MERGED into master by fast-forward: master = 9ad22f00bd (maintainer's conditional GO MERGE on 9ad22f00bd, 2026-11-04). From master a709fddfa8.
What
StarletBootstrapProbe --broadway-h1a: the probe stands in for Broadway with StarOS's own bench loader code, so that StarOS's H-1A bench (docs/architecture/h-1a.md, D-H1A-7) runs whole under the Starlet LLE.
Commit
What
f391ae6c85
The client: StarOS boot/wii/loaderhw0c.c, hw0d.c, h1a.c and the three contract headers vendored unchanged in Tools/StarletBootstrapProbe/StarOSLoader/ (StarOS 480119d, stored -text), built over a host HAL (BroadwayHAL/); ProbeBroadway.h/.cpp; CMake computes the nine files' SHA-256 at configure and the probe prints them; hw0c_setup() before the first instruction, one hw0c_step() a slice (timebase = cycles / 4); bench-window bounds (0x13500000..0x13510000, whole words, the first access outside fails the run); --cycles up to 2^34 in this mode only; refused with --ipc-script/--stage-spk; gtests
9cce9b35ef
The end of a run as StarOS's main.c monitor decides it: SBR1 state ≥ IDLE with EXI back to Broadway (StarletDone), and the bench done. The image's 1 KiB trace is full before its IDLE line: the first version ran every round, then ran out of budget. --broadway-h1a requires --sbr1-record
2df9dfc909
--cycles read in place again, so that without --broadway-h1a every message is master's
9ad22f00bd
Final review (StarOS D2), two findings fixed: (F1) a refused access during the report (hw0c_report() reads the window too) now fails the run, as one during the run does; (F2) --cycles' 2^34 bound was raised whenever --broadway-h1a appeared among the arguments, even as another option's value (a file of that name): ClientRequested reads the options with their grammar. Test OnlyTheOptionItselfRaisesTheBudget
The four patches rebuild the branch's tree (0a0571d4) from master.
Evidence
Head 9ad22f00bd: probe sha256 aa6118810c9b…, tests 38/38, A/B 20/20 identical to master (incl. the F2 cases), 6/6 option checks, H-1A interpreter 236 s / JIT 116 s INCONCLUSIVE (I-N), the same capture 9bdd880b, negative run STOP as expected. Earlier, probe 2df9dfc909: sha256 d24098698e10…, built by StarOS tools/dolphin/build_probe.py (clean checkout, provenance JSON); gtest binary after the gtest step tests.exe (probe unchanged).
Tests: 37/37 (StarletProbe*, StarletBootstrapELF*), among them the client's: the window's bounds, the clock, Gecko's formats, the budgets, the built-in sources, StarletDone, and four death tests running the real loader code against a scripted Starlet (3000 rounds COHERENT; no READY; no Starlet END; budget too short), each in its own process (the loader's state is global).
Unchanged behaviour (A/B against master a709fddfa8, probe 15fda547): 18 runs without --broadway-h1a — default, JIT, --sbr1-record, --sbr1-absent --mmu-faults, --cycles, --expect-fatal-data, --expect-undefined-fault, --ipc-script (interp, JIT), --stage-spk, both, a refused package, five usage errors — same exit status, stdout and stderr, byte for byte. 6 checks of the new option's refusals and bounds: OK.
StarOS H-1A under the probe (StarOS tools/dolphin/run_h1a.py): interpreter 228 s, JIT 117 s; 3000 posted / 3000 answered, record COHERENT, every area word exact (F 627, W 627, N 632, P 74 counted rounds), INCONCLUSIVE (I-N) as predicted (coherent memory: the retention is not reproduced); interpreter and JIT captures identical byte for byte. Negative: the client on an image without the bench → no READY → S0 INCONCLUSIVE, the judge STOP.
Not a hardware result: Dolphin's memory is coherent; this rehearses the protocol, the capture and the judge.
Merged (2026-11-04)
Checked before: remote master a709fddfa8, branch 9ad22f00bd, tree 0a0571d4 = the four patches applied to master, no other change.
Post-merge: probe rebuilt from master (build_probe.py, clean checkout): sha256 5a72fa29bb4f… (the branch build was aa6118810c9b…: the probe embeds the branch name); tests 38/38; StarOS H-1A (run_h1a.py, StarOS aef86b8): interpreter 237 s, JIT 119 s, INCONCLUSIVE (I-N), 3000/3000, every word exact, the same capture 9bdd880b…; negative run (no READY) STOP as expected.
**MERGED into master by fast-forward: master = `9ad22f00bd` (maintainer's conditional GO MERGE on 9ad22f00bd, 2026-11-04).** From master `a709fddfa8`.
## What
`StarletBootstrapProbe --broadway-h1a`: the probe stands in for Broadway with StarOS's own bench loader code, so that StarOS's H-1A bench (docs/architecture/h-1a.md, D-H1A-7) runs whole under the Starlet LLE.
| Commit | What |
|---|---|
| `f391ae6c85` | The client: StarOS `boot/wii/loader` `hw0c.c`, `hw0d.c`, `h1a.c` and the three contract headers vendored **unchanged** in `Tools/StarletBootstrapProbe/StarOSLoader/` (StarOS `480119d`, stored `-text`), built over a host HAL (`BroadwayHAL/`); `ProbeBroadway.h/.cpp`; CMake computes the nine files' SHA-256 at configure and the probe prints them; `hw0c_setup()` before the first instruction, one `hw0c_step()` a slice (timebase = cycles / 4); bench-window bounds (0x13500000..0x13510000, whole words, the first access outside fails the run); `--cycles` up to 2^34 in this mode only; refused with `--ipc-script`/`--stage-spk`; gtests |
| `9cce9b35ef` | The end of a run as StarOS's `main.c` monitor decides it: SBR1 state ≥ IDLE with EXI back to Broadway (`StarletDone`), and the bench done. The image's 1 KiB trace is full before its IDLE line: the first version ran every round, then ran out of budget. `--broadway-h1a` requires `--sbr1-record` |
| `2df9dfc909` | `--cycles` read in place again, so that without `--broadway-h1a` every message is master's |
| `9ad22f00bd` | **Final review (StarOS D2), two findings fixed:** (F1) a refused access during the report (`hw0c_report()` reads the window too) now fails the run, as one during the run does; (F2) `--cycles`' 2^34 bound was raised whenever `--broadway-h1a` appeared among the arguments, even as another option's value (a file of that name): `ClientRequested` reads the options with their grammar. Test `OnlyTheOptionItselfRaisesTheBudget` |
The four patches rebuild the branch's tree (0a0571d4) from master.
## Evidence
- **Head `9ad22f00bd`: probe sha256 `aa6118810c9b…`, tests 38/38, A/B 20/20 identical to master (incl. the F2 cases), 6/6 option checks, H-1A interpreter 236 s / JIT 116 s INCONCLUSIVE (I-N), the same capture 9bdd880b, negative run STOP as expected.** Earlier, probe `2df9dfc909`: sha256 `d24098698e10…`, built by StarOS `tools/dolphin/build_probe.py` (clean checkout, provenance JSON); gtest binary after the gtest step `tests.exe` (probe unchanged).
- **Tests: 37/37** (`StarletProbe*`, `StarletBootstrapELF*`), among them the client's: the window's bounds, the clock, Gecko's formats, the budgets, the built-in sources, `StarletDone`, and four death tests running the real loader code against a scripted Starlet (3000 rounds COHERENT; no READY; no Starlet END; budget too short), each in its own process (the loader's state is global).
- **Unchanged behaviour (A/B against master `a709fddfa8`, probe 15fda547):** 18 runs without `--broadway-h1a` — default, JIT, `--sbr1-record`, `--sbr1-absent --mmu-faults`, `--cycles`, `--expect-fatal-data`, `--expect-undefined-fault`, `--ipc-script` (interp, JIT), `--stage-spk`, both, a refused package, five usage errors — **same exit status, stdout and stderr, byte for byte**. 6 checks of the new option's refusals and bounds: OK.
- **StarOS H-1A under the probe** (StarOS `tools/dolphin/run_h1a.py`): interpreter 228 s, JIT 117 s; 3000 posted / 3000 answered, record COHERENT, every area word exact (F 627, W 627, N 632, P 74 counted rounds), **INCONCLUSIVE (I-N)** as predicted (coherent memory: the retention is not reproduced); interpreter and JIT captures identical byte for byte. Negative: the client on an image without the bench → no READY → S0 INCONCLUSIVE, the judge STOP.
Not a hardware result: Dolphin's memory is coherent; this rehearses the protocol, the capture and the judge.
## Merged (2026-11-04)
- Checked before: remote master a709fddfa8, branch 9ad22f00bd, tree 0a0571d4 = the four patches applied to master, no other change.
- `git merge --ff-only` + push without force: master a709fddfa8..9ad22f00bd. Branch kept.
- Post-merge: probe rebuilt from master (`build_probe.py`, clean checkout): sha256 `5a72fa29bb4f…` (the branch build was `aa6118810c9b…`: the probe embeds the branch name); tests 38/38; StarOS H-1A (`run_h1a.py`, StarOS aef86b8): interpreter 237 s, JIT 119 s, **INCONCLUSIVE (I-N)**, 3000/3000, every word exact, the same capture `9bdd880b…`; negative run (no READY) STOP as expected.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
The probe stands in for Broadway with StarOS's own bench loader code, so
that StarOS's H-1A bench (docs/architecture/h-1a.md, D-H1A-7) runs whole:
its Starlet image on the ARM core, its Broadway side from StarOS's
boot/wii/loader hw0c.c, hw0d.c and h1a.c, vendored unchanged in
Tools/StarletBootstrapProbe/StarOSLoader (StarOS 480119d, stored -text so
their bytes stay StarOS's) with their contract headers, and built over a
host HAL in BroadwayHAL/. CMake computes the nine files' SHA-256s at
configure; the probe prints them when the mode starts.
As StarOS's loader around the jump: hw0c_setup() before the Starlet's
first instruction, one hw0c_step() between each two slices, the timebase
243 MHz / 4 from the Starlet's cycles, until it says 1; once the image's
trace is terminal and the bench is done, the trace, then the report
between main.c's status and END lines on stdout. If the budget runs out,
the report under SBL:TIMEOUT, and the run fails. The client reaches PPC
memory only in the bench window 0x13500000..0x13510000, by whole words:
the first access outside fails the run, and is not made. Dolphin's memory
is coherent: the run rehearses the protocol, the capture and the judge,
not the console's caches.
--cycles may reach 2^34 in this mode only (MAX_CLIENT_CYCLES), 2^30 as
before otherwise. --broadway-h1a takes neither --ipc-script nor
--stage-spk, whose behaviour is unchanged.
StarletProbeBroadwayTest: the window's bounds, the clock, Gecko's number
formats, the budgets, the built-in sources; and, each in a death test's
own process (the loader's state is global), the real loader code against
a scripted Starlet: 3000 rounds and a COHERENT record, no READY, no
Starlet END, a budget too short; a second client refused.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The first whole run of StarOS's H-1A image (interpreter, 2^34 cycles)
ran every round: Broadway posted 3000, the Starlet answered 3000, its
record COHERENT, END NONE, S0 PASS. But the probe never ended it: the
image's trace, 1 KiB, is full before its REV:BOOT:IDLE line, and the
probe looked for that line only. StarOS's main.c does not: its monitor
takes the Starlet for done once the SBR1 record's state is IDLE or after,
with EXI given back to Broadway (StarletDone), and its bench ended.
In this mode the probe now does the same: it reads the record, which
--broadway-h1a therefore requires (--sbr1-record), prints the trace as it
stands (and says on stderr when it is full: its last lines are in the
SBR1 ring the probe prints), then the client's report under SBL:STARLET
DONE. The run passes when the trace shows the boot's start, no panic or
fatal line, and the record's state is IDLE (or the trace's IDLE line).
Without --broadway-h1a nothing changes.
StarletProbeBroadwayTest: StarletDone against StarOS's states.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
--broadway-h1a had moved --cycles' reading after the options, which
changed the usage errors' text for a missing value or a second --cycles.
The bound is now known before the options are read (whether
--broadway-h1a is among them), and --cycles is read in place, with
master's messages: without --broadway-h1a, every run and every refusal
is master's, byte for byte.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Two findings of the review of 2df9dfc909 (StarOS H-1A, D2):
- The report reads the bench window too (hw0c_report(): HW-M4-0D's
area, and H-1A's record if it was never read), but a refused access
there did not fail the run, as one during the run does. It does now:
the failure on stderr, and the run fails.
- --cycles' bound of 2^34 was raised whenever "--broadway-h1a" appeared
among the arguments, even as the value of --ipc-script or --stage-spk
(a file of that name), the run then not in the client's mode.
ClientRequested reads the options with their grammar: the word after
--ipc-script, --stage-spk or --cycles is a value, never an option.
StarletProbeBroadwayTest: ClientRequested.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
MERGED into master by fast-forward: master =
9ad22f00bd(maintainer's conditional GO MERGE on9ad22f00bd, 2026-11-04). From mastera709fddfa8.What
StarletBootstrapProbe --broadway-h1a: the probe stands in for Broadway with StarOS's own bench loader code, so that StarOS's H-1A bench (docs/architecture/h-1a.md, D-H1A-7) runs whole under the Starlet LLE.f391ae6c85boot/wii/loaderhw0c.c,hw0d.c,h1a.cand the three contract headers vendored unchanged inTools/StarletBootstrapProbe/StarOSLoader/(StarOS480119d, stored-text), built over a host HAL (BroadwayHAL/);ProbeBroadway.h/.cpp; CMake computes the nine files' SHA-256 at configure and the probe prints them;hw0c_setup()before the first instruction, onehw0c_step()a slice (timebase = cycles / 4); bench-window bounds (0x13500000..0x13510000, whole words, the first access outside fails the run);--cyclesup to 2^34 in this mode only; refused with--ipc-script/--stage-spk; gtests9cce9b35efmain.cmonitor decides it: SBR1 state ≥ IDLE with EXI back to Broadway (StarletDone), and the bench done. The image's 1 KiB trace is full before its IDLE line: the first version ran every round, then ran out of budget.--broadway-h1arequires--sbr1-record2df9dfc909--cyclesread in place again, so that without--broadway-h1aevery message is master's9ad22f00bdhw0c_report()reads the window too) now fails the run, as one during the run does; (F2)--cycles' 2^34 bound was raised whenever--broadway-h1aappeared among the arguments, even as another option's value (a file of that name):ClientRequestedreads the options with their grammar. TestOnlyTheOptionItselfRaisesTheBudgetThe four patches rebuild the branch's tree (
0a0571d4) from master.Evidence
9ad22f00bd: probe sha256aa6118810c9b…, tests 38/38, A/B 20/20 identical to master (incl. the F2 cases), 6/6 option checks, H-1A interpreter 236 s / JIT 116 s INCONCLUSIVE (I-N), the same capture 9bdd880b, negative run STOP as expected. Earlier, probe2df9dfc909: sha256d24098698e10…, built by StarOStools/dolphin/build_probe.py(clean checkout, provenance JSON); gtest binary after the gtest steptests.exe(probe unchanged).StarletProbe*,StarletBootstrapELF*), among them the client's: the window's bounds, the clock, Gecko's formats, the budgets, the built-in sources,StarletDone, and four death tests running the real loader code against a scripted Starlet (3000 rounds COHERENT; no READY; no Starlet END; budget too short), each in its own process (the loader's state is global).a709fddfa8, probe 15fda547): 18 runs without--broadway-h1a— default, JIT,--sbr1-record,--sbr1-absent --mmu-faults,--cycles,--expect-fatal-data,--expect-undefined-fault,--ipc-script(interp, JIT),--stage-spk, both, a refused package, five usage errors — same exit status, stdout and stderr, byte for byte. 6 checks of the new option's refusals and bounds: OK.tools/dolphin/run_h1a.py): interpreter 228 s, JIT 117 s; 3000 posted / 3000 answered, record COHERENT, every area word exact (F 627, W 627, N 632, P 74 counted rounds), INCONCLUSIVE (I-N) as predicted (coherent memory: the retention is not reproduced); interpreter and JIT captures identical byte for byte. Negative: the client on an image without the bench → no READY → S0 INCONCLUSIVE, the judge STOP.Not a hardware result: Dolphin's memory is coherent; this rehearses the protocol, the capture and the judge.
Merged (2026-11-04)
a709fddfa8, branch9ad22f00bd, tree0a0571d4= the four patches applied to master, no other change.git merge --ff-only+ push without force: master a709fddfa8..9ad22f00bd. Branch kept.build_probe.py, clean checkout): sha2565a72fa29bb4f…(the branch build wasaa6118810c9b…: the probe embeds the branch name); tests 38/38; StarOS H-1A (run_h1a.py, StarOS aef86b8): interpreter 237 s, JIT 119 s, INCONCLUSIVE (I-N), 3000/3000, every word exact, the same capture9bdd880b…; negative run (no READY) STOP as expected.🤖 Generated with Claude Code
Pull request closed