v0.0.4

Release v0.0.4

Builds on v0.0.3. New in this release:

• A sturdier architecture. The bulk of this release is a deep structural pass
  that follows through on the sealed-core groundwork from v0.0.3. The scheduler
  and process engine — historically a handful of enormous files that the rest of
  the kernel reached into freely — is now split into clearly separated layers
  with a small, explicit set of entry points between them, and the largest
  source files are broken into focused modules. A single result-and-error
  vocabulary runs across every subsystem boundary. Build-time checks enforce the
  rules: scheduling and process state can only change through the engine's own
  entry points, and lower layers can't reach up into higher ones. None of this
  changes what programs see — it makes the kernel far easier to reason about and
  much harder to break one part without the build catching it, which is what
  lets new work land cleanly from here.

• More faithful signals. Real-time signals now queue in order and respect the
  per-user limit on pending signals; a signal that interrupts an open-ended wait
  no longer wrongly restarts it; a memory fault arrives as a normal, catchable
  signal rather than an unconditional kill; and a debugger can reliably inject
  signals into a program it controls. Software that depends on precise signal
  behavior — shells, job control, language runtimes — behaves the way its
  authors expect.

• Per-process CPU timers. Programs can arm timers that fire based on the
  processor time they actually consume, not just elapsed wall-clock time.

• Real memory locking. Locking memory now genuinely pins it in RAM and faults it
  in immediately, and a program can ask that everything it maps from then on
  stays locked too. If the system runs out of memory while servicing a fault, it
  now stops just the offending program with a clean termination instead of
  putting the whole machine at risk.

• Durable, precise file writes. Flushing a file writes its pending pages through
  to storage, and a range flush writes back exactly the bytes requested, so data
  lands when a program asks for it. Pipe buffer capacity can be queried and
  resized.

• Correct directory-relative open permissions. Opening a file by a path relative
  to an open directory now runs the same permission check as opening it by full
  path, closing a gap where the relative form could skip the check.

• Truer introspection. Resource-usage accounting reports real minor and major
  page-fault counts; the per-process status view reports the real open-file
  ceiling; a per-process login identity is tracked and inherited across programs.
  The processor listing shows one entry per online core, and the load average
  excludes idle sleepers, so standard monitoring tools read the values they
  expect.

• Networking refinements. Non-blocking is honored per individual send and
  receive rather than only as a socket-wide mode, local socket pairs preserve
  message boundaries for datagram and packet types, and loopback delivery was
  corrected.

• Better device and process fidelity. Terminal window size can be set and read
  back so full-screen terminal programs lay themselves out correctly; the disk
  now appears in the system's device tree so enumeration tools find it; creating
  a device node routes it to the right driver; and a child carries its parent's
  resource limits across a fork or clone.

See README.md for what runs today, and docs/ for the architecture, the
verification recipe, and the clean-room policy.