diff --git a/.claude/agents/reviewer.md b/.claude/agents/reviewer.md index 9973b91643f..a5e379a0098 100644 --- a/.claude/agents/reviewer.md +++ b/.claude/agents/reviewer.md @@ -73,7 +73,7 @@ if it meets the bar above; otherwise it is a NOTE. - **Arrivals.** A host tool outside Rust and QEMU arrives by `Command::new`, `libc::system`, `exec`, `posix_spawn`, a build script or `cc::Build`, a `.github/` `run:` step or package manager, or `sh -c`, and is declared in - `issues/build/the-build-runs-host-tools-outside-rust-and-qemu.md` and nowhere else. A BLOCKER + `issues/the-build-runs-host-tools-outside-rust-and-qemu.md` and nowhere else. A BLOCKER each: an undeclared host tool; one, like Go's `gh`, not built from C or C++ source ToyOS can one day build and run; a binary for one host OS alone; a C or C++ tool taken where a Rust tool does the job; new Python, Perl or shell of ToyOS's own. diff --git a/Cargo.toml b/Cargo.toml index 9c8e75f44c8..5e52cf5f70b 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -173,7 +173,7 @@ tar = { version = "0.4.46", default-features = false } flate2 = { version = "1", default-features = false, features = ["rust_backend"] } # Every request the build system makes, GitHub's API and the crates.io index, # where curl is a host's tool: rustls on ring, the one TLS provider the tree -# takes (`issues/design-debt/the-internet-clients-work-unchanged.md`), whose C +# takes (`issues/the-internet-clients-work-unchanged.md`), whose C # and assembly the host's `cc` compiles. ureq = { version = "3", default-features = false, features = ["rustls"] } diff --git a/bootloader/src/main.rs b/bootloader/src/main.rs index a93546df5c8..f667d65e736 100644 --- a/bootloader/src/main.rs +++ b/bootloader/src/main.rs @@ -665,7 +665,7 @@ fn start_kernel(kernel: LoadedKernel, kernel_elf_bytes: vec::Vec, cmdline: v // A `push` here would grow the vector, and growing it is the death // above. What was dropped is not reported: the page that carried // that refusal off this boot is gone with the claim, and - // `issues/panic-path/the-loaders-truncated-map-refusal-is-executed-by-nothing.md` + // `issues/the-loaders-truncated-map-refusal-is-executed-by-nothing.md` // holds what is owed. return; } diff --git a/issues/README.md b/issues/README.md index 88dd02eec2a..e8fd8c23905 100644 --- a/issues/README.md +++ b/issues/README.md @@ -1,9 +1,9 @@ # Issues -One file per issue, `issues//.md`. There is no index and no +One file per issue, `issues/.md`. There is no index and no numbering: **`ls` is the index and the frontmatter is the query.** -`ls issues/*/` lists everything. To ask a question of the set: +`ls issues/` lists everything. To ask a question of the set: ``` rg -l '^status: open' issues/ # every unheld piece of work @@ -70,19 +70,19 @@ number somebody measured, a design line the owner already drew. It does not carry a design, a stage table, a rationale or a review history: a design that is right is written as code, and one that is not yet written is not yet known. -## Areas +## Slugs -An area is a directory because it makes every cross-reference a path that resolves. Moving -an issue between areas is a `git mv`; the **slug** is its identity — unique -across every area — so `rg ` finds every pointer at it wherever it has -been put. A slug is a claim like any sentence here: one the tree has refuted is +The tracker is one directory with no subdirectories: what an issue is, is its +`kind`, and what it is about, its slug and its body. The **slug** is its +identity — unique across the tracker — so `rg ` finds every pointer at +it. A slug is a claim like any sentence here: one the tree has refuted is renamed in the commit that corrects the body, with every citation moved. ## Pointing at one -**Name the file, not the directory.** `issues/audio/null-sink-applies-one-connect.md` -is a claim something can check; `issues/audio/` is a claim that an area -exists, which says nothing about whether the entry you meant is still there. +**Name the file.** `issues/null-sink-applies-one-connect.md` is a claim +something can check; a bare `issues/` says nothing about whether the entry you +meant is still there. Never write "the entry above" or "the entry below". Position was what the numbered document had and what this directory exists to be rid of; a positional diff --git a/issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md b/issues/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md similarity index 97% rename from issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md rename to issues/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md index 1b0519288fc..61f99e88c3a 100644 --- a/issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md +++ b/issues/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md @@ -114,7 +114,7 @@ is owed; a cause is. ## What is known and what is not -- `issues/kernel/an-xhci-storm-starves-the-cpu-that-takes-it.md` carries the +- `issues/an-xhci-storm-starves-the-cpu-that-takes-it.md` carries the same shape, over the 34 s the stick was being written, on run 20's `metaldevicecase` boot at tip `f46f91eb` (`[2026-09-07 08:51:28 34.609 cpu1] irq: cpu0 total=103171 timer=10 xhci=103161 net=0 sound=0 i8042=0 dmafault=0 hda=0 tlb=0 nmi=0 spurious=0 unclaimed=0`) @@ -130,14 +130,14 @@ is owed; a cause is. inference — that a deadline which fires is a machine on which some CPU was still taking a timer interrupt — holds for the instant it fired; this record shows the 133 s before it in which none did. -- `issues/hardware/a-t14-boot-wedges-after-a-jobs-exit-and-nothing-said-why.md` +- `issues/a-t14-boot-wedges-after-a-jobs-exit-and-nothing-said-why.md` waits for a `WEDGED` record of a different shape — a `testcases-mkdir` or `-readdir` boot stopping between a job's `exit:` and the next `spawn:` — and names a 2 MiB symbol-table read of 512 SCSI READ(10) commands as the one device call in its window; run 55's tail names READ(10) transport breaks on the same stick. Whether those are one defect is unmeasured, and this record is not that file's exit condition. -- `issues/kernel/the-deadline-header-promises-any-interrupt-and-only-the-timer-entry-polls.md` +- `issues/the-deadline-header-promises-any-interrupt-and-only-the-timer-entry-polls.md` is the tree-checkable half: the module header's coverage claim is wider than the poll's one call site. diff --git a/issues/hardware/a-bar-sharing-the-scanout-page.md b/issues/a-bar-sharing-the-scanout-page.md similarity index 100% rename from issues/hardware/a-bar-sharing-the-scanout-page.md rename to issues/a-bar-sharing-the-scanout-page.md diff --git a/issues/filesystem/a-bcachefs-hole-costs-a-block-write-per-page.md b/issues/a-bcachefs-hole-costs-a-block-write-per-page.md similarity index 95% rename from issues/filesystem/a-bcachefs-hole-costs-a-block-write-per-page.md rename to issues/a-bcachefs-hole-costs-a-block-write-per-page.md index 8944c6c76a1..2880ca6f053 100644 --- a/issues/filesystem/a-bcachefs-hole-costs-a-block-write-per-page.md +++ b/issues/a-bcachefs-hole-costs-a-block-write-per-page.md @@ -31,4 +31,4 @@ same cost. hole costs one list entry rather than one write per page, and a read of it resolves to zeros without a block. That is an on-disk format change for bcachefs, which is why it is not a small one — the same wall -`issues/filesystem/a-listing-still-scans-the-whole-mount.md` ends at. +`issues/a-listing-still-scans-the-whole-mount.md` ends at. diff --git a/issues/kernel/a-bind-whose-device-left-aims-the-ladder-at-its-empty-port.md b/issues/a-bind-whose-device-left-aims-the-ladder-at-its-empty-port.md similarity index 100% rename from issues/kernel/a-bind-whose-device-left-aims-the-ladder-at-its-empty-port.md rename to issues/a-bind-whose-device-left-aims-the-ladder-at-its-empty-port.md diff --git a/issues/kernel/a-boot-paint-at-subsystems-ready-stalled-4-ms-on-the-t14.md b/issues/a-boot-paint-at-subsystems-ready-stalled-4-ms-on-the-t14.md similarity index 100% rename from issues/kernel/a-boot-paint-at-subsystems-ready-stalled-4-ms-on-the-t14.md rename to issues/a-boot-paint-at-subsystems-ready-stalled-4-ms-on-the-t14.md diff --git a/issues/design-debt/a-boot-start-refused-a-present-device-runs-without-it.md b/issues/a-boot-start-refused-a-present-device-runs-without-it.md similarity index 100% rename from issues/design-debt/a-boot-start-refused-a-present-device-runs-without-it.md rename to issues/a-boot-start-refused-a-present-device-runs-without-it.md diff --git a/issues/build/a-boot-timeout-verdict-quotes-stdio-alone-and-never-the-16550-log.md b/issues/a-boot-timeout-verdict-quotes-stdio-alone-and-never-the-16550-log.md similarity index 100% rename from issues/build/a-boot-timeout-verdict-quotes-stdio-alone-and-never-the-16550-log.md rename to issues/a-boot-timeout-verdict-quotes-stdio-alone-and-never-the-16550-log.md diff --git a/issues/hardware/a-boot-with-no-kernel-log-is-not-no-boot-complete.md b/issues/a-boot-with-no-kernel-log-is-not-no-boot-complete.md similarity index 100% rename from issues/hardware/a-boot-with-no-kernel-log-is-not-no-boot-complete.md rename to issues/a-boot-with-no-kernel-log-is-not-no-boot-complete.md diff --git a/issues/hardware/a-boots-readback-is-lost-to-one-ssh-that-times-out.md b/issues/a-boots-readback-is-lost-to-one-ssh-that-times-out.md similarity index 100% rename from issues/hardware/a-boots-readback-is-lost-to-one-ssh-that-times-out.md rename to issues/a-boots-readback-is-lost-to-one-ssh-that-times-out.md diff --git a/issues/kernel/a-bounded-post-spends-its-wake-on-a-waiter-that-then-dies.md b/issues/a-bounded-post-spends-its-wake-on-a-waiter-that-then-dies.md similarity index 100% rename from issues/kernel/a-bounded-post-spends-its-wake-on-a-waiter-that-then-dies.md rename to issues/a-bounded-post-spends-its-wake-on-a-waiter-that-then-dies.md diff --git a/issues/filesystem/a-cached-read-from-a-file-server-is-measured-only-under-tcg.md b/issues/a-cached-read-from-a-file-server-is-measured-only-under-tcg.md similarity index 100% rename from issues/filesystem/a-cached-read-from-a-file-server-is-measured-only-under-tcg.md rename to issues/a-cached-read-from-a-file-server-is-measured-only-under-tcg.md diff --git a/issues/kernel/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md b/issues/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md similarity index 96% rename from issues/kernel/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md rename to issues/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md index 03404324522..2d0a22e8b50 100644 --- a/issues/kernel/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md +++ b/issues/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md @@ -9,8 +9,8 @@ opened: 2026-09-29 libc cannot start a child: `fork` and `execvp` answer `ENOSYS`, `waitpid` `ECHILD` and `system` `-1` (`userland/libc/src/misc.rs`, `userland/libc/src/stdio.rs`), and there is no `posix_spawn`. M2 and M4 of -`issues/build/toyos-builds-itself.md` and the exit of -`issues/kernel/toyos-runs-on-arm64.md` need it. +`issues/toyos-builds-itself.md` and the exit of +`issues/toyos-runs-on-arm64.md` need it. **Constraints.** libc is built on ToyOS and never ToyOS on libc (owner, 2026-09-30: "toyos moderness and anti legacy may never be compromised because @@ -18,7 +18,7 @@ of libc. no legacy"). One mechanism (owner: "i dont want multiple mechanisms"): the `Process` handle is the only control, and the kernel grows no job object, process group, POSIX session, controlling terminal, signal, wait-any, pid-addressed call or thread. What names a child's image and working -directory is `issues/isolation/every-program-sees-only-the-files-it-was-given.md`'s. +directory is `issues/every-program-sees-only-the-files-it-was-given.md`'s. **Ruled** (owner, 2026-09-30): @@ -53,7 +53,7 @@ directory is `issues/isolation/every-program-sees-only-the-files-it-was-given.md control: the stage reverted whole, where the first two read alike. Oracle: POSIX ``'s classes. 3. **libc starts and waits for children** (blocked on - `issues/isolation/a-childs-stdio-handle-is-not-the-one-command-named.md`). + `issues/a-childs-stdio-handle-is-not-the-one-command-named.md`). libc imitates `SIGCHLD`. A C child starts with descriptors 0–2 and exactly what its file actions name, a stated departure from POSIX. `posix_spawn` and `posix_spawnp` with file actions and attributes, routed by std's @@ -62,7 +62,7 @@ directory is `issues/isolation/every-program-sees-only-the-files-it-was-given.md signal-set calls; `environ`, `setenv`, `unsetenv`; `kill` with `SIGKILL` for a child or a `-pgid` of its children, 0 as a probe, `EINVAL` for other signals until stage 6; `system`, `popen` and `pclose` through - `/system/bin/shell -c`. No `select` in this stage: `issues/build/toyos-builds-itself.md` + `/system/bin/shell -c`. No `select` in this stage: `issues/toyos-builds-itself.md` owns it. A handler for any signal libc imitates runs at once, beside the program: inside a blocking call of a thread that leaves the signal unblocked (`ppoll` and `sigsuspend` under their mask), and, while no thread is in one, @@ -107,7 +107,7 @@ directory is `issues/isolation/every-program-sees-only-the-files-it-was-given.md desktop's at boot, one per SSH connection at sshd's request. As it starts one, init hands the compositor or sshd a right to start programs in that session alone. sshd's right also quits and kills it. Its namespace is - `issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md`'s login row. + `issues/a-user-is-a-home-tree-and-a-login-row.md`'s login row. *Exit*: killing the desktop session ends every program the compositor started and leaves the compositor running; killing the compositor ends none of them; a dropped SSH connection ends its session and all under it. Negative control: diff --git a/issues/isolation/a-childs-stdio-handle-is-not-the-one-command-named.md b/issues/a-childs-stdio-handle-is-not-the-one-command-named.md similarity index 94% rename from issues/isolation/a-childs-stdio-handle-is-not-the-one-command-named.md rename to issues/a-childs-stdio-handle-is-not-the-one-command-named.md index b002a420f80..6345032b968 100644 --- a/issues/isolation/a-childs-stdio-handle-is-not-the-one-command-named.md +++ b/issues/a-childs-stdio-handle-is-not-the-one-command-named.md @@ -61,4 +61,4 @@ path both probes took. The instrument is a guest arm that hands a child a handle it must not be able to use and asserts the refusal, which is the shape `handle_kill_policy` already has for handles a process does not hold. -`handle_kill_policy` is deleted; `issues/kernel/handle-kill-policy-census-grew-one-sharedmem-on-two-nightlies.md` records the commit that restores it. +`handle_kill_policy` is deleted; `issues/handle-kill-policy-census-grew-one-sharedmem-on-two-nightlies.md` records the commit that restores it. diff --git a/issues/kernel/a-claim-spends-device-addresses-its-slot-never-gets-back.md b/issues/a-claim-spends-device-addresses-its-slot-never-gets-back.md similarity index 100% rename from issues/kernel/a-claim-spends-device-addresses-its-slot-never-gets-back.md rename to issues/a-claim-spends-device-addresses-its-slot-never-gets-back.md diff --git a/issues/kernel/a-claimed-function-can-storm-its-cpu.md b/issues/a-claimed-function-can-storm-its-cpu.md similarity index 93% rename from issues/kernel/a-claimed-function-can-storm-its-cpu.md rename to issues/a-claimed-function-can-storm-its-cpu.md index 213d20791c9..1f5ba0f3068 100644 --- a/issues/kernel/a-claimed-function-can-storm-its-cpu.md +++ b/issues/a-claimed-function-can-storm-its-cpu.md @@ -11,7 +11,7 @@ message it sends (`kernel/src/pcidev/mod.rs`, `isr`), and nothing bounds how often. Its holder programs the device through the BARs it maps, so a hostile or broken holder can make the device send messages as fast as the bus carries them, and each one is an interrupt cpu0 takes before anything else it runs. -`issues/kernel/an-xhci-storm-starves-the-cpu-that-takes-it.md` measured what +`issues/an-xhci-storm-starves-the-cpu-that-takes-it.md` measured what that does to a CPU for a kernel driver's source; a claim is the same source with its holder outside the kernel. diff --git a/issues/kernel/a-claims-own-refusals-are-read-by-nothing.md b/issues/a-claims-own-refusals-are-read-by-nothing.md similarity index 96% rename from issues/kernel/a-claims-own-refusals-are-read-by-nothing.md rename to issues/a-claims-own-refusals-are-read-by-nothing.md index 20360ec10e5..171054a1f12 100644 --- a/issues/kernel/a-claims-own-refusals-are-read-by-nothing.md +++ b/issues/a-claims-own-refusals-are-read-by-nothing.md @@ -10,7 +10,7 @@ Refusals of `kernel/src/pcidev/mod.rs` that no test reaches: - `ClaimError::Owned`, `Refusal::NoInterrupt`, `Refusal::CapsTruncated` and the domain's fault, whose guest readers the guest suite's cut moved to stage J - of `issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md`; + of `issues/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md`; - `ClaimError::Ambiguous`, a config naming a device this machine has two of; - `ClaimError::KernelDriven`, a claim on a function one of this kernel's own drivers bound; diff --git a/issues/build/a-clean-cannot-land-inside-a-build-judges-a-flat-700-ms-window.md b/issues/a-clean-cannot-land-inside-a-build-judges-a-flat-700-ms-window.md similarity index 100% rename from issues/build/a-clean-cannot-land-inside-a-build-judges-a-flat-700-ms-window.md rename to issues/a-clean-cannot-land-inside-a-build-judges-a-flat-700-ms-window.md diff --git a/issues/audio/a-client-cannot-tell-soundserver-it-paused.md b/issues/a-client-cannot-tell-soundserver-it-paused.md similarity index 97% rename from issues/audio/a-client-cannot-tell-soundserver-it-paused.md rename to issues/a-client-cannot-tell-soundserver-it-paused.md index c7dbe64816d..3e3a6f69afc 100644 --- a/issues/audio/a-client-cannot-tell-soundserver-it-paused.md +++ b/issues/a-client-cannot-tell-soundserver-it-paused.md @@ -47,5 +47,5 @@ resuming from suspend all need the same client→soundd notification, sent from cpal's `play()`. The one variant that needs no client change is filed apart, at -`issues/audio/stop-the-device-voice-keep-the-wake.md`, because it could land +`issues/stop-the-device-voice-keep-the-wake.md`, because it could land first. diff --git a/issues/design-debt/a-client-waits-on-the-compositors-answer-with-no-bound.md b/issues/a-client-waits-on-the-compositors-answer-with-no-bound.md similarity index 100% rename from issues/design-debt/a-client-waits-on-the-compositors-answer-with-no-bound.md rename to issues/a-client-waits-on-the-compositors-answer-with-no-bound.md diff --git a/issues/kernel/a-close-of-one-handle-ends-every-rings-poll-on-its-object.md b/issues/a-close-of-one-handle-ends-every-rings-poll-on-its-object.md similarity index 100% rename from issues/kernel/a-close-of-one-handle-ends-every-rings-poll-on-its-object.md rename to issues/a-close-of-one-handle-ends-every-rings-poll-on-its-object.md diff --git a/issues/build/a-compile-fail-case-names-an-error-code-rustdoc-never-reads.md b/issues/a-compile-fail-case-names-an-error-code-rustdoc-never-reads.md similarity index 94% rename from issues/build/a-compile-fail-case-names-an-error-code-rustdoc-never-reads.md rename to issues/a-compile-fail-case-names-an-error-code-rustdoc-never-reads.md index 9d35eb5caf5..25fe81f7e25 100644 --- a/issues/build/a-compile-fail-case-names-an-error-code-rustdoc-never-reads.md +++ b/issues/a-compile-fail-case-names-an-error-code-rustdoc-never-reads.md @@ -23,7 +23,7 @@ crate's doc-tests green: What does hold a case to its reason in this tree is the block beside it that compiles (`toyos-net-wire/src/lib.rs`, `mod compile_fail`). `Place`'s three have one; `DirectMapEnd`'s has none. The "compile-fail case" that Stages C and -H of `issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md` +H of `issues/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md` exit on is held the same way and no other. **Exit**: `git grep 'compile_fail,E'` finds nothing outside `rust/` and every diff --git a/issues/build/a-compiler-fixtures-git-commit-could-not-create-a-temporary-file.md b/issues/a-compiler-fixtures-git-commit-could-not-create-a-temporary-file.md similarity index 100% rename from issues/build/a-compiler-fixtures-git-commit-could-not-create-a-temporary-file.md rename to issues/a-compiler-fixtures-git-commit-could-not-create-a-temporary-file.md diff --git a/issues/build/a-compiler-key-reads-no-symbolic-link.md b/issues/a-compiler-key-reads-no-symbolic-link.md similarity index 100% rename from issues/build/a-compiler-key-reads-no-symbolic-link.md rename to issues/a-compiler-key-reads-no-symbolic-link.md diff --git a/issues/hardware/a-connect-between-two-accepts-is-reset.md b/issues/a-connect-between-two-accepts-is-reset.md similarity index 100% rename from issues/hardware/a-connect-between-two-accepts-is-reset.md rename to issues/a-connect-between-two-accepts-is-reset.md diff --git a/issues/design-debt/a-console-holders-line-state-guards-writers-that-no-longer-exist.md b/issues/a-console-holders-line-state-guards-writers-that-no-longer-exist.md similarity index 100% rename from issues/design-debt/a-console-holders-line-state-guards-writers-that-no-longer-exist.md rename to issues/a-console-holders-line-state-guards-writers-that-no-longer-exist.md diff --git a/issues/kernel/a-console-watch-waits-on-the-keyboard-not-the-serial-line.md b/issues/a-console-watch-waits-on-the-keyboard-not-the-serial-line.md similarity index 100% rename from issues/kernel/a-console-watch-waits-on-the-keyboard-not-the-serial-line.md rename to issues/a-console-watch-waits-on-the-keyboard-not-the-serial-line.md diff --git a/issues/kernel/a-controller-whose-msix-table-is-in-bar-0-cannot-be-driven-from-userland.md b/issues/a-controller-whose-msix-table-is-in-bar-0-cannot-be-driven-from-userland.md similarity index 89% rename from issues/kernel/a-controller-whose-msix-table-is-in-bar-0-cannot-be-driven-from-userland.md rename to issues/a-controller-whose-msix-table-is-in-bar-0-cannot-be-driven-from-userland.md index f35140602ce..0d1693da25f 100644 --- a/issues/kernel/a-controller-whose-msix-table-is-in-bar-0-cannot-be-driven-from-userland.md +++ b/issues/a-controller-whose-msix-table-is-in-bar-0-cannot-be-driven-from-userland.md @@ -20,12 +20,12 @@ would have no registers to drive it through`. The blockd tests boot the controller with `msix-exclusive-bar=on`, which moves the table to a BAR of its own (`tests/common/qemu.rs`, `BootOptions::userland_nvme`). Where the T14's NVMe keeps its table is not measured; it matters from the small-kernel track's -step 9 (`issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md`), +step 9 (`issues/the-kernel-is-small-interrupts-post-and-threads-wait.md`), when blockd is the only NVMe driver. **Exit condition.** A claim hands over the pages of a BAR that hold neither the table nor the PBA, at the granularity those structures need (4 KiB, which the user mappings do not have yet: -`issues/kernel/process-memory-is-2-mib-pages-and-that-caps-the-process-count.md`), +`issues/process-memory-is-2-mib-pages-and-that-caps-the-process-count.md`), and a test drives QEMU's NVMe with its table in BAR 0 through blockd while a write to the table's page is refused. diff --git a/issues/filesystem/a-corrupt-chain-met-by-a-queued-free-is-answered-by-the-next-call.md b/issues/a-corrupt-chain-met-by-a-queued-free-is-answered-by-the-next-call.md similarity index 100% rename from issues/filesystem/a-corrupt-chain-met-by-a-queued-free-is-answered-by-the-next-call.md rename to issues/a-corrupt-chain-met-by-a-queued-free-is-answered-by-the-next-call.md diff --git a/issues/kernel/a-counters-read-under-host-load-can-go-silent-for-15-s.md b/issues/a-counters-read-under-host-load-can-go-silent-for-15-s.md similarity index 100% rename from issues/kernel/a-counters-read-under-host-load-can-go-silent-for-15-s.md rename to issues/a-counters-read-under-host-load-can-go-silent-for-15-s.md diff --git a/issues/diagnostics/a-cpu-that-stops-passing-takes-the-console-with-it.md b/issues/a-cpu-that-stops-passing-takes-the-console-with-it.md similarity index 100% rename from issues/diagnostics/a-cpu-that-stops-passing-takes-the-console-with-it.md rename to issues/a-cpu-that-stops-passing-takes-the-console-with-it.md diff --git a/issues/panic-path/a-crash-report-can-name-a-syscall-that-already-ended.md b/issues/a-crash-report-can-name-a-syscall-that-already-ended.md similarity index 100% rename from issues/panic-path/a-crash-report-can-name-a-syscall-that-already-ended.md rename to issues/a-crash-report-can-name-a-syscall-that-already-ended.md diff --git a/issues/kernel/a-cut-bulk-only-command-does-not-brick-the-benchs-stick.md b/issues/a-cut-bulk-only-command-does-not-brick-the-benchs-stick.md similarity index 98% rename from issues/kernel/a-cut-bulk-only-command-does-not-brick-the-benchs-stick.md rename to issues/a-cut-bulk-only-command-does-not-brick-the-benchs-stick.md index 2b512613530..d0c55603291 100644 --- a/issues/kernel/a-cut-bulk-only-command-does-not-brick-the-benchs-stick.md +++ b/issues/a-cut-bulk-only-command-does-not-brick-the-benchs-stick.md @@ -78,7 +78,7 @@ port, halted and reset the controller and unpowered its ports, and said `no Bulk-Only command was open, so this reset cuts none`. And the device had stopped answering media commands before any of that: the boot's first READ(10) was the first thing that broke -(`issues/kernel/a-stick-that-answers-late-is-broken-by-the-two-second-abandon.md`). +(`issues/a-stick-that-answers-late-is-broken-by-the-two-second-abandon.md`). Every path a host drives ended with the device reset and inside no command, and it was still lost — so what loses it is in the device, reached before this kernel's first media command, and cleared only by taking VBUS away, which this diff --git a/issues/kernel/a-deliberate-wedge-inside-a-driver-panics-every-other-cpu-that-wants-its-lock.md b/issues/a-deliberate-wedge-inside-a-driver-panics-every-other-cpu-that-wants-its-lock.md similarity index 96% rename from issues/kernel/a-deliberate-wedge-inside-a-driver-panics-every-other-cpu-that-wants-its-lock.md rename to issues/a-deliberate-wedge-inside-a-driver-panics-every-other-cpu-that-wants-its-lock.md index 69e9c53ed4d..193e7eaebb2 100644 --- a/issues/kernel/a-deliberate-wedge-inside-a-driver-panics-every-other-cpu-that-wants-its-lock.md +++ b/issues/a-deliberate-wedge-inside-a-driver-panics-every-other-cpu-that-wants-its-lock.md @@ -38,7 +38,7 @@ Two things are true and neither is decided here: Any actuator that stops a CPU inside a driver: the `usb-wedge-*` arms, which went with `usb_reset_records_the_phase_it_cut`'s QEMU registration and come back as T14 rows in stage E of -`issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md`. +`issues/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md`. ## Exit condition diff --git a/issues/kernel/a-device-swapped-into-its-port-inside-the-port-rungs-reset-is-taken-for-the-disk-it-replaced.md b/issues/a-device-swapped-into-its-port-inside-the-port-rungs-reset-is-taken-for-the-disk-it-replaced.md similarity index 91% rename from issues/kernel/a-device-swapped-into-its-port-inside-the-port-rungs-reset-is-taken-for-the-disk-it-replaced.md rename to issues/a-device-swapped-into-its-port-inside-the-port-rungs-reset-is-taken-for-the-disk-it-replaced.md index d6d8cdfdd26..0bd196910b5 100644 --- a/issues/kernel/a-device-swapped-into-its-port-inside-the-port-rungs-reset-is-taken-for-the-disk-it-replaced.md +++ b/issues/a-device-swapped-into-its-port-inside-the-port-rungs-reset-is-taken-for-the-disk-it-replaced.md @@ -35,4 +35,4 @@ number is read again and judged by `toyos_xhci::identity::same` before the volume carries on. A `usb-reset-moves` staging that plugs another serial number into the same port refuses it by name. -`usb_transport_break` is deleted; `issues/kernel/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md` records the commit that restores it. +`usb_transport_break` is deleted; `issues/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md` records the commit that restores it. diff --git a/issues/kernel/a-device-without-a-domain-of-its-own-reaches-all-memory.md b/issues/a-device-without-a-domain-of-its-own-reaches-all-memory.md similarity index 100% rename from issues/kernel/a-device-without-a-domain-of-its-own-reaches-all-memory.md rename to issues/a-device-without-a-domain-of-its-own-reaches-all-memory.md diff --git a/issues/hardware/a-disk-plugged-in-after-boot-is-bound-inside-a-scheduling-pass.md b/issues/a-disk-plugged-in-after-boot-is-bound-inside-a-scheduling-pass.md similarity index 93% rename from issues/hardware/a-disk-plugged-in-after-boot-is-bound-inside-a-scheduling-pass.md rename to issues/a-disk-plugged-in-after-boot-is-bound-inside-a-scheduling-pass.md index f1aa91480a6..64d6e179b27 100644 --- a/issues/hardware/a-disk-plugged-in-after-boot-is-bound-inside-a-scheduling-pass.md +++ b/issues/a-disk-plugged-in-after-boot-is-bound-inside-a-scheduling-pass.md @@ -16,7 +16,7 @@ disk arriving *after* boot, which is one greppable path. **What to build**: a stepped driver for the bind over the same two machines, one act per pass, as enumeration has. Moving the bind to a thread that may block — usbd, step 10 of -`issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md` — ends +`issues/the-kernel-is-small-interrupts-post-and-threads-wait.md` — ends this file as well. After it, the pass-duration proof costs no new code: one guest gate measuring a @@ -46,5 +46,5 @@ Constraints the machine has to preserve: SuperSpeed ports read enabled the moment they are touched, so warm-reset correctness lives in the host model only. -`issues/hardware/pulling-the-boot-stick-freezes-the-t14.md` is open and is not +`issues/pulling-the-boot-stick-freezes-the-t14.md` is open and is not closed by this. diff --git a/issues/kernel/a-disk-refused-while-one-is-held-is-enumerated-again-and-no-test-reaches-that-arm.md b/issues/a-disk-refused-while-one-is-held-is-enumerated-again-and-no-test-reaches-that-arm.md similarity index 100% rename from issues/kernel/a-disk-refused-while-one-is-held-is-enumerated-again-and-no-test-reaches-that-arm.md rename to issues/a-disk-refused-while-one-is-held-is-enumerated-again-and-no-test-reaches-that-arm.md diff --git a/issues/kernel/a-disk-taken-offline-is-never-brought-back.md b/issues/a-disk-taken-offline-is-never-brought-back.md similarity index 90% rename from issues/kernel/a-disk-taken-offline-is-never-brought-back.md rename to issues/a-disk-taken-offline-is-never-brought-back.md index c1ebd2b90af..9852ee041a9 100644 --- a/issues/kernel/a-disk-taken-offline-is-never-brought-back.md +++ b/issues/a-disk-taken-offline-is-never-brought-back.md @@ -34,4 +34,4 @@ A T14 boot whose stick's transport broke mid-boot and that finishes with its mounts intact, on either half of the receptacle; and a disk that left its port under a reset and arrived on another keeps its number. -`usb_transport_break` is deleted; `issues/kernel/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md` records the commit that restores it. +`usb_transport_break` is deleted; `issues/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md` records the commit that restores it. diff --git a/issues/boot-media/a-disk-whose-port-went-away-panics-the-boot-at-roots-hold.md b/issues/a-disk-whose-port-went-away-panics-the-boot-at-roots-hold.md similarity index 90% rename from issues/boot-media/a-disk-whose-port-went-away-panics-the-boot-at-roots-hold.md rename to issues/a-disk-whose-port-went-away-panics-the-boot-at-roots-hold.md index aaea524db86..eff424d7928 100644 --- a/issues/boot-media/a-disk-whose-port-went-away-panics-the-boot-at-roots-hold.md +++ b/issues/a-disk-whose-port-went-away-panics-the-boot-at-roots-hold.md @@ -35,4 +35,4 @@ The nightlies agree: or the boot's refusal is what `usb_transport_break` expects. Either way `usb_transport_break` is green on a nightly. -`usb_transport_break` is deleted; `issues/kernel/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md` records the commit that restores it. +`usb_transport_break` is deleted; `issues/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md` records the commit that restores it. diff --git a/issues/kernel/a-dlopened-library-never-binds-to-the-executables-exports.md b/issues/a-dlopened-library-never-binds-to-the-executables-exports.md similarity index 100% rename from issues/kernel/a-dlopened-library-never-binds-to-the-executables-exports.md rename to issues/a-dlopened-library-never-binds-to-the-executables-exports.md diff --git a/issues/kernel/a-domains-addresses-are-never-given-back.md b/issues/a-domains-addresses-are-never-given-back.md similarity index 100% rename from issues/kernel/a-domains-addresses-are-never-given-back.md rename to issues/a-domains-addresses-are-never-given-back.md diff --git a/issues/kernel/a-double-fault-on-cpu-1-under-a-wide-suite.md b/issues/a-double-fault-on-cpu-1-under-a-wide-suite.md similarity index 99% rename from issues/kernel/a-double-fault-on-cpu-1-under-a-wide-suite.md rename to issues/a-double-fault-on-cpu-1-under-a-wide-suite.md index 4c4522cc9a8..42e9837b87e 100644 --- a/issues/kernel/a-double-fault-on-cpu-1-under-a-wide-suite.md +++ b/issues/a-double-fault-on-cpu-1-under-a-wide-suite.md @@ -26,7 +26,7 @@ line for that run: `fastest boot 1522 ms against the reference 1320 ms — liveness ceilings paid at 1.15x width`. The same name passed in 9 s in the full run before it and red in the full run after it on a different and already-filed defect (`writer A declared 1000 whole lines and the capture carries 798`, -`issues/build/parallel-tests-red-under-other-suites.md`), so +`issues/parallel-tests-red-under-other-suites.md`), so what this name does under load is red in more than one way. **This is the sighting the panic discriminator was closed to catch.** The diff --git a/issues/panic-path/a-double-panic-at-boots-edge-says-nothing-but-its-name.md b/issues/a-double-panic-at-boots-edge-says-nothing-but-its-name.md similarity index 100% rename from issues/panic-path/a-double-panic-at-boots-edge-says-nothing-but-its-name.md rename to issues/a-double-panic-at-boots-edge-says-nothing-but-its-name.md diff --git a/issues/kernel/a-driver-is-tested-on-the-host-and-its-real-implementation-is-one-instruction-deep.md b/issues/a-driver-is-tested-on-the-host-and-its-real-implementation-is-one-instruction-deep.md similarity index 97% rename from issues/kernel/a-driver-is-tested-on-the-host-and-its-real-implementation-is-one-instruction-deep.md rename to issues/a-driver-is-tested-on-the-host-and-its-real-implementation-is-one-instruction-deep.md index 15850d30006..39540b9205f 100644 --- a/issues/kernel/a-driver-is-tested-on-the-host-and-its-real-implementation-is-one-instruction-deep.md +++ b/issues/a-driver-is-tested-on-the-host-and-its-real-implementation-is-one-instruction-deep.md @@ -22,7 +22,7 @@ What is to be built: - **The boundary, named by function and not by chip.** A driver is written against four small traits: register access, a clock, DMA buffers, and interrupt arrival. They are generic parameters resolved at compile time - (the dispatch ruling in `issues/kernel/toyos-runs-on-arm64.md`: no trait + (the dispatch ruling in `issues/toyos-runs-on-arm64.md`: no trait objects, no `Kernel`), and they are the same three things the userland-device substrate hands a process, so a driver moved to userland keeps its tests. - **A real implementation is one instruction's worth of meaning per function** diff --git a/issues/kernel/a-driver-that-reflashes-its-device-escapes-its-isolation.md b/issues/a-driver-that-reflashes-its-device-escapes-its-isolation.md similarity index 94% rename from issues/kernel/a-driver-that-reflashes-its-device-escapes-its-isolation.md rename to issues/a-driver-that-reflashes-its-device-escapes-its-isolation.md index 2da9225428d..9137caf0b92 100644 --- a/issues/kernel/a-driver-that-reflashes-its-device-escapes-its-isolation.md +++ b/issues/a-driver-that-reflashes-its-device-escapes-its-isolation.md @@ -23,7 +23,7 @@ reading, not a measurement. reflashing is a recorded weakness with an exit (firmware verification) to design later." -Owner: the orchestrator, under `issues/kernel/the-iommu-refuses-nothing-yet.md`. +Owner: the orchestrator, under `issues/the-iommu-refuses-nothing-yet.md`. **Exit**: a design for verifying a device's firmware is put to the owner and ruled, and built; a device whose firmware fails that verification is diff --git a/issues/filesystem/a-fat-files-mtime-through-its-handle-is-its-last-level.md b/issues/a-fat-files-mtime-through-its-handle-is-its-last-level.md similarity index 100% rename from issues/filesystem/a-fat-files-mtime-through-its-handle-is-its-last-level.md rename to issues/a-fat-files-mtime-through-its-handle-is-its-last-level.md diff --git a/issues/panic-path/a-fatal-event-stands-down-both-bounds-and-may-leave-nothing-to-end-the-machine.md b/issues/a-fatal-event-stands-down-both-bounds-and-may-leave-nothing-to-end-the-machine.md similarity index 95% rename from issues/panic-path/a-fatal-event-stands-down-both-bounds-and-may-leave-nothing-to-end-the-machine.md rename to issues/a-fatal-event-stands-down-both-bounds-and-may-leave-nothing-to-end-the-machine.md index 1d1c7c8c1ae..f9fff3e413f 100644 --- a/issues/panic-path/a-fatal-event-stands-down-both-bounds-and-may-leave-nothing-to-end-the-machine.md +++ b/issues/a-fatal-event-stands-down-both-bounds-and-may-leave-nothing-to-end-the-machine.md @@ -26,7 +26,7 @@ table named none, `arm` returns `Bound::Held` which never ends. **On the T14 that last bound is the one thing already known not to work.** -`issues/hardware/an-armed-tco-has-never-reset-the-t14.md` records that no claim +`issues/an-armed-tco-has-never-reset-the-t14.md` records that no claim of this machine resetting itself has ever survived: every metal run so far has needed a hand on the power button. So a fatal kernel event on this machine disarms the two bounds that would have ended the boot and then depends on the @@ -44,7 +44,7 @@ from `deadline::expire` and `hardlockup::locked_up`) — and the stand-down is what guarantees the second one is not written. This is not -`issues/panic-path/no-console-between-boot-and-terminal.md`, which is about a +`issues/no-console-between-boot-and-terminal.md`, which is about a machine having no output channel in a window. Here the channel exists and the mechanism that would use it has been disarmed. diff --git a/issues/panic-path/a-fatal-path-entered-outside-a-panic-holds-the-panel-with-interrupts-open.md b/issues/a-fatal-path-entered-outside-a-panic-holds-the-panel-with-interrupts-open.md similarity index 100% rename from issues/panic-path/a-fatal-path-entered-outside-a-panic-holds-the-panel-with-interrupts-open.md rename to issues/a-fatal-path-entered-outside-a-panic-holds-the-panel-with-interrupts-open.md diff --git a/issues/panic-path/a-fatal-path-inside-its-own-cpus-console-burst-waits-out-the-bound.md b/issues/a-fatal-path-inside-its-own-cpus-console-burst-waits-out-the-bound.md similarity index 100% rename from issues/panic-path/a-fatal-path-inside-its-own-cpus-console-burst-waits-out-the-bound.md rename to issues/a-fatal-path-inside-its-own-cpus-console-burst-waits-out-the-bound.md diff --git a/issues/panic-path/a-fault-before-the-kernels-idt-vectors-into-the-firmwares.md b/issues/a-fault-before-the-kernels-idt-vectors-into-the-firmwares.md similarity index 100% rename from issues/panic-path/a-fault-before-the-kernels-idt-vectors-into-the-firmwares.md rename to issues/a-fault-before-the-kernels-idt-vectors-into-the-firmwares.md diff --git a/issues/filesystem/a-file-held-across-a-file-servers-restart-answers-gone.md b/issues/a-file-held-across-a-file-servers-restart-answers-gone.md similarity index 100% rename from issues/filesystem/a-file-held-across-a-file-servers-restart-answers-gone.md rename to issues/a-file-held-across-a-file-servers-restart-answers-gone.md diff --git a/issues/filesystem/a-file-on-data-is-refused-at-250-runs-while-blocks-are-free.md b/issues/a-file-on-data-is-refused-at-250-runs-while-blocks-are-free.md similarity index 100% rename from issues/filesystem/a-file-on-data-is-refused-at-250-runs-while-blocks-are-free.md rename to issues/a-file-on-data-is-refused-at-250-runs-while-blocks-are-free.md diff --git a/issues/isolation/a-file-server-can-open-every-partition-diskserver-serves.md b/issues/a-file-server-can-open-every-partition-diskserver-serves.md similarity index 100% rename from issues/isolation/a-file-server-can-open-every-partition-diskserver-serves.md rename to issues/a-file-server-can-open-every-partition-diskserver-serves.md diff --git a/issues/filesystem/a-file-server-killed-mid-sync-leaves-a-half-written-btree.md b/issues/a-file-server-killed-mid-sync-leaves-a-half-written-btree.md similarity index 100% rename from issues/filesystem/a-file-server-killed-mid-sync-leaves-a-half-written-btree.md rename to issues/a-file-server-killed-mid-sync-leaves-a-half-written-btree.md diff --git a/issues/filesystem/a-file-server-maps-a-lent-window-at-the-size-it-expects.md b/issues/a-file-server-maps-a-lent-window-at-the-size-it-expects.md similarity index 100% rename from issues/filesystem/a-file-server-maps-a-lent-window-at-the-size-it-expects.md rename to issues/a-file-server-maps-a-lent-window-at-the-size-it-expects.md diff --git a/issues/build/a-finder-file-in-a-store-directory-panics-its-sweep.md b/issues/a-finder-file-in-a-store-directory-panics-its-sweep.md similarity index 100% rename from issues/build/a-finder-file-in-a-store-directory-panics-its-sweep.md rename to issues/a-finder-file-in-a-store-directory-panics-its-sweep.md diff --git a/issues/diagnostics/a-first-dial-turned-away-before-a-line-is-waited-on-to-its-callers-bound.md b/issues/a-first-dial-turned-away-before-a-line-is-waited-on-to-its-callers-bound.md similarity index 100% rename from issues/diagnostics/a-first-dial-turned-away-before-a-line-is-waited-on-to-its-callers-bound.md rename to issues/a-first-dial-turned-away-before-a-line-is-waited-on-to-its-callers-bound.md diff --git a/issues/filesystem/a-foreign-data-partition-is-answered-with-memory.md b/issues/a-foreign-data-partition-is-answered-with-memory.md similarity index 100% rename from issues/filesystem/a-foreign-data-partition-is-answered-with-memory.md rename to issues/a-foreign-data-partition-is-answered-with-memory.md diff --git a/issues/build/a-fork-checkout-a-killed-git-worktree-add-left-is-taken-as-made.md b/issues/a-fork-checkout-a-killed-git-worktree-add-left-is-taken-as-made.md similarity index 93% rename from issues/build/a-fork-checkout-a-killed-git-worktree-add-left-is-taken-as-made.md rename to issues/a-fork-checkout-a-killed-git-worktree-add-left-is-taken-as-made.md index 533165a4474..86dafdcca1b 100644 --- a/issues/build/a-fork-checkout-a-killed-git-worktree-add-left-is-taken-as-made.md +++ b/issues/a-fork-checkout-a-killed-git-worktree-add-left-is-taken-as-made.md @@ -40,13 +40,13 @@ descriptor of the lock, `git_run` being `Command::status` and the lock file opened close-on-exec. A build that starts then finds `rust/.git`, `HEAD` at the pin and the lock free. When that git ends, the checkout has no `library/backtrace`, the state -`issues/build/the-fork-checkout-runs-git-submodule-in-a-linked-worktree.md` +`issues/the-fork-checkout-runs-git-submodule-in-a-linked-worktree.md` records of a `fork_checkout` that stopped before adding it. ## Owner The toolchain item of -`issues/build/the-tooling-is-a-review-prompt-and-three-workflows.md`, whose +`issues/the-tooling-is-a-review-prompt-and-three-workflows.md`, whose stores are published by an atomic rename. **Exit**: a build that finds a fork checkout git records as `locked` makes it diff --git a/issues/kernel/a-fresh-kernel-heap-chunk-holds-its-frames-last-owners-bytes.md b/issues/a-fresh-kernel-heap-chunk-holds-its-frames-last-owners-bytes.md similarity index 89% rename from issues/kernel/a-fresh-kernel-heap-chunk-holds-its-frames-last-owners-bytes.md rename to issues/a-fresh-kernel-heap-chunk-holds-its-frames-last-owners-bytes.md index 2143a6839ad..b260eaa69fa 100644 --- a/issues/kernel/a-fresh-kernel-heap-chunk-holds-its-frames-last-owners-bytes.md +++ b/issues/a-fresh-kernel-heap-chunk-holds-its-frames-last-owners-bytes.md @@ -17,7 +17,7 @@ wrote now leaks another process's data where it used to leak zeros. By reading, not measured: no reachable copy-out of unwritten heap memory is known. -Owner: `issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md`. +Owner: `issues/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md`. **Exit**: no byte the kernel heap hands out holds data a previous owner of its frame wrote, and the zeroing that ensures it runs under no lock another CPU diff --git a/issues/hardware/a-frozen-toyos-waits-for-a-hand-on-the-power-button.md b/issues/a-frozen-toyos-waits-for-a-hand-on-the-power-button.md similarity index 85% rename from issues/hardware/a-frozen-toyos-waits-for-a-hand-on-the-power-button.md rename to issues/a-frozen-toyos-waits-for-a-hand-on-the-power-button.md index 9aa423dd0d3..1bfa99b0691 100644 --- a/issues/hardware/a-frozen-toyos-waits-for-a-hand-on-the-power-button.md +++ b/issues/a-frozen-toyos-waits-for-a-hand-on-the-power-button.md @@ -23,7 +23,7 @@ kernel arms the chipset's TCO only on the `watchdog` parameter device class of its own: one way of doing it and not two (2026-10-03). That ruling does not settle two things, and nothing here decides them: - #592's grant covers ports below `0x100`, and the T14's TCO is at `0x400` - (`issues/hardware/an-armed-tco-has-never-reset-the-t14.md`). + (`issues/an-armed-tco-has-never-reset-the-t14.md`). - #592 refuses a claim on ports the kernel drives, and under this track the kernel still arms the timer, feeds it from the panel and disarms it. @@ -34,14 +34,14 @@ kernel arms the chipset's TCO only on the `watchdog` parameter holding the claim resets the machine. After that first claim the panel's hold is the one feed the kernel keeps. A successor's claim that meets its predecessor's release still in flight - (`issues/kernel/deferred-release-outlives-its-syscall.md`) is refused, so + (`issues/deferred-release-outlives-its-syscall.md`) is refused, so `watchdogd` waits on that defect. - A job holding `device` can mint the claim where no `watchdogd` holds it, which - `issues/isolation/every-job-test-runner-starts-holds-its-whole-system-capability.md` + `issues/every-job-test-runner-starts-holds-its-whole-system-capability.md` fences. - `watchdogd` feeds from a thread under `rt`, until - `issues/kernel/cpu-time-is-a-band-and-not-a-reservation.md` gives it a + `issues/cpu-time-is-a-band-and-not-a-reservation.md` gives it a reservation. - **Every guest runs with `-action watchdog=none`.** q35's TCO counts `QEMU_CLOCK_VIRTUAL`, which a loaded host advances while it starves a guest, @@ -50,12 +50,12 @@ kernel arms the chipset's TCO only on the `watchdog` parameter `watchdog_fed` finds not reset, are judged on the T14. - The T14's PCH TCO is its one reset that needs nothing of the kernel (no BMC, no AMT, a battery no switch cuts), and no armed TCO has reset it yet - (`issues/hardware/an-armed-tco-has-never-reset-the-t14.md`). + (`issues/an-armed-tco-has-never-reset-the-t14.md`). **Next: the detector on every boot**, at the half of `boot-deadline=` it takes today or at `toyos_tco::HARD_LOCKUP_BOUND_MS` where a boot names none. The constant then has a reader, which closes -`issues/build/hard-lockup-bound-ms-is-read-by-nothing-but-its-own-assertion.md`. +`issues/hard-lockup-bound-ms-is-read-by-nothing-but-its-own-assertion.md`. **Exit**: a host test holds the bound of a boot that names no `boot-deadline=` to `HARD_LOCKUP_BOUND_MS`, and putting the arm back behind `deadline::start` @@ -64,7 +64,7 @@ fails to build. `Armed`'s `(0, _)` arm, which nothing reaches, is gone. **Then, once loader stage 7 has taken Ubuntu**, whose `iTCO_wdt_probe` clears `SECOND_TO_STS` (Linux 6.12, `drivers/watchdog/iTCO_wdt.c:545-560`), out of the loop: **the reading**, `watchdog_resets`' metal row in -`issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md`. The +`issues/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md`. The owner's ruling (2026-10-03): one T14 boot may stop feeding the chipset's watchdog on purpose, "only if its quick i dont want tests doing nothing for a long time". So the row's wait is bounded by the watchdog's own bound and fails @@ -72,18 +72,18 @@ loudly past it, with no long idle wait. One T14 boot is armed with `watchdog` and `wedge-before-reset`, under a deadline past its job list and `toyos_tco::BOUND_MS`, which `toyos_tco::STAGED_BOUND_MS` is not. The fed control is `watchdog_fed`, once -`issues/hardware/watchdog-fed-ends-its-boot-before-the-bound-it-judges.md` +`issues/watchdog-fed-ends-its-boot-before-the-bound-it-judges.md` closes. **Exit**: the next armed kernel's `TCO2_STS` read, in `arch::watchdog`'s `arm`, says the last boot ended in a TCO reset, and the page still reads `ARMED` where the deadline would have sealed a record; the armed boot after that says no TCO reset. That closes -`issues/hardware/tco2-sts-clearing-is-verified-on-qemu-only.md`. Otherwise the +`issues/tco2-sts-clearing-is-verified-on-qemu-only.md`. Otherwise the T14 exit below waits on the TCO defect. **Last: `watchdogd` ships**, after loader stage 8 -(`issues/boot-media/the-loader-does-only-what-must-precede-the-handover.md`) +(`issues/the-loader-does-only-what-must-precede-the-handover.md`) has made the kernel's arm the only one. `toyos_tco::PARAM` goes, and with it `watchdog_quiet`, `loader_watchdog_arms`' control arm and the `testcases-watchdog` boot: the kernel arms every boot whose chipset has a diff --git a/issues/kernel/a-function-refused-under-translation-faults-read-permission-after-the-hand-over.md b/issues/a-function-refused-under-translation-faults-read-permission-after-the-hand-over.md similarity index 97% rename from issues/kernel/a-function-refused-under-translation-faults-read-permission-after-the-hand-over.md rename to issues/a-function-refused-under-translation-faults-read-permission-after-the-hand-over.md index 7750b7ff414..3069f536bae 100644 --- a/issues/kernel/a-function-refused-under-translation-faults-read-permission-after-the-hand-over.md +++ b/issues/a-function-refused-under-translation-faults-read-permission-after-the-hand-over.md @@ -65,5 +65,5 @@ reaches `Boot: complete` with no `DMA FAULT` line, through a hand-over that waits on an event the unit or the function reports. A timed hold with `TE` off does not close this: it is a flat wait no hardware document mandates, it widens the untranslated window -`issues/kernel/a-unit-left-translating-passes-dma-untranslated-while-programmed.md` +`issues/a-unit-left-translating-passes-dma-untranslated-while-programmed.md` records, and it rests on one green boot against three reds. diff --git a/issues/build/a-guest-with-no-virtio-keeps-no-serial-when-its-run-reds.md b/issues/a-guest-with-no-virtio-keeps-no-serial-when-its-run-reds.md similarity index 100% rename from issues/build/a-guest-with-no-virtio-keeps-no-serial-when-its-run-reds.md rename to issues/a-guest-with-no-virtio-keeps-no-serial-when-its-run-reds.md diff --git a/issues/hardware/a-handshake-nobody-finishes-holds-a-listeners-port-shut.md b/issues/a-handshake-nobody-finishes-holds-a-listeners-port-shut.md similarity index 87% rename from issues/hardware/a-handshake-nobody-finishes-holds-a-listeners-port-shut.md rename to issues/a-handshake-nobody-finishes-holds-a-listeners-port-shut.md index 0bd71ff9299..92dd74dbdfd 100644 --- a/issues/hardware/a-handshake-nobody-finishes-holds-a-listeners-port-shut.md +++ b/issues/a-handshake-nobody-finishes-holds-a-listeners-port-shut.md @@ -23,8 +23,8 @@ bound on a listener's half-open handshake, and the timeout smoltcp offers also bounds the connection the socket becomes, so it would have to come off at the hand-over. -**Owner**: whoever holds `issues/design-debt/toyos-has-its-own-network-stack.md`, -which carries this and `issues/hardware/a-connect-between-two-accepts-is-reset.md`. +**Owner**: whoever holds `issues/toyos-has-its-own-network-stack.md`, +which carries this and `issues/a-connect-between-two-accepts-is-reset.md`. **Exit**: a listener's half-open handshake let go within a bound, and a test that sends one SYN and nothing more, then finds the port answering the next diff --git a/issues/kernel/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md b/issues/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md similarity index 91% rename from issues/kernel/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md rename to issues/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md index a72ef1038a8..992a920c4ea 100644 --- a/issues/kernel/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md +++ b/issues/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md @@ -44,7 +44,7 @@ reboot's sync and cpu1 in a shootdown **What is still wrong**: the operation that waited answers `BudgetExpired` instead of the device's answer, and a caller that gives up on one — `logd` on a -refused create (`issues/boot-media/logkeeper-ends-the-boots-log-on-one-refused-create-and-nothing-durable-says-so.md`) +refused create (`issues/logkeeper-ends-the-boots-log-on-one-refused-create-and-nothing-durable-says-so.md`) — loses what it was doing. The retry loops above the block layer spin with `IF` clear too, so on a machine with one CPU the device binds only when the caller leaves the kernel. @@ -64,9 +64,9 @@ clear — the wait parks — or a held call's CPU may bind within its bound with making the bind the caller's cost. Either is the owner's ruling to revisit. Related records — `usb_transport_break`'s three other open red modes, not this -one: `issues/kernel/a-shutdown-on-a-held-usb-disk-left-a-cpu-deaf-to-a-tlb-shootdown.md`, -`issues/build/usb-transport-break-flushedstick-can-break-after-the-reboot.md`, and -`issues/boot-media/a-disk-whose-port-went-away-panics-the-boot-at-roots-hold.md`. +one: `issues/a-shutdown-on-a-held-usb-disk-left-a-cpu-deaf-to-a-tlb-shootdown.md`, +`issues/usb-transport-break-flushedstick-can-break-after-the-reboot.md`, and +`issues/a-disk-whose-port-went-away-panics-the-boot-at-roots-hold.md`. **Unrun since it was disabled**: PR #562 deleted this test's timing check, that the staged break's record came less than 2 s of kernel clock after the diff --git a/issues/isolation/a-held-launcher-that-will-not-open-is-a-direct-spawn.md b/issues/a-held-launcher-that-will-not-open-is-a-direct-spawn.md similarity index 100% rename from issues/isolation/a-held-launcher-that-will-not-open-is-a-direct-spawn.md rename to issues/a-held-launcher-that-will-not-open-is-a-direct-spawn.md diff --git a/issues/kernel/a-holders-queued-line-can-reach-the-console-after-the-last-word.md b/issues/a-holders-queued-line-can-reach-the-console-after-the-last-word.md similarity index 92% rename from issues/kernel/a-holders-queued-line-can-reach-the-console-after-the-last-word.md rename to issues/a-holders-queued-line-can-reach-the-console-after-the-last-word.md index 85e92355b68..4e035ace570 100644 --- a/issues/kernel/a-holders-queued-line-can-reach-the-console-after-the-last-word.md +++ b/issues/a-holders-queued-line-can-reach-the-console-after-the-last-word.md @@ -46,4 +46,4 @@ What is left of "by construction" is a stop that did not stop every holder, which it reports at alert level. A holder that still runs after the drain can queue a line that follows the last word. -`quiesce_stops_the_machine` is deleted; `issues/kernel/a-quiesce-writers-first-pass-outlasts-the-jobs-five-second-spin-up.md` records the commit that restores it. +`quiesce_stops_the_machine` is deleted; `issues/a-quiesce-writers-first-pass-outlasts-the-jobs-five-second-spin-up.md` records the commit that restores it. diff --git a/issues/build/a-hosts-apps-are-judged-on-other-hosts-runners.md b/issues/a-hosts-apps-are-judged-on-other-hosts-runners.md similarity index 95% rename from issues/build/a-hosts-apps-are-judged-on-other-hosts-runners.md rename to issues/a-hosts-apps-are-judged-on-other-hosts-runners.md index b0a0b4a42ba..cfda226705a 100644 --- a/issues/build/a-hosts-apps-are-judged-on-other-hosts-runners.md +++ b/issues/a-hosts-apps-are-judged-on-other-hosts-runners.md @@ -29,5 +29,5 @@ Owner: the host gate, `src/userlandhost.rs` and `src/ci.rs`'s `apps_for`. **Exit:** on each pull request, a runner of each host builds that host's apps, judges no other host's, and attempts each app whose `fails` names its host, red when one builds. Windows waits on -`issues/build/the-build-system-does-not-compile-on-windows.md`, macOS on a +`issues/the-build-system-does-not-compile-on-windows.md`, macOS on a macOS runner in `ci.yml`. diff --git a/issues/build/a-hung-boots-log-partition-is-wiped-by-the-next-runs-flash.md b/issues/a-hung-boots-log-partition-is-wiped-by-the-next-runs-flash.md similarity index 98% rename from issues/build/a-hung-boots-log-partition-is-wiped-by-the-next-runs-flash.md rename to issues/a-hung-boots-log-partition-is-wiped-by-the-next-runs-flash.md index 226fd2754a9..89f810409bc 100644 --- a/issues/build/a-hung-boots-log-partition-is-wiped-by-the-next-runs-flash.md +++ b/issues/a-hung-boots-log-partition-is-wiped-by-the-next-runs-flash.md @@ -58,7 +58,7 @@ wrote. Its `loader.log` is the loader's first pass alone, 105 lines ending in Black box: 0x8000000 armed at 2026-09-14-205457 for [7a, cb, db, a9, 04, 52, 10, 4a, b2, ac, 8c, 55, b4, 43, b5, 90], and the kernel is told so on its parameter line — the boot whose `WEDGED` record run 56's loader pass then printed -(`issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md`). +(`issues/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md`). So for the one hung boot whose partition was captured, the flash would have destroyed nothing `logd` wrote, because `logd` wrote nothing: that boot's ring tail carries `exit: logd pid=4 code=-1 cpu=2143ms` at 3.471 s. What the other diff --git a/issues/kernel/a-job-list-hangs-with-interrupts-on-and-the-deadline-ends-it.md b/issues/a-job-list-hangs-with-interrupts-on-and-the-deadline-ends-it.md similarity index 96% rename from issues/kernel/a-job-list-hangs-with-interrupts-on-and-the-deadline-ends-it.md rename to issues/a-job-list-hangs-with-interrupts-on-and-the-deadline-ends-it.md index 00d6871659a..357115ff5e0 100644 --- a/issues/kernel/a-job-list-hangs-with-interrupts-on-and-the-deadline-ends-it.md +++ b/issues/a-job-list-hangs-with-interrupts-on-and-the-deadline-ends-it.md @@ -34,7 +34,7 @@ next occurrence should leave a stick the driver can read. **Run 55 does not bear on this.** Its `lancase` boot ran no job list — the ring tail records `spawn: /system/bin/test-runner: ELF: fewer bytes than a file header` — and its subject is a storage transport dying -(`issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md`), +(`issues/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md`), not a job list hanging with interrupts on; this file's exit condition is still unmet. diff --git a/issues/kernel/a-jobs-exit-record-landed-under-the-boots-last-word.md b/issues/a-jobs-exit-record-landed-under-the-boots-last-word.md similarity index 86% rename from issues/kernel/a-jobs-exit-record-landed-under-the-boots-last-word.md rename to issues/a-jobs-exit-record-landed-under-the-boots-last-word.md index f3e0d20bb74..605e3484a72 100644 --- a/issues/kernel/a-jobs-exit-record-landed-under-the-boots-last-word.md +++ b/issues/a-jobs-exit-record-landed-under-the-boots-last-word.md @@ -30,4 +30,4 @@ the console once it has. A job's exit record either precedes the boot's last word or never reaches the console after it, and the test is green under a loaded host. -`quiesce_wakes_on_the_last_park` is deleted; `issues/kernel/quiesce-wakes-on-the-last-park-gave-up-on-one-thread-beside-the-held-one.md` records the commit that restores it. +`quiesce_wakes_on_the_last_park` is deleted; `issues/quiesce-wakes-on-the-last-park-gave-up-on-one-thread-beside-the-held-one.md` records the commit that restores it. diff --git a/issues/filesystem/a-kernel-files-fstat-answers-its-handles-mtime.md b/issues/a-kernel-files-fstat-answers-its-handles-mtime.md similarity index 100% rename from issues/filesystem/a-kernel-files-fstat-answers-its-handles-mtime.md rename to issues/a-kernel-files-fstat-answers-its-handles-mtime.md diff --git a/issues/kernel/a-kill-on-a-spawns-handle-before-its-child-lands-claims-nothing.md b/issues/a-kill-on-a-spawns-handle-before-its-child-lands-claims-nothing.md similarity index 100% rename from issues/kernel/a-kill-on-a-spawns-handle-before-its-child-lands-claims-nothing.md rename to issues/a-kill-on-a-spawns-handle-before-its-child-lands-claims-nothing.md diff --git a/issues/build/a-killed-keystore-writer-leaves-an-orphan-temp-in-target.md b/issues/a-killed-keystore-writer-leaves-an-orphan-temp-in-target.md similarity index 100% rename from issues/build/a-killed-keystore-writer-leaves-an-orphan-temp-in-target.md rename to issues/a-killed-keystore-writer-leaves-an-orphan-temp-in-target.md diff --git a/issues/kernel/a-known-mask-is-copied-out-of-toyos-abi-by-hand.md b/issues/a-known-mask-is-copied-out-of-toyos-abi-by-hand.md similarity index 100% rename from issues/kernel/a-known-mask-is-copied-out-of-toyos-abi-by-hand.md rename to issues/a-known-mask-is-copied-out-of-toyos-abi-by-hand.md diff --git a/issues/isolation/a-launch-too-large-for-one-frame-becomes-a-direct-spawn.md b/issues/a-launch-too-large-for-one-frame-becomes-a-direct-spawn.md similarity index 100% rename from issues/isolation/a-launch-too-large-for-one-frame-becomes-a-direct-spawn.md rename to issues/a-launch-too-large-for-one-frame-becomes-a-direct-spawn.md diff --git a/issues/design-debt/a-lease-kept-across-a-link-flap-is-not-verified-until-its-renewal.md b/issues/a-lease-kept-across-a-link-flap-is-not-verified-until-its-renewal.md similarity index 100% rename from issues/design-debt/a-lease-kept-across-a-link-flap-is-not-verified-until-its-renewal.md rename to issues/a-lease-kept-across-a-link-flap-is-not-verified-until-its-renewal.md diff --git a/issues/filesystem/a-link-on-a-kernel-mount-to-a-served-path-leads-nowhere.md b/issues/a-link-on-a-kernel-mount-to-a-served-path-leads-nowhere.md similarity index 100% rename from issues/filesystem/a-link-on-a-kernel-mount-to-a-served-path-leads-nowhere.md rename to issues/a-link-on-a-kernel-mount-to-a-served-path-leads-nowhere.md diff --git a/issues/filesystem/a-listing-still-scans-the-whole-mount.md b/issues/a-listing-still-scans-the-whole-mount.md similarity index 100% rename from issues/filesystem/a-listing-still-scans-the-whole-mount.md rename to issues/a-listing-still-scans-the-whole-mount.md diff --git a/issues/build/a-loaded-suite-reds-a-volume-checker-on-both-arms.md b/issues/a-loaded-suite-reds-a-volume-checker-on-both-arms.md similarity index 99% rename from issues/build/a-loaded-suite-reds-a-volume-checker-on-both-arms.md rename to issues/a-loaded-suite-reds-a-volume-checker-on-both-arms.md index 073a13022d0..725a1e5d79c 100644 --- a/issues/build/a-loaded-suite-reds-a-volume-checker-on-both-arms.md +++ b/issues/a-loaded-suite-reds-a-volume-checker-on-both-arms.md @@ -55,7 +55,7 @@ the box, so it was discarded. Re-take the A/B on a quiet host, six runs an arm or more, and record the rates here. If the branch arm separates, the question is which of the two mechanisms below it is; if it does not, `fat_backing_revoked` inherits -`issues/build/parallel-tests-red-under-other-suites.md`'s standing class and +`issues/parallel-tests-red-under-other-suites.md`'s standing class and this file folds into that one. The two mechanisms worth naming before anybody measures again: diff --git a/issues/kernel/a-log-inside-a-pass-wedged-four-of-twelve-guests-on-a-kernel-without-the-entry-cld.md b/issues/a-log-inside-a-pass-wedged-four-of-twelve-guests-on-a-kernel-without-the-entry-cld.md similarity index 100% rename from issues/kernel/a-log-inside-a-pass-wedged-four-of-twelve-guests-on-a-kernel-without-the-entry-cld.md rename to issues/a-log-inside-a-pass-wedged-four-of-twelve-guests-on-a-kernel-without-the-entry-cld.md diff --git a/issues/kernel/a-log-rings-owner-is-named-only-when-logkeeper-reads-its-registration.md b/issues/a-log-rings-owner-is-named-only-when-logkeeper-reads-its-registration.md similarity index 100% rename from issues/kernel/a-log-rings-owner-is-named-only-when-logkeeper-reads-its-registration.md rename to issues/a-log-rings-owner-is-named-only-when-logkeeper-reads-its-registration.md diff --git a/issues/filesystem/a-long-name-entry-whose-write-was-refused-is-on-the-volume-and-the-create-erases-nothing.md b/issues/a-long-name-entry-whose-write-was-refused-is-on-the-volume-and-the-create-erases-nothing.md similarity index 100% rename from issues/filesystem/a-long-name-entry-whose-write-was-refused-is-on-the-volume-and-the-create-erases-nothing.md rename to issues/a-long-name-entry-whose-write-was-refused-is-on-the-volume-and-the-create-erases-nothing.md diff --git a/issues/build/a-machine-tests-row-with-no-dispatch-arm-is-found-only-by-booting-it.md b/issues/a-machine-tests-row-with-no-dispatch-arm-is-found-only-by-booting-it.md similarity index 100% rename from issues/build/a-machine-tests-row-with-no-dispatch-arm-is-found-only-by-booting-it.md rename to issues/a-machine-tests-row-with-no-dispatch-arm-is-found-only-by-booting-it.md diff --git a/issues/kernel/a-machine-without-an-iommu-refuses-every-claim.md b/issues/a-machine-without-an-iommu-refuses-every-claim.md similarity index 100% rename from issues/kernel/a-machine-without-an-iommu-refuses-every-claim.md rename to issues/a-machine-without-an-iommu-refuses-every-claim.md diff --git a/issues/audio/a-megabyte-written-to-the-stick-starves-a-tone-beside-it.md b/issues/a-megabyte-written-to-the-stick-starves-a-tone-beside-it.md similarity index 100% rename from issues/audio/a-megabyte-written-to-the-stick-starves-a-tone-beside-it.md rename to issues/a-megabyte-written-to-the-stick-starves-a-tone-beside-it.md diff --git a/issues/boot-media/a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos.md b/issues/a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos.md similarity index 88% rename from issues/boot-media/a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos.md rename to issues/a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos.md index 198f227bf65..1c44b2a1639 100644 --- a/issues/boot-media/a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos.md +++ b/issues/a-memory-overwrite-request-ubuntu-left-set-stays-set-under-toyos.md @@ -7,10 +7,10 @@ opened: 2026-10-04 # A memory-overwrite request Ubuntu left set stays set under ToyOS The owner's ruling "Keep crash records" (2026-10-03, -`issues/diagnostics/toyos-explains-itself.md`) has ToyOS not ask the firmware +`issues/toyos-explains-itself.md`) has ToyOS not ask the firmware to wipe memory at reset. On the T14 the request is already made: under its Ubuntu (`6.8.0-142-generic`), whose EFI stub sets it on every boot -(`issues/boot-media/the-loader-never-sets-the-firmwares-memory-overwrite-request.md`), +(`issues/the-loader-never-sets-the-firmwares-memory-overwrite-request.md`), ``` ls /sys/firmware/efi/efivars/ | grep -i -E "MemoryOverwrite|MOR" @@ -26,7 +26,7 @@ non-volatile, so it stays set into every ToyOS boot that follows Ubuntu, and on the reset paths ToyOS takes is unmeasured: a black-box record has survived two hours of Ubuntu, which does not say what an unclean reset does. Every UEFI call ToyOS makes is the loader's, so the write belongs with -`issues/boot-media/the-loader-does-only-what-must-precede-the-handover.md`. +`issues/the-loader-does-only-what-must-precede-the-handover.md`. **Exit**: where the firmware defines `MemoryOverwriteRequestControl` and it reads non-zero, the loader writes 0 before `ExitBootServices` and logs the diff --git a/issues/build/a-metal-failure-drops-every-row-its-boot-measured.md b/issues/a-metal-failure-drops-every-row-its-boot-measured.md similarity index 100% rename from issues/build/a-metal-failure-drops-every-row-its-boot-measured.md rename to issues/a-metal-failure-drops-every-row-its-boot-measured.md diff --git a/issues/build/a-metal-judge-takes-a-names-lowest-pid-for-the-job.md b/issues/a-metal-judge-takes-a-names-lowest-pid-for-the-job.md similarity index 100% rename from issues/build/a-metal-judge-takes-a-names-lowest-pid-for-the-job.md rename to issues/a-metal-judge-takes-a-names-lowest-pid-for-the-job.md diff --git a/issues/build/a-metal-run-asks-ubuntu-which-machine-it-is-and-the-boot-says-nothing.md b/issues/a-metal-run-asks-ubuntu-which-machine-it-is-and-the-boot-says-nothing.md similarity index 100% rename from issues/build/a-metal-run-asks-ubuntu-which-machine-it-is-and-the-boot-says-nothing.md rename to issues/a-metal-run-asks-ubuntu-which-machine-it-is-and-the-boot-says-nothing.md diff --git a/issues/hardware/a-metal-session-runs-a-pre-flash-gate-first.md b/issues/a-metal-session-runs-a-pre-flash-gate-first.md similarity index 98% rename from issues/hardware/a-metal-session-runs-a-pre-flash-gate-first.md rename to issues/a-metal-session-runs-a-pre-flash-gate-first.md index c8aa3d198aa..b8e2e70189e 100644 --- a/issues/hardware/a-metal-session-runs-a-pre-flash-gate-first.md +++ b/issues/a-metal-session-runs-a-pre-flash-gate-first.md @@ -88,7 +88,7 @@ carried here too: | measurement | closes | |---|---| -| one boot with AP control-register inheritance armed against one without, same image, same session; record the delta | `issues/kernel/ap-control-registers-inherit-init.md` | +| one boot with AP control-register inheritance armed against one without, same image, same session; record the delta | `issues/ap-control-registers-inherit-init.md` | | transcribe the 16550 loopback line, and the boot's own completion time beside the last metal-sim reading of the same image | the T14 half of the console-drain question | | re-take the phase breakdown below on the boot the session flashes | whether the peripherals phase is still 73% of a metal boot | @@ -151,4 +151,4 @@ invariant at `kernel/src/drivers/panic_console/mod.rs:542`: render and everythin it calls takes no lock, so a shared static scratch strip re-creates the multi-CPU race the panic-path records carry against `capture()`. -`metal_sim_input` is deleted; `issues/build/parallel-tests-red-under-other-suites.md` records the commit that restores it. +`metal_sim_input` is deleted; `issues/parallel-tests-red-under-other-suites.md` records the commit that restores it. diff --git a/issues/build/a-metal-timing-record-never-tightens.md b/issues/a-metal-timing-record-never-tightens.md similarity index 100% rename from issues/build/a-metal-timing-record-never-tightens.md rename to issues/a-metal-timing-record-never-tightens.md diff --git a/issues/isolation/a-moved-handle-is-always-re-movable.md b/issues/a-moved-handle-is-always-re-movable.md similarity index 100% rename from issues/isolation/a-moved-handle-is-always-re-movable.md rename to issues/a-moved-handle-is-always-re-movable.md diff --git a/issues/design-debt/a-netstack-client-cannot-tell-a-reset-from-the-peers-fin.md b/issues/a-netstack-client-cannot-tell-a-reset-from-the-peers-fin.md similarity index 100% rename from issues/design-debt/a-netstack-client-cannot-tell-a-reset-from-the-peers-fin.md rename to issues/a-netstack-client-cannot-tell-a-reset-from-the-peers-fin.md diff --git a/issues/diagnostics/a-netstack-that-dies-while-serving-leaves-the-hosts-stream-silent.md b/issues/a-netstack-that-dies-while-serving-leaves-the-hosts-stream-silent.md similarity index 100% rename from issues/diagnostics/a-netstack-that-dies-while-serving-leaves-the-hosts-stream-silent.md rename to issues/a-netstack-that-dies-while-serving-leaves-the-hosts-stream-silent.md diff --git a/issues/isolation/a-new-x86-thread-enters-ring-3-holding-kernel-register-values.md b/issues/a-new-x86-thread-enters-ring-3-holding-kernel-register-values.md similarity index 100% rename from issues/isolation/a-new-x86-thread-enters-ring-3-holding-kernel-register-values.md rename to issues/a-new-x86-thread-enters-ring-3-holding-kernel-register-values.md diff --git a/issues/build/a-nightly-a-landing-overtakes-leaves-no-release-and-no-sdk-alias.md b/issues/a-nightly-a-landing-overtakes-leaves-no-release-and-no-sdk-alias.md similarity index 100% rename from issues/build/a-nightly-a-landing-overtakes-leaves-no-release-and-no-sdk-alias.md rename to issues/a-nightly-a-landing-overtakes-leaves-no-release-and-no-sdk-alias.md diff --git a/issues/filesystem/a-package-cannot-ship-its-own-libraries.md b/issues/a-package-cannot-ship-its-own-libraries.md similarity index 100% rename from issues/filesystem/a-package-cannot-ship-its-own-libraries.md rename to issues/a-package-cannot-ship-its-own-libraries.md diff --git a/issues/filesystem/a-package-is-a-directory-under-apps-and-the-installer-is-a-program.md b/issues/a-package-is-a-directory-under-apps-and-the-installer-is-a-program.md similarity index 96% rename from issues/filesystem/a-package-is-a-directory-under-apps-and-the-installer-is-a-program.md rename to issues/a-package-is-a-directory-under-apps-and-the-installer-is-a-program.md index 52abd05b77e..52b029bfcb1 100644 --- a/issues/filesystem/a-package-is-a-directory-under-apps-and-the-installer-is-a-program.md +++ b/issues/a-package-is-a-directory-under-apps-and-the-installer-is-a-program.md @@ -74,7 +74,7 @@ The storage track's users and mount-protocol stages do not block this one. 1. Landed: `pkg install `, `pkg remove`, `pkg list`. Its judge, `pkg_install_gbae`, is a metal row - `issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md` + `issues/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md` owes. **What a package holds is the image's `[apps]` row, never its own `manifest.toml`** — that file names which of the directory's binaries a launch starts and nothing else, so a writable `/apps` cannot name @@ -83,7 +83,7 @@ The storage track's users and mount-protocol stages do not block this one. (`userland/pkg/src/main.rs`). 2. The HTTPS fetch: TLS client under `pkg`, the GitHub redirect, the sums file from the same release. This is the internet-client track's last - stage (`issues/design-debt/the-internet-clients-work-unchanged.md`). Judged in QEMU against a server the harness + stage (`issues/the-internet-clients-work-unchanged.md`). Judged in QEMU against a server the harness runs on the host in Rust; then once against GitHub itself, by hand, with the owner watching. No registered test fetches anything. 3. Updates: `pkg install` of a newer version replaces the directory whole @@ -92,7 +92,7 @@ The storage track's users and mount-protocol stages do not block this one. 4. Signatures over the sums file, from a key the owner publishes with the project. 5. The users track's per-user `/home` - (`issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md`) decides + (`issues/a-user-is-a-home-tree-and-a-login-row.md`) decides where a package's own data goes. Until then nothing says where: a committed `/apps/` is written by nothing, and that directory is where a package wrote before the stage-then-commit ruling. diff --git a/issues/kernel/a-page-in-its-backing-refused-is-reported-as-a-segfault.md b/issues/a-page-in-its-backing-refused-is-reported-as-a-segfault.md similarity index 100% rename from issues/kernel/a-page-in-its-backing-refused-is-reported-as-a-segfault.md rename to issues/a-page-in-its-backing-refused-is-reported-as-a-segfault.md diff --git a/issues/panic-path/a-panic-inside-mm-init-may-not-reach-the-panel.md b/issues/a-panic-inside-mm-init-may-not-reach-the-panel.md similarity index 100% rename from issues/panic-path/a-panic-inside-mm-init-may-not-reach-the-panel.md rename to issues/a-panic-inside-mm-init-may-not-reach-the-panel.md diff --git a/issues/kernel/a-panic-is-never-an-accident.md b/issues/a-panic-is-never-an-accident.md similarity index 95% rename from issues/kernel/a-panic-is-never-an-accident.md rename to issues/a-panic-is-never-an-accident.md index 7336e8d2e97..d45da8df1f9 100644 --- a/issues/kernel/a-panic-is-never-an-accident.md +++ b/issues/a-panic-is-never-an-accident.md @@ -25,7 +25,7 @@ program is an app, `toybox`, `terminal` and the `exempt.manages` tools included. `unreachable`, `todo`, `unimplemented` and `panic_in_result_fn`; the lossy casts `cast_possible_truncation`, `cast_possible_wrap`, `cast_sign_loss` and `cast_precision_loss`, which for tiers 1 to 3 overrides their rejection in -`issues/build/clippy-stage-two-is-lints-one-at-a-time.md`; `disallowed_methods` +`issues/clippy-stage-two-is-lints-one-at-a-time.md`; `disallowed_methods` naming `slice::split_at`, `slice::split_at_mut`, `slice::copy_from_slice` and `slice::clone_from_slice`; and `disallowed_macros` naming `core::assert`, `core::assert_eq` and `core::assert_ne`. It does not see a shift by a variable @@ -52,7 +52,7 @@ amount, `pow`, `abs`, a standard function it does not name or a callee's panic. `arithmetic_side_effects` reports an expression once, however many operators it nests: `x * x + y * y - 1` is one finding, so one `#[expect]` covers its four overflows. -4. The system services, once `issues/build/userland-programs-are-never-linted.md` +4. The system services, once `issues/userland-programs-are-never-linted.md` has put userland in `src/clippy.rs`. The stage ends when every crate of this tree a service links by a normal edge, whatever its `cfg`, its own and `toyos` included, unless stage 1 already forbids the set in it, is linted diff --git a/issues/panic-path/a-panic-on-a-wedged-virtio-console-panics-again.md b/issues/a-panic-on-a-wedged-virtio-console-panics-again.md similarity index 100% rename from issues/panic-path/a-panic-on-a-wedged-virtio-console-panics-again.md rename to issues/a-panic-on-a-wedged-virtio-console-panics-again.md diff --git a/issues/panic-path/a-panic-reentry-inside-a-fatal-paths-console-hold-halts-with-it-held.md b/issues/a-panic-reentry-inside-a-fatal-paths-console-hold-halts-with-it-held.md similarity index 100% rename from issues/panic-path/a-panic-reentry-inside-a-fatal-paths-console-hold-halts-with-it-held.md rename to issues/a-panic-reentry-inside-a-fatal-paths-console-hold-halts-with-it-held.md diff --git a/issues/panic-path/a-panic-write-between-two-console-bursts-can-split-a-character.md b/issues/a-panic-write-between-two-console-bursts-can-split-a-character.md similarity index 100% rename from issues/panic-path/a-panic-write-between-two-console-bursts-can-split-a-character.md rename to issues/a-panic-write-between-two-console-bursts-can-split-a-character.md diff --git a/issues/build/a-pipe-made-on-macos-can-leak-into-a-sibling-spawn-and-red-the-tether-tests.md b/issues/a-pipe-made-on-macos-can-leak-into-a-sibling-spawn-and-red-the-tether-tests.md similarity index 100% rename from issues/build/a-pipe-made-on-macos-can-leak-into-a-sibling-spawn-and-red-the-tether-tests.md rename to issues/a-pipe-made-on-macos-can-leak-into-a-sibling-spawn-and-red-the-tether-tests.md diff --git a/issues/kernel/a-poll-registered-racing-its-own-close-outlives-the-release.md b/issues/a-poll-registered-racing-its-own-close-outlives-the-release.md similarity index 100% rename from issues/kernel/a-poll-registered-racing-its-own-close-outlives-the-release.md rename to issues/a-poll-registered-racing-its-own-close-outlives-the-release.md diff --git a/issues/kernel/a-poll-that-leaves-a-port-outstanding-with-no-wake-says-nothing.md b/issues/a-poll-that-leaves-a-port-outstanding-with-no-wake-says-nothing.md similarity index 100% rename from issues/kernel/a-poll-that-leaves-a-port-outstanding-with-no-wake-says-nothing.md rename to issues/a-poll-that-leaves-a-port-outstanding-with-no-wake-says-nothing.md diff --git a/issues/kernel/a-process-faulting-in-128-gib-panics-the-kernel.md b/issues/a-process-faulting-in-128-gib-panics-the-kernel.md similarity index 100% rename from issues/kernel/a-process-faulting-in-128-gib-panics-the-kernel.md rename to issues/a-process-faulting-in-128-gib-panics-the-kernel.md diff --git a/issues/kernel/a-process-lengthens-an-interrupts-off-walk-by-the-threads-it-parks-on-one-ring.md b/issues/a-process-lengthens-an-interrupts-off-walk-by-the-threads-it-parks-on-one-ring.md similarity index 90% rename from issues/kernel/a-process-lengthens-an-interrupts-off-walk-by-the-threads-it-parks-on-one-ring.md rename to issues/a-process-lengthens-an-interrupts-off-walk-by-the-threads-it-parks-on-one-ring.md index 8e4395730d2..e788e40d0d3 100644 --- a/issues/kernel/a-process-lengthens-an-interrupts-off-walk-by-the-threads-it-parks-on-one-ring.md +++ b/issues/a-process-lengthens-an-interrupts-off-walk-by-the-threads-it-parks-on-one-ring.md @@ -7,7 +7,7 @@ opened: 2026-09-30 # A process lengthens an interrupts-off walk by the threads it parks on one ring Held by the small-kernel track's stage 6 step 2 -(`issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md`), +(`issues/the-kernel-is-small-interrupts-post-and-threads-wait.md`), whose instrument is the only thing that can read it. Every poll ring's own watch sits behind an `IrqLock` @@ -33,7 +33,7 @@ holder, decides how long a CPU runs with interrupts masked: Nothing caps N: a thread costs its process a 128 KiB kernel stack (`kernel/src/process.rs`) and no count. The first walk starts in `SYS_INBOX_SUBMIT`, and a syscall runs with interrupts masked from entry to -exit (`issues/kernel/syscall-preemption-is-incidental.md`), with #634 and +exit (`issues/syscall-preemption-is-incidental.md`), with #634 and without it: #634 did not mask it, and reverting #634 does not shorten it. The second runs in the device's handler since #634. @@ -45,7 +45,7 @@ span, and `649-r5/3-idle-halt-counted`) ran it with N = 256 spans the runner's spawn of the herd as well. The longest `irqs_off_ns` on any CPU there is 1032292 (`windowscase/kernel.log:428`), 2 × 519358 (`:426`) and 1175943 (`:430`). The third is cpu7's, the CPU that spawned the herd -(`issues/kernel/the-cpu-that-spawns-a-toybox-applet-reads-1-4-ms-of-interrupts-and-preemption-off-on-the-t14.md`), +(`issues/the-cpu-that-spawns-a-toybox-applet-reads-1-4-ms-of-interrupts-and-preemption-off-on-the-t14.md`), and the other seven read 257646 to 364953 in that boot. The three at `0aa8d4c88` (comment 5960575031, readbacks `649-r6/1-head`, @@ -58,9 +58,9 @@ mutated kernels) read the same report of the same load at 1980239 - 2 × 5075290 is one of eight: every CPU reads 2 × 5014552 to 2 × 5075290 (`:416` to `:430`), beside `tlb: shootdowns=282 wait=131633us max=10038us` (`:431`). It is a log write's all-CPU shape - (`issues/hardware/xhci-waits-are-spins.md`) by reading. + (`issues/xhci-waits-are-spins.md`) by reading. - 4725822 is cpu0's, a firmware step's length by reading - (`issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md`). + (`issues/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md`). The other seven read 544283 to 1018355. So one size reads 1.03 to 1.98 ms in the four of those reports none of the diff --git a/issues/kernel/a-process-name-is-written-into-the-kernels-own-records-unsanitised.md b/issues/a-process-name-is-written-into-the-kernels-own-records-unsanitised.md similarity index 100% rename from issues/kernel/a-process-name-is-written-into-the-kernels-own-records-unsanitised.md rename to issues/a-process-name-is-written-into-the-kernels-own-records-unsanitised.md diff --git a/issues/kernel/a-process-that-starts-four-billion-threads-panics-the-kernel.md b/issues/a-process-that-starts-four-billion-threads-panics-the-kernel.md similarity index 100% rename from issues/kernel/a-process-that-starts-four-billion-threads-panics-the-kernel.md rename to issues/a-process-that-starts-four-billion-threads-panics-the-kernel.md diff --git a/issues/kernel/a-processs-memory-is-a-byte-total-that-reads-zero-under-contention.md b/issues/a-processs-memory-is-a-byte-total-that-reads-zero-under-contention.md similarity index 95% rename from issues/kernel/a-processs-memory-is-a-byte-total-that-reads-zero-under-contention.md rename to issues/a-processs-memory-is-a-byte-total-that-reads-zero-under-contention.md index 98b0df1fd99..37b7c2648f8 100644 --- a/issues/kernel/a-processs-memory-is-a-byte-total-that-reads-zero-under-contention.md +++ b/issues/a-processs-memory-is-a-byte-total-that-reads-zero-under-contention.md @@ -6,7 +6,7 @@ opened: 2026-09-01 # A process's memory is a byte total that reads zero under contention, so no plateau can be trusted -`issues/build/std-leaks-a-thread-stack-per-spawn.md` is the immediate consumer: +`issues/std-leaks-a-thread-stack-per-spawn.md` is the immediate consumer: ToyOS std allocates a 2 MiB stack per spawn and `join` performs the join syscall and nothing else. Deciding whether the mapping and its frames come back means reading a *plateau* — a sequence that climbs and returns — and that is what this @@ -51,7 +51,7 @@ silent zero. Then bounded spawn/join plateaus driven through the real std path. not retain the objects it counts. Both are proved by comparing its total against a quiescent page-table and PMM walk at the start and at the end. -Accounting is a pillar of `issues/diagnostics/toyos-explains-itself.md`. +Accounting is a pillar of `issues/toyos-explains-itself.md`. **Half the defect is not the joined half.** A `JoinHandle` dropped without `join` detaches, and the record's exit condition currently closes only the joined path. diff --git a/issues/diagnostics/a-processs-syscall-profile-is-one-threads.md b/issues/a-processs-syscall-profile-is-one-threads.md similarity index 100% rename from issues/diagnostics/a-processs-syscall-profile-is-one-threads.md rename to issues/a-processs-syscall-profile-is-one-threads.md diff --git a/issues/isolation/a-program-run-from-tmp-pages-in-code-any-process-can-rewrite.md b/issues/a-program-run-from-tmp-pages-in-code-any-process-can-rewrite.md similarity index 91% rename from issues/isolation/a-program-run-from-tmp-pages-in-code-any-process-can-rewrite.md rename to issues/a-program-run-from-tmp-pages-in-code-any-process-can-rewrite.md index 533fb5cddee..0968e7b63d0 100644 --- a/issues/isolation/a-program-run-from-tmp-pages-in-code-any-process-can-rewrite.md +++ b/issues/a-program-run-from-tmp-pages-in-code-any-process-can-rewrite.md @@ -16,7 +16,7 @@ every window of the running program not yet faulted in, its code included. `/tmp` is writable by every process, so the writer need not be the spawner: one program changes another's code. `SharedImage` (`kernel/src/file_backing.rs`) has the same shape on the image route and is bounded there by who can write: the -object is the spawner's own. `issues/isolation/a-swapped-binary-lives-where-any-process-can-rewrite-it.md` +object is the spawner's own. `issues/a-swapped-binary-lives-where-any-process-can-rewrite-it.md` is this defect for the swap's installed binaries. By reading, unmeasured. diff --git a/issues/design-debt/a-programs-two-streams-map-its-one-ring-twice.md b/issues/a-programs-two-streams-map-its-one-ring-twice.md similarity index 92% rename from issues/design-debt/a-programs-two-streams-map-its-one-ring-twice.md rename to issues/a-programs-two-streams-map-its-one-ring-twice.md index 393ccf362e0..b58be1707f2 100644 --- a/issues/design-debt/a-programs-two-streams-map-its-one-ring-twice.md +++ b/issues/a-programs-two-streams-map-its-one-ring-twice.md @@ -11,7 +11,7 @@ and 2, and `toyos/src/log/stdio.rs`'s `ask` takes each stream on its own: it duplicates the slot's handle and maps the region, once for stdout and once for stderr. So every program holds two handles and two 2 MiB mappings of the same ring, within one instance of the SDK — before the second instance -`issues/design-debt/a-rust-program-holds-two-copies-of-its-stream-state.md` +`issues/a-rust-program-holds-two-copies-of-its-stream-state.md` counts. Nothing a program can ask today tells it that two slots name one object, which diff --git a/issues/isolation/a-provided-name-cannot-reach-an-undeclared-child.md b/issues/a-provided-name-cannot-reach-an-undeclared-child.md similarity index 100% rename from issues/isolation/a-provided-name-cannot-reach-an-undeclared-child.md rename to issues/a-provided-name-cannot-reach-an-undeclared-child.md diff --git a/issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md b/issues/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md similarity index 88% rename from issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md rename to issues/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md index 35182bbddb9..cf5e78e241e 100644 --- a/issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md +++ b/issues/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md @@ -12,7 +12,7 @@ selects, built by the kernel and by a host test. Pull request #602 holds it. **Exit**: each committed fixture's facts give its lines: the T14's and the TCG model's from -`issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md`, +`issues/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md`, and each EPYC guest's once its runner is captured. **Mutation**: `GDS` deleted from `cpu_vuln_blacklist`'s TIGERLAKE_L row reds the T14's fixture, and `SRSO` deleted from its family 0x19 row reds a family-0x19 EPYC guest's. diff --git a/issues/kernel/a-quiesce-writers-first-pass-outlasts-the-jobs-five-second-spin-up.md b/issues/a-quiesce-writers-first-pass-outlasts-the-jobs-five-second-spin-up.md similarity index 97% rename from issues/kernel/a-quiesce-writers-first-pass-outlasts-the-jobs-five-second-spin-up.md rename to issues/a-quiesce-writers-first-pass-outlasts-the-jobs-five-second-spin-up.md index 7aeaa60eb05..104484384f7 100644 --- a/issues/kernel/a-quiesce-writers-first-pass-outlasts-the-jobs-five-second-spin-up.md +++ b/issues/a-quiesce-writers-first-pass-outlasts-the-jobs-five-second-spin-up.md @@ -9,7 +9,7 @@ opened: 2026-09-25 It asks for the reset only once each of its six writers has finished one pass: a create, 64 KiB of writes and an fsync. Every sighting below then reads `QEMU never reported stopping: the guest asked for a reboot and stayed up`; that misreport is -`issues/build/a-stopped-boot-whose-job-never-asked-waits-out-the-reset-budget-and-says-it-asked.md`. +`issues/a-stopped-boot-whose-job-never-asked-waits-out-the-reset-budget-and-says-it-asked.md`. `quiesce_dump_holds_the_stopped`, in the fast tier on the logd branch (PR #492), dev host: red wide with `QEMU never reported stopping: the guest diff --git a/issues/filesystem/a-read-or-write-answered-lost-is-never-answered.md b/issues/a-read-or-write-answered-lost-is-never-answered.md similarity index 100% rename from issues/filesystem/a-read-or-write-answered-lost-is-never-answered.md rename to issues/a-read-or-write-answered-lost-is-never-answered.md diff --git a/issues/diagnostics/a-reader-that-never-reads-holds-its-slot-until-its-buffers-fill.md b/issues/a-reader-that-never-reads-holds-its-slot-until-its-buffers-fill.md similarity index 100% rename from issues/diagnostics/a-reader-that-never-reads-holds-its-slot-until-its-buffers-fill.md rename to issues/a-reader-that-never-reads-holds-its-slot-until-its-buffers-fill.md diff --git a/issues/build/a-ready-marker-read-off-the-16550-file-can-end-the-boot-wait-mid-line.md b/issues/a-ready-marker-read-off-the-16550-file-can-end-the-boot-wait-mid-line.md similarity index 100% rename from issues/build/a-ready-marker-read-off-the-16550-file-can-end-the-boot-wait-mid-line.md rename to issues/a-ready-marker-read-off-the-16550-file-can-end-the-boot-wait-mid-line.md diff --git a/issues/filesystem/a-reallocated-extent-on-data-keeps-the-deleted-files-bytes.md b/issues/a-reallocated-extent-on-data-keeps-the-deleted-files-bytes.md similarity index 100% rename from issues/filesystem/a-reallocated-extent-on-data-keeps-the-deleted-files-bytes.md rename to issues/a-reallocated-extent-on-data-keeps-the-deleted-files-bytes.md diff --git a/issues/isolation/a-received-handle-has-no-knowable-type.md b/issues/a-received-handle-has-no-knowable-type.md similarity index 96% rename from issues/isolation/a-received-handle-has-no-knowable-type.md rename to issues/a-received-handle-has-no-knowable-type.md index cbc4cf93183..6859121aa5f 100644 --- a/issues/isolation/a-received-handle-has-no-knowable-type.md +++ b/issues/a-received-handle-has-no-knowable-type.md @@ -69,4 +69,4 @@ the next reader will ask why a class this wide was left open. So it stays open, and what it is waiting on is a decision rather than an instrument. -`launcher_refusals` is deleted; `issues/build/parallel-tests-red-under-other-suites.md` records the commit that restores it. +`launcher_refusals` is deleted; `issues/parallel-tests-red-under-other-suites.md` records the commit that restores it. diff --git a/issues/diagnostics/a-record-cannot-name-thread-zero.md b/issues/a-record-cannot-name-thread-zero.md similarity index 100% rename from issues/diagnostics/a-record-cannot-name-thread-zero.md rename to issues/a-record-cannot-name-thread-zero.md diff --git a/issues/filesystem/a-refused-delete-has-already-thrown-the-file-away.md b/issues/a-refused-delete-has-already-thrown-the-file-away.md similarity index 100% rename from issues/filesystem/a-refused-delete-has-already-thrown-the-file-away.md rename to issues/a-refused-delete-has-already-thrown-the-file-away.md diff --git a/issues/diagnostics/a-refused-framebuffer-reads-as-no-display.md b/issues/a-refused-framebuffer-reads-as-no-display.md similarity index 100% rename from issues/diagnostics/a-refused-framebuffer-reads-as-no-display.md rename to issues/a-refused-framebuffer-reads-as-no-display.md diff --git a/issues/isolation/a-refused-handle-move-leaves-the-compositor-holding-it.md b/issues/a-refused-handle-move-leaves-the-compositor-holding-it.md similarity index 100% rename from issues/isolation/a-refused-handle-move-leaves-the-compositor-holding-it.md rename to issues/a-refused-handle-move-leaves-the-compositor-holding-it.md diff --git a/issues/build/a-release-that-decides-before-its-tips-crates-are-up-reds-the-nightly.md b/issues/a-release-that-decides-before-its-tips-crates-are-up-reds-the-nightly.md similarity index 100% rename from issues/build/a-release-that-decides-before-its-tips-crates-are-up-reds-the-nightly.md rename to issues/a-release-that-decides-before-its-tips-crates-are-up-reds-the-nightly.md diff --git a/issues/kernel/a-released-function-still-names-its-slots-domain.md b/issues/a-released-function-still-names-its-slots-domain.md similarity index 100% rename from issues/kernel/a-released-function-still-names-its-slots-domain.md rename to issues/a-released-function-still-names-its-slots-domain.md diff --git a/issues/filesystem/a-rename-that-stops-between-its-writes-leaves-a-chain-two-entries-reach.md b/issues/a-rename-that-stops-between-its-writes-leaves-a-chain-two-entries-reach.md similarity index 100% rename from issues/filesystem/a-rename-that-stops-between-its-writes-leaves-a-chain-two-entries-reach.md rename to issues/a-rename-that-stops-between-its-writes-leaves-a-chain-two-entries-reach.md diff --git a/issues/filesystem/a-renamed-services-state-stays-under-its-old-name-unread.md b/issues/a-renamed-services-state-stays-under-its-old-name-unread.md similarity index 95% rename from issues/filesystem/a-renamed-services-state-stays-under-its-old-name-unread.md rename to issues/a-renamed-services-state-stays-under-its-old-name-unread.md index 136844db04c..e9e0e28eeeb 100644 --- a/issues/filesystem/a-renamed-services-state-stays-under-its-old-name-unread.md +++ b/issues/a-renamed-services-state-stays-under-its-old-name-unread.md @@ -9,7 +9,7 @@ opened: 2026-10-03 The supervisor starts a service with `HOME` at `/state/` (`toyos-manifest`'s `home`), so a service's state is keyed by its program's name and a rename orphans it with nothing said. Stage 1 of -`issues/isolation/the-supervisor-is-host-tested-and-owns-the-stop.md` renamed +`issues/the-supervisor-is-host-tested-and-owns-the-stop.md` renamed five services, and a DATA volume that outlives that change: - keeps `/state/logd`, `/state/soundd`, `/state/netd`, `/state/sshd` and diff --git a/issues/hardware/a-replacement-netstack-reuses-its-predecessors-ports.md b/issues/a-replacement-netstack-reuses-its-predecessors-ports.md similarity index 100% rename from issues/hardware/a-replacement-netstack-reuses-its-predecessors-ports.md rename to issues/a-replacement-netstack-reuses-its-predecessors-ports.md diff --git a/issues/isolation/a-reset-stops-xhci-and-leaves-every-claimed-pci-function-armed.md b/issues/a-reset-stops-xhci-and-leaves-every-claimed-pci-function-armed.md similarity index 98% rename from issues/isolation/a-reset-stops-xhci-and-leaves-every-claimed-pci-function-armed.md rename to issues/a-reset-stops-xhci-and-leaves-every-claimed-pci-function-armed.md index c21224f5bfd..df7628e42e6 100644 --- a/issues/isolation/a-reset-stops-xhci-and-leaves-every-claimed-pci-function-armed.md +++ b/issues/a-reset-stops-xhci-and-leaves-every-claimed-pci-function-armed.md @@ -56,7 +56,7 @@ ended by `deadline::expire` → `reset_now` — is a path `quiesce` never runs o and on that boot the function had already been released: the sealed tail reads `exit: netd pid=5 code=-1 cpu=22ms` and then `pcidev: PCI 00:1f.6 [8086:15fc] released from slot 0` at 3.479 s -(`issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md`). +(`issues/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md`). So the I219 went into that reset torn down — by the `Drop` a dying process reaches and a live one does not. diff --git a/issues/kernel/a-residue-slot-is-held-for-the-boot-by-a-function-never-claimed-again.md b/issues/a-residue-slot-is-held-for-the-boot-by-a-function-never-claimed-again.md similarity index 100% rename from issues/kernel/a-residue-slot-is-held-for-the-boot-by-a-function-never-claimed-again.md rename to issues/a-residue-slot-is-held-for-the-boot-by-a-function-never-claimed-again.md diff --git a/issues/isolation/a-ring-handed-to-another-process-resolves-its-watches-in-the-receivers-table.md b/issues/a-ring-handed-to-another-process-resolves-its-watches-in-the-receivers-table.md similarity index 100% rename from issues/isolation/a-ring-handed-to-another-process-resolves-its-watches-in-the-receivers-table.md rename to issues/a-ring-handed-to-another-process-resolves-its-watches-in-the-receivers-table.md diff --git a/issues/build/a-runner-image-that-moves-cc-or-cmake-makes-every-toolchain-job-cold.md b/issues/a-runner-image-that-moves-cc-or-cmake-makes-every-toolchain-job-cold.md similarity index 100% rename from issues/build/a-runner-image-that-moves-cc-or-cmake-makes-every-toolchain-job-cold.md rename to issues/a-runner-image-that-moves-cc-or-cmake-makes-every-toolchain-job-cold.md diff --git a/issues/design-debt/a-rust-program-holds-two-copies-of-its-stream-state.md b/issues/a-rust-program-holds-two-copies-of-its-stream-state.md similarity index 100% rename from issues/design-debt/a-rust-program-holds-two-copies-of-its-stream-state.md rename to issues/a-rust-program-holds-two-copies-of-its-stream-state.md diff --git a/issues/build/a-rust-std-binary-cannot-link-the-cxx-runtime.md b/issues/a-rust-std-binary-cannot-link-the-cxx-runtime.md similarity index 100% rename from issues/build/a-rust-std-binary-cannot-link-the-cxx-runtime.md rename to issues/a-rust-std-binary-cannot-link-the-cxx-runtime.md diff --git a/issues/build/a-rust-std-executable-runs-no-init-array-so-a-linked-c-constructor-is-skipped.md b/issues/a-rust-std-executable-runs-no-init-array-so-a-linked-c-constructor-is-skipped.md similarity index 100% rename from issues/build/a-rust-std-executable-runs-no-init-array-so-a-linked-c-constructor-is-skipped.md rename to issues/a-rust-std-executable-runs-no-init-array-so-a-linked-c-constructor-is-skipped.md diff --git a/issues/kernel/a-safe-mmio-window-reaches-any-physical-address.md b/issues/a-safe-mmio-window-reaches-any-physical-address.md similarity index 100% rename from issues/kernel/a-safe-mmio-window-reaches-any-physical-address.md rename to issues/a-safe-mmio-window-reaches-any-physical-address.md diff --git a/issues/kernel/a-safe-port-read-reaches-any-io-port.md b/issues/a-safe-port-read-reaches-any-io-port.md similarity index 100% rename from issues/kernel/a-safe-port-read-reaches-any-io-port.md rename to issues/a-safe-port-read-reaches-any-io-port.md diff --git a/issues/isolation/a-second-launch-of-a-serves-program-panics-the-supervisor.md b/issues/a-second-launch-of-a-serves-program-panics-the-supervisor.md similarity index 100% rename from issues/isolation/a-second-launch-of-a-serves-program-panics-the-supervisor.md rename to issues/a-second-launch-of-a-serves-program-panics-the-supervisor.md diff --git a/issues/filesystem/a-served-directory-costs-each-process-a-two-mebibyte-window.md b/issues/a-served-directory-costs-each-process-a-two-mebibyte-window.md similarity index 100% rename from issues/filesystem/a-served-directory-costs-each-process-a-two-mebibyte-window.md rename to issues/a-served-directory-costs-each-process-a-two-mebibyte-window.md diff --git a/issues/filesystem/a-served-file-panics-when-asked-its-raw-fd.md b/issues/a-served-file-panics-when-asked-its-raw-fd.md similarity index 100% rename from issues/filesystem/a-served-file-panics-when-asked-its-raw-fd.md rename to issues/a-served-file-panics-when-asked-its-raw-fd.md diff --git a/issues/build/a-settled-thread-join-taking-the-table-lock-again-is-gated-by-nothing.md b/issues/a-settled-thread-join-taking-the-table-lock-again-is-gated-by-nothing.md similarity index 100% rename from issues/build/a-settled-thread-join-taking-the-table-lock-again-is-gated-by-nothing.md rename to issues/a-settled-thread-join-taking-the-table-lock-again-is-gated-by-nothing.md diff --git a/issues/kernel/a-shared-boot-stopped-answering-and-no-capture-says-why.md b/issues/a-shared-boot-stopped-answering-and-no-capture-says-why.md similarity index 98% rename from issues/kernel/a-shared-boot-stopped-answering-and-no-capture-says-why.md rename to issues/a-shared-boot-stopped-answering-and-no-capture-says-why.md index a4b19b06224..f3e2025dbe8 100644 --- a/issues/kernel/a-shared-boot-stopped-answering-and-no-capture-says-why.md +++ b/issues/a-shared-boot-stopped-answering-and-no-capture-says-why.md @@ -46,7 +46,7 @@ shared boot waiting for its next command is parked at almost every sample. `SYS_THREAD_JOIN` whose wake was lost: it parks on the target thread's own watch at `Deadline::never()` (`kernel/src/syscall/proc.rs:171`), and nothing else would leave a whole boot idle straight after a sibling thread's clean exit. -`issues/kernel/thread-exits-completion-post-is-the-second-one.md` owns that +`issues/thread-exits-completion-post-is-the-second-one.md` owns that path's two posts. **Exit condition.** A capture taken from a boot that has actually stopped, which diff --git a/issues/build/a-shared-object-does-not-link-against-the-c-sysroot-with-z-defs.md b/issues/a-shared-object-does-not-link-against-the-c-sysroot-with-z-defs.md similarity index 88% rename from issues/build/a-shared-object-does-not-link-against-the-c-sysroot-with-z-defs.md rename to issues/a-shared-object-does-not-link-against-the-c-sysroot-with-z-defs.md index 96722376b4b..91fb411845f 100644 --- a/issues/build/a-shared-object-does-not-link-against-the-c-sysroot-with-z-defs.md +++ b/issues/a-shared-object-does-not-link-against-the-c-sysroot-with-z-defs.md @@ -11,7 +11,7 @@ clang links one with `-shared`. None links against the C sysroot with `-z defs`. A C one linked without it leaves `__tls_get_addr` undefined, and lld refuses the executable that links it for that name. LLVM built for `x86_64-unknown-toyos` -(`issues/build/bootstrap-cannot-build-llvm-clang-and-lld-for-a-toyos-host.md`) +(`issues/bootstrap-cannot-build-llvm-clang-and-lld-for-a-toyos-host.md`) builds `libLTO`, `libRemarks`, `libclang` and `libclang-cpp`, linked `-shared -z defs`, and each stops on what the sysroot's archives were built for, an executable: @@ -22,7 +22,7 @@ for, an executable: or libc's, through it, and only std defines it. - `R_X86_64_TPOFF32` against libc++abi's `eh_globals`, and `R_X86_64_PC32` against libc++'s vtables: the C++ runtime is compiled for an executable - (`issues/build/a-rust-std-binary-cannot-link-the-cxx-runtime.md`). + (`issues/a-rust-std-binary-cannot-link-the-cxx-runtime.md`). **Exit**: a C and a C++ shared object link against the C sysroot with `-z defs`, LLVM's four build for ToyOS with their options on, and a guest case diff --git a/issues/kernel/a-shootdown-panicked-on-a-cpu-the-host-starved.md b/issues/a-shootdown-panicked-on-a-cpu-the-host-starved.md similarity index 100% rename from issues/kernel/a-shootdown-panicked-on-a-cpu-the-host-starved.md rename to issues/a-shootdown-panicked-on-a-cpu-the-host-starved.md diff --git a/issues/filesystem/a-shrink-frees-clusters-before-the-entry-stops-naming-them.md b/issues/a-shrink-frees-clusters-before-the-entry-stops-naming-them.md similarity index 100% rename from issues/filesystem/a-shrink-frees-clusters-before-the-entry-stops-naming-them.md rename to issues/a-shrink-frees-clusters-before-the-entry-stops-naming-them.md diff --git a/issues/kernel/a-shutdown-on-a-held-usb-disk-left-a-cpu-deaf-to-a-tlb-shootdown.md b/issues/a-shutdown-on-a-held-usb-disk-left-a-cpu-deaf-to-a-tlb-shootdown.md similarity index 91% rename from issues/kernel/a-shutdown-on-a-held-usb-disk-left-a-cpu-deaf-to-a-tlb-shootdown.md rename to issues/a-shutdown-on-a-held-usb-disk-left-a-cpu-deaf-to-a-tlb-shootdown.md index 79cca8589e3..7df19d99df8 100644 --- a/issues/kernel/a-shutdown-on-a-held-usb-disk-left-a-cpu-deaf-to-a-tlb-shootdown.md +++ b/issues/a-shutdown-on-a-held-usb-disk-left-a-cpu-deaf-to-a-tlb-shootdown.md @@ -29,7 +29,7 @@ accord is logd's network thread, on a boot that gives logd no netd; the logd branch no longer starts that thread there, which would remove this boot's trigger and not the deaf CPU. -`issues/hardware/xhci-waits-are-spins.md` carries the arithmetic for one disk +`issues/xhci-waits-are-spins.md` carries the arithmetic for one disk operation outrunning `time::DEAF_CPU`; this is a boot that did outrun it, in `quiesce`, across several operations each inside its own budget. Whether `quiesce` holds `IF` clear between them is not measured. @@ -51,4 +51,4 @@ either the shutdown's calls on a held disk take interrupts between them or the shootdown on another CPU cannot need them then; a staged `usb-transport-break` shutdown with a thread ending on the other CPU inside the window stays up. -`usb_transport_break` is deleted; `issues/kernel/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md` records the commit that restores it. +`usb_transport_break` is deleted; `issues/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md` records the commit that restores it. diff --git a/issues/build/a-sigkilled-harness-leaves-its-qemu-children-running.md b/issues/a-sigkilled-harness-leaves-its-qemu-children-running.md similarity index 100% rename from issues/build/a-sigkilled-harness-leaves-its-qemu-children-running.md rename to issues/a-sigkilled-harness-leaves-its-qemu-children-running.md diff --git a/issues/kernel/a-spawn-of-echo-was-refused-with-an-error-nothing-names.md b/issues/a-spawn-of-echo-was-refused-with-an-error-nothing-names.md similarity index 96% rename from issues/kernel/a-spawn-of-echo-was-refused-with-an-error-nothing-names.md rename to issues/a-spawn-of-echo-was-refused-with-an-error-nothing-names.md index 1adbf1af288..ff8fe133674 100644 --- a/issues/kernel/a-spawn-of-echo-was-refused-with-an-error-nothing-names.md +++ b/issues/a-spawn-of-echo-was-refused-with-an-error-nothing-names.md @@ -27,7 +27,7 @@ printed anywhere on that path. **What is not established.** Everything: whether the refusal came from the kernel or from the loader in std, which errno it was, and whether it is the same failure as -`issues/kernel/two-processes-started-at-an-entry-point-nothing-had-mapped.md`, +`issues/two-processes-started-at-an-entry-point-nothing-had-mapped.md`, the *other* name on the same CI run, whose guest started two processes at an unmapped entry point in the same run. Both are "a process would not start" on one run's two shards; that is a coincidence with a shape, not a link. diff --git a/issues/kernel/a-split-lock-goes-unnoticed.md b/issues/a-split-lock-goes-unnoticed.md similarity index 100% rename from issues/kernel/a-split-lock-goes-unnoticed.md rename to issues/a-split-lock-goes-unnoticed.md diff --git a/issues/build/a-staged-image-went-missing-from-its-own-lane-directory.md b/issues/a-staged-image-went-missing-from-its-own-lane-directory.md similarity index 100% rename from issues/build/a-staged-image-went-missing-from-its-own-lane-directory.md rename to issues/a-staged-image-went-missing-from-its-own-lane-directory.md diff --git a/issues/build/a-std-fork-moved-for-an-unlanded-abi-is-rebuilt-against-mains-abi.md b/issues/a-std-fork-moved-for-an-unlanded-abi-is-rebuilt-against-mains-abi.md similarity index 100% rename from issues/build/a-std-fork-moved-for-an-unlanded-abi-is-rebuilt-against-mains-abi.md rename to issues/a-std-fork-moved-for-an-unlanded-abi-is-rebuilt-against-mains-abi.md diff --git a/issues/kernel/a-stick-that-answers-late-is-broken-by-the-two-second-abandon.md b/issues/a-stick-that-answers-late-is-broken-by-the-two-second-abandon.md similarity index 100% rename from issues/kernel/a-stick-that-answers-late-is-broken-by-the-two-second-abandon.md rename to issues/a-stick-that-answers-late-is-broken-by-the-two-second-abandon.md diff --git a/issues/build/a-stopped-boot-whose-job-never-asked-waits-out-the-reset-budget-and-says-it-asked.md b/issues/a-stopped-boot-whose-job-never-asked-waits-out-the-reset-budget-and-says-it-asked.md similarity index 100% rename from issues/build/a-stopped-boot-whose-job-never-asked-waits-out-the-reset-budget-and-says-it-asked.md rename to issues/a-stopped-boot-whose-job-never-asked-waits-out-the-reset-budget-and-says-it-asked.md diff --git a/issues/build/a-stores-build-code-moves-its-key-only-through-a-recipe-bumped-by-hand.md b/issues/a-stores-build-code-moves-its-key-only-through-a-recipe-bumped-by-hand.md similarity index 100% rename from issues/build/a-stores-build-code-moves-its-key-only-through-a-recipe-bumped-by-hand.md rename to issues/a-stores-build-code-moves-its-key-only-through-a-recipe-bumped-by-hand.md diff --git a/issues/filesystem/a-stranded-replace-staging-file-is-never-swept.md b/issues/a-stranded-replace-staging-file-is-never-swept.md similarity index 100% rename from issues/filesystem/a-stranded-replace-staging-file-is-never-swept.md rename to issues/a-stranded-replace-staging-file-is-never-swept.md diff --git a/issues/design-debt/a-stream-write-spins-on-a-lock-its-own-panic-can-hold.md b/issues/a-stream-write-spins-on-a-lock-its-own-panic-can-hold.md similarity index 100% rename from issues/design-debt/a-stream-write-spins-on-a-lock-its-own-panic-can-hold.md rename to issues/a-stream-write-spins-on-a-lock-its-own-panic-can-hold.md diff --git a/issues/hardware/a-swap-on-the-t14-lives-inside-a-metal-boots-bound.md b/issues/a-swap-on-the-t14-lives-inside-a-metal-boots-bound.md similarity index 94% rename from issues/hardware/a-swap-on-the-t14-lives-inside-a-metal-boots-bound.md rename to issues/a-swap-on-the-t14-lives-inside-a-metal-boots-bound.md index 616537515d8..c824415913b 100644 --- a/issues/hardware/a-swap-on-the-t14-lives-inside-a-metal-boots-bound.md +++ b/issues/a-swap-on-the-t14-lives-inside-a-metal-boots-bound.md @@ -26,5 +26,5 @@ what bounds such a boot instead. `lanswapcase` and `lan_swap_hold` are deleted with `lan_swap`, and `29733dba3` deleted `--swap`'s `--hand-back`, which ended that hold; -`issues/hardware/a-connect-between-two-accepts-is-reset.md` records the commits +`issues/a-connect-between-two-accepts-is-reset.md` records the commits that restore them. diff --git a/issues/isolation/a-swapped-binary-lives-where-any-process-can-rewrite-it.md b/issues/a-swapped-binary-lives-where-any-process-can-rewrite-it.md similarity index 100% rename from issues/isolation/a-swapped-binary-lives-where-any-process-can-rewrite-it.md rename to issues/a-swapped-binary-lives-where-any-process-can-rewrite-it.md diff --git a/issues/diagnostics/a-swaps-redial-asks-again-with-no-event-to-wait-on.md b/issues/a-swaps-redial-asks-again-with-no-event-to-wait-on.md similarity index 100% rename from issues/diagnostics/a-swaps-redial-asks-again-with-no-event-to-wait-on.md rename to issues/a-swaps-redial-asks-again-with-no-event-to-wait-on.md diff --git a/issues/filesystem/a-symbolic-link-on-tmp-displaces-its-name-and-lists-nowhere.md b/issues/a-symbolic-link-on-tmp-displaces-its-name-and-lists-nowhere.md similarity index 100% rename from issues/filesystem/a-symbolic-link-on-tmp-displaces-its-name-and-lists-nowhere.md rename to issues/a-symbolic-link-on-tmp-displaces-its-name-and-lists-nowhere.md diff --git a/issues/panic-path/a-syscall-panic-reset-the-guest-announced-and-qemu-never-saw.md b/issues/a-syscall-panic-reset-the-guest-announced-and-qemu-never-saw.md similarity index 96% rename from issues/panic-path/a-syscall-panic-reset-the-guest-announced-and-qemu-never-saw.md rename to issues/a-syscall-panic-reset-the-guest-announced-and-qemu-never-saw.md index 345b114846c..d89afb307ab 100644 --- a/issues/panic-path/a-syscall-panic-reset-the-guest-announced-and-qemu-never-saw.md +++ b/issues/a-syscall-panic-reset-the-guest-announced-and-qemu-never-saw.md @@ -28,7 +28,7 @@ reads, never arrived inside the row's wait. The run took 99.8 s at a 2.96x liveness width (fastest boot 3908 ms against a 1320 ms reference). **The one mechanism proposed for this is measured and does not reproduce it.** -`panic-path/the-panic-lock-spin-limit-is-a-count-its-comment-calls-a-second.md` +`issues/the-panic-lock-spin-limit-is-a-count-its-comment-calls-a-second.md` held the panic path's console wire across the same reset (`wire-held-red.patch`, `core::mem::forget(serial::try_wire())` before `acpi::reboot`) and got EXIT=0 at `8e525da4` in 27 s, against 7–8 s for the fixed path at the same head — the held diff --git a/issues/build/a-sysroot-builds-both-architectures-userland-for-a-build-of-one.md b/issues/a-sysroot-builds-both-architectures-userland-for-a-build-of-one.md similarity index 100% rename from issues/build/a-sysroot-builds-both-architectures-userland-for-a-build-of-one.md rename to issues/a-sysroot-builds-both-architectures-userland-for-a-build-of-one.md diff --git a/issues/diagnostics/a-t14-boot-said-rebooting-and-the-host-never-came-back.md b/issues/a-t14-boot-said-rebooting-and-the-host-never-came-back.md similarity index 100% rename from issues/diagnostics/a-t14-boot-said-rebooting-and-the-host-never-came-back.md rename to issues/a-t14-boot-said-rebooting-and-the-host-never-came-back.md diff --git a/issues/hardware/a-t14-boot-wedges-after-a-jobs-exit-and-nothing-said-why.md b/issues/a-t14-boot-wedges-after-a-jobs-exit-and-nothing-said-why.md similarity index 98% rename from issues/hardware/a-t14-boot-wedges-after-a-jobs-exit-and-nothing-said-why.md rename to issues/a-t14-boot-wedges-after-a-jobs-exit-and-nothing-said-why.md index 420da8563d0..ecd441ea577 100644 --- a/issues/hardware/a-t14-boot-wedges-after-a-jobs-exit-and-nothing-said-why.md +++ b/issues/a-t14-boot-wedges-after-a-jobs-exit-and-nothing-said-why.md @@ -87,6 +87,6 @@ proved the deadline: a boot wedged on purpose ended itself at 120153 ms against its 120000 ms bound, sealed a `WEDGED` record, and the machine was back in 231 s with no hand. But the sealed tail carried 190 of that boot's 295 records and **dropped the newest ten** — -`issues/diagnostics/a-wedged-reports-newest-records-were-cut-by-the-loaders-own-log-file.md` +`issues/a-wedged-reports-newest-records-were-cut-by-the-loaders-own-log-file.md` — and the newest ten are what this file is waiting for. That is the next thing to fix, before the next hung boot spends its one seal on the wrong window. diff --git a/issues/diagnostics/a-t14-wedge-ran-the-deadline-out-and-sealed-nothing.md b/issues/a-t14-wedge-ran-the-deadline-out-and-sealed-nothing.md similarity index 97% rename from issues/diagnostics/a-t14-wedge-ran-the-deadline-out-and-sealed-nothing.md rename to issues/a-t14-wedge-ran-the-deadline-out-and-sealed-nothing.md index d6e036b076d..d8f4252e051 100644 --- a/issues/diagnostics/a-t14-wedge-ran-the-deadline-out-and-sealed-nothing.md +++ b/issues/a-t14-wedge-ran-the-deadline-out-and-sealed-nothing.md @@ -8,7 +8,7 @@ opened: 2026-09-14 T14 run 48, `tests/metalcase` on `wt/toyos-quiesce` `3f8f7fd3`. The boot wedged and the stick came back readable — the case -`issues/hardware/a-t14-boot-wedges-after-a-jobs-exit-and-nothing-said-why.md` +`issues/a-t14-boot-wedges-after-a-jobs-exit-and-nothing-said-why.md` has been waiting for — and **the deadline sealed nothing**, so its exit condition is still unmet. diff --git a/issues/hardware/a-tco-base-word-near-all-ones-panics-the-loader-and-the-kernel.md b/issues/a-tco-base-word-near-all-ones-panics-the-loader-and-the-kernel.md similarity index 100% rename from issues/hardware/a-tco-base-word-near-all-ones-panics-the-loader-and-the-kernel.md rename to issues/a-tco-base-word-near-all-ones-panics-the-loader-and-the-kernel.md diff --git a/issues/build/a-test-asserts-a-daemons-line-off-a-boot-log-that-ends-before-it.md b/issues/a-test-asserts-a-daemons-line-off-a-boot-log-that-ends-before-it.md similarity index 100% rename from issues/build/a-test-asserts-a-daemons-line-off-a-boot-log-that-ends-before-it.md rename to issues/a-test-asserts-a-daemons-line-off-a-boot-log-that-ends-before-it.md diff --git a/issues/build/a-thread-std-detaches-holds-its-place-in-the-process-for-good.md b/issues/a-thread-std-detaches-holds-its-place-in-the-process-for-good.md similarity index 100% rename from issues/build/a-thread-std-detaches-holds-its-place-in-the-process-for-good.md rename to issues/a-thread-std-detaches-holds-its-place-in-the-process-for-good.md diff --git a/issues/kernel/a-threads-kernel-stack-has-no-guard-page.md b/issues/a-threads-kernel-stack-has-no-guard-page.md similarity index 100% rename from issues/kernel/a-threads-kernel-stack-has-no-guard-page.md rename to issues/a-threads-kernel-stack-has-no-guard-page.md diff --git a/issues/build/a-throwaway-signing-key-temp-named-by-pid-alone-fails-a-later-process.md b/issues/a-throwaway-signing-key-temp-named-by-pid-alone-fails-a-later-process.md similarity index 100% rename from issues/build/a-throwaway-signing-key-temp-named-by-pid-alone-fails-a-later-process.md rename to issues/a-throwaway-signing-key-temp-named-by-pid-alone-fails-a-later-process.md diff --git a/issues/kernel/a-tlb-shootdown-reaches-only-the-cpus-that-ran-the-space.md b/issues/a-tlb-shootdown-reaches-only-the-cpus-that-ran-the-space.md similarity index 95% rename from issues/kernel/a-tlb-shootdown-reaches-only-the-cpus-that-ran-the-space.md rename to issues/a-tlb-shootdown-reaches-only-the-cpus-that-ran-the-space.md index f559b50598c..a903aa09182 100644 --- a/issues/kernel/a-tlb-shootdown-reaches-only-the-cpus-that-ran-the-space.md +++ b/issues/a-tlb-shootdown-reaches-only-the-cpus-that-ran-the-space.md @@ -8,7 +8,7 @@ opened: 2026-09-29 A shootdown blocks on every other CPU (`kernel/src/mm/unmapped.rs:5`), whether or not it ever ran the address space. It waits on -`issues/kernel/no-test-can-hold-a-thread-on-a-named-cpu.md`. A CPU that +`issues/no-test-can-hold-a-thread-on-a-named-cpu.md`. A CPU that switches away keeps the space's entries: under PCID every CR3 load sets NOFLUSH (`kernel/src/arch/x86_64/paging.rs:295-306`), so a CPU leaves the target set only when those entries are gone, not when it stops running the diff --git a/issues/kernel/a-tls-block-is-zeroed-twice-with-interrupts-masked.md b/issues/a-tls-block-is-zeroed-twice-with-interrupts-masked.md similarity index 81% rename from issues/kernel/a-tls-block-is-zeroed-twice-with-interrupts-masked.md rename to issues/a-tls-block-is-zeroed-twice-with-interrupts-masked.md index 94f55dcdfe0..0aa58e03984 100644 --- a/issues/kernel/a-tls-block-is-zeroed-twice-with-interrupts-masked.md +++ b/issues/a-tls-block-is-zeroed-twice-with-interrupts-masked.md @@ -11,11 +11,11 @@ opened: 2026-10-03 frame it hands out; then it zeroes the whole block again with `write_bytes`. Every `SYS_THREAD_SPAWN` (`process::spawn_thread`) and every `SYS_SPAWN` (`loader`) builds one, and a syscall runs with interrupts masked from entry to -exit (`issues/kernel/syscall-preemption-is-incidental.md`), so each spawn pays +exit (`issues/syscall-preemption-is-incidental.md`), so each spawn pays two writes of the block, at least 2 MiB each, in one interrupts-off window. By reading, not measured. -Owner: `issues/kernel/toyos-beats-linuxs-latency-on-the-t14.md`. +Owner: `issues/toyos-beats-linuxs-latency-on-the-t14.md`. **Exit**: `build_combined` zeroes no byte the PMM already zeroed. diff --git a/issues/build/a-toolchain-job-that-does-not-finish-saves-no-layer-it-built.md b/issues/a-toolchain-job-that-does-not-finish-saves-no-layer-it-built.md similarity index 100% rename from issues/build/a-toolchain-job-that-does-not-finish-saves-no-layer-it-built.md rename to issues/a-toolchain-job-that-does-not-finish-saves-no-layer-it-built.md diff --git a/issues/build/a-toolchain-releases-asset-is-whatever-its-last-writer-put-there.md b/issues/a-toolchain-releases-asset-is-whatever-its-last-writer-put-there.md similarity index 100% rename from issues/build/a-toolchain-releases-asset-is-whatever-its-last-writer-put-there.md rename to issues/a-toolchain-releases-asset-is-whatever-its-last-writer-put-there.md diff --git a/issues/build/a-toyos-hosted-llvm-is-configured-as-running-on-the-build-machine.md b/issues/a-toyos-hosted-llvm-is-configured-as-running-on-the-build-machine.md similarity index 88% rename from issues/build/a-toyos-hosted-llvm-is-configured-as-running-on-the-build-machine.md rename to issues/a-toyos-hosted-llvm-is-configured-as-running-on-the-build-machine.md index 2c8706929fc..283db974f3d 100644 --- a/issues/build/a-toyos-hosted-llvm-is-configured-as-running-on-the-build-machine.md +++ b/issues/a-toyos-hosted-llvm-is-configured-as-running-on-the-build-machine.md @@ -12,7 +12,7 @@ configures it (`llvm/cmake/modules/GetHostTriple.cmake`, bootstrap names none: the `rust/` fork's `src/bootstrap/src/core/build_steps/llvm.rs` defines `LLVM_DEFAULT_TARGET_TRIPLE` and no `LLVM_HOST_TRIPLE`. So the LLVM that M2 -cross-builds to run on ToyOS (`issues/build/toyos-builds-itself.md`) records +cross-builds to run on ToyOS (`issues/toyos-builds-itself.md`) records the machine that built it as its host. The configure of that build on the development Mac, the fork at the commit `main` pins (`95960d6c214`), logged (#682, comment 5968053849) @@ -26,7 +26,7 @@ development Mac, the fork at the commit `main` pins (`95960d6c214`), logged it exits non-zero, so a configure run inside ToyOS stops there. That half is read from `GetHostTriple.cmake`, not run. -Owner: `issues/build/toyos-builds-itself.md`: M2 for the triple the host +Owner: `issues/toyos-builds-itself.md`: M2 for the triple the host build records, M5 for the configure inside ToyOS. Exit condition: the configure of a ToyOS-hosted LLVM logs `LLVM host triple: diff --git a/issues/kernel/a-unit-in-scalable-or-abort-mode-loses-translation-for-its-root-table-switch.md b/issues/a-unit-in-scalable-or-abort-mode-loses-translation-for-its-root-table-switch.md similarity index 92% rename from issues/kernel/a-unit-in-scalable-or-abort-mode-loses-translation-for-its-root-table-switch.md rename to issues/a-unit-in-scalable-or-abort-mode-loses-translation-for-its-root-table-switch.md index c1cf20d37d3..b5cf73c5fb2 100644 --- a/issues/kernel/a-unit-in-scalable-or-abort-mode-loses-translation-for-its-root-table-switch.md +++ b/issues/a-unit-in-scalable-or-abort-mode-loses-translation-for-its-root-table-switch.md @@ -11,7 +11,7 @@ mode (`RTADDR_REG.TTM` not `00`) and `CAP.ESRTPS` clear may not have its root table pointer set while translation is on (VT-d Rev. 4.1 §6.6). Handing such a unit over to this kernel's root table therefore turns translation off for that one switch, and for that moment every function behind the unit reaches all of -memory. `issues/kernel/a-unit-left-translating-passes-dma-untranslated-while-programmed.md` +memory. `issues/a-unit-left-translating-passes-dma-untranslated-while-programmed.md` removes the gap where the switch may stay translating; on these units it may not. @@ -23,7 +23,7 @@ T14 reports `CAP` bit 63 (`ESRTPS`), `ECAP` bit 43 (`SMTS`) and bit 52 those machines, log it, and file it as a known weakness with a fix (older protection registers) as its exit." -Owner: the orchestrator, under `issues/kernel/the-iommu-refuses-nothing-yet.md`. +Owner: the orchestrator, under `issues/the-iommu-refuses-nothing-yet.md`. **Exit**: on such a unit that reports `CAP.PLMR` (bit 5) and `CAP.PHMR` (bit 6), `PMEN`'s protected memory regions (§11.4.8.1) cover all of memory diff --git a/issues/kernel/a-unit-left-translating-passes-dma-untranslated-while-programmed.md b/issues/a-unit-left-translating-passes-dma-untranslated-while-programmed.md similarity index 100% rename from issues/kernel/a-unit-left-translating-passes-dma-untranslated-while-programmed.md rename to issues/a-unit-left-translating-passes-dma-untranslated-while-programmed.md diff --git a/issues/kernel/a-unit-this-kernel-does-not-program-keeps-what-firmware-left-on.md b/issues/a-unit-this-kernel-does-not-program-keeps-what-firmware-left-on.md similarity index 100% rename from issues/kernel/a-unit-this-kernel-does-not-program-keeps-what-firmware-left-on.md rename to issues/a-unit-this-kernel-does-not-program-keeps-what-firmware-left-on.md diff --git a/issues/kernel/a-usb3-device-attached-but-untrained-reads-as-gone.md b/issues/a-usb3-device-attached-but-untrained-reads-as-gone.md similarity index 100% rename from issues/kernel/a-usb3-device-attached-but-untrained-reads-as-gone.md rename to issues/a-usb3-device-attached-but-untrained-reads-as-gone.md diff --git a/issues/kernel/a-user-copy-pin-that-is-never-released-reds-no-test.md b/issues/a-user-copy-pin-that-is-never-released-reds-no-test.md similarity index 100% rename from issues/kernel/a-user-copy-pin-that-is-never-released-reds-no-test.md rename to issues/a-user-copy-pin-that-is-never-released-reds-no-test.md diff --git a/issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md b/issues/a-user-is-a-home-tree-and-a-login-row.md similarity index 76% rename from issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md rename to issues/a-user-is-a-home-tree-and-a-login-row.md index ec664e139c6..8c3afc8213d 100644 --- a/issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md +++ b/issues/a-user-is-a-home-tree-and-a-login-row.md @@ -6,11 +6,11 @@ opened: 2026-09-05 # A user is a home tree and a login row -A stage of `issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md`; +A stage of `issues/storage-is-layers-and-a-role-is-a-filesystem.md`; where a program's own data goes depends on it. A user is two things: `/home/`, a directory on DATA laid out as -`issues/filesystem/where-everything-lives.md` rules; and a row in the manifest from +`issues/where-everything-lives.md` rules; and a row in the manifest from which init builds a login session's namespace, the way it builds every system program's from `system.toml`. Nothing else names a user: no numeric id the kernel checks, no password file, no ambient "current user" a process can ask @@ -19,7 +19,7 @@ into it, and a program launched inside the session holds what the session's launcher row grants it. Until this lands there is one user, `toy`, whose home init makes at boot. -Stage 3 of `issues/isolation/every-program-sees-only-the-files-it-was-given.md`, and blocked on its first two stages: a user is isolated only +Stage 3 of `issues/every-program-sees-only-the-files-it-was-given.md`, and blocked on its first two stages: a user is isolated only once a session's view is all it can name. The mount protocol and real bcachefs change what backs `/home`, not what a user is. Constraints a builder would otherwise re-derive: the diff --git a/issues/design-debt/a-userland-device-driver-has-no-shared-boundary-to-be-written-against.md b/issues/a-userland-device-driver-has-no-shared-boundary-to-be-written-against.md similarity index 100% rename from issues/design-debt/a-userland-device-driver-has-no-shared-boundary-to-be-written-against.md rename to issues/a-userland-device-driver-has-no-shared-boundary-to-be-written-against.md diff --git a/issues/build/a-userland-test-in-a-file-no-module-reaches-runs-nowhere.md b/issues/a-userland-test-in-a-file-no-module-reaches-runs-nowhere.md similarity index 100% rename from issues/build/a-userland-test-in-a-file-no-module-reaches-runs-nowhere.md rename to issues/a-userland-test-in-a-file-no-module-reaches-runs-nowhere.md diff --git a/issues/build/a-warm-host-run-keeps-what-a-registry-proc-macro-expanded-from-a-file-it-never-named.md b/issues/a-warm-host-run-keeps-what-a-registry-proc-macro-expanded-from-a-file-it-never-named.md similarity index 100% rename from issues/build/a-warm-host-run-keeps-what-a-registry-proc-macro-expanded-from-a-file-it-never-named.md rename to issues/a-warm-host-run-keeps-what-a-registry-proc-macro-expanded-from-a-file-it-never-named.md diff --git a/issues/build/a-warm-host-run-never-relinks-for-a-file-only-a-flag-names.md b/issues/a-warm-host-run-never-relinks-for-a-file-only-a-flag-names.md similarity index 100% rename from issues/build/a-warm-host-run-never-relinks-for-a-file-only-a-flag-names.md rename to issues/a-warm-host-run-never-relinks-for-a-file-only-a-flag-names.md diff --git a/issues/kernel/a-watch-outlives-the-close-of-the-process-handle-it-was-made-through.md b/issues/a-watch-outlives-the-close-of-the-process-handle-it-was-made-through.md similarity index 93% rename from issues/kernel/a-watch-outlives-the-close-of-the-process-handle-it-was-made-through.md rename to issues/a-watch-outlives-the-close-of-the-process-handle-it-was-made-through.md index 9b8af636d7b..73530d5c893 100644 --- a/issues/kernel/a-watch-outlives-the-close-of-the-process-handle-it-was-made-through.md +++ b/issues/a-watch-outlives-the-close-of-the-process-handle-it-was-made-through.md @@ -24,6 +24,6 @@ kept the same way. **Exit**: a handle's close answers the polls its own process made through it, and no other handle's; a test watches a held child through a duplicate, closes the duplicate, and reads `-NotFound` before the child ends. That change -answers `issues/kernel/a-close-of-one-handle-ends-every-rings-poll-on-its-object.md` +answers `issues/a-close-of-one-handle-ends-every-rings-poll-on-its-object.md` too, whose first exit, a poll ending only when the last handle to its source closes, would keep the very poll this exit ends at its own handle's close. diff --git a/issues/diagnostics/a-wedged-boots-record-outgrows-both-channels-that-carry-it.md b/issues/a-wedged-boots-record-outgrows-both-channels-that-carry-it.md similarity index 100% rename from issues/diagnostics/a-wedged-boots-record-outgrows-both-channels-that-carry-it.md rename to issues/a-wedged-boots-record-outgrows-both-channels-that-carry-it.md diff --git a/issues/diagnostics/a-wedged-reports-newest-records-were-cut-by-the-loaders-own-log-file.md b/issues/a-wedged-reports-newest-records-were-cut-by-the-loaders-own-log-file.md similarity index 100% rename from issues/diagnostics/a-wedged-reports-newest-records-were-cut-by-the-loaders-own-log-file.md rename to issues/a-wedged-reports-newest-records-were-cut-by-the-loaders-own-log-file.md diff --git a/issues/isolation/a-window-buffer-is-read-while-its-client-writes-it.md b/issues/a-window-buffer-is-read-while-its-client-writes-it.md similarity index 100% rename from issues/isolation/a-window-buffer-is-read-while-its-client-writes-it.md rename to issues/a-window-buffer-is-read-while-its-client-writes-it.md diff --git a/issues/build/a-worktree-cannot-build-a-hosted-rustc-of-its-own.md b/issues/a-worktree-cannot-build-a-hosted-rustc-of-its-own.md similarity index 100% rename from issues/build/a-worktree-cannot-build-a-hosted-rustc-of-its-own.md rename to issues/a-worktree-cannot-build-a-hosted-rustc-of-its-own.md diff --git a/issues/filesystem/a-write-back-the-device-refused-waits-for-the-next-write.md b/issues/a-write-back-the-device-refused-waits-for-the-next-write.md similarity index 100% rename from issues/filesystem/a-write-back-the-device-refused-waits-for-the-next-write.md rename to issues/a-write-back-the-device-refused-waits-for-the-next-write.md diff --git a/issues/isolation/aarch64-el1-runs-without-pan.md b/issues/aarch64-el1-runs-without-pan.md similarity index 100% rename from issues/isolation/aarch64-el1-runs-without-pan.md rename to issues/aarch64-el1-runs-without-pan.md diff --git a/issues/kernel/all-cores-are-assumed-equal-and-arm64-breaks-that.md b/issues/all-cores-are-assumed-equal-and-arm64-breaks-that.md similarity index 100% rename from issues/kernel/all-cores-are-assumed-equal-and-arm64-breaks-that.md rename to issues/all-cores-are-assumed-equal-and-arm64-breaks-that.md diff --git a/issues/build/allocator-stress-bounds-a-failed-reservation-by-sixteen-gib.md b/issues/allocator-stress-bounds-a-failed-reservation-by-sixteen-gib.md similarity index 100% rename from issues/build/allocator-stress-bounds-a-failed-reservation-by-sixteen-gib.md rename to issues/allocator-stress-bounds-a-failed-reservation-by-sixteen-gib.md diff --git a/issues/kernel/an-aarch64-crash-report-reads-through-any-user-leaf.md b/issues/an-aarch64-crash-report-reads-through-any-user-leaf.md similarity index 97% rename from issues/kernel/an-aarch64-crash-report-reads-through-any-user-leaf.md rename to issues/an-aarch64-crash-report-reads-through-any-user-leaf.md index d727b3fb36e..49e1dea5844 100644 --- a/issues/kernel/an-aarch64-crash-report-reads-through-any-user-leaf.md +++ b/issues/an-aarch64-crash-report-reads-through-any-user-leaf.md @@ -33,7 +33,7 @@ Two more readers take the same leaf to the direct map: Nothing maps a BAR into an AArch64 process yet — `arch::msi_message` refuses there, so pcidev refuses every hand-over — so this is latent until -stage 6 of `issues/kernel/toyos-runs-on-arm64.md`. +stage 6 of `issues/toyos-runs-on-arm64.md`. **Exit condition**: `read_user_word`, `leaf` and the fault dump's `translate` answer only a leaf of the memory type the direct map holds, and diff --git a/issues/hardware/an-accept-that-never-reaches-netstack-strands-its-listener.md b/issues/an-accept-that-never-reaches-netstack-strands-its-listener.md similarity index 93% rename from issues/hardware/an-accept-that-never-reaches-netstack-strands-its-listener.md rename to issues/an-accept-that-never-reaches-netstack-strands-its-listener.md index 0d9d9fb5fca..c4936fcc607 100644 --- a/issues/hardware/an-accept-that-never-reaches-netstack-strands-its-listener.md +++ b/issues/an-accept-that-never-reaches-netstack-strands-its-listener.md @@ -19,7 +19,7 @@ Read from the code and not reproduced. `NetdConn::connect` fails with `ResourceExhausted` when the kernel's port queue refuses it, and `DataPath::create` with `Io` when a pipe cannot be made. -**Owner**: whoever holds `issues/design-debt/toyos-has-its-own-network-stack.md`. +**Owner**: whoever holds `issues/toyos-has-its-own-network-stack.md`. **Exit**: no failure between the wake and netd's answer leaves the owner holding a spent wake netd still counts, and a test in which that step fails and diff --git a/issues/kernel/an-acknowledge-after-an-enumeration-clears-a-replug-no-look-has-seen.md b/issues/an-acknowledge-after-an-enumeration-clears-a-replug-no-look-has-seen.md similarity index 100% rename from issues/kernel/an-acknowledge-after-an-enumeration-clears-a-replug-no-look-has-seen.md rename to issues/an-acknowledge-after-an-enumeration-clears-a-replug-no-look-has-seen.md diff --git a/issues/kernel/an-ap-loads-the-idt-before-its-control-registers.md b/issues/an-ap-loads-the-idt-before-its-control-registers.md similarity index 100% rename from issues/kernel/an-ap-loads-the-idt-before-its-control-registers.md rename to issues/an-ap-loads-the-idt-before-its-control-registers.md diff --git a/issues/hardware/an-armed-tco-has-never-reset-the-t14.md b/issues/an-armed-tco-has-never-reset-the-t14.md similarity index 100% rename from issues/hardware/an-armed-tco-has-never-reset-the-t14.md rename to issues/an-armed-tco-has-never-reset-the-t14.md diff --git a/issues/boot-media/an-image-on-a-disk-diskserver-drives-cannot-write-its-slots.md b/issues/an-image-on-a-disk-diskserver-drives-cannot-write-its-slots.md similarity index 100% rename from issues/boot-media/an-image-on-a-disk-diskserver-drives-cannot-write-its-slots.md rename to issues/an-image-on-a-disk-diskserver-drives-cannot-write-its-slots.md diff --git a/issues/kernel/an-irq-watchs-freeing-cancel-compiles-in-a-handler.md b/issues/an-irq-watchs-freeing-cancel-compiles-in-a-handler.md similarity index 94% rename from issues/kernel/an-irq-watchs-freeing-cancel-compiles-in-a-handler.md rename to issues/an-irq-watchs-freeing-cancel-compiles-in-a-handler.md index 9b29532b441..7cfe524325a 100644 --- a/issues/kernel/an-irq-watchs-freeing-cancel-compiles-in-a-handler.md +++ b/issues/an-irq-watchs-freeing-cancel-compiles-in-a-handler.md @@ -7,7 +7,7 @@ opened: 2026-09-30 # An IrqWatch's freeing cancel compiles in a handler Held by the small-kernel track's stage 6 step 5 -(`issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md`), +(`issues/the-kernel-is-small-interrupts-post-and-threads-wait.md`), whose exit reads it. An interrupt handler may not free: it can interrupt the allocator's holder. diff --git a/issues/filesystem/an-undated-file-on-fat-reads-back-as-1980.md b/issues/an-undated-file-on-fat-reads-back-as-1980.md similarity index 100% rename from issues/filesystem/an-undated-file-on-fat-reads-back-as-1980.md rename to issues/an-undated-file-on-fat-reads-back-as-1980.md diff --git a/issues/boot-media/an-unreadable-sector-on-a-usb-boot-stick-hangs-the-loader-past-the-firmware-watchdog.md b/issues/an-unreadable-sector-on-a-usb-boot-stick-hangs-the-loader-past-the-firmware-watchdog.md similarity index 100% rename from issues/boot-media/an-unreadable-sector-on-a-usb-boot-stick-hangs-the-loader-past-the-firmware-watchdog.md rename to issues/an-unreadable-sector-on-a-usb-boot-stick-hangs-the-loader-past-the-firmware-watchdog.md diff --git a/issues/kernel/an-xhci-storm-starves-the-cpu-that-takes-it.md b/issues/an-xhci-storm-starves-the-cpu-that-takes-it.md similarity index 95% rename from issues/kernel/an-xhci-storm-starves-the-cpu-that-takes-it.md rename to issues/an-xhci-storm-starves-the-cpu-that-takes-it.md index bb45e184aa2..45fcfab28e5 100644 --- a/issues/kernel/an-xhci-storm-starves-the-cpu-that-takes-it.md +++ b/issues/an-xhci-storm-starves-the-cpu-that-takes-it.md @@ -41,5 +41,5 @@ does not need `XHCI` at all. **Not this task's**: found while root-causing the loaded-host hang whose cause was the timer arming and not this. Whether an xHCI storm can by itself hold a CPU out of its timer for the whole of a bound is unmeasured — and it is one of -the shapes `issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md` +the shapes `issues/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md` leaves open. diff --git a/issues/hardware/anonymous-mmap-is-not-demand-paged.md b/issues/anonymous-mmap-is-not-demand-paged.md similarity index 100% rename from issues/hardware/anonymous-mmap-is-not-demand-paged.md rename to issues/anonymous-mmap-is-not-demand-paged.md diff --git a/issues/kernel/ap-control-registers-inherit-init.md b/issues/ap-control-registers-inherit-init.md similarity index 98% rename from issues/kernel/ap-control-registers-inherit-init.md rename to issues/ap-control-registers-inherit-init.md index a4a23a1884a..aa3a6354190 100644 --- a/issues/kernel/ap-control-registers-inherit-init.md +++ b/issues/ap-control-registers-inherit-init.md @@ -78,7 +78,7 @@ survivor, and a recurrence is a red naming the test instead of a line in a log. **2026-08-25, promoted to `defect`.** What is left is a measurement, not an observation, and it already has a named executor: -`issues/hardware/a-metal-session-runs-a-pre-flash-gate-first.md` carries it as +`issues/a-metal-session-runs-a-pre-flash-gate-first.md` carries it as the first row of that session's measurement table — one boot with AP control-register inheritance armed against one without, same image, same session. The instrument is built (`--diag-boot --kernel-param diff --git a/issues/kernel/ap-tsc-trail-is-assumed-and-never-checked.md b/issues/ap-tsc-trail-is-assumed-and-never-checked.md similarity index 97% rename from issues/kernel/ap-tsc-trail-is-assumed-and-never-checked.md rename to issues/ap-tsc-trail-is-assumed-and-never-checked.md index 1703652bc19..6c71343d5a2 100644 --- a/issues/kernel/ap-tsc-trail-is-assumed-and-never-checked.md +++ b/issues/ap-tsc-trail-is-assumed-and-never-checked.md @@ -62,5 +62,5 @@ rests on, and the instrument that would confirm or refute it does not exist — one `rdtsc` per CPU logged at the end of `init_ap` is the entire measurement. QEMU synthesises every guest TSC from one host clock and cannot answer, so this belongs on the metal session's table beside the control-register delta -(`issues/hardware/a-metal-session-runs-a-pre-flash-gate-first.md`). Owed by +(`issues/a-metal-session-runs-a-pre-flash-gate-first.md`). Owed by whoever prepares that session: build the log line first, then read it. diff --git a/issues/build/apps-that-build-or-run-on-toyos-alone.md b/issues/apps-that-build-or-run-on-toyos-alone.md similarity index 93% rename from issues/build/apps-that-build-or-run-on-toyos-alone.md rename to issues/apps-that-build-or-run-on-toyos-alone.md index c1b30838c11..2e94797c69a 100644 --- a/issues/build/apps-that-build-or-run-on-toyos-alone.md +++ b/issues/apps-that-build-or-run-on-toyos-alone.md @@ -13,7 +13,7 @@ each manifest's `[package.metadata.toyos.host] fails` names all three, so | app | what stops it | |---|---| -| `doom` | its `build.rs` compiles doomgeneric's C with the compiler the build system names in `CC_`, and panics without one; a check of another host's triple has no C library for it. On Linux, cpal's `alsa-sys` links ALSA's C library, found through `pkg-config`, and neither is a declared host tool (`issues/build/the-build-runs-host-tools-outside-rust-and-qemu.md`) | +| `doom` | its `build.rs` compiles doomgeneric's C with the compiler the build system names in `CC_`, and panics without one; a check of another host's triple has no C library for it. On Linux, cpal's `alsa-sys` links ALSA's C library, found through `pkg-config`, and neither is a declared host tool (`issues/the-build-runs-host-tools-outside-rust-and-qemu.md`) | | `toybox` | `std::os::toyos` in its `stats` and `locale` applets; on Linux, cpal's `alsa-sys`, as doom | | `terminal` | `std::os::toyos`: it starts its shell with `CommandExt::provide` | | `shell` | `std::os::toyos`: raw stdin, and `CommandExt::provide` to hand each program the connectors the shell was given | diff --git a/issues/build/assembly-outside-an-arch-module-in-userland-and-guest-probes.md b/issues/assembly-outside-an-arch-module-in-userland-and-guest-probes.md similarity index 100% rename from issues/build/assembly-outside-an-arch-module-in-userland-and-guest-probes.md rename to issues/assembly-outside-an-arch-module-in-userland-and-guest-probes.md diff --git a/issues/kernel/bcachefs-crate-is-not-bcachefs.md b/issues/bcachefs-crate-is-not-bcachefs.md similarity index 100% rename from issues/kernel/bcachefs-crate-is-not-bcachefs.md rename to issues/bcachefs-crate-is-not-bcachefs.md diff --git a/issues/diagnostics/blocked-dump-cannot-fire-on-a-total-freeze.md b/issues/blocked-dump-cannot-fire-on-a-total-freeze.md similarity index 98% rename from issues/diagnostics/blocked-dump-cannot-fire-on-a-total-freeze.md rename to issues/blocked-dump-cannot-fire-on-a-total-freeze.md index da08a94831d..5c9ada3a8c1 100644 --- a/issues/diagnostics/blocked-dump-cannot-fire-on-a-total-freeze.md +++ b/issues/blocked-dump-cannot-fire-on-a-total-freeze.md @@ -137,4 +137,4 @@ landing on `sched/dump.rs` hours before the first occurrence: `deaf_window` is (`tests/common/faults.rs:321`), and `screen_blocked_dump` boots a kernel that does not contain the function. -`blocked_dump` is deleted; `issues/build/parallel-tests-red-under-other-suites.md` records the commit that restores it. `screen_blocked_dump` stays. +`blocked_dump` is deleted; `issues/parallel-tests-red-under-other-suites.md` records the commit that restores it. `screen_blocked_dump` stays. diff --git a/issues/diagnostics/blocked-time-is-invisible-while-the-park-lasts.md b/issues/blocked-time-is-invisible-while-the-park-lasts.md similarity index 100% rename from issues/diagnostics/blocked-time-is-invisible-while-the-park-lasts.md rename to issues/blocked-time-is-invisible-while-the-park-lasts.md diff --git a/issues/build/blocking-read-window-reds-beside-other-guests.md b/issues/blocking-read-window-reds-beside-other-guests.md similarity index 100% rename from issues/build/blocking-read-window-reds-beside-other-guests.md rename to issues/blocking-read-window-reds-beside-other-guests.md diff --git a/issues/build/bootstrap-cannot-build-llvm-clang-and-lld-for-a-toyos-host.md b/issues/bootstrap-cannot-build-llvm-clang-and-lld-for-a-toyos-host.md similarity index 72% rename from issues/build/bootstrap-cannot-build-llvm-clang-and-lld-for-a-toyos-host.md rename to issues/bootstrap-cannot-build-llvm-clang-and-lld-for-a-toyos-host.md index c2cc7c6442e..ec3e0ee320c 100644 --- a/issues/build/bootstrap-cannot-build-llvm-clang-and-lld-for-a-toyos-host.md +++ b/issues/bootstrap-cannot-build-llvm-clang-and-lld-for-a-toyos-host.md @@ -6,7 +6,7 @@ opened: 2026-09-30 # Bootstrap cannot build LLVM, clang and lld for a ToyOS host -M2's clang and lld (`issues/build/toyos-builds-itself.md`) are bootstrap's +M2's clang and lld (`issues/toyos-builds-itself.md`) are bootstrap's `Llvm` step, with `clang = true`, and its `Lld` step for `x86_64-unknown-toyos`, in a bootstrap build that names no `llvm-config` for the build triple and so builds that triple's LLVM, and its `clang-tblgen`, @@ -18,19 +18,19 @@ sysroot's file has CMake find a package under a root alone. What stops the build, in the order it stops it: - **Compile.** The first errors are `Support`'s: `Unix/Watchdog.inc` and - `Unix/Program.inc` call `alarm` (`issues/build/libc-has-no-alarm.md`), and + `Unix/Program.inc` call `alarm` (`issues/libc-has-no-alarm.md`), and `Program.inc` stage 3's `wait` and `wait4` - (`issues/kernel/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md`). + (`issues/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md`). Then ORC's `shm_open` and `shm_unlink`, the interpreter's `scanf` and `llvm-objdump`'s `ctime` - (`issues/build/libc-lacks-names-llvm-for-a-toyos-host-calls.md`), and + (`issues/libc-lacks-names-llvm-for-a-toyos-host-calls.md`), and clang's `std::ifstream`, which libc++ has only with `std::filesystem` - (`issues/build/libcxx-is-built-without-std-filesystem.md`). + (`issues/libcxx-is-built-without-std-filesystem.md`). - **Link.** clang needs `lround`, which libc does not define - (`issues/build/libc-lacks-names-llvm-for-a-toyos-host-calls.md`), beside + (`issues/libc-lacks-names-llvm-for-a-toyos-host-calls.md`), beside those above. LLVM's shared libraries, `libLTO`, `libRemarks`, `libclang` and `libclang-cpp`, do not link against the C sysroot - (`issues/build/a-shared-object-does-not-link-against-the-c-sysroot-with-z-defs.md`). + (`issues/a-shared-object-does-not-link-against-the-c-sysroot-with-z-defs.md`). clang and lld use none of them, and ToyOS's build turns them off. **Exit**: ToyOS's build, with nothing supplied by hand, has bootstrap install diff --git a/issues/hardware/both-boots-of-the-manageability-read-image-found-the-t14-powered-off.md b/issues/both-boots-of-the-manageability-read-image-found-the-t14-powered-off.md similarity index 100% rename from issues/hardware/both-boots-of-the-manageability-read-image-found-the-t14-powered-off.md rename to issues/both-boots-of-the-manageability-read-image-found-the-t14-powered-off.md diff --git a/issues/isolation/bus-mastering-rides-memory-decode.md b/issues/bus-mastering-rides-memory-decode.md similarity index 100% rename from issues/isolation/bus-mastering-rides-memory-decode.md rename to issues/bus-mastering-rides-memory-decode.md diff --git a/issues/filesystem/c-programs-name-no-file-a-file-server-holds.md b/issues/c-programs-name-no-file-a-file-server-holds.md similarity index 100% rename from issues/filesystem/c-programs-name-no-file-a-file-server-holds.md rename to issues/c-programs-name-no-file-a-file-server-holds.md diff --git a/issues/build/cargo-package-fails-in-a-linked-worktree.md b/issues/cargo-package-fails-in-a-linked-worktree.md similarity index 100% rename from issues/build/cargo-package-fails-in-a-linked-worktree.md rename to issues/cargo-package-fails-in-a-linked-worktree.md diff --git a/issues/build/cargo-run-inside-kernel-loom-or-kernel-sim-builds-for-a-bare-target.md b/issues/cargo-run-inside-kernel-loom-or-kernel-sim-builds-for-a-bare-target.md similarity index 100% rename from issues/build/cargo-run-inside-kernel-loom-or-kernel-sim-builds-for-a-bare-target.md rename to issues/cargo-run-inside-kernel-loom-or-kernel-sim-builds-for-a-bare-target.md diff --git a/issues/audio/client-ring-depth-is-the-devices-pipeline-depth.md b/issues/client-ring-depth-is-the-devices-pipeline-depth.md similarity index 100% rename from issues/audio/client-ring-depth-is-the-devices-pipeline-depth.md rename to issues/client-ring-depth-is-the-devices-pipeline-depth.md diff --git a/issues/build/clippy-stage-two-is-lints-one-at-a-time.md b/issues/clippy-stage-two-is-lints-one-at-a-time.md similarity index 99% rename from issues/build/clippy-stage-two-is-lints-one-at-a-time.md rename to issues/clippy-stage-two-is-lints-one-at-a-time.md index 806aca4bb7f..0ddaaa66cf4 100644 --- a/issues/build/clippy-stage-two-is-lints-one-at-a-time.md +++ b/issues/clippy-stage-two-is-lints-one-at-a-time.md @@ -414,7 +414,7 @@ they did, and `Ring::read`/`Ring::write` hand out a pointer and a length now. Measuring `volatile_composites` (a `restriction` lint, cherry-picked, not part of this pass's scope but caught while reading kernel driver code) found 10 genuine sites — filed as -`issues/kernel/volatile-composites-on-mmio-dma-structs.md`, not fixed, because +`issues/volatile-composites-on-mmio-dma-structs.md`, not fixed, because the fix means re-deriving each device's own field-ordering contract (xHCI's Cycle-bit-last rule among them) and getting it wrong silently is worse than today's implementation-defined-but-tested state. diff --git a/issues/kernel/closing-a-ring-leaves-its-submitters-parked.md b/issues/closing-a-ring-leaves-its-submitters-parked.md similarity index 100% rename from issues/kernel/closing-a-ring-leaves-its-submitters-parked.md rename to issues/closing-a-ring-leaves-its-submitters-parked.md diff --git a/issues/build/cmake-ships-no-platform-module-for-toyos.md b/issues/cmake-ships-no-platform-module-for-toyos.md similarity index 100% rename from issues/build/cmake-ships-no-platform-module-for-toyos.md rename to issues/cmake-ships-no-platform-module-for-toyos.md diff --git a/issues/comments-name-defects-no-issue-holds.md b/issues/comments-name-defects-no-issue-holds.md new file mode 100644 index 00000000000..45d1addfba1 --- /dev/null +++ b/issues/comments-name-defects-no-issue-holds.md @@ -0,0 +1,18 @@ +--- +status: open +kind: finding +opened: 2026-10-04 +--- + +# A comment names a defect that no issue file holds + +It cited an area directory, not a file, and flattening the tracker dropped the +pointer because no file under that area named the subject: + +- `tests/toyos-rust-tests/src/bin/abuse_elf_loader.rs`, "the actuator for the + allocator-lock defect": a >2 MiB `KernelAllocator::alloc` assert fires while + the dlmalloc lock is held, and the comment says the defect "has stayed open". + No issue names it. + +**Exit condition:** it is either filed as a defect, if the tree still has it, +or its comment says it as an invariant and stops calling it a standing defect. diff --git a/issues/design-debt/comments-still-name-syscalls-the-abi-deleted.md b/issues/comments-still-name-syscalls-the-abi-deleted.md similarity index 100% rename from issues/design-debt/comments-still-name-syscalls-the-abi-deleted.md rename to issues/comments-still-name-syscalls-the-abi-deleted.md diff --git a/issues/design-debt/connects-are-turned-away-for-6-s-after-logkeeper-listens-again.md b/issues/connects-are-turned-away-for-6-s-after-logkeeper-listens-again.md similarity index 100% rename from issues/design-debt/connects-are-turned-away-for-6-s-after-logkeeper-listens-again.md rename to issues/connects-are-turned-away-for-6-s-after-logkeeper-listens-again.md diff --git a/issues/build/console-line-atomicity-loses-five-of-a-thousand-lines-on-ci.md b/issues/console-line-atomicity-loses-five-of-a-thousand-lines-on-ci.md similarity index 93% rename from issues/build/console-line-atomicity-loses-five-of-a-thousand-lines-on-ci.md rename to issues/console-line-atomicity-loses-five-of-a-thousand-lines-on-ci.md index 6f38cd52eaf..4dbc7a7aa06 100644 --- a/issues/build/console-line-atomicity-loses-five-of-a-thousand-lines-on-ci.md +++ b/issues/console-line-atomicity-loses-five-of-a-thousand-lines-on-ci.md @@ -16,7 +16,7 @@ writer's thousand lines there is not host contention between suites — which sharpens the question the test was built to ask rather than settling it: the loss is inside one guest's own console path. -Split out of `issues/build/parallel-tests-red-under-other-suites.md`, whose +Split out of `issues/parallel-tests-red-under-other-suites.md`, whose rate table was never this test's — CI's single-guest-per-machine shards rule out the contention shape that file is about. diff --git a/issues/build/contention-has-no-owning-instrument.md b/issues/contention-has-no-owning-instrument.md similarity index 94% rename from issues/build/contention-has-no-owning-instrument.md rename to issues/contention-has-no-owning-instrument.md index 9420dede8aa..051eea93f0e 100644 --- a/issues/build/contention-has-no-owning-instrument.md +++ b/issues/contention-has-no-owning-instrument.md @@ -20,7 +20,7 @@ The table used to carry a row for exactly this class — "loaded dev host | contention: parallel suites, lock storms, scheduler collapse | vendor semantics; run-to-run comparability" — and that row is what found the `ALONE: GREEN` verdict family and the load-coincident audio failures this -tree's history is full of (`issues/build/parallel-tests-red-under-other-suites.md`, +tree's history is full of (`issues/parallel-tests-red-under-other-suites.md`, the owner's 2026-08-04 ruling that a load-coincident audio failure is a real defect and not noise). The row left when the table was rewritten to four instruments; nothing replaced it, and the class it owned has carried no instrument since. diff --git a/issues/kernel/copy-meets-a-remap-holds-a-cpu-the-thread-it-waits-on-may-be-queued-behind.md b/issues/copy-meets-a-remap-holds-a-cpu-the-thread-it-waits-on-may-be-queued-behind.md similarity index 100% rename from issues/kernel/copy-meets-a-remap-holds-a-cpu-the-thread-it-waits-on-may-be-queued-behind.md rename to issues/copy-meets-a-remap-holds-a-cpu-the-thread-it-waits-on-may-be-queued-behind.md diff --git a/issues/audio/cpal-backend-hardcodes-the-format.md b/issues/cpal-backend-hardcodes-the-format.md similarity index 92% rename from issues/audio/cpal-backend-hardcodes-the-format.md rename to issues/cpal-backend-hardcodes-the-format.md index 29342949b46..804b515829e 100644 --- a/issues/audio/cpal-backend-hardcodes-the-format.md +++ b/issues/cpal-backend-hardcodes-the-format.md @@ -16,7 +16,7 @@ aborts every cpal app. fade, in whole periods, plus the 8 periods of the stream's ring: 1280 frames at 44100 Hz (`RELEASE_WITHIN`). Past it, `Drop` refuses by name and returns. The fade (`toyos_mixer::ramp_frames`) and the ring depth (soundd's `slot_count`, see -`issues/audio/client-ring-depth-is-the-devices-pipeline-depth.md`) are copies: +`issues/client-ring-depth-is-the-devices-pipeline-depth.md`) are copies: `StreamOpenResponse.slot_count` reaches `AudioStream::open` and stays private, and no message carries the fade. If soundd's fade grows or a device's pipeline deepens, the bound shrinks under what soundd needs, and a healthy soundd is @@ -35,7 +35,7 @@ and the cpal backend's `pause()` is a purely local futex store soundd is never told about. No change confined to soundd can separate the two, and landing the soundd and SDK halves alone would kill every paused cpal client. The **protocol**, not the implementation, is what needs to change; -`issues/audio/a-client-cannot-tell-soundserver-it-paused.md` is that change. +`issues/a-client-cannot-tell-soundserver-it-paused.md` is that change. The assignment was reclaimed 2026-08-23: nobody holds it, and the block above is what it is waiting on. diff --git a/issues/kernel/cpu-time-is-a-band-and-not-a-reservation.md b/issues/cpu-time-is-a-band-and-not-a-reservation.md similarity index 100% rename from issues/kernel/cpu-time-is-a-band-and-not-a-reservation.md rename to issues/cpu-time-is-a-band-and-not-a-reservation.md diff --git a/issues/kernel/crash-entry-under-preemption-has-no-loom-model.md b/issues/crash-entry-under-preemption-has-no-loom-model.md similarity index 95% rename from issues/kernel/crash-entry-under-preemption-has-no-loom-model.md rename to issues/crash-entry-under-preemption-has-no-loom-model.md index 3b0e21c2f73..5fbd5136485 100644 --- a/issues/kernel/crash-entry-under-preemption-has-no-loom-model.md +++ b/issues/crash-entry-under-preemption-has-no-loom-model.md @@ -13,7 +13,7 @@ why: "loom explores the interleavings of the *real* primitives, not of a re-implementation — a re-implementation is exactly the divergence risk this crate is meant to remove." What is owed is not the principle. It is one edge: the steal probe's victim-retire is modelled now, and -`issues/kernel/steal-probe-node-dies-with-its-victim.md` carries the command +`issues/steal-probe-node-dies-with-its-victim.md` carries the command that reproduces it. **Crash entry under preemption — no model at all.** Real preemption state is two diff --git a/issues/panic-path/crash-report-preemption-untested.md b/issues/crash-report-preemption-untested.md similarity index 100% rename from issues/panic-path/crash-report-preemption-untested.md rename to issues/crash-report-preemption-untested.md diff --git a/issues/filesystem/create-new-on-a-kernel-path-is-not-exclusive.md b/issues/create-new-on-a-kernel-path-is-not-exclusive.md similarity index 100% rename from issues/filesystem/create-new-on-a-kernel-path-is-not-exclusive.md rename to issues/create-new-on-a-kernel-path-is-not-exclusive.md diff --git a/issues/filesystem/data-takes-a-directory-whose-parent-was-never-made.md b/issues/data-takes-a-directory-whose-parent-was-never-made.md similarity index 90% rename from issues/filesystem/data-takes-a-directory-whose-parent-was-never-made.md rename to issues/data-takes-a-directory-whose-parent-was-never-made.md index 52763d86e45..92f5d28c244 100644 --- a/issues/filesystem/data-takes-a-directory-whose-parent-was-never-made.md +++ b/issues/data-takes-a-directory-whose-parent-was-never-made.md @@ -17,7 +17,7 @@ above it — init makes every level in turn for this reason (`make_dir` in ## Owner -The storage track, `issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md`: +The storage track, `issues/storage-is-layers-and-a-role-is-a-filesystem.md`: real bcachefs under DATA carries directories. ## What would close it diff --git a/issues/build/debug-true-produces-no-debug-info.md b/issues/debug-true-produces-no-debug-info.md similarity index 100% rename from issues/build/debug-true-produces-no-debug-info.md rename to issues/debug-true-produces-no-debug-info.md diff --git a/issues/design-debt/decode-payload-accepts-bytes-past-its-type.md b/issues/decode-payload-accepts-bytes-past-its-type.md similarity index 100% rename from issues/design-debt/decode-payload-accepts-bytes-past-its-type.md rename to issues/decode-payload-accepts-bytes-past-its-type.md diff --git a/issues/kernel/deferred-release-outlives-its-syscall.md b/issues/deferred-release-outlives-its-syscall.md similarity index 100% rename from issues/kernel/deferred-release-outlives-its-syscall.md rename to issues/deferred-release-outlives-its-syscall.md diff --git a/issues/audio/desktop-session-put-26ms-of-silence.md b/issues/desktop-session-put-26ms-of-silence.md similarity index 100% rename from issues/audio/desktop-session-put-26ms-of-silence.md rename to issues/desktop-session-put-26ms-of-silence.md diff --git a/issues/kernel/desktop-window-child-freeze.md b/issues/desktop-window-child-freeze.md similarity index 99% rename from issues/kernel/desktop-window-child-freeze.md rename to issues/desktop-window-child-freeze.md index c20cc4dded9..507410fdde4 100644 --- a/issues/kernel/desktop-window-child-freeze.md +++ b/issues/desktop-window-child-freeze.md @@ -113,7 +113,7 @@ no prompt at all, which is the weaker evidence of the two and may simply be a line that never got flushed. **A confound that is not this.** Three of the owner's eight CPUs stop taking -scheduler passes during a session and threads placed on them never run (`issues/kernel/`, +scheduler passes during a session and threads placed on them never run (`issues/spawned-process-never-starts.md`, #142/#156). That produces processes which *hang*; the three here *exited*, promptly, with `code=0`. This entry must not be closed by it — though the freeze the test now reproduces is very likely that defect, which is the whole diff --git a/issues/hardware/device-shape-and-lifecycle-have-no-coverage.md b/issues/device-shape-and-lifecycle-have-no-coverage.md similarity index 97% rename from issues/hardware/device-shape-and-lifecycle-have-no-coverage.md rename to issues/device-shape-and-lifecycle-have-no-coverage.md index 44c2412e7ea..21d1b990f5f 100644 --- a/issues/hardware/device-shape-and-lifecycle-have-no-coverage.md +++ b/issues/device-shape-and-lifecycle-have-no-coverage.md @@ -39,4 +39,4 @@ of protocol conformance. kernel's own parser, so one assertion covers write-back and capacity at once. Remaining: the file's own bytes, which needs a file-backed `BlockIO` so the harness can walk the btree rather than only the superblocks. -4. **The network gate** — `issues/build/there-is-no-network-gate.md`. +4. **The network gate** — `issues/there-is-no-network-gate.md`. diff --git a/issues/design-debt/deviceerror-classify-trusts-a-lying-transfererror.md b/issues/deviceerror-classify-trusts-a-lying-transfererror.md similarity index 100% rename from issues/design-debt/deviceerror-classify-trusts-a-lying-transfererror.md rename to issues/deviceerror-classify-trusts-a-lying-transfererror.md diff --git a/issues/filesystem/dir-symlink-skips-the-reconnect-every-other-path-call-makes.md b/issues/dir-symlink-skips-the-reconnect-every-other-path-call-makes.md similarity index 100% rename from issues/filesystem/dir-symlink-skips-the-reconnect-every-other-path-call-makes.md rename to issues/dir-symlink-skips-the-reconnect-every-other-path-call-makes.md diff --git a/issues/hardware/diskserver-drives-nvme-apst.md b/issues/diskserver-drives-nvme-apst.md similarity index 88% rename from issues/hardware/diskserver-drives-nvme-apst.md rename to issues/diskserver-drives-nvme-apst.md index ab3ef5d75dd..fbee731b3c5 100644 --- a/issues/hardware/diskserver-drives-nvme-apst.md +++ b/issues/diskserver-drives-nvme-apst.md @@ -7,7 +7,7 @@ opened: 2026-09-29 # blockd drives NVMe APST After blockd drives the T14's drive, the blockd step of -`issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md`. As +`issues/the-kernel-is-small-interrupts-post-and-threads-wait.md`. As Linux at `Ubuntu-6.8.0-142.142`, APST stays within `default_ps_max_latency_us` and honours `NVME_QUIRK_NO_APST` and `NVME_QUIRK_NO_DEEPEST_PS` (`drivers/nvme/host/core.c:63,2495-2598`). diff --git a/issues/filesystem/diskserver-resets-a-drive-that-is-slow-and-healthy.md b/issues/diskserver-resets-a-drive-that-is-slow-and-healthy.md similarity index 100% rename from issues/filesystem/diskserver-resets-a-drive-that-is-slow-and-healthy.md rename to issues/diskserver-resets-a-drive-that-is-slow-and-healthy.md diff --git a/issues/filesystem/diskserver-serves-the-slot-the-machine-runs-from.md b/issues/diskserver-serves-the-slot-the-machine-runs-from.md similarity index 91% rename from issues/filesystem/diskserver-serves-the-slot-the-machine-runs-from.md rename to issues/diskserver-serves-the-slot-the-machine-runs-from.md index 19a2d7518a9..dbc4b9376a5 100644 --- a/issues/filesystem/diskserver-serves-the-slot-the-machine-runs-from.md +++ b/issues/diskserver-serves-the-slot-the-machine-runs-from.md @@ -15,7 +15,7 @@ refusal, and nothing tells it which of its partitions the machine booted. It cannot bite today: blockd drives a controller the kernel does not, and the boot medium is always the kernel's (the stick, or the first NVMe controller). It bites the day blockd drives the disk the loader read ROOT from — the -small-kernel track's step 9 (`issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md`), +small-kernel track's step 9 (`issues/the-kernel-is-small-interrupts-post-and-threads-wait.md`), or an installed machine booting off NVMe once the kernel stops driving it. **Exit condition.** blockd learns the running slot's unique GUID from the diff --git a/issues/design-debt/diskserver-ships-a-staging-flag.md b/issues/diskserver-ships-a-staging-flag.md similarity index 100% rename from issues/design-debt/diskserver-ships-a-staging-flag.md rename to issues/diskserver-ships-a-staging-flag.md diff --git a/issues/audio/dither-draws-share-one-state.md b/issues/dither-draws-share-one-state.md similarity index 100% rename from issues/audio/dither-draws-share-one-state.md rename to issues/dither-draws-share-one-state.md diff --git a/issues/kernel/dlopen-write-at-is-not-the-sole-writer-of-a-mapped-module.md b/issues/dlopen-write-at-is-not-the-sole-writer-of-a-mapped-module.md similarity index 100% rename from issues/kernel/dlopen-write-at-is-not-the-sole-writer-of-a-mapped-module.md rename to issues/dlopen-write-at-is-not-the-sole-writer-of-a-mapped-module.md diff --git a/issues/design-debt/dns-resolver-refuses-a-truncated-answer.md b/issues/dns-resolver-refuses-a-truncated-answer.md similarity index 100% rename from issues/design-debt/dns-resolver-refuses-a-truncated-answer.md rename to issues/dns-resolver-refuses-a-truncated-answer.md diff --git a/issues/audio/doom-audio-callback-stalled-on-the-t14.md b/issues/doom-audio-callback-stalled-on-the-t14.md similarity index 95% rename from issues/audio/doom-audio-callback-stalled-on-the-t14.md rename to issues/doom-audio-callback-stalled-on-the-t14.md index 6a6c684ca81..d06f67ad47e 100644 --- a/issues/audio/doom-audio-callback-stalled-on-the-t14.md +++ b/issues/doom-audio-callback-stalled-on-the-t14.md @@ -23,7 +23,7 @@ device. So the one thing that keeps a 2.9 ms deadline met was absent there and is present in every config the suite runs. That is a mechanism, not a measurement, and two others are equally live: the -`drain_irqs` entry, `issues/kernel/scheduler-pass-blocks-in-xhci.md`, +`drain_irqs` entry, `issues/scheduler-pass-blocks-in-xhci.md`, where any syscall on that thread can become the USB driver's engine for as long as a second; and plain scheduling pressure from a game thread and a compositor that never yield to it. diff --git a/issues/isolation/dtv-capacity-is-a-workload-bound.md b/issues/dtv-capacity-is-a-workload-bound.md similarity index 100% rename from issues/isolation/dtv-capacity-is-a-workload-bound.md rename to issues/dtv-capacity-is-a-workload-bound.md diff --git a/issues/kernel/each-boot-prints-the-vulnerabilities-lines-linux-prints.md b/issues/each-boot-prints-the-vulnerabilities-lines-linux-prints.md similarity index 87% rename from issues/kernel/each-boot-prints-the-vulnerabilities-lines-linux-prints.md rename to issues/each-boot-prints-the-vulnerabilities-lines-linux-prints.md index 61f2d291ea6..6e05ae1a3b5 100644 --- a/issues/kernel/each-boot-prints-the-vulnerabilities-lines-linux-prints.md +++ b/issues/each-boot-prints-the-vulnerabilities-lines-linux-prints.md @@ -9,7 +9,7 @@ opened: 2026-09-29 **Exit**: each proving machine's ToyOS boot prints, for each vulnerabilities file, the line Linux at `Ubuntu-6.8.0-142.142` printed on that machine: the T14's from -`issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md`, +`issues/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md`, each EPYC guest's from its runner's capture. It omits only clauses about what ToyOS does not run: `spectre_v1`'s swapgs barriers while it runs no `swapgs`, the KVM and VM-exit clauses since it runs no guest, and `IBRS_FW` since the diff --git a/issues/kernel/echo-faulted-after-the-fault-arms.md b/issues/echo-faulted-after-the-fault-arms.md similarity index 100% rename from issues/kernel/echo-faulted-after-the-fault-arms.md rename to issues/echo-faulted-after-the-fault-arms.md diff --git a/issues/build/edk2-stable202502-to-202608-hangs-at-exitbootservices-under-hvf.md b/issues/edk2-stable202502-to-202608-hangs-at-exitbootservices-under-hvf.md similarity index 100% rename from issues/build/edk2-stable202502-to-202608-hangs-at-exitbootservices-under-hvf.md rename to issues/edk2-stable202502-to-202608-hangs-at-exitbootservices-under-hvf.md diff --git a/issues/design-debt/elf-domain-lint-line-not-yet-added.md b/issues/elf-domain-lint-line-not-yet-added.md similarity index 100% rename from issues/design-debt/elf-domain-lint-line-not-yet-added.md rename to issues/elf-domain-lint-line-not-yet-added.md diff --git a/issues/build/errno-codes-are-defined-in-three-places-in-libc.md b/issues/errno-codes-are-defined-in-three-places-in-libc.md similarity index 100% rename from issues/build/errno-codes-are-defined-in-three-places-in-libc.md rename to issues/errno-codes-are-defined-in-three-places-in-libc.md diff --git a/issues/build/every-build-still-removes-an-llvm-no-build-makes-in-tree-any-more.md b/issues/every-build-still-removes-an-llvm-no-build-makes-in-tree-any-more.md similarity index 100% rename from issues/build/every-build-still-removes-an-llvm-no-build-makes-in-tree-any-more.md rename to issues/every-build-still-removes-an-llvm-no-build-makes-in-tree-any-more.md diff --git a/issues/kernel/every-driver-is-still-in-the-kernel.md b/issues/every-driver-is-still-in-the-kernel.md similarity index 91% rename from issues/kernel/every-driver-is-still-in-the-kernel.md rename to issues/every-driver-is-still-in-the-kernel.md index 9552fffcca2..ef745e3f4ef 100644 --- a/issues/kernel/every-driver-is-still-in-the-kernel.md +++ b/issues/every-driver-is-still-in-the-kernel.md @@ -22,8 +22,8 @@ function a process drives: a claim on one this machine cannot give an address space of its own is refused by name, so there is no machine on which a driver outside the kernel gets an untranslated address. The ruling for signed in-image drivers on a machine with no IOMMU is -`issues/kernel/a-machine-without-an-iommu-refuses-every-claim.md`'s. -`issues/kernel/the-iommu-refuses-nothing-yet.md` still holds the other half — +`issues/a-machine-without-an-iommu-refuses-every-claim.md`'s. +`issues/the-iommu-refuses-nothing-yet.md` still holds the other half — every driver *inside* the kernel holds a domain of its own and the refusal there is not built. @@ -44,7 +44,7 @@ What is left of the staged work: `SYS_DEVICE_BAR_MAP` and `SYS_DEVICE_DMA_ALLOC`, with config space readable and unwritable and the interrupt delivered as a record on the claim. 4. **The i8042 (PS/2)**: staged as stage 7 of - `issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md`. + `issues/the-kernel-is-small-interrupts-post-and-threads-wait.md`. - **USB HID cannot move to userspace without moving the boot block device or splitting the controller.** It shares the controller, the event ring and the diff --git a/issues/filesystem/every-flush-of-a-served-file-syncs-its-whole-volume.md b/issues/every-flush-of-a-served-file-syncs-its-whole-volume.md similarity index 100% rename from issues/filesystem/every-flush-of-a-served-file-syncs-its-whole-volume.md rename to issues/every-flush-of-a-served-file-syncs-its-whole-volume.md diff --git a/issues/kernel/every-interrupt-lands-on-the-boot-cpu.md b/issues/every-interrupt-lands-on-the-boot-cpu.md similarity index 98% rename from issues/kernel/every-interrupt-lands-on-the-boot-cpu.md rename to issues/every-interrupt-lands-on-the-boot-cpu.md index adccaf9303e..ec515548c1b 100644 --- a/issues/kernel/every-interrupt-lands-on-the-boot-cpu.md +++ b/issues/every-interrupt-lands-on-the-boot-cpu.md @@ -37,7 +37,7 @@ the machine's, and every device shares it. plans any more. The reason stands: the drain and wait machinery under the ISRs must be settled ground first, and what moves that machinery today is stage 6 of - `issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md`, + `issues/the-kernel-is-small-interrupts-post-and-threads-wait.md`, where `irq_ring` and `drain_irqs` go. 4. The instrument before the change: measure interrupt distribution and the boot CPU's share under the loaded suites, so the improvement is a number diff --git a/issues/isolation/every-job-test-runner-starts-holds-its-whole-system-capability.md b/issues/every-job-test-runner-starts-holds-its-whole-system-capability.md similarity index 100% rename from issues/isolation/every-job-test-runner-starts-holds-its-whole-system-capability.md rename to issues/every-job-test-runner-starts-holds-its-whole-system-capability.md diff --git a/issues/kernel/every-mmap-walks-every-region-under-both-locks.md b/issues/every-mmap-walks-every-region-under-both-locks.md similarity index 100% rename from issues/kernel/every-mmap-walks-every-region-under-both-locks.md rename to issues/every-mmap-walks-every-region-under-both-locks.md diff --git a/issues/isolation/every-program-sees-only-the-files-it-was-given.md b/issues/every-program-sees-only-the-files-it-was-given.md similarity index 93% rename from issues/isolation/every-program-sees-only-the-files-it-was-given.md rename to issues/every-program-sees-only-the-files-it-was-given.md index 1fbfd60cdd7..daca0b4949f 100644 --- a/issues/isolation/every-program-sees-only-the-files-it-was-given.md +++ b/issues/every-program-sees-only-the-files-it-was-given.md @@ -8,10 +8,10 @@ opened: 2026-09-24 Owner ruling, 2026-09-24: isolation is non-negotiable, and the filesystem is no longer the declared exception to the capability model. This reverses question -2 of `issues/kernel/the-capability-end-state-is-twelve-answers.md`. Today any +2 of `issues/the-capability-end-state-is-twelve-answers.md`. Today any process opens, deletes or spawns any path, so there is no boundary between two programs, let alone between two people: any process can append a line to -sshd's key list and log in remotely (`issues/isolation/sshserver-authorized-keys-unprotected.md`). +sshd's key list and log in remotely (`issues/sshserver-authorized-keys-unprotected.md`). ## The model @@ -52,7 +52,7 @@ was handed, so isolating people follows from isolating programs. granted, never for who connects. Revocation comes later. - **`/tmp`, "Per session"**: a session's programs share one `/tmp`, and each service and each app has its own. This amends the 2026-09-26 ruling of - `issues/filesystem/where-everything-lives.md` that `/tmp` is private per + `issues/where-everything-lives.md` that `/tmp` is private per program. **Ruled** (owner, 2026-10-04), **the local desktop, "Desktop counts"**: the @@ -71,7 +71,7 @@ nameable by every program and make confused-deputy bugs structural. ## Stages 1. **The resolver is the file server's** (amended by the owner's storage - ruling of 2026-09-26, `issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md` + ruling of 2026-09-26, `issues/the-kernel-is-small-interrupts-post-and-threads-wait.md` stage 4; it was a per-process view object in the kernel). A view is a set of directory capabilities: init builds each from the program's row as a connector to a file server's port, and tells that server which subtree and @@ -94,7 +94,7 @@ nameable by every program and make confused-deputy bugs structural. terminal get the session's view, doom its `/apps` directory, and daemons their own state. **Exit**: the machine boots with every program in a declared view, and nothing still sees the global tree. -3. **Sessions and users.** `issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md` +3. **Sessions and users.** `issues/a-user-is-a-home-tree-and-a-login-row.md` on top of views: a login authority (sshd, and later a local greeter) holds a `login` right and asks init's `launcher` for a session, and init builds the session's view from the user's row: the user's home, `/system` diff --git a/issues/kernel/every-random-byte-is-one-rdrand.md b/issues/every-random-byte-is-one-rdrand.md similarity index 100% rename from issues/kernel/every-random-byte-is-one-rdrand.md rename to issues/every-random-byte-is-one-rdrand.md diff --git a/issues/kernel/every-syscall-runs-at-one-kernel-stack-offset.md b/issues/every-syscall-runs-at-one-kernel-stack-offset.md similarity index 100% rename from issues/kernel/every-syscall-runs-at-one-kernel-stack-offset.md rename to issues/every-syscall-runs-at-one-kernel-stack-offset.md diff --git a/issues/build/every-sysroot-key-compiles-userlands-core-and-alloc-again.md b/issues/every-sysroot-key-compiles-userlands-core-and-alloc-again.md similarity index 100% rename from issues/build/every-sysroot-key-compiles-userlands-core-and-alloc-again.md rename to issues/every-sysroot-key-compiles-userlands-core-and-alloc-again.md diff --git a/issues/hardware/extcnf-ctrl-bit-7-is-read-as-manageability-on-a-mac-where-it-gates-phy-configuration.md b/issues/extcnf-ctrl-bit-7-is-read-as-manageability-on-a-mac-where-it-gates-phy-configuration.md similarity index 100% rename from issues/hardware/extcnf-ctrl-bit-7-is-read-as-manageability-on-a-mac-where-it-gates-phy-configuration.md rename to issues/extcnf-ctrl-bit-7-is-read-as-manageability-on-a-mac-where-it-gates-phy-configuration.md diff --git a/issues/kernel/fairness-is-per-thread-so-thread-count-wins.md b/issues/fairness-is-per-thread-so-thread-count-wins.md similarity index 100% rename from issues/kernel/fairness-is-per-thread-so-thread-count-wins.md rename to issues/fairness-is-per-thread-so-thread-count-wins.md diff --git a/issues/filesystem/fat-unlink-reallocate-leaks-a-cluster-under-load.md b/issues/fat-unlink-reallocate-leaks-a-cluster-under-load.md similarity index 100% rename from issues/filesystem/fat-unlink-reallocate-leaks-a-cluster-under-load.md rename to issues/fat-unlink-reallocate-leaks-a-cluster-under-load.md diff --git a/issues/filesystem/fat32-bounds-are-policy.md b/issues/fat32-bounds-are-policy.md similarity index 100% rename from issues/filesystem/fat32-bounds-are-policy.md rename to issues/fat32-bounds-are-policy.md diff --git a/issues/hardware/features-no-proving-machine-is-known-to-offer.md b/issues/features-no-proving-machine-is-known-to-offer.md similarity index 91% rename from issues/hardware/features-no-proving-machine-is-known-to-offer.md rename to issues/features-no-proving-machine-is-known-to-offer.md index 1709affbdb9..04fa065307b 100644 --- a/issues/hardware/features-no-proving-machine-is-known-to-offer.md +++ b/issues/features-no-proving-machine-is-known-to-offer.md @@ -7,8 +7,8 @@ opened: 2026-09-29 # Features no proving machine is known to offer No stage of -`issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md` -or `issues/kernel/toyos-uses-what-modern-hardware-offers-for-speed.md` takes +`issues/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md` +or `issues/toyos-uses-what-modern-hardware-offers-for-speed.md` takes these, since neither the T14 nor an EPYC KVM guest is known to enumerate one. It is blocked on a proving machine that does; its exit is every row a stage issue under the track it serves, or a `rejected` issue. Intel's @@ -17,7 +17,7 @@ ISE reference 319433-062, Table 1-2 ("ISE"), neither of which places any of these in Tiger Lake. AMD's and Arm's are read in Linux at tag `v7.2`; the AMD parts that carry each were not verified against AMD's documents, and the Arm cores were not verified against Arm's. The Arm rows belong to -`issues/kernel/toyos-runs-on-arm64.md`'s CPU-state declaration. +`issues/toyos-runs-on-arm64.md`'s CPU-state declaration. | Feature | Hardware | |---|---| diff --git a/issues/hardware/first-match-selection-that-remains.md b/issues/first-match-selection-that-remains.md similarity index 100% rename from issues/hardware/first-match-selection-that-remains.md rename to issues/first-match-selection-that-remains.md diff --git a/issues/build/fork-branches-have-no-upstream.md b/issues/fork-branches-have-no-upstream.md similarity index 100% rename from issues/build/fork-branches-have-no-upstream.md rename to issues/fork-branches-have-no-upstream.md diff --git a/issues/build/fork-estate-outside-the-warning-bar.md b/issues/fork-estate-outside-the-warning-bar.md similarity index 100% rename from issues/build/fork-estate-outside-the-warning-bar.md rename to issues/fork-estate-outside-the-warning-bar.md diff --git a/issues/build/fork-upstream-work-is-open-or-prepared-and-recorded-nowhere-else.md b/issues/fork-upstream-work-is-open-or-prepared-and-recorded-nowhere-else.md similarity index 100% rename from issues/build/fork-upstream-work-is-open-or-prepared-and-recorded-nowhere-else.md rename to issues/fork-upstream-work-is-open-or-prepared-and-recorded-nowhere-else.md diff --git a/issues/filesystem/fs-turns-judges-the-scheduler-with-the-lock.md b/issues/fs-turns-judges-the-scheduler-with-the-lock.md similarity index 100% rename from issues/filesystem/fs-turns-judges-the-scheduler-with-the-lock.md rename to issues/fs-turns-judges-the-scheduler-with-the-lock.md diff --git a/issues/kernel/fsgsbase-is-measured-then-taken-or-rejected.md b/issues/fsgsbase-is-measured-then-taken-or-rejected.md similarity index 91% rename from issues/kernel/fsgsbase-is-measured-then-taken-or-rejected.md rename to issues/fsgsbase-is-measured-then-taken-or-rejected.md index 8715ca63e28..f83d5d6c042 100644 --- a/issues/kernel/fsgsbase-is-measured-then-taken-or-rejected.md +++ b/issues/fsgsbase-is-measured-then-taken-or-rejected.md @@ -9,7 +9,7 @@ opened: 2026-09-29 `CR4.FSGSBASE` is forbidden (`kernel/src/arch/x86_64/control_regs.rs:62-75`): GS always holds the kernel's per-CPU base and the kernel runs no `swapgs`. Taking it costs a `swapgs` entry and the swapgs barriers of -`issues/kernel/user-pointer-checks-have-no-spectre-v1-fence-and-smap-is-optional.md`. +`issues/user-pointer-checks-have-no-spectre-v1-fence-and-smap-is-optional.md`. **Exit**: the T14's pipe round trips with and without it, a loss becoming a `rejected` issue with both figures. Taken: on every proving machine and under diff --git a/issues/audio/gate-a-suspend-structure-verdict-unread.md b/issues/gate-a-suspend-structure-verdict-unread.md similarity index 100% rename from issues/audio/gate-a-suspend-structure-verdict-unread.md rename to issues/gate-a-suspend-structure-verdict-unread.md diff --git a/issues/design-debt/getrandom-forks-discard-the-kernels-random-status.md b/issues/getrandom-forks-discard-the-kernels-random-status.md similarity index 100% rename from issues/design-debt/getrandom-forks-discard-the-kernels-random-status.md rename to issues/getrandom-forks-discard-the-kernels-random-status.md diff --git a/issues/design-debt/getsockname-answers-an-address-nobody-asked-netstack-for.md b/issues/getsockname-answers-an-address-nobody-asked-netstack-for.md similarity index 100% rename from issues/design-debt/getsockname-answers-an-address-nobody-asked-netstack-for.md rename to issues/getsockname-answers-an-address-nobody-asked-netstack-for.md diff --git a/issues/hardware/gop-is-not-the-path-every-boot-takes.md b/issues/gop-is-not-the-path-every-boot-takes.md similarity index 100% rename from issues/hardware/gop-is-not-the-path-every-boot-takes.md rename to issues/gop-is-not-the-path-every-boot-takes.md diff --git a/issues/kernel/granularity-bound-crossed-at-four-widths.md b/issues/granularity-bound-crossed-at-four-widths.md similarity index 100% rename from issues/kernel/granularity-bound-crossed-at-four-widths.md rename to issues/granularity-bound-crossed-at-four-widths.md diff --git a/issues/kernel/handle-kill-policy-census-grew-one-sharedmem-on-two-nightlies.md b/issues/handle-kill-policy-census-grew-one-sharedmem-on-two-nightlies.md similarity index 93% rename from issues/kernel/handle-kill-policy-census-grew-one-sharedmem-on-two-nightlies.md rename to issues/handle-kill-policy-census-grew-one-sharedmem-on-two-nightlies.md index 66e077b2806..8de28e17338 100644 --- a/issues/kernel/handle-kill-policy-census-grew-one-sharedmem-on-two-nightlies.md +++ b/issues/handle-kill-policy-census-grew-one-sharedmem-on-two-nightlies.md @@ -26,7 +26,7 @@ Dev host, QEMU 11.1.1, TCG, one named run each: `nightly-green2` at 877b8c95, What is known: every holder the test kills holds one `SharedMem` region and one pipe, and `settled_census` answers once two readings 10 ms apart agree. The mechanism -`issues/kernel/deferred-release-outlives-its-syscall.md` records is a release +`issues/deferred-release-outlives-its-syscall.md` records is a release still in flight on another CPU when both readings are taken. That would read exactly like this: one killed holder's region is not yet released at the second census. The red boot's kernel reports a TLB shootdown wait of up to @@ -40,7 +40,7 @@ reports `tlb: shootdowns=89 wait=354978us max=66850us`. The branch changes no kernel or guest code. **Exit condition.** A killed process's deferred releases finish before `wait` -returns, the fix `issues/kernel/deferred-release-outlives-its-syscall.md` +returns, the fix `issues/deferred-release-outlives-its-syscall.md` names under "What to do", and `handle_kill_policy` green on the KVM `guest` shards where it went red. Owner: orchestrator. diff --git a/issues/build/hard-lockup-bound-ms-is-read-by-nothing-but-its-own-assertion.md b/issues/hard-lockup-bound-ms-is-read-by-nothing-but-its-own-assertion.md similarity index 93% rename from issues/build/hard-lockup-bound-ms-is-read-by-nothing-but-its-own-assertion.md rename to issues/hard-lockup-bound-ms-is-read-by-nothing-but-its-own-assertion.md index ed439769404..10287d4472c 100644 --- a/issues/build/hard-lockup-bound-ms-is-read-by-nothing-but-its-own-assertion.md +++ b/issues/hard-lockup-bound-ms-is-read-by-nothing-but-its-own-assertion.md @@ -19,7 +19,7 @@ alone. ## Owner -`issues/hardware/a-frozen-toyos-waits-for-a-hand-on-the-power-button.md`, the +`issues/a-frozen-toyos-waits-for-a-hand-on-the-power-button.md`, the track that arms the hard-lockup detector on every boot. ## What would close it diff --git a/issues/audio/hda-client-stall-prints-a-stream-error-and-passes.md b/issues/hda-client-stall-prints-a-stream-error-and-passes.md similarity index 100% rename from issues/audio/hda-client-stall-prints-a-stream-error-and-passes.md rename to issues/hda-client-stall-prints-a-stream-error-and-passes.md diff --git a/issues/audio/hda-has-no-jack-detection-volume-or-keys.md b/issues/hda-has-no-jack-detection-volume-or-keys.md similarity index 96% rename from issues/audio/hda-has-no-jack-detection-volume-or-keys.md rename to issues/hda-has-no-jack-detection-volume-or-keys.md index 0290c36850e..234ec8c0860 100644 --- a/issues/audio/hda-has-no-jack-detection-volume-or-keys.md +++ b/issues/hda-has-no-jack-detection-volume-or-keys.md @@ -25,7 +25,7 @@ blocked on nothing: - **Volume keys.** The premise was never established either — the diagnostic that would say what the T14's keyboard sends for them was never committed. - **Persistence** of the chosen output and level, blocked on the kernel keeping - anything it enumerates (`issues/diagnostics/the-kernel-keeps-nothing-it-enumerates.md`). + anything it enumerates (`issues/the-kernel-keeps-nothing-it-enumerates.md`). **Two pieces of the shipped work are still owed a verdict.** The four HDA sections of the audio baseline were never recorded, so the HDA arm asserts harm diff --git a/issues/audio/hda-ring-fix-unverified-on-metal.md b/issues/hda-ring-fix-unverified-on-metal.md similarity index 100% rename from issues/audio/hda-ring-fix-unverified-on-metal.md rename to issues/hda-ring-fix-unverified-on-metal.md diff --git a/issues/build/host-scale-reads-host-speed-off-boots-that-stop-at-different-markers.md b/issues/host-scale-reads-host-speed-off-boots-that-stop-at-different-markers.md similarity index 95% rename from issues/build/host-scale-reads-host-speed-off-boots-that-stop-at-different-markers.md rename to issues/host-scale-reads-host-speed-off-boots-that-stop-at-different-markers.md index d4dfce6f0bc..79ad877beed 100644 --- a/issues/build/host-scale-reads-host-speed-off-boots-that-stop-at-different-markers.md +++ b/issues/host-scale-reads-host-speed-off-boots-that-stop-at-different-markers.md @@ -34,7 +34,7 @@ The whole suite at `e5daa61ff`, 12 wide on the same host, read 566 ms and paid ## Owner -`issues/build/the-tooling-is-a-review-prompt-and-three-workflows.md`, whose +`issues/the-tooling-is-a-review-prompt-and-three-workflows.md`, whose harness item keeps a piece of the harness only where it sees what reading cannot. diff --git a/issues/hardware/hotplug-blocks-a-scheduler-pass.md b/issues/hotplug-blocks-a-scheduler-pass.md similarity index 90% rename from issues/hardware/hotplug-blocks-a-scheduler-pass.md rename to issues/hotplug-blocks-a-scheduler-pass.md index 283a5166ccd..56dc602b799 100644 --- a/issues/hardware/hotplug-blocks-a-scheduler-pass.md +++ b/issues/hotplug-blocks-a-scheduler-pass.md @@ -17,8 +17,9 @@ The one hardware figure there is says the T14's five boot-time devices took 346 ms including 5×55 ms of port reset, so roughly **14 ms each** for everything `configure` does. That is a scheduler pass of that length on the CPU that services the plug, with preemption disabled under -the `XHCI` lock — the same order as `log_file`'s flush, which `issues/boot-media/` measures at -2.0–9.7 ms and calls out for the same reason. The port reset was the dominant +the `XHCI` lock — the same order as `log_file`'s flush, measured at +2.0–9.7 ms and called out for the same reason; its closing commit `3675af6f7` +carries that measurement. The port reset was the dominant term and is already out of it; taking the rest out means a state machine over the control transfers, which is the whole enumeration path rewritten. diff --git a/issues/kernel/i13s-margin-at-32-cpus-is-down-to-two-milliseconds.md b/issues/i13s-margin-at-32-cpus-is-down-to-two-milliseconds.md similarity index 97% rename from issues/kernel/i13s-margin-at-32-cpus-is-down-to-two-milliseconds.md rename to issues/i13s-margin-at-32-cpus-is-down-to-two-milliseconds.md index 49d41c69f89..864c338eaea 100644 --- a/issues/kernel/i13s-margin-at-32-cpus-is-down-to-two-milliseconds.md +++ b/issues/i13s-margin-at-32-cpus-is-down-to-two-milliseconds.md @@ -7,7 +7,7 @@ opened: 2026-08-24 # I13's margin at 32 CPUs has closed from 10 ms to 2 ms since it was recorded Found while re-running the fairness sweep for -`issues/kernel/granularity-bound-crossed-at-four-widths.md`, not looked for. +`issues/granularity-bound-crossed-at-four-widths.md`, not looked for. `per-process-fair-split-is-the-policy` records the per-thread split as the half that does *not* degrade with width, and prices its own confidence on that: diff --git a/issues/hardware/i8042-mouse-ends-four-packets-short-with-a-clean-exit.md b/issues/i8042-mouse-ends-four-packets-short-with-a-clean-exit.md similarity index 97% rename from issues/hardware/i8042-mouse-ends-four-packets-short-with-a-clean-exit.md rename to issues/i8042-mouse-ends-four-packets-short-with-a-clean-exit.md index 4522d6477b7..06c7929fa09 100644 --- a/issues/hardware/i8042-mouse-ends-four-packets-short-with-a-clean-exit.md +++ b/issues/i8042-mouse-ends-four-packets-short-with-a-clean-exit.md @@ -15,7 +15,7 @@ FAIL i8042_mouse: 872 pointer events reached userland out of 876 packets injecte ``` Earlier sightings of this -message are in `issues/build/parallel-tests-red-under-other-suites.md`'s +message are in `issues/parallel-tests-red-under-other-suites.md`'s `i8042_mouse` entry. ## What is known diff --git a/issues/kernel/idle-cpus-enter-the-c-states-cst-names.md b/issues/idle-cpus-enter-the-c-states-cst-names.md similarity index 86% rename from issues/kernel/idle-cpus-enter-the-c-states-cst-names.md rename to issues/idle-cpus-enter-the-c-states-cst-names.md index fda05c16c34..9bf02f9a298 100644 --- a/issues/kernel/idle-cpus-enter-the-c-states-cst-names.md +++ b/issues/idle-cpus-enter-the-c-states-cst-names.md @@ -8,7 +8,7 @@ opened: 2026-09-29 The kernel runs no `mwait` and reads no `_CST`. The states come from `_CST`, as Linux takes the T14's, after the AML interpreter -`issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md` +`issues/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md` records ToyOS lacks. **Exit**: on the T14, since a KVM guest's idle is its host's: the idle diff --git a/issues/build/idle-stack-guard-price-nearly-doubled-since-its-return.md b/issues/idle-stack-guard-price-nearly-doubled-since-its-return.md similarity index 100% rename from issues/build/idle-stack-guard-price-nearly-doubled-since-its-return.md rename to issues/idle-stack-guard-price-nearly-doubled-since-its-return.md diff --git a/issues/build/idle-stack-guards-returned-arm-reads-a-line-nothing-writes.md b/issues/idle-stack-guards-returned-arm-reads-a-line-nothing-writes.md similarity index 100% rename from issues/build/idle-stack-guards-returned-arm-reads-a-line-nothing-writes.md rename to issues/idle-stack-guards-returned-arm-reads-a-line-nothing-writes.md diff --git a/issues/kernel/indirect-branches-and-returns-run-without-thunks.md b/issues/indirect-branches-and-returns-run-without-thunks.md similarity index 95% rename from issues/kernel/indirect-branches-and-returns-run-without-thunks.md rename to issues/indirect-branches-and-returns-run-without-thunks.md index 45b3f614171..1ae2447da63 100644 --- a/issues/kernel/indirect-branches-and-returns-run-without-thunks.md +++ b/issues/indirect-branches-and-returns-run-without-thunks.md @@ -15,7 +15,7 @@ return (`arch/x86/kernel/cpu/bugs.c:1125`) or SRSO's safe RET, in its alias form on family 0x19 (`bugs.c:2726-2732`). **Exit**: a gate over `kernel.elf`, on the decoder of -`issues/build/no-gate-decodes-kernel-elfs-instructions.md`, finds no raw +`issues/no-gate-decodes-kernel-elfs-instructions.md`, finds no raw indirect branch or `ret` outside the thunks and entry, an `int3` after each, and every placement Linux's linker script asserts (`arch/x86/kernel/vmlinux.lds.S:510-539`): `retbleed_return_thunk` and `srso_safe_ret` at a line start, the SRSO alias diff --git a/issues/isolation/interrupt-entry-keeps-a-ring-3-ac-flag.md b/issues/interrupt-entry-keeps-a-ring-3-ac-flag.md similarity index 100% rename from issues/isolation/interrupt-entry-keeps-a-ring-3-ac-flag.md rename to issues/interrupt-entry-keeps-a-ring-3-ac-flag.md diff --git a/issues/kernel/interrupt-remapping-refusals-are-unreachable.md b/issues/interrupt-remapping-refusals-are-unreachable.md similarity index 100% rename from issues/kernel/interrupt-remapping-refusals-are-unreachable.md rename to issues/interrupt-remapping-refusals-are-unreachable.md diff --git a/issues/kernel/io-uring-enter-trips-the-one-queue-invariant.md b/issues/io-uring-enter-trips-the-one-queue-invariant.md similarity index 100% rename from issues/kernel/io-uring-enter-trips-the-one-queue-invariant.md rename to issues/io-uring-enter-trips-the-one-queue-invariant.md diff --git a/issues/kernel/kernel-forward-copies-and-fills-are-one-rep-movsb-or-stosb-on-every-cpu.md b/issues/kernel-forward-copies-and-fills-are-one-rep-movsb-or-stosb-on-every-cpu.md similarity index 95% rename from issues/kernel/kernel-forward-copies-and-fills-are-one-rep-movsb-or-stosb-on-every-cpu.md rename to issues/kernel-forward-copies-and-fills-are-one-rep-movsb-or-stosb-on-every-cpu.md index 0fc1863ff7b..cddf1a57571 100644 --- a/issues/kernel/kernel-forward-copies-and-fills-are-one-rep-movsb-or-stosb-on-every-cpu.md +++ b/issues/kernel-forward-copies-and-fills-are-one-rep-movsb-or-stosb-on-every-cpu.md @@ -23,7 +23,7 @@ refused. Zen 2 lacks ERMS (a Ryzen 9 PRO 3900, family 0x17, reads EBX machine is family 0x17. **Exit**: a gate over `kernel.elf`, on the decoder of -`issues/build/no-gate-decodes-kernel-elfs-instructions.md`, finds `memcpy`, +`issues/no-gate-decodes-kernel-elfs-instructions.md`, finds `memcpy`, `memset` and `memmove`'s forward branch each one `rep movsb` or `rep stosb`, with no `rep movsq` or `rep stosq`; the T14's pipe figures; and Zen 2's cost recorded, as a family-0x17 figure against the build without `ermsb` or as a diff --git a/issues/kernel/kernel-functions-return-with-their-used-registers-intact.md b/issues/kernel-functions-return-with-their-used-registers-intact.md similarity index 91% rename from issues/kernel/kernel-functions-return-with-their-used-registers-intact.md rename to issues/kernel-functions-return-with-their-used-registers-intact.md index ad26a54bff8..4d0c55f4928 100644 --- a/issues/kernel/kernel-functions-return-with-their-used-registers-intact.md +++ b/issues/kernel-functions-return-with-their-used-registers-intact.md @@ -19,6 +19,6 @@ on the function attribute `zero-call-used-regs` **Exit**: the kernel, `core` and `alloc` build under a rustc option that sets `zero-call-used-regs=used-gpr` on every function, carried in the fork to upstream quality; a gate over `kernel.elf`, on the decoder of -`issues/build/no-gate-decodes-kernel-elfs-instructions.md`, finds each function's used +`issues/no-gate-decodes-kernel-elfs-instructions.md`, finds each function's used call-clobbered general registers zeroed before its return thunk, and a build without the option reds it. diff --git a/issues/kernel/kernel-issues-cite-the-cut-https-tests-as-cover-that-runs.md b/issues/kernel-issues-cite-the-cut-https-tests-as-cover-that-runs.md similarity index 68% rename from issues/kernel/kernel-issues-cite-the-cut-https-tests-as-cover-that-runs.md rename to issues/kernel-issues-cite-the-cut-https-tests-as-cover-that-runs.md index b96b872cc56..e8168961617 100644 --- a/issues/kernel/kernel-issues-cite-the-cut-https-tests-as-cover-that-runs.md +++ b/issues/kernel-issues-cite-the-cut-https-tests-as-cover-that-runs.md @@ -9,18 +9,18 @@ opened: 2026-10-02 `520c0d129` deleted the guest tests `https_tls13` and `https_tls13_e1000e`, and three issues still give one or both as tests that run: -- `issues/kernel/a-claims-own-refusals-are-read-by-nothing.md` -- `issues/kernel/no-boot-reaches-the-refusal-that-keeps-a-bar-read-inside-a-declared-window.md` -- `issues/kernel/no-boot-reaches-the-retry-that-undoes-a-placement-nothing-answered.md` +- `issues/a-claims-own-refusals-are-read-by-nothing.md` +- `issues/no-boot-reaches-the-refusal-that-keeps-a-bar-read-inside-a-declared-window.md` +- `issues/no-boot-reaches-the-retry-that-undoes-a-placement-nothing-answered.md` One citation is cover no tier holds and no track owes. The last two give `https_tls13_e1000e` as what reads `Refusal::BarReferenceEmpty`: its judge asserted how many BARs the boot kept back, and that refusal's words. Outside `kernel/` and `issues/` no file names the refusal, its words or the kept-BAR record, and stage H of -`issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md` lists +`issues/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md` lists that test for its fetch alone, on a line stage 3 of -`issues/design-debt/the-internet-clients-work-unchanged.md` deletes. +`issues/the-internet-clients-work-unchanged.md` deletes. **Exit**: none of the three cites a test of either name that the tree lacks, and `BarReferenceEmpty` has a reader that reds when the refusal goes, or one of diff --git a/issues/build/kernel-loom-without-loom-is-linted-by-no-clippy-run.md b/issues/kernel-loom-without-loom-is-linted-by-no-clippy-run.md similarity index 100% rename from issues/build/kernel-loom-without-loom-is-linted-by-no-clippy-run.md rename to issues/kernel-loom-without-loom-is-linted-by-no-clippy-run.md diff --git a/issues/kernel/kernel-text-is-writable-and-every-kernel-page-executable.md b/issues/kernel-text-is-writable-and-every-kernel-page-executable.md similarity index 100% rename from issues/kernel/kernel-text-is-writable-and-every-kernel-page-executable.md rename to issues/kernel-text-is-writable-and-every-kernel-page-executable.md diff --git a/issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md b/issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md deleted file mode 100644 index 08e1b574abc..00000000000 --- a/issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -status: open -kind: track -opened: 2026-09-29 ---- - -# The kernel is at least as secure as Linux on every machine ToyOS supports - -Parity with Linux at `Ubuntu-6.8.0-142.142`, pinned by the first issue below, -is the floor on every CPU ToyOS supports, and the kernel also takes every -security feature such a CPU offers. The proving machines are the T14 and -AMD EPYC KVM guests; the PR gate's TCG model proves wiring only. A -probe is a `boot-actuators` arm or a `test-actuators` `SYS_DEBUG` action. - -One line of Linux's is declined, and ToyOS stays below it there: the -firmware's memory-overwrite request, by the owner's "Keep crash records" -(`issues/boot-media/the-loader-never-sets-the-firmwares-memory-overwrite-request.md`). - -**Exit**: every issue below is closed, in the order listed. - -- `issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md` -- `issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md` -- `issues/kernel/spec-ctrl-and-gds-stay-as-firmware-left-them.md` -- `issues/kernel/no-program-runs-with-speculative-store-bypass-disabled.md` -- `issues/build/no-gate-decodes-kernel-elfs-instructions.md` -- `issues/kernel/no-entry-or-switch-clears-the-bhb-fills-the-rsb-or-issues-an-ibpb.md` -- `issues/kernel/user-pointer-checks-have-no-spectre-v1-fence-and-smap-is-optional.md` -- `issues/kernel/indirect-branches-and-returns-run-without-thunks.md` -- `issues/kernel/tsx-stays-as-firmware-left-it.md` -- `issues/kernel/the-kernel-loads-no-cpu-microcode.md` -- `issues/kernel/no-user-address-is-drawn-per-spawn.md` -- `issues/kernel/the-kernel-has-no-stack-protector.md` -- `issues/kernel/no-kernel-address-is-drawn-per-boot.md` -- `issues/kernel/every-syscall-runs-at-one-kernel-stack-offset.md` -- `issues/kernel/kernel-functions-return-with-their-used-registers-intact.md` -- `issues/kernel/a-threads-kernel-stack-has-no-guard-page.md` -- `issues/kernel/kernel-text-is-writable-and-every-kernel-page-executable.md` -- `issues/kernel/the-kernel-heap-has-none-of-slubs-hardening.md` -- `issues/kernel/a-device-without-a-domain-of-its-own-reaches-all-memory.md` -- `issues/kernel/user-programs-run-without-a-shadow-stack.md` -- `issues/kernel/the-kernel-runs-without-indirect-branch-tracking.md` -- `issues/kernel/the-kernel-runs-without-a-shadow-stack.md` -- `issues/kernel/user-programs-have-no-protection-keys.md` -- `issues/kernel/programs-hold-aes-keys-as-key-locker-handles.md` -- `issues/kernel/a-split-lock-goes-unnoticed.md` -- `issues/kernel/each-boot-prints-the-vulnerabilities-lines-linux-prints.md` diff --git a/issues/kernel/kernel_stack_addr-names-an-offset-not-an-address.md b/issues/kernel_stack_addr-names-an-offset-not-an-address.md similarity index 100% rename from issues/kernel/kernel_stack_addr-names-an-offset-not-an-address.md rename to issues/kernel_stack_addr-names-an-offset-not-an-address.md diff --git a/issues/design-debt/kernelslice-outlives-its-allocation.md b/issues/kernelslice-outlives-its-allocation.md similarity index 100% rename from issues/design-debt/kernelslice-outlives-its-allocation.md rename to issues/kernelslice-outlives-its-allocation.md diff --git a/issues/build/lan-hold-holds-two-boots-open-for-a-flat-twenty-seconds.md b/issues/lan-hold-holds-two-boots-open-for-a-flat-twenty-seconds.md similarity index 100% rename from issues/build/lan-hold-holds-two-boots-open-for-a-flat-twenty-seconds.md rename to issues/lan-hold-holds-two-boots-open-for-a-flat-twenty-seconds.md diff --git a/issues/build/lan-talk-host-closes-judges-a-fixed-ten-second-window.md b/issues/lan-talk-host-closes-judges-a-fixed-ten-second-window.md similarity index 100% rename from issues/build/lan-talk-host-closes-judges-a-fixed-ten-second-window.md rename to issues/lan-talk-host-closes-judges-a-fixed-ten-second-window.md diff --git a/issues/build/libc-answers-einval-for-every-error-it-does-not-name.md b/issues/libc-answers-einval-for-every-error-it-does-not-name.md similarity index 100% rename from issues/build/libc-answers-einval-for-every-error-it-does-not-name.md rename to issues/libc-answers-einval-for-every-error-it-does-not-name.md diff --git a/issues/build/libc-close-of-a-socket-ends-the-process.md b/issues/libc-close-of-a-socket-ends-the-process.md similarity index 100% rename from issues/build/libc-close-of-a-socket-ends-the-process.md rename to issues/libc-close-of-a-socket-ends-the-process.md diff --git a/issues/build/libc-dl-iterate-phdr-allocates-on-every-walk.md b/issues/libc-dl-iterate-phdr-allocates-on-every-walk.md similarity index 100% rename from issues/build/libc-dl-iterate-phdr-allocates-on-every-walk.md rename to issues/libc-dl-iterate-phdr-allocates-on-every-walk.md diff --git a/issues/build/libc-dlsym-rtld-default-panics-as-unimplemented.md b/issues/libc-dlsym-rtld-default-panics-as-unimplemented.md similarity index 91% rename from issues/build/libc-dlsym-rtld-default-panics-as-unimplemented.md rename to issues/libc-dlsym-rtld-default-panics-as-unimplemented.md index 824956cdc9f..a669180af70 100644 --- a/issues/build/libc-dlsym-rtld-default-panics-as-unimplemented.md +++ b/issues/libc-dlsym-rtld-default-panics-as-unimplemented.md @@ -12,7 +12,7 @@ one, and `SYS_DLSYM` answers from one loaded library by index. Nothing searches the global scope — the executable's exports, then every library in load order — which is what glibc's `dlsym(RTLD_DEFAULT, …)` answers from. A C program that probes the process for an optional symbol dies. The kernel-side sibling is -`issues/kernel/a-dlopened-library-never-binds-to-the-executables-exports.md`: +`issues/a-dlopened-library-never-binds-to-the-executables-exports.md`: both want the executable inside the global scope. **Exit**: `dlsym(RTLD_DEFAULT, name)` answers the first definition of `name` in diff --git a/issues/build/libc-has-no-alarm.md b/issues/libc-has-no-alarm.md similarity index 93% rename from issues/build/libc-has-no-alarm.md rename to issues/libc-has-no-alarm.md index 1a5a26eda49..4b2966567e8 100644 --- a/issues/build/libc-has-no-alarm.md +++ b/issues/libc-has-no-alarm.md @@ -13,7 +13,7 @@ not link without it: rustc's LLVM wrapper linked `-shared -z defs` with the libraries it needs leaves it undefined, beside stage 3's `wait` and `wait4`. POSIX gives `alarm` no refusal, and its `SIGALRM` reaches a handler only through the signals libc imitates from stage 3 of -`issues/kernel/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md` +`issues/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md` on; this waits on that stage. LLVM's `Wait` disarms it with `alarm(0)` and then restores the old `SIGALRM` diff --git a/issues/build/libc-has-no-pread-or-pwrite.md b/issues/libc-has-no-pread-or-pwrite.md similarity index 100% rename from issues/build/libc-has-no-pread-or-pwrite.md rename to issues/libc-has-no-pread-or-pwrite.md diff --git a/issues/build/libc-lacks-names-llvm-for-a-toyos-host-calls.md b/issues/libc-lacks-names-llvm-for-a-toyos-host-calls.md similarity index 91% rename from issues/build/libc-lacks-names-llvm-for-a-toyos-host-calls.md rename to issues/libc-lacks-names-llvm-for-a-toyos-host-calls.md index c8deacd4f37..eab41ae32f8 100644 --- a/issues/build/libc-lacks-names-llvm-for-a-toyos-host-calls.md +++ b/issues/libc-lacks-names-llvm-for-a-toyos-host-calls.md @@ -7,7 +7,7 @@ opened: 2026-10-01 # libc lacks names LLVM for a ToyOS host calls LLVM, clang and lld built for `x86_64-unknown-toyos` -(`issues/build/bootstrap-cannot-build-llvm-clang-and-lld-for-a-toyos-host.md`) +(`issues/bootstrap-cannot-build-llvm-clang-and-lld-for-a-toyos-host.md`) call five names libc neither declares nor defines: - `shm_open` and `shm_unlink`, with which ORC maps memory on every Unix but diff --git a/issues/isolation/libc-loses-the-kernels-word-on-three-write-paths.md b/issues/libc-loses-the-kernels-word-on-three-write-paths.md similarity index 100% rename from issues/isolation/libc-loses-the-kernels-word-on-three-write-paths.md rename to issues/libc-loses-the-kernels-word-on-three-write-paths.md diff --git a/issues/build/libc-printf-ignores-the-alternate-form-flag.md b/issues/libc-printf-ignores-the-alternate-form-flag.md similarity index 100% rename from issues/build/libc-printf-ignores-the-alternate-form-flag.md rename to issues/libc-printf-ignores-the-alternate-form-flag.md diff --git a/issues/build/libc-reads-a-long-double-as-a-double.md b/issues/libc-reads-a-long-double-as-a-double.md similarity index 100% rename from issues/build/libc-reads-a-long-double-as-a-double.md rename to issues/libc-reads-a-long-double-as-a-double.md diff --git a/issues/build/libc-refuses-what-toyos-cannot-yet-answer.md b/issues/libc-refuses-what-toyos-cannot-yet-answer.md similarity index 96% rename from issues/build/libc-refuses-what-toyos-cannot-yet-answer.md rename to issues/libc-refuses-what-toyos-cannot-yet-answer.md index aec0c62ef78..a03b711da53 100644 --- a/issues/build/libc-refuses-what-toyos-cannot-yet-answer.md +++ b/issues/libc-refuses-what-toyos-cannot-yet-answer.md @@ -12,7 +12,7 @@ These answer failure in their POSIX form and do nothing - `link`, `ENOSYS`: no call gives a file a second name. - `symlink`, `ENOSYS`: `SYS_SYMLINK` displaces what its name held - (`issues/filesystem/a-symbolic-link-on-tmp-displaces-its-name-and-lists-nowhere.md`). + (`issues/a-symbolic-link-on-tmp-displaces-its-name-and-lists-nowhere.md`). - `chmod` and `fchmod`, `ENOSYS`: a file has no mode bits to set. - `statvfs` and `fstatvfs`, `ENOSYS`: no call answers a filesystem's size or free space. diff --git a/issues/build/libc-stat-answers-one-serial-number-for-every-file.md b/issues/libc-stat-answers-one-serial-number-for-every-file.md similarity index 100% rename from issues/build/libc-stat-answers-one-serial-number-for-every-file.md rename to issues/libc-stat-answers-one-serial-number-for-every-file.md diff --git a/issues/build/libcxx-is-built-without-std-filesystem.md b/issues/libcxx-is-built-without-std-filesystem.md similarity index 100% rename from issues/build/libcxx-is-built-without-std-filesystem.md rename to issues/libcxx-is-built-without-std-filesystem.md diff --git a/issues/build/libcxx-takes-the-generic-locale-path-on-toyos.md b/issues/libcxx-takes-the-generic-locale-path-on-toyos.md similarity index 100% rename from issues/build/libcxx-takes-the-generic-locale-path-on-toyos.md rename to issues/libcxx-takes-the-generic-locale-path-on-toyos.md diff --git a/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md b/issues/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md similarity index 85% rename from issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md rename to issues/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md index e8c17fb8fe8..2b233e837c2 100644 --- a/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md +++ b/issues/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md @@ -7,17 +7,17 @@ opened: 2026-09-29 # Linux's readings of the T14 and the TCG model lack reads owed before the T14's wipe The floor of -`issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md` +`issues/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md` is tag `Ubuntu-6.8.0-142.142` (53e5d07aac028a1523ab0b115f079d6d1bc831ef) of `https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble`, config sha256 3b8533dd9d235ca634ac58f82c5ce1ee35f12ef620693e17033184d2c9ca5890, and what it reads on the T14 and on the TCG model are the fixtures -of `issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md`, +of `issues/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md`, `toyos-cpuvuln/fixtures/`'s `t14.txt`, `t14/` and `tcg/`; `the_t14s_facts_are_linuxs_reading_of_it` and `the_tcg_models_signature_gives_its_lines` hold `T14` and `TCG` to them. Ubuntu leaves the T14 only after this issue and -`issues/hardware/no-program-measures-toyos-against-linux-on-one-machine.md` +`issues/no-program-measures-toyos-against-linux-on-one-machine.md` close. **Exit**: before the wipe the T14's readings add CPUID 5, 0x19 and @@ -31,7 +31,7 @@ reads it. **Oracle**: that Linux. ## Linux's counter readings, read 2026-10-03 The orchestrator takes this Linux as the one independent oracle for the T14's -hardware counters (`issues/diagnostics/toyos-explains-itself.md`). Read as +hardware counters (`issues/toyos-explains-itself.md`). Read as root under Ubuntu's `6.8.0-142-generic` from 16:22:37 UTC, one after the other, and committed whole with their commands in the `SOURCE` beside them: turbostat idle and under one `yes` per CPU in `tests/t14-linux/`, which diff --git a/issues/filesystem/listing-home-answers-not-found-and-its-bound-has-no-guest-test.md b/issues/listing-home-answers-not-found-and-its-bound-has-no-guest-test.md similarity index 100% rename from issues/filesystem/listing-home-answers-not-found-and-its-bound-has-no-guest-test.md rename to issues/listing-home-answers-not-found-and-its-bound-has-no-guest-test.md diff --git a/issues/build/lld-beside-an-external-llvm-config-is-carried-without-an-upstream-pr.md b/issues/lld-beside-an-external-llvm-config-is-carried-without-an-upstream-pr.md similarity index 100% rename from issues/build/lld-beside-an-external-llvm-config-is-carried-without-an-upstream-pr.md rename to issues/lld-beside-an-external-llvm-config-is-carried-without-an-upstream-pr.md diff --git a/issues/filesystem/log-flush-retry-deadman-arm.md b/issues/log-flush-retry-deadman-arm.md similarity index 100% rename from issues/filesystem/log-flush-retry-deadman-arm.md rename to issues/log-flush-retry-deadman-arm.md diff --git a/issues/build/log-reserve-window-negative-times-out-beside-other-guests.md b/issues/log-reserve-window-negative-times-out-beside-other-guests.md similarity index 91% rename from issues/build/log-reserve-window-negative-times-out-beside-other-guests.md rename to issues/log-reserve-window-negative-times-out-beside-other-guests.md index c07e03e7f93..64dfc57323f 100644 --- a/issues/build/log-reserve-window-negative-times-out-beside-other-guests.md +++ b/issues/log-reserve-window-negative-times-out-beside-other-guests.md @@ -17,7 +17,7 @@ log_reserve_window_negative: GREEN — it fails only beside other guests, so its Sched::Parallel is wrong.` Two later runs of the same suite on the same tip were green (322 passed, then 323 passed), and a third run of that session went red on `blocked_dump` instead, which -`issues/build/parallel-tests-red-under-other-suites.md` already carries. Nothing +`issues/parallel-tests-red-under-other-suites.md` already carries. Nothing here investigates the mechanism: `ALONE: GREEN` is the harness naming a hypothesis, and one red at 18x its price is not a rate. @@ -33,4 +33,4 @@ actuator only it armed. `4db54ffa5` then took `log_reserve_window` and and test-runner's `log-gate`, all of which it rode. `blocked_dump`, the other name this file saw red, is deleted too: -`issues/build/parallel-tests-red-under-other-suites.md` records the commit. +`issues/parallel-tests-red-under-other-suites.md` records the commit. diff --git a/issues/kernel/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md b/issues/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md similarity index 96% rename from issues/kernel/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md rename to issues/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md index 12f7240c6dd..eee1bbcd753 100644 --- a/issues/kernel/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md +++ b/issues/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md @@ -18,7 +18,7 @@ nor at a stop, which init sequences through `logd`'s flush. `logd` syncs on an alert or an interval, keeps every boot's first part, and holds each program to an allowance. Severity is an ordered ladder. -The log is a pillar of `issues/diagnostics/toyos-explains-itself.md`. The +The log is a pillar of `issues/toyos-explains-itself.md`. The orchestrator's plan, not ruled: step 1's ring is the reset-surviving region's, and step 2's keys are how a program writes an event. @@ -61,7 +61,7 @@ audio-latency A/B, neither of which is taken today. **5. Preallocated parts.** A part created at its whole length moves no metadata on an append, but the zeros are a burst of writes to the stick, and that burst starves a tone playing beside it -(`issues/audio/a-megabyte-written-to-the-stick-starves-a-tone-beside-it.md`). +(`issues/a-megabyte-written-to-the-stick-starves-a-tone-beside-it.md`). *Exit:* that issue closed, and on the T14 a `METAL` row plays a tone at `underruns=0` while parts are preallocated beside it. diff --git a/issues/boot-media/logkeeper-ends-the-boots-log-on-one-refused-create-and-nothing-durable-says-so.md b/issues/logkeeper-ends-the-boots-log-on-one-refused-create-and-nothing-durable-says-so.md similarity index 100% rename from issues/boot-media/logkeeper-ends-the-boots-log-on-one-refused-create-and-nothing-durable-says-so.md rename to issues/logkeeper-ends-the-boots-log-on-one-refused-create-and-nothing-durable-says-so.md diff --git a/issues/filesystem/logkeeper-flushes-the-records-its-own-refused-flush-made.md b/issues/logkeeper-flushes-the-records-its-own-refused-flush-made.md similarity index 100% rename from issues/filesystem/logkeeper-flushes-the-records-its-own-refused-flush-made.md rename to issues/logkeeper-flushes-the-records-its-own-refused-flush-made.md diff --git a/issues/filesystem/logkeeper-still-says-a-budget-refusal-leaves-the-device-untouched.md b/issues/logkeeper-still-says-a-budget-refusal-leaves-the-device-untouched.md similarity index 100% rename from issues/filesystem/logkeeper-still-says-a-budget-refusal-leaves-the-device-untouched.md rename to issues/logkeeper-still-says-a-budget-refusal-leaves-the-device-untouched.md diff --git a/issues/build/loom-never-races-arc-strong-count-against-a-clone-or-drop.md b/issues/loom-never-races-arc-strong-count-against-a-clone-or-drop.md similarity index 100% rename from issues/build/loom-never-races-arc-strong-count-against-a-clone-or-drop.md rename to issues/loom-never-races-arc-strong-count-against-a-clone-or-drop.md diff --git a/issues/kernel/map-mmio-takes-an-address-past-the-direct-map-window.md b/issues/map-mmio-takes-an-address-past-the-direct-map-window.md similarity index 100% rename from issues/kernel/map-mmio-takes-an-address-past-the-direct-map-window.md rename to issues/map-mmio-takes-an-address-past-the-direct-map-window.md diff --git a/issues/build/memmap2-fork-is-unreachable-code.md b/issues/memmap2-fork-is-unreachable-code.md similarity index 100% rename from issues/build/memmap2-fork-is-unreachable-code.md rename to issues/memmap2-fork-is-unreachable-code.md diff --git a/issues/hardware/metal-device-probe-usbread-answered-iofailed-once-beside-other-guests.md b/issues/metal-device-probe-usbread-answered-iofailed-once-beside-other-guests.md similarity index 100% rename from issues/hardware/metal-device-probe-usbread-answered-iofailed-once-beside-other-guests.md rename to issues/metal-device-probe-usbread-answered-iofailed-once-beside-other-guests.md diff --git a/issues/build/metal-job-reboot-drained-no-kernel-output-beside-other-guests.md b/issues/metal-job-reboot-drained-no-kernel-output-beside-other-guests.md similarity index 100% rename from issues/build/metal-job-reboot-drained-no-kernel-output-beside-other-guests.md rename to issues/metal-job-reboot-drained-no-kernel-output-beside-other-guests.md diff --git a/issues/hardware/metalprobes-usb-read-is-answered-from-fileservers-cache.md b/issues/metalprobes-usb-read-is-answered-from-fileservers-cache.md similarity index 100% rename from issues/hardware/metalprobes-usb-read-is-answered-from-fileservers-cache.md rename to issues/metalprobes-usb-read-is-answered-from-fileservers-cache.md diff --git a/issues/build/mio-deregister-fd-leaves-a-pending-poll-live.md b/issues/mio-deregister-fd-leaves-a-pending-poll-live.md similarity index 100% rename from issues/build/mio-deregister-fd-leaves-a-pending-poll-live.md rename to issues/mio-deregister-fd-leaves-a-pending-poll-live.md diff --git a/issues/design-debt/mio-s-toyos-waker-never-drains-its-pipe.md b/issues/mio-s-toyos-waker-never-drains-its-pipe.md similarity index 100% rename from issues/design-debt/mio-s-toyos-waker-never-drains-its-pipe.md rename to issues/mio-s-toyos-waker-never-drains-its-pipe.md diff --git a/issues/hardware/most-t14-leases-land-one-dhcp-retry-late.md b/issues/most-t14-leases-land-one-dhcp-retry-late.md similarity index 89% rename from issues/hardware/most-t14-leases-land-one-dhcp-retry-late.md rename to issues/most-t14-leases-land-one-dhcp-retry-late.md index 67fd30a0958..d550b67ae4d 100644 --- a/issues/hardware/most-t14-leases-land-one-dhcp-retry-late.md +++ b/issues/most-t14-leases-land-one-dhcp-retry-late.md @@ -21,9 +21,9 @@ OFFER came back, is unmeasured. RFC 2131 §4.1 puts the first retransmission at 4 s, randomized by ±1 s. The network track owns it: netd leaves smoltcp in stage 5 of -`issues/design-debt/toyos-has-its-own-network-stack.md`, whose stage 3 is +`issues/toyos-has-its-own-network-stack.md`, whose stage 3 is `toyos-dhcp`. Stage 6 of -`issues/boot-media/the-loader-does-only-what-must-precede-the-handover.md` +`issues/the-loader-does-only-what-must-precede-the-handover.md` waits on it. **Exit**: netd logs each DISCOVER it sends and each OFFER it receives, and a diff --git a/issues/kernel/msi-and-pin-routing-take-an-x86-vector-and-apic-id.md b/issues/msi-and-pin-routing-take-an-x86-vector-and-apic-id.md similarity index 91% rename from issues/kernel/msi-and-pin-routing-take-an-x86-vector-and-apic-id.md rename to issues/msi-and-pin-routing-take-an-x86-vector-and-apic-id.md index 256298fad60..8c04720f4d6 100644 --- a/issues/kernel/msi-and-pin-routing-take-an-x86-vector-and-apic-id.md +++ b/issues/msi-and-pin-routing-take-an-x86-vector-and-apic-id.md @@ -13,7 +13,7 @@ vector delivered to an xAPIC id. A GICv3 message names an LPI through the ITS (a 32-bit event id, translated to an INTID above 8191) and a redistributor, and neither fits a `u8`. -Owned by stage 6 of `issues/kernel/toyos-runs-on-arm64.md`, which brings up +Owned by stage 6 of `issues/toyos-runs-on-arm64.md`, which brings up the GICv3 ITS for the claimed functions its SMMUv3 translates. **Exit condition**: a PCI function's interrupt is programmed from an diff --git a/issues/build/must-be-cleans-quoted-fault-line-keeps-its-stamp.md b/issues/must-be-cleans-quoted-fault-line-keeps-its-stamp.md similarity index 100% rename from issues/build/must-be-cleans-quoted-fault-line-keeps-its-stamp.md rename to issues/must-be-cleans-quoted-fault-line-keeps-its-stamp.md diff --git a/issues/kernel/mutual-kill-panicked-on-the-t14-with-stdio-slot-1-not-a-log-ring.md b/issues/mutual-kill-panicked-on-the-t14-with-stdio-slot-1-not-a-log-ring.md similarity index 100% rename from issues/kernel/mutual-kill-panicked-on-the-t14-with-stdio-slot-1-not-a-log-ring.md rename to issues/mutual-kill-panicked-on-the-t14-with-stdio-slot-1-not-a-log-ring.md diff --git a/issues/build/n2-does-not-compile-for-toyos.md b/issues/n2-does-not-compile-for-toyos.md similarity index 80% rename from issues/build/n2-does-not-compile-for-toyos.md rename to issues/n2-does-not-compile-for-toyos.md index 5998969a89f..0260bffd7e8 100644 --- a/issues/build/n2-does-not-compile-for-toyos.md +++ b/issues/n2-does-not-compile-for-toyos.md @@ -16,10 +16,10 @@ fork). Read from the source, not built. Its unix arm is `posix_spawn` of `/bin/sh -c ` with `/dev/null` as stdin, a pipe and `waitpid`, so a ToyOS arm waits on what -`issues/build/ninja-runs-every-command-through-a-bin-sh-toyos-does-not-have.md` -and `issues/filesystem/there-is-no-dev-null.md` wait on. +`issues/ninja-runs-every-command-through-a-bin-sh-toyos-does-not-have.md` +and `issues/there-is-no-dev-null.md` wait on. -Owner: `issues/build/toyos-builds-itself.md`, whose M5 builds LLVM in the +Owner: `issues/toyos-builds-itself.md`, whose M5 builds LLVM in the guest. Exit condition: n2 builds for `x86_64-unknown-toyos`, and inside ToyOS it diff --git a/issues/build/needs-actuators-names-lower-sysinfo-bound-as-a-payload-action.md b/issues/needs-actuators-names-lower-sysinfo-bound-as-a-payload-action.md similarity index 100% rename from issues/build/needs-actuators-names-lower-sysinfo-bound-as-a-payload-action.md rename to issues/needs-actuators-names-lower-sysinfo-bound-as-a-payload-action.md diff --git a/issues/kernel/netstack-answers-for-its-name-without-claiming-it.md b/issues/netstack-answers-for-its-name-without-claiming-it.md similarity index 100% rename from issues/kernel/netstack-answers-for-its-name-without-claiming-it.md rename to issues/netstack-answers-for-its-name-without-claiming-it.md diff --git a/issues/design-debt/netstack-holds-a-pending-request-for-a-client-that-left.md b/issues/netstack-holds-a-pending-request-for-a-client-that-left.md similarity index 100% rename from issues/design-debt/netstack-holds-a-pending-request-for-a-client-that-left.md rename to issues/netstack-holds-a-pending-request-for-a-client-that-left.md diff --git a/issues/design-debt/netstack-keeps-receiving-for-a-client-that-closed-its-receive-end.md b/issues/netstack-keeps-receiving-for-a-client-that-closed-its-receive-end.md similarity index 100% rename from issues/design-debt/netstack-keeps-receiving-for-a-client-that-closed-its-receive-end.md rename to issues/netstack-keeps-receiving-for-a-client-that-closed-its-receive-end.md diff --git a/issues/design-debt/netstack-lookup-slots-have-no-per-client-share.md b/issues/netstack-lookup-slots-have-no-per-client-share.md similarity index 100% rename from issues/design-debt/netstack-lookup-slots-have-no-per-client-share.md rename to issues/netstack-lookup-slots-have-no-per-client-share.md diff --git a/issues/design-debt/netstack-passes-every-millisecond-while-a-request-is-pending.md b/issues/netstack-passes-every-millisecond-while-a-request-is-pending.md similarity index 100% rename from issues/design-debt/netstack-passes-every-millisecond-while-a-request-is-pending.md rename to issues/netstack-passes-every-millisecond-while-a-request-is-pending.md diff --git a/issues/hardware/netstack-refused-accept-hung-waiting-for-a-wake-that-never-came.md b/issues/netstack-refused-accept-hung-waiting-for-a-wake-that-never-came.md similarity index 95% rename from issues/hardware/netstack-refused-accept-hung-waiting-for-a-wake-that-never-came.md rename to issues/netstack-refused-accept-hung-waiting-for-a-wake-that-never-came.md index d8ea149c921..517fb84dd02 100644 --- a/issues/hardware/netstack-refused-accept-hung-waiting-for-a-wake-that-never-came.md +++ b/issues/netstack-refused-accept-hung-waiting-for-a-wake-that-never-came.md @@ -30,7 +30,7 @@ Exit condition: the mechanism established from a kept console, fixed, and instead of dropping it, since nothing else in the tree keeps this test's console. -**Owner**: whoever holds `issues/design-debt/toyos-has-its-own-network-stack.md`. +**Owner**: whoever holds `issues/toyos-has-its-own-network-stack.md`. **Its test is deleted**: `7967fba91` took `netd_refused_accept` out, and `git revert 7967fba91` brings it back. diff --git a/issues/hardware/netstack-removes-a-closed-stream-before-its-fin-leaves.md b/issues/netstack-removes-a-closed-stream-before-its-fin-leaves.md similarity index 100% rename from issues/hardware/netstack-removes-a-closed-stream-before-its-fin-leaves.md rename to issues/netstack-removes-a-closed-stream-before-its-fin-leaves.md diff --git a/issues/design-debt/netstack-resolver-asks-a-dead-primary-first-on-every-lookup.md b/issues/netstack-resolver-asks-a-dead-primary-first-on-every-lookup.md similarity index 100% rename from issues/design-debt/netstack-resolver-asks-a-dead-primary-first-on-every-lookup.md rename to issues/netstack-resolver-asks-a-dead-primary-first-on-every-lookup.md diff --git a/issues/isolation/netstack-socket-ids-are-ambient.md b/issues/netstack-socket-ids-are-ambient.md similarity index 100% rename from issues/isolation/netstack-socket-ids-are-ambient.md rename to issues/netstack-socket-ids-are-ambient.md diff --git a/issues/design-debt/netstack-spends-two-poller-slots-per-piped-connection.md b/issues/netstack-spends-two-poller-slots-per-piped-connection.md similarity index 100% rename from issues/design-debt/netstack-spends-two-poller-slots-per-piped-connection.md rename to issues/netstack-spends-two-poller-slots-per-piped-connection.md diff --git a/issues/hardware/netstacks-i219-drops-a-transmit-burst-past-its-ring.md b/issues/netstacks-i219-drops-a-transmit-burst-past-its-ring.md similarity index 95% rename from issues/hardware/netstacks-i219-drops-a-transmit-burst-past-its-ring.md rename to issues/netstacks-i219-drops-a-transmit-burst-past-its-ring.md index 8f56254dea3..a6beb7a3cc6 100644 --- a/issues/hardware/netstacks-i219-drops-a-transmit-burst-past-its-ring.md +++ b/issues/netstacks-i219-drops-a-transmit-burst-past-its-ring.md @@ -29,7 +29,7 @@ on the `lanswapcase` boot: 11, 18 and 23 frames dropped. ## Owner -Stage 2 of `issues/hardware/the-lan-is-not-yet-production-grade.md`, a gigabit +Stage 2 of `issues/the-lan-is-not-yet-production-grade.md`, a gigabit driver that holds. ## Exit diff --git a/issues/diagnostics/netstacks-lease-probe-answers-a-question-its-lines-already-answer.md b/issues/netstacks-lease-probe-answers-a-question-its-lines-already-answer.md similarity index 100% rename from issues/diagnostics/netstacks-lease-probe-answers-a-question-its-lines-already-answer.md rename to issues/netstacks-lease-probe-answers-a-question-its-lines-already-answer.md diff --git a/issues/diagnostics/netstacks-transmit-drop-report-cadence-has-no-deterministic-test.md b/issues/netstacks-transmit-drop-report-cadence-has-no-deterministic-test.md similarity index 100% rename from issues/diagnostics/netstacks-transmit-drop-report-cadence-has-no-deterministic-test.md rename to issues/netstacks-transmit-drop-report-cadence-has-no-deterministic-test.md diff --git a/issues/build/ninja-runs-every-command-through-a-bin-sh-toyos-does-not-have.md b/issues/ninja-runs-every-command-through-a-bin-sh-toyos-does-not-have.md similarity index 84% rename from issues/build/ninja-runs-every-command-through-a-bin-sh-toyos-does-not-have.md rename to issues/ninja-runs-every-command-through-a-bin-sh-toyos-does-not-have.md index c17cd8cb2ba..832be8cb6d9 100644 --- a/issues/build/ninja-runs-every-command-through-a-bin-sh-toyos-does-not-have.md +++ b/issues/ninja-runs-every-command-through-a-bin-sh-toyos-does-not-have.md @@ -15,9 +15,9 @@ nothing establishes that it runs the POSIX shell language build files are written in. Blocked on `posix_spawn`, stage 3 of -`issues/kernel/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md`. +`issues/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md`. Where the path comes from is -`issues/isolation/every-program-sees-only-the-files-it-was-given.md`'s. +`issues/every-program-sees-only-the-files-it-was-given.md`'s. **Exit**: inside ToyOS, Ninja builds a file whose commands chain with `&&`, redirect and quote, through a `/bin/sh` that listens for a quit and relays diff --git a/issues/kernel/no-boot-reaches-the-refusal-that-keeps-a-bar-read-inside-a-declared-window.md b/issues/no-boot-reaches-the-refusal-that-keeps-a-bar-read-inside-a-declared-window.md similarity index 100% rename from issues/kernel/no-boot-reaches-the-refusal-that-keeps-a-bar-read-inside-a-declared-window.md rename to issues/no-boot-reaches-the-refusal-that-keeps-a-bar-read-inside-a-declared-window.md diff --git a/issues/kernel/no-boot-reaches-the-retry-that-undoes-a-placement-nothing-answered.md b/issues/no-boot-reaches-the-retry-that-undoes-a-placement-nothing-answered.md similarity index 100% rename from issues/kernel/no-boot-reaches-the-retry-that-undoes-a-placement-nothing-answered.md rename to issues/no-boot-reaches-the-retry-that-undoes-a-placement-nothing-answered.md diff --git a/issues/panic-path/no-console-between-boot-and-terminal.md b/issues/no-console-between-boot-and-terminal.md similarity index 96% rename from issues/panic-path/no-console-between-boot-and-terminal.md rename to issues/no-console-between-boot-and-terminal.md index 1cc33c45b14..2822fcd0898 100644 --- a/issues/panic-path/no-console-between-boot-and-terminal.md +++ b/issues/no-console-between-boot-and-terminal.md @@ -71,4 +71,4 @@ a line is one display row or two and therefore whether it is on the page the checkpoint paints. The cheap fix is to render the sequence as a single `-`; the honest one is to keep non-ASCII out of `log!`. -`screen_diag_boot` is deleted; `issues/boot-media/screen-diag-boot-leaves-no-i8042-line-on-the-panel.md` records the commit that restores it. +`screen_diag_boot` is deleted; `issues/screen-diag-boot-leaves-no-i8042-line-on-the-panel.md` records the commit that restores it. diff --git a/issues/kernel/no-entry-or-switch-clears-the-bhb-fills-the-rsb-or-issues-an-ibpb.md b/issues/no-entry-or-switch-clears-the-bhb-fills-the-rsb-or-issues-an-ibpb.md similarity index 81% rename from issues/kernel/no-entry-or-switch-clears-the-bhb-fills-the-rsb-or-issues-an-ibpb.md rename to issues/no-entry-or-switch-clears-the-bhb-fills-the-rsb-or-issues-an-ibpb.md index 8e716f8e4b5..2a3bef40fa6 100644 --- a/issues/kernel/no-entry-or-switch-clears-the-bhb-fills-the-rsb-or-issues-an-ibpb.md +++ b/issues/no-entry-or-switch-clears-the-bhb-fills-the-rsb-or-issues-an-ibpb.md @@ -14,13 +14,13 @@ selects the BHI loop (`arch/x86/entry/entry_64.S:1534`), (`arch/x86/include/asm/nospec-branch.h:151`), and an IBPB on a switch between address spaces one of which asked for it (`arch/x86/mm/tlb.c:384`). In ToyOS the ask is the flag of -`issues/kernel/no-program-runs-with-speculative-store-bypass-disabled.md`. +`issues/no-program-runs-with-speculative-store-bypass-disabled.md`. **Exit**: a gate over `kernel.elf`, on the decoder of -`issues/build/no-gate-decodes-kernel-elfs-instructions.md`, matches it against +`issues/no-gate-decodes-kernel-elfs-instructions.md`, matches it against both of Linux's sequences; on every proving machine probes count what -`issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md` +`issues/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md` selects for it: a clear per syscall where it selects the loop, a fill per switch where it selects filling, and two IBPBs over B, C, idle, B, A, idle, A, B. **Mutation**: either sequence edited, the clear's condition inverted, no diff --git a/issues/build/no-gate-decodes-kernel-elfs-instructions.md b/issues/no-gate-decodes-kernel-elfs-instructions.md similarity index 76% rename from issues/build/no-gate-decodes-kernel-elfs-instructions.md rename to issues/no-gate-decodes-kernel-elfs-instructions.md index 80f3d6547e2..330c1096940 100644 --- a/issues/build/no-gate-decodes-kernel-elfs-instructions.md +++ b/issues/no-gate-decodes-kernel-elfs-instructions.md @@ -8,11 +8,11 @@ opened: 2026-09-29 Five stages each owe a gate over `kernel.elf`'s instructions: -- `issues/kernel/no-entry-or-switch-clears-the-bhb-fills-the-rsb-or-issues-an-ibpb.md` -- `issues/kernel/indirect-branches-and-returns-run-without-thunks.md` -- `issues/kernel/kernel-functions-return-with-their-used-registers-intact.md` -- `issues/kernel/the-kernel-runs-without-indirect-branch-tracking.md` -- `issues/kernel/kernel-forward-copies-and-fills-are-one-rep-movsb-or-stosb-on-every-cpu.md` +- `issues/no-entry-or-switch-clears-the-bhb-fills-the-rsb-or-issues-an-ibpb.md` +- `issues/indirect-branches-and-returns-run-without-thunks.md` +- `issues/kernel-functions-return-with-their-used-registers-intact.md` +- `issues/the-kernel-runs-without-indirect-branch-tracking.md` +- `issues/kernel-forward-copies-and-fills-are-one-rep-movsb-or-stosb-on-every-cpu.md` The five share one x86-64 decoder, in Rust in the tree and run by the host gate, with no external disassembler: it lands before any of them, and each adds diff --git a/issues/kernel/no-kernel-address-is-drawn-per-boot.md b/issues/no-kernel-address-is-drawn-per-boot.md similarity index 90% rename from issues/kernel/no-kernel-address-is-drawn-per-boot.md rename to issues/no-kernel-address-is-drawn-per-boot.md index e134d1994b5..7018a2a514b 100644 --- a/issues/kernel/no-kernel-address-is-drawn-per-boot.md +++ b/issues/no-kernel-address-is-drawn-per-boot.md @@ -16,5 +16,5 @@ and a direct map placed at PUD granularity. **Exit**: on every proving machine, over 64 boots in a test, each claimed bit is set 12 to 52 times, the guard of -`issues/kernel/the-kernel-has-no-stack-protector.md` and the first spawn's +`issues/the-kernel-has-no-stack-protector.md` and the first spawn's bases included. **Mutation**: a fixed base. **Oracle**: Linux's bits. diff --git a/issues/build/no-kvm-runner-has-had-its-cpuid-and-vulnerability-lines-captured.md b/issues/no-kvm-runner-has-had-its-cpuid-and-vulnerability-lines-captured.md similarity index 100% rename from issues/build/no-kvm-runner-has-had-its-cpuid-and-vulnerability-lines-captured.md rename to issues/no-kvm-runner-has-had-its-cpuid-and-vulnerability-lines-captured.md diff --git a/issues/isolation/no-physical-memory-fairness.md b/issues/no-physical-memory-fairness.md similarity index 100% rename from issues/isolation/no-physical-memory-fairness.md rename to issues/no-physical-memory-fairness.md diff --git a/issues/hardware/no-program-measures-toyos-against-linux-on-one-machine.md b/issues/no-program-measures-toyos-against-linux-on-one-machine.md similarity index 100% rename from issues/hardware/no-program-measures-toyos-against-linux-on-one-machine.md rename to issues/no-program-measures-toyos-against-linux-on-one-machine.md diff --git a/issues/kernel/no-program-runs-with-speculative-store-bypass-disabled.md b/issues/no-program-runs-with-speculative-store-bypass-disabled.md similarity index 87% rename from issues/kernel/no-program-runs-with-speculative-store-bypass-disabled.md rename to issues/no-program-runs-with-speculative-store-bypass-disabled.md index 75e8fe7a229..9ef087e7da4 100644 --- a/issues/kernel/no-program-runs-with-speculative-store-bypass-disabled.md +++ b/issues/no-program-runs-with-speculative-store-bypass-disabled.md @@ -13,6 +13,6 @@ The kernel never sets SSBD, so no process can have it. Linux at **Exit**: on every proving machine a flagged program runs with SSBD set, through the control -`issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md` +`issues/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md` names for its CPU, and so does its child, while an unflagged one runs with it clear. **Mutation**: no inheritance. **Oracle**: the CPU's own register. diff --git a/issues/kernel/no-test-can-hold-a-thread-on-a-named-cpu.md b/issues/no-test-can-hold-a-thread-on-a-named-cpu.md similarity index 100% rename from issues/kernel/no-test-can-hold-a-thread-on-a-named-cpu.md rename to issues/no-test-can-hold-a-thread-on-a-named-cpu.md diff --git a/issues/build/no-test-covers-the-pid-in-a-keystore-records-temp-name.md b/issues/no-test-covers-the-pid-in-a-keystore-records-temp-name.md similarity index 100% rename from issues/build/no-test-covers-the-pid-in-a-keystore-records-temp-name.md rename to issues/no-test-covers-the-pid-in-a-keystore-records-temp-name.md diff --git a/issues/kernel/no-test-reaches-the-device-control-a-reset-clears.md b/issues/no-test-reaches-the-device-control-a-reset-clears.md similarity index 100% rename from issues/kernel/no-test-reaches-the-device-control-a-reset-clears.md rename to issues/no-test-reaches-the-device-control-a-reset-clears.md diff --git a/issues/kernel/no-user-address-is-drawn-per-spawn.md b/issues/no-user-address-is-drawn-per-spawn.md similarity index 100% rename from issues/kernel/no-user-address-is-drawn-per-spawn.md rename to issues/no-user-address-is-drawn-per-spawn.md diff --git a/issues/kernel/nothing-asserts-that-a-claim-answers-no-configuration-write.md b/issues/nothing-asserts-that-a-claim-answers-no-configuration-write.md similarity index 100% rename from issues/kernel/nothing-asserts-that-a-claim-answers-no-configuration-write.md rename to issues/nothing-asserts-that-a-claim-answers-no-configuration-write.md diff --git a/issues/diagnostics/nothing-can-freeze-this-machine-from-outside.md b/issues/nothing-can-freeze-this-machine-from-outside.md similarity index 96% rename from issues/diagnostics/nothing-can-freeze-this-machine-from-outside.md rename to issues/nothing-can-freeze-this-machine-from-outside.md index 41d1ddebdce..51ef7a7b617 100644 --- a/issues/diagnostics/nothing-can-freeze-this-machine-from-outside.md +++ b/issues/nothing-can-freeze-this-machine-from-outside.md @@ -6,7 +6,7 @@ opened: 2026-09-01 # Nothing can freeze the whole machine from outside, so the last case the blocked dump exists for is unreachable -`issues/diagnostics/blocked-dump-cannot-fire-on-a-total-freeze.md` records that +`issues/blocked-dump-cannot-fire-on-a-total-freeze.md` records that the request and service path runs only through `drain_irqs` (`kernel/src/sched/driver.rs:652`), so every trigger the tree owns presupposes a CPU that can still schedule that path. diff --git a/issues/kernel/nothing-charges-kernel-memory-to-a-process.md b/issues/nothing-charges-kernel-memory-to-a-process.md similarity index 97% rename from issues/kernel/nothing-charges-kernel-memory-to-a-process.md rename to issues/nothing-charges-kernel-memory-to-a-process.md index b46fff99fc2..8dd2b4e577b 100644 --- a/issues/kernel/nothing-charges-kernel-memory-to-a-process.md +++ b/issues/nothing-charges-kernel-memory-to-a-process.md @@ -23,7 +23,7 @@ user-string copy has a ceiling. What survives is the *accounting*, which nothing has touched, plus one item: peak memory is written by two paths that overwrite each other. -Accounting is a pillar of `issues/diagnostics/toyos-explains-itself.md`. +Accounting is a pillar of `issues/toyos-explains-itself.md`. Blocked on nothing. Two things worth knowing before it is restarted, because both cost a day to discover: diff --git a/issues/kernel/nothing-fails-when-a-devices-release-or-close-stops-answering-its-polls.md b/issues/nothing-fails-when-a-devices-release-or-close-stops-answering-its-polls.md similarity index 94% rename from issues/kernel/nothing-fails-when-a-devices-release-or-close-stops-answering-its-polls.md rename to issues/nothing-fails-when-a-devices-release-or-close-stops-answering-its-polls.md index 47cccb8b434..219fcd99af1 100644 --- a/issues/kernel/nothing-fails-when-a-devices-release-or-close-stops-answering-its-polls.md +++ b/issues/nothing-fails-when-a-devices-release-or-close-stops-answering-its-polls.md @@ -7,7 +7,7 @@ opened: 2026-09-30 # Nothing fails when a device's release or close stops answering its polls Held by the small-kernel track's stage 6 step 5 -(`issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md`), +(`issues/the-kernel-is-small-interrupts-post-and-threads-wait.md`), whose exit reads it. A device's watch is an `IrqWatch`, and three thread sites answer the polls on diff --git a/issues/kernel/nothing-fails-without-the-timer-stop-before-cpu-off.md b/issues/nothing-fails-without-the-timer-stop-before-cpu-off.md similarity index 94% rename from issues/kernel/nothing-fails-without-the-timer-stop-before-cpu-off.md rename to issues/nothing-fails-without-the-timer-stop-before-cpu-off.md index 45fb33fe79d..7f2c2f4587c 100644 --- a/issues/kernel/nothing-fails-without-the-timer-stop-before-cpu-off.md +++ b/issues/nothing-fails-without-the-timer-stop-before-cpu-off.md @@ -17,7 +17,7 @@ test can fail if the stop is deleted: - A second provider, TF-A under QEMU, needs a C cross-toolchain, which is not a declared host tool. - No AArch64 metal target exists. By the owner's ruling in - `issues/kernel/toyos-runs-on-arm64.md`, no ARM hardware is a target. + `issues/toyos-runs-on-arm64.md`, no ARM hardware is a target. - `SGI_OFF` lands on idle CPUs. An idle CPU with no parked deadline has already stopped its one-shot (`kernel/pure/sched/timer.rs:43`), so deleting the stop changes nothing even on metal in that case. @@ -45,4 +45,4 @@ https://github.com/ToyOSOrg/ToyOS/pull/647#issuecomment-5956924013. is armed, with the deletion mutation red there. Owner: `kernel/src/arch/aarch64/power.rs`'s `cpu_off`, under -`issues/kernel/toyos-runs-on-arm64.md`. +`issues/toyos-runs-on-arm64.md`. diff --git a/issues/diagnostics/nothing-in-the-machine-can-read-the-trace-ring.md b/issues/nothing-in-the-machine-can-read-the-trace-ring.md similarity index 88% rename from issues/diagnostics/nothing-in-the-machine-can-read-the-trace-ring.md rename to issues/nothing-in-the-machine-can-read-the-trace-ring.md index e88fc27e2ce..ab51252be67 100644 --- a/issues/diagnostics/nothing-in-the-machine-can-read-the-trace-ring.md +++ b/issues/nothing-in-the-machine-can-read-the-trace-ring.md @@ -13,7 +13,7 @@ Its one reader is LLDB: `p &TRACE_RINGS` and then `memory read`, which is why the discriminants are fixed by hand and held there by const assertions. A booted machine can ask itself nothing: no syscall, no tool, no gate. -Part of `issues/diagnostics/toyos-explains-itself.md`. +Part of `issues/toyos-explains-itself.md`. **Proposal accepted** (owner, 2026-10-03, "Build it as proposed"): the ring is finished in three steps, and the work then stops and is judged before @@ -38,9 +38,9 @@ anything more is built on it. trace. A system call held past the threshold in a shipped-configuration kernel reads back from the trace with its number and its program. A window's record names its opener by address, which - `issues/kernel/the-cpu-that-spawns-a-toybox-applet-reads-1-4-ms-of-interrupts-and-preemption-off-on-the-t14.md` + `issues/the-cpu-that-spawns-a-toybox-applet-reads-1-4-ms-of-interrupts-and-preemption-off-on-the-t14.md` and - `issues/kernel/the-supervisors-claim-of-a-pci-function-the-t14-lacks-holds-interrupts-off-for-3-8-ms.md` + `issues/the-supervisors-claim-of-a-pci-function-the-t14-lacks-holds-interrupts-off-for-3-8-ms.md` need. **Ruled** (owner, 2026-10-04), on when these steps start, **"Both in @@ -48,8 +48,8 @@ parallel"**: "Start the trace diary's first steps now, beside latency step 1 (interrupts on in system calls). Step 1 is already measured by existing T14 rows. The tail delays are only worked on once the diary shows their cause." The step he names is step 2 of -`issues/kernel/toyos-beats-linuxs-latency-on-the-t14.md`, -`issues/kernel/syscall-preemption-is-incidental.md`; that mapping is the +`issues/toyos-beats-linuxs-latency-on-the-t14.md`, +`issues/syscall-preemption-is-incidental.md`; that mapping is the orchestrator's, not his. Behind that judgement, and not before it: interrupt enter and exit records diff --git a/issues/panic-path/nothing-judges-that-an-aarch64-panic-resets-at-its-bound.md b/issues/nothing-judges-that-an-aarch64-panic-resets-at-its-bound.md similarity index 97% rename from issues/panic-path/nothing-judges-that-an-aarch64-panic-resets-at-its-bound.md rename to issues/nothing-judges-that-an-aarch64-panic-resets-at-its-bound.md index e67d0090ce8..ba107afd964 100644 --- a/issues/panic-path/nothing-judges-that-an-aarch64-panic-resets-at-its-bound.md +++ b/issues/nothing-judges-that-an-aarch64-panic-resets-at-its-bound.md @@ -37,4 +37,4 @@ instead of resetting, once one boot can shorten the bound, or on the owner's word that the row is worth its 60 s. Owner: `kernel/src/panic_reboot.rs`, under -`issues/kernel/toyos-runs-on-arm64.md`. +`issues/toyos-runs-on-arm64.md`. diff --git a/issues/build/nothing-launches-a-script-by-its-interpreter-line.md b/issues/nothing-launches-a-script-by-its-interpreter-line.md similarity index 90% rename from issues/build/nothing-launches-a-script-by-its-interpreter-line.md rename to issues/nothing-launches-a-script-by-its-interpreter-line.md index 41aa5f986dd..c25749c1ce9 100644 --- a/issues/build/nothing-launches-a-script-by-its-interpreter-line.md +++ b/issues/nothing-launches-a-script-by-its-interpreter-line.md @@ -13,7 +13,7 @@ above the kernel reads the line: `git grep -n -e '"#!"' -e ENOEXEC -- kernel userland toyos toyos-abi` finds only `ENOEXEC`'s definition in `userland/libc/include/errno.h`. -Owner: `issues/build/toyos-builds-itself.md`, whose tools (a POSIX `sh`, Perl, +Owner: `issues/toyos-builds-itself.md`, whose tools (a POSIX `sh`, Perl, make, CMake) are the first programs here that start a script by its path. Exit condition: inside ToyOS, a spawn by path of an executable file whose diff --git a/issues/kernel/nothing-reaches-the-msi-refusal-arms-of-a-claimed-function.md b/issues/nothing-reaches-the-msi-refusal-arms-of-a-claimed-function.md similarity index 100% rename from issues/kernel/nothing-reaches-the-msi-refusal-arms-of-a-claimed-function.md rename to issues/nothing-reaches-the-msi-refusal-arms-of-a-claimed-function.md diff --git a/issues/filesystem/nothing-reclaims-what-a-stop-leaves-on-a-fat-volume.md b/issues/nothing-reclaims-what-a-stop-leaves-on-a-fat-volume.md similarity index 100% rename from issues/filesystem/nothing-reclaims-what-a-stop-leaves-on-a-fat-volume.md rename to issues/nothing-reclaims-what-a-stop-leaves-on-a-fat-volume.md diff --git a/issues/kernel/nothing-reds-when-the-bar-survey-drops-an-assigned-bar.md b/issues/nothing-reds-when-the-bar-survey-drops-an-assigned-bar.md similarity index 100% rename from issues/kernel/nothing-reds-when-the-bar-survey-drops-an-assigned-bar.md rename to issues/nothing-reds-when-the-bar-survey-drops-an-assigned-bar.md diff --git a/issues/filesystem/nothing-reopens-a-diskserver-session-over-a-used-page.md b/issues/nothing-reopens-a-diskserver-session-over-a-used-page.md similarity index 95% rename from issues/filesystem/nothing-reopens-a-diskserver-session-over-a-used-page.md rename to issues/nothing-reopens-a-diskserver-session-over-a-used-page.md index 26322aa9057..c03cc56c4e1 100644 --- a/issues/filesystem/nothing-reopens-a-diskserver-session-over-a-used-page.md +++ b/issues/nothing-reopens-a-diskserver-session-over-a-used-page.md @@ -28,7 +28,7 @@ that runs reopens a session over a used page: blockd under its client, and no guest test or metal row ends blockd. **Exit**: the restart test that Stage D of -`issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md` owes +`issues/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md` owes for `blockd_survives_its_death`, at the tier that stage builds it on: red with that `Io` under a mutation that moves blockd's two stores after its answer, and green without it. diff --git a/issues/audio/null-sink-applies-one-connect.md b/issues/null-sink-applies-one-connect.md similarity index 97% rename from issues/audio/null-sink-applies-one-connect.md rename to issues/null-sink-applies-one-connect.md index 9d4ab0bb7b6..a2b0f21b38c 100644 --- a/issues/audio/null-sink-applies-one-connect.md +++ b/issues/null-sink-applies-one-connect.md @@ -52,7 +52,7 @@ registration is on the command pipe, which soundd owns both ends of and nobody closes. **What settles it on the next T14 boot: Ctrl+Alt+D on the wedged machine.** The -dump is machine-wide and process-named now (`issues/diagnostics/`), so one press answers the split +dump is machine-wide and process-named now, so one press answers the split directly. soundd's mix thread parked with a sane deadline says the timer did not fire; parked with an absurd one says the timeout was computed wrong; absent from every parked list says nothing ever held it, which would move this into diff --git a/issues/build/one-checkout-of-one-tree-builds-two-kernels.md b/issues/one-checkout-of-one-tree-builds-two-kernels.md similarity index 95% rename from issues/build/one-checkout-of-one-tree-builds-two-kernels.md rename to issues/one-checkout-of-one-tree-builds-two-kernels.md index 67e4dc2a1d8..382a17f95c6 100644 --- a/issues/build/one-checkout-of-one-tree-builds-two-kernels.md +++ b/issues/one-checkout-of-one-tree-builds-two-kernels.md @@ -31,7 +31,7 @@ The empty directories' kernel and `2593c71c…` differ in `.symtab` and `.strtab` and in no other section: 121 of 6419 symbol names, each in its `.llvm.` suffix alone, ten of the 261 suffixes the kernel carries. It is the suffix -`issues/build/two-checkouts-of-one-tree-build-different-guest-bytes.md` +`issues/two-checkouts-of-one-tree-build-different-guest-bytes.md` measures across checkout paths; that issue's exit builds two clean checkouts and would not see this one. @@ -44,7 +44,7 @@ What it costs: an image's signed header names the kernel file, symbol table and all, so a reading taken on a machine names the bytes of one build, and the next build of the same sources may carry others: a metal reading reaches a later head by its bytes only where the builds that preceded the booted image -are replayed. `issues/build/toyos-builds-itself.md`'s M4 compares a guest +are replayed. `issues/toyos-builds-itself.md`'s M4 compares a guest build against "the host build of the same commit", and of this kernel a host has built three. diff --git a/issues/filesystem/one-diskserver-session-can-hold-every-device-slot.md b/issues/one-diskserver-session-can-hold-every-device-slot.md similarity index 100% rename from issues/filesystem/one-diskserver-session-can-hold-every-device-slot.md rename to issues/one-diskserver-session-can-hold-every-device-slot.md diff --git a/issues/build/one-failed-request-for-the-crates-io-token-reds-a-publish-run.md b/issues/one-failed-request-for-the-crates-io-token-reds-a-publish-run.md similarity index 91% rename from issues/build/one-failed-request-for-the-crates-io-token-reds-a-publish-run.md rename to issues/one-failed-request-for-the-crates-io-token-reds-a-publish-run.md index 12411f54e06..eeb354462af 100644 --- a/issues/build/one-failed-request-for-the-crates-io-token-reds-a-publish-run.md +++ b/issues/one-failed-request-for-the-crates-io-token-reds-a-publish-run.md @@ -18,7 +18,7 @@ again. The next landing's run, 37000495781 at `c1c504835`, was green, and Until the next landing, what that tip changed in the SDK crates is not on crates.io, and the nightly's `release` refuses such a tip -(`issues/build/a-release-that-decides-before-its-tips-crates-are-up-reds-the-nightly.md`). +(`issues/a-release-that-decides-before-its-tips-crates-are-up-reds-the-nightly.md`). Owner: the orchestrator. diff --git a/issues/isolation/one-manifest-row-grants-every-applet-and-one-is-compared.md b/issues/one-manifest-row-grants-every-applet-and-one-is-compared.md similarity index 98% rename from issues/isolation/one-manifest-row-grants-every-applet-and-one-is-compared.md rename to issues/one-manifest-row-grants-every-applet-and-one-is-compared.md index 85547245cf7..86a4dc43f21 100644 --- a/issues/isolation/one-manifest-row-grants-every-applet-and-one-is-compared.md +++ b/issues/one-manifest-row-grants-every-applet-and-one-is-compared.md @@ -10,7 +10,7 @@ opened: 2026-09-01 to `/system/bin/toybox`. Init resolves a symlink to its binary row (`userland/init/src/main.rs:422-441`), so every applet runs with the union of authority that one row grants — -`issues/isolation/toybox-is-one-row-for-every-applet.md`. +`issues/toybox-is-one-row-for-every-applet.md`. **One applet is already checked, and the shape it uses is the right one.** `tests/toyos-rust-tests/src/bin/endowment_denied.rs:39-43` runs `/system/bin/ps` twice, diff --git a/issues/kernel/one-mapping-inventory-nobody-can-read.md b/issues/one-mapping-inventory-nobody-can-read.md similarity index 95% rename from issues/kernel/one-mapping-inventory-nobody-can-read.md rename to issues/one-mapping-inventory-nobody-can-read.md index b01dc531bd1..e3a51579d0d 100644 --- a/issues/kernel/one-mapping-inventory-nobody-can-read.md +++ b/issues/one-mapping-inventory-nobody-can-read.md @@ -6,7 +6,7 @@ opened: 2026-09-01 # No test can read this machine's mappings, so a two-ledger inventory cannot be shown to agree -`issues/kernel/one-mapping-is-written-in-two-ledgers.md` is the subject: address +`issues/one-mapping-is-written-in-two-ledgers.md` is the subject: address space regions live in `AddressSpace.regions` and process mmap metadata lives in `ProcessData.mmap_regions`, and nothing proves the two stay identical across every return edge — including the failure edges, which is where a rollback that diff --git a/issues/kernel/one-mapping-is-written-in-two-ledgers.md b/issues/one-mapping-is-written-in-two-ledgers.md similarity index 100% rename from issues/kernel/one-mapping-is-written-in-two-ledgers.md rename to issues/one-mapping-is-written-in-two-ledgers.md diff --git a/issues/isolation/one-program-can-take-every-file-servers-client-slot.md b/issues/one-program-can-take-every-file-servers-client-slot.md similarity index 100% rename from issues/isolation/one-program-can-take-every-file-servers-client-slot.md rename to issues/one-program-can-take-every-file-servers-client-slot.md diff --git a/issues/filesystem/one-write-far-past-a-files-end-holds-data-s-server.md b/issues/one-write-far-past-a-files-end-holds-data-s-server.md similarity index 91% rename from issues/filesystem/one-write-far-past-a-files-end-holds-data-s-server.md rename to issues/one-write-far-past-a-files-end-holds-data-s-server.md index eed0f5be5d9..48183111d8b 100644 --- a/issues/filesystem/one-write-far-past-a-files-end-holds-data-s-server.md +++ b/issues/one-write-far-past-a-files-end-holds-data-s-server.md @@ -9,7 +9,7 @@ opened: 2026-09-27 fsd takes a `WRITE` at any offset up to `toyos::fs::MAX_FILE_BYTES` (16 TiB), and `Mounted::resolve_or_alloc_block` bridges the gap from the file's end to it by allocating and zeroing every block between -(`issues/filesystem/a-bcachefs-hole-costs-a-block-write-per-page.md` is why). +(`issues/a-bcachefs-hole-costs-a-block-write-per-page.md` is why). fsd is one thread, so the one request runs until the volume is full or the gap is bridged, and every other client of `/apps`, `/config`, `/home` and `/state` waits the whole of it: any program holding `/home` can stop every program's diff --git a/issues/build/only-a-metal-or-debug-run-builds-every-binary-of-the-guest-test-crate.md b/issues/only-a-metal-or-debug-run-builds-every-binary-of-the-guest-test-crate.md similarity index 100% rename from issues/build/only-a-metal-or-debug-run-builds-every-binary-of-the-guest-test-crate.md rename to issues/only-a-metal-or-debug-run-builds-every-binary-of-the-guest-test-crate.md diff --git a/issues/kernel/only-one-allocation-can-be-made-to-fail-and-only-at-one-site.md b/issues/only-one-allocation-can-be-made-to-fail-and-only-at-one-site.md similarity index 97% rename from issues/kernel/only-one-allocation-can-be-made-to-fail-and-only-at-one-site.md rename to issues/only-one-allocation-can-be-made-to-fail-and-only-at-one-site.md index 44abceaabf4..c3c64c76c16 100644 --- a/issues/kernel/only-one-allocation-can-be-made-to-fail-and-only-at-one-site.md +++ b/issues/only-one-allocation-can-be-made-to-fail-and-only-at-one-site.md @@ -44,7 +44,7 @@ not perturb allocator order — proved by showing that with the countdown disabled the allocator's behaviour is byte-for-byte what it was. The result channel is preallocated at arm time, before the failure it exists to report. -`issues/kernel/nothing-charges-kernel-memory-to-a-process.md` holds the terminal +`issues/nothing-charges-kernel-memory-to-a-process.md` holds the terminal state every unbounded grower closes into — who dies when the heap gives out. Whichever of the two lands first, the other's closure runs through this actuator; they are not two answers to one question. diff --git a/issues/design-debt/os-toyos-io-traits-keep-a-posix-name.md b/issues/os-toyos-io-traits-keep-a-posix-name.md similarity index 100% rename from issues/design-debt/os-toyos-io-traits-keep-a-posix-name.md rename to issues/os-toyos-io-traits-keep-a-posix-name.md diff --git a/issues/kernel/page-global-is-a-decision-nobody-has-made.md b/issues/page-global-is-a-decision-nobody-has-made.md similarity index 96% rename from issues/kernel/page-global-is-a-decision-nobody-has-made.md rename to issues/page-global-is-a-decision-nobody-has-made.md index e43cfab717b..3e753abec1f 100644 --- a/issues/kernel/page-global-is-a-decision-nobody-has-made.md +++ b/issues/page-global-is-a-decision-nobody-has-made.md @@ -8,7 +8,7 @@ opened: 2026-08-19 **The owner ruled on 2026-08-20: `PGE` goes on**, sequenced into the interrupt-distribution/scheduler performance era -(`issues/kernel/every-interrupt-lands-on-the-boot-cpu.md`'s wave), never as a +(`issues/every-interrupt-lands-on-the-boot-cpu.md`'s wave), never as a drive-by — because the work below is real: every `Owed::discharge` in `mm/paging.rs` must answer for global translations, `guard_4k`'s local full flush too, the bit joins `control_regs.rs`'s one declaration (never a diff --git a/issues/build/parallel-tests-red-under-other-suites.md b/issues/parallel-tests-red-under-other-suites.md similarity index 98% rename from issues/build/parallel-tests-red-under-other-suites.md rename to issues/parallel-tests-red-under-other-suites.md index 386f8380d6f..82183d05c90 100644 --- a/issues/build/parallel-tests-red-under-other-suites.md +++ b/issues/parallel-tests-red-under-other-suites.md @@ -30,7 +30,7 @@ was the cause; it was evidence that the *boot* differed, which a re-run also changes. - **`i8042_mouse`** — CLOSED 2026-08-06. Both red modes were the harness and - neither was ever the driver losing a packet; `issues/hardware/`'s entry carries the mechanism, + neither was ever the driver losing a packet; its closing commit `f804d4d29` carries the mechanism, the measurements and the two gates that now hold each half. The short version: the pacing lead was 32 packets — 96 bytes — against QEMU's 16-byte `PS2_QUEUE_SIZE`, so a host that got ahead of the guest made QEMU *sum* the @@ -43,7 +43,7 @@ changes. worktree while a second worktree held six of the twelve guest slots: `1003 pointer events reached userland out of 1004 packets injected, never more than 4 of them (12 bytes) outstanding against a 16-byte device queue`. The lead is - inside the bound the fix installed, so the summing mechanism `issues/hardware/` describes is + inside the bound the fix installed, so the summing mechanism above is not what this is. A/B in one session, `git checkout main -- kernel/` in the same tree minutes apart: this branch PASS 33 s first try, **main's kernel FAIL with the identical 1003-of-1004 line**, then PASS 2 s on the harness's own @@ -319,7 +319,7 @@ changes. `screen_loader_lines` and `swap_crash_rolls_back`, then `syscall_window_nmi`. The run's summed QEMU RSS peaked at 5801, 6367 and 6275 MiB on `main` and 7867, 9634 and 10836 MiB on the branch, with no swap in any arm - (`issues/boot-media/root-in-memory-costs-its-whole-size.md`). + (`issues/root-in-memory-costs-its-whole-size.md`). `screen_loader_lines` is the branch's by margin: alone, three runs each, its panel grows 10, 10 and 11 rows for 14 loader lines on `main` and 14, 14 and 14 on the branch, the most the test accepts, and the red arm's GOP-query @@ -342,7 +342,7 @@ changes. init's words on netd ending at `accepted`; and in the further run `metal_job_reboot` reddened, `quiesce_wakes_on_the_last_park`, on a kernel panic at - `arch/tlb.rs:171` (`issues/kernel/a-shootdown-panicked-on-a-cpu-the-host-starved.md`). + `arch/tlb.rs:171` (`issues/a-shootdown-panicked-on-a-cpu-the-host-starved.md`). None investigated. What none of @@ -466,7 +466,7 @@ mechanism for it. A flaky test is deleted at once. Each commit below takes one out: - `metal_job_reboot` — `99ee9625d`, also on - `issues/build/metal-job-reboot-drained-no-kernel-output-beside-other-guests.md`; + `issues/metal-job-reboot-drained-no-kernel-output-beside-other-guests.md`; - `job_deadline_reboots` — `ce4f2965e`; - `swap_netd` and `swap_crash_rolls_back` — `4a60c35c8`; - `launcher_refusals` — `4c191469f`; @@ -480,8 +480,8 @@ A flaky test is deleted at once. Each commit below takes one out: and `log-close-cancels-any-syscap`; - `metal_sim_pointer_churn` — `525e59ad1`; - `blocked_dump` — `0a7fc5f70`, red after its retirement here on the - sightings `issues/build/log-reserve-window-negative-times-out-beside-other-guests.md` - and `issues/build/process-stats-exits-101-beside-other-guests.md` record; + sightings `issues/log-reserve-window-negative-times-out-beside-other-guests.md` + and `issues/process-stats-exits-101-beside-other-guests.md` record; - `metal_sim_input` — `415d9a102`; - `xhci_full_speed_device` — `5e4223525`, with `Profile::MetalFullSpeed`. diff --git a/issues/boot-media/partition-claim-departure-exits-clean-with-none-of-its-refusals-said.md b/issues/partition-claim-departure-exits-clean-with-none-of-its-refusals-said.md similarity index 97% rename from issues/boot-media/partition-claim-departure-exits-clean-with-none-of-its-refusals-said.md rename to issues/partition-claim-departure-exits-clean-with-none-of-its-refusals-said.md index bb94c918608..b4f3c2db92b 100644 --- a/issues/boot-media/partition-claim-departure-exits-clean-with-none-of-its-refusals-said.md +++ b/issues/partition-claim-departure-exits-clean-with-none-of-its-refusals-said.md @@ -46,7 +46,7 @@ An exit of 0 rules out a panic on a wrong assertion (`departure()`'s guest's own logic is not shown to have run into an unexpected state. This is the same family flagged in -`issues/boot-media/partition-claim-gives-up-reds-beside-other-guests-and-is-green-alone.md` +`issues/partition-claim-gives-up-reds-beside-other-guests-and-is-green-alone.md` — same test area, and that file already widens its scope to `partition_claim_departure`. It is filed separately rather than folded in because the failure signature differs: that file's evidence is a kernel-log line count coming up short diff --git a/issues/boot-media/partition-claim-gives-up-reds-beside-other-guests-and-is-green-alone.md b/issues/partition-claim-gives-up-reds-beside-other-guests-and-is-green-alone.md similarity index 98% rename from issues/boot-media/partition-claim-gives-up-reds-beside-other-guests-and-is-green-alone.md rename to issues/partition-claim-gives-up-reds-beside-other-guests-and-is-green-alone.md index 0d4a083f1e9..1ff3c370b48 100644 --- a/issues/boot-media/partition-claim-gives-up-reds-beside-other-guests-and-is-green-alone.md +++ b/issues/partition-claim-gives-up-reds-beside-other-guests-and-is-green-alone.md @@ -45,7 +45,7 @@ above), then `partition_claim_departure`'s `silent` case (`0 flushes were told of the loss, not 1` — its own doc comment names the identical race, "another claim flushes first — logd's `/log`") plus two unrelated `swap_*` names, then 376/376 again, then `syscall_window_nmi` (this repo's other wall-clock-storm -row, `issues/build/parallel-tests-red-under-other-suites.md`) plus this test's +row, `issues/parallel-tests-red-under-other-suites.md`) plus this test's *other* case (`unanswered`). No two of the five runs named the same failing test, and none of the five failures is in a file this round's diff touches (`kernel/src/block.rs`, `device.rs`, `gpt.rs`, `page_cache.rs`, diff --git a/issues/kernel/per-process-fair-split-is-the-policy.md b/issues/per-process-fair-split-is-the-policy.md similarity index 100% rename from issues/kernel/per-process-fair-split-is-the-policy.md rename to issues/per-process-fair-split-is-the-policy.md diff --git a/issues/build/pkg-install-gbaes-launch-client-exits-over-a-child-that-ends-with-it.md b/issues/pkg-install-gbaes-launch-client-exits-over-a-child-that-ends-with-it.md similarity index 90% rename from issues/build/pkg-install-gbaes-launch-client-exits-over-a-child-that-ends-with-it.md rename to issues/pkg-install-gbaes-launch-client-exits-over-a-child-that-ends-with-it.md index e9b5b283778..16811f5b9ac 100644 --- a/issues/build/pkg-install-gbaes-launch-client-exits-over-a-child-that-ends-with-it.md +++ b/issues/pkg-install-gbaes-launch-client-exits-over-a-child-that-ends-with-it.md @@ -6,7 +6,7 @@ opened: 2026-10-02 # pkg_install_gbae's launch client exits over a child that ends with it -`issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md` brings +`issues/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md` brings `pkg_install_gbae` back as a metal row, from `main` before the cut. Its client there, `pkg_launch_gbae`, launches gbae and exits at once. A launched program ends with its launcher, so gbae ends as killed before the compositor counts its diff --git a/issues/kernel/placement-is-blind-to-caches-and-topology.md b/issues/placement-is-blind-to-caches-and-topology.md similarity index 100% rename from issues/kernel/placement-is-blind-to-caches-and-topology.md rename to issues/placement-is-blind-to-caches-and-topology.md diff --git a/issues/kernel/portable-kernel-code-names-the-tsc.md b/issues/portable-kernel-code-names-the-tsc.md similarity index 100% rename from issues/kernel/portable-kernel-code-names-the-tsc.md rename to issues/portable-kernel-code-names-the-tsc.md diff --git a/issues/isolation/probe-mounts-on-a-checksum.md b/issues/probe-mounts-on-a-checksum.md similarity index 96% rename from issues/isolation/probe-mounts-on-a-checksum.md rename to issues/probe-mounts-on-a-checksum.md index 1362003b387..2778dd35527 100644 --- a/issues/isolation/probe-mounts-on-a-checksum.md +++ b/issues/probe-mounts-on-a-checksum.md @@ -17,7 +17,7 @@ it, which is a weaker form of the wrong the designation stamp exists to prevent. Accidental collision is not the risk — random block-0 bytes satisfy 4 bytes of magic, 4 of version and a 32-bit CRC with probability about 2^-64 — and neither is a *genuine* upstream bcachefs volume, which does not begin with ASCII `BCFS` -(this crate shares the name and nothing else; `issues/kernel/`). The risk is a **deliberately +(this crate shares the name and nothing else; `issues/bcachefs-crate-is-not-bcachefs.md`). The risk is a **deliberately crafted block 0** on a disk somebody hands you, which is the metal track's situation exactly. diff --git a/issues/kernel/process-memory-is-2-mib-pages-and-that-caps-the-process-count.md b/issues/process-memory-is-2-mib-pages-and-that-caps-the-process-count.md similarity index 99% rename from issues/kernel/process-memory-is-2-mib-pages-and-that-caps-the-process-count.md rename to issues/process-memory-is-2-mib-pages-and-that-caps-the-process-count.md index ea42633c6c0..11d066e2a44 100644 --- a/issues/kernel/process-memory-is-2-mib-pages-and-that-caps-the-process-count.md +++ b/issues/process-memory-is-2-mib-pages-and-that-caps-the-process-count.md @@ -16,7 +16,7 @@ small data and code segments, and device windows handed to a process — moves to 4 KiB pages. 2 MiB stays where it pays: large mappings, DMA grants, the IOMMU's superpages, the kernel's own mappings. One paging design serves both, on x86-64 and on the ARM64 the tree is kept portable for -(`issues/kernel/toyos-runs-on-arm64.md`). +(`issues/toyos-runs-on-arm64.md`). **The constraint that makes this a track, measured on the T14** (run 29 readback, `PMM: 100/16038MB used` at 11 s with four user processes and three diff --git a/issues/hardware/process-start-skew-on-a-runner.md b/issues/process-start-skew-on-a-runner.md similarity index 100% rename from issues/hardware/process-start-skew-on-a-runner.md rename to issues/process-start-skew-on-a-runner.md diff --git a/issues/build/process-stats-exits-101-beside-other-guests.md b/issues/process-stats-exits-101-beside-other-guests.md similarity index 93% rename from issues/build/process-stats-exits-101-beside-other-guests.md rename to issues/process-stats-exits-101-beside-other-guests.md index a024d03bcfc..aec736b19ca 100644 --- a/issues/build/process-stats-exits-101-beside-other-guests.md +++ b/issues/process-stats-exits-101-beside-other-guests.md @@ -14,7 +14,7 @@ Sched::Parallel is wrong.` It is the third name to do this in three foldings of this branch — `log_reserve_window_negative` and `blocked_dump` were the other two, each a different name on a different run — and nothing in the diff being gated goes near any of them. -`issues/diagnostics/blocked-time-is-invisible-while-the-park-lasts.md` names +`issues/blocked-time-is-invisible-while-the-park-lasts.md` names `process_stats` as where a defect was found, not as a name that flakes, so this is its own entry. Nothing here investigates the mechanism: `ALONE: GREEN` is the harness naming a hypothesis, and one red is not a rate. @@ -36,5 +36,5 @@ fails the arm by name, and `process_stats` passes on the T14's shared boot. **Its test is deleted**, as a flaky test is: `4a5b228d2` took `process_stats` out, and moved the nightly `tcg` job's one test to `empty_dir_stat`. `blocked_dump` is -deleted too: `issues/build/parallel-tests-red-under-other-suites.md` records +deleted too: `issues/parallel-tests-red-under-other-suites.md` records the commit. diff --git a/issues/kernel/programs-hold-aes-keys-as-key-locker-handles.md b/issues/programs-hold-aes-keys-as-key-locker-handles.md similarity index 90% rename from issues/kernel/programs-hold-aes-keys-as-key-locker-handles.md rename to issues/programs-hold-aes-keys-as-key-locker-handles.md index 391fe02e0f3..4fe4658b62a 100644 --- a/issues/kernel/programs-hold-aes-keys-as-key-locker-handles.md +++ b/issues/programs-hold-aes-keys-as-key-locker-handles.md @@ -11,7 +11,7 @@ the kernel loads into every CPU, and encrypts with the handle, so the key itself need not stay in memory. Linux at `Ubuntu-6.8.0-142.142` has none: nothing under its `arch/x86` names Key Locker. It is blocked on its first consumer, a program that keeps an AES key for a session's life, and lands with -it, after `issues/kernel/no-test-can-hold-a-thread-on-a-named-cpu.md`. +it, after `issues/no-test-can-hold-a-thread-on-a-named-cpu.md`. **Exit**: on each proving machine that enumerates CPUID.19H:EBX bits 0 and 4 and ECX bit 1, a handle wrapped on one pinned CPU gives FIPS-197 C.1's diff --git a/issues/hardware/pulling-the-boot-stick-freezes-the-t14.md b/issues/pulling-the-boot-stick-freezes-the-t14.md similarity index 100% rename from issues/hardware/pulling-the-boot-stick-freezes-the-t14.md rename to issues/pulling-the-boot-stick-freezes-the-t14.md diff --git a/issues/build/qemu-drops-console-output-the-harness-is-slow-to-read.md b/issues/qemu-drops-console-output-the-harness-is-slow-to-read.md similarity index 98% rename from issues/build/qemu-drops-console-output-the-harness-is-slow-to-read.md rename to issues/qemu-drops-console-output-the-harness-is-slow-to-read.md index 95eb2e38925..c95daf9a9ff 100644 --- a/issues/build/qemu-drops-console-output-the-harness-is-slow-to-read.md +++ b/issues/qemu-drops-console-output-the-harness-is-slow-to-read.md @@ -37,7 +37,7 @@ makes it likely. file the harness follows and its input through a FIFO, so no write is refused. Twenty runs of it after that change: 18 green; one red was the kernel's TLB shootdown panic on a starved vCPU -(`issues/kernel/a-shootdown-panicked-on-a-cpu-the-host-starved.md`), which +(`issues/a-shootdown-panicked-on-a-cpu-the-host-starved.md`), which killed a `logd` reader thread so it was never let go, and one had `logd` let none of the eight stalled readers go in 90 s while every host guest slot was held by other worktrees, green alone. Neither lost a console line. Once diff --git a/issues/kernel/qemu-passes-compatibility-format-interrupts.md b/issues/qemu-passes-compatibility-format-interrupts.md similarity index 98% rename from issues/kernel/qemu-passes-compatibility-format-interrupts.md rename to issues/qemu-passes-compatibility-format-interrupts.md index 6f30888a152..9bd6f6b849b 100644 --- a/issues/kernel/qemu-passes-compatibility-format-interrupts.md +++ b/issues/qemu-passes-compatibility-format-interrupts.md @@ -108,7 +108,7 @@ differ, and `iommu_discovery` reads the same id back out of the table on both machines — `0x100` at `DST` 47:40 without `EIME` and `0x1` at 63:32 with it. What stays undecided is only whether a destination too wide for the 8-bit field is refused, which needs more than 255 vCPUs -(`issues/kernel/interrupt-remapping-refusals-are-unreachable.md`). +(`issues/interrupt-remapping-refusals-are-unreachable.md`). What is owed meanwhile is that no gate is written as though the harness could decide any of this. diff --git a/issues/kernel/quiesce-wakes-on-the-last-park-gave-up-on-one-thread-beside-the-held-one.md b/issues/quiesce-wakes-on-the-last-park-gave-up-on-one-thread-beside-the-held-one.md similarity index 97% rename from issues/kernel/quiesce-wakes-on-the-last-park-gave-up-on-one-thread-beside-the-held-one.md rename to issues/quiesce-wakes-on-the-last-park-gave-up-on-one-thread-beside-the-held-one.md index 5d41dcf17a3..8c266648179 100644 --- a/issues/kernel/quiesce-wakes-on-the-last-park-gave-up-on-one-thread-beside-the-held-one.md +++ b/issues/quiesce-wakes-on-the-last-park-gave-up-on-one-thread-beside-the-held-one.md @@ -22,7 +22,7 @@ tier: PR #549 at `751e36d9`, `4 of 6 … 2010 ms of a 2010 ms budget over 2 sweep(s)`. That boot normally counts 5 userland threads. The earliest is PR #510 at `98e803cb`, recorded in -`issues/build/quiesce-wakes-on-the-last-park-lost-its-serial-ready-beside-other-guests.md`: +`issues/quiesce-wakes-on-the-last-park-lost-its-serial-ready-beside-other-guests.md`: `stop: 4 of 7 userland thread(s) stopped ... in 2010 ms of a 2010 ms budget`. That boot then lost its READY, so the harness reported the READY and not the stop. diff --git a/issues/build/quiesce-wakes-on-the-last-park-lost-its-serial-ready-beside-other-guests.md b/issues/quiesce-wakes-on-the-last-park-lost-its-serial-ready-beside-other-guests.md similarity index 87% rename from issues/build/quiesce-wakes-on-the-last-park-lost-its-serial-ready-beside-other-guests.md rename to issues/quiesce-wakes-on-the-last-park-lost-its-serial-ready-beside-other-guests.md index 768b13cb18a..bbfc027a8f7 100644 --- a/issues/build/quiesce-wakes-on-the-last-park-lost-its-serial-ready-beside-other-guests.md +++ b/issues/quiesce-wakes-on-the-last-park-lost-its-serial-ready-beside-other-guests.md @@ -23,4 +23,4 @@ Again in PR #532's fast tier at `a7f423b5`, 399 passed and this one of two reds: `Rebooting.` and `shutdown: /log did not answer in 2000ms`, the uart `nothing at all`; `ALONE ... GREEN`. That branch touches no quiesce path. -`quiesce_wakes_on_the_last_park` is deleted; `issues/kernel/quiesce-wakes-on-the-last-park-gave-up-on-one-thread-beside-the-held-one.md` records the commit that restores it. +`quiesce_wakes_on_the_last_park` is deleted; `issues/quiesce-wakes-on-the-last-park-gave-up-on-one-thread-beside-the-held-one.md` records the commit that restores it. diff --git a/issues/build/record-reads-compiler-source-after-the-bootstrap-it-records.md b/issues/record-reads-compiler-source-after-the-bootstrap-it-records.md similarity index 100% rename from issues/build/record-reads-compiler-source-after-the-bootstrap-it-records.md rename to issues/record-reads-compiler-source-after-the-bootstrap-it-records.md diff --git a/issues/design-debt/redesign-the-log-subsystem.md b/issues/redesign-the-log-subsystem.md similarity index 96% rename from issues/design-debt/redesign-the-log-subsystem.md rename to issues/redesign-the-log-subsystem.md index e49abb550e2..1111b1ab5b6 100644 --- a/issues/design-debt/redesign-the-log-subsystem.md +++ b/issues/redesign-the-log-subsystem.md @@ -11,15 +11,15 @@ work. With the ruling the orchestrator sequenced the log core behind the kernel's lock conversions (`vfs::VFS`, the FAT volumes' lock, `xhci::XHCI` and `ProcessData` becoming sleep locks), which touch the same scheduler-adjacent paths. Nothing plans those conversions any more: -`issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md` moves +`issues/the-kernel-is-small-interrupts-post-and-threads-wait.md` moves storage and USB out of the kernel instead (owner, 2026-09-25), so that wait names nothing that will land. The directory re-shape is a scheduling matter exactly as priced below: one clean pass in a window with few worktrees in flight, and never interleaved with a code change. -The log is a pillar of `issues/diagnostics/toyos-explains-itself.md`, and +The log is a pillar of `issues/toyos-explains-itself.md`, and its ring is -`issues/kernel/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md`'s; +`issues/logging-records-from-every-producer-and-a-kernel-that-waits-on-nobody.md`'s; this file holds the sinks and the layout. The target shape stands as reviewed: a log core (ring + context stamping, diff --git a/issues/filesystem/remove-dir-all-empties-a-directory-and-leaves-it.md b/issues/remove-dir-all-empties-a-directory-and-leaves-it.md similarity index 100% rename from issues/filesystem/remove-dir-all-empties-a-directory-and-leaves-it.md rename to issues/remove-dir-all-empties-a-directory-and-leaves-it.md diff --git a/issues/boot-media/root-in-memory-costs-its-whole-size.md b/issues/root-in-memory-costs-its-whole-size.md similarity index 97% rename from issues/boot-media/root-in-memory-costs-its-whole-size.md rename to issues/root-in-memory-costs-its-whole-size.md index ab4a4e18148..73b511261a1 100644 --- a/issues/boot-media/root-in-memory-costs-its-whole-size.md +++ b/issues/root-in-memory-costs-its-whole-size.md @@ -21,7 +21,7 @@ in turn, each carrying at most `SHARED_BOOT_BYTES` (64 MiB) of test binaries; carries `tests/testcases`'s own programs, 13 MiB (3328 blocks), where every test boot carried the whole 619 MiB catalogue before. The one part past the bound is `demand_window_race`, 131 MiB, nearly all of it the `.bss` zeros `toyos-ld` -writes into the file (`issues/hardware/anonymous-mmap-is-not-demand-paged.md`), +writes into the file (`issues/anonymous-mmap-is-not-demand-paged.md`), which a guest that mounts ROOT off a disk never reads and a guest here holds. **Every resident `/system` page is in RAM twice.** `ReadOnlyBacking::read_page` diff --git a/issues/build/run-test-and-its-ceiling-verdict-serve-only-debugs-run.md b/issues/run-test-and-its-ceiling-verdict-serve-only-debugs-run.md similarity index 94% rename from issues/build/run-test-and-its-ceiling-verdict-serve-only-debugs-run.md rename to issues/run-test-and-its-ceiling-verdict-serve-only-debugs-run.md index 085aff79e40..94c6f2066a5 100644 --- a/issues/build/run-test-and-its-ceiling-verdict-serve-only-debugs-run.md +++ b/issues/run-test-and-its-ceiling-verdict-serve-only-debugs-run.md @@ -26,7 +26,7 @@ modules at `06788146b^`, and one in `tests/toyos.rs`, the debug loop's, at ## Owner -`issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md`, whose +`issues/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md`, whose first cut left them that one caller. ## What would close it diff --git a/issues/build/rust-and-c-objects-carry-two-triples.md b/issues/rust-and-c-objects-carry-two-triples.md similarity index 100% rename from issues/build/rust-and-c-objects-carry-two-triples.md rename to issues/rust-and-c-objects-carry-two-triples.md diff --git a/issues/build/rustc-llvm-cannot-build-for-a-toyos-host.md b/issues/rustc-llvm-cannot-build-for-a-toyos-host.md similarity index 94% rename from issues/build/rustc-llvm-cannot-build-for-a-toyos-host.md rename to issues/rustc-llvm-cannot-build-for-a-toyos-host.md index f42cdcc6617..2fa571118d2 100644 --- a/issues/build/rustc-llvm-cannot-build-for-a-toyos-host.md +++ b/issues/rustc-llvm-cannot-build-for-a-toyos-host.md @@ -6,7 +6,7 @@ opened: 2026-09-30 # rustc_llvm cannot build for a ToyOS host -M3's rustc (`issues/build/toyos-builds-itself.md`) carries LLVM through +M3's rustc (`issues/toyos-builds-itself.md`) carries LLVM through `compiler/rustc_llvm`, whose `build.rs`, read from the fork at `rust/`, not run, builds it for `x86_64-unknown-toyos` wrongly three ways: diff --git a/issues/build/save-durations-publishes-through-a-fixed-tmp-and-ignores-every-error.md b/issues/save-durations-publishes-through-a-fixed-tmp-and-ignores-every-error.md similarity index 100% rename from issues/build/save-durations-publishes-through-a-fixed-tmp-and-ignores-every-error.md rename to issues/save-durations-publishes-through-a-fixed-tmp-and-ignores-every-error.md diff --git a/issues/kernel/scheduler-pass-blocks-in-xhci.md b/issues/scheduler-pass-blocks-in-xhci.md similarity index 97% rename from issues/kernel/scheduler-pass-blocks-in-xhci.md rename to issues/scheduler-pass-blocks-in-xhci.md index ac3cd70c74e..df8a28cb956 100644 --- a/issues/kernel/scheduler-pass-blocks-in-xhci.md +++ b/issues/scheduler-pass-blocks-in-xhci.md @@ -36,7 +36,7 @@ handing it on, gated by simulator invariant I14. This half is not. The second instance of the same shape used to be the idle loop's log flush; the idle loop touches no filesystem now — the log is logd's file — and the disk wait that survives, logd's `fsync` pinning a CPU for the device round -trip, is `issues/hardware/xhci-waits-are-spins.md`'s subject. +trip, is `issues/xhci-waits-are-spins.md`'s subject. Closing this means making xHCI enumeration and endpoint recovery asynchronous, so that `drain_irqs` only ever does work it can finish: drain the event ring, diff --git a/issues/boot-media/screen-diag-boot-leaves-no-i8042-line-on-the-panel.md b/issues/screen-diag-boot-leaves-no-i8042-line-on-the-panel.md similarity index 100% rename from issues/boot-media/screen-diag-boot-leaves-no-i8042-line-on-the-panel.md rename to issues/screen-diag-boot-leaves-no-i8042-line-on-the-panel.md diff --git a/issues/boot-media/screen-fatal-halt-reds-on-ci-with-a-usb-storage-transport-break-during-boot.md b/issues/screen-fatal-halt-reds-on-ci-with-a-usb-storage-transport-break-during-boot.md similarity index 100% rename from issues/boot-media/screen-fatal-halt-reds-on-ci-with-a-usb-storage-transport-break-during-boot.md rename to issues/screen-fatal-halt-reds-on-ci-with-a-usb-storage-transport-break-during-boot.md diff --git a/issues/build/seven-commits-of-mains-history-pin-a-rust-commit-no-repository-holds.md b/issues/seven-commits-of-mains-history-pin-a-rust-commit-no-repository-holds.md similarity index 100% rename from issues/build/seven-commits-of-mains-history-pin-a-rust-commit-no-repository-holds.md rename to issues/seven-commits-of-mains-history-pin-a-rust-commit-no-repository-holds.md diff --git a/issues/isolation/sharedmemory-slices-rest-on-a-size-nobody-checks.md b/issues/sharedmemory-slices-rest-on-a-size-nobody-checks.md similarity index 100% rename from issues/isolation/sharedmemory-slices-rest-on-a-size-nobody-checks.md rename to issues/sharedmemory-slices-rest-on-a-size-nobody-checks.md diff --git a/issues/filesystem/shell-c-discards-the-cwd-its-launch-carried.md b/issues/shell-c-discards-the-cwd-its-launch-carried.md similarity index 100% rename from issues/filesystem/shell-c-discards-the-cwd-its-launch-carried.md rename to issues/shell-c-discards-the-cwd-its-launch-carried.md diff --git a/issues/kernel/short-sleep-livelock-stalls-on-ci-with-one-sleeper-never-returning.md b/issues/short-sleep-livelock-stalls-on-ci-with-one-sleeper-never-returning.md similarity index 100% rename from issues/kernel/short-sleep-livelock-stalls-on-ci-with-one-sleeper-never-returning.md rename to issues/short-sleep-livelock-stalls-on-ci-with-one-sleeper-never-returning.md diff --git a/issues/design-debt/slint-and-egui-are-not-supported-by-the-owners-choice.md b/issues/slint-and-egui-are-not-supported-by-the-owners-choice.md similarity index 100% rename from issues/design-debt/slint-and-egui-are-not-supported-by-the-owners-choice.md rename to issues/slint-and-egui-are-not-supported-by-the-owners-choice.md diff --git a/issues/build/smp-ap-hole-and-log-reserve-window-red-under-a-loaded-host.md b/issues/smp-ap-hole-and-log-reserve-window-red-under-a-loaded-host.md similarity index 96% rename from issues/build/smp-ap-hole-and-log-reserve-window-red-under-a-loaded-host.md rename to issues/smp-ap-hole-and-log-reserve-window-red-under-a-loaded-host.md index de8d4dcd223..59a21bd77f6 100644 --- a/issues/build/smp-ap-hole-and-log-reserve-window-red-under-a-loaded-host.md +++ b/issues/smp-ap-hole-and-log-reserve-window-red-under-a-loaded-host.md @@ -12,7 +12,7 @@ two other worktrees' suites (`[host-slots]` names `pid 49668` and `pid 2726` holding slots across the whole run). The branch's own diff at the time touches neither SMP bring-up, `spawn_init`, nor `rootfs.rs`, so it is filed rather than chased. Same shape as -`issues/build/parallel-tests-red-under-other-suites.md`, filed separately +`issues/parallel-tests-red-under-other-suites.md`, filed separately because that file is not this agent's to append to. `smp_failed_ap_leaves_no_hole` FAILED at `[kernel 2.605 cpu0] PANIC: panicked diff --git a/issues/kernel/so-cache-refusals-saw-the-kernel-refuse-nothing-once.md b/issues/so-cache-refusals-saw-the-kernel-refuse-nothing-once.md similarity index 100% rename from issues/kernel/so-cache-refusals-saw-the-kernel-refuse-nothing-once.md rename to issues/so-cache-refusals-saw-the-kernel-refuse-nothing-once.md diff --git a/issues/design-debt/softbuffer-reads-a-toyos-window-behind-its-lock.md b/issues/softbuffer-reads-a-toyos-window-behind-its-lock.md similarity index 100% rename from issues/design-debt/softbuffer-reads-a-toyos-window-behind-its-lock.md rename to issues/softbuffer-reads-a-toyos-window-behind-its-lock.md diff --git a/issues/kernel/soundserver-past-due-wake-max-1.md b/issues/soundserver-past-due-wake-max-1.md similarity index 100% rename from issues/kernel/soundserver-past-due-wake-max-1.md rename to issues/soundserver-past-due-wake-max-1.md diff --git a/issues/build/soundservers-mix-pass-has-no-host-test.md b/issues/soundservers-mix-pass-has-no-host-test.md similarity index 100% rename from issues/build/soundservers-mix-pass-has-no-host-test.md rename to issues/soundservers-mix-pass-has-no-host-test.md diff --git a/issues/kernel/spawn-thread-disagrees-about-a-reaped-parent.md b/issues/spawn-thread-disagrees-about-a-reaped-parent.md similarity index 100% rename from issues/kernel/spawn-thread-disagrees-about-a-reaped-parent.md rename to issues/spawn-thread-disagrees-about-a-reaped-parent.md diff --git a/issues/kernel/spawned-process-never-starts.md b/issues/spawned-process-never-starts.md similarity index 98% rename from issues/kernel/spawned-process-never-starts.md rename to issues/spawned-process-never-starts.md index 7790d691d02..9e081900464 100644 --- a/issues/kernel/spawned-process-never-starts.md +++ b/issues/spawned-process-never-starts.md @@ -86,7 +86,7 @@ instrument that would settle the split the `ps` column was going to. The assignment was reclaimed 2026-08-23: #142's investigation left no artifact. Investigation is the scheduler agent's (#142); the shapes are consistent with -one defect. Ctrl+Alt+D is now machine-wide and process-named (`issues/diagnostics/`), and on the +one defect. Ctrl+Alt+D is now machine-wide and process-named, and on the owner's laptop one press named three CPUs not reaching a scheduler pass and three threads ready-and-never-run. diff --git a/issues/kernel/spec-ctrl-and-gds-stay-as-firmware-left-them.md b/issues/spec-ctrl-and-gds-stay-as-firmware-left-them.md similarity index 89% rename from issues/kernel/spec-ctrl-and-gds-stay-as-firmware-left-them.md rename to issues/spec-ctrl-and-gds-stay-as-firmware-left-them.md index 3ccd0e00466..aa0566410c0 100644 --- a/issues/kernel/spec-ctrl-and-gds-stay-as-firmware-left-them.md +++ b/issues/spec-ctrl-and-gds-stay-as-firmware-left-them.md @@ -14,7 +14,7 @@ unmitigated if firmware left `GDS_MITG_DIS` set. Linux at (`arch/x86/kernel/cpu/bugs.c:89,777`). **Exit**: on every proving machine each CPU's 0x48 holds what -`issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md` +`issues/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md` selects for it, on the T14 Linux's read less SSBD; on the T14, the one proving machine with GDS, a probe sets `GDS_MITG_DIS` and reads it clear after the kernel's write. **Mutation**: the clear deleted. **Oracle**: Linux's reads on diff --git a/issues/isolation/sshserver-authorized-keys-unprotected.md b/issues/sshserver-authorized-keys-unprotected.md similarity index 94% rename from issues/isolation/sshserver-authorized-keys-unprotected.md rename to issues/sshserver-authorized-keys-unprotected.md index ac78b264422..cb42c069efc 100644 --- a/issues/isolation/sshserver-authorized-keys-unprotected.md +++ b/issues/sshserver-authorized-keys-unprotected.md @@ -27,5 +27,5 @@ without them grants more than the file says), and a host key that exists but does not parse is refused rather than replaced, because minting over it would change the identity every client has pinned. -Stage 3 of `issues/isolation/every-program-sees-only-the-files-it-was-given.md` +Stage 3 of `issues/every-program-sees-only-the-files-it-was-given.md` closes this: the key list lies in the login authority's view alone. diff --git a/issues/isolation/sshserver-holds-one-channel-and-does-not-say-so.md b/issues/sshserver-holds-one-channel-and-does-not-say-so.md similarity index 100% rename from issues/isolation/sshserver-holds-one-channel-and-does-not-say-so.md rename to issues/sshserver-holds-one-channel-and-does-not-say-so.md diff --git a/issues/isolation/sshserver-still-speaks-rsa.md b/issues/sshserver-still-speaks-rsa.md similarity index 100% rename from issues/isolation/sshserver-still-speaks-rsa.md rename to issues/sshserver-still-speaks-rsa.md diff --git a/issues/filesystem/stats-does-not-resolve-the-command-its-user-typed.md b/issues/stats-does-not-resolve-the-command-its-user-typed.md similarity index 100% rename from issues/filesystem/stats-does-not-resolve-the-command-its-user-typed.md rename to issues/stats-does-not-resolve-the-command-its-user-typed.md diff --git a/issues/build/std-and-libc-allocate-under-a-spinlock-with-no-futex.md b/issues/std-and-libc-allocate-under-a-spinlock-with-no-futex.md similarity index 93% rename from issues/build/std-and-libc-allocate-under-a-spinlock-with-no-futex.md rename to issues/std-and-libc-allocate-under-a-spinlock-with-no-futex.md index c4d7dd4c81f..20566b76e3b 100644 --- a/issues/build/std-and-libc-allocate-under-a-spinlock-with-no-futex.md +++ b/issues/std-and-libc-allocate-under-a-spinlock-with-no-futex.md @@ -22,7 +22,7 @@ A holder that is preempted, or that is inside the `mmap` or `munmap` syscall `dlmalloc` makes under the lock through its backing allocator, leaves every other thread of its process that allocates spinning through its slice. A real-time thread outranks a fair one by right -(`issues/kernel/cpu-time-is-a-band-and-not-a-reservation.md`), so a real-time +(`issues/cpu-time-is-a-band-and-not-a-reservation.md`), so a real-time waiter on the holder's CPU keeps a fair holder off that CPU while it spins: priority inversion. How long such a spin lasts, and whether it ends before the holder is run elsewhere, is unmeasured, and so is whether two threads ever meet @@ -35,7 +35,7 @@ The futex both need is there: libc's `futex_lock` and `futex_unlock` is the futex mutex on ToyOS (`library/std/src/sys/sync/mutex/mod.rs`, over `library/std/src/sys/pal/toyos/futex.rs`). -Owner track: `issues/kernel/toyos-has-its-own-allocator.md`, whose std front +Owner track: `issues/toyos-has-its-own-allocator.md`, whose std front replaces std's allocator; it does not rule whether this lock is fixed on `dlmalloc` first. Owner: the orchestrator. diff --git a/issues/kernel/std-and-libc-drop-the-answer-thread-join-gives.md b/issues/std-and-libc-drop-the-answer-thread-join-gives.md similarity index 100% rename from issues/kernel/std-and-libc-drop-the-answer-thread-join-gives.md rename to issues/std-and-libc-drop-the-answer-thread-join-gives.md diff --git a/issues/kernel/std-answers-every-spawn-refusal-but-notfound-as-other.md b/issues/std-answers-every-spawn-refusal-but-notfound-as-other.md similarity index 93% rename from issues/kernel/std-answers-every-spawn-refusal-but-notfound-as-other.md rename to issues/std-answers-every-spawn-refusal-but-notfound-as-other.md index 122b64d4788..d6ccb5f4afa 100644 --- a/issues/kernel/std-answers-every-spawn-refusal-but-notfound-as-other.md +++ b/issues/std-answers-every-spawn-refusal-but-notfound-as-other.md @@ -13,7 +13,7 @@ The std fork's direct spawn (`rust/library/std/src/sys/process/toyos.rs`, the `Command::current_dir` the kernel refuses as not absolute — `InvalidArgument` from `SYS_SPAWN` — reaches the caller as `Other`, the same word as a refused endowment, an exhausted table or a bad ELF, and `{e}` prints `other error`. -`issues/kernel/a-spawn-of-echo-was-refused-with-an-error-nothing-names.md` is +`issues/a-spawn-of-echo-was-refused-with-an-error-nothing-names.md` is a failure this mapping already made unreadable. `tests/toyos-rust-tests/src/bin/spawn_cwd.rs` checks the relative and empty diff --git a/issues/design-debt/std-calloc-overflow-writes-past-a-fifteen-byte-block.md b/issues/std-calloc-overflow-writes-past-a-fifteen-byte-block.md similarity index 100% rename from issues/design-debt/std-calloc-overflow-writes-past-a-fifteen-byte-block.md rename to issues/std-calloc-overflow-writes-past-a-fifteen-byte-block.md diff --git a/issues/filesystem/std-calls-undated-what-it-did-not-stat.md b/issues/std-calls-undated-what-it-did-not-stat.md similarity index 100% rename from issues/filesystem/std-calls-undated-what-it-did-not-stat.md rename to issues/std-calls-undated-what-it-did-not-stat.md diff --git a/issues/design-debt/std-file-lock-answers-ok-and-locks-nothing.md b/issues/std-file-lock-answers-ok-and-locks-nothing.md similarity index 86% rename from issues/design-debt/std-file-lock-answers-ok-and-locks-nothing.md rename to issues/std-file-lock-answers-ok-and-locks-nothing.md index af236182e12..2542a6aa16d 100644 --- a/issues/design-debt/std-file-lock-answers-ok-and-locks-nothing.md +++ b/issues/std-file-lock-answers-ok-and-locks-nothing.md @@ -16,9 +16,9 @@ cargo is one such program. Every file lock it takes is one of these calls (its `src/util/flock.rs` at `7c83d4cc0953`, the cargo the fork pins), so two cargo processes in one ToyOS are kept apart by nothing. -Owner: `issues/build/toyos-builds-itself.md`, whose M4 runs cargo in the guest; +Owner: `issues/toyos-builds-itself.md`, whose M4 runs cargo in the guest; the locks libc owes for the same milestone are -`issues/build/libc-refuses-what-toyos-cannot-yet-answer.md`'s. +`issues/libc-refuses-what-toyos-cannot-yet-answer.md`'s. Exit condition: a second process's `try_lock` on a file another holds locked answers `WouldBlock`, and its `lock` waits for the holder's `unlock` or its diff --git a/issues/build/std-leaks-a-thread-stack-per-spawn.md b/issues/std-leaks-a-thread-stack-per-spawn.md similarity index 96% rename from issues/build/std-leaks-a-thread-stack-per-spawn.md rename to issues/std-leaks-a-thread-stack-per-spawn.md index a87d640a336..69748212156 100644 --- a/issues/build/std-leaks-a-thread-stack-per-spawn.md +++ b/issues/std-leaks-a-thread-stack-per-spawn.md @@ -36,6 +36,6 @@ reclaiming a thread stack it already knows, or std refusing to detach a thread whose stack it allocated — and not a missing line in `join`. **It cannot be closed without a plateau to measure**, which is -`issues/kernel/a-processs-memory-is-a-byte-total-that-reads-zero-under-contention.md`: +`issues/a-processs-memory-is-a-byte-total-that-reads-zero-under-contention.md`: a single before/after pair cannot distinguish a leak from a deferred release, and the plateau has to cover the detached path too. diff --git a/issues/design-debt/std-lookup-host-answers-no-address-as-other.md b/issues/std-lookup-host-answers-no-address-as-other.md similarity index 100% rename from issues/design-debt/std-lookup-host-answers-no-address-as-other.md rename to issues/std-lookup-host-answers-no-address-as-other.md diff --git a/issues/design-debt/std-maps-a-device-error-to-other-not-uncategorized.md b/issues/std-maps-a-device-error-to-other-not-uncategorized.md similarity index 100% rename from issues/design-debt/std-maps-a-device-error-to-other-not-uncategorized.md rename to issues/std-maps-a-device-error-to-other-not-uncategorized.md diff --git a/issues/diagnostics/std-reads-a-query-modules-byte-count-as-a-module-count.md b/issues/std-reads-a-query-modules-byte-count-as-a-module-count.md similarity index 100% rename from issues/diagnostics/std-reads-a-query-modules-byte-count-as-a-module-count.md rename to issues/std-reads-a-query-modules-byte-count-as-a-module-count.md diff --git a/issues/design-debt/std-says-this-machine-has-one-cpu.md b/issues/std-says-this-machine-has-one-cpu.md similarity index 100% rename from issues/design-debt/std-says-this-machine-has-one-cpu.md rename to issues/std-says-this-machine-has-one-cpu.md diff --git a/issues/filesystem/std-stat-conflates-io-with-notfound.md b/issues/std-stat-conflates-io-with-notfound.md similarity index 100% rename from issues/filesystem/std-stat-conflates-io-with-notfound.md rename to issues/std-stat-conflates-io-with-notfound.md diff --git a/issues/design-debt/std-udp-socket-ignores-its-timeouts.md b/issues/std-udp-socket-ignores-its-timeouts.md similarity index 100% rename from issues/design-debt/std-udp-socket-ignores-its-timeouts.md rename to issues/std-udp-socket-ignores-its-timeouts.md diff --git a/issues/build/stdio-buffering-saw-one-long-line-arrive-as-two.md b/issues/stdio-buffering-saw-one-long-line-arrive-as-two.md similarity index 100% rename from issues/build/stdio-buffering-saw-one-long-line-arrive-as-two.md rename to issues/stdio-buffering-saw-one-long-line-arrive-as-two.md diff --git a/issues/kernel/steal-probe-node-dies-with-its-victim.md b/issues/steal-probe-node-dies-with-its-victim.md similarity index 98% rename from issues/kernel/steal-probe-node-dies-with-its-victim.md rename to issues/steal-probe-node-dies-with-its-victim.md index 754a94865f6..02fc8443468 100644 --- a/issues/kernel/steal-probe-node-dies-with-its-victim.md +++ b/issues/steal-probe-node-dies-with-its-victim.md @@ -35,7 +35,7 @@ whole mailbox — none of which is a change to `post_steal_probe`. Found while closing the placement half of the freeze family (the shed-core work), which is the only reason the state is reachable in the first place: a CPU that stops taking passes is what every part of this rests on, and why one does -is still open (`issues/kernel/spawned-process-never-starts.md`). +is still open (`issues/spawned-process-never-starts.md`). ## It reproduces in a second, on the real primitive diff --git a/issues/audio/stop-the-device-voice-keep-the-wake.md b/issues/stop-the-device-voice-keep-the-wake.md similarity index 100% rename from issues/audio/stop-the-device-voice-keep-the-wake.md rename to issues/stop-the-device-voice-keep-the-wake.md diff --git a/issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md b/issues/storage-is-layers-and-a-role-is-a-filesystem.md similarity index 93% rename from issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md rename to issues/storage-is-layers-and-a-role-is-a-filesystem.md index ab75fa8b02a..be5b5fdcfcf 100644 --- a/issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md +++ b/issues/storage-is-layers-and-a-role-is-a-filesystem.md @@ -8,7 +8,7 @@ opened: 2026-09-03 What the installed product's disks look like, from the block device up to a path. **Where each layer runs is the small-kernel track's** -(`issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md`, +(`issues/the-kernel-is-small-interrupts-post-and-threads-wait.md`, stages 3 and 4, owner ruling 2026-09-26): block services and file servers are userland programs, the VFS is a client library, and the kernel keeps ROOT's in-memory read path and nothing else of storage. The plan this track carried @@ -38,7 +38,7 @@ refused rather than guessed, which `boot_partition_identity` already asserts for the boot volume. A blank volume joins the system by the designation stamp the bcachefs crate already carries (`DESIGNATION_MAGIC`, `bcachefs/src/superblock.rs`): the probe formats a designated volume and -refuses to reformat a used one (`issues/isolation/probe-mounts-on-a-checksum.md` +refuses to reformat a used one (`issues/probe-mounts-on-a-checksum.md` is what that refusal still owes). Microsoft's basic-data type is a foreign volume, handed to whichever server recognises its superblock. @@ -72,7 +72,7 @@ kernel on bytes another OS wrote. across disks, replicas per subvolume, tiering with a fast foreground device, erasure coding, snapshots, checksums and scrub, compression, encryption, subvolume per user and per app: every one is a feature of upstream bcachefs's -format, which is why `issues/kernel/bcachefs-crate-is-not-bcachefs.md`'s +format, which is why `issues/bcachefs-crate-is-not-bcachefs.md`'s ruling — the crate becomes a real implementation — is what makes them reachable. The block layer stays dumb. LVM- and md-shaped aggregation is refused: it cannot tell metadata from data, place a file's replicas on @@ -91,7 +91,7 @@ NTFS by the same shape if wanted. ## Paths The tree, its names and how a program finds them are -`issues/filesystem/where-everything-lives.md`. What this track owes it is the +`issues/where-everything-lives.md`. What this track owes it is the mount structure: a mount point is exactly one top-level name (`kernel/src/vfs.rs`, `ROOT_ENTRIES` and the array indexed by it), so `/media/`, ~20 distinct symbols behind ~145 `crate::arch::` paths), a 4 KiB granule with 2 MiB L2 blocks, and the driver boundary of -`issues/kernel/a-driver-is-tested-on-the-host-and-its-real-implementation-is-one-instruction-deep.md` +`issues/a-driver-is-tested-on-the-host-and-its-real-implementation-is-one-instruction-deep.md` as a precondition for the drivers it names. **Purpose** (owner ruling, 2026-09-29): ARM is for quick runs on the @@ -35,7 +35,7 @@ Every x86 guest on this host runs under TCG emulation instead — there is no loader, kernel reaching serial on QEMU `virt`) start now. Stage 0 waits for small-kernel stage 2 (PR #513, "One way to wait") to land before its own changes land — both touch the same files. Stage 4 onward waits for - small-kernel stage 6 (`issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md`), + small-kernel stage 6 (`issues/the-kernel-is-small-interrupts-post-and-threads-wait.md`), so the per-CPU IRQ relay and the i8042 plumbing are not ported and then deleted. - **EL1 only.** The kernel runs at EL1, dropping from EL2 when entered there. @@ -45,7 +45,7 @@ Every x86 guest on this host runs under TCG emulation instead — there is no (`aaddf38a^:issues/kernel/the-stops-no-lost-wake-claim-rests-on-x86-locked-rmws.md` is one instance). - **C on AArch64 goes through clang**, whose driver knows - `aarch64-unknown-toyos` (`issues/build/toyos-builds-itself.md`); doomgeneric + `aarch64-unknown-toyos` (`issues/toyos-builds-itself.md`); doomgeneric compiles for it. Doom and the C corpus stay x86-only until userland runs on ARM. - **Randomness** comes from RNDR where the CPU has it, and from virtio-rng @@ -200,9 +200,9 @@ before any aarch64 file exists, with x86 as its only user: Each is its own issue, owned by the stage that removes it: -- `issues/kernel/msi-and-pin-routing-take-an-x86-vector-and-apic-id.md` (stage 6) -- `issues/kernel/the-crash-evidence-records-x86-fault-registers.md` (stage 5) -- `issues/kernel/the-aarch64-kernel-builds-with-dead-code-allowed.md` (stage 7) +- `issues/msi-and-pin-routing-take-an-x86-vector-and-apic-id.md` (stage 6) +- `issues/the-crash-evidence-records-x86-fault-registers.md` (stage 5) +- `issues/the-aarch64-kernel-builds-with-dead-code-allowed.md` (stage 7) ## Stages @@ -291,7 +291,7 @@ Each stage names its exit; "measured" means a number from a run. **Every CPU starts, ahead of small-kernel stage 6 by the owner's word, as stage 4 did:** it ports no device interrupt, so nothing of the relay. Owed before the exit holds: the TLS-descriptor resolver; - `issues/kernel/the-crash-evidence-records-x86-fault-registers.md`; the + `issues/the-crash-evidence-records-x86-fault-registers.md`; the blocked-task dump's probe of a CPU that ignored its kick (`sched/dump.rs`'s `probe_silent`), which reaches `irqchip::send_nmi`'s `owed!` on a machine of more than one CPU, and which nothing but the @@ -341,12 +341,12 @@ arm64 guest under QEMU with HVF, and ToyOS arm64 under QEMU with HVF. All three times are recorded, and it passes when ToyOS is at least as fast as the Linux guest. The timing is one measurement, taken by hand and not automated (owner ruling, 2026-09-29). ToyOS compiling LLVM is -`issues/build/toyos-builds-itself.md`'s work on AArch64. +`issues/toyos-builds-itself.md`'s work on AArch64. ## Interactions with other tracks - **Small kernel** - (`issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md`): + (`issues/the-kernel-is-small-interrupts-post-and-threads-wait.md`): its stage 1 (the loader loads ROOT into memory) removes every kernel storage driver from the ARM bring-up path — land it before stage 0 here. Its stage 3 (storage in userland) removes NVMe, USB storage and the block @@ -355,11 +355,11 @@ Linux guest. The timing is one measurement, taken by hand and not automated scheduler pass, which the i8042 currently threads through (`scheduler.rs`, `sched/driver.rs`) — stage 4 here follows it. - **The driver boundary** - (`issues/kernel/a-driver-is-tested-on-the-host-and-its-real-implementation-is-one-instruction-deep.md`) + (`issues/a-driver-is-tested-on-the-host-and-its-real-implementation-is-one-instruction-deep.md`) is the stated precondition: its four traits (registers, clock, DMA, interrupt arrival) are the arch seam for drivers, and ARM is the second implementation that makes them real boundaries. - **Page size** - (`issues/kernel/process-memory-is-2-mib-pages-and-that-caps-the-process-count.md`): + (`issues/process-memory-is-2-mib-pages-and-that-caps-the-process-count.md`): 2 MiB L2 blocks map identically on both arches, so no change is forced by this track. diff --git a/issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md b/issues/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md similarity index 96% rename from issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md rename to issues/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md index a7acea8bbff..c1b3f863913 100644 --- a/issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md +++ b/issues/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md @@ -9,7 +9,7 @@ opened: 2026-10-03 ToyOS leaves the machine in the mode its firmware hands over: nothing writes `ACPI_ENABLE` to `SMI_CMD`, and nothing handles an SCI. The T14's firmware hands it over in legacy mode, which interrupts every CPU every 2.2 s -(`issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md`). +(`issues/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md`). Nothing in the tree evaluates the AML in a machine's DSDT or SSDTs. What ToyOS takes from them it takes another way: `toyos-acpi/src/dsdt.rs` finds @@ -43,7 +43,7 @@ writes its own, and the battery comes first (his direction of `0ee814f5a`). - **"General counters"**: stage 1's `MSR_SMI_COUNT` reading is built as the first piece of the general counters - (`issues/diagnostics/toyos-explains-itself.md`), not as a one-off check. + (`issues/toyos-explains-itself.md`), not as a one-off check. - **"Back to legacy mode"**: when the server dies and its `acpi` claim is released, the kernel writes `ACPI_DISABLE` to `SMI_CMD`, so the firmware handles the buttons again. diff --git a/issues/design-debt/toyos-ships-no-monospace-or-serif-system-font.md b/issues/toyos-ships-no-monospace-or-serif-system-font.md similarity index 100% rename from issues/design-debt/toyos-ships-no-monospace-or-serif-system-font.md rename to issues/toyos-ships-no-monospace-or-serif-system-font.md diff --git a/issues/kernel/toyos-uses-what-modern-hardware-offers-for-speed.md b/issues/toyos-uses-what-modern-hardware-offers-for-speed.md similarity index 50% rename from issues/kernel/toyos-uses-what-modern-hardware-offers-for-speed.md rename to issues/toyos-uses-what-modern-hardware-offers-for-speed.md index 56bcf545a65..f2c6241f785 100644 --- a/issues/kernel/toyos-uses-what-modern-hardware-offers-for-speed.md +++ b/issues/toyos-uses-what-modern-hardware-offers-for-speed.md @@ -12,21 +12,21 @@ where the stage says so. The proving machines are the T14 and AMD EPYC KVM guests, and a stage's correctness test runs on each that has its feature. A figure is the T14's, since the EPYC guests are shared CI runners: the median of 11 runs with its spread, taken by the program of -`issues/hardware/no-program-measures-toyos-against-linux-on-one-machine.md`. +`issues/no-program-measures-toyos-against-linux-on-one-machine.md`. A stage is done at or past that program's Linux figure, or with the gap filed as a defect carrying both; a feature Linux has no counterpart for lands only if it beats ToyOS without it. What no proving machine is known to offer is -`issues/hardware/features-no-proving-machine-is-known-to-offer.md`. +`issues/features-no-proving-machine-is-known-to-offer.md`. **Exit**: every issue below is closed, in the order listed. -- `issues/kernel/no-test-can-hold-a-thread-on-a-named-cpu.md` -- `issues/hardware/no-program-measures-toyos-against-linux-on-one-machine.md` -- `issues/kernel/user-programs-use-avx-under-xsave.md` -- `issues/build/no-gate-decodes-kernel-elfs-instructions.md` -- `issues/kernel/kernel-forward-copies-and-fills-are-one-rep-movsb-or-stosb-on-every-cpu.md` -- `issues/kernel/the-direct-map-uses-1-gib-leaves-where-the-cpu-has-them.md` -- `issues/kernel/a-tlb-shootdown-reaches-only-the-cpus-that-ran-the-space.md` -- `issues/kernel/fsgsbase-is-measured-then-taken-or-rejected.md` -- `issues/kernel/idle-cpus-enter-the-c-states-cst-names.md` -- `issues/hardware/diskserver-drives-nvme-apst.md` +- `issues/no-test-can-hold-a-thread-on-a-named-cpu.md` +- `issues/no-program-measures-toyos-against-linux-on-one-machine.md` +- `issues/user-programs-use-avx-under-xsave.md` +- `issues/no-gate-decodes-kernel-elfs-instructions.md` +- `issues/kernel-forward-copies-and-fills-are-one-rep-movsb-or-stosb-on-every-cpu.md` +- `issues/the-direct-map-uses-1-gib-leaves-where-the-cpu-has-them.md` +- `issues/a-tlb-shootdown-reaches-only-the-cpus-that-ran-the-space.md` +- `issues/fsgsbase-is-measured-then-taken-or-rejected.md` +- `issues/idle-cpus-enter-the-c-states-cst-names.md` +- `issues/diskserver-drives-nvme-apst.md` diff --git a/issues/kernel/tsx-stays-as-firmware-left-it.md b/issues/tsx-stays-as-firmware-left-it.md similarity index 83% rename from issues/kernel/tsx-stays-as-firmware-left-it.md rename to issues/tsx-stays-as-firmware-left-it.md index dcce09494a3..daac49b33c5 100644 --- a/issues/kernel/tsx-stays-as-firmware-left-it.md +++ b/issues/tsx-stays-as-firmware-left-it.md @@ -18,9 +18,9 @@ T14's `CONFIG_X86_INTEL_TSX_MODE_OFF=y`, runs `tsx_init` (`tsx.c:23-41,189-226`). **Exit**: -`issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md` +`issues/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md` carries `tsx_init`'s decision and every CPU applies it; on the T14, ToyOS's reads of 0x122, 0x10F and 0x123 equal the Linux reads of -`issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md` +`issues/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md` where each exists, and dropping the write leaves 0x122 or 0x10F at firmware's value and reds it. diff --git a/issues/build/two-builds-of-one-llvm-key-differ-in-their-bytes.md b/issues/two-builds-of-one-llvm-key-differ-in-their-bytes.md similarity index 96% rename from issues/build/two-builds-of-one-llvm-key-differ-in-their-bytes.md rename to issues/two-builds-of-one-llvm-key-differ-in-their-bytes.md index 76a2d235b9c..d9540f0334b 100644 --- a/issues/build/two-builds-of-one-llvm-key-differ-in-their-bytes.md +++ b/issues/two-builds-of-one-llvm-key-differ-in-their-bytes.md @@ -25,7 +25,7 @@ does not name: - **Archive dates.** The members of every static archive carry the time they were built (`ar tv`). -This is not `issues/build/two-checkouts-of-one-tree-build-different-guest-bytes.md`, +This is not `issues/two-checkouts-of-one-tree-build-different-guest-bytes.md`, which holds the LLVM fixed and varies rustc's inputs: every checkout on a host links the one LLVM its key names, so that gate sees no origin, and a comparison of two LLVM installs sees no panic path rustc writes. diff --git a/issues/build/two-checkouts-of-one-tree-build-different-guest-bytes.md b/issues/two-checkouts-of-one-tree-build-different-guest-bytes.md similarity index 94% rename from issues/build/two-checkouts-of-one-tree-build-different-guest-bytes.md rename to issues/two-checkouts-of-one-tree-build-different-guest-bytes.md index 31275116251..e6b4f674948 100644 --- a/issues/build/two-checkouts-of-one-tree-build-different-guest-bytes.md +++ b/issues/two-checkouts-of-one-tree-build-different-guest-bytes.md @@ -12,7 +12,7 @@ sources copied to two paths and built with the same sysroot, profile and linker gave three different kernels, bootloaders and `snake`s; the same path built twice into two target directories gave identical ones. The LLVM is held fixed here: two builds of one LLVM key differing is -`issues/build/two-builds-of-one-llvm-key-differ-in-their-bytes.md`. +`issues/two-builds-of-one-llvm-key-differ-in-their-bytes.md`. - The kernel and the bootloader carry each path dependency's absolute source path in their panic locations (55 strings in the kernel, 13 in the diff --git a/issues/kernel/two-processes-started-at-an-entry-point-nothing-had-mapped.md b/issues/two-processes-started-at-an-entry-point-nothing-had-mapped.md similarity index 92% rename from issues/kernel/two-processes-started-at-an-entry-point-nothing-had-mapped.md rename to issues/two-processes-started-at-an-entry-point-nothing-had-mapped.md index 3b8a643ef48..46372caba95 100644 --- a/issues/kernel/two-processes-started-at-an-entry-point-nothing-had-mapped.md +++ b/issues/two-processes-started-at-an-entry-point-nothing-had-mapped.md @@ -42,9 +42,9 @@ young, and a stale CR3/PCID would read exactly like this). The record has no `spawn:` line for either process in the captured window, and the capture is the first 80 of 86 lines the harness kept. -`issues/kernel/echo-faulted-after-the-fault-arms.md` is the closest relative — +`issues/echo-faulted-after-the-fault-arms.md` is the closest relative — a spawned process faulting immediately, once, under host load — and -`issues/kernel/a-spawn-of-echo-was-refused-with-an-error-nothing-names.md` is +`issues/a-spawn-of-echo-was-refused-with-an-error-nothing-names.md` is the *other* name on the same CI run whose child would not start at all. The three may be one defect; nothing here shows they are. @@ -65,4 +65,4 @@ for what the *other* CPUs hold) and the `spawn:` line for the faulting pid in the same log, on a host loaded the way a CI shard is — eight guest vCPUs on a four-CPU runner. Until then the rate is one guest in one shard of one run. -`log_reserve_window` is deleted; `issues/build/smp-ap-hole-and-log-reserve-window-red-under-a-loaded-host.md` records the commits that restore it. +`log_reserve_window` is deleted; `issues/smp-ap-hole-and-log-reserve-window-red-under-a-loaded-host.md` records the commits that restore it. diff --git a/issues/build/two-sequences-build-one-image.md b/issues/two-sequences-build-one-image.md similarity index 100% rename from issues/build/two-sequences-build-one-image.md rename to issues/two-sequences-build-one-image.md diff --git a/issues/isolation/two-std-fork-maps-still-answer-other-for-a-dead-peer.md b/issues/two-std-fork-maps-still-answer-other-for-a-dead-peer.md similarity index 100% rename from issues/isolation/two-std-fork-maps-still-answer-other-for-a-dead-peer.md rename to issues/two-std-fork-maps-still-answer-other-for-a-dead-peer.md diff --git a/issues/kernel/two-submitters-of-one-ring-race-its-last-completion-slot.md b/issues/two-submitters-of-one-ring-race-its-last-completion-slot.md similarity index 100% rename from issues/kernel/two-submitters-of-one-ring-race-its-last-completion-slot.md rename to issues/two-submitters-of-one-ring-race-its-last-completion-slot.md diff --git a/issues/kernel/two-t14-cpus-idle-busier-under-toyos-than-any-under-linux.md b/issues/two-t14-cpus-idle-busier-under-toyos-than-any-under-linux.md similarity index 100% rename from issues/kernel/two-t14-cpus-idle-busier-under-toyos-than-any-under-linux.md rename to issues/two-t14-cpus-idle-busier-under-toyos-than-any-under-linux.md diff --git a/issues/build/two-toolchain-releases-report-the-same-rustc-vv.md b/issues/two-toolchain-releases-report-the-same-rustc-vv.md similarity index 100% rename from issues/build/two-toolchain-releases-report-the-same-rustc-vv.md rename to issues/two-toolchain-releases-report-the-same-rustc-vv.md diff --git a/issues/filesystem/usb-audit-findings-not-in-vcs.md b/issues/usb-audit-findings-not-in-vcs.md similarity index 100% rename from issues/filesystem/usb-audit-findings-not-in-vcs.md rename to issues/usb-audit-findings-not-in-vcs.md diff --git a/issues/hardware/usb-disk-index-stable-nothing-enumerates-on-the-first-controller.md b/issues/usb-disk-index-stable-nothing-enumerates-on-the-first-controller.md similarity index 100% rename from issues/hardware/usb-disk-index-stable-nothing-enumerates-on-the-first-controller.md rename to issues/usb-disk-index-stable-nothing-enumerates-on-the-first-controller.md diff --git a/issues/boot-media/usb-short-read-reds-beside-other-guests-and-is-green-alone.md b/issues/usb-short-read-reds-beside-other-guests-and-is-green-alone.md similarity index 100% rename from issues/boot-media/usb-short-read-reds-beside-other-guests-and-is-green-alone.md rename to issues/usb-short-read-reds-beside-other-guests-and-is-green-alone.md diff --git a/issues/build/usb-transport-break-flushedstick-can-break-after-the-reboot.md b/issues/usb-transport-break-flushedstick-can-break-after-the-reboot.md similarity index 89% rename from issues/build/usb-transport-break-flushedstick-can-break-after-the-reboot.md rename to issues/usb-transport-break-flushedstick-can-break-after-the-reboot.md index acd44a32358..6e9bb0f42c2 100644 --- a/issues/build/usb-transport-break-flushedstick-can-break-after-the-reboot.md +++ b/issues/usb-transport-break-flushedstick-can-break-after-the-reboot.md @@ -30,4 +30,4 @@ flush is made to go out before the job ends the boot (or the case waits on the break before it starts the job), and ten consecutive `usb_transport_break` runs are green. -`usb_transport_break` is deleted; `issues/kernel/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md` records the commit that restores it. +`usb_transport_break` is deleted; `issues/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md` records the commit that restores it. diff --git a/issues/kernel/user-pointer-checks-have-no-spectre-v1-fence-and-smap-is-optional.md b/issues/user-pointer-checks-have-no-spectre-v1-fence-and-smap-is-optional.md similarity index 100% rename from issues/kernel/user-pointer-checks-have-no-spectre-v1-fence-and-smap-is-optional.md rename to issues/user-pointer-checks-have-no-spectre-v1-fence-and-smap-is-optional.md diff --git a/issues/kernel/user-programs-have-no-protection-keys.md b/issues/user-programs-have-no-protection-keys.md similarity index 93% rename from issues/kernel/user-programs-have-no-protection-keys.md rename to issues/user-programs-have-no-protection-keys.md index 06a756d2652..38ba663b6c6 100644 --- a/issues/kernel/user-programs-have-no-protection-keys.md +++ b/issues/user-programs-have-no-protection-keys.md @@ -11,7 +11,7 @@ part of its own memory off from itself. Linux at `Ubuntu-6.8.0-142.142` builds with `X86_INTEL_MEMORY_PROTECTION_KEYS` (`debian.master/config/annotations:15334`). Its ABI is approved in principle and shaped in this issue's pull request, which lands after -`issues/kernel/user-programs-use-avx-under-xsave.md`, since PKRU is XSAVE +`issues/user-programs-use-avx-under-xsave.md`, since PKRU is XSAVE state. **Exit**: under TCG with `+pku` (`target/i386/cpu.c:992` at QEMU v11.1.1), on diff --git a/issues/kernel/user-programs-run-without-a-shadow-stack.md b/issues/user-programs-run-without-a-shadow-stack.md similarity index 100% rename from issues/kernel/user-programs-run-without-a-shadow-stack.md rename to issues/user-programs-run-without-a-shadow-stack.md diff --git a/issues/kernel/user-programs-use-avx-under-xsave.md b/issues/user-programs-use-avx-under-xsave.md similarity index 92% rename from issues/kernel/user-programs-use-avx-under-xsave.md rename to issues/user-programs-use-avx-under-xsave.md index cbaeab370b4..f8791f03396 100644 --- a/issues/kernel/user-programs-use-avx-under-xsave.md +++ b/issues/user-programs-use-avx-under-xsave.md @@ -12,7 +12,7 @@ The kernel enables every vector component the CPU enumerates and saves them by one path on every CPU, XSAVEOPT, refusing by name a CPU without it: TCG implements neither XSAVEC nor XSAVES (`target/i386/cpu.c:1012-1014` at QEMU v11.1.1), and the CET state of -`issues/kernel/user-programs-run-without-a-shadow-stack.md` is switched by +`issues/user-programs-run-without-a-shadow-stack.md` is switched by `wrmsr`, as `fs_base` is. The TCG model gains `+xsave,+xsaveopt,+avx,+avx2`, which TCG implements (`cpu.c:905,907,981,1012`). diff --git a/issues/build/userland-programs-are-never-linted.md b/issues/userland-programs-are-never-linted.md similarity index 100% rename from issues/build/userland-programs-are-never-linted.md rename to issues/userland-programs-are-never-linted.md diff --git a/issues/filesystem/userlands-wall-clock-has-whole-seconds-and-an-mtime-has-nanoseconds.md b/issues/userlands-wall-clock-has-whole-seconds-and-an-mtime-has-nanoseconds.md similarity index 100% rename from issues/filesystem/userlands-wall-clock-has-whole-seconds-and-an-mtime-has-nanoseconds.md rename to issues/userlands-wall-clock-has-whole-seconds-and-an-mtime-has-nanoseconds.md diff --git a/issues/kernel/volatile-composites-on-mmio-dma-structs.md b/issues/volatile-composites-on-mmio-dma-structs.md similarity index 96% rename from issues/kernel/volatile-composites-on-mmio-dma-structs.md rename to issues/volatile-composites-on-mmio-dma-structs.md index f911dc0bc8d..53a5b65f525 100644 --- a/issues/kernel/volatile-composites-on-mmio-dma-structs.md +++ b/issues/volatile-composites-on-mmio-dma-structs.md @@ -40,5 +40,5 @@ ordering its rings actually require, decide per site whether one target's ISA guarantees a single-instruction store, which is again not something the *language* promises) or needs splitting, and add the regression coverage that would have caught the difference. Filed rather than -fixed — `issues/build/clippy-stage-two-is-lints-one-at-a-time.md` records the measurement +fixed — `issues/clippy-stage-two-is-lints-one-at-a-time.md` records the measurement and the reason it wasn't attempted here. diff --git a/issues/build/wait-until-for-the-supervisors-word-never-wakes-once-the-stream-is-dead.md b/issues/wait-until-for-the-supervisors-word-never-wakes-once-the-stream-is-dead.md similarity index 100% rename from issues/build/wait-until-for-the-supervisors-word-never-wakes-once-the-stream-is-dead.md rename to issues/wait-until-for-the-supervisors-word-never-wakes-once-the-stream-is-dead.md diff --git a/issues/kernel/watch-window-spins-out-a-hold-its-poster-is-queued-behind.md b/issues/watch-window-spins-out-a-hold-its-poster-is-queued-behind.md similarity index 95% rename from issues/kernel/watch-window-spins-out-a-hold-its-poster-is-queued-behind.md rename to issues/watch-window-spins-out-a-hold-its-poster-is-queued-behind.md index f338f4587de..e0a10988147 100644 --- a/issues/kernel/watch-window-spins-out-a-hold-its-poster-is-queued-behind.md +++ b/issues/watch-window-spins-out-a-hold-its-poster-is-queued-behind.md @@ -33,4 +33,4 @@ not reproduced. task on the same CPU lands in it; and `blocking_read_window` shown green at a rate on a guest whose canary pair shares a CPU. -`watch-window` and `blocking_read_window` are deleted; `issues/build/blocking-read-window-reds-beside-other-guests.md` records the commit that restores them. +`watch-window` and `blocking_read_window` are deleted; `issues/blocking-read-window-reds-beside-other-guests.md` records the commit that restores them. diff --git a/issues/hardware/watchdog-fed-ends-its-boot-before-the-bound-it-judges.md b/issues/watchdog-fed-ends-its-boot-before-the-bound-it-judges.md similarity index 91% rename from issues/hardware/watchdog-fed-ends-its-boot-before-the-bound-it-judges.md rename to issues/watchdog-fed-ends-its-boot-before-the-bound-it-judges.md index 3d8acda7a5a..2e5188f42cb 100644 --- a/issues/hardware/watchdog-fed-ends-its-boot-before-the-bound-it-judges.md +++ b/issues/watchdog-fed-ends-its-boot-before-the-bound-it-judges.md @@ -16,5 +16,5 @@ and the shutdown disarms the timer (`arch::watchdog::disarm`), inside one **Exit**: `watchdog_fed`'s boot holds past `toyos_tco::BOUND_MS` before its `reboot`, and the same boot on a kernel whose scheduler pass never feeds reds -it once `issues/hardware/a-frozen-toyos-waits-for-a-hand-on-the-power-button.md` +it once `issues/a-frozen-toyos-waits-for-a-hand-on-the-power-button.md` has seen the TCO reset the T14. diff --git a/issues/design-debt/what-is-owed-on-file-size.md b/issues/what-is-owed-on-file-size.md similarity index 100% rename from issues/design-debt/what-is-owed-on-file-size.md rename to issues/what-is-owed-on-file-size.md diff --git a/issues/filesystem/where-everything-lives.md b/issues/where-everything-lives.md similarity index 93% rename from issues/filesystem/where-everything-lives.md rename to issues/where-everything-lives.md index 01bf18711c7..e784cc39861 100644 --- a/issues/filesystem/where-everything-lives.md +++ b/issues/where-everything-lives.md @@ -7,10 +7,10 @@ opened: 2026-09-26 # Where everything lives, and how a program finds it The owner ruled this layout on 2026-09-26. This file is where it is recorded: -`issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md` says what +`issues/storage-is-layers-and-a-role-is-a-filesystem.md` says what backs each name, and -`issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md` and -`issues/isolation/every-program-sees-only-the-files-it-was-given.md` say who +`issues/a-user-is-a-home-tree-and-a-login-row.md` and +`issues/every-program-sees-only-the-files-it-was-given.md` say who may reach it. Every line below is the owner's ruling. ## The tree @@ -28,7 +28,7 @@ may reach it. Every line below is the owner's ruling. ``` `/system` is signed because the image is: -`issues/boot-media/the-machine-updates-itself-without-ubuntu.md` signs it, and +`issues/the-machine-updates-itself-without-ubuntu.md` signs it, and until that lands nothing verifies it. ## The rules @@ -77,7 +77,7 @@ until that lands nothing verifies it. each desktop app in the image) with `HOME=/home//Apps/`, makes the folder and its `Config Data Cache State`, and puts nothing else of the home in that app's view. It needs - `issues/isolation/every-program-sees-only-the-files-it-was-given.md` stage 2. + `issues/every-program-sees-only-the-files-it-was-given.md` stage 2. **Exit**: a launched app's `home_dir()` is its folder, it cannot name another app's folder, and the shell's history is still `/home//Apps/shell/State/history` (`OWN_FOLDER` in `userland/shell`). @@ -119,4 +119,4 @@ until that lands nothing verifies it. `--exit-with-lease` bench report the metal loop reads off the stick's FAT log volume, as it reads `/log/metal-*.bin`, and the DATA volume is not readable there. It goes with -`issues/diagnostics/netstacks-lease-probe-answers-a-question-its-lines-already-answer.md`. +`issues/netstacks-lease-probe-answers-a-question-its-lines-already-answer.md`. diff --git a/issues/design-debt/whether-a-region-may-be-lent-is-a-runtime-option.md b/issues/whether-a-region-may-be-lent-is-a-runtime-option.md similarity index 100% rename from issues/design-debt/whether-a-region-may-be-lent-is-a-runtime-option.md rename to issues/whether-a-region-may-be-lent-is-a-runtime-option.md diff --git a/issues/build/which-pass-drain-irqs-is-entered-from-is-gated-only-by-a-nightly-guest.md b/issues/which-pass-drain-irqs-is-entered-from-is-gated-only-by-a-nightly-guest.md similarity index 86% rename from issues/build/which-pass-drain-irqs-is-entered-from-is-gated-only-by-a-nightly-guest.md rename to issues/which-pass-drain-irqs-is-entered-from-is-gated-only-by-a-nightly-guest.md index 090e65fa7a1..a6939c8b917 100644 --- a/issues/build/which-pass-drain-irqs-is-entered-from-is-gated-only-by-a-nightly-guest.md +++ b/issues/which-pass-drain-irqs-is-entered-from-is-gated-only-by-a-nightly-guest.md @@ -17,4 +17,4 @@ and only the nightly `blocked_dump` went red. **Exit**: a mutation of either call site's `Entered` reds a host test. Owner: orchestrator. -`blocked_dump`, the nightly guest this names, is deleted; `issues/build/parallel-tests-red-under-other-suites.md` records the commit that restores it. Until then no test reds that mutation. +`blocked_dump`, the nightly guest this names, is deleted; `issues/parallel-tests-red-under-other-suites.md` records the commit that restores it. Until then no test reds that mutation. diff --git a/issues/kernel/x2apic-is-enabled-without-reading-firmwares-opt-out.md b/issues/x2apic-is-enabled-without-reading-firmwares-opt-out.md similarity index 93% rename from issues/kernel/x2apic-is-enabled-without-reading-firmwares-opt-out.md rename to issues/x2apic-is-enabled-without-reading-firmwares-opt-out.md index d1e0397c302..711348e329c 100644 --- a/issues/kernel/x2apic-is-enabled-without-reading-firmwares-opt-out.md +++ b/issues/x2apic-is-enabled-without-reading-firmwares-opt-out.md @@ -15,7 +15,7 @@ x2APIC unconditionally in `arch::apic::init` (`enable_x2apic`), reached from DMAR` line) and decides nothing. The owner's ruling on extended interrupt mode -(`issues/kernel/the-iommu-refuses-nothing-yet.md`) is about the width of a +(`issues/the-iommu-refuses-nothing-yet.md`) is about the width of a remapping entry's destination, not whether x2APIC is on, so it does not cover this. The T14 clears the flag (`flags=0x05`), so no machine in reach sets it. diff --git a/issues/hardware/xhci-flap-wedges-under-kvm.md b/issues/xhci-flap-wedges-under-kvm.md similarity index 89% rename from issues/hardware/xhci-flap-wedges-under-kvm.md rename to issues/xhci-flap-wedges-under-kvm.md index 61cf760c288..5949531702b 100644 --- a/issues/hardware/xhci-flap-wedges-under-kvm.md +++ b/issues/xhci-flap-wedges-under-kvm.md @@ -21,11 +21,8 @@ test ends on, and `test_rs_input_events` therefore never exits. So the driver survives three collapsed replugs and stops on the fourth, on the accelerator that runs the guest ~50x faster between the host's two QMP writes. The owner's rule names what this is — "everything should work under emulation and -kvm if it doesnt something with the guest is wrong" — and it is the class `issues/hardware/`'s -xHCI entries already track: one outstanding operation per controller, a -completion matched by its Command TRB address, a recovery cancelled by a -disconnect. Not diagnosed further here; found by CI, which is the thing CI was -built to do. +kvm if it doesnt something with the guest is wrong". Not diagnosed further +here; found by CI, which is the thing CI was built to do. **It has stopped reproducing, which is not the same as being fixed.** Run `31258202923`, five reps of the whole twelve-shard configuration on the same @@ -53,12 +50,12 @@ All four are green on the dev host in seconds and green under TCG on the same runner image and the same QEMU. So the class is one sentence: **the xHCI driver's plug, unplug and endpoint-recovery paths are unreliable when the guest executes natively**, and the ~50x speed-up between the host's two QMP writes is the only -thing that changed. `issues/hardware/`'s own entries name the shape it would be in — one +thing that changed. `issues/pulling-the-boot-stick-freezes-the-t14.md` names the shape it would be in — one outstanding operation per controller, a completion matched by its Command TRB address, a recovery cancelled by a disconnect rather than waited out. **This class is what stands between CI and green.** It is not -`issues/build/parallel-tests-red-under-other-suites.md`'s classification +`issues/parallel-tests-red-under-other-suites.md`'s classification class: it fails alone, and it fails the same way twice. **Three of the four have stopped and one has not.** Run `31258202923`, five reps diff --git a/issues/hardware/xhci-waits-are-spins.md b/issues/xhci-waits-are-spins.md similarity index 94% rename from issues/hardware/xhci-waits-are-spins.md rename to issues/xhci-waits-are-spins.md index 24edf644062..c5069042abc 100644 --- a/issues/hardware/xhci-waits-are-spins.md +++ b/issues/xhci-waits-are-spins.md @@ -14,13 +14,13 @@ command and transfer, each bounded by `USB_TIMEOUT_NS`, 2 s. The port machine's enumeration and HID recovery submit and return; what still spins is the boot path's bring-up, the stop, a disk's bind after boot, inside a scheduler pass -(`issues/hardware/a-disk-plugged-in-after-boot-is-bound-inside-a-scheduling-pass.md`), +(`issues/a-disk-plugged-in-after-boot-is-bound-inside-a-scheduling-pass.md`), and a disk call. A call on a USB disk holds `XHCI` from its first command (`with_disk`, `kernel/src/drivers/xhci/wait/msc.rs`) inside a syscall, which runs with interrupts masked from entry to exit -(`issues/kernel/syscall-preemption-is-incidental.md`): a partition claim's +(`issues/syscall-preemption-is-incidental.md`): a partition claim's `SYS_PARTITION_READ`, `SYS_PARTITION_WRITE` and `SYS_FSYNC`, the last a cache flush through `xhci::storage_flush` (`partition_fsync`, `kernel/src/object/ops.rs`), and the table `SYS_DEVICE_CLAIM` reads for one @@ -77,7 +77,7 @@ fsd. interrupts off for 2 ms. - **Not the firmware**: `MSR_SMI_COUNT` does not move across any of them. The windows it does move across are - `issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md`'s. + `issues/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md`'s. The `mask-windows` kernel (`kernel/src/windows.rs`) prints a span and no opener, and #649's T14 boots printed these by reading: @@ -96,7 +96,7 @@ opener, and #649's T14 boots printed these by reading: `72f16e39a`, and two in `649-r5/1-head`, cpu7 at 11,522,834 and cpu4 at 11,645,411 (`loader.log:57`, `:63`). -**Owner**: `issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md`, +**Owner**: `issues/the-kernel-is-small-interrupts-post-and-threads-wait.md`, whose step 10 moves the whole xHCI to usbd and deletes the kernel's driver. It owes both exits. diff --git a/kernel/.cargo/config.toml b/kernel/.cargo/config.toml index 71025f80d2d..2f1e7ae3096 100644 --- a/kernel/.cargo/config.toml +++ b/kernel/.cargo/config.toml @@ -7,7 +7,7 @@ rustflags = ["-Dwarnings", "-Cforce-frame-pointers=yes"] # the syscall gate, the interrupt controller and the scheduler a way in, every # item only those reach is unreachable there and nowhere else — and an # `#[expect(dead_code)]` cannot be met under it, hence the second `-A`. Exit: -# both go when `issues/kernel/toyos-runs-on-arm64.md`'s stage 7 lands. The +# both go when `issues/toyos-runs-on-arm64.md`'s stage 7 lands. The # loader takes a static PIE at base 0 (`ET_DYN`, `R_AARCH64_RELATIVE` only), # which rust-lld makes of the target's static-model code with `-pie`: `-z # notext` lets absolute words stay in read-only sections, which the loader diff --git a/kernel/loom/tests/loom_mailbox.rs b/kernel/loom/tests/loom_mailbox.rs index 0db13dfc424..51078736b83 100644 --- a/kernel/loom/tests/loom_mailbox.rs +++ b/kernel/loom/tests/loom_mailbox.rs @@ -271,7 +271,7 @@ fn steal_probe_node_is_never_double_linked() { /// **A control for a defect that stands, not for a mutation.** This crate's /// other features model a rule away to show the model catches the lie; this one /// changes nothing and lets the victim do what a stopped CPU does, and the -/// model must then fail — `issues/kernel/steal-probe-node-dies-with-its-victim.md` +/// model must then fail — `issues/steal-probe-node-dies-with-its-victim.md` /// reproduced instead of argued. `TOYOS_LOOM_RAW=1` skips the catch. /// /// **The exit is deletion, not a green run.** The feature *defines* every diff --git a/kernel/loom/tests/reap_gate.rs b/kernel/loom/tests/reap_gate.rs index f91aba2db4e..995887b0464 100644 --- a/kernel/loom/tests/reap_gate.rs +++ b/kernel/loom/tests/reap_gate.rs @@ -2,9 +2,8 @@ //! //! The gate exists so that a CPU with nothing to run does not take //! `PROCESS_TABLE` on every trip round the idle loop — the standing aggressor -//! against the crash report's `try_lock`, which is the whole reason a fault -//! report could print a bare address for a symbol that was right there -//! (`issues/panic-path/`). Gating housekeeping on a flag is only sound if +//! against the crash report's `try_lock`. +//! Gating housekeeping on a flag is only sound if //! the flag cannot lose a raise, and that is what these models are for: a raise //! concurrent with a claim, from every interleaving loom can build. //! diff --git a/kernel/pci/src/bar.rs b/kernel/pci/src/bar.rs index 00af5970d09..e7d93242212 100644 --- a/kernel/pci/src/bar.rs +++ b/kernel/pci/src/bar.rs @@ -30,7 +30,7 @@ //! **What this does not bound is the address.** A BAR that says memory names a //! physical address the kernel then maps, and every non-zero value is a //! possible one. Bounding what a device may be *pointed at* is the IOMMU's -//! question (`issues/kernel/the-iommu-refuses-nothing-yet.md`), not this +//! question (`issues/the-iommu-refuses-nothing-yet.md`), not this //! decoder's. use core::fmt; diff --git a/kernel/pure/proclife/interleave.rs b/kernel/pure/proclife/interleave.rs index 098f99d2906..f80634e933d 100644 --- a/kernel/pure/proclife/interleave.rs +++ b/kernel/pure/proclife/interleave.rs @@ -8,7 +8,7 @@ //! point". Not //! one of those sentences was checkable by anything but a booted guest with a //! race that had to land the wrong way, which is why -//! `issues/kernel/spawned-process-never-starts.md` has been open since August +//! `issues/spawned-process-never-starts.md` has been open since August //! and was never reproduced in QEMU. //! //! An [`Op`] here is one of those kernel paths, cut at exactly the points where diff --git a/kernel/pure/sched/cpu.rs b/kernel/pure/sched/cpu.rs index 0c9738cbca1..b9dc57451a1 100644 --- a/kernel/pure/sched/cpu.rs +++ b/kernel/pure/sched/cpu.rs @@ -229,7 +229,7 @@ pub struct CpuSched { /// occupied" is false. /// /// **Superseded in design by the reservation model** - /// (`issues/kernel/cpu-time-is-a-band-and-not-a-reservation.md`), which + /// (`issues/cpu-time-is-a-band-and-not-a-reservation.md`), which /// deletes the age, the chunk and the grant together: the deferral /// above is bounded per *corpse* and not per CPU, so k corpses take k /// consecutive grants, and a real-time band that briefly empties throws the @@ -888,8 +888,8 @@ impl CpuSched { /// disjoint from both. That argument is worth one comparison per migration /// to stop being an argument: if it is ever wrong, the far CPU restores a /// stack this one is standing on, and what the machine reports is not this - /// site but a container somewhere else reading as a value nothing can write - /// (`issues/kernel/`, the `BTreeMap`-inside-its-own-insert class). Two CPUs + /// site but a container somewhere else reading as a value nothing can write. + /// Two CPUs /// on one kernel stack is not a state to return an error from — it is a /// kernel bug, and it dies here where it can still be named. fn hand_off, P: PreemptGuard>( diff --git a/kernel/src/arch/aarch64/mod.rs b/kernel/src/arch/aarch64/mod.rs index 0e56393ffb3..295062ec1e8 100644 --- a/kernel/src/arch/aarch64/mod.rs +++ b/kernel/src/arch/aarch64/mod.rs @@ -4,7 +4,7 @@ //! Every `unsafe` block here carries a one-line `SAFETY:` comment, enforced by the lint above. /// Stands for work the port owes: panics naming what and which stage of the -/// track owns it (`issues/kernel/toyos-runs-on-arm64.md`), or that none does yet. +/// track owns it (`issues/toyos-runs-on-arm64.md`), or that none does yet. macro_rules! owed { ($what:literal, $stage:literal) => { panic!(concat!("aarch64: ", $what, ": owed by ", $stage)) diff --git a/kernel/src/arch/x86_64/smp.rs b/kernel/src/arch/x86_64/smp.rs index 721f93de39d..3313af5966d 100644 --- a/kernel/src/arch/x86_64/smp.rs +++ b/kernel/src/arch/x86_64/smp.rs @@ -400,7 +400,7 @@ global_asm!( // SSE state and `fxsave` without `CR4.OSFXSR` is `#UD`. This CR4 holds // `PAE` alone until `init_ap` reaches `control_regs::init`, so a fault // before that point faults again in its own handler — - // `issues/kernel/an-ap-loads-the-idt-before-its-control-registers.md`. + // `issues/an-ap-loads-the-idt-before-its-control-registers.md`. "mov edi, 0x8F00", "lidt [rdi + 0x28]", // TrampolineData.kernel_idt diff --git a/kernel/src/arch/x86_64/vtd/mod.rs b/kernel/src/arch/x86_64/vtd/mod.rs index 7fc808bd536..9dc03c9ca9f 100644 --- a/kernel/src/arch/x86_64/vtd/mod.rs +++ b/kernel/src/arch/x86_64/vtd/mod.rs @@ -543,7 +543,7 @@ fn enable( // After the tables are built, so a unit firmware left translating passes DMA // untranslated only while it is programmed - // (`issues/kernel/a-unit-left-translating-passes-dma-untranslated-while-programmed.md`), + // (`issues/a-unit-left-translating-passes-dma-untranslated-while-programmed.md`), // and before the queue is pointed, which §6.5.2 does only with it off. unit.hand_over(); let mut queue = Queue::new(&mut TABLES.lock(), unit.regs); diff --git a/kernel/src/drivers/xhci/stop.rs b/kernel/src/drivers/xhci/stop.rs index 03504f6bf87..22572109e75 100644 --- a/kernel/src/drivers/xhci/stop.rs +++ b/kernel/src/drivers/xhci/stop.rs @@ -22,7 +22,7 @@ //! every path but the panic one a live driver may still be enqueuing on — for //! an out data phase, a second write of the block. What a cut command then //! costs is a question about the device and not about this path: -//! `issues/kernel/a-cut-bulk-only-command-does-not-brick-the-benchs-stick.md`. +//! `issues/a-cut-bulk-only-command-does-not-brick-the-benchs-stick.md`. //! //! **Registers and DMA and nothing else, because the panic path calls this.** //! The controllers are published into [`POINTS`] at bring-up rather than read diff --git a/kernel/src/log/mod.rs b/kernel/src/log/mod.rs index 7dcea32f8e7..f0894458f0f 100644 --- a/kernel/src/log/mod.rs +++ b/kernel/src/log/mod.rs @@ -177,7 +177,7 @@ fn reserve(guard: &crate::arch::IrqGuard) -> (Origin, u64) { /// know the raw idle-CPU sentinel. /// /// A process's first thread has `Tid(0)`, which also renders as absent — -/// tracked at `issues/diagnostics/a-record-cannot-name-thread-zero.md`, fixed +/// tracked at `issues/a-record-cannot-name-thread-zero.md`, fixed /// in the ABI's formatter rather than here. fn on_a_thread(id: u32) -> u32 { if id == u32::MAX { 0 } else { id } diff --git a/kernel/src/mm/region.rs b/kernel/src/mm/region.rs index c868fcb2aca..6e169147bdf 100644 --- a/kernel/src/mm/region.rs +++ b/kernel/src/mm/region.rs @@ -1,4 +1,4 @@ -//! `KernelSlice` is `Copy`, carries no lifetime, and can outlive its `Allocation`; tracked at `issues/design-debt/kernelslice-outlives-its-allocation.md`. +//! `KernelSlice` is `Copy`, carries no lifetime, and can outlive its `Allocation`; tracked at `issues/kernelslice-outlives-its-allocation.md`. /// A kernel allocation that can vouch for its own extent. /// # Safety diff --git a/kernel/src/object/mod.rs b/kernel/src/object/mod.rs index e530fe80c0d..205029806b9 100644 --- a/kernel/src/object/mod.rs +++ b/kernel/src/object/mod.rs @@ -2,7 +2,7 @@ //! //! Objects are plain `Arc`: no custom refcounting, no `Weak`, no `dyn` hierarchy. //! -//! `handle_count`, not the Arc strong count, is what userland-visible lifecycle rides: a syscall's `Arc` can be stranded on a killed thread's kernel stack, so release is deferred through [`ZERO_QUEUE`] — see `issues/kernel/deferred-release-outlives-its-syscall.md`. +//! `handle_count`, not the Arc strong count, is what userland-visible lifecycle rides: a syscall's `Arc` can be stranded on a killed thread's kernel stack, so release is deferred through [`ZERO_QUEUE`] — see `issues/deferred-release-outlives-its-syscall.md`. // `warn` here gates via CI's `-D warnings`; the rest of the kernel is not yet swept. #![warn(clippy::undocumented_unsafe_blocks)] diff --git a/kernel/src/object/ops.rs b/kernel/src/object/ops.rs index 264db66bac9..744ccedf56f 100644 --- a/kernel/src/object/ops.rs +++ b/kernel/src/object/ops.rs @@ -815,7 +815,7 @@ pub fn has_data(object: &KObjectRef) -> bool { /// [`has_data`] cannot be asked for: the log's, whose unread records are a /// property of the reader's cursor, which the kernel does not hold; and a /// console's, whose watch is the keyboard's while its data is the serial -/// line's (`issues/kernel/a-console-watch-waits-on-the-keyboard-not-the-serial-line.md`). +/// line's (`issues/a-console-watch-waits-on-the-keyboard-not-the-serial-line.md`). pub fn read_posts_are_readiness(object: &KObjectRef) -> bool { match object { KObjectRef::SysCap(_) | KObjectRef::Console(_) => true, diff --git a/kernel/src/syscall/vm.rs b/kernel/src/syscall/vm.rs index 9c6edf668e4..d5da317fe5e 100644 --- a/kernel/src/syscall/vm.rs +++ b/kernel/src/syscall/vm.rs @@ -24,7 +24,7 @@ use toyos_abi::syscall::*; /// /// **Hand-copied from `toyos-abi` and nothing checks the copy**: a bit added /// there and not here is refused although the ABI defines it, measured in -/// `issues/kernel/a-known-mask-is-copied-out-of-toyos-abi-by-hand.md`. +/// `issues/a-known-mask-is-copied-out-of-toyos-abi-by-hand.md`. const MMAP_PROT_KNOWN: u64 = MmapProt::READ.0 | MmapProt::WRITE.0; /// Every bit `MmapFlags` defines; hand-copied, as `MMAP_PROT_KNOWN` says. const MMAP_FLAGS_KNOWN: u64 = MmapFlags::ANONYMOUS.0 | MmapFlags::PRIVATE.0 | MmapFlags::FIXED.0; diff --git a/src/build.rs b/src/build.rs index c1c164badf8..b51c06fb9fc 100644 --- a/src/build.rs +++ b/src/build.rs @@ -811,14 +811,14 @@ const NOT_YET_BUILT: &[(Arch, &str, &str)] = &[ Arch::Aarch64, "doom", "softbuffer's toyos fork stops it \ - (issues/build/the-toolkit-forks-resolve-an-x86-only-toyos-window.md); its C compiles for \ + (issues/the-toolkit-forks-resolve-an-x86-only-toyos-window.md); its C compiles for \ AArch64 with the toolchain's clang", ), ]; const TOOLKIT_FORKS: &str = "softbuffer's and winit's toyos forks resolve the published \ toyos-window 0.2.0, whose framebuffer is x86-64 only \ - (issues/build/the-toolkit-forks-resolve-an-x86-only-toyos-window.md)"; + (issues/the-toolkit-forks-resolve-an-x86-only-toyos-window.md)"; /// Why `arch`'s userland leaves `program` out, if it does. fn not_built_for(arch: Arch, program: &str) -> Option<&'static str> { @@ -1028,7 +1028,7 @@ pub struct Boot { config: PathBuf, image: PathBuf, /// Which of the two build sequences writes it. They are not one function - /// yet — `issues/build/two-sequences-build-one-image.md` — and until they + /// yet — `issues/two-sequences-build-one-image.md` — and until they /// are, this is what keeps each artifact to a single writer. case: bool, } diff --git a/src/ci.rs b/src/ci.rs index f69ee1a8440..2e13a0b9b24 100644 --- a/src/ci.rs +++ b/src/ci.rs @@ -368,7 +368,7 @@ pub(crate) const CONTROLS: &[Control] = &[ Fails("a_poll_registered_racing_a_post_in_place_completes_exactly_once"), ]), // Reproduces an open defect - // (`issues/kernel/steal-probe-node-dies-with-its-victim.md`) rather than + // (`issues/steal-probe-node-dies-with-its-victim.md`) rather than // proving a lie is caught, and goes with its fix. Control { krate: KERNEL_LOOM, diff --git a/src/clippy.rs b/src/clippy.rs index 65acca983e8..9811e7e1431 100644 --- a/src/clippy.rs +++ b/src/clippy.rs @@ -12,7 +12,7 @@ use crate::arch::Arch; use crate::ci::{KERNEL_HOST_TARGET, KERNEL_MANIFEST}; /// The pedantic/nursery lints adopted one at a time, each on a measured finding -/// (`issues/build/clippy-stage-two-is-lints-one-at-a-time.md`). +/// (`issues/clippy-stage-two-is-lints-one-at-a-time.md`). const ADOPTED: &[&str] = &[ "clippy::checked_conversions", "clippy::default_trait_access", diff --git a/src/kernelconsole.rs b/src/kernelconsole.rs index f90197e1f23..73b30fe4b4e 100644 --- a/src/kernelconsole.rs +++ b/src/kernelconsole.rs @@ -17,7 +17,7 @@ pub const HEAD: &str = "[kernel "; /// A console's bytes as they arrive, withheld until the kernel's first record. /// /// Of a QEMU process's first boot only: a guest reset does not re-arm it -/// (`issues/build/the-kernel-console-split-does-not-re-arm-across-a-guest-reset.md`). +/// (`issues/the-kernel-console-split-does-not-re-arm-across-a-guest-reset.md`). pub struct KernelConsole { /// The withheld tail that could still begin [`HEAD`]; `None` once the /// kernel has begun. diff --git a/src/libcxx.rs b/src/libcxx.rs index 2f0403caeb4..f714b9f94b8 100644 --- a/src/libcxx.rs +++ b/src/libcxx.rs @@ -41,7 +41,7 @@ pub(crate) const OPTIONS: [(&str, &str); 18] = [ // The C library has no `dladdr`, so libunwind names no function it unwinds. ("LIBUNWIND_ADDITIONAL_COMPILE_FLAGS", "-D_LIBUNWIND_USE_DLADDR=0"), // The C library has no directory, `stat` or path surface for it - // (`issues/build/libcxx-is-built-without-std-filesystem.md`). + // (`issues/libcxx-is-built-without-std-filesystem.md`). ("LIBCXX_ENABLE_FILESYSTEM", "OFF"), ("LIBCXX_INCLUDE_BENCHMARKS", "OFF"), ("LIBCXX_INCLUDE_TESTS", "OFF"), diff --git a/src/licence.rs b/src/licence.rs index bdc30429c02..bb8c92ccb48 100644 --- a/src/licence.rs +++ b/src/licence.rs @@ -134,7 +134,7 @@ pub struct Exception { } const DOOM_LEAVES: &str = - "issues/filesystem/a-package-is-a-directory-under-apps-and-the-installer-is-a-program.md"; + "issues/a-package-is-a-directory-under-apps-and-the-installer-is-a-program.md"; const fn pending( subject: Subject, @@ -209,7 +209,7 @@ pub const EXCEPTIONS: &[Exception] = &[ /// not, because that directory is where third-party material arrives. A /// third-party *text* file anywhere else — a ninth Phosphor SVG one directory /// over — is reached by neither, and the corpus by count alone and no digest; -/// `issues/build/the-third-party-corpus-is-in-no-machine-read-ledger.md` is +/// `issues/the-third-party-corpus-is-in-no-machine-read-ledger.md` is /// what is left of that gap. pub const COMMITTED_FILES: &[(&str, &str, &str, Terms)] = &[ // The ACPI tables QEMU 11.1.1 published to a `Profile::Headless` guest, diff --git a/src/metaltalk.rs b/src/metaltalk.rs index b5c31f06225..a398349f197 100644 --- a/src/metaltalk.rs +++ b/src/metaltalk.rs @@ -247,7 +247,7 @@ impl Stream { /// **The admitted dial is the event, and `by` its only bound**: nothing the /// machine sends says when `logkeeper` admits a reader again, so how many dials /// that takes is the length of the machine's gap and no verdict — the - /// recorded compromise `issues/diagnostics/a-swaps-redial-asks-again-with-no-event-to-wait-on.md`. + /// recorded compromise `issues/a-swaps-redial-asks-again-with-no-event-to-wait-on.md`. /// /// **For a connection this host knows is going**: a swap of the netstack /// carrying it ends it with no FIN and no reset, so nothing but this host diff --git a/src/sourcegate.rs b/src/sourcegate.rs index 568f537e36d..571c134e92f 100644 --- a/src/sourcegate.rs +++ b/src/sourcegate.rs @@ -91,7 +91,7 @@ const NMI_SILENT: &[&str] = /// Every `enable_bus_master(` site `kernel/src` holds, by file and count. /// Arming DMA comes after a site's refusals — virtio parses its capability /// chain first and disarms on one it cannot use — and the three early-enabling -/// MMIO drivers are `issues/isolation/`'s to fix, not a precedent. +/// MMIO drivers are `issues/bus-mastering-rides-memory-decode.md`'s to fix, not a precedent. /// /// A function handed to a *process* takes the other path: `pcidev` arms bus /// mastering with `start_bus_mastering`, after the address space that bounds it diff --git a/src/sysroot.rs b/src/sysroot.rs index b1e608fc4e3..b5730bc6d75 100644 --- a/src/sysroot.rs +++ b/src/sysroot.rs @@ -363,7 +363,7 @@ pub(crate) fn gitlink(checkout: &Path, path: &str) -> String { pub(crate) enum Links { /// Refused by name. Refused, - /// Left out of the identity (`issues/build/a-compiler-key-reads-no-symbolic-link.md`). + /// Left out of the identity (`issues/a-compiler-key-reads-no-symbolic-link.md`). Skipped, } diff --git a/src/toolchain.rs b/src/toolchain.rs index b7a00883cc3..4957e739c97 100644 --- a/src/toolchain.rs +++ b/src/toolchain.rs @@ -514,9 +514,7 @@ fn runs(stage2: &Path) -> bool { /// Every step decides under the caller's shared lock and acts under the /// exclusive one, so the common answer — nothing to do — costs no /// serialisation, and two agents cannot both conclude the compiler is stale -/// and both start `x.py build` in the same directory. That pair is what left a -/// half-written `librustc_driver` for cargo to probe, and cargo memoises a -/// failed probe (`issues/build/`). +/// and both start `x.py build` in the same directory. /// /// The steps are ordered, and each invalidates what it makes stale rather than /// threading a `rebuilt` flag through: a step that decides for itself still diff --git a/src/userlandhost.rs b/src/userlandhost.rs index 9d74d61c5b1..113e4064501 100644 --- a/src/userlandhost.rs +++ b/src/userlandhost.rs @@ -19,14 +19,14 @@ //! ```toml //! [package.metadata.toyos.host] //! fails = ["windows"] -//! issue = "issues/build/.md" +//! issue = "issues/.md" //! ``` //! //! A host's apps are built where the gate runs on its triple ([`Os::triple`]), //! and checked against that triple elsewhere. A check links nothing and runs //! build scripts on the host that checks, and a declared failure is attempted on //! no host, so one that outlives its fix goes unseen -//! (`issues/build/a-hosts-apps-are-judged-on-other-hosts-runners.md`). An app +//! (`issues/a-hosts-apps-are-judged-on-other-hosts-runners.md`). An app //! whose work a `cfg` compiles out of a host checks green there: only review //! holds that (`.claude/agents/reviewer.md`, Hosts). //! @@ -257,18 +257,18 @@ fn declared(manifest: &toml::Value, root: &Path) -> Result { } } -/// `issue` is `issues//.md`, work still owed, and names `app` in +/// `issue` is `issues/.md`, work still owed, and names `app` in /// backticks. fn owed(root: &Path, issue: &str, app: &str) -> Result<(), String> { let word = |s: &str| { !s.is_empty() && s.chars().all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-') }; let shaped = match issue.split('/').collect::>()[..] { - ["issues", area, slug] => word(area) && slug.strip_suffix(".md").is_some_and(word), + ["issues", slug] => slug.strip_suffix(".md").is_some_and(word), _ => false, }; if !shaped { - return Err(format!("`issue` is {issue:?}, which is no issues//.md")); + return Err(format!("`issue` is {issue:?}, which is no issues/.md")); } let text = std::fs::read_to_string(root.join(issue)) .map_err(|e| format!("`issue` is {issue}, which does not open: {e}"))?; @@ -538,17 +538,18 @@ mod tests { let text = format!("---\nstatus: {status}\nkind: defect\n---\n\n| `calc` | 101 |\n"); fs::write(path, text).expect("write a fixture issue"); }; - put("issues/build/x.md", "open"); - put("issues/build/held.md", "assigned"); - put("issues/build/asked.md", "owner"); + put("issues/x.md", "open"); + put("issues/held.md", "assigned"); + put("issues/asked.md", "owner"); put("issues/README.md", "open"); + put("issues/build/x.md", "open"); put("notes.md", "open"); let read = |host: &str| { let manifest = format!("[package]\nname = \"calc\"\n{host}"); declared(&manifest.parse().expect("TOML"), &dir) }; let table = "[package.metadata.toyos.host]\n"; - let issue = "issue = \"issues/build/x.md\"\n"; + let issue = "issue = \"issues/x.md\"\n"; assert_eq!(read(""), Ok(Host::App(Vec::new()))); assert_eq!(read("[package.metadata.toyos]\nother = 1\n"), Ok(Host::App(Vec::new()))); for case in ["owns", "manages"] { @@ -559,7 +560,7 @@ mod tests { Ok(Host::App(vec![Os::Windows, Os::Linux])) ); assert_eq!( - read(&format!("{table}fails = [\"linux\"]\nissue = \"issues/build/held.md\"\n")), + read(&format!("{table}fails = [\"linux\"]\nissue = \"issues/held.md\"\n")), Ok(Host::App(vec![Os::Linux])) ); for refused in [ @@ -579,8 +580,9 @@ mod tests { format!("{table}fails = [\"linux\"]\nissue = \"notes.md\"\n"), format!("{table}fails = [\"linux\"]\nissue = \"issues/README.md\"\n"), format!("{table}fails = [\"linux\"]\nissue = \"issues/../notes.md\"\n"), - format!("{table}fails = [\"linux\"]\nissue = \"issues/build/asked.md\"\n"), - format!("{table}fails = [\"linux\"]\nissue = \"issues/build/gone.md\"\n"), + format!("{table}fails = [\"linux\"]\nissue = \"issues/build/x.md\"\n"), + format!("{table}fails = [\"linux\"]\nissue = \"issues/asked.md\"\n"), + format!("{table}fails = [\"linux\"]\nissue = \"issues/gone.md\"\n"), format!("{table}exmept.owns = \"a panel\"\n"), format!("{table}exempt.owns = \"a panel\"\nnote = \"it may grow\"\n"), "[package.metadata.toyos]\nhost = \"exempt\"\n".to_string(), diff --git a/tests/checks/qemu.rs b/tests/checks/qemu.rs index c9b8a0ed406..7a3dadfd246 100644 --- a/tests/checks/qemu.rs +++ b/tests/checks/qemu.rs @@ -235,7 +235,7 @@ pub fn ceiling_self_check() -> Result<(), String> { if !carried.to_string().contains(want) { return Err(format!( "the verdict names the death and drops {want:?}, which is the defect \ - `issues/kernel/a-double-fault-on-cpu-1-under-a-wide-suite.md` is \ + `issues/a-double-fault-on-cpu-1-under-a-wide-suite.md` is \ about:\n{carried}" )); } diff --git a/tests/common/audio.rs b/tests/common/audio.rs index 46a61b33721..1d4ac73096a 100644 --- a/tests/common/audio.rs +++ b/tests/common/audio.rs @@ -188,9 +188,8 @@ fn departures(serial: &str) -> Vec { /// **soundserver may not report a departure it did not establish.** /// /// A crash and a clean exit close the same descriptors in the same order, so -/// the mix loop's broken signal pipe witnesses neither — it used to say `died` -/// anyway, and did so on 5 of 44 runs whose client exited `code=0` -/// (`issues/audio/`, closed). Two things are asserted here, and the +/// the mix loop's broken signal pipe witnesses neither. +/// Two things are asserted here, and the /// second is the one with teeth: every removal names how the stream ended, in /// the fixed departure vocabulary, and no line claims a death. /// diff --git a/tests/common/iommu.rs b/tests/common/iommu.rs index a4f7a7d7388..3dac6ab3973 100644 --- a/tests/common/iommu.rs +++ b/tests/common/iommu.rs @@ -178,7 +178,7 @@ const NVME_AT: &str = "00:02.0"; /// three times over. /// /// The ordering ruling this whole stage stands on -/// (`issues/kernel/every-driver-is-still-in-the-kernel.md`) is that moving a +/// (`issues/every-driver-is-still-in-the-kernel.md`) is that moving a /// driver out without the unit costs security: a message nothing remaps raises /// any vector on any CPU, and a descriptor holding a physical address is an /// arbitrary read and write over all of memory. So the kernel diff --git a/tests/common/qemu.rs b/tests/common/qemu.rs index 8847ed12e05..b12ed265363 100644 --- a/tests/common/qemu.rs +++ b/tests/common/qemu.rs @@ -414,7 +414,7 @@ const WINDOW_LINES: usize = 40; /// 2026-08-18 that is what a `DOUBLE FAULT on CPU 1` cost — the wait named the /// death in one sentence, the kernel's report sat in `TestResult::serial`, and /// the arm printed `stdout` -/// (`issues/kernel/a-double-fault-on-cpu-1-under-a-wide-suite.md`). Fixing +/// (`issues/a-double-fault-on-cpu-1-under-a-wide-suite.md`). Fixing /// the arms would have fixed the arms. What is fixed here is that the sentence /// cannot be built without the capture: [`Self::new`] is the only constructor /// there is and the capture is one of its two arguments, so a wait that reports @@ -1988,7 +1988,7 @@ fn qemu_command( // `virt` puts RAM at 1 GiB and AAVMF allocates from its top, so with 4 GiB // the loader's allocations land past the 4 GiB its boot map reaches and it - // refuses the boot: issues/boot-media/the-boot-map-reaches-4-gib-and-firmware-decides-what-lands-in-it.md. + // refuses the boot: issues/the-boot-map-reaches-4-gib-and-firmware-decides-what-lands-in-it.md. let memory = match arch { Arch::X86_64 => "4G", Arch::Aarch64 => "2G", diff --git a/tests/common/serial.rs b/tests/common/serial.rs index bf469d9af65..b1fbb61994b 100644 --- a/tests/common/serial.rs +++ b/tests/common/serial.rs @@ -169,7 +169,7 @@ pub(crate) const REPORT_LINES: usize = 80; /// original stack for the frame that started the chain — and the failing test's /// arm printed `result.stdout`, which is the *userland* half of the capture and /// carried two daemon lines. The report was in `result.serial` and nothing read -/// it (`issues/kernel/a-double-fault-on-cpu-1-under-a-wide-suite.md`). +/// it (`issues/a-double-fault-on-cpu-1-under-a-wide-suite.md`). /// /// The death line is where it starts, because everything before it is the run /// going normally and the point of a bound is that the report survives it. diff --git a/tests/libc-arch/src/prototypes.rs b/tests/libc-arch/src/prototypes.rs index f6589730374..3836c5fa027 100644 --- a/tests/libc-arch/src/prototypes.rs +++ b/tests/libc-arch/src/prototypes.rs @@ -21,7 +21,7 @@ const UNDECLARED: &[(&str, &str)] = &[ ("_Unwind_Resume", "what the precompiled `alloc`'s landing pads name"), ("__cxa_atexit", "the C++ ABI's, which `cxxabi.h` declares"), ("__cxa_thread_atexit_impl", "what libc++abi's `__cxa_thread_atexit` calls, which it declares"), - ("close_socket", "`close`'s arm for a socket, which `close` never calls: issues/build/libc-close-of-a-socket-ends-the-process.md"), + ("close_socket", "`close`'s arm for a socket, which `close` never calls: issues/libc-close-of-a-socket-ends-the-process.md"), ]; fn libc() -> PathBuf { diff --git a/tests/toyos-rust-tests/src/bin/abuse_elf_loader.rs b/tests/toyos-rust-tests/src/bin/abuse_elf_loader.rs index db472e79f53..1dbf8df013d 100644 --- a/tests/toyos-rust-tests/src/bin/abuse_elf_loader.rs +++ b/tests/toyos-rust-tests/src/bin/abuse_elf_loader.rs @@ -510,8 +510,8 @@ fn main() { // single Vec. Under the old growth-by-doubling that overshot to 4 MiB // on the push. // - // This case is also the actuator for the allocator-lock defect - // (`issues/panic-path/`): the >2 MiB assert fires inside + // This case is also the actuator for the allocator-lock defect: + // the >2 MiB assert fires inside // `KernelAllocator::alloc` *while it holds the dlmalloc lock*, so the // recovered CPU's next allocation spins on a lock the dead thread // still owns. Nothing else in the suite stages that, which is part of diff --git a/tests/toyos-rust-tests/src/bin/endowment_denied.rs b/tests/toyos-rust-tests/src/bin/endowment_denied.rs index d224a951535..5971baff5e5 100644 --- a/tests/toyos-rust-tests/src/bin/endowment_denied.rs +++ b/tests/toyos-rust-tests/src/bin/endowment_denied.rs @@ -123,7 +123,7 @@ const APPLET_NEEDS: &[(&str, &[&str])] = &[ ]; /// Every authority this image hands an applet that has no use for it: the exact -/// size of `issues/isolation/toybox-is-one-row-for-every-applet.md` here. +/// size of `issues/toybox-is-one-row-for-every-applet.md` here. const DECLARED_OVER_GRANTS: &[&str] = &[ "cat: receive soundserver", "cp: receive soundserver", diff --git a/tests/toyos-rust-tests/src/bin/ring_park_herd.rs b/tests/toyos-rust-tests/src/bin/ring_park_herd.rs index 1a609b84e2c..d053c6c2f95 100644 --- a/tests/toyos-rust-tests/src/bin/ring_park_herd.rs +++ b/tests/toyos-rust-tests/src/bin/ring_park_herd.rs @@ -4,7 +4,7 @@ //! A ring's own watch sits behind a lock that masks interrupts, so every //! completion notifies all 256 registrations with interrupts masked, and each //! woken thread re-registers under that lock and parks again: the load -//! `issues/kernel/a-process-lengthens-an-interrupts-off-walk-by-the-threads-it-parks-on-one-ring.md` +//! `issues/a-process-lengthens-an-interrupts-off-walk-by-the-threads-it-parks-on-one-ring.md` //! names, which `mask_windows` reads the windows under. //! //! The sibling is this program's main thread. Each round it completes one diff --git a/tests/toyos-rust-tests/src/census_wait.rs b/tests/toyos-rust-tests/src/census_wait.rs index fba76532e8f..cc4a6d77922 100644 --- a/tests/toyos-rust-tests/src/census_wait.rs +++ b/tests/toyos-rust-tests/src/census_wait.rs @@ -5,7 +5,7 @@ //! queue, and `object::drain_zero_handles` clears its pending flag before it //! runs the hooks, so the release can land on another CPU after the caller's //! own drain site found the queue empty -//! (`issues/kernel/deferred-release-outlives-its-syscall.md`). So a reading is +//! (`issues/deferred-release-outlives-its-syscall.md`). So a reading is //! a wait for an event, and a leak is the event that never comes: the harness //! ceiling reds it. diff --git a/tests/toyos-rust-tests/src/isa_row.rs b/tests/toyos-rust-tests/src/isa_row.rs index 26b3235a18f..e607996f3a7 100644 --- a/tests/toyos-rust-tests/src/isa_row.rs +++ b/tests/toyos-rust-tests/src/isa_row.rs @@ -2,7 +2,7 @@ //! //! A holder's exit is not its claim's release having run: the release is a //! deferred hook another CPU can still be inside when `wait` returns -//! (`issues/kernel/deferred-release-outlives-its-syscall.md`). So the next +//! (`issues/deferred-release-outlives-its-syscall.md`). So the next //! claim is asked for until it is granted. use std::time::{Duration, Instant}; diff --git a/tests/toyos.rs b/tests/toyos.rs index 86f31dc582b..25c449955da 100644 --- a/tests/toyos.rs +++ b/tests/toyos.rs @@ -1119,7 +1119,7 @@ const NOT_RUN: &[NotRun] = &[ NotRun { case: "22_floating_point", stage: Stage::Built, - why: Why::Declined("it prints `long double`s through `%Lf`, and libc reads a `long double` as a `double` (issues/build/libc-reads-a-long-double-as-a-double.md): every `%Lf` of a line whose `double`s filled the registers prints 0.000000"), + why: Why::Declined("it prints `long double`s through `%Lf`, and libc reads a `long double` as a `double` (issues/libc-reads-a-long-double-as-a-double.md): every `%Lf` of a line whose `double`s filled the registers prints 0.000000"), }, NotRun { case: "31_args", @@ -3346,7 +3346,7 @@ fn field_between<'a>(log: &'a str, head: &str, tail: &str) -> Result<&'a str, St /// The shortest span `counters_on_metal` reads the SMI count across: twice the /// longest period between the T14's firmware interrupts that has been read -/// (`issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md`). +/// (`issues/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md`). const SMI_SPAN_NS: u64 = 4_444_000_000; /// `counters_metal`'s three reads on the T14, held to what the hardware and @@ -4525,7 +4525,7 @@ fn main() { ); // Where this run's interrupts landed, aggregated over every guest that - // said. `issues/kernel/every-interrupt-lands-on-the-boot-cpu.md`'s step 4: + // said. `issues/every-interrupt-lands-on-the-boot-cpu.md`'s step 4: // the number its later change is measured against, produced by an ordinary // run rather than by `--nocapture`, so a CI run's own log carries it. let census = common::irqcensus::summary(); diff --git a/toyos-cpuvuln/src/tests.rs b/toyos-cpuvuln/src/tests.rs index 35d4808a1a6..60d417c00ae 100644 --- a/toyos-cpuvuln/src/tests.rs +++ b/toyos-cpuvuln/src/tests.rs @@ -602,7 +602,7 @@ fn rtm_always_abort_decides_tsx_first() { // The two fixtures below are this crate's reading of the pinned Linux, awaiting // a capture on a nightly runner: -// `issues/build/no-kvm-runner-has-had-its-cpuid-and-vulnerability-lines-captured.md`. +// `issues/no-kvm-runner-has-had-its-cpuid-and-vulnerability-lines-captured.md`. /// A guest's lines do not read its microcode: `tsa_init` returns under a /// hypervisor (`amd.c:519-520`) before `amd_check_tsa_microcode`. diff --git a/toyos-fat32/tests/refused_writes.rs b/toyos-fat32/tests/refused_writes.rs index c18a2d7a608..d90fc1e130c 100644 --- a/toyos-fat32/tests/refused_writes.rs +++ b/toyos-fat32/tests/refused_writes.rs @@ -620,7 +620,7 @@ fn a_stop_at_any_write_leaves_only_the_named_windows() { // What these two calls' own write order leaves at a stop, owned by // their issue files and not by this repair. let own: fn(&Complaint) -> bool = match s.name { - // issues/filesystem/a-rename-that-stops-between-its-writes-leaves-a-chain-two-entries-reach.md + // issues/a-rename-that-stops-between-its-writes-leaves-a-chain-two-entries-reach.md "rename" => |c| { matches!( c, @@ -629,7 +629,7 @@ fn a_stop_at_any_write_leaves_only_the_named_windows() { | Complaint::DotEntry { .. } ) }, - // issues/filesystem/a-shrink-frees-clusters-before-the-entry-stops-naming-them.md + // issues/a-shrink-frees-clusters-before-the-entry-stops-naming-them.md "truncate" => |c| matches!(c, Complaint::ChainTooShort { .. }), "truncate to zero" => |c| matches!(c, Complaint::ChainTooShort { .. } | Complaint::ChainOutOfRange { .. }), _ => |_| false, diff --git a/toyos-net-shard/tcp/Cargo.toml b/toyos-net-shard/tcp/Cargo.toml index 68d326f4d04..5eec4d11022 100644 --- a/toyos-net-shard/tcp/Cargo.toml +++ b/toyos-net-shard/tcp/Cargo.toml @@ -1,4 +1,4 @@ -# Host-tested; nothing ships it until the stack replaces smoltcp (issues/design-debt/toyos-has-its-own-network-stack.md). +# Host-tested; nothing ships it until the stack replaces smoltcp (issues/toyos-has-its-own-network-stack.md). [package] name = "toyos-net-tcp" diff --git a/userland/compositor/desktop/src/budget.rs b/userland/compositor/desktop/src/budget.rs index 5928460862b..911848c83ae 100644 --- a/userland/compositor/desktop/src/budget.rs +++ b/userland/compositor/desktop/src/budget.rs @@ -35,7 +35,7 @@ pub fn window_bytes(screen: Rect) -> u64 { /// /// **This is a mitigation, and the thing it mitigates is the real defect.** A /// window buffer is charged to nobody: there is no per-process memory limit, no -/// pressure signal and no OOM killer (`issues/isolation/`), so without a +/// pressure signal and no OOM killer (`issues/no-physical-memory-fairness.md`), so without a /// cap any client can walk the machine into exhaustion by asking for windows, /// and the compositor cannot tell a desktop from an attack. The 2 MiB rounding /// amplifies it: at 2048x2048 a window costs exactly 16 MiB, so 64 windows is diff --git a/userland/doom/Cargo.toml b/userland/doom/Cargo.toml index 1699e175f30..d605d606009 100644 --- a/userland/doom/Cargo.toml +++ b/userland/doom/Cargo.toml @@ -25,4 +25,4 @@ tar = "0.4" [package.metadata.toyos.host] fails = ["linux", "macos", "windows"] -issue = "issues/build/apps-that-build-or-run-on-toyos-alone.md" +issue = "issues/apps-that-build-or-run-on-toyos-alone.md" diff --git a/userland/fileserver/src/data.rs b/userland/fileserver/src/data.rs index 9227eabcebd..1fdbf82260c 100644 --- a/userland/fileserver/src/data.rs +++ b/userland/fileserver/src/data.rs @@ -21,7 +21,7 @@ //! between the two leaks blocks rather than leaving an entry naming freed ones. //! //! **What a kill costs.** The format updates its btree in place and keeps no -//! journal (`issues/kernel/bcachefs-crate-is-not-bcachefs.md`): what the disk +//! journal (`issues/bcachefs-crate-is-not-bcachefs.md`): what the disk //! holds is what the last sync wrote, and a server that dies inside a sync can //! leave a node half of that sync's. Nothing but a sync writes a dirty block, //! unless the cache is holding more than it keeps. diff --git a/userland/libc/src/fdreq.rs b/userland/libc/src/fdreq.rs index 45a76ccdb00..b06c95597f6 100644 --- a/userland/libc/src/fdreq.rs +++ b/userland/libc/src/fdreq.rs @@ -78,7 +78,7 @@ pub(crate) fn dup_at_least( } /// The descriptors marked close-on-exec, by number: kept for stage 3 of -/// `issues/kernel/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md`, +/// `issues/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md`, /// whose spawn reads them. A number is a slot at one generation, so a handle /// made later in the slot is never taken for one marked here. pub(crate) struct CloseOnExec(BTreeSet); diff --git a/userland/libc/src/refused.rs b/userland/libc/src/refused.rs index ea313350d88..94d1f73e2fc 100644 --- a/userland/libc/src/refused.rs +++ b/userland/libc/src/refused.rs @@ -1,5 +1,5 @@ //! What this C library refuses. What each waits on is -//! `issues/build/libc-refuses-what-toyos-cannot-yet-answer.md`'s. +//! `issues/libc-refuses-what-toyos-cannot-yet-answer.md`'s. use core::ptr; diff --git a/userland/metalprobe/src/usb.rs b/userland/metalprobe/src/usb.rs index 89bf6de9685..1561769b3e6 100644 --- a/userland/metalprobe/src/usb.rs +++ b/userland/metalprobe/src/usb.rs @@ -83,7 +83,7 @@ pub fn write() -> Measured { /// /// **The staged file is closed before the clock starts**, though the read is /// answered from the file server's cache -/// (`issues/hardware/metalprobes-usb-read-is-answered-from-fileservers-cache.md`). +/// (`issues/metalprobes-usb-read-is-answered-from-fileservers-cache.md`). pub fn read() -> Measured { let blob = payload(); { diff --git a/userland/netstack/src/main.rs b/userland/netstack/src/main.rs index 25c5f18e0b4..0e611b67c40 100644 --- a/userland/netstack/src/main.rs +++ b/userland/netstack/src/main.rs @@ -613,7 +613,7 @@ const PIPE_BUDGET_SHARE: u64 = 8; /// /// **A mitigation, not a policy anyone chose.** A piped connection's 4 MiB is /// charged to nobody — no per-process limit, no pressure signal, no OOM killer -/// (`issues/isolation/`) — so without a cap a client that opens sockets +/// (`issues/no-physical-memory-fairness.md`) — so without a cap a client that opens sockets /// in a loop walks the machine into exhaustion, and netstack has no way to tell /// that from ordinary use. Delete this in favour of a kernel memory limit, not /// in favour of a bigger number. @@ -638,7 +638,7 @@ fn total_memory() -> u64 { /// another client's live socket in the new one. A random start makes two /// instances' ranges overlap only by a chance the size of their lengths over /// 2^32, which bounds the harm and does not remove it: an id is a number any -/// client can name (`issues/isolation/netstack-socket-ids-are-ambient.md`). +/// client can name (`issues/netstack-socket-ids-are-ambient.md`). fn first_socket_id() -> u32 { let mut bytes = [0u8; 4]; toyos_abi::syscall::random(&mut bytes) diff --git a/userland/pkg/src/main.rs b/userland/pkg/src/main.rs index 50aed1bfa3b..cb121a63be4 100644 --- a/userland/pkg/src/main.rs +++ b/userland/pkg/src/main.rs @@ -200,7 +200,7 @@ fn remove(name: &str) -> Result<(), String> { /// Delete a directory and everything under it. /// /// **Not `fs::remove_dir_all`**: that one empties a directory and leaves it -/// (`issues/filesystem/remove-dir-all-empties-a-directory-and-leaves-it.md`), +/// (`issues/remove-dir-all-empties-a-directory-and-leaves-it.md`), /// and a package whose directory survives its removal is a name that can never /// be installed again. /// diff --git a/userland/proctest/Cargo.toml b/userland/proctest/Cargo.toml index 5cfdb8cce46..9293011ac39 100644 --- a/userland/proctest/Cargo.toml +++ b/userland/proctest/Cargo.toml @@ -6,4 +6,4 @@ license = "MIT OR Apache-2.0" [package.metadata.toyos.host] fails = ["linux", "macos", "windows"] -issue = "issues/build/apps-that-build-or-run-on-toyos-alone.md" +issue = "issues/apps-that-build-or-run-on-toyos-alone.md" diff --git a/userland/shell/Cargo.toml b/userland/shell/Cargo.toml index b8babde8782..9c40b9f2173 100644 --- a/userland/shell/Cargo.toml +++ b/userland/shell/Cargo.toml @@ -11,4 +11,4 @@ toyos-manifest = { path = "../../toyos-manifest" } [package.metadata.toyos.host] fails = ["linux", "macos", "windows"] -issue = "issues/build/apps-that-build-or-run-on-toyos-alone.md" +issue = "issues/apps-that-build-or-run-on-toyos-alone.md" diff --git a/userland/sshserver/src/main.rs b/userland/sshserver/src/main.rs index 069d768fa94..ec4f68c6f6f 100644 --- a/userland/sshserver/src/main.rs +++ b/userland/sshserver/src/main.rs @@ -45,7 +45,7 @@ fn host_key_path() -> String { /// with nothing in it, so a key that has to be *installed* before the first /// login is a key nobody can install. Neither file is protected from anything /// else on the machine — see -/// `issues/isolation/sshserver-authorized-keys-unprotected.md`. +/// `issues/sshserver-authorized-keys-unprotected.md`. fn authorized_keys() -> [String; 2] { [format!("{}/authorized_keys", state()), "/system/etc/ssh_authorized_keys".to_string()] } diff --git a/userland/supervisor/src/main.rs b/userland/supervisor/src/main.rs index ce31322f152..1670ceec920 100644 --- a/userland/supervisor/src/main.rs +++ b/userland/supervisor/src/main.rs @@ -618,7 +618,7 @@ impl<'a> Service<'a> { // file lives in an ambient directory, so what the supervisor verified when it // wrote it is not a claim about what is there now. This narrows the // window to the spawn itself and does not close it - // (`issues/isolation/a-swapped-binary-lives-where-any-process-can-rewrite-it.md`). + // (`issues/a-swapped-binary-lives-where-any-process-can-rewrite-it.md`). if let Some(digest) = toyos_swap::installed_digest(path) { let bytes = read_binary(path).map_err(|why| std::io::Error::other(why.to_string()))?; toyos_swap::verify(&bytes, &digest).map_err(|why| { @@ -1864,7 +1864,7 @@ enum Served<'m, 'a> { /// /// **A compromise over a kernel defect, recorded as one**: the kernel publishes /// a process's end before every deferred release its handles queued has run -/// (`issues/kernel/deferred-release-outlives-its-syscall.md`), so a claim asked +/// (`issues/deferred-release-outlives-its-syscall.md`), so a claim asked /// for the instant `wait` returns is refused as still held. Its release is one /// pass of the zero-handle drain; this bound is a liveness guard, and it goes /// when that issue closes. @@ -2253,7 +2253,7 @@ fn build_namespace( /// /// **Every program sees the whole tree the file servers serve**, which is the /// kernel's old view kept whole until each row declares its own -/// (`issues/isolation/every-program-sees-only-the-files-it-was-given.md`, +/// (`issues/every-program-sees-only-the-files-it-was-given.md`, /// stage 2), with one exception: a storage row sees none, since a file server /// resolving a path of its own through itself waits for ever. fn in_view(program: &Program, name: &str) -> bool { diff --git a/userland/terminal/Cargo.toml b/userland/terminal/Cargo.toml index 01225368bce..67ecc407e38 100644 --- a/userland/terminal/Cargo.toml +++ b/userland/terminal/Cargo.toml @@ -14,4 +14,4 @@ doctest = false [package.metadata.toyos.host] fails = ["linux", "macos", "windows"] -issue = "issues/build/apps-that-build-or-run-on-toyos-alone.md" +issue = "issues/apps-that-build-or-run-on-toyos-alone.md" diff --git a/userland/terminal/src/main.rs b/userland/terminal/src/main.rs index 3315bcfd9c2..95405c471d4 100644 --- a/userland/terminal/src/main.rs +++ b/userland/terminal/src/main.rs @@ -74,10 +74,7 @@ fn main() { // The window exists and the shell's stdin is a pipe this process owns, so // from here a keystroke the compositor forwards has somewhere to land even // if the shell has not reached its first read. Before it, one is dropped - // with no trace — which is what the desktop tests used to compensate for by - // retyping against a clock, making every one of their verdicts a statement - // about how long a desktop takes to come up on the host of the day - // (`issues/design-debt/`). + // with no trace. eprintln!("terminal: ready"); loop { diff --git a/userland/toybox/Cargo.toml b/userland/toybox/Cargo.toml index f0f51c154fc..9ac87978bff 100644 --- a/userland/toybox/Cargo.toml +++ b/userland/toybox/Cargo.toml @@ -13,4 +13,4 @@ toyos-window = { path = "../toyos-window" } [package.metadata.toyos.host] fails = ["linux", "macos", "windows"] -issue = "issues/build/apps-that-build-or-run-on-toyos-alone.md" +issue = "issues/apps-that-build-or-run-on-toyos-alone.md" diff --git a/userland/toybox/src/locale.rs b/userland/toybox/src/locale.rs index 98126b9f131..ba31b96428e 100644 --- a/userland/toybox/src/locale.rs +++ b/userland/toybox/src/locale.rs @@ -14,7 +14,7 @@ fn layouts() -> impl Iterator { /// still has. Not what a translator is actually using — the config is the /// last thing anyone asked for, and a surface that missed the notification /// can disagree with it; that half stays unanswerable until the query -/// syscall in `issues/diagnostics/the-kernel-keeps-nothing-it-enumerates.md` +/// syscall in `issues/the-kernel-keeps-nothing-it-enumerates.md` /// exists. fn current() -> Option { let name = std::fs::read_to_string(surface::LAYOUT_CONFIG).ok()?;