# SMP guests, scoped Cap\<Fs>, generational GC, and a fail-closed security sweep

> On main since rc2: SMP guests, scoped Cap\<Fs>, generational GC, and a fail-closed security sweep. Four threads of work landed in the same week.

Source: https://kern-lang.eu/releases/smp-guests-scoped-fs-generational-gc

On main since rc2Four threads of work landed in the same week

## Release notes

### Multi-vCPU guests

The microVM monitor gained SMP: `microvm_create_smp` spawns a VM with _n_ vCPUs, each its own KVM vCPU on its own host thread, with per-vCPU CPUID topology and an Intel MP 1.4 floating-pointer table the monitor writes so the guest kernel discovers every core. Block-image volumes mount into the guest under the same capability that gates the VM itself, with a copy-on-write rootfs so tenants share a base image without writing to it, and an ext4 image writer, written in pure Kern, that produces the disk from a directory.

### Scoped `Cap<Fs>`

`fs_scope(fs, root)` confines a filesystem capability to a single directory: every path is resolved component by component via `openat(O_DIRECTORY|O_NOFOLLOW)`, so an absolute path, `..` or a symlink pointing outside is `Err`, never a read or write outside. The root is pinned by device and inode, so renaming the directory and planting an impostor at the same path is refused. Scopes nest.

### Generational GC

A nursery collects short-lived values without scanning the full heap, auto-GC is on by default, and a write barrier promotes nursery values stored into old-gen collections. Alongside it: HTTP thread pool, `str` length cache, GC lock elision, zero-copy `str.split`, in-place list append (the compiler lowers `xs = xs + [e]` to an append), and single-pass code emission, taking bootstrap from 35 seconds to 14.

### C-layer fail-closed sweep

Two systematic passes across every C leaf in HTTP, TLS, sync, event log, KMS, netlink, Redis, MQTT and WebSocket, converting every "succeed on error" path to a fail-closed return. A static-analyser sweep, an `init_globals`\-per-TU fix and a W0003 SSRF lint round out the hardening.