Changelog

All notable changes to SigilOS. Format follows Keep a Changelog; versions are SemVer (pre-1.0 = 0.x). No 1.0 until SigilOS is a fully-functional OS booting the full platform matrix (see README).

Release policy (Director #106; version-ledger ruling 2026-07-10): git tags are authoritative. The 0.x.0 → 1.0 train is the sequence of tagged, flashable sigilos.img releases. The first git-tagged release is v0.6.0 (2026-07-10), the Pi 1.0 line-scan close-out. Milestones that predate it were aspirational, never tagged; they are recorded below under Pre-tag development milestones, dated but unnumbered — no version number is reused. Bug-fixes to a released tag take a DDMMYYSS subversion (Sigil-FS owns the tag).

The milestone spine lives in the roadmap — this CHANGELOG records what shipped in each; the two stay in lock-step.

[Unreleased] — toward 0.7.0

Post-0.6.0 work in flight: the fully-operational desktop — dock → app-open, a real terminal, real Files — plus multi-user, signed-module loading, and the 1.1 POSIX gate. Nothing tagged since 0.6.0 yet.

Landed toward 0.7.0

• 🖥️⬇️ SRDX clients — the multi-OS remote-desktop downloads go live: the SRDX client ships for macOS (arm64), Linux (x86-64), and Windows (x86-64) — run it on your everyday machine to connect to a sigilOS desktop and forward your USB devices to it (any keyboard/mouse/HID on the client drives the OS). All three build + run; downloadable now at srdx.html#client as an honest 0.1.0 unsigned preview (checksum-verified against SHA256SUMS; Gatekeeper/SmartScreen caveats on the page — production code-signing is a follow-up). An all-Sigil client core: UDP 7723 host beacon → host:7722 → HMAC-PSK → SRDX SCENE/RAW decode + input forward.
• 🔌 Hotplug gate fully diagnosed across all three boards; 4B compile+deploy confirmed: @grio asked directly whether USB hotplug works on every board — honest answer: not yet, but the path is now fully mapped. Confirmed: the 4B's compile+deploy path is proven (golden builds clean + deploys to the 4B rig, boot-to-desktop, UART-repeatable) — the plumbing that gets any fix to metal fast. Diagnosed + drafted (not yet metal-confirmed): Drivers drove all three hotplug legs — 3B (dwc2 service functional, boot-binds the mouse; needs tick-wire + @grio live-plug), 4B (root cause = shared xHCI event-ring cross-drain between hotplug-detect and the HID poll; per-endpoint event-routing fix drafted), Pi5 (RP1 xHCI is standard xHCI → a scoped port of the same root-scan). Key insight: 4B + Pi5 share one fix pattern (per-EP/slot event routing so hotplug coexists with the HID poll); the 3B dwc2 path is independent + in place. Honest scope: hotplug is not confirmed on any board yet — boot-bind (3B) is closest and even that awaits @grio's physical wiggle-test; true post-boot plug/unplug is untested everywhere this session (post). Drivers / Fable + Director.
• 🪟 The 3B desktop opens app windows — the Lumen tour walks real app panes on metal: the "mostly-unpainted canvas" from the unified-image milestone is closed. A cycle-counter probe (Fable) ruled out timer/wiring/cycler-logic and found the real cause: on the 3B no app window ever actually opened — the tour cycled a list of panes the compositor wasn't rendering. The fix (Fable, cafb051080e7, all rails) wires lmd_open_settings + forces a first render at cycler-enable, so the scripted Lumen tour now opens the Settings window and walks its panes (System Info, Bluetooth), each painting on real 3B hardware — metal-verified, Video-reviewed, OS-confirmed (Bluetooth pane artifact). Honest scope: this is the render/compositor path proven (open → composite → present a titled app window), not interactive use — the tour is scripted (OS-timed, not @grio-clicked), window bodies are still sparsely painted (fuller pane rendering is a metal-tested follow-on), and USB HID input is unchanged: @grio's wiggle + keyboard port-move remain the last human steps (post). Milestone — Fable / Video / OS + Director.
• 💽 One unified image now boots all three Pi boards — and the USB HID software is complete on every board: the 3B, 4B, and Pi 5 boot the same single sigilos.img — no per-board fork — each bringing up its own USB + display path off one durable commit (4B full-boot-to-desktop UART-verified; 3B up with a new filesystem-forced-direct USB fix; Pi 5 netboots clean, its RP1 → xHCI USB chain complete + committed). This is @grio's "fully functional image for all three platforms" on the build-and-boot axis: one artifact, three SoCs (BCM2837 / 2711 / 2712). USB HID input is now written, committed, and protocol-verified on all three boards — the Pi 5 input path, the last 🔴 on the tracker, is now software-complete. Honest scope: this is boot + software-complete + fleet-verified — the desktop paint is still being finished (mockup-fidelity pass in flight), and the one step between here and real use is @grio driving it with his own hands (3B mouse wiggle, keyboard port-move, Pi 5 monitor glance). Not yet claimed as drivable end-to-end (post). Fleet effort — Drivers / Kernel / Fable / OS / cc0 + Director.
• 🖱️⌨️ USB mouse + keyboard drive the desktop on metal — the interactivity saga's hardest board closes: real USB HID input now moves the cursor and types on the Lumen desktop on the Pi 3B and Pi 4B, on real hardware — native USB, not the SRDX/UART keyboard bypass. The Pi 4B, the hardest board of the whole push, is fully verified working end-to-end, confirmed two independent ways (Fable's UART trace + RPi-SME's Cam-Link capture); the 3B lands its pointer through a from-scratch dwc2 split-transaction HID path (Drivers #106, metal-verified; mouse-bind #109). Honest scope: mouse + keyboard input is live on 3B + 4B; dock-click app-open and the Pi 5 input path are the last bits before the desktop is interactive end-to-end on the full board matrix. Fleet effort — Drivers / Kernel / Fable / RPi-SME / cc0 + Director.

[0.6.0] — 2026-07-10 · Pi 1.0 line-scan close-out (first git-tagged release, v0.6.0)

All three Raspberry Pi boards — 3B, 4B, and Pi 5 — run the EL2 cached-MMU scan-kill with the full boot chain alive to the Lumen desktop (SRDX → Ex Machina → login → desktop), metal- and camera-verified. Frozen refs: kernel b9fc96e, video 5526591, sigil 08ce483; golden images d27984a6 (3B/4B), fc57a660 (Pi 5). This first tagged release bundles the userland that landed on the way to it — listed below.

Landed in 0.6.0

• 🏆🖥️ THE 1.0 BOOT CHAIN IS ALIVE END-TO-END ON METAL — @grio eyes-confirmed on both the Pi 3B and Pi 4B (root d27984a6): hands-off, the board runs the whole sequence — SRDX splash (4s) → Ex Machina curtain (60 fps) → login card over a living wallpaper → the Lumen desktop — with no scan, no flicker, no crash, no lockup, and the Pi 5 renders the same chain on metal (El Gato-captured). This closes a whole-day hunt where three symptoms — a line-scan, then a black screen, then a login crash that reset at ~165 s — turned out to be one root cause. The EL2 “scan-kill” map had been correct for weeks but never ran (its base predated the EL2 twins → EL1 setters no-op at EL2); once it engaged, turning on a real cached MMU surfaced the rest — a write-combining buffer never drained (black, fixed with a dsb drain), CPU-spin-paced animation flying by at 38× (vanished splash + flicker, fixed with wall-clock pacing + dirty-row present), and a USB-HID poll faulting under the cached map (the 165 s reset, gated at source). The fix was never a spot-patch: it was making the map correct-by-construction — all RAM Normal-WB cacheable except the framebuffer (Device-GRE) and the carved DMA pages. Honest scope: this is the boot and the render, not a finished userland — the desktop comes up bare, and the functional-desktop push (dock→app-open, real terminal, real Files) is now underway. Fleet effort — Kernel/Video/Fable/RPi-SME/cc0 + Director (post).
• 🎮🟢 Forge: a CHIP-8 core runs native — a real ROM, rendered as a binary: the chip8.sg emulator core executes a hand-authored 20-byte ROM (the classic LD I, addr + DRW Vx,Vy,8 pair drawing an 'F' sprite) and renders its 64×32 framebuffer — as a native cc0-compiled binary, standing on the new mem_map keystone (a fixed anonymous RW mapping cc0 landed this week, letting the emulator carve out and address its own guest memory). No VM, no interpreter, no Python, no emulator layer: bytecode in, machine state updated, pixels out, nothing interpreted along the way. Honest scope — it's a headless render proof today (frame → image); an on-screen window, live keypad input, and audio are the next steps (post).
• 🚀 Forge: the v0.1 native desktop preview ships for all three platforms: Forge's native downloads are now published for macOS (Apple Silicon), Linux x86-64, and Windows x86-64 — the Windows .exe (PE32+, cc0 win backend) joins the refreshed Mac/Linux binaries, each a single cc0-compiled artifact with a published, verifiable SHA-256. Written once in Sigil, compiled per platform, no runtime underneath.
• 🍎 cc0: native arm64 macOS compiler — the Python interpreter is fully off the critical path (896a833): cc0 now self-hosts on Apple Silicon natively — a real Mach-O arm64 binary, fixpoint-verified (it recompiles itself to a bit-identical compiler) — so the Mac dev host builds metal images with the native backend directly, no Docker/Linux-ELF detour and no Python interpreter anywhere. This is what made the Lumen landing reproducible: the auto-login miscompile was a defect in the interpreter's codegen, and going native cured it; until tonight the native path only ran on the Proxmox Linux runners (Mac-native cc0 was segfaulting on the big Lumen closure — root-caused to heap exhaustion). With the macho target landed, that Proxmox-only build mandate lifts and every host compiles the same way. Closes the last leg of @grio's "native compiler, not Python" directive (cc0 896a833).
• 🖥️✨ THE LUMEN DESKTOP IS UP ON METAL — native auto-login one-shot (DBLD=164, 36fea04f): a Raspberry Pi 4B cold-boots, auto-logs in, and the Lumen desktop renders and holds on real hardware — gradient wallpaper + status bar + dock, composited and DMA-presented, AUTO → TD3 → LMDN render loop, no fault. Built natively with zero Python on the Proxmox cc0 runners. The final wall was the toolchain itself: the auto-login path hung deterministically at PAL=1 inside id_pw_digest on every Python-interpreter-emitted build (155/156/157), while the native build cleared it — a Python codegen miscompile, fixed by @grio's own directive (native compiler, not Python; first AUTO on metal at DBLD=158 7f530647). Past auto-login, a cluster of window-chrome hangs (lma_draw_chrome/lma_draw_dot) traced to one AArch64 codegen hazard — a decrement-past-zero loop the backend mis-emitted (Video 11b3a27, fleet-swept) — localized by on-screen trace markers; the welcome interstitial was gated off to prove the bare desktop paints. Clean traces-stripped final: DBLD=165 b3f784aa. UART-confirmed on @grio's Pi 4B; the post-login Sigil ASCII + quote-of-the-day show and SRDX remote-access are staged to switch on next (post).
• 🎉 THE PI4B KEYBOARD LIVES ON METAL — ~100 builds to a keystroke: @grio pressed a letter on a Raspberry Pi 4B running sigilOS on bare metal and the character appeared on the login screen — the longest, hardest mile of 0.7.0, earned over ~100 metal build-flash-cold-cycle iterations (DBLD→100). No C, no vendor blob, no Linux USB stack: the entire VL805 + hub + HID path is Sigil. Each fix exposed the next wall — off-bus VL805 (NOTIFY-last reinit), AddressDevice AD24 split-txn (drop HS→FS clamp + fix EP0 MPS → AD01), garbled bytes (pre-doorbell dsb() + FIFO pacing), it's-a-hub (DVCL=0x09, keyboard on port 4 FS via the hub's TT → from-scratch hub enum + TT think-time), EP0 STALL (RESET_ENDPOINT + Set-TR-Dequeue recovery + two-stage max-read), wrong interface (bind bInterfaceProtocol==1 int-IN), babble→short-packet (size buffer to MPS, accept cc=13). Then RPT=0800→'e': real scancodes, real letters. Driven by the on-screen-diagnostics rule (UART was silent; state painted to the framebuffer, the keyboard's lock-LED the ground truth). Fleet effort — Drivers/Kernel/Code/cc0/Video/OS + Director (post).
• Video: GPU-first rendering becomes the standard: gpu_accel_render.sg (GARENDER-PASS 9/9) gives every draw path a hal_accel()-gated lane — GPU via gpu_submit(CAP_ACCEL), software floor via fill_span/copy_span/composite_span (cpuaccel SIMD); gpu_login.sg (GPULOGIN-PASS 8/8) makes the GPU-drawn login canonical for every image. @grio standing rule: everything renders GPU-first, software floor underneath (post).
• Code/Apps: the data & security tier — capability-native: SigQL reaches PostgreSQL/MSSQL/Oracle parity in ~119 KB (4f69aff, parser 83464e0 37/37, client suite 9fc8c90 97/97); Sigil Vault matches HashiCorp Vault in ~138 KB (e4f4bda); Warden security monitor enforces on the kernel cap-audit ring (428e7ce 22/22) (post).
• Video: load_page — the 0.7.0 browser capstone: one call takes a URL all the way to a painted page — net IPC ring → tokenize → DOM → style → layout → render → present — fetched over a capability-gated lane, proven on x86 metal (LPCAP-PASS, 14f5053) (post).
• Apps: 200 modules — the pillar infrastructure complete (T159–T166): ipc_channel, spawn_queue, event_bus, cap_quota, health_check, cap_delegate, resource_pool, app_lifecycle — the layer that enforces the four pillars per-app (mem budgets, cap quotas, fault isolation), each *-PASS 10/10 (6f48a77) (post).
• OS/Video: the Lumen desktop hardens: runtime th() theming (Lumen-dark live across wmlive/browser/files, 3709de1), WIN_APP/WIN_TOOL window chrome + traffic-light buttons, the lumen_input.sg hit-test input dispatcher (LMINPUT-PASS), and multi-monitor (post).
• FS: VFS grows POSIX muscles (builds 12–15): fs_mmap (zero-copy over the content store), fs_event (32-event async queue), fs_poll (poll/select multiplexing), fs_dup (FD table dup/dup2) — each fixed-size + capability-gated, ABCDEFGH green 33→34→51 (0c6803a→13be4eb) (post).
• Retropie: the Relic standard library — ~980 game primitives: a continuous run of single-purpose relic_* modules (inventory, FSM, camera, BFS pathfinder, particles, tweens, AABB tree, …) past the 950-module milestone — fixed-point, fixed-size, all-Sigil, zero bad builds (post).
• Kernel: x86 keyboard VER=18→19 — the LED-power reframe: VER=18 (85abc53) adds a big glanceable top-left banner — GREEN PORT PWR Y when our xHCI reached RUN + PORTSC.PP, RED PORT PWR N otherwise — so @grio can read the port-power state at a glance (the keyboard's lock-LED is the ground-truth tell: it flashes the instant VBUS applies, before enum). The diagnostic split it confirmed: on x86 the keyboard powers on (hardware VBUS at POST → x86 is now an enumeration problem, layers C/D/E), while on Pi the keyboard stays dark (VBUS/VL805 not driving → a power problem). VER=19 (aa7bb7e) removed a genuinely-dead _v9_stash fn (the live xHCI/enum path is inline in m3login_kbd, xhci_op@405 / hk_op@440, no early return — a "VER=10 STOP return 0" sighting was a stale-checkout false alarm, not the live code). No metal behavior change vs VER=18 (Kernel 85abc53 + aa7bb7e).
• Video: Doom Pile cmd-tab locator + live resize + snap + theme: wm_doompile combined fold-corner + show-through outline (471e7a8, WDPCMB-PASS) + wm_taskbar_render + vid_cursor_hw · wm_doompile pile-locator (319cf4e, cmd-tab slot switcher with a spinning gold glow ring) · wm_snap edge/corner snap + vid_theme NeXT/LCARS (9e590d3) · wm_resize_live 8-handle live edge/corner resize + vid_anim_ease integer easing (ff6e312). All screendumped both arches (Video 471e7a8→ff6e312).
• Apps: Doom Pile button + tab groups + universal search (T155): lumen_dock_doompile_btn.sg (hover → charge → fire → restore, wired to Video's wm_doompile) + browser_tabs2.sg (pinned tabs + groups + overflow + recently-closed) + lumen_search.sg (apps + files + settings + web in one overlay) (944848e). 165 modules (Apps 944848e).
• Drivers: USB hub multi-TT + consumer/media keys: usb_hub multi-TT (6d12b23, TT-type/think-time/mtt accessors, SET_INTERFACE(alt=1), uhub_enable_multi_tt) + hid_consumer media keys. Plus 21b VL805 serial instrumentation — xhci_trace_cell per enum sub-stage (VKB/PCRC/…) over PL011 (3897821/4075135) to diagnose the silent Pi keyboard enum (Drivers 6d12b23).
• FS: batches 21–26 — Relic lend, composite index, journal replay, savepoints: fs_relic_lend (Shamir-split lend per the Relic spec) + sigdb_trigger2 + fs_snapshot_diff (USB-quarantine re-insert diff foundation) (0ed68ec) · sigdb_index2 (composite 2-col key, b74a5a0) · fs_journal_replay (debbe08) · sigdb_savepoint (nested txn, 073f4de). All 26/26 PASS (FS 0ed68ec→073f4de).
• Retropie: WASM-4 interpreter increment 2: wasm_interp (c59abc6) — br_table + call_indirect + element-section decode; section 9 → w4_etab (256 func-idx slots), one-pass w4_br_table branch-table resolution (Retropie c59abc6).
• 🎉 Pi 4B UART WORKS ON METAL (BUILD 20, 000755d6): the Pi-4B kernel finally talks serial on @grio's hardware — KKKK PILOGINB20 ok=1 over FTDI @ 115200. Root cause (Director, by reading the on-screen PL011 register grid off @grio's photo): the kernel only read GPFSEL1, never set it — it trusted the firmware's GPIO pin-mux instead of selecting ALT0 for the PL011 TX/RX pins itself. The cached-MMIO fix (D-cache-off + MMU-on) was necessary but not sufficient; the UART pins also had to be muxed. BUILD 20 dropped pl011_init and inherits the firmware's working PL011 setup. This closes the Pi serial-on-metal gate — Pi now renders and talks (Kernel/Code 000755d6).
• 🐍→🦅 cc0: native all-Sigil metal build harness — Python/keystone retired (059a62e): the metal build path is now pure native cc0 — tools/build_native_cc0.sh (seed → native cc0 binary, once) + tools/metal_build.sh (drives cc0 directly: srcs → target → data-manifest → raw bootable image). Zero Python, zero keystone, no interpreter in the emit path — the native cc0 AArch64/x86 backend emits the bootable Pi/x86 login images itself. Closes grioghar's build-tools-in-Sigil directive violation (the old build.py + keystone-engine arm_emit) and kills the 15-minute build bottleneck that was throttling every metal iteration. CI gate stage E now has native cc0 emit a metal ARM image with its own backend and asserts raw-Pi-kernel (not ELF) output (cc0 6cc6b70→059a62e→6f283d5).
• Kernel: x86 keyboard VER=16→17 — cached-MMIO root-cause (the Pi pattern, on x86): VER=16 (a28aca8) moved the full xHCI diagnostic readout (SA ADC ADS CC HCH CNR hr kr + per-port pp/ccs) to a clear left band beside the login card (it was hidden behind it) + comprehensive one-shot init. VER=17 (ffeb86b) — the diagnosis: "same result across VER 14/15/16" = the xHCI controller never RUNs = cached MMIO, the exact bug class as the Pi UART. cc0 exposes only CR0/CR4 (no CR3 walk / wrmsr / MTRR / PAT), so VER=17 forces the xHCI BAR uncached the one available way — CR0.CD (cache-disable) + clear NW before controller init. The x86 keyboard unblock, flashed to @grio's metal (Kernel a28aca8 + ffeb86b).
• Pi keyboard wired into the rendering login (BUILD 21a, f0942140): xhci.sg + usbhidkbd.sg + bcm2711_xhci.sg (VL805) folded into pi_login_pi4b — a serial-independent Pi sign-in path (the screen already renders; this lets @grio type on the Pi without waiting on serial). Closure compiles, zero symbol gaps. HID-ABI confirmed by Drivers (hk_op after xhci_op(OP_INIT)) (Code/Drivers f0942140).
• Drivers: Bluetooth HCI + USB audio + USB hub reset: bt_hci (ea0bbe5) + usb_audio UAC1.0 (ebe9fef) drivers with framing tests (5bff471: BTHCI ok=1, UAUDIO vol=75 ok=1); usb_hub real-HW port-reset path (f899a61, uhub_reset_port SET_FEATURE(PORT_RESET) → poll → CLR C_PORT_RESET) (Drivers 5bff471 + f899a61).
• FS: batches 16–20 — thumbnails, search, autotag, FTS2, Relic store/seal/verify, views, integrity: fs_thumbnail_cache + sigdb_index_rebuild + fs_watch_recursive (e39eff1) · fs_tag_autotag + sigdb_fts2 (phrase+prefix) + fs_quota_ui_feed (db98d53) · fs_relic_store (CAS-backed .relic artifact storage for Forge/Anvil) + sigdb_view2 (materialized views) + fs_export (Smart Folder → portable bundle) (315d253) · fs_relic_seal + sigdb_explain2 + fs_cas_verify (4d38b90) · fs_relic_verify (Ed25519 .relic signature check) + sigdb_join3 (3-way join) + fs_cas_compact (e846abc). All 26/26 PASS (FS e39eff1→e846abc).
• Video: dock render + Doom Pile (dense touching stack) + glyph AA + wallpaper: wm_dock_render (1c6a739, 2nd-row locked apps + main dock + Doom Pile button in one pass) · wm_doompile hover-outline + wm_dock_anim + vid_glyph_aa (d71b1be) · wm_doompile dense-stack fold-corner pass + vid_wallpaper procedural patterns (f8bea40). The Doom Pile (3-second-hover → dense overlapping window stack with show-through outline, per grioghar's spec) is landing (Video 1c6a739→f8bea40).
• Apps: dock fully wired + animation + bookmarks + notifications (T153–T154): dock_fswire (340a80a, dock ↔ fs_tag_query + thumbnail + watch) + lumen_settings_dock (center/left/right align + Doom Pile config) + browser_findbar · lumen_dock_anim (open/close + Doom-Pile 3s trigger) + browser_bookmarks + lumen_notifications (DND + clear) (afad3ae). 162 modules (Apps 340a80a + afad3ae).
• Retropie: controller hotplug + per-core input remap: controller_hotplug (8ff4641, Xbox One BT connect/disconnect state machine) + input_remap_ui (per-core remap Lumen panel) (Retropie 8ff4641).
• Kernel: x86 keyboard bring-up VER=13→15 (sign-in path, QEMU-complete, metal in progress): VER=13 (fabbfbf) restored Enable-Slot→Address-Device→Config-EP→HID-boot-report on the proven VER=12 render — keystrokes feed the password field, verify, sign in (OVMF: kr=0 letter k=6 u=1000 ok=1). VER=14 (b241690) adds PORTSC.PP port-power + numeric on-screen port readout. VER=15 (1545dc3) scans all 8 root ports with a longer CCS settle/re-poll. On QEMU: signs in. On @grio's x86 metal: keyboard still not enumerating — real-HW port bring-up gap (QEMU auto-powers ports; metal needs explicit PP + debounce). The active x86 metal blocker (Kernel fabbfbf→1545dc3).
• Kernel: input router + cap_tier expansion: core/input_router.sg (39e4293) — focus-tagged FIFO; HID drivers route key/mouse events to the focused EL0 window, drained via ir_poll. cap_tier expansion (b47d390) — per-board feature gates CAP_GIGE/CAP_USB3/CAP_H265/CAP_4K (Pi4+Pi5 only) + RAM tier (1G/8G/16G) on top of the base board tiers, with a cap_query(kind) userland seam (Kernel 39e4293 + b47d390).
• cc0: Pi MMIO fix v2 — D-cache-off + MMU-on (faf6c54, seed bb49744a): the corrected cached-MMIO fix — clear SCTLR.C (D-cache off) but keep SCTLR.M (MMU on), so the firmware peripheral map stays intact (0xFE201000 still routes to the UART) and writes are uncached. Preserves the FAST pillar (only D-cache off, not the whole MMU). Supersedes the PR #100 full-MMU-off attempt. On @grio's Pi-4B metal (BUILD 19, Code a7e6a33e): screen renders ✅, but UART still silent — the Pi serial grind continues past this fix (cc0 faf6c54).
• Drivers: USB mouse + hotplug + UVC camera: hid_mouse_xhci (MHM dci=3 prb=1 ok=1) + usb_hotplug (HPUG ccs=1 csc=1 ok=1, port connect/disconnect detect) + uvc_camera framing tests (8ab0b02) — the pointer + hotplug + webcam transport layer over xHCI (Drivers 8ab0b02).
• Video: boot readout + debug HUD + dock + workspaces + Doom Pile: boot_readout.sg (19ac8d2, Ex Machina node lattice — green=detected/slate=absent, BIOS-style sidebar, feeds Kernel boot_diag) · debug_hud.sg + wm_dock.sg + wm_workspace.sg (46afd3e, fps/mem HUD overlay, 8-slot Lumen dock, 4 virtual workspaces) · wm_doompile.sg (77b1c11→eda2947, 3-second-hover → dense touching window stack like shambled papers, ±12px jitter + show-through outline) · wm_animate (7188739) + vid_thumbnail. All screendumped both arches (Video 19ac8d2→eda2947).
• Apps: browser render/chrome + Lumen dock (T151–T152): browser_render.sg + browser_chrome.sg + lumen_copy_dialog.sg (T151, b56ccea) — wire css_cascade + canvas + font_render into a page paint; unified browser window. lumen_dock.sg + dock_smartfolder.sg + dock_appmenu.sg (T152, edd51e2) — the scrolling apps dock (center-button scroll, lock-app rows, hover-expand folders) per grioghar's Lumen dock spec. 156 modules (Apps b56ccea + edd51e2).
• Retropie: controller config (1.0 gate) + thumbnails + achievements + polish: controller config UI with Xbox One BT default mapping (fc5d0d4, 11 buttons, remap table — the 1.0 controller gate, closed) · save-state thumbnails (84795b3, IT_IMAGE 80×60 ARGB per slot) · RetroAchievements-style hooks (6a9dc9b, 32-slot mem-watch + 64-entry event ring, fire-on-change/increase/decrease) · scanline+rewind polish (2ce9d5c, L2/R2 toggles + launcher badges) (Retropie fc5d0d4, 84795b3, 6a9dc9b, 2ce9d5c).
• FS: UUID + quota report + search index + thumbnails (batches 13–15): fs_uuid.sg (8c00d57, deterministic UUID/provider) · fs_quota_report.sg (8642651, CAS→cap quota rollup) · fs_search_index.sg + fs_tag_query.sg + fs_dir_stats.sg (3de597d, dual-tier name+trigram search, cap-scoped tag-query wrapper for Smart Folders + locked dock folders, directory stats) · fs_thumbnail.sg (104599d, 32-slot descriptor table, dirty-flag invalidation). Powers the Lumen dock metadata + live Smart Folder queries (FS 8c00d57→104599d).
• 🎉 x86 LOGIN SCREEN RENDERS FULL ON REAL METAL (VER=12, 60350e6): the complete sigilOS login card renders on @grio's physical x86-64 hardware — "sigilOS" titlebar, "sign in to continue", grioghar(admin) + dev(standard) user cards with avatars, password field, Sign-in button. Crisp, correct colors, stable, no freeze. VER=12 brought glyph text back onto the proven raw-rect card (serial V11:ABCDEF → FNT:0GHIJKLMN → V12LGN, all 8 labels, correct-color white text) — and fixed the VER=10 freeze root cause. This is the x86 real-metal render gate, closed. The last x86 item is VER=13 (xHCI keyboard so @grio can type the password) (Kernel 60350e6).
• cc0: font_raster.sg — glyph rasterizer (font 1.0 gate): glyph outline → coverage bitmap, bounded (dims ≤256, 8-step bezier, capped scanline — no unbounded glyph loop) + nonzero-winding fill (correct for composite contours). The rasterizer that backs on-screen text; pairs with font_parse (composite glyphs + cmap12) to complete the cc0 font subsystem (cc0 43eb721).
• Drivers: metal keyboard — xHCI + dwc2 + USB hub: hid_keyboard_xhci (9a910e3/b071c0e, M2HID h=0 k=0 dci=3 ok=1) + hid_kbd_dwc2 (b071c0e, Pi3B dwc2 path, bitwise &→% cc0-rule fix) + usb_hub. The USB-HID boot keyboards for x86 (xHCI) and Pi3B (dwc2) — they light up on metal the moment the MMIO cache fix lands (Drivers b071c0e).
• Kernel: boot-diagnostics core: boot_diag.sg + panic_log.sg (a3bdc98) — 64-entry RAM ring (32 B/entry: stage·hw·timing·warning), wraps retaining newest N, flush-on-stage + on-panic, DEBUG-gated, board-aware via boardsel/cap_tier. BDIAG init=1 hw=1 warn=1 dbg=1 ring=1 flush=1 on arm-raspi3b. The structured boot-log source feeding FS's /logs sink (Kernel a3bdc98).
• Retropie: BIOS management suite — verify · import · open-source registry · HLE: bios_state 3-state table (MISSING=red / WRONG-DUMP=orange / VERIFIED=green via fs_read byte-count compare, d10e47b) · BIOS import flow (bi_install scans /roms/bios_drop/, IDs by byte count, places canonical /roms/bios/, 1913a0f) · open-BIOS registry (bios_open_kind flags redistributable replacements, GBA=Normmatt, teal OPEN chip, 655a317) · HLE-BIOS toggle (hle_prefs.sg per-system auto↔force-HLE, Y-button cycle, 73bbbb1) · PS1 HLE BIOS (ps1_hle.sg — JR RA stubs at A/B/C dispatch tables 0xA0/0xB0/0xC0 + exception vector, 1a7e96f). The BIOS-management 1.0 gate (Retropie d10e47b→73bbbb1).
• Apps: browser settings + downloads + MOTD (T150): browser_settings.sg (homepage/search/privacy toggles) + browser_downloads.sg + motd.sg (10 rotating ASCII MOTD banners) — all screendump green; 150 modules (Apps 54f778f).
• ⭐ x86 login renders on real metal (VER=11, 8bc56bd): the x86 login card renders correct + stable on @grio's hardware — green bg, navy card, blue title bar, pink+cyan accent rects, two input bars; serial V9GRN → V11:ABCDEF V11LGN, no freeze. The metal-bringup bisection (VER4 pink → VER9 solid-green → VER10 login-card-render breaks → VER11 raw-rects correct) localised the remaining x86 freeze to GLYPH/text rendering (raw rects + geometry + xHCI all proven correct). Furthest the x86 desktop has reached on real hardware (Kernel 8bc56bd). VER=12 (glyph raster, with cc0) is the open x86 item.
• ⭐ Pi cached-MMIO fixed — serial on metal (cc0 c9849bf, PR #100): the Pi-4B "renders in QEMU, zero serial on metal" divergence was root-caused (Code) to cached MMIO in the ARM boot stub. cc0's metal_entry now maps MMIO Device-nGnRnE (MMU-off diagnostic) so UART writes reach the hardware — unblocks Pi BUILD 18. Follow-up flagged (Director): global MMU-off = everything uncached = FAST-pillar hit (FB/RAM crawl); selective cached-normal mapping is the post-diagnostic cleanup (cc0 c9849bf).
• Unified Pi image — board-detect + capability tiering (Kernel 6c22408): new architecture directive (grioghar) — ONE kernel + ONE SD that detects the SoC at boot and scales up from the Pi-3B floor. boardsel.sg (boardsel_periph_base() → 0x3F/0xFE/0x107C for Pi3/Pi4/Pi5) binds the correct HAL; cap_tier.sg sets the detected capability tier (Pi3 floor → Pi4 +xHCI/HDMI/PCIe → Pi5 +RP1/compute; unknown → floor). Verified CAPT pi3=1 pi4=1 pi5=1 unk=1 + BSL det=1 on arm-raspi3b (Kernel 6c22408). [[scale-with-hardware]] made literal in the boot path.
• cc0: font subsystem (1.0 gate) — composite glyphs + full Unicode cmap: font_parse composite glyph support (11f6067, recursive component merge + F2Dot14 scale — accented/CJK glyphs were returning empty contours) + cmap format 12 full-Unicode mapping (2e693a4, emoji + supplementary CJK, were BMP-only). Closes the cc0-side Unicode requirement for the font subsystem 1.0 gate (cc0 11f6067 + 2e693a4).
• Video: Lumen theme engine + multi-monitor + window snap: wm_theme.sg + vid_multimon.sg + wm_snap.sg (39b7941) — theme engine (NeXT dark-grey + LCARS alt, 6 swappable color/metrics tokens, wmth_set(0/1), GPU uniform-block upload); multi-monitor; window snap/tiling. Verified both arches (Video 39b7941).
• Apps: browser history (T149): browser_history.sg (ebe623b) — visited-URL history for the browser; plus an it_rect 8-arg fix (missing blue channel). All four browser scenes screendump green: browser · browser_fetch · tab_manager · browser_history (Apps ebe623b).
• OS: process supervisor: proc_super.sg (b5d6842) — spawn / monitor / restart EL0 services with a restart policy; the init-style supervisor for long-running OS services (OS b5d6842).
• FS: boot-log sink + volume labels + TRIM: fs_logs.sg (fe55737, 32-slot ring, append/flush/rotate, structured boot entries — the /logs/boot-<n>.log sink for the boot-diagnostics launcher) + fs_label.sg (volume labels + UUID per provider) + fs_trim.sg (discard/TRIM for SSD-backed providers) (FS fe55737 + 3ebe139).
• Retropie: rewind + scanline across 6 cores: dd2546e (GB + SNES) + 3dfaeaa (Genesis + GBA + PCE; NES in a prior commit) — rewind buffer + CRT scanline shader wired into all 6 emulator cores (NES/GB/SNES/Genesis/GBA/PCE) (Retropie dd2546e + 3dfaeaa).
• Video: cross-app clipboard + screenshot + tooltips: wm_clipboard.sg + vid_screenshot.sg + wm_tooltip.sg (074435c) — cross-app clipboard (cap-scoped copy/paste channel between Lumen apps); real-HW screendump (vid_screenshot writes the live LFB to a file); hover tooltips (delayed-show on pointer dwell). WMCLIP-PASS · VIDSSHOT-PASS · WMTOOLTIP-PASS (Video 074435c).
• Video: resolution negotiation + wallpaper + DPMS: fb_resolution.sg + wm_wallpaper.sg + vid_dpms.sg (a50eab0) — framebuffer resolution negotiation (queries display modes, picks best fit); desktop wallpaper layer (composited beneath all windows); DPMS power management (display sleep/standby/off). FBRES-PASS · WMWALL-PASS · VIDDPMS-PASS (Video a50eab0).
• Video: menu bar + icon grid + GPU glyph atlas: wm_menu.sg + wm_iconview.sg + font_glyph_cache.sg (bcdbc07) — Lumen menu bar (top-strip + dropdown menus); icon grid view (file/app icon layout with selection); GPU glyph atlas (cached rendered glyphs in a texture atlas, eliminates per-frame glyph rasterisation). WMMENU-PASS · WMICONVIEW-PASS · FGCACHE-PASS (Video bcdbc07).
• FS: ACL inherit + SigDB trigger + backup: fs_acl_inherit.sg + sigdb_trigger.sg + fs_backup.sg (d8fdab9) — directory ACL inheritance (child inherits parent grants on create); SigDB row triggers (BEFORE/AFTER INSERT/UPDATE/DELETE hooks); FS backup engine (full + incremental over CAS). ACLI + TRIG + BACK green (FS d8fdab9).
• FS: unified VFS namespace + vacuum + perf bench: fs_vfs_unify.sg + sigdb_vacuum.sg + fs_perf_bench.sg (52f2667) — unified VFS namespace with a 16-slot mount table over all 5 providers (CAS/devfs/tmpfs/procfs/net); SigDB vacuum (dead-page reclaim + free-list compaction); FS perf benchmark harness. VFSU/VACU/PERF green, 26/26 (FS 52f2667).
• FS: mount API + WAL checkpoint + iostat: fs_mount_api.sg + sigdb_wal_checkpoint.sg + fs_iostat.sg (9103401) — cap-gated mount/umount syscall surface (8-slot cap table, EPERM on unauthorized); SigDB write-ahead-log checkpoint (flush WAL → main store, truncate log); FS I/O statistics counters. MAPI/WALT/IOST green (FS 9103401). SECURE finding RESOLVED (786961d): the fma_cap_check fail-open bug (the FMA_FREE()=0xFFFFFFFF sentinel passed as a valid cap) is patched — cap_check now guards the free-slot sentinel, so 0xFFFFFFFF is rejected and the mount gate fails closed. Found by Code, fixed by FS (FS 9103401 + 786961d).
• Retropie: WASM-4 runtime — interpreter + host draw + EL0 launch app (system #75): wasm_interp.sg increment 3 (6e18af8) adds the WASM-4 host draw API so real carts render; el0/wasm_app.sg (fcf798b) loads /roms/wasm/demo.wasm (64 KB cap via fs_resolve+fs_read), core_loads it, and exposes a launcher card — users can actually run WASM-4 carts as EL0 apps. WASM-4 is system #75 (Retropie 6e18af8 + fcf798b).
• Retropie: BIOS Management UI + save-state UI: bios_ui.sg (7e8cf20) — fs_resolve BIOS scan + Lumen status panel (which systems have their BIOS present); savestate_ui.sg (20a9df7) — 8-slot save-state grid with thumbnail capture (Retropie 7e8cf20 + 20a9df7).
• Kernel: generic task wait queue: core/wait_queue.sg (2cf484f) — 16 queues × 8 slots; the primitive that backs condvar / semaphore / futex; tasks block on a wait queue and are woken by wq_wake/wq_wake_all (Kernel 2cf484f).
• Kernel: futex + WiFi/SRDX host transport: core/futex.sg (04d0c92) — fast userspace mutex over the wait queue; plus build_host wiring for wifihal/wifisys/srdx_xport host transports (Kernel 04d0c92).
• Kernel: VER=9 x86 login diagnostic — solid-GREEN paint: hal/x86/login VER=9 (66a5ba6) — full-screen solid-green diagnostic paint before any xHCI init, format-robust (G=0xFF in both RGBX+BGRX); serial M3IN V9GRN w=1280 h=800 fmt=1. Isolates the x86 metal paint-vs-hang split for @grio's GOP=1280×800 hardware. OVMF PASS (Kernel 66a5ba6).
• Drivers: xHCI VER=7→9 metal bring-up (diagnostic increments): VER=7 (fd01c7b) removes bios_handoff+ports_power from uhc_init, adds CRCR diag; VER=8 (70d5e44) bounded PSC drain in uhc_init, guard 64→128 in xhci_wait_event; VER=9 pre-stage (94f5bcb) xhci_find_port_retry (bounded 500k poll for CCS). Hardening the x86 metal xHCI enumeration path (Drivers fd01c7b→94f5bcb).
• Apps: web NFC + X-Frame-Options (T145–T146): web_nfc.sg + x_frame_options.sg (9a4703b) — Web NFC API surface for the browser; X-Frame-Options enforcement in the net layer (DENY/SAMEORIGIN frame-embedding policy) (Apps 9a4703b).
• Video: keyboard focus routing for Lumen WM: wm_focus.sg (7e4cd1c) — active window receives key events; click-to-focus + programmatic focus change; focus ring visual on the active title bar. WMFOCUS-PASS (Video 7e4cd1c).
• Video: LCD subpixel AA glyph renderer: font_aa.sg (59b38c6) — RGB and BGR subpixel anti-aliasing for the Lumen glyph pipeline; per-subpixel gamma-weighted blend against background; FONTAA-PASS (Video 59b38c6).
• Video: ARGB cursor sprite with alpha-blend: vid_cursor.sg (ed61946) — 32×32 ARGB cursor sprite; alpha-blended composite into the framebuffer (no save-under required — full alpha path); VIDCURSOR-PASS (Video ed61946).
• FS: SigDB secondary B-tree index: sigdb_index.sg (fc3ab3a) — auto-maintained secondary B-tree index on any SigDB column; INDEX CREATE/DROP; auto-updated on INSERT/UPDATE/DELETE via the query executor; CILRUD green (FS fc3ab3a).
• FS: CAS compact + B-tree defrag: fs_defrag.sg (3cdd188) — CAS object compaction (dead-object sweep + repack) + B-tree page reclaim (merge underfull sibling pages); fs_defrag_run() is a background-safe pass; LDCRF green (FS 3cdd188).
• FS: overlay mount (OverlayFS-style): fs_mount_overlay.sg (a86774b) — upper writable layer over lower read-only CAS snapshot; whiteout entries hide lower-layer files; fsmov_lookup routes reads through upper→lower; MLWODU green (FS a86774b).
• Kernel: xHCI VER=5 — HS→FS speed clamp + EP0 MPS=8: hal/x86/login VER=5 (d5bca8e) — HS→FS speed clamp on Address Device (spec-correct per xHCI §4.6.5); EP0 MPS=8 for FS/LS initial address; ADC/ADS allocated/in-service columns on-screen for diagnostic clarity. OVMF ok=1 k=7 sel=1 (Kernel d5bca8e).
• Drivers: ARM GIC-400 (GICv2) interrupt controller: arm_gic.sg (05dc1c4) — GIC Distributor + CPU interface enable; gic_irq_enable/disable, gic_ack, gic_eoi; gic_op dispatch; cc0 arm-el0 compile-verified, Code GREEN (Drivers 05dc1c4).
• Drivers: PL011 UART — Pi4B serial console: pl011.sg (77a5c50) — init (CR disable → BUSY poll → IBRD=26/FBRD=3 → LCRH=112 → CR=769); pl011_putc/pl011_getc with poll loops counter-bounded at 1M; Pi4B base 0xFE201000. cc0 arm-el0 compile-verified, Code GREEN (Drivers 77a5c50).
• Drivers: BCM2711 BSC I2C — Pi4B I2C bus: i2c_bcm2711.sg (a4e6835) — i2c_init, i2c_write_byte, i2c_read_byte (2-phase write-then-read); i2c_wait_done counter-bounded at 1M; Pi4B BSC1 base 0xFE804000. cc0 arm-el0 compile-verified, Code GREEN (Drivers a4e6835).
• Drivers: BCM2711 SPI0 — Pi4B SPI master: spi_bcm2711.sg (1e417e1) — spi_init(base,div) flush+CLK; spi_xfer TA+CLEAR→write FIFO→poll DONE→read FIFO; DONE-poll counter-bounded; Pi4B SPI0 base 0xFE204000. cc0 arm-el0 compile-verified, Code GREEN (Drivers 1e417e1).
• Drivers: BCM2711 GPIO — Pi4B GPIO controller: gpio_bcm2711.sg (9fee0dc) — gpio_fsel read-modify-write (no bitwise — cur - old_fn*shift + fn_val*shift); gpio_set/gpio_clr/gpio_get; gpio_pow2 loop-shift helper; Pi4B base 0xFE200000. cc0 arm-el0 compile-verified, Code GREEN (Drivers 9fee0dc).
• Drivers: Pi4B platform driver hardening: 98b5f3b — I2C/SPI/GPIO unified: DONE-wait timeout surfaces as error (not silent continue); GPIO pin bound 0–53 guard + fn_val&7 mask; SPI DONE-poll error path consistent with I2C pattern (Drivers 98b5f3b).
• Video: WM dirty-rect damage tracker: wm_damage.sg (8ab1e71) — 16-slot dirty-rect tracker; wmd_composite_dirty blits only damage∩layer rects; compositor no longer redraws the full framebuffer on every tick (Video 8ab1e71). WMDAMAGE-PASS x86.
• Video: NeXT-style window drop-shadows: wm_shadow.sg (05a2838) — per-window shadow geometry, SIMD-blended into the compositor pass before each window blit. WMSHADOW-PASS x86. (Video 05a2838).
• Video: framebuffer capture — real-HW screendumps: vid_capture.sg (2fadf68) — PPM P6 encoder that snapshots the live LFB; vid_capture_to_file() writes a portable bitmap from any BGRA/RGB framebuffer. Fulfils the Director standing rule: QEMU screendump required on every test pass. VIDCAP-PASS arm + x86 (Video 2fadf68).
• Video: z-buffer depth foundation: fb_depth.sg (53a91e1) — 16-bit depth buffer at FB_DEPTH_BASE; fbd_test_write(x,y,z) performs depth test + conditional write; foundation for 3D pipeline (Video 53a91e1). FBDEPTH-PASS.
• Apps: browser fetch pipeline capstone (T147): browser_fetch.sg (e1c7994) — HTTP fetch pipeline + rendered scene; Cap<NetConn>-gated; response body parsed + rendered into Lumen view. T147 capstone (Apps e1c7994).
• Apps: multi-tab browser manager (T148): tab_manager.sg (b1488bf) — 4-tab strip (106px each) + Tab Manager panel with per-tab URL/status, active count, Close/New; Lumen window x=30, panel x=416 (Apps b1488bf).
• FS: network mounts + integrity: vfs_net_mount.sg + fs_integrity.sg (38658f2) — NFS/SMB network mount provider wired into VFS; fs_integrity.sg adds HMAC-SHA256 tamper detection over mount-point data paths (FS 38658f2).
• FS: quota, audit log, COW snapshot: fs_quota.sg + fs_audit.sg + fs_snapshot.sg (721eaea) — cap-scoped storage quotas (per-session byte ceiling, enforced at write); HMAC-chained audit log (tamper-evident entry chain); COW snapshot engine (copy-on-write fork of FS state) (FS 721eaea).
• FS: SigDB query executor + block compression + CAS replication: sigdb_query.sg + fs_compress.sg + fs_replication.sg (28c0261) — plan-based SigDB executor (sdq_exec_plan: SELECT point/range, INSERT, UPDATE, DELETE); LZ4+Zstd block compression (fsc_seal/fsc_open, 8B SG header, auto-stored on incompressible); async CAS replication state machine (list/diff/push over Cap<NetConn>) (FS 28c0261).
• FS: security fix — fsc_lz4_decompress OOB read (Code #review): match_src = di - offset could go negative on crafted input; fix: reject offset > di before the back-reference read. Found by Code review, patched in FS (FS 4e552ff).
• Kernel: Pi BUILD 12 — keyboard enum + typing fixes: hal/aarch64/pi_login BUILD 12 (ea10ee3) — xHCI keyboard enumeration and typing pipeline fixes; pi_build_num() → 12; 406 696 B img verified; auto-flashed to Pi SD (Kernel ea10ee3).
• Kernel: animated 7-stage boot splash sequencer: bootseq.sg (631e2b9) — stage-by-stage splash sequencer (SIGIL glyph → pillars → version → handoff to login); hands off to login on completion (Kernel 631e2b9).
• Drivers: SDHCI — SD Host Controller (QEMU verified): sdhci.sg (4c41e18) — block-read-verified SD Host Controller driver; sdhci_read_block returns ok=1 on QEMU sim (Drivers 4c41e18).
• Drivers: DWC2 HCSPLT.XactPos=ALL fix: dwc2_hid_keyboard.sg — HCSPLT.XactPos=ALL for LS/FS-behind-HS-hub split transactions; eliminates XactErr on the Pi 3B keyboard-behind-LAN9514-hub path (Drivers ae03f45).
• Drivers: Pi 4B GPIO + UART0 base address fix: wrong decimal literals for GPIO (0x3F200000) and UART0 (0x3F201000) base addresses corrected (Drivers 546249c).

In progress

• Kernel: xHCI x86 — PrtAddr split-path BUILD 13 (HCSPLT.PrtAddr = KPORT fix, Code #review)
• OS: os_https_fetch.sg — real TLS over Cap<NetConn> (Director lane)
• Video: wm_focus.sg — keyboard focus routing; wm_anim.sg — spring/easing; wm_tiling.sg
• Apps: browser_history.sg (T149) + css_cascade.sg
• Retropie: wasm_interp.sg — WebAssembly interpreter core (Emscripten-compiled cores as EL0 apps)
• cc0: css_cascade.sg — CSS cascade resolver (specificity, inheritance, computed-value pass)

Pre-tag development milestones

The aspirational milestones that preceded the first git tag (v0.6.0, above). They were never cut as tagged sigilos.img releases — they mark development progress by date. No version number below is a released tag; tags are authoritative.

The x86 desktop + SRDX — 2026-06-24 (pre-tag, untagged)

The x86 desktop + SRDX milestone — sigilOS boots a full Lumen desktop on x86-64 bare-metal QEMU (first non-ARM Lumen), SRDX remote display protocol live end-to-end (Ed25519 secure invite, relay mesh, display driver), mouse and audio integrated, Lumen declared working capstone. A superset of 0.5.0's desktop foundation.

Added (post-0.4.0)

• Live external networking (0.4.x): the net stack talks to a real external peer end to end — netdemo brings up real virtio-net, sends a real ARP request, and slirp's gateway replies into vnet_rx (Kernel 615c887, #120 M5NET prs=1 arp=1 ok=1; the unlock was Drivers' 16-bit QueueNotify fix fa72b06). New net-tools — ARP resolution (over the ungated raw-L2 net_recv_raw 90 path) + the DNS dig/nslookup primitive (dns_query/dns_parse_a over UDP) — documented in NET_STACK.md. Artifact BOOTX64-netlive.EFI (46 080 B, md5 0714117e…, subversion 0.4.0-18062601). (DNS A-record resolve is an environment-gated acceptance item, not a code gap — the sandbox host has no outbound network so slirp's resolver never replies, confirmed via the ungated net_recv_raw; non-blocking #116-style env gate, the live data path is proven by the ARP round-trip.)
• Smart Folders — the FS tag substrate MERGED (0.5.0 desktop): the indexed tag/query engine landed FS-side (feat/tag-substrate → main, Director-authorized FF 5bf243e; harness-green 233/233, 7 new substrate tests, all-new files, no regression) — fs/metal/ tagidx.sg (inverted tag→item index), fs_tags.sg, fs_smartfolder.sg, fs_meta.sg/fs_tagstate.sg (persisted tag state). All 8 locked verbs present and confirmed against the ratified seam: fs_query · fs_tag_children · fs_tag_list · fs_tag · fs_untag · fs_item_tags · fs_sf_save · fs_sf_list. This is the read/write backing the column browser, tag well, and shelf consume — the Smart-Folders desktop substrate is now real end to end (FS 5bf243e).
• Smart Folders — the EL0 tag-query syscall seam 91–102, wired end-to-end (0.5.0 desktop): Sigil-Kernel claimed syscalls 91–102 for the tag-query verbs and landed the dispatch + proof (core/tagq.sg tagq_dispatch, 93cdd04) — fs_query=91 … fs_sf_query=102, routing EL0 calls to FS's substrate verbs, the analog of fshal (16–26) and netsys (84–90). SECURE: the kernel injects the login-bound session slot (fsh_cur_slot()) on every call, so the broker-held token is never EL0-supplied (sigil-os#94). Registered in the kernel SYSCALLS.md + cross-linked from SMART_FOLDERS.md; wired end-to-end (dd9be7c): host.sg now routes 91 ≤ num ≤ 102 → tagq_dispatch — the tag-driven Lumen column browser and the terminal's fs_query file-completion are live (Kernel 93cdd04 + dd9be7c).
• Smart Folders — the column browser (0.5.0 desktop): OS's NeXT column browser (cc0/colbrowser.sg) navigates the tag hierarchy — each column narrows the AND, the breadcrumb is the query — per the ratified Smart-Folders / tags file model (no physical folders); in Lumen's own look (OS 0aed9de).
• Smart Folders — column browser wired to live EL0 ABI (0.5.0 desktop): the column browser is now wired to the live EL0 tag-query client (tagfs.sg, OS 8580de3) — it calls the real fs_query/fs_tag_children syscalls (91–102) through the now-routed seam rather than any stub; the tag-driven navigator is end-to-end with the FS indexed substrate.
• Smart Folders — the tagging UX (0.5.0 desktop): the tag well (cc0/tagwell.sg) — an item's tags as removable chips with a prefix-autocomplete add field — consuming the locked FS↔OS seam: fs_item_tags to list, fs_tag / fs_untag to mutate (cap-gated like an item write — no ambient re-tagging), fs_tag_list for the autocomplete well. The tag-as-organization write surface to pair with the column browser's read surface (OS a0968bb).
• Smart Folders — tag well wired to live EL0 seam (0.5.0 desktop): the tag well now drives FS's real cap-scoped verbs through tagfs.sg, keyed by the broker session slot (EL0 never holds the token — kernel injects it): fs_item_tags #96 / fs_tag #97 / fs_untag #98 / fs_tag_list #94 / fs_name #95 (buffer-based names). Tag-write cap-gated; a denied write is surfaced as status, never a local mutation. SECURE verified: a non-owner session slot returns zero tags — absence, not greying (OS 2577b88).
• Smart Folders — the default shelf (0.5.0 desktop): the desktop shelf (cc0/sfshelf.sg) wires the default Smart Folders (saved live queries) into the column browser — fs_sf_list enumerates them, selecting one opens its fs_query result in the browser. The launcher / sidebar is a set of Smart Folders, re-evaluated live on open — no static listing, no physical folders (OS 08bb2b5).
• Smart Folders — shelf wired to live FS verbs (0.5.0 desktop): the shelf now drives FS's real cap-scoped Smart-Folder verbs through tagfs.sg, keyed by the broker session slot: fs_sf_list #99 populates the tiles (only caller-authorized Smart Folders — absence, not greying), fs_name #95 for names, fs_sf_query #102 opens a folder (runs its saved query), fs_sf_delete #101 removes. Stateful (cached SF handles) rather than static defaults. SECURE verified: a non-owner session slot loads zero Smart Folders (OS 5636be5).
• ⭐ Smart Folders — Lumen-working: live tag-driven desktop capstone (0.5.0): lumenfiles.sg mounts all three file-model surfaces over the live FS tag-query EL0 seam (tagfs.sg, cap-scoped by the broker session slot) in Lumen-dark — the complete tag-driven file experience in one app: Smart-Folder dock (fs_sf_list #99) · NeXT column browser over the tag hierarchy (fs_tag_children #92 / fs_tag_is_leaf #93 / fs_name #95; breadcrumb = live query) · tag-well inspector for the selected item (fs_item_tags #96 / fs_tag_list #94). Verified PASS on QEMU raspi3b: shelf loads live Smart Folders; browser drills retropie ▸ snes ▸ Zelda; inspector surfaces live tags with autocomplete — whole tag-driven experience, one cap-scoped seam. (Director: 'mount shelf+browser+well = Lumen-working') (OS 9c56de4).
• Smart CLI autocomplete — pt1 (0.5.x): sig-sh gained command / flag completion + hint-nav in the AA terminal (Apps apps/term/term.sg, ce9dc0a, Director-greenlit). Same engine as Smart Folders applied to the shell.
• Smart CLI autocomplete — pt2: path/file completion (0.5.x): sig-sh file completion now goes through the tag substrate via fs_query (syscall 91) — the shell issues a live tag query for the prefix and ranks results by recency/tag match, giving capability-scoped path completion identical to the column browser's query (Apps a564dc6). The full tag-filter layer activates now that host.sg routes 91–102.
• WM chrome → Lumen-dark default + NeXT-native live compositor (0.5.0 desktop): the default window chrome is Lumen-dark (the NeXT bevel stays an optional theme, per @grio's "Lumen's own look") — OS 7e7a6d1; the live compositor is NeXT-native and a cursor-scratch image collision is fixed — OS b835bfa.
• Anti-aliased terminal — SHIPPED for 0.5.0 (Director ruling): the 0.5.0 anti-aliased Terminal is sig-sh as a Lumen WM window (Apps termwin, 39d5eef), glyphs rendered AA via the compositor's ui_text_packed (dual-mode; the CLI host is /apps/term) — the e2e AA terminal that ships in the desktop. The SDF monospace upgrade (Video sdf_term_cell / sdf_term_row in core/sdf.sg, gamma-correct partial-coverage AA, SDFTERM mono=1 aaPos ok=1, Video f2f8754) is a deferred, non-gating razor-crisp quality pass that completes when OS's libwin make_font high-res AA source lands (sigil-os#15) — the 0.5.0 terminal does not wait on it.
• Session Manager — the 0.5.0 shell (hollow until 0.6): the Royal TSX-style Session Manager shell ships as a libwin Lumen view (Apps apps/sessions/sessions.sg, 61d1a73) — folder-tree of connections, compile-verified + QEMU WM-composited screendump. The shell only; its SSH/RDP/VNC backends are the 0.6 remote stack, so it stays hollow until 0.6 — prototyped early per the roadmap's Session-Manager note.
• WM window-chrome policy (0.5.0 desktop): per-window size class — WIN_APP (resizable application) vs WIN_TOOL (fixed-size system tool); a fixed tool ignores resize, an app resizes — plus a full-screen toggle (saves the restore rect + an isfull flag, the full-screen button lives in the chrome). Pure policy logic (OS cc0/wmchrome.sg, 9abcc8e).
• WM focus + stacking + window lifecycle (0.5.0 desktop): the WM's focus/input-routing decisions and full window lifecycle are now explicit: cc0/wmfocus.sg — hit-test, click-to-focus raise, Alt-Tab cycle over the stacking order (wm_hit / wm_raise / wm_focus_next / wm_focus_prev / wm_top); cc0/wmwin.sg — move (clamped ≥24 px on-screen) / resize (floored at minw×minh, clamped to screen) / close (compacts stacking order, focuses next; no-op for absent window). n==0 guards (Code review 29a7f30) make the empty-desktop reachable with no crash. Verified PASS on QEMU raspi3b for all lifecycle cases (OS 0291864 + 584ace3 + 29a7f30).
• GPU-first rendering — gpuhal formalized (architecture): per @grio's standing rule (GPU-accelerated framebuffer first, software-2D fallback), Video made the contract explicit in core/gpuhal.sg — hal_accel() (1 = GPU target / 0 = software-2D floor), hal_gpu_primary() (backend id or −1), hal_software_floor() (the always-present Pi 3 floor); hal_target prefers the GPU primary and continues rendering on the floor on gpu_fault (hal_accel 1 → 0). The stack already ran GPU-primary/software-fallback (CAP_ACCEL backends + CPU/GOP/VESA floor · gpucomp · gpu3d · sdf); this names it and documents a per-feature GPU-path → software-2D-fallback table in GPU_FIRST_RENDERING.md. Verified both arches (GPUFIRST floor=1 gpuPrimary=1 softFallback=1 ok=1); additive, no behavior change → 0.5.0-safe (Video f8a59e5).
• Multi-monitor capability — multi-CRTC (0.5.x): gpuhal grew from one scanout to an additive multi-output table — up to 4 independent CRTCs, each with its own mode, scanout, page-flip counter, and hot-plug; output 0 mirrors the legacy primary so every existing single-output consumer is byte-unchanged. Verified both arches (MULTICRTC n=2 ind=1 scan=1 mirror=1 flipind=1 disc=1 compat=1 ok=1). Wires into the #105 present path (Video 0a453cf).
• Bluetooth HID input (BT-HID host): the OS-owned BT-HID stack starts with its transport-agnostic top layer — a BT keyboard/mouse's HID reports arrive over L2CAP/HIDP and, once unframed, are the same boot-protocol HID format as USB-HID, so they feed the existing keymap + pointer with no second input path (OS c7e2bb2, #174; also the synergy for BT game controllers).
• Runtime theming + LCARS (sigil-os#9): the Lumen design language is themeable at runtime, not hardcoded — theme_set/theme_get + th(role, ch): one cell picks the active palette and widgets read colours by semantic role (surface / accent / text / text_dim / line), so the same codepath re-renders in any theme the instant theme_set() flips it. Three palettes — Lumen-dark, Lumen-light (night-mode is now just dark↔light of this one mechanism), and LCARS (orange / amber / purple / blue) (OS 70b92e5). The live compositor now reads its colours through th() too (desk_compose/dk_window), so the running desktop re-themes, not just static widgets (OS 98cb091).
• WM miniaturize — collapse-to-dock (0.5.0 desktop): windows can collapse to a dock tab — the yellow miniaturize dot in the chrome (Lumen-dark and NeXT) calls wm_minimize; desk_compose skips minimized windows and routes them to a dk_minibar dock strip at the bottom (dk_docktab per entry). wm_restore expands them back from the strip. WIN_TOOL deny (same gate as full-screen — system tools may not miniaturize). Verified PASS on QEMU raspi3b: Files on-screen, Terminal + Settings as dock tabs; WIN_TOOL deny + restore round-trip correct (OS 7ff6358).
• WM tearoff palette primitive — NeXTSTEP palette pattern (0.5.x desktop): cc0/tearoff.sg adds three tearoff primitives: tearoff_draw(base,pitch,x,y,w) — perforated dashed bar (3-on/2-off in text_dim color) at the top of any popup menu, signalling it can be torn free; tearoff_hit(px,py,mx,my,mw) — hit-test for the tearoff zone; tearoff_palette(base,pitch,x,y,w,h,focused) — draws a detached floating palette window (surface_raised body, thin accent-if-focused / line-if-not border, tearoff bar, separator — no full chrome; the bar is the drag handle, per the NeXTSTEP palette pattern); tearoff_promote(r,i) — nudges the WM rect 4 px on detach. Demo in cc0/wmdesk.sg: one tearoff_palette rendered after desk_compose. Pixel-verified: 3-on/2-off dot pattern at y=92, text_dim (135,139,166) on surface_raised (21,18,43) (OS 5eafc3a).
• FS: memory-hard KDF + mount-guard (0.5.0 encryption, 1.0-blocker closed): the rootfs AEAD keyslot now derives keys via a memory-hard ROMix KDF (kdf_w=131072, 1 MB work factor, 2^17 — cc0's W-param call) rather than a trivial hash — a brute-force attack now requires 1 MB of memory per guess, not just CPU cycles (cc0 finding #1). A mount-before-write structural guard ensures fs_mount must succeed before any write path can proceed (cc0 finding #2, eliminates the UMR class). cc0 confirmed both (DSPM ok + UMR ok); this closes the last 0.5.0 encryption gate (FS 424c516, merges 0bb01fa + e3f413b + 395e46f).
• ⭐ Retropie: CPS-1 — LAUNCHABLE system #37 (37 systems total): Capcom Play System 1 (Street Fighter II / Final Fight era) is now a fully-launchable system — and it cost zero new CPU code: cores/cps.sg reuses cores/m68k.sg entirely. Memory layout: ROM 4MB/GFX 4MB/RAM 64KB/PAL 2KB/FB 256×224. 68000 bus seam: ROM $000-$3FFFFF, RAM $FF0000-$FFFFFF, palette $900000, CPS-A registers $9A0000, IN0 $800000. 15-bit palette decode (B5/G5/R5→ARGB); 4bpp tile pixel (128B/tile, 2px/byte); BG1 scroll layer render (32×28 tilemap in RAM → 256×224 fb). Core ABI: core_id=37, core_load (ROM+GFX copy, big-endian reset vectors, supervisor mode), core_run_frame (~167000 68000 steps + BG1 render). EL0 app: loads /roms/game.cps (8MB cap, SECURE), blits 256×224. Blob: 36752-byte, 0 undecodable. Launcher rp_count 34→35, rp_title(34)="cps-1". PARITY.md CPS-1 ✅. uart=63 PASS (Retropie dfe179a).
• Retropie: N64 SRA/SRAV correctness fix (Sigil-Code flag): SRA (funct=3) was using RS as the value to shift instead of RT — a/n64_pow2(shamt) → b/n64_pow2(shamt). SRAV (funct=7) had the same swap: the value register was RS, shift amount was RT & 31, but variables were reversed. Root cause: misleading variable naming (a=RS, b=RT). Both bugs caused shifts to always yield 0 when RS=0 — which is common in well-formed MIPS SRA sequences. SRA/SRAV test coverage added to tests/n64_cpu.sg; uart=61 still PASS; apps/n64 rebuilt (26368 B, 0 undecodable) (Retropie ff62e32).
• ⭐ Retropie: N64 — LAUNCHABLE system #36 (RetroPie parity): Nintendo 64 is now a fully-launchable system. cores/n64.sg implements VI_ORIGIN/VI_WIDTH state (offsets 152/156), n64_display() walks the RDRAM framebuffer (RGBA8888 big-endian) → n64_fb ARGB 320×240 output; VI register bus stubs. Core ABI: core_id=36, core_fb=320×240, core_load (Z64 header bytes 8-11 → boot PC, HLE, no external BIOS, $sp=$A4001FF0), core_set_input (N64 controller bitmask), core_run_frame (~93750 MIPS steps + n64_display). EL0 app (el0/n64_app.sg): loads /roms/game.z64 (32MB cap, SECURE), MIPS + HLE VI loop, blits 320×240. apps/n64: 26368-byte EL0 blob, 0 undecodable words. Launcher: rp_count 33→34, rp_title(33)="n64". PARITY.md: N64 ⬜→✅. All tests PASS: uart=61 (n64_cpu) + uart=62 (n64_core) at 200M sim steps (Retropie a834251).
• Kernel: hw-provisioning capstone QEMU-verified (sigil-kernel#6): build_provision upgraded from compile-only Interpreter call to arm_runverify — closes the run-verify gap on the hw auto-provisioning capstone. provision.sg emits serial banner PROV 6/6 before returning K so the run is identifiable. QEMU PASS PROV 6/6 K — 6 devices auto-provisioned across all 3 buses: PCI xHCI + DT dwc2/genet/sdhci + USB lan9514/BT, each bound to its class contract via modload (Kernel 36c8ae1).
• Video: overlay hole-punch seam — DSO pipeline complete (OVL-HOLE-PASS x86): core/present_accel_ovl.sg — present_window_accel_ovl / present_window_composite_accel_ovl read active DSO overlay slots from ovl_buf() at 0x929000 (matches OS wmoverlay.sg scratch) and punch holes in the scanout blit for overlay-covered row spans, so Kernel's pre-flip overlay_present() composites the DSO client buffer into a clean region. Slot layout: x@0 y@8 w@16 h@24, 32B stride. n_ovl=0 path is zero-overhead (identical to present_window_accel). QEMU x86-metal: OVL-HOLE-PASS — outside=red blit preserved, inside=bg hole punched. DSO overlay pipeline fully wired: Kernel allocates (9f6ba13) → OS WM absorbs (df6c08e) → Video hole-punches scanout (Video 2d02aa4).
• OS: Direct-Scene Overlay WM absorption (Director Ruling ③): cc0/wmoverlay.sg — wm_absorb(r, order, n, w, h) calls ovl_list (syscall 105 loopback stub; real Kernel bind pending), reads up to 8 live overlay slots from Kernel's OVL registry, appends each as a managed WM window into the rect+order tables. Memory layout: 0x929000 scratch stays clear of WM model (0x920000) and cursor (0x930000). wmdesk.sg calls wm_absorb before wm_ctx_init — with loopback stub n_abs=0 → wm_ctx_init(ws,3) unchanged, screendump PASS. Ruling ③ contract: EL0 apps that opened a DSO overlay before WM started are absorbed seamlessly — no flash, no reload; provider drops out at Kernel bind (OS df6c08e).
• Kernel: overlay fb-region bounds check at syscall 103 dispatch (SECURE fix): host.sg now validates x+w≤fbw / y+h≤fbh via fb_info() before calling overlay_dispatch for syscall 103 — closes the gap Sigil-Code flagged against 9f6ba13. ovl_blit_slot comment updated; QEMU PASS unchanged (Kernel 5ceef46).
• FS: NTFS rename — $FILE_NAME in-place update via vfsdev_rename_path (0.3.x): ntfs_rename(): ntfs_find locates the MFT record → ntfs_attr_find(48) finds $FILE_NAME → bounds-check (24 + 66 + new_len×2 ≤ attrlen, refuses overflow) → zeros old name bytes, updates ValueLength+FileNameLength, writes new UTF-16LE name, flushes via ntfs_write_record. Wired via vfsdev_rename_path using vfs_parent_sub×2 + vw_b for old-leaf save. All 6 NTFS tests green (create/readdir/unlink/truncate/mkdir/rename) (FS 688e8f5).
• ⭐ Kernel: Direct-Scene Overlay syscalls 103-105 + cap-topology seam (0.6.0): Kernel allocated three new framebuffer overlay syscalls: fb_overlay_request(103), fb_overlay_release(104), fb_overlay_list(105) — gated behind CAP_FB_OVERLAY(524288). Overlay registry: 8 static slots at OVL_META=0x900000, 8×1MB pixel buffers at OVL_BUF_BASE=0x1000000. fb_flip(37) now intercepts pre-flip to call overlay_present(), compositing live overlays onto the framebuffer; hittest + drag seam wired for WM. Also ships the cap-topology seam (core/captop.sg): 13 capability-architecture nodes, 14 edges at 0x980000 — Video reads CAPTOP_BASE at Ex Machina boot render time to draw the actual live topology. QEMU PASS: OVL alloc=1 rel=1 list=1 deny=1 hit=1 + CAPTOP n=13 e=14 (Kernel 9f6ba13).
• ⭐ Video: Ex Machina sigil lattice boot screen — BOTH ARCHES COMPLETE (SIGBOOT2-OK + SIGBOOT-ARM-OK): Boot screen now live on x86 and ARM. boot_sigil.sg (x86, efb9699): reads live cap-topology from Kernel's CAPTOP_BASE (0x980000) via peek64, draws 13 named nodes (KERNEL center, DISPLAY/TIMER r=120, POWER/BT/GPU/EL0 r=200) + 14 edges, 3 rings (r=120/200/280), purple glow #a78bfa on Bochs VBE 1024×768. boot_sigil_arm.sg (ARM, 7b9c1e6): same live captop render via gfx.sg mbox property-interface for HDMI framebuffer; FMT_RGBA pixel order; cpuaccel scalar/NEON via cpufeat.sg. SIGBOOT-ARM-OK verified on qemu-system-aarch64 -M raspi3b. Director ruling sigil#4 fully delivered across the platform matrix (Video 3818424 → efb9699 → 7b9c1e6).
• Video: GPU HAL surface allocation stub (GPU-FB-PASS x86): gpu_fb_alloc(w,h) / gpu_fb_pitch(w) / gpu_fb_free — gpu-first surface allocation per the standing GPU-first rule. GPU path: gpu_alloc() VRAM bump at 0x3C0000 (HW: GPU MMU BO on accel backend); software floor: same bump, CPU-accessible for comp_blit/fill_span/present_accel. CTL_GPU_SURFACE_ALLOC(20) / CTL_GPU_SURFACE_FREE(21) wired into gpu_ctl; alloc writes {base,pitch} back to params buf. QEMU x86-metal: GPU-FB-PASS — alloc1=vram_base pitch=4096 sentinel_rw=ok, alloc2=vram_after pitch2=2048 free=noop. VRAM bump is arch-agnostic (Video 6a8b7fa).
• FS: procfs — virtual /proc filesystem (provider ID 11, MANIFEST 311/0 FAIL): fs/sys/procfs.sg: synthetic kernel-info provider with no block-device backing. Built-in nodes: version (id=0, "Sigil-FS 1.0 AArch64\n"), meminfo (id=1, MemTotal/MemFree), uptime (id=2, stub). proc_emit_u32 decimal int→ASCII; proc_vfs_resolve/read/readdir (sliced content window, indexed enum). Wired into vfs_dev.sg at provider ID 11. Test PROCVMDU ✓. 311/311 ALL PASS (FS ce758ad).
• OS: Night-mode scheduler + tz-coarse offset (sigil-os#10/#11): nightmode.sg: time-of-day theme toggle. Config cell at 0xA20000 (64B): tz_offset@0 (UTC hours, clamped −12..+14), sunrise@8 (default 7), sunset@16 (default 20). nm_apply_hour(cell, h) → THEME_DARK or THEME_LIGHT based on [sunrise, sunset). nm_apply(cell) reads nm_rtc_seconds() (loopback=0=midnight; real Kernel RTC binds at integration), applies UTC+tz_offset. No networking for tz-coarse tier v1 — user sets UTC offset once via nm_set_tz. Test: 9 logic assertions + split-screen render (dark pixel (16,16,32), light pixel (250,250,253)). QEMU raspi3b PASS (74,200,160) (OS 138e5eb).
• Video: gpucomp — compositor blit + src-over composite test (GPUCOMP-PASS x86): tests/test_gpucomp.sg: comp_path()==0 (SW floor on QEMU), comp_blit (opaque span copy via copy_span), comp_composite (src-over alpha blend: B/G/R channels verified against oracle). The one compositor seam the WM/present path calls — SW floor verified x86 (Video 5ae2755).
• FS: SMB 2.1 client codec + VFS dispatch integration (MANIFEST 309/0 FAIL): smb2.sg: SMB2 header builder/checker; NEGOTIATE, SESSION_SETUP, TREE_CONNECT, READ, QUERY_DIRECTORY builders+parsers; 16-slot fhandle table (persistent+volatile compound IDs); smb2_vfs_resolve/read/readdir (fail-closed -1 no transport, -2 kernel TCP pending). vfs_dev.sg: provider ID 2 (vfs_smb()) now dispatches to SMB2 wrappers; statfs stays -2 (no SMB2 analog). Test NHGAFRV ✓. 309/309 ALL PASS (FS dd67dfd).
• Retropie: Neo Geo ③ — sticky-chain compositor + sprite priority: ng_render_chain: 2-pass reverse draw for sprite priority; sticky-chain compositor composites sprites in correct Z-order (Retropie 807af7c).
• Video: VT100 scroll-up on \n/wrap past last row (VT100-SCR-PASS x86): vt100_decode.sg: vt100_scroll_up(cells,cols,rows) — shifts all rows up by 1, blanks last row with spaces + current bg. Called from newline handler and char-wrap path. Previously cursor clamped at rows-1 (no scroll); now proper terminal behaviour. Pairs with vt100_fb.sg (Video d519468).
• cc0: CI — /opt/homebrew/bin for Apple Silicon self-hosted runner: sigil-native/sigil-macos runner is Apple Silicon iMac Pro; Homebrew installs to /opt/homebrew/bin (Python 3.14). System python3 (/usr/bin/python3 = 3.9.6) lacks 3.10+ syntax. PATH fix ensures correct python3 resolves (cc0 d82b8ca).
• FS: NFS3 directory mutation set complete — RENAME + RMDIR (337/337 ALL PASS): fs/net/nfs3_rename.sg: nfs3_rename_call/parse (proc 14 — atomic rename across/within directories; wire: [from_dir_fh][from_name][to_dir_fh][to_name] → [status][2×null wcc]) + nfs3_rmdir_call/parse (proc 12 — remove empty directory; same wire shape as REMOVE proc 11). Stale nfs3_lookup.sg placeholder removed (LOOKUP already in nfs3.sg). Completes the NFS3 directory mutation set: CREATE + REMOVE + MKDIR + RMDIR + RENAME. 337/337 ALL PASS (FS 6b45ecad).
• Drivers: USB HID input router — CAP_HID gate, cursor accumulation, ev_overlay hit-test: shared/input/hid_router.sg unifies the USB keyboard (usbhidkbd, hk_op) and USB mouse (usbhidmouse, hm_op) behind a single hid_poll() entry point gated by CAP_HID. Mouse deltas are accumulated into an absolute cursor position (clamped to screen bounds); on each poll the router runs ev_overlay_hittest(x,y) — if the cursor lands inside an overlay region the event is re-dispatched in overlay-local coordinates before propagating to the WM. Uses literal op codes to avoid the 10-function symbol collision when both HID drivers are in scope. Integration-verified: hid_router + ev_overlay + usbhidkbd compile clean (Drivers 6bd38bd).
• FS: VFS fd table API (MANIFEST 336/0 FAIL): fs/metal/vfs_fd.sg: integer file-descriptor layer over the VFS — 16-slot fd table at 0x340000; vfs_fd_init(), vfs_open(path)→fd[0..15]|-1, vfs_close(fd), vfs_fread(fd,buf,len)→bytes (advances seek), vfs_fseek(fd,off), vfs_ftell(fd). Slot reuse on next open. App code now uses fds instead of (backend,id) pairs. Infrastructure fix: vfs_stubs_net.sg + vfs_stubs_disk.sg — no-op symbol stubs for builds that don't include the full provider stacks (clears stale-cache false-passes across 96 MANIFEST entries). Test OPENFDT ✓. 336/336 ALL PASS (FS 7a14eb7).
• Video: GPU-first rendering rule test x86 verify (GPUFIRST-PASS): backends/gpu_first_test.sg validates hal_accel()/hal_gpu_primary()/hal_software_floor() across 3 states: CPU-only floor, GPU-primary with fallback, GPU lost → fallback. Formalizes the standing GPU-first rule (GPU primary + software-2D floor always present) on x86-metal QEMU. GPUFIRST-PASS (Video 669b6ab).
• Retropie: Sega 32X — LAUNCHABLE system #44: cores/s32x.sg — Sega 32X add-on: SH-2 bus seam (s32x.sg BEFORE sh2.sg, first-def-wins); 64KB boot ROM ($00000000), 256KB WRAM ($06000000), 320×224 frame VRAM ($04000000, 143360B packed RGB555 big-endian). s32x_rgb555: R[14:10]/G[9:5]/B[4:0]→ARGB. s32x_render: 71680-pixel blit to ARGB fb. 38333 SH-2 steps/frame. Test uart=51 PASS (WRAM bus r/w, frame VRAM r/w, RGB555 decode, render pixel, sh2_reset from ROM vectors, MOV#99,R2 sh2_step). EL0 app: /roms/game.32x (64KB cap). Launcher rp_count 43→44. 44 systems, 7 CPU archs (Retropie 8400f43).
• FS: SMB2 CLOSE + SET_INFO/FileEndOfFileInfo (MANIFEST 335/0 FAIL): fs/net/smb2_close.sg: smb2_close_call/parse (cmd 6 — release file handle, free slot; parse verifies StructureSize=60) + smb2_seteof_call/parse (cmd 17 SET_INFO / FileInfoClass=20 FileEndOfFileInfo — 8-byte EndOfFile at body+32 absolute offset 96; parse delegates to smb2_hdr_check). Completes SMB2 1.x handle lifecycle: NEGOTIATE→SESSION_SETUP→TREE_CONNECT→CREATE→WRITE→SET_INFO→CLOSE. Network FS I/O fully round-trippable. Test CLOSEFG ✓. 335/335 ALL PASS (FS 7d22916).
• OS: capability-backed multi-user identity + session seam (sigil-os#13): identity.sg: user table @ 0xA50000 (16 slots, 64B each — uid/gid/home_off/flags/elev_cap); root (uid=0) + guest (uid=1) pre-installed by id_user_init(). Session table @ 0xA51000 (16 slots — sess_uid/sess_gid/pid/state/cap_token); id_sess_alloc(uid,pid) binds pid to slot; all ops pid-gated via id_sess_verify. id_elevate(slot,pid,elev_token): sudo-equiv — grants uid=0; caller must present ID_ELEV_TOKEN=0x494C4F55 (broker-held, EL0-unguessable). id_access(mode,fuid,fgid,uid,gid): POSIX rwx check (uid=0→always 1; owner/group/other bit decode without shifts). 17-assertion test: init/alloc/verify, dual-session uniqueness, elevation wrong+correct token, access owner/other/root, close lifecycle, invalid-uid guard. QEMU raspi3b PASS (OS f6930de).
• FS: NFS3 REMOVE + MKDIR directory mutation codec (MANIFEST 334/0 FAIL): fs/net/nfs3_dir.sg: nfs3_remove_call/parse (proc 11 — unlink name from dir) + nfs3_mkdir_call/parse (proc 9 — create subdir, null SATTR3; parse stores returned post_op_fh in local fh table). Same xdr_put_opaque pattern as nfs3_write.sg. Completes core NFS3 mutation API: WRITE + CREATE + REMOVE + MKDIR. Test RMVEDN ✓. 334/334 ALL PASS (FS 8bf78c2).
• Video: GPU codec ctl verb test (GPUCODEC-PASS x86): tests/test_gpu_codec_ctl.sg: GET_CAPS (kind=25 caps=393216), CODEC_DECODE/ENCODE on bound HW backend (ST_LAST_CODEC=1), fault-isolation CPU fallback (gpu_fault(0) → ST_LAST_CODEC=0). Covers the CLS_GPU hw-codec service 6-verb path in gpuhal.sg. GPUCODEC-PASS x86 (Video d11cc51).
• FS: SigDB logical delete + exists + count_live (MANIFEST 332/0 FAIL): sigdb/delete.sg completes the CRUD API: sigdb_exists(key) → 1 if key slot in leaf (any epoch); sigdb_delete(key) → sets val=0 via WAL+commit (crash-safe; sigdb_recover correctly undoes partial delete); sigdb_count_live(snap) → count visible entries where val≠0. Re-insertion after delete works: commit raises cur_epoch, new val visible at snap≥new_epoch. Test EDLGONF ✓: insert 2 keys, exists/delete/count_live/re-insert roundtrip. SigDB CRUD complete. 332/332 ALL PASS (FS e8b393a).
• Video: accelerated present path (PACCEL-PASS x86): tests/test_present_accel.sg: present_window_accel (comp_blit opaque span copy) + present_window_composite_accel (comp_composite src-over semi-transparent alpha blend, A=64 → ob=4 og=8 or=12 oa=255 oracle) + right-edge clipping (dx=78 with 4px window, only cols 78-79 land). Covers the accelerated present path the Lumen WM desktop compositor uses. PACCEL-PASS x86 (Video 7badae5).
• FS: SigDB range scan [lo,hi] — count/range/range_key (MANIFEST 331/0 FAIL): sigdb/range.sg: sigdb_range_count(lo,hi,snap) — count entries with lo≤key≤hi at snapshot; sigdb_range(lo,hi,snap,keys_out,vals_out,max_n) — bulk fill; sigdb_range_key(lo,hi,snap,idx) — Nth key in range. Same MVCC visibility rule as sigdb_scan; standalone (no scan.sg dep). Enables: paginated /db VFS readdir, directory-range listing, B-tree prefix scans. Test RTSAZ ✓: range [20,40]=3 (R), [99,99]=0 (T), [1,100]=5 (S), first key=20 (A), idx=2 in [20,40]=40 (Z). 331/331 ALL PASS (FS c6ec3b8).
• Video: SDF glyph builder + sampler test (SDF-PASS x86, sigil-os#15): tests/test_sdf.sg: half-on bitmap (cols 0-3 lit, 4-7 off) for char 'A'; sdf_build then texel distance oracle: deep-inside t0=192, mid-inside t1=176, edge-inside t3=144, edge-outside t4=112, deep-outside t7=64. Covers the signed-distance field rendering path for GPU SDF sampling (AA glyph rendering — Lumen font seam, sigil-os#15). SDF-PASS x86 (Video 2d0f659).
• FS: SMB 2.1 WRITE + CREATE codec (MANIFEST 329/0 FAIL): smb2_write.sg: write-side SMB 2.1 codec. smb2_write_call(buf, msg_id, tree_id, sess_id, fh_id, file_off, data_ptr, data_len) — WRITE body (StructureSize=49, DataOffset=112, FileId from fh table, data inline); smb2_write_parse → Count bytes written or -1. smb2_create_call(buf, msg_id, tree_id, sess_id, name_ptr, name_len) — CREATE body (OPEN_IF, GENERIC_WRITE, ASCII→UTF-16LE name); smb2_create_parse → fh_id stored in table or -1. Test WSPECRY ✓. 329/329 ALL PASS (FS 4cf0a60).
• Video: bitmap glyph text rendering test (GLYPH-PASS x86): tests/test_glyph.sg: synthetic 8×16 atlas at glyph_ram() (0xC0000); renders 'A' (row0=0xFF all-lit), 'X' (row0=0x80 MSB-only), space (blank). Verifies lit bits→colour, unlit bits→0, space writes nothing. Covers boot-splash text path (gglyph pixel oracle). GLYPH-PASS x86 (Video 9ea3b16).
• OS: rename rfb_encode→srdx_encode, rdp_session→srdx_session (Director directive): cc0/rfb_encode.sg→srdx_encode.sg; cc0/rdp_session.sg→srdx_session.sg; all rfb_encode_*/rfb_send/recv/net_*/rfb_handshake*/rdp_sess_*/rdp_session_*/rdp_listen/accept symbols updated to srdx_*; constants RDP_*/SRDX_* updated. Test files rdptest.sg/rfbhstest.sg updated. Protocol doc comments left as-is (OS c65f657).
• Kernel: build recursion guards for remaining direct-Interpreter functions: setrecursionlimit(200000) added at entry of x86_m1efi, x86_m4fs, x86_m5net, x86_m3login_kbd, x86_m1xhci, x86_m1login (all direct Interpreter.run_main() calls not through x86_runverify). Verified: m1boot ✓, m1efi ✓ (OVMF PASS), m5net ✓ (M5NET prs=1 lk=1 tx=58 rx=58 ok=1) (Kernel 88e1f2b).
• ⭐ Retropie: Sega Saturn — SH-2 + VDP2 backdrop — LAUNCHABLE system #43: cores/sh2.sg: Hitachi SH-2 CPU (16-bit fixed-width, big-endian, 16 GPRs + PC/SR/PR/GBR + MACH/MACL); delay-slot via pending state; default flat bus stubs overridden first-def-wins. Instructions: MOV imm/Rm/mem variants, ADD/SUB/AND/OR/XOR/NOT, CMP/EQ/GE/GT, DT, shifts (SHLL/SHLR/SHAR/SHLL2/SHLR2/SHLL16/SHLR16), BRA/BSR/BT/BF/BT-S/BF-S/JMP/JSR/RTS (delay-slot), STS/LDS PR, LDC/STC SR, TRAPA. cores/saturn.sg: 512KB boot ROM, 2MB work RAM-L ($06000000), 2KB VDP2 register shadow ($05E00000); sat_backdrop_argb RGB555@VDP2 offset $E0→ARGB; sat_render backdrop fill 320×224; core_run_frame 47633 SH-2 steps. EL0 app apps/saturn (25,880 B); ROM cap 512KB SECURE. uart=50 PASS. rp_count 42→43, rp_title(42)="saturn" (Retropie 31fc8c9).
• ⭐ Kernel: CLS_BUS HAL seam — 5th HAL contract complete (sigil-kernel#10): core/bushal.sg: PCI config reads/writes + BAR mapping through CAP_BUS gate, bus_route(id,op,a0,a1,a2,need) pattern. Real drivers: AArch64 ECAM (MMIO); x86 CF8/CFC port-IO; I2C SMBus. modules/busmodel.sg: modeled 4-entry PCI controller for QEMU (bdf/vid:did/cmd:status/class:rev/BAR0–BAR1 at 0x3C0000). Smoke: init/cfg_read/cfg_write/map_bar/cap-gate — BUS init=1 read=1 write=1 bar=1 gate=1 K PASS. All 5 HAL contract sigs shipped (CLS_INPUT/STORAGE/USBHOST/POWER/BUS) (Kernel 44fd896).
• Video: CEA-861 display mode-list test (DISP-CEA-PASS x86): tests/test_display_cea.sg: disp_build_modes collects native DTD + CEA-861 extension modes. CEA-stub reports 2 extra modes (1280×720, 720×480). Oracle: nmodes=3 native=1920×1080 cea0=1280×720 cea1=720×480; disp_modeset_index(0,0) no-crash. Full display detection seam (native + CEA) x86-verified (Video 9bd99a2).
• Video: EL0 audio syscall bridge test (AUD-EL0-PASS x86): tests/test_audio_el0.sg: verifies aud_handle dispatch for ratified EL0 audio ABI (syscalls 80-83). Cases: cap-denied open (→-1); cap-grant + open (stream id=0); submit 512 frames (→512); volume set (→0); close (→0); unknown syscall 99 (→-1). Pure in-memory, no hardware dep. AUD-EL0-PASS x86 (Video bf07346).
• OS: hw-probe EL0 app — hardware enumeration profile (sigil-os#17): hwprobe.sg: reads CPU/ISA, PCI vendor:device, USB VID:PID, EDID display size, MAC OUI from kernel HW-detect loopback stubs. Assembles flat key=value profile (cpu_isa=/pci=/usb=/display=/mac_oui=, one field per line). Content-addressed submit is consent-gated: caller must present HP_NET_TOKEN (0x484E5342); wrong/absent token returns -1 without touching network. Loopback: QEMU VGA 1234:1111, virtio-blk 1AF4:1000, USB hub 1D6B:0002, 640×480 display, OUI 52:54:00. Real HW-detect syscalls bind at integration unchanged. Test: 11 assertions — per-field checks, profile record structure (first line "cpu_isa=AArch64-v8.0\n" byte-verified), consent gate (wrong token→-1, correct→0). QEMU raspi3b PASS (74,200,160) (OS dca32c8).
• FS: SigDB /db VFS provider — keys as files, values as decimal content (MANIFEST 327/0 FAIL): sigdb/dbfs.sg: SigDB mounted as VFS filesystem provider ID=13. dbfs_vfs_readdir — iterates committed keys as decimal filenames; dbfs_vfs_resolve — parses decimal name → key, verifies present, returns node_id; dbfs_vfs_read — emits value as decimal string + newline. dbfs_atoi/dbfs_emit_u32 decimal codec (no string literals in Sigil). Snapshot epoch 2^30-1 sees all committed data. Test DBPRXVF ✓: readdir(0)="10"/readdir(1)="20"/past-end; resolve("10")=10/resolve("99")=-1; read(10)="100\n"/read(20)="200\n". ls /db lists all keys; cat /db/42 prints value. 327/327 ALL PASS (FS 4d37915).
• Video: display mode-selection + DPI derivation (DISP-PASS x86): tests/test_display.sg: disp_ingest_v → disp_get_edid → disp_build_modes with stubbed Drivers edid.sg boundary (edid_stubs.sg, linked before display.sg per cc0 forward-ref rule). Confirms connected=ok nw=1920 nh=1080 dpi=92 (1920×254/5270, integer), nmodes=1, native-mode=1920×1080, unplug=ok. Fixes the Drivers handoff seam in isolation — no cross-repo dep on edid.sg. DISP-PASS x86 (Video a639bfc).
• FS: SigDB crash recovery via WAL undo at boot (MANIFEST 325/0 FAIL): sigdb/recover.sg: sigdb_recover(base) — opens volume (magic check), if wal_tail>0 (uncommitted transaction) calls sigdb_wal_undo() to reverse all field mutations back to pre-transaction state; returns 0 (clean/recovered) or -1 (bad magic). STABLE pillar: a transaction is either fully committed or fully absent after recovery — no partial writes visible. recover_test.sg: commit key=1 val=100 (survives); insert key=2 val=200 no commit (crash sim); sigdb_recover → wal_tail cleared, key=2 vanishes, key=1 intact. Test RWICVEY ✓. 325/325 ALL PASS (FS 5f32a80).
• cc0: CI — macOS VM 201 x86 homebrew Python 3.12: VM 201 (192.168.1.113) is x86_64 macOS 26.5.1 with Intel homebrew at /usr/local. python@3.12 installed (3.12.13); tests need 3.10+ for str|None union syntax (PEP 604). PATH hardcoded with /usr/local/bin first; use python3.12 explicitly (cc0 6bad7a0).
• Retropie: MSX Turbo-R — R800 thin override — LAUNCHABLE system #42: cores/msx_turbo.sg: first-def-wins core_id=1991 on cores/msx2.sg; R800 CPU is Z80-compatible (shared z80.sg); V9938 graphics, AY PSG, slot layout unchanged. Test uart=49 PASS. EL0 app apps/msx_turbo (52,944 B); reuses msx2_app.sg entry (loads /roms/game.rom). rp_count 41→42 (Retropie 521c058).
• OS: Cap — PCM mixer with mic consent gate (sigil-os#14): audiosess.sg: 16-bit stereo 44100Hz (4B/frame). 8-slot session store at 0xA30000 (64B header each); per-slot ring 4096 frames (16KB); output ring 2048 frames (8KB). au_alloc(pid) → slot; au_write(slot,pid,buf,frames) with cap check; au_mic_grant(slot,pid,token) — consent gate, token must equal AU_MIC_TOKEN() sentinel (unguessable by EL0). au_mix_tick() drains ≤512 frames/session, per-session L/R vol scale (0..256), int32 sum → int16 clamp → output ring → au_hal_write loopback (real HAL binds at Kernel integration). Test: 8 assertions — alloc/pid/vol, dual-session, ring write/read, pid-auth rejection, mic wrong/correct token, mix_tick drain+clamp. QEMU PASS (74,200,160) (OS 8187fff).
• FS: shmem — cap-scoped shared memory segments (MANIFEST 322/0 FAIL): fs/sys/shmem.sg: 8-slot allocator with 4096B pages. shmem_create(cap_tag, pages) → seg_id; shmem_attach(id) → physical base, incr ref_count; shmem_detach/destroy (destroy blocked while ref_count>0); shmem_size/base. Direct physical-address access; zero-copy. Destroy guards prevent use-after-free. Completes IPC trinity (pipe/sigq/shmem). Test CSAWRDLK ✓. 322/322 ALL PASS (FS 1d209d8).
• Kernel: GPFSEL3_MASK arithmetic fix (Code flag on HAL): GPFSEL3_MASK was 614564416; correct sum of AF3 field values for GPIO 34-39 is 613564416 (off-by-1,000,000). Comment corrected. Pi4/GPIO41 GPSET1 issue open pending Pi model detection API (Kernel 76318fb).
• cc0: CI — Windows Rust path hardcoded for LocalSystem runner: USERPROFILE not set under LocalSystem service account; hardcode C:\Users\grio\.cargo\bin for sigil-runner-win11 (cc0 77c86ab).
• Retropie: Atari 8-bit — 6502A bus + GTIA + GR.0 render — LAUNCHABLE system #41: cores/at8.sg: first-def-wins m6_read/write over m6502.sg; bus: $0000-$BFFF=48KB RAM, $D000-$D01F=GTIA (COLPF0-3/COLPM0-3/COLBK), $E000-$FFFF=8KB OS ROM. NTSC YIQ at8_color; GR.0 40×24 char render (screen RAM $9C40, char ROM $E800); at8_bit MSB-first extraction; core_load reads 6502 reset vector from $FFFC-$FFFD. Test uart=48 PASS. EL0 app apps/atari800 (38,560 B). rp_count 40→41, rp_title(40)="atari 800" (Retropie 2bc19e0).
• FS: cap-scoped IPC ring buffer (MANIFEST 316/0 FAIL) + procfs scratch fix: pipe.sg: 8-slot bidirectional pipe store with 4096B ring per slot. pipe_create(cap_tag) → id; pipe_write/read/avail; pipe_close_write/read. Broken-pipe detection (write → -1 when reader gone); ring wrap-around (fill 4090 + 6-byte wrap, verify last byte); EAGAIN (-3) on full ring; reader reuse after both ends closed. Test CWAREFBX ✓. Fix: procfs scratch buffer overlapped sys_nodes (0x3C30C0..0x3C31C0 vs sys_nodes at 0x3C3100); moved proc scratch to 0x3C32C0. 316/316 ALL PASS (FS c5c216e).
• Video: ovl_display — x86 cross-verify (OVL-DISPLAY-PASS both-arch): tests/test_ovl_display.sg confirmed x86-metal QEMU: slot=ok disp=ok filter=ok. Overlay slot assignment, display-id routing, and filter logic both-arch verified (Video e835085).
• FS: sysfs — virtual /sys filesystem provider (ID 12, MANIFEST 313/0 FAIL): fs/sys/sysfs.sg: VFS provider ID 12 (vfs_sys_id()). Built-in nodes: build (id=0, "Sigil-FS 1.0 metal AArch64\n"), providers (id=1, "fat=3 nfs=1 smb=2 proc=11 sys=12\n"), pagesize (id=2, "4096\n"), word (id=3, "8\n"). sys_emit_u32, sys_vfs_resolve/read/readdir. Wired into vfs_dev.sg at provider ID 12 across all three dispatch paths. Test SYFBPGD ✓. 313/313 ALL PASS (FS 9aa676d).
• Video: sdf_term — x86 cross-verify (SDFTERM both-arch): backends/sdf_term_test.sg (previously ARM-only) confirmed on x86-metal QEMU: SDFTERM c0pos c1pos mono=1 aaPos ok=1 — monospace grid placement + AA partial-coverage pixels verified. SDF terminal seam passes both architectures (Video 25833c7).
• Kernel: ARP reply target IP offset fix 36→38 (Code flag on 5dc2487): wr_ip(p, 36, ...) overlapped the 6-byte target MAC field (cp_mac writes bytes 32–37). RFC 826 layout: target hw[32-37] + target proto[38-41]. Fix: wr_ip(p, 38, sender_ip) and matching test rd_ip(cap_buf(), 38). Test was written to match the bug — both corrected (Kernel 4fa4bee).
• Retropie: fix — remove duplicate GBC launcher slot (rp_count stays 40): GBC was already at slot 4 (rp_title(4)="game boy color"). A prior commit incorrectly added a duplicate slot 40 and incremented rp_count to 41. Reverts rp_count to 40, removes redundant slot 40 arm. apps/gbc is the dedicated binary for the pre-existing slot 4 (Retropie 7930c12).
• cc0: CI — macOS runner hardcoded PATH for ARM Homebrew: GITHUB_PATH prepend doesn't override because bash setup re-prioritizes /usr/bin. Fix: explicit env: PATH: with /opt/homebrew/bin first → Python 3.14 guaranteed on sigil-runner-macos (cc0 4804433).
• Video: gpu_tex — VRAM texture alloc + upload (GPU-TEX-PASS x86): tests/test_gpu_tex.sg: gpu_tex_alloc (VRAM bump allocator, distinct handles), gpu_tex_upload (copy_span path, 4-pixel sample verify), gpu_tex_pitch, gpu_tex_free. GPU-first table row: async DMA VRAM BLT (silicon) / copy_span CPU floor (current). Pairs with overlay GPU path and SDF font atlas (Video 3754b88).
• cc0: CI — Windows runner PowerShell (sigil-runner-win11): Switch all Windows steps to shell: powershell; Add-Content for GITHUB_PATH; Get-Item glob for fmt --check; python (not python3) for Windows py launcher. Fixes bash-not-in-service-PATH on self-hosted runner (cc0 6e2c1b7).
• Retropie: PC-88 — Z80A bus + 3-plane 640×200 + 8-color palette — LAUNCHABLE system #40: cores/pc88.sg: Z80A bus seam, 3-plane 640×200 framebuffer (planes R/G/B), 8-color palette decode → ARGB32. EL0 app + launcher entry (Retropie 22e3664).
• OS: Cap — capability-confined network sessions (sigil-os#12): netsess.sg: 16-slot table at 0xA10000 (64B/slot); each slot records conn_id, state (FREE/CONNECTING/ESTABLISHED/CLOSED), owner pid, send/recv seq counters. Cap check on every op: pid mismatch → -1, wrong state → -2. API: ns_alloc(pid), ns_connect(slot,pid,host,port), ns_send, ns_recv, ns_close. No ambient authority: broker owns TCP state, app holds only slot index. Wraps Kernel TCP stack (net/stack.sg 5dc2487); Kernel TCP syscall loopbacks replaced by real calls at integration. Test: 9 assertions — alloc uniqueness, pid binding, connect state machine, auth rejection, seq counters, recv-on-CONNECTING, close/reuse. QEMU PASS (74,200,160) (OS 098094a).
• FS: NFS3 VFS dispatch integration + fhandle table (MANIFEST 307/0 FAIL): Wire NFS v3 into vfs_dev.sg provider layer: vfsdev_resolve/vfsdev_readdir_path/vfsdev_statfs_path/vfsdev_read dispatch to nfs3_vfs_* when provider == vfs_nfs() (ID=1); SMB stub (ID=2) returns -2 pending smb.sg. Added: fhandle table (nfs3fh_base/slots/store/free), nfs3_vfs_mount, nfs3_vfs_resolve (root-path check before transport guard — returns root_fh_id without live socket), nfs3_vfs_read/readdir/statfs (fail-closed stubs, return -1 when send_fn==0). Test FTRVU ✓. MANIFEST 307/0 FAIL (FS 5683a26).
• Video: VT100/ANSI escape sequence parser (VT100-DEC-PASS x86): core/vt100_decode.sg: full VT100 byte-stream parser → cell buffer. Handles printable ASCII, \n \r \b, and ESC[ CSI: cursor movement (A/B/C/D), cursor position (H), screen erase (2J), SGR colors (30-37 fg, 40-47 bg, 0 reset, 1 bold). State at 0x943000. Pairs with vt100_fb.sg for the Lumen terminal stack. GPU-first: SDF atlas (pending make_font/sigil-os#15) / bitmap floor (Video d713a9a).
• cc0: CI — GITHUB_PATH for Rust on self-hosted runners: Replace hardcoded /home/runner/.cargo/bin with echo $HOME/.cargo/bin >> $GITHUB_PATH (works Linux/macOS); Windows uses $USERPROFILE/.cargo/bin. Removes job-level env: PATH override that was hiding the real home directory (cc0 042321f).
• Retropie: Sharp X68000 — MC68000 bus seam + GVRAM 4bpp + RGB555 palette — LAUNCHABLE: cores/x68k.sg: MC68000 bus seam (reuses m68k.sg), GVRAM 4bpp tile/sprite layer, RGB555 palette decode → ARGB32. EL0 app + launcher entry. PARITY.md: X68000 launchable (Retropie 42627cc).
• FS: NFS v3 client — ONC RPC codec + GETATTR/LOOKUP/READ/READDIR: fs/net/nfs3.sg: full XDR codec (big-endian u32/u64/opaque) + ONC RPC CALL builder + REPLY validator. Procedures: GETATTR (1) — fattr3 parser (type/mode/uid/gid/size/fileid/mtime); LOOKUP (3) — dir fhandle + name → fhandle; READ (6) — fhandle + offset + count → data + eof; READDIR (16) — cookie-based entry iteration. Transport-injected: nfs3_set_transport(send_fn, recv_fn) binds to any socket at mount time. Protocol layer for Network FS RFC (issue #3); vfs_dev.sg provider IDs 11=SMB/12=NFS wire-up is the next integration step. Test XGALRDE ✓. MANIFEST 305/0 FAIL (FS f04106d).
• cc0: CI — system python3 + macOS Rust PATH on self-hosted runners: Drop actions/setup-python from all self-hosted jobs (toolcache absent); call python3 directly. Add ~/.cargo/bin to macOS runner PATH so rustc resolves. Windows jobs fall back to python if python3 isn't aliased (cc0 5d9eae4).
• Kernel: netconn — SRDX 0.6.0 transport lane, syscalls 109-112 (net_conn_listen/send/recv/close): TCP data plane in net/stackdata.sg (tcp_send_data/recv_data/store_rx + stack_poll_data). core/netconn.sg: netconn_dispatch → tcp_listen/send/recv/rx_clear, CAP_NET-gated. host.sg wired sys 109-112 + tcp_rxbuf_init() at boot. QEMU PASS: NC listen=1 estab=1 send=1 recv=1 close=1 K. Kernel lane of SRDX 0.6.0 complete — unblocks OS session manager and Apps viewer to stream over this seam (Kernel 0b932b9).
• Video: SRDX client-side delta applier + GPU_FIRST table update: core/srdx_decode.sg: srdx_decode_frame(pkt,fb,pitch,fbw,fbh) validates SRDX magic, walks n_rects, blits each dirty rect via copy_span. Round-trip verified: encode→decode recovers pixel (65,0)=7; clean tile (0,0)=0 untouched; bad-magic returns -1. GPU path: GPU BLT rect silicon-pending; CPU floor copy_span. docs/GPU_FIRST_RENDERING.md updated with SRDX encoder, VT100-FB renderer, and overlay display routing entries (Video b10fea5).
• Video: per-slot display routing parallel array (OVL-DISPLAY-PASS x86): core/overlay_z.sg: ovl_display_buf() parallel array at 0x929200 (8×Int64, ABI-non-breaking); ovl_slot_display/ovl_set_display/ovl_for_display accessors; multi-CRTC present path can now filter overlays by display_id. core/gpuhal.sg: ovl_buf() (0x929000) promoted from present_accel_ovl.sg as HAL-level constant; overlay_request_display writes display_id to ovl_display_buf directly. QEMU PASS (Video e00913d).
• FS: SRDX ephemeral frame-buffer backing store: srdx_store.sg: 8-slot session store at 0x3C0F08, 256KB frame pool at 0x3E0000 (8 × 32KB). Each slot holds one pending encoded frame (newest-wins, ring depth 1). Producer: srdx_store_push(sess, ptr, len). Consumer: srdx_store_pop + srdx_store_ack. seq counter lets consumer detect fresh frames without copying. SECURE: push/pop check active flag; cross-session access impossible (slot index is the only EL0 handle); frames >32KB rejected. Test: OPQRASX ✓. MANIFEST 301/0 FAIL (FS 62edf5d).
• OS: RFB 3.8 session handshake — VNC client negotiation: rfb_encode.sg gains rfb_handshake() completing RFB protocol negotiation before FramebufferUpdate packets. Phase 1: ProtocolVersion ("RFB 003.008\n" exchange). Phase 2: Security ([1 type][type=1 None] + SecurityResult=0x00000000). Phase 3: ServerInit (w/h u16 BE, 16-byte pixel-format, 32bpp/24depth/true-colour, r-shift=16 g-shift=8 b-shift=0, name). All multi-byte fields big-endian via rfb_pu16/rfb_ps32. Loopback stubs (rfb_send/rfb_recv) are no-ops; real Cap<NetConn> binds at integration. Test rfbhstest.sg: 18 assertions across banner bytes, SecurityResult zeros, ServerInit w/h/pixel-format/name. QEMU PASS (74,200,160) (OS e10dae1).
• Video: VT100 framebuffer text renderer — 8×16 cells, bg fill + bitmap glyph: core/vt100_fb.sg: vt100_fb_render_cell(fb,pitch,cx,cy,char,fg,bg) renders one 8×16 text cell into the GPU framebuffer; vt100_fb_render_row renders a full row from 24B-stride cell buffer (char/fg/bg triples). Three tiers: GPU SDF (pending make_font/sdf.sg atlas) → bitmap glyph (8×16 font8x16.bin layout, via vt100_set_font()) → bg-only fill (before font loads). Glyph bit extraction via integer division (no bitwise). PASS: bg fill ✓, 3-cell row dispatch ✓, MSB-first glyph bit decode (170=0b10101010 → col0=fg, col1=bg, col2=fg) ✓ (Video bb479df).
• Kernel: SYSCALLS.md — NET_LISTEN (109) + NET_ACCEPT (110) reserved: net_listen(port, backlog) → 109 RSVD pending Director ratification; net_accept(port, out_rip, out_rport) → 110 RSVD. Free ranges corrected to 111+. Dispatch section updated: 103-108 overlay_dispatch (106/107 Z-order, 108 watchdog) (Kernel 3111fac).
• cc0: CI — self-hosted Windows + macOS runners: test-windows points to [self-hosted, sigil-windows] (PROXMOX-WIN11 VM 300, online); test-macos added with [self-hosted, sigil-macos] (macOS VM 201, registering). actions/setup-python dropped from both (pre-installed on self-hosted runners) (cc0 0d6c786).
• Video: SRDX delta encoder — tile-based dirty-rect frame diff: core/srdx_encode.sg: srdx_encode_frame() compares current fb vs shadow (last-sent copy) in 64×64 tiles, extracts dirty tiles as SRDX delta packet (magic 0x53524458, seq, n_rects, rect headers + pixel data). srdx_encode_init() zeros shadow for first frame. GPU path: tile-diff → GPU compute shader; pixel copy → GPU DMA (silicon-pending); CPU scalar floor via copy_span/accel_tier()=0. PASS: nrects1=1 (one dirty tile), nrects2=0 (shadow caught up), magic/seq/rect-header correct. Public surface: srdx_encode_frame(fb,shadow,fw,fh,pitch,out_buf)->bytes + srdx_encode_init(shadow,w,h) (Video 8f9de77).
• Video: overlay Z-order slot management + gpu_tex upload path + multi-monitor stub: core/overlay_z.sg: parallel Z array at 0x929100 (8B×8 slots, separate from 32B x/y/w/h stride); ovl_slot_z/ovl_set_z; overlay_raise/overlay_lower (syscalls 106/107 Video-side); ovl_z_sort() selection sort (highest-Z first into scratch at 0x929140); present_window_accel_z_ovl() Z-sorted hole-punch present (up to 2 disjoint overlay spans per row; n_ovl==0 zero-overhead, identical to present_window_accel). core/gpu_tex.sg: gpu_tex_alloc(w,h,fmt) VRAM bump alloc; gpu_tex_upload(tex,src,n_bytes) CPU copy_span + gpu_submit fence (DMA on silicon); gpu_tex_free no-op bump model. core/gpuhal.sg multi-monitor stub: display_enum(), display_fb/w/h/pitch(id), overlay_request_display(display_id,x,y,w,h) (display_id encoded in bits 32+ of h field). QEMU PASS (x86-metal): Z-ORDER-PASS z0=hole z1=hole mid=hole outside=red, GPU-TEX-PASS alloc=ok upload=ok free=ok, DISPLAY-ENUM-PASS. Evidence: evidence/overlay-z-x86.png (Video 95729f2).
• Kernel: WiFi per-arch power seams + wifihal banner upgrade: hal/aarch64/wifipwr.sg: BCM43455 bring-up seam for RPi — wifi_hw_init() = WL_REG_ON (GPIO 29 high via GPSET0) + SDIO pinmux AF3 for GPIO 34-39 (GPFSEL3); all MMIO guarded by wifi_hw_present() (WIFI_HW_FLAG at 0x560020), QEMU-safe. hal/x86/wifipwr.sg: PCIe WiFi D0 power seam — reads BDF from WIFI_BDF, reads PM_CTRL via CF8/CFC I/O, clears D-state to D0; guarded by WIFI_HW_FLAG_X86 at 0x570020, QEMU-safe. core/wifihal_test.sg banner upgraded: WIFI guards=1 → WIFI scan=1 assoc=1 eapol=1 key=1 ip=1 guards=1 — all 8 checks pass (Kernel 107ad5f).
• Kernel: net/stack.sg — ARP + IPv4 routing + TCP skeleton wired to GENET RX/TX: ARP (0x0806): replies to requests targeting our IP + opportunistic MAC learn (IP→MAC from ARP sender hw addr and IPv4 src→Eth src); 8-slot ARP cache at 0x580000, FIFO eviction. IPv4 routing: 4-entry route table at 0x580080, longest-prefix match via CIDR mask arithmetic (no bitwise ops: host_bits = 2^32 - mask, masked_ip = ip - ip%host_bits); /0 default route supported; most-specific wins. TCP state machine: LISTEN → SYN_RCVD (passive open + SYN-ACK built + sent) → ESTAB (ACK) → FIN_WAIT (FIN); 4-slot conn table at 0x5800C0; RST tears down matching conn; SYN-ACK built in PKT_SCRATCH (54B Eth+IPv4+TCP, checksums=0 / GENET hw offload v1). stack_rx(frame, flen) dispatches by ethertype; stack_poll() ingests via net_recv_raw → stack_rx (kernel tick hook); stack_init() loads NET_CFG (IP+MAC+default-gw at 0x5801C0) from host.sg main. QEMU PASS: STACK arp=1 arpl=1 route=1 tcp=1 K (Kernel 5dc2487).
• OS: overlay_input_dispatch Z-order fix + loop invariant (Code flags): Scan direction was 0→7 (lowest-index hit) — incorrect because higher slot index renders on top. Fixed: scan 7→0 so first hit is topmost visible overlay. Loop invariant i >= 0 added per cc0 checker convention. Test: z-order overlap assertion added (slot 2 at [120,210,100×80] overlapping slot 0 at [100,200,320×180]; point (150,250) → pid=99 slot 2 wins). 8/8 assertions PASS (OS d5e9908).
• cc0: canonicalize remaining selfhost/*.sg (fmt pass): sigil fmt --write on all remaining selfhost/*.sg files — no behavior change (cc0 68d5eb6).
• Retropie: Neo Geo ② — .neo header parser + C-ROM deplanarizer (sprite tiles show game graphics): core_load detects "NEO\x01" 64-byte header (PSZ/SSZ/MSZ/V1SZ/V2SZ big-endian @4..23), splits P-ROM + C-ROM. ng_crom_deplane converts merged C1/C2 interleaved 4bpp planar tiles (bp0|bp2|bp1|bp3 per 8-px half, MSB=left) into packed nibble format for ng_tile_pixel. ng_char_max state-based (ng_st @12); buffer 2048→4096 tiles / 512KB; EL0 app buffer 1MB→8MB at 0x1000000 for full .neo files; ng_shr fast bit-extract. Test neogeo_crom: uart=19 PASS. apps/neogeo 48864B (Retropie dbfa680).
• Retropie: FDS — NES bus hook + BIOS load + core ABI + EL0 app — LAUNCHABLE system #40: cores/fds.sg: core ABI (core_id=40), fds_load_bios (copies BIOS to n6_mem $E000), fds_mode_on/off. Linked first → first-def-wins overrides nes.sg stubs. nes.sg: FDS intercept stubs + 3-line n6_read/n6_write guard on fds_mode() — zero overhead for all existing NES ROMs. EL0 app fds_app.sg (91536 B, 0 undecodable) loads /roms/fds_bios.rom (8KB) + /roms/game.fds (up to 256KB), hooks disk streaming via $4031/$4032, blits 256×240, submits FDS wavetable audio. Test fds_core.sg: uart=40, 5M steps — ABI, fds_mode toggle, disk load+read, register dispatch, BIOS copy, wavetable fill. PARITY.md: FDS 🟡→✅ (Retropie f31c7bc).
• FS: SigDB Cap broker API + complete WAL undo (Code flag fix on b53254e): WAL fix: previous sigdb_wal_write saved only old_cur_val; cur_epoch/prev_val/prev_epoch were lost on crash. Replaced with sigdb_wal_append(ftype, page_no, eidx, old_val) — 4 records per update (cur_val+cur_epoch+prev_val+prev_epoch), 1 for new-key (nkeys). Added sigdb_wal_undo() for reverse-order restore; sigdb_del() for physical compaction. Cap<DBTxn> broker layer in sigdb/cap_txn.sg: sigdb_cap_open(base, mode) → opaque slot handle (0..3, mode 1=RO/2=RW); sigdb_cap_txn_begin/commit/rollback (rollback calls sigdb_wal_undo()); sigdb_cap_get/put/del — SECURE: put/del check mode==2 before any write; EL0 holds only slot Int, broker owns db_base/mode/snapshot_epoch. Test: OPCGRSKV ✓. MANIFEST 289/0 FAIL (FS e005749).
• Kernel: overlay Z-order — syscalls 106/107 fb_overlay_raise/lower (Director T1 ①): Adds OVL_Z field (offset 48 in the 64B slot record, between OVL_PID and OVL_LIVE) tracking each overlay's compositor depth. Default Z = slot index; raise/lower swap values, keeping Z set a unique permutation (no duplicates, no renumber). overlay_raise(buf): swap with max-Z live slot → front. overlay_lower(buf): swap with min-Z live slot → back. overlay_present: changed from slot-index iteration to N-pass ascending-Z blit (lowest Z first = background, highest Z last = foreground). overlay_hittest: changed from descending-index scan to single-pass max-Z search among hit slots — correctly finds frontmost overlay regardless of slot. Cap-gate range extended 103–105 → 103–107 (CAP_FB_OVERLAY); SYSCALLS.md updated. QEMU PASS: OVL alloc=1 rel=1 list=1 deny=1 hit=1 z=1 K (Kernel 3c258d6).
• cc0: arm64.sg fmt canonicalization: sigil fmt --write pass on selfhost/arm64.sg — no behavior change (cc0 7eed178).
• OS: overlay_input_dispatch — pointer routing to DSO slot owners (Director T1 ②): cc0/wmoverlay.sg gains overlay_input_dispatch(x, y) -> pid: scans OVL_META@0x900000 (up to 8 slots, 48B stride; x@0 y@8 w@16 h@24 fb_buf@32 pid@40) for the first active slot (w>0) whose region contains (x,y), returns the owner pid (or -1 — WM takes the event normally). Call at the start of pt_dispatch/wm_pointer_down before wm_hit. Closes the overlay input pipeline: Kernel allocates slot → Video punches scanout hole → OS routes pointer to slot owner. Also adds OVL_META() constant (0x900000). Test ovlinputtest.sg: 2-slot fake OVL_META (pid=42 at 100,200,320×180; pid=77 at 500,100,200×300), 7 cases (2 hits, 4 misses, 1 inactive bypass w=0), raspi3b PASS (OS dd42eca).
• cc0: CI fix — keystone-engine + capstone added to pip install: Fixes test_armgen + test_selfhost_arm64/armcg import errors that were blocking the CI-red PRs #75/#77/#78. Pre-existing gap in the CI environment, surfaced after seed fixes unblocked earlier stages (cc0 127f985).
• FS: SigDB storage engine — page manager, MVCC, WAL, Cap: New sigdb/store.sg implements the SigDB backend required by the SQL planner. 4KB page manager with 32-page bitmap free-list (freemap in header). B-tree leaf node with sorted Int-keyed entries, insert/lookup, K_MAX=101. MVCC: 2-version per entry (cur+prev); cur_epoch ≤ snap → cur_val, prev_epoch > 0 and ≤ snap → prev_val — isolates concurrent transactions across commits. WAL: 16-byte records (page_no+entry_idx+old_cur_val) written before any mutation, reset on commit (crash-safe by construction). Cap<DBTxn>: sigdb_txn_begin() returns opaque epoch snapshot; broker holds the authoritative transaction table; EL0 never touches raw state. Test sigdb/store_test.sg verifies all 6 properties: format+open (F), insert (I), lookup (L), WAL integrity (W), MVCC isolation (M), alloc/free round-trip (A) — FILWMA ✓. MANIFEST 285/0 FAIL (FS b53254e).
• OS: tearoff_hit off-by-one + rounded border corners (Code flags): Two correctness fixes for cc0/tearoff.sg. tearoff_hit: hit zone started at my (the border pixel) but tearoff_draw paints the bar at my+1 — off-by-one caused a border-pixel click to falsely trigger a tearoff drag. Fixed: zone now [my+1, my+tearoff_bar_h()+1). tearoff_palette: border was four flat rad=0 strip rects that squared off the rad=6 anti-aliased body corners, leaving visible artefacts. Fixed: draw full outer rounded rect in border colour first (rad=6), fill inner body second (rad=5, shrunk 1px each side). Pixel-verified on x86 QEMU: border (42,44,68) at top+left edges, body (21,18,43) inside, dot rows at y=92+93, border row 88 clean. Both Code flags cleared (OS 01debf7).
• Kernel: 7 compile-only builds upgraded to arm_runverify + QEMU verification: Matches the standard set by nethal/wifihal/tagq — each now boots raspi3b, captures PL011 serial, fails on unexpected output. Upgraded: usbenum (USB VID:PID/class → modmgr_match, expect='K'), sdio (SDIO c52=1 c53=1 blk=1), dtenum (DT compat hash, expect='K'), modload (modalias→match→load→gate, expect='K'), netsys (NETSYS tx=64 rx=64 s=1 b=1 f=1 dr=1 rf=1 rp=1 l=1), fshal (FSHAL wn=32 rn=32 s=1 d=1 o=1), usbhal (xHCI probe/reset/control-xfer, expect='K') (Kernel d364da9).
• cc0: bootstrap fixpoint stage3 output-path fix: test_bootstrap_fixpoint stage3 reused stdin (which specifies cc0_stage2.bin as output) but checked for cc0_stage3.bin — always failing once the stage1≠stage2 failure was cleared by the seed fixes on the PR branches. Fix: use stdin3 with cc0_stage3.bin as the output path. Pre-existing bug on main, newly visible after seed fixes unblocked earlier stage (cc0 53a449e).
• Kernel: watchdog PM_BASE address fix — Pi3 physical correctness: PM_BASE was 0x7E138000 (wrong BCM bus alias) → 0x3F100000 (correct Pi3 ARM physical: BCM2835 bus 0x7E100000 → ARM physical 0x3F100000). PM_RSTC/PM_WDOG derived addresses corrected accordingly. Non-functional on QEMU (all MMIO writes behind wdog_hw() guard) but wrong on real Pi3 silicon. QEMU PASS WDOG start=1 feed=1 stop=1 deny=1 K unchanged (Kernel 84d1c71).
• FS: Btrfs 3-component key comparison fix in btrfs_find_leaf: Without key.offset in the predicate, two internal-node key pointers sharing the same (objectid, type) but different offsets collapsed to the same match result — btrfs_find_leaf would always select the later (wrong) leaf. Fix: extend comparison to the full Btrfs key order (objectid → type → offset). New btrfs_koff_test.sg: 2-pointer root with identical (256,84) keys but offset 0 vs 500; off_hint=42 selects leaf_A (bytenr 73728), off_hint=9999 selects leaf_B (77824). Expected "AB"; arm_emit+cc0 ✓. MANIFEST 281 entries, 0 FAIL (FS fb579ad).
• Kernel: hardware watchdog seam — syscall 108, BCM2835/2711 PM gate (Director ③): CAP_ADMIN-gated watchdog — if the kernel hangs without petting the timer, the BCM PM watchdog resets the system. Syscall 108 ABI (a0=op, a1=timeout_ms): 0=feed (returns -1 if not running), 1=start (sets WDOG_STATE=1, loads ticks), 2=stop, 3=status (returns remaining ticks, 0 if stopped). Silicon path (bcm_nic_present/wdog_hw guard): pokes PM_RSTC + PM_WDOG with 0x5A password in bits[31:20] via arithmetic (PM_PASSWD + ticks % 1048576) — no bitwise. Silicon-free state at WDOG_STATE (0x550000). wdog_dispatch() routed from host.sg syscall_dispatch behind cred_check(CAP_ADMIN). QEMU PASS WDOG start=1 feed=1 stop=1 deny=1 K (Kernel 5b975e6).
• ⭐ Retropie: CPS-3 — LAUNCHABLE system #39: Capcom Play System 3 (JoJo's Bizarre Adventure, Street Fighter III era) — 68020 modeled as 68000 + 32-bit address space (no 24-bit mask); m68k.sg reused unchanged, unknown 68020 opcodes fall through as NOP. cores/cps3.sg: 32MB SIMM ROM (cps3_rom 0x1B000000), 2MB RAM (cps3_ram 0x1D000000), 384×224 framebuffer, palette at 0x1D200000 (15-bit little-endian bus writes). Bus map: ROM $00000000-$01FFFFFF, RAM $02000000-$021FFFFF, palette LE $04000000, video regs $04100000. cps3_backdrop() fills fb with palette entry 0 each frame. core_id=39, core_fb=384×224, core_run_frame ~200K 68020 steps + backdrop. EL0 app: /roms/game.cps3 (32MB cap, SECURE). Blob: 35,256B, 0 undecodable. uart=65 PASS. Launcher rp_count 36→37, rp_title(36)="cps-3" (Retropie d82cbeb).
• Kernel: BCM54213 GENET v5 TX descriptor ring (Director ②): Mirrors the RX ring structure — same [len_status:4][buf_addr:4] 8B descriptor layout, same OWN bit (bit 2=4) with reversed convention: SW sets OWN=1 to hand frame to NIC, NIC clears on completion. tx_ring_init(): all 8 slots SW-owned (OWN=0), buf_addr set, programs TDMA ring-0 regs behind bcm_nic_present() guard. bcm54213_tx_send(): copies frame to tx_buf(slot), sets OWN=1 + length in bits[27:16], kicks TDMA_WRITE_PTR doorbell on HW, returns -1 on ring-full. tx_ring_poll(): advances consumer past NIC-completed slots (OWN=0), calls tx_ring_free() per reclaimed slot. QEMU PASS BCM54213TX init=1 tx=1 comp=1 wrap=1 full=1 K — slots OWN=0 + correct buf_addr; 64-byte frame queued OWN=1; nic_tx_complete()+tx_ring_poll() reclaims 1 slot; producer wraps mod 8; 9th send returns -1 (ring full) (Kernel f0160db).
• Kernel: BCM54213 GENET v5 RX descriptor ring — NIC seam (Director ① networking): 8-slot DMA ring at BCM_DESC_BASE (0x500000) / BCM_BUF_BASE (0x501000); 8B descriptors [len_status:4][buf_addr:4]; OWN bit (bit 2 / value 4) follows GENET convention (1=NIC-owns / 0=SW-owns). No bitwise ops — /+% arithmetic throughout. rx_ring_init(): fills all 8 slots NIC-owned, programs GENET RDMA ring-0 registers (START/END/RING_BUF_SZ/PROD/CONS/CFG/CTRL) behind bcm_nic_present() guard (safe on raspi3b QEMU). rx_ring_poll(): OWN-clear detection, length extraction bits[27:16], byte copy, descriptor recycle, consumer advance. bcm54213_*(): BCM54213PE PHY MDIO stubs (reset/autoneg/link_up). QEMU PASS BCM54213 init=1 rx=1 wrap=1 K — 8 descriptors OWN-set + correct buf_addr; 64-byte frame byte-exact to slot 0; consumer wraps mod 8, slot 0 recycled at cons=8 (Kernel 2e113e9).
• Kernel: nethal/wifihal/tagq QEMU run-verify (compile-only → arm_runverify): Three previously compile-only builds upgraded to arm_runverify with raspi3b PNG + serial assertion: build_nethal PASS 'K' — LAN9514 loopback TX/RX + cap-gate via net_route; build_wifihal PASS 'K' (serial WIFI guards=1) — 802.11 scan/assoc/EAPOL/key/IP round-trip via wifi_route (Director #108 PRIMARY WiFi lane); build_tagq PASS 'K' (serial TAGQ route=1 inject=1 unpack=1 deny=1) — all 12 tag-query verbs, kernel-injected session slot, cap-deny. Root cause of nethal linker hang: lan9514.sg's nic_link_up() called dwc2_ctrl() unconditionally; fixed with core/dwc2_stub.sg — single dwc2_ctrl() → return 0 satisfying the linker without HW (Kernel 730991e).
• ⭐ Retropie: CPS-2 — LAUNCHABLE system #38: Capcom Play System 2 (Super Street Fighter II Turbo, Dungeons & Dragons, Marvel vs. Capcom era) — zero new CPU code, pure reuse of m68k.sg + CPS bus-seam pattern. cores/cps2.sg: 8MB 68000 ROM (cps2_rom 0x18000000) + 8MB GFX (cps2_gfx 0x18800000); BG1 scroll layer (opaque) + BG2 scroll layer (transparent: pxi=0 → skip), shared c2_render_bg(map_base,sx,sy,transparent); CPS-A regs for BG1/BG2 tilemap addr + scroll X/Y at $9A0000; 512-entry 15-bit palette (1024B at $900000, same format as CPS-1); core_id=38, core_fb=256×224, core_run_frame (~167000 68000 steps + BG1+BG2). EL0 app: /roms/game.cps2 (16MB cap, SECURE). Blob: 38,496B, 0 undecodable. uart=64 PASS. Launcher rp_count 35→36, rp_title(35)="cps-2" (Retropie f0cadaa).
• Retropie: CPS-1 + N64 correctness batch (Code audit): CPS-1 (cores/cps.sg) — cps_pal_argb now reads palette as big-endian (high byte×256 + low byte) matching 68000 bus write order via gn_write16 (was little-endian — wrong colors); cps_render_bg row mask and 27 → and 31 (correct 32-row wrap, was truncating tilemap). N64 (cores/n64.sg) — removes bogus n64_setr(29, 0x80B90000) SP init (ROM entry sets its own SP); clamps n64_display render width to 320 to prevent OOB writes when VI_WIDTH > 320. Rebuilt: apps/cps 36656B, apps/n64 25032B, 0 undecodable each. Tests: cps_core=63 PASS, n64_cpu=61 PASS (Retropie 58e2a45).
• Video: ARM boot screen arm_nodey(12) explicit fix + Vulkan compute ABI stub (1.5 track): Follow-up to 7b9c1e6 — arm_nodey(12) now has an explicit if n == 12 { return 0 - 200; } branch (EL0 outer-ring node named, not implicit fallthrough). SIGBOOT-ARM-OK still passes on raspi3b. Also adds core/gpu_compute.sg: Vulkan compute ABI stub for the 1.5 milestone — gpu_compute_queue_alloc(gpu_cap)→Int, gpu_compute_submit(queue_cap, shader_blob, args)→fence, gpu_compute_queue_free(queue_cap) — GPU-first/software-floor comments; stubs return −1/0 (silicon-pending); links gpuhal.sg (CAP_ACCEL, gpu_fence_wait) (Video 43a9561).
• FS: Btrfs multi-level B-tree traversal — real-volume correctness fix (FS #10 follow-up): btrfs.sg previously assumed the FS-tree root was always a leaf (level=0), failing silently on any real Btrfs volume where the root is an internal node. Fix: btrfs_find_leaf(oid_hint, typ_hint) descends internal nodes by choosing the rightmost key pointer whose key ≤ (oid_hint, typ_hint), iterating until level==0. New btctx()[24] (curleaf) field stores the resolved leaf bytenr; btrfs_find and btrfs_readdir both call btrfs_find_leaf and use bt_curleaf() for data_off. btrfs_mount initialises curleaf = fsroot. 2-level test (btrfs_btree_test.sg): internal root → leaf, proves find+read+readdir traverse correctly; FRDTNE; arm_emit+cc0 ✓. MANIFEST 278 entries, 0 FAIL (FS 40d763f).
• FS: Btrfs readdir via DIR_INDEX + full magic check (FS #10): btrfs_mount now verifies all 8 bytes of "_BHRfS_M" (was 4/8 — closes Sigil-Code flag "Btrfs 4/8 magic minor"). btrfs_readdir: scans FS tree leaf for objectid=256, type=96 (DIR_INDEX) items in sorted order, fills canonical dirent (location.objectid/otype/namelen/name). vfsdev_readdir_path wired for vfs_btrfs() root case. Two test suites: btrfs_rd_test.sg (standalone) + vfs_btrfs_rd_test.sg (via VFS dispatch) — both → "DTNE", both arm_emit+cc0 ✓. MANIFEST 275 entries, 0 FAIL (FS 02878bf).
• FS: HFS+ empty-file stat correctness fix (Sigil-Code audit): hfs_find_in was encoding logicalSize in the high 32 bits of the packed ID — for empty files (logicalSize=0), id/shift32==0 which vfsdev_stat_path read as "directory" (same encoding as folderID). Fix: store logicalSize+1 so any file always has id/shift32≥1; vfsdev_stat_path and vfsdev_size_path subtract 1 to recover real size. Empty file now correctly reports otype=1, size=0. All prior HFS+ VFS tests (RS/DTNE/RSD/DTNER) still pass; new vfs_hfs_empty_test "S" covers the edge; both arm_emit + cc0 verified. MANIFEST updated to include btrfs.sg (now referenced by vfs_dev.sg) (FS 766d584).
• ⭐ FS: HFS+ read-only provider COMPLETE (FS #9): Full feature matrix wired — mount, read, stat (file+dir), readdir (root+subdir), multi-component path resolve. hfs_readdir_in(pid, index, ent) generalises readdir over any folderID; hfs_readdir() is a thin wrapper for pid=2 (root). vfsdev_readdir_path HFS+ subdir case: walks sub-path via copy_comp+hfs_find_in → target folderID → hfs_readdir_in. vfs_hfssubrd_test.sg subdir+root cross-check → "DTNER", arm_emit ✓. MANIFEST 268 entries, 0 FAIL (FS bd8180e readdir → 52ea944 subdir/complete).
• FS: HFS+ wired into VFS dispatch (provider #9, read-only): vfs_dev.sg adds vfs_hfs()=9; dispatches hfs_mount+hfs_find in vfsdev_resolve, hfs_read in vfsdev_read; size/stat fall through to packed-id path (id = startBlock + logicalSize*shift32). vfs_hfs_test.sg: VFS-contract round-trip (read + stat) → 'RS'; arm_emit 'RS' ✓ (FS 7ded8ec).
• FS: HFS+ read-only provider (FS #9) — mount + find + read: hfs.sg adds Apple HFS+ (1998-2019 macOS filesystem) as a read-only VFS provider. Big-endian VolumeHeader parse (blockSize@40, catalogFile.extents[0].startBlock@288); catalog B-tree leaf scan (single-level): BTNodeDescriptor (numRecords@10, offset table at node[nsz-2*(i+1)]); HFSPlusCatalogKey (keyLength+parentID+UTF-16BE nodeName); HFSPlusCatalogFile (recordType=2, dataFork at +88 — logicalSize@+4, startBlock@+16). Self-contained ramdisk test (hfs_test.sg): blockSize=512, catalog at block 4, file at block 6. arm_emit→"FR", cc0→"FR". MANIFEST 264 entries, 0 FAIL (FS514f23e`).
• ⭐ FS: NTFS VFS milestone — all 13 verbs complete (0.3.x): vfsdev_stat_path verified for NTFS closes the last open VFS verb. Stat contract: file → otype==1, size==24; directory → otype==2. arm_emit→"SD", cc0→"SD". **NTFS VFS is now fully wired:** create / write / read / append / mkdir / rename / unlink / truncate / stat / statfs / readdir / resolve — 13vfs_ntfs*tests all green (FS9bae711`).
• FS: NTFS mkdir + alloc-rec correctness fix (0.3.x): ntfs_alloc_rec now starts at record 12 (was 6) — NTFS reserves records 0-11 for system files ($MFT, $MFTMirr, $LogFile, $Volume, $AttrDef, ., $Bitmap, $Boot, $BadClus, $Secure, $UpCase, $Extend); the prior 0-5 boundary was wrong (flag raised by Sigil-Code). ntfs_readdir flat scan updated to match. ntfs_mkdir allocates a new MFT slot with Flags=InUse|Directory(3), $FILE_NAME (ParentRef=5, FileAttrs=0x10), and a minimal $INDEX_ROOT (16-byte root hdr + INDEX_HEADER + LAST_ENTRY marker). Wired via vfsdev_mkdir_path → ntfs_mount_at + ntfs_mkdir. All prior NTFS tests green; vfs_ntfsmkdir_test.sg arm_emit→"MD", cc0 compiled (FS c6dd46c).
• FS: NTFS flat-MFT readdir fallback (0.3.x): when $INDEX_ROOT (0x90) is absent, ntfs_readdir falls back to a parent-filtered MFT scan (records 6..31) — enables ls on minimal NTFS volumes. ntfs_alloc_rec starts at record 6 (reserving 0–5 for system), ntfs_create sets ParentRef=5 so newly created files are enumerable. Dual-path verified: arm_emit "AB" + cc0 compiled (vfs_ntfsreaddir_test) (FS f124e08).
• FS: NTFS resident-$DATA append via vfsdev_append_path (0.3.x): ntfs_append() wires ntfs_size → ntfs_grow_resident → ntfs_write at old EOF; wired into vfsdev_append_path with ntfs_find fallback for flat-MFT volumes. Verified: record-8 "F.TXT" 8B→12B, arm_emit SR, cc0 clean (FS c5f2e9b).
• FS: exFAT exfat_append_in clobber fix (0.3.x): fixed a real bug in exfat_bitmap_clus — the xdir() call inside the directory scan was clobbering bmlba, causing blk_read(base+s, xdir()) to overwrite the target sub-directory sector with root-directory content on subsequent iterations. Fix: hoist bmlba before the scan loop. Verified: arm_emit→SR, cc0 clean, run_tests.py ALL PASS (FS 5f28529).
• FS: vfsdev_stat_checked — session-gated stat (0.3.x last verb): the final remaining 0.3.x coreutil verb. POSIX mounts (ext2): the caller's session must hold r(4) on the target — the broker enforces it. Non-POSIX mounts (FAT/exFAT/ISO/NTFS): ungated, consistent with their no-ownership model. Ancestor-directory x-bit checks deferred to the resolve layer (sigil-os#139), matching the caveat already on readdir_checked. vfs_statgate_test passes on both arches, 26/26 run_tests.py green (FS 6d39c5b).
• FS: cap-scoped pseudo-FS devfs + procfs (post-0.5.0): /dev (devfs) and /proc (procfs) are now real VFS providers — but cap-scoped: a session sees only the device / process nodes it is authorized to (absence, not greying — same SECURE rationale as the tag seam, #177). Backed by the 0.3.0 id_handle_access gate; vfs_pseudo dispatch wires both. Not 0.5.0-gating — canonical vfs_dev mount-table wiring deferred post-0.5.0 per Director (FS fb8ed88).
• FS: Smart-Folder delete + tag-table overflow fix (substrate hardening): fs_sf_delete (#101, via tagfs.sg EL0 verb) completes the Smart-Folder CRUD surface (create/list/query were already wired — delete was the gap). The same merge fixes a real buffer-overflow that has been live in the tag substrate since the original merge: ti_intern_tag and ti_intern_obj lacked capacity guards at the 256-entry bound — overflow now returns −1 (rejected) rather than writing past the table; fs_tag/fs_untag also reject a full table; tq_eval guards <0 atom counts. Dual-path green; all substrate regression tests pass (FS dc5b0fd).
• Drivers: USB EHCI — full USB 2.0 host controller (charter fallback, 5 increments): the high-speed USB host for the pre-xHCI installed base (QEMU-modeled -device usb-ehci). Five increments: PCI probe + HC reset + CONFIGFLAG routing + structural params (inc1) → async-schedule control transfers + device descriptor (inc2) → SET_ADDRESS + addressed control (inc3) → config descriptor + SET_CONFIGURATION (inc4) → bulk data plane + USB Bulk-Only Transport + SCSI INQUIRY (inc5, ehci_bulk + ehci_msc_inquiry). Verified end-to-end on real QEMU EHCI + usb-storage (q35/OVMF): E5: iq=36 vn=QEMU ty=0 — enumerated + configured the stick, ran BBB SCSI INQUIRY over bulk, 36-byte vendor response. EHCI is now a complete USB 2.0 host through the bulk/mass-storage plane (Drivers fdd7671 → 38c2f11). Interrupt-IN (HID over EHCI) + OHCI deferred.
• Drivers: USB UHCI — Intel USB 1.1 host controller (charter fallback, 2 increments): the full-speed USB fallback for the oldest x86 machines (-device piix4-usb-uhci). Two increments: UHCI bring-up + port status (inc1) → control schedule + device enumeration (inc2, SETUP/IN/OUT TDs, frame-list scheduling, GET_DESCRIPTOR → device descriptor). Rides the same shared/bus/pci.sg; UHCI enumeration verified on QEMU (Drivers 94d9a2f → 504022a).
• cc0: compiler parse-cache tier #1 (toolchain, dev-only): every compile on Darwin re-ran load_program(cc0.sg)+check — ~180 ms fixed overhead to parse + typecheck the 6 885-LOC compiler, paid by every agent on every call (~8× a small-target compile). sigil/parse_cache.py (load_checked_compiler) caches the parsed+checked compiler image at two levels: per-process memo (one parse per test run) and content-addressed on-disk (sha256 over all selfhost/*.sg + all sigil/*.py + entry path → invalidates on any change). Measured: hit 180 ms → ~20 ms / ~0 ms memo (9–13×). Dev-only guardrails (Director #181): SIGIL_CACHE_VERIFY recompiles fresh and asserts compilation is identical; corrupt/unreadable entries fall back to fresh; bootstrap-seed-only CI never touches this — the cache is development tooling, not the trust gate. Wired all 15 cc0 test suites (sigil 1aa7d30). Tiers #2 (CAS output cache) + #3 (shared fleet dir) next.

• cc0: Windows PE/COFF x86-64 target (1.1 toolchain): cc0 can now emit a Windows-native win target — x86-64 PE32+ COFF objects + a VM harness for running on Windows without cross-compilation. Roadmap placement: 1.1 Windows-native (#190/#191). No 0.5.0 impact (sigil 08392b3).

• Video: present_accel — x86 GPU-accel compositing on Bochs VBE LFB (0.6.0, T2→T1): Video wired the cpuaccel SIMD span ops onto the real x86 video RAM now that OS's Bochs VBE LFB is live (43a6233): fill_span (xfill32 SSE2/AVX2) fills the full 1024×768 desktop background into video RAM; present_window_accel (comp_blit → copy_span) composites a window; blend_span (xblend32 SSE2) applies a translucent highlight stripe over the title bar. Verified ACCELFB-OK xf=1 xb=1 fill_ok=1 copy_ok=1 on qemu-system-x86_64 -vga std. Key x86 bare-metal fix: CR4.OSFXSR (bit 9) must be set before any SSE2 intrinsic — OVMF sets it implicitly for EFI but bare-metal starts with CR4=0; Video's bring-up now sets it explicitly (Video 0e1d475). Director T2→T1 lane delivered.

• ⭐ x86-64 Lumen desktop — bare-metal QEMU (0.6.0, first lane deliverable): the Lumen desktop now boots and renders on x86-64 bare-metal QEMU — cc0/gfxraster_x86.sg initialises the Bochs VBE framebuffer (outw 0x1CE/0x1CF, 1024×768×32 LFB at 0x500000; hal_set_pixfmt(FMT_BGRA) for x86 BGR byte order), replacing the VideoCore mailbox path used on ARM. build_cc0.py compile_x86 drives the cc0 x86-metal target. Rasterizer logic is identical to gfxraster.sg — one codebase, two arch backends. Verified PASS on qemu-system-x86_64 -kernel out/wm-x86.elf -vga std: dark gradient, Files/Terminal/Settings windows, Lumen-dark chrome, AA fonts, BGRA pixel format correct (OS 43a6233). Key implementation note: fb_info must be at 0x500000 — 0xF0000 is the BIOS ROM on x86, writes silently ignored, producing a non-canonical pointer → #GP.

• Video: mouse cursor sprite with save-under: video/cursor.sg — renders a cursor sprite at an arbitrary (X,Y) position with save-under compositing: saves the pixels beneath the cursor before drawing and restores them on move, so the cursor never permanently stomps background pixels. Feeds the OS mouse integration pipeline (Video 20d85f3).

• OS: pointer event subsystem: os/pointer.sg — normalises raw USB-HID 3-byte boot-protocol mouse deltas (dX, dY) into an absolute cursor position, clamped to screen bounds; provides the pt_dispatch call that the input subsystem and mouse integration layer consume (OS 06f8c83).
• OS: session input hotplug device table: os/input_subsystem.sg — per-session hotplug table with keyboard / mouse / gamepad slots; tracks device attach/detach lifecycle and routes pointer events via pointer.sg; cap-scoped per consumer for device discovery (supports future keyboard integration on Pi + x86 HID enum). Memory at IS_BASE=0x6E0000: kbd/mouse/pad slot flags + 128B hotplug event queue. Verified PASS on QEMU raspi3b (OS 824cca1).
• OS: audio playback service — boot chime: audio/audio_output.sg — detects the available audio device (0=none · 1=Intel HDA x86 · 2=Pi-audio ARM), queues PCM samples, and drives the boot chime (44 100 Hz, ~1.5 s / 66 150 samples from bootchime.sg). Capability-scaled: graceful no-op if no audio device is present (Pi 3 floor remains silent-but-working). Memory at AO_BASE=0x6C0000: playing flag, sample pointer, sample count (OS 6af85d1).
• OS: mouse end-to-end integration pipeline: os/mouse_integration.sg — wires the full mouse stack: Drivers USB-HID boot-protocol reports → pointer.sg delta normalisation → input_subsystem.sg hotplug routing → cursor.sg sprite positioning → login hit-test. Absolute X/Y/buttons at MI_BASE=0x700000; MI_HIT_TEST routes clicks to the login button. Pointer actually moves and clicks. Verified PASS on QEMU raspi3b: mouse positioning, button tracking, hit-test (OS 4f31c9e).

Networking end-to-end — 2026-06-18 (pre-tag, untagged)

The networking milestone — sigilOS talks to the network end to end, proven on real virtio-net hardware under OVMF. A superset of 0.3.0's multi-user file isolation; cut from Kernel's BOOTX64-net.EFI (hal/x86/m5net) per Director #188.

Added

• Network stack, end to end (#173/#171): the kernel EL0 raw-frame seam — syscalls 84–89 (net_open/net_send_frame/net_recv_frame/net_link/net_mac/net_close) wired in host.sg (49d6a73), cap-gated CAP_NET over nethal → NIC. The OS socket layer (netsock.sg) binds on top: UDP (sock_open/udp_send/udp_recv, zero-copy RX) and TCP (tcp_connect/tcp_send/tcp_recv_data/tcp_recv_seg, the RFC-793 state machine) — OS a6cd0c4
• 3b33766 + 1dc5349. Per #171 the kernel carries only memory-safe frames; all protocol build/parse/gate lives in the OS.
• The one RX SECURE gate (#166/#171, Code e4ec494): every received frame passes net_rx_ipv4_ok(buf, caplen) — Ethernet+IPv4 headers present, IHL·4 ≥ 20, no over-claiming total_len — before any in-place parse; malformed / non-IPv4 dropped, no read past the capture.
• Real-hardware proof (#120): the x86 net-host hal/x86/m5net (11995a8) boots BOOTX64-net.EFI under OVMF on a real -device virtio-net-pci — the NIC self-discovers and links up (Drivers 1d891b5 / 19607d9), and a real Ethernet/IPv4/UDP frame round-trips the kernel seam through the gate byte-identical (COM1 M5NET prs=1 lk=1 tx=58 rx=58 s=1 ok=1; OVMF GOP green PASS).
• Filesystem — cross-provider ls: vfsdev_readdir_checked returns one canonical VFS dirent (otype 1 file / 2 dir, namelen, name) across all five providers — ext2 (session-gated) + FAT 8.3 + exFAT + ISO 9660 + NTFS (non-POSIX mounts list ungated) — so ls parses one layout whatever the mounted FS (FS f2ca6d5).
• Filesystem — tmpfs (/tmp): a RAM-backed scratch FS, a first-class VFS provider (vfs_tmpfs() = 8) through the unified vfsdev_* contract, mounted RW at /tmp; the FS-tier syscalls + coreutils work on it unchanged (FS cd5b50d + 97c8e37, #172).
• Userland — full FS-tier coreutils CLI: the seven-verb set — ls/cat/df/mkdir/rm/mv/ chmod — over the session-gated FS syscalls (16–26), imaged + verified with per-user isolation enforced (Apps; 2e7ff15).

Image

• sigilos-0.4.0.img (x86-64, dd-able) — MBR + primary/backup GPT; the net-host the proven net-host BOOTX64-net.EFI (43 520 B, md5 a1a323595d2496483eceae364982f629) embedded byte-exact in the ESP; OVMF-bootable. + flash.sh. (The initial 0.4.0 tag embedded a scratch out/ build that #UD'd at runtime; re-tagged from the pinned dist/ net-host — committed dist/ is the source of truth, never scratch out/. Director caught it pre-@grio.)

Note

• A superset of [0.3.0] file isolation; the since-0.3.0 1.0-DoD work (encrypted-boot, mount-time integrity-seal) rides along. Rolling-release pattern (Director #106); harness 226/226.

Multi-user file isolation (dual-arch) — 2026-06-18 (pre-tag, untagged)

Multi-user file isolation (dual-arch) — per-user files are isolated by the session capability, enforced in the VFS and proven on both arches: ARM raspi3b and x86-64 UEFI/OVMF (Director #160/#162/#163).

Added

• Multi-user file isolation: per-user /home; every VFS open is session-token perms-gated (id_sess_access_m, sigil-os#94) — POSIX owner/mode enforced by the broker, not ambient. SEATED-marker fail-closed session slots: an unseated/zeroed slot denies every access (#135).
• FS syscall tier 16–26 wired: the kernel host.sg routes EL0 syscalls 16–26 → fsh_dispatch → real slot-gated vfsdev_* over identity.sg (f164435, #152). Per-number: open 16/read 17/write 18/close 19/readdir 20/stat 21/mkdir 22/unlink 23/rename 24/chmod 25/statfs 26; fd-table vfsdev_backend + canonical dirent.
• Session-gated mutations: mkdir / rm (unlink) / mv (rename) / chmod via the coreutils CLIs over the gated syscalls; FAT-mount listing (ls) ungated with an 8.3 canonical dirent (FS 3fc5c76).
• Dual-arch boot artifacts: ARM raspi3b dist/host.img (418 287 B, build f164435, #152) and x86-64 UEFI dist/BOOTX64-fs.EFI (262 144 B, build cd3a920, #162 (B)) — real ext2 on block_ram, the OS identity.sg / idcred.sg broker (d373851).
• Isolation proof (#120, both arches): O — an owner reads its own file, bytes round-trip; X — a non-owner opening another user's 0600 file gets EACCES (-13) (broker denies non-owner); S — both users read a shared 0644 file. Same code path on ARM and x86 (COM1 M4FS o=1 x=1 s=1 ok=1; OVMF GOP green PASS panel).

Note

• Released as 0.3.0 (dual-arch), cut by Sigil-FS from the kernel main dist/ artifacts.

x86-64 real-metal — 2026-06-18 (pre-tag, untagged)

x86-64 real-metal milestone — SigilOS boots from a flashed USB to an interactive multi-user Lumen login on real x86-64 hardware (and OVMF), all-Sigil end to end (Director #81).

Added

• x86-64 UEFI boot: the frozen SIGILOS_BOOT handoff ABI (magic 0x5347424F4F540001; GOP framebuffer base/pitch/W/H/format + memory map + ACPI RSDP + EFI system table; GOP PixelInformation masks for PixelBitMask framebuffers). cc0 x86-efi → BOOTX64.EFI PE32+ stub → kernel_main.
• Bootable image: all-Sigil mkimage produces a UEFI-valid sigilos.img — protective MBR + primary/backup GPT (CRC32-validated), FAT ESP with /EFI/BOOT/BOOTX64.EFI, ext2 rootfs; dd-able make-sigilos-img.sh + flash.sh pipeline.
• M2 device bring-up on real OVMF: NVMe storage and xHCI USB host (full enumeration) over an integrated, size-aware re-BAR.
• Input: USB-HID boot keyboard (CLS_INPUT/CAP_HID) on the one xHCI host; ps2kbd normalized to the same HID-usage codespace; one hid_char keymap → WM/login. Live keyboard typing on real hardware.
• M3 login: integrated Lumen login compositor on the firmware GOP framebuffer; interactive multi-user login — tile-picker, per-user broker-held credential store (salted verifiers, no cleartext), per-user sessions + /home. Pixel-format-aware (the pink→purple GOP PixelFormat fix).
• Identity / capability model: su/sudo as a held, droppable capability (not a root uid); broker-held session tokens with an unforgeable-by-holder trust boundary; supplementary groups; salted-hash password auth on the one crypto suite. Mechanism (kernel auth.sg, syscalls 60–68) / policy (idcred.sg) split.
• CPU dispatch: kernel-owned FEAT_* registry + portable cpu_tier; SSE2/AVX2 SIMD tiers landing behind the scalar fallback.
• Docs system: the ratified .sdoc format (v1 AST) + canonical JS interpreter/overlay across four render surfaces (CLI · web · Chrome · macOS), plus the orientation canon (overview · boot-flow · architecture).

Note

• Released image previously tagged v9.99.9999 (placeholder); re-cut at the current build_x86_m3login_kbd EFI. Proposed milestone tag: 0.2.0 (pending Director ratification + FS cut).

First Pi boot — 2026-06-16 (pre-tag, untagged)

First bootable milestone — SigilOS boots on Raspberry Pi (AArch64), written 100% in Sigil.

Added

• Kernel: EL1 kernel + syscall ABI; bootable console (EL0 app draws via the ABI); MMU (RAM Normal / MMIO Device), preemptive scheduler, timers; framebuffer + input drivers.
• Filesystem: encrypted-at-rest volume (per-item + block integrity, rollback protection, authenticated root); save-state store; ROM store; VFS mount table + provider vtable; FAT12 read provider + MBR partitions; fs_boot_seed.
• Userland: double-buffered HDMI framebuffer; window manager (z-order, title bars, close buttons); AA 2D rasterizer (shadows, gradients); AA font engine (Inter UI, JetBrains Mono mono); a shell hosted in a terminal window.
• Language/toolchain: self-hosted cc0→AArch64 fold reaching Text + record; static-aligned peek64/poke64 fast path; per-arch optimization groundwork.
• Gaming: CHIP-8 + Intel 8080 emulator cores (QEMU-verified); Game Boy core in progress.
• Principle: 100% Sigil product code (Python only for the bootstrap/test harness).