redbear-mini now reaches a working brush login and executes commands
(framebuffer ground truth: login -> MOTD -> `user@redbear: $` ->
`echo RB=$((21*2))=OK` -> `RB=42=OK`; login ~12s, brush ~16s in QEMU
q35/KVM). This is the console-login floor of the desktop path.
Root cause was NOT in login/brush/pty/spawn (16+ prior sessions chased
those). cpufreqd reads /scheme/acpi/processor/CPUn/pss; evaluating that
AML ran `_ACQ` on an ACPI mutex whose acquire handler (a) multiplied
the millisecond timeout by 1000 (0xFFFF "wait forever" became ~18h) and
(b) tracked no owner, so a nested acquire by acpid's single AML thread
self-deadlocked. Because acpid is single-threaded and also serves the
`acpi` scheme socket, and because the single-threaded init namespace
manager does a blocking openat in its dispatch loop, a stuck acpid
froze EVERY open in the system. Fixed in submodule/base d78fd44a
(bumped here), verified against local/reference/linux-7.1 ACPICA.
Docs:
- Add local/docs/INIT-NAMESPACE-MANAGER-SCALABILITY-PLAN.md: the
residual architectural root (initnsmgr head-of-line blocking + kernel
ignoring O_NONBLOCK on open) that still lets one slow daemon wedge the
whole open path, with a worker-offload / deferred-open / kernel
O_NONBLOCK execution plan. This is the answer to "use SMP where it's
justified": the parallelism that matters is fault isolation of the
namespace-open path, not throughput.
- CONSOLE-TO-KDE-DESKTOP-PLAN.md v5.9: record the mini-login result and
point at the new plan.
Note: submodule/base worktree also carries in-progress i2c/driver-manager
work (not part of this commit); the acpid fix is isolated.
Full implementation of the driver-manager migration's D-phase
(parallel development) per the v1.3 plan. The § 0.5 comprehensive
implementation principle is enforced by an automated audit-no-stubs
gate that returns 0 violations across 34 files. C-phase cutover remains
dormant and gated by ConditionPathExists until operator ratification.
redox-driver-core (28 unit + 5 integration tests):
- concurrent.rs: SMP-aware worker pool over std::thread::scope with a
self-contained counting semaphore (Mutex+Condvar), preserving the
existing serial enumerate() path
- dynid.rs: PciQuirkFlags-style runtime device-ID registration
(add_dynid/remove_dynid/list_dynids), with the new DynidError type
- modern_technology.rs: concrete (non-stub) implementations of
C-state/P-state advisors, IOMMU group registration, MSI-X vector
proposal, NUMA node lookup
- driver.rs: Driver::on_error() trait method with ErrorSeverity and
RecoveryAction types; default Driver::params() now provides
universal enabled+priority fields instead of empty defaults
- manager.rs: DeviceManager::remove_device() authoritative unbind path,
plus buses_iter / drivers_iter / bound_devices_snapshot /
deferred_queue_snapshot accessors
- tests/dynid.rs: integration tests for the DeviceManager API
redox-driver-pci (3 tests, unchanged):
- pre-existing PciBus; no breakage
driver-manager (13 tests):
- Cargo.toml: adds redox-driver-sys path dep
- quirks.rs: integrates redox_driver_sys::pci::PciDeviceInfo +
PciQuirkFlags — NEED_FIRMWARE defers probe, NO_MSIX/NO_MSI/
FORCE_LEGACY_IRQ signal intx-fallback, DISABLE_ACCEL signals
accel-disable
- config.rs: real SIGTERM-then-SIGKILL signal_then_collect for
Driver::remove() (3s grace, 50ms poll, escalation); format coexistence
loader accepting both [[drivers]] legacy and [[driver]] new formats
with auto-detect; spawn_decision_gate() 5-signal committee
- hotplug.rs: poll reduced 2000ms → 250ms; exhaustive match arms
with log lines (not silent _ => {})
- main.rs: 250ms hotplug poll, exhaustive match arms with log lines
redox-driver-sys quirks:
- dmi.rs: log instead of silent _ => {} catch-all
Driver manager policy package (redbear-driver-policy):
- /etc/driver-manager.d/00-blacklist.conf (4 driver blacklist entries)
- /etc/driver-manager.d/50-amdgpu.toml (AMD GPU driver policy)
- /etc/driver-manager.d/initfs.manifest (ordered initfs driver list)
- /etc/driver-manager.d/autoload.d/ntsync.conf (autoload ntsync module)
- /etc/driver-manager.d/README.md (explanation)
- recipe.toml: custom install script that stages into /etc/driver-manager.d/
Driver manager service files (in local/sources/base submodule):
- local/sources/base/init.d/00_driver-manager.service — dormant
(oneshot_async, ConditionPathExists=!/etc/driver-manager.d/disabled)
- local/sources/base/init.initfs.d/40_driver-manager-initfs.service —
dormant (oneshot, ConditionPathExists=!/etc/driver-manager.d/initfs-active)
Audit gate:
- local/scripts/driver-manager-audit-no-stubs.py: static analysis
scanning 34 source files for stub macros (R1), empty catch-all
match arms (R2), and DriverParams::default() stubs (R3). Returns
0 violations at v1.3.
- local/scripts/driver-manager-audit-no-stubs.sh: thin wrapper
- local/scripts/test-driver-manager-no-stubs-qemu.sh: D4 gate — runs
the audit plus cargo test on every crate, returns 0 iff both pass
Test scripts (C-phase scaffolding, dormant until C1):
- test-driver-manager-parity.sh (C1)
- test-driver-manager-active.sh (C3)
- test-driver-manager-initfs.sh (C2)
- test-driver-manager-hotplug.sh (D3)
- test-driver-manager-pm.sh (D2)
- test-driver-manager-cutover.sh (C4)
Docs:
- local/docs/DRIVER-MANAGER-MIGRATION-PLAN.md: v1.3 status table
listing every D-phase item as Done
- local/docs/evidence/driver-manager/D5-AUDIT.md: capability-by-
capability matrix + verbatim audit output
- local/docs/HARDWARE-VALIDATION-MATRIX.md: driver-manager rows
added with v1.3 status
- local/AGENTS.md: PLANNING NOTES pointer updated to v1.3
- docs/README.md: Related Red Bear-local plans row updated to v1.3
Test totals: 49 tests across the three crates, all passing.
Audit totals: 0 violations across 34 files, all clean.
Note: local/sources/base service files (00_driver-manager.service and
40_driver-manager-initfs.service) live in a submodule and need a
separate commit there. They are NOT included in this commit.
Upstream xhci_calculate_lpm_timeout needs SuperSpeed endpoint companion
SEL/PEL parsing across the hub tree + tier policy + XHCI_LPM_SUPPORT
vendor quirk. Defaults-only timeout writes would be speculative and can
break device links. P7-B assigned a dedicated workstream.
Audit: set_usb2_hw_lpm is xHCI-only upstream; EHCI PM is vendor-specific
TDI PHY LPM only. Correct EHCI power path is legacy L2 port suspend
(host-agnostic); deferred until a concrete device need arises.
base -> 2a3b0d4e: per-device USB 2.0 hardware LPM (L1) enablement at
attach in xhcid (full Linux xhci.c:4650 gate chain, BESL/HIRD params,
MEL Evaluate Context, PORTHLPMC/PORTPMSC sequence). Plan P7-A updated:
xhcid side done; ehcid USBCMD.HIRD and hardware L1 validation remain.
Bump base fork to 28afc1fe:
- ad40fffd ahcid: always re-arm the IRQ line, even for foreign interrupts
(from the UAS workstream)
- 92924224 e1000d/ihdad/vboxd/xhcid: unconditional ack
- 28afc1fe sb16d/ac97d/rtl8139d/rtl8168d/ixgbed/ihdgd: unconditional ack
- 54e89a33 fbcond: perform the display handoff open off the console loop
(concurrent session's root-cause fix for the '-vga std' boot freeze)
Bug class: kernel masks the IRQ line on delivery and only re-arms on the
userspace write-back; conditional acks wedged shared INTx lines forever.
Explains a class of 'works in QEMU, wedges on real hardware' failures.
Full audit + unaffected-driver rationale recorded in the IRQ plan P3
section.
Phases A-C static diagnosis of the wl_proxy_add_listener null+8 crash.
Evidence-backed root cause, candidate patch verdict, ruled-out hypothesis
cross-check, and a copy-pasteable instrumented-rebuild runbook for the
orchestrator.
Verdict: candidate patch qtwaylandscanner-null-guard-listeners.patch guards
the CORRECT site (every generated init_listener). Necessary but not
sufficient alone — complementary to libwayland redox.patch hunk 1.
v5.5 'verified FIXED' claim overstated: never tested in isolation,
kded6 workaround masked it, stale-sysroot risk documented.
Log-grep legs (MSI-X, xHCI IRQ) re-confirmed again this morning; login-based
legs still blocked by the concurrent .claude QEMU workload (SIGKILL of
competing guests); retry loop armed; IOMMU leg needs a redbear-full image.
- 06-BUILD-SYSTEM-SETUP: note which QEMU proof scripts use
qemu-login-expect.py vs host expect
- 01-REDOX-ARCHITECTURE, LOCAL-FORK-SUPREMACY-POLICY,
SYSTEM-STABILITY-AND-UPSTREAM-SYNC-PLAN, UPSTREAM-SYNC-PROCEDURE:
sync with current fork-model and sync-procedure state
- Delete archived/SOURCE-ARCHIVAL-POLICY.md and
fork-push-status/2026-07-12-Round-5-phase-4.1.md — superseded by the
current local-fork model docs and newer fork-push-status rounds
- config/redbear-mini.toml: trailing newline
IRQ plan + validation matrix: the login-based QEMU proofs (PS/2 + serio,
monotonic timer, IOMMU first-use, USB storage BOT) now run through
local/scripts/qemu-login-expect.py (stdlib python) instead of the host expect
tool. MSI-X (virtio-net) and xHCI interrupt-driven mode were re-confirmed on
the current redbear-mini ISO. Re-confirmation of the login-based legs with the
new harness is pending an uncontended host (parallel QEMU workload kills QEMU
processes and stalls guest boots). Also record the fbcond Performing-handoff
boot freeze observed with -vga std (separate graphics-path issue).
Correct the P3-A runtime-validation note and matrix row: the
intermittent apparent boot freeze is startup latency under load (guest
clock ~10-15x slower than wall), not a deadlock or an xhcid bug. A short
50-60s test timeout occasionally cuts the spawn+enumerate sequence,
producing a 'frozen' log while the guest is still running — proven by
18 boots (one apparent short-timeout loss), a 12s log-quiet 'freeze'
the guest resumed from, and every >=180s run enumerating fully. No fix
required beyond adequate test timeouts; no speculative kernel-deadlock
fix was implemented.
The usb-kbd behind the QEMU usb-hub now enumerates fully: debounce ->
port reset -> enable -> second debounce -> pre-attach -> attach ->
ATTACH 5.2 -> slot 3 -> addressed -> descriptors read -> HID class match
-> 'Loading subdriver "USB HID" for port 5.2' (class 3.1 proto 1,
keyboard boot protocol).
Root cause of the final stall: an unconditional SetPortFeature
(PORT_INDICATOR) for every connected+enabled port NAK-hung on QEMU's
indicator-less hub (no control-transfer timeout), blocking the flow
before the post-enable debounce. Now gated on
wHubCharacteristics.HUB_CHAR_PORTIND like Linux has_indicators.
test-usb-hub-qemu.sh: check #5 now requires the hub-child subdriver
line ('Loading subdriver "USB HID" for port <root>.<child>') so a
root-port HID (tablet) can no longer satisfy it — closes a false-
positive hole. Timeout raised to 360s for slow TT-path driver bring-up.
Docs (plan P3-A runtime validation + matrix): full hub + hub-child
chain recorded as QEMU-proven; remaining items (intermittent reactor
startup race, slow TT-path Evaluate Context) noted.
USB-IMPLEMENTATION-PLAN.md P3-A: record the 2026-07-19 QEMU runtime
validation (test-usb-hub-qemu.sh) — full usbhubd chain proven
(descriptor, EP1 change detection, initial scan, debounce, reset to
port-enable), the five latent bugs it surfaced and that were fixed
(scheme attach bootstrap, bitmap off-by-one, missing initial scan,
unbounded EP1 wait, debounce clear deadlock), QEMU's ClearPortFeature
stall handled gracefully by P2-C recovery, and the remaining gap:
hub-child device enumeration (usb-kbd to HID driver) blocked on
xhcid's hub-child attach path (debug-level; TT/route investigation)
plus an intermittent xhcid IRQ-reactor startup race.
HARDWARE-VALIDATION-MATRIX.md: hub row to QEMU-validated for the
enumeration chain, with the hub-child gap noted.
Track base pointer to bd379e07 (usbhubd debounce/reset-wait/U0-wait/
wHubDelay + SET_ISOCH_DELAY, HubDescriptorV3 device_removable fix).
USB-IMPLEMENTATION-PLAN.md: P3-A marked CORE COMPLETE with the full
Linux equivalence inventory and documented follow-ups (USB 2.0 bitmaps,
SS.Inactive warm-reset loop, multi-TT, hub LPM). Hub gap-table row
updated (249 -> ~700 LoC with Linux state machine).
HARDWARE-VALIDATION-MATRIX.md: hub row updated — enumeration core
complete with 14 unit tests; runtime hub proof tracked under P8-B.
Track base pointer to d20557f7 (xHCI 1.1+ feature gating: LEC/U3C/CIC
gates, HW LPM substrate with protocol-caps HLC detection, PORTPMSC
register-target fix, bogus HCCPARAMS1-HLC accessor removed).
Mark P2-B COMPLETE in USB-IMPLEMENTATION-PLAN.md with the full gating
inventory and Linux 7.1 cross-references. Per-device L1 enablement
(BESL, MEL Evaluate Context) explicitly deferred to P3 hub work.
Tier 1 message fixes (Part 5.3):
- M18/M19 (build-redbear.sh:523-524): reworded patch-application messages
to reflect local fork model (forks have patches committed; recipe patches
for non-fork recipes applied atomically by repo fetch)
- M46 (build-redbear.sh:923): 'immutable archives' → 'local forks'
Tier 2 doc consolidation (Part 7):
- GRUB-INTEGRATION-PLAN.md: updated all 'make all CONFIG_NAME=' commands
to canonical './local/scripts/build-redbear.sh' equivalents
- SLEEP-IMPLEMENTATION-PLAN.md: archived (referenced 0.2.4 branch, pre-0.3.1)
Assessment doc Part 7 updated: all Tier 1 (items 1-6) and Tier 2 (items 7-13)
marked as verified complete with per-item status.
All Q1-Q10 quality improvement opportunities from Part 6.2 and all Tier 1-3
items from Part 7 are now resolved.
Q1 from assessment Part 6.2 — closes the largest robustness gap (Mechanism #2):
corrupt cached pkgar that passes mtime check was previously not detected
until runtime.
Publish side (repo_builder.rs):
- Accumulates BLAKE3 hash of each published file (pkgar, toml, dep_hashes,
auto_deps) into a BinaryStoreManifest
- Writes <recipe>.manifest.toml alongside published artifacts in repo/
Restore side (cook_build.rs):
- BinaryStoreManifest struct with read() returning Result<Option<Self>, String>
(same pattern as DepHashes: Ok(None) for missing = backward compat,
Err for corrupt TOML = loud WARN + skip)
- After restoring from binary store, verifies each file's BLAKE3 against
the manifest. On mismatch or missing file: WARN + all_restored=false
(forces rebuild). Missing manifest = backward compatible (older cookbook
published without one).
Helper (fs.rs):
- compute_file_blake3_hex(): 64KB chunked BLAKE3 hash, avoids loading
entire pkgar into memory
Tests: 3 new (roundtrip, missing-file Ok(None), corrupt-TOML Err).
Total: 38/38 pass. cargo check clean. No new clippy warnings.
Assessment doc Part 6.2/6.3/7 updated: Q1-Q6 all marked resolved.
Auto-correction table updated: transient network failure (Q2 retry) and
corrupt cached pkgar (Q1 BLAKE3 manifest) moved from 'does NOT auto-correct'
to 'auto-corrects'.
Phase 1 remediation of the build-system assessment:
- Makefile: wire 'validate' target into build/live/reimage flows; surface
lint-config and init-service validators as a first-class gate.
- mk/disk.mk: add 'validate' target running lint-config, init-service
validator, and file-ownership validator; suppress noisy unmount warnings
that masked real failures.
- mk/redbear.mk: add source-fingerprint tracking so integrate-redbear.sh
re-runs when local/recipes, local/Assets, or local/firmware change.
- src/cook/cook_build.rs: atomic dep_hashes.toml write (tmp + rename) to
prevent torn-write cache corruption; binary-store restore now checks
dep_hashes before silent restore; fix production bug in
collect_files_recursive that silently dropped subdirectories whose
name matched an exclude pattern.
- src/cook/fetch.rs, src/cook/fetch_repo.rs: harden atomic patch
application and protected-recipe gating.
- AGENTS.md, local/AGENTS.md, local/docs/COLLISION-DETECTION-STATUS.md:
sync collision-detection status to 'implemented (Phase 15.0)' now that
CollisionTracker is wired across all four installer layers
(installer submodule pointer tracked separately in 13cc6fb0c3).
Verified: cargo check (0 errors), cargo test --lib (35/35 passed),
cargo clippy (0 new warnings vs baseline), make -n validate, make -n live.
The fork branch normalization it described is done — all local/sources forks are
on submodule/* branches (submodule/relibc, submodule/base, ... in active use).
Unreferenced one-time handoff; recoverable from git history if needed.
SESSION-2026-07-13-DOC-CLEANUP.md was an explicitly-transient session handoff
log (marked not-edit-me) recording a past cleanup; its content is fully
historical. Durable records (post-mortems, policy, resolved-plan implementation
notes) are intentionally kept.
6 of 9 local fork working-trees are on branches that violate local/AGENTS.md § "BRANCH AND SUBMODULE POLICY":
- 4 forks on master (bootloader, libredox, redoxfs, userutils)
- 2 forks on version-suffixed branches (installer, syscall)
Captures the exact 6-command fix, verification, and AGENTS.md policy citations. NO fallbacks, NO code changes — operator-only per "agents MUST NOT create new git branches" rule.
(NO AI attribution)
D7 validation: INPUT-SCHEME-ENHANCEMENT.md + PROFILE-MATRIX.md deleted
during cleanup but still referenced. Replaced with local/docs/CONSOLE-TO-KDE-DESKTOP-PLAN.md (consolidation target).
(NO AI attribution)
D7 validation: 3 stale refs remained after cleanup.
- Removed DESKTOP-STACK-CURRENT-STATUS.md ref (file deleted)
- Removed docs/QUIRKS-IMPROVEMENT-PLAN.md ref (correct path is local/docs/)
- Verified all remaining refs resolve.
(NO AI attribution)
D7 validation found fork SHAs in this doc were stale vs the actual
local fork HEADs. Refreshed kernel/relibc rows to current; added
missing base row.
(NO AI attribution)
Captures what was done this session (doc cleanup) and what carry-over issues remain (kernel fork at detached HEAD 2086faec with fix 22f5f622 in master; boot still fails at unit loading).
For handoff to next agent or operator.
D6 verification flagged 3 stale remnants missed by the Round-12 cleanup pass. Per ground-truth:
- Line 155: relibc "active patches" is stale. Core recipes use PATCHED-VIA-PATH-FORK; 26 patch files in local/patches/relibc/ are reference/archived only.
- Lines 1832, 1902: qtbase 6.11.0 bumped to 6.11.1 to match README and actual fork state.
(NO AI attribution)
Round-7 audit found stale entries for files deleted by c04da4f031 and ecf1f19d55, plus missing entries for files still present in the archive. Rewrote the inventory to match the filesystem and added the 2026-07-13 sync note.
Per ground-truth: BOOT-PROCESS-ASSESSMENT.md, IOMMU-SPEC-REFERENCE.md, and LINUX-BORROWING-RUST-IMPLEMENTATION-PLAN.md are gone. Replaced with "(deleted)" markers. Lines 73-74 (duplicate BOOT-PROCESS-ASSESSMENT.md refs) collapsed to a single marker.
Per ground-truth: AMD-FIRST-INTEGRATION.md, HARDWARE-3D-ASSESSMENT.md, DMA-BUF-IMPROVEMENT-PLAN.md were deleted during the P0 archive cleanup. Replaced each occurrence with "(deleted)" markers.
Lines 298-311 had 8 fork HEAD SHAs from 2026-07-07 (+rb0.3.0 era) that have since advanced. Per ground-truth section A:\n base 4d09ab7f\n bootloader c78c3a6\n installer 1e9dcde\n kernel 22f5f622\n libredox b99b204\n redoxfs b78a791\n relibc 11a1f8bc\n syscall 6e4e5bd (+rb0.3.1)\n userutils 0dc0cb7\n\nAll forks now use +rb0.3.1 suffix. Line 311 "intentionally kept at +rb0.3.0" updated to "kept at +rb0.3.1".
- PATCH-PRESERVATION-AUDIT: add Phase 16.1 to cumulative reduction table
(122→0 orphans, Round 17); update operator test section with all 6 modes;
replace stale 'Round 3 final' re-run with current Round 17 verification
- TOOLS.md: add --regen and --dry-run flags; clarify default is opt-in
- HOOKS.md: add --regen and --dry-run to sync-versions.sh option list
Round 10 (Phase 9.x) outcomes:
- Phase 9.0: Full state audit — 0 orphans, 0 collisions,
all forks pass. Base fork had 1 small diagnostic commit
(no patch impact).
- Phase 9.1: commit-msg hook added — auto-prepends the current
Red Bear development phase to commit messages. Opt-in
(copy to .git/hooks/commit-msg).
- Phase 9.2: HOOKS.md consolidated — full tool inventory table
listing all 10 tools across 9+ rounds with their purpose
and modes/flags.
Cumulative: 122 patches, 0 orphans (0%) — Round 10.
Adds the commit-msg hook promised in HOOKS.md since Round 5.
The hook auto-prepends the current Red Bear development phase
(e.g. 'phase 8.4:') to commit messages. The phase is detected
from the most recent 'phase X.Y:' commit in the git log.
Hook behavior:
- Normal commit → prepended: 'phase 8.4: my message'
- Already has prefix → skipped
- Revert message → skipped
- Empty/comment → skipped
Install: cp local/scripts/commit-msg .git/hooks/commit-msg && chmod +x
Updates HOOKS.md with:
- commit-msg hook documentation (install, behavior)
- Full tool inventory table (10 tools across 9+ rounds)
listing each tool's type, purpose, and modes/flags
vasilito