toyos-net-udp: a datagram waits for its next hop in its own sender; [ip] takes none it cannot frame and holds only its own messages; a failed hop drops what waited; the node reads a refused query in the opportunity that refused it

[Japabu]

Stage "datagram senders" of the move to ToyOS's own stack: the two lines issues/toyos-has-its-own-network-stack.md kept from #781, the resolver's burst and the report read late, are closed here. toyos-net-udp, toyos-net-ip, toyos-net-shard and toyos-net-node ship in nothing, so every test is a host test and no guest test reaches the change: what ships links toyos-dns and toyos-mdns, neither of which this touches.

Head 554bac968, the merge of origin/main at 975d5702a (#791) into 9afecafb4, the head round 3 reviewed. The merge was clean: three files both sides changed merged without a conflict, issues/toyos-has-its-own-network-stack.md, userland/netstack/node/tests/lease.rs and userland/netstack/node/tests/listeners.rs. Of the stack's sources it moved one, the node's listeners.rs, which is #791's alone; nothing of toyos-net-udp, toyos-net-ip, toyos-net-shard or toyos-dhcp moved. #791's three listener tests run on this branch's shard here for the first time and are green, each ... ok in r4-suite-toyos-net-node.log: a_handshake_reset_before_it_ends_leaves_the_next_connection_its_listeners_option, a_listener_holds_the_option_its_listen_named_from_its_first_connection and an_accept_answers_the_option_of_a_stream_its_own_pass_let_go.

What changed, per decision

1. A datagram waits for its next hop in its own sender, and [ip] takes none it cannot frame.

• Ip::send_udp answers in one call: Sent::Frame, a refusal it counts and reports to the flow as it always did, or Sent::Pending(next_hop) for a datagram it did not take, whose next hop it has asked for. It holds nothing of a transport's.
• Udp::serve(sender, offer) offers a sender's datagrams in the order it accepted them, and offer answers each Offer::Taken or Offer::Waits(next_hop). One that waits stays where it is, marked with its hop, and is passed over until that hop is named again.
• The shard maps [ip]'s answer and decides nothing: Pending is Waits, everything else is Taken. It asks no route and peeks no neighbour for a datagram, and a datagram's route is looked up once as it leaves. [tcp]'s hop reads as it did on main.
• The wait is per socket and next hop, never per socket (the review of toyos-net-node: a datagram socket's broadcast permission, which each datagram keeps to the route it leaves by; a logged refusal out of the call that met it; and the name announced again when the link returns #788's first decision). A waiting datagram holds back no later one to another hop: US-26's own test is unchanged and green. FIFO holds per next hop, a datagram accepted after the hop resolved included. The closed sender is one queue of many sockets' datagrams and waits per datagram the same way.

2. A failed hop drops what waited for it and counts it (the second decision; US-27).

• Udp::fail(next_hop), called on [ip]'s Event::Failed, drops every datagram that waited for that hop, in a socket or in the closed sender, in the call that reports the failure. That is the one drop [ip] cannot make, and the only thing udp.tx-unreachable counts. A connected socket whose datagram it was hears SocketError::NextHopFailed once; no other socket is told. Nothing is kept: a host that answers after the hold-down brings out no datagram of before.
• A datagram that never waited and cannot leave as its turn comes, for want of a route, for a next hop [ip] holds failed or for a full neighbour table, is [ip]'s refusal, as on main: [ip]'s counter (route.*, nb.failed-refused, nb.table-full), Event::Unreachable, Udp::unreachable. There is one path to it. Round 1's Offer::Unreachable, lost in serve and the shard's two arms are deleted.
• The full neighbour table, the one case the review named as a candidate for a second path: [ip] answers it. The shard now makes one call for a datagram, send_udp, which is the call s_ip_nud_022_a_full_table_evicts_in_order makes, and that test reads nb.table-full = 1 for one datagram refused. No variant is kept for it.
• US-27 names [ip] as the one that drops and counts a datagram that waited. Here [udp] does, since that is where it waited. Recorded as a departure, below.

3. [ip]'s queue for a next hop holds [ip]'s own messages alone, and the types say so.

• The transport half of that queue is deleted: Sent::Held, Held.flow, FrameKind::Datagram, the Event::Unreachable a dropped held datagram raised, and the interface's bound refusing a transport's datagram. What is left holds an echo reply or an ICMP error. The shard's unreachable! went with the state it guarded.
• The scenarios that filled the queue with UDP datagrams fill it with echo replies, which carry their data where a UDP datagram carries its own: NUD-01 to NUD-05, NUD-23, NUD-29 to NUD-31, OUT-08, NBR-08, NBR-14 and the test of two next hops. No test is deleted and none added: the five suites count what they counted at round 1.
• What those scenarios said of the sender lives where the sender now waits. A datagram released when its hop answers: US-26's shard test. Its order: US-26's order test. The sender told when resolution fails (NUD-02, ICD-12): Event::Failed in [ip]'s tests, and s_ip_icd_012_shard_a_resolution_failure_reaches_the_connected_socket through the shard. The bound (NUD-04, NUD-05): the socket's own queue, US-25's two tests. The link going down (NUD-23): US-24's shard test. The notices NUD-05, NUD-23 and NUD-29 expect for a dropped datagram are gone, since nobody is told of a message of [ip]'s own; the track records the departure by scenario id.

4. The DHCP client's socket has no rule of its own (the third decision). Its broadcasts are never asked to wait. Its unicast renewal waits in the client's socket like any datagram and is dropped when [ip] gives the server up; the socket is not connected, so the client hears nothing, keeps its lease and asks again on its own clock.

5. The broadcast permission stays on the queued datagram, and [ip] reads the route of the moment it leaves: a datagram that waited for a host which a renewal has since made a prefix's broadcast address leaves in a link broadcast only if its socket held the permission at the call.

6. PENDING_PER_NEIGHBOUR is 8 again, s_ip_nud_004_overflow_drops_the_oldest is the scenario's ten again, now of [ip]'s own messages, and the resolver's compile-time assertion is deleted.

7. Node::transmit takes the draws and carries the lookups on. A query for a resolver [ip] holds failed is accepted and refused by [ip] at its turn, inside a transmit opportunity. The node reads that in the same opportunity, and sends the query asked in its place in it while credit lasts. This is the first of the two exits the track offered for the late report; the second, a refusal in the call, would have answered a client's unconnected socket with an error, which the second decision rules out.

8. limits::TX_BYTES is a constant no send reaches. 16 datagrams of at most 1,472 bytes are 23,552, under its 65,536. The count kept beside the queue, and the per-send sum round 1 put in its place, are deleted; a const assertion says the product fits, so a larger MTU or queue that made the bound bind fails the build.

Bounds

• What waits is bounded by the queue it waits in: limits::TX_DATAGRAMS, 16 a socket, refused in the call past it as udp.tx-queue-full; and limits::CLOSED_DATAGRAMS, 16 for every closed socket together. Neither is new and nothing was added beside them: Queued gains one Option<Ipv4Addr> and a port.
• Nothing grows with what the wire sends: a reply or a failure only removes marks or datagrams. A client can make a socket hold 16 waiting datagrams, which it could already make it hold.
• Udp::wake and Udp::fail walk every socket's queue once per event; [ip] makes such an event only for a next hop the machine itself asked for.
• [ip]'s own messages held for next hops are bounded as before, 8 a next hop and 64 an interface (s_ip_nud_005_the_interface_holds_at_most_64, m20), and a transport's datagram no longer counts against either.

What the move must still do with this

• Hand Node::transmit its draws. The track's stage 5 paragraph says so.
• Show udp.tx-unreachable wherever it shows [udp]'s counters.
• Nothing else: a full queue is still Refused::ResourceExhausted, which the shell already maps.

Outside the first brief's files

• toyos-dhcp/tests/common/mod.rs, one line: its harness calls Udp::serve, whose closure now answers an Offer.
• toyos-net-ip/src/egress.rs, nud.rs and [ip]'s scenario tests, by the round-2 brief, for the third decision. Beside them iface.rs and lib.rs, comments the deletion made false.

What is left, on the track

• One queue a socket, for every next hop. With 16 datagrams waiting for one hop, the socket's sends to every destination are refused until the hop answers or fails. s_udp_us_025_what_waits_for_a_next_hop_is_bounded_by_its_sockets_queue holds it as it stands. Owner: the worker of the move; due by the move's first run on the T14 or in a guest.
• A link that returns before a transmit opportunity. A link that goes down drops no waiting datagram by itself: each is handed to [ip] again at the next opportunity and refused for want of a route. If the link is back first it waits for its next hop anew and leaves when the hop answers, where the readers' link-down rule drops it. a_waiting_datagram_whose_link_returns_before_an_opportunity_waits_anew_and_leaves (toyos-net-shard/tests/udp.rs, beside US-24's shard test, under no scenario id since it holds a departure from NUD-23) holds it as it stands: after link down and up, the opportunity carries the address's announcement and an ARP request for the hop, route.no-source-address and udp.tx-unreachable stay 0, and the datagram leaves after the reply. The track's line names the test. Owner: the worker of the move; closed before the move, by that test with its last assertion inverted, finding the datagram gone, or by the specifications having it wait and the test standing as it is.
• Round 1's other two lines are closed by this round: [ip] takes no transport's datagram into a queue, and a datagram's route is looked up once.
• Two departure lines under stage 3: the specification has the datagram wait in [ip] and [ip] count its drop; and it fills [ip]'s queue with UDP datagrams.

Checks (devices and a trust boundary)

• Wire input. The paths a frame can now take are an ARP reply or announcement that resolves a hop, which un-marks datagrams, and nothing else; a failure is a deadline. No byte of a frame is read outside toyos-net-wire. This round adds no unreachable! and removes one. The crates forbid indexing, arithmetic side effects, unwrap, expect and panic outside tests, and clippy is green.
• Liveness. A datagram is marked waiting only on Sent::Pending, which [ip] answers only when nud::send answered that the entry is INCOMPLETE, new or already there, with its request queued. INCOMPLETE ends in Event::Resolved, Event::Failed, or a link going down, which bumps the routing generation: Udp::wake, Udp::fail, Udp::wake_all. These are the three ends the round-1 review checked; what changed is that one call of [ip]'s makes the answer where two adjacent ones did.
• Oracles. RFC 4861 §7.2.2 and RFC 1122 §2.3.2.1 for giving a hop up, RFC 2131 §4.4.5 for the renewal and the rebinding request, RFC 1035 §4.2.1 for the next resolver. Every frame the node emits is read by etherparse. The scenarios are the readers': US-21, US-24 to US-28, US-53, and the NUD, OUT, NBR and ICD ids above.
• Negative controls. Thirty mutations: twenty-nine at 86e685857 and m31 at 9afecafb4, whose sources are the same. None was run again at the merged head: the merge moved one source file of these crates, the node's listeners.rs, which no mutation patches. Each is a checked patch applied to the clean head, built, run with cargo test --locked --no-fail-fast -p toyos-net-udp -p toyos-net-ip -p toyos-net-shard -p toyos-net-node -p toyos-dhcp, and reversed by one script that refuses a dirty tree before and after. Patches, script and the run's summary are in the round-2 mutations comment, m31's in the round-3 comment. Every one built (exit 0) and turned the suites red (exit 101). None stayed green.
• m00 is no mutation. It is the whole source change reverted onto the base with the tests as here: the build exits 101, because the tests name Offer, Sent::Pending, udp.tx-unreachable and the draws. It claims no behaviour. m01 is the control for the central decision.

mutation	red
m01: the shard takes a datagram [ip] did not	55
m02: a waiting datagram holds back the sender's later ones	6: US-26's own test, the order test, the shard's and the closed sender's among them
m03: a resolved hop wakes nothing	56
m04: a failed hop drops nothing	10
m06: a dropped datagram's connected socket is not told	6
m07: a socket that is not connected is told	4
m08: the shard does not wake [udp] on a resolved hop	50
m09: the shard does not tell [udp] of a failed hop	7
m10: a change of routes wakes no datagram	2: the route-goes test and the waited-broadcast test, through the shard
m11: a resolved hop wakes every waiting datagram	1: a_resolved_next_hop_wakes_the_senders_that_waited_for_it_and_no_other
m12: a queued datagram carries no permission of its call	5: US-21's
m13: [ip] has a datagram wait for a hop it has given up	6: NUD-14, NUD-22's two, the node's 4 s test and same-opportunity test, [udp]'s US-27
m14: [ip] tells no flow of its refusal	5: the node's 4 s test and same-opportunity test, [udp]'s US-27, two of [ip]'s own
m15: the node carries no lookup on in transmit	2: the 4 s test and the same-opportunity test
m16: the query asked in a dropped one's place waits for the next opportunity	1: the same-opportunity test
m17: [ip]'s queue for a next hop is 16	1: s_ip_nud_004_overflow_drops_the_oldest
m18: what waits is not counted against the socket's queue	2: US-25's two
m19: [ip] tells the flow of a datagram it did not take	31
m20: [ip] holds its own messages without the interface's bound	2: NUD-05, NUD-29
m21: [ip] holds none of its own messages	17
m22: a failed hop counts no message it dropped	2: NUD-02, the two-next-hops test
m23: a link that goes down counts no message it dropped	1: NUD-23
m24: eviction takes an entry with released messages as any other	1: NUD-29
m25: an idle lifetime deletes an entry with released messages	2: NUD-30, NUD-31
m26: a full queue drops the newest	1: NUD-04
m27: released messages leave newest first	9: NUD-03 and OUT-08 among them
m28: an UNREACHABLE entry whose request waits is idle	1: NUD-31
m29: a released message leaves to the link address it was built for	11: NBR-08 and NBR-14 among them
m30: a failed hop is not reported	18: ICD-12 and NUD-02 among them
m31: a change of routes wakes no datagram, at the round-3 head	3: the link-returns test, the route-goes test and the waited-broadcast test

• m13 and m14 hold the composed stack's answer. With the harness's copy of the shard's question gone, the decision they mutate is [ip]'s, and they are red at the node's two tests, which run the shard itself, as well as at [udp]'s and [ip]'s.
• Why one test sits inside the shard. a_resolved_next_hop_wakes_the_senders_that_waited_for_it_and_no_other reads the round, which is private: that a waiting sender costs nothing until its own hop changes shows on no wire. No other test is red on m11.

The track's exits, as met

• The burst test finds every query on the wire once the resolver answers ARP, with the queue at 8: a_burst_at_a_resolver_not_yet_resolved_is_on_the_wire_once_the_resolver_answers_arp, which also finds [ip] holding none. Its neighbour is a_clients_datagrams_behind_the_burst_wait_in_their_own_socket_and_take_no_querys_place: sixteen datagrams of a client's behind the sixteen queries, all thirty-two on the wire.
• The 4 s test finds its lookup ended at the 4 s it started: a_query_for_a_resolver_ip_has_given_up_ends_its_lookup_in_the_opportunity_that_would_have_carried_it, whose premise is now [ip]'s nb.failed-refused.

Gates

At 554bac968, the head:

command	exit	log
cargo run -- --ci host (Host: 78 step(s), all green; clippy, warnings denied: clean)	0	r4-ci-host.log
cargo run -- --build-only	0	r4-build-only.log
cargo test --locked -p toyos-net-shard (57 passed, 0 failed)	0	r4-suite-toyos-net-shard.log
cargo test --locked -p toyos-net-node (147 passed, 0 failed: round 3's 144 and #791's three)	0	r4-suite-toyos-net-node.log

At 9afecafb4, which the head's merge follows:

command	exit	log
cargo run -- --ci host (Host: 78 step(s), all green; clippy, warnings denied: clean)	0	r3-ci-host.log
cargo test --locked -p toyos-net-shard (57 passed, 0 failed; a_waiting_datagram_whose_link_returns_before_an_opportunity_waits_anew_and_leaves ... ok)	0	r3-suite-toyos-net-shard.log
cargo test --locked -p toyos-net-node (144 passed, 0 failed)	0	r3-suite-toyos-net-node.log

At 86e685857, from which the head differs by one test file and the track:

command	exit	log
cargo run -- --ci host (Host: 78 step(s), all green; clippy, warnings denied: clean)	0	r2-ci-host.log
cargo run -- --build-only	0	r2-build-only.log
cargo test --locked -p toyos-net-udp (66 passed, 0 failed)	0	r2-suite-toyos-net-udp.log
cargo test --locked -p toyos-net-ip (273 passed, 0 failed)	0	r2-suite-toyos-net-ip.log
cargo test --locked -p toyos-net-shard (56 passed, 0 failed)	0	r2-suite-toyos-net-shard.log
cargo test --locked -p toyos-net-node (144 passed, 0 failed)	0	r2-suite-toyos-net-node.log
cargo test --locked -p toyos-dhcp (76 passed, 0 failed)	0	r2-suite-toyos-dhcp.log
cargo clippy --locked -p toyos-net-udp -p toyos-net-ip -p toyos-net-shard -p toyos-net-node -p toyos-dhcp -p toyos-dns --all-targets --keep-going -- <src/clippy.rs's ADOPTED as -W> -D warnings	0	r2-clippy.log, and the same lint inside r2-ci-host.log
cargo test --locked --lib -- hostws:: userlandhost:: sourcegate:: licence:: from the root package (45 passed)	0	r2-sourcegates.log

Each log opens with the head and its command and ends with its exit code, in the orchestrator's scratchpad under the stage's logs/; each mutation's is under logs/r2-mutations/ and logs/r3-mutations/. Each round's were written by one script run after its commit.

Not run: any guest test, as nothing that ships changed; anything on metal.

Growth

git diff --shortstat origin/main...554bac968: 28 files, +891 -272. Sources: +308 -167, of which the shard's unit test is +26: toyos-net-udp/src/lib.rs +132 -48, toyos-net-ip/src +84 -85, toyos-net-shard/src/lib.rs +51 -9, the node's sources +41 -25. Tests: +578 -101. The track: +5 -4 lines.

Round 2 by itself, git diff --shortstat 05e3dbaad 86e685857 over the stack's sources, its tests and the track, which leaves out the merge's six files: 18 files, +241 -270. Sources +135 -168; tests +101 -97; the track +5 -5.

Round 3 by itself, git diff --shortstat 86e685857 9afecafb4: 2 files, +19 -1: the test +18, the track's line +1 -1.

[udp] grows by the offer, the mark, wake, fail and their documentation. [ip] is a line smaller than on main.

Unsure of

• The lookups are passed in every transmit opportunity while any is in flight: one recv_from a query. That is what reading the report where it is made costs; with no lookup it costs nothing.
• A full neighbour table drops a datagram at once, as on main, where [tcp]'s flow waits for Event::Room. A datagram could wait for room the same way; nothing here does, and no scenario asks it.
• udp.tx still counts a datagram [ip] refused as it left, as on main: serve counts what it handed over.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

[Japabu]

Mutation patches and the script that ran them, at 05e3dbaad. Each patch is applied to the clean head with git apply --check first, built, run, and reversed; the script refuses a dirty tree before and after each. Results are in the body's table.

run.sh

#!/bin/sh
# Applies each mutation as a checked patch to a clean tree, builds, runs the five crates' suites,
# reports both exit codes and the tests that failed, and reverses the patch. Refuses a dirty tree
# before and after each.
# usage: run.sh <worktree> <mutations dir> <logs dir> [patch...]
set -u
tree=$1; dir=$2; logs=$3; shift 3
crates="-p toyos-net-udp -p toyos-net-ip -p toyos-net-shard -p toyos-net-node -p toyos-dhcp"
cd "$tree" || exit 2
[ $# -gt 0 ] || set -- "$dir"/m*.patch
for patch in "$@"; do
  name=$(basename "$patch" .patch)
  log="$logs/$name.log"
  if [ -n "$(git status --porcelain --ignore-submodules=none)" ]; then echo "$name: the tree is dirty before" ; exit 2; fi
  { echo "head $(git rev-parse HEAD)"; echo "git apply --check $name.patch"; } > "$log"
  if ! git apply --check "$patch" >> "$log" 2>&1; then echo "$name: the patch does not apply"; exit 2; fi
  git apply "$patch"
  echo "cargo test --locked --no-run $crates" >> "$log"
  cargo test --locked --no-run $crates >> "$log" 2>&1; build=$?
  echo "BUILD_EXIT=$build" >> "$log"
  tests="not run"
  if [ $build -eq 0 ]; then
    echo "cargo test --locked --no-fail-fast $crates" >> "$log"
    cargo test --locked --no-fail-fast $crates >> "$log" 2>&1; tests=$?
    echo "TEST_EXIT=$tests" >> "$log"
  fi
  git apply -R "$patch"
  if [ -n "$(git status --porcelain --ignore-submodules=none)" ]; then echo "$name: the tree is dirty after"; exit 2; fi
  red=$(grep -c '^test .* \.\.\. FAILED$' "$log")
  echo "$name build=$build tests=$tests failed=$red"
done
echo "all restored: $(git status --porcelain --ignore-submodules=none | wc -l | tr -d ' ') dirty paths"

m00-the-whole-source-change-reverted-onto-the-base.patch

diff --git a/toyos-net-ip/src/lib.rs b/toyos-net-ip/src/lib.rs
index 9cbee3f78..59be88ccf 100644
--- a/toyos-net-ip/src/lib.rs
+++ b/toyos-net-ip/src/lib.rs
@@ -108,7 +108,7 @@ pub mod limits {
         pub const FAILED_HOLD: Duration = Duration::from_secs(20);
         pub const LOCKTIME: Duration = Duration::from_secs(1);
         pub const IDLE_LIFETIME: Duration = Duration::from_secs(600);
-        pub const PENDING_PER_NEIGHBOUR: usize = 8;
+        pub const PENDING_PER_NEIGHBOUR: usize = 16;
         pub const PENDING_TOTAL: usize = 64;
         pub const TABLE_MAX: usize = 512;
     }
diff --git a/toyos-net-shard/src/lib.rs b/toyos-net-shard/src/lib.rs
index c47e74c1f..678f1f50a 100644
--- a/toyos-net-shard/src/lib.rs
+++ b/toyos-net-shard/src/lib.rs
@@ -13,12 +13,7 @@
 //! next hop is unresolved or failed builds nothing, spends nothing, and is not asked again until
 //! [ip] reports a change for that next hop, for the routes, or, to a flow a full neighbour table
 //! refused, that the table has room: a waiting flow costs one question per such change. A UDP
-//! datagram is asked the same question before [ip] is handed it: one whose next hop is unresolved
-//! stays in its sender's queue in [udp], spending nothing and charged nothing, while the sender's
-//! datagrams to other next hops leave: it is asked again when [ip] reports that hop resolved or
-//! the routes changed, and dropped when [ip] reports the hop failed. One with no route, or whose
-//! next hop [ip] holds failed or has no room for, is dropped as its turn comes. [ip] holds no
-//! sender's datagram.
+//! datagram whose next hop is unresolved waits in [ip], spending nothing and charged nothing.
 //!
 //! **Refusals.** Each crate's refusals of legacy or insecure input pass through that crate's
 //! `RefusalLog` here: at most one [`Event::Refused`] per rule in any 10 s, carrying how many
@@ -50,7 +45,7 @@ use core::net::Ipv4Addr;
 
 use toyos_net_ip::{Advice, Delivery, ErrorKind, IfIndex, Ip, Limiter, NextHop, Nud, Resolution, Sent, Source, Transport, TransportError, FRAME};
 use toyos_net_tcp::{ConnId, Endpoint, Hop, IcmpError, IcmpKind, ListenerId, Outgoing, Received, Seq, Served, Status, Tcp, Tuple};
-use toyos_net_udp::{Offer, Sender, SocketId, Udp, Verdict};
+use toyos_net_udp::{Sender, SocketId, Udp, Verdict};
 use toyos_net_udp::Served as UdpServed;
 use toyos_net_wire::ethernet::{FrameBuilder, IndividualMac, MacAddr};
 use toyos_net_wire::ipv4::{Ipv4Builder, Ipv4Source, MulticastAddr, TrafficClass, Ttl};
@@ -149,8 +144,8 @@ struct Member {
 
 /// What serving a flow did with a frame of credit.
 struct Outcome {
-    /// The length of the frame that left; none when the flow had nothing to offer, or when [ip]
-    /// refused its datagram.
+    /// The length of the frame that left; none when the flow had nothing, or when [ip] holds its
+    /// datagram for its next hop or refused it.
     frame: Option<i32>,
     /// The flow has nothing left: it leaves the round, its deficit with it.
     leaves: bool,
@@ -343,33 +338,18 @@ impl Shard {
         (done, Some(len))
     }
 
-    /// One datagram of `sender`'s, framed by [ip]: the oldest whose next hop's link address is
-    /// known, or that needs none. One [ip] refuses as it leaves makes no frame.
+    /// One datagram of `sender`'s, framed by [ip]; one [ip] holds for its next hop or refuses
+    /// leaves no frame.
     fn udp_frame(&mut self, now: Instant, sender: Sender, sink: &mut impl FnMut(&[u8])) -> Outcome {
         let Self { ip, udp, frame, .. } = self;
         let mut sent = None;
         let served = udp.serve(sender, |out| {
-            let source = if out.source.is_unspecified() { Source::Unspecified } else { Source::Bound(out.source) };
-            let Ok(route) = ip.route(out.destination, source, None) else { return Offer::Unreachable };
-            if let NextHop::Neighbour(next_hop) = route.next_hop {
-                match peek(ip, now, route.iface, next_hop, route.source) {
-                    (Resolution::Resolved(_), _) => {}
-                    (Resolution::Pending, _) => return Offer::Waits(next_hop),
-                    (Resolution::Failed, _) => return Offer::Unreachable,
-                }
-            }
-            match ip.send_udp(now, out, frame) {
-                Ok(Sent::Frame(len)) => {
-                    sent = frame.get(..len).map(|bytes| {
-                        sink(bytes);
-                        charge(bytes)
-                    });
-                }
-                Ok(Sent::Held) => unreachable!("[ip] is handed a datagram only once its next hop has a link address"),
-                // Counted by [ip], which tells the datagram's flow.
-                Err(_) => {}
+            if let Ok(Sent::Frame(len)) = ip.send_udp(now, out, frame) {
+                sent = frame.get(..len).map(|bytes| {
+                    sink(bytes);
+                    charge(bytes)
+                });
             }
-            Offer::Taken
         });
         Outcome { frame: sent, leaves: served != UdpServed::More }
     }
@@ -409,16 +389,9 @@ impl Shard {
                     }
                 }
                 toyos_net_ip::Event::Unreachable(flow) => udp.unreachable(&flow),
-                toyos_net_ip::Event::Resolved { next_hop, .. } => {
-                    wake(tcp, waiting, Wait::Hop(next_hop));
-                    udp.wake(next_hop);
-                }
-                toyos_net_ip::Event::Failed { next_hop, .. } => {
+                toyos_net_ip::Event::Resolved { next_hop, .. } | toyos_net_ip::Event::Failed { next_hop, .. } | toyos_net_ip::Event::Cleared { next_hop, .. } => {
                     wake(tcp, waiting, Wait::Hop(next_hop));
-                    udp.fail(next_hop);
                 }
-                // No datagram waits on a failed next hop: the failure dropped them.
-                toyos_net_ip::Event::Cleared { next_hop, .. } => wake(tcp, waiting, Wait::Hop(next_hop)),
                 toyos_net_ip::Event::Room { .. } => wake(tcp, waiting, Wait::Room),
                 toyos_net_ip::Event::Verified { addr, .. } => events.push(Event::Verified(addr)),
                 toyos_net_ip::Event::Conflict { addr, mac, .. } => events.push(Event::Conflict { addr, mac }),
@@ -435,7 +408,6 @@ impl Shard {
             self.routes = ip.generation();
             waiting.clear();
             tcp.wake_all();
-            udp.wake_all();
         }
         let head = self.round.front().map(|m| m.flow);
         let gone: BTreeSet<Flow> = tcp.drain_gone().map(Flow::Tcp).chain(udp.drain_gone().map(Flow::Udp)).collect();
@@ -672,33 +644,22 @@ fn hop(ip: &mut Ip, now: Instant, iface: IfIndex, tuple: &Tuple, waiting: &mut B
     let remote = tuple.remote.addr;
     let Ok(route) = ip.route(remote, Source::Bound(tuple.local.addr), Some(iface)) else { return Hop::Unreachable };
     let NextHop::Neighbour(next_hop) = route.next_hop else { return Hop::Unreachable };
-    let (answer, wait) = match peek(ip, now, iface, next_hop, route.source) {
-        (Resolution::Resolved(mac), _) => return Hop::Ready(Via { next_hop, mac }),
-        (Resolution::Pending, wait) => (Hop::Pending, wait),
-        (Resolution::Failed, wait) => (Hop::Unreachable, wait),
-    };
-    waiting.entry(wait).or_default().insert(remote);
-    answer
-}
-
-/// Whether a frame for `next_hop` can be built now, and what a flow that cannot build one waits
-/// on. The entry is peeked and does not move: only a next hop with no entry is resolved, which
-/// queues its request, preferring `source`.
-fn peek(ip: &mut Ip, now: Instant, iface: IfIndex, next_hop: Ipv4Addr, source: Ipv4Addr) -> (Resolution, Wait) {
-    match ip.neighbour(iface, next_hop) {
-        Some(entry) => {
-            let answer = match entry.mac() {
-                Some(mac) => Resolution::Resolved(mac),
-                None if matches!(entry, Nud::Failed) => Resolution::Failed,
-                None => Resolution::Pending,
-            };
-            (answer, Wait::Hop(next_hop))
-        }
-        None => match ip.resolve(now, iface, next_hop, source) {
-            Resolution::Failed => (Resolution::Failed, Wait::Room),
-            answer => (answer, Wait::Hop(next_hop)),
+    let (answer, wait) = match ip.neighbour(iface, next_hop) {
+        Some(entry) => match entry.mac() {
+            Some(mac) => (Hop::Ready(Via { next_hop, mac }), None),
+            None if matches!(entry, Nud::Failed) => (Hop::Unreachable, Some(Wait::Hop(next_hop))),
+            None => (Hop::Pending, Some(Wait::Hop(next_hop))),
+        },
+        None => match ip.resolve(now, iface, next_hop, route.source) {
+            Resolution::Resolved(mac) => (Hop::Ready(Via { next_hop, mac }), None),
+            Resolution::Pending => (Hop::Pending, Some(Wait::Hop(next_hop))),
+            Resolution::Failed => (Hop::Unreachable, Some(Wait::Room)),
         },
+    };
+    if let Some(wait) = wait {
+        waiting.entry(wait).or_default().insert(remote);
     }
+    answer
 }
 
 /// What a frame costs its flow's deficit: its length, which `FRAME` bounds and `QUANTUM` fits.
@@ -787,32 +748,6 @@ mod tests {
         }
     }
 
-    // No id: a sender all of whose datagrams wait for a next hop is out of the round, and a next
-    // hop that resolves puts back the senders that waited for it and no other: a waiting datagram
-    // costs one question per change of its own next hop.
-    #[test]
-    fn a_resolved_next_hop_wakes_the_senders_that_waited_for_it_and_no_other() {
-        const C: Ipv4Addr = Ipv4Addr::new(192, 0, 2, 3);
-        const D: Ipv4Addr = Ipv4Addr::new(192, 0, 2, 4);
-        let (mut shard, now) = verified();
-        shard.transmit(now, usize::MAX, |_| {});
-        let port = |n| Port::new(n).unwrap();
-        let (to_c, to_d) = (shard.bind(Ipv4Addr::UNSPECIFIED, Some(port(5000)), || 0).unwrap(), shard.bind(Ipv4Addr::UNSPECIFIED, Some(port(5001)), || 0).unwrap());
-        shard.send_to(now, to_c, C, 9, b"c").unwrap();
-        shard.send_to(now, to_d, D, 9, b"d").unwrap();
-        assert_eq!(shard.round.len(), 2);
-        assert_eq!(shard.transmit(now, usize::MAX, |_| {}), 2, "a request for each");
-        assert!(shard.round.is_empty(), "what waits is not served");
-
-        let mut reply = [[2, 0, 0, 0, 0, 0x0a], [2, 0, 0, 0, 0, 0x0c]].concat();
-        reply.extend_from_slice(&[0x08, 0x06, 0, 1, 8, 0, 6, 4, 0, 2, 2, 0, 0, 0, 0, 0x0c]);
-        reply.extend_from_slice(&C.octets());
-        reply.extend_from_slice(&[2, 0, 0, 0, 0, 0x0a]);
-        reply.extend_from_slice(&A.octets());
-        shard.receive(now, &reply);
-        assert_eq!(shard.round.iter().map(|m| m.flow).collect::<Vec<_>>(), [Flow::Udp(Sender::Socket(to_c))]);
-    }
-
     // No id: the head freed in its turn takes the turn with it, so the next flow's turn adds its
     // quantum; a flow behind it leaves the turn as it was.
     #[test]
diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 0454418c8..edeb93d6f 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -8,16 +8,9 @@
 //! datagrams: a send past it is refused and the caller keeps its datagram. What closed sockets
 //! had accepted is held to `limits::CLOSED_DATAGRAMS` together and is one [`Sender`] beside the
 //! sockets, so closing never starves another socket. The caller's round over senders decides
-//! whose datagram leaves next: a datagram leaves only when [`Udp::serve`] offers it to the caller
-//! and the caller takes it, and is built then. What [`Udp::drain_eligible`] and
-//! [`Udp::drain_gone`] report is held until the caller drains it, a socket closed while offered
-//! included.
-//!
-//! **A datagram waits for its next hop where it was accepted.** One the caller answers
-//! [`Offer::Waits`] stays in its sender's queue, under that queue's bound, and is passed over
-//! until [`Udp::wake`] names the hop: the sender's datagrams to other hops leave meanwhile, and
-//! those to one hop leave in the order they were accepted. One with no way out is dropped,
-//! counted, and reported to a connected socket; nothing is kept for another try.
+//! whose datagram leaves next: a datagram leaves only when [`Udp::serve`] hands it to the caller
+//! and is built then. What [`Udp::drain_eligible`] and [`Udp::drain_gone`] report is held until
+//! the caller drains it, a socket closed while offered included.
 //!
 //! **Refusals are values.** Every refusal is a named [`Counter`] and the [`Error`] the call
 //! returns; one of legacy or insecure input is also a [`Refusal`] naming the socket and the peer.
@@ -82,7 +75,6 @@ toyos_net_wire::counters! {
     RxDiscardedOnClose = "udp.rx-discarded-on-close";
     TxDiscardedOnClose = "udp.tx-discarded-on-close";
     Tx = "udp.tx";
-    TxUnreachable = "udp.tx-unreachable";
     IcmpErrorDelivered = "udp.icmp-error-delivered";
     IcmpErrorSoft = "udp.icmp-error-soft";
     IcmpErrorUnconnected = "udp.icmp-error-unconnected";
@@ -130,8 +122,7 @@ pub enum SocketError {
     Refused,
     /// An ICMP error said the way to the peer is administratively prohibited.
     Prohibited,
-    /// A datagram the socket had accepted found no way out, no route or no link address for its
-    /// next hop, or [ip] refused it as it left: it is gone.
+    /// [ip] found no link address for the next hop of a datagram it held: nothing left.
     NextHopFailed,
 }
 
@@ -193,8 +184,6 @@ struct Stored {
 #[derive(Debug)]
 struct Queued {
     source: Ipv4Addr,
-    /// The port of the socket that accepted it.
-    source_port: Port,
     destination: Ipv4Addr,
     port: Port,
     ttl: Ttl,
@@ -202,24 +191,6 @@ struct Queued {
     /// leaves is decided by this, not by what the socket holds then.
     broadcast: bool,
     payload: Vec<u8>,
-    /// The next hop whose link address it waits for: not offered until [`Udp::wake`] names it.
-    waits: Option<Ipv4Addr>,
-}
-
-impl Queued {
-    fn out(&self) -> UdpOut<'_> {
-        UdpOut {
-            source: self.source,
-            destination: self.destination,
-            ttl: self.ttl,
-            broadcast: self.broadcast,
-            datagram: UdpBuilder { source: self.source_port, destination: self.port, data: &self.payload },
-        }
-    }
-
-    fn flow(&self) -> Flow {
-        Flow { source: self.source, source_port: self.source_port, destination: self.destination, destination_port: self.port }
-    }
 }
 
 #[derive(Debug)]
@@ -232,6 +203,7 @@ struct Socket {
     rx_bytes: usize,
     rx_full: u64,
     tx: VecDeque<Queued>,
+    tx_bytes: usize,
     /// In `eligible` or the caller's round.
     offered: bool,
     pending: Option<SocketError>,
@@ -255,28 +227,14 @@ pub enum Sender {
     Closed,
 }
 
-/// What the caller did with a datagram [`Udp::serve`] offered it.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Offer {
-    /// It left [udp]: in a frame, or refused by [ip], which counted it and told its flow.
-    Taken,
-    /// The link address of this next hop is being asked for: the datagram stays with its sender
-    /// until [`Udp::wake`] names the hop.
-    Waits(Ipv4Addr),
-    /// It has no way out: no route, or a next hop [ip] has given up on or has no room for.
-    Unreachable,
-}
-
 /// What [`Udp::serve`] handed the caller.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Served {
-    /// A datagram, and another may be offered behind it.
+    /// A datagram, and another waits behind it.
     More,
-    /// The last datagram the sender may be offered: it leaves the round, and is offered again
-    /// once it has another or one of its own is woken.
+    /// The sender's last datagram: it leaves the round, and is offered again once it has another.
     Last,
-    /// Nothing: the sender has no datagram that waits for no next hop, or names a socket since
-    /// closed.
+    /// Nothing: the sender has no datagram, or names a socket since closed.
     Nothing,
 }
 
@@ -293,7 +251,7 @@ pub struct Udp {
     closed_offered: bool,
     /// Datagrams closed sockets had accepted: they still leave, at most
     /// `limits::CLOSED_DATAGRAMS` of them.
-    closed: VecDeque<Queued>,
+    closed: VecDeque<(Port, Queued)>,
     counters: Counters,
     refusals: Vec<Refusal>,
 }
@@ -391,6 +349,7 @@ impl Udp {
             rx_bytes: 0,
             rx_full: 0,
             tx: VecDeque::new(),
+            tx_bytes: 0,
             offered: false,
             pending: None,
             ttl: Ttl::DEFAULT,
@@ -566,12 +525,13 @@ impl Udp {
             Err(refusal) => return self.refuse(route_refusal(refusal), me, peer),
         };
         let socket = self.socket(id)?;
-        let held: usize = socket.tx.iter().map(|queued| queued.payload.len()).sum();
-        if socket.tx.len() >= limits::TX_DATAGRAMS || held.saturating_add(payload.len()) > limits::TX_BYTES {
+        let bytes = socket.tx_bytes.saturating_add(payload.len());
+        if socket.tx.len() >= limits::TX_DATAGRAMS || bytes > limits::TX_BYTES {
             return self.refuse(Counter::TxQueueFull, me, peer);
         }
         let ttl = if destination.is_multicast() { multicast_ttl } else { ttl };
-        socket.tx.push_back(Queued { source, source_port: local_port, destination, port, ttl, broadcast: broadcast_permitted, payload: payload.to_vec(), waits: None });
+        socket.tx.push_back(Queued { source, destination, port, ttl, broadcast: broadcast_permitted, payload: payload.to_vec() });
+        socket.tx_bytes = bytes;
         if !core::mem::replace(&mut socket.offered, true) {
             self.eligible.push(Sender::Socket(id));
         }
@@ -621,7 +581,7 @@ impl Udp {
         if socket.offered {
             self.gone.push(Sender::Socket(id));
         }
-        self.closed.extend(socket.tx.into_iter().take(room));
+        self.closed.extend(socket.tx.into_iter().take(room).map(|q| (socket.port, q)));
         if !self.closed.is_empty() && !core::mem::replace(&mut self.closed_offered, true) {
             self.eligible.push(Sender::Closed);
         }
@@ -716,8 +676,7 @@ impl Udp {
         self.count(Counter::IcmpErrorDelivered);
     }
 
-    /// A datagram of `flow` this crate had accepted will not leave: [ip] refused it as it left,
-    /// or it found no way out.
+    /// [ip] could not reach the next hop of a datagram this crate handed it.
     pub fn unreachable(&mut self, flow: &Flow) {
         if let Some(socket) = self.connected(flow) {
             socket.pending = Some(SocketError::NextHopFailed);
@@ -741,94 +700,42 @@ impl Udp {
         self.gone.drain(..)
     }
 
-    /// Offers `sender`'s datagrams in the order it accepted them, those waiting for a next hop
-    /// aside, until `offer` takes one: each is built as `offer` reads it. One `offer` answers
-    /// [`Offer::Waits`] for stays and waits; one it answers [`Offer::Unreachable`] for is dropped
-    /// and counted, and the connected socket it left from is told.
-    pub fn serve(&mut self, sender: Sender, mut offer: impl FnMut(&UdpOut<'_>) -> Offer) -> Served {
-        let (queue, offered) = match sender {
-            Sender::Closed => (&mut self.closed, &mut self.closed_offered),
+    /// The oldest datagram of `sender`, built as `sink` takes it; whether it leaves the stack then
+    /// or waits in [ip] for its next hop is the caller's.
+    pub fn serve(&mut self, sender: Sender, sink: impl FnOnce(&UdpOut<'_>)) -> Served {
+        let (port, queued, last) = match sender {
+            Sender::Closed => {
+                let Some((port, queued)) = self.closed.pop_front() else {
+                    self.closed_offered = false;
+                    return Served::Nothing;
+                };
+                let last = self.closed.is_empty();
+                self.closed_offered = !last;
+                (port, queued, last)
+            }
             Sender::Socket(id) => {
                 let Ok(socket) = self.socket(id) else { return Served::Nothing };
-                (&mut socket.tx, &mut socket.offered)
+                let Some(queued) = socket.tx.pop_front() else {
+                    socket.offered = false;
+                    return Served::Nothing;
+                };
+                socket.tx_bytes = socket.tx_bytes.saturating_sub(queued.payload.len());
+                socket.offered = !socket.tx.is_empty();
+                (socket.port, queued, !socket.offered)
             }
         };
-        let mut taken = false;
-        let mut lost = Vec::new();
-        queue.retain_mut(|queued| {
-            if taken || queued.waits.is_some() {
-                return true;
-            }
-            match offer(&queued.out()) {
-                Offer::Taken => taken = true,
-                Offer::Waits(next_hop) => queued.waits = Some(next_hop),
-                Offer::Unreachable => lost.push(queued.flow()),
-            }
-            queued.waits.is_some()
+        self.count(Counter::Tx);
+        sink(&UdpOut {
+            source: queued.source,
+            destination: queued.destination,
+            ttl: queued.ttl,
+            broadcast: queued.broadcast,
+            datagram: UdpBuilder { source: port, destination: queued.port, data: &queued.payload },
         });
-        let more = taken && queue.iter().any(|queued| queued.waits.is_none());
-        *offered = more;
-        self.counters.add(Counter::Tx, u64::from(taken));
-        self.lose(&lost);
-        match (taken, more) {
-            (true, true) => Served::More,
-            (true, false) => Served::Last,
-            (false, _) => Served::Nothing,
-        }
-    }
-
-    /// Datagrams this crate had accepted, each dropped for want of a way out.
-    fn lose(&mut self, lost: &[Flow]) {
-        self.counters.add(Counter::TxUnreachable, u64::try_from(lost.len()).unwrap_or(u64::MAX));
-        for flow in lost {
-            self.unreachable(flow);
-        }
-    }
-
-    /// [ip] gave `next_hop` up: every datagram that waited for it is dropped and counted, and
-    /// the connected socket it left from is told.
-    pub fn fail(&mut self, next_hop: Ipv4Addr) {
-        let mut lost = Vec::new();
-        let queues = self.slots.iter_mut().filter_map(|slot| slot.socket.as_mut()).map(|socket| &mut socket.tx).chain([&mut self.closed]);
-        for queue in queues {
-            queue.retain(|queued| {
-                let waited = queued.waits == Some(next_hop);
-                if waited {
-                    lost.push(queued.flow());
-                }
-                !waited
-            });
-        }
-        self.lose(&lost);
-    }
-
-    /// `next_hop`'s link address is known: the datagrams that wait for it are offered again.
-    pub fn wake(&mut self, next_hop: Ipv4Addr) {
-        self.rouse(|waits| waits == next_hop);
-    }
-
-    /// The routes changed: every waiting datagram's next hop is asked for again.
-    pub fn wake_all(&mut self) {
-        self.rouse(|_| true);
-    }
-
-    /// Ends the wait of every datagram whose next hop `woken` names, and offers its sender.
-    fn rouse(&mut self, woken: impl Fn(Ipv4Addr) -> bool) {
-        let Self { slots, closed, closed_offered, eligible, .. } = self;
-        let mut rouse = |queue: &mut VecDeque<Queued>, offered: &mut bool, sender: Sender| {
-            let mut any = false;
-            for queued in queue.iter_mut().filter(|queued| queued.waits.is_some_and(&woken)) {
-                queued.waits = None;
-                any = true;
-            }
-            if any && !core::mem::replace(offered, true) {
-                eligible.push(sender);
-            }
-        };
-        for (index, slot) in slots.iter_mut().enumerate() {
-            let (Some(socket), Ok(index)) = (&mut slot.socket, u32::try_from(index)) else { continue };
-            rouse(&mut socket.tx, &mut socket.offered, Sender::Socket(SocketId { index, generation: slot.generation }));
+        if last {
+            Served::Last
+        } else {
+            Served::More
         }
-        rouse(closed, closed_offered, Sender::Closed);
     }
 }
diff --git a/userland/netstack/node/src/datagram.rs b/userland/netstack/node/src/datagram.rs
index 99a6e04b2..b40ad1f5c 100644
--- a/userland/netstack/node/src/datagram.rs
+++ b/userland/netstack/node/src/datagram.rs
@@ -17,13 +17,6 @@
 //! accepted for a host leaves in no link broadcast, whatever prefix a server has renewed the
 //! address with since, and is dropped, counted `ip.broadcast-not-permitted` and logged instead.
 //!
-//! **A datagram waits for its next hop in its own socket**, among the `limits::TX_DATAGRAMS` it
-//! has accepted: while [ip] asks for a link address the socket's datagrams to other next hops
-//! leave, and a send past the queue is answered [`Refused::ResourceExhausted`] whatever its
-//! destination. One whose next hop [ip] gives up, or that has no way out when its turn comes, is
-//! dropped and counted `udp.tx-unreachable`, and the client is told nothing: its socket is not
-//! connected.
-//!
 //! A refusal [udp] logs is in [`Node::drain_events`] when the send that met it returns, and one
 //! [ip] logs as a datagram leaves when that [`Node::transmit`] returns; no other call of a
 //! client's meets one.
@@ -107,7 +100,6 @@ fn refused(error: Error) -> Refused {
         | Counter::RxDiscardedOnClose
         | Counter::TxDiscardedOnClose
         | Counter::Tx
-        | Counter::TxUnreachable
         | Counter::IcmpErrorDelivered
         | Counter::IcmpErrorSoft
         | Counter::IcmpErrorUnconnected
diff --git a/userland/netstack/node/src/lib.rs b/userland/netstack/node/src/lib.rs
index 4a68d7b9b..3a2ca566c 100644
--- a/userland/netstack/node/src/lib.rs
+++ b/userland/netstack/node/src/lib.rs
@@ -20,8 +20,8 @@
 //! [`Node::drain_events`].
 //!
 //! **Draws.** Each `draw` is handed to the client, whose order is its own: a call that starts an
-//! exchange draws its transaction id first. The lookups in flight draw after it, and alone in
-//! [`Node::transmit`]: an id and then a port for each query they send, and nothing else.
+//! exchange draws its transaction id first. The lookups in flight draw after it: an id and then a
+//! port for each query they send, and nothing else.
 
 #![no_std]
 #![forbid(unsafe_code)]
@@ -150,19 +150,11 @@ impl Node {
     }
 
     /// A transmit opportunity with room for `credit` frames, each handed to `sink` as it is built.
-    /// Returns how many left. A lookup's query that found no way out as its turn came is read
-    /// here, and the query asked in its place leaves in this opportunity while credit lasts.
-    pub fn transmit(&mut self, now: Instant, credit: usize, mut sink: impl FnMut(&[u8]), mut draw: impl FnMut() -> u32) -> usize {
-        let mut sent = 0usize;
-        loop {
-            sent = sent.saturating_add(self.stack.transmit(now, credit.saturating_sub(sent), &mut sink));
-            // A datagram [ip] refused as it left is a line of this opportunity.
-            self.log();
-            let asked = self.resolver.pass(now, &mut self.stack, &mut self.counters, &mut draw);
-            if !asked || sent >= credit {
-                break;
-            }
-        }
+    /// Returns how many left.
+    pub fn transmit(&mut self, now: Instant, credit: usize, sink: impl FnMut(&[u8])) -> usize {
+        let sent = self.stack.transmit(now, credit, sink);
+        // A datagram [ip] refused as it left is a line of this opportunity.
+        self.log();
         self.pass(now, true);
         sent
     }
diff --git a/userland/netstack/node/src/resolve.rs b/userland/netstack/node/src/resolve.rs
index 054fa6ac9..1dcef864a 100644
--- a/userland/netstack/node/src/resolve.rs
+++ b/userland/netstack/node/src/resolve.rs
@@ -13,17 +13,18 @@
 //! - **A query the node knows did not reach its resolver is let go**
 //!   (`toyos_dns::Lookup::on_unreached`): the lookup asks its next resolver at once, or ends
 //!   where no query's answer is read any more. The node knows it of a query [udp] refuses in the
-//!   call, which never left, is counted and holds no socket; and of one [udp] reports found no
-//!   way out, no route or no link address for its next hop, which is counted and its socket
-//!   closed. That report is read in the call that made it, a transmit opportunity included.
+//!   call, which never left, is counted and holds no socket; and of one [ip] reports it found no
+//!   next hop for, which is counted and its socket closed.
 //! - **An ICMP error is a report and not knowledge** (`toyos_dns::Lookup::on_report`): [udp]
 //!   hands a query's socket one that quotes the socket's addresses and ports and says refused or
 //!   prohibited, which takes an off-path sender the query's port to forge and not its id (RFC
 //!   8085 §5.2). It is counted, and the next resolver is asked at once; the query's socket stays
 //!   open and its answer is read, and no number of them ends a lookup.
-//! - **A query whose resolver's link address is not known yet waits in its own socket**, as
-//!   [udp] keeps every datagram: no other lookup's query and no client's datagram to that next
-//!   hop takes its place, and it leaves when the address is known.
+//! - **Every lookup's first query can wait in [ip] for one next hop at once**, where no link
+//!   address is known yet: [ip] holds `PENDING_PER_NEIGHBOUR` datagrams for a next hop it is
+//!   resolving and keeps the newest (RFC 4861 §7.2.2), which is no fewer than the lookups held
+//!   here. A datagram another socket sends to that next hop meanwhile takes a place in the same
+//!   queue.
 //! - **A lookup asks the resolvers of the lease it started under, and ends with that lease's
 //!   word**: when the held lease names other resolvers, or none is held.
 //! - **A wait is a deadline of the node's** ([`Resolver::next_deadline`]); a reply is a frame.
@@ -38,6 +39,7 @@ use alloc::vec::Vec;
 use core::net::Ipv4Addr;
 
 use toyos_dns::{Asked, Failure, Lookup, Name, Step, MAX_LOOKUPS, PORT};
+use toyos_net_ip::limits::nud::PENDING_PER_NEIGHBOUR;
 use toyos_net_udp::{Error, SocketError, SocketId};
 use toyos_net_wire::Instant;
 
@@ -45,6 +47,8 @@ use crate::lease::Stack;
 use crate::name::millis;
 use crate::{Counter, Counters, Node};
 
+const _: () = assert!(PENDING_PER_NEIGHBOUR >= MAX_LOOKUPS);
+
 /// One lookup, from [`Node::resolve`] until its answer is taken or it is let go.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
 pub struct LookupId(u64);
@@ -120,7 +124,7 @@ fn close(stack: &mut Stack, now: Instant, socket: SocketId) {
 enum Heard {
     /// A datagram of this length, now in the reply buffer.
     Reply(usize),
-    /// The stack's own word that the query never left.
+    /// [ip]'s word that the query never left.
     Unreached,
     /// An ICMP error's word that the query was refused.
     Reported,
@@ -142,8 +146,8 @@ fn waiting(queries: &[Query], stack: &mut Stack, reply: &mut [u8]) -> Option<(Qu
 
 /// Carries out `step` for `asking`, and every step the lookup answers a query [udp] refused
 /// with, then closes the socket of every query the lookup no longer reads an answer for. Returns
-/// how the lookup ended, if it did, and sets `queued` when [udp] accepted a query.
-fn act(asking: &mut Asking, mut step: Step, now: Instant, stack: &mut Stack, counters: &mut Counters, draw: &mut impl FnMut() -> u32, queued: &mut bool) -> Option<Result<Vec<[u8; 4]>, Ended>> {
+/// how the lookup ended, if it did.
+fn act(asking: &mut Asking, mut step: Step, now: Instant, stack: &mut Stack, counters: &mut Counters, draw: &mut impl FnMut() -> u32) -> Option<Result<Vec<[u8; 4]>, Ended>> {
     let done = loop {
         match step {
             Step::Ask { asked, to, query } => {
@@ -152,7 +156,6 @@ fn act(asking: &mut Asking, mut step: Step, now: Instant, stack: &mut Stack, cou
                 let resolver = Ipv4Addr::from(to);
                 if stack.connect(now, socket, resolver, PORT).is_ok() && stack.send_to(now, socket, resolver, PORT, &query).is_ok() {
                     asking.queries.push(Query { asked, socket, to });
-                    *queued = true;
                     break None;
                 }
                 counters.add(Counter::QueryUnsent, 1);
@@ -195,7 +198,7 @@ impl Resolver {
         let servers: Vec<[u8; 4]> = resolvers.iter().map(Ipv4Addr::octets).collect();
         let Some((lookup, step)) = Lookup::start(name, &servers, millis(now), || id(&mut *draw)) else { unreachable!("the lease names a resolver") };
         let mut asking = Asking { id: LookupId(self.next), lookup, resolvers, queries: Vec::new() };
-        let done = act(&mut asking, step, now, stack, counters, &mut *draw, &mut false);
+        let done = act(&mut asking, step, now, stack, counters, &mut *draw);
         if done == Some(Err(Ended::NoPort)) {
             return Err(NotStarted::ResourceExhausted);
         }
@@ -212,12 +215,10 @@ impl Resolver {
 
     /// Ends every lookup whose lease went or names other resolvers, reads every reply that
     /// reached a query's socket, and ends every wait that is over. A lookup that ended closes
-    /// its sockets and waits to be taken. Returns whether a query was queued, which the next
-    /// transmit opportunity carries.
-    pub(crate) fn pass(&mut self, now: Instant, stack: &mut Stack, counters: &mut Counters, draw: &mut impl FnMut() -> u32) -> bool {
+    /// its sockets and waits to be taken.
+    pub(crate) fn pass(&mut self, now: Instant, stack: &mut Stack, counters: &mut Counters, draw: &mut impl FnMut() -> u32) {
         let Self { asking: lookups, ended, reply, .. } = self;
         let ms = millis(now);
-        let mut queued = false;
         lookups.retain_mut(|asking| {
             let named = stack.lease().is_some_and(|lease| lease.dns == asking.resolvers);
             let mut done = if named { None } else { Some(Err(Ended::LeaseChanged)) };
@@ -236,11 +237,11 @@ impl Resolver {
                         asking.lookup.on_report(query.asked, ms, || id(&mut *draw))
                     }
                 };
-                done = act(asking, step, now, stack, counters, &mut *draw, &mut queued);
+                done = act(asking, step, now, stack, counters, &mut *draw);
             }
             if done.is_none() {
                 let step = asking.lookup.on_time(ms, || id(&mut *draw));
-                done = act(asking, step, now, stack, counters, &mut *draw, &mut queued);
+                done = act(asking, step, now, stack, counters, &mut *draw);
             }
             let Some(result) = done else { return true };
             for query in &asking.queries {
@@ -249,7 +250,6 @@ impl Resolver {
             ended.push(Resolved { id: asking.id, result });
             false
         });
-        queued
     }
 
     fn let_go(&mut self, now: Instant, id: LookupId, stack: &mut Stack) {

m01-the-shard-asks-no-question-and-ip-holds-as-on-the-base.patch

diff --git a/toyos-net-shard/src/lib.rs b/toyos-net-shard/src/lib.rs
index c47e74c1f..95e8ef06d 100644
--- a/toyos-net-shard/src/lib.rs
+++ b/toyos-net-shard/src/lib.rs
@@ -354,7 +354,7 @@ impl Shard {
             if let NextHop::Neighbour(next_hop) = route.next_hop {
                 match peek(ip, now, route.iface, next_hop, route.source) {
                     (Resolution::Resolved(_), _) => {}
-                    (Resolution::Pending, _) => return Offer::Waits(next_hop),
+                    (Resolution::Pending, _) => {}
                     (Resolution::Failed, _) => return Offer::Unreachable,
                 }
             }
@@ -365,7 +365,7 @@ impl Shard {
                         charge(bytes)
                     });
                 }
-                Ok(Sent::Held) => unreachable!("[ip] is handed a datagram only once its next hop has a link address"),
+                Ok(Sent::Held) => {}
                 // Counted by [ip], which tells the datagram's flow.
                 Err(_) => {}
             }

m02-a-waiting-datagram-holds-back-the-senders-later-ones.patch

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 0454418c8..11779a977 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -754,14 +754,19 @@ impl Udp {
             }
         };
         let mut taken = false;
+        let mut blocked = false;
         let mut lost = Vec::new();
         queue.retain_mut(|queued| {
-            if taken || queued.waits.is_some() {
+            blocked |= queued.waits.is_some();
+            if taken || blocked {
                 return true;
             }
             match offer(&queued.out()) {
                 Offer::Taken => taken = true,
-                Offer::Waits(next_hop) => queued.waits = Some(next_hop),
+                Offer::Waits(next_hop) => {
+                    queued.waits = Some(next_hop);
+                    blocked = true;
+                }
                 Offer::Unreachable => lost.push(queued.flow()),
             }
             queued.waits.is_some()

m03-a-resolved-hop-wakes-nothing.patch

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 0454418c8..b66df2dec 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -804,7 +804,7 @@ impl Udp {
 
     /// `next_hop`'s link address is known: the datagrams that wait for it are offered again.
     pub fn wake(&mut self, next_hop: Ipv4Addr) {
-        self.rouse(|waits| waits == next_hop);
+        let _ = next_hop;
     }
 
     /// The routes changed: every waiting datagram's next hop is asked for again.

m04-a-failed-hop-drops-nothing.patch

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 0454418c8..fc8dc3305 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -792,7 +792,7 @@ impl Udp {
         let queues = self.slots.iter_mut().filter_map(|slot| slot.socket.as_mut()).map(|socket| &mut socket.tx).chain([&mut self.closed]);
         for queue in queues {
             queue.retain(|queued| {
-                let waited = queued.waits == Some(next_hop);
+                let waited = queued.waits == Some(next_hop) && queued.waits.is_none();
                 if waited {
                     lost.push(queued.flow());
                 }

m05-a-datagram-with-no-way-out-is-kept.patch

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 0454418c8..18b755254 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -762,7 +762,7 @@ impl Udp {
             match offer(&queued.out()) {
                 Offer::Taken => taken = true,
                 Offer::Waits(next_hop) => queued.waits = Some(next_hop),
-                Offer::Unreachable => lost.push(queued.flow()),
+                Offer::Unreachable => queued.waits = Some(Ipv4Addr::UNSPECIFIED),
             }
             queued.waits.is_some()
         });

m06-a-dropped-datagrams-connected-socket-is-not-told.patch

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 0454418c8..ce4a68035 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -780,9 +780,6 @@ impl Udp {
     /// Datagrams this crate had accepted, each dropped for want of a way out.
     fn lose(&mut self, lost: &[Flow]) {
         self.counters.add(Counter::TxUnreachable, u64::try_from(lost.len()).unwrap_or(u64::MAX));
-        for flow in lost {
-            self.unreachable(flow);
-        }
     }
 
     /// [ip] gave `next_hop` up: every datagram that waited for it is dropped and counted, and

m07-a-socket-that-is-not-connected-is-told.patch

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 0454418c8..ea966d9f1 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -719,7 +719,7 @@ impl Udp {
     /// A datagram of `flow` this crate had accepted will not leave: [ip] refused it as it left,
     /// or it found no way out.
     pub fn unreachable(&mut self, flow: &Flow) {
-        if let Some(socket) = self.connected(flow) {
+        if let Some(socket) = self.ports.get(&flow.source_port).copied().and_then(|index| self.at(index)) {
             socket.pending = Some(SocketError::NextHopFailed);
         }
     }

m08-the-shard-does-not-wake-udp-on-a-resolved-hop.patch

diff --git a/toyos-net-shard/src/lib.rs b/toyos-net-shard/src/lib.rs
index c47e74c1f..d65dd0eec 100644
--- a/toyos-net-shard/src/lib.rs
+++ b/toyos-net-shard/src/lib.rs
@@ -411,7 +411,6 @@ impl Shard {
                 toyos_net_ip::Event::Unreachable(flow) => udp.unreachable(&flow),
                 toyos_net_ip::Event::Resolved { next_hop, .. } => {
                     wake(tcp, waiting, Wait::Hop(next_hop));
-                    udp.wake(next_hop);
                 }
                 toyos_net_ip::Event::Failed { next_hop, .. } => {
                     wake(tcp, waiting, Wait::Hop(next_hop));

m09-the-shard-does-not-tell-udp-of-a-failed-hop.patch

diff --git a/toyos-net-shard/src/lib.rs b/toyos-net-shard/src/lib.rs
index c47e74c1f..2062d2ec0 100644
--- a/toyos-net-shard/src/lib.rs
+++ b/toyos-net-shard/src/lib.rs
@@ -415,7 +415,6 @@ impl Shard {
                 }
                 toyos_net_ip::Event::Failed { next_hop, .. } => {
                     wake(tcp, waiting, Wait::Hop(next_hop));
-                    udp.fail(next_hop);
                 }
                 // No datagram waits on a failed next hop: the failure dropped them.
                 toyos_net_ip::Event::Cleared { next_hop, .. } => wake(tcp, waiting, Wait::Hop(next_hop)),

m10-a-change-of-routes-wakes-no-datagram.patch

diff --git a/toyos-net-shard/src/lib.rs b/toyos-net-shard/src/lib.rs
index c47e74c1f..1f81371e6 100644
--- a/toyos-net-shard/src/lib.rs
+++ b/toyos-net-shard/src/lib.rs
@@ -435,7 +435,6 @@ impl Shard {
             self.routes = ip.generation();
             waiting.clear();
             tcp.wake_all();
-            udp.wake_all();
         }
         let head = self.round.front().map(|m| m.flow);
         let gone: BTreeSet<Flow> = tcp.drain_gone().map(Flow::Tcp).chain(udp.drain_gone().map(Flow::Udp)).collect();

m11-a-resolved-hop-wakes-every-waiting-datagram.patch

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 0454418c8..4498e8d57 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -804,7 +804,8 @@ impl Udp {
 
     /// `next_hop`'s link address is known: the datagrams that wait for it are offered again.
     pub fn wake(&mut self, next_hop: Ipv4Addr) {
-        self.rouse(|waits| waits == next_hop);
+        let _ = next_hop;
+        self.rouse(|_| true);
     }
 
     /// The routes changed: every waiting datagram's next hop is asked for again.

m12-a-queued-datagram-carries-no-permission-of-its-call.patch

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 0454418c8..ddb1c50da 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -212,7 +212,7 @@ impl Queued {
             source: self.source,
             destination: self.destination,
             ttl: self.ttl,
-            broadcast: self.broadcast,
+            broadcast: true,
             datagram: UdpBuilder { source: self.source_port, destination: self.port, data: &self.payload },
         }
     }

m13-a-failed-hop-is-handed-to-ip-at-the-datagrams-turn.patch

diff --git a/toyos-net-shard/src/lib.rs b/toyos-net-shard/src/lib.rs
index c47e74c1f..cfe844f73 100644
--- a/toyos-net-shard/src/lib.rs
+++ b/toyos-net-shard/src/lib.rs
@@ -355,7 +355,7 @@ impl Shard {
                 match peek(ip, now, route.iface, next_hop, route.source) {
                     (Resolution::Resolved(_), _) => {}
                     (Resolution::Pending, _) => return Offer::Waits(next_hop),
-                    (Resolution::Failed, _) => return Offer::Unreachable,
+                    (Resolution::Failed, _) => {}
                 }
             }
             match ip.send_udp(now, out, frame) {

m14-a-datagram-with-no-route-is-taken-and-not-counted.patch

diff --git a/toyos-net-shard/src/lib.rs b/toyos-net-shard/src/lib.rs
index c47e74c1f..05297fb08 100644
--- a/toyos-net-shard/src/lib.rs
+++ b/toyos-net-shard/src/lib.rs
@@ -350,7 +350,7 @@ impl Shard {
         let mut sent = None;
         let served = udp.serve(sender, |out| {
             let source = if out.source.is_unspecified() { Source::Unspecified } else { Source::Bound(out.source) };
-            let Ok(route) = ip.route(out.destination, source, None) else { return Offer::Unreachable };
+            let Ok(route) = ip.route(out.destination, source, None) else { return Offer::Taken };
             if let NextHop::Neighbour(next_hop) = route.next_hop {
                 match peek(ip, now, route.iface, next_hop, route.source) {
                     (Resolution::Resolved(_), _) => {}

m15-the-node-carries-no-lookup-on-in-transmit.patch

diff --git a/userland/netstack/node/src/lib.rs b/userland/netstack/node/src/lib.rs
index 4a68d7b9b..8d8c2c0d4 100644
--- a/userland/netstack/node/src/lib.rs
+++ b/userland/netstack/node/src/lib.rs
@@ -158,7 +158,8 @@ impl Node {
             sent = sent.saturating_add(self.stack.transmit(now, credit.saturating_sub(sent), &mut sink));
             // A datagram [ip] refused as it left is a line of this opportunity.
             self.log();
-            let asked = self.resolver.pass(now, &mut self.stack, &mut self.counters, &mut draw);
+            let asked = false;
+            let _ = &mut draw;
             if !asked || sent >= credit {
                 break;
             }

m16-the-query-asked-in-a-dropped-ones-place-waits-for-the-next-opportunity.patch

diff --git a/userland/netstack/node/src/lib.rs b/userland/netstack/node/src/lib.rs
index 4a68d7b9b..7faa8821e 100644
--- a/userland/netstack/node/src/lib.rs
+++ b/userland/netstack/node/src/lib.rs
@@ -159,7 +159,7 @@ impl Node {
             // A datagram [ip] refused as it left is a line of this opportunity.
             self.log();
             let asked = self.resolver.pass(now, &mut self.stack, &mut self.counters, &mut draw);
-            if !asked || sent >= credit {
+            if asked || !asked {
                 break;
             }
         }

m17-ips-queue-for-a-next-hop-is-16.patch

diff --git a/toyos-net-ip/src/lib.rs b/toyos-net-ip/src/lib.rs
index 9cbee3f78..59be88ccf 100644
--- a/toyos-net-ip/src/lib.rs
+++ b/toyos-net-ip/src/lib.rs
@@ -108,7 +108,7 @@ pub mod limits {
         pub const FAILED_HOLD: Duration = Duration::from_secs(20);
         pub const LOCKTIME: Duration = Duration::from_secs(1);
         pub const IDLE_LIFETIME: Duration = Duration::from_secs(600);
-        pub const PENDING_PER_NEIGHBOUR: usize = 8;
+        pub const PENDING_PER_NEIGHBOUR: usize = 16;
         pub const PENDING_TOTAL: usize = 64;
         pub const TABLE_MAX: usize = 512;
     }

m18-what-waits-is-not-counted-against-the-sockets-queue.patch

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 0454418c8..94926a9e2 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -567,7 +567,7 @@ impl Udp {
         };
         let socket = self.socket(id)?;
         let held: usize = socket.tx.iter().map(|queued| queued.payload.len()).sum();
-        if socket.tx.len() >= limits::TX_DATAGRAMS || held.saturating_add(payload.len()) > limits::TX_BYTES {
+        if socket.tx.iter().filter(|queued| queued.waits.is_none()).count() >= limits::TX_DATAGRAMS || held.saturating_add(payload.len()) > limits::TX_BYTES {
             return self.refuse(Counter::TxQueueFull, me, peer);
         }
         let ttl = if destination.is_multicast() { multicast_ttl } else { ttl };

[Japabu]

Review, round 1, of 05e3dbaad against origin/main (5055dc4aa; merge base 425f3eb9e, merges clean, #789 names no file of this branch). Read: the diff, every changed file whole at the head, toyos-net-ip/src/{nud,egress,route,config}.rs, the manifests, the stage's logs and the nineteen mutation logs, and the readers' scenarios by id.

Net lines: 19 files, +780 -150. Production +247 -99 (toyos-net-udp/src +140 -47, toyos-net-shard/src +65 -26 outside its unit test, the node's sources +41 -25, toyos-net-ip/src +1 -1). Tests +528 -47. The track +5 -4.

BLOCKER

• toyos-net-udp/src/lib.rs:267 (Offer::Unreachable), :757,765,772 (lost in serve), toyos-net-shard/src/lib.rs:353,358 — a second path to an outcome [ip] already produces — for a datagram that never waited, Ip::send_udp refuses no route and a FAILED hop itself: it counts (route.*, nb.failed-refused), emits Event::Unreachable(flow), and settle hands that to Udp::unreachable, which is the path the Err(_) => {} arm at :370 still takes for every other refusal. The pull request's own m13 is the measurement: with the FAILED hop handed to [ip], one test goes red, on its counter premise, and the_query_asked_in_a_dropped_querys_place_leaves_in_the_same_opportunity stays green. The body's reason for [udp] dropping, "that is where the datagram waited", covers Udp::fail and not this. Delete the variant, lost in serve and the two arms, so the shard's question has one answer that keeps a datagram back, pending; udp.tx-unreachable then counts what Udp::fail drops, the one drop [ip] cannot make, and NUD-14's and US-24's refusals are [ip]'s in the composed stack too, which narrows the recorded departure to the datagram that waited. If a full neighbour table (peek's resolve, then send_udp, each counting nb.table-full) is the reason to keep it, say so in the body with the count measured, and keep the variant for that case alone.
• issues/toyos-has-its-own-network-stack.md:42-44 — the three residuals this branch records name no owner, and none says by which stage it is due — the two lines they replace each named "the slice in which datagram senders wait on the hop". The second matters most: Sent::Held for a transport's datagram, Held.flow and drop_held's Event::Unreachable are reached by toyos-net-ip's tests and by no caller, guarded by an unreachable! in the shard, and would ship at the move as they stand. Each line names its owner; the second and third say they are closed before the move or in it, or carry the owner's word that the move may ship them.

NOTE

• toyos-net-udp/src/lib.rs:569-570 — the diff rewrites a check that cannot be true instead of deleting it — TX_DATAGRAMS (16) times MAX_PAYLOAD (1,472) is 23,552, under TX_BYTES (65,536), as the body says. tx_bytes went; the per-send sum that replaced it and the second half of the condition go too, with TX_BYTES or a const assertion that the product fits it.
• toyos-net-udp/tests/common/mod.rs:294-309 — U::hop is a copy of the shard's question, so the [udp] crate's US-24, US-27 and NUD-14 tests hold the harness's answers and not the shard's: m13 and m14 leave all of them green. It shrinks with the first BLOCKER; what remains should be the pending answer alone.
• The body's clippy row is given "at 05e3dbaad": its log carries no head line and was written before the commit. The same lint ran inside --ci host at the head (clippy, warnings denied: clean), so the claim stands on that log; the row should cite it.
• m00 holds no claim of behaviour: the tests do not compile against the base's sources. m01 is the control for the central decision, and m02 to m18 for the rest; the table should not count m00 among mutations that went red.

Checked, no finding

• Liveness. A datagram is marked waiting only for an INCOMPLETE entry (peek, Resolution::Pending; a down link has no route and is refused first). INCOMPLETE ends three ways and each reaches the datagram exactly once: inherit emits Resolved (Udp::wake), fire past BROADCAST_SOLICIT emits Failed (Udp::fail), and flush on link-down emits neither but bumps the generation (Udp::wake_all, then no route at the next opportunity). Eviction never takes INCOMPLETE; a request the control queue refuses still arms the deadline. No wake is lost between the mark and the resolution: a hop resolves only inside receive, which ends in settle, and marks are made only inside transmit.
• unreachable! on Sent::Held. Sound: between the shard's route and send_udp's only Ip::neighbour runs when the answer is resolved, every state with a link address answers Link::Resolved in nud::send, and broadcast and multicast routes never hold a transport's datagram. No byte of a frame reaches it.
• Bounds. A socket's 16 datagrams at 16 unresolved hops cost 16 INCOMPLETE entries and 3 requests each, as before this change; the wait adds one Option<Ipv4Addr> a datagram. wake, fail and wake_all walk every socket's queue, once per Resolved or Failed (each needs a request of ours first) or per route generation; nothing grows with what a peer sends.
• Order and fairness. FIFO per socket per hop holds, a datagram accepted after the hop resolved included (s_udp_us_026_datagrams_to_one_next_hop_leave_in_the_order_they_were_accepted, m02). Senders woken by one hop enter the round's tail in slot order, not send order; each gets one quantum a turn, so it is bounded and not fair by arrival.
• Permission of a datagram that waited. s_udp_us_021_shard_a_datagram_that_waited_for_a_host_is_asked_its_route_again_and_keeps_its_permission has both datagrams wait (one ARP request, no datagram) before the prefix changes; red on m10 and m12.
• [ip]'s path. Not dead as a whole: Ip::own still holds [ip]'s ICMP messages in a neighbour's queue. TCP never reaches Ip::datagram; the shard frames segments itself. Dead in the composed stack is the transport half named in the second BLOCKER. Removing it is egress.rs and the NUD scenario tests, outside this slice's files.
• The draw in Node::transmit. The same shape as receive, fire and link: the caller owns the entropy and the node asks for an id and a port as it forms a query. A peer chooses when a query is formed, by silence, and not what is drawn.
• toyos-net-node: a query known not to have reached its resolver is not waited out, an ICMP error ends nothing, and a burst of lookups reaches the wire #781's two lines. Both exits met: the 4 s test ends its lookup at 4,000 ms in the opportunity (m15); the burst test finds all sixteen queries and [ip] holding none (m01); PENDING_PER_NEIGHBOUR is 8 and NUD-04 is the scenario's ten, 3 to 10 out, two overflowed (m17); the assertion and the departure line are gone, and no citation of either renamed test is left in the tree.
• Evidence. Each log opens with the head and ends with its exit: udp 66, ip 273, shard 56, node 144, dhcp 76, all 0; --ci host 0 (78 step(s), all green); --build-only 0; m01 to m18 build 0 and test 101 at the head, tree clean before and after.
• Guest suite. userland/netstack/Cargo.toml links toyos-mdns and toyos-dns; toyos-mdns links toyos-dns alone; toyos-dns links nothing. toyos-dhcp, toyos-net-ip, toyos-net-udp, toyos-net-shard and toyos-net-node are in no shipped program's graph. No guest test reaches the change.

At the head that lands

The fixes change source, so cargo run -- --ci host, the five suites and the mutations that touch serve and udp_frame (m01, m02, m05, m13, m14) are measured again at the new head. The landing commit is the merge queue's, on a main that carries #789: its host check must be green there, being the only gate that runs these crates' suites and clippy on that tree; guest / suite must be green as the required check it is, and cannot be moved by this change. After a round that ends LAND, the orchestrator may land on reading those two green.

SEND BACK

[Japabu]

Answer to the round-1 review, at 86e685857 (origin/main 5055dc4aa merged in, clean; wt/toyos-move-listenopt has not landed, so there was no hunk of the node's to account for).

BLOCKER 1: the second path to an outcome [ip] already produces. Fixed, by deleting it.

Offer::Unreachable, lost in serve and the shard's two arms are gone. The shard's closure is now three arms over Ip::send_udp's answer and decides nothing: a frame is Taken, Sent::Pending(next_hop) is Waits(next_hop), a refusal is Taken with [ip] having counted it and raised Event::Unreachable. udp.tx-unreachable counts what Udp::fail drops and nothing else.

The full neighbour table, measured: it needs no variant. The shard makes one call for a datagram, send_udp, and s_ip_nud_022_a_full_table_evicts_in_order makes that call against a full table and reads nb.table-full = 1 for the one datagram refused. Round 1's double count came from the shard's own lookup ahead of [ip]'s, which is gone.

The [udp] harness's U::hop is deleted, and its closure is the shard's three arms. m13 and m14, written again against where the decision now is, in [ip]: m13 (a datagram waits for a hop [ip] has given up) is red at 6, m14 ([ip] tells no flow of its refusal) at 5, and both are red at a_query_for_a_resolver_ip_has_given_up_ends_its_lookup_in_the_opportunity_that_would_have_carried_it and the_query_asked_in_a_dropped_querys_place_leaves_in_the_same_opportunity, the node's tests, which run the shard itself. The second of those is the test that stayed green on round 1's m13.

BLOCKER 2: the residuals without an owner, and the dead transport half of [ip]'s queue. Fixed, by deleting the half.

By the orchestrator's decision the fence widened to toyos-net-ip/src/egress.rs, nud.rs and [ip]'s scenario tests.

• Sent::Held is Sent::Pending(next_hop): [ip] did not take the datagram. Held.flow, FrameKind::Datagram, drop_held's Event::Unreachable and the shard's unreachable! are deleted. Held is an echo reply or an ICMP error and can be nothing else.
• [ip] answers the question and builds the frame in one call, so round 1's third residual, the route looked up twice, is closed too, and the shard's peek is deleted: [tcp]'s hop is byte for byte main's.
• The scenario tests the track names by id, and the two-next-hops test, fill the queue with echo replies in the datagrams' places. None is deleted and none added: 273 in [ip]'s suite, as at round 1. What each said of the sender is held where the sender waits; the body's third decision names the test for each. The track records the departure by scenario id.
• Each test whose queue now holds [ip]'s messages has a mutation that turns it red, m20 to m30 in the body's table.
• Size: round 2 is +135 -168 in sources and +101 -97 in tests. No scenario's meaning had to be decided: each keeps its rule about the queue, with [ip]'s own message as the thing queued, which the track's exit for that line had already named.

Two residuals remain on the track, each with an owner and a due stage: the one queue a socket (the worker of the move, by its first run on the T14 or in a guest), and a link that returns before a transmit opportunity (the worker of the move, before the move). The second is narrower than round 1's line and measured at this head: the datagram waits anew and leaves when its hop answers (r2-probe-link-back.log, a test not committed).

NOTEs

• The check that cannot be true. The per-send sum and the second half of the condition are deleted. TX_BYTES stays as the limit the readers' specification names, with a const assertion that TX_DATAGRAMS of MAX_PAYLOAD fit it.
• U::hop. Deleted, as above.
• The clippy row. It now cites r2-clippy.log, which opens with the head and was written after the commit by the script that wrote every other gate's log, and the same lint inside r2-ci-host.log.
• m00. The body says what it is, a revert the tests do not compile against, claiming no behaviour, and the table no longer lists it.

Measured at 86e685857

	exit
cargo test --locked -p toyos-net-udp: 66 passed	0
cargo test --locked -p toyos-net-ip: 273 passed	0
cargo test --locked -p toyos-net-shard: 56 passed	0
cargo test --locked -p toyos-net-node: 144 passed	0
cargo test --locked -p toyos-dhcp: 76 passed	0
clippy on the six crates, the adopted lints, warnings denied	0
the source gates, 45 passed	0
cargo run -- --ci host: 78 steps, all green	0
cargo run -- --build-only	0
m01 to m30 less m05, twenty-nine: each built	0
the same twenty-nine: each run	101

The patches and the script are in the comment below.

[Japabu]

Mutation patches of round 2 and the script that ran them, at 86e685857. Each patch is applied to the clean head with git apply --check first, built, run with cargo test --locked --no-fail-fast -p toyos-net-udp -p toyos-net-ip -p toyos-net-shard -p toyos-net-node -p toyos-dhcp, and reversed; the script refuses a dirty tree before and after each. m00 is no mutation: it is the whole source change reverted onto the base, against which the tests do not compile. m05 is gone with the variant it mutated; m01, m02, m06, m07, m13, m14 and m18 are written again for the code as it stands; m19 to m30 are new.

the run

m00-the-whole-source-change-reverted-onto-the-base build=101 tests=not run failed=0
m01-the-shard-takes-a-datagram-ip-did-not build=0 tests=101 failed=55
m02-a-waiting-datagram-holds-back-the-senders-later-ones build=0 tests=101 failed=6
m03-a-resolved-hop-wakes-nothing build=0 tests=101 failed=56
m04-a-failed-hop-drops-nothing build=0 tests=101 failed=10
m06-a-dropped-datagrams-connected-socket-is-not-told build=0 tests=101 failed=6
m07-a-socket-that-is-not-connected-is-told build=0 tests=101 failed=4
m08-the-shard-does-not-wake-udp-on-a-resolved-hop build=0 tests=101 failed=50
m09-the-shard-does-not-tell-udp-of-a-failed-hop build=0 tests=101 failed=7
m10-a-change-of-routes-wakes-no-datagram build=0 tests=101 failed=2
m11-a-resolved-hop-wakes-every-waiting-datagram build=0 tests=101 failed=1
m12-a-queued-datagram-carries-no-permission-of-its-call build=0 tests=101 failed=5
m13-ip-has-a-datagram-wait-for-a-hop-it-has-given-up build=0 tests=101 failed=6
m14-ip-tells-no-flow-of-its-refusal build=0 tests=101 failed=5
m15-the-node-carries-no-lookup-on-in-transmit build=0 tests=101 failed=2
m16-the-query-asked-in-a-dropped-ones-place-waits-for-the-next-opportunity build=0 tests=101 failed=1
m17-ips-queue-for-a-next-hop-is-16 build=0 tests=101 failed=1
m18-what-waits-is-not-counted-against-the-sockets-queue build=0 tests=101 failed=2
m19-ip-tells-the-flow-of-a-datagram-it-did-not-take build=0 tests=101 failed=31
m20-ip-holds-its-own-messages-without-the-interfaces-bound build=0 tests=101 failed=2
m21-ip-holds-none-of-its-own-messages build=0 tests=101 failed=17
m22-a-failed-hop-counts-no-message-it-dropped build=0 tests=101 failed=2
m23-a-link-that-goes-down-counts-no-message-it-dropped build=0 tests=101 failed=1
m24-eviction-takes-an-entry-with-released-messages-as-any-other build=0 tests=101 failed=1
m25-an-idle-lifetime-deletes-an-entry-with-released-messages build=0 tests=101 failed=2
m26-a-full-queue-drops-the-newest build=0 tests=101 failed=1
m27-released-messages-leave-newest-first build=0 tests=101 failed=9
m28-an-unreachable-entry-whose-request-waits-is-idle build=0 tests=101 failed=1
m29-a-released-message-leaves-to-the-link-address-it-was-built-for build=0 tests=101 failed=11
m30-a-failed-hop-is-not-reported build=0 tests=101 failed=18
all restored: 0 dirty paths
RUN_EXIT=0

run.sh

#!/bin/sh
# Applies each mutation as a checked patch to a clean tree, builds, runs the five crates' suites,
# reports both exit codes and the tests that failed, and reverses the patch. Refuses a dirty tree
# before and after each.
# usage: run.sh <worktree> <mutations dir> <logs dir> [patch...]
set -u
tree=$1; dir=$2; logs=$3; shift 3
crates="-p toyos-net-udp -p toyos-net-ip -p toyos-net-shard -p toyos-net-node -p toyos-dhcp"
cd "$tree" || exit 2
[ $# -gt 0 ] || set -- "$dir"/m*.patch
for patch in "$@"; do
  name=$(basename "$patch" .patch)
  log="$logs/$name.log"
  if [ -n "$(git status --porcelain --ignore-submodules=none)" ]; then echo "$name: the tree is dirty before" ; exit 2; fi
  { echo "head $(git rev-parse HEAD)"; echo "git apply --check $name.patch"; } > "$log"
  if ! git apply --check "$patch" >> "$log" 2>&1; then echo "$name: the patch does not apply"; exit 2; fi
  git apply "$patch"
  echo "cargo test --locked --no-run $crates" >> "$log"
  cargo test --locked --no-run $crates >> "$log" 2>&1; build=$?
  echo "BUILD_EXIT=$build" >> "$log"
  tests="not run"
  if [ $build -eq 0 ]; then
    echo "cargo test --locked --no-fail-fast $crates" >> "$log"
    cargo test --locked --no-fail-fast $crates >> "$log" 2>&1; tests=$?
    echo "TEST_EXIT=$tests" >> "$log"
  fi
  git apply -R "$patch"
  if [ -n "$(git status --porcelain --ignore-submodules=none)" ]; then echo "$name: the tree is dirty after"; exit 2; fi
  red=$(grep -c '^test .* \.\.\. FAILED$' "$log")
  echo "$name build=$build tests=$tests failed=$red"
done
echo "all restored: $(git status --porcelain --ignore-submodules=none | wc -l | tr -d ' ') dirty paths"

m00-the-whole-source-change-reverted-onto-the-base

git diff 425f3eb9e 86e685857 -R -- toyos-net-udp/src toyos-net-ip/src toyos-net-shard/src userland/netstack/node/src

m01-the-shard-takes-a-datagram-ip-did-not

diff --git a/toyos-net-shard/src/lib.rs b/toyos-net-shard/src/lib.rs
index 9a3a7d90c..a58644f1f 100644
--- a/toyos-net-shard/src/lib.rs
+++ b/toyos-net-shard/src/lib.rs
@@ -355,7 +355,7 @@ impl Shard {
                 });
                 Offer::Taken
             }
-            Ok(Sent::Pending(next_hop)) => Offer::Waits(next_hop),
+            Ok(Sent::Pending(_)) => Offer::Taken,
             // Counted by [ip], which tells the datagram's flow.
             Err(_) => Offer::Taken,
         });

m02-a-waiting-datagram-holds-back-the-senders-later-ones

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 8a3901b85..a6fe52ead 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -753,13 +753,19 @@ impl Udp {
             }
         };
         let mut taken = None;
-        for (at, queued) in queue.iter_mut().enumerate().filter(|(_, queued)| queued.waits.is_none()) {
+        for (at, queued) in queue.iter_mut().enumerate() {
+            if queued.waits.is_some() {
+                break;
+            }
             match offer(&queued.out()) {
                 Offer::Taken => {
                     taken = Some(at);
                     break;
                 }
-                Offer::Waits(next_hop) => queued.waits = Some(next_hop),
+                Offer::Waits(next_hop) => {
+                    queued.waits = Some(next_hop);
+                    break;
+                }
             }
         }
         let taken = taken.and_then(|at| queue.remove(at)).is_some();

m03-a-resolved-hop-wakes-nothing

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 0454418c8..b66df2dec 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -804,7 +804,7 @@ impl Udp {
 
     /// `next_hop`'s link address is known: the datagrams that wait for it are offered again.
     pub fn wake(&mut self, next_hop: Ipv4Addr) {
-        self.rouse(|waits| waits == next_hop);
+        let _ = next_hop;
     }
 
     /// The routes changed: every waiting datagram's next hop is asked for again.

m04-a-failed-hop-drops-nothing

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 0454418c8..fc8dc3305 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -792,7 +792,7 @@ impl Udp {
         let queues = self.slots.iter_mut().filter_map(|slot| slot.socket.as_mut()).map(|socket| &mut socket.tx).chain([&mut self.closed]);
         for queue in queues {
             queue.retain(|queued| {
-                let waited = queued.waits == Some(next_hop);
+                let waited = queued.waits == Some(next_hop) && queued.waits.is_none();
                 if waited {
                     lost.push(queued.flow());
                 }

m06-a-dropped-datagrams-connected-socket-is-not-told

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 8a3901b85..dc6e8e1ed 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -788,9 +788,6 @@ impl Udp {
             });
         }
         self.counters.add(Counter::TxUnreachable, u64::try_from(lost.len()).unwrap_or(u64::MAX));
-        for flow in &lost {
-            self.unreachable(flow);
-        }
     }
 
     /// `next_hop`'s link address is known: the datagrams that wait for it are offered again.

m07-a-socket-that-is-not-connected-is-told

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 8a3901b85..39fcd5de1 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -719,7 +719,7 @@ impl Udp {
     /// A datagram of `flow` this crate had accepted will not leave: [ip] refused it as it left,
     /// or gave up the next hop it waited for.
     pub fn unreachable(&mut self, flow: &Flow) {
-        if let Some(socket) = self.connected(flow) {
+        if let Some(socket) = self.ports.get(&flow.source_port).copied().and_then(|index| self.at(index)) {
             socket.pending = Some(SocketError::NextHopFailed);
         }
     }

m08-the-shard-does-not-wake-udp-on-a-resolved-hop

diff --git a/toyos-net-shard/src/lib.rs b/toyos-net-shard/src/lib.rs
index c47e74c1f..d65dd0eec 100644
--- a/toyos-net-shard/src/lib.rs
+++ b/toyos-net-shard/src/lib.rs
@@ -411,7 +411,6 @@ impl Shard {
                 toyos_net_ip::Event::Unreachable(flow) => udp.unreachable(&flow),
                 toyos_net_ip::Event::Resolved { next_hop, .. } => {
                     wake(tcp, waiting, Wait::Hop(next_hop));
-                    udp.wake(next_hop);
                 }
                 toyos_net_ip::Event::Failed { next_hop, .. } => {
                     wake(tcp, waiting, Wait::Hop(next_hop));

m09-the-shard-does-not-tell-udp-of-a-failed-hop

diff --git a/toyos-net-shard/src/lib.rs b/toyos-net-shard/src/lib.rs
index c47e74c1f..2062d2ec0 100644
--- a/toyos-net-shard/src/lib.rs
+++ b/toyos-net-shard/src/lib.rs
@@ -415,7 +415,6 @@ impl Shard {
                 }
                 toyos_net_ip::Event::Failed { next_hop, .. } => {
                     wake(tcp, waiting, Wait::Hop(next_hop));
-                    udp.fail(next_hop);
                 }
                 // No datagram waits on a failed next hop: the failure dropped them.
                 toyos_net_ip::Event::Cleared { next_hop, .. } => wake(tcp, waiting, Wait::Hop(next_hop)),

m10-a-change-of-routes-wakes-no-datagram

diff --git a/toyos-net-shard/src/lib.rs b/toyos-net-shard/src/lib.rs
index c47e74c1f..1f81371e6 100644
--- a/toyos-net-shard/src/lib.rs
+++ b/toyos-net-shard/src/lib.rs
@@ -435,7 +435,6 @@ impl Shard {
             self.routes = ip.generation();
             waiting.clear();
             tcp.wake_all();
-            udp.wake_all();
         }
         let head = self.round.front().map(|m| m.flow);
         let gone: BTreeSet<Flow> = tcp.drain_gone().map(Flow::Tcp).chain(udp.drain_gone().map(Flow::Udp)).collect();

m11-a-resolved-hop-wakes-every-waiting-datagram

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 0454418c8..4498e8d57 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -804,7 +804,8 @@ impl Udp {
 
     /// `next_hop`'s link address is known: the datagrams that wait for it are offered again.
     pub fn wake(&mut self, next_hop: Ipv4Addr) {
-        self.rouse(|waits| waits == next_hop);
+        let _ = next_hop;
+        self.rouse(|_| true);
     }
 
     /// The routes changed: every waiting datagram's next hop is asked for again.

m12-a-queued-datagram-carries-no-permission-of-its-call

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 0454418c8..ddb1c50da 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -212,7 +212,7 @@ impl Queued {
             source: self.source,
             destination: self.destination,
             ttl: self.ttl,
-            broadcast: self.broadcast,
+            broadcast: true,
             datagram: UdpBuilder { source: self.source_port, destination: self.port, data: &self.payload },
         }
     }

m13-ip-has-a-datagram-wait-for-a-hop-it-has-given-up

diff --git a/toyos-net-ip/src/egress.rs b/toyos-net-ip/src/egress.rs
index dd91fe40f..74a93851f 100644
--- a/toyos-net-ip/src/egress.rs
+++ b/toyos-net-ip/src/egress.rs
@@ -382,7 +382,7 @@ fn hop(i: &mut Interface, cx: &mut Cx<'_>, route: &Route, destination: Ipv4Addr,
         NextHop::Neighbour(addr) => match nud::send(i, cx, addr, Some(route.source)) {
             Link::Resolved(mac) => Ok(Hop::To(mac)),
             Link::Pending => Ok(Hop::Asked(addr)),
-            Link::Failed(refusal) => Err(refusal),
+            Link::Failed(_) => Ok(Hop::Asked(addr)),
         },
     }
 }

m14-ip-tells-no-flow-of-its-refusal

diff --git a/toyos-net-ip/src/egress.rs b/toyos-net-ip/src/egress.rs
index dd91fe40f..579684d64 100644
--- a/toyos-net-ip/src/egress.rs
+++ b/toyos-net-ip/src/egress.rs
@@ -326,9 +326,7 @@ impl Ip {
                 Hop::Asked(next_hop) => Ok(Sent::Pending(next_hop)),
             }
         });
-        if sent.is_err() {
-            self.log.event(Event::Unreachable(flow));
-        }
+        let _ = flow;
         sent
     }
 

m15-the-node-carries-no-lookup-on-in-transmit

diff --git a/userland/netstack/node/src/lib.rs b/userland/netstack/node/src/lib.rs
index 4a68d7b9b..8d8c2c0d4 100644
--- a/userland/netstack/node/src/lib.rs
+++ b/userland/netstack/node/src/lib.rs
@@ -158,7 +158,8 @@ impl Node {
             sent = sent.saturating_add(self.stack.transmit(now, credit.saturating_sub(sent), &mut sink));
             // A datagram [ip] refused as it left is a line of this opportunity.
             self.log();
-            let asked = self.resolver.pass(now, &mut self.stack, &mut self.counters, &mut draw);
+            let asked = false;
+            let _ = &mut draw;
             if !asked || sent >= credit {
                 break;
             }

m16-the-query-asked-in-a-dropped-ones-place-waits-for-the-next-opportunity

diff --git a/userland/netstack/node/src/lib.rs b/userland/netstack/node/src/lib.rs
index 4a68d7b9b..7faa8821e 100644
--- a/userland/netstack/node/src/lib.rs
+++ b/userland/netstack/node/src/lib.rs
@@ -159,7 +159,7 @@ impl Node {
             // A datagram [ip] refused as it left is a line of this opportunity.
             self.log();
             let asked = self.resolver.pass(now, &mut self.stack, &mut self.counters, &mut draw);
-            if !asked || sent >= credit {
+            if asked || !asked {
                 break;
             }
         }

m17-ips-queue-for-a-next-hop-is-16

diff --git a/toyos-net-ip/src/lib.rs b/toyos-net-ip/src/lib.rs
index 9cbee3f78..59be88ccf 100644
--- a/toyos-net-ip/src/lib.rs
+++ b/toyos-net-ip/src/lib.rs
@@ -108,7 +108,7 @@ pub mod limits {
         pub const FAILED_HOLD: Duration = Duration::from_secs(20);
         pub const LOCKTIME: Duration = Duration::from_secs(1);
         pub const IDLE_LIFETIME: Duration = Duration::from_secs(600);
-        pub const PENDING_PER_NEIGHBOUR: usize = 8;
+        pub const PENDING_PER_NEIGHBOUR: usize = 16;
         pub const PENDING_TOTAL: usize = 64;
         pub const TABLE_MAX: usize = 512;
     }

m18-what-waits-is-not-counted-against-the-sockets-queue

diff --git a/toyos-net-udp/src/lib.rs b/toyos-net-udp/src/lib.rs
index 8a3901b85..1731ca232 100644
--- a/toyos-net-udp/src/lib.rs
+++ b/toyos-net-udp/src/lib.rs
@@ -567,7 +567,7 @@ impl Udp {
             Err(refusal) => return self.refuse(route_refusal(refusal), me, peer),
         };
         let socket = self.socket(id)?;
-        if socket.tx.len() >= limits::TX_DATAGRAMS {
+        if socket.tx.iter().filter(|queued| queued.waits.is_none()).count() >= limits::TX_DATAGRAMS {
             return self.refuse(Counter::TxQueueFull, me, peer);
         }
         let ttl = if destination.is_multicast() { multicast_ttl } else { ttl };

m19-ip-tells-the-flow-of-a-datagram-it-did-not-take

diff --git a/toyos-net-ip/src/egress.rs b/toyos-net-ip/src/egress.rs
index dd91fe40f..b91903fec 100644
--- a/toyos-net-ip/src/egress.rs
+++ b/toyos-net-ip/src/egress.rs
@@ -326,7 +326,7 @@ impl Ip {
                 Hop::Asked(next_hop) => Ok(Sent::Pending(next_hop)),
             }
         });
-        if sent.is_err() {
+        if sent.is_err() || matches!(sent, Ok(Sent::Pending(_))) {
             self.log.event(Event::Unreachable(flow));
         }
         sent

m20-ip-holds-its-own-messages-without-the-interfaces-bound

diff --git a/toyos-net-ip/src/egress.rs b/toyos-net-ip/src/egress.rs
index dd91fe40f..3a959718d 100644
--- a/toyos-net-ip/src/egress.rs
+++ b/toyos-net-ip/src/egress.rs
@@ -341,9 +341,7 @@ impl Ip {
         let Some((i, mut cx)) = self.split(now, route.iface) else { return };
         if let NextHop::Neighbour(addr) = route.next_hop {
             let holds = matches!(i.neighbours.get(&addr).map(|n| &n.state), None | Some(Nud::Incomplete(_)));
-            if holds && i.held >= PENDING_TOTAL {
-                return cx.log.count(Counter::NbPendingFull);
-            }
+            let _ = (holds, PENDING_TOTAL);
         }
         let Ok(hop) = hop(i, &mut cx, route, builder.destination, false) else { return };
         let (to, held_for) = match hop {

m21-ip-holds-none-of-its-own-messages

diff --git a/toyos-net-ip/src/egress.rs b/toyos-net-ip/src/egress.rs
index dd91fe40f..658ffa03f 100644
--- a/toyos-net-ip/src/egress.rs
+++ b/toyos-net-ip/src/egress.rs
@@ -352,7 +352,7 @@ impl Ip {
         };
         let Some(frame) = build_vec(i.mac, to, builder) else { return };
         match held_for {
-            Some(next_hop) => nud::hold(i, &mut cx, next_hop, Held { frame, kind }),
+            Some(next_hop) => drop((next_hop, Held { frame, kind })),
             None => {
                 cx.control.push(Item::Frame { iface: route.iface, frame, kind }, cx.log);
             }

m22-a-failed-hop-counts-no-message-it-dropped

diff --git a/toyos-net-ip/src/nud.rs b/toyos-net-ip/src/nud.rs
index dc11c25bc..7b2eb0aad 100644
--- a/toyos-net-ip/src/nud.rs
+++ b/toyos-net-ip/src/nud.rs
@@ -498,7 +498,6 @@ fn dropped(cx: &mut Cx<'_>, counter: Counter, held: usize) {
 fn fail(i: &mut Interface, cx: &mut Cx<'_>, addr: Ipv4Addr, pending: Pending) {
     let now = cx.now;
     i.held = i.held.saturating_sub(pending.0.len());
-    dropped(cx, Counter::NbPendingDropped, pending.0.len());
     cx.log.count(Counter::NbFailed);
     cx.log.event(Event::Failed { iface: cx.iface, next_hop: addr });
     cx.timers.arm(timer(cx, addr), now.after(FAILED_HOLD));

m23-a-link-that-goes-down-counts-no-message-it-dropped

diff --git a/toyos-net-ip/src/nud.rs b/toyos-net-ip/src/nud.rs
index dc11c25bc..5d0112324 100644
--- a/toyos-net-ip/src/nud.rs
+++ b/toyos-net-ip/src/nud.rs
@@ -619,7 +619,7 @@ pub(crate) fn flush(i: &mut Interface, cx: &mut Cx<'_>) {
             Nud::Incomplete(s) => s.pending.0,
             mut state => state.take_released().0,
         };
-        dropped(cx, Counter::NbPendingDropped, held.len());
+        drop(held);
     }
     cx.control.purge(cx.iface);
     i.held = 0;

m24-eviction-takes-an-entry-with-released-messages-as-any-other

diff --git a/toyos-net-ip/src/nud.rs b/toyos-net-ip/src/nud.rs
index dc11c25bc..f9bb8976c 100644
--- a/toyos-net-ip/src/nud.rs
+++ b/toyos-net-ip/src/nud.rs
@@ -322,7 +322,7 @@ fn evictable(n: &Neighbour) -> Option<u8> {
         Nud::Stale(_) => 2,
         _ => return None,
     };
-    Some(if n.state.releasing() { 3 } else { class })
+    Some(class)
 }
 
 /// An entry became one eviction takes, or the table emptied: a send refused since room last

m25-an-idle-lifetime-deletes-an-entry-with-released-messages

diff --git a/toyos-net-ip/src/nud.rs b/toyos-net-ip/src/nud.rs
index dc11c25bc..419fc9d95 100644
--- a/toyos-net-ip/src/nud.rs
+++ b/toyos-net-ip/src/nud.rs
@@ -446,9 +446,6 @@ pub(crate) fn fire(i: &mut Interface, cx: &mut Cx<'_>, addr: Ipv4Addr) {
         // A request is pending, so it is not idle: its next deadline starts as the request leaves.
         Nud::Unreachable(Unreachable { solicit: Solicit::Queued, .. }) => {}
         // Not idle while released datagrams are its: `leave` deletes it once they have left.
-        Nud::Stale(Stale { lifetime, .. }) | Nud::Unreachable(Unreachable { solicit: Solicit::Quiescent(lifetime), .. }) if releasing => {
-            *lifetime = Lifetime::Passed;
-        }
         Nud::Stale(_) | Nud::Unreachable(_) | Nud::Failed => {
             remove(i, cx, addr);
             route::refresh_active(i, cx);

m26-a-full-queue-drops-the-newest

diff --git a/toyos-net-ip/src/nud.rs b/toyos-net-ip/src/nud.rs
index dc11c25bc..08bb98800 100644
--- a/toyos-net-ip/src/nud.rs
+++ b/toyos-net-ip/src/nud.rs
@@ -63,9 +63,11 @@ impl Pending {
     /// Takes `held`, handing back the oldest when PENDING_PER_NEIGHBOUR wait already (RFC 4861
     /// §7.2.2).
     pub fn push(&mut self, held: Held) -> Option<Held> {
-        let oldest = if self.0.len() >= PENDING_PER_NEIGHBOUR { self.0.pop_front() } else { None };
+        if self.0.len() >= PENDING_PER_NEIGHBOUR {
+            return Some(held);
+        }
         self.0.push_back(held);
-        oldest
+        None
     }
 }
 

m27-released-messages-leave-newest-first

diff --git a/toyos-net-ip/src/nud.rs b/toyos-net-ip/src/nud.rs
index dc11c25bc..98afa7d57 100644
--- a/toyos-net-ip/src/nud.rs
+++ b/toyos-net-ip/src/nud.rs
@@ -80,7 +80,7 @@ impl Released {
     }
 
     pub fn pop(&mut self) -> Option<Held> {
-        self.0.pop_front()
+        self.0.pop_back()
     }
 }
 

m28-an-unreachable-entry-whose-request-waits-is-idle

diff --git a/toyos-net-ip/src/nud.rs b/toyos-net-ip/src/nud.rs
index dc11c25bc..8f37ce50b 100644
--- a/toyos-net-ip/src/nud.rs
+++ b/toyos-net-ip/src/nud.rs
@@ -443,8 +443,6 @@ pub(crate) fn fire(i: &mut Interface, cx: &mut Cx<'_>, addr: Ipv4Addr) {
             *solicit = Solicit::Quiescent(Lifetime::Runs);
             cx.timers.arm(timer(cx, addr), now.after(IDLE_LIFETIME));
         }
-        // A request is pending, so it is not idle: its next deadline starts as the request leaves.
-        Nud::Unreachable(Unreachable { solicit: Solicit::Queued, .. }) => {}
         // Not idle while released datagrams are its: `leave` deletes it once they have left.
         Nud::Stale(Stale { lifetime, .. }) | Nud::Unreachable(Unreachable { solicit: Solicit::Quiescent(lifetime), .. }) if releasing => {
             *lifetime = Lifetime::Passed;

m29-a-released-message-leaves-to-the-link-address-it-was-built-for

diff --git a/toyos-net-ip/src/nud.rs b/toyos-net-ip/src/nud.rs
index dc11c25bc..76087d61e 100644
--- a/toyos-net-ip/src/nud.rs
+++ b/toyos-net-ip/src/nud.rs
@@ -466,9 +466,7 @@ pub(crate) fn leave(i: &mut Interface, cx: &mut Cx<'_>, addr: Ipv4Addr) -> Optio
     let n = i.neighbours.get_mut(&addr)?;
     let mac = n.state.mac()?;
     let mut held = n.state.released_mut()?.pop()?;
-    if let Some((destination, _)) = held.frame.split_first_chunk_mut::<6>() {
-        *destination = mac.0;
-    }
+    let _ = mac;
     let idle = matches!(
         n.state,
         Nud::Stale(Stale { lifetime: Lifetime::Passed, .. }) | Nud::Unreachable(Unreachable { solicit: Solicit::Quiescent(Lifetime::Passed), .. })

m30-a-failed-hop-is-not-reported

diff --git a/toyos-net-ip/src/nud.rs b/toyos-net-ip/src/nud.rs
index dc11c25bc..28a317e84 100644
--- a/toyos-net-ip/src/nud.rs
+++ b/toyos-net-ip/src/nud.rs
@@ -500,7 +500,6 @@ fn fail(i: &mut Interface, cx: &mut Cx<'_>, addr: Ipv4Addr, pending: Pending) {
     i.held = i.held.saturating_sub(pending.0.len());
     dropped(cx, Counter::NbPendingDropped, pending.0.len());
     cx.log.count(Counter::NbFailed);
-    cx.log.event(Event::Failed { iface: cx.iface, next_hop: addr });
     cx.timers.arm(timer(cx, addr), now.after(FAILED_HOLD));
     route::refresh_active(i, cx);
 }

[Japabu]

Review, round 2, of 86e685857 against origin/main (5055dc4aa). Read: git diff 05e3dbaad 86e685857 less the merge of #789, toyos-net-ip/src/egress.rs and nud.rs whole at the head as new code, config.rs's link and resolve calls, the shard's udp_frame and settle, [udp]'s serve, fail, wake and rouse, the rewritten scenario tests, the r2-* logs and the thirty mutation logs, and the readers' scenarios by id.

Net lines, git diff --shortstat origin/main...86e685857: 28 files, +873 -272. Production +308 -167 (toyos-net-udp/src +132 -48, toyos-net-ip/src +84 -85, toyos-net-shard/src +51 -9 of which the unit test is +26, the node's sources +41 -25). Tests +560 -101. The track +5 -4. The round by itself removes more production than it adds, and [ip] ends a line under main.

Round 1's BLOCKERs

• 1, the second path to [ip]'s refusal: CLOSED. Offer::Unreachable, lost in serve, Udp::lose and the shard's route and peek ahead of send_udp are gone; the shard's closure is three arms over one call. m13 is red at 6 and m14 at 5, both at the node's a_query_for_a_resolver_ip_has_given_up_… and the_query_asked_in_a_dropped_querys_place_…, the second being the test round 1's m13 left green. The full table, by reading and by m13: nud::send finds no entry and no room, counts nb.table-full once, and answers Link::Failed; hop returns it as an error; send_udp raises Event::Unreachable; the shard answers Offer::Taken. The datagram is never marked. m13, which turns that answer into a wait for an entry that does not exist, is red at both NUD-22 tests, which make the one call the shard makes.
• 2, the dead transport half and the unowned residuals: CLOSED. Sent::Held, Held.flow, FrameKind::Datagram, drop_held, the shard's unreachable! and peek are in no file of the tree. The type holds it: Held is a frame and a FrameKind of Echo or Error, its fields are the crate's, Ip::own is the crate's and has two callers, both in icmp.rs, and Sent has no variant in which [ip] keeps anything. Nothing is left dead beside it. Both remaining lines on the track name an owner and when they are due.

Round 1's NOTEs

All four closed: the per-send sum is gone and the product is a const assertion; U::hop is gone; the clippy row cites a log that opens with the head; m00 is out of the table.

BLOCKER

• The body's "What is left", second item, and issues/toyos-has-its-own-network-stack.md:22 — the one behaviour this round claims without a measurement at the head — r2-probe-link-back.log carries no head, no command and no exit code, was written eleven seconds before 86e685857 was committed, and ran a test whose source is on no record, so "measured at this head" cannot be read off it. By reading the claim is true: link_down bumps the generation and flushes, link_up bumps it again and keeps the addresses, wake_all un-marks the datagram, and send_udp then finds a route, makes a new INCOMPLETE entry and answers Sent::Pending. Close it by committing the probe: in toyos-net-shard/tests/udp.rs beside s_udp_us_024_shard_a_waiting_datagram_whose_route_goes_is_dropped, which it is with link_up moved ahead of the opportunity, under no scenario id since it holds a departure, and named by the track's line as what holds its second half as it stands. Both arms of that line's exit need this test: the first inverts its last assertion, the second keeps it. The shard suite's log at the new head is then the measurement. A patch in a comment and one run by the mutation script's form closes it too, but leaves the track's sentence resting on a scratch log.

NOTE

• None beyond the above.

Checked, no finding

• The deletion in [ip]'s egress, read as new code. own is the old datagram with no transport: the MTU check, the interface's bound ahead of nud::send so a refused message makes no entry, no link broadcast, MacAddr::ZERO in a held frame that leave overwrites, a full control queue counted and dropped. send_udp reaches nud::send for every neighbour route and builds only into the caller's buffer. hop is the one place a link destination is chosen, for both. nud::hold takes only INCOMPLETE, and hop answers Asked only for INCOMPLETE. dropped counts what the three loops counted. No byte of a frame reaches a panic: the round adds none and removes one.
• Liveness with peek gone. A datagram is marked on Sent::Pending alone, which hop answers only on Link::Pending, which nud::send answers only for an INCOMPLETE entry, new with its request queued or its deadline armed, or already there. resolve's answer for a down link never reaches a datagram: send_udp has no route on one and refuses. INCOMPLETE is never evicted and leaves three ways, each reaching [udp]: inherit (Event::Resolved), fire past BROADCAST_SOLICIT (Event::Failed), flush (the generation). Marks are made inside Shard::transmit, no Resolved or Failed is raised inside it, and it ends in settle. m03, m04, m08, m09, m10 and m19 are red.
• The shard's refusal arm. Err(_) answered as a wait would turn s_udp_us_024_shard_… red: the datagram would leave after the link returns.
• The scenarios under their ids. Each keeps its rule about the queue with [ip]'s own message as the thing queued: NUD-01 (m21, m29), NUD-02 (m22, m30), NUD-03 (m27), NUD-04 (m17, m26), NUD-05 (m20), NUD-23 (m23), NUD-29 (m20, m24), NUD-30 and NUD-31 (m25, m28), OUT-08 (m27, m29), NBR-08 and NBR-14 (m29), the two-next-hops test (m22). What each said of a sender, the notices of NUD-05, NUD-23 and NUD-29 and the sender's word in NUD-02 and ICD-12, is not in [ip]'s tests any more, and the track's new departure line says so by id. NUD-14 and NUD-22 still hand [ip] a transport's datagram and are unchanged. That nobody is told of a dropped message of [ip]'s needs no mutation: Held carries no flow to tell.
• The narrowed residual. A datagram that waited, whose link goes down and returns with no transmit opportunity between, waits for its hop anew and leaves, where NUD-23 drops what waits at link-down; with an opportunity between, [ip] refuses it route.no-source-address and its connected socket is told. No isolation or safety hole: the address is still held, the socket's 16 places bound it, and each return of the link starts a three-request resolution that ends. The weakness is that the outcome turns on when the shell offers credit. The track's line is true of the code, owned and due before the move, and its exit is a test.
• Evidence at the head. Each of the nine gate logs opens with 86e685857 and its command and ends EXIT=0: udp 66, ip 273, shard 56, node 144, dhcp 76, clippy, the source gates 45, --ci host (78 step(s), all green), --build-only. Twenty-nine mutation logs open with the head, build 0 and test 101; the failed tests named in the body's table are the ones in the logs.
• Guest suite. Unchanged from round 1: no shipped program links a crate this touches.

#791 and #793

git merge-tree of this head with #791's 5d78654ba is clean, the track included, and the merged tree's node tests reach Node::transmit through helpers that already pass the draws. After #791 lands and main is merged in, the body must show cargo test --locked -p toyos-net-node and cargo run -- --ci host at the merged head, each with command, exit and log: #791's three listener tests then run on this branch's shard for the first time. git merge-tree with #793's 82c5b7039 conflicts in issues/toyos-has-its-own-network-stack.md and userland/netstack/node/src/lib.rs; whichever lands second merges and accounts for every hunk of both sides in those two files.

At the head that lands

The fix adds a test, so the shard's suite and --ci host are measured at the new head; no mutation need run again unless a source file moves. The landing commit is the merge queue's: its host check must be green there, being the only gate that runs these suites and clippy on the merged tree, and guest / suite green as the required check it is, which this change cannot move. This round does not end LAND, so a third reads the committed probe and the merged-head rows; after it ends LAND the orchestrator may land on reading those two green.

SEND BACK

[Japabu]

Round 3, head 9afecafb4 on origin/main at 5055dc4aa: one commit on 86e685857, a test and the track's line. No source file moved.

The BLOCKER. The probe is committed as a_waiting_datagram_whose_link_returns_before_an_opportunity_waits_anew_and_leaves in toyos-net-shard/tests/udp.rs, beside s_udp_us_024_shard_a_waiting_datagram_whose_route_goes_is_dropped, which it is with link_up moved ahead of the opportunity. It carries no scenario id. The track's line names it as what holds its second half as it stands, and both arms of the exit are stated by it: the first inverts its last assertion, the second keeps the test.

The merge of #791 is still owed. origin/main is 5055dc4aa, already in this branch; #791 was open and unmerged when this was pushed. Its three listener tests have not run on this branch's shard.

command, at 9afecafb4	exit	log
cargo test --locked -p toyos-net-shard (57 passed; the new test ... ok)	0	r3-suite-toyos-net-shard.log
cargo test --locked -p toyos-net-node (144 passed)	0	r3-suite-toyos-net-node.log
cargo run -- --ci host (Host: 78 step(s), all green)	0	r3-ci-host.log

Each log opens with the head and its command and ends with its exit.

Mutation m31, a change of routes wakes no datagram, by round 2's script: git apply --check, build exit 0, cargo test --locked --no-fail-fast -p toyos-net-udp -p toyos-net-ip -p toyos-net-shard -p toyos-net-node -p toyos-dhcp exit 101, reversed, tree clean after. Red at three tests: the new one, s_udp_us_024_shard_a_waiting_datagram_whose_route_goes_is_dropped and s_udp_us_021_shard_a_datagram_that_waited_for_a_host_is_asked_its_route_again_and_keeps_its_permission.

diff --git a/toyos-net-shard/src/lib.rs b/toyos-net-shard/src/lib.rs
index 9a3a7d90c..0960885c9 100644
--- a/toyos-net-shard/src/lib.rs
+++ b/toyos-net-shard/src/lib.rs
@@ -423,7 +423,6 @@ impl Shard {
             self.routes = ip.generation();
             waiting.clear();
             tcp.wake_all();
-            udp.wake_all();
         }
         let head = self.round.front().map(|m| m.flow);
         let gone: BTreeSet<Flow> = tcp.drain_gone().map(Flow::Tcp).chain(udp.drain_gone().map(Flow::Udp)).collect();

[Japabu]

Review, round 3, of 554bac968 against origin/main (975d5702a). Read: git diff 86e685857 9afecafb4, toyos-net-shard/tests/udp.rs at the head, the merge commit and git diff 9afecafb4 554bac968 over the stack's crates, the body at the head, m31's log, and the four r4-* logs.

Net lines, git diff --shortstat origin/main...554bac968: 28 files, +891 -272. Production +308 -167, unchanged since round 2. Tests +578 -101, round 2's and the one test of 18 lines. The track +5 -4.

Round 2's BLOCKER

• The behaviour that rested on a scratch log: CLOSED. a_waiting_datagram_whose_link_returns_before_an_opportunity_waits_anew_and_leaves is at toyos-net-shard/tests/udp.rs:205 at the head, directly under s_udp_us_024_shard_a_waiting_datagram_whose_route_goes_is_dropped, and is that test with link_up moved ahead of the opportunity: same b_resolved, same send to C, same first ARP request, then link_down, link_up, one opportunity that carries the address's announcement and a new request for the hop, udp.tx-unreachable and route.no-source-address both 0, C's reply, and the datagram on the wire. It carries no scenario id. Measured at the head: r4-suite-toyos-net-shard.log opens with 554bac968, names cargo test --locked -p toyos-net-shard, shows the test ... ok among 57 and ends EXIT=0. It can fail: m31's log opens with 9afecafb4, git apply --check, BUILD_EXIT=0, TEST_EXIT=101, and the test is red at its second assertion, left: ["ARP request 192.0.2.1"] against the two requests, beside US-24's and US-21's shard tests; 0 dirty paths after. The track's line names the test as what holds its second half as it stands, and its exit reads by it: the test finding the datagram gone, or the specifications having it wait, in which case the test stands as the line says it does.

The merge

• 554bac968 has two parents, 9afecafb4 and 975d5702a. git merge-tree --write-tree 9afecafb4 975d5702a exits 0 and answers 62cb2b66, which is the merge commit's tree: nothing was resolved by hand. Three files changed on both sides, the track, the node's tests/lease.rs and tests/listeners.rs, as the body says.
• Of the stack's crates the merge moved userland/netstack/node/src/listeners.rs and those two test files, and nothing under toyos-net-udp, toyos-net-ip, toyos-net-shard or toyos-dhcp.

The rows the merged head owed

Each log opens with 554bac968 and its command and ends with its exit; the gate file ends dirty=0 at that head.

• cargo test --locked -p toyos-net-node: EXIT=0, 147 lines ... ok and none failed or ignored (1, 9, 1, 20, 31, 15, 33, 3, 34 by target). The pipe ABI gives a listener its TCP_NODELAY in its bind and afterwards, and an accept's answer its connection's; the node's listen takes the option and its accept answers its stream's; a std stream shares its nodelay with its duplicates #791's three are ok by name: a_listener_holds_the_option_its_listen_named_from_its_first_connection, a_handshake_reset_before_it_ends_leaves_the_next_connection_its_listeners_option, an_accept_answers_the_option_of_a_stream_its_own_pass_let_go; they are the three fns The pipe ABI gives a listener its TCP_NODELAY in its bind and afterwards, and an accept's answer its connection's; the node's listen takes the option and its accept answers its stream's; a std stream shares its nodelay with its duplicates #791 added to tests/listeners.rs.
• cargo test --locked -p toyos-net-shard: EXIT=0, 57 (3, 5, 6, 19, 4, 3, 5, 12).
• cargo run -- --ci host: EXIT=0, Host: 78 step(s), all green, 78 step headers, clippy, warnings denied: clean. The 67 FAILED lines in it all sit inside control steps, each ending verdict(s) reached; the logs at the two earlier heads carry the same 67. The node's step inside it shows The pipe ABI gives a listener its TCP_NODELAY in its bind and afterwards, and an accept's answer its connection's; the node's listen takes the option and its accept answers its stream's; a std stream shares its nodelay with its duplicates #791's tests and the workspace step the new shard test.
• cargo run -- --build-only: EXIT=0.

No mutation re-run at the merged head

Accepted. The thirty-one posted patches change six files: toyos-net-ip/src/egress.rs, lib.rs and nud.rs, toyos-net-shard/src/lib.rs, toyos-net-udp/src/lib.rs and the node's src/lib.rs. The merge moved none of the six. What it moved under them is one argument, false, in a listen helper of tests/lease.rs, and #791's listener tests, which no mutation's table names. A mutation that was red at 86e685857 or 9afecafb4 patches the same bytes and meets the same tests at 554bac968.

BLOCKER

• None.

NOTE

• issues/toyos-has-its-own-network-stack.md:43 — prose, and round 2's own wording — "that second test's last assertion is inverted" understates the first arm: a datagram dropped at link-down is not asked for anew either, so the test's second assertion, the request for 192.0.2.3 after link_up, goes with the last. The arm's meaning, the test finding the datagram gone, is readable as it stands.

Guest suite

Unchanged: no shipped program links a crate this branch touches, and what the merge brought to netstack is main's, measured there.

At the head that lands

• The pull request is a draft, and its host, toolchain and guest checks at 554bac968 are SKIPPED. A skipped check is no measurement. Marked ready, host must conclude success on the head that lands, and on the merge queue's commit host and guest / suite must both conclude success, neither skipped.
• If the head that lands is 554bac968, the orchestrator may land on reading those. If main moves first and is merged in again, he may still land without a further round where git merge-tree reproduces the merge's tree, the merge moves no file under toyos-net-udp, toyos-net-ip, toyos-net-shard, toyos-dhcp or the node's src/lib.rs, and the body shows cargo test --locked -p toyos-net-node and cargo run -- --ci host at that head with command, exit and log. A merge that conflicts, a merge that moves one of those sources, or any commit that is not a merge of main is another round.
• toyos-mdns claims its name before it uses it: three probes, the tie-break, a conflict's outcome, RFC 6762 §8.1's bound on what a peer's messages cost, and the link's return in both callers #793 lands second and accounts for every hunk of both sides in the node's lib.rs and the track; that is its round's, not this one's.

LAND

[Japabu]

CI at 554bac968, read from each job's own log (the orchestrator). host: [ci] Host: 79 step(s), all green, with a_waiting_datagram_whose_link_returns_before_an_opportunity_waits_anew_and_leaves and #791's a_handshake_reset_before_it_ends_leaves_the_next_connection_its_listeners_option each ok by name. guest / suite: test result: ok. 37 passed, 37 total, [ci] Guest: 5 step(s), all green, no FAIL line. The head is the one round 3 passed. git merge-tree against main at 975d5702a exits 0 with no conflict.