Follow-up session to the three-kernel marathon. Hold off on new features, verify what works, fix what doesn't. Shipped seven commits across JefeOS C++, JefeRust, and JefeOS2Go — four real bug fixes, two platform limitations diagnosed, and small parity additions to JefeRust.

JefeOS2Go Silent Boot Hang

The ARM64 microkernel would print "Registering QEMU virt drivers" and then go dark. VBAR_EL1 was still zero, so any exception spun into garbage. Root cause: GCC emitted 16-byte NEON loads (LDP Q0, Q1, [src]) for struct-copy of 32-byte HAL op-tables, but the op-tables in .data were only 8-byte aligned. With the MMU off during early boot, memory is treated as Device-like, which requires naturally-aligned access regardless of SCTLR_EL1.A. One unaligned vector load and the kernel was gone without a trace. Fixed with -mstrict-align in CMakeLists plus an explicit SCTLR clear in start.S. Kernel now boots cleanly through the full HAL, GIC, PMM, MMU, scheduler, VFS, and VirtIO probe chain to the idle loop.

JefeRust SSH Banner That Wasn't

SSH connections to JefeRust completed the TCP 3-way handshake, then died with "Connection timed out during banner exchange." My hypothesis was a SynReceived→Established transition failure. Wrong. The TCP stack was fine — the SSH handshake, auth, and channel open all completed. The bug was in handle_channel_close(): it treated SSH_MSG_CHANNEL_EOF (client closing stdin) identically to SSH_MSG_CHANNEL_CLOSE. Server sent CLOSE back and deactivated the channel before the queued command could write its output. Split the handlers; EOF now just logs and returns, channel stays live. ssh jefe@<ip> echo CONNECTED went from empty+timeout to working end-to-end.

JefeOS SSH Connection Exhaustion

SSH_MAX_CONNECTIONS = 4 was too low. Rapid SSH attempts filled the slots with failed handshakes that were never reclaimed. Bumped to 8 and added stale-handshake eviction: when find_free_connection() sees a full table, it evicts the oldest connection still in state < AUTHENTICATED. Added a connect_time tick stamp to the Connection struct to drive the eviction. Also fixed an unrelated issue where ps, dhcp, and lcompat worked over SSH but their output went to the framebuffer console instead of the SSH channel — those helpers were writing directly via fbconsole::puts instead of through shell::print() which respects the capture buffer.

The Timer That Wasn't Broken

JefeRust's uptime was reportedly stuck at 8 seconds. Turned out the timer was firing — just slowly. Precise measurement showed uptime advances at roughly 5% of wall-clock rate on Hyper-V Gen1. The hypervisor coalesces PIT timer interrupts when the guest is HLT'd to reduce host overhead, delivering one IRQ for every ˜20 expected intervals. Not a kernel bug. Documented the limitation in tick() with pointers to the proper fix: read the PIT counter directly on each IRQ, or switch to TSC/HPET/ACPI PM timer. Deferred.

JefeRust Parity: hexdump and netstat

Small parity work to close gaps with JefeOS C++. Added hexdump/xxd (classic 16-byte hex+ASCII layout, default 256 bytes, cap 4096) and netstat/ss (dumps the TCP connection table with state names). Added tcp::get_connections() and TcpConnectionInfo to snapshot both the active and listener maps. First attempt registered the commands only in the main execute_command dispatcher, which meant they worked on the framebuffer but showed "Unknown command" over SSH. Found a second dispatch table in execute_to_buffer (used by the SSH server) that's drifted out of sync with the main one. Added entries to both. Tech debt flagged — the two tables should be consolidated.

Agent Permission Tuning

Subagents were getting denied on cmd /c build.cmd, powershell.exe, and qemu-system-aarch64 — the session-level permissions.allow list was missing these patterns. Added them, then scoped back the powershell/cmd blanket allows to keep the dangerous Windows patterns blocked: Remove-Item, Format-Volume, Restart-Computer, Invoke-Expression, diskpart, del, format, etc. One agent still managed to run itself in circles for 90 minutes on the JefeOS ELF ring 3 output bug without reporting back — lesson learned, tighter time caps on debugging agents going forward.

What's Next

• JefeOS ELF ring 3 output — task creates but sys_write output never reaches console. Needs focused debug session with serial trace during ring 3 transition.
• JefeOS TLS scheduler starvation over SSH — architectural fix (async TLS state machine or per-command task isolation).
• JefeRust TSC/HPET time source to replace PIT on Hyper-V.
• Consolidate JefeRust's execute_command and execute_to_buffer dispatch tables.
• Continue JefeRust parity: SSH user management, permissions system, multiple GUI themes.