Merge origin/main (a93067f: #651) into wt/toyos-tight

Clean. #651 deletes the retired ABI numbers and adds one shared member,
`syscall_unassigned`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013UDZQ6fSKw14e4w2TKTRfm

Author: Japabu

issues/build/mio-deregister-fd-leaves-a-pending-poll-live.md

@@ -34,8 +34,7 @@ notification for a resource it was promised was gone.
 
 There used to be an ABI op for this. `toyos-abi/src/inbox.rs` op code 2 was
 `IORING_OP_POLL_REMOVE`, retired in PR #89 (`c41b831`,
-"abi: four names retired, and the number each one held") as caller-less. The
-retirement's own reasoning is recorded at the site:
+"abi: four names retired, and the number each one held") as caller-less:
 
 ```
 // Op code 2 unused (formerly IORING_OP_POLL_REMOVE). It had no submitter

issues/design-debt/comments-still-name-syscalls-the-abi-deleted.md

@@ -0,0 +1,32 @@
+---
+status: open
+kind: defect
+opened: 2026-10-02
+---
+
+# Comments still name syscalls the ABI deleted
+
+A deleted syscall is simply deleted, and a past implementation lives in a commit
+message, never in source. Six comments still tell the history of a syscall
+`toyos-abi` no longer declares:
+
+- `userland/libc/src/misc.rs`, `waitpid`'s doc: "`SYS_WAITPID` is retired";
+- `kernel/src/pipe.rs`, `Pipe::backing`'s doc: a pending `SYS_CONNECT`;
+- `userland/soundd/src/virtio.rs`, `submit`'s doc: "the deleted
+  `SYS_AUDIO_SUBMIT`";
+- `tests/toyos-rust-tests/src/bin/abuse_pipe_owner.rs`, the module doc:
+  `SYS_PIPE_OPEN` and `SYS_SOCKET_CREATE`, "that family is retired";
+- `tests/toyos-rust-tests/src/bin/abuse_connect_flood.rs`, the module doc:
+  "it used to `SYS_LISTEN`";
+- `tests/toyos-rust-tests/src/bin/shm_release_reclaims.rs`, the module doc:
+  what `SYS_RELEASE_SHARED` did.
+
+None holds a number or refuses anything, so none is a retirement entry. Each is
+deleted down to what is true of its item now.
+
+Owner: the item each comment documents — `waitpid`, `Pipe::backing`,
+`Virtio::submit`, and the three test binaries' module docs.
+
+**Exit**: `git grep -w -E
+'SYS_WAITPID|SYS_CONNECT|SYS_AUDIO_SUBMIT|SYS_PIPE_OPEN|SYS_SOCKET_CREATE|SYS_LISTEN|SYS_RELEASE_SHARED'
+-- kernel userland tests` finds nothing.

issues/design-debt/the-abi-still-keeps-retired-syscall-numbers.md

@@ -0,0 +1,25 @@
+---
+status: open
+kind: defect
+opened: 2026-10-01
+---
+
+# The window protocol keeps a retired message type
+
+A deleted syscall, `SYS_DEBUG` action or inbox op is simply deleted, and its
+number is free. The window protocol still carries one retired type and refuses
+it by name:
+
+- `userland/toyos-window/src/lib.rs`: `MSG_RETIRED_CLIPBOARD_SET_SHM = 10`;
+- `userland/compositor/src/client.rs`: `DropReason::Retired` and its `why`;
+- `userland/compositor/src/session.rs`: `Session::dispatch`'s arm for it.
+
+Deleting the type makes a frame of 10 an unknown type, which `Session::dispatch`
+reads and drops without a word
+(`issues/isolation/the-compositor-ignores-a-message-it-does-not-know.md`). That
+issue lands first or with this one.
+
+Owner: `Session::dispatch` in `userland/compositor/src/session.rs`.
+
+**Exit**: `git grep -i retired userland/toyos-window userland/compositor` finds
+nothing, and a frame of type 10 drops its client with `DropReason::OutOfProtocol`.

issues/design-debt/the-window-protocol-keeps-a-retired-message-type.md

@@ -21,8 +21,7 @@ the privilege: a `SysCap` carrying `Rights::RT`, granted by a `system.toml` row
 and not in the scheduler. The gate this file was opened against is gone —
 `SYS_SET_RT_PRIORITY` (96) demanded a `VirtioSound` or `HdaAudio` device claim,
 so a latency tool could only reach the band by taking the sound card away from
-soundd and measuring a different machine. Number 96 is retired, and
-`toyos-abi/src/syscall.rs` says why: "a claim is not a privilege".
+soundd and measuring a different machine.
 
 **What exists is not a substitute, and each instrument fails differently.**
 soundd's `max_wake_lat_ns` (`toyos-mixer/src/stats.rs`, printed by

issues/diagnostics/no-cyclictest.md

@@ -43,14 +43,6 @@ On top of retention, in dependency order:
 One residual is nearly free: a log-follow tool is a manifest row and about 30
 lines, because `LogTail` already exists in the SDK.
 
-**Syscall numbers: the three this work once reserved are all taken, and the
-obvious fix is wrong too.** 97 and 98 are the device register read/write pair,
-99 is the endowments call. Re-allocating "from 128 up" breaks a compile-time
-assert, because 128 is the syscall-profile bin count and 127 is its overflow
-bucket. **The first clean numbers are 116, 117, 118** — 113 and 115 are held
-reservations, 114 is spent on log reading, and 96 and 107 are retired and never
-reused.
-
 The log half of this work landed differently and better, and the difference is
 worth knowing before anything is rebuilt on the old design: reading is
 record-shaped rather than byte-shaped, it is authority (`Rights::LOG` on a

issues/diagnostics/the-kernel-keeps-nothing-it-enumerates.md

@@ -16,8 +16,8 @@ nothing.
 1. **The rename**, one mechanical PR, first after #536. Before stage 1 is
    briefed, the exit's search below runs once over the `rust/` fork's delta as
    well as the superproject, so its hits are known going in. It touches `toyos/src`,
-   `toyos-abi/src`, `userland/libc/src` and the `rust/` fork's delta, so it is
-   briefed as an ABI brief, and its `CLAUDE.md` edits are placed in the same PR
+   `toyos-abi/src`, `userland/libc/src` and the `rust/` fork's delta, and its
+   `CLAUDE.md` edits are placed in the same PR
    by an agent briefed for them. Issue slugs carrying an old name are renamed
    with every citation.
 

issues/isolation/the-supervisor-is-host-tested-and-owns-the-stop.md

@@ -12,8 +12,7 @@ into `h:m:s` (`toyos_abi::syscall::clock_realtime`), which every caller today
 could derive from `clock_epoch()` instead, with no information
 `SYS_CLOCK_REALTIME` carries that `SYS_CLOCK_EPOCH` does not.
 
-Exit condition: `SYS_CLOCK_REALTIME`'s number (42) is retired and never
-reused, its kernel handler and `toyos_abi::syscall::clock_realtime` are
+Exit condition: `SYS_CLOCK_REALTIME`, its kernel handler and `toyos_abi::syscall::clock_realtime` are
 deleted, `toyos::system::clock_realtime` and both its callers
 (`userland/compositor/src/render.rs`,
 `tests/toyos-rust-tests/src/bin/wall_clock_now.rs`) move to `clock_epoch`, all

issues/kernel/sys-clock-realtime-is-now-a-format-of-sys-clock-epoch.md

@@ -8,7 +8,7 @@ opened: 2026-10-01
 
 The guest suite's first cut
 (`issues/build/the-guest-suite-runs-only-what-no-cheaper-tier-reaches.md`) deleted the only
-callers of nine `SYS_DEBUG` actions and the loader's reading of two boot words, and left their
+callers of eight `SYS_DEBUG` actions and the loader's reading of two boot words, and left their
 names in `toyos-abi/src`, because a deletion there is an ABI change and that pull request was not
 one. Each kernel arm still answers its action. `git grep -w <name> -- tests userland toyos src`
 finds no caller of:
@@ -18,14 +18,16 @@ finds no caller of:
   `syscall_fault_halts` and `heap_over_ceiling_halts` and stage C's `idle_stack_guard`;
 - `HEAP_AT_CEILING` (5), `HEAP_AT_CEILING_PAGE_ALIGNED` (7) and `LOWER_SYSINFO_BOUND` (19),
   `heap_ceiling`'s, for stage C's `heap_ceiling_bounds`;
-- `LOCK_ACROSS_SWITCH` (2), `test_panic_child`'s, and `LOG_PATTERNED` (21), test-runner's
-  `log-gate` and `log-storm`. Their stage C items are a type (`lock_across_switch_halts`) and
-  a host test (`log_conservation_smp2`), and neither calls `SYS_DEBUG`, so no stage brings a
-  caller back;
+- `LOCK_ACROSS_SWITCH` (2), `test_panic_child`'s. Its stage C item is a type
+  (`lock_across_switch_halts`), which calls no `SYS_DEBUG`, so no stage brings a caller back;
 - `boot::WRITE_NO_LAYOUT_PARAM` and `boot::WITHHOLD_ROOT_PARAM`, for stage A's
   `kernel_args_layout_refused` and `root_withheld_refused`.
 
+`LOG_PATTERNED` (21) has one caller, `panic_halts_first`, which wants a record and reads none of
+the pattern `kernel/src/log/storm.rs` writes into it: the checksum and payload had test-runner's
+`log-gate` and `log-storm` as their readers, and stage C's `log_conservation_smp2` is a host test.
+
 Owner: the orchestrator.
 
 **Exit**: for each name, `git grep -w` finds a caller again, its stage's row, or an ABI change
-retires the name with its kernel arm and never reuses its number.
+deletes the name with its kernel arm; and `storm.rs`'s pattern has a reader or is deleted.

issues/kernel/sys-debug-actions-and-two-loader-words-that-nothing-calls.md

@@ -295,9 +295,7 @@ no replace", and a narrower one is a *new* object built from an existing one
 (`4a98107f^:kernel/src/arch/syscall.rs:1861`); `SYS_NAMESPACE_BUILD` demands
 `Rights::TRANSFER` on every added connector and resolves kept names against the
 base before installing anything (`:1754`). A process with no `svc` endowment
-resolves no name at all, and there is no registry to fall back to: 85
-`SYS_LISTEN` and 87 `SYS_CONNECT` are retired numbers
-(`4a98107f^:kernel/src/arch/syscall.rs:77`, `:78`). The **filesystem** path space is the
+resolves no name at all, and there is no registry to fall back to. The **filesystem** path space is the
 other thing the word could mean, and it is ambient process state
 (`4a98107f^:kernel/src/arch/syscall.rs:1234`) — questions 2 and 5 hold that half.