The issue tracker is flat: issues/<slug>.md, and no area is left

.claude/agents/reviewer.md

@@ -73,7 +73,7 @@ if it meets the bar above; otherwise it is a NOTE.
 - **Arrivals.** A host tool outside Rust and QEMU arrives by `Command::new`, `libc::system`,
   `exec`, `posix_spawn`, a build script or `cc::Build`, a `.github/` `run:` step or package
   manager, or `sh -c`, and is declared in
-  `issues/build/the-build-runs-host-tools-outside-rust-and-qemu.md` and nowhere else. A BLOCKER
+  `issues/the-build-runs-host-tools-outside-rust-and-qemu.md` and nowhere else. A BLOCKER
   each: an undeclared host tool; one, like Go's `gh`, not built from C or C++ source ToyOS can
   one day build and run; a binary for one host OS alone; a C or C++ tool taken where a Rust tool
   does the job; new Python, Perl or shell of ToyOS's own.

Cargo.toml

@@ -173,7 +173,7 @@ tar = { version = "0.4.46", default-features = false }
 flate2 = { version = "1", default-features = false, features = ["rust_backend"] }
 # Every request the build system makes, GitHub's API and the crates.io index,
 # where curl is a host's tool: rustls on ring, the one TLS provider the tree
-# takes (`issues/design-debt/the-internet-clients-work-unchanged.md`), whose C
+# takes (`issues/the-internet-clients-work-unchanged.md`), whose C
 # and assembly the host's `cc` compiles.
 ureq = { version = "3", default-features = false, features = ["rustls"] }
 

bootloader/src/main.rs

@@ -665,7 +665,7 @@ fn start_kernel(kernel: LoadedKernel, kernel_elf_bytes: vec::Vec<u8>, cmdline: v
             // A `push` here would grow the vector, and growing it is the death
             // above. What was dropped is not reported: the page that carried
             // that refusal off this boot is gone with the claim, and
-            // `issues/panic-path/the-loaders-truncated-map-refusal-is-executed-by-nothing.md`
+            // `issues/the-loaders-truncated-map-refusal-is-executed-by-nothing.md`
             // holds what is owed.
             return;
         }

issues/README.md

@@ -1,9 +1,9 @@
 # Issues
 
-One file per issue, `issues/<area>/<slug>.md`. There is no index and no
+One file per issue, `issues/<slug>.md`. There is no index and no
 numbering: **`ls` is the index and the frontmatter is the query.**
 
-`ls issues/*/` lists everything. To ask a question of the set:
+`ls issues/` lists everything. To ask a question of the set:
 
 ```
 rg -l '^status: open' issues/       # every unheld piece of work
@@ -70,19 +70,19 @@ number somebody measured, a design line the owner already drew. It does not
 carry a design, a stage table, a rationale or a review history: a design that is
 right is written as code, and one that is not yet written is not yet known.
 
-## Areas
+## Slugs
 
-An area is a directory because it makes every cross-reference a path that resolves. Moving
-an issue between areas is a `git mv`; the **slug** is its identity — unique
-across every area — so `rg <slug>` finds every pointer at it wherever it has
-been put. A slug is a claim like any sentence here: one the tree has refuted is
+The tracker is one directory with no subdirectories: what an issue is, is its
+`kind`, and what it is about, its slug and its body. The **slug** is its
+identity — unique across the tracker — so `rg <slug>` finds every pointer at
+it. A slug is a claim like any sentence here: one the tree has refuted is
 renamed in the commit that corrects the body, with every citation moved.
 
 ## Pointing at one
 
-**Name the file, not the directory.** `issues/audio/null-sink-applies-one-connect.md`
-is a claim something can check; `issues/audio/` is a claim that an area
-exists, which says nothing about whether the entry you meant is still there.
+**Name the file.** `issues/null-sink-applies-one-connect.md` is a claim
+something can check; a bare `issues/` says nothing about whether the entry you
+meant is still there.
 
 Never write "the entry above" or "the entry below". Position was what the
 numbered document had and what this directory exists to be rid of; a positional

issues/kernel/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md → issues/a-120000-ms-boot-deadline-fired-132859-ms-late-on-the-t14.md

@@ -114,7 +114,7 @@ is owed; a cause is.
 
 ## What is known and what is not
 
-- `issues/kernel/an-xhci-storm-starves-the-cpu-that-takes-it.md` carries the
+- `issues/an-xhci-storm-starves-the-cpu-that-takes-it.md` carries the
   same shape, over the 34 s the stick was being written, on run 20's
   `metaldevicecase` boot at tip `f46f91eb`
   (`[2026-09-07 08:51:28 34.609 cpu1] irq: cpu0 total=103171 timer=10 xhci=103161 net=0 sound=0 i8042=0 dmafault=0 hda=0 tlb=0 nmi=0 spurious=0 unclaimed=0`)
@@ -130,14 +130,14 @@ is owed; a cause is.
   inference — that a deadline which fires is a machine on which some CPU was
   still taking a timer interrupt — holds for the instant it fired; this record
   shows the 133 s before it in which none did.
-- `issues/hardware/a-t14-boot-wedges-after-a-jobs-exit-and-nothing-said-why.md`
+- `issues/a-t14-boot-wedges-after-a-jobs-exit-and-nothing-said-why.md`
   waits for a `WEDGED` record of a different shape — a `testcases-mkdir` or
   `-readdir` boot stopping between a job's `exit:` and the next `spawn:` —
   and names a 2 MiB symbol-table read of 512 SCSI READ(10) commands as the
   one device call in its window; run 55's tail names READ(10) transport
   breaks on the same stick. Whether those are one defect is unmeasured, and
   this record is not that file's exit condition.
-- `issues/kernel/the-deadline-header-promises-any-interrupt-and-only-the-timer-entry-polls.md`
+- `issues/the-deadline-header-promises-any-interrupt-and-only-the-timer-entry-polls.md`
   is the tree-checkable half: the module header's coverage claim is wider
   than the poll's one call site.
 

issues/filesystem/a-bcachefs-hole-costs-a-block-write-per-page.md → issues/a-bcachefs-hole-costs-a-block-write-per-page.md

@@ -31,4 +31,4 @@ same cost.
 hole costs one list entry rather than one write per page, and a read of it
 resolves to zeros without a block. That is an on-disk format change for
 bcachefs, which is why it is not a small one — the same wall
-`issues/filesystem/a-listing-still-scans-the-whole-mount.md` ends at.
+`issues/a-listing-still-scans-the-whole-mount.md` ends at.

issues/kernel/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md → issues/a-childs-end-is-an-event-and-a-parent-takes-its-children-down.md

@@ -9,16 +9,16 @@ opened: 2026-09-29
 libc cannot start a child: `fork` and `execvp` answer `ENOSYS`, `waitpid`
 `ECHILD` and `system` `-1` (`userland/libc/src/misc.rs`,
 `userland/libc/src/stdio.rs`), and there is no `posix_spawn`. M2 and M4 of
-`issues/build/toyos-builds-itself.md` and the exit of
-`issues/kernel/toyos-runs-on-arm64.md` need it.
+`issues/toyos-builds-itself.md` and the exit of
+`issues/toyos-runs-on-arm64.md` need it.
 
 **Constraints.** libc is built on ToyOS and never ToyOS on libc (owner,
 2026-09-30: "toyos moderness and anti legacy may never be compromised because
 of libc. no legacy"). One mechanism (owner: "i dont want multiple
 mechanisms"): the `Process` handle is the only control, and the kernel grows
 no job object, process group, POSIX session, controlling terminal, signal,
 wait-any, pid-addressed call or thread. What names a child's image and working
-directory is `issues/isolation/every-program-sees-only-the-files-it-was-given.md`'s.
+directory is `issues/every-program-sees-only-the-files-it-was-given.md`'s.
 
 **Ruled** (owner, 2026-09-30):
 
@@ -53,7 +53,7 @@ directory is `issues/isolation/every-program-sees-only-the-files-it-was-given.md
    control: the stage reverted whole, where the first two read alike. Oracle:
    POSIX `<signal.h>`'s classes.
 3. **libc starts and waits for children** (blocked on
-   `issues/isolation/a-childs-stdio-handle-is-not-the-one-command-named.md`).
+   `issues/a-childs-stdio-handle-is-not-the-one-command-named.md`).
    libc imitates `SIGCHLD`. A C child starts with descriptors 0–2 and exactly
    what its file actions name, a stated departure from POSIX. `posix_spawn` and
    `posix_spawnp` with file actions and attributes, routed by std's
@@ -62,7 +62,7 @@ directory is `issues/isolation/every-program-sees-only-the-files-it-was-given.md
    signal-set calls; `environ`, `setenv`, `unsetenv`; `kill` with `SIGKILL` for
    a child or a `-pgid` of its children, 0 as a probe, `EINVAL` for other
    signals until stage 6; `system`, `popen` and `pclose` through
-   `/system/bin/shell -c`. No `select` in this stage: `issues/build/toyos-builds-itself.md`
+   `/system/bin/shell -c`. No `select` in this stage: `issues/toyos-builds-itself.md`
    owns it. A handler for any signal libc imitates runs at once, beside the
    program: inside a blocking call of a thread that leaves the signal unblocked
    (`ppoll` and `sigsuspend` under their mask), and, while no thread is in one,
@@ -107,7 +107,7 @@ directory is `issues/isolation/every-program-sees-only-the-files-it-was-given.md
    desktop's at boot, one per SSH connection at sshd's request. As it starts
    one, init hands the compositor or sshd a right to start programs in that
    session alone. sshd's right also quits and kills it. Its namespace is
-   `issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md`'s login row.
+   `issues/a-user-is-a-home-tree-and-a-login-row.md`'s login row.
    *Exit*: killing the desktop session ends every program the compositor started
    and leaves the compositor running; killing the compositor ends none of them;
    a dropped SSH connection ends its session and all under it. Negative control:

issues/isolation/a-childs-stdio-handle-is-not-the-one-command-named.md → issues/a-childs-stdio-handle-is-not-the-one-command-named.md

@@ -61,4 +61,4 @@ path both probes took. The instrument is a guest arm that hands a child a
 handle it must not be able to use and asserts the refusal, which is the shape
 `handle_kill_policy` already has for handles a process does not hold.
 
-`handle_kill_policy` is deleted; `issues/kernel/handle-kill-policy-census-grew-one-sharedmem-on-two-nightlies.md` records the commit that restores it.
+`handle_kill_policy` is deleted; `issues/handle-kill-policy-census-grew-one-sharedmem-on-two-nightlies.md` records the commit that restores it.

issues/kernel/a-claimed-function-can-storm-its-cpu.md → issues/a-claimed-function-can-storm-its-cpu.md

@@ -11,7 +11,7 @@ message it sends (`kernel/src/pcidev/mod.rs`, `isr`), and nothing bounds how
 often. Its holder programs the device through the BARs it maps, so a hostile
 or broken holder can make the device send messages as fast as the bus carries
 them, and each one is an interrupt cpu0 takes before anything else it runs.
-`issues/kernel/an-xhci-storm-starves-the-cpu-that-takes-it.md` measured what
+`issues/an-xhci-storm-starves-the-cpu-that-takes-it.md` measured what
 that does to a CPU for a kernel driver's source; a claim is the same source
 with its holder outside the kernel.
 

issues/kernel/a-claims-own-refusals-are-read-by-nothing.md → issues/a-claims-own-refusals-are-read-by-nothing.md

@@ -10,7 +10,7 @@ Refusals of `kernel/src/pcidev/mod.rs` that no test reaches:
 
 - `ClaimError::Owned`, `Refusal::NoInterrupt`, `Refusal::CapsTruncated` and
   the domain's fault, whose guest readers the guest suite's cut moved to stage J
-  of `issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md`;
+  of `issues/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md`;
 - `ClaimError::Ambiguous`, a config naming a device this machine has two of;
 - `ClaimError::KernelDriven`, a claim on a function one of this kernel's own
   drivers bound;

issues/audio/a-client-cannot-tell-soundserver-it-paused.md → issues/a-client-cannot-tell-soundserver-it-paused.md

@@ -47,5 +47,5 @@ resuming from suspend all need the same client→soundd notification, sent from
 cpal's `play()`.
 
 The one variant that needs no client change is filed apart, at
-`issues/audio/stop-the-device-voice-keep-the-wake.md`, because it could land
+`issues/stop-the-device-voice-keep-the-wake.md`, because it could land
 first.

issues/build/a-compile-fail-case-names-an-error-code-rustdoc-never-reads.md → issues/a-compile-fail-case-names-an-error-code-rustdoc-never-reads.md

@@ -23,7 +23,7 @@ crate's doc-tests green:
 What does hold a case to its reason in this tree is the block beside it that
 compiles (`toyos-net-wire/src/lib.rs`, `mod compile_fail`). `Place`'s three
 have one; `DirectMapEnd`'s has none. The "compile-fail case" that Stages C and
-H of `issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md`
+H of `issues/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md`
 exit on is held the same way and no other.
 
 **Exit**: `git grep 'compile_fail,E'` finds nothing outside `rust/` and every

issues/kernel/a-controller-whose-msix-table-is-in-bar-0-cannot-be-driven-from-userland.md → issues/a-controller-whose-msix-table-is-in-bar-0-cannot-be-driven-from-userland.md

@@ -20,12 +20,12 @@ would have no registers to drive it through`. The blockd tests boot the
 controller with `msix-exclusive-bar=on`, which moves the table to a BAR of its
 own (`tests/common/qemu.rs`, `BootOptions::userland_nvme`). Where the T14's
 NVMe keeps its table is not measured; it matters from the small-kernel track's
-step 9 (`issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md`),
+step 9 (`issues/the-kernel-is-small-interrupts-post-and-threads-wait.md`),
 when blockd is the only NVMe driver.
 
 **Exit condition.** A claim hands over the pages of a BAR that hold neither
 the table nor the PBA, at the granularity those structures need (4 KiB, which
 the user mappings do not have yet:
-`issues/kernel/process-memory-is-2-mib-pages-and-that-caps-the-process-count.md`),
+`issues/process-memory-is-2-mib-pages-and-that-caps-the-process-count.md`),
 and a test drives QEMU's NVMe with its table in BAR 0 through blockd while a
 write to the table's page is refused.

issues/kernel/a-cut-bulk-only-command-does-not-brick-the-benchs-stick.md → issues/a-cut-bulk-only-command-does-not-brick-the-benchs-stick.md

@@ -78,7 +78,7 @@ port, halted and reset the controller and unpowered its ports, and said
 `no Bulk-Only command was open, so this reset cuts none`. And the device had
 stopped answering media commands before any of that: the boot's first READ(10)
 was the first thing that broke
-(`issues/kernel/a-stick-that-answers-late-is-broken-by-the-two-second-abandon.md`).
+(`issues/a-stick-that-answers-late-is-broken-by-the-two-second-abandon.md`).
 Every path a host drives ended with the device reset and inside no command, and
 it was still lost — so what loses it is in the device, reached before this
 kernel's first media command, and cleared only by taking VBUS away, which this

issues/kernel/a-deliberate-wedge-inside-a-driver-panics-every-other-cpu-that-wants-its-lock.md → issues/a-deliberate-wedge-inside-a-driver-panics-every-other-cpu-that-wants-its-lock.md

@@ -38,7 +38,7 @@ Two things are true and neither is decided here:
 Any actuator that stops a CPU inside a driver: the `usb-wedge-*` arms, which
 went with `usb_reset_records_the_phase_it_cut`'s QEMU registration and come back
 as T14 rows in stage E of
-`issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md`.
+`issues/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md`.
 
 ## Exit condition
 

issues/kernel/a-device-swapped-into-its-port-inside-the-port-rungs-reset-is-taken-for-the-disk-it-replaced.md → issues/a-device-swapped-into-its-port-inside-the-port-rungs-reset-is-taken-for-the-disk-it-replaced.md

@@ -35,4 +35,4 @@ number is read again and judged by `toyos_xhci::identity::same` before the
 volume carries on. A `usb-reset-moves` staging that plugs another serial number
 into the same port refuses it by name.
 
-`usb_transport_break` is deleted; `issues/kernel/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md` records the commit that restores it.
+`usb_transport_break` is deleted; `issues/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md` records the commit that restores it.

issues/hardware/a-disk-plugged-in-after-boot-is-bound-inside-a-scheduling-pass.md → issues/a-disk-plugged-in-after-boot-is-bound-inside-a-scheduling-pass.md

@@ -16,7 +16,7 @@ disk arriving *after* boot, which is one greppable path.
 **What to build**: a stepped driver for the bind over the same two machines,
 one act per pass, as enumeration has. Moving the bind to a thread that may
 block — usbd, step 10 of
-`issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md` — ends
+`issues/the-kernel-is-small-interrupts-post-and-threads-wait.md` — ends
 this file as well.
 
 After it, the pass-duration proof costs no new code: one guest gate measuring a
@@ -46,5 +46,5 @@ Constraints the machine has to preserve:
   SuperSpeed ports read enabled the moment they are touched, so warm-reset
   correctness lives in the host model only.
 
-`issues/hardware/pulling-the-boot-stick-freezes-the-t14.md` is open and is not
+`issues/pulling-the-boot-stick-freezes-the-t14.md` is open and is not
 closed by this.

issues/kernel/a-disk-taken-offline-is-never-brought-back.md → issues/a-disk-taken-offline-is-never-brought-back.md

@@ -34,4 +34,4 @@ A T14 boot whose stick's transport broke mid-boot and that finishes with its
 mounts intact, on either half of the receptacle; and a disk that left its port
 under a reset and arrived on another keeps its number.
 
-`usb_transport_break` is deleted; `issues/kernel/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md` records the commit that restores it.
+`usb_transport_break` is deleted; `issues/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md` records the commit that restores it.

issues/boot-media/a-disk-whose-port-went-away-panics-the-boot-at-roots-hold.md → issues/a-disk-whose-port-went-away-panics-the-boot-at-roots-hold.md

@@ -35,4 +35,4 @@ The nightlies agree:
 or the boot's refusal is what `usb_transport_break` expects. Either way
 `usb_transport_break` is green on a nightly.
 
-`usb_transport_break` is deleted; `issues/kernel/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md` records the commit that restores it.
+`usb_transport_break` is deleted; `issues/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md` records the commit that restores it.

issues/kernel/a-double-fault-on-cpu-1-under-a-wide-suite.md → issues/a-double-fault-on-cpu-1-under-a-wide-suite.md

@@ -26,7 +26,7 @@ line for that run: `fastest boot 1522 ms against the reference 1320 ms —
 liveness ceilings paid at 1.15x width`. The same name passed in 9 s in the full
 run before it and red in the full run after it on a different and already-filed
 defect (`writer A declared 1000 whole lines and the capture carries 798`,
-`issues/build/parallel-tests-red-under-other-suites.md`), so
+`issues/parallel-tests-red-under-other-suites.md`), so
 what this name does under load is red in more than one way.
 
 **This is the sighting the panic discriminator was closed to catch.** The

issues/kernel/a-driver-is-tested-on-the-host-and-its-real-implementation-is-one-instruction-deep.md → issues/a-driver-is-tested-on-the-host-and-its-real-implementation-is-one-instruction-deep.md

@@ -22,7 +22,7 @@ What is to be built:
 - **The boundary, named by function and not by chip.** A driver is written
   against four small traits: register access, a clock, DMA buffers, and
   interrupt arrival. They are generic parameters resolved at compile time
-  (the dispatch ruling in `issues/kernel/toyos-runs-on-arm64.md`: no trait
+  (the dispatch ruling in `issues/toyos-runs-on-arm64.md`: no trait
   objects, no `Kernel<A>`), and they are the same three things the userland-device
   substrate hands a process, so a driver moved to userland keeps its tests.
 - **A real implementation is one instruction's worth of meaning per function**

issues/kernel/a-driver-that-reflashes-its-device-escapes-its-isolation.md → issues/a-driver-that-reflashes-its-device-escapes-its-isolation.md

@@ -23,7 +23,7 @@ reading, not a measurement.
 reflashing is a recorded weakness with an exit (firmware verification) to
 design later."
 
-Owner: the orchestrator, under `issues/kernel/the-iommu-refuses-nothing-yet.md`.
+Owner: the orchestrator, under `issues/the-iommu-refuses-nothing-yet.md`.
 
 **Exit**: a design for verifying a device's firmware is put to the owner
 and ruled, and built; a device whose firmware fails that verification is

issues/panic-path/a-fatal-event-stands-down-both-bounds-and-may-leave-nothing-to-end-the-machine.md → issues/a-fatal-event-stands-down-both-bounds-and-may-leave-nothing-to-end-the-machine.md

@@ -26,7 +26,7 @@ table named none, `arm` returns `Bound::Held`
 which never ends.
 
 **On the T14 that last bound is the one thing already known not to work.**
-`issues/hardware/an-armed-tco-has-never-reset-the-t14.md` records that no claim
+`issues/an-armed-tco-has-never-reset-the-t14.md` records that no claim
 of this machine resetting itself has ever survived: every metal run so far has
 needed a hand on the power button. So a fatal kernel event on this machine
 disarms the two bounds that would have ended the boot and then depends on the
@@ -44,7 +44,7 @@ from `deadline::expire` and `hardlockup::locked_up`) — and the stand-down is
 what guarantees the second one is not written.
 
 This is not
-`issues/panic-path/no-console-between-boot-and-terminal.md`, which is about a
+`issues/no-console-between-boot-and-terminal.md`, which is about a
 machine having no output channel in a window. Here the channel exists and the
 mechanism that would use it has been disarmed.
 

issues/build/a-fork-checkout-a-killed-git-worktree-add-left-is-taken-as-made.md → issues/a-fork-checkout-a-killed-git-worktree-add-left-is-taken-as-made.md

@@ -40,13 +40,13 @@ descriptor of the lock, `git_run` being `Command::status` and the lock file
 opened close-on-exec. A build that starts then finds `rust/.git`, `HEAD` at the
 pin and the lock free. When that git ends, the checkout has no
 `library/backtrace`, the state
-`issues/build/the-fork-checkout-runs-git-submodule-in-a-linked-worktree.md`
+`issues/the-fork-checkout-runs-git-submodule-in-a-linked-worktree.md`
 records of a `fork_checkout` that stopped before adding it.
 
 ## Owner
 
 The toolchain item of
-`issues/build/the-tooling-is-a-review-prompt-and-three-workflows.md`, whose
+`issues/the-tooling-is-a-review-prompt-and-three-workflows.md`, whose
 stores are published by an atomic rename.
 
 **Exit**: a build that finds a fork checkout git records as `locked` makes it

issues/kernel/a-fresh-kernel-heap-chunk-holds-its-frames-last-owners-bytes.md → issues/a-fresh-kernel-heap-chunk-holds-its-frames-last-owners-bytes.md

@@ -17,7 +17,7 @@ wrote now leaks another process's data where it used to leak zeros.
 By reading, not measured: no reachable copy-out of unwritten heap memory is
 known.
 
-Owner: `issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md`.
+Owner: `issues/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md`.
 
 **Exit**: no byte the kernel heap hands out holds data a previous owner of its
 frame wrote, and the zeroing that ensures it runs under no lock another CPU