Every QEMU ceiling is at most three times what its test takes; wedges end in seconds; two LAN boots ride the talking boot

issues/build/a-suites-first-run-after-the-fork-pin-moves-races-its-own-checkout.md

@@ -0,0 +1,40 @@
+---
+status: open
+kind: tooling
+opened: 2026-10-03
+---
+
+# A suite's first run after the fork pin moves races its own checkout
+
+`sysroot::fork_checkout` (`src/sysroot.rs`) moves a linked worktree's `rust/`
+to the commit the tree pins when the checkout is behind it, with
+`git checkout --detach`. The guest suite boots its tests on twelve threads and
+each reaches `fork_checkout` on its own, so the first run after a merge that
+moved the gitlink runs that checkout in every thread at once. The same unlocked
+function reds a new worktree's first run while `git worktree add` is still
+writing:
+`issues/build/a-worktrees-first-wide-run-reds-on-the-fork-checkout-it-is-still-making.md`.
+
+## Measured
+
+A worktree at `bf28c1e38` whose `rust/` stood at `c4c65e3e8` under a pin of
+`95960d6c2`, after a merge of `origin/main`: `cargo test --test toyos-build`
+exited 1 with 18 of 26 red in 177 s. Every red is one of two sentences. One is
+`git ["checkout", "--detach", "-q", "95960d6c2…"] in …/rust failed`, under
+git's `Unable to create '…/modules/rust/worktrees/rust1/index.lock': File
+exists`. The other is `…/rust is at c4c65e3e8… with uncommitted work`, from a
+thread that read the checkout's status while another thread was moving it. The
+checkout ended at the pin, and the next run of the same command did not repeat
+either.
+
+## Owner
+
+The toolchain stage of
+`issues/build/the-tooling-is-a-review-prompt-and-three-workflows.md`.
+
+## What would close it
+
+One mover: the checkout is moved under a lock every thread of the process
+takes, or once before the suite starts its workers, and
+`cargo test --test toyos-build` on a worktree whose checkout is behind its pin
+moves it and boots its tests.

issues/build/hard-lockup-bound-ms-is-read-by-nothing-but-its-own-assertion.md

@@ -0,0 +1,28 @@
+---
+status: open
+kind: tooling
+opened: 2026-09-30
+---
+
+# `toyos_tco::HARD_LOCKUP_BOUND_MS` is read by nothing but its own assertion
+
+`toyos-tco/src/lib.rs` declares `HARD_LOCKUP_BOUND_MS`,
+`hard_lockup_bound_ms(WEDGE_BOUND_MS)`, as "the one a T14 boot runs under",
+and the `const _` beside it is its one reader. Its last other reader was the
+metal profile's list of declared ceilings, which went with
+`tests/metal-profile.toml`. The T14's `hardlockup` arm no longer runs under it
+either: `metal::bound_for` arms that image with `toyos_tco::STAGED_BOUND_MS`, so its
+lockup bound is `hard_lockup_bound_ms(STAGED_BOUND_MS)`.
+
+`git grep HARD_LOCKUP_BOUND_MS -- ':!issues'` lists `toyos-tco/src/lib.rs`
+alone.
+
+## Owner
+
+`issues/hardware/the-t14-boots-toyos-unattended.md`, the track that holds the
+hard-lockup detector and its bound.
+
+## What would close it
+
+The constant and its assertion deleted, with whatever `toyos-tco`'s version
+owes for it; `hard_lockup_bound_ms`'s own test already holds the half.

issues/build/host-scale-reads-host-speed-off-boots-that-stop-at-different-markers.md

@@ -0,0 +1,44 @@
+---
+status: open
+kind: tooling
+opened: 2026-10-03
+---
+
+# `host_scale` reads host speed off boots that stop at different markers
+
+`budget_smp` (`tests/common/qemu.rs`) pays a ceiling out for a slower host by
+`host_scale`: the run's fastest boot against `REFERENCE_BOOT_MS`, 1424 ms.
+`record_boot` takes each boot's time to its own ready marker, and those differ:
+`virt_early_panic`'s and `virt_early_fault`'s is `EARLY PANIC:`, which the
+kernel prints when it panics early in bring-up; the other AArch64 boots' is
+`control registers: SCTLR_EL1=`; an x86-64 boot's is `===READY===`, after
+userland starts. The boots also run under different accelerators
+(`Profile::accel`). So the scale says which boots a run held, not how fast the
+host is: a run with an early-panic boot in it pays 1× on nearly any host. With
+the suite's width no longer multiplying a ceiling, `host_scale` and
+`oversubscription` are the only host corrections `budget_smp` makes.
+
+## Measured
+
+On the dev host, an arm64 Mac, one run after the other at `e5daa61ff`, load
+average 1.7 to 2.8:
+
+| command | the boot | its fastest boot | scale |
+|---|---|---|---|
+| `cargo test --test toyos-build -- virt_early_panic` | `Virt`, HVF, to `EARLY PANIC:` | 479 ms | 1.00× |
+| `cargo test --test toyos-build -- virt_smp` | `VirtEl2`, TCG, to `SCTLR_EL1=` | 1180 ms | 1.00× |
+| `cargo test --test toyos-build -- machine_shutdown` | x86-64, TCG, to `===READY===` | 3316 ms | 2.33× |
+
+The whole suite at `e5daa61ff`, 12 wide on the same host, read 566 ms and paid
+1.00×.
+
+## Owner
+
+`issues/build/the-tooling-is-a-review-prompt-and-three-workflows.md`, whose
+harness item keeps a piece of the harness only where it sees what reading
+cannot.
+
+## What would close it
+
+`host_scale` reads only boots of one profile that stop at one marker, or it is
+deleted with `budget_smp`'s promise of it.

issues/build/run-test-and-its-ceiling-verdict-serve-only-debugs-run.md

@@ -0,0 +1,36 @@
+---
+status: open
+kind: tooling
+opened: 2026-10-03
+---
+
+# `run_test` and its ceiling verdict serve only `--debug`'s `run`
+
+`QemuInstance::run_test`, `run_test_hooked` and `run_test_paced`
+(`tests/common/qemu.rs`), and `ceiling_verdict`, the verdict their read loop
+ends a wait on, have one caller: interactive debug mode's `run <test>`
+(`tests/toyos.rs`, `qemu.run_test(test_name, Duration::from_secs(60))`). Every
+guest test of the suite waits through `await_guest`, `drain_until` or a
+screendump wait instead. So the checks that hold `ceiling_verdict` to its arms
+(`tests/checks/qemu.rs`, and `a_stall_stays_red` in `tests/checks.rs`) and the
+`run_test` shape `driven_binaries` reads (`tests/checks.rs`) guard that one
+path.
+
+## Measured
+
+`git grep -c 'run_test(\|run_test_hooked(\|run_test_paced(' <rev> -- tests/toyos.rs tests/common`
+counts 40 lines in `tests/toyos.rs` and 34 across sixteen other `tests/common`
+modules at `06788146b^`, and one in `tests/toyos.rs`, the debug loop's, at
+`06788146b`, the commit that cut the guest suite; the five in
+`tests/common/qemu.rs` are the three functions' own.
+
+## Owner
+
+`issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md`, whose
+first cut left them that one caller.
+
+## What would close it
+
+`--debug`'s `run` reads its test through a wait the suite uses, and
+`run_test`, `run_test_hooked`, `run_test_paced`, `ceiling_verdict` and the
+checks and readers that exist for them are deleted.

issues/diagnostics/netds-lease-probe-answers-a-question-its-lines-already-answer.md

@@ -0,0 +1,36 @@
+---
+status: open
+kind: tooling
+opened: 2026-09-16
+---
+
+# netd's lease probe answers a question its own lines already answer
+
+netd's `--exit-with-lease` brings the card up and serves exactly as the
+shipping boot does for a bounded window, leaves `/log/lease.txt` on the log
+volume one durable line at a time (the bring-up's own words, every link change,
+the lease, what the driver and the MAC counted each way), and ends with
+`toyos_i219::lease::Verdict`'s code. It existed because every line netd printed
+about the same things was a console write, and on the T14 a console write
+reached no file. Every program's lines reach `/log` through its log ring now,
+and the talking boot's `lan_dhcp_lease` judge reads the lease off netd's own
+lines. What still arms the probe is `tests/lanleasecase`, the `lan_lease_report`
+metal row: a T14 flash of its own, because netd ends inside it.
+
+## Owner
+
+The I219 bring-up's author, and after it the network track.
+
+## What would close it
+
+The probe deleted: `tests/lanleasecase/system.toml`, its row and its gate in
+`src/build.rs`, the `lan_lease_report` metal row in `tests/toyos.rs` with
+`LANLEASECASE`, `lan::leased_on_metal`, `Readback::log_volume_file` and
+`tests/common/volumes.rs`, netd's `--exit-with-lease` and
+`userland/netd/src/report.rs`, `toyos-i219/src/lease.rs`'s report lines, and
+`toyos_i219::phy::Outcome`, whose tests then assert the refusal itself.
+
+An earlier form of this arm, `--exit-with-phy-outcome` on `d409139f^:tests/lanphycase`,
+ended right after the bring-up with the PHY's outcome; its codes are still
+`Verdict::NotLeased`'s, so a code read off one of its boots means what
+`toyos_i219::phy::Outcome` says.

issues/filesystem/listing-home-answers-not-found-and-its-bound-has-no-guest-test.md

@@ -0,0 +1,34 @@
+---
+status: open
+kind: defect
+opened: 2026-09-30
+---
+
+# Listing `/home` itself answers "entity not found", and the listing bound on a served directory has no guest test
+
+`readdir_bound` asserted that `read_dir("/home")` is refused once `/home` holds
+more entries than the listing bound, and it accepted any error. Before the file
+servers the refusal was the bound's; since them it is `NotFound`, whatever the
+count:
+
+```
+634-whole.log (main before #536):   [readdir]: /home refused at 32769 entries (out of memory)
+536r21-whole.log (#536's branch):   [readdir]: /home refused at 32769 entries (entity not found)
+536r21-whole.log:                   [readdir]: /home's own root is still refused (entity not found)
+```
+
+So on `main` the arm created 32,769 files through the DATA server (364 s and
+442 s of `readdir_bound` on #536's two whole runs, against 46-181 s before it)
+to reach an answer an empty `/home` gives too. The arm is deleted; what is left
+untested is the one refusal the DATA server has for a listing too large, the
+`WINDOW_BYTES` check in `userland/fsd/src/main.rs`'s `READDIR`.
+
+## Owner
+
+The storage track, which moved `/home` behind the DATA server.
+
+## What would close it
+
+`read_dir("/home")` on a machine with a DATA volume answers `/home`'s entries,
+and a guest test lists a served directory past `WINDOW_BYTES` and is refused
+with `ResourceExhausted` by name rather than by any error.

issues/filesystem/where-everything-lives.md

@@ -117,4 +117,4 @@ until that lands nothing verifies it.
 `--exit-with-lease` bench report the metal loop reads off the stick's FAT log
 volume, as it reads `/log/metal-*.bin`, and the DATA volume is not readable
 there. It goes with
-`issues/diagnostics/the-lanleasecase-boot-is-a-third-t14-flash-for-one-exit-code.md`.
+`issues/diagnostics/netds-lease-probe-answers-a-question-its-lines-already-answer.md`.

issues/hardware/netds-i219-drops-a-transmit-burst-past-its-ring.md

@@ -0,0 +1,39 @@
+---
+status: open
+kind: defect
+opened: 2026-09-29
+---
+
+# netd's I219 drops a transmit burst past its ring, and only a retransmit timeout recovers it
+
+`I219::tx` (`userland/netd/src/i219.rs`) writes a frame the driver has no
+descriptor for into a scratch buffer and drops it: smoltcp's `TxToken` cannot
+refuse. But `Device::transmit` can, by answering `None`, and then smoltcp keeps
+the bytes in the socket and sends them on a later poll. netd's `transmit`
+(`userland/netd/src/main.rs`) answers `Some` every time. `toyos_i219::TX_RING`
+is 16, so 15 frames can be in flight. Every frame after those 15 in one poll is
+lost, and TCP gets it back only when its retransmission timeout fires. For
+smoltcp 0.12 that timeout starts at 700 ms (`RTTE_INITIAL_RTT` +
+4 × `RTTE_INITIAL_DEV`).
+
+## Measured
+
+The T14 run of PR #609 at `7d2e15c0`, boot `lantalkcase`. `logd` admitted the
+host's stream at 19.141 s. At 19.180 s netd said `9 frame(s) dropped with no
+transmit descriptor free`, and `reboot` came at 19.403 s. The host's
+`stream.log` is `kernel.log`'s first 217 lines, which is 21890 bytes, and
+15 × 1460 = 21900 falls inside line 218. The run of `main` at `7e151819`
+stopped at the same 217th line, with 595 ms between the admit and the stop.
+Both windows are shorter than the first retransmit timeout. The same count appears
+on the `lanswapcase` boot: 11, 18 and 23 frames dropped.
+
+## Owner
+
+Stage 2 of `issues/hardware/the-lan-is-not-yet-production-grade.md`, a gigabit
+driver that holds.
+
+## Exit
+
+`transmit` answers `None` when no descriptor is free, and a descriptor coming
+free wakes netd's poll. A host test pushes more than `TX_RING` frames' worth
+through one poll and asserts that `tx_dropped` stays 0 and every byte leaves.