d3c37f82b6
The site and several documents still described the system as it was before virtual terminals, the new schinit, the hybrid work and descriptor passing. docs/architecture/init.md described the wrong program. It documented a single schinit that parses manifests and supervises jobs, which has not been true since PID 1 was split: PID 1 forks a supervisor, spawns jobs on its behalf and reaps; the job table lives in /proc/schinit; a heartbeat runs both ways; and proc_reincarnate() re-execs PID 1 in place rather than panicking. Rewritten around what exists, keeping the reasoning that is still load-bearing -- the five failures of the sibling-init scheme, the escalation ladder, and the three bugs in the reincarnation path that each had to happen before they were obvious. docs/plan/init.md is deleted, which is the tree's own rule for finished work and had not been applied. Fourteen source comments referenced it by part number, so they are repointed at the architecture doc by section name rather than left dangling -- a deleted document nobody notices is worse than a stale one. docs/architecture/devices.md gained the section it has been missing since /dev/pci existed: what a driver needs from a kernel, why mmap is checked against the caller's claims, why DMA is a call and not a mapping, and why the write back after an interrupt is not optional. Also that a released device does not come back by itself, which is true and was nowhere. docs/architecture/networking.md gained a descriptor-passing section, and docs/architecture/README.md's stack diagram gained the two layers and the third seam it was missing. "Two seams hold the whole thing together" has not been true since /dev/pci. docs/plan/README.md said the hybrid work was deliberately last, on the argument that an interface with no consumer is wrong in ways nobody can see. The argument was right; the conclusion was not, and the document now says why it changed -- the alternative to a driver compatibility layer is writing a driver for every device that exists, and the original objection is answered rather than ignored because SchOS's own drivers are the consumers. The site: a Hybrid section with the eviction transcript, cards for virtual terminals, schinit and drivers outside the kernel, and the numbers remeasured rather than estimated -- 46,961 lines, 207 syscalls. The boot log in app.js is from a boot taken today, and the lines are trimmed to what the console can show without clipping, each still a verbatim prefix of real output. Two small rendering fixes found by looking at the pages rather than assuming: .console pre's min-height is now scoped to the hero, so a static transcript sizes to its content instead of reserving eight lines it does not have; and the docs reader's contents panel strips inline marks from headings, so a heading written `proc_reincarnate()` no longer carries its backticks into the sidebar. Every intra-doc link checked; none broken. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
5.5 KiB
What happens next
Everything in this directory is unbuilt. When a piece of it is finished it leaves — deleted from here, rewritten as a description in ../architecture/. See the rule.
Read 1.0.md first.
It draws a finish line and puts most of the work below on the far side of it. Anything not named there is not being worked on, and the documents in this directory describe more than 1.0 contains.
The three current decisions
Taken together, because they turn out to need the same foundation.
| wayland.md | The GUI stack becomes Wayland. SchWM and SchDE are deleted; Schcom survives and changes its wire format. |
| hybrid.md | The kernel becomes hybrid — drivers move out into userspace processes, starting with the GPU. Partly built: all four mechanisms exist and the GPU driver already runs outside the kernel. |
| Built. PID 1 is now a role the kernel refills; the description moved to ../architecture/init.md. |
And the one they all wait on:
| foundations.md | Descriptor passing, shared memory, sockets in the filesystem. The critical path. Item 1 is built — sendmsg/recvmsg with SCM_RIGHTS. |
And the one that says which parts of the above are actually being worked on:
| 1.0.md | The finish line. Four gates, and everything else explicitly deferred. |
Two longer-horizon documents sit behind these: schapi.md, the API layering and the compatibility promise, and roadmap.md, which holds everything still open that is not one of the three above.
The order
Set by 1.0.md, which is the authority. In short:
0. Fix what is already wrong — first
Not a document of its own; it is Gate 0 of 1.0.md, assembled from the What it does not do sections in ../architecture/.
Before any new capability, and the reason is the one that put
netdev_selftest() before the TCP/IP stack: a compositor built on a kernel with
an unexplained hang and a socket layer that reports success for things it did not
do will fail in ways indistinguishable from its own bugs.
1. foundations.md — the critical path
Both the Wayland work and the hybrid work stop here. Descriptor passing and shared memory are the substrate for handing a buffer to a compositor and for handing a device to a driver process. Doing it once for both is the entire reason these are one plan rather than three.
2. init.md — before the desktop, not after — done
A compositor being brought up for the first time crashes constantly, and something that restarts it and says why is worth far more during that work than at the end of it. Built; see ../architecture/init.md.
3. hybrid.md — moved up, and the reason is worth recording
This document used to put the hybrid work after 1.0, deliberately last, on this argument:
designing a userspace driver interface with no driver consuming it produces an interface that is wrong in ways nobody can see
The argument was sound and the conclusion drawn from it was wrong. What forced the change was the driver situation: SchOS cannot write a driver for every device that exists, no project can, and the only route to the hardware support an established OS has is a compatibility layer with the foreign drivers kept outside the kernel. That layer is this plan's mechanisms. It is not optional and it is not late work.
The original argument still holds, and it is answered rather than ignored:
SchOS's own drivers are the consumers. vgpud is a real driver, with real
requirements, and building the interface against it is what keeps it a general
mechanism rather than a hole shaped like something foreign. The compositor is
still a demanding consumer — it is no longer the only one available.
Four mechanisms, all built. One eviction done, one to go, then the foreign driver host.
4. wayland.md — with the GPU driver either side of the seam
W1–W3 and a terminal. W4 and W5 are post-1.0. Item 1 of foundations.md —
descriptor passing — was the thing it could not start without, and it now
exists.
In one sentence
Fix what is broken, build the descriptor-passing and shared-memory substrate, make init survivable, move the drivers out through an interface SchOS's own drivers have to live with first — and put a terminal on the screen.
What this plan does not address
Stated here so it is not mistaken for covered:
- No IOMMU, so the hybrid work isolates against bugs and not against a hostile driver.
- No page cache, so
foundations.mddelivers amemfdand not a general answer to shared file mappings. The general answer is still owed. - No garbage collector for descriptors in flight, so an
AF_UNIXsocket passed over itself and never received leaks. Bounded at thirty-two sockets, and nothing on this plan does it. - No dynamic linking, so no Mesa, no accelerated clients, and no third party
shipping a
.sofor anything. - A new compatibility surface between PID 1 and PID 2, created by a plan whose own schapi.md §3 spends a section warning about those.
- The three open networking items —
getsockname, routing, and interrupt-driven receive — are untouched by any of this and still open. They are in roadmap.md.