What the governance cut left untrue: four issue files and four test caveats (#478)

The governance cut (#475) deleted the price gate, `EXPECTED_FAILURES`
and `UNMEASURED`. This removes what it left untrue:

- Four `issues/build` files wholly about the deleted gate are deleted:
the timer-anchored tier, `i8042_health` on the ten-second line, the
committed profile against the nightly, and `xhci_full_speed_device`'s
jump. The three sentences citing them go too: two in `defect-events.md`
and one in the T14 unattended-boot issue. A search for each bare name
finds nothing.
- `tests/CLAUDE.md`: the pointer line names `QUARANTINE` and the fast
tier's line. The known-red caveat names `--known-red` and a row's
`says`. The two-CI-cycle caveat (`UNMEASURED`, `FAST_COMMIT_MS`) is
deleted. "Only a hosted run renders the tier verdict" is gone, since the
verdict is now a warning.

Documents only. `cargo test -p toyos-build --lib` exit 0 (267 passed, 1
ignored), which includes the gate that every quarantine row's issue file
exists.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_014iqcj4jDKpaiDX8B7CMvmK

Author: Japabu

issues/build/a-timer-anchored-names-tier-is-decided-by-its-price.md

@@ -145,9 +145,6 @@ ledger was written.
   soundd's stats line and a mixer counter, nothing i8042 touches.
   `cargo run -- --known-red i8042_health` answered `NOT ON THE LIST`, so every
   author who met it re-derived that from scratch.
-  `issues/build/i8042-health-sits-on-the-ten-second-line.md` (on #197's branch)
-  is the sighting; the fix is the margin rule below, which relegates it as an
-  honest `Why::Cost` row at its committed 9,509 ms.
 
 - **The one-sample tier rule** — origin: pre-existing, and it is the root cause
   of both entries above. discoverer: automated gate — the same `durations` gate,
@@ -167,11 +164,7 @@ ledger was written.
   `Why::Cost` row. Three names relegated with it (`i8042_health` 9,509 ms,
   `double_panic_names_the_fault` 9,120 ms, `console_line_atomicity` 8,925 ms);
   the two returns of the same morning were re-checked against the new line and
-  keep their Fast (`idle_stack_guard` 5,049 ms, `dump_nmi_probe` 6,284 ms). What
-  the fix does *not* cover is
-  `issues/build/xhci-full-speed-device-jumped-47-percent-over-its-commitment.md`:
-  that name had margin and jumped anyway, which the rule's own derivation says
-  is a finding about the test rather than a straddle.
+  keep their Fast (`idle_stack_guard` 5,049 ms, `dump_nmi_probe` 6,284 ms).
 
 ## 2026-08-22
 

issues/build/defect-events.md

@@ -108,11 +108,6 @@ What is left to build:
   the surviving file was 228 bytes and the boot's own watchdog read-back was
   gone. **Exit**: a chained run whose stick carries every pass, each named by
   the pass that wrote it.
-- **A timer-anchored name's tier is decided by its price**, not by the
-  classification `FAST_CEILING_MS` states, so two of this track's names sit Fast
-  on a verdict a slower machine moves —
-  `issues/build/a-timer-anchored-names-tier-is-decided-by-its-price.md`, whose
-  exit is the owner's answer on which of the two the boundary is.
 - **The measurements owed on hardware are this loop's jobs**, by record:
   `issues/kernel/the-split-window-tlb-cost-is-unpriced.md`,
   `issues/kernel/ap-control-registers-inherit-init.md`,

issues/build/i8042-health-sits-on-the-ten-second-line.md

@@ -1,6 +1,6 @@
 # Tests
 
-The mechanics live where the work is: profiles and shapes in `tests/common/`, registration, tiers and `EXPECTED_FAILURES` in `tests/toyos.rs`, instruments and known reds in `src/redlist.rs`, the relegation record in `src/tiers.rs` — read those, not this file, for how the harness works.
+The mechanics live where the work is: profiles and shapes in `tests/common/`, registration and tiers in `tests/toyos.rs`, known reds in `src/redlist.rs`'s `QUARANTINE`, the fast tier's line in `src/tiers.rs` — read those, not this file, for how the harness works.
 
 ## Caveats that bite every agent
 
@@ -16,13 +16,12 @@ The mechanics live where the work is: profiles and shapes in `tests/common/`, re
 - **A boot's capture has two pieces** — `boot_log()` ends at the ready marker, `run_test`'s capture begins at `===TEST_START===`, and the lines between land in `TestResult::before`; a test reading a daemon's boot line appends it.
 - **A file's last close does not flush it synchronously** — a test that reads the backing device behind the kernel's back first lets `iod` drain; a spawn or `dlopen` of a just-closed file needs no drain (`Vfs::open_backing` settles the queue itself).
 - **Every guest this host boots is TCG** — anything vendor-dependent is gated only by CI's KVM shards, and TCG prices an uncontended atomic read-modify-write unlike hardware.
-- **CI's `guest` lane is two different machines** — hosted shards for pull requests, pushes and queue refs, the T14 for `workflow_dispatch` and non-`ci.yml` schedules — and a duration measured on one does not transfer: `tests/test-durations` is hosted, and only a hosted run renders the tier verdict.
+- **CI's `guest` lane is two different machines** — hosted shards for pull requests, pushes and queue refs, the T14 for `workflow_dispatch` and non-`ci.yml` schedules — and a duration measured on one does not transfer: `tests/test-durations` is hosted.
 - **The dev host's guests boot `-cpu qemu64`, which has no PCID** — every `INVPCID` path is dead locally, so a change gated on a CPUID feature is unverified by a green local suite.
 - **A liveness ceiling scales by two host facts** — boot-derived host speed *and* the guest's own `vcpus/cores` oversubscription. Widen a *liveness* guard for this, never a correctness bound.
 - **A wedge verdict needs both the budget spent and the guest gone quiet** — a healthy idle guest can be silent for minutes, and a guest still talking past its budget is slow, not stuck; only a far backstop stands behind a guest that keeps talking.
-- **A new registered name costs two CI cycles** — `UNMEASURED` buys one measured run and a re-tier buys a second; a name is Fast only under `FAST_COMMIT_MS`; a landing renders the price verdict only for the names it registered or re-tiered; a Rust guest test's registration is its file under `tests/toyos-rust-tests/src/bin/`.
 - **A measured bound is asserted against the derivation, never against the measurement** — a bound that has to be widened to pass is a finding. A test asserting a kernel `Budget` never expires asserts a bound the kernel does not promise; the red is only the outcome that is neither the answer nor the declared degradation.
-- **A test named as evidence may itself be declared expected-red** — check `EXPECTED_FAILURES` before quoting a test's name; and an entry's `says` list matches a *message*, not a cause, so read the capture, never the declaration.
+- **A test named as evidence may itself be quarantined** — ask `cargo run -- --known-red <name>` before quoting it; a row's `says` matches a *message*, not a cause, so read the capture, never the row.
 - **A crafted-input test asserts the harm before the return value, and never Debug-prints a refused value** — an unrefused one is as large as the input asked for.
 - **A stimulus sent through a channel that can silently lose it is verified before its effect is asserted** — QEMU's PS/2 queue drops the seventeenth byte, so typed input paces against the guest's report (`shell_type_once`); a guest's console reaches the host as whole lines only, so a partial line exists on no channel.
 - **A harness field that can be silently inert is this suite's worst defect class** — where two options can describe the same guest they refuse each other by name, and an image is asked what it is armed with.