dlopen: the kernel loads a library from an image and opens no path

issues/a-refused-syscall-writes-a-log-record-per-call-and-nothing-bounds-the-caller.md

@@ -9,16 +9,13 @@ opened: 2026-10-08
 A refusal the kernel answers with an error is also a kernel log record, once
 per call, at every one of these sites, and the caller chooses how often:
 
-- `sys_dlopen` (`kernel/src/syscall/vm.rs`): a path that does not open
-  (`dlopen: <path>: <error>`), a cached image whose file changed, an image
-  `elf::load_shared_lib` refuses, no virtual address space left, and a TLS
-  reference that leaves its module's segment;
-- `elf::cache_loaded_lib` (`kernel/src/elf/cache.rs`): a load that would take
-  the shared-object cache past its budget;
+- `sys_dlopen` (`kernel/src/syscall/vm.rs`): an image
+  `elf::load_shared_lib` refuses (`dlopen: <name>: <why>`), no virtual
+  address space left, and a TLS reference that leaves its module's segment;
 - a refused spawn (`kernel/src/loader/mod.rs`): every `spawn: <path>: …`
   record, one for each reason a file can be refused.
 
-`dlopen` of a missing path in a loop, or a spawn of a file that is not an
+`dlopen` of a refused image in a loop, or a spawn of a file that is not an
 executable, is a record per syscall from any program, into a log every
 program shares: `logkeeper` keeps sixteen megabytes of a boot
 (`issues/a-t14-boot-that-outlogs-its-retention-loses-its-middle-and-the-rows-whose-lines-sat-there.md`),

issues/dlopen-write-at-is-not-the-sole-writer-of-a-mapped-module.md

@@ -11,13 +11,11 @@ the module's image for the call's duration. In `load_shared_lib` that holds: the
 image is exclusively owned before it is mapped. In `sys_dlopen` it does not.
 `map_into` maps the module into the running process first, and only then does
 `resolve_dlopen_relocs` / `apply_tpoff_relocs` / `apply_dtpoff_relocs` call
-`write_at` — so a peer thread of the same process can be reading (or, for a
-`Shared` module's private window, touching) those pages while the relocation
-writes land.
+`write_at` — so a peer thread of the same process can be reading those pages
+while the relocation writes land.
 
-For an `Owned` module the writes go to freshly allocated pages the peer has no
-handle to yet, so the race is benign in practice; for a `Shared` module the
-writes go to the private `rw_alloc`, likewise not yet handed out. But the
+The writes go to the module's one freshly allocated `PageAlloc`, which the
+peer has no address of yet, so the race is benign in practice. But the
 `# Safety` contract as written is not the one the `dlopen` caller meets, so it
 cannot be the thing that makes those `unsafe` blocks sound.
 

issues/the-capability-end-state-is-twelve-answers.md

@@ -156,8 +156,10 @@ table** can still reach:
   `SYS_SHM_CREATE`, `SYS_INBOX_SETUP`;
 - **and four that reach past the process** — the whole filesystem by path
   (`SYS_OPEN`, `SYS_READDIR`, `SYS_DELETE`, `SYS_MKDIR`, `SYS_RMDIR`,
-  `SYS_RENAME`, `SYS_SYMLINK`, `SYS_READLINK`), `SYS_DLOPEN`/`SYS_DLSYM` over
-  the same paths, `SYS_SPAWN`, and `SYS_SHUTDOWN` — plus `SYS_SYSINFO`'s census.
+  `SYS_RENAME`, `SYS_SYMLINK`, `SYS_READLINK`), `SYS_SPAWN`, and
+  `SYS_SHUTDOWN` — plus `SYS_SYSINFO`'s census. `SYS_DLOPEN` was among them
+  and is not now: it loads an image the caller read through its own
+  namespace, and opens nothing by path.
 
 **Smallest decision:** the last group. **Recommendation:** keep the filesystem,
 `SYS_DLOPEN` and `SYS_SPAWN` ambient under question 2's ruling; make

issues/the-kernel-is-small-interrupts-post-and-threads-wait.md

@@ -118,12 +118,14 @@ Beside that order, each waiting on something outside it:
       are deleted.
    5. **Spawn and dlopen from an image handle.** **Exit**: a program in
       `/apps` runs having been read by userland, its faults served from the
-      image object and not the VFS. **Partly done** (#536): spawn
-      (`SpawnArgs::image`). **Left**: dlopen. `SYS_DLOPEN` opens a path the
-      kernel serves, so no library on a file server loads
-      (`issues/a-package-cannot-ship-its-own-libraries.md`). Its exit: a
-      library in `/apps` loads having been read by userland, its faults
-      served from the image object, and `SYS_DLOPEN` takes no path.
+      image object and not the VFS; and `SYS_DLOPEN` takes no path.
+      **Done**: spawn (#536, `SpawnArgs::image`), and dlopen: libc's and the
+      SDK's `dlopen` read the library through `toyos::files::read_image`
+      wherever it is served, `SYS_DLOPEN` loads it from the image handle
+      (`DlopenArgs`) under a name it opens nothing by, and the kernel's
+      cross-process library cache is deleted, each process holding its own
+      library pages (orchestrator, under the memory design, whose later
+      stages bring sharing back through memory objects).
    6. **fileserver for DATA over diskserver.** **Done** (#536). #660 cut
       its guest tests and #890 keeps them cut.
       `apps_and_home_are_one_filesystem`'s claim, `/apps` and `/home` one

issues/the-kernel-still-parses-what-userland-writes.md

@@ -46,7 +46,7 @@ artifacts this tree builds.
 
 **It has a deadline.** Nothing shipped is dynamically linked today, so the move
 is pure deletion. The day an image ships a hosted rustc, a very large shared object is
-dlopened into a kernel whose cache never evicts, and every one of those bounds
+dlopened by the kernel's loader, and every one of those bounds
 becomes load-bearing at once. Do it after the completion architecture lands and
 before that day. Independent of everything else; may run as soon as a slot frees.
 

kernel/src/arch/x86_64/paging.rs

@@ -509,7 +509,7 @@ impl AddressSpace {
         detached
     }
 
-    /// Discharges only in this address space — a caller whose mapping may be live elsewhere (e.g. `sys_dlopen`) must shoot down itself.
+    /// Discharges only in this address space — a caller whose mapping may be live elsewhere must shoot down itself.
     pub fn remap(&mut self, vaddr: UserAddr, phys: u64, prot: Prot) {
         let va = vaddr.raw();
         assert!(