StarOS M3C, after the console gate H1's STOP (2026-10-16). For review; do not merge without the maintainer's word.
Console observation. H1 acknowledged the timer through HW_ARMIRQFLAG before rewriting HW_ALARM, tens of microseconds after the match. It then read HW_ARMIRQFLAG & HW_ARMIRQMASK still 1, and the run logged STAROS:MMU ERROR 0x00000010 0x00000001. MINI's irq.c does the opposite: it rewrites HW_ALARM first, then acknowledges. The model fired the cause once, on the crossing, and a write-one-to-clear ended it for good, so the probe passed.
Change. Once the counter reaches HW_ALARM, the timer's cause stays asserted until HW_ALARM is written:
An acknowledgement sets the cause again. This covers both the wide and the byte-assembled write paths.
Writing the comparator re-arms it. Writing the current counter value still matches at once, as before.
A counter write does not end the match.
The state is saved, with STATE_VERSION 197.
One run cannot tell a latch from a "counter >= alarm" comparison; the latch is the smaller model that explains the observation.
Tests.
New: StarletTimer.MatchedAlarmStaysAssertedUntilRewritten and StarletTimer.MatchedAlarmSurvivesStateRoundTrip.
The StarOS images of commit 7f90c7d now fail as the console did. The probe's ring of the console image equals H1's ring line for line, except the stack peak (228 against 240), with summary state 4, reason 12.
With the kernel's order fixed (HW_ALARM first, then the acknowledgement), every StarOS scenario passes: 40/40, interpreter and JIT identical.
StarOS M3C, after the console gate H1's STOP (2026-10-16). For review; do not merge without the maintainer's word.
**Console observation.** H1 acknowledged the timer through HW_ARMIRQFLAG before rewriting HW_ALARM, tens of microseconds after the match. It then read `HW_ARMIRQFLAG & HW_ARMIRQMASK` still 1, and the run logged `STAROS:MMU ERROR 0x00000010 0x00000001`. MINI's `irq.c` does the opposite: it rewrites HW_ALARM first, then acknowledges. The model fired the cause once, on the crossing, and a write-one-to-clear ended it for good, so the probe passed.
**Change.** Once the counter reaches HW_ALARM, the timer's cause stays asserted until HW_ALARM is written:
- An acknowledgement sets the cause again. This covers both the wide and the byte-assembled write paths.
- Writing the comparator re-arms it. Writing the current counter value still matches at once, as before.
- A counter write does not end the match.
- The state is saved, with `STATE_VERSION` 197.
One run cannot tell a latch from a "counter >= alarm" comparison; the latch is the smaller model that explains the observation.
**Tests.**
- New: `StarletTimer.MatchedAlarmStaysAssertedUntilRewritten` and `StarletTimer.MatchedAlarmSurvivesStateRoundTrip`.
- `tests.exe --gtest_filter=Starlet*`: 188 run, 183 passed, 5 skipped (Ethernet NAT, environment), 0 failed.
**Probe `dd2336f278ac`** (exe `acb01278…`):
- The StarOS images of commit 7f90c7d now fail as the console did. The probe's ring of the console image equals H1's ring line for line, except the stack peak (228 against 240), with summary state 4, reason 12.
- With the kernel's order fixed (HW_ALARM first, then the acknowledgement), every StarOS scenario passes: 40/40, interpreter and JIT identical.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
A console run (StarOS M3C gate H1, 2026-10-16) acknowledged the timer
through HW_ARMIRQFLAG before rewriting HW_ALARM, tens of microseconds after
the match, and read the cause still set. MINI's IRQ handler rewrites
HW_ALARM first, then acknowledges. The model fired the cause once on the
crossing, and a write-one-to-clear ended it for good, so the probe hid the
difference.
Once the counter reaches HW_ALARM, the timer's cause now stays asserted:
an acknowledgement sets it again until HW_ALARM is written. Writing the
comparator re-arms it (an immediate match when equal to the counter, as
before); a counter write does not end the match. One run does not tell a
latch from a "counter >= alarm" comparison: the latch is the smaller model
that explains it. The state is saved (STATE_VERSION 197).
Tests: StarletTimer.MatchedAlarmStaysAssertedUntilRewritten (both write
paths, a counter write, MINI's order, the next match) and
MatchedAlarmSurvivesStateRoundTrip.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
StarOS M3C, after the console gate H1's STOP (2026-10-16). For review; do not merge without the maintainer's word.
Console observation. H1 acknowledged the timer through HW_ARMIRQFLAG before rewriting HW_ALARM, tens of microseconds after the match. It then read
HW_ARMIRQFLAG & HW_ARMIRQMASKstill 1, and the run loggedSTAROS:MMU ERROR 0x00000010 0x00000001. MINI'sirq.cdoes the opposite: it rewrites HW_ALARM first, then acknowledges. The model fired the cause once, on the crossing, and a write-one-to-clear ended it for good, so the probe passed.Change. Once the counter reaches HW_ALARM, the timer's cause stays asserted until HW_ALARM is written:
STATE_VERSION197.One run cannot tell a latch from a "counter >= alarm" comparison; the latch is the smaller model that explains the observation.
Tests.
StarletTimer.MatchedAlarmStaysAssertedUntilRewrittenandStarletTimer.MatchedAlarmSurvivesStateRoundTrip.tests.exe --gtest_filter=Starlet*: 188 run, 183 passed, 5 skipped (Ethernet NAT, environment), 0 failed.Probe
dd2336f278ac(exeacb01278…):🤖 Generated with Claude Code
Pull request closed