v0.4.1

SavanXP v0.4.1 — summarized change list: the opening line of each entry. Full detail in CHANGELOG.md ([0.4.1] — 2026-10-23).

Download

SavanXP-v0.4.1.iso is a LiveCD that boots through BIOS and UEFI (tested in QEMU, q35, with 512 MiB of RAM or more). The system volume loads into RAM, so changes do not survive a reboot. The image is the plain system build plus the Doom port with the Freedoom: Phase 1 IWAD (freedoom1.wad, BSD-3-Clause; license in FREEDOOM-LICENSE.txt). The FFmpeg port, the Media Player and Celeste Classic are not included. Checksums in SHA256SUMS.

Added

• Native processes can have threads.
• Each native thread has its own %fs and %gs.
• Native threads can sleep on a word of memory.
• POSIX programs can use threads.
• AHCI (SATA) disk driver with DMA.
• The Command Prompt, the first SUN application.
• SUN windows choose their size, title and icon, and present rectangles.
• SUN gets CreatePipe and CreateProcess with chosen handles.
• The Start menu shows ▲/▼ arrows when its list does not fit.
• Native programs have a heap.
• SXN_SYS_SPAWN_STDIO and SXN_SYS_SET_NONBLOCKING.
• SXN_SYS_PROCESS_QUERY tells a native process about any other.
• SXN_SYS_WAIT_MANY, and pipes and devices can be waited on.
• sessiond, the session manager.
• SXN_SYS_TERMINATE ends a child.
• Ports, and POSIX on the native floor.
• Native calls for handles, devices and time.
• Window roles and global hotkeys for the shell.
• Web Viewer (/bin/webview), a local HTML viewer in the spirit of IE 1.1.
• Web Viewer gains its browser chrome.
• Web Viewer fetches http:// pages from numeric IPs, follows links and redirects, and shows source.
• Web Viewer paints a first CSS.
• Web Viewer resolves names through DNS.
• The taskbar shows a W2K-style clock that opens a calendar.
• Manual date/time setting (/bin/date, SET_REALTIME).
• Automatic time sync (/bin/ntpsync, ntp-smoke).
• Paint (/bin/paint), in the Accessories group.
• Paint gains brush, eraser, picker and undo.
• Paint gains a flood-fill bucket.
• libsximg.so.0.4, a PNG decoder the tree builds and installs in /disk/lib.
• --gui external applications link the window-chrome module.
• GitHub Actions CI (.github/workflows/ci.yml) on every push and pull request.
• <dlfcn.h>: dlopen, dlsym, dlclose, dlerror and dladdr for PIE programs.

Changed

• Every house icon is redrawn in a Windows 2000 look
• The Start menu draws each program's own 16x16 icon
• Static programs map their ELF headers.
• The kernel schedules threads, not processes.
• Disk writes are written back in the background.
• Disk writes are ordered by explicit flushes.
• The libc FILE buffer is 4 KiB
• SxFS commits write only the metadata sectors that changed.
• The taskbar's Start label uses the caption font.
• The visual harness opens programs through the Command Prompt.
• AltGr never triggers a hotkey.
• Program Manager no longer opens with the session.
• The desktop's text is Wine's MS Sans Serif, crisp and 1-bit.
• malloc's page source is a replaceable hook.
• The platform services live in system/.
• Application frames go straight to compositord.
• compositord composes the desktop.
• compositord is a session service.
• windowd is a native process.
• compositord connects to windowd through a private port.
• Closing a window asks the program; a hung one gets an End Program dialog.
• The shell role goes to a process the session started.
• Programs connect to windowd for a window (WM protocol v5).
• Each window publishes its own title, icon, accent and style.
• compositord is a native process.
• Ctrl+Esc opens the Start menu, Ctrl+Shift+Esc opens Task Manager, and Alt+Tab shows its own switcher.
• The shell is one /bin/desktop process.
• New app-paint and app-webview icons.
• The system edition is centralized as SAVANXP_EDITION.
• The native syscall dispatcher is a separate kernel unit.
• The kernel has an sx:: native surface.
• The POSIX dispatcher is a separate translation unit.
• The native ABI is standalone, with its first guest test.
• Neutral sx:: sync primitives.
• Native spawn/wait (SXN_SYS_SPAWN, SXN_SYS_WAITPID).
• Native event/section/wait syscalls plus the sxn.h userland surface.
• First native window, proven inside real windowd.
• Native input ring plus the sxnwm.h toolkit seed.
• Native widgets with scripted interaction.
• Real PS/2 keys into a native form, native apps in the launcher.
• POSIX translation out of the kernel.
• The kernel stops including the POSIX SDK.
• The current directory leaves the process state.
• The kernel no longer parks processes for poll().
• POSIX signals leave the process state.
• The smoke runner no longer leaves a QEMU behind when it is killed.
• A wedged disk is reset instead of failing the operation.
• The error space belongs to the kernel.
• Native IPC proven over sections plus events.
• Neutral sx:: sections, views and waits.

Removed

• The icon generators are no longer in the repository
• Eight redundant test programs.
• SDK examples that duplicated in-tree programs.
• shellapp, the old terminal window.
• The BusyBox port.
• The Task List.
• /bin/shellui, /bin/taskbar, /bin/startmenu, /bin/volumepopup, /bin/clockpopup and /bin/kbdlayoutpopup, now part of /bin/desktop, and the four shell launch flags
• The Haxe native experiment is removed.

Fixed

• clear in the Command Prompt no longer loses the prompt.
• A process ended by SXN_SYS_TERMINATE no longer reads as running.
• Windows opened during a fullscreen app get the desktop's size.
• Paint no longer overwrites PNG files or resizes what it opens.
• IDE flushes reach the drive.
• waitpid returns to the parent that is waiting, not to whoever waits first.
• Window titles are sharp.
• windowd-stats lines are back.
• A POSIX program started by a native one has its POSIX state.
• The kernel's text console no longer stalls the machine when it scrolls.
• Leaving fullscreen right after compositord died left the screen in the low mode.
• Minimizing a window from the taskbar left the next window's caption inactive.
• A clean checkout builds again.
• tools/verify_doom_persistence.sh runs on any host.
• ./build.sh test builds and passes again.
• The loader no longer holds a descriptor per library, nor leaks a failed load's segments.