Validated Test Packages

Each package below has its own Go 1.23.1 _test.go suite converted to C#, built against the converted standard library, run under the Go-semantics test host, and differentially compared — verdict for verdict — against a clean go test -json baseline. A row appears only when every Test function’s result matches go test; a package that almost passes never appears, which is what keeps the denominator below honest. Example/Benchmark execution is deferred and never factors into a row. src/run-validated-sweep.ps1 re-validates every listed package on demand, reading its own roster straight from the table below — see Try it yourself to reproduce any row from a clone with one command.

A disclosure is a specific Go assertion the managed CLR provably cannot satisfy — not a skipped test, not a tolerance. Two classes exist:

Each disclosure is pinned by exact failure signature in a hand-owned, committed go2cs_test_disclosures.json. Any other failure is still a hard mismatch, and packages without a manifest compare strictly.

Phase 4 progress: 140 / 215 testable packages validated — 65.1%

15,186 matching test verdicts · 47 disclosed (updated 2026-08-14 — maintained as part of the Phase-4 validation campaign and grows as packages validate. Denominator: the 215 of 302 converted standard-library packages whose Go 1.23.1 sources define Test functions.)

Package Tests Disclosed What it exercises
archive/zip 98   ZIP archives end to end — central-directory and data-descriptor parsing over a corpus of real archives written by 7-Zip, InfoZip, WinRAR, WinZip and OS X, fs.FS traversal, UTF-8 vs CP-437 name/comment detection, the CVE regression set, and the zip64 boundaries at uint16max/uint32max — including a 4 GiB central directory, the case whose rune walk over 65,535-byte names proved @string slicing had to become a window. · proof
bufio 80 1 Buffered reader/writer/scanner — fill, rewind, split functions, io error propagation. · proof
bytes 82 6 Byte-slice algorithms; alloc-profile disclosures. · proof
cmp 4   Generics with an ordered-type constraint. · proof
compress/bzip2 4   Bzip2 decompression — bit readers, Huffman trees, the move-to-front decoder. · proof
compress/flate 64   DEFLATE itself — all ten compression levels, the Huffman bit-writer’s stored/fixed/dynamic block selection against golden bit streams, the LZ77 match chains and dictionaries, and a whole-Writer reflect.DeepEqual after Reset. · proof
compress/gzip 15   Gzip round-trips over the real DEFLATE coder — flate’s Huffman encoder/decoder tables, multistream framing, CRC/ISIZE trailers. · proof
compress/lzw 17   LZW coder in both bit orders (GIF’s LSB, TIFF/PDF’s MSB) — code-width growth, dictionary reset, and the reader/writer Reset matrix over the shared ../testdata corpus. · proof
compress/zlib 6   zlib framing over the real DEFLATE coder — Adler-32 trailer, preset dictionaries, and every compression level across the shared ../testdata corpus. · proof
container/heap 7   Heap interface over a slice. · proof
container/list 10   Doubly-linked list — pointers and receiver methods. · proof
container/ring 8   Circular linked list — a pointer graph. · proof
context 57 1 Cancellation trees over real channel rendezvous — parent/child propagation, Done broadcast, AfterFunc registration races, t.Deadline-driven tree cancellation, value chains named through the reflectlite bridge; alloc-count disclosure. · proof
crypto 6   The root crypto package’s cross-cipher invariants — every stream mode’s out-of-bounds-write guard (CFB/CTR/OFB/RC4) and the purego build-tag assertion the converted corpus is built under. · proof
crypto/aes 13   AES over the purego generic implementation — key expansion, the S-box and Te/Td round tables, GF(2⁸) mul/powx, known-answer encrypt/decrypt vectors, and the CBC/CTR/GCM interface-upgrade probes. · proof
crypto/des 18   DES and Triple-DES — the initial/final permutation bit shuffles, the substitution tables, semi-weak key pairs, and the full known-answer vector matrix. · proof
crypto/dsa 4   DSA over the converted math/big — FIPS 186-3 parameter generation at all four key sizes (a probabilistic prime search run to completion), sign/verify round-trips, the bad-public-key rejection, and the degenerate-key signing contract. · proof
crypto/ecdh 47   ECDH key agreement over P-256/P-384/P-521 and X25519 — key generation, the Bytes/NewPublicKey/NewPrivateKey encoding round-trips, shared-secret agreement across curves, the low-order and non-canonical X25519 rejections, and the crypto.PublicKey/crypto.PrivateKey interface witnesses. · proof
crypto/ecdsa 82   ECDSA sign/verify over the four NIST curves AND the generic big.Int CurveParams path — the NIST CAVP vector matrix, nonce safety, negative and zero-hash inputs, r±n signature rejection, ASN1 encoding via crypto/x509, and randomPoint. · proof
crypto/elliptic 82   The NIST curves over the generic CurveParams big.Int path as well as the optimized field implementations — point addition/doubling/scalar-multiplication agreement between the two, on-curve and off-curve predicates, the point-at-infinity contract, Marshal/Unmarshal compressed and uncompressed round-trips, and the base-point multiplication vectors. · proof
crypto/hmac 172   HMAC over the real MD5/SHA-1/SHA-224/256/384/512 digests — block-size key folding, constant-time Equal, and cryptotest.TestHash’s stateful-write matrix per hash. · proof
crypto/internal/alias 1   The buffer-overlap predicate every cipher mode’s in-place guard is built on, over the full offset matrix. · proof
crypto/internal/bigmod 14   Constant-time modular arithmetic on big naturals — Montgomery domain round-trips, Exp, modular add/sub identities, limb expansion and SetBytes bounds, all on the purego word-at-a-time path. · proof
crypto/internal/boring 3   The not-BoringCrypto build’s own contract — Enabled false, and the Unreachable/UnreachableExceptTests guards that a BoringCrypto-only path must never execute staying quiet under it. · proof
crypto/internal/edwards25519/field 16   The Ed25519 base field mod 2²⁵⁵−19 — the 51-bit limb representation’s carry propagation and 64×64→128 multiply, Multiply/Square/Invert/SqrtRatio, constant-time Select/Swap, canonical SetBytes/Bytes round-trips at the edge cases, and TestBytesBigEquivalence, which cross-checks the whole encoding against math/big over randomized inputs — the row the array<T> unshaped-instance class held. TestAliasing additionally drives every method with its receiver aliasing an argument. · proof
crypto/internal/hpke 19   Hybrid public-key encryption against the RFC 9180 vector set — DHKEM(X25519, HKDF-SHA256) base-mode setup over both AEADs, the exporter secret, and Seal/Open at every sequence number in the vectors including the 255→256 nonce-width boundary; the P-256/P-521 suites reach Go’s own SupportedKEMs guard and skip identically on both sides. The whole vector set is encoding/json-decoded into a slice of a converter-lifted anonymous struct — the shape that held this package until the lift’s element Kind reached Unmarshal. · proof
crypto/md5 11 1 MD5 — the golden digest matrix, binary marshal/unmarshal of a half-written state, large-input block handling, and cryptotest.TestHash’s stateful-write matrix; alloc-profile disclosure. · proof
crypto/rand 298   Cryptographically secure random integers over the real math/big arithmetic — Int’s rejection-sampled bit-mask loop across the whole modulus matrix, Prime generation and its degenerate bit-length errors, the Read/Reader surface, and the empty-max panic contract. · proof
crypto/rc4 2   RC4 keystream golden vectors across every key length, and the in-place XORKeyStream block matrix. · proof
crypto/rsa 559 1 RSA end to end over the converted math/big and crypto/internal/bigmod — key generation at every size including multi-prime, PKCS#1 v1.5 and OAEP encrypt/decrypt with and without a blinding source, PSS sign/verify across every salt-length mode against the OpenSSL and RSA-Labs golden vectors, key validation and the small-key/overlong/unpadded rejection paths, and the several-hundred-case TestEverything matrix over the key-size × hash × scheme cross-product; alloc-profile disclosure. · proof
crypto/sha1 12 1 SHA-1 — the struct-carrying-arrays value copy Sum depends on; binary marshal round-trips. · proof
crypto/sha256 23 1 SHA-224/256 golden vectors and cryptotest.TestHash’s stateful-write matrix. · proof
crypto/sha512 36 1 SHA-384/512/512-224/512-256 — the four-variant digest state machine. · proof
crypto/subtle 7   Constant-time primitives; word-at-a-time XORBytes over the full alignment matrix. · proof
database/sql/driver 1   The driver Value contract — IsValue/IsScanValue over every convertible Go kind and the default converter’s integer-range and pointer-indirection rules. · proof
debug/buildinfo 197   Build-info extraction from real linked binaries — the ELF/Mach-O/PE/XCOFF reader matrix over the package’s own testdata executables, and the blob scan repeated at every start offset. · proof
debug/dwarf 40   DWARF debug info — the whole type graph (basic, struct, array, pointer, typedef including a cycle, qualified, unsupported), bit fields and DWARF 4/5 bit offsets, line tables across GCC/Clang and zstd-compressed sections, ranges/rnglists, split and type units. Its reader satisfies an anonymous interface via a pointer-receiver method promoted from an exported value embed — the shape whose absent promotion made the run-time method set incomplete. · proof
debug/gosym 9   Go symbol tables and the pclntab line machinery — LineTable’s PC↔line mapping and Table symbol lookup over a binary the test compiles from its own testdata with the real Go toolchain and then reads back, plus package-path splitting for standard-library, remote and generic-instantiation symbol names. That toolchain build runs in testdata relative to the package, which is why this row waited on the converted host reproducing a package’s directory ancestry rather than only its shape. · proof
debug/macho 7   Mach-O object files — the load-command walk over the thin and fat testdata corpus, dynamic-symbol parsing including a malformed LC_DYSYMTAB, and the relocation/CPU stringer tables. Reached through saferio.SliceCap over a slice of the Load interface, whose Go size unsafe.Sizeof now answers from Go’s own layout rule. · proof
debug/plan9obj 2   Plan 9 a.out objects — section table and symbol parsing over the testdata corpus, plus the malformed-file error path. · proof
encoding/ascii85 9   Ascii85 encode/decode and streaming wrappers. · proof
encoding/asn1 38   DER marshal/unmarshal end to end — tag and class handling including SET vs SEQUENCE, asn1:"…" struct-tag parameters read through the reflection bridge, unexported-field guards probing settability, big.Int/bit-string/OID/UTC-time round-trips, and a full certificate walk. Closed by three complementary fixes across two machines (defined-type Name(), StructField.PkgPath, array dims). · proof
encoding/base32 26   Base32 round-trips; io.Pipe rendezvous over the real channel core. · proof
encoding/base64 17   Base64 round-trips; goroutine + time.After timer path. · proof
encoding/binary 137 9 Reflection-driven Read/Write — the bridge’s construction/write-back surface. · proof
encoding/csv 71   CSV parsing; wrapped-error errors.Is through the reflection bridge. · proof
encoding/hex 12   Hex encode/decode and error paths. · proof
encoding/pem 8   PEM block parsing and round-trips. · proof
errors 61   errors.Is/As/Join — reflection-bridge write-back (Value.Set, addressability). · proof
expvar 11   The exported-variable registry — Int/Float/String/Map/Func publication and atomic update, Map key ordering with delete/init, JSON quoting across every rune class, and the /debug/vars handler. · proof
go/ast 9   The Go syntax tree — comment maps and doc association, FilterFile/FilterPackage deduplication, Walk/Preorder traversal with early break, and ast.Fprint’s reflective dump of a parsed tree (map iteration and unnamed struct types through the reflection bridge). · proof
go/build/constraint 89   Build-constraint expression parsing. · proof
go/constant 9   Exact-precision Go constant arithmetic — the int/rational/float representation ladder, Make/Bytes round trips, BitLen, and the full binary/unary operator and comparison matrix. · proof
go/doc/comment 10059   Doc-comment parsing and re-printing to text/markdown/HTML over the whole testdata corpus, plus a sweep over every doc comment in the converted standard library’s Go sources — 10,000+ subtests, the largest verdict set banked. · proof
go/format 4   gofmt’s public entry points — format.Source on whole files and partial fragments, and format.Node’s no-modify guarantee over a parsed AST. · proof
go/importer 3   The compiler-keyed importer front end — ForCompiler’s dispatch for source, gc and gccgo, including the custom-lookup path. · proof
go/internal/gccgoimporter 4   The gccgo export-data importer — the .gox type-parser matrix (aliases, complex constants, escape info, notinheap, pointer and interface shapes) and the ELF archive reader that locates export data inside a .a member, with the two gccgo-installation tests skipping on both sides exactly where Go’s do. · proof
go/parser 173   The Go parser end to end — the valid and error corpora, ParseFile/ParseDir/ParseExpr entry points, identifier resolution into scopes, and TestParseDepthLimit/TestScopeDepthLimit, which drive nesting to Go’s own maxNestLev of 100,001 levels deliberately: about 400,000 converted frames, which is what sized the host’s per-test stack reservation to Go’s 1 GB ceiling. Its package initializer reads the sibling go/printer’s sources, so it is also the package that proved the ancestry view. · proof
go/printer 45   The Go pretty-printer — the golden-file corpus (declarations, expressions, generics, comments, //go:build lines), comment placement and bad-node recovery, CommentedNode, and base-indentation modes. · proof
go/scanner 11   Go’s lexical scanner — the whole token and literal matrix, automatic semicolon insertion, //line directive handling (valid and invalid), ErrorList collection with its sort and one-per-line dedup, and CR stripping in raw strings. · proof
go/token 31   FileSet/Position machinery; a full encoding/gob serialization round-trip — the reflect type-relation mirrors driving real Encoder/Decoder engines. · proof
go/version 3   Go version-string comparison. · proof
hash 18   The hash.Hash contract itself — encoding.BinaryMarshaler/BinaryUnmarshaler state round-trips exercised across every standard-library digest (adler32, crc32/64, the six FNV widths, md5, sha1, and the six SHA-2 variants). · proof
hash/adler32 2   Adler-32 checksum. · proof
hash/crc32 10   CRC-32 including real SSE4.2/PCLMULQDQ hardware paths via managed intrinsics. · proof
hash/crc64 5   CRC-64 checksum tables. · proof
hash/fnv 19   FNV-1/FNV-1a across widths. · proof
hash/maphash 22   Seeded and unseeded hash streams plus SMHasher avalanche/BIC quality checks; the 100,000-sample bounds exercise a computed float constant derived from a named untyped integer constant. · proof
image 8   The image model — Rectangle algebra, the At/Set/SubImage/Opaque contract over every concrete image type, RGBA64Image 16-bit access, YCbCr plane geometry and non-overlap, and image.Decode through the registered-format table. · proof
image/color 10   The color models — RGBA/CMYK/YCbCr conversion round-trips and cross-model consistency, alpha-premultiplied NYCbCrA, and the palette’s nearest-color search. · proof
image/draw 9   Porter-Duff compositing over every image model — clip narrowing through address-taken value parameters, Floyd-Steinberg dithering, and paletted quantization. · proof
image/gif 28   GIF encode/decode over the real LZW coder — interlacing, transparency and palette edge cases, animation loop counts and per-frame disposal, and image.Decode reading a PNG through a blank import’s registration. · proof
image/jpeg 14   Baseline and progressive JPEG decode/encode — forward and inverse DCT against a reference implementation, zig-zag tables, restart markers, truncated and extraneous scan data, grayscale and CMYK, and a full encode/decode round trip over the shared image/testdata fixtures. · proof
image/png 28   The PNG codec end to end — the full PNGSuite decode corpus (every bit depth, palette, interlacing and transparency form) against its .sng goldens, Paeth filtering, malformed-stream error paths, and an encode/decode round trip whose RGBA→NRGBA row conversion writes through a slice-to-array pointer. · proof
index/suffixarray 12   SAIS suffix-array construction in both 32- and 64-bit index widths, verified exhaustively over every string up to length 8 on 2- and 3-letter alphabets, plus lookup, regexp FindAllIndex, and gob save/restore round trips. · proof
internal/abi 2   Runtime ABI helpers (FuncPC). · proof
internal/buildcfg 3   Toolchain build configuration — GOARM64/GOAMD64 feature-level parsing and the gogoarch build-tag set. · proof
internal/coverage/cformat 2   Coverage report formatting — per-function and per-package percentage rollups, and the empty-package edge. · proof
internal/coverage/cmerge 2   Coverage counter merging — the saturating-add merge policy and the conflicting-metadata clash path. · proof
internal/coverage/pods 1   Coverage “pod” collection — grouping meta/counter data files on disk by package, over real temp-directory I/O. · proof
internal/coverage/slicereader 1   Coverage slice reader. · proof
internal/coverage/slicewriter 1   Coverage slice writer. · proof
internal/cpu 8   The x86 feature-detection tables — the CPUID-derived AVX/AVX2/AVX-512 implication invariants, and the GODEBUG cpu-option machinery reached through getGOAMD64level, whose GOAMD64 build level go2cs answers at the amd64 baseline exactly as Go’s own assembly does for a build with no GOAMD64_vN define. · proof
internal/dag 6   The dependency-graph language the standard library’s own layering rules are written in — rule parsing, topological order, transpose, and transitive reduction. · proof
internal/diff 13   The unified-diff engine over its testdata corpus — every edit shape from empty-to-full through EOF-newline edge cases. · proof
internal/fmtsort 3   fmt’s map-key ordering — Value.Convert, arithmetically-ordered pointer/channel tokens, -tests init-order relocation. · proof
internal/godebugs 1   The GODEBUG registry, cross-checked against the world outside the package: every entry must be documented in GOROOT’s doc/godebug.md and must have a matching IncNonDefault() call site, found by running go list std cmd through the real toolchain and reading every .go file it names. · proof
internal/gover 5   Toolchain version ordering. · proof
internal/itoa 3   Minimal integer formatting. · proof
internal/profile 1   The pprof protobuf codec’s packed varint encoding — round-tripped through the white-box test’s own message implementation, which is what proved a Go package split across two assemblies still binds its unexported interface methods. · proof
internal/saferio 17   Allocation-capped I/O helpers. · proof
internal/singleflight 5   Duplicate-call suppression — and, in TestDoAndForgetUnsharedRace, 1000 goroutines that must all park inside one Do before it returns. That row was the cooperative scheduler’s whole bill: under the old ThreadPool executor a parked goroutine held shared capacity, so the test climbed a doubling ladder for 28.7 minutes; on a dedicated thread per goroutine it converges at iteration 8 in 1.2 s. · proof
internal/sysinfo 1   The CPU brand string the runtime reports, read through the converted internal/cpu name tables. · proof
internal/testenv 7   The capability probes the rest of the standard library’s suites gate themselves on — HasGoBuild/MustHaveExec/MustHaveGoRun consistency, and TestGoToolLocation, which resolves ../../../bin/go from the package’s own directory and requires os.SameFile agreement with exec.LookPath("go"): the test that pins both halves of the host’s execution environment, its working directory and its PATH. · proof
internal/types/errors 155   Every go/types error code, checked two ways against the real type checker: each code’s documented Example snippet must actually produce that code, and the codes themselves must stay dense, uniquely named and correctly styled. Its walkCodes type-checks codes.go through go/types.Check on the way in, so this is also the first package to exercise the converted checker over real source. · proof
internal/xcoff 3   AIX XCOFF objects — the 32- and 64-bit section and symbol-table readers over the PowerPC testdata executables, big-format archive member enumeration, and the malformed-file error path. · proof
internal/zstd 534   The Zstandard decompressor — FSE/Huffman table construction, the sliding window, xxhash checksums, and 500+ fuzz-corpus round-trips. · proof
io 60 1 The core reader/writer contracts — pipes over real goroutine rendezvous, MultiReader/MultiWriter flattening via runtime.Callers, OffsetWriter on real temp files (os.runtime_rand), WriteString interface dispatch under -tests renaming; alloc-count disclosures. · proof
io/fs 18   The fs.FS interface family — named-interface runtime shells, fs.Glob deep recursion, dirFS walks. · proof
io/ioutil 28   The deprecated pre-os/io shims — ReadAll/ReadFile/WriteFile, TempFile/TempDir including their bad-pattern and bad-directory matrices, and TestReadDir, which lists the PARENT directory and expects the sibling io package’s own io_test.go to be there. · proof
log/slog/internal/benchmarks 3   The two hand-written slog.Handler implementations log/slog’s benchmarks measure against, checked for correctness rather than speed — a minimal text handler’s rendered output byte-for-byte, and an async handler’s ring-buffered Record compared attribute by attribute through slices.EqualFunc over slog.Attr.Equal. · proof
maps 14   Generic map helpers and iterators. · proof
math 76   The core numeric package — IEEE edge cases, rounding, Inf/NaN. · proof
math/bits 26   Bit-manipulation intrinsics. · proof
math/cmplx 24   complex128 transcendental math. · proof
math/rand 43   PRNG streams, including a child-process race test. · proof
math/rand/v2 36   The v2 PRNG API (PCG, ChaCha8). · proof
mime 17 1 MIME type tables and media-type parsing — the first package through the runtime process-control facade (LockOSThread, registry reads). · proof
mime/multipart 52   MIME multipart reading and writing — the part reader’s boundary scanner over slow, truncated and nested streams, ReadForm’s memory/disk spill with the multipartmaxparts/multipartmaxheaders godebug limits, quoted-printable part decoding, and the writer’s boundary generation under concurrent use. Reaches net/textproto’s size-limited header reader through a cross-package //go:linkname pull — the forwarder that closed all 45 of this package’s differential rows at once (L12). · proof
mime/quotedprintable 5   Quoted-printable encoding — the reader’s soft-line-break and hex-escape state machine, the writer’s line wrapping, and an exhaustive encode/decode round-trip. · proof
net/http/fcgi 12   The FastCGI record protocol end to end — the child’s record dispatch and FCGI_GET_VALUES reply, multiplexed request streams over a shared connection, the ResponseWriter’s content-type sniffing, and a served request torn down mid-flight. · proof
net/http/internal/ascii 13   ASCII case-insensitive helpers. · proof
net/rpc/jsonrpc 9   JSON-RPC 1.0 client and server codecs driven through the real net/rpc server over an in-memory net.Pipe — hand-coded request framing, out-of-order concurrent calls, the map/slice/[1]int builtin reply types the server allocates from the method type alone (reflect.New(mtype.ReplyType.Elem()) — the row that made a fixed-size array’s LENGTH reach reflect through a method’s pointer parameter), malformed input and output, and the null-result error path. · proof
net/textproto 26   Text-protocol primitives under HTTP/SMTP — MIME header reading with canonicalization (including the want-ZERO AllocsPerRun asserts over the common-header fast path, satisfied by the m[string(b)] transient-key lookup, hoisted big-const masks and Once.Do’s zero-alloc fast path — L11), dot-encoding reader/writer, continued lines, and pipelined request sequencing. · proof
net/url 48   URL parsing, escaping and reference resolution — the query encode/decode matrix including semicolon rejection, userinfo, opaque and relative references, JoinPath, and gob/JSON/TextMarshaler round-trips of a parsed URL. · proof
os/exec/internal/fdtest 1   The file-descriptor existence probe; its one test is Windows-gated and the converted run reaches Go’s own runtime.GOOS guard and skips exactly where Go does. · proof
os/signal 1   Console-signal delivery (Ctrl+Break) through real channels and select. · proof
path 9   Pure path manipulation (Clean/Split/Join/Match…). · proof
path/filepath 61   Path algebra plus the Windows symlink machinery — EvalSymlinks through the hand-owned FindFirstFile blittable mirror, Glob/Walk, junction-aware TempDir cleanup, testenv.GOROOT via the pipeline’s exported root, and 20 privilege-gated skips agreeing with Go’s · host-conditional (symlink-creation privilege — the parent test skips before spawning them without it): TestWalkSymlinkRoot/no_slash, TestWalkSymlinkRoot/slash, TestWalkSymlinkRoot/abs_no_slash, TestWalkSymlinkRoot/abs_with_slash, TestWalkSymlinkRoot/double_link_no_slash, TestWalkSymlinkRoot/double_link_with_slash · proof
plugin 1   That a program importing plugin links and starts at all — Go’s own regression test for issue 28789 is an empty body asserting precisely that, and the converted binary runs it. · proof
regexp 45   The full RE2 engine — NFA/backtracker/one-pass executors, the RE2 exhaustive corpus, TextMarshaler round-trips. · proof
regexp/syntax 12   Regexp parsing, simplification and program compilation; named-type constant tables. · proof
runtime/internal/math 1   The allocator’s overflow-checked MulUintptr across its boundary table — the uintptr-typed constant shift whose width decides whether the fast path guards at 2³² or at 1. · proof
runtime/internal/sys 4   The runtime’s own bit intrinsics — Bswap32/Bswap64 and TrailingZeros32/TrailingZeros64 across their full input matrices. · proof
runtime/metrics 2   The runtime metrics table end to end — All()’s sorted-name/regexp contract against doc.go, and a full metrics.Read round trip computing a kind for every published metric through the first linkname push into a _test package, the managed metricsLock, and every stat-aggregate compute closure. · proof
sort 63   Interface-driven sort, sort.Slice reflection swaps, NaN-aware ordering, stability. · proof
strconv 55 11 Number↔string conversion at full precision — Ryū/Grisu float formatting, arbitrary-precision decimal shifts, complex parsing; alloc-profile disclosures. · proof
strings 68 4 String algorithms; alloc-count/alloc-profile disclosures. · proof
sync 44 7 The concurrency crown — Mutex/RWMutex/WaitGroup/Once/Cond/Map/Pool over real parked-thread semaphores, a hand-owned lock-free pool ring, and GC-integrated cleanup; Cond’s copy detector on root-allocation identity; alloc-profile and codegen-liveness disclosures. · proof
syscall 62   The Windows system-call surface itself — WTF-8/UTF-16 round-trips across the whole surrogate matrix (lone highs, lone lows, paired, and the astral characters between them), EscapeArg’s command-line quoting rules, the environment block, StartupInfo/handle inheritance and permuted-fd process launch, TOKEN_ALL_ACCESS’s version-dependent value, and Getwd over a path far past MAX_PATH — the row that needed a converted process to be long-path aware the way every Go binary is. · proof
testing/iotest 18   The io testing helpers — the half/one-byte/timeout/error reader wrappers, DataErrReader’s final-read fusion, and the read/write loggers’ log output. · proof
testing/quick 8   Property testing — reflect value generation and Value.Call dynamic invocation. · proof
testing/slogtest 17   The slog.Handler conformance harness Go ships for third-party handlers, run against the real TextHandler/JSONHandler — the whole 17-case matrix of groups, inline and empty groups, WithAttrs/WithGroup composition, and LogValuer resolution. · proof
text/scanner 18   Rune-level source scanning. · proof
text/tabwriter 3   Elastic-tab column formatting; panic-during-write recovery. · proof
text/template/parse 52   Template lexing and parse-tree construction — the item stream, custom and alphanumeric delimiters, actions/pipelines/variables, `` and tree copying, and the full parse-error matrix. · proof
time 159   Monotonic and wall clocks, timer/ticker delivery including Go 1.23’s synchronous timer channel, RFC 3339 and layout parse/format, zone loading. · proof
unicode 28   Category tables, case mapping (SpecialCase), script ranges. · proof
unicode/utf16 8 1 Encode/decode round-trips via reflect.DeepEqual. · proof
unicode/utf8 14   UTF-8 encode/decode — the first suite to pass (2026-07-17). · proof

  1. A by-value struct argument wider than a machine word is passed by hidden reference, so the caller’s temp is address-exposed and therefore untracked by liveness analysis. ↩