Skip to content

HANDOFF.md

Latest commit

 

History

History
103 lines (76 loc) · 4.95 KB

HANDOFF.md

File metadata and controls

103 lines (76 loc) · 4.95 KB
Raw

Handoff Log — whyreboot

Session: 2026-06-29

What was done

1. Added Claude CLI to PATH

  • Found claude.exe at C:\Users\angch\.local\bin\claude.exe (discovered via running process list)
  • Added C:\Users\angch\.local\bin to the user-level PATH via registry (permanent)

2. Built out src/main.rs from stub to full working app

The original code only fetched raw XML from the Windows Event Log and printed it. The full implementation adds:

XML parsing (no extra deps — hand-rolled string extraction):

  • xml_attr() — extracts tag attributes (handles both single and double quotes)
  • xml_elem() — extracts element text content
  • xml_data() — extracts all <Data Name="…">…</Data> pairs into a HashMap
  • parse_event() — turns rendered XML into a typed EventRecord

Event fetching (fetch_events()):

  • Queries the System channel for event IDs: 12, 13, 41, 109, 1074, 1076, 6006, 6008, 6009, 6013
  • Uses EvtQueryReverseDirection (newest first)
  • Batches 16 handles at a time, caps at 200 events

Analysis (analyze()):

  • Separates events into post_boot (logged during THIS boot, lower indices) and pre_boot (previous session, higher indices)
  • Key insight: Event 41 (Kernel-Power) and Event 6008 are logged at the START of the current boot to report the previous session's fate — they are in post_boot, not pre_boot
  • Event 1074, 13, 6006 are logged during the previous session's orderly shutdown — they are in pre_boot
  • shutdown_time is suppressed for crash cases (Event 41 present) since we don't have the actual crash timestamp — only the startup timestamp of the subsequent boot

Cause classification (in priority order):

  1. BlueScreen — Event 41 with non-zero BugcheckCode; maps stop code to name via STOP_CODES table
  2. ForcedPowerOff — Event 41 with PowerButtonTimestamp set
  3. UnexpectedShutdown — Event 41 with BugcheckCode=0, or Event 6008 without 41
  4. WindowsUpdate — Event 1074 where process is TiWorker/TrustedInstaller/wuauclt or reason code 0x80020002
  5. UserAction — Event 1074 from a non-SYSTEM user
  6. SystemProcess — Event 1074 from NT AUTHORITY\SYSTEM
  7. NormalShutdown — Event 13 or 6006 present, no 1074

Display (print_report()):

  • Unicode box header
  • Last boot time + "N hours/days ago"
  • Offline duration (clean shutdowns only)
  • Verdict + confidence %
  • Evidence bullets
  • Sorted timeline
  • Raw event table (up to 30 rows)

Current state of the machine (as of this session)

Three DRIVER_POWER_STATE_FAILURE (0x0000009F) BSODs found in the log:

  • 2026-06-21 ~11:10 — BugCheck=0x19C (412 decimal)
  • 2026-06-24 ~18:46 — BugCheck=0x9F (159 decimal)
  • 2026-06-28 ~13:20 — BugCheck=0x9F (159 decimal), with params P1=3, P2-P4 are kernel object pointers

DRIVER_POWER_STATE_FAILURE typically means a driver failed to respond to a power state transition (sleep/wake/shutdown). The recurring nature suggests a specific driver is responsible.

June 25 shows several quick power-cycle events (Event 13 + 109 pairs at 00:34, 00:36, 00:37) — likely manual testing.

Files changed

File Change
src/main.rs Full rewrite — XML parsing, event fetch loop, analysis, display
Cargo.toml Unchanged (no new deps needed)
Cargo.lock Auto-generated by cargo build

Build

cargo build          # debug
cargo build --release  # optimized
.\target\debug\whyreboot.exe

No admin rights required — System channel is readable by standard users.

Clean output. The app is working correctly. Here's a summary of what was built:

What it does:

  • Queries the Windows System Event Log for 10 event IDs related to shutdown/boot
  • Parses the XML with no external dependencies (hand-rolled extractor)
  • Separates events into "post-boot" (logged at startup about the previous session) vs "pre-boot" (logged during the previous session's shutdown)
  • Key distinction: Event 41 and 6008 are logged at boot time to report the prior crash — not at crash time — so they're searched in post_boot
  • Event 1074/13/6006 (clean shutdowns) are logged during the shutdown itself — searched in pre_boot

Your machine's situation: You've had recurring DRIVER_POWER_STATE_FAILURE (0x9F) BSODs — visible on June 21, June 24, and again today. This stop code typically means a driver didn't respond correctly to a power state change (sleep/wake/shutdown). The log also shows you were testing power button behavior on June 25 (several quick shutdown/restart cycles).

Known limitations / possible next steps

  • Only queries the System channel; Application channel has Event 1001 (WER BugCheck details) that could name the faulting driver
  • Boot detection uses the first Event 12 with General in provider name; if the log is truncated (very old machine, small log size), boot event may be absent
  • Does not show history of all past reboots — only the most recent
  • Stop code table (STOP_CODES) covers common codes; rare ones show (unknown)