toyos-net-node: a datagram socket's broadcast permission, which each datagram keeps to the route it leaves by; a logged refusal out of the call that met it; and the name announced again when the link returns

[Japabu]

Stage "node" of the move to ToyOS's own network stack: the three lines of issues/toyos-has-its-own-network-stack.md that the plan gives the node between the listeners stage (#777) and the move. toyos-net-node, toyos-net-shard, toyos-net-udp and toyos-net-ip ship in nothing, so no guest test and no T14 row reaches these rules and none is added; toyos-mdns ships, and gains one call that netstack on smoltcp does not make.

Head 108232f24: the stage's commit 422292c38, round 2's 436570ec9, round 3's e8a806cc8, and origin/main at 9cf2c4e5c (#787, libc's sockets) merged in. Every gate below was run at 108232f24.

One thing briefed in round 1 is not built: datagram senders that wait on the next hop, with PENDING_PER_NEIGHBOUR back to 8. See "Not built" below; it is its own stage, now that #781 is in.

What changed, per rule

1. A datagram socket's broadcast permission, which a datagram keeps (US-21, decision U-4; POSIX's SO_BROADCAST).

• Node::udp_set_broadcast(id, permitted) hands the permission through Stack::set_broadcast and Shard::udp_set_broadcast to Udp::set_broadcast, which [udp] already had for the DHCP client's socket alone. A socket is bound without it.
• udp.broadcast-not-permitted is answered Refused::PermissionDenied, where it was InvalidInput: the request was well formed. The word is the node's name for toyos::net's ERR_PERMISSION_DENIED, which The pipe ABI carries a datagram socket's broadcast permission from std and libc to netstack, and the option read is gone #783 added.
• The permission of the call travels with the datagram (round 2, the review's first BLOCKER). It was asked once, in [udp]'s submit, against the prefixes held then, and the datagram was routed again when it left, against the prefixes held then. Ip::add_address rewrites a held address's prefix in place with whatever prefix a DHCP server's acknowledgement names, so a datagram accepted for one host left as a link broadcast from a socket that never held the permission. Now:
  • [udp]'s Queued carries what its socket held at the call. The closed sender's queue is Queueds, so a closed socket's datagrams carry it with no code of their own.
  • toyos_net_ip::UdpOut has the field broadcast. It is a struct whose maker names every field, and [udp]'s serve is its one maker outside tests: no transport hands [ip] a datagram without saying.
  • Ip::send_udp routes the datagram as before and refuses a NextHop::Broadcast to one that does not carry the permission: ip.broadcast-not-permitted, counted, logged through Log::refuse against the destination like [ip]'s other logged rules, and the flow told it is unreachable like every refusal of that call. The refusal is the NextHop::Broadcast arm of datagram itself (toyos-net-ip/src/egress.rs), the one function that writes a link destination, with the permission its argument (round 3, the review's NOTE): send_udp passes the datagram's, and own, the path of [ip]'s ICMP messages, passes false, so no sender inside [ip] reaches the link's broadcast address without saying so, and the check reads the route the frame would take and not a second predicate of [udp]'s. datagram takes a transport's flow and frame as one Option of the pair, which they always were together; that keeps it at seven arguments. One order moved with the check: a datagram both too long and refused the broadcast is now counted ip.exceeds-mtu, the length being read first (read, not tested).
  • [ip]'s own messages reach that arm, and a test holds it. admit refuses a source at an edge of a held prefix, but an error is routed when [udp] asks for it, after receive returned: a prefix that becomes usable in between can make the admitted source its directed broadcast. On the shard the two calls are one step with nothing between; at [ip]'s interface the state is built through public calls with admit as it is.
  • Node::transmit ends in the pass over the stack's log lines: a datagram can now be refused as it leaves, and its line is in Node::drain_events when that opportunity returns.
• What the datagram carries is the socket's permission at the call, which is when POSIX reads SO_BROADCAST: given later it covers nothing accepted before, and taken back it still covers what was accepted under it.
• Tests:
  • a_broadcast_needs_its_permission (userland/netstack/node/tests/datagram.rs), as in round 1: refused without the permission in the word that says so, both broadcast addresses on the wire in link-broadcast frames with it, another socket still refused, refused again once it is taken back.
  • s_udp_us_021_shard_a_datagram_accepted_for_a_host_is_no_broadcast_after_a_renewal_narrows_the_prefix (toyos-net-shard/tests/udp.rs): verified A/24, bind, a send to 192.0.2.127 accepted, add_address(A, 25), one transmit opportunity: no frame, ip.broadcast-not-permitted at 1, the shard's one line naming 192.0.2.127, and nothing in a second opportunity. Run twice, the second time with the socket closed before the renewal.
  • …_accepted_for_the_router_is_no_broadcast_after_a_renewal_widens_the_prefix: A/25 with a router, a send to 192.0.2.255 accepted for the router, add_address(A, 24), the same.
  • …_a_datagram_carries_the_permission_of_its_call: two sockets each with a datagram to 192.0.2.127 accepted, one permitted at the call and the permission taken back after, one not permitted and given it after; after the renewal exactly one frame leaves, to ff:ff:ff:ff:ff:ff from the first socket's port.
  • a_datagram_accepted_for_a_host_is_no_broadcast_after_the_server_renews_a_narrower_prefix (the node's tests/datagram.rs): the same from the trust boundary, a server's ACK of the node's own renewal naming 255.255.255.128. The lease's prefix is 25, no frame leaves, the counter is 1, and the line is in drain_events after the opportunity with no receive, fire or link behind it.
  • s_udp_us_021_ip_no_link_broadcast_without_the_datagrams_permission (toyos-net-ip/tests/addr.rs): send_udp with the field false, to the limited address and the /24's directed one: the refusal, the count, the two events, no frame and no ARP request; the same datagram to a host is held for its link address.
  • an_error_whose_next_hop_became_a_broadcast_is_refused_and_counted (toyos-net-ip/tests/icmp.rs, round 3): a datagram from 192.0.2.127 admitted under A/24, 192.0.2.3/25 added and run to assigned, then port_unreachable for the arrival: no frame, ip.broadcast-not-permitted at 1 and logged against 192.0.2.127, icmp.error-suppressed and icmp.errors-sent at 0. Red under m12, m16 and m18.
• The control: the three shard tests, their counter and log assertions taken out since the base has neither, run on 07fbe3c7b: exit 101, all three red on (MacAddr([255, 255, 255, 255, 255, 255]), "UDP 192.0.2.127 from port 5000") where no frame is expected (192.0.2.255 in the widened case, and both sockets' frames in the third). The patch and the log's failures are in the round-2 comment below.
• Mutations: m1 to m4 as in round 1, and m12 ([ip] asks no permission), m13 ([udp] queues every datagram as permitted), m14 (a closed socket's datagrams are permitted), m15 (a datagram leaves under its socket's permission of the moment), m16 (the drop is counted and not logged), m17 (a transmit ends without the pass over the log lines), m18 (the refused broadcast is counted and leaves). m12, m16 and m18 are cut again against the arm in datagram and were run at 108232f24: each builds (exit 0) and is red (exit 101) at the five tests it was red at in round 2 and at the new ICMP test. The other fifteen and m0 were not run again: their last run is at 65961d1aa.
• Oracle: POSIX's SO_BROADCAST and RFC 919 §7 and RFC 922 §7 for what a broadcast is; at the node etherparse reads every frame, the control's broadcast frame under m12 included. At the shard the frames are read by toyos-net-wire's parsers, which are ours. s_udp_us_021_broadcast_needs_permission in toyos-net-udp is unchanged and red under m4.
• The readers' specifications ask the permission at the call alone and list no such logged rule: the track's stage 3 departures say so, and s_ip_mod_002_ordinary_refusals_are_not_logged lists the rule beside the readers'.

2. A refusal the stack logs is out of the node when the call that met it returns.

• Node::udp_send_to and, from round 2, Node::transmit end in the pass over the stack's log lines, like receive, fire and link.
• One way out of Stack for a log line (round 2, the review's NOTE). Stack::refusals is the one drain of the shard: it hands each log line over and queues each of [ip]'s reports on the address for Stack::report. Report::Refused, its arm in settle and report's own drain are gone; the inbox is a queue of a type that has no log line in it. Node::log is the one caller.
• Only a send meets a logged rule of [udp]'s: of its counters two are logged, udp.send-unspecified-destination (US-20) and udp.broadcast-not-permitted (US-21), and both are submit's. udp_bind, udp_recv_from, udp_close and udp_set_broadcast therefore take no pass.
• Tests: a_refusal_is_logged_by_the_call_that_met_it, as in round 1. the_log_lines_are_taken_and_the_report_before_them_keeps_its_turn, the unit test in lease.rs: a verification unread and a refused send behind it, the line taken, the verification still the next report, and a second pass handing neither over again.
• Mutations: m5 (the send ends without the pass), m11 (taking a line drops the reports before it), m17.

3. The machine's name is announced again when the link returns (RFC 6762 §8, §8.3, §6).

• RFC 6762 §8: "Whenever a Multicast DNS responder starts up, wakes up from sleep, receives an indication of a network interface "Link Change" event, or has any other reason to believe that its network connectivity may have changed in some relevant way, it MUST perform the two startup steps below: Probing (Section 8.1) and Announcing (Section 8.3)." The node keeps its lease across the link, so the responder saw no new address and announced nothing.
• toyos_mdns::Responder::link_returned(now_ms) owes the record to the group twice, a second apart (§8.3), the first no sooner than a second after the record's last multicast (§6). With no address held it owes nothing: the address that comes is new and announced as before. Node::link calls it on a link that came up.
• A new address's two announcements go through the same step now: on sends what is owed and owes the second, where it had one arm for a new address and one for a due one.
• What "no behaviour of the shipped responder changes" rests on: its twelve host tests pass unchanged; the shipped shell's suite, which links it, passes; netstack on smoltcp calls on and owed_at only; and the guest suite, whose every network test boots that responder, was run once locally at this head (below). The reading the review asks for is CI's guest / suite on the head that lands, which a draft does not run.
• Probing is not built here and is the next stage of toyos-mdns, not this one. §8 asks for probing first and §8.3 announces a record that "completed the probing step"; toyos-mdns probes nowhere. What this stage adds to that defect is occasions: each return of the link is two more multicasts, with the cache-flush bit, of a record nobody probed. issues/netstack-answers-for-its-name-without-claiming-it.md described userland/netd/src/mdns.rs, which the tree no longer has; it is rewritten to be true of toyos-mdns, with what a returning link multiplies, its owner and an exit a test can fail, and the track's line rests on it.
• An announcement that falls due while the link is down (the review's observation): the responder hands it over, [udp] refuses it for want of a route, the node counts node.name-unsent, and the responder holds it sent; the link's return owes two more, the first up to a second later than §6 needs. I read it as the rule and not a defect: §6 is a least interval, which a multicast held sent and never sent only lengthens, and §8.3's two leave after the return. Telling the responder would take a second call for a second that is spent once a link change. It is said at userland/netstack/node/src/name.rs's header and held by an_announcement_due_with_the_link_down_is_counted_and_the_links_return_owes_both: the second announcement due 1 s after the first with the link down is counted and not sent, a return 300 ms later announces 1 s and 2 s after the unsent one, and never a third time.
• Tests: a_link_that_returns_is_announced_twice_a_second_apart_and_no_sooner_than_a_second_after_the_last_multicast in toyos-mdns, a_held_name_is_announced_again_when_the_link_returns and the one above (userland/netstack/node/tests/name.rs).
• Mutations: m6 (the node tells the name nothing of the link), m7 (announced inside the second of the last multicast), m8 (announced once), m9 (a record owed with no address), m10 (a new address announced once).
• Oracle: RFC 6762, quoted at each test. Every message is written out in the test from RFC 1035 §4.1's layout, never by toyos-mdns; etherparse reads every frame.

Not built: datagram senders that wait on the next hop

The table gives the node rows 2, 6 and 8, which are the three rules above; this slice is #781's recorded remainder, and the track now names it as what is still to build before the move, with #781's two lines for its owner and exit. The review's reading of its three open questions is in the round-1 review for that stage's brief.

What the move must still do with each

added here	the move
Node::udp_set_broadcast	netstack answers MsgType::UdpSetOption with OPT_BROADCAST by this call, the value's zero as false; a socket it does not hold is the call's NotConnected
Refused::PermissionDenied	written as ERR_PERMISSION_DENIED; the guest test udp_broadcast_needs_its_permission and the C case the track names come behind the move
the log lines in the send's and the transmit's own call	nothing more than reading drain_events each turn of its loop, which it owes the log anyway
ip.broadcast-not-permitted	nothing: the datagram is dropped inside the stack, and its line is one of drain_events'
Responder::link_returned	nothing: the shell reports the card's link changes to Node::link, which it must for the lease

Checks (a trust boundary and a device's protocol)

• Wire input. The prefix that opened the first BLOCKER is a DHCP server's, off the wire, and decided a permission. It decides none now: the permission is the datagram's own, set from the socket at the client's call, and the prefix only chooses the route, which is refused a broadcast without it. No new path reads a byte off the wire.
• What a client gains. A socket with the permission sends one link broadcast a datagram, bounded by its own queue of TX_DATAGRAMS like any send. A socket without it sends none, whatever a server renews. A client's refused sends and dropped datagrams cost the log one line a rule in 10 s, the shard's bound, unchanged.
• What a server gains. A server that renews a prefix under queued datagrams makes the node drop those now addressed to a broadcast, at most TX_DATAGRAMS a socket and CLOSED_DATAGRAMS for the closed, each counted; a connected socket among them hears its flow is unreachable, as for any datagram [ip] refuses.
• What a link gains. Each return of the link owes two multicasts of one record, and §6's second still bounds them: a link that flaps faster than once a second is announced on once a second.
• Negative controls. The control on 07fbe3c7b above. Eighteen mutations and m0, each a checked patch on the clean head, built, run, reported with its exit code and reversed by one script that refuses a dirty tree before the first and after each; patches, script and table are in the round-2 comment, and the three patches cut again for round 3 in the round-3 comment. At 65961d1aa every one was red at the tests named above (exit 101), and m0, the node's, shard's, [udp]'s and [ip]'s sources as on main under these tests, did not build (exit 101); at 108232f24 m12, m16 and m18 are red again (exit 101), the tree clean after each.
• Time is an argument everywhere; no wait was added.

Gates, at 108232f24

command	exit
cargo test --locked -p toyos-mdns (13 passed, 0 failed)	0
cargo test --locked -p toyos-net-node (141 passed, 0 failed)	0
cargo test --locked -p toyos-net-udp (59 passed, 0 failed)	0
cargo test --locked -p toyos-net-shard (50 passed, 0 failed)	0
cargo test --locked -p toyos-net-ip (273 passed, 0 failed)	0
cargo test --locked --manifest-path userland/netstack/Cargo.toml (29 passed, 0 failed; the shipped shell, which links toyos-mdns)	0
cargo clippy --locked -p toyos-mdns -p toyos-net-node -p toyos-net-udp -p toyos-net-shard -p toyos-net-ip --all-targets --keep-going -- <src/clippy.rs's ADOPTED as -W> -D warnings	0
cargo test --locked --lib -- hostws:: userlandhost:: sourcegate:: licence:: from the root package (45 passed)	0
cargo run -- --ci host (78 steps, all green)	0
cargo run -- --build-only	0
cargo test --test toyos-build, the whole guest suite, once (37 passed, 37 total, libc_sockets among them)	0

cargo run -- --ci host was run twice at this head. The first run exited 1 with 1 of 78 steps red: the licences step's cargo metadata could not resolve the crates.io index's host name, in a network outage on the development machine, and the other 77 steps were green. The second, with the network back, is the row above. The first run's log is kept as r3-ci-host-red-on-a-network-outage.log.

The guest suite ran on a loaded, shared host: uptime read load averages 46.68 57.64 59.42 before it and 54.70 57.26 59.08 after, on 14 cores; the harness paid its liveness ceilings at 1.00x (fastest boot 456 ms against its reference 1424 ms). It is one local run, not CI's guest / suite under KVM, which runs on the head that lands.

Every step's log, its command first and its exit code last, is in the orchestrator's scratchpad under the stage's logs/, named r3-<step>.log; round 2's at 65961d1aa are r2b-<step>.log, and the control is r2-control-on-07fbe3c7b.log.

The merge of 9cf2c4e5c. One conflict, in the track's line on the broadcast permission: #787 changed its last sentence only, and the line is this branch's with #787's ending (tests/netcase/sendto_unbound.c holds the send without bind). #787's other hunk in the track, the listener's TCP_NODELAY issue among the listener defects, merged by itself. No line of the tree names any of the four issue files #787 deleted, searched by path and by bare name.

Not run, as briefed: anything on metal.

Not measured

• Nothing here has met a device, a switch or another host's responder or DHCP server: whether a server in the field ever renews a held address with another prefix is not known, and the rule does not rest on it.
• What a C program or std sees: the pipe ABI's side is The pipe ABI carries a datagram socket's broadcast permission from std and libc to netstack, and the option read is gone #783's, and nothing joins the two until the move.

Unsure of

• A connected socket's refused broadcast is reported in [ip]'s word for a failed next hop. send_udp reports every refusal to the flow as unreachable, which since toyos-net-node: a query known not to have reached its resolver is not waited out, an ICMP error ends nothing, and a burst of lookups reaches the wire #781 [udp] hands a connected socket as SocketError::NextHopFailed. For a peer whose address a renewal turned into a directed broadcast that word is inexact: nothing left, which is what it promises, but no link address was looked for. No client's socket is connected, and the resolver's, which are, ask the next resolver on it.
• A datagram [ip] already holds for its next hop when the prefix is renewed was framed for that neighbour and leaves to the neighbour's own link address or not at all (nud::leave writes the resolved MAC). Read, not tested.
• The announcement leaves while the DHCP client is still verifying its lease on the returned link. A server that then refuses the lease leaves two announcements of an address the machine gives up a moment later. The record's TTL is 120 s.
• the_log_lines_are_taken_and_the_report_before_them_keeps_its_turn holds an order no call of Node's can reach today. I kept the order and its test rather than an unreachable! in a path a client's send runs.

Growth

git diff --shortstat origin/main...108232f24: 19 files, +631 -86. Production +154 -51: toyos-mdns +40 -17, the node's lease.rs +35 -15, datagram.rs +22 -4, lib.rs +15 -5, name.rs +10, [ip] +20 -8, [udp] +7 -2, the shard +5. Tests +441 -21: the node's tests/datagram.rs +123 -15, the shard's tests/udp.rs +102 -2, the node's tests/name.rs +70, the unit test in lease.rs +47, toyos-mdns's +47, [ip]'s tests +52 -4. The track and the issue +36 -14.

Round 2 alone (07fbe3c7b to 436570ec9): production +67 -39, of which the carried permission is [ip]'s +12 -3 and [udp]'s +7 -2, and the one way out of Stack is lease.rs +28 -25 with lib.rs +10 -4 and datagram.rs +7 -5; tests +199 -8. Round 3 alone (65961d1aa to e8a806cc8): egress.rs +12 -9, the ICMP test +19, the track one sentence.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

[Japabu]

Mutation patches of round 1, each applied to the clean head 07fbe3c7b with git apply --recount, built with cargo test --locked --no-run and run with cargo test --locked --no-fail-fast over -p toyos-mdns -p toyos-net-node -p toyos-net-udp -p toyos-net-shard -p toyos-net-ip, then reversed; the script refuses a dirty tree before the first and after each. The diffs below are git diff of the mutated tree.

mutation	build	tests	red
m0-the-node-shard-and-udp-sources-as-on-the-base	101	not run
m1-the-refusal-is-invalid-input-again	0	101	each_refusal_is_answered_in_the_pipes_word_for_it a_refusal_is_logged_by_the_call_that_met_it a_broadcast_needs_its_permission
m2-the-node-hands-the-permission-to-nobody	0	101	a_broadcast_needs_its_permission
m3-a-permission-given-is-never-taken-back	0	101	a_broadcast_needs_its_permission
m4-udp-asks-no-permission	0	101	a_broadcast_needs_its_permission a_refusal_is_logged_by_the_call_that_met_it each_refusal_is_answered_in_the_pipes_word_for_it s_udp_us_021_broadcast_needs_permission
m5-a-send-ends-without-the-pass-over-the-log-lines	0	101	a_refusal_is_logged_by_the_call_that_met_it
m6-the-node-tells-the-name-nothing-of-the-link	0	101	a_held_name_is_announced_again_when_the_link_returns
m7-a-returned-link-is-announced-inside-the-second-of-the-last-multicast	0	101	a_link_that_returns_is_announced_twice_a_second_apart_and_no_sooner_than_a_second_after_the_last_multicast a_held_name_is_announced_again_when_the_link_returns
m8-a-returned-link-is-announced-once	0	101	a_link_that_returns_is_announced_twice_a_second_apart_and_no_sooner_than_a_second_after_the_last_multicast a_held_name_is_announced_again_when_the_link_returns
m9-a-returned-link-owes-a-record-with-no-address	0	101	a_link_that_returns_is_announced_twice_a_second_apart_and_no_sooner_than_a_second_after_the_last_multicast
m10-a-new-address-is-announced-once	0	101	a_link_that_returns_is_announced_twice_a_second_apart_and_no_sooner_than_a_second_after_the_last_multicast the_record_is_multicast_at_most_once_a_second_and_a_query_inside_it_waits a_lease_already_held_is_announced_as_the_name_is_told every_response_leaves_with_ttl_255 a_second_query_inside_a_second_waits_for_the_second_to_end an_answer_udp_refuses_is_counted_and_dropped a_query_in_a_frame_to_the_groups_address_reaches_the_responder an_answer_goes_to_the_group_or_to_the_asker_as_the_query_asked a_held_name_is_announced_again_when_the_link_returns an_answer_to_a_link_local_asker_goes_to_its_own_link_address a_held_lease_is_announced_at_once_and_a_second_later no_cut_of_a_query_is_answered a_query_from_off_the_link_is_not_answered
m11-the-pass-over-the-log-lines-drops-every-other-report	0	101	the_log_lines_are_taken_and_the_report_before_them_keeps_its_turn

m1-the-refusal-is-invalid-input-again

diff --git a/userland/netstack/node/src/datagram.rs b/userland/netstack/node/src/datagram.rs
index b59680619..b4f73140d 100644
--- a/userland/netstack/node/src/datagram.rs
+++ b/userland/netstack/node/src/datagram.rs
@@ -77,7 +77,7 @@ fn refused(error: Error) -> Refused {
         | Counter::SendPortZero
         | Counter::SendUnspecifiedDestination
         | Counter::ExceedsMtu => Refused::InvalidInput,
-        Counter::BroadcastNotPermitted => Refused::PermissionDenied,
+        Counter::BroadcastNotPermitted => Refused::InvalidInput,
         Counter::TxQueueFull => Refused::ResourceExhausted,
         Counter::ConnectUnspecified
         | Counter::ConnectGroup

m2-the-node-hands-the-permission-to-nobody

diff --git a/userland/netstack/node/src/datagram.rs b/userland/netstack/node/src/datagram.rs
index b59680619..8371bb2f2 100644
--- a/userland/netstack/node/src/datagram.rs
+++ b/userland/netstack/node/src/datagram.rs
@@ -121,7 +121,7 @@ impl Node {
     /// Whether the socket's datagrams may go to a broadcast address, the limited one or the
     /// directed one of a prefix the machine holds, from here on.
     pub fn udp_set_broadcast(&mut self, id: DatagramId, permitted: bool) -> Result<(), Refused> {
-        self.stack.set_broadcast(id.0, permitted).map_err(refused)
+        self.stack.set_broadcast(id.0, permitted && false).map_err(refused)
     }
 
     /// Queues `payload` for `destination:port`; it leaves in a later [`Node::transmit`].

m3-a-permission-given-is-never-taken-back

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 55737e4e0..5026ee3e7 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -373,7 +373,7 @@ impl Udp {
 
     /// POSIX's `SO_BROADCAST`: without it a send to a broadcast address is refused.
     pub fn set_broadcast(&mut self, id: SocketId, permitted: bool) -> Result<(), Error> {
-        self.socket(id).map(|s| s.broadcast = permitted)
+        self.socket(id).map(|s| s.broadcast |= permitted)
     }
 
     pub fn set_ttl(&mut self, id: SocketId, unicast: Ttl, multicast: Ttl) -> Result<(), Error> {

m4-udp-asks-no-permission

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 55737e4e0..c7954fd50 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -485,7 +485,7 @@ impl Udp {
             Some(Counter::SendUnspecifiedDestination)
         } else if let Some(rule) = Self::unusable(ip, destination) {
             Some(rule)
-        } else if broadcast && !broadcast_permitted {
+        } else if broadcast && !broadcast_permitted && false {
             Some(Counter::BroadcastNotPermitted)
         } else if payload.len() > limits::MAX_PAYLOAD {
             Some(Counter::ExceedsMtu)

m5-a-send-ends-without-the-pass-over-the-log-lines

diff --git a/userland/netstack/node/src/datagram.rs b/userland/netstack/node/src/datagram.rs
index b59680619..41c23ca91 100644
--- a/userland/netstack/node/src/datagram.rs
+++ b/userland/netstack/node/src/datagram.rs
@@ -128,7 +128,6 @@ impl Node {
     pub fn udp_send_to(&mut self, now: Instant, id: DatagramId, destination: Ipv4Addr, port: u16, payload: &[u8]) -> Result<(), Refused> {
         let sent = self.stack.send_to(now, id.0, destination, port, payload).map_err(refused);
         let events = &mut self.events;
-        self.stack.refusals(|refusal, suppressed| events.push(crate::Event::Stack { refusal, suppressed }));
         sent
     }
 

m6-the-node-tells-the-name-nothing-of-the-link

diff --git a/userland/netstack/node/src/lib.rs b/userland/netstack/node/src/lib.rs
index 62aeabd85..34717685d 100644
--- a/userland/netstack/node/src/lib.rs
+++ b/userland/netstack/node/src/lib.rs
@@ -164,7 +164,6 @@ impl Node {
         self.stack.link(now, up);
         if up {
             if let Some(name) = &mut self.name {
-                name.link_returned(now);
             }
             let out = self.client.link_up(now, &mut draw);
             self.carry_out(now, out, None, &mut draw);

m7-a-returned-link-is-announced-inside-the-second-of-the-last-multicast

diff --git a/userland/netstack/mdns/src/lib.rs b/userland/netstack/mdns/src/lib.rs
index 66b16f210..be015f6be 100644
--- a/userland/netstack/mdns/src/lib.rs
+++ b/userland/netstack/mdns/src/lib.rs
@@ -231,7 +231,7 @@ impl<'a> Responder<'a> {
     /// comes is new.
     pub fn link_returned(&mut self, now_ms: u64) {
         if self.link.is_some() {
-            self.owed_ms = Some(self.group_free_ms(now_ms));
+            self.owed_ms = Some(now_ms);
             self.again = true;
         }
     }

m8-a-returned-link-is-announced-once

diff --git a/userland/netstack/mdns/src/lib.rs b/userland/netstack/mdns/src/lib.rs
index 66b16f210..32235f285 100644
--- a/userland/netstack/mdns/src/lib.rs
+++ b/userland/netstack/mdns/src/lib.rs
@@ -232,7 +232,6 @@ impl<'a> Responder<'a> {
     pub fn link_returned(&mut self, now_ms: u64) {
         if self.link.is_some() {
             self.owed_ms = Some(self.group_free_ms(now_ms));
-            self.again = true;
         }
     }
 

m9-a-returned-link-owes-a-record-with-no-address

diff --git a/userland/netstack/mdns/src/lib.rs b/userland/netstack/mdns/src/lib.rs
index 66b16f210..4ecfd7633 100644
--- a/userland/netstack/mdns/src/lib.rs
+++ b/userland/netstack/mdns/src/lib.rs
@@ -230,7 +230,7 @@ impl<'a> Responder<'a> {
     /// be multicast. With no address held nothing is owed: the one that
     /// comes is new.
     pub fn link_returned(&mut self, now_ms: u64) {
-        if self.link.is_some() {
+        if true {
             self.owed_ms = Some(self.group_free_ms(now_ms));
             self.again = true;
         }

m10-a-new-address-is-announced-once

diff --git a/userland/netstack/mdns/src/lib.rs b/userland/netstack/mdns/src/lib.rs
index 66b16f210..60a700ce9 100644
--- a/userland/netstack/mdns/src/lib.rs
+++ b/userland/netstack/mdns/src/lib.rs
@@ -213,7 +213,6 @@ impl<'a> Responder<'a> {
         };
         if self.link.is_none_or(|was| was.addr != link.addr) {
             self.owed_ms = Some(now_ms);
-            self.again = true;
         }
         self.link = Some(link);
         if !self.owed_ms.is_some_and(|at| now_ms >= at) {

m11-the-pass-over-the-log-lines-drops-every-other-report

diff --git a/userland/netstack/node/src/lease.rs b/userland/netstack/node/src/lease.rs
index 23d957a70..579d2788f 100644
--- a/userland/netstack/node/src/lease.rs
+++ b/userland/netstack/node/src/lease.rs
@@ -184,7 +184,7 @@ impl Stack {
                 line(refusal, suppressed);
                 false
             }
-            Event::Verified(_) | Event::Conflict { .. } | Event::Lost { .. } | Event::NotVerified(_) => true,
+            Event::Verified(_) | Event::Conflict { .. } | Event::Lost { .. } | Event::NotVerified(_) => false,
         });
     }
 

m0 is every source file of the change under toyos-net-shard/src, toyos-net-udp/src and userland/netstack/node/src as on origin/main (git checkout 0d6cd9a60 -- <those>), under the tests as they stand: the tests name udp_set_broadcast and Refused::PermissionDenied, so it is a build failure and no assertion.

The mutation script:

#!/bin/sh
# Applies each mutation to a clean tree, builds, runs the five crates' suites, and restores.
# usage: mutate.sh <worktree> <patch dir> <log dir> <round>
set -u
W=$1; P=$2; L=$3; R=$4
cd "$W" || exit 2
CRATES="-p toyos-mdns -p toyos-net-node -p toyos-net-udp -p toyos-net-shard -p toyos-net-ip"
SUMMARY=$L/$R-mutations.summary
: > "$SUMMARY"
clean() { [ -z "$(git status --porcelain --ignore-submodules=none)" ]; }
clean || { echo "dirty tree before" >> "$SUMMARY"; exit 2; }
echo "head $(git rev-parse HEAD)" >> "$SUMMARY"
for patch in "$P"/m*.patch; do
  name=$(basename "$patch" .patch)
  git apply --check --recount "$patch" || { echo "$name: does not apply" >> "$SUMMARY"; exit 2; }
  git apply --recount "$patch"
  git diff > "$L/$R-$name.diff"
  cargo test --locked --no-run $CRATES > "$L/$R-$name-builds.log" 2>&1; b=$?
  echo "EXIT=$b" >> "$L/$R-$name-builds.log"
  if [ $b -eq 0 ]; then
    cargo test --locked --no-fail-fast $CRATES > "$L/$R-$name.log" 2>&1; t=$?
    echo "EXIT=$t" >> "$L/$R-$name.log"
    red=$(grep -E '^test .* \.\.\. FAILED$' "$L/$R-$name.log" | sed -E 's/^test (.*) \.\.\. FAILED$/\1/' | tr '\n' ' ')
  else
    t="not run"; red=""
  fi
  git apply -R --recount "$patch"
  clean || { echo "$name: dirty tree after" >> "$SUMMARY"; exit 2; }
  echo "$name | build $b | tests $t | $red" >> "$SUMMARY"
done
# m0: every source file of the change as on the base, the tests as they stand.
BASE=$(git merge-base HEAD origin/main)
SRC="toyos-net-shard/src toyos-net-udp/src userland/netstack/node/src"
git diff "$BASE" HEAD -- $SRC userland/netstack/mdns/src/lib.rs > "$L/$R-m0-forward.diff"
git checkout -q "$BASE" -- $SRC
cargo test --locked --no-run $CRATES > "$L/$R-m0-builds.log" 2>&1; b=$?
echo "EXIT=$b" >> "$L/$R-m0-builds.log"
git checkout -q HEAD -- $SRC
clean || { echo "m0: dirty tree after" >> "$SUMMARY"; exit 2; }
echo "m0-the-node-shard-and-udp-sources-as-on-the-base | build $b | tests not run |" >> "$SUMMARY"
echo DONE >> "$SUMMARY"

[Japabu]

Review, round 1, of 07fbe3c7b against origin/main at 0d6cd9a60, by .claude/agents/reviewer.md. Read, not run: the diff, every changed file whole, the twelve mutation diffs and the r1b-* step logs at this head.

Growth: git diff --shortstat origin/main...07fbe3c7b is 10 files, +323 -42. Production +95 -23 (toyos-mdns +40 -17, the node's sources +49 -5, the shard +5, [udp] +1 -1), tests +225 -15, the track +3 -4. The production growth is the three rules' and is accepted, less the NOTE on the second way out below.

BLOCKER

• toyos-net-udp/src/lib.rs:483 with toyos-net-ip/src/egress.rs:298 and toyos-net-ip/src/route.rs:93 — a socket that never held the permission sends a link broadcast — the permission is asked once, in submit, against the prefixes held then; the datagram is routed again when it leaves, in send_udp, against the prefixes held then, and nothing between carries what the socket was permitted. Ip::add_address rewrites a held address's prefix in place (toyos-net-ip/src/config.rs:38), and Stack::renew (userland/netstack/node/src/lease.rs:257) calls it with whatever prefix the server's acknowledgement names. So: A/24 held, a socket without the permission queues a datagram to 192.0.2.127 (one host, accepted), an acknowledgement renews A as /25 before the next transmit opportunity, and the datagram leaves to ff:ff:ff:ff:ff:ff as the /25's directed broadcast (NextHop::Broadcast). A widened prefix does the same to a datagram accepted for the router. The value that opens it is a DHCP server's, off the wire. US-21 and decision U-4 give a broadcast to a socket that holds the right and to no other; the owner's ruling is that the permission is carried, never assumed, and here it is assumed from the moment of the call. The check is older than this branch; the claim is this branch's ("the node enforces it", the track's line, and rule 1 of the body), and no test of it reaches the window: a_broadcast_needs_its_permission pumps after every send. Sent back to measure and close: a test at the shard, the cheapest tier that holds both the queue and the prefix (verified A/24, bind, send_to 192.0.2.127 accepted, add_address(A, 25), one transmit opportunity), which must be red on 07fbe3c7b for a frame to the link's broadcast address, and green once what the socket was permitted at the call travels with the queued datagram and a broadcast next hop it does not cover is a counted drop. The closed sender's datagrams carry it too. The track's line is false of the tree until then.
• Evidence — no guest measurement at this head — toyos-mdns ships, and Responder::on, which the shipped netstack calls, is restructured (userland/netstack/mdns/src/lib.rs:209); the body says no guest test was run. Every guest test that boots the network reaches that function. The three check runs on the pull request are SKIPPED, a draft's, and read as nothing. Closed by guest / suite concluding success on the head that lands; see "Asked" below.

NOTE

• userland/netstack/node/src/lease.rs:180, :197 and userland/netstack/node/src/lib.rs:199 — a log line now has two ways out of Stack, refusals and report's Report::Refused, with the same push written twice — one is enough: settle takes the lines by refusals before each report, and Report::Refused, its arm in settle and report's own drain of the shard go. The inbox then holds lease reports only, which is what the module's header says of it.
• issues/toyos-has-its-own-network-stack.md:20 — "Still to build on it: the move" — false of the record: the lines below it still carry two exits "before the move", and the body's "Not built" names a slice the move waits on. Say what is left.
• issues/toyos-has-its-own-network-stack.md:41 — the name's line now rests its exit on issues/netstack-answers-for-its-name-without-claiming-it.md, which describes userland/netd/src/mdns.rs, a path the tree no longer has — the exit is leaned on here, so the issue is brought to the tree in this diff or the line states the exit itself.
• Pull request body, rule 3 — "No behaviour of the shipped responder changes" rests on host tests alone until the guest suite has run — say so.

Asked, not findings

Broadcast permission. Against US-21: both destinations are refused without the permission and leave in link broadcasts with it, read off the wire by a parser that is not ours; m1 to m4 are red at tests that name the claim, and m4 also at [udp]'s own US-21. The permission is written in three places only: false at bind, Udp::set_broadcast, and Shard::acquisition for the DHCP client's socket; a DatagramId names neither that socket nor the responder's, so the one call is the one path, and a reused slot is a new Socket. The DHCP client's socket keeps its permission and is exempted from nothing. The responder's socket holds none and needs none: its destinations are the group or a query's source, and [ip] refuses a source that is an edge of a held prefix before [udp] sees it. A duplicate is not the node's to hold: one DatagramId is one socket, and the pipe's try_clone case stays the move's, as the track's line says. A permission taken back while a broadcast is queued lets that datagram leave: the call was permitted, which is POSIX's rule. The window the other way is the first BLOCKER.

Logged refusal. Once, at the call: refusals drains the shard and removes each line from the inbox as it hands it over, so report cannot hand it over again; the unit test's last assertion (report() is None after the verification) is red on a line left behind, and m5 is red on a send that skips the pass. No other caller is left late: only submit refuses by a logged rule; the resolver connects first, and a connect's rules are not logged; the responder's destinations cannot be a broadcast or 0.0.0.0, as above; the DHCP client's sends are followed by settle's loop. On m11: the unit test is at the right tier. I find no call of Node's that leaves a lease report unread when a client sends ([ip] reports an address at a frame, a deadline or a link change, and each ends in settle), so a test through Node cannot build the state; a type cannot hold an order; and the alternative to keeping the order is a panic in a path a client's call runs. It holds the claim and not only the mutation: the line is taken, the verification is next, and nothing follows it.

Re-announce. RFC 6762 §8 asks for both steps on a link change, probing (§8.1) and then announcing (§8.3), and §8.3 announces unique records "that have completed the probing step". The stage announces only: a conformance defect against §8 and §8.1, older than this branch, which the track's line records. What it adds is occasions: each return of the link multicasts an unprobed record with the cache-flush bit (§10.2), and two machines named alike each flush the other's record from every cache on the link when their link returns. Counts and intervals are §8.3's minimum: two, one second apart (m8, m10). §6 holds on every path a returned link takes: the first announcement is owed at the later of now and one second after the record's last multicast (m7), and the second exactly one second after the first. A link that flaps without end is answered with one multicast a second and two after its last return; no path multiplies it. A query held back by §6 while an announcement is owed is answered by that announcement, at the same instant it was owed. Nothing is being probed when a link drops, since nothing probes. One thing a reader should know: an announcement that falls due while the link is down is handed to [udp], refused for want of a route, counted node.name-unsent and recorded by the responder as multicast; the return of the link then owes two more, the first up to one second later than §6 needs.

What is not built. Stopping was right. On this head PENDING_PER_NEIGHBOUR is 8; the 16 and the test that would turn are #781's, a draft, and the test's file is outside this fence. My reading of the three questions, from the scenarios and the code, for the brief of that slice:

1. A waiting datagram must not hold back the socket's later datagrams to other hops: US-26 and §U4.6 (4) of the datagram specification forbid it, and US-26's test must stay green. If a sender keeps what [ip]'s queue has no room for, the wait is per socket and next hop, never per socket. FIFO within a socket (§U4.6 (3)) then holds per destination hop. The closed sender mixes sockets and so can only wait per hop.
2. A failed hop drops what waited for it and counts it, wherever it waited: US-27, §U4.6 (5) and the ip specification's §9.6. A connected socket hears it once, as its pending error; an unconnected one is told nothing. Nothing is kept for another try: the datagram's owner retries.
3. The DHCP client's socket needs no rule of its own. Its broadcasts have no next hop to wait on (US-28); its unicast renewals wait like any socket's and are bounded by the same TX_DATAGRAMS, and the client retransmits on its own clock, so what waits must be droppable without the client being told.

What the landing head must show. The pull request ready, and on the exact commit that lands: host concluding success, its log ending in the driver's count of steps all green; and guest / suite concluding success, having run, with toolchain not skipped. skipped on any of the three is not a reading. The orchestrator may land on reading those two, given both BLOCKERs are closed by a later round: the first by its test's red on 07fbe3c7b and green on the new head with the gates of the body run again there, the second by the guest check itself.

SEND BACK

[Japabu]

Round 2, answering the round-1 review (#788 (comment)) finding by finding. Head 65961d1aa: round 2's commit 436570ec9 and origin/main at 44871bee9 (#781) merged in. The body is rewritten to this head.

BLOCKER 1: a socket that never held the permission sends a link broadcast — fixed

Measured first. The test the review names, at the shard, run on 07fbe3c7b with the patch below and nothing else (cargo test --locked -p toyos-net-shard --test udp --no-fail-fast): exit 101, three red, each on a frame to the link's broadcast address:

---- s_udp_us_021_shard_a_datagram_accepted_for_a_host_is_no_broadcast_after_a_renewal_narrows_the_prefix stdout ----
assertion `left == right` failed: closed: false
  left: [(MacAddr([255, 255, 255, 255, 255, 255]), "UDP 192.0.2.127 from port 5000")]
 right: []

---- s_udp_us_021_shard_a_datagram_accepted_for_the_router_is_no_broadcast_after_a_renewal_widens_the_prefix stdout ----
assertion `left == right` failed
  left: [(MacAddr([255, 255, 255, 255, 255, 255]), "UDP 192.0.2.255 from port 5000")]
 right: []

---- s_udp_us_021_shard_a_datagram_carries_the_permission_of_its_call stdout ----
assertion `left == right` failed
  left: [(MacAddr([255, 255, 255, 255, 255, 255]), "UDP 192.0.2.127 from port 5000"), (MacAddr([255, 255, 255, 255, 255, 255]), "UDP 192.0.2.127 from port 5002")]
 right: [(MacAddr([255, 255, 255, 255, 255, 255]), "UDP 192.0.2.127 from port 5000")]

test result: FAILED. 3 passed; 3 failed; 0 ignored; 0 measured; 0 filtered out
EXIT=101

The control is the branch's tests with one function emptied: refused_a_broadcast reads a counter and a log line the base does not have, so on the base only the frames are asserted. Its closed: true arm is not reached there, the open arm failing first; m14 below is that arm's own control.

Then closed, by what is queued and not by a second check.

• [udp]'s Queued has the field broadcast, set in submit from what the socket holds at the call. The closed sender's queue is Queueds.
• toyos_net_ip::UdpOut has the field broadcast: a struct literal names every field, and Udp::serve is its one maker outside tests. This is the change to [ip]'s egress signature the brief allowed.
• Ip::send_udp refuses NextHop::Broadcast to a datagram without it: ip.broadcast-not-permitted, counted and logged by Log::refuse with the destination as its peer, through the shard's one-line-a-rule-in-10-s log like [ip]'s other logged rules. The decision is on the route of the moment the frame would be built, the one place the link destination is chosen.
• Node::transmit ends in the pass over the log lines, so the line is out with that opportunity.
• The widened case and the closed sender are tests of their own (above); the node's a_datagram_accepted_for_a_host_is_no_broadcast_after_the_server_renews_a_narrower_prefix reaches it from a server's ACK; [ip]'s s_udp_us_021_ip_no_link_broadcast_without_the_datagrams_permission holds the rule at send_udp.
• Green at 65961d1aa (cargo test --locked -p toyos-net-shard, 50 passed, exit 0), red under m12 to m18.
• The track's line now says the permission goes with the datagram and names the tests; a stage 3 departure line records that the readers' specifications ask the permission at the call alone and list no such logged rule.

BLOCKER 2: no guest measurement at this head — CI's, and run once locally

cargo test --test toyos-build, the whole suite, once at 65961d1aa: exit 0, 36 passed of 36, with uptime reading load averages 52.48 42.92 40.65 before and 65.07 59.60 50.45 after on a shared 14-core host. CI's guest / suite on the head that lands is still the reading the review asks for.

NOTEs

• Two ways out of Stack for a log line — fixed as described: Stack::refusals is the one drain of the shard, Report::Refused, its arm in settle and report's own drain are gone, and the inbox is a queue of Fate, a type with no log line in it. Node::log is the one caller, from settle, udp_send_to and transmit.
• "Still to build on it: the move" — the paragraph now names what is left: datagram senders that wait on the hop, then the move. After the merge of toyos-net-node: a query known not to have reached its resolver is not waited out, an ICMP error ends nothing, and a burst of lookups reaches the wire #781 it is toyos-net-node: a query known not to have reached its resolver is not waited out, an ICMP error ends nothing, and a burst of lookups reaches the wire #781's sentence less the broadcast permission, which is built; toyos-net-node: a query known not to have reached its resolver is not waited out, an ICMP error ends nothing, and a burst of lookups reaches the wire #781's two lines carry that slice's owner and exits, and no line's exit reads "before the move" without it.
• The name line's exit rests on an issue that describes a path the tree no longer has — issues/netstack-answers-for-its-name-without-claiming-it.md is rewritten to be true of toyos-mdns: it announces and re-announces a record it has not probed (RFC 6762 §8.1, §8.3, §10.2), what a returning link multiplies, its owner, and an exit: probing before announcing at start-up and at a link's return, with its tests. The body says probing is the next stage of toyos-mdns and not this one.
• "No behaviour of the shipped responder changes" — the body now says what it rests on: the responder's twelve host tests unchanged, the shipped shell's suite, netstack calling on and owed_at only, and the guest suite once locally; and that CI's on the landing head is the reading.
• An announcement falling due while the link is down (asked, not a finding) — measured and kept as the rule: §6 is a least interval, which a multicast held sent and never sent only lengthens, and §8.3's two leave after the return. Said at userland/netstack/node/src/name.rs's header, and held by an_announcement_due_with_the_link_down_is_counted_and_the_links_return_owes_both (counted node.name-unsent, nothing on the wire, then 1 s and 2 s after the unsent one and never a third).

Mutations, round 2

Each applied to the clean head 65961d1aa with git apply --recount, built with cargo test --locked --no-run and run with cargo test --locked --no-fail-fast over -p toyos-mdns -p toyos-net-node -p toyos-net-udp -p toyos-net-shard -p toyos-net-ip, then reversed; the script refuses a dirty tree before the first and after each. m1 to m4 and m6 to m10 are round 1's patches unchanged; m5 and m11 are rewritten for the files round 2 changed (m11 was "the pass drops every other report" and is now "taking a line drops the reports before it", since refusals is the one drain and dropping every report reds every lease test); m12 to m18 are new. m0 is every source file of the change as on the merge base under the tests as they stand.

mutation	build	tests	red
m0-the-node-shard-udp-and-ip-sources-as-on-the-base	101	not run
m1-the-refusal-is-invalid-input-again	0	101	a_broadcast_needs_its_permission, a_refusal_is_logged_by_the_call_that_met_it, each_refusal_is_answered_in_the_pipes_word_for_it
m2-the-node-hands-the-permission-to-nobody	0	101	a_broadcast_needs_its_permission
m3-a-permission-given-is-never-taken-back	0	101	a_broadcast_needs_its_permission
m4-udp-asks-no-permission	0	101	a_broadcast_needs_its_permission, a_refusal_is_logged_by_the_call_that_met_it, each_refusal_is_answered_in_the_pipes_word_for_it, s_udp_us_021_broadcast_needs_permission
m5-a-send-ends-without-the-pass-over-the-log-lines	0	101	a_refusal_is_logged_by_the_call_that_met_it
m6-the-node-tells-the-name-nothing-of-the-link	0	101	a_held_name_is_announced_again_when_the_link_returns, an_announcement_due_with_the_link_down_is_counted_and_the_links_return_owes_both
m7-a-returned-link-is-announced-inside-the-second-of-the-last-multicast	0	101	a_held_name_is_announced_again_when_the_link_returns, an_announcement_due_with_the_link_down_is_counted_and_the_links_return_owes_both, tests::a_link_that_returns_is_announced_twice_a_second_apart_and_no_sooner_than_a_second_after_the_last_multicast
m8-a-returned-link-is-announced-once	0	101	a_held_name_is_announced_again_when_the_link_returns, an_announcement_due_with_the_link_down_is_counted_and_the_links_return_owes_both, tests::a_link_that_returns_is_announced_twice_a_second_apart_and_no_sooner_than_a_second_after_the_last_multicast
m9-a-returned-link-owes-a-record-with-no-address	0	101	tests::a_link_that_returns_is_announced_twice_a_second_apart_and_no_sooner_than_a_second_after_the_last_multicast
m10-a-new-address-is-announced-once	0	101	a_held_lease_is_announced_at_once_and_a_second_later, a_held_name_is_announced_again_when_the_link_returns, a_lease_already_held_is_announced_as_the_name_is_told, a_query_from_off_the_link_is_not_answered, a_query_in_a_frame_to_the_groups_address_reaches_the_responder, a_second_query_inside_a_second_waits_for_the_second_to_end, an_announcement_due_with_the_link_down_is_counted_and_the_links_return_owes_both, an_answer_goes_to_the_group_or_to_the_asker_as_the_query_asked, an_answer_to_a_link_local_asker_goes_to_its_own_link_address, an_answer_udp_refuses_is_counted_and_dropped, every_response_leaves_with_ttl_255, no_cut_of_a_query_is_answered, tests::a_link_that_returns_is_announced_twice_a_second_apart_and_no_sooner_than_a_second_after_the_last_multicast, tests::the_record_is_multicast_at_most_once_a_second_and_a_query_inside_it_waits
m11-the-pass-over-the-log-lines-drops-the-report-before-them	0	101	lease::tests::the_log_lines_are_taken_and_the_report_before_them_keeps_its_turn
m12-ip-asks-no-permission-of-a-datagram-it-broadcasts	0	101	a_datagram_accepted_for_a_host_is_no_broadcast_after_the_server_renews_a_narrower_prefix, s_udp_us_021_ip_no_link_broadcast_without_the_datagrams_permission, s_udp_us_021_shard_a_datagram_accepted_for_a_host_is_no_broadcast_after_a_renewal_narrows_the_prefix, s_udp_us_021_shard_a_datagram_accepted_for_the_router_is_no_broadcast_after_a_renewal_widens_the_prefix, s_udp_us_021_shard_a_datagram_carries_the_permission_of_its_call
m13-udp-queues-every-datagram-as-permitted	0	101	a_datagram_accepted_for_a_host_is_no_broadcast_after_the_server_renews_a_narrower_prefix, s_udp_us_021_shard_a_datagram_accepted_for_a_host_is_no_broadcast_after_a_renewal_narrows_the_prefix, s_udp_us_021_shard_a_datagram_accepted_for_the_router_is_no_broadcast_after_a_renewal_widens_the_prefix, s_udp_us_021_shard_a_datagram_carries_the_permission_of_its_call
m14-a-closed-sockets-datagrams-are-permitted	0	101	s_udp_us_021_shard_a_datagram_accepted_for_a_host_is_no_broadcast_after_a_renewal_narrows_the_prefix
m15-a-datagram-leaves-under-its-sockets-permission-of-the-moment	0	101	s_udp_us_021_shard_a_datagram_carries_the_permission_of_its_call
m16-ip-counts-the-refused-broadcast-and-logs-nothing	0	101	a_datagram_accepted_for_a_host_is_no_broadcast_after_the_server_renews_a_narrower_prefix, s_udp_us_021_ip_no_link_broadcast_without_the_datagrams_permission, s_udp_us_021_shard_a_datagram_accepted_for_a_host_is_no_broadcast_after_a_renewal_narrows_the_prefix, s_udp_us_021_shard_a_datagram_accepted_for_the_router_is_no_broadcast_after_a_renewal_widens_the_prefix, s_udp_us_021_shard_a_datagram_carries_the_permission_of_its_call
m17-a-transmit-ends-without-the-pass-over-the-log-lines	0	101	a_datagram_accepted_for_a_host_is_no_broadcast_after_the_server_renews_a_narrower_prefix
m18-the-refused-broadcast-is-counted-and-leaves	0	101	a_datagram_accepted_for_a_host_is_no_broadcast_after_the_server_renews_a_narrower_prefix, s_udp_us_021_ip_no_link_broadcast_without_the_datagrams_permission, s_udp_us_021_shard_a_datagram_accepted_for_a_host_is_no_broadcast_after_a_renewal_narrows_the_prefix, s_udp_us_021_shard_a_datagram_accepted_for_the_router_is_no_broadcast_after_a_renewal_widens_the_prefix, s_udp_us_021_shard_a_datagram_carries_the_permission_of_its_call

The control patch, on 07fbe3c7b

diff --git a/toyos-net-shard/tests/udp.rs b/toyos-net-shard/tests/udp.rs
index a7058b15a..7a4e2d9d0 100644
--- a/toyos-net-shard/tests/udp.rs
+++ b/toyos-net-shard/tests/udp.rs
@@ -1,13 +1,20 @@
-//! UDP through the shard: what nobody takes is answered by [ip], and what the network says about
-//! a connected socket's datagrams reaches it.
+//! UDP through the shard: what nobody takes is answered by [ip], what the network says about a
+//! connected socket's datagrams reaches it, and a datagram leaves under the broadcast permission
+//! it was accepted with, whatever prefix the address has been renewed with since.
 
 mod common;
 
+use std::net::Ipv4Addr;
 use std::time::Duration;
 
 use common::*;
+use toyos_net_shard::Shard;
 use toyos_net_testnet::Fate;
 use toyos_net_udp::{Error, SocketError};
+use toyos_net_wire::ethernet::{Frame, MacAddr};
+use toyos_net_wire::ipv4::Ipv4Packet;
+use toyos_net_wire::udp::UdpDatagram;
+use toyos_net_wire::Instant;
 
 #[test]
 fn s_udp_us_035_shard_no_socket_is_a_port_unreachable() {
@@ -52,3 +59,90 @@ fn s_ip_icd_012_shard_a_resolution_failure_reaches_the_connected_socket() {
     net.advance(Duration::from_millis(1));
     assert_eq!(net.nodes[a].shard.recv_from(socket, &mut buf), Err(Error::Failed(SocketError::Unreachable)));
 }
+
+/// One host of 192.0.2.0/24, and the directed broadcast address of 192.0.2.0/25 (RFC 922 §7).
+const EDGE_OF_25: Ipv4Addr = Ipv4Addr::new(192, 0, 2, 127);
+/// The directed broadcast address of 192.0.2.0/24, which under 192.0.2.0/25 is a host off the link.
+const EDGE_OF_24: Ipv4Addr = Ipv4Addr::new(192, 0, 2, 255);
+/// A router both prefixes hold.
+const ROUTER_IN_25: Ipv4Addr = Ipv4Addr::new(192, 0, 2, 126);
+
+/// One transmit opportunity with all the credit the shard wants: each frame's link destination
+/// and, of a UDP datagram, its destination and source port; any other frame by its name.
+fn opportunity(shard: &mut Shard, now: Instant) -> Vec<(MacAddr, String)> {
+    let mut left = Vec::new();
+    shard.transmit(now, usize::MAX, |bytes| {
+        let frame = Frame::parse(bytes).expect("a frame");
+        let udp = Ipv4Packet::parse(frame.body()).ok().and_then(|ip| UdpDatagram::parse(&ip).ok().map(|udp| format!("UDP {} from port {}", ip.destination(), udp.source_port().map_or(0, |p| p.get()))));
+        left.push((frame.destination(), udp.unwrap_or_else(|| name(bytes))));
+    });
+    left
+}
+
+/// The control's stand-in: the base has no counter and no line to read, so only the frames are
+/// asserted.
+fn refused_a_broadcast(_: &mut Shard, _: Ipv4Addr, _: u64) {}
+
+// US-21 (decision U-4) across a renewal: the prefix is a DHCP server's value, and a renewal
+// rewrites it under a held address. A datagram a socket without the permission had accepted for
+// one host of the /24 is, once the address is renewed as a /25, addressed to that prefix's
+// directed broadcast: it leaves in no frame, to the link's broadcast address or any other, and is
+// counted and logged. A socket closed with the datagram accepted changes nothing: the closed
+// sender's datagrams carry what their socket was permitted.
+#[test]
+fn s_udp_us_021_shard_a_datagram_accepted_for_a_host_is_no_broadcast_after_a_renewal_narrows_the_prefix() {
+    for closed in [false, true] {
+        let (mut net, a, _) = segment();
+        let now = net.now();
+        let shard = &mut net.nodes[a].shard;
+        shard.drain_events().for_each(drop);
+        let socket = shard.bind(Ipv4Addr::UNSPECIFIED, Some(port(5000)), || 0).unwrap();
+        assert_eq!(shard.send_to(now, socket, EDGE_OF_25, 5001, b"hi"), Ok(()), "one host of the /24");
+        if closed {
+            shard.udp_close(now, socket).unwrap();
+        }
+        assert_eq!(shard.add_address(now, A, 25), Ok(()), "the renewal");
+        assert_eq!(opportunity(shard, now), [], "closed: {closed}");
+        refused_a_broadcast(shard, EDGE_OF_25, 1);
+        assert_eq!(opportunity(shard, now), [], "and it is gone, not waiting");
+    }
+}
+
+// The same across a renewal that widens the prefix: under the /25 192.0.2.255 is a host behind
+// the router, and under the /24 it is the directed broadcast.
+#[test]
+fn s_udp_us_021_shard_a_datagram_accepted_for_the_router_is_no_broadcast_after_a_renewal_widens_the_prefix() {
+    let (mut net, a, _) = segment();
+    let now = net.now();
+    let shard = &mut net.nodes[a].shard;
+    shard.add_address(now, A, 25).unwrap();
+    shard.set_gateways(now, &[ROUTER_IN_25]).unwrap();
+    shard.drain_events().for_each(drop);
+    let socket = shard.bind(Ipv4Addr::UNSPECIFIED, Some(port(5000)), || 0).unwrap();
+    assert_eq!(shard.send_to(now, socket, EDGE_OF_24, 5001, b"hi"), Ok(()), "a host behind the router");
+    assert_eq!(shard.add_address(now, A, 24), Ok(()), "the renewal");
+    assert_eq!(opportunity(shard, now), []);
+    refused_a_broadcast(shard, EDGE_OF_24, 1);
+}
+
+// The permission is the one the socket held at the call (POSIX's `SO_BROADCAST` is read by the
+// send): given after a datagram was accepted it covers nothing accepted before, and taken back
+// it still covers what was accepted under it.
+#[test]
+fn s_udp_us_021_shard_a_datagram_carries_the_permission_of_its_call() {
+    let (mut net, a, _) = segment();
+    let now = net.now();
+    let shard = &mut net.nodes[a].shard;
+    shard.drain_events().for_each(drop);
+    let permitted = shard.bind(Ipv4Addr::UNSPECIFIED, Some(port(5000)), || 0).unwrap();
+    let unpermitted = shard.bind(Ipv4Addr::UNSPECIFIED, Some(port(5002)), || 0).unwrap();
+    shard.udp_set_broadcast(permitted, true).unwrap();
+    for socket in [permitted, unpermitted] {
+        assert_eq!(shard.send_to(now, socket, EDGE_OF_25, 5001, b"hi"), Ok(()));
+    }
+    shard.udp_set_broadcast(permitted, false).unwrap();
+    shard.udp_set_broadcast(unpermitted, true).unwrap();
+    assert_eq!(shard.add_address(now, A, 25), Ok(()), "the renewal");
+    assert_eq!(opportunity(shard, now), [(MacAddr::BROADCAST, "UDP 192.0.2.127 from port 5000".to_string())]);
+    refused_a_broadcast(shard, EDGE_OF_25, 1);
+}

The mutation patches

m1-the-refusal-is-invalid-input-again

--- a/userland/netstack/node/src/datagram.rs
+++ b/userland/netstack/node/src/datagram.rs
@@ -80,3 +80,3 @@
         | Counter::ExceedsMtu => Refused::InvalidInput,
-        Counter::BroadcastNotPermitted => Refused::PermissionDenied,
+        Counter::BroadcastNotPermitted => Refused::InvalidInput,
         Counter::TxQueueFull => Refused::ResourceExhausted,

m2-the-node-hands-the-permission-to-nobody

--- a/userland/netstack/node/src/datagram.rs
+++ b/userland/netstack/node/src/datagram.rs
@@ -127,3 +127,3 @@
     pub fn udp_set_broadcast(&mut self, id: DatagramId, permitted: bool) -> Result<(), Refused> {
-        self.stack.set_broadcast(id.0, permitted).map_err(refused)
+        self.stack.set_broadcast(id.0, permitted && false).map_err(refused)
     }

m3-a-permission-given-is-never-taken-back

--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -375,3 +375,3 @@
     pub fn set_broadcast(&mut self, id: SocketId, permitted: bool) -> Result<(), Error> {
-        self.socket(id).map(|s| s.broadcast = permitted)
+        self.socket(id).map(|s| s.broadcast |= permitted)
     }

m4-udp-asks-no-permission

--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -487,3 +487,3 @@
             Some(rule)
-        } else if broadcast && !broadcast_permitted {
+        } else if broadcast && !broadcast_permitted && false {
             Some(Counter::BroadcastNotPermitted)

m5-a-send-ends-without-the-pass-over-the-log-lines

diff --git a/userland/netstack/node/src/datagram.rs b/userland/netstack/node/src/datagram.rs
index b40ad1f5c..2a73a47a2 100644
--- a/userland/netstack/node/src/datagram.rs
+++ b/userland/netstack/node/src/datagram.rs
@@ -132,3 +132,2 @@ impl Node {
         let sent = self.stack.send_to(now, id.0, destination, port, payload).map_err(refused);
-        self.log();
         sent

m6-the-node-tells-the-name-nothing-of-the-link

--- a/userland/netstack/node/src/lib.rs
+++ b/userland/netstack/node/src/lib.rs
@@ -166,3 +166,2 @@
             if let Some(name) = &mut self.name {
-                name.link_returned(now);
             }

m7-a-returned-link-is-announced-inside-the-second-of-the-last-multicast

--- a/userland/netstack/mdns/src/lib.rs
+++ b/userland/netstack/mdns/src/lib.rs
@@ -233,3 +233,3 @@
         if self.link.is_some() {
-            self.owed_ms = Some(self.group_free_ms(now_ms));
+            self.owed_ms = Some(now_ms);
             self.again = true;

m8-a-returned-link-is-announced-once

--- a/userland/netstack/mdns/src/lib.rs
+++ b/userland/netstack/mdns/src/lib.rs
@@ -234,3 +234,2 @@
             self.owed_ms = Some(self.group_free_ms(now_ms));
-            self.again = true;
         }

m9-a-returned-link-owes-a-record-with-no-address

--- a/userland/netstack/mdns/src/lib.rs
+++ b/userland/netstack/mdns/src/lib.rs
@@ -232,3 +232,3 @@
     pub fn link_returned(&mut self, now_ms: u64) {
-        if self.link.is_some() {
+        if true {
             self.owed_ms = Some(self.group_free_ms(now_ms));

m10-a-new-address-is-announced-once

--- a/userland/netstack/mdns/src/lib.rs
+++ b/userland/netstack/mdns/src/lib.rs
@@ -213,3 +213,2 @@
             self.owed_ms = Some(now_ms);
-            self.again = true;
         }

m11-the-pass-over-the-log-lines-drops-the-report-before-them

diff --git a/userland/netstack/node/src/lease.rs b/userland/netstack/node/src/lease.rs
index 9398ca4d3..334685916 100644
--- a/userland/netstack/node/src/lease.rs
+++ b/userland/netstack/node/src/lease.rs
@@ -192,2 +192,3 @@ impl Stack {
                     line(refusal, suppressed);
+                    self.inbox.clear();
                     continue;

m12-ip-asks-no-permission-of-a-datagram-it-broadcasts

diff --git a/toyos-net-ip/src/egress.rs b/toyos-net-ip/src/egress.rs
index 273329f36..e2f829a27 100644
--- a/toyos-net-ip/src/egress.rs
+++ b/toyos-net-ip/src/egress.rs
@@ -302,3 +302,3 @@ impl Ip {
         let sent = self.route(out.destination, source, None).and_then(|route| {
-            if route.next_hop == NextHop::Broadcast && !out.broadcast {
+            if route.next_hop == NextHop::Broadcast && !out.broadcast && false {
                 self.log.refuse(Counter::IpBroadcastNotPermitted, route.iface, Peer::Ip(out.destination));

m13-udp-queues-every-datagram-as-permitted

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 88c38d216..2bf4e3dcc 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -526,3 +526,3 @@ impl Udp {
         let ttl = if destination.is_multicast() { multicast_ttl } else { ttl };
-        socket.tx.push_back(Queued { source, destination, port, ttl, broadcast: broadcast_permitted, payload: payload.to_vec() });
+        socket.tx.push_back(Queued { source, destination, port, ttl, broadcast: true, payload: payload.to_vec() });
         socket.tx_bytes = bytes;

m14-a-closed-sockets-datagrams-are-permitted

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 88c38d216..9a6966f7e 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -577,3 +577,3 @@ impl Udp {
         }
-        self.closed.extend(socket.tx.into_iter().take(room).map(|q| (socket.port, q)));
+        self.closed.extend(socket.tx.into_iter().take(room).map(|q| (socket.port, Queued { broadcast: true, ..q })));
         if !self.closed.is_empty() && !core::mem::replace(&mut self.closed_offered, true) {

m15-a-datagram-leaves-under-its-sockets-permission-of-the-moment

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 88c38d216..17a169e2c 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -715,2 +715,3 @@ impl Udp {
                 };
+                let queued = Queued { broadcast: socket.broadcast, ..queued };
                 socket.tx_bytes = socket.tx_bytes.saturating_sub(queued.payload.len());

m16-ip-counts-the-refused-broadcast-and-logs-nothing

diff --git a/toyos-net-ip/src/egress.rs b/toyos-net-ip/src/egress.rs
index 273329f36..21954964e 100644
--- a/toyos-net-ip/src/egress.rs
+++ b/toyos-net-ip/src/egress.rs
@@ -303,3 +303,3 @@ impl Ip {
             if route.next_hop == NextHop::Broadcast && !out.broadcast {
-                self.log.refuse(Counter::IpBroadcastNotPermitted, route.iface, Peer::Ip(out.destination));
+                self.log.count(Counter::IpBroadcastNotPermitted);
                 return Err(Counter::IpBroadcastNotPermitted);

m17-a-transmit-ends-without-the-pass-over-the-log-lines

diff --git a/userland/netstack/node/src/lib.rs b/userland/netstack/node/src/lib.rs
index 3a2ca566c..b3d90ed7a 100644
--- a/userland/netstack/node/src/lib.rs
+++ b/userland/netstack/node/src/lib.rs
@@ -155,4 +155,2 @@ impl Node {
         let sent = self.stack.transmit(now, credit, sink);
-        // A datagram [ip] refused as it left is a line of this opportunity.
-        self.log();
         self.pass(now, true);

m18-the-refused-broadcast-is-counted-and-leaves

diff --git a/toyos-net-ip/src/egress.rs b/toyos-net-ip/src/egress.rs
index 273329f36..509fd1840 100644
--- a/toyos-net-ip/src/egress.rs
+++ b/toyos-net-ip/src/egress.rs
@@ -304,3 +304,2 @@ impl Ip {
                 self.log.refuse(Counter::IpBroadcastNotPermitted, route.iface, Peer::Ip(out.destination));
-                return Err(Counter::IpBroadcastNotPermitted);
             }

The script

#!/bin/sh
# Applies each mutation to a clean tree, builds, runs the five crates' suites, and restores.
# usage: mutate.sh <worktree> <patch dir> <log dir> <round>
set -u
W=$1; P=$2; L=$3; R=$4
cd "$W" || exit 2
CRATES="-p toyos-mdns -p toyos-net-node -p toyos-net-udp -p toyos-net-shard -p toyos-net-ip"
SUMMARY=$L/$R-mutations.summary
: > "$SUMMARY"
clean() { [ -z "$(git status --porcelain --ignore-submodules=none)" ]; }
clean || { echo "dirty tree before" >> "$SUMMARY"; exit 2; }
echo "head $(git rev-parse HEAD)" >> "$SUMMARY"
for patch in "$P"/m*.patch; do
  name=$(basename "$patch" .patch)
  git apply --check --recount "$patch" || { echo "$name: does not apply" >> "$SUMMARY"; exit 2; }
  git apply --recount "$patch"
  git diff > "$L/$R-$name.diff"
  cargo test --locked --no-run $CRATES > "$L/$R-$name-builds.log" 2>&1; b=$?
  echo "EXIT=$b" >> "$L/$R-$name-builds.log"
  if [ $b -eq 0 ]; then
    cargo test --locked --no-fail-fast $CRATES > "$L/$R-$name.log" 2>&1; t=$?
    echo "EXIT=$t" >> "$L/$R-$name.log"
    red=$(grep -E '^test .* \.\.\. FAILED$' "$L/$R-$name.log" | sed -E 's/^test (.*) \.\.\. FAILED$/\1/' | tr '\n' ' ')
  else
    t="not run"; red=""
  fi
  git apply -R --recount "$patch"
  clean || { echo "$name: dirty tree after" >> "$SUMMARY"; exit 2; }
  echo "$name | build $b | tests $t | $red" >> "$SUMMARY"
done
# m0: every source file of the change as on the base, the tests as they stand.
BASE=$(git merge-base HEAD origin/main)
SRC="toyos-net-ip/src toyos-net-shard/src toyos-net-udp/src userland/netstack/node/src"
git diff "$BASE" HEAD -- $SRC userland/netstack/mdns/src/lib.rs > "$L/$R-m0-forward.diff"
git checkout -q "$BASE" -- $SRC
cargo test --locked --no-run $CRATES > "$L/$R-m0-builds.log" 2>&1; b=$?
echo "EXIT=$b" >> "$L/$R-m0-builds.log"
git checkout -q HEAD -- $SRC
clean || { echo "m0: dirty tree after" >> "$SUMMARY"; exit 2; }
echo "m0-the-node-shard-udp-and-ip-sources-as-on-the-base | build $b | tests not run |" >> "$SUMMARY"
echo DONE >> "$SUMMARY"

[Japabu]

Review, round 2, of 65961d1aa against origin/main at 44871bee9, by .claude/agents/reviewer.md. Read, not run: git diff 07fbe3c7b 436570ec9, the merge's hand resolution (git show --remerge-diff 65961d1aa), every file round 2 changed whole, the control's log, the nineteen mutation diffs and the r2b-* step logs at this head.

Growth: git diff --shortstat origin/main...65961d1aa is 18 files, +604 -81. Production +146 -46, tests +422 -21, the track and the issue +36 -14. Round 2's production growth is the carried permission ([ip] +12 -3, [udp] +7 -2) and the one drain, which replaces as much as it adds; accepted.

Round 1's BLOCKERs

• A socket that never held the permission sends a link broadcast: CLOSED. The control (cargo test --locked -p toyos-net-shard --test udp --no-fail-fast on 07fbe3c7b with the posted patch): exit 101, three red, each on a frame to ff:ff:ff:ff:ff:ff where none is expected (192.0.2.127 narrowed, 192.0.2.255 widened, and port 5002's frame beside port 5000's in the third). At 65961d1aa: cargo test --locked -p toyos-net-shard, 50 passed, exit 0. m12 to m18 at 65961d1aa, each build 0 and tests 101, red where they should be: m12 and m18 at [ip]'s test, the three shard tests and the node's; m13 at the shard's three and the node's; m14 at the narrowed test alone, which is its closed arm; m15 at the permission-of-the-call test alone; m16 at all five; m17 at the node's test alone. The closed arm is not reached by the control on the base (the open arm fails first), and m14 is its control.
• No guest measurement at this head: CLOSED. cargo test --test toyos-build at 65961d1aa: exit 0, 36 passed, 36 total, load averages 52.48 before and 65.07 after on 14 cores, liveness ceilings paid at 1.00x. The landing condition stands as round 1 gave it; see "What the landing head must show".

BLOCKER

None.

NOTE

• toyos-net-ip/src/egress.rs:303 and :344 — the permission is asked in send_udp, one call above the arm that writes MacAddr::BROADCAST, and own reaches that arm for [ip]'s ICMP messages without being asked — move the refusal into datagram's NextHop::Broadcast arm with the permission its argument, own passing false; then no sender inside [ip] can pick the link's broadcast address unasked, and m12, m16 and m18 apply to the one arm and are run again there. Today ICMP is kept from it by admit's source rule in the same call (IN-05) and not by the egress.
• issues/toyos-has-its-own-network-stack.md:55 — "their IP specification's list of logged rules has none for a datagram" — false of the record: ip.source-route and ip.fragment are a datagram's; it has none for one that leaves. Prose.
• Pull request body, rule 1 — "The check is where the link destination is chosen" — it is in the caller of that function until the first NOTE is done. Prose.

Asked, not findings

Is the wrong state unrepresentable. For a transport, yes. UdpOut is a public struct of public fields with no constructor and no Default, so nothing outside [ip] hands it a datagram without naming broadcast; Udp::serve is its one maker outside tests, and it copies Queued.broadcast, which submit alone writes, from the socket at the call. By sender: the DHCP client's socket is given the permission in Shard::acquisition before any send, so its broadcasts carry it; the responder's socket holds none, and an answer queued for an asker whose address a renewal turns into a broadcast is now refused like a client's; the resolver's sockets hold none and connect refuses a broadcast peer; TCP's hop takes NextHop::Neighbour or answers unreachable, by pattern; a datagram [ip] already holds for a next hop leaves to that neighbour's link address or not at all (nud::leave writes the resolved MAC). Inside [ip] it is a check and not a shape: the first NOTE.

A connected socket hears NextHopFailed for the refusal. Not a finding, and no word of its own. send_udp reports every refusal of that call to the flow as unreachable, on main already: no route and a full queue are heard in the same word, so what the word tells its one reader is that the datagram did not leave, which is true here and is what the resolver acts on. US-27 is the only scenario in which a connected socket hears of a datagram [ip] dropped, and the readers have none for a datagram refused at the route for another reason. The socket's next send after that error is refused in the exact word at the call, since submit then reads the peer as a broadcast. No client holds a connected datagram socket until the pipe ABI has a connect; a second word would have one producer and no reader that acts differently on it.

The departure. Justified. US-21 is met unchanged: the permission is still asked at the call, s_udp_us_021_broadcast_needs_permission is unchanged and red under m4. What is added is a second asking at the route, for a state no scenario of the readers' builds, a prefix that changes under a queued datagram; and decision U-4 has the refusal logged, so a logged counter for it follows the readers' own decision rather than departing from it. MOD-02's own expectation, 1,000 ip.not-for-us and no line, is untouched; what moved is the list of logged names that test also holds. It is recorded where a reader of the scenarios looks: the track's list of what stage 3 departs from, beside US-43, DH-64 and NUD-04, naming US-21, the test and an exit the readers can meet.

The down-link announcement. Right. RFC 6762 §6 is a least interval between multicasts of a record, so a record held multicast that never left can only lengthen it; §8.3's two, a second apart, both leave after the return, which §8 asks. an_announcement_due_with_the_link_down_is_counted_and_the_links_return_owes_both pins the choice: a responder told of the unsent one would announce 300 ms after it, and the test wants more than 999 ms; m6, m7, m8 and m10 are red at it. The header line is a contract of the module and the reason for a surprising decision; allowed.

The NOTEs of round 1. Closed. Stack::refusals is the one drain of the shard (lease.rs:189 is the only drain_events in the node's sources), Report::Refused and report's own drain are gone, and the inbox is a queue of Fate, which has no line in it; the mapping of [ip]'s four address events to Report is what it was. The track says what is left, and after the merge each stage's lines stand: against 44871bee9 the track differs in the paragraph (the broadcast permission moved from "still to build" to "in the tree"), the broadcast line, the logged-refusal line, which is gone with its exit met, the name's line, and the one added departure; #781's two lines and its NUD-04 departure are whole, and every test and issue those lines cite exists at this head. The issue is true of toyos-mdns and of dhcp::HOSTNAME, cites no path the tree lacks, has the track for its owner and an exit tests can fail.

#787. It touches no crate of this stage: its sources are userland/libc and tests/, and its guest test runs on netstack on smoltcp, where this stage's only shipped change is Responder::on. It does collide in the track: git merge-tree 65961d1aa <#787's head> conflicts in the broadcast line, whose last sentence #787 rewrites, and #787 deletes issues/libc-sends-from-a-datagram-socket-it-never-bound.md, which that sentence on this branch still cites. Whichever lands second is merged by hand; if it is this one, the line takes #787's ending, or it cites a deleted document, which is a BLOCKER at that head.

What the landing head must show. The first NOTE done, with the five crates' suites and m12, m16 and m18 at that head in the body; if #787 is under it, the merge as above. Then, the pull request ready, on the exact commit that lands: host concluding success, its log ending in the driver's count of steps all green; and guest / suite concluding success, having run, with toolchain not skipped, 37 tests with libc_sockets among them if #787 is under it. The three checks read skipping on the draft today, which is no reading. The orchestrator may land on reading those two if the head differs from 65961d1aa by the named change and a merge of main alone; anything else in the diff is another round.

LAND AFTER NAMED CHANGES

[Japabu]

Round 3, the named changes of the round-2 review, at 108232f24 (e8a806cc8 and a merge of origin/main at 9cf2c4e5c, #787).

The egress hunk (git diff 65961d1aa e8a806cc8 -- toyos-net-ip/src/egress.rs)

diff --git a/toyos-net-ip/src/egress.rs b/toyos-net-ip/src/egress.rs
index 273329f36..bbc49fdfb 100644
--- a/toyos-net-ip/src/egress.rs
+++ b/toyos-net-ip/src/egress.rs
@@ -300,10 +300,6 @@ impl Ip {
         };
         let source = if out.source.is_unspecified() { Source::Unspecified } else { Source::Bound(out.source) };
         let sent = self.route(out.destination, source, None).and_then(|route| {
-            if route.next_hop == NextHop::Broadcast && !out.broadcast {
-                self.log.refuse(Counter::IpBroadcastNotPermitted, route.iface, Peer::Ip(out.destination));
-                return Err(Counter::IpBroadcastNotPermitted);
-            }
             let builder = Ipv4Builder {
                 source: Ipv4Source::new(route.source).map_err(|_| Counter::RouteNoSourceAddress)?,
                 destination: out.destination,
@@ -312,7 +308,7 @@ impl Ip {
                 options: &[],
                 payload: out.datagram,
             };
-            self.datagram(now, &route, &builder, FrameKind::Datagram, Some(flow), Some(frame))
+            self.datagram(now, &route, &builder, FrameKind::Datagram, out.broadcast, Some((flow, frame)))
         });
         if sent.is_err() {
             self.log.event(Event::Unreachable(flow));
@@ -321,19 +317,21 @@ impl Ip {
     }
 
     /// Sends one of [ip]'s own ICMP messages along `route`, into the control queue or held for
-    /// its next hop.
+    /// its next hop, and never in a link broadcast.
     pub(crate) fn own<P: Payload>(&mut self, now: Instant, route: &Route, builder: &Ipv4Builder<'_, P>, kind: FrameKind) {
-        let _ = self.datagram(now, route, builder, kind, None, None);
+        let _ = self.datagram(now, route, builder, kind, false, None);
     }
 
+    /// The one place a datagram's link destination is chosen: the link's broadcast address only
+    /// with `broadcast`, and a transport's datagram comes with its flow and its frame.
     fn datagram<P: Payload>(
         &mut self,
         now: Instant,
         route: &Route,
         builder: &Ipv4Builder<'_, P>,
         kind: FrameKind,
-        flow: Option<Flow>,
-        out: Option<&mut [u8; FRAME]>,
+        broadcast: bool,
+        transport: Option<(Flow, &mut [u8; FRAME])>,
     ) -> Result<Sent, Counter> {
         if builder.length().map_or(true, |len| len > MTU) {
             self.log.count(Counter::IpExceedsMtu);
@@ -341,6 +339,10 @@ impl Ip {
         }
         let Some((i, mut cx)) = self.split(now, route.iface) else { return Err(Counter::UnknownInterface) };
         let (destination, hold) = match route.next_hop {
+            NextHop::Broadcast if !broadcast => {
+                cx.log.refuse(Counter::IpBroadcastNotPermitted, route.iface, Peer::Ip(builder.destination));
+                return Err(Counter::IpBroadcastNotPermitted);
+            }
             NextHop::Broadcast => (MacAddr::BROADCAST, None),
             NextHop::Multicast(group) => (MacAddr::multicast(group), None),
             NextHop::Neighbour(addr) => {
@@ -357,6 +359,7 @@ impl Ip {
             }
         };
         let mac = i.mac;
+        let (flow, out) = transport.unzip();
         if let Some(addr) = hold {
             let frame = build_vec(mac, destination, builder).ok_or(Counter::IpExceedsMtu)?;
             nud::hold(i, &mut cx, addr, Held { frame, kind, flow });

The eighth argument would have tripped clippy::too_many_arguments; the flow and the frame, which were Some together and None together, are one Option of the pair instead of an allow.

The test added (toyos-net-ip/tests/icmp.rs)

own does reach the arm without defeating admit: an error is routed at port_unreachable, a call after the receive that admitted its datagram, and a prefix that becomes usable in between makes the admitted source a directed broadcast.

diff --git a/toyos-net-ip/tests/icmp.rs b/toyos-net-ip/tests/icmp.rs
index 4e0fe80fb..1483839e2 100644
--- a/toyos-net-ip/tests/icmp.rs
+++ b/toyos-net-ip/tests/icmp.rs
@@ -614,3 +614,22 @@ fn s_icmp_046_no_error_to_a_source_that_is_no_host() {
     }
     assert_eq!(h.count(Counter::IpInvalidSource), 4);
 }
+
+// An error of [ip]'s own is routed when it is generated, which is after its datagram was admitted:
+// a prefix that becomes usable in between can make the datagram's source its directed broadcast.
+// The error then leaves in no link broadcast: it is counted and logged against that address.
+#[test]
+fn an_error_whose_next_hop_became_a_broadcast_is_refused_and_counted() {
+    let mut h = H::fixture_i();
+    let source = ip4(192, 0, 2, 127);
+    let Some(Delivery::Udp(arrival, _)) = h.datagram(&hi_from(source)) else { panic!("a host's datagram is admitted") };
+    h.ip.add_address(h.clock(), h.if0, ip4(192, 0, 2, 3), 25).unwrap();
+    h.run(3_000);
+    assert_eq!(h.ip.address(h.if0, ip4(192, 0, 2, 3)), Some(toyos_net_ip::AddrState::Assigned));
+    h.rebase();
+    h.ip.port_unreachable(h.clock(), &arrival);
+    let rule = Counter::IpBroadcastNotPermitted;
+    assert_eq!(h.out().iter().map(Out::to).collect::<Vec<_>>(), [], "nothing left");
+    assert_eq!((h.count(rule), h.count(Counter::IcmpErrorSuppressed), h.count(Counter::IcmpErrorsSent)), (1, 0, 0));
+    assert_eq!(h.refusals(rule), [toyos_net_ip::Refusal { rule, iface: h.if0, peer: Peer::Ip(source) }]);
+}

m12, m16 and m18, cut again against the arm

m12-ip-asks-no-permission-of-a-datagram-it-broadcasts.patch

diff --git a/toyos-net-ip/src/egress.rs b/toyos-net-ip/src/egress.rs
index bbc49fdfb..c11054ef9 100644
--- a/toyos-net-ip/src/egress.rs
+++ b/toyos-net-ip/src/egress.rs
@@ -339,7 +339,7 @@ impl Ip {
         }
         let Some((i, mut cx)) = self.split(now, route.iface) else { return Err(Counter::UnknownInterface) };
         let (destination, hold) = match route.next_hop {
-            NextHop::Broadcast if !broadcast => {
+            NextHop::Broadcast if !broadcast && false => {
                 cx.log.refuse(Counter::IpBroadcastNotPermitted, route.iface, Peer::Ip(builder.destination));
                 return Err(Counter::IpBroadcastNotPermitted);
             }

m16-ip-counts-the-refused-broadcast-and-logs-nothing.patch

diff --git a/toyos-net-ip/src/egress.rs b/toyos-net-ip/src/egress.rs
index bbc49fdfb..046c5c6e0 100644
--- a/toyos-net-ip/src/egress.rs
+++ b/toyos-net-ip/src/egress.rs
@@ -340,7 +340,7 @@ impl Ip {
         let Some((i, mut cx)) = self.split(now, route.iface) else { return Err(Counter::UnknownInterface) };
         let (destination, hold) = match route.next_hop {
             NextHop::Broadcast if !broadcast => {
-                cx.log.refuse(Counter::IpBroadcastNotPermitted, route.iface, Peer::Ip(builder.destination));
+                cx.log.count(Counter::IpBroadcastNotPermitted);
                 return Err(Counter::IpBroadcastNotPermitted);
             }
             NextHop::Broadcast => (MacAddr::BROADCAST, None),

m18-the-refused-broadcast-is-counted-and-leaves.patch

diff --git a/toyos-net-ip/src/egress.rs b/toyos-net-ip/src/egress.rs
index bbc49fdfb..001954367 100644
--- a/toyos-net-ip/src/egress.rs
+++ b/toyos-net-ip/src/egress.rs
@@ -341,7 +341,7 @@ impl Ip {
         let (destination, hold) = match route.next_hop {
             NextHop::Broadcast if !broadcast => {
                 cx.log.refuse(Counter::IpBroadcastNotPermitted, route.iface, Peer::Ip(builder.destination));
-                return Err(Counter::IpBroadcastNotPermitted);
+                (MacAddr::BROADCAST, None)
             }
             NextHop::Broadcast => (MacAddr::BROADCAST, None),
             NextHop::Multicast(group) => (MacAddr::multicast(group), None),

Each applied with git apply --check then git apply on the clean head, built with cargo test --locked --no-run over the five crates, run with cargo test --locked --no-fail-fast over them, reversed, and the tree checked clean:

head 108232f240fd646676e2168c19ad1975d88cca34
m12-ip-asks-no-permission-of-a-datagram-it-broadcasts | build 0 | tests 101 | s_udp_us_021_ip_no_link_broadcast_without_the_datagrams_permission an_error_whose_next_hop_became_a_broadcast_is_refused_and_counted a_datagram_accepted_for_a_host_is_no_broadcast_after_the_server_renews_a_narrower_prefix s_udp_us_021_shard_a_datagram_accepted_for_the_router_is_no_broadcast_after_a_renewal_widens_the_prefix s_udp_us_021_shard_a_datagram_accepted_for_a_host_is_no_broadcast_after_a_renewal_narrows_the_prefix s_udp_us_021_shard_a_datagram_carries_the_permission_of_its_call 
m16-ip-counts-the-refused-broadcast-and-logs-nothing | build 0 | tests 101 | s_udp_us_021_ip_no_link_broadcast_without_the_datagrams_permission an_error_whose_next_hop_became_a_broadcast_is_refused_and_counted a_datagram_accepted_for_a_host_is_no_broadcast_after_the_server_renews_a_narrower_prefix s_udp_us_021_shard_a_datagram_accepted_for_a_host_is_no_broadcast_after_a_renewal_narrows_the_prefix s_udp_us_021_shard_a_datagram_carries_the_permission_of_its_call s_udp_us_021_shard_a_datagram_accepted_for_the_router_is_no_broadcast_after_a_renewal_widens_the_prefix 
m18-the-refused-broadcast-is-counted-and-leaves | build 0 | tests 101 | s_udp_us_021_ip_no_link_broadcast_without_the_datagrams_permission an_error_whose_next_hop_became_a_broadcast_is_refused_and_counted a_datagram_accepted_for_a_host_is_no_broadcast_after_the_server_renews_a_narrower_prefix s_udp_us_021_shard_a_datagram_accepted_for_a_host_is_no_broadcast_after_a_renewal_narrows_the_prefix s_udp_us_021_shard_a_datagram_carries_the_permission_of_its_call s_udp_us_021_shard_a_datagram_accepted_for_the_router_is_no_broadcast_after_a_renewal_widens_the_prefix 
DONE

Each is red at the five tests it was red at in round 2, and at the new one.

Exits at 108232f24

head 108232f240fd646676e2168c19ad1975d88cca34
test-mdns | 0 | cargo test --locked -p toyos-mdns
test-node | 0 | cargo test --locked -p toyos-net-node
test-udp | 0 | cargo test --locked -p toyos-net-udp
test-shard | 0 | cargo test --locked -p toyos-net-shard
test-ip | 0 | cargo test --locked -p toyos-net-ip
test-netstack | 0 | cargo test --locked --manifest-path userland/netstack/Cargo.toml
clippy | 0 | cargo clippy --locked -p toyos-mdns -p toyos-net-node -p toyos-net-udp -p toyos-net-shard -p toyos-net-ip --all-targets --keep-going -- -W clippy::checked_conversions -W clippy::default_trait_access -W clippy::manual_midpoint -W clippy::redundant_clone -W clippy::unchecked_time_subtraction -W clippy::unnecessary_semicolon -D warnings
source-gates | 0 | cargo test --locked --lib -- hostws:: userlandhost:: sourcegate:: licence::
ci-host | 1 | cargo run -- --ci host
build-only | 0 | cargo run -- --build-only
tree        0
DONE

The ci-host | 1 row is the first run: 1 of 78 steps red, the licences step, whose cargo metadata could not resolve the crates.io index in a network outage on the development machine. Run again with the network back: cargo run -- --ci host, exit 0, Host: 78 step(s), all green.

Counts: toyos-mdns 13, toyos-net-node 141, toyos-net-udp 59, toyos-net-shard 50, toyos-net-ip 273, netstack 29, the source gates 45; 0 failed in each.

Guest suite, once: cargo test --test toyos-build, exit 0, 37 passed, 37 total, libc_sockets PASS; uptime load averages 46.68 57.64 59.42 before and 54.70 57.26 59.08 after, 14 cores, liveness ceilings paid at 1.00x.

The merge

One conflict, the track's broadcast line: this branch's line with #787's last sentence. #787's other hunk in the track merged by itself. git grep -F for each of the four issue files #787 deleted, by path and by bare name, finds no line.

[Japabu]

CI at 108232f24, read from each job's own log (the orchestrator). host: [ci] Host: 79 step(s), all green, with a_broadcast_needs_its_permission, a_refusal_is_logged_by_the_call_that_met_it, a_held_name_is_announced_again_when_the_link_returns and the named change's an_error_whose_next_hop_became_a_broadcast_is_refused_and_counted each ok by name. guest / suite: test result: ok. 37 passed, 37 total, libc_sockets among them, [ci] Guest: 5 step(s), all green, no FAIL line. The head differs from the reviewed 65961d1aa by round 2's named change and a merge of main (#787). git merge-tree against main at 9cf2c4e5c exits 0 with no conflict.