The smp multidomain example registered the package in dune-project but
its dune-generated .opam was left untracked; commit it so the package
resolves like its siblings.

The Xen runtime's wait now takes an absolute deadline; the store-ring
block callback waits until the port fires, which is deadline 0 (no timeout).

A device-less unikernel that spawns two extra OCaml domains with Domain.spawn, runs a CPU-bound Fibonacci on each and the main domain, and joins them. It boots on the mirage-eio scheduler alone and demonstrates that the OCaml 5 multicore runtime brings up more than one domain under a unikernel; the cram test checks the fixed join results so it stays deterministic across targets and host core counts.

The XenStore-over-a-real-ring guest was buried under
mirage/lib/eio/xen-runtime/xs-boot with a private run.sh. Move it to
unikernels/bin/xen/xenstore as a proper unikernel producing
unikernel.xen, so it boots with the standard flow --
XEN=~/git/xen/xen/xen mrg run -t xen unikernels/bin/xen/xenstore
-- instead of a hand-rolled script. It still links only the hypercall
runtime and nox-xen, not the full device library.

unikernel-crunch depends on eio directly, so monopam lint wants the pin
recorded in its opam template like the other unikernel packages.

Embed a small directory tree with eio-fs-crunch and rebuild it in memory at boot without declaring a block device. Cover the native output and empty manifest in Cram, register the cross-target build rules, and include the generated demo.

Wait for the SSH server description the guest currently emits before starting the client, and report startup failure instead of spinning forever.

Synchronize the SSH server cram setup on the description line the guest now emits, and fail with its log instead of looping forever if startup exits.

The TCP table contains the held client and the current query connection; the prior query is pruned once it reaches CLOSED, so the subsequent table summary remains at two live rows.

Start the SSH, SQL, and gRPC clients in readiness order so their ephemeral ports are deterministic. After SQL closes, assert that CLOSED has been pruned from the live TCP table.

Wait for the appliance startup marker, which follows frame-socket acquisition, before running the LAN peer. Surface the firewall log if the guest exits during startup.

Synchronize setup on the guest lease log before treating the published echo port as ready, and fail with the guest log if the process exits during startup.

Match the committed generated Dune registry with the current Mirage generator output.

The backend-neutral device description should not live under Eio or expose a Solo5-shaped ABI. Model runtime resources as optional singleton devices and pass normalized runtime metadata to applications, allowing each backend to project the capabilities it needs.

Lead with working animations, overlay installation, public command names, and the native/cross-build workflow. Organize examples by domain and describe what each demonstrates.

Drop internal cram/GIF generation mechanics and low-level backend narration from the user-facing overview.

Add native and cross-target iperf3 examples for both ends of the guest TCP stack. Drive each against the stock implementation in forward and reverse mode with bounded setup and transfer timeouts.

Embed reviewed GIFs generated from the passing crams; their visible summaries show the traffic direction, duration, and stream count without unstable host-specific throughput values.

The git-client and git-server sources no longer depend on nox-notafs-eio, but their committed cross-build arms still listed it. Regenerate the arms so they match the sources.

Each demo composes its devices with Mirage_eio.(run [...]) over the block/dir device leaves, and its run instructions invoke the unikernel-<name> package rather than a dune-path .exe. Client and server partner cross-references follow the network/ layout.

Each recording rule produces one GIF, so declare it with Dune's singular target field. This makes the enabled REGEN path compatible with the singular target variable used by vhs-cram.

Replace the combined files demo with one read-only tar asset example and one writable FAT persistence example. Each has its own package, cram transcript, generated backend stanzas, and GIF recorded from that transcript.

Move the Git client/server and etcd examples beside the storage devices they demonstrate. Update the generated-Dune registry and catalogue paths without changing their installed command names.

The one-shot scheduler programs had no statistical harness, baseline, regression threshold, or result consumer, and the guest comparison had lost its Miou half. Remove them rather than shipping unstable CSV as a supported benchmark.

Remove the dependency-sink unikernels package. Assign the detection model, gRPC schema, tests, and native helper executables to the examples that ship them, with direct package dependencies.

Publish the live TCP SQL catalog and terminal tree as nox-tcp-eio sublibraries. Their implementations and tests now live beside the stack they inspect instead of in the unikernel example tree.

Move the allowlisted network policies out of unikernel examples and publish them as nox-mirage.eio.caps. Drop the misleading Caps.dir wrapper; examples now compose Fs.v with their block device directly.

Move notafs-extract out of the unikernel support directory and publish it from the existing nox-notafs-eio package. SQLite-based examples can now inspect their block images without depending on repository-private tooling.

Replace the centralized example registry with local vhs-cram rules driven by each example transcript and setup script. The repository-wide alias now aggregates naturally, and the SQL shell keeps its wider frame.

Mirage_eio.Net_device stuttered (Net_device.net) and repeated its own qualifier. Alias it Mirage_eio.Net -- still a module alias, so -no-alias-deps keeps the TCP stack out of a unikernel that names no net device -- and rename the Eio.Net.t constructor to v: net stuttered under the new module and intf collided with the netif primitive. The unused Mirage_eio.Net = Tcp_eio.Net layers alias gives way; its two internal users take Tcp_eio.Net directly.

The nine examples that ride a layer below TCP -- eth, ipv4, ipv6, udp and dns --
depended on nox-tcp-eio and wrote Tcp_eio.Net.Udp, because that package used to
carry every layer. It no longer does, so they name the package that owns their
protocol: Ethernet_eio, Ip_eio.V4/V6, Udp_eio. A UDP guest no longer pulls in a
TCP stack to send a datagram.

net.mli's layer modules become aliases of those packages rather than abstract
re-declarations, so the types are the packages' own and a caller holding a stack
can still reach them; the facade's endpoint closure moves out of Udp, which is
now literally Udp_eio.

The UDP layer was built over an Ipv4 layer and nothing else: its datagram type
named Ipaddr.V4.t addresses, send took a V4 destination, and the facade's
datagram socket answered an IPv6 one with "IPv6 UDP is not supported". So the
device called udpv4v6 carried v4 only, and udp-client had to narrow its --server
and reject an IPv6 peer -- a limitation of the layer, showing up as a line in
every caller.

UDP is one port space over both families -- the datagram and its checksum are the
same either way, and the codec already takes an Ipaddr.t for the pseudo-header --
so the layer now holds an optional Ipv4 and an optional Ipv6, registers its demux
on each, and routes a send by the destination's family (raising only if it has no
layer of that family). udp_over_netif takes the v6 address and runs both on the
one Ethernet reader; the udpv4v6 device takes each family's boot args and hands
back the dual-stack layer its name promised.

udp-client's narrow is gone, and the Eio.Net datagram socket now works over IPv6.
Verified both ways against host echoes: 127.0.0.1 and ::1.

The address args went through Mirage_eio.Arg last commit; the HOST:PORT ones --
every client's --server, and the vaccel guests' --agent -- still arrived as
strings and were split in the body, six of them with their own error message.
They now use Arg.host_port, so the body destructures a pair it was handed.

obs-producer's collector_addr helper existed only to do that split and is gone.
udp-client keeps one line of its own, and it is a real one: the stack's UDP layer
rides IPv4 only, so an IPv6 peer has nothing to send from -- a constraint of the
layer, not of parsing.

Across both commits: body address parses 19 -> 0, hand-rolled argument errors
11 -> 0. Verified against the netstack crams.

Nineteen examples took an address as a string and picked it apart themselves,
eleven of them carrying a bespoke error message for it, and one calling
of_string_exn so a typo became a raw exception rather than a usage error. That is
work cmdliner already does, and doing it in the body means every unikernel repeats
it and reports it differently.

Mirage_eio.Arg holds the converters -- ipaddr, ipv4, ipv6, ipv4_prefix,
ipv6_prefix, host, port, host_port -- so an argument is declared for the value it
is ([opt Mirage_eio.Arg.ipv4 ...]) and the body is handed that value. Cmdliner
reports a malformed one the way it reports every other bad option.

net_device.ml had five copies of the same converters inline; they are now the one
set in Arg, which is also what the examples use. Body address parses: 19 -> 0.

Every device constructor took its Solo5 manifest name positionally, so 38 of the
40 examples opened with the same noise: Net_device.net "service". The name is not
a program-facing thing -- the body uses the device by value -- it is the label an
operator binds at the boundary: the tender's --net:service=tap0, and the key
--frame NAME=LOCAL:REMOTE looks up natively. Only a guest declaring more than one
device has anything to say with it.

So it becomes an optional argument defaulting to "service", threaded down through
every wrapper device (arp, icmp, http, tls, ssh, grpc, dns, dtn, sle, vaccel,
bluetooth, happy-eyeballs) as a pass-through, leaving one default in Net_device.
Net_device.net "service" becomes Net_device.net (); the genuinely-named devices
(tm-downlink's "rf", the vaccel "rpc" and "demo" links) say ~name:"rf". The
emitted manifest is unchanged, so the tender binding still works.

nox-websocket had every piece of RFC 6455 -- the frame codec, the reader, the
handshake helpers and the State machine -- but no I/O edge, the one thing every
other protocol here has (Tls_eio, Ssh_eio, Dns_eio, Quic_eio). respond drives the
server side because it owns the HTTP listener; the client side had no home, so
ws-client hand-rolled the upgrade and read a single frame -- no reassembly, no
ping/pong, no close handshake.

Two additions, in the order the complexity belongs:

- core: Handshake.client_request builds the whole RFC 6455 4.1 upgrade request
(request-line, Host, upgrade headers, head terminator), so the caller no longer
formats HTTP by hand. Tested by parsing it back as an ordinary request.
- nox-websocket-eio: the thin edge -- connect runs the upgrade over a flow and
validates the 101, send masks through the state machine, recv drives it
(answering control frames underneath) and yields whole messages.

ws-client drops from 85 lines of protocol plumbing to 44 of application.

ws-server upgrades a GET to RFC 6455 and echoes each message: Mirage_eio.Http
serves a Respond.websocket route, which runs the handshake and drives the
Websocket state machine, so the handler only sees whole messages. ws-client is
the driver the I/O-free Websocket library leaves to the caller --
Handshake.upgrade_headers builds the GET, validate_upgrade_response checks the
101, and encode/decode carry the frames (a client frame is masked). The pair
talks over one raw frame link, no gateway between them.

The gateway NATed every guest echo request, including one aimed at its own
address -- but nothing on the host owns that address, so the echo went to a host
socket for a destination that does not exist and was silently black-holed. A
real gateway answers pings for itself, and this one already answers for itself
on ARP, DHCP, NDP and DNS; ICMP was the odd one out.

handle_icmp and handle_icmpv6 now reply directly when the destination is one of
the gateway's own addresses (v4 gateway_ip, v6 link-local or ULA), echoing the
identifier, sequence and payload back; anything else still NATs as before. Tests
cover both families, and the example comments that documented the old behaviour
as a rule are corrected.

slirp NATs ICMPv6 onto host sockets exactly as it does ICMPv4 -- neither answers
for the gateway's own address, which is why a ping at fd00::1 goes unanswered.
Pointed at a real destination (::1) the NAT works, so ipv6-client gets the same
shape of cram as ipv4-client rather than relying only on the server pair.

Extends the matrix past IPv4: the client frames an ICMPv6 echo on the guest's
own IPv6 layer and reads the reply, and the layer resolves the next hop with
Neighbor Discovery (RFC 4861, the IPv6 analogue of ARP) before the datagram
leaves. ipv6-server is the layer itself -- its built-in NDP and echo responder
answers for its address, so the server is brought up and left to serve, the same
shape as arp-server. The pair talks over one raw frame link, no gateway between
them; slirp answers no ICMPv6 for its own address, so the pair is the test.

The client/server example packages' generated dune-opam manifests were not
committed alongside their directories; add them so each package is installable.

The tcp-server gen arm was generated before fmt was added to its libraries, so
the wasi cross-build copy failed on Fmt; regenerated. Also point the remaining
README references at the SSH console's new path.

The client half of ssh-server: connects over the guest's own TCP tower with
Ssh_eio.Client, authenticates as admin, runs one command, and prints the
console's reply. The pair talks over one raw frame link, so the client drives
the console directly with no gateway between them (whoami -> "admin from
10.0.0.1"). Every stack protocol now has both a client and a server unikernel.