), and CI on a runner, which runs when this is marked ready.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

[Japabu]

Mutation and timing patches behind the body's tables, each applied with git apply --check then git apply, and reversed with git apply -R in the same script.

M-key-no-backend-entry (this tree)

--- a/src/sysroot.rs
+++ b/src/sysroot.rs
@@ -63,10 +63,9 @@
 /// The per-worktree sources that end up inside a sysroot: std links `toyos-abi`
 /// and `toyos` and compiles its ToyOS backend from `sdk/std`, and
 /// `libtoyos_c.a` is `userland/libc` with `toyos-elf` and `toyos-osrelease`.
-pub const SYSROOT_SOURCES: [&str; 7] = [
+pub const SYSROOT_SOURCES: [&str; 6] = [
     "toyos-abi/src",
     "toyos/src",
-    "sdk/std",
     "toyos-elf/src",
     "toyos-osrelease/src",
     "userland/libc/src",

M2-every-program-exits-one-more (this tree)

--- a/sdk/std/sys/pal/mod.rs
+++ b/sdk/std/sys/pal/mod.rs
@@ -98,7 +98,7 @@
 
     let code = unsafe { main(argc as i32, argv) };
     crate::sys::stdio::finish();
-    toyos_abi::syscall::exit(code)
+    toyos_abi::syscall::exit(code + 1)
 }
 
 pub fn abort_internal() -> ! {

M1-clock-a-day-ahead (this tree)

--- a/sdk/std/sys/time.rs
+++ b/sdk/std/sys/time.rs
@@ -37,7 +37,7 @@
     pub fn now() -> SystemTime {
         let secs = toyos_abi::syscall::clock_epoch()
             .expect("SYS_CLOCK_EPOCH: this machine will not say what time it is");
-        SystemTime(Duration::from_secs(secs))
+        SystemTime(Duration::from_secs(secs + 86_400))
     }
 
     pub fn sub_time(&self, other: &SystemTime) -> Result<Duration, Duration> {

F1-fork-library-edit (in rust/, the fork-side timing arm)

--- a/library/std/src/sys/time/mod.rs
+++ b/library/std/src/sys/time/mod.rs
@@ -1,3 +1,5 @@
+const _FORK_SIDE_EDIT: u8 = 1;
+
 cfg_select! {
     target_os = "hermit" => {
         mod hermit;

M-key under cargo test --lib -- a_comment_is_the_same_sysroot: exit 101. M2: virt_readonly_copyout exit 1. M-key + M2: exit 0 on a stale std. M1 and F1 were timed with cargo run -- --build-only (201.5 s, 314.2 s), both exit 0.

[Japabu]

Review of 3831f291b against origin/main ff57dc704, round 1. Fork half: cc9c8b1be68 on ToyOSOrg/rust main (git ls-remote origin main answers it; parent 7fa3f566c28).

Net lines, git diff --shortstat origin/main...3831f291b: 66 files, +4,315 −89. Production under src/: +10 −6. Tests under src/: +3 −3. sdk/std: +4,155, against the fork's −4,155 +14, so the two repositories together grow by 14 lines of #[path]. issues/: +145 −78. src/CLAUDE.md: +1 −1. The growth is accepted as the ruling's.

BLOCKER

None.

NOTE

• issues/ — the hosted rustc's std is unmeasured and no file records it — the ruling named the hosted rustc, the body lists it under "not measured", and src/toolchain.rs's hosted_rustc_owed reads a stamp and a file and no std source, so a backend edit leaves a built one standing while collect_hosted_rustc ships its lib/*.so beside this build's rlibs. File it (kind: tooling), with the body's sentence "nothing keys the hosted rustc on std's sources" as the weakness and this as the exit: on the primary at a main that carries this change, a build whose config asks for the hosted rustc exits 0, and the libstd-*.so under rust/build/x86_64-unknown-toyos/stage2/lib carries sdk/std/sys/ paths and no sys/pal/toyos.
• src/CLAUDE.md:18 — with sdk a symlink, the two #[path]s that lead back (sdk/std/os/ffi.rs:5, sdk/std/sys/pal/mod.rs:6) are resolved by the filesystem through the link's target, so they read the worktree's real rust/library and not the recipe's copy — by reading; logs/10-typecheck-recipe.log ran where the worktree's rust/ was populated. The recipe needs the worktree's fork checkout made, and an edit to the copy's os_str.rs or common.rs is not what is checked. Say so in the same sentence or copy sdk beside a copy named rust.
• Prose, issues/: the body says the sentences that placed the backend in the fork are corrected; these still place it there beside a repointed path: a-provided-name-cannot-reach-an-undeclared-child.md:23, a-served-file-panics-when-asked-its-raw-fd.md:9,16, create-new-on-a-kernel-path-is-not-exclusive.md:10, every-flush-of-a-served-file-syncs-its-whole-volume.md:9, os-toyos-io-traits-keep-a-posix-name.md:10, std-maps-a-device-error-to-other-not-uncategorized.md:7, std-reads-a-query-modules-byte-count-as-a-module-count.md:9, std-stat-conflates-io-with-notfound.md:17 ("cannot be made from a linked worktree"), toyos-runs-on-arm64.md:85.
• Prose, body: "of the 20 times main moved the fork pin" names no command; git log --first-parent origin/main -- rust prints 26 commits.

Judged, no finding

• The move is a move. Each of the 21 files at 3831f291b compared with git -C rust show 7fa3f566c28:<old path>: 19 identical, os/ffi.rs and sys/pal/mod.rs differ in their one #[path] line. git -C rust grep at cc9c8b1be68 finds no ToyOS file left under library/std/src and 14 arms, each climbing the right number of levels for its depth. logs/11-nm-*.norm2.diff are empty for both userland triples, 1,758 and 1,723 symbols, against main's sysroot 9c33148e3d5ab541 built on the same host.
• The negative control. logs/08-control-driver.log opens with head 3831f291b, status lines 0, and closes restored and clean. Red arm: key 62be33c1… to b60346da…, freestanding key unmoved, a std built, virt_readonly_copyout exit 1. Stale arm: with sdk/std off SYSROOT_SOURCES, M2 leaves the key at 46c572c6…, the build ends in 1.94 s and the guest test exits 0 on the older std. It reverts exactly the one production line the claim rests on, which is the whole build-system change, and it shows cargo's own fingerprint saw the edit as well as the key. logs/06-mutation-key-unit.log: exit 101, sdk/std kept the old sysroot. --ci toolchain in each arm: llvm, compiler and freestanding keys equal, sysroot as the table says. Accepted.
• The dep-info gate left alone. assert_std_built_from decides by toyos-abi's resolved path; the backend is reached from the same fork checkout, and fork_checkout and rust_dir put that checkout at <root>/rust as a real directory for every owner, so cargo's lexical path and rustc's filesystem path agree. The class beyond that is issues/nothing-refuses-a-std-that-read-a-worktree-file-its-key-does-not-name.md, whose exit a test can fail. assert_std_reads_no_worktree still holds the loader's std to reading none of sdk/std, and the builds at this head are green under it.
• The hosted rustc, on reading. Enough to land, with the measurement in the first NOTE owed after it. build_hosted_rustc runs bootstrap in the primary's rust/, which compiles library/std in place; fork_checkout moves that rust/ to the commit the primary's own index pins, so the gitlink and sdk/std arrive together; the compiler's key reads compiler, src/tools, src/stage0 and Cargo.lock and nothing of library/, so the staleness is what it was before the move. No tracked config sets hosted-rustc = true, build::shipped refuses one, and the primary holds no hosted stage2 today. The same std, by the same bootstrap, at the same depth, is what the sysroot build at this head measured. The measurement cannot be taken before landing without the branch's tree in the primary.
• Placement. Rule step 3 of issues/the-tree-says-who-uses-each-thing.md fits: the fork's library/std, another repository, reads these bytes by name, and the step is asked before step 4. The track's new line gives the leaving to the owner and the placement to the rule, no broader than the ruling. sdk/std holds no manifest, so src/hostws.rs and the workspace lists have nothing to account for.
• "A fork". The 14 lines are not upstream-mergeable, which that section forbids. Not raised as a BLOCKER: the brief gives the #[path] mechanism as the owner's, and issues/std-names-its-toyos-backend-by-a-path-out-of-the-fork.md records it with an exit a grep reads. The commit is appended to the fork's one branch, touches cross-platform files only inside the existing ToyOS arm, and its gitlink bump is in this pull request.
• Assembly outside an architecture's module (sdk/std/sys/pal/mod.rs:45-62, sys/pal/tls.rs:38-56): recorded in issues/stds-toyos-backend-keeps-assembly-outside-an-architecture-module.md with a readable exit. Restructuring in this diff would have cost the byte comparison above. Accepted as recorded.
• Beyond the brief. The 33 repointed citations and the two renames are what root CLAUDE.md and issues/README.md ("Slugs") require of a change that moves a cited path; git grep at this head finds neither old slug and no pal/toyos, os/toyos or /toyos.rs citation outside a test fixture and unrelated crates. The src/CLAUDE.md edit updates a step the change itself breaks, which is the one edit an unbriefed agent may make there. The three filed issues are each open, typed within the README's table, and carry an exit something can read. sourcegate's GUEST_CODE entry classifies guest code as guest code.
• Gates at this head, each log opening with head 3831f291b…, status lines 0: --ci host exit 0, 75 steps; --build-only exit 0 for both architectures; cargo test exit 0, 28 of 28.

Owed before this lands, by whoever marks it ready

• CI. All three checks read skipping on the draft. A run at this head shows toolchain green having built the freestanding and sysroot layers on a Linux runner, which is the first compile of the 14 arms off this host; host green; and guest / suite green under KVM on the installed toolchain, which is the first time check_installed_toolchain meets a witness with sdk/std lines.
• The metal profile. The run at this head shows its own exit 0, built from a clean tree at 3831f291b; every row green that main's last whole run has green and none absent; and, on the shared boots, each row that is std's only test ending exit 0: std_alloc, std_fs, std_fs_write, std_io, std_mmap, std_process, std_sync, std_threading, std_tls, std_tls_cranelift, std_tls_dlopen, std_tls_multi_crate, std_unwind, std_unwind_so, wall_clock_now. A row red there that main has green is a BLOCKER on this head and reopens this review.

LAND AFTER NAMED CHANGES

[Japabu]

The whole metal profile at 3831f291b, run by the orchestrator from the clean worktree at that head (cargo test --test toyos-build -- --metal, which builds, flashes, boots, reads back and judges every boot): EXIT=0, [metal] 294 passed, 0 failed, 28 boot(s), 2529 s. The tree was clean after it.

Each row that is std's only test ended exit=0 on the shared boots, read from their ===TEST_END … exit=0=== records: std_alloc, std_fs, std_fs_write, std_io, std_mmap, std_process, std_sync, std_threading, std_tls, std_tls_cranelift, std_tls_dlopen, std_tls_multi_crate, std_unwind, std_unwind_so, wall_clock_now.

The judging asked to record three rows for the testcases-bounds boot in tests/metal; that diff is kept as a patch and the worktree restored.