Roadmap — Language Milestones (M) and CosmoOS Integration Milestones (C)

Status: written at the end of M0/C0 (2026-10-22), kept current since (last 2026-10-28). Rule: no milestone is complete because a demo runs. Each one requires its acceptance criteria, positive and negative tests, updated docs, and an updated risk register (master prompt §22).

Ordering

M0/C0 ─► M1 ─► C1 ─► M2 ─► M3 ─► C2 ─► M4 ─► M6 ─► C3
                                   │            └─► M7 ─► M8 ─► C4 ─► C5 ─► C6 ─► C7 ─► C8 ─► C9 ─► A5
                                   └─► M5 (after M4)      M9 (after M7 + correctness baseline) ─► M11 ─► M10 ─► M12 ─► M13

M11 came before M10 at the owner's order (2026-10-26). A5 is CosmoOS's own roadmap unit, written in Nova inside CosmoOS once C9b had put Nova sources in its tree.

Milestones and acceptance criteria

#	Scope	Acceptance (measurable)
M0/C0 ✅ 2026-10-22	Research, architecture, specs, audits	This document set. All decisions accepted (ADR 0002)
M1 ✅ 2026-10-22 Minimal compiler	Lexer, parser, AST, primitives, locals, functions, arithmetic, conditions, loops, semantic checks, HIR, NIR, LIR, C emission, executable	See milestone-1.md: ≥ 150 corpus tests, generated C clean under strict warnings, clang + gcc host runs agree, both CosmoOS triples compile, determinism check
C1 ✅ 2026-10-22 Native Hello World	M1 output linked against CosmoOS libc and run in QEMU (S0, out of tree)	NOVATEST: PASS printed by the Nova program inside CosmoOS on x86-64 and AArch64. .note.cosmo present. llvm-nm -u shows only libc symbols. Exact flags recorded. No CosmoOS file modified (git status clean)
M2 ✅ 2026-10-22 Ownership & borrowing (milestone-2.md)	Structs, enums, references, moves, init check, NLL borrow check, drop elaboration, drop, using, defer, slices of arrays	Each of O1–O5, B1–B5, E1–E4 has ≥ 2 compile-fail and ≥ 1 near-miss compile-pass test (≥ 120 total). Drop-order run tests. Mutation suite. ASan/UBSan clean
M3 ✅ 2026-10-22 Safe heap (ADR 0003: built-in Result/Box/allocators)	Allocator, SystemHeap, Box, AllocError, Result/?, FailingAllocator, recursive types, iterative drops	Fault-injection sweep: for every test that allocates n times, run with failure at each k ≤ n; no leaks/double frees under ASan. Ex4, Ex5, Ex11, Ex14 pass
C2 ✅ 2026-10-22 Safe allocation in CosmoOS (report)	M2+M3 features in Profile A	Allocation, destruction and fault-injection tests pass inside QEMU on both arches
M4 ✅ 2026-10-22 Regions (ADR 0004)	Arena, Scratch, FixedBufferAllocator, Pool	Compile-fail: every arena-escape form (return, store in Box, outlive via reset/drop). Run tests for bulk release. R2 enforced
M5 ✅ 2026-10-23 Escape/placement analysis (milestone-5.md)	CFG analysis, classification, --explain-allocations, Box→stack demotion	Optimised vs unoptimised outputs equal on the whole run-pass corpus. Drop timing identical (instrumented). Report snapshots. No program accepted only because of placement
M6 ✅ 2026-10-23 Generics & collections (ADR 0005)	Monomorphisation, interfaces, Vector, String, StringView, StableVector, SlotMap, iterators. OD-3 design	Invalidation compile-fail tests. Property tests of collections against a model. Ex9, Ex10, Ex12, Ex13
C3 ✅ 2026-10-23 Collections & syscalls (report)	Files, sockets, processes in Profile A; a useful utility (candidate: a wc/sha256sum-class tool or a hexdump)	The utility runs in QEMU on both arches, with output compared to the C/BusyBox equivalent on a test corpus
M7 ✅ 2026-10-24 Production C backend (plan)	Source maps, structured C, Csmith-style fuzzer, NIR reference interpreter, MSVC best-effort	24 h fuzz campaign with no miscompile across clang/gcc × O0/O2. Interpreter agrees with native output
M8 ✅ 2026-10-24 Systems/freestanding (plan)	core library split, FFI, raw pointers, MMIO types, custom entry points, freestanding profile	Freestanding object with no libc: verified by llvm-nm -u allowlist
C4 ✅ 2026-10-24 Freestanding in CosmoOS (report)	Nova kernel-profile object built with kernel flags	Symbols, relocations and sections checked against the module loader allowlist. Frame sizes ≤ 2 KiB. No FP registers (disassembly check)
C5 ✅ 2026-10-24 Kernel memory adapter (report)	KernelHeap, ObjectCache<T> bindings; isolated test component	In-kernel selftest: allocation, exhaustion (fault-injected), ownership transfer, cleanup. No allocator modifications
C6 ✅ 2026-10-24 Controlled kernel component (report: LZ4, fbvalid)	One small, non-critical component reimplemented beside its C original (candidate chosen with the owner)	Same test suite passes for both. Performance compared (measured, reproducible)
C7 ✅ 2026-10-25 Kernel concurrency (report)	Effects, SpinLock<T>/Mutex<T> guards, KRef, QuiesceGuard, PerCpu, deferred reclamation	Negative effect tests. Lockdep clean under QEMU stress. Real concurrency rules exercised
C8 ✅ 2026-10-28 Experimental module (C8a 2026-10-25; C8b against CosmoOS itself once its hook was merged, #457; report)	Nova .ko with generated shutdown()	Load/unload loops (≥ 1000) with no zombie modules, leaks or lockdep reports, on both arches. Signing via modsign.py
M9 ✅ 2026-10-25 Performance (report)	Optimisations with preconditions; benchmark suite vs C/C++/Rust/Zig/Goose	Each optimisation: equivalence tests + measured gain. Published methodology. No claims without data
M11 ✅ 2026-10-26 Language gaps (plan and report)	The gaps M9's suite and the README's tour ran into: nested patterns, for over non-Copy elements, borrow-checker precision, small conveniences, if/match expressions, references to optionals; floats and closures after an ADR each	Each gap: spec, positive and negative tests, the probe that showed it now passing
M10 ✅ 2026-10-26 Tooling (plan and report)	Formatter, docs generator, language server and VS Code extension, debugging integration; then modules and packages (path and git dependencies) after an ADR	Each tool: spec, tests, and the repository's own code kept passing it (novac fmt --check)
C9 Gradual adoption (C9a, C9b ✅ 2026-10-26: GPT in Nova, merged into CosmoOS; report)	Evaluate further components	Per-component ADR
A5 ✅ 2026-10-28 CosmoOS features in Nova: CPU time and nice values (#461, #476, #477 merged; report)	CosmoOS roadmap 1.2 A5's kernel lines (LX-13, LX-14) written in Nova: CPU-time timers, then nice values, then a weighted share	Tests written first; CosmoOS's matrix on both arches; merged by the owner
M13 ✅ 2026-10-28 The documented gaps (plan and report)	Vector and string growth; dynamic dispatch (OD-10) and owning closures (OD-9b); userland threads with a data-race guarantee; checker generality; a package registry and version solver	Each gap: the probe that showed it now passing, spec, positive and negative tests; G2, G4 and G6 after an ADR each; performance on the suite (benchmarks/)
M14 proposed 2026-10-29 Nova for a kernel written in Nova (plan)	What CosmoOS's roadmap 2.0 (proposed) needs: global and per-CPU state (K1), typed calls across compilation units (K2), a kernel library (K3), novac for a self-hosted build (K4), hot-path performance (K5), an outside audit (K6), the compiler as trusted base (K7)	Each item's acceptance in milestone-14.md; K1 and K2a ship in Nova 0.2.0
M12 ✅ 2026-10-26 Tooling for AI agents (plan and report)	JSON diagnostics with fixes, novac fix/explain; novac mcp; llms.txt and the agent guide	Each fix resolves its diagnostic on the corpus; an MCP client test covers every tool and the sandbox; the guide's examples compile

Next highest-priority task

Every milestone above is complete (2026-10-28), C8 last: its 1,000-cycle test passed against CosmoOS itself on both arches once CosmoOS had merged the hook (cosmoos/c8-report.md). C9 stays open by design: each further component is its own decision with the owner. Next, at the owner's choice:

• M14, if CosmoOS adopts its roadmap 2.0 (plan, proposed 2026-10-29): what a kernel written in Nova needs from Nova. First K4's decision and K2a (for the roadmap's SA1), then K1 and K3 (for SA2 and SA3).

• CosmoOS roadmap 1.2. A5's kernel lines in Nova are done (#461, #476, #477; cosmoos/a5-report.md); the rest of A5 (OpenSSH and git with their test suites) and A2 are CosmoOS ports, not Nova work. Further components in Nova follow C9's rule: a per-component decision with the owner.

• The open decisions M13 left: OD-25 (ADR 0018), OD-9a's performance need (ADR 0019), OD-24 (ADR 0021) and OD-9c (ADR 0020) are done; OD-9a's language question (closure types, Fn bounds) and OD-26 were re-examined on 2026-10-29 and stay deferred, as do OD-10a and OD-10b (open-decisions.md).

• What is left of the slow workloads: vector-growth is at parity with C since M13's G1, and string-building is 1.26× (clang) and 1.40× (gcc) C since the ASCII boundary checks and short appends (2026-10-28, optimisations.md §2.9).

• When the owner wants it, the S1 in-tree port for C1 (OD-20).

Where things are: CosmoOS's Nova sources live in CosmoOS beside the C they generate (kernel/block/gpt.nova, kernel/process/cputime.nova, kernel/process/nice.nova, kernel/scheduler/fair.nova), built by its make nova with a pinned novac (cosmoos/build-integration.md §3.1). integrations/cosmoos/ keeps the Nova-side scripts that check them (c1.py to c9.py) and no CosmoOS source.

Progress log

Completed work, oldest first; the table above has each milestone's status and report. Each entry, and each milestone report's "Not done" list, records the state when it was written; a later entry or report says what changed since. Where the same report later supersedes its own list (M13), the list says so.

M1 and C1 are complete (2026-10-22).

• Nova compiles its M1 subset to C.
• The test suite passes on macOS (clang) and Linux CI (clang and GCC).
• All 70 run-corpus programs run natively inside CosmoOS on x86-64 and AArch64 (cosmoos/c1-report.md).

M2, ownership and borrowing, is done (2026-10-22; milestone-2.md). It delivered:

• 2a, structs;
• 2b, references and the NLL borrow checker;
• 2c, move types, drop, move checking on NIR, drop elaboration with flags, using, defer;
• 2d, enums with payloads and match, fixed arrays, slices, bounds checks, for, and the mutation suite.

M3, the safe heap, is done (2026-10-22; milestone-3.md; ADR 0003). It delivered:

• 3a, Result<T, E>, ?, !;
• 3b, Box<T, A>, SystemHeap, FailingAllocator, runtime allocation accounting, and the fault-injection sweep;
• 3c, moves out of boxes, consuming match, and tail-iterative destruction.

Heap programs run inside CosmoOS on both arches with its libc malloc.

C2 is done (2026-10-22; cosmoos/c2-report.md): integrations/cosmoos/c2.py runs the whole corpus and a guest-side fault-injection sweep inside CosmoOS on both arches.

M4, regions, is done (2026-10-22; milestone-4.md; ADR 0004):

• scoped results;
• Arena, FixedBufferAllocator, LIFO scratch frames and Pool/PoolBox, all following R1/R2;
• the fault-injection sweeps, which cover region allocations.

M6, generics and collections, is done (milestone-6.md; ADR 0005):

• 6a, generics (checked once, monomorphised), done 2026-10-22;

• 6b, interfaces, impl, bounds, done 2026-10-22;

• 6c, optionals T? and StringView, done 2026-10-23;

• 6d, Vector<T, A> and String<A> (Ex9, Ex10), done 2026-10-23;

• 6e, SlotMap<T>/Handle<T> and StableVector<T>, done 2026-10-23.

• 6f, model-based property tests, the invalidation suite and the OD-3 design (od3-design.md), done 2026-10-23. M6 is complete (acceptance results in milestone-6.md).

M6x, region parameters (OD-3), is done (2026-10-23; milestone-6x.md; ADR 0006): references in structs, enums, generic instances and collections, checked by signature flows and one loan set per value.

C3 is done (2026-10-23; cosmoos/c3-report.md): files, TCP sockets, processes and program arguments (type-system §26), and nwc, a Nova word counter that matches BusyBox wc byte for byte inside CosmoOS on both arches (integrations/cosmoos/c3.py).

M7, the production C backend, is complete (2026-10-24; milestone-7.md). 7a, source maps, is done (2026-10-23): #line directives (--line-directives, -g), host-path-free source paths, and a line-table test. 7b, structured C, is done (2026-10-23): if/else, loops and switch reconstructed from the NIR graph, with the flat form kept as an oracle (--flat-c).

7c, the NIR reference interpreter, is done (2026-10-23): novac run --interp agrees with native code on the whole run corpus, the allocation-failure sweep and the I/O programs, and faults on uses of ended or uninitialised memory.

7d, the random program generator, is done (2026-10-23): tests/Nova.Fuzz. Its first runs found a C name collision with the runtime, a borrow-checker false positive and four kinds of warnings in generated C, all fixed.

7e is done (2026-10-24): generated C builds with MSVC in CI (test-windows), and a 24-hour campaign (423,773 programs through clang and GCC at -O0/-O2, the flat form and the interpreter) found no miscompile; its one finding kind, a clang warning on a constant slice index, is fixed.

M5, escape and placement analysis, was done in parallel (2026-10-23; milestone-5.md): non-escaping SystemHeap boxes on the stack with --placement, --explain-allocations, equal outputs and identical drop traces.

M8, systems and freestanding support, is complete (2026-10-24; milestone-8.md, ADR 0007: a hybrid core library). 8a is done (2026-10-24): unsafe blocks, expressions and functions, raw pointers *T and *mut T, the Safety: rule, and interpreter faults for invalid accesses through pointers. 8b is done (2026-10-24): extern "C" declarations, @export, @repr(C) structs and @repr enums, a generated nova_exports.h, and C files in a build.

8c is done (2026-10-24): --profile freestanding rejects what needs the hosted runtime, links only the core runtime, and --emit obj makes one object whose only undefined symbols are nova_panic, the memory functions and the package's own C functions, on the host and both CosmoOS triples.

8d is done (2026-10-24): lib/core (bundled Nova sources: Volatile<T>, MmioPtr<T>, address types), volatile accesses, C function pointers, @align, @noncopy, Cpu.spinHint() and target queries; Ex18 runs, and builds as a freestanding object.

8e, the acceptance, is done (2026-10-24): freestanding objects for both CosmoOS triples have only allowlisted undefined symbols and no constructor, TLS or unwind sections, mutable globals or COMMON symbols.

C4 is done (2026-10-24; cosmoos/c4-report.md): a freestanding Nova object built with CosmoOS's own module flags meets every structural rule of its module loader (ELF, relocations, exported symbols), keeps frames under 2 KiB and touches no FP register, on both arches; eight negative controls are rejected.

C5 is done (2026-10-24; cosmoos/c5-report.md): user-defined allocators (Allocator, Layout in lib/core; for Box), KernelHeap over kmalloc/kfree, and an out-of-tree, signed test module whose in-kernel selftest (allocation, real and injected exhaustion, ownership transfer, cleanup) passes in CosmoOS on both arches. ObjectCache<T> waits for statics or scoped cache boxes.

C6a is done (2026-10-24; cosmoos/c6-report.md): CosmoOS's LZ4 codec in safe Nova, beside kernel/core/lz4.c. CosmoOS's own host test and fuzz target pass for both, a differential test finds no mismatch in 20,000 cases, and the object meets the kernel checks on both arches. A bug planted in the offset check panics in Nova and goes unnoticed in sanitizer-free C. Performance is measured (benchmarks/lz4/): 0.48–0.78 of C for compression, lower for literal-heavy decompression.

C6b is done, and with it C6 (2026-10-24; cosmoos/c6-report.md): imported C struct types (type-system §31, ADR 0008) and CosmoOS's framebuffer validator in Nova over CosmoOS's own kernel/bootinfo.h. CosmoOS's host test and fuzz target pass for both. The differential test reaches all 11 answers with no mismatch, and the object meets the kernel checks on both arches. A header that disagrees with a Nova declaration fails to compile, naming the field. With clang the port costs what C costs (benchmarks/fbvalid/).

C7 is in progress (cosmoos/c7-report.md, ADR 0009; the owner chose C state embedded by value). Its increments: C7a context effects, C7b embedded C state, C7c lock guards, C7d kernel objects and quiescence, and C7e the in-kernel stress test under lockdep. QuiesceGuard in modules (blocked on KQ-2), PerCpu<T> and statics are left out, with reasons. C7a is done (2026-10-24): sleep/alloc effects inferred over the package and checked in @context(atomic|irq) functions, under live @context(atomic) values, and against @effects bounds (type-system §32).

C7b is done (2026-10-24): C state embedded by value (type-system §33): imported C types as fields, C-laid-out types made in place in boxes and never moved, zero-filled C fields, and @placed initialisers at the final address.

C7c is done (2026-10-24): SpinLock<T>, IrqSpinLock<T> and Mutex<T> over CosmoOS's own locks, with private fields (type-system §12) so the data is reached only through a guard; sleeping under a spin guard does not compile; a host test over CosmoOS's spinlock shim passes, and the objects meet the module loader's rules on both arches (c7.py).

C7d is done (2026-10-25): @callback and raw boxes (type-system §34), KRef<T> over CosmoOS's own struct kobject, and grace periods (Quiesce.synchronize, deferDrop). A final put under a spin guard does not compile, and the host test runs against CosmoOS's real object.c.

C7e is done, and with it C7 (2026-10-25; cosmoos/c7-report.md): a Nova module in CosmoOS's debug build runs four kernel threads over 4 CPUs on Nova locks, kernel objects and grace periods, with every total exact, no lockdep report, CosmoOS's 507 selftests passing and a clean shutdown, on both arches. Lockdep catches the lock-order inversion that Nova does not check, and an unlocked control counter loses updates. QuiesceGuard (KQ-2) and PerCpu are left out.

C8a is done, C8b validated against the proposed hook (2026-10-25; cosmoos/c8-report.md): a Nova module (a timer, a kernel thread and a shared kernel object, torn down by dropping its state) loaded at boot on both arches; 1,000 load/unload cycles with nothing left behind in a hook-patched copy of CosmoOS; a leaked reference makes the module a zombie. Three findings for CosmoOS. C8 closes when the hook is in CosmoOS.

M9a is done (2026-10-25; milestone-9.md, benchmarks.md): fifteen workloads in Nova, C, C++, Rust, Zig and Goose with matching checksums, a runner measuring time, memory, allocations, compile time and size, and a baseline on the Ryzen under clang and gcc. Nova is within 1.25× of C on 7 of 15 workloads with clang; its largest gaps are the byte-loop copy (13–17×), vector growth and string building (1.9–4.4×), and the larger nodes of optional boxes. Writing the suite also fixed a parser gap and a trigraph in emitted layout assertions.

M9b is done (2026-10-25; milestone-9.md, type-system §16.5): checked bulk operations copyFrom and fill on SliceMut (one length check, then memmove; a byte fill is a memset), and memcpy in vector growth. On the Ryzen:

• memory-copy is 1.06× C under clang and 1.67× under gcc, where gcc inlines C's constant-size copy;
• vector growth under gcc is 2.11× C, down from 4.41×;
• LZ4's literal decompression is 0.89–0.97 of C, up from 0.02–0.03.

It also found a flaw in the 9a workload: clang had merged C's block copies into one, so the blocks are now permuted.

M9c is done (2026-10-25; optimisations.md §2, ADR 0010): bounds-check elimination, a NIR dataflow that removes index checks earlier checks or loop and guard tests prove, with --no-bce and --explain-bounds-checks.

• The interpreter checks every removal on every run, and the run corpus and fuzzer also build with the analysis off.
• The owner added a rule to the unsafe contract: a pointer made from a reference cannot write after its target's next direct use. It is what makes vector lengths trackable.
• The analysis removes 14 of LZ4's 21 checks, which makes its decompression 1.32× faster under gcc. Under clang nothing changes: clang already removed them, and gives byte-identical binaries.
• The suite shows no change beyond noise.

M9d is done (2026-10-25; optimisations.md §3, c-backend.md §5–§6): overflow-check elimination in the same analysis (--no-oce, --explain-overflow-checks), and the cause of the gcc gap found and fixed.

• The analysis removes 35 of LZ4's 50 overflow checks and 91 of the suite's 151. With them gone, clang vectorises LZ4's match copy: records decompression is 3.44× faster under clang, 1.24× under gcc.
• fbvalid's gcc gap (1.76× C since C6b) was the zero-initialisation of every aggregate local, which gcc keeps. Locals are now zeroed only where needed, and the port is at 1.06× C under gcc.
• Check locations are per-site constants passed by pointer, so a passing check no longer loads its location under gcc (data-oriented 0.76 of its 9c time).
• The fuzz campaign found a gcc -Werror warning, now fixed. A rerun of 11,581 programs found nothing.
• Recorded, not fixed:
  • memory-copy under gcc (C's constant-size memcpy is inlined);
  • LZ4 under gcc moves by up to 25% with code placement alone;
  • numeric measured 1.14× slower under clang in the suite, which did not reproduce outside it.

M9e is done (2026-10-25; memory-model.md §5.1, optimisations.md §4): placement is on by default (--no-placement).

• As M5 left it, placement placed no box in the suite. It now also places boxes created in a loop when they die within the iteration.
• heap-alloc makes 1 allocation instead of 10,000,001, and runs 1.30× faster under clang (0.92 of C) and 1.16× under gcc. The other workloads' C is unchanged.
• The interpreter now reports a placed site reused while its box is alive, and a placed box destroyed twice.
• Allocation counts are the one thing placement changes, allowed for SystemHeap only (optimisations.md §4.2).

M9e′ is done (2026-10-25; type-system §22.1, c-backend.md §2): 9a's F4 and F6.

• Box<T>? and borrow T? are now one pointer, null for null. Nodes and peak heaps are C's size: binary-trees peaks at 12 MiB (was 20), and arena at 3.1 (was 4.6).
• Box.create builds its argument in the box's memory, with no temporary and no by-value copy. large-objects under gcc is 3.49× faster, now 0.84 of C.
• Gains under gcc: arena 1.77×, heap-alloc 1.31×, linked-list 1.22×. Under clang: arena 1.39×, binary-trees 1.17×.

M9 is complete (2026-10-25; milestone-9.md, 9f). The whole suite was rerun in eight languages and modes.

• Nova takes 0.93–2.44× C's time under clang (median 1.17), 1.02–3.54× under gcc (median 1.40), and 0.99–2.27× under MSVC on ARM64 (median 1.18). At 9a it was up to 17× (memory-copy).
• Each switch's share was measured. LZ4's decompressor needs both check eliminations to vectorise under clang (3.4×), and placement gains 1.16–1.29× on heap-alloc. Differences under about 15% are this shared machine's noise.
• string-building and vector-growth remain the slowest (2–3.5×).

M11 is complete (2026-10-26; milestone-11.md). The owner put language gaps before tooling.

• Done: nested patterns, for over non-Copy elements, borrow-checker precision (F1), character literals, explicit overflow arithmetic, String.appendNumber, if/match expressions, references to optionals (F2), f32/f64 (ADR 0011) and function values, closures, effect lists on function types and closure-taking library methods (ADR 0012), with benchmarks/sort and nbody, a sixteenth suite workload.
• The acceptance re-ran every gap's probe; one found an older backend bug (Result<S, IoError> with a struct S), fixed.
• Against M9's acceptance nothing regressed: Nova takes 0.89–2.45× C's time under clang (median 1.19) and 0.96–3.50× under gcc (median 1.46), and the rows that moved were the same with 9f's compiler, interleaved. A 60-minute campaign found nothing.

M10 is complete (2026-10-26; milestone-10.md). Six tools, each with a spec and tests, kept passing by the repository's own code:

• novac fmt;
• novac doc (docs/api/core.md);
• novac lsp and editors/vscode, built with Vite+;
• the lldb and gdb commands of editors/debug;
• names across packages and nova.toml packages with path and git dependencies (ADR 0013).

The C generated for every existing program is the same as at M11's acceptance, apart from one source line number.

C9a is complete (2026-10-26; cosmoos/c9-report.md, ADR 0014). CosmoOS's GPT parser and writer in Nova:

• the language additions: array fields of imported C structs, arrays of imported types, @cname, pointer arithmetic on imported types, constant arrays and exported constants;
• integrations/cosmoos/c9/gpt.nova, with gpt.h's own structs, unsafe only in the exported wrappers;
• c9.py: CosmoOS's test_gpt and fuzz_gpt pass with both implementations, the differential test finds no mismatch in 20,000 cases (23 of 24 refusal reasons reached; the 24th cannot be reported, finding 1), and the object meets C4's checks on both arches;
• benchmarks/gpt: parity with C under clang, faster under gcc.

M12 is complete (2026-10-26; milestone-12.md), at the owner's request ("MCP or any better feature AI agents can depend on"):

• diagnostics as JSON with fixes the compiler is sure of, novac fix and novac explain, and quick fixes in editors;
• novac mcp, an MCP server with a checker, fixes, the formatter, a sandboxed interpreter, the C generator, and the embedded specification;
• llms.txt, llms-full.txt and an agent guide whose ten common mistakes are compiled by SiteTests.

C9b is complete (2026-10-26; cosmoos/c9-report.md). CosmoOS's GPT parser and writer are Nova in CosmoOS itself: kernel/block/gpt.c is novac's generated C (stage S1, checked in, written then by c9/vendor.py), with Nova's runtime and a panic hook per environment. Local checks on both arches (host-test, fuzz, analyze, debug and release boots with blk-gpt) and CosmoOS's CI (47 of 47) passed; the owner merged it (68925d14).

novac 0.1.0 is released (2026-10-26; docs/release.md): NativeAOT binaries for Linux, macOS and Windows on x64 and ARM, the macOS ones signed and notarized, installed by site/public/install.sh and install.ps1 (https://github.com/vkuttyp/Nova/releases/tag/v0.1.0). main is 0.2.0-dev.

CosmoOS A5, PR 1 is built (2026-10-26; cosmoos/a5-report.md). The first CosmoOS feature written in Nova rather than ported: kernel/process/cputime.c is novac's C for cputime.nova (the tick's user/system sample, ITIMER_VIRTUAL/ITIMER_PROF, the exact user/system split), with the process side in C. Its test (lxtest) failed 27 checks on the unchanged kernel first; host-test, fuzz, analyze and debug and release boots pass on both arches.

The CosmoOS Nova sources moved into CosmoOS (2026-10-27; cosmoos/build-integration.md §3.1), at the owner's choice, folded into A5's first PR (#461): each NAME.nova beside its generated NAME.c, make nova with a pinned novac (0.1.1), and a CosmoOS CI job that fails on drift. integrations/cosmoos/vendor.py is gone; c9.py and benchmarks/gpt read the sources from a CosmoOS checkout, and benchmarks/gpt now takes the C original from dc1d5166 (run after C9b, it would have compared the generated C with itself; its published numbers predate C9b).

CosmoOS A5's kernel lines are done (2026-10-28; cosmoos/a5-report.md): nice values with Linux's rules (#476, kernel/process/nice.nova) and a weighted fair share at the default level (#477, kernel/scheduler/fair.nova), after PR 1's CPU time (#461). None needed a language change.

C8 is complete (2026-10-28; cosmoos/c8-report.md). CosmoOS had merged the module-cycle hook as #457 (2026-10-26), so c8.py --cycles 1000 now builds CosmoOS itself: 1,000 load/unload cycles pass on both arches with every count back to its start, no lockdep report and 522 selftests, and the zombie control is refused 3 of 3. A stale output directory, built from the patched copy, first made a kernel of two trees; c8.py now starts one afresh for another tree. The same day the roadmap's status text was brought up to date with A5, C9b, M13 and C8.

OD-25: fork-join threads (2026-10-28; ADR 0018, type-system §38.6). Thread.both(a, b) runs two closures on two threads and returns when both are done, so they may borrow the caller's data; no new borrow rule, a capture rule extending Send and Share to references inside the call only. It scales as C's same split on the Ryzen box (1.79× and 3.10× on 2 and 4 threads, against C's 1.80× and 3.26×; Nova 1.03–1.08× C's time), and runs in CosmoOS on both arches. A SliceMut field that a use moved instead of reborrowing was found on the way and fixed first.

OD-9a: direct closure calls (2026-10-28; ADR 0019, optimisations.md §5). A measured need (calls through the comparator were a third of benchmarks/sort's time) met without a language change: the compiler makes a variant of a closure-taking function for each closure body it is called with, and calls through a known closure become direct. benchmarks/sort is 34% faster under clang and 28% under gcc on the Ryzen box, at 1.13× and 1.20× the same introsort in C. On by default; --no-closure-specialisation and --explain-closure-calls.

string-building's gap (2026-10-28; optimisations.md §2.9, c-backend §2). Two causes, each found by timing a hand-edited copy of the generated C first: a character-boundary check on every slice of the ASCII digit text, which cannot fail and is now removed under --no-bce's switch, and gcc's memcpy call for every one-byte append, now a byte loop up to 16 bytes. On the Ryzen box the workload went from 1.58× to 1.26× C under clang and from 2.58× to 1.40× under gcc.

An independent review of closures and threads (2026-10-29; type-system §13.2–§13.3, risks R-1). Three reviewers, each given the code and not a conclusion, wrote programs against M13's closures, dyn, threads and Thread.both. Two holes were real, each shown by a program the checker accepted and ASan or ThreadSanitizer then caught: a borrow mut or SliceMut field read through a shared reference gave mutable access (present in 0.1.1), and the field reborrow of 2026-10-28 did the same. Both are refused now (N0248). The reviewers were the same model that wrote the code, so this is not the human or outside audit the priorities ask for.

P3: atomic orderings and closure-argument effects (2026-10-29; ADR 0021, ADR 0020). benchmarks/atomics showed the need for weaker orderings: a ring between two threads spent most of its time in x86-64's full barrier on every sequentially consistent store. lib/std's atomics gained loadWith, storeWith and the other …With methods, and the ring became 4.5× (clang) and 6.0× (gcc) faster on the Ryzen box. Inline atomics, a further 1.8×, are OD-27. @effectsOf(p) gives a function the effects of the closure it is given, so sortBy, any and the others may run in atomic and interrupt code with a closure that neither sleeps nor allocates. Adapters of named functions now call them directly. Closure types with Fn bounds, and several versions of one package, were re-examined and stay deferred.

novac 0.1.2 (2026-10-29; release.md, "Point releases"). The shared-path soundness fix, backported to the release-0.1 branch from 0.1.1, whose compiler accepts the reviewers' program and whose C for it is a use after free under ASan.

M14 begins (2026-10-29; milestone-14.md). CosmoOS adopted Nova prerequisites in its roadmap 2.0 (#487), and the owner started M14. K2a: novac build --split writes a C file per Nova file, so a 202,000-line program builds in 14.0 s on ten cores instead of 33.8 s on one, and in 2.4 s after a one-file change (ADR 0022). K4: CosmoOS source releases carry the generated C (ADR 0023). K1: static and static mut items, built at compile time by @constant constructors and C constant macros, and used through a hidden reference with the static region, so no new borrow rule was needed (ADR 0024, type-system §39).

M14 K3 and novac 0.2.0 (2026-10-29; ADR 0025). lib/kernel, the library for a kernel with CosmoOS's C API, ships inside novac and is selected by --kernel cosmoos or kernel = "cosmoos": the kernel heap, spin locks and mutexes that hand out their data only through a guard (spin locks also in statics), preemption and interrupt guards, per-CPU values, counted kernel objects and quiescence. k3.py checks it against CosmoOS's headers on both architectures; it has not yet run in a booted kernel. A static mutex and ObjectCache are open (ADR 0025 §7). novac 0.2.0 carries M13, ADR 0018–0021, --split, statics and lib/kernel.

M14 K5 and K7, ADR 0027, and novac 0.3.0 (2026-10-29). The atomic types are in lib/core for every profile, their operations static inline in rt.h (ADR 0026): the ordered ring within 1.24–1.34× of inline C. Enum values whose payload may hold a pointer are built by constructors, so clang's analyzer follows a box's allocation. ADR 0027: p.read()/p.write(v) for any type, layoutOf<T>(), here in static initialisers, and lib/kernel's static Mutex and ObjectCache<T>. The random program generator writes statics and kernel-style programs built freestanding against their hosted twin. CosmoOS's nova-kcore self-test runs lib/kernel in every debug boot (CosmoOS #489). novac 0.3.0 carries all of it. 0.3.1, a point release the same day, fixes ObjectCache.setUp's alignment, which CosmoOS's boot found.