One of the broadest weeks yet — nearly every layer of the pure-Rust stack moved at once. The JavaScript engine crossed 93% of the official conformance suite. Two data engines advanced in parallel, a key-value store and a SQL database. The crypto floor deepened, an HTTP server landed to sit opposite rsurl, the UI toolkit was renamed — and, the surprise, the work reached into actual hardware with FPGA gateware and USB Power Delivery.

kataan: 93% of test262

kataan — the pure-Rust JavaScript engine that will power the argus browser — spent the week grinding through test262, the official ECMAScript conformance suite, and reached roughly 41,000 of 44,189 tests passing (~93%). That number is the story: a from-scratch JS engine at conformance parity with the mainstream engines on most of the language.

The commits are the long tail of spec fidelity that gets you there: lexically scoping the with-statement object environment, Promise.resolve/reject using NewPromiseCapability for subclasses, validating the __proto__ setter like SetPrototypeOf, rejecting unescaped control characters in JSON.parse strings, [+In] grammar inside for-headers, regex early-errors, and Array / Object becoming real callable function cells — each fix flipping another few dozen tests green against a re-blessed ledger.

pebbledb: a Pebble port

pebbledb is a Rust port of CockroachDB's Pebble, the LSM key-value engine in the LevelDB / RocksDB lineage. The stated goal is a complete port — 100% of the functionality and the on-disk format — and the week pushed it to broad parity: WAL, background flush and leveled compaction, snapshot-consistent bidirectional iteration with bounds and prefix seek, range keys, value blocks and blob files, checkpoints, and external-sstable ingestion.

The interoperability bar is the real thing: it writes table-format-v7 columnar sstables that Pebble reads, and reads value-separated databases (format 24) that Pebble writes, both directions. It also grew MinLZ block compression on the in-house minlz-rs, async and flushable-ingest paths, ApplyNoSyncWait, lazy value fetch, and the limited / next_prefix iterator family.

graphitesql: a pure-Rust SQLite

graphitesql is a pure, safe, no_std-capable Rust re-implementation of SQLite as a single crate, aiming for byte-for-byte compatibility with the SQLite 3 file format. It's been running at roughly a hundred commits a week; W26 was a heavy push on the query engine. It opens real SQLite files and creates databases that sqlite3 opens with PRAGMA integrity_check = ok, checked differentially against the real sqlite3 CLI (a 1,600+ query corpus plus 360+ focused suites). License is the blessing (public domain).

The week's throughline was the VDBE — SQLite's register-machine bytecode engine, which graphitesql runs by default, falling back to a tree-walker only for shapes it can't yet compile. W26 moved a long list of shapes onto the VDBE: window functions over joins / derived tables / CTEs / views / table-valued functions, json_each / json_tree sources, sibling-CTE and compound FROM sources, and non-correlated subquery folding. Alongside it, ALTER TABLE learned cross-object propagation — a RENAME COLUMN rewriting dependent triggers, views, and nested subqueries; a DROP COLUMN refusing to break a dependent view — with a batch of prepare-time correctness checks (rejecting unknown columns / functions across joins and subqueries, comparing integers exactly above 2⁵³ instead of through f64).

usbmagic: a turn into hardware

The week's surprise is usbmagic — a Rust library and CLI for programmable USB test instruments, the first being the Cynthion (a Great Scott Gadgets FPGA board) — plus usbmagic-gateware, the FPGA gateware itself (an ECP5, doing a USB 2.0 host controller). This is the stack reaching past software into the wire.

The host side is built on nusb (pure-Rust USB, no libusb), and the week went deep and low-level: a Rust-native Apollo client and a JTAG transport over it (hardware-verified IDCODE read), ECP5 SRAM configuration over JTAG that flashes a real .bit bitstream, an in-gateware I2C master driving an FUSB302B USB-PD controller, and then USB Power Delivery end to end — capturing and decoding real Source_Capabilities (including PPS), driving TARGET-C VBUS, and negotiating a spec-timed PD Rev 3.0 exchange with an iPhone, with full bidirectional pcapng traces. A forensic device API can issue deliberately non-compliant traffic.

httpsd: the server side of rsurl

httpsd is a pure-Rust HTTP server — HTTP/1.1, HTTP/2, and HTTP/3 — with a sans-I/O core and pluggable runtimes (blocking thread pool, tokio, or mio). Where rsurl is the client on the pure-Rust stack, httpsd is the server: a library with your own handler, or a CLI that serves a directory or a TOML config. It ships with ACME (automatic TLS), privilege drop, per-IP connection limits, and graceful shutdown with SIGHUP cert reload. Much of the week was security: five HTTP/2 DoS findings, HTTP/3 field-section limits, correctly anchored QUIC loss-recovery timers, routing on the percent-decoded path, and a race-free confined open for static files (TOCTOU / symlink-escape).

stipple: forma, renamed — compositor and theming

The forma UI toolkit was renamed to stipple this week. It finished the piece the browser needs: a cross-platform compositor with zero-copy GPU frame sharing — dma-buf via DRI3 / Present on Linux (with frame-sync wait-fences), a shared IOSurface on macOS, and a shared texture handle on Windows — plus content-process compositing over a CPU shm path and a seccomp sandbox for the content process. On top: Material 3 (Material You) dynamic-color theming, and full accessibility element trees over AT-SPI (Linux), UI Automation (Windows), and NSAccessibility (macOS). This is the rendering-and-isolation groundwork a multi-process browser sits on.

Also this week

• purecrypto kept a hundred-commit pace of its own (v0.6.23 → v0.6.25): new hash functions (Streebog, Whirlpool, MarsupilamiFourteen, MD2), server-side TLS 1.2/1.3 version negotiation from the ClientHello, QUIC peek_initial_sni for HTTP/3 cert selection, Falcon post-quantum signature hardening, and PQC PKCS#8 that now interoperates with OpenSSL 3.5.
• libwallet took a broad security-audit pass (0.4.68 → 0.4.70): SSRF guards on RPC URLs, homograph guards on names, hardened FFI lifecycle with panic recovery and secret zeroing, swap slippage clamps and execute tripwires, and MEV-protection opt-out.
• minlz-rs — the MinLZ codec pebbledb depends on — got its own push.
• rsurl and puressh kept advancing their torrent and certificate work from the last two weeks.
• The OxideAV per-codec sweep continued across the audio/video/container crates (mpeg4video, vorbis, mp4, mov, vp9, …).
• azusa-kernel — the AzusaOS kernel repo appeared, alongside last week's 5fs filesystem.

Next week

kataan keeps closing the last few percent of test262. pebbledb reaches full Pebble parity. httpsd and rsurl become a matched client/server pair on the pure-Rust HTTP stack. usbmagic keeps climbing the USB stack now that it can talk to the hardware.