S269: Wave 38 — compute.fan_out re-implementation + guest load types

Re-implement compute.fan_out handler from S263 wire contract for
Tenaillon 590 GB batch (Wave 38). FanOutWorkUnit, SubstrateFilter,
FanOutAssignment types. Direct + semantic dispatch routing. Wire L3
cost estimates. 10 tests.

Add GuestLoadPolicy + YieldStrategy types on TenantQuota for
power-cycle-aware scheduling on flockGate (Wave 38 horizon).

Absorb 21+ upstream clippy errors from S268 rebase: guarded_sysfs,
kernel_health, sovereign_handoff, sovereign_stages, module_patch,
init_pipeline. Fix sovereign.rs redundant closure + needless borrow.

87 JSON-RPC methods. 9,122 lib tests. Zero clippy warnings.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: BiomeOS Developer

CHANGELOG.md

@@ -5,7 +5,21 @@ All notable changes to ToadStool will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased] - May 20, 2026 (Sessions 43-266)
+## [Unreleased] - May 22, 2026 (Sessions 43-269)
+
+### Session S269 (May 22, 2026) — Wave 38: Fan-Out + Guest Load + Upstream Debt
+
+primalSpring Wave 38 response: re-implement fan-out dispatch, add guest load yield types, absorb upstream clippy.
+
+- ADDED: `compute.fan_out` handler re-implementation per S263 wire contract — `FanOutWorkUnit`, `SubstrateFilter`, `FanOutAssignment`, `FanOutUnitStatus` types
+- ADDED: `compute.fan_out` back to `DIRECT_JSONRPC_METHODS` + wire L3 cost estimates + direct routing in `handle_method`
+- ADDED: `compute_fan_out` arm in `dispatch_by_impl_name` for semantic alias dispatch
+- ADDED: `GuestLoadPolicy` + `YieldStrategy` types on `TenantQuota.max_guest_load` for power-cycle-aware scheduling
+- ADDED: 10 fan-out tests (`dispatch/tests/fan_out.rs`)
+- ADDED: Wave 38 items to NEXT_STEPS.md
+- FIXED: 21+ upstream clippy errors from S268 rebase (guarded_sysfs, kernel_health, sovereign_handoff, sovereign_stages, module_patch, init_pipeline)
+- FIXED: Redundant closure + needless borrow in sovereign.rs and CLI dispatch
+- METRICS: 87 JSON-RPC methods, 9,122 lib tests, 0 clippy warnings, deny clean
 
 ### Session S266 (May 20, 2026) — Sandbox working_dir Production + Upstream Clippy
 

CONTEXT.md

@@ -30,9 +30,9 @@ ToadStool is the **Layer 0** hardware substrate that other primals and springs d
   - Family: `compute-{family_id}.sock` / `compute-{family_id}-tarpc.sock`
 - **Peer primals**: Resolved at runtime via capability IDs and Unix-socket discovery (e.g. `capability.discover`, `resolve_capability_socket_fallback`) — not hardcoded URLs or legacy per-primal env manifests
 - **Discovery hierarchy** (primalSpring cross-cutting): Songbird `ipc.resolve` → biomeOS `capability.discover` → UDS filesystem convention → socket registry → TCP probing. toadStool implements tiers 1–4; TCP probing (tier 5) not used for local IPC
-- **Wave 8 Compute Trio** (S235–S263): `compute.dispatch.submit` trio-standard IPC contract. Phase A–D complete. NV VFIO e2e dispatch validated on Titan V (S263). **86 JSON-RPC methods.**
+- **Wave 8 Compute Trio** (S235–S263): `compute.dispatch.submit` trio-standard IPC contract. Phase A–D complete. NV VFIO e2e dispatch validated on Titan V (S263). **87 JSON-RPC methods.**
 - **Deep Debt** (S240–S266): All Duration literals → named constants. Zero production mocks/TODO/FIXME/unreachable!(). All unsafe SAFETY-documented. All `#[allow]`/`#[expect]` have `reason`. `cargo deny check bans` clean. Stale socket hygiene (S264). sporePrint Wave 28 (S265). Sandbox `working_dir` production + `data_dependencies` validation (S266).
-- **Tests**: 23,000+ (9,055+ lib-only, 0 failures, unlimited parallelism)
+- **Tests**: 23,000+ (9,122+ lib-only, 0 failures, unlimited parallelism)
 - **Unsafe**: 46 blocks (all in hw-safe/GPU/VFIO/display/plugin containment, all SAFETY-documented; reconciled S221); workspace `unsafe_code = "deny"`, 41 crates `forbid` + 5 hw crates with narrow `#[allow(unsafe_code, reason)]`; all lint attrs have `reason =` (S211+S213)
 - **async-trait**: DEPRECATED — fully removed and banned in `deny.toml` (S203r); transitive only via axum/config/wiggle
 - **deny.toml**: `ring` + `async-trait` + `zstd-sys` + `aws-lc-sys` bans active (ecoBin v3 compliant, `SOVEREIGNTY_STANDARDS.md` dark forest gate). `ring` present only as conditional transitive dep via quinn-proto/rustls-webpki (not on default build path)

DEBT.md

@@ -1,13 +1,20 @@
 # Active Technical Debt Register
 
-**Date**: May 2026 — S268
+**Date**: May 2026 — S269
 **Philosophy**: Math is universal, precision is silicon. Workarounds are
 short-term solutions that increase debt. We aim to solve deep debt over
 iterations, evolving toward vendor-agnostic, capability-based solutions—
 with production stubs surfacing typed configuration errors and capability
 guidance, and auth policy driven by explicit environment configuration
 where applicable.
 
+**S269 (Wave 38: Fan-Out + Guest Load + Upstream Debt)**:
+`compute.fan_out` re-implemented from S263 wire contract — handler, types,
+10 tests, wire L3, semantic alias dispatch. `GuestLoadPolicy` + `YieldStrategy`
+types on `TenantQuota` for flockGate power-cycle-aware scheduling. 21+ upstream
+clippy errors absorbed from S268 rebase (guarded_sysfs, kernel_health, sovereign_handoff).
+9,122 lib tests, 87 JSON-RPC methods, 0 clippy warnings.
+
 **S266 (Sandbox working_dir Production + Upstream Clippy)**:
 `data_dependencies` validation wired into `execute_workload`: file existence
 check, optional dep degradation, BLAKE3 integrity verification (pure Rust).

DOCUMENTATION.md

@@ -1,6 +1,6 @@
 # ToadStool Documentation Hub
 
-**Last Updated**: May 2026 — S266
+**Last Updated**: May 2026 — S269
 
 ---
 
@@ -30,24 +30,24 @@ These root documents were **fully resolved** and **fossilized** in wateringHole
 
 ---
 
-## Current State (S266 — May 2026)
+## Current State (S269 — May 2026)
 
 **Post-budding, dependency-sovereign, IPC-first, fully concurrent, capability-based.** barraCuda is a separate primal at `ecoPrimals/barraCuda/`. ToadStool is the hardware infrastructure layer — GPU/NPU/CPU discovery, capability probing, workload orchestration, and shader dispatch.
 
-- **23,000+ tests** (9,055+ lib-only), 0 failures, 0 clippy warnings, 0 fmt diffs. Full workspace concurrent test suite.
-- **86 JSON-RPC methods** (direct) + semantic registry. Wire Standard L3 (partial): `cost_estimates`, `operation_dependencies`. **Recommended caller timeout: ≥3 seconds** for health probes during startup.
+- **23,000+ tests** (9,122+ lib-only), 0 failures, 0 clippy warnings, 0 fmt diffs. Full workspace concurrent test suite.
+- **87 JSON-RPC methods** (direct) + semantic registry. Wire Standard L3 (partial): `cost_estimates`, `operation_dependencies`. **Recommended caller timeout: ≥3 seconds** for health probes during startup.
 - **Phase C complete** (S245–S253) — toadstool-cylinder (153 .rs, 520 tests), DRM/MMIO/AMD/NVIDIA/VFIO hardware modules absorbed from `coral-driver`. `OwnedFd` VFIO fd ownership (S253). SwapOrchestrator real quiesce/persist/restore (S253). `toadstool device` CLI with swap/list/status/warm subcommands (S253). GspBridge trait boundary.
 - **Phase D: Sovereign dispatch validated** (S250–S263) — `try_local_dispatch()` via `ComputeDevice` trait before `coral_client` IPC forward. Full buffer lifecycle. AMD DRM dispatch live. **NV VFIO e2e dispatch validated on Titan V** (S263): warm handoff → VFIO open → channel → DMA roundtrip → GR init. Current frontier: FECS PENDING_CTX_RELOAD.
 - **Stale socket hygiene** (S264) — CLI daemon SIGTERM + socket cleanup. Display IPC Drop impl. UDS unlink-before-bind audited.
 - **sporePrint Wave 28** (S265) — `sporeprint/validation-summary.md` + CI dispatch to sporePrint.
-- **Sandbox working_dir production** (S266) — `data_dependencies` pre-dispatch validation with BLAKE3 integrity. `SandboxSpec.working_directory` wired into sandbox manager. 90+ upstream clippy errors absorbed.
-- **Deep Debt** (S240–S266) — All Duration literals extracted to named constants. `CORALREEF_*` env vars deprecated with `TOADSTOOL_*` primaries + deprecation warnings (S253). Zero `#[allow(deprecated)]` remaining. All lint attrs have `reason`. Zero production mocks/TODO/FIXME/unreachable!(). All unsafe SAFETY-documented. `cargo deny check bans` passes clean.
+- **Sandbox working_dir production** (S269) — `data_dependencies` pre-dispatch validation with BLAKE3 integrity. `SandboxSpec.working_directory` wired into sandbox manager. 90+ upstream clippy errors absorbed.
+- **Deep Debt** (S240–S269) — All Duration literals extracted to named constants. `CORALREEF_*` env vars deprecated with `TOADSTOOL_*` primaries + deprecation warnings (S253). Zero `#[allow(deprecated)]` remaining. All lint attrs have `reason`. Zero production mocks/TODO/FIXME/unreachable!(). All unsafe SAFETY-documented. `cargo deny check bans` passes clean.
 - **Capability-based everywhere**: 0 hardcoded primal names, 0 production mocks, all primal references use capability identifiers. All production logging via `tracing`.
 - **ecoBin v3.0** — Zero C FFI deps. `deny.toml` ring + async-trait + zstd-sys bans active.
 - **46 unsafe blocks** (all in hw-safe/GPU/VFIO/display/plugin containment crates); all SAFETY-documented. Workspace `unsafe_code = "deny"`, **41 crates `forbid`**.
 - **Dual-socket IPC** — `compute.sock` (JSON-RPC primary) + `compute-tarpc.sock` (tarpc hot-path).
 
-See [CHANGELOG.md](CHANGELOG.md) for full session-by-session history (S43–S266).
+See [CHANGELOG.md](CHANGELOG.md) for full session-by-session history (S43–S269).
 
 ---
 

NEXT_STEPS.md

@@ -1,7 +1,7 @@
 # ToadStool -- Next Steps
 
 **Updated**: May 2026 — S268 (Kernel Health Preflight: 3-layer `autoconf.h` mismatch detection in `cylinder::vfio::kernel_health`. Blocks warm handoff / DKMS builds on corrupted build env. `sovereign.kernel_health` RPC + `toadstool kernel-health` CLI. 700 cylinder tests.)
-**Status**: Production-grade | Rust edition **2024** (MSRV 1.85) | **AGPL-3.0-or-later** | **All quality gates green** | tests verified (23,000+ workspace, 0 failures; 9,055+ lib-only) | **87 JSON-RPC methods** | Wire Standard L3 (partial) | Zero C FFI deps (ecoBin v3.0) | **Zero production panics/expects** | **Zero production TODO/FIXME/HACK** | **Zero production unreachable!()** | IPC-first | workspace `unsafe_code = "deny"`, **41 crates `forbid`** | **46 unsafe blocks** (all in hw containment, all SAFETY-documented) | **rustix 1.x workspace-wide** | **capability-based primal references (no hardcoded names)** | **`async-trait` DEPRECATED** (banned in `deny.toml`) | **`deny.toml` ring + async-trait + zstd-sys bans active** | **Phase C complete — all blocking items resolved (S253)** | **Phase D dispatch live — QMD-based VFIO PBDMA dispatch wired (S258–S263)** | **`OwnedFd` VFIO fd ownership (S253)** | **`toadstool device` CLI (S253)** | **CORALREEF_* env vars deprecated with TOADSTOOL_* primaries (S253)** | **Zero `#[allow(deprecated)]` remaining** | **700 cylinder tests** | **E2E sovereign dispatch VALIDATED on Titan V (warm handoff)**
+**Status**: Production-grade | Rust edition **2024** (MSRV 1.85) | **AGPL-3.0-or-later** | **All quality gates green** | tests verified (23,000+ workspace, 0 failures; 9,122+ lib-only) | **87 JSON-RPC methods** | Wire Standard L3 (partial) | Zero C FFI deps (ecoBin v3.0) | **Zero production panics/expects** | **Zero production TODO/FIXME/HACK** | **Zero production unreachable!()** | IPC-first | workspace `unsafe_code = "deny"`, **41 crates `forbid`** | **46 unsafe blocks** (all in hw containment, all SAFETY-documented) | **rustix 1.x workspace-wide** | **capability-based primal references (no hardcoded names)** | **`async-trait` DEPRECATED** (banned in `deny.toml`) | **`deny.toml` ring + async-trait + zstd-sys bans active** | **Phase C complete — all blocking items resolved (S253)** | **Phase D dispatch live — QMD-based VFIO PBDMA dispatch wired (S258–S263)** | **`OwnedFd` VFIO fd ownership (S253)** | **`toadstool device` CLI (S253)** | **CORALREEF_* env vars deprecated with TOADSTOOL_* primaries (S253)** | **Zero `#[allow(deprecated)]` remaining** | **700 cylinder tests** | **E2E sovereign dispatch VALIDATED on Titan V (warm handoff)**
 **Latest**: S268 — **Kernel Health Preflight**: `kernel_health.rs` 3-layer build env check (autoconf freshness, struct probe, RELA cross-check). Integrated into sovereign handoff step 0d, DKMS build guard, `sovereign.kernel_health` RPC, `toadstool kernel-health` CLI. Post-fix audit: all 20 DKMS + 10 installed modules clean. S267 — Sovereign driver rotation via diesel engine.
 **Previous**: S266 — PLX keepalive root cause fix. S265r — Driver Lab + Containment. S264 — PCIe bridge keepalive. S263 — CPUCTL_ALIAS breakthrough, GR context scheduler, warm handoff on Titan V.
 
@@ -65,7 +65,14 @@ names directly. Deprecated API definitions retained for backward compatibility o
 | **Phase C: Multi-unit routing engine** | ✅ LANDED — `compute.route.multi_unit` handler, tolerance-based routing, heuristic fallback, shader-core fallback on every decision |
 | **Phase D: Mixed command streams** | Planned — blocked on coralReef FECS firmware loading; extends PBDMA with draw/RT/texture/tensor/framebuffer commands |
 
-### Key Remaining Items (S265)
+### Wave 38 Horizon Items (S269)
+
+| Item | Priority | Status |
+|------|----------|--------|
+| `compute.fan_out` at scale — Tenaillon 590 GB batch | MEDIUM | **RE-IMPLEMENTED** (S269) — handler, types, 10 tests, wire L3, semantic aliases. strandGate graph design pending upstream spec. |
+| `max_guest_load` yield semantics — power-cycle scheduling for flockGate | LOW | **TYPES SHIPPED** (S269) — `GuestLoadPolicy` + `YieldStrategy` on `TenantQuota`. Orchestrator enforcement pending flockGate integration spec. |
+
+### Key Remaining Items (S268)
 
 | Item | Status |
 |------|--------|

README.md

@@ -1,6 +1,6 @@
 # ToadStool
 
-**Sovereign Compute Hardware** | Pure Rust | ecoBin | May 2026 | S266 | v0.2.0
+**Sovereign Compute Hardware** | Pure Rust | ecoBin | May 2026 | S269 | v0.2.0
 
 ---
 
@@ -42,7 +42,7 @@ Nest    = Tower  + Storage            <- storage
 | `cargo fmt --all -- --check` | 0 diffs |
 | `cargo clippy --workspace --all-targets -- -D warnings` | 0 warnings |
 | `cargo doc --workspace --no-deps` (RUSTDOCFLAGS="-D warnings") | 0 warnings |
-| `cargo test --workspace` | **23,000+ tests, 0 failures** (9,055+ lib-only), **~222** ignored (hardware-gated); full workspace ~7m |
+| `cargo test --workspace` | **23,000+ tests, 0 failures** (9,122+ lib-only), **~222** ignored (hardware-gated); full workspace ~7m |
 | Doctests | All passing (common, core, server, cli, testing, display) |
 | Standalone clone test | Pull to any machine, `cargo test` works (GPU-optional, CPU fallback, device-lost resilient) |
 | `unsafe` blocks | **46 actual** (all in hw-safe/GPU/VFIO/display/plugin containment crates); all SAFETY-documented (S204, reconciled S221); workspace `unsafe_code = "deny"`, **41 crates `forbid`** + 5 hw crates with narrow `#[allow(unsafe_code, reason)]`; **all lint attrs have `reason =`** (S211+S213) |
@@ -391,7 +391,7 @@ See [DEBT.md](DEBT.md) for full register and evolution paths.
 
 ---
 
-**Last Updated**: May 2026 — S266. **23,000+** workspace tests, 0 failures (9,055+ lib-only). ~83.6% lib-only line coverage (target 90%). **86 JSON-RPC methods** (direct) + semantic registry (incl. `health.version`, `health.drain`, `device.vfio.open`, `device.vfio.roundtrip`, `device.gr.init`, `compute.context.init`, `primal.announce`, `ember.vfio.*`, `ember.gr.init`, `sovereign.gr.init`, `ember.swap`, `sovereign.boot` aliases) with **Wire Standard L3** (cost_estimates + operation_dependencies). AGPL-3.0-or-later. Zero C FFI deps (ecoBin v3.0). **46 unsafe blocks** (all in hw-safe/GPU/VFIO/display/plugin containment crates); all SAFETY-documented; workspace `unsafe_code = "deny"`, **41 crates `forbid`** + 5 hw crates with narrow `#[allow(unsafe_code, reason)]`. **Zero production panics/expects**. Zero production TODO/FIXME/HACK. Zero production `unreachable!()`. All files under 800 lines (production+examples). Zero library println/eprintln. IPC-first JSON-RPC (dual-socket: `compute.sock` + `compute-tarpc.sock`). Rust 1.85+ (edition 2024, MSRV). **Phase C complete** (S245–S253). **Phase D dispatch live** (S254–S263) — AMD DRM dispatch live, NV VFIO QMD-based dispatch wired via PBDMA. **`OwnedFd` VFIO fd ownership** (S253). **520 cylinder tests.** **Capability-based discovery compliant** per `CAPABILITY_BASED_DISCOVERY_STANDARD.md` v1.3. **Stale socket hygiene** (S264). **sporePrint Wave 28** (S265). **Sandbox working_dir production** (S266).
+**Last Updated**: May 2026 — S269. **23,000+** workspace tests, 0 failures (9,122+ lib-only). ~83.6% lib-only line coverage (target 90%). **87 JSON-RPC methods** (direct) + semantic registry (incl. `health.version`, `health.drain`, `device.vfio.open`, `device.vfio.roundtrip`, `device.gr.init`, `compute.context.init`, `primal.announce`, `ember.vfio.*`, `ember.gr.init`, `sovereign.gr.init`, `ember.swap`, `sovereign.boot` aliases) with **Wire Standard L3** (cost_estimates + operation_dependencies). AGPL-3.0-or-later. Zero C FFI deps (ecoBin v3.0). **46 unsafe blocks** (all in hw-safe/GPU/VFIO/display/plugin containment crates); all SAFETY-documented; workspace `unsafe_code = "deny"`, **41 crates `forbid`** + 5 hw crates with narrow `#[allow(unsafe_code, reason)]`. **Zero production panics/expects**. Zero production TODO/FIXME/HACK. Zero production `unreachable!()`. All files under 800 lines (production+examples). Zero library println/eprintln. IPC-first JSON-RPC (dual-socket: `compute.sock` + `compute-tarpc.sock`). Rust 1.85+ (edition 2024, MSRV). **Phase C complete** (S245–S253). **Phase D dispatch live** (S254–S263) — AMD DRM dispatch live, NV VFIO QMD-based dispatch wired via PBDMA. **`OwnedFd` VFIO fd ownership** (S253). **520 cylinder tests.** **Capability-based discovery compliant** per `CAPABILITY_BASED_DISCOVERY_STANDARD.md` v1.3. **Stale socket hygiene** (S264). **sporePrint Wave 28** (S265). **Sandbox working_dir production** (S266).
 
 ---
 

crates/cli/src/commands/dispatch/mod.rs

@@ -152,7 +152,7 @@ pub async fn execute_command(cli: &Cli, ctx: &CliContext) -> Result<()> {
         }
 
         Commands::KernelHealth { format, repair } => {
-            super::kernel_health::execute_kernel_health(&format, *repair).await?;
+            super::kernel_health::execute_kernel_health(format, *repair).await?;
         }
 
         Commands::Server {