Integration tests outside the kernel are cut, and unit and module tests hold what they checked

[Japabu]

The test sweep the orchestrator accepted on this pull request, built, and answered in its second through fifth rounds. Every test the owner's testing ruling refuses — it integrates userspace programs, or installs or launches software and drives it through steps — is cut. Where what it checked matters, a unit or module test of its program now holds it, and each of those is red under a mutation of the property it holds. The plan, with every test's verdict, is test-sweep-survey.md; this body is what landed and how it differs from the plan. It sits on #889, which deleted proctest and launch_authority, and #897, which cut netstack_socket_churn: those three are theirs, not this branch's.

The rulings it follows

• The owner's testing ruling (Integration between modules is tested only for the kernel, and an integration test outside it is cut #890, now in reviewer.md's Tests): integration between modules is tested only for the kernel; an integration test refused there is cut, and a unit or module test of its program holds what mattered.
• The orchestrator's acceptance (the comment above): launch_toctou, app_view and process_tree's launcher arms stay until the supervisor track's stage 2, recorded there; hosted_clang_hello stays, a module test of the hosted toolchain; the 18 tracks that owe refused tests are a separate issues-only pull request.
• The orchestrator's ruling on the three ACPI rows' oracle (round 2's brief): the firmware's raw table bytes are the machine's own, not another OS's reading of them; and, ruling on round 3's review, the exit asks of committed extracts only what an extract can hold, with no loader dump. Recorded in the ACPI track with an owner and an exit (below).
• The owner's direction on Linux and the clean-room rule (Another implementation's source is read only clean-room, and the tree names Linux only as a host platform or a libc interface #902): the tree adds no reference to Linux; a test's oracle is a specification, the vendor's document, or the host's own implementation of a published interface run live. The plan's netstack_streams replacement replayed a recorded Linux TCP peer; it is replaced instead by a node test judged against RFC 9293.

Counts

	plan	landed here
deleted	15	11: hosted_clang_hello kept, as ruled; proctest and launch_authority by #889, netstack_socket_churn by #897
replaced, cut with its replacement	21	16
replaced in the plan, kept for now	—	5: launch_toctou, app_view (stage 2, as ruled); acpi_server_events, acpi_tables_loaded, battery_read (the ACPI track, as ruled)
narrowed	10	10 (process_tree keeps its launcher arms, as ruled, and the shell's detach)

Deleted: what each checked is held already (11)

test	held by
consent_prompt	lib/manifest/src/consent.rs, grants.rs; system/compositor/desktop's prompt-layer tests; spawn_image_object
netstack_streams_e1000e	the stream rules as netstack_streams' replacement; the 82574 by system/netstack/i219's host tests
https_fetch	rustls's suite; ring_kat, now a shared-boot member; random_draws, wall_clock_now; the node tests
machine_shutdown	machine_shutdown_wire_held, _kept, _at_the_seal; acpi_mediated_access, acpi_supply_outlives_holder; system/acpiserver/aml/tests/evaluate.rs
acpi_press_across_a_lock_wait	system/acpiserver/src/sci.rs, host.rs; acpi_mediated_access
block_grants_reach_their_partitions	system/diskserver/src/main.rs's tests; port_badge
toyfetch_reports	apps/toyfetch/src/render.rs; counters_read
shipped_client_departures	system/soundserver/src/client.rs; cpal_drop_unreleased
fs_large_file	lib/bcachefs/tests/integration.rs
home_backing_revoked	system/fileserver/src/data.rs
nvme_home_roundtrip	system/fileserver/src/data.rs, cache.rs

Replaced: the test that now holds it (16)

Every replacement is a host test but four, each the kernel's own. Why each of the four needs QEMU or the T14, and why no cheaper tier reaches it:

• acpi_press_is_one_sci (QEMU): a press of the fixed power button reaches the acpi claim's holder as one SCI, its line masked until the holder serves it. No type reaches it: it is the kernel's interrupt path at run time. No host test: the kernel's SCI and its mask have no host build. No metal row: nothing presses the T14's button but a hand, and the owner forbids a row that needs one (the ACPI track's 2026-10-05 rulings); QEMU raises the event on demand.
• lent_device_memory_refused, rewritten (QEMU): the probe asks SharedMemory::lent of a BAR of a function no program of the boot holds, and is answered NotRam. No host test: fstat of a lent BAR is the kernel's object table at run time. No metal row: the T14's only such unheld function is its I219, and a kernel that dies on this takes the bench's machine down with it; QEMU's virtio NIC is that function here.
• nvme_disk_boots (QEMU): a machine whose one NVMe disk is all it has, with no USB controller, boots the image off it to ready, clean. No host test: the firmware that reads the disk and the loader and kernel it hands the image to have no host build. No metal row: the T14 boots from a stick beside an NVMe disk that is another system's.
• lent_window_refused, rewritten (T14 shared member): a pipe end answered NotRam, a region twice the window Length. It stays where it ran, on the T14's testcases boot, and run 1 below read it exit code=0.

cut	now held by	mutation, red
netstack_streams	system/netstack/node/tests/streams.rs an_echo_past_both_windows_arrives_whole_both_ways_and_ends_in_both_fins, judged against RFC 9293 §3.8.6 and §3.6; two connects queued before an accept were already listeners.rs' a_connect_between_two_accepts_is_queued_not_reset	19
libc_sockets	std's and libc's stream end by one rule, moved into toyos::net (read_end, write_refused, StreamRefusal) and its SDK tests, which libc's socket.rs and std's connection.rs both read; sendto_unbound.c's bind of a datagram socket never bound, at its first sendto or a connected send (which is sendto to the peer), by libc's dgramreq.rs and sdk/libc/arch's datagram_sends: one bind, at any address to port 0, before the first datagram alone, none for a bound socket, and nothing sent after a refused bind. That two such sockets hold two ports is netstack's draw, held by system/netstack/node/tests/datagram.rs a_socket_holds_the_port_it_named_or_the_one_its_draw_picked; the option rule by socket_options	18, 26
acpi_power_button	acpi_press_is_one_sci (QEMU, above). The supervisor's stop on a press goes to stage 2	20
lent_device_memory_refused	the same name, rewritten (QEMU, above); fileserver's drop by fileserver::bounds::hello	21, 04
lent_window_refused	the same name, rewritten (T14, above); fileserver's drop as above	04
nvme_disk_keeps_log_and_home	nvme_disk_boots (QEMU, above). Persistence by system/fileserver/src/data.rs and logkeeper's store.rs	22
update_writes_the_idle_slot_through_the_block_service	update's own src/install/, compiled on the host by system/update/copies (update-copies): a signed image installed over memory, the table marked at its version, ROOT byte for byte, the volume judged by toyos-fat32-check and its three files read back; an image another key signed writes nothing. The supervisor's grant goes to stage 2	09
audio_idle_suspend	system/soundserver/src/mix.rs with_no_client_the_mix_loop_arms_no_timer_and_fills_nothing	14
hda_client_stall	mix.rs a_ring_defers_no_period_for_a_stalled_client_and_resumes_from_the_whole_ring	15
soundserver_log_stall	sdk/toyos/src/log/proof.rs a_full_lane_counts_the_mix_thread_s_line_and_returns	08
fs_share	system/fileserver/src/bounds.rs: handshake, hello and stream bounds, machine-wide and per share	07
fs_cache_eviction	system/fileserver/src/cache.rs every_evicted_clean_block_reads_back_off_the_disk_byte_for_byte	01
fs_escape	bounds.rs a_path_on_the_wire_that_climbs_or_is_absolute_is_refused, the check resolve makes first; the floor by resolve.rs. A link's target is not resolved and is held to UTF-8 alone: a_link_s_target_is_taken_absolute_or_climbing	06, 23
fs_stream_offset	bounds.rs an_offset_past_the_largest_a_file_has_is_refused, which also takes lseek_past_eof's /home ceiling	05
fs_turns	sdk/std/sys/turns.rs the_value_goes_to_the_tickets_in_the_order_they_were_taken, through sdk/std/copies	17
toybox_file_tools	toybox's own cp.rs, mv.rs and hexdump.rs, compiled on the host by system/toybox/copies (toybox-copies): cp past its flush interval and every refusal leaving no partial, mv refusing a rename with no copy behind it, hexdump against a recorded macOS xxd	10, 11, 12

Narrowed: the kernel's arms stay (10)

test	cut	the cut arms are held by
iommu_virtio_platform	netstack's and soundserver's negotiation lines, diskserver refused, fileserver without DATA, the null sink	lib/virtio/src/tests.rs; what stays counts the kernel's own virtio drivers and the kernel's hand-over and refusals
usbd_drives_the_spare	usbd naming the devices, and its restart	lib/xhci, lib/xhci/sim/tests; usbd's No-Op by interrupt stays as its smoke
process_tree	std's launch refusals, a_place_without_dup_is_refused and a_named_image_is_spawned_directly	sdk/std/sys/launch_route.rs, through sdk/std/copies: the_supervisor_is_asked_only_by_a_launch_of_its_row_s_own_program (16); a_launch_whose_place_cannot_be_copied_is_refused_and_not_spawned_directly (24); a_named_image_runs_under_its_program_s_name, the argv[0] check (25). MAX_DEPTH is reached by direct spawns of itself, with no shell
disk_backtrace	running symbolize	lib/symbols/tests/name.rs, system/symbolize's tests
endowment_denied	the shipped ps with and without ROSTER	the kernel by the_roster_is_a_right_and_the_header_is_not; the roster ps reads by toybox's roster.rs through toybox-copies: a refused roster is no row (13), and a granted one's two clocks are read from their own fields (27)
file_mtime	/home and /log	data.rs a_write_s_stamp_keeps_its_nanosecond_across_a_remount (02), fat.rs the_flush_stamps_its_even_second_and_not_the_write_s (03)
fs_truncate_persist	/home	data.rs
hierarchy_paths	/apps and /home	lib/manifest, data.rs
lseek_past_eof	/home	data.rs; the ceiling by bounds.rs
stat_identity	/home and /log	data.rs, fat.rs, volume.rs; a link's target, absolute or climbing, by bounds.rs (23)

Production changes, per decision

Each lifts a decision out of code a host cannot build into code it can, so the tests above reach it. Behaviour is main's but where a bullet says otherwise.

• fileserver::bounds: the handshake, hello and stream bounds, the lent-window answer, the file-offset bound, a request path's decode and the check a resolved path is held to, out of main.rs, which calls them. One declaration of MAX_SERVED, MAX_HANDSHAKES, MAX_STREAMS and their shares. A path off the wire is UTF-8 (path), and resolve holds it canonical first (relative), as main did; a link's target is never resolved, so SYMLINK takes an absolute or climbing target as main did. Round 1 had decoded every path as canonical, which refused such a target: mutation 23 is that decode, and the new test is red under it.
• update's install: system/update/src/install/, a module of update, over any Disk; update-copies compiles it by #[path] and holds its tests, as toyos-libc-copies holds libc's. A test package because update links the SDK and reads its key with env!, which a host's test step sets for no package, and its tests live there and not in update's files because build/userlandhost.rs runs cargo test on a program whose own files hold a test.
• toyos-disk (lib/disk): the Disk trait, its block and its errors, moved out of diskserver::disk, which re-exports them; diskserver and update share it, and update-copies links no SDK through it.
• toybox: cp.rs, mv.rs and hexdump.rs stay toybox's, and the roster ps decodes moves into its roster.rs; toybox-copies compiles the four by #[path] and holds their tests, for the same two reasons as update's, toybox building on no host (issues/apps-that-build-or-run-on-toyos-alone.md). mv's refusal and hexdump's request parsing return their words instead of exiting, and main says them as main's did, hexdump's bare Usage: line included.
• std's ToyOS platform: sdk/std/sys/launch_route.rs decides where a spawn goes, what a launch not made leaves the caller (unmade: the direct spawn, or a refusal, a place the launch could not copy refused as its copy was and never spawned directly), and what a direct spawn runs under which name (image_and_name); process.rs builds Routed::Direct only through unmade. sdk/std/sys/turns.rs is a value held in ticket order. Both name only core and std's sync, so sdk/std/copies (toyos-std-copies) compiles them on a host, at std's own edition, 2024. One change of words: a command that provided a connector, run where no launcher is held, is refused PermissionDenied as before, now with its reason.
• libc's dgramreq.rs: a datagram send's order, a bind of a socket never bound and then the send, over a trait socket.rs's socket entry implements with netstack's calls; toyos-libc-copies compiles it.
• The stream-end rule moves from libc's streamend.rs and std's connection.rs, where it was written twice, into toyos::net.
• soundserver: the mix loop's wait, the free list a ring fills from, and the deferral, as three functions of mix.rs.
• Deleted, shipped for tests alone: logkeeper's --stall-until and Origin::waiting; Plan::second (only the harness set it).

Harness, images and helpers removed

tests/images/{consentcase,blockgrantcase,logstallcase,slotscase}.toml and their ALL_CONFIGS rows; Profile::Desktop, HeadlessE1000e, Nic::E1000e; BootOptions::second_slot, acpi_tables; QemuInstance::screendump_file, reset_on_reboot, await_boot, boot_image; run_test_paced folded into run_test; QmpInput::point, click, screendump; compile_own_c; tests/common/https.rs and the rustls, rcgen, toyos-desktop dev-dependencies; the guest crate's ureq, rustls, diskserver, toyos-blockring, toyos-gpt, inspect, toyos-desktop; the audio judges and their host checks for the cut rows; build/bootlog.rs's lines_of, whose one reader was log_stall_on_metal; tests/guest/c/{addr_order,nodelay_kept,sendto_unbound,stream_ends}.c; stream_ends.rs, lent_hello.rs; the symbolize and toyfetch rows of testcases.toml, and netcase.toml's e1000e claim; proctreecase.toml's rows for fs_share. ON_DEMAND and hostedclangcase.toml stay with hosted_clang_hello.

Gates

At head 59697d07833b1e80e532a6dda4e3f26dde01b570, origin/main 347e3313d (#874, #896) merged in (main has since gained #887, issues only, which merges clean), every log masked as root CLAUDE.md masks what is posted (exits). The merge's one conflict is tests/toyos.rs's testcases metal arm: it keeps #874's test_rs_wake_onto_busy and drops test_rs_audio_idle_suspend and its comment. Round 6's other commit narrows the ACPI issue's sentence, below.

• cargo run -- --ci host: EXIT=0 ("Host: 76 step(s), all green", line 8974). log
• The whole guest suite, cargo test --test toyos-build: EXIT=0 ("52 passed, 52 total", line 703; acpi_mediated_access, which A wake to another CPU that is busy is drained at its next preemption point and runs within a bound #874 changed and which auto-merged with this branch's rewrite, passes at line 370). log
• The T14 testcases boot, staged by cargo test --test toyos-build -- --metal --metal-readback <dir> boot:testcases: EXIT=2, staged 2 images and judging nothing (log, request). Its derived member list carries test_rs_wake_onto_busy and no test_rs_audio_idle_suspend (members); the orchestrator ran it as run 4 below.
• Earlier rounds, kept for what this round did not run again:
• At df92d1c4c, round 5's head: cargo test -p toyos-std-copies (its edition moved from 2021 to std's 2024), EXIT=0, 6 passed (log). At b1d430bea, round 3's head: cargo run -- --build-only --arch aarch64, EXIT=0 (log).
• At 0dba06f1f, round 5's commit, mutation 27 by its script, the same steps as below: 27-ps-swaps-the-header-s-clocks.patch, cargo test -p toybox-copies -- --exact roster_reading::a_granted_roster_is_its_header_and_each_whole_entry, green 0, mutated 101, reverted and clean (log). The test now writes two distinct non-zero clocks at the header's ABI offsets; before, it decoded an all-zero header and compared it with itself.
• At ff1a11dbd, the round before, the mutations, each the test green on the tree (an --exact filter, its one test run), the patch applied and shown to build, the same test run, the patch reverted and the tree shown clean, by one script: summary, logs.

#	patch	test	green	mutated
01	01-cache-flush-writes-nothing.patch	cargo test -p fileserver --lib -- --exact cache::tests::every_evicted_clean_block_reads_back_off_the_disk_byte_for_byte	0	101
02	02-data-write-stamps-whole-seconds.patch	cargo test -p fileserver --lib -- --exact data::tests::a_write_s_stamp_keeps_its_nanosecond_across_a_remount	0	101
03	03-fat-level-keeps-a-stale-stamp.patch	cargo test -p fileserver --lib -- --exact fat::tests::the_flush_stamps_its_even_second_and_not_the_write_s	0	101
04	04-fileserver-answers-a-device-window.patch	cargo test -p fileserver --lib -- --exact bounds::tests::a_hello_whose_window_is_no_region_of_window_bytes_is_let_go_unanswered	0	101
05	05-fileserver-stream-past-the-largest-offset.patch	cargo test -p fileserver --lib -- --exact bounds::tests::an_offset_past_the_largest_a_file_has_is_refused	0	101
06	06-fileserver-path-not-held-canonical.patch	cargo test -p fileserver --lib -- --exact bounds::tests::a_path_on_the_wire_that_climbs_or_is_absolute_is_refused	0	101
07	07-fileserver-share-served-past-its-part.patch	cargo test -p fileserver --lib -- --exact bounds::tests::a_hello_past_the_server_s_bound_or_its_share_s_part_is_refused_before_its_window_is_asked	0	101
08	08-log-lane-refusal-uncounted.patch	cargo test -p toyos --lib -- --exact log::proof::a_full_lane_counts_the_mix_thread_s_line_and_returns	0	101
09	09-update-marks-the-running-slot.patch	cargo test -p update-copies -- --exact installing::a_signed_image_is_written_into_the_idle_slot_and_marked	0	101
10	10-cp-leaves-its-partial.patch	cargo test -p toybox-copies -- --exact copying::a_refused_copy_leaves_the_destination_as_it_was_and_no_partial	0	101
11	11-mv-asks-no-source-before-the-rename.patch	cargo test -p toybox-copies -- --exact moving::a_missing_source_is_refused_before_anything_is_renamed	0	101
12	12-hexdump-pads-a-column-too-many.patch	cargo test -p toybox-copies -- --exact dumping::a_dump_is_xxd_s_byte_for_byte_whole_and_in_a_window	0	101
13	13-ps-reads-a-refused-roster-as-empty.patch	cargo test -p toybox-copies -- --exact roster_reading::a_refused_roster_is_no_row	0	101
14	14-soundserver-idle-arms-a-timer.patch	cargo test -p soundserver -- --exact mix::tests::with_no_client_the_mix_loop_arms_no_timer_and_fills_nothing	0	101
15	15-soundserver-ring-defers-a-period.patch	cargo test -p soundserver -- --exact mix::tests::a_ring_defers_no_period_for_a_stalled_client_and_resumes_from_the_whole_ring	0	101
16	16-std-supervisor-takes-an-extra-slot.patch	cargo test -p toyos-std-copies -- --exact launch_route::tests::the_supervisor_is_asked_only_by_a_launch_of_its_row_s_own_program	0	101
17	17-std-turnstile-lets-the-releaser-barge.patch	cargo test -p toyos-std-copies -- --exact turns::tests::the_value_goes_to_the_tickets_in_the_order_they_were_taken	0	101
18	18-stream-reset-read-as-other.patch	cargo test -p toyos --lib -- --exact net::tests::a_read_of_zero_is_the_peer_s_fin_only_while_the_send_pipe_is_read	0	101
19	19-netstack-drops-what-the-pipe-refused.patch	cargo test -p toyos-net-node --test streams -- --exact an_echo_past_both_windows_arrives_whole_both_ways_and_ends_in_both_fins	0	101
20	20-kernel-leaves-the-sci-unmasked.patch	cargo test --test toyos-build -- acpi_press_is_one_sci	0	1
21	21-kernel-calls-a-bar-shared-memory.patch	cargo test --test toyos-build -- lent_device_memory_refused	0	1
22	22-kernel-needs-a-usb-controller.patch	cargo test --test toyos-build -- nvme_disk_boots	0	1
23	23-fileserver-link-target-held-canonical.patch	cargo test -p fileserver --lib -- --exact bounds::tests::a_link_s_target_is_taken_absolute_or_climbing	0	101
24	24-std-uncopied-place-spawned-directly.patch	cargo test -p toyos-std-copies -- --exact launch_route::tests::a_launch_whose_place_cannot_be_copied_is_refused_and_not_spawned_directly	0	101
25	25-std-named-image-is-argv0.patch	cargo test -p toyos-std-copies -- --exact launch_route::tests::a_named_image_runs_under_its_program_s_name	0	101
26	26-libc-unbound-send-binds-nothing.patch	cargo test -p toyos-libc-copies -- --exact datagram_sends::a_socket_never_bound_is_bound_to_a_port_the_stack_chooses_before_its_first_send	0	101

Every mutated arm built; 20 reds by the hang ceiling, an SCI that is never masked again storming the guest, and 22 by the kernel's panic before ready. Round 2's review named two patches with no test to turn red: process.rs's dup failure routed to the direct spawn, whose decision is now launch_route::unmade's, so its patch is 24; and socket.rs's bind block deleted, which is now dgramreq::send_to's, so its patch is 26.
Round 3 changes process_tree.rs alone, and round 4 proctreecase.toml alone, which no mutation touches; round 5 touches no file a patch above names.

• At ff1a11dbd, git grep -w of every deleted, replaced and renamed name, bare, outside issues/ at the head: nothing. output

The T14

Run 1, at ff1a11dbd. The orchestrator ran the four boots staged there (boot:testcases boot:proctreecase usbd_drives_the_type_c_controller hda_tone): 248 of 249 rows passed, among them every row the testcases boot changed, launch_toctou, port_badge, app_view, usbd_drives_the_type_c_controller and hda_tone. process_tree was red: test_rs_process_tree exited 101, panicking at process_tree.rs:309:33: a link's index: ParseIntError { kind: InvalidDigit }. The kernel half of its judge held: one depth refusal, spawn: refused under pid 79 at depth 65, more than 64 below the supervisor. judge log, the boot's kernel log (line 488 is the refusal, 490 the panic).

Root cause, in this branch's narrowing. The chain's links now spawn each other directly, so the depth refusal is a link's own line, link <k>: its next link was refused: ..., which starts with the prefix of a link's index line. The reader tried the index prefix first and parsed <k>: its next ... as a number. The fix (b1d430bea) reads the refusal before the index. As a host measurement, not a suite row, classify.rs runs the reader at ff1a11dbd and at the fix over the lines link() prints for a 62-link chain: the old reader panics with the T14's message, EXIT=101; the new one stops at link 62 on the refusal, EXIT=0 (output).

Run 2, at b1d430bea: boot:proctreecase. 3 passed, 1 failed. The chain arm passed on the T14 ("a chain of 62 links stopped at a depth refusal (link 62: its next link was refused: out of memory) and died whole"), as did both ends of B, the MANAGE-only place and the pipe; the judge's kernel half held again (two loader refusals of no_such_program, one depth refusal at 65). process_tree was red at its last arm: process_tree.rs:351:5: the shell's detach failed: ExitStatus(ExitStatus(126)). judge log, the boot's kernel log (lines 552–558).

Root cause, in this branch's image edit. The supervisor said it at line 553: launcher: shell in the machine's session may not start toybox: its caller's row does not list it. The sweep (ff1a11dbd) cut toybox from proctreecase.toml's [programs.shell] starts with the depth chain that launched shells, but a_detached_program_outlives_its_shell has a shell detach /system/bin/cat, a launch of the toybox row (/bin/cat links to /system/bin/toybox). The launch was refused, detach exited 126. The fix (aa6816c10) puts toybox back in the shell row's starts, and the config's header says why the row lists it.

The rest of process_tree's path, read for the same break. Every launch the test makes, by caller row and session: test-runner (machine session) launches cat (A's under-B launch, the pipe arm, and B's D and E through A's launcher copy) and shell; the shell, a login row in the machine's session, launches cat, opening a login session. Every other child is a direct spawn, which no row decides. The scratch launchcheck renders proctreecase.toml through the build's own manifest_and_symlinks and asks the supervisor's own toyos_manifest::launch::may_start each of those three: at b1d430bea the shell's launch of cat is Err(NotListed), EXIT=1, the T14's refusal (output); at aa6816c10 all three are allowed, the shell's as Opening(Not), EXIT=0 (output). That a shell's launch in this boot opens a login session that is answered, run 2 already shows: app_view's shells launched grants in one and passed. Past the detach, the arm asks the roster for one live cat: D and E are killed and waited by then, and a launched cat runs under the name cat (run 2's kernel log, lines 354–357).

The cheapest tier. The supervisor's decision is host code, and the launchcheck above runs it on the host over the image's rendered manifest; it is evidence, not a suite row, because what it checks is one line of one test image that reading sees. process_tree as a whole runs on no QEMU image (tests/toyos.rs: testcases.toml gives no launcher, declared cat or shell), so its green arm is the proctreecase boot at aa6816c10, staged by cargo test --test toyos-build -- --metal --metal-readback <dir> boot:proctreecase: EXIT=2, staged and judging nothing (log, request); its derived system config lists starts = ["toybox", "shell", "grants"] for the shell. Run 2 is the negative control, run 3 the green arm.

Run 3, at aa6816c10: boot:proctreecase. The orchestrator ran the staged boot, cargo run -p toyos-metal -- --image <dir>/proctreecase/image.img --readback <dir>/proctreecase --fat32-check (request), and judged it with cargo test --test toyos-build -- --metal --metal-readback <dir> boot:proctreecase: EXIT=0 (the orchestrator's comment above), "4 passed, 0 failed, 1 boot(s)": process_tree, launch_toctou, port_badge and app_view (judge log, verdict: passed). The boot's supervisor says build aa6816c1083174337e5271c55567b3672920e33d clean (line 322 of the boot's kernel log); the depth refusal at 65 is line 488, the chain stopping at link 62 line 551, a detached cat outlived its shell line 555, process_tree: PASS line 556 and exit=0 line 558. Nothing this branch changed since touches a file that boot's image builds from; the merge of #874 changes the kernel it builds, and run 5 below repeats it at the head.

Rows removed: shipped_client_departures, audio_idle_suspend, hda_client_stall, soundserver_log_stall, fs_share, and the logstallcase boot with them.

Run 4, at 59697d078: boot:testcases (the testcases and testcases-watchdog boots), run by the orchestrator. Judge cargo test --test toyos-build -- --metal --metal-readback <dir> boot:testcases: EXIT=0, 245 passed, 0 failed, 2 boot(s). Both verdicts read passed, and both supervisors read build 59697d07833b… clean. It is the T14 green arm for the rewritten lent_window_refused and the merged wake_onto_busy (logs).

Run 5, at 59697d078: boot:proctreecase, staged by the orchestrator from this head (cargo test --test toyos-build -- --metal --metal-readback <dir> boot:proctreecase, EXIT=2, staged) and run. Judge EXIT=0, 4 passed, 0 failed, 1 boot: process_tree, launch_toctou, port_badge and app_view are green on #874's kernel, and the supervisor reads build 59697d07833b… clean (logs).

The three ACPI rows

acpi_server_events, acpi_tables_loaded and battery_read drive acpiserver on a T14 boot, which the testing ruling refuses, and stay: nothing else reads the T14's firmware. They are recorded in issues/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md, owner its interpreter stage, with the orchestrator's oracle ruling. A definition block's load takes the whole block, and the track's "Extracts only" keeps whole tables out of the tree, so each block's load and \_S5 stay held by the T14's metal row that loads its own tables whole, acpi_tables_loaded, under the orchestrator's ruling on round 3's review. The AMD bench holds neither: acpiserver refuses its DSDT and loads none of its tables (issues/acpiserver-refuses-the-amd-benchs-dsdt-for-a-read-in-memory-mapped-io.md). The exit asks only what extracts can hold: extracts of the T14's tables, masked, committed with their provenance; host tests that evaluate each query method the controller raises, and the battery's and adapter's methods, over a scripted host and controller; and acpi_server_events and battery_read leave tests/toyos.rs in that diff. No loader path dumps tables for fixtures, and no reading taken under another OS is a fixture.

What I am unsure of

• process_tree keeps the shell's detach. The plan gave it to a host test of the shell's parser, but the shell builds on no host and its tokenizer reads the environment and the last status: lifting it is a redesign of the shell. I read detach as a launch under the supervisor, which the ruling keeps until stage 2, and recorded it there.
• The std and libc tests hold the decision, not its call site. unmade and send_to are what decides, and a mutation there is red; a patch to process.rs or socket.rs that skipped them would build a second route a reader sees, and no host test reaches those files.
• soundserver's replacements are three decisions, not the seam issues/soundservers-mix-pass-has-no-host-test.md describes. They hold what the two rows judged (no timer and no fill with no client; no deferral on a ring; a resume primes the whole ring); the whole pass with a fake device stays that issue's.
• libc_sockets' "a stream and its duplicate are one socket" is held by the type: TcpStream::duplicate clones the one Arc of each shared field, and no host test reaches it.
• lent_window_refused's kernel half is a T14 shared member, so its mutation can only redden there; fileserver's half is mutation 04.

Net lines (git diff --shortstat origin/main...HEAD): 117 files changed, 2225 insertions(+), 6731 deletions(-): tests +916 −5839 (tests/, the test packages' files, sdk/libc/arch and system/netstack/node/tests counted as tests), production +1274 −892 (the moved files counted on both sides, and the test modules of the lifted ones counted as production), issues/ +35.

🤖 Generated with Claude Code

https://claude.ai/code/session_015xhaydXCVRNscoccHYFUWy

[Japabu]

Plan accepted by the orchestrator (the owner handed technical calls to the orchestrator: "youre the new owner now"). Build it as surveyed: 15 delete, 21 replace, 192 keep (10 narrowed), each replacement landing with its cut. Rulings on the open points:

• launch_toctou, app_view and process_tree's launcher arms: they stay until the supervisor track's stage 2 lands. Record them, in the issue that track names, as the refused shape owed a cut, with that stage as the exit. They are not moved out of the supervisor ahead of it.
• The T14's recorded ACPI tables as test fixtures: no whole tables. They identify the machine, and the owner's "extracts only" rule stands. A fixture is the extract a test needs, masked, with no OEM, model, serial or table ID.
• hosted_clang_hello: keep. It is a module test of the hosted toolchain, which is self-hosting's north star, not an integration of userspace programs.
• The 18 tracks that name a refused test or row are updated in a separate issues-only pull request after this one lands.

The test image configs, build/build.rs lines, the ON_DEMAND check, logkeeper's --stall-until and proctest go with their tests, unless #889 lands first with proctest's deletion, in which case rebase onto it.

[Japabu]

Review of #893 at 5affa6759, against .claude/agents/reviewer.md on origin/main.

Net lines (git diff --shortstat origin/main...5affa6759): 118 files changed, 2062 insertions(+), 7366 deletions(-). By the body's split, tests are +554 −6337 and production +1493 −1029. Most of the production growth is test modules inside lifted files. I accept that, apart from the two packages named under BLOCKER.

BLOCKER

• system/fileserver/src/main.rs:788 — SYMLINK now refuses absolute and .. targets on every served volume. The target is read through self.path(), which now calls bounds::path (bounds.rs:179), and that requires canonical. On main, path() only checked UTF-8 and resolve() checked canonical, and the target never went through resolve(). The client sends targets uncanonicalised on purpose (sdk/toyos/src/fs.rs:523: "The target is stored, not resolved, so it is not held to canonical"). So std::os::toyos::fs::symlink("/home/x", "/home/l") now gets InvalidArgument. Main's stat_identity /home arm made exactly that call, and this branch cuts that arm, so the suite stays green over the regression. This contradicts the body's "no behaviour changed". Fix: decode the target with path_span and UTF-8 only, as main did. Lift that decode into bounds and add a host test that an absolute target and a .. target are both accepted. That test must go red on this head.

• sdk/std/sys/process.rs:539 — process_tree's cut arm a_place_without_dup_is_refused is held by nothing. The body says launch_route.rs holds "std's launch refusals", but route() never sees the place. The patch Some(place) => match toyos_abi::syscall::dup(place) { Ok(copy) => launch::Parent::Place(copy), Err(_) => return direct(None) }, is the fallback the cut arm guarded, and it would turn no test red. The plan (survey row process_tree) put this refusal in a host test of std's launch checks. It needs one, red under that patch. The cut a_named_image_is_spawned_directly also checked argv[0], and that check is likewise held nowhere.

• sdk/libc/src/socket.rs:445 — libc_sockets' sendto_unbound.c is held by nothing. It checked that a datagram socket is bound by its first sendto, or by send after connect, to a port the stack chooses, and that two such sockets hold two ports. Neither sdk/libc/arch's tests nor the node tests reach this. Deleting the if entry.netstack_id == 0 { bind_datagram(..) } block at :447-:452 would turn nothing red. The body's "libc's half by sdk/libc/arch's existing tests" is false for this file. The survey missed it too.

• system/toybox/applets/Cargo.toml:2, system/update/install/Cargo.toml:2 — Fit: code that one program alone uses now sits in a package of its own. toybox-applets is toybox's alone and update-install is update's alone. Neither is shared by two programs, and neither is an input boundary. Both reasons the body gives (toybox builds on no host; update's env! key) are answered by the shape the tree already uses, and that this branch uses itself for std (sdk/std/copies): a test-only package that compiles the program's own files by #[path], as toyos-libc-copies does. That keeps cp.rs, mv.rs, hexdump.rs, the roster decode and the install inside system/toybox and system/update. The accepted plan names lifts, not these packages. toyos-disk earns its place: diskserver and update share it.

• tests/toyos.rs:945, :1016, :887, :443 — Evidence: metal rows changed with no T14 reading. These need an orchestrator run on the T14 at the final head before landing:

  • the testcases boot: its jobs and shared members changed, it gained ring_kat, and disk_backtrace, endowment_denied, file_mtime, fs_truncate_persist, hierarchy_paths, lseek_past_eof, stat_identity and lent_window_refused are changed binaries that run only there;
  • proctreecase's rows, because process_tree is narrowed and proctreecase.toml changed: process_tree, launch_toctou, port_badge, app_view;
  • usbd_drives_the_type_c_controller, because usbd is no longer restarted;
  • hda_tone, whose judge's window changed (tests/common/audio.rs:16).

  Without that run, lent_window_refused's kernel half has no measurement at all.

• tests/toyos.rs, system/toybox/src/main.rs, tests/images/proctreecase.toml — The branch conflicts with origin/main (1a7464692). Delete the net and spin applets, proctest, and the launch_authority metal row #889 landed and deletes proctest and the launch_authority metal row (git merge-tree --write-tree origin/main 5affa6759: CONFLICT in all three). The rebase moves the head, and every gate and mutation above was measured at a head that will not land. Run --ci host, the guest suite and both --build-only again at the new head.

• PR body, "Replaced" preamble — Guest tests: the body does not say why a metal row cannot reach acpi_press_is_one_sci, the rewritten lent_device_memory_refused or nvme_disk_boots. It gives only the host reason. The reasons exist in the MACHINE_TESTS comments: nothing presses the T14's button, its only unheld function is its I219, and it boots from a stick. Put them in the body.

NOTE

• build/bootlog.rs:251 — lines_of has no caller left but its own test. log_stall_on_metal was its only user. Delete it.
• system/toybox/applets/src/ps.rs:61 — REFUSED.starts_with("ps: ") && REFUSED.contains("ROSTER") asserts a constant against itself, so it tests nothing. Cut the line; rows(&[]) == None is the claim.
• system/toybox/applets/src/hexdump.rs:48 — the usage refusal now prints as hexdump: Usage: … where main printed Usage: …. That is a change to what the applet says, under a lift the body calls behaviour-neutral.
• acpi_server_events, acpi_tables_loaded, battery_read — the plan's replacement is not built, and these rows stay refused by the ruling with nothing recording them in issues/. Record them, with an owner, the evidence and an exit, in the ACPI track. The plan's route was acpidump on the T14's Ubuntu, which the owner's direction on Linux now rules out, so the exit needs a source that direction allows.
• PR body — "with no behaviour changed" is false of the tree (the SYMLINK regression and the hexdump usage line), and the deleted count and the proctest row move once it is rebased onto Delete the net and spin applets, proctest, and the launch_authority metal row #889.

SEND BACK

[Japabu]

T14, proctreecase at aa6816c10, run by the orchestrator from agents/893-r4/metal/request.txt: judge cargo test --test toyos-build -- --metal --metal-readback <dir> boot:proctreecase exit 0, 4 passed, 0 failed. process_tree is green. With round 2's run at ff1a11dbd (248 of 249, only process_tree red), every row the review listed has now been read on the T14.

[Japabu]

Review of #893 at aa6816c10, round 3, against .claude/agents/reviewer.md on origin/main.

Net lines (git diff --shortstat origin/main...aa6816c10): 117 files changed, 2219 insertions(+), 6731 deletions(-). By the body's split, production is +1274 −892. I accept that growth: it is the lifted decisions and their test modules.

origin/main has since moved to b805e6154 (#900, issues only), and git merge-tree --write-tree origin/main aa6816c10 is clean.

Round 2's BLOCKERs

• SYMLINK refused absolute and .. targets: CLOSED. bounds::path (bounds.rs:107) now checks UTF-8 only, and resolve holds a path canonical through bounds::relative, as main did. a_link_s_target_is_taken_absolute_or_climbing is red under mutation 23 (EXIT=101) and green on the tree, with --ci host at the head running it. bounds.rs is blob c8293d33c at both ff1a11dbd and aa6816c10.

• a_place_without_dup_is_refused was held by nothing: CLOSED. process.rs now sends a failed dup to launch_route::unmade(PlaceNotCopied), which answers Failed and never Direct. Mutation 24 is red. argv[0] comes from image_and_name, and mutation 25 is red. launch_route.rs is the same blob at both heads.

• sendto_unbound.c was held by nothing: CLOSED. sendto's datagram arm, and a connected send through it, now go through dgramreq::send_to. Mutation 26, which deletes its bind, is red. The two-ports half is held by netstack's existing a_socket_holds_the_port_it_named_or_the_one_its_draw_picked, which runs in the --ci host log.

• The two folded packages: CLOSED. toybox-applets and update-install are gone:

  • cp.rs, mv.rs, hexdump.rs, roster.rs and src/install/ stay inside their programs. toybox-copies and update-copies compile them by #[path], at the programs' own edition.
  • No program file holds a cfg(test).
  • Mutations 09 through 13 are red, and all 26 patches still apply at aa6816c10 (git apply --check --cached against a scratch index).
  • The --ci host log runs toybox_copies, update_copies, toyos_std_copies and toyos_libc_copies.

• Metal rows with no T14 reading: OPEN, on evidence alone. Run 1 (ff1a11dbd, published) read all four boots, 248 of 249:

  • every changed testcases member exits code=0 in the readback (lent_window_refused, ring_kat, disk_backtrace, endowment_denied, file_mtime, fs_truncate_persist, hierarchy_paths, lseek_past_eof, stat_identity);
  • usbd_drives_the_type_c_controller and hda_tone pass.

  Between ff1a11dbd and aa6816c10 the branch touches only process_tree.rs and proctreecase.toml; everything else in that range is x86-64 kernel leaves are global under a declared CR4.PGE, and only a kernel-half change drops them #873's merge. So that reading stands for the rest. The proctreecase boot at aa6816c10 passed 4 of 4: its supervisor logs build aa6816c1083… clean, and its log reads process_tree: PASS after the chain and the detach. That reading exists only in the orchestrator's comment and in a local readback. Its log is not published, and the body still says "Until that boot is read, process_tree is unverified at this head". Publish the agents/893-r4/metal judge log, the boot's kernel log and its verdict, masked like runs 1 and 2. Cite them in the body as run 3, with command, EXIT=0 and "4 passed, 0 failed".

• Conflict with origin/main: CLOSED. b680a973b is merged in. --ci host at aa6816c10 gave EXIT=0, "76 step(s), all green", and --build-only gave EXIT=0. The guest suite at b1d430bea passed 52 of 52, and --build-only --arch aarch64 gave EXIT=0. The only difference between those two heads is proctreecase.toml, and outside the metal registrations only build/build.rs's list of configs it renders reads that file.

• No metal-tier reasons for the three QEMU replacements: CLOSED. The body's "Replaced" preamble now gives them.

BLOCKER

• PR body, "The T14" — process_tree's T14 reading at the head is not in the body, and its log is not published (above). Evidence: the hardware reading a change reaches needs its command, exit code and log in the body at that head.

NOTE

• system/toybox/copies/src/roster_reading.rs:20, :26 — the "two clocks" assert decodes an all-zero header and compares the result with itself. A rows that swapped uptime_ns and total_cpu_ns would pass. Write two distinct non-zero clocks into the header bytes and assert those values, or drop the clocks from the claim.
• sdk/std/copies/Cargo.toml:5 — edition = "2021" compiles launch_route.rs and turns.rs, but std builds them under 2024 (rust/library/std/Cargo.toml:9), and temporary drop scopes differ between the two. Nothing in either file reads differently today. Match std's edition, as toybox-copies and update-copies match their programs'.
• issues/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md:172-:177 — the exit asks host tests to "hold each block's load" from committed extracts. Loading a definition block takes the whole block, and the owner's "Extracts only" (:61) keeps whole tables out of the tree, so this exit cannot be met as written. It also makes the loader dump tables, which ships a loader path for fixtures alone. Narrow the exit to what extracts can hold (each method's evaluation over the scripted host and controller), and say which reader keeps each block's load.
• PR body — false of the record: "its kernel half has no reading until the requested run below" (run 1 read it); "Until that boot is read, process_tree is unverified at this head" (run 3 read it); and the deletions are 6731, not 6732.

SEND BACK

[Japabu]

Review of #893 at df92d1c4c, round 4, against .claude/agents/reviewer.md on origin/main. This round covers what changed since aa6816c10: 0dba06f1f and the merge of b805e6154 (#900, issues only).

Net lines (git diff --shortstat origin/main...df92d1c4c): 117 files changed, 2225 insertions(+), 6731 deletions(-). Since round 3: +6 test lines, and one line in a manifest. Production is unchanged from round 3, where I accepted its growth.

Round 3's findings

• BLOCKER, run 3's evidence: CLOSED. The body now cites run 3 at aa6816c10: the request, the judge command, EXIT=0, and "4 passed, 0 failed, 1 boot(s)". The published judge log (evidence e441e005c, test-sweep-r5/t14-aa6816c10/) reads PASS for process_tree, launch_toctou, port_badge and app_view, and the verdict file reads passed. The kernel log's supervisor line reads build aa6816c1083174337e5271c55567b3672920e33d clean. The depth refusal at 65, the 62-link chain, a detached cat outlived its shell and process_tree: PASS are at the cited lines. 0dba06f1f touches no file that image builds from.
• NOTE, the roster clocks: CLOSED. roster_reading.rs:21-:23 writes 0x0102…0708 and 0x1112…1718 at bytes 24..32 and 32..40. Those are SysinfoHeader::decode's uptime_ns and total_cpu_ns offsets (sdk/abi/src/syscall.rs). The test asserts those values. Mutation 27 swaps the two fields in roster.rs: green 0, mutated 101 with the swapped pair in the assert, reverted and clean (test-sweep-r5/mutations/27.log). The --ci host log at the head runs the test green (line 1107).
• NOTE, std copies' edition: CLOSED. sdk/std/copies/Cargo.toml:5 is 2024. cargo test -p toyos-std-copies gives EXIT=0 with 6 passed (std-copies.log).
• NOTE, the ACPI exit: CLOSED under the orchestrator's ruling. The exit (issues/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md:176-:180) asks extracts only for the query, battery and adapter methods. It drops the loader dump. It names acpi_server_events and battery_read as the rows that leave, and keeps acpi_tables_loaded for each block's load. A finding on its new sentence is below.
• NOTE, the body's false lines: CLOSED. The run-1 and run-3 lines are corrected, and the deletion count is 6731.

BLOCKER

• tests/toyos.rs:1001 — git merge-tree --write-tree origin/main df92d1c4c exits 1 with CONFLICT (content): Merge conflict in tests/toyos.rs. origin/main has moved to 347e3313d. A wake to another CPU that is busy is drained at its next preemption point and runs within a bound #874 added "test_rs_wake_onto_busy" to the testcases metal arm's member list, directly above the audio_idle_suspend entry this branch deletes. The branch cannot enter the merge queue as it stands, so the body's "still its tip" is no longer true. Merge origin/main, keep wake_onto_busy, and drop audio_idle_suspend and its comment. A wake to another CPU that is busy is drained at its next preemption point and runs within a bound #874 also changes acpi_mediated.rs (it auto-merges with this branch's rewrite), the kernel's scheduler and two guest tests. Evidence at the resolved head therefore needs cargo run -- --ci host and the guest suite cargo test --test toyos-build, each with its EXIT and a published log. It also needs the T14 testcases boot to be staged with --metal-readback, which shows the merged member list builds.

NOTE

• issues/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md:174-:175 — the new sentence says each block's load and \_S5 "stay held by the metal rows that load a machine's own tables whole: acpi_tables_loaded on the T14, and the AMD bench's". That is false of the record. On the AMD bench, acpiserver loads 0 of 17 tables and hands over no \_S5, because the DSDT is refused (issues/acpiserver-refuses-the-amd-benchs-dsdt-for-a-read-in-memory-mapped-io.md). Name the T14's row alone, or name the AMD bench's only once that defect's exit is met.

SEND BACK

[Japabu]

T14 at 59697d078 (the merge with #874 and #896), run by the orchestrator from agents/893-r6/t14/request.txt: the testcases and testcases-watchdog boots. Judge cargo test --test toyos-build -- --metal --metal-readback <dir> boot:testcases, exit 0, 245 passed, 0 failed, 2 boots.

[Japabu]

Review of #893 at 59697d078, round 5, against .claude/agents/reviewer.md on origin/main. This round covers what changed since df92d1c4c: the merge fa4e4358d of 347e3313d (#874, #896), and 59697d078, which edits the ACPI issue (+2 −2).

Net lines (git diff --shortstat origin/main...59697d078): 117 files changed, 2225 insertions(+), 6731 deletions(-). Since round 4 the branch's own diff has moved only in the issue file. Production is unchanged from round 3, where I accepted its growth.

Round 4's findings

• BLOCKER, the conflict with main: CLOSED.
  • fa4e4358d resolves tests/toyos.rs's testcases arm as asked. It keeps "test_rs_wake_onto_busy" and drops "test_rs_audio_idle_suspend" and its comment (git show --cc fa4e4358d). acpi_mediated.rs auto-merged.
  • At the head, the published cargo run -- --ci host gives EXIT=0, "Host: 76 step(s), all green" (test-sweep-r6/ci-host.log:8974).
  • The guest suite cargo test --test toyos-build gives EXIT=0, "52 passed, 52 total" (guest-suite.log:703), with acpi_mediated_access passing at :370.
  • exits.txt names head 59697d07833b….
  • origin/main has since moved to 1d5325376 (issues: the speed track's stages stand on the vendors' documents and the literature, and report their figures #887, eight issues/ files). The branch touches none of them, and git merge-tree --write-tree origin/main 59697d078 exits 0.
  • The orchestrator's T14 run builds the merged member list on the machine (below).
• NOTE, the ACPI sentence: CLOSED. issues/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md:174-:175 now names only the T14's acpi_tables_loaded. The file names no AMD bench as holding the load.

The T14 run at the head, read from its readback

/Users/jan/.claude/jobs/2280e09e/tmp/scratchpad/agents/893-r6/t14/:

• judge-head.log ends "245 passed, 0 failed, 2 boot(s)", with 222 of 222 shared members marked.
• Among the passes are wake_onto_busy, acpi_server_events, acpi_tables_loaded (14 of 14 tables, \_S5 handed over) and battery_read.
• testcases/verdict.txt and testcases-watchdog/verdict.txt both read passed.
• Both kernel logs' supervisor line reads build 59697d07833b1e80e532a6dda4e3f26dde01b570 clean (testcases/kernel.log:322, testcases-watchdog/kernel.log:324).

The run is sound. It is not yet evidence: the body does not carry it (first BLOCKER).

BLOCKER

• PR body, "Gates" and "The T14" — the T14 testcases run at 59697d078 is missing from the body, which still says "the boot itself is the orchestrator's to run". The readback is a local path and a comment, with no published log. Evidence asks for the measurement in the body, with its command, exit code and log. Publish to the evidence repository, masked as root CLAUDE.md masks what is posted:

  • request.txt
  • judge-head.log
  • both verdict.txt files
  • both kernel logs, or at least their supervisor build 59697d0… clean lines

  Cite in the body the judge command cargo test --test toyos-build -- --metal --metal-readback <dir> boot:testcases, its EXIT=0, and "245 passed, 0 failed, 2 boot(s)". This run is also the T14 green arm for the rewritten lent_window_refused and the merged wake_onto_busy member, so name both.

• PR body, "Run 3" — process_tree is a row this branch narrows, and it runs only on the T14 proctreecase boot. Its only green run is at aa6816c10. The body itself says "the merge of A wake to another CPU that is busy is drained at its next preemption point and runs within a bound #874 changes the kernel it builds, and the run was not repeated at the head". A wake to another CPU that is busy is drained at its next preemption point and runs within a bound #874 changes the scheduler: the busy-CPU wake drain, kernel/pure/sched/cpu.rs +439, and kernel/src/hw.rs. The narrowed process_tree exercises that path: a 62-link chain of direct spawns, a detach and a roster read. Evidence asks for the hardware reading at the head, and here it costs one boot. Stage boot:proctreecase at 59697d078 with --metal-readback, have the orchestrator run it, and cite its judge EXIT, its verdict and its supervisor build line in the body.

NOTE

• PR body, "Gates" — "origin/main 347e3313d (A wake to another CPU that is busy is drained at its next preemption point and runs within a bound #874, issues: what the shipped OS takes from QEMU, and the track to run in any open-source hypervisor #896) merged in and still its tip" is false of the record. origin/main is 1d5325376 (issues: the speed track's stages stand on the vendors' documents and the literature, and report their figures #887, issues only, merges clean).

SEND BACK

[Japabu]

Review of #893 at 59697d078, round 6, against .claude/agents/reviewer.md. The code is unchanged since round 5: the head is still 59697d07833b1e80e532a6dda4e3f26dde01b570. This round reads only the body and its evidence, which is ToyOSOrg/evidence pr-893 at 22b8e09a0, under test-sweep-r7/.

Net lines (git diff --shortstat origin/main...59697d078): 117 files changed, 2225 insertions(+), 6731 deletions(-). This matches the body's figure.

Round 5's findings

• BLOCKER, the T14 testcases run at the head was not in the body: CLOSED. It is now run 4. I checked it against t14-testcases-59697d078/:
  • judge-head.log ends 245 passed, 0 failed, 2 boot(s). It reports 23 registrations and 222 shared members, and "222 of 222 with both markers".
  • wake_onto_busy, acpi_server_events, acpi_tables_loaded (14 of 14 tables) and battery_read all PASS.
  • testcases/verdict.txt and testcases-watchdog/verdict.txt both read passed.
  • Both supervisors' build lines read build 59697d07833b1e80e532a6dda4e3f26dde01b570 clean (testcases/kernel.log:322, testcases-watchdog/kernel.log:324).
  • lent_window_refused ends code=0 and ===TEST_END test_rs_lent_window_refused exit=0=== (testcases/kernel.log:47486-:47487).
  • request.txt names both boots and the toyos-metal invocation.
  • The body states the judge command, EXIT=0 and the tally. It names this run as the green arm for lent_window_refused and wake_onto_busy.
• BLOCKER, process_tree had no T14 run at the head: CLOSED. It is now run 5. I checked it against t14-proctreecase-59697d078/:
  • judge-head.log ends 4 passed, 0 failed, 1 boot(s). process_tree, launch_toctou, port_badge and app_view all PASS.
  • proctreecase/verdict.txt reads passed.
  • kernel.log:322 reads build 59697d07833b… clean. The image was therefore built from this head, on A wake to another CPU that is busy is drained at its next preemption point and runs within a bound #874's kernel.
  • The depth refusal at 65 is at :488. The 62-link chain stopping on the refusal is at :551. "a detached cat outlived its shell" is at :555, process_tree: PASS at :556 and exit=0 at :558.
• NOTE, the body said 347e3313d was still main's tip: CLOSED. The body now says main has since gained issues: the speed track's stages stand on the vendors' documents and the literature, and report their figures #887, issues only, which merges clean.
  • origin/main is 1d5325376, and 347e3313d..origin/main touches only issues/.
  • The branch touches none of those eight files.
  • git merge-tree --write-tree origin/main 59697d078 exits 0.

Masking

I scanned all thirteen published files in test-sweep-r7/. None contains a MAC address, an IPv4 or IPv6 address, a username or a home path. Vendor, model, BIOS, OEM ID, the stick's serial and paths read as <vendor>, <model>, <bios>, <serial> and <path>. Each boot's four GUIDs are the freshly written stick image's own partitions and differ from boot to boot, so they identify no machine.

Links

All 59 distinct evidence links in the body resolve at their pinned commits, both tree/ directories included. I checked each one through the contents API.

BLOCKER

None.

NOTE

None.

LAND