Robert Allan JamesandClaude Sonnet 5
e2abc56306
Formal successor to §XII's ad hoc exerciser campaign, requested as a genuine randomized full-factorial design matching this project's own DoE methodology (capsules/doe.4th's Fisher-Yates shuffle), and written entirely in FORTH per explicit request -- not host-orchestrated shell scripting. experiments/std79-doe/std79-doe.fth: builds a 27-cell (9 identity x 3 replicate) run matrix, Fisher-Yates shuffles it with a fixed seed (matching doe.4th's own default), then dispatches each of the 24 exerciser test cases directly into the target identity's own live VM via VM-EXEC -- no console USE redirection, no per-trial host interaction. The zuse case runs as directly-compiled native code (RUN-TEST-NATIVE) rather than VM-EXEC targeting "Hera" herself: VM-EXEC's own vm_state_push/pop only saves rsp/exit_colon/ecw_nesting, not input_buffer/input_pos, so a self-targeting call while this capsule's own vm_interpret call is still mid-line would risk exactly the class of bug the idle-tick reentrancy guards exist for. amd64: all 27 trials ran with all 9 identities simultaneously live in one boot -- clean, zero mismatches. aarch64: hit a real, uninvestigated bug attaching all 9 simultaneously -- the 6th live VM's birth stalled for 90+ minutes at 100%+ CPU with a Stadium COOL-dispatch counter already at 335,000+ cycles, versus tens of thousands at the same checkpoint for earlier identities. Not root-caused here (flagged in FABRIC-3.md for later); worked around by splitting into 3 boots of 3 simultaneously-live identities each, every boot sharing the same seed so the master 27-slot shuffle is identical, filtered per boot by a new ACTIVE-LO/ACTIVE-HI range (EXEC-STD79-DOE's signature: seed lo hi -- ). run_id is always the slot's true position in the master shuffle, so trial order stays comparable across boots -- standard DoE blocking. riscv64: same 3-boot pattern, clean. Grand total: 81/81 trials correct, 0 mismatches, across all three architectures, all nine identities, all three replicates. Also flagged (FABRIC-3.md §XIV, not fixed): attaching several WIREBIND identities near-simultaneously (whether via rapid hotplug or all present from boot) causes the kernel to silently detect only some of them -- confirmed at the host/QMP level that every device was genuinely present. Worked around throughout this campaign by attaching one identity at a time with confirmed waits; real hardware hotplug could hit the same gap, so it's a genuine robustness concern, not just a test-harness inconvenience. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EXieurDfDSsDFdnSyusuWo
disk/
QEMU disk images used for Artemis (block-storage VM) persistence testing.
Mounted via Makefile.starkernel's ARTDISK variable (default
disk/artemis.img) as a virtio-blk-pci device on all three
architectures' kernel QEMU boots — not scripts/rundisk.sh, which targets
a separate, currently-unused disks/ (plural) directory for the hosted
VM's --disk-img= flag instead.
artemis.img— standard Artemis persistence test disk. Reformatted 2026-08-02: this image had been stuck in a corrupted state (validLithosAnankemagic header, but data not matching whatART-READ-TESTexpects) since before this repo's own git history begins (git logshows it already broken at the initial commit, carried over from the pre-split monorepo). Chasing down the resulting persistentFAIL: persist-readtraced to the data, not the code — the write→reboot→read round trip works correctly on a fresh image (seeartemis-debug-roundtrip.imgbelow). Reformatted by blanking the file and letting a normal boot format+write-test it; verifiedPASS: persist-readon amd64, aarch64, and riscv64 against the same image afterward (cross-arch resume, matching the arch-neutral on-disk format.claude/ARTEMIS.mdspecifies).artemis-debug-roundtrip.img— round-trip regression fixture created during that investigation. Known-good: format → self-test → write-test → reboot → resume →PASS: persist-read, confirmed 3 times in a row. Keep this in a passing state; if a future change breaks it, that's a real regression, not a stale-fixture artifact likeartemis.imgwas.artemis-persist-test.img— persistence round-trip test image (pre-existing; history/state not re-verified during the above investigation).artemis-poison.img— a separate test image (exact scenario not documented elsewhere in the repo as of this writing; name suggests an adversarial/corruption test, not confirmed).artemis-unrecognized-test.img— exercisesART-HALT-UNRECOG(.claude/ARTEMIS.mdacceptance criterion #6). Regenerated 2026-08-02: the previous copy of this file had itself been silently reformatted by a since-fixed bug in the generic block subsystem (src/block_subsystem.c) — it carried a valid low-level'STFR'/v2 header despite being meant to represent foreign disk content, direct forensic evidence of the bug described in.claude/ARTEMIS.md's Build Status item 6. Regenerated as 30MB of a repeatingPOISON-UNRECOGNIZED-DISK-TEST-FIXTURE--NOT-BLANK-NOT-STFR-NOT-ARTEMIS--ASCII pattern — deliberately neither blank, nor the block subsystem's own'STFR'magic, nor Artemis's"ARTEMIS\0"marker. Verified on amd64 and riscv64 post-fix: boot correctly halts (ARTEMIS HALT: unrecognized disk content) and the file's sha256 is now byte-for-byte identical before and after boot. Keep this fixture in this poisoned state — if a future change makes its sha256 change across a boot, that is exactly the regression this fixture exists to catch.
Note on incidental header churn: artemis.img picks up a few changed
header bytes on every ordinary boot even though no user data changes —
blk_subsys_attach_device() always records a fresh mounted_time on a
successfully recognized disk, which gets flushed at shutdown. This is
expected bookkeeping, not a bug; revert it before committing rather than
carrying timestamp noise in git history.
-
usb-thumbdrive-test.img— 64MB raw image backing a QEMUusb-storagedevice attached to the xHCI controller's bus (xhci0.0) for Milestone 2e/ 2h hotplug testing, added 2026-08-22. Blank (all zero) —blkio_usb.c+blk_subsys_attach_device()wiring (Milestone 2h, done 2026-08-25) attach it asBLK_FMT_PROVISIONALevery time, which is the intended, exercised state; not yetBLK_FMT_FORMATTEDviaBLK-CONFIRM-FORMAT. -
usb-thumbdrive-test2.img— 64MB raw image, added 2026-08-25 for Milestone 2h hot-detach/re-attach verification. Filled with a repeatingHOTDETACH-REATTACH-FIXTURE-2026-08-25--ASCII pattern, deliberately distinguishable fromusb-thumbdrive-test.img's all-zero content — the point is proving a block read after detachingusb-thumbdrive-test.imgand re-attaching this one actually returns this pattern rather than silently replaying the old device's cached (all-zero) content, which is exactly the class of bug a same-LBN-range device swap can cause if the VM block window cache (vm->blk_vm_cbuf[]) isn't re-validated on a hit. -
artemis-reloc-test.img— 64MB raw image, added 2026-08-25 for single-block relocation (RELOCATE-BLOCK) persistence verification. Blank at creation; a genuinely fresh volume was required (notartemis.img) because relocation-table capacity (reloc_start/reloc_devblocksinblk_volume_meta_t) is only reserved byblk_compute_fresh_geometry()on a fresh format —artemis.imgpredates the feature and correctly reads backreloc_devblocks=0from what was previously unused header padding. Attach viamake -f Makefile.starkernel ARTDISK=disk/artemis-reloc-test.img ...(the Makefile'sARTDISKvar is?=-overridable). Not yetBLK-CONFIRM-FORMAT-committed in the repo copy — commit that step live if reusing this fixture for further reloc-table testing. -
artemis-metafence-fresh.img— 30MB raw image, blank at creation, added 2026-08-26 for the top-of-device system-metadata fence (meta_fence_blocksinblk_volume_meta_t, FABRIC-2.md Phase 8 §C). Same reasoning asartemis-reloc-test.imgabove: the fence is only initialized toBLK_META_FENCE_INIT(128) byblk_compute_fresh_geometry()on a fresh format, so a genuinely blank volume was needed to exercise that path. Verified round-trip: fresh format writes 128 (confirmed via direct byte read at header offset 184, independent of kernel self-report), a second boot without reformatting reads it back unchanged. Keep in its formatted (meta_fence_blocks=128) state — a future change that resets or corrupts this on reload is a real regression. -
artemis-metafence-test.img— 30MB raw image, a direct copy of the pre-existing (pre-fence)artemis.img, added 2026-08-26 alongside the fixture above to verify the other direction: an old volume that predatesmeta_fence_blockscorrectly reads it back as 0 (graceful default via zeroed former padding, not corruption) rather than crashing or misreading adjacent fields. -
zuse.img— 64MB raw image simulating the physical Zuse superuser thumbdrive for QEMU testing (FABRIC-2.md, Phase 8:zuse.img"bleach" mechanism, added 2026-08-26). 64MB is only this fixture's size, not a constraint on real home-blocks thumbdrives (Captain Bob, 2026-08-26) — the design is not bound to any particular drive size;homeblocks_sig_t's ownmetadata_devblocksfield records whatever size is actually observed on a real drive, nothing in the format hardcodes one. 64MB here is purely an arbitrary QEMU-test convenience (matchingusb-thumbdrive-test.img's existing precedent for BOT driver testing scale); usescripts/bleach_zuse_img.sh --size-mb Nfor a different test size. Blank (all zero) at creation — reads back asHOMEBLOCKS_SIG_BLANKviahomeblocks_sig_check(), confirmed live (xhci: USB drive not recognized (blank or foreign media)), simulating a genuine first boot for exercising the still-to-be-built one-time mint-Zuse flow. "Bleach" it back to this pristine/unminted state withscripts/bleach_zuse_img.shbefore each first-boot test run, rather than hand-regenerating the file — same all-zero content either way, the script just makes the reset a single documented, repeatable command. Deliberately a flat/raw image, not GPT-partitioned, matchinghomeblocks_sig_check()'s current call site (repl.c,sig_start_fblock=0) — both will move to a real GPT-partition-relative offset together once a GPT parser exists, not attempted ahead of that.
Convention, standing as of 2026-08-22: every virtual disk/thumb-drive image
used for testing — Artemis persistence disks above, and USB Mass Storage
backing images alike — lives in this directory and is a tracked, committed
file, never scratchpad. This was already artemis.img's convention;
usb-thumbdrive-test.img and any future USB test images follow the same
rule. Confirmed no .gitignore in this repo excludes disk/*.img.
These are regenerable QEMU raw disk images, not source — see
.claude/ARTEMIS.md for the storage model they exercise.