Hew on SlOS

Host-compiled Hew programs run as native x86-64 and AArch64 ELF64 applications in SlOS. The local runtime supports owned values, cooperative actors and tasks, timers, files, streams, and TCP. Installed tools and durable services exercise those facilities in real QEMU guests. This is Slepp's local port, not an official Hew target or upstream release.

Hew, LLVM, and the SlOS SDK

Hew defines the language: values, ownership, actor messages, and suspended work. The consumer's freestanding runtime implements selected language ABI operations. LLVM emits native x86-64 or AArch64 objects. SlOS supplies generic operating-system facilities through its LP64 SDK; the kernel does not depend on Hew.

HOST
  Hew source + matching standard library
    -> Hew compiler: types, ownership, actors, continuations
    -> existing LLVM x86-64 or AArch64 backend: native object
    -> linker: Hew runtime + generic SlOS SDK
    -> static ELF64 executable, LP64 ABI

GUEST / QEMU
  SlOS loads ELF into a private CPL3 / EL0 user process
    -> cooperative Hew actor/task worker
    -> generic SlOS files, streams, sockets, timers and allocation
    -> full-width int 0x80 / SVC -> preemptive SlOS kernel -> devices

The existing host compiler emits native objects; Make links them with the matching consumer runtime and SlOS SDK. No new LLVM backend or SlOS-specific LLVM pass is required. Neither LLVM nor the compiler runs inside the guest. The retired i386 SlOS linker driver is not the native build path.

All local Hew actors, tasks, and continuations share one cooperative process worker. SlOS independently preempts processes. A Hew actor is not a kernel actor, a kernel thread, or a distributed mesh endpoint.

Native build, compiler selection, and ABI reference

# In an existing SlOS checkout; uses the external Hew-on-SlOS consumer
make -j2 userland ARCH=x86_64 HEW=/path/to/hew
make -j1 userland-check ARCH=x86_64 HEW=/path/to/hew
make -j1 userland-dev ARCH=x86_64 HEW=/path/to/hew

# Select the other native kernel, SDK and consumer together:
make -j2 userland ARCH=aarch64 BOARD=qemu_virt HEW=/path/to/hew

Use an existing Hew compiler with its matching standard library and native freestanding runtime. Compiler/runtime ABI compatibility matters; a different installed compiler is not automatically a substitute. The local port is not an upstream Hew target, and older recordings retain their original compiler versions.

The SlOS wrapper builds the selected kernel and SDK, then invokes the external consumer. HEW_USERLAND_SRC selects its checkout, defaulting to $HOME/projects/hew-lang/hew-on-slos. The consumer links its libhew_rt.a and startup object with generic libslos.a, headers, linker script, and matching compiler support library. It does not rebuild or replace Hew. These commands assume existing private checkouts and prepared host tools.

The ABI is static ELF64, LP64, with architecture-matching objects and private user address spaces: CPL3 on x86-64, EL0 on AArch64. Syscalls use full-width int 0x80 arguments or AArch64 SVC. Use the matching native/cross GCC and binutils, LLD, Python, and QEMU alongside the existing Hew compiler and standard library. Native boot prerequisites apply; a 32-bit GCC runtime is not required.

Runtime coverage

Area	Observed behaviour
Modern values	Owned strings and bytes, collections, checked Results/Options, enum assertions, string building, ownership cleanup, integer/UTF-8 edge cases.
Actors and tasks	Owned messages and replies, serialized turns, scoped fork/join, deep ask chains, cancellation and consuming cleanup, cooperative fairness.
Failure and time	Checked failure containment; fresh constructors for one-for-one, one-for-all, and rest-for-one supervision; EXIT/DOWN notifications; timer ownership/cancellation; race losers and cleanup faults.
Operating-system I/O	File streaming, process launch/wait, typed pipes with backpressure, EOF and stream-select readiness, binary TCP and genuine write-half shutdown, timer progress during idle I/O.
Useful programs	Installed utility families, versioned report workspaces, guest-developed ledger and actor-queue examples, distributed rendering and a durable debugger.

These facilities are exercised by native user programs, installed services and actual pipe-backed stream_select. The platform guide describes their scope; recordings keep the boundaries of the sessions they show.

Individual actor and service check commands

# Real QEMU guest acceptance with disposable images
make -j2 actors-check actors-contract-check HEW=/path/to/hew SLOS=/path/to/slos
make -j2 actors-check-release HEW=/path/to/hew SLOS=/path/to/slos
make -j2 service-check service-check-release HEW=/path/to/hew SLOS=/path/to/slos

Edit and build Hew from SlOS

The application workbench supports real multi-file Hew projects. Edit in the guest, build with a trusted Linux worker and run the verified native ELF. Source diagnostics, retained feedback and selected/previous builds make compiler errors and rollback inspectable without discarding your edits.

The expense ledger keeps immutable entries outside its build directory. The persistent job queue adds boot-service operation, supervised workers and queued-work-preserving stopped updates. Saved-project rescue and fresh-session import provide a way back to checked saved work without trusting an interrupted original.

Distributed rendering and installed services

The mixed-architecture renderer runs a Hew coordinator and workers in separate SlOS guests. Its recorded sessions follow progressive images, worker loss and accepted-result recovery. An installed service profile starts guest userland at boot; configuration, stop/start and code rollback stay in Hew rather than host serial scripts.

The durable debugger connects result, assignment, process and configuration observations across volumes and boots. Remote evidence stays visibly distinct from checked local state, and cached offline observations do not become live status.

Guest command	Purpose
`exec service status`; `exec service logs`	Inspect the installed profile and bounded lifecycle output.
`exec service start`; `exec service stop`; `exec service restart`	Operate the managed application. Stop before changing its profile or selected project.
`exec service enable`; `exec service disable`	Persist whether the managed profile starts at boot.
`exec service configure queue NAME`	While stopped, select a guest-developed queue project at `/home/NAME`; its data stays under `/queues/NAME`.
`exec service rollback`	Verify and roll back the manager bundle, not a developer project's program or application data.

For a persistent coordinator, an existing SlOS checkout can provision a separate selected volume with make service-install DEV_DISK=my-coordinator.img SERVICE_ROLE=coordinator HEW=/path/to/hew DOOM=0. Subsequent make service-dev DEV_DISK=my-coordinator.img DOOM=0 boots that volume without host serial application startup. Use matching native compiler/runtime inputs, stop before installation, and keep a separate volume for each node.

Start and enable acknowledge requests, not application readiness. Check service status and actual application output; a reply timeout is an unknown outcome. Retries and logs are bounded, and damaged configuration blocks startup instead of reviving an older enabled profile. This remains a trusted-LAN service prototype.

Native shell and installed tools

Installed Hew tools run through ordinary shell command resolution. Up to four external pipeline stages execute concurrently, with binary-safe first-stage < file input and final >/>> output. Real Hew cat, wc, and tee pass duplex, append, and cold-reboot readback checks on both architectures.

Streams are bounded; the shell feeds input while draining output rather than capturing whole files. Builtin/external mixtures and builtin input redirection are rejected. This is a scoped native interface, not a POSIX shell contract.

A local Hew command toolbox

The installed suite now spans stream, text, filesystem, data, system, network and causal workflows. Command algorithms live in Hew; C bridges supply generic SDK operations rather than stand-in command implementations.

Family	Commands	Use
Streams	`cat wc head tail tee sysinfo`	Read and copy bounded streams, count input and inspect the system.
Text	`grep sort uniq cut tr paste nl split cmp diff`	Match, compare, transform and arrange byte-oriented text.
Filesystem	`ls stat cp mv rm mkdir touch find du df tree`	Inspect metadata, navigate real paths and manipulate files.
Data	`hexdump strings sha256sum cksum jq tar printf seq`	Inspect binary data, check hashes, filter bounded JSON and handle archives.
System	`basename dirname realpath xargs timeout time ps kill sleep uptime free uname date`	Compose commands, inspect processes and work with paths and time.
Network	`wget nc host httpd`	Transfer data through the native TCP/IP stack and IPv4 resolver.
Causal applications	`events cq note schedule`	Read bounded structured history, maintain notes and schedule relative or boot-tick work.

# With the local Hew tools installed
cat < /input.bin | cat | cat | tee /copy.bin > /second-copy.bin
sha256sum /copy.bin
jq -c '.category' /record.json
events --type user --limit 20
cq --id latest
note add inspect saved work
schedule -- set 100 events --limit 5

Use each installed program's --help for its actual options and bounds. Familiar names do not imply full GNU/POSIX parity, an unrestricted regex or JSON language, every archive format, or a multiuser permission model. Unsupported options report errors.

Filesystem commands use real guest path and symlink resolution; installed multicall aliases remain ordinary copied files. events reads a bounded hot snapshot and cq defaults to a bounded archive snapshot. An empty window is not proof that an event never happened. Their structured CLI is distinct from the kernel history commands, which remain accessible through kcmd.

Some system operations require explicitly delegated capability, including clock setting. Administrator privilege is not automatically inherited by installed applications. The installed-application manual explains command selection, and the report workspace shows application versions and data.

Prime-report service

The prime-report demonstration accepts jobs over HTTP, computes results in a supervised worker, and recovers pending work from disk on startup. A sibling timer progresses while the forked worker task is outstanding. The recording follows submission, failure, retry, and restart; its local command and operating bounds accompany the transcript.

Worker lifetime and memory

Released allocations are reused. Completed worker execution records can be reclaimed once notifications and exact-object operation pins are finished, while terminal identity and diagnostics remain observable. Stable-worker request memory is bounded in the measured workload; total memory still grows with actor incarnations, distinct stable-role keys, and retained diagnostics.

Request and restart measurements, accounting, and source logs

These measurements are the 25 October 2026 i386 baseline. They are retained for comparison, not presented as native LP64 allocation sizes.

A resident actor serves 4096 owned requests in eight batches. After every batch, measured live allocations return to 20 and live bytes to the same baseline: 2589 at O0 / 2261 at O2, including a run with the I/O adapter linked. The allocator reuses released storage; this is no longer the earlier process-lifetime bump-only adapter.

That baseline measures a stable worker and fixed identities. A newer 2049-restart stress check at O0/O2 also exercises actually-started cancelled owned turns, exactly-once resource cleanup, and fresh owned requests. Completed worker execution records are reclaimed after notification delivery and release of the last exact-object operation pin. Exactly two live actor records remain. After subtracting only historical metadata pages, the fixture retains 18 allocations / 34249 requested bytes at O0 and 18 / 34121 at O2 at each sample; these figures include its configured 4096-entry restart-intensity window.

Historical identity is retained separately, not discarded: on i386, terminal metadata uses 12 bytes per incarnation in 128-record pages with 8-byte headers, or 1544 × ceil(retired incarnations / 128) allocated bytes. The 2049-restart fixture ends with 26248 bytes in 17 history pages, plus separately retained owned diagnostic chains. Supervisor/control owners and interned role keys remain process-lived.

The cost is O(actor incarnations + distinct stable-role keys + retained diagnostic bytes). Retired workers no longer appear in live traversals, but their historical identities have no safe automatic expiry edge in the current ABI.

Additional lifetime revision 9eee426, with corrected fixture accounting documented in ea5da38, tested with compiler 95340fc71a and generic SDK 04fcefa. Real guest evidence: build/actors{,-o2}/resident-lifetime.vm.log; all 18 existing actor cases also pass in actors-suite.vm.log, with the strengthened retained-history/pinned-retirement C contract in build/current/actors.vm.log.

DNS and socket deadlines

Hew uses the existing SlOS TCP/IP stack and native IPv4 resolver. Socket read/write deadlines are opt-in; receive timeout faults the calling actor and should be isolated if the service must continue. A partial-send count means bytes accepted into OS buffers, not delivered or acknowledged. The network recording shows those failure paths and a successful slow-reader transfer.

Native DNS yields the OS task but occupies Hew's cooperative worker for up to three seconds. Timed wrappers cannot preempt that call, and the connect deadline starts after resolution. Existing jobs and HTTP examples have not enabled read/write deadlines.

Timeout API, resolver protocol limits, and network provenance

Connection.set_read_timeout / set_write_timeout are opt-in: positive durations round up to 10 ms, negative clears, and zero is invalid. Each deadline spans its whole operation, including partial transfers. Receive timeout/reset faults the calling actor; isolate it for containment. Send returns Closed or WriteTimedOut(n), where n counts bytes accepted into OS buffers, not delivered or acknowledged. Failed sends must retire the aborted connection.

Default connect is bounded to three seconds and graceful close to two seconds before abort/failure, but there is no default read/write deadline. The earlier jobs/HTTP examples do not automatically acquire these protections.

DNS returns the first usable IPv4 address, not all answers. One in-flight native UDP query has a three-second maximum; concurrent uncached requests fail busy. The eight-entry positive cache is capped at 300 seconds. There are no retries, negative cache, IPv6, DNSSEC, or TCP fallback. DNS occupies the cooperative Hew worker while yielding the OS task; timed wrappers cannot preempt it, and connect timing begins after resolution. Ordinary consuming address-vector iteration also passes genuine O0/O2 checks after the move-safe vector runtime addition 5e7c10c; it does not change the resolver's timing boundary.

Isolated network additions: OS/SDK e954004, consumer 70e08fb; later vector iteration 5e7c10c. The network transcript records session IDs, kernel hash, and original O0/O2 proof lines. Combined acceptance is recorded on the development page.

Runtime limits

The consumer implements selected modern Hew runtime ABI operations; it does not link the official Rust hew-runtime or establish full standard-library parity. Nested supervision and general restart/backoff policy combinations have bounded coverage. Recursively nested foundation destruction still has a C-stack bound. Rc/weak ownership, distributed Hew actors and explicit actor heap quotas are not admitted; unsupported heap-limited construction is refused.

The SDK is not full POSIX/libc. The HTTP examples are diagnostic subsets, not full std.net.http; their security and persistence bounds are documented with each demonstration. Checked language faults are containable, while hardware faults remain process-fatal.

Earlier value, file, overflow, and SDK examples

Hello: prints modern Hew on SlOS and computes sum of squares 1–100 as 338350.
Report: computes 168 primes below 1000 with sum 76127, uses checked file I/O, and verifies /prime-report.txt after a separate reboot.
ABI edges: UTF-8 scalar length, embedded NUL roundtrips, integer limits, invalid UTF-8, and file errors.
Checked overflow: reports language fault code 201 and a nonzero process exit without executing the next statement; the fault code is not the exit status.

The older hew_actor_hello.elf SDK/mailbox sample is written in C. The recorded “HEW SDK” chapter depicts that sample, not these compiled Hew actors. The prior videos, browser walkthroughs, and causal explorer notes are retained.