build: finish Zig 0.18 standard-library migration

Home is preparing to move from the Pantry-pinned Zig 0.17 dev toolchain to 0.18/master. A source and compile audit against 0.18.0-dev.146 found three distinct classes that must be handled independently rather than by blanket rewrites.

Confirmed work:

• Remove only the obsolete error handling around std.crypto.dh.X25519.recoverPublicKey; retain X25519.scalarmult error propagation because it rejects attacker-controlled identity/small-order public inputs. Ed25519 deterministic generation and the visible AEAD/KDF checks remain fallible.
• Complete the std.Io migration. The tree already has broad std.Io adoption, but packages/io/src/async_io.zig still calls one-argument Threaded.init and the removed std.fs.cwd() surface. Many other legacy filesystem call sites require separate measured slices.
• Rename bare old optimize tags such as .ReleaseFast to lowercase tags where the contextual type is std.lang.Optimize. Qualified deprecated aliases still compile through 0.18, so this is mechanical rather than semantic.

Coverage findings:

• zig build --help, home-tool, and home-tsc build successfully with 0.18.0-dev.146.
• Direct compilation of the real packages/io and packages/build sources exposes failures that the top-level filtered tests do not compile.
• Main compiler/runtime production and test modules both link libc; no libltvpn-style test-only libc mismatch was found.
• Current Pantry, CI, and release workflows still pin 0.17.0-dev.2163, so green CI does not yet establish 0.18 compatibility.

Acceptance:

• Migrate in small independently verified slices that compile under both the current pinned compiler and the selected 0.18 baseline while dual support is required.
• Add real coverage for migrated package sources rather than placeholder tests.
• Preserve all meaningful cryptographic validation paths.
• Add an actual 0.18 CI lane before changing the project-wide pin, then move Pantry/release CI and documented commands together.

Related: #66, #855.

Zig 0.18 migration progress: 498551180 is on origin/main with five files and 27/27 focused tests passing under both tracked Zig versions.

This batch covers checked enum conversion, the Type.Enum.field_names reflection rename, allocator-explicit robustness/stabilization collections, and the semantic Rational.den to Rational.denom correction. The video unit root now has four remaining source diagnostics, down from sixteen.

Zig 0.18 migration milestone: 4cdcd2fea is pushed to origin/main, and the full packages/video unit suite is now 318/318 green under both pinned Zig and Zig 0.18.0-dev.146.

This includes the expensive API class from the audit: RTMP handshake generation now takes std.Io explicitly and uses std.Io.Clock.real; both client and server generation paths have direct tests. The batch also migrates std.Random, trimStart, and fixes bilinear edge-coordinate semantics.

Zig 0.18 migration update: pushed 4b1aeb1c6 directly to origin/main.

The packages/video build now compiles its installed static library and every test target from the same video_module, target, and optimization selection. The previously unwired integration/conformance binaries were migrated from the old test-framework API and from nonexistent namespace/type assumptions to the current public API.

Verified with Zig 0.18.0-dev.146+35accc06e:

• zig build --build-file packages/video/build.zig check -j1 --summary all: 5/5 steps succeeded
• zig build --build-file packages/video/build.zig test-all -j1 --summary all: 320/320 outer Zig tests passed
• Guarded compile peak: 452 MB

Pinned Zig 0.17.0-dev.2163+89ff10d56 passes the identical compile and test graph, preserving cross-version compatibility.

Pushed f96eb61cf (fix(build): use canonical optimize tags (#884)) directly to origin/main.

This exact three-file slice removes the remaining first-party qualified deprecated OptimizeMode.Debug/ReleaseSafe/ReleaseFast/ReleaseSmall spellings from the active LTO implementation and the JSON import example, and replaces the alias-existence smoke test with direct coverage of the canonical debug/safe/fast/small tags.

Classification: this is a rename-only Zig compatibility change. LTO behavior is unchanged (debug -> None, safe -> Thin, fast/small -> Fat), and no runtime or error-handling semantics changed.

Guarded verification, one process at a time:

• Zig 0.17.0-dev.2163: direct build tests 9/9; wired LTO Debug 6/6; wired LTO ReleaseFast 6/6.
• Zig 0.18.0-dev.146: direct build tests 9/9; wired LTO Debug 6/6; wired LTO ReleaseFast 6/6.
• All three changed files pass zig fmt --check under both compilers and git diff --check.
• Peak guarded footprint was 336 MB.

The broader std.Io migration remains semantic, separately scoped work. The two first-party X25519.scalarmult error paths remain intact because they reject attacker-controlled identity/small-order inputs.

Pushed 90105909d (fix(audio): migrate fixed buffers for Zig 0.18 (#884)) directly to origin/main.

This exact five-file slice removes the next audio blockers exposed by the shipped media dependency graph:

• replaces removed array repetition with typed/inferred @splat initialization in beat/chord analysis and AAC/MP3 decoders;
• migrates the onset and MP3 reservoir lists to the current .empty initializer;
• makes the immutable AAC reader parser binding const.

A temporary in-package root compiled and ran the real modules from the correct packages/audio/src boundary, then was deleted before commit. Results were 25/25 tests on pinned Zig 0.17.0-dev.2163 and 25/25 on Zig 0.18.0-dev.146, with a 203 MB guarded peak. git diff --check passes.

The formatter's unrelated @enumFromInt -> @fromBackingInt rewrites were inspected and reverted; no enum-conversion semantics changed. This is API/syntax migration plus stricter binding correctness, not test weakening.

Pushed 331e92a72 (fix(audio): migrate waveform and decoder buffers (#884)) directly to origin/main.

This second exact five-file audio slice removes all legacy array-repetition syntax from waveform analysis, Opus/Vorbis decoder state, and AIFF/APE fixtures. Opus decode scratch allocations also use immutable bindings now that the slices themselves—not the bindings—are mutated.

A temporary in-package root exercised the real module boundary and was removed before commit. Results:

• pinned Zig 0.17.0-dev.2163: 15/15 tests passed;
• Zig 0.18.0-dev.146: 15/15 tests passed;
• guarded peak: 199 MB;
• no removed ** array repetition remains in these five files;
• git diff --check passes.

Unrelated formatter enum-conversion rewrites were inspected and reverted. This is a source/API migration with unchanged decoder/format semantics, not a compatibility shim or weakened test.

Pushed 32bbf96c2 (fix(audio): migrate format fixture buffers (#884)) directly to origin/main.

This exact five-file slice removes legacy array repetition from DSD, FLAC, MIDI, Ogg, and Opus format fixtures/state. Concatenated magic-byte fixtures now use explicitly typed @splat arrays, while field initializers rely on their declared array types.

The real format modules passed 23/23 tests on pinned Zig 0.17.0-dev.2163 and 23/23 on Zig 0.18.0-dev.146 through a temporary in-package root that was deleted before commit. Guarded peak was 194 MB; git diff --check passes and no removed ** array repetition remains in these five files.

Formatter-generated enum/integer conversion rewrites were inspected and reverted, so this commit changes no parsing or wire-format semantics.

Pushed ba7dfd71f (fix(audio): migrate recorder and format buffers (#884)) directly to origin/main.

This exact five-file slice clears the remaining format/recorder diagnostics from the earlier media graph: TTA, WavPack, WMA and recorder fixed buffers now use typed @splat; WAV's read-only header parser binding is const; and recorder's dynamic sample buffer uses the current .empty initializer.

The real five-module graph passes 27/27 tests under pinned Zig 0.17.0-dev.2163 and 27/27 under Zig 0.18.0-dev.146. Guarded peak was 198 MB. git diff --check passes and no removed array-repetition syntax remains in the five files.

Unrelated formatter alignment and enum-conversion output was inspected and reverted. No format parsing or recording semantics were weakened.

Pushed 851f2d346 (fix(audio): migrate processing state buffers (#884)) directly to origin/main.

This exact five-file slice migrates crossfade, de-esser, equalizer, loudness, and modulation to current fixed-array/list initialization and immutable bindings. De-esser and EQ reset paths use the same @splat state shape as construction; loudness keeps mutable slice contents while making the slice bindings themselves const.

The real processing graph passes 20/20 tests on pinned Zig 0.17.0-dev.2163 and 20/20 on Zig 0.18.0-dev.146. Guarded peak was 196 MB; git diff --check passes and no removed array repetition remains in these five files.

Unrelated formatter table alignment was inspected and reverted. DSP behavior and test thresholds are unchanged.

Pushed c804f2c35 (fix(audio): migrate remaining processing buffers (#884)) directly to origin/main.

This exact five-file slice removes the remaining fixed-array repetition diagnostics from multiband, reverb, sidechain, stereo, and tape processing. Construction, reset, and test-fixture buffers now use typed or field-inferred @splat initialization without changing values or DSP behavior.

Verification:

• pinned Zig 0.17.0-dev.2163: 22/22 tests passed;
• Zig 0.18.0-dev.146: 22/22 tests passed;
• both compilers accept zig fmt --check for all five files;
• git diff --check passes;
• guarded peak: 208 MB.

The earlier media-graph processing diagnostics are now cleared; the full media graph still needs a fresh compile to identify the next reachable layer.

Pushed 0b4359257 (fix(media): migrate collections for Zig 0.18 (#884)) directly to main.

This five-file batch:

• migrates media stream and pipeline lists to allocator-explicit ArrayList APIs used by Zig 0.17/0.18;
• fixes Result.map's invalid fn (T) anytype signature and adds success/error regression coverage;
• replaces Registry.getSupportedFormats()'s dangling stack slice with static combined storage;
• adds the VP6 codec entry already referenced by the FLV registry; and
• removes the Pipeline.fade parameter/method shadowing diagnostic.

Verification used a temporary package-root test (deleted after the run) so relative imports and lazy generic methods were genuinely compiled:

• pinned Zig 0.17.0-dev.2163+89ff10d56: 22/22 passed, 198 MB guarded peak;
• Zig 0.18.0-dev.146+35accc06e: 22/22 passed, 216 MB guarded peak.

Both runs were sequential and stayed under the 3,840 MB ceiling.

Pushed 33d701c63 (fix(media): preserve frame ownership through filters (#884)) directly to main.

This three-file batch removes the filter graph's dangling-frame-pointer bug rather than allocating wrapper objects around it:

• filter processors now mutate the caller-owned Frame and cannot return an unrelated pointer;
• scale/crop replace owned buffers while preserving the original frame address;
• Frame.deinit() uses the allocator recorded by the frame;
• video/audio frame constructors unwind every partial allocation on failure;
• filter lists use Zig 0.17/0.18's allocator-explicit ArrayList API; and
• zero-sized scale/crop and zero-width/height flips are handled without divide-by-zero/underflow.

The permanent filter_graph_test.zig root verifies pointer stability, invalid-crop nonreplacement, and exhaustive allocation failures:

• Zig 0.17.0-dev.2163+89ff10d56: 22/22 passed, 201 MB guarded peak;
• Zig 0.18.0-dev.146+35accc06e: 22/22 passed, 162 MB guarded peak.

Both runs were sequential and stayed below the 3,840 MB ceiling.

Pushed 10fc14ee0 (fix(image): migrate repeated arrays for Zig 0.18 (#884)) directly to main.

This exact five-file batch replaces removed array ** count initialization with typed @splat across image histograms, blur accumulators, ICO palettes, and JPEG Huffman/component/quantization state. It also fixes the same-file immutable ChannelMixer local exposed by current analysis.

Verification on both toolchains:

• all five edited files pass zig ast-check under pinned Zig 0.17.0-dev.2163+89ff10d56 and Zig 0.18.0-dev.146+35accc06e;
• a temporary typed regression covering scalar, struct, nested-array, and initialized-struct splats passed 1/1 under both versions;
• each guarded batch peaked at 173 MB.

The temporary regression file was removed. The full image umbrella still has separate preexisting diagnostics, so this update intentionally makes no package-wide pass claim; those diagnostics are being cleared in subsequent batches.

Pushed bcfe82bb8 (fix(image): migrate histogram buffers for Zig 0.18 (#884)) directly to main.

This exact five-file batch removes the next set of deprecated array-repetition expressions from the image facade, parallel/GPU/SIMD histograms, and QOI codec index tables. It also makes the grayscale scratch-slice binding immutable as required by current Zig analysis.

Each edited file passes zig ast-check under both pinned Zig 0.17.0-dev.2163+89ff10d56 and Zig 0.18.0-dev.146+35accc06e. The guarded checks ran sequentially and stayed far below the 3,840 MB ceiling.

The remaining repetition sites are now isolated to TIFF and steganography and will be handled with the next source-diagnostic batch.

Pushed 16c42bc62 (fix(image): finish repeated buffer migration (#884)) directly to main.

This five-file batch removes the final deprecated array-repetition sites under packages/image/src (TIFF LZW allocation tracking and steganography counters), supplies the explicit alpha conversion type required by current Zig, and fixes immutable ellipse constants.

It also resolves the dither/watermark diagnostics semantically:

• halftone no longer accepts an unused allocator and now applies the configured strength to dot radius;
• watermark scans reject block sizes that would produce a zero loop step;
• visualization allocation is unwound on later failures; and
• dead average accumulation/division was removed while preserving the existing max-strength detector.

All five edited files pass zig ast-check under pinned Zig 0.17.0-dev.2163+89ff10d56 and Zig 0.18.0-dev.146+35accc06e. rg now finds no remaining ** array repetition anywhere under packages/image/src.

Pushed eef1ea4aa (fix(image): migrate reserved identifiers for Zig 0.18 (#884)) directly to origin/main.

This five-file batch removes another set of concrete Zig 0.18 blockers in the image package:

• resolves Color through the canonical image.zig module instead of the nonexistent color.zig;
• renames identifiers that became reserved (i1, j1, error, packed, and the public align field, whose source spelling is preserved with @"align");
• adds the missing void return type on renderBitmapText;
• fixes the strict never-mutated/unused diagnostics exposed while parsing these files.

Verification:

• all five edited source files pass ast-check with pinned Zig 0.17.0-dev.2163+89ff10d56;
• all five pass with CI-target Zig 0.18.0-dev.146+35accc06e;
• both versions pass zig fmt --check on the exact five files;
• git diff --check passes;
• commit has exactly five changed files and is confirmed present at origin/main.

No compatibility shim, suppressed diagnostic, or test weakening was introduced.

Pushed bab4d6587 (fix(image): clear decoder diagnostics for Zig 0.18 (#884)) directly to origin/main.

This exact five-file batch clears six strict mutability diagnostics in the GIF, Radiance HDR, JPEG XL, TGA, and HDR-processing paths. The changes are declaration-only (var to const) and preserve runtime behavior.

Verification:

• all five files pass ast-check under pinned Zig 0.17.0-dev.2163+89ff10d56;
• all five pass under CI-target Zig 0.18.0-dev.146+35accc06e;
• the bounded dual-version run peaked at 12 MB;
• git diff --check passes;
• the commit contains exactly five files and is authored as glennmichael123 <gtorregosa@gmail.com> with no coauthor.

The formatter's unrelated @enumFromInt/@intFromEnum semantic rewrites in GIF/TGA were intentionally excluded.

Pushed e21d9445f (fix(image): migrate analysis paths for Zig 0.18 (#884)) directly to origin/main.

This exact five-file batch covers IPTC metadata, mesh morphing, OCR, color operations, and panorama processing. In addition to clearing strict Zig 0.18 diagnostics, the IPTC implementation now uses allocator-explicit ArrayList APIs throughout, preserves ownership on partial allocation failures, and widens the extended-dataset length before shifting.

Verification:

• all five edited files pass ast-check under Zig 0.17 and 0.18.0-dev.146;
• IPTC passes 5/5 tests under both compilers;
• the new test exhaustively injects allocation failures through both parser and writer paths and passes under both compilers;
• the test run peaked at 211 MB under the 768 MB guard;
• git diff --check passes;
• the commit contains exactly five files and is authored as glennmichael123 <gtorregosa@gmail.com> with no coauthor.

The formatter's unrelated enum-builtin semantic rewrites remain excluded. A package-root color test also exposed separate existing blockers in selection.zig, print_prep.zig, and vector.zig; those are being handled in the next batch rather than hidden in this commit.

Pushed f04caeaf5 (fix(image): restore vector and print module builds (#884)) directly to origin/main.

This exact three-file batch:

• resolves Color through the canonical image.zig module in Selection, Print Prep, and Vector instead of importing the nonexistent color.zig;
• restores the two missing bottom bleed-mark corners, using the previously dead bleed_height value as intended;
• removes Vector's dead radius square and unused sign-tracking state, and makes the number-start binding immutable.

Verification:

• all three files pass ast-check under both Zig 0.17 and Zig 0.18.0-dev.146;
• both compilers pass zig fmt --check on the exact files;
• git diff --check passes;
• a bounded package-root test compile advances past these three modules and now reaches the next independent missing import in curves.zig;
• the commit has exactly three files and the requested author/committer identity, with no coauthor.

Pushed 86b06eb47 (fix(image): resolve canonical Color imports (#884)) directly to origin/main.

This exact five-file batch replaces nonexistent color.zig imports with the canonical Color export from image.zig in Curves, Morphing, RAW, HDR, and Color Blindness. Both Zig 0.17 and Zig 0.18.0-dev.146 pass ast-check and zig fmt --check on all five files; git diff --check also passes.

The bounded package-root test compile now advances through these modules and stops at the next independent stale import in history.zig. Commit identity and the exact five-file boundary were verified before the direct main push.

Pushed de0ac6345 (fix(image): continue canonical Color imports (#884)) directly to origin/main.

This second exact five-file tranche replaces the nonexistent color.zig dependency in History, Forensics, Focus Stack, Sprite, and Steganography with the canonical Color export from image.zig.

All five pass ast-check and zig fmt --check under both Zig 0.17 and Zig 0.18.0-dev.146; git diff --check passes. The bounded package-root compile advances through this tranche and now stops at the next stale import in ocr.zig. Commit identity, no-coauthor status, and the exact five-file boundary were verified before the direct main push.

Pushed 2137d4ffe (fix(image): finish canonical Color imports (#884)) directly to origin/main.

This exact three-file batch repairs Barcode, OCR, and Panorama, completing the stale-import sweep: packages/image/src now contains no references.

Verification:

• all three files pass ast-check under Zig 0.17 and Zig 0.18.0-dev.146;
• all three pass both formatters and git diff --check;
• a temporary package-root harness (removed before commit) passes 8/8 real image/color tests under both compilers;
• guarded peaks were 170 MB on Zig 0.17 and 199 MB on Zig 0.18;
• the commit has exactly three files and the requested identity, with no coauthor.

This closes the nonexistent Color-module blocker as a class. It does not yet claim that every lazy image feature has been instantiated by the package-root tests.

Pushed d0552c9d0 (fix(media): restore public codec and timing APIs (#884)) directly to origin/main.

This exact three-source-file batch restores APIs already required by Home's media bindings and integration contract:

• explicit disabled-stream and PCM codec variants, Ultra quality, common fractional frame rates, timing constructors/comparison aliases, and signed timestamp-safe helpers;
• Pipeline.crf, seek, and to aliases backed by the existing canonical implementations;
• public TranscoderState plus allocator-explicit BatchTranscoder job/result storage.

Verification:

• the shipped media module unit suite passes under pinned Zig 0.17 and Zig 0.18.0-dev.146;
• guarded peaks were 210 MB and 1,026 MB, respectively;
• all three files pass both formatter versions and git diff --check;
• the commit contains exactly three files and is authored/committed as glennmichael123 <gtorregosa@gmail.com> with no coauthor.

The uncommitted build-graph candidate now reduces integration compile failures from 27 to 15. Those remaining failures are being resolved against the real current API rather than by dropping tests from the check step.

Pushed 6f51c63eb (fix(media): preserve codecs and timing statistics (#884)) directly to origin/main.

This exact three-file behavioral batch fixes four failures found only after running the integration suite:

• container extension detection is now ASCII case-insensitive;
• a valid zero-origin monotonic timestamp no longer makes duration/average-FPS report zero;
• ordinary quality presets update CRF/preset/bitrate without overwriting explicitly selected video/audio codecs;
• the lossless preset still selects its lossless audio codec.

The complete media graph passes all 91 tests on pinned Zig 0.17 and passes combined compile/test gates on Zig 0.18.0-dev.146. Guarded peaks were 441 MB and 455 MB. All three files pass both formatters and git diff --check; commit identity and exact file count were verified before direct push.

Landed 9843feeb9 (fix(media): align integration contracts (#884)) directly on main.

This 3-file batch aligns the media integration surface with the implementation: it adds a recoverable Timeout media error and stable -64 error-code mapping, adds the registry's video-codec compatibility shorthand, and updates integration coverage to assert the current signed timestamp, duration, pipeline, filter graph, codec metadata, and error-conversion contracts.

Verification after pruning Zig caches:

• zig build test-integration -j1 passed with pinned Zig 0.17.0-dev.2163+89ff10d56
• The same integration suite passed with Zig 0.18.0-dev.146+35accc06e
• Dual-version AST checks and formatting checks passed for the changed source files
• git diff --check passed
• Guard peak: 1,110 MB under the 1,536 MB ceiling

Commit contains exactly 3 changed files and has no coauthor trailers.

The shipped-audio graph exposed nine source files with managed std.ArrayList fields still initialized as empty anonymous structs. Those are now fixed and pushed directly to main in two small commits:

• 9604dc43e — fix(audio): initialize managed lists explicitly (#884) (5 files)
• 9464093bd — fix(audio): finish managed list migration (#884) (4 files)

This is a Zig API migration, not a behavior workaround: each managed list now uses its declared .empty initializer while retaining allocator-explicit append/deinit calls.

Verification:

• First package-root batch: 19/19 tests passed under pinned Zig 0.17 and Zig 0.18-dev
• Second package-root batch: 20/20 tests passed under both toolchains
• Full shipped audio library, unit-test, and integration-test graph passed under both toolchains
• Guard peaks: 166 MB, 205 MB, and 442 MB respectively
• Both commits have the requested 3–5 files and no coauthor trailers

The separate build-graph patch that exposed these failures remains under validation before it is committed.

Landed 92e213824 (fix(image): migrate core format buffers (#884)) directly on the updated main after a non-force rebase over concurrent documentation work.

The 3-file batch migrates BMP, QOI, and TIFF buffers to allocator-explicit ArrayList ownership (.empty, allocator-aware append/deinit/toOwnedSlice). BMP bitfield decoding also now rejects zero required color masks and narrows only validated shift counts, avoiding both a Zig 0.18 type error and a malformed-input trap.

The package-root format harness passed all 32 tests under pinned Zig 0.17 and Zig 0.18-dev; guarded peaks were 174 MB and 181 MB. The commit has exactly 3 files, is authored by glennmichael123 <gtorregosa@gmail.com>, and has no coauthor trailers.

Three more verified commits are now on main:

• b744aa508 — fix(image): correct operation transforms (#884) (3 files)
• 7c9b82862 — build(image): verify shipped package graph (#884) (3 files)
• 3af628221 — build: verify shipped audio and media graphs (#884) (3 files)

The image operation batch removes alpha dilution from RGB trim distance, corrects the swapped 90°/270° coordinate mappings, adds 270° regression coverage, and strengthens affine composition coverage in both orders. Its package-root suite passed 23/23 under both Zig versions.

The image graph now builds the real exported module into both static and shared libraries, carries release SIMD configuration on that module, and compiles/runs format and operation tests through package-root harnesses instead of invalid nested module roots. zig build check test-all -j1 passed under pinned Zig 0.17 and Zig 0.18-dev (376 MB peak).

The audio and media graphs now compile the same exported modules they ship, install static libraries, compile all unit/integration targets in check, and remove the unused/nonexistent media test-framework dependency. The complete audio graph passed under both Zig versions (442 MB peak), and the complete 91-test media graph passed under both (448 MB peak).

All three commits contain exactly 3 files, use glennmichael123 <gtorregosa@gmail.com>, and have no coauthor trailers.

Landed 46f4b51ff (fix(audio): migrate file APIs to std.Io (#884)) directly on main.

This three-file slice migrates the high-level audio load/save APIs and WAV/AIFF file writers from the removed std.fs.cwd() surface to std.Io, while retaining convenience wrappers backed by the threaded default I/O implementation. It also:

• adds explicit *WithIo entry points so callers and tests can provide their own std.Io;
• finishes the allocator-explicit unmanaged std.ArrayList(AudioFrame) migration in the high-level loader;
• makes file-backed WavReader own and release its allocated input buffer;
• adds real temporary-file coverage for high-level save, WAV read/write ownership, and AIFF write paths.

Verified serially under a 1,536 MB guard:

• pinned Zig 0.17.0-dev.2163+89ff10d56: zig build check test integration-test -j1 passed (248 MB peak tree footprint);
• CI Zig 0.18.0-dev.146+35accc06e: the same full shipped audio graph passed (1,101 MB peak).

The first cold run also exposed four previously lazy parser failures in AIFF/MP3/FLAC/OGG. Those are real follow-up migration work rather than being hidden or worked around; I am addressing them as the next coherent batch.

Landed follow-up b9b232506 (fix(audio): repair lazy format parsers (#884)) directly on main.

The cold full-graph run from the previous slice correctly exposed four paths that Zig had not lazily analyzed before. This five-file batch fixes and tests them:

• AIFF: corrects the COMM num_frames and SSND block_size reads from oversized 6/8-byte slices to the format-defined 4-byte fields; a real encode/decode round trip now exercises both;
• FLAC and OGG: migrates Vorbis-comment lists to allocator-explicit std.ArrayList, including cleanup for the vendor and the current field/value pair on allocation failure;
• MP3: removes the impossible error union from parseV2Header because the function performs no fallible operation (rather than adding a meaningless try at its caller);
• high-level audio: restores the disk save/load round trip so the complete format-dispatch cone is analyzed and the loaded PCM values are checked.

Verification, serial under a 1,536 MB guard:

• pinned Zig 0.17.0-dev.2163+89ff10d56: zig build check test integration-test -j1 passed (438 MB peak tree footprint);
• CI Zig 0.18.0-dev.146+35accc06e: the same complete shipped audio graph passed (253 MB peak).

This distinguishes API-only migration from semantic fixes: the list calls are renames/signature migration, the AIFF widths are correctness fixes, and the MP3 error-union removal is safe specifically because that function cannot fail. No real attacker-input error path was removed.

Landed dffaed490 (fix(audio): harden format buffer handling (#884)) directly on main.

This five-file batch finishes another lazily compiled std.ArrayList migration slice across AAC, FLAC, OGG, Opus, and WMA. It adds allocator-explicit ownership and tests for each path, including complete cleanup of partially constructed Opus tags.

The new round-trip tests also found and fixed two semantic ownership/layout defects that were independent of the API rename:

• WmaReader.decodeUtf16Le returned a static empty string from an API whose callers always free the result; empty output is now allocator-owned like every other result.
• StreamInfo.parse extracted FLAC’s packed sample-rate/channel/bit-depth/total-sample fields from incorrect shifts and byte offsets. It now decodes the format-defined 20/3/5/36-bit layout, verified by writing and parsing a stereo 44.1 kHz/16-bit STREAMINFO block.

Verification, serial under a 1,536 MB guard:

• pinned Zig 0.17.0-dev.2163+89ff10d56: complete zig build check test integration-test -j1 passed, 264/264 unit tests (247 MB peak);
• CI Zig 0.18.0-dev.146+35accc06e: the same complete shipped audio graph passed (254 MB peak).

Landed c8e4f1c6d (fix(audio): finish std.Io and list migration (#884)) directly on main.

This four-file closure batch removes the final legacy std.fs.cwd() and allocator-capturing std.ArrayList(...).init(...) calls from packages/audio/src:

• playlist parsers/writers now expose explicit-I/O methods and have real M3U/PLS temporary-file round trips;
• batch directory discovery stores its std.Io, uses the new directory/walker APIs, and correctly distinguishes recursive from non-recursive scans (the old walker always descended despite recursive = false);
• MIDI parsing uses allocator-explicit temporary lists with complete nested-track cleanup on failure;
• the Ogg Opus writer uses allocator-explicit output storage and is exercised through a real write.

The MIDI test also exposed and fixed a semantic bug: pitch-bend data was cast to signed i14 before subtracting the 8192 center, even though positive 8192 is not representable by i14. Arithmetic now uses an i15 intermediate and narrows only after centering; the test verifies the wire value 0x2000 becomes zero.

Verification, serial under a 1,536 MB guard:

• pinned Zig 0.17.0-dev.2163+89ff10d56: complete zig build check test integration-test -j1 passed (435 MB peak);
• CI Zig 0.18.0-dev.146+35accc06e: the same complete shipped audio graph passed (262 MB peak);
• source audit: zero remaining matches for std.fs.cwd( or std.ArrayList(...).init( under packages/audio/src.

Pushed 14bb452a4 (fix(image): migrate lazy buffers to Zig 0.18 (#884)) directly to main.

This three-file image slice migrates the barcode, flood-fill, magic-wand, and lasso work buffers to allocator-explicit std.ArrayList APIs. Exercising those previously lazy paths also found and fixed real defects: stale .rgba tags, nonexistent Image.create calls, optional pixels passed to color math, unchecked optional pop() results, and missing error-path cleanup. New behavioral tests cover Code 128, QR quiet zones, flood-fill boundaries, contiguous magic-wand selection, selection-mask rendering, and lasso filling.

Verification:

• pinned Zig 0.17.0-dev.2163+89ff10d56: zig build check test-all -j1 passed; guarded peak 377 MB
• CI Zig 0.18.0-dev.146+35accc06e: the same shipped-library and full test graph passed; guarded peak 352 MB
• source audit: no allocator-capturing ArrayList.init, Image.create, or stale .rgba remains in the three changed files

No error-union handling was removed in this slice.

Pushed ddeed51c1 (fix(media): migrate streaming I/O to std.Io (#884)) directly to main.

This three-file slice migrates image streaming/mmap, media file probing, and the high-level Media.open path to caller-provided std.Io. It also fixes two behavioral issues found while forcing the paths through real tests:

• StreamingReader.read now advances the public position and uses positional reads, so seek and getPosition describe actual subsequent reads.
• StreamingWriter.flush now writes all buffered bytes; the old single write could silently discard a short-write suffix.
• failed opens clean up file handles, duplicate opens are rejected, zero-sized writer buffers are rejected, and mapped-file handles use the same I/O context for close.
• Media.deinit now frees the path owned by its probed MediaInfo; the prior Media.open path duplicated the pathname twice and released only one copy.

Verification (all serial and memory-guarded):

• image graph, pinned Zig: zig build check test-all -j1 passed, peak 404 MB
• image graph, Zig 0.18.0-dev.146+35accc06e: passed, peak 405 MB
• media graph, pinned Zig: passed, peak 436 MB
• media graph, Zig 0.18.0-dev.146+35accc06e: passed, peak 296 MB
• source audit: no legacy std.fs.File/std.fs.cwd() remains in the three changed files

Scoping note: I initially added the same explicit-I/O surface to high-level Image.load/save. Its real round-trip test correctly forced every branch of Image.encode through analysis and exposed 23 pre-existing failures across roughly 18 format modules (mostly allocator-capturing ArrayList.init, plus AVIF/HEIC/JXL bit-width errors). I removed that unverified high-level change from this commit. Those encoders need small format batches first; after they are green, high-level image file I/O can be migrated and tested honestly.

No crypto/error-union handling was changed in this slice.

Pushed ca95d81a2 (fix(image): migrate AVIF HEIC and JXL encoders (#884)) directly to main.

This three-file encoder tranche removes allocator-capturing ArrayList state throughout AVIF, HEIC, and JPEG XL encoding, passes allocators explicitly through nested box/bitstream writers, and adds real encoder tests that assert the emitted container structure.

Semantic fixes found while forcing those paths:

• AVIF and HEIC bit readers now derive the shift from bits_available - bits_to_read; the old expression had a possible intermediate value of 8 that cannot fit in u3.
• JPEG XL readBits now rejects widths above 32 before narrowing the shift count for its u32 accumulator. This preserves a meaningful malformed-input check instead of merely casting a wider attacker-controlled count.

Verification:

• pinned Zig 0.17.0-dev.2163+89ff10d56: full image zig build check test-all -j1 passed, guarded peak 377 MB
• CI Zig 0.18.0-dev.146+35accc06e: same shipped-library and full test graph passed, guarded peak 407 MB
• no allocator-capturing ArrayList.init, stored-list allocator lookup, or allocator-less owned-slice transfer remains in these three files

No std.crypto error-union handling changed in this slice.

Pushed 36ea7ab71 (fix(image): migrate DDS EXR and FLIF encoders (#884)) directly to main.

This three-file encoder tranche migrates DDS, EXR, and FLIF buffers to allocator-explicit std.ArrayList APIs and activates real encoder coverage.

Additional correctness findings from the newly analyzed paths:

• EXR channel parsing now frees the just-allocated channel name if list growth fails.
• EXR scanline decoding gives channel widths a runtime usize type and checks the full 2- or 4-byte channel width before reading, rather than checking only two bytes for every pixel type.
• The previously dormant FLIF varint test expected value 128 to occupy two bytes, contradicting both its writer and reader's documented 1-based representation. Coverage now round-trips 1, 128, and the actual two-byte boundary 129.

Verification:

• isolated 17-test DDS/EXR/FLIF root passed on pinned Zig (209 MB peak) and Zig 0.18.0-dev.146 (303 MB peak); the temporary root was deleted
• full image zig build check test-all -j1 passed on pinned Zig (399 MB peak)
• the same shipped-library/full-test graph passed on Zig 0.18.0-dev.146 (1,017 MB peak)
• no allocator-capturing list initialization or allocator-less owned-slice transfer remains in these three files

No std.crypto error-union handling changed in this slice.

Pushed d9cc2c959 directly to main: fix(image): migrate HDR PSD and TGA encoders (#884).

This is an exact three-file Zig 0.18 migration tranche:

• formats/hdr.zig: moved encoder storage to allocator-explicit ArrayList, replaced removed std.fmt.formatIntBuf with std.fmt.printInt, and fixed two real round-trip bugs exposed by active encoder coverage: the decoder stopped at the blank header separator before parsing dimensions, and the -Y encoder emitted scanlines in the opposite vertical order.
• formats/psd.zig: moved planar output construction to allocator-explicit list APIs and added an exact RGBA encode/decode round trip.
• formats/tga.zig: moved raw/RLE output helpers to allocator-explicit list APIs and added exact raw and RLE pixel round trips.

Verification, each run alone under the memory supervisor:

• targeted HDR/PSD/TGA graph: 17/17 on pinned Zig 0.17.0-dev.2163+89ff10d56 (202 MB peak)
• targeted HDR/PSD/TGA graph: 17/17 on Zig 0.18.0-dev.146+35accc06e (182 MB peak)
• full packages/image test-all: pass on pinned Zig (571 MB peak)
• full packages/image test-all: pass on Zig 0.18 (618 MB peak)

No compatibility shim, test weakening, or generated file was committed.

Pushed d8d49b61e directly to main: fix(image): migrate PNG ICO and Netpbm codecs (#884).

This exact three-file tranche ports real codec paths rather than adding compatibility wrappers:

• formats/png.zig: allocator-explicit nested APNG lists, Zig 0.18 std.Io.Reader / std.Io.Writer.Allocating plus std.compress.flate for zlib, incremental CRC computation, and strict decompression errors.
• formats/ico.zig: allocator-explicit container output and PNG-backed encoding.
• formats/ppm.zig: allocator-explicit PPM/PGM/PBM output and std.fmt.printInt.

The active round trips exposed and fixed additional semantic/ownership defects: PNG palette/frame failure cleanup, duplicate palette/transparency ownership, ICO partial-encode cleanup, and a 4-bit ICO palette shift incorrectly typed as u2.

Verification, one supervised process at a time:

• targeted PNG/ICO/PPM graph: 18/18 on pinned Zig 0.17.0-dev.2163+89ff10d56 (207 MB peak)
• targeted PNG/ICO/PPM graph: 18/18 on Zig 0.18.0-dev.146+35accc06e (191 MB peak)
• full packages/image test-all: pass on pinned Zig (618 MB peak)
• full packages/image test-all: pass on Zig 0.18 using isolated caches after a reproducible shared-cache missing-object failure (1,065 MB peak)

Coverage includes exact RGBA PNG, ICO-through-PNG, PPM RGB, PGM grayscale, and PBM packed-row round trips. No shim, test weakening, or generated test root was committed.

Landed 7a739303c (fix(image): migrate GIF SVG and RAW codecs (#884)) directly on main.

This three-file Zig 0.18 migration slice covers:

• GIF: allocator-explicit lists, balanced partial-frame ownership, strict truncated palette handling, and the valid 256-entry color-table shift fix (u3 could not represent shift count 8).
• SVG: allocator-explicit parser/encoder lists, allocation failures now propagate from path rasterization instead of being silently discarded, and encoder/decode round-trip coverage.
• RAW/DNG: allocator-explicit output, endian-correct inline TIFF SHORT parsing, selected SubIFD metadata stays paired with its strip, checked dimensions/strip sizes, correct DNGVersion byte order, and RGB TIFF strips now decode as RGB instead of being misinterpreted as Bayer sensor data.

Verification (fresh isolated caches, one guarded process at a time):

• pinned Zig 0.17.0-dev.2163+89ff10d56: image test-all 66/66 passed, peak tree footprint ~1,046 MB.
• Zig 0.18.0-dev.146+35accc06e: image test-all 66/66 passed, peak tree footprint ~1,060 MB.

All temporary Zig caches used for the run were removed afterward.

Landed b728b7643 (fix(image): migrate metadata writers (#884)) directly on main.

This five-file slice migrates and activates the EXIF, ICC, and XMP metadata paths:

• EXIF uses allocator-explicit list ownership, computes string-data offsets from the final IFD entry count, rejects overflowed/out-of-range value offsets, and declares the precise allocator error set for its recursive IFD parser.
• ICC uses allocator-explicit writer buffers, writes profile/color-space signatures in required big-endian order, validates tag ranges without overflow, and releases replaced/failed unknown-tag allocations.
• XMP uses allocator-explicit property/writer/list storage and fully cleans up partially parsed RDF list items.
• A real test-metadata package target is compiled by check and executed by test-all; this raised the full image suite from 66 to 78 discovered tests.

New behavioral coverage round-trips multi-string EXIF data and orientation, generates/parses an sRGB ICC profile with exact signatures and gamma, and writes/parses XMP attributes.

Fresh-cache guarded verification, one process at a time:

• pinned Zig 0.17.0-dev.2163+89ff10d56: 78/78 passed, peak tree footprint ~1,041 MB;
• Zig 0.18.0-dev.146+35accc06e: 78/78 passed, peak tree footprint ~1,117 MB.

All temporary caches were removed after verification.

Pushed 169d05bfb (fix(image): activate advanced image operations (#884)) directly to main.

This four-file slice activates the previously dormant color-blindness, composition/clipping-path, and dithering modules in the operations test root and ports their allocator-owned lists to the Zig 0.18 APIs. It also fixes the behavioral defects exposed by activating them:

• color-blindness simulations now reject unsupported pixel formats and clean up every partially constructed image/report allocation;
• accessibility reports transfer ownership atomically, including duplicated recommendation strings;
• layer, mask, composition, and clipping-path construction now clean up on allocation failure;
• mergeVisible builds the replacement layer before destructively replacing the old layer list;
• clipping-path point/segment mutations reserve both lists before committing either side;
• dithering rejects unsupported/indexed and invalid palette/count inputs instead of interpreting bytes with stale pixel-format tags;
• threshold dithering preserves alpha, error diffusion handles empty images safely, and quantization owns/frees its palette correctly.

Verification from empty isolated caches, one guarded process at a time:

• pinned Zig 0.17.0-dev.2163+89ff10d56: packages/image test-all passed; peak tree footprint 1,020 MB;
• Zig 0.18.0-dev.146+35accc06e: the same test-all passed; peak tree footprint 1,025 MB.

All temporary Zig caches from this verification were removed.

Pushed 0d911d630 (fix(image): migrate JPEG WebP and JP2 codecs (#884)) directly to main.

This exact four-file slice migrates JPEG, WebP, and JPEG 2000 encoder storage/helpers to allocator-explicit Zig 0.18 list APIs and explicitly activates JP2 in the format-test root.

The newly analyzed paths also exposed and fixed behavioral defects:

• JPEG now rejects zero/oversized dimensions and pixel formats its 8-bit baseline header cannot represent before narrowing dimensions;
• WebP validates its 14-bit VP8L dimensions and supported 8-bit formats, checks decoded pixel-buffer multiplication, rejects truncated subchunks, propagates animation-frame decode failures, and frees only initialized frame buffers on partial failure;
• WebP color-index transform size is now u9, preserving the valid 256-entry case instead of narrowing it to u8;
• JP2 box parsing now rejects truncated/oversized and malformed extended boxes without offset arithmetic underflow;
• JP2 rejects zero dimensions and unsupported 16-bit formats rather than writing an 8-bit header for them;
• JP2 Psot now reports the actual 15-byte tile-part length rather than the previous one-byte-short value.

Coverage now exercises JPEG baseline dimensions and format rejection, WebP RIFF/VP8L encode-decode dimensions, JP2 container/codestream encode-decode dimensions, and malformed JP2 box bounds.

Fresh-cache guarded full packages/image test-all verification, one process at a time:

• pinned Zig 0.17.0-dev.2163+89ff10d56: passed; peak tree footprint 986 MB;
• Zig 0.18.0-dev.146+35accc06e: passed; peak tree footprint 1,078 MB.

All temporary codec caches were removed after verification.

Pushed 653995839 (fix(image): activate steganography and vector operations (#884)) directly to main.

This three-file Zig 0.18 migration slice activates steganography.zig and vector.zig in the operations test graph. It ports their allocator-explicit collections and fixes the dormant behavior exposed by activation: consistent LSB byte capacity, 1/2/3/4-bit encrypted round trips, header and key validation, overflow-safe watermark bounds, owned watermark results, empty-pattern validation, bounded Bezier flattening, SVG parse errors, zero-segment arcs, zero-size raster handling, and radial-gradient division by zero.

Verification from empty caches:

• pinned Zig 0.17.0-dev.2163+89ff10d56: full packages/image test-all passed; guarded peak 1,044 MB
• Zig 0.18.0-dev.146+35accc06e: full packages/image test-all passed; guarded peak 1,105 MB
• git diff --check passed

All temporary Zig caches were removed after verification.

Pushed 21f386752 (fix(image): harden utility ownership lifecycles (#884)) directly to main as an exact four-file slice.

This activates the previously dormant format/image utility paths in the operations root and migrates their lists to allocator-explicit Zig 0.18 APIs. The active tests exposed and fixed:

• animation clone/insert/export failure cleanup, frame-dimension validation, and the incorrect ping-pong order;
• allocator mismatch between exported frame storage and the owning Image;
• multi-page metadata replacement leaks, split/merge partial ownership, zero-page-group and contact-sheet dimension validation;
• bounded APNG/WebP/GIF chunk walking for malformed input;
• duplicate image-pool releases that could hand the same buffer to two callers, allocation-failure cleanup, checked pooled-image sizing, and invalidation after release;
• allocator-correct thumbnails, checked tile/grid/padding dimensions, partial-tile cleanup, and highlighted diffs sized to both inputs;
• Zig's nominal anonymous-struct mismatch in the SIMD histogram result.

Fresh-cache verification, one guarded process at a time:

• pinned Zig 0.17.0-dev.2163+89ff10d56: full packages/image test-all passed; peak 1,017 MB
• Zig 0.18.0-dev.146+35accc06e: full packages/image test-all passed; peak 1,086 MB
• git diff --check passed

All temporary Zig caches were removed. The next reproduced slice is the batch file-I/O traversal, which exposed the remaining Image.load/save std.Io migration plus SVG view-box and TIFF bit-reader type defects.

Pushed e501b0c26 (fix(image): harden codec parser bit readers (#884)) directly to main.

This four-file codec slice ports the concrete parser hardening found during the active image test audit:

• AVIF/HEIC bit readers no longer overflow a u3 while advancing exactly one byte.
• TIFF bit extraction performs the width arithmetic before safely narrowing the shift.
• SVG view-box parsing now rejects missing, extra, non-finite, and non-positive values.
• SVG recursive parser functions use an explicit allocator error set, avoiding inferred error-set recursion.

Verification used a fresh isolated codec test root under both supported compiler tracks: 91/91 tests passed with pinned Zig 0.17 (377 MB peak) and Zig 0.18-dev.146 (380 MB peak). The temporary test root and both compiler caches were removed afterward. Commit authorship is glennmichael123 <gtorregosa@gmail.com> with no coauthors.

Pushed ebe7a0be2 (fix(image): migrate file APIs to std.Io (#884)) directly to main.

This five-file slice completes the image package's explicit-I/O boundary and exercises the shipped configuration:

• Image.loadWithIo, saveWithIo, and saveAsWithIo accept caller-provided std.Io; compatibility entry points delegate to the single-threaded global I/O implementation.
• File allocation is capped, encoded output uses streaming writes, image-size multiplication is checked, and clone cleanup now covers palette-allocation failure.
• The utility test performs a real QOI batch round trip through temporary input/output directories.
• A dedicated test-io root owns file/batch coverage and is wired into both check and test-all; check also compiles the shipped static and shared libraries.

Fresh-cache verification passed check test-all on both compilers under a 1,536 MB guard: pinned Zig 0.17 peaked at 1,391 MB; Zig 0.18-dev.146 peaked at 1,504 MB. All four isolated caches were removed afterward. Commit authorship is glennmichael123 <gtorregosa@gmail.com> with no coauthors.

Pushed 5d046b50c (fix(build): migrate owned collection APIs (#884)) directly to main as an exact three-file slice.

Current-state audit first disproved the stale packages/io failure: its shipped static library, embedded tests, and public-consumer tests all pass unchanged under pinned Zig 0.17 (1,039 MB peak) and Zig 0.18-dev.146 (1,083 MB peak).

The direct build-subsystem import audit then exposed real 0.18 failures in cross_compilation.zig, linker_script.zig, and packaging.zig. This commit:

• migrates allocator-owned lists and byte writers to the dual-supported allocator-explicit / std.Io.Writer.Allocating APIs;
• cleans up partially accumulated flags and commands on allocation failure;
• makes every linker argument uniformly owned, removing the unsafe cleanup heuristic that freed arguments based only on -L/-l prefixes;
• makes package-file insertion atomic across source/destination duplication and list growth;
• replaces an indeterminate enum-vs-undefined test with exact host architecture/OS mapping assertions;
• adds active command ownership, metadata formatting, package-file, and distribution-list coverage.

Fresh-cache guarded verification passed 9/9 tests on pinned Zig 0.17 (283 MB peak) and Zig 0.18-dev.146 (248 MB peak). The temporary import root and all audit caches were removed. Commit authorship is glennmichael123 <gtorregosa@gmail.com> with no coauthors.

Pushed 5fd816740 (fix(build): migrate file watcher to std.Io (#884)) directly to origin/main.

This 4-file slice:

• adds a standalone packages/build/build.zig gate that compiles the shipped static library and tests with the same libc setting;
• migrates the build file watcher from legacy std.fs / std.Thread.Mutex / std.Thread.sleep calls to explicit std.Io filesystem, mutex, clock, and sleep APIs;
• fixes duplicate-watch and append-failure ownership paths;
• fixes a pre-existing use-after-free where pollEvents shallow-copied event paths and then freed them, and adds an active ownership test;
• rolls back running when watcher thread creation fails;
• removes temporary heap copies leaked by IRCache.saveMetadata, and fixes the cache test cleanup order.

Fresh-cache verification, one guarded process at a time under a 1,536 MB ceiling:

• Zig 0.18.0-dev.146+35accc06e: check test passed, 15/15 tests, no leaks or warnings, 1,081 MB peak tree footprint.
• pinned Zig 0.17.0-dev.2163+89ff10d56: check test passed, 15/15 tests, no leaks or warnings, 1,026 MB peak tree footprint.

The newly activated incremental suite is deliberately tracked as the next substantive slice rather than represented as green: it currently exposes five failures and hundreds of allocator leaks around cache I/O ownership and parallel scheduling. The next patch will fix those defects and only then add incremental_test.zig to the active package test root.

Pushed 35ea544d6 (fix(build): make incremental cache ownership safe (#884)) directly to origin/main.

This activates incremental_test.zig in the build package's real test root and fixes the defects it exposed. The baseline was 17/22 passing with 5 failures and 422 allocator leaks. The repaired suite is 22/22 passing with zero leaks on both compilers.

Root fixes in this 4-file slice:

• ParallelBuilder.init now owns a concurrent std.Io.Threaded backend for compatibility callers; initWithIo supports explicit caller-provided I/O and is used by deterministic tests.
• Cache and statistics access shared by worker threads is synchronized instead of racing an AutoHashMap and counters.
• Per-task I/O backend construction was removed; workers reuse the builder's correctly scoped backend.
• A failed dependency wave now reports BuildFailed rather than being misclassified as CircularDependency.
• Partial task/deque/thread creation has complete rollback, including joining already-spawned workers if a later spawn fails.
• Source reads handle partial positional reads and cache compile time is computed from an actual completion timestamp.
• IRCache.get records misses and frees invalid entries; put atomically replaces owned metadata without leaking the previous entry; failed writes and partial metadata loads release their allocations.
• LRU eviction always makes progress when an oversized cache has fewer than four entries.
• The tests now persist the first builder before reopening its cache, use distinct content for parallel modules, and apply real 64 KiB payloads with unique keys for size-pressure eviction. The eviction gate triggered 12 real evictions.
• Same-key replacement is now covered explicitly and retains exactly one map entry.

Fresh-cache guarded verification, one process at a time under a 1,536 MB ceiling:

• Zig 0.18.0-dev.146+35accc06e: check test passed, 22/22 tests, zero leaks, 1,079 MB peak tree footprint.
• pinned Zig 0.17.0-dev.2163+89ff10d56: check test passed, 22/22 tests, zero leaks, 992 MB peak tree footprint.

Pushed e3ed6652a (fix(build): migrate pipeline entrypoints to std.Io (#884)) directly to main.

This five-file slice activates and ports the previously lazy build-pipeline surface:

• BuildPipeline, IntegrationTestRunner, and common integration scenarios are now forced through the package test root with refAllDecls.
• Pipeline, LTO, linker execution, integration file I/O, clocks, and child processes now receive and use an explicit std.Io provider.
• The linker uses std.process.spawn/Child.wait and checks Child.Term.success() without dropping signal or nonzero-exit checks.
• LTO reads/stats/output use the I/O-aware APIs, allocator exhaustion still propagates, and owned call-name lists plus optimized-output failure paths are cleaned up correctly.
• Added an active integration temporary-file round-trip test; the package's shipped static library and tests still share link_libc = true.

Fresh isolated-cache verification under the guarded runner:

• Zig 0.18.0-dev.146+35accc06e: zig build --build-file packages/build/build.zig check test passed; peak process-tree footprint 1,097 MB.
• Pinned Zig 0.17.0-dev.2163+89ff10d56: the identical check test command passed; peak process-tree footprint 1,034 MB.
• No allocator leak diagnostics; staged diff contained exactly the five intended files.

This advances the real-source and explicit-std.Io acceptance work; #884 remains open for the remaining package surfaces and CI lane.