Validated Test Packages

Each package below has its own Go 1.23.12 _test.go suite converted to C#, built against the converted standard library, run under the Go-semantics test host, and differentially compared — verdict for verdict — against a clean go test -json baseline. A row appears only when every Test function’s result matches go test; a package that almost passes never appears, which is what keeps the denominator below honest. Example/Benchmark execution is deferred and never factors into a row. src/run-validated-sweep.ps1 re-validates every listed package on demand, reading its own roster straight from the table below — see Try it yourself to reproduce any row from a clone with one command.

A disclosure is a specific Go assertion the converted suite provably cannot satisfy — never a tolerance, and never a test skipped to make a row pass. Eight classes exist: three name something the managed runtime cannot measure, two something the test host cannot be or must not claim, one something the managed runtime cannot truthfully describe, one — platform-skip, minted 2026-08-25 — that is not a cannot at all, but a skip Go’s own test source defines for a platform the converted corpus genuinely is, and one — performance-margin, minted 2026-08-29 — that names a measured wall-clock gap rather than a structural impossibility. (The count has moved in both directions, and the committed manifests — never this prose — have always been the authority: it read “four” while five were in use, because alloc-count-semantics predates the newer classes and had lost its spot, restored 2026-08-20; then “five” for the rest of that day, until chan-direction retired that same evening; then “four” again, until runtime-capability joined with runtime/debug’s bank.)

A class that RETIRED itself, chan-direction, named the one thing the managed representation could not distinguish: a Go channel emitted as golib’s channel<T> whatever its direction, so <-chan int was indistinguishable from chan int in assignability and chan<- string stringified as chan string. It was written to retire itself on its own recorded remedy — carrying direction as descriptor cargo the way array dims are — and it did, on 2026-08-20: the direction now rides on the channel VALUE, the three internal/reflectlite rows it pinned pass, and its manifest is gone. The entry is removed rather than kept, exactly as host-limit’s text says such an entry must be once its remedy lands, because the arithmetic below moves when it goes.

alloc-profile — a test asserts an exact allocation count; Go’s compiler stack-allocates the value where .NET must heap-allocate it.
alloc-count-semantics — a test asserts an allocation budget whose unit the managed runtime cannot honor: testing.AllocsPerRun’s numbers under the CLR come back in a different regime entirely (measured: want 0 reading 128, want 3 reading 754), so no allocation behavior can satisfy the count assert. Sibling of alloc-profile — that class is where an allocation lives, this one is how counting itself denominates. Established by the io/strings/bytes banks.
codegen-liveness — a test asserts, from inside its own frame, that an object it just stopped using is now collectible. Go’s GC drops a local at its last use via per-safepoint liveness maps; the CLR reports a frame’s slots live for the frame’s whole lifetime.¹ That second clause is true of the DEFAULT execution configuration, not of the CLR as such — measured 2026-08-30 by the tier-0 A/B, which found the property is a tier-0 artifact and disappears under a Release publish with DOTNET_TieredCompilation=0. The class therefore stands where it stands, and a row whose tests need that configuration says so on its own line instead (execution: release-tc0, ruled the same day); internal/weak is the first, at 4/4. The flip is not global: two failures are TC0-only in the other direction, so a blanket config would trade one class for another rather than retire this one.
host-identity — a test’s assert can be satisfied only by the test-hosting machinery claiming Go’s testing-package identity (testing.tRunner, testing.go) for a frame that is actually the hand-owned test host. The host is a structural replacement (F15b: one testing package), and the standing position-map ruling — the host never claims testing/testing.go — forbids the fabrication passing would require: truth here is the divergence. The bar is deliberately narrow: the frame must belong to the HOST ITSELF; a missing or misnamed frame of converted user code or converted stdlib is a defect, never this class. The worked proof of that boundary is the internal-test-variant caller-info fix (2026-08-26), where four rows that looked like this one were defects in the converted side’s own frame naming and were fixed rather than disclosed. Like codegen-liveness it is permanent by design, retiring only if the hand-owned host were ever replaced by converted Go testing. Minted 2026-08-26 with log/slog’s TestRecordSource, which asserts that two frames above itself sits testing.tRunner in testing.go.
host-limit — a test’s premise rests on a property of the test binary that the converted host’s deployment shape structurally lacks. The bar: an entry must name a structural property of the deployment shape, never an unimplemented-but-fixable defect — and every entry is written to retire itself when the shape gains its named property. One entry holds the class: crypto/tls’s TestBogoSuite — BoringSSL’s runner spawns the host once per case inside Go’s own 10-minute test-binary wall. The ReadyToRun rung was measured 2026-08-28: with 0.74 s shim startup the runner completes the WHOLE configuration — 3,242 cases, zero failures, ok end to end — in 1,316 s against that 600 s wall, 2.2x over on a 6-core host (down from ~20x), and the arithmetic shows the wall is now THROUGHPUT-bound, not startup-bound: the zero-startup (AOT) floor computes to ~980 s there, so no startup work alone retires it (the manifest carries the full per-shape record). Confirmed on a second box 2026-08-29, and that run is the first whose numbers come from Go’s contract rather than partly from a harness defect: 861 PASS / 2,381 SKIP / 0 FAIL, exit 0 — identical on all three buckets — wall 1,046.3 s, ~20% faster and still not crossing. Getting there forced two ordering defects out of the converted test host (it ruled on an unrecognized flag, and parsed, both before a package’s TestMain could install the flag.Usage that exits 89 — which BoGo reads as unimplemented-and-skip), so 1,902 cases had been failing on flag parsing rather than on anything about TLS. Same verdict, entirely different evidence. The 861/2,381 partition is now known to be contract-determined and load-INVARIANT across four runs on two machines, so a later split that differs is a real change rather than noise. The interop itself is no longer in question at any width; the entry retires when managed steady-state TLS throughput on the sweep host crosses the runner’s own deadline — and the class empties and is removed with it, the chan-direction precedent, exactly as its founding entry (the relocatable single-file executable, whose 27 os/exec verdicts now simply pass) already demonstrated.
runtime-capability — a test exercises a runtime facility whose output or behavior is defined over the replaced runtime’s own internals: Go’s type descriptors, its heap layout, its GC bookkeeping. Any managed rendering would be fabrication rather than implementation. The admission test is one question — does a truthful managed implementation of the asserted behavior exist at any cost? — and a yes makes the row an arc with a price, never a disclosure, which is why this class admits runtime/debug’s three WriteHeapDump tests and refuses the rest of what that package measures. It carries a binding anti-laundering clause: an entry pins its rows AS FAILING. The three it names assert only that a heap dump is non-empty and never parse it, so writing a single byte would pass them while proving nothing — and this class’s own text forbids writing it.
platform-skip — a test whose converted side takes a skip the upstream Go source itself writes, because the property that skip describes is one the converted corpus genuinely and permanently holds. The divergence is between two platforms’ verdicts on one test, not between Go and the conversion on one platform. First and founding row: crypto/cipher’s TestGCMAsm, which skips when the assembly GCM implementation is the same type as the generic one — true of the converted corpus by design, since it has no .s codepaths at all, while the real toolchain’s windows/amd64 build has a distinct assembly GCM and therefore passes. runtime-capability’s refusal stands and does not reach it: that class asks whether a truthful managed implementation exists at any cost, and here the cost buys nothing Go’s own source does not already define away — building a second GCM whose only consumer is a differential test would manufacture a platform property instead of measuring one. Its admission test is binding: the skip taken must be the upstream test’s own skip statement, conditioned on a platform property the deployment genuinely and by-design holds — never a host-limit workaround, never a skip the harness injects, never a skip added by conversion. Its anti-laundering clause is enforced in code rather than on trust: this is the one class the compare oracle reads behaviorally, it is the sole key that admits a Go=pass/C#=skip pair, and it admits nothing else — a platform-skip row whose converted side fails is a hard mismatch even when the failure text contains the pinned message. The signature pins Go’s own skip message, and every such row records its verdict pair (Go pass / C# skip) openly, in the roster and on the proof page.
performance-margin — a test’s fixed deadline structurally excludes the managed runtime’s measured completion time on any host of its class, bracketed by direct measurement rather than inferred: not a cannot, a not yet fast enough, the same distinction host-limit’s TestBogoSuite entry draws between throughput-bound and startup-bound. Founding row: net/http’s TestWriteDeadlineExtendedOnNewRequest/h2, whose fixed 250ms WriteTimeout (no retry) bounds a TLS handshake the managed runtime completes in (250ms, 500ms] on this host — bracketed directly by the sibling test TestWriteDeadlineEnforcedPerStream/h2’s own retry ladder (Go’s own authoring: 125/250/500ms), which fails identically at 125ms and 250ms and passes at 500ms. A ~2x margin, not an order-of-magnitude wall, and same family as crypto/tls’s TestBogoSuite 2.2x shim measurement under host-limit. Distinct from codegen-liveness: that class’s object is never reachable at all; this class’s assertion would pass given more time, on the SAME host, doing nothing structurally different.

Each disclosure is pinned by exact failure signature in a hand-owned, committed go2cs_test_disclosures.json. Any other failure is still a hard mismatch, and packages without a manifest compare strictly.

Phase 4 progress: 202 / 215 testable packages validated — 94.0%

27,737 matching test verdicts · 152 disclosed (updated 2026-09-03 — maintained as part of the Phase-4 validation campaign and grows as packages validate. Denominator: the 215 of 302 converted standard-library packages whose Go 1.23.12 sources define Test functions.)

Against the implementable set (215 − 5 excluded = 210): 202 / 210 — 96.2%. Both numbers are always reported. The line above measures against every package that defines a Test function; this one against the packages a faithful managed conversion can honestly validate at all. The five, each with its class, mechanism and evidence, are in Excluded packages below. The denominator moved 209 → 210 by owner ruling on 2026-09-02: internal/runtime/syscall was a phantom inside it — not a member of go list std on windows/amd64 at all, so a set derived from that listing could never subtract it — and net/http/pprof, converted and testable and in no accounting at all, is named in the remainder below.

Linux: 198 of 200 applicable rows validated at their Linux counts — 23,209 matching verdicts · 180 disclosed · 2 rows platform-exclusive (linux: n/a). (internal/syscall/windows joins its own child internal/syscall/windows/registry in that second class on this bank: Windows-exclusive by its own name, every source file *_windows.go, and its layout-L3 csproj compiles nothing at all under GoTargetOS=linux. It is permanently inapplicable rather than not-yet-measured, so neither the numerator nor the applicable denominator moves.)

A verdict count is a fact about a package and an operating system. Go itself runs a different test set per GOOS — build-tagged tests, GOOS-keyed skips, capability gates — so crypto/rand offers 302 eligible verdicts on Linux where Windows offers 298, and path/filepath 54 where Windows offers

The Tests and Disclosed columns are the Windows record for the Go 1.23.12 era; a row that has validated on another OS records that OS’s own arithmetic as a linux: N + D annotation at the end of its What it exercises cell — the matching count, then the disclosed count when there is one. Counts are never averaged, blended, or footnoted away: the sweep validates a row against its annotation when it runs under that OS, and reports comparison-validated-at-count for a row that has none. A package that cannot exist on an OS at all — internal/syscall/windows/registry is Windows-exclusive by its own name — carries linux: n/a instead: permanently inapplicable, counted in neither the numerator nor the applicable denominator, never pending, and skipped by name when the sweep runs under that OS. The Linux line above is summed from those annotations exactly as the line above it is summed from the columns.

Package	Tests	Disclosed	What it exercises
`archive/tar`	97		TAR archives end to end — the V7, USTAR, PAX, GNU and STAR formats read and written against a corpus of real archives, PAX record parse/format including the sorted-header and non-ASCII/xattr paths, sparse-file maps in both the GNU and PAX encodings, octal and base-256 numeric fields at their width boundaries, the USTAR 100-byte name split, `fs.FS` traversal via `AddFS`, and the insecure-path and truncation regression sets. Its table-driven suite is written on function-local `any` types, which is what put all 97 verdicts behind one alias emission. · linux: 97 · proof
`archive/zip`	100		ZIP archives end to end — central-directory and data-descriptor parsing over a corpus of real archives written by 7-Zip, InfoZip, WinRAR, WinZip and OS X, `fs.FS` traversal, UTF-8 vs CP-437 name/comment detection, the CVE regression set, and the zip64 boundaries at `uint16max`/`uint32max` — including a 4 GiB central directory, the case whose rune walk over 65,535-byte names proved `@string` slicing had to become a window. `TestZip64` streams a further 4 GiB through the writer and back, which is most of this row’s ~775 s sweep time. · linux: 100 · proof
`bufio`	80	1	Buffered reader/writer/scanner — fill, rewind, split functions, `io` error propagation. · linux: 80 + 1 · proof
`bytes`	82	6	Byte-slice algorithms; alloc-profile disclosures. · linux: 86 + 6 · proof
`cmp`	4		Generics with an ordered-type constraint. · linux: 4 · proof
`compress/bzip2`	4		Bzip2 decompression — bit readers, Huffman trees, the move-to-front decoder. · linux: 4 · proof
`compress/flate`	64		DEFLATE itself — all ten compression levels, the Huffman bit-writer’s stored/fixed/dynamic block selection against golden bit streams, the LZ77 match chains and dictionaries, and a whole-`Writer` `reflect.DeepEqual` after `Reset`. · linux: 64 · proof
`compress/gzip`	15		Gzip round-trips over the real DEFLATE coder — flate’s Huffman encoder/decoder tables, multistream framing, CRC/ISIZE trailers. · linux: 15 · proof
`compress/lzw`	17		LZW coder in both bit orders (GIF’s LSB, TIFF/PDF’s MSB) — code-width growth, dictionary reset, and the reader/writer `Reset` matrix over the shared `../testdata` corpus. · linux: 17 · proof
`compress/zlib`	6		zlib framing over the real DEFLATE coder — Adler-32 trailer, preset dictionaries, and every compression level across the shared `../testdata` corpus. · linux: 6 · proof
`container/heap`	7		Heap interface over a slice. · linux: 7 · proof
`container/list`	10		Doubly-linked list — pointers and receiver methods. · linux: 10 · proof
`container/ring`	8		Circular linked list — a pointer graph. · linux: 8 · proof
`context`	57	1	Cancellation trees over real channel rendezvous — parent/child propagation, `Done` broadcast, `AfterFunc` registration races, `t.Deadline`-driven tree cancellation, value chains named through the reflectlite bridge; alloc-count disclosure. · linux: 57 + 1 · proof
`crypto`	6		The root `crypto` package’s cross-cipher invariants — every stream mode’s out-of-bounds-write guard (CFB/CTR/OFB/RC4) and the `purego` build-tag assertion the converted corpus is built under. · linux: 6 · · proof
`crypto/aes`	13		AES over the `purego` generic implementation — key expansion, the S-box and Te/Td round tables, GF(2⁸) `mul`/`powx`, known-answer encrypt/decrypt vectors, and the CBC/CTR/GCM interface-upgrade probes. · linux: 13 · proof
`crypto/cipher`	13	1	Go’s block-cipher MODES over the converted AES — CBC/CFB/CTR/OFB encrypt and decrypt against the NIST SP 800-38A vectors, GCM authenticated encryption including the counter-wrap edge, invalid tag sizes, empty plaintext, and the tag-failure path that must overwrite its output buffer. `TestGCMAsm` is the founding `platform-skip` row: Go passes on a build with a distinct assembly GCM, the converted corpus takes gcm_test.go’s own skip because it has no assembly codepaths at all. · linux: 13 + 1 · proof
`crypto/des`	18		DES and Triple-DES — the initial/final permutation bit shuffles, the substitution tables, semi-weak key pairs, and the full known-answer vector matrix. · linux: 18 · proof
`crypto/dsa`	4		DSA over the converted `math/big` — FIPS 186-3 parameter generation at all four key sizes (a probabilistic prime search run to completion), sign/verify round-trips, the bad-public-key rejection, and the degenerate-key signing contract. · linux: 4 · proof
`crypto/ecdh`	47		ECDH key agreement over P-256/P-384/P-521 and X25519 — key generation, the `Bytes`/`NewPublicKey`/`NewPrivateKey` encoding round-trips, shared-secret agreement across curves, the low-order and non-canonical X25519 rejections, and the `crypto.PublicKey`/`crypto.PrivateKey` interface witnesses. · linux: 47 · · proof
`crypto/ecdsa`	82		ECDSA sign/verify over the four NIST curves AND the generic `big.Int` `CurveParams` path — the NIST CAVP vector matrix, nonce safety, negative and zero-hash inputs, r±n signature rejection, `ASN1` encoding via `crypto/x509`, and `randomPoint`. · linux: 82 · proof
`crypto/ed25519`	8	1	Ed25519 over the converted `crypto/internal/edwards25519` — sign/verify round-trips in the plain, pre-hashed (Ed25519ph) and context (Ed25519ctx) modes with wrong-message/wrong-key rejection, `crypto.Signer` through the interface surface, the RFC 8032 golden vectors (`sign.input.gz`), the project’s extended edge-case vector set (non-canonical A/R encodings, small-order components, mixed-order points), key equality, and signature-malleability rejection — the package whose `crypto.Signer(private)` cast named the local-value→foreign-interface record gap; alloc-profile disclosure. · linux: 8 + 1 · · proof
`crypto/elliptic`	82		The NIST curves over the generic `CurveParams` `big.Int` path as well as the optimized field implementations — point addition/doubling/scalar-multiplication agreement between the two, on-curve and off-curve predicates, the point-at-infinity contract, `Marshal`/`Unmarshal` compressed and uncompressed round-trips, and the base-point multiplication vectors. · linux: 82 · proof
`crypto/hmac`	172		HMAC over the real MD5/SHA-1/SHA-224/256/384/512 digests — block-size key folding, constant-time `Equal`, and `cryptotest.TestHash`’s stateful-write matrix per hash. · linux: 172 · proof
`crypto/internal/alias`	1		The buffer-overlap predicate every cipher mode’s in-place guard is built on, over the full offset matrix. · linux: 1 · proof
`crypto/internal/bigmod`	14		Constant-time modular arithmetic on big naturals — Montgomery domain round-trips, `Exp`, modular add/sub identities, limb expansion and `SetBytes` bounds, all on the `purego` word-at-a-time path. · linux: 14 · proof
`crypto/internal/boring`	3		The not-BoringCrypto build’s own contract — `Enabled` false, and the `Unreachable`/`UnreachableExceptTests` guards that a BoringCrypto-only path must never execute staying quiet under it. · linux: 3 · proof
`crypto/internal/boring/bcache`	1		The GC-cleared BoringCrypto shadow cache, whose single test is four suites in one: a 10,000-entry `Put`/`Get` sweep with a random 20% overwritten in place, the `Clear` contract, the REGISTERED cache emptying across a `runtime.GC()`, and a 100-goroutine barrier that fills `cacheSize` entries per goroutine and then reads every one back. It is the measured consumer of the package’s one hand-own, and the reason that hand-own could not be a literal conversion: Go’s `Register` gives the runtime the ADDRESS of the cache’s `ptable` word and `clearpools` nils it with `atomicstorep`, but that word is an `atomic.Pointer[cacheTable[K,V]]` whose managed slot holds a `ж<T>` REFERENCE — storage containing references is not pinnable, so the `uintptr` would name nothing recoverable, and pinning it to force the issue would defeat the one thing the package exists to do, which is let the collector reclaim what it caches. A registration is therefore a clear DELEGATE — the currency `clearpools`’ other two arms already use — and the delegate is the package’s own `Clear`, which Go’s doc comment names as precisely what the collector performs here; `golib.BoringCaches` drives it from a resurrecting finalizable sentinel filtered to gen2 per the Go-cycle-is-a-gen2-collection identity, and `runtime.GC()` clears the registry directly before returning, exactly as it already invokes `poolcleanup` directly. · proof
`crypto/internal/edwards25519`	54	1	The edwards25519 group law behind Ed25519 and X25519 — generator/identity arithmetic against Dalek-derived vectors, `ScalarBaseMult`/`ScalarMult`/`VarTimeDoubleScalarBaseMult` cross-checked against each other and against `crypto/elliptic`-independent references, scalar field arithmetic with `SetUniformBytes`’ 64-byte wide reduction, aliasing-safety sweeps over every receiver/argument overlap, and the lookup-table selectors. The one disclosure is the nistec shape at small scale: `TestAllocations` wants zero over a point addition plus encode round-trips, where Go stack-allocates every temporary and the managed model’s 98 golib boxes per run are structural. · linux: 54 + 1 · proof
`crypto/internal/edwards25519/field`	16		The Ed25519 base field mod 2²⁵⁵−19 — the 51-bit limb representation’s carry propagation and 64×64→128 multiply, `Multiply`/`Square`/`Invert`/`SqrtRatio`, constant-time `Select`/`Swap`, canonical `SetBytes`/`Bytes` round-trips at the edge cases, and `TestBytesBigEquivalence`, which cross-checks the whole encoding against `math/big` over randomized inputs — the row the `array<T>` unshaped-instance class held. `TestAliasing` additionally drives every method with its receiver aliasing an argument. · linux: 16 · proof
`crypto/internal/hpke`	19		Hybrid public-key encryption against the RFC 9180 vector set — DHKEM(X25519, HKDF-SHA256) base-mode setup over both AEADs, the exporter secret, and `Seal`/`Open` at every sequence number in the vectors including the 255→256 nonce-width boundary; the P-256/P-521 suites reach Go’s own `SupportedKEMs` guard and skip identically on both sides. The whole vector set is `encoding/json`-decoded into a slice of a converter-lifted anonymous struct — the shape that held this package until the lift’s element Kind reached `Unmarshal`. · linux: 19 · proof
`crypto/internal/mlkem768`	12		ML-KEM-768 (Kyber) end to end — the mod-3329 field arithmetic checked EXHAUSTIVELY (`TestFieldReduce` walks all 2q² inputs; add/sub/mul walk every ordered pair below q), compress/decompress at every bit width against a `math/big` rational reference, the ζ and γ constant tables re-derived by modular exponentiation, key-generation/encapsulate/decapsulate round trips, and the encapsulation-key/ciphertext length-validation matrix. `TestPQCrystalsAccumulated` drives 10,000 reference-implementation vectors through the full KEM and checks the accumulated SHAKE-128 digest — 417 s of this row’s runtime, and the reason it exists: it is the operational guard for the hand-owned `sha3` array-reinterpret fix, which the vendored package’s own sources cannot provide. · linux: 12 · proof
`crypto/internal/nistec`	2195	5	The NIST P-curve group law at purego fidelity — the `ScalarMult` ladder across P224/P256/P384/P521 at every boundary scalar (0 and ±k around the group order, powers of two, every small scalar), `TestEquivalents`’ addition-chain identities, and the compressed/uncompressed point round-trips. The five disclosures are ONE shape: `TestAllocations`’ want-zero `AllocsPerRun` over whole scalar multiplications — 8,484–17,090 golib boxes per run where Go’s escape analysis stack-allocates every point and fiat field-element temporary (measured at the B2 kind-split emission) — the four curve subtests plus their aggregate parent. The asm-flavor-only tests (`p256_asm_table`, `ordinv`) are named flavor exclusions: the corpus reproduces `-tags purego`, and the manifest now declares what the native flavor alone runs. · linux: 2195 + 5 · proof
`crypto/md5`	11	1	MD5 — the golden digest matrix, binary marshal/unmarshal of a half-written state, large-input block handling, and `cryptotest.TestHash`’s stateful-write matrix; alloc-profile disclosure. · linux: 11 + 1 · proof
`crypto/rand`	298		Cryptographically secure random integers over the real `math/big` arithmetic — `Int`’s rejection-sampled bit-mask loop across the whole modulus matrix, `Prime` generation and its degenerate bit-length errors, the `Read`/`Reader` surface, and the empty-max panic contract. · linux: 302 · proof
`crypto/rc4`	2		RC4 keystream golden vectors across every key length, and the in-place `XORKeyStream` block matrix. · linux: 2 · proof
`crypto/rsa`	559	1	RSA end to end over the converted `math/big` and `crypto/internal/bigmod` — key generation at every size including multi-prime, PKCS#1 v1.5 and OAEP encrypt/decrypt with and without a blinding source, PSS sign/verify across every salt-length mode against the OpenSSL and RSA-Labs golden vectors, key validation and the small-key/overlong/unpadded rejection paths, and the several-hundred-case `TestEverything` matrix over the key-size × hash × scheme cross-product; alloc-profile disclosure. · linux: 559 + 1 · proof
`crypto/sha1`	12	1	SHA-1 — the struct-carrying-arrays value copy `Sum` depends on; binary marshal round-trips. · linux: 13 + 1 · proof
`crypto/sha256`	23	1	SHA-224/256 golden vectors and `cryptotest.TestHash`’s stateful-write matrix. · linux: 23 + 1 · proof
`crypto/sha512`	36	1	SHA-384/512/512-224/512-256 — the four-variant digest state machine. · linux: 36 + 1 · proof
`crypto/subtle`	7		Constant-time primitives; word-at-a-time `XORBytes` over the full alignment matrix. · linux: 7 · proof
`crypto/tls`	3643	1	The flagship networking suite — one row over everything the Windows syscall arcs built: TLS 1.2 and 1.3 handshakes in both roles over real loopback sockets (the managed netpoller and the WSA submit family end to end), session tickets and resumption, QUIC transport events, ECH, the ALPN/SNI/client-auth matrices, certificate chain verification through the Windows system verifier (`CertGetCertificateChain` and the SSL policy check — the opaque-pointer mint round trip), name resolution (`GetAddrInfoW` + `adapterAddresses`), sha3-backed key schedules, and the zero-value regression sets. Four resumption/verification tests fail AGREEING on both runtimes (the suite’s fixtures expired 2025-01-01 — the proof page carries the ceiling note); `TestBogoSuite`’s 3,243 BoringSSL-interop sub-verdicts are now ordinary MATCHED verdicts — case-for-case agreement with Go, the window-twelve host-ordering fold’s real effect, not a filtered sample or a disclosed capability. codegen-liveness disclosure only (`TestCertCache`, the `TestOnceXGC`/`TestPoolGC` mechanism). THREE host states reach this row, each PROVEN from the run’s own comparison record before `run-validated-sweep.ps1` accepts it, none waved through. A host carrying the BoGo/BoringSSL shim runner and the throughput to finish inside its fixed 600 s wall banks the full count above. A host missing the runner never spawns the case matrix at all: `TestBogoSuite` collapses to one agreeing verdict on both runtimes with no Go-side fan-out, and the row validates at 400 matched — the capability-absent check, whose discriminator is precisely that absent fan-out. A host that has the runner but cannot clear the wall is the third state and reads nothing like the second: Go fans all 3,242 cases out while the converted side dies on the deadline with the pinned signature, so the row validates at 400 matched / 2 disclosed, the second being `TestBogoSuite`’s own committed `host-limit` entry — the host-limit check, which admits it only when the withdrawn Go-side rows are exactly this block’s 3,242 banked sub-verdicts, name for name, and the committed manifest pins the root under that class. The two shortfall checks partition on the fan-out, not on the root’s verdict pair (measured 2026-09-01: the third state can report Go fail / C# fail, the second state’s pair, and only the withdrawals tell them apart). Any other shortfall still fails the row. · linux: 400 + 2 · · proof
`crypto/x509`	341		X.509 end to end — certificates, CSRs and CRLs parsed, created, marshalled and re-parsed across RSA, RSA-PSS, ECDSA, Ed25519, X25519 and DSA, every key encoding (PKCS#1, PKCS#8, SEC1, PKIX) with its mismatched-format and broken-signer rejections, chain building and verification — EKU enforcement, path building, the pathological and long-chain limits, and the Windows system verifier — name constraints with the RFC 2821 mailbox grammar and the bad-name sets, hostname and IP matching, the `OID` value type’s marshal/unmarshal/equality round-trips, PEM encryption, certificate policies under GODEBUG, the system and hybrid certificate pools, and the duplicate-extension, negative-serial and critical-extension regression sets. The row is what the multi-value-`return` arc closed: `ParseOID` returned an EMPTY OID beside a nil error until the return-operand spill landed, and `parsePublicKey`/`parsePKCS8PrivateKey` forwarded a VALUE into `any` where Go holds `*ecdh.PublicKey`. 17 of the 341 skip identically on both sides. · linux: 322 · proof
`database/sql`	138	2	The connection pool and the driver contract end to end — `DB`/`Conn`/`Tx`/`Stmt`/`Rows` lifetimes against the `fakedb` driver, idle/open limits and connection reuse under concurrency, context cancellation and the `ErrBadConn` retry loop, prepared-statement dependency tracking and close ordering, and the `convertAssign` scan matrix through the reflection bridge (`driver.Valuer`, `sql.Scanner`, `RawBytes`, user-defined types). `TestConnRaw` is the row that measured the frame re-raise: a callee’s `finally` re-raising a panic it never caught truncated `Conn.Raw`’s deferred release, so the connection stayed open and the test spent the package’s entire deadline on a poll that could not come true; alloc-profile disclosures. · linux: 138 + 2 · proof
`database/sql/driver`	1		The driver `Value` contract — `IsValue`/`IsScanValue` over every convertible Go kind and the default converter’s integer-range and pointer-indirection rules. · linux: 1 · proof
`debug/buildinfo`	197		Build-info extraction from real linked binaries — the ELF/Mach-O/PE/XCOFF reader matrix over the package’s own `testdata` executables, and the blob scan repeated at every start offset. · linux: 204 · proof
`debug/dwarf`	40		DWARF debug info — the whole type graph (basic, struct, array, pointer, typedef including a cycle, qualified, unsupported), bit fields and DWARF 4/5 bit offsets, line tables across GCC/Clang and zstd-compressed sections, ranges/rnglists, split and type units. Its reader satisfies an anonymous interface via a pointer-receiver method promoted from an exported value embed — the shape whose absent promotion made the run-time method set incomplete. · linux: 40 · proof
`debug/elf`	31		ELF objects, executables and core files — the header/section/program-header walk over 32- and 64-bit fixtures, symbol tables, `DynValue`, `NOBITS` sections, zlib-compressed debug sections in both the GCC `.zdebug` and gABI `SHF_COMPRESSED` spellings, the `>65280`-section overflow path that moves the counts into section 0, and DWARF relocation application across twenty compiler/architecture testdata objects (GCC 4.2 through 9.3 and Clang, over x86, ARM, AArch64, MIPS/MIPS64, PPC/PPC64LE, RISC-V, s390x and SPARC64). The wall was a single line — `_ = net.ResolveIPAddr`, which Go writes to force dynamic linkage: a discard whose right-hand side is a method group, the one C# expression form a discard cannot take its type from. · linux: 31 · proof
`debug/gosym`	10		Go symbol tables and the `pclntab` line machinery — `LineTable`’s PC↔line mapping and `Table` symbol lookup over a binary the test compiles from its own `testdata` with the real Go toolchain and then reads back, the Go 1.15 `pclntab` format read from a gzipped fixture, plus package-path splitting for standard-library, remote and generic-instantiation symbol names. That toolchain build runs in `testdata` relative to the package, which is why this row waited on the converted host reproducing a package’s directory ancestry rather than only its shape. · linux: 9 + 1 · proof
`debug/macho`	7		Mach-O object files — the load-command walk over the thin and fat testdata corpus, dynamic-symbol parsing including a malformed `LC_DYSYMTAB`, and the relocation/CPU stringer tables. Reached through `saferio.SliceCap` over a slice of the `Load` interface, whose Go size `unsafe.Sizeof` now answers from Go’s own layout rule. · linux: 7 · proof
`debug/pe`	10		PE executables and objects — header, section and symbol parsing over the mingw testdata corpus (32- and 64-bit executables and objects, a no-symbols binary, a truncated kernel image), import tables read from a real system `ws2_32.dll` found via the search path, the fuzz-derived malformed-input set (invalid optional-header magic, missing optional header, out-of-bounds symbol slices), and two binaries the test builds with the real Go toolchain and reads back: a DWARF walk that must find `main.main` at the exact offset the freshly-built program reports about itself at runtime, and a `-H=windowsgui` build’s subsystem check. The row’s one divergence was the COFF aux-symbol re-view — Go re-types one 18-byte record as two struct shapes through `unsafe.Pointer`, a free cast over identical Go layouts, but the managed layout pun handed the aux shape’s blank `_ [3]uint8` the source’s 8-element `Name` array reference — closed by hand-owning the symbol reader pair to transcribe the Go layout explicitly (`symbol_impl.cs`), which also leaves `File.COFFSymbols` holding exactly the field values Go’s memory holds. `TestBSSHasZeros` skips identically on both sides (no gcc on the host). · linux: 13 · proof
`debug/plan9obj`	2		Plan 9 a.out objects — section table and symbol parsing over the testdata corpus, plus the malformed-file error path. · linux: 2 · proof
`encoding/ascii85`	9		Ascii85 encode/decode and streaming wrappers. · linux: 9 · proof
`encoding/asn1`	38		DER marshal/unmarshal end to end — tag and class handling including SET vs SEQUENCE, `asn1:"…"` struct-tag parameters read through the reflection bridge, unexported-field guards probing settability, `big.Int`/bit-string/OID/UTC-time round-trips, and a full certificate walk. Closed by three complementary fixes across two machines (defined-type `Name()`, `StructField.PkgPath`, array dims). · linux: 38 · proof
`encoding/base32`	26		Base32 round-trips; `io.Pipe` rendezvous over the real channel core. · linux: 26 · proof
`encoding/base64`	17		Base64 round-trips; goroutine + `time.After` timer path. · linux: 17 · proof
`encoding/binary`	137	9	Reflection-driven Read/Write — the bridge’s construction/write-back surface. · linux: 137 + 9 · proof
`encoding/csv`	71		CSV parsing; wrapped-error `errors.Is` through the reflection bridge. · linux: 71 · proof
`encoding/gob`	106		Go’s self-describing binary serialization end to end — the encoder and decoder engines over every kind gob transmits, wire type-graph construction and the `Register`/`GobEncoder`/`GobDecoder`/`BinaryMarshaler` interface paths, indirection and recursive types, cross-type compatibility and the malformed-input regression set. Its last divergence, `TestIgnoreDepthLimit`, was the arc that put `reflect.ArrayOf` and `reflect.StructOf` in the bridge: the test builds a 101-deep nested array and a 101-deep nested struct at RUN TIME, so the row could not close until a Go type nothing declared could be constructed. 5 of the 106 skip identically on both runtimes. · linux: 106 · proof
`encoding/hex`	12		Hex encode/decode and error paths. · linux: 12 · proof
`encoding/json`	491		JSON end to end — the `Marshal`/`Unmarshal` tables over the 40-field `All` fixture, struct-tag naming and options including `,string` and `omitempty`, embedding with Go’s full dominance rules, `Marshaler`/`Unmarshaler`/`TextMarshaler` dispatch at every depth, `RawMessage`, `Number`, the streaming `Encoder`/`Decoder` with `Token`/`More`, `Compact`/`Indent`/`HTMLEscape`, and the cycle, depth and malformed-input error sets. Nearly every row is a reflection walk checked against Go’s own answer, so this suite is the reflection bridge’s broadest proof: ten of its roots were found here, and the last of them was a map entry read without its element type. · linux: 491 · proof
`encoding/xml`	386		XML end to end — the `Decoder`’s tokenizer over the whole grammar (nested elements, CDATA, directives, comments, processing instructions, character and HTML entities, `CharsetReader`, `RawToken`/`Skip`/`InputOffset`, and the syntax-error line/column set), namespace resolution and prefix scoping in both directions, `Marshal`/`Unmarshal` over the struct-tag grammar (`XMLName`, `attr`, `chardata`, `cdata`, `innerxml`, `comment`, `omitempty`, `a>b>c` nesting, `any`), `Marshaler`/`Unmarshaler` and their Attr/Text variants at every depth, `EncodeToken` streaming with its well-formedness rules, and the CVE and disallowed-character regression sets. The row is one long reflection walk checked against Go’s own answer, which is why its last root was a `reflect.DeepEqual` that could not see a NAMED byte slice’s backing array — `CopyToken` really did clone its buffer, and the comparison said otherwise. · linux: 386 · proof
`encoding/pem`	8		PEM block parsing and round-trips. · linux: 8 · proof
`errors`	61		`errors.Is`/`As`/`Join` — reflection-bridge write-back (`Value.Set`, addressability). · linux: 61 · proof
`expvar`	11		The exported-variable registry — `Int`/`Float`/`String`/`Map`/`Func` publication and atomic update, `Map` key ordering with delete/init, JSON quoting across every rune class, and the `/debug/vars` handler. · linux: 11 · proof
`flag`	24		Command-line flag parsing end to end — definition, `Set`, and `Parse` across every builtin flag type with its range and overflow boundaries, `FlagSet` isolation and `ContinueOnError`/`ExitOnError` error handling, the `Value`/`Getter`/`Func`/`BoolFunc`/`TextVar` interfaces, redefinition and invalid-name panics, `-h`/`-help` behaviour, and `PrintDefaults`/`Usage` output byte for byte. Its `TestDefineAfterSet` matches `./flag_test.go:.` against the file `runtime.Caller` answers with, which is the assertion the position map put in reach: the frame now names Go’s own source, not the converted `.cs`. · linux: 24 · · proof
`fmt`	63		Go’s formatted I/O end to end — the whole `Printf` verb matrix over every kind with its width/precision/flag combinations, `Formatter`/`Stringer`/`GoStringer`/`error` dispatch and the recursion guards around it, `%v`/`%+v`/`%#v` of nested structs, maps (ordered by `internal/fmtsort`), slices, funcs, pointers and typed nils, the `Append`/`Fprint` and `Sscan*` surfaces, and the panic-in-`String` and bad-verb error texts byte for byte. It is the deepest test the reflection bridge has — `%v` and `%T` ARE `reflect` walks, so every row is a descriptor read checked against Go’s own answer — and the behavioral suite’s ~520 stdout comparisons all run through this package, so banking it strengthens each of them. · linux: 63 · proof
`go/ast`	9		The Go syntax tree — comment maps and doc association, `FilterFile`/`FilterPackage` deduplication, `Walk`/`Preorder` traversal with early break, and `ast.Fprint`’s reflective dump of a parsed tree (map iteration and unnamed struct types through the reflection bridge). · linux: 9 · proof
`go/build`	57	1	The build-context resolver itself — `Import`/`ImportDir` over the real GOROOT tree, the `+build` and `//go:build` readers across the whole `TestShouldBuild` matrix, `MatchFile` with the GOOS/GOARCH filename rules, the cgo and binary-only paths, `TestDependencies` walking the standard library’s own dependency policy, and `TestVendorPackages`. The disclosed row is `TestLocalDirectory`, which calls `os.Getwd()` and asks `ImportDir` to name the result `"go/build"` — an assert requiring cwd to sit under the GOROOT the process REPORTS. The host runs every suite in a sandbox so a test may write without touching the real tree, so `ImportDir` finds no known root and honestly answers `"."`; the ancestry view deliberately does not repoint GOROOT, because a directory walk does not descend into a junction and repointing would regress `compress/gzip` and `path/filepath` (measured: 0 `*.gz` under a mirrored root against the real 4). Same root as `internal/coverage/cfile`’s disclosed row, manifesting differently. · linux: 57 + 1 · proof
`go/build/constraint`	89		Build-constraint expression parsing. · linux: 89 · proof
`go/constant`	9		Exact-precision Go constant arithmetic — the int/rational/float representation ladder, `Make`/`Bytes` round trips, `BitLen`, and the full binary/unary operator and comparison matrix. · linux: 9 · proof
`go/doc`	85		The godoc extractor itself — `New`/`NewFromFiles` building a `Package` from a parsed AST, run over the whole `testdata` package corpus in all three modes (`default`, `AllDecls`, `AllMethods`) against golden renderings, so each of the 19 fixture packages contributes three verdicts. Exercises type/method/field association including embedded and promoted methods, the exported-filter and blank-identifier paths, error-type recognition, generics with type parameters and constraints, `Synopsis` extraction, import-group detection, and `TestClassifyExamples`/`TestExamples`, which map `Example*` functions onto the identifiers they document. Its one runnable example, `ExampleNewFromFiles`, is deferred with every other `Example` and never factors into the row. · linux: 85 · proof
`go/doc/comment`	10059		Doc-comment parsing and re-printing to text/markdown/HTML over the whole `testdata` corpus, plus a sweep over every doc comment in the converted standard library’s Go sources — 10,000+ subtests, the largest verdict set banked. · linux: 10059 · · proof
`go/format`	4		gofmt’s public entry points — `format.Source` on whole files and partial fragments, and `format.Node`’s no-modify guarantee over a parsed AST. · linux: 4 · proof
`go/importer`	3		The compiler-keyed importer front end — `ForCompiler`’s dispatch for source, gc and gccgo, including the custom-lookup path. · linux: 3 · · proof
`go/internal/gccgoimporter`	4		The gccgo export-data importer — the `.gox` type-parser matrix (aliases, complex constants, escape info, `notinheap`, pointer and interface shapes) and the ELF archive reader that locates export data inside a `.a` member, with the two gccgo-installation tests skipping on both sides exactly where Go’s do. · linux: 4 · proof
`go/internal/gcimporter`	583		The gc export-data importer, read end to end: `TestImportStdLib` compiles and re-imports all 303 standard-library packages, and `TestImportTypeparamTests` compiles each of GOROOT’s `test/typeparam` programs, imports the result, and requires the imported package to describe every exported object EXACTLY as a from-source `go/types` type-check of the same file does. That second half is a differential test of the converted CHECKER against the converted IMPORTER, and it is the package that priced the type-parameter identity wall: 399 of 583 at first census, 475 once an interface map key compared by Go equality, and all 583 once an embedded struct stopped being a shared box. · linux: 582 · proof
`go/internal/srcimporter`	7		Type-checking GOROOT FROM SOURCE — `TestImportStdLib` walks every standard-library package and runs the converted `go/types` over its real sources, so a single checker defect anywhere in the language surfaces here as a failed import. `TestImportedTypes` then pins the resulting objects, and the issue tests cover import cycles, `unsafe`, and re-import identity. · linux: 7 · · proof
`go/parser`	173		The Go parser end to end — the valid and error corpora, `ParseFile`/`ParseDir`/`ParseExpr` entry points, identifier resolution into scopes, and `TestParseDepthLimit`/`TestScopeDepthLimit`, which drive nesting to Go’s own `maxNestLev` of 100,001 levels deliberately: about 400,000 converted frames, which is what sized the host’s per-test stack reservation to Go’s 1 GB ceiling. Its package initializer reads the sibling `go/printer`’s sources, so it is also the package that proved the ancestry view. · linux: 173 · proof
`go/printer`	45		The Go pretty-printer — the golden-file corpus (declarations, expressions, generics, comments, `//go:build` lines), comment placement and bad-node recovery, `CommentedNode`, and base-indentation modes. · linux: 45 · proof
`go/scanner`	11		Go’s lexical scanner — the whole token and literal matrix, automatic semicolon insertion, `//line` directive handling (valid and invalid), `ErrorList` collection with its sort and one-per-line dedup, and CR stripping in raw strings. · linux: 11 · proof
`go/token`	31		FileSet/Position machinery; a full `encoding/gob` serialization round-trip — the reflect type-relation mirrors driving real Encoder/Decoder engines. · linux: 31 · proof
`go/types`	557		The Go type-checker itself, end to end. `TestCheck`, `TestSpec` and `TestFixedbugs` run the language’s own conformance corpora file by file and require the converted checker to report exactly the errors Go reports at exactly the positions; `TestStdlib` then type-checks all of GOROOT from source. `TestSizeof` asks `reflect` for the amd64 size of every type and object node, which makes the reflection bridge’s Go layout walk a first-class assertion rather than an implementation detail — and it is the test that priced the walk’s one process-killing defect, a managed reference classified as a struct sending it into the BCL’s cyclic object graph. · linux: 557 · · proof
`go/version`	3		Go version-string comparison. · linux: 3 · proof
`hash`	18		The `hash.Hash` contract itself — `encoding.BinaryMarshaler`/`BinaryUnmarshaler` state round-trips exercised across every standard-library digest (adler32, crc32/64, the six FNV widths, md5, sha1, and the six SHA-2 variants). · linux: 18 · proof
`hash/adler32`	2		Adler-32 checksum. · linux: 2 · proof
`hash/crc32`	10		CRC-32 including real SSE4.2/PCLMULQDQ hardware paths via managed intrinsics. · linux: 10 · proof
`hash/crc64`	5		CRC-64 checksum tables. · linux: 5 · proof
`hash/fnv`	19		FNV-1/FNV-1a across widths. · linux: 19 · proof
`hash/maphash`	22		Seeded and unseeded hash streams plus SMHasher avalanche/BIC quality checks; the 100,000-sample bounds exercise a computed float constant derived from a named untyped integer constant. · linux: 22 · proof
`html`	3		HTML entity escaping and unescaping — the 2,138 single-rune and 91 two-rune named-entity tables walked longest-match-first, with and without the trailing semicolon, plus numeric references in decimal and hex with the Windows-1252 replacement table and the early-termination edges, and an `Unescape(Escape(s)) == s` round trip. Its hot path is what the array-zero-length fix bought: `entity2[name]` is a map whose VALUE is a `[2]rune`, so a miss returns the zero array and the very next expression indexes it — an index that panicked for as long as the map-miss zero carried no Go array shape. · linux: 3 · proof
`html/template`	243		Contextual auto-escaping, the security property `html/template` exists for: the escaper’s state machine driven across HTML text, attributes, comments, `<script>`, `<style>`, URLs and JS string/regexp contexts, each with its own escaper and filter; the `Content` typed-string exemptions; template cloning, redefinition and `{{block}}` composition through the escaper; and the error matrix. Its verdicts ride the whole `text/template` engine underneath, so it is the largest single consumer of the reflection bridge’s value plumbing on the roster. · linux: 243 · proof
`image`	8		The image model — `Rectangle` algebra, the `At`/`Set`/`SubImage`/`Opaque` contract over every concrete image type, `RGBA64Image` 16-bit access, YCbCr plane geometry and non-overlap, and `image.Decode` through the registered-format table. · linux: 8 · proof
`image/color`	10		The color models — RGBA/CMYK/YCbCr conversion round-trips and cross-model consistency, alpha-premultiplied NYCbCrA, and the palette’s nearest-color search. · linux: 10 · proof
`image/draw`	9		Porter-Duff compositing over every image model — clip narrowing through address-taken value parameters, Floyd-Steinberg dithering, and paletted quantization. · linux: 9 · proof
`image/gif`	28		GIF encode/decode over the real LZW coder — interlacing, transparency and palette edge cases, animation loop counts and per-frame disposal, and `image.Decode` reading a PNG through a blank import’s registration. · linux: 28 · proof
`image/jpeg`	14		Baseline and progressive JPEG decode/encode — forward and inverse DCT against a reference implementation, zig-zag tables, restart markers, truncated and extraneous scan data, grayscale and CMYK, and a full encode/decode round trip over the shared `image/testdata` fixtures. · linux: 14 · proof
`image/png`	28		The PNG codec end to end — the full PNGSuite decode corpus (every bit depth, palette, interlacing and transparency form) against its `.sng` goldens, Paeth filtering, malformed-stream error paths, and an encode/decode round trip whose RGBA→NRGBA row conversion writes through a slice-to-array pointer. · linux: 28 · proof
`index/suffixarray`	12		SAIS suffix-array construction in both 32- and 64-bit index widths, verified exhaustively over every string up to length 8 on 2- and 3-letter alphabets, plus lookup, regexp `FindAllIndex`, and gob save/restore round trips. · linux: 12 · proof
`internal/abi`	1	1	Runtime ABI helpers (`FuncPC`). · linux: 1 + 1 · · proof
`internal/buildcfg`	3		Toolchain build configuration — `GOARM64`/`GOAMD64` feature-level parsing and the `gogoarch` build-tag set. · linux: 3 · proof
`internal/chacha8rand`	4		The ChaCha8 generator behind `math/rand/v2` and the runtime’s per-`m` source — `TestOutput` walks the package’s own vector through `Next`/`Refill`, `TestMarshal` marshals and unmarshals the state before every single draw, `TestReseed` proves reseeding moves it, and `TestBlockGeneric` compares the two block implementations word for word. That last row is the array-SHAPE reinterpret: Go’s `block_generic` computes IN PLACE through `(*[16][4]uint32)(unsafe.Pointer(buf))`, a rank change no managed nested-array view can reconstruct, so it and `setup` are hand-owned over a `MemoryMarshal.Cast` alias of the same storage — kept independent of the assembly-replacing `block`, down to reusing the package’s own auto-converted `qr`, so the test still compares two implementations rather than one against itself. · linux: 4 · proof
`internal/concurrent`	20		The concurrent hash map behind `unique` and `net/netip` — `Load`/`LoadOrStore`/`CompareAndDelete`/`All` over a 128-key set, the delete-all and delete-one orderings, weakly-consistent iteration with mutation running underneath it, and two genuine stress rows per parent that each launch `GOMAXPROCS` goroutines (12 on the sweep host) looping the full lifecycle over shared and unshared keys. The two parents run the SAME nine subtests: `TestHashTrieMapBadHash` first replaces the map’s hash function with one returning 0 for every key, so half this row is the entire contract re-proven under total collision. That whitebox write is what the row turned on. The production code is a hand-owned `ConcurrentDictionary` replacement of Go’s lock-free trie — the runtime descriptor `Hasher` the original seeds from means “hash the bytes AT this address”, which the managed bridge cannot honor — and it now carries a real `keyHash` seam: installing a hook rebuilds the store behind an `IEqualityComparer<K>` whose `GetHashCode` IS the hook’s answer, leaving equality untouched exactly as Go’s test does, so the collision the test forces is the collision the map gets. The suite’s dead `dumpMap`/`dumpNode` debug printers — called by no `Test`, but naming the trie’s node types in a signature, which put the whole compilation behind one declaration-phase `CS0426` — are satisfied by a declaration-only companion whose single door throws. · linux: 20 · proof
`internal/coverage/cfile`	15	1	The coverage runtime’s file side — `ProcessCoverTestDir` reading meta and counter files, the emit APIs driven through a real subprocess harness (`TestCoverageApis` builds and runs a covered binary per sub-case, including the emit-to-directory, emit-to-writer and failing-writer paths), `TestApisOnNocoverBinary`, and the `GOCOVERDIR` handling. The disclosed row is `TestIssue59563TruncatedCoverPkgAll`, which shells out to the real toolchain twice — `go test -coverpkg=all` then `go tool cover -func` — and looks for a row prefixed `internal/coverage/cfile/testdata/issue59563/repro.go`. Both subprocesses SUCCEED and the coverage is CORRECT (`large` at 100.0%, which is what issue 59563 is about); measured A/B, the control and the sandbox emit an identical 10280 rows differing by one prefix, because outside the reported GOROOT the toolchain reads the staged `src/go.mod` as an ordinary module named `std` and qualifies every path. Same root as `go/build`’s disclosed row, manifesting differently. · linux: 15 + 1 · proof
`internal/coverage/cformat`	2		Coverage report formatting — per-function and per-package percentage rollups, and the empty-package edge. · linux: 2 · proof
`internal/coverage/cmerge`	2		Coverage counter merging — the saturating-add merge policy and the conflicting-metadata clash path. · linux: 2 · proof
`internal/coverage/pods`	1		Coverage “pod” collection — grouping meta/counter data files on disk by package, over real temp-directory I/O. · linux: 1 · proof
`internal/coverage/slicereader`	1		Coverage slice reader. · linux: 1 · proof
`internal/coverage/slicewriter`	1		Coverage slice writer. · linux: 1 · proof
`internal/cpu`	8		The x86 feature-detection tables — the CPUID-derived AVX/AVX2/AVX-512 implication invariants, and the GODEBUG cpu-option machinery reached through `getGOAMD64level`, whose GOAMD64 build level go2cs answers at the amd64 baseline exactly as Go’s own assembly does for a build with no `GOAMD64_vN` define. On Linux the two GODEBUG cpu-disable tests (`TestDisableSSE3`, `TestDisableAllCapabilities`) take Go’s own `MustHaveDebugOptionsSupport` skip: the converted runtime performs no CPU feature detection — `cpuid` is an unimplemented asm intrinsic and `cpuinit`’s `schedinit` slot never runs, so `DebugOptions` is false — and that all-false default is load-bearing, routing every feature-gated path to its portable implementation (enabling real detection would crash on the unimplemented SIMD asm, so the skip is honest, not a gap); platform-skip disclosures. · linux: 6 + 2 · proof
`internal/dag`	6		The dependency-graph language the standard library’s own layering rules are written in — rule parsing, topological order, transpose, and transitive reduction. · linux: 6 · proof
`internal/diff`	13		The unified-diff engine over its testdata corpus — every edit shape from empty-to-full through EOF-newline edge cases. · linux: 13 · proof
`internal/fmtsort`	3		`fmt`’s map-key ordering — `Value.Convert`, arithmetically-ordered pointer/channel tokens, `-tests` init-order relocation. · linux: 3 · proof
`internal/fuzz`	52		Go’s fuzzing engine, the layer below `testing`’s fuzz targets — corpus-file marshal/unmarshal round-trips over every basic type (float edge cases, rune validity, integer overflow, malformed records, Windows line endings), the byte-slice mutator table, input minimization, and the worker queue. The first package banked through the host’s `TestMain` flag bridge: its `TestMain` calls `flag.Parse()`, which now finds the host’s own command line declared on `flag.CommandLine` exactly the way `testing.Init()` declares `-test.*`. · linux: 52 · proof
`internal/godebug`	5		The $GODEBUG settings machinery itself, hand-owned end to end and validated against its own contract — the 12-case parse/override table through `t.Setenv` (later entries override earlier, `#` names undocumented settings, `value#pattern` splits), and the TWO protocol arms Go layers on top: `TestCmdBisect` runs x/tools’ cmd/bisect against the converted test host binary itself — dozens of spawn-and-classify runs whose `value#pattern` matchers decide per CALL STACK through the converted `internal/bisect` over the runtime’s managed traceback surface, hash-stable across processes, converging on exactly the three `BISECT BUG` lines the test’s own source marks — and `TestMetrics` reads `IncNonDefault`’s per-name counters back as `/godebug/non-default-behavior/<name>:events` through the runtime’s metric table (the godebugRegisterMetric shim, the registerPoolCleanup pattern). `TestPanicNilRace` skips identically on both sides (race-build-only). Carries `execution: release-tiered` since the Release+TC0 default flip (2026-09-02): `TestCmdBisect` is a line-attribution assertion and tiering’s presence is what supplies it, measured as a one-axis A/B rather than inferred. · execution: release-tiered · linux: 5 · proof
`internal/godebugs`	1		The GODEBUG registry, cross-checked against the world outside the package: every entry must be documented in GOROOT’s `doc/godebug.md` and must have a matching `IncNonDefault()` call site, found by running `go list std cmd` through the real toolchain and reading every `.go` file it names. · linux: 1 · · proof
`internal/gover`	5		Toolchain version ordering. · linux: 5 · proof
`internal/itoa`	3		Minimal integer formatting. · linux: 3 · proof
`internal/platform`	1		One test that is a whole toolchain round trip: `TestGenerated` shells out to `go run cmd/dist list -json -broken`, unmarshals the port list, renders `zosarch.go` through a `text/template`, pipes that through a `gofmt` subprocess on stdin, and byte-compares the result against the `zosarch.go` it reads from the working directory. The cwd-relative read is why the row was flagged as a risk and is exactly what it proves: the test host runs beside the package’s staged Go sources, so the file resolves and the generated bytes match Go’s own. · linux: 1 · · proof
`internal/poll`	19		The `fdMutex` reference-count protocol under real contention — its lock/unlock state machine, the reference-overflow panics, `TestMutexStress`’s parallel read/write/close ladder and `TestMutexCloseUnblock`’s blocked-reader wakeup — plus the `eofError` policy and the fd-initialisation checks over real file, console and COM-port handles. The row is priced honestly: this suite is the protocol-and-policy layer, and the FD and netpoll engine beneath it is exercised by the `os` and `net` rows that drive it, not here. · linux: 12 + 1 · proof
`internal/profile`	1		The pprof protobuf codec’s packed varint encoding — round-tripped through the white-box test’s own `message` implementation, which is what proved a Go package split across two assemblies still binds its unexported interface methods. · linux: 1 · proof
`internal/reflectlite`	30		The reflection mini-bridge end to end — field walks in Go declaration order, the canonical nil func, Go’s unexported-method and assignability rules one layer down, and channel DIRECTION at every position it is read: through `new(<-chan int)`, off a struct field’s zero, and out of the zero value `Zero(typ)` fabricates. Its three `chan-direction` disclosures retired 2026-08-20 with the class. · linux: 30 · proof
`internal/runtime/atomic`	15		The runtime’s own atomic substrate — contended And/Or ladders across widths (eight goroutines clearing one word bit-by-bit at 8/32/64 bits), Xadduintptr’s four-million-op parallel totals, CAS-release ordering, and `TestStorepNoWB`, the store-through-a-bare-`unsafe.Pointer` probe whose lost write the I5 ruling recorded at 14/15: the mint now RETAINS its source box (`FromBox`) and the store lands in the very slot the pointer names. `TestUnaligned64` skips identically on both sides (64-bit host). · linux: 15 · proof
`internal/saferio`	17		Allocation-capped I/O helpers. · linux: 17 · proof
`internal/singleflight`	5		Duplicate-call suppression — and, in `TestDoAndForgetUnsharedRace`, 1000 goroutines that must all park inside one `Do` before it returns. That row was the cooperative scheduler’s whole bill: under the old ThreadPool executor a parked goroutine held shared capacity, so the test climbed a doubling ladder for 28.7 minutes; on a dedicated thread per goroutine it converges at iteration 8 in 1.2 s. · linux: 5 · proof
`internal/syscall/windows`	2		The Windows syscall shims the rest of the corpus is built on, proven at the two points their own suite reaches. `TestRunAtLowIntegrity` builds a low-integrity primary token — `OpenProcessToken`, `DuplicateTokenEx`, then `SetTokenInformation` writing a `TOKEN_MANDATORY_LABEL` whose SID is `S-1-16-4096` — launches a helper subprocess under it through `os/exec`’s `SysProcAttr.Token`, and requires the CHILD to report its own integrity SID back: the pass is non-vacuous because the re-exec’d process reads its ACTUAL token, so a token that never dropped fails the compare. It is also the row that named the non-blittable-struct-by-address class through a POINTER field rather than an array field — `SID_AND_ATTRIBUTES.Sid` converts to a managed `ж<syscall.SID>` where Windows wants a raw native SID address — hand-owned against a blittable `NativeTokenMandatoryLabel` mirror carrying `StringToSid`’s opaque native handle as a plain `nuint`. `TestSupportUnixSocket` cross-checks `SupportUnixSocket()` against a real `WSASocket(AF_UNIX, SOCK_STREAM, …)` attempt under `WSA_FLAG_NO_HANDLE_INHERIT`, matching on `WSAEAFNOSUPPORT`/`WSAEINVAL`. · linux: n/a · proof
`internal/syscall/windows/registry`	6		Registry key/value CRUD against the real Windows registry — create/open/delete keys, round-tripping all value types (SZ/EXPAND_SZ/BINARY/DWORD/QWORD/MULTI_SZ), environment-variable expansion, and the localized MUI string path through `RegLoadMUIStringW` against the live time-zone key. Two non-blittable-struct-by-address wrappers reached first here: `GetDynamicTimeZoneInformation`’s DYNAMIC_TIME_ZONE_INFORMATION mirror and `SetDWordValue`/`SetQWordValue`’s explicit byte-buffer construction, both hand-owned against the established remedies. · linux: n/a · proof
`internal/sysinfo`	1		The CPU brand string the runtime reports, read through the converted `internal/cpu` name tables. · linux: 1 · proof
`internal/testenv`	7		The capability probes the rest of the standard library’s suites gate themselves on — `HasGoBuild`/`MustHaveExec`/`MustHaveGoRun` consistency, and `TestGoToolLocation`, which resolves `../../../bin/go` from the package’s own directory and requires `os.SameFile` agreement with `exec.LookPath("go")`: the test that pins both halves of the host’s execution environment, its working directory and its PATH. · linux: 7 · · proof
`internal/trace`	92		The execution-trace reader end to end — real trace corpora parsed through the v2 reader (`TestReaderGolden`’s 21 golden streams open by relative path, the fixture family the single-file bundler fix was proven on), the old-trace (1.11–1.21) format converter over its stress corpora — the suite whose swap corruption rooted the parallel-deref-assignment converter fix — summary/MUD statistics, and `TestTraceCPUProfile`’s live `go run` of a profiled testprog, the first consumer of link-staged fixtures (the sandbox compiles real GOROOT sources through a symlink, closing the internal-import class). Three converter/harness arcs met their measure in this one row: sibling-testdata staging, link-staging, and the parallel-assignment family’s third arm. · linux: 98 · proof
`internal/trace/internal/oldtrace`	3		The pre-1.22 execution-trace parser on its own suite — all 12 canned corpora (1.11–1.21 stress, http, fmt and user-task-region streams) parsed and classified good vs deliberately time-unordered with STW reason strings checked, eight historically parser-crashing corrupted inputs required to error rather than crash, and the bucketed `Events` container’s whole lifecycle: append across bucket boundaries, iterate, pop until every bucket drops. This parser is where the star-deref-of-call parallel swap lives (`l.Ptr(i), l.Ptr(j) = l.Ptr(j), l.Ptr(i)`) — the shape the parallel-deref-assignment fix closed after the parent `internal/trace` suite rooted it; this row is the package’s own suite validating clean behind it. · linux: 3 · proof
`internal/types/errors`	155		Every `go/types` error code, checked two ways against the real type checker: each code’s documented Example snippet must actually produce that code, and the codes themselves must stay dense, uniquely named and correctly styled. Its `walkCodes` type-checks `codes.go` through `go/types.Check` on the way in, so this is also the first package to exercise the converted checker over real source. · linux: 155 · · proof
`internal/weak`	4		Go’s weak pointers — `Make`/`Strong` round-trips across `runtime.GC()`, the canonical-handle equality contract over a ten-element set (a second weak pointer made from a `Strong()` result must compare equal to the first, while distinct referents must not), the finalizer ordering that requires the handle to read nil before the finalizer runs, and the issue-69210 regression stress, which races `GOMAXPROCS-1` goroutines through weak-to-strong conversions for a full second while another goroutine holds the collector in its mark phase. The production code is hand-owned, and by a wide margin: Go’s original is two `//go:linkname` declarations into `mheap_` span metadata, one of which re-derives an object pointer from a raw address — a question the CLR does not answer at all — so the managed-native rewrite keeps the observable contract on a `WeakReference` over the `ж<T>` box plus a `ConditionalWeakTable` that makes the handle canonical per referent. The row carries `execution: release-tc0` because its assertions are the `codegen-liveness` shape from the inside: a test stops using a local and then requires the collector to have already reclaimed it. Under the default tier-0 configuration the CLR reports a frame’s slots live for the frame’s whole lifetime, so the referent is never collected — measured directly on this row, 2026-08-30: `TestPointer` fails outright (expected weak pointer to be nil), and `TestPointerFinalizer` does not fail at all, it blocks to the package deadline on a finalizer that can never run, burning the full 600 s while the suite’s other three verdicts land in under 1.1 s. `TestPointerEquality` passes either way, which is the class being precise rather than broad: that test nils its own slice, so the slot is overwritten instead of merely unused. Under the annotated configuration all four pass, in 27 s warm. · execution: release-tc0 · linux: 4 · proof
`internal/xcoff`	3		AIX XCOFF objects — the 32- and 64-bit section and symbol-table readers over the PowerPC testdata executables, `big`-format archive member enumeration, and the malformed-file error path. · linux: 3 · proof
`internal/zstd`	536		The Zstandard decompressor — FSE/Huffman table construction, the sliding window, xxhash checksums, and 500+ fuzz-corpus round-trips. Two of the 536, `TestLarge` and `TestAlloc`, gate themselves on a `zstd` binary being on `PATH` and skip identically on both sides where it is absent; a host that HAS one runs them, and `TestAlloc` asserts an exact zero allocations, so expect it to need an `alloc-profile` disclosure there. · linux: 536 · proof
`io`	60	1	The core reader/writer contracts — pipes over real goroutine rendezvous, `MultiReader`/`MultiWriter` flattening via `runtime.Callers`, `OffsetWriter` on real temp files (`os.runtime_rand`), `WriteString` interface dispatch under `-tests` renaming; alloc-count disclosures. · linux: 60 + 1 · proof
`io/fs`	18		The `fs.FS` interface family — named-interface runtime shells, `fs.Glob` deep recursion, `dirFS` walks. · linux: 18 · proof
`io/ioutil`	28		The deprecated pre-`os`/`io` shims — `ReadAll`/`ReadFile`/`WriteFile`, `TempFile`/`TempDir` including their bad-pattern and bad-directory matrices, and `TestReadDir`, which lists the PARENT directory and expects the sibling `io` package’s own `io_test.go` to be there. · linux: 28 · proof
`iter`	28		Pull-style iterators over `Seq`/`Seq2` — `Pull`/`Pull2` driven to exhaustion and stopped early at every index, the `next`-after-`stop` and double-`yield` panics with their exact Go texts, and panic and `runtime.Goexit` propagation raised on both sides of the handshake (inside `next`, and inside `stop`). The suite is the corpus’s only direct test of a coroutine control TRANSFER: Go’s `newcoro`/`coroswitch` runtime primitives have no managed counterpart, so they are hand-owned onto a real rendezvous (`golib`’s `Coro`, bound through a `ConditionalWeakTable` keyed on the `ж<coro>` token’s identity) while every other line of the package stays the faithful conversion. What makes the row a proof rather than a smoke test is that Go’s own asserts pin the goroutine accounting: `TestPull`/`TestPull2` bracket each phase with exact `runtime.NumGoroutine()` deltas, so the rendezvous has to create, park, resume and retire its goroutine on precisely Go’s schedule — and `TestPullImmediateStop`/`TestPull2ImmediateStop` require a `Pull` whose `next` is never called to leave nothing behind. `TestPullDoubleNext`/`TestPullDoubleNext2` add a `GOMAXPROCS(1)` scheduling case over `runtime.Gosched`. · linux: 28 · proof
`log`	8	1	The standard logger — the whole flag matrix (`Ldate`/`Ltime`/`Lmicroseconds`/`Llongfile`/`Lshortfile`/`LUTC`/`Lmsgprefix`) rendered against regexps, prefix placement, `SetOutput`/`SetFlags`/`SetPrefix` on both the package logger and a fresh one, concurrent `Output` under `-race`, and the empty-`Print` newline rule. `TestAll` pins `log_test.go`’s own line numbers (`63`\|`65`) behind the `Llongfile`/`Lshortfile` prefixes — the assertion the position map exists to answer, and the one that moved this row: the file half alone made it `log/log_test.go:69`, a position in neither tree. alloc-profile disclosure. · linux: 8 + 1 · proof
`log/slog`	194	19	Structured logging end to end — the `Record`/`Attr`/`Value` model including the packed-payload `Value` across every `Kind`, `LogValuer` resolution with its cycle guard, `Logger`/`Handler` composition through `WithAttrs`/`WithGroup`, the built-in JSON and text handlers compared output-for-output over a ~50-case table (escapes, empty groups, `ReplaceAttr` rewriting, `json.RawMessage`, `TextMarshaler` errors), level parsing/marshalling and `LevelVar`, the `log` package bridge, and `testing/slogtest`’s own conformance suite run against both handlers. Its caller-info tests are what rooted the `-tests` pipeline’s internal-test-variant naming defect: an in-package test file is compiled INTO its package, so `TestCallDepth` asserts `log/slog.TestCallDepth` where the derivation had been leaking the converter’s own `_internal_test` class token — a systemic frame-naming bug, fixed rather than disclosed, worth four rows. alloc-profile disclosures on the `...any`/`Value` boxing the two-word Go interface avoids; `TestRecordSource` is the founding host-identity row — its depth-1 case passes on that same fix, while its depth-2 case asks the hand-owned test host to answer `testing.tRunner` in `testing.go`. Carries `execution: release-tiered` since the Release+TC0 default flip (2026-09-02): `TestCallDepth`’s pc=0 is the same line-attribution class as internal/godebug’s, and recovers completely with tiering on. · execution: release-tiered · linux: 194 + 19 · proof
`log/slog/internal/benchmarks`	3		The two hand-written `slog.Handler` implementations `log/slog`’s benchmarks measure against, checked for correctness rather than speed — a minimal text handler’s rendered output byte-for-byte, and an async handler’s ring-buffered `Record` compared attribute by attribute through `slices.EqualFunc` over `slog.Attr.Equal`. · linux: 3 · proof
`log/slog/internal/buffer`	1	1	The pool-allocated byte buffer slog’s built-in handlers render into — the pooled New/Free round-trip with its oversize-discard rule and the Write/WriteString/WriteByte append path. alloc-profile disclosure on the zero-alloc pool assert: the deferred Free closure heap-allocates where Go’s escape analysis plus pool reuse stays allocation-free. · linux: 1 + 1 · proof
`maps`	14		Generic map helpers and iterators. · linux: 14 · proof
`math`	76		The core numeric package — IEEE edge cases, rounding, `Inf`/`NaN`. · linux: 76 · proof
`math/big`	224	2	Arbitrary-precision `Int`/`Float`/`Rat` arithmetic — the karatsuba/toom multiplication thresholds, GCD and modular machinery, string/scan round-trips across bases and formats; two alloc-profile disclosures, one on the `MemStats` byte meter (the unbalanced-multiply temp-`nat` workspaces the ж-box arc’s math/big harvest reclaims). · linux: 224 + 2 · proof
`math/bits`	26		Bit-manipulation intrinsics. · linux: 26 · proof
`math/cmplx`	24		`complex128` transcendental math. · linux: 24 · proof
`math/rand`	43		PRNG streams, including a child-process race test. · linux: 43 · · proof
`math/rand/v2`	36		The v2 PRNG API (PCG, ChaCha8). · linux: 36 · proof
`mime`	17	1	MIME type tables and media-type parsing — the first package through the runtime process-control facade (`LockOSThread`, registry reads). · linux: 18 + 1 · proof
`mime/multipart`	52		MIME multipart reading and writing — the part reader’s boundary scanner over slow, truncated and nested streams, `ReadForm`’s memory/disk spill with the `multipartmaxparts`/`multipartmaxheaders` godebug limits, quoted-printable part decoding, and the writer’s boundary generation under concurrent use. Reaches `net/textproto`’s size-limited header reader through a cross-package `//go:linkname` pull — the forwarder that closed all 45 of this package’s differential rows at once (L12). · linux: 52 · proof
`mime/quotedprintable`	5		Quoted-printable encoding — the reader’s soft-line-break and hex-escape state machine, the writer’s line wrapping, and an exhaustive encode/decode round-trip. · linux: 5 · proof
`net`	472	2	The network stack itself, and the campaign’s largest single row — 474 verdicts either side with ZERO orphans. Real sockets throughout: TCP/UDP/Unix dial-listen-accept across IPv4, IPv6 and dual-stack, `Conn` deadline semantics under concurrent readers, `splice`/`sendfile` fast paths, the Windows `WSA` socket surface through the hand-owned blittable mirrors, interface enumeration over the transcribed `IP_ADAPTER_ADDRESSES` chain, and the DNS resolver end to end — `dnsReadConfig`, the message packer, `LookupHost`/`CNAME`/`MX`/`NS`/`TXT`/`SRV`/`Addr` on both the Go and cgo resolver paths, and NXDOMAIN classification against a live resolver. Its bank was gated for a day not by the conversion but by the HOST: Go’s own reference run failed 26 DNS rows here until the `fec0:0:0:ffff::*` IPv6 placeholder resolvers were replaced — a host-qualification class now carried as a two-line preflight for every net-family run. alloc-profile disclosures on the two zero-alloc hot-path asserts (`TestAllocs` over `WriteMsgUDPAddrPort`/`ReadMsgUDPAddrPort`, `TestTCPReadWriteAllocs` over TCP `Read`/`Write`): both are guarded by `SkipIfOptimizationOff` because Go reaches zero only through escape analysis, and the converted path allocates at three structural sites — `slice<T>` over a heap `T[]`, the `Conn`/`PacketConn` interface surface, and per-call syscall marshalling. · linux: 577 + 2 · proof
`net/http`	1343	2	HTTP client and server, dual-tested in h1 and h2 (real ALPN-negotiated TLS) mode across nearly every case — the campaign’s largest single row. Server: `Serve`/`Handler` dispatch, the 1.22+ pattern-based `ServeMux` router (method/host/wildcard segments, `routing_index`/`routing_tree`’s own suites), graceful `Shutdown` and its in-flight-connection drain, chunked and identity transfer-encoding, and the `WriteTimeout`/`ReadTimeout` deadline machinery. Client/Transport: `Do`’s redirect and cookie-jar handling, `persistConn` pooling and idle-connection reuse/eviction, proxy dialing, and the request/response read/write paths, all against real loopback sockets throughout. The bundled HTTP/2 stack (`h2_bundle.cs`, ported near-verbatim from `x/net/http2`) carries its own frame, flow-control and stream-lifecycle suite within this same row. Two named divergences: `TestTransportGCRequest` gates (`codegen-liveness`’s fourth documented trigger shape — storing the finalized object into a wrapper’s field and reading it back through that wrapper, exactly what `persistConn.readLoop` does with every request); `TestWriteDeadlineExtendedOnNewRequest/h2` discloses (`performance-margin`, this class’s founding row). Carries `execution: release-tiered` since the Release+TC0 default flip (2026-09-02): `server.go:2819` captures a registration site with `runtime.Caller(3)`, a FIXED frame-depth walk, and TC0 inlines the walked chain (`ServeMux.Handle` → `register` → `registerErr`) where tier-0 does not — so `TestRegisterErr` and its `/a` subtest shift by one frame and miss the `registered at .../server_test.go:NNN` assertion. Measured as a one-axis A/B: exactly those two verdicts move, and the census’s own Release+TC0 record shows them as this row’s ONLY two errors, so with the opt-out the row is green at Release. · execution: release-tiered · proof
`net/http/cgi`	38	1	RFC 3875 CGI on both sides of the process boundary — and every host-side verdict is a REAL process spawn, because Go’s suite makes the test binary its own CGI child (`Path: os.Args[0]`, dispatched by `cgi_main.go` on the `SCRIPT_NAME`/`PATH_INFO` it was handed). `TestHostingOurselves` states the shape outright: one binary, two roles, a live `httptest` server in front, so each row exercises `Handler.ServeHTTP` marshalling a request into the CGI environment, a real child process reading that environment back and replying, and the parent parsing the reply. Host side (`host.go`): environment construction and its `TestCGIEnvIPv6`, working-directory (`TestDir`) and explicit-`Env` (`TestEnvOverride`) variants, `removeLeadingDuplicates`, the httpoxy mitigation (`TestDropProxyHeader` — a request’s `Proxy:` header must never reach the child as `HTTP_PROXY`), `PATH_INFO`/`SCRIPT_NAME` splitting across three root shapes, identity and chunked POST bodies, `Location` in both its external (`TestRedirect`) and internal (`TestInternalRedirect`) forms, child stderr routing, duplicate response headers, a nil request body, and the malformed-child error matrix (`Test500With*`: no headers, empty headers, missing `Content-Type`). Child side (`child.go`): `Request()` rebuilding an `http.Request` out of the CGI environment — TLS detection, and the degraded cases where `HTTP_HOST`, `REMOTE_PORT` or `REQUEST_URI` is absent — plus `Serve`’s content-type sniffing across four body shapes. One named divergence: `TestCopyError` discloses (`runtime-capability`) — its `handlerRunning()` probe greps a whole-process goroutine dump for another goroutine’s `ServeHTTP` frame, and `runtime.Stack`’s `all` parameter degrades to the calling thread by documented design because the CLR has no supported cross-thread stack walk, so the probe is structurally false; the copy-error-kills-the-child behavior it guards is proven on the same run by the passing sibling `TestKillChildAfterCopyError`. · linux: 38 + 1 · proof
`net/http/cookiejar`	17		The in-memory RFC 6265 cookie jar driven through Go’s scripted jarTest engine — each scenario a sequence of set-and-query steps asserting the jar’s full sorted content and its per-URL cookie selection: creation, update, deletion and expiration semantics (`TestBasics`, `TestUpdateAndDelete`, `TestExpiration`), host-only vs domain cookies with the public-suffix guard supplied by an injected test `PublicSuffixList` (a local table — no network), the Chromium-compatibility matrices across secure/path/domain selection and cross-domain deletion, host canonicalization through the package’s own punycode encoder (`TestPunycode`, `TestCanonicalHost`), jar-key derivation with and without a suffix list, default-path computation, and the issue-19384 empty-host regression. · linux: 17 · proof
`net/http/fcgi`	12		The FastCGI record protocol end to end — the child’s record dispatch and `FCGI_GET_VALUES` reply, multiplexed request streams over a shared connection, the `ResponseWriter`’s content-type sniffing, and a served request torn down mid-flight. · linux: 12 · proof
`net/http/httptest`	55		The HTTP test-server and response-recorder harness — and, because the harness is only real if the server under it is, the broadest running proof the converted `net/http` has: `TestServer` alone stands up four server flavors (`NewServer`, `NewTLSServer` and each one’s hand-assembled `Unstarted` equivalent) on real loopback listeners and drives 19 verdicts through them, covering client transport selection, `Close`’s blocking semantics with a request in flight, `CloseClientConnections`, and requests issued after close. `TestTLSServerWithHTTP2` is the row worth naming: its `http2` subtest asserts the server observes `HTTP/2.0`, so the bundled HTTP/2 stack negotiates over ALPN on a real TLS socket and both ends agree. The rest is `ResponseRecorder`’s recording semantics — implicit 200, first-code-only, sniffed vs explicit `Content-Type`, `Content-Length`, trailers, flush, nil `Body`, the `HeaderMap`-vs-`Result` split, and the panic matrix for non-3-digit codes — plus `NewRequest`’s URL, method and body-length inference. · linux: 55 · proof
`net/http/httptrace`	2		HTTP client instrumentation hooks — the first row whose verdicts run THROUGH `reflect.MakeFunc`: `compose` walks `ClientTrace`’s func-typed fields with reflect and, where both traces set a hook, replaces the field with a MakeFunc-made func value that `Call`s both. `TestWithClientTrace` layers two traces through the context (`WithClientTrace`/`ContextClientTrace`) and asserts the composed `ConnectStart` fires newest-then-oldest; `TestCompose` drives the composition matrix directly across per-field overrides. · linux: 2 · proof
`net/http/httputil`	53		`ReverseProxy` and the request/response dumpers — a proxy is two HTTP implementations facing each other, and nearly every row here runs a real `httptest` backend behind a real `httptest` frontend over loopback sockets. Covers hop-by-hop header stripping and the `Connection`-listed variants, `X-Forwarded-For` append vs omit, the `Director` and `Rewrite` configurations including the four query-parameter-smuggling regressions that separate raw query preservation from form parsing, `ModifyResponse` and `ErrorHandler` across their four-way matrix, flush-interval selection across seven server-sent-event and `Content-Length: -1` cases, buffer pooling, unannounced trailers, 1xx informational responses via `httptrace`, and panic propagation with the incoming body closed. `TestReverseProxyWebSocket` and its cancellation sibling carry a full protocol upgrade through the proxy — hijacked connections in both directions, which is the strongest statement here about the converted socket layer. The dumpers round-trip `DumpRequest`/`DumpRequestOut`/`DumpResponse` over the same servers, including the issue-38352 canceled-request deadlock regression. · linux: 53 · proof
`net/http/internal`	14	1	HTTP chunked transfer-encoding end to end — the chunked reader/writer round-trip across partial, multiple and byte-at-a-time reads, hex chunk-size parsing with its overflow and empty-value error matrix, the incomplete-chunk and end-read error paths, the malicious-sender overhead detector, and the bare-LF rejection matrix (`TestChunkInvalidInputs`, four subtests) that hardens the reader against request smuggling; alloc-profile disclosure on the interface-shell allocation. · linux: 14 + 1 · proof
`net/http/internal/ascii`	13		ASCII case-insensitive helpers. · linux: 13 · proof
`net/mail`	11		RFC 5322 mail message parsing end to end: the address-list grammar across quoted strings, comments and folding white space, RFC 2047 encoded-words in both `B` and `Q` form with a custom `WordDecoder`, group syntax, obsolete and malformed input driven through a shared error matrix, the `Address.String()` round trip back through the parser, and `Date` header parsing including the CFWS-bearing forms. Its verdicts ride `net/textproto`’s reader and `mime`’s word decoder underneath. · linux: 11 · proof
`net/netip`	210	57	The IP-address value types end to end — `Addr`/`Prefix`/`AddrPort` across the full parse/format matrix (IPv4, IPv6, zones, 4-in-6, and the `ParseAddr`/`ParsePrefix`/`ParseAddrPort` error tables), the `uint128` arithmetic underneath, `As4`/`As16`/`AsSlice` conversions, `Compare`/`Less` ordering with sorted round-trips, prefix masking/containment/overlap, and the binary/text/JSON marshal round-trips. `TestInlining` passes for real: it drives the actual Go toolchain (`go build --gcflags=-m`) through the converted `os/exec`/`testenv` plumbing and reads the compiler’s own inlining report back. The 57 disclosed rows are the three `AllocsPerRun` families (`TestNoAllocs`, `TestAddrStringAllocs`, `TestParsePrefixAllocs`) — want-0/want-1 asserts Go satisfies by stack allocation and inlining where the converted path measurably heap-allocates, each leaf pinned on its own counter line; they are the zh-box reduction arc’s named netip harvest and retire as that arc lands. · linux: 210 + 57 · proof
`net/rpc`	15		The RPC server and client themselves, where `net/rpc/jsonrpc` below drives them over an in-memory `net.Pipe`: every row here runs against a real `net.Listen("tcp", "127.0.0.1:0")` server, and the HTTP half dials an `httptest.NewServer` — so the gob codec, the reflection-driven method dispatch and the converted socket stack are all live at once. Covers service registration’s signature validation (unexported argument types, non-pointer replies, methods that are not RPC-shaped), the `Arith` round trip over both the direct and the `DialHTTP` transports on two independently registered servers, the builtin `map`/`slice`/array reply types, `Go`’s asynchronous calls, and the teardown matrix — `Accept` returning after its listener closes, client close racing an in-flight call, codec close, write errors, gob encode failures, and the send-deadlock guard. `TestCountMallocs` and `TestCountMallocsOverHTTP` are matched verdicts that both runtimes SKIP identically, on Go’s own `GOMAXPROCS>1` gate rather than on any converted-runtime limitation, so neither is a disclosure. · linux: 15 · proof
`net/rpc/jsonrpc`	9		JSON-RPC 1.0 client and server codecs driven through the real `net/rpc` server over an in-memory `net.Pipe` — hand-coded request framing, out-of-order concurrent calls, the `map`/`slice`/`[1]int` builtin reply types the server allocates from the method type alone (`reflect.New(mtype.ReplyType.Elem())` — the row that made a fixed-size array’s LENGTH reach reflect through a method’s pointer parameter), malformed input and output, and the null-result error path. · linux: 9 · proof
`net/smtp`	19		The SMTP client end to end, and the first roster row driven through real loopback TCP sockets rather than an in-memory pipe: `TestSendMail`, `TestSendMailWithAuth`, `TestTLSClient` and `TestTLSConnState` each stand up a `net.Listen("tcp", "127.0.0.1:0")` (or `tls.Listen`) server and speak the real dialogue to it, so the converted socket stack is under test alongside the protocol. Covers the AUTH mechanisms with their RFC-required TLS/localhost guards (CRAM-MD5, PLAIN, the trailing-space trim, and the failure path), HELO-vs-EHLO negotiation with the 8BITMIME and SMTPUTF8 extension advertisements across five subtests, per-command hello-first ordering, and a STARTTLS upgrade whose `ConnectionState` is read back through the converted `crypto/tls` handshake against a self-signed certificate. · linux: 19 · proof
`net/textproto`	26		Text-protocol primitives under HTTP/SMTP — MIME header reading with canonicalization (including the want-ZERO `AllocsPerRun` asserts over the common-header fast path, satisfied by the `m[string(b)]` transient-key lookup, hoisted big-const masks and `Once.Do`’s zero-alloc fast path — L11), dot-encoding reader/writer, continued lines, and pipelined request sequencing. · linux: 26 · proof
`net/url`	48		URL parsing, escaping and reference resolution — the query encode/decode matrix including semicolon rejection, userinfo, opaque and relative references, `JoinPath`, and `gob`/`JSON`/`TextMarshaler` round-trips of a parsed `URL`. · linux: 48 · proof
`os/exec`	116		Running external processes end to end, driven by Go’s own helper protocol — which re-executes the test binary itself as the child, so every `Cmd` path here is exercised against a real process tree: pipes and `StdinPipe`/`StdoutPipe` teardown, `Output`/`CombinedOutput`/`Wait`, `ExtraFiles` handle inheritance, environment de-duplication and NUL rejection, `LookPath` with Windows `PATHEXT` and `ErrDot`, exit-status plumbing, and `context` cancellation with `Cancel`/`WaitDelay` including the interrupt-and-hang matrix. The 27 verdicts once disclosed as the roster’s first `host-limit` class — `TestCommand` and `TestLookPathWindows` COPY the test executable and run the copy, which a framework-dependent apphost could not survive — pass on their own measurement since 2026-08-27: the `-tests` host publishes as a self-contained single-file executable, the lone relocated copy runs exactly as Go’s statically linked binary does, and the class entry retired with them per its own self-retiring text. · linux: 86 + 2 · proof
`os/exec/internal/fdtest`	1		The file-descriptor existence probe; its one test is Windows-gated and the converted run reaches Go’s own `runtime.GOOS` guard and skips exactly where Go does. · linux: 1 · proof
`os/signal`	1		Console-signal delivery (Ctrl+Break) through real channels and `select`. On Linux the whole POSIX surface validates through the PosixSignalRegistration bridge carrying Go’s sighandler decision — Notify/Stop/Reset/Ignore, the nohup families over inherited SIG_IGN (seeded from real dispositions at start, exactly Go’s initsig), NotifyContext, the stress and timing suites, and `TestAllThreadsSyscallSignals` matching Go’s own cgo skip via the ENOTSUP hand-own; the two disclosed rows are the execution tracer and the cgo pty controlling terminal, runtime capabilities the managed host does not model. · linux: 29 + 2 · proof
`os/user`	5		Windows account lookup end to end — `Current()`, `Lookup`/`LookupId` by name and by SID string, `LookupGroup`/`LookupGroupId`, and the local-group membership walk behind `GroupIds()`. This is the consumer the native pointer-out arc was built for: `NetUserGetInfo` and `NetUserGetLocalGroups` return buffers the kernel itself allocates, and `LookupAccountSid` appends the SID bytes inside the buffer it fills — self-referential, so the transcription anchors that buffer rather than trusting a managed copy, a distinction a type-only fix would have passed here and failed intermittently under GC pressure. `lookupUserPrimaryGroup`, `lookupFullNameServer` and `listGroupsForUsernameAndDomain` are hand-converted against those native shapes. · linux: 12 · proof
`path`	9		Pure path manipulation (`Clean`/`Split`/`Join`/`Match`…). · linux: 9 · proof
`path/filepath`	61		Path algebra plus the Windows symlink machinery — `EvalSymlinks` through the hand-owned `FindFirstFile` blittable mirror, `Glob`/`Walk`, junction-aware `TempDir` cleanup, `testenv.GOROOT` via the pipeline’s exported root, and 20 privilege-gated skips agreeing with Go’s · host-conditional (symlink-creation privilege — the parent test skips before spawning them without it): `TestWalkSymlinkRoot/no_slash`, `TestWalkSymlinkRoot/slash`, `TestWalkSymlinkRoot/abs_no_slash`, `TestWalkSymlinkRoot/abs_with_slash`, `TestWalkSymlinkRoot/double_link_no_slash`, `TestWalkSymlinkRoot/double_link_with_slash` · linux: 54 · proof
`plugin`	1		That a program importing `plugin` links and starts at all — Go’s own regression test for issue 28789 is an empty body asserting precisely that, and the converted binary runs it. · linux: 1 · proof
`regexp`	45		The full RE2 engine — NFA/backtracker/one-pass executors, the RE2 exhaustive corpus, `TextMarshaler` round-trips. · linux: 45 · proof
`regexp/syntax`	12		Regexp parsing, simplification and program compilation; named-type constant tables. · linux: 12 · proof
`runtime/debug`	4	5	The runtime’s own debugging surface — `ReadGCStats`’ packed pause history (`n` pauses, `n` end times, `lastGC`, `numGC`, `totalPause`, most-recent-first) cross-checked against `ReadMemStats` in nine assertions that hold because both read one shared recorder, the `SetGCPercent`/`SetMaxThreads` get-set knobs including the overflow path, and `SetCrashOutput`, which re-executes the test binary, panics inside `TestMain`, and reads Go’s crash report back from BOTH the child’s stderr and the crash file. That last one is the row that made every converted program print `panic: <value>`, a blank line, `goroutine N [running]:` and a Go-spelled traceback where a .NET exception dump used to go. host-limit + runtime-capability + codegen-liveness disclosures. · linux: 4 + 6 · proof
`runtime/internal/math`	1		The allocator’s overflow-checked `MulUintptr` across its boundary table — the `uintptr`-typed constant shift whose width decides whether the fast path guards at 2³² or at 1. · linux: 1 · proof
`runtime/internal/sys`	4		The runtime’s own bit intrinsics — `Bswap32`/`Bswap64` and `TrailingZeros32`/`TrailingZeros64` across their full input matrices. · linux: 4 · proof
`runtime/metrics`	2		The runtime metrics table end to end — `All()`’s sorted-name/regexp contract against `doc.go`, and a full `metrics.Read` round trip computing a kind for every published metric through the first linkname push into a `_test` package, the managed `metricsLock`, and every stat-aggregate compute closure. · linux: 2 · proof
`slices`	119	3	The generic slice algorithms over `S ~[]E` end to end — sort/stable-sort with cmp variants, binary search, Insert/Delete/Replace/Compact/Reverse/Rotate at every boundary, the iterator surface (`All`/`Values`/`Backward`/`Collect`/`Sorted*`), and `TestConcat_too_large`’s overflow matrix, whose `make([]struct{}, math.MaxInt)` fakes flow through Concat’s Grow chain allocation-free — the slice-shaped-spread arc’s own target, the row this arc was priced to unlock (`append(s, t...)` travels as the slice it is; the Span int32 ceiling left the call boundary). The three disclosures are the pre-ruled classes: `TestConcat`/`TestGrow` assert allocation counts the managed regime cannot denominate in Go mallocs (alloc-count-semantics), and `TestInsert`’s rotation budget meets the model’s structural heap boxes (alloc-profile, 242 golib objects against a want-below-25). · linux: 119 + 3 · proof
`sort`	63		Interface-driven sort, `sort.Slice` reflection swaps, NaN-aware ordering, stability. · linux: 63 · proof
`strconv`	55	11	Number↔string conversion at full precision — Ryū/Grisu float formatting, arbitrary-precision decimal shifts, complex parsing; alloc-profile disclosures. · linux: 55 + 11 · proof
`strings`	68	4	String algorithms; alloc-count/alloc-profile disclosures. · linux: 68 + 4 · proof
`sync`	47	4	The concurrency crown — `Mutex`/`RWMutex`/`WaitGroup`/`Once`/`Cond`/`Map`/`Pool` over real parked-thread semaphores, a hand-owned lock-free pool ring, and GC-integrated cleanup; `Cond`’s copy detector on root-allocation identity; codegen-liveness disclosures (the `TestOnceXGC` family). · linux: 44 + 7 · · proof
`sync/atomic`	108		The atomic-operations matrix end to end — Load/Store/Swap/CompareAndSwap/Add/And/Or across every width in both the function and method forms, the racing hammer suites (4–8 goroutines × 10⁶ iterations per op over one shared word), `atomic.Value`’s store/swap/CAS semantics with the inconsistent-type and nil panics, Go’s align64 GUARANTEE asserted through reflect (`StructField.Offset` and `Pointer()&7` answering from ONE layout walk — the alignment-truthful token), and `TestHammerStoreLoad`’s reinterpret of a single uint64 as `int32`/`uintptr`/`unsafe.Pointer`/`atomic.Pointer[byte]` in turn — the row that made a native-backed pointer slot hold the pointer’s VALUE rather than a managed reference, closing a GC-invisible dangling-reference hazard along with it. · linux: 108 · proof
`syscall`	65		The Windows system-call surface itself — WTF-8/UTF-16 round-trips across the whole surrogate matrix (lone highs, lone lows, paired, and the astral characters between them), `EscapeArg`’s command-line quoting rules, the environment block, `StartupInfo`/handle inheritance and permuted-fd process launch, `TOKEN_ALL_ACCESS`’s version-dependent value, and `Getwd` over a path far past `MAX_PATH` — the row that needed a converted process to be long-path aware the way every Go binary is. · linux: 38 + 17 · proof
`testing/fstest`	7		The `fs.FS` conformance checker and the in-memory `MapFS` it validates — `TestFS` walking a tree to cross-check `Open`/`ReadDir`/`ReadFile`/`Stat`/`Glob`/`Sub` and every `fs` sub-interface for mutual agreement, `MapFS`’s synthesized directories and `FileInfo`, symlink resolution through `fs.ReadLink`/`Lstat`, the shuffled-order harness that proves `ReadDir` results are sorted independently of map iteration order, and `TestFSWrappedErrors`’ `errors.Is`/`As` unwrapping contract. · linux: 7 · proof
`testing/iotest`	18		The `io` testing helpers — the half/one-byte/timeout/error reader wrappers, `DataErrReader`’s final-read fusion, and the read/write loggers’ `log` output. · linux: 18 · proof
`testing/quick`	8		Property testing — `reflect` value generation and `Value.Call` dynamic invocation. · linux: 8 · proof
`testing/slogtest`	17		The `slog.Handler` conformance harness Go ships for third-party handlers, run against the real `TextHandler`/`JSONHandler` — the whole 17-case matrix of groups, inline and empty groups, `WithAttrs`/`WithGroup` composition, and `LogValuer` resolution. · linux: 17 · proof
`text/scanner`	18		Rune-level source scanning. · linux: 18 · proof
`text/tabwriter`	3		Elastic-tab column formatting; panic-during-write recovery. · linux: 3 · proof
`text/template`	52		Go’s template engine end to end — the exec matrix over structs, maps, methods, pipelines and variables; `text/template`’s own reflection-heavy value plumbing (`Value.Call` including variadic and method values, `Index`/`Slice`/`Slice3` over strings and containers, typed-nil rendering); template composition, `{{block}}` redefinition, `html`/`js`/`urlquery` builtins, and the error and recovery matrix. The last two verdicts were channels: `TestExecute` ranges a bidirectional `chan string` through `reflect.Value.Recv`, and `TestIssue43065` ranges a `make(chan<- int)` and needs Go’s `range over send-only channel` — one needs the recv bridge, the other the direction that had to land with it. · linux: 52 · · proof
`text/template/parse`	52		Template lexing and parse-tree construction — the item stream, custom and alphanumeric delimiters, actions/pipelines/variables, `{{block}}` and tree copying, and the full parse-error matrix. · linux: 52 · proof
`time`	169		Monotonic and wall clocks, timer/ticker delivery including Go 1.23’s synchronous timer channel, RFC 3339 and layout parse/format, zone loading. · linux: 167 · proof
`unicode`	28		Category tables, case mapping (`SpecialCase`), script ranges. · linux: 28 · proof
`unicode/utf16`	8	1	Encode/decode round-trips via `reflect.DeepEqual`. · linux: 8 + 1 · proof
`unicode/utf8`	14		UTF-8 encode/decode — the first suite to pass (2026-07-17). · linux: 14 · proof

Excluded packages

The naive denominator above — 215 — counts every converted package whose Go 1.23.12 sources define a Test function. Five of those cannot be validated at all, and not because the work is unfinished: each is blocked by a property of the target that no amount of converter effort changes. The campaign’s real goal is 100% of what remains, so both denominators are always reported and nothing disappears quietly — every exclusion is carried here with its class, its mechanism and the measurement that put it there, exactly as every disclosure is pinned by exact failure signature.

The admission bar is the disclosure bar’s sibling, and it is strict: a package is excluded only when validation is provably meaningless or impossible — never merely hard, unimplemented, or expensive. Each exclusion is ruled individually, on measurement. Three classes are in evidence:

E1 — no eligible tests on the target platform. Go’s own build constraints leave the eligible test set empty on windows/amd64. There is nothing to validate; the comparison is vacuous by Go’s own definition.
E2 — broken oracle. Go’s own suite fails on the reference side, so no clean differential baseline exists to compare the conversion against. ⚠ An E2 exclusion is only as durable as the HOST that measured it — a failing oracle can be a property of one machine rather than of the target — so a fleet-wide re-probe comes before any machinery is built on the exclusion (os/user, 2026-09-01: the row banked from a host whose oracle probed clean; had no host been clean, the honest form was an oracle-side host-limit disclosure, not a standing exclusion).
E3 — the test’s subject is the replaced representation. The suite measures the raw memory model a safe managed runtime deliberately does not have, so any pass would be fabrication rather than implementation.

The rejoin clause is binding and works exactly like the disclosure classes’ anti-laundering rule: an exclusion whose mechanism is later implemented — or whose oracle is fixed upstream, or whose platform gains the tests — rejoins the denominator the day the evidence changes, exactly as the chan-direction disclosure class retired itself the other way. An exclusion is a measurement with a date on it, never a permanent write-off.

os/user is the first ledger row to exercise that clause, on 2026-09-01. It was carried as E2 because Go’s own go test failed TestGroupIds on the validation host, leaving no clean baseline to compare against. The re-probe that admitted it back is the whole of the evidence and is stated rather than summarized: bare go test -count=1 os/user on the banking host now reports ok os/user 0.184s, exit 0, with all five tests passing under -v — TestGroupIds among them. The oracle being clean is what the exclusion said it was waiting for, so the row banked the ordinary way, from that host’s own shard, against that same clean baseline. Note the direction this moves the arithmetic: rejoining grows the implementable denominator 209 → 210 at the same time as it grows the numerator 200 → 201, so the row is worth no more to the percentage than any other row — which is precisely the point of admitting it back rather than leaving a passing suite parked outside the count. (Published that day as 208 → 209; striking the phantom ledger row on 2026-09-02 lifts both ends by one. The rejoin itself is unchanged.)

Verdicts below is the naive count the suite would contribute if it could be compared: 0 where the platform yields no eligible test, — where no baseline exists to count against. Rooting links the owner ruling that admitted the class; the per-package measurements behind each row are recorded on that same board.

Package	Verdicts	Class	Mechanism	Rooting
`internal/syscall/unix`	0	E1	A Unix-only package; no `Test` declaration survives the windows/amd64 build constraints, and the pipeline reports `not-applicable` with zero errors.	ruling
`net/internal/socktest`	0	E1	A socket-testing helper library other packages’ suites import, not a package with a suite of its own — it declares no test entry points to compare.	ruling
`log/syslog`	0	E1	There is no syslog on Windows; Go’s own constraints exclude the entire suite on this target.	ruling
`runtime/race`	0	E1	Race-detector runtime support is only testable under the `-race` instrumented build; outside it Go declares no eligible tests, and the converted corpus has no such build at all.	ruling
`internal/unsafeheader`	6	E3	The suite’s entire subject is the raw `{Data, Len, Cap}` slice/string header: it fabricates a live slice or string by writing those fields and reinterpreting the struct, and Go’s memory model lets the result alias the original storage. A managed slice is not that triple and cannot be aliased into existence — all 6 verdicts fail identically, structurally rather than by defect.	ruling

internal/runtime/syscall was struck from this ledger on 2026-09-02, by owner ruling, because it was never inside the denominator it was being subtracted from. It is not a member of go list std on windows/amd64 at all — Go’s build constraints exclude every one of its files, which is exactly what its own E1 mechanism said (build constraints exclude all Go files: the converter refuses it, so on this target there is not even a package to convert) — and a phantom cannot be subtracted from a set derived from that listing. 215 − 6 therefore took one too many; the strict Windows-axis implementable set is 215 − 5 = 210. Nothing else moves: no banked row changes, and the header’s numbers are recomputed by src/check-roster-format.ps1 from the table above rather than hand-set.

The measurement is not lost with the row. internal/runtime/syscall is a genuine Linux-axis testable package — converted, with an L3 linux/ folder under src/core/internal/runtime/syscall, and GOROOT carries syscall_linux_test.go — so what the strike removes is a Windows exclusion that was excluding nothing, not a Linux row. The E1 reading above is the Windows half of its story, and the row belongs to Linux’s own denominator when the per-OS denominators land.

Candidates that are not yet ruled are deliberately absent, and the list is currently empty: crypto/internal/boring/bcache was the last name on it, and it left the same way the two before it did — by validating rather than by being ruled out. Three now, in a row: internal/concurrent at 20/20 on 2026-08-30, when the census that was to feed its ruling found the whitebox half honorable and the dead-code half merely a compile wall; internal/weak at 4/4 the same day, once the per-row execution config gave it the configuration its liveness assertions need; and bcache at 1/1 on 2026-09-02, once the hand-owned clear-delegate that replaced its registerCache address store was re-measured at the Release + tiering-off default. None of the three needed an exclusion — which is what the naive denominator is for, and it is worth noticing that every candidate that has actually reached a measurement has come back implementable.

The 215, derived — and the thirteen rows that are not yet banked

The naive denominator was a number the ledger asserted and no reader could reproduce. It is derived here instead, so the subtraction above has something to subtract from. Re-derived 2026-09-02 on windows/amd64 against go1.23.12 with GOROOT pinned explicitly (go version reports the binary’s own build stamp, not the root it resolves, so the pin is stated rather than assumed):

306 — go list std.
219 — of those, the packages carrying at least one func Test declaration in their GOROOT sources. Counted tag-independently over every *_test.go in the package directory, which is why all four E1 rows above — internal/syscall/unix, net/internal/socktest, log/syslog, runtime/race — are inside this figure and then subtracted: Go’s constraints select none of their test files here, but their sources do define the tests. (A fifth E1 row, internal/runtime/syscall, was struck from the ledger on 2026-09-02 precisely because it is not inside it at all — see the note beside that table, and the block below.) The regex admits a bare func Test(t *testing.T) — internal/diff declares one and is a banked row, so the stricter ^func Test[A-Z] form would contradict the table above.
215 — of those, the packages that exist in the corpus as a converted package (a production .csproj under src/core). The four that do not are GOROOT directories with zero non-test .go files, so no production package is converted and there is nothing for a host to reference: embed/internal/embedtest, internal/coverage/test, net/internal/cgotest, runtime/internal/wasitest. Only embedtest carries a ruling today (board, 2026-08-11).
202 banked · 13 remaining. The thirteen, by disposition:
- 5 are the ledger rows above, all of them inside the 215 — internal/syscall/unix, net/internal/socktest, log/syslog, runtime/race, internal/unsafeheader.
- 3 are lane-owned — reflect, runtime, unique.
- 5 have no lane named in any dated record — os (682/686), testing (Option 1 ruled, sequenced), runtime/pprof (capability frontier), net/http/pprof (5 of 15), and runtime/trace (0 of 2, re-measured 2026-09-02: both verdicts now have named roots and the getg stub is no longer the whole story — the execution-tracer family’s disposition is with the owner). crypto/internal/boring/bcache left this list by banking on the same date.
202 + 5 + 3 + 5 = 215, and the eight non-ledger rows are the implementable remainder — which is the header’s arithmetic read from the other side: 210 − 202 = 8.

net/http/pprof is one of those eight and had appeared in no accounting at all — no roster row, no ledger row, and absent from the coordinator tracker’s list of remaining rows, which named eight until this ruling, nine after it, and eight again once bcache banked the same day. It is converted (src/core/net/http/pprof), declares four func Test, and was measured 5 of 15 on 2026-08-14 (board, Scout batch 2): TestHandlers fails with seven subtests infrastructure-erroring, TestDeltaProfile skips where Go passes, and profile collection has no managed body — the same capability frontier runtime/pprof and runtime/trace sit behind. Naming it here is what made the implementable remainder nine on 2026-09-02 rather than the eight the tracker carried; bcache banking the same day brought it back to eight, by the other route.

⚠ One ledger row sat OUTSIDE the naive denominator, and the owner ruling of 2026-09-02 struck it. internal/runtime/syscall is not in go list std on windows/amd64 at all — Go’s build constraints exclude every file, which is what its own E1 mechanism said — so it could not be a member of a set derived from that listing, and 215 − 6 subtracted one non-member. Five exclusions are inside the 215, the strict Windows-axis implementable set is 210, and the header above now reports 202 / 210 — 96.2% — recomputed by the format guard from the corrected ledger, not hand-set. The struck row’s Linux-axis measurement is kept in the note beside the ledger table.

Why the phantom survived weeks of arithmetic that “came out right”: the 215 is reachable by two live memberships that differ by exactly one swap, and both land on 215.

The board’s recorded derivation (2026-08-17) counted src/core directories whose GOROOT sources define a Test — which counts internal/runtime/syscall in (it is converted, with an L3 linux/ folder, and GOROOT carries syscall_linux_test.go) and then subtracts hand-owned testing: “216 … minus hand-owned testing that is the roster header’s 215”. The derivation above counts go list std on this target — which counts testing in (it is an ordinary member with 59 func Test and a .csproj) and internal/runtime/syscall out. Under the first membership 215 − 6 = 209 was exact; under the second it was one too many.
The campaign’s own accounting follows the second, and the owner ruling of 2026-08-30 is why: it puts testing on the road to a validating row (Option 1 — bucket D banks), and a row that can bank must be inside the denominator it banks against.
Two corrections were available — strike the row from the Windows ledger and re-derive the header, or keep it and teach src/check-roster-format.ps1 to subtract only the ledger rows inside the naive denominator (its implementable = testable − ledger.Count assumes all of them are). The owner took the first. It moves a published headline, which is why it was owed to a ruling rather than taken as a docs fix; the guard needed no change at all, because that subtraction is exact once the ledger holds only members.

A by-value struct argument wider than a machine word is passed by hidden reference, so the caller’s temp is address-exposed and therefore untracked by liveness analysis. ↩

go2cs

Golang to C# Converter

Validated Test Packages

Phase 4 progress: 202 / 215 testable packages validated — 94.0%

Excluded packages

The 215, derived — and the thirteen rows that are not yet banked