UserSafe is proved by the compiler: user_safe! declares a struct, its impl and its no-padding assertion, and usersafe::bytes is the one view of its bytes

[Japabu]

Closes issues/usersafe-layouts-are-checked-by-hand.md. Head 196ec3b67, merged with origin/main e16cb0841 (#745). Logs are under orch/usersafe-r2/ in the job scratchpad, one directory per head they were measured at.

What changed, per decision

UserSafe is implemented only by toyos_abi::user_safe!, which declares the struct, its impl and its assertion together. The trait lives in toyos-abi/src/usersafe.rs, beside the structs. The macro emits the struct under #[repr(C)] (named fields) or #[repr(transparent)] (one unnamed field), then const _: () = ::core::assert!(size_of::<S>() == 0 + field::<F1>() + ...) where field<T: UserSafe>() is size_of::<T>(), then the unsafe impl.

• A padding byte anywhere makes the size exceed the sum: E0080, "a byte of S belongs to no field".
• A field whose type is not valid for every bit pattern has no impl: E0277 on the field::<T> bound.
• The base cases are written by hand once, in that file: u8 i8 u16 i16 u32 i32 u64 i64, and [T; N] for T: UserSafe. "No impl is written by hand" holds for structs only.

One byte view, and one unsafe block behind it (review round 1's BLOCKER). toyos_abi::usersafe::bytes<T: UserSafe>(&T) -> &[u8] is the only way a UserSafe value becomes bytes. The eight structs that still asserted "no padding" with a sum written by hand (AcpiInfo, HdaInfo, PartitionInfo, PciFunctionInfo, LogRecord, ModuleInfo, TraceRecord, VirtioSoundInfo) are declared through user_safe!, and so is acpi::Block, which AcpiInfo holds. Deleted: the eleven as_bytes methods with their unsafe blocks, the eight hand sums, and their doc comments. LogRecord passes #[repr(align(64))] as a caller attribute and keeps its RECORD_BYTES, align_of and offset_of assertions; TraceRecord keeps RECORD_BYTES. Those are other claims.

• kernel/src/log/user.rs: read_rings loses its bytes: fn(&Record) -> &[u8] parameter, which had one value per record type; the record is bound UserSafe and the sink calls usersafe::bytes.
• The two tests that decode a record's bytes field by field (log.rs, syscall.rs) stay, calling usersafe::bytes: they hold field order, which the macro does not.
• toyos/src/device.rs: the SAFETY comment on device_info! cited the deleted assertions and as_bytes; it now cites the macro.

The macro names ::core::assert! and ::core::concat! (NOTE), so a macro_rules! assert in scope at an expansion site cannot replace the check.

Why not a published crate, and why not a derive. Every struct but the kernel's Stat is declared in toyos-abi, and a foreign trait can only be implemented there. toyos-abi is in std's dependency graph, so zerocopy or bytemuck would have to build as a dependency of std, which neither does unforked, and a derive brings syn, quote and proc-macro2 under the kernel and std. macro_rules reaches both refusals with no dependency.

Lines (git diff --shortstat origin/main...196ec3b67): 630 insertions, 749 deletions, 24 files; with whitespace ignored, 270 and 389, the rest being wrapped structs re-indented. kernel/, toyos-abi/, toyos/: +544 −661, and +184 −301 with whitespace ignored. toyos-abi/src/usersafe.rs is 108 lines.

No layout changed, and no struct had padding. Every struct built under the macro as it stood.

toyos-userbound/src/span.rs's table of thirteen hand-written sizes is deleted; the tests walk every multiple of each alignment 1, 2, 4, 8 up to 256 bytes.

Filed on the way:

• issues/fstats-answer-is-declared-twice.md.
• issues/three-kernel-byte-views-still-rest-on-a-hand-layout-claim.md: DmaGrant, DmaMapping and DeviceIrqRecord reach user memory through from_raw_parts blocks of the kernel's own (kernel/src/syscall/device.rs, kernel/src/object/ops.rs), each resting on an assertion that compares the struct's size with a number written by hand (two sums and, for DeviceIrqRecord, the total 4). They are the same shape as the eight and were not in the review's count or this round's brief, so they are recorded and not fixed.

The merge with #745

origin/main e16cb0841 is merged at cc1a2c311; no file is touched by both sides.

1. at-cc1a2c311/build-x86_64.log:10 is Building sysroot 8bdf2ee4c8ec9cd6, for both targets in the one run: Compiling std at lines 23 and 79, Compiling toyos-abi under it at 28 and 83, and std's warnings at 46-60 and 102-116 name sdk/std/sys/pal/os.rs and sdk/std/sys/pal/mod.rs, so the backend is read from sdk/std.
2. The merged key lists still name the directory: src/sysroot.rs:67 "toyos-abi/src", src/toolchain.rs:78 STD_SOURCES = ["toyos-abi/src", "toyos/src"]. usersafe.rs is inside it.
3. std's uses of the wrapped structs built in that sysroot: sdk/std/sys/process.rs:392 (SpawnArgs literal), sdk/std/sys/fs.rs:190 (toyos::fs::Stat), sdk/std/sys/pal/mod.rs:212-237 (ModuleInfo, read through a pointer cast, no as_bytes). No file under sdk/std called any deleted as_bytes.

Gates

The head, 196ec3b67, differs from cc1a2c311 by one file, the second filed issue (git diff --stat cc1a2c311 196ec3b67: 41 insertions in issues/three-kernel-byte-views-still-rest-on-a-hand-layout-claim.md), so the source every local gate below compiled is the head's. Every local measurement was taken at the head its row names, none at 196ec3b67.

command	measured at	exit	log
cargo run -- --ci host	cc1a2c311	EXIT=0	at-cc1a2c311/ci-host.log, ends [ci] Host: 77 step(s), all green (line 7826)
cargo run -- --build-only --arch x86_64	cc1a2c311	EXIT=0	at-cc1a2c311/build-x86_64.log:560 Build finished.
cargo run -- --build-only --arch x86_64	3861d296b	EXIT=0	at-3861d296b/build-x86_64.log:502 Build finished.
cargo run -- --build-only --arch aarch64	cc1a2c311	EXIT=0	at-cc1a2c311/build-aarch64.log:394 Build finished.
cargo test (the guest suite, whole)	cc1a2c311	EXIT=0	at-cc1a2c311/guest-suite.log:855, 30 passed, 30 total

Nothing was run locally at 196ec3b67, and why. The re-run at 3861d296b was stopped after its x86_64 build: the owner reserved this machine's compute for another task while it ran, and 196ec3b67, which corrects the filed issue's text (review round 2's NOTE), was made with no build or test at all. --ci host, the builds, the guest suite, the compile-fail cases and the control have no local measurement at 196ec3b67. --ci host reads tracked files that are not compiled, the issue among them, so the table's row at cc1a2c311 does not stand for it at the head: CI at 196ec3b67 is the measurement for host and guest / suite, and it is recorded below here. CI must show, at 196ec3b67: host green with Doc-tests toyos_abi listing the two compile fail ... ok cases and their two twins; toolchain green, which is the macro compiling as a dependency of std on both targets; guest / suite green.

CI at 196ec3b67, run 37696165075 (ci, on the pull request's head), all three concluded success:

• host (cargo run -- --ci host): [ci] Host: 78 step(s), all green. Under Doc-tests toyos_abi, exactly four lines: usersafe::user_safe (line 53) - compile fail ... ok, (line 70) - compile fail ... ok, (line 46) ... ok, (line 63) ... ok.
• toolchain / build: success; at this head it restored sysroot 6a6e3fbcd05fbd1c from the cache and compiled no std. The compile of toyos-abi with the macro under std, for both targets against sdk/std, is run 37694635644 at 3861d296b, which built that same sysroot key; 196ec3b67 differs from 3861d296b by one issue file and computes the same key.
• guest / suite: test result: ok. 30 passed, 30 total, run and not skipped.

No new guest test, no new dependency, no new gate.

High-risk checks (ABI, the kernel's trust boundary)

The two compile-fail cases, each beside its accepted twin, doc-tests on user_safe!. In --ci host at cc1a2c311: ci-host.log:4601-4604, both compile fail ... ok, both twins ok. The host's rustdoc reads no error code on a compile_fail block, so each reason was read with the fence removed (control/unfence.patch, applied checked and reversed in the script, tree clean after), cargo test -p toyos-abi --doc, EXIT=101, at-cc1a2c311/abi-doc-unfenced.log:

struct	result
{ a: u64, b: u64 }	builds
{ a: u64, b: u32 }	error[E0080]: evaluation panicked: a byte of \Tail` belongs to no field` (line 14)
{ a: u32, b: u32 }	builds
{ a: u32, b: char }	error[E0277]: the trait bound \char: UserSafe` is not satisfied` (line 30)

The whole change reverted, last run at cc1a2c311, not at the head. Mutation: the kernel's Stat.mtime narrowed from u64 to u32, four tail bytes in a struct SYS_FSTAT copies out. cargo run -- --build-only --arch x86_64, each arm a checked patch applied and reversed in one script (gates.sh), at-cc1a2c311/control/exits.txt, porcelain empty after. control/revert.patch is git diff <head> origin/main less the filed issues.

arm	exit	log
branch + mutation	EXIT=101, error[E0080]: evaluation panicked: a byte of \Stat` belongs to no fieldatsrc/object/ops.rs:611`	at-cc1a2c311/control/arm-a-branch.log:11
change reverted onto e16cb0841 + mutation	EXIT=0, Compiling kernel then Build finished.	at-cc1a2c311/control/arm-b-reverted.log:171, :509

Independent oracle: the compiler's own layout, size_of, is what the assertion reads; the macro computes no offset.

The patches are in the round 2 comment.

Unsure of

• Rust cannot forbid a hand-written unsafe impl UserSafe; one outside usersafe.rs is what a reader of a diff catches.
• The macro passes caller attributes through. #[repr(packed)] would be accepted, soundly; #[repr(align(N))] is refused whenever it adds a byte, and LogRecord's adds none.
• issues/clippy-stage-two-is-lints-one-at-a-time.md says in its record of a past sweep that LogRecord::as_bytes exists. It no longer does; that file is another track's history and is not edited here.
• toyos-abi/src/audio.rs keeps a hand sum on AudioCompletionRecord. No unsafe rests on it: both kernel drivers write the record field by field into a byte array.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

[Japabu]

Evidence for the negative controls

1. The two refusals with the compile_fail fence removed (cargo test -p toyos-abi --doc, EXIT=101, restored)

   Compiling toyos-abi v0.16.0 (<worktree>/toyos-abi)
    Finished `test` profile [optimized + debuginfo] target(s) in 0.55s
   Doc-tests toyos_abi

running 4 tests
test toyos-abi/src/usersafe.rs - usersafe::user_safe (line 64) ... FAILED
test toyos-abi/src/usersafe.rs - usersafe::user_safe (line 47) ... FAILED
test toyos-abi/src/usersafe.rs - usersafe::user_safe (line 40) ... ok
test toyos-abi/src/usersafe.rs - usersafe::user_safe (line 57) ... ok

failures:

---- toyos-abi/src/usersafe.rs - usersafe::user_safe (line 64) stdout ----
error[E0277]: the trait bound `char: UserSafe` is not satisfied
  --> toyos-abi/src/usersafe.rs:68:32
   |
68 |     struct Scalar { a: u32, b: char }
   |                                ^^^^ the trait `UserSafe` is not implemented for `char`
   |
   = help: the following other types implement trait `UserSafe`:
             FramebufferInfo
             InboxSetup
             LogCursor
             MouseEvent
             NamespaceBuild
             ProcessStats
             RawHandle
             RawKeyEvent
           and 13 others
note: required by a bound in `toyos_abi::usersafe::field`
  --> toyos-abi/src/usersafe.rs:31:23
   |
31 | pub const fn field<T: UserSafe>() -> usize {
   |                       ^^^^^^^^ required by this bound in `field`

error: aborting due to 1 previous error

For more information about this error, try `rustc --explain E0277`.
Couldn't compile the test.
---- toyos-abi/src/usersafe.rs - usersafe::user_safe (line 47) stdout ----
error[E0080]: evaluation panicked: a byte of `Tail` belongs to no field
  --> toyos-abi/src/usersafe.rs:49:1
   |
49 | / toyos_abi::user_safe! {
50 | |     #[derive(Clone, Copy)]
51 | |     struct Tail { a: u64, b: u32 }
52 | | }
   | |_^ evaluation of `main::_doctest_main_toyos_abi_src_usersafe_rs_47_0::_` failed here
   |
   = note: this error originates in the macro `$crate::panic::panic_2021` which comes from the expansion of the macro `toyos_abi::user_safe` (in Nightly builds, run with -Z macro-backtrace for more info)

error: aborting due to 1 previous error

For more information about this error, try `rustc --explain E0080`.
Couldn't compile the test.

failures:
    toyos-abi/src/usersafe.rs - usersafe::user_safe (line 47)
    toyos-abi/src/usersafe.rs - usersafe::user_safe (line 64)

test result: FAILED. 2 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.51s

error: doctest failed, to rerun pass `-p toyos-abi --doc`

2. Mutation on the branch (control/mutation-branch.patch)

diff --git a/kernel/src/object/ops.rs b/kernel/src/object/ops.rs
index 67260edad..af584dbf8 100644
--- a/kernel/src/object/ops.rs
+++ b/kernel/src/object/ops.rs
@@ -613,7 +613,7 @@ toyos_abi::user_safe! {
     pub struct Stat {
         pub file_type: u64,
         pub size: u64,
-        pub mtime: u64,
+        pub mtime: u32,
     }
 }
 
@@ -624,7 +624,7 @@ pub fn fstat(object: &KObjectRef) -> Stat {
         KObjectRef::File(f) => f.with(|state| Stat {
             file_type: FileType::File as u64,
             size: file_cache::size(state.file_id),
-            mtime: state.mtime,
+            mtime: state.mtime as u32,
         }),
         KObjectRef::PipeRead(r) => {
             plain(if r.is_tty() { FileType::Tty } else { FileType::Pipe })

3. The same mutation on the base, applied after the whole change is reverted (git diff HEAD origin/main)

diff --git a/kernel/src/object/ops.rs b/kernel/src/object/ops.rs
index e0803305f..9401c2361 100644
--- a/kernel/src/object/ops.rs
+++ b/kernel/src/object/ops.rs
@@ -613,7 +613,7 @@ pub fn seek(object: &KObjectRef, pos: SeekFrom) -> u64 {
 pub struct Stat {
     pub file_type: u64,
     pub size: u64,
-    pub mtime: u64,
+    pub mtime: u32,
 }
 
 /// What kind of thing this is, and how big.
@@ -623,7 +623,7 @@ pub fn fstat(object: &KObjectRef) -> Stat {
         KObjectRef::File(f) => f.with(|state| Stat {
             file_type: FileType::File as u64,
             size: file_cache::size(state.file_id),
-            mtime: state.mtime,
+            mtime: state.mtime as u32,
         }),
         KObjectRef::PipeRead(r) => {
             plain(if r.is_tty() { FileType::Tty } else { FileType::Pipe })

4. Exits (cargo run -- --build-only --arch x86_64 per arm, at e24fd3b55)

ARM A (branch + mutation) EXIT=101
ARM B (change reverted + mutation) EXIT=0
porcelain: []
DONE

5. Arm A's refusal, from its log

   Compiling kernel v0.1.0 (<worktree>/kernel)
   Compiling bootloader v0.1.0 (<worktree>/bootloader)
    Finished `toyos` profile [optimized + debuginfo] target(s) in 1.22s
error[E0080]: evaluation panicked: a byte of `Stat` belongs to no field
   --> src/object/ops.rs:611:1
    |
611 | / toyos_abi::user_safe! {
612 | |     #[derive(Clone, Copy)]
613 | |     pub struct Stat {
614 | |         pub file_type: u64,
...   |
618 | | }
    | |_^ evaluation of `object::ops::_` failed here
    |
    = note: this error originates in the macro `$crate::panic::panic_2021` which comes from the expansion of the macro `toyos_abi::user_safe` (in Nightly builds, run with -Z macro-backtrace for more info)

For more information about this error, try `rustc --explain E0080`.
error: could not compile `kernel` (bin "kernel") due to 1 previous error

thread '<unnamed>' (172605810) panicked at src/build.rs:432:9:
cargo build failed in <worktree>/kernel
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

thread 'main' (172605244) panicked at src/build.rs:1805:27:
kernel build thread panicked: Any { .. }

[Japabu]

Review, round 1, head 842f168a6 against origin/main e7010129f

Read, nothing run. Net lines (git diff --shortstat origin/main...842f168a6): 392 insertions, 378 deletions, 13 files. Production (kernel/, toyos-abi/): +347 −290, of which toyos-abi/src/usersafe.rs is +102 with four doc-tests inside it. Tests (toyos-userbound/src/span.rs's mod tests): +17 −29. issues/: +28 −59.

BLOCKER

• toyos-abi/src/input.rs:39, toyos-abi/src/input.rs:63, toyos-abi/src/lib.rs:99, and toyos-abi/src/{acpi.rs:57, hda.rs:58, part.rs:137, pci.rs:54, log.rs:169, syscall.rs:2486, trace.rs:53, virtio_sound.rs:154} — the branch leaves the tree with two mechanisms for one promise, and production grows where it could shrink — the pull request body's "Unsure of" names this compromise and neither removes nor records it. "No byte of this struct is padding, so its bytes may cross the boundary" is now proved by user_safe! for twelve structs and still asserted by hand for eight (AcpiInfo, HdaInfo, PartitionInfo, PciFunctionInfo, LogRecord, ModuleInfo, TraceRecord, VirtioSoundInfo): a literal sum beside each (4 * 4 + 2 + 2, 7 * 4, 8 + 16, ...), the shape the closed issue called hand-checked, and an unsafe from_raw_parts under it. Three more (RawKeyEvent, MouseEvent, FramebufferInfo) are UserSafe and keep their own unsafe block, whose SAFETY comment this diff rewrites to cite the macro: that sentence three times is T: UserSafe once. The deletion: one safe pub fn bytes<T: UserSafe>(value: &T) -> &[u8] in usersafe.rs, with the only unsafe block; the eight structs declared through user_safe! (every field of each is an integer, an array of them, RawHandle or acpi::Block, which goes through the macro too; LogRecord's align(64) passes as a caller attribute and its RECORD_BYTES, align_of and offset_of assertions stay, being other claims); eleven hand unsafe blocks, eight hand sums and their doc comments gone. Root CLAUDE.md gives a found compromise two outcomes. If the implementer's fence excludes the eight, the three inside the diff still go through the one function, and the eight are filed in issues/ with an owner and an exit a build can fail.

NOTE

• toyos-abi/src/usersafe.rs:93 — assert! and concat! are named bare, so a macro_rules! assert in textual scope at an expansion site replaces the check; ::core::assert! and ::core::concat! close it, as ::core::mem::size_of already is. None exists in kernel/ or toyos-abi/ at this head (git grep 'macro_rules! assert\b').
• PR body, "Gates" — the table gives command and exit and no log. The logs exist at this head and were read: orch/usersafe/head/head.txt is 842f168a69bd...; ci-host.log ends [ci] Host: 77 step(s), all green and carries the four doc-tests at lines 4598-4601 and span::tests at 4298-4309; guest-suite.log:806 is 30 passed, 30 total; both build logs end Build finished. The body names them, as File servers share by service and by login session, and no launch gives either a second share #742's does.
• PR body, "so no impl is written by hand" as the issue's exit words it is met for structs only: nine impls in usersafe.rs are by hand, the eight integers and [T; N]. The body says so; the close stands on it.

Judged, no finding

The macro's check is the promise. Fields of a struct occupy disjoint bytes, so size_of::<S>() equal to the sum of field sizes leaves no byte outside a field under any repr; every field UserSafe makes every byte of S a byte of a type with no invalid pattern. Shapes tried against it, each refused or sound:

• alignment: #[repr(align(N))] as a caller attribute adds bytes and fails the sum, or adds none and is harmless; #[repr(packed)] removes padding and is sound, and object::<T> reads its align_of of 1.
• zero-sized: [u64; 0] is UserSafe with size 0 and alignment 8; { a: u32, b: [u64; 0] } is 8 bytes against a sum of 4 and is refused.
• a field under #[cfg]: its type stays in the sum while the field leaves the struct, so the sum exceeds the size and the build fails closed.
• a type alias or a shadowed name (type u32 = char): the bound is on the type, not its spelling; refused.
• generics, lifetimes, enums, unions: no arm matches. bool, char, NonZero*, references, raw pointers, fn pointers, Cell<_>, floats, u128, usize: no impl, E0277.
• the repr(transparent) arm: one field, same @impl, same bound.
• a field whose own impl is by hand: only the nine in the file. u8 i8 u16 i16 u32 i32 u64 i64 each have no padding and no invalid pattern; [T; N] for T: UserSafe is N elements end to end, Copy with T. Each is right. The four the kernel wrote (u32, u64, [u32; 2], [u64; 2]) are covered, and every copy_in/copy_out caller in kernel/src/syscall/ built.
• a dropped #[repr(C)] in the first arm would keep every test green and stay UserSafe-sound while unpinning the ABI's field order; that is a line a reader of the macro's diff sees, not a mutation to run.

Can a type refuse a hand-written unsafe impl UserSafe outside the file? No. A macro_rules expansion is tokens at the call site: whatever user_safe! names from kernel/src/object/ops.rs or from a doc-test, a hand can name from the same place, so a sealed supertrait or a token has to be pub and only renames what the hand writes (zerocopy's only_derive_is_allowed_to_implement_this_trait is that, an obstacle and not a refusal). A real seal needs the macro unexported, which needs the kernel's Stat inside toyos-abi (the filed issue's exit) and gives up the issue's own exit, the two refused structs handed to the macro from outside the crate, because nothing in-crate can show a compile failure. So no named change here, and no #[doc(hidden)] supertrait either: it would be code guarding what a reader of a diff checks. The implementer's sentence is the remaining form; where it goes is the owner's.

The issue's exit, clause by clause.

• refused by the compiler, one macro writing impl and assertion together: usersafe.rs:72-101; the kernel's fifteen impls gone (kernel/src/user_ptr.rs, −42).
• { a: u64, b: u32 } refused beside { a: u64, b: u64 }: doc-tests at lines 47 and 40; reason read with the fence off, E0080 ... a byte of 'Tail' belongs to no field, EXIT=101 (abi-doc-unfenced.log, the PR's first comment).
• { a: u32, b: char } refused beside { a: u32, b: u32 }: lines 64 and 57; E0277 ... char: UserSafe, same run.
• no code builds or writes the four: they are doc-tests, and --ci host runs them (Doc-tests toyos_abi).
• span.rs's table deleted; the issue file deleted; git grep usersafe-layouts 842f168a6 finds no citation left.
• published crate or own, argued: accepted. The orphan rule puts the trait where the structs are, toyos-abi builds as rustc-dep-of-std, and no dependency arrives.

The whole-change-reverted control. control/revert.patch is byte-identical to git diff 842f168a6 origin/main less the filed issue, and git diff --stat e24fd3b55 842f168a6 is that one file, so the arms measured at e24fd3b55 are this head's source. Arm A, branch plus Stat.mtime: u32: EXIT=101, E0080 at src/object/ops.rs:611. Arm B, reverted plus the same mutation: EXIT=0, Compiling kernel then Build finished., tree clean after. The oracle is rustc's layout through size_of; the macro computes no offset.

span.rs. shapes() is every multiple of each alignment 1, 2, 4, 8 up to 256 bytes: a superset of the thirteen deleted rows and of LogCursor/TraceCursor (80, 8), which the table lacked. is_user_object takes only the two numbers, so the names were never tied to a type; nothing weaker.

issues/fstats-answer-is-declared-twice.md. Frontmatter is legal against issues/README.md; true of the tree (kernel/src/object/ops.rs:613, three u64; toyos-abi/src/syscall.rs:661, FileType #[repr(u64)] first); the exit is one a build can fail.

What #745's merge must check

toyos-abi is compiled into std, and this branch changes its code, so its identity moves and a sysroot is built. Neither head's measurements cover the merged tree:

1. On the merge result, not on either head: cargo run -- --build-only --arch x86_64 and --arch aarch64 each build a new sysroot whose log shows Compiling toyos-abi under Compiling std with std's backend read from sdk/std, then cargo run -- --ci host and the guest suite. This branch's own first build shows the macro compiling as rustc-dep-of-std on both targets (build-x86_64.log:97 and :153), against rust/library/std, not sdk/std.
2. std's ToyOS backend lives in sdk/std, and the fork names it by #[path] #745 rewrites src/sysroot.rs and src/toolchain.rs, which key the sysroot on toyos-abi/src as a directory and refuse a std whose dep-info read a file the key does not name. The merged lists must still name that directory, so the new toyos-abi/src/usersafe.rs is in the witness.
3. sdk/std/sys/process.rs:392 builds a SpawnArgs literal and sdk/std/sys/fs.rs:190 reads toyos::fs::Stat; both shapes are unchanged here, and the merged build is what says so.
4. No file is touched by both (gh pr view 745 --json files), so a textual conflict is not the signal; the sysroot build is.

SEND BACK

[Japabu]

Round 2 patches and outputs

Head 3861d296b. The control and the unfenced doc-tests were last run at cc1a2c311, which differs from the head by one filed issue file.

at-cc1a2c311/control/exits.txt:

ARM A (branch + mutation) EXIT=101
ARM B (change reverted + mutation) EXIT=0
porcelain: []
head: cc1a2c311d82341d06899609f9875d27a7a16965
UNFENCED DOC-TESTS EXIT=101
porcelain after unfence: []

control/mutation-branch.patch:

diff --git a/kernel/src/object/ops.rs b/kernel/src/object/ops.rs
index 67260edad..af584dbf8 100644
--- a/kernel/src/object/ops.rs
+++ b/kernel/src/object/ops.rs
@@ -613,7 +613,7 @@ toyos_abi::user_safe! {
     pub struct Stat {
         pub file_type: u64,
         pub size: u64,
-        pub mtime: u64,
+        pub mtime: u32,
     }
 }
 
@@ -624,7 +624,7 @@ pub fn fstat(object: &KObjectRef) -> Stat {
         KObjectRef::File(f) => f.with(|state| Stat {
             file_type: FileType::File as u64,
             size: file_cache::size(state.file_id),
-            mtime: state.mtime,
+            mtime: state.mtime as u32,
         }),
         KObjectRef::PipeRead(r) => {
             plain(if r.is_tty() { FileType::Tty } else { FileType::Pipe })

control/mutation-base.patch:

diff --git a/kernel/src/object/ops.rs b/kernel/src/object/ops.rs
index e0803305f..9401c2361 100644
--- a/kernel/src/object/ops.rs
+++ b/kernel/src/object/ops.rs
@@ -613,7 +613,7 @@ pub fn seek(object: &KObjectRef, pos: SeekFrom) -> u64 {
 pub struct Stat {
     pub file_type: u64,
     pub size: u64,
-    pub mtime: u64,
+    pub mtime: u32,
 }
 
 /// What kind of thing this is, and how big.
@@ -623,7 +623,7 @@ pub fn fstat(object: &KObjectRef) -> Stat {
         KObjectRef::File(f) => f.with(|state| Stat {
             file_type: FileType::File as u64,
             size: file_cache::size(state.file_id),
-            mtime: state.mtime,
+            mtime: state.mtime as u32,
         }),
         KObjectRef::PipeRead(r) => {
             plain(if r.is_tty() { FileType::Tty } else { FileType::Pipe })

control/unfence.patch:

diff --git a/toyos-abi/src/usersafe.rs b/toyos-abi/src/usersafe.rs
index da4c5f6db..f91044ff6 100644
--- a/toyos-abi/src/usersafe.rs
+++ b/toyos-abi/src/usersafe.rs
@@ -50,7 +50,7 @@ pub const fn field<T: UserSafe>() -> usize {
 /// }
 /// ```
 ///
-/// ```compile_fail
+/// ```
 /// toyos_abi::user_safe! {
 ///     #[derive(Clone, Copy)]
 ///     struct Tail { a: u64, b: u32 }
@@ -67,7 +67,7 @@ pub const fn field<T: UserSafe>() -> usize {
 /// }
 /// ```
 ///
-/// ```compile_fail
+/// ```
 /// toyos_abi::user_safe! {
 ///     #[derive(Clone, Copy)]
 ///     struct Scalar { a: u32, b: char }

control/revert.patch is git diff 3861d296b origin/main -- . ':!issues/fstats-answer-is-declared-twice.md' ':!issues/three-kernel-byte-views-still-rest-on-a-hand-layout-claim.md' (1814 lines; its source hunks are those of the run at cc1a2c311).

at-cc1a2c311/abi-doc-unfenced.log:

   Compiling toyos-abi v0.16.0 (/Users/jan/Dev/jan/toyos-usersafe/toyos-abi)
    Finished `test` profile [optimized + debuginfo] target(s) in 1.55s
   Doc-tests toyos_abi

running 4 tests
test toyos-abi/src/usersafe.rs - usersafe::user_safe (line 53) ... FAILED
test toyos-abi/src/usersafe.rs - usersafe::user_safe (line 70) ... FAILED
test toyos-abi/src/usersafe.rs - usersafe::user_safe (line 63) ... ok
test toyos-abi/src/usersafe.rs - usersafe::user_safe (line 46) ... ok

failures:

---- toyos-abi/src/usersafe.rs - usersafe::user_safe (line 53) stdout ----
error[E0080]: evaluation panicked: a byte of `Tail` belongs to no field
  --> toyos-abi/src/usersafe.rs:55:1
   |
55 | / toyos_abi::user_safe! {
56 | |     #[derive(Clone, Copy)]
57 | |     struct Tail { a: u64, b: u32 }
58 | | }
   | |_^ evaluation of `main::_doctest_main_toyos_abi_src_usersafe_rs_53_0::_` failed here
   |
   = note: this error originates in the macro `$crate::panic::panic_2021` which comes from the expansion of the macro `toyos_abi::user_safe` (in Nightly builds, run with -Z macro-backtrace for more info)

error: aborting due to 1 previous error

For more information about this error, try `rustc --explain E0080`.
Couldn't compile the test.
---- toyos-abi/src/usersafe.rs - usersafe::user_safe (line 70) stdout ----
error[E0277]: the trait bound `char: UserSafe` is not satisfied
  --> toyos-abi/src/usersafe.rs:74:32
   |
74 |     struct Scalar { a: u32, b: char }
   |                                ^^^^ the trait `UserSafe` is not implemented for `char`
   |
   = help: the following other types implement trait `UserSafe`:
             AcpiInfo
             FramebufferInfo
             HdaInfo
             InboxSetup
             LogCursor
             LogRecord
             ModuleInfo
             MouseEvent
           and 22 others
note: required by a bound in `toyos_abi::usersafe::field`
  --> toyos-abi/src/usersafe.rs:37:23
   |
37 | pub const fn field<T: UserSafe>() -> usize {
   |                       ^^^^^^^^ required by this bound in `field`

error: aborting due to 1 previous error

For more information about this error, try `rustc --explain E0277`.
Couldn't compile the test.

failures:
    toyos-abi/src/usersafe.rs - usersafe::user_safe (line 53)
    toyos-abi/src/usersafe.rs - usersafe::user_safe (line 70)

test result: FAILED. 2 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.63s

error: doctest failed, to rerun pass `-p toyos-abi --doc`

[Japabu]

Review, round 2, head 3861d296b against origin/main e16cb0841

Read, nothing run. Net lines (git diff --shortstat origin/main...3861d296b): 628 insertions, 749 deletions, 24 files. Production (kernel/, toyos-abi/, toyos/): +544 −661. Tests (toyos-userbound/src/span.rs's mod tests): +17 −29. issues/: +67 −59. Production shrinks; accepted.

Round 1's findings

• BLOCKER, two mechanisms for one promise: CLOSED. By reading the tree at the head and by the build that compiled it. git grep 'fn as_bytes' 3861d296b -- toyos-abi kernel toyos toyos-userbound sdk leaves one hit, toyos/src/ipc.rs:573, which is IpcPayload's and another promise. toyos-abi/src/usersafe.rs:30-33 is the only from_raw_parts over an ABI struct in toyos-abi; the eight structs and acpi::Block are under user_safe!; the eight hand sums and eleven unsafe blocks are gone; LogRecord keeps RECORD_BYTES, align_of and offset_of, TraceRecord keeps RECORD_BYTES. read_rings lost its one-valued bytes parameter for a Stream<Record: UserSafe> bound. No caller of a deleted method is left in the tree (sdk/std included), and at-cc1a2c311/build-x86_64.log:560, build-aarch64.log:394 and ci-host.log:7826 are that source building on both targets and the host.
• NOTE, bare assert!/concat!: closed. usersafe.rs:101,103 name ::core::assert! and ::core::concat!.
• NOTE, gates without logs: closed. The body's table names a log and line per row; each was read and says what the body says (ci-host.log:4598-4606 the four doc-tests, :7826 77 step(s), all green; guest-suite.log:855 30 passed, 30 total; control/exits.txt A=101, B=0, porcelain empty, head cc1a2c311).
• NOTE, "no impl by hand" holds for structs only: closed. The body says so.

BLOCKER

• PR body, "Gates" — cargo run -- --ci host and the guest suite have no measurement at 3861d296b — Evidence. The body says so itself. git diff --stat cc1a2c311 3861d296b is one issues/ file, so every compiled input is the one measured at cc1a2c311, and I accept the builds, the guest suite, the unfenced doc-tests and the control on that ground, as round 1 accepted the control one issue file behind its head. --ci host is not covered the same way: it reads tracked files that are not compiled, and the head adds one. At the time of this comment gh pr checks 747 shows toolchain / build pass (10m2s), host pending, guest / suite pending. This closes with no code change, by CI at the head that lands (see the NOTE below, which moves it):
  • host: green, its log ending [ci] Host: <N> step(s), all green, and under Doc-tests toyos_abi exactly four lines: usersafe::user_safe (line 53) - compile fail ... ok, (line 70) - compile fail ... ok, (line 46) ... ok, (line 63) ... ok. Three lines, or a compile fail line missing its twin, is red whatever the summary says.
  • toolchain / build: green, which is toyos-abi with the macro compiling under Compiling std for both targets against sdk/std. It is green at 3861d296b.
  • guest / suite: green and run, not skipped: 30 passed, 30 total or the count main has, no test filtered.
    The body then names those three runs with their head. The verdict stands on them and on nothing else.

NOTE

• issues/three-kernel-byte-views-still-rest-on-a-hand-layout-claim.md:19,23-24 — the DeviceIrqRecord row says its SAFETY comment rests on "an assertion that does not exist", and the paragraph under the table says a field added to it "fails nothing" — false of the tree: toyos-abi/src/pci.rs:103 is const _: () = assert!(DeviceIrqRecord::SIZE == 4);, so an added field fails the build unless the literal is moved with it, the same weakness as the other two rows (a literal total, where theirs is a hand sum). The file is this branch's and in the tree, so the implementer corrects it, not the orchestrator; the correction is a new head.
• issues/clippy-stage-two-is-lints-one-at-a-time.md:486 — "LogRecord::as_bytes exists" is false of the tree once this lands. The body discloses it; it is another track's file.

The three kernel byte views: filed is right

DmaGrant, DmaMapping and DeviceIrqRecord are round 1's shape and round 1's miss: its count was eleven and the tree had fourteen. They do not reopen the BLOCKER, and they are not owed in this diff:

• None is UserSafe, at base or at head, and no T: UserSafe path reaches one. The branch's claim is about a UserSafe value's bytes, and that claim is true of the tree; the body and title do not say the tree has one unsafe byte view, and the body names the three.
• The branch does not write, move or widen them: kernel/src/syscall/device.rs is not in the diff, and grant_bytes, record_bytes and the inline block are main's bytes. Nothing regressed: fourteen hand views became three.
• Root CLAUDE.md gives a found compromise two outcomes and tells an agent to file what is off its task. Round 1 named filing as the legal outcome for what lay outside the fence. The file is legal against issues/README.md (defect, open, three fields), names its files, and its exit is one a build fails on: a padded struct under user_safe! is E0080.
• Folding them in changes toyos-abi/src/pci.rs and the DMA grant path, which is device and ABI code: a new sysroot, the gates and the control again at a new source. Filing leaves the measured source frozen, which is what the evidence above rests on.

It would be a BLOCKER if the body claimed one byte view for the tree, or if the issue had no exit. Neither is so, once the NOTE above is corrected.

The round adds nothing else

• git diff 14dd1b9a8 cc1a2c311 -- toyos-abi kernel toyos toyos-userbound is empty: the merge of std's ToyOS backend lives in sdk/std, and the fork names it by #[path] #745 touched none of this branch's source, and no file is touched by both sides. src/sysroot.rs and src/toolchain.rs still key on toyos-abi/src as a directory, so usersafe.rs is in the witness; build-x86_64.log:10,23,28,79,83 is the new sysroot with toyos-abi under std twice.
• git grep usersafe-layouts 3861d296b and git grep 'user_ptr::UserSafe' 3861d296b find nothing: no citation of the deleted issue, no path to the moved trait.
• bytes is sound as written: &T is readable for size_of::<T>(), u8 has alignment 1, the lifetime is the borrow's, and T: UserSafe is the no-padding half. UserRecords writes at written * bytes.len(), the stride it had.
• No new dependency, feature, cfg, package, workflow, guest test or host tool. The two decoding tests kept hold field order, which the macro does not, and can fail on it.
• Control at cc1a2c311: arm A E0080 ... a byte of 'Stat' belongs to no field at src/object/ops.rs:611, EXIT=101; arm B Compiling kernel, Build finished., EXIT=0. The mutation patches in comment 6047879819 are the same change on both arms.

SEND BACK

[Japabu]

Review, round 3, head 196ec3b67 against origin/main e16cb0841

Read, nothing run. Net lines (git diff --shortstat origin/main...196ec3b67): 630 insertions, 749 deletions, 24 files. Production (kernel/, toyos-abi/, toyos/): +544 −661, unchanged from round 2. Tests: +17 −29, unchanged. issues/: +69 −59. git diff --stat 3861d296b 196ec3b67 is issues/three-kernel-byte-views-still-rest-on-a-hand-layout-claim.md alone (8 insertions, 6 deletions); origin/main has not moved. Nothing else moved.

Round 2's findings

• BLOCKER, no measurement of host and guest / suite at the landing head: CLOSED. Run 37696165075 (ci, pull_request), headSha 196ec3b67, all three jobs success; each job's checkout line is HEAD is now at cfed847 Merge 196ec3b67… into e16cb0841…, so what ran is the head merged onto the main it lands on. The three job logs were fetched with gh run view 37696165075 --job <id> --log and read; the fetched host log is byte-identical to the saved usersafe-r3/ci-host.log (cmp exit 0).
  • host (job 113048790048, step Run cargo run -- --ci host = success): line 9612 [ci] Host: 78 step(s), all green. Lines 5341-5349: Doc-tests toyos_abi, running 4 tests, usersafe::user_safe (line 53) - compile fail ... ok, (line 46) ... ok, (line 63) ... ok, (line 70) - compile fail ... ok, test result: ok. 4 passed; 0 failed. Four lines, both compile fail cases beside their twins: what round 2 asked. The log holds 67 ... FAILED lines, lines 6381-8026; every one lies inside a === [ci] control '<name>' step between kernel-loom without loom (22:37:49) and userland/acpiserver (22:39:11), each step closing N verdict(s) reached. They are the red arms of main's own controls and not a finding.
  • guest / suite (job 113050060747, step Run cargo run -- --ci guest = success, not skipped; runner label kvm: true, /dev/kvm opens): line 681 installed sysroot 6a6e3fbcd05fbd1c, then Compiling kernel and Compiling toyos-userbound at this head, running 30 tests, 1 wide, thirty RUN/PASS pairs and no other outcome, line 857 test result: ok. 30 passed, 30 total, line 862 [ci] Guest: 5 step(s), all green. The count is the one measured locally at cc1a2c311.
  • toolchain / build (job 113048790324): green, line 535 [ci] Toolchain: 1 step(s), all green, line 623 [ci] Bootstrap: 1 step(s), all green. At this head the job compiled no std: line 603 is Cache hit for: toolchain-sysroot-6a6e3fbcd05fbd1c and line 622 says sysroot 6a6e3fbcd05fbd1c restored. The compile round 2 asked for is in run 37694635644, job 113043227491, head 3861d296b (toolchain / build = success; the run's other two jobs were cancelled by the push): Cache not found for input keys: toolchain-sysroot-6a6e3fbcd05fbd1c, Building sysroot 6a6e3fbcd05fbd1c, Compiling std at 22:17:26 and 22:19:06 with Compiling toyos-abi v0.16.0 under each at 22:18:11 and 22:19:55, sysroot 6a6e3fbcd05fbd1c built, Bootstrap: 1 step(s), all green, Cache saved with key: toolchain-sysroot-6a6e3fbcd05fbd1c. The key is computed from the tree and names toyos-abi/src (src/sysroot.rs, src/toolchain.rs); the head computes the same key, git diff 3861d296b 196ec3b67 touches no source, and the guest suite built its kernel and passed 30 of 30 on that sysroot. I accept it as the measurement of the head's source. See the NOTE on how the body words it.
• NOTE, the DeviceIrqRecord row: closed. The row now reads SIZE == 4, a total written by hand, and the paragraph says the same weakness of all three. Against the tree at the head: toyos-abi/src/pci.rs:65 size_of::<DmaGrant>() == 4 + 4 + 8 + 8, :82 size_of::<DmaMapping>() == 8 + 8, :100 SIZE = size_of::<Self>(), :103 assert!(DeviceIrqRecord::SIZE == 4); the three views are kernel/src/syscall/device.rs:280 (inline, DmaMapping), :308 (grant_bytes), kernel/src/object/ops.rs:491 (record_bytes), each SAFETY comment citing the assertion beside the declaration. Every statement in the file is true of the tree. Frontmatter open / defect / opened is legal against issues/README.md; the exit is one a build fails on.
• NOTE, issues/clippy-stage-two-is-lints-one-at-a-time.md:486: stands as recorded, another track's file, disclosed in the body.

BLOCKER

None.

NOTE

• PR body, "CI at 196ec3b67", toolchain / build — "success, which is toyos-abi with the macro compiled under std for both targets against sdk/std" is false of run 37696165075's log: that job restored sysroot 6a6e3fbcd05fbd1c from the cache and compiled no std. The compile is run 37694635644, job 113043227491, at 3861d296b, under the same key. Prose in a record; the orchestrator corrects the body to name both runs.

LAND