diff --git a/FABRIC-3.5.md b/FABRIC-3.5.md index d7bedc17..5d5edb37 100644 --- a/FABRIC-3.5.md +++ b/FABRIC-3.5.md @@ -602,9 +602,9 @@ Collected so nothing here is mistaken for settled. **Updated 2026-09-18 after § Most of this list is now closed — see §XIV.2 and §XV.6 for what resolved, dissolved, or had its premise rejected. -**Still genuinely open — updated again 2026-09-18 after §XVI settled item 10.** -- **Item 12 (§XIII.5)** — is the Console Tripod leg a new singleton, distinct from today's - per-attach proxies? **Now the largest remaining design item**, and still gates §IV. +**Still genuinely open — updated again 2026-09-18 after §XVII closed item 12. Nothing +structural remains; what follows are small local decisions, one placement question, and one +build-time check.** - **Item 9 (§VII.2/§XVI.5)** — half-answered. The consumer action is defined for the two fleet-fatal cases; open is whether an *ordinary peer's* `SOS` is actionable or merely advisory, plus the trivial number allocation. @@ -768,6 +768,16 @@ would create a Console that does not currently exist. That is worth naming plain is the one place this document's "reorganization, not invention" scope discipline is genuinely strained. +> **CORRECTED 2026-09-18 by §XVII — the paragraph above compares the wrong object.** The +> singular pinned Console *does* already exist: it is the HAL drawing fabric +> (`hal/console.c`, `framebuffer.c`, `vt100.c`, `font_8x16.c`), already singular, permanent +> and kernel-resident — it simply has no VM face and no owner. The per-attach proxies this +> section measured against are what *binding produces*, not what Console *is*. The scope +> discipline is therefore **not** strained: the leg is an existing singleton given an owner, +> and the only genuinely new artifact is a capsule personality. The resolution shape proposed +> below was right; this justification for it was wrong. **RATIFIED — see §XVII.2.** Left in +> place, not rewritten. + **The shape that resolves it without inventing anything** — offered as analysis, **not ratified, Captain Bob's call**: distinguish **Console** (singular, pinned, capsule-backed, the Tripod leg — owns the drawing fabric and is the bind point, per §V.1) from **console proxies** @@ -1264,3 +1274,107 @@ VM inheriting Hera's authority — it is the machine having nothing left to run. authority flowing only down the birth graph (§IX.2) while still terminating. **Offered as analysis, not a ruling — Captain Bob's call.** Added as punch item 18. + +--- + +## XVII. Item 12 CLOSED — "Console" already exists as a singleton; it just has no VM face + +Taken as closing **item 12** (§XIII.5's Console-singleton question), the largest remaining +design item and the one gating §IV. + +**§XIII.5 framed this wrongly, and the error is worth naming before the answer.** It compared +the Tripod legs against `capsule_console_birth()`'s per-attach proxies, found Console "plural, +ephemeral and capsule-less," and concluded that a singular pinned Console "does not currently +exist" — so §IV.1 would be creating one, straining the reorganization-not-invention discipline. +**That comparison picked the wrong object.** Traced 2026-09-18: there are three distinct things +called "console" in this kernel, not two. + +### XVII.1 — The three consoles, traced + +1. **The HAL console — the drawing fabric itself.** `src/starkernel/hal/console.c` (14 KB), + `framebuffer.c` (13 KB), `vt100.c` (43 KB), `font_8x16.c` (27 KB) — ~98 KB of kernel C. + **Already singular. Already permanent. Already kernel-resident.** It is not a VM and has no + owner in the fleet sense. +2. **The console proxy VMs** — `capsule_console_birth()`, plural, ephemeral, minted per attach + from a 3-line C string literal (§XIII.5). +3. **The active-console-VM name** — a single global, `console_set_vm_name()`/ + `console_get_vm_name()` (`include/starkernel/console.h:190-191`), swapped by every dispatch + in the "switch, do work, switch back" pattern. + +### XVII.2 — RULING: the Console Tripod leg is (1), given a VM face. Not a promoted proxy. + +The singular, permanent Console this design wants **already exists in substance** — it is the +drawing fabric. What it lacks is an *owner*: today the fabric is an ownerless kernel singleton +that any VM reaches into through a global. So §IV.1's "Console takes the vacated third slot" +is **not** the invention §XIII.5 feared. It is giving an existing singleton a VM face. + +That resolves the tension cleanly and without inventing anything: + +- **The Console leg is singular, pinned and born-at-boot** — because the fabric it owns already + is all three. +- **The proxies are untouched.** They stay plural and ephemeral, which is correct: they are + what *binding produces*, not what Console *is* (§XIII.5's own phrasing, now properly + grounded). +- **§V.1's "bind point" falls out rather than being asserted.** The VM that owns the fabric is + necessarily what a user or agent VM binds *to*. + +**§XIII.5's proposed shape was right; its justification was wrong.** It proposed exactly this +leg/proxy split but called the leg new. The leg is not new — only its VM face is. + +### XVII.3 — The evidence that the fabric actually wants an owner + +This is not merely tidy. The ownerless global in (3) has already caused a real, live bug, +documented in the kernel's own header (`console.h:193-203`): `console_get_vm_name()` alone is +**not** safe for save-then-restore, because it returns a pointer into the single internal +buffer that `console_set_vm_name()` copies into — so an intervening call in the normal +"switch, do work, switch back" pattern overwrites the very bytes the saved pointer points at +**before the restore runs**. Found live 2026-08-28; the restore silently no-opped. +`console_save_vm_name()` exists solely to work around it. + +That is the signature of shared mutable state with no owner. **Giving the fabric an owning VM +is a structural fix for the class**, not just a reorganization — and it is an argument *for* +Bob's reshuffle that this document had not previously identified. + +### XVII.4 — What this commits to, concretely + +Consequences of the ruling, so they are not discovered late: + +- **Console needs a capsule personality.** `capsules/console/init.4th` — a new directory beside + `hermes/` and `artemis/`. This is the one genuinely new artifact, and it is a capsule, not a + mechanism. +- **`is_fleet_foundation` changes membership** (`capsule_birth.c:793-796`): the name-prefix + triple becomes Hera / Artemis / Console. That single line is what makes a VM pinned + (§XIII.3), so it is also what makes Console a Tripod leg. +- **`kernel_main.c:865`'s `S" Hermes" BIRTH` becomes Console's birth**, and the switch-signal + registration at `:1007` follows it. +- **The DoE CSV schema changes** — `doe_log.c`'s six Tripod-named columns (§XIII.3). Still the + expensive consequence, still not to be resolved by quietly renaming a column. +- **Console must have `BIRTH` registered** (§XIII.6): binding mints a proxy, and minting is + `BIRTH`. Already settled in principle by §XV.1's "any VM can birth." +- **Console becomes the owner of the `console_set_vm_name()` discipline** — the fix in §XVII.3 + is available once there is an owner, but is **not** in this reshuffle's scope. Flagged, not + scheduled. + +### XVII.5 — §IV is unblocked, and §XIII.5's marker corrected + +With item 12 closed, **§IV.1 (Tripod = Hera/Artemis/Console) stands as ratified with no +outstanding objection**, and §IV.2 remains dissolved per §XIV.2. §XIII.5's "this is the one +place the scope discipline is genuinely strained" no longer holds and is corrected there. + +### XVII.6 — Punch list after this ruling + +- ✅ **Item 12 — CLOSED** (§XVII). The Console leg is the existing drawing-fabric singleton + given a VM face; proxies unchanged. §IV unblocked. +- 🔶 **Item 9** — half-answered (§XVI.5): open is whether an ordinary peer's `SOS` is actionable + or advisory, plus the number allocation. +- ⬜ **§VIII.3 first bullet** — where the sinking semaphore mechanically lives. +- ⬜ **Item 16** (§XV.4) — implementation check: teardown paths must reach `STADIUM-EVICT`. +- ⬜ **Item 17** (§XVI.2) — does Hera's suicide replace `BYE`'s cold-restart or become a + separate word? +- ⬜ **Item 18** (§XVI.7) — if Hera is already dead, nobody performs the halt. + +**Nothing structural remains open.** Items 9, 17 and 18 are small, local decisions; §VIII.3's +first bullet is a placement question; item 16 is a build-time check. Every load-bearing +architectural question this document opened — what Hermes becomes, what the Tripod is, what +`BIRTH` means, who owns death, who owns turn order, what survives, what shutdown is — is now +ruled.