fds-os/docs/developer/m6-validation.md

M6 cartridge software validation

Development reference and historical context. For current operating instructions, use the user manual. Acceptance applies only to the source and artifacts identified in each record.

Verified on 2026-09-21 on the x86_64 Arch build host. These results use actual AArch64 binaries, kernel USB events, s6 services and filesystem mounts in QEMU 11.1.1. Physical Pi wiring, bay calibration, simultaneous physical devices and USB electrical behavior remain deferred. Twelve-device virtual stress follows in M11; this milestone does not claim that test has already run.

Behavior verified

make cartridge-test passed in out/m6-vm.u4w9b7pl/:

• The unconfigured production image reports twelve UNCONFIGURED bays. A probe discovers the virtual controller's actual topology; the fixture then maps its USB 2/3 companion ports explicitly. No /dev/sdX name selects a bay.
• The SYSTEM image boots from virtual USB and is reported PROTECTED. Eject fails.
• A virtual keyboard is recognized by the hardware catalog without a filesystem.
• The ordinary FDS user can query the daemon. A different UID is rejected even when the test temporarily relaxes socket file permissions. Slow and oversized clients do not prevent another control request from completing.
• Inserting ENVIRONMENT media triggers a validated read-only mount. Writes fail. Metadata is inspected privately before the mount becomes publicly accessible.
• A shell inside the mount and an additional bind mount each prevent SAFE. After those uses end, eject unmounts successfully and reports SAFE. A service restart preserves that ejected state until removal and reinsertion.
• Reinsertion into another port follows that bay. Wrong manifest classes, symlink metadata, and multiple named partitions are rejected without choosing a first candidate. Surprise removal clears inventory; restart remounts valid, nonejected read-only media.
• Holding cartridged before its readiness notification does not prevent the ordinary UID-1000 FDS console from accepting a command.

Every VM disk used read-only remained byte-identical. Tests use disposable image files and virtual USB devices, never host disks or physical USB passthrough. VM test helpers and the temporary root test console do not ship in SYSTEM.

Shared unit tests also cover USB bus renumbering, mapping aliases and overlapping mappings, manifest symlinks/FIFOs, malformed contracts, and absent USB subsystems. The older native-init VM revealed the absent-USB case; its corrected empty-inventory behavior passed a new unit test and the complete native-init boot afterward.

Final artifacts and regression evidence

Artifact	SHA-256
Rootfs TAR, out/rootfs-build.FpSNiJ/	00fc851affe0f1c42d289cc05ae376788beae9a6b0dce39c6a1f3b86687d1baf
SYSTEM, out/system-build.df52fwqj/	908645b47bfe207470eeb82436f8a644d34cf3703156a7bdcbf2a3534e9346fe
Production boot FAT, out/boot-build.bka9vs1y/	fb54582a9bd3bb393299002a65a5b0035e806e6733e81a437369a0b152b297e2

The rootfs contains 112 packages and 1,170 AArch64 ELF files; its TAR is 408,248,320 bytes. fds-cartridged is statically linked, installed by its own mandatory base package and supervised by native s6. No external Rust dependency or locked external version changed; the lockfile change only adds the workspace member. Existing libc, serde, serde_json and toml provide the required interfaces.

The final pipeline exited zero: fresh rootfs and initramfs, tooling tests, make check, rootfs checks, native-init boot, SYSTEM/boot-volume construction, the nine-case stage0 matrix, console tests and cartridge tests. Logs are out/logs/m6-verified-*.log. M0 bootstrap and smoke-test also passed in out/logs/m6-final-bootstrap.log and out/logs/m6-final-smoke-test.log. The optional M0 host-PATH emulator skip remains explicit; project-local ARM execution and full-system tests actually ran.

Native-init evidence is in out/m2-vm.S16Noo/; stage0 cases are in out/m4-vm.XBTVEW/; ordinary-console traces are in out/m5-vm.51n612y3/. The normal trace measured 1,753.878 ms from the kernel clock to console, versus 1,669.027 ms in the final M5 normal trace: +84.851 ms, below the 100 ms explanation threshold. The actual ARM comparison tool passed; see out/logs/m6-boot-regression.log. These are individual emulator observations, not proof of physical Pi latency or a statistically established timing change.

Writable DATA, consumer shutdown and syncfs follow in M7; desktop/profile activation follows in M8. Read Cartridge usage for exact commands, configuration syntax, current states and safe-eject boundaries.