CosmOS lets every voice go when a program stops

A gate is a register on the sound device and only a program can drop one.
A program that has stopped cannot: it is gone. So a note left held
sustained until something else said otherwise, and nothing else did -
one program could leave the machine sounding for as long as it ran, with
nothing the person at it could do.

The shell already puts back the Stack, the vectors, the drive, the
working directory and the screen. This is the same list and the same
argument, and the fault path calls it too, for the stronger version of
the argument: a program that CRASHED is exactly the one that cannot tidy
up after itself, and a machine that will not stop humming is a poor place
to read an error message.

It does not make the device silent at once and does not pretend to.
Dropping a gate RELEASES a note rather than stopping it, so the patch's
release still runs. A bounded tail rather than an endless one is the part
the system can be responsible for without knowing what instrument the
program had built.

Hum exits while holding a note; Pause makes no sound and takes a couple
of million cycles, because the machine stops the moment the shell runs
out of input and a note quietened at that instant leaves no samples
behind to say whether it was. They are on a disk of their own so that a
fixture does not move the ten recordings that quote cosmos.img's listing.

THE CHECK CAUGHT ITSELF PASSING WRONGLY FIRST. Pause was missing from the
disk, the machine halted immediately, and the window that should have
held the tail was past the end of a render a twentieth of a second long -
an empty window's peak is nought, which is indistinguishable from silence.
So the sample count is asserted before anything is read from it. Verified
with break.sh: without the call the note is still ringing at 9869.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E2JrLzFvuFX9fgi1LDRjrW

Programs/CosmOS/README.md

@@ -767,7 +767,7 @@ the program was stopped
 most faults meets the very instruction that failed and fails again, so carrying on is not on
 offer - but the machine is almost never what is broken. Everything the shell puts back when a
 program exits, which is the Stack, any vectors it installed, the drive, the working directory,
-the console and the screen, is exactly what wants putting back after one dies. So you are
+the console, the screen and the sound, is exactly what wants putting back after one dies. So you are
 returned to the prompt, and the program is recorded as having stopped rather than finished.
 
 A fault *below* where programs load is the system's own code, and there is nothing to go back
@@ -1261,7 +1261,7 @@ Those numbers are written down once, in `Programs/CosmOS/Source/services.asm`, w
 | --- | --- |
 | osPrintString | DP0 names a string ending in a zero byte. Prints it. |
 | osReadLine | DP0 names somewhere to put a line, B says how much room there is. Reads one from the console, with the shell's own editing - arrows, Home, End, Delete - but not its history. Q comes back holding how long it was. The console is left in whatever mode it was found in. |
-| osExit | Gives the machine back. Does not return. |
+| osExit | Gives the machine back. Does not return. The system puts back what the program was borrowing - the Stack, its vectors, the drive, the working directory, the screen - and lets every voice of the sound device go, because a gate is a register only a program can drop and a program that has stopped cannot drop one. |
 | osArgument | DP0 names somewhere to put whatever followed the run command, B says how much room there is. |
 | osFileRead | DP0 names a file, DP1 says where to put it. Q is zero if it read, and DP3 comes back holding how many bytes there were. It writes WHOLE BLOCKS: a sixteen byte file still puts 256 bytes where it is told, so the room given has to be the length rounded up to the next 256. |
 | osFileSave | DP0 names a file, DP1 is the bytes, A and B together are how many. Q is zero if it saved, whether or not it was there before. |

Programs/CosmOS/Source/cosmos.asm

@@ -1496,6 +1496,10 @@ faultSay:
   ; read, and a program that faulted may have left the screen with nowhere to put a letter.
   CALL faultScreen
 
+  ; And quiet, before them. A program that faulted mid-note left one sounding and is no longer
+  ; in a position to stop it.
+  CALL soundQuiet
+
   CALL printString
   SETD.1 FaultNumbered
   LDA.1
@@ -5154,6 +5158,40 @@ screenGiveDone:
 screenGiveNone:
   RET
 
+; ---- Every voice let go of ----
+;
+; The same argument as the screen, and for a stronger reason. A program that took the sound
+; device and stopped has nothing left that could end a note it was holding: a gate is a
+; register on the device and only a program can drop one. A held note sustains until somebody
+; says otherwise, so what this bounds is the difference between a machine that rings for a
+; moment and one that rings until it is switched off.
+;
+; IT DOES NOT MAKE THE DEVICE SILENT AT ONCE, and does not pretend to. Dropping a gate
+; RELEASES a note rather than stopping it, so whatever release the patch was given still runs.
+; A bounded tail rather than an endless one is the part the system can be responsible for
+; without knowing what instrument the program had built.
+;
+; A PROGRAM THAT FAULTS CANNOT TIDY UP AFTER ITSELF, which is why this is called from the
+; fault path too. A machine that will not stop humming is a poor place to read an error
+; message, and the program that would have quietened it is exactly the one that just died.
+;
+; Safe from a fault handler: four port writes, no service, no disk, and nothing that can
+; refuse.
+soundQuiet:
+  RSTA
+soundQuietOne:
+  OUTA 0x41                 ; This channel. Every sound port writes to whichever was last.
+  PSHA
+  RSTA
+  OUTA 0x45                 ; Let go of whatever it was holding.
+  POPA
+  INCA
+  INIB 0d4
+  CCF
+  SUB
+  BNQ soundQuietOne
+  RET
+
 ; The registers a console cannot work without, put back. Not the picture - that is
 ; screenGive's, and only happens for a program that asked.
 screenSane:
@@ -6266,6 +6304,10 @@ handleExit:
   ; What was on the screen before this program had it, if it asked for that.
   CALL screenGive
 
+  ; And every voice let go of, for the same reason the screen is: a program that has stopped
+  ; cannot drop a gate it left up.
+  CALL soundQuiet
+
   ; The drive the person was on, whatever the program did with it.
   PSHA
   SETD.1 RunDrive