[Japabu]

What this changes

SYS_CLOCK_REALTIME (42), its kernel arm in kernel/src/syscall/dispatch.rs, toyos_abi::syscall::{SYS_CLOCK_REALTIME, clock_realtime, RealTime} and toyos::system::{clock_realtime, RealTime} are deleted. The compositor's taskbar clock formats clock_epoch() through toyos_wallclock::Civil (new path dependency on the existing no_std calendar crate). wall_clock_now reads only SYS_CLOCK_EPOCH: its "both syscalls answered or neither" assertion and its realtime= print go — the first is vacuous with one syscall, the second was read by no host test (virt_wall_clock_utc parses wall-clock: epoch= and wall-clock: std_epoch=).

Why

Since the RTC-keeps-UTC ruling both handlers read clock::utc_secs(); SYS_CLOCK_REALTIME only packed it into h:m:s, carrying nothing SYS_CLOCK_EPOCH does not. The issue fixed the decision to delete it.

Evidence

Logs: https://github.com/ToyOSOrg/evidence/tree/6fe2825e5cb3b01fc4f4efc37cf0a4783784331c/ab409f3e4 (ci-host.log, build-only.log, guest.log, metal-readback.log). Revision: the tree committed as ab409f3e4 (all runs below were on that exact worktree content before committing), host macOS arm64.

• cargo run -- --ci host — exit 0, "Host: 86 step(s), all green".
• cargo run -- --build-only — exit 0; rebuilt both toyos sysroots against the changed toyos-abi/toyos (std fork compiles without the deleted items) and the x86-64 image.
• cargo test --test toyos-build -- wall_clock the_compositor_drives_the_virtio_gpu — exit 0, 2 passed: virt_wall_clock_utc (AArch64 virt, runs wall_clock_now and checks epoch= and std_epoch= against the RTC instant staged by the host: epoch=1993799667, 2s past the staged 2033-03-07T09:14:25 — independent oracle) and the_compositor_drives_the_virtio_gpu (x86-64 HeadlessVirtioGpu; the desktop including the taskbar status clock is drawn at two modes).
• wall_clock_now's x86-64 run is a member of the metal shared boot only (a QEMU filter refuses it). Staged with cargo test --test toyos-build -- --metal --metal-readback <dir> wall_clock_now (exit 2 = staged, no machine touched); not run.
• Consumer search: git grep of the tree, the fork clones beside the monorepo, the primary checkout's rust/library and ~/.cargo/git/checkouts — no other user of the number or the function (only Miri's unrelated RealTime in rust-upstream). libc's POSIX CLOCK_REALTIME is a separate thing and already goes through SYS_CLOCK_EPOCH.

What is unsure

The compositor clock's pixels are not asserted by any test; the virtio-gpu smoke shows the taskbar path draws without fault, and the HH:MM derivation is Civil::from_unix_secs, host-tested in lib/wallclock. Syscall number 42 is left unused, not renumbered.

Anything a reader of main must not miss

Closes issues/sys-clock-realtime-is-now-a-format-of-sys-clock-epoch.md. issues/the-capability-end-state-is-twelve-answers.md's machine-facts list drops the syscall. issues/the-loader-does-only-what-must-precede-the-handover.md still names SYS_CLOCK_REALTIME and the probe's realtime= in stage 1, which records what the landed PR #583 did; left as history.

[Japabu]

Review of #945 at ab409f3 (base origin/main 979d4c5)

Assessment. This is a clean deletion that moves work out of the kernel. SYS_CLOCK_REALTIME was utc_secs() packed into h:m:s by the kernel. Its one production caller now gets the same seconds from SYS_CLOCK_EPOCH and formats them itself with the tree's one calendar. Net: +23/−84, and no code is added beyond the five-line taskbar arm.

ABI coherence. The whole chain is removed in one landing:

• the number in sdk/abi/src/syscall.rs
• RealTime and clock_realtime in toyos-abi
• the re-export and wrapper in sdk/toyos/src/system.rs
• the kernel arm in syscall/dispatch.rs

On the branch tree, git grep for clock_realtime|SYS_CLOCK_REALTIME|RealTime finds only libc's unrelated POSIX CLOCK_REALTIME, the realtime program endowment (syscall.rs:390), and one issue file (below). A search of the primary checkout's rust/library, every fork clone under ../forks/ and ~/.cargo/git/checkouts finds nothing. No fork pin is owed. build-only.log shows both sysroots rebuilt against the changed SDK. Leaving number 42 unused is right; dispatch's _ => arm answers it InvalidArgument like any unknown number.

Compositor semantics are unchanged.

• Before, the kernel computed Civil::from_unix_secs(utc_secs) and packed hour and minute. The compositor printed {:02}:{:02}.
• Now the compositor computes Civil::from_unix_secs(clock_epoch()) from the same utc_secs().
• Both show UTC, and both fall back to --:-- on exactly the same machines: both syscalls returned NotSupported from one utc_secs() None.
• No time zone or locale was applied before or after, so nothing changes for a reader of the taskbar.

Dependency. toyos-wallclock is the tree's own no_std, dependency-free calendar. The supervisor and logkeeper already use it in userland, and std's SystemTime would still need a calendar to get hours. So it is the only sensible choice, and it adds no third-party source.

Issue edits.

• Deleting sys-clock-realtime-is-now-a-format-of-sys-clock-epoch.md meets its exit exactly, including "a PR of its own". No citation of its slug or path remains.
• The the-capability-end-state-is-twelve-answers.md edit is legitimate. That list is the recorded, committed set of ambient syscalls "the tree now enforces". Leaving a deleted syscall in it would make a present-tense claim false. The repo's practice is that issue citations follow such changes (e.g. 330e39a30, 170428ccd). The removal is the only change; the rewrap is mechanical.
• Leaving the-loader-does-only-what-must-precede-the-handover.md alone is right: those lines record what landed stage 1 measured.

Evidence and the T14. I read the logs at evidence 6fe2825e. ci-host.log ends all green / exit 0. guest.log shows 2 passed, with epoch= and std_epoch= both inside the staged instant's window, judged against the RTC the host staged (an independent oracle). metal-readback.log exits 2, which means staged, no machine touched.

QEMU aarch64 virt_wall_clock_utc plus host checks are enough to land. What the change touches on x86 metal:

• the deletion of a portable dispatch arm, which aarch64 exercises
• the wall_clock_now edit, which only removes an assertion and a print. Its surviving lines are byte-identical, and they ran on aarch64.
• The x86 SYS_CLOCK_EPOCH arm and clock::utc_secs are unchanged.

No host parser reads realtime= (I checked tests/ and build/). The metal row would re-establish what is already established, so it can go to the next scheduled shared boot rather than gate this PR.

Findings

• SUGGESTION: sdk/abi/src/syscall.rs:1171-1178. The merged doc joins two paragraphs ("…reads the clock once. / Cheap: …") with no /// blank line, so rustdoc renders them as one. Put a blank doc line before "Cheap:".
• SUGGESTION: lib/wallclock/src/lib.rs:15-18. The "The one calendar in the tree" sentence is an inventory of callers, and it is already incomplete: the supervisor, the loader and lib/update use it too. Its point is the last clause. Consider dropping the list rather than maintaining it.

LAND

[Japabu]

Merge-queue run 38719410357 went red on kernel/loom/tests/tlb_shootdown.rs::an_acknowledged_flush_postdates_the_page_table_write ("no interleaving completed the wait"). Independent of this PR (which touches no kernel paging or loom code): the file's eight models share one static ACKED that each test resets at its start, and cargo test runs them on parallel threads, so one test can clear another's acknowledgement before its final assertion — the same test reddened the last two nightlies. A separate fix is dispatched; re-queued.