The loader-slimming track, and the firmware rule in CLAUDE.md

CLAUDE.md

@@ -50,6 +50,8 @@ A subdirectory `CLAUDE.md` loads when a file in that subtree is `Read`, and not
 
 **CPU state** — a CPU's control registers come from one declaration, applied by the BSP and by every AP and asserted on each; no read-modify-write decides what either holds.
 
+**Firmware** — the kernel calls no UEFI service; every UEFI call ToyOS makes is the loader's, before ExitBootServices.
+
 **Input** — the kernel delivers key *transitions*, never what one types; a surface turns one into the other. Translation, layouts, dead keys and escape sequences live in userland, one translator per surface.
 
 **POSIX** — the kernel ABI and SDK are Rust-native and capability-shaped. POSIX lives in `userland/libc` (ours, not a fork) with explicitly relaxed rules. That layer may be ugly; the kernel may not.

issues/boot-media/the-anti-rollback-floor-is-a-firmware-variable.md

@@ -34,6 +34,11 @@ to the disk can lower it, because the variable is unreachable once
   refuses rather than boot with no floor, so nothing boots until the
   firmware's variables are reset. OVMF deletes one made with time-based
   authenticated write, so no guest reaches that refusal.
+- **an older image at the floor's security version** — once stage 3 of
+  `the-loader-does-only-what-must-precede-the-handover.md` makes the floor
+  count one, any build the same key signed at that version boots, so a hole
+  whose fix did not raise the version stays open, which is the cost the
+  owner accepted for a security version.
 
 `/system/bin/update`'s own check — newer than the running image — reads the
 versions in the slot table, which is on the disk and is advisory; the loader's