[Japabu]

Problem

Stale claims in open kind: defect records misdirect planning and review.
This is the owner's one-off audit (decision A), batch 3 of 4: 115 records.
Every concrete claim was checked against origin/main at
db0cf636d16d265ac400ab5f32658ed81f5cd632. After rebasing onto
a8ea09d209c514fdcffcdbe58f3c1826e6aa40e9 (#978's descriptor table and
#981), every record whose cited code had changed was read again there. The owner's uncommitted
requirements/ and claude-questions.md in the primary checkout were read as
well. Nothing in them bears on these records.

Result

class	count	what was done
already deleted on main	7	nothing: 13ed7b4f4 (usbd) removed them
owner-held	1	untouched: tearing-is-what-gop-cannot-give-back has uncommitted owner edits
fixed	5	deleted, exit verified
superseded	4	deleted, residual folded where one exists
partly stale	34	corrected, residual kept; 3 renamed because the old slug was refuted
still-valid	58	unchanged
uncertain	6	unchanged

Fixed (deleted):

• the-ack-delay-abi-doc-names-one-cpu: the doc now says what the kernel does.
• the-running-slots-volume-is-claimable: since 13ed7b4f4 the kernel serves
  no partition claim. The remaining exposure is the owner's rejected
  the-block-service-does-not-refuse-the-running-root.
• the-sysroots-core-and-alloc-carry-the-compiler-profiles-debug-assertions:
  5f732156a landed the exit and re-ran the proof.
• thread-exits-completion-post-is-the-second-one: fa1e3254d removed the
  second post.
• the-socket2-forks-ownedfd-holds-a-table-key-not-a-handle: fd: one descriptor table numbers every raw fd, and a child's descriptors are its fd:<n> endowments #978's
  descriptor table, with socket2 at 2aa6b00, which the lock now pins, makes
  a socket's number a descriptor in that table. std's OwnedFd closes it
  there.

Superseded (deleted):

• t14-keyboard-will-not-report-its-scancode-set: ps2server (ps2server: the i8042 driver leaves the kernel, and the owner of input merges every source #899) asks for
  no scancode set.
• the-memory-map-buffer-is-the-unreported-pointer: the framebuffer is now
  mapped through the boot map's scanout regions. The memory map's report and
  the T14 reading it needs are folded into
  the-boot-map-reaches-4-gib-and-firmware-decides-what-lands-in-it.
• the-supervisors-claim-of-a-pci-function-the-t14-lacks-holds-preemption-off-for-3-8-ms:
  A device function is claimed by its arrival, and a drives row has one process per function (lifecycle stage 1.2) #926 removed that path. The preemption-off bound belongs to
  syscall-preemption-is-incidental.
• watch-window-spins-out-a-hold-its-poster-is-queued-behind: dc62efca4
  deleted the hold. That git revert dc62efca4 restores the hold is now
  recorded where the remaining wake record links to it.

Renamed:

• the-panel-seeds-... became the-gcd-maps-held-mmio-descriptors-are-logged-nowhere.
• the-kernel-depends-on-toyos-fat32-... became three-comments-say-the-kernel-uses-toyos-fat32.
• two-std-maps-... became std-net-maps-every-other-syscall-error-to-other.

None of the three had an inbound reference.

Uncertain, left unchanged:

• the-bootstraps-own-build-cannot-start-rust-objcopy-on-an-apple-host
• the-console-loses-typed-keystrokes-under-host-load
• the-t14s-superspeed-stick-enumerates-at-high-speed-under-toyos
• the-wifi-demos-commits-still-resolve-on-origin
• two-processes-started-at-an-entry-point-nothing-had-mapped
• virt-claim-lpi-boot-stalled-in-firmware-once-under-load

Inbound references to deleted records were fixed in four files outside the
batch. The commit message gives every correction, and the classification table
with file and line evidence for each record is linked below.

Overlap with batches 1 and 2

The branch was rebased onto ff6b4fdff, after #982 and #986 landed. One file
overlapped. a-wake-to-a-busy-cpu-waits-for-its-next-pass-and-no-idle-cpu-can-take-it
was edited here only to replace its reference to the deleted watch-window
record. Batch 1 deleted it in favour of
no-row-holds-a-wake-beside-seven-spinners-to-100-us, and nothing in that
record cites watch-window. So the deletion stands and this branch's edit is
dropped, and the note that the restored hold would spin out with its poster
queued behind it now survives only in this branch's commit message.
blocking-read-window-reds-beside-other-guests still records that
git revert dc62efca4 restores the hold. No other record either batch touched
is touched here. A tree-wide search after the rebase finds no reference to a
slug that any of the three batches deleted or renamed. The only dangling
issues/ citation is the one already on main, noted below.

Checks

• Classification table: one row per record, with its class
  and its file, line or commit evidence.
• cargo run -- --ci host at df829822f, exit 1. That commit is the
  pre-rebase branch: it predates the socket2 record's deletion, the
  std-net-maps-... and broadcast-pin corrections made after the rebase, and
  review round 1's three record fixes. All of those are Markdown in issues/
  too (log). Every step through "the licences of what
  ships" passed: the build system, the harness's own checks, the workspace's
  host members, toyos-crypto, the kernel's library and the licences. Clippy
  stopped with No space left on device when the shared host's disk filled,
  so it established nothing. For a Markdown-only change, CI's documentation
  scope runs the build system's tests and the licences, and both passed.
• cargo test --lib (the build system's tests) at 92c77f575, rebased onto
  ff6b4fdff: exit 0, 366 passed
  (log).
• Before deleting each record, a tree-wide git grep for its slug found
  every inbound reference, and those were fixed. Every issues/*.md path cited
  under issues/ resolves except one already on main:
  a-device-function-is-driven-from-its-arrival-to-its-end cites
  a-cargo-run-boot-claims-every-pcidev-slot, which does not exist. That file
  has uncommitted owner edits, so it was not touched.
• No guest, metal or code change.

Risks

• Classification is a reading of code at one revision. Still-valid records
  were spot-checked against their central claims, not every sentence.
• The touchpad track's keyboard bullet, which described the deleted kernel
  driver, is corrected in this PR alongside its reference fix.

🤖 Generated with Claude Code

[Japabu]

Review r1: #985 at d3bd464be (base a8ea09d20, which is current origin/main)

Assessment. This changes Markdown only: 50 files, +414/−882. The approach fits the audit's terms. Five records were deleted as fixed, four as superseded, three were renamed, 31 were corrected in place, and four inbound references outside the batch were updated. I checked every deletion and rename against origin/main, using the socket2 fork's 2aa6b00 checkout and the rust gitlink a56b4057. I read all 34 corrections and spot-checked twelve still-valid records and two of the six uncertain ones. The published classification table matches the scratch copy byte for byte. Four claims need fixing before this lands: three are false sentences the branch introduces and one is a false evidence statement in the PR description. Everything else I checked holds.

What I verified

• Fixed deletions (5), all with their exit met:
  • the-ack-delay-abi-doc-names-one-cpu: the doc at sdk/abi/src/syscall.rs:799-806 states what tlb.rs's ARM_WINDOW_NANOS does.
  • the-running-slots-volume-is-claimable: Claimed (kernel/src/device.rs:48-53) has no partition arm and hold_source is gone. The record's own exit routed the residual to the block service's grants, which is the rejected the-block-service-does-not-refuse-the-running-root.
  • the-sysroots-core-and-alloc-…: build/sysroot.rs:1137 has debug-assertions-std = false, and 5f732156a's message records the no-panic proof being re-run.
  • thread-exits-completion-post-is-the-second-one: thread_exit (kernel/src/process.rs:1237-1263) posts once and publish_released is gone. This resolves the double post by the other route than the record's exit, and that is fine.
  • the-socket2-forks-ownedfd-holds-a-table-key-not-a-handle: at 2aa6b00, install puts each socket into the descriptor table as an fd::Object::opaque with a release callback (src/sys/toyos.rs:338-357). Every fd impl (:929-963) passes that descriptor, and std's OwnedFd drop calls toyos::fd::close (rust a56b4057 library/std/src/os/fd/owned.rs:242-243). The root Cargo.lock is the only pin (:3900).
• Superseded deletions (4), each residual kept or moved:
  • The scancode record: ps2server's probe (system/ps2server/src/probe.rs:11-17) resets the keyboard with translation on and asks for no scancode set.
  • The memory-map record: folded into the-boot-map-reaches-4-gib-…, and the T14 margin reading is added to its exit.
  • The 3.8 ms claim: the window now falls under syscall-preemption-is-incidental's mask_windows exit.
  • watch-window: the restore commit was already recorded in blocking-read-window-reds-beside-other-guests.md:47-49.
• Renames (3):
  • The old slugs have no references left anywhere in the tree. I also searched the owner's uncommitted requirements/ and issues/ in the primary checkout, reading only; the only hits are the four files this PR edits, in their main versions.
  • Each opened date is preserved.
  • The fat32 comments (lib/fat32/Cargo.toml:2, build/fatformat.rs:5, build/image.rs:578) and syscall_err's _ => Other (sdk/std/sys/net/connection.rs:59-64, called at :358,360,482,499) are as described.
• Path check: I ran a script over every path cited in the 47 added or modified records against the head tree. It found three misses, none of them a defect. Two are guest paths, /system/bin/…, which the extraction cut short. userland/soundd/ is explicitly historical ("was … now system/soundserver/"). Separately, tests/testcases/ in a-shared-boot-…:66 does not exist; that line predates this PR. Every issues/*.md citation resolves except the one the PR already names.
• Personal data and format: no identifiers in the added lines. Frontmatter and kinds follow issues/README.md. No owner-held file is touched.

Required

1. issues/the-t14-mouse-may-be-another-defect.md:25-28,33-35: a false claim about usbd, and the exit depends on it.
   • The record says that "under usbd the first names the completion code, and the second leaves no completion". The exit then asks for "the completion code or silence that says which of the two cases".
   • At main, read_reports (system/usbd/xhci/src/hid.rs:158-162) names the code only when dev.restart fails. An error completion that restarts successfully produces no line. restart (system/usbd/xhci/src/usb.rs:927-937) speaks only when Recovery::begin refuses.
   • So an endpoint that errors and recovers forever is as silent as one that was never scheduled. The next T14 session could not tell the two cases apart, which is exactly what this record exists to do.
   • Fix: say what usbd actually reports, and make the exit name an observable that separates the cases. That means either a line or counter for recovered error completions, recorded as owed, or wording that admits usbd cannot separate them today.
2. issues/the-t14-touchpad-is-i2c-hid-and-unbuilt.md:33: the branch writes a false count.
   • "Two T14 defects are open beside this one" is untrue: about 37 open records name the T14, and the-t14-mouse-may-be-another-defect and t14-desktop-froze-at-64s are in this very batch.
   • The old "Three" was already wrong, but this edit restates the count.
   • Fix: drop the number, for example "T14 defects open beside this one include".
3. issues/the-compiler-workspace-resolves-the-published-toyos-abi.md:13-14: the pin cited is not the current one.
   • "the committed lock (the rust fork at 11e31a5277)" names an older commit. Main's gitlink is a56b4057. The lock line is unchanged between the two (Cargo.lock:5854-5857 at a56b4057), so the fact is true but cited at the wrong revision.
   • This is the stale-base kind of citation the brief asked about. Cite a56b4057, or just say "the pinned rust/Cargo.lock".
4. PR description, Checks (orchestrator to correct): a false evidence statement.
   • It calls df829822f "the same change before the rebase". git range-diff shows it is not.
   • After the rebase the branch added the socket2 OwnedFd deletion, changed std-net-maps-…'s text, moved the SO_BROADCAST pin from 12abd8f to 2aa6b00, and rewrote the commit message.
   • For a Markdown-only change the conclusion still stands: cargo test --lib ran at d3bd464be, and the slug search covers the manifest issue = check in build/userlandhost.rs. But the sentence should say "an earlier version of this change".

Optional

• toybox-is-one-row-for-every-applet.md:18-23: the union described omits the row's starts list (images/system.toml:240: shell, update, sshserver, swap, …). Every applet inherits that authority too, so it belongs in the account of the over-grant.
• the-gcd-maps-held-mmio-descriptors-are-logged-nowhere.md:9-11: free_mmio prints every free MMIO range of at least GRANULE, including those "past the room the kernel is handed" (loader/src/gcd.rs:146-158), not only the ranges it hands over. "one line per free MMIO range of GRANULE or more" would be exact.
• the-t14-touchpad-is-i2c-hid-and-unbuilt.md: the PR edits this file but leaves the sentence it found false ("reads the set and never writes it"). Fixing it now costs one line, but deferring it to its batch is defensible.
• test-runner-holds-logread-…: the exit's "or" became "and", which turns a stale comment into part of the defect. That is reasonable given testcases.toml:45's "log gate"; I mention it only so the scope change is deliberate.

Notes for the orchestrator (not about the branch)

• The handoff's unfiled discovery is wrong. toyos_elf::section::rela_sections does have a caller, loader/src/main.rs:296-297, which panics on the REL/RELR refusal. Do not file it.
• The handoff reports that the implementer ran git submodule status once in its worktree, which CLAUDE.md forbids. It was read-only, and I saw no damage, but the shared fork's worktree configuration is for you to judge.

SEND BACK: required items 1–3 are one-line or one-paragraph edits to the records, and item 4 is a PR-description correction.