Once: start something else on the next start, and only that one

A program that owns the whole machine had nowhere to run. It cannot be
started from the shell, because starting it means there is no shell, and
pointing boot.cfg at it means a machine that keeps starting it - which is a
poor place to find a mistake in something written five minutes ago.

Once writes /System/Boot/once.cfg, in the same format as boot.cfg and read
with the same routines, because a second format for one setting would be a
second format. The loader reads it before boot.cfg and DELETES IT BEFORE IT
JUMPS, which is the only moment there is: after the jump the loader does
not exist.

Consumed by being read rather than by working, so a one shot that hangs
cannot hang twice - the request is gone before the image ran, and the next
start reads boot.cfg like any other.

THE BOOT STATE IS NOT TOUCHED, and the first version got that wrong. It
marked the start the way any other start is marked, and then every
successful bare metal boot reported that it had never arrived - because a
program with the whole machine has no filesystem to clear a mark with and
is doing nothing wrong by not having one. Found by running it: the image
printed its line and the next start still said the last one did not.

Three disks, each a start further along, so none of the tests depends on
another having run.

The loop is closed on the machine now: write it in Edit, assemble it with
Asm, ask for it with Once, restart, watch it own the machine, and the
system comes back without being asked.

Programs/Boot/stage2.asm

@@ -70,6 +70,57 @@ start:
   ;
   ; Read before the image is, because the configuration is staged where the image will go:
   ; there is one large free area down here and no reason to have two.
+  ; ---- Something to start just this once ----
+  ;
+  ; A file naming an image to run instead of the configured system, and then to forget
+  ; about. It is the same format as boot.cfg and is read the same way, because a second
+  ; format for one setting would be a second format.
+  ;
+  ; CONSUMED BY BEING READ, not by working. It is deleted before the jump, which is the
+  ; only moment there is: after the jump this program does not exist. That also means a
+  ; one shot that hangs cannot hang twice - the request is already gone, and the mark on
+  ; the disk brings the ordinary system back.
+  SETD.0 OncePath
+  SETD.2 StageAt
+  LDD.1.2
+  INIA 0d4
+  CALL cfgLoad
+
+  SETD.0 KeySystem
+  CALL cfgGet
+  BNQ noOnce
+
+  SETD.1 BootName
+  SETD.2 CfgValue
+  LDD.0.2
+  RCAL copyString
+
+  ; Gone before it is used, so that whatever happens next happens only once.
+  SETD.0 OncePath
+  CALL sbfsDelete
+
+  SETD.0 OnceText
+  RCAL say
+  SETD.0 BootName
+  RCAL say
+  RCAL newLine
+
+  ; ---- AND THE MARK IS NOT TOUCHED ----
+  ;
+  ; A one shot is already self limiting: the request was deleted a moment ago, so whatever
+  ; happens now, the next start reads boot.cfg like any other. Marking it as well would
+  ; report every successful bare metal boot as a start that never arrived - which is what
+  ; the first version did, because a program that owns the whole machine has no filesystem
+  ; to clear a mark with and is not doing anything wrong by not having one.
+  SETD.0 BootName
+  RCAL tryImage
+
+  ; It did not start, and there is nothing to fall back to that was asked for. Whatever
+  ; boot.cfg says is the thing to try, so carry on into it.
+  SETD.0 OnceFailedText
+  RCAL say
+
+noOnce:
   SETD.0 ConfigPath
   SETD.2 StageAt
   LDD.1.2
@@ -541,6 +592,8 @@ NoSystemText:
 ; Where the configuration lives, and what to start when it does not say.
 ConfigPath:
 "/System/Boot/boot.cfg"
+OncePath:
+"/System/Boot/once.cfg"
 SystemName:
 "/System/Boot/cosmos.bin"
 KeySystem:
@@ -570,6 +623,11 @@ NoFallbackText:
 NothingText:
 "nothing to start
 "
+OnceText:
+"just this once: "
+OnceFailedText:
+"it did not start, so carrying on
+"
 
 BootName:
   #Reserve 0d128