build: finish Zig 0.18 standard-library migration

Home is preparing to move from the Pantry-pinned Zig 0.17 dev toolchain to 0.18/master. A source and compile audit against 0.18.0-dev.146 found three distinct classes that must be handled independently rather than by blanket rewrites.

Confirmed work:

• Remove only the obsolete error handling around std.crypto.dh.X25519.recoverPublicKey; retain X25519.scalarmult error propagation because it rejects attacker-controlled identity/small-order public inputs. Ed25519 deterministic generation and the visible AEAD/KDF checks remain fallible.
• Complete the std.Io migration. The tree already has broad std.Io adoption, but packages/io/src/async_io.zig still calls one-argument Threaded.init and the removed std.fs.cwd() surface. Many other legacy filesystem call sites require separate measured slices.
• Rename bare old optimize tags such as .ReleaseFast to lowercase tags where the contextual type is std.lang.Optimize. Qualified deprecated aliases still compile through 0.18, so this is mechanical rather than semantic.

Coverage findings:

• zig build --help, home-tool, and home-tsc build successfully with 0.18.0-dev.146.
• Direct compilation of the real packages/io and packages/build sources exposes failures that the top-level filtered tests do not compile.
• Main compiler/runtime production and test modules both link libc; no libltvpn-style test-only libc mismatch was found.
• Current Pantry, CI, and release workflows still pin 0.17.0-dev.2163, so green CI does not yet establish 0.18 compatibility.

Acceptance:

• Migrate in small independently verified slices that compile under both the current pinned compiler and the selected 0.18 baseline while dual support is required.
• Add real coverage for migrated package sources rather than placeholder tests.
• Preserve all meaningful cryptographic validation paths.
• Add an actual 0.18 CI lane before changing the project-wide pin, then move Pantry/release CI and documented commands together.

Related: #66, #855.

First migration slice landed directly on main as bcec002 (fix(io): migrate package filesystem operations (#884)).\n\nExactly three files changed. packages/io now uses the explicit std.Io filesystem surface, passes Threaded.init options, maps initWithThreads to the supported async limit, and exercises both embedded unit behavior and the public package module through its real standalone build graph. The obsolete Build.pathFromRoot test setup was also replaced rather than bypassed.\n\nPost-rebase verification:\n- Pantry Zig 0.17.0-dev.2163: 5/5 build steps, public tests 2/2, peak 334 MB.\n- Zig 0.18.0-dev.146: 5/5 build steps, public tests 2/2, peak 351 MB.\n- Direct embedded tests: 3/3 on each compiler.\n\nThe X25519 signature correction, optimize-tag cleanup, broader legacy std.fs inventory, and actual 0.18 CI lane remain open as separate slices. No cryptographic validation was removed in this commit.

Landed c142ab9989685eb3dd5bbb6991a57339e570df13 (fix(runtime): bridge X25519 recovery signatures (#884)) on origin/main.

This is a narrow semantic bridge rather than a blanket catch removal:

• Zig 0.17's fallible X25519.recoverPublicKey path is retained.
• Zig 0.18's direct [32]u8 return is accepted.
• X25519.scalarmult remains fallible; the attacker-controlled identity/small-order rejection was not weakened.
• Added a fixed RFC/Node vector unit test and wired it into the main test graph as crypto_compat.

Verification on the committed tree:

• pinned Zig 0.17: zig build test -Dfilter=crypto_compat -j1 passed (guard peak 279 MB)
• Zig 0.18.0-dev.146: same target passed (guard peak 362 MB)
• pinned Zig 0.17: zig build home-tool -j1 passed
• Zig 0.18.0-dev.146: zig build home-tool -j1 passed (guard peak 1,947 MB)
• both changed Zig files plus build.zig pass zig fmt --check under both compilers

The existing X25519 corpus invocation was blocked by the cached Home binary's jsc-disabled configuration, so it is explicitly not counted as a runtime pass.

Landed c451ed8525d62a7c2833c4af5ef9ac39da5c88f5 (fix(build): restore LTO compiler compatibility (#884)) on origin/main after rebasing over the latest FileHandle evidence commit.

What changed:

• OptimizeMode dispatch now uses qualified std.builtin.OptimizeMode.Debug/ReleaseSafe/ReleaseFast/ReleaseSmall lookups. This is a rename-only compatibility bridge: the aliases exist in the pinned 0.17 compiler and Zig 0.18, while tests exercise the canonical .debug/.safe/.fast/.small values.
• Migrated the LTO module from stale managed-ArrayList construction/calls to the current allocator-explicit API.
• Repaired stale IR-global and ThinLTO summary field construction.
• ThinLTO now frees owned function/import/export metadata and has OOM cleanup for partially built summaries.
• Wired packages/build/src/lto.zig into the top-level test graph as zig build test -Dfilter=lto; the previous -Dfilter=build run only compiled build_cli_options and did not cover this package.
• Updated the LTO documentation to name the real dual-version test target.

Verification:

• direct LTO suite: 6/6 under pinned Zig 0.17 (168 MB peak)
• direct LTO suite: 6/6 under Zig 0.18.0-dev.146 (162 MB peak)
• top-level -Dfilter=lto -j1: passed under pinned Zig 0.17 (324 MB peak)
• top-level -Dfilter=lto -j1: passed under Zig 0.18.0-dev.146 (369 MB peak)
• both top-level targets passed again after the rebase
• zig fmt --check passes under both compilers; git diff --check passes

Zig 0.18 migration checkpoint landed on main as 61b5cba (ci: gate Zig master compatibility).

Configuration findings and changes:

• Added a dedicated zig-master.yml lane using setup-zig's documented master selector. It runs on changes, daily schedule, and manual dispatch.
• The master lane currently gates the qualified compatibility seams: X25519 recovery, OptimizeMode/LTO, and packages/io std.Io migration.
• Release tests now run with -Doptimize=ReleaseFast, matching the optimization mode of the binaries packaged by release.yml. Previously the release job built ReleaseFast and then tested Debug.
• Stable CI and release builds remain on the Pantry-pinned 0.17 compiler; master churn is isolated to the compatibility lane.

Semantic audit:

• X25519.recoverPublicKey changed from an error union to a direct [32]u8 result; Home's compatibility helper accepts both signatures.
• X25519.scalarmult remains fallible. Home keeps both catches/try sites because they reject attacker-controlled identity/small-order public inputs.
• Ed25519 KeyPair.generateDeterministic is still fallible in 0.18.0-dev.146, so its catches remain.
• AEAD decrypt, PBKDF2, and scrypt error handling remains security-meaningful and was not removed.
• OptimizeMode is a rename-only compatibility concern; qualified legacy aliases are used where dual-version support is required.
• The broad std.Io migration is still separate scope. Existing unported std.fs filesystem call sites are not being mechanically rewritten until their exact 0.18 signatures and behavior are exercised.

Validation:

• Pickier passed on all three changed workflow files.
• Pinned Zig ReleaseFast crypto_compat: 1/1 passed, peak 229 MB.
• packages/io exact workflow command: 2/2 passed on Zig 0.17 and 0.18.0-dev.146, peaks 310 MB and 318 MB.
• No full master or full ReleaseFast suite claim is made locally; the new CI lanes are the persistent evidence.

Landed ec5e07048 (fix(ffi): propagate libc through public modules (#884)) directly on main.

This corrects the earlier audit statement that no test-only libc mismatch existed. The main compiler/runtime roots were consistent, but the standalone FFI package was not: both build graphs attached libc to test/example roots while the reusable ffi module omitted it. Consumers therefore did not inherit the module's actual C-library requirement.

The five-file slice:

• makes both public FFI modules own link_libc and removes root-level test/example compensation;
• removes the standalone header generator's unnecessary dependency on the entire basics package and migrates it to the current allocator-explicit ArrayList API and lowercase @typeInfo tags;
• restores the documented ffi.c_char/c_int/c_long/c_float/c_double public aliases;
• fixes CAllocator.resize, which previously called potentially-moving libc realloc and discarded the returned pointer; shrinking now retains the allocation and growth uses the allocator's safe alloc/copy/free fallback;
• adds a compile-only FFI test step so cross-target linkage is verified without pretending the host can execute the target binary.

Verification, one guarded process at a time under 3,840 MB:

• top-level FFI: 6/6 on pinned Zig 0.17 and Zig 0.18.0-dev.146;
• standalone FFI: 38/38 Debug and 38/38 ReleaseFast on both compilers;
• real math consumer: builds and runs successfully on both compilers;
• x86_64-linux compile-only test binary: succeeds in Debug and ReleaseFast on both compilers;
• all five Zig files pass zig fmt --check under both compilers; git diff --check passes.

The Linux checks prove compilation/linkage only; they are not represented as Linux runtime execution. Broader Zig 0.18 standard-library migration remains open.

Landed and pushed c6e950e04 (fix(session): migrate runtime services to std.Io (#884)) directly to origin/main.

This five-file slice migrates packages/session from removed process-global services to the shared std.Io surface:

• wall time now uses std.Io.Clock.real.now(io).toSeconds();
• cryptographic IDs, CSRF tokens, GC sampling, and cookie nonces use fallible std.Io.randomSecure and propagate failures;
• the file driver uses std.Io.Dir/std.Io.File operations and explicit io arguments;
• the ChaCha20-Poly1305 namespace rename is applied (aead.chacha20_poly1305 -> aead.chacha_poly);
• package test discovery now executes the file, memory, and cookie driver tests instead of only compiling them;
• file tests use an isolated temporary directory and perform a real write/read/destroy round trip;
• authenticated-cookie tests now prove modified ciphertext is rejected, while fixing plaintext cleanup on that successful-null path.

Verification (guarded, one process at a time, 3,840 MB ceiling):

• Zig 0.18.0-dev.146 Debug: 6/6
• pinned Zig 0.17.0-dev.2163 Debug: 6/6
• Zig 0.18.0-dev.146 ReleaseFast: 6/6
• pinned Zig 0.17.0-dev.2163 ReleaseFast: 6/6
• x86_64-linux compile-only: success on both compilers
• formatting: success on both compilers

Classification: the ChaCha path is a pure namespace rename; the clock/random/filesystem work is the semantic std.Io migration. Secure randomness remains fallible and no error check was stripped.

Landed and pushed 5bb45b03f (fix(syslog): migrate secure runtime services to std.Io (#884)) directly to origin/main.

This four-file slice migrates syslog wall-clock and cryptographic randomness to std.Io, making AuthKey.generate, EncryptionKey.generate, and nonce generation explicitly fallible so secure-random failures are propagated rather than erased. It also ports associated-data construction from removed std.io.fixedBufferStream to std.Io.Writer.fixed.

The previous top-level syslog gate reported 2/2 because imported auth/encryption tests were not discovered. The root now activates them, raising real coverage to 9/9.

Guarded verification under the 3,840 MB ceiling:

• Zig 0.18.0-dev.146 Debug: 9/9
• pinned Zig 0.17.0-dev.2163 Debug: 9/9
• Zig 0.18.0-dev.146 ReleaseFast: 9/9
• pinned Zig 0.17.0-dev.2163 ReleaseFast: 9/9
• x86_64-linux compile-only: success on both compilers

Classification: fixedBufferStream -> std.Io.Writer.fixed is an API migration; global clock/random removal is semantic because the caller must now supply an I/O implementation and secure randomness can fail. No security-relevant error was dropped.

Landed and pushed 7c11db726 (fix(syslog): complete std.Io concurrency migration (#884)) directly to origin/main.

This five-file follow-up completes the syslog package migration:

• rate-limit wall clocks use the shared std.Io.Clock provider;
• remote connection/retry delays use fallible std.Io.sleep and propagate cancellation through existing error-returning APIs;
• removed std.Thread.Mutex fields are now std.Io.Mutex;
• APIs that were intentionally infallible retain that contract with lockUncancelable, rather than catching and discarding cancellation errors;
• ConnectionStatus now has an explicit u8 representation required by std.atomic.Value;
• access/rate-limit/remote tests are activated at the root.

Activating the full suite exposed a contradictory ACL fixture: the user role is configured for .notice and higher priority but the test expected .info to pass. The fixture now tests .notice as allowed and adds an explicit .info rejection assertion, strengthening rather than weakening coverage.

Guarded verification:

• Zig 0.18.0-dev.146 Debug: 18/18
• pinned Zig 0.17.0-dev.2163 Debug: 18/18
• Zig 0.18.0-dev.146 ReleaseFast: 18/18
• pinned Zig 0.17.0-dev.2163 ReleaseFast: 18/18
• x86_64-linux compile-only: success on both compilers

Together with 5bb45b03f, the syslog root now runs all 18 package tests instead of the prior misleading 2/2.

Landed and pushed 05cc320a8 (fix(coredump): migrate secure runtime services to std.Io (#884)) directly to origin/main after rebasing over the concurrent TS checker commit.

This four-file coredump slice migrates metadata/key expiration wall time and all key/ID/nonce generation to the shared std.Io provider. Every secure-random operation remains fallible and uses existing error-returning call paths; no cryptographic failure is caught or dropped. The coredump root now activates key-management and encryption tests, increasing actual coverage from 2/2 to 10/10.

Guarded verification before rebase:

• Zig 0.18.0-dev.146 Debug: 10/10
• pinned Zig 0.17.0-dev.2163 Debug: 10/10
• Zig 0.18.0-dev.146 ReleaseFast: 10/10
• pinned Zig 0.17.0-dev.2163 ReleaseFast: 10/10
• x86_64-linux compile-only: success on both

After the non-overlapping rebase, both Zig 0.18 and pinned-Zig debug gates passed again (cached build graph).

Landed and pushed a7bbbbe6e (fix(auth): migrate cryptographic services to std.Io (#884)) directly to origin/main.

The standalone auth build was a confirmed Zig 0.18 failure: remember-token and password-salt generation referenced removed std.crypto.random. This four-file slice:

• routes remember tokens and Argon2 salts through fallible std.Io.randomSecure;
• migrates JWT wall time to std.Io.Clock.real;
• updates Argon2 KDF calls to the allocator + mode + std.Io signature for both hashing and verification;
• activates JWT, guard, and hash tests at the auth root.

No cryptographic error was dropped: token/salt failures propagate through existing error-returning APIs; hashing maps KDF failures to HashingFailed; verification remains a boolean and maps KDF failure to false as before.

Guarded verification:

• Zig 0.18.0-dev.146 Debug: 12/12
• pinned Zig 0.17.0-dev.2163 Debug: 12/12
• Zig 0.18.0-dev.146 ReleaseFast: 12/12
• pinned Zig 0.17.0-dev.2163 ReleaseFast: 12/12
• x86_64-linux compile-only: success on both compilers

Landed and pushed 9a9865b0a (fix(coredump): migrate persisted files to std.Io (#884)) directly to origin/main.

This exact five-file slice completes coredump persisted-file migration:

• key save/load, encrypted-dump save/load, metadata extraction, directory scanning, integrity checks, and size queries now use std.Io.Dir/std.Io.File;
• private key/dump creation preserves 0600 permissions where the target permission type supports POSIX modes;
• integer fields remain explicitly little-endian;
• untrusted dump loading uses bounded exact positional reads rather than buffering the whole file, validates declared length against file size, and checked-casts u64 sizes;
• root discovery now executes decrypt, format, and capture tests;
• real temporary-file tests cover key save/load, encrypted save/load/decrypt/metadata extraction, directory filtering, magic verification, and size reporting.

Guarded verification:

• Zig 0.18.0-dev.146 Debug: 21/21
• pinned Zig 0.17.0-dev.2163 Debug: 21/21
• Zig 0.18.0-dev.146 ReleaseFast: 21/21
• pinned Zig 0.17.0-dev.2163 ReleaseFast: 21/21
• x86_64-linux compile-only: success on both compilers
• peak observed guarded tree footprint: below 300 MB

Pushed e94a935 (fix(modsign): migrate key generation to std.Io (#884)) directly to origin/main.

This is a semantic Zig 0.18 migration, not a rename:

• replaced the removed global std.crypto.random.bytes service with explicit std.Io.randomSecure;
• preserved the new failure path with try (no security check was removed);
• exposed the key tests through the package root, increasing this target from 2 to 6 discovered tests.

Verification (one guarded process at a time, 3,840 MB ceiling):

• Zig 0.18.0-dev.146: Debug 6/6, ReleaseFast 6/6;
• pinned Zig 0.17.0-dev.2163: Debug 6/6, ReleaseFast 6/6;
• aarch64-linux compile-only passes on both toolchains.

Peak guarded tree footprint was 279 MB. The next modsign slice is the shipped key/module persistence path, whose old std.fs calls still need explicit std.Io migration and real file round-trip coverage.

Pushed 6c97291 (fix(modsign): migrate persistence to std.Io (#884)) directly to origin/main.

This five-file slice completed modsign's shipped file-I/O migration and exposed semantic bugs that the previous two-test root never instantiated:

• private/public PEM and signed-module I/O now use explicit std.Io;
• private keys are created with private file permissions;
• public PEM payloads are now actually Base64-decoded (the old loader stored encoded bytes as the key);
• key fingerprints now depend on key material rather than an unsaved description, so persisted public keys can match signatures;
• algorithm recovery is explicit from the persisted key size instead of silently forcing RSA-2048;
• signing and verification now HMAC the same 32-byte digest (the old signer used the whole 64-byte backing buffer);
• the old verification test's valid-or-invalid escape hatch was replaced with an exact valid assertion;
• forged appended-signature lengths are rejected before subtraction, avoiding an underflow;
• the owned extracted signature is mutable so its allocation can be released.

The package root now discovers 18 tests (previously 2 before these modsign slices). Verification:

• Zig 0.18.0-dev.146: Debug 18/18, ReleaseFast 18/18;
• pinned Zig 0.17.0-dev.2163: Debug 18/18, ReleaseFast 18/18;
• aarch64-linux compile-only passes on both.

No crypto error union was stripped. All new secure-random and I/O failures remain propagated. Peak guarded tree footprint was 289 MB.

Pushed 38dd474 (fix(tpm): migrate secure services to std.Io (#884)) directly to origin/main.

The old TPM root reported 2/2 green because it did not import any submodule tests. The package root now discovers 14 tests and exposed both Zig 0.18 migration failures and semantic defects:

• attestation time now uses explicit std.Io clock access;
• challenge and simulated-key entropy now use std.Io.randomSecure;
• AttestationChallenge.init is intentionally fallible and callers propagate secure-random failure;
• allocated key material is released if entropy acquisition fails;
• unmanaged PCR lists now receive their allocator during deinit;
• authorization sealing now removes the old policy stream before applying the new policy stream. Previously, correct credentials decrypted to garbage even though the hidden test expected the original secret.

Verification:

• Zig 0.18.0-dev.146: Debug 14/14, ReleaseFast 14/14;
• pinned Zig 0.17.0-dev.2163: Debug 14/14, ReleaseFast 14/14;
• aarch64-linux compile-only passes on both.

No fallible crypto check was removed. Peak guarded tree footprint was 288 MB.

Pushed 4d9dca2 (fix(websocket): migrate secure handshakes to std.Io (#884)) directly to origin/main.

The standalone package previously reported 1/1 while hiding server, broadcaster, handshake, and mask-generation paths. It now discovers 7 tests and:

• uses std.Io.randomSecure for the client handshake nonce and every RFC 6455 client mask;
• makes mask generation fallible and propagates entropy failures through send/ping/pong/close;
• validates the server's Sec-WebSocket-Accept proof instead of accepting any 101 response;
• validates the client key's fixed 24-byte Base64 width before hashing/copying, eliminating an attacker-controlled fixed-buffer overflow;
• parses HTTP field names case-insensitively;
• emits CRLF-correct handshake responses;
• ports hidden JSON serialization paths from removed std.io.fixedBufferStream to std.Io.Writer.fixed;
• includes the RFC 6455 published accept-key vector.

Verification:

• Zig 0.18.0-dev.146: Debug 7/7, ReleaseFast 7/7;
• pinned Zig 0.17.0-dev.2163: Debug 7/7, ReleaseFast 7/7;
• aarch64-linux compile-only passes on both.

No entropy error was swallowed or converted to predictable fallback data. Peak guarded tree footprint was 278 MB.

Pushed add029156 (fix(ipv6): migrate protocol services to std.Io (#884)) directly to origin/main.

This is a semantic migration, not a blanket rename:

• route/NDP clocks now use std.Io.Clock.real;
• routing and neighbor caches use std.Io.Mutex.lockUncancelable, preserving their existing non-fallible APIs;
• DHCPv6 transaction IDs now come from fallible secure entropy instead of a millisecond-seeded PRNG, and entropy failure propagates through solicit/request/renew/release;
• Zig 0.18 array-repetition parser breakages in the IPv6/ICMPv6 tests were replaced with typed @splat equivalents.

Verification on the expanded 29-test suite:

• Zig 0.17.0-dev.2163 Debug: 29/29
• Zig 0.17.0-dev.2163 ReleaseFast: 29/29
• Zig 0.18.0-dev.146 Debug: 29/29
• Zig 0.18.0-dev.146 ReleaseFast: 29/29
• x86_64-linux-gnu compile-only: passed on both compilers

The shipped/test module configuration is the same ipv6_pkg; no libc-only test masking was found.

Pushed 5b36cd07f (fix(build): finish Zig 0.18 compatibility batch (#884)) directly to origin/main.

Breakdown:

• Rename-only: Home-owned optimization mirrors now use debug/safe/fast/small; the JSON example uses qualified std.builtin.OptimizeMode.{Debug,ReleaseSafe,ReleaseFast} aliases, which compile on both the pinned compiler and 0.18-dev.146. A 9th build test verifies all four old qualified aliases map to the lowercase modes.
• API migration: kernel builder ArrayLists now pass allocators explicitly; byte generation uses std.Io.Writer.Allocating.
• Semantic fixes exposed by the migration: Multiboot2 checksum is now explicit wrapping u32 arithmetic; compiler/linker flag arrays now return uniformly owned strings and clean partial allocations, fixing the previous invalid free of string literals.
• Coverage: the IPv6 root now imports all four protocol modules, increasing the ordinary package suite from 5 to 29 tests.

Verification:

• kernel builder: 4/4 Debug and ReleaseFast on Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146
• build tests: 9/9 Debug and ReleaseFast on both compilers
• JSON example: AST-check passes on both compilers
• kernel builder x86_64-linux-gnu ReleaseFast compile-only: passes on both compilers
• IPv6 expanded suite was already verified 29/29 Debug/ReleaseFast on both plus Linux compile-only

No real error union was removed in this batch.

Pushed two verified variadic Zig 0.18 migration commits directly to origin/main:

• bee7cb8 — fix(variadic): migrate formatting to std.Io (#884), exactly five files.
• 1b32f76 — fix(variadic): repair std.Io examples (#884), exactly four files.

The first slice replaces removed struct .fields reflection with field_names/field_types, moves fixed and allocating output to std.Io.Writer, makes LoggerConfig borrow a live *std.Io.Writer, migrates timestamps to std.Io.Clock.real and global locking to std.Io.Mutex.lockUncancelable, and updates syscall argument reflection. This is an API/semantic migration: writer state must remain shared rather than copied, clock access is explicit, and the logger's infallible global API retains its contract.

The second slice fixes the shipped examples and docs. Printf return values are consumed, the logger example now owns a real stdout writer instead of silently dropping every log, all mixed examples use one output stream for deterministic ordering, and integer syscall addresses use hexadecimal formatting rather than the pointer formatter.

Verification under the 3,840 MB guard, one process at a time:

• Zig 0.18.0-dev.146 Debug: 25/25 tests.
• pinned Zig 0.17.0-dev.2163 Debug: 25/25 tests.
• Zig 0.18 ReleaseFast: 25/25 tests.
• pinned Zig ReleaseFast: 25/25 tests.
• aarch64-linux-gnu ReleaseFast compile-only: passes on both compilers.
• shipped ReleaseFast package/examples build: 7/7 on both compilers.
• printf, logger, and syscall examples execute successfully; the corrected traces emit 0x1000 and 0x2000 exactly.

The only targeted formatter findings are pre-existing semantic rewrites from @intFromEnum to @backingInt in logger/syscall sources; they were not mixed into these commits. Broader std.Io migration remains open.

Pushed cfb9625cb (fix(cloud): migrate request signing to std.Io (#884)) directly to main.

This five-file slice fixes the cloud package's real Zig 0.17/0.18 breakage:

• injects std.Io into SQS/SES/SNS clients and obtains AWS signing timestamps through std.Io.Clock.real
• migrates request/signature assembly from removed ArrayList.writer helpers to std.Io.Writer.Allocating
• replaces removed fmtSliceHexLower use with native {x} formatting
• removes leaked lowercase header allocations during SigV4 canonicalization
• migrates packages/cloud/build.zig to the current Build API and expands zig build test to instantiate SQS, SES, and SNS rather than testing only the lazily compiled root

Verification (all guarded and serialized):

• direct SQS/SES/SNS tests: Debug + ReleaseFast on pinned Zig 0.17.0-dev.2163 and master Zig 0.18.0-dev.146
• shipped static-library build + expanded package test step: Debug + ReleaseFast on both Zig versions
• shipped aarch64-linux-gnu ReleaseFast cross-build on both versions
• focused zig fmt --check on all five files with both compilers

The expanded package test step peaked at about 1.1 GB, below the 3,840 MB ceiling.

Pushed ae2ef57dd (fix(cloud): migrate S3 and test every service (#884)) directly to main.

This three-file follow-up completes the cloud runtime-service Zig migration slice:

• S3 now receives std.Io explicitly and obtains copy timestamps from std.Io.Clock.real
• S3 presigned URL assembly uses std.Io.Writer.Allocating
• S3 ETag formatting uses native {x} byte formatting instead of removed fmtSliceHexLower
• the public cloud root references SQS, SES, SNS, DynamoDB, and S3 declarations, so their tests are no longer skipped by lazy compilation
• the package test graph now uses one public-root artifact rather than duplicating multiple service executables

Verification (guarded and serialized):

• package test: 18/18 in Debug and ReleaseFast on pinned Zig 0.17.0-dev.2163 and master Zig 0.18.0-dev.146
• shipped ReleaseFast static-library build on both versions
• shipped aarch64-linux-gnu ReleaseFast cross-build on both versions
• focused zig fmt --check on all three files with both compilers

The single-artifact test graph peaked around 323 MB, down from roughly 1.1 GB for the duplicated graph.

Pushed 9dc2333e0 (fix(modsign): migrate lazy formatting paths (#884)) directly to main, rebased on the latest upstream TypeScript commits.

The existing modsign suite was 18/18 on both Zig versions but did not instantiate two public methods. This three-file slice closes that reachability gap:

• signatureSummary now uses std.Io.Writer.Allocating instead of the removed ArrayList.writer path
• PublicKey.keyIdHex now uses native {x} byte formatting instead of removed fmtSliceHexLower
• tests execute both public methods and verify exact lowercase output
• the package-root declaration test now explicitly references every public submodule

Verification (guarded and serialized):

• top-level -Dfilter=modsign: 19/19 in Debug and ReleaseFast on pinned Zig 0.17.0-dev.2163 and master Zig 0.18.0-dev.146
• aarch64-linux-gnu ReleaseFast compile-only on both compilers
• post-rebase rerun of all four top-level compiler/mode combinations

Focused formatter inspection found only two pre-existing semantic builtin rewrites outside this slice (@enumFromInt to @fromBackingInt), so they were not mixed into this commit.

Database 0.18 compatibility slice landed directly on main as 4127e828c (fix(database): migrate hidden auth and migration paths (#884)).

What this found:

• API migration: the migrations module still used allocator-bound ArrayList, ArrayList.writer(), and std.time.timestamp(). It now uses caller-supplied allocator operations, std.Io.Writer.Allocating, and an explicit std.Io clock.
• Previously uncompiled code: the standalone database test build did not import src/migrations.zig, so 18 green tests never instantiated these paths. The test root now imports the migrations module, and zig build check provides a compile-only cross-target step using the same database module and SQLite linkage as the tests.
• Semantic bug: PostgreSQL MD5 auth allocated 35 bytes for "md5" + 32 hex digits + NUL, which requires 36. The old code overwrote the final digest digit with NUL. The response is now complete and checked against an independently computed vector.
• Lifetime fixes: every migrations query result is finalized; rollback and getApplied copy SQLite row text before stepping/finalizing; allocated VARCHAR(n) type strings are released.

Verification (all under the 3,840 MB guard, one process at a time):

• macOS Debug tests: 20/20 on pinned Zig 0.17 and Zig 0.18.0-dev.146
• macOS ReleaseFast tests: 20/20 on both compilers
• aarch64-linux-gnu ReleaseFast compile-only check: green on both compilers
• peak observed guarded footprint: 874 MB

Formatting note: both compilers accept all changed code. migrations.zig is formatter-clean. postgresql.zig retains three pre-existing @enumFromInt spellings because these dev formatters semantically rewrite them to @fromBackingInt; that unrelated churn was deliberately excluded.

Validation std.Io slice landed directly on main as 2eb8d04d4 (fix(validation): inject clocks and run real tests (#884)).

• ValidationContext now receives std.Io explicitly and obtains start/phase timestamps from std.Io.Clock.real.
• This is an API/semantic migration, not a rename: timeout decisions now use a caller-selected clock and can be exercised without ambient legacy time calls.
• The old package test root contained zero tests and excluded messages.zig and rules.zig. The package now runs a real external API suite plus all 11 existing message/rule tests: 15 tests total.
• A compile-only check step covers cross-target configuration.

Verification under the 3,840 MB guard:

• Debug: 15/15 on pinned Zig 0.17 and Zig 0.18.0-dev.146
• ReleaseFast: 15/15 on both compilers
• aarch64-linux-gnu ReleaseFast compile-only: green on both compilers
• focused format checks: clean on both compilers
• peak guarded footprint: 675 MB

No cryptographic error handling changed in this slice. The separate compression build/test and std.Io migration discovered during this audit is tracked in #887.

Current-tree follow-up audit against Zig 0.18.0-dev.146+35accc06e (HEAD 2eb8d04d4):

Crypto error unions

• There are no Home call sites for X25519.KeyPair.generateDeterministic.
• The one X25519 public-key recovery caller goes through crypto_compat.recoverX25519PublicKey, which accepts the fallible pinned-0.17 signature and the direct 0.18 return.
• The runtime's X25519.scalarmult catch remains in place. Both toolchains still declare IdentityElementError![32]u8, so removing it would discard rejection of attacker-controlled identity/small-order public keys.
• The two remaining generateDeterministic catches are Ed25519, whose 0.18 signature is still IdentityElementError!KeyPair.
• Visible AEAD decrypt, PBKDF2, and scrypt handling also remains fallible. No blanket catch removal is valid.

The exact crypto_compat top-level gate passes on both pinned Zig 0.17 and Zig 0.18.0-dev.146.

OptimizeMode

This is rename-only in the audited call sites. Home-owned modes use lowercase tags; the remaining old names are qualified std.builtin.OptimizeMode.{Debug,ReleaseSafe,ReleaseFast,ReleaseSmall} aliases. The 9-test build compatibility suite and 6-test LTO suite pass on both toolchains; the exact Zig-master -Dfilter=lto gate also passes.

std.Io scope

The migration is already active in the pinned 0.17 fork, not newly introduced by 0.18. A static inventory still finds 48 non-upstream Zig files referencing removed lowercase std.io. Most are dormant/lazy examples or APIs and therefore do not invalidate the successful ordinary shipped build. They need separate source-owning package slices rather than a mechanical repository-wide rewrite. The migrated packages/io build passes its exact 5/5 Zig-master gate. Compression's known subset remains tracked in #887.

Shipped versus test configuration

• Ordinary Zig 0.18 zig build -Denable_jsc=false -j1 succeeds under the 3,840 MB supervisor (2,910 MB peak).
• Emitted production and test commands both include -lc; there is no top-level libltvpn-style test-only libc masking.
• Release CI builds and tests with the same -Doptimize=ReleaseFast setting.
• A separate real configuration defect exists in the convenience release-fast step: its command line sets only -Mroot to -Ofast; imported modules remain -Odebug unless the caller also supplies -Doptimize=fast. The trace includes -lc, so this is optimization propagation, not libc. The guarded link was stopped at 3,873 MB against the 3,840 MB ceiling, so no completed-build claim is made for that convenience target.

The full Zig 0.18 test graph is not green, but focused pinned-Zig reproductions show the observed compile failures are pre-existing graph/reachability defects rather than 0.18-only changes: missing no-JSC HTTPServerAgent stubs, dormant runtime CSS/Cow test errors, and the top-level database test root omitting its new migrations module import. The aggregate run was stopped after those classifications and unrelated behavioral failures; no full-suite pass is claimed.

Pushed eaf77c012 (fix(runtime): restore no-JSC substrate tests (#884)) directly to main.

This five-file slice fixes failures exposed while auditing the Zig 0.18 test graph:

• construct the CSS diagnostic union values instead of accidentally formatting their tag enums;
• build valid empty StyleRule fixtures for nesting tests;
• make the test Cow vtable methods satisfy the public declaration contract;
• add the missing no-JSC HTTP server inspector stubs with the generated bridge signatures.

Verification:

• zig fmt --check passes with pinned Zig 0.17 and Zig 0.18.0-dev.146;
• git diff --check passes;
• focused Cow/ptr tests pass under both compiler versions;
• the no-JSC runtime aggregate now compiles past all original errors. Its complete link/test run remains above the enforced 3,840 MB process-tree ceiling (the guard stopped it at 3,915/4,138 MB), so I did not weaken or raise the safety limit and am not claiming a full aggregate pass.

The Zig 0.18 crypto/OptimizeMode/build-parity audit remains documented in the preceding update. In particular, the live X25519 scalarmult attacker-input error check remains intact.

Pushed two verified serialization migration commits directly to origin/main:

• 3f53e381e — fix(serialization): migrate codecs to std.Io (#884) (exactly five files).
• fa1cdf7f9 — test(serialization): exercise the shipped module graph (#884) (exactly three files).

What broke on Zig 0.18.0-dev.146:

• MessagePack and Protobuf still used removed std.io.fixedBufferStream, old reader methods, allocator-bound ArrayList, and ArrayList.writer().
• CBOR and Avro still used allocator-bound ArrayList output/storage APIs.
• Recursive generic encode/decode paths needed explicit error sets; otherwise master reports dependency loops while inferring errors.
• Avro relied on two structurally identical anonymous structs being interchangeable; the union payload now has one named type.
• Cap'n Proto had stricter unused-variable/immutability diagnostics.
• The package test step referenced five source files that do not exist, so it never exercised a real shipped/test configuration.

Semantic hardening included with the API migration:

• MessagePack partial array/map decoding now destroys already-owned values on malformed input; duplicate map keys release the replaced key/value.
• Protobuf rejects field zero/out-of-range field numbers, wire tags 6/7, truncated tags, and overlong 64-bit varints instead of trapping, truncating, or accepting a partial message.
• The package now installs and tests the same serialization module object, and a public-import suite verifies the exported API. The compile-only check step includes the shipped static library.

Guarded verification, serialized under the 3,840 MB ceiling:

• direct public-root suite: 23/23 in Debug and ReleaseFast on pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146;
• repaired package graph: 25/25 native tests in Debug/ReleaseFast on both compilers;
• shipped aarch64-linux-gnu ReleaseFast compile-only check passes on both compilers;
• peak observed guarded footprint: 591 MB.

The three files touched in the build-parity commit pass focused formatting checks on both compilers. Three codec files retain pre-existing formatter-only semantic builtin rewrites (@intFromEnum/@enumFromInt); those unrelated rewrites were deliberately not mixed into the migration.

No cryptographic error handling changed in this slice. The earlier X25519 audit still stands: recoverPublicKey is bridged across the removed error union, while scalarmult remains fallible and its attacker-input identity check must remain.

Pushed fc2937a65 (fix(diagnostics): inject terminal services via std.Io (#884)) directly to origin/main as an exact three-file slice.

The maintained diagnostics target previously did not import colorizer.zig, leaving three removed APIs invisible: std.process.getEnvVarOwned, std.io.getStdErr, and std.io.fixedBufferStream. Direct Zig 0.18 compilation reproduced the failure.

The colorizer now:

• receives a borrowed std.process.Environ.Map instead of allocating ambient environment values;
• receives std.Io for stderr TTY detection and propagates cancellation rather than silently treating it as a non-TTY;
• uses std.Io.Writer.fixed for ANSI sequence construction;
• is exported by the public diagnostics root and covered through deterministic public tests for exact ANSI output, TERM, NO_COLOR, and LANG behavior.

Guarded verification under the unchanged 3,840 MB ceiling:

• exact diagnostics/AST/lexer graph: 13/13 Debug and ReleaseFast on pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146;
• direct colorizer suite: 2/2 Debug/ReleaseFast on both compilers;
• aarch64-linux-gnu ReleaseFast compile-only: passes on both compilers;
• focused formatting and diff checks: clean;
• peak focused footprint: 268 MB.

The broad top-level filtered graph was stopped by the guard at 4,304 MB and receives no passing claim. No limit was raised and no identical retry was run; the exact module graph above uses the same real diagnostics, AST, and lexer sources without unrelated build-graph construction.

fb20db9ac advances the Zig 0.18 migration through the standalone realtime package.

The semantic migration is intentionally explicit:

• RealtimeConfig now owns the caller-provided std.Io.
• realtime timestamps use std.Io.Clock.real.now(io).
• all three drivers use std.Io.Mutex with the same injected I/O implementation.
• tests use std.testing.io and compile through the exact installed module graph.

This avoids a process-global compatibility shim and keeps blocking/cancellation services visible at the API boundary. Both Zig 0.17 and 0.18 pass Debug and ReleaseFast shipped builds/tests, plus x86_64-linux-gnu ReleaseFast compile-only checks.

Redis std.Io migration landed on main in a742b69f6.

This is a semantic migration, not a rename: RedisConfig now carries the injected std.Io; DNS/IP connection, stream operations, close, and pool locking all use that backend. The public-import test materializes Redis and RedisPool, while the package check step compiles the same module used by the shipped static library.

The batch passes Debug and ReleaseFast tests on Zig 0.17.0-dev.2163 and 0.18.0-dev.146, plus x86_64-linux-gnu ReleaseFast compile checks on both.

Cache package std.Io migration landed on main in 60c673b02.

This is the expensive semantic migration class: CacheConfig carries the I/O backend, and clocks, filesystem operations, Redis DNS/TCP streams, closes, and driver mutexes all consume it. No global compatibility backend or test-only workaround was introduced.

The shipped static library and both test suites now share/materialize the exact same public module. Debug checks, ReleaseFast tests, and Linux release compile checks pass on Zig 0.17.0-dev.2163 and 0.18.0-dev.146.

Mail package Zig-master migration landed in e7cadfd7f.

MemoryTransport now receives std.Io, uses std.Io.Mutex for its actual synchronization, and takes timestamps from the injected real clock. The old unused std.net and POSIX clock dependencies are gone. Shipped and tested module graphs are now identical.

Verified on Zig 0.17.0-dev.2163 and 0.18.0-dev.146, including ReleaseFast tests and Linux release compilation.

Rate-limit package Zig-master migration landed in 2d2abd417.

This removes the package's POSIX clock and std.Thread.Mutex dependencies in favor of explicit std.Io injection through token buckets and both stores. A public-import test now materializes the same module used by the installed static library.

Verified on Zig 0.17.0-dev.2163 and 0.18.0-dev.146, including ReleaseFast tests and Linux release compilation.

Logging package Zig-master migration landed in 5e058526c.

This removes legacy std.io, std.fs writer calls, POSIX time, and std.Thread.Mutex usage from the package. Handlers now retain an injected std.Io and std.Io.File, create buffered writers per operation, flush explicitly, and use std.Io.Mutex; child/global logger APIs propagate the same backend.

Verified on Zig 0.17.0-dev.2163 and 0.18.0-dev.146, including ReleaseFast tests and Linux release compilation.

Database std.Io migration landed on main in 26baac70d.

Covered four independently stale network clients (mysql.zig, postgres.zig, postgresql.zig, redis.zig) and their pool synchronization, DNS/IP connection paths, stream lifetime, wire reads/writes, allocator-explicit lists, and declaration-level compile coverage. All four compile on both the pinned Zig 0.17 build and Zig 0.18.0-dev.146; the package passes Debug/ReleaseFast natively and ReleaseFast for x86_64-linux-gnu on both.

Classification: this is a semantic API change, not a rename. No fallible protocol or attacker-controlled input validation was removed; malformed PostgreSQL lengths/rows and malformed RESP lengths/terminators remain error paths.

Pushed 6aac8dd77 to finish the database package's hidden Zig 0.18 graph.

Beyond the four network clients in 26baac70d, this commit migrates both ORM modules from removed writer/collection/reflection APIs and changes the package build so check covers the installed static library and every public module using the same SQLite/libc root. Concrete ORM and typed-ORM tests prevent these declarations from going lazy again.

Debug, ReleaseFast, and x86_64-linux-gnu ReleaseFast all pass on both Zig 0.17.0-dev.2163+89ff10d56 and 0.18.0-dev.146+35accc06e under the 3,840 MB guard.

Zig 0.18 audit progress in 59dea25b6:

• Added shipped/test graph parity for validation, queue, and scheduler.
• Confirmed all three packages compile and test on Zig 0.17.0-dev.2163 and 0.18.0-dev.146 in Debug and ReleaseFast.
• Confirmed their shipped graphs cross-compile for x86_64-linux-gnu ReleaseFast on both compilers.
• The cross-build found a semantic configuration defect, not a rename: queue uses libc close but its module did not declare libc. Native tests concealed it. The shared shipped/test module now carries the dependency.
• Scheduler's standalone build was also missing its actual threading dependency; tests and shipped library now share the same complete graph.

Crypto audit remains conservative: the two Home catches around X25519.scalarmult are retained because that API is still fallible and the peer key is attacker-controlled. Home already calls X25519.recoverPublicKey without try/catch, and has no X25519 generateDeterministic callsite.

Zig 0.18 migration progress in 565c1fbfa:

• auth, config, and i18n now compile installed libraries and tests from one shared module graph.
• i18n's removed allocator-owning ArrayList.init usage was migrated to the explicit allocator API used by both supported Zig versions.
• The stronger test graph exposed escaped substituted-string allocations; generated translations are now owned by Translator and released by deinit.
• Dual-Zig Debug/ReleaseFast host tests and Linux ReleaseFast cross-checks all pass.

This is a semantic ownership/API migration, not a compatibility alias change.

Dual-Zig package-graph progress in 84ae6fd71:

• inline, intrinsics, and volatile now compile their shipped static libraries and tests from one shared module each.
• Debug/ReleaseFast host tests and Linux ReleaseFast cross-checks pass on both Zig 0.17 and 0.18-dev.
• The intrinsics cross-target check exercises its target-specific source through the shipped graph, rather than only a duplicate test root.

No compatibility alias or test weakening was introduced.

Zig 0.18 migration progress in 634c94c31:

• middleware, notifications, and routing now share one module graph between shipped libraries and tests.
• Notifications timestamp acquisition moved from removed std.posix.clock_gettime to std.Io.Clock.real.
• A previously uncompiled multipart fixture now uses cross-version typed @splat rather than invalid string repetition.
• Both Zig versions pass Debug/ReleaseFast host tests and Linux ReleaseFast shipped-graph checks.

This is a real I/O-capability API migration plus build-graph parity, not a renamed enum alias or suppressed test.

Dual-Zig package-graph progress in ad3503b2a:

• session, storage, and templates now compile shipped static libraries and tests from one module graph each.
• Debug/ReleaseFast host tests and Linux ReleaseFast cross-checks pass on Zig 0.17 and current 0.18-dev.
• No compatibility aliases, alternate test roots, or weakened assertions were added.

Eight standalone tested packages still lack shipped-artifact checks.

Dual-Zig package-graph progress in ac5ba9a82:

• compression, I/O, and platform now compile installed static libraries and their tests from the intended module graphs;
• the I/O shipped artifact includes its real collections dependency;
• Debug/ReleaseFast host tests and Linux ReleaseFast cross-checks pass on Zig 0.17 and current 0.18-dev.

Five standalone tested packages still lack shipped-artifact checks.

Dual-Zig package-graph progress in 4793b595b:

• app, HTTP client, and WebSocket now compile installed static libraries and tests from one shared module each;
• Debug/ReleaseFast host tests and Linux ReleaseFast checks pass on Zig 0.17 and current 0.18-dev;
• no test-only alternate implementation or compatibility workaround was introduced.

Only the dependency-rich media and video standalone graphs remain in this audit.

Fresh Zig 0.18.0-dev.146 audit revalidation (2026-10-14):

• X25519.recoverPublicKey is the only reachable X25519 direct-return signature change found. The compatibility bridge in packages/runtime/src/jsc/crypto_compat.zig still compiles and passes under pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146.
• Both first-party X25519.scalarmult call sites retain try/catch. This remains security-significant because attacker-controlled identity/small-order public inputs are rejected through the error union.
• The two generateDeterministic catches in packages/runtime/src/jsc/node_modules.zig are Ed25519, not X25519. Ed25519 remains fallible in 0.18.0-dev.146, so removing those catches would be incorrect.
• No first-party X25519 KeyPair.generateDeterministic call site exists.
• Qualified std.builtin.OptimizeMode.Debug/ReleaseSafe/ReleaseFast/ReleaseSmall aliases remain the dual-version bridge. The focused 9-test build suite passes under both compilers; no bare optimize-mode legacy literals were found.
• The top-level Zig 0.18 build graph evaluates successfully, and zig build test -j1 -Dfilter=crypto-compat passes under 0.18 (guard peak 1,106 MB).
• std.Io is already a broad semantic migration in Home (1,670 first-party references across 388 files). A lexical audit still finds 41 first-party files containing lowercase std.io references; these include a mixture of reachable old APIs, compatibility comments/shims, tests, examples, and dormant package code. They need shipped-graph triage, not a mechanical rename.

No crypto validation was removed in this revalidation.

Zig 0.18 migration progress: 5bf57649a is now on origin/main and the repaired accessibility, CEA-608, CEA-708, GIF, and H.264 source files compile/test identically under the pinned Zig 0.17 compiler and Zig 0.18.0-dev.146.

Focused evidence:

• accessibility/captions: 13/13 on each compiler;
• GIF LZW roundtrip: 1/1 on each compiler;
• H.264 analysis declarations: compile cleanly on each compiler.

This batch distinguishes API migration from semantic repair: allocator-explicit ArrayList calls and the reserved align identifier are 0.18 compatibility changes; caption dispatch/UTF-8 handling, GIF LZW decoding, and allocator-failure ownership are runtime correctness fixes exposed while making the code compile.

Another dual-toolchain migration batch is on origin/main: d0adb9776.

This removes current-Zig blockers in five audio files: the removed ** array-repeat syntax is replaced by typed @splat, shadowing and non-mutated bindings are corrected, and removed std.math.max usage is replaced with @max. Focused audio tests pass 5/5 under both the pinned Zig 0.17 compiler and Zig 0.18.0-dev.146. The full video graph reports the same remaining 33/34 unrelated diagnostics under both toolchains.

Pushed Zig migration batch 2ddb9ff8d to origin/main. Five analysis/decoder files now use typed @splat instead of the removed ** array-repeat form and current allocator-explicit ArrayList calls. The migration also exposed and fixed unsafe PSNR/SSIM slicing by validating the complete YUV420 frame size before indexing.

All 12 focused analysis tests pass on pinned Zig 0.17 and Zig 0.18.0-dev.146. The full video graph now has 28/29 later diagnostics, identical across toolchains apart from the integration test root's extra diagnostic.

Zig migration batch 476a876b6 is now on origin/main. Vorbis, H.264, and VP9 no longer use the removed array-repeat operator; typed @splat preserves the exact fixed-size initialization semantics across pinned Zig 0.17 and Zig 0.18.0-dev.146. Dual-toolchain package diagnostics now stand at 23/24, all outside this five-file batch.

Dual-toolchain migration batch 005147fc5 is on origin/main. Five metadata/streaming modules now use current fixed-array and allocator APIs and clear both pinned Zig 0.17 and Zig 0.18.0-dev.146. Focused coverage is 21/21, and full video diagnostics are down to 18/19. The batch also fixes real RTSP wire-case behavior and SDP ownership uncovered after compilation advanced.

Zig 0.18 migration progress: 1ec0f51c6 is pushed to origin/main with exactly five files.

The batch replaces allocator-capturing ArrayList usage with allocator-explicit operations, replaces removed array repetition syntax with @splat, corrects an @abs(i64) result to u64, and repairs lazy public MP4 paths that only became semantically analyzed once tests exercised them.

Both pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 pass the same focused 23-test root. This is a compatible migration, not a version gate or test workaround.

Zig 0.18 migration progress: d7a389227 is pushed to origin/main.

Four more video files now use allocator-explicit ArrayList initialization, mutation, writers, ownership transfer, and teardown. The shipped packages/video static library compiles under both pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146; remaining failures are isolated to test-only source paths and test-framework call sites.

Zig 0.18 migration progress: 498551180 is on origin/main with five files and 27/27 focused tests passing under both tracked Zig versions.

This batch covers checked enum conversion, the Type.Enum.field_names reflection rename, allocator-explicit robustness/stabilization collections, and the semantic Rational.den to Rational.denom correction. The video unit root now has four remaining source diagnostics, down from sixteen.

Zig 0.18 migration milestone: 4cdcd2fea is pushed to origin/main, and the full packages/video unit suite is now 318/318 green under both pinned Zig and Zig 0.18.0-dev.146.

This includes the expensive API class from the audit: RTMP handshake generation now takes std.Io explicitly and uses std.Io.Clock.real; both client and server generation paths have direct tests. The batch also migrates std.Random, trimStart, and fixes bilinear edge-coordinate semantics.

Zig 0.18 migration update: pushed 4b1aeb1c6 directly to origin/main.

The packages/video build now compiles its installed static library and every test target from the same video_module, target, and optimization selection. The previously unwired integration/conformance binaries were migrated from the old test-framework API and from nonexistent namespace/type assumptions to the current public API.

Verified with Zig 0.18.0-dev.146+35accc06e:

• zig build --build-file packages/video/build.zig check -j1 --summary all: 5/5 steps succeeded
• zig build --build-file packages/video/build.zig test-all -j1 --summary all: 320/320 outer Zig tests passed
• Guarded compile peak: 452 MB

Pinned Zig 0.17.0-dev.2163+89ff10d56 passes the identical compile and test graph, preserving cross-version compatibility.

Pushed f96eb61cf (fix(build): use canonical optimize tags (#884)) directly to origin/main.

This exact three-file slice removes the remaining first-party qualified deprecated OptimizeMode.Debug/ReleaseSafe/ReleaseFast/ReleaseSmall spellings from the active LTO implementation and the JSON import example, and replaces the alias-existence smoke test with direct coverage of the canonical debug/safe/fast/small tags.

Classification: this is a rename-only Zig compatibility change. LTO behavior is unchanged (debug -> None, safe -> Thin, fast/small -> Fat), and no runtime or error-handling semantics changed.

Guarded verification, one process at a time:

• Zig 0.17.0-dev.2163: direct build tests 9/9; wired LTO Debug 6/6; wired LTO ReleaseFast 6/6.
• Zig 0.18.0-dev.146: direct build tests 9/9; wired LTO Debug 6/6; wired LTO ReleaseFast 6/6.
• All three changed files pass zig fmt --check under both compilers and git diff --check.
• Peak guarded footprint was 336 MB.

The broader std.Io migration remains semantic, separately scoped work. The two first-party X25519.scalarmult error paths remain intact because they reject attacker-controlled identity/small-order inputs.

Pushed 90105909d (fix(audio): migrate fixed buffers for Zig 0.18 (#884)) directly to origin/main.

This exact five-file slice removes the next audio blockers exposed by the shipped media dependency graph:

• replaces removed array repetition with typed/inferred @splat initialization in beat/chord analysis and AAC/MP3 decoders;
• migrates the onset and MP3 reservoir lists to the current .empty initializer;
• makes the immutable AAC reader parser binding const.

A temporary in-package root compiled and ran the real modules from the correct packages/audio/src boundary, then was deleted before commit. Results were 25/25 tests on pinned Zig 0.17.0-dev.2163 and 25/25 on Zig 0.18.0-dev.146, with a 203 MB guarded peak. git diff --check passes.

The formatter's unrelated @enumFromInt -> @fromBackingInt rewrites were inspected and reverted; no enum-conversion semantics changed. This is API/syntax migration plus stricter binding correctness, not test weakening.

Pushed 331e92a72 (fix(audio): migrate waveform and decoder buffers (#884)) directly to origin/main.

This second exact five-file audio slice removes all legacy array-repetition syntax from waveform analysis, Opus/Vorbis decoder state, and AIFF/APE fixtures. Opus decode scratch allocations also use immutable bindings now that the slices themselves—not the bindings—are mutated.

A temporary in-package root exercised the real module boundary and was removed before commit. Results:

• pinned Zig 0.17.0-dev.2163: 15/15 tests passed;
• Zig 0.18.0-dev.146: 15/15 tests passed;
• guarded peak: 199 MB;
• no removed ** array repetition remains in these five files;
• git diff --check passes.

Unrelated formatter enum-conversion rewrites were inspected and reverted. This is a source/API migration with unchanged decoder/format semantics, not a compatibility shim or weakened test.

Pushed 32bbf96c2 (fix(audio): migrate format fixture buffers (#884)) directly to origin/main.

This exact five-file slice removes legacy array repetition from DSD, FLAC, MIDI, Ogg, and Opus format fixtures/state. Concatenated magic-byte fixtures now use explicitly typed @splat arrays, while field initializers rely on their declared array types.

The real format modules passed 23/23 tests on pinned Zig 0.17.0-dev.2163 and 23/23 on Zig 0.18.0-dev.146 through a temporary in-package root that was deleted before commit. Guarded peak was 194 MB; git diff --check passes and no removed ** array repetition remains in these five files.

Formatter-generated enum/integer conversion rewrites were inspected and reverted, so this commit changes no parsing or wire-format semantics.

Pushed ba7dfd71f (fix(audio): migrate recorder and format buffers (#884)) directly to origin/main.

This exact five-file slice clears the remaining format/recorder diagnostics from the earlier media graph: TTA, WavPack, WMA and recorder fixed buffers now use typed @splat; WAV's read-only header parser binding is const; and recorder's dynamic sample buffer uses the current .empty initializer.

The real five-module graph passes 27/27 tests under pinned Zig 0.17.0-dev.2163 and 27/27 under Zig 0.18.0-dev.146. Guarded peak was 198 MB. git diff --check passes and no removed array-repetition syntax remains in the five files.

Unrelated formatter alignment and enum-conversion output was inspected and reverted. No format parsing or recording semantics were weakened.

Pushed 851f2d346 (fix(audio): migrate processing state buffers (#884)) directly to origin/main.

This exact five-file slice migrates crossfade, de-esser, equalizer, loudness, and modulation to current fixed-array/list initialization and immutable bindings. De-esser and EQ reset paths use the same @splat state shape as construction; loudness keeps mutable slice contents while making the slice bindings themselves const.

The real processing graph passes 20/20 tests on pinned Zig 0.17.0-dev.2163 and 20/20 on Zig 0.18.0-dev.146. Guarded peak was 196 MB; git diff --check passes and no removed array repetition remains in these five files.

Unrelated formatter table alignment was inspected and reverted. DSP behavior and test thresholds are unchanged.

Pushed c804f2c35 (fix(audio): migrate remaining processing buffers (#884)) directly to origin/main.

This exact five-file slice removes the remaining fixed-array repetition diagnostics from multiband, reverb, sidechain, stereo, and tape processing. Construction, reset, and test-fixture buffers now use typed or field-inferred @splat initialization without changing values or DSP behavior.

Verification:

• pinned Zig 0.17.0-dev.2163: 22/22 tests passed;
• Zig 0.18.0-dev.146: 22/22 tests passed;
• both compilers accept zig fmt --check for all five files;
• git diff --check passes;
• guarded peak: 208 MB.

The earlier media-graph processing diagnostics are now cleared; the full media graph still needs a fresh compile to identify the next reachable layer.

Pushed 0b4359257 (fix(media): migrate collections for Zig 0.18 (#884)) directly to main.

This five-file batch:

• migrates media stream and pipeline lists to allocator-explicit ArrayList APIs used by Zig 0.17/0.18;
• fixes Result.map's invalid fn (T) anytype signature and adds success/error regression coverage;
• replaces Registry.getSupportedFormats()'s dangling stack slice with static combined storage;
• adds the VP6 codec entry already referenced by the FLV registry; and
• removes the Pipeline.fade parameter/method shadowing diagnostic.

Verification used a temporary package-root test (deleted after the run) so relative imports and lazy generic methods were genuinely compiled:

• pinned Zig 0.17.0-dev.2163+89ff10d56: 22/22 passed, 198 MB guarded peak;
• Zig 0.18.0-dev.146+35accc06e: 22/22 passed, 216 MB guarded peak.

Both runs were sequential and stayed under the 3,840 MB ceiling.

Pushed 33d701c63 (fix(media): preserve frame ownership through filters (#884)) directly to main.

This three-file batch removes the filter graph's dangling-frame-pointer bug rather than allocating wrapper objects around it:

• filter processors now mutate the caller-owned Frame and cannot return an unrelated pointer;
• scale/crop replace owned buffers while preserving the original frame address;
• Frame.deinit() uses the allocator recorded by the frame;
• video/audio frame constructors unwind every partial allocation on failure;
• filter lists use Zig 0.17/0.18's allocator-explicit ArrayList API; and
• zero-sized scale/crop and zero-width/height flips are handled without divide-by-zero/underflow.

The permanent filter_graph_test.zig root verifies pointer stability, invalid-crop nonreplacement, and exhaustive allocation failures:

• Zig 0.17.0-dev.2163+89ff10d56: 22/22 passed, 201 MB guarded peak;
• Zig 0.18.0-dev.146+35accc06e: 22/22 passed, 162 MB guarded peak.

Both runs were sequential and stayed below the 3,840 MB ceiling.

Pushed 10fc14ee0 (fix(image): migrate repeated arrays for Zig 0.18 (#884)) directly to main.

This exact five-file batch replaces removed array ** count initialization with typed @splat across image histograms, blur accumulators, ICO palettes, and JPEG Huffman/component/quantization state. It also fixes the same-file immutable ChannelMixer local exposed by current analysis.

Verification on both toolchains:

• all five edited files pass zig ast-check under pinned Zig 0.17.0-dev.2163+89ff10d56 and Zig 0.18.0-dev.146+35accc06e;
• a temporary typed regression covering scalar, struct, nested-array, and initialized-struct splats passed 1/1 under both versions;
• each guarded batch peaked at 173 MB.

The temporary regression file was removed. The full image umbrella still has separate preexisting diagnostics, so this update intentionally makes no package-wide pass claim; those diagnostics are being cleared in subsequent batches.

Pushed bcfe82bb8 (fix(image): migrate histogram buffers for Zig 0.18 (#884)) directly to main.

This exact five-file batch removes the next set of deprecated array-repetition expressions from the image facade, parallel/GPU/SIMD histograms, and QOI codec index tables. It also makes the grayscale scratch-slice binding immutable as required by current Zig analysis.

Each edited file passes zig ast-check under both pinned Zig 0.17.0-dev.2163+89ff10d56 and Zig 0.18.0-dev.146+35accc06e. The guarded checks ran sequentially and stayed far below the 3,840 MB ceiling.

The remaining repetition sites are now isolated to TIFF and steganography and will be handled with the next source-diagnostic batch.

Pushed 16c42bc62 (fix(image): finish repeated buffer migration (#884)) directly to main.

This five-file batch removes the final deprecated array-repetition sites under packages/image/src (TIFF LZW allocation tracking and steganography counters), supplies the explicit alpha conversion type required by current Zig, and fixes immutable ellipse constants.

It also resolves the dither/watermark diagnostics semantically:

• halftone no longer accepts an unused allocator and now applies the configured strength to dot radius;
• watermark scans reject block sizes that would produce a zero loop step;
• visualization allocation is unwound on later failures; and
• dead average accumulation/division was removed while preserving the existing max-strength detector.

All five edited files pass zig ast-check under pinned Zig 0.17.0-dev.2163+89ff10d56 and Zig 0.18.0-dev.146+35accc06e. rg now finds no remaining ** array repetition anywhere under packages/image/src.

Pushed eef1ea4aa (fix(image): migrate reserved identifiers for Zig 0.18 (#884)) directly to origin/main.

This five-file batch removes another set of concrete Zig 0.18 blockers in the image package:

• resolves Color through the canonical image.zig module instead of the nonexistent color.zig;
• renames identifiers that became reserved (i1, j1, error, packed, and the public align field, whose source spelling is preserved with @"align");
• adds the missing void return type on renderBitmapText;
• fixes the strict never-mutated/unused diagnostics exposed while parsing these files.

Verification:

• all five edited source files pass ast-check with pinned Zig 0.17.0-dev.2163+89ff10d56;
• all five pass with CI-target Zig 0.18.0-dev.146+35accc06e;
• both versions pass zig fmt --check on the exact five files;
• git diff --check passes;
• commit has exactly five changed files and is confirmed present at origin/main.

No compatibility shim, suppressed diagnostic, or test weakening was introduced.

Pushed bab4d6587 (fix(image): clear decoder diagnostics for Zig 0.18 (#884)) directly to origin/main.

This exact five-file batch clears six strict mutability diagnostics in the GIF, Radiance HDR, JPEG XL, TGA, and HDR-processing paths. The changes are declaration-only (var to const) and preserve runtime behavior.

Verification:

• all five files pass ast-check under pinned Zig 0.17.0-dev.2163+89ff10d56;
• all five pass under CI-target Zig 0.18.0-dev.146+35accc06e;
• the bounded dual-version run peaked at 12 MB;
• git diff --check passes;
• the commit contains exactly five files and is authored as glennmichael123 <gtorregosa@gmail.com> with no coauthor.

The formatter's unrelated @enumFromInt/@intFromEnum semantic rewrites in GIF/TGA were intentionally excluded.

Pushed e21d9445f (fix(image): migrate analysis paths for Zig 0.18 (#884)) directly to origin/main.

This exact five-file batch covers IPTC metadata, mesh morphing, OCR, color operations, and panorama processing. In addition to clearing strict Zig 0.18 diagnostics, the IPTC implementation now uses allocator-explicit ArrayList APIs throughout, preserves ownership on partial allocation failures, and widens the extended-dataset length before shifting.

Verification:

• all five edited files pass ast-check under Zig 0.17 and 0.18.0-dev.146;
• IPTC passes 5/5 tests under both compilers;
• the new test exhaustively injects allocation failures through both parser and writer paths and passes under both compilers;
• the test run peaked at 211 MB under the 768 MB guard;
• git diff --check passes;
• the commit contains exactly five files and is authored as glennmichael123 <gtorregosa@gmail.com> with no coauthor.

The formatter's unrelated enum-builtin semantic rewrites remain excluded. A package-root color test also exposed separate existing blockers in selection.zig, print_prep.zig, and vector.zig; those are being handled in the next batch rather than hidden in this commit.

Pushed f04caeaf5 (fix(image): restore vector and print module builds (#884)) directly to origin/main.

This exact three-file batch:

• resolves Color through the canonical image.zig module in Selection, Print Prep, and Vector instead of importing the nonexistent color.zig;
• restores the two missing bottom bleed-mark corners, using the previously dead bleed_height value as intended;
• removes Vector's dead radius square and unused sign-tracking state, and makes the number-start binding immutable.

Verification:

• all three files pass ast-check under both Zig 0.17 and Zig 0.18.0-dev.146;
• both compilers pass zig fmt --check on the exact files;
• git diff --check passes;
• a bounded package-root test compile advances past these three modules and now reaches the next independent missing import in curves.zig;
• the commit has exactly three files and the requested author/committer identity, with no coauthor.

Pushed 86b06eb47 (fix(image): resolve canonical Color imports (#884)) directly to origin/main.

This exact five-file batch replaces nonexistent color.zig imports with the canonical Color export from image.zig in Curves, Morphing, RAW, HDR, and Color Blindness. Both Zig 0.17 and Zig 0.18.0-dev.146 pass ast-check and zig fmt --check on all five files; git diff --check also passes.

The bounded package-root test compile now advances through these modules and stops at the next independent stale import in history.zig. Commit identity and the exact five-file boundary were verified before the direct main push.

Pushed de0ac6345 (fix(image): continue canonical Color imports (#884)) directly to origin/main.

This second exact five-file tranche replaces the nonexistent color.zig dependency in History, Forensics, Focus Stack, Sprite, and Steganography with the canonical Color export from image.zig.

All five pass ast-check and zig fmt --check under both Zig 0.17 and Zig 0.18.0-dev.146; git diff --check passes. The bounded package-root compile advances through this tranche and now stops at the next stale import in ocr.zig. Commit identity, no-coauthor status, and the exact five-file boundary were verified before the direct main push.

Pushed 2137d4ffe (fix(image): finish canonical Color imports (#884)) directly to origin/main.

This exact three-file batch repairs Barcode, OCR, and Panorama, completing the stale-import sweep: packages/image/src now contains no references.

Verification:

• all three files pass ast-check under Zig 0.17 and Zig 0.18.0-dev.146;
• all three pass both formatters and git diff --check;
• a temporary package-root harness (removed before commit) passes 8/8 real image/color tests under both compilers;
• guarded peaks were 170 MB on Zig 0.17 and 199 MB on Zig 0.18;
• the commit has exactly three files and the requested identity, with no coauthor.

This closes the nonexistent Color-module blocker as a class. It does not yet claim that every lazy image feature has been instantiated by the package-root tests.

Pushed d0552c9d0 (fix(media): restore public codec and timing APIs (#884)) directly to origin/main.

This exact three-source-file batch restores APIs already required by Home's media bindings and integration contract:

• explicit disabled-stream and PCM codec variants, Ultra quality, common fractional frame rates, timing constructors/comparison aliases, and signed timestamp-safe helpers;
• Pipeline.crf, seek, and to aliases backed by the existing canonical implementations;
• public TranscoderState plus allocator-explicit BatchTranscoder job/result storage.

Verification:

• the shipped media module unit suite passes under pinned Zig 0.17 and Zig 0.18.0-dev.146;
• guarded peaks were 210 MB and 1,026 MB, respectively;
• all three files pass both formatter versions and git diff --check;
• the commit contains exactly three files and is authored/committed as glennmichael123 <gtorregosa@gmail.com> with no coauthor.

The uncommitted build-graph candidate now reduces integration compile failures from 27 to 15. Those remaining failures are being resolved against the real current API rather than by dropping tests from the check step.

Pushed 6f51c63eb (fix(media): preserve codecs and timing statistics (#884)) directly to origin/main.

This exact three-file behavioral batch fixes four failures found only after running the integration suite:

• container extension detection is now ASCII case-insensitive;
• a valid zero-origin monotonic timestamp no longer makes duration/average-FPS report zero;
• ordinary quality presets update CRF/preset/bitrate without overwriting explicitly selected video/audio codecs;
• the lossless preset still selects its lossless audio codec.

The complete media graph passes all 91 tests on pinned Zig 0.17 and passes combined compile/test gates on Zig 0.18.0-dev.146. Guarded peaks were 441 MB and 455 MB. All three files pass both formatters and git diff --check; commit identity and exact file count were verified before direct push.

Landed 9843feeb9 (fix(media): align integration contracts (#884)) directly on main.

This 3-file batch aligns the media integration surface with the implementation: it adds a recoverable Timeout media error and stable -64 error-code mapping, adds the registry's video-codec compatibility shorthand, and updates integration coverage to assert the current signed timestamp, duration, pipeline, filter graph, codec metadata, and error-conversion contracts.

Verification after pruning Zig caches:

• zig build test-integration -j1 passed with pinned Zig 0.17.0-dev.2163+89ff10d56
• The same integration suite passed with Zig 0.18.0-dev.146+35accc06e
• Dual-version AST checks and formatting checks passed for the changed source files
• git diff --check passed
• Guard peak: 1,110 MB under the 1,536 MB ceiling

Commit contains exactly 3 changed files and has no coauthor trailers.

The shipped-audio graph exposed nine source files with managed std.ArrayList fields still initialized as empty anonymous structs. Those are now fixed and pushed directly to main in two small commits:

• 9604dc43e — fix(audio): initialize managed lists explicitly (#884) (5 files)
• 9464093bd — fix(audio): finish managed list migration (#884) (4 files)

This is a Zig API migration, not a behavior workaround: each managed list now uses its declared .empty initializer while retaining allocator-explicit append/deinit calls.

Verification:

• First package-root batch: 19/19 tests passed under pinned Zig 0.17 and Zig 0.18-dev
• Second package-root batch: 20/20 tests passed under both toolchains
• Full shipped audio library, unit-test, and integration-test graph passed under both toolchains
• Guard peaks: 166 MB, 205 MB, and 442 MB respectively
• Both commits have the requested 3–5 files and no coauthor trailers

The separate build-graph patch that exposed these failures remains under validation before it is committed.

Landed 92e213824 (fix(image): migrate core format buffers (#884)) directly on the updated main after a non-force rebase over concurrent documentation work.

The 3-file batch migrates BMP, QOI, and TIFF buffers to allocator-explicit ArrayList ownership (.empty, allocator-aware append/deinit/toOwnedSlice). BMP bitfield decoding also now rejects zero required color masks and narrows only validated shift counts, avoiding both a Zig 0.18 type error and a malformed-input trap.

The package-root format harness passed all 32 tests under pinned Zig 0.17 and Zig 0.18-dev; guarded peaks were 174 MB and 181 MB. The commit has exactly 3 files, is authored by glennmichael123 <gtorregosa@gmail.com>, and has no coauthor trailers.

Three more verified commits are now on main:

• b744aa508 — fix(image): correct operation transforms (#884) (3 files)
• 7c9b82862 — build(image): verify shipped package graph (#884) (3 files)
• 3af628221 — build: verify shipped audio and media graphs (#884) (3 files)

The image operation batch removes alpha dilution from RGB trim distance, corrects the swapped 90°/270° coordinate mappings, adds 270° regression coverage, and strengthens affine composition coverage in both orders. Its package-root suite passed 23/23 under both Zig versions.

The image graph now builds the real exported module into both static and shared libraries, carries release SIMD configuration on that module, and compiles/runs format and operation tests through package-root harnesses instead of invalid nested module roots. zig build check test-all -j1 passed under pinned Zig 0.17 and Zig 0.18-dev (376 MB peak).

The audio and media graphs now compile the same exported modules they ship, install static libraries, compile all unit/integration targets in check, and remove the unused/nonexistent media test-framework dependency. The complete audio graph passed under both Zig versions (442 MB peak), and the complete 91-test media graph passed under both (448 MB peak).

All three commits contain exactly 3 files, use glennmichael123 <gtorregosa@gmail.com>, and have no coauthor trailers.

Landed 46f4b51ff (fix(audio): migrate file APIs to std.Io (#884)) directly on main.

This three-file slice migrates the high-level audio load/save APIs and WAV/AIFF file writers from the removed std.fs.cwd() surface to std.Io, while retaining convenience wrappers backed by the threaded default I/O implementation. It also:

• adds explicit *WithIo entry points so callers and tests can provide their own std.Io;
• finishes the allocator-explicit unmanaged std.ArrayList(AudioFrame) migration in the high-level loader;
• makes file-backed WavReader own and release its allocated input buffer;
• adds real temporary-file coverage for high-level save, WAV read/write ownership, and AIFF write paths.

Verified serially under a 1,536 MB guard:

• pinned Zig 0.17.0-dev.2163+89ff10d56: zig build check test integration-test -j1 passed (248 MB peak tree footprint);
• CI Zig 0.18.0-dev.146+35accc06e: the same full shipped audio graph passed (1,101 MB peak).

The first cold run also exposed four previously lazy parser failures in AIFF/MP3/FLAC/OGG. Those are real follow-up migration work rather than being hidden or worked around; I am addressing them as the next coherent batch.

Landed follow-up b9b232506 (fix(audio): repair lazy format parsers (#884)) directly on main.

The cold full-graph run from the previous slice correctly exposed four paths that Zig had not lazily analyzed before. This five-file batch fixes and tests them:

• AIFF: corrects the COMM num_frames and SSND block_size reads from oversized 6/8-byte slices to the format-defined 4-byte fields; a real encode/decode round trip now exercises both;
• FLAC and OGG: migrates Vorbis-comment lists to allocator-explicit std.ArrayList, including cleanup for the vendor and the current field/value pair on allocation failure;
• MP3: removes the impossible error union from parseV2Header because the function performs no fallible operation (rather than adding a meaningless try at its caller);
• high-level audio: restores the disk save/load round trip so the complete format-dispatch cone is analyzed and the loaded PCM values are checked.

Verification, serial under a 1,536 MB guard:

• pinned Zig 0.17.0-dev.2163+89ff10d56: zig build check test integration-test -j1 passed (438 MB peak tree footprint);
• CI Zig 0.18.0-dev.146+35accc06e: the same complete shipped audio graph passed (253 MB peak).

This distinguishes API-only migration from semantic fixes: the list calls are renames/signature migration, the AIFF widths are correctness fixes, and the MP3 error-union removal is safe specifically because that function cannot fail. No real attacker-input error path was removed.

Landed dffaed490 (fix(audio): harden format buffer handling (#884)) directly on main.

This five-file batch finishes another lazily compiled std.ArrayList migration slice across AAC, FLAC, OGG, Opus, and WMA. It adds allocator-explicit ownership and tests for each path, including complete cleanup of partially constructed Opus tags.

The new round-trip tests also found and fixed two semantic ownership/layout defects that were independent of the API rename:

• WmaReader.decodeUtf16Le returned a static empty string from an API whose callers always free the result; empty output is now allocator-owned like every other result.
• StreamInfo.parse extracted FLAC’s packed sample-rate/channel/bit-depth/total-sample fields from incorrect shifts and byte offsets. It now decodes the format-defined 20/3/5/36-bit layout, verified by writing and parsing a stereo 44.1 kHz/16-bit STREAMINFO block.

Verification, serial under a 1,536 MB guard:

• pinned Zig 0.17.0-dev.2163+89ff10d56: complete zig build check test integration-test -j1 passed, 264/264 unit tests (247 MB peak);
• CI Zig 0.18.0-dev.146+35accc06e: the same complete shipped audio graph passed (254 MB peak).

Landed c8e4f1c6d (fix(audio): finish std.Io and list migration (#884)) directly on main.

This four-file closure batch removes the final legacy std.fs.cwd() and allocator-capturing std.ArrayList(...).init(...) calls from packages/audio/src:

• playlist parsers/writers now expose explicit-I/O methods and have real M3U/PLS temporary-file round trips;
• batch directory discovery stores its std.Io, uses the new directory/walker APIs, and correctly distinguishes recursive from non-recursive scans (the old walker always descended despite recursive = false);
• MIDI parsing uses allocator-explicit temporary lists with complete nested-track cleanup on failure;
• the Ogg Opus writer uses allocator-explicit output storage and is exercised through a real write.

The MIDI test also exposed and fixed a semantic bug: pitch-bend data was cast to signed i14 before subtracting the 8192 center, even though positive 8192 is not representable by i14. Arithmetic now uses an i15 intermediate and narrows only after centering; the test verifies the wire value 0x2000 becomes zero.

Verification, serial under a 1,536 MB guard:

• pinned Zig 0.17.0-dev.2163+89ff10d56: complete zig build check test integration-test -j1 passed (435 MB peak);
• CI Zig 0.18.0-dev.146+35accc06e: the same complete shipped audio graph passed (262 MB peak);
• source audit: zero remaining matches for std.fs.cwd( or std.ArrayList(...).init( under packages/audio/src.

Pushed 14bb452a4 (fix(image): migrate lazy buffers to Zig 0.18 (#884)) directly to main.

This three-file image slice migrates the barcode, flood-fill, magic-wand, and lasso work buffers to allocator-explicit std.ArrayList APIs. Exercising those previously lazy paths also found and fixed real defects: stale .rgba tags, nonexistent Image.create calls, optional pixels passed to color math, unchecked optional pop() results, and missing error-path cleanup. New behavioral tests cover Code 128, QR quiet zones, flood-fill boundaries, contiguous magic-wand selection, selection-mask rendering, and lasso filling.

Verification:

• pinned Zig 0.17.0-dev.2163+89ff10d56: zig build check test-all -j1 passed; guarded peak 377 MB
• CI Zig 0.18.0-dev.146+35accc06e: the same shipped-library and full test graph passed; guarded peak 352 MB
• source audit: no allocator-capturing ArrayList.init, Image.create, or stale .rgba remains in the three changed files

No error-union handling was removed in this slice.

Pushed ddeed51c1 (fix(media): migrate streaming I/O to std.Io (#884)) directly to main.

This three-file slice migrates image streaming/mmap, media file probing, and the high-level Media.open path to caller-provided std.Io. It also fixes two behavioral issues found while forcing the paths through real tests:

• StreamingReader.read now advances the public position and uses positional reads, so seek and getPosition describe actual subsequent reads.
• StreamingWriter.flush now writes all buffered bytes; the old single write could silently discard a short-write suffix.
• failed opens clean up file handles, duplicate opens are rejected, zero-sized writer buffers are rejected, and mapped-file handles use the same I/O context for close.
• Media.deinit now frees the path owned by its probed MediaInfo; the prior Media.open path duplicated the pathname twice and released only one copy.

Verification (all serial and memory-guarded):

• image graph, pinned Zig: zig build check test-all -j1 passed, peak 404 MB
• image graph, Zig 0.18.0-dev.146+35accc06e: passed, peak 405 MB
• media graph, pinned Zig: passed, peak 436 MB
• media graph, Zig 0.18.0-dev.146+35accc06e: passed, peak 296 MB
• source audit: no legacy std.fs.File/std.fs.cwd() remains in the three changed files

Scoping note: I initially added the same explicit-I/O surface to high-level Image.load/save. Its real round-trip test correctly forced every branch of Image.encode through analysis and exposed 23 pre-existing failures across roughly 18 format modules (mostly allocator-capturing ArrayList.init, plus AVIF/HEIC/JXL bit-width errors). I removed that unverified high-level change from this commit. Those encoders need small format batches first; after they are green, high-level image file I/O can be migrated and tested honestly.

No crypto/error-union handling was changed in this slice.

Pushed ca95d81a2 (fix(image): migrate AVIF HEIC and JXL encoders (#884)) directly to main.

This three-file encoder tranche removes allocator-capturing ArrayList state throughout AVIF, HEIC, and JPEG XL encoding, passes allocators explicitly through nested box/bitstream writers, and adds real encoder tests that assert the emitted container structure.

Semantic fixes found while forcing those paths:

• AVIF and HEIC bit readers now derive the shift from bits_available - bits_to_read; the old expression had a possible intermediate value of 8 that cannot fit in u3.
• JPEG XL readBits now rejects widths above 32 before narrowing the shift count for its u32 accumulator. This preserves a meaningful malformed-input check instead of merely casting a wider attacker-controlled count.

Verification:

• pinned Zig 0.17.0-dev.2163+89ff10d56: full image zig build check test-all -j1 passed, guarded peak 377 MB
• CI Zig 0.18.0-dev.146+35accc06e: same shipped-library and full test graph passed, guarded peak 407 MB
• no allocator-capturing ArrayList.init, stored-list allocator lookup, or allocator-less owned-slice transfer remains in these three files

No std.crypto error-union handling changed in this slice.

Pushed 36ea7ab71 (fix(image): migrate DDS EXR and FLIF encoders (#884)) directly to main.

This three-file encoder tranche migrates DDS, EXR, and FLIF buffers to allocator-explicit std.ArrayList APIs and activates real encoder coverage.

Additional correctness findings from the newly analyzed paths:

• EXR channel parsing now frees the just-allocated channel name if list growth fails.
• EXR scanline decoding gives channel widths a runtime usize type and checks the full 2- or 4-byte channel width before reading, rather than checking only two bytes for every pixel type.
• The previously dormant FLIF varint test expected value 128 to occupy two bytes, contradicting both its writer and reader's documented 1-based representation. Coverage now round-trips 1, 128, and the actual two-byte boundary 129.

Verification:

• isolated 17-test DDS/EXR/FLIF root passed on pinned Zig (209 MB peak) and Zig 0.18.0-dev.146 (303 MB peak); the temporary root was deleted
• full image zig build check test-all -j1 passed on pinned Zig (399 MB peak)
• the same shipped-library/full-test graph passed on Zig 0.18.0-dev.146 (1,017 MB peak)
• no allocator-capturing list initialization or allocator-less owned-slice transfer remains in these three files

No std.crypto error-union handling changed in this slice.

Pushed d9cc2c959 directly to main: fix(image): migrate HDR PSD and TGA encoders (#884).

This is an exact three-file Zig 0.18 migration tranche:

• formats/hdr.zig: moved encoder storage to allocator-explicit ArrayList, replaced removed std.fmt.formatIntBuf with std.fmt.printInt, and fixed two real round-trip bugs exposed by active encoder coverage: the decoder stopped at the blank header separator before parsing dimensions, and the -Y encoder emitted scanlines in the opposite vertical order.
• formats/psd.zig: moved planar output construction to allocator-explicit list APIs and added an exact RGBA encode/decode round trip.
• formats/tga.zig: moved raw/RLE output helpers to allocator-explicit list APIs and added exact raw and RLE pixel round trips.

Verification, each run alone under the memory supervisor:

• targeted HDR/PSD/TGA graph: 17/17 on pinned Zig 0.17.0-dev.2163+89ff10d56 (202 MB peak)
• targeted HDR/PSD/TGA graph: 17/17 on Zig 0.18.0-dev.146+35accc06e (182 MB peak)
• full packages/image test-all: pass on pinned Zig (571 MB peak)
• full packages/image test-all: pass on Zig 0.18 (618 MB peak)

No compatibility shim, test weakening, or generated file was committed.

Pushed d8d49b61e directly to main: fix(image): migrate PNG ICO and Netpbm codecs (#884).

This exact three-file tranche ports real codec paths rather than adding compatibility wrappers:

• formats/png.zig: allocator-explicit nested APNG lists, Zig 0.18 std.Io.Reader / std.Io.Writer.Allocating plus std.compress.flate for zlib, incremental CRC computation, and strict decompression errors.
• formats/ico.zig: allocator-explicit container output and PNG-backed encoding.
• formats/ppm.zig: allocator-explicit PPM/PGM/PBM output and std.fmt.printInt.

The active round trips exposed and fixed additional semantic/ownership defects: PNG palette/frame failure cleanup, duplicate palette/transparency ownership, ICO partial-encode cleanup, and a 4-bit ICO palette shift incorrectly typed as u2.

Verification, one supervised process at a time:

• targeted PNG/ICO/PPM graph: 18/18 on pinned Zig 0.17.0-dev.2163+89ff10d56 (207 MB peak)
• targeted PNG/ICO/PPM graph: 18/18 on Zig 0.18.0-dev.146+35accc06e (191 MB peak)
• full packages/image test-all: pass on pinned Zig (618 MB peak)
• full packages/image test-all: pass on Zig 0.18 using isolated caches after a reproducible shared-cache missing-object failure (1,065 MB peak)

Coverage includes exact RGBA PNG, ICO-through-PNG, PPM RGB, PGM grayscale, and PBM packed-row round trips. No shim, test weakening, or generated test root was committed.

Landed 7a739303c (fix(image): migrate GIF SVG and RAW codecs (#884)) directly on main.

This three-file Zig 0.18 migration slice covers:

• GIF: allocator-explicit lists, balanced partial-frame ownership, strict truncated palette handling, and the valid 256-entry color-table shift fix (u3 could not represent shift count 8).
• SVG: allocator-explicit parser/encoder lists, allocation failures now propagate from path rasterization instead of being silently discarded, and encoder/decode round-trip coverage.
• RAW/DNG: allocator-explicit output, endian-correct inline TIFF SHORT parsing, selected SubIFD metadata stays paired with its strip, checked dimensions/strip sizes, correct DNGVersion byte order, and RGB TIFF strips now decode as RGB instead of being misinterpreted as Bayer sensor data.

Verification (fresh isolated caches, one guarded process at a time):

• pinned Zig 0.17.0-dev.2163+89ff10d56: image test-all 66/66 passed, peak tree footprint ~1,046 MB.
• Zig 0.18.0-dev.146+35accc06e: image test-all 66/66 passed, peak tree footprint ~1,060 MB.

All temporary Zig caches used for the run were removed afterward.

Landed b728b7643 (fix(image): migrate metadata writers (#884)) directly on main.

This five-file slice migrates and activates the EXIF, ICC, and XMP metadata paths:

• EXIF uses allocator-explicit list ownership, computes string-data offsets from the final IFD entry count, rejects overflowed/out-of-range value offsets, and declares the precise allocator error set for its recursive IFD parser.
• ICC uses allocator-explicit writer buffers, writes profile/color-space signatures in required big-endian order, validates tag ranges without overflow, and releases replaced/failed unknown-tag allocations.
• XMP uses allocator-explicit property/writer/list storage and fully cleans up partially parsed RDF list items.
• A real test-metadata package target is compiled by check and executed by test-all; this raised the full image suite from 66 to 78 discovered tests.

New behavioral coverage round-trips multi-string EXIF data and orientation, generates/parses an sRGB ICC profile with exact signatures and gamma, and writes/parses XMP attributes.

Fresh-cache guarded verification, one process at a time:

• pinned Zig 0.17.0-dev.2163+89ff10d56: 78/78 passed, peak tree footprint ~1,041 MB;
• Zig 0.18.0-dev.146+35accc06e: 78/78 passed, peak tree footprint ~1,117 MB.

All temporary caches were removed after verification.

Pushed 169d05bfb (fix(image): activate advanced image operations (#884)) directly to main.

This four-file slice activates the previously dormant color-blindness, composition/clipping-path, and dithering modules in the operations test root and ports their allocator-owned lists to the Zig 0.18 APIs. It also fixes the behavioral defects exposed by activating them:

• color-blindness simulations now reject unsupported pixel formats and clean up every partially constructed image/report allocation;
• accessibility reports transfer ownership atomically, including duplicated recommendation strings;
• layer, mask, composition, and clipping-path construction now clean up on allocation failure;
• mergeVisible builds the replacement layer before destructively replacing the old layer list;
• clipping-path point/segment mutations reserve both lists before committing either side;
• dithering rejects unsupported/indexed and invalid palette/count inputs instead of interpreting bytes with stale pixel-format tags;
• threshold dithering preserves alpha, error diffusion handles empty images safely, and quantization owns/frees its palette correctly.

Verification from empty isolated caches, one guarded process at a time:

• pinned Zig 0.17.0-dev.2163+89ff10d56: packages/image test-all passed; peak tree footprint 1,020 MB;
• Zig 0.18.0-dev.146+35accc06e: the same test-all passed; peak tree footprint 1,025 MB.

All temporary Zig caches from this verification were removed.

Pushed 0d911d630 (fix(image): migrate JPEG WebP and JP2 codecs (#884)) directly to main.

This exact four-file slice migrates JPEG, WebP, and JPEG 2000 encoder storage/helpers to allocator-explicit Zig 0.18 list APIs and explicitly activates JP2 in the format-test root.

The newly analyzed paths also exposed and fixed behavioral defects:

• JPEG now rejects zero/oversized dimensions and pixel formats its 8-bit baseline header cannot represent before narrowing dimensions;
• WebP validates its 14-bit VP8L dimensions and supported 8-bit formats, checks decoded pixel-buffer multiplication, rejects truncated subchunks, propagates animation-frame decode failures, and frees only initialized frame buffers on partial failure;
• WebP color-index transform size is now u9, preserving the valid 256-entry case instead of narrowing it to u8;
• JP2 box parsing now rejects truncated/oversized and malformed extended boxes without offset arithmetic underflow;
• JP2 rejects zero dimensions and unsupported 16-bit formats rather than writing an 8-bit header for them;
• JP2 Psot now reports the actual 15-byte tile-part length rather than the previous one-byte-short value.

Coverage now exercises JPEG baseline dimensions and format rejection, WebP RIFF/VP8L encode-decode dimensions, JP2 container/codestream encode-decode dimensions, and malformed JP2 box bounds.

Fresh-cache guarded full packages/image test-all verification, one process at a time:

• pinned Zig 0.17.0-dev.2163+89ff10d56: passed; peak tree footprint 986 MB;
• Zig 0.18.0-dev.146+35accc06e: passed; peak tree footprint 1,078 MB.

All temporary codec caches were removed after verification.

Pushed 653995839 (fix(image): activate steganography and vector operations (#884)) directly to main.

This three-file Zig 0.18 migration slice activates steganography.zig and vector.zig in the operations test graph. It ports their allocator-explicit collections and fixes the dormant behavior exposed by activation: consistent LSB byte capacity, 1/2/3/4-bit encrypted round trips, header and key validation, overflow-safe watermark bounds, owned watermark results, empty-pattern validation, bounded Bezier flattening, SVG parse errors, zero-segment arcs, zero-size raster handling, and radial-gradient division by zero.

Verification from empty caches:

• pinned Zig 0.17.0-dev.2163+89ff10d56: full packages/image test-all passed; guarded peak 1,044 MB
• Zig 0.18.0-dev.146+35accc06e: full packages/image test-all passed; guarded peak 1,105 MB
• git diff --check passed

All temporary Zig caches were removed after verification.

Pushed 21f386752 (fix(image): harden utility ownership lifecycles (#884)) directly to main as an exact four-file slice.

This activates the previously dormant format/image utility paths in the operations root and migrates their lists to allocator-explicit Zig 0.18 APIs. The active tests exposed and fixed:

• animation clone/insert/export failure cleanup, frame-dimension validation, and the incorrect ping-pong order;
• allocator mismatch between exported frame storage and the owning Image;
• multi-page metadata replacement leaks, split/merge partial ownership, zero-page-group and contact-sheet dimension validation;
• bounded APNG/WebP/GIF chunk walking for malformed input;
• duplicate image-pool releases that could hand the same buffer to two callers, allocation-failure cleanup, checked pooled-image sizing, and invalidation after release;
• allocator-correct thumbnails, checked tile/grid/padding dimensions, partial-tile cleanup, and highlighted diffs sized to both inputs;
• Zig's nominal anonymous-struct mismatch in the SIMD histogram result.

Fresh-cache verification, one guarded process at a time:

• pinned Zig 0.17.0-dev.2163+89ff10d56: full packages/image test-all passed; peak 1,017 MB
• Zig 0.18.0-dev.146+35accc06e: full packages/image test-all passed; peak 1,086 MB
• git diff --check passed

All temporary Zig caches were removed. The next reproduced slice is the batch file-I/O traversal, which exposed the remaining Image.load/save std.Io migration plus SVG view-box and TIFF bit-reader type defects.

Pushed e501b0c26 (fix(image): harden codec parser bit readers (#884)) directly to main.

This four-file codec slice ports the concrete parser hardening found during the active image test audit:

• AVIF/HEIC bit readers no longer overflow a u3 while advancing exactly one byte.
• TIFF bit extraction performs the width arithmetic before safely narrowing the shift.
• SVG view-box parsing now rejects missing, extra, non-finite, and non-positive values.
• SVG recursive parser functions use an explicit allocator error set, avoiding inferred error-set recursion.

Verification used a fresh isolated codec test root under both supported compiler tracks: 91/91 tests passed with pinned Zig 0.17 (377 MB peak) and Zig 0.18-dev.146 (380 MB peak). The temporary test root and both compiler caches were removed afterward. Commit authorship is glennmichael123 <gtorregosa@gmail.com> with no coauthors.

Pushed ebe7a0be2 (fix(image): migrate file APIs to std.Io (#884)) directly to main.

This five-file slice completes the image package's explicit-I/O boundary and exercises the shipped configuration:

• Image.loadWithIo, saveWithIo, and saveAsWithIo accept caller-provided std.Io; compatibility entry points delegate to the single-threaded global I/O implementation.
• File allocation is capped, encoded output uses streaming writes, image-size multiplication is checked, and clone cleanup now covers palette-allocation failure.
• The utility test performs a real QOI batch round trip through temporary input/output directories.
• A dedicated test-io root owns file/batch coverage and is wired into both check and test-all; check also compiles the shipped static and shared libraries.

Fresh-cache verification passed check test-all on both compilers under a 1,536 MB guard: pinned Zig 0.17 peaked at 1,391 MB; Zig 0.18-dev.146 peaked at 1,504 MB. All four isolated caches were removed afterward. Commit authorship is glennmichael123 <gtorregosa@gmail.com> with no coauthors.

Pushed 5d046b50c (fix(build): migrate owned collection APIs (#884)) directly to main as an exact three-file slice.

Current-state audit first disproved the stale packages/io failure: its shipped static library, embedded tests, and public-consumer tests all pass unchanged under pinned Zig 0.17 (1,039 MB peak) and Zig 0.18-dev.146 (1,083 MB peak).

The direct build-subsystem import audit then exposed real 0.18 failures in cross_compilation.zig, linker_script.zig, and packaging.zig. This commit:

• migrates allocator-owned lists and byte writers to the dual-supported allocator-explicit / std.Io.Writer.Allocating APIs;
• cleans up partially accumulated flags and commands on allocation failure;
• makes every linker argument uniformly owned, removing the unsafe cleanup heuristic that freed arguments based only on -L/-l prefixes;
• makes package-file insertion atomic across source/destination duplication and list growth;
• replaces an indeterminate enum-vs-undefined test with exact host architecture/OS mapping assertions;
• adds active command ownership, metadata formatting, package-file, and distribution-list coverage.

Fresh-cache guarded verification passed 9/9 tests on pinned Zig 0.17 (283 MB peak) and Zig 0.18-dev.146 (248 MB peak). The temporary import root and all audit caches were removed. Commit authorship is glennmichael123 <gtorregosa@gmail.com> with no coauthors.

Pushed 5fd816740 (fix(build): migrate file watcher to std.Io (#884)) directly to origin/main.

This 4-file slice:

• adds a standalone packages/build/build.zig gate that compiles the shipped static library and tests with the same libc setting;
• migrates the build file watcher from legacy std.fs / std.Thread.Mutex / std.Thread.sleep calls to explicit std.Io filesystem, mutex, clock, and sleep APIs;
• fixes duplicate-watch and append-failure ownership paths;
• fixes a pre-existing use-after-free where pollEvents shallow-copied event paths and then freed them, and adds an active ownership test;
• rolls back running when watcher thread creation fails;
• removes temporary heap copies leaked by IRCache.saveMetadata, and fixes the cache test cleanup order.

Fresh-cache verification, one guarded process at a time under a 1,536 MB ceiling:

• Zig 0.18.0-dev.146+35accc06e: check test passed, 15/15 tests, no leaks or warnings, 1,081 MB peak tree footprint.
• pinned Zig 0.17.0-dev.2163+89ff10d56: check test passed, 15/15 tests, no leaks or warnings, 1,026 MB peak tree footprint.

The newly activated incremental suite is deliberately tracked as the next substantive slice rather than represented as green: it currently exposes five failures and hundreds of allocator leaks around cache I/O ownership and parallel scheduling. The next patch will fix those defects and only then add incremental_test.zig to the active package test root.

Pushed 35ea544d6 (fix(build): make incremental cache ownership safe (#884)) directly to origin/main.

This activates incremental_test.zig in the build package's real test root and fixes the defects it exposed. The baseline was 17/22 passing with 5 failures and 422 allocator leaks. The repaired suite is 22/22 passing with zero leaks on both compilers.

Root fixes in this 4-file slice:

• ParallelBuilder.init now owns a concurrent std.Io.Threaded backend for compatibility callers; initWithIo supports explicit caller-provided I/O and is used by deterministic tests.
• Cache and statistics access shared by worker threads is synchronized instead of racing an AutoHashMap and counters.
• Per-task I/O backend construction was removed; workers reuse the builder's correctly scoped backend.
• A failed dependency wave now reports BuildFailed rather than being misclassified as CircularDependency.
• Partial task/deque/thread creation has complete rollback, including joining already-spawned workers if a later spawn fails.
• Source reads handle partial positional reads and cache compile time is computed from an actual completion timestamp.
• IRCache.get records misses and frees invalid entries; put atomically replaces owned metadata without leaking the previous entry; failed writes and partial metadata loads release their allocations.
• LRU eviction always makes progress when an oversized cache has fewer than four entries.
• The tests now persist the first builder before reopening its cache, use distinct content for parallel modules, and apply real 64 KiB payloads with unique keys for size-pressure eviction. The eviction gate triggered 12 real evictions.
• Same-key replacement is now covered explicitly and retains exactly one map entry.

Fresh-cache guarded verification, one process at a time under a 1,536 MB ceiling:

• Zig 0.18.0-dev.146+35accc06e: check test passed, 22/22 tests, zero leaks, 1,079 MB peak tree footprint.
• pinned Zig 0.17.0-dev.2163+89ff10d56: check test passed, 22/22 tests, zero leaks, 992 MB peak tree footprint.

Pushed e3ed6652a (fix(build): migrate pipeline entrypoints to std.Io (#884)) directly to main.

This five-file slice activates and ports the previously lazy build-pipeline surface:

• BuildPipeline, IntegrationTestRunner, and common integration scenarios are now forced through the package test root with refAllDecls.
• Pipeline, LTO, linker execution, integration file I/O, clocks, and child processes now receive and use an explicit std.Io provider.
• The linker uses std.process.spawn/Child.wait and checks Child.Term.success() without dropping signal or nonzero-exit checks.
• LTO reads/stats/output use the I/O-aware APIs, allocator exhaustion still propagates, and owned call-name lists plus optimized-output failure paths are cleaned up correctly.
• Added an active integration temporary-file round-trip test; the package's shipped static library and tests still share link_libc = true.

Fresh isolated-cache verification under the guarded runner:

• Zig 0.18.0-dev.146+35accc06e: zig build --build-file packages/build/build.zig check test passed; peak process-tree footprint 1,097 MB.
• Pinned Zig 0.17.0-dev.2163+89ff10d56: the identical check test command passed; peak process-tree footprint 1,034 MB.
• No allocator leak diagnostics; staged diff contained exactly the five intended files.

This advances the real-source and explicit-std.Io acceptance work; #884 remains open for the remaining package surfaces and CI lane.

Pushed 093c062ef78ad918abcf6008822a0d71c5817d89 (fix(cache): migrate incremental storage to std.Io (#884)) directly to main.

This found a hidden coverage gap: packages/cache/src/incremental.zig was excluded from both the package build and the top-level cache test root, so the existing green Zig 0.18 build did not compile it. The commit activates it in both places and ports the implementation to explicit std.Io without compatibility shims.

The same slice also fixes real ownership and behavior defects exposed while making the module executable: module keys/paths/dependency lists/artifact paths are now owned consistently, replacement and failure paths release prior allocations, dependency-to-dependent edges are populated, invalidation is transitive and removes artifacts, metadata I/O is bounded, and cache cleaning measures and evicts actual artifacts. The removed std.fmt.fmtSliceHexLower call was replaced by deterministic SHA-256 hex encoding; no cryptographic validation or attacker-input check was removed.

Verification (each heavy process guarded and run serially):

• Zig 0.18 and pinned Zig formatting checks: pass
• Package Debug, Zig 0.18: 9/9 steps; public suite 14/14
• Package Debug, pinned Zig: 9/9 steps; public suite 14/14
• Top-level -Dfilter=cache, Zig 0.18: 5/5 steps, 30/30 tests
• Top-level -Dfilter=cache, pinned Zig: 5/5 steps, 30/30 tests
• Package ReleaseFast, Zig 0.18: 9/9 steps, 19/19 tests
• Package ReleaseFast, pinned Zig: 9/9 steps, 19/19 tests
• Peak observed memory: 1,085 MB (below the 3,840 MB ceiling)

#884 remains open for the remaining Zig 0.18 migration slices.

Pushed d028eae1a56b8c11efb2e9a2379435f3c88979f2 (fix(cache): activate dependency graph tracking (#884)) directly to main as an exact four-file slice.

The dependency tracker was another hidden source gap: it was excluded from both the standalone cache build and Home's top-level cache test graph. Forcing every declaration under Zig 0.18 exposed five real failures: removed managed-ArrayList construction/deinit APIs, stale owned-slice calls, and the obsolete .ImportStmt AST variant.

This slice activates the real module in both build graphs and fixes the behavior exposed by doing so:

• forward and reverse dependency edges are reserved and duplicated before either graph is mutated, keeping both maps coherent on allocation failure;
• graph keys, edges, compilation-order results, and cycle results have explicit ownership and complete cleanup;
• current .ImportDecl segmented paths are joined into canonical slash-separated dependency names;
• cycle detection returns only the exact closed cycle without leaking every acyclic DFS path;
• invalidation handles cycles and owns committed keys correctly;
• statistics include dependency-only leaf modules;
• duplicate edges remain idempotent.

An exhaustive checkAllAllocationFailures test caught an additional recursive-invalidation double free during this work: a key had already transferred into the invalidation map before a later dependent allocation failed. Ownership now transfers exactly at the successful put boundary, and the complete failure sweep passes.

Final fresh-cache guarded verification, one process at a time:

• standalone package Debug, Zig 0.18: 9/9 steps, 22/22 tests; 1,054 MB peak
• standalone package Debug, pinned Zig: 9/9 steps, 22/22 tests; 1,044 MB peak
• top-level -Dfilter=cache, Zig 0.18: 5/5 steps, 33/33 tests; 1,115 MB peak
• top-level -Dfilter=cache, pinned Zig: 5/5 steps, 33/33 tests; 982 MB peak
• standalone ReleaseFast: passes on both compiler tracks
• both compilers' formatting checks and git diff --check: pass

No error union or security-relevant validation was removed. #884 remains open for the remaining dormant package surfaces and standard-library migrations.

Pushed a34352dc10012663e66f84d1c38129aeef4a6bb2 (fix(io): migrate INI files to std.Io (#884)) directly to main as an exact three-file slice.

This closes another false-green coverage gap. The existing standalone packages/io gate reported 2/2 passing under Zig 0.18, but directly invoking the exported IniFile.parseFile failed because it still called removed std.fs.cwd(). The top-level build had no dedicated I/O package test target, and test compilation substituted an inline map instead of exercising the shipped collections implementation.

The patch:

• adds IniFile.parseFileWithIo using caller-provided std.Io and keeps parseFile as the real single-threaded compatibility entry point;
• makes tests use the production collections map rather than a test-only fallback;
• makes section, block, nested-block, map-key, and property-value ownership explicit on every partial allocation path;
• replaces duplicate section/property values without leaking their previous allocations;
• uses isolated temporary directories instead of a shared /tmp/test.ini fixture;
• adds a specific top-level io_package test target so filtering does not accidentally select unrelated iommu/diagnostics tests;
• runs exhaustive allocation-failure coverage across duplicate sections, duplicate properties, and nested blocks;
• executes both explicit-I/O and compatibility file entry points.

Guarded verification, one process at a time:

• standalone package Debug, Zig 0.18: 7/7 steps, 5/5 tests
• standalone package Debug, pinned Zig: 7/7 steps, 5/5 tests
• top-level -Dfilter=io_package, Zig 0.18: 3/3 steps, 5/5 tests
• top-level -Dfilter=io_package, pinned Zig: 3/3 steps, 5/5 tests
• standalone package ReleaseFast: 7/7 steps, 5/5 tests on both compiler tracks
• peak observed process-tree footprint: 1,119 MB during the baseline build; patched runs peaked at 1,072 MB
• both compiler formatting checks and git diff --check: pass

This is a semantic std.Io migration plus ownership repair; no fallible operation or validation check was removed. #884 remains open for the remaining dormant buffered/regex and package surfaces.

Pushed 5d25fa78f5256c844219e50ee70dfc9fea1b9004 (fix(io): migrate buffered files to std.Io (#884)) directly to main as an exact four-file slice.

The buffered I/O module was neither exported nor compiled by the package test graph. Forcing every declaration under Zig 0.18 failed immediately because its public file adapters still used removed std.fs.File types.

This slice:

• adds explicit-std.Io file reader/writer adapters plus compatibility entry points backed by the single-threaded provider;
• exports the buffered APIs from the shipped io module;
• activates the buffered source as its own package test artifact;
• migrates all file tests to isolated temporary directories and the new std.Io.Dir/std.Io.File operations;
• rejects zero-sized reader/writer buffers instead of permitting EOF confusion, an infinite write loop, or an out-of-bounds byte write;
• adds a public file-adapter round trip through the actual package module.

Activating the suite exposed a semantic API difference rather than a rename: Io.File.readStreaming reports EOF as error.EndOfStream, while the existing generic buffered-reader contract uses a zero-byte read. The file adapter now translates only that documented EOF signal to 0; every real I/O error continues to propagate.

Guarded verification, one process at a time:

• standalone package Debug, Zig 0.18: 9/9 steps, 14/14 tests
• standalone package Debug, pinned Zig: 9/9 steps, 14/14 tests
• top-level -Dfilter=io_package, Zig 0.18: 3/3 steps, 6/6 tests
• top-level -Dfilter=io_package, pinned Zig: 3/3 steps, 6/6 tests
• standalone package ReleaseFast, Zig 0.18: 9/9 steps, 14/14 tests
• standalone package ReleaseFast, pinned Zig: 9/9 steps, 14/14 tests
• peak observed process-tree footprint: 1,097 MB
• both compiler formatting checks and git diff --check: pass

No operational error was dropped; only the new API's explicit EOF representation is normalized to the established buffered-reader EOF contract. #884 remains open for the dormant regex and other package surfaces.

Pushed bab6ff261 (fix(io): activate allocation-safe regex support (#884)) directly to main.

This activates the previously dormant packages/io/src/regex.zig module in both the shipped io API and the standalone package test graph.

What was migration-only:

• Replaced the removed managed std.ArrayList.init(allocator) / allocator-bound method calls with the Zig 0.17/0.18-compatible unmanaged API.
• Removed the unnecessary error union from the infallible parser initializer.

What required semantic fixes rather than renames:

• Parse trees now live in a temporary arena, so every success and failure path releases all AST nodes and parser-owned character-class ranges.
• NFA character-class transitions now own independent range copies and release them exactly once.
• Builder states and fragment lists now unwind safely on every allocation failure; an exhaustive checkAllAllocationFailures test covers compilation.
• Parsing rejects unmatched trailing delimiters, repeated/bare quantifiers, and reversed ranges instead of silently accepting them.
• Search is leftmost and greedy; replacement now searches beyond the immediately preceding match instead of stopping early.
• find, findAll, and replace handle empty matches through end-of-input while guaranteeing forward progress.

Verification (fresh isolated caches, one guarded process at a time):

• Standalone packages/io, Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146: Debug passed.
• Standalone ReleaseFast on both compilers: 9/9 build steps and 36/36 tests passed.
• Top-level -Dfilter=io_package on both compilers: 3/3 build steps and 8/8 tests passed.
• Maximum observed guarded tree footprint: 1,180 MB, below the 3,840 MB ceiling.

The commit contains exactly four files and retains compatibility with the pinned compiler while exercising the shipped module under master-tracking Zig.

Pushed 1c34849ff (fix(pkg): migrate structured lockfiles to std.Io (#884)) directly to main.

This fixes and activates the exported packages/pkg/src/lockfile.zig API. A direct Zig 0.18 declaration audit previously failed at all three legacy std.fs.cwd() entry points (load, save, and exists).

Migration work:

• Added explicit-I/O loadWithIo, saveWithIo, and existsWithIo APIs using std.Io.Dir; compatibility wrappers use the global single-threaded I/O implementation.
• Added a standalone packages/pkg/build.zig that compiles the shipped static library, source tests, and public package tests.
• Updated the package test script to use zig build test, so it no longer bypasses the shipped-library build graph.

Semantic fixes found while activating the code:

• Lockfiles now deep-clone package fields, dependency keys/values, and every source-union variant.
• Deinitialization releases all of those allocations; exhaustive allocation-failure coverage exercises insertion and replacement.
• Replacing a package is allocation-atomic and releases the old key/package exactly once.
• Loading validates JSON tags and rejects out-of-range versions without panics or retained allocations.
• Saving JSON-escapes all dynamic strings and sorts package/dependency keys, making the reproducibility claim deterministic rather than hash-map-order dependent.
• Tests round-trip Registry, Git, Path, and URL sources, quoted/backslash data, duplicate replacement, explicit-I/O and compatibility APIs.

Verification (fresh isolated caches, one guarded process at a time):

• Standalone Debug, Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146: 5/5 build steps and 16/16 tests passed.
• Standalone ReleaseFast on both compilers: 5/5 build steps and 16/16 tests passed.
• Top-level -Dfilter=package_manager on both compilers: 3/3 build steps and 16/16 tests passed.
• Maximum observed guarded tree footprint: 1,145 MB, below the 3,840 MB ceiling.

The commit contains exactly four files and preserves dual compiler support.

Related build-package correctness slice: #904 landed on main in 4ef6f1f. It removes an actual >256-dependency cache-key input mutation and propagates allocator failure; the real packages/build check/test graph passes 33/33 on pinned Zig 0.17 and Zig 0.18 in Debug and ReleaseFast. This is not a claim that all legacy Zig APIs or the project-wide toolchain migration are complete. The separate current-main native build attempted for #894 was stopped by the unchanged 3840 MB guard; no native/full-runtime pass is claimed.

Related scoped slice: #905 is fixed and closed by a441cc5 on origin/main. The TS cache now has a standalone build that compiles its shipped static library and public tests on pinned Zig 0.17 and CI Zig 0.18, Debug and ReleaseFast (7/7 build steps, 18/18 tests for each). The same change fixes a real source/config key collision; full pinned TS driver 214/214 and TS Program 321/321 pass, and focused Zig 0.18 driver cache tests pass 4/4. This advances dual-toolchain source coverage but does not claim the remaining std.Io migration or project-wide 0.18 pin/CI lane is finished.

Additional dual-toolchain cache hardening: #906 is fixed and closed by 093ff6a on origin/main. The shipped ts_cache static library and its newly active fault-injection root compile and pass 20/20 tests on pinned Zig 0.17 and CI Zig 0.18 in both Debug and ReleaseFast. The original allocation-failure run reproduced one failed replacement and four leaks; the unchanged fault assertions now pass. Full pinned driver/Program consumers pass 214/214 and 321/321. This advances real migrated-package coverage, but std.Io migration, project-wide 0.18 pin and CI lane remain open.

Dual-toolchain build-package checkpoint on current main: the active packages/build graph now compiles its shipped ReleaseFast library and both test roots (4/4 steps) and runs 35/35 tests under pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 in both Debug and ReleaseFast. The new two-case watcher test in 592bbe4 exercises real std.Io file operations, deletion/recreation transitions, and allocation-failure retry; its predecessor failed before the fix. All runs stayed under the unchanged 3,840 MB guard. This is not full #884 completion. A separate packages/build/src/watch_mode.zig source is still outside the shipped package graph and currently has an invalid ../modules/module_system.zig import, in addition to removed filesystem/time APIs; a direct test attempt failed on that import and was reverted rather than presented as a green migration. It needs a coherent module-system/build-graph migration before coverage can be claimed.

Additional Zig 0.18 source audit on current main e9f03c1 (no code change claimed): shipped ts_watch tests pass 10/10, async tests 35/35, and basics_crypto tests 7/7 on 0.18.0-dev.146. Runs were serial under the unchanged 3,840 MB guard, with sampled tree-footprint peaks 237, 307 and 236 MB. These filtered roots do not prove all lazy code paths, whole-runtime release build, 0.17/0.18 dual support for every package, or the final pin/CI migration. #884 remains open.

Current-main correction at 1b07917: packages/io/src/async_io.zig already uses std.Io.Threaded.init(allocator, .{}) and std.Io.Dir.cwd(); the one-argument init and std.fs.cwd findings in the issue body are stale for this package. The real io_package test target (packages/io/tests/io_test.zig, importing the package) passes 8/8 under both pinned Zig 0.17 and Zig 0.18.0-dev.146, run serially under the 3840 MB guard (peak tree footprints 318 MB and 261 MB respectively). This is coverage for packages/io only, not the remaining dormant legacy filesystem modules or the full 0.18 migration. No code change is claimed.

Pushed 1e7655c directly to origin/main as glennmichael123: fix(storage): exercise memory and S3 drivers on Zig 0.18 (#884). Exactly three files changed. The shipped storage package now compiles and runs dedicated memory and S3 driver test roots alongside its prior root; the two drivers use std.Io.Clock.real instead of removed std.posix.clock_gettime, and memory directory deletion uses the allocator-explicit ArrayList API. A new unchanged-in-test 1,025-child regression verifies complete deletion while a sibling with the same prefix survives; the implementation now checks a directory boundary rather than matching arbitrary prefixes. Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 each passed Debug and ReleaseFast: 7/7 build steps and 16/16 test executions per run across three roots (10 distinct tests because imported root tests repeat). Both compilers passed zig fmt --check for all three files, and git diff --check passed. Observed guarded tree-footprint peaks remained below 600 MB. This is a partial storage migration, not full #884 completion: direct Zig 0.18 compilation of src/local.zig still fails on removed std.fs absolute-path APIs, and that local filesystem driver is not credited by these tests.

Pushed 8169786 directly to origin/main as glennmichael123: fix(storage): port local driver and uploads to std.Io (#884). Exactly three files changed. LocalDriver now uses std.Io.Dir/File operations and explicit-I/O construction; uploads use full positional reads and Zig 0.18-compatible hashing/formatting. Regression coverage includes 1,025-file listing and byte-for-byte uploaded content. On the exact committed tree, Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 passed native Debug and ReleaseFast builds: 9/9 steps and 68/68 test executions each (17 distinct tests repeated across four roots). Both compilers passed Linux and Windows cross-target compile checks, 6/6 steps each; those target binaries were not run. Formatting and whitespace checks passed. Remaining gaps: path confinement is lexical, not symlink-safe handle-relative traversal; Windows visibility/ACL behavior lacks runtime verification. This is progress on #884, not completion.

Pushed 2f71514 directly to origin/main as glennmichael123 (no coauthors): fix(basics): port fs utilities to std.Io (#884). Exactly three files changed: the existing fs utility implementation, a new real test root, and build-graph registration. File open/create/read/write/seek/append, bounded read-to-string, directory create/list/copy/rename/delete, and path resolution now exercise std.Io rather than removed std.fs handle APIs. The test root runs the actual fs.zig source; 3/3 tests and 3/3 build steps passed on both pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 in Debug and ReleaseFast (four serial memory-guarded runs; observed tree peaks 294–383 MB, below the 3,840 MB ceiling). Both compilers passed zig fmt --check and git diff --check passed. Scope boundary: importing the broader basics.zig aggregator on Zig 0.18 still fails on pre-existing errors in basics.zig, json.zig, and net.zig; this commit does not claim that aggregator, all basics APIs, or the full Zig 0.18 migration is green.

Pushed 0023559 directly to origin/main as glennmichael123, no coauthors: fix(basics): port JSON utility to std.Io writer (#884). Exactly three files changed (json.zig, a real JSON test root, build registration). The public JSON utility now compiles under both pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 with std.Io.Writer.Allocating and allocator-explicit ArrayList APIs. A red-before/green-after control caught two genuine bugs: unescaped object keys caused JSON SyntaxError; duplicate builder keys leaked the old value and replacement key (3 pass/1 fail/2 leaks before, 4/4 pass after). Both compilers passed Debug and ReleaseFast: 3/3 build steps and 4/4 tests in each of four serial runs; guarded tree peaks 301–321 MB, below the 3,840 MB ceiling. Both zig fmt checks and git diff --check passed. Aggregate basics.zig remains unproven: a guarded direct root test exposed additional removed std.time and std.posix clock/getenv APIs and ArrayList calls after the first three parse errors were temporarily corrected. Those exploratory edits were fully reverted; this commit does not claim the aggregator, native platform matrix, or whole Zig 0.18 migration is complete.

Pushed 05320ff directly to origin/main as glennmichael123, no coauthors: fix(basics): port Temporal clock and TZ access (#884). Exactly three files changed. Temporal.Now uses std.Io.Clock.real instead of removed std.posix.clock_gettime; libc-linked builds preserve the TZ environment override through std.c.getenv, while no-libc builds retain the existing UTC fallback. The new libc-linked test target tests real-clock bounds and TZ propagation, and has_side_effects=true prevents a cached run from disguising an environment change. Both Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 pass all 96 original Temporal source tests in Debug and ReleaseFast without libc; both pass the new 2/2 target in Debug and ReleaseFast with TZ=Asia/Manila, plus uncached 2/2 Debug with empty TZ. Libc-linked original-source runs also passed 96/96 on both compilers in Debug. Linux and Windows x64 test roots compile on both compilers with and without libc (compile-only, not executed). Both zig fmt checks and git diff --check passed. All heavy runs were serial under the 3,840 MB guard. This is a Temporal slice, not a claim that the broader basics.zig aggregate or entire Zig 0.18 migration is green.

Progress on Zig 0.18 migration: pushed 0a1b5a1 (fix(basics): port public time helpers to std.Io (#884)) to main as glennmichael123. The Basics public time helpers now use std.Io real/awake clocks and cancellable sleep, with explicit-I/O variants for callers that inject their own Io. Registered the Basics aggregate as a libc-linked test target matching the hosted build. Zig 0.18.0-dev.146 and pinned 0.17 both passed 108/108 aggregate tests in Debug and ReleaseFast; x86_64 Linux/Windows libc compile-only checks passed on both compilers. This is a partial migration: the freestanding aggregate still fails in Zig std.Io.Threaded, and other lazily compiled Basics APIs (notably net) still need their own port and tests. No freestanding-readiness claim.

Pushed a8bfcf0 (fix(basics): port mapped memory protection to typed flags (#884)) to main as glennmichael123. The previously uncovered packages/basics/src/memory.zig failed on Zig 0.18 because std.posix.PROT is a typed bitfield, not u32. The port uses typed flags, actual runtime page size, explicit zero-length rejection, and checked mprotect/mlock/munlock errors; the libc-linked Basics memory test target exercises all eight protection combinations, mapping/protection transitions, sync, an unaligned-in-page mlock/munlock address, and aligned allocation. Native macOS: 4/4 new tests on pinned Zig 0.17 and Zig 0.18 in Debug and ReleaseFast; the Basics aggregate remains 108/108 on Zig 0.18. Linux GNU and musl: the new test source compiles on both compiler versions (compile-only, not runtime execution). Windows behavior was not exercised. I also rechecked packages/io/src/async_io.zig on current main: its existing three direct Zig 0.18 tests already pass, so the issue description’s old Threaded.init/cwd failure is stale for that file. #884 remains open for other package migrations and the real 0.18 CI lane.

Pushed 3686b69 (fix(basics): capture process output through std.Io (#884)) to main as glennmichael123. The previously untested Basics exec path failed to compile on Zig 0.18 because std.process.Child.init is gone. It now accepts a caller-supplied std.Io, spawns through the current process API, and drains stdout/stderr together with MultiReader, preserving the inherited-stdin behavior while preventing a full-stderr-pipe deadlock. shell and commandExists pass the same explicit I/O context. A libc-linked basics_process target exercises distinct stdout/stderr, exit 7, both streams beyond pipe capacity, shell resolution, empty argv, and the 10 MiB capture limit. Native macOS: 4/4 tests on pinned Zig 0.17 and Zig 0.18 in Debug and ReleaseFast; Basics aggregate 108/108 on both. Linux/Windows test source compile-only checks pass on both versions; Windows tests skip execution and are not credited as passing behavior. Other APIs in process.zig, notably execWithInput/SpawnedProcess/ProcessBuilder/Pipe, still use the old Child surface and are not ported by this commit. The GitHub Zig-master lane exists in-tree, but gh run list --workflow zig-master.yml currently returns no runs, so no CI execution is claimed.

Pushed c8ad5c9 (fix(basics): feed child stdin concurrently with output capture (#884)) directly to main as glennmichael123. Basics execWithInput now uses std.process.spawn and caller-provided std.Io, shares the dual-pipe bounded capture path from the preceding exec commit, and runs nonempty stdin writing with std.Io.concurrent so a child echoing >pipe capacity cannot deadlock the parent. Writer errors propagate; on output failure the child is killed before the writer future is canceled. Empty input closes stdin without requiring concurrency, while a nonempty input on an I/O implementation with no concurrency returns ConcurrencyUnavailable promptly. New native tests cover output/status, 256 KiB bidirectional flow plus 128 KiB stderr, empty input, empty argv, the 10 MiB limit, and the unavailable-concurrency cleanup path. Combined process target: 9/9 tests on pinned Zig 0.17 and Zig 0.18 in Debug and ReleaseFast; Basics aggregate 108/108 on Zig 0.18. Linux/Windows new-test compile-only checks pass on both toolchains; no cross-platform execution is claimed, and Windows-specific tests skip. Remaining process.zig SpawnedProcess/ProcessBuilder/Pipe and other old Child paths still need migration.

Pushed 6d6b611 (fix(basics): port process child lifecycle to std.Io (#884)) directly to origin/main as glennmichael123, without coauthors. SpawnedProcess and ProcessBuilder now use std.process.spawn, std.Io, Environ.Map, current stdio options, and concurrent capture of zero/one/two output pipes. Waiting closes an unused piped stdin so EOF-dependent children do not hang; cleanup kills a child on error. Added five lifecycle tests for output/status, cwd/env/args, stream modes, kill/reap behavior, and stdin EOF. Combined process tests: 14/14 on pinned Zig 0.17 and Zig 0.18, each in Debug and ReleaseFast. Linux/Windows compile-only checks passed on Zig 0.18; this does not establish Windows runtime behavior. Remaining Pipe and other legacy process paths still need migration; #884 stays open.

Pushed d373a32 (fix(basics): stream process pipelines without deadlock (#884)) directly to origin/main as glennmichael123, no coauthors, exactly three changed files. Basics Pipe now uses the current std.process.spawn/std.Io API and passes each upstream stdout file directly as the next child stdin, spawning all stages before collecting output. It closes parent-owned handoff ends, reaps/kills every child on success/error, preserves the final command exit status, and enforces the existing 10 MiB output limit. Five new tests cover empty inputs, status/output, three live stages carrying 256 KiB beyond pipe capacity (including reuse), earlier-stage failure, and output-limit cleanup. Combined process suite: 19/19 on pinned Zig 0.17 and Zig 0.18 in Debug and ReleaseFast, each under the 3,840 MB memory guard. This is macOS execution, not Windows runtime proof. Other legacy process.zig helpers and the broader Zig 0.18 migration remain open.

Pushed a4ee192 (fix(basics): use explicit process context in std.Io helpers (#884)) directly to origin/main as glennmichael123, no coauthors, exactly three files. Basics environment reads now use a supplied std.process.Environ snapshot; child environment mutation uses an explicitly owned Environ.Map, validates names/NUL values, and does not pretend to mutate process-global state. Args use std.process.Args.Iterator with cleanup on every allocation-failure point; cwd uses std.process.currentPathAlloc/setCurrentPath with supplied std.Io. New direct tests cover snapshot copies/independence, map replacement/removal/validation, args ownership and injected allocation failures, and cwd. Combined process group: 24/24 tests on pinned Zig 0.17 and Zig 0.18, in Debug and ReleaseFast, each under 3,840 MB. This is macOS runtime evidence; Windows execution and remaining process helpers remain open.

Progress on Zig 0.18 migration: 480af47 (pushed to main) ports Basics process signal/liveness handling and sleep to current std.Io APIs. POSIX signal numbers now follow the host enum; invalid nonpositive PIDs are rejected, and Windows Child.Id is treated as a process handle rather than a numeric PID. Verification on macOS: basics_process group 28 passed / 1 Windows-only skipped in Debug and ReleaseFast with both pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146, guarded below 3,840 MB. The signal test file also compile-checked for x86_64-linux-gnu and x86_64-windows-gnu with both compilers. Windows/Linux runtime behavior was not exercised; the wider 0.18 migration remains open.

Pushed 1b5a6dc9b directly to main (3 files): migrated the public Basics filesystem facade from removed std.fs file/directory APIs to std.Io.File and std.Io.Dir, including an explicit-Io nonrecursive makeDirAbsolute wrapper. Added a real temporary-directory regression test for create/open/read/stat/delete and duplicate/missing-path errors. Before the change, this test failed to compile on Zig 0.18 at std.fs.File and std.fs.makeDirAbsolute. After the change: facade tests 2/2 on Zig 0.17 and 0.18 in Debug and ReleaseFast; existing Basics core tests 108/108; Linux and Windows cross-target compile checks passed (not runtime-tested). Formatting and diff checks passed. The wider Zig 0.18 migration remains open.

Pushed afadba7f4 directly to main (3 files). New image async-result regression first exposed removed std.Thread.Mutex on Zig 0.18; after removing that redundant lock, it exposed the old wait() signature. The fix uses the existing release/acquire completion flag as the producer/consumer publication barrier and passes explicit std.Io into wait for cancellable one-millisecond sleeps. Two focused tests cover cross-thread result publication and error propagation. Registered image suite: 97/97 on Zig 0.17 and 0.18, Debug and ReleaseFast; Linux/Windows compile-only checks passed (not runtime-tested). Peak guarded process-tree footprint was below 600 MB in all four full image runs. Zig 0.18 migration remains open.

Pushed b6b62e886 directly to main as a three-file std.Io file-package migration. Before this change, direct Zig 0.18 zig test packages/file/src/file.zig failed at removed std.fs.File and Io.Dir.makeDir. The package now uses explicit std.Io file/dir handles, positional I/O with a tracked cursor, nonrecursive/recursive directory operations, real-path and rename APIs, and accurate optional access time/status-change metadata. Opened handles close on allocation failures. The eight existing tests were isolated in unique temporary directories rather than deleting fixed names from the repository checkout, and the actual package tests are now registered in the top-level build graph with two additional seek/overwrite/append/directory regressions. Final guarded results: 10/10 on Zig 0.17 and 0.18 in Debug and ReleaseFast; peak process-tree footprint below 560 MB. Linux and Windows tests compile-only (not runtime-tested). Formatting and staged diff checks pass. The wider Zig 0.18 migration remains open.

Post-push integration check for b6b62e886: current Zig 0.18 zig build home-tool -j1 --summary all completed 4/4 Debug steps under the unchanged 3,840 MB guard (peak process-tree footprint 1,733 MB). This checks the non-JSC tool build only; it does not establish JSC-linked runtime or Bun-corpus success.

Pushed 5f700aa68 directly to main (exactly 3 files). Replaced packages/modules simulation-only tests with actual temporary-directory ModuleLoader tests registered in the top-level build graph. Before the change, the real test failed to compile because all three source imports escaped the module path. The loader now uses build-graph package imports and explicit std.Io, retains source backing AST name slices, closes/deinitializes source/AST/parser/map ownership, propagates non-absence filesystem errors, and rejects parser-recovered partial ASTs without caching them. Public function/value/type export kinds are distinguished from private declarations. The documented 10 MiB source boundary is tested at exactly 10 MiB and one byte over. Final guarded suite: 5/5 on Zig 0.17 and 0.18 in Debug and ReleaseFast, with peak process-tree footprint below 470 MB. Zig formatting and staged diff checks pass. Post-push home-tool build succeeds 4/4 from cache (not a fresh compile of the module package). Relative import resolution remains separate: resolveImport still ignores from_module; no full module-system/Bun-suite pass is claimed.

The independently observed relative-import/cache-identity follow-up from 5f700aa68 is now tracked as #920. This is separate from the verified Zig 0.17/0.18 loader migration; no relative-import pass is claimed.

Module-loader follow-up #920 is fixed by ca881af and closed. Canonical path cache identity and importer-relative ./ and ../ resolution now have real two-root tests; 6/6 module tests pass on Zig 0.17/0.18 in Debug and ReleaseFast under the 3,840 MB guard. This is macOS runtime coverage only; #884 remains open for its other std.Io migration scope.

Published directly to origin/main as glennmichael123 without coauthors: deaf609 (three files). Migrated the previously uninstantiated KernelBuilder and IsoBuilder staging writers from removed std.fs.cwd operations to explicit std.Io plus a caller-supplied destination directory. Real temporary-directory tests read back the generated linker script, multiboot header, copied kernel bytes, and GRUB config; the package test root now runs those source tests. This is staging only: compiling/linking a kernel and creating the final ISO are still unimplemented, and output_path is not claimed as an artifact. Direct kernel source tests pass 6/6 on Zig 0.17 and 0.18; integrated build-package tests passed 41/41 on both in Debug and ReleaseFast. Runs were serial through run_bounded with HOME_RUN_MAX_MB=3840; observed peak tree footprints were at most 539 MB. Two transient process-snapshot probe-deadline warnings occurred during the pinned tests; the supervisor tolerates fewer than eight consecutive failures and completed with measured samples, so uninterrupted sampling is not claimed. Other legacy build/runtime filesystem callsites, the 0.18 CI lane, and all-platform/release parity remain open.

Pushed bc62c38e7 directly to origin/main as glennmichael123 (author and committer; no coauthors), conventional issue-linked commit with exactly four files. Migrated MAC policy load/save and System.loadPolicy from removed std.fs.cwd() operations to caller-supplied std.Io and directory handles; newly instantiated parsing uses std.mem.tokenizeAny. Policy save/load round-trip, ordered rule decisions, missing-file behavior, audit-enabled system loading, and exact 10 MiB versus 10 MiB+1 input limit are covered in real temporary directories. Fixed partial-allocation ownership in security-context creation/parsing and rule cloning, with injected allocation-failure tests. The full packages/mac/src/mac.zig test root passes 17/17 on pinned Zig 0.17 and Zig 0.18 in both Debug and ReleaseFast, one guarded process at a time under HOME_RUN_MAX_MB=3840 (final observed peaks 141–298 MB). Both Zig format checks, git diff --check, and scoped Pickier on the changed README pass. This is one measured migration slice, not proof that all MAC APIs, packages, CI, release or platform targets are 0.18-ready; #884 remains open.

Progress on #884: 21858ac03 restores the shipped FFI/SQLite compile path. The pre-patch packages/ffi build failed identically with pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146: ambiguous Statement inside the SQLite binding and removed callconv(.C). The patch qualifies the opaque handle, uses the target C convention in both SQLite and CStdLib.atexit, and adds active compile tests plus a check step that includes both examples and tests.

Verified under the 3,840 MB guard, serially: zig build check --build-file packages/ffi/build.zig -j1 on both Zig versions; zig build test --build-file packages/ffi/build.zig -j1 on both; and the 0.18 example-sqlite run opened an in-memory database, inserted three rows, and read them back. Both Zig format checks and git diff --check passed. This is one FFI package slice, not proof of project-wide 0.18 compatibility. Separately, current packages/build and packages/io check steps compiled on 0.18 here; the issue's broader CI/toolchain migration remains open.

Another verified #884 slice is on main: 92a70f808. Both shipped linker examples failed to compile on pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 because they still used removed std.io.getStdOut().writer(). They now use std.Io.File.stdout().writerStreaming with explicit flush; the README shows the same working API, and a check step compiles all four examples plus active tests.

Actual execution also revealed that the embedded example's page-aligned .text and .rodata addresses were invalid for its declared 512 KiB flash region. The corrected layout validates and generates stm32_cortex_m.ld on both Zig versions. On each compiler, zig build check, zig build test, and zig build for packages/linker passed serially under the 3,840 MB guard; both kernel and embedded binaries executed from temporary directories, and the generated script contained the expected entry, MEMORY, and aligned .text sections. Both Zig formatting checks, targeted Pickier on the README, and staged diff check passed. This is linker-package coverage only; project-wide Zig 0.18 migration and CI admission remain open.

Pushed 9f56b05 directly to origin/main as glennmichael123, with exactly three files and no coauthors. The public video Source.readAll path was missing from the ordinary package test gate: a new public integration regression failed before the fix on Zig 0.18 at removed std.ArrayList.init, while the previous implementation also consumed up to 8192 bytes beyond max_size. The method now uses allocator-threaded ArrayList operations and limits each read to the remaining byte budget; the test covers zero, short, EOF, and a partial second 8192-byte chunk. The regular package test step now runs this integration suite. Guarded serial Debug tests passed on pinned Zig 0.17 and Zig 0.18; optimized ReleaseFast tests passed 329/329 on each compiler. Both Zig format checks and diff checks passed; observed tree-footprint peak was 689 MB under the 3840 MB ceiling. This verifies the public bounded-read slice only, not every video adapter, full Zig 0.18 migration, or CI readiness. #884 remains open.

Second video std.Io slice is pushed directly to origin/main as glennmichael123: 4d13e40, exactly three changed files, no coauthors. Public FileSource and FileTarget now accept an explicit std.Io, own std.Io.File handles until close, and use positional reads/writes with tracked logical offsets. This removes removed std.fs.File/cwd APIs and fixes FileTarget.seek, which previously ignored whence and bitcast negative offsets. A real temporary-file regression first failed on Zig 0.18 at std.fs.File; after migration it verifies overwrite via relative seek, seek from end, EOF, missing-file mapping, invalid negative seek, size and flush. On pinned Zig 0.17 and Zig 0.18, guarded Debug package tests passed 330/330, ReleaseFast tests passed 330/330, and shipped-library plus all declared test-root check steps passed. Both Zig formatting checks and diff checks passed; peak guarded tree footprint was 734 MB under the 3840 MB ceiling. This does not claim all video APIs, targets, CI, or project-wide 0.18 migration are complete.

Pushed 994f719 directly to origin/main as glennmichael123: exactly three files, conventional commit, no coauthors. This is a verified Zig 0.17/0.18 slice of the public video WAV disk API.

The new public integration regression failed before the change because WavReader.fromFileWithIo did not exist; existing disk paths still used removed std.fs.cwd calls. WavReader.fromFileWithIo now reads through an explicit std.Io, owns and releases file-backed bytes (while fromMemory remains borrowed), and propagates allocation failure. WavWriter.writeToFileWithIo and Audio.loadWithIo/saveWithIo use the same I/O surface; no-Io wrappers remain. Audio's frame list also uses allocator-threaded std.ArrayList operations. The test checks missing files, exact sample bytes through writer/reader/Audio load/save and in-memory load, and cleanup after malformed input.

Guarded package test steps pass with both pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 in Debug and ReleaseFast. Each full uncached run had 331/331 tests; final reruns reused the 326-test unit result and reran the five integration tests. Shipped-library/test-root check steps passed on both compilers, both Zig format checks and git diff --check passed. Observed guarded tree-footprint peaks stayed below 733 MB, against the 3,840 MB ceiling. This verifies the WAV file slice only; other video adapters, the broader std.Io migration, and 0.18 CI/pin changes remain open.

Pushed 5c16678 directly to origin/main as glennmichael123 (three files, conventional commit, no coauthors). It rebased cleanly on Chris's non-overlapping 71f639d recording-policy commit.

The public video sink module was not compiled through a real sink regression: adding a dedicated public test target reproduced 13 Zig 0.18 errors from removed std.ArrayList.init/allocator-less methods. All five list-backed sinks now use allocator-threaded operations. FileSink now owns a std.Io.File, supports an explicit Io interface (with its existing default-Io entry point preserved), writes at tracked offsets, and closes exactly once. The new public tests cover byte order and file reopening, write-after-close, buffer clear/reuse, frame/packet retention, and audio/waveform sample facts.

On the rebased tip, guarded full package test steps passed 334/334 on pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 in both Debug and ReleaseFast. Shipped-library/test-root check steps passed on both compilers before the rebase (the new parent touched only recording-policy source and docs); dual Zig formatting and git diff --check passed. Peak observed tree footprint in the final four test runs was 736 MB, below the 3,840 MB ceiling. This is a verified sink slice only; other video APIs, the wider std.Io migration, and 0.18 CI/pin acceptance remain open.

Pushed e653e9c directly to origin/main as glennmichael123 (three files, conventional commit, no coauthors). This adds a fixed Zig 0.18.0-dev.146 CI job alongside the existing moving-master job, plus scripts/verify-zig-018.sh and scope/reproduction documentation. The fixed job builds home-tsc and runs both check (shipped libraries plus test sources) and test for packages/io and packages/build; it does not replace the 0.17 production lane.

Local verification: the exact script passed under the 3,840 MB guard, peak sampled tree footprint 2,032 MB. Zig 0.18 Linux x86_64 cross-build of home-tsc and cross-checks for the two packages also passed. The script rejects the pinned 0.17 compiler with exit code 2. Bash syntax, workflow YAML parse, targeted Pickier check, and git diff --check passed. GitHub Actions execution of the new job is not yet confirmed; full compiler/runtime 0.18 migration remains open.

CI execution follow-up for e653e9c: I attempted workflow_dispatch on main for the updated Zig master compatibility workflow. GitHub returned HTTP 422, "Actions has been disabled for this repository." The fixed 0.18 job is committed and passed locally, but there is no hosted CI run to cite until Actions is re-enabled. This does not change the local verification or imply the broader migration is complete.

Checkpoint on main: 63dc191 (test(build): gate basics crypto on Zig 0.18) adds the real basics crypto consumer suite to both the fixed 0.18.0-dev.146 gate and the moving-master job. This covers Ed25519 use, X25519 agreement and the fallible identity/small-order public-key rejection, plus authenticated-decryption failure. Local guarded direct tests passed on 0.18 (303 MB peak) and Pantry 0.17 (254 MB peak). The full fixed 0.18 gate passed after the edit: crypto 7/7, I/O 36/36, build package 41/41; process-tree peak 2,299 MB below the 3,840 MB ceiling. Bash syntax, targeted Pickier and diff checks passed. The standalone build warned that pinned Bun WebKit is absent and used system JavaScriptCore; this is not native Bun-runtime verification. This expands CI coverage only; the broader 0.18 migration and actual CI execution remain open.