mgbrowser v0.9.32 Experimental Preview

mgbrowser v0.9.32 Experimental Preview

End-to-end live Google Search compatibility (https://www.google.com/ -> search
query -> SearchGuard knitsail challenge & SG_SS cookie -> HTTP 200 SERP
with inline data:image/ maps/thumbnails -> click first organic result ->
destination), strict <noscript> suppression whenever scripts_enabled == true,
sloppy direct-eval dynamic-binding slot isolation in boa_engine 0.22.0,
WebIDL prototype/brand/event/image/window surface completion, 256 KiB
data:image/ attribute materialization, styled Display::Inline descendant
geometry & 2,000,000-step worker compute_boxes layout parity, and the
explicit boa-interactive-page-v1 desktop script profile. Exact-source
publication and public-install receipts are recorded in the dated work log.

Linux x86_64 / X11 or XWayland, glibc 2.35 or newer. Rust 1.91.1, locked
dependencies, Apache-2.0 license, and pure-Rust implementation backends (zero
C/C++ bindings or new crates).

Root-Cause Fixes & Live Google Search Parity (v0.9.32)

• Never Activate <noscript> When scripts_enabled == true (crates/mg-chassis/src/lib.rs):
  • Removed the v0.9.31 fallback that projected <noscript> elements and
    followed <noscript><meta http-equiv="refresh"> to
    /httpservice/retry/enablejs ("Turn on JavaScript to keep searching") when
    initial scripts hit RealmState::Fatal. Per HTML §4.12.2, <noscript> is
    rendered strictly and exclusively when scripting is disabled
    (--disable-scripts / scripts_enabled == false).
• Sloppy Direct-eval Dynamic var Slot Isolation (vendor/boa_engine-0.22.0/):
  • Fixed an upstream boa_engine 0.22.0 bug where sloppy direct eval("var x = ...")
    inside a repeatedly invoked function mutated the shared CodeBlock
    compile-time Scope so subsequent calls created FunctionEnvironment slots
    treating earlier eval var declarations as undeleted static bindings and
    mis-evaluating typeof in GetNameOrUndefined — causing SearchGuard's
    knitsail VM to silently abort ~50% of cold sessions at ~143 admissions
    with HTTP 429 instead of completing ~222 admissions with HTTP 200.
• Complete WebIDL Prototype, Event, Image & Window Surface (crates/mg-sparkle/src/js_browser/boa/):
  • Installed branded Window, Navigator (PluginArray, MimeTypeArray),
    HTMLIFrameElement (contentWindow, contentDocument), HTMLMediaElement /
    HTMLVideoElement / HTMLAudioElement, HTMLImageElement (naturalWidth,
    naturalHeight, complete, currentSrc, decode, legacy layout
    reflections), Element/Node namespace/attribute/visibility methods, 42
    audited Window properties/methods ([Global]/[Replaceable] descriptors,
    getSelection, requestIdleCallback), and full MouseEvent/UIEvent
    properties (screenX/screenY, x/y, offsetX/offsetY,
    layerX/layerY, movementX/movementY, view, which,
    getModifierState), while preventing modern handles (navigator, history,
    mevent:*, subdoc:*, abortsignal:*, xhr:*) from leaking through
    host.get.
• Inline data:image/ (<= 256 KiB) & Worker Layout Geometry (crates/mg-sparkle/):
  • Raised data:image/ src attribute and inline image materialization limits
    to 256 KiB (<= 8 large > 4 KiB inline images, <= 1 MiB aggregate) so
    Google SERP inline base64 maps and thumbnails (19 inline images up to
    77 KiB) render cleanly.
  • Updated geometry_style::node_rect, collect_live_stylesheets,
    ensure_layout_cached, and styled_layout::compute_boxes (2,000,000
    layout budget + descendant box unions for Display::Inline anchors) so
    getBoundingClientRect() and Playwright locator.click() hit-test organic
    SERP links accurately.
• Interactive Desktop Script Profile (boa-interactive-page-v1):
  • Interactive desktop browsing (mgbrowser default GUI launch or
    --interactive-script-profile) uses ResourceProfile::InteractivePageV1
    (32M opcodes, 16 MiB cumulative source, 64 MiB outstanding / 512 MiB
    cumulative worker allocations, 5 CPU s, 768 MiB RLIMIT_AS, 10 s
    active time) with identical seccomp, RLIMIT_NOFILE = 3, and
    RLIMIT_FSIZE = 0 confinement, while preserving boa-page-process-v1
    unchanged across all library defaults, worker selftests, WPT runners, and CI
    gates.
• Preserved WPT Coverage:
  • Static WPT reftest coverage (558 PASS / 391 FAIL / 62 UNSUPPORTED of
    1,011) and Window WPT coverage (16/16 files, 79/79 final subtests)
    remain intact with zero regressions, within the unchanged < 8 MiB release
    archive limit.

mgbrowser v0.9.31 Experimental Preview

mgbrowser v0.9.31 Experimental Preview

W3C Beacon (navigator.sendBeacon), WebIDL host method-override and expando
assignment semantics across navigator/console/history/DOM wrappers,
Navigation Timing (performance.timing & performance.navigation), ECMA-262
Annex B string/date compatibility (String.prototype.substr,
trimLeft/trimRight, Date.prototype.toGMTString), same-origin
iframe.contentWindow intrinsic constructors, and <noscript> fallback
projection when initial page scripts hit cooperative EngineLimit with zero
rendered items — resolving all JavaScript console errors and blank-screen traps
on Google Search (https://www.google.com/ -> /search?... ->
/httpservice/retry/enablejs with 0 diagnostics). Exact-source publication
and public-install receipts are recorded in the dated work log.

Linux x86_64 / X11 or XWayland, glibc 2.35 or newer. Rust 1.91.1, locked
dependencies, Apache-2.0 license, and pure-Rust implementation backends (zero
new crate dependencies).

Beacon API, WebIDL Method Overrides & Navigation Timing (v0.9.31)

• W3C navigator.sendBeacon(url, data?) (crates/mg-sparkle/src/js_browser/boa/web_apis.rs):
  • Brand-checks Navigator receivers (TypeError on unbound/alien this),
    resolves url against the document URL requiring http: or https:
    schemes (TypeError on invalid URLs or javascript:/data:/about:
    schemes), validates optional USVString, URLSearchParams, and
    BufferSource (ArrayBuffer, TypedArray, DataView) payloads, enforces
    the 64 KiB (65,536-byte) keepalive quota (false when exceeded, true
    within bounds), and exposes standard read-only Navigator properties
    (cookieEnabled, onLine, webdriver, pdfViewerEnabled, vendor,
    languages, maxTouchPoints, hardwareConcurrency).
• WebIDL Host Method Overrides & Expando Properties (crates/mg-sparkle/src/js_browser/boa.rs):
  • Distinguishes read-only IDL data attributes (such as navigator.userAgent,
    navigator.webdriver, document.nodeType, and event.type, which remain
    non-writable in sloppy and strict mode) from regular WebIDL operations and
    expandos across navigator, console, history, and DOM/event wrappers
    (preserving [LegacyUnforgeable] location restrictions and defineProperty
    wrapper invariants).
• Navigation Timing, Annex B & iframe.contentWindow Intrinsics (crates/mg-sparkle/src/js_browser/boa/):
  • Adds performance.timing (navigationStart, fetchStart, responseStart,
    domInteractive, domComplete, loadEventEnd, etc.) and
    performance.navigation (type, redirectCount, TYPE_* constants).
  • Registers ECMA-262 Annex B String.prototype.substr (UTF-16 code-unit
    slicing with negative start and Infinity/NaN handling),
    String.prototype.trimLeft / trimRight, and
    Date.prototype.toGMTString.
  • Populates same-origin iframe.contentWindow with standard realm
    constructors (Object, Array, String, Number, RegExp, Promise,
    Uint8Array, JSON, etc.) and platform globals (navigator,
    performance, screen).

Cooperative EngineLimit Empty-Projection <noscript> Fallback (v0.9.31)

• Blank-Screen Prevention on Challenge Pages (crates/mg-chassis/src/lib.rs):
  • When an initial page script realm hits cooperative RealmState::Fatal
    (OPCODE_LIMIT = 1_000_000) before revealing any body items
    (doc.items.is_empty()), mg-chassis checks whether the unscripted
    document provides <noscript> fallback items or a <meta http-equiv="refresh">
    target (refresh_count < 4) and adopts that fallback projection while
    preserving InitialScriptOutcome diagnostics, worker accounting, and
    ScriptWorkStatus::Blocked.
  • Note: Google's server-side SearchGuard (SG_SS / BotGuard) still redirects
    non-Chrome clients away from live SERP results; the full Google search
    destination goal remains incomplete and deferred as documented in
    AGENTS.md.

Preserved Resource & Isolation Profile

• All boa-page-process-v1 limits remain unchanged (OPCODE_LIMIT = 1_000_000,
  32 MiB outstanding / 64 MiB cumulative worker allocations, RLIMIT_NOFILE = 3,
  RLIMIT_FSIZE = 0, RLIMIT_CPU = 1, seccomp confinement, and < 8 MiB
  compressed release archive ceiling).
• Static WPT reftest coverage (558 PASS / 391 FAIL / 62 UNSUPPORTED of
  1,011) and Window WPT coverage (16/16 files, 79/79 final subtests)
  remain intact with zero regressions.

mgbrowser v0.9.30 Experimental Preview

mgbrowser v0.9.30 Experimental Preview

Responsive CSS Grid ([named-lines], fit-content(), repeat(auto-fill | auto-fit, ...)), generalized intrinsic box sizing (min-content, max-content,
fit-content), CSS box-shadow and text-shadow Gaussian blur rendering,
multi-stop (2..=16) linear/repeating-linear/radial/repeating-radial gradients,
CSS 2D transform (translate, scale, matrix), clip: rect(...) /
clip-path: inset(... round ...) and text-overflow: ellipsis, pure-Rust HTML5
<canvas> 2D immediate-mode rasterization and PNG export, browser-hosted ES
<script type="module"> execution, DOM Observers (MutationObserver,
ResizeObserver, IntersectionObserver) and CustomElementRegistry
(window.customElements), @font-face unicode-range subset filtering,
large-page (> 1 MiB) CDP utility-world automation (news.google.com), honest
Linux desktop User-Agent compatibility (www.npr.org), independent per-tab
page zoom (25%..=500%), persistent user-local localStorage, and tab session
snapshot & restore. Exact-source publication and public-install receipts are
recorded in the dated work log.

Linux x86_64 / X11 or XWayland, glibc 2.35 or newer. Rust 1.91.1, locked
dependencies, Apache-2.0 license, and pure-Rust implementation backends (zero
new crate dependencies).

CSS Visual Parity, Responsive Grid & Intrinsic Sizing (v0.9.30)

• Named Grid Lines, fit-content() & repeat(auto-fill | auto-fit) (crates/mg-sparkle/):
  • Parses explicit [line-name] line lists on grid-template-columns and
    grid-template-rows, synthesizes implicit <area>-start / <area>-end
    lines from grid-template-areas, resolves grid-column / grid-row named
    lines and span <name> placements, maps fit-content(<length-percentage>)
    tracks, and expands repeat(auto-fill | auto-fit, ...) track definitions
    against container dimensions while collapsing empty auto-fit tracks to
    0px (rendering MDN Web Docs --layout-no-sidebar-extended in full styled
    layout without readable-flow fallback).
• Generalized Intrinsic Sizing & HTML5 <canvas> Replaced Layout (crates/mg-sparkle/):
  • Supports min-content, max-content, and fit-content keywords across
    width, height, min-width, min-height, max-width, max-height, and
    flex-basis across block, inline, flex, and grid formatting contexts, plus
    HTML5 <canvas> 300x150 intrinsic fallback and HTML width/height
    attribute sizing.
• Shadows, Multi-Stop Gradients, 2D Transforms, Clipping & Ellipsis (crates/mg-sparkle/):
  • box-shadow (0..=8 reverse-painted layers) with analytical rounded-rect
    signed-distance Gaussian blur, outer border-box cutout masking, and inset
    padding-box clipping; text-shadow (0..=4 layers) with blurred glyph
    rasterization beneath text runs.
  • Multi-stop (2..=16) linear-gradient, repeating-linear-gradient,
    radial-gradient, and repeating-radial-gradient backgrounds with CSS
    Images 3 stop fixup and color-transition midpoints.
  • CSS 2D transform (translate, translateX, translateY, translate3d,
    scale, scaleX, scaleY, matrix) with transform-origin, stacking
    context creation, and position: fixed containing-block establishment.
  • Screen-reader clip: rect(...) and clip-path: inset(... round ...)
    zero-area visual hiding and rounded inset clipping, plus single-line
    text-overflow: ellipsis (U+2026) truncation.
• Measured WPT Coverage:
  • Static flexbox reftest lane advances from 541 to 558 PASS / 391 FAIL /
    62 UNSUPPORTED of 1,011 (+17 genuine new passes over v0.9.29, zero
    losses; expectations.json manually ratcheted to protect all 558 passes
    and 949 runnable cases).
  • Separate real-Browser Window lane retains 16 / 16 files and 79 / 79 final
    subtests (100%).

HTML5 <canvas> 2D, ES Modules, DOM Observers & Web Components (v0.9.30)

• Pure-Rust HTML5 <canvas> 2D Engine (crates/mg-sparkle/src/js_browser/boa/canvas.rs, crates/mg-chassis/):
  • Implements HTMLCanvasElement.getContext('2d') (<= 2048x2048, <= 1,048,576
    pixels, worker-memory-accounted premultiplied RGBA buffer): fillRect,
    strokeRect, clearRect, subpaths (beginPath, moveTo, lineTo,
    quadraticCurveTo, bezierCurveTo, arc, arcTo, ellipse, rect,
    roundRect), Path2D, nonzero/evenodd scanline fill & dashed/joined
    stroke, clip, affine DOMMatrix state stack, CanvasGradient &
    CanvasPattern, shadow blur, Porter-Duff globalCompositeOperation,
    zero-FD embedded bitmap fillText / strokeText / measureText,
    getImageData / putImageData / drawImage, pure-Rust LZ77+Huffman PNG
    encoding (toDataURL / toBlob), and live document.resources projection
    into Sparkle's styled layout painter.
• Browser-Hosted ES <script type="module">, Observers & Custom Elements (crates/mg-sparkle/src/js_browser/boa/, crates/mg-chassis/):
  • Preloads bounded inline and external <script type="module"> graphs (<= 16
    modules, <script type="importmap"> specifier resolution, live namespace
    bindings, import.meta.url, and parent-brokered same-origin dynamic
    import(), with nomodule suppression in browser sessions while keeping
    standalone BoaPageRealm::start / boa_worker assertions untouched).
  • Implements microtask-batched MutationObserver (childList, attributes,
    characterData, subtree), layout-synced ResizeObserver and
    IntersectionObserver, and CustomElementRegistry (customElements.define,
    get, whenDefined, upgrade, connectedCallback, disconnectedCallback,
    attributeChangedCallback), plus Element.animate / getAnimations and
    window.visualViewport.

Real-Site Compatibility, Large-Page CDP & Desktop Session UX (v0.9.30)

• @font-face unicode-range Filtering, Wikipedia Sprite/SVG/JS Compatibility & Large-Page CDP (crates/mg-sparkle/, crates/mg-chassis/):
  • Filters @font-face rules against document text codepoints before fetching
    font binaries so multi-subset stylesheets (such as MDN's Cyrillic/Greek/Latin
    font sheets) download matching subsets instead of exhausting MAX_FONTS on
    unused scripts.
  • Updates USER_AGENT to "Mozilla/5.0 (X11; Linux x86_64) mgbrowser/0.9.30",
    resolving CDN crawler-signature TLS tar-pitting on sites such as www.npr.org.
  • Adds window.Image (new Image(width?, height?)), raises the browser-session
    addEventListener cap to 2,048 memory-accounted listeners (while keeping
    the standalone BoaPageRealm::start contract cap at 32), supports bounded
    external/inline SVG <style> blocks and acyclic internal <use href="#id">
    sprite references, resolves intrinsic background-size: auto and
    background-position offsets with element-box clipping for CSS sprites,
    multiplies color alpha (color: transparent) during text painting,
    suppresses spurious gradient diagnostics for MediaWiki's transparent
    linear-gradient(transparent, transparent), url(...) fallback idiom, and
    replaces per-reply full-HTML string materialization with zero-allocation
    serialized-byte validation (www.wikipedia.org executes all page scripts
    and renders its SVG wordmark sprite with 0 JS/CSS/SVG errors or warnings).
  • Synthesizes a bounded (<= 128 KiB, <= 2,500 nodes) <script>-free DOM
    snapshot when opening an on-demand CDP automation session on oversize (> 1 MiB) HTML documents or after page-script budget exhaustion so Playwright
    page.title() and utility-world queries succeed well within the 2-second
    active wall budget on pages like en.wikipedia.org, news.google.com, and
    developer.mozilla.org.
• Per-Tab Page Zoom, Persistent localStorage & Session Restore (crates/mg-chassis/, src/):
  • Independent per-tab page content zoom (25%..=500%, Alt+= / Alt+- /
    Alt+0, Ctrl+MouseWheel, address-bar zoom badge, and Hamburger Menu zoom
    row) separate from whole-browser UI scale.
  • Atomic 0o600 (O_NOFOLLOW, flock, <= 512 KiB) user-local persistence
    for window.localStorage (local-storage.json, cleared on Ctrl+Shift+Delete)
    and open-tab session snapshots (session.json, restorable via Menu ->
    Restore session, chrome://newtab, or --restore-session).

Remaining Limitations

• Modern-web compatibility remains bounded: cross-origin dynamic import(),
  WebGL/WebGPU, HTML5 <video>/<audio> codecs, Service Workers, cross-origin
  CORS preflights, CSS 3D transforms/keyframe animations, and full Chromium
  multi-process site isolation are not implemented.
• Resource budgets (16 stylesheets, 32 requests, 2 MiB total resources,
  1 MiB page script source, 2048px / 1,048,576-pixel image/canvas cap) and
  the seccomp-confined script worker (RLIMIT_NOFILE = 3, RLIMIT_FSIZE = 0,
  not a whole-browser sandbox) remain unchanged. Do not use this preview for
  banking, sensitive authenticated browsing, or arbitrary hostile websites.

mgbrowser v0.9.29 Experimental Preview

mgbrowser v0.9.29 Experimental Preview

Pinned unmodified Playwright 1.58.2 browser automation parity (connectOverCDP
over HTTP and WebSocket plus chromium.launch over --remote-debugging-pipe),
pure-Rust HTTP gzip/deflate/br decompression, responsive <picture> /
srcset and data:image/* decoding, credential-free cross-origin HTTPS
stylesheets and bounded CSS @import, CSS grid-template-areas / grid-area
2-column desktop layout, inline position: relative containing-block fallback,
flex-item BFC float isolation, viewBox-only and large-viewBox inline <svg>
sizing with Stylo style="..." and xmlns:xlink support, legacy vendor-prefixed
-moz-border-radius aliasing and Chromium-aligned DevTools Console css-parse
filtering, and real-site Boa DOM/JS compatibility (ECMAScript Annex B HTML-like
comments, DOM wrapper expandos, reflected HTML attributes, document.currentScript,
document.write, and blank/srcdoc <iframe> contentDocument/contentWindow).
Exact-source publication and public-install receipts are recorded in the dated
work log.

Linux x86_64 / X11 or XWayland, glibc 2.35 or newer. Rust 1.91.1, locked
dependencies, Apache-2.0 license, and pure-Rust implementation backends (zero
new crate dependencies).

Pinned Playwright 1.58.2 Automation & CDP Parity (v0.9.29)

• CDP Target Auto-Attachment, Isolated Utility Worlds & Pipe Transport (src/cdp.rs, src/main.rs, crates/mg-sparkle/src/js_browser/):
  • Full Target.setAutoAttach (flatten: true, waitForDebuggerOnStart),
    Runtime.runIfWaitingForDebugger, Page.createIsolatedWorld / utility-world
    Runtime.evaluate & Runtime.callFunctionOn (awaitPromise, returnByValue,
    element argument & return marshaling, executionContextCreated/Destroyed/
    Cleared even when page scripts are disabled with --disable-scripts),
    Page lifecycle events (frameAttached, frameNavigated, domContentEventFired,
    loadEventFired, lifecycleEvent, javascriptDialogOpening), DOM / CSS
    inspection, Network request/response events (including stylesheet HTTP 404
    reporting), Input mouse/keyboard/insertText, Emulation.setDeviceMetricsOverride,
    Browser.setDownloadBehavior (DownloadProgress / downloadWillBegin), and
    Chromium FD 3/4 NUL-delimited --remote-debugging-pipe + --headless
    virtual framebuffer mode.
  • Passes the unchanged tools/playwright/acceptance.mjs probe (playwright-core
1.58.2, both HTTP and WebSocket chromium.connectOverCDP paths) and
    tools/playwright/launch.test.mjs (chromium.launch with locators,
    screenshots, and downloads) while rejecting unknown CDP methods explicitly.

Real-Site CSS, SVG, HTTP & DOM Compatibility (v0.9.29)

• HTTP Decompression, Cross-Origin HTTPS Stylesheets & Bounded @import (crates/mg-chassis/):
  • Pure-Rust Accept-Encoding: gzip, deflate, br response decoding (flate2 +
    brotli-decompressor) with strict decoded-byte caps preventing zip/brotli
    amplification; credential-free cross-origin HTTPS <link rel="stylesheet">
    and @import loading (depth <= 4, cycle-checked, line/column-preserving)
    within the unchanged 16-sheet, 32-request, 2 MiB resource budget.
  • Responsive <img srcset> / <picture><source> candidate selection and
    bounded data:image/{png,jpeg,gif,svg+xml} inline URI decoding.
• Slashdot, Lobsters, Wikipedia & Rust-Lang Visual Layout Parity (crates/mg-sparkle/):
  • Byte-length-preserving author CSS normalization for legacy -moz-border-radius
    (plus corner variants, -moz-box-sizing, -webkit-box-sizing, -moz-opacity,
    -moz-box-shadow) preserving 1-based line/column diagnostic locations, paired
    with Chromium-aligned DevTools Console filtering of declarative CSS Syntax §5
    css-parse ignored declarations.
  • Stylo style="..." computed cascade on <svg> and SVG descendants, xmlns:xlink
    / xmlns:svg / xml:space / xml:lang attributes, inert <defs> / <symbol>
    / <metadata>, proportional svg_target_size scaling for large-coordinate
    viewBox icons within MAX_SIDE = 2048 / MAX_PIXELS = 1,048,576, and
    containing-width sizing for viewBox-only inline <svg> elements lacking
    width/height attributes.
  • CSS Grid grid-template-areas explicit track sizing and grid-area named
    placement resolution (rendering Wikipedia's Vector 2022 2-column desktop
    layout at >= 1120px), CSS 2.1 §10.1 inline position: relative containing-block
    fragment union fallback, and isolated float state across Taffy flex/grid item
    measurement and BFC painting (fixing clear: both story lists inside flex
    containers on lobste.rs).
• Real-Site Boa JS & DOM Compatibility (crates/mg-sparkle/src/js_browser/boa/):
  • Byte-length-preserving ECMAScript Annex B.1.1 <!-- / --> comment
    normalization, DOM wrapper JS expando property storage with worker memory
    accounting and strict/sloppy read-only IDL semantics, reflected HTML element
    properties, <script>/<style> text serialization, document.currentScript,
    bounded document.write/writeln/open/close, and subdoc:-backed
    same-origin blank/srcdoc <iframe> contentDocument and contentWindow.
• Measured WPT Coverage:
  • Static flexbox reftest lane advances from 532 to 541 PASS / 408 FAIL /
    62 UNSUPPORTED of 1,011 (+9 new passes over v0.9.28 across SVG flex
    items, data:image/* flex-basis content sizing, and dynamic inline-size
    float/BFC measurement, zero losses; expectations.json ratcheted to protect
    all 541 passes).
  • Separate real-Browser Window lane retains 16 / 16 files and 79 / 79 final
    subtests (100%).

mgbrowser v0.9.28 Experimental Preview

mgbrowser v0.9.28 Experimental Preview

Interactive HTML forms and standalone controls, arbitrary element click/focus
activation, Stylo CSS3 DOM selectors (querySelector / querySelectorAll /
matches / closest), modern DOM mutation and Event APIs (DocumentFragment,
DOMParser, outerHTML, insertAdjacentHTML, { capture, once, passive, signal }, CustomEvent), Web Platform globals (URL, URLSearchParams,
TextEncoder/TextDecoder, atob/btoa, ChaCha20 CSPRNG
crypto.getRandomValues/randomUUID, performance.now, setInterval,
requestAnimationFrame, queueMicrotask, structuredClone, matchMedia),
live layout/style queries (getComputedStyle, getBoundingClientRect,
scrollTo), localStorage/sessionStorage, document.cookie (HttpOnly
isolated), history.pushState/replaceState/popstate, and parent-brokered
same-origin fetch() / XMLHttpRequest over the seccomp-confined VERSION = 9
page worker session. Exact-source publication and public-install receipts are
recorded in the dated work log.

Linux x86_64 / X11 or XWayland, glibc 2.35 or newer. Rust 1.91.1, locked
dependencies, Apache-2.0 license, and pure-Rust implementation backends (zero
new crate dependencies).

HTML Forms, Interactive Controls & Modern Web Platform APIs (v0.9.28)

• HTML Forms, Standalone Controls & Arbitrary Element Clicks (mg-sparkle, mg-chassis):
  • Projects standalone controls outside <form> alongside form-associated
    controls (checkbox, radio groups, <select>/<option>/<optgroup> with
    native dropdown popup overlay, <button type="button"|"reset"|"submit">,
    <textarea>, <label> for + descendant forwarding, <details>/<summary>,
    <dialog> show/showModal/close/returnValue, form.elements/submit/
    reset/requestSubmit, and <div onclick> arbitrary element activation).
• Modern DOM & CSS3 Selector APIs (crates/mg-sparkle/src/js_browser/boa/):
  • Stylo CSS3 querySelector, querySelectorAll, matches, closest,
    CSS.supports, and CSS.escape; DocumentFragment, DOMParser,
    <template>.content, cloneNode, insertBefore/replaceChild/remove/
    before/after/replaceWith/prepend/append/replaceChildren,
    outerHTML, and insertAdjacentHTML/Element/Text; { capture, once, passive, signal } listener options, AbortController/AbortSignal,
    Event/CustomEvent/MouseEvent/KeyboardEvent/FocusEvent/
    PopStateEvent/HashChangeEvent, dispatchEvent, click()/focus()/blur(),
    and document.activeElement.
• Web Globals, Live Layout/Style Queries, Storage, History & fetch/XHR:
  • URL, URLSearchParams, TextEncoder/TextDecoder, atob/btoa,
    parent-seeded ChaCha20 crypto.getRandomValues & crypto.randomUUID,
    performance.now/User Timing, setInterval, requestAnimationFrame,
    queueMicrotask, cyclic structuredClone, and Stylo window.matchMedia.
  • Live window.getComputedStyle, pixel-free compute_boxes-backed
    getBoundingClientRect / getClientRects / offset* / client* / scroll*,
    and scrollTo/scrollBy/scrollIntoView.
  • Per-origin localStorage and per-tab sessionStorage, HttpOnly-isolated
    document.cookie, same-document history.pushState/replaceState/back/
    forward/go (popstate + hashchange), and parent-brokered same-origin
    Headers/Request/Response/fetch() and XMLHttpRequest over the
    seccomp-confined VERSION = 9 worker protocol (zero worker network or
    filesystem syscalls).
• Measured WPT Coverage:
  • Static flexbox reftest lane advances to 532 PASS / 417 FAIL / 62
    UNSUPPORTED of 1,011 (+4 new scripted/form flexbox passes over v0.9.27,
    zero losses; expectations.json ratcheted to protect all 532 passes).
  • Separate real-Browser Window lane retains 16 / 16 files and 79 / 79 final
    subtests (100%).

mgbrowser v0.9.27 Experimental Preview

mgbrowser v0.9.27 Experimental Preview

CSS layout fidelity, anti-aliased border-radius rendering and rounded clipping,
full CSS 2.1 Appendix E stacking contexts and z-index paint order, position: absolute hypothetical static positioning across block/inline/flex/grid and
position: sticky clamping, direction: rtl, CSS Sizing 4 aspect-ratio,
linear calc(% + px) in flex/grid, CSS 2.1 float/clear and BFC float
avoidance, overflow: auto | scroll and table-cell clipping, general
::before/::after pseudo-elements, visibility: collapse, and CSSOM
container-query length units. Honest upstream WPT coverage advances from 339
to 528 PASS / 421 FAIL / 62 UNSUPPORTED of 1,011 (+189 net new passes,
zero losses) on the static reftest lane and from 15/16 (77/79) to 16/16
files and 79/79 final subtests (100%) on the Window parsing lane.
Exact-source publication and public-install receipts are recorded in the dated
work log.

Linux x86_64 / X11 or XWayland, glibc 2.35 or newer. Rust 1.91.1, locked
dependencies, Apache-2.0 license, and pure-Rust implementation backends (zero
new crate dependencies).

CSS Layout Fidelity & WPT Coverage (v0.9.27)

• Rounded Corners & Clipping (crates/mg-sparkle/src/paint.rs, styled_layout.rs):
  • Implements CSS Backgrounds 3 §4.5 elliptical corner resolution, overlap
    scale factor f, inner padding/content radii, 4×4 supersampled boundary
    anti-aliasing without outer background bleed, diagonal per-side corner
    borders, and stackable rounded CanvasClip masking across fills, text,
    gradients, images, and overflow != visible, while preserving an exact
    zero-overhead fast path when all outer radii are zero.
• Stacking Contexts & CSS 2.1 Appendix E Painting Order (crates/mg-sparkle/src/styled_layout/stacking.rs):
  • Establishes stacking contexts for opacity < 1.0, position: fixed | sticky,
    and numeric z-index on positioned boxes and flex/grid items, ordering own
    backgrounds/borders, negative z-index child contexts, in-flow blocks,
    floats, inline/atomic-inline and order-sorted flex/grid items, DOM-ordered
    z-index: auto positioned pseudo-contexts interleaved with z-index: 0
    contexts, and positive z-index child contexts with clip-safe paint and hit
    reordering.
• Positioned & Sticky Layout (crates/mg-sparkle/src/styled_layout/positioned.rs, formatting.rs):
  • Computes hypothetical static positions for position: absolute | fixed with
    auto insets across block, inline, flex, and grid formatting contexts (LTR
    and RTL), plus position: sticky clamping within scrollports and containing
    block content boxes.
• RTL, aspect-ratio, Flex/Grid calc(), Floats, Overflow, Pseudo-Elements & Collapse:
  • direction: rtl across block horizontal margins, bidi inline runs, table
    columns, and Taffy flex/grid axes; CSS Sizing 4 aspect-ratio transfer and
    automatic minimum sizing; linear calc(% + px) in flex/grid; CSS 2.1 §9.5
    float / clear and BFC float avoidance; overflow: auto | scroll and
    table-cell padding-box clipping; general ::before and ::after
    pseudo-element cascade and layout materialization; and visibility: collapse
    flex struts and table tracks.
• CSSOM Container-Query Units & Upstream WPT Scores (crates/mg-sparkle/src/style/declarations.rs):
  • Supports cqw, cqh, cqi, cqb, cqmin, and cqmax in CSSOM
    CSSStyleDeclaration parsing and serialization without C++ bindings,
    bringing the pinned WPT Window parsing lane to 16/16 passing files and
    79/79 passing final subtests, while lifting the pinned WPT static flexbox
    reftest lane to 528 PASS / 421 FAIL / 62 UNSUPPORTED of 1,011 (+189
    new passes, 0 regressions).

mgbrowser v0.9.26 Experimental Preview

mgbrowser v0.9.26 Experimental Preview

Desktop browser UX parity with Chromium: Omnibox search & live autocomplete
dropdown, chrome:// internal pages (newtab, history, bookmarks,
downloads, settings, version), Find in Page (Ctrl+F / F3 /
Shift+F3), persistent user-local Browsing History (Ctrl+H) & Clear Browsing
Data (Ctrl+Shift+Delete), pure-Rust File Downloads (Content-Disposition: attachment, <a download>, Save link as..., Ctrl+S Save Page, Ctrl+J),
toggleable Bookmarks Bar (Ctrl+Shift+B), Hard Reload (Ctrl+Shift+R), Stop
Loading (Escape / toolbar ×), Ctrl+U View Page Source, Ctrl+Shift+T
Reopen Closed Tab, Ctrl+N New Window, Ctrl+Shift+W Close Window,
Ctrl+1..9 tab switching, middle-click background link opening & tab closing,
tab-strip right-click context menu, mouse buttons 8/9 Back/Forward, and F11
EWMH fullscreen. Exact-source publication and public-install receipts are
recorded in the dated work log.

Linux x86_64 / X11 or XWayland, glibc 2.35 or newer. Rust 1.91.1, locked
dependencies and pure-Rust implementation backends (zero new crate dependencies).

Desktop Browser UX & Chrome Parity (v0.9.26)

• Omnibox Search, URL Normalization & Live Autocomplete (crates/mg-chassis/src/omnibox.rs):
  • Smart input classification distinguishes explicit http(s):// and
    chrome:// / about: schemes, localhost / IPv4 / dotted hostnames
    (defaulting bare domains to https:// and loopback to http://), and
    free-text search queries routed to the user's configured Search Engine
    (DuckDuckGo, Google, or Wikipedia, persisted in settings.json).
  • Live Omnibox autocomplete dropdown (Up / Down / Enter / pointer click,
    up to 6 suggestions) surfaces direct URL/Search actions, matching
    chrome:// internal pages, saved Bookmarks (★), and visited Browsing
    History (⏱).
• chrome:// Internal Pages:
  • Built-in styled HTML pages rendered natively through mg-sparkle with safe
    internal-only chrome:// link navigation: chrome://newtab (search hero,
    pinned bookmarks, recent history), chrome://history, chrome://bookmarks,
    chrome://downloads, chrome://settings, and chrome://version (plus
    about:blank).
• Find in Page (crates/mg-chassis/src/find.rs):
  • Ctrl+F opens the floating Find bar with live case-insensitive substring
    matching across positioned Frame::text_runs, live N/M match counter,
    translucent yellow (#ffe066) inactive and orange (#ff922b) active match
    highlights, automatic viewport scroll-into-view, F3 / Enter / ▼ next
    match, Shift+F3 / Shift+Enter / ▲ previous match, full clipboard
    support (Focus::FindInput), and Escape / × dismissal.
• Persistent Browsing History & Clear Browsing Data (crates/mg-chassis/src/history.rs, src/history.rs):
  • User-local $XDG_CONFIG_HOME/mgbrowser/history.json (O_NOFOLLOW, 0o600,
    advisory flock .history.lock, 2 MiB read cap, 512 deduplicated
    entries sorted newest-first with visit counts and timestamps).
  • Ctrl+H and Menu > History open the paginated History modal with click
    navigation and per-item Remove; Ctrl+Shift+Delete clears browsing
    history, session cookies, HTTP/render caches, and the download list.
• Pure-Rust File Downloads & Save Page (crates/mg-chassis/src/downloads.rs, src/downloads.rs):
  • RFC 6266 / RFC 8187 Content-Disposition: attachment and binary MIME
    detection (application/pdf, application/zip, application/gzip, etc.),
    <a download="..."> link activation, context-menu Save link as..., and
    Ctrl+S / context-menu Save page as... stream downloads without navigated
    page loss.
  • Safe host persistence into MGBROWSER_DOWNLOAD_DIR / XDG_DOWNLOAD_DIR /
    ~/Downloads using sanitized filenames, O_NOFOLLOW, create_new(true),
    0o600 mode, and automatic (1), (2) collision numbering (8 MiB per
    download cap), inspected via Ctrl+J / Menu > Downloads /
    chrome://downloads.
• Bookmarks Bar, Toolbar Reload/Stop & Page Source:
  • Toggleable Bookmarks Bar (Ctrl+Shift+B or Menu > Settings > Bar) renders
    one-click saved bookmark pills directly beneath the main toolbar.
  • Active page loads turn the toolbar reload button into Stop (×, or Escape
    to cancel in-flight navigation); Ctrl+Shift+R / Shift+F5 performs a
    cache-bypassing Hard Reload (Cache-Control: no-cache, Pragma: no-cache).
  • Ctrl+U and context-menu View page source open the raw HTML document in
    DevTools Sources.
• Tabs, Windows, Pointer & Fullscreen Shortcuts (src/desktop.rs, src/workspace.rs):
  • Ctrl+Shift+T reopens closed tabs from a 32-entry LIFO stack; Ctrl+N
    opens a new native browser window; Ctrl+Shift+W closes the current window;
    Ctrl+1..8 selects tabs 1–8 and Ctrl+9 jumps to the last tab.
  • Middle-clicking (Button 2) a page link opens it in a background tab
    without stealing focus; middle-clicking a tab in the tab strip closes it;
    right-clicking a tab opens a native Tab Context Menu (New tab,
    Duplicate tab, Reload, Close tab, Close other tabs,
    Reopen closed tab); X11 mouse buttons 8 and 9 navigate Back and
    Forward; F11 toggles EWMH _NET_WM_STATE_FULLSCREEN.

mgbrowser v0.9.25 Experimental Preview

mgbrowser v0.9.25 Experimental Preview

App-wide pure-Rust X11 clipboard (CLIPBOARD and PRIMARY), mouse drag/double-click
text selection, and Cut / Copy / Paste / Select All across the DevTools Console,
all six DevTools panels and search/style inputs, the Address bar, HTML <input>
form controls (with <input type="password"> plaintext protection), and read-only
web page content. Exact-source publication and public-install receipts are
recorded in the dated work log.

Linux x86_64 / X11 or XWayland, glibc 2.35 or newer. Rust 1.91.1, locked
dependencies and pure-Rust implementation backends (zero new crate dependencies).

Native X11 Clipboard & App-Wide Text Selection

mg-browser, mg-chassis, and mg-sparkle implement pure-Rust ICCCM X11
selection ownership and retrieval (x11rb) paired with interactive text
selection, editing, and context-menu clipboard actions across every browser
surface:

• Pure-Rust X11 CLIPBOARD & PRIMARY Host (src/platform/clipboard.rs):
  uses a dedicated unmapped 1x1 child window of the root screen (EventMask::PROPERTY_CHANGE)
  so selection ownership survives closing detached browser windows without any C
  toolkit or external helper utility (xclip/xsel). Serves TARGETS,
  TIMESTAMP, UTF8_STRING, text/plain;charset=utf-8, text/plain, TEXT,
  and STRING (SelectionRequest / SelectionClear), and retrieves inbound
  CLIPBOARD (Ctrl+V / Shift+Insert / context-menu Paste) and PRIMARY
  (middle-click Button 2) selections with UTF8_STRING -> STRING fallback,
  bounded INCR transfers (256 KiB), and 0 ms local short-circuit when
  mgbrowser owns the active selection.
• DevTools Console & Panels (crates/mg-chassis/src/devtools.rs):
  • Console Logs & Uncaught JS Errors: click or click-and-drag across Console
    rows (Ctrl+A selects all visible rows), then press Ctrl+C, click the
    subtoolbar Copy button, or right-click (Copy message, Copy all visible,
    Select all, Clear console) to copy full untruncated error messages, stack
    frames, and expanded object property trees. Console Command Line API
    copy(...) also syncs directly to the X11 system CLIPBOARD.
  • Console > REPL & DevTools Filter/Style Inputs: click/drag/double-click
    selection, Shift + arrow/word (Ctrl+Left/Right) range extension,
    Ctrl+A, Ctrl+X / Shift+Delete (Cut), Ctrl+C / Ctrl+Insert (Copy),
    Ctrl+V / Shift+Insert (Paste), middle-click PRIMARY paste, and
    right-click Cut / Copy / Paste / Select all.
  • Elements, Sources, Network, Performance, Application & About: Ctrl+C
    and right-click context menus copy outerHTML, unique CSS selectors, or
    computed style summaries in Elements; selected code lines or full source in
    Sources; request URL, full request/response details, or all captured URLs
    in Network; structured telemetry reports in Performance and Application;
    and build/revision identity on the About dialog.
• Address Bar (Focus::Address): click-to-select-all on initial focus from a
  page, second-click caret placement, click-and-drag substring selection (updating
  PRIMARY) with 2 px caret and highlight rendering, double-click select-all,
  word navigation, Ctrl+A / Ctrl+X / Ctrl+C / Ctrl+V, middle-click
  PRIMARY paste, and right-click Cut / Copy / Paste / Paste and go /
  Select all.
• HTML <input> Form Controls & Password Protection (Focus::Input):
  positioned caret + partial selection highlight rendering in mg-sparkle,
  click/drag/double-click word selection, Ctrl+A / Ctrl+X / Ctrl+C /
  Ctrl+V (updating edit_versions for isolated script-worker form snapshots),
  middle-click PRIMARY paste, and strict <input type="password"> protection
  that blocks Cut, Copy, and PRIMARY drag export of masked password
  characters while permitting Paste.
• Web Page Prose Selection (Focus::Page): Frame::text_runs records
  positioned glyph runs (MAX_TEXT_RUNS = 25,000) for click-and-drag text
  selection with translucent highlight rendering, double-click word selection,
  Ctrl+A select-all, Ctrl+C copy in reading order, PRIMARY export on drag
  or double-click, and right-click Copy (when a selection is active) plus
  Copy link address on links. Cut and Paste remain disabled on read-only page
  prose.

Validation status

Workspace debug and release unit/integration tests (including new app-wide
clipboard/selection unit tests and live two-client X11 CLIPBOARD/PRIMARY
roundtrip tests under Xvfb), component boundary and no-chrome embedding checks,
packaged native X11 smoke gates, all 8 frozen JSPLAN gates, and both complete
reviewed WPT lanes pass.

Install and known limitations

curl -fsSL https://mgbrowser.org/install.sh | bash

The installer follows the latest published release and verifies SHA-256 before
installing without sudo. Checksums are not independent signatures. Existing
processes must restart to use an installed update.

Modern-web compatibility is poor. The Google search to first result journey is
not working. Real Reddit loading and full interactive Google News features
remain unfinished goals. Ordinary Playwright is unsupported: autoattachment,
debugger waiting/resume, downloads, utility worlds, promise awaiting and stock
locator message-size policy remain open. Clipboard transfers support plain UTF-8
and Latin-1 text up to 256 KiB on X11/XWayland; rich HTML/image clipboard MIME
types, JavaScript navigator.clipboard / ClipboardEvent DOM APIs, <textarea>
or contenteditable editing, breakpoint stepping, heap snapshots, and persistent
Web Storage remain outside this bounded increment. This release does not complete
F-011/F-016/F-024/F-025/F-026/F-027 or formal MVP.

mgbrowser v0.9.24 Experimental Preview

mgbrowser v0.9.24 Experimental Preview

Full 6-panel Chromium-style DevTools workspace (Elements, Console, Sources,
Network, Performance, Application) with Right/Bottom docking, draggable
splitter resize, interactive Element Picker (↖ / Ctrl+Shift+C) with 4-layer
Stylo box-model overlays, live element.style DOM/CSS editing, isolated Boa
worker JS Console REPL + Command Line API, and 4-tab Network request inspection.
Exact-source publication and public-install receipts are recorded in the dated
work log.

Linux x86_64 / X11 or XWayland, glibc 2.35 or newer. Rust 1.91.1, locked
dependencies and pure-Rust implementation backends.

Six-Panel Chromium-Style DevTools Workspace

mg-chassis, mg-sparkle and mg-browser expand the built-in DevTools panel
(F12 / Ctrl+Shift+I / right-click Inspect) across six panels with
Right/Bottom docking (⬓ / ◨), a draggable 4 px splitter, and compact-overlay
fallback on narrow viewports:

• Interactive Element Picker (↖ / Ctrl+Shift+C) & 4-Layer Box Model
  Overlay: hovering the page highlights any DOM element with concentric Stylo
  Margin (orange), Border (yellow), Padding (green), and Content (blue) layers
  plus a floating tag#id.class W×H tooltip; clicking selects the element as
  $0 in Elements without activating page links or forms.
• Elements (Styles | Computed | Box Model): collapsible ▸/▾ DOM
  tree with == $0 badge, CSS selector & text search (Ctrl+F), H visibility
  toggle, Delete node removal, live editable element.style { ... } inline
  declarations with instant Stylo restyle/reflow and color swatches, real Stylo
  ComputedStyle properties, and a concentric 4-layer Box Model diagram.
• Console (Ctrl+Shift+J): 19-method WHATWG/Chromium console.* API
  (log, info, warn, error, debug, dir, dirxml, table, trace,
  assert, clear, count, countReset, group, groupCollapsed,
  groupEnd, time, timeLog, timeEnd) with %s/%d/%i/%f/%o/%O/%j/%c/%%
  formatting inside the isolated Boa worker without invoking user JS getters or
  Proxy traps; interactive > JS REPL with Command Line API ($_, $0..$4,
  $(), $$(), keys(), values(), dir(), dirxml(), table(), clear(),
  copy(), inspect()), on-demand isolated worker startup on static/oversize
  pages, inline ▶/▼ object & DOM property tree expansion, [Inspect]
  jump-to-Elements badges, Tab ghost autocomplete, 64-entry Up/Down
  history, Shift+Enter multiline input, -term negative text filtering,
  severity pills, and Preserve log.
• Sources: navigator for [HTML] document source, [CSS] inline and
  same-origin stylesheets, and [JS] inline and external scripts with
  line-numbered syntax-colored viewing and Ctrl+F line search.
• Network (Ctrl+Shift+E): All/Doc/CSS/JS/Font/Img filters,
  URL substring filter, Preserve log, Disable cache, Waterfall timeline with
  DOMContentLoaded (blue) and Load (red) vertical markers, and a 4-tab
  Request Inspector drawer (Headers | Response | Preview | Timing) that
  redacts sensitive cookie, set-cookie, and authorization header values.
• Performance (Ctrl+Shift+P): ● Reload & Profile, Load Phase Flame Bar,
  64-frame render-duration sparkline with 16.7 ms (60 FPS) budget line, Boa
  worker opcode/allocation metrics, and frame/style/shaping cache hit telemetry.
• Application: live session Cookies table (with redacted byte lengths and
  Clear Cookies), Security origin/TLS/worker-sandbox summary, and Resources
  inventory.

Validation status

Workspace debug and release unit/integration tests (including legacy-test-engine
and protocol v8 worker session selftests), component boundary and no-chrome
embedding checks, packaged native X11 inspector-smoke across light/dark and
100%/200% scale, all 13 native/CDP smoke helpers, all 8 frozen JSPLAN gates, and
both complete reviewed WPT lanes pass.

Install and known limitations

curl -fsSL https://mgbrowser.org/install.sh | bash

The installer follows the latest published release and verifies SHA-256 before
installing without sudo. Checksums are not independent signatures. Existing
processes must restart to use an installed update.

Modern-web compatibility is poor. The Google search to first result journey is
not working. Real Reddit loading and full interactive Google News features
remain unfinished goals. Ordinary Playwright is unsupported: autoattachment,
debugger waiting/resume, downloads, utility worlds, promise awaiting and stock
locator message-size policy remain open. JavaScript breakpoint stepping, heap
snapshots, flamechart CPU sampling, and persistent Web Storage (localStorage /
IndexedDB) remain outside this bounded DevTools increment.

Boa JavaScript is enabled by default (--disable-scripts opts out); documents
exceeding the 1 MiB source or 2 MiB wire admission cap skip page-load script
execution and spawn a bounded on-demand worker only when interactive Console
evaluation is explicitly requested. Full CSS/CSSOM, intrinsic sizing, baselines,
bidi and floats remain incomplete. This increment does not complete F-011/F-016/
F-024/F-025/F-026/F-027 or formal MVP.

Linux X11/XWayland is the supported GUI target. The restricted JavaScript worker
is not a sandbox for the browser as a whole. Do not use this preview for banking,
sensitive authenticated browsing or arbitrary hostile websites. Project code,
documentation and original artwork use Apache-2.0. Dependencies retain their
licenses in packaged THIRD_PARTY_LICENSES.txt. Old tags/assets stay immutable.

mgbrowser v0.9.23 Experimental Preview

mgbrowser v0.9.23 Experimental Preview

Google News default-mode browsing and pure-Rust WOFF1/WOFF2 @font-face web
fonts: clean oversize-document script skipping, working scroll and link
activation, styled Full coverage (/stories/...) layout, and WOFF1/WOFF2
SFNT reconstruction with synthetic bold/oblique styling for downloaded faces.
Exact-source publication and public-install receipts are recorded in the dated
work log.

Linux x86_64 / X11 or XWayland, glibc 2.35 or newer. Rust 1.91.1, locked
dependencies and pure-Rust implementation backends (brotli-decompressor = 5.0.3
with default-features = false, #![forbid(unsafe_code)]).

Clean Google News default-mode loading, scrolling, and link navigation

mg-chassis and mg-sparkle resolve default-mode (--enable-scripts) script
errors and link-activation blocking on news.google.com and extend styled
layout to Full coverage (/stories/...) destinations without widening any
worker, memory, or layout budget:

• Before preparing external scripts or spawning an isolated script worker,
  resources::script_document_admissible checks whether a page's raw HTML, URL,
  and encoded initial request fit within the existing 1 MiB source, 16 KiB URL,
  and 2 MiB JSON wire caps. Ordinary browsing documents above those caps (such
  as Google News's 1.86..4.40 MB /home, /topics/..., /stories/..., and
  /showcase SSR payloads) skip worker startup cleanly (JavaScript skipped),
  parse once with <noscript> preserved, emit zero SCRIPT_* or DevTools JS
  rejection errors, and leave script_blocked = false so scrolling and link
  clicks (Top stories ›, category tabs, Full coverage, Ctrl+click new tab,
  and Back/Forward) work normally.
• Admitted < 1 MiB scripted pages that actually start a script realm and fail
  or close still enforce closed_script_realm_never_falls_through_to_native_activation,
  and trusted WindowHarness runs retain full worker observation.
• Outer-box Length::Calc supports bounded min(...) and max(...)
  comparisons between a pixel bound and a linear <length-percentage> term
  (CalcOp::{Linear, MinPx, MaxPx}, keeping size_of::<Length>() == 16), and
  CSS grid placement preflight charges linear O(cells * count + count^2) work
  within MAX_GRID_WORK = 1_000_000, allowing 51-item 12-column Full coverage
  (/stories/...) pages and Material 3 max(48px, 100%) touch-target overlays
  to render in full centered styled layout without fallback.
• See the Google News contract.

Pure-Rust WOFF1 and WOFF2 @font-face web fonts

mg-sparkle and mg-chassis load and render same-origin .woff2 and .woff
@font-face stylesheets (such as M Plus 1M / mplus-1m on badge.nyx.ms and
sl.ush.fund) alongside .ttf and .otf:

• @font-face src: scanning inspects all url(...) candidates in declaration
  order and admits .woff2, .woff, .ttf, and .otf URLs and font/woff2 /
  font/woff MIME types within the unchanged same-origin resource ledger.
• mg-sparkle::woff reconstructs uncompressed OpenType/TrueType SFNT tables
  from wOFF (zlib via flate2 rust_backend) and wOF2 (RFC 7932 Brotli via
  brotli-decompressor = 5.0.3, default-features = false,
  #![forbid(unsafe_code)], including W3C WOFF2 transformed glyf/loca and
  hmtx reconstruction) within bounded 8 MiB scratch and 4 MiB SFNT caps.
• Downloaded @font-face families without separate bold/italic faces synthesize
  horizontal stem emboldening (font-weight >= 600) and subpixel-interpolated
  oblique shear (font-style: italic | oblique and HTML <i>/<em> UA rules)
  without altering system-font glyph metrics or WPT baselines.

Validation status

Workspace debug and release unit/integration tests (including legacy-test-engine),
component boundary and no-chrome embedding checks, Hacker News 1024/1280 PNG
byte-identity, and live default-flags mgbrowser Xvfb/CDP/X11 scrolling and
link navigation across Google News Homepage, Top stories ›, Full coverage,
and Back pass with zero script errors. All 8 frozen JSPLAN gates retain all 364
research outcomes. Both complete reviewed WPT lanes are refreshed for this
commit.

Install and known limitations

curl -fsSL https://mgbrowser.org/install.sh | bash

The installer follows the latest published release and verifies SHA-256 before
installing without sudo. Checksums are not independent signatures. Existing
processes must restart to use an installed update.

Modern-web compatibility is poor. The Google search to first result journey is
not working. Real Reddit loading and full interactive Google News features
remain unfinished goals. Ordinary Playwright is unsupported: autoattachment,
debugger waiting/resume, downloads, utility worlds, promise awaiting and stock
locator message-size policy remain open.

Boa JavaScript is enabled by default (--disable-scripts opts out); documents
exceeding the 1 MiB source or 2 MiB wire admission cap skip script execution and
render statically. The DOM, classic external scripts and browser event loop
remain incomplete. Modules, dynamic scripts, fetch/XHR and general asynchronous
resources are not supported. Full CSS/CSSOM, intrinsic sizing, baselines, bidi
and floats remain incomplete. Fonts/images/tabs/resources are bounded subsets;
cookies are memory-only. This increment does not complete F-011/F-016/F-024/
F-025/F-026/F-027 or formal MVP.

Linux X11/XWayland is the supported GUI target. The restricted JavaScript worker
is not a sandbox for the browser as a whole. Do not use this preview for banking,
sensitive authenticated browsing or arbitrary hostile websites. Existing
limits are not whole-browser quotas or GC/RSS measurements. No worker authority
or resource profile is widened for this increment; brotli-decompressor 5.0.3
(default-features = false) is reviewed in docs/DEPENDENCIES.md.

Project code, documentation and original artwork use Apache-2.0. Dependencies
retain their licenses in packaged THIRD_PARTY_LICENSES.txt. Old tags/assets stay
immutable.