2028

The kernel declares the probe as a device. Its register layout, address, interrupt and handler are fixed when the kernel is compiled, so no driver finds hardware by guessing. The handler records the byte and returns; what the reading means is decided above the kernel.

struct ProbePort with { endian = little, layout = declared } {
    u32 data,
    u32 status,
}

static atomic<u8> lastByte = 0

device ProbePort probe0 with { space = mmio, address = 0x09000000, irq = 33, handler = onProbe }

interrupt void onProbe(ref<Frame> f) {
    u8 b = u8(probe0.data & 0xFF)
    cut.atomic.store(lastByte, b, order = release)
}

The probe service declares the most it may ever hold: one file scope to read, one shared segment, one device and one channel. Each arrives at start as a capability in the program's table. A launcher whose own authority does not cover the request gets fault.denied.

program probed with {
    memory = 16MiB,
    grants = [files(calibration, read), segments([batches]), devices([probe0]), channels([uplink])],
    launch = [gatewayHost],
}

The application on the gateway is ordinary Trident. It handles each reading as an event and writes it through its readings anchor. On BenthOS that anchor is a MerFS scope; on a hosted server the same source writes to a host folder.

on event("probeReading", const chest reading) {
    u32 station = reading.station
    u64 sequence = reading.sequence
    f64 chlorine = reading.chlorine
    text name = "station-" + text(station) + "/" + text(sequence) + ".txt"
    u64 written = t.io.writeText("readings", name, text(chlorine))
    if (chlorine < 0.2) {
        t.log.warn("low chlorine at station " + text(station))
    }
}