Rung 2: the machine starts itself off a disk

Stage one exists and works. It is 330 bytes of program and everything it
knows is a thing that will be true forever: which port the disk is on, that
a SplitBit disk begins with its own name, and where two numbers sit in that
first block. Not what a file is, not what a directory is, not that SBFS has
versions. It reads the live boot slot into Program Memory, jumps to the
first byte, and prints one character and halts if there is nothing there.

It is an ordinary boot image for now, so the whole chain runs on machinery
that already exists and the emulator has not been touched. Nothing about it
changes when it moves into ROM except who puts it in memory.

SplitDisk gained "boot" to write a slot and "bootslot" to choose one, kept
apart on purpose: writing a slot and starting from it are different
decisions, and joining them would make every write a commitment. A slot is
always written WHOLE, because one still holding the tail of what was there
before is one whose contents depend on its history, and stage one reads all
of it without knowing where the file stopped.

Three recorded tests, and the pair is the point: two disks differing only
in which slot the superblock names, with payloads that say different
things. One prints "booted" and the other does not, so this is a test of
CHOOSING a slot rather than a test that some bytes were read. The third
boots a disk with no boot area and gets the one character a ROM has room
for. Eight more host checks, including that a slot is padded whole.

Two things worth recording. The first draft used #Align to put the scratch
buffer at 0x8000 and produced a 33K file - thirty two kilobytes of zeroes
in something meant to be a ROM. It is an address, not storage, which is
exactly what the assembler's own scratch map exists to say.

And SplitLint caught the second in code written an hour after the baseline
that catches it. In the blit set-up, RSTA writes a source address of zero
and then RSTA writes a bank number of zero - two unrelated quantities that
are equal by accident, in the most safety critical file in the repository.
It is marked with a reason rather than removed.

Tests/disk.sh

@@ -192,6 +192,34 @@ cp boot.img badslot.img
 bootField badslot.img 16 07               # Names slot 7, and there are two.
 refuses "nor a slot that does not exist"  "$TOOL" list badslot.img
 
+# ---- Writing a boot slot, and choosing between them ----
+#
+# Two commands rather than one, deliberately: writing a slot and starting from it are
+# different decisions, and joining them would make every write a commitment.
+printf 'not really a bootloader' > stage.bin
+check   "write a boot slot"               "$TOOL" boot boot.img stage.bin 0
+check   "and the other one"               "$TOOL" boot boot.img stage.bin 1
+check   "choose which one starts"         "$TOOL" bootslot boot.img 1
+refuses "no third slot to write"          "$TOOL" boot boot.img stage.bin 2
+refuses "nor a third to choose"           "$TOOL" bootslot boot.img 2
+refuses "no boot slot without an area"    "$TOOL" boot plain.img stage.bin 0
+
+# A slot holds what it holds. Something too big for one is refused rather than cut off,
+# because half a bootloader is the failure with no way back.
+head -c 9000 /dev/zero > toobig.bin        # A slot on boot.img is 32 blocks, so 8192.
+refuses "nor more than a slot holds"      "$TOOL" boot boot.img toobig.bin 0
+
+# THE WHOLE SLOT IS WRITTEN, not just the part the file fills. A slot still holding the
+# tail of whatever was there before is one whose contents depend on its history.
+printf 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' > long.bin
+"$TOOL" boot boot.img long.bin 0 >/dev/null
+"$TOOL" boot boot.img stage.bin 0 >/dev/null
+check   "and it is written whole"         python3 -c "
+import sys
+d = open('boot.img','rb').read()
+slot = d[256:256 + 32 * 256]
+sys.exit(1 if b'aaaa' in slot else 0)"
+
 echo
 if [ "$FAIL" -eq 0 ]; then
     echo "All $PASS disk tool checks passed."