A design follows what its hardware's manufacturers or the published state of the art back, and a bench verdict never blocks it

[Japabu]

The ruling

The owner's answers to round 1's two questions, as the orchestrator recorded them in comment 6125405603:

He chose "No: vendor practice wins", meaning: if the manufacturers and published practice say do it, we do it. Bench numbers are reported and never block. A slowdown we see is investigated, not used to reject.

He chose "Review on merits", meaning: it is reviewed on correctness and simplicity like any code. A speed claim is measured and reported but does not decide by itself, unless the design's only purpose is speed.

His answer on the metal timings ceiling, as the orchestrator recorded it in comment 6125787320:

He chose "Yes, keep the 2x guard": a doubling is treated as a probable bug, not a design verdict. It fails, and is fixed or investigated before landing. Normal variation never trips it.

How far that answer reaches, as the orchestrator ruled in comment 6125993566:

That reason holds on every bench whose record the ceiling judges, not only the T14. So the clause reads "a metal timing past twice its machine's record", at both sites.

What moves a design off its manufacturers' line is his ruling on #873, as the orchestrator recorded it in comment 6124769421:

if the global cache is still considered best practice then we should do it else if intel and amd go away from it we leave it. we listen to what the manufacturers and reports say.

What changed

Three role prompts carry the ruling: implementer.md where a design is chosen, reviewer.md where a design is sent back, and orchestrator.md where a brief or issue sets the condition a design lives by. One more place in the tree already decides whether a design lands on a bench number: the metal timings ceiling, tests/metal/src/timings.rs's ceiling. It judges every number the metal suite measures on any bench against that machine's own record, one record file per machine, and a number past twice its record reds the metal run (tests/common/metal.rs's judge_readbacks). The owner kept it as a bug guard. This branch does not change it. implementer.md and reviewer.md's Fit both say what it is.

Root CLAUDE.md is unchanged. No sentence there contradicts the ruling, and "Its test machines decide its feature set, never its design" already agrees with it. The rule that a design is never chosen because another OS does it that way stays: the ruling names the manufacturers and the published state of the art, not Linux.

.claude/agents/implementer.md, Measure, build, test. Four sentences follow the merits sentence, which is unchanged:

Where that hardware's manufacturers or the published state of the art back a design, the design follows and cites them, and leaves them only when they leave it. Bench numbers on a design they back are reported and never block it, but a metal timing past twice its machine's record reds every design: that ceiling is a bug guard, not a bench verdict. A slowdown on a design they back is investigated, not used to reject it. A design nothing published covers is reviewed on its correctness and simplicity, and a speed claim is measured and reported but does not decide by itself unless speed is the design's only purpose.

"That hardware" is the merits sentence's "modern hardware ToyOS targets", so its manufacturers are the makers of every device ToyOS drives as well as of its CPUs. The duty to follow is triggered by what they back, not by what their manuals document: a manual documents far more than its maker recommends. The ceiling's clause is Fit's, word for word. Round 3 had a colon before "bench numbers", and that colon is now a full stop, so the slowdown clause names "a design they back" instead of "it". The rest of the paragraph only reflows.

.claude/agents/reviewer.md, Fit. A BLOCKER joins the list that ends with the merits rule, and a sentence follows it:

…; where that hardware's manufacturers or the published state of the art back a design, one that does not follow and cite them, or leaves them while they still back it. Bench numbers on a design they back are reported and never send it back, but a metal timing past twice its machine's record reds every design: that ceiling is a bug guard, not a bench verdict. A design nothing published covers is reviewed on its correctness and simplicity, and a speed claim does not decide by itself unless speed is the design's only purpose.

Tests' "A timing row on the T14 is a test, and it goes red past its bound" is the same as main's and agrees with this. reviewer.md's Evidence is also the same as main's: the reading from the hardware is still owed where a change targets hardware, and Fit says how much it weighs.

.claude/agents/orchestrator.md, Design before building. The sentence on the one-boot measurement is the same as main's, and one sentence follows it:

No brief or issue makes a bench number the condition a design lives by where its hardware's manufacturers or the published state of the art back it, or where nothing published covers it and speed is not its only purpose.

Round 3's review

• BLOCKER, implementer.md:28's "never block it" with no exception for the ceiling: Fit's clause now follows "never block it" at implementer.md:28-30.
• BLOCKER, "a T14 timing past twice its record", when the ceiling judges every bench's record: both sites now read "a metal timing past twice its machine's record" (implementer.md:28-29, reviewer.md:60), as the orchestrator ruled in comment 6125993566. git grep -n "T14 timing" e9096f4d5 -- .claude CLAUDE.md '*/CLAUDE.md' exits 1 with no match.
• NOTE, What changed's "the T14's ceiling …, twice a number's record": What changed now says that the ceiling judges every metal bench's numbers against that machine's own record.

Round 2's three BLOCKERs and its NOTE were judged closed in round 3's review. Round 1's were judged closed or fixed in round 2's.

Gates

• cargo run -- --ci host at e9096f4d58186c3c8b3b684eb816222f9110f25b: EXIT=0, "Host: 73 step(s), all green". Log: https://github.com/ToyOSOrg/evidence/blob/31e19d9d303bb4f939982cc2b15f49f5487a2749/ci-host.log
• git merge-tree --write-tree origin/main e9096f4d5 exits 0.
• No guest test reaches this change: it touches only .claude/agents/*.md.

Unsure

• issues/toyos-uses-what-modern-hardware-offers-for-speed.md still says each design round is "judged by a kill condition fixed before the run", and that "a feature Linux has no counterpart for lands only if it beats ToyOS without it". Its stages' issues carry kill lines too. For a design that its manufacturers or the published state of the art back, both contradict the prompts. This branch edits no issue, so they stay until a brief takes them up.
• The ruling does not say what happens where the manufacturers or the published record disagree with each other, for example Intel against AMD. The prompts do not say either.
• The metal row wake_storm_cost (tests/toyos.rs:525-531) also reds on a bound read off the bench clock (large <= small * 5, tests/guest/rust-tests/src/bin/wake_storm_cost.rs:237-243). Its message calls a breach a claim that grows with the storm, which makes it a bug guard like the timings ceiling, not a speed verdict, so the ruling does not reach it.

🤖 Generated with Claude Code

https://claude.ai/code/session_015xhaydXCVRNscoccHYFUWy

[Japabu]

Round 1, head 58552a7be95fd9f7a3cc59034f8b8ebfe7a7f617.

Net lines (git diff --shortstat origin/main...58552a7be): 3 files, +15 −6, all in .claude/agents/. Production 0, tests 0.

Evidence: cargo run -- --ci host passes at this head. The body records EXIT=0. The linked ci-host.log at evidence fbd459f0 is 10026 lines and ends Host: 73 step(s), all green, and its commit message names 58552a7be95f…. No guest test reaches a change to .claude/agents/ only.

BLOCKER

• .claude/agents/reviewer.md:18, .claude/agents/implementer.md:29-30 — "regresses nothing" — The owner never gave this: neither passage the body quotes says it. It brings back a bench gate, on regression where the old one was on gain, and puts it in Evidence's list of BLOCKERs. It names no bound, so it holds the reading after the change to the reading before it. tests/CLAUDE.md:16 refuses a bound taken from a measurement, and on that rule noise on metal alone sends a branch back. The body's own Unsure names the before-and-after pair it can force on every hardware change. Delete "and regresses nothing" at both sites, or bring the owner's words for it.
• .claude/agents/implementer.md:29 — "its bench reading shows that it works" — This clause's subject is every design. A design no hardware decides now owes a bench reading, and so does every AArch64 design, which has no bench (root CLAUDE.md:3: AArch64 is tested under QEMU virt alone). reviewer.md:17-18 asks for a reading only "where the change targets hardware", so the two prompts now disagree on when one is owed, and the ruling asks for no reading at all. Delete "and its bench reading shows that it works and regresses nothing". implementer.md:35 and reviewer.md:17-18 already require the reading.
• .claude/agents/implementer.md:30, .claude/agents/reviewer.md:19, .claude/agents/orchestrator.md:22 — "a gain is reported, never gated" and "no brief or issue makes a bench gain the condition a design lives by" — These apply to every design, which is wider than the ruling. The owner put the manufacturers and the state of the art in place of our bench as the judge of a design. Where neither speaks (the branch's own "where they speak to it"), the branch leaves no judge, and it rules out the only one left. A mechanism whose only merit is speed could then land with no gain. That conflicts with root CLAUDE.md:24 ("code that does not earn its keep is deleted"), with reviewer.md:117-118 ("Production code that grows needs a reason you accept") and with orchestrator.md:19-20, whose roast weighs "its cost against what it saves". Limit all three to a design that its manufacturers or the published state of the art back, or put the unbacked case to the owner and write in his answer.

NOTE

• .claude/agents/implementer.md:28-29, .claude/agents/reviewer.md:60 — "says why, with the evidence, where it departs from them" — This names no kind of evidence, so our bench alone can justify departing from a documented design. That lets x86-64 kernel leaves are global under a declared CR4.PGE, and only a kernel-half change drops them #873's kill condition back in another way. The owner's words name what moves a design off the manufacturers' line: "if intel and amd go away from it we leave it. we listen to what the manufacturers and reports say". Name that, or put the case to him.
• .claude/agents/implementer.md:27-28 — the list of documents — It can be deleted: "what that hardware's manufacturers document" already says it. As written, it reads as the CPU vendors alone, but "the manufacturers of our hardware" also means the makers of every device ToyOS drives, and "Arm's" names no document.
• .claude/agents/orchestrator.md:21-23 — "it measures what is unknown" and "for a design follows its hardware's manufacturers and the published state of the art as implementer.md says" — Both can be deleted. The orchestrator acts only on the clause between them.
• PR body, Unsure — "That is the ruling's wording" — This is false: neither of the two passages the body quotes as the ruling contains "regresses nothing".

SEND BACK

[Japabu]

Owner's answers to round 1's questions, recorded by the orchestrator. He was asked two questions.

1. "Regresses nothing." He was told the orchestrator had added it and that he never said it, then asked: when a change follows vendor or published practice, should our bench still be able to block it if it measures slower? He chose "No: vendor practice wins", meaning: if the manufacturers and published practice say do it, we do it. Bench numbers are reported and never block. A slowdown we see is investigated, not used to reject.

2. A design no vendor document or published practice covers (for example our own DNS cache details, scheduler tuning or our own protocols). He chose "Review on merits", meaning: it is reviewed on correctness and simplicity like any code. A speed claim is measured and reported but does not decide by itself, unless the design's only purpose is speed.

So "regresses nothing" goes. The rule applies to a design that its manufacturers or the published state of the art back. The uncovered case is review on merits, with the speed-only exception as he chose it.

[Japabu]

Round 2, head 26fc45cd60cdf126cf35339be3bee0afe1a57052.

Net lines (git diff --shortstat origin/main...26fc45cd6): 3 files, +15 −3, all in .claude/agents/. Production 0, tests 0. git merge-tree --write-tree origin/main 26fc45cd6 exits 0, and main has not touched .claude/agents/ or CLAUDE.md since the merge base 528b9a6c2.

Evidence: cargo run -- --ci host passes at this head. The body records EXIT=0. The linked ci-host.log at evidence 1b24f1e8 is 8651 lines and ends Host: 73 step(s), all green, and its commit message names 26fc45cd60cd…. No guest test reaches a change to .claude/agents/ only.

Round 1's BLOCKERs

• "regresses nothing" — CLOSED. git grep -n -e "regresses nothing" -e "bench reading" -e "never gated" -e "bench gain" 26fc45cd6 -- .claude CLAUDE.md '*/CLAUDE.md' exits 1. git diff origin/main...26fc45cd6 has no hunk in reviewer.md's Evidence.
• "its bench reading shows that it works" — CLOSED. The same grep exits 1, and implementer.md:23-31 asks for no reading.
• "a gain is reported, never gated" applied to every design — CLOSED. All three sites are limited to a design the manufacturers or the published state of the art back: implementer.md:28, reviewer.md:59-60 and orchestrator.md:22-24. Answer 2 covers the case nothing published covers, at implementer.md:29-31 and reviewer.md:60-62.

BLOCKER

• .claude/agents/implementer.md:26-28, .claude/agents/reviewer.md:57-59 — "Where that hardware's manufacturers document a design or the published state of the art backs one, a design follows and cites them, and leaves them only when they leave it" — Here the duty to follow is triggered by what the manufacturers document. The owner ruled on what they back: "if the manufacturers and published practice say do it, we do it", and "if the global cache is still considered best practice". The orchestrator's summary of his answers, this PR's title, orchestrator.md:23-24 and both "never block" clauses all say "back". A manual documents far more than its maker backs: the SDM still documents MTRRs, segmentation and hardware task switching. Three results follow. The duty to follow, and reviewer.md's BLOCKER for not following, fire on documentation, where he ruled on recommendation. "leaves them only when they leave it" means a design may leave only once the manual stops describing it, which nothing he said supports. And a design the manufacturers document but do not back must be followed, yet its bench numbers may still block it, because the protection covers only "a design they back". Write "Where that hardware's manufacturers or the published state of the art back a design" at both sites.
• .claude/agents/reviewer.md:59-60, against .claude/agents/reviewer.md:131-132, CLAUDE.md:70 and tests/common/metal.rs:1270-1272 — "Bench numbers on a design they back are reported and never send it back" — The T14 already gates bench numbers. tests/metal/src/timings.rs:31-35 makes a red of any number the metal suite measures once it passes twice its record, and tests/common/metal.rs:1270-1272 sets red on it. reviewer.md:131-132 calls that row a test that "goes red past its bound", and root CLAUDE.md:70 makes a red test a defect, fixed or deleted. The owner was asked "should our bench still be able to block it if it measures slower?" and answered no. If a timing row counts as a bench number, Tests and root CLAUDE.md contradict the new Fit sentence on any backed design that doubles a recorded number. If it does not, the head states his ruling more narrowly than he gave it, and the row still blocks a backed design. At reviewer.md:131-132, say what a T14 row past its ceiling means for a design the manufacturers or the published state of the art back, as he ruled. Otherwise put the row to him and write in his answer.
• .claude/agents/orchestrator.md:22-24 — "No brief or issue makes a bench number the condition a design lives by where its hardware's manufacturers or the published state of the art back it" — This carries answer 1 alone. Answer 2 covers a design nothing published covers: "a speed claim is measured and reported but does not decide by itself, unless the design's only purpose is speed". When a brief or issue makes a bench number the condition a design lives by, a speed claim decides by itself. The orchestrator writes those conditions, and they end a design before any review: x86-64 kernel leaves are global under a declared CR4.PGE, and only a kernel-half change drops them #873's kill condition stopped its build until the owner overrode it. So implementer.md:29-31 and reviewer.md:60-62 never reach that case. At the one site that governs briefs and issues, the ruling is stated more narrowly than he gave it. Extend the sentence to "…back it, or where nothing published covers it and speed is not its only purpose."

NOTE

• PR body, "What changed" — "each at the place where a bench could decide whether a design lives" — This is false of the tree. The T14 timings ceiling (tests/metal/src/timings.rs:31-35, tests/common/metal.rs:1270-1272) is such a place, and none of the three edits reaches it. See BLOCKER 2.

SEND BACK

[Japabu]

Owner's answer to round 2's BLOCKER 2, recorded by the orchestrator. He was asked: "the T14 test suite already fails any measured time that gets more than 2x slower than its best recorded value (a guard that catches accidental bugs like something becoming 10x slower). For a change that follows vendor/published practice, should that 2x guard still fail the change?" He chose "Yes, keep the 2x guard": a doubling is treated as a probable bug, not a design verdict. It fails, and is fixed or investigated before landing. Normal variation never trips it.

So the timings ceiling stays a red on every design. The Fit sentence says that the ceiling is a bug guard, not a bench verdict on a backed design.

On BLOCKERs 1 and 3, the orchestrator rules them as the review names them:

• "back", not "document", at both sites;
• orchestrator.md's sentence covers answer 2 too.

[Japabu]

Round 3, head a6b52dde197e8928145136bdf57c2c3ff1d66e47.

Net lines (git diff --shortstat origin/main...a6b52dde1): 3 files, +16 −3, all in .claude/agents/. Production 0, tests 0. git merge-tree --write-tree origin/main a6b52dde1 exits 0. Since the merge base 528b9a6c2, main has changed only orchestrator.md:59-62 among the prompts (#880), and that is outside this diff's hunk.

Evidence: cargo run -- --ci host passes at this head. The body records EXIT=0. The linked ci-host.log at evidence 982cf54c is 8656 lines and ends Host: 73 step(s), all green, and its commit message names a6b52dde197e…. No guest test reaches a change that touches only .claude/agents/.

Round 2's BLOCKERs

• "document" where the owner ruled on "back": CLOSED. git grep -n -e "document a" -e "backs one" a6b52dde1 -- .claude/agents exits 1. implementer.md:26-27 and reviewer.md:57-58 both read "manufacturers or the published state of the art back a design".
• The T14 ceiling against "never send it back": CLOSED at the site that finding named. reviewer.md:59-61 now says "but a T14 timing past twice its record reds every design: that ceiling is a bug guard, not a bench verdict". That agrees with reviewer.md:132-133, root CLAUDE.md:70 and the owner's answer in comment 6125787320. The same contradiction remains at two sites that finding did not name: the first two BLOCKERs below.
• orchestrator.md carrying answer 1 alone: CLOSED. orchestrator.md:22-24 ends "…or where nothing published covers it and speed is not its only purpose."
• Round 2's NOTE, "each at the place where a bench could decide…": CLOSED. The sentence is gone, and What changed names the ceiling.

BLOCKER

• .claude/agents/implementer.md:28 — "bench numbers on a design they back are reported and never block it" — This sentence has no exception for the ceiling. The owner was asked whether the 2× guard should still fail a change that follows vendor or published practice, and he answered yes: "It fails, and is fixed or investigated before landing" (comment 6125787320). At the implementer's own site, then, the ruling is stated more broadly than he gave it. It also contradicts reviewer.md:59-61 in the same tree. Reading reviewer.md first does not settle the conflict, because both statements are unconditional. An implementer answers a BLOCKER by refuting it (implementer.md:110-112), and a red row on a backed design is the exact dispute the owner just settled. The body's Unsure names this gap. The orchestrator's ruling put the sentence in Fit, but it never ruled that the "never" here stands. Fix: after "never block it", add Fit's clause as the next finding corrects it. "a slowdown on it is investigated, not used to reject it" can stay as it is: the owner's "a probable bug, not a design verdict" agrees with it.
• .claude/agents/reviewer.md:60 — "a T14 timing past twice its record" — The guard the owner kept is timings::ceiling, which tests/metal/src/timings.rs:17 calls "the one rule". It applies to every metal bench's record, one file per machine (timings.rs:5). judge_readbacks reds the run on whatever bench --metal-host names (tests/common/metal.rs:1264-1272, tests/metal/src/testargs.rs:27). The tree runs the suite on the AMD bench (issues/a-metal-row-names-no-hardware-and-a-bench-without-it-reds.md:13-27). The loop boots no machine without a record (timings.rs:8-9), so the same ceiling judges that bench's numbers. Under this sentence, an AMD-bench reading past twice its record on a backed design is a bench number that "never send[s] it back". Yet the tree reds the run, and root CLAUDE.md:70 makes that red a defect. That is round 2's BLOCKER 2 again, on the other bench, and x86-64 kernel leaves are global under a declared CR4.PGE, and only a kernel-half change drops them #873, the case the ruling came from, was killed on an AMD-bench row. Whichever bench the owner meant, this head reds that case in the tree and clears it in Fit. Fix: write "a metal timing past twice its machine's record" here and in the implementer.md clause. If the orchestrator reads "keep the 2x guard" as covering the T14 alone, put the other bench to the owner and write in his answer.

NOTE

• PR body, What changed — "the T14's ceiling (tests/metal/src/timings.rs's ceiling, twice a number's record)" — This is false of the tree: the ceiling judges every bench's record, not only the T14's (timings.rs:5, :17).

SEND BACK

[Japabu]

The orchestrator, on round 3's second BLOCKER: the owner kept the 2× guard because "a doubling is treated as a probable bug, not a design verdict". That reason holds on every bench whose record the ceiling judges, not only the T14. So the clause reads "a metal timing past twice its machine's record", at both sites.

[Japabu]

Round 4, head e9096f4d58186c3c8b3b684eb816222f9110f25b.

Net lines (git diff --shortstat origin/main...e9096f4d5): 3 files, +20 −6, all in .claude/agents/. Production 0, tests 0. Since round 3's head (git diff --shortstat a6b52dde1 e9096f4d5): 2 files, +10 −9. main has since moved to c0cdddf4e (#882), which touches no prompt, and git merge-tree --write-tree origin/main e9096f4d5 exits 0.

Evidence: cargo run -- --ci host passes at this head. The body records EXIT=0. The linked ci-host.log at evidence 31e19d9d is 8642 lines and ends Host: 73 step(s), all green, and its commit message names e9096f4d5818…. No guest test reaches a change that touches only .claude/agents/.

Round 3's findings

• BLOCKER, implementer.md:28's "never block it" with no exception for the ceiling: CLOSED. implementer.md:28-30 now reads "…and never block it, but a metal timing past twice its machine's record reds every design: that ceiling is a bug guard, not a bench verdict". That is word for word reviewer.md:59-61, and it states the owner's answer in comment 6125787320 ("It fails … a probable bug, not a design verdict"). The slowdown sentence (implementer.md:30) changed only "it" to "a design they back".
• BLOCKER, "a T14 timing past twice its record": CLOSED. git grep -n "T14 timing" e9096f4d5 -- .claude CLAUDE.md '*/CLAUDE.md' exits 1. Both sites read "a metal timing past twice its machine's record", which is the orchestrator's wording in comment 6125993566. That matches the tree: one record per machine (tests/metal/src/timings.rs:5), a ceiling of twice the record (timings.rs:33-35), and a red on whatever machine ran (tests/common/metal.rs:1263-1273). Every number the suite records is a duration: boot.<label>.complete_ms, panel_max_us and panel_us (metal.rs:1137-1141), tlb.latencycase.p50_ns and p99_ns (tests/toyos.rs:778-779), and latency.p99_us (tests/toyos.rs:6272). So "metal timing" names exactly what the ceiling judges, no more and no less.
• NOTE, What changed's "the T14's ceiling": CLOSED. What changed now says the ceiling judges every number the metal suite measures on any bench against that machine's own record, which is what timings.rs:1-5 says.

Each new sentence holds the owner's ruling as recorded, and nothing beyond it:

• implementer.md:26-28 and reviewer.md:57-59 hold answer 1 and x86-64 kernel leaves are global under a declared CR4.PGE, and only a kernel-half change drops them #873.
• implementer.md:28-30 and reviewer.md:59-61 hold answer 1, the 2× answer and the orchestrator's every-bench reading.
• implementer.md:30 holds answer 1's slowdown clause.
• implementer.md:30-32 and reviewer.md:61-63 hold answer 2.
• orchestrator.md:22-24 is unchanged since round 3.

BLOCKER

None.

NOTE

• PR body, What changed: "Three sentences follow the merits sentence". This is false of the tree: four sentences follow it at implementer.md:26-32, and the body's own quotation shows all four.
• PR body, What changed: "One more place in the tree already decides whether a design lands on a bench number: the metal timings ceiling". The metal row wake_storm_cost (tests/toyos.rs:525-531) also reds on a bound read off the bench clock: large <= small * 5 in tests/guest/rust-tests/src/bin/wake_storm_cost.rs:237-243, which compares the cost at 16 and at 64 waiters. Its message calls a breach a claim that grows with the storm, which is a bug guard like the ceiling and not a speed verdict. The body should say that the ruling does not reach this row, or list it under Unsure for the owner.

LAND