[repeat98]

What was wrong: after a power cycle, the Octatrack beta base sometimes left SC Ringmod out of the restored module set. The unit showed "SOME MODULES FAILED" and the restore record named Ring SC refused BUSY (beta finding 69). In the 28 October diagnostics this hit three testers in 24 hours, on bases 903f8ed6 and 2ba936b9. In one case a sync later in the same boot installed the same package fine, so the refusal is transient.

The exact cause is still unknown. loader.c reports every switch it could not make as RUNTIME_BUSY, whichever check refused it, and the key-bus reader's own BUSY paths in controller_board.c look unreachable that early. A RAM boot did not reproduce it on 24 October; testers power-cycle.

What changes: modset.c's restore now tries a package the loader refuses BUSY again every half second, for up to ten seconds, before leaving it out. The same applies when the loader can't be entered (the sequencer playing). restored stays 0 until the restore is done, so ep0.c holds host requests meanwhile, at most ten seconds longer than before. Every other refusal is still left out at once. The card keeps the whole set, so the next start tries it again, as before. The set's identity is sorted by module id, so a module installed on a later pass doesn't change it.

• Beta base regenerated: 88c68eed (was 6541d7e9). Browser .bin equals build_core.py's, stock-free, flash-safety checks passed. The five base-bound packages rebind byte-identical (octatrack:module-packages --base-only); only their requiredBase moves.
• Changelog: changelog/2026-10-28-restore-retries-busy.md. Finding 69's row says the fix (the log doesn't grow).
• Docs: OCTATRACK_DRIVING.md now says to start the serve loop from a checkout that stays. The shared loop had been started from a merged PR's removed worktree: after a boot hand-off it can't restart (process.cwd failed) and fails every second.

How I checked it

• Host: test_modset.c covers three cases. A package refused BUSY every time is tried 20 times, the host is held meanwhile and it is left out after ten seconds. BUSY twice, then it installs: the whole set, nothing sealed or written. Any other refusal is left out at once. The old modset.c fails 4 of these checks. test_sets.c's refused-at-boot case uses a lasting refusal. test_recipe.py (39), test_runtime_card_guard, test_volatile_service, test_saved_set_wiring, test_runtime_journal and test_module_sets all pass.
• npm run pr:ready: Ready.
• Not tested on a unit. The shared USB link on the owner's computer was down: its loop runs from a removed worktree, and stopping it needs the owner's OK. Still to do: a RAM boot of 88c68eed with a kept set that includes Ring SC (normal restore, no regression), then a power-on with that set.

Conflicts with #1024, which also edits the end of restore() and test_modset.c, and with every base PR's generated base files. Merge them one at a time; the second one merges main and regenerates the base.

Related to finding 69 in docs/OCTATRACK_BETA_TEST_PLAN.md.

🤖 Generated with Claude Code