The last JefeOS entry ended with a real Discord bot living on a from-scratch kernel. The eleven days since were the opposite of a demo: no new party trick, just a sustained reliability-and-security campaign across both kernels — 134 commits, dozens of dual-reviewed PRs, and a memory-management overhaul that took the C++ kernel from “runs real software until the RAM runs out” to “survives the RAM running out.” Zero reverts on the memory arc.

From Features to Foundations

Proving that unmodified Alpine software runs is one thing; keeping it up under load is another. A Node soak test quietly filled the ~495 MB dev VM and wedged the kernel — because the kernel had no idea how much memory any process was actually holding. That postmortem set the agenda for the whole stretch: before adding another feature, teach the kernel to account for, defend, and reclaim its own memory. Everything below flows from that decision.

A Memory Accountant and an OOM-Killer

The fix came in layers. First a per-process address-space cap that tracks how much each Linux task has committed and reclaims it cleanly on exit. Then a global memory accountant paired with a bounded, last-resort OOM-killer: when concurrent daemons genuinely exhaust physical RAM, the kernel now evicts the single largest offender and keeps going, instead of freezing the whole machine. A follow-up routed the remaining eager allocation paths — ELF loads, fork copies, demand-stack growth — through that same admission gate, so nothing slips past the accountant. The kernel went from “first to ask for a page that isn't there wins a hang” to a defined, survivable failure.

Lazy mmap and a VMA Tracker

The accountant treated a symptom; the root cause was that every anonymous mmap eagerly committed a real zeroed frame per page — even for pure address-space reservations that programs like V8 and glibc make constantly and never touch. Phase 1 made PROT_NONE reservations cost zero RAM, committing only on first real access, so the cap finally counts touched memory instead of reserved address space — which is exactly how Linux behaves. This session laid the foundation for the rest: a per-task VMA interval tracker that records every mapping and stays correct across mmap, munmap, mprotect, fork, and exec, verified on the live VM through a 186-case smoke run that includes the DOOM dynamic-linker workload. It ships advisory-only today; the demand-paging payoff that sits on top of it is the next step.

Hardening the Syscall Boundary

In parallel, we audited the native syscall surface for a class of faults where a misbehaving — or hostile — userspace program could hand the kernel a bad pointer and take it down. The fix was systematic: route every raw user-memory access on that surface through fault-survivable copy helpers, so a bad address returns a clean error code to the caller instead of crashing the kernel, with careful rollback so a failed call leaves no half-updated state behind. Partway through, an adversarial review pass surfaced a more serious class of issue than the one we set out to fix; it was closed the same session and re-verified. Each PR was probed on the live VM with a hostile-input test fixture before merge. Details stay internal; the outcome is that the boundary now fails safe.

The Long Tail: Crypto Hygiene and Fail-Closed Networking

Underneath the headline arcs ran a steady burndown, much of it on JefeRust. A sweep of use-after-free issues on the socket, pipe, and epoll teardown paths; consistent zeroization of key material and decrypted plaintext on every TLS and SSH close; SSH and SFTP clients that now fail closed on a host-key verification failure instead of connecting anyway; and a batch of Linux-ABI correctness fixes so blocking socket waits are signal-interruptible, connect no longer freezes an event loop, and sockets inherit correctly across fork. Two kernels moving in lockstep, each catching bugs the other's review then checked for.

How It Was Built

The process is the point. Every kernel change went through two independent reviewers — one for correctness, one for security — running on the strongest available model, merging only on a clean double approval, and verified on real Hyper-V hardware rather than a mock. That gate repeatedly earned its keep: it caught real defects before merge, escalated one low-severity cleanup into finding a genuinely serious issue, and once flagged a reported test-pass that didn't match the committed code. One thread per kernel, disjoint kernels in parallel, and a bug with a known cause is never a reason to stop.

What's Next

• VMA tracker Step 2: the page-fault demand-commit arm, so lazy anonymous memory pages in on first touch and the cap counts true resident size everywhere.
• Close the last mechanical syscall-boundary hardening sites, then hand the memory line back to forward workload-truth features.
• Keep the two kernels near parity — JefeRust's SMP catch-up resumes once the C++ side clears its next SMP phase.