Tier 3 code improvements (from BUILD-SYSTEM-ASSESSMENT-2026-07-18 Part 6.2):
- Q2: Add run_command_with_retry() helper with exponential backoff (1s, 2s, 4s).
Wrap download_wget and git clone with 3 attempts. Git clone closure cleans
partial tmp dir between retries (git refuses non-empty clone targets).
- Q3: Preserve auto_deps.toml alongside dep_hashes.toml in binary store publish
(repo_builder.rs). Restore path prefers the preserved copy, falling back to
declared-depends-only reconstruction only when the preserved copy is absent
(e.g. published by an older cookbook). Preserves full ELF dynamic dep graph.
- Q4: DepHashes::read now returns Result<Option<Self>, String> discriminating
'missing' (legitimate first build, fall back to mtime) from 'corrupt' (loud
WARN + force rebuild). Closes a silent-swallow gap where a corrupt
dep_hashes.toml produced an incorrect mtime-fallback rebuild.
- Q6: Standardize error reporting in repo.rs nonstop path to {:#} format,
matching the pattern established in the earlier Tier 1 message commit.
Tier 1 message fixes (remaining items from assessment Part 5.3/5.4):
- M26: build-redbear.sh:569 '30-60 minutes' -> config-dependent range
- A6/A8: Makefile container messages add remediation hint
- B3: mk/config.mk sccache hint adds install guidance
- H2: mk/qemu.mk Unsupported ARCH lists supported values
- mk/redbear.mk comment 'fully-patched' -> 'versioned'
Verification: cargo check 0 errors, cargo test --lib 35/35 passed,
cargo clippy 0 new warnings vs baseline, make -n live + validate clean.
Phase 1 remediation of the build-system assessment:
- Makefile: wire 'validate' target into build/live/reimage flows; surface
lint-config and init-service validators as a first-class gate.
- mk/disk.mk: add 'validate' target running lint-config, init-service
validator, and file-ownership validator; suppress noisy unmount warnings
that masked real failures.
- mk/redbear.mk: add source-fingerprint tracking so integrate-redbear.sh
re-runs when local/recipes, local/Assets, or local/firmware change.
- src/cook/cook_build.rs: atomic dep_hashes.toml write (tmp + rename) to
prevent torn-write cache corruption; binary-store restore now checks
dep_hashes before silent restore; fix production bug in
collect_files_recursive that silently dropped subdirectories whose
name matched an exclude pattern.
- src/cook/fetch.rs, src/cook/fetch_repo.rs: harden atomic patch
application and protected-recipe gating.
- AGENTS.md, local/AGENTS.md, local/docs/COLLISION-DETECTION-STATUS.md:
sync collision-detection status to 'implemented (Phase 15.0)' now that
CollisionTracker is wired across all four installer layers
(installer submodule pointer tracked separately in 13cc6fb0c3).
Verified: cargo check (0 errors), cargo test --lib (35/35 passed),
cargo clippy (0 new warnings vs baseline), make -n validate, make -n live.
- Track base submodule pointer for output_level Warn console-quiet change.
- Capture brush entry.rs redox edits (tokio current-thread runtime, default
minimal input backend) as patches/brush-redox-runtime-and-input.patch and
apply it in the recipe, so a clean source re-fetch keeps the Redox port.
Track base e9342b78 (fbcond bidirectional serial mirror) + kernel 229046c6
(debug fevent readable). Disable the standalone 31_debug_console getty since
fbcond now owns the serial/debug console (avoids competing for the shared debug
input queue and duplicated output). Gives headless serial login on mini + bare.
- build-redbear.sh: detect changes to the 4 forks the staleness loop missed
(userutils pkgar; syscall/libredox/redox-scheme crate path-deps force a full
userspace relink) — prevents stale-binary skew (bash -n validated).
- glib: drop the stale '#undef AT_FDCWD' Redox workaround — relibc now provides
faccessat()/AT_FDCWD, and glib's HAVE_FACCESSAT path needs AT_FDCWD.
- mesa: remove the dropped '-Dosmesa=true' meson option (unknown option) and
guard the osmesa.pc pkg-config edit.
- libinput: unblocked by syncing the fresh relibc libc.a (with timerfd_*) into
the stale prefix sysroot (prefix-sysroot staleness — see notes).
The fork branch normalization it described is done — all local/sources forks are
on submodule/* branches (submodule/relibc, submodule/base, ... in active use).
Unreferenced one-time handoff; recoverable from git history if needed.
Track base 01200174 (smolnetd empty-router/broadcast warnings silenced, e1000e
82574 NIC support). redbear-sessiond: suppress the harmless first dbus connect
retry so it does not print an alarming line on every boot.
SESSION-2026-07-13-DOC-CLEANUP.md was an explicitly-transient session handoff
log (marked not-edit-me) recording a past cleanup; its content is fully
historical. Durable records (post-mortems, policy, resolved-plan implementation
notes) are intentionally kept.
Track base 1769b083 (condition_path_exists for optional daemons, ahcid no-media,
netstack no-NIC idle, dhcpd fast-fail). Re-enable the serial debug console on
the bare target so it has a headless-visible login prompt (matching mini up to
login).
Track relibc submodule pointer 733da068 (translate POSIX F_DUPFD_CLOEXEC 1030 to
Redox syscall value 5, so OwnedFd::try_clone and thus tokio Runtime::build stop
failing with EINVAL). Also revert the ineffective epoll_ctl retry.
Remove temporary tokio/sessiond EINVAL diagnostics now that the root cause is
fixed.
The kernel event scheme now implements kdup, so dup() of an epoll fd works
and tokio's registry.try_clone() succeeds — fixing the tokio runtime EINVAL
that killed every zbus daemon and the brush login shell.
build-redbear.sh: gate the userspace build/sysroot clean on relibc/base
(the forks userspace links) instead of any low-level fork, so a kernel-only
change rebuilds the kernel + initfs + image without a full userspace re-cook.
relibc is statically linked into every userspace binary, so a relibc change
invalidates every consumer, not just the 4 initfs-critical packages the old
ABI_CRITICAL_PKGS list covered. A stale consumer silently bakes in old relibc
behaviour; diagnosing against such stale binaries wastes enormous time. Now:
if relibc rebuilds, ALL package pkgars + recipe build trees are invalidated
for a clean relink; otherwise any consumer pkgar older than relibc.pkgar (the
interrupted-build skew that shipped a broken login image) is invalidated.
Also add a temporary SESSIOND_DIAG probe that tries each tokio runtime config
and logs which one EINVALs, to pinpoint the tokio-runtime failure.
Track relibc submodule at the epoll_ctl transient-retry fix (415fa3c8),
which lets tokio runtimes (the zbus daemons and the brush login shell)
build past the transient /scheme/event EINVAL/EBADF during early-boot
scheme churn.
redbear-bare.toml: switch [users.root]/[users.user] to /usr/bin/brush and
add the brush package, so bare and mini share an identical boot-to-login
shell (bare = minimal boot-test surface, mini = +app payload).
Port the brush shell (reubeno/brush) to Redox and adopt the recipe as a
Red Bear local recipe under local/recipes/shells/brush, with the standard
recipes/shells/brush -> ../../local/recipes/shells/brush overlay symlink so
it takes priority over any upstream WIP copy (per local/AGENTS.md "Local
recipe priority vs upstream WIP"). Removes the old recipes/wip/shells/brush.
The dependency tree did not build for Redox: nix 0.31 only partially
cfg-enables Redox and the libc crate's Redox module omits POSIX symbols that
relibc provides. Fixes are reviewable unified diffs under
local/recipes/shells/brush/patches/:
nix-0.31-redox.patch cfg-enable resource/Id/waitid/from_siginfo, rlimit
import + repr(i32), SaFlags width casts, pty.
libc-0.2-redox.patch add idtype_t, P_*/CLD_*, rusage, getrusage/waitid/
forkpty externs, siginfo child accessors.
brush-umask-redox.patch mode_t is signed on Redox; cast, not u32::from.
The recipe runs `cargo fetch` to materialise registry sources before
patching (they are only unpacked during the build), resolves the right
crate version from Cargo.lock (brush pulls both nix 0.26 and 0.31), and
applies each patch idempotently, failing loudly on version drift. The
binary target is named `brush` (not `brush-shell`), so install it
explicitly. Verified: cooks from a pristine cargo cache using only the
patch files. brush is shipped in redbear-mini as a package for in-image
validation; the login shell stays zsh until brush is runtime-proven.
Base submodule 1f826240: 00_pcid-spawner (/usr) and 10_smolnetd base-default
init units switched to oneshot_async so init never blocks the boot-to-login
path on PCI driver enumeration or a network adapter binding. Adds the
2026-07-16 CHANGELOG entry (mini login restored, kernel MSR #GP guard,
build-system staleness/lock/override fixes).
Mini now boots (q35/KVM) all the way to the getty "Red Bear login:" prompt
on VT2 with zero kernel panics. Root-cause fixes across submodules + config:
- config: 00_base.service zsh->mkdir (a full shell startup hangs an init
oneshot; the earlier 'echo/mkdir also hang' result was a silent config
override running zsh). 00_ptyd.service notify->{scheme=pty} (ptyd signals
readiness via its scheme fd; notify made init block on a byte forever).
- kernel: wrmsr_safe/rdmsr_safe #GP recovery so /scheme/sys/msr can't panic
the kernel (cpufreqd's P-state MSR write #GP'd on KVM, halting the boot
before login). base: ptyd scheme type + hwd ACPI enum -> debug (noise).
installer: warn on config [[files]] override. relibc/bootloader: prior
getrlimit + warning-demotion pointers.
- build-redbear.sh: fix host-fstools staleness (installer/redoxfs never
rebuilt on source change), prefix rebuild-every-build (touch libc.a), add
concurrent-build flock.
Submodule pointers: base 8aa8616d, installer 460d9530, kernel 155d01b1,
relibc a7663b3a, bootloader 6e119641.
vasilito