Trail Mate Dev
6e613e382e
Compose the CM0 fullscreen application and standard Debian package, align the Cardputer Zero shell, and share protocol, configuration, audio and storage services with embedded targets through existing platform seams. Add the paginated on-device TMAP creator using Center's published producer, private workspace recovery and direct keyboard shortcuts. Preserve unfinished management work behind its existing opt-in capability. Include native, ARM and shared-core regression fixtures, integration records, packaging helpers and dependency/license updates. Keep local build trees, device credentials, produced packages and validation logs outside version control. Validation before integration: ESP stack hygiene, Reticulum scope guard, staged whitespace checks and GitNexus scope audit. Prior device/build evidence and remaining hardware/package boundaries are recorded in the acceptance documents.
3.6 KiB
Linux application restart and clock writes
The SDL desktop composition and the Cardputer Wayland/framebuffer entrypoints
now own an application lifecycle scope. A restart request is recorded atomically,
the rendering loop stops, and normal C++ scope cleanup releases UI objects and
application services. Only after the run scope has returned does the owner call
execv on the kernel's current executable identity. This replaces the process
image with the same executable and preserves its argument vector and environment;
it does not run a shell or reboot the operating system.
The former direct exit(0) path skipped automatic-object destruction and did not
restart the application. Compositions adopting the lifecycle now release phone,
radio, storage and presentation resources before replacement. Unadapted legacy
compositions retain their previous fallback behavior. A failed application run
is not restarted. A failed exec returns an error exit rather than pretending that
restart succeeded.
Window close, Alt+F4 and explicit automatic-exit deadlines take priority over an overlapping restart request. A later restart request cannot reverse a recorded normal exit. Repeated restart requests coalesce. There is no installed application path or board identifier in the lifecycle owner.
After run-owned services shut down, the restart thread isolates its descriptor table and marks residual non-stdio descriptors close-on-exec. This also covers process-lifetime platform services and prevents other threads from racing a new descriptor into the replacement image. The descriptor test includes an open descriptor deliberately retained outside the run scope. The descriptor-table operation uses the documented CLONE_FILES contract.
The process contract follows execve(2).
The test launches a real child, checks cleanup of an intentionally non-CLOEXEC
descriptor before replacement, verifies destructor output and unchanged PID,
and confirms argument/environment preservation, including spaces and shell
metacharacters. It also covers an error result, exec failure and exit priority.
The phone facade regression calls the actual restart backend in a child and
requires a distinct continuation exit status, so the old exit(0) behavior
cannot produce a false passing result.
Clock writes
The Linux set_utc_time port now calls clock_settime(CLOCK_REALTIME) and returns
the actual result. Negative timestamps are rejected before the syscall. It does
not substitute a local configuration value for an operating-system clock update.
The existing phone facade bounds its epoch conversion and propagates failure;
the shared phone protocols already map failed synchronization to failure replies.
System-clock authorization is an operating-system deployment prerequisite. This change does not grant capabilities to the executable or install an elevated helper. The normal unprivileged application's clock-write capability is therefore not established by these tests, and full phone time administration remains subject to deployment policy. NTP and timezone policy are unchanged. See the Linux clock interface for the operating-system privilege requirement.
Clock tests interpose the syscall inside the test process. They verify the target clock, timestamp, success, permission rejection and invalid-value rejection without changing any host or device clock. The shared Meshtastic protocol regression also verifies that the actual Linux facade returns rejected writes as failure and successful writes as success.