build: finish Zig 0.18 standard-library migration

Home is preparing to move from the Pantry-pinned Zig 0.17 dev toolchain to 0.18/master. A source and compile audit against 0.18.0-dev.146 found three distinct classes that must be handled independently rather than by blanket rewrites.

Confirmed work:

• Remove only the obsolete error handling around std.crypto.dh.X25519.recoverPublicKey; retain X25519.scalarmult error propagation because it rejects attacker-controlled identity/small-order public inputs. Ed25519 deterministic generation and the visible AEAD/KDF checks remain fallible.
• Complete the std.Io migration. The tree already has broad std.Io adoption, but packages/io/src/async_io.zig still calls one-argument Threaded.init and the removed std.fs.cwd() surface. Many other legacy filesystem call sites require separate measured slices.
• Rename bare old optimize tags such as .ReleaseFast to lowercase tags where the contextual type is std.lang.Optimize. Qualified deprecated aliases still compile through 0.18, so this is mechanical rather than semantic.

Coverage findings:

• zig build --help, home-tool, and home-tsc build successfully with 0.18.0-dev.146.
• Direct compilation of the real packages/io and packages/build sources exposes failures that the top-level filtered tests do not compile.
• Main compiler/runtime production and test modules both link libc; no libltvpn-style test-only libc mismatch was found.
• Current Pantry, CI, and release workflows still pin 0.17.0-dev.2163, so green CI does not yet establish 0.18 compatibility.

Acceptance:

• Migrate in small independently verified slices that compile under both the current pinned compiler and the selected 0.18 baseline while dual support is required.
• Add real coverage for migrated package sources rather than placeholder tests.
• Preserve all meaningful cryptographic validation paths.
• Add an actual 0.18 CI lane before changing the project-wide pin, then move Pantry/release CI and documented commands together.

Related: #66, #855.

Pushed 093c062ef78ad918abcf6008822a0d71c5817d89 (fix(cache): migrate incremental storage to std.Io (#884)) directly to main.

This found a hidden coverage gap: packages/cache/src/incremental.zig was excluded from both the package build and the top-level cache test root, so the existing green Zig 0.18 build did not compile it. The commit activates it in both places and ports the implementation to explicit std.Io without compatibility shims.

The same slice also fixes real ownership and behavior defects exposed while making the module executable: module keys/paths/dependency lists/artifact paths are now owned consistently, replacement and failure paths release prior allocations, dependency-to-dependent edges are populated, invalidation is transitive and removes artifacts, metadata I/O is bounded, and cache cleaning measures and evicts actual artifacts. The removed std.fmt.fmtSliceHexLower call was replaced by deterministic SHA-256 hex encoding; no cryptographic validation or attacker-input check was removed.

Verification (each heavy process guarded and run serially):

• Zig 0.18 and pinned Zig formatting checks: pass
• Package Debug, Zig 0.18: 9/9 steps; public suite 14/14
• Package Debug, pinned Zig: 9/9 steps; public suite 14/14
• Top-level -Dfilter=cache, Zig 0.18: 5/5 steps, 30/30 tests
• Top-level -Dfilter=cache, pinned Zig: 5/5 steps, 30/30 tests
• Package ReleaseFast, Zig 0.18: 9/9 steps, 19/19 tests
• Package ReleaseFast, pinned Zig: 9/9 steps, 19/19 tests
• Peak observed memory: 1,085 MB (below the 3,840 MB ceiling)

#884 remains open for the remaining Zig 0.18 migration slices.

Pushed d028eae1a56b8c11efb2e9a2379435f3c88979f2 (fix(cache): activate dependency graph tracking (#884)) directly to main as an exact four-file slice.

The dependency tracker was another hidden source gap: it was excluded from both the standalone cache build and Home's top-level cache test graph. Forcing every declaration under Zig 0.18 exposed five real failures: removed managed-ArrayList construction/deinit APIs, stale owned-slice calls, and the obsolete .ImportStmt AST variant.

This slice activates the real module in both build graphs and fixes the behavior exposed by doing so:

• forward and reverse dependency edges are reserved and duplicated before either graph is mutated, keeping both maps coherent on allocation failure;
• graph keys, edges, compilation-order results, and cycle results have explicit ownership and complete cleanup;
• current .ImportDecl segmented paths are joined into canonical slash-separated dependency names;
• cycle detection returns only the exact closed cycle without leaking every acyclic DFS path;
• invalidation handles cycles and owns committed keys correctly;
• statistics include dependency-only leaf modules;
• duplicate edges remain idempotent.

An exhaustive checkAllAllocationFailures test caught an additional recursive-invalidation double free during this work: a key had already transferred into the invalidation map before a later dependent allocation failed. Ownership now transfers exactly at the successful put boundary, and the complete failure sweep passes.

Final fresh-cache guarded verification, one process at a time:

• standalone package Debug, Zig 0.18: 9/9 steps, 22/22 tests; 1,054 MB peak
• standalone package Debug, pinned Zig: 9/9 steps, 22/22 tests; 1,044 MB peak
• top-level -Dfilter=cache, Zig 0.18: 5/5 steps, 33/33 tests; 1,115 MB peak
• top-level -Dfilter=cache, pinned Zig: 5/5 steps, 33/33 tests; 982 MB peak
• standalone ReleaseFast: passes on both compiler tracks
• both compilers' formatting checks and git diff --check: pass

No error union or security-relevant validation was removed. #884 remains open for the remaining dormant package surfaces and standard-library migrations.

Pushed a34352dc10012663e66f84d1c38129aeef4a6bb2 (fix(io): migrate INI files to std.Io (#884)) directly to main as an exact three-file slice.

This closes another false-green coverage gap. The existing standalone packages/io gate reported 2/2 passing under Zig 0.18, but directly invoking the exported IniFile.parseFile failed because it still called removed std.fs.cwd(). The top-level build had no dedicated I/O package test target, and test compilation substituted an inline map instead of exercising the shipped collections implementation.

The patch:

• adds IniFile.parseFileWithIo using caller-provided std.Io and keeps parseFile as the real single-threaded compatibility entry point;
• makes tests use the production collections map rather than a test-only fallback;
• makes section, block, nested-block, map-key, and property-value ownership explicit on every partial allocation path;
• replaces duplicate section/property values without leaking their previous allocations;
• uses isolated temporary directories instead of a shared /tmp/test.ini fixture;
• adds a specific top-level io_package test target so filtering does not accidentally select unrelated iommu/diagnostics tests;
• runs exhaustive allocation-failure coverage across duplicate sections, duplicate properties, and nested blocks;
• executes both explicit-I/O and compatibility file entry points.

Guarded verification, one process at a time:

• standalone package Debug, Zig 0.18: 7/7 steps, 5/5 tests
• standalone package Debug, pinned Zig: 7/7 steps, 5/5 tests
• top-level -Dfilter=io_package, Zig 0.18: 3/3 steps, 5/5 tests
• top-level -Dfilter=io_package, pinned Zig: 3/3 steps, 5/5 tests
• standalone package ReleaseFast: 7/7 steps, 5/5 tests on both compiler tracks
• peak observed process-tree footprint: 1,119 MB during the baseline build; patched runs peaked at 1,072 MB
• both compiler formatting checks and git diff --check: pass

This is a semantic std.Io migration plus ownership repair; no fallible operation or validation check was removed. #884 remains open for the remaining dormant buffered/regex and package surfaces.

Pushed 5d25fa78f5256c844219e50ee70dfc9fea1b9004 (fix(io): migrate buffered files to std.Io (#884)) directly to main as an exact four-file slice.

The buffered I/O module was neither exported nor compiled by the package test graph. Forcing every declaration under Zig 0.18 failed immediately because its public file adapters still used removed std.fs.File types.

This slice:

• adds explicit-std.Io file reader/writer adapters plus compatibility entry points backed by the single-threaded provider;
• exports the buffered APIs from the shipped io module;
• activates the buffered source as its own package test artifact;
• migrates all file tests to isolated temporary directories and the new std.Io.Dir/std.Io.File operations;
• rejects zero-sized reader/writer buffers instead of permitting EOF confusion, an infinite write loop, or an out-of-bounds byte write;
• adds a public file-adapter round trip through the actual package module.

Activating the suite exposed a semantic API difference rather than a rename: Io.File.readStreaming reports EOF as error.EndOfStream, while the existing generic buffered-reader contract uses a zero-byte read. The file adapter now translates only that documented EOF signal to 0; every real I/O error continues to propagate.

Guarded verification, one process at a time:

• standalone package Debug, Zig 0.18: 9/9 steps, 14/14 tests
• standalone package Debug, pinned Zig: 9/9 steps, 14/14 tests
• top-level -Dfilter=io_package, Zig 0.18: 3/3 steps, 6/6 tests
• top-level -Dfilter=io_package, pinned Zig: 3/3 steps, 6/6 tests
• standalone package ReleaseFast, Zig 0.18: 9/9 steps, 14/14 tests
• standalone package ReleaseFast, pinned Zig: 9/9 steps, 14/14 tests
• peak observed process-tree footprint: 1,097 MB
• both compiler formatting checks and git diff --check: pass

No operational error was dropped; only the new API's explicit EOF representation is normalized to the established buffered-reader EOF contract. #884 remains open for the dormant regex and other package surfaces.

Pushed bab6ff261 (fix(io): activate allocation-safe regex support (#884)) directly to main.

This activates the previously dormant packages/io/src/regex.zig module in both the shipped io API and the standalone package test graph.

What was migration-only:

• Replaced the removed managed std.ArrayList.init(allocator) / allocator-bound method calls with the Zig 0.17/0.18-compatible unmanaged API.
• Removed the unnecessary error union from the infallible parser initializer.

What required semantic fixes rather than renames:

• Parse trees now live in a temporary arena, so every success and failure path releases all AST nodes and parser-owned character-class ranges.
• NFA character-class transitions now own independent range copies and release them exactly once.
• Builder states and fragment lists now unwind safely on every allocation failure; an exhaustive checkAllAllocationFailures test covers compilation.
• Parsing rejects unmatched trailing delimiters, repeated/bare quantifiers, and reversed ranges instead of silently accepting them.
• Search is leftmost and greedy; replacement now searches beyond the immediately preceding match instead of stopping early.
• find, findAll, and replace handle empty matches through end-of-input while guaranteeing forward progress.

Verification (fresh isolated caches, one guarded process at a time):

• Standalone packages/io, Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146: Debug passed.
• Standalone ReleaseFast on both compilers: 9/9 build steps and 36/36 tests passed.
• Top-level -Dfilter=io_package on both compilers: 3/3 build steps and 8/8 tests passed.
• Maximum observed guarded tree footprint: 1,180 MB, below the 3,840 MB ceiling.

The commit contains exactly four files and retains compatibility with the pinned compiler while exercising the shipped module under master-tracking Zig.

Pushed 1c34849ff (fix(pkg): migrate structured lockfiles to std.Io (#884)) directly to main.

This fixes and activates the exported packages/pkg/src/lockfile.zig API. A direct Zig 0.18 declaration audit previously failed at all three legacy std.fs.cwd() entry points (load, save, and exists).

Migration work:

• Added explicit-I/O loadWithIo, saveWithIo, and existsWithIo APIs using std.Io.Dir; compatibility wrappers use the global single-threaded I/O implementation.
• Added a standalone packages/pkg/build.zig that compiles the shipped static library, source tests, and public package tests.
• Updated the package test script to use zig build test, so it no longer bypasses the shipped-library build graph.

Semantic fixes found while activating the code:

• Lockfiles now deep-clone package fields, dependency keys/values, and every source-union variant.
• Deinitialization releases all of those allocations; exhaustive allocation-failure coverage exercises insertion and replacement.
• Replacing a package is allocation-atomic and releases the old key/package exactly once.
• Loading validates JSON tags and rejects out-of-range versions without panics or retained allocations.
• Saving JSON-escapes all dynamic strings and sorts package/dependency keys, making the reproducibility claim deterministic rather than hash-map-order dependent.
• Tests round-trip Registry, Git, Path, and URL sources, quoted/backslash data, duplicate replacement, explicit-I/O and compatibility APIs.

Verification (fresh isolated caches, one guarded process at a time):

• Standalone Debug, Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146: 5/5 build steps and 16/16 tests passed.
• Standalone ReleaseFast on both compilers: 5/5 build steps and 16/16 tests passed.
• Top-level -Dfilter=package_manager on both compilers: 3/3 build steps and 16/16 tests passed.
• Maximum observed guarded tree footprint: 1,145 MB, below the 3,840 MB ceiling.

The commit contains exactly four files and preserves dual compiler support.

Related build-package correctness slice: #904 landed on main in 4ef6f1f. It removes an actual >256-dependency cache-key input mutation and propagates allocator failure; the real packages/build check/test graph passes 33/33 on pinned Zig 0.17 and Zig 0.18 in Debug and ReleaseFast. This is not a claim that all legacy Zig APIs or the project-wide toolchain migration are complete. The separate current-main native build attempted for #894 was stopped by the unchanged 3840 MB guard; no native/full-runtime pass is claimed.

Related scoped slice: #905 is fixed and closed by a441cc5 on origin/main. The TS cache now has a standalone build that compiles its shipped static library and public tests on pinned Zig 0.17 and CI Zig 0.18, Debug and ReleaseFast (7/7 build steps, 18/18 tests for each). The same change fixes a real source/config key collision; full pinned TS driver 214/214 and TS Program 321/321 pass, and focused Zig 0.18 driver cache tests pass 4/4. This advances dual-toolchain source coverage but does not claim the remaining std.Io migration or project-wide 0.18 pin/CI lane is finished.

Additional dual-toolchain cache hardening: #906 is fixed and closed by 093ff6a on origin/main. The shipped ts_cache static library and its newly active fault-injection root compile and pass 20/20 tests on pinned Zig 0.17 and CI Zig 0.18 in both Debug and ReleaseFast. The original allocation-failure run reproduced one failed replacement and four leaks; the unchanged fault assertions now pass. Full pinned driver/Program consumers pass 214/214 and 321/321. This advances real migrated-package coverage, but std.Io migration, project-wide 0.18 pin and CI lane remain open.

Dual-toolchain build-package checkpoint on current main: the active packages/build graph now compiles its shipped ReleaseFast library and both test roots (4/4 steps) and runs 35/35 tests under pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 in both Debug and ReleaseFast. The new two-case watcher test in 592bbe4 exercises real std.Io file operations, deletion/recreation transitions, and allocation-failure retry; its predecessor failed before the fix. All runs stayed under the unchanged 3,840 MB guard. This is not full #884 completion. A separate packages/build/src/watch_mode.zig source is still outside the shipped package graph and currently has an invalid ../modules/module_system.zig import, in addition to removed filesystem/time APIs; a direct test attempt failed on that import and was reverted rather than presented as a green migration. It needs a coherent module-system/build-graph migration before coverage can be claimed.

Additional Zig 0.18 source audit on current main e9f03c1 (no code change claimed): shipped ts_watch tests pass 10/10, async tests 35/35, and basics_crypto tests 7/7 on 0.18.0-dev.146. Runs were serial under the unchanged 3,840 MB guard, with sampled tree-footprint peaks 237, 307 and 236 MB. These filtered roots do not prove all lazy code paths, whole-runtime release build, 0.17/0.18 dual support for every package, or the final pin/CI migration. #884 remains open.

Current-main correction at 1b07917: packages/io/src/async_io.zig already uses std.Io.Threaded.init(allocator, .{}) and std.Io.Dir.cwd(); the one-argument init and std.fs.cwd findings in the issue body are stale for this package. The real io_package test target (packages/io/tests/io_test.zig, importing the package) passes 8/8 under both pinned Zig 0.17 and Zig 0.18.0-dev.146, run serially under the 3840 MB guard (peak tree footprints 318 MB and 261 MB respectively). This is coverage for packages/io only, not the remaining dormant legacy filesystem modules or the full 0.18 migration. No code change is claimed.

Pushed 1e7655c directly to origin/main as glennmichael123: fix(storage): exercise memory and S3 drivers on Zig 0.18 (#884). Exactly three files changed. The shipped storage package now compiles and runs dedicated memory and S3 driver test roots alongside its prior root; the two drivers use std.Io.Clock.real instead of removed std.posix.clock_gettime, and memory directory deletion uses the allocator-explicit ArrayList API. A new unchanged-in-test 1,025-child regression verifies complete deletion while a sibling with the same prefix survives; the implementation now checks a directory boundary rather than matching arbitrary prefixes. Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 each passed Debug and ReleaseFast: 7/7 build steps and 16/16 test executions per run across three roots (10 distinct tests because imported root tests repeat). Both compilers passed zig fmt --check for all three files, and git diff --check passed. Observed guarded tree-footprint peaks remained below 600 MB. This is a partial storage migration, not full #884 completion: direct Zig 0.18 compilation of src/local.zig still fails on removed std.fs absolute-path APIs, and that local filesystem driver is not credited by these tests.

Pushed 8169786 directly to origin/main as glennmichael123: fix(storage): port local driver and uploads to std.Io (#884). Exactly three files changed. LocalDriver now uses std.Io.Dir/File operations and explicit-I/O construction; uploads use full positional reads and Zig 0.18-compatible hashing/formatting. Regression coverage includes 1,025-file listing and byte-for-byte uploaded content. On the exact committed tree, Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 passed native Debug and ReleaseFast builds: 9/9 steps and 68/68 test executions each (17 distinct tests repeated across four roots). Both compilers passed Linux and Windows cross-target compile checks, 6/6 steps each; those target binaries were not run. Formatting and whitespace checks passed. Remaining gaps: path confinement is lexical, not symlink-safe handle-relative traversal; Windows visibility/ACL behavior lacks runtime verification. This is progress on #884, not completion.

Pushed 2f71514 directly to origin/main as glennmichael123 (no coauthors): fix(basics): port fs utilities to std.Io (#884). Exactly three files changed: the existing fs utility implementation, a new real test root, and build-graph registration. File open/create/read/write/seek/append, bounded read-to-string, directory create/list/copy/rename/delete, and path resolution now exercise std.Io rather than removed std.fs handle APIs. The test root runs the actual fs.zig source; 3/3 tests and 3/3 build steps passed on both pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 in Debug and ReleaseFast (four serial memory-guarded runs; observed tree peaks 294–383 MB, below the 3,840 MB ceiling). Both compilers passed zig fmt --check and git diff --check passed. Scope boundary: importing the broader basics.zig aggregator on Zig 0.18 still fails on pre-existing errors in basics.zig, json.zig, and net.zig; this commit does not claim that aggregator, all basics APIs, or the full Zig 0.18 migration is green.

Pushed 0023559 directly to origin/main as glennmichael123, no coauthors: fix(basics): port JSON utility to std.Io writer (#884). Exactly three files changed (json.zig, a real JSON test root, build registration). The public JSON utility now compiles under both pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 with std.Io.Writer.Allocating and allocator-explicit ArrayList APIs. A red-before/green-after control caught two genuine bugs: unescaped object keys caused JSON SyntaxError; duplicate builder keys leaked the old value and replacement key (3 pass/1 fail/2 leaks before, 4/4 pass after). Both compilers passed Debug and ReleaseFast: 3/3 build steps and 4/4 tests in each of four serial runs; guarded tree peaks 301–321 MB, below the 3,840 MB ceiling. Both zig fmt checks and git diff --check passed. Aggregate basics.zig remains unproven: a guarded direct root test exposed additional removed std.time and std.posix clock/getenv APIs and ArrayList calls after the first three parse errors were temporarily corrected. Those exploratory edits were fully reverted; this commit does not claim the aggregator, native platform matrix, or whole Zig 0.18 migration is complete.

Pushed 05320ff directly to origin/main as glennmichael123, no coauthors: fix(basics): port Temporal clock and TZ access (#884). Exactly three files changed. Temporal.Now uses std.Io.Clock.real instead of removed std.posix.clock_gettime; libc-linked builds preserve the TZ environment override through std.c.getenv, while no-libc builds retain the existing UTC fallback. The new libc-linked test target tests real-clock bounds and TZ propagation, and has_side_effects=true prevents a cached run from disguising an environment change. Both Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 pass all 96 original Temporal source tests in Debug and ReleaseFast without libc; both pass the new 2/2 target in Debug and ReleaseFast with TZ=Asia/Manila, plus uncached 2/2 Debug with empty TZ. Libc-linked original-source runs also passed 96/96 on both compilers in Debug. Linux and Windows x64 test roots compile on both compilers with and without libc (compile-only, not executed). Both zig fmt checks and git diff --check passed. All heavy runs were serial under the 3,840 MB guard. This is a Temporal slice, not a claim that the broader basics.zig aggregate or entire Zig 0.18 migration is green.

Progress on Zig 0.18 migration: pushed 0a1b5a1 (fix(basics): port public time helpers to std.Io (#884)) to main as glennmichael123. The Basics public time helpers now use std.Io real/awake clocks and cancellable sleep, with explicit-I/O variants for callers that inject their own Io. Registered the Basics aggregate as a libc-linked test target matching the hosted build. Zig 0.18.0-dev.146 and pinned 0.17 both passed 108/108 aggregate tests in Debug and ReleaseFast; x86_64 Linux/Windows libc compile-only checks passed on both compilers. This is a partial migration: the freestanding aggregate still fails in Zig std.Io.Threaded, and other lazily compiled Basics APIs (notably net) still need their own port and tests. No freestanding-readiness claim.

Pushed a8bfcf0 (fix(basics): port mapped memory protection to typed flags (#884)) to main as glennmichael123. The previously uncovered packages/basics/src/memory.zig failed on Zig 0.18 because std.posix.PROT is a typed bitfield, not u32. The port uses typed flags, actual runtime page size, explicit zero-length rejection, and checked mprotect/mlock/munlock errors; the libc-linked Basics memory test target exercises all eight protection combinations, mapping/protection transitions, sync, an unaligned-in-page mlock/munlock address, and aligned allocation. Native macOS: 4/4 new tests on pinned Zig 0.17 and Zig 0.18 in Debug and ReleaseFast; the Basics aggregate remains 108/108 on Zig 0.18. Linux GNU and musl: the new test source compiles on both compiler versions (compile-only, not runtime execution). Windows behavior was not exercised. I also rechecked packages/io/src/async_io.zig on current main: its existing three direct Zig 0.18 tests already pass, so the issue description’s old Threaded.init/cwd failure is stale for that file. #884 remains open for other package migrations and the real 0.18 CI lane.

Pushed 3686b69 (fix(basics): capture process output through std.Io (#884)) to main as glennmichael123. The previously untested Basics exec path failed to compile on Zig 0.18 because std.process.Child.init is gone. It now accepts a caller-supplied std.Io, spawns through the current process API, and drains stdout/stderr together with MultiReader, preserving the inherited-stdin behavior while preventing a full-stderr-pipe deadlock. shell and commandExists pass the same explicit I/O context. A libc-linked basics_process target exercises distinct stdout/stderr, exit 7, both streams beyond pipe capacity, shell resolution, empty argv, and the 10 MiB capture limit. Native macOS: 4/4 tests on pinned Zig 0.17 and Zig 0.18 in Debug and ReleaseFast; Basics aggregate 108/108 on both. Linux/Windows test source compile-only checks pass on both versions; Windows tests skip execution and are not credited as passing behavior. Other APIs in process.zig, notably execWithInput/SpawnedProcess/ProcessBuilder/Pipe, still use the old Child surface and are not ported by this commit. The GitHub Zig-master lane exists in-tree, but gh run list --workflow zig-master.yml currently returns no runs, so no CI execution is claimed.

Pushed c8ad5c9 (fix(basics): feed child stdin concurrently with output capture (#884)) directly to main as glennmichael123. Basics execWithInput now uses std.process.spawn and caller-provided std.Io, shares the dual-pipe bounded capture path from the preceding exec commit, and runs nonempty stdin writing with std.Io.concurrent so a child echoing >pipe capacity cannot deadlock the parent. Writer errors propagate; on output failure the child is killed before the writer future is canceled. Empty input closes stdin without requiring concurrency, while a nonempty input on an I/O implementation with no concurrency returns ConcurrencyUnavailable promptly. New native tests cover output/status, 256 KiB bidirectional flow plus 128 KiB stderr, empty input, empty argv, the 10 MiB limit, and the unavailable-concurrency cleanup path. Combined process target: 9/9 tests on pinned Zig 0.17 and Zig 0.18 in Debug and ReleaseFast; Basics aggregate 108/108 on Zig 0.18. Linux/Windows new-test compile-only checks pass on both toolchains; no cross-platform execution is claimed, and Windows-specific tests skip. Remaining process.zig SpawnedProcess/ProcessBuilder/Pipe and other old Child paths still need migration.

Pushed 6d6b611 (fix(basics): port process child lifecycle to std.Io (#884)) directly to origin/main as glennmichael123, without coauthors. SpawnedProcess and ProcessBuilder now use std.process.spawn, std.Io, Environ.Map, current stdio options, and concurrent capture of zero/one/two output pipes. Waiting closes an unused piped stdin so EOF-dependent children do not hang; cleanup kills a child on error. Added five lifecycle tests for output/status, cwd/env/args, stream modes, kill/reap behavior, and stdin EOF. Combined process tests: 14/14 on pinned Zig 0.17 and Zig 0.18, each in Debug and ReleaseFast. Linux/Windows compile-only checks passed on Zig 0.18; this does not establish Windows runtime behavior. Remaining Pipe and other legacy process paths still need migration; #884 stays open.

Pushed d373a32 (fix(basics): stream process pipelines without deadlock (#884)) directly to origin/main as glennmichael123, no coauthors, exactly three changed files. Basics Pipe now uses the current std.process.spawn/std.Io API and passes each upstream stdout file directly as the next child stdin, spawning all stages before collecting output. It closes parent-owned handoff ends, reaps/kills every child on success/error, preserves the final command exit status, and enforces the existing 10 MiB output limit. Five new tests cover empty inputs, status/output, three live stages carrying 256 KiB beyond pipe capacity (including reuse), earlier-stage failure, and output-limit cleanup. Combined process suite: 19/19 on pinned Zig 0.17 and Zig 0.18 in Debug and ReleaseFast, each under the 3,840 MB memory guard. This is macOS execution, not Windows runtime proof. Other legacy process.zig helpers and the broader Zig 0.18 migration remain open.

Pushed a4ee192 (fix(basics): use explicit process context in std.Io helpers (#884)) directly to origin/main as glennmichael123, no coauthors, exactly three files. Basics environment reads now use a supplied std.process.Environ snapshot; child environment mutation uses an explicitly owned Environ.Map, validates names/NUL values, and does not pretend to mutate process-global state. Args use std.process.Args.Iterator with cleanup on every allocation-failure point; cwd uses std.process.currentPathAlloc/setCurrentPath with supplied std.Io. New direct tests cover snapshot copies/independence, map replacement/removal/validation, args ownership and injected allocation failures, and cwd. Combined process group: 24/24 tests on pinned Zig 0.17 and Zig 0.18, in Debug and ReleaseFast, each under 3,840 MB. This is macOS runtime evidence; Windows execution and remaining process helpers remain open.

Progress on Zig 0.18 migration: 480af47 (pushed to main) ports Basics process signal/liveness handling and sleep to current std.Io APIs. POSIX signal numbers now follow the host enum; invalid nonpositive PIDs are rejected, and Windows Child.Id is treated as a process handle rather than a numeric PID. Verification on macOS: basics_process group 28 passed / 1 Windows-only skipped in Debug and ReleaseFast with both pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146, guarded below 3,840 MB. The signal test file also compile-checked for x86_64-linux-gnu and x86_64-windows-gnu with both compilers. Windows/Linux runtime behavior was not exercised; the wider 0.18 migration remains open.

Pushed 1b5a6dc9b directly to main (3 files): migrated the public Basics filesystem facade from removed std.fs file/directory APIs to std.Io.File and std.Io.Dir, including an explicit-Io nonrecursive makeDirAbsolute wrapper. Added a real temporary-directory regression test for create/open/read/stat/delete and duplicate/missing-path errors. Before the change, this test failed to compile on Zig 0.18 at std.fs.File and std.fs.makeDirAbsolute. After the change: facade tests 2/2 on Zig 0.17 and 0.18 in Debug and ReleaseFast; existing Basics core tests 108/108; Linux and Windows cross-target compile checks passed (not runtime-tested). Formatting and diff checks passed. The wider Zig 0.18 migration remains open.

Pushed afadba7f4 directly to main (3 files). New image async-result regression first exposed removed std.Thread.Mutex on Zig 0.18; after removing that redundant lock, it exposed the old wait() signature. The fix uses the existing release/acquire completion flag as the producer/consumer publication barrier and passes explicit std.Io into wait for cancellable one-millisecond sleeps. Two focused tests cover cross-thread result publication and error propagation. Registered image suite: 97/97 on Zig 0.17 and 0.18, Debug and ReleaseFast; Linux/Windows compile-only checks passed (not runtime-tested). Peak guarded process-tree footprint was below 600 MB in all four full image runs. Zig 0.18 migration remains open.

Pushed b6b62e886 directly to main as a three-file std.Io file-package migration. Before this change, direct Zig 0.18 zig test packages/file/src/file.zig failed at removed std.fs.File and Io.Dir.makeDir. The package now uses explicit std.Io file/dir handles, positional I/O with a tracked cursor, nonrecursive/recursive directory operations, real-path and rename APIs, and accurate optional access time/status-change metadata. Opened handles close on allocation failures. The eight existing tests were isolated in unique temporary directories rather than deleting fixed names from the repository checkout, and the actual package tests are now registered in the top-level build graph with two additional seek/overwrite/append/directory regressions. Final guarded results: 10/10 on Zig 0.17 and 0.18 in Debug and ReleaseFast; peak process-tree footprint below 560 MB. Linux and Windows tests compile-only (not runtime-tested). Formatting and staged diff checks pass. The wider Zig 0.18 migration remains open.

Post-push integration check for b6b62e886: current Zig 0.18 zig build home-tool -j1 --summary all completed 4/4 Debug steps under the unchanged 3,840 MB guard (peak process-tree footprint 1,733 MB). This checks the non-JSC tool build only; it does not establish JSC-linked runtime or Bun-corpus success.

Pushed 5f700aa68 directly to main (exactly 3 files). Replaced packages/modules simulation-only tests with actual temporary-directory ModuleLoader tests registered in the top-level build graph. Before the change, the real test failed to compile because all three source imports escaped the module path. The loader now uses build-graph package imports and explicit std.Io, retains source backing AST name slices, closes/deinitializes source/AST/parser/map ownership, propagates non-absence filesystem errors, and rejects parser-recovered partial ASTs without caching them. Public function/value/type export kinds are distinguished from private declarations. The documented 10 MiB source boundary is tested at exactly 10 MiB and one byte over. Final guarded suite: 5/5 on Zig 0.17 and 0.18 in Debug and ReleaseFast, with peak process-tree footprint below 470 MB. Zig formatting and staged diff checks pass. Post-push home-tool build succeeds 4/4 from cache (not a fresh compile of the module package). Relative import resolution remains separate: resolveImport still ignores from_module; no full module-system/Bun-suite pass is claimed.

The independently observed relative-import/cache-identity follow-up from 5f700aa68 is now tracked as #920. This is separate from the verified Zig 0.17/0.18 loader migration; no relative-import pass is claimed.

Module-loader follow-up #920 is fixed by ca881af and closed. Canonical path cache identity and importer-relative ./ and ../ resolution now have real two-root tests; 6/6 module tests pass on Zig 0.17/0.18 in Debug and ReleaseFast under the 3,840 MB guard. This is macOS runtime coverage only; #884 remains open for its other std.Io migration scope.

Published directly to origin/main as glennmichael123 without coauthors: deaf609 (three files). Migrated the previously uninstantiated KernelBuilder and IsoBuilder staging writers from removed std.fs.cwd operations to explicit std.Io plus a caller-supplied destination directory. Real temporary-directory tests read back the generated linker script, multiboot header, copied kernel bytes, and GRUB config; the package test root now runs those source tests. This is staging only: compiling/linking a kernel and creating the final ISO are still unimplemented, and output_path is not claimed as an artifact. Direct kernel source tests pass 6/6 on Zig 0.17 and 0.18; integrated build-package tests passed 41/41 on both in Debug and ReleaseFast. Runs were serial through run_bounded with HOME_RUN_MAX_MB=3840; observed peak tree footprints were at most 539 MB. Two transient process-snapshot probe-deadline warnings occurred during the pinned tests; the supervisor tolerates fewer than eight consecutive failures and completed with measured samples, so uninterrupted sampling is not claimed. Other legacy build/runtime filesystem callsites, the 0.18 CI lane, and all-platform/release parity remain open.

Pushed bc62c38e7 directly to origin/main as glennmichael123 (author and committer; no coauthors), conventional issue-linked commit with exactly four files. Migrated MAC policy load/save and System.loadPolicy from removed std.fs.cwd() operations to caller-supplied std.Io and directory handles; newly instantiated parsing uses std.mem.tokenizeAny. Policy save/load round-trip, ordered rule decisions, missing-file behavior, audit-enabled system loading, and exact 10 MiB versus 10 MiB+1 input limit are covered in real temporary directories. Fixed partial-allocation ownership in security-context creation/parsing and rule cloning, with injected allocation-failure tests. The full packages/mac/src/mac.zig test root passes 17/17 on pinned Zig 0.17 and Zig 0.18 in both Debug and ReleaseFast, one guarded process at a time under HOME_RUN_MAX_MB=3840 (final observed peaks 141–298 MB). Both Zig format checks, git diff --check, and scoped Pickier on the changed README pass. This is one measured migration slice, not proof that all MAC APIs, packages, CI, release or platform targets are 0.18-ready; #884 remains open.

Progress on #884: 21858ac03 restores the shipped FFI/SQLite compile path. The pre-patch packages/ffi build failed identically with pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146: ambiguous Statement inside the SQLite binding and removed callconv(.C). The patch qualifies the opaque handle, uses the target C convention in both SQLite and CStdLib.atexit, and adds active compile tests plus a check step that includes both examples and tests.

Verified under the 3,840 MB guard, serially: zig build check --build-file packages/ffi/build.zig -j1 on both Zig versions; zig build test --build-file packages/ffi/build.zig -j1 on both; and the 0.18 example-sqlite run opened an in-memory database, inserted three rows, and read them back. Both Zig format checks and git diff --check passed. This is one FFI package slice, not proof of project-wide 0.18 compatibility. Separately, current packages/build and packages/io check steps compiled on 0.18 here; the issue's broader CI/toolchain migration remains open.

Another verified #884 slice is on main: 92a70f808. Both shipped linker examples failed to compile on pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 because they still used removed std.io.getStdOut().writer(). They now use std.Io.File.stdout().writerStreaming with explicit flush; the README shows the same working API, and a check step compiles all four examples plus active tests.

Actual execution also revealed that the embedded example's page-aligned .text and .rodata addresses were invalid for its declared 512 KiB flash region. The corrected layout validates and generates stm32_cortex_m.ld on both Zig versions. On each compiler, zig build check, zig build test, and zig build for packages/linker passed serially under the 3,840 MB guard; both kernel and embedded binaries executed from temporary directories, and the generated script contained the expected entry, MEMORY, and aligned .text sections. Both Zig formatting checks, targeted Pickier on the README, and staged diff check passed. This is linker-package coverage only; project-wide Zig 0.18 migration and CI admission remain open.

Pushed 9f56b05 directly to origin/main as glennmichael123, with exactly three files and no coauthors. The public video Source.readAll path was missing from the ordinary package test gate: a new public integration regression failed before the fix on Zig 0.18 at removed std.ArrayList.init, while the previous implementation also consumed up to 8192 bytes beyond max_size. The method now uses allocator-threaded ArrayList operations and limits each read to the remaining byte budget; the test covers zero, short, EOF, and a partial second 8192-byte chunk. The regular package test step now runs this integration suite. Guarded serial Debug tests passed on pinned Zig 0.17 and Zig 0.18; optimized ReleaseFast tests passed 329/329 on each compiler. Both Zig format checks and diff checks passed; observed tree-footprint peak was 689 MB under the 3840 MB ceiling. This verifies the public bounded-read slice only, not every video adapter, full Zig 0.18 migration, or CI readiness. #884 remains open.

Second video std.Io slice is pushed directly to origin/main as glennmichael123: 4d13e40, exactly three changed files, no coauthors. Public FileSource and FileTarget now accept an explicit std.Io, own std.Io.File handles until close, and use positional reads/writes with tracked logical offsets. This removes removed std.fs.File/cwd APIs and fixes FileTarget.seek, which previously ignored whence and bitcast negative offsets. A real temporary-file regression first failed on Zig 0.18 at std.fs.File; after migration it verifies overwrite via relative seek, seek from end, EOF, missing-file mapping, invalid negative seek, size and flush. On pinned Zig 0.17 and Zig 0.18, guarded Debug package tests passed 330/330, ReleaseFast tests passed 330/330, and shipped-library plus all declared test-root check steps passed. Both Zig formatting checks and diff checks passed; peak guarded tree footprint was 734 MB under the 3840 MB ceiling. This does not claim all video APIs, targets, CI, or project-wide 0.18 migration are complete.

Pushed 994f719 directly to origin/main as glennmichael123: exactly three files, conventional commit, no coauthors. This is a verified Zig 0.17/0.18 slice of the public video WAV disk API.

The new public integration regression failed before the change because WavReader.fromFileWithIo did not exist; existing disk paths still used removed std.fs.cwd calls. WavReader.fromFileWithIo now reads through an explicit std.Io, owns and releases file-backed bytes (while fromMemory remains borrowed), and propagates allocation failure. WavWriter.writeToFileWithIo and Audio.loadWithIo/saveWithIo use the same I/O surface; no-Io wrappers remain. Audio's frame list also uses allocator-threaded std.ArrayList operations. The test checks missing files, exact sample bytes through writer/reader/Audio load/save and in-memory load, and cleanup after malformed input.

Guarded package test steps pass with both pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 in Debug and ReleaseFast. Each full uncached run had 331/331 tests; final reruns reused the 326-test unit result and reran the five integration tests. Shipped-library/test-root check steps passed on both compilers, both Zig format checks and git diff --check passed. Observed guarded tree-footprint peaks stayed below 733 MB, against the 3,840 MB ceiling. This verifies the WAV file slice only; other video adapters, the broader std.Io migration, and 0.18 CI/pin changes remain open.

Pushed 5c16678 directly to origin/main as glennmichael123 (three files, conventional commit, no coauthors). It rebased cleanly on Chris's non-overlapping 71f639d recording-policy commit.

The public video sink module was not compiled through a real sink regression: adding a dedicated public test target reproduced 13 Zig 0.18 errors from removed std.ArrayList.init/allocator-less methods. All five list-backed sinks now use allocator-threaded operations. FileSink now owns a std.Io.File, supports an explicit Io interface (with its existing default-Io entry point preserved), writes at tracked offsets, and closes exactly once. The new public tests cover byte order and file reopening, write-after-close, buffer clear/reuse, frame/packet retention, and audio/waveform sample facts.

On the rebased tip, guarded full package test steps passed 334/334 on pinned Zig 0.17.0-dev.2163 and Zig 0.18.0-dev.146 in both Debug and ReleaseFast. Shipped-library/test-root check steps passed on both compilers before the rebase (the new parent touched only recording-policy source and docs); dual Zig formatting and git diff --check passed. Peak observed tree footprint in the final four test runs was 736 MB, below the 3,840 MB ceiling. This is a verified sink slice only; other video APIs, the wider std.Io migration, and 0.18 CI/pin acceptance remain open.

Pushed e653e9c directly to origin/main as glennmichael123 (three files, conventional commit, no coauthors). This adds a fixed Zig 0.18.0-dev.146 CI job alongside the existing moving-master job, plus scripts/verify-zig-018.sh and scope/reproduction documentation. The fixed job builds home-tsc and runs both check (shipped libraries plus test sources) and test for packages/io and packages/build; it does not replace the 0.17 production lane.

Local verification: the exact script passed under the 3,840 MB guard, peak sampled tree footprint 2,032 MB. Zig 0.18 Linux x86_64 cross-build of home-tsc and cross-checks for the two packages also passed. The script rejects the pinned 0.17 compiler with exit code 2. Bash syntax, workflow YAML parse, targeted Pickier check, and git diff --check passed. GitHub Actions execution of the new job is not yet confirmed; full compiler/runtime 0.18 migration remains open.

CI execution follow-up for e653e9c: I attempted workflow_dispatch on main for the updated Zig master compatibility workflow. GitHub returned HTTP 422, "Actions has been disabled for this repository." The fixed 0.18 job is committed and passed locally, but there is no hosted CI run to cite until Actions is re-enabled. This does not change the local verification or imply the broader migration is complete.

Checkpoint on main: 63dc191 (test(build): gate basics crypto on Zig 0.18) adds the real basics crypto consumer suite to both the fixed 0.18.0-dev.146 gate and the moving-master job. This covers Ed25519 use, X25519 agreement and the fallible identity/small-order public-key rejection, plus authenticated-decryption failure. Local guarded direct tests passed on 0.18 (303 MB peak) and Pantry 0.17 (254 MB peak). The full fixed 0.18 gate passed after the edit: crypto 7/7, I/O 36/36, build package 41/41; process-tree peak 2,299 MB below the 3,840 MB ceiling. Bash syntax, targeted Pickier and diff checks passed. The standalone build warned that pinned Bun WebKit is absent and used system JavaScriptCore; this is not native Bun-runtime verification. This expands CI coverage only; the broader 0.18 migration and actual CI execution remain open.