Track: the supervisor is host-tested and owns the stop

[Japabu]

Tracker only. It files one kind: track issue, issues/isolation/the-supervisor-is-host-tested-and-owns-the-stop.md, and corrects issues/isolation/the-power-broker-authority-with-a-human-in-the-loop.md. No code changes, and nothing is renamed.

What changed and why

• The power-broker track loses its parenthetical and its item 1. toybox receives the power connector (system.toml, console/system.toml), not Rights::POWER.

Gates

• cargo test --lib: EXIT=0.

🤖 Generated with Claude Code

https://claude.ai/code/session_01W6rME2DoqwjcYFStYHHY4j

[Japabu]

Review of #575 at d346d9de. CI ci/host run 36416368694 concluded success at this head (run 36416336103 is skipped). The PR is not a draft. The branch has 1 commit: git diff --shortstat origin/main...HEAD gives 1 file, +134. Production 0, tests 0, all of it tracker prose.

Claims about today's tree (checked at origin/main 69d1b53 and at #536 5235eda7)

• Holds: init flushes logd and then calls the kernel. userland/init/src/main.rs:903-917 (Init::stop: self.log.flush(), then syscap.reboot()/shutdown()).
• Holds on shipped images only: only init's SysCap carries POWER. It is set at kernel/src/loader/mod.rs:857, and system.toml, console/system.toml and diag/system.toml name no power syscap. It is false for test images: tests/testcases/system.toml:41, tests/blockdcase/system.toml:38, tests/partclaimcase/system.toml:47 and tests/quiescetwicecase/system.toml:16 all grant syscap = [... "power" ...], and toyos-manifest/src/lib.rs:95 makes it nameable. The PR body's "no manifest row names power in syscap" is false.
• Holds, with one exception: on Storage: file servers for DATA, the log and the boot volume; the kernel's NVMe and FAT go #536 init syncs the file servers. 5235eda7:userland/init/src/main.rs:1233-1234 (flush then sync_files), :1248-1290. drain_all and sync_all are gone from kernel/src/syscall/machine.rs. But the kernel still runs xhci::flush_disks(), the USB write-cache flush, so "the kernel syncs nothing" is not literally true.
• Holds: [boot] start says its order "means nothing" (system.toml:16). compositor receives filepicker (system.toml:60) and filepicker receives compositor (system.toml:112).
• True only on Storage: file servers for DATA, the log and the boot volume; the kernel's NVMe and FAT go #536: the logd and log-role cycle. On main /log is the kernel's FAT adapter, and log is logd's own inspect port (system.toml:55). The log role exists at 5235eda7:system.toml:193.
• Holds: no service is restarted on end on main. close_when_it_ends (userland/init/src/main.rs:511-518) clears the acceptors. On main, Served::Restart only restores the previous binary after a failed swap.

BLOCKER

• issues/isolation/the-supervisor-is-host-tested-and-owns-the-stop.md:110 — the table records fsd → files as decided — the owner left fsd's name open because files is taken. Lines 114-116 then invent a second decision, renaming the file manager, that nobody made. The row must read "open with the owner", and 114-116 go.
• …the-stop.md:63-64 — stage 1's exit git grep -nE 'fn (resolve|declared)\b' userland/init already answers nothing today (EXIT=1). git's ERE has no \b, and without it the same grep finds main.rs:1170 and :1204 (log stage1-exit.log). The exit is met before any work. It also goes vacuous as soon as the rename removes userland/init. Use a path-independent check that fails today.
• …the-stop.md:97-98 — stage 3's exit, "--known-red lists no quiesce_ test", is met by deletion: tests: the measured schedule — Fast is every PR, then Nightly, then Weekly; 15 never-caught tests and the kernel code only they armed deleted #564 (617e934) deletes quiesce_wakes_on_the_last_exit and quiesce_dump_holds_the_stopped and moves three more to Tier::Nightly. Storage: file servers for DATA, the log and the boot volume; the kernel's NVMe and FAT go #536 deletes quiesce_leaves_the_volume_whole. "Coverage comes back" is not checked. The exit must name each quiesce test as registered in tests/toyos.rs's tier table at a named tier, with --known-red <name> answering NO for each.
• …the-stop.md:77-80 — stage 2's exit cannot fail on the owner's order rule. It has one service and one negative control, and no check of reverse dependency order between two non-storage services. Mutation: ask the services in forward start order, or all at once with storage still last. The stated test stays green. The exit needs a two-service ordering assertion.
• …the-stop.md:118-120 — the rename exit passes on a partial rename. -w, case-sensitive: 3,219 hits today. -i, substring: 3,954. The difference is 110 distinct identifiers the exit never sees: netd_refused_pipes, blockd_io, sshdcase, LOGD, SounddCounters, every_boot_config_runs_logd, swap_netd, and more (logs rename-exit.log, rename-missed-tokens.txt). The init half likewise misses spawn_init, struct Init and every "asks init" line. The exit needs a case-insensitive identifier-boundary pattern with its false positives (klogd, netdev, netdb, ENETDOWN, BlockDevice, fsdir) named.

NOTE

• …the-stop.md:99-101 — ordering. The owner put the rename "after Storage: file servers for DATA, the log and the boot volume; the kernel's NVMe and FAT go #536", not after stages 1-3. Numbering it 4 behind stage 2's open ABI decision delays a mechanical PR that conflicts with everything in flight. Put it first after Storage: file servers for DATA, the log and the boot volume; the kernel's NVMe and FAT go #536, then write stage 1 against toyos-supervisor/userland/supervisor.
• …the-stop.md:48-58 — stage 2's stop-order derivation and cycle-breaking are pure decisions. They belong in stage 1's host-tested crate list, with a host test that refuses an undeclared cycle.
• issues/isolation/the-power-broker-authority-with-a-human-in-the-loop.md:17-19 — fix it, do not absorb it. Its item 1 already holds on shipped images, with init as the broker: toybox receives the power connector (system.toml:152, console/system.toml:48) and not the bit. What is left is the owner's unstaffed question (human confirmation, inhibitors), which is not this assigned track's. The fix: delete the false parenthetical and item 1. Out of this PR's fence (README: do not touch a file you do not own), so it is the orchestrator's.
• Conflicts with Disable quiesce_stops_the_machine and quiesce_wakes_on_the_last_park behind their filed defects #574 (f27d77c) and tests: the measured schedule — Fast is every PR, then Nightly, then Weekly; 15 never-caught tests and the kernel code only they armed deleted #564 (617e934). The second to land edits this track's stage 3. After Disable quiesce_stops_the_machine and quiesce_wakes_on_the_last_park behind their filed defects #574 it must replace issues/kernel/quiesce-dump-holds-the-stopped-reds-wide-with-usb-transport-breaks.md with issues/kernel/a-quiesce-writers-first-pass-outlasts-the-jobs-five-second-spin-up.md. It must drop issues/kernel/quiesce-stops-the-machine-stayed-up-beside-other-guests.md, which is deleted. It must move quiesce_stops_the_machine (writers issue) and quiesce_wakes_on_the_last_park (issues/kernel/quiesce-wakes-on-the-last-park-gave-up-on-threads-running-beside-the-held-one.md) to disabled. After tests: the measured schedule — Fast is every PR, then Nightly, then Weekly; 15 never-caught tests and the kernel code only they armed deleted #564 it must drop issues/build/quiesce-wakes-on-the-last-exit-lost-its-serial-ready-beside-other-guests.md (deleted) and state that two quiesce tests no longer exist. No gate reds on a dangling issue path, so both are found only by git grep on slug and path. Taking the REMOVE of lines 81-96 below takes away both conflicts.
• tests: the measured schedule — Fast is every PR, then Nightly, then Weekly; 15 never-caught tests and the kernel code only they armed deleted #564 deletes two quiesce tests and moves three to Nightly, while the owner decided "the quiesce tests' coverage comes back". The orchestrator must settle which wins before either lands.
• The rename exit counts 596 hits in issues/ and 2 in CLAUDE.md, which agents never edit. The exit forces rewriting recorded evidence in issue bodies. Decide whether issues/ bodies are excluded or rewritten, and have the orchestrator place the CLAUDE.md edits.

REMOVE (the track is 134 lines, a screen is the bar)

• …the-stop.md:9-11 — "835 added and 249 deleted lines" — a count that rots; keep only "stage 1 and 2 wait on Storage: file servers for DATA, the log and the boot volume; the kernel's NVMe and FAT go #536".
• …the-stop.md:15-23 — the tour of init's functions and "1,746 lines" — describes the tree, and stage 1's list already scopes it.
• …the-stop.md:24-26 — the restart bullet — describes Storage: file servers for DATA, the log and the boot volume; the kernel's NVMe and FAT go #536, which will change.
• …the-stop.md:27-30 — "only init's SysCap carries Rights::POWER" — false for four test manifests, and no stage acts on init's end.
• …the-stop.md:31-37 — the stop on main — superseded by Storage: file servers for DATA, the log and the boot volume; the kernel's NVMe and FAT go #536 before stage 2 can start.
• …the-stop.md:38 — "the kernel's quiesce syncs nothing" — misleading: flush_disks stays.
• …the-stop.md:48-49 — "as toyos-proclife and toyos-desktop did" — not load-bearing.
• …the-stop.md:54-56 — the parenthetical naming constants (MAX_PENDING_LAUNCHES, HANDSHAKE_TIMEOUT) — rots with code.
• …the-stop.md:81-96 — the lists of disabled and finding-bearing tests with their issue paths — duplicates src/redlist.rs and four issues, and is exactly what Disable quiesce_stops_the_machine and quiesce_wakes_on_the_last_park behind their filed defects #574 and tests: the measured schedule — Fast is every PR, then Nightly, then Weekly; 15 never-caught tests and the kernel code only they armed deleted #564 rewrite.
• …the-stop.md:94-96 — "These defects are the kernel's stop beside a loaded host" — false: the cited dump issue records a red on a one-guest KVM nightly lane, "not the other suites' load".
• …the-stop.md:99-101 — "each program is named for what it does, not with the Unix daemon suffix" and "the large in-flight PRs" — rationale, and a condition the owner did not set.
• …the-stop.md:114-117 — the files-is-taken paragraph — goes with the first BLOCKER.
• …the-stop.md:124-128 — "the candidate is one connection per started service … lives in a crate beside toyos-swap" — an undecided design; the stage only needs "the ABI is decided with the owner".
• …the-stop.md:133-134 — power-broker inhibitors "would ride the same connection" — a design guess coupling to an unstaffed track.
• PR body: "fsd becomes files", "no manifest row names power in syscap", the whole "What I am unsure of" section, and "Gates" with no log — the body becomes main's merge record.

SEND BACK

[Japabu]

Round 2 of the review of #575, at 883a15f5. CI run 36419150347 ran job host at head 883a15f5 and concluded success. The PR is not a draft. git diff --shortstat origin/main...HEAD gives 2 files, +103 -7. Production code is 0 lines and tests are 0 lines: the whole diff is tracker prose. The measurements below were taken on #536's head 5235eda7, because the rename runs after #536.

Round-1 BLOCKERs

• fsd → files recorded as decided: CLOSED. :30 now reads "open with the owner". :96 names fileserver as the candidate. The invented rename of the file manager is gone.
• Stage 1's exit (fn (resolve|declared)\b) was met before any work was done: CLOSED. The crate exit is not met today, because git ls-tree -d 5235eda7 toyos-supervisor is empty. It also names no path the rename removes. The move itself has lost its check: see the new BLOCKER on :66-69.
• The quiesce exit could be met by deleting tests: CLOSED. :84-87 requires a host test, or a guest test at Fast/Nightly with no redlist row, and says "a deleted or disabled test covers nothing".
• The order exit could not fail: CLOSED. :77-80 reds on forward order and on all-at-once order.
• The rename exit passed on a partial rename: CLOSED for the daemon half. A case-insensitive substring search catches every token on the round-1 missed list by construction. The search gives 4068 matches (daemon-tok-5235eda7.txt). Outside the seven exclusions, the only tokens that are not daemon names are NetDaemon, TOYOS-BLOCKDIO and aaasoundd (daemon-left-5235eda7.txt), and each is fair to rename. The init half catches spawn_init, struct Init and "asks init". Its exclusions are a new BLOCKER below.

BLOCKER

• issues/isolation/the-supervisor-is-host-tested-and-owns-the-stop.md:41-58 — The init exclusion list is inexact in both directions. Applying it at 5235eda7 leaves 1152 lines (init-excl.pl, init-residual-5235eda7.txt).
  • It excludes too much. init( matches process::spawn_init(); at kernel/src/main.rs:446 and every other *_init( call.
  • It excludes too little. Hits that do not name the program remain:
    • TinyCC's corpus, which is third-party (NOTICE:336): init (data) at tests/testcases/tinycc/121_struct_return.c:48, and test_init_bf and test_init_struct_from_struct at 90_struct_init.c:201,240 and in its .expect;
    • tests/test-durations' *_init rows;
    • doom's init: field at userland/doom/src/sound.rs:61,78,115,130;
    • the initial address space in toyos-pcid's oracle, at oracle.rs:77,153,157,158;
    • init_array_vaddr and init_array_size in toyos-ld, and init_array_ptr in toyos-abi;
    • pub use wait::boot::{init, …} at kernel/src/drivers/xhci/mod.rs:10;
    • sftp's a_second_init_ends_the_session.
  • Lines 57-58 make the rename reword about 45 kernel bring-up lines. They include the log string {}ms init budget, which tests/toyos.rs:14760 finds by "init budget".
  • Fix: replace lines 41-58 with a categorical rule: "a match stays only where init means initialise, initial or the CPU's INIT signal (a function, method or field named init, an identifier of that meaning, ELF's init arrays, bring-up prose), or is third-party text (tests/testcases/, the C ports); every other match names the program and goes." Each match is already judged by hand, so this is exact, and it is about 4 lines instead of 18.
• …the-stop.md:66-69 — Stage 2's exit passes with every decision in two places. A new toyos-supervisor holding copies of the decisions with host tests, and userland/supervisor left unchanged, meets all three clauses. That is a sibling code path, and nothing checks :61's "keeps only handles, spawns and the loop". Add: "the stage deletes each decision from userland/supervisor, which calls the crate for it, named per decision in the PR."
• …the-stop.md:90-91 — "the thread count" and "the console drain" are nouns, not claims, so any assertion about either meets the exit. State them as claims, for example "a dump served during the stop counts every thread it stopped as held" (origin/main:tests/common/power.rs:389) and "every record reaches the console, Rebooting. last" (:159).

NOTE

• …the-stop.md:41 — Bounding the search by any letter misses a CamelCase join (the InitRefusal/TimerInit form). At 5235eda7 six such tokens exist and none names the program. "No lowercase letter on either side" would catch SpawnInit and InitPort too.
• …the-stop.md:39-40 — Say that the exclusions match case-insensitively. BlockDevice, UsbBlockDevice, FLAP_NETDEV, KLOGD and _NETDB_H rely on that, and spelling out VirtioSoundDev in mixed case invites a case-sensitive reading.
• …the-stop.md:35 — "the fork's ToyOS files" is undefined. src/forkcheck.rs:19 defines the fork's delta as git log <base>..toyos, which also covers cfg-gated blocks in files shared with other platforms. Say "the fork's delta".
• …the-stop.md:77-83 — Stage 3's two guest tests lack stage 4's "registered at Tier::Fast or Tier::Nightly with no src/redlist.rs row", so landing them redlisted meets the exit. Move that clause so it covers every guest test the track names.
• …the-stop.md:25-29 — Some new names collide with words the tree already uses. At 5235eda7, disks occurs 174 times (for example flush_disks) and mixer 74 times. After the rename, a search for either program is as ambiguous as init is today. The names are the owner's decision; raise the collision before stage 1 is briefed.
• issues/isolation/the-power-broker-authority-with-a-human-in-the-loop.md:16-29 — The edit is correct: toybox receives the power connector (system.toml:152, console/system.toml:48) and not the bit. It is not complete, because :34 still cites "the applet", which was defined only in the deleted parenthetical (REMOVE below).

REMOVE

• …the-stop.md:11-13 — describes the stop on Storage: file servers for DATA, the log and the boot volume; the kernel's NVMe and FAT go #536, which is unmerged, and rots when stage 3 lands; no stage needs it.
• …the-stop.md:73-76 — describes the manifest and names logd, which stage 1 renames before stage 3 is worked.
• …the-stop.md:96-97 "; files stays the file manager's" — a decision nobody recorded; the candidate is enough.
• …the-power-broker-authority-with-a-human-in-the-loop.md:33-34 "because asking the applet is inconvenient — the broker is the answer to that itch" — its antecedent went with item 1.
• PR body, "What changed and why" stage list — restates the track file.
• PR body, "Measurements" table — counts at 62e7e8c7 that rot before stage 1 starts, in text that becomes main's record.
• PR body, "Gates" log pointer "(supervisor-r2/cargo-test-lib.log in the job scratchpad)" — a private path the record cannot reach.

SEND BACK

[Japabu]

Round 3 of the review of #575, at 6f6e925c. CI run 36421960822 ran job host at head 6f6e925c and concluded success, with every step success. The PR is not a draft. git diff --shortstat origin/main...HEAD gives 2 files, +96 -9: 0 lines of production code and 0 lines of tests. The merge 6f6e925c adds nothing beyond e8ba2219: git diff cd2e6307 6f6e925c shows only the two branch files. The measurements below were taken at #536's head 06c6195f (origin/wt/toyos-fsd) and at origin/main cd2e6307. The bound is applied per match to every tracked text file outside the bodies of issues/, and the fork is not included. The files are bound.pl, matches-*.txt and missed-tokens-fsd.txt.

Round-2 BLOCKERs

• The init rule is inexact in both directions: OPEN. The 18-line list is gone, but the categorical rule that replaced it is still inexact both ways. Part of the rule's wording came from round 2's suggested fix, specifically the tests/testcases/ scope and the "every other match names the program" dichotomy. The first three BLOCKERs below give the measurements.
• Stage 2's exit passes with every decision in two places: CLOSED. :62-64 requires each decision to be deleted from userland/supervisor, which then calls the crate for it, named per decision in the PR.
• Stage 4's claims were nouns: CLOSED. Each line at :78-82 is now a sentence that can fail.

BLOCKER

• issues/isolation/the-supervisor-is-host-tested-and-owns-the-stop.md:42-44 — the bound still lets a partial rename pass.
  • What it misses: "followed by no lowercase letter" skips the possessive joined to an s. At both heads, fn a_boot_record_without_inits_stop_is_not_a_pass (src/bootlog.rs:567) and fn inits_lines_are_heard_in_every_form_the_log_renders_them (toyos-swap/src/lib.rs:399) name the program and escape the search.
  • Fix: "followed by no lowercase letter other than one s", which is the regex …(?i:nit))s?(?![a-z]). Measured at both heads, it adds exactly these two matches and nothing else.
  • The CamelCase half of the bound is right. TimerInit is 6 matches at Storage: file servers for DATA, the log and the boot volume; the kernel's NVMe and FAT go #536's head. Round 2's "no lowercase letter on either side" would not catch SpawnInit either, so the implementer's bound is the correct one.
• …the-stop.md:49 — "third-party text (tests/testcases/…)" also covers tests/testcases/system.toml, which is ours. At both heads it names the program 3 times (:10, and twice on :32: "init hands", "init through the power connector, and init has…"), and under the rule those matches stay. Fix: tests/testcases/tinycc/.
• …the-stop.md:45-50 — the rule's two classes do not cover every match, so it cannot be judged without ambiguity.
  • (a) The rule says "every other match names the program and goes", but the bound also hits matches that are neither the program nor a stay-class. Examples at both heads: f32::INFINITY and NEG_INFINITY (toyos-mixer/src/corpus.rs:538-539, gain.rs:102-103), f64::INFINITY and #define INFINITY (userland/libc/src/math.rs:138,151, include/math.h:5), and INITIATE_FLR (toyos-pci/src/af.rs:20, express.rs:33, kernel/src/pcidev/mod.rs:1066). "Initiate" is not initialise. Read literally, the exit requires renaming them.
  • (b) :48 "a log string a test matches such as init budget" reads as a stay-class of its own. Yet 26 lines in tests/ and src/ at Storage: file servers for DATA, the log and the boot volume; the kernel's NVMe and FAT go #536's head match "init: … log strings that name the program. Examples: tests/common/origin.rs:576 and src/metalswap.rs:103 const INIT: &str = "init". Other matches also name the program: INIT_WITHOUT_A_DISK's "boot: init spawned…" (kernel/src/rootfs.rs:30, tests/toyos.rs:20166) and 17init: started test-runner (tests/common/console.rs:641).
  • Fix: replace :45-50 from "A match stays only where" with "A match goes where it names the program and stays otherwise; third-party text (tests/testcases/tinycc/, the C ports) stays." This deletes the stay-class parenthetical.

NOTE

• The fork's delta was not measured in this round, only the superproject. The stage-1 brief should apply the same search there before it is dispatched.

REMOVE

• …the-stop.md:86-89 "The orchestrator's candidate for fsd is fileserver. mixer and disks are refused: …" — nobody made that decision, so "refused" records one that does not exist. It also records one candidate out of the three the owner will be asked about. The first sentence of the bullet is the neutral record.
• PR body, "What changed and why", the first three bullets — they restate the track file and the commit message. Round 2's REMOVE was reworded here, not deleted.
• PR body, "which occurs 6 times outside issues/ at cd2e6307", together with the whole "Unsure" section — a count that goes stale, in text that becomes main's record, and a question to the reviewer that this round answers.

The power-broker edit is clean. "because asking the applet … itch" is deleted and not reworded, and no mention of "applet" remains.

SEND BACK

[Japabu]

Round 4 of the review of #575, at 0e49e251. CI run 36424866787 ran job host at head 0e49e251 and concluded success, with every step success. The PR is not a draft. git diff --shortstat origin/main...HEAD gives 2 files, +92 -9: 0 lines of production code and 0 lines of tests. Round 4 is 6f6e925c..0e49e251: one commit, one file. Main has moved to d4e41022 since the merge base cd2e6307, and none of that movement touches issues/isolation/.

Round-3 BLOCKERs

• The bound misses the inits possessive: CLOSED. :44-45 now reads "followed by no lowercase letter other than one s". That is the prose form of (?i:init)s?(?![a-z]). The implementer ran that regex (supervisor-r4/bound2.pl) at origin/main, and its 1749 matches include both src/bootlog.rs:567 and toyos-swap/src/lib.rs:399.
• The tests/testcases/ scope covered our own system.toml: CLOSED. :49 now names tests/testcases/tinycc/. The other files at that level, LICENSE and hello.c, produce no hit under the bound: grep -i init finds only "definition" in LICENSE, and there the match is preceded by a lowercase letter.
• The rule's classes did not cover every match: CLOSED. :48-49 is round 3's fix text verbatim, "A match goes where it names the program and stays otherwise". So INFINITY, INITIATE_FLR and the "init: …" log strings are each judged by whether they name the program, and no stay-class remains that could contradict that.

Round-3 NOTE and REMOVEs

• The fork's delta was not measured: addressed. :17-19 runs the exit's search over the fork's delta before stage 1 is briefed.
• The fsd candidate and "refused": deleted, and :85 is the neutral record.
• The PR body's first three bullets, the "6 times" count and the "Unsure" section: deleted, not reworded.

BLOCKER
None.

NOTE
None.

REMOVE
None.

LAND