[Japabu]

Problem

Login sessions were opened by launches:

• A login row's launch from the machine's session opened one. So the compositor opened a session for each program its taskbar started.
• Nothing ended a session.
• A detached app was the supervisor's child, whatever session it was in.
• sshserver killed a connection's programs when the connection dropped.

This is the second part of the process track's stage 5. It is stacked on #1024 (rebased onto main at bfc9b9793) and follows the permission design's revision 8, which the coordinator approved; its amendments A–D are named below.

Resulting behaviour

One owner per login session, /system/bin/session, which the supervisor starts as its child.

• It is the session's launcher (A). The owner accepts each connection on the session's own launcher port and hands it to the supervisor over its link, with the connection's badge. The supervisor serves the launch exactly as it serves its own launcher's, in the session of the owner's link, never the badge's.
• It parents the session's detached apps. The owner's first word on the link is a place, its own handle, and the supervisor spawns the session's detached apps under it. A detached launch in a session whose owner has not given a place is refused. Only in the machine's session is a detached app the supervisor's.
• The supervisor watches every app started in a session on threads of its own, each one poller wide. It tells the owner of each start, with a handle that may quit and kill the app, and of each end. The lifecycle port that would announce these moves to the permission service's stage, with its first consumer (B).

Signing out, in the owner and with no clock:

1. Every app is asked to quit with a hang-up.
2. What stays is reported to the session's controls and to the supervisor.
3. A cancel keeps the session; already-delivered hang-ups stay delivered.
4. A force kills what stays.
5. The owner exits 0 once nothing is left.

Opening sessions:

• The desktop session is endowed (C). The supervisor opens it as it starts the screen's row, and endows that row the session's launcher and a control connection, again on a restart while the session lives.
• Any login row may open one on the supervisor's new login port:
  • the compositor does when its session ends, so a sign-out brings the desktop back empty;
  • sshserver, on sshserver on toyos-ssh with std threads; russh, tokio and rsa are gone (SSH stage 2) #1026's threaded server, opens one per connection with its first program and launches the shell and shell -c there, detached, through CommandExt::launcher (D). The connection's end signs the session out. A channel's end asks its program to quit with a hang-up through a handle of its own (spawn::Ender); on a host build it still kills the program.
• A login row holds no launcher of the machine's session. Its launches are its sessions' alone. The compositor, started without a desktop session, opens one, and opens one again for each launch it is asked for while none is open; when that is refused, it says why and starts nothing. The supervisor refuses every launch into a session that has ended. A login test-runner opens one session for its jobs and hands them that session's launcher.
• At most 16 sessions are open at once, and the last slot is the desktop's.
• An owner's end other than its sign-out is the session's failure. A login authority whose sessions failed more than three times in ten seconds is refused its next open. No open spends anything.
• An owner that breaks its link is killed, and its session ends as a failure.

logout, the one row the build lets receive session-admin, lists the open sessions and signs one out. It is reached as launch logout. The machine has one user, so a login session's logout acts on every session; there is no ownership check.

The compositor signs its session out on Ctrl+Alt+Q and shows what the sign-out waits for above the taskbar. Escape cancels; Enter forces.

Smaller changes:

• may_start is a permission check alone, and login now means "a login authority".
• An image with a login row must declare session, which only the supervisor may start (a build gate).
• sshserver starts only shell.
• SDK: Connection::into_raw, an endowable Connection and a safe Namespace::received.
• std: CommandExt::launcher, which toyos::spawn refuses for a helper.

Decisions worth a look

• A (connection hand-over) instead of re-encoding the launch. It removes a second frame codec, a second validation and the handle relay. The session still comes only from the link.
• The owner gives its place on the link, because the supervisor's handle to its child lacks the WRITE a place needs, and rights only narrow.
• A login row is endowed the port however it was started. Where SSH logins come from is owner item 65. Until it is ruled, a detached sshserver opens its sessions from inside the desktop's, which issues/four-shares-take-a-file-server.md records. Either way it holds no machine launcher.
• A session's launcher port lives in its Login alone. Its end closes the port, so a launch connected to it reads the end. The screen's row is handed its session's launcher and control afresh for each start. The compositor's opens of a session and its launches are its launcher thread's. The loop asks for an open and takes the control connection it makes off a pipe, so no open is a round trip on the loop. The screen's row is answered its open desktop session on login, as desktop_for does.

Checks and evidence

Round 3, at f3f45a814. Evidence p1b/r4/ and p1b/muts3/: https://github.com/ToyOSOrg/evidence/tree/a7168f805fc5086ab10dc6269ceed3ae0b111dea

• A refused open is answered. The launcher thread sends it back over the same channel and pipe a session comes back on, so the loop stops waiting and the next launch asks again (toyos_desktop::Opening, law a_refused_open_is_asked_again).

• A desktop session is handed again only while its owner runs, by desktop_for and by serve_login alike (desktop_session, law a_desktop_whose_owner_ended_is_not_handed_again).

• Mutations, each built, failed by name with exit 101, and restored:

  • a refused open is never asked again;
  • an ended owner's desktop session is handed again.

• --ci host exit 0 and --build-only exit 0.

• session_lifecycle, desktop_without_x2apic, the_compositor_drives_the_virtio_gpu and a_window_is_drawn_at_the_scale_and_relaid_at_the_next: exit 0 each.

• libc_children fails only spawn_children_cap in three runs, each a different form of the guest running out of memory:

  • this head: exit 1, posix_spawn answering ENOMEM;
  • spawn: a plain spawn is a helper, and a launch is asked for #1024's bfc9b9793: abort 134, Poller::new refused ResourceExhausted;
  • main 89f92a4bd: child 240 ended by SIGSEGV.

  The form varies run to run and none is this change's.

• Metal is staged at f3f45a814.

Round 2, at b3b2ad355 (restacked on #1024's bfc9b9793). Evidence p1b/r3/: https://github.com/ToyOSOrg/evidence/tree/9345c76a8eb41e837ede2f75de3cbd0fc1782d71

• --ci host exit 0 and --build-only exit 0.
• session_lifecycle exit 0. Its desktop arm runs through the launcher thread's opens.
• QEMU regressions, exit 0 each: a_launch_gives_each_unsent_stdio_slot_a_null, a_usb_key_reaches_the_console, desktop_without_x2apic, the_compositor_drives_the_virtio_gpu, a_window_is_drawn_at_the_scale_and_relaid_at_the_next, stream_holders, stream_exported_to_a_child.
• libc_children: exit 1 on spawn_children_cap alone, main's.
• Mutations: round 1's (p1b/muts2/) carry over, because their files are unchanged since.
• Metal is re-staged at b3b2ad355.

Round 1, at 3dcd5855e. 4592ce5f5 adds only a fix to the session_lifecycle job, which now finds its session by the line that names the holder ending, and one comment. That job was re-run at that tree (7455cffe8). Evidence: https://github.com/ToyOSOrg/evidence/tree/c506f99899c3c1b42a12ddc7fff5cdf9f14889e7 (p1b/r2/, p1b/muts2/)

• cargo run -- --ci host: exit 0. cargo run -- --build-only: exit 0.
• session_lifecycle (QEMU x86-64): exit 0 at 7455cffe8. The desktop arm and the job's arms pass, now among test-runner's own session. The run at 3dcd5855e red only on the job's old guess of its session's number.
• QEMU regressions, exit 0 each: a_launch_gives_each_unsent_stdio_slot_a_null, a_usb_key_reaches_the_console, desktop_without_x2apic, the_compositor_drives_the_virtio_gpu, a_window_is_drawn_at_the_scale_and_relaid_at_the_next.
• libc_children: exit 1, on spawn_children_cap alone (guest memory), as on main.
• Negative controls. Each is a checked patch that builds, fails by name with exit 101 (exit 1 for the QEMU run), and is restored:
  • the session taken from the badge: a_handed_over_launch_runs_in_its_links_session fails;
  • a sibling's sign-out forgets a failure: failures_are_budgeted_across_an_authoritys_sessions fails;
  • one failure refuses a login: the same law fails (the first run of this patch did not build; the evidence is the rebuilt run);
  • a detached app placed under the supervisor: a_detached_app_is_placed_under_its_sessions_owner fails;
  • a login row holding the machine's launcher: a_login_row_holds_no_machine_launcher fails;
  • a graceful sign-out that kills: the owner's two laws fail, and session_lifecycle stalls at the desktop's sign-out;
  • any row receiving session-admin: the build's gate test fails.
• The round-0 revision line is corrected: those mutations ran at b9d8a83ef, one commit before the head they were reported against. They are superseded by this round's.
• The reverted stage cannot be the control, because neither the job nor its image builds without it. The owner's unasked end is split between the kernel's parent rule (process_tree) and the supervisor's host laws.
• app_view loses its machine-session grants arm, because a login test-runner's jobs launch in its session.
• Metal, staged at 3dcd5855e: the shared testcases boot, testcases-watchdog and proctreecase. 4592ce5f5 changes no binary those images carry.
• The SSH arms wait for a T14 row of sshserver; its session half has host tests alone.

Not here (P1c and later)

• Stop modes and the non-blocking power protocol, with acpiserver's second press.
• inspect listing sessions.
• The SSH arms on metal.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PXEk8BBMDT8tXu4AnENB9Q

[Japabu]

Review of #1035, round 1 (head ab7da5b, code 34dc3a7)

Architecture

The shape matches revision 8 and item 55. Each login session has one owner, /system/bin/session, which is the supervisor's child. The owner serves the session's launcher by handing each connection over (A) and parents the session's detached apps through the place it gives on its link. Sign-out has no clock in it. logout is its own row, and the desktop session is endowed to the compositor (C). sshserver and the compositor open sessions through CommandExt::launcher (D). The session comes only from the link: handed_over builds Caller { session } from the Login it was pumped from, and no field of the request names a share. The login port is minted with the row's name and checked against p.login. The pure Owner is a small, readable state machine. Its graceful, cancel and force laws are right, including an app that starts while the session signs out.

Net growth is about +2050 production lines (including in-file unit tests and the lockfile) against −250, plus about 440 lines of tests. The largest new pieces are the supervisor's sessions.rs (~500), the owner (~365), lib/session (~325) and the compositor's sign-out (~200). They are justified by the approved design.

Four defects remain. Each is either a consequence of removing Starts::Opening without replacing what it guaranteed, or a check that only looks implemented.

Findings

BLOCKER 1 — A login row's endowed launcher is now the machine's, so its launches can run in the machine session.

• system/supervisor/src/main.rs:827: None => (&minted.launcher, self.session).
• system/compositor/src/signout.rs:10,37.
• system/supervisor/src/sessions.rs:288.

Before this change, any launch a login row made from the machine session opened a login session (Starts::Opening). That rule is deleted, and nothing replaces it:

• The compositor without a session. When desktop_for cannot open the desktop session, the supervisor logs it and starts the compositor anyway, endowed the machine launcher. Possible causes are the reopen budget being spent, 16 sessions already open, or a failed owner start. Every taskbar and terminal launch then runs in Session::Machine, detached under the supervisor, and the compositor never retries, because reopen runs only on a control EOF.
• The comments say the opposite. The compositor says "its launches go nowhere", and the module header says "a launch goes nowhere, and says so". Both are false.
• sshserver. It is a service, and its starts = ["shell"] also endows it a machine-session launcher. Any .independent() without .launcher(..) launches a shell in the machine session, which this PR newly makes possible.

The fix needs one rule: a login row's launches belong to a session, and it holds no machine launcher. test-runner's machine launcher for jobs is the one case to settle. For example, refuse to start the screen's row without its session, or endow it no LAUNCHER. Then delete both false comments.

BLOCKER 2 — The compositor's launcher thread holds a mutex across a blocking launch, and the supervisor keeps a dead session's launcher port alive.

• system/compositor/src/session.rs:2209-2215.
• system/compositor/src/signout.rs (reopen).
• system/supervisor/src/sessions.rs:427-442.

The launcher thread locks Launcher and keeps the guard through command.spawn(), which waits for the supervisor's answer. reopen() on the main thread takes the same lock.

sessions_ended drops the Login, but services[i].desktop still holds an Rc<Acceptor> of the dead session's launcher port. The port therefore stays open with nobody accepting on it:

• A launch connected to it hangs forever instead of seeing EOF.
• If a taskbar launch is queued on the port when the owner ends (for example a click during a forced sign-out), the launcher thread blocks for good. The compositor's main thread then blocks in reopen() on the control EOF, and the desktop freezes.
• After a refused reopen, every later launch hangs silently through the stale endowed launcher.

The fix:

• Take the namespace handle out of the lock (a dup, or a message to the launcher thread) instead of holding the guard across the spawn.
• Keep the session's launcher only in Login, so its end closes the port. Desktop can name the session alone.

BLOCKER 3 — The reopen budget is keyed per opener row with one failed flag, which is wrong for an authority that holds several sessions.

• system/supervisor/lifecycle/src/sessions.rs:59-87.
• system/supervisor/src/sessions.rs:205-213.

R2 says only a reopen after a failure is counted, and ordinary logins never are. sshserver holds one session per connection, so the single flag means:

• One connection's owner failing makes the next unrelated SSH login spend the budget. Three such failures inside 10 s refuse ordinary logins.
• Any sibling session's sign-out clears the flag, so a real crash loop goes unbudgeted if any sibling signs out.

The ordering is also off. reopens.open spends the budget and clears failed before the MAX_SESSIONS check and before the owner starts. A refused or failed open therefore consumes the budget and forgets the failure.

The host law tests only one session at a time, so it cannot expose this. The fix:

• Define the budget on failures themselves. For example: refuse an authority's open while more than RESTARTS of its owners failed inside WINDOW. Or key it by the session that failed, which the desktop's reopen is.
• Spend only once the open has succeeded.
• Add a law with two concurrent sessions of one opener.

BLOCKER 4 — The session-admin ownership check compares a constant with itself, and the PR presents it as a check.

• system/supervisor/src/sessions.rs:460-463,482.
• lifecycle/src/sessions.rs:90-105.

admin gives every session the user toyos_manifest::USER and asks sign_out_target with that same constant. The badge is Authority { row, session }, with no {user} as R3 specifies. Refused::NotYours is unreachable in production. The mutation m6 only shows that the pure function is tested, not that the supervisor checks anything.

The PR says "The supervisor checks whose session it is", and the track lists "session-admin ignoring whose session it is" among its controls. Both overstate the code. With one user, the honest result is that any logout in a login session may sign out any session.

The fix is one of:

• Carry the user in the session (or in the admin badge) and check it.
• Delete NotYours, the user column and their law, and state plainly in the PR and the track record that the system has a single user.

The current form is machinery that exists for its test.

BLOCKER 5 — The sshserver half is written against a design main has deleted.

• system/sshserver/src/{main.rs,spawn.rs}.

The branch sits on 35e930136. Main has since landed #1026 (63bc8a32b), which replaces russh and tokio with toyos-ssh, threads, connection.rs and program.rs. This branch's Login, abandon and SshSession.login hunks will not apply.

Before this can land, the sshserver changes must be rewritten on main's server, and that is new code for re-review. sshserver had only host tests here, so no guest evidence is lost. Its sign-out on drop, and the "reap ended programs" behaviour #1026 added, need checking together.

SUGGESTION — refuse launches in a session that has ended.

• system/supervisor/src/main.rs:2411.

in_login.as_deref().unwrap_or(&self.minted.launcher) takes a Session::Login whose Login is gone (a queued handed-over launch served after sessions_ended) and mints the machine launcher with the dead session's badge. Detached launches are already refused there. Refusing every launch in a session that is not open is one check and removes that fallback.

SUGGESTION — keep the desktop's reopen from being crowded out.

• system/supervisor/src/sessions.rs:212.

MAX_SESSIONS is global. SSH sessions left "ending" by an app that ignores hang-ups (which R6 permits indefinitely) can fill all 16 slots. Once full, the desktop's reopen after a sign-out is refused and never retried. A per-authority bound, or a reserved desktop slot, avoids that.

SUGGESTION — stop the supervisor spinning on a bad link.

• system/supervisor/src/sessions.rs:337-339.

A Malformed link logs and breaks but stays watched and readable, so the loop spins and floods the log. A malformed frame from the supervisor's own child is a bug, so kill the owner and let the session end as a failure.

SUGGESTION — fix MAX_CONTROLS' doc.

• system/session/src/main.rs:26-27.

The doc says "one per restart of a compositor". A restarted compositor's old control has already hung up and been removed, so the bound counts live controls only. Also, a refused ninth control looks like a session end to a compositor, which then opens a second desktop session.

SUGGESTION — replace the roster polling if kill is synchronous.

• tests/guest/rust-tests/src/bin/session_lifecycle.rs:470.

The test polls the roster with a 20 ms sleep. If the kernel's kill is synchronous, the holder is gone (or a zombie, which live filters out) by the time the control hangs up, so one check after control.ended() suffices. If it is not synchronous, the current comment is fine.

Evidence

• Checks at 34dc3a7. --ci host exited 0 (102 steps), --build-only exited 0, and session_lifecycle exited 0 (r1/session_lifecycle.log). The five QEMU regressions exited 0.
• Mutations. All six ran at b9d8a83ef, not at 34dc3a7 as the PR states. The only difference is the 7-line serve_login desktop hunk and the issue text, which none of the mutated files or tests touch, so the result carries over. The PR's "all checks are at 34dc3a7" line should name that revision.
• libc_children. It fails at child 240 of spawn_children_cap with status 0xb, matching the recorded red on main, and this PR touches only the helper path's launcher: None. I accept it as independent.
• Controls.
  • m1 (session taken from the badge) and m6 (ownership ignored) are mutations of pure functions whose production inputs cannot differ. See blockers 3 and 4.
  • m7's guest arm (a graceful sign-out that kills stalls at Escape) is the meaningful one.
  • Blocker 3 has no control at all.
• Metal. testcases, testcases-watchdog and proctreecase are queued and pending.
• Gaps outside this round. The owner's unasked end follows the given ruling, and the open login-row question is with the owner; neither blocks this round.

SEND BACK

[Japabu]

Review round 1, answered at 4592ce5f5, restacked on #1024's edd13715c. Evidence: https://github.com/ToyOSOrg/evidence/tree/c506f99899c3c1b42a12ddc7fff5cdf9f14889e7

• B1. A login row holds no machine launcher (holds_machine_launcher, a host law with a mutation), and both unwrap_or(&minted.launcher) paths are gone.
  • A launch into an ended session is refused.
  • The compositor opens a session at start and again for each launch while none is open. It says why when refused, and starts nothing.
  • sshserver's starts = ["shell"] gives it no machine launcher.
  • A login test-runner opens one session for its jobs.
• B2. The launcher acceptor lives in Login alone, so the port closes with the session. The screen's row is handed a minted launcher and control per start. The compositor's thread launches through a Namespace::duplicate taken under the lock, so no lock is held across the launch.
• B3. Reopens are budgeted on failures inside the window, per authority. An open spends nothing. A new law runs several sessions of one authority at once, with two mutations: a sibling's sign-out forgetting a failure, and one failure refusing a login.
• B4. The user dimension is gone, per your ruling. The PR and the track say the machine has one user.
• B5. The sshserver session half is rewritten on sshserver on toyos-ssh with std threads; russh, tokio and rsa are gone (SSH stage 2) #1026's server: Login per connection, and spawn::Ender for a channel's end.
• Suggestions taken:
  • refuse launches into a closed session;
  • a reserved desktop slot;
  • kill an owner on a malformed link;
  • the MAX_CONTROLS doc.
• Roster poll. I kept it: the guest cannot tell from the kill alone that the end is published.
• Mutation revision line. Corrected; round 0's mutations ran at b9d8a83ef, and this round's supersede them.

[Japabu]

Review of #1035, round 2 (head 4592ce5, on #1024's edd1371)

Architecture

The answer keeps revision 8's shape and removes what round 1 objected to.

• No machine-launcher fallback. A login row is endowed no machine launcher (holds_machine_launcher), so its launches can only be a session's.
• Ownership follows the session. The session's launcher acceptor lives in Login alone, so a session's end closes its port.
• Reopens are budgeted on failures. The count is per authority, across all its sessions.
• The single-user fact is stated. The vacuous per-user check is deleted, and the PR and track say plainly that the machine has one user.
• The sshserver half sits on sshserver on toyos-ssh with std threads; russh, tokio and rsa are gone (SSH stage 2) #1026's server. It uses a Login per connection and an Ender that hangs up a channel's program through its own MANAGE handle. On ToyOS this also closes the hole recorded in issues/sshserver-cannot-end-a-program-that-closed-its-output.md.

The round's delta is +388 −283, and most of it replaces code rather than adding it.

Round 1's blockers

• B1 — resolved.
  • Minting::launches is an Option. Minting::machine gives a login row none, and that covers service starts, drives starts and machine-session launches (main.rs:339-342, 2408-2418).
  • A launch into an ended login session is refused (main.rs:2411-2416).
  • The compositor tries to open a session at start and again on each launch while none is open. When refused, it starts nothing and says why. Its comments now match that behaviour.
  • A login test-runner opens one session for its jobs.
  • Law: a_login_row_holds_no_machine_launcher, with mutation m12 exiting 101.
• B2 — resolved.
  • Login.launcher: Acceptor is the session port's only holder.
  • Desktop is now a minted connector namespace plus one control connection, which Service::start takes once (main.rs:827-831).
  • The compositor's launcher thread takes a Namespace::duplicate under the lock and launches outside it (session.rs:2220-2232).
  • A launch queued on a dead session's port now reads EOF instead of hanging.
• B3 — resolved.
  • Reopens keeps a window of failure instants per authority, and an open spends nothing (lifecycle/src/sessions.rs:134-164).
  • A sibling's sign-out forgets no failure, and one failure refuses no login.
  • A failed or refused open counts nothing, because only an owner's end records a failure.
  • The deque is pruned on each may_open, and there are at most 16 sessions, so it stays bounded.
  • Laws: failures_are_budgeted_across_an_authoritys_sessions, with mutations m5 and m5b exiting 101.
• B4 — resolved, per the coordinator's ruling.
  • sign_out_target, Refused and the user column are gone.
  • admin finds the session by its share or refuses by name.
  • The single-user statement is in the code (sessions.rs:464), in logout's header and in the track.
• B5 — resolved.
  • connection.rs opens the Login lazily per connection and drops it in end(self), which signs the session out gracefully.
  • Program carries an Ender, and a failed Ender::of kills and refuses the program.
  • The host build keeps the kill-and-reap behaviour sshserver on toyos-ssh with std threads; russh, tokio and rsa are gone (SSH stage 2) #1026 landed.
  • a_program_ended_is_reaped is still the host law.

The suggestions taken are all correct:

• the reserved desktop slot (room);
• a malformed link kills its owner;
• the doc of MAX_CONTROLS.

The roster poll stays, with a reason: from the kill alone, the guest cannot tell when the end is published. That is acceptable.

Races I checked

• Per-launch open. launch runs on the compositor's one loop thread, so two launches never both open a session.
  • A session opened in ensure has its control watched (session.rs:2111-2116), and a session reopened on EOF is watched in session_said.
  • A launch asked between an owner's end and the read of its EOF goes through the old launcher. Its port is now closed, so the launch fails and says so, and the EOF then reopens the session. Nothing hangs.
  • Holding a lock across a wait is gone.
• Ender. The MANAGE duplicate outlives the Child waiter, so it can ask a quit while another thread waits. A quit on a program that has already ended returns an error, which is ignored.
  • The connection's end(self) hangs up each channel's program, then drops Login, which signs the session out. The order is the same on an unwinding panic.
  • A program that ignores the hang-up stays in the session as "ending" until something forces it, as R6 requires.
• Late start and force. These are unchanged from round 1 and still correct. A desktop restart is minted a fresh launcher and control into the open desktop session, including one that is ending.

Findings

BLOCKER — two sshserver comments contradict ToyOS's behaviour.

• system/sshserver/src/program.rs:4-8. The header says that until the wait starts "end kills the program", and that "a program that closed both and runs on is waited for and cannot be ended". On ToyOS, end now asks a hang-up through the Ender's own handle, whether or not a thread waits. The edited issue says exactly that: the hole stays only on a host build.
• system/sshserver/src/connection.rs:441. The doc "End what runs on a channel: its program, whose pipes then end its readers" claims the program ends. On ToyOS it is only asked to.
• Fix. State both platforms briefly or point to spawn::Ender, and drop the false sentence. This is comment-only, so no rerun is needed.

SUGGESTION — move the session open off the compositor's loop.

• system/compositor/src/signout.rs:113-127. reopen() makes a blocking supervisor round trip on the loop thread, at start, on EOF and on each launch while no session is open. The supervisor answers within its own bounded start, so this is not a hang. It is still a frame stall per attempt, and the open could move to the launcher thread later.

SUGGESTION — don't let the screen's row open a second desktop session.

• system/supervisor/src/sessions.rs:312. serve_login from the screen's row opens a new desktop session even while one is open. That is reachable when the owner refuses a ninth control, which the compositor reads as the session's end. Answering with the open desktop session, as desktop_for does, would prevent two desktop sessions.

NOTE — app_view's machine-session grants arm is gone.

• This follows from B1: the job no longer runs in the machine session. The refusal itself (main.rs:1166) is a one-line match on the badge's session, which inspection establishes. I don't require a replacement test. The metal judge's expected line was removed with it (tests/toyos.rs).

Evidence

• Checks. --ci host (exit 0), --build-only (exit 0), the five QEMU regressions (exit 0 each) and the eight mutations (exit 101 each; m7's QEMU arm exit 1, each restored) ran at 3dcd5855e.
  • 3dcd5855e and the head differ only in session_lifecycle.rs and one doc comment in main.rs.
  • session_lifecycle failed at 3dcd5855e (exit 1, r2/session_lifecycle.log). The job's assumption that "the smallest active share is mine" broke once test-runner's own jobs session (8) existed. The test was fixed to identify its session as the one ending with the holder, and it asserts that session was listed active before. It passed at 7455cffe8 (r2/session_lifecycle-2.log).
  • 7455cffe8 differs from the head by that one doc comment. That fix is sound, not a rerun-to-green.
• libc_children. Exit 1 is the same independent red on main as in round 1.
• Metal staging. It exited 2, which is staging's normal exit (round 1's did too). It staged three images, and they are pending.

SEND BACK

[Japabu]

Review of #1035, round 3 (head b3b2ad3, on #1024's bfc9b97)

As asked, I looked only at four things: the comment fix, the compositor's opens moving to its launcher thread, serve_login answering the screen's row with its open desktop session, and the restack.

Verified

• The comment fix is right.
  • program.rs's header now states both platforms: on ToyOS a hang-up through the Ender's own handle, and on a host a kill unless a thread waits.
  • connection.rs's end says the program is asked to quit.
  • The round-2 blocker is resolved.
• The restack is right.
  • serve_launch keeps let session = caller.session ahead of net: a stream is shared by its holders across processes (socket sharing S2) #1012's kind-checked caller_fds. A descriptor of an unknown kind is still refused before the Launch is built (main.rs:2262-2272).
  • The kind field threads through sdk/libc/src/spawn.rs, sdk/toyos/src/spawn.rs and launch_unsent_stdio.rs.
  • In tests/toyos.rs, session_lifecycle sits beside the new stream rows in RUST_SKIP, MACHINE_TESTS and run_machine_test. libc_children and the stream rows are still registered.
  • app_view's machine-session grants line is gone from the metal judge, as in round 2.
• The thread handoff has no double opens.
  • Ask::Open is queued only at start, on a control's EOF, or by a launch while there is no control and opening is unset.
  • An EOF needs a control, and opened() clears opening when the control arrives. So one open is outstanding at most, and two queued opens cannot happen.
  • A launch asked while an open is in flight queues behind it on the one thread, so it uses the opened launcher.
  • opened() drains the wake pipe and then the channel. The thread sends and then writes, so a late write only causes an empty wake.
  • The pipe is re-watched on every wake, and the new control is watched once taken. FIXED_POLL_HANDLES = 7 is correct.
  • The loop no longer waits on the supervisor.

Findings

BLOCKER 1 — A refused open leaves opening set for good, so the desktop never asks again.

• system/compositor/src/signout.rs.
• opening is cleared only in opened(), when a control connection arrives. When wire::open fails, the thread only logs: the failure reasons are a spent failure budget, every session slot taken, a missing session row, or a controls.open error.
• After that, launch sees opening and asks no open. EOF cannot fire either, because there is no control. Every later launch goes through the stale or endowed launcher and fails.
• So one refused open leaves the desktop without a session until the compositor restarts. That remains true even after the failure window has passed and an open would succeed. Round 2's per-launch open retried, so this is a regression this round introduced.
• Fix: the thread reports the refusal back as well, for example by sending Result<Connection, String> over opened and writing to the pipe either way. The loop then clears opening in both cases.

BLOCKER 2 — serve_login and desktop_for can hand back a desktop session whose owner has already ended.

• system/supervisor/src/sessions.rs:312-321 and desktop_for.
• The lookup position(|l| l.desktop && l.opener.name == opener.name) reads logins.open. Only sessions_ended prunes that list, and it runs from ended() after the pending frames of the same loop iteration.
• The race: the supervisor is busy in one iteration (a launch, or file work) when the desktop owner exits. In the meantime the compositor reads the control EOF and the launcher thread sends its open. The supervisor's next wait then returns both TOKEN_ENDED and the login frame, and serve_login answers with the dead session:
  • If controls.open then fails, the compositor is refused, and blocker 1 makes that permanent.
  • If it succeeds, the compositor gets a launcher whose port closes a moment later, and a control that reads EOF at once.
• This round's change introduced the race; round 2 always opened a new session.
• Fix: reuse only a session whose owner is still running. For example, call self.sessions_ended() before the lookup, or filter with exit_of(&l.owner).is_none(). The same applies to desktop_for.
• The desktop arm of session_lifecycle does not exercise this, because there the supervisor is idle when the owner exits.

Evidence

• Checks at b3b2ad3. --ci host, --build-only, session_lifecycle and eight QEMU regressions, including the restack's stream_holders and stream_exported_to_a_child, each exited 0 (p1b/r3/).
• libc_children changed its failure. It still exits 1, but the failure is now spawn_children_cap ended Some(134), a libc panic from Poller::new: inbox_setup failed: ResourceExhausted, rather than round 1's child 240 with status 0xb.
  • It matches the out-of-memory variant recorded for main in the handoff. The PR does not change per-process kernel resources or the libccase image, so I infer it is independent.
  • This round cites no base run. The cheapest check is libc_children at spawn: a plain spawn is a helper, and a launch is asked for #1024's bfc9b9793.
  • The host ran at 2.85x its liveness ceiling, so timing in this run means nothing.
• Metal. Staging exited 2, as usual here. The boots are queued.

SEND BACK

[Japabu]

Review of #1035, round 4 (head f3f45a8)

As asked, I checked only round 3's two blockers and the code that fixes them.

Round 3 blocker 1: a refused open now ends the wait

• Ask::Open now always answers Result<Connection, String> on the same channel and pipe (system/compositor/src/signout.rs). That includes the case with no login connector.
• The loop's opened() calls Opening::answered() on every answer before it looks at it. The next launch or EOF therefore asks again.
• Opening::ask(open) still allows only one outstanding open. So round 3's guarantee holds: no two opens are ever queued.
• A refusal leaves the thread's session launcher as it was. The launch queued behind the refused open fails and says so. The next launch asks for a session again.
• The pipe is re-watched on every wake, so an answer that only refuses does not strand the wake.
• Law: a_refused_open_is_asked_again. Mutation m13 (answered keeps asked) exited 101 and was restored. The production path calls exactly that method.

Round 3 blocker 2: an ended owner's desktop is not handed out again

• Both desktop_for and serve_login now go through Supervisor::desktop_session. It marks each Login as running: exit_of(&l.owner).is_none(), and decide::desktop_session hands out only a running one.
• Asking exit_of early does not consume the owner's end. sys_process_wait with WNOHANG reads object.end() without taking it, so the later sessions_ended still sees the end and closes the session.
• An owner can still exit in the moment between that check and handed_to. That window is now benign: the compositor reads EOF on the control and asks again, and blocker 1's fix makes that retry work.
• Law: a_desktop_whose_owner_ended_is_not_handed_again. Mutation m14 (ignore running) exited 101 and was restored.

Evidence (p1b/r4, all at f3f45a8)

• These checks exited 0:
  • --ci host (102 steps);
  • --build-only;
  • session_lifecycle, including the desktop arm's reopen;
  • the compositor regressions.
• libc_children is independent of this PR. It exits 1 on the head, on spawn: a plain spawn is a helper, and a launch is asked for #1024's bfc9b9793 and on main 89f92a4bd. All three are the same spawn_children_cap exhaustion. The exact symptom varies between runs: ResourceExhausted in Poller::new, or child 240 ending with status 0xb.
• Metal is still pending. Staging exited 2, as usual here, and the T14 boots are queued.

Suggestion (optional)

decide::Open and the Vec that desktop_session collects exist only so a one-line predicate can be tested on the host. Filtering self.logins.open with that predicate in place would be shorter. The current form is correct, so I do not require the change.

LAND