c0ed23cc56
The failure this is against is not scope creep. It is abandonment by promotion:
a thing gets built to the point where it works, the next thing becomes more
interesting, and the first is left in a corner -- in the tree, not finished, not
deleted, and not in any list. Enough of those and the tree stops matching its
own documentation.
docs/plan/1.0.md now holds the register, and it is the only place anything
half-built is listed. Four sections, because the kinds are genuinely different:
built and connected to nothing (the text layer, a font from disk, socket
activation, wait_vblank); started and stopped part-way (foundations 2-5, hybrid
H2, Schcom v0, a released PCI device that nothing brings back); named in a "what
it does not do" and still true; and frozen -- scoped, unstarted, not to be
started. The rule is that nothing enters except by being finished or deleted,
and that adding a row requires closing one.
1.0.md already said "two things in flight, never three". It was right and it was
not being followed.
Then the corners themselves, because a register written over a tree full of them
is just a longer list:
- cmd/init is deleted. Nothing had execed /bin/init since initcode.S changed
to /bin/schinit; it was built and installed on every image as an unreachable
fallback, and an unreachable fallback rots rather than saves.
- projects/schwm/ and projects/schde/ are deleted. Both said "to be deleted"
in their own first paragraph, which proves only that a directory marked for
deletion is not deleted by being marked. README-only, no code lost, and the
arguments each made are moved into wayland.md where they are still true.
- projects/schcom/schcom and schcom-demo were tracked binaries. Untracked, and
.gitignore'd.
Three code comments and one document described a boot that has not happened
since 7d44eb7. cons_serial_only starts set, but kmain clears it on its first
lines now, so the splash does not survive the boot and the kernel log is on
screen from the start. That reversal was earned by a Chromebox with no serial
port freezing at boot showing nothing at all, and the comments still argued the
losing side of it.
The site:
- a download page. One ISO, what it has actually been run on -- one machine,
under test -- Ventoy and dd, what the first boot looks like step by step,
and the build if you would rather. The support table names one Chromebox
rather than listing hardware, because one Chromebox is the entire bare-metal
record and a list would be fiction.
- Assets/usb.svg, drawn to the same rule as the other marks: two tones,
geometry only, the accent spent in one place, and that place is the activity
light because it is the part that tells you something is happening.
- Download is in both navs and is the hero's primary action; a closing band
ends the front page on it.
- the uberblock-slots and drivers-outside-the-kernel figures are gone. Three
numbers left, including the fastfetch one, which stays because it is funny.
Two things caught by rendering the pages instead of assuming: .hero p was
beating .filemeta on specificity and the file line was coming out at body size,
and the dd command was one line long enough that the card clipped it at `conv=`
-- a destructive command that can scroll half of itself out of view is a good
way to take somebody's disk. It is two lines now.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
132 lines
5.8 KiB
Markdown
132 lines
5.8 KiB
Markdown
# What happens next
|
||
|
||
Everything in this directory is **unbuilt**. When a piece of it is finished it
|
||
leaves — deleted from here, rewritten as a description in
|
||
[../architecture/](../architecture/). See [the rule](../README.md#the-rule-that-keeps-this-from-rotting).
|
||
|
||
> ## Read [1.0.md](1.0.md) first.
|
||
>
|
||
> It draws a finish line and puts most of the work below on the far side of it.
|
||
> **Anything not named there is not being worked on**, and the documents in this
|
||
> directory describe more than 1.0 contains.
|
||
>
|
||
> It also holds **[the register of unfinished work](1.0.md#the-freeze-and-the-register-of-unfinished-work)**,
|
||
> which is the one place anything half-built is listed. No new capability starts
|
||
> until that register is empty, and a row leaves it only by being finished or by
|
||
> being deleted from the tree.
|
||
|
||
---
|
||
|
||
## The three current decisions
|
||
|
||
Taken together, because they turn out to need the same foundation.
|
||
|
||
| | |
|
||
|---|---|
|
||
| **[wayland.md](wayland.md)** | The GUI stack becomes Wayland. SchWM and SchDE are **deleted** — actually gone from the tree, not marked; Schcom survives and changes its wire format. |
|
||
| **[hybrid.md](hybrid.md)** | The kernel becomes hybrid — drivers move out into userspace processes, starting with the GPU. **Partly built**: all four mechanisms exist and the GPU driver already runs outside the kernel. |
|
||
| ~~init.md~~ | **Built.** PID 1 is now a role the kernel refills; the description moved to [../architecture/init.md](../architecture/init.md). |
|
||
|
||
And the one they all wait on:
|
||
|
||
| | |
|
||
|---|---|
|
||
| **[foundations.md](foundations.md)** | Descriptor passing, shared memory, sockets in the filesystem. The critical path. **Item 1 is built** — `sendmsg`/`recvmsg` with `SCM_RIGHTS`. |
|
||
|
||
And the one that says which parts of the above are actually being worked on:
|
||
|
||
| | |
|
||
|---|---|
|
||
| **[1.0.md](1.0.md)** | The finish line. Four gates, and everything else explicitly deferred. |
|
||
|
||
Two longer-horizon documents sit behind these: [schapi.md](schapi.md), the API
|
||
layering and the compatibility promise, and [roadmap.md](roadmap.md), which holds
|
||
everything still open that is not one of the three above.
|
||
|
||
---
|
||
|
||
## The order
|
||
|
||
Set by [1.0.md](1.0.md), which is the authority. In short:
|
||
|
||
### 0. Fix what is already wrong — **first**
|
||
|
||
Not a document of its own; it is Gate 0 of [1.0.md](1.0.md), assembled from the
|
||
*What it does not do* sections in [../architecture/](../architecture/).
|
||
|
||
**Before any new capability**, and the reason is the one that put
|
||
`netdev_selftest()` before the TCP/IP stack: a compositor built on a kernel with
|
||
an unexplained hang and a socket layer that reports success for things it did not
|
||
do will fail in ways indistinguishable from its own bugs.
|
||
|
||
### 1. `foundations.md` — the critical path
|
||
|
||
Both the Wayland work and the hybrid work stop here. Descriptor passing and
|
||
shared memory are the substrate for handing a buffer to a compositor *and* for
|
||
handing a device to a driver process. **Doing it once for both is the entire
|
||
reason these are one plan rather than three.**
|
||
|
||
### 2. `init.md` — before the desktop, not after — **done**
|
||
|
||
A compositor being brought up for the first time crashes constantly, and
|
||
something that restarts it and says why is worth far more during that work than
|
||
at the end of it. Built; see [../architecture/init.md](../architecture/init.md).
|
||
|
||
### 3. `hybrid.md` — **moved up, and the reason is worth recording**
|
||
|
||
This document used to put the hybrid work *after 1.0*, deliberately last, on this
|
||
argument:
|
||
|
||
> designing a userspace driver interface with no driver consuming it produces an
|
||
> interface that is wrong in ways nobody can see
|
||
|
||
The argument was sound and the conclusion drawn from it was wrong. What forced
|
||
the change was the driver situation: SchOS cannot write a driver for every device
|
||
that exists, no project can, and the only route to the hardware support an
|
||
established OS has is a compatibility layer with the foreign drivers kept
|
||
*outside* the kernel. That layer is this plan's mechanisms. It is not optional and
|
||
it is not late work.
|
||
|
||
The original argument still holds, and it is answered rather than ignored:
|
||
**SchOS's own drivers are the consumers.** `vgpud` is a real driver, with real
|
||
requirements, and building the interface against it is what keeps it a general
|
||
mechanism rather than a hole shaped like something foreign. The compositor is
|
||
still a demanding consumer — it is no longer the *only* one available.
|
||
|
||
Four mechanisms, all built. One eviction done, one to go, then the foreign
|
||
driver host.
|
||
|
||
### 4. `wayland.md` — with the GPU driver either side of the seam
|
||
|
||
W1–W3 and a terminal. W4 and W5 are post-1.0. Item 1 of `foundations.md` —
|
||
descriptor passing — was the thing it could not start without, and it now
|
||
exists.
|
||
|
||
---
|
||
|
||
## In one sentence
|
||
|
||
> Fix what is broken, build the descriptor-passing and shared-memory substrate,
|
||
> make init survivable, move the drivers out through an interface SchOS's own
|
||
> drivers have to live with first — and put a terminal on the screen.
|
||
|
||
---
|
||
|
||
## What this plan does not address
|
||
|
||
Stated here so it is not mistaken for covered:
|
||
|
||
- **No IOMMU**, so the hybrid work isolates against bugs and not against a
|
||
hostile driver.
|
||
- **No page cache**, so `foundations.md` delivers a `memfd` and not a general
|
||
answer to shared file mappings. The general answer is still owed.
|
||
- **No garbage collector for descriptors in flight**, so an `AF_UNIX` socket
|
||
passed over itself and never received leaks. Bounded at thirty-two sockets, and
|
||
nothing on this plan does it.
|
||
- **No dynamic linking**, so no Mesa, no accelerated clients, and no third party
|
||
shipping a `.so` for anything.
|
||
- **A new compatibility surface** between PID 1 and PID 2, created by a plan
|
||
whose own [schapi.md](schapi.md) §3 spends a section warning about those.
|
||
- **The three open networking items** — `getsockname`, routing, and
|
||
interrupt-driven receive — are untouched by any of this and still open. They
|
||
are in [roadmap.md](roadmap.md).
|