tests: the measured schedule — Fast is every PR, then Nightly, then Weekly; 15 never-caught tests and the kernel code only they armed deleted

[Japabu]

The guest suite runs on the schedule the owner adopted from what each test has caught: 426 of 524 CI-scheduled guest tests never caught a real defect, and they were 87% of guest time.

The schedule

Every price is the sum of the report's per-test medians (table_pertest.md, "cost s"). "Before" is the report's own tier column; "after" is cargo test --test toyos-build -- --list at 9b2645e, each name joined to its median. Counts are runnable tests; disabled rows run nowhere and are counted apart.

tier	before: tests	before: guest s	after: tests	after: guest s
Fast (cargo test, every PR)	393	614.4	227	84.0
Nightly (--nightly)	114	2617.3	143	751.9
Weekly (--weekly)	—	—	117	2247.1
Local (unsharded runs only)	3	unpriced	3	unpriced
disabled rows	17	—	22 (9 Fast, 12 Nightly, 1 Weekly)	—

run	before: guest s	after: guest s
plain cargo test	614.4	84.0
--nightly	3231.7	835.9
--weekly	—	3083.0

Unpriced after, and summed as 0: with no row in the report, in Fast, c_hello, doom_frames and netd_refused_accept, which main added at Fast, and eight C tests of the shared boot (03_struct, 33_ternary_op, 79_vla_continue, 85_asm_outside_function, 94_generic, 98_al_ax_extend, 122_vla_reuse, 127_asm_goto); in Nightly, heap_ceiling_bounds, heap_over_ceiling_halts, klogd_fault_halts, lock_across_switch_halts, syscall_fault_halts and syscall_panic_halts, which main added at Nightly. With a row whose median is n/m: abuse_shm_length in Fast, and audio_tone_load and tls_rebase_window in Nightly.

Where a registration differs from its bucket, the reason is one of these:

• A boot group has one tier, its most frequent member's: metal_sim_scanout_wc, metal_sim_ipc_hostile_peer, metal_sim_compositor_stall, metal_sim_client_death, i8042_no_spurious_wake and locale_detect_unrecognized are weekly-bucket riders on a nightly boot, and stay Nightly.
• Audio and timing rows wt/toyos-notiming rewrites keep the tier they had (below).
• Five guards stay, Weekly (below).
• Disabled rows keep their tier, and rows main added keep main's.

Decisions

• src/tiers.rs: Tier gains Weekly, and a run's Reach (plain, --nightly, --weekly) selects its own tier and every narrower one. A test's tier is declared once, as the word in its registration row. Schedule is every registered name at its one tier: a second row for a name is refused by name. The harness builds it from the shared boot's binaries and the three declared registries; it replaces check_no_collisions and check_registration's duplicate loop, answers the redlist's "is this registered" (contains), and drives --list.
• src/testargs.rs: --weekly. --nightly --weekly is refused, because the second would be read by nothing. Either reach beside --audio-gate or --metal is refused too: --metal --nightly used to be accepted and its --nightly dropped.
• CI: nightly.yml has two crons, 0 3 * * 1-6 and 0 3 * * 0, and nothing else changes in YAML. The guest job reads the schedule that started it from $GITHUB_EVENT_PATH and runs --weekly on Sunday's and --nightly on the other, on a dispatch and off a runner (src/ci.rs's reach_of_event, host-tested). A schedule the file does not declare is a red step. A test holds the two crons in nightly.yml against the two in src/ci.rs.
• Before a release: cargo test --test toyos-build -- --weekly.
• A run that holds tiers back names each one with its flag: not run without --nightly: / --weekly:, and , N held back for --nightly, M held back for --weekly in the result line.
• No boot names a binary the suite did not build, and --list says so. Every CARRIES row is checked against the built catalogue before --list, --debug and --audio-gate, not only before the first boot.
• The harness's own checks leave the guest tiers. The eleven that boot nothing (serial_vocabulary, suspend_detector, suspend_invalidates_a_verdict, stall_is_not_a_verdict, nvme_image_is_held_by_one_guest, control_regs_verdict, i8042_quarantine_verdict, suite_split, run_exit_status, nightly_tier_is_announced, screen_decoder) are libtest tests of a new target, toyos-checks: tests/checks.rs includes tests/toyos.rs under the test harness and holds the checks and the helpers only they read. src/ci.rs's host job runs it, and so does every plain cargo test. No guest row, dispatch arm or duration line is left for any of them.
• DRIVEN_AND_SHARED stays beside RUST_SKIP in tests/toyos.rs, since the two lists are one partition, and its block is main's byte for byte. Only toyos-checks' suite_split reads it, so the harness = false target carries one #[allow(dead_code, reason = …)] on it. #[cfg(test)] in its place does not tell the two targets apart: cargo run -- --clippy checks toyos-build under cfg(test) too, and fails there with "constant DRIVEN_AND_SHARED is never used" (EXIT=1).

Deleted: 15 of the 26

console_line_atomicity, home_budget_refusal_retried, i8042_keyboard, klogd_panic_halts, log_conservation_smp4, log_conservation_smp8, quiesce_dump_holds_the_stopped, quiesce_wakes_on_the_last_exit, screen_early_panic, so_cache_refusals, sshd_fail_closed, usb_disk_index_stable, wall_clock_file, xhci_hid_break, xhci_hotplug.

Each one went with its harness code, its dead helpers, its duration row, its redlist row and its CARRIES and RUST_SKIP rows. The guest binaries console_line_atomicity, home_fsync_budget and so_cache_policy went too, quiesce_last lost the exiting thread only the last-exit test held, and the test runner's CONSOLE_JOBS, whose one entry was test_rs_console_line_atomicity, went: every job's stdin is a pipe now. So did the kernel code only these tests armed: the actuators quiesce-last-exit, quiesce-dump, so-cache-tiny, xhci-hid-break-first, xhci-hid-break-late and klogd-panic, with quiesce::last's exit hold (Last collapses to the park it still stages), sched::dump::serve_for_the_stop, DumpRequest::file_and_take and its loom model, the cache's tiny budget, HidDevice::stage_break and its completion count, and klogd's staged panic. kernel/src is net −133 lines.

The three whose exit needs a run name their reproducer as it stands at 1808fb8d, this branch's base on main: console_line_atomicity with its CONSOLE_JOBS stdin, so_cache_refusals with the so-cache-tiny budget, and home_budget_refusal_retried, whose file now names its owner, the orchestrator. quiesce-wakes-on-the-last-exit-lost-its-serial-ready-beside-other-guests (kind: finding) goes with its test. a-quiesce-writers-first-pass-outlasts-the-jobs-five-second-spin-up stays expected-red behind quiesce_stops_the_machine, and its sentence naming the deleted quiesce_dump_holds_the_stopped as booting quiesce_writers goes.

Where coverage of a deleted test stands:

• log_conservation_smp4/_smp8: kernel-loom log_ring's a_published_record_is_whole_and_read_once and a_lane_publishes_whole_and_reuses_only_after_a_read; log_conservation_smp1 remains, Weekly.
• wall_clock_file's retention: userland/logd/src/store.rs's whole_old_boots_go_first_then_earlier_continuations and a_flooding_boot_costs_its_own_middle_and_nobody_elses_start.
• xhci_hotplug: toyos-xhci's sim a_device_plugged_in_is_enumerated_once and unplugging_tears_the_device_down.
• xhci_hid_break: teardown.rs's a_halted_endpoint_is_reset_cleared_and_delivering_again and a_recovery_the_controller_refuses_lets_the_device_go.
• klogd_panic_halts: klogd_fault_halts drives the klogd context and syscall_panic_halts the panic! entry.
• sshd_fail_closed: sshd's a_file_that_names_nobody_authorizes_nobody holds the authorization half. The "never listens" half (userland/sshd/src/main.rs) has no gate.
• screen_early_panic: blackbox_early_panic_sealed_muted reads the early panic off the panel, without check_colors.

Kept, Weekly, and why:

• syscall_window_nmi, syscall_window_nmi_controls and dump_nmi_probe. What they guard (IST fix NMI and #MC get stacks of their own, because three instructions of syscall entry run at CPL 0 on the user's stack #234, the NMI dump) is the frame an x86 CPU pushes for an NMI taken at CPL 0 on a user rsp, and whether vector 2's IST index keeps it off that stack. Only a CPU produces that frame. The controls' catch data predates The NMI window control holds its victim inside the entry instead of hoping a spray lands there #470's rewrite of the control, so fresh runs judge it. dump_nmi_probe's verdict is also a 1 ms NMI budget, flagged for wt/toyos-notiming.
• fat_backing_revoked, the only gate on a revoked FAT32 backing never serving reallocated data, and launcher_refusals, the only gate on init refusing hostile launches and surviving them with no census growth. Neither can be held on the host without a new abstraction. The FAT revocation is FatFs::delete's revoke and FatBacking::read_page in kernel/src/fat32_adapter.rs, and no host test compiles the kernel. The launcher's refusals are /system/bin/init's serve_launch against real handles and the kernel's SYS_NAMESPACE_BUILD answer, and init builds only for the ToyOS target.

Left to wt/toyos-notiming (not touched here):

• From the delete bucket: doom_sound_flood, metal_sim_null_audio, latency_wake, short_sleep_livelock, sched_check_build, and i8042_health_cadence, whose verdict is a cadence over a real span.
• Rows it rewrites, left at their old tier: doom_music, soundd_log_stall, i8042_absent, null_sink_shipped_client, netd_stalled_peer, desktop_audio_client, hda_client_stall, hda_tone, kernel_heartbeat, xhci_slow_connect, audio_tone, audio_tone_load.

panic_halts_the_others_first is Nightly and hda_two_live_refused Weekly, by their buckets.

Host conversions: 5 of 13

defect	host test	arm	exit	the named reason
B02 initiators deadlocked	kernel-loom an_initiator_answers_while_it_waits (already there)	b02-initiator-stops-answering: wait_turn stops serving	101	"cpu 0 is waiting for cpu 1 and has stopped answering it"
A16 IRQ counted ahead of its bytes	kernel-loom an_empty_interrupt_is_never_counted_as_one_that_carried, on main's model under #567's loom fork	a16-counted-on-the-way-in: record counts "carried" first and corrects after the burst	101, at 617e934	"a reader saw Counts { carried: 1, empty: 0 } while the only interrupt on the machine carried nothing"
B22 waitpid stranded	toyos-proclife a_poisoned_main_thread_takes_the_claim_and_ends_the_process (already there)	b22-zombified-and-woke-nobody: zombify, name no wake	101	right: Process(
B09 dump on a syscall's pass	kernel-loom only_a_pass_entered_at_depth_zero_takes_the_request (new)	b09-any-pass-serves: every pass may serve	101	"a pass entered at preempt depth 1 took the request"
B23 join answered NotFound	toyos-proclife a_join_asked_after_it_collected_keeps_its_answer (new)	b23-join-collects-again: every ask collects	101, at b1d8472	"a join that collected its thread answered the ask after it with no such thread", left: Some(Err(NoSuchThread))

• B09: Entered and its decision (may_serve) move from sched/dump.rs into sched/dump_request.rs, which kernel-loom already compiles. dump.rs mints its proof from that decision and re-exports the type.
• B23, and the table lock: the kept answer is toyos_proclife::join::Join's, held in a Cell and asked through &self. sys_thread_join holds one Join and its ask closure borrows it, so no copy of the answer is taken out and written back. a_join_asked_after_it_collected_keeps_its_answer runs that shape: one join shared by the ask before the wait, the wait's predicate and the ask after it. Join::ask takes the collect as a closure and calls it only while the join is unsettled. process::ask_join, which replaces wait_thread_zombie, takes PROCESS_TABLE inside that closure, so a settled join answers without the lock, as main's answer.get().is_some() || did. That decision is toyos-proclife's, where a host test reaches it: a_settled_join_does_not_take_the_table_again asks a settled join with a closure that panics. Under join-asks-when-settled, which calls the collect every time but keeps the first answer, it exits 101 with "a settled join took the table lock to ask again", and a_join_asked_after_it_collected_keeps_its_answer stays green.
• A16: the tally models are main's. Loom from a fork that races a store against every thread's last load #567 moved every loom model onto a fork that races a store against every thread's last load, and made both tally models require the case they are named for. So this branch's reordering of them, and its explored guard, went in the merge. The issue this branch had filed about the gap went too, since Loom from a fork that races a store against every thread's last load #567 meets its exit.

Not converted, and why:

• The decision is in kernel code no host crate compiles, so a host test first needs it extracted: B29 (i8042::service's record-then-bytes read order), A48 (completion::post_n's claim count), B43 (the scheduler's wait loop), and B27, B28 and B30 (the i8042 health verdicts in kernel/src/drivers/i8042/mod.rs; toyos-ps2 holds only decoding).
• B37 is a property of what a Rust scope releases at a -> ! call, not a decision any proclife function makes.
• B36 is open: a host test would reproduce it, not guard it.

Gates

At 9b2645e, after the merge of origin/main (d4e4102):

gate	exit
cargo test --lib	0 (392 passed, 1 ignored)
cargo test --workspace --exclude toyos-build	0
cargo run -- --clippy	0
cargo run -- --ci host	0 (Host: 50 step(s), all green; toyos-checks 11 passed)
cargo test --test toyos-build -- --list	0 (236 Fast, 155 Nightly, 118 Weekly, 3 Local; 22 disabled)
cargo run -- --build-only	0

Host arms. Each was applied as a checked patch, built, run, and reversed, and the tree was shown clean.

arm	the mutation	test	at	exit	the named reason
exit-code-suspended-is-zero	Tally::exit_code returns 0 for a suspended-only tally	toyos-checks run_exit_status	617e934	101	"a suspended run exits 0, and it has to be 2"
join-asks-when-settled	Join::ask calls the collect on a settled join and keeps its first answer	a_settled_join_does_not_take_the_table_again	b1d8472	101	"a settled join took the table lock to ask again"
b23-join-collects-again	every ask collects	a_join_asked_after_it_collected_keeps_its_answer	b1d8472	101	"answered the ask after it with no such thread"
join-keeps-no-answer	Join::ask returns what it collected and keeps none of it	a_join_asked_after_it_collected_keeps_its_answer	b1d8472	101	"answered the ask after it with no such thread", left: Some(Err(NoSuchThread))
a16-counted-on-the-way-in	as above	an_empty_interrupt_is_never_counted_as_one_that_carried	617e934	101	"a reader saw Counts { carried: 1, empty: 0 }"
checks-held-back-unsaid	the result line drops its held-back counts	toyos-checks nightly_tier_is_announced	a9dfb9c	101	"a run holding tests back never says "2 held back for --nightly, 1 held back for --weekly""
ci-dispatch-runs-weekly	a run no schedule started reaches weekly	a_run_no_schedule_started_reaches_nightly	a9dfb9c	101	"a None run", left: Ok("--weekly")
tiers-contains-a-prefix	contains takes a prefix	only_a_registered_name_is_contained	a9dfb9c	101	"a prefix is not the name"

Guest arms, each applied as a checked patch at b1d8472, shown to build with cargo run -- --build-only (EXIT=0 each) and reversed: b23-join-collects-again, join-per-ask (sys_thread_join builds a fresh Join for every ask), b09-any-pass-serves, fat-delete-keeps-the-backing and init-keeps-a-refused-frames-handles.

Run by the orchestrator at 9b2645e (agents run no QEMU), on a clean tree:

• The Fast tier, cargo test: EXIT=0, test result: ok. 230 passed, 230 total (52.9s), 143 held back for --nightly, 117 held back for --weekly.
• EXIT=0 each: --nightly fpu_isolation, xhci_flap and usb_boot_stick_pulled.
• The guest red arms, each EXIT=1 with the same assertion on --nightly fpu_isolation, thread_join failed, left: 18446744073709551614, right: 0:
  • b23-join-collects-again, in its form for the &mut self Join::ask.
  • join-per-ask (sys_thread_join builds a fresh Join for every ask).

High-risk parts: the kernel's join and dump paths, the deleted kernel code, and the harness's selection.

• Mutations: the arms above.
• Independent oracles: for the kernel, the recorded real failures the two guest red arms re-stage (fpu_isolation red at fd62f56 on thread_join, CI run 35360971260's dump panic); for the join's lock, main's own sys_thread_join, whose answer.get().is_some() || asked no table once settled; for the deletions, the compiler over every kernel feature set clippy checks; for the schedule, the report's independently measured buckets against --list.

Unsure

• The weekly cron is proven by host tests of the mapping and the file, not by a run. github.event.schedule in the event payload is GitHub's documented field; the first Sunday is the proof.
• The join's early return is Join::ask's rather than an answer() accessor read in ask_join. An accessor would put the lock decision in process.rs, where no host test reaches it.

Filed

• issues/build/the-harness-carries-three-helpers-nothing-calls.md
• issues/build/which-pass-drain-irqs-is-entered-from-is-gated-only-by-a-nightly-guest.md
• issues/build/a-settled-thread-join-taking-the-table-lock-again-is-gated-by-nothing.md

Net lines against origin/main, 1550 insertions and 3703 deletions in all:

	+	−	net
kernel/src	62	195	−133
src/ (the build system, its unit tests included)	267	53	+214
toyos-proclife, toyos-quiesce (unit tests included)	78	4	+74
userland/ (the test runner)	2	13	−11
tests/	1035	3350	−2315
kernel-loom/	14	29	−15
issues/	80	53	+27
.github/, Cargo.toml	10	4	+6
kernel/CLAUDE.md, tests/CLAUDE.md	2	2	0

🤖 Generated with Claude Code

https://claude.ai/code/session_01W6rME2DoqwjcYFStYHHY4j

[Japabu]

Missing at 6f9a317: CI has no conclusion (run 36354938564 host queued; the run at 42918cf was cancelled), and there are no guest runs for the branch (orch-runs/summary.txt has no 564 line): nothing for the Fast tier, for fpu_isolation and dump_left_pending_is_owed on the changed join/dump paths, or for the b23/b09 guest red arms.

NOT READY FOR REVIEW

[Japabu]

Review, round 2, at 4919fbd

Round 1 gave no findings: it was NOT READY FOR REVIEW because measurements were missing. Here is where those stand now.

• CI: CLOSED. host SUCCESS, run 36384174766 at 4919fbd.
• --nightly fpu_isolation, --nightly dump_left_pending_is_owed and --weekly iommu_empty_domain: CLOSED. EXIT=0 each (orch-runs/564r2-{fpu,dump,weekly}.log).
• Arms b23 and b09: CLOSED. Both EXIT=1 with the named reasons: left: 18446744073709551614 and dump.rs:227:5 … preempt depth 2.
• Fast tier: ran, 225 passed and 1 failed. The red is main's; see "handle_basic" below.
• --nightly quiesce_wakes_on_the_last_park: OPEN. The branch changed its guest binary, and no run exists at 4919fbd. The 6f9a317 run panicked on the carry check before its first boot.

handle_basic is main's

• Census::now() counts every object on the machine, but the guest runs one job at a time. userland/test-runner/src/main.rs:302-319 spawns a job and then calls child.wait(), so nothing runs beside handle_basic except the boot's daemons (tests/testcases, which this branch does not touch).
• handle_basic runs on the actuator boot, and ACTUATOR_TESTS (tests/toyos.rs:119) is not in this diff. Its part has the same members at base and head, and it passed through no tier change.
• The same assertion (handle_basic.rs:305) went red on CI run 33266767478, job 99138099030, on 2026-08-29. That was wt/toyos-wv-fs at b10c4da, with the same predecessor (abuse_kernel_addr), and it was GREEN alone.
• The shape of the failure is PipeWrite +1 with PipeRead unchanged, which is the last round's drop(write) still in the release queue at the second reading. That is issues/kernel/deferred-release-outlives-its-syscall.md, which already disables handle_kill_policy, handle_transfer and kill_while_blocked on the same census instrument.
• Disable handle_basic behind that issue as a fourth witness.

BLOCKER

• kernel/src/actuator.rs:123,126,252,330,333,466 — the branch leaves six actuators that nothing arms: quiesce-last-exit, quiesce-dump, so-cache-tiny, xhci-hid-break-first, xhci-hid-break-late and klogd-panic. They are dead kernel code this branch created, and they are recorded instead of deleted. Delete them and everything only they reach, then delete issues/design-debt/six-kernel-actuators-lost-the-only-test-that-armed-them.md. That code is:

  • log/console.rs:422-424;
  • syscall/machine.rs:104-107, plus sched/dump.rs:160-172 serve_for_the_stop, plus DumpRequest::file_and_take (dump_request.rs:81, whose last caller was that function) and its loom model at kernel-loom/tests/dump_request.rs:125;
  • Last::Exit in quiesce.rs:268-308 and syscall/proc.rs:26;
  • elf/cache.rs:157-165;
  • drivers/xhci/hid.rs:113- (the boot-actuators impl HidDevice, break_at, stage_break) and its call at xhci/mod.rs:977.

• issues/{build/console-line-atomicity-loses-five-of-a-thousand-lines-on-ci, filesystem/home-budget-refusal-retried-is-red-on-every-nightly, hardware/usb-disk-index-stable-nothing-enumerates-on-the-first-controller, kernel/quiesce-dump-holds-the-stopped-reds-wide-with-usb-transport-breaks, kernel/so-cache-refusals-saw-the-kernel-refuse-nothing-once}.md — five kind: defect records are closed with no evidence about the defect. Each records a product symptom that nobody has explained:

  • lines lost inside one guest's console path;
  • "the retry never ran" on a /home fsync, red on every nightly, against kernel/CLAUDE.md's BudgetExpired rule;
  • an empty first xHCI controller;
  • a /log writer's fsync held 5.8 s on a one-guest KVM lane (quiesce_writers, which quiesce_stops_the_machine still runs in Fast);
  • a cache budget that refused nothing.

  Deleting the instrument does not close the defect (issues/README.md: "closing it costs evidence"). Restore them. Only quiesce-wakes-on-the-last-exit… (kind: finding) is correctly gone.

• tests/toyos-rust-tests/src/bin/fat_backing_revoked.rs (deleted) — this was the only gate on an information disclosure through a revoked FAT32 backing (FatBacking::revoke, kernel/src/file_backing.rs:37: open, unlink, reallocate, read the old descriptor). No host test takes the claim, and home_backing_revoked covers /home only. The ruling moves coverage to host tests; it does not drop it. Either keep the row, Weekly, until a host test holds the claim, or land that test.

• tests/toyos-rust-tests/src/bin/launcher_refusals.rs (deleted) — this was the only gate on init refusing hostile launcher requests and surviving them, with no census growth. That is a security boundary, and userland/init has no host test at all. Same remedy as above.

• tests/toyos.rs:1459 — nightly_tier_is_announced is the guard of the Tally::holding_back/summary code this branch rewrote. The branch rewrote the test too and moved it to Weekly, and it has no run at 4919fbd. It boots nothing, so the implementer can run cargo test --test toyos-build -- --weekly nightly_tier_is_announced and must report EXIT=0.

NOTE

• The deleted tests that are covered, and what covers them:
  • log_conservation_smp4/_smp8: kernel-loom log_ring a_published_record_is_whole_and_read_once and a_lane_publishes_whole_and_reuses_only_after_a_read.
  • wall_clock_file's retention: userland/logd/src/store.rs whole_old_boots_go_first_then_earlier_continuations and a_flooding_boot_costs_its_own_middle_and_nobody_elses_start.
  • xhci_hotplug: toyos-xhci/sim a_device_plugged_in_is_enumerated_once and unplugging_tears_the_device_down.
  • xhci_hid_break: teardown.rs a_halted_endpoint_is_reset_cleared_and_delivering_again and a_recovery_the_controller_refuses_lets_the_device_go.
  • sshd_fail_closed: the authorization half is covered by sshd's a_file_that_names_nobody_authorizes_nobody. The "never listens" half (main.rs:730) now has no gate.
  • screen_early_panic: blackbox_early_panic_sealed_muted reads the early panic off the panel, but without check_colors.
  • klogd_panic_halts: klogd_fault_halts covers the klogd context and syscall_panic_halts covers the panic! entry. The deletion stands on the data: a=b=0 and 5 main reds. It stands only once its actuator goes (BLOCKER 1).
  • console_line_atomicity, quiesce_dump_holds_the_stopped, quiesce_wakes_on_the_last_exit, so_cache_refusals and usb_disk_index_stable: all were already disabled at base, so no running coverage is lost.
• tests/toyos.rs:1058,1438 — panic_halts_the_others_first (nightly bucket) and hda_two_live_refused (weekly bucket) stay Fast on the premise that No QEMU test measures time, and audio is judged on metal only #562 deletes them. origin/wt/toyos-notiming keeps both registrations. The fix is one word each.
• tests/toyos.rs:1021 — syscall_window_nmi, syscall_window_nmi_controls and dump_nmi_probe are kept against the delete bucket. No QEMU test measures time, and audio is judged on metal only #562 moves dump_nmi_probe to METAL. The controls' 15 main reds (cistats.json) predate 3ad278c (The NMI window control holds its victim inside the entry instead of hoping a spray lands there #470), which rewrote the control, so the data never saw today's control. The deviation needs the owner's sign-off.
• The ten host-side self-tests are Weekly because they never caught anything, but they cost 0 s and boot nothing, so the price rule buys nothing there. It is the owner's call to make them host #[test]s or keep them Fast.
• kernel/src/sched/driver.rs:587 — drain_irqs(Entered::Blocking) changed to Entered::Pass { depth: 0 } passes every host test and the Fast tier. Only Nightly blocked_dump reds. The host test pins only may_serve.
• kernel/src/syscall/proc.rs:157-162 — dropping join.set(asked) passes host tests and Fast. Only Nightly fpu_isolation reds, the same as at base.
• kernel/src/syscall/proc.rs:157 — ask() takes PROCESS_TABLE after Join has settled, which the old short-circuit avoided.
• src/ci.rs:611 — guest_reach is untested. Returning WEEKLY for a non-schedule event passes every test.
• src/tiers.rs:106 — the only production caller of Schedule::tier (tests/toyos.rs:19502) reads only is_ok(). A contains does the job.
• tests/common/power.rs:340 — woken_by_the_held_thread now has one caller, and its armed parameter has one value. Inline it.
• tests/toyos.rs:19502 — there is a blank line before }.
• issues/build/loom-never-moves-a-store-before-a-load-another-thread-made-first.md and issues/build/the-harness-carries-three-helpers-nothing-calls.md name no owner. Loom from a fork that races a store against every thread's last load #567 (wt/toyos-loomfix) meets the loom issue's second exit.
• kernel/CLAUDE.md:19 — an agent edited a CLAUDE.md. The orchestrator ratifies or places it. tests/CLAUDE.md:3 still points at "the fast tier's line in src/tiers.rs", which no longer exists.
• Net lines: +924/−3653 in all. Tests are −2909 and issues −53. Production, which includes src/ unit tests, is +233, and the kernel is ≈+1. BLOCKER 1 is where the kernel should shrink.

REMOVE

• src/tiers.rs:14-17 — "A test's tier is what it has caught: … A new test enters Nightly." This is an unenforced rule, and it is already false in the tree (netd_refused_accept entered Fast; see the NOTE on :1058/:1438).
• src/tiers.rs:10-12 — the cron sentence restates src/ci.rs.
• kernel-loom/tests/i8042_tally.rs:181-184 — "If a future loom … stops scheduling a reader … this reds". This branch's own finding falsified it: the models explored 1 execution while this test stayed green.
• tests/toyos.rs:644, 694, 698-699, 852, 1254 — the "Nightly for …" tier reasons that the schedule falsified. The PR body says these were deleted.
• PR body, "Unsure" — "Deleting wall_clock_file leaves logd's delete-oldest retention with none." False; see logd store.rs above.
• PR body, "The schedule" — "…hda_two_live_refused (2.0 s), which wt/toyos-notiming deletes." False.

SEND BACK

[Japabu]

Review, round 3, at 3b94e06

CI: host SUCCESS, run 36397650628, headSha 3b94e06. The step "the harness's own checks: cargo test --test toyos-checks" ran 10 tests and all 10 passed. The loom controls each reached their verdicts.

Round-2 BLOCKERs

• The six unarmed actuators: CLOSED. grep over kernel, kernel-loom, toyos-quiesce, tests, src and userland finds none of the six wire names, and none of serve_for_the_stop, file_and_take, Last::Exit, stage_break or break_at. kernel/src is 64+/190−. Clippy passed on every kernel feature set (schedule-r3/gate-clippy.log, EXIT=0). At 3b94e06 these runs are each EXIT=0: --nightly quiesce_ (4 of 4, quiesce_wakes_on_the_last_park among them), klogd_fault_halts, dump_left_pending_is_owed and blocked_dump.
• The five defect issues: CLOSED. All five are back, at status: open. Their exit clauses are a NOTE below.
• fat_backing_revoked: CLOSED. The Weekly row, the dispatch arm, the host body and the guest binary are byte-identical to main. --weekly fat_backing_revoked is EXIT=0. The arm fat-delete-keeps-the-backing is EXIT=1 with "the backing served another file's data". The stated reason holds: FatBacking lives in kernel/src/fat32_adapter.rs, and no host crate compiles it.
• launcher_refusals: CLOSED. --weekly launcher_refusals is EXIT=0. The arm init-keeps-a-refused-frames-handles is EXIT=1 with "16 more refused launches left more live objects behind". The reason holds: serve_launch (userland/init/src/main.rs:986) is handle ownership against a real kernel table, inside a target-only binary.
• nightly_tier_is_announced: CLOSED. It is in toyos-checks and green on CI at 3b94e06. The arm checks-held-back-unsaid is EXIT=101 with the named reason.
• Round 2's OPEN measurement, quiesce_wakes_on_the_last_park: CLOSED. It is a PASS in 564r3-quiesce.log.

BLOCKER

• tests/toyos.rs:1422,12481,18070 and tests/test-durations:185 — run_exit_status is the one harness check that boots nothing and is still a guest-tier row. The ruling was that the boot-nothing checks become host #[test]s, so this row is also a sibling of toyos-checks. It was Fast on main (origin/main:tests/toyos.rs:1586) and is now Nightly: every plain run holds it back (564r3-fast.log:934), and no PR runs it. Yet it gates Tally::exit_code and the test result: ok. line, which this branch rewrote (holding_back, relegated, summary). The fix: move fn run_exit_status into tests/checks.rs's mod checks as a #[test], and delete the row, the dispatch arm and the durations line. It must turn red under a patch that makes exit_code return 0 for a suspended-only tally.

NOTE

• kernel/src/process.rs:1275 and kernel/src/syscall/proc.rs:154-165 — a settled join takes PROCESS_TABLE again at the top of the loop. Main's answer.get().is_some() || short-circuit avoided that lock. This is the branch's own regression, and it was filed (issues/kernel/a-settled-thread-join-takes-the-process-table-to-ask-again.md) rather than fixed. The fix: add pub fn answer(self) -> Option<Result<i32, JoinRefused>> { self.0 } to toyos_proclife::join::Join, and in ask_join do if let Some(a) = join.answer() { return Some(a); } before PROCESS_TABLE.lock(). Then delete the issue.
• kernel/src/elf/cache.rs:231 — let budget = BUDGET_BYTES; is what the so-cache-tiny removal left behind. Use the const itself at its three uses.
• Issue exits: at issues/filesystem/home-budget-refusal-retried-is-red-on-every-nightly.md:30, "the cause shown on a red run's log" can no longer be met, because the test is deleted and nothing can produce a red run. The file also still names no owner, although the branch edited that line. At issues/build/console-line-atomicity-loses-five-of-a-thousand-lines-on-ci.md:23 and issues/kernel/so-cache-refusals-saw-the-kernel-refuse-nothing-once.md:18, "the cause is fixed" names nothing that would show it. Each exit should name the reproducer the fix is shown against.
• The three filed issues are which-pass-drain-irqs…, a-thread-join-keeping… and a-settled-thread-join…. Their owner, exit and frontmatter match the tracker's shape, and "Owner: orchestrator" is the tree's convention (14 files). The third should be deleted by the fix above, not kept.
• Merge: git merge-tree --write-tree HEAD origin/main (a7cd327) is clean, tree 3f0c30f5, EXIT=0. The only file both sides touch is src/redlist.rs, in disjoint hunks. After the merge, every DISABLED name is registered, log_ring_keeps_the_owners_slots included (Nightly, tests/toyos.rs:719), so the tier table and the redlist agree. Two counts in the PR body then go stale: "18 disabled (11 Nightly)" and "145 held back for --nightly" become 19 (12 Nightly) and 144. Re-run --list after the merge, before the body becomes main's record.
• Conflict risk, from the other branch's side:
  • Disable handle_basic behind the deferred-release-outlives-its-syscall issue, and run userdev_dma_fault on a binary with no census #571 deletes "handle_basic" from DRIVEN_AND_SHARED, which this branch moves to tests/checks.rs:412-432. Whichever lands second must carry the hunk across files, or suite_split reds on the stale entry.
  • No QEMU test measures time, and audio is judged on metal only #562 renames stall_is_not_a_verdict to a_stall_stays_red and deletes idle_trip_verdict/i8042_quarantine_verdict in tests/toyos.rs. Both now live in tests/checks.rs, so the same applies.
  • Kernel: a kill never waits on its victim — the last thread out tears its process down #549, tests: a pty tethers QEMU and the judge's servers to the harness #555, An image release: main's disk image, booted before a separate job publishes it #556 and In QEMU, the loader writes boot variables on the running system's request and a failed pass falls to the entry behind its own or powers off; toyos-metal drives a boot through a machine running ToyOS alone #539 edit tests/toyos.rs and src/testargs.rs/src/ci.rs around rows and flags this branch rewrote.
• tests/checks.rs — the toyos-checks target does what the ruling asks. CI's required host check runs it, clippy --all-targets covers it, and the arm proves it can red. Its price is a second compile of the whole harness: 46.11 s on the required check (CI log 08:35:38 to 08:36:24), and again on every plain local cargo test.
• tests/checks.rs:412 — DRIVEN_AND_SHARED and RUST_SKIP (tests/toyos.rs) are one partition ("every driven name is on one list or the other"), and now they are in two files.
• kernel/CLAUDE.md:19, tests/CLAUDE.md:3 — CLAUDE.md edits by an agent, still for the orchestrator to place or decline.
• Net lines: +1653/−3717.
  • The kernel shrinks, as it should: kernel/src is 64+/190−, net −126.
  • src/ is +214 (the Weekly reach, the schedule, the cron mapping, and their unit tests).
  • toyos-proclife and toyos-quiesce are +39.
  • userland is −11.
  • tests/ is −2281 and kernel-loom −14.
  • issues/ is +109.
  • CI and Cargo.toml are +6.

REMOVE

• tests/checks.rs:24-31 — "they used to disagree … All three ask serial::died now". Chronology, moved in with the block.
• tests/checks.rs:211-216 — the reboot story and its date, "2026-08-17".
• tests/checks.rs:281-282 — "read off this tree on 2026-08-08".
• tests/checks.rs:326-329 — "UMIP used to be this file's example …".
• tests/checks.rs:336-338 — "The bit that was on before this … reddened nothing at all".
• tests/checks.rs:358-360 — "the closed vacuous-line-count entry asked for …".
• tests/toyos.rs:477-478 — "screen_decoder needs no guest at all …" in SCREEN_TESTS' doc. It is no screen row now.
• issues/build/loom-never-moves-a-store-before-a-load-another-thread-made-first.md:26-28 — "They now spawn the reader … (explored)". This is the story of the fix, and it belongs in the commit.
• PR body — the scratchpad/schedule-r1/arms/, scratchpad/schedule-r3/ and scratchpad/schedule-r3/arms/ paths. These are session-local paths, and the body becomes main's record.
• PR body, "Unsure" — "home-budget-refusal-retried-is-red-on-every-nightly names no owner, as it did before this branch." Name the owner instead.

SEND BACK

[Japabu]

Review, round 4, at 617e934

CI: host SUCCESS, run 36413265821, headSha 617e934. Both steps passed: --ci host and --ci gate-stage. The log shows toyos-checks running checks::run_exit_status ... ok, join::tests::a_settled_join_does_not_take_the_table_again ... ok, and Host: 50 step(s), all green.

The orchestrator's guest runs at 617e934, clean tree:

• Fast: test result: ok. 231 passed ... 143 held back for --nightly, 118 held back for --weekly.
• EXIT=0: fpu_isolation, quiesce_ (4 of 4), klogd_fault_halts, dump_left_pending_is_owed, blocked_dump, fat_backing_revoked and launcher_refusals.
• Each arm is EXIT=1, for the reason it names:
  • b23 on fpu_isolation: thread_join failed, left 18446744073709551614.
  • b09-any-pass-serves: PANIC ... dump.rs:208:5: the blocked-task dump ran at preempt depth 2.
  • fat-delete-keeps-the-backing: "the backing served another file's data".
  • init-keeps-a-refused-frames-handles: "16 more refused launches left more live objects behind".

Round-3 BLOCKER

• run_exit_status: CLOSED.
  • It is a #[test] in tests/checks.rs:576, and its row, dispatch arm and durations line are gone.
  • It is green on CI.
  • The arm exit-code-suspended-is-zero (exit_code returns 0 for a suspended-only tally) is EXIT=101 with "a suspended run exits 0, and it has to be 2" (schedule-r4/arms/exit-code-suspended-is-zero.log).

Round-3 NOTEs and REMOVEs

• The join lock is closed.
  • Join::ask calls collect only while self.0.is_none(), and process::ask_join takes PROCESS_TABLE inside the closure. The guard is a temporary that drops when the closure returns.
  • join-asks-when-settled (collect every time, keep the first answer) is EXIT=101 with "a settled join took the table lock to ask again".
  • b23-join-collects-again reds both join tests.
  • The issue is deleted.
• The rest is closed:
  • elf/cache.rs uses BUDGET_BYTES directly.
  • The three exits name a reproducer, and 1808fb8d is an ancestor of main that carries all three tests.
  • home-budget names its owner.
  • Every REMOVE line is deleted. The loom issue went with Loom from a fork that races a store against every thread's last load #567, and the body carries no scratchpad paths.
• DRIVEN_AND_SHARED is back beside RUST_SKIP, identical to main's list after Disable handle_basic behind the deferred-release-outlives-its-syscall issue, and run userdev_dma_fault on a binary with no census #571. handle_basic is gone from it, as Disable handle_basic behind the deferred-release-outlives-its-syscall issue, and run userdev_dma_fault on a binary with no census #571 removed it.

BLOCKER

• src/redlist.rs and issues/kernel/quiesce-dump-holds-the-stopped-reds-wide-with-usb-transport-breaks.md:2 — the head does not merge with main.
  • The branch merged main only up to Disable handle_basic behind the deferred-release-outlives-its-syscall issue, and run userdev_dma_fault on a binary with no census #571 (merge-base af817e5). Disable quiesce_stops_the_machine and quiesce_wakes_on_the_last_park behind their filed defects #574 and Disable ftruncate_flush_race, and file the boot-timeout verdict's blind spot #576 are not in it.
  • git merge-tree --write-tree HEAD origin/main is EXIT=1, with conflicts in src/redlist.rs and in the writers issue that Disable quiesce_stops_the_machine and quiesce_wakes_on_the_last_park behind their filed defects #574 renamed to issues/kernel/a-quiesce-writers-first-pass-outlasts-the-jobs-five-second-spin-up.md.
  • The frontmatter hunk that merges without a conflict takes this branch's status: open. Main's new quiesce_stops_the_machine row cites that file, so redlist::check refuses it with "does not open with status: expected-red". The exit clause has the same problem: main's "Re-enabled when…" is what that row needs.
  • The resolution has to do four things:
    • keep main's ftruncate_flush_race, quiesce_stops_the_machine and quiesce_wakes_on_the_last_park rows;
    • drop quiesce_dump_holds_the_stopped and quiesce_wakes_on_the_last_exit, whose tests this branch deletes;
    • keep the writers issue at expected-red, with main's exit;
    • drop xHCI: every report that moves a port's belief leaves it to be read #554's xhci_flap row.
  • kernel/src/drivers/xhci/mod.rs and tests/common/usb.rs auto-merge against xHCI: every report that moves a port's belief leaves it to be read #554's rewrite of the same files, and no one has built or tested that merged tree.
  • Merge main, then show cargo test --lib (the redlist test), --list, --ci host and --build-only green at the new head, with the Fast tier re-run there.

NOTE

• tests/toyos.rs:466 — the #[allow(dead_code, reason = …)] is truthful, but it also silences the one lint that would name this list if suite_split stopped reading it.
  • harness = false passes no --test, so cfg(test) holds in toyos-checks alone. #[cfg(test)] in place of the allow would carry the list only where it is read, and the list would warn if its reader went.
  • The mutation the allow survives is deleting tests/checks.rs:517-535.
• kernel/src/syscall/proc.rs:154-159 — the Cell<Join> copy-out/write-back is what issues/build/a-thread-join-keeping-its-answer-is-gated-only-by-a-nightly-guest.md records: dropping join.set(asked) is red only on a nightly.
  • Hold the answer in Join as a Cell<Option<Result<i32, JoinRefused>>> and make it ask(&self, collect). The write-back then does not exist, the host test covers the whole path, and the issue is deleted.
  • This round rewrote ask's signature, so the change is cheap now.
• kernel/src/process.rs:1276 — the claim "a settled join answers without the lock" is held for Join only. In the kernel, let mut g = PROCESS_TABLE.lock(); join.ask(|| join::collect_zombie(g.as_mut().unwrap(), parent_pid, tid)) passes every test.
  • That costs speed, not correctness, and the closure makes the correct form the natural one. It is recorded here, not sent back.
• kernel/CLAUDE.md, tests/CLAUDE.md — agent edits to a CLAUDE.md, still for the orchestrator to place or decline.
• Net lines: git diff --shortstat origin/main...HEAD is 54 files, +1548/−3702.
  • Production:
    • kernel/src +66/−194 (−128);
    • src/ +267/−53 (+214, its unit tests included);
    • toyos-proclife +24 for Join;
    • toyos-quiesce −1;
    • userland −11.
  • Tests:
    • tests/ +1040/−3351 (−2311);
    • kernel-loom −15;
    • toyos-proclife +40.
  • issues/ is +28, and CI plus Cargo.toml +6.
  • Since 3b94e06 the branch's own commit is +127/−145. I accept the production growth in src/ (Weekly reach, schedule, cron mapping) and in Join.

REMOVE

• tests/checks.rs:573-574 — "what --land's gate reads off the process". --land is retired (src/pr.rs:75), so the line is false, and it came into this file with the move.
• PR body, the deleted-tests paragraph — "quiesce-dump-holds-the-stopped-reds-wide-with-usb-transport-breaks … are status: open, since no redlist row disables anything for them". This is false once main is merged: Disable quiesce_stops_the_machine and quiesce_wakes_on_the_last_park behind their filed defects #574 renamed that file, and a disabled row cites it.
• PR body, "Run by the orchestrator" — every "Expected green" / "expected red". These are predictions, not measurements, and the body becomes main's record.

SEND BACK

[Japabu]

Review, round 5, at 9b2645e

CI: host SUCCESS, run 36429966012, headSha 9b2645e. The log has clippy: workspace root — cargo clippy --workspace --all-targets ... -D warnings clean, join::tests::a_join_asked_after_it_collected_keeps_its_answer ... ok, a_settled_join_does_not_take_the_table_again ... ok and Host: 50 step(s), all green.

The orchestrator's guest runs at 9b2645e, on a clean tree:

• Fast: EXIT=0, test result: ok. 230 passed, 230 total (52.9s), 143 held back for --nightly, 117 held back for --weekly.
• EXIT=0 each: --nightly fpu_isolation, xhci_flap and usb_boot_stick_pulled.
• b23-join-collects-again and join-per-ask on fpu_isolation: EXIT=1 each, with thread_join failed, left: 18446744073709551614.

Round-4 BLOCKER

• Merge with main: CLOSED.
  • 4dff77b3 has parents 617e934f and d4e41022. git merge-tree --write-tree HEAD origin/main (ec06384) is EXIT=0, and A std build keeps nothing another compiler compiled, and a bootstrap run leaves the fork's lockfiles as it found them #573/Track: the supervisor is host-tested and owns the stop #575 touch no file this branch touches.
  • git show --remerge-diff 4dff77b3 has two conflicts, and each hunk of both sides is accounted for:
    • src/redlist.rs: the resolution keeps main's ftruncate_flush_race, quiesce_stops_the_machine and quiesce_wakes_on_the_last_park. It drops quiesce_dump_holds_the_stopped and quiesce_wakes_on_the_last_exit, whose tests are deleted, and it drops xhci_flap. Measured against main, git diff d4e41022 4dff77b3 -- src/redlist.rs is only the five rows of the tests this branch deletes.
    • The writers issue: the branch had two hunks, status: open and "A reproduction names" in place of "Re-enabled when". Both are reversed to main's text, so the file is expected-red behind main's row. One hunk belongs to neither side: the sentence naming the deleted test is dropped. The PR body states that.
  • tests/common/usb.rs and kernel/src/drivers/xhci/mod.rs auto-merged. On each file, the branch's change against the old base and the merge's change against main have identical -/+ lines (646 and 2; diff EXIT=0). So every hunk from main (xHCI: every report that moves a port's belief leaves it to be read #554) is present. xhci_flap and usb_boot_stick_pulled are green at the head.
  • Every issue a dropped row cited, and that is still in the tree, is at status: open.

Round-4 NOTEs

• DRIVEN_AND_SHARED #[allow]: its justification is true, and the round-4 premise was false.
  • I reproduced it in a scratch crate: one harness = false test target holding a #[cfg(test)] const that it never reads, and one libtest target that include!s it and reads it.
  • cargo clippy --all-targets -v -- -D dead-code passes --cfg test to the harness = false target and fails there with "constant LIST is never used", EXIT=101. cargo test --no-run -v passes --cfg test to that target too.
  • So cfg(test) cannot tell toyos-build from toyos-checks, and CI's clippy step (--workspace --all-targets -D warnings) would red on it.
• Join holds its own answer: CLOSED.
  • Join(Cell<Option<Result<i32, JoinRefused>>>), ask(&self, …), and sys_thread_join holds one join (kernel/src/syscall/proc.rs:154-155). The write-back is gone.
  • Host arms, each EXIT=101: join-keeps-no-answer reds both join tests, b23 reds both, and join-asks-when-settled reds the lock test alone.
• Kernel-side issue: filed. Its evidence is a REMOVE below.

NOTE

• kernel/src/syscall/proc.rs:154 — join-per-ask (a fresh Join for every ask) is red only on the nightly fpu_isolation (564r5-join-per-ask.log). a_join_asked_after_it_collected_keeps_its_answer runs a copy of the syscall's shape, not the syscall, so it stays green under that patch.
  • b1d84726 deleted a-thread-join-keeping-its-answer-is-gated-only-by-a-nightly-guest.md because round 4 said the host test "covers the whole path". It does not. The recorded weakness is still true, only now in its join-per-ask form, and nothing records it except the PR body's "Unsure".
  • Record it where the other kernel-wiring gap already is: add the join-per-ask mutation and its nightly red to issues/build/a-settled-thread-join-taking-the-table-lock-again-is-gated-by-nothing.md. The alternative is to move the ask/wait loop into toyos-proclife, so that the host test drives the real loop.
• Arms b23-join-collects-again and join-per-ask:
  • Each is whole for the claim it controls. The is_none guard is all of Join::ask's keeping, and let join at proc.rs:154 is all of the syscall's sharing. Neither is a partial revert.
  • Neither is a negative control in CLAUDE.md's sense, and none can be. The join change is a behaviour-preserving move, and its whole revert onto d4e41022 is main's own sys_thread_join, which is green on fpu_isolation. They are mutations, which the rule's "negative control or mutation" admits. The PR body's "Negative controls: the arms above" should say mutations.
  • b23's guest red shows nothing its host arm (EXIT=101) does not. join-per-ask is the one arm that needs the guest.
• PR body, "Run by the orchestrator at 617e934": the landing head's measurements are the 9b2645e runs listed above. The record should carry those, not the pre-merge head's.
• Net lines: git diff --shortstat origin/main...HEAD is 54 files, +1550/−3703. Since the merge, the branch's own commits are +55/−53. kernel/src is +62/−195 and toyos-proclife +75. No new production growth.

REMOVE

• toyos-proclife/src/join.rs:106 — "sys_thread_join's path: …". The test is a replica of that path, and join-per-ask on the real path leaves it green.
• toyos-proclife/src/join.rs:59 — "and no caller holds a copy to write back". This describes the deleted implementation.
• issues/build/a-settled-thread-join-taking-the-table-lock-again-is-gated-by-nothing.md:12-16 — "PR tests: the measured schedule — Fast is every PR, then Nightly, then Weekly; 15 never-caught tests and the kernel code only they armed deleted #564's round-4 review wrote it as …: every test passed" and "which costs contention … and not a wrong answer". No run stands behind either claim: no 564r4/564r5 summary line runs that patch.
• PR body, "Unsure" — "join-per-ask … shown to build and not yet run on a guest". False: it ran at 9b2645e, EXIT=1.

LAND AFTER NAMED CHANGES