v0.4.0

SavanXP v0.4.0 — summarized change list: the opening line of each entry. Full detail in CHANGELOG.md ([0.4.0] — 2026-10-08).

Added

• Per-song GENMIDI bank in libsxmidi.
• libsxmidi.so.0.4, a General MIDI synthesizer the tree builds and installs in /disk/lib.
• The DoomGeneric port has music.
• The port's music is checked on the guest audio, and on what follows it.
• Three SpicyGame pixel fonts join the baked set.
• Start menu (trimmed): Start button plus a flat Programs list.
• The Start menu gains a footer, a banner strip, a logo button and a self-listed launcher.
• libffmpeg.so.0.4, FFmpeg's five components as one shared library.
• The Media Player is a program that depends on a library.
• The Media Player is a program of the system tree, and the FFmpeg port builds no program at all.
• A program whose library is missing now says so and keeps running.
• A missing dependency no longer leaves the program unrelocated, and no longer takes the rest of them with it.
• The loader applies R_X86_64_64.
• libgfx2d.so.0.4, the 2D painter and window chrome, as a shared library.
• Up to 32 shared libraries per process, instead of 8.
• The library loader no longer leaks a descriptor per library.
• A rebuilt program now reaches the bootable image.
• The visual scenarios now assert the glyphs on screen, not just that something moved.
• A program can now ask the loader which dependency failed to load.
• The Media Player is built position-independent.
• Two Media Player smoke scenarios are removed.
• A missing shared library is now recorded as reported by the application itself.
• Dead code in the binaries is now measured against what would recover it:
• A relocation type the loader does not implement now says so,
• Three more loader failures now say what they are, and each has a self-test.
• The library loader says which symbol it could not resolve.
• The runtime for external applications is derived from the one for the system's own programs
• The build now fails if a program carries its own copy of a library it loads.
• The kernel now tells a program where its own image starts.
• libsxgfx.so.0.4, the graphics layer, as a shared library.
• sxgui-smoke, which drives the visual scenario as a smoke test.
• libsxgui.so.0.4, and ten programs now draw through it.
• ldso_symbol_is_shared()
• sx_start_dynamic reports a failing interpreter.
• calc now links as a PIE
• crt0 now runs the library loader before main.
• libtest, the first program that links against a shared library.
• The loader relocates the executable, not just libraries.
• The executable is now in the library loader's symbol scope.
• A library now loads the libraries it declares.
• pietest, the first PIE executable in the tree.
• The kernel loads ET_DYN images with a load bias.
• The kernel reads PT_INTERP and hands the path to crt0.
• libmath.so.0.4, a real shared library, and a minimal loader that maps it.
• section_open_range backs a section with part of a file.
• section_open maps a file into a read-only section.
• map_view_at maps a section view at an address the caller chooses.
• savanxp_system_info reports live section counts.
• SAVANXP_SECTION_EXEC maps a section view as executable.
• fscheck reports SxFS consistency from inside the system.
• Celeste Classic is now an official port.
• The SDK now owns Doom-style pixel presentation and timed PCM mixing.
• Linux builds can now be driven by Bash and CMake.
• Official ports now have a versioned layout.
• DoomGeneric now has a versioned official port.
• The optional Haxe subsystem now has a standalone Linux build.
• Linux now has a headless smoke runner.
• Linux smoke orchestration now covers audio, TCP, and external native apps.
• Linux build commands now match the one-word smoke aliases and SDK install destinations.
• The host sxfs-cli check command validates SxFS metadata.
• SxFS images now compact safely when fragmentation blocks an apply.
• Stack canaries are randomized at kernel boot and for every new process.
• Kernel security boundaries are documented and enforced.
• Alt+F4 closes the active window,
• System name and version at the bottom right of the desktop,
• Dialogs are windows of their own.
• Media Player is now a system application in Accessories.
• The FFmpeg port decodes the common formats.
• Gears (/bin/gears), in the Diagnostics group.
• Fixed-size windows: window_flags=fixed_size in a .sxres.
• Floating point in every app of the image.
• docs/SXGL_ROADMAP.md.
• Calculator (/bin/calc), in the Accessories group.
• Minesweeper (/bin/mines), in the Games group.
• System master volume and mute.
• Taskbar volume button and popup.
• sx_audio_mixer_set_voice_loop.
• Celeste Classic now plays music.
• Two programs can now sound at once.
• Per-application volume.
• Per-application sliders in the volume popup.

Changed

• Doom music now plays the WAD's OPL2 instruments.
• The MIDI bank stopped being one waveform per family.
• The calculator's arithmetic now comes from libmath.so.0.4.
• The calculator shows 15 significant digits instead of 16
• Section budgets raised: 64 section views per process, 256 sections system-wide.
• Two PT_LOAD segments may now share a page.
• The ELF loader reports which program header it rejected.
• The section cache keys on the file range, not just the inode.
• savanxp_system_info reports live section counts
• Window caption bars are two pixels taller.
• The test machine now boots with 1 GiB of RAM
• SxFS format v2: 4096 inodes and a 1 GiB ceiling.
• ATA now splits large requests instead of rejecting them.
• fscheck reports metadata commit cost.
• The development path no longer carries the persistent volume as a boot module.
• build/disk.img may now be larger than the volume inside it.
• Window titles use RetroSans instead of Noto Sans.
• Active captions follow the declared accent instead of tinting the blue base.
• init relaunches the audio daemon only when it dies serving.
• The test machine now boots with 512 MiB of RAM
• Window title text is now one pixel smaller and bold.
• Normal builds no longer regenerate desktop source icons.
• Gears (/bin/gears) has a redesigned app icon.
• The About app now identifies the system as the Alpha edition.
• The boot screen fades in from black, like a classic desktop splash.
• Visual desktop verification uses the native Bash launcher.
• Linux Program Manager and Add/Remove Programs smokes restore Doom when its external ELF exists.
• Doom persistence now has an isolated Linux regression command.
• ISO verification now covers El Torito plus BIOS and UEFI boot.
• WM↔client protocol v4: the session opens all 12 windows.
• The automated smokes honour --accel.
• The system 3D edges moved to savanxp/sxchrome.h, out of the toolkit.
• The userland links with --gc-sections.
• The managed app layer (Haxe on a VM) is deferred until after v1.0.
• About is now System Properties.
• The Shell window opens and repaints far faster.
• The compositor accumulates damage as an exact region.
• tools/shoot.sh drives other hardware and loads the display path.
• Launcher icon captions wrap to two lines.
• The boot screen is now a splash with the project logo.
• The splash bar keeps moving through the long boot steps.
• All repository documentation is in English, and the README leads with a quickstart.
• The filesystem is now called SxFS, and the 2 leaves the name.
• assert() reports when it fails.
• struct stat has the fields third-party code names.
• exec no longer copies the whole image into physically contiguous pages.
• The user stack goes from a fixed 128 KiB to 1 MiB on demand, with a guard page.
• spawn/exec accept 128 arguments and 8 KiB total, instead of 15 arguments of 63 characters.
• Streams read in batches and malloc aligns to 16.
• The libc stops renaming with #define: the standard names are now real symbols.
• One userland runtime and one printf.
• icon= in progman.ini points at a program, not at an art catalog.
• The sxgui chrome moves to the Win95 two-pixel bevel.
• The sxgui apps share a single layout grid.
• tools/shoot.sh gains the files scenario.
• The keyboard event carries the modifiers.

Removed

• The SxMedia multimedia layer is withdrawn, and the Media Player is the optional FFmpeg port again rather than a system program.
• The alternate host compatibility surface is removed.
• The legacy SDK trees for Doom and FFmpeg are removed.
• The wavinfo and player FFmpeg demos.
• The icon set baked into desktop_icons.h is down to one.
• The start menu strip art is deleted.
• The eight hand-written coreutils in subsystems/posix/userland are deleted.

Fixed

• Celeste's effects no longer saturate at any volume.
• A jittery audio stream is concealed instead of zeroed.
• Changing the music no longer stalls the game for a second.
• A missing library is now named deterministically, and counted.
• The emulated disk transfers 32 bits per port access instead of 16
• Four loader diagnostics can now fail.
• The launcher's baked table and the manifests agree.
• The visual smoke scenarios work on a virtio machine.
• Moving the mouse over a virtio machine no longer freezes the VM.
• smoke_runner_layout_test.py runs again.
• progman-smoke passes again.
• Relocated global pointers in a PIE no longer become a pointer to the image base.
• crt0 no longer loses argc and argv.
• The interpreter path no longer overwrites an argument string.
• PIE executables no longer declare a glibc interpreter path.
• A shared library no longer resolves its calls against the wrong image.
• A library that calls nothing from outside now loads.
• The mouse no longer drifts away from the host's.
• The AC'97 driver measures its own feed.
• ./build.sh smoke clock-smoke.
• Sockets that ported code can use.
• A network adapter with no driver is reported as such.
• Task Manager (/bin/taskmgr), in the System group.
• TCP survives a network that loses and reorders.
• The mouse wheel works.
• The compositor measures itself.
• Gfx Demo has an auto-motion mode.
• Every core runs user processes, under one big kernel lock.
• Add or Remove Programs (/bin/appwiz), in the System group.
• Program Manager lists every installed program on its own.
• virtio-net driver for the NIC.
• --accel kvm.
• Audio capture (virtio-sound RX) and duplex /dev/audio0.
• Keyboard over virtio-input.
• virtio-blk driver for the persistent disk.
• The file list shows an icon per type.
• Video player on FFmpeg: MJPEG decoding, YUV->RGB through swscale, on screen.
• FFmpeg runs inside SavanXP.
• static_assert in <assert.h>, the PRI*/SCN* in <inttypes.h>, and fpclassify.
• ./build.sh smoke runs imagetest.
• ./build.sh smoke runs stacktest.
• The libc gains what a port takes for granted.
• Real %f, %e and %g, and strtod.
• libm: the missing ones.
• ./build.sh smoke runs libctest.
• ES/EN keyboard layout selector, in the taskbar.
• ./build.sh smoke kbd-smoke: the keyboard driver is tested on its own.
• ./build.sh smoke pointer-smoke --virtio: the pointer is tested on its own.
• SXE stamping is no longer opt-in: everything built for the system comes out in that format.
• icon_file= in the manifest: the icon travels in the binary, not in assets/.
• Floating point in userland, with --sse and a libm of our own.
• Tab control in sxgui (sxgui_tabs).
• Taskbar at the bottom of the screen, listing open windows.
• tools/shoot.sh: visual verification of the session, headless.
• Alt+Tab to switch windows.
• Text selection in sxgui, with Cut, Copy and Paste.
• System clipboard, in /dev/clipboard.
• Closing a window no longer freezes the desktop while the program is still loading.
• The native SXGUI smoke label is now distinct from the native GUI host.
• CMake-generated UEFI images now include startup.nsh.
• Linux gpu-soak now uses the legacy 96-iteration default.
• DoomGeneric verifies its vendored upstream tree before building.
• build.sh --jobs now applies to every CMake build target.
• Linux QEMU launches honor SAVANXP_QEMU and custom OVMF pairs.
• Native Haxe --force now clears stale generated artifacts.
• BusyBox is built with stack canaries enabled.
• SxFS directory reconstruction now uses a bounded 32-level depth.
• SxFS now rejects data extents claimed by more than one inode.
• SMEP and kernel write protection are enabled on supported processors.
• Initramfs archives that exceed the VFS node limit now fail closed.
• RTL8139 accepts valid maximum-size frames and recovers from bad records.
• NX is now enabled explicitly on every application processor.
• The keyboard-layout popup can change the active layout again.
• Kernel stack-canary failures report the actual return address.
• User memory is no longer uniformly executable.
• Malformed storage and boot images are rejected before use.
• Mutating device ioctls require a writable descriptor.
• Restoring a maximized window no longer leaves residue on the wallpaper.
• fork hands the child the floating-point registers too.
• A command typed in the desktop Shell keeps its arguments.
• netinfo over virtio-net no longer kills the machine on VirtualBox.
• QEMU starts from a path with a space in it.
• The kernel/userland build handles host paths with spaces.
• Closing a window that was playing sound no longer mutes the machine.
• The wall clock follows the ACPI PM timer on machines that expose a usable one.
• The kernel's wall clock is a free-running counter, not a count of timer interrupts.
• A process waiting in poll() wakes on the event, not only on the next tick.
• ./build.sh build no longer deletes build/disk.img when it cannot read it.
• poll() blocks instead of spinning, and an idle machine halts.
• Notepad's editor ignored the mouse wheel and its own scrollbar.
• tools/shoot.sh guarded the wrong path for a planted automation spec.
• A blocking pipe read did not get the CPU when its data arrived.
• The taskbar drew the generic icon for every window.
• The ELF loader failed on two PT_LOADs sharing a page.
• argc could exceed the arguments that existed.
• time() returned the uptime, not the Unix epoch.
• strtoul and friends wrapped silently on overflow.
• waitpid() was infinite recursion.
• A read-only SxFS volume became writable again once published.
• Two windowd bugs uncovered by the keyboard selector popup.
• The SXE resource generator blurred an icon when enlarging it.
• The Type column in files was clipped when the scrollbar appeared.
• Row text did not line up with its column label.
• In widgetsdemo the free-standing scrollbar overlapped the second column.
• Pressing Ctrl dropped the selection, so Ctrl+C copied nothing.