Project Lyra v1.3.0

Changes

Mods now call the platform through a published API instead of compiling its internals, so a Lyra update can no longer break a mod by moving something inside itself. This release also makes a bad mod survivable: the device recovers from one that wedges the shell, and a mod whose capability faults is caught, disabled and reported instead of taking the UI down with it.

• Mod SDK. Two files, lyra.h and lyra_client.c, give a mod 24 calls into the platform: shared state, status publishing, the picker channel and kernel access. A mod declares "requires": ["lyra.mod_runtime"] and is held back with a reason on a platform too old to serve it. Download lyra-sdk-1.3.0.zip; the README in it is the reference.
• Boot failsafe. A mod that wedges the shell no longer needs a reflash. Lyra counts boots that never reach the shell and demotes the mod set, first to platform components only and then to nothing, while Manage still lists every mod so the offender stays disableable.
• Fault recovery. A capability that faults is caught, the rest of that mod is dropped, and the other mods still apply. The mod is disabled and says so in Manage rather than looking like a switch someone flipped. A mod that fails partway through applying is rolled back instead of shipping half its changes.
• Settings. The Mods hub's settings button opens a real settings page, shaped like the device's own: System for platform behaviour, Mods for each mod's settings. Toggles written there now survive a reboot.
• Bounded logs. Every component logs through one shared logger that caps its own file, so a runaway log cannot fill flash.

Mods rebuilt on the SDK, available from the mod repo: Zune Cast 0.3.0, Screen share 0.2.0, Play Next 0.2.0.

Install with lyra-hd-deploykit.zip (zune-deploy) or lyra-hd.ccgame (XNA). See INSTALLING.md.