[Japabu]

Problem and result

Four defects found during today's landings, checked against the tree and the CI logs before writing. Markdown only.

Evidence: https://github.com/ToyOSOrg/evidence/tree/a36ad035c72df67b46d2ccee7a916fe5f521a5a3 — the log lines of the nightly host seals (runs 38533374419, 38701484274, 38868708235, 39013160165, 39108067326, 39221595037, 39390441510), the nightly release refusals (the same six red runs), the 27 publish runs on main since #905 (38558545002 to 39497368165), the repository's cache list, crates.io's answers and the newest releases. GitHub's own logs for these runs expire.

1. issues/the-host-caches-limit-reaches-the-10-gb-only-through-one-measured-ratio.md, updated (it already predicted this case). Nightly's host has been red at its seal, and only there, every night since 2026-10-15: 8,033,351,794 B in 17,181 files against build/cicache.rs's LIMIT of 8,000,000,000 B. That 8 GB is ToyOS's own bound on uncompressed bytes. It is not GitHub's limit; GitHub caps the repository at 10 GB of compressed entries. At the last saved entry's ratio (3.91) the refused tree would store about 2.06 GB. The last saved entry is run 38533374419's (f0a987b, 2026-10-14). This is the cause of every host red in runs 38701484274 through 39390441510. The exit now also requires that the seal saves again.
2. New, issues/a-crate-new-to-the-published-set-reds-every-publish-until-someone-puts-it-up-by-hand.md. The nightly release failure is a symptom. A TCP stream is one region and one connection to netstack (netstack data-path track, stage 3) #905 added toyos-untrusted and toyos-transport to PUBLISHED. Neither is on crates.io, and trusted-publishing tokens cannot create a crate (403). So of main's 27 publish runs from 38558545002 to 39497368165, 25 are red at toyos-untrusted and two stopped earlier, and release::sdk_at_tip then refuses, correctly, for the crate that is owed. The fix needs the owner's crates.io account.
3. New, issues/a-driver-that-lends-its-device-a-handle-a-peer-sent-is-ended-when-it-is-no-region.md. SYS_DEVICE_DMA_MAP resolves its region with get, not get_sent. Since Audio leaves soundserver for an hda driver per controller; the matcher takes any prog-if #953, hda lends soundserver's ring unchecked, so a non-region handle ends hda (exit 139) instead of answering InvalidArgument. This record is separate from a-received-handle-has-no-knowable-type.md because SYS_FSTAT does settle a region's kind.
4. issues/the-boot-volumes-server-holds-a-claim-that-writes.md, restated. The boot server's partition is the ESP (Role::Boot: the loader and toyos/log.guid), not the slot volume the kernel is read from. The record also cited a test, block_grants_reach_their_partitions, that was deleted in ff1a11d; it now cites diskserver's module contract instead.

Not recorded: the portability-linux red in run 39221595037 was a Docker pull failure on the runner.

Checks

• cargo run -- --ci host at dc18ad7 and again at b043fab (macOS host): exit 0 both times, "Host: 87 step(s), all green". Those local runs are the only host-check evidence; the review round after them changed record wording only: this draft's CI jobs are skipping, and a markdown-only change needs no host run under the root testing policy. A first attempt exited 101 before running any step: the build's git worktree add of rust/library/backtrace met a stale registration of this same worktree path left by an earlier worktree. That one registration was removed, the checkout completed, and the checks were run again.

🤖 Generated with Claude Code

[Japabu]

Review of #960 at b043fab (records only)

Assessment. This PR only changes records. Three of the four records describe real, current defects, and the fourth restatement corrects a factual error. Each one has an owner and an exit. None duplicates an existing record:

• a-release-that-decides-before-its-tips-crates-are-up-reds-the-nightly.md covers a publish that is late, not one that can never happen.
• a-received-handle-has-no-knowable-type.md covers kinds that SYS_FSTAT cannot settle.
• a-red-nightly-on-main-is-reported-to-nobody.md is about who gets told of a red nightly, not about the cause of this one.

I checked each record against origin/main and against ToyOSOrg/evidence@a36ad035c. One figure is false, and one exit asks for a test the testing policy rules out.

What I verified:

• Seal. LIMIT is 8,000,000,000 (build/cicache.rs:61). The seal lines of all six red runs fall between 8,033,230,395 and 8,034,022,781 B, as recorded. The last save is 7,293,414,884 B, stored as 1,867,126,459 B, a ratio of 3.906. 8,033,351,794 / 3.906 is 2.06 GB. The growth is +740,607,897 B and +1,947 files over 15 first-parent landings f0a987bc6..979d4c539. The cache list holds 24 entries totalling 10,562,836,502 B. gh run view gives the run heads 979d4c5 and 0e6716f.
• Publish. A TCP stream is one region and one connection to netstack (netstack data-path track, stage 3) #905's diff adds the two crates to PUBLISHED. The pinned library/Cargo.lock holds both. The 403 text appears in the run logs, and crates.io answers "does not exist" for both crates. toyos and toyos-window were last published 2026-10-14 10:06Z. In the evidence, 25 logs stop at toyos-untrusted, one at a git SSL clone and one at a moved tip. The refusal string is release.rs:385.
• DMA map. sys_device_dma_map uses handles.get::<SharedMemObject>, so a wrong type goes through refuse, then handle_fault, then exit 139. get_sent maps WrongType to InvalidArgument, and only ipc.rs:180 and proc.rs:41 use it. Why::of_lent reads InvalidArgument as Unlendable. hda's offered returns the received ring unchecked into lend. diskserver runs Region::lent (an fstat check) before dma_map (diskserver/src/main.rs:334-337). The compositor's lend maps its own allocation.
• Boot volume. Role::Boot is the ESP (kernel/src/gpt.rs:4-9,190). create_esp_volume writes the loader and toyos/log.guid. The slot volume holds the kernel, cmdline and signed header. The supervisor serves only data, log and boot, and boot gets writes: false. The fileserver's fat_on(disk, writable) sets writable only for Role::Log. Device claims carry no DUP (ops.rs:41-44). diskserver's header, lines 36-37, says "answers every write ReadOnly before the device sees it". block_grants_reach_their_partitions was deleted in ff1a11d.

Findings

BLOCKER 1. issues/a-crate-new-to-the-published-set-reds-every-publish-until-someone-puts-it-up-by-hand.md:30

• What: the record says the newest toolchain release and sdk- alias "are of 2026-10-14 06:30Z". That time is false.
• Evidence: the PR's own releases-newest.txt gives toolchain-linux-x86_64-sdk-0.71.0 and toolchain-linux-x86_64-3f35e91fcd052cac at 2026-10-14T08:16:46Z and 08:16:25Z. That matches nightly 38533374419, created 08:11:29Z. Nothing in the evidence shows 06:30Z.
• Fix: write 08:16Z, or name the release tag.

BLOCKER 2. issues/a-driver-that-lends-its-device-a-handle-a-peer-sent-is-ended-when-it-is-no-region.md:31-33

• What: the exit requires "a guest test that lends its claim a handle of another kind sees InvalidArgument and lives".
• Why it is wrong: root's testing policy says not to add a test for what inspection establishes, and says a kernel integration test must name behaviour host tests cannot establish. The fix the record names changes one call site from get to get_sent. get_sent maps WrongType to InvalidArgument in five visible lines (handle.rs:253-262), and Why::of_lent's unit test (lib/pci-claim/src/lib.rs:258) already holds InvalidArgument as Unlendable. No guest test claims a PCI function and calls dma_map today. So this exit would make the fixer build a new device-claiming guest test to confirm a one-line, inspectable change.
• Fix: end the exit at the get_sent call and the comment. If a test is wanted, name a cheaper one, or state what it establishes that inspection cannot.

SUGGESTION 1. ...-is-ended-when-it-is-no-region.md:22-24

• What: the record picks the kernel fix without mentioning the userland alternative the tree already uses. diskserver avoids this case by checking the region's kind with fstat before it maps; hda could do the same. a-received-handle-has-no-knowable-type.md points that way ("refuses ... by name before it uses it typed", with "WrongType stops being fatal" rejected).
• Why the kernel fix still holds up: lend's contract ("which a peer lent") and the existing SYS_SPAWN/SYS_NAMESPACE_BUILD precedent support it, so I do not ask for a different exit. One clause saying why the kernel owns this rather than each lender would stop the next reader from re-deriving it.

SUGGESTION 2. ...-until-someone-puts-it-up-by-hand.md:13-16

• What: "and two before it, at a git fetch and at a moved tip" reads as two runs before A TCP stream is one region and one connection to netstack (netstack data-path track, stage 3) #905. It means two runs that stopped before reaching the crate, for example "and two stopped earlier: 38719407453 at a git clone, 38727675385 at a moved tip".
• Count: "each of main's 27 publish runs since" is already the 28th: publish/runs.json lists 39499102970 (4a44aa0), which is also red. "27 runs to 39497368165" says the same thing without going stale.

SUGGESTION 3. issues/the-host-caches-limit-reaches-the-10-gb-only-through-one-measured-ratio.md:58

• "the second time after 2026-10-05's" needs a comma: "the second time, after 2026-10-05's". Without it, it reads as "two occurrences since".

Note for the orchestrator (PR description, not a branch finding). The Checks section calls "the PR's own CI host check" the durable record. On this draft, host, image, scope and toolchain are all skipping (run 39504514894), so there is no such record. Under root's policy a Markdown-only change needs no host run anyway. The sentence should go, or say the run was not needed.

SEND BACK

[Japabu]

Round 1 addressed at 306380d:

• BLOCKER 1: fixed. The record now names toolchain-linux-x86_64-sdk-0.71.0, nightly 38533374419's release, at 2026-10-14 08:16Z. My 06:30Z was false.
• BLOCKER 2: fixed. The exit ends at SYS_DEVICE_DMA_MAP taking its region through get_sent and WrongType's comment naming it. No guest test is required.
• SUGGESTION 1: taken. One paragraph says why the kernel owns the fix: lend's contract, the SYS_SPAWN/SYS_NAMESPACE_BUILD precedent, and that a per-lender check would repeat it in each driver.
• SUGGESTION 2: taken. The count is pinned to the 27 runs 38558545002..39497368165, and the two other reds are named as stopping earlier.
• SUGGESTION 3: taken (the comma).
• PR body: the Checks section now says the local --ci host runs are the only host-check evidence, since this draft's CI skips and a markdown-only change needs none. This round changed record wording only, so I did not run the checks again.

[Japabu]

Orchestrator: both required findings resolved at 306380d (checked the diff b043fab..306380d): the release is named as nightly 38533374419's toolchain-linux-x86_64-sdk-0.71.0 at 08:16Z, and the DMA-map record's exit ends at get_sent and its comment, with no guest test. Suggestions taken; the body's Checks section is corrected. Markdown only; local --ci host at b043fab exit 0 stands. Reviewed: LAND.