[Japabu]

Draft. Records the owner's design rulings of 2026-11-05, which answer the open decisions listed on #1191. Text only, apart from one code comment. The RAM-wipe reversal (#1191's decision 2) is #1196's, and this branch does not touch it.

Each ruling and where it lives

#	Ruling	Manual (design)	Records (date, source, work)
1	CPU reservations are rejected. The scheduler is EEVDF by job with a per-CPU real-time allowance.	Scheduling and power: nothing reserves CPU time	cpu-time-is-a-band-and-not-a-reservation is now rejected. the-fair-band-orders-by-share-alone-and-a-woken-editor-waits is deleted: its aim was adopted as J1, and only the reservation layer it waited on was declined. The reservation model is removed from all-cores-are-assumed-equal-and-arm64-breaks-that and placement-has-no-migration-cost-or-wake-affinity. New finding: k-dying-corpses-take-k-deferral-grants-on-one-cpu, the weakness whose only exit was the reservation model; the cpu.rs comment cites it.
2	Without an IOMMU, any driver the signed image ships may claim its device (2026-09-29, confirmed image-wide).	Trust: any shipped driver, with its ordinary claim	a-machine-without-an-iommu-refuses-every-claim records the confirmation. Root CLAUDE.md has not carried the trust paragraph since #1191, so it needed no change.
3	Apps ask for a right at run time, always within the image's ceiling. There is no up-front permission list.	Access, privacy and data: rights are asked for at run time, with no up-front list	The package track's stage 6 keeps the ruling date (superseding 2026-09-24), what gets built and the exit. Its two citations (toyos-has-a-desktop, an-installed-gbae-browses-to-no-rom) are updated.
4	Only the installer service writes /apps. Every other program sees it read-only.	Files and views: "No special cases"	whether-pkg-alone-writes-apps (the question) is deleted. The file-isolation track's stage 2 now carries the change and its exit, and the package track's installer bullet only points there. Today every row still holds /apps read-write.
5	Updates fix forward, with no automatic fallback to the previous slot.	Boot and updates: the loader boots the marked slot and no other	The update track gains stage 2, which removes the loader's three fallback paths and names an exit. The next boot still reports the last boot's death; #1196 decides what carries that report if the black-box page goes. The loader track's stage 5 drops its tries, priorities and fall to the other slot. It keeps the good flag, which replaces the black-box page as an image's proof (#1196 decides whether it must land with the page's removal), the health gate and one-shot requests. Planned tests that promised a fallback are renamed, removed or rescoped (the-guest-suite-runs-only-what-no-cheaper-tier-reaches, including hang_bounded_by_the_stick, and the-update-rig-the-guest-cut-deleted-is-still-cited). an-images-guids-are-drawn-from-the-hosts-random-source names stage 5's good flag.
6	When a wait's failure timeout expires, the wait returns an error where its interface can carry one and otherwise reports the expiry.	—	Root CLAUDE.md's existing timeout sentence gains one clause. No issue track applies, so the date is recorded in the commit message. A wait for swapped memory is the one exception: it behaves like RAM and is reported, never failed (decided by the orchestrator, to whom the owner left it). The manual's swap line says the same.
7	Once a greeter exists, the local desktop is a login session like any other.	Sessions and permissions: the greeter asks for it, and it gets the same per-session isolation	The file-isolation track's preamble and stage 3.

kernel/pure/sched/cpu.rs: the comment on CpuSched::dying named the reservation model as its replacement. It now cites the finding. The scheduling page drops the per-stream reservation line, which the general line covers.

Checks

At 083ad4f, macOS host. Head 4bb1256 changes only one sentence of CLAUDE.md and one bullet of memory.md, with no links or identifying shapes, so neither check was re-run:

• cargo run -- --ci host tests: exit 0, "9 step(s), all green" (log). It includes the build system's tests, and sourcegate is among them. The only code change is a comment, so lint, models and userland were not run.
• mdbook build docs with mdBook 0.5.4: exit 0 (log).

Round 1's links were dead: its evidence commit carried no logs. These replace them.

Risks and open points

• Fallback is staged, not removed: until the update track's stage 2 lands, the loader still falls back.
• The bench loader-binary fallback in loader stage 6 is a development-stick ruling outside ruling 5, and stays as it is.

🤖 Generated with Claude Code

[Japabu]

Review of #1197 at 9289022 (base ec89121, which is origin/main)

Architectural assessment

The branch records seven rulings, with the design in docs/, the dates and work in issues/, and the agents' rule in CLAUDE.md. That split is right, and most of the edits are accurate. The tree has +192/−272 lines. One code comment changes. I checked the three fallback paths that update-track stage 2 names against loader/src/slot.rs (policy::order, Refusal::Died, the second loop over dead), and all three are real. a_bent_supervisor_is_refused_and_the_other_slot_boots and bent_supervisor_falls_back exist (tests/toyos.rs:651,866). Root CLAUDE.md on main no longer has the trust paragraph, as the PR says. Stage 1 of the update track is the only citation of that track's stage numbers, so renumbering the T14 stage to 3 breaks nothing. The manual edits use no code references and are short. They state target design.

Four problems remain. Some records still contradict the rulings: two scheduler records still cite the reservation model, one record still cites stage 5's tries, and one planned metal test still promises a fallback. Ruling 6 conflicts with a design line in the manual. One rejected record misstates what the owner declined. The evidence the PR links does not exist.

Blockers

1. Evidence missing. The PR's evidence links are dead. Evidence commit 67f600230 on pr-1197 contains only README, and rulings/host-tests.log and rulings/mdbook-build.log return 404 through both the contents API and raw. The claims "exit 0, 9 step(s), all green" and "mdbook build exit 0" have no record behind them. Fix: commit the two logs to the evidence branch, or re-run and push them, and update the links. No other check is needed.

2. Superseded reservation design still stated as current. Ruling 1 left these behind:

   • issues/all-cores-are-assumed-equal-and-arm64-breaks-that.md:22-25 says "What is already done … reservation admission sums against each CPU's own capacity". This was never built (the old track said "Nothing below is built"), and the owner has now rejected it.
   • issues/placement-has-no-migration-cost-or-wake-affinity.md:47 says placement "Composes with the reservation model (… reservations decide how much)".

   Both are records the ruling directly affects. Delete the false "already done" paragraph and the reservation clause. Neither file cites the rejected record by slug, which is why the slug search missed them.

3. Stage 5's tries still cited. issues/an-images-guids-are-drawn-from-the-hosts-random-source.md:50-52 says loader stage 5 "replaces that record with the slot table's tries". Stage 5 now uses a good flag and has no tries. Change it to say stage 5 replaces the record with the table's good flag.

4. A planned metal test still promises a fallback. issues/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md:62 describes hang_bounded_by_the_stick as "a hanging image costs one boot and never traps the machine". Before this branch, loader stage 5 rewrote that test for tries, and the tries supplied the "never traps" half. Under fix-forward, a marked slot that hangs is booted again after every reset, and the PR's own risk note admits this. The branch renamed or removed two other test names that promised a fallback but left this one. Scope it to what still holds. For example, a hanging --once image costs one boot and the marked slot boots after it. Otherwise, state only the one-boot bound.

5. Ruling 6 contradicts the manual's swap rule. The new CLAUDE.md:15 says that on expiry a wait "returns an error where its interface can carry one". docs/src/architecture/memory.md:63-67 says a copying system call's wait on swapped memory "is reported when overdue; a timeout never turns it into an error". A system call's interface can carry an error, so the two homes now disagree on that case. The ToyOS manual: the design in docs/, published by GitHub Pages #1191's question 6 named the swap rule as already-recorded design.

   • Check the owner's exact ruling.
   • If the ruling covers this case, the swap line in the manual and the swap track change in this branch.
   • If the swap wait is an exception the owner keeps, say so in one place. Do not leave both statements standing.

   I cannot tell which from the repository. The decision belongs to the owner, and the orchestrator should check it.

6. issues/the-fair-band-waits-on-a-reservation-layer.md is the wrong kind of record. It is now kind: rejected, "Declined by the owner". That track proposed EEVDF lag-and-deadline ordering so that a woken editor beats a compiler. The owner did not decline that. He adopted it as J1, and the file's own last sentence says so. The only part declined is the reservation layer, and cpu-time-is-a-band-and-not-a-reservation.md already records that rejection. Nothing is owed and there is nothing to re-propose, so under issues/README.md the record closes by deletion. The commit message carries the story. Nothing outside the file cites either slug, so the deletion is clean.

7. Package-track stage 6 restates the manual's design. issues/a-package-is-a-directory-under-apps-and-the-installer-is-a-program.md:104-118, which this branch rewrote, restates the following:

   • "There is no up-front permission list", from privacy.md;
   • the free rights and the picker;
   • "The ceiling names rights, never apps … installing an app never edits the image", from sessions.md:72-73.

   issues/README.md says a track "does not restate" the manual. The brief asks for one home per ruling. Reduce the stage to:

   • the ruling date, and that it supersedes 2026-09-24;
   • what is built: the run-time request path, and the [apps] row becoming the ceiling;
   • the exit.

   In the same way, the installer bullet at lines 40-50 can say that stage 2 of the isolation track carries the change, without restating the rule.

Suggestions

• kernel/pure/sched/cpu.rs:273-275: the weakness now also lives in issues/k-dying-corpses-take-k-deferral-grants-on-one-cpu.md, in the same words. Either cite the finding or drop the paragraph, so the debt has one home.
• docs/src/architecture/scheduling.md:31: "no per-stream reservation and no deadline admission" is now covered by the general line added at :13. Keep only the best-effort sentence for streams.
• issues/the-machine-updates-itself-without-ubuntu.md:51-54: "has no consumer left" is true of marking an image dead for refusal. The manual still promises that "a slot that … fails is reported". Say that the next boot still reports the last boot's death, or that Memory overwrite on every boot; the black box goes, and a clean stop proves an image #1196's replacement carries that report, so stage 2 does not drop the report along with the refusal.
• issues/the-loader-does-only-what-must-precede-the-handover.md:205-206: "How proving an image depends on the black-box page is before the owner in Memory overwrite on every boot; the black box goes, and a clean stop proves an image #1196" undersells stage 5. Its good flag, written by update --good into the slot table, already proves an image without the page (today the proof is the DONE record through slot::proven). Say that stage 5 replaces the page as proof, and that Memory overwrite on every boot; the black box goes, and a clean stop proves an image #1196 decides whether that piece has to land with the black box's removal.

Open points the PR leaves

• Bench loader-binary fallback (loader stage 6). Correctly left open. Ruling 5 concerns update slots. The bench trial of a loader binary is a separately ruled mechanism on the development stick, for a binary that update never writes on an installed machine. In my reading it falls outside the ruling's scope, but asking the owner about it costs one line. The branch should not change it.
• A slot that hangs every boot. This is not an open design question. It follows directly from the ruling, and boot.md already states the remedy: a newer image. What is left is finding 4, the record that still promises otherwise. The suggestion on stage 2 covers reporting such a boot.
• Stage 5's good flag and Memory overwrite on every boot; the black box goes, and a clean stop proves an image #1196. Correctly not decided here, because the order of the two landings is Memory overwrite on every boot; the black box goes, and a clean stop proves an image #1196's question. The wording should describe the relation accurately, as in the last suggestion: the good flag is the black-box-independent proof that Memory overwrite on every boot; the black box goes, and a clean stop proves an image #1196 needs.

Nothing staged or in progress is lost. The rejected cpu-time track was entirely unbuilt. Its 93.3 ms measurement dates from before 2026-07-29 and predates EEVDF and J2. The corpse deferral weakness was filed as a finding. Both cpu-time and fair-band show rejected/none, which the README allows, but finding 6 asks for the fair-band file to be deleted.

SEND BACK

[Japabu]

Review r2 of #1197: 9289022ed..4bb125663

Architectural assessment

The two new commits are a direct answer to round 1. Each ruling now has one home: the design is in docs/, the dates and work are in issues/, and the agents' rule is in CLAUDE.md. The round removes 30 more lines than it adds (+26/−56). Against origin/main the branch now has 26 files, +175/−285. The only code change is still the cpu.rs doc comment. I found no new restatement, code reference or contradiction in this round.

Round 1 blockers

1. Evidence: resolved. Evidence commit abebecfa ("PR 1197 round 2: host tests and mdbook build at 083ad4f") contains rulings/r2/host-tests-r2.log and rulings/r2/mdbook-build-r2.log.
   • The host log has 8477 lines and ends with "Host(Some(Tests)): 9 step(s), all green" and exit=0. It contains no FAILED or panicked, and it runs the sourcegate tests, including no_tracked_file_identifies_a_machine_or_its_network.
   • The mdbook log ends with exit=0.
   • Reusing these at 4bb1256 is sound. That commit changes one sentence of CLAUDE.md and one bullet of memory.md, with no links, paths or identifying shapes.
2. Reservation references: resolved. The false "already done" paragraph is gone from all-cores-are-assumed-equal-and-arm64-breaks-that.md, and the placement record now composes only with the simulator. A search of issues/, docs/, CLAUDE.md and kernel/pure/sched finds no remaining reference to the CPU reservation model.
3. The guids record: resolved. an-images-guids-are-drawn-from-the-hosts-random-source.md:52 now says "table's good flag". No other record cites stage 5's tries.
4. hang_bounded_by_the_stick: resolved. The planned test now says that a hanging --once image costs one boot and the marked slot boots after it. That matches fix-forward and loader stage 5's one-shot requests (the-loader-does-only-what-must-precede-the-handover.md:230-232).
5. Ruling 6 and swap: resolved. CLAUDE.md:15 states the exception once ("except a wait for swapped memory, which behaves like RAM and is reported"). memory.md:64-67 agrees: a timeout never turns the wait into an error. The two homes no longer disagree. The commit message and the PR say the owner left this decision to the orchestrator and the orchestrator kept the exception. They do not present it as the owner's own decision. I cannot check that delegation from the repository. The orchestrator owns it.
6. Fair-band record: resolved. The record is deleted. The net change against main removes the-fair-band-orders-by-share-alone-and-a-woken-editor-waits.md, and the PR table names that slug correctly. No reference to either slug remains.
7. Package track: resolved. Stage 6 is reduced to the ruling date and what it supersedes, what is built, and the exit. The installer bullet points to isolation stage 2 without restating the rule, and that stage carries the rule, its change and today's read-write state (every-program-sees-only-the-files-it-was-given.md:69-72).

Suggestions taken in round 1

• cpu.rs: taken. The comment cites the finding and no longer restates it. The cited file exists.
• scheduling.md: taken. The per-stream line is dropped, and the general line at :12-13 covers it.
• Update-track stage 2: taken. The next boot still reports the last boot's death, Memory overwrite on every boot; the black box goes, and a clean stop proves an image #1196 decides what carries that report, and only the fallback's use of the page is removed.
• Loader stage 5: taken. The good flag replaces the page's DONE record as proof, and Memory overwrite on every boot; the black box goes, and a clean stop proves an image #1196 decides the landing order.

Findings

No blockers.

SUGGESTION:

• docs/src/architecture/memory.md:65 (91 columns) and docs/src/architecture/scheduling.md:31 (87 columns) were edited in place and not rewrapped. The other lines on these pages wrap at about 78 columns. Rewrap both paragraphs if the branch is touched again. This needs no re-run.

LAND