toyos-net-ip: 169.254/16 is on the link whatever address is held, and a silent next hop holds up no other

[Japabu]

Stage "ip" of the move off smoltcp: two rules of toyos-net-ip, each with the test that is its exit. toyos-net-ip ships in no image (userland/netstack links smoltcp and none of the toyos-net-* crates), so no guest test reaches this and none is added.

Head 95b889b15 (b83237cab and one line of the track after it), on origin/main at a4416fe6c (#774 is merged in). Round 3: it answers the review of 6b14a7f4d, whose one source change is the input path's refusal below.

What changed, per decision

1. A host of 169.254/16 is on the link whatever address the interface holds (RFC 3927 §2.6.2, §2.7).

• Two predicates, for two questions. Interface::on_link is what it is on main, inside the prefix of a usable address, and its readers set_gateways and withdraw_off_link are byte for byte main's: a gateway is in a prefix the interface holds (RFC 2132 §3.5), and 169.254.0.1 on a routable interface is refused route.gateway-off-link, as toyos-dhcp refuses it. Interface::is_neighbour is new: on the link, or a host of 169.254/16 on an interface with a usable address. It has two readers:
  • route::lookup, one arm after the connected prefixes and before the gateway: a 169.254/16 destination goes to NextHop::Neighbour(destination) on the lowest eligible interface that has an address, or the one a bound source names, and never falls through to the gateway.
  • ARP reception, where a link-local sender is a neighbour. Without it the reply to the request [ip] now sends would be counted arp.sender-off-link and dropped.
• The prefix's two edges, 169.254.0.0 and 169.254.255.255, are no host on an interface whose prefixes do not hold them, and no peer on any:
  • as an ARP sender, in a request or a reply, each is arp.invalid-sender-address on every interface, beside our own prefixes' edges;
  • as the source of an IPv4 datagram each is ip.invalid-source on every interface (RFC 1122 §3.2.1.3 for the broadcast address, which RFC 3927 §2.6.2 names for every host; the network address by the tree's rule for one). This is round 3's change: input.rs read only the held prefixes' edges;
  • as a destination on an interface none of whose prefixes holds it, each is route.none: §2.6.2 excludes the broadcast address from what is resolved, and §2.7 keeps it from the router;
  • an interface that holds 169.254.x.y/16 broadcasts to 169.254.255.255 as before, by its connected prefix. One whose own prefix is wider than 169.254/16 and contains it (169.255.0.5/15) still resolves 169.254.255.255 as a neighbour, as on main: it is inside a connected prefix and not that prefix's edge. Nothing answers it, since the reply is refused as a sender, and the entry fails at 3 s.
• The node's test an_answer_to_a_link_local_asker_leaves_by_the_router is renamed an_answer_to_a_link_local_asker_goes_to_its_own_link_address. It finds exactly one frame after the query, the ARP request for the asker itself, and after the asker's reply the answer in a frame to the asker's own link address. The reply comes to the link's broadcast address, as RFC 3927 §2.5 has a link-local sender send it. The test delivers that reply itself: Lan::pump answers only for the router and B, and tests/lan/mod.rs is outside the fence.

2. A next hop that never answers ARP holds up no datagram to another (RFC 4861 §7.2.2). No source change: the queue was already INCOMPLETE's own. rfc_4861_7_2_2_a_silent_next_hop_holds_up_no_other holds it: nine datagrams to nine hosts behind a silent router fill and overflow the router's queue; eight to B wait in B's; B answers and its eight leave in order while the router's wait on; a ninth to B leaves at once; the router fails alone, and only the flows routed by it are told.

3. The track. Its line for the first rule and #774's line for the second are removed: both exits are met. Two lines are added:

• what is left of §2.6.2: a datagram from a 169.254/16 source to a destination outside it goes to the router where there is one and is refused route.none where there is none. rfc_3927_2_6_2_a_link_local_source_still_sends_by_the_router_or_nowhere holds both as they stand. The line says that no interface holds such an address today, that no stage is planned that gives one, that §2.5 would be owed with it, and an exit a test reads either way.
• the scenario ids. I read the routing, reachability and ARP reception scenarios of the readers' IP specification for this round: RTE-01 to RTE-17 and NBR-01 to NBR-18 name 169.254/16 nowhere, and neither NUD-04 nor NUD-05 has a second neighbour answering. No scenario holds either rule, so the tests name their RFC section and carry no id, and the exit is that the readers add one for each.

What a host on the link can now do to the neighbour table

• Which entries are new. An ARP request for one of our addresses from a link-local sender is learned to STALE, where it was counted and not cached. Our own datagrams to a link-local destination make an INCOMPLETE entry for that destination, where they went to the router's one entry: an echo reply, a port unreachable, a reset or an mDNS answer to a datagram that came from a link-local source. An entry for a link-local address carries datagrams to that address and nothing else.
• The bounds are unchanged: 512 entries, an entry in use never evicted, 64 held datagrams an interface.
• What is new on a /24. The table could not fill from the wire before, since 253 senders pass the prefix; now it can. A host cycling link-local senders that ask for our address makes STALE entries newer than every idle real one, so eviction takes the leased prefix's idle STALE entries first, the router's among them once it idles. The cost is one resolution on the next send, and that send finds room because the flood's entries are STALE too. Datagrams from cycling link-local sources that make us answer hold at most 64 INCOMPLETE entries at a time and then refuse every new resolution nb.pending-full until they fail at 3 s. Both were already true of any lease of /16 or shorter, and the second of any prefix with 64 unused addresses.

Checks (a trust boundary)

• Oracle. RFC 3927 §2.5, §2.6.2 and §2.7, RFC 2132 §3.5 and RFC 4861 §7.2.2, quoted at each test. In the node's test every frame the node emits is read by etherparse (lan::outside); the query and the asker's reply are written from the RFCs' layouts by the test's own helpers.
• Wire input. The new path from the wire is an ARP packet whose sender is in 169.254/16. It passes the checks that were there, with the two edges added to the refused senders, and then goes where an on-link sender's went. On the IPv4 input path the change only refuses more. Nothing new can panic: the crate forbids indexing, arithmetic side effects, unwrap and expect, and the source diff adds a matches! on four octets, an any and a find.
• Negative controls, round 3, every one run again at this head: each a checked patch applied, run with cargo test --locked --no-fail-fast -p toyos-net-ip -p toyos-net-node, and reversed, by one script that refuses a dirty tree before and after. The patches, the script and each failed assertion of rounds 1 and 2 are in their comments; round 3's comment carries the two new patches, the script's output and every failed assertion at this head. Each run's whole log is round 3's step of that number in the orchestrator's scratchpad.

step	mutation	exit	red
10	m0: the whole source change reverted onto the base (toyos-net-ip/src as origin/main), tests as here	101	the node's renamed test; …a_link_local_destination_is_on_the_link, …a_datagram_to_a_link_local_host_is_resolved_and_sent_to_it, …a_link_local_sender_is_a_neighbour, …the_edges_…_are_no_destination, …the_edges_…_are_no_senders, …the_edges_…_are_no_source
11	m0c: the source as reviewed in round 2 (6b14a7f4d), tests as here: the red-first run of round 3's test	101	rfc_3927_the_edges_of_the_link_local_prefix_are_no_source
12	m1: the route arm removed	101	the node's renamed test; the first two rfc_3927_2_6_2 tests; …the_edges_…_are_no_destination
13	m2: the neighbour queue made global (one queue of 8 for the interface)	101	rfc_4861_7_2_2_a_silent_next_hop_holds_up_no_other; also s_ip_nud_005, s_ip_nud_029
14	m3: ARP reads the prefixes only	101	the node's renamed test; …a_datagram_to_a_link_local_host…, …a_link_local_sender_is_a_neighbour
15	m4a: an edge of 169.254/16 is a neighbour	101	…the_edges_…_are_no_destination
16	m4b: an edge of 169.254/16 is an ARP sender	101	…the_edges_…_are_no_senders
17	m5: the gateways read the wide predicate	101	rfc_3927_a_link_local_address_is_no_gateway_of_a_routable_interface
18	m6: an edge falls through to the router	101	…the_edges_…_are_no_destination
19	m7: an edge of 169.254/16 is an IPv4 source (the new check removed)	101	…the_edges_…_are_no_source

The red-first run of the three tests round 1's review named, against c9bbdb5f4's source, is round 2's step 11 (exit 101) and its comment.

• Red-first, said plainly. Every rfc_3927 test but the present-state one, and the node's renamed test, are red on the base (step 10); round 3's test is red on 6b14a7f4d's source (step 11): the datagram from 169.254.0.0 is delivered, Some(Unicast) where None is wanted. rfc_4861_7_2_2_a_silent_next_hop_holds_up_no_other is green on the base, as it must be: the property already held, and its control is m2, which also reds two older scenarios. rfc_3927_2_6_2_a_link_local_source_still_sends_by_the_router_or_nowhere is green on every arm: it holds a present state the change does not touch.

Gates, round 3, at b83237cab

step	command	exit
01	cargo test --locked --no-fail-fast -p toyos-net-ip -p toyos-net-udp -p toyos-dhcp -p toyos-dns -p toyos-net-shard -p toyos-net-testnet -p toyos-net-tcp -p toyos-net-node -p toyos-mdns	0
02	cargo clippy --locked -p toyos-net-ip -p toyos-net-node -p toyos-net-udp -p toyos-net-shard -p toyos-dhcp --all-targets --keep-going -- <src/clippy.rs's ADOPTED as -W> -D warnings	0
03	cargo test --locked --lib -- hostws:: userlandhost:: sourcegate:: licence:: from the root package (45 passed)	0

Not run, and still owed before this lands: cargo run -- --ci host. My brief leaves it to CI, and a draft runs no CI, so the host check at this head is skipped and not green. Step 02 is the touched crates and their dependants under the local toolchain's lints, not src/clippy.rs's workspace shapes. No guest test and nothing on metal is owed or was run.

Growth

git diff --shortstat origin/main...b83237cab: 9 files, +249 −21. Production +27 −9: arp.rs +4 −4, iface.rs +11 −0, input.rs +2 −2, route.rs +10 −3; the code is one predicate of one expression, one constant function with three readers, a five-line arm, and three changed conditions. Tests: toyos-net-ip/tests +203, the node's name.rs +17 −10. The track +2 −2.

Unsure of

• route.none for the two edges on a routable interface. route.invalid-destination would also be a true name; I took the one that says there is no way there from this interface, since an interface that holds the prefix does send to its broadcast.
• The new input test sits in tests/addr.rs beside the other rfc_3927 tests, which the track's line names; I did not read the specification's input scenarios, so that 169.254 is in none of them rests on the round 2 review's reading of the whole of it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

[Japabu]

Negative controls at c9bbdb5f4: the patches, the script that ran them, and its output. Each patch applies with git apply --recount at that head.

run.sh:

#!/bin/sh
# Applies each mutation as a checked patch, runs the tests it must red, records the exit, restores.
S=<scratchpad>
cd <worktree> || exit 2
[ -z "$(git status --porcelain)" ] || { echo "tree not clean"; exit 2; }
echo "head $(git rev-parse HEAD)"
one() { # name
    name=$1; patch="$S/mut/$name.patch"
    git apply --recount --check "$patch" || { echo "$name: patch does not apply"; exit 2; }
    git apply --recount "$patch"
    cargo test --locked --no-fail-fast -p toyos-net-ip -p toyos-net-node > "$S/mut/$name.log" 2>&1
    echo "$name EXIT=$?"
    echo "EXIT recorded above" >> "$S/mut/$name.log"
    git apply --recount -R "$patch" || { echo "$name: restore failed"; exit 2; }
    [ -z "$(git status --porcelain)" ] || { echo "$name: tree not clean after restore"; exit 2; }
}
one m0-whole-source-change-reverted
one m1-route-arm-removed
one m2-neighbour-queue-global
one m3-arp-reads-prefixes-only
git status --porcelain; echo "clean=$?"

Its output (exit 0; each mutation's cargo test exit is on its line):

head c9bbdb5f495635f8593d0bcd988ace56865d0601
m0-whole-source-change-reverted EXIT=101
m1-route-arm-removed EXIT=101
m2-neighbour-queue-global EXIT=101
m3-arp-reads-prefixes-only EXIT=101
clean=0

m0-whole-source-change-reverted.patch:

diff --git a/toyos-net-ip/src/iface.rs b/toyos-net-ip/src/iface.rs
index b3d126daf..148ac72e3 100644
--- a/toyos-net-ip/src/iface.rs
+++ b/toyos-net-ip/src/iface.rs
@@ -63,10 +63,9 @@ impl Interface {
         self.addresses.iter().any(|a| a.cidr.addr() == addr)
     }
 
-    /// Reachable without a gateway: inside the prefix of a usable address, or in 169.254/16,
-    /// which is this link's whatever address the interface holds (RFC 3927 §2.6.2).
+    /// Inside the prefix of a usable address: reachable without a gateway.
     pub fn on_link(&self, addr: Ipv4Addr) -> bool {
-        self.usable().any(|a| addr.is_link_local() || a.cidr.contains(addr))
+        self.usable().any(|a| a.cidr.contains(addr))
     }
 
     /// A usable address whose prefix holds `toward`, else the first usable one.
diff --git a/toyos-net-ip/src/route.rs b/toyos-net-ip/src/route.rs
index 1437347d7..79f1f91a0 100644
--- a/toyos-net-ip/src/route.rs
+++ b/toyos-net-ip/src/route.rs
@@ -1,8 +1,7 @@
 //! The host routing table: the connected prefixes of usable addresses and an ordered list of
-//! on-link gateways per interface; longest prefix first, then 169.254/16 on the link itself (RFC
-//! 3927 §2.6.2), then the active gateway, and no forwarding. A lookup considers only interfaces
-//! that are up, and with a bound source only the interface holding it (RFC 1122 §3.3.4.2, the
-//! strong model).
+//! on-link gateways per interface; longest prefix first, then the active gateway, and no
+//! forwarding. A lookup considers only interfaces that are up, and with a bound source only the
+//! interface holding it (RFC 1122 §3.3.4.2, the strong model).
 
 use core::net::Ipv4Addr;
 
@@ -93,11 +92,6 @@ pub(crate) fn lookup(ifaces: &[Interface], destination: Ipv4Addr, source: Source
         let next_hop = if cidr.broadcast() == Some(destination) { NextHop::Broadcast } else { NextHop::Neighbour(destination) };
         return Ok(Route { iface: IfIndex(index), next_hop, source: pick_source(i, destination)? });
     }
-    // On the link with no prefix holding it is 169.254/16: resolved and sent to directly, and
-    // never handed to a router (RFC 3927 §2.6.2, §7).
-    if let Some((index, i)) = candidates().find(|(_, i)| i.on_link(destination)) {
-        return Ok(Route { iface: IfIndex(index), next_hop: NextHop::Neighbour(destination), source: pick_source(i, destination)? });
-    }
     let (index, i, gateway) = candidates().find_map(|(index, i)| i.active.map(|g| (index, i, g))).ok_or(Counter::RouteNone)?;
     Ok(Route { iface: IfIndex(index), next_hop: NextHop::Neighbour(gateway), source: pick_source(i, gateway)? })
 }

Red under it:

test rfc_3927_2_6_2_a_datagram_to_a_link_local_host_is_resolved_and_sent_to_it ... FAILED
test rfc_3927_2_6_2_a_link_local_destination_is_on_the_link ... FAILED
test result: FAILED. 31 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test rfc_3927_2_6_2_a_link_local_sender_is_a_neighbour ... FAILED
test result: FAILED. 21 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test an_answer_to_a_link_local_asker_goes_to_its_own_link_address ... FAILED
test result: FAILED. 12 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

m1-route-arm-removed.patch:

--- a/toyos-net-ip/src/route.rs
+++ b/toyos-net-ip/src/route.rs
@@ -93,11 +93,6 @@ pub(crate) fn lookup(ifaces: &[Interface], destination: Ipv4Addr, source: Source
         let next_hop = if cidr.broadcast() == Some(destination) { NextHop::Broadcast } else { NextHop::Neighbour(destination) };
         return Ok(Route { iface: IfIndex(index), next_hop, source: pick_source(i, destination)? });
     }
-    // On the link with no prefix holding it is 169.254/16: resolved and sent to directly, and
-    // never handed to a router (RFC 3927 §2.6.2, §7).
-    if let Some((index, i)) = candidates().find(|(_, i)| i.on_link(destination)) {
-        return Ok(Route { iface: IfIndex(index), next_hop: NextHop::Neighbour(destination), source: pick_source(i, destination)? });
-    }
     let (index, i, gateway) = candidates().find_map(|(index, i)| i.active.map(|g| (index, i, g))).ok_or(Counter::RouteNone)?;
     Ok(Route { iface: IfIndex(index), next_hop: NextHop::Neighbour(gateway), source: pick_source(i, gateway)? })
 }

Red under it:

test rfc_3927_2_6_2_a_datagram_to_a_link_local_host_is_resolved_and_sent_to_it ... FAILED
test rfc_3927_2_6_2_a_link_local_destination_is_on_the_link ... FAILED
test result: FAILED. 31 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s
test an_answer_to_a_link_local_asker_goes_to_its_own_link_address ... FAILED
test result: FAILED. 12 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

m2-neighbour-queue-global.patch:

--- a/toyos-net-ip/src/nud.rs
+++ b/toyos-net-ip/src/nud.rs
@@ -395,13 +395,22 @@ pub(crate) fn send(i: &mut Interface, cx: &mut Cx<'_>, addr: Ipv4Addr, hint: Opt
     }
 }
 
-/// Holds a frame for an INCOMPLETE neighbour; the queue keeps the newest (RFC 4861 §7.2.2).
+/// MUTATION: one queue of PENDING_PER_NEIGHBOUR for the whole interface, whose oldest datagram
+/// goes whichever neighbour it waits for.
 pub(crate) fn hold(i: &mut Interface, cx: &mut Cx<'_>, addr: Ipv4Addr, held: Held) {
-    let Some(Nud::Incomplete(s)) = i.neighbours.get_mut(&addr).map(|n| &mut n.state) else { return };
-    if s.pending.push(held).is_some() {
-        i.held = i.held.saturating_sub(1);
-        cx.log.count(Counter::NbPendingOverflow);
+    if !matches!(i.neighbours.get(&addr).map(|n| &n.state), Some(Nud::Incomplete(_))) {
+        return;
+    }
+    if i.held >= PENDING_PER_NEIGHBOUR {
+        let oldest = i.neighbours.values_mut().find_map(|n| match &mut n.state {
+            Nud::Incomplete(s) => s.pending.0.pop_front(),
+            _ => None,
+        });
+        if oldest.is_some() {
+            i.held = i.held.saturating_sub(1);
+            cx.log.count(Counter::NbPendingOverflow);
+        }
     }
+    let Some(Nud::Incomplete(s)) = i.neighbours.get_mut(&addr).map(|n| &mut n.state) else { return };
+    s.pending.0.push_back(held);
     i.held = i.held.saturating_add(1);
 }
 

Red under it:

test rfc_4861_7_2_2_a_silent_next_hop_holds_up_no_other ... FAILED
test s_ip_nud_005_the_interface_holds_at_most_64 ... FAILED
test s_ip_nud_029_released_datagrams_are_evicted_last ... FAILED
test result: FAILED. 32 passed; 3 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

m3-arp-reads-prefixes-only.patch:

--- a/toyos-net-ip/src/arp.rs
+++ b/toyos-net-ip/src/arp.rs
@@ -36,7 +36,7 @@ pub(crate) fn receive(i: &mut Interface, cx: &mut Cx<'_>, arp: &Arp) {
     let for_us = arp.operation == Operation::Request && i.is_usable(target);
     let mut noticed = for_us;
     if !probe {
-        if !i.on_link(sender) {
+        if !i.usable().any(|a| a.cidr.contains(sender)) {
             cx.log.count(Counter::ArpSenderOffLink);
             noticed = true;
         } else if i.neighbours.contains_key(&sender) {

Red under it:

test rfc_3927_2_6_2_a_datagram_to_a_link_local_host_is_resolved_and_sent_to_it ... FAILED
test result: FAILED. 32 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test rfc_3927_2_6_2_a_link_local_sender_is_a_neighbour ... FAILED
test result: FAILED. 21 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test an_answer_to_a_link_local_asker_goes_to_its_own_link_address ... FAILED
test result: FAILED. 12 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

[Japabu]

Review of wt/toyos-move-ip at c9bbdb5f4 against origin/main at a4416fe6c, round 1. Read only: no build, no test. RFC 3927 was read from rfc-editor.org for this round.

Growth: git diff --shortstat origin/main...c9bbdb5f4 is 7 files, +158 −17. Production +12 −5 (iface.rs +3 −2, route.rs +9 −3). Tests +145 −9 (toyos-net-ip/tests +129, node name.rs +16 −9). Track +2 −2. The production growth is accepted for the route arm and the ARP reader; not for the gateway reader (BLOCKER 3).

BLOCKER

1. PR body, "Gates" — cargo run -- --ci host green at the head is absent, and the host, toolchain and guest checks at c9bbdb5f4 all read SKIPPED — Evidence asks it of every branch, and a skipped check is not a green one. The three commands the body carries are a subset: no src/clippy.rs shape was run (the body says so), and the green arm is a count ("942 tests ok") with no log. No guest test is owed: no shipped package links toyos-net-ip (its dependants are toyos-net-udp, toyos-dhcp, toyos-net-shard and toyos-net-node, none in userland/netstack's manifest).

2. toyos-net-ip/src/iface.rs:69, src/route.rs:98, src/arp.rs:39, tests/addr.rs:434-437 — 169.254.0.0 and 169.254.255.255 are hosts on the link of every interface that holds a routable address — the one prefix this diff adds to "on link" has no edges, where every prefix the interface holds does (arp.rs:27, route.rs:159, input.rs:87, s_ip_nbr_002_prefix_edges_are_no_senders). What follows, by reading:

   • a datagram to 169.254.255.255 leaves as an ARP request for the prefix's broadcast address, and the new test asserts that as right. RFC 3927 §2.6.2 excludes exactly this address from "MUST ARP for the destination";
   • the body's "resolved as a host and never answered" holds only of honest hosts. A reply whose sender is 169.254.255.255 passes is_host, passes is_edge (our prefixes only), is on_link, finds the INCOMPLETE entry our request made, and nud::confirm makes it REACHABLE: the held datagrams leave to the claimant's MAC;
   • a request for our address from sender 169.254.255.255 or 169.254.0.0 is learned to STALE, where before this diff it was arp.sender-off-link and on a 169.254.x.y/16 interface it is arp.invalid-sender-address;
   • set_gateways takes 169.254.255.255 as a router.
     Wanted: the two edges of 169.254/16 are a host nowhere on_link is read, and still never the router's. Tests that must exist and fail on this head: a send to 169.254.255.255 from fixture I emits no ARP request and no frame to the router's MAC; an ARP request for A and an ARP reply, each from sender 169.254.255.255 and from 169.254.0.0, create no entry and count arp.invalid-sender-address.

3. toyos-net-ip/src/route.rs:163 and :132, tests/addr.rs:440-445 — set_gateways now accepts a router in 169.254/16 on a leased interface, and withdraw_off_link keeps one through any change of address — a refusal (route.gateway-off-link) turned into an acceptance, outside the brief, with no caller, pinned by a test as right. It is neither RFC's: RFC 2132 §3.5, which set_gateways cites, lists "routers on the client's subnet", and RFC 3927 §1.6 has no DHCP server configure the prefix; toyos-dhcp/src/lib.rs:298-301 refuses that router, so two crates of the stack answer one question two ways and nothing reaches the acceptance from the wire. The body names four of the predicate's readers as three: withdraw_off_link is the fourth and changed silently. The one-predicate argument does not hold: the predicate now answers "reached without a gateway" for the route and ARP, and "may be my router" for the gateways, and the RFC widened only the first. Wanted: a gateway is inside a prefix the interface holds, as before; 169.254.0.1 is refused route.gateway-off-link, in s_ip_rte_005's list or beside it; the six lines of addr.rs that set it go. If the orchestrator rules the other way, the ruling goes in the body as his, and the test delivers it from the node's DHCP path or it has no reader.

NOTE

4. issues/toyos-has-its-own-network-stack.md:46, the four new tests' names — the track's first paragraph: "The specifications live outside the tree; every test names its scenario id, and the review checks each scenario has one." They are the orchestrator's to hand over, and a writer briefed without them cannot meet the rule. Before this lands: the orchestrator gives the implementer the readers' IP specification's routing, ARP and neighbour sections; each of the four tests takes the id of the scenario that holds it; where none does (169.254/16 on a routable interface likely has none, the per-neighbour queue may be NUD-04's or NUD-05's neighbour), the readers add the scenario and the test takes its id, or the line stays with the scenario's absence stated as measured rather than supposed. The line as written records a guess: "The track line says the tests carry no id, not that no scenario exists."

5. issues/toyos-has-its-own-network-stack.md:51 — the line for a 169.254/16 source to a routable destination is true by reading (route.rs:101), with three defects. It is held by no test, where H::assign(if0, 169.254.x.y, 16, …) with a gateway reaches the case in a host test today, as the track's other present-state lines name the test that holds them. "Handed to the router" is the case with a gateway; with none the datagram is refused route.none, which is not §2.6.2's "ARP for everything" either, and the line does not say so. Its exit waits on "the stage that gives an interface a link-local address", which is no stage the track lists. The exit itself is a test and is readable.

6. toyos-net-ip/tests/addr.rs:474, userland/netstack/node/tests/name.rs:234 — the asker's ARP reply is sent in a frame to our MAC, where RFC 3927 §2.5 has a host send every ARP packet with a link-local sender, replies included, to the link broadcast. The script should be what the RFC's host sends. No blind spot follows: s_ip_nbr_015_a_broadcast_reply_is_still_solicited holds the path.

7. PR comment, negative controls — the four mutations are the right ones and their patches are whole: m0 is the source reverted with the tests kept, m1 to m3 each remove one reader. What the record carries is each run's exit and its FAILED lines, which Evidence does not take, plus the assertion text of the node test under m0, m1 and m3 and of the nud.rs scenario under m2, which it does. Missing: each mutation's log and the green arm's log at the head, where a reviewer can read them, and the assertion each of the three rfc_3927 tests failed on.

8. Prose, one line: the body and the track cite §7 for "never to a router", which is §2.6.2's own last sentence and §2.7 (§7 binds routers); the body's "creates an entry only as a request for one of our addresses" omits the entries our own answers make (an echo reply, a port unreachable or an mDNS answer to a link-local source now creates INCOMPLETE on the link, where it went to the router's one entry).

Asked

• RFC 3927. §2.6.2's first rule (ARP for a 169.254/16 destination, whatever address is held, never a router) is the RFC's and the route arm meets it for every address but the two of BLOCKER 2. §2.7 and §2.8 ask nothing more of a host that holds a routable address: [ip] forwards nothing, and answers ARP only for its own addresses. Not met: §2.6.2's second rule (a link-local source to a routable destination), recorded, see NOTE 5; and §2.5's broadcast of our own ARP packets once an interface holds a link-local address, which no line records and which is owed with that same stage.
• The widened ARP reader. An entry for a link-local address is used only for datagrams to that address, the gateway case of BLOCKER 3 apart. The table's bound is unchanged at 512, and entries in use are never evicted. What is new on a /24: the table could not fill from the wire before (253 senders pass on_link), and now can. A host cycling link-local senders that ask for our address makes STALE entries newer than every idle real one, so make_room evicts the leased prefix's STALE entries first, the router's among them once it idles; the cost is a re-resolution on the next send, and a send always finds room because the flood's entries are STALE too. Pings from link-local sources make at most PENDING_TOTAL INCOMPLETE entries at a time and then refuse every new resolution nb.pending-full for 3 s; that was already reachable from any prefix with 64 unused addresses. Every lease of /16 or shorter had both exposures. No BLOCKER; the body's paragraph should say it.
• The node test is a test of [ip]. Its first assertion is over every frame after the query and finds only the node's own request for the asker, so a route by the router fails there whether or not the router is resolved; the answer's link destination can only come from the reply's sender MAC through [ip]'s entry. The test scripts one frame, the asker's reply, see NOTE 6.
• host at the landing head. The host check concluded success, not skipped, on the exact commit that lands, from cargo run -- --ci host exit 0, and again in the merge queue. On this head it would close BLOCKER 1 and the orchestrator could read it himself; BLOCKERs 2 and 3 change source, so the head that lands is a new one and is reviewed again.
• toyos-net-node: streams, a connection of the own stack's bridged to its client's two pipes (stage D) #775 and toyos-net-node: listeners on the own stack's accept queue, and one bound on the streams, listeners and datagram sockets clients make the node hold (stage E) #777. git merge-tree --write-tree c9bbdb5f4 origin/wt/toyos-ownstack-d exits 0 at 49e38ca4a: clean, the track's hunks apart from each other and no shared test file. Against origin/wt/toyos-ownstack-e at 643584d4b it conflicts in the track and in userland/netstack/node/src/lib.rs, and so does that branch against origin/main alone (its base is 35d35859e, before toyos-net-node: the resolver on ToyOS's own UDP, host-tested and shipped in nothing #774): the conflicts are toyos-net-node: listeners on the own stack's accept queue, and one bound on the streams, listeners and datagram sockets clients make the node hold (stage E) #777's with toyos-net-node: the resolver on ToyOS's own UDP, host-tested and shipped in nothing #774, and this branch touches neither node/src/lib.rs nor a test file toyos-net-node: listeners on the own stack's accept queue, and one bound on the streams, listeners and datagram sockets clients make the node hold (stage E) #777 touches but through common::arp, whose signature is the same on both.

SEND BACK

[Japabu]

Round 2 negative controls at 6b14a7f4d. Each patch applies with git apply --recount at that head. Each run's whole log is round 2's step of the number given, in the orchestrator's scratchpad: the command on its first line, the exit code on its last.

The script ($1 the worktree, $2 the patches, $3 the logs):

#!/bin/sh
# Applies each mutation as a checked patch, runs the tests, records the exit, restores, and
# refuses a tree that is not clean before or after. $1: the worktree, $2: the patches, $3: the logs.
W=$1; M=$2; L=$3
cd "$W" || exit 2
[ -z "$(git status --porcelain)" ] || { echo "tree not clean"; exit 2; }
echo "head $(git rev-parse HEAD)"
n=10
for patch in "$M"/m*.patch; do
    name=$(basename "$patch" .patch)
    log="$L/$n-mutation-$name.log"
    git apply --recount --check "$patch" || { echo "$name: patch does not apply"; exit 2; }
    git apply --recount "$patch"
    echo '$ cargo test --locked --no-fail-fast -p toyos-net-ip -p toyos-net-node' > "$log"
    cargo test --locked --no-fail-fast -p toyos-net-ip -p toyos-net-node >> "$log" 2>&1
    rc=$?
    echo "EXIT=$rc" >> "$log"
    echo "$name EXIT=$rc"
    git apply --recount -R "$patch" || { echo "$name: restore failed"; exit 2; }
    [ -z "$(git status --porcelain)" ] || { echo "$name: tree not clean after restore"; exit 2; }
    n=$((n+1))
done
echo "tree clean"

Its output, step 09 (exit 0):

head 6b14a7f4d21cdd60d94bbce5d4b9ec66f1252586
m0-whole-source-change-reverted EXIT=101
m0b-source-as-reviewed-in-round-1 EXIT=101
m1-route-arm-removed EXIT=101
m2-neighbour-queue-global EXIT=101
m3-arp-reads-prefixes-only EXIT=101
m4a-an-edge-is-a-neighbour EXIT=101
m4b-an-edge-is-a-sender EXIT=101
m5-gateways-read-the-wide-predicate EXIT=101
m6-an-edge-goes-to-the-router EXIT=101
tree clean

Step 10, m0-whole-source-change-reverted

diff --git a/toyos-net-ip/src/arp.rs b/toyos-net-ip/src/arp.rs
index 08a6093b8..4c7236053 100644
--- a/toyos-net-ip/src/arp.rs
+++ b/toyos-net-ip/src/arp.rs
@@ -1,6 +1,6 @@
 //! ARP reception: the sender's MAC and address are checked, then the packet classified, in
 //! `receive`'s order. Only our own
-//! need to send, and a request for one of our addresses from a neighbour, create an entry;
+//! need to send, and a request for one of our addresses from an on-link host, create an entry;
 //! any other packet can confirm, assert a MAC into STALE, or be ignored, and a MAC change is
 //! always logged.
 
@@ -9,7 +9,7 @@ use toyos_net_wire::arp::{Arp, Operation};
 use toyos_net_wire::ethernet::MacClass;
 
 use crate::counters::Counter;
-use crate::iface::{link_local_edge, Cx, Interface};
+use crate::iface::{Cx, Interface};
 use crate::{acd, egress, nud};
 
 pub(crate) fn receive(i: &mut Interface, cx: &mut Cx<'_>, arp: &Arp) {
@@ -24,7 +24,7 @@ pub(crate) fn receive(i: &mut Interface, cx: &mut Cx<'_>, arp: &Arp) {
     if mac == i.mac.get() {
         return cx.log.count(Counter::ArpOwnSender);
     }
-    if link_local_edge(sender) || i.usable().any(|a| a.cidr.is_edge(sender)) {
+    if i.usable().any(|a| a.cidr.is_edge(sender)) {
         return cx.log.count(Counter::ArpInvalidSenderAddress);
     }
     if !probe && i.owns(sender) {
@@ -36,7 +36,7 @@ pub(crate) fn receive(i: &mut Interface, cx: &mut Cx<'_>, arp: &Arp) {
     let for_us = arp.operation == Operation::Request && i.is_usable(target);
     let mut noticed = for_us;
     if !probe {
-        if !i.is_neighbour(sender) {
+        if !i.on_link(sender) {
             cx.log.count(Counter::ArpSenderOffLink);
             noticed = true;
         } else if i.neighbours.contains_key(&sender) {
diff --git a/toyos-net-ip/src/iface.rs b/toyos-net-ip/src/iface.rs
index 4a6f3d038..148ac72e3 100644
--- a/toyos-net-ip/src/iface.rs
+++ b/toyos-net-ip/src/iface.rs
@@ -50,11 +50,6 @@ impl Cx<'_> {
     }
 }
 
-/// The network or the broadcast address of 169.254/16: no host's, on any interface.
-pub(crate) const fn link_local_edge(addr: Ipv4Addr) -> bool {
-    matches!(addr.octets(), [169, 254, 0, 0] | [169, 254, 255, 255])
-}
-
 impl Interface {
     pub fn usable(&self) -> impl Iterator<Item = &Address> + '_ {
         self.addresses.iter().filter(|a| a.usable())
@@ -73,12 +68,6 @@ impl Interface {
         self.usable().any(|a| a.cidr.contains(addr))
     }
 
-    /// Reached without a gateway: on the link, or a host of 169.254/16, which is this link's
-    /// whatever address the interface holds (RFC 3927 §2.6.2).
-    pub fn is_neighbour(&self, addr: Ipv4Addr) -> bool {
-        self.on_link(addr) || (addr.is_link_local() && !link_local_edge(addr) && self.usable().next().is_some())
-    }
-
     /// A usable address whose prefix holds `toward`, else the first usable one.
     pub fn source_for(&self, toward: Ipv4Addr) -> Option<Ipv4Addr> {
         self.usable().find(|a| a.cidr.contains(toward)).or_else(|| self.usable().next()).map(|a| a.cidr.addr())
diff --git a/toyos-net-ip/src/route.rs b/toyos-net-ip/src/route.rs
index fc0565490..79f1f91a0 100644
--- a/toyos-net-ip/src/route.rs
+++ b/toyos-net-ip/src/route.rs
@@ -1,8 +1,7 @@
 //! The host routing table: the connected prefixes of usable addresses and an ordered list of
-//! on-link gateways per interface; longest prefix first, then 169.254/16 on the link itself (RFC
-//! 3927 §2.6.2), then the active gateway, and no forwarding. A lookup considers only interfaces
-//! that are up, and with a bound source only the interface holding it (RFC 1122 §3.3.4.2, the
-//! strong model).
+//! on-link gateways per interface; longest prefix first, then the active gateway, and no
+//! forwarding. A lookup considers only interfaces that are up, and with a bound source only the
+//! interface holding it (RFC 1122 §3.3.4.2, the strong model).
 
 use core::net::Ipv4Addr;
 
@@ -93,12 +92,6 @@ pub(crate) fn lookup(ifaces: &[Interface], destination: Ipv4Addr, source: Source
         let next_hop = if cidr.broadcast() == Some(destination) { NextHop::Broadcast } else { NextHop::Neighbour(destination) };
         return Ok(Route { iface: IfIndex(index), next_hop, source: pick_source(i, destination)? });
     }
-    // RFC 3927 §2.6.2, §2.7: a host of 169.254/16 is resolved and sent to on the link itself, and
-    // nothing to that prefix is a router's: not its two edges either, which are no host.
-    if destination.is_link_local() {
-        let (index, i) = candidates().find(|(_, i)| i.is_neighbour(destination)).ok_or(Counter::RouteNone)?;
-        return Ok(Route { iface: IfIndex(index), next_hop: NextHop::Neighbour(destination), source: pick_source(i, destination)? });
-    }
     let (index, i, gateway) = candidates().find_map(|(index, i)| i.active.map(|g| (index, i, g))).ok_or(Counter::RouteNone)?;
     Ok(Route { iface: IfIndex(index), next_hop: NextHop::Neighbour(gateway), source: pick_source(i, gateway)? })
 }

Failed assertions, from its log (thread ids removed, long payloads cut):

test rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination ... FAILED
test rfc_3927_2_6_2_a_link_local_destination_is_on_the_link ... FAILED
test rfc_3927_2_6_2_a_datagram_to_a_link_local_host_is_resolved_and_sent_to_it ... FAILED
test result: FAILED. 33 passed; 3 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test rfc_3927_2_6_2_a_link_local_sender_is_a_neighbour ... FAILED
test rfc_3927_the_edges_of_the_link_local_prefix_are_no_senders ... FAILED
test result: FAILED. 21 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s
test an_answer_to_a_link_local_asker_goes_to_its_own_link_address ... FAILED
test result: FAILED. 12 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
thread 'rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination' panicked at toyos-net-ip/tests/addr.rs:485:9:
assertion `left == right` failed: 169.254.0.0
  left: Ok(Route { iface: IfIndex(0), next_hop: Neighbour(192.0.2.254), source: 192.0.2.1 })
 right: Err(RouteNone)
thread 'rfc_3927_2_6_2_a_link_local_destination_is_on_the_link' panicked at toyos-net-ip/tests/addr.rs:434:5:
assertion `left == right` failed: with a routable address and a router
  left: Ok(Route { iface: IfIndex(0), next_hop: Neighbour(192.0.2.254), source: 192.0.2.1 })
 right: Ok(Route { iface: IfIndex(0), next_hop: Neighbour(169.254.3.4), source: 192.0.2.1 })
thread 'rfc_3927_2_6_2_a_datagram_to_a_link_local_host_is_resolved_and_sent_to_it' panicked at toyos-net-ip/tests/addr.rs:461:5:
assertion `left == right` failed
  left: Ok(Some([2, 0, 0, 0, 0, 254, 2, 0, 0, 0, 0, 10, 8, 0, 69, 0, 0, 30, 0, 0, 64, 0, 64, 17, 203, 203, 192, 0, 2, 1, 169, 254, 3, 4, 19, 137, 19, 137, 0, 10, 1, 91, 104, 105, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]))
 right: Ok(None)
thread 'rfc_3927_2_6_2_a_link_local_sender_is_a_neighbour' panicked at toyos-net-ip/tests/nbr.rs:168:5:
assertion failed: h.is_stale(asker)
thread 'rfc_3927_the_edges_of_the_link_local_prefix_are_no_senders' panicked at toyos-net-ip/tests/nbr.rs:188:9:
assertion `left == right` failed: 169.254.0.0
  left: 0
 right: 2
thread 'an_answer_to_a_link_local_asker_goes_to_its_own_link_address' panicked at userland/netstack/node/tests/name.rs:234:5:
assertion `left == right` failed: the asker is asked for, and nothing is the router's
  left: [Arp { request: true, sender: 192.0.2.1, target: 192.0.2.254 }, Udp(Udp { to: [2, 0, 0, 0, 0, 254], source: 192.0.2.1, source_port: 5353, destination: 169.254.3.4, port: 53000, ttl: 255, payload: [0, 5, 132, 0, 0, 1, 0, 1, 0, 0, 0, 0, 5, 116, 111, 121, 111, 115, 5, 108, 111, 99, 97, 108, 0, 0, 1, 0, 1, 5, 116, 111, 121, 
 right: [Arp { request: true, sender: 192.0.2.1, target: 169.254.3.4 }]
EXIT=101

Step 11, m0b-source-as-reviewed-in-round-1

diff --git a/toyos-net-ip/src/arp.rs b/toyos-net-ip/src/arp.rs
index 08a6093b8..4c7236053 100644
--- a/toyos-net-ip/src/arp.rs
+++ b/toyos-net-ip/src/arp.rs
@@ -1,6 +1,6 @@
 //! ARP reception: the sender's MAC and address are checked, then the packet classified, in
 //! `receive`'s order. Only our own
-//! need to send, and a request for one of our addresses from a neighbour, create an entry;
+//! need to send, and a request for one of our addresses from an on-link host, create an entry;
 //! any other packet can confirm, assert a MAC into STALE, or be ignored, and a MAC change is
 //! always logged.
 
@@ -9,7 +9,7 @@ use toyos_net_wire::arp::{Arp, Operation};
 use toyos_net_wire::ethernet::MacClass;
 
 use crate::counters::Counter;
-use crate::iface::{link_local_edge, Cx, Interface};
+use crate::iface::{Cx, Interface};
 use crate::{acd, egress, nud};
 
 pub(crate) fn receive(i: &mut Interface, cx: &mut Cx<'_>, arp: &Arp) {
@@ -24,7 +24,7 @@ pub(crate) fn receive(i: &mut Interface, cx: &mut Cx<'_>, arp: &Arp) {
     if mac == i.mac.get() {
         return cx.log.count(Counter::ArpOwnSender);
     }
-    if link_local_edge(sender) || i.usable().any(|a| a.cidr.is_edge(sender)) {
+    if i.usable().any(|a| a.cidr.is_edge(sender)) {
         return cx.log.count(Counter::ArpInvalidSenderAddress);
     }
     if !probe && i.owns(sender) {
@@ -36,7 +36,7 @@ pub(crate) fn receive(i: &mut Interface, cx: &mut Cx<'_>, arp: &Arp) {
     let for_us = arp.operation == Operation::Request && i.is_usable(target);
     let mut noticed = for_us;
     if !probe {
-        if !i.is_neighbour(sender) {
+        if !i.on_link(sender) {
             cx.log.count(Counter::ArpSenderOffLink);
             noticed = true;
         } else if i.neighbours.contains_key(&sender) {
diff --git a/toyos-net-ip/src/iface.rs b/toyos-net-ip/src/iface.rs
index 4a6f3d038..b3d126daf 100644
--- a/toyos-net-ip/src/iface.rs
+++ b/toyos-net-ip/src/iface.rs
@@ -50,11 +50,6 @@ impl Cx<'_> {
     }
 }
 
-/// The network or the broadcast address of 169.254/16: no host's, on any interface.
-pub(crate) const fn link_local_edge(addr: Ipv4Addr) -> bool {
-    matches!(addr.octets(), [169, 254, 0, 0] | [169, 254, 255, 255])
-}
-
 impl Interface {
     pub fn usable(&self) -> impl Iterator<Item = &Address> + '_ {
         self.addresses.iter().filter(|a| a.usable())
@@ -68,15 +63,10 @@ impl Interface {
         self.addresses.iter().any(|a| a.cidr.addr() == addr)
     }
 
-    /// Inside the prefix of a usable address: reachable without a gateway.
+    /// Reachable without a gateway: inside the prefix of a usable address, or in 169.254/16,
+    /// which is this link's whatever address the interface holds (RFC 3927 §2.6.2).
     pub fn on_link(&self, addr: Ipv4Addr) -> bool {
-        self.usable().any(|a| a.cidr.contains(addr))
-    }
-
-    /// Reached without a gateway: on the link, or a host of 169.254/16, which is this link's
-    /// whatever address the interface holds (RFC 3927 §2.6.2).
-    pub fn is_neighbour(&self, addr: Ipv4Addr) -> bool {
-        self.on_link(addr) || (addr.is_link_local() && !link_local_edge(addr) && self.usable().next().is_some())
+        self.usable().any(|a| addr.is_link_local() || a.cidr.contains(addr))
     }
 
     /// A usable address whose prefix holds `toward`, else the first usable one.
diff --git a/toyos-net-ip/src/route.rs b/toyos-net-ip/src/route.rs
index fc0565490..1437347d7 100644
--- a/toyos-net-ip/src/route.rs
+++ b/toyos-net-ip/src/route.rs
@@ -93,10 +93,9 @@ pub(crate) fn lookup(ifaces: &[Interface], destination: Ipv4Addr, source: Source
         let next_hop = if cidr.broadcast() == Some(destination) { NextHop::Broadcast } else { NextHop::Neighbour(destination) };
         return Ok(Route { iface: IfIndex(index), next_hop, source: pick_source(i, destination)? });
     }
-    // RFC 3927 §2.6.2, §2.7: a host of 169.254/16 is resolved and sent to on the link itself, and
-    // nothing to that prefix is a router's: not its two edges either, which are no host.
-    if destination.is_link_local() {
-        let (index, i) = candidates().find(|(_, i)| i.is_neighbour(destination)).ok_or(Counter::RouteNone)?;
+    // On the link with no prefix holding it is 169.254/16: resolved and sent to directly, and
+    // never handed to a router (RFC 3927 §2.6.2, §7).
+    if let Some((index, i)) = candidates().find(|(_, i)| i.on_link(destination)) {
         return Ok(Route { iface: IfIndex(index), next_hop: NextHop::Neighbour(destination), source: pick_source(i, destination)? });
     }
     let (index, i, gateway) = candidates().find_map(|(index, i)| i.active.map(|g| (index, i, g))).ok_or(Counter::RouteNone)?;

Failed assertions, from its log (thread ids removed, long payloads cut):

test rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination ... FAILED
test rfc_3927_a_link_local_address_is_no_gateway_of_a_routable_interface ... FAILED
test result: FAILED. 34 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test rfc_3927_the_edges_of_the_link_local_prefix_are_no_senders ... FAILED
test result: FAILED. 22 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
thread 'rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination' panicked at toyos-net-ip/tests/addr.rs:485:9:
assertion `left == right` failed: 169.254.0.0
  left: Ok(Route { iface: IfIndex(0), next_hop: Neighbour(169.254.0.0), source: 192.0.2.1 })
 right: Err(RouteNone)
thread 'rfc_3927_a_link_local_address_is_no_gateway_of_a_routable_interface' panicked at toyos-net-ip/tests/addr.rs:503:5:
assertion `left == right` failed
  left: Ok(())
 right: Err(RouteGatewayOffLink)
thread 'rfc_3927_the_edges_of_the_link_local_prefix_are_no_senders' panicked at toyos-net-ip/tests/nbr.rs:188:9:
assertion `left == right` failed: 169.254.0.0
  left: 0
 right: 2
EXIT=101

Step 12, m1-route-arm-removed

--- a/toyos-net-ip/src/route.rs
+++ b/toyos-net-ip/src/route.rs
@@ -93,12 +93,6 @@ pub(crate) fn lookup(ifaces: &[Interface], destination: Ipv4Addr, source: Source
         let next_hop = if cidr.broadcast() == Some(destination) { NextHop::Broadcast } else { NextHop::Neighbour(destination) };
         return Ok(Route { iface: IfIndex(index), next_hop, source: pick_source(i, destination)? });
     }
-    // RFC 3927 §2.6.2, §2.7: a host of 169.254/16 is resolved and sent to on the link itself, and
-    // nothing to that prefix is a router's: not its two edges either, which are no host.
-    if destination.is_link_local() {
-        let (index, i) = candidates().find(|(_, i)| i.is_neighbour(destination)).ok_or(Counter::RouteNone)?;
-        return Ok(Route { iface: IfIndex(index), next_hop: NextHop::Neighbour(destination), source: pick_source(i, destination)? });
-    }
     let (index, i, gateway) = candidates().find_map(|(index, i)| i.active.map(|g| (index, i, g))).ok_or(Counter::RouteNone)?;
     Ok(Route { iface: IfIndex(index), next_hop: NextHop::Neighbour(gateway), source: pick_source(i, gateway)? })
 }

Failed assertions, from its log (thread ids removed, long payloads cut):

test rfc_3927_2_6_2_a_link_local_destination_is_on_the_link ... FAILED
test rfc_3927_2_6_2_a_datagram_to_a_link_local_host_is_resolved_and_sent_to_it ... FAILED
test rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination ... FAILED
test result: FAILED. 33 passed; 3 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test an_answer_to_a_link_local_asker_goes_to_its_own_link_address ... FAILED
test result: FAILED. 12 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
thread 'rfc_3927_2_6_2_a_link_local_destination_is_on_the_link' panicked at toyos-net-ip/tests/addr.rs:434:5:
assertion `left == right` failed: with a routable address and a router
  left: Ok(Route { iface: IfIndex(0), next_hop: Neighbour(192.0.2.254), source: 192.0.2.1 })
 right: Ok(Route { iface: IfIndex(0), next_hop: Neighbour(169.254.3.4), source: 192.0.2.1 })
thread 'rfc_3927_2_6_2_a_datagram_to_a_link_local_host_is_resolved_and_sent_to_it' panicked at toyos-net-ip/tests/addr.rs:461:5:
assertion `left == right` failed
  left: Ok(Some([2, 0, 0, 0, 0, 254, 2, 0, 0, 0, 0, 10, 8, 0, 69, 0, 0, 30, 0, 0, 64, 0, 64, 17, 203, 203, 192, 0, 2, 1, 169, 254, 3, 4, 19, 137, 19, 137, 0, 10, 1, 91, 104, 105, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]))
 right: Ok(None)
thread 'rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination' panicked at toyos-net-ip/tests/addr.rs:485:9:
assertion `left == right` failed: 169.254.0.0
  left: Ok(Route { iface: IfIndex(0), next_hop: Neighbour(192.0.2.254), source: 192.0.2.1 })
 right: Err(RouteNone)
thread 'an_answer_to_a_link_local_asker_goes_to_its_own_link_address' panicked at userland/netstack/node/tests/name.rs:234:5:
assertion `left == right` failed: the asker is asked for, and nothing is the router's
  left: [Arp { request: true, sender: 192.0.2.1, target: 192.0.2.254 }, Udp(Udp { to: [2, 0, 0, 0, 0, 254], source: 192.0.2.1, source_port: 5353, destination: 169.254.3.4, port: 53000, ttl: 255, payload: [0, 5, 132, 0, 0, 1, 0, 1, 0, 0, 0, 0, 5, 116, 111, 121, 111, 115, 5, 108, 111, 99, 97, 108, 0, 0, 1, 0, 1, 5, 116, 111, 121, 
 right: [Arp { request: true, sender: 192.0.2.1, target: 169.254.3.4 }]
EXIT=101

Step 13, m2-neighbour-queue-global

--- a/toyos-net-ip/src/nud.rs
+++ b/toyos-net-ip/src/nud.rs
@@ -395,13 +395,22 @@ pub(crate) fn send(i: &mut Interface, cx: &mut Cx<'_>, addr: Ipv4Addr, hint: Opt
     }
 }
 
-/// Holds a frame for an INCOMPLETE neighbour; the queue keeps the newest (RFC 4861 §7.2.2).
+/// MUTATION: one queue of PENDING_PER_NEIGHBOUR for the whole interface, whose oldest datagram
+/// goes whichever neighbour it waits for.
 pub(crate) fn hold(i: &mut Interface, cx: &mut Cx<'_>, addr: Ipv4Addr, held: Held) {
-    let Some(Nud::Incomplete(s)) = i.neighbours.get_mut(&addr).map(|n| &mut n.state) else { return };
-    if s.pending.push(held).is_some() {
-        i.held = i.held.saturating_sub(1);
-        cx.log.count(Counter::NbPendingOverflow);
+    if !matches!(i.neighbours.get(&addr).map(|n| &n.state), Some(Nud::Incomplete(_))) {
+        return;
+    }
+    if i.held >= PENDING_PER_NEIGHBOUR {
+        let oldest = i.neighbours.values_mut().find_map(|n| match &mut n.state {
+            Nud::Incomplete(s) => s.pending.0.pop_front(),
+            _ => None,
+        });
+        if oldest.is_some() {
+            i.held = i.held.saturating_sub(1);
+            cx.log.count(Counter::NbPendingOverflow);
+        }
     }
+    let Some(Nud::Incomplete(s)) = i.neighbours.get_mut(&addr).map(|n| &mut n.state) else { return };
+    s.pending.0.push_back(held);
     i.held = i.held.saturating_add(1);
 }
 

Failed assertions, from its log (thread ids removed, long payloads cut):

test rfc_4861_7_2_2_a_silent_next_hop_holds_up_no_other ... FAILED
test s_ip_nud_005_the_interface_holds_at_most_64 ... FAILED
test s_ip_nud_029_released_datagrams_are_evicted_last ... FAILED
test result: FAILED. 32 passed; 3 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s
thread 'rfc_4861_7_2_2_a_silent_next_hop_holds_up_no_other' panicked at toyos-net-ip/tests/nud.rs:907:5:
assertion `left == right` failed: B's datagrams wait in B's queue, and R's full one drops none of them
  left: 9
 right: 1
thread 's_ip_nud_005_the_interface_holds_at_most_64' panicked at toyos-net-ip/tests/nud.rs:89:5:
assertion `left == right` failed
  left: Ok(None)
 right: Err(NbPendingFull)
thread 's_ip_nud_029_released_datagrams_are_evicted_last' panicked at toyos-net-ip/tests/nud.rs:669:13:
assertion `left == right` failed
  left: 0
 right: 1
EXIT=101

Step 14, m3-arp-reads-prefixes-only

--- a/toyos-net-ip/src/arp.rs
+++ b/toyos-net-ip/src/arp.rs
@@ -36,7 +36,7 @@ pub(crate) fn receive(i: &mut Interface, cx: &mut Cx<'_>, arp: &Arp) {
     let for_us = arp.operation == Operation::Request && i.is_usable(target);
     let mut noticed = for_us;
     if !probe {
-        if !i.is_neighbour(sender) {
+        if !i.on_link(sender) {
             cx.log.count(Counter::ArpSenderOffLink);
             noticed = true;
         } else if i.neighbours.contains_key(&sender) {

Failed assertions, from its log (thread ids removed, long payloads cut):

test rfc_3927_2_6_2_a_datagram_to_a_link_local_host_is_resolved_and_sent_to_it ... FAILED
test result: FAILED. 35 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test rfc_3927_2_6_2_a_link_local_sender_is_a_neighbour ... FAILED
test result: FAILED. 22 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test an_answer_to_a_link_local_asker_goes_to_its_own_link_address ... FAILED
test result: FAILED. 12 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
thread 'rfc_3927_2_6_2_a_datagram_to_a_link_local_host_is_resolved_and_sent_to_it' panicked at toyos-net-ip/tests/addr.rs:468:5:
assertion failed: h.is_reachable(LINK_LOCAL)
thread 'rfc_3927_2_6_2_a_link_local_sender_is_a_neighbour' panicked at toyos-net-ip/tests/nbr.rs:168:5:
assertion failed: h.is_stale(asker)
thread 'an_answer_to_a_link_local_asker_goes_to_its_own_link_address' panicked at userland/netstack/node/tests/name.rs:238:5:
assertion `left == right` failed
  left: []
 right: [Udp { to: [2, 0, 0, 0, 0, 11], source: 192.0.2.1, source_port: 5353, destination: 169.254.3.4, port: 53000, ttl: 255, payload: [0, 5, 132, 0, 0, 1, 0, 1, 0, 0, 0, 0, 5, 116, 111, 121, 111, 115, 5, 108, 111, 99, 97, 108, 0, 0, 1, 0, 1, 5, 116, 111, 121, 111, 115, 5, 108, 111, 99, 97, 108, 0, 0, 1, 0, 1, 0, 0, 0, 10, 0, 4
EXIT=101

Step 15, m4a-an-edge-is-a-neighbour

--- a/toyos-net-ip/src/iface.rs
+++ b/toyos-net-ip/src/iface.rs
@@ -75,7 +75,7 @@ impl Interface {
     /// Reached without a gateway: on the link, or a host of 169.254/16, which is this link's
     /// whatever address the interface holds (RFC 3927 §2.6.2).
     pub fn is_neighbour(&self, addr: Ipv4Addr) -> bool {
-        self.on_link(addr) || (addr.is_link_local() && !link_local_edge(addr) && self.usable().next().is_some())
+        self.on_link(addr) || (addr.is_link_local() && self.usable().next().is_some())
     }
 
     /// A usable address whose prefix holds `toward`, else the first usable one.

Failed assertions, from its log (thread ids removed, long payloads cut):

test rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination ... FAILED
test result: FAILED. 35 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
thread 'rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination' panicked at toyos-net-ip/tests/addr.rs:485:9:
assertion `left == right` failed: 169.254.0.0
  left: Ok(Route { iface: IfIndex(0), next_hop: Neighbour(169.254.0.0), source: 192.0.2.1 })
 right: Err(RouteNone)
EXIT=101

Step 16, m4b-an-edge-is-a-sender

--- a/toyos-net-ip/src/arp.rs
+++ b/toyos-net-ip/src/arp.rs
@@ -24,7 +24,7 @@ pub(crate) fn receive(i: &mut Interface, cx: &mut Cx<'_>, arp: &Arp) {
     if mac == i.mac.get() {
         return cx.log.count(Counter::ArpOwnSender);
     }
-    if link_local_edge(sender) || i.usable().any(|a| a.cidr.is_edge(sender)) {
+    if i.usable().any(|a| a.cidr.is_edge(sender)) {
         return cx.log.count(Counter::ArpInvalidSenderAddress);
     }
     if !probe && i.owns(sender) {

Failed assertions, from its log (thread ids removed, long payloads cut):

test rfc_3927_the_edges_of_the_link_local_prefix_are_no_senders ... FAILED
test result: FAILED. 22 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
thread 'rfc_3927_the_edges_of_the_link_local_prefix_are_no_senders' panicked at toyos-net-ip/tests/nbr.rs:188:9:
assertion `left == right` failed: 169.254.0.0
  left: 0
 right: 2
EXIT=101

Step 17, m5-gateways-read-the-wide-predicate

--- a/toyos-net-ip/src/route.rs
+++ b/toyos-net-ip/src/route.rs
@@ -160,7 +160,7 @@ impl Ip {
                     Some(Counter::RouteGatewayInvalid)
                 } else if local.contains(&g) {
                     Some(Counter::RouteGatewayIsLocal)
-                } else if !i.on_link(g) {
+                } else if !i.is_neighbour(g) {
                     Some(Counter::RouteGatewayOffLink)
                 } else {
                     None

Failed assertions, from its log (thread ids removed, long payloads cut):

test rfc_3927_a_link_local_address_is_no_gateway_of_a_routable_interface ... FAILED
test result: FAILED. 35 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
thread 'rfc_3927_a_link_local_address_is_no_gateway_of_a_routable_interface' panicked at toyos-net-ip/tests/addr.rs:503:5:
assertion `left == right` failed
  left: Ok(())
 right: Err(RouteGatewayOffLink)
EXIT=101

Step 18, m6-an-edge-goes-to-the-router

--- a/toyos-net-ip/src/route.rs
+++ b/toyos-net-ip/src/route.rs
@@ -95,8 +95,7 @@ pub(crate) fn lookup(ifaces: &[Interface], destination: Ipv4Addr, source: Source
     }
     // RFC 3927 §2.6.2, §2.7: a host of 169.254/16 is resolved and sent to on the link itself, and
     // nothing to that prefix is a router's: not its two edges either, which are no host.
-    if destination.is_link_local() {
-        let (index, i) = candidates().find(|(_, i)| i.is_neighbour(destination)).ok_or(Counter::RouteNone)?;
+    if let Some((index, i)) = candidates().find(|(_, i)| i.is_neighbour(destination)) {
         return Ok(Route { iface: IfIndex(index), next_hop: NextHop::Neighbour(destination), source: pick_source(i, destination)? });
     }
     let (index, i, gateway) = candidates().find_map(|(index, i)| i.active.map(|g| (index, i, g))).ok_or(Counter::RouteNone)?;

Failed assertions, from its log (thread ids removed, long payloads cut):

test rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination ... FAILED
test result: FAILED. 35 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
thread 'rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination' panicked at toyos-net-ip/tests/addr.rs:485:9:
assertion `left == right` failed: 169.254.0.0
  left: Ok(Route { iface: IfIndex(0), next_hop: Neighbour(192.0.2.254), source: 192.0.2.1 })
 right: Err(RouteNone)
EXIT=101

[Japabu]

Review of wt/toyos-move-ip at 6b14a7f4d against origin/main at a4416fe6c, round 2. Read only: no build, no test. Read for this round: git diff c9bbdb5f4 6b14a7f4d, the four source files whole at the head, round 2's step logs 00 to 18, the round 2 patches in the comment above, and the routing, reachability and ARP reception scenarios of the readers' IP specification.

Growth: git diff --shortstat origin/main...6b14a7f4d is 8 files, +232 −19. Production +25 −7 (iface.rs +11, route.rs +10 −3, arp.rs +4 −4). Tests +205 −10 (toyos-net-ip/tests +188, node name.rs +17 −10). Track +2 −2. The production growth over round 1 is one constant predicate and one method, each with two readers; accepted.

Round 1, judged

1. OPEN. cargo run -- --ci host green at the head. Not run: the pull request is a draft, and host, toolchain and guest at 6b14a7f4d all concluded SKIPPED. Steps 01 to 03 (exit 0 each, head 6b14a7f4d in step 00) are a subset and no src/clippy.rs shape. Nothing else holds this open.
2. CLOSED. Step 11, c9bbdb5f4's source under this head's tests, exit 101: addr.rs:485 finds Neighbour(169.254.0.0) where route.none is wanted, nbr.rs:188 finds arp.invalid-sender-address at 0 where 2 is wanted. Step 01 at the head, exit 0, both ok. Each half is held apart: step 15 (an edge is a neighbour) and step 18 (an edge falls through to the router) red addr.rs:485, the second with Neighbour(192.0.2.254); step 16 (an edge is a sender) reds nbr.rs:188. Both loops reach both edges, the sender test with a request and a reply each, and the destination test with the router resolved, so a frame to it could have left.
3. CLOSED. set_gateways and withdraw_off_link do not appear in git diff origin/main...6b14a7f4d -- toyos-net-ip/src/route.rs, and on_link is context in iface.rs's hunk. Step 11 and step 17 (the gateways read the wide predicate) both red addr.rs:503, Ok(()) where route.gateway-off-link is wanted; green at the head.
4. CLOSED. The track's line is a measurement, and it is true: the specification's routing scenarios are RTE-01 to RTE-17 and its ARP reception scenarios NBR-01 to NBR-18, 169.254 occurs nowhere in it, NBR-12's sender is 198.51.100.9, and of NUD-01 to NUD-31 none has one next hop silent while another answers (NUD-04 is one neighbour, NUD-05 eight that never answer, NUD-23 two that go with the link). The line stands under the departures, where it belongs: the lookup has an arm the specification's has not. The exit is read off the tests' names.
5. CLOSED. Both cases are named, rfc_3927_2_6_2_a_link_local_source_still_sends_by_the_router_or_nowhere holds both (ok in step 01), §2.5 is recorded as owed with it, and the exit no longer waits on a stage that is not listed: either arm of it is a test's result.
6. CLOSED. addr.rs:467 and name.rs:236 deliver the asker's reply in a frame to the link broadcast.
7. CLOSED. Each mutation's patch and failed assertion are in the round 2 comment and agree with the step logs line for line; the green arm's log is step 01.
8. CLOSED. §2.6.2 and §2.7 where §7 was, in the track, the tests and route.rs; the body carries both paragraphs.

BLOCKER

None new.

NOTE

9. toyos-net-ip/src/input.rs:87, issues/toyos-has-its-own-network-stack.md — a datagram whose source is 169.254.255.255 or 169.254.0.0 is admitted on a routable interface, and the only record of it is the pull request body — a compromise the branch found is removed or recorded in issues/ with evidence and an exit, and a body is not the tracker. Wanted before landing: one line under "What stage 3 does not yet meet", its evidence input.rs:87 reading the held prefixes' edges only, its exit a toyos-net-ip test that finds ip.invalid-source for a datagram from each edge on fixture I. The refusal itself in this branch is the other legal outcome; it changes source, and comes back for a round on that hunk and its red-first log. See "Asked" for why it is not a BLOCKER.
10. Prose, one line: the body's "the prefix's two edges are a host nowhere" does not hold on an interface whose own prefix is wider than 169.254/16 and contains it (169.255.0.5/15, an address toyos-dhcp's host passes): 169.254.255.255 is inside a connected prefix and not its edge, so route.rs:92 still resolves it as a neighbour, as on main. Nothing follows from it at this head: the reply is refused at arp.rs:27 and the entry fails at 3 s.

Asked

• Two names, two questions. Each of the four call sites asks the right one. arp.rs:39 and route.rs:99 ask "is this a host I reach without a gateway" and read is_neighbour. route.rs:164 and route.rs:133 ask "is this inside a prefix I hold", RFC 2132 §3.5's subnet, and read on_link. No fifth reader exists in toyos-net-ip, and no other crate reads either. In the route arm the on_link half of is_neighbour is always false, the connected prefixes having been taken above it; that is one predicate shared and not a second path.
• The edges, at every reader. ARP sender: refused at arp.rs:27 before anything is learned, for a request and a reply, on an interface with or without an address. ARP target: an edge is no address a lease gives us (config.rs:32 refuses it under its own /16 and toyos-dhcp refuses every 169.254/16 address), so a request for one is arp.not-for-us or asserts a sender already cached, and nothing about the target is stored. Route destination: route.none on an interface whose prefix does not hold it; NextHop::Broadcast by the connected prefix on one that holds 169.254.x.y/16, unchanged. Gateway: refused as before.
• The input path. Admitting the datagram is not right: RFC 1122 §3.2.1.3 has a host silently discard a datagram whose source is a broadcast address, and RFC 3927 §2.6.2 names 169.254.255.255 the link-local subnet's broadcast address for every host, whatever it holds; 169.254.0.0 is refused by the tree's own rule for a network address and by neither RFC's letter. RFC 3927 itself has no receive rule for either. It is not round 1's hole on the input side: that hole was a claimant gaining a neighbour entry and the datagrams held for it, and the IPv4 input path learns nothing from a source; entries are made only by arp.rs and by our own sends, and the send toward an edge is now refused before an entry exists. The admission is main's, byte for byte, and this branch narrows what follows it: the answer went to the router and is now route.none. So it is owed as a record or a refusal, NOTE 9, and not as a BLOCKER on this branch.
• host at the head that lands. The host check concluded success, not skipped, on the exact commit that lands, from cargo run -- --ci host exit 0, its log read rather than its last line, and again in the merge queue. If that commit is 6b14a7f4d, or 6b14a7f4d plus NOTE 9's track line and nothing else, BLOCKER 1 closes on that reading and the orchestrator may land without another round. Any change under toyos-net-ip/ or userland/ comes back.
• Merges. git merge-tree --write-tree 6b14a7f4d origin/main exits 0 with origin/main still at a4416fe6c, and git merge-tree --write-tree 6b14a7f4d origin/wt/toyos-ownstack-d exits 0 at 49e38ca4a.

SEND BACK

[Japabu]

Round 3 negative controls at b83237cab. m1 to m6 are round 2's patches unchanged and m0 is the same revert taken at this head; the two new patches follow. Each applies with git apply --recount at this head, by round 2's script. Each run's whole log is round 3's step of the number given, in the orchestrator's scratchpad: the command on its first line, the exit code on its last.

The script's output, step 09 (exit 0):

head b83237cabd126350990587b06b1a62587ae070ad
m0-whole-source-change-reverted EXIT=101
m0c-source-as-reviewed-in-round-2 EXIT=101
m1-route-arm-removed EXIT=101
m2-neighbour-queue-global EXIT=101
m3-arp-reads-prefixes-only EXIT=101
m4a-an-edge-is-a-neighbour EXIT=101
m4b-an-edge-is-a-sender EXIT=101
m5-gateways-read-the-wide-predicate EXIT=101
m6-an-edge-goes-to-the-router EXIT=101
m7-an-edge-is-a-source EXIT=101
tree clean

m0c-source-as-reviewed-in-round-2.patch:

diff --git a/toyos-net-ip/src/input.rs b/toyos-net-ip/src/input.rs
index bb5749451..d2769ea10 100644
--- a/toyos-net-ip/src/input.rs
+++ b/toyos-net-ip/src/input.rs
@@ -14,7 +14,7 @@ use toyos_net_wire::udp::UdpDatagram;
 use toyos_net_wire::Instant;
 
 use crate::counters::Counter;
-use crate::iface::{link_local_edge, Interface};
+use crate::iface::Interface;
 use crate::{arp, igmp, Arrival, Cast, Delivery, IfIndex, Ip, Peer};
 
 const IPV6: u16 = 0x86DD;
@@ -84,7 +84,7 @@ fn admit(ifaces: &[Interface], i: &Interface, link: MacClass, packet: &Ipv4Packe
         return Err(Counter::IpNotForUs);
     };
     let unspecified_igmp = source == Ipv4Addr::UNSPECIFIED && packet.protocol() == Protocol::Igmp;
-    if !unspecified_igmp && (!is_host(source) || link_local_edge(source) || i.usable().any(|a| a.cidr.is_edge(source))) {
+    if !unspecified_igmp && (!is_host(source) || i.usable().any(|a| a.cidr.is_edge(source))) {
         return Err(Counter::IpInvalidSource);
     }
     if ifaces.iter().any(|j| j.owns(source)) {

m7-an-edge-is-a-source.patch:

--- a/toyos-net-ip/src/input.rs
+++ b/toyos-net-ip/src/input.rs
@@ -84,7 +84,7 @@ fn admit(ifaces: &[Interface], i: &Interface, link: MacClass, packet: &Ipv4Packe
         return Err(Counter::IpNotForUs);
     };
     let unspecified_igmp = source == Ipv4Addr::UNSPECIFIED && packet.protocol() == Protocol::Igmp;
-    if !unspecified_igmp && (!is_host(source) || link_local_edge(source) || i.usable().any(|a| a.cidr.is_edge(source))) {
+    if !unspecified_igmp && (!is_host(source) || i.usable().any(|a| a.cidr.is_edge(source))) {
         return Err(Counter::IpInvalidSource);
     }
     if ifaces.iter().any(|j| j.owns(source)) {

Failed assertions at this head, from each step's log (thread ids removed, long payloads cut):

Step 10, m0-whole-source-change-reverted

test rfc_3927_2_6_2_a_link_local_destination_is_on_the_link ... FAILED
test rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination ... FAILED
test rfc_3927_the_edges_of_the_link_local_prefix_are_no_source ... FAILED
test rfc_3927_2_6_2_a_datagram_to_a_link_local_host_is_resolved_and_sent_to_it ... FAILED
test result: FAILED. 33 passed; 4 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test rfc_3927_2_6_2_a_link_local_sender_is_a_neighbour ... FAILED
test rfc_3927_the_edges_of_the_link_local_prefix_are_no_senders ... FAILED
test result: FAILED. 21 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test an_answer_to_a_link_local_asker_goes_to_its_own_link_address ... FAILED
test result: FAILED. 12 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
thread 'rfc_3927_2_6_2_a_link_local_destination_is_on_the_link' panicked at toyos-net-ip/tests/addr.rs:434:5:
assertion `left == right` failed: with a routable address and a router
  left: Ok(Route { iface: IfIndex(0), next_hop: Neighbour(192.0.2.254), source: 192.0.2.1 })
 right: Ok(Route { iface: IfIndex(0), next_hop: Neighbour(169.254.3.4), source: 192.0.2.1 })
thread 'rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination' panicked at toyos-net-ip/tests/addr.rs:485:9:
assertion `left == right` failed: 169.254.0.0
  left: Ok(Route { iface: IfIndex(0), next_hop: Neighbour(192.0.2.254), source: 192.0.2.1 })
 right: Err(RouteNone)
thread 'rfc_3927_the_edges_of_the_link_local_prefix_are_no_source' panicked at toyos-net-ip/tests/addr.rs:505:9:
assertion `left == right` failed: 169.254.0.0
  left: Some(Unicast)
 right: None
thread 'rfc_3927_2_6_2_a_datagram_to_a_link_local_host_is_resolved_and_sent_to_it' panicked at toyos-net-ip/tests/addr.rs:461:5:
assertion `left == right` failed
  left: Ok(Some([2, 0, 0, 0, 0, 254, 2, 0, 0, 0, 0, 10, 8, 0, 69, 0, 0, 30, 0, 0, 64, 0, 64, 17, 203, 203, 192, 0, 2, 1, 169, 254, 3, 4, 19, 137, 19, 137, 0, 10, 1, 91, 104, 105, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]))
 right: Ok(None)
thread 'rfc_3927_2_6_2_a_link_local_sender_is_a_neighbour' panicked at toyos-net-ip/tests/nbr.rs:168:5:
assertion failed: h.is_stale(asker)
thread 'rfc_3927_the_edges_of_the_link_local_prefix_are_no_senders' panicked at toyos-net-ip/tests/nbr.rs:188:9:
assertion `left == right` failed: 169.254.0.0
  left: 0
 right: 2
thread 'an_answer_to_a_link_local_asker_goes_to_its_own_link_address' panicked at userland/netstack/node/tests/name.rs:234:5:
assertion `left == right` failed: the asker is asked for, and nothing is the router's
  left: [Arp { request: true, sender: 192.0.2.1, target: 192.0.2.254 }, Udp(Udp { to: [2, 0, 0, 0, 0, 254], source: 192.0.2.1, source_port: 5353, destination: 169.254.3.4, port: 53000, ttl: 255, payload: [0, 5, 132, 0, 0, 1, 0, 1, 0, 0, 0, 0, 5, 116, 111, 121, 111, 115, 5, 108, 111, 99, 97, 108, 0, 0, 1, 0, 1, 5, 116, 111, 121, 
 right: [Arp { request: true, sender: 192.0.2.1, target: 169.254.3.4 }]
EXIT=101

Step 11, m0c-source-as-reviewed-in-round-2

test rfc_3927_the_edges_of_the_link_local_prefix_are_no_source ... FAILED
test result: FAILED. 36 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
thread 'rfc_3927_the_edges_of_the_link_local_prefix_are_no_source' panicked at toyos-net-ip/tests/addr.rs:505:9:
assertion `left == right` failed: 169.254.0.0
  left: Some(Unicast)
 right: None
EXIT=101

Step 12, m1-route-arm-removed

test rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination ... FAILED
test rfc_3927_2_6_2_a_datagram_to_a_link_local_host_is_resolved_and_sent_to_it ... FAILED
test rfc_3927_2_6_2_a_link_local_destination_is_on_the_link ... FAILED
test result: FAILED. 34 passed; 3 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test an_answer_to_a_link_local_asker_goes_to_its_own_link_address ... FAILED
test result: FAILED. 12 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
thread 'rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination' panicked at toyos-net-ip/tests/addr.rs:485:9:
assertion `left == right` failed: 169.254.0.0
  left: Ok(Route { iface: IfIndex(0), next_hop: Neighbour(192.0.2.254), source: 192.0.2.1 })
 right: Err(RouteNone)
thread 'rfc_3927_2_6_2_a_datagram_to_a_link_local_host_is_resolved_and_sent_to_it' panicked at toyos-net-ip/tests/addr.rs:461:5:
assertion `left == right` failed
  left: Ok(Some([2, 0, 0, 0, 0, 254, 2, 0, 0, 0, 0, 10, 8, 0, 69, 0, 0, 30, 0, 0, 64, 0, 64, 17, 203, 203, 192, 0, 2, 1, 169, 254, 3, 4, 19, 137, 19, 137, 0, 10, 1, 91, 104, 105, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]))
 right: Ok(None)
thread 'rfc_3927_2_6_2_a_link_local_destination_is_on_the_link' panicked at toyos-net-ip/tests/addr.rs:434:5:
assertion `left == right` failed: with a routable address and a router
  left: Ok(Route { iface: IfIndex(0), next_hop: Neighbour(192.0.2.254), source: 192.0.2.1 })
 right: Ok(Route { iface: IfIndex(0), next_hop: Neighbour(169.254.3.4), source: 192.0.2.1 })
thread 'an_answer_to_a_link_local_asker_goes_to_its_own_link_address' panicked at userland/netstack/node/tests/name.rs:234:5:
assertion `left == right` failed: the asker is asked for, and nothing is the router's
  left: [Arp { request: true, sender: 192.0.2.1, target: 192.0.2.254 }, Udp(Udp { to: [2, 0, 0, 0, 0, 254], source: 192.0.2.1, source_port: 5353, destination: 169.254.3.4, port: 53000, ttl: 255, payload: [0, 5, 132, 0, 0, 1, 0, 1, 0, 0, 0, 0, 5, 116, 111, 121, 111, 115, 5, 108, 111, 99, 97, 108, 0, 0, 1, 0, 1, 5, 116, 111, 121, 
 right: [Arp { request: true, sender: 192.0.2.1, target: 169.254.3.4 }]
EXIT=101

Step 13, m2-neighbour-queue-global

test rfc_4861_7_2_2_a_silent_next_hop_holds_up_no_other ... FAILED
test s_ip_nud_005_the_interface_holds_at_most_64 ... FAILED
test s_ip_nud_029_released_datagrams_are_evicted_last ... FAILED
test result: FAILED. 32 passed; 3 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s
thread 'rfc_4861_7_2_2_a_silent_next_hop_holds_up_no_other' panicked at toyos-net-ip/tests/nud.rs:907:5:
assertion `left == right` failed: B's datagrams wait in B's queue, and R's full one drops none of them
  left: 9
 right: 1
thread 's_ip_nud_005_the_interface_holds_at_most_64' panicked at toyos-net-ip/tests/nud.rs:89:5:
assertion `left == right` failed
  left: Ok(None)
 right: Err(NbPendingFull)
thread 's_ip_nud_029_released_datagrams_are_evicted_last' panicked at toyos-net-ip/tests/nud.rs:669:13:
assertion `left == right` failed
  left: 0
 right: 1
EXIT=101

Step 14, m3-arp-reads-prefixes-only

test rfc_3927_2_6_2_a_datagram_to_a_link_local_host_is_resolved_and_sent_to_it ... FAILED
test result: FAILED. 36 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test rfc_3927_2_6_2_a_link_local_sender_is_a_neighbour ... FAILED
test result: FAILED. 22 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test an_answer_to_a_link_local_asker_goes_to_its_own_link_address ... FAILED
test result: FAILED. 12 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
thread 'rfc_3927_2_6_2_a_datagram_to_a_link_local_host_is_resolved_and_sent_to_it' panicked at toyos-net-ip/tests/addr.rs:468:5:
assertion failed: h.is_reachable(LINK_LOCAL)
thread 'rfc_3927_2_6_2_a_link_local_sender_is_a_neighbour' panicked at toyos-net-ip/tests/nbr.rs:168:5:
assertion failed: h.is_stale(asker)
thread 'an_answer_to_a_link_local_asker_goes_to_its_own_link_address' panicked at userland/netstack/node/tests/name.rs:238:5:
assertion `left == right` failed
  left: []
 right: [Udp { to: [2, 0, 0, 0, 0, 11], source: 192.0.2.1, source_port: 5353, destination: 169.254.3.4, port: 53000, ttl: 255, payload: [0, 5, 132, 0, 0, 1, 0, 1, 0, 0, 0, 0, 5, 116, 111, 121, 111, 115, 5, 108, 111, 99, 97, 108, 0, 0, 1, 0, 1, 5, 116, 111, 121, 111, 115, 5, 108, 111, 99, 97, 108, 0, 0, 1, 0, 1, 0, 0, 0, 10, 0, 4
EXIT=101

Step 15, m4a-an-edge-is-a-neighbour

test rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination ... FAILED
test result: FAILED. 36 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
thread 'rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination' panicked at toyos-net-ip/tests/addr.rs:485:9:
assertion `left == right` failed: 169.254.0.0
  left: Ok(Route { iface: IfIndex(0), next_hop: Neighbour(169.254.0.0), source: 192.0.2.1 })
 right: Err(RouteNone)
EXIT=101

Step 16, m4b-an-edge-is-a-sender

test rfc_3927_the_edges_of_the_link_local_prefix_are_no_senders ... FAILED
test result: FAILED. 22 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
thread 'rfc_3927_the_edges_of_the_link_local_prefix_are_no_senders' panicked at toyos-net-ip/tests/nbr.rs:188:9:
assertion `left == right` failed: 169.254.0.0
  left: 0
 right: 2
EXIT=101

Step 17, m5-gateways-read-the-wide-predicate

test rfc_3927_a_link_local_address_is_no_gateway_of_a_routable_interface ... FAILED
test result: FAILED. 36 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
thread 'rfc_3927_a_link_local_address_is_no_gateway_of_a_routable_interface' panicked at toyos-net-ip/tests/addr.rs:518:5:
assertion `left == right` failed
  left: Ok(())
 right: Err(RouteGatewayOffLink)
EXIT=101

Step 18, m6-an-edge-goes-to-the-router

test rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination ... FAILED
test result: FAILED. 36 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
thread 'rfc_3927_2_6_2_the_edges_of_the_link_local_prefix_are_no_destination' panicked at toyos-net-ip/tests/addr.rs:485:9:
assertion `left == right` failed: 169.254.0.0
  left: Ok(Route { iface: IfIndex(0), next_hop: Neighbour(192.0.2.254), source: 192.0.2.1 })
 right: Err(RouteNone)
EXIT=101

Step 19, m7-an-edge-is-a-source

test rfc_3927_the_edges_of_the_link_local_prefix_are_no_source ... FAILED
test result: FAILED. 36 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
thread 'rfc_3927_the_edges_of_the_link_local_prefix_are_no_source' panicked at toyos-net-ip/tests/addr.rs:505:9:
assertion `left == right` failed: 169.254.0.0
  left: Some(Unicast)
 right: None
EXIT=101

[Japabu]

Review of wt/toyos-move-ip at b83237cab against origin/main at a4416fe6c, round 3. Read only: no build, no test. Read for this round: git diff 6b14a7f4d b83237cab (one commit, input.rs +2 −2, tests/addr.rs +15), input.rs whole at the head, link_local_edge and its three readers, the test's helpers, round 3's step logs 00 to 03, 09, 11 and 19, the round 3 comment's two patches, and the input scenarios of the readers' IP specification.

Growth: git diff --shortstat origin/main...b83237cab is 9 files, +249 −21. Production +27 −9 (arp.rs +4 −4, iface.rs +11, input.rs +2 −2, route.rs +10 −3). Tests +220 −10 (toyos-net-ip/tests +203, node name.rs +17 −10). Track +2 −2. This round's production growth is one operand in an existing condition, reading a predicate the tree had; accepted.

Earlier findings, judged

1. OPEN. cargo run -- --ci host green at the head. Not run: the pull request is a draft, and host, toolchain and guest at b83237cab all concluded skipped. Steps 01 to 03 (exit 0 each, head b83237cab in step 00) are a subset and no src/clippy.rs shape. Nothing else holds this open.
2. to 8. CLOSED in round 2; steps 10 and 12 to 18 are the same patches at this head, each exit 101 in step 09, and nothing this round touches what they closed on.
3. (NOTE) CLOSED, by the refusal. Step 11, 6b14a7f4d's input.rs under this head's tests, exit 101: addr.rs:505 finds Some(Unicast) where None is wanted, for the datagram from 169.254.0.0. Step 19, the new operand alone removed, exit 101 at the same assertion. Step 01 at the head, exit 0, rfc_3927_the_edges_of_the_link_local_prefix_are_no_source ... ok. The step 11 patch is the whole of git diff b83237cab 6b14a7f4d -- toyos-net-ip/src, so it is the negative control on the base the green arm was measured on. Both red runs stop at the first edge; 169.254.255.255 is held by the same loop, and on fixture I neither is_host nor a held prefix's edge refuses it, so a predicate that lost that half is red on the second pass.
4. (NOTE) CLOSED. The body's edges paragraph now says what an interface whose own prefix is wider than 169.254/16 does, and it is what route.rs does.

BLOCKER

None new.

NOTE

11. issues/toyos-has-its-own-network-stack.md:46 — the departure line covers the new test by name (rfc_3927_… in tests/addr.rs) but measures only RTE-01 to RTE-17 and NBR-01 to NBR-18, and says nothing of the input path, which now refuses a source the specification's input step does not list — the line is the record of where the tree departs, and its third reader is missing from it. Wanted before landing: the same sentence extended with the input scenarios, IN-01 to IN-09, of which none names 169.254 and IN-05 is the nearest. That is true of the specification as I read it this round. A track-line edit and nothing else; it needs no further round.

Asked

• Where it sits. input.rs:87, one more operand of the one condition that returns ip.invalid-source: after the frame-versus-destination, martian and for-us steps, before own-source, fragments, options and protocol dispatch. Destination still names the refusal first, so a datagram from an edge to an address that is not ours stays ip.not-for-us. admit returns on the first failing step and ipv4 hands that one refusal to log.refuse and returns None: one count, one refusal event bounded as every other, nothing delivered. No ICMP can follow: the only self.error on this path is under protocol dispatch, after admit; the echo, port-unreachable and reset paths are all behind it. The IPv4 input path learns no neighbour from a source, so nothing is learned either. The test asserts the count is 1 and that nothing leaves.
• Every interface. The operand does not read the interface, so it holds with no address (the casts reachable there are acquisition, limited broadcast and a joined group), with a routable one and with a link-local one. On an interface that holds 169.254.x.y/16 the two addresses are also that prefix's own edges: link_local_edge is evaluated first and short-circuits, the held-prefix any is not reached, and the result is the same single ip.invalid-source it was on main. Not counted twice by construction: one if, one return.
• What is still admitted. Every source in 169.254.0.1 to 169.254.255.254: the predicate is two literal addresses. So mDNS from a link-local host is admitted, and the test's last assertion holds 169.254.3.4 delivered Unicast. DHCP: a server's or relay's source is a host address, and 0.0.0.0 was already refused outside IGMP by is_host, unchanged; the acquisition cast is decided before this step and still admitted for any host source.
• What it refuses that a prefix could call a host. On an interface whose own prefix is wider than 169.254/16 (169.255.0.5/15), 169.254.255.255 is an interior address and is now refused as a source; on one holding 169.254.0.1/31, 169.254.0.0 is the RFC 3021 peer and is refused too. Both were already refused as ARP senders since round 2, so neither could be answered; the body says "no peer on any", and the track's line on a held 169.254/16 address has its exit at Ip::add_address. Not a finding.
• The specification's input scenarios. IN-01 to IN-09; none names 169.254 or a link-local source. There is no scenario this test should carry the id of. It contradicts none: IN-05's three cases (0.1.2.3 and 192.0.2.0 on a /24 refused, 192.0.2.0 on a /31 delivered) are untouched, the predicate being false of all three, and s_ip_in_005_invalid_sources is ok in step 01 and in steps 11 and 19. The refusal is an addition to that step's list, which is NOTE 11.
• host at the head that lands. The host check concluded success, not skipped, on the exact commit that lands, from cargo run -- --ci host exit 0, its log read rather than its last line, and again in the merge queue.
  If that commit is b83237cab, or b83237cab plus NOTE 11's track line and nothing else, BLOCKER 1 closes on that reading and the orchestrator may land without another round; any change under toyos-net-ip/ or userland/ comes back.
• Merges. git merge-tree --write-tree b83237cab origin/main exits 0 with origin/main still at a4416fe6c, and git merge-tree --write-tree b83237cab origin/wt/toyos-ownstack-d exits 0 at 49e38ca4a.

SEND BACK

[Japabu]

CI at 95b889b15, read from each job's own log (the orchestrator). host: [ci] Host: 79 step(s), all green, clippy with warnings denied clean. guest / suite: test result: ok. 36 passed, 36 total, [ci] Guest: 5 step(s), all green. toolchain / build: success. Queued.