[Japabu]

Problem

Open defect records carry claims about the code that later commits made stale
(the trigger was issues/std-calloc-overflow-writes-past-a-fifteen-byte-block.md,
retired by #980). Stale records misdirect planning and review. This is a
bounded one-off audit of batch 0 of 4: 117 open kind: defect records, every
concrete claim checked against origin/main at
6f4d8dbdbca1452c0faa3eead53104d9d0d47fa4 and against the owner's uncommitted
planning in the primary checkout (requirements/, claude-questions.md), read
and not edited. Documentation only; no code changes.

Base: rebased onto db0cf636d16d265ac400ab5f32658ed81f5cd632 (#971, #978,
#980). The records whose cited code #971 removed were checked again there.
The classifications below are as of 6f4d8dbdb; "On the new base" says what
changed.

Result (at 6f4d8dbdb)

class	count	action
fixed	4	deleted; the commit message says, per record, which exit halves were met and which were judged unnecessary
partly stale	40	text corrected to the current code, defect kept
uncertain	10	left open (8 had stale identifiers corrected, none marked fixed)
still-valid	59	unchanged
held for the owner's uncommitted edits	4	unchanged (the owner has deleted the MOR record locally as superseded)

Fixed:

• a-file-server-killed-mid-sync-leaves-a-half-written-btree (3adcf424e). Exit met by lib/bcachefs/tests/crash.rs. Its residual defects are owned by a-write-over-a-files-committed-page-is-not-shadowed and a-crash-leaks-the-blocks-of-its-last-commit.
• a-long-name-entry-whose-write-was-refused-is-on-the-volume-and-the-create-erases-nothing (0d73b9957). The QEMU half is met by the host model in lib/fat32/tests/refused_writes.rs (run below). The T14 half was judged unnecessary: the mechanism is the crate's, and since usbd drives every xHCI controller; the kernel drives no USB #971 the usb-transport-break actuator no longer exists.
• a-replacement-netstack-reuses-its-predecessors-ports (4b96de015, RFC 6056 keyed ports with per-process keys). Its citation in issues/netstack-ends-for-the-boot-on-a-nic-it-cannot-drive-on.md (batch 2) is removed.
• a-disk-whose-port-went-away-panics-the-boot-at-roots-hold (602cff0e2). The code half is met. The nightly half was met by that commit's three local --nightly runs with a negative control, not by a CI nightly. usbd drives every xHCI controller; the kernel drives no USB #971 deleted the record on main first.

On the new base

• Superseded and deleted: a-deliberate-wedge-inside-a-driver-panics-every-other-cpu-that-wants-its-lock. usbd drives every xHCI controller; the kernel drives no USB #971 (13ed7b4f4) took the restoration of the usb-wedge-* arms out of stage E, and the kernel drives no USB. The one staged wedge left holds no lock.
• Taken from main: a-console-watch-waits-on-the-keyboard-not-the-serial-line (with the residual correction to its blocking read reapplied: it repolls every 10 ms, and its exit asks for no repoll) and a-disk-taken-offline-is-never-brought-back.
• Deleted by main, so this PR no longer edits them: a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it, a-machine-that-boots-off-nvme-looks-1500-ms-for-a-usb-boot-disk, a-reset-stops-xhci-and-leaves-every-claimed-pci-function-armed. Main also deleted the unchanged a-bind-whose-device-left-..., a-device-swapped-into-its-port-..., a-disk-refused-while-one-is-held-..., a-hid-interface-outside-the-boot-subclass-... and a-poll-that-leaves-a-port-outstanding-....
• Re-checked: a-job-list-hangs-... now cites pcidev::stop_before_reset in place of the deleted xhci/stop.rs. a-megabyte-... and a-120000-ms-... merge with main's text. Two citations of files that were already deleted at the base, missed in r0, are fixed: a-driver-that-lends-... now cites lib/blockserve/src/sessions.rs, and a-counters-read-... now names the closed last-word record by its commit.
• Review r1's items are addressed:
  • The firmware-call record now gives d2006cc65 as the first AML write to reach the kernel and 15536e2e0 as its widening.
  • The relative-program exit again requires that the shell's own resolution goes, and says that launch_path sits beside is_canonical.
  • The claim-spends record says the actuator was removed.
  • The edited long paragraphs are rewrapped.

Uncertain (left open): a-double-fault-on-cpu-1-under-a-wide-suite, a-double-panic-at-boots-edge-says-nothing-but-its-name, a-function-refused-under-translation-faults-read-permission-after-the-hand-over, a-guest-close-after-a-refused-handshake-can-leave-its-peer-waiting, a-lane-reader-counted-one-refusal-fewer-than-its-writer-made, a-megabyte-written-to-the-stick-starves-a-tone-beside-it, a-netcase-boot-under-host-load-said-nothing-past-the-firmwares-screen-clears, a-reallocated-extent-on-data-keeps-the-deleted-files-bytes, a-job-list-hangs-with-interrupts-on-and-the-deadline-ends-it and a-firmware-call-does-what-its-handler-chooses-and-the-kernel-bounds-only-the-call. That last one is a question for the owner: its exit said the slice passing AML's writes to the kernel would not land without a ruling. d2006cc65 landed it (a byte to SMI_CMD and firmware-memory writes), 15536e2e0 widened it to every port, and no ruling is recorded. Whether the 2026-10 trust model answers the exit's first arm is the owner's call.

Held for the owner (untouched, so the local planning edits apply cleanly): a-driver-that-reflashes-its-device-escapes-its-isolation, a-file-held-across-a-file-servers-restart-answers-gone, a-machine-without-an-iommu-refuses-every-claim and a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos. The owner has deleted that last one locally, together with its citation in the-loader-never-sets-the-firmwares-memory-overwrite-request.md (claude-questions.md item 12).

Checks

• CARGO_TARGET_DIR=<scratch>/target cargo test -p toyos-fat32 --test refused_writes every_refused_write_of_a_long_name_create_is_undone -- --nocapture at 6f4d8dbdb, host (macOS arm64): exit 0. The rebase changes nothing under lib/fat32.

  create: 24 refused cases, every one consistent
  test every_refused_write_of_a_long_name_create_is_undone ... ok
  test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 19 filtered out
  

• Every other classification comes from reading the code at 6f4d8dbdb, or at db0cf636d for the re-checked records. The table below gives the evidence.
• At the head I checked that every repository path cited in the batch's records exists (apart from foreign-repository, relative, deleted or out-of-tree paths named as such), and that no citation of a deleted slug is left. git grep /Users/ -- issues finds nothing.
• No guest or metal test was run.

Privacy fix outside the batch

This PR also removes home-directory paths from three records outside batch 0.
Each record's meaning is kept:

• issues/the-shipping-kernel-actuator-gate-reads-the-checkouts-own-path.md: the worktree path is now <parent>/toyos-heartbeat.
• issues/mutual-kill-panicked-on-the-t14-with-stdio-slot-1-not-a-log-ring.md: the quoted panic path is now <parent>/toyos-phdr/....
• issues/a-boot-with-no-kernel-log-is-not-no-boot-complete.md: the stick log is named without its scratch location.

Noticed outside this batch (not changed)

• issues/toyos-has-its-own-network-stack.md still lists the mio fork as owed for TCP_NODELAY. mio 836d14f delegates to std's stream now.

Classification

117 records, as of 6f4d8db: file, class, evidence, action

file	class	evidence	action
a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14	partly stale	deadline.rs now uses AT_COUNTER/arch::cpu::counter, Ring0 calls poll_in_kernel, reset via power::reset_now (not acpi::reset_now); every line ref drifted; "byte-identical to this tree" false; expire also seals KernelPcs. Cause of lateness still unmeasured.	corrected mechanism text, dropped line refs; defect kept
a-bar-sharing-the-scanout-page	still-valid	paging.rs map_2m asserts on mixed types (:794); panic_console::remap maps WC (mod.rs:520); kernel still map_mmios MSI-X tables, xhci BAR	none
a-bars-mapping-outlives-the-claim-it-was-asked-on	still-valid	pcidev::tear_down (mod.rs:1248) touches no BAR object; bar_object (:1339) hands fresh SharedMemObject the claim never tracks; bar_map_again test exists	none
a-bcachefs-hole-costs-a-block-write-per-page	partly stale	zeroing loop still in resolve_or_alloc_block (fs.rs:1032); fs_large_file test cut in ff1a11d; caller is now the file server (system/fileserver/src/data.rs:545), not a kernel VFS flush	corrected the caller and dropped the cut test
a-bind-whose-device-left-aims-the-ladder-at-its-empty-port	still-valid	msc.rs:574 scsi() Gone arm; bring_up (:1497) climbs every break with Left::Elsewhere; climb_until_in_step (:610) reads port only after a rung	none
a-block-session-waits-forever-on-a-server-past-its-submission-ring	still-valid	system/diskserver/src/session.rs:225 pump breaks on space() Err; drain (:290) reads only completion ring; wait (:277) poller.wait(u64::MAX)	none
a-boot-paint-at-subsystems-ready-stalled-4-ms-on-the-t14	still-valid	single-boot T14 measurement; panel census line still written (panic_console/mod.rs:961); cited lantalkcase issue exists; no measurement since	none
a-boot-start-refused-a-present-device-runs-without-it	partly stale	init no longer starts programs; the supervisor does (system/supervisor/src/main.rs:2735-2741, refused() :2484); claims::goes_on_without (system/supervisor/lifecycle/src/claims.rs:59) has no required mark	init→supervisor, quoted line updated; defect kept
a-bounded-post-spends-its-wake-on-a-waiter-that-then-dies	still-valid	watch.rs post_n (:234) counts notify().woke(), which is true for PrePark (task.rs:319); park.rs commit (:231) answers Killed after; loom_watch has no killed model	none
a-btree-split-leaves-nodes-holding-a-few-entries	still-valid	btree.rs split_node (:618) uses pack (:672) fill-in-order	none
a-c-program-clang-links-for-toyos-carries-no-build-id	still-valid	pinned llvm-project b7420fe5 (via rust 11e31a52) ToyOS.cpp has no build-id	none
a-cached-read-from-a-file-server-is-measured-only-under-tcg	still-valid	measurement owed on T14; window_take still the client copy (sdk/toyos/src/fs.rs:424)	none
a-claim-spends-device-addresses-its-slot-never-gets-back	partly stale	dma_alloc (pcidev/mod.rs:1357) still takes fresh addresses except residue reuse; allocator now kernel/pure/iova.rs Window::reserve via iommu/domains.rs (vtd Domain::reserve gone); Tables::alloc expect still at vtd/table.rs:53; iommu-domain-narrow removed in 29e1006	path and exit corrected
a-claimed-function-can-storm-its-cpu	still-valid	pcidev::isr (mod.rs:1579) unbounded; user_dev.rs cpu0 vectors	none
a-class-claims-poll-in-flight-lands-after-the-claims-release	still-valid	device.rs:11 TAKEN per-class flag; ops.rs:284-285 read_watch → static keyboard/mouse WATCH	none
a-client-waits-on-the-compositors-answer-with-no-bound	still-valid	sdk/window/src/lib.rs:524 copy() and :597 Window::create block in recv_header with no deadline	none
a-close-of-one-handle-ends-every-rings-poll-on-its-object	partly stale	ops::close (ops.rs:191) cancels polls on any handle's close; Poller::wait (sdk/toyos/src/poller.rs:309) drops the result; fsd renamed fileserver (55d1afd)	renamed fsd; defect kept
a-connect-between-two-accepts-is-reset	partly stale	listener queue fixed (system/netstack/node/tests/listeners.rs:474); guest netstack_streams cut in ff1a11d; lan_swap still deleted, so the exit's restore is still owed	noted the cut; kept
a-console-watch-waits-on-the-keyboard-not-the-serial-line	partly stale	premise "blocking read moved onto the serial line's own wait" false: sys_read (syscall/io.rs:105-112, :186-192) parks on keyboard::WATCH with a 10 ms CONSOLE_REPOLL; read_watch (ops.rs:282) keyboard; readiness serial::has_data (ops.rs:817)	corrected the read half; watch defect kept, exit names the repoll
a-corrupt-chain-met-by-a-queued-free-is-answered-by-the-next-call	partly stale	settle_first is now settle (lib/fat32/src/repair.rs:97,151); fsd→fileserver, logged in system/fileserver/src/fat.rs:134, CorruptChain→fs::Error::Io	names corrected; defect kept
a-counters-read-under-host-load-can-go-silent-for-15-s	still-valid	virtsmpcase.toml:17 still runs test_rs_counters_read; virt_smp/virt_el1_smp/virt_mask_windows registered (tests/toyos.rs:328-330); cause never captured	none
a-crash-leaks-the-blocks-of-its-last-commit	still-valid	bitmap in place, count_free (lib/bcachefs/src/alloc_bitmap.rs:121), give/succeed/fail present; no sweep; tests/crash.rs exists	none
a-crash-report-can-name-a-syscall-that-already-ended	still-valid	exceptions.rs:294,352 percpu::in_syscall; percpu.rs:677-695 per-CPU word; process.rs:1769 syscall_num unbracketed	none
a-cut-bulk-only-command-does-not-brick-the-benchs-stick	still-valid	measurement record; usb_reset_records_the_phase_it_cut row with usb_load_chain judge still registered (tests/toyos.rs:938-942); hang never reproduced	none
a-dead-scratch-root-another-user-owns-panics-every-sweep-of-its-base	still-valid	lib/tmpdir/src/lib.rs:319-331 reap_into panics on refused rename	none
a-deliberate-wedge-inside-a-driver-panics-every-other-cpu-that-wants-its-lock	partly stale	usb-wedge-* actuators removed in 29e1006 (absent from kernel/src/actuator.rs); stage E of the-guest-suite-runs-only-what-no-cheaper-tier-reaches restores them and cites this record; detector unchanged	at 6f4d8db: tense corrected, kept as stage E's precondition. On db0cf63: superseded by 13ed7b4 (#971), whose stage E no longer restores the usb-wedge-* arms or cites this record, and the kernel drives no USB; the only staged wedge (wedge-before-reset, syscall/machine.rs:106) holds no lock — deleted
a-device-swapped-into-its-port-inside-the-port-rungs-reset-is-taken-for-the-disk-it-replaced	still-valid	msc.rs:783 port_reset_recovery re-addresses and asks TUR with no identity read; identity::same used only by adopt (xhci/mod.rs:1261); usb_transport_break deleted 90ecefe, held-disk record names 4f2bea1	none
a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it	partly stale	wait_for_return (msc.rs:1743) still spins via clock::settles; the demand-fill paragraph is fixed: file_backing::read_block_retrying went in eb54ce8 (ROOT is read from memory)	demand-fill paragraph removed, logd→logkeeper; defect kept
a-device-without-a-domain-of-its-own-reaches-all-memory	partly stale (line refs)	vtd/mod.rs:150,512-521 identity domain over pmm::top() still bound to every function; cited lines drifted	line refs replaced by item names
a-disk-refused-while-one-is-held-is-enumerated-again-and-no-test-reaches-that-arm	still-valid	xhci/device.rs:820 refuse_for_now AfterSlot::Again; mod.rs:1340 log line; nothing in tests/ reads it	none
a-disk-taken-offline-is-never-brought-back	partly stale	moved-port case answered within RETURN_WINDOW by hold_for_return/adopt (xhci/mod.rs:1211-1300); offline-for-life and T14 exit remain	first bullet's resolution stated; defect kept
a-disk-whose-port-went-away-panics-the-boot-at-roots-hold	fixed	602cff0: gpt::seek names silent disks, rootfs::hold_source (rootfs.rs:163) never panics; that commit measured usb_transport_break EXIT=0 x3 with a negative control	deleted; inbound ref in held-disk record removed
a-dlopened-library-never-binds-to-the-executables-exports	still-valid	elf/reloc.rs:99 searches other_libs only; caller syscall/vm.rs:328 passes loaded_libs, which only dlopen pushes (vm.rs:412)	none
a-domains-addresses-are-never-given-back	partly stale	vtd Domain::reserve gone; now kernel/pure/iova.rs Window::reserve hand-out-once via iommu/domains.rs map (:80); window starts at LEAF not 1<<(bits-2), so leaf count was wrong	mechanism and arithmetic corrected; defect kept, cross-ref to claim record
a-double-fault-on-cpu-1-under-a-wide-suite	uncertain (sighting, cause unknown); identifiers partly stale	#DF report features present (exceptions.rs debug_page_walk, percpu.rs ist1_report, IST_STACK_SIZE 16384); IDLE_GUARD_SIZE/guard_kernel_page now sched/idle_stack.rs GUARD + guard_4k; alloc_kernel_stack in loader/start.rs; double_fault_stack cut 520c0d1	identifiers corrected; the sighting left open
a-double-panic-at-boots-edge-says-nothing-but-its-name	uncertain (sighting, cause unknown); one line stale	panic.rs FIRST evidence path present; double_panic_names_the_first renamed (eb3b4ac) then cut (520c0d1)	test line corrected; finding 1 left open
a-driver-that-lends-its-device-a-handle-a-peer-sent-is-ended-when-it-is-no-region	still-valid	syscall/device.rs:262 handles.get::; get_sent (handle.rs:272) unused there; hda lends offered ring (system/hda/src/main.rs:269-270)	none
a-driver-that-reflashes-its-device-escapes-its-isolation	still-valid	nothing refuses firmware download; no firmware verification exists. Primary checkout has an uncommitted owner decision (2026-10-17) rewriting its ruling	untouched, to preserve the owner's local edit
a-fat-files-mtime-through-its-handle-is-its-last-level	partly stale	fsd→fileserver: node_meta/lstat at system/fileserver/src/fat.rs:231,326 read the entry's modified_unix	path renamed; defect kept
a-fatal-event-stands-down-both-bounds-and-may-leave-nothing-to-end-the-machine	partly stale	halt_all_cpus moved to panic.rs:348 (stand_down at :355-356); can_reboot is power.rs:26 → arch::power::can_reset (x86_64/power.rs:144); hold_the_panel now halts on Held (panic_console/mod.rs:688)	mechanism text corrected, line refs dropped; defect kept
a-fatal-path-entered-outside-a-panic-holds-the-panel-with-interrupts-open	still-valid	panic.rs:348 halt_all_cpus masks nothing itself; callers main.rs:561 (panel-painter-stalls) and dispatch.rs:550 FATAL_HALT	none
a-fatal-path-inside-its-own-cpus-console-burst-waits-out-the-bound	still-valid	serial_lock.rs:23 LIVE names no CPU, try_seize :93; serial.rs:135,171 PANIC_LOCK_WAIT	none
a-fault-before-the-kernels-idt-vectors-into-the-firmwares	partly stale	x86-64 only: init_bsp is called from arch::boot::interrupts (x86_64/boot.rs:98), after_console refuses test-early-fault; AArch64 sets VBAR_EL1 first (aarch64/trap.rs:514, aarch64/boot.rs:263)	scoped to x86-64 and path corrected
a-file-held-across-a-file-servers-restart-answers-gone	still-valid	sdk/std/sys/fs.rs still answers Gone for a held handle; no object id in DATA entries. Primary has an uncommitted owner decision (2026-10-17) rewriting its exit	untouched, to preserve the owner's local edit
a-file-on-data-is-refused-at-250-runs-while-blocks-are-free	partly stale	fsd→fileserver: test at system/fileserver/src/data.rs:1125; file_entry_fits lib/bcachefs/src/fs.rs:258	paths renamed; defect kept
a-file-server-killed-mid-sync-leaves-a-half-written-btree	fixed	3adcf42: shadow-paged commits, superblock written last after a flush (lib/bcachefs/src/fs.rs header at :763), lib/bcachefs/tests/crash.rs stops at every block write, torn sectors included, and mounts. Residuals already owned by a-write-over-a-files-committed-page-is-not-shadowed and a-crash-leaks-the-blocks-of-its-last-commit	deleted; no inbound refs
a-file-server-waits-30-s-on-a-block-port-nobody-serves-and-says-nothing	still-valid (single measurement)	fileserver reaches diskserver::list/Session::open (system/fileserver/src/main.rs:262,275); no change addressing the silent wait found	none
a-firmware-call-does-what-its-handler-chooses-and-the-kernel-bounds-only-the-call	partly stale; uncertain	"the server passes no write its AML asks for to the kernel yet" false since d2006cc (first AML write to reach the kernel; 15536e2 widened it to every port) (host.rs write → kernel); exit said that slice would not land without a ruling, and it landed; whether the 2026-10 trust model (5596d7b, root CLAUDE.md) answers the exit's first arm is the owner's	stale sentences corrected; ruling question left open and listed as uncertain
a-foreign-data-partition-is-answered-with-memory	partly stale	data_on (system/fileserver/src/main.rs:342-350) still answers Foreign with ram(); foreign_disk_untouched cut in 520c0d1	paths renamed, exit's test rephrased
a-fragmented-wifi-frame-is-dropped	still-valid	lib/ieee80211/src/frame.rs:262 Refused::Fragmented; refusals.rs:143 test	none
a-fresh-kernel-heap-chunk-holds-its-frames-last-owners-bytes	still-valid	mm/alloc.rs:560 takes pmm::claim() frames, allocates_zeros false (:62)	none
a-full-data-volume-frees-space-only-at-a-commit	still-valid	alloc_bitmap.rs:49 pending, :56 NODE_RESERVE = 16; WRITEBACK in system/fileserver/src/writeback.rs	none
a-function-refused-under-translation-faults-read-permission-after-the-hand-over	uncertain (T14 measurement, cause unknown)	iommu-firmware-left actuator still in actuator.rs:128; vtd hand_over (vtd/mod.rs:365) has no event wait; no later reading	none
a-function-the-smmuv3-does-not-route-panics-at-attach	partly stale	DeviceSpace::create now takes functions (iommu/mod.rs:173) but asks only domain::untranslated, which on SMMUv3 answers None (smmu/domain.rs:91); Live::stream still panics (smmu/mod.rs:151)	first sentence corrected; defect kept
a-guest-close-after-a-refused-handshake-can-leave-its-peer-waiting	uncertain; partly stale	https_fetch cut in ff1a11d; own stack measured clean twice, no rate	noted the cut; left open
a-hardware-reduced-x86-machine-has-no-power-off-and-no-power-button	still-valid	lib/acpi/src/fadt.rs FixedRefused::HardwareReduced; x86_64/power.rs:141 "no ACPI server supplied S5"	none
a-hid-interface-outside-the-boot-subclass-is-read-as-qemus-tablet	still-valid	xhci/device.rs:170 (0, _) => HidType::Tablet in parse_config; toyos-usbhid (kernel/usbhid/src/pointer.rs) Pointer::Tablet layout; usbd binds nothing yet	none
a-holders-queued-line-can-reach-the-console-after-the-last-word	partly stale (name)	take_for_the_stop (log/console.rs:194) drains; residual holder-after-drain stands; logd renamed	logd→logkeeper; kept
a-job-list-hangs-with-interrupts-on-and-the-deadline-ends-it	partly stale; uncertain	stop.rs's settle_transfers gone (stop.rs now bounds and records the cut command, 9ca2e01); restored in 14186a8; no T14 loader.log since	sentence corrected; record 1's claim that it was closed corrected to point here
a-kernel-files-fstat-answers-its-handles-mtime	still-valid	ops.rs:652 fstat answers state.mtime; file_cache::touch (file_cache.rs:154)	none
a-kill-on-a-spawns-handle-before-its-child-lands-claims-nothing	still-valid	loader/start.rs:112 PendingHandles::commit; kernel/pure/proclife/teardown.rs:29 claim_teardown; process.rs:1698 Ok for gone	none
a-known-mask-is-copied-out-of-toyos-abi-by-hand	partly stale	MMAP_PROT_KNOWN/MMAP_FLAGS_KNOWN (syscall/vm.rs:30-32), OPEN_FLAGS_KNOWN (ops.rs:78), inbox KNOWN (inbox/mod.rs:116), proc.rs:70 !WNOHANG; NAMESPACE_FLAGS_KNOWN moved to syscall.rs:1808; only one guest copy left (handle_lifetime.rs:82)	line ref and copy inventory corrected
a-lane-reader-counted-one-refusal-fewer-than-its-writer-made	uncertain (one red under load)	test still at sdk/toyos/src/log/proof.rs:139	none
a-late-write-from-a-released-function-halts-the-machine	still-valid	pcidev/mod.rs:1233-1245 release clears held at its end, before reset quiet	none
a-launch-too-large-for-one-frame-becomes-a-direct-spawn	partly stale	NotSent→Direct is now toyos::spawn's unmade (sdk/toyos/src/spawn.rs:266-268, :371-374), not std's Command::launch; under_init is under_supervisor	names corrected; defect kept
a-lent-scanout-is-one-contiguous-run	still-valid	shm.rs:80 pmm::alloc_contiguous; pcidev lend_room (:304) first-fit; compositor lend (display.rs:392); LEND_WINDOW sdk/abi/src/pci.rs:119	none
a-link-on-a-kernel-mount-to-a-served-path-leads-nowhere	still-valid	vfs.rs:455 followed() resolves a target only in the kernel's own mounts	none
a-link-that-goes-and-returns-inside-one-pass-of-the-intel-driver-is-reported-as-no-change	still-valid	system/netstack/i219/src/lib.rs:1352 link_changed: self.link != before; netstack i219.rs:251	none
a-listeners-tcp-nodelay-has-no-setter-in-std-or-the-forks-and-a-c-program-cannot-order-the-waiting-case	partly stale	lock now pins socket2 12abd8f (listener is std's TcpListener; setsockopt on it is Ok and a no-op; accepted socket's option is std's) and mio 836d14f (delegates to std — the mio half is met); libc_sockets/nodelay_kept.c cut ff1a11d; libc poll now watches a listener's wake pipe (posix_io.rs:642-681); node ships	fork facts, cut tests and exit corrected; socket2 listener, libc poll proof and one bind call remain
a-listing-still-scans-the-whole-mount	partly stale	TmpFs::list (tmpfs.rs:104) and Mounted::list/is_dir (bcachefs fs.rs:707,730) still walk the whole volume; /home is the file server's now, and is_mounted_dir (vfs.rs:309) checks only kernel mounts	scope corrected (ROOT, /tmp in kernel; DATA in file server); defect kept
a-long-name-entry-whose-write-was-refused-is-on-the-volume-and-the-create-erases-nothing	fixed	0d73b99: erase_inserted gone; write_entry_at (lib/fat32/src/dir.rs:387) queues Repair::Entry with the old bytes before every write, so a write refused after it landed is written back; cargo test -p toyos-fat32 --test refused_writes every_refused_write_of_a_long_name_create_is_undone exit 0 at 6f4d8db (24 cases, Refused and Landed, the record's own file name), log fat32-longname.log. T14 fat check of a usb-transport-break boot not rerun	deleted; no inbound refs
a-machine-that-boots-off-nvme-looks-1500-ms-for-a-usb-boot-disk	partly stale	gpt.rs:206 probe_usb_disks unchanged, called main.rs:510; nvme_disk_keeps_log_and_home cut ff1a11d	test reference corrected; defect kept
a-machine-without-an-iommu-refuses-every-claim	still-valid; partly stale wording (init's refused, netd)	pcidev bring_up still refuses NotRemapped/Untranslated. Primary has an uncommitted owner decision (2026-10-17) rewriting most of it	untouched, to preserve the owner's local edit; stale names reported in handoff
a-megabyte-written-to-the-stick-starves-a-tone-beside-it	uncertain (QEMU sighting); names stale	hda_tone metal rows exist (tests/toyos.rs:636); no T14 row with a concurrent write; logd/soundd renamed	names corrected; left open
a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos	still-valid by code (loader/src touches no MOR variable)	primary checkout has it deleted, uncommitted (owner planning)	untouched, owner's local deletion preserved; listed for the owner
a-metal-job-that-fails-on-the-amd-bench-is-reported-as-failing-on-the-t14	partly stale (line ref)	tests/common/metal.rs:494-502 job_passed still says "on the T14"	line ref dropped
a-moved-handle-is-always-re-movable	partly stale (name)	moves still require TRANSFER and carry rights unchanged (loader/start.rs:135); no rights word on EndowEntry or send; soundd→soundserver (client.rs:172-179)	renamed; kept
a-netcase-boot-under-host-load-said-nothing-past-the-firmwares-screen-clears	uncertain (sightings under load)	netcase.toml still booted (tests/common/iommu.rs:18); the tests named were cut (c6a2861, ff1a11d)	noted the cuts; left open
a-new-x86-thread-enters-ring-3-holding-kernel-register-values	still-valid	x86_64/entry.rs:42-87 process_start/thread_start clear no GPRs before iretq	none
a-package-cannot-ship-its-own-libraries	still-valid	sdk/toyos/src/relocate/mod.rs:329 refuses DT_NEEDED	none
a-page-in-its-backing-refused-is-reported-as-a-segfault	partly stale	process.rs:1461 line and exceptions.rs report unchanged; exit's DATA-backed page-in test impossible by the record's own reach section (images are memory objects) and root_chunk_refused is cut	exit retargeted at the reachable /tmp deletion case
a-panic-before-the-reset-register-is-read-holds-the-machine-for-good	still-valid	x86_64/boot.rs:95 power::init_reset inside interrupts(), after after_console; panic_reboot::arm Held without reset or clock	none
a-panic-inside-mm-init-may-not-reach-the-panel	partly stale	x86-64 paging::init (paging.rs:1039) ignores the scanout; AArch64's maps it (aarch64/paging.rs:670-700); window is in mm::init (mm/mod.rs:200-202), not main.rs	scoped to x86-64, path corrected
a-panic-on-a-wedged-virtio-console-panics-again	partly stale (refs)	wait_used/ANSWERS Tripwire still panics (virtio.rs:523-541); panic_flush Held branch drains through virtio (serial.rs:245-255); every cited line number drifted; "IOMMU PR collision fence" rationale obsolete	line refs replaced by names, fence sentence removed; defect kept
a-panic-reentry-inside-a-fatal-paths-console-hold-halts-with-it-held	still-valid	panic.rs:246 last_words, main.rs:129 reentry halts	none
a-panic-write-between-two-console-bursts-can-split-a-character	still-valid	serial.rs:340-341 chunks by TX_BURST; tests/common/qemu.rs:2661 publish_line stops on non-UTF-8	none
a-parked-launchs-hang-up-reaches-settle-through-wiring-no-test-runs	still-valid	supervisor main.rs:215,1394,2119,2272; consent::settle lib/manifest/src/consent.rs:165	none
a-pipe-console-socket-or-shared-memory-has-no-identity	still-valid	ops.rs:647,672 volume 0 node 0	none
a-pipe-is-a-two-mebibyte-page-for-a-mapping-nothing-makes	still-valid	pipe.rs:102 PIPE_SIZE = PAGE_2M, :159 alloc_page; no pipe_map caller outside sdk/toyos/src/lib.rs:181	none
a-platform-with-no-transmit-power-table-joins-no-wifi-network	still-valid (prospective)	concerns W6's design; no ax2xx code yet; cited by there-is-no-wifi.md	none
a-poll-that-leaves-a-port-outstanding-with-no-wake-says-nothing	still-valid	xhci/mod.rs:353 stores 0 with no log; sim Stuck::Unwoken (lib/xhci/sim/src/driver.rs:328)	none
a-process-faulting-in-128-gib-panics-the-kernel	still-valid	process.rs:560 demand_pages Vec, :1485 push unbounded; MAX_HEAP_ALLOC mm/mod.rs:72	none
a-process-name-is-written-into-the-kernels-own-records-unsanitised	partly stale	process.rs:1084 exit record writes the name raw; devices::exit_of is gone, the judge is tests/common/metal.rs:421 Boot::exit_code (lowest pid wins, still forgeable); logd/init renamed	judge and names corrected
a-process-that-starts-four-billion-threads-panics-the-kernel	partly stale (path)	id_map.rs:33 next + ONE; overflow-checks are set in root Cargo.toml [profile.toyos] (:356), not kernel/Cargo.toml	path corrected
a-processs-syscall-profile-is-one-threads	still-valid	teardown_resources (process.rs:1037-1071) reads one ThreadData's counts; the live stats path (:758) sums threads, the exit path does not	none
a-program-run-from-tmp-pages-in-code-any-process-can-rewrite	still-valid	loader/mod.rs:92 insert_elf_regions over TmpfsBacking (tmpfs.rs:15)	none
a-programs-line-on-a-screen-names-no-cpu	still-valid	sdk/toyos/src/log/region.rs:85 Body has no CPU	none
a-programs-two-streams-map-its-one-ring-twice	partly stale (name)	stdio.rs ask dups and maps per stream (:237-240); the supervisor hands the ring (supervisor main.rs:13-18)	init→supervisor
a-provided-name-cannot-reach-an-undeclared-child	partly stale	direct path is now toyos::spawn::Spawn::direct (sdk/toyos/src/spawn.rs), not std in the rust submodule; it drops provided; init→supervisor build_namespace (:2869); test_rs_window_child gone, shell build_command (:737) still provides for every child	location of the fix, the masked caller and names corrected
a-question-waits-unseen-while-a-file-is-picked	still-valid	filepicker main.rs:653 run_picker inside the loop; compositor session.rs:2203 one launcher thread	none
a-reallocated-extent-on-data-keeps-the-deleted-files-bytes	uncertain	cause never named; DATA moved to the file server and shadow-paged commits since (3adcf42); pkg_install_gbae cut 520c0d1	exit's stale ordering note replaced by what changed and that nothing has looked again
a-received-handle-has-no-knowable-type	still-valid	handle_recv answers a count (sdk/abi/src/syscall.rs:1947); fstat Acceptor→Pipe, Process→Unknown (ops.rs:655-685)	none
a-record-cannot-name-thread-zero	partly stale	Display still drops tid 0 (sdk/abi/src/log.rs:257); on_a_thread (log/mod.rs:194); FLAG_EARLY is FLAG_UNTIMED; SYSROOT_SOURCES in build/sysroot.rs:71; logd renamed	details corrected; defect kept
a-refused-framebuffer-reads-as-no-display	partly stale (line ref)	main.rs:324 boot: gop line, :531-546 one arm; KernelArgs carries no reason (sdk/abi/src/boot.rs)	line ref replaced
a-refused-syscall-writes-a-log-record-per-call-and-nothing-bounds-the-caller	still-valid	vm.rs:257,265 dlopen records per call; no limiter	none
a-region-keeps-the-address-space-of-every-process-that-ended-with-it-mapped	still-valid	shm.rs:130 map_into keeps Arc PageTables; unmap_from (:160) called only from inbox/mod.rs:84	none
a-relative-program-is-refused-a-launch	partly stale	launch_path now lives in toyos_manifest::package (:153) beside is_canonical (:144), used by shell main.rs:721; std/libc still pass relative paths	shell-copy clause corrected; std/libc residual kept
a-released-function-never-claimed-again-keeps-its-retired-grants	still-valid	pcidev retired freed only by finish_retired (:1197) on the next claim (:836)	none
a-rename-that-stops-between-its-writes-leaves-a-chain-two-entries-reach	still-valid	lib/fat32/tests/refused_writes.rs:618-623 stop test still carries the rename arm citing this record	none
a-renamed-services-state-stays-under-its-old-name-unread	still-valid	manifest home() (lib/manifest/src/lib.rs:297) keys /state by name; nothing names orphaned /state dirs	none
a-replacement-netstack-reuses-its-predecessors-ports	fixed	4b96de0: netstack runs ToyOS's own stack; TCP ephemeral ports are RFC 6056 keyed draws (system/netstack/shard/tcp/src/stack.rs:625 ephemeral, keys from system/netstack/src/main.rs:166 secrets() per process), the record's own remedy; NetDaemon/next_local_port gone	deleted; inbound ref in issues/netstack-ends-for-the-boot-on-a-nic-it-cannot-drive-on.md (batch 2's file) edited
a-reset-stops-xhci-and-leaves-every-claimed-pci-function-armed	partly stale	still no claim teardown before reset: power.rs reset_now/shutdown stop only xHCI; supervisor stop (main.rs:1621) only flushes and syncs; every acpi.rs/line ref and netd/system.toml lines stale	paths rewritten to power.rs and current callers, holders updated; defect kept
a-restarted-display-holder-lends-around-its-predecessors-scanouts	still-valid	pcidev residue never lent again (mod.rs:73-78)	none
a-ring-handed-to-another-process-resolves-its-watches-in-the-receivers-table	still-valid	inbox/mod.rs:521 resolve in the caller's table; Inbox rights carry DUP/TRANSFER	none
a-rust-program-holds-two-copies-of-its-stream-state	partly stale	std at rust 11e31a52 depends on toyos (library/std/Cargo.toml:107); stdio.rs:181-185 statics; console_line_atomicity guest binary cut	cut-binary clause removed; defect kept
a-rust-std-binary-cannot-link-the-cxx-runtime	still-valid	build/libcxx.rs:33 LIBCXXABI_ENABLE_STATIC_UNWINDER ON, static non-shared runtime	none
a-held-launcher-that-will-not-open-is-a-direct-spawn	partly stale (location)	the open-or-none read is now toyos::spawn::Spawn::ask_launcher (sdk/toyos/src/spawn.rs), answering Unmade::NoLauncher → Direct, not std	location corrected; defect kept

🤖 Generated with Claude Code

[Japabu]

Review r1: PR #981, head f22dc14e7

I reviewed the head f22dc14e7 (3bb41e6 plus the home-path commit) against its base 6f4d8dbdb and against current origin/main db0cf636d. I read the full diff (56 files, +343/-473, documentation only), the classification table and the handoff. I checked the four deletions in full, 21 partly-stale corrections, 11 still-valid records and all 10 uncertain ones against the code at 6f4d8dbdb, the named commits and the pinned socket2 fork checkout.

Assessment

The audit is careful and mostly accurate. The batch is exactly the first 117 status: open + kind: defect records at 6f4d8dbdb; the five assigned defects in that range are correctly out of scope. All four deletions are justified on the code, and each residual defect has an owning record. The corrections I sampled are true at 6f4d8dbdb and keep the defect. No uncertain record was marked fixed, and I found no fixed record left uncertain.

The main problem is time: #971 (usbd: the kernel drives no USB) and #980 landed on main after the audited revision. The branch now conflicts with main, and several of its corrections are false at the base it would land on.

Required

1. The branch conflicts with main, and some corrections are stale there. gh pr view reports CONFLICTING. git merge-tree origin/main HEAD shows two content conflicts and three modify/delete conflicts:

   • Content: a-console-watch-waits-on-the-keyboard-not-the-serial-line.md and a-disk-taken-offline-is-never-brought-back.md.
   • Modify/delete: a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md, a-machine-that-boots-off-nvme-looks-1500-ms-for-a-usb-boot-disk.md and a-reset-stops-xhci-and-leaves-every-claimed-pci-function-armed.md. Main deleted all three; 13ed7b4f4 adds pcidev::stop_before_reset for the reset defect.

   After the merge these statements would be false:

   • a-console-watch-...md:13-19: says a blocking read "parks on the same watch" (keyboard::WATCH). Main removed the kernel's keyboard watch, and main's own text says registering a console watch is now refused.
   • a-job-list-hangs-...md:30-33: cites kernel/src/drivers/xhci/stop.rs, which main deleted. This file auto-merges, so the stale citation would land unseen.
   • a-disk-taken-offline-...md:27-32: cites hold_for_return and adopt in kernel/src/drivers/xhci/mod.rs, which main deleted and replaced with usbd's text.
   • a-deliberate-wedge-inside-a-driver-...md: the table keeps it as "stage E's precondition", but main's stage E in the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md no longer restores the usb-wedge-* arms or cites this record.

   Fix:

   • Bring the branch onto current main.
   • Take main's version or deletion for the five conflicted files, accounting for each hunk of this PR's.
   • Re-check the edited records whose cited code #971 removed: job-list, deliberate-wedge, megabyte (two merged paragraphs) and the 120000 ms record.
   • Record the new base in the commit and the PR. Untouched records' classifications can stand as stated at 6f4d8dbdb.

2. a-firmware-call-...md:124-127, 141-146 names the wrong commit for the slice.

   • The slice that first passed an AML write to the kernel (a byte to SMI_CMD, plus SystemMemory writes) is d2006cc65 ("S2: AML ... writes SMI_CMD and firmware memory through the kernel", 2026-10-12 12:07). 15536e2e0's own message says that before it, "the server asked the kernel for three port writes and a byte to SMI_CMD"; 15536e2e0 only widened this to every port.
   • So "Since 15536e2e0 ... a byte to SMI_CMD among them ..., so the T14's AML can make calls" and "the slice that passes those writes landed in 15536e2e0" are false. The owner question in the PR body repeats the error.
   • Fix: cite d2006cc65 for the slice, and 15536e2e0 only for widening it to every port. The PR body's owner question is the orchestrator's to correct.

3. a-relative-program-is-refused-a-launch.md:17-19 quietly softens the exit.

   • The old exit required that "the shell's copy of that rule goes". Once std and libc make a relative program absolute, the shell's own launch_path call in system/shell/src/main.rs:721,744 is a duplicate path. The new exit drops that requirement without evidence that the shell still needs it.
   • The new wording "the rule the supervisor's gate and the shell already share" is also inaccurate. The gate calls is_canonical (system/supervisor/src/main.rs:2358); launch_path is a resolver that lives beside it and is not called by the gate.
   • Fix: keep the deletion of the shell's own resolution in the exit, and say that launch_path sits beside the gate's is_canonical.

4. a-claim-spends-device-addresses-its-slot-never-gets-back.md:33-34 can be read as the opposite of what happened.

   • The text says the iommu-domain-narrow "feature that narrowed a domain went in 29e1006". "Went in" reads as "landed", but 29e100612 removed it, and it was an actuator (kernel/src/actuator.rs at 29e100612^), not a feature.
   • Fix: "the iommu-domain-narrow actuator was removed in 29e100612".

5. The deletion commit's evidence says more than was shown. issues/README.md makes the commit message the home of a close's evidence. 3bb41e633 says "Deleted as fixed, each exit met":

   • The long-name record's T14 half (the fat check of a usb-transport-break boot) was not run. The same message says so, so it contradicts itself.
   • The disk-port record's "green on a nightly" was met by 602cff0e2's local --nightly runs (three green runs, with a reverted negative control), not by a CI nightly.

   Both deletions are sound: the host model in lib/fat32/tests/refused_writes.rs is the cheaper sufficient test for the fat32 case. After the merge, the T14 arm cannot be reached at all (main has no usb-transport-break actuator). Fix: say which halves were met and which were judged unnecessary, and why, in the rewritten commit message.

Optional

• a-claim-spends-...md exit: with no narrowed domain, "more claims than its domain has room for" means about 262k claims on a 39-bit unit. A host test over kernel/pure/iova.rs and iommu/domains.rs is the cheaper place to hold it.
• a-page-in-its-backing-refused-...md exit: still asks for a report that "names the device failure" while the only reachable refusal it now names is a deleted /tmp file, which involves no device.
• Several edited paragraphs were not rewrapped and carry lines of 100-130 columns (a-firmware-call :141, a-reset-stops :1623 of the diff, a-console-watch exit, a-launch-too-large :10). issues/README.md has no wrap rule, so this is cosmetic.

PR description (orchestrator)

• The classification table lists a-console-watch-waits-on-the-keyboard-not-the-serial-line twice, once as still-valid with action "none" and once as partly stale. The PR's counts (40 partly stale, 59 still-valid) only add up if a-moved-handle-is-always-re-movable, a still-valid row with renames, is counted as partly stale. Remove the duplicate row and reconcile the counts.
• "exit checked met" in the Result table: see required item 5.
• The owner question about 15536e2e0: see required item 2.

Checked and fine

• The four deletions.
  • a-disk-whose-port-went-away-...: hold_source at 6f4d8dbdb (kernel/src/rootfs.rs:163) withholds rather than panics. The record was filed at 635a9a14c (03:07), hours before its own fix 602cff0e2 (05:31). Main also deleted it in #971.
  • a-file-server-killed-mid-sync-...: 3adcf424e shadow-pages commits and writes the superblock last. lib/bcachefs/tests/crash.rs stops at every block write, including torn sectors and a lost block 0. The residual defects are owned by a-write-over-a-files-committed-page-is-not-shadowed.md and a-crash-leaks-the-blocks-of-its-last-commit.md.
  • a-long-name-entry-...: every_refused_write_of_a_long_name_create_is_undone exists at 6f4d8dbdb:lib/fat32/tests/refused_writes.rs:569. The run log shows 1 passed, and the worktree differs from the base only in issues/.
  • a-replacement-netstack-...: ephemeral (system/netstack/shard/tcp/src/stack.rs:625) is a keyed RFC 6056 draw, with keys from secrets() drawn per process (system/netstack/src/main.rs:166-176). UDP draws too (system/netstack/udp/src/lib.rs:354).
• Partly-stale corrections, verified true at 6f4d8dbdb with the defect kept:
  • 120000 ms deadline: AT_COUNTER, poll_in_kernel, power::reset_now, KernelPcs.
  • bcachefs hole: the caller at fileserver/src/data.rs:545; a write past the end still zero-fills.
  • boot-start refused: goes_on_without, and the supervisor's refusal text.
  • Domain addresses: the iova window from LEAF, AddressesExhausted, and the arithmetic.
  • Console watch at 6f4d8dbdb: CONSOLE_REPOLL and serial::has_data.
  • Fatal event: panic::halt_all_cpus, can_reset, and hold_the_panel halting.
  • Fault before the IDT: the x86-64 scope, and VBAR_EL1 set first on AArch64.
  • SMMUv3 attach: untranslated answers None.
  • Known mask: the mask inventory and the single copy in handle_lifetime.rs:82.
  • Launch too large and held launcher: Spawn::launch/unmade/ask_launcher.
  • Provided name: Spawn::direct carries none of provided.
  • TCP_NODELAY: socket2 12abd8f's listener setsockopt/getsockopt and mio 836d14f, checked in the fork checkout.
  • Listing: is_mounted_dir.
  • Page-in: revoke_selftest reach.
  • Panic inside mm::init: x86-64's _scanout against AArch64's mapping.
  • Process name: exit_code's lowest pid is the forger's.
  • Four billion threads: [profile.toyos] overflow-checks.
  • Thread zero: FLAG_UNTIMED and build/sysroot.rs.
  • Reset stops xHCI: the power.rs header and the system.toml holders.
• Still-valid records, still valid at 6f4d8dbdb: the BAR mapping outlives its claim, the block session waits forever, the dlopened library, the new x86 thread's registers, the 2 MiB pipe page, the 128 GiB fault-in, the dead scratch root, the late write, the received handle, the boot paint stall and the deadline lateness.
• Uncertain records: all ten are sightings or readings with no cause established. None is closed by a fix I could find.
• Inbound references: git grep at the head finds no citation of any deleted slug. The one on main (netstack-ends-...md:26) is removed by this PR without a conflict.
• Personal data: none of the 56 touched files contains home paths, user or host names, e-mail addresses, IPs or MACs, and issues/ at the head has no /Users/ or Dev/jan left. The <parent> masking keeps each record's meaning.
• Format: no frontmatter changed. The deletions follow issues/README.md's closing procedure; no durable rule needed folding to a site.

SEND BACK

[Japabu]

Review r2: PR #981, head bb81e19db

The head bb81e19db is two commits on origin/main db0cf636d, and GitHub reports it MERGEABLE. I checked only r1's items and what the rebase newly changed.

r1's required items

1. Resolved: the rebase, and the stale corrections on main.
   • The three records main deleted (held-disk, NVMe boot wait, reset-stops-xHCI) are no longer in the diff. a-disk-taken-offline-is-never-brought-back.md is main's text unchanged.
   • a-console-watch-...md is main's text plus the correction to its blocking read. That correction is true on main: sys_read waits through watch::wait_until on handle.watch() with serial::has_data, and the deadline is CONSOLE_REPOLL (kernel/src/syscall/io.rs:95-99, 156-166).
   • a-job-list-...md now cites pcidev::stop_before_reset (kernel/src/pcidev/mod.rs:211, called from kernel/src/power.rs:57,67). af1c5af25 is usbd drives every xHCI controller; the kernel drives no USB #971.
   • The megabyte record merges coherently with main's added paragraph.
   • The a-deliberate-wedge-... deletion is sound. Main's actuators keep wedge-before-reset, which stages its wedge in quiesce before anything is synced and holds no driver lock; hard-lockup-probe is the hard-lockup negative control. No arm stops inside a driver, main's stage E no longer cites the record, and no citation of it remains.
2. Resolved: the firmware-call commits. The record now cites d2006cc65 for the SMI_CMD byte and 15536e2e0 for widening it to every port. The owner question in the PR body says the same.
3. Resolved: the relative-program exit. The exit again requires that "the shell's own resolution goes", and launch_path is described as sitting beside the gate's is_canonical.
4. Resolved: the claim-spends wording. It now reads "actuator ... was removed in 29e100612". The host-test optional was taken too.
5. Resolved: the deletion message. It states, for each record, which exit halves were met and which were judged unnecessary and why, including the local --nightly runs and the removed usb-transport-break actuator.

Newly changed by the rebase

• a-driver-that-lends-...md is true on main. Region::lent (lib/blockserve/src/region.rs:29) refuses anything SharedMemory::lent refuses, and Sessions::open (lib/blockserve/src/sessions.rs:137) calls it before using the region.
• a-counters-read-...md is true on main. 241832e01 deleted the-boots-last-word-can-miss-the-console-when-klogd-holds-the-wire.md and is an ancestor of main. The rest of that paragraph was only rewrapped.
• The page-in record's exit now names "the backing's refusal", which settles the r1 optional.
• Personal data: no home paths or identifiers remain in issues/ or in the 53 touched files.
• Citations: every repository path cited in added text exists at the head. The exceptions are a relative hardlockup/mod.rs, the fork's src/sys/toyos.rs and the cut nodelay_kept.c, which the text names as cut.

Optional

• a-console-watch-...md:13-17 now says the same thing twice: "has no source at all" and "a console has no readable watch at all now". One clause can go. The title, "waits on the keyboard", is main's and is now false; the slug rule in issues/README.md lets whoever takes the record up rename it.
• The PR body's classification row for the firmware-call record still says "false since 15536e2" in its evidence column, though the summary above it is correct (orchestrator). The commit message's "went in 29e1006" for the usb-wedge-* actuators has the same "landed or removed" ambiguity r1 fixed in the record.

No required findings remain.

LAND