test: kernel host tests -- the harness, and gpt.c tested on the host

Captain Bob, 2026-11-12: "Build an appropriate test harness! Love the idea."
The kernel had no tests below the boots, so defects QEMU cannot provoke could
not be tested first. Plan: docs/v4.0.0/plans/2026-11-12-kernel-host-tests.md.

kernel/tests/: one host program per kernel source, built with that source as
it is, the kernel's flags (-std=c99 -Wall -Wextra -Werror), and fakes --
the console captured line by line, a deterministic RNG that can fail, and a RAM
disk whose reads, writes or flushes fail at chosen 1 KiB blocks.
make -C kernel/tests test runs them; SRC_<test>= runs a test against other
code, which is how a test is seen to fail against the code before a fix.

test_gpt.c, 12 checks: a table written and read back; 16, 17 and 18 used
entries against max 16 and an entry out of range after the 16th (#180); the
RNG, the first write, a later write and a flush failing (#168). Against gpt.c
before #168 and #180: 4 failures, each defect caught. Now: 0. Both runs in
logs/.../kernel-tests/. Not yet a protocol stage: to rule (the plan, step 5).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RzZgrf7V7Zk2iczBXDRbm

docs/v4.0.0/plans/2026-11-12-kernel-host-tests.md

@@ -0,0 +1,37 @@
+# Kernel host tests -- plan and progress (kept current, one line per increment)
+
+Captain Bob, 2026-11-12: "Build an appropriate test harness! Love the idea." -- for the kernel's own
+C code, so that a defect QEMU cannot provoke (a USB descriptor no emulated device sends, a write that
+fails half-way, a stop that spins) is still tested first and seen to fail. v4 has had this since step
+1 (`make -C v4 test`); the kernel had none.
+
+## The design (my calls, open to a ruling)
+
+- **`kernel/tests/`**, one program per kernel source under test: `test_<unit>.c` compiled on the
+  host with the kernel's own source file, `-std=c99 -Wall -Wextra -Werror`, and nothing else of the
+  kernel. `make -C kernel/tests test` builds and runs them all; each prints `N checks, M failures`
+  as v4's do, and the run fails if any does.
+- **Fakes, not mocks** (`kernel/tests/fakes.[ch]`): the console captured line by line (so a test
+  reads what the kernel said), a deterministic RNG, and a RAM disk whose reads or writes fail at the
+  1 KiB blocks a test chooses -- the disk faults QEMU's blkdebug gives the boots, here per block and
+  without a boot.
+- **Code is moved only to be testable, never changed in the move.** Where a unit is buried in a
+  larger function (the xHCI configuration-descriptor walk inside the event loop), it is moved out
+  into a function of its own in one commit, the boots and the tests unchanged, and then tested.
+- **Not a substitute for acceptance.** The boots stay the only acceptance of the kernel; these run
+  beside them. Whether they become a stage of the protocol and the PR's gate (`nightly.sh
+  kernel-tests`, after test-32) is **to rule** -- proposed once there are enough tests to matter.
+
+## Increments
+
+- [x] 1. The harness (`Makefile`, `harness.h`, `fakes.[ch]`) and `test_gpt.c`: `gpt_read` and
+      `gpt_write_one` against a RAM disk -- a valid table; more used entries than `max` (#180); an
+      entry out of range past `max` (#180); the first write failing and a later one failing (#168).
+      Seen to fail against `gpt.c` as it was before #168 and #180 (`54311be1~1`): 12 checks, 4
+      failures -- each of the two defects caught. Now: 0 failures.
+- [ ] 2. The xHCI configuration-descriptor walk moved out of the event loop, then #170 and #171
+      tested first and fixed.
+- [ ] 3. #176 (seeds wiped on every exit), #177 (the fatal stops halt), #178 (the slot array) --
+      each with what it needs moved or faked.
+- [ ] 4. #179 once #187 is ruled (the block layer's header read).
+- [ ] 5. To rule: the kernel tests as a protocol stage and in the gate.