Test oracles come from ACPI 6.5, the SDM and ToyOS's own reads; Linux is a goal in issues (#919/#915 follow-up)

issues/README.md

@@ -62,12 +62,13 @@ and an agent that "fixes" one has decided something that was his to decide. But
 a file blocked on an *instrument* — a gate, a machine, a measurement — is not a
 question. Nobody has to decide it; somebody has to run it.
 
-**`kind: track` is what a plan used to be**, and it is written to the length a
-defect is. A `track` says what is to be built, what it is blocked on, and any
-constraint a reader would otherwise pay to re-derive — a hardware bound, a
-number somebody measured, a design line the owner already drew. It does not
-carry a design, a stage table, a rationale or a review history: a design that is
-right is written as code, and one that is not yet written is not yet known.
+**`kind: track` is what a plan used to be.** A `track` says what is to be
+built, what it is blocked on, and any constraint a reader would otherwise pay to
+re-derive — a hardware bound, a number somebody measured, a design line the
+owner already drew. Work that lands in stages lists them in order, each with
+what it builds, the design decisions its brief settled and its exit. A track
+carries no rationale and no review history: those stay in the pull requests and
+commits that settled it.
 
 ## Slugs
 

issues/each-boot-prints-the-vulnerabilities-lines-linux-prints.md

@@ -7,12 +7,17 @@ opened: 2026-09-29
 # Each boot prints the vulnerabilities lines Linux prints
 
 **Exit**: each proving machine's ToyOS boot prints, for each vulnerabilities
-file, the line Linux at `Ubuntu-6.8.0-142.142` printed on that machine: the
-T14's from
-`issues/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md`,
-each EPYC guest's from its runner's capture. It omits only clauses about what
-ToyOS does not run: `spectre_v1`'s swapgs barriers while it runs no `swapgs`,
-the KVM and VM-exit clauses since it runs no guest, and `IBRS_FW` since the
-kernel calls no firmware; `spec_store_bypass` reads "Mitigation: Speculative
-Store Bypass disabled per program". **Mutation**: `ARCH_CAPABILITIES` read as
-0 reds the T14. **Oracle**: Linux's lines.
+file, a line stating what
+`issues/a-pure-function-decides-a-cpus-speculation-mitigations-from-its-vendors-guidance.md`
+decided for that CPU from the words ToyOS read there, and on the T14 the words
+it logs equal the T14's words that issue commits with their provenance, so its
+line is the function's verdict on them. It omits only clauses
+about what ToyOS does not run: `spectre_v1`'s swapgs barriers while it runs no
+`swapgs`, the KVM and VM-exit clauses since it runs no guest, and `IBRS_FW`
+since the kernel calls no firmware; `spec_store_bypass` reads "Mitigation:
+Speculative Store Bypass disabled per program". **Mutation**:
+`ARCH_CAPABILITIES` read as 0 reds the T14. **Oracle**: the vendor's
+guidance through that function, over the words committed with provenance. The line Linux at
+`Ubuntu-6.8.0-142.142` prints on each machine is the goal, compared in
+evidence; a clause ToyOS's line lacks is a finding against this issue, never a
+test's expected value.

issues/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md

@@ -13,17 +13,19 @@ Ubuntu leaves the T14 only after this issue and
 `issues/no-program-measures-toyos-against-linux-on-one-machine.md`
 close.
 
-**Exit**: `wt/toyos-linux-sweep`, which holds this section and this slug
-under #915's fence, settles the turbostat readings below.
+**Exit**: the Linux readings on the T14 that
+`issues/toyos-explains-itself.md` (each counter ToyOS reads there) and
+`issues/no-program-measures-toyos-against-linux-on-one-machine.md` (that
+program's outputs under Ubuntu) compare against are taken before the wipe and
+published in evidence.
 
 ## Linux's counter readings, read 2026-10-03
 
-The orchestrator takes this Linux as the one independent oracle for the T14's
-hardware counters (`issues/toyos-explains-itself.md`). Read as
+A measurement of Linux on the same machine, never a test's oracle. Read as
 root under Ubuntu's `6.8.0-142-generic` from 16:22:37 UTC, one after the
-other, and committed whole with their commands in the `SOURCE` beside them:
-turbostat idle and under one `yes` per CPU in `tests/metal/t14-linux/`, which
-`counters_on_metal` prints ToyOS's reading beside.
+other, and published whole with their commands in
+[evidence](https://github.com/ToyOSOrg/evidence/tree/423044d281a0e0df5bde10688b2baf59ca2be9b6/pr-929/t14-linux):
+turbostat idle and under one `yes` per CPU.
 Idle, per 10 s: busy 0.11 to 0.36%, busy clock 980 to 1668 MHz, TSC 2419
 MHz, SMI 0. Loaded: busy 99.77%, busy clock 3800 MHz for the first two
 intervals, 3555 MHz in the third, then 3075 to 3094 MHz; SMI 0.

issues/no-entry-or-switch-clears-the-bhb-fills-the-rsb-or-issues-an-ibpb.md

@@ -18,10 +18,13 @@ the ask is the flag of
 
 **Exit**: a gate over `kernel.elf`, on the decoder of
 `issues/no-gate-decodes-kernel-elfs-instructions.md`, matches it against
-both of Linux's sequences; on
+the branch history clearing and return stack filling sequences Intel's and
+AMD's published guidance prescribes; on
 every proving machine probes count what
 `issues/a-pure-function-decides-a-cpus-speculation-mitigations-from-its-vendors-guidance.md`
 selects for it: a clear per syscall where it selects the loop, a fill per
 switch where it selects filling, and two IBPBs over B, C, idle, B, A, idle, A,
 B. **Mutation**: either sequence edited, the clear's condition inverted, no
-fill, the IBPB decided by the previous root. **Oracle**: Linux's sequences.
+fill, the IBPB decided by the previous root. **Oracle**: the vendors'
+published sequences. Linux's sequences are a goal compared in evidence, never
+the gate's expected text.

issues/no-program-measures-toyos-against-linux-on-one-machine.md

@@ -17,10 +17,12 @@ sides each read their x2APIC ID from CPUID.0BH:EDX before and after the timed
 window, and a pure function over the four readings refuses the figure when the
 two sides' IDs match or either side's changed across the window.
 
-**Exit**: the outputs committed as fixtures, and that function host-tested.
-**Mutation**, each red: a pair on one CPU passes; only the readings before the
-window compared, so a sibling that moved onto the initiator's CPU inside it
-passes. **Oracle**: Linux.
+**Exit**: both runs' outputs published in evidence, and that function
+host-tested on crafted readings. **Mutation**, each red: a pair on one CPU
+passes; only the readings before the window compared, so a sibling that moved
+onto the initiator's CPU inside it passes. **Oracle**: the function's rule over
+the x2APIC IDs it is handed. Linux's outputs are a goal ToyOS's are compared
+against in evidence, never a fixture a test reads.
 
 What stands nearest is `counters_metal`'s `loaded` phase
 (`tests/guest/rust-tests/src/bin/counters_metal.rs`), the one lateness reading

issues/spec-ctrl-and-gds-stay-as-firmware-left-them.md

@@ -15,7 +15,8 @@ unmitigated if firmware left `GDS_MITG_DIS` set. Linux at
 
 **Exit**: on every proving machine each CPU's 0x48 holds what
 `issues/a-pure-function-decides-a-cpus-speculation-mitigations-from-its-vendors-guidance.md`
-selects for it, on the T14 Linux's read less SSBD; on the T14, the one proving
-machine with GDS, a probe sets `GDS_MITG_DIS` and reads it clear after the
-kernel's write. **Mutation**: the clear deleted. **Oracle**: Linux's reads on
-each machine.
+selects for it; on the T14, the one proving machine with GDS, a probe sets
+`GDS_MITG_DIS` and reads it clear after the kernel's write. **Mutation**: the
+clear deleted. **Oracle**: the vendor's guidance through that function, and
+ToyOS's own reads on each machine. Linux's reads of 0x48 and 0x123 on each
+machine are a goal compared in evidence, never a test's expected value.

issues/suite-rows-that-are-measurements-or-make-several-claims.md

@@ -20,7 +20,7 @@ Measurements as `METAL` rows in `tests/toyos.rs`:
 
 - `counters` (`counters_on_metal`): records fresh and named by APIC id, SMI counts moved only by
   the kernel's commands, MPERF against the stamp, an idle second with no log line, the HWP request
-  and a turbostat frequency floor. The HWP request's oracle is
+  and a floor at the rate MPERF counts at. The HWP request's oracle is
   `issues/t14-rows-hold-toyos-to-linuxs-choice-or-copy.md`'s.
 - `acpi_tables_loaded` (`acpi_tables_on_metal`): the definition-block count, the MTRRs compared
   across CPUs, nothing refused, and the AML reads. The count's oracle is the same issue's.

issues/the-tree-says-who-uses-each-thing.md

@@ -138,7 +138,7 @@ build/    CLAUDE.md; the root package's library and binaries (bin/ toyos-flash i
           ssh/ (package toyos-ssh)
 tests/    CLAUDE.md; toyos.rs checks.rs common/ checks/ (the root package's test targets)
           guest/ (proctest kernelprobe metalprobe test-runner rust-tests/) images/ (one .toml per boot case)
-          metal/ (package toyos-metal: the loop, and t14-linux/, the Linux readings)
+          metal/ (package toyos-metal: the loop)
           corpus/tinycc/ cavp/
 ports/    <name>/recipe.toml and patches/, empty until the first
 issues/   <slug>.md
@@ -235,9 +235,8 @@ tree's top level: `.cargo`, `.claude`, `.github`, `.gitignore`,
    package depends on a path outside `sdk/`; `--build-only` and the guest
    suite green.
 8. **Tests and images:** `images/`, `tests/images/`, `tests/metal/` (the
-   metal loop as package `toyos-metal`, with the Linux readings in
-   `t14-linux/`; a machine's records are in the host's store, so there is no
-   descriptor), `tests/guest/rust-tests/`, `tests/guest/c/` and
+   metal loop as package `toyos-metal`; a machine's records are in the
+   host's store, so there is no descriptor), `tests/guest/rust-tests/`, `tests/guest/c/` and
    `tests/corpus/tinycc/`. Image names stay `bootable-<stem>.img`.
    `whole_disk` and `Node`, which `toyos-flash` and the loop both read, are
    in `build/disk.rs`. Landed with stage 4, in one pull request. **Exit:** no

issues/toyos-explains-itself.md

@@ -79,5 +79,8 @@ thermal counters, the log's steps, accounting, `inspect` and `size`.
 manifest row names; a program without the counters right is refused a
 counter read, and one that holds it but not `trace` is refused the power and
 per-device interrupt counters; and a T14 row holds each counter ToyOS reads
-there against Linux's reading of it
-(`issues/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md`).
+there to the bound Intel's SDM gives it where it gives one, as `counters_on_metal` holds the busy
+clock to the rate MPERF counts at. Linux's reading of each counter is a goal compared in
+evidence
+(`issues/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md`),
+never a row's expected value.

issues/tsx-stays-as-firmware-left-it.md

@@ -19,8 +19,8 @@ T14's `CONFIG_X86_INTEL_TSX_MODE_OFF=y`, runs `tsx_init`
 
 **Exit**:
 `issues/a-pure-function-decides-a-cpus-speculation-mitigations-from-its-vendors-guidance.md`
-carries `tsx_init`'s decision and every CPU applies it; on the T14, ToyOS's
-reads of 0x122, 0x10F and 0x123 equal the Linux reads of
-`issues/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md`
-where each exists, and dropping the write leaves 0x122 or 0x10F at firmware's
-value and reds it.
+carries the TSX decision of the vendor's guidance and every CPU applies it; on
+the T14, ToyOS's own reads of 0x122, 0x10F and 0x123 hold what that decision
+selects where each exists, and dropping the write leaves 0x122 or 0x10F at
+firmware's value and reds it. Linux's reads of the same registers on the T14
+are a goal compared in evidence, never a test's expected value.

lib/acpi/tests/resource.rs

@@ -27,9 +27,10 @@ fn windows(bytes: &[u8], room: usize) -> Result<Vec<RootBridgeWindow>, ResourceE
     Ok(out)
 }
 
-/// The shape the T14's firmware answers in, as Linux's own journal reports it:
-/// two memory windows and the I/O and bus ranges beside them, of which only the
-/// memory ones are windows a BAR could be placed in.
+/// A root bridge's list carries bus number, I/O and memory ranges, which a
+/// descriptor's Resource Type tells apart (ACPI 6.5 §6.4.3.5.1, byte 3: 0
+/// memory, 1 I/O, 2 bus number); only the memory ranges are windows a BAR
+/// could be placed in.
 #[test]
 fn only_the_memory_ranges_of_a_root_bridge_become_windows() {
     let bytes = list(&[

lib/acpi/tests/thinkpad_t14.rs

@@ -1,6 +1,5 @@
-//! The T14's fixed hardware and SCI, decoded from an
-//! extract of its FACP and APIC and held against what Linux read on the
-//! same machine (`fixtures/thinkpad-t14/SOURCE`).
+//! The T14's fixed hardware and SCI, decoded from an extract of its FACP and
+//! APIC and held to what ACPI 6.5 says the machine's bytes mean.
 //!
 //! **An extract, never the tables**: each table here is laid out from the
 //! fields `fixed_hardware`, `pm1a_control` and `sci_line` read, at their offsets and
@@ -65,14 +64,13 @@ fn open(bytes: Vec<u8>, signature: &[u8; 4], needed: usize) -> Table<Machine<'st
     Table::open(Machine { regions }, AT, signature, needed).expect("a sealed extract")
 }
 
-/// Linux: `ACPI: PM-Timer IO Port: 0x1808` beside the blocks this names, and
-/// the firmware issue's reading of `SMI_CMD=0xb2`, `ACPI_ENABLE=0xf0` and
-/// `PM1a_CNT` at port 0x1804; `Enabled 9 GPEs in block 00 to 7F`, a GPE0 block
-/// of 128 GPEs, sixteen bytes of status then sixteen of enable; and `Power
-/// Button [PWRF]`, the fixed-feature button, beside `Sleep Button [SLPB]`, a
-/// control method device.
+/// ACPI 6.5 Table 5.9 at the machine's offsets: `SCI_INT` 9; `SMI_CMD` 0xb2,
+/// `ACPI_ENABLE` 0xf0, `ACPI_DISABLE` 0xf1; `PM1a_EVT_BLK` 0x1800 of
+/// `PM1_EVT_LEN` 4, `PM1a_CNT_BLK` 0x1804 of `PM1_CNT_LEN` 2, `GPE0_BLK` 0x1860
+/// of `GPE0_BLK_LEN` 32; and Table 5.10's `PWR_BUTTON` clear, the
+/// fixed-feature power button.
 #[test]
-fn the_t14s_fadt_names_the_blocks_linux_served_its_sci_through() {
+fn the_t14s_fadt_names_its_fixed_hardware_and_sci() {
     let bytes = laid_out(b"FACP", FACP_REVISION, FACP_LEN, FACP_FIELDS);
     let fadt = open(bytes, b"FACP", FADT_FOR_FIXED_HARDWARE);
     assert_eq!(
@@ -88,7 +86,9 @@ fn the_t14s_fadt_names_the_blocks_linux_served_its_sci_through() {
     assert_eq!(pm1a_control(&fadt), Ok(Block { port: 0x1804, len: 2 }));
 }
 
-/// Linux: `ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)`.
+/// ACPI 6.5 Tables 5.25 and 5.26 over the second override: bus 0, source 9,
+/// global system interrupt 9, flags 0x000d, polarity 01 active high and
+/// trigger mode 11 level-triggered.
 #[test]
 fn the_t14s_madt_names_its_sci_level_and_active_high() {
     let list: Vec<u8> = APIC_OVERRIDES.iter().flat_map(|o| entry(o[0], o[1], &o[2..])).collect();