Status
Milestone: N3 Memory met on 2026-10-18, decision 42 done; N4 Processes and scheduling
next (docs/ZERO_UNSAFE.md 0.8). Goal: zero unsafe in the kernel: sys/kernel/ and sys/abi/
are #![forbid(unsafe_code)] crates, sys/hal/ holds the only unsafe, bsd (the LZ tree)
is replaced subsystem by subsystem and deleted at N9 (decisions 20-24). Decision 44 (2026-10-18):
arm64 only until N10 homologates amd64; then N11 verification, N12 performance. Updated: 2026-10-19.
Done (N3, 0.10): hal::Pmap and both pmaps in hal; kernel::vm whole, sys/uvm/ deleted,
15 vm syscalls Native; one MP kernel (decision 40). Close: just jobs=3 ci 86/86,
just ci-full rc=0 (2248 s), just diff-openbsd 0 unexpected; hal 35 -> 100, bsd
10583 -> 10196; host tests 3229 -> 3775; just bench: fork and page fault slower.
- Decision 42 (N3’s performance; 43, the hot-path rule): host fork/exec -36..-49 % in 7 commits,
KASSERT kept c51cb2c2;
just ci86/86, diff-openbsd 0 unexpected; QEMU amd64 forkexit -12 %, forkexec -10 %, arm64 and the fault unchanged: the rest is outside kernel::vm (the pmaps), open.
Next (N4, 0.8): first the /insight heads-up on the split (2026-10-19; Gemini 4 + GPT Sol, verified
claim by claim; the timeout fork’s constraints are in JOURNAL); then 1. timeout, task, extent; 2. proc,
credentials, fork, exit, sysctl’s core; 3. descriptors and kqueue (0.6’s shapes); cpu, clock, trap, syscall entry into hal.
Generated by cargo xtask lz status --write against EmiBSD.LZ 3c62ede68802: 1170 modules (302 forbid of 857 non-core, 313 core), 594 function rows, 69 extras, 0 dropped.
Unsafe (cargo xtask unsafe-report): kernel 8636 blocks, 1099 fn, 811 impl, 30 trait, 341 other; tests 904 more; core 2416, legacy 8501, forbid 348 of 1219 modules; crates: kernel 0, abi 0, hal 100, bsd 10196 (1538 to move into hal), boot 621.
Blockers (inherited from LZ; not regressions): amd64 kernel stacks tight (~4.9 KB free under
softraid I/O); a diagnostic bsd does not compile (sys/dev/usb/ucom.rs:1247, N7, the user);
flakes: amd64 serial cut at QEMU exit, host tests no idleproc set on CPU0 (~1 in 80) and
dev::ic::pckbc (the timeout wheel left to an earlier test), EDK2 UhciDxe on arm64 (~1 in 5).
Open for the user: the pckbc test fix (an inherited file); MappedBytes waits for typed pages.