feat(startos): persist a CPU energy/performance preference and apply it at boot

[MattDHill]

Why

intel_pstate and amd-pstate in active/EPP mode expose only the performance and powersave governors:

$ cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_available_governors
performance powersave

So GOVERNOR_HEIRARCHY (ondemand, schedutil, conservative) never matches and init.rs sets nothing — silently, the log line being inside the if let Some. That is harmless in itself: powersave is the right governor on those drivers and the machine is already on it. What matters is that nothing ever touched EPP, the hint that actually decides how hard HWP chases a burst, so every such server runs on whatever its firmware left in the request register — and StartOS had no way to change it.

On a Server Pro (Librem Mini v2, i7-10710U) PureBoot leaves performance on all 12 CPUs. A 3% aggregate poll took the package from 55 °C to 90 °C in under a second and back; 34 days of uptime had logged 24,881,470 package-throttle events, and the chassis fan chased every excursion, cycling every few seconds indefinitely.

Measured

Same box, steady-state workload (mempool's 8-second poll plus bitcoind/electrs/Fulcrum), 50-second windows:

EPP	idle / median	worst seen	clock ceiling
performance (PureBoot default)	55–58 °C	92 °C	4.09 GHz
balance_performance (stock Linux default)	47–48 °C	82 °C steady state, 90 °C under load	3.91 GHz
balance_power	47–48 °C	58 °C	2.0 GHz

balance_performance fixes the median but still lets the clock reach 3.9 GHz, so a real burst still spikes the die into the 80s — and the fan tracks spikes, not medians. balance_power is the only value measured to stop the cycling on this hardware.

The change

• serverInfo.epp persists a preference (#[serde(default)], so existing databases deserialize). Init applies it at boot, warning if the driver does not offer that value.
• start-cli server epp [<value>] reads the live sysfs value and sets the persisted one, mirroring governor. It reports the live value because the persisted one is null on every box that has not set it.
• When no preference is saved, StartOS defaults Librem Mini v2 systems to balance_power if the driver offers it. Other systems retain their current EPP. A saved preference always takes precedence.
• Machines whose driver exposes no EPP attribute — aarch64, VMs, intel_pstate passive, acpi-cpufreq, pre-HWP Intel — read an empty set and are left alone.

The governor is deliberately untouched: the hierarchy falling through costs nothing on these drivers, and appending powersave would pin acpi-cpufreq boxes to minimum frequency.

Review changes

Per dr-bonez: every fallible cpupower call at init — governor and EPP — goes through log_err() rather than ?, so a sysfs failure logs and moves on instead of dropping the server into Diagnostic Mode. get_preferred_governor became preferred_governor, taking the available set the caller already read.

The CPU governor and EPP commands now live directly under start-cli server; server experimental retains only the ZRAM command.

Drive-by

display_serializable(format, params) at system/mod.rs and ssh.rs serialized the command's arguments instead of its result — server governor --format json and ssh list --format json both returned the wrong object. Verified against action.rs.

[MattDHill]

Design change, squashed to one commit (2e8491ddd).

The automatic boot default is gone: this now only applies an EPP the user has persisted via start-cli server experimental epp, and changes nothing otherwise. Measuring balance_performance showed it still permits 82–90 °C spikes on the Server Pro, so the only value that fixes the fan is balance_power — which is measured on one chip and would have moved every Intel and amd-pstate box, Server Ones included. The right default is a per-device firmware decision, so the Server Pro's gets fixed in PureBoot rather than here.

@dr-bonez your log_err() request is still in, on both the governor and EPP blocks. The Generated Artifacts drift (one man page, trailing whitespace) is committed from CI's own artifact.

[helix-nine]

Updated the boot default as requested in 7692f317d:

• a saved EPP still takes precedence;
• None plus the exact DMI product librem_mini_v2 selects balance_power when available;
• other or unknown products remain unchanged, and DMI/read/write failures only log;
• the model default is applied at boot without persisting it as a user preference.

I also added focused selector tests, updated the changelog and CLI reference, and corrected the PR description. This supersedes my earlier comment saying the automatic default was gone.

[helix-nine]

Moved both CPU power controls out of the experimental namespace: the commands are now start-cli server governor and start-cli server epp, while server experimental retains only ZRAM. I regenerated the man pages, updated the CLI reference and both affected changelogs, and rebased onto current master.

Verified with the full start-core test suite (784 unit tests and 52 doctests), a start-cli build plus command-tree help assertions, Rust formatting, Prettier, and the StartOS docs build.

[helix-nine]

Thanks — the approval is on the current head. CI is still running; no failures are reported so far.

[helix-nine]

Rebased onto master at 1c6f8012a to resolve the conflicts from #3865. The overlap resolution keeps both the curated-registry additions and this PR’s EPP/CLI changes; an independent range comparison found no lost or altered payload.

Post-rebase verification: cargo check -p start-core, the three EPP selector tests, man-page generation, a start-cli build, and command-tree help assertions. This force-push necessarily dismissed the approval, so the PR needs a fresh approving review.