Changelog — WolOS

0.12.0 (2026-11-03)

The same desktop, made solid, and then grown: a redesigned Settings and Control Center, shell plugins and themes you can make yourself, optional modules, and a friendlier installer with Secure Boot on the live USB stick. All four repositories are tagged together once every package is built on our own build farm and the ISO has passed its VM tests (ADR 0029).

Desktop & apps

WolKernel 1:1.0+7.3-5: a rebuild of the same fork tag wolkernel-1.0-7.3 (no new patches).
Control Center has a new tile grid: Battery, Screen Mirroring, Keyboard Brightness, Night Shift, Screenshot, Record, accessibility and Stay Awake, plus tiles from plugins. It gained a Sound page (outputs, inputs, mute) and a Display page (brightness, Night Shift, mirroring).
A theme picker (Ctrl+Super+T) shows every installed theme as a preview card. One theme now colours the whole desktop: window borders, the lock screen, the terminal and the prompt in every shell you use. "Theme from your wallpaper" makes one from your picture.
wol-hue makes a theme from a picture, with sliders, and imports Base16 and colors.toml palettes.
Clipboard history (Shift+Super+V) can search, pin and clear, and never keeps one-time codes.
Screenshots can go to the clipboard instead of a file (Ctrl+Shift+Super+3 or 4), and a pen lets you mark up a capture. When the clipboard copy fails, the saved file is still named.
Web apps: wol webapp add opens a site in its own window, with its own launcher and icon.
wol toggle switches Night Shift, Stay Awake and Silence; wol remind <minutes> <text> sets a reminder.
The mic-mute key works, and its on-screen sign shows the microphone, not the speaker level. The brightness keys work.
The Dock follows your layout settings as the menu bar does: its edge and the order of its items, plugin items included.
Shortcuts added by plugins survive a reload of the window manager.
Banners held during a full-screen game or video stay gone if you cleared them meanwhile, and desktop widgets pause per display, by that display's own full-screen state.
wol sessions save|restore|list: terminal windows reopen on their desktops, in their folders, after a restart. With the sessions module, a notification offers it once at login; an empty desktop never overwrites a saved set unless you ask.
Control Center no longer closes itself as it opens; Settings opened from a link goes to the right page in the running window.
The menu bar keeps the current app's name while a panel has the keyboard; Log Out and Shut Down do different things again.
Clicking a running app in the Dock brings its window back instead of starting a second copy.
Search no longer says "Search Search" and waits for you to stop typing before it searches.
The desktop reconnects to the window manager after it restarts, and no call to it can freeze the screen.
Spaces shortcuts moved to Ctrl+Alt (Ctrl+Alt+1..4 and Ctrl+Alt+arrows), so Ctrl+1..4 and Ctrl+arrows go back to your apps.
Esc and Super no longer start a helper program in every app you use, and Esc no longer starts two helpers at once.
Panels no longer close when you switch from one to another, and switching works every time.
Overview works the first time you open it, always shows four desktops and brings the window you click to the front.
Notification Center has a Clear button and keeps a limited number of notifications.
Banners wait while a game or video is full screen and show after you leave it.
Force Quit and Overview open over full-screen games, and Esc closes them.
Desktop widgets that take too long are stopped.
The login window lists only the accounts that can log in.
A new icon set: symbolic icons and app icons drawn on one grid, for light and dark.
Sound: automatic input level for the microphone really turns on, and microphone volume is set on the device itself.
In a virtual machine the pointer stays visible after the window manager reloads.

Settings

Settings is redesigned: new navigation, and a search that finds every pane and every row.
A new Sound pane: outputs with their codec, a 0 dB mark with Allow Louder, balance, inputs with a level meter, automatic level and noise removal, Bluetooth codec and switching, pro audio rate and buffer, and troubleshooting. Its messages stay until you have read them, and its switches flip back when a change fails.
A new Modules pane installs and removes the optional modules.
Startup Security (under Privacy & Security) shows how this computer starts and finishes a Secure Boot setup that is waiting.
Displays: refresh rate and arrangement can be changed; a mode is saved only after it was applied, and Night Shift is one switch for all displays.
Appearance has a Wallpaper row and a row for themes from plugins.
Desktop & Dock lost two controls that did nothing; in a narrow window you can bring the sidebar back.
Add User refuses names the system reserves.
When a save fails, the control goes back to what is saved: Appearance, Desktop & Dock and Keyboard Shortcuts no longer show a change that was not kept, and the automatic-update switches flip back when the change failed or could not be made.
Software Update and "Theme from your wallpaper" read and decode in the background, so the window no longer stalls while they work.
Search: Return opens the subpage that has the row, and every Displays row can be found.
Keyboard Shortcuts: Restore Defaults also hides the Reset button on every row.
Modules: a list that cannot be read says so instead of "No modules are available", and each module runs one job at a time.
Startup Security: Finish Setup runs once and the facts on the page are read again afterwards.
Appearance: the accent swatches follow light and dark.

Store & plugins

Shell plugins: a plugin can add menu bar and Dock items, desktop widgets, Control Center tiles, search results, shortcuts, themes and web-app launchers. Each runs in a sandbox with time and size limits, and a plugin that keeps failing is turned off.
A plugin's tiles, Dock items and shortcuts run commands only after you allow it to.
The Store has a Plugins page (from the signed plugin index) and a Kits page: one click for the media formats (MP3, AAC, H.264, HEVC, AC3 and fonts) or for the creative suite.
Plugin Maker: make a plugin or a theme and see it live. The editor shows problems as you type, a sandboxed preview runs it on the menu bar, Dock, desktop and Control Center, Theme Studio has colour sliders with live contrast checks, and Create Package and Share prepare it for the plugin index. Open it from Settings > Appearance or Store > Plugins.
wol plugin add installs a plugin from a folder or a .wolplug file. wol plugin check, new and pack no longer run a plugin's code with real permissions.
A plugin's web requests cannot be redirected to another host, its notifications are rate limited, and the org.wolos id is reserved.
Optional modules: AI, local AI, sessions, developer, creative, gaming and console. The installer installs the ones you tick while online, and first boot installs the rest in the background, the local AI graphics backend chosen for your machine, without asking for the password again.
A module that cannot install is given up after five tries instead of being retried at every start; removing a module also removes what it added.
The console module brings a themed prompt, pickers for files, commits and variables, faster folder jumping and listing, the same keys and colours in every shell, and system defaults for the terminal multiplexer and the tool version manager.
The AI module brings WolOS managed settings for Claude Code (wol mcp allowed, sudo and friends denied) and a WolOS skill for writing and checking plugins; they come with the module, not with every system.
Applying a theme keeps your own linked dotfiles.
The Store Plugins page can remove a plugin it installed.
Kits that are already installed show Added instead of Get.
Plugin Maker: Create Package asks you to save first instead of packing old files; Theme Studio never overwrites another theme with the same name; Create Plugin leaves no half-written folder after a write error; the preview's sandbox is cleaned up when the app closes; planned plugin kinds are not offered.

Installer & boot

The live USB stick boots with Secure Boot on: the first start asks once to enrol the WolOS key from the stick.
The installer explains every page in plain words: what will happen, what is kept, and what Secure Boot means. Secure Boot is a step you choose, with a picture of the one-time key screen.
New pages for the optional modules and for extras such as media formats and fonts (one click, off by default).
Offline, the summary says which media formats and modules are added later, at first start with a network, instead of promising exactly what will happen.
Modules and media formats queued while offline install as soon as the network comes up, on Wi-Fi too, instead of at a later restart.
The US International keyboard (and other layouts with a variant) no longer stops the install at 90%.
The installer finds a TPM the same way the encryption step does, so a machine with an old TPM is not offered TPM unlock that then fails.
The account password must be long enough before it becomes a disk password.
When an install fails you see what failed: every step writes to a log that is kept on the installed system. When the installer refuses to go on, the Failed page explains why and what to do.
Password files are removed when an install stops, and your recovery key is never written next to the plan the installer keeps in your account.
The live USB stick and disks in use are no longer offered as targets; other systems on a disk are named correctly.
Your keyboard layout is applied before you type the start-up (disk) password, so the password you type at start is the one you chose.
"Look Again" checks the disks once more after you plug one in or free space.
Next to Windows: the last page tells you how to choose Windows at start, the clock keeps local time as Windows does, other systems stay in the start menu, and you can install again over an earlier WolOS.
Next to a Windows that uses BitLocker, the installer warns you before Secure Boot changes that Windows will ask once for its BitLocker recovery key, and says how to avoid it.
A Windows that is hibernated or was shut down with Fast Startup is refused, so its files cannot be damaged; shut it down fully and try again.
When the recovery key cannot be read at the end of an encrypted install, a page says so and lets you try again before you restart.
The boot loader menu can no longer be edited at start.
On a computer that uses the WolOS key through the signed first-stage loader, the next start goes to that loader first, and the startup partition is found by its real number. When the boot loader update fails on a shared startup partition, the other system's loader is put back.
On a computer that trusts WolOS only through its firmware keys, Secure Boot switches itself to the stronger setup after the key has been enrolled.
A clock set in the future no longer stops update checks.

Security

Apps talking to the system service are identified the moment they connect, and both sides confirm each other with a handshake before any request, so a program can no longer borrow another program's permissions.
A permission to change packages is a permission to ask: every change made as root shows a sheet on your screen, and nothing happens until you confirm it. Installing a package file, rolling back the system and switching the update channel ask for the administrator password.
The most sensitive actions (accounts, remote login, firewall, permissions, boot environments) always ask for your password, even right after you typed it.
Helpers (wol mcp) are named on the sheet together with the program that started them, and an Always Allow holds only for that program. A helper that adds or removes a web app, turns on a module or saves or reopens a session asks every time, and a reminder or notification shows its full text before you allow it.
Every command the system runs as root starts with a clean environment, root logins too.
System services run in a sandbox by default and see only what they need.
Everything read from files, sockets and plugins has limits on size and depth, and the readers are fuzz-tested.
One account can no longer slow down another account's apps, use up the system's sockets for everyone, or stop the system service by naming a terminal.
The malware check keeps its memory, its lists and the signatures it loads in a folder only the system may write; the background check and the full-database download (run as their own unprivileged account) can no longer change them. The full database is built by the system only from downloads whose publisher's signature checks. After this update the check rebuilds its memory by looking at files again, and the list of files it stopped before the update is cleared once.
The malware check refuses a file it could not scan instead of letting it through. Large files are checked in pieces with a time limit, and files above 1 GiB are answered "not checked yet" until the background check is done. It reads each account's download folder safely and marks only folders inside that account's home.
The plugin index and the update feed are signed and carry a serial number, so an old copy cannot be replayed to hold back updates; downloads have size limits and replace the old copy only once verified.
A web app's icon is checked, so an approved web app cannot become another command.
A program running in your account can no longer answer the system's confirmation sheets for you.
--help on any wol command only shows help and never runs the command.
Apps you install after a system update has been prepared, but before you restart into it, are kept when the new system starts.
Packages waiting to be installed and pending confirmations have limits, so a program cannot fill memory with them.
Files are written whole or not at all.
The supply chain is pinned (build actions, container images, package sources) and audited on every change.
The Wonderland Doctrine, our code of conduct, was published.

Packaging & release

One build path (ADR 0029): code in wolos, recipes in wolos-pkgbuilds, the image in wolos-iso, the build tool and farm in wolos-build; every package is built in a clean chroot and the ISO only from the published repo.
The build forge: one build machine with shared package and compiler caches, a reused clean chroot and prefetched sources, so a rebuild builds only what changed; more build boxes can join it.
The package repo is ready for a CDN (ADR 0030) with the release host as fallback; the x86-64-v3 repos are reached through a redirect to a ranked mirror instead of a WolOS copy.
The release pins one Arch Linux snapshot date for the whole system.
Version numbers agree: the code is 0.12.0 everywhere, and a release whose version does not match its tag is refused.
A release is signed only after its ISO passed the VM test, and becomes the latest release only once every file is on it.
Every stable release publishes the signed update feed that WolOS reads to offer updates.
The live image is signed with the WolOS live-image key.
Licences: WolOS is GPL-2.0-or-later (libwol BSD-2-Clause); third-party notices ship with the packages that need them.

Developer

Coding standards, rule catalogues (docs/RULES.md, RULES-system.md, RULES-ui.md) and an independent audit after each change are part of how WolOS is built. Their checks may only get better, never worse: window manager calls, user-facing sentences, crash-on-error calls, slow work on the desktop's main thread, Esc handling, style classes, unsafe code, system files and UI rules.
wolvm drives the whole system in a VM step by step: boot the ISO, go through the installer, start the installed disk, open apps, take snapshots and collect the journal (docs/modules/vm-e2e.md).
The install tests fail when their checks fail, and they check Secure Boot, the first boot and dual boot for real.
Scripts that are run directly are checked to keep their executable bit.
Crystal code (the package tool, wol-hue, the libwol examples) has its own rule catalogue (docs/RULES-crystal.md): formatter and linter clean, raw memory and C bindings only in listed files, programs run without a shell, network clients with timeouts, input decoded into types, dependencies pinned by commit and counted (none today), and no shard fetched while a package builds. tools/crystal/lint.sh runs the tools.
Cryswol, the Crystal framework for WolOS apps (wolos-crystal/shards/cryswol/, BSD-2-Clause): every libwol call (windows and Kit parts, notifications, menus, clipboard, preferences, file panels, power, network, audio, Search, accounts, messages, devices, sharing, background services) as Crystal objects with exceptions and blocks, opt-in package calls (require "cryswol/pkg"), specs against a fake system service; libwol itself now ships as its own package, libwol (libwol.so.1, wol.h, version = ABI version). docs/modules/cryswol.md.
Wolkit, the WolOS UI kit, as a preview: libWolkit (crates/wolkit, wolkit.h and libwolkit.so.1, BSD-2-Clause) keeps a scene that apps change with patch streams and styles, lays out and draws it (real text, theme colours, CPU or Vulkan), and shows it in its own window, through the Kit or headless for tests; the wolkit Crystal shard puts a declarative DSL, signals and a test harness on top (docs/modules/libwolkit.md, docs/modules/wolkit.md). Apps keep the Kit path until the kit is declared stable.

Known limitations

The CDN is not switched on yet: its mirror lines stay commented out until it exists, so packages come from the release host.
The update feed does not expire yet (expires is 0): only its serial number keeps an old copy out, until a job re-signs the feed regularly.
Adding a plugin by its id from the plugin index works only in the Store; wol plugin add takes a folder or a .wolplug file.
wol jail run and a codecs module are planned for 0.13.
Plugin kinds for looks and window manager rules are planned; wol plugin check refuses them for now.

0.11.5

VirtualBox (VMSVGA): the desktop starts after install. GTK used GL on the vmwgfx render node, Hyprland rejected its buffers, the shell died and the start-up lock respawned behind a black screen; on vmwgfx WolOS now renders with cairo.
Install WolOS shows the mouse pointer (the installer hid it and never showed it again).
Disk unlock: when the TPM refuses (for example after Secure Boot was switched), your account password unlocks the disk before the recovery key, and the next start is automatic again (the TPM slot is sealed again). Changing the password in Settings keeps the disk password in step.
The lock screen comes back when it crashes, without giving up, and a crash never shows the compositor's stock page.
VMs draw the pointer themselves (no cursor plane on vmwgfx), with the WolOS cursor theme in every session.
The live ISO no longer prints "memdisk not found" at start.
Built the new way: one recipe repository (wolos-pkgbuilds), clean-chroot builds on the AWS build farm, signed from this repository, ISO tested in QEMU and VirtualBox.

0.11.4

Image build: the work directory is cleared without crossing into mounts a stopped build left behind (it could delete the build host's /dev).
Secure Boot for the live ISO, prepared: shim first, systemd-boot second and one signed UKI with Install and Try (image/sb-layout.sh, ADR 0025), off until the WolOS live image key exists. With Secure Boot on, the ISO still needs it turned off for now.
Analyze with ClamAV: the "not ready" window shows its information icon (it named one the WolOS theme does not ship).
Install and Try: the welcome card fits small and scaled screens (1024x600, 1366x768, a VM window): the installer, setup and login screens run at scale 1 like the desktop, and a screen smaller than the card scrolls instead of cutting off the buttons.
Boot splash: the WolOS mark from power-on, also on the live ISO (it showed the Arch Linux splash: the theme was set before plymouth was installed). Upgrades switch systems that kept the Arch splash.
Virtual machines: VirtualBox, VMware, SPICE and QEMU guest support, each started only under its own hypervisor. In VirtualBox the screen follows the window size (VBoxClient --vmsvga).

0.11.3

WolKernel 1:1.0+7.3-4: the series through 0034 (since moved to the fork, one commit per patch; list: linux-wolos/SERIES.md in wolos-pkgbuilds): futex spinning, prechecks and inline vectors for futex_waitv, pipe and semaphore wake paths, SLUB sheaf sizing, ntsync inline waits, large folios cleared on idle CPUs, and the syscall exit fixes. Each has a runtime off switch.
Arch Linux snapshot 2026-10-31.
linux-wolos-headers ships vmlinux without debug info (BTF kept), as Arch does: 390 MB less on disk, and the ISO stays one 2 GiB download.
Window title strip: follows light and dark. Kit windows show the title once, and strip plus toolbar take 64 px instead of 80.
The search window is wol-search and the app grid is Apps; a saved shortcut that named the old program needs setting again.
The image no longer adds files to Firefox's folder.
The kernel series and scx_wolos are in this repository, GPL-2.0-only.
Memory Saver switches flip back when they could not save. The installer's password fields show the Caps Lock note.
sudo works: sudo-rs ships no /etc/sudoers and no PAM service, so every sudo failed, for administrators too, and the live installer found no disk. WolOS now ships both.
The live desktop has Install WolOS first in the dock and in Search, and never locks itself.
Secure Boot (ADR 0025): every computer makes its own boot keys at install. In Setup Mode they join Microsoft's in the firmware; otherwise one key screen at first start; with neither, WolOS still starts and says so. Each slot boots one signed image holding kernel, initramfs and command line, with kernel lockdown and module signature checks on. The disk key follows signed kernels, so updates keep unlocking and a changed kernel, command line or initramfs does not. An older slot can't be started once it is retired.
A failed update now really rolls back: three failed starts fall back to the other slot. Before, the loader kept starting the failed slot.
The system file check runs on every start, in 0.4 s instead of 7 s. A sealed system gets its machine id at install, so D-Bus starts.
rEFInd and GRUB of another system can start WolOS (/usr/share/wolos/boot/41_wolos).
AUR laws (ADR 0022, archicture/modules/aurlaws.md): wopkg audit <pkg> reads a package's files and code as a graph and checks them against named laws, each with a severity. Every package gets one state: No Law Broken, Needs Review, Blocked or Not Checked. No state says a package is safe. On 40 fresh malicious fixtures, 30 were flagged; on 300 fresh popular packages, 59 were flagged, so expect to read findings on packages that are fine.
App Store: the AUR is never in browse or search. It has its own tab with the risk first, and opening that tab asks for an administrator's password, once each time the App Store runs. AUR installs stay in Terminal. Develop lists SDKs and toolchains.
App Store: tiles say where an app comes from. One app is one entry, joined by AppStream id, and its page lists every source and version, picks which one Get installs, and offers update, Keep This Version and Roll Back. Two sources with no shared id stay two entries.
Administrator passwords work on an installed system: wol-admind looked for its password helper in the wrong folder.
Installed systems: packages added live stay after a restart, NetworkManager runs, and updates can build the next slot. Flatpak ships and Flathub is added on first use. A package change no longer reports failure after it worked, and a refused system update no longer says everything is up to date.
wopkg: wopkg pin and unpin keep a package through updates; wopkg update <name> updates one app; search reads Arch's AppStream, and Flathub's public list when Flatpak has none.
One app cannot take the desktop with it (ADR 0027): each app has task and memory limits, the session keeps its memory and CPU share, and a fork storm is killed within seconds, on its own. A memory bomb used to stop new programs for 95 s; now they start in 3.5 ms.
Memory Saver (ADR 0026): a background app gives its memory back to zram 30 s after it stops being used, and takes it back as it runs. Sound, video, games and the apps you exclude are left alone. On by default, with its row in Settings.
Shader precompile (fossilize_replay) runs in the Background class, so a game keeps its frames during a replay. Steam's children malloc on transparent huge pages (wol games steam): shader compiles take 8% less time for 11% more memory.
Malware check (ADR 0024, archicture/modules/security.md): a layer of protection against known malware, on this computer only. Downloads, removable disks, AppImages, .wol, Windows programs and new programs are checked the first time they open; a clean file is never read again until it changes. Nothing appears when nothing is wrong. A stopped file gets one sentence, Move to Trash, and a deliberate Open Anyway in Settings > Privacy & Security. Signature updates are signed. wol security scan, and libxguard.so.1 or wol-xguard scan --json for installers. New malware can get past it.
Full malware signatures (ADR 0028), off by default: a switch in Settings > Privacy & Security fetches the ClamAV database straight to this computer and keeps it current, and new downloads, Windows programs and installs are then checked by ClamAV too. It runs in its own process, only when needed, and uses about 1 GB of memory while it does. wopkg now checks through wol-xguard scan.
Files: right-click a file and choose Analyze with ClamAV for a clear result: nothing found, the signature it matched, or a check that did not finish. With the signatures off it checks nothing and offers Settings.
Install WolOS is a real installer (ADR 0023): boot offers Install or Try, and Install stays light. Language and keyboard, time zone (searchable, guessed), then Erase Disk, Install Alongside with a size slider for Windows or Linux, or Manual (create, delete, resize, mount points, file system, keep an existing /home). Encryption with a password or the TPM, an account, and a summary of exactly what will change before anything is written. A plan names the partitions it may touch; if anything else moves, the install stops. The boot medium is refused. Manual layouts without btrfs keep one copy of WolOS and say so.
libwol 1.2: window menus and toolbars (keys come back to the app; a shortcut like cmd+s works in the window), and an app can replace or withdraw a notification it posted, which only the process that posted it can do.
libwol 1.3: clipboard text (wol_clipboard_copy_text, wol_clipboard_set_text), behind two new permissions in Privacy & Security. wold checks the app, then asks the desktop of its account.
libwol 1.4: an app keeps its own preferences (wol_prefs_), held by wold per account and executable so no app can reach another's, and service answers arrive as one read-only tree (wol_info_).
libwol 1.5: file panels (wol_panel_open, wol_panel_save). The person picks, and the app gets that one file already open, never a path.
libwol 1.6: battery and Low Power Mode facts (wol_power_copy_info), and wol_power_keep_awake, which lasts as long as the app does.
libwol 1.7: whether the computer is online and over what (wol_network_copy_info), never an address or a network name.
libwol 1.8: read the volume and what is playing (wol_audio_copy_info) and change the volume or mute (wol_audio_set_volume, wol_audio_set_muted), behind separate permissions.
libwol 1.9: apps search apps and Settings pages, and with permission add rows to Search, which sees each row's app from the kernel.
libwol 1.10: apps read the name of the account running them, and only that one.
libwol 1.11: apps of one account send each other messages through wold, with a grant per peer app; the receiver sees the sender as the kernel does.
libwol 1.12: apps list devices and, with a grant per device, get a USB device opened by wold; keyboards, disks and hubs are never handed out.
libwol 1.13: apps offer text; the person sees it and chooses to copy it, save it or cancel.
libwol 1.14: apps run parts of themselves as services under wold, as the account and only as their own executable.
Search finds files and folders by name under your home folder (hidden folders and build output left out; the list is refreshed at login, hourly and when Search opens), finds every Settings page by its name or words ("dark", "menu bar"; "Menu Bar & Dock" and "Hardware" opened Appearance), and with nothing found says "No results for “…”" and offers Search the web.

0.11.2

Helium is the default browser (Chromium based; package helium-browser from the official release, signature checked at build): Dock, Search web search, default apps for web links and pages, privacy defaults (no usage reports, surveys or sign-in prompts), video decode on the GPU. Firefox stays in the App Store.
WolKernel 1:1.0+7.3-2: services with a syscall filter no longer log an audit warning on every boot when audit is on. WolOS boots with audit=0 (it ships no audit tools or audit-based security module).
libwol, the app API (ADR 0020, archicture/modules/abi.md): wol.h and libwol.so.1 for apps in any language, with a stable C ABI (versioned symbols; a test fails on any removed or changed symbol or declaration). First calls: version, errors, strings, an event loop any language can drive (fd + dispatch) with subscriptions to system events, system facts (OS, kernel, appearance, accent), posting notifications, and window content built from stacks, labels and buttons with click callbacks. The desktop draws app windows with Kit parts and shows app notifications as banners, with their buttons. Apps ask WolOS for services; WolOS checks the app's permission, and Settings > Privacy & Security lists and switches Notifications like the other permissions. No telemetry: libwol talks only to WolOS itself.
libwol 1.1: rows, lists, spacers, text fields, toggles, sliders and images; changing a part's text or value redraws its window; apps hear when the person edits, toggles, slides or closes; notifications with up to three buttons, and a pressed button reaches only the app that posted it. Apps built for 1.0 keep working unchanged.
Lua desktop widgets (runtime): one .lua file (layout, data, refresh, click handlers) becomes a Kit view tree, reloaded when the file changes; an example Clock ships with it. Scripts run sandboxed (no files, programs or network) and reach only the services they declare. The desktop runs them from ~/.config/wolos/widgets/ (wol widgets add lua:clock), on the same calm timer as the other widgets.
Package mirrors (ADR 0019): [wolos], then [wolos-cachy] (x86-64-v3 builds of the same Arch versions, frozen at each release, on only on CPUs that run them), then Arch at the release date. wol mirror status|rank|gate|kernel; wol update moves all three repos together.
One picture from power-on to the desktop (ADR 0012): the WolOS mark replaces the loader's kernel splash, boot text never reaches a video console (rc.d wolos_quiet; serial consoles stay readable), every compositor starts black and every first window fades in from black and out to it. One account: its session starts directly behind the lock screen (no login window hop). The Hyprland fork hides the desktop under a lock taken over at boot or after a crash; wol-lock respawns a crashed lock screen and never unlocks on its own; Ctrl+Alt+Fn cannot show a console. The start-up lock opens the login keyring. grep wolos-boot /var/log/messages lists each boot stage with its time. If passwords can't be checked, the lock screen says so and offers Restart.
Setup Assistant, redone (ADR 0013): the Welcome art, then four questions on one card each: Language & Region (language and keyboard on one page, guessed from the time zone and console keymap; the keyboard applies at once, so the password is typed on it), Wi-Fi (scanned by wol-login, skipped on a wired machine, a wrong password says so), Create Your Account (full name fills the account name; colour for the avatar; administrator with zsh and sudo), Appearance (Light, Dark or Auto, and three looks), then You're All Set and Get Started fades into the desktop. Return continues, Escape goes back; every problem is one sentence on the page that has it.
Install WolOS is an app (ADR 0013): pick the disk by name and size, a clear erase warning, Erase and Install, progress with the Pocket Watch, the step it is on and the time left (the screen stays on and closing the lid does not sleep the machine meanwhile), then Restart into Setup. It runs the boot menu's installer without a terminal or a password (the live user may run libexec/wolos/install-run with sudo): GPT with EFI and BIOS boot, ZFS with boot environments (FreeBSD era; since the Arch base, ADR 0016, the install is btrfs with A/B boot slots, ADR 0018 and 0025), the system, the boot loader, the apps. Each step reports wolos-install: <stage> <percent> <message>; a stop says where it stopped, cleans up and offers Try Again.
Error copy in one place (shell::copy, archicture/modules/ux-journeys.md): every failure sentence says what happened and what to do; tests/copy_lint.rs bans raw error text (errno, exit codes, paths, program names, "failed") and {e} outside logs. Fixed: Software Update said "Make sure pkg is installed"; App Store said "X was not installed. The change did not work"; auth messages without a full stop.
Wi-Fi join (FreeBSD) waits up to 20 s for the network instead of reporting success after wpa_cli reconfigure: a refused password is WrongPassword ("“Home” didn't accept that password. Check it and try again."), not a false "Connected" or the administrator sheet; a password of the wrong length says "8 to 63 characters".
App menu: Force Quit <App> ends every window of a frozen app (Hyprland killwindow; wol-app force-quit).
Dock apps are real: Files (Nautilus), Mail (Geary), Music (Amberol), Photos (Shotwell), Calendar, Notes (Gnote), keeping WolOS names and icons; Trash opens in Files. Running dots and the menu bar name follow each app's window class; Apps lists each pinned app once. Also shipped: Calculator, Clocks, Papers (PDF), Celluloid + mpv, File Roller, Disk Usage, default file-type apps (mimeapps.list, Firefox for the web). 71 packages, 689 MiB installed (archicture/modules/userland.md); Weather is the desktop widget, not an app.
Administrators can use sudo (/usr/local/etc/sudoers.d/wolos). Accounts made in Settings get the same groups as the Setup Assistant's (administrators: wheel, video, operator; standard accounts: video).
Themes: 13 new (Matte Black, Jade Horse, Ristretto, Flexoki Light, Ethereal, Hackerman, Vantablack, White, Miasma, Lumon, Lupine, Retro 82, Solitude). Every theme passes a stricter contrast check: text >= 4.5:1 on windows, cards and sidebars, secondary text >= 3:1. Accent and status text in apps is darkened or lightened until readable.
One look across apps, switched live: Helium (GTK mode, light/dark and accent from the system), Firefox (toolbar, tabs, address bar, menus, new tab; window buttons on the left), GTK 3 apps (colours are now a GTK theme, so open windows restyle on a switch), Text Editor and other GtkSourceView apps (generated light/dark schemes), zsh prompt colours. GTK 3 CSS no longer uses GTK 4-only properties (Firefox logged a parse error).
zsh for every new account (Setup Assistant, Settings > Accounts, live user; root keeps /bin/sh for recovery): system zshrc with autosuggestions, syntax highlighting, extra completions, shared history, case-insensitive menu completion, Home/End/Delete/Ctrl-arrow keys, colour ls, and a pure-zsh prompt (ready in ~30 ms with all plugins, no zsh setup wizard; theme colours from ~/.config/wolos/toolkits/zsh/colors.zsh). Your ~/.zshrc is never touched.
First session creates Desktop, Documents, Downloads, Music, Pictures, Videos; the login keyring unlocks with the login password, so Mail and Calendar do not ask.
Printing (CUPS + driverless network printers via Avahi) and USB sticks (FAT, exFAT, NTFS) under /media, writable by WolOS accounts.
wol-admind starts at boot (wold job org.wol.admin): on the image it was never started, so every administrator action (Settings, Control Center, wol hw fix, updates) failed.
App Store is in the image: wol-store installed, a Dock tile before System Settings, "App Store…" in the WolOS menu, and .wol files open in it.
Control Center: Screenshot and Record tiles open the capture toolbar (they ran wol capture, which does not exist; Record opens it in record mode, wol shell show screen-record). New detail pages: Bluetooth devices (power, connect/disconnect paired devices), Sound output picker, Focus (Do Not Disturb, for 1 hour, until tomorrow morning; banners stay quiet, the menu bar shows the moon). Now Playing shows cover art, previous/next and progress (playerctl). Battery module with time remaining and Low Power Mode (power-profiles-daemon; FreeBSD: powerd flags through wol-admind power-mode). Keyboard Brightness and Accessibility shortcuts (Reduce Motion, Increase Contrast, Zoom) as optional modules; Settings picks modules (control_center in shell.json). Night Shift shows only while hyprsunset runs. FreeBSD menu bar: battery from hw.acpi.battery, wired/Wi-Fi state from the default route.
Hardware (archicture/modules/hardware.md): one catalogue picks driver, firmware, packages and loader lines per device (CPU, GPU, Wi-Fi, Ethernet, Bluetooth, audio, webcam, I2C touchpads, card readers, backlight). wol hw lists devices and their state (ready, needs driver, needs firmware, unsupported) with a one-line hint; wol hw status shows problems only; wol hw fix loads missing modules through wol-admind (hw-load, catalogue modules only) and installs missing packages with --yes. New rc.d wolos_hw (before netif) runs wol hw boot every boot: loads the modules, writes next-boot loader lines (early CPU microcode, RTL8125/8126 driver, NVIDIA modeset) and publishes /var/run/wolos-hw.json; wolos_wifi and wolos_gpu no longer pick drivers, and machines without Wi-Fi skip the 10 s wait.
Offline repo adds CPU microcode (Intel 31.5 MB, AMD 0.6 MB), Bluetooth firmware (Intel, Realtek, Broadcom), RTL8125/8126 Ethernet, USB cameras (webcamd, started on plug-in, /dev/video* for group video) and PipeWire on sound(4); all GPU firmware comes with drm-kmod. NVIDIA is detected and installed online (~520 MB).
powerd runs only where cpufreq can steer the CPU (not with Intel HWP or in a VM, where it failed at boot); wol hw boot alone decides (rc.conf no longer enables it). wol sys hw gives the hardware list as a System API topic. ntpd refreshes the leap-second file and re-resolves its pool once DHCP has a lease. Desktop tunables, each commented: scheduler preemption threshold 224, user mounts, no keyboard debug keys, cuse at boot.
Low Power Mode works on Speed Shift CPUs (powerd off there): wol-admind power-mode sets the energy preference on every CPU (dev.hwpstate_intel.N.epp, kept in /etc/sysctl.conf.local) and the powerd flags only where powerd runs; the switch reads the preference first and hides when there is nothing to steer.
wol-admind verbs for System Settings: ntp, hostname, remote-login (sshd), firewall (pf with /usr/local/share/wolos/pf.conf: block in, pass out; ping, DHCP, IPv6 neighbours, mDNS), lid, printer-add|remove|default, consent (compositor grants), bt-pair|forget, wifi-forget. Services start or stop only when not already so; Controls::admin_request sends any of them.
Desktop widgets (ADR 0010, archicture/modules/widgets.md): Clock, Calendar, Weather (Open-Meteo, a city you pick by name), Music (Now Playing), Batteries and System, each in small, medium and large, on a grid above the wallpaper. Right-click the desktop for Edit Widgets: a gallery with real-size previews and Add Widget, drag to move, minus to remove; right-click a card for its size and options. Build your own from a folder with a widget.json layout of the same Kit parts and a script that prints data: wol widgets validate names each problem and every empty binding; a broken widget shows one sentence and Show Details, never a blank card. wol widgets list|add|remove|reload. One timer wakes every widget together, music and batteries follow D-Bus events, and nothing runs while a window is fullscreen.
Helpers ask before they change anything (archicture/modules/automation.md): when wol mcp clients or WOL_HELPER scripts change a setting, wol-shell shows a sheet with who asks and what will change, in plain words: Deny, Always Allow (per helper and kind of change, journaled; wol helpers forget <helper>), Allow Once. Administrator changes ask for the password every time and run in the shell, never in the helper. Requests queue (4 waiting at most); no answer in 50 s is a no; without a session nothing changes. One audit record per call.
.wol app packages (ADR 0011, archicture/modules/packages.md): one file holding Info.json, a pkg(8) package and a SHA-256 manifest, signed with Ed25519. wol install <file.wol|app|package>, wol remove, wol list, wol search (App Store catalogue and the package index), wol update apps. wol-admind wol-install verifies its own copy, installs dependencies from FreeBSD pkg and pkg adds the payload after a restore point; an unsigned package needs the password every time, a bad signature or hash is refused. wol-remove deletes the package and dependencies nothing else uses. Packages and the index come from github.com/wonderlandos/wol-packages.
WolKernel (kernel/README.md): the kernel is named WolKernel in uname -i, About and the boot menu; uname -s stays FreeBSD (pkg ABI, ports, Linux ABI). Config is GENERIC plus HZ=1000 (VMs default to 100) and no debug options, one reason per line. kernel/check.sh dry-runs the build on any host; an extra patch that does not apply now stops the kernel or DRM build (exit 3) instead of being skipped.
Wi-Fi (archicture/modules/wifi.md): MediaTek MT7921/MT7922 driver built with WolKernel (802.11a/b/g; not yet run on the card). Qualcomm ath10k/ath11k/ath12k and MediaTek MT7925 have no working FreeBSD 15.1 driver: their firmware is no longer shipped and wol hw says why. The Wi-Fi doc lists the link each card gets.
NVIDIA (archicture/modules/hardware.md): driver 595 for Turing and newer, 580 for Maxwell/Pascal/Volta, Kepler reported unsupported with the reason. First boot installs it online and loads it with modesetting (wol hw boot --online; tunables set with kenv before the module loads), so the first login already runs on it. The session names only installed NVIDIA libraries (GBM, GLX, VA-API nvidia-drm; was nvidia, a driver that does not exist); wol-realtime gpu offload prints one app's PRIME offload environment; render nodes are matched to GPUs by PCI id, so driver load order no longer swaps them. Not yet run on NVIDIA hardware.
wol about reports the kernel (kern.ident) and the base (FreeBSD 15.1-RELEASE-pN) separately.
Apps look like WolOS apps (archicture/modules/app-theming.md): Files, Calendar, Calculator, Clocks, Papers, Disk Usage and Text Editor get the Kit toolbar (52 px glass bar, 13 px semibold title, 24 px controls), a source-list sidebar with the accent pill, 10 px cards with hairlines, segmented view switchers, glass menus, popovers and sheets, in every theme, light and dark. Metrics come from one place shared with the Kit (shared::theme::scaffold). Window buttons are 12 px circles 22 px apart, first centre 23 px from the window edge in GTK 3, GTK 4, Firefox and the title bar (GTK 3 had 28 px). The accent replaces libadwaita's blue palette too (Clocks, Calendar). Files selects with the accent; Calculator has card keys; Text Editor's bar is 52 px like the rest. GTK 3 apps (Mail, Photos, Notes, Archive Manager) get the same 52 px bar, accent sidebar pill, accent selection and 6/10 px radii. Firefox hides the bookmarks toolbar by default.
Games (archicture/modules/games.md): Steam is in Apps, Search and the App Store, and steam:// links open it. Its first start says "Getting Steam ready" while the Steam client downloads (linux-steam-utils), then Steam's own updater runs. In a game's Properties > Compatibility, "WolOS Proton (native wine-proton)" runs Windows games on wine-proton, a native FreeBSD Wine, with DXVK, vkd3d-proton and dxvk-nvapi from an installed Proton of the same version; only the Steam client uses the Linux ABI. wol games doctor checks the Linux ABI, linux-steam-utils, wine-proton, 32-bit support, Vulkan, NVIDIA and DXVK and prints the exact fix for each problem; wol games steam-setup writes the tool. Double-clicking a .exe or .msi runs it on wine-proton in its own prefix (wol-run --exe). The image turns on what the Steam client checks (unprivileged chroot, real interface names, nullfs). .wol Proton targets no longer require the Linux ABI. Not yet run on real hardware.
Super is Command (⌘), as on a Mac (desktop/README.md): ⌘C/V/X, ⌘Z/⇧⌘Z, ⌘A/S/O/P/F/G/T/W/N/R/L and ⌘+/−/0 reach the app in front as its own Ctrl key (a terminal gets Ctrl+Shift+C/V, so ⌘C never interrupts a running command; ⌘W closes a terminal without tabs). Held keys repeat. The Hyprland fork sends these keys in any layout and puts the held modifiers back (patch 0006). System shortcuts are the Mac ones: ⌘Space Search, ⇧⌘3/4/5, ⌃↑ and ⌘↑ Overview, ⌘Tab, ⌃⌘Q lock, ⌥⌘Esc Force Quit Applications (pick an app, Force Quit), ⌃⌘Space Emoji & Symbols, ⌃F2 and ⌃F3 put the keyboard in the menu bar and the Dock (Esc gives it back). No system shortcut takes a plain ⌘ letter any more (Control Center, Notifications, Files, light/dark and lock had ⌘A/N/E/⇧T/L; tiling float is ⌥⌘F). Settings > Keyboard Shortcuts lists the App commands group.
Notification banners leave with Esc or a swipe; Esc closes Notification Center. Banners show an app's buttons (two at most, e.g. Restart after a driver install) and stay until one is chosen; a click on the banner runs the app's default action. System notices carry the WolOS mark.
wol wallpaper set and Settings change the desktop picture at once (the desktop showed one fixed picture); Dynamic follows the time of day.
Screenshots (⇧⌘3/4) are saved to the Desktop; the banner says "Screenshot saved to Desktop" and shows the picture instead of its path.
Power follows the power source (ADR 0014, archicture/modules/power.md): wol power apply runs on AC changes (devd), at boot and after resume. It picks the Speed Shift preference per CPU, the powerd flags only where powerd runs, the deepest idle state, and Wi-Fi power save on battery. Low Power and High Power Mode override it (wol power mode auto|low|high). On battery the display turns off after 2 minutes and the computer sleeps after 10. Every sleep locks first. PCI devices without a driver are powered down.
Restart, Shut Down and Log Out ask first, with a 60 s countdown. Sleep, Restart and Shut Down work for standard accounts too: the account at the computer needs no password, unless another account has a session. Notifications appear at 20, 10 and 5 % battery, and at 3 % the computer sleeps. A notification appears when the startup disk is under 5 % free.
Wi-Fi join and forget, Wi-Fi and Bluetooth power, pairing and the power mode need no password for the account at the computer (logged in the audit log). Hidden networks can be joined. Network names and passwords may contain quotes and backslashes.
On by default (ADR 0015, archicture/modules/security.md): the firewall (inbound blocked except replies and local discovery), no remote login, the system log off the network, and kernel hardening (other accounts' processes hidden, kernel messages for root only, no hard links to others' files, random PIDs). The compositor refuses direct screen copy, cursor position and input capture to apps, and loads plugins only from the system folder. wol security and wol firewall on|off|status.
Updates are checked daily in the background (packages, known vulnerabilities, FreeBSD fixes) and only downloaded. One "Updates Available" notification per check says when security fixes are included. Update Now installs FreeBSD fixes and packages after a restore point. FreeBSD's updater never replaces WolKernel. wol update status.
Encrypted homes (off by default): each account can have its own encrypted ZFS home, opened at login with the login password and locked at logout.
System Settings, complete: 24 panes in six groups with search (Wi-Fi, Bluetooth, Network, Notifications, Sound, General with About, Software Update, Storage, Date & Time, Language & Region, Login Items and Sharing, Appearance with every theme as a preview card, Accessibility, Control Center, Desktop & Dock, Displays, Wallpaper, Effects & Looks, Widgets, Battery, Lock Screen, Privacy & Security, Users & Groups, Keyboard and Keyboard Shortcuts, Trackpad & Mouse, Printers, Hardware, Assistants & Automation, Restore). Effects & Looks shows a live picture of the desktop and Looks that set every effect at once (WolOS, Compact, Focus and more; import and export your own; Custom once you change one), then each effect on its own: corners, space around windows, blur strength and quality, glass, window opacity, border width and gradient colours, shadows, dimming, open and desktop animations and their speed. Changes apply at once, and heavy blur on integrated graphics gets a quiet hint. Every change from Settings is journaled: a toast offers Undo right away, and Restore lists recent changes (with who made them) and restore points to start from. Hardware lists each device with its driver and fixes what is missing in one click. About names WolKernel and the FreeBSD release. Controls without a working backend are not shown.

0.11.1

Login window and Setup use the GTK cairo renderer (no GPU renderer dependency before login); wol-shell stderr goes to $XDG_RUNTIME_DIR/wol-shell.log; the console no longer forces 1920x1080 (panel native mode).
Wi-Fi (archicture/modules/wifi.md): offline repo ships Intel iwlwifi (7000..sc, incl. ax210 for ADL CNVi 8086:51f0), Realtek rtw88/rtw89, Qualcomm ath10k/ath11k and MediaTek mt7921/7925 firmware (~21 MB). New rc.d wolos_wifi (before netif, every boot): loads the driver for the wireless NIC present, creates wlan0 on the first net.wlan.devices entry, creates /etc/wpa_supplicant.conf if missing and sets ifconfig_wlan0="WPA DHCP" if unset, so Setup Assistant and Control Center Wi-Fi have an interface.
First real-GPU session fixes: GTK apps use the cairo renderer (GSK_RENDERER=cairo; the default renderer never mapped the shell, Setup or login windows on the passthrough iGPU); foot config uses [colors-dark] (foot 1.28 rejects [colors]) and JetBrains Mono; fontconfig maps monospace to JetBrains Mono (it resolved to Font Awesome).
Login and Setup screens: no Hyprland banners (guiutils missing, launched without start-hyprland); seen on the first real-GPU boot.
Installer never offers the boot media: libexec/wolos/install-disks skips disks holding ufs/FreeBSD_Install, iso9660/WOLOS or a Ventoy stick (msdosfs/VTOYEFI), plus cd/md (the Ventoy stick was eligible).
Live ISO (ADR 0009): the default boot is the WolOS desktop, autologin as live, all writes in memory (rc.d wolos_live: tmpfs unionfs over /etc, /usr/local/etc, tmpfs /home). "Install WolOS" in the dock runs the unattended installer; the old installer console needs set wolos.install=1 at the loader prompt.
wolos_gpu: a panel backlight left at 0 after the driver loads is raised to 80 (passthrough boot ran the whole desktop on a dark panel); a non-zero level is never changed.
i915 fork patch 0002: when no VBT is found (firmware param, OpRegion, ROM), i915 loads /boot/firmware/i915/vbt.bin if present. A VFIO-passed-through laptop iGPU gets no OpRegion under OVMF, so the eDP panel stayed black; copy the host VBT (/sys/kernel/debug/dri/*/i915_vbt) there. Real hardware never reaches the fallback.
Compute and power limits (archicture/modules/intel-graphics.md): wol-realtime power show|set --pl1 W --pl2 W reads/writes Intel RAPL package limits (MSR 0x610; refuses a locked MSR). vkpeak ships for Vulkan compute and GPU bandwidth peaks (no Intel OpenCL runtime on FreeBSD). verify-gpu.sh runs it and A/B's PL1 firmware vs 15 W.
Memory bandwidth (ADR 0007 accepted, archicture/modules/memory-bandwidth.md): wol-hypr records every frame (time, damaged px) in a realtime ring; wol-realtime hypr stats prints p50/p95 µs, damage %, full-screen frames and derived bytes/frame. wol-realtime gpu caps|sample prints GPU freq range, FBC state and RAPL graphics energy (i915: lindebugfs + cpuctl; other drivers: nulls). Firefox decodes video with VA-API by default.
i915 driver fork (ADR 0008, kernel/drm): drm-kmod drm_v6.12.85_3 + patch: a request still running at its vblank deadline is boosted (set_deadline), waitboost only for the frontmost process (compat.linuxkpi.i915_wol_waitboost=2, pid from wold). Ships as drm-fork.tar over pkg drm-612-kmod (locked). verify-gpu.sh gains A/B runs (waitboost, deadline boost, INTEL_DEBUG=noccs) with RAPL watts per side.
build-in-vm: copy-back is resumable and sha256-verified (image/vm/fetch.sh; a 3.5 GB ssh cat once stopped at 2.8 GB).
Menu bar with no focused window shows no app name and no app/Window menu (was "Files", an app that was not running). Switcher fails closed: it does not open when the compositor does not answer or no window is open (drew "No open windows" over an open window when the Hyprland query failed).
Intel graphics (archicture/modules/intel-graphics.md): the offline repo ships i915 DMC/GuC/HuC firmware (gpu-firmware-intel-kmod-alderlake, tigerlake, rocketlake, meteorlake), VA-API iHD (libva-intel-media-driver), vulkan-loader and proof tools (mesa-demos, vulkan-tools, libva-utils, glmark2, vkmark). /boot/loader.conf.d/wolos-i915.conf pins the i915 "unsafe" params at driver defaults (GuC off: FreeBSD shutdown hang). wol-session now sources wol-realtime gpu env (AQ_DRM_DEVICES; LIBVA_DRIVER_NAME=iHD on i915/xe). image/hw/verify-gpu.sh (also /usr/local/libexec/wolos/verify-gpu.sh) writes the native-boot report to /var/log/wolos-gpu-report.txt. test-install.sh uses a scratch install.raw and never deletes a kept disk.raw.
wol-run: Proton output redirected to a file was lost (Proton ntdll closes seekable std handles). Proton targets now relay seekable stdout/stderr through pipes (tests/relay.rs). image/vm/test/compat.sh --iso packs the compat run for the installed disk.
Icons: no SVG <filter> in design/icons (grey shadow box behind Files/Notes in GTK, Qt, Firefox). App icon depth is baked as offset translucent copies (design/tools/gen.py); store icons stripped with design/tools/nofilter.py; tests/icon_filters.rs guarded it until v0.12, replaced by the GTK render check (design/tools/icons/gtkcheck, tests/icons_v2.rs). Avatars are fixed squares centred in their row (were 32x40 pills); the layout check fails any non-square .avatar.
Performance (archicture/modules/performance.md, design/tools/perf): status refresh is 1 s only while a panel watches, else 10 s with 60 s TTLs (wol-shell idle 0.27 ms/s, 1.8 wakeups/s); volume keys run wol shell show osd, which reads audio on demand; Control Center is a resident shell panel (wol shell toggle control-center, Super+A; 27 ms to frame, no growth over 200 opens); vendored blocking 1.7.0 lets idle pool threads exit (ADR 0006); wolos-perf.conf moved to the overlay and is now sourced; wol shell spawns write the shell socket directly; WOL_SHELL_TIMING adds dock/wallpaper map and Search per-key times.
Menu bar: placeholder File/Edit/View/Go/Help menus removed. The bold app menu has About <App> (shell panel), Settings… (apps that open preferences on Ctrl+,), Hide <App> Super+H, Hide Others Super+Alt+H, Quit <App> Super+Q; the Window menu has Minimise Super+M, Zoom, Fill, Centre, Move to Desktop 1-4. All of them run wol-app <verb> (new binary), and the keybinds call the same verbs (Super+Q now closes every window of the app, Super+H hides all of them).
No Hyprland nag banners: wol-session launches start-hyprland (watchdog); fork patch 0003 drops the .conf deprecation notice; misc:disable_hyprland_guiutils_check (guiutils is not shipped). WOLOS_SHARE overrides the defaults dir (live tests).
Fork patch 0004: Hyprland advertises minimise, and a client's minimise button moves the window to special:hidden (libadwaita drew it disabled). wol-hypr raises the window that becomes active (switcher and menu focus left floating windows behind).
Live fixes, title bars and window placement (Hyprland 0.56.2 + hyprbars 7644cec): traffic lights now close/minimise/zoom left to right in kit colours, 12 px, centres 22.5/44.5/66.5 px (were green-yellow-red, 20 px apart); double-click on the title zooms; GTK CSD apps (no xdg-decoration) are tagged wol-csd by wol-hypr and get no hyprbars bar (was a double title bar); new floating windows are placed by wol-hypr after the layout pass (centred, 1/3 down the area between menu bar and dock; the move rule is gone); open/close animations use the realtime curves (220 ms ease-out, 180 ms ease-in, no spring overshoot); the Settings window is named "System Settings" in the menu bar and marks its dock pin running (pin id is now org.wolos.settings).
Live fixes, screenshot: bar bottom-centre and thumbnail bottom-right (anchors were left/bottom-left); wol-screenshot keeps wl-copy off stdout (the shell waited forever and never showed the thumbnail); capture waits 150 ms and the bar/thumbnail have no fade-out, so neither lands in the shot; Return captures.
Live Hyprland 0.56.2 fixes: wallpaper and Overview span the whole output (exclusive zone -1); blur layer rules match the real namespaces (^(wol-menubar|wol-dock|wol-panel-.*|...)$, ignore_alpha 0.3); menu bar shows the focused app on shell start; switcher hides before focusing (Hyprland refocused on unmap); wol shell accepts overview, screenshot, switcher-prev (panel list now shared::shell::PANELS); Overview thumbnails per window via wol-window-shot (hyprland_toplevel_export_v1).
One look for every app: wol theme set (and Dark Mode / Appearance in the shell) regenerates GTK4/libadwaita CSS variables, GTK3 adw-gtk3 colours, qt6ct Fusion palette and foot colours from the active theme into ~/.config/wolos/toolkits, links them from ~/.config (never over user files) and pushes gsettings (color-scheme, accent, Inter, left window controls). Defaults ship in /usr/local/share/wolos. Firefox policies.json: no telemetry/studies/sponsored home, follows the system theme.
Notification banners: 344 px glass cards top-right with app icon, app name + time, bold title, body clamped to 2 lines; slide in from the right; one banner per app with stacked edges and "N more notifications".
Screenshot toolbar (Super+Shift+5): glass bar with Capture Entire Screen / Window / Selection, Record Screen / Selection (wf-recorder, now in packages.txt), Options (save to Desktop or Pictures, 5/10 s timer); a 5 s thumbnail bottom-right opens on click and drags as a file. wol-screenshot gains window, record, record-region, stop, --dir, --delay and prints the saved path; old full|region|clip unchanged.
Overview (Super+Up, 3-finger swipe up): wol-shell overview surface with blurred wallpaper, desktops strip and an aspect-preserving window grid with grim thumbnails (ADR 0005; hyprexpo is not in the plugins pin).
App switcher (Super+Tab): glass strip of 64 px app icons grouped by class in MRU order, accent ring + name on the selection; Tab/Shift+Tab cycle, releasing Super focuses (show switcher|switcher-prev, hide switcher).
Lock and login window: blurred WolOS wallpaper (night in dark, day in light), 200x28 glass password pill with submit arrow, shake + message on failure. Login window: user tiles, Back, Sleep/Restart/Shut Down.
Notifications: zbus connection kept; NotificationClosed emitted on expiry (1), click dismiss (2) and CloseNotification (3), once per id.
wol-shell startup: product icon theme pinned (WolOS, Adwaita in dev) instead of the host user's; app icon textures cached; WOL_SHELL_TIMING=1|exit prints stage times. First map median 233 -> 122 ms (10 runs, release, broadway).
Lock/login light mode: dark ink on the day wallpaper; pill, placeholder, error (13 px medium) and captions meet 4.5:1, measured from golden pixels.
Login window Sleep/Restart/Shut Down go through wol-login (!sleep|!restart|!shutdown, ADR 0003); wire in shared::login.
First boot: wol-login runs the setup assistant (wol-setup) when no user exists; !setup-create-user, !setup-wifi (ADR 0004). firstboot no longer prompts for a user in bsddialog.
wol-setup: setup assistant UI (Welcome, Language & Region, Keyboard, Wi-Fi, Account, Appearance, Done); goldens at 1280x800 and 1024x640.
Setup assistant polish: content-sized 560 px cards, 36 px rows showing whole rows (layout check flags cut rows in whole-rows lists), Wi-Fi signal/lock icons, accent avatar above the fields, per-field problems, Done without Back.
First session applies setup.json keyboard; Auto appearance follows time of day (dark 19:00-07:00); setup writes the user theme for Light/Dark; login window shows the password hint after 3 failures.
shell --features layer-shell needs gtk4-layer-shell >= 1.2.
App switcher: glass strip of 64 px app icons grouped by class in MRU order (Hyprland focusHistoryID), accent ring and name on the selection; Super+Tab / Super+Shift+Tab cycle, releasing Super focuses. Socket: show switcher|switcher-prev, hide switcher commits.

0.11.0

Rust workspace (ADR 0002): shared contracts (QoS ABI, jobs, admin wire, theme tokens, bundle Info.json, events, error codes, sys, par), core (System API, theme, jobs, admin, bundle, update), api (wold, wol-admind, rc.d), controller (wol, wol-login, wol-authcheck), proxy (wol-run), realtime (wol-realtime: Hyprland IPC, event bus, QoS boost, GPU env, C ABI for plugins/wol-hypr).
Architecture test enforces shared <- core <- adaptors.

0.10.0

Initial monorepo: identity, desktop overlay, image build.

Pages

Manual

What changed, release by release.