# Kernel host tests -- plan and progress (kept current, one line per increment)

Captain Bob, 2026-11-12: "Build an appropriate test harness! Love the idea." -- for the kernel's own
C code, so that a defect QEMU cannot provoke (a USB descriptor no emulated device sends, a write that
fails half-way, a stop that spins) is still tested first and seen to fail. v4 has had this since step
1 (`make -C v4 test`); the kernel had none.

## The design (my calls, open to a ruling)

- **`kernel/tests/`**, one program per kernel source under test: `test_<unit>.c` compiled on the
  host with the kernel's own source file, `-std=c99 -Wall -Wextra -Werror`, and nothing else of the
  kernel. `make -C kernel/tests test` builds and runs them all; each prints `N checks, M failures`
  as v4's do, and the run fails if any does.
- **Fakes, not mocks** (`kernel/tests/fakes.[ch]`): the console captured line by line (so a test
  reads what the kernel said), a deterministic RNG, and a RAM disk whose reads or writes fail at the
  1 KiB blocks a test chooses -- the disk faults QEMU's blkdebug gives the boots, here per block and
  without a boot.
- **Code is moved only to be testable, never changed in the move.** Where a unit is buried in a
  larger function (the xHCI configuration-descriptor walk inside the event loop), it is moved out
  into a function of its own in one commit, the boots and the tests unchanged, and then tested.
- **Not a substitute for acceptance.** The boots stay the only acceptance of the kernel; these run
  beside them. Whether they become a stage of the protocol and the PR's gate (`nightly.sh
  kernel-tests`, after test-32) is **to rule** -- proposed once there are enough tests to matter.

## Increments

- [x] 1. The harness (`Makefile`, `harness.h`, `fakes.[ch]`) and `test_gpt.c`: `gpt_read` and
      `gpt_write_one` against a RAM disk -- a valid table; more used entries than `max` (#180); an
      entry out of range past `max` (#180); the first write failing and a later one failing (#168).
      Seen to fail against `gpt.c` as it was before #168 and #180 (`54311be1~1`): 12 checks, 4
      failures -- each of the two defects caught. Now: 0 failures.
- [x] 2. The xHCI configuration-descriptor walk moved out of the event loop (`usb_config.c`,
      `test_usb_config`), then #170 and #171 tested first (10 failures against the old decision)
      and fixed.
- [x] 3. #176 (seeds wiped on every exit; option 1, Captain Bob 2026-11-12: "1 is great" -- the
      caller owns the buffer: `test_sk_v4_mint`, 7 failures before; `test_sk_v4_identity`, through the
      real drive-arrival path, 5 failures before). [x] #177 (the fatal stops halt:
      `sk_v4_stop.c`, `test_sk_v4_stop`, a spin seen failing). [x] #178 (the slot array:
      `sk_v4_slots.c`, `test_sk_v4_slots`, 4 failures against the old allocation). [x] #182 (the
      cap checked at compile time: `check_cap`, a 4 TiB cap seen building before).
- [ ] 4. #179 once #187 is ruled (the block layer's header read).
- [ ] 5. To rule: the kernel tests as a protocol stage and in the gate.