Claim: S.8b added i2c_ss to the build's system sets, so hw/i2c sources compile with -DCONFIG_SOFTMMU, but this spec keeps its own copy of the set list and still expected no flags. It now lists i2c_ss too.

Passage: QEMU 11.1.2 hw/i2c/meson.build line 22: system_ss.add_all(when: 'CONFIG_I2C', if_true: i2c_ss).

Demonstration: crystal spec spec/qemu/qemu_compile_spec.cr: 1 example, 0 failures (it failed in the full suite run for 3.6). S.8b's review ran the minikconf, inventory and microbit specs but not this one; that was the miss.

Size: one word in one spec.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUH8KMXZyLk8eDgCjvQ9hX check-in: 9f4350d715 user: x86-1-glint tags: trunk

Claim: boot/pe_image.cr parses and checks a PE32+ guest image in place, without copying a header, and returns a status rather than panicking on any field outside its bound. Overflow-checked sums throughout; a DIR64 must have all 8 bytes inside SizeOfImage, one byte stricter than U-Boot's efi_loader_relocate. tools/make_test_guest.cr writes the relocatable fixtures for both machines (base 0x10000000, 8 DIR64 each), byte-identical every run.

Passage: xv6 §3.7 ('Code: exec'): 'Thus exec is risky, because the addresses in the ELF file may refer to the kernel, accidentally or on purpose.'

Demonstration: crystal spec spec/pe_image_spec.cr spec/test_guest_spec.cr: 954 examples, 0 failures, 1 pending (the built aarch64 image). That covers both fixtures, each refused as the other machine, 25 hostile headers per machine, truncation at every boundary, DIR64 in the last 7 bytes, and the built x86_64 image parsing with 0 DIR64. On x86-1 the x86_64 boots are unchanged: guest_space, cat, hosted heap, fault, fault 'write' and overflow. Full crystal spec: 1683 examples, 14 failures, 2 errors, 21 pending. All but one fail at bin/glint-build all or another aarch64 build, which x86-1's X86-only LLVM can't do. The other is qemu_compile_spec, from S.8b, fixed in its own check-in.

Review notes: - Codex also made aarch64 steps in nine existing specs pending when LLVM lacks AArch64 (spec/support/llvm_targets.cr). This is outside the task. It is kept because each skip says why and runs again by itself once the seed is installed, so no check is lost. - An exported glint_pe_parse compiles the parser into the image now, so the image check covers it. BOOTX64.EFI grows 172,544 to 176,640 bytes. - The MACHINE constant uses {% else %} for x86_64, the pattern S.1 replaces. - The aarch64 image, its sizes and its boots are not shown; they run when the seed lands.

Size: 258 non-spec lines (parser 209, tool 48, plus a require); largest function PeImage#relocations, 1,159 bytes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUH8KMXZyLk8eDgCjvQ9hX Leaf check-in: dceeaff183 user: x86-1-glint tags: slice/3.6

Claim: docs/tasks/3.6.md is handed out without waiting for the seed. Everything that runs on the host is done now, for both machines: both fixtures (the tool writes bytes), the parser's checks and every hostile header. The steps that need a built aarch64 image are pending specs, and the reviewer runs them when x86-1's LLVM has AArch64. The plan's S.8 says it is parked after S.8a-c.

Passage: the maintainer, ocx-console 363063f81e: 'Try to let Glint get through the book implementation.' Relayed with the choice of route in glint b142e85cea.

Demonstration: llvm-config --targets-built on x86-1 prints X86, so bin/glint-build aarch64 can't run here; tools/make_test_guest.cr is a host tool and needs no target compiler.

Size: 4 changes to one task, 2 lines in the plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUH8KMXZyLk8eDgCjvQ9hX check-in: 5e0694da5a user: x86-1-glint tags: trunk