Settle is a program, and a machine with no fallback still starts

The boot state opened a loop that could not be closed from inside: the
machine said "settle it to try again" and gave you no way to do so. Settle
closes it, in 349 bytes.

A PROGRAM RATHER THAN A SHELL WORD. The shell is for the things that cannot
be done without it, and this is not one - it reaches the system through SWI
like anything else, which means it can be replaced, left off a disk, or
called by whatever comes to call programs in turn. That last one is the
point: a shell word is not callable by anything.

Two services for it. osBootState answers in Q, and a machine with no disk
answers settled, because there is nothing there to be unsettled about.
osBootSettle puts it back. SETTLING IS THE ONLY WRITE A PROGRAM GETS -
marking a start as trying or fallen back is the loader's business, and a
service that let a program claim either would let it lie about something
the loader has no way to check.

And a hole the tests walked into, which was mine rather than theirs. With
no fallback configured, a failed start left the machine unable to start at
all: the mark said do not use the system, and there was nothing else to
use. That turns "the last start failed" into "no start is permitted", which
is worse than the problem the mark was added to solve. With nothing to fall
back to it now tries the configuration again and says so - a failure that
was passing recovers, and one that is not leaves the machine exactly where
it would have been without any of this, which is the most that can be
promised when there is only one thing to start.

docs.sh caught both new services having no row in the services table before
anything else did.

Programs/CosmOS/Apps/Settle.asm

@@ -0,0 +1,90 @@
+; Settle.asm
+; Says how the last start went, and tells the machine to stop falling back.
+;
+; A program rather than a shell command, because the shell is for the things you cannot do
+; without it and this is not one of them. It reaches the system through SWI like anything
+; else, which means it can be replaced, left off a disk, or called by whatever comes to
+; call programs in sequence - and none of that is true of a word built into the shell.
+;
+; ---- What settling means ----
+;
+; The loader marks the disk before handing over and the system clears the mark on reaching
+; its prompt, so a mark still set is a start that never arrived. After that the loader uses
+; the fallback and KEEPS USING IT, because a system known not to start should not be tried
+; every other boot for ever.
+;
+; Settling is how it is told that has changed. It does not fix anything and it does not
+; check anything: it says "the situation is different now, try again". Which is why it is a
+; deliberate act by somebody who has just changed something, rather than anything automatic.
+;
+; Written by Anachronaut
+
+#Include services.asm
+
+#Program
+
+  #Base 0x4000
+
+start:
+  SWI osBootState
+  MVQA
+  SETD.0 State
+  STA.0
+
+  BRA alreadySettled
+
+  INIB 0d2
+  XOR
+  BRQ fellBack
+
+  ; Trying. Nothing has gone wrong yet - this is what the disk looks like while a start is
+  ; still in progress, which from in here means the system that is running has not reached
+  ; its prompt, which it plainly has. So the mark is stale.
+  SETD.0 WasTrying
+  SWI osPrintString
+  BRI doSettle
+
+fellBack:
+  SETD.0 WasFallen
+  SWI osPrintString
+
+doSettle:
+  SWI osBootSettle
+  MVQA
+  BNA settleFailed
+  SETD.0 Settled
+  SWI osPrintString
+  SWI osExit
+
+settleFailed:
+  SETD.0 NoDisk
+  SWI osPrintString
+  SWI osExit
+
+alreadySettled:
+  SETD.0 Already
+  SWI osPrintString
+  SWI osExit
+
+#Data
+
+  #Base 0x2000
+
+WasTrying:
+"the disk says a start is still in progress
+"
+WasFallen:
+"the disk says the last start did not arrive, so this is the fallback
+"
+Settled:
+"settled: the next start will use the configuration again
+"
+Already:
+"already settled: the next start will use the configuration
+"
+NoDisk:
+"nothing to settle: no disk answered
+"
+
+State:
+  0x00