A number the T14 measured is recorded off its owner's verdict alone: one red row or member no longer drops what its boot measured, and a boot whose clocks disagree fails its rows' numbers

[Japabu]

Stage 2 of step B of the one-boot plan for the T14's metal rows. Head 71afd05ef, which carries main at 9cf2c4e5c. Harness only: no kernel, no userland program, no change to which rows a boot runs.

The owner wants as many tests on the T14 as possible in as few boots as possible, and a metal failure must never silently drop what its boot measured. This lands before stage 3 puts most of the profile's verdicts on one boot's label.

What changed, per decision

• A number has an owner, and fails with that owner alone. judge_readbacks kept a set of failed boot labels: one red row or shared member riding a boot put the label in it, and every number that boot measured was then kept out of the machine's record. The set is gone. What the harness reads off every boot (boot.<label>.complete_ms, panel_us, panel_max_us) is the boot's, and is recorded where the boot's own checks pass. What a row's judge measured is the row's, and is recorded where that judge passed. A failing shared member reds the run and moves no number.
• How a number finds its owner. A judge still calls Readback::measured, whose signature is unchanged, so no registration changed. After the boot's own checks, and after each row's judge returns, the harness takes what the readbacks gained (Readback::taken) and enters it under that owner's verdict (own). No field names an owner: the owner is whoever was being judged when the number was measured.
• A boot-level red fails a passing row's number only where it makes that number suspect (the orchestrator's ruling on the review's table, round 2). A boot whose clocks disagree (one_clock) fails every row-measured number of that boot: every such number is a duration on the clock that check compares, a disagreement may be another rate, and the record never moves a recorded value, so a scaled number would stand as the baseline. It is one clause in the row's own call: the judge passed and every boot the row rode has one_clock() Ok. No set, no second pass. Every other boot-level red the harness has (no Boot: complete or no census, the log not whole, the stop giving up, a late deadline or lockup) leaves a passing row's number standing, because each is read off one line that is present; the comment at the site says what would change that: a number summed or maximised over the log.
• One name measured by two owners is judged on the first reading and recorded off neither, whether the first owner passed or failed. The check plants the two rows on two boots; after taken drains a readback, two rows on one boot take the same path through own, which is read from the code and not exercised by a check.
• A row that is the second to measure a name is not a PASS (round 2): own runs before the verdict is printed, its FAIL <name> is measured twice, and <row> is the second is the row's line, and the row is counted among the failed. Nothing checks the printed count; it is read from the code.
• Every reading is still judged against the record whatever its owner's verdict; only whether a new name becomes a row depends on the owner. src/metaltimings.rs changes in its header and one doc comment, and one test is renamed.
• The summary line reads N whose owner failed where it read N off a boot that failed. A passing row's number on a boot whose clocks disagree is counted in that N; the boot's own FAIL line above says why.

Boots, as the harness prints them: [metal] 64 registration(s) and 229 shared member(s) over 25 boot(s) at the head (r2-list), as at the base in round 1.

Where the landed tree differs from the design

• The design's stage 2 is one sentence and names no mechanism; the mechanism above is this branch's.
• The design counts 26 boots going to 25 in stage 1 and calls LOADED cut to 2 s. As landed (A T14 boot whose log is missing parts reds by name, and the two ACPI rows ride testcases again: 26 boots to 25 #785) LOADED stays 20 s and the count is 25.
• No track in issues/ carries a line for this stage, and stage 1 added none, so none is edited.

Issues

issues/a-metal-failure-drops-every-row-its-boot-measured.md is closed: deleted. Its exit, "each number is recorded against its owner, and only that owner fails", is what the two rewritten checks hold. Its rule is the doc comment of judge_readbacks. Nothing else in the tree cited it, by path or by slug.

issues/the-licence-step-re-locks-std-against-the-registry-on-every-run.md is filed, kind: tooling, as a record of the review's off-branch finding. Nothing here fixes it.

Gates at 71afd05ef, each by its own exit code (logs named r2-<step>)

step	command	exit	host load (1 min) at its start
checks	cargo test --locked --test toyos-checks (38 passed)	0	20.94
lib	cargo test --locked --lib (340 passed, 15 ignored)	0	20.38
list	cargo test --locked --test toyos-build -- --metal --list: 25 boots	0	22.96
clippy	cargo run -- --clippy (24 invocations)	0	23.92
build-only	cargo run -- --build-only	0	25.10
host	cargo run -- --ci host (Host: 78 step(s), all green)	0	25.35

No guest test is reached: the change is in the judge of readbacks, which no QEMU test calls. None was run.

High-risk checks

The harness's verdict path is the change.

The row half of the rule over a real readback, base against head. Every row-measured number lives on latencycase. The newest recorded T14 readback of that boot (a full-profile run of 7 October, another branch's) is one the current harness reads. It was copied; no recorded readback was changed in place. The T14's record had its six latencycase rows removed (boot.latencycase.*, tlb.latencycase.p50_ns, .p99_ns, latency.p99_us) before each arm and was restored after it. Each arm is --metal --metal-readback <copy> boot:latencycase; the base arm is the same with m0 applied (tests/common/metal.rs and src/metaltimings.rs as on main).

readback	harness	verdict	exit	rows the record regains
as it came back	head	2 passed, 0 failed; 0 whose owner failed	0	all six: 1139, 2478, 13706; 1687, 2331; 16
as it came back	base	2 passed, 0 failed; 0 off a boot that failed	0	the same six
tlb: bench line's min= made 0	head	1 passed, 1 failed (tlb_shootdown_cost); 0 whose owner failed	1	boot.latencycase.* and latency.p99_us; no tlb.*
the same	base	1 passed, 1 failed; 4 off a boot that failed	1	none
supervisor's line stamped 10 ms before its spawn	head	2 passed, 0 failed; the boot's FAIL for its clocks; 6 whose owner failed	1	none
the same	base	2 passed, 0 failed; 6 off a boot that failed	1	none

Logs r2-lat-<asis|benchfail|skew>-<head|base>.log, each with the record's diff beside it. The three record diffs that regain nothing are byte-identical to the removal patch. In the second arm tlb_shootdown_cost fails before it measures, so that arm shows the boot and the row beside the red one keeping their numbers; a red row's own measured number staying out is the host check's (m1). The third arm is beyond what the review asked: it is the first BLOCKER's rule on the same real readback.

The earlier control, round 1 at 7cc209f13: a testcases readback with hda_tone made red, head against base; the head re-records the three boot.testcases.* rows and the base none (r1-redrow-*).

Independent oracle. The readbacks are the T14's own. Every red in them is planted: no recorded readback with a red row and an unrecorded number was at hand.

Mutations at 71afd05ef (patches in the round-2 comment; each applied as a checked patch, run with cargo test --locked --test toyos-checks -- metal_, reversed, tree clean after; each a test failure, exit 101):

patch	the claim it breaks	check it reds
m0-whole-change-reverted	the stage	metal_number_fails_with_its_owner_alone, metal_failing_shared_member_fails_itself_alone, metal_name_two_owners_measured_is_refused
m1-a-red-rows-number-is-recorded	a red row's own number is not recorded	metal_number_fails_with_its_owner_alone
m2-a-red-boots-number-is-recorded	a boot whose own check fails records none of its own	the same, and metal_cleared_page_owes_no_panel
m3-a-late-deadline-fails-its-rows-numbers	a boot-level red other than its clocks does not move a passing row's number	metal_number_fails_with_its_owner_alone
m4-a-red-member-is-not-red	a failing member reds the run	metal_failing_shared_member_fails_itself_alone
m5-a-name-measured-twice-is-recorded	one name from two owners is recorded off neither	metal_name_two_owners_measured_is_refused
m6-a-name-measured-twice-is-not-red	and reds the run	the same
m7-taken-takes-nothing	a number is entered once, under the owner who measured it	four checks
m8-a-red-row-is-not-red	a failing row alone reds the run	metal_number_fails_with_its_owner_alone
m9-a-row-number-stands-on-a-boot-whose-clocks-disagree	the clock clause	metal_number_fails_with_its_owner_alone
m10-a-failing-owners-reading-is-not-entered	a failing first owner's reading still holds its name (the review's patch)	metal_name_two_owners_measured_is_refused

Tiers and growth

No new test and no new gate: three existing host checks are rewritten to the new rule and renamed; one gains a row beside the failing one, a boot whose clocks disagree with a passing row on it, and a run where the row's failure is the only one; one gains the arm where the first of two owners fails. They see what reading cannot: which names reach the record file when owners fail in combination. git diff --numstat origin/main...HEAD: the harness and src/metaltimings.rs +72 −47, the checks +81 −29, the closed issue −23, the filed one +28.

Unsure of

• A name the record lacks, off an owner that failed, is counted and not named: the summary says how many, and the FAIL lines above it say which owners.
• one_clock is evaluated twice per boot a row rides, once among the boot's own checks and once per row in the clause; it is a pure function of the readback's two texts.
• A boot the loop refused still measures nothing and reds every row on it; that is stage 4a's.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

[Japabu]

Round 1 mutations at 7cc209f13. Each was checked with git apply --check, applied, run as cargo test --locked --test toyos-checks -- metal_, and reversed; git status --porcelain --ignore-submodules=none printed nothing afterwards. All nine are test failures, not build errors.

patch	exit	check it reds
m0-whole-change-reverted	101	metal_failing_shared_member_fails_itself_alone, metal_number_fails_with_its_owner_alone
m1-a-red-rows-number-is-recorded	101	metal_number_fails_with_its_owner_alone
m2-a-red-boots-number-is-recorded	101	metal_cleared_page_owes_no_panel, metal_number_fails_with_its_owner_alone
m3-a-red-boot-fails-its-rows-numbers	101	metal_number_fails_with_its_owner_alone
m4-a-red-member-is-not-red	101	metal_failing_shared_member_fails_itself_alone
m5-a-name-measured-twice-is-recorded	101	metal_name_two_owners_measured_is_refused
m6-a-name-measured-twice-is-not-red	101	metal_name_two_owners_measured_is_refused
m7-taken-takes-nothing	101	metal_reading_past_its_record_fails_and_moves_nothing, metal_name_two_owners_measured_is_refused, metal_number_fails_with_its_owner_alone, metal_run_under_another_bios_fails_and_records_nothing
m8-a-red-row-is-not-red	101	metal_number_fails_with_its_owner_alone

m0-whole-change-reverted.patch

diff --git a/src/metaltimings.rs b/src/metaltimings.rs
index e22a7cf53..de930057a 100644
--- a/src/metaltimings.rs
+++ b/src/metaltimings.rs
@@ -4,9 +4,9 @@
 //! One file per machine under [`DIR`], named for its SMBIOS vendor and product,
 //! written by a run and committed by whoever ran it. A run on a machine with no
 //! record is recorded and not judged; a name the record lacks is added and not
-//! judged, and only where its owner passed, the boot or the row that measured
-//! it; a recorded value is never moved by a run, so a slow run cannot become
-//! the baseline the next is judged by. A run under a BIOS other than the record's is judged against it,
+//! judged, and only off a boot with no failure of its own; a recorded value is
+//! never moved by a run, so a slow run cannot become the baseline the next is
+//! judged by. A run under a BIOS other than the record's is judged against it,
 //! fails naming both, and records nothing. Deleting a row is how a number is
 //! re-recorded, and deleting the file is how a machine is, firmware and all.
 //!
@@ -136,8 +136,8 @@ enum Unread {
     Refused(String),
 }
 
-/// One number a run measured, and whether its owner passed: every reading is
-/// judged, and only a passing owner's becomes a record.
+/// One number a run measured, and whether the boot that measured it passed:
+/// every reading is judged, and only a passing boot's becomes a record.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct Reading {
     pub value: u64,
@@ -386,9 +386,9 @@ mod tests {
         );
     }
 
-    /// **A failed owner's numbers are judged and never become a baseline.**
+    /// **A failed boot's numbers are judged and never become a baseline.**
     #[test]
-    fn a_failing_owners_reading_is_judged_and_not_recorded() {
+    fn a_failing_boots_reading_is_judged_and_not_recorded() {
         let machine = t14(BIOS);
         let record = recorded(&machine, &[("boot.a.complete_ms", 1000)]);
         let failed = |value| Reading { value, passed: false };
diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 7a382de67..21190c3bc 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -235,8 +235,7 @@ pub struct Readback {
     pub stick_secs: u64,
     /// The machine the loop read before the flash.
     pub machine: Result<Machine, String>,
-    /// What was measured on this boot and no owner has taken yet
-    /// ([`Self::taken`]).
+    /// What this boot's judges measured, for the machine's record to judge.
     numbers: RefCell<BTreeMap<String, u64>>,
 }
 
@@ -463,11 +462,9 @@ impl Readback {
             })
     }
 
-    /// One number measured on this boot. It is its measurer's, the row whose
-    /// judge called this or the boot itself for what [`judge_readbacks`] reads
-    /// off every boot, and is judged against this machine's record once every
-    /// judge has spoken. A second value under one name is refused: which of
-    /// the two a record kept would be nobody's reading.
+    /// One number this boot measured, judged by [`run`] against this machine's
+    /// record once every judge has spoken. A second value under one name is
+    /// refused: which of the two a record kept would be nobody's reading.
     pub fn measured(&self, name: &str, value: u64) -> Result<(), String> {
         match self.numbers.borrow_mut().entry(name.to_string()) {
             Entry::Vacant(slot) => {
@@ -482,11 +479,6 @@ impl Readback {
         }
     }
 
-    /// What was measured on this boot since this was last asked.
-    fn taken(&self) -> BTreeMap<String, u64> {
-        std::mem::take(&mut self.numbers.borrow_mut())
-    }
-
     /// The job ran and the kernel recorded it exiting cleanly.
     pub fn job_passed(&self, binary: &str) -> Result<(), String> {
         match self.exit_code(binary)? {
@@ -1013,41 +1005,10 @@ pub fn run(
     }
 }
 
-/// What `backs` measured since they were last asked becomes one owner's: judged
-/// against the record whatever the owner's verdict, and a new row of it only
-/// where the owner `passed`. A name a second owner measures is judged on the
-/// first reading and recorded off neither; answers whether one was.
-fn own(
-    measured: &mut BTreeMap<String, Reading>,
-    owner: &str,
-    passed: bool,
-    backs: &[&Readback],
-) -> bool {
-    let mut twice = false;
-    for (name, value) in backs.iter().flat_map(|back| back.taken()) {
-        match measured.entry(name) {
-            Entry::Vacant(slot) => {
-                slot.insert(Reading { value, passed });
-            }
-            Entry::Occupied(mut first) => {
-                eprintln!("  FAIL {} is measured twice, and {owner} is the second", first.key());
-                first.get_mut().passed = false;
-                twice = true;
-            }
-        }
-    }
-    twice
-}
-
 /// Every verdict a run's readbacks carry, and this machine's record judged by
-/// them: one function of the readbacks, whether the loop wrote them a moment
-/// ago or a run long past did. Answers whether anything was red.
-///
-/// **A number is its owner's, and fails with its owner alone.** What a boot
-/// reads off itself is the boot's, and stands or falls with the boot's own
-/// checks; what a row's judge measured is the row's, and stands or falls with
-/// that judge. Neither is moved by another row or a shared member riding the
-/// same boot.
+/// them and added to off the boots that passed: one function of the readbacks,
+/// whether the loop wrote them a moment ago or a run long past did. Answers
+/// whether anything was red.
 pub fn judge_readbacks(
     root: &Path,
     readbacks: &BTreeMap<String, Result<Readback, String>>,
@@ -1055,13 +1016,15 @@ pub fn judge_readbacks(
     shared: &[SharedBoot],
 ) -> bool {
     let mut red = false;
-    let mut measured: BTreeMap<String, Reading> = BTreeMap::new();
+    // **A boot with any failure of its own adds no row**, whether the loop,
+    // the boot's own checks, or a test or member riding it failed.
+    let mut failed: BTreeSet<&str> = BTreeSet::new();
     eprintln!("\n[metal] the boots");
     for (label, back) in readbacks {
         let back = match back {
             Err(why) => {
                 eprintln!("  FAIL {label}: {why}");
-                red = true;
+                failed.insert(label);
                 continue;
             }
             Ok(back) => back,
@@ -1109,9 +1072,9 @@ pub fn judge_readbacks(
         for why in &findings {
             eprintln!("    FAIL {why}");
         }
-        let whole = findings.is_empty();
-        let twice = own(&mut measured, &format!("the boot {label}"), whole, &[back]);
-        red |= twice || !whole;
+        if !findings.is_empty() {
+            failed.insert(label);
+        }
     }
 
     eprintln!("\n[metal] the tests");
@@ -1130,15 +1093,16 @@ pub fn judge_readbacks(
             Some(why) => Err(why),
             None => judge(&owed),
         };
-        match &verdict {
+        match verdict {
             Ok(()) => {
                 eprintln!("  PASS {name}");
                 passed += 1;
             }
-            Err(why) => eprintln!("  FAIL {name}: {why}"),
+            Err(why) => {
+                eprintln!("  FAIL {name}: {why}");
+                failed.extend(arms.iter().map(|arm| arm.boot));
+            }
         }
-        let twice = own(&mut measured, name, verdict.is_ok(), &owed);
-        red |= twice || verdict.is_err();
     }
     let mut members = 0usize;
     for boot in shared {
@@ -1160,7 +1124,7 @@ pub fn judge_readbacks(
                 // bury the four that matter.
                 Err(why) => {
                     eprintln!("  FAIL {job}: {}", why.lines().next().unwrap_or(&why));
-                    red = true;
+                    failed.insert(&boot.boot);
                 }
             }
         }
@@ -1171,8 +1135,27 @@ pub fn judge_readbacks(
             }
         }
     }
+    red |= !failed.is_empty();
 
     eprintln!("\n[metal] the timings");
+    let mut measured: BTreeMap<String, Reading> = BTreeMap::new();
+    for (label, back) in readbacks {
+        let Ok(back) = back else { continue };
+        let passed = !failed.contains(label.as_str());
+        for (name, &value) in back.numbers.borrow().iter() {
+            match measured.entry(name.clone()) {
+                Entry::Vacant(slot) => {
+                    slot.insert(Reading { value, passed });
+                }
+                // Judged on the first, and recorded off neither.
+                Entry::Occupied(mut first) => {
+                    eprintln!("  FAIL {name} is measured by two boots, and {label} is the second");
+                    first.get_mut().passed = false;
+                    red = true;
+                }
+            }
+        }
+    }
     let machine = one_machine(readbacks);
     let record =
         machine.as_ref().map_err(Clone::clone).and_then(|machine| Record::load(root, machine));
@@ -1195,7 +1178,7 @@ pub fn judge_readbacks(
                 );
             }
             eprintln!(
-                "  {} number(s) on {} {}, BIOS {}; {} past its record, {} whose owner failed",
+                "  {} number(s) on {} {}, BIOS {}; {} past its record, {} off a boot that failed",
                 measured.len(),
                 machine.vendor,
                 machine.product,

m1-a-red-rows-number-is-recorded.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 7a382de67..a4353407f 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -1137,7 +1137,7 @@ pub fn judge_readbacks(
             }
             Err(why) => eprintln!("  FAIL {name}: {why}"),
         }
-        let twice = own(&mut measured, name, verdict.is_ok(), &owed);
+        let twice = own(&mut measured, name, true, &owed);
         red |= twice || verdict.is_err();
     }
     let mut members = 0usize;

m2-a-red-boots-number-is-recorded.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 7a382de67..2c19b75f0 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -1110,7 +1110,7 @@ pub fn judge_readbacks(
             eprintln!("    FAIL {why}");
         }
         let whole = findings.is_empty();
-        let twice = own(&mut measured, &format!("the boot {label}"), whole, &[back]);
+        let twice = own(&mut measured, &format!("the boot {label}"), true, &[back]);
         red |= twice || !whole;
     }
 

m3-a-red-boot-fails-its-rows-numbers.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 7a382de67..6af2b5162 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -1056,6 +1056,7 @@ pub fn judge_readbacks(
 ) -> bool {
     let mut red = false;
     let mut measured: BTreeMap<String, Reading> = BTreeMap::new();
+    let mut unwhole: BTreeSet<&str> = BTreeSet::new();
     eprintln!("\n[metal] the boots");
     for (label, back) in readbacks {
         let back = match back {
@@ -1110,6 +1111,9 @@ pub fn judge_readbacks(
             eprintln!("    FAIL {why}");
         }
         let whole = findings.is_empty();
+        if !whole {
+            unwhole.insert(label);
+        }
         let twice = own(&mut measured, &format!("the boot {label}"), whole, &[back]);
         red |= twice || !whole;
     }
@@ -1137,7 +1141,8 @@ pub fn judge_readbacks(
             }
             Err(why) => eprintln!("  FAIL {name}: {why}"),
         }
-        let twice = own(&mut measured, name, verdict.is_ok(), &owed);
+        let on_whole = arms.iter().all(|arm| !unwhole.contains(arm.boot));
+        let twice = own(&mut measured, name, verdict.is_ok() && on_whole, &owed);
         red |= twice || verdict.is_err();
     }
     let mut members = 0usize;

m4-a-red-member-is-not-red.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 7a382de67..13e1ca3d2 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -1160,7 +1160,6 @@ pub fn judge_readbacks(
                 // bury the four that matter.
                 Err(why) => {
                     eprintln!("  FAIL {job}: {}", why.lines().next().unwrap_or(&why));
-                    red = true;
                 }
             }
         }

m5-a-name-measured-twice-is-recorded.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 7a382de67..c3cb5b837 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -1029,9 +1029,8 @@ fn own(
             Entry::Vacant(slot) => {
                 slot.insert(Reading { value, passed });
             }
-            Entry::Occupied(mut first) => {
+            Entry::Occupied(first) => {
                 eprintln!("  FAIL {} is measured twice, and {owner} is the second", first.key());
-                first.get_mut().passed = false;
                 twice = true;
             }
         }

m6-a-name-measured-twice-is-not-red.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 7a382de67..112b1c6af 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -1023,7 +1023,7 @@ fn own(
     passed: bool,
     backs: &[&Readback],
 ) -> bool {
-    let mut twice = false;
+    let twice = false;
     for (name, value) in backs.iter().flat_map(|back| back.taken()) {
         match measured.entry(name) {
             Entry::Vacant(slot) => {
@@ -1032,7 +1032,6 @@ fn own(
             Entry::Occupied(mut first) => {
                 eprintln!("  FAIL {} is measured twice, and {owner} is the second", first.key());
                 first.get_mut().passed = false;
-                twice = true;
             }
         }
     }

m7-taken-takes-nothing.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 7a382de67..15d778629 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -484,7 +484,7 @@ impl Readback {
 
     /// What was measured on this boot since this was last asked.
     fn taken(&self) -> BTreeMap<String, u64> {
-        std::mem::take(&mut self.numbers.borrow_mut())
+        self.numbers.borrow().clone()
     }
 
     /// The job ran and the kernel recorded it exiting cleanly.

m8-a-red-row-is-not-red.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 7a382de67..e9aea23cb 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -1138,7 +1138,7 @@ pub fn judge_readbacks(
             Err(why) => eprintln!("  FAIL {name}: {why}"),
         }
         let twice = own(&mut measured, name, verdict.is_ok(), &owed);
-        red |= twice || verdict.is_err();
+        red |= twice;
     }
     let mut members = 0usize;
     for boot in shared {

[Japabu]

Review, round 1, of 7cc209f13 against origin/main at 9cf2c4e5c (merge base 44871bee9; git merge-tree of the two is clean). Read: the one commit, the diff, and tests/common/metal.rs, tests/checks/metal.rs, src/metaltimings.rs whole at the head, with the r1-* logs.

Net lines, git diff --shortstat origin/main...7cc209f13: 5 files, +115 −90. Harness and src/metaltimings.rs +64 −47, checks +51 −20, the issue −23. The growth in the harness is own and taken replacing the failed set and the late pass over numbers; accepted.

BLOCKER

• tests/common/metal.rs:1140 — a row's number is recorded off a boot whose clocks disagree — one_clock is a boot-level finding, so at the head it fails only boot.<label>.*; the base kept every number of that boot out. The three numbers rows measure today (tlb.latencycase.p50_ns, .p99_ns, latency.p99_us) are all differences of nanos_since_boot, the clock whose stamps one_clock compares with the loader's counter. A disagreement is either another zero or another rate, the harness cannot tell which, and another rate scales every one of those durations. The record never moves a recorded value, so such a number stays the baseline until someone deletes the row. The issue's exit asks that a red row or member stop dropping its boot's numbers; it does not ask for this. Least change: the row's number stands where its judge passed and every boot it rode has one_clock() Ok, in the own call at this line; no set and no second pass. The check gains a boot whose clocks disagree with a passing row on it, whose number must be absent while span.late.us stays, and a mutation that drops the new clause must red it.
• tests/common/metal.rs:1029 — "every reading is still judged against the record whatever its owner's verdict" has no check at this level — I expect this patch to pass all 38: in own, Entry::Vacant(slot) => { slot.insert(..) } becomes Entry::Vacant(slot) if passed => { slot.insert(..) } with Entry::Vacant(_) => {} after it. Under it a name a failing owner measured first and a passing owner second is recorded off the second with no measured twice, and a failing owner's reading past its record prints nothing. Run it; the check it must red is metal_name_two_owners_measured_is_refused, given an arm where the first of the two owners fails and the name must still be absent.
• pull request body, "High-risk checks" — the row half of the rule has never been judged over a real readback — the before/after and the negative control both use boot:testcases, whose six numbers are all the boots' own, and the row made red (hda_tone) measures nothing. Every row-measured number lives on latencycase, and recorded T14 readbacks of that boot exist beside the one used. Owed, offline, at base and head: boot:latencycase over one such readback with the record's three row-measured rows and boot.latencycase.* removed, once as it came back and once with the tlb: bench line made to fail its judge. Expected at the head: the first arm re-records all six; the second records boot.latencycase.* and latency.p99_us and not tlb.*; the base's second arm records none. If no recorded readback of that boot is one the current harness reads, the body says so.

NOTE

• tests/common/metal.rs:1133 — a row that is the second to measure a name is printed PASS and counted in N passed on a run that is red for it; at the base a second row on the same boot failed by name. Fix before landing or say in the body that the count excludes it.
• pull request body, "One name measured by two owners" — "it now also covers two rows measuring one name on one boot": the check plants the two rows on two boots. True of the code (after the drain both cases are one path, and m7 covers the drain), not of what the check exercises.
• Off this branch, for the orchestrator to file as kind: tooling: src/licence.rs:1234 re-locks the std workspace into a scratch lock on every run with neither --locked nor --offline, so the licences of what ships asks the registry each time; host reds without the network, and what it judges moves with what the registry serves that day. No issue in the tree names it.

What the brief asked to be said

Per kind of boot-level red, may a passing row's number stand, and where the head draws the line. The head draws one line: no finding of the boot's own touches a row's number; only a refused readback does, by judging no row.

boot-level red	a passing row's number	head
readback refused: the loop's verdict, a log missing parts	none is measured; the judge does not run	right
no Boot: complete, or no panel census where one is owed	may stand: it says nothing of a number read off its own line	right
log_reached_the_stick: nothing made the file whole, or no sealed tail	may stand today: each of the three is read off one line that is present, and a cut tail removes lines, it alters none. A number summed or maximised over the log would not stand	right for today's rows
stop_completed: the stop gave up, or an operation left open	may stand: after every row ended	right
deadline_on_time, lockup_on_time	may stand: read at the boot's end	right, and span.late.us in the check pins it
one_clock	may not	wrong: the first BLOCKER

m3 as written fails every row number on any boot red; the rule wanted is m3 for one_clock alone.

Verdicts unchanged. With the clock stamps and build times stripped, r1-base-judge-metal3 and r1-head-judge-metal3 differ in the one summary line; both end 23 passed, 0 failed, 2 boot(s), exit 0. r1-redrow-head and r1-redrow-base both end 22 passed, 1 failed, exit 1, with the same FAIL hda_tone; the head's record diff holds the three boot.testcases.* rows at this boot's readings (1135, 2499, 13022) and the base's record diff is byte-identical to the removal patch. The two --list outputs name the same 25 boots and jobs.

Mutations. All nine logs end exit 101 at the checks the table names, none a build error. Claims with no mutation: the second BLOCKER's. A boot's own red reddening the run with no rider is held by metal_cleared_page_owes_no_panel. red = true on a refused readback has no observable of its own, in the checks or in a run: every batched boot has a rider, and the rider reds.

The issue. Deleted; its exit is met for a red row and a red member, and exceeded for a boot's own red as the first BLOCKER says. Its rule is the doc comment of judge_readbacks, citing nothing. git grep at the head finds the slug nowhere, by path or bare, nor the old rule's wording or the three old check names. No fixture enters the tree: the diff adds no file, and no added line carries an identifier.

Machinery. own's twice cannot be true on the boots' pass (boot.<label>.<field> is unique per label and nothing is owned yet); harmless. No simpler shape that keeps measured's signature.

Evidence. checks 38 passed exit 0, lib 340 passed 15 ignored exit 0, clippy 24 invocations exit 0, build-only exit 0, both lists exit 0, host-2 78 step(s), all green exit 0, all at 7cc209f13. The first host: 1 of 78 step(s) red, the one being the licences of what ships, whose cargo metadata over the std workspace could not resolve the registry's host name after twelve tries. That is the whole of the red. Both host logs carry the same 67 ... FAILED lines, which are the suites' own negative arms. Not a defect of this branch: it touches nothing that step reads.

Landing. The pull request is a draft, so host, toolchain and guest read SKIPPED: none of them is a verdict. At the head that lands, the body owes cargo run -- --ci host exit 0 again, since the head moves. The orchestrator may then land on the merge queue's host and guest / suite concluding success, not skipped, on the queue's own commit; no rebase is owed, main's four commits since the base touch nothing the judge reads. No local guest run is owed: no guest test reaches judge_readbacks, and the suite's build is what proves the harness still compiles into it. No T14 boot is owed: the change is a function of readback files, and base and head stage the same boots; what is owed is the offline reading in the third BLOCKER.

SEND BACK

[Japabu]

Round 2, answering the round-1 review. Head 71afd05ef, which carries main at 9cf2c4e5c. Gates and the readback table are in the body.

BLOCKERs

1. A row's number off a boot whose clocks disagree — fixed as the review's least change, on the orchestrator's ruling: in the row's own call the number stands where the judge passed and every boot the row rode has one_clock() Ok. No set, no second pass. The comment at the site says what would widen it: a number summed or maximised over the log. metal_number_fails_with_its_owner_alone gains the boot skewed (the supervisor's line stamped 10 ms before the spawn it reports) with a passing row on it: span.skewed.us and boot.skewed.* are absent, span.late.us stays. m9 drops the clause and reds that check, exit 101. m3 is now the clause widened to a late deadline, and reds the same check through span.late.us, exit 101.
2. The reviewer's patch — run as m10. It was not run against the round-1 checks, which had no failing first owner. metal_name_two_owners_measured_is_refused now runs twice, with the first owner passing and with it failing, and the name must be absent both times. m10 reds it, exit 101.
3. The row half over a real readback — done offline, base and head, over the newest recorded T14 readback of latencycase, which the current harness reads. Six arms in the body's table. As it came back, head and base both re-record all six rows. With the tlb: bench line failing its judge, the head records boot.latencycase.* and latency.p99_us and no tlb.*; the base records none. A third pair, the same readback with its clocks made to disagree: head and base both record none, and both exit 1. No T14 boot is owed.

NOTEs

• A second owner printed PASS — fixed: own runs before the verdict is printed, and a row whose reading was the second is neither printed PASS nor counted as passed. Its line is own's FAIL <name> is measured twice, and <row> is the second. No check reads the printed count.
• "Two rows on one boot" — the body now says the check plants the rows on two boots and that the one-boot case is read from the code.
• The licence step — filed as issues/the-licence-step-re-locks-std-against-the-registry-on-every-run.md, kind: tooling, a record only.

Mutations at 71afd05ef

Every round-1 patch touches tests/common/metal.rs, which changed, so all were regenerated against this head and rerun, with m9 and m10 new. Each: git apply --check, applied, cargo test --locked --test toyos-checks -- metal_, reversed; git status --porcelain --ignore-submodules=none empty after the last.

patch	exit	checks red
m0-whole-change-reverted	101	metal_number_fails_with_its_owner_alone, metal_failing_shared_member_fails_itself_alone, metal_name_two_owners_measured_is_refused
m1-a-red-rows-number-is-recorded	101	metal_number_fails_with_its_owner_alone
m2-a-red-boots-number-is-recorded	101	metal_number_fails_with_its_owner_alone, metal_cleared_page_owes_no_panel
m3-a-late-deadline-fails-its-rows-numbers	101	metal_number_fails_with_its_owner_alone
m4-a-red-member-is-not-red	101	metal_failing_shared_member_fails_itself_alone
m5-a-name-measured-twice-is-recorded	101	metal_name_two_owners_measured_is_refused
m6-a-name-measured-twice-is-not-red	101	metal_name_two_owners_measured_is_refused
m7-taken-takes-nothing	101	metal_name_two_owners_measured_is_refused, metal_reading_past_its_record_fails_and_moves_nothing, metal_run_under_another_bios_fails_and_records_nothing, metal_number_fails_with_its_owner_alone
m8-a-red-row-is-not-red	101	metal_number_fails_with_its_owner_alone
m9-a-row-number-stands-on-a-boot-whose-clocks-disagree	101	metal_number_fails_with_its_owner_alone
m10-a-failing-owners-reading-is-not-entered	101	metal_name_two_owners_measured_is_refused

m0-whole-change-reverted.patch

diff --git a/src/metaltimings.rs b/src/metaltimings.rs
index e22a7cf53..de930057a 100644
--- a/src/metaltimings.rs
+++ b/src/metaltimings.rs
@@ -4,9 +4,9 @@
 //! One file per machine under [`DIR`], named for its SMBIOS vendor and product,
 //! written by a run and committed by whoever ran it. A run on a machine with no
 //! record is recorded and not judged; a name the record lacks is added and not
-//! judged, and only where its owner passed, the boot or the row that measured
-//! it; a recorded value is never moved by a run, so a slow run cannot become
-//! the baseline the next is judged by. A run under a BIOS other than the record's is judged against it,
+//! judged, and only off a boot with no failure of its own; a recorded value is
+//! never moved by a run, so a slow run cannot become the baseline the next is
+//! judged by. A run under a BIOS other than the record's is judged against it,
 //! fails naming both, and records nothing. Deleting a row is how a number is
 //! re-recorded, and deleting the file is how a machine is, firmware and all.
 //!
@@ -136,8 +136,8 @@ enum Unread {
     Refused(String),
 }
 
-/// One number a run measured, and whether its owner passed: every reading is
-/// judged, and only a passing owner's becomes a record.
+/// One number a run measured, and whether the boot that measured it passed:
+/// every reading is judged, and only a passing boot's becomes a record.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct Reading {
     pub value: u64,
@@ -386,9 +386,9 @@ mod tests {
         );
     }
 
-    /// **A failed owner's numbers are judged and never become a baseline.**
+    /// **A failed boot's numbers are judged and never become a baseline.**
     #[test]
-    fn a_failing_owners_reading_is_judged_and_not_recorded() {
+    fn a_failing_boots_reading_is_judged_and_not_recorded() {
         let machine = t14(BIOS);
         let record = recorded(&machine, &[("boot.a.complete_ms", 1000)]);
         let failed = |value| Reading { value, passed: false };
diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 0c440f498..21190c3bc 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -235,8 +235,7 @@ pub struct Readback {
     pub stick_secs: u64,
     /// The machine the loop read before the flash.
     pub machine: Result<Machine, String>,
-    /// What was measured on this boot and no owner has taken yet
-    /// ([`Self::taken`]).
+    /// What this boot's judges measured, for the machine's record to judge.
     numbers: RefCell<BTreeMap<String, u64>>,
 }
 
@@ -463,11 +462,9 @@ impl Readback {
             })
     }
 
-    /// One number measured on this boot. It is its measurer's, the row whose
-    /// judge called this or the boot itself for what [`judge_readbacks`] reads
-    /// off every boot, and is judged against this machine's record once every
-    /// judge has spoken. A second value under one name is refused: which of
-    /// the two a record kept would be nobody's reading.
+    /// One number this boot measured, judged by [`run`] against this machine's
+    /// record once every judge has spoken. A second value under one name is
+    /// refused: which of the two a record kept would be nobody's reading.
     pub fn measured(&self, name: &str, value: u64) -> Result<(), String> {
         match self.numbers.borrow_mut().entry(name.to_string()) {
             Entry::Vacant(slot) => {
@@ -482,11 +479,6 @@ impl Readback {
         }
     }
 
-    /// What was measured on this boot since this was last asked.
-    fn taken(&self) -> BTreeMap<String, u64> {
-        std::mem::take(&mut self.numbers.borrow_mut())
-    }
-
     /// The job ran and the kernel recorded it exiting cleanly.
     pub fn job_passed(&self, binary: &str) -> Result<(), String> {
         match self.exit_code(binary)? {
@@ -1013,42 +1005,10 @@ pub fn run(
     }
 }
 
-/// What `backs` measured since they were last asked becomes one owner's: judged
-/// against the record whatever the owner's verdict, and a new row of it only
-/// where the owner `passed`. A name a second owner measures is judged on the
-/// first reading and recorded off neither; answers whether one was.
-fn own(
-    measured: &mut BTreeMap<String, Reading>,
-    owner: &str,
-    passed: bool,
-    backs: &[&Readback],
-) -> bool {
-    let mut twice = false;
-    for (name, value) in backs.iter().flat_map(|back| back.taken()) {
-        match measured.entry(name) {
-            Entry::Vacant(slot) => {
-                slot.insert(Reading { value, passed });
-            }
-            Entry::Occupied(mut first) => {
-                eprintln!("  FAIL {} is measured twice, and {owner} is the second", first.key());
-                first.get_mut().passed = false;
-                twice = true;
-            }
-        }
-    }
-    twice
-}
-
 /// Every verdict a run's readbacks carry, and this machine's record judged by
-/// them: one function of the readbacks, whether the loop wrote them a moment
-/// ago or a run long past did. Answers whether anything was red.
-///
-/// **A number is its owner's, and fails with its owner alone.** What a boot
-/// reads off itself is the boot's, and stands or falls with the boot's own
-/// checks; what a row's judge measured is the row's, and stands or falls with
-/// that judge, and with the clocks of every boot it rode agreeing
-/// ([`Readback::one_clock`]). Neither is moved by another row or a shared
-/// member riding the same boot.
+/// them and added to off the boots that passed: one function of the readbacks,
+/// whether the loop wrote them a moment ago or a run long past did. Answers
+/// whether anything was red.
 pub fn judge_readbacks(
     root: &Path,
     readbacks: &BTreeMap<String, Result<Readback, String>>,
@@ -1056,13 +1016,15 @@ pub fn judge_readbacks(
     shared: &[SharedBoot],
 ) -> bool {
     let mut red = false;
-    let mut measured: BTreeMap<String, Reading> = BTreeMap::new();
+    // **A boot with any failure of its own adds no row**, whether the loop,
+    // the boot's own checks, or a test or member riding it failed.
+    let mut failed: BTreeSet<&str> = BTreeSet::new();
     eprintln!("\n[metal] the boots");
     for (label, back) in readbacks {
         let back = match back {
             Err(why) => {
                 eprintln!("  FAIL {label}: {why}");
-                red = true;
+                failed.insert(label);
                 continue;
             }
             Ok(back) => back,
@@ -1110,9 +1072,9 @@ pub fn judge_readbacks(
         for why in &findings {
             eprintln!("    FAIL {why}");
         }
-        let whole = findings.is_empty();
-        let twice = own(&mut measured, &format!("the boot {label}"), whole, &[back]);
-        red |= twice || !whole;
+        if !findings.is_empty() {
+            failed.insert(label);
+        }
     }
 
     eprintln!("\n[metal] the tests");
@@ -1131,22 +1093,16 @@ pub fn judge_readbacks(
             Some(why) => Err(why),
             None => judge(&owed),
         };
-        // A clock at another rate scales every duration a row measures. No
-        // other finding of a boot's own touches a row's number while each is
-        // read off one line that is present: one summed or maximised over the
-        // log would fall with a log that is not whole too.
-        let clocked = owed.iter().all(|back| back.one_clock().is_ok());
-        let twice = own(&mut measured, name, verdict.is_ok() && clocked, &owed);
-        match &verdict {
-            // `own` said so, by name.
-            Ok(()) if twice => {}
+        match verdict {
             Ok(()) => {
                 eprintln!("  PASS {name}");
                 passed += 1;
             }
-            Err(why) => eprintln!("  FAIL {name}: {why}"),
+            Err(why) => {
+                eprintln!("  FAIL {name}: {why}");
+                failed.extend(arms.iter().map(|arm| arm.boot));
+            }
         }
-        red |= twice || verdict.is_err();
     }
     let mut members = 0usize;
     for boot in shared {
@@ -1168,7 +1124,7 @@ pub fn judge_readbacks(
                 // bury the four that matter.
                 Err(why) => {
                     eprintln!("  FAIL {job}: {}", why.lines().next().unwrap_or(&why));
-                    red = true;
+                    failed.insert(&boot.boot);
                 }
             }
         }
@@ -1179,8 +1135,27 @@ pub fn judge_readbacks(
             }
         }
     }
+    red |= !failed.is_empty();
 
     eprintln!("\n[metal] the timings");
+    let mut measured: BTreeMap<String, Reading> = BTreeMap::new();
+    for (label, back) in readbacks {
+        let Ok(back) = back else { continue };
+        let passed = !failed.contains(label.as_str());
+        for (name, &value) in back.numbers.borrow().iter() {
+            match measured.entry(name.clone()) {
+                Entry::Vacant(slot) => {
+                    slot.insert(Reading { value, passed });
+                }
+                // Judged on the first, and recorded off neither.
+                Entry::Occupied(mut first) => {
+                    eprintln!("  FAIL {name} is measured by two boots, and {label} is the second");
+                    first.get_mut().passed = false;
+                    red = true;
+                }
+            }
+        }
+    }
     let machine = one_machine(readbacks);
     let record =
         machine.as_ref().map_err(Clone::clone).and_then(|machine| Record::load(root, machine));
@@ -1203,7 +1178,7 @@ pub fn judge_readbacks(
                 );
             }
             eprintln!(
-                "  {} number(s) on {} {}, BIOS {}; {} past its record, {} whose owner failed",
+                "  {} number(s) on {} {}, BIOS {}; {} past its record, {} off a boot that failed",
                 measured.len(),
                 machine.vendor,
                 machine.product,

m1-a-red-rows-number-is-recorded.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 0c440f498..43bf08b70 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -1136,7 +1136,7 @@ pub fn judge_readbacks(
         // read off one line that is present: one summed or maximised over the
         // log would fall with a log that is not whole too.
         let clocked = owed.iter().all(|back| back.one_clock().is_ok());
-        let twice = own(&mut measured, name, verdict.is_ok() && clocked, &owed);
+        let twice = own(&mut measured, name, clocked, &owed);
         match &verdict {
             // `own` said so, by name.
             Ok(()) if twice => {}

m2-a-red-boots-number-is-recorded.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 0c440f498..6a1be59c5 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -1111,7 +1111,7 @@ pub fn judge_readbacks(
             eprintln!("    FAIL {why}");
         }
         let whole = findings.is_empty();
-        let twice = own(&mut measured, &format!("the boot {label}"), whole, &[back]);
+        let twice = own(&mut measured, &format!("the boot {label}"), true, &[back]);
         red |= twice || !whole;
     }
 

m3-a-late-deadline-fails-its-rows-numbers.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 0c440f498..ce6b0d843 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -1135,7 +1135,7 @@ pub fn judge_readbacks(
         // other finding of a boot's own touches a row's number while each is
         // read off one line that is present: one summed or maximised over the
         // log would fall with a log that is not whole too.
-        let clocked = owed.iter().all(|back| back.one_clock().is_ok());
+        let clocked = owed.iter().all(|back| back.one_clock().is_ok() && back.deadline_on_time().is_ok());
         let twice = own(&mut measured, name, verdict.is_ok() && clocked, &owed);
         match &verdict {
             // `own` said so, by name.

m4-a-red-member-is-not-red.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 0c440f498..5eabfcffc 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -1168,7 +1168,6 @@ pub fn judge_readbacks(
                 // bury the four that matter.
                 Err(why) => {
                     eprintln!("  FAIL {job}: {}", why.lines().next().unwrap_or(&why));
-                    red = true;
                 }
             }
         }

m5-a-name-measured-twice-is-recorded.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 0c440f498..6d18eb1ce 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -1029,9 +1029,8 @@ fn own(
             Entry::Vacant(slot) => {
                 slot.insert(Reading { value, passed });
             }
-            Entry::Occupied(mut first) => {
+            Entry::Occupied(first) => {
                 eprintln!("  FAIL {} is measured twice, and {owner} is the second", first.key());
-                first.get_mut().passed = false;
                 twice = true;
             }
         }

m6-a-name-measured-twice-is-not-red.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 0c440f498..4bcead8c4 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -1023,7 +1023,7 @@ fn own(
     passed: bool,
     backs: &[&Readback],
 ) -> bool {
-    let mut twice = false;
+    let twice = false;
     for (name, value) in backs.iter().flat_map(|back| back.taken()) {
         match measured.entry(name) {
             Entry::Vacant(slot) => {
@@ -1032,7 +1032,6 @@ fn own(
             Entry::Occupied(mut first) => {
                 eprintln!("  FAIL {} is measured twice, and {owner} is the second", first.key());
                 first.get_mut().passed = false;
-                twice = true;
             }
         }
     }

m7-taken-takes-nothing.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 0c440f498..c8be471de 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -484,7 +484,7 @@ impl Readback {
 
     /// What was measured on this boot since this was last asked.
     fn taken(&self) -> BTreeMap<String, u64> {
-        std::mem::take(&mut self.numbers.borrow_mut())
+        self.numbers.borrow().clone()
     }
 
     /// The job ran and the kernel recorded it exiting cleanly.

m8-a-red-row-is-not-red.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 0c440f498..aa0ff267e 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -1146,7 +1146,7 @@ pub fn judge_readbacks(
             }
             Err(why) => eprintln!("  FAIL {name}: {why}"),
         }
-        red |= twice || verdict.is_err();
+        red |= twice;
     }
     let mut members = 0usize;
     for boot in shared {

m9-a-row-number-stands-on-a-boot-whose-clocks-disagree.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 0c440f498..bad0d6f22 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -1135,7 +1135,7 @@ pub fn judge_readbacks(
         // other finding of a boot's own touches a row's number while each is
         // read off one line that is present: one summed or maximised over the
         // log would fall with a log that is not whole too.
-        let clocked = owed.iter().all(|back| back.one_clock().is_ok());
+        let clocked = true;
         let twice = own(&mut measured, name, verdict.is_ok() && clocked, &owed);
         match &verdict {
             // `own` said so, by name.

m10-a-failing-owners-reading-is-not-entered.patch

diff --git a/tests/common/metal.rs b/tests/common/metal.rs
index 0c440f498..075d286e3 100644
--- a/tests/common/metal.rs
+++ b/tests/common/metal.rs
@@ -1026,9 +1026,10 @@ fn own(
     let mut twice = false;
     for (name, value) in backs.iter().flat_map(|back| back.taken()) {
         match measured.entry(name) {
-            Entry::Vacant(slot) => {
+            Entry::Vacant(slot) if passed => {
                 slot.insert(Reading { value, passed });
             }
+            Entry::Vacant(_) => {}
             Entry::Occupied(mut first) => {
                 eprintln!("  FAIL {} is measured twice, and {owner} is the second", first.key());
                 first.get_mut().passed = false;

[Japabu]

Review, round 2, of 71afd05ef against origin/main at 9cf2c4e5c (the merge base: the branch carries it). Judged: git diff 7cc209f13 71afd05ef less the merge 91feb529a, which is one commit, 71afd05ef, over tests/common/metal.rs (+11 −3), tests/checks/metal.rs (+32 −11) and one new issue (+28). The merge brought nothing the judge reads: of the harness, the checks, src/metaltimings.rs and the record, it touches tests/common/compile.rs alone. Read with the r2-* logs, each by its own EXIT= line.

Net lines, git diff --shortstat origin/main...71afd05ef: 6 files, +181 −99. Harness and src/metaltimings.rs +72 −47, checks +81 −29, the closed issue −23, the filed one +28. Round 2's growth in the harness is the clause, its comment and the twice arm; accepted.

Round 1's BLOCKERs

1. A row's number off a boot whose clocks disagree: CLOSED. tests/common/metal.rs:1138 is the least change round 1 named: one all over the boots the row rode, joined to the judge's verdict in the own call, no set and no second pass. The comment above it is the refusal reason at a surprising decision and says what would widen it. The check's skewed boot asserts one_clock() is Err before it judges, so a planted line that stopped matching reds there and not silently. m9 (clause dropped): exit 101, metal_number_fails_with_its_owner_alone at tests/checks/metal.rs:235, the record holding span.skewed.us that the check refuses. m3 (clause widened to a late deadline): exit 101 at the same assertion, the record lacking span.late.us. The two together pin the line on both sides: the clocks, and nothing wider.
2. A failing owner's reading not entered: CLOSED. m10 is the patch round 1 wrote, unchanged: exit 101, metal_name_two_owners_measured_is_refused at tests/checks/metal.rs:309. Its log carries both passes of the loop. The first, with the first owner passing, is round 1's check as it stood, and it runs through under the patch: PASS one, FAIL latency.p99_us is measured twice, and two is the second, 6 numbers recorded. The second, with the first owner failing, prints FAIL one: a planted failure and PASS two with no measured twice, and records 7, latency.p99_us among them; that is the panic. So the one log shows what round 1 expected (the patch survives the old check, and the other 18 metal_ checks) and what it asked for (the new arm reds). Not running it at 7cc209f13 leaves nothing unshown: no check outside metal_ reaches own.
3. The row half over a real readback: CLOSED. Six arms over copies of one T14 readback of latencycase; the two altered copies differ from the one as it came back in one line of the kernel log each (the tlb: bench line's min=, and the supervisor's stamp on its started logkeeper line), and in nothing else the harness reads. The base arm is the head with m0 applied, and m0 applied to the head's two files gives origin/main's byte for byte (checked in a scratch copy). Read from the logs and the record diffs:

readback	harness	summary line	exit	the record after
as it came back	head	2 passed, 0 failed; 0 whose owner failed	0	all six rows back: 1139, 2478, 13706; 1687, 2331; 16
as it came back	base	2 passed, 0 failed; 0 off a boot that failed	0	the same six, the diff byte-identical to the head's
bench line failing	head	1 passed, 1 failed; 4 numbers, 0 whose owner failed	1	boot.latencycase.* and latency.p99_us; no tlb.*
bench line failing	base	1 passed, 1 failed; 4 off a boot that failed	1	none: the diff is the removal patch
clocks made to disagree	head	2 passed, 0 failed, the boot's own FAIL for its clocks; 6 whose owner failed	1	none: the removal patch
clocks made to disagree	base	the same; 6 off a boot that failed	1	none: the removal patch

These are the readings round 1 asked for, with the third pair beyond it. The script restores the tree after each arm, status after arms: [], and the record is not in the branch's diff.

Round 1's NOTEs

• A second owner printed PASS: closed. own runs before the verdict is printed and Ok(()) if twice prints and counts nothing; m10's first pass shows it on an unmutated path (PASS one, the measured twice line, 1 passed, 1 failed, 2 boot(s)). That no check reads the printed count is right, not a gap: the three arms are read from the diff, and the red verdict behind them is m6's.
• "Two rows on one boot": closed; the body now says what the check plants and what is read from the code.
• The licence step: filed. issues/the-licence-step-re-locks-std-against-the-registry-on-every-run.md is true of the tree: src/licence.rs:1211 gives --locked to every workspace but std's, and the std call at :1232 gets a scratch lockfile and neither --locked nor --offline; the module's own header already says two runs at one head can resolve std's graph differently. status: open, kind: tooling, an owner that exists, an exit a check can fail. Of its evidence I read one of the two red runs it names, this branch's in round 1.

BLOCKER

None.

NOTE

None.

Evidence at 71afd05ef

r2-run.head and r2-gates.done both name the head, the tree clean after. checks: 38 passed, exit 0. lib: 340 passed, 15 ignored, exit 0. list: 64 registration(s) and 229 shared member(s) over 25 boot(s), exit 0. clippy: 24 invocations clean, exit 0. build-only: exit 0. host: Host: 78 step(s), all green, exit 0, with the same 67 ... FAILED lines of the suites' own negative arms as round 1. m0 to m10: eleven logs, each EXIT=101, each a test failure at the checks the body's table names and none a build error; status after: [].

No guest test is reached and none is owed. No T14 boot is owed: the change is a function of readback files and stages the same 25 boots.

Landing

The three checks on the pull request read SKIPPED because it is a draft; none of them is a verdict. The body's cargo run -- --ci host is at the head that lands, so nothing more is owed locally unless the head moves. Marked ready, host and guest / suite must each conclude success, not skipped, on this head, and again on the merge queue's own commit. host is the gate that reads this change: the 38 checks and the lib tests run inside it. guest / suite reaches none of it; what it shows is that the harness still compiles into the suite and the suite is green under it. The orchestrator may land on reading those two as success. A red in the licences of what ships alone, with the registry unreachable, is the filed issue's and is re-run, not waived.

LAND

[Japabu]

CI at 71afd05ef, read from each job's own log (the orchestrator). host: [ci] Host: 79 step(s), all green, with checks::metal_number_fails_with_its_owner_alone and checks::metal_name_two_owners_measured_is_refused each ok by name. guest / suite: test result: ok. 37 passed, 37 total, [ci] Guest: 5 step(s), all green, no FAIL line. git merge-tree against main at 425f3eb9e exits 0 with no conflict.