Validated Test Packages

What a row means. Each package in the table below has had its own Go 1.26.10 test suite converted to C#, built against the converted standard library, run, and compared with go test, verdict for verdict. A package appears only when every Test function’s result either matches Go’s or is disclosed, by its exact failure, as something the converted code does not do; a package that almost passes never appears. What “validated” means, and what it doesn’t says what that proves and what it does not.

Where Phase 4 stands

Phase 4 progress: 238 / 242 testable packages validated — 98.3%

73,850 matching test verdicts · 377 disclosed (updated 2026-10-25 — grows as packages validate)

Against the implementable set (242 − 4 excluded = 238): 238 / 238 — 100.0%. Both ratios are always reported. The headline measures against every package that defines a Test function; this line measures against only those a faithful managed conversion can honestly validate at all.

Every implementable package is validated, including the 13 packages new at Go 1.26.10 and internal/unsafeheader, which rejoined from the excluded list; the four packages outside the 238 are listed, each with its reason, under Excluded packages. Every row’s columns are its own Go 1.26.10 Windows measurement.

Linux: 236 of 236 applicable rows validated at their Linux counts — 73,966 matching verdicts · 410 disclosed · 2 rows platform-exclusive (linux: n/a). (They are internal/syscall/windows and its child internal/syscall/windows/registry; the parent is Windows-exclusive by its own name, every source file is *_windows.go, and its layout-L3 csproj compiles nothing under GoTargetOS=linux.)

Reading the table

Package Tests Disclosed What it exercises
archive/tar 98   TAR archives end to end — V7, USTAR, PAX, GNU and STAR formats read and written against real archives; PAX record parse/format, including the sorted-header and non-ASCII/xattr paths; GNU and PAX sparse-file maps; octal and base-256 numeric fields at their width boundaries; the USTAR 100-byte name split; fs.FS traversal via AddFS; and the insecure-path and truncation regression sets. Its table-driven suite uses function-local any types, which put all 97 verdicts (its 1.23.12 count) behind one alias emission. · linux: 98 · darwin: 98 · proof
archive/zip 101   ZIP archives end to end — central-directory and data-descriptor parsing over real archives from 7-Zip, InfoZip, WinRAR, WinZip and OS X; fs.FS traversal; UTF-8 vs CP-437 name/comment detection; the CVE regression set; and the zip64 boundaries at uint16max/uint32max, including a 4 GiB central directory whose rune walk over 65,535-byte names proved @string slicing had to become a window. TestZip64 streams another 4 GiB through the writer and back: most of the row’s ~775 s sweep time. · linux: 101 · darwin: 101 · proof
bufio 80 1 Buffered reader/writer/scanner — fill, rewind, split functions, io error propagation. · linux: 81 + 1 · darwin: 81 + 1 · proof
bytes 84 6 Byte-slice algorithms; deferred alloc-count disclosures. · linux: 88 + 6 · darwin: 84 + 6 · proof
cmp 4   Generics with an ordered-type constraint. · linux: 4 · darwin: 4 · proof
compress/bzip2 4   Bzip2 decompression — bit readers, Huffman trees, the move-to-front decoder. · linux: 4 · darwin: 4 · proof
compress/flate 64   DEFLATE itself — all ten compression levels, the Huffman bit-writer’s stored/fixed/dynamic block selection against golden bit streams, the LZ77 match chains and dictionaries, and a whole-Writer reflect.DeepEqual after Reset. · linux: 64 · darwin: 64 · proof
compress/gzip 15   Gzip round-trips over the real DEFLATE coder — flate’s Huffman encoder/decoder tables, multistream framing, CRC/ISIZE trailers. · linux: 15 · darwin: 15 · proof
compress/lzw 17   LZW coder in both bit orders (GIF’s LSB, TIFF/PDF’s MSB) — code-width growth, dictionary reset, and the reader/writer Reset matrix over the shared ../testdata corpus. · linux: 17 · darwin: 17 · proof
compress/zlib 6   zlib framing over the real DEFLATE coder — Adler-32 trailer, preset dictionaries, and every compression level across the shared ../testdata corpus. · linux: 6 · darwin: 6 · proof
container/heap 7   Heap interface over a slice. · linux: 7 · darwin: 7 · proof
container/list 10   Doubly-linked list — pointers and receiver methods. · linux: 10 · darwin: 10 · proof
container/ring 8   Circular linked list — a pointer graph. · linux: 8 · darwin: 8 · proof
context 62   Cancellation trees over real channel rendezvous — parent/child propagation, Done broadcast, AfterFunc registration races, t.Deadline-driven tree cancellation, value chains named through the reflectlite bridge; deferred alloc-count disclosure. · linux: 62 · darwin: 62 · proof
crypto 8   The root crypto package’s cross-cipher invariants — every stream mode’s out-of-bounds-write guard (CFB/CTR/OFB/RC4) and the purego build-tag assertion the converted corpus is built under. · linux: 8 · darwin: 8 · · proof
crypto/aes 58   AES over the purego generic implementation — key expansion, the S-box and Te/Td round tables, GF(2⁸) mul/powx, known-answer encrypt/decrypt vectors, and the CBC/CTR/GCM interface-upgrade probes. · linux: 58 · darwin: 58 · proof
crypto/cipher 27289   Go’s block-cipher MODES over the converted AES — CBC/CFB/CTR/OFB encrypt and decrypt against the NIST SP 800-38A vectors; GCM authenticated encryption, including the counter-wrap edge, invalid tag sizes, empty plaintext, and the tag-failure path that must overwrite its output buffer. TestGCMAsm, once the founding platform-skip row, now agrees on every platform: newGCM returns *gcm.GCM for an *aes.Block but a fallback for the test’s wrapped block, so gcm_test.go’s skip for a corpus with no assembly codepaths cannot fire, and crypto/cipher discloses nothing on any platform. · linux: 27289 · darwin: 27289 · proof
crypto/des 55   DES and Triple-DES — the initial/final permutation bit shuffles, the substitution tables, semi-weak key pairs, and the full known-answer vector matrix. · linux: 55 · darwin: 55 · proof
crypto/dsa 4   DSA over the converted math/big — FIPS 186-3 parameter generation at all four key sizes (a probabilistic prime search run to completion), sign/verify round-trips, the bad-public-key rejection, and the degenerate-key signing contract. · linux: 4 · darwin: 4 · proof
crypto/ecdh 47   ECDH key agreement over P-256/P-384/P-521 and X25519 — key generation, the Bytes/NewPublicKey/NewPrivateKey encoding round-trips, shared-secret agreement across curves, the low-order and non-canonical X25519 rejections, and the crypto.PublicKey/crypto.PrivateKey interface witnesses. · linux: 47 · darwin: 47 · proof
crypto/ecdsa 125   ECDSA sign/verify over the four NIST curves AND the generic big.Int CurveParams path — the NIST CAVP vector matrix, nonce safety, negative and zero-hash inputs, r±n signature rejection, ASN1 encoding via crypto/x509, and randomPoint. · linux: 125 · darwin: 125 · proof
crypto/ed25519 9 1 Ed25519 over the converted crypto/internal/fips140/ed25519 (on crypto/internal/fips140/edwards25519) — sign/verify round-trips in the plain, pre-hashed (Ed25519ph) and context (Ed25519ctx) modes with wrong-message/wrong-key rejection; crypto.Signer through the interface surface; the RFC 8032 golden vectors (sign.input.gz); the project’s extended edge-case vectors (non-canonical A/R encodings, small-order components, mixed-order points); key equality; and signature-malleability rejection. Its crypto.Signer(private) cast named the local-value→foreign-interface record gap. Deferred alloc-count disclosure. · linux: 9 + 1 · darwin: 9 + 1 · · proof
crypto/elliptic 81   The NIST curves over both the generic CurveParams big.Int path and the optimized field implementations — point addition/doubling/scalar-multiplication agreement between the two, on-curve and off-curve predicates, the point-at-infinity contract, Marshal/Unmarshal compressed and uncompressed round-trips, and the base-point multiplication vectors. · linux: 81 · darwin: 81 · proof
crypto/fips140 2   The public FIPS 140-3 mode switch: TestImmutableGODEBUG holds that the fips140 GODEBUG cannot be changed once the program runs; TestWithoutEnforcement needs a FIPS 140-capable build, so it skips on both sides. · linux: 2 · darwin: 2 · proof
crypto/hkdf 3   RFC 5869 extract-and-expand over the real hash — the derivation matrix, the output-length ceiling HKDF refuses past, and the FIPS service indicator. · linux: 3 · darwin: 3 · proof
crypto/hmac 202   HMAC over the real MD5/SHA-1/SHA-224/256/384/512 digests — block-size key folding, constant-time Equal, and cryptotest.TestHash’s stateful-write matrix per hash. · linux: 202 · darwin: 202 · proof
crypto/hpke 231   Hybrid Public Key Encryption (RFC 9180) as a public package — TestRoundTrip sealing and opening across every KEM (the post-quantum hybrids among them) with each KDF and AEAD, TestVectors over the RFC 9180 vectors (rfc9180.json) and the post-quantum hpke-pq set, and TestSingletons. Go 1.26 replaced crypto/internal/hpke with this public package; that package’s one test, TestRFC9180Vectors, continues here as TestVectors/rfc9180 over the same RFC 9180 vector set, and its record stays at its Go 1.24.13 page. · linux: 231 · darwin: 231 · proof
crypto/internal/boring 3   The not-BoringCrypto build’s own contract — Enabled is false, and the Unreachable/UnreachableExceptTests guards (a BoringCrypto-only path must never execute) stay quiet under it. · linux: 3 · darwin: 3 · proof
crypto/internal/boring/bcache 1   The GC-cleared BoringCrypto shadow cache. Its single test is four suites in one: a 10,000-entry Put/Get sweep with a random 20% overwritten in place; the Clear contract; the REGISTERED cache emptying across a runtime.GC(); and a 100-goroutine barrier that fills cacheSize entries per goroutine, then reads each one back. The row is the measured consumer of the package’s one hand-own, which cannot be a literal conversion. Go’s Register hands the runtime the ADDRESS of the cache’s ptable word, which clearpools nils with atomicstorep; but that word is an atomic.Pointer[cacheTable[K,V]] whose managed slot holds a ж<T> REFERENCE. Storage containing references is not pinnable, so the uintptr would name nothing recoverable, and pinning it anyway would defeat the package’s one purpose: letting the collector reclaim what it caches. So a registration is a clear DELEGATE (the currency clearpools’ other two arms already use), and the delegate is the package’s own Clear, which Go’s doc comment names as precisely what the collector performs here. golib.BoringCaches drives it from a resurrecting finalizable sentinel filtered to gen2 (the Go-cycle-is-a-gen2-collection identity), and runtime.GC() clears the registry directly before returning, exactly as it already invokes poolcleanup directly. · linux: 1 · darwin: 1 · proof
crypto/internal/fips140/aes 5   The FIPS AES core — the S-box and inverse S-box tables, the Te/Td round tables, and the powx / mul GF(2⁸) helpers they are generated from, each recomputed and compared entry by entry. · linux: 5 · darwin: 5 · proof
crypto/internal/fips140/bigmod 79   The FIPS 140 module’s big-number modular arithmetic — Montgomery round trips, modular add, subtract, multiply, exponentiate and invert, shifts, and the Nat/Modulus size and encoding rules. Its tests moved here from crypto/internal/bigmod at Go 1.24 (one, TestNewModFromBigZero, was removed upstream). The first proof link is this package’s own record; the second is the earlier package’s, whose figures are that run’s, not this row’s. · linux: 79 · darwin: 79 · proof · proof
crypto/internal/fips140/ecdh 1   The P-224/P-256/P-384/P-521 group orders checked against crypto/elliptic’s own curve parameters; the row’s whole content is that the FIPS module and the general implementation agree on N. · linux: 1 · darwin: 1 · proof
crypto/internal/fips140/ecdsa 10   The FIPS ECDSA scalar plumbing — randomPoint’s rejection loop across the supported curves and hashToNat’s truncation of a digest to the curve order, at the boundary widths where a digest is longer, shorter and exactly the order’s length. · linux: 10 · darwin: 10 · proof
crypto/internal/fips140/edwards25519 54   The edwards25519 group law behind Ed25519 and X25519 — generator/identity arithmetic against Dalek-derived vectors; ScalarBaseMult/ScalarMult/VarTimeDoubleScalarBaseMult cross-checked against each other and against crypto/elliptic-independent references; scalar field arithmetic with SetUniformBytes’ 64-byte wide reduction; aliasing-safety sweeps over every receiver/argument overlap; and the lookup-table selectors. Its tests moved here from crypto/internal/edwards25519 at Go 1.24, all but one: the allocation assert TestAllocations moved to crypto/internal/fips140test as TestEdwards25519Allocations and is disclosed there, so this row discloses nothing. The first proof link is this package’s own record; the second is the earlier package’s, whose figures are that run’s, not this row’s. · linux: 54 · darwin: 54 · proof · proof
crypto/internal/fips140/edwards25519/field 15   The Ed25519 base field mod 2²⁵⁵−19 — the 51-bit limb representation’s carry propagation and 64×64→128 multiply; Multiply/Square/Invert/SqrtRatio; constant-time Select/Swap; canonical SetBytes/Bytes round-trips at the edge cases; TestBytesBigEquivalence, cross-checking the whole encoding against math/big over randomized inputs; and TestAliasing, driving every method with its receiver aliasing an argument. Its tests moved here, all of them, from crypto/internal/edwards25519/field at Go 1.24. The first proof link is this package’s own record; the second is the earlier package’s, whose figures are that run’s, not this row’s. · linux: 15 · darwin: 15 · proof · proof
crypto/internal/fips140/mldsa 46   The FIPS 204 ML-DSA module internals — Montgomery-domain field arithmetic (add, subtract, multiply, reduce, centered modulus, infinity norm), Power2Round and Decompose, the NTT zetas and constants, the ACVP rejection-sampling KATs across ML-DSA-44, -65 and -87, and the CAST rejection paths. · linux: 46 · darwin: 46 · proof
crypto/internal/fips140/mlkem 11   ML-KEM-768 (Kyber) internals — the mod-3329 field arithmetic checked EXHAUSTIVELY (TestFieldReduce walks all 2q² inputs; add/sub/mul walk every ordered pair below q), compress/decompress at every bit width against a math/big rational reference, and the ζ and γ constant tables re-derived by modular exponentiation. Go 1.24 split crypto/internal/mlkem768 in two: its field and compression tests moved here, its round-trip and length-validation tests moved to crypto/mlkem, and TestPQCrystalsAccumulated (10,000 reference-implementation vectors through the full KEM) was removed upstream. The first proof link is this package’s own record; the second is the earlier package’s, whose figures are that run’s, not this row’s. · linux: 11 · darwin: 11 · proof · proof
crypto/internal/fips140/nistec 44   The P-256 precomputed generator table, recomputed entry by entry and compared against the baked one — 43 subtests plus their parent. These 44 are this package’s own tests: the tests of the former crypto/internal/nistec moved to crypto/internal/fips140test at Go 1.24, and the two declarations this package received are benchmarks, which produce no test verdicts. p256_asm_test.go’s two page-boundary tests are a named flavour exclusion: their (amd64 || arm64 || ppc64le || s390x) && !purego && linux guard does not select under the corpus’s own purego tag, which is the same shape the crypto/internal/fips140test row already states for this family. · linux: 44 · darwin: 44 · proof
crypto/internal/fips140/rsa 123   The FIPS RSA primitives — Miller-Rabin primality over the witness matrix, the totient, the PKCS#1 v1.5 hash prefixes, and EMSA-PSS encode/verify at every salt length. · linux: 123 · darwin: 123 · proof
crypto/internal/fips140/subtle 1   Constant-time byte-slice comparison inside the FIPS 140 module (ConstantTimeLessOrEqBytes). · linux: 1 · darwin: 1 · proof
crypto/internal/fips140cache 1   The weak map that ties a precomputed value’s lifetime to its key’s, as the FIPS 140 module uses it for expensive key precomputation: TestCache over hits, misses, the validity check and the constructor. · linux: 1 · darwin: 1 · proof
crypto/internal/fips140only 1   The GODEBUG=fips140=only enforcement switch. Its one test, TestFIPS140Only, needs a FIPS 140-capable build, so it skips on both runtimes here and both record the same skip. · linux: 1 · darwin: 1 · proof
crypto/internal/fips140test 2270 8 The NIST P-curve group law at purego fidelity — the ScalarMult ladder across P224/P256/P384/P521 at every boundary scalar (0 and ±k around the group order, powers of two, every small scalar); TestEquivalents’ addition-chain identities; and the compressed/uncompressed point round-trips. The asm-flavor-only tests (p256_asm_table, ordinv) are named flavor exclusions: the corpus reproduces -tags purego, and the manifest declares what only the native flavor runs. Its eight disclosed verdicts are one shape, the want-zero AllocsPerRun family, in seven deferred entries: TestEdwards25519Allocations and TestNISTECAllocations/P{224,256,384,521} (each a TestAllocations that moved here at Go 1.24 from crypto/internal/edwards25519 or crypto/internal/nistec, renamed, its pin unchanged), TestXAESAllocations and TestMLDSAAllocations, with the parent TestNISTECAllocations counted through the disclosed-parent aggregation. Go’s escape analysis keeps every point, field element and buffer off the heap where the managed model must box it. The row’s other tests also came from crypto/internal/nistec (TestScalarMult, TestEquivalents) and from crypto/internal/alias at Go 1.24. TestP256PrecomputedTable is not lost: its file was renamed p256_asm_table_test.go → p256_table_test.go and its build guard inverted to (!amd64 && …) || purego, which the corpus’s own purego tag satisfies, so it is selected and converted; what the corpus excludes is the assembly variant, which it is defined never to have. The first proof link is this package’s own record; the other two are the earlier packages’ records, whose figures are those runs’, not this row’s. · linux: 2270 + 8 · proof · proof · darwin: 2270 + 8 · proof
crypto/internal/sysrand 6   The OS entropy source — Read at every buffer shape including empty, the byte-value distribution, concurrent readers, and the no-getrandom and no-urandom-fallback paths. TestReadError is cgo-gated and does not select at CGO 0. · linux: 6 · darwin: 6 · proof
crypto/md5 14 1 MD5 — the golden digest matrix, binary marshal/unmarshal of a half-written state, large-input block handling, and cryptotest.TestHash’s stateful-write matrix; deferred alloc-count disclosure. · linux: 14 + 1 · darwin: 14 + 1 · proof
crypto/mlkem 8   ML-KEM (FIPS 203) encapsulate/decapsulate end to end — the round trip at both parameter sets, the bad-length rejections, the accumulated known-answer digest, and the constant size contracts. · linux: 8 · darwin: 8 · proof
crypto/pbkdf2 5   PBKDF2 over real HMAC-SHA-1 and HMAC-SHA-256 — the RFC 6070 vectors, the maximum and zero key-length boundaries, and the FIPS service indicator. · linux: 5 · darwin: 5 · proof
crypto/rand 314 1 Cryptographically secure random integers over the real math/big arithmetic — Int’s rejection-sampled bit-mask loop across the whole modulus matrix, Prime generation and its degenerate bit-length errors, the Read/Reader surface, and the empty-max panic contract. Its one disclosure is TestAllocations’ want-zero AllocsPerRun over a 32-byte make plus rand.Read: two golib-site objects per run where Go’s escape analysis keeps the buffer on the stack. Deferred, not structural: the run’s own unit note reports a COUNT in Go’s own units, and nothing in the CLR’s object model requires an allocation on that path. · linux: 314 + 1 · darwin: 314 + 1 · proof
crypto/rc4 75   RC4 keystream golden vectors across every key length, and the in-place XORKeyStream block matrix. · linux: 75 · darwin: 75 · proof
crypto/rsa 590 1 RSA end to end over the converted math/big, crypto/internal/fips140/rsa and crypto/internal/fips140/bigmod — key generation at every size, including multi-prime; PKCS#1 v1.5 and OAEP encrypt/decrypt with and without a blinding source; PSS sign/verify across every salt-length mode against the OpenSSL and RSA-Labs golden vectors; key validation and the small-key/overlong/unpadded rejection paths; and the several-hundred-case TestEverything matrix over the key-size × hash × scheme cross-product. Deferred alloc-count disclosure. · linux: 590 + 1 · darwin: 590 + 1 · proof
crypto/sha1 13 1 SHA-1 — the struct-carrying-arrays value copy Sum depends on; binary marshal round-trips. · linux: 14 + 1 · proof
crypto/sha256 29 2 SHA-224/256 golden vectors and cryptotest.TestHash’s stateful-write matrix. · linux: 29 + 2 · darwin: 29 + 2 · proof
crypto/sha3 54 5 SHA-3 and SHAKE end to end — the hash and XOF matrices, unaligned and one-byte-at-a-time writes, cSHAKE accumulation, binary marshal/unmarshal of a partial state, and the FIPS service indicator. The five disclosed verdicts are the TestAllocations family — /New, /NewSHAKE, /Sum, /SumSHAKE pinned deferred at 18/16/16/13 golib objects per run against a want of zero, plus their parent by aggregation. A mechanism can be named (the sponge state object and the closures’ non-escaping byte slices), so the excess is reducible bridge work, not a structural floor. · linux: 54 + 5 · darwin: 54 + 5 · proof
crypto/sha512 44 1 SHA-384/512/512-224/512-256 — the four-variant digest state machine. · linux: 44 + 1 · darwin: 44 + 1 · proof
crypto/subtle 10   Constant-time primitives; word-at-a-time XORBytes over the full alignment matrix. · linux: 11 · darwin: 10 · proof
crypto/tls 1393 2 The flagship networking suite: one row over everything the Windows syscall arcs built — TLS 1.2 and 1.3 handshakes in both roles over real loopback sockets (the managed netpoller and the WSA submit family end to end); session tickets and resumption; QUIC transport events; ECH; the ALPN/SNI/client-auth matrices; certificate chain verification through the Windows system verifier (CertGetCertificateChain and the SSL policy check, the opaque-pointer mint round trip); name resolution (GetAddrInfoW + adapterAddresses); sha3-backed key schedules; and the zero-value regression sets. ⚠ BoGo interop is host-bound. TestBogoSuite runs BoringSSL’s interop runner, which launches the converted shim once per case (3,527 launches measured at Go 1.26.10) inside a fixed 600 s wall. Each converted shim launch costs about 10 s against Go’s 85 ms — process start and package init about 3 to 3.7 s with tiering off, then about 6.5 s of cold JIT over the handshake path — so the full suite projects to about 77 minutes on a desktop host (3,527 launches x 10.4 s over about 7.9 concurrent). That is the converted deployment’s per-process cost, not a Go 1.26.10 regression and not host speed; what reclaims the fan-out is lowering that cost (ReadyToRun-compiled test hosts, or tiered JIT in spawned child test processes), planned after publication. So the row validates in the third host state below: Go fans out BoringSSL’s cases, now 3,526 of them, the converted side gets through only a small part of the suite inside the wall, the root reads Go pass / go2cs fail under its host-limit entry, and every one of those rows is withdrawn with the disclosed root, as the proof page lists. No converted verdict outside the suite is lost: the non-BoGo set grew from 1,342 to 1,395 names (17 renamed or removed upstream, 70 new), hence 1,393 matched + 2 disclosed, the second disclosure being TestWeakCertCache (Go 1.26’s name for TestCertCache). run-validated-sweep.ps1 accepts THREE host states, each only when PROVEN from the run’s own comparison record. (1) A host with the BoGo/BoringSSL shim runner and the throughput to finish inside its fixed 600 s wall validates the full count. (2) A host missing the runner never spawns the case matrix: TestBogoSuite collapses to one agreeing verdict on both runtimes with no Go-side fan-out, and the row validates at 1,340 matched; that absent fan-out is precisely the capability-absent check’s discriminator. (3) A host that has the runner but cannot clear the wall reads nothing like the second: Go fans out all 3,418 cases while the converted side dies on the deadline with the pinned signature, so the row validates at 1,340 matched / 2 disclosed, the second being TestBogoSuite’s own committed host-limit entry. The host-limit check admits it only when the withdrawn Go-side rows are exactly the 3,418 sub-verdicts validated in the first state, name for name, and the committed manifest pins the root under that class. The two shortfall checks partition on the fan-out, not the root’s verdict pair (the third state can report Go fail / C# fail, the second’s pair; only the withdrawals tell them apart). Any other shortfall fails the row. The counts in those three states are Go 1.24.13’s, validated in the first state with BoringSSL’s runner wall raised to 40 minutes on both sides: there TestBogoSuite’s 3,419 BoringSSL-interop sub-verdicts were ordinary MATCHED verdicts, case-for-case agreement with Go, not a filtered sample or a disclosed capability, and the one disclosure was codegen-liveness (TestCertCache, the TestOnceXGC/TestPoolGC mechanism), which Linux read as a pass on both sides. On Linux under WSL, a generated /etc/hosts that names localhost IPv4-only breaks Go’s own BoGo run, because BoringSSL’s runner listens on [::1] while Go’s shim dials “localhost”; with that fixed on the host, Go’s own TestBogoSuite passes natively. · linux: 1394 + 1 · darwin: 1394 + 1 · · proof
crypto/x509 540   X.509 end to end — certificates, CSRs and CRLs parsed, created, marshalled and re-parsed across RSA, RSA-PSS, ECDSA, Ed25519, X25519 and DSA; every key encoding (PKCS#1, PKCS#8, SEC1, PKIX) with its mismatched-format and broken-signer rejections; chain building and verification (EKU enforcement, path building, the pathological and long-chain limits, the Windows system verifier); name constraints with the RFC 2821 mailbox grammar and the bad-name sets; hostname and IP matching; the OID value type’s marshal/unmarshal/equality round-trips; PEM encryption; certificate policies under GODEBUG; the system and hybrid certificate pools; and the duplicate-extension, negative-serial and critical-extension regression sets. The multi-value-return arc closed this row: ParseOID returned an EMPTY OID beside a nil error until the return-operand spill landed, and parsePublicKey/parsePKCS8PrivateKey forwarded a VALUE into any where Go holds *ecdh.PublicKey. 17 of the 540 skip identically on both sides. · linux: 523 + 9 · darwin: 516 · proof
database/sql 141 2 The connection pool and the driver contract end to end — DB/Conn/Tx/Stmt/Rows lifetimes against the fakedb driver; idle/open limits and connection reuse under concurrency; context cancellation and the ErrBadConn retry loop; prepared-statement dependency tracking and close ordering; and the convertAssign scan matrix through the reflection bridge (driver.Valuer, sql.Scanner, RawBytes, user-defined types). TestConnRaw measured the frame re-raise: a callee’s finally re-raising a panic it never caught truncated Conn.Raw’s deferred release, so the connection stayed open and the test spent the package’s entire deadline on a poll that could not come true. Two alloc-count disclosures: one deferred, one alloc-count-semantics. · linux: 141 + 2 · darwin: 141 + 2 · proof
database/sql/driver 1   The driver Value contract — IsValue/IsScanValue over every convertible Go kind and the default converter’s integer-range and pointer-indirection rules. · linux: 1 · darwin: 1 · proof
debug/buildinfo 211   Build-info extraction from real linked binaries — the ELF/Mach-O/PE/XCOFF reader matrix over the package’s own testdata executables, and the blob scan repeated at every start offset. · linux: 211 · darwin: 211 · proof
debug/dwarf 41   DWARF debug info — the whole type graph (basic, struct, array, pointer, typedef including a cycle, qualified, unsupported), bit fields and DWARF 4/5 bit offsets, line tables across GCC/Clang and zstd-compressed sections, ranges/rnglists, split and type units. Its reader satisfies an anonymous interface via a pointer-receiver method promoted from an exported value embed — the shape whose absent promotion made the run-time method set incomplete. · linux: 41 · darwin: 41 · proof
debug/elf 32   ELF objects, executables and core files — the header/section/program-header walk over 32- and 64-bit fixtures; symbol tables; DynValue; NOBITS sections; zlib-compressed debug sections in both the GCC .zdebug and gABI SHF_COMPRESSED spellings; the >65280-section overflow path that moves the counts into section 0; and DWARF relocation application across twenty compiler/architecture testdata objects (GCC 4.2 through 9.3 and Clang, over x86, ARM, AArch64, MIPS/MIPS64, PPC/PPC64LE, RISC-V, s390x and SPARC64). The wall was one line, _ = net.ResolveIPAddr, which Go writes to force dynamic linkage: a discard whose right-hand side is a method group, the one C# expression form a discard cannot take its type from. · linux: 32 · darwin: 32 · proof
debug/gosym 10   Go symbol tables and the pclntab line machinery — LineTable’s PC↔line mapping and Table symbol lookup over a binary the test compiles from its own testdata with the real Go toolchain and then reads back; the Go 1.15 pclntab format read from a gzipped fixture; and package-path splitting for standard-library, remote and generic-instantiation symbol names. The toolchain build runs in testdata relative to the package, so this row waited on the converted host reproducing a package’s directory ancestry, not only its shape. · linux: 10 · darwin: 10 · proof
debug/macho 7   Mach-O object files — the load-command walk over the thin and fat testdata corpus, dynamic-symbol parsing including a malformed LC_DYSYMTAB, and the relocation/CPU stringer tables. Reached through saferio.SliceCap over a slice of the Load interface, whose Go size unsafe.Sizeof answers from Go’s own layout rule. · linux: 7 · darwin: 7 · proof
debug/pe 10   PE executables and objects — header, section and symbol parsing over the mingw testdata corpus (32- and 64-bit executables and objects, a no-symbols binary, a truncated kernel image); import tables from a real system ws2_32.dll found via the search path; the fuzz-derived malformed-input set (invalid optional-header magic, missing optional header, out-of-bounds symbol slices); and two binaries the test builds with the real Go toolchain and reads back: a DWARF walk that must find main.main at the exact offset the freshly-built program reports about itself at runtime, and a -H=windowsgui build’s subsystem check. The one divergence was the COFF aux-symbol re-view: Go re-types one 18-byte record as two struct shapes through unsafe.Pointer, a free cast over identical Go layouts, but the managed layout pun handed the aux shape’s blank _ [3]uint8 the source’s 8-element Name array reference. Hand-owning the symbol reader pair (symbol_impl.cs) to transcribe the Go layout explicitly closed it, and leaves File.COFFSymbols holding exactly the field values Go’s memory holds. TestBSSHasZeros skips identically on both sides (no gcc on the host). · linux: 10 · darwin: 10 · proof
debug/plan9obj 2   Plan 9 a.out objects — section table and symbol parsing over the testdata corpus, plus the malformed-file error path. · linux: 2 · darwin: 2 · proof
embed/internal/embedtest 7   go:embed end to end over the real embedded file system — a string, a byte slice and an embed.FS, ReadDir/Open/ReadFile across the embedded tree, and the aliasing rule that an embedded byte slice handed to a caller may not be mutated through. · linux: 7 · darwin: 7 · proof
encoding/ascii85 9   Ascii85 encode/decode and streaming wrappers. · linux: 9 · darwin: 9 · proof
encoding/asn1 55   DER marshal/unmarshal end to end — tag and class handling including SET vs SEQUENCE, asn1:"…" struct-tag parameters read through the reflection bridge, unexported-field guards probing settability, big.Int/bit-string/OID/UTC-time round-trips, and a full certificate walk. Closed by three complementary fixes across two machines (defined-type Name(), StructField.PkgPath, array dims). · linux: 55 · darwin: 55 · proof
encoding/base32 26   Base32 round-trips; io.Pipe rendezvous over the real channel core. · linux: 26 · darwin: 26 · proof
encoding/base64 17   Base64 round-trips; goroutine + time.After timer path. · linux: 17 · darwin: 17 · proof
encoding/binary 143 3 Reflection-driven Read/Write — the bridge’s construction/write-back surface. · linux: 143 + 3 · darwin: 143 + 3 · proof
encoding/csv 71   CSV parsing; wrapped-error errors.Is through the reflection bridge. · linux: 71 · darwin: 71 · proof
encoding/gob 106   Go’s self-describing binary serialization end to end — the encoder and decoder engines over every kind gob transmits, wire type-graph construction and the Register/GobEncoder/GobDecoder/BinaryMarshaler interface paths, indirection and recursive types, cross-type compatibility and the malformed-input regression set. Its last divergence, TestIgnoreDepthLimit, was the arc that put reflect.ArrayOf and reflect.StructOf in the bridge: the test builds a 101-deep nested array and a 101-deep nested struct at RUN TIME, so the row could not close until a Go type nothing declared could be constructed. 5 of the 106 skip identically on both runtimes. · linux: 106 · darwin: 106 · proof
encoding/hex 12   Hex encode/decode and error paths. · linux: 12 · darwin: 12 · proof
encoding/json 550   JSON end to end — the Marshal/Unmarshal tables over the 40-field All fixture, struct-tag naming and options including ,string and omitempty, embedding with Go’s full dominance rules, Marshaler/Unmarshaler/TextMarshaler dispatch at every depth, RawMessage, Number, the streaming Encoder/Decoder with Token/More, Compact/Indent/HTMLEscape, and the cycle, depth and malformed-input error sets. Nearly every case is a reflection walk checked against Go’s own answer, making this suite the reflection bridge’s broadest proof: ten of its roots were found here, and the last was a map entry read without its element type. · linux: 550 · darwin: 550 · proof
encoding/xml 393   XML end to end — the Decoder’s tokenizer over the whole grammar (nested elements, CDATA, directives, comments, processing instructions, character and HTML entities, CharsetReader, RawToken/Skip/InputOffset, and the syntax-error line/column set), namespace resolution and prefix scoping in both directions, Marshal/Unmarshal over the struct-tag grammar (XMLName, attr, chardata, cdata, innerxml, comment, omitempty, a>b>c nesting, any), Marshaler/Unmarshaler and their Attr/Text variants at every depth, EncodeToken streaming with its well-formedness rules, and the CVE and disallowed-character regression sets. The row is one long reflection walk checked against Go’s own answer, which is why its last root was a reflect.DeepEqual that could not see a NAMED byte slice’s backing array — CopyToken really did clone its buffer, and the comparison said otherwise. · linux: 393 · darwin: 393 · proof
encoding/pem 18   PEM block parsing and round-trips. · linux: 18 · darwin: 18 · proof
errors 80   errors.Is/As/Join — reflection-bridge write-back (Value.Set, addressability). · linux: 80 · darwin: 80 · proof
expvar 11   The exported-variable registry — Int/Float/String/Map/Func publication and atomic update, Map key ordering with delete/init, JSON quoting across every rune class, and the /debug/vars handler. · linux: 11 · darwin: 11 · proof
flag 24   Command-line flag parsing end to end — definition, Set and Parse across every builtin flag type at its range and overflow boundaries, FlagSet isolation, ContinueOnError/ExitOnError handling, the Value/Getter/Func/BoolFunc/TextVar interfaces, redefinition and invalid-name panics, -h/-help behaviour, and PrintDefaults/Usage output byte for byte. TestDefineAfterSet matches .*/flag_test.go:.* against the file runtime.Caller reports, an assertion the position map put in reach: the frame names Go’s own source, not the converted .cs. · linux: 24 · darwin: 24 · proof
fmt 62 1 Formatted I/O end to end — the whole Printf verb matrix over every kind with its width/precision/flag combinations, Formatter/Stringer/GoStringer/error dispatch and its recursion guards, %v/%+v/%#v of nested structs, maps (ordered by internal/fmtsort), slices, funcs, pointers and typed nils, the Append*/Fprint* and Sscan* surfaces, and the panic-in-String and bad-verb error texts byte for byte. The reflection bridge’s deepest test: %v and %T ARE reflect walks, so every row is a descriptor read checked against Go’s own answer. The behavioral suite’s ~520 stdout comparisons all run through this package, so banking it strengthens each of them. · linux: 62 + 1 · darwin: 62 + 1 · proof
go/ast 36   The Go syntax tree — comment maps and doc association, FilterFile/FilterPackage deduplication, Walk/Preorder traversal with early break, and ast.Fprint’s reflective dump of a parsed tree (map iteration and unnamed struct types through the reflection bridge). Go 1.26 folded go/ast/internal/tests into this package: its one top-level test, TestSortImportsUpdatesFileImportsField, is declared here now, and the second proof link is that package’s earlier record. · linux: 36 · darwin: 36 · proof · proof
go/build 57 1 The build-context resolver — Import/ImportDir over the real GOROOT tree, the +build and //go:build readers across the whole TestShouldBuild matrix, MatchFile with the GOOS/GOARCH filename rules, the cgo and binary-only paths, TestDependencies walking the standard library’s own dependency policy, and TestVendorPackages. The disclosed row, TestLocalDirectory, calls os.Getwd() and asserts that ImportDir names the result "go/build", which requires cwd to sit under the GOROOT the process REPORTS. The host runs every suite in a sandbox so a test may write without touching the real tree; ImportDir then finds no known root and honestly answers ".". The ancestry view deliberately does not repoint GOROOT: a directory walk does not descend into a junction, so repointing would regress compress/gzip and path/filepath (measured: 0 *.gz under a mirrored root against the real 4). Same root as internal/coverage/cfile’s disclosed row, manifesting differently. · linux: 57 + 1 · darwin: 57 + 1 · proof
go/build/constraint 89   Build-constraint expression parsing. · linux: 89 · darwin: 89 · proof
go/constant 9   Exact-precision Go constant arithmetic — the int/rational/float representation ladder, Make/Bytes round trips, BitLen, and the full binary/unary operator and comparison matrix. · linux: 9 · darwin: 9 · proof
go/doc 90   The godoc extractor — New/NewFromFiles building a Package from a parsed AST over the whole testdata package corpus, in all three modes (default, AllDecls, AllMethods), against golden renderings: each of the 19 fixture packages contributes three verdicts. Also exercises type/method/field association including embedded and promoted methods, the exported-filter and blank-identifier paths, error-type recognition, generics with type parameters and constraints, Synopsis extraction, import-group detection, and TestClassifyExamples/TestExamples, which map Example* functions onto the identifiers they document. Its one runnable example, ExampleNewFromFiles, is deferred with every other Example and never factors into the row. · linux: 90 · darwin: 90 · proof
go/doc/comment 10059   Doc-comment parsing and re-printing to text/markdown/HTML over the whole testdata corpus, plus a sweep over every doc comment in the converted standard library’s Go sources — 10,000+ subtests. · linux: 10059 · darwin: 10059 · proof
go/format 4   gofmt’s public entry points — format.Source on whole files and partial fragments, and format.Node’s no-modify guarantee over a parsed AST. · linux: 4 · darwin: 4 · proof
go/importer 3   The compiler-keyed importer front end — ForCompiler’s dispatch for source, gc and gccgo, including the custom-lookup path. · linux: 3 · darwin: 3 · proof
go/internal/gccgoimporter 4   The gccgo export-data importer — the .gox type-parser matrix (aliases, complex constants, escape info, notinheap, pointer and interface shapes) and the ELF archive reader that finds export data inside a .a member. The two gccgo-installation tests skip on both sides exactly where Go’s do. · linux: 4 · darwin: 4 · proof
go/internal/gcimporter 638   The gc export-data importer end to end. TestImportStdLib compiles and re-imports all 303 standard-library packages. TestImportTypeparamTests compiles each of GOROOT’s test/typeparam programs, imports the result, and requires the imported package to describe every exported object EXACTLY as a from-source go/types type-check of the same file does — a differential test of the converted CHECKER against the converted IMPORTER. This package priced the type-parameter identity wall: 399 of 583 at first census, 475 once an interface map key compared by Go equality, and all 583 once an embedded struct stopped being a shared box. · linux: 636 · darwin: 636 · proof
go/internal/srcimporter 7   Type-checking GOROOT FROM SOURCE — TestImportStdLib runs the converted go/types over every standard-library package’s real sources, so a single checker defect anywhere in the language surfaces here as a failed import. TestImportedTypes pins the resulting objects; the issue tests cover import cycles, unsafe and re-import identity. On Linux, Go’s own suite passes under both CGO_ENABLED=0 and =1, and the Linux count equals the Windows one; an earlier Linux oracle failure of TestImportStdLib was a host state since cleared. · linux: 7 · darwin: 7 · proof
go/parser 183   The Go parser end to end — the valid and error corpora, the ParseFile/ParseDir/ParseExpr entry points, identifier resolution into scopes, and TestParseDepthLimit/TestScopeDepthLimit, which deliberately drive nesting to Go’s own maxNestLev of 100,001 levels. That is about 400,000 converted frames, which sized the host’s per-test stack reservation to Go’s 1 GB ceiling. Its package initializer reads the sibling go/printer’s sources, so it also proved the ancestry view. · linux: 183 · darwin: 183 · proof
go/printer 45   The Go pretty-printer — the golden-file corpus (declarations, expressions, generics, comments, //go:build lines), comment placement and bad-node recovery, CommentedNode, and base-indentation modes. · linux: 45 · darwin: 45 · proof
go/scanner 12   Go’s lexical scanner — the whole token and literal matrix, automatic semicolon insertion, //line directive handling (valid and invalid), ErrorList collection with its sort and one-per-line dedup, and CR stripping in raw strings. · linux: 12 · darwin: 12 · proof
go/token 36   FileSet/Position machinery; a full encoding/gob serialization round-trip — the reflect type-relation mirrors driving real Encoder/Decoder engines. · linux: 36 · darwin: 36 · proof
go/types 597   The Go type-checker end to end. TestCheck, TestSpec and TestFixedbugs run the language’s own conformance corpora file by file; the converted checker must report exactly the errors Go reports, at exactly the positions. TestStdlib type-checks all of GOROOT from source. TestSizeof asks reflect for the amd64 size of every type and object node, making the reflection bridge’s Go layout walk a first-class assertion, not an implementation detail. It priced the walk’s one process-killing defect: a managed reference classified as a struct, which sent the walk into the BCL’s cyclic object graph. · linux: 597 · darwin: 597 · proof
go/version 3   Go version-string comparison. · linux: 3 · darwin: 3 · proof
hash 18   The hash.Hash contract — encoding.BinaryMarshaler/BinaryUnmarshaler state round-trips across every standard-library digest (adler32, crc32/64, the six FNV widths, md5, sha1, and the six SHA-2 variants). · linux: 18 · darwin: 18 · proof
hash/adler32 9   Adler-32 checksum. · linux: 9 · darwin: 9 · proof
hash/crc32 17   CRC-32 including real SSE4.2/PCLMULQDQ hardware paths via managed intrinsics. · linux: 17 · darwin: 17 · proof
hash/crc64 12   CRC-64 checksum tables. · linux: 12 · darwin: 12 · proof
hash/fnv 62   FNV-1/FNV-1a across widths. · linux: 62 · darwin: 62 · proof
hash/maphash 66   Seeded and unseeded hash streams, plus SMHasher avalanche/BIC quality checks whose 100,000-sample bounds exercise a float constant computed from a named untyped integer constant. · linux: 66 · darwin: 66 · proof
html 3   HTML entity escaping and unescaping — the 2,138 single-rune and 91 two-rune named-entity tables walked longest-match-first, with and without the trailing semicolon; numeric references in decimal and hex, with the Windows-1252 replacement table and the early-termination edges; and an Unescape(Escape(s)) == s round trip. Its hot path is what the array-zero-length fix bought: entity2[name] is a map whose VALUE is a [2]rune, so a miss returns the zero array and the very next expression indexes it. That index panicked while the map-miss zero carried no Go array shape. · linux: 3 · darwin: 3 · proof
html/template 265   Contextual auto-escaping, the security property html/template exists for: the escaper’s state machine across HTML text, attributes, comments, <script>, <style>, URLs and JS string/regexp contexts, each with its own escaper and filter; the Content typed-string exemptions; template cloning, redefinition and {{block}} composition through the escaper; and the error matrix. Its verdicts ride the whole text/template engine, making it the roster’s largest single consumer of the reflection bridge’s value plumbing. · linux: 265 · darwin: 265 · proof
image 8   The image model — Rectangle algebra, the At/Set/SubImage/Opaque contract over every concrete image type, RGBA64Image 16-bit access, YCbCr plane geometry and non-overlap, and image.Decode through the registered-format table. · linux: 8 · darwin: 8 · proof
image/color 10   The color models — RGBA/CMYK/YCbCr conversion round-trips and cross-model consistency, alpha-premultiplied NYCbCrA, and the palette’s nearest-color search. · linux: 10 · darwin: 10 · proof
image/draw 9   Porter-Duff compositing over every image model — clip narrowing through address-taken value parameters, Floyd-Steinberg dithering, and paletted quantization. · linux: 9 · darwin: 9 · proof
image/gif 28   GIF encode/decode over the real LZW coder — interlacing, transparency and palette edge cases, animation loop counts and per-frame disposal, and image.Decode reading a PNG through a blank import’s registration. · linux: 28 · darwin: 28 · proof
image/jpeg 19   Baseline and progressive JPEG decode/encode — forward and inverse DCT against a reference implementation, zig-zag tables, restart markers, truncated and extraneous scan data, grayscale and CMYK, and a full encode/decode round trip over the shared image/testdata fixtures. · linux: 19 · darwin: 19 · proof
image/png 28   The PNG codec end to end — the full PNGSuite decode corpus (every bit depth, palette, interlacing and transparency form) against its .sng goldens, Paeth filtering, malformed-stream error paths, and an encode/decode round trip whose RGBA→NRGBA row conversion writes through a slice-to-array pointer. · linux: 28 · darwin: 28 · proof
index/suffixarray 12   SAIS suffix-array construction in both 32- and 64-bit index widths, verified exhaustively over every string up to length 8 on 2- and 3-letter alphabets, plus lookup, regexp FindAllIndex, and gob save/restore round trips. · linux: 12 · darwin: 12 · proof
internal/abi 1 1 Runtime ABI helpers (FuncPC). · linux: 1 + 1 · darwin: 1 + 1 · proof
internal/buildcfg 4   Toolchain build configuration — GOARM64/GOAMD64 feature-level parsing and the gogoarch build-tag set. · linux: 4 · darwin: 4 · proof
internal/chacha8rand 4   The ChaCha8 generator behind math/rand/v2 and the runtime’s per-m source. TestOutput walks the package’s own vector through Next/Refill; TestMarshal marshals and unmarshals the state before every single draw; TestReseed proves reseeding moves it; TestBlockGeneric compares the two block implementations word for word. That last row is the array-SHAPE reinterpret: Go’s block_generic computes IN PLACE through (*[16][4]uint32)(unsafe.Pointer(buf)), a rank change no managed nested-array view can reconstruct. So it and setup are hand-owned over a MemoryMarshal.Cast alias of the same storage, kept independent of the assembly-replacing block (down to reusing the package’s own auto-converted qr) so the test still compares two implementations, not one against itself. · linux: 4 · darwin: 4 · proof
internal/coverage/cfile 16   The coverage runtime’s file side — ProcessCoverTestDir reading meta and counter files, the emit APIs driven through a real subprocess harness (TestCoverageApis builds and runs a covered binary per sub-case, including the emit-to-directory, emit-to-writer and failing-writer paths), TestApisOnNocoverBinary, and GOCOVERDIR handling. The disclosed row, TestIssue59563TruncatedCoverPkgAll, shells out to the real toolchain twice — go test -coverpkg=all, then go tool cover -func — and looks for a row prefixed internal/coverage/cfile/testdata/issue59563/repro.go. Both subprocesses SUCCEED and the coverage is CORRECT (large at 100.0%, the subject of issue 59563). Measured A/B, the control and the sandbox emit an identical 10280 rows differing by one prefix: outside the reported GOROOT, the toolchain reads the staged src/go.mod as an ordinary module named std and qualifies every path. Same root as go/build’s disclosed row, manifesting differently. · linux: 15 + 1 · proof
internal/coverage/cformat 2   Coverage report formatting — per-function and per-package percentage rollups, and the empty-package edge. · linux: 2 · darwin: 2 · proof
internal/coverage/cmerge 2   Coverage counter merging — the saturating-add merge policy and the conflicting-metadata clash path. · linux: 2 · darwin: 2 · proof
internal/coverage/pods 1   Coverage “pod” collection — grouping meta/counter data files on disk by package, over real temp-directory I/O. · linux: 1 · darwin: 1 · proof
internal/coverage/slicereader 1   Coverage slice reader. · linux: 1 · darwin: 1 · proof
internal/coverage/slicewriter 1   Coverage slice writer. · linux: 1 · darwin: 1 · proof
internal/coverage/test 6   The coverage meta-data and counter-data formats round-tripped — writer against reader for both, the empty-package meta case, the appended counter segment, and the decode-literal-flag regression from issue 57942. · linux: 6 · darwin: 6 · proof
internal/cpu 9   The x86 feature-detection tables — the CPUID-derived AVX/AVX2/AVX-512 implication invariants, and the GODEBUG cpu-option machinery reached through getGOAMD64level, whose GOAMD64 build level go2cs answers at the amd64 baseline exactly as Go’s own assembly does for a build with no GOAMD64_vN define. On Linux the two GODEBUG cpu-disable tests (TestDisableSSE3, TestDisableAllCapabilities) run as Go runs them: the converted runtime sets DebugOptions where Go’s cpuinit does (the GOOS list that applies GODEBUG) and processes the options. Feature detection itself stays all-false, because cpuid is an unimplemented asm intrinsic. That default is load-bearing: it routes every feature-gated path to its portable implementation, and enabling real detection would crash on the unimplemented SIMD asm. On Windows both runtimes skip the two tests identically, through the same MustHaveDebugOptionsSupport guard. · linux: 9 · darwin: 9 · proof
internal/dag 6   The dependency-graph language the standard library’s own layering rules are written in — rule parsing, topological order, transpose, and transitive reduction. · linux: 6 · darwin: 6 · proof
internal/diff 13   The unified-diff engine over its testdata corpus — every edit shape from empty-to-full through EOF-newline edge cases. · linux: 13 · darwin: 13 · proof
internal/fmtsort 3   fmt’s map-key ordering — Value.Convert, arithmetically-ordered pointer/channel tokens, -tests init-order relocation. · linux: 3 · darwin: 3 · proof
internal/fuzz 52   Go’s fuzzing engine, the layer below testing’s fuzz targets — corpus-file marshal/unmarshal round-trips over every basic type (float edge cases, rune validity, integer overflow, malformed records, Windows line endings), the byte-slice mutator table, input minimization, and the worker queue. The first package validated through the host’s TestMain flag bridge: its TestMain calls flag.Parse(), which finds the host’s own command line declared on flag.CommandLine exactly as testing.Init() declares -test.*. · linux: 52 · darwin: 52 · proof
internal/godebug 6   The $GODEBUG settings machinery, hand-owned end to end and validated against its own contract. The 12-case parse/override table runs through t.Setenv (later entries override earlier, # names undocumented settings, value#pattern splits). Go layers TWO protocol arms on top: TestCmdBisect runs x/tools’ cmd/bisect against the converted test host binary itself: dozens of spawn-and-classify runs whose value#pattern matchers decide per CALL STACK through the converted internal/bisect over the runtime’s managed traceback surface, hash-stable across processes, converging on exactly the three BISECT BUG lines the test’s own source marks. TestMetrics reads IncNonDefault’s per-name counters back as /godebug/non-default-behavior/<name>:events through the runtime’s metric table (the godebugRegisterMetric shim, the registerPoolCleanup pattern). TestPanicNilRace skips identically on both sides (race-build-only). TestCmdBisect is a line-attribution assertion: the CLR alone would resolve a caller frame to the last JIT mapping before its return address, and full-opt code keeps none per statement, so a frame would land on the previous call’s line; the runtime instead resolves a caller frame at the call it is suspended in, as Go’s pc-1 does (the first call at or after a statement boundary, strictly after any other mapping), and the row runs at the Release + tiering-off default. · linux: 6 · darwin: 6 · proof
internal/godebugs 2   The GODEBUG registry, cross-checked against the world outside the package: every entry must be documented in GOROOT’s doc/godebug.md and have a matching IncNonDefault() call site, found by running go list std cmd through the real toolchain and reading every .go file it names. · linux: 2 · darwin: 2 · · proof
internal/gover 5   Toolchain version ordering. · linux: 5 · darwin: 5 · proof
internal/pkgbits 2   The unified IR bitstream — an encoder/decoder round trip and the version gating that rejects a stream the reader does not implement. · linux: 2 · darwin: 2 · proof
internal/platform 1   One test, a whole toolchain round trip: TestGenerated shells out to go run cmd/dist list -json -broken, unmarshals the port list, renders zosarch.go through a text/template, pipes that through a gofmt subprocess on stdin, and byte-compares the result against the zosarch.go it reads from the working directory. That cwd-relative read is why the row was flagged as a risk and is exactly what it proves: the test host runs beside the package’s staged Go sources, so the file resolves and the generated bytes match Go’s own. · linux: 1 · darwin: 1 · · proof
internal/poll 13   The fdMutex reference-count protocol under real contention — its lock/unlock state machine, the reference-overflow panics, TestMutexStress’s parallel read/write/close ladder and TestMutexCloseUnblock’s blocked-reader wakeup — plus the eofError policy and the fd-initialisation checks over real file, console and COM-port handles. The row is priced honestly: this suite is the protocol-and-policy layer; the os and net rows exercise the FD and netpoll engine beneath it, not this one. · linux: 12 + 1 · darwin: 12 · proof
internal/profile 1   The pprof protobuf codec’s packed varint encoding, round-tripped through the white-box test’s own message implementation. That proved a Go package split across two assemblies still binds its unexported interface methods. · linux: 1 · darwin: 1 · proof
internal/reflectlite 30   The reflection mini-bridge end to end — field walks in Go declaration order, the canonical nil func, Go’s unexported-method and assignability rules one layer down, and channel DIRECTION at every position it is read: through new(<-chan int), off a struct field’s zero, and out of the zero value Zero(typ) fabricates. Its three former chan-direction disclosures pass, which retired that class. · linux: 30 · darwin: 30 · proof
internal/runtime/atomic 16   The runtime’s own atomic substrate — contended And/Or ladders across widths (eight goroutines clearing one word bit-by-bit at 8/32/64 bits), Xadduintptr’s four-million-op parallel totals, CAS-release ordering, and TestStorepNoWB, the store-through-a-bare-unsafe.Pointer probe: the pointer mint retains its source box (FromBox), so the store lands in the very slot the pointer names. TestUnaligned64 skips identically on both sides (64-bit host). · linux: 16 · darwin: 16 · proof
internal/runtime/cgroup 114   The Linux cgroup v1 and v2 parsing the runtime sizes GOMAXPROCS from — CPU limit numbers, /proc/self/cgroup and mountinfo lines (well-formed and malformed), path escaping, and the line reader. Pure parsing over fixtures, so it runs on every OS. · linux: 114 · darwin: 114 · proof
internal/runtime/gc/scan 19   The garbage collector’s span-scanning kernels in their portable Go form — TestScanSpanPackedGo and the TestFilterNil cases over every nil-elimination shape. The AVX-512 variants skip on both sides, as Go skips them on a host without AVX-512. · linux: 3095 · darwin: 3095 · proof
internal/runtime/maps 19 108 The Swiss-table map implementation — group and slot layout, makemap across every capacity hint including the negative and overflowing ones, table growth and its duplicate-key paths, iteration over a growing table, and the probe sequence. The 108 disclosed verdicts are ONE class, runtime-capability: 58 exact-pinned leaves on the Swiss-map internals plus the 50 ancestors they imply, which the pipeline’s parent aggregation discloses without an entry of its own. The pins reach four levels deep (TestTableGroupCount/makemap/n=-1/escape), so the implied set is far larger than the top-level parents alone. · linux: 19 + 108 · darwin: 19 + 108 · proof
internal/runtime/math 1   The allocator’s overflow-checked MulUintptr across its boundary table — the uintptr-typed constant shift whose width decides whether the fast path guards at 2³² or at 1. Its tests moved here, both of them, from runtime/internal/math at Go 1.24. (math shares the base name and is NOT the successor — it takes none of them.) The first proof link is this package’s own record; the second is the earlier package’s, whose figures are that run’s, not this row’s. · linux: 1 · darwin: 1 · proof · proof
internal/runtime/sys 4   The runtime’s own bit intrinsics — Bswap32/Bswap64 and TrailingZeros32/TrailingZeros64 across their full input matrices. Its tests moved here, all 4, from runtime/internal/sys at Go 1.24. (cmd/internal/sys shares the base name and is NOT the successor — it takes none of them.) The first proof link is this package’s own record; the second is the earlier package’s, whose figures are that run’s, not this row’s. · linux: 4 · darwin: 4 · proof · proof
internal/saferio 17   Allocation-capped I/O helpers. · linux: 17 · darwin: 17 · proof
internal/singleflight 5   Duplicate-call suppression — and, in TestDoAndForgetUnsharedRace, 1000 goroutines that must all park inside one Do before it returns. That row was the cooperative scheduler’s whole bill: under the old ThreadPool executor a parked goroutine held shared capacity, so the test climbed a doubling ladder for 28.7 minutes; on a dedicated thread per goroutine it converges at iteration 8 in 1.2 s. · linux: 5 · darwin: 5 · proof
internal/strconv 47   The conversion core strconv now delegates to, moved here at go1.26.10: bool, integer, float and complex parsing and formatting (bit sizes, bases, round trips, the testdata corpora), and the decimal, fixed-point and power-of-ten helpers under them. It is validated together with strconv, whose count is lower by the 16 tests that moved here. It also succeeds the former internal/itoa, whose own tests Go 1.26 removed (the TestItoa and TestUitoa declared here are strconv’s FormatInt tests, namesakes only); that package’s record stays at its Go 1.24.13 page. · linux: 47 · darwin: 47 · proof
internal/sync 106   The concurrent hash-trie map (HashTrieMap) — its operations, bad and truncated hash functions, and concurrent use as a cache. Its tests moved here from internal/concurrent at Go 1.24. The first proof link is this package’s own record; the second is the earlier package’s, whose figures are that run’s, not this row’s. · linux: 106 · darwin: 106 · proof · proof
internal/synctest 59   The bubble runtime behind testing/synctest, new at Go 1.24: Run isolates a goroutine group on its own fake clock, and Wait returns only once every goroutine in the bubble is durably blocked. Timers, time.After and time.Now inside the bubble (reset, stop, reads before and after the deadline), channels and timers that cross the bubble boundary, sync.Cond and sync.WaitGroup waits, iterator pull and push, root and child deadlock detection, and reflect.FuncOf inside a bubble. · linux: 59 · proof
internal/syscall/unix 7   The one test of the Unix syscall helpers that selects on windows/amd64: TestKernelVersionGE and its six version comparisons. Its other tests are Linux-, FreeBSD- or Solaris-only by build tag; until go1.26.10 the package had no test on windows/amd64 at all. · darwin: 8 · linux: 9 · proof
internal/syscall/windows 7   The Windows syscall shims the rest of the corpus is built on, proven at the two points their own suite reaches. TestRunAtLowIntegrity builds a low-integrity primary token (OpenProcessToken, DuplicateTokenEx, then SetTokenInformation writing a TOKEN_MANDATORY_LABEL whose SID is S-1-16-4096), launches a helper subprocess under it through os/exec’s SysProcAttr.Token, and requires the CHILD to report its own integrity SID back. The pass is non-vacuous: the re-exec’d process reads its ACTUAL token, so a token that never dropped fails the compare. This row also named the non-blittable-struct-by-address class through a POINTER field rather than an array field: SID_AND_ATTRIBUTES.Sid converts to a managed ж<syscall.SID> where Windows wants a raw native SID address, so the test file is hand-owned against a blittable NativeTokenMandatoryLabel mirror carrying StringToSid’s opaque native handle as a plain nuint. TestSupportUnixSocket cross-checks SupportUnixSocket() against a real WSASocket(AF_UNIX, SOCK_STREAM, …) attempt under WSA_FLAG_NO_HANDLE_INHERIT, matching on WSAEAFNOSUPPORT/WSAEINVAL. · linux: n/a · proof
internal/syscall/windows/registry 6   Registry key/value CRUD against the real Windows registry — create/open/delete keys, round-tripping all value types (SZ/EXPAND_SZ/BINARY/DWORD/QWORD/MULTI_SZ), environment-variable expansion, and the localized MUI string path through RegLoadMUIStringW against the live time-zone key. Two non-blittable-struct-by-address wrappers reached first here: GetDynamicTimeZoneInformation’s DYNAMIC_TIME_ZONE_INFORMATION mirror and SetDWordValue/SetQWordValue’s explicit byte-buffer construction, both hand-owned against the established remedies. · linux: n/a · proof
internal/sysinfo 1   The CPU brand string the runtime reports, read through the converted internal/cpu name tables. · linux: 1 · darwin: 1 · proof
internal/testenv 7   The capability probes the rest of the standard library’s suites gate on — HasGoBuild/MustHaveExec/MustHaveGoRun consistency, and TestGoToolLocation, which resolves ../../../bin/go from the package’s own directory and requires os.SameFile agreement with exec.LookPath("go"). That test pins both halves of the host’s execution environment: its working directory and its PATH. · linux: 7 · darwin: 7 · proof
internal/trace 187   The execution-trace reader end to end — real trace corpora parsed through the v2 reader (TestReaderGolden’s 21 golden streams open by relative path, the fixture family the single-file bundler fix was proven on); the old-trace (1.11–1.21) format converter over its stress corpora, the suite whose swap corruption rooted the parallel-deref-assignment converter fix; summary/MUD statistics; and TestTraceCPUProfile’s live go run of a profiled testprog, the first consumer of link-staged fixtures (the sandbox compiles real GOROOT sources through a symlink, closing the internal-import class). Three converter/harness arcs met their measure in this one row: sibling-testdata staging, link-staging, and the parallel-assignment family’s third arm. · linux: 191 · proof
internal/trace/internal/tracev1 3   The pre-1.22 execution-trace parser on its own suite — all 12 canned corpora (1.11–1.21 stress, http, fmt and user-task-region streams) parsed and classified good vs deliberately time-unordered, with STW reason strings checked; eight historically parser-crashing corrupted inputs that must error rather than crash; and the bucketed Events container’s whole lifecycle (append across bucket boundaries, iterate, pop until every bucket drops). This parser holds the star-deref-of-call parallel swap (*l.Ptr(i), *l.Ptr(j) = *l.Ptr(j), *l.Ptr(i)) that the parallel-deref-assignment fix closed after the parent internal/trace suite rooted it; this row is the package’s own suite validating clean behind the fix. Go 1.26 renamed the package from internal/trace/internal/oldtrace, whose three tests (TestBuckets, TestCorruptedInputs, TestParseCanned) are this package’s; that package’s record stays at its Go 1.24.13 page. · linux: 3 · darwin: 3 · proof
internal/trace/testtrace 1   The execution-trace test helpers. Its one test, TestConvertDump, is a conversion tool that skips unless -convert names a trace text file, so both runtimes record the same skip. · linux: 1 · darwin: 1 · proof
internal/trace/tracev2 1   The v2 execution-trace wire-format definitions: TestSpecs checks every event’s spec — names, the dt first argument of timed events, data and stack events, and the timed-argument limit. · linux: 1 · darwin: 1 · proof
internal/types/errors 155   Every go/types error code, checked two ways against the real type checker: each code’s documented Example snippet must produce that code, and the codes must stay dense, uniquely named and correctly styled. Its walkCodes type-checks codes.go through go/types.Check on the way in, so this is also the first package to exercise the converted checker over real source. · linux: 155 · darwin: 155 · proof
internal/unsafeheader 6   The runtime’s Slice and String header layouts — TestTypeMatchesReflectType holds them to reflect’s, and TestWriteThroughHeader writes a header field by field and requires the result to alias the original storage. ⚠ Rejoined at Go 1.26.10: excluded as E3 at earlier releases on the premise that all 6 verdicts fail structurally, it now matches all 6 on Windows and on Linux, because a header written through its generated setter commits to the variable it views, so a pass is no longer fabrication. Its rejoin moved the numerator and the implementable denominator by one each, as os/user’s did. · linux: 6 · darwin: 6 · proof
internal/xcoff 3   AIX XCOFF objects — the 32- and 64-bit section and symbol-table readers over the PowerPC testdata executables, big-format archive member enumeration, and the malformed-file error path. · linux: 3 · darwin: 3 · proof
internal/zstd 536   The Zstandard decompressor — FSE/Huffman table construction, the sliding window, xxhash checksums, and 500+ fuzz-corpus round-trips. Two of the 536, TestLarge and TestAlloc, need a zstd binary on PATH and skip identically on both sides without one. A host that has one runs them; TestAlloc asserts exactly zero allocations, so expect it to need an allocation disclosure there. · linux: 536 · darwin: 535 + 1 · proof
io 60 1 The core reader/writer contracts — pipes over real goroutine rendezvous, MultiReader/MultiWriter flattening via runtime.Callers, OffsetWriter on real temp files (os.runtime_rand), and WriteString interface dispatch under -tests renaming. One deferred allocation-count disclosure. · linux: 60 + 1 · darwin: 60 + 1 · proof
io/fs 21   The fs.FS interface family — named-interface runtime shells, fs.Glob deep recursion, dirFS walks. · linux: 21 · darwin: 21 · proof
io/ioutil 28   The deprecated pre-os/io shims — ReadAll/ReadFile/WriteFile, TempFile/TempDir with their bad-pattern and bad-directory matrices, and TestReadDir, which lists the PARENT directory and expects the sibling io package’s own io_test.go there. · linux: 28 · darwin: 28 · proof
iter 28   Pull-style iterators over Seq/Seq2 — Pull/Pull2 run to exhaustion and stopped early at every index, the next-after-stop and double-yield panics with their exact Go texts, and panic and runtime.Goexit propagation from both sides of the handshake (inside next and inside stop). The suite is the corpus’s only direct test of a coroutine control TRANSFER: Go’s newcoro/coroswitch runtime primitives have no managed counterpart, so they are hand-owned onto a real rendezvous (golib’s Coro, bound through a ConditionalWeakTable keyed on the ж<coro> token’s identity); the rest of the package is the faithful conversion. Go’s own asserts pin the goroutine accounting, making this a proof, not a smoke test: TestPull/TestPull2 bracket each phase with exact runtime.NumGoroutine() deltas, so the rendezvous must create, park, resume and retire its goroutine on Go’s exact schedule, and TestPullImmediateStop/TestPull2ImmediateStop require a Pull whose next is never called to leave nothing behind. TestPullDoubleNext/TestPullDoubleNext2 add a GOMAXPROCS(1) scheduling case over runtime.Gosched. · linux: 28 · darwin: 28 · proof
log 23 1 The standard logger — the whole flag matrix (Ldate/Ltime/Lmicroseconds/Llongfile/Lshortfile/LUTC/Lmsgprefix) rendered against regexps, prefix placement, SetOutput/SetFlags/SetPrefix on the package logger and a fresh one, concurrent Output under -race, and the empty-Print newline rule. TestAll pins log_test.go’s own line numbers (63|65) behind the Llongfile/Lshortfile prefixes, the assertion the position map exists to answer; it moved this row, since the file half alone gave log/log_test.go:69, a position in neither tree. One deferred allocation disclosure. · linux: 23 + 1 · darwin: 23 + 1 · proof
log/slog 228 21 Structured logging end to end — the Record/Attr/Value model with the packed-payload Value across every Kind, LogValuer resolution and its cycle guard, Logger/Handler composition through WithAttrs/WithGroup, the built-in JSON and text handlers compared output-for-output over a ~50-case table (escapes, empty groups, ReplaceAttr rewriting, json.RawMessage, TextMarshaler errors), level parsing/marshalling and LevelVar, the log package bridge, and testing/slogtest’s conformance suite against both handlers. Its caller-info tests rooted the -tests pipeline’s internal-test-variant naming defect: an in-package test file compiles INTO its package, so TestCallDepth asserts log/slog.TestCallDepth, where the derivation leaked the converter’s _internal_test class token — a systemic frame-naming bug, fixed rather than disclosed, worth four rows. deferred disclosures cover the ...any/Value boxing the two-word Go interface avoids. TestRecordSource, the founding host-identity row, passes whole: the test host’s runner is modelled as Go’s testing.tRunner in testing.go, so its depth-2 case reads the frame Go reads. Runs at the Release, tiering-off default: runtime.Callers captures a call site and resolves its source position on first read, so the one-second deadline in TestSetDefault does not wait on a symbol file. · linux: 228 + 21 · darwin: 228 + 21 · proof
log/slog/internal/benchmarks 3   The two hand-written slog.Handler implementations log/slog’s benchmarks measure against, checked for correctness, not speed — a minimal text handler’s rendered output byte-for-byte, and an async handler’s ring-buffered Record compared attribute by attribute through slices.EqualFunc over slog.Attr.Equal. · linux: 3 · darwin: 3 · proof
log/slog/internal/buffer 1 1 The pool-allocated byte buffer slog’s built-in handlers render into — the pooled New/Free round-trip with its oversize-discard rule, and the Write/WriteString/WriteByte append path. One alloc-count-semantics disclosure on the zero-alloc pool assert: the deferred Free closure heap-allocates where Go’s escape analysis plus pool reuse stays allocation-free. · linux: 1 + 1 · darwin: 1 + 1 · proof
maps 14   Generic map helpers and iterators. · linux: 14 · darwin: 14 · proof
math 76   The core numeric package — IEEE edge cases, rounding, Inf/NaN. · linux: 76 · darwin: 76 · proof
math/big 248 3 Arbitrary-precision Int/Float/Rat arithmetic — the karatsuba/toom multiplication thresholds, GCD and modular machinery, and string/scan round-trips across bases and formats. TestMulUnbalanced’s MemStats byte budget holds because len/cap of the named slice nat no longer box it on every call. · linux: 248 + 3 · darwin: 248 + 3 · proof
math/big/internal/asmgen 11   math/big’s assembly generator: Test regenerates the arithmetic kernels for each of the ten architectures and requires the output to be byte-identical to the committed .s files. · linux: 11 · darwin: 11 · proof
math/bits 26   Bit-manipulation intrinsics. · linux: 26 · darwin: 26 · proof
math/cmplx 24   complex128 transcendental math. · linux: 24 · darwin: 24 · proof
math/rand 47   PRNG streams, including a child-process race test. · linux: 47 · darwin: 47 · proof
math/rand/v2 36   The v2 PRNG API (PCG, ChaCha8). · linux: 36 · darwin: 36 · proof
mime 17 1 MIME type tables and media-type parsing — the first package through the runtime process-control facade (LockOSThread, registry reads). · linux: 18 + 1 · darwin: 18 + 1 · proof
mime/multipart 53   MIME multipart reading and writing — the part reader’s boundary scanner over slow, truncated and nested streams, ReadForm’s memory/disk spill under the multipartmaxparts/multipartmaxheaders godebug limits, quoted-printable part decoding, and the writer’s boundary generation under concurrent use. A cross-package //go:linkname pull reaches net/textproto’s size-limited header reader; that forwarder closed all 45 of this package’s differential rows at once (L12). · linux: 53 · darwin: 53 · proof
mime/quotedprintable 5   Quoted-printable encoding — the reader’s soft-line-break and hex-escape state machine, the writer’s line wrapping, and an exhaustive encode/decode round-trip. · linux: 5 · darwin: 5 · proof
net 505 3 The network stack, over real sockets throughout — TCP/UDP/Unix dial-listen-accept over IPv4, IPv6 and dual-stack, Conn deadline semantics under concurrent readers, splice/sendfile fast paths, the Windows WSA socket surface through the hand-owned blittable mirrors, interface enumeration over the transcribed IP_ADAPTER_ADDRESSES chain, and the DNS resolver end to end (dnsReadConfig, the message packer, LookupHost/CNAME/MX/NS/TXT/SRV/Addr on both the Go and cgo resolver paths, NXDOMAIN classification against a live resolver). The host must be qualified for this row: Go’s own reference run fails 26 DNS rows while the fec0:0:0:ffff::* IPv6 placeholder resolvers are configured, so every net-family run checks for them first. Three deferred disclosures, all zero-alloc asserts Go meets through escape analysis (TestAllocs over WriteMsgUDPAddrPort/ReadMsgUDPAddrPort, TestTCPReadWriteAllocs over TCP Read/Write, Go 1.24’s new TestIPAppendTextNoAllocs), each read on a DNS-conforming host and pinned against its plan record. ⚠ HOST QUALIFICATION: TestLookupNoSuchHost/LookupHost_NXDOMAIN/default_resolver needs a resolver that answers NXDOMAIN for invalid.invalid. On a network whose resolver answers SERVFAIL the whole family fails on both sides, and Go’s own pass there is intermittent, so a Go=pass / C#=fail reading on such a network is an oracle flake, not a conversion fact. On a conforming resolver both sides pass, on Windows and on Linux. It is the same host-qualification class as the IPv6 placeholder resolvers above, so the row carries NO disclosure for it, and the validation host is qualified instead. The macOS count is validated under the agreement rule: the two mac runners’ resolvers differ, so 10 keys read Go pass / C# pass on osx-arm64 and Go fail / C# fail on osx-x64 – TestLookupNoSuchHost/LookupHost_NXDOMAIN, TestLookupNoSuchHost/LookupHost_NXDOMAIN/forced_go_resolver, TestLookupNoSuchHost/LookupNS_NXDOMAIN, TestLookupNoSuchHost/LookupNS_NXDOMAIN/default_resolver, TestLookupNoSuchHost/LookupNS_NXDOMAIN/forced_cgo_resolver, TestLookupNoSuchHost/LookupNS_NXDOMAIN/forced_go_resolver, TestLookupNoSuchHost/LookupTXT_NXDOMAIN, TestLookupNoSuchHost/LookupTXT_NXDOMAIN/default_resolver, TestLookupNoSuchHost/LookupTXT_NXDOMAIN/forced_cgo_resolver, TestLookupNoSuchHost/LookupTXT_NXDOMAIN/forced_go_resolver – and on each RID Go == C# on every one, with 552 matched and 3 disclosed on both; the converted code mirrors the oracle on each architecture, which is what the agreement rule asks. · linux: 596 + 3 · darwin: 552 + 3 · proof
net/http 1526   HTTP client and server, dual-tested in h1 and h2 (real ALPN-negotiated TLS) mode across nearly every case. Server: Serve/Handler dispatch, the pattern-based ServeMux router (method/host/wildcard segments; routing_index/routing_tree’s own suites), graceful Shutdown and its in-flight-connection drain, chunked and identity transfer-encoding, and the WriteTimeout/ReadTimeout deadline machinery. Client/Transport: Do’s redirects and cookie jar, persistConn pooling with idle-connection reuse/eviction, proxy dialing, and the request/response read/write paths, all over real loopback sockets. The bundled HTTP/2 stack (h2_bundle.cs, ported near-verbatim from x/net/http2) carries its own frame, flow-control and stream-lifecycle suite within this row. At Go 1.24 part of the suite runs inside testing/synctest bubbles (fake time, durable blocking); those verdicts agree because internal/synctest is hand-owned over golib’s bubble and park seam. TestTransportGCRequest’s 7 rows stay gated (codegen-liveness: the finalized object is stored into a wrapper’s field and read back through it, as persistConn.readLoop does) and are claimed by neither side. Two behaviours of the optimizing JIT (tiering off) are handled for this row. TestRegisterErr asserts a registration site captured by runtime.Caller(3), a fixed frame-depth walk, which inlining the walked chain (ServeMux.Handle → register → registerErr) would shift by one frame, so the converter keeps every in-package frame inside a constant Caller/Callers skip window out of inlining. And TestMain’s goroutine-leak check must not count unique’s map-cleanup goroutine even when the runtime frame executing its go is elided, so golib classifies a goroutine by its start function, as Go does (gp.startpc). The row runs at the Release + tiering-off default on both platforms. The Go 1.23.12 record is the write-once 1.23.12.3/net.http.md. · linux: 1526 · darwin: 1526 · proof
net/http/cgi 39 1 RFC 3875 CGI on both sides of the process boundary, and every host-side verdict is a REAL process spawn: Go’s suite makes the test binary its own CGI child (Path: os.Args[0], dispatched by cgi_main.go on the SCRIPT_NAME/PATH_INFO it receives). TestHostingOurselves states the shape: one binary, two roles, a live httptest server in front. So each row exercises Handler.ServeHTTP marshalling a request into the CGI environment, a real child process reading it back and replying, and the parent parsing the reply. Host side (host.go): environment construction and its TestCGIEnvIPv6, working-directory (TestDir) and explicit-Env (TestEnvOverride) variants; removeLeadingDuplicates; the httpoxy mitigation (TestDropProxyHeader: a request’s Proxy: header must never reach the child as HTTP_PROXY); PATH_INFO/SCRIPT_NAME splitting across three root shapes; identity and chunked POST bodies; external (TestRedirect) and internal (TestInternalRedirect) Location; child stderr routing; duplicate response headers; a nil request body; and the malformed-child error matrix (Test500With*: no headers, empty headers, missing Content-Type). Child side (child.go): Request() rebuilding an http.Request from the CGI environment, including TLS detection and the degraded cases where HTTP_HOST, REMOTE_PORT or REQUEST_URI is absent, plus Serve’s content-type sniffing across four body shapes. One disclosure, TestCopyError (runtime-capability): its handlerRunning() probe greps a whole-process goroutine dump for another goroutine’s ServeHTTP frame, and runtime.Stack’s all parameter degrades to the calling thread by documented design (the CLR has no supported cross-thread stack walk), so the probe is structurally false. The passing sibling TestKillChildAfterCopyError proves the guarded copy-error-kills-the-child behavior on the same run. · linux: 39 + 1 · darwin: 39 + 1 · proof
net/http/cookiejar 17   The in-memory RFC 6265 cookie jar, driven by Go’s scripted jarTest engine: each scenario is a sequence of set-and-query steps asserting the jar’s full sorted content and per-URL cookie selection. Covers creation, update, deletion and expiration semantics (TestBasics, TestUpdateAndDelete, TestExpiration); host-only vs domain cookies, with the public-suffix guard from an injected test PublicSuffixList (a local table, no network); the Chromium-compatibility matrices across secure/path/domain selection and cross-domain deletion; host canonicalization through the package’s own punycode encoder (TestPunycode, TestCanonicalHost); jar-key derivation with and without a suffix list; default-path computation; and the issue-19384 empty-host regression. · linux: 17 · darwin: 17 · proof
net/http/fcgi 12   The FastCGI record protocol end to end — the child’s record dispatch and FCGI_GET_VALUES reply, multiplexed request streams over a shared connection, the ResponseWriter’s content-type sniffing, and a served request torn down mid-flight. · linux: 12 · darwin: 12 · proof
net/http/httptest 62   The HTTP test-server and response-recorder harness. A harness is only as real as the server under it, so this is also a running proof of the converted net/http: TestServer alone stands up four server flavors (NewServer, NewTLSServer, and each one’s hand-assembled Unstarted equivalent) on real loopback listeners and drives 19 verdicts through them — client transport selection, Close blocking with a request in flight, CloseClientConnections, and requests issued after close. TestTLSServerWithHTTP2’s http2 subtest asserts the server observes HTTP/2.0: the bundled HTTP/2 stack negotiates over ALPN on a real TLS socket and both ends agree. The rest is ResponseRecorder’s recording semantics (implicit 200, first-code-only, sniffed vs explicit Content-Type, Content-Length, trailers, flush, nil Body, the HeaderMap-vs-Result split, the panic matrix for non-3-digit codes) and NewRequest’s URL, method and body-length inference. · linux: 62 · darwin: 62 · proof
net/http/httptrace 2   HTTP client instrumentation hooks — the first row whose verdicts run THROUGH reflect.MakeFunc: compose walks ClientTrace’s func-typed fields with reflect and, where both traces set a hook, replaces the field with a MakeFunc-made func value that Calls both. TestWithClientTrace layers two traces through the context (WithClientTrace/ContextClientTrace) and asserts the composed ConnectStart fires newest-then-oldest; TestCompose drives the composition matrix directly across per-field overrides. · linux: 2 · darwin: 2 · proof
net/http/httputil 62   ReverseProxy and the request/response dumpers. A proxy is two HTTP implementations facing each other; nearly every row runs a real httptest backend behind a real httptest frontend over loopback sockets. Covers hop-by-hop header stripping and Connection-listed variants, X-Forwarded-For append vs omit, the Director and Rewrite configurations with the four query-parameter-smuggling regressions that separate raw query preservation from form parsing, ModifyResponse and ErrorHandler across their four-way matrix, flush-interval selection over seven server-sent-event and Content-Length: -1 cases, buffer pooling, unannounced trailers, 1xx informational responses via httptrace, and panic propagation with the incoming body closed. TestReverseProxyWebSocket and its cancellation sibling carry a full protocol upgrade through the proxy, hijacking connections in both directions: the row’s strongest statement about the converted socket layer. The dumpers round-trip DumpRequest/DumpRequestOut/DumpResponse over the same servers, including the issue-38352 canceled-request deadlock regression. · linux: 62 · darwin: 62 · proof
net/http/internal 14 1 HTTP chunked transfer-encoding end to end — the chunked reader/writer round-trip across partial, multiple and byte-at-a-time reads, hex chunk-size parsing with its overflow and empty-value error matrix, the incomplete-chunk and end-read error paths, the malicious-sender overhead detector, and the bare-LF rejection matrix (TestChunkInvalidInputs, four subtests) that hardens the reader against request smuggling. One deferred disclosure on the interface-shell allocation. · linux: 14 + 1 · darwin: 14 + 1 · proof
net/http/internal/ascii 13   ASCII case-insensitive helpers. · linux: 13 · darwin: 13 · proof
net/http/pprof 15   The HTTP handlers behind /debug/pprof — the index page and its descriptions, cmdline, symbol, a one-second CPU profile, the execution trace, the heap, goroutine, block and mutex profiles, and TestDeltaProfile’s ?seconds= delta over a live mutex hog, which reads the mutex events the hand-owned sync.Mutex records. · linux: 15 · darwin: 15 · proof
net/mail 11   RFC 5322 mail message parsing end to end — the address-list grammar across quoted strings, comments and folding white space, RFC 2047 encoded-words in B and Q form with a custom WordDecoder, group syntax, obsolete and malformed input through a shared error matrix, the Address.String() round trip back through the parser, and Date header parsing including the CFWS-bearing forms. Its verdicts ride on net/textproto’s reader and mime’s word decoder. · linux: 11 · darwin: 11 · proof
net/netip 211 57 The IP-address value types end to end — Addr/Prefix/AddrPort across the full parse/format matrix (IPv4, IPv6, zones, 4-in-6, and the ParseAddr/ParsePrefix/ParseAddrPort error tables), the uint128 arithmetic underneath, As4/As16/AsSlice conversions, Compare/Less ordering with sorted round-trips, prefix masking/containment/overlap, and binary/text/JSON marshal round-trips. TestInlining passes for real: it drives the actual Go toolchain (go build --gcflags=-m) through the converted os/exec/testenv plumbing and reads back the compiler’s own inlining report. The 57 disclosed rows are three AllocsPerRun families (TestNoAllocs, TestAddrStringAllocs, TestParsePrefixAllocs): want-0/want-1 asserts Go meets by stack allocation and inlining where the converted path measurably heap-allocates, each leaf pinned on its own counter line. They are the zh-box reduction arc’s named netip harvest and retire as that arc lands. · linux: 211 + 57 · darwin: 211 + 57 · proof
net/rpc 15   The RPC server and client. Where net/rpc/jsonrpc below uses an in-memory net.Pipe, every row here runs against a real net.Listen("tcp", "127.0.0.1:0") server, and the HTTP half dials an httptest.NewServer, so the gob codec, the reflection-driven method dispatch and the converted socket stack are live at once. Covers service registration’s signature validation (unexported argument types, non-pointer replies, methods that are not RPC-shaped), the Arith round trip over the direct and DialHTTP transports on two independently registered servers, the builtin map/slice/array reply types, Go’s asynchronous calls, and the teardown matrix (Accept returning after its listener closes, client close racing an in-flight call, codec close, write errors, gob encode failures, the send-deadlock guard). TestCountMallocs and TestCountMallocsOverHTTP are matched verdicts both runtimes SKIP identically, on Go’s own GOMAXPROCS>1 gate rather than a converted-runtime limitation, so neither is a disclosure. · linux: 15 · darwin: 15 · proof
net/rpc/jsonrpc 9   JSON-RPC 1.0 client and server codecs driven through the real net/rpc server over an in-memory net.Pipe — hand-coded request framing, out-of-order concurrent calls, the map/slice/[1]int builtin reply types the server allocates from the method type alone (reflect.New(mtype.ReplyType.Elem()) — the row that made a fixed-size array’s LENGTH reach reflect through a method’s pointer parameter), malformed input and output, and the null-result error path. · linux: 9 · darwin: 9 · proof
net/smtp 20   The SMTP client end to end, and the first roster row over real loopback TCP sockets rather than an in-memory pipe: TestSendMail, TestSendMailWithAuth, TestTLSClient and TestTLSConnState each stand up a net.Listen("tcp", "127.0.0.1:0") (or tls.Listen) server and speak the real dialogue, putting the converted socket stack under test with the protocol. Covers the AUTH mechanisms and their RFC-required TLS/localhost guards (CRAM-MD5, PLAIN, the trailing-space trim, the failure path), HELO-vs-EHLO negotiation with the 8BITMIME and SMTPUTF8 extension advertisements across five subtests, per-command hello-first ordering, and a STARTTLS upgrade whose ConnectionState is read back through the converted crypto/tls handshake against a self-signed certificate. · linux: 20 · darwin: 20 · proof
net/textproto 27   Text-protocol primitives under HTTP/SMTP — MIME header reading with canonicalization (including the want-ZERO AllocsPerRun asserts over the common-header fast path, satisfied by the m[string(b)] transient-key lookup, hoisted big-const masks and Once.Do’s zero-alloc fast path — L11), dot-encoding reader/writer, continued lines, and pipelined request sequencing. · linux: 27 · darwin: 27 · proof
net/url 53   URL parsing, escaping and reference resolution — the query encode/decode matrix including semicolon rejection, userinfo, opaque and relative references, JoinPath, and gob/JSON/TextMarshaler round-trips of a parsed URL. · linux: 53 · darwin: 53 · proof
os 6826 2 The operating-system surface — file creation/open/close over the full O_* matrix, Read/Write/ReadAt/WriteAt/Seek with the closed-file and double-close error paths, Stat/Lstat/Chmod/Chtimes (with the omit and Unix-zero cases), Truncate, Rename, Remove and RemoveAll’s deep and read-only trees, MkdirTemp/CreateTemp and their pattern rules, directory reading through ReadDir/Readdirnames and the DirFS/CopyFS walks, Getwd/Chdir, the environment block end to end (Setenv/Clearenv/Environ consistency), pipes and their close-race paths, Executable(), and the Windows-specific surface: extended-prefix paths past MAX_PATH, app-exec-link stats, and the ErrNotExist/ErrExist mappings behind os.IsNotExist. Two disclosures, both deferred: TestUTF16Alloc (Go’s escape analysis stack-allocates the array literal the converted path heap-allocates today; planned against the string-byte-window record’s mirror arm) and TestWriteStringAlloc (want 0 allocations per run for File.WriteString, reading 4; its named retirement plan is the ж-box capability set). ⚠ HOST CONDITION: TestReadlink with its six symlink_* subtests and TestOpenFileCreateExclDanglingSymlink with its InRoot and NoRoot subtests need symbolic-link creation, which Windows grants under Developer Mode or to a holder of SeCreateSymbolicLinkPrivilege. On the validating host they run and pass on both runtimes, as the proof page shows. On a host without it they fail on both runtimes, agreeing name for name, so they still count as matched although neither side ran the thing under test: an agreeing failure on an ABSENT CAPABILITY masks a question where one on shared semantics answers it, and the matched count alone cannot tell the two hosts apart. TestRemoveAllWithExecutedProcess, which copies the test executable and runs the copy, runs and passes on both sides, because the test host is a relocatable single-file executable. Three declarations are capability-gated and absent from both maps: TestCmdArgs (native output block with caller-side LocalFree), and TestDirectoryJunction and TestDirectorySymbolicLink (raw-metal struct overlay on managed bytes). · linux: 3831 + 2 · darwin: 3736 + 1 · proof
os/exec 117   Running external processes end to end through Go’s own helper protocol, which re-executes the test binary as the child, so every Cmd path runs against a real process tree: pipes and StdinPipe/StdoutPipe teardown, Output/CombinedOutput/Wait, ExtraFiles handle inheritance, environment de-duplication and NUL rejection, LookPath with Windows PATHEXT and ErrDot, exit-status plumbing, and context cancellation with Cancel/WaitDelay including the interrupt-and-hang matrix. The 27 verdicts once disclosed as the roster’s first host-limit entry (TestCommand and TestLookPathWindows COPY the test executable and run the copy, which a framework-dependent apphost could not survive) pass on their own measurement: the -tests host publishes as a self-contained single-file executable, whose lone relocated copy runs exactly as Go’s statically linked binary does, and the entry retired with them per its own self-retiring text. · host-conditional-disclosure (published-host descriptor count): TestExtraFiles · linux: 88 + 1 · darwin: 86 + 2 · proof
os/exec/internal/fdtest 1   The file-descriptor existence probe; its one test is Windows-gated and the converted run reaches Go’s own runtime.GOOS guard and skips exactly where Go does. · linux: 1 · darwin: 1 · proof
os/signal 1   Console-signal delivery (Ctrl+Break) through real channels and select. On Linux the whole POSIX surface validates through the PosixSignalRegistration bridge carrying Go’s sighandler decision: Notify/Stop/Reset/Ignore, the nohup families over inherited SIG_IGN (seeded from real dispositions at start, exactly Go’s initsig), NotifyContext, the stress and timing suites, and TestAllThreadsSyscallSignals matching Go’s own cgo skip via the ENOTSUP hand-own. That skip is the one disclosed row (cgo-configuration). The execution tracer’s TestSignalTrace passes through go2cs’s managed execution tracer. · linux: 30 + 1 · darwin: 30 · proof
os/user 23   Windows account lookup end to end — Current(), Lookup/LookupId by name and by SID string, LookupGroup/LookupGroupId, and the local-group membership walk behind GroupIds(). This is the consumer the native pointer-out arc was built for: NetUserGetInfo and NetUserGetLocalGroups return buffers the kernel itself allocates, and LookupAccountSid appends the SID bytes inside the buffer it fills. That buffer is self-referential, so the transcription anchors it rather than trusting a managed copy; a type-only fix would have passed here and failed intermittently under GC pressure. lookupUserPrimaryGroup, lookupFullNameServer and listGroupsForUsernameAndDomain are hand-converted against those native shapes. · linux: 12 · darwin: 6 · proof
path 9   Pure path manipulation (Clean/Split/Join/Match…). · linux: 9 · darwin: 9 · proof
path/filepath 67   Path algebra plus the Windows symlink machinery — EvalSymlinks through the hand-owned FindFirstFile blittable mirror, Glob/Walk, junction-aware TempDir cleanup, testenv.GOROOT via the pipeline’s exported root, and 20 privilege-gated skips agreeing with Go’s · host-conditional (symlink-creation privilege — the parent test skips before spawning them without it): TestWalkSymlinkRoot/no_slash, TestWalkSymlinkRoot/slash, TestWalkSymlinkRoot/abs_no_slash, TestWalkSymlinkRoot/abs_with_slash, TestWalkSymlinkRoot/double_link_no_slash, TestWalkSymlinkRoot/double_link_with_slash · linux: 54 · darwin: 54 · proof
plugin 1   That a program importing plugin links and starts at all — Go’s own regression test for issue 28789 is an empty body asserting precisely that, and the converted binary runs it. · linux: 1 · darwin: 1 · proof
reflect 445 21 Go’s run-time reflection, the reflection bridge’s own suite: TypeOf/ValueOf over every kind, Kind and String for named, generic and function-local types, struct fields with tags, embedding and VisibleFields, method sets and Method/MethodByName calls, Call and MakeFunc, Set/Addr/CanSet and the settability rules, Convert/CanConvert, DeepEqual, IsZero and Comparable, maps with MapIndex, SetMapIndex and MapIter, channels with Select, Copy and Swapper, the Seq/Seq2 iterators, and the types built at run time by PointerTo, SliceOf, ArrayOf, MapOf, ChanOf, FuncOf and StructOf. The 22 disclosures are runtime capabilities the managed runtime lacks (a pointer compared as a number, GC bitmaps, address arithmetic, write-protected memory, an assembly trampoline), stack-allocation counts (three alloc-count-semantics, and one structural: TestMapIterSet, whose MapIter Go keeps off the heap), and one frame-liveness assert. · linux: 445 + 21 · darwin: 445 + 21 · proof
regexp 45   The full RE2 engine — NFA/backtracker/one-pass executors, the RE2 exhaustive corpus, TextMarshaler round-trips. · linux: 45 · darwin: 45 · proof
regexp/syntax 12   Regexp parsing, simplification and program compilation; named-type constant tables. · linux: 12 · darwin: 12 · proof
runtime 11080 66 The Go runtime’s own suite, run against the managed runtime that replaces it. The scheduler: GOMAXPROCS, synchronous and asynchronous preemption, LockOSThread nesting and exit, goroutine parallelism, timer and semaphore fairness, and deadlock detection. Channels and select: fairness, stress, duplicate channels and the non-blocking races. The collector’s observable surface: finalizers, AddCleanup cleanups and their Stop, Pinner, ReadMemStats, the GC pacer and the memory limit. defer, panic, recover and Goexit in every ordering, with Go-spelled tracebacks and crash reports read back from child processes; Caller and Callers frames; stack growth through deep recursion, overflow and callbacks. Maps across growth, iteration, NaN keys and tombstones (TestMapIterDeleteReplace and its 10,000 subtests are 10,001 of the matched verdicts), the hash functions’ smhasher suite, strings, slices and append’s growth. Windows callbacks in stdcall and cdecl, console control handlers and the crash handler. The page allocator, scavenger, address-range set, ProfBuf, time histograms and debug log, through the runtime’s exported test hooks. 33 tests skip identically on both sides. The 71 disclosures are 33 runtime-capability verdicts (Go’s SEH unwinder, its inline tree, frame-pointer and system-stack walks, GC bitmaps and pointer classes, tiny-allocator and arena layout, the netpoller’s break), 24 deferred (allocation counts, and one live-heap metric the managed host has no Go mark phase to produce), six structural, two codegen-liveness, one host-identity and five aggregate parents of disclosed subtests. · linux: 11091 + 70 · proof
runtime/debug 8 1 The runtime’s own debugging surface. ReadGCStats’ packed pause history (n pauses, n end times, lastGC, numGC, totalPause, most-recent-first) cross-checks against ReadMemStats in nine assertions that hold because both read one shared recorder. SetMaxThreads takes a count past int32 without overflowing the thread limit. Stack() reads back frame by frame (debug.Stack, a pointer method, a value method and the test function, each with its GOROOT source path) down to the test host’s root frame, which prints as testing.tRunner in testing/testing.go. WriteHeapDump, with two finalizers queued and generic instantiations live, writes a well-formed, truthful Go heap dump that is empty: the header, the parameters record and the end-of-dump tag, no objects, because the CLR owns the heap. SetCrashOutput re-executes the test binary, panics inside TestMain, and reads Go’s crash report back from BOTH the child’s stderr and the crash file; that test made every converted program print panic: <value>, a blank line, goroutine N [running]: and a Go-spelled traceback instead of a .NET exception dump. TestSetGCPercent skips on both sides at Go’s own flaky-test gate. The one disclosure is TestFreeOSMemory (codegen-liveness): the 32 MB it expects released is still rooted in the test’s own running frame. On linux TestPanicOnFault is withdrawn from both sides by name as host-fatal, because the CLR cannot recover a hardware fault as a panic. · linux: 8 + 1 · darwin: 8 + 1 · proof
runtime/metrics 2   The runtime metrics table end to end — All()’s sorted-name/regexp contract against doc.go, and a full metrics.Read round trip computing a kind for every published metric through the first linkname push into a _test package, the managed metricsLock, and every stat-aggregate compute closure. · linux: 2 · darwin: 2 · proof
runtime/pprof 146 8 The profiler, working in the managed runtime. CPU profiles single- and multi-threaded, across a fork, with labels and over math/big division; heap and memory profiles with their runtime frames; the goroutine profile’s counts, labels and concurrency, including the snapshot gate that keeps one profile consistent while goroutines start and exit; block-profile bias and the block and mutex full-aggregation rule; Do, SetGoroutineLabels and context label propagation, raced across goroutines; and the profile builder’s proto encoding: /proc/self/maps parsing, fake mappings, empty call stacks and the legacy CPU and memory profile conversions. Two tests skip identically on both sides. The seven disclosures are two compiler-property skips at Go’s own inlining self-check (TestCPUProfileInlining, TestTryAdd); four runtime-capability rows whose frames exist only in the Go compiler’s inline tree and GC-shape names, or on the Go runtime’s system stack and stack-growth path (TestCPUProfileRecursion, TestGenericsInlineLocations, TestLabelSystemstack, TestMorestack); and TestGenericsHashKeyInPprofBuilder, split between a shape-name half and a codegen-liveness half. Six tests that wait for another goroutine’s interior frames in runtime.Stack(all) are withdrawn from both sides by name as host-fatal, because the CLR cannot walk a foreign thread’s stack. · linux: 148 + 8 · proof
runtime/trace 19   The execution tracer, working in the managed runtime: go2cs’s managed execution tracer writes Go’s v2 trace of the goroutine facts, and Go’s own trace parser accepts it — TestTraceStartStop and TestTraceDoubleStart pass on windows and linux. · linux: 19 · darwin: 19 · proof
slices 122 2 The generic slice algorithms over S ~[]E end to end — sort/stable-sort with cmp variants, binary search, Insert/Delete/Replace/Compact/Reverse/Rotate at every boundary, the iterator surface (All/Values/Backward/Collect/Sorted*), and TestConcat_too_large’s overflow matrix, whose make([]struct{}, math.MaxInt) fakes flow through Concat’s Grow chain allocation-free. That matrix is the slice-shaped-spread arc’s own target, the row the arc was priced to unlock (append(s, t...) travels as the slice it is; the Span int32 ceiling left the call boundary). The disclosures are in established classes: TestConcat asserts allocation counts the managed regime cannot denominate in Go mallocs (alloc-count-semantics; byte-derived reading 112, 168 before len/cap of a named slice type stopped boxing, verdict unchanged), and TestInsert’s rotation budget meets the model’s structural heap boxes (deferred, 58 golib objects per run against a want-below-25). TestGrow passes: slices.Grow is append(s[:cap(s)], make([]E, n)...), which the converter lowers to grow in place without materializing the make, so the allocation its assert counts is gone. Its manifest entry stays, unfiring, until the Linux reading is re-taken. · linux: 122 + 2 · darwin: 122 + 2 · proof
sort 63   Interface-driven sort, sort.Slice reflection swaps, NaN-aware ordering, stability. · linux: 63 · darwin: 63 · proof
strconv 39 11 Number↔string conversion at full precision — Ryū/Grisu float formatting, arbitrary-precision decimal shifts, complex parsing; deferred allocation disclosures. · linux: 39 + 11 · darwin: 39 + 11 · proof
strings 68 5 String algorithms; deferred allocation disclosures. · linux: 68 + 5 · darwin: 68 + 5 · proof
sync 48 9 The concurrency crown — Mutex/RWMutex/WaitGroup/Once/Cond/Map/Pool over real parked-thread semaphores, a hand-owned lock-free pool ring, and GC-integrated cleanup; Cond’s copy detector on root-allocation identity. codegen-liveness disclosures cover the TestOnceXGC family. Two more joined at 1.24.13, both alloc-count-semantics: TestMapClearOneAllocation (a rename of 1.23.12’s TestMapClearNoAllocations, its want relaxed 0 → 1) and TestMapRangeNoAllocations. go2cs’s allocation counter charged nothing on either path, so the shim reported BYTES per run, and no object count exists to compare with an object want. · linux: 48 + 9 · darwin: 48 + 9 · proof
sync/atomic 108   The atomic-operations matrix end to end — Load/Store/Swap/CompareAndSwap/Add/And/Or across every width in both function and method forms, the racing hammer suites (4–8 goroutines × 10⁶ iterations per op over one shared word), atomic.Value’s store/swap/CAS semantics with the inconsistent-type and nil panics, Go’s align64 GUARANTEE asserted through reflect (StructField.Offset and Pointer()&7 answering from ONE layout walk, the alignment-truthful token), and TestHammerStoreLoad’s reinterpret of a single uint64 as *int32/*uintptr/*unsafe.Pointer/*atomic.Pointer[byte] in turn. That test made a native-backed pointer slot hold the pointer’s VALUE rather than a managed reference, closing a GC-invisible dangling-reference hazard with it. · linux: 108 · darwin: 108 · proof
syscall 66   The Windows system-call surface — WTF-8/UTF-16 round-trips across the whole surrogate matrix (lone highs, lone lows, paired, and the astral characters between them), EscapeArg’s command-line quoting rules, the environment block, StartupInfo/handle inheritance and permuted-fd process launch, TOKEN_ALL_ACCESS’s version-dependent value, and Getwd over a path far past MAX_PATH (the row that needed a converted process to be long-path aware, as every Go binary is). HOST CONDITION on the Linux count: it is measured on a host lacking two capabilities, and each absence masks a real divergence. Without cgroup2 permission the oracle skips TestUseCgroupFD and the pair matches; on a cgroup2-capable host Go passes it and the converted side skips (our posix_spawn seam does not implement SysProcAttr.UseCgroupFD: a feature gap, never a disclosure). Without a controlling terminal both runtimes skip TestForeground and TestForegroundSignal; with one, both run them and the converted side does not survive. So the count reproduces on a host lacking both and reads lower on a host with either. · linux: 42 + 17 · proof
testing 83 2 Go’s own testing suite, run against the HAND-OWNED Phase-4 test host it exercises: the first row admitted on a defined SUBSET of its own suite. Most of the oracle’s verdicts are structurally excluded, and the proof page lists every one — because the whitebox package testing variant asserts against Go’s own unexported state machine (common, matcher, chattyPrinter), which the host REPLACES rather than implements; because benchmark execution is Phase-4D; race tests counting Go output literals this host never writes (a pass no host defect could move); and two whose parent loops forever waiting for Go’s -test.timeout dump. At Go 1.26.10 the compared set is 85 (83 matched + 2 disclosed), and 9 gated declarations withdraw 55 more verdict rows. Two more join the benchmark bucket by the same Phase-4D rule: TestBenchmarkBLoopIterationCorrect and TestBenchmarkBNIterationCorrect, new with b.Loop, re-exec the binary with -test.bench and count the benchmark’s printed iterations, which a host that defers benchmark execution never prints. What the compared set buys is real: TempDir naming/isolation/cleanup across nine hostile subtest names, Setenv’s restore contract and panic-if-parallel rule through the whole ancestor chain, concurrent and nested t.Run, Cleanup ordering, AllocsPerRun, testing.Testing, and the flag surface end to end. Go’s suite found three real host defects, all three FIXED, not disclosed: t.Run refused from a non-owning goroutine (Go permits it: go.dev/issue/64402), which DEADLOCKED the row at 2 verdicts of 52 until the parent’s parallel-children bookkeeping moved under the lock that makes concurrent Run safe; TempDir mapping the test name through Go’s NAME rewriter instead of its stricter PATH mapper, which broke four leaves on Windows-illegal characters and one on a glob character class; and a declaration in a file the compile set excludes reaching the generated host by name (CS0117). Go 1.24’s suite found a fourth, also FIXED: TempDir re-registers its removal when the parent is already gone (Go’s own nonExistent check), which TestTempDirInCleanup reaches from a user Cleanup. The 2 disclosed are 1 host-identity (TestMorePanic, which re-execs the binary and regexes the child’s terminal text against Go’s --- FAIL: layout: the one-testing-package rule seen through its own output channel) and 1 structural (TestAllocsPerRun). The -test.v tri-state, once the sixteenth and seventeenth, is RETIRED, not carried: Go’s chattyFlag is a real flag.Value, a Go-shaped host type whose implementation of the converted interface golib’s AdapterBinder builds at RUN time from the shells go2cs-gen emits beside it, the tier every cross-assembly structural assertion in the corpus resolves through. So the host still carries no compile-time flag reference (a guard arm asserts exactly that), and both -test.v verdicts are ordinary matched ones. TWO DENOMINATORS over DIFFERENT universes, neither derivable from the other: the verdict counts range over the six test files we carry (allocs, flag, helper, helperfuncs, panic, testing_test, all package testing_test, the EXTERNAL suite); the file ratio is those six of the eleven in Go’s suite. The five absent files’ verdicts belong to NEITHER count (the oracle emits only over files present), so adding the two, or reading the verdict ratio as coverage of Go’s suite, overstates this row. Dispositions, from reading each file with none converted: sub_test.go (15 tests) and match_test.go (4) are package testing and reach Go’s own unexported state machine (constructing &T{}/&B{} with common/chatty/parent/tRunner, or naming newMatcher/matcher), so both are structurally unreachable against a host that REPLACES that machine; export_test.go (11 lines aliasing three unexported helpers) and testing_windows_test.go (2 benchmarks) carry ZERO tests, so their absence costs no verdict; and benchmark_test.go (7 tests, external, public API) is the ONE convertible gap: six of its seven need no shim, the seventh needs export_test.go’s alias, and it touches exactly one absent member of the public surface (B.Elapsed). · linux: 83 + 2 · proof
testing/cryptotest 10   Deterministic randomness for cryptographic tests — SetGlobalRandom seeding rand.Read and rand.Reader, determinism per seed, mlkem.GenerateKey768 and ecdsa.GenerateKey under it, and the cryptocustomrand GODEBUG. · linux: 10 · darwin: 10 · proof
testing/fstest 8   The fs.FS conformance checker and the in-memory MapFS it validates — TestFS walking a tree to cross-check Open/ReadDir/ReadFile/Stat/Glob/Sub and every fs sub-interface for mutual agreement, MapFS’s synthesized directories and FileInfo, symlink resolution through fs.ReadLink/Lstat, the shuffled-order harness that proves ReadDir results are sorted independently of map iteration order, and TestFSWrappedErrors’ errors.Is/As unwrapping contract. · linux: 8 · darwin: 8 · proof
testing/iotest 18   The io testing helpers — the half/one-byte/timeout/error reader wrappers, DataErrReader’s final-read fusion, and the read/write loggers’ log output. · linux: 18 · darwin: 18 · proof
testing/quick 8   Property testing — reflect value generation and Value.Call dynamic invocation. · linux: 8 · darwin: 8 · proof
testing/slogtest 18   The slog.Handler conformance harness Go ships for third-party handlers, run against the real TextHandler/JSONHandler — the whole 17-case matrix of groups, inline and empty groups, WithAttrs/WithGroup composition, and LogValuer resolution. · linux: 18 · darwin: 18 · proof
testing/synctest 18   The bubble API over internal/synctest — Test and Wait driving fake time, timers, context deadlines and AfterFunc, the HTTP transport’s 100-continue wait, and a bubble test’s Error, Fatal, Skip, Cleanup, Context, Deadline, Parallel, Run and Helper behaving as in an ordinary test. · linux: 18 · darwin: 18 · proof
text/scanner 18   Rune-level source scanning. · linux: 18 · darwin: 18 · proof
text/tabwriter 3   Elastic-tab column formatting; panic-during-write recovery. · linux: 3 · darwin: 3 · proof
text/template 53   Go’s template engine end to end — the exec matrix over structs, maps, methods, pipelines and variables; text/template’s own reflection-heavy value plumbing (Value.Call with variadic and method values, Index/Slice/Slice3 over strings and containers, typed-nil rendering); template composition, {{block}} redefinition, html/js/urlquery builtins, and the error and recovery matrix. The last two verdicts were channels: TestExecute ranges a bidirectional chan string through reflect.Value.Recv and needs the recv bridge; TestIssue43065 ranges a make(chan<- int) and needs Go’s range over send-only channel, the direction that had to land with it. · linux: 53 · darwin: 53 · · proof
text/template/parse 52   Template lexing and parse-tree construction — the item stream, custom and alphanumeric delimiters, actions/pipelines/variables, {{block}} and tree copying, and the full parse-error matrix. · linux: 52 · darwin: 52 · proof
time 178   Monotonic and wall clocks, timer/ticker delivery including Go 1.23’s synchronous timer channel, RFC 3339 and layout parse/format, zone loading. · linux: 176 · darwin: 176 · proof
unicode 28   Category tables, case mapping (SpecialCase), script ranges. · linux: 28 · darwin: 28 · proof
unicode/utf16 8 1 Encode/decode round-trips via reflect.DeepEqual. · linux: 8 + 1 · darwin: 8 + 1 · proof
unicode/utf8 14 1 UTF-8 encode/decode — the first suite to pass (2026-07-17). · linux: 14 + 1 · darwin: 14 + 1 · proof
unique 27 12 The interning table — Make/Handle identity and equality across clones, the string-cloning path that must not alias its argument, and the unsafe-string handle. The one disclosure, TestMakeClonesStrings, is codegen-liveness: the CLR reports the test’s own by-value slice live for the whole frame, so the clone’s backing array cannot become collectible while the test is looking. · linux: 27 + 12 · darwin: 27 + 12 · proof
weak 9   Weak pointers — weak.Make and Value, pointer equality, finalizers and cleanups on the referent, tiny and immortal objects, and two upstream issue regressions. Its tests moved here from internal/weak when Go 1.24 made the package public. The first proof link is this package’s own record; the second is the earlier package’s, whose figures are that run’s, not this row’s. · linux: 9 · darwin: 9 · proof · proof

How the header’s figures are derived

Denominator: the packages go list std reports at go1.26.10 whose test files surviving the corpus axis (windows/amd64, -tags purego,math_big_pure_go) declare a Test function, listed one import path per line in the repository’s population file for the release, docs/phase4/data/population-go1.26.10.txt. The file is generated by src/go2cs/internal/genpopulation, and its header carries the derivation.

Exclusions: four, the whole excluded list, each with its class, mechanism and evidence in Excluded packages. An exclusion is subtractable only from a set that contains it, so a package that Go’s own windows/amd64 constraints leave with no test at all is not a member of the population and is never excluded from it.

src/check-roster-format.ps1 recomputes every figure in the header from the table and fails on any disagreement. It checks the one figure the table cannot know, the denominator, against the population file instead, along with every banked and excluded row’s membership in it.

Rows follow Go’s import paths. When a release moves a package, its row validates under the package that now holds its tests, and its row notes say where the tests came from. Go 1.24 moved ten packages: the crypto/internal family under crypto/internal/fips140/…, runtime/internal/{sys,math} to internal/runtime/…, internal/weak to the public weak, and internal/concurrent’s map to internal/sync. The go1.26.10 relocation map covers the four packages Go 1.26 moved. The denominators of earlier releases are in their frozen snapshots: Go 1.23.12 and Go 1.24.13.

Disclosures

A disclosure is a specific Go assertion the converted suite provably cannot satisfy: never a tolerance, and never a test skipped to make a row pass. Each one is pinned by exact failure signature in a hand-owned, committed go2cs_test_disclosures.json. Any other failure is a hard mismatch, and a package without a manifest compares strictly. The committed manifests, never this prose, are the authority on which classes are in use.

At a glance, as of 2026-10-01. Entries counts each class’s entries in the committed manifests (an entry split between two classes counts in each). Entries are not verdicts, so the column does not sum to a Disclosed figure.

Class Entries What it means (one line)
deferred 153 An allocation-count assert the CLR can meet in principle; it carries Go’s want, a measured reading and a retirement plan.
structural 9 Its reason proves that no managed implementation can meet the assert, so it carries no plan.
alloc-count-semantics 8 An allocation-count assert whose allocations golib’s counter never sees, so the host reports only bytes; nothing to retire.
codegen-liveness 11 A test asserts from its own frame that an object it just stopped using is collectible; the CLR can still report that slot live.
runtime-capability 124 A facility defined over the replaced runtime’s own internals, which the managed runtime cannot truthfully describe.
host-identity 16 Only the test host impersonating an identity Go’s own go test supplies could satisfy it, and the host must not claim one.
host-limit 5 The test’s premise needs a property of the test binary that the host’s deployment shape structurally lacks.
host-fatal 12 The test crashes the host or hangs it to the deadline, so it is withdrawn from both sides by name and counted in Disclosed.
platform-skip 16 The converted side takes a skip Go’s own test source writes, for a property the corpus permanently holds.
cgo-configuration 4 A Go pass / C# skip pair left by the two sides’ different cgo configurations at one seam.
compiler-property 2 A Go pass / C# skip pair at Go’s own self-check for a Go compiler property (inlining) that a converted program lacks.

Not tabulated: alloc-profile and performance-margin, which have no entries, and the retired chan-direction. Each is described below.

The classes in full:

Retired: chan-direction named what the managed representation could not distinguish, a channel’s direction (golib’s channel<T> served every direction). It retired itself when direction began riding on the channel value: the three internal/reflectlite rows it pinned pass, and its entries were removed, because the roster’s arithmetic moves when an entry goes.

The go1.26.10 relocation map

Go 1.26 moved four packages that Go 1.24.13 validated, so their tests continue under the package that now holds them; three continue as new rows and one, go/ast/internal/tests, folds into the existing go/ast row. Each earlier row’s figures count once, on the package that receives its tests.

earlier package its Go 1.24.13 verdicts now validated under how its tests map
crypto/internal/hpke 19 crypto/hpke sole successor; a RENAME (below), so no verdict maps by name
go/ast/internal/tests 3 go/ast (an existing row) 3 of 3 by name
internal/itoa 3 internal/strconv sole successor, by LINEAGE; all three names retire (below)
internal/trace/internal/oldtrace 3 internal/trace/internal/tracev1 3 of 3 by name

Names are mapped through the Go 1.26.10 declarations, and two of the four defeat a by-name rule from opposite sides, so each is resolved as Go 1.24’s ambiguous names were: the lineage successor wins, and a body decides a name.

The retirements: TestItoa, TestUitoa and TestUitox of internal/itoa (itoa’s own tests are declared nowhere at go1.26.10; the first two are namesakes only, above).

The excluded E1 package is renamed: runtime/internal/wasitest → internal/runtime/wasitest. Its three test files and their build tags are unchanged, so the class holds.

13 packages are new to the implementable set, each validated from its own measurement: crypto/fips140, crypto/internal/fips140/mldsa, crypto/internal/fips140/subtle, crypto/internal/fips140cache, crypto/internal/fips140only, internal/runtime/cgroup, internal/runtime/gc/scan, internal/syscall/unix, internal/trace/testtrace, internal/trace/tracev2, math/big/internal/asmgen, testing/cryptotest and testing/synctest. Of the 242 packages in the Go 1.26.10 population, 224 continue rows validated at Go 1.24.13 (after the four moves above), 13 are new, internal/unsafeheader rejoined, and 4 are excluded.

No row needs an execution configuration. Every row runs at the default (Release, tiering off): internal/godebug and net/http pass there on both operating systems, and log/slog’s earlier tiering-off failures (TestPanics, TestSetDefault) do not reappear.

Excluded packages

The naive denominator above counts every converted package whose Go 1.26.10 test files declare a Test function on the corpus axis (windows/amd64, -tags purego,math_big_pure_go). Four of them cannot be validated at all: one (E1) because a property of the target blocks validation, whatever the converter does, and three (E4) because their comparison runs cleanly and validates nothing. Both denominators are always reported, and nothing disappears quietly: each exclusion is listed here with its class, its mechanism and the measurement that put it there, just as each disclosure is pinned by exact failure signature.

Each release’s record is its own. The figures above are Go 1.26.10’s. Earlier releases’ figures are frozen in their snapshots rather than carried as a running total: Go 1.23.12’s (204 / 215 as of 2026-09-07) in its snapshot, and Go 1.24.13’s in its snapshot. That changes what the percentage means, so it is worth stating: the metric is package-based, not content-based, and a row is all-or-nothing — a package matching most of its verdicts still scores zero, exactly as one matching none of them does. The five packages Go 1.23.12 left unvalidated (unique, reflect, runtime, runtime/pprof and net/http/pprof) all validated at Go 1.24.13.

The admission bar is the disclosure bar’s sibling, and it is strict. A package is excluded only when validation is provably meaningless or impossible — never merely hard, unimplemented or expensive. Each exclusion is decided individually, on measurement. There are four classes; the fourth is a separate limb of the bar, not a relaxation of it (see E4):

The rejoin clause is binding and works like the disclosure classes’ anti-laundering rule. An exclusion rejoins the denominator the day the evidence changes: its mechanism is implemented, its oracle is fixed upstream, or its platform gains the tests. The chan-direction disclosure class retired itself the same way, from the other side. An exclusion is a measurement with a date on it, never a permanent write-off.

os/user was the first exclusion to rejoin under that clause. It was excluded as E2 because Go’s own go test failed TestGroupIds on the validation host, leaving no clean baseline to compare against. The re-probe that admitted it back is the whole of the evidence: bare go test -count=1 os/user on the validating host reported ok os/user 0.184s, exit 0, with all five tests passing under -v — TestGroupIds among them. A clean oracle is what the exclusion was waiting for, so the row validated the ordinary way, against that same clean baseline. Note the direction this moves the arithmetic: rejoining grows the implementable denominator at the same time as it grows the numerator, so the row is worth no more to the percentage than any other row — which is precisely the point of admitting it back rather than leaving a passing suite parked outside the count. internal/unsafeheader rejoined the same way at Go 1.26.10 (below).

Verdicts below is the naive count the suite would contribute if it could be compared: 0 where the platform yields no eligible test, — where no baseline exists. Rooting dates the project decision that the headline is also reported against the implementable set, with every exclusion listed here with its reason, under which each class is admitted; the per-package measurements behind each row are kept in the project’s validation records.

Package Verdicts Class Mechanism Rooting
internal/runtime/wasitest 1 E1 A WASI test package (runtime/internal/wasitest before Go 1.26, which moved it under internal/runtime/ with its three test files and their build tags unchanged, so the class and the mechanism hold as written). nonblock_test.go is //go:build !aix && !plan9 && !solaris && !wasm && !windows, so it does not select on windows/amd64 at all, and host_test.go declares no test; the only test that does select, TestTCPEcho in the untagged tcpecho_test.go, opens if target != "wasip1/wasm" { t.Skip() } and the oracle target is windows/amd64. The executing surface on the platform of record is EMPTY and the single verdict is that skip. 2026-08-25
net/internal/cgotest 1 E4 Its only test is func Test(t *testing.T) {} — an empty body — under Go’s own comment: “Nothing to test here. The test is that the package compiles at all. See resstate.go.” The comparison is sound and a pass carries no information about the port; the compile it stands for is already gated by the build. 2026-08-25
internal/copyright 1 E4 TestCopyright walks testenv.GOROOT(t)/src and errors "%s: missing copyright notice" per Go file lacking one. Both sides walk the SAME GOROOT and reach the same answer by construction, independent of anything the conversion emits, so the comparison validates the Go distribution’s source hygiene rather than the port. 2026-08-25
crypto/internal/fips140deps 1 E4 TestImports shells out to go list (t.Fatalf("go list: %v\n%s", …)) and asserts the fips140 tree’s dependency policy — “unexpected import of internal package” and “package %s does not import crypto/internal/fips140/check”. Same input and same answer on both sides, so it validates the Go tree’s import policy rather than the port. 2026-08-25

internal/unsafeheader left this table at Go 1.26.10 under the rejoin clause: its E3 mechanism (a pass would be fabrication) no longer holds, it matches 6 of 6 on Windows and on Linux, and the implementable denominator grew by one.

runtime/trace left this table by arithmetic rather than by decision, the E4 exit described above: go2cs’s managed execution tracer made both of its verdicts match, so it validated at 2 of 2 under the rejoin clause and the implementable denominator grew by one.

Packages that Go’s own constraints leave with no test on windows/amd64, or with no package there at all — net/internal/socktest, log/syslog, runtime/race and internal/runtime/syscall among them — are not members of the population, so they are never excluded from it: nothing can be subtracted from a set that does not contain it. Their Linux relevance is untouched — log/syslog and internal/runtime/syscall are ordinary Linux packages — and they belong to Linux’s own denominator when per-OS denominators exist.

Packages under consideration for exclusion but not yet decided are deliberately absent from the table, and there are currently none. The last three such candidates all validated instead of being excluded, which is what the naive denominator is for:

  1. A by-value struct argument wider than a machine word is passed by hidden reference, so the caller’s temp is address-exposed and therefore untracked by liveness analysis. ↩