The machine's stop keeps its gate and waits for no thread

Cargo.toml

@@ -337,9 +337,6 @@ acpiserver-api = { path = "lib/acpiserver-api" }
 # The metal loop, the suite's command line, and what the metal profile
 # derives, times and reads off a boot.
 toyos-metal = { path = "tests/metal" }
-# The shutdown's stop record: the kernel renders it and the harness reads it
-# back off a log, so one declaration is what both sides spell it with.
-toyos-quiesce = { path = "lib/quiesce" }
 # The parity table `crypto_parity` prints and the judge reads, under one rule.
 toyos-parity = { path = "lib/parity" }
 # The package energy counter's decode, so the `counters` judge's reading of

build/ci.rs

@@ -620,6 +620,12 @@ pub(crate) const CONTROLS: &[Control] = &[
         test: "a_halted_cpu_with_queued_work_was_kicked",
         message: "halted with 2 of 2 messages queued and no IPI in flight",
     }]),
+    // The same edge under a demanded pass, in a run of its own: the model
+    // above ends its process.
+    red(KERNEL_LOOM, "doorbell-kick-relaxed", Some("loom_sleep"), &[Says {
+        test: "a_pass_that_answers_a_demand_reads_what_its_demander_wrote",
+        message: "a pass answered the demand and read the gate closed after it",
+    }]),
     red(KERNEL_LOOM, "push-fence-relaxed", Some("loom_push"), &[Says {
         test: "a_cpu_that_halts_without_seeing_the_surplus_was_pushed",
         message: "published and no push behind it",
@@ -646,11 +652,6 @@ pub(crate) const CONTROLS: &[Control] = &[
         test: "a_second_post_is_not_lost_to_a_flag_the_waiter_consumed",
         message: "parked with both conditions true and no wake owed: a post answered off a load",
     }]),
-    // The stop's store-buffering pair with the gate's fences gone.
-    red(KERNEL_LOOM, "gate-fence-off", Some("loom_watch"), &[Says {
-        test: "a_transition_racing_an_opening_gate_is_never_missed",
-        message: "the stop parked over a thread that had parked, and nothing posted it",
-    }]),
     // `kernel-loom`'s control, over the kernel's `Once` as the watch models'
     // ring entry.
     red(KERNEL_LOOM, "poll-fire-load-store", Some("loom_watch"), &[

docs/src/architecture/authority.md

@@ -69,7 +69,15 @@
 ## The process tree
 
 - Every process has one parent. A parent's end, whether exit, crash or kill,
-  ends its whole subtree at once; quitting gracefully is the parent's job.
+  ends its whole subtree at once.
+- A holder of a child's process handle may ask the child and everything
+  below it to quit, with a reason: an interrupt, a hang-up or a terminate. The
+  kernel carries the request to every process below. A process that listens
+  for such requests receives it as an event. One that never listened, or has
+  not yet taken the last request, is ended instead, and its subtree with it;
+  no process in between can shield what is below it.
+- The kernel never asks on its own: whether and when to ask is the holder's
+  decision.
 - A child's end is readiness on its process handle, and says how: an exit code,
   a kill, or a fault of a named class.
 - There are no process groups, POSIX sessions, controlling terminals, signals,

docs/src/architecture/services.md

@@ -10,7 +10,10 @@
 - It never dies and stays small: its decisions are pure, host-tested logic,
   and the process only holds handles, spawns and runs its loop.
 - It owns the machine's orderly stop, derived from the manifest's
-  dependencies, and replaces a running service's binary when an authorised
+  dependencies. Once it asks the kernel to end the machine, no program but
+  the asking thread runs its own code again; the kernel waits for no
+  program to finish, so what must finish first is done before the ask.
+- It replaces a running service's binary when an authorised
   caller in a login session asks.
 
 The other services are the components in the [Overview](overview.md). Each is

docs/src/architecture/sessions.md

@@ -44,14 +44,19 @@
 
 ## Ending a session
 
-- Sign-out asks the session's apps to finish, allows cancel or force, then
-  ends the session's subtree.
+- Sign-out asks each of the session's apps to quit
+  ([Processes and authority](authority.md)). An app that never listened for
+  such a request ends at once. The others receive it, and the sign-out waits
+  for them, reporting what remains, until it is cancelled or forced. The
+  session's subtree ends once its last app has.
 - A dropped connection or closed terminal sends its tree a hang-up, reports
   what remains and for how long, and keeps waiting.
-- **No timer ends a process.** Only an explicit force does: a sign-out's
-  force, scoped to the user's own sessions, or the system controls' stop. A
-  second quit request ends a process that ignored the first only when a person
-  or an explicit force sends it.
+- **No timer ends a process.** A process that received a request and carries
+  on is ended only by an explicit force: a sign-out's force, scoped to the
+  user's own sessions, or the system controls' stop. No request is repeated on
+  a timer. A second one, which ends a process that has not yet taken the
+  first and asks again one that has, is sent only by a person's action or
+  the machine's stop.
 
 ## Permissions
 

issues/a-crash-record-survives-a-reset-outside-ram.md

@@ -17,8 +17,8 @@ What went with the black-box page and comes back with this track: the
 metal rows that judged a sealed record (`boot_deadline_ends_a_wedge`,
 `hard_lockup_ends_a_deaf_cpu`, `watchdog_resets` and the
 `wedge-before-reset` and `hard-lockup-probe` arms they staged), the
-records a stop writes after `logkeeper`'s last flush (its stop record, the
-machine's census and the panel's, which `irq_census_conservation` and the
+records a stop writes after `logkeeper`'s last flush (the machine's census
+and the panel's, which `irq_census_conservation` and the
 boot's panel timings read), and the window between `logkeeper`'s stop mark
 and the reset: a hang in the drivers' stop, the kernel's quiesce or the
 reset, which the deadline then ends, leaves the volume of a clean stop and

issues/no-t14-row-reads-the-power-off-after-the-kernels-own-acpi-enable.md

@@ -31,7 +31,7 @@ ACPI_ENABLE 0xf0 written to SMI_CMD 0xb2, SCI_EN set 13371ns after` at
 13.535 s, the supervisor's `(Shutdown)` line followed at 13.540 s, and the
 loader pass after it found no panic record.
 
-**What QEMU reads of it.** `machine_shutdown`, `machine_shutdown_short_stop`
+**What QEMU reads of it.** `machine_shutdown`, `machine_shutdown_with_a_thread_spinning`
 and `acpi_power_button` power q35 off in ACPI mode, and none of them after
 the kernel's enable: OVMF hands q35 over with `SCI_EN` set, so the mint
 writes nothing. A guest can be put in legacy mode from outside, with nothing

issues/the-kernel-is-small-interrupts-post-and-threads-wait.md

@@ -358,7 +358,7 @@ state. Nothing here is ruled, and the ranking is a proposal.
 | Interrupt controllers, vectors, traps | 10 | 3,970 | yes |
 | Log ring, console UART, panic console, panic capture, own symbols | 17 | 3,517 | yes |
 | Scheduling: the core's driver, context switch, idle states, jobs, preemption | 20 | 3,160 | yes |
-| Firmware tables, ACPI mode, reset and power-off, the machine's stop, what the loader named | 12 | 3,099 | yes for the tables, the `acpi` row and power; the rest below |
+| Firmware tables, ACPI mode, reset and power-off, the machine's stop, what the loader named | 12 | 3,099 | yes for the tables, the `acpi` row, power and the stop's gate; what the loader named has left (#1210) |
 | Processes, threads, spawn | 8 | 2,736 | yes, less the userland text a spawn carries (below) |
 | Clocks: TSC and generic timer, the wall clock, typed durations | 7 | 1,847 | yes; the x86-64 CMOS driver and its IRQ8, 285 of these lines, went after this count |
 | Counters, the diary, IRQ census, mask windows, boot deadline, hard lockup, chipset watchdog | 14 | 1,844 | counters and diary yes; the three bounds are unnamed and inferred to be the kernel's, since they bound the kernel |
@@ -404,10 +404,6 @@ Changes of the design, each inferred and none of them work until resolved:
   something in userland that maps a build-id to a file; neither is built.
 - **Namespaces**:
   `issues/a-namespace-is-a-kernel-object-and-service-lookup-is-kept-out-of-the-kernel.md`.
-- **The stop's sweep of userland threads**:
-  `issues/the-kernel-stops-every-userland-thread-at-a-stop-the-supervisor-orders.md`.
-- **The quit's walk**:
-  `issues/the-kernel-decides-who-is-asked-to-quit-and-who-is-killed.md`.
 
 ### The next removals, ranked (a proposal)
 
@@ -450,8 +446,7 @@ out, and a larger number needs one of the design changes above.
   (`issues/fstats-answer-is-declared-twice.md` owns its two declarations).
 - Stale text: `kernel/Cargo.toml`'s description says "filesystem";
   `kernel/CLAUDE.md`'s first caveat is about a filesystem on the idle path;
-  `quiesce.rs`'s header speaks of the block layer and a USB stop, neither
-  of which the kernel has; `UserImage`'s doc comment
+  `UserImage`'s doc comment
   (`kernel/src/process.rs`) says "the file the kernel opened", and the
   kernel opens none.