Built to beatthe frontier.

Every system change becomes a new numbered generation, and the newest ten stay in the boot menu, so a bad change is undone by starting the one before.

Generation 117 running on 29 Oct 2026, with 10 kept bootable.

The kernel stays pinned to the build that was proven, and profile changes leave the kernel and early-boot image untouched. Updates can apply without a reboot when the kernel is unchanged; a kernel update still needs a supervised reboot.

The first live security update closed 66 known vulnerabilities, added none and needed no restart (26 Sep 2026).

Every hour, at idle priority, d0 history keeps an encrypted, deduplicated version of what the person writes, thinned to 24 hourly, 30 daily and 12 weekly versions. They are on the same disk and are not a backup. They guard against deletes and overwrites, not against a failed drive.

62 versions kept at 08:53 on 30 Oct 2026, after the nightly thinning; the hourly run at 07:58 took 46 s.

Right-click a file and choose Previous Versions: an earlier copy is restored next to the file, never over it.

The firewall is on by default, and remote sign-in accepts keys only: no passwords and no root account.

One box in the shell for apps, files, maths, units, system commands and settings, with emoji on Super+. (full stop). It lives in the shell itself, so it opens without starting an app.

Copied text and images come back with Super+V. Anything a password manager marks secret, and anything copied while the screen is locked, is never recorded.

Drag a box over anything on screen and its text lands on the clipboard, recognised on this computer in English and German.

Speak, and each phrase is typed at the cursor when you pause. Speech is transcribed on the laptop’s own graphics chip, in English or German, and nothing is written to disk.

A 6.6 s clip transcribes in 1.24 s on the laptop’s graphics chip, against 4.6 s on its processor (measured on this laptop, Sep 2026).

Captions for whatever the computer is playing appear in a glass bar above the taskbar, transcribed on the device, with optional translation into English. Nothing leaves the computer and nothing is kept.

A caption appears 1.1–1.35 s after each phrase ends (measured with synthetic speech, v58, Sep 2026).

Steam runs Windows games through Proton and keeps its firewall holes closed. It starts in its own memory group, so a big download is charged to Steam, not to the desktop.

A desktop freeze on 26 Sep 2026 was traced to a 60 GB download charged to the compositor’s own memory group.

Network printers appear in every print dialog by themselves, and USB printers and scanners work without drivers. The print service listens only on this computer, and the browsing service behind the 2024 remote-code-execution chain stays off.

Verified with a real network printer and its flatbed and document-feeder scanner on 26 Sep 2026; before that, the OS could not print at all.

Miracast over Wi-Fi Direct or the network, and Chromecast, all with hardware H.264. A D0 patch serves the stream only to the device being cast to and adds a 720p–4K resolution setting.

Send files to phones and computers on the same Wi-Fi (iPhone, Android, Mac, Windows) from the app or a right-click in Files. Nothing listens unless the app is open, and every incoming transfer asks first.

Firmware for the laptop and its dock arrives through the standard Linux firmware service.

Video decodes on the graphics chip’s media engine instead of the processor. GPU firmware offload is on, and framebuffer compression stays off because it caused flicker.

One directory of people and groups signs them in to the server desktop, remote desktop, the admin console and joined machines, and the last administrator cannot be removed.

Eight role groups and a last-admin guard went live on 7 Oct 2026.

People sign in to their own full desktop on the server from the D0 app or from Windows’ built-in Remote Desktop Connection. Only Remote Desktop Users and administrators get in, every attempt is audited, and a refusal never reveals whether an account exists.

Key press to screen ≈51 ms, and 47 screen updates per second while content moved, in a 1920 × 1080 bench test on a 6-vCPU server without a graphics card with the d0 look, 27 September 2026.

Every five minutes the server closes remote login screens that a dropped client left behind, but only when no live connection belongs to that user.

Its first run closed three abandoned login screens while their owner stayed connected (29 Sep 2026).

D0’s own remote desktop app checks and remembers each computer’s identity, signs in with the D0 directory account, stays sharp at any window size and disconnects cleanly.

A web console in D0’s light and dark themes, with status tiles for every role and pages for users, certificates, devices, remote desktop, alerts, licences, backup and more.

Its 8 Oct 2026 release passed 139 automated browser checks.

Rule edits, acknowledgements, sign-ins and remote sign-ins land in an audit trail that accepts entries only from the system itself, so an ordinary user cannot forge one.

Seats for products such as remote desktop or the vault are assigned to people or groups from the directory. Stale assignments are listed, not silently deleted, and a missing licence file is refused, not started fresh.

Every licence change is written durably, with at least two fsyncs, as checked under strace (27 Sep 2026).

Server changes and restarts are refused while anyone is on remote desktop, at a remote login screen or in a Server Manager tab, unless an administrator overrides the guard with a recorded reason. Admin prompts ask for the administrator’s own directory password.

A team password vault behind directory single sign-on. Only licensed members get in, and every sign-in and every refused password grant is written to the audit trail.

A real sign-in test with a password and a one-time code passed 9 of 9 checks in 76 s (27 Sep 2026).

Administrators switch their role on only when they need it, and approved management actions run from the console.

The server scores its own configuration against a set of checks, lists findings by severity and records exemptions.

Encrypted backups of server state and home folders. Every role checkpoints itself first, and a failed copy keeps the last good one and raises a warning.

Scheduled, sandboxed runbooks with redacted output, plus roles for apps, deployments with maintenance windows, containers, databases, network, logs and file shares, each with its own console page.