[Japabu]

What this is

A bounded, one-off accuracy audit of batch 2 of the open kind: defect records in issues/ (117 files), as the owner directed: stale claims misdirect planning and review. Each record's concrete claims were read against origin/main at db0cf636d16d265ac400ab5f32658ed81f5cd632, beside the owner's uncommitted requirements/ and claude-questions.md in the primary checkout. I then rebased onto a8ea09d209c514fdcffcdbe58f3c1826e6aa40e9, after #978 (the userland fd table) and #981 (batch 0) landed, and read again every record whose cited code #978 changed. No code changes and no guest or metal runs.

Result

class	count	done
fixed	7	3 deleted here; 4 were already deleted on main by #971, #980 and #978
superseded	8	deleted: the code or test they describe is gone, or another record or a later owner decision carries what they asked
partly stale	34	corrected; each residual defect kept in its record (3 renamed, because the old slug's claim is false)
uncertain	9	unchanged
still valid	58	unchanged
owner-held	1	no-physical-memory-fairness, which has uncommitted owner edits; untouched

Decisions worth review:

• Fixed means the defect is gone in the code. shell-c-discards-the-cwd-its-launch-carried and std-answers-every-spawn-refusal-but-notfound-as-other are deleted although their exits also asked for a guest probe. Reading the code is enough to establish both fixes, and root CLAUDE.md asks for no test of what inspection establishes.
• netstack-watches-both-pipes-of-every-connection-on-every-pass was fixed by c91e72b, whose message names it but did not delete it. Both exit clauses are met (kernel/src/pipe.rs's leaving watch, system/netstack/src/watches.rs's Armed, which is host-tested).
• Superseded records whose cause was never found (metal-device-probe-usbread…, netstack-refused-accept…, process-stats…) were deleted only because both the code path and the test they describe are gone. Where a mechanism might still exist (log-reserve-window-negative…, metal-job-reboot…, so-cache-refusals…, stdio-buffering…, null-sink-applies-one-connect, pulling-the-boot-stick…, spawned-process-never-starts, process-start-skew…), the record stays and is classed as uncertain.
• Some exits were rewritten where the old one names something removed (the kernel keyboard route, blockd, a guest QEMU trace, dns_resolve). Where a unit or module test can establish the claim, the new exit asks for that test.
• libc-munmap-refuses-part-of-a-mapping loses its "or the owner rules the refusal final" alternative. The record now states the owner's 2026-10-21 ruling itself: whole-mapping-only unmap is not the final contract, and the refusal is to be revised.
• Review r1: logkeeper-flushes-the-records-its-own-refused-flush-made is deleted as superseded, not renamed. Its measured loop (the kernel's fsync retry) is gone, and no current route is known; the commit message carries the evidence. kernel_stack_addr… stands deleted because the loader record carries its rename, while the field itself still exists.
• fd: one descriptor table numbers every raw fd, and a child's descriptors are its fd:<n> endowments #978's effect. It fixed and deleted libc-close-of-a-socket-ends-the-process. os-toyos-io-traits-keep-a-posix-name is deleted on the owner's 2026-10-21 answers (C numbering and Rust/C descriptor interoperability in userland, one adaptation shared by std and libc, one inheritance rule). Those answers supersede the 2026-08-19 "fds belong only in libc jargon" ruling (64f806d); fd: one descriptor table numbers every raw fd, and a child's descriptors are its fd:<n> endowments #978 implements them and gives the kernel handle AsRawHandle. The traits themselves still exist. It also narrows libc-refuses-what-toyos-cannot-yet-answer's fcntl bullet and the example in libc-answers-einval…. The other records it touched (std-says-a-launch-moves…, std-set-times…, the libc socket records, mio-deregister… at the new mio pin) still hold as corrected.
• Inbound references: parallel-tests-red-under-other-suites.md (another batch's file) loses a pointer to a deleted record. no-console-between-boot-and-terminal.md pointed at the deleted screen-diag-boot… record and now cites the commit instead. A code comment (system/pkg/src/main.rs:201-202, system/netstack/src/serve.rs:34) still cites two slugs I kept, so no code changes were needed.

Found on the way

The home paths I found in records outside this batch are already masked on main (#981). No path under /Users/ is left in issues/.

Checks

Final commit 0a6275f27 on base a8ea09d20, on the dev host (macOS):

• cargo test --lib exited 0 with 366 passed (log). These are the build system's tests, which are what a documentation-only change runs under cargo run -- --ci host, including licence::tests::every_pending_exception_cites_an_issue_that_exists. It also exited 0 at fff4f5680 before review r1 (log).
• An earlier cargo run -- --ci host at b00918e0d (the same audit on base db0cf636d) exited 1 (log). Its documentation-scope steps both passed: "the build system" and "the licences of what ships". It then failed in the kernel-loom controls with No space left on device (os error 28) on the shared disk, so the environment caused that red, not this change. I did not rerun it: nothing outside issues/ is touched.

Table: table.md.

Per-record classification (117). Evidence is file and line at db0cf63; records #978 touched were reread at a8ea09d.

record	class	evidence	action
partition-claim-gives-up-reds-beside-other-guests-and-is-green-alone	fixed (already closed)	deleted on main by 13ed7b4 (#971)	none
scheduler-pass-blocks-in-xhci	fixed (already closed)	deleted on main by 13ed7b4 (#971)	none
std-calloc-overflow-writes-past-a-fifteen-byte-block	fixed (already closed)	deleted on main by e4e66e5 (#980)	none
libc-close-of-a-socket-ends-the-process	fixed (already closed)	deleted on main by #978 (a6ab280): a socket is an Object::opaque descriptor in the fd table and close releases it (sdk/libc/src/socket.rs:103-129); #978 filed libc-close-of-a-socket-is-unproven-on-a-connected-socket for the guest case	none
netstack-watches-both-pipes-of-every-connection-on-every-pass	fixed	c91e72b (2026-10-11) gave a pipe end's leaving its own watch (kernel/src/pipe.rs:126-129, "a byte moved through the pipe wakes no poll that asked about a leaving") and made netstack submit only a changed or answered watch (system/netstack/src/watches.rs Armed, host-tested at :97, :105); both exit clauses met; the commit named the record but did not delete it	delete
shell-c-discards-the-cwd-its-launch-carried	fixed	system/shell/src/main.rs:25-29 runs -c with no set_current_dir (b3770cf); the exit's guest probe is not owed for what inspection establishes	delete
std-answers-every-spawn-refusal-but-notfound-as-other	fixed	sdk/std/sys/process.rs:406-417 maps each toyos::spawn::Refused (Invalid -> InvalidInput) and every SyscallError through to_io_error (sdk/std/sys/pal/mod.rs:23-37), since 61a283a; the cited spawn_cwd test is gone and the exit's assertion is a match inspection establishes	delete
kernel_stack_addr-names-an-offset-not-an-address	superseded (carried elsewhere)	PR #583 merged without the rename (sdk/abi/src/boot.rs:9 still kernel_stack_addr); the rename is a step of issues/the-loader-does-only-what-must-precede-the-handover.md:175	delete
log-flush-retry-deadman-arm	superseded	the kernel fsync deadman went with the durability ledger (80a1f1c; ops.rs:648-655 fsync owes nothing); kernel USB went (13ed7b4); test deleted 9ebf080	delete
logkeeper-flushes-the-records-its-own-refused-flush-made	superseded	the measured loop was the kernel's fsync retry and its records, gone with 80a1f1c and 13ed7b4; logkeeper ends its volume on a refused append or flush (system/logkeeper/src/main.rs:625-632) and warns of a slow round once behind degraded (:633-643); the file server logs only failures (system/fileserver/src/data.rs:136, 461); no current route known	delete (review r1)
metal-device-probe-usbread-answered-iofailed-once-beside-other-guests	superseded	one sighting with no mechanism through the kernel's usb-storage, which is gone (13ed7b4: usbd drives xHCI); the test was deleted (24aa318)	delete
netstack-refused-accept-hung-waiting-for-a-wake-that-never-came	superseded	netd and its listen.rs gone (netstack replaced it), test deleted 7967fba, netcase_against_host gone from tests/	delete
os-toyos-io-traits-keep-a-posix-name	superseded	the traits still exist (sdk/std/os/io.rs) and now name a real descriptor; the owner's 2026-10-21 answers (claude-questions.md item 5, section M, item 9) supersede the 2026-08-19 "fds belong only in libc jargon" ruling (64f806d); #978 implements them and adds AsRawHandle	delete
process-stats-exits-101-beside-other-guests	superseded	both recorded reds are the test's own premise (a park it could not attribute to the connection); test deleted 4a5b228, and the first red carried no text	delete
screen-diag-boot-leaves-no-i8042-line-on-the-panel	superseded	the kernel's i8042 and its health line left for ps2server (febfd21); test deleted 8bf3fc2	delete; fix ref in no-console-between-boot-and-terminal
io-uring-enter-trips-the-one-queue-invariant	partly stale	kernel io_uring and WaitQueue gone (232f69b, aaddf38); kernel keyboard gone (13ed7b4); the assertion is now kernel/pure/sched/watch.rs:132 "a task waits on at most one watch"; root cause never found	rewrite + rename
kernel-text-is-writable-and-every-kernel-page-executable	partly stale (cite)	still valid: kernel_leaf paging.rs:66-67 is P	W
libc-answers-einval-for-every-error-it-does-not-name	partly stale	mapping is errcode::of (sdk/libc/src/errcode.rs), still _ => EINVAL; after #978 libc's own descriptor table answers EMFILE (posix_io.rs fd_errno), the kernel handle table's ResourceExhausted still reaches EINVAL	correct site and example
libc-answers-epipe-and-raises-no-sigpipe	partly stale	SIGALRM now handled by signal/sigaction (misc.rs:144-160, alarm.rs); Gone->EPIPE is in errcode.rs; SIGPIPE still never raised	correct text
libc-host-tests-take-the-host-c-library-as-their-oracle	partly stale	fparts_differential.rs:8-17 also calls host round and lround; rest holds	correct list
libc-loses-the-kernels-word-on-three-write-paths	partly stale	send's TCP arm answers through stream_errno (socket.rs:363-366, 539-549); sendto's UDP Datagrams::send socket.rs:170 `map_err(	_
libc-munmap-refuses-part-of-a-mapping	partly stale (owner direction)	code holds: posix_io.rs:620-630, kernel vm.rs:193-201; the owner's uncommitted requirements/memory.md (2026-10-21) has the track's refusal of partial unmaps revised, so the "or rule it final, kind: rejected" exit is dropped	drop that alternative
libc-refuses-what-toyos-cannot-yet-answer	partly stale	after #978 F_DUPFD_CLOEXEC works, F_DUPFD answers the lowest free at or above its floor (sdk/toyos/src/fd/table.rs:68-71, 117-119), and F_GETFD/F_SETFD of an unheld descriptor answer EBADF (sdk/libc/src/posix_io.rs:472-481); record locks and F_GETFL/F_SETFL/F_GETOWN/F_SETOWN remain; every other name still in refused.rs	trim the fcntl bullet
listing-home-answers-not-found-and-its-bound-has-no-guest-test	partly stale	the bound is system/fileserver/src/main.rs:803-805 Error::LimitExceeded, not userland/fsd's ResourceExhausted; readdir_bound covers only /tmp; /home's NotFound not re-measured (uncertain half kept)	correct sites
logkeeper-ends-the-boots-log-on-one-refused-create-and-nothing-durable-says-so	partly stale	defect holds: system/logkeeper/src/store.rs:202-207 one create error -> None, no retry; logd/userland/logd and policy::fate gone (system/logkeeper/src/main.rs:612-645: any refused append or flush ends the volume); kernel usb-storage gone (13ed7b4)	correct "what is known"
map-mmio-takes-an-address-past-the-direct-map-window	partly stale	map_mmio still unbounded (paging.rs:710-719, 925); DMAR/IVRS base bound is iommu_unit::register_window (iommu_unit.rs:35,78-83), vtd::window/pcidev::probe_dword gone; ECAM windows now checked against DIRECT_MAP_WINDOW (drivers/acpi.rs:139-142)	correct sites
metalprobes-usb-read-is-answered-from-fileservers-cache	partly stale	still holds: tests/guest/metalprobe/src/usb.rs:87-108 reads back a file it just wrote; cache is system/fileserver/src/cache.rs CLEAN_LIMIT, not userland/fsd	correct paths
mio-deregister-fd-leaves-a-pending-poll-live	partly stale	still holds at mio 9f34d36c (Cargo.lock after #978): deregister_handle (selector.rs:247-251) only drops the registration; drain loop (:205-) matches by token alone; text named deregister_fd, POLL_ADD, CQE, pin e8068c2	correct names and pin
most-t14-leases-land-one-dhcp-retry-late	partly stale	netd/smoltcp gone, netstack runs toyos-dhcp; netstack logs no DISCOVER or OFFER (no such log in system/netstack); the exit still names netd	correct to netstack
netstack-holds-a-pending-request-for-a-client-that-left	partly stale	the connect half is gone: a stream's connection is watched from the connect for its hang-up (serve.rs:11-15, 739-741); Sockets::receiving (serve.rs:124) is still unwatched; Sockets::connecting no longer exists	keep the receive half
netstack-keeps-receiving-for-a-client-that-closed-its-receive-end	partly stale	streams are a lent region, no receive pipe; shutdown_read only sets the client's own read_shut (sdk/toyos/src/net/stream.rs:465-470), so netstack keeps receiving into the ring and the peer is not told; cited test is now a_client_that_leaves_with_text_unread_resets	rewrite to current shape
netstack-lookup-slots-have-no-per-client-share	partly stale	MAX_LOOKUPS is system/netstack/dns/src/lib.rs:77, global; connections now carry a row/session badge (serve.rs:26-29), but sessions are multipliable; "netd"	correct
netstack-socket-ids-are-ambient	partly stale	streams are no longer named by a number (serve.rs:11-15); listener and datagram ids (serve.rs:298-310, 429-492) still checked only against the table; netd -> netstack	correct scope
netstacks-places-are-one-number-for-every-client	partly stale (cite)	guest netstack_socket_churn cut (c6a2861); host tests listeners.rs:613,633,797 hold	drop guest cite
no-console-between-boot-and-terminal	partly stale (names/cites)	holds: panic_console/mod.rs:730 returns once SCREEN_OWNED_BY_USERLAND; glyph_char mod.rs:1171-1177; logd is logkeeper, test every_boot_config_runs_logkeeper (build/build.rs:3005); screen_diag_boot's record deleted, so its pointer now names the deleting commit	correct names, cites, inbound ref
one-diskserver-session-can-hold-every-device-slot	partly stale	blockd gone; the pull is toyos_blockserve::Sessions::pull (lib/blockserve/src/sessions.rs:212-226), run by each disk driver (system/nvme); still only the ring's DEPTH bound	correct site
one-write-far-past-a-files-end-holds-data-s-server	partly stale (names)	still holds: lib/bcachefs/src/fs.rs:1032 resolve_or_alloc_block, fileserver single-threaded (main.rs:26-30), no gap bound in bounds.rs; "fsd" is fileserver	rename fsd
probe-mounts-on-a-checksum	partly stale (paths)	still holds: system/fileserver/src/data.rs:211-229 mounts first; superblock.rs:236-262 backup fallback; guest arm volume_from_another_disk gone	correct paths
remove-dir-all-empties-a-directory-and-leaves-it	partly stale	std fixed: sdk/std/sys/fs.rs:848-859 ends with rmdir(path) (in 3831f29); residual: system/pkg/src/main.rs:201-204 keeps remove_tree with a doc comment giving this defect as its reason (its other reason, an explicit stack, stands)	rewrite to residual
sharedmemory-slices-rest-on-a-size-nobody-checks	partly stale	a peer's region now maps through lent, which judges its size against fstat (sdk/toyos/src/shm.rs:55-62); adopt (:46-53) is still safe with an unchecked size, held only by its doc; aliasing premise unchanged	correct first bullet
smp-ap-hole-and-log-reserve-window-red-under-a-loaded-host	partly stale	the root-read half is gone: the kernel reads ROOT only from the loader's in-memory image (kernel/src/rootfs.rs:1-12) and drives no USB (13ed7b4); the spawn half stands under a new name, spawn_supervisor panics on any refusal (kernel/src/loader/mod.rs:487); tests deleted	keep the spawn half
soundserver-past-due-wake-max-1	partly stale	the device wait's armed now arms the next future grid point when past due (system/soundserver/src/mix.rs:185-192); the null sink's wait keeps .saturating_sub(now).max(1) (:765); userland/soundd paths gone	narrow to the null sink
sshserver-authorized-keys-unprotected	partly stale	keys are /state/sshserver (sshserver main.rs:28-45); installed packages no longer see /state (lib/manifest/src/lib.rs:305-318), every shipped row still sees the whole tree	narrow the claim
sshserver-holds-one-channel-and-does-not-say-so	partly stale (paths)	still holds at system/sshserver/src/main.rs:157-172, 478; userland/sshd named	correct path
sshserver-still-speaks-rsa	partly stale (path)	system/sshserver/Cargo.toml:9 rsa; Cargo.lock:3356	correct path
std-calls-undated-what-it-did-not-stat	partly stale	mtime half fixed: DirEntry::metadata is lstat (sdk/std/sys/fs.rs:239-241), FileAttr carries the server's/kernel's mtime (:140-158); set_times half holds (:695-697, :943-949 answer Ok)	rewrite to the set_times half, rename
std-lookup-host-answers-no-address-as-other	partly stale	still Other "DNS lookup failed: no results" (connection.rs:671), but net_err_to_io now names eight kinds (:17-29); netd is netstack; dns_resolve/DNS_NO_ADDRESS no longer in tests/	correct names, drop the gone test from the exit
std-maps-a-device-error-to-other-not-uncategorized	partly stale	Io => Other holds (sdk/std/sys/pal/mod.rs:33); every load-bearing consumer it names is gone (logd policy.rs, tests/common/volumes.rs; no ErrorKind::Other in system/), so the reason it was kept no longer applies	rewrite to the std arm alone
std-says-a-launch-moves-its-handles-to-the-launcher-even-when-the-move-is-refused	partly stale	std's launch handling moved to toyos::spawn::Spawn::ask_launcher (sdk/toyos/src/spawn.rs:197-268, 61a283a), whose prose is right; CommandExt::provide (sdk/std/os/process.rs:41-43) still points at endow's "after a successful spawn" (:25); #978 touches the file	keep the provide half
log-reserve-window-negative-times-out-beside-other-guests	uncertain	test and actuators deleted (9ee7a75, 4db54ff, 3b8102c); an early-boot hang with no mechanism, never re-measured	none
metal-job-reboot-drained-no-kernel-output-beside-other-guests	uncertain	test deleted (99ee962); no mechanism found	none
null-sink-applies-one-connect	uncertain (annotated)	never explained; every component it names has been replaced: soundd is soundserver with its own null-sink thread (system/soundserver/src/main.rs:56-68, 87f0b2a, aa7767b), the kernel's io_uring and PIPES waits are gone (232f69b), tests/desktopaudiocase and null_sink_shipped_client deleted (520c0d1); not re-seen	add a current-state note, keep open
process-start-skew-on-a-runner	uncertain	a CI-runner reading never re-measured; scheduler balance changed since	none
pulling-the-boot-stick-freezes-the-t14	uncertain	already annotated "Since usbd" (13ed7b4): kernel holds no USB lock; whether the T14 still freezes is unmeasured	none
so-cache-refusals-saw-the-kernel-refuse-nothing-once	uncertain	one CI sighting, no mechanism; the budget check is kernel/src/elf/cache.rs:233-242; test and so-cache-tiny gone	none
spawned-process-never-starts	uncertain	investigation record; cause of a CPU going quiet never found	none
stdio-buffering-saw-one-long-line-arrive-as-two	uncertain	one sighting, test deleted 2dfe100	cite of deleted tests/common/console.rs now names 520c0d1
stds-toyos-files-carry-lines-rustfmt-would-rewrap	uncertain	measured at fork a0d44493347; not re-run (needs the stage0 nightly rustfmt)	none
no-physical-memory-fairness	owner-held	uncommitted owner edit in primary checkout	untouched
kernel-functions-return-with-their-used-registers-intact	still-valid	.cargo/config.toml has no zero-call option; rustc fork 11e31a52 options.rs has no zero_call	none
kernelslice-outlives-its-allocation	still-valid	region.rs:14 Copy no lifetime; holders elf/cache.rs, elf/mod.rs, process.rs:256	none
libc-accept-writes-its-callers-address-before-it-can-still-fail	still-valid	socket.rs:321-344 fill before alloc_socket, ENOMEM	none
libc-dl-iterate-phdr-allocates-on-every-walk	still-valid	link.rs:30-52 answer() Vec via listing::whole, name Vec	none
libc-dlsym-rtld-default-panics-as-unimplemented	still-valid	misc.rs:457 expect("dlsym: RTLD_DEFAULT not implemented")	none
libc-getaddrinfo-ignores-its-service-and-its-hints	still-valid	socket.rs:743-777 _service, _hints, port 0, SOCK_STREAM; gai_strerror one text socket.rs:825	none
libc-getsockname-and-getpeername-answer-a-null-buffer-with-success	still-valid	fill_sockaddr socket.rs:133-138 returns on null	none
libc-has-no-pread-or-pwrite	still-valid	no pread/pwrite in sdk/libc/src or include; no positional syscall in sdk/abi/src/syscall.rs	none
libc-lacks-names-llvm-for-a-toyos-host-calls	still-valid	no shm_open/shm_unlink/scanf/ctime in sdk/libc	none
libc-printf-ignores-the-h-and-hh-length-modifiers	still-valid	conversion.rs:67 skips h/hh	none
libc-reads-a-long-double-as-a-double	still-valid	conversion.rs:73 skips L; tests/toyos.rs:1612 still declines; strtold (arch/x86_64.rs:96) returns st0 widened from strtod, which the parenthetical already allows	none
libcxx-takes-the-generic-locale-path-on-toyos	still-valid	llvm-project at b7420fe5 (rust 11e31a52's src/llvm-project) has no support/toyos.h	none
mutual-kill-panicked-on-the-t14-with-stdio-slot-1-not-a-log-ring	still-valid	sdk/toyos/src/log/stdio.rs:208-210, 277 unchanged; no cause recorded	none (main masked its home path in 58e5b4a)
n2-does-not-compile-for-toyos	still-valid	build/n2.rs:17 still pins b1fead52	none
netstack-drives-one-card	still-valid	system/netstack/src/main.rs:71, 316 first match	none
netstack-ends-for-the-boot-on-a-nic-it-cannot-drive-on	still-valid	card.rs:74, virtio_net.rs:89 panic; system.toml restart only on other rows	none
netstack-replaces-one-programs-cached-answers-to-keep-anothers	still-valid	dns/src/lib.rs:92, 926; test dns/src/tests.rs:1496	none
netstack-resolver-asks-a-dead-primary-first-on-every-lookup	still-valid	Lookup::start dns/src/lib.rs:663-680 starts every server at now, no history across lookups	none
netstacks-receiver-round-trip-reads-no-finer-than-a-millisecond	still-valid	shard/tcp/src/rx.rs:39 one tick	none
no-claim-gets-an-address-space-under-virtio-iommu	still-valid	no virtio-iommu in kernel/src; pcidev/mod.rs:652,660	none
no-entry-or-switch-clears-the-bhb-fills-the-rsb-or-issues-an-ibpb	still-valid	no IBPB/PRED_CMD/BHB/RSB in kernel/src	none
no-guest-case-reads-std-filesystem	still-valid	no C++ guest using std::filesystem or ifstream under tests/	none
no-kernel-address-is-drawn-per-boot	still-valid	mm/mod.rs:33 constant PHYS_OFFSET; no randomization in kernel or loader	none
no-program-runs-with-speculative-store-bypass-disabled	still-valid	no SSBD/SPEC_CTRL in kernel/src	none
no-rule-decides-l1tf-mitigation-for-an-affected-intel-cpu	still-valid	no L1TF decision in kernel/src	none
no-test-runs-the-shipped-trace-reader	still-valid	system/trace has no test; only tests/guest/rust-tests/src/bin/trace_read.rs	none
no-user-address-is-drawn-per-spawn	still-valid	loader/mod.rs:49 USER_VM_BASE, vma.rs:14 STACK_BASE constants (lines drifted by one)	none
no-watchdog-arms-on-an-amd-machine	still-valid	kernel/src/arch/x86_64/watchdog.rs has no AMD arm	none
nothing-launches-a-script-by-its-interpreter-line	still-valid	no #! handling in kernel, system or sdk	none
nothing-reclaims-what-a-stop-leaves-on-a-fat-volume	still-valid	lib/fat32/src/repair.rs; test refused_writes.rs:618	none
one-checkout-of-one-tree-builds-two-kernels	still-valid (not re-measured)	[profile.toyos] still inherits dev (Cargo.toml:344-352), no gate compares builds	none
one-mapping-is-written-in-two-ledgers	still-valid	vm.rs:193-208 mmap_regions plus free_and_unmap; owner's uncommitted memory checkpoint lists it to reconcile, not decided	none
one-program-that-fills-a-servers-table-holds-every-other-client-out	still-valid	lines pinned at 1a74646; fileserver's share now in bounds.rs:43-66, soundserver MAX_CONTROL_CLIENTS and surface MAX_CLIENTS=4 unchanged	none
pci-is-enumerated-on-segment-group-0-alone	still-valid	lib/acpi/src/mcfg.rs:36, 64-65	none
per-cpu-scheduler-and-pmm-state-shares-lines-every-cpu-writes	still-valid	pmm.rs:249-279, user_ptr.rs:305-309, CpuHandle unpadded cpu.rs:2213, Frontier fair.rs:29-45 (line cites drifted, names hold)	none
physical-memory-past-64-gib-panics-the-boot	still-valid	pmm.rs:36-37 MAX_PAGES, :118 assert	none
remove-all-follows-a-link-swapped-in-mid-walk	still-valid	build/libcxx.rs:47 flag; no openat/fdopendir/unlinkat in sdk/libc	none
rust-and-c-objects-carry-two-triples	still-valid	fork 11e31a52 targets/{x86_64,aarch64}_unknown_toyos.rs:10 *-unknown-none-elf	none
rustc-llvm-cannot-build-for-a-toyos-host	still-valid	fork 11e31a52 compiler/rustc_llvm/build.rs has no toyos arm (stdc++ default at :508)	none
screen-panic-muted-reads-the-panel-before-the-report-has-reached-its-armed-line	still-valid	tests/toyos.rs:3430 one screendump_until("PANIC:") then asserts the armed line	none
servers-let-a-client-go-on-the-handshake-limit-with-its-request-unread	still-valid	lines pinned at 1a74646; the same eight files declare HANDSHAKE_TIMEOUT today	none
slint-and-egui-are-not-supported-by-the-owners-choice	still-valid	nothing in the tree builds slint or egui	none
softbuffer-reads-a-toyos-window-behind-its-lock	still-valid	softbuffer b36854df src/backends/toyos.rs:31 derefs the handle unlocked	none
spawn-thread-disagrees-about-a-reaped-parent	still-valid	process.rs:914-915 panic vs :955 admit_thread_insert -> None	none
spec-ctrl-and-gds-stay-as-firmware-left-them	still-valid	no IA32_SPEC_CTRL / MCU_OPT_CTRL access in kernel/src	none
sshserver-reports-a-killed-program-as-exit-lost	still-valid	main.rs:57, 443-472	none
stats-does-not-resolve-the-command-its-user-typed	still-valid	system/toybox/src/stats.rs:12	none
std-and-libc-allocate-under-a-spinlock-with-no-futex	still-valid	sdk/std/sys/alloc.rs:56-70 spin; sdk/libc/src/lib.rs spin; #980 made malloc.rs the one C allocator over whichever heap, as the record already says	none
std-and-libc-drop-the-answer-thread-join-gives	still-valid	sdk/std/sys/thread.rs:56-58; pthread.rs:84	none
std-file-lock-answers-ok-and-locks-nothing	still-valid	sdk/std/sys/fs.rs:560-574	none
std-leaks-a-thread-stack-per-spawn	still-valid	sdk/std/sys/thread.rs:9-55 Thread holds only a tid	none
std-names-its-toyos-backend-by-a-path-out-of-the-fork	still-valid	14 arms in fork 11e31a52 library/std/src; sdk/std/os/ffi.rs:5, sys/pal/mod.rs:7	none
std-reads-a-query-modules-byte-count-as-a-module-count	still-valid	sdk/std/sys/pal/mod.rs:135-155 reads count records	none
std-says-this-machine-has-one-cpu	still-valid	sdk/std/sys/thread.rs available_parallelism NonZero 1	none
std-udp-socket-ignores-its-timeouts	still-valid	connection.rs recv_from/send_to ignore read/write_timeout_ms	none
stds-toyos-backend-keeps-assembly-outside-an-architecture-module	still-valid	sdk/std/sys/pal/mod.rs:49-67 naked _start under target_arch	none
steal-probe-node-dies-with-its-victim	still-valid	kernel/loom feature victim-retires-mid-probe (Cargo.toml:250) and the single node cpu.rs:251	none
stop-the-device-voice-keep-the-wake	still-valid	soundserver stops the device only with no stream (system/soundserver/src/mix.rs:655-662), so a connected silent client keeps it open	none

🤖 Generated with Claude Code

[Japabu]

Review r1: PR #986 at fff4f5680 (base a8ea09d20)

I read the commit, the whole diff (51 files under issues/ only; +400/−894), each changed record against the head tree, the owner's uncommitted requirements/memory.md and claude-questions.md in the primary checkout (read-only), and the per-record table. No builds or tests were run. A documentation-only change needs a consistency review, and cargo test --lib at fff4f5680 (exit 0, 366 passed, including licence::tests::every_pending_exception_cites_an_issue_that_exists) covers the one gate that reads issue paths.

Assessment

This is a sound audit, scoped as its terms set it. Records are corrected in place, and where a defect remains it stays in its record: the munmap gap, the set_times half, the two libc write paths, the stream half of netstack's pending requests, the null-sink wait. No deletion leaves a dangling pointer. A git grep of each of the 14 removed slugs at the head finds no hits in the tree, and none in the primary's requirements/ or claude-questions.md. New exits move from guest probes to host or module tests wherever a unit test can hold the claim (Sessions::pull, serve.rs, a loom model of Watch), which matches root's testing policy. One rename adds an unproven defect claim, and the commit message gives the wrong grounds for two deletions. Those are the two required items below.

Required

1. issues/logkeeper-flushes-the-records-its-own-flush-made.md:8-14: the title and opening state a live feedback loop that nothing establishes. The record says logkeeper's flushes make records that make it flush again and again, so "the log never goes quiet." Its own lines 26-29, and the handoff, admit that no current route has been shown. The code shows the measured route is closed:

   • a refused append or flush ends the volume (system/logkeeper/src/main.rs:625-632);
   • a slow round warns once, behind the degraded latch (:633-643);
   • the storage servers log only when an operation fails (system/fileserver/src/data.rs:136, 461), and a failed flush ends the volume.

   The old slug described a real, measured instance. The new slug describes a hypothesis, which is the kind of claim this audit set out to remove. Either delete the record as superseded, with this evidence in the commit message, or retitle it as an unconfirmed question and name the route to check. Do not leave it stating the loop as current behaviour.

2. The commit message's grounds for two deletions. Under the issues README, the commit message is the durable record of a close.

   • The heading "Deleted, superseded (the subject's code or test no longer exists)" is false for kernel_stack_addr-names-an-offset-not-an-address. The field is still kernel_stack_addr (sdk/abi/src/boot.rs:9). The deletion is right because the rename is a stated step of issues/the-loader-does-only-what-must-precede-the-handover.md:175. Say so in the heading, not that the code is gone.
   • It is also false for os-toyos-io-traits-keep-a-posix-name. The traits still exist; they now mean something different. Its line, and the handoff's "the owner should confirm that fd: one descriptor table numbers every raw fd, and a child's descriptors are its fd:<n> endowments #978's design supersedes that ruling", give fd: one descriptor table numbers every raw fd, and a child's descriptors are its fd:<n> endowments #978's design as the authority. The authority is the owner's own later answers, and the message should cite them (details under question 2 below). With that citation, no owner question is needed for this record.

Optional

• issues/libc-munmap-refuses-part-of-a-mapping.md:57-62: dropping the "rule it final" exit is justified (question 3). The record should state the decision itself rather than cite "the owner's memory checkpoint", a local file marked "do not commit" that no reader of the tree can open. Line 27 also still calls the refusal "the ruling in … stage 4" without noting that it is revised.
• issues/libc-loses-the-kernels-word-on-two-write-paths.md:24-26: sys_write already holds an Errno (write_fd, sdk/libc/src/posix_io.rs:79-88), so its fix is set_errno(e), not errcode::of. sys_read (sdk/libc/src/stdio.rs:10-15) drops errno the same way, and no record names it.
• issues/stdio-buffering-saw-one-long-line-arrive-as-two.md:25 (classed uncertain, so unchanged) cites tests/common/console.rs as the current host capture. That file no longer exists.
• remove-dir-all-empties-a-directory-and-leaves-it: the slug's claim is now refuted but the slug is kept, because system/pkg/src/main.rs:201 cites it. That is acceptable under the README, since the work that takes the record up renames it. The doc comment the record targets also starts with an orphan fragment (main.rs:197, "How deep this walk goes. Policy on the primitive: any process can plant a"), which the same fix could remove.

The questions asked

1. Fixed and superseded deletions (all 10 read in full).

• shell-c-discards…: fixed. The reset is gone (system/shell/src/main.rs:25-29). b3770cf removed it and in the same commit added the probe the exit asked for: spawn_cwd ran shell -c "toybox pwd" from a current_dir. That probe was deleted later, in 520c0d1, under the guest-suite policy. So the exit was met when the fix landed, which is stronger than the PR's "inspection suffices."
• std-answers-every-spawn-refusal…: fixed. refused sends Refused::Syscall through to_io_error, whose match is exhaustive and has no catch-all (sdk/std/sys/pal/mod.rs:18-39, 67-80). That holds the first exit clause at the type level. The second clause can no longer arise: child_cwd makes every directory absolute before the spawn (sdk/std/sys/process.rs:226-245), so no relative or empty directory reaches SYS_SPAWN. A guest probe would establish nothing the types and this code do not. Io => Other remains, and std-maps-a-device-error… holds it.
• netstack-watches-both-pipes…: fixed. c91e72b names the record and meets both exit clauses: pipe::left_watch (kernel/src/pipe.rs:375, used at kernel/src/object/ops.rs:315-316) and the host-tested Armed (system/netstack/src/watches.rs:30-130).
• Superseded, all seven confirmed:
  • log-flush-retry-deadman-arm: the kernel's fsync no longer has a deadman, and its actuators and test are gone (80a1f1c, 9ebf080).
  • metal-device-probe…: the kernel's usb-storage driver is gone (13ed7b4), and so is the test (24aa318).
  • netstack-refused-accept…: netd and its listen.rs are gone (7967fba).
  • process-stats…: the reds came from the test's own premise, and the test is gone (4a5b228).
  • screen-diag-boot…: to_screen belonged to the kernel's i8042 health path, which left with febfd21; the test went in 8bf3fc2. no-console… now says nothing gates the diag image.
  • kernel_stack_addr… and os-toyos-io-traits…: deleting both is correct; their stated grounds are required item 2.

2. os-toyos-io-traits-keep-a-posix-name and the owner's 2026-08-19 line.

• The line. It is in 64f806d (2026-08-19), which created issues/design-debt/fd-is-libc-jargon-and-the-tree-still-speaks-it.md: "Owner ruling, 2026-08-19: "fds belong only in libc jargon."" The commit message adds: "libc is exempt whole; the toyos SDK is explicitly not." f62a644 reduced that sweep to this record.

• Does fd: one descriptor table numbers every raw fd, and a child's descriptors are its fd:<n> endowments #978 conflict with an owner decision? With the letter of the 08-19 ruling, yes; with a current owner decision, no. toyos::fd puts the descriptor table in the SDK, and std's RawFd is now a descriptor (sdk/std/os/io.rs:1-35). The owner's later answers of 2026-10-21 in claude-questions.md supersede the 08-19 ruling on exactly this point:

  • item 5: "Keep C numbering and dup2 conventions in userland, including Rust/C descriptor interoperability";
  • section M: "Rust std's C-style descriptor interoperation must use the same userland adaptation; native SDK file capabilities need not be represented by those integers";
  • item 9 (approved by Jan): "one userland descriptor-inheritance rule, honored by both libc spawning and Rust Command".

  One adaptation shared by std and libc needs a home beneath both, and fd: one descriptor table numbers every raw fd, and a child's descriptors are its fd:<n> endowments #978 put it there. The kernel handle now has its own word, AsRawHandle, which meets the intent of the 2026-09-30 exit. Renaming std's portable descriptor traits now would break the interoperability the owner asked to preserve. Keep the deletion. The record need not stay, and no owner question is needed. Only the stated authority changes (required item 2). If the orchestrator wants the stale 08-19 wording formally retired, that question is about fd: one descriptor table numbers every raw fd, and a child's descriptors are its fd:<n> endowments #978's placement, not about this record.

3. libc-munmap: justified. requirements/memory.md records "Jan accepted this direction on 2026-10-21". It includes "Whole-mapping-only unmap/replacement is not the final application contract", and the checkpoint lists this record and says the track's "refusal of partial unmaps must be revised for this direction." Ruling the refusal final would now contradict the owner, so dropping that alternative is correct. The wording is an optional item above.

4. Samples.

• All four renames. a-wait-was-registered… is accurate: the assertion is at kernel/pure/sched/watch.rs:132, and the routes are gone through aaddf38, 232f69b, febfd21, 13ed7b4 and 02366d7. loom_watch.rs does not yet assert the flag, so the new exit is still open. libc-loses…-two… is accurate (socket.rs:208, stdio.rs:17-21). std-set-times… is accurate: lstat- and server-sourced mtime at sdk/std/sys/fs.rs:140-158, 239-241, and set_times returning Ok at :958-964. logkeeper… is required item 1.
• 20 partly-stale records. All accurate except the optional points above: libc-answers-einval, libc-refuses (fdreq.rs:50-54), remove-dir-all, sharedmemory, netstack-holds (serve.rs:738-756), netstack-keeps (stream.rs:471-476; test at node/tests/streams.rs:864), soundserver (mix.rs:176-192, 765), sshserver-authorized (manifest/src/lib.rs:312-320), std-maps-device (no ErrorKind::Other dependant in system/), std-says-launch (os/process.rs:21-42, spawn.rs:277-289), smp-ap-hole, kernel-text, map-mmio (iommu_unit.rs:35, 78-79, acpi.rs:130-140), mio, no-console (build.rs:3008, panic_console/mod.rs:303, 730, 1171), libc-munmap, std-lookup-host (connection.rs:30-42, 674), one-diskserver, most-t14 and listing-home.
• 12 still-valid records, re-read and confirmed: dlsym (misc.rs:457), available_parallelism of 1, n2 pin b1fead52, the AMD watchdog's TCO-only arm, File::lock returning Ok (fs.rs:575-589), no pread or pwrite, MAX_PAGES = 32768 × 2 MiB, no IBPB, no #!, and three more.
• Nine uncertain records. Leaving them unchanged is consistent with "do not mark uncertainty as fixed". Their paths are historical (rev^:path) apart from the stdio-buffering point above.

5. Path check. For every added or modified record at fff4f5680, I extracted each repository-rooted path, and separately each backticked *.rs/.toml/.md/.c name, and compared them with git ls-tree -r of the head. Every cited path exists except:

• two rev-qualified historical paths, both confirmed with git cat-file -e: aaddf38a^:toyos-sched/loom/tests/loom_ticket.rs and 9ca7631a^:kernel/src/log_file.rs;
• tests/swapcase and tests/desktopaudiocase, cited as historical sightings, with the text saying they were deleted;
• tests/common/volumes.rs, cited as deleted;
• fork-relative paths: mio's src/sys/toyos/selector.rs, and sys/io/error/unix.rs, hermit.rs, uefi.rs and motor.rs in the rust fork. unix.rs was confirmed at a56b4057c.

6. Personal data and format. Scanning the added lines for home paths, email addresses, MAC addresses, IPv4 addresses and account names finds nothing (one hit on the word "serial" refers to a serial port). No /Users/ path remains under issues/. The four new files have valid status, kind and opened frontmatter, each keeping its predecessor's opened. The deletions follow the README's closing rule, and the owner-held no-physical-memory-fairness is untouched.

SEND BACK